| Age | Commit message (Collapse) | Author |
|---|
|
|
|
This uses the same language in most manuals mentioning the obsolete
ENGINE parameters. Make it clear that it is always ignored and that
NULL should be passed. Always call it engine instead of a mix of e
pe, impl, eng.
|
|
|
|
|
|
|
|
For a long time SSL_SESSION has had both a cipher ID and a pointer to
an SSL_CIPHER (and not both are guaranteed to be populated). There is also
a pointer to an SSL_CIPHER in the SSL_HANDSHAKE that denotes the cipher
being used for this connection. Some code has been using the cipher from
SSL_SESSION and some code has been using the cipher from SSL_HANDSHAKE.
Remove cipher from SSL_SESSION and use the version in SSL_HANDSHAKE
everywhere. If resuming from a session then we need to use the SSL_SESSION
cipher ID to set the SSL_HANDSHAKE cipher. And we still need to ensure that
we update the cipher ID in the SSL_SESSION whenever the SSL_HANDSHAKE
cipher changes (this only occurs in a few places).
ok tb@
|
|
|
|
SSL_SESSION has a 'ciphers' member which contains a list of ciphers
that were advertised by the client. Move this from SSL_SESSION to
SSL_HANDSHAKE and rename it to match reality.
ok tb@
|
|
POSIX says this is implementation-dependent; OpenBSD does not allow
it. OK guenther@
|
|
been waited for. If you SIG_IGN SIGCHLD or don't call any of the wait
functions then RUSAGE_CHILDREN wont report anything.
OK deraadt@ millert@
|
|
The handshake MAC needs to be upgraded when TLSv1.0 and TLSv1.1
ciphersuites are used with TLSv1.2. Since we no longer support TLSv1.0
and TLSv1.1, we can simply upgrade the handshake MAC in the ciphersuite
table and remove the various defines/macros/code that existed to handle
the upgrade.
ok tb@
|
|
|
|
This would have prevented the PKCS12 oopsie.
|
|
This tries to copy some microsoft attributes which are not usually present
and chokes on the now disabled EVP_PKEY_*attr* API. Instead of reviving
about four layers of traps and indirection, just inline the two functions
in a way that should be more obvious.
found by anton via the ruby-openssl tests
ok jsing
|
|
These have not been used for a long time, however SSL_CIPHER was not opaque
at the time, hence they had to stick around. Now that SSL_CIPHER is opaque
we can simply mop them up.
ok tb@
|
|
|
|
Instead of jumping through many layers that cause headache, we can achieve
the same in an entirely straightforward way without losing clarity.
ok jsing
|
|
There is a single consumer of this entire family of function, namely
the openssl(1) pkcs12 command uses EVP_PKEY_add1_attr_by_NID, so leave
that one intact for now.
ok jsing
|
|
h/t to levitte
|
|
|
|
Needed by newer freeradius. This is a straightforward implementation that
essentially duplicates tls13_cipher_hash().
ok jsing
|
|
lhash_local.h was previously needed since conf/conf_api.c and
objects/obj_dat.c were fiddling with lhash internals when deleting via a
callback. Since we no longer need to do that, inline the structs in
lhash.c and remove the header.
ok tb@
|
|
The %ls (wide char string) support in printf(3) currently uses
malloc(3), which violates the promise in in sigaction(2). This
makes it use mmap(2) instead. OK deraadt@
|
|
|
|
Missing function hit by fcambus@ some time ago. ok millert@
|
|
Designed to let userland peek at AT_HWCAP and AT_HWCAP2 using an already
existing interface coming from FreeBSD. Headers bits were snatched from
there. Input & ok kettenis@
libc bump and sets sync will follow soon
|
|
missed in 2022 "remove please from manual pages" commit
ok tb@
|
|
|
|
|
|
Now that the SSL2 client hello support is gone, nothing uses this anymore,
except that a few ports still need SSL2_VERSION.
ok beck
|
|
This could be made cleaner if we expose ERR_load_const_strings(), but for
now this hackier version with casts achieves the same and removes the last
unprotected modifiable globals in this library.
ok jsing
|
|
Use C99 initializers for all structs (some were forgotten).
Make all the structs static, call them x509v3_ext_* matching NID_*.
Add accessors called x509v3_ext_method_* and use these to implement
X509V3_EXT_get_nid().
This adds consistency and avoids a few contortions like grouping
a few extensions in arrays to save a couple externs.
ok beck jsing
|
|
Of allowing you to pass in a NID directly, instead of a trust_id,
and have it work, as long as the trust_id's and the NID's did not
overlap.
This screwball behaviour was depended upon by the OCSP code that
called X509_check_trust with the NID, instead of the trust id, so
let's fix that.
We also rename the confusingly named X509_TRUST_DEFAULT to
X509_TRUST_ACCEPT_ALL which makes a lot more sense, and rototill
this to remove the confusingly named static functions.
This will shortly be follwed up by making this function private,
so we have not bothered to fix the amazingly obtuse man page
as it will be taken behind the barn at that time.
ok tb@
|
|
The XXX comment in here is now outdated. Our behaviour matches boringssl
in that passing in a 0 trust gets the default behavior, which is to
trust the certificate only if it has EKU any, or is self signed.
Remove the goofy unused nid argument to "trust_compat" and rename it to
what it really does, instead of some bizzare abstraction to something
simple so the code need not change if we ever change our mind on what
"compat" is for X.509, which will probably only happen when we are back
to identifying things by something more sensible like recognizable grunts
and smells.
ok jsing@
|
|
ok beck kettenis, earlier versions jmc
|
|
|
|
|
|
Instead rename the **ext in this file to **out_ext, freeing up ext in
X509_EXTENSION_create_by_OBJ()
Appeases some jsing grumbling on review
|
|
x -> out_ext, sk -> exts
requested by jsing on review
|
|
requested by jsing on review
|
|
This is a silly API, but there are worse.
ok jsing
|
|
ok jsing
|
|
ok jsing
|
|
Remove unnecessary ret parameter and freeing of obj (which looks like
a double free or freeing of unallocated memory but actually isn't due
to various magic flags). Also make this const correct.
ok jsing
|
|
This is another brilliancy straight out of muppet labs. Overeager and
misguided sprinkling of NULL checks, going through the trademark poor
code review, made this have semantics not matching what almost every
other function with this signature would be doing in OpenSSL land.
This is a long standing mistake we can't fix without introducing
portability traps, but at least annotate it. Simplify the elaborate
dance steps and make this resemble actual code.
ok jsing
|
|
Drop unnecessary checks that are part of the stack API.
ok jsing
|
|
Plus, replace a manual check with a call to X509_EXTENSION_get_critical().
ok jsing
|
|
Like most of its siblings, this function can be simplified significantly
by making proper use of the API that is being built. Drop unnecessary NULL
checks and other weirdness and add some const correctness.
ok jsing
|
|
different asm stanzas to produce strong aliases.
This unbreaks libssl on hppa after the recent switch to LIBRESSL_NAMESPACE.
|
|
different asm stanzas to produce strong aliases.
This unbreaks libcrypto (and thus ssh, among other things) on hppa after the
recent switch to LIBRESSL_CRYPTO_NAMESPACE.
|
