summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2019-01-10Move default numer of pools in the multi-threaded case to 8. Various testsOtto Moerbeek
by me and others indicate that it is the optimum.
2019-01-10Make the "not my pool" searching loop a tiny bit smarter, whileOtto Moerbeek
making the number of pools variable. Do not document the malloc conf settings atm, don't know yet if they will stay. Thanks to all the testers. ok deraadt@
2019-01-09Use static consistently with definitions of functions that have beenVisa Hankala
declared static. OK guenther@
2019-01-09make spelling in previous consistent within the page;Jason McIntyre
2019-01-08Document SO_ZEROIZE socket option.Alexander Bluhm
OK claudio@
2019-01-06Fix most of the .Li abuse:Ingo Schwarze
* Use .Vt for struct names and other type names like in_port_t. * Use .Dv for #define'd constants like CPUSTATES and KERN_SYSVIPC_INFO. * Use .Va for sysctl variable names like "machdep". Not touching some of the .Li use related to networking; that stuff looks suspicious in more than one way and a diff would need review.
2019-01-06note that tracefile must be null when clearing points.Ted Unangst
ok kn
2019-01-05Replace two-operand instruction aliases that clang does notVisa Hankala
understand with the three-operand instructions. No binary change with gas.
2019-01-02correct article;Jason McIntyre
2018-12-31nanosleep: loop tsleep(9) to ensure coverage of the full timeout range.cheloha
tsleep(9)'s maximum timeout shrinks as HZ grows, so this ensures we do not return early from longer timeouts on alpha or on custom kernels. POSIX says you cannot return early unless a signal is delivered, so this makes us more compliant with the standard. While here, remove the 100 million second upper bound. It is an artifact from itimerfix() and it serves no discernible purpose. ok tedu@ visa@
2018-12-28getgruid_r -> getgrgid_rTheo Buehler
from Lauri Tirkkonen
2018-12-26document kern.pool_debug; ok tedu@anton
2018-12-26Make AES CCM available in tables.Theo Buehler
Omission reported by reyk and Alice Wonder. ok bcook jsing
2018-12-25Use the same additional arch specific files for sparc64 as is done for mipsClaudio Jeker
or aarch64. Needed to build userland with clang. OK visa@ kettenis@
2018-12-24Make this page much more readable by deleting as much text as possibleIngo Schwarze
about functions that are deprecated, identical to other functions, and never made sense in the first place. As deraadt@ points out, we should not hide the information that matters in a heap of clutter. It would waste reader's time and make confusion and accidental misuse more likely. OK deraadt@ jmc@
2018-12-23EVP_MD_CTX_cleanup() is deprecated and doesn't free, so recommend usingTheo Buehler
EVP_MD_CTX_free() instead if the goal is to avoid leaking memory. From my corresponding upstream commit, reminded by schwarze
2018-12-22Document EVP_PKEY_new_mac_key(3);Ingo Schwarze
from Matt Caswell <matt at openssl dot org> via OpenSSL commit d45a97f4 Mar 5 17:41:49 2018 +0000.
2018-12-22Delete irrelevant HISTORY details. Simply use BN_rand(3); thereIngo Schwarze
is no need to know at which time BN_pseudo_rand(3) was made the same as BN_rand(3). Considering that question might even mislead people to attempt ill-advised #ifdef'ing. Pointed out by deraadt@.
2018-12-21The wrong header file was given for EVP_PKEY_CTX_set_signature_md(3).Ingo Schwarze
Also clarify to which algorithms it applies. From Matt Caswell <matt at openssl dot org> via OpenSSL commit d45a97f4 Mar 5 17:41:49 2018 +0000. Document EVP_PKEY_CTX_get_rsa_padding(3), EVP_PKEY_CTX_get_rsa_pss_saltlen(3), EVP_PKEY_CTX_set_rsa_mgf1_md(3), and EVP_PKEY_CTX_get_rsa_mgf1_md(3). From Antoine Salon <asalon at vmware dot com> via OpenSSL commit 87103969 Oct 1 14:11:57 2018 -0700 from the OpenSSL_1_1_1-stable branch, which is still under a free license.
2018-12-21Document the ECDSA_SIG_new(3) return value.Ingo Schwarze
Inspired by OpenSSL commit 6da34cfb Jun 2 16:17:32 2018 -0400 by Ken Goldman <kgoldman at us dot ibm dot com>, but use the same wording as in ASN1_item_new(3) instead.
2018-12-21Clarify behaviour of DH_get0_pqg(3) and DH_get0_key(3) with NULL arguments;Ingo Schwarze
from <Matthias dot St dot Pierre at ncp dash e dot com> via OpenSSL commit 5777254b May 27 09:07:07 2018 +0200.
2018-12-21grammar and style fixes from wesinator at githubIngo Schwarze
via OpenSSL commit 521738e9 Oct 5 14:58:30 2018 -0400
2018-12-21Since OpenBSD 6.1, BN_pseudo_rand*(3) does the same as BN_rand*(3).Ingo Schwarze
Say so, and note that OpenSSL followed suit in 1.1.0 according to OpenSSL commit 5ecff87d Jun 21 13:55:02 2017 +0100.
