Add error code support to libtls

This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.

Additional error codes will be added in follow-up commits.

ok

Add error code support to libtls

This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.

Additional error codes will be added in follow-up commits.

ok jsing@ beck@

show more ...

Convert libressl to use the BoringSSL style time conversions

This gets rid of our last uses of timegm and gmtime in the
library and things that ship with it. It includes a bit
of refactoring in ocsp

Convert libressl to use the BoringSSL style time conversions

This gets rid of our last uses of timegm and gmtime in the
library and things that ship with it. It includes a bit
of refactoring in ocsp_cl.c to remove some obvious ugly.

ok tb@

show more ...

Remove last caller of ASN1_time_parse(3) in libtls

This one is slightly annoying since ASN1_TIME_to_tm(3) doesn't provide a
direct check for a GeneralizedTime, so call ASN1_GENERALIZEDTIME_check()
a

Remove last caller of ASN1_time_parse(3) in libtls

This one is slightly annoying since ASN1_TIME_to_tm(3) doesn't provide a
direct check for a GeneralizedTime, so call ASN1_GENERALIZEDTIME_check()
as well. This means LibreSSL parses the time twice. Shrug.

ok beck

show more ...

add missing #include <string.h>; ok tb@

Simplify some code by using X509_STORE_CTX_get_obj_by_subject()

ok beck jsing

libtls: Don't reach into X509_STORE_CTX.

ok jsing

OCSP_basic_verify() doesn't set errno, so use tls_set_errorx()

ok inoguchi

Add missing RCS tag.

Do not bother NULLing pointers in memory that is freed immediately after.

Be consistent with the goto label names used in libtls code.

No change to generated assembly.

Keep track of which keypair is in use by a TLS context.

This fixes a bug where by a TLS server with SNI would always only return
the OCSP staple for the default keypair, rather than returning the OC

Keep track of which keypair is in use by a TLS context.

This fixes a bug where by a TLS server with SNI would always only return
the OCSP staple for the default keypair, rather than returning the OCSP
staple associated with the keypair that was selected via SNI.

Issue reported by William Graeber and confirmed by Andreas Bartelt.

Fix tested by William Graeber and Andreas Bartelt - thanks!

show more ...

Slightly restructure tls_ocsp_verify_cb() to make it more like libtls code.

Provide a useful error if there are no OCSP URLs in the peer certificate.

Fix indentation.

Plug a memory leak. The main_cert needs to be X509_free()ed since
SSL_get_peer_certificate() increases the ref count whereas extra_certs
do not because SSL_get_peer_cert_chain() won't increase ref co

Plug a memory leak. The main_cert needs to be X509_free()ed since
SSL_get_peer_certificate() increases the ref count whereas extra_certs
do not because SSL_get_peer_cert_chain() won't increase ref counts.
OK beck@

show more ...

Move the ocsp staple to being part of the keypair structure internally,
so that it does not send back bogus staples when SNI is in use.
(Further change is required to be able to use staples on all ke

Move the ocsp staple to being part of the keypair structure internally,
so that it does not send back bogus staples when SNI is in use.
(Further change is required to be able to use staples on all keypairs
and not just the main one)
ok jsing@

show more ...

More s/OSCP/OCSP/ typos

ok jmc@

Add support for server side OCSP stapling to libtls.
Add support for server side OCSP stapling to netcat.

rename ocsp_ctx to ocsp
ok jsing@

make public ASN1_time_parse and ASN1_time_tm_cmp to replace former hidden
functions.. document with a man page.
bump majors on libtls, libssl, libcrypto
ok jsing@ guenther@

Add ocsp_require_stapling config option for tls - allows a connection
to indicate that it requires the peer to provide a stapled OCSP response
with the handshake. Provide a "-T muststaple" for nc th

Add ocsp_require_stapling config option for tls - allows a connection
to indicate that it requires the peer to provide a stapled OCSP response
with the handshake. Provide a "-T muststaple" for nc that uses it.
ok jsing@, guenther@

show more ...

Don't do OCSP validation when we have disabled certificate verification
or certificate validation.
ok jsing@

Fix handshake failures:
split out internals of OCSP verification to allow callback
to verify before TLS handshake is complete

fix shadow declaration of time in parameter list.
ok jsing@

Ensure handshake is complete before processing an ocsp response for a ctx
ok jsing@