summaryrefslogtreecommitdiff
path: root/src/lib/libc/string/wcscpy.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-05-09Add a middlebox_compat flag and condition session ID randomisation on it.jsing3-4/+7
ok tb@
2020-05-09catch the other place this needs to changebeck1-2/+2
2020-05-09now that 3.1.1 is out the door as a stable release bump the developmentbeck1-2/+2
version to 3.2.0
2020-05-09Add support for certificate status requests in TLS 1.3 clientbeck4-12/+81
ok jsing@, tb@, inoguchi@
2020-05-09Make the test for the legacy_compression_method vector in the ClientHellotb1-12/+7
stricter. Previously, we would accept any vector if it advertised the "null" compression method. RFC 8446 4.1.2 specifies that the only legal vector has length one and contains a zero byte for the null method. ok jsing
2020-05-09Drop a redundant test. It's effectively doing the same test twicetb1-3/+2
and if the two lengths differed, the later CBS_write_bytes() would correctly fail anyway. Discussed with jsing
2020-05-09On receiving an overlong session ID terminate with an illegal_parametertb1-1/+6
alert. Found with tlsfuzzer. ok jsing
2020-05-09Add support for HelloRetryRequests in the TLSv1.3 server.jsing2-10/+73
ok inoguchi@ tb@
2020-05-09crazy whitespace on one linetb1-2/+2
2020-05-09Pull the sending of alerts up into tls13_handshake_perform().jsing1-14/+11
This fixes the case where a send function signals that an alert should be sent, then returns failure. Previously the failure would be propagated up, without the alert being sent. Issued noted by tb@ ok tb@
2020-05-09Refactor tls13_server_hello_sent().jsing1-30/+36
Split the record protection engagement code into a separate tls13_server_engage_record_protection() function and call this from tls13_server_hello_sent(). Also move some functions around to keep the logical ordering/grouping. ok inoguchi@ tb@ (as part of a larger diff)
2020-05-07On receiving a handshake or alert record with empty inner plaintext,tb1-1/+11
terminate the connection with an unexpected_message alert. See RFC 8446 section 5.4. Found with tlsfuzzer hint/ok jsing
2020-05-06Bump LibreSSL version to 3.1.1tb1-3/+3
ok bcook inoguchi deraadt
2020-05-04Use a larger (2048 bit) RSA test key.jsing1-1/+63
Otherwise we fail to do PSS signatures since the key size is too small.
2020-05-04Fix out-of-bounds access in tables[][] that was exposed in bluhm'stb1-6/+8
regress on i386 after inoguchi moved some symbols to const. ok inoguchi jsing deraadt
2020-05-03Accept two ChangeCipherSpec messages during a TLSv1.3 handshake.jsing1-3/+3
In compatibility mode, a TLSv1.3 server MUST send a dummy CCS message immediately after its first handshake message. This is normally after the ServerHello message, but it can be after the HelloRetryRequest message. As such we accept one CCS message from the server during the handshake. However, it turns out that in the HelloRetryRequest case, Facebook's fizz TLSv1.3 stack sends CCS messages after both the HelloRetryRequest message and the ServerHello message. This is unexpected and as far as I'm aware, no other TLSv1.3 implementation does this. Unfortunately the RFC is rather ambiguous here, which probably means it is not strictly an RFC violation. Relax the CCS message handling to allow two dummy CCS messages during a TLSv1.3. This makes our TLSv1.3 client work with Facebook Fizz when HRR is triggered. Issue discovered by inoguchi@ and investigated by tb@. ok deraadt@ tb@
2020-05-02Add const to TLS1.3 internal vectorsinoguchi2-14/+14
ok tb@
2020-04-30Disallow setting the AES-GCM IV length to 0tb1-1/+5
It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)
2020-04-29tls13_record_layer internal functions to static in libsslinoguchi1-4/+4
We might remove static again for further regress around record layer in the future. ok jsing@ tb@
2020-04-29tls13_handshake internal functions to static in libsslinoguchi1-11/+12
ok jsing@ tb@
2020-04-28Move legacy stack interfacing functions into tls13_legacy.c.jsing4-199/+206
No functional change. ok inoguchi@ tb@
2020-04-28Rename tls13_client_synthetic_handshake_message() and move to tls13_lib.c.jsing3-47/+48
The server-side will need to use the same function. No functional change. ok inoguchi@ tb@
2020-04-27Shuffle some functions around.jsing2-329/+328
Move functions so that they are in the order that the TLSv1.3 messages are processed. While here, also move tls13_client_end_of_early_data_send() from tls13_client.c to tls13_server.c. No functional change. ok beck@ tb@
2020-04-27Fix two bugs in the AES-CBC-PKCS5 tests that didn't hide failing tests:tb1-3/+3
1. Use the correct slice for comparing the cipher output 2. Fix logic error similar to the one in AES-GCM in the previous commit
2020-04-27Fix a logic error that hid the failing ZeroLengthIv tests.tb1-3/+3
This issue was fixed in lib/libcrypto/evp/e_aes.c r1.40.
2020-04-27Disallow the use of zero length IVs in AES-GCM viatb3-3/+15
EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen.
2020-04-26Minimal maintenance to make this mess slightly less confusing:schwarze1-10/+10
queue -> list; mention "intrusive"; element -> member at one place; delete a bogus remark that maybe referred to a long-gone implementation in VAX assembly code. Much more could be improved, but i don't want to waste too much time here.
2020-04-26fix the description; from andras farkasjmc1-5/+4
ok schwarze kill a Tn while here...
