![[BACK]](/icons/back.gif){kind=icon}
Up to [local] / src / lib / libssl
Request diff between arbitrary revisions
Default branch: MAIN
Revision 1.165 / (download) - annotate - [select for diffs], Sat Feb 3 18:03:49 2024 UTC (3 months, 4 weeks ago) by tb
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE,
OPENBSD_7_5,
HEAD
Changes since 1.164: +1 -7 lines
Diff to previous 1.164 (colored)
Remove last peeking at TLS1_FLAGS_SKIP_CERT_VERIFY This was used for some GOST weirdness. The flag is unused in ports and there is no user in Debian's codesearch. ok beck
Revision 1.164 / (download) - annotate - [select for diffs], Sat Feb 3 15:58:33 2024 UTC (3 months, 4 weeks ago) by beck
Branch: MAIN
Changes since 1.163: +2 -204 lines
Diff to previous 1.163 (colored)
Remove GOST and STREEBOG support from libssl. This version of GOST is old and not anywhere close to compliant with modern GOST standards. It is also very intrusive in libssl and makes a mess everywhere. Efforts to entice a suitably minded anyone to care about it have been unsuccessful. At this point it is probably best to remove this, and if someone ever showed up who truly needed a working version, it should be a clean implementation from scratch, and have it use something closer to the typical API in libcrypto so it would integrate less painfully here. This removes it from libssl in preparation for it's removal from libcrypto with a future major bump ok tb@
Revision 1.163 / (download) - annotate - [select for diffs], Fri Dec 29 12:24:33 2023 UTC (5 months ago) by tb
Branch: MAIN
Changes since 1.162: +1 -6 lines
Diff to previous 1.162 (colored)
Neuter the SSL_set_debug(3) API The TLSv1.3 stack didn't support this in the first place, and in the legacy stack it only added some dubious BIO_flush(3) calls. The sleep call between SSL_read(3) and SSL_write(3) advertised in the comment next to the flag has been a sleep call in the s_server since time immemorial, nota bene between calls to BIO_gets(3). Anyway. This can all go and what remains will go with the next major bump. ok jsing
Revision 1.162 / (download) - annotate - [select for diffs], Sun Nov 19 15:50:29 2023 UTC (6 months, 1 week ago) by tb
Branch: MAIN
Changes since 1.161: +4 -17 lines
Diff to previous 1.161 (colored)
Manually unifdef OPENSSL_NO_ENGINE in ssl_clnt.c This allows us to simplify ssl_do_client_cert_cb() a bit. ok jsing
Revision 1.161 / (download) - annotate - [select for diffs], Sat Jul 8 16:40:13 2023 UTC (10 months, 3 weeks ago) by beck
Branch: MAIN
CVS Tags: OPENBSD_7_4_BASE,
OPENBSD_7_4
Changes since 1.160: +5 -1 lines
Diff to previous 1.160 (colored)
Hide all public symbols in libssl With the guentherizer 9000 ok tb@
Revision 1.160 / (download) - annotate - [select for diffs], Sun Jun 11 19:01:01 2023 UTC (11 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.159: +27 -17 lines
Diff to previous 1.159 (colored)
Convert legacy server kex to one-shot sign/verify
This converts ssl3_{get,send}_server_key_exchange() to EVP_DigestVerify()
and EVP_DigestSign(). In order to do this, build the full signed_params
up front and rework the way the key exchange parameters are constructed.
This way we can do the verify and sign steps in one go and at the same
use a more idiomatic approach with CBB/CBS.
with/ok jsing
Revision 1.159 / (download) - annotate - [select for diffs], Sun Jun 11 18:50:51 2023 UTC (11 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.158: +5 -15 lines
Diff to previous 1.158 (colored)
Easy EVP_Digest{Sign,Verify} conversions for legacy stack
Convert ssl3_send_client_verify_{sigalgs,gost}() to EVP_DigestSign() and
ssl3_get_cert_verify() to EVP_DigestVerify().
ok jsing
Revision 1.158 / (download) - annotate - [select for diffs], Mon Dec 26 07:31:44 2022 UTC (17 months, 1 week ago) by jmc
Branch: MAIN
CVS Tags: OPENBSD_7_3_BASE,
OPENBSD_7_3
Changes since 1.157: +3 -3 lines
Diff to previous 1.157 (colored)
spelling fixes; from paul tagliamonte ok tb
Revision 1.157 / (download) - annotate - [select for diffs], Sat Nov 26 16:08:55 2022 UTC (18 months ago) by tb
Branch: MAIN
Changes since 1.156: +3 -3 lines
Diff to previous 1.156 (colored)
Make internal header file names consistent Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
Revision 1.156 / (download) - annotate - [select for diffs], Thu Oct 20 15:18:54 2022 UTC (19 months, 1 week ago) by tb
Branch: MAIN
Changes since 1.155: +2 -1 lines
Diff to previous 1.155 (colored)
Annotate misuse of EVP_Digest() The session_id member of SSL_SESSION has 32 bytes for historical reasons. This precisely accommodates a SHA-256 and is currently computed using this hash. If the hash function is ever changed, this will likely overflow. This should be fixed in code. Leave it at an XXX comment for now. Pointed out by jsing
Revision 1.155 / (download) - annotate - [select for diffs], Sun Oct 2 16:36:41 2022 UTC (20 months ago) by jsing
Branch: MAIN
Changes since 1.154: +101 -101 lines
Diff to previous 1.154 (colored)
Get rid of SSL_CTX_INTERNAL and SSL_INTERNAL. These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@
Revision 1.154 / (download) - annotate - [select for diffs], Sat Oct 1 16:23:15 2022 UTC (20 months ago) by jsing
Branch: MAIN
Changes since 1.153: +172 -22 lines
Diff to previous 1.153 (colored)
Move handshake message handling functions from ssl_both.c to client/server. Currently, ssl_both.c contains several functions that are used by both the legacy client and legacy server. This interwines the client and server, making it harder to make progressive changes. While it does deduplicate some code, it also ends up with code that is conditioned on s->server and forces the caller to pass in SSL3_ST_* values. Move these functions from ssl_both.c into ssl_clnt.c and ssl_srvr.c, renaming as appropriate and removing the s->server conditionals. Also move the client and server function prototypes from ssl_locl.h into the .c files, making them static in the process. ok tb@
Revision 1.153 / (download) - annotate - [select for diffs], Wed Aug 17 07:39:19 2022 UTC (21 months, 2 weeks ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_7_2_BASE,
OPENBSD_7_2
Changes since 1.152: +4 -32 lines
Diff to previous 1.152 (colored)
Deduplicate peer certificate chain processing code. Rather than reimplement this in each TLS client and server, deduplicate it into a single function. Furthermore, rather than dealing with the API hazard that is SSL_get_peer_cert_chain() in this code, simply produce two chains - one that has the leaf and one that does not. SSL_get_peer_cert_chain() can then return the appropriate one. This also moves the peer cert chain from the SSL_SESSION to the SSL_HANDSHAKE, which makes more sense since it is not available on resumption. ok tb@
Revision 1.152 / (download) - annotate - [select for diffs], Mon Aug 15 10:45:25 2022 UTC (21 months, 2 weeks ago) by tb
Branch: MAIN
Changes since 1.151: +1 -2 lines
Diff to previous 1.151 (colored)
Remove redeclaration of ret When ret was introduced in an outer scope in r1.113, this declaration wasn't garbage collected. ok jsing
Revision 1.151 / (download) - annotate - [select for diffs], Sun Jul 3 14:52:39 2022 UTC (23 months ago) by jsing
Branch: MAIN
Changes since 1.150: +33 -45 lines
Diff to previous 1.150 (colored)
Simplify certificate list handling code in legacy client. Tidy up CBS code and remove some unnecessary length checks. Use 'cert' and 'certs' for certificates, rather than 'x' and 'sk'. ok tb@
Revision 1.150 / (download) - annotate - [select for diffs], Sat Jul 2 16:00:12 2022 UTC (23 months ago) by tb
Branch: MAIN
Changes since 1.149: +7 -7 lines
Diff to previous 1.149 (colored)
Rename uses 'curve' to 'group' and rework tls1 group API. This reworks various tls1_ curve APIs to indicate success via a boolean return value and move the output to an out parameter. This makes the caller code easier and more consistent. Based on a suggestion by jsing ok jsing
Revision 1.149 / (download) - annotate - [select for diffs], Thu Jun 30 11:17:49 2022 UTC (23 months ago) by tb
Branch: MAIN
Changes since 1.148: +8 -1 lines
Diff to previous 1.148 (colored)
Add checks to ensure we do not initiate or negotiate handshakes with versions below the minimum required by the security level. input & ok jsing
Revision 1.148 / (download) - annotate - [select for diffs], Wed Jun 29 08:34:04 2022 UTC (23 months ago) by tb
Branch: MAIN
Changes since 1.147: +7 -1 lines
Diff to previous 1.147 (colored)
There's tentacles, tentacles everywhere ok beck jsing
Revision 1.147 / (download) - annotate - [select for diffs], Wed Jun 29 08:27:51 2022 UTC (23 months ago) by tb
Branch: MAIN
Changes since 1.146: +7 -1 lines
Diff to previous 1.146 (colored)
Check the security of DH key shares ok beck, looks good to jsing
Revision 1.146 / (download) - annotate - [select for diffs], Tue Jun 7 17:45:13 2022 UTC (23 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.145: +3 -4 lines
Diff to previous 1.145 (colored)
Simplify various CBS_write_bytes() calls Now that session_id_length is a size_t, we can pass it directly to CBS_write_bytes() instead of using a temporary variable. ok jsing
Revision 1.145 / (download) - annotate - [select for diffs], Tue Jun 7 17:39:16 2022 UTC (23 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.144: +9 -4 lines
Diff to previous 1.144 (colored)
Add missing error check call in ssl3_get_new_session_ticket() EVP_Digest() can fail, so handle failure appropriately and prepare switch of session_id_length to a size_t. ok jsing
Revision 1.144 / (download) - annotate - [select for diffs], Tue Jun 7 17:35:49 2022 UTC (23 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.143: +3 -4 lines
Diff to previous 1.143 (colored)
Another small readability tweak: compare explicitly against 0 and NULL, respectively ok jsing
Revision 1.143 / (download) - annotate - [select for diffs], Tue Jun 7 17:14:17 2022 UTC (23 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.142: +19 -9 lines
Diff to previous 1.142 (colored)
Add error checking to tls_session_secret_cb() calls Failure of this undocumented callback was previously silently ignored. Follow OpenSSL's behavior and throw an internal error (for lack of a better choice) if the callback failed or if it set the master_key_length to a negative number. Unindent the success path and clean up some strange idioms. ok jsing
Revision 1.142 / (download) - annotate - [select for diffs], Mon Jun 6 13:18:34 2022 UTC (23 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.141: +2 -3 lines
Diff to previous 1.141 (colored)
Remove incorrect and ungrammattical comment The fallback to SHA-1 if SHA-256 is disabled fell victim to tedu many moons ago when this file was still called s3_clnt.c and had no RCS ID.
