summaryrefslogtreecommitdiffstats
path: root/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* document X509_check_purpose(3)schwarze2019-08-226-9/+403
|
* sysctl(2): add kern.utc_offset: successor to the DST/TIMEZONE options(4)cheloha2019-08-211-1/+18
| | | | | | | | | | | | | | | | | | | | | The DST and TIMEZONE options(4) are incompatible with KARL, so we need some other way to compensate for an RTC running with a known offset. Enter kern.utc_offset, an offset in minutes East of UTC. TIMEZONE has always been minutes West, but this is inconsistent with how everyone else talks about timezones, hence the flip. TIMEZONE has the advantage of being compiled into the binary. Our new sysctl(2) has no such luck, so it needs to be set as early as possible in boot, from sysctl.conf(5), so we can correct the kernel clock from the RTC's local time to UTC before daemons like ntpd(8) and cron(8) start. To encourage this, kern.utc_offset is made immutable after the securelevel(7) is raised to 1. Prompted by yasuoka@. Discussed with deraadt@, kettenis@, yasuoka@. Additional testing by yasuoka@. ok deraadt@, yasuoka@
* Remove support for semantically opace interface identifiers (RFC 7217)florian2019-08-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | for IPv6 link local addresses. Some hosting and VM providers route customer IPv6 prefixes to link local addresses derived from ethernet MAC addresses (RFC 2464). This leads to hard to debug IPv6 connectivity problems and is probably not worth the effort. RFC 7721 lists 4 weaknesses: 3.1. Correlation of Activities over Time & 3.2. Location Tracking These are still possible with RFC 7217 addresses for an adversary connected to the same layer 2 network (think conference wifi). Since the link local prefix stays the same (fe80::/64) the link local addresses do not change between different networks. An adversary on the same layer 2 network can probably track ethernet MAC addresses via different means, too. 3.3. Address Scanning & 3.4. Device-Specific Vulnerability Exploitation These now become possible, however, as noted above a layer 2 adversary was probably able to do this via different means. People concerned with these weaknesses are advised to use ifconfig lladdr random. OK benno input & OK kn
* New manual page X509_cmp(3) documenting the same public functionsschwarze2019-08-206-10/+241
| | | | | | as in OpenSSL 1.1.1. I rewrote most of the text for clarity, precision, and conciseness and added some additional information. A few sentences from Paul Yang remain.
* Add static_ASN1_* macroinoguchi2019-08-201-1/+72
| | | | - Add static_ASN1_* macro. Patch was provided by steils AT gentoo.org
* make BN_CTX_end(NULL) a NOOP for compatibility with documented behaviourschwarze2019-08-202-4/+12
| | | | | | | | | in OpenSSL 1.1.1 even though in general, letting random functions accept NULL is not advisable because it can hide programming errors; "yes please" tb@ "unfortunately I suspect you're right" jsing@ "oh well" deraadt@
* document X509_INFO_new(3) and X509_INFO_free(3)schwarze2019-08-194-10/+78
|
* document ECDH_compute_key(3) and ECDH_size(3);schwarze2019-08-198-15/+110
| | | | feedback and OK tb@
* Tweak cross references, in particular making sure thatschwarze2019-08-1823-48/+85
| | | | | all CMS pages are linked to CMS_ContentInfo_new(3) both ways and that closely related pages reference each other.
* minor cleanup:schwarze2019-08-182-63/+37
| | | | | | * avoid jumping back and forth between use cases * delete duplicate information * and minor wording improvements
* minor cleanup:schwarze2019-08-184-54/+74
| | | | | | | * add the missing STANDARDS sections * mark up ASN.1 type names * GOST does not need an ENGINE in LibreSSL, so don't use it as an example * and minor wording improvements and typo fixes
* minor cleanup:schwarze2019-08-181-22/+42
| | | | | | * mark up ASN.1 type and field names * move the RFC reference to STANDARDS * and minor wording improvements
* some cleanup:schwarze2019-08-181-60/+82
| | | | | | | | | | * do not jump back and forth among functions * show data type - NID correspondance in a table * make the difference between content type and embedded content clearer * add the missing STANDARDS section * mark up ASN.1 type names * remove some text that says nothing * and minor wording improvements
* some cleanup:schwarze2019-08-171-44/+46
| | | | | | | | * add the missing STANDARDS section * more precision below RETURN VALUES * simplify some overly verbose text * mark up ASN.1 type names * and minor wording improvements and typo fixes
* minor cleanup:schwarze2019-08-171-89/+88
| | | | | | | | * add the missing STANDARDS section * mark up ASN.1 type names * avoid some repetitions * make some lists more palatable in -column form * and minor wording improvements and typo fixes
* link to the new EC_KEY_METHOD_new(3) pageschwarze2019-08-161-3/+6
| | | | and mention a trap set by EC_KEY_copy(3)
* document the EC_KEY_METHOD function tableschwarze2019-08-163-3/+330
|
* document EC_KEY_get_ex_new_index(3), EC_KEY_get_ex_data(3),schwarze2019-08-162-8/+19
| | | | and EC_KEY_set_ex_data(3)
* some cleanup:schwarze2019-08-161-60/+55
| | | | | | | * do not jump back and forth among different arguments and flags * add the missing STANDARDS section * mark up ASN.1 type names * and several wording improvements
* minor cleanup:schwarze2019-08-161-15/+28
| | | | | | * add the missing STANDARDS section * mark up ASN.1 type names * and minor wording improvements and typo fixes
* minor cleanup:schwarze2019-08-151-19/+20
| | | | | | * add the missing STANDARDS section * mark up ASN.1 type names * and minor wording improvements
* some cleanup:schwarze2019-08-151-52/+61
| | | | | | | | * do not jump back and forth between different arguments * display the flags in a proper list * add the missing STANDARDS section * mark up ASN.1 type names * and minor wording improvements
* document but do not recommend EVP_Cipher(3);schwarze2019-08-151-3/+52
| | | | | jsing@ provided crucial help regarding the content; tweaks and OK tb@
* Revert previous. There were some users of the quirky behaviour that weremartijn2019-08-151-2/+2
| | | | missed during code scan.
