summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2014-07-13Make sure all error conditions in RSA_padding_add_PKCS1_PSS_mgf1() causeMiod Vallat
EVP_MD_CTX_cleanup() to be called.
2014-07-13Possible PBEPARAM leak in the error path.Miod Vallat
2014-07-13dsa_priv_decode(): only destroy the object we've created, and with theMiod Vallat
appropriate function. Checking for privkey != NULL is not enough since privkey points to a member of ndsa if ndsa != NULL. dsa_priv_encode(): possible double free in error path.
2014-07-13Check X509_NAME_oneline() return value when it will have to allocate memory.Miod Vallat
2014-07-13EVP_DigestInit_ex() may be used to recycle an existing EVP_MD_CTX without havingMiod Vallat
to reinitialize all of it, especially if it is used with the same MD algorithm. However, when the MD algorithm changes, it needs to perform more cleanups. Make that code more closer to what EVP_MD_CTX_cleanup() does by: - only freeing md_data if EVP_MD_CTX_FLAG_REUSE is not set - performing an explicit_bzero of md_data before freeing it - making sure we call EVP_PKEY_CTX_free on the pctx if the allocation for the new md_data fails. ok tedu@
2014-07-13Don't include asn1_mac.h if all you need is asn1.h.Miod Vallat
2014-07-13Take out __bounded__ in the include files we use it in when not on OpenBSD.Bob Beck
while we can take it out in portable at compile time, it is still a problem when we install this header file on a system that doesn't support __bounded__ if this is unguarded. ok miod@ bcook@
2014-07-13While we thought this would make portable life easier it actuallyBob Beck
makes it much harder. ok bcook@ kettenis@
2014-07-13No need to include evp_locl.h in there.Miod Vallat
2014-07-13Take away the use of the address of main as a source of entropy. CausesBob Beck
distractions to people testing and seeing link errors in some setups. This will come back in another form ok deraadt@
2014-07-13KNF and some code cleaning.Joel Sing
2014-07-13remove silly castTheo de Raadt
2014-07-13Another large dose of KNF.Joel Sing
2014-07-12Apply a large dose of KNF.Joel Sing
2014-07-12duplicate function names in head1Miod Vallat
2014-07-12The correct name for EDH is DHE, likewise EECDH should be ECDHE.Joel Sing
Based on changes to OpenSSL trunk. ok beck@ miod@
2014-07-12No need to include asn1_mac.h here.Miod Vallat
2014-07-12remove double brackets. fixes build with clang.Jonathan Gray
ok jsing@
2014-07-12Remove this sentence:Miod Vallat
``The probability that a randomly generated key is weak is -1/2^52, so it is not really worth checking for them.'' This kind of naively optimistic attitude is not compatible with security.
2014-07-12more MLINKSMiod Vallat
2014-07-12getentropy on Windows. It compiles but has not been thoroughly tested yet.wouter
OK: beck@
2014-07-12Remove signed/unsigned warning, statement before declaration andwouter
add a function to use function pointers that does not take sizeof(fptr). OK beck@
2014-07-12We have EVP_CIPH_FLAG_DEFAULT_ASN1 in evp.h; no need to keep constructs toMiod Vallat
build on pre-EVP_CIPH_FLAG_DEFAULT_ASN1 codebases. ok jsing@
2014-07-12Remove private_{Camellia,RC4}_set_key FIPS indirection tentacles, as has beenMiod Vallat
done for other symmetric algorithms recently.
2014-07-12Provide ssl_version_string() function, which uses one of those modern CJoel Sing
constructs (a switch statement) and returns the appropriate string defined by SSL_TXT_* for the given version, including support for DTLSv1 and DTLSv1-bad. Use this function in SSL_get_version() and SSL_SESSION_print(). ok beck@
2014-07-12In openssl_startup(), call SSL_library_init() and SSL_load_error_strings().Joel Sing
This allows us to remove the ERR_load_crypto_strings() call, along with the various SSL_load_error_strings() and OpenSSL_add_ssl_algorithms() calls scattered around the place. ok beck@
2014-07-12Make the BLOCK_CIPHER_{generic,custom} macros expand to more readable structMiod Vallat
definitions using C99 field initializers. No functional change.