Revision 1.141 / (download) - annotate - [select for diffs], Sat Feb 5 14:54:10 2022 UTC (2 years, 3 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_7_1_BASE,
OPENBSD_7_1
Changes since 1.140: +136 -136 lines
Diff to previous 1.140 (colored)
Bye bye S3I. S3I has served us well, however now that libssl is fully opaque it is time to say goodbye. Aside from removing the calloc/free/memset, the rest is mechanical sed. ok inoguchi@ tb@
Revision 1.140 / (download) - annotate - [select for diffs], Thu Feb 3 16:33:12 2022 UTC (2 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.139: +2 -2 lines
Diff to previous 1.139 (colored)
Cleanup/simplify ssl_cert_type() Remove the X509 argument as it is unused - this was passed so that ssl_cert_type() can get the public key from the X509 object if the EVP_PKEY argument is NULL, however this is never the case. ok tb@
Revision 1.139 / (download) - annotate - [select for diffs], Mon Jan 24 13:53:29 2022 UTC (2 years, 4 months ago) by tb
Branch: MAIN
Changes since 1.138: +4 -5 lines
Diff to previous 1.138 (colored)
Garbage collect unused ret in ssl3_get_new_session_ticket() ret is used to bubble up an error from ssl3_get_message() and is unused otherwise. Zap dead store and silly ret = 1; return ret; ok inoguchi jsing
Revision 1.138 / (download) - annotate - [select for diffs], Mon Jan 24 13:51:48 2022 UTC (2 years, 4 months ago) by tb
Branch: MAIN
Changes since 1.137: +2 -2 lines
Diff to previous 1.137 (colored)
In ssl3_get_server_key_exchange() switch a 'goto err' to 'goto fatal_err' so that the illegal_parameter alert is actually sent in case of X509_get0_pubkey() failure. ok inoguchi jsing
Revision 1.137 / (download) - annotate - [select for diffs], Tue Jan 11 19:03:15 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.136: +32 -49 lines
Diff to previous 1.136 (colored)
Remove peer_pkeys from SSL_SESSION. peer_pkeys comes from some world where peers can send multiple certificates - in fact, one of each known type. Since we do not live in such a world, get rid of peer_pkeys and simply use peer_cert instead (in both TLSv1.2 and TLSv1.3, both clients and servers can only send a single leaf (aka end-entity) certificate). ok inoguchi@ tb@
Revision 1.136 / (download) - annotate - [select for diffs], Tue Jan 11 18:39:28 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.135: +3 -3 lines
Diff to previous 1.135 (colored)
Rename 'peer' to 'peer_cert' in SSL_SESSION. The 'peer' member of SSL_SESSION is the leaf/end-entity certificate provided by our peer. Rename it since 'peer' on its own is unhelpful. ok inoguchi@ tb@
Revision 1.135 / (download) - annotate - [select for diffs], Tue Jan 11 18:28:41 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.134: +25 -14 lines
Diff to previous 1.134 (colored)
Plumb decode errors through key share parsing code. Distinguish between decode errors and other errors, so that we can send a SSL_AD_DECODE_ERROR alert when appropriate. Fixes a tlsfuzzer failure, due to it expecting a decode error alert and not receiving one. Prompted by anton@ ok tb@
Revision 1.134 / (download) - annotate - [select for diffs], Sun Jan 9 15:55:37 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.133: +3 -3 lines
Diff to previous 1.133 (colored)
ssl_check_srvr_ecc_cert_and_alg() only returns 0/1 - test accordingly.
Revision 1.133 / (download) - annotate - [select for diffs], Sun Jan 9 15:53:52 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.132: +3 -3 lines
Diff to previous 1.132 (colored)
Swap arguments to ssl_check_srvr_ecc_cert_and_alg() If a libssl function takes an SSL *, it should normally be the first argument.
Revision 1.132 / (download) - annotate - [select for diffs], Sun Jan 9 15:40:13 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.131: +26 -21 lines
Diff to previous 1.131 (colored)
Clean up ssl3_{send,get}_client_kex_gost()
Fix leaks, use sizeof() instead of hardcoded sizes, actually check return
codes, explicit_bzero() the premaster secret on the server side and
generally try to kick the GOST kex code into some sort of shape.
ok inoguchi@ tb@
Revision 1.131 / (download) - annotate - [select for diffs], Sun Jan 9 15:34:21 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.130: +4 -4 lines
Diff to previous 1.130 (colored)
Return 0/1 from ssl3_{send,get}_client_kex_gost()
Like other KEX handling functions, there is no need to return anything
other than failure/success here.
ok inoguchi@ tb@
Revision 1.130 / (download) - annotate - [select for diffs], Sun Jan 9 15:29:42 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.129: +2 -4 lines
Diff to previous 1.129 (colored)
Remove a comment from Captain Obvious.
Revision 1.129 / (download) - annotate - [select for diffs], Sun Jan 9 13:17:33 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.128: +22 -42 lines
Diff to previous 1.128 (colored)
Clean up pkey handling in ssl3_get_server_key_exchange() With TLSv1.2 and earlier, the authentication algorithm used to sign the ServerKeyExchange message is dependent on the cipher suite in use and has nothing to do with the key exchange algorithm. As such, check the authentication algorithm based on the cipher suite in ssl3_get_server_key_exchange() and handle things accordingly. ok inoguchi@ tb@
Revision 1.128 / (download) - annotate - [select for diffs], Sat Jan 8 12:59:58 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.127: +33 -66 lines
Diff to previous 1.127 (colored)
Merge SESS_CERT into SSL_SESSION. There is no reason for SESS_CERT to exist - remove it and merge its members into SSL_SESSION for the time being. More clean up to follow. ok inoguchi@ tb@
Revision 1.127 / (download) - annotate - [select for diffs], Thu Jan 6 18:23:56 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.126: +35 -175 lines
Diff to previous 1.126 (colored)
Convert legacy TLS client to tls_key_share. This requires adding DHE support to tls_key_share. In doing so, tls_key_share_peer_public() has to lose the group argument and gains an invalid_key argument. The one place that actually needs the group check is tlsext_keyshare_client_parse(), so add code to do this. ok inoguchi@ tb@
Revision 1.126 / (download) - annotate - [select for diffs], Tue Jan 4 12:53:31 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.125: +25 -25 lines
Diff to previous 1.125 (colored)
Return 0 on failure from send/get kex functions in the legacy stack. In the legacy stack, a message handling function returns -1 for failure, 0 for need more data and 1 for success (although in extra special cases 2 may also be used). However, the various send/get kex functions only need to indicate success or failure - switch these to return 0 on failure (rather than -1) and use normal result testing. This leaves GOST unchanged for now, as that code is special and needs extra work. ok inoguchi@ tb@
Revision 1.125 / (download) - annotate - [select for diffs], Tue Jan 4 11:17:11 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.124: +2 -2 lines
Diff to previous 1.124 (colored)
Use normal result testing for tls1_check_curve().
