summaryrefslogtreecommitdiff
path: root/src/lib/libssl/d1_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Replace DTLS r_epoch with the read epoch from the TLSv1.2 record layer.jsing2021-08-301-5/+3
| | | | ok inoguchi@ tb@
* Remove DTLS processed_rcds queue.jsing2021-07-211-9/+1
| | | | | | | | | | | | | | | | | | | When DTLS handshake records are received from the next epoch, we will potentially queue them on the unprocessed_rcds queue - this is usually a Finished message that has been received without the ChangeCipherSuite (CCS) message (which may have been dropped or reordered). After the epoch increments (due to the CCS being received), the current code processes all records on the unprocessed queue and immediate queues them on the processed queue, which dtls1_get_record() then pulls from. This form of processing only adds more complexity and another queue. Instead, once the epoch increments, pull a single record from the unprocessed queue and process it, allowing the contents to be consumed by the caller. We repeat this process until the unprocessed queue is empty, at which point we go back to consuming messages from the wire. ok inoguchi@ tb@
* Merge SSL_METHOD_INTERNAL into SSL_METHOD.jsing2021-07-011-2/+2
| | | | | | | Now that SSL_METHOD is opaque and in internal headers, we can remove SSL_METHOD_INTERNAL by merging it back into SSL_METHOD. ok tb@
* Provide the ability to set the initial DTLS epoch value.jsing2021-06-191-1/+4
| | | | | | This allows for regress to test edge cases for epoch handling. ok tb@
* Initialise the epoch for the DTLS processed and unprocessed queues.jsing2021-06-191-1/+4
| | | | | | | | Currently these only get correctly initialised when dtls1_process_buffered_records() is called - while this works it is more accidental than intentional. ok tb@
* Move DTLS structs/definitions/prototypes to dtls_locl.h.jsing2021-05-161-1/+2
| | | | | | | | Now that the DTLS structs are opaque, add a dtls_locl.h header and move internal-only structs from dtls1.h, along with prototypes from ssl_locl.h. Only pull this header in where DTLS code actually exists. ok inoguchi@ tb@
* Clean up/simplify dtls1_get_cipher().jsing2021-02-201-7/+8
| | | | ok tb@
* Mop up unused dtls1_build_sequence_number() function.jsing2021-01-211-22/+1
|
* Use TLSv1_1_enc_data instead of DTLSv1_enc_data.jsing2020-10-031-5/+1
| | | | | | | | DTLSv1 is TLSv1.1 over datagrams - there is no need for a separate SSL3_ENC_METHOD struct, just use TLSv1_1_enc_data and remove DTLSv1_enc_data entirely. ok tb@
* Call dtls1_hm_fragment_free() from dtls1_drain_fragments()jsing2020-09-261-5/+4
| | | | | | | | Currently dtls1_drain_fragments() has a incomplete handrolled version of dtls1_hm_fragment_free(), which has the potential to leak memory. Replace the handrolled free with a call to dtls1_hm_fragment_free(). ok inoguchi@ tb@
* Have dtls1_new() call dtls1_free() on failure.jsing2020-09-261-36/+22
| | | | | | | | Allocate into the appropriate structures and call dtls1_free() on failure, rather than allocating into local variables and then remembering to free various things on failure. ok tb@
* Refactor dtls1_clear_queues()tb2020-09-261-25/+26
| | | | | | | | | | An upcoming cleanup diff by jsing needs dtls1_clear_queues() to be able to handle NULL pqueues. While one can easily add a NULL check to pqueue_pop(), this does not really fit in with the rest of the code. There are two kinds of while loops in dtls1_clear_queues that drain pqueues, so add two helper functions with a NULL check each. ok jsing
* Release read and write buffers using freezero().jsing2020-09-241-4/+4
| | | | | | | | | Provide a ssl3_release_buffer() function that correctly frees a buffer and call it from the appropriate locations. While here also change ssl3_release_{read,write}_buffer() to void since they cannot fail and no callers check the return value currently. ok beck@ inoguchi@ tb@
* Remove some unnecessary function pointers from SSL_METHOD_INTERNAL.jsing2020-07-071-9/+1
| | | | | | ssl_version is completely unused and get_timeout is the same everywhere. ok beck@ inoguchi@ tb@
* Use internal versions of SSL3_BUFFER, SSL3_RECORD and DTLS1_RECORD_DATA.jsing2020-03-121-5/+5
| | | | | | | | | SSL3_BUFFER, SSL3_RECORD and DTLS1_RECORD_DATA are currently still in public headers, even though their usage is internal. This moves to using _INTERNAL suffixed versions that are in internal headers, which then allows us to change them without any potential public API fallout. ok inoguchi@ tb@
* Remove the enc function pointers.jsing2020-03-101-2/+1
| | | | | | | The enc function pointers do not serve any purpose these days - remove a layer of indirection and call dtls1_enc()/tls1_enc() directly. ok inoguchi@ tb@
* Convert dtls1_build_sequence_number() to CBB.jsing2020-02-211-7/+15
| | | | ok inoguchi@ tb@
* Use freezero() for the internal opaque