summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/recallocarray.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-06-29Convert legacy stack client to ssl_sigalg_for_peer().jsing1-34/+12
ok inoguchi@ tb@
2021-06-29Provide a ssl_sigalg_for_peer() function and use in the TLSv1.3 code.jsing4-15/+33
Provide an ssl_sigalg_for_peer() function that knows how to figure out which signature algorithm should be used for a peer provided signature, performing appropriate validation to ensure that the peer provided value is suitable for the protocol version and key in use. In the TLSv1.3 code, this replaces the need for separate calls to lookup the sigalg from the peer provided value, then perform validation. ok inoguchi@ tb@
2021-06-29Move the RSA-PSS check for TLSv1.3 to ssl_sigalg_pkey_ok().jsing6-34/+29
Also, rather than passing in a check_curve flag, pass in the SSL * and handle version checks internally to ssl_sigalg_pkey_ok(), simplifying the callers. ok inoguchi@ tb@
2021-06-29Factor out handling of legacy default signature algorithms.jsing1-32/+27
In the case of TLSv1.0 and TLSv1.1 there is no signature algorithms extension and default signature algorithms are used - similar applies to TLSv1.2 when the signature algorithms extension has been omitted. ok inoguchi@ tb@
2021-06-29Mop up now unused variables.jsing1-7/+2
2021-06-29Require a ServerHello following a HelloRetryRequest to use the same cipher.jsing1-2/+11
RFC 8446 section 4.1.4 requires that the client ensure the cipher suite in the TLSv1.3 HelloRetryRequest and subsequent ServerHello is the same. Reported via GitHub issue #675. ok inoguchi@ tb@
2021-06-29Reject zero-length non-application data fragments in the legacy stack.jsing1-1/+11
Per RFC 5246 section 6.2.1, zero-length fragments are only permitted for application data - reject all others. Reported via GitHub issue #675. ok inoguchi@ tb@
2021-06-28Use the order action->sender == ctx->mode everywhere for consistency.tb1-3/+3
2021-06-28ctx->alert is not a boolean, so compare it explicitly against 0.tb1-3/+3
2021-06-28The state machine now takes care of setting the legacy state,tb1-11/+1
so it is no longer necessary in to do this by hand in various places of the code interfacing with the legacy stack. ok jsing
2021-06-28Expand info callback support for TLSv1.3tb2-7/+187
During the TLSv1.3 handshake, update the legacy state and call the info callback at the appropriate moment. This is done by mapping the TLSv1.3 states to the states in the old state machine whenever that is possible. The callbacks are called at the beginning and end of the handshake, and just before the state machine advances. This should fix a periodic warning in logs of tor relays about a variable that wasn't set although it should have been. input/ok jsing, ok inoguchi (early version)
2021-06-27Track the sigalgs used by ourselves and our peer.jsing3-9/+14
Move the sigalg pointer from SSL_HANDSHAKE_TLS13 to SSL_HANDSHAKE, naming it our_sigalg, adding an equivalent peer_sigalg. Adjust the TLSv1.3 code that records our signature algorithm. Add code to record the signature algorithm used by our peer. Needed for upcoming API additions. ok tb@
2021-06-27Have ssl3_send_client_verify() pass *pkey to called functions.jsing1-22/+11
ssl3_send_client_verify() already has a pointer to the EVP_PKEY for the certificate - pass this as an argument to the functions that it calls, rather than duplicating code/variable declarations.