Revision 1.124 / (download) - annotate - [select for diffs], Tue Jan 4 11:14:54 2022 UTC (2 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.123: +18 -20 lines
Diff to previous 1.123 (colored)
Refactor ssl3_get_server_kex_ecdhe() to separate parsing and validation. If we receive something other than a "named curve", send a handshake failure alert as we're unable to complete the handshake with the given parameters. If the server responded with a curve that we did not advertise send an illegal parameter alert. ok inoguchi@ tb@
Revision 1.123 / (download) - annotate - [select for diffs], Thu Dec 9 17:50:48 2021 UTC (2 years, 5 months ago) by tb
Branch: MAIN
Changes since 1.122: +29 -26 lines
Diff to previous 1.122 (colored)
Convert ssl_clnt.c to opaque EVP_MD_CTX ok inoguchi jsing
Revision 1.122 / (download) - annotate - [select for diffs], Sat Dec 4 13:50:35 2021 UTC (2 years, 5 months ago) by jsing
Branch: MAIN
Changes since 1.121: +5 -8 lines
Diff to previous 1.121 (colored)
Move the minimum DHE key size check into ssl_kex_peer_params_dhe() ok inoguchi@ tb@
Revision 1.121 / (download) - annotate - [select for diffs], Sat Dec 4 13:15:10 2021 UTC (2 years, 5 months ago) by jsing
Branch: MAIN
Changes since 1.120: +8 -2 lines
Diff to previous 1.120 (colored)
Check DH public key in ssl_kex_peer_public_dhe(). Call DH_check_pub_key() after decoding the peer public key - this will be needed for the server DHE key exchange, but also benefits the client. ok inoguchi@ tb@
Revision 1.120 / (download) - annotate - [select for diffs], Mon Nov 29 16:00:32 2021 UTC (2 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.119: +20 -64 lines
Diff to previous 1.119 (colored)
Factor out/rewrite DHE key exchange. This follows what was done previously for ECDHE EC point key exchange and will allow for deduplication and further code improvement. Convert the TLSv1.2 client to use the new DHE key exchange functions. ok inoguchi@ tb@
Revision 1.119 / (download) - annotate - [select for diffs], Fri Nov 26 16:41:42 2021 UTC (2 years, 6 months ago) by tb
Branch: MAIN
Changes since 1.118: +18 -12 lines
Diff to previous 1.118 (colored)
Stop reaching into EVP_PKEY in the rest of libssl. ok inoguchi jsing
Revision 1.118 / (download) - annotate - [select for diffs], Fri Nov 19 18:53:10 2021 UTC (2 years, 6 months ago) by tb
Branch: MAIN
Changes since 1.117: +3 -3 lines
Diff to previous 1.117 (colored)
libssl: don't reach for pkey->save_type. For some strange historical reason ECDSA_sign() and ECDSA_verify}() have a type argument that they ignore. For another strange historical reason, the type passed to them from libssl is pkey->save_type, which is used to avoid expensive engine lookups when setting the pkey type... Whatever the aforementioned reasons were, we can't access pkey->save_type with the OpenSSL 1.1 API, and this is thus in the way of making EVP_PKEY opaque. Simply pass in 0 instead. ok jsing
Revision 1.117 / (download) - annotate - [select for diffs], Mon Oct 25 10:01:46 2021 UTC (2 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.116: +18 -18 lines
Diff to previous 1.116 (colored)
Fold SSL_SESSION_INTERNAL back into SSL_SESSION. ok beck@ tb@
Revision 1.116 / (download) - annotate - [select for diffs], Sat Oct 23 16:11:30 2021 UTC (2 years, 7 months ago) by tb
Branch: MAIN
Changes since 1.115: +3 -3 lines
Diff to previous 1.115 (colored)
Unhandroll X509_up_ref() ok beck jsing
Revision 1.115 / (download) - annotate - [select for diffs], Sat Oct 23 14:40:54 2021 UTC (2 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.114: +16 -36 lines
Diff to previous 1.114 (colored)
Provide a way to determine our maximum legacy version. With the introduction of TLSv1.3, we need the ability to determine our maximum legacy version and to track our peer's maximum legacy version. This is needed for both the TLS record layer when using TLSv1.3, plus it is needed for RSA key exhange in TLS prior to TLSv1.3, where the maximum legacy version is incorporated in the pre-master secret to avoid downgrade attacks. This unbreaks RSA KEX for the TLS client when the non-version specific method is used with TLSv1.0 or TLSv1.1 (clearly no one does this). ok tb@
Revision 1.114 / (download) - annotate - [select for diffs], Sat Oct 23 13:36:03 2021 UTC (2 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.113: +18 -18 lines
Diff to previous 1.113 (colored)
Fold DTLS1_STATE_INTERNAL into DTLS1_STATE. Now that DTLS1_STATE is opaque, fold DTLS1_STATE_INTERNAL back into DTLS1_STATE and remove D1I() usage. ok tb@
Revision 1.113 / (download) - annotate - [select for diffs], Sat Oct 23 08:34:36 2021 UTC (2 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.112: +83 -96 lines
Diff to previous 1.112 (colored)
Untangle ssl3_get_message() return values. This function currently has a long return type that may be <= 0 on error/retry (which is then cast to an int in order to return it up the stack), or it returns the length of the handshake message (on success). This obviously means that 0 can be returned for both success and failure, which is the reason why a separate 'ok' argument has to exist. Untangle this mess by changing the return value to an int that indicates success (1) or error/retry (<= 0). The length never needs to actually be returned as it is already stored in s->internal->init_num (which is where the return value is read from anyway). ok tb@
Revision 1.112 / (download) - annotate - [select for diffs], Sat Oct 23 08:13:02 2021 UTC (2 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.111: +2 -5 lines
Diff to previous 1.111 (colored)
Change tlsext_tick_lifetime_hint to uint32_t. Now that SSL_SESSION is opaque, change tlsext_tick_lifetime_hint from long to uint32_t (matching RFC4507), rather than continuing to work around an inappropriate type choice. ok tb@
Revision 1.111 / (download) - annotate - [select for diffs], Fri Sep 3 13:18:17 2021 UTC (2 years, 8 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_7_0_BASE,
OPENBSD_7_0
Changes since 1.110: +4 -1 lines
Diff to previous 1.110 (colored)
Ensure that a server hello does not have trailing data. Found by tlsfuzzer. ok beck@
Revision 1.110 / (download) - annotate - [select for diffs], Thu Sep 2 14:41:03 2021 UTC (2 years, 9 months ago) by beck
Branch: MAIN
Changes since 1.109: +3 -2 lines
Diff to previous 1.109 (colored)
We need to allow for either a CERTIFICATE or CERTIFICATE_STATUS message here or we break the handshake with BAD_MESSAGE ok tb@
Revision 1.109 / (download) - annotate - [select for diffs], Thu Sep 2 08:51:56 2021 UTC (2 years, 9 months ago) by beck
Branch: MAIN
Changes since 1.108: +37 -3 lines
Diff to previous 1.108 (colored)
RFC 6066 section 8 allows the server MAY choose not send the CertificateStatus message, even if it has received a "status_request" extension in the client hello message and has sent a "status_request" extention in the server hello message. Genua found a site that is this broken. This makes it work. ok jsing@
Revision 1.108 / (download) - annotate - [select for diffs], Mon Aug 30 19:25:43 2021 UTC (2 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.107: +8 -16 lines
Diff to previous 1.107 (colored)
Clean up and simplify info and msg callbacks. The info and msg callbacks result in duplication - both for code that refers to the function pointers and for the call sites. Avoid this by providing typedefs for the function pointers and pulling the calling sequences into their own functions. ok inoguchi@ tb@
Revision 1.107 / (download) - annotate - [select for diffs], Wed Jun 30 09:59:07 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.106: +2 -3 lines
Diff to previous 1.106 (colored)
Correct sigalg hash usage when signing content for client verify. This was inadvertently broken during sigalgs refactoring.
Revision 1.106 / (download) - annotate - [select for diffs], Tue Jun 29 19:56:11 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.105: +11 -14 lines
Diff to previous 1.105 (colored)
Pull sigalg selection up into ssl3_send_client_verify(). This means that we do sigalg selection for all cases, including those where are are not sending sigalgs. This is needed in order to track our signature type in legacy cases. ok tb@
Revision 1.105 / (download) - annotate - [select for diffs], Tue Jun 29 19:43:15 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.104: +3 -1 lines
Diff to previous 1.104 (colored)
Track sigalg used by ourselves and our peer in the legacy stack. This is needed for upcoming API additions.
