A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2024-07-23T14:40:54+00:00 2024-07-23T14:40:54+00:00 jsing 2024-07-23T14:40:54+00:00 urn:sha1:db84a0d6a236726c87d7c4ee86e95e65452b429e Inline the get_cipher implementation (including the special handling for DTLS) in ssl_cipher_collect_ciphers() (the only consumer), remove the get_cipher member of SSL_METHOD and mop up dtls1_get_cipher(). ssl3_get_cipher() has always had a strange property of being a reverse index, which is relied on by the cipher list ordering code, since it currently assumes that high cipher suite values are preferable. Rather than complicating ssl3_get_cipher() (and regress), change the iteration order in ssl_cipher_collect_ciphers() to match what it requires. Lastly, rename ssl3_get_cipher() to be more descriptive. ok tb@ 2022-11-26T16:08:57+00:00 tb 2022-11-26T16:08:57+00:00 urn:sha1:81d98bf600a381a625eb11b39a725b08c0ba547f Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook 2022-11-11T17:15:27+00:00 jsing 2022-11-11T17:15:27+00:00 urn:sha1:de50508f29672766d86ce907a002ff8fe4c49908 This converts the legacy TLS stack to tls_content - records are now opened into a tls_content structure, rather than being written back into the same buffer that the sealed record was read into. This will allow for further clean up of the legacy record layer. ok tb@ 2022-10-02T16:36:42+00:00 jsing 2022-10-02T16:36:42+00:00 urn:sha1:efde998d3821e41e124a4bfcdf103e506055fc52 These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@ 2021-10-23T13:36:03+00:00 jsing 2021-10-23T13:36:03+00:00 urn:sha1:86a096b0c72b8b6be5c3299946b7ab98d3eee7e6 Now that DTLS1_STATE is opaque, fold DTLS1_STATE_INTERNAL back into DTLS1_STATE and remove D1I() usage. ok tb@ 2021-10-21T08:30:14+00:00 tb 2021-10-21T08:30:14+00:00 urn:sha1:0ee5567af5b1d62685bac6f84d0baa729b085677 ok jsing 2021-08-30T19:12:25+00:00 jsing 2021-08-30T19:12:25+00:00 urn:sha1:2260f3293f3a2c05fbb25d7e447add03b355e61d ok inoguchi@ tb@ 2021-07-21T08:42:14+00:00 jsing 2021-07-21T08:42:14+00:00 urn:sha1:67063c5ad51de8a429ef4b75620cd2275b75782c When DTLS handshake records are received from the next epoch, we will potentially queue them on the unprocessed_rcds queue - this is usually a Finished message that has been received without the ChangeCipherSuite (CCS) message (which may have been dropped or reordered). After the epoch increments (due to the CCS being received), the current code processes all records on the unprocessed queue and immediate queues them on the processed queue, which dtls1_get_record() then pulls from. This form of processing only adds more complexity and another queue. Instead, once the epoch increments, pull a single record from the unprocessed queue and process it, allowing the contents to be consumed by the caller. We repeat this process until the unprocessed queue is empty, at which point we go back to consuming messages from the wire. ok inoguchi@ tb@ 2021-07-01T17:53:39+00:00 jsing 2021-07-01T17:53:39+00:00 urn:sha1:909a6d9c0830e04a252ab680efffd5246ba048ba Now that SSL_METHOD is opaque and in internal headers, we can remove SSL_METHOD_INTERNAL by merging it back into SSL_METHOD. ok tb@ 2021-06-19T16:52:47+00:00 jsing 2021-06-19T16:52:47+00:00 urn:sha1:975ca9dd8cda1a7829ad89db6d690638e9804058 This allows for regress to test edge cases for epoch handling. ok tb@