openbsd/src/lib/libssl/s3_lib.c, branch OPENBSD_6_8_BASE

Prepare to provide SSL_get_peer_tmp_key().

2020-09-17T15:42:14+00:00

OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@

Move state initialisation from SSL_clear() to ssl3_clear().

2020-09-14T18:34:12+00:00

If we use the default method (now TLSv1.3) and end up talking to a TLSv1.2 server that gives us a session ticket, then try to resume that session, we end up trying to talk TLS without doing a handshake. This is caused by the state (S3I(s)->hs.state) getting cleared, which results in SSL_do_handshake() and others thinking they do not need to do anything (as SSL_in_init() and SSL_in_before() are not true). The reason this occurs is due to SSL_set_ssl_method() calling ssl_free() and ssl_new() when switching methods. The end result is that the S3I(s) has been freed and reallocated, losing the state in the process. Since the state is part of the S3I(s) structure, move its initialisation into ssl3_clear() - this ensures it gets correctly reinitialised across a SSL_set_ssl_method() call. Issue noticed by sthen@ with nginx and unifi. ok beck@ tb@

Implement a rolling hash of the ClientHello message, Enforce RFC 8446

2020-06-06T01:40:09+00:00

section 4.1.2 to ensure subsequent ClientHello messages after a HelloRetryRequest messages must be unchanged from the initial ClientHello. ok tb@ jsing@

Use IANA allocated GOST ClientCertificateTypes.

2020-06-05T18:14:05+00:00

IANA has allocated numbers for GOST ClientCertificateType. Use them in addition to private values (left in place for compatibility). Diff from Dmitry Baryshkov Sponsored by ROSA Linux ok inoguchi@ tb@

Stop sending GOST R 34.10-94 as a CertificateType.

2020-06-05T17:58:32+00:00

GOST R 34.10-94 is an obsolete certificate type, unsupported by LibreSSL and by the rest of current software, so there is no point in sending in the CertificateTypes. Diff from Dmitry Baryshkov Sponsored by ROSA Linux ok inoguchi@ tb@

Use size_t for OCSP response length.

2020-05-10T14:17:48+00:00

The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@

Expose the peer ephemeral public key used for TLSv1.3 key exchange.

2020-04-18T14:07:56+00:00

SSL_get_server_tmp_key() provides the peer ephemeral public key used for key exchange. In the case of TLSv1.3 this is essentially the peer public key from the key share used for TLSv1.3 key exchange, hence make it availaable via SSL_get_server_tmp_key(). ok inoguchi@ tb@

Avoid leak for tmp.x25519

2020-02-16T14:33:04+00:00

Changed to use local variable to hold malloc address rather than directly set to S3I(s)->tmp.x25519, and set that private_key pointer to S3I(s)->tmp.x25519 after all the "goto err;". Also added freezero for S3I(s)->tmp.x25519 to ssl3_free() and ssl3_clear(). ok jsing@ tb@

Provide struct/functions for handling TLSv1.3 key shares.

2020-01-30T17:09:23+00:00

Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@

Correctly handle TLSv1.3 ciphers suites in ssl3_choose_cipher().

2020-01-23T10:40:59+00:00

Currently, TLSv1.3 cipher suites are filtered out by the fact that they have authentication and key exchange algorithms that are not being set in ssl_set_cert_masks(). Fix this so that ssl3_choose_cipher() works for TLSv1.3, however we also now need to ensure that we filter out TLSv1.3 for non-TLSv1.3 and only select TLSv1.3 for TLSv1.3. ok beck@ tb@