Revision 1.104 / (download) - annotate - [select for diffs], Tue Jun 29 19:23:36 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.103: +12 -34 lines
Diff to previous 1.103 (colored)
Convert legacy stack client to ssl_sigalg_for_peer(). ok inoguchi@ tb@
Revision 1.103 / (download) - annotate - [select for diffs], Tue Jun 29 19:10:08 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.102: +2 -2 lines
Diff to previous 1.102 (colored)
Move the RSA-PSS check for TLSv1.3 to ssl_sigalg_pkey_ok(). Also, rather than passing in a check_curve flag, pass in the SSL * and handle version checks internally to ssl_sigalg_pkey_ok(), simplifying the callers. ok inoguchi@ tb@
Revision 1.102 / (download) - annotate - [select for diffs], Sun Jun 27 19:16:59 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.101: +11 -22 lines
Diff to previous 1.101 (colored)
Have ssl3_send_client_verify() pass *pkey to called functions. ssl3_send_client_verify() already has a pointer to the EVP_PKEY for the certificate - pass this as an argument to the functions that it calls, rather than duplicating code/variable declarations.
Revision 1.101 / (download) - annotate - [select for diffs], Sun Jun 27 18:15:35 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.100: +4 -3 lines
Diff to previous 1.100 (colored)
Change ssl_sigalgs_from_value() to perform sigalg list selection. Rather that passing in a sigalg list at every call site, pass in the appropriate TLS version and have ssl_sigalgs_from_value() perform the sigalg list selection itself. This allows the sigalg lists to be made internal to the sigalgs code. ok tb@
Revision 1.100 / (download) - annotate - [select for diffs], Sun Jun 27 18:09:07 2021 UTC (2 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.99: +3 -3 lines
Diff to previous 1.99 (colored)
Rename ssl_sigalg() to ssl_sigalg_from_value(). This makes the code more self-documenting and avoids the ambiguity between ssl_sigalg the struct and ssl_sigalg the function. ok tb@
Revision 1.99 / (download) - annotate - [select for diffs], Sun May 16 14:10:43 2021 UTC (3 years ago) by jsing
Branch: MAIN
Changes since 1.98: +2 -3 lines
Diff to previous 1.98 (colored)
Make local header inclusion consistent. Consistently include local headers in the same location, using the same grouping/sorting across all files.
Revision 1.98 / (download) - annotate - [select for diffs], Sun May 16 13:56:30 2021 UTC (3 years ago) by jsing
Branch: MAIN
Changes since 1.97: +2 -1 lines
Diff to previous 1.97 (colored)
Move DTLS structs/definitions/prototypes to dtls_locl.h. Now that the DTLS structs are opaque, add a dtls_locl.h header and move internal-only structs from dtls1.h, along with prototypes from ssl_locl.h. Only pull this header in where DTLS code actually exists. ok inoguchi@ tb@
Revision 1.97 / (download) - annotate - [select for diffs], Sun May 16 08:24:21 2021 UTC (3 years ago) by jsing
Branch: MAIN
Changes since 1.96: +2 -1 lines
Diff to previous 1.96 (colored)
Explicitly include <openssl/opensslconf.h> in files using OPENSSL_NO_* Where a file references to OPENSSL_NO_* conditions, ensure that we explicitly include <openssl/opensslconf.h> before any references, rather than relying on another header to pull this in.
Revision 1.96 / (download) - annotate - [select for diffs], Sun May 2 17:46:58 2021 UTC (3 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.95: +3 -5 lines
Diff to previous 1.95 (colored)
Clean up tls1_change_cipher_state(). Replace flag gymnastics at call sites with separate read and write, functions which call the common code. Condition on s->server instead of using SSL_ST_ACCEPT, for consistency and more readable code. ok inoguchi@ tb@
Revision 1.95 / (download) - annotate - [select for diffs], Sun May 2 17:18:10 2021 UTC (3 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.94: +1 -5 lines
Diff to previous 1.94 (colored)
Clean up dtls1_reset_seq_numbers(). Rather than doing flag gymnastics, split dtls1_reset_seq_numbers() into separate read and write functions. Move the calls of these functions into tls1_change_cipher_state() so they directly follow the change of cipher state in the record layer, which avoids having to duplicate the calls in the client and server. ok inoguchi@ tb@
Revision 1.94 / (download) - annotate - [select for diffs], Fri Apr 30 19:26:44 2021 UTC (3 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.93: +12 -17 lines
Diff to previous 1.93 (colored)
Clean up and harden TLSv1.2 master key derivation. The master key and its length are only stored in one location, so it makes no sense to handle these outside of the derivation function (the current 'out' argument is unused). This simplifies the various call sites. If derivation fails for some reason, fail hard rather than continuing on and hoping that something deals with this correctly later. ok inoguchi@ tb@
Revision 1.93 / (download) - annotate - [select for diffs], Sun Apr 25 13:15:22 2021 UTC (3 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.92: +2 -3 lines
Diff to previous 1.92 (colored)
Clean up derivation of finished/peer finished. Make this process more readable by having specific client/server functions, calling the correct one based on s->server. This allows to remove various SSL_ST_ACCEPT/SSL_ST_CONNECT checks, along with duplicate code. ok inoguchi@ tb@
Revision 1.92 / (download) - annotate - [select for diffs], Wed Apr 21 19:27:56 2021 UTC (3 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.91: +12 -24 lines
Diff to previous 1.91 (colored)
Clean up TLSv1.2 certificate request handshake data. Currently cert_req is used by clients and cert_request is used by servers. Replace this by a single cert_request used by either client or server. Remove the certificate types as they are currently unused. This also fixes a bug whereby if the number of certificate types exceeds SSL3_CT_NUMBER the number of bytes read in is insufficient, which will break decoding. ok inoguchi@ tb@
Revision 1.91 / (download) - annotate - [select for diffs], Mon Apr 19 16:51:56 2021 UTC (3 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.90: +21 -21 lines
Diff to previous 1.90 (colored)
Move reuse_message, message_type, message_size and cert_verify into the TLSv1.2 handshake struct. ok inoguchi@ tb@
Revision 1.90 / (download) - annotate - [select for diffs], Sun Apr 11 07:06:01 2021 UTC (3 years, 1 month ago) by tb
Branch: MAIN
CVS Tags: OPENBSD_6_9_BASE,
OPENBSD_6_9
Changes since 1.89: +3 -3 lines
Diff to previous 1.89 (colored)
Update a stale comment and fix a typo.
Revision 1.89 / (download) - annotate - [select for diffs], Sat Mar 27 17:56:28 2021 UTC (3 years, 2 months ago) by tb
Branch: MAIN
Changes since 1.88: +1 -3 lines
Diff to previous 1.88 (colored)
Garbage collect s->internal->type
This variable is used in the legacy stack to decide whether we are
a server or a client. That's what s->server is for...
The new TLSv1.3 stack failed to set s->internal->type, which resulted
in hilarious mishandling of previous_{client,server}_finished. Indeed,
both client and server would first store the client's verify_data in
previous_server_finished and later overwrite it with the server's
verify_data. Consequently, renegotiation has been completely broken
for more than a year. In fact, server side renegotiation was broken
during the 6.5 release cycle. Clearly, no-one uses this.
This commit fixes client side renegotiation and restores the previous
behavior of SSL_get_client_CA_list(). Server side renegotiation will
be fixed in a later commit.