2014-07-12Wrap "thread_private.h" with #ifdef __OpenBSD__ so that other systemsTheo de Raadt
can copy this file (plus chacha_private.h) directly and reuse it trivially. Well, as long as they have a getentropy() as well.. ok beck
2014-07-12Remove extra parenthesis.Joel Sing
2014-07-12need_cert is now always true, so remove the variable and associatedJoel Sing
conditionals. ok miod@
2014-07-12openssl(1) is only built as a single monolithic binary, so just callJoel Sing
load_config() once when we start. ok miod@
2014-07-12jsing and I are investigating removal of all? most? 'getenv from library'Theo de Raadt
instances. This one for OPENSSL_ALLOW_PROXY_CERTS gets turned off first, especially since it had this special comment: /* A hack to keep people who don't want to modify their software happy */ ok beck jsing
2014-07-12more accept_rtadv removal;Jason McIntyre
2014-07-12tweak previous;Jason McIntyre
2014-07-12no more net.inet6.ip6.accept_rtadvHenning Brauer
no idea how jmc finds these, but I'm very glad he does
2010-10-01import OpenSSL-1.0.0aDamien Miller
2014-07-12A few fixes/improvements:Miod Vallat
- first, BN_free == BN_clear_free in our libcrypto, so we do not need to treat CBIGNUM (crypto BN) separately from BIGNUM (regular BN). - then, in bn_i2c(), since BN_bn2bin returns BN_num_bytes(input), take advantage of this to avoid calling BN_num_bytes() a second time. BN_num_bytes() is cheap, but this not a reason to perform redundant work. - finally, in bn_c2i, if bn_new() fails, return early. Otherwise BN_bin2bn will try to create a BN too, and although this will probably fail since we were already out of memory, if we are on a threaded process and suddenly the allocation succeeds, we will leak it since it will never be stored in *pval. ok jsing@
2014-07-12Make sure the return value of X509_NAME_oneline(, NULL,) is checked againstMiod Vallat
NULL. ok deraadt@ guenther@ jsing@
2014-07-12if (x) FOO_free(x) -> FOO_free(x).Miod Vallat
Improves readability, keeps the code smaller so that it is warmer in your cache. review & ok deraadt@
2014-07-12more MLINKsMiod Vallat
2014-07-12guard inclusion of sys/sysctl.h so we can detect at compile time andBob Beck
keep linux distros happy that don't have it. ok bcook@
2014-07-12Principle of least surprise: make CMAC_CTX_free(), OCSP_REQ_CTX_free() andMiod Vallat
X509_STORE_CTX_free() accept NULL pointers as input without dereferencing them, like all the other well-behaved *_CTX_free() functions do.
2014-07-12remove gratuitous differences, ok beckTheo de Raadt
2014-07-12remove gratuitous differences, ok beck bcookTheo de Raadt
2014-07-12Correct the sentence in the BUGS section. Colon chars are usable as aYASUOKA Masahiko
string value and usage of it in type is documented in the other section. ok jmc
2014-07-12Split arc4random_uniform into it's own file, to assist other projectsTheo de Raadt
now using this as upstream code. The particular problem is systems that contain older arc4random derivations lacking arc4random_uniform(). ok tedu miod
2014-07-12Solaris uses a symbolic link for /dev/urandom which harms best practice ofBob Beck
using O_NOFOLLOW - cope with it as best as possible by trying two different paths. - written by deraadt@ and kettenis@
2014-07-12Remove remnants from PSK, KRB5 and SRP.Joel Sing
ok beck@ miod@
2014-07-12typosMiod Vallat
2014-07-12Place comments in a block above the if statement, rather than attemptingJoel Sing
to interleave them within the conditions. Also fix wrapping and indentation.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 10:04:30 +0000