summaryrefslogtreecommitdiff
path: root/lib/libssl
AgeCommit message (Collapse)Author
2016-11-21Import the DTLSv1_listen(3) manual from OpenSSL,Ingo Schwarze
excluding interface changes that don't apply to LibreSSL, except that i left the confusing discussion of RETURN VALUES completely unchanged, to warn users that this is a mess: OpenSSL first published this interface, then later changed its syntax and semantics in multiple ways.
2016-11-17Convert ssl3_get_client_kex_dhe() to CBS and perform some general codeJoel Sing
cleanup, including the removal of a dead code path. ok beck@
2016-11-17Use defines instead of magic numbers and comments.Joel Sing
2016-11-14Add Copyright and license.Ingo Schwarze
In the SYNOPSIS, show function prototypes rather than macro definitions. Delete the useless NOTES section header.
2016-11-11Disable ec assembly for amd64 pending fixes for ssh, and bumpBob Beck
majors appropriately
2016-11-08When using an union including a type known for having strong alignmentMiod Vallat
constraints, in order to force the union to have the same constraint, use the actual type instead of `double'. And add a comment explaining why we want such an alignment in there. ok beck@
2016-11-06Remove unused SSLv3 from ssl3_cbc_record_digest_supported().Joel Sing
From Markus Uhlin <markus.uhlin at bredband dot net> ok beck@ bcooK@
2016-11-06Split ssl3_get_client_key_exchange() into separate per algorithm functions.Joel Sing
ok beck@
2016-11-06Remove pointless check - without fixed ECDH, there is only one way to reachJoel Sing
this code path. ok beck@ bcook@
2016-11-06Split out the DHE and ECDHE code paths fromJoel Sing
ssl3_send_server_key_exchange(). ok beck@ bcook@
2016-11-06Adjust cipher suite strengths - move MD5 to LOW, RC4 to LOW and 3DES toJoel Sing
MEDIUM. ok beck@ bcook@
2016-11-06Remove the single IDEA cipher suite. There is no good reason to supportJoel Sing
this. ok beck@ bcook@
2016-11-06unifdef -m -UOPENSSL_NO_CHACHA -UOPENSSL_NO_POLY1305Joel Sing
ok beck@
2016-11-06remove unused variableBrent Cook
2016-11-05One of the error paths would attempt to access not-yet-initialized locals.Miod Vallat
Simply return since there is nothing more to do. Spotted by coverity. ok jsing@ beck@
2016-11-05Do a partial CBB conversion of ssl3_send_server_key_exchange(), which willJoel Sing
make it easier to do further clean up. ok beck@ miod@
2016-11-05move manual pages from doc/ to man/ for consistency with otherIngo Schwarze
libraries, in particular considering that there are unrelated files in doc/; requested by jsing@ and beck@
2016-11-05bump minors for symbol addition for ocsp and x25519 symbol additionsBob Beck
2016-11-05after getting rid of the pod files, clean up the Makefiles; ok bcook@Ingo Schwarze
2016-11-05Convert ssl3_get_server_kex_ecdhe() to CBS, simplifying tls1_check_curve()Joel Sing
in the process. This also fixes a long standing bug where tls1_ec_curve_id2nid() is called with only one byte of the curve ID. ok beck@ miod@
2016-11-05Remove generated Symbols.map on make clean.Joel Sing
ok guenther@
2016-11-04Rename ssl3_get_key_exchange() to ssl3_get_server_key_exchange(), sinceJoel Sing
that's what it really is. ok miod@
2016-11-04Tidy up the usage of peer_ecdh_tmp, following the fixed ECDH removal.Joel Sing
ok beck@
2016-11-04Mark a couple local functions as staticPhilip Guenther
ok jsing@ beck@
2016-11-04The *_method_data structures can be staticPhilip Guenther
ok jsing@
2016-11-04Add an explict list of exported symbols with just the functionsPhilip Guenther
declared in the public headers, and use __{BEGIN,END}_HIDDEN_DECLS in the internal headers to optimize internal functions ok jsing@
2016-11-04make public ASN1_time_parse and ASN1_time_tm_cmp to replace former hiddenBob Beck
functions.. document with a man page. bump majors on libtls, libssl, libcrypto ok jsing@ guenther@
2016-11-04Make do_dtls1_write() static to d1_pkt.c and delete declarations forPhilip Guenther
three functions that were removed a while ago ok jsing@
2016-11-04Fix some linewrapping glitchesPhilip Guenther
ok jsing@
2016-11-04Completely rewrite the session handling ASN.1 code using CBB and CBS. ThisJoel Sing
addresses two 2038 related issues and also adds support for allocation in the i2d function, which will allow for simplification in the callers. ok beck@ miod@
