summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2017-07-23Hook the TLS extension parsing framework into the serverhello parsing.Joel Sing
Missed in the original commit.
2017-07-22Favor err() over perror() in example.anton
ok schwarze@
2017-07-22zap trailing whitespace;Jason McIntyre
2017-07-22rework the page a bit, clarify a few things, maybe better wordingTed Unangst
2017-07-20Allow leading . in nameConstraints. from openssl via jabberwock. ok jsingTed Unangst
2017-07-20Accessing a mmap(2)ed file behind its end should result in a SIGBUSAlexander Bluhm
according to POSIX. Bring regression test and kernel in line for amd64 and i386. Other architectures have to follow. OK deraadt@ kettenis@
2017-07-20Rename TBUF_LEN and FMT_LEN to _SIZE as they contain a NUL byte.Alexander Bluhm
Change FMT_SIZE to 1024+1 for consistency. Do not loop over the format string if there is no output space left. OK deraadt@ millert@
2017-07-19Update libexpat to 2.2.2. Fixes NULL parser dereference.Alexander Bluhm
no objections deraadt@
2017-07-19Check the return value of CBB_init_fixed(), since it can fail.Joel Sing
2017-07-18Both syslog(3) and syslogd(8) truncate the message at 8192 bytes.Alexander Bluhm
Do the same in sendsyslog(2) and document the behavior. reported by Ilja Van Sprundel; OK millert@ deraadt@
2017-07-16Start rewriting TLS extension handling.Joel Sing
Introduce a TLS extension handling framework that has per-extension type functions to determine if an extension is needed, to build the extension data and parse the extension data. This is somewhat analogous to BoringSSL, however these build and parse functions are intentionally symetrical. The framework is hooked into the existing TLS handling code in such a way that we can gradual convert the extension handling code. Convert the TLS Server Name Indication extension to the new framework, while rewriting it to use CBB/CBS and be more strict in the process. Discussed with beck@ ok inoguchi@
2017-07-15Remove unused variable.Joel Sing
Reported by <dravion at ht-foss dot net>
2017-07-13Get rid of ip6.maxifprefixes and ip6.maxifdefrouters, the kernel noFlorian Obser
longer tracks prefixes or default routers from router advertisements. Pointed out by jmc. ports tree grepping sthen, who only found nsh OK mpi, sthen
2017-07-10if there are no changes for kevent, pass in NULL instead.Ted Unangst
this has no effect except to make ktrace output prettier. ok bluhm mpi
2017-07-10remove misc. depend and yacc nits that no longer matter.Marc Espie
okay millert@
2017-07-10one more instance of the previous commit; also initialize ->offset to aOtto Moerbeek
definite value in the size == 0 case
2017-07-10replace Fifos with FIFOs.David Gwynne
ok jmc@ visa@
2017-07-09use working boilerplate for yacc/lex instead of homemade rules.Marc Espie
okay millert@ (forgot the obvious scanner.l tweak in my diff)
2017-07-08update the little endian processor list to give it a chance of matchingTed Unangst
what the reader is using.
2017-07-07Only access offset if canaries are enabled *and* size > 0, otherwise offsetOtto Moerbeek
is not initialized. Problem spotted by Carlin Bingham; ok phessler@ tedu@
2017-07-06Document tls_config_set_crl_file() and tls_config_set_crl_mem().Joel Sing
Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks!
2017-07-06Bump minor due to symbol addition.Joel Sing
2017-07-06Add support for providing CRLs to libtls - once a CRL is provided weJoel Sing
enable CRL checking for the full certificate chain. Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks! Discussed with beck@
2017-07-06The 0x (or 0X) prefix in base 16 is optional so only skip over theTodd C. Miller
prefix if the character following it is a valid hex char. The C99 standard is clear that given the string "0xy" zero should be returned and endptr set to point to the "x". OK deraadt@ espie@
2017-07-06fix broken cross references; found with mandoc -TlintIngo Schwarze
2017-07-06Add ULL suffix to 64 bit constants. This avoids compiler warningsAlexander Bluhm
on i386 and allows to compile the C++ test. Upstream dropped the ULL in an insufficient attempt to make the siphash code C89 compatible. Their fix will be more complicated. No binary change.
