| Age | Commit message (Collapse) | Author |
|---|
|
These were already under LIBRESSL_INTERNAL hence no ABI change.
ok tb@
|
|
the same implementation that we're already using for lrintl(3) and llrintl(3).
The old implementations were derived from code from NetBSD that didn't pass
the lib/libm/msun/lrint_test regress test. NetBSD replaced their
implementation with the FreeBSD implementation of this code which we were
already using for lrintl(3) and llrintl(3). This fixes the regress test.
ok bluhm@, millert@
|
|
else in libcrypto's manuals and headers).
|
|
A tiny realpath(3) wrapper to make a porter's life easier.
Feedback kettenis deraadt cheloha sthen
OK cheloha martijn deraadt
|
|
|
|
diff from chohag jtan com
ok claudio
|
|
for a NULL ctx->ctx in the lookup functions using X509_STORE_CTX.
This affects X509_STORE_get1_certs(), X509_STORE_get1_crls(),
X509_STORE_CTX_get1_issuer() and X509_STORE_get_by_subject().
With this X509_verify_cert() no longer crashes with a NULL store.
With and OK tb@
|
|
.h files as required.... preparing for a potential future when sys/proc.h
might be more clean...
do not touch the MD .c files yet, the dragons remain full of fire
|
|
|
|
In order to work around the expired DST Root CA X3 certficiate, enable
X509_V_FLAG_TRUSTED_FIRST in the legacy verifier. This means that the
default chain provided by Let's Encrypt will stop at the ISRG Root X1
intermediate, rather than following the DST Root CA X3 intermediate.
Note that the new verifier does not suffer from this issue, so only a
small number of things will hit this code path.
ok millert@ robert@ tb@
|
|
ok sthen, beck, jsing, tb, etc etc
|
|
The length checks need to be >= rather than > in order to ensure the string
remains NUL terminated. While here consistently check wi before using it
so we have the same idiom throughout this function.
Issue reported by GoldBinocle on GitHub.
ok deraadt@ tb@
|
|
execve can be detected better
reported by Alejandro Colomar, ok millert
|
|
This matches the documented behavior more obviously and ensures that
these aren't optimized away, although this is unlikely.
Discussed with deraadt and otto
|
|
|
|
initialization instead.
|
|
|
|
|
|
|
|
When we finish sending a flight of records, flush the record layer output.
This effectively means calling BIO_flush() on the wbio.
Some things (such as apache2) have custom BIOs that perform buffering and
do not actually send on BIO_write(). Without BIO_flush() the server thinks
it has sent data and starts receiving records, however the client never
sends records since it never received those that the server should have
sent.
Joint work with tb@
ok tb@
|
|
|
|
"typedef struct ssl_st SSL;" is defined in ossl_typ.h.
This reverts part of r1.204.
ok tb@
|
|
|
|
The p5-Net-SSLeay test expects the info callback to be called on
connect exit. This is the behavior in the legacy stack but wasn't
implemented in the TLSv1.3 stack. With this commit, p5-Net-SSLeay
tests are happy again after the bump.
ok bluhm inoguchi jsing
|
|
stub, written from scratch;
OK tb@ on SSL_set_psk_use_session_callback.3
|
|
OpenSSL 1.1.1 branch, which is still under a free license.
A few tweaks to wording and structure by me.
OK tb@ on SSL_SESSION_is_resumable.3
|
|
and OPENSSL_EC_EXPLICIT_CURVE
from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000
after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE
in ec/ec_lib.c rev. 1.41,
which is the same default that OpenSSL uses since 1.1.0.
While merging, drop the description of the pre-1.1.0 behaviour.
It seems irrelevant to me because tb@ found no application in Debian
codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default
that was probably never relied upon by anyone does not need to be
documented.
|
|
as in all other palces. Check the EXFLAG_SET flag first and if not set
grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions().
OK tb@ beck@
|
|
The pre-OpenSSL 1.1.0 default was to use explicit curve parameter
encoding. Most applications want to use named curve parameter encoding
and have to opt into this explicitly.
Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years
ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into
the old default. According to Debian's codesearch, no application
currently does this, which indicates that we currently have a bad default.
In the future it is more likely that applications expect the new
default, so we follow OpenSSL to avoid problems.
Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing.
ok beck inoguchi jsing
|
|
from the OpenSSL 1.1.1 branch, which is still under a free license
|
|
branch, which is still under a free license.
While here, also merge a few other improvements, mostly regarding
EC_GROUP_get_order(3) and EC_GROUP_get_cofactor(3); in particular,
some statements below RETURN VALUES were outright wrong.
This patch includes a few minor tweaks and an addition to HISTORY by me.
Feedback and OK tb@.
|
|
OK tb@
|
|
and BN_lebin2bn(3) from the OpenSSL 1.1.1 branch,
which is still under a free license.
While here, tweak a number of details for clarity.
OK tb@
|
|
automatically initializes itself. OK tb@
|
|
'may as well' deraadt
|
|
|
|
changes
|
|
|
|
|
|
ok beck inoguchi jsing
|
|
ok inoguchi jsing
|
|
ok beck jsing
|
|
ok beck jsing
|
|
ok beck jsing
|
|
ok beck
|
|
ok jsing
|
|
with/ok jsing
|
|
ok jsing
|
|
with/ok jsing
|
|
from public visibility.
with/ok jsing
|