2016-11-04Convert ssl3_get_server_kex_dhe() to CBS.Joel Sing
ok beck@
2016-11-03In ssl3_read_bytes(), do not process more than three consecutive TLSJoel Sing
records, otherwise a peer can potentially cause us to loop indefinately. Return with an SSL_ERROR_WANT_READ instead, so that the caller can choose when they want to handle further processing for this connection. ok beck@ miod@
2016-11-03Split ssl3_get_key_exchange() into separate functions for DHE/ECDHE.Joel Sing
ok beck@ (who was struggling to keep lunch down while reviewing the diff)
2016-11-03Clean up the TLS handshake digest handling - this refactors some of theJoel Sing
code for improved readability, however it also address two issues. The first of these is a hard-to-hit double free that will occur if EVP_DigestInit_ex() fails. To avoid this and to be more robust, ensure that tls1_digest_cached_records() either completes successfully and sets up all of the necessary digests, or it cleans up and frees everything that was allocated. The second issue is that EVP_DigestUpdate() can fail - detect and handle this in tls1_finish_mac() and change the return type to an int so that a failure can be propagated to the caller (the callers still need to be fixed to handle this, in a later diff). The double-free was reported by Matthew Dillon. ok beck@ doug@ miod@
2016-11-02Expand LHASH_OF, IMPLEMENT_LHASH_DOALL_ARG_FN and LHASH_DOALL_ARG_FNJoel Sing
macros. Only change in generated assembly is due to line numbering.
2016-11-02Expand another LHASH_OF macro.Joel Sing
2016-11-02Expand DECLARE_LHASH_OF and LHASH_OF macros.Joel Sing
2016-11-02Expand DECLARE_PEM_rw macro.Joel Sing
2016-11-02Expand IMPLEMENT_LHASH_COMP_FN/IMPLEMENT_LHASH_HASH_FN macros - the onlyJoel Sing
change to generated assembly results from a difference in line numbers.
2016-11-02Wrap some >80 char lines.Joel Sing
2016-10-19Remove support for fixed ECDH cipher suites - these is not widely supportedJoel Sing
and more importantly they do not provide PFS (if you want to use ECDH, use ECDHE instead). With input from guenther@. ok deraadt@ guenther@
2016-10-02Check for and handle failure of HMAC_{Update,Final} or EVP_DecryptUpdate()Philip Guenther
based on openssl commit a5184a6c89ff954261e73d1e8691ab73b9b4b2d4 ok bcook@
2016-10-02Detect zero-length encrypted session data early, instead of when malloc(0)Philip Guenther
fails or the HMAC check fails. Noted independently by jsing@ and Kurt Cancemi (kurt (at) x64architecture.com) ok bcook@
2016-09-22Improve on code from the previous commit.Joel Sing
ok bcook@
2016-09-22Avoid unbounded memory growth, which can be triggered by a clientJoel Sing
repeatedly renegotiating and sending OCSP Status Request TLS extensions. Fix based on OpenSSL.
2016-09-22Check for packet with truncated DTLS cookie.Philip Guenther
Flip pointer comparison logic to avoid beyond-end-of-buffer pointers to make it less likely a compiler will decide to screw you. Based on parts of openssl commits 6f35f6deb5ca7daebe289f86477e061ce3ee5f46 and 89c2720298f875ac80777da2da88a64859775898 ok jsing@
2016-09-22Improve ticket validity checking when tlsext_ticket_key_cb() callbackPhilip Guenther
chooses a different HMAC algorithm. Avert memory leaks if the callback preps the HMAC in some way. Based on openssl commit 1bbe48ab149893a78bf99c8eb8895c928900a16f but retaining a pre-callback length check to guarantee the callback is provided the buffer that the API claims. ok bcook@ jsing@
2016-09-20Avoid selecting weak digests for (EC)DH when using SNI.Brent Cook
from OpenSSL: SSL_set_SSL_CTX is normally called for SNI after ClientHello has received and the digest to use for each certificate has been decided. The original ssl->cert contains the negotiated digests and is now copied to the new ssl->cert. noted by David Benjamin and Kinichiro Inoguchi
2016-09-19Update ld search path for libssl/libcrypto, fixes cross-build after source ↵Brent Cook
moved. from Patrick Wildt
2016-09-14Generate pkg-config files at build time like everything else. ThisMartin Natano
avoids permission problems due to the build and install stages being run by different users. ok deraadt jasper
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-22 03:52:18 +0000