openbsd/src/lib/libssl/t1_enc.c, branch OPENBSD_7_9

Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability.

2026-04-03T13:11:00+00:00

We no longer support TLSv1.0 and definitely do not support SSLv3 - remove the empty fragments workaround for the CBC vulnerability in these protocols. ok kenjiro@ tb@

Remove cipher from SSL_SESSION.

2024-07-20T04:04:23+00:00

For a long time SSL_SESSION has had both a cipher ID and a pointer to an SSL_CIPHER (and not both are guaranteed to be populated). There is also a pointer to an SSL_CIPHER in the SSL_HANDSHAKE that denotes the cipher being used for this connection. Some code has been using the cipher from SSL_SESSION and some code has been using the cipher from SSL_HANDSHAKE. Remove cipher from SSL_SESSION and use the version in SSL_HANDSHAKE everywhere. If resuming from a session then we need to use the SSL_SESSION cipher ID to set the SSL_HANDSHAKE cipher. And we still need to ensure that we update the cipher ID in the SSL_SESSION whenever the SSL_HANDSHAKE cipher changes (this only occurs in a few places). ok tb@

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Rewrite TLSv1.2 key exporter.

2022-11-07T11:58:45+00:00

Replace the grotty TLSv1.2 key exporter with a cleaner version that uses CBB and CBS. ok tb@

Get rid of SSL_CTX_INTERNAL and SSL_INTERNAL.

2022-10-02T16:36:42+00:00

These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@

Bye bye S3I.

2022-02-05T14:54:10+00:00

S3I has served us well, however now that libssl is fully opaque it is time to say goodbye. Aside from removing the calloc/free/memset, the rest is mechanical sed. ok inoguchi@ tb@

Convert t1_enc.c to opaque EVP_MD_CTX.

2021-12-09T17:54:41+00:00

ok inoguchi jsing

Mop up enc_read_ctx and read_hash.

2021-10-23T15:02:27+00:00

These are no longer public, so we can mop them up along with the machinery needed to set/clear them. ok beck@ tb@

Merge SSL_METHOD_INTERNAL into SSL_METHOD.

2021-07-01T17:53:39+00:00

Now that SSL_METHOD is opaque and in internal headers, we can remove SSL_METHOD_INTERNAL by merging it back into SSL_METHOD. ok tb@

Remove tls1_alert_code().

2021-06-13T15:34:41+00:00

After running the preprocessor, this function becomes: switch (code) { case 0: return (0); case 10: return (10); case 20: return (20); ... } Its intended purpose was to prevent SSLv3 alerts being sent from TLS code, however now that we've removed "no_certificate" from LibreSSL's reach, it no longer does anything useful. ok tb@