summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-04-13Remove some stuff that isn't needed.Bob Beck
ok miod@ deraadt@
2014-04-13Remove the AEP engine: it is not standalone and doesn't seem to beReyk Floeter
relevant anymore. OpenSSL should have a better way to include 3rd party engines: either completely and free or external. But including a wrapper for a non-free wrapper in the code base does not make much sense and could also be provided by the vendor. ok deraadt@
2014-04-13Remove the Atalla engine: It is not standalone and depends on externalReyk Floeter
non-free libraries. OpenSSL should have a better way to include 3rd party engines: either completely free or external. But including a wrapper for a non-free wrapper in the code base does not make much sense and could also be provided by the vendor. ok deraadt@
2014-04-13Remove the cswift engine: it is not standalone and we don't have theReyk Floeter
hardware. The vendor_defns/cswift.h does not specify a copyright and theoretically defaults to the OpenSSL license, but it also mentions that it includes parts that have been "clipped" from CryptoSwift's proprietary headers. This file should better include an explicit copyright statement or mention OpenSSL's library instead of the ambiguous "Attribution notice". ok deraadt@
2014-04-13Remove the "sureware" engine:Reyk Floeter
The vendor_defns/sureware.h file by Baltimore Technologies Ltd. has a copyright that does not grant rights! Vendor files should either include a compatible license in the copyright statement or use OpenSSL's defaults, but adding a copyright statement without any terms is not acceptable. It should not have been included in the first place. ok deraadt@
2014-04-13Remove the Broadcom ubsec engine:Reyk Floeter
The vendor_defns/hw_ubsec.h file has a copyright that does not grant rights! Vendor files should either include a compatible license in the copyright statement or use OpenSSL's defaults, but adding a copyright statement without any terms is not acceptable. It should not have been included in the first place. (The ubsec(4) kernel driver is not affected by this change) ok deraadt@
2014-04-13Remove the IBM 4758 engine: we don't have this hardware and it is anReyk Floeter
old PCI accelerator that was EOL'ed in 2005. ok deraadt@
2014-04-13Don't edit on cvs. 23.1 as intended.Miod Vallat
2014-04-13Move undocumented internal OPENSSL_DIR interface from libcrypto to libssl,Miod Vallat
so that libssl no longer need to access the non-external headers of libcrypto to build. No library bump, riding upon the recent update.
2014-04-13Crank libcrypto minor (addition of BN_consttime_swap and CRYPTO_memcmp)Miod Vallat
and libssl major (ssl_check_clienthello_tlsext split into two functions)
2014-04-13No longer define OPENSSL_NO_EC_NISTP_64_GCC_128 on amd64; requested by djmMiod Vallat
2014-04-13Merge conflicts; remove MacOS, Netware, OS/2, VMS and Windows build machinery.Miod Vallat
2014-04-13Import OpenSSL 1.0.1gMiod Vallat
2014-04-11Move build machinery for libcrypto from libssl/crypto to libcrypto, as wellMiod Vallat
as configuration files; split manpages and .pc files between libcrypto and libssl. No functional change, only there to make engineering easier, and libcrypto sources are still found in libssl/src/crypto at the moment. ok reyk@, also discussed with deraadt@ beck@ and the usual crypto suspects.
2014-04-10Piotr Sikora pointed me at a more refined diff for the buffer releaseTed Unangst
issue. Apply that version. Maybe someday upstream will wake up and then we can have the same code. https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest
2014-04-10crank major; struct ssl_ctx_st changes; ok teduTheo de Raadt
2014-04-10don't release the read buffer if we're not done reading from it.Ted Unangst
ok benno deraadt
2014-04-07cherrypick fix for CVE-2014-0160 "heartbleed" vulnerability fromDamien Miller
OpenSSL git; ok sthen@
2014-03-18prepare manpages for new perl.Marc Espie
Note that I missed two of these in the diff shown initially, thx to the atrocious Makefile rule... okay millert@, sthen@, basically
2014-02-27SECURITY fixes backported from openssl-1.0.1f. ok mikeb@Jeremie Courreges-Anglas
CVE-2013-4353 NULL pointer dereference with crafted Next Protocol Negotiation record in TLS handshake. Upstream: 197e0ea CVE-2013-6449 Fix crash with crafted traffic from a TLS 1.2 client. Upstream: ca98926, 0294b2b CVE-2013-6450 Fix DTLS retransmission from previous session. Upstream: 3462896
2013-12-19Reliability fix for SHA384 SSL/TLS ciphers on strict alignmentJeremie Courreges-Anglas
architectures. ok miod@ djm@ Upstream patch: commit cdd1acd788020d2c525331da1712ada778f1373c Author: Andy Polyakov <appro@openssl.org> Date: Wed Dec 18 21:27:35 2013 +0100
