openbsd/src/lib/libssl/tls12_lib.c, branch OPENBSD_7_9

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

The master_key_length can no longer be < 0

2022-06-07T17:19:09+00:00

ok jsing

Bye bye S3I.

2022-02-05T14:54:10+00:00

S3I has served us well, however now that libssl is fully opaque it is time to say goodbye. Aside from removing the calloc/free/memset, the rest is mechanical sed. ok inoguchi@ tb@

Harden tls12_finished_verify_data() by checking master key length.

2021-05-02T15:57:29+00:00

Require master key length to be greater than zero if we're asked to derive verify data for a finished or peer finished message. ok tb@

Clean up and harden TLSv1.2 master key derivation.

2021-04-30T19:26:45+00:00

The master key and its length are only stored in one location, so it makes no sense to handle these outside of the derivation function (the current 'out' argument is unused). This simplifies the various call sites. If derivation fails for some reason, fail hard rather than continuing on and hoping that something deals with this correctly later. ok inoguchi@ tb@

Clean up derivation of finished/peer finished.

2021-04-25T13:15:23+00:00

Make this process more readable by having specific client/server functions, calling the correct one based on s->server. This allows to remove various SSL_ST_ACCEPT/SSL_ST_CONNECT checks, along with duplicate code. ok inoguchi@ tb@