summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-05-02disable base-gcc on amd64; ok jca@ deraadt@Christian Weisgerber
2021-05-02Put -stable template into #if 0 section of current newvers.sh.Alexander Bluhm
OK deraadt@
2021-05-02Initialize per-CPU pointer register earlier.Mark Kettenis
ok patrick@
2021-05-02riscv64, fix HANDLE_ERRORDale Rahn
the CERROR handling code had a gross mistake in that that it didn't continue processing the code after the macro if no error occurred. ok kettenis@
2021-05-02Try harder to ensure there are no GPT revenants afterKenneth R Westerback
choosing MBR partitioning.
2021-05-02riscv64 openssl configDale Rahn
copied from other 64 bit arch ok jsg@
2021-05-02We need to set the dirty bit whenever we add write permissionMark Kettenis
otherwise a write will still fault on hardware that doesn't implement hardware updates for these bits. ok drahn@
2021-05-02Shuffle some code to eliminate get_address(), bring interface_state() andKenneth R Westerback
initialize_interface() logic into closer alignment, and try harder to initialize link_state at start up.
2021-05-02Prevent future internal use of some #definesTheo Buehler
After jsing's recent commits, SSL3_CC_{READ,WRITE,CLIENT,SERVER} and the derived SSL3_CHANGE_CIPHER_{CLIENT,SERVER}_{READ,WRITE} are no longer used by LibreSSL and should never be used again. discussed with jsing
2021-05-02Clean up tls1_change_cipher_state().Joel Sing
Replace flag gymnastics at call sites with separate read and write, functions which call the common code. Condition on s->server instead of using SSL_ST_ACCEPT, for consistency and more readable code. ok inoguchi@ tb@
2021-05-02In the TLSv1.2 server, set up the key block after sending the CCS.Joel Sing
This avoids calling into the key block setup code multiple times and makes the server code consistent with the client. ok inoguchi@ tb@
2021-05-02Clean up dtls1_reset_seq_numbers().Joel Sing
Rather than doing flag gymnastics, split dtls1_reset_seq_numbers() into separate read and write functions. Move the calls of these functions into tls1_change_cipher_state() so they directly follow the change of cipher state in the record layer, which avoids having to duplicate the calls in the client and server. ok inoguchi@ tb@
2021-05-02Ensure that handshake hash is non-NULL in tls1_transcript_hash_value().Joel Sing
There are several paths where a subtle bug could result in tls1_transcript_hash_value() being called with a NULL handshake hash - add an explicit check for this case. As noted by tb@, due to the wonders of the libcrypto EVP APIs, combined with integer promotion, we already have a NULL check - this one is just more obvious. ok tb@
2021-05-02Harden tls12_finished_verify_data() by checking master key length.Joel Sing
Require master key length to be greater than zero if we're asked to derive verify data for a finished or peer finished message. ok tb@
2021-05-02Stop deriving peer finished twice for TLSv1.2.Joel Sing
We already derive the peer finished in ssl3_do_change_cipher_spec(), which DTLS relies on. In the case of TLS we've been doing it twice - once in ssl3_get_message() and once in ssl3_do_change_cipher_spec(). ok tb@
2021-05-02Make TS_compute_imprint a bit more robust.Theo Buehler
Instead of using the output parameters directly, null them out at the beginning and work with local variables which are only assigned to the output parameters on success. This way we avoid leaking stale pointers back to the caller. requested/ok jsing
2021-05-02Improve documentation. Try to explain the various inputs that result inTheo de Raadt
a rewritten resolv.conf, and without being too precise, the order they will be in the file discussed with florian and jmc
2021-05-02Fix having hostnames in the listen on statement. Regression introduced inMartijn van Duren
r1.39. Issue originally reported by Anton Kasimov via rob@. OK claudio@
2021-05-02Do soreserve() before `kp' allocation. This simplifies error path. Themvs
same was done for route_attach(). Also do soisconnected() after `kp' is fully initialized. This chair movement affects nothing for PF_KEY sockets but makes code more consistent. ok bluhm@ mpi@
2021-05-02dired-shell-command is listed in the man page under 'DIRED KEYMark Lumsden
BINDINGS' but not under 'DIRED COMMANDS'. Add it in.
2021-05-02Initialize the per-CPU pointer register early.Mark Kettenis
ok drahn@
2021-05-02explain what FETCH_CMD should support in a bit more detailMarc Espie
2021-05-02fix logic error in boot()Jonathan Gray
ok deraadt@
2021-05-01Remove NetBSDisms that crept into the arm64 version of this file.Mark Kettenis
ok gnezdo@
2021-05-01Actually, that variable needs to be a u_int8_t pointer.Mark Kettenis
This is what was tested, but I forgot to commit a file.
2021-05-01Expand the regress test quite a bit to make sure no new regressions areMartijn van Duren
introduced by the previous libagentx commit. There's a few of the new tests failing, mark those as such.
