summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2017-03-04Drop the second argument of dtls1_set_message_header() and make it a voidJoel Sing
function. Nothing makes use of the return value and the second argument was only used to produce the return value...
2017-03-04Call ssl3_handshake_write() instead of ssl3_do_write() - this was missedJoel Sing
when ssl3_send_client_certificate() was converted to the standard handshake functions in r1.150 of s3_clnt.c. This has no impact on TLS, however it causes the DTLS client to fail if the server sends a certificate request, since the TLS MAC is calculated on a non-populated DTLS header. Issue reported by umokk on github.
2017-03-03Ensure MD and key initialized before processing HMACKinichiro Inoguchi
Ensure both MD and key have been initialized before processing HMAC. Releasing HMAC_CTX in error path of HMAC(). In regress test, added test 4,5,6 and cleaned up the code. ok jsing@
2017-03-02document EPERM error when connect(2)ing.Sebastian Benoit
ok bluhm@ jmc@ renato@
2017-03-02fix error in Dt; from robert kleinJason McIntyre
2017-03-01Convert ssl3_{get,send}_server_key_exchange() to EVP_md5_sha1().Joel Sing
ok inoguchi@
2017-03-01Include EVP_md5_sha1() via OpenSSL_add_all_digests().Joel Sing
2017-02-28Bump minors due to symbol addition.Joel Sing
2017-02-28Document EVP_md5_sha1().Joel Sing
2017-02-28Add an EVP interface that provides concatenated MD5+SHA1 hashes, which areJoel Sing
used in various parts of TLS 1.0/1.1. This will allow for code simplification in libssl. The same interface exists in OpenSSL 1.1. ok beck@ deraadt@ inoguchi@ millert@
2017-02-28Fix typo in issuingDistributionPoint description.Joel Sing
2017-02-28Stop pretending that MD5 and SHA1 might not exist - rather than locatingJoel Sing
"ssl3-md5" and "ssl-sha1", call the EVP_md5() and EVP_sha1() functions directly. ok beck@ inoguchi@
2017-02-27use Dv, for consistency; from bruno flueckigerJason McIntyre
2017-02-27Add support for RES_USE_DNSSECJeremie Courreges-Anglas
RES_USE_DNSSEC is implemented by setting the DNSSEC DO bit in outgoing queries. The resolver is then supposed to set the AD bit in the reply if it managed to validate the answer through DNSSEC. Useful when the application doesn't implement validation internally. This scheme assumes that the validating resolver is trusted and that the communication channel between the validating resolver and and the client is secure. ok eric@ gilles@
2017-02-27Recognize and allow bits AD and CD in DNS replies.Jeremie Courreges-Anglas
Needed for RES_USE_DNSSEC support. ok eric@ gilles@
2017-02-27Put a common flags field in the query struct, rather than in someJeremie Courreges-Anglas
elements of the union. This field is for internal asr flags. The flags in "struct rrset" and "struct ni" are different kinds of flags. ok eric@
2017-02-27RELRO means the __{got,plt}_{start,end} symbols are superfluousPhilip Guenther
ok kettenis@
2017-02-26Our certbegin/certend is always PIC, so remove the non-PIC MD_SECT_CALL_FUNC()Mark Kettenis
implementations. ok guenther@
2017-02-26Use a long branch (using movw/movt) to implement MD_SECT_CALL_FUNC.Mark Kettenis
Necessary (but perhaps not suffcient) to build large binaries on arm. ok guenther@
2017-02-25Provide libc++abi as shared library as well. Discussed and requestedPatrick Wildt
due to ports build failures. ok kettenis@
2017-02-24Add the following root CAs, from SECOM Trust Systems / Security CommunicationStuart Henderson
of Japan, they are present in Mozilla's CA store. OK ajacoutot@ /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1 /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 /C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1
2017-02-23The assembly for sigpending(2) wasn't correctly implemented either. IPatrick Wildt
suppose this still stems from the first steps where we tried to get at least some userland stuff to compile. This change properly saves the pointer before doing the syscall and stores the return value in the pointer on return. This makes sigpending regress pass.
2017-02-23SHA-1 collisions have now been found so update some man pages. As noted byDaniel Dickman
minek van on misc@. Thanks. ok tb@, tj@ (and jmc@ is ok with the diff but can't ok the technical content).
2017-02-23Replace use of mathematical minus with an em-dash (from tb@) and break upDaniel Dickman
a long sentence (from tj@).
