openbsd/src/lib/libssl/ssl_tlsext.h, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-07-03T04:51:59+00:00 Make the message type available to the extension functions 2020-07-03T04:51:59+00:00 tb 2020-07-03T04:51:59+00:00 urn:sha1:0bfb0ca4cf5c93e1c9f105fdbdcd8825c432e4f1 Some TLS extensions need to be treated differently depending on the handshake message they appear in. Over time, various workarounds and hacks were used to deal with the unavailability of the message type in these functions, but this is getting fragile and unwieldy. Having the message type available will enable us to clean this code up and will allow simple fixes for a number of bugs in our handling of the status_request extension reported by Michael Forney. This approach was suggested a while ago by jsing. ok beck jsing Improve argument order for the internal tlsext API 2020-07-03T04:12:51+00:00 tb 2020-07-03T04:12:51+00:00 urn:sha1:3634005e8a2051a239211f692a45371c14e9d8e4 Move is_server and msg_type right after the SSL object so that CBS and CBB and alert come last. This brings these functions more in line with other internal functions and separates state from data. requested by jsing Enforce that SNI hostnames be correct as per rfc 6066 and 5980. 2020-05-23T17:13:24+00:00 beck 2020-05-23T17:13:24+00:00 urn:sha1:93f758622bc86732ccd44db068014cb9e42f9a52 Correct SNI alerts to differentiate between illegal parameter and an unknown name. ok tb@` Correct value for SSL_TLSEXT_MSG_HRR. 2020-01-25T12:58:27+00:00 jsing 2020-01-25T12:58:27+00:00 urn:sha1:42cb289a42596aac50162531fba940d3d5b0e9ba ok beck@ tb@ Add tls_extension_seen(), a utility to know if a particular extension 2019-01-28T15:44:33+00:00 beck 2019-01-28T15:44:33+00:00 urn:sha1:c58264060d34a89096fa45721ffd26f246efb0df has been seen in the handshake so far. Use it for keyshare. ok tb@ Add server side of versions, keyshare, and client and server of cookie 2019-01-24T02:56:41+00:00 beck 2019-01-24T02:56:41+00:00 urn:sha1:0e0dded0edfa8150131664aa928c1c890377082d extensions for tls1.3. versions is currently defanged to ignore its result until tls13 server side wired in full, so that server side code still works today when we only support tls 1.2 ok bcook@ tb@ jsing@ revert previous, accidentally contained another diff in addition 2019-01-23T18:24:40+00:00 beck 2019-01-23T18:24:40+00:00 urn:sha1:9a6a5e403c8b66eb5bbc3532a5f1b5e325b172c1 to the one I intended to commit Modify sigalgs extension processing for TLS 1.3. 2019-01-23T16:46:04+00:00 beck 2019-01-23T16:46:04+00:00 urn:sha1:eb8cfbe6972b8b99de20acf4ed8e9b7ffc9b22df - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@ copyright 2019-01-18T12:18:10+00:00 beck 2019-01-18T12:18:10+00:00 urn:sha1:d61658edd84d221a4ca3ff7dd2086a2f1512ab79 Add client side of supported versions and keyshare extensions with basic regress 2019-01-18T12:09:52+00:00 beck 2019-01-18T12:09:52+00:00 urn:sha1:ce47e4d50f0d2d1f5283e840350417b0292ea5f4 ok jsing@