ok jsing
Revision 1.88 / (download) - annotate - [select for diffs], Wed Mar 24 18:44:00 2021 UTC (3 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.87: +14 -14 lines
Diff to previous 1.87 (colored)
Rename new_cipher to cipher. This is in the SSL_HANDSHAKE struct and is what we're currently negotiating, so there is really nothing more "new" about the cipher than there is the key block or other parts of the handshake data. ok inoguchi@ tb@
Revision 1.87 / (download) - annotate - [select for diffs], Wed Mar 24 18:40:03 2021 UTC (3 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.86: +7 -7 lines
Diff to previous 1.86 (colored)
Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data. Move TLSv1.2 specific components over from SSL_HANDSHAKE. ok inoguchi@ tb@
Revision 1.86 / (download) - annotate - [select for diffs], Thu Mar 11 17:14:46 2021 UTC (3 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.85: +4 -7 lines
Diff to previous 1.85 (colored)
Remove ssl_downgrade_max_version(). Now that we store our maximum TLS version at the start of the handshake, we can check against that directly. ok inoguchi@ tb@
Revision 1.85 / (download) - annotate - [select for diffs], Wed Mar 10 18:27:01 2021 UTC (3 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.84: +17 -3 lines
Diff to previous 1.84 (colored)
Improve internal version handling. Add handshake fields for our minimum TLS version, our maximum TLS version and the TLS version negotiated during the handshake. Initialise our min/max versions at the start of the handshake and leave these unchanged. The negotiated TLS version is set in the client once we receive the ServerHello and in the server at the point we select the highest shared version. Provide an ssl_effective_version() function that returns the negotiated TLS version if known, otherwise our maximum TLS version - this is effectively what is stored in s->version currently. Convert most of the internal code to use one of these three version fields, which greatly simplifies code (especially in the TLS extension handling code). ok tb@
Revision 1.84 / (download) - annotate - [select for diffs], Mon Feb 22 15:59:10 2021 UTC (3 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.83: +4 -9 lines
Diff to previous 1.83 (colored)
Factor out/change some of the legacy client version handling code. This consolidates the version handling code and will make upcoming changes easier. ok tb@
Revision 1.83 / (download) - annotate - [select for diffs], Sat Feb 20 14:16:56 2021 UTC (3 years, 3 months ago) by tb
Branch: MAIN
Changes since 1.82: +8 -8 lines
Diff to previous 1.82 (colored)
ugly whitespace
Revision 1.82 / (download) - annotate - [select for diffs], Sat Feb 20 14:14:16 2021 UTC (3 years, 3 months ago) by tb
Branch: MAIN
Changes since 1.81: +60 -60 lines
Diff to previous 1.81 (colored)
Rename f_err into fatal_err. discussed with jsing
Revision 1.81 / (download) - annotate - [select for diffs], Sat Feb 20 14:03:50 2021 UTC (3 years, 3 months ago) by tb
Branch: MAIN
Changes since 1.80: +46 -46 lines
Diff to previous 1.80 (colored)
Rename the truncated label into decode_err. This describes its purpose better and doesn't look odd if there's trailing data for exapmle. Indent a few labels in the neighborhood while there. ok jsing
Revision 1.80 / (download) - annotate - [select for diffs], Sat Feb 20 08:22:55 2021 UTC (3 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.79: +7 -2 lines
Diff to previous 1.79 (colored)
Revise HelloVerifyRequest handling for DTLSv1.2. Per RFC 6347 section 4.2.1, the HelloVerifyRequest should always contain DTLSv1.0 - ensure this is the case on the server side, allow both DTLSv1.0 and DTLSv1.2 on the client. ok tb@
Revision 1.79 / (download) - annotate - [select for diffs], Sat Feb 20 08:19:01 2021 UTC (3 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.78: +5 -4 lines
Diff to previous 1.78 (colored)
Group HelloVerifyRequest decoding and add missing check for trailing data. ok tb@
Revision 1.78 / (download) - annotate - [select for diffs], Sun Feb 7 15:26:32 2021 UTC (3 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.77: +3 -2 lines
Diff to previous 1.77 (colored)
Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md(). The mess that is ssl_get_algorithm2() only exists to upgrade the handshake MAC of a pre-TLSv1.2 cipher suite to SHA256 when used with TLSv1.2. We can readily do this in ssl_get_handshake_evp_md(), which is far more readable. ok tb@
Revision 1.77 / (download) - annotate - [select for diffs], Sun Feb 7 15:04:10 2021 UTC (3 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.76: +5 -13 lines
Diff to previous 1.76 (colored)
Factor out the legacy stack version checks. Also check for explicit version numbers, rather than just the major version value. ok tb@
Revision 1.76 / (download) - annotate - [select for diffs], Wed Oct 14 16:57:33 2020 UTC (3 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.75: +25 -25 lines
Diff to previous 1.75 (colored)
Replace SSL_IS_DTLS with SSL_is_dtls(). Garbage collect the now unused SSL_IS_DTLS macro. ok tb@
Revision 1.75 / (download) - annotate - [select for diffs], Sun Oct 11 02:22:27 2020 UTC (3 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.74: +2 -2 lines
Diff to previous 1.74 (colored)
Condense and simplify TLS methods. Historically, OpenSSL has had client and server specific methods - the only difference between these is that the .ssl_connect or .ssl_accept function pointer is set to ssl_undefined_function, with the intention of reducing code size for a statically linked binary that was only a client or server. These days the difference is minimal or non-existant in many cases and we can reduce the amount of code and complexity by having single method. Internally remove all of the client and server specific methods, simplifying code in the process. The external client/server specific API remain, however these now return the same thing as TLS_method() does. ok tb@
Revision 1.74 / (download) - annotate - [select for diffs], Sat Oct 3 18:01:55 2020 UTC (3 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.73: +58 -2 lines
Diff to previous 1.73 (colored)
Merge d1_{clnt,srvr}.c into ssl_{clnt,srvr}.c
The d1_{clnt,srvr}.c contain a single function each - merge these into the
ssl_{clnt,srvr}.c, renaming them with an ssl3_ prefix for consistency.
ok beck@ tb@
Revision 1.73 / (download) - annotate - [select for diffs], Thu Sep 24 18:12:00 2020 UTC (3 years, 8 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_6_8_BASE,
OPENBSD_6_8
Changes since 1.72: +3 -5 lines
Diff to previous 1.72 (colored)
Simplify the cleanup of init_buf via a ssl3_release_init_buffer() function. ok beck@ inoguchi@ tb@
Revision 1.72 / (download) - annotate - [select for diffs], Thu Sep 17 15:23:29 2020 UTC (3 years, 8 months ago) by jsing
Branch: MAIN
Changes since 1.71: +2 -4 lines
Diff to previous 1.71 (colored)
Simplify SSL method lookups.
There are three places where we call tls1_get_{client,server}_method() and
if that returns NULL, call dtls1_get_{client,server}_method(). Simplify
this by combining the lookup into a single function. While here also use
uint16_t for version types.
ok inoguchi@ millert@
Revision 1.71 / (download) - annotate - [select for diffs], Fri Sep 11 17:36:27 2020 UTC (3 years, 8 months ago) by jsing
Branch: MAIN
Changes since 1.70: +3 -6 lines
Diff to previous 1.70 (colored)
Remove cipher_list_by_id. When parsing a cipher string, a cipher list is created, before being duplicated and sorted - the second copy being stored as cipher_list_by_id. This is done only so that a client can ensure that the cipher selected by a server is in the cipher list. This is pretty pointless given that most clients are short-lived and that we already had to iterate over the cipher list in order to build the client hello. Additionally, any update to the cipher list requires that cipher_list_by_id also be updated and kept in sync. Remove all of this and replace it with a simple linear scan - the overhead of duplicating and sorting the cipher list likely exceeds that of a simple linear scan over the cipher list (64 maximum, more typically ~9 or so). ok beck@ tb@
Revision 1.70 / (download) - annotate - [select for diffs], Fri Jul 3 04:12:50 2020 UTC (3 years, 11 months ago) by tb
Branch: MAIN
Changes since 1.69: +3 -3 lines
Diff to previous 1.69 (colored)
