summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-10-12make fixed-sized fixed-value mib[] arrays be constTheo de Raadt
ok guenther tb millert
2020-10-12annoying whitespaceTheo de Raadt
2020-10-12mib[2] is no longer used; ok guentherTheo de Raadt
2020-10-12Add support for the i.MX8M AHB clocks. These behave just like all thePatrick Wildt
other composite clocks. With this we can get the frequency for the OCOTP.
2020-10-12OCOTP's parent clock is the IPG clock on i.MX8M.Patrick Wildt
2020-10-12Disable retguard for clang build.mortimer
Fixes build on powerpc
2020-10-12update retguard listTheo de Raadt
2020-10-12Add RETGUARD implementation for powerpc and powerpc64.mortimer
ok deraadt@ kettenis@
2020-10-12Accommodate POSIX basename(3) that takes a non-const parameter andChristian Weisgerber
may modify the string buffer. From Joerg Sonnenberger for DragonFly BSD. ok millert@
2020-10-12Accommodate POSIX basename(3) that takes a non-const parameter andChristian Weisgerber
may modify the string buffer. ok millert@
2020-10-12avoid two overlong lines and drop an unused printf argumentTheo Buehler
2020-10-12Fix build of tmpfsVisa Hankala
The breakage was caused by the removal of #include <sys/systm.h> from <uvm/uvm_map.h>. OK deraadt@, mpi@, beck@
2020-10-12drop references to the SSL protocol because support was removed long ago;Ingo Schwarze
suggested by tb@
2020-10-12List and describe the recommended methods first and relegate theIngo Schwarze
deprecated methods to a separate table. Simplify and shorten the surrounding verbiage. Joint work with tb@.
2020-10-12Use KASSERT() instead of if(x) panic() for NULL dereference checks.Martin Pieuchot
Improves readability and reduces the difference with NetBSD without compromising debuggability on RAMDISK. While here also use local variables to help with future locking and reference counting. ok semarie@
2020-10-12Zap unused family parameter from ssh_connect_direct()kn
sshconnect.c r1.241 from 2013 made it unused; found while reading code. OK djm
2020-10-12Mention TP-LINK TL-NG421.Kevin Lo
From Brad.
2020-10-12Set the maximum frame size to RGE_JUMBO_FRAMELEN.Kevin Lo
From Brad. Tweak by myself.
2020-10-11UpdateHostkeys: check for keys under other namesDamien Miller
Stop UpdateHostkeys from automatically removing deprecated keys from known_hosts files if the same keys exist under a different name or address to the host that is being connected to. This avoids UpdateHostkeys from making known_hosts inconsistent in some cases. For example, multiple host aliases sharing address-based known_hosts on different lines, or hosts that resolves to multiple addresses. ok markus@
2020-10-11UpdateHostkeys: better CheckHostIP handlingDamien Miller
When preparing to update the known_hosts file, fully check both entries for both the host and the address (if CheckHostIP enabled) and ensure that, at the end of the operation, entries for both are recorded. Make sure this works with HashKnownHosts too, which requires maintaining a list of entry-types seen across the whole file for each key. ok markus@
2020-10-11UpdateHostkeys: better detect manual host entriesDamien Miller
Disable UpdateHostkeys if the known_hosts line has more than two entries in the pattern-list. ssh(1) only writes "host" or "host,ip" lines so anything else was added by a different tool or by a human. ok markus@
2020-10-11Don't skip file systems just because the parent fs is nodev and nosuid.Todd C. Miller
Fixes instances where a mount point uses the nodev and nosuid options but another file system mounted inside that hierarchy does not. OK schwarze@
2020-10-11In ssl_methods.c rev. 1.18, jsing@ deprecated *_server_method(3)Ingo Schwarze
and *_client_method(3). Adjust the documentation. While here, delete most of the verbiage regarding the deprecated functions SSLv23_*(3) and add the missing entry to RETURN VALUES. OK tb@
2020-10-11Always allocate GOT header entries on powerpc.Mark Kettenis
ok deraadt@
2020-10-11SSL3_ENC_METHOD is just a flag word; merge it into SSL_METHOD_INTERNALPhilip Guenther
with #defines for the per-version initializers instead of extern globals. Add SSL_USE_SHA256_PRF() to complete the abstraction. ok tb@ jsing@
2020-10-11Implement more of RFC 8630 and support more than one URI in the TAL file.Claudio Jeker
The URI are sorted which results in preferrence of https URI. To make rpki-client's handling easier enforce that all URI use the same filename. OK benno@
2020-10-11Introduce repo_filename() a function that converts a URI into the localClaudio Jeker