* Fix argument list for ber_set_writecallbackmartijn2019-08-141-3/+5
| | | | OK claudio@
* wonky comma;jmc2019-08-141-3/+3
|
* Document that ber_scanf_elements' 'p' and 't' attribute don't eat themartijn2019-08-141-2/+7
| | | | | | | current ber element. OK claudio@ Seems sensible to deraadt@
* Make ber_scanf_elements's 'e' attribute eat the element.martijn2019-08-141-2/+2
| | | | | | | | Right now all consumers use 'e' at the end of the list, so no regressions should be introduced. OK claudio@ Seems sensible to deraadt@
* document EVP_Digest(3)schwarze2019-08-141-3/+57
|
* some cleanup:schwarze2019-08-141-58/+96
| | | | | | | | | | | * avoid repetitions and jumping back and forth between the functions * more precision regarding which ASN.1 types and fields are involved * mark up the ASN.1 type and field names * explain CMS_REUSE_DIGEST more precisely * move the discussion of attributes to CMS_NOATTR where it belongs * GOST does not need an ENGINE in LibreSSL, so don't use it as an example * add the missing STANDARDS section * and minor wording improvements
* read() returns -1 on failureasou2019-08-141-2/+2
| | | | ok yasuoka@
* Make sure that ber in ber_scanf_elements is not NULL before parsing formatmartijn2019-08-141-3/+3
| | | | | | | | | where ber is utilized. This also allows us to remove the ber->be_next check, which can cause weird behaviour, because a NULL be_next would result in parsing the last element twice. OK claudio@ on previous version OK rob@
* some cleanup:schwarze2019-08-131-29/+62
| | | | | | | | * state the common, general purpose up front * more precision regarding which ASN.1 types and fields are involved * mark up the ASN.1 type and field names * add the missing STANDARDS section * and minor wording improvements
* some cleanup:schwarze2019-08-121-44/+75
| | | | | | | * add missing STANDARDS section * avoid repetitions and jumping back and forth among functions * describe the difference between 0 and 1 more precisely and more concisely * mark up the ASN.1 type and field names
* Provide a local version of X509_get0_subject_key_id()jsing2019-08-121-3/+11
| | | | | It seems that the CMS code is currently the only code in existence that uses this function.
* Inline the equivalent of ASN1_TYPE_unpack_sequence().jsing2019-08-121-3/+6
|
* correct a misspelled page name in an .Xr;schwarze2019-08-121-3/+3
| | | | it looks like this was the last bad .Xr in *CMS*(3)
* correct misspelled page name in an .Xrschwarze2019-08-121-3/+3
|
* Fix .Xrs to non-existant pages by correcting the misspelled functionschwarze2019-08-121-43/+83
| | | | | | names and documenting these two functions, CMS_decrypt_set1_pkey(3) and CMS_decrypt_set1_key(3) right here in this same page. While here, simplify and improve some wording.
* These public functions are listed in the OpenSSL manuals but notschwarze2019-08-122-0/+257
| | | | actually documented, so write the documentation from scratch.
* merge a few minor improvements from the OpenSSL 1.1.1 branch,schwarze2019-08-121-15/+35
| | | | | | | | | | which is still under a free license: * mention pem_password_cb in NAME and SYNOPSIS * recommend -1 as pem_password_cb error return for OpenSSL compat * minor improvements to the pass_cb() example code * mention that the pass phrase is just a byte sequence * and minor wording and markup improvements
* Document ip.arpq and remove ip, ip6 and mpls ifq.denis2019-08-111-45/+27
| | | | ok deraadt@
* No specific called "exec(3)", so move primary manpage to a name whichderaadt2019-08-117-27/+23
| | | | | | | | does exist -- execv(3). Still call this a family but without "Nm". Adjust Xr in various pages to refer to the precise function used rather than the family, in most cases the semantics of execve(2) are being referenced, so change the Xr. ok jmc
* Use ERR_asprintf_error_data() instead of ERR_add_error_data().jsing2019-08-111-3/+3
|
* Remove unsupported GOST 2012 NIDs.jsing2019-08-111-3/+1
|
* Disable DES3 since we do not currently provide DES3 keywrap.jsing2019-08-111-1/+7
|
* Remove label that is now unused (due to arc4random_buf() returning void).jsing2019-08-111-3/+2
|
* Fix loading of CMS error strings.jsing2019-08-111-5/+5
|
* Bring back stack macros for CMS structs.jsing2019-08-111-1/+111
|
* Provide ASN1_PKEY_CTRL_CMS_RI_TYPE.jsing2019-08-111-1/+2
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.