2021-05-01Refactor varbind OID parsing into their indices. Simplifies the code byMartijn van Duren
about 40 LoC and fixes a potential out of bounds read. Bug found by bluhm@ on arm64 regress OK bluhm@
2021-05-01Removed unused SYSCTL_INT_UNBOUNDED (no use planned)gnezdo
Added a comment for SYSCTL_INT_READONLY. OK mvs@
2021-05-01Update the remaining SYSCTL_INT_READONLY casesgnezdo
OK mvs@
2021-05-01Implement per-socket `so_lock' rwlock(9) and use it to protect routingmvs
(PF_ROUTE) sockets. This can be done because we have no cases where one thread should lock two sockets simultaneously. Against the previous version rtm_senddesync_timer() execution was moved to process context. Also this time `so_lock' used for routing sockets only but in the future it will be used to other socket types too. tested by claudio@ ok claudio@ bluhm@
2021-05-01Retire OpenBSD/sgi.Visa Hankala
OK deraadt@
2021-05-01syncTheo de Raadt
2021-05-01bump to LibreSSL 3.4.0 in -currentBrent Cook
2021-05-01Plug leak in c2i_ASN1_OBJECTTheo Buehler
When using the object reuse facility of c2i_ASN1_OBJECT, the dynamically allocated strings a may contain are set to NULL, so we must free them beforehand. Also clear the flag, because that's what OpenSSL chose to do. From Richard Levitte OpenSSL 1.1.1 65b88a75921533ada8b465bc8d5c0817ad927947 ok inoguchi
2021-05-01Prevent double free in int_TS_RESP_verify_tokenTheo Buehler
If TS_compute_imprint fails after md_alg was allocated, there will be a double free in its caller. Obvious fix is to null out the output parameter md_alg just like it's already done for imprint and imprint_len. From Pauli Dale, OpenSSL 1.1.1, a3dea76f742896b7d75a0c0529c0af1e628bd853 ok inoguchi jsing
2021-05-01Implement early console functionality based on available SBI calls.Mark Kettenis
While these calls are part of the legacy extensions and deprecated, they are really useful for debugging purposes. ok jsg@
2021-05-01In singel user mode / is mounted ro. Just warn if we can't createFlorian Obser
the control socket instead of fatal(). OK deraadt
2021-05-01Allow running in single user mode where /var/empty doesn't exist byFlorian Obser
switching from chroot("/var/empty") to unveil("/", ""). This is just an extra pair of suspenders since these processes pledge(2) to not access the filesystem. OK deraadt
2021-05-01Allow running in single user mode where /var/empty doesn't exist byFlorian Obser
switching from chroot("/var/empty") to unveil("/", ""). This is just an extra pair of suspenders since these processes pledge(2) to not access the filesystem. OK deraadt
2021-05-01update currency exchange rates;Jason McIntyre
2021-05-01KERNEL_LOCK/UNLOCK() was pushed into trapsignal() last AugustJonathan Gray
2021-05-01use sival_ptr instead of sival_int for breakpoint and illegal instJonathan Gray
For breakpoints stval will have a vaddr. For illegal instructions stval may be as large as a register or the widest instruction. Also avoid using an uninitialised variable for stval. ok mlarkin@ drahn@
2021-05-01regen llvm man pages from rst withJonathan Gray
cd /usr/src/gnu/llvm/llvm/docs gmake -f Makefile.sphinx man cd /usr/src/gnu/llvm/clang/docs gmake -f Makefile.sphinx man cmake -DLLVM_ENABLE_SPHINX=ON -DLLDB_INCLUDE_TESTS=OFF /usr/src/gnu/llvm/lldb/ make docs-lldb-man
2021-05-01arvm7 -> armv7Jonathan Gray
2021-05-01variable has to be a pointer after last changeTheo de Raadt
2021-04-30make timer/intc cd_name match configJonathan Gray
ok kettenis@ mlarkin@
2021-04-30Clean up and harden TLSv1.2 master key derivation.Joel Sing
The master key and its length are only stored in one location, so it makes no sense to handle these outside of the derivation function (the current 'out' argument is unused). This simplifies the various call sites. If derivation fails for some reason, fail hard rather than continuing on and hoping that something deals with this correctly later. ok inoguchi@ tb@
2020-08-03Import LLVM 10.0.0 release including clang, lld and lldb.Patrick Wildt
ok hackroom tested by plenty
2021-04-30Fix linkage error due to fp* functions.Dale Rahn
ok kettenis@
2021-04-30Rearrange the implementation of bounded sysctl. The primitiveAlexander Bluhm
functions are sysctl_int() and sysctl_rdint(). This brings us back the 4.4BSD implementation. Then sysctl_int_bounded() builds the magic for range checks on top. sysctl_bounded_arr() is a wrapper around it to support multiple variables. Introduce macros that describe the meaning of the magic boundary values. Use these macros in obvious places. input and OK gnezdo@ mvs@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 02:53:45 +0000