summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2017-08-23Work around bug in F5's handling of the supported elliptic curves extension.Doug Hogan
RFC 4492 only defines elliptic_curves for ClientHello. However, F5 is sending it in ServerHello. We need to skip over it since our TLS extension parsing code is now more strict. Thanks to Armin Wolfermann and WJ Liu for reporting the issue. input + ok jsing@
2017-08-23Update libexpat to 2.2.4. Fix copying partial UTF-8 characters.Alexander Bluhm
OK deraadt@
2017-08-22Remove mpool.libtp, it was part of the Berkeley DB tarball but notTodd C. Miller
present int the CSRG libc. It is only of historical interest and, given the amount of time passed, probably not even that anymore. OK deraadt@, prodded by miod@
2017-08-21Use waitpid()/EINTR idiom for the specific pid, rather than generic wait(),Theo de Raadt
in case the parent process was started with a dangling child. This style ensures any potential parent:child interlock isn't disrupted due to the "wrong" child being waited on first. Then the other other childs can safely zombie. ok millert jca brynet
2017-08-21import SSL_export_keying_material(3) from OpenSSLIngo Schwarze
2017-08-21merge the applicable parts of SSL_set_tlsext_host_name(3) documentation;Ingo Schwarze
from Paul Yang <yang dot yang at baishancloud dot com> via OpenSSL commit 190b9a03 Jun 28 15:46:13 2017 +0800
2017-08-21Selectively merge OpenSSL commit e091367d May 5 11:56:45 2017 +0100Ingo Schwarze
from Matt Caswell <matt at openssl dot org>. In particular, stop talking about SSL 2.0 and SSL 3.0, but do not start talking about TLS 1.3 just yet.
2017-08-21Mention three functions related to protocol selection by the clientIngo Schwarze
that are deprecated no-ops in LibreSSL, but that OpenSSL explicitly documented on April 19, 2017, without deprecating them.
2017-08-21Delete non-existent function SSL_flush_sessions();Ingo Schwarze
from Rich Salz <rsalz at openssl dot org> via OpenSSL commit 1722496f Jun 8 15:18:38 2017 -0400.
2017-08-21Delete non-existent functions SSL_add_session() and SSL_remove_session() andIngo Schwarze
clarify that SSL_CTX_remove_session(3) marks the session as non-resumable. From Rich Salz <rsalz at openssl dot org> via OpenSSL commit 1722496f Jun 8 15:18:38 2017 -0400 and from Matt Caswell <matt at openssl dot org> via OpenSSL commit b8964668 Apr 26 15:16:18 2017 +0100.
2017-08-20New manual page X509_check_private_key(3), using informationIngo Schwarze
from the OpenSSL manual and from code inspection. Use my own Copyright and license because no Copyright-worthy amount of text from OpenSSL remains. And, no, these functions do *NOT* check private keys, not at all.
2017-08-20fix a pasto in the description of UI_get0_result_string(3);Ingo Schwarze
from Richard Levitte <levitte at openssl dot org> via OpenSSL commit e9c9971b Jul 1 18:28:50 2017 +0200
2017-08-20Add a BUGS section stating that RSA_PKCS1_PADDING is weak by design;Ingo Schwarze
from Emilia Kasper <emilia at openssl dot org> via OpenSSL commit 1e3f62a3 Jul 17 16:47:13 2017 +0200.
2017-08-20Add a BUGS sectionIngo Schwarze
stating that RSA_padding_check_PKCS1_type_2(3) is weak by design; from Emilia Kasper <emilia at openssl dot org> via OpenSSL commit 1e3f62a3 Jul 17 16:47:13 2017 +0200.
2017-08-20import PEM_bytes_read_bio(3) from OpenSSL,Ingo Schwarze
dropping the secmem stuff that we don't want
2017-08-20mention CRYPTO_mem_leaks_cb(3) because OpenSSLIngo Schwarze
now also documents it, in OPENSSL_malloc.pod
2017-08-20import EVP_PKEY_meth_get_count.pod from OpenSSL, pruning the functions weIngo Schwarze
don't have, which implies renaming the file to EVP_PKEY_meth_get0_info.3
2017-08-20fix wrong function name;Ingo Schwarze
from Rich Salz <rsalz at openssl dot org> via OpenSSL commit 1722496f Jun 8 15:18:38 2017 -0400
2017-08-20sync with OpenSSL:Ingo Schwarze
1. mention three additional functions for stitched ciphers from Steven Collison <steven at raycoll dot com> via OpenSSL commit 209fac9f Mar 28 12:46:07 2017 -0700 2. fix wrong data type of an automatic variable in an example from Paul Yang <paulyang dot inf at gmail dot com> via OpenSSL commit 719b289d May 22 23:18:45 2017 +0800 3. fix memory leak in sample encryption code and check return value of fopen from Greg Zaverucha <gregz at microsoft dot com> via OpenSSL commit 519a5d1e Jun 27 17:38:25 2017 -0700
2017-08-20zap trailing whitespace;Jason McIntyre
2017-08-20sprinkle a few missing dependencies on perl scripts internal bits.Marc Espie
'it works' deraadt@
2017-08-20remove a duplicate BIO_do_accept() call from an example;Ingo Schwarze
from Beat Bolli <dev at drbeat dot li> via OpenSSL commit 7a67a3ba Jan 18 23:49:43 2017 +0100
2017-08-20Sync with OpenSSL: document several new functions, plus some additionalIngo Schwarze
minor improvements. Mostly from Todd Short <tshort at akamai dot com> via OpenSSL commit cf37aaa3 Aug 4 11:24:03 2017 +1000.
