summaryrefslogtreecommitdiff
path: root/lib/libtls
AgeCommit message (Collapse)Author
2019-01-22bump minors after symbol additionTheo Buehler
2019-01-19bump minors after symbol additionTheo Buehler
2018-12-14Delete a note taken during the rev. 1.1 man page spliteIngo Schwarze
that should have been deleted before commit. The cross reference is already present below SEE ALSO. Glitch noticed by jsing@.
2018-11-29missed adding tls_default_ca_cert_file here. found by sthenTed Unangst
2018-11-29expose the default cert file as a function, not a define. it's reallyTed Unangst
an internal detail of the library, so the string should live inside it, not in the application code. ok jsing
2018-11-11bump minors after symbol addition.Theo Buehler
2018-11-06Define TLS_CA_CERT_FILE rather than having every application create theirJoel Sing
own define for /etc/ssl/cert.pem. ok beck@ bluhm@ tb@
2018-10-24Bump libcrypto/libssl/libtls majors due to symbol removals (libcrypto)Joel Sing
and changes to struct visibility/sizes (libssl).
2018-09-12crank to follow minor crank in libcrypto; ok tb@ jsing@Damien Miller
2018-08-24crank majors after symbol addition/modification/removalTheo Buehler
2018-08-21typo in argument type, from Mario dot Andres dot Campos at gmail dot comIngo Schwarze
2018-07-24Use the same order in NAME, SYNOPSIS, DESCRIPTION, and RETURN VALUES toTheo Buehler
improve readability and ease of maintenance. Positive feedback jmc Detailed suggestion & ok schwarze
2018-07-23Document tls_peer_ocsp_result() and use it in place of the non-existentTheo Buehler
tls_peer_ocsp_result_msg() in the documentation. input & ok jsing Reads fine to jmc and makes sense to schwarze
2018-07-09Move a detail on tls_connect(3) to its documentation and be a bit moreTheo Buehler
explicit about the servername argument of tls_connect_servername(3). input & ok jsing, input & ok schwarze on earlier version
2018-07-09wording tweak for tls_init() from jsingTheo Buehler
ok jsing, schwarze
2018-07-08Simplify and shorten the description of tls_init(3),Ingo Schwarze
fixing an awkward wording noticed by tb@. OK tb@
2018-05-26minor markup improvement: .Fa *cctx -> .Pf * Fa cctxIngo Schwarze
2018-05-26Quote .Fa arguments containing blanks.Ingo Schwarze
Diff from Jack Burton <jack at saosce dot com dot au>.
2018-04-07Correct tls_config_clear_keys() behaviour.Joel Sing
Previously this incorrectly called tls_keypair_clear(), which results in the private key being cleared, along with the certificate, OCSP staple and pubkey hash. This breaks OCSP stapling if tls_config_clear_keys() is called following tls_configure(), as is done by httpd. Fix this by calling tls_keypair_clear_key() so that only the private key is cleared, leaving the other public data untouched. While here, remove tls_keypair_clear() and fold the necessary parts into tls_keypair_free(). ok beck@
2018-04-07Switch to OPENSSL_init_ssl() and prevent an openssl configuration file fromJoel Sing
being loaded behind our back, at a later point. ok beck@
2018-03-20Avoid potentially calling strchr() on a NULL pointer inJoel Sing
tls_config_set_ecdhecurve(). Spotted by Coverity.
2018-03-20bump minors after symbol additionTheo Buehler
2018-03-19Automatically handle library initialisation for libtls.Joel Sing
Now that we have tls_init() under pthread_once(), automatically initialise libtls from the entry point functions (tls_config(), tls_client() and tls_server()) - this makes an explicit tls_init() call no longer a requirement. ok bcook@ beck@ inoguchi@
2018-03-17crank majorsTheo Buehler
req by deraadt
2018-03-17Bump minors after symbol additionTheo Buehler
2018-03-15Also bump libtls minor after the addition of SSL_CTX_get_min/max_proto_versionJeremie Courreges-Anglas
cluebat tb@
2018-03-08un-revert tls_init pthread_once change, now that stub is added so that ↵Bob Beck
builds work
2018-03-07backout. diff was not tested comprehensively, resulting in a broken tree.Theo de Raadt
2018-03-07Make tls_init() concurrently callable using pthread_once().Bob Beck
ok jsing@ This brings pthread_once usage into libressl, which will need to get dealt with correctly in portable. This sets us up to autoinit libtls, and we will also be using pthread_once to deal with autoinit stuff in libssl and libcrypto
2018-02-22Bump lib{crypto,ssl,tls} minors due to symbol additions.Joel Sing
2018-02-20Crank lib{crypto,ssl,tls} minors after symbol addition.Theo Buehler
2018-02-18Bump minor due to symbol addition.Theo Buehler
2018-02-18Bump libcrypto/libssl/libtls minors due to symbol additions.Theo Buehler
2018-02-17Bump libcrypto/libssl/libtls minors due to symbol additions.Joel Sing
2018-02-14Bump lib{crypto,ssl,tls} minors due to symbol additions.Joel Sing
2018-02-10Be more specific about when the session file will be updated.Joel Sing
2018-02-10Bump TLS API version since we've added more functionality.Joel Sing
2018-02-10Move the keypair pubkey hash handling code to during config.Joel Sing
The keypair pubkey hash was being generated and set in the keypair when the TLS context was being configured. This code should not be messing around with the keypair contents, since it is part of the config (and not the context). Instead, generate the pubkey hash and store it in the keypair when the certificate is configured. This means that we are guaranteed to have the pubkey hash and as a side benefit, we identify bad certificate content when it is provided, instead of during the context configuration. ok beck@
2018-02-10Tidy/standardise some code.Joel Sing
2018-02-10Remove NULL check from tls_conninfo_cert_pem() - all of the other conninfoJoel Sing
functions require the conninfo passed in to be non-NULL.
2018-02-10Document functions for client-side TLS session support.Joel Sing
2018-02-10Add support to libtls for client-side TLS session resumption.Joel Sing
A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@
2018-02-10Bump lib{crypto,ssl,tls} minors due to symbol addition.Joel Sing
2018-02-08Have tls_keypair_pubkey_hash() call tls_keypair_load_cert() instead ofJoel Sing
rolling its own certificate loading. This also means we get better error reporting on failure.
2018-02-08Ensure that tls_keypair_clear() clears the OCSP staple and pubkey hash.Joel Sing
2018-02-08Do not bother NULLing pointers in a struct that is about to be freed.Joel Sing
2018-02-08Move tls_keypair_pubkey_hash() to the keypair file.Joel Sing
2018-02-08Avoid a memory leak that results when the same tls_config is reused.Joel Sing
Reported by and fix from Nate Bessette <openbsd at nate dot sh> - thanks.
2018-02-08Assert tedu's copyright since some of the code moved here is his.Joel Sing
2018-02-08Split keypair handling out into its own file - it had already appearedJoel Sing
in multiple locations. ok beck@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 19:51:03 +0000