2018-12-21Mention that some functions call BN_GENCB_call(3) with a secondIngo Schwarze
argument of 3; from Beat Bolli <dev at drbeat dot li> via OpenSSL commit bd93f1ac Jul 28 16:45:22 2018 -0400.
2018-12-21Add support for {preinit,init,fini}_array sections in static binariesPhilip Guenther
ok kettenis@
2018-12-19Correctly describe the return values of BN_hex2bn(3) and BN_dec2bn(3).Ingo Schwarze
Inspired by OpenSSL commit a130950d Aug 23 12:06:41 2017 -0400 by Rich Salz <rsalz at openssl dot org>, but using a more explicit wording, and fixing *both* places rather than only half of them.
2018-12-19Specify the return values of some of these functions more precisely;Ingo Schwarze
inspired by OpenSSL commit 1f13ad31 Dec 25 17:50:39 2017 +0800 by Paul Yang <yang sot yang at baishancloud dot com>, but without creating a RETURN VALUES section because that makes no sense here: it would either result in a confusing order of information or in duplicate information.
2018-12-19typo;Ingo Schwarze
from Jakub Wilk <jwilk at jwilk dot net> via OpenSSL commit a21285b3 Aug 21 18:30:34 2018 +0200
2018-12-18"a" MIDI, not "an";Jason McIntyre
2018-12-16Restore the optimization for unbuffered I/O. The buffer needs toTodd C. Miller
be reset before each call to __srefill(). Passes new regress. OK semarie@
2018-12-16Regenerate root CA list using updated format-pem.pl. Specifically thisStuart Henderson
drops CA certificates whose validity dates don't comply with the rules on ASN.1 encoding in RFC 5280 (and predecessors - same rule goes back to at least RFC 2459, section 4.1.2.5). LibreSSL strictly enforces this, so attempting to validate certificates signed by these CAs just result in the following: error 13 at 1 depth lookup:format error in certificate's notBefore field "probably" beck@
2018-12-16Add a check that libressl is actually able to verify CA certs.Stuart Henderson
Skip outputting them if invalid (e.g. GENERALIZEDTIME date before 2050).
2018-12-16Back out rev 1.17 for now, it causes issues with python when buildingTodd C. Miller
databases/tdb from ports.
2018-12-14Revisit the optimization for unbuffered I/O. We can use the bufferTodd C. Miller
passed to fread(3) directly in the FILE * and call __srefill() in a loop without the memcpy(). This preserves the expected behavior in all cases. OK semarie@, "This is neat" tedu@
2018-12-14Back out the optimization in rev 1.13, it does not update flags onTodd C. Miller
EOF or error. This caused a regression in the cPickle python extension.
2018-12-14Delete a note taken during the rev. 1.1 man page spliteIngo Schwarze
that should have been deleted before commit. The cross reference is already present below SEE ALSO. Glitch noticed by jsing@.
2018-12-13further document pcap_dump; from jan staryJason McIntyre
text tweaked and ok djm
2018-12-12some pcap_setdirection details; from jan staryJason McIntyre
ok djm
2018-12-10Improve speed for the multi-threaded case by reducing lock contention.Otto Moerbeek
tested by many; ok florian@
2018-12-09add basic MPLS filtering supportdenis
OK claudio@ jca@
2018-12-09style; OK ottoFlorian Obser
2018-12-07Remove an ugly hack in the client certificate verification code that worksTheo Buehler
around broken GOST implementations. It looks like client certificates with GOST have been completely broken since reimport of the GOST code, so no-one is using LibreSSL this way. The client side was fixed only last week for TLSv1.0 and TLSv1.1. This workaround is now in the way of much needed simplifcation and cleanup, so it is time for it to go. suggested by and ok jsing
2018-12-05remove a stray line accidentally left behind in rev. 1.120;Ingo Schwarze
patch from Hiltjo Posthuma <hiltjo at codemadness dot org>
2018-12-03Send SSL_AD_DECODE alerts in the case of a bad hello request or anTheo Buehler
invalid change cipher spec. Found due to dead assignment warnings by the Clang static analyzer. ok inoguchi (previous version), jsing
2018-11-30Fix a typo and remove broken example.Martin Pieuchot
From Edgar Pettijohn.
2018-11-30Restore function prototype for ASN1_dup, fixing usage on I32LP64 platforms.Jeremy Evans
This prototype was removed inadvertantly in r1.50. OK jsing@
2018-11-29remove double .Pp. oops - sorry for not spotting!Jason McIntyre
2018-11-29Improve introduction so there is more clarity about the patterns ofTheo de Raadt
unveil calls should follow. ok various, including jmc
2018-11-29missed adding tls_default_ca_cert_file here. found by sthenTed Unangst
2018-11-29expose the default cert file as a function, not a define. it's reallyTed Unangst
an internal detail of the library, so the string should live inside it, not in the application code. ok jsing
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-07 17:44:37 +0000