Improve argument order for the internal tlsext API Move is_server and msg_type right after the SSL object so that CBS and CBB and alert come last. This brings these functions more in line with other internal functions and separates state from data. requested by jsing
Revision 1.69 / (download) - annotate - [select for diffs], Fri Jun 5 17:53:26 2020 UTC (3 years, 11 months ago) by jsing
Branch: MAIN
Changes since 1.68: +7 -1 lines
Diff to previous 1.68 (colored)
Enable GOST_SIG_FORMAT_RS_LE when verifying certificate signatures. GOST cipher suites requires that CertVerify signatures be generated in a special way (see ssl3_send_client_kex_gost(), ssl3_get_cert_verify()). However, the GOST_SIG_FORMAT_RS_LE flag was not passed in case of TLS 1.2 connections (because they use different code path). Set this flag on GOST PKEYs. Diff from Dmitry Baryshkov <dbaryshkov@gmail.com> Sponsored by ROSA Linux ok inoguchi@ tb@
Revision 1.68 / (download) - annotate - [select for diffs], Sun May 31 16:36:35 2020 UTC (4 years ago) by jsing
Branch: MAIN
Changes since 1.67: +2 -2 lines
Diff to previous 1.67 (colored)
Correct downgrade sentinels when a version pinned method is in use. Previously only the enabled protocol versions were considered, however we also have to consider the method in use which may be version pinned. Found the hard way by danj@ with haproxy and force-tlsv12. ok beck@ inoguchi@ tb@
Revision 1.67 / (download) - annotate - [select for diffs], Tue May 19 16:35:20 2020 UTC (4 years ago) by jsing
Branch: MAIN
Changes since 1.66: +4 -4 lines
Diff to previous 1.66 (colored)
Replace SSL_PKEY_RSA_ENC/SSL_PKEY_RSA_SIGN with SSL_PKEY_RSA. Some time prior to SSLeay 0.8.1b, SSL_PKEY_RSA_SIGN got added with the intention of handling RSA sign only certificates... this incomplete code had the following comment: /* check to see if this is a signing only certificate */ /* EAY EAY EAY EAY */ And while the comment was removed in 2005, the incomplete RSA sign-only handling has remained ever since. Remove SSL_PKEY_RSA_SIGN and rename SSL_PKEY_RSA_ENC to SSL_PKEY_RSA. While here also remove the unused SSL_PKEY_DH_RSA. ok tb@
Revision 1.66 / (download) - annotate - [select for diffs], Sun May 10 14:17:47 2020 UTC (4 years ago) by jsing
Branch: MAIN
Changes since 1.65: +2 -5 lines
Diff to previous 1.65 (colored)
Use size_t for OCSP response length. The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@
Revision 1.65 / (download) - annotate - [select for diffs], Sat May 9 13:54:19 2020 UTC (4 years ago) by tb
Branch: MAIN
Changes since 1.64: +2 -3 lines
Diff to previous 1.64 (colored)
Drop a redundant test. It's effectively doing the same test twice and if the two lengths differed, the later CBS_write_bytes() would correctly fail anyway. Discussed with jsing
Revision 1.64 / (download) - annotate - [select for diffs], Fri Mar 6 16:36:47 2020 UTC (4 years, 2 months ago) by tb
Branch: MAIN
CVS Tags: OPENBSD_6_7_BASE,
OPENBSD_6_7
Changes since 1.63: +27 -1 lines
Diff to previous 1.63 (colored)
RFC 8446, section 4.1.3: If a TLSv1.2 client receives a ServerHello for TLSv1.1 or below, it should check whether the server's random value contains the magic downgrade protection cookie and in that case abort the handshake with an illegal parameter alert. ok inoguchi, jsing
Revision 1.63 / (download) - annotate - [select for diffs], Thu Jan 30 16:25:09 2020 UTC (4 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.62: +15 -94 lines
Diff to previous 1.62 (colored)
Factor out/rewrite the ECDHE EC point key exchange code. This reduces replication between the existing TLS client/server and allows the code to soon be reused for TLSv1.3. With feedback from inoguchi@ and tb@ ok inoguchi@ tb@
Revision 1.62 / (download) - annotate - [select for diffs], Thu Jan 23 10:48:37 2020 UTC (4 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.61: +11 -13 lines
Diff to previous 1.61 (colored)
Remove the ssl_get_message function pointer from SSL_METHOD_INTERNAL. ssl_get_message is essentially a switch between ssl3_get_message and dtls1_get_message, both only used by the legacy stack. Instead, use SSL_IS_DTLS() in ssl3_get_message to call the DTLS function when necessary. ok beck@ inoguchi@ tb@
Revision 1.61 / (download) - annotate - [select for diffs], Sun Mar 31 15:49:03 2019 UTC (5 years, 2 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_6_6_BASE,
OPENBSD_6_6,
OPENBSD_6_5_BASE,
OPENBSD_6_5
Changes since 1.60: +49 -50 lines
Diff to previous 1.60 (colored)
Clean up and simplify the client verify code: - Be consistent with _len naming. - Use size_t where possible/appropriate. - Group the CBB code. - Use EVP_MAX_MD_SIZE consistently, instead of "magic" values. - Switch GOST to EVP_DigestSign*, making it similar to sigalgs. ok tb@ a while back.
Revision 1.60 / (download) - annotate - [select for diffs], Mon Mar 25 17:21:18 2019 UTC (5 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.59: +18 -12 lines
Diff to previous 1.59 (colored)
Defer sigalgs selection until the certificate is known. Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@.
Revision 1.59 / (download) - annotate - [select for diffs], Mon Mar 25 16:35:48 2019 UTC (5 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.58: +2 -2 lines
Diff to previous 1.58 (colored)
Rework ssl3_output_cert_chain() to take a CERT_PKEY and consider chains. We will now include the certificates in the chain in the certificate list, or use the existing extra_certs if present. Failing that we fall back to the automatic chain building if not disabled. This also simplifies the code significantly. ok beck@ tb@
Revision 1.58 / (download) - annotate - [select for diffs], Tue Mar 19 16:53:03 2019 UTC (5 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.57: +2 -2 lines
Diff to previous 1.57 (colored)
Revert TLS1_get{,_client}_version simplification because DTLS.
Revision 1.57 / (download) - annotate - [select for diffs], Sun Mar 17 15:16:39 2019 UTC (5 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.56: +2 -2 lines
Diff to previous 1.56 (colored)
Partially clean up the TLS1_get_{,client}_version macros.
LibreSSL only supports TLSv1.0 and above, hence the checks the macros are
performing are useless. Simplify them to their effective code. Also place
both under #ifndef LIBRESSL_INTERNAL and use the variables directly in our
code, which improves readability.
ok tb@
Revision 1.56 / (download) - annotate - [select for diffs], Sat Feb 9 15:26:15 2019 UTC (5 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.55: +4 -4 lines
Diff to previous 1.55 (colored)
Rename tls1_handshake_hash*() to tls1_transcript_hash*(). While handshake hash is correct (in as far as it is a hash of handshake messages), using tls1_transcript_hash*() aligns them with the naming of the tls1_transcript*() functions. Additionally, the TLSv1.3 specification uses Transcript-Hash and "transcript hash", which this matches. ok inoguchi@ tb@
Revision 1.55 / (download) - annotate - [select for diffs], Wed Jan 23 18:39:28 2019 UTC (5 years, 4 months ago) by beck
Branch: MAIN
Changes since 1.54: +3 -2 lines
Diff to previous 1.54 (colored)
Modify sigalgs extension processing to accomodate TLS 1.3. - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2. - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 from a 1.3 handshake. ok jsing@ tb@
Revision 1.54 / (download) - annotate - [select for diffs], Wed Jan 23 18:24:40 2019 UTC (5 years, 4 months ago) by beck
Branch: MAIN
Changes since 1.53: +1 -2 lines
Diff to previous 1.53 (colored)
revert previous, accidentally contained another diff in addition to the one I intended to commit
Revision 1.53 / (download) - annotate - [select for diffs], Wed Jan 23 16:46:04 2019 UTC (5 years, 4 months ago) by beck
Branch: MAIN
Changes since 1.52: +3 -2 lines
Diff to previous 1.52 (colored)
Modify sigalgs extension processing for TLS 1.3. - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@
Revision 1.52 / (download) - annotate - [select for diffs], Fri Jan 18 00:54:42 2019 UTC (5 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.51: +3 -3 lines
Diff to previous 1.51 (colored)
Rename TLS extension handling to use less "hello".
When the TLS extension code was rewritten, TLS extensions could only exist
in ClientHello and ServerHello messages - as such, they were named in pairs
of *_clienthello_{needs,build} which would be called by the client and
*_clienthello_parse. Likewise for *_serverhello_{needs,build} which would
be called by a server and *_serverhello_parse, which would be called by a
client.
