summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2017-05-17The BSD qsort() performs tail recursion elimination on the secondTodd C. Miller
side of the array being partitioned to save on stack space. Greater savings can be gained by choosing recursion for the smaller side of the partition and eliminating recursion for the larger side. This also results in a small but measurable performance gain. OK otto@ schwarze@
2017-05-16Plug a memory leak. The main_cert needs to be X509_free()ed sinceClaudio Jeker
SSL_get_peer_certificate() increases the ref count whereas extra_certs do not because SSL_get_peer_cert_chain() won't increase ref counts. OK beck@
2017-05-15Typo: freezeo -> freezeroTheo Buehler
From "fenderq" on freenode via tj@
2017-05-13- fix bug wrt posix_memalign(3) of blocks between half a page and a pageOtto Moerbeek
- document posix_memalign() does not play nice with reacallocarray(3) and freezero(3)
2017-05-11Fix a problem introduced in freezero() conversion and useJonathan Gray
sizeof(struct) not sizeof(pointer). otto@ points out that on OpenBSD currently freezero() would have still zeroed the entire allocation, but this is not documented behaviour and may change in future. ok tom@
2017-05-09Enable TLS support but default to the emulatated TLS model. Enable theMark Kettenis
runtime support code libcompiler_rt for this. This code uses functions that live in libpthread, so code that uses TLS support will need to be linked with -lpthread. This should allow more ports to build with base clang. ok espie@
2017-05-09Prevent memory leak on sbuf by freeing it unconditionally and ensureRicardo Mestre
finalbuf is also free'd if kn_encode_base64 somehow fails hint from tb@, OK millert@ and tb@
2017-05-08Fix exponential CPU use with repeated '*' operators by changing '*'Todd C. Miller
handling to be interative instead of recursive. Fix by Yves Orton, ported to OpenBSD glob.c by Ray Lai. OK tb@
2017-05-08Update STANDARDS section, these are now in XSI BASE.Todd C. Miller
2017-05-08BUF_MEM_grow_clean() returns an int, not a size_t. Humourously, on successJoel Sing
it returns "len", which is a size_t value, as an int...
2017-05-07killpg() is covered by XSI so add a STANDARDS section to that effectTodd C. Miller
and document that handling of process group 0 is not specified by the standard.
2017-05-07Drop cipher suites with DSS authentication - there is no good reason toJoel Sing
keep these around. ok beck@
2017-05-07Don't allow a negative process group ID, it would turn into aTodd C. Miller
process ID when negated.
2017-05-07Instead of starting a 'zero-sized' CBB at the size of the first additionJoel Sing
to the CBB, then doubling, start with an initial size of 64 bytes. Almost all uses will exceed this size and we avoid multiple small recallocarray() calls during the initial usage. ok beck@
2017-05-07Move state from ssl->internal to the handshake structure.Bob Beck
while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
2017-05-07Ensure that a client context has been connected before attempting toJoel Sing
complete a TLS handshake.
2017-05-07Return an error if tls_handshake() is called on a TLS context that hasJoel Sing
already completed a TLS handshake.
2017-05-06Move info about group handling via a negative pid into the listTodd C. Miller
with the other pid-specific details.
2017-05-06Bring in an SSL_HANDSHAKE structure and commence the great shovellingBob Beck
ok jsing@, gcc@, regress@
2017-05-06Use freezero() for the tls_load_file() failure case, since we'reJoel Sing
potentially dealing with key material. Also switch a calloc to malloc, since we immediately copy the same amount of data to the newly allocated buffer.
