openbsd/src/lib/libssl, branch libressl-v2.9.0 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v2.9.0 2018-12-07T07:22:09+00:00 Remove an ugly hack in the client certificate verification code that works 2018-12-07T07:22:09+00:00 tb 2018-12-07T07:22:09+00:00 urn:sha1:018afeb2aec4670632a8ace8c72375d615c1f49d around broken GOST implementations. It looks like client certificates with GOST have been completely broken since reimport of the GOST code, so no-one is using LibreSSL this way. The client side was fixed only last week for TLSv1.0 and TLSv1.1. This workaround is now in the way of much needed simplifcation and cleanup, so it is time for it to go. suggested by and ok jsing Send SSL_AD_DECODE alerts in the case of a bad hello request or an 2018-12-03T17:16:12+00:00 tb 2018-12-03T17:16:12+00:00 urn:sha1:364a2952c0af39bd1295e56ea70be8c49ffb4618 invalid change cipher spec. Found due to dead assignment warnings by the Clang static analyzer. ok inoguchi (previous version), jsing Refactor a tangle in ssl3_send_client_verify() into one function for each 2018-11-29T06:21:09+00:00 tb 2018-11-29T06:21:09+00:00 urn:sha1:1604e1fa73583347fa0b8735c9f9485428eba1b5 type, sigalgs/rsa/ec/gost. Move a few special dances for GOST where they belong now. This prompted a fix for a long-standing bug with GOST client certificate authentication where tls1_transcript_data() fails since the transcript was already freed before. Add a bit of missing error checking and leave some further cleanup for later. idea, guidance & ok jsing Fix DTLS transcript handling for HelloVerifyRequest. 2018-11-21T15:13:29+00:00 jsing 2018-11-21T15:13:29+00:00 urn:sha1:e8890ed3b276eb268ca4797509a7faf50534f77d If DTLS sees a HelloVerifyRequest the transcript is reset - the previous tls1_init_finished_mac() function could be called multiple times and would discard any existing state. The replacement tls1_transcript_init() is more strict and fails if a transcript already exists. Provide an explicit tls1_transcript_reset() function and call it from the appropriate places. This also lets us make DTLS less of a special snowflake and call tls1_transcript_init() in the same place as used for TLS. ok beck@ tb@ Revert previous - DTLSv1 uses MD5+SHA1 for RSA signature verification. 2018-11-19T15:07:29+00:00 jsing 2018-11-19T15:07:29+00:00 urn:sha1:d56d600f3870ec2c9e54df36d801eb89a3133c94 Discussed with beck@ Revert previous - the default sigalg for RSA key exchange is {sha1,rsa}. 2018-11-19T14:42:01+00:00 jsing 2018-11-19T14:42:01+00:00 urn:sha1:c3a30b06a9f99ca44c239bb7aba269feaa58256e In TLSv1.2, if the client does not send a signature algorithms extension then for RSA key exchange a signature algorithm of {sha1,rsa} is implied. The MD5+SHA1 hash only applies to older versions of TLS, which do not support sigalgs. Fix DTLS, because DTLS still remains a special flower, allows regress to pass 2018-11-17T11:22:43+00:00 beck 2018-11-17T11:22:43+00:00 urn:sha1:6d27fd93f40dec18f1778594e4e3f59fb538daec revert previous 2018-11-16T21:20:15+00:00 beck 2018-11-16T21:20:15+00:00 urn:sha1:824d79fa702e86900e958ac83c785c22f4e3c75d Fix DTLS. Because the DTLS code is strange. I am really coming around to 2018-11-16T21:07:20+00:00 beck 2018-11-16T21:07:20+00:00 urn:sha1:cfa0592684c490f4f99b26ec631f6af09b5b8702 joel's line of thinking about it Unbreak legacy ciphers for prior to 1.1 by setting having a legacy 2018-11-16T02:41:16+00:00 beck 2018-11-16T02:41:16+00:00 urn:sha1:69bf77d3b518cd8ed78eef6ac0fe903148c8fa95 sigalg for MD5_SHA1 and using it as the non sigalgs default ok jsing@