Enter TLSv1.3 - TLS extensions can now exist in one of seven messages,
with only certain types being allowed to appear in each, meaning the naming
scheme no longer works. Instead, rename them to indicate the caller rather
than the message type - this effectively means:
clienthello_needs -> client_needs
clienthello_build -> client_build
clienthello_parse -> server_parse
serverhello_needs -> server_needs
serverhello_build -> server_build
serverhello_parse -> client_parse
ok beck@ tb@
Revision 1.51 / (download) - annotate - [select for diffs], Thu Nov 29 06:21:09 2018 UTC (5 years, 6 months ago) by tb
Branch: MAIN
Changes since 1.50: +213 -118 lines
Diff to previous 1.50 (colored)
Refactor a tangle in ssl3_send_client_verify() into one function for each type, sigalgs/rsa/ec/gost. Move a few special dances for GOST where they belong now. This prompted a fix for a long-standing bug with GOST client certificate authentication where tls1_transcript_data() fails since the transcript was already freed before. Add a bit of missing error checking and leave some further cleanup for later. idea, guidance & ok jsing
Revision 1.50 / (download) - annotate - [select for diffs], Wed Nov 21 15:13:29 2018 UTC (5 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.49: +5 -10 lines
Diff to previous 1.49 (colored)
Fix DTLS transcript handling for HelloVerifyRequest. If DTLS sees a HelloVerifyRequest the transcript is reset - the previous tls1_init_finished_mac() function could be called multiple times and would discard any existing state. The replacement tls1_transcript_init() is more strict and fails if a transcript already exists. Provide an explicit tls1_transcript_reset() function and call it from the appropriate places. This also lets us make DTLS less of a special snowflake and call tls1_transcript_init() in the same place as used for TLS. ok beck@ tb@
Revision 1.49 / (download) - annotate - [select for diffs], Mon Nov 19 15:07:29 2018 UTC (5 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.48: +2 -5 lines
Diff to previous 1.48 (colored)
Revert previous - DTLSv1 uses MD5+SHA1 for RSA signature verification. Discussed with beck@
Revision 1.48 / (download) - annotate - [select for diffs], Sat Nov 17 11:22:43 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.47: +5 -2 lines
Diff to previous 1.47 (colored)
Fix DTLS, because DTLS still remains a special flower, allows regress to pass
Revision 1.47 / (download) - annotate - [select for diffs], Fri Nov 16 21:20:15 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.46: +2 -4 lines
Diff to previous 1.46 (colored)
revert previous
Revision 1.46 / (download) - annotate - [select for diffs], Fri Nov 16 21:07:20 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.45: +5 -3 lines
Diff to previous 1.45 (colored)
Fix DTLS. Because the DTLS code is strange. I am really coming around to joel's line of thinking about it
Revision 1.45 / (download) - annotate - [select for diffs], Fri Nov 16 02:41:16 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.44: +2 -2 lines
Diff to previous 1.44 (colored)
Unbreak legacy ciphers for prior to 1.1 by setting having a legacy sigalg for MD5_SHA1 and using it as the non sigalgs default ok jsing@
Revision 1.44 / (download) - annotate - [select for diffs], Sun Nov 11 21:54:47 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.43: +2 -2 lines
Diff to previous 1.43 (colored)
Add check function to verify that pkey is usable with a sigalg. Include check for appropriate RSA key size when used with PSS. ok tb@
Revision 1.43 / (download) - annotate - [select for diffs], Sun Nov 11 02:22:34 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.42: +14 -1 lines
Diff to previous 1.42 (colored)
Add support for RSA PSS algorithims being used in sigalgs. lightly tested, but will need sanity checks and regress test changes before being added to any sigalgs list for real ok jsing@ tb@
Revision 1.42 / (download) - annotate - [select for diffs], Sun Nov 11 02:03:23 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.41: +52 -24 lines
Diff to previous 1.41 (colored)
Convert signatures and verifcation to use the EVP_DigestXXX api to allow for adding PSS, Nuke the now unneejded guard around the PSS algorithms in the sigalgs table ok jsing@ tb@
Revision 1.41 / (download) - annotate - [select for diffs], Sat Nov 10 01:19:09 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.40: +12 -12 lines
Diff to previous 1.40 (colored)
Stop keeping track of sigalgs by guessing it from digest and pkey, just keep the sigalg around so we can remember what we actually decided to use. ok jsing@
Revision 1.40 / (download) - annotate - [select for diffs], Fri Nov 9 17:43:31 2018 UTC (5 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.39: +4 -1 lines
Diff to previous 1.39 (colored)
Ensure we free the handshake transcript upon session resumption. Found the hard way by jmc@ ok tb@
Revision 1.39 / (download) - annotate - [select for diffs], Fri Nov 9 05:43:39 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.38: +3 -2 lines
Diff to previous 1.38 (colored)
Ensure we only choose sigalgs from our prefernce list, not the whole list ok jsing@
Revision 1.38 / (download) - annotate - [select for diffs], Fri Nov 9 00:34:55 2018 UTC (5 years, 6 months ago) by beck
Branch: MAIN
Changes since 1.37: +13 -18 lines
Diff to previous 1.37 (colored)
Reimplement the sigalgs processing code into a new implementation that will be usable with TLS 1.3 with less eye bleed. ok jsing@ tb@
Revision 1.37 / (download) - annotate - [select for diffs], Thu Nov 8 22:28:52 2018 UTC (5 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.36: +16 -30 lines
Diff to previous 1.36 (colored)
Clean up and simplify the handshake transcript code.
This provides a cleaner, simpler and more readable API, with code that uses
a BUF_MEM instead of a BIO.
ok beck@ ("hurry up") and tb@.
Revision 1.36 / (download) - annotate - [select for diffs], Thu Nov 8 20:55:18 2018 UTC (5 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.35: +3 -3 lines
Diff to previous 1.35 (colored)
Stop pretending that a cert member in a SSL and SSL_CTX can be NULL. ok beck@ tb@
Revision 1.35 / (download) - annotate - [select for diffs], Thu Nov 8 20:26:45 2018 UTC (5 years, 6 months ago) by jsing
Branch: MAIN
Changes since 1.34: +13 -2 lines
Diff to previous 1.34 (colored)
Ensure the handshake transcript is cleaned up. Add a check at the completion of the client/server handshake to ensure that the handshake transcript has been freed. Fix the case where a server asks the client for a certificate, but it does not have one, resulting in the handshake transcript being left around post-handshake. ok bcook@ tb@
Revision 1.34 / (download) - annotate - [select for diffs], Wed Sep 5 16:58:59 2018 UTC (5 years, 8 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_6_4_BASE,
OPENBSD_6_4
Changes since 1.33: +3 -3 lines
Diff to previous 1.33 (colored)
Use the newer/more sensible names for EVP_MD_CTX_* functions. EVP_MD_CTX_create -> EVP_MD_CTX_new EVP_MD_CTX_destroy -> EVP_MD_CTX_free This should make the intent more obvious and reduce head scratching during code reviews. Raised by tb@
Revision 1.33 / (download) - annotate - [select for diffs], Fri Aug 24 17:30:32 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.32: +9 -9 lines
Diff to previous 1.32 (colored)
Clean up handshake message start/finish functions. Now that all handshake messages are created using CBB, remove the non-CBB ssl3_handshake_msg_start()/ssl3_handshake_msg_finish() functions. Rename the CBB variants by dropping the _cbb suffix. ok bcook@ inoguchi@ tb@
Revision 1.32 / (download) - annotate - [select for diffs], Sun Aug 19 15:38:03 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.31: +2 -2 lines
Diff to previous 1.31 (colored)
Rename and collapse tls12_get_sigandhash_cbb(). Now that all callers of tls12_get_sigandhash() have been converted to CBB, collapse tls12_get_sigandhash() and tls12_get_sigandhash_cbb() into a single function. Rename it to tls12_gethashandsig() to be representative of the actual order of the sigalgs parameters, and perform some other clean up. ok inoguchi@ tb@
Revision 1.31 / (download) - annotate - [select for diffs], Fri Aug 17 16:28:21 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.30: +50 -43 lines
Diff to previous 1.30 (colored)
Convert ssl3_send_client_verify() to CBB. ok inoguchi@ tb@
Revision 1.30 / (download) - annotate - [select for diffs], Thu Aug 16 17:39:50 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.29: +55 -69 lines
Diff to previous 1.29 (colored)
Convert ssl3_get_server_key_exchange() to CBS. ok inoguchi@ tb@
Revision 1.29 / (download) - annotate - [select for diffs], Tue Aug 14 16:31:02 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.28: +1 -3 lines
Diff to previous 1.28 (colored)
Remove now unused variable, that got left behind from a previous change.
Revision 1.28 / (download) - annotate - [select for diffs], Tue Aug 14 16:19:06 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.27: +12 -8 lines
Diff to previous 1.27 (colored)
Actually check the return values for EVP_Sign* and EVP_Verify*. ok bcook@ beck@ tb@
Revision 1.27 / (download) - annotate - [select for diffs], Fri Aug 10 17:52:35 2018 UTC (5 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.26: +18 -49 lines
Diff to previous 1.26 (colored)
Simplify server key exchange signature verification. Everything can go through the EVP_Verify* code path. ok inoguchi@ tb@
Revision 1.26 / (download) - annotate - [select for diffs], Sun Jun 3 15:31:30 2018 UTC (6 years ago) by jsing
Branch: MAIN
Changes since 1.25: +6 -4 lines
Diff to previous 1.25 (colored)
Check the return value from DH_size() in ssl3_send_client_kex_dhe(). ok beck@ inoguchi@
Revision 1.25 / (download) - annotate - [select for diffs], Sun May 13 17:31:06 2018 UTC (6 years ago) by jsing
Branch: MAIN
Changes since 1.24: +3 -2 lines
Diff to previous 1.24 (colored)
Fix a malloc() NULL check in ssl3_send_client_kex_ecdhe_ecp(), by adding the missing goto. While here also remove a set of unnecessary parentheses.
