src - OpenBSD base system

Age	Commit message (Collapse)	Author
2016-08-22	Create contexts for server side SNI - these include the additional SSL_CTX	Joel Sing
	that is required for certificate switching with libssl and the certificate itself so that we can match against the subject and SANs. Hook up the servername callback and switch to the appropriate SSL_CTX if we find a matching certificate. ok beck@
2016-08-18	Split out the TLS server SSL_CTX allocation and configuration code, so	Joel Sing
	that it can be reused to allocate the additional SSL_CTXs needed for SNI. ok reyk@
2016-08-15	Explicitly pass in an SSL_CTX * to the functions that operate on one,	Joel Sing
	instead of assuming that they should use the one associated with the TLS context. This allows these functions to be used with the additional SSL contexts that are needed to support server-side SNI. Also rename tls_configure_keypair() to tls_configure_ssl_keypair(), so that these functions have a common prefix. ok reyk@
2016-08-12	Add ALPN support to libtls.	Joel Sing
	ok beck@ doug@
2016-08-02	Revert previous since it adds new symbols.	Joel Sing
	Requested by deraadt@
2016-08-01	Add ALPN support to libtls.	Joel Sing
	ok beck@ doug@
2016-04-28	Factor our the keypair handling in libtls. This results in more readable	Joel Sing
	and self-contained code, while preparing for the ability to handle multiple keypairs. Also provide two additional functions that allow a public certificate and private key to be set with a single function call. ok beck@
2015-09-29	clean some ugly intendation warts	Theo de Raadt

2015-09-12	Ensure that we clear the libssl error stack before we make a function call	Joel Sing
	that we will pass the result through tls_ssl_error() on failure. Otherwise we can end up reporting spurious errors due to their being unrelated errors already on the error stack. Spotted by Marko Kreen. ok beck@
2015-09-11	actually set return value to 0 on success.	Bob Beck
	ok jsing@ who wears the cone of shame.
2015-09-10	Split tls_handshake() out from tls_accept/tls_connect. By doing this the	Joel Sing
	tls_accept/tls_connect functions can be guaranteed to succeed or fail and will no longer return TLS_READ_AGAIN/TLS_WRITE_AGAIN. This also resolves the semantics of tls_accept_*. The tls_handshake() function now does I/O and can return TLS_READ_AGAIN/TLS_WRITE_AGAIN. Calls to tls_read() and tls_write() will trigger the handshake if it has not already completed, meaning that in many cases existing code will continue to work. Discussed over many coffees at l2k15. ok beck@ bluhm@
2015-09-10	Add support for preferring the server's cipher list or the client's cipher	Joel Sing
	list. Prefer the server's cipher list by default. Based on a diff from Kyle Thompson <jmp at giga dot moe>. ok beck@ bcook@
2015-09-09	Indent labels with a space so that diff -p is more friendly.	Joel Sing
	Requested by bluhm@
2015-09-09	Add client certificate support. Still needs a few tweaks but this will	Bob Beck
	ride upcoming minor bump ok jsing@
2015-09-09	Only take ownership of a socket if we allocated it within libtls. If we are	Joel Sing
	passed a socket then the caller is responsible for closing it. ok bcook@
2015-08-27	Improve libtls error messages.	Joel Sing
	The tls_set_error() function previously stored the errno but did nothing with it. Change tls_set_error() to append the strerror(3) of the stored errno so that we include useful information regarding failures. Provide a tls_set_errorx() function that does not store the errno or include strerror(3) in the error message. Call this function instead of tls_set_error() for errors where the errno value has no useful meaning. With feedback from and ok doug@
2015-08-22	Unify error message between client and server.	Joel Sing

2015-08-22	SSL_set_app_data is a macro for SSL_set_ex_data(), which is a wrapper	Joel Sing
	around CRYPTO_set_ex_data(), which can fail. Since this is the case, check the return value of CRYPTO_set_ex_data^WSSL_set_ex_data^WSSL_set_app_data.
2015-03-31	Provide a tls_accept_fds() function, which allows a TLS connection to be	Joel Sing
	accepted via an existing pair of file descriptors. Based on a diff from Jan Klemkow.
2015-03-31	Store errors that occur during a tls_accept_socket() call on the context	Joel Sing
	for the server, rather than on the context for the connection. This makes more sense than the current behaviour does. Issue reported by Tim van der Molen.
2015-02-07	Convert tls_connect_fds() and tls_accept_socket() to the new OpenSSL error	Joel Sing
	dance handling code. This means that we get slightly useful messages when a TLS connection or accept fails. Requested by reyk@
2015-02-07	Add tls_config_set_dheparams() to allow specification of the parameters to	Joel Sing
	use for DHE. This enables the use of DHE cipher suites. Rename tls_config_set_ecdhcurve() to tls_config_set_ecdhecurve() since it is only used to specify the curve for ephemeral ECDH. Discussed with reyk@
2015-01-30	Make the TLS connect and accept error messages consistent.	Alexander Bluhm
	OK jsing@
2015-01-16	The SSL/TLS session Id context is limited to 32 bytes. Instead of	Reyk Floeter
	using the name of relayd relay or smtpd pki, use a 32 byte arc4random buffer that should be unique for the context. This fixes an issue in OpenSMTPD when a long pki name could break the configuration. OK gilles@ benno@
2014-10-31	Rename libressl to libtls to avoid confusion and to make it easier to	Joel Sing
	distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.