summaryrefslogtreecommitdiff
path: root/lib/libssl
AgeCommit message (Collapse)Author
2015-07-24an TLS -> a TLS; from thanos tsouanasJason McIntyre
2015-07-24Convert tls1_process_ticket to CBS.Doug Hogan
ok miod@ jsing@
2015-07-24Convert tls1_process_sigalgs to CBS.Doug Hogan
ok miod@ jsing@
2015-07-24Convert ssl3_get_record to CBS.Doug Hogan
ok miod@ jsing@
2015-07-21Remove duplicate check in libssl.Doug Hogan
If len == 0, it already set try_session_cache so there's no need to check len again. Fixes Coverity issue 21687. ok bcook@
2015-07-19Remove OpenSSL engine RSAX.Doug Hogan
OpenSSL stopped building it last year and removed it this year. Based on OpenSSL commit c436e05bdc7f49985a750df64122c960240b3ae1. Also cranked major version in libcrypto, libssl and libtls. "fine with me" bcook@ miod@
2015-07-19Allow *_free() functions in libssl to handle NULL input.Doug Hogan
This mimics free()'s behavior which makes error handling simpler. ok bcook@ miod@
2015-07-19Convert ssl3_get_certificate_request to CBS.Doug Hogan
ok miod@
2015-07-19Fix symbol collision with libtls.Doug Hogan
Pointed out by guenther. ok guenther@
2015-07-19Add TLS_method, TLS_client_method and TLS_server_method.Doug Hogan
Use these instead of SSLv23_*method when you want to make sure TLS is used. By default, we disable SSLv3 but it's still possible for the user to re-enable it. TLS_*method does not allow SSLv3. Both BoringSSL and (next version of) OpenSSL have these methods. However, they have changed the implementation significantly. We will as well, but not right now. Riding the libssl major bump. ok miod@ bcook@
2015-07-19Crank major and remove legacy variables.Doug Hogan
Libtls is riding this crank. ok miod@ bcook@
2015-07-19Assign p to CBS_data since it is used later.Doug Hogan
The p initialization was hiding this bug but Coverity 126279 saw it. ok miod@ bcook@ beck@
2015-07-18Convert dtls1_get_message_header to CBS and change to int.Doug Hogan
Changed return value from void to int. It should never return an error given that the input length is not checked yet. ok miod@
2015-07-18Convert dtls1_get_record to CBS.Doug Hogan
ok miod@, input + ok jsing@
2015-07-18Remove repeated code in dtls1_get_record.Doug Hogan
The "if" is a bit ugly, but this does remove a lot of repetitive code. This will be converted to CBS later as well. ok miod@ jsing@ roughly ok with it after seeing the CBS version
2015-07-18Remove SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER workaround.Doug Hogan
This was a hack to work around problems on IE 6 with SSLv3. ok miod@ bcook@
2015-07-18Remove support for the SSL_OP_TLS_D5_BUG compat hack from SSLeay.Doug Hogan
This is a 17 year old workaround from SSLeay 0.9.0b. It was for clients that send RSA client key exchange in TLS using SSLv3 format (no length prefix). ok jsing@
2015-07-17Convert ssl_parse_serverhello_use_srtp_ext to CBS.Doug Hogan
ok miod@ jsing@
2015-07-17Remove compat hack that disabled ECDHE-ECDSA on OS X.Doug Hogan
For a few old releases, ECDHE-ECDSA was broken on OS X. This option cannot differentiate between working and broken OS X so it disabled ECDHE-ECDSA support on all OS X >= 10.6. 10.8-10.8.3 were the faulty releases but these are no longer relevant. Tested on OS X 10.10 by jsing. ok jsing@
2015-07-17Remove workaround for TLS padding bug from SSLeay days.Doug Hogan
OpenSSL doesn't remember which clients were impacted and the functionality has been broken in their stable releases for 2 years. Based on OpenSSL commit a8e4ac6a2fe67c19672ecf0c6aeafa15801ce3a5. ok jsing@
2015-07-15check n before cbs_init, coverity - ID 125063Bob Beck
ok bcook@ miod@
2015-07-15test for n<0 before use in CBS_init - mostly to shut up coverity.Bob Beck