Revision 1.24 / (download) - annotate - [select for diffs], Sat Apr 7 16:55:13 2018 UTC (6 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.23: +2 -15 lines
Diff to previous 1.23 (colored)
Nuke SSL3_FLAGS_DELAY_CLIENT_FINISHED and SSL3_FLAGS_POP_BUFFER. These flags enabled experimental behaviour in the write path, which nothing uses. Removing this code greatly simplifies ssl3_write(). ok beck@ inoguchi@ sthen@ tb@
Revision 1.23 / (download) - annotate - [select for diffs], Thu Feb 8 11:30:30 2018 UTC (6 years, 3 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_6_3_BASE,
OPENBSD_6_3
Changes since 1.22: +18 -10 lines
Diff to previous 1.22 (colored)
Complete the TLS extension rewrite on the client-side. The RI logic gets pulled up into ssl3_get_server_hello() and ssl_parse_serverhello_tlsext() gets replaced by tlsext_client_parse(), which allows a CBS to be passed all the way down. This also deduplicates the tlsext_client_build() and tlsext_server_build() code. ok beck@
Revision 1.22 / (download) - annotate - [select for diffs], Thu Oct 12 16:06:32 2017 UTC (6 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.21: +3 -3 lines
Diff to previous 1.21 (colored)
Rename ssl3_client_hello() to ssl3_send_client_hello() for consistency.
Revision 1.21 / (download) - annotate - [select for diffs], Wed Oct 11 17:35:00 2017 UTC (6 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.20: +45 -36 lines
Diff to previous 1.20 (colored)
Convert ssl3_client_hello() to CBB. As part of this, change ssl_cipher_list_to_bytes() to take a CBB argument, rather than a pointer/length. Some additional clean up/renames while here. Based on a diff from doug@
Revision 1.20 / (download) - annotate - [select for diffs], Tue Oct 10 15:42:32 2017 UTC (6 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.19: +4 -4 lines
Diff to previous 1.19 (colored)
((remove) (some) (unnecessary) (parentheses)) Part of a diff from doug@
Revision 1.19 / (download) - annotate - [select for diffs], Tue Oct 10 15:13:26 2017 UTC (6 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.18: +111 -21 lines
Diff to previous 1.18 (colored)
Merge dtls1_connect() into ssl3_connect(), removing a large amount of duplicated code. For now this is essentially adds a diff of the two functions with 'if (SSL_IS_DTLS(s))' - further clean up and improvement will follow. ok inoguchi@
Revision 1.18 / (download) - annotate - [select for diffs], Sun Oct 8 16:42:21 2017 UTC (6 years, 7 months ago) by jsing
Branch: MAIN
Changes since 1.17: +9 -10 lines
Diff to previous 1.17 (colored)
Fix some style/whitespace/indentation issues in ssl3_connect().
Revision 1.17 / (download) - annotate - [select for diffs], Sat Aug 12 21:47:59 2017 UTC (6 years, 9 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_6_2_BASE,
OPENBSD_6_2
Changes since 1.16: +2 -4 lines
Diff to previous 1.16 (colored)
Convert TLS signature algorithms extension handling to the new framework. ok beck@ doug@
Revision 1.16 / (download) - annotate - [select for diffs], Sat Aug 12 21:03:08 2017 UTC (6 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.15: +3 -53 lines
Diff to previous 1.15 (colored)
Remove NPN support. NPN was never standardised and the last draft expired in October 2012. ALPN was standardised in July 2014 and has been supported in LibreSSL since December 2014. NPN has also been removed from Chromium in May 2016. TLS clients and servers that try to use/enable NPN will fail gracefully and fallback to the default protocol, since it will essentially appear that the otherside does not support NPN. At some point in the future we will actually remove the NPN related symbols entirely. ok bcook@ beck@ doug@
Revision 1.15 / (download) - annotate - [select for diffs], Sat Aug 12 02:55:22 2017 UTC (6 years, 9 months ago) by jsing
Branch: MAIN
Changes since 1.14: +2 -19 lines
Diff to previous 1.14 (colored)
Remove support for DSS/DSA, since we removed the cipher suites a while back. ok guenther@
Revision 1.14 / (download) - annotate - [select for diffs], Sun May 7 04:22:24 2017 UTC (7 years ago) by beck
Branch: MAIN
Changes since 1.13: +53 -53 lines
Diff to previous 1.13 (colored)
Move state from ssl->internal to the handshake structure. while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
Revision 1.13 / (download) - annotate - [select for diffs], Sat May 6 22:24:57 2017 UTC (7 years ago) by beck
Branch: MAIN
Changes since 1.12: +17 -17 lines
Diff to previous 1.12 (colored)
Bring in an SSL_HANDSHAKE structure and commence the great shovelling ok jsing@, gcc@, regress@
Revision 1.12 / (download) - annotate - [select for diffs], Mon Apr 10 06:09:32 2017 UTC (7 years, 1 month ago) by jsing
Branch: MAIN
Changes since 1.11: +5 -14 lines
Diff to previous 1.11 (colored)
Convert various client key exchange functions to freezero(3). The memory contents needs to be made inaccessible - this is simpler and less error prone than the current "if not NULL, explicit_bzero(); free()" dance.
Revision 1.11 / (download) - annotate - [select for diffs], Fri Mar 10 16:03:27 2017 UTC (7 years, 2 months ago) by jsing
Branch: MAIN
CVS Tags: OPENBSD_6_1_BASE,
OPENBSD_6_1
Changes since 1.10: +14 -8 lines
Diff to previous 1.10 (colored)
Remove the handshake digests and related code, replacing remaining uses with the handshake hash. For now tls1_digest_cached_records() is retained to release the handshake buffer. ok beck@ inoguchi@
Revision 1.10 / (download) - annotate - [select for diffs], Sun Mar 5 14:39:53 2017 UTC (7 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.9: +4 -1 lines
Diff to previous 1.9 (colored)
Provide a rolling handshake hash that commences as soon as the cipher suite has been selected, and convert the final finish MAC to use this handshake hash. This is a first step towards cleaning up the current handshake buffer/digest code. ok beck@ inoguchi@
Revision 1.9 / (download) - annotate - [select for diffs], Sun Mar 5 14:24:12 2017 UTC (7 years, 2 months ago) by jsing
Branch: MAIN
Changes since 1.8: +27 -14 lines
Diff to previous 1.8 (colored)
Convert various handshake message generation functions to CBB. ok beck@ inoguchi@
Revision 1.8 / (download) - annotate - [select for diffs], Sat Mar 4 16:15:02 2017 UTC (7 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 (colored)
Call ssl3_handshake_write() instead of ssl3_do_write() - this was missed when ssl3_send_client_certificate() was converted to the standard handshake functions in r1.150 of s3_clnt.c. This has no impact on TLS, however it causes the DTLS client to fail if the server sends a certificate request, since the TLS MAC is calculated on a non-populated DTLS header. Issue reported by umokk on github.
Revision 1.7 / (download) - annotate - [select for diffs], Wed Mar 1 14:01:24 2017 UTC (7 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.6: +12 -21 lines
Diff to previous 1.6 (colored)
Convert ssl3_{get,send}_server_key_exchange() to EVP_md5_sha1().
ok inoguchi@
Revision 1.6 / (download) - annotate - [select for diffs], Tue Feb 28 14:08:49 2017 UTC (7 years, 3 months ago) by jsing
Branch: MAIN
Changes since 1.5: +3 -3 lines
Diff to previous 1.5 (colored)
Stop pretending that MD5 and SHA1 might not exist - rather than locating "ssl3-md5" and "ssl-sha1", call the EVP_md5() and EVP_sha1() functions directly. ok beck@ inoguchi@
Revision 1.5 / (download) - annotate - [select for diffs], Tue Feb 7 02:08:38 2017 UTC (7 years, 3 months ago) by beck
Branch: MAIN
Changes since 1.4: +131 -131 lines
Diff to previous 1.4 (colored)
Change SSLerror() back to taking two args, with the first one being an SSL *. Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible
Revision 1.4 / (download) - annotate - [select for diffs], Thu Jan 26 12:16:13 2017 UTC (7 years, 4 months ago) by beck
Branch: MAIN
Changes since 1.3: +96 -191 lines
Diff to previous 1.3 (colored)
Finish the fallout of the SSLerr->SSLerror cleanup to get rid of the ugly line wraps that resulted
Revision 1.3 / (download) - annotate - [select for diffs], Thu Jan 26 10:40:21 2017 UTC (7 years, 4 months ago) by beck
Branch: MAIN
Changes since 1.2: +131 -131 lines
Diff to previous 1.2 (colored)
Send the error function codes to rot in the depths of hell where they belong We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
Revision 1.2 / (download) - annotate - [select for diffs], Thu Jan 26 06:32:58 2017 UTC (7 years, 4 months ago) by jsing
Branch: MAIN
Changes since 1.1: +12 -12 lines
Diff to previous 1.1 (colored)
Remove most of SSL3_ENC_METHOD - we can just inline the function calls and defines since they are the same everywhere. ok beck@
Revision 1.1 / (download) - annotate - [select for diffs], Thu Jan 26 05:51:54 2017 UTC (7 years, 4 months ago) by jsing
Branch: MAIN
Rename s3_{both,clnt,pkt_srvr}.c to have an ssl_ prefix since they are no
longer SSLv3 code.
ok beck@