2021-06-27Change ssl_sigalgs_from_value() to perform sigalg list selection.jsing6-32/+31
Rather that passing in a sigalg list at every call site, pass in the appropriate TLS version and have ssl_sigalgs_from_value() perform the sigalg list selection itself. This allows the sigalg lists to be made internal to the sigalgs code. ok tb@
2021-06-27Rename ssl_sigalg() to ssl_sigalg_from_value().jsing6-17/+18
This makes the code more self-documenting and avoids the ambiguity between ssl_sigalg the struct and ssl_sigalg the function. ok tb@
2021-06-27Change ssl_sigalgs_build() to perform sigalg list selection.jsing4-28/+29
Rather that doing sigalg list selection at every call site, pass in the appropriate TLS version and have ssl_sigalgs_build() perform the sigalg list selection itself. This reduces code duplication, simplifies the calling code and is the first step towards internalising the sigalg lists. ok tb@
2021-06-27Tidy some comments and simplify some code.jsing1-15/+7
ok tb@
2021-06-27Keep sigalg initialiser order consistent - key type, then hash.jsing2-20/+20
This matches the order that sigalgs are specified in. ok tb@
2021-06-27Add test coverage for TLSv1.3 client hellos.jsing1-13/+166
This is a little bit clunky due to the number of things that vary (largely thanks to middlebox compatibility mode, along with the versions and key share extensions), however it works and can be improved at a later date.
2021-06-27Add test coverage for DTLSv1.2 client hellos.jsing1-7/+102
2021-06-27Improve test coverage for SSL_OP_NO_DTLSv1.jsing1-1/+9
2021-06-27Correct handling of SSL_OP_NO_DTLSv1.jsing1-3/+3
When converting to TLS flags, we need to also include SSL_OP_NO_TLSv1, otherwise the TLS equivalent of SSL_OP_NO_DTLSv1 is TLSv1.0 only, which does not work so well when we try to switch back to DTLS versions.
2021-06-27Teach hexdump() how to identify differing bytes.jsing1-9/+13
This allows differences between the received data and the test data to be more readily identified.
2021-06-27More appropriately set cipher_list_len when AES acceleration is available.jsing1-5/+6
2021-06-27Tweak some data types and sprinkle some const.jsing1-15/+15
2021-06-26Fix .Xr order. From mandoc -Tlint.tb2-7/+7
2021-06-23Garbage collect prototoype for ssl_parse_serverhello_tlsext() whichtb1-3/+1
was removed in t1_lib.c r1.141.
2021-06-22zap wonky commas;jmc1-5/+5
2021-06-22Clarify tls_config_set_*_file() file I/O semanticskn1-13/+11
tls_config_set_*_file(3) do not just set the file paths like tls_config_set_*_path(3) do, they do load the given file(s) into memory directly using tls_config_load_file(). This distinction is important because it means a later tls_connect(3) will not do any file I/O (at least wrt. those files), which is relevant when for example pleding without "[rwc]path" after loading files into memory and before doing tls_connect(3). The manual's current wording made me use the following due to above way of pledging a program: tls_load_file() tls_config_set_ca_mem() tls_unload_file() While in fact a single tls_config_set_ca_file() call does the same. tls_config.c r1.26 (Aug 2016) change the code but forgot to amend the manual as noted by tb, thanks. Feedback OK tb
2021-06-21Add GnuTLS interoperability test in appstest.shinoguchi1-1/+109
2021-06-19zap trailing whitespacetb1-4/+7
2021-06-19Correctly handle epoch wrapping in dtls1_get_bitmap().jsing2-4/+5
Due to a type bug that has been present in DTLS since the code was first committed in 2005, dtls1_get_bitmap() fails to handle next epoch correctly when the epoch is currently 0xffff (and wraps to zero). For various reasons unknown, the epoch field in the SSL3_RECORD_INTERNAL (formerly SSL3_RECORD) was added as unsigned long (even though the value is an unsigned 16 bit value on the wire, hence cannot exceed 0xffff), however was added to other code as unsigned short. Due to integer promotion, the r_epoch value is incremented by one to become 0x10000, before being cast to an unsigned long and compared to the value pulled from the DTLS record header (which is zero). Strangely 0x10000 != 0, meaning that we drop the DTLS record, instead of queueing it for the next epoch. Fix this issue by using more appropriate types and pulling up the calculation of the next epoch value for improved readability. ok inoguchi@ tb@
2021-06-19Add DTLS test cases that use non-zero initial epochs.jsing2-5/+44
In particular, test handling of 0xfffe and 0xffff - the latter results in wrapping to zero for the next epoch. One of these tests triggers a known bug in libssl, which will be fixed following this commit.
