src - OpenBSD base system

Age	Commit message (Collapse)	Author
2018-02-05	Be consistent with the goto label names used in libtls code.	Joel Sing
	No change to generated assembly.
2017-04-10	Rework name verification code so that a match is indicated via an argument,	Joel Sing
	rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg <daniel at haxx dot se>. ok beck@ jca@
2016-11-04	Avoid signed vs unsigned comparisons.	Joel Sing
	ok miod@
2016-09-04	Add callback-based interface to libtls.	Brent Cook
	This allows working with buffers and callback functions instead of directly on sockets or file descriptors. Original patch from Tobias Pape <tobias_at_netshed.de>. ok beck@
2016-08-02	Revert previous since it adds new symbols.	Joel Sing
	Requested by deraadt@
2015-09-29	Instead of declaring a union in multiple places, move it to tls_internal.h.	Joel Sing
	ok deraadt@
2015-09-29	clean some ugly intendation warts	Theo de Raadt

2015-09-11	Do not match a wildcard against a name with no host part.	Bob Beck
	ok jsing@
2015-09-11	add tls_peer functions for checking names and issuers of peer certificates.	Bob Beck
	ok jsing@
2015-09-09	Indent labels with a space so that diff -p is more friendly.	Joel Sing
	Requested by bluhm@
2015-08-27	Improve libtls error messages.	Joel Sing
	The tls_set_error() function previously stored the errno but did nothing with it. Change tls_set_error() to append the strerror(3) of the stored errno so that we include useful information regarding failures. Provide a tls_set_errorx() function that does not store the errno or include strerror(3) in the error message. Call this function instead of tls_set_error() for errors where the errno value has no useful meaning. With feedback from and ok doug@
2015-08-27	Make functions that are internal to tls verify static.	Joel Sing
	Spotted by Marko Kreen. Rides libtls major bump.
2015-04-29	Reject dNSName of " " for subjectAltName extension.	Doug Hogan
	RFC 5280 says " " must not be used as a dNSName. ok jsing@ jca@
2015-02-11	Be consistent with naming - only use "host" and "hostname" when referring	Joel Sing
	to an actual host and use "servername" when referring to the name of the TLS server that we expect to be indentified in the server certificate. Likewise, rename verify_host to verify_name and use the term "name" throughout the verification code (rather than host or hostname). Requested by and ok tedu@
2014-12-17	Add size_t to int checks for SSL functions.	Doug Hogan
	libtls accepts size_t for lengths but libssl accepts int. This verifies that the input does not exceed INT_MAX. It also avoids truncating size_t when comparing with int and adds printf-style attributes for tls_set_error(). with input from deraadt@ and tedu@ ok tedu@
2014-12-07	Allow specific libtls hostname validation errors to propagate.	Brent Cook
	Remove direct calls to printf from the tls_check_hostname() path. This allows NUL byte error messages to bubble up to the caller, to be logged in a program-appropriate way. It also removes non-portable calls to getprogname(). ok jsing@
2014-12-07	Fix a memory leak in tls_check_subject_altname() by calling	Joel Sing
	sk_GENERAL_NAME_pop_free() instead of sk_GENERAL_NAME_free(). The latter only frees the stack itself and does not free the items. From Basskrapfen on github.
2014-12-07	revert previous change for now, adjusting based on comments from jsing@	Brent Cook

2014-12-07	Allow specific libtls hostname validation errors to propagate.	Brent Cook
	Remove direct calls to printf from the tls_check_hostname() path. This allows NUL byte error messages to bubble up to the caller, to be logged in a program-appropriate way. It also removes non-portable calls to getprogname(). The semantics of tls_error() are changed slightly: the last error message is not necessarily preserved between subsequent calls into the library. When the previous call to libtls succeeds, client programs should treat the return value of tls_error() as undefined. ok tedu@
2014-10-31	Rename libressl to libtls to avoid confusion and to make it easier to	Joel Sing
	distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.