| e1465e2e | 17-Feb-2022 |
John Baldwin <[email protected]> |
OpenSSL: Fix the same BIO_FLAGS macro definition
Also add comment to the public header to avoid
making another conflict in future.
Reviewed by: jkim
Obtained from: OpenSSL commit 5d4975ecd88ac17d07
OpenSSL: Fix the same BIO_FLAGS macro definition
Also add comment to the public header to avoid
making another conflict in future.
Reviewed by: jkim
Obtained from: OpenSSL commit 5d4975ecd88ac17d0749513a8fac9a7c7befd900
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D34135
(cherry picked from commit aa7208254996a66fb0b363bb696fe65d81335d81)
show more ...
|
| b08bb7f8 | 17-Aug-2021 |
John Baldwin <[email protected]> |
OpenSSL: Add support for Chacha20-Poly1305 to kernel TLS on FreeBSD.
FreeBSD's kernel TLS supports Chacha20 for both TLS 1.2 and TLS 1.3.
NB: This commit has not yet been merged upstream as it is d
OpenSSL: Add support for Chacha20-Poly1305 to kernel TLS on FreeBSD.
FreeBSD's kernel TLS supports Chacha20 for both TLS 1.2 and TLS 1.3.
NB: This commit has not yet been merged upstream as it is deemed a new
feature and did not make the feature freeze cutoff for OpenSSL 3.0.
Reviewed by: jkim
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D31443
(cherry picked from commit 6372fd253e3266c6eb271f49159f1632d527c9bd)
show more ...
|
| 58dcc177 | 17-Aug-2021 |
John Baldwin <[email protected]> |
OpenSSL: Refactor KTLS tests to better support TLS 1.3.
Most of this upstream commit touched tests not included in the
vendor import. The one change merged in is to remove a constant
only present i
OpenSSL: Refactor KTLS tests to better support TLS 1.3.
Most of this upstream commit touched tests not included in the
vendor import. The one change merged in is to remove a constant
only present in an internal header to appease the older tests.
Reviewed by: jkim
Obtained from: OpenSSL (e1fdd5262e4a45ce3aaa631768e877ee7b6da21b)
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D31442
(cherry picked from commit d6e78ecb0bcd5af750c72745c4c51fe211046bff)
show more ...
|
| a1509acd | 17-Aug-2021 |
John Baldwin <[email protected]> |
OpenSSL: Update KTLS documentation
KTLS support has been changed to be off by default, and configuration is
via a single "option" rather two "modes". Documentation is updated
accordingly.
Reviewed
OpenSSL: Update KTLS documentation
KTLS support has been changed to be off by default, and configuration is
via a single "option" rather two "modes". Documentation is updated
accordingly.
Reviewed by: jkim
Obtained from: OpenSSL (6878f4300213cfd7d4f01e26a8b97f70344da100)
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D31441
(cherry picked from commit a208223130fb12daac9b4f52be1b3477b03ac521)
show more ...
|
| 622809b0 | 17-Aug-2021 |
John Baldwin <[email protected]> |
OpenSSL: Only enable KTLS if it is explicitly configured
It has always been the case that KTLS is not compiled by default. However
if it is compiled then it was automatically used unless specificall
OpenSSL: Only enable KTLS if it is explicitly configured
It has always been the case that KTLS is not compiled by default. However
if it is compiled then it was automatically used unless specifically
configured not to. This is problematic because it avoids any crypto
implementations from providers. A user who configures all crypto to use
the FIPS provider may unexpectedly find that TLS related crypto is actually
being performed outside of the FIPS boundary.
Instead we change KTLS so that it is disabled by default.
We also swap to using a single "option" (i.e. SSL_OP_ENABLE_KTLS) rather
than two separate "modes", (i.e. SSL_MODE_NO_KTLS_RX and
SSL_MODE_NO_KTLS_TX).
Reviewed by: jkim
Obtained from: OpenSSL (a3a54179b6754fbed6d88e434baac710a83aaf80)
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D31440
(cherry picked from commit 62ca9fc1ad569eb3fafd281e03812a598b9856ee)
show more ...
|
| d00932be | 17-Aug-2021 |
John Baldwin <[email protected]> |
OpenSSL: ktls: Initial support for ChaCha20-Poly1305
Linux kernel is going to support ChaCha20-Poly1305 in TLS offload.
Add support for this cipher.
Reviewed by: jkim
Obtained from: OpenSSL (3aa721
OpenSSL: ktls: Initial support for ChaCha20-Poly1305
Linux kernel is going to support ChaCha20-Poly1305 in TLS offload.
Add support for this cipher.
Reviewed by: jkim
Obtained from: OpenSSL (3aa7212e0a4fd1533c8a28b8587dd8b022f3a66f)
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D31439
(cherry picked from commit 63c6d3e283eb01d32f54e2a153e6719d19e4a80d)
show more ...
|