2021-06-19Provide the ability to set the initial DTLS epoch value.jsing4-7/+29
This allows for regress to test edge cases for epoch handling. ok tb@
2021-06-19Initialise the epoch for the DTLS processed and unprocessed queues.jsing1-1/+4
Currently these only get correctly initialised when dtls1_process_buffered_records() is called - while this works it is more accidental than intentional. ok tb@
2021-06-19Add more complex DTLS tests for delay/reordering.jsing1-17/+160
These tests exercise the various queues and delayed processing that exists in the DTLS code.
2021-06-19Expand comment that details why two DTLS tests currently fail.jsing1-2/+5
Two tests currently fail (and are disabled) due to a flaw in the DTLSv1.0 specification - this flaw was addressed in DTLSv1.2, however our DTLS server code still needs to support the fix. Quoting RFC 6347 section 4.2.4: "This requirement applies to DTLS 1.0 as well, and though not explicit in [DTLS1], it was always required for the state machine to function correctly." In otherwords, both the original DTLS implementation and the DTLSv1.0 specification have a broken state machine, resulting in possible dead lock.
2021-06-19Provide the ability to delay/reorder DTLS packets.jsing1-14/+147
Add a test that delays the client CCS, resulting in it arriving after the client Finished message.
2021-06-18Remove SSL_CTX_set_read_ahead() calls - it is now the default for DTLS.jsing1-3/+1
2021-06-17Like ARM, RISC-V does not implement floating point exceptions.kettenis3-6/+6
2021-06-15Mop up part of dtls1_dispatch_alert().jsing1-9/+2
The original DTLS code had some strange alert handling code (basically one type of alert included extra data) - a few years later this was "fixed", however the rest of the code was left as is. This means that rather than sending the alert data from send_alert (like ssl3_dispatch_alert() does), we have a local buffer on the stack, which we memset, copy the send_alert bytes into, then send from. ok inoguchi@ tb@
2021-06-14Simplify nonce handling in the TLSv1.2 record layer.jsing1-13/+16
Pass the CBS for the sequence number through, which also allows us to do more sensible length checks. Also, add a missing length check while here. ok inoguchi@ tb@
2021-06-14Remove TLS1_AD_INTERNAL_ERROR from internal visibility againtb1-3/+1
With tls_server.c r1.47 this is no longer needed.
2021-06-14Use SSL_AD_INTERNAL_ERRORtb1-2/+2
One instance of TLS1_AD_* was missed and broke the tree in the recent switch to using only one version of alert defines internally.
2021-06-14ugly hack around broken build until people wake up.deraadt1-1/+3
2021-06-13Add SSL_AD_MISSING_EXTENSION.jsing2-2/+9
This is an alert that was added in TLSv1.3 - we already use it internally, but did not provide the SSL_AD_* define previously. ok tb@
2021-06-13Define SSL_AD_* as actual values.jsing3-42/+49
Rather than having SSL_AD_* as defines that refer to SSL3_AD_* or TLS1_AD_*, just give them actual values directly since it is more readable and the indirection provides no value. Place SSL3_AD_* and TLS1_AD_* under #ifndef LIBRESSL_INTERNAL to prevent further usage. ok tb@
2021-06-13Remove tls1_alert_code().jsing3-73/+3
After running the preprocessor, this function becomes: switch (code) { case 0: return (0); case 10: return (10); case 20: return (20); ... } Its intended purpose was to prevent SSLv3 alerts being sent from TLS code, however now that we've removed "no_certificate" from LibreSSL's reach, it no longer does anything useful. ok tb@
2021-06-13Place obsolete alerts under #ifndef LIBRESSL_INTERNAL.jsing1-4/+7
ok tb@
2021-06-13Remove references to obsolete alerts.jsing2-26/+2
The "no_certificate" alert only existed in SSLv3, while the "decryption_failed" and "export_restriction" alerts were removed in TLSv1.1. ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-20 04:23:21 +0000