summaryrefslogtreecommitdiff
path: root/lib/libtls
AgeCommit message (Collapse)Author
2017-12-09Make tls_config_parse_protocols() work correctly when passed a NULL pointerJoel Sing
for a protocol string. Issue found by semarie@, who also provided the diff.
2017-10-08hyphenate DER/PEM-encoded, for consistency;Jason McIntyre
2017-10-07Document tls_peer_cert_chain_pem().Joel Sing
ok beck@
2017-09-25If tls_config_parse_protocols() is called with a NULL pointer, return theJoel Sing
default protocols instead of crashing - this makes the behaviour more useful and mirrors what we already do in tls_config_set_ciphers() et al.
2017-09-20Keep track of which keypair is in use by a TLS context.Joel Sing
This fixes a bug where by a TLS server with SNI would always only return the OCSP staple for the default keypair, rather than returning the OCSP staple associated with the keypair that was selected via SNI. Issue reported by William Graeber and confirmed by Andreas Bartelt. Fix tested by William Graeber and Andreas Bartelt - thanks!
2017-09-20Slightly restructure tls_ocsp_verify_cb() to make it more like libtls code.Joel Sing
2017-09-20Provide a useful error if there are no OCSP URLs in the peer certificate.Joel Sing
2017-09-20Fix indentation.Joel Sing
2017-08-30Bump libssl/libtls minors due to symbol (re)addition.Joel Sing
2017-08-28Bump lib{crypto,ssl,tls} majors due to symbol removals.Joel Sing
2017-08-28Fix unchecked return nitBob Beck
ok bcook@ jsing@
2017-08-27Make the symbol for ASN1_time_tm_clamp_notafter visible so libtlsBob Beck
can get at it, so libtls can also deal with notafter's past the realm of 32 bit time in portable
2017-08-13Switch to -Werror with clang for libressl.Doug Hogan
Discussed with beck@ and jsing@ ok beck@
2017-08-12Document tls_config_set_dheparams().Joel Sing
2017-08-12Document tls_reset().Joel Sing
2017-08-11new sentence, new line;Jason McIntyre
2017-08-11Bump minor due to symbol addition.Joel Sing
Prompted by jsg@, since I apparently left it sitting in my tree...
2017-08-10Add a tls_config_set_ecdhecurves() function to libtls, which allows theJoel Sing
names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@
2017-08-09Don't use tls_cert_hash for the hashing used by the engine offloading magicClaudio Jeker
for the TLS privsep code. Instead use X509_pubkey_digest() because only the key should be used as identifier. Relayd is rewriting certificates and then the hash would change. Rename the hash is struct tls_keypair to pubkey_hash to make clear what this hash is about. With input and OK jsing@
2017-08-01correct function name;Jason McIntyre
from carlos cardenas
2017-07-06Document tls_config_set_crl_file() and tls_config_set_crl_mem().Joel Sing
Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks!
2017-07-06Bump minor due to symbol addition.Joel Sing
2017-07-06Add support for providing CRLs to libtls - once a CRL is provided weJoel Sing
enable CRL checking for the full certificate chain. Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks! Discussed with beck@
2017-07-05RFC 6066 states that IP literals are not permitted in "HostName" for aJoel Sing
TLS Server Name extension, however seemingly several clients (including Python, Ruby and Safari) violate the RFC. Given that this is a fairly widespread issue, if we receive a TLS Server Name extension that contains an IP literal, pretend that we did not receive the extension rather than causing a handshake failure. Issue raised by jsg@ ok jsg@
2017-06-22Use the tls_password_cb() callback with all PEM_read_bio_*() calls, so thatJoel Sing
we can prevent libcrypto from going behind our back and trying to read passwords from standard input (which we may not be permitted to do). Found by jsg@ with httpd and password protected keys.
2017-06-22Fix incorrect indentation.Joel Sing
2017-06-22Plug a memory leak in tls_keypair_cert_hash(), introduced in r1.60.Joel Sing
2017-06-22Remove dead code that has remained hiding since ressl.c r1.14!Joel Sing
2017-06-22Use the standard `rv' idiom in tls_keypair_load_cert(), rather thanJoel Sing
duplicating clean up code.
2017-05-16Plug a memory leak. The main_cert needs to be X509_free()ed sinceClaudio Jeker
SSL_get_peer_certificate() increases the ref count whereas extra_certs do not because SSL_get_peer_cert_chain() won't increase ref counts. OK beck@
2017-05-07Ensure that a client context has been connected before attempting toJoel Sing
complete a TLS handshake.
2017-05-07Return an error if tls_handshake() is called on a TLS context that hasJoel Sing
already completed a TLS handshake.
2017-05-06Use freezero() for the tls_load_file() failure case, since we'reJoel Sing
potentially dealing with key material. Also switch a calloc to malloc, since we immediately copy the same amount of data to the newly allocated buffer.
2017-05-06BIO_free_all() and EVP_PKEY_free() can be called with NULL.Joel Sing
2017-05-06Be explicit about when it is safe to call tls_config_free().Joel Sing
Discussed with beck@
2017-05-06Document tls_unload_file().Joel Sing
2017-05-06Perform reference counting for tls_config. This allows tls_config_free() toJoel Sing
be called as soon as it has been passed to the final tls_configure() call, simplifying lifetime tracking for the application. Requested some time ago by tedu@. ok beck@
2017-05-06Provide a tls_unload_file() function, that frees the memory returned fromJoel Sing
a tls_load_file() call, ensuring that it the contents become inaccessible. This is specifically needed on platforms where the library allocators may be different from the application allocator. ok beck@
2017-05-06Bump minors for symbol addition in libcryptoBob Beck
ok jsing@
2017-05-04Move tls_config_skip_private_key_check() out from under HIDDEN_DECLS.Claudio Jeker
Even though this is not a real public interface we need the symbol in the shared library so that relayd can use it (needed for TLS key privsep) OK beck@
2017-05-02use freezero() instead of memset/explicit_bzero + free. SubstantiallyTheo de Raadt
reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
2017-04-30Only enable -Werror on libcrypto/libssl/libtls if we are building withJoel Sing
gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@
2017-04-30Add a tls_keypair_clear_key() function that uses freezero() to make keyJoel Sing
material inaccessible, then call it from the appropriate places. ok beck@
2017-04-27tls_free(3) and tls_config_free(3) accept NULL;Ingo Schwarze
patch from Matthew Martin <phy1729 at gmail dot com>, slightly tweaked by me
2017-04-10Rework name verification code so that a match is indicated via an argument,Joel Sing
rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg <daniel at haxx dot se>. ok beck@ jca@
2017-04-07Use uint8_t instead of u_int8_t - for consistency and to make things easierJoel Sing
for portable. From Raphael Hittich.
2017-04-05Add tls_peer_cert_chain_pem - To retreive the peer certificate and chainBob Beck
as PEM format. This allows for it to be used or examined with tools external to libtls bump minor ok jsing@
2017-04-05Internal changes to allow for relayd engine privsep. sends the hash of theBob Beck
public key as an identifier to RSA, and adds an function for relayd to use to disable private key checking when doing engine privsep. ok jsing@
2017-03-02fix error in Dt; from robert kleinJason McIntyre
2017-02-28Bump minors due to symbol addition.Joel Sing
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 02:20:52 +0000