A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-09-24T18:12:00+00:00 2020-09-24T18:12:00+00:00 jsing 2020-09-24T18:12:00+00:00 urn:sha1:10841ee643f560678ff5ed0276c4da735ec37bdf ok beck@ inoguchi@ tb@ 2020-09-24T17:59:54+00:00 jsing 2020-09-24T17:59:54+00:00 urn:sha1:1328e78055c6ad087ebbec8484862dea13576ef5 Provide a ssl3_release_buffer() function that correctly frees a buffer and call it from the appropriate locations. While here also change ssl3_release_{read,write}_buffer() to void since they cannot fail and no callers check the return value currently. ok beck@ inoguchi@ tb@ 2020-09-17T15:23:29+00:00 jsing 2020-09-17T15:23:29+00:00 urn:sha1:ac608c91af9de9141849165d1599e500cf7010cc There are three places where we call tls1_get_{client,server}_method() and if that returns NULL, call dtls1_get_{client,server}_method(). Simplify this by combining the lookup into a single function. While here also use uint16_t for version types. ok inoguchi@ millert@ 2020-09-15T09:41:24+00:00 jsing 2020-09-15T09:41:24+00:00 urn:sha1:b1c0ef487c250fc4642e7e832c1057881273e6fd Now that get_ssl_method is no longer used, we can garbage collect the function pointer and some associated machinery. ok beck@ 2020-09-13T16:49:05+00:00 jsing 2020-09-13T16:49:05+00:00 urn:sha1:413d6dece592534652ab298d8c9f26aca9ce2063 OpenSSL added a separate API for configuring TLSv1.3 ciphersuites. Provide this API, while retaining the current behaviour of being able to configure TLSv1.3 via the existing interface. Note that this is not currently exposed in the headers/exported symbols. ok beck@ inoguchi@ tb@ 2020-09-11T17:36:27+00:00 jsing 2020-09-11T17:36:27+00:00 urn:sha1:cb4349853bf54ac34c4b6615aa3102e8d10f685f When parsing a cipher string, a cipher list is created, before being duplicated and sorted - the second copy being stored as cipher_list_by_id. This is done only so that a client can ensure that the cipher selected by a server is in the cipher list. This is pretty pointless given that most clients are short-lived and that we already had to iterate over the cipher list in order to build the client hello. Additionally, any update to the cipher list requires that cipher_list_by_id also be updated and kept in sync. Remove all of this and replace it with a simple linear scan - the overhead of duplicating and sorting the cipher list likely exceeds that of a simple linear scan over the cipher list (64 maximum, more typically ~9 or so). ok beck@ tb@ 2020-09-11T15:28:08+00:00 jsing 2020-09-11T15:28:08+00:00 urn:sha1:f0df36892f1ea5c0f48cd299f82f8a96f8adc015 The name ssl_cipher_is_permitted() is not entirely specific - what it really means is "can this cipher be used with a given version range". Use ssl_cipher_allowed_in_version_range() to more clearly indicate this. Bikeshedded with tb@ ok tb@ 2020-09-01T12:40:53+00:00 tb 2020-09-01T12:40:53+00:00 urn:sha1:9f988c795fd8a5ef1dcaff20a0704bca35366cfe ssl_get_prev_session() hands the session id down to tls_decrypt_ticket() which then copies it into the session pointer that it is about to return. It's a lot simpler to retrieve the session pointer and copy the session id inside ssl_get_prev_session(). Also, 'goto err' directly in TLS1_TICKET_NOT_DECRYPTED instead of skipping a couple of long if clauses before doing so. ok inoguchi jsing 2020-09-01T05:32:11+00:00 tb 2020-09-01T05:32:11+00:00 urn:sha1:c4e85056430c7717bad800d4e1a6dd84c0fe298f tls1_process_ticket() - the only caller of tls_decrypt_ticket() - ends in a switch over the return value of tls_decrypt_ticket() to decide whether or not to set s->internal->tlsext_ticket_expected = 1. Since tls_decrypt_ticket() already knows what it will return and partly bases its decision on what to return on whether or not the ticket needs to be renewed, it can also take care of setting this flag. This way we don't need to have a confusing switch that conflates some return values and sets this flag. Moreover, we can get rid of the ugly TLS1_TICKET_DECRYPTED_RENEW whose only purpose is to signal that the flag should be set. ok jsing 2020-08-31T14:34:01+00:00 tb 2020-08-31T14:34:01+00:00 urn:sha1:cacb5c0088a8650eff463899828ce9a729fa956e In tls1_process_ticket() and tls_decrypt_ticket() use #defines with descriptive names instead of hardcoding -1 1 2 3 4 and occasionally explaining the magic numbers with comments. ok beck inoguchi