2013-08-13Switch time_t, ino_t, clock_t, and struct kevent's ident and dataPhilip Guenther
members to 64bit types. Assign new syscall numbers for (almost all) the syscalls that involve the affected types, including anything with time_t, timeval, itimerval, timespec, rusage, dirent, stat, or kevent arguments. Add a d_off member to struct dirent and replace getdirentries() with getdents(), thus immensely simplifying and accelerating telldir/seekdir. Build perl with -DBIG_TIME. Bump the major on every single base library: the compat bits included here are only good enough to make the transition; the T32 compat option will be burned as soon as we've reached the new world are are happy with the snapshots for all architectures. DANGER: ABI incompatibility. Updating to this kernel requires extra work or you won't be able to login: install a snapshot instead. Much assistance in fixing userland issues from deraadt@ and tedu@ and build assistance from todd@ and otto@
2013-05-30Switch to using unhyphenated VIA padlock mnemonics. VIA abandoned theMatthew Dempsky
hyphen in their official programming guide sometime between 2003 and 2005, and Clang's integrated assembler does not support hyphenated mnemonics. ok jsg, deraadt
2013-02-14cherry pick bugfixes for http://www.openssl.org/news/secadv_20130205.txtMarkus Friedl
from the openssl git (changes between openssl 1.0.1c and 1.0.1d). ok djm@
2013-02-14Import OpenSSL 1.0.1gMarkus Friedl
2013-01-26remove ACSS, crank libcrypto major; ok markus@ deraadt@Damien Miller
2012-10-31On amd64 OPENSSL_cpuid_setup and OPENSSL_ia32cap_P are now hidden so we don'tMark Kettenis
have to go through the PLT/GOT to get at them anymore. In fact going through the GOT now fails since we no longer have a GOT entry for OPENSSL_ia32cap_P. Fixes the problem spotted by jasper@ and sthen@. Based on a diff from mikeb@ who did most of the actual work of tracking down the issue. ok millert@, mikeb@
2012-10-22Restore r1.10, lost during last update:Miod Vallat
Disable use of dladdr() on a.out arches, they do not provide it (yet);
2012-10-13Makefile and header changes for OpenSSL-1.0.1cDamien Miller
major cranks
2012-10-13import files that CVS missed; sighDamien Miller
2012-10-13resolve conflictsDamien Miller
2012-10-13import OpenSSL-1.0.1cDamien Miller
2012-08-21When deciding whether we're PIC in a (generated) asm file, check for both PICPascal Stumpf
and __PIC__ defines. Makes things easier for PIE. ok djm@
2012-07-11Disable SSLv2 in OpenSSL. No objections from djm.Stuart Henderson
Brad, jasper and naddy helped with test builds, fixing ports, etc.
2012-04-19cherrypick fix for CVE-2012-2110: libcrypto ASN.1 parsing heap overflowDamien Miller
ok miod@ deraadt@
2012-01-05OpenSSL 1.0.0f: crank minorDamien Miller
2012-01-05OpenSSL 1.0.0f: mergeDamien Miller
2012-01-05OpenSSL 1.0.0f: import upstream sourceDamien Miller
2011-11-03crank major for openssl-1.0.0eDamien Miller
2011-11-03openssl-1.0.0e: resolve conflictsDamien Miller
2011-11-03import OpenSSL 1.0.0eDamien Miller
2011-02-10fix for CVE-2011-0014 "OCSP stapling vulnerability";Damien Miller
ok markus@ jasper@ miod@ AFAIK nothing in base uses this, though apache2 from ports may be affected.
2010-12-16move CRYPTO_VIAC3_MAX out of cryptodev.h and into the onlyJonathan Gray
file it will be used from. requested by/ok mikeb@
2010-12-16The VIA ciphers are added to an array of CRYPTO_ALGORITHM_MAX lengthJonathan Gray
which should have been declared as CRYPTO_ALGORITHM_MAX + 1, fix this and reserve enough space for the VIA additions as well. ok/comments from mikeb & deraadt
2010-12-15Security fix for CVE-2010-4180 as mentioned in ↵Jasper Lievisse Adriaanse
http://www.openssl.org/news/secadv_20101202.txt. where clients could modify the stored session cache ciphersuite and in some cases even downgrade the suite to weaker ones. This code is not enabled by default. ok djm@
2010-11-17- Apply security fix for CVE-2010-3864 (+commit 19998 which fixes the fix).Jasper Lievisse Adriaanse
ok djm@ deraadt@
2010-10-18Disable use of dladdr() on a.out arches, they do not provide it (yet); ok djm@Miod Vallat
2010-10-06More OpenSSL fixes:Damien Miller
- Update local engines for the EVP API change (len u_int => size_t) - Use hw_cryptodev.c instead of eng_cryptodev.c - Make x86_64-xlate.pl always write to the output file and not stdout, fixing "make -j" builds (spotted by naddy@) ok naddy@
2010-10-06Retire SkipjackMike Belopuhov
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-10-01fix -Wall due to API changeDamien Miller
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-23 08:32:34 +0000