summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/reallocarray.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-01-22Avoid NULL deref on BIO_new{_mem_buf,}() failure.tb2-7/+11
2021-01-21when using fake keys, skip the private key checkeric1-1/+2
ok tb@
2021-01-21return -1 on error for consistencyeric1-2/+2
ok tb@
2021-01-21minor bump after symbol additioneric1-1/+1
2021-01-21Allow setting a keypair on a tls context without specifying the privateeric4-26/+77
key, and fake it internally with the certificate public key instead. It makes it easier for privsep engines like relayd that don't have to use bogus keys anymore. ok beck@ tb@ jsing@
2021-01-21Mop up unused dtls1_build_sequence_number() function.jsing2-25/+2
2021-01-21don't set AUTO_RETRY. it's a remnant of an experiment.tb1-3/+1
2021-01-20Drop unneeded cast in seal_record_protected_ciphertb1-2/+2
eiv_len was changed from an int to a size_t in r1.10, so casting it to a size_t is now a noop. ok jsing
2021-01-19Add code to handle change of cipher state in the new TLSv1.2 record layer.jsing5-17/+137
This provides the basic framework for handling change of cipher state in the new TLSv1.2 record layer, creating new record protection. In the DTLS case we retain the previous write record protection and can switch back to it when retransmitting. This will allow the record layer to start owning sequence numbers and encryption/decryption state. ok inoguchi@ tb@
2021-01-19Provide functions to determine if TLSv1.2 record protection is engaged.jsing5-18/+37
Call these functions from code that needs to know if we've changed cipher state and enabled record protection, rather than inconsistently checking various pointers from other places in the code base. This also fixes a minor bug where the wrong pointers are checked if we're operating with AEAD. ok inoguchi@ tb@
2021-01-19Provide record layer overhead for DTLS.jsing3-17/+38
Rather than manually calculating the maximum record layer overhead in the DTLS code, have the record layer provide this information. This also makes it work correctly with AEAD ciphersuites. ok inoguchi@ tb@
2021-01-19Factor out code for explicit IV length, block size and MAC length.jsing1-21/+77
Pull this code up into the record protection struct, which means we only need the length checks in one place. This code will soon be used for additional purposes. ok inoguchi@ tb@
2021-01-19Prevent an overflow in inet_net_pton(3) when the passed in buffer isflorian1-11/+18
too small in the AF_INET6 case. Spotted by Brad House (brad AT brad-house.com) with the c-ares regression test. The man page says Caution: The dst field should be zeroed before calling inet_net_pton() as the function will only fill the number of bytes necessary to encode the network number in network byte order. Which seems to suggest that the function should work if the passed in storage is big enough to hold the prefix, which might be smaller than sizeof(in6_addr). Input & OK tb
2021-01-13Clean up dtls1_reset_seq_numbers()jsing1-10/+7
Inline/remove some variables and use sizeof with the correct variables. ok inoguchi@ tb@
2021-01-13Clean up read sequence handling in DTLS.jsing1-19/+21
Pass the explicit DTLS read sequence number to dtls1_record_bitmap_update() and dtls1_record_replay_check(), rather than expecting it to be in S3I(s)->read_sequence. Also, store the read sequence number into S3I(s)->rrec.seq_num when we're processing the record header, rather than having dtls1_record_replay_check() be responsible for copying it. ok inoguchi@ tb@
2021-01-13Clean up sequence number handing in the new TLSv1.2 record layer.jsing3-69/+89
Handle protocol specific (DTLS vs TLS) sequence number differences in the open/seal record functions and propagate the sequence number through to the called functions. This means that DTLS specific knowledge is limited to two functions and also avoids building sequence numbers multiple times over. As a result, the DTLS explicit sequence number is now extracted from the record header and passed through for processing, which makes the read epoch handling redundant. ok inoguchi@ tb@
2021-01-12A few minor tweaks to make my OCD happy.tb1-12/+9
Sort headers, unwrap a line, fix grammar in spelling and simplify the check for test failure.
2021-01-12Split the record protection from the TLSv1.2 record layer.jsing1-75/+101
When changing cipher state, DTLS requires that the previous write protection state remain available so that messages can be retransmitted. Currently, this is done by DTLS saving and restoring various pointers, along with special casing to not free the cipher and hash where it would normally be freed for TLS (and requiring DTLS to free things at the appropriate times). This can be handled in a much cleaner manner by splitting the record protection from the record layer. This allows for the previous write state to be retained and restored by swapping a single pointer. Additionally, it also results in more readable and manageable code. This diff simply splits the record protection from the record layer - future changes will add support for maintaining and switching between write states. ok inoguchi@ tb@
2021-01-11Print error if SSL_{connect,accept,shutdown}(3) don't run to completion.tb1-3/+13
2021-01-11Shut down the TLS connections properly.tb1-3/+28
2021-01-11Include headers used instead of relying on ssl.h pulling in the world.tb1-1/+7
2021-01-10Merge handshake_loop() into handshake(). There's no benefit in havingtb1-18/+7
this factored into a separate function.
2021-01-10tweak a commenttb1-2/+2
2021-01-10Link shared ciphers test to buildtb1-1/+3