summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-05-09reenable POOL_DEBUGChristian Weisgerber
2020-05-09Log error notifications other than NO_PROPOSAL_CHOSENtobhe
ok markus@
2020-05-09Forcibly ensure that only PSS may be used with RSA in TLS 1.3.Bob Beck
This prevents us from incorrectly choosing a PKCS1 based signature if the client advertises support for them but also prefers them to PSS such as appears to be the case with gnuTLS. ok jsing@
2020-05-09Shuffle and clarify logic creating the contents of resolv.conf.Kenneth R Westerback
No intentional functional change.
2020-05-09Send dummy ChangeCipherSpec messages from the TLSv1.3 serverTheo Buehler
If the client has requested middle box compatibility mode by sending a non-empty legacy_session_id, the server must send a dummy CCS right after its first handshake message. This means right after ServerHello or HelloRetryRequest. ok jsing
2020-05-09Send dummy ChangeCipherSpec messages from the TLSv1.3 client.Joel Sing
When operating in middlebox compatibility mode, the TLSv1.3 client needs to send a dummy ChangeCipherSpec message immediately before its second flight of handshake messages (when early data is not offered). ok tb@
2020-05-09Correct return value check to handle TLS13_IO_EOF case.Joel Sing
2020-05-09Add a middlebox_compat flag and condition session ID randomisation on it.Joel Sing
ok tb@
2020-05-09catch the other place this needs to changeBob Beck
2020-05-09now that 3.1.1 is out the door as a stable release bump the developmentBob Beck
version to 3.2.0
2020-05-09Add support for certificate status requests in TLS 1.3 clientBob Beck
ok jsing@, tb@, inoguchi@
2020-05-09Make the test for the legacy_compression_method vector in the ClientHelloTheo Buehler
stricter. Previously, we would accept any vector if it advertised the "null" compression method. RFC 8446 4.1.2 specifies that the only legal vector has length one and contains a zero byte for the null method. ok jsing
2020-05-09Drop a redundant test. It's effectively doing the same test twiceTheo Buehler
and if the two lengths differed, the later CBS_write_bytes() would correctly fail anyway. Discussed with jsing
2020-05-09On receiving an overlong session ID terminate with an illegal_parameterTheo Buehler
alert. Found with tlsfuzzer. ok jsing
2020-05-09Add support for HelloRetryRequests in the TLSv1.3 server.Joel Sing
ok inoguchi@ tb@
2020-05-09aml_die() doesn't return, hint the compilerJeremie Courreges-Anglas
Avoids an uninitialized variable warning. ok kettenis@
2020-05-09Initialize the srp_ref in the non-MP version of srp_enterJeremie Courreges-Anglas
Silences an uninitialized warning in net/art.c "reasonable" jmatthew@, ok mpi@
2020-05-09crazy whitespace on one lineTheo Buehler
2020-05-09Pull the sending of alerts up into tls13_handshake_perform().Joel Sing
This fixes the case where a send function signals that an alert should be sent, then returns failure. Previously the failure would be propagated up, without the alert being sent. Issued noted by tb@ ok tb@
2020-05-09Use MSI-X interrupts where available. The first vector is used forJonathan Matthew
events and command completions as that's the only vector they can go to. tx/rx queues are mapped to subsequent vectors. ok mpi@ dlg@
2020-05-09Refactor tls13_server_hello_sent().Joel Sing
Split the record protection engagement code into a separate tls13_server_engage_record_protection() function and call this from tls13_server_hello_sent(). Also move some functions around to keep the logical ordering/grouping. ok inoguchi@ tb@ (as part of a larger diff)
2020-05-09No need to look at _STA here, all we care about is _PSR.Jeremie Courreges-Anglas
Rename surrounding code to reflect that. ok kettenis@
2020-05-08Use a union to ensure cmsg buffer is properly alignedJeremie Courreges-Anglas
Fix synced from unwind/libunbound. unwind(8) crash on landisk (strict alignement arch) reported by otto@, original diff ok deraadt@ otto@
2020-05-08Use a union to ensure cmsg buffer is properly alignedJeremie Courreges-Anglas
Fixes a crash on landisk (strict alignement arch) reported by otto@ ok deraadt@ otto@
2020-05-08Remove unneccessary X509_NAME_oneline wrapper. Passing NULL as buftobhe
does the same thing. ok patrick@
2020-05-08Nuke unneeded 'inits' field in struct proposal. 'mtu' being 0 is enough of a ↵Kenneth R Westerback
clue to avoid setting interface mtu.
