openbsd/src/lib/libssl/tls13_server.c, branch OPENBSD_6_8_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE2020-07-03T04:12:51+00:00Improve argument order for the internal tlsext API2020-07-03T04:12:51+00:00tb2020-07-03T04:12:51+00:00urn:sha1:3634005e8a2051a239211f692a45371c14e9d8e4
Move is_server and msg_type right after the SSL object so that CBS
and CBB and alert come last. This brings these functions more in
line with other internal functions and separates state from data.
requested by jsing
Switch the order of the two tests in tls13_client_hello_required_extensions2020-06-25T07:35:05+00:00tb2020-06-25T07:35:05+00:00urn:sha1:2ee8fdd1c5ce8efb1f998902ce8a4fe85eb2b572
to match the order they are listed in the RFC. No functional change.
Enforce restrictions for ClientHello extensions2020-06-24T07:28:38+00:00tb2020-06-24T07:28:38+00:00urn:sha1:e462afaa4660571e2f70d975fc276c4bce2dc53b
RFC 8446 section 9.2 imposes some requirements on the extensions sent
in the ClientHello: key_share and supported_groups must either both be
present or both be absent. If no pre_shared_key was sent, the CH must
contain both signature_algorithms and supported_groups. If either of
these conditions is violated, servers must abort the handshake with a
missing_extensions alert. Add a function that enforces this. If we are
going to enforce that clients send an SNI, we can also do this in this
function.
Fixes failing test case in tlsfuzzer's test-tls13-keyshare-omitted.py
ok beck inoguchi jsing
Implement a rolling hash of the ClientHello message, Enforce RFC 84462020-06-06T01:40:09+00:00beck2020-06-06T01:40:09+00:00urn:sha1:2d835ca8318d9ce502e9fd2dced3ef440decb39d
section 4.1.2 to ensure subsequent ClientHello messages after a
HelloRetryRequest messages must be unchanged from the initial
ClientHello.
ok tb@ jsing@
Align tls13_server_select_certificate() with2020-06-04T18:46:21+00:00tb2020-06-04T18:46:21+00:00urn:sha1:30629d372bb6fa25fceb1d56688001423c01eaaf
tls13_client_select_certificate().
ok inoguchi
distracting whitespace2020-06-02T04:50:17+00:00tb2020-06-02T04:50:17+00:00urn:sha1:f2c03ff1d263ece8e157af50dafc2774543ab6eeImprove server certificate selection for TLSv1.3.2020-05-29T18:00:10+00:00jsing2020-05-29T18:00:10+00:00urn:sha1:d1a8b3df6a3db04aefa03855f802f5bb704acb17
This allows an EC certificate to be selected and used, if the client
sigalgs would allow it.
With feedback from tb@
ok inoguchi@ tb@
Wire up the servername callback in the TLSv1.3 server.2020-05-29T17:47:30+00:00jsing2020-05-29T17:47:30+00:00urn:sha1:e0e84f310956950abc8c5d9f225578b3f6945ee9
This makes SNI work correctly with TLSv1.3.
Found the hard way by danj@, gonzalo@ and others.
ok beck@ inoguchi@ tb@
Wire up SSL_MODE_AUTO_RETRY mode to retrying after PHH messages.2020-05-23T11:58:46+00:00jsing2020-05-23T11:58:46+00:00urn:sha1:b7886785c522527763ee1154ed9eb1f384cb90fe
ok beck@ inoguchi@ tb@
Do not assume that server_group != 0 or tlsext_supportedgroups != NULL2020-05-23T08:47:19+00:00tb2020-05-23T08:47:19+00:00urn:sha1:75a517d36cb6927c5e5e2af71f5bed9d6ac6b884
implies that we're dealing with a HRR in the extension handling code.
Explicitly check that we're in this situation by inspecting the flag in
the handshake context. Add missing error checks and send the appropriate
alerts. The hrr flag needs to be unset after parsing the client hello
retry to avoid breaking the server hello handling. All this is far from
ideal, but better than nothing.
The correct fix would likely be to make the message type available
but that would need to be part of a more extensive rearchitecture of
the extension handling.
Discussed at length with jsing