reluctant ok miod@
2015-07-15Flense out dead code, we don't do ecdhe_clnt_cert.Bob Beck
coverity ID's 21691 21698 ok miod@, "Fry it" jsing@
2015-07-14Partially convert ssl3_get_message to CBS.Doug Hogan
Unlike the other conversions, this only partially converts the function for now. This is the second to last function which still uses the n2l3 macro. That macro is deprecated since we're using CBS. ok miod@ jsing@
2015-07-14Convert dtls1_get_hello_verify to CBS.Doug Hogan
ok miod@ jsing@
2015-07-14Convert ssl3_get_cipher_by_char to CBS.Doug Hogan
ok miod@ jsing@
2015-07-14Convert ssl3_get_client_certificate to CBS.Doug Hogan
ok miod@ jsing@
2015-07-14Convert ssl3_get_finished to CBS.Doug Hogan
ok miod@ jsing@
2015-07-14Convert ssl_parse_clienthello_use_srtp_ext to CBS.Doug Hogan
ok miod@ jsing@
2015-07-14Convert ssl3_get_cert_status to CBS.Doug Hogan
ok miod@ jsing@
2015-07-14Convert ssl3_get_server_certificate to CBS.Doug Hogan
ok miod@
2015-06-28Convert ssl_bytes_to_cipher_list to CBS.Doug Hogan
Link in the new 'unit' regress and expand the invalid tests to include some that would fail before the CBS conversion. input + ok miod@ jsing@
2015-06-24Stop using BUF_memdup() within the LibreSSL code base - it is correctlyJoel Sing
spelt malloc+memcpy, which is what is used in all except two places. ok deraadt@ doug@
2015-06-23Change CBS_dup() to also sync the offset.Doug Hogan
Previously, CBS_dup() had its own offset. However, it is more consistent to copy everything. ok miod@ jsing@
2015-06-21Check for failure with CBB_init() in bs_ber.c.Doug Hogan
From BoringSSL commit 3fa65f0f05f67615d9daf48940e07f84d094ac6e.
2015-06-20Convert ssl3_get_new_session_ticket to CBS.Doug Hogan
tweak + ok miod@ jsing@
2015-06-20Convert ssl3_get_next_proto to CBS.Doug Hogan
tweak + ok miod@ jsing@
2015-06-20Convert ssl_parse_serverhello_renegotiate_ext to CBS.Doug Hogan
ok miod@ jsing@
2015-06-20Make SSL_OP_ALL readable.Joel Sing
ok deraadt@ doug@ millert@ miod@ sthen@
2015-06-20Convert ssl_parse_clienthello_renegotiate_ext to CBS.Doug Hogan
ok miod@, tweak + ok jsing@
2015-06-20Replace internal call to CRYPTO_memcmp with timingsafe_memcmp.Doug Hogan
Suggested by jsing@. ok jsing@ miod@
2015-06-20Crank major for libcrypto, ssl and tls due to MDC-2DES removal.Doug Hogan
ok miod@ jsing@
2015-06-19Convert tls1_alpn_handle_client_hello() to CBS.Doug Hogan
tweak + ok miod@ jsing@
2015-06-19Add CBS_dup() to initialize a new CBS with the same values.Doug Hogan
This is useful for when you need to check the data ahead and then continue on from the same spot. input + ok jsing@ miod@
2015-06-18Extend the input types for CBB_add_*() to help catch bugs.Doug Hogan
While the previous types were correct, they can silently accept bad data via truncation or signed conversion. We now take size_t as input for CBB_add_u*() and do a range check. discussed with deraadt@ input + ok jsing@ miod@
2015-06-18Remove Microsoft Server Gated Crypto.Doug Hogan
Another relic due to the old US crypto policy. From OpenSSL commit 63eab8a620944a990ab3985620966ccd9f48d681 and 95275599399e277e71d064790a1f828a99fc661a. ok jsing@ miod@
2015-06-18Change DTLS client cert request code to match TLS.Doug Hogan
DTLS currently doesn't check whether a client cert is expected. This change makes the logic in dtls1_accept() match that from ssl3_accept(). From OpenSSL commit c8d710dc5f83d69d802f941a4cc5895eb5fe3d65 input + ok jsing@ miod@
2015-06-17Clean up alert codes and add references.Joel Sing
2015-06-17Keep alerts sorted by alert code.Joel Sing
2015-06-17Remove pointless comments.Joel Sing
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-22 02:25:55 +0000