2017-05-06BIO_free_all() and EVP_PKEY_free() can be called with NULL.Joel Sing
2017-05-06Be explicit about when it is safe to call tls_config_free().Joel Sing
Discussed with beck@
2017-05-06Document tls_unload_file().Joel Sing
2017-05-06Perform reference counting for tls_config. This allows tls_config_free() toJoel Sing
be called as soon as it has been passed to the final tls_configure() call, simplifying lifetime tracking for the application. Requested some time ago by tedu@. ok beck@
2017-05-06Provide a tls_unload_file() function, that frees the memory returned fromJoel Sing
a tls_load_file() call, ensuring that it the contents become inaccessible. This is specifically needed on platforms where the library allocators may be different from the application allocator. ok beck@
2017-05-06Bring in HKDF, from BoringSSL, with regress tests modified to beBob Beck
in C. Ride previous minor bump ok tom@ inoguchi@ jsing@
2017-05-06Provide SSL{,_CTX}_set_{min,max}_proto_version() functions.Joel Sing
Rides minor bump. ok beck@
2017-05-06space needed between macro arg and punctuation;Jason McIntyre
2017-05-06Bump minors for symbol addition in libcryptoBob Beck
ok jsing@
2017-05-06Add ASN1_TIME_set_to to exported symbolsBob Beck
ok jsing@
2017-05-06Add ASN1_TIME_set_tm to set an asn1 from a struct tm *Bob Beck
ok jsing@
2017-05-06Add missing $OpenBSD$ tags.Joel Sing
2017-05-05Document what happens when sending a signal to the calling process.Todd C. Miller
OK jmc@
2017-05-05Mention that the signal mask does not affect what signals areTodd C. Miller
discarded by the kernel. Document that at least one pending signal will be delivered before sigprocmask() returns.
2017-05-04Merge headers defining identifiers from sysctl.8 into sysctl.3. Shorten andTheo Buehler
update their descriptions. In sysctl.8 refer to /etc/sysctl.conf in FILES. discussed with and ok jmc
2017-05-04Move tls_config_skip_private_key_check() out from under HIDDEN_DECLS.Claudio Jeker
Even though this is not a real public interface we need the symbol in the shared library so that relayd can use it (needed for TLS key privsep) OK beck@
2017-05-03spacing (in EXAMPLES code)Reyk Floeter
2017-05-03make the description strings match the codeTheo de Raadt
2017-05-02the XXXfree functions being called accept NULL, so don't check first.Theo de Raadt
ok beck
2017-05-02use freezero() instead of memset/explicit_bzero + free. SubstantiallyTheo de Raadt
reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
2017-05-01Document that wait3/waitpid can receive SIGCHILD when wpid doesTodd C. Miller
not exist or is not a child of the calling process. Document what happens when SIGCHLD is ignored or SA_NOCLDWAIT is set in sa_flags (this part from FreeBSD). OK guenther@
2017-04-30No original OpenSSL code remains in this file. RelicenseBob Beck
2017-04-30Add futex(2) shim, bump minor.Martin Pieuchot
Inputs from guenther@, ok kettenis@, visa@
2017-04-30Make BIO_get_host_ip just yet another getaddrinfo wrapperBob Beck
2017-04-30Rework BIO_accept to be more like modern code.Bob Beck
ok jsing@
2017-04-30Only enable -Werror on libcrypto/libssl/libtls if we are building withJoel Sing
gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@
2017-04-30Switch back to freezero() and explicitly initialise data_len to zero. TheJoel Sing
previous code was safe since data would always be NULL if data_len was uninitialised, however compilers cannot know this.
2017-04-30Microsoft Windows hates BIO_get_accept_socket in portable. Fix it toBob Beck
not be awful or have any claims on supporting ipv6 when it does so very badly ok jsing@
2017-04-30Add a tls_keypair_clear_key() function that uses freezero() to make keyJoel Sing
material inaccessible, then call it from the appropriate places. ok beck@
2017-04-29Fix a bug caused by the return value being set early to signal successfulJoel Sing
DTLS cookie validation. This can mask a later failure and result in a positive return value being returned from ssl3_get_client_hello(), when it should return a negative value to propagate the error. Ironically this was introduced in OpenSSL 2e9802b7a7b with the commit message "Fix DTLS cookie management bugs". Fix based on OpenSSL. Issue reported by Nicolas Bouliane <nbouliane at jive dot com>. ok beck@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 20:28:11 +0000