2017-08-20clarify deprecation notice;Ingo Schwarze
from Rich Salz, OpenSSL commit a95d7574, July 2, 2017
2017-08-20New ASN1_STRING_TABLE_add(3) manual page, based on information fromIngo Schwarze
the OpenSSL manual page committed on July 27, 2017, and on source code inspection. Use my own Copyright and license because no copyright-worthy amount of text from OpenSSL remains. NOTA BENE: BUGS Most aspects of the semantics considerably differ from OpenSSL.
2017-08-20two MALLOC_STATS only tweaks; one from David CARLIER, the other found by clangOtto Moerbeek
2017-08-19fix .Xr ordering, found with mandoc -TlintIngo Schwarze
2017-08-19Import SSL_CTX_set_min_proto_version(3) from OpenSSL, suggested by jsing@.Ingo Schwarze
While importing: * Fix the prototypes, they all contained wrong datatypes. * Delete SSL3_VERSION which is no longer supported. * Delete TLS1_3_VERSION and DTLS1_2_VERSION, not yet supported. * Delete the lie that these would be macros. * Improve SEE ALSO and HISTORY sections.
2017-08-19fix a typo and mention OpenBSD in HISTORY;Ingo Schwarze
both pointed out by jsing@
2017-08-19Use 0xcc trapsleds instead of default/nop/0xcc in BTC alignmentsTheo de Raadt
don't bother with .text before ENTRY()
2017-08-19Use 0xcc trapsleds instead of default/nop/0xcc in BTC alignmentsTheo de Raadt
2017-08-19Don't need .text before ENTRY(), also minor spacing cleanupsTheo de Raadt
2017-08-19Put _map table into .rodata instead of .textTheo de Raadt
2017-08-15s/DEF_STD/DEF_STRONG/ to match namespace.h differences between librthreadPhilip Guenther
and libc
2017-08-15Wrap <sched.h> and <sys/futex.h> so that internal calls go directPhilip Guenther
2017-08-15Sort headers per style(9)Philip Guenther
2017-08-15Copy files from ../librthread in preparation for moving functionalityPhilip Guenther
from libpthread to libc. No changes to the build yet, just making it easier to review the substantive diffs. ok beck@ kettenis@ tedu@
2017-08-15Copy files from ../librthread in preparation for moving functionalityPhilip Guenther
from libpthread to libc. No changes to the build yet, just making it easier to review the substantive diffs. ok beck@ kettenis@ tedu@
2017-08-15fmt0 is a wchar_t *, so use %ls to reportTheo de Raadt
2017-08-14Use sendsyslog() directly instead of syslog_r() for the "backwards memcpy"Philip Guenther
messages, to avoid pulling in piles of other machinery unnecessarily problem observed by schwarze@ ok deraadt@ millert@
2017-08-14fix missing bracket on ARMBrent Cook
ok beck@
2017-08-13match function implementation with declaration, ok beck@, doug@Brent Cook
2017-08-13Add ability to clamp a notafter to values representable in a 32 bit time_tBob Beck
This will only be used in portable. As noted, necessary to make us conformant to RFC 5280 4.1.2.5. ok jsing@ bcook@
2017-08-13Switch to -Werror with clang for libressl.Doug Hogan
Discussed with beck@ and jsing@ ok beck@
2017-08-13add fktrace to libcTed Unangst
2017-08-13move endian/word size checks from runtime to compile timeBrent Cook
ok guenther@
2017-08-13Make SSL{,_CTX}_set_alpn_protos() do atomic updates and handle NULL.Doug Hogan
Previously, the code would accept NULL and 0 length and try to malloc/memcpy it. On OpenBSD, malloc(0) does not return NULL. It could also fail in malloc and leave the old length. Also, add a note that this public API has backwards semantics of what you would expect where 0 is success and 1 is failure. input + ok jsing@ beck@
2017-08-13Convert the sigma and tau initialisers to byte arrays, rather than usingJoel Sing
strings. The original code is perfectly valid C, however it causes some compilers to complain since it lacks room for a string NUL terminator and the compiler is not smart enough to realise that these are only used as byte arrays and never treated as strings. ok bcook@ beck@ inoguchi@
2017-08-13Remove support for the TLS padding extension.Joel Sing
This was added as a workaround for broken F5 TLS termination, which then created issues talking to broken IronPorts. The size of the padding is hardcoded so it cannot be used in any generic sense. ok bcook@ beck@ doug@
2017-08-13Nuke SSL_OP_CRYPTOPRO_TLSEXT_BUG.Joel Sing
This was a workaround for a server that needed to talk GOST to old/broken CryptoPro clients. This has no impact on TLS clients that are using GOST. ok bcook@ beck@ doug@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-17 20:20:08 +0000