2020-05-08Nuke 'set but never used' addrs field in struct proposal.Kenneth R Westerback
2020-05-08Use proper function pointer type instead of void *Jeremie Courreges-Anglas
Mixing up function and void pointers isn't defined by POSIX or the C standard. POSIX only specifies that casting the result of dlsym(3) to an appropriate function pointer works. Avoid all this by using a typedef. from Michael Forney, ok tb@
2020-05-08imsg.h needs uio.h, pointed out by deraadtNicholas Marriott
2020-05-08Fix obvious copy-past-O in calculation of maximum length of "Available"Martijn van Duren
column for df subcommand. Fixes misalignment in some cases.
2020-05-08Move parsing of _CRS into acpi(4) and pass the parsed address and interruptMark Kettenis
information in struct acpi_attach_args. ok mpi@
2020-05-08Make sure cmsgbufs are properly aligned by using the idiom from theOtto Moerbeek
CMSG_DATA man page. Avoids SIGBUS on landisk; ok kettenis@ jca@
2020-05-08ld.so(1) also ignores LD_LIBRARY_PATH an friends for set-group-ID executablesJeremie Courreges-Anglas
While here, use consistent casing and don't use .Ev for set-user-ID/set-group-ID. from Miod
2020-05-08LD_DEBUG is ignored for set-user-ID and set-group-ID executablesJeremie Courreges-Anglas
from Miod
2020-05-08Do not use string litterals in the grammar ("{") it is not POSIX compliantClaudio Jeker
and also not needed. This just needs a char lookup ('{') like it is done in all the other rules with '{'. With this parse.y can be compiled with bison. OK otto@ benno@
2020-05-08Just a bit of KNF.Claudio Jeker
OK florian@
2020-05-08Do not wait indefinitely for flushing when closing a tty.Martin Pieuchot
This prevent exiting processes from hanging when a slave pseudo terminal is close(2)d before its master. From NetBSD via anton@. Reported-by: syzbot+2ed25b5c40d11e4c3beb@syzkaller.appspotmail.com ok anton@, kettenis@
2020-05-08fix compilation with DEBUG_KEXDH; bz#3160 ok dtucker@Damien Miller
2020-05-08less ugly upstream namesTheo de Raadt
2020-05-07On receiving a handshake or alert record with empty inner plaintext,Theo Buehler
terminate the connection with an unexpected_message alert. See RFC 8446 section 5.4. Found with tlsfuzzer hint/ok jsing
2020-05-07post-6.7 development continuesTheo de Raadt
2020-05-06openssh-8.3; ok deraadt@Damien Miller
2020-05-06another case where a utimes() failure could make scp send aDamien Miller
desynchronising error; reminded by Aymeric Vincent ok deraadt markus
2020-05-06Currently LibreSSL reports an unknown SSL_internal error. AdjustAlexander Bluhm
regex in test. So make regress passes for the release, the error message will be improved later. discussed with jsing@
2020-05-06Only allow forkmda() to be called from a local action dispatcher.Todd C. Miller
From gilles@, OK deraadt@ jung@
2020-05-06Bump LibreSSL version to 3.1.1Theo Buehler
ok bcook inoguchi deraadt
2020-05-06The error message from LibreSSL has changed. Adjust regex in test.Alexander Bluhm
discussed with jsing@
2020-05-06Same fix for ospfd lsupdate.c applies in ospf6d as well.Claudio Jeker
Do not use the pointer returned by ibuf_reserve() after calling another ibuf function. After the call the internal buffer may have moved by realloc() and so the pointer is invalid. Instead use ibuf_size() to get the current offset in the buffer and use ibuf_seek() later on to write back the updated lsa age into the buffer at the right spot. This fixes an issue seen by Richard Chivers on routers with many passive interfaces. OK stsp@ denis@ deraadt@ also tested by sthen@
2020-05-06Do not use the pointer returned by ibuf_reserve() after calling anotherClaudio Jeker
ibuf function. After the call the internal buffer may have moved by realloc() and so the pointer is invalid. Instead use ibuf_size() to get the current offset in the buffer and use ibuf_seek() later on to write back the updated lsa age into the buffer at the right spot. This fixes an issue seen by Richard Chivers on routers with many passive interfaces. OK stsp@ deraadt@
2020-05-06rpki-client is only interested in real files. Don't tell rsync toClaudio Jeker
preserve symbolic links. Instead just ignore them. OK benno@ deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 11:34:33 +0000