2017-02-23Put a common subq pointer in the query struct, rather than one in eachEric Faurot
element of the union. ok gilles@ millert@ krw@
2017-02-22The assembly for sigprocmask(2) had a tiny typo which made it jump toPatrick Wildt
the wrong location, thus not making it set SIG_BLOCK with a zero mask when attempting to read the signal mask (if set ptr is NULL). Instead an attempt to read the mask actually told the syscall to set the mask to zero.
2017-02-21missing breaksEric Faurot
ok jca@ krw@ gilles@
2017-02-21Remove STREEBOG 512 as a TLS MAC since there are currently no cipher suitesJoel Sing
that make use of it. ok bcook@ inoguchi@
2017-02-21Report the errno set by getifaddrs(3) if the setup for AI_ADDRCONFIG fails,Eric Faurot
rather than a non-informative EAI_FAIL. Compare to -1 for error detection while here. ok jca@ gilles@
2017-02-21don;t end Nd with a full stop;Jason McIntyre
2017-02-20Mark ERR_add_error_data and ERR_add_error_vdata as not for internal use,Bob Beck
and document ERR_asprintf_error_data as their replacement. ok jsing@, ingo@
2017-02-20spelling fix;Jason McIntyre
2017-02-20document tls_config_error(3) RETURN VALUES, improve what is saidIngo Schwarze
about tls_error(3), and warn about some traps; OK jmc@
2017-02-20__tfork(3) returns the thread ID of the new thread in x0, not x1. ThePatrick Wildt
value returned in x1 on __tfork(3) is always zero, which made the code always fall into the child case.
2017-02-19Move static variables from .data to .bss by not initializing them to zeroPhilip Guenther
ok kettenis@
2017-02-19Use T_OPT instead of literal "41".Jeremie Courreges-Anglas
Requested earlier by eric@
2017-02-18Use more specific error codes for invalid packets.Eric Faurot
In particular, truncated packets without the TC flag set (non-compliant server sending too large packets) now fail with EOVERFLOW instead of EINVAL, so the TCP fallback mechanism can work. feedback and ok krw@ jca@ benno@
2017-02-18Add EDNS0 support.Jeremie Courreges-Anglas
EDNS allows for various DNS extensions, among which UDP DNS packets size bigger than 512 bytes. The default is still to not advertize anything. ok eric@
2017-02-17use common errnos instead of random strings as error indicators inEric Faurot
pack/unpack contexts. ok krw@ deraadt@
2017-02-17Increase UDP packet buffer to 4096 bytes from 512. There are some reallyKenneth R Westerback
broken DNS servers out there that send packets >512 bytes w/o even the courtesy of trying to use EDNS0. A partial workaround as more complete packet parsing solutions are worked on. ok jca@ eric@
2017-02-16clang is installed as cc and c++ there is no need to set CC and CXX toJonathan Gray
clang and clang++.
2017-02-15Style improvement, no functional change.Ingo Schwarze
As reported by Yuri Pankov, some versions of GCC whine that "tmp" might be used uninitialized in fts_open(3). Clearly, that cannot actually happen, but explicitly setting it to NULL is safer anyway. While here, rename the badly named variable "tmp" and make the inner "if" easier to understand. Feedback and OK guenther@
2017-02-15Avoid dereferencing a pointer when reporting an error about the sameJoel Sing
pointer being NULL. Found by jsg@ with cppcheck; also detected by Coverity.
2017-02-15Add a NULL test to wrterror() to avoid a NULL deref when called from aJonathan Gray
free() error path. ok otto@
2017-02-14Missing opening brace. Spotted by Hiltjo Posthuma.Theo Buehler
2017-02-14bump to 2.5.2Brent Cook
2017-02-12malloc does not *need* to return page-aligned objects for size >=Otto Moerbeek
a page. This is not required by any standard and other malloc implementation do not document (or implement) this. ok deraadt@
2017-02-09DES keys are not 7 days long. ok jsing@Darren Tucker
2017-02-07Revert previous; the implementation is incorrect since it assumes that theJoel Sing
provided error code matches the error that is currently on the top of the error stack.
2017-02-07Add file and line to the LibreSSL error strings sine we are no longer inBob Beck
1989, VMS, or MS/DOS and we all run Brobdingnagian C compilers that have can now be counted on to achieve this level of sophistication nearly everywhere. ok jsing@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 23:49:46 +0000