A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v4.3.2 2024-09-09T03:32:29+00:00 2024-09-09T03:32:29+00:00 tb 2024-09-09T03:32:29+00:00 urn:sha1:461979ad807ebd887bb629ba3072f150b5390cd2 This is a small refactoring that wraps a direct call to the record layer's alert_sent() callback into a handler for upcoming reuse in the QUIC code. No functional change. ok jsing 2024-01-27T14:23:51+00:00 jsing 2024-01-27T14:23:51+00:00 urn:sha1:9f10df8c2961b5d22fbb67942ef04e74ea843ece This will make it easier to regress test shutdown behaviour in the TLSv1.3 stack. Additionally, `openssl -msg` now shows alerts for TLSv1.3 connections. ok tb@ 2022-11-11T17:15:27+00:00 jsing 2022-11-11T17:15:27+00:00 urn:sha1:de50508f29672766d86ce907a002ff8fe4c49908 This converts the legacy TLS stack to tls_content - records are now opened into a tls_content structure, rather than being written back into the same buffer that the sealed record was read into. This will allow for further clean up of the legacy record layer. ok tb@ 2022-09-11T13:50:41+00:00 jsing 2022-09-11T13:50:41+00:00 urn:sha1:b0927200cf32ec6615639e84b9d31ced84f394de ok tb@ 2022-07-24T14:28:16+00:00 jsing 2022-07-24T14:28:16+00:00 urn:sha1:2c5937ccb88658c18243c49fc57c58b62e344235 QUIC uses TLS to complete the handshake, however unlike normal TLS it does not use the TLS record layer, rather it provides its own transport. This means that we need to intercept all communication between the TLS handshake and the record layer. This allows TLS handshake message writes to be directed to QUIC, likewise for TLS handshake message reads. Alerts also need to be sent via QUIC, plus it needs to be provided with the traffic keys that are derived by TLS. ok tb@ 2022-07-24T14:16:29+00:00 jsing 2022-07-24T14:16:29+00:00 urn:sha1:8e1be2bf4fabd0e39f3d547284095e5c4610e056 QUIC wants to know what "encryption level" handshake messages should be sent at. Provide an ssl_encryption_level_t enum (via BoringSSL) that defines these (of course quictls decided to make this an OSSL_ENCRYPTION_LEVEL typedef, so provide that as well). Wire these through to tls13_record_layer_set_{read,write}_traffic_key() so that they can be used in upcoming commits. ok tb@ 2022-07-20T06:32:24+00:00 jsing 2022-07-20T06:32:24+00:00 urn:sha1:c883f86bc052054b4a1fc92fd72cc4c7ea17657e There is no way that tls_buffer_set_data() can currently work in conjunction with tls_buffer_expand(). This fact is currently hidden by the way that PHH works, which reads the same data from the record layer (which it needs to do anyway, since we may not have all of the handshake message in a single record). Since this is broken, mop it up and change the PHH callback to not provide the record data. ok beck@ tb@ 2022-01-14T09:12:15+00:00 tb 2022-01-14T09:12:15+00:00 urn:sha1:cc893e3cc0b957c2b09fd48feadb8518d7f3ddea ok jsing 2022-01-06T18:18:13+00:00 jsing 2022-01-06T18:18:13+00:00 urn:sha1:8a294c8f5ee20d8960cff250faba4ec8637a5f74 This brings the code more in line with the tls12_record_layer and reduces the effort needed to make EVP_AEAD_CTX opaque. Prompted by and ok tb@ 2021-12-15T17:57:45+00:00 jsing 2021-12-15T17:57:45+00:00 urn:sha1:e135a3ba22c8b5c9463cad3035704d99945030ac ok tb@