openbsd/src/lib/libssl, branch libressl-v3.3.0

fix another misleading line break and indent

2020-11-20T08:08:02+00:00

fix confusing line break and indent

2020-11-20T08:03:53+00:00

typo & punctuation in comment

2020-11-17T07:02:30+00:00

Implement exporter for TLSv1.3.

2020-11-16T18:55:15+00:00

This implements the key material exporter for TLSv1.3, as defined in RFC8446 section 7.5. Issue reported by nmathewson on github. ok inoguchi@ tb@

Implement auto chain for the TLSv1.3 server.

2020-11-11T18:20:10+00:00

Apparently OpenLDAP relies on this craziness to provide intermediates, rather than specifying the chain directly like a normal TLS server would. Issue noted by sthen@ and Bernard Spil, who both also tested this diff. ok tb@

Use size_t for key_block_len.

2020-11-11T18:14:12+00:00

This allows us to remove a check and will make future changes simpler. Use suitable names for tls1_generate_key_block() arguments while here. ok inoguchi@ tb@

Only check BIO_should_read() on read and BIO_should_write() on write.

2020-11-03T17:41:39+00:00

The TLSv1.3 code that drives a BIO currently checks BIO_should_read() after BIO_write() and BIO_should_write() after BIO_read(), which was modelled on SSL_get_error(). However, there are certain cases where this can confuse the caller - primarily where the same BIO is being used for both read and write and the caller is manipulating the retry flags. SSL_get_error() tends avoids this issue by relying on another layer of state tracking. Unfortunately haproxy hits this situation - it has its own BIO_METHOD, the same BIO is used for both read and write and it manipulates the retry flags - resulting in it stalling. Issued noted by Thorsten Lockert ok beck@ tb@

Unbreak DTLS retransmissions for flights that include a CCS.

2020-10-15T18:00:31+00:00

When retransmitting a flight that includes a CCS, the record protection from the previous epoch has to be used to send the messages up to and including the CCS, with messages after the CCS using record protection from the current epoch. The code that restores the record protection state failed to work correctly with the new TLSv1.2 record layer. ok tb@

zap annoying stray spaces

2020-10-15T07:07:09+00:00

Replace SSL_IS_DTLS with SSL_is_dtls().

2020-10-14T16:57:33+00:00

Garbage collect the now unused SSL_IS_DTLS macro. ok tb@