2017-07-06Compile libexpat with -fvisibility=hidden. This restricts theAlexander Bluhm
exported symbols to the indended API. We do not need a Symbols.map anymore. Major library bump is necessary as some internal functions vanish from the ABI. Discussed upstream with Sebastian Pipping; ports bulk build ajacoutot@; OK deraadt@
2017-07-05RFC 6066 states that IP literals are not permitted in "HostName" for aJoel Sing
TLS Server Name extension, however seemingly several clients (including Python, Ruby and Safari) violate the RFC. Given that this is a fairly widespread issue, if we receive a TLS Server Name extension that contains an IP literal, pretend that we did not receive the extension rather than causing a handshake failure. Issue raised by jsg@ ok jsg@
2017-07-05nits about trailing punctuation found with mandoc -TlintIngo Schwarze
2017-07-05void functions don't return 0Theo Buehler
From Klemens Nanni
2017-07-05fix cross references to self; found with mandoc -TlintIngo Schwarze
2017-07-041. mild deprecation noticeIngo Schwarze
2. point to getline (suggested by nicm@) 3. cross reference fgetc(3) rather than putc(3) 4. add missing error handling to the example code OK nicm@
2017-07-04Enable the use of futex(2) in librthread on mips64.Visa Hankala
OK mpi@, deraadt@
2017-07-03Generate source and header files for regress on demand.Alexander Bluhm
OK espie@
2017-07-02repair the tree, make sure y.tab.h is there before compiling yacc files.Marc Espie
problem noticed by deraadt@
2017-06-30Add test suite source files for expat 2.2.1.Alexander Bluhm
2017-06-30AmigaOS and pre-X Mac OS support has been dropped in upstreamAlexander Bluhm
libexpat. Remove obsolete header files, missed in previous commit.
2017-06-30Update libexpat to version 2.2.1 which has some security fixes.Alexander Bluhm
- CVE-2017-9233 CVE-2016-9063 CVE-2016-5300 CVE-2016-4472 CVE-2016-0718 CVE-2015-2716 CVE-2015-1283 CVE-2012-6702 CVE-2012-0876 have been addressed. Not all of them affect OpenBSD as we had fixes before. - Upstream uses arc4random_buf(3) now. Delete all code for other entropy sources to make sure to compile the correct one. Our library already used arc4random(3) before. - The overflow fixes in rev 1.11 and 1.12 of lib/xmlparse.c have been commited upstream in a different way. Use the upstream code to make maintenance easier. - Although it should be ABI compatible, there is a new global symbol align_limit_to_full_utf8_characters. As it is in lib/internal.h, add a Symbols.map to restrict the export. Do not bump the shared library version. - Use the internal expat's siphash.h. ports build ajacoutot@; move ahead deraadt@
2017-06-29take const off the timeval argument in the pending functions.David Gwynne
event_pending, evtimer_pending, and signal_pending all write to the timeval because that's how they tell the caller when the event is meant to fire. ok deraadt@ millert@ jmc@ schwarze@
2017-06-28.init stub creation doesn't need a jmp + .align to reach a branch target,Theo de Raadt
just fall into the code. The .align created a FILL zone in the .init section, which on i386 was filled with a NOP-sled, something we want to get away from. discussed with kettenis and tom
2017-06-22Use the tls_password_cb() callback with all PEM_read_bio_*() calls, so thatJoel Sing
we can prevent libcrypto from going behind our back and trying to read passwords from standard input (which we may not be permitted to do). Found by jsg@ with httpd and password protected keys.
2017-06-22Fix incorrect indentation.Joel Sing
2017-06-22Plug a memory leak in tls_keypair_cert_hash(), introduced in r1.60.Joel Sing
2017-06-22Remove dead code that has remained hiding since ressl.c r1.14!Joel Sing
2017-06-22Use the standard `rv' idiom in tls_keypair_load_cert(), rather thanJoel Sing
duplicating clean up code.
2017-06-22Distinguish between self-issued certificates and self-signed certificates.Joel Sing
The certificate verification code has special cases for self-signed certificates and without this change, self-issued certificates (which it seems are common place with openvpn/easyrsa) were also being included in this category. Based on BoringSSL. Thanks to Dale Ghent <daleg at elemental dot org> for assisting in identifying the issue and testing this fix. ok inoguchi@
2017-06-19port the RBT code to userland by making it part of libc.David Gwynne
src/lib/libc/gen/tree.c is a copy of src/sys/kern/subr_tree.c, but with annotations for symbol visibility. changes to one should be reflected in the other. the malloc debug code that uses RB code is ported to RBT. because libc provides the RBT code, procmap doesn't have to reach into the kernel and build subr_tree.c itself now. mild enthusiasm from many ok guenther@
2017-06-16mark files as BUILDFIRST, or write explicit dependencies, so that mostMarc Espie
programs will build even without a make depend first. okay tb@ millert@
2017-06-13no need for branding in .Nd lineTheo de Raadt
2017-06-12Add dprintf() and vdprintf() RETURN VALUES. OK deraadt@Todd C. Miller
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 04:09:49 +0000