summaryrefslogtreecommitdiff
path: root/src/lib/libc/string/wcscpy.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-02-06Re-enable the TLSv1.3 client since the known issues have been addressed.jsing1-3/+1
ok tb@
2020-02-06Add a workaround to make SSL_set_session() work with TLSv1.3.jsing1-1/+9
While we do not currently do session resumption, just return the TLS_client_method() or TLS_server_method() when asked for a method that does TLSv1.3. ok tb@ (who also arrived at the same diff)
2020-02-06Add support for handling hello retry requests in the TLSv1.3 client.jsing1-5/+100
In the case of a hello retry request, we need to replace the client hello with a synthetic handshake message, switch key share to that selected by the server, build and send a new client hello, then process the resulting server hello. ok tb@
2020-02-06Correctly handle key share extensions in a hello retry request.jsing2-4/+11
In a hello retry request the server will only send the selected group and not actually provide a key exchange. In this case we need to store the server selected group for further processing. ok tb@
2020-02-05Reset the key share so that we do not have an existing peer public key.jsing1-1/+7
2020-02-05Refactor the server hello processing code in the TLSv1.3 client.jsing2-22/+46
Use flags to signal the need to switch to the legacy client and to identify a hello retry request. This allows the caller to take appropriate action, rather than trying to do this in the parsing/processing code. Split the key deriviation and record protection engagement code into a separate function, both for readability and reuse. Change handshake states outside of the processing code. ok tb@
2020-02-05Remove the hello retry request processing code that was previously added.jsing2-65/+16
This got added to the wrong functions (server side, not client) - swap the now unimplemented send/recv functions between client and server. ok tb@
2020-02-05Provide tls1_transcript_unfreeze() to avoid the need for manual flagsjsing2-3/+10
mangling. ok tb@
2020-02-05Pull the handshake message transcript code into its own function.jsing2-7/+14
This is soon going to be used in the TLSv1.3 client code. ok tb@
2020-02-05Rework tls13_legacy_handshake_message_{recv,sent}_cb() to usetb3-16/+22
their own CBS as a preparation for upcoming HRR diffs. ok jsing
2020-02-04Add support for TLSv1.3 key shares with secp256r1 and secp384r1 groups.jsing1-5/+98
ok inoguchi@ tb@
2020-02-04Free the transcript as soon as we initialise the transcript hash.jsing2-2/+4
Unlike TLSv1.2 there is only a single hash in use, hence as soon as we know what the hash is and have initialised the transcript hash, we can free the transcript buffers. ok inoguchi@ tb@
2020-02-02Add missing new line to printf. Make clean should not require SUDO.bluhm2-7/+5
2020-02-01Tweak regress to match change made to tls13_key_share_peer_public().jsing1-2/+1
2020-02-01Correctly unpack client key shares.jsing2-14/+11
Even if we're not processing/using the peer public key from the key share, we still need to unpack it in order to parse the TLS extension correctly. Resolves issues with TLSv1.3 clients talking to TLSv1.2 server. ok tb@
2020-02-01Disable TLSv1.3 client while some known issues are being addressed.jsing1-1/+3
2020-01-30Revise for TLSv1.3 key share changes.jsing1-8/+27
2020-01-30Provide struct/functions for handling TLSv1.3 key shares.jsing8-130/+299
Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
2020-01-30Factor out/rewrite the ECDHE EC point key exchange code.jsing5-173/+188
This reduces replication between the existing TLS client/server and allows the code to soon be reused for TLSv1.3. With feedback from inoguchi@ and tb@ ok inoguchi@ tb@
2020-01-30Enable t_ptrace with an errno change compared to NetBSD.mpi4-19/+31
Note that the last test triggers a kernel bug related to waitpid(9) and ptraced processes. This is now visible thanks to recent make(1) changes. guenther@ suggests to look at the logic behind `p_orphan' in FreeBSD to fix this bug.
2020-01-29Remove dead prototypes.jsing1-10/+1
2020-01-29If the TLSv1.3 code has not recorded an error and something already existsjsing3-3/+9
on the error stack, refrain from pushing an 'unknown' error on the stack. This should allow libcrypto errors (including bio) to be visible, where we have nothing better to offer. ok tb@
2020-01-29Remove unused stub implementation of tls13_accept(). The correcttb1-11/+1
and used version is in tls13_server.c. ok inoguchi jsing
2020-01-27Some of the test vectors that were added in the upstream committb1-7/+9
4672ff74d68766e7785c2cac4c597effccef2c5c have a zero byte prepended. Run the secp224k1 ECDH tests and adjust this if needed.
2020-01-26revert previous nc loop refactor from 1.211, breaks bluhm's stuffbeck1-64/+36
will attempt again later, now that there is new regress
2020-01-26Fix SSL_CIPHER_descriptioninoguchi1-2/+2
ok jsing@
2020-01-26Restrict to use up to TLSv1.2 for test_server_client in appstest.shinoguchi1-7/+7
Currently, only s_client has TLSv1.3 and s_server does not.
2020-01-26Avoid 32 bit right shift with unsigned int in crypto/cast/cast_lcl.hinoguchi1-2/+2
ok tb@
2020-01-26tweak previous; ok tbjmc1-3/+3
2020-01-26typotb1-2/+2
2020-01-26Document the change in EVP_chacha20(3).tb1-3/+5
Discussed with jsing
2020-01-26Improve the comment explaining why the previous change matches OpenSSL'stb1-8/+15
behavior. ok jsing
2020-01-26When an SSL method is set, bump the max version back to that of thejsing1-1/+10
incoming method if it is a client. This addresses the case where TLS_method() is used to initialise a SSL_CTX, then a TLS_client_method() is then set, resulting in TLSv1.2 being used instead of TLSv1.3. This is observable in smtpd. ok beck@
2020-01-26When switching back to a legacy client or server, ensure we reset thejsing2-2/+4
handshake function pointer. Fixes an isssue found by jca@ with OpenVPN. ok beck@ tb@
2020-01-26Fix basement bug where record layer would not correctly deal withbeck1-1/+4
traffic retries when not yet encrypting. ok jsing@
2020-01-26Add server side support for requesting client certificates in tls 1.3beck1-4/+173
ok jsing@
2020-01-26Add client certificate support for tls 1.3beck2-15/+149
ok jsing@
2020-01-26Add back the tests that were deleted in previous but not containedtb1-1/+9
in OpenSSL's test suite.
2020-01-26Add sigalgs for server side to enable client certificate processingbeck1-5/+34
in tls 1.3 Will be used in a follow on commit to enable tls1.3 client certificates ok jsing@
2020-01-26server sigalgs test is now bogus, disable for nowbeck1-2/+3
2020-01-26Adjust tests to match the change in EVP_chacha20().tb2-11/+22
Test vectors taken from OpenSSL 1.1.1d (under OpenSSL's old license).
2020-01-26Move pad and verify context into tls13_lib.cbeck4-68/+60
ok jsing@
2020-01-26Adjust EVP_chacha20()'s behavior to match OpenSSL's semantics:tb1-7/+14
The new IV is 128 bit long and is actually the 64 bit counter followed by 64 the bit initialization vector. This is needed by an upcoming change in OpenSSH and is a breaking change for all current callers. There are language bindings for Node.js, Rust and Erlang, but none of our ports use them. Note that EVP_chacha20() was first introduced in LibreSSL on May 1, 2014 while the entirely incompatible version in OpenSSL was committed on Dec 9, 2015. Initial diff from djm and myself, further refinements by djm. Ports grepping by sthen ok jsing
2020-01-25Add an underbar for consistency.tb1-2/+2
2020-01-25Disable cert interop tests for now.jsing1-2/+2
The libressl TLSv1.3 client and server currently lack client certificate authentication support and this test expects all clients can auth with all servers. We can likely turn this back on in the near future.
2020-01-25Actually disable cipher interop tests.jsing1-3/+3
2020-01-25Disable the cipher interop tests.jsing1-3/+4
These make far too many assumptions about cipher suites - TLSv1.3 cipher suites can only be used with TLSv1.3 and there is tests using TLSv1.3 cipher suites with TLSv1.2 will not work. Likewise, expecting TLSv1.2 cipher suites to work with TLSv1.3 is futile. Additionally, eopenssl11 lists TLSv1.3 cipher suites with different names to libressl. Futher work will be necessary before this can be re-enabled.
2020-01-25Accept both TLSv1.2 and TLSv1.3 protocols for netcat.jsing1-4/+3
This can potentially be improved by adding knowledge about which libraries support which versions and handle differences between clients and servers.
2020-01-25Disable session regress for libressl client talking to openssl11 server.jsing1-1/+2
This is now talking over TLSv1.3 and needs session support.
2020-01-25Revert change to certificate request check from r1.45.jsing1-3/+3
This code was correct, it was the entry in the table that was incorrect. ok beck@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-28 20:59:16 +0000