2020-04-26Display TLSv1.3 extension type with openssl(1) -tlsextdebuginoguchi1-7/+49
Add TLSv1.3 extension type, and sort by the definition order in tls1.h. This helps that openssl(1) s_server and s_client with -tlsextdebug displays the TLS extension type instead of "unknown". ok beck@ jsing@ tb@
2020-04-26s_client: fix use of possibly uninitialized valuesinoguchi1-2/+2
Set initial value to variable 'p' and 'pending'. Reported and fix requested from leonklingele by GitHub pull request. https://github.com/libressl-portable/portable/issues/577 https://github.com/libressl-portable/openbsd/pull/114 ok bcook@ jsing@ tb@
2020-04-25A comma is not appropriate here, use a semicolonjca1-2/+2
Suggested by Evan Silberman, confirmed by jmc@
2020-04-25In s_server.c rev. 1.33, jsing added support for "openssl s_server -groups";schwarze1-6/+18
document it and deprecate "openssl s_server -named_curve". While here, fix the error in the synopsis for "openssl s_client -groups" and use unified argument naming and similar wording like in SSL_CTX_set1_groups_list(3). OK jsing@
2020-04-25Switch to NEGOTIATED when using WITHOUT_HRR.jsing1-4/+9
This ensures that we remain in a valid handshake state in the TLSv1.3 server. Ideally we would not switch to NEGOTIATED until after record protection has been enabled, but we'll revisit this later. Issue noted by inoguchi@ ok tb@
2020-04-25Discourage use of RES_USE_INET6jca1-1/+5
Suggested by eric@, input from deraadt@, ok deraadt@ eric@
2020-04-25Fix RES_USE_INET6 descriptionjca1-7/+9
The previous wording implied this option does nothing, which is wrong. This option does affect the way gethostbyname(3) works on OpenBSD (return IPv6 addresses if available). On some systems, it also introduces IPv4-mapped IPv6 addresses, a "feature" that we don't support. ok deraadt@ eric@
2020-04-25Move unsupported, obsolete ciphers and deprecated aliases out ofschwarze1-31/+29
the main list of words to make it more readable, even though it remains long. Avoid using deprecated aliases in explanations what other words mean. Stop documenting aDSS because it is *both* a deprecated alias *and* no longer matches anything at all. General direction discussed with jsing@ some time ago.
2020-04-25tweak the wording to make it clearer under which conditions exactlyschwarze1-4/+4
the TLSv1.3 cipher suites are made available, too; related to ssl_ciph.c rev. 1.115
2020-04-22Revise regress to match state transition changes.jsing1-11/+13
2020-04-22Improve TLSv1.3 state machine for HelloRetryRequest handling.jsing5-66/+104
The state machine currently handles the HelloRetryRequest case by using WITH_HRR - in other words, we're explicitly indicating when we transition to the alternate path. The problem here is that we do not know if we're going to receive a ServerHello or a HelloRetryRequest until we process the message. This means that the ServerHello processing code has to handle both types of messages. The state machine and associated processing code becomes cleaner if we flip this around so that we assume we are going to receive a HelloRetryRequest and upon discovering that it is not, trigger WITHOUT_HRR and hand off to the ServerHello processing function. In particular, this makes the logic much more straight forward on the server side, when adding support for HRR. With feedback from tb@ ok tb@
2020-04-21Handle TLSv1.3 key shares other than X25519 on the server side.jsing2-16/+34
Previously we would only select an X25519 key share from the client, ignoring any others. Change this so that we will select the first of the key shares that matches one of our supported groups. ok beck@ inoguchi@ tb@
2020-04-21Consolidate TLSv1.3 constants.jsing3-40/+47
Move all of the TLSv1.3 constants to the top of tls13_lib.c. Also mark these all as const so that they end up in .rodata rather than .data. ok tb@
2020-04-19Add -groups option to openssl(1) s_server.jsing2-35/+31
This allows supported EC groups to be configured, which will also control which TLSv1.3 key shares we'll accept. While here, deprecate the rather useless -named_curve option, which is effectively the same as -groups with a single group. Also stop setting a single default group of P-256 via SSL_CTX_set_tmp_ecdh() - use the library defaults instead. ok beck@ inoguchi@
2020-04-19Provide TLSv1.3 cipher suite aliases to match the names used in RFC 8446.jsing1-2/+25
ok beck@ inoguchi@ tb@
2020-04-18Fix wrapping/indentation.jsing1-4/+3
2020-04-18Expose the peer ephemeral public key used for TLSv1.3 key exchange.jsing5-36/+79
SSL_get_server_tmp_key() provides the peer ephemeral public key used for key exchange. In the case of TLSv1.3 this is essentially the peer public key from the key share used for TLSv1.3 key exchange, hence make it availaable via SSL_get_server_tmp_key(). ok inoguchi@ tb@
2020-04-18Tweak previous active cipher suite code.jsing1-6/+5
Use a boolean value rather than using a counter, as suggested by tb@ during the previous review. ok tb@
2020-04-18Allow more key share groups for TLSv1.3.jsing1-21/+12
The key share code previously only allowed for key shares to be generated using one of the groups in our default list (X25519, secp256r1, secp384r1). Relax this and allow key shares using any of the groups in our NID list. ok inoguchi@ tb@
2020-04-17Only include TLSv1.3 cipher suites if there are active cipher suites.jsing1-2/+10
Revise the previous so that we only include TLSv1.3 cipher suites if the cipher rule string resulted in at least one active cipher suite. This more closely matches OpenSSL behaviour. Noted and fix tested by schwarze@ ok beck@ tb@
2020-04-17Update key share regress to match previous change.jsing1-4/+4
2020-04-17Generate client key share using our preferred group.jsing4-25/+37
Generate a client key share using our preferred group, rather than always using X25519. This means that the key share group can be controlled via SSL{_CTX,}_set1_groups() and SSL{_CTX,}_set1_groups_list(). ok beck@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-20 23:06:25 +0000