path to that resource. This will be needed for future RRDP support. Additionally support more then one TAL URI and select the rsync URI in that list. Finally queue_add_from_cert() got modified to include both the rsync URI and the RRDP notify URI (which is still unused). OK benno@
2020-10-11Refactor kqueue_scan() to use a context: a "kqueue_scan_state struct".Martin Pieuchot
The struct keeps track of the end point of an event queue scan by persisting the end marker. This will be needed when kqueue_scan() is called repeatedly to complete a scan in a piecewise fashion. Extracted from a previous diff from visa@. ok visa@, anton@
2020-10-11Stop exporting `wt_hwqueue' now that drivers don't advertise it.Martin Pieuchot
Pointed by and ok jsg@
2020-10-11Align pool items on CACHELINESIZE when replacing linux kmem_cache withJonathan Gray
SLAB_HWCACHE_ALIGN flag. tested by semarie@
2020-10-11Fix an assert conditioned on DTLS1_VERSION.Joel Sing
This condition previously existed for DTLS BAD_VER, which has long been removed. Furthermore, conditioning on DTLS1_VERSION means this is broken for any newer DTLS version. While here roll up two assertions into one. ok tb@
2020-10-11Handle absence of TLS certs while parsing the configTheo Buehler
There is a soft fail mechanism to handle missing certs for seamless interaction with acme-client. Move this to the config parser. This is simpler than server.c r1.117 and avoids a crash due to listening on port 443 without having set up the TLS context first. More precisely, the crash happens if a server with missing certificate is visited via https in a configuration where there is a second server with valid certificate and key. From Joshua Sing (joshua at hypera dot dev) ok benno
2020-10-11Grow init_buf before stashing a handshake message for the legacy stack.Joel Sing
When transitioning from the TLSv1.3 stack to the legacy stack, grow init_buf before stashing the handshake message. The TLSv1.3 stack has already received the handshake message (potentially from multiple TLS records) and validated its size, however the default allocation is only for a single plaintext record, which can result in the handshake message failing to fit in certain cases. Issue noted by tb@ via tlsfuzzer. ok tb@
2020-10-11No longer need to cast away const in srtp_find_profile_by_name()Theo Buehler
2020-10-11Make profile_name const in srtp_find_profile_by_name()Theo Buehler
There is no reason (and there never was any) for profile_name to be non-const, it was always just passed to strncmp(). Changing this allows removing an ugly instance of casting away const. ok guenther jsing
2020-10-11Update regress for method changes.Joel Sing
2020-10-11Condense and simplify TLS methods.Joel Sing
Historically, OpenSSL has had client and server specific methods - the only difference between these is that the .ssl_connect or .ssl_accept function pointer is set to ssl_undefined_function, with the intention of reducing code size for a statically linked binary that was only a client or server. These days the difference is minimal or non-existant in many cases and we can reduce the amount of code and complexity by having single method. Internally remove all of the client and server specific methods, simplifying code in the process. The external client/server specific API remain, however these now return the same thing as TLS_method() does. ok tb@
2020-10-11Unbreak regress following SRTP_PROTECTION_PROFILE const change.Joel Sing
2020-10-11Constipate srtp_known_profiles, pushing it into .data.rel.roPhilip Guenther
ok tb@ jsing@
2020-10-11Constipate ssl3_ciphers and tls1[23]_sigalgs*, pushing them intoPhilip Guenther
.data.rel.ro and .rodata respectively. ok tb@ jsing@
2020-10-10syncStuart Henderson
2020-10-10Returning a void expression is weird; ok kettenis@ daniel@Otto Moerbeek
2020-10-10Handle spurious interrupts.Mark Kettenis
ok patrick@, deraadt@
2020-10-10Add OPAL_PCI_MAP_PE_DMA_WINDOW.Mark Kettenis
2020-10-10Don't leak bundle_file and cert_file paths at the end.Theo Buehler
2020-10-10Remove unnecessary count of device instances.Visa Hankala
2020-10-10Add a manual page for octboot(4).Visa Hankala
2020-10-10Clear the kcov device for the current thread before freeing the sameanton
kcov device. Prevents a use-after-free, note I've never seen this one in practice.
2020-10-09Unbreak the powerpc64 kernel build.Mark Kettenis
2020-10-09Escape ! in QlTim van der Molen
OK jmc@ nicm@, agreement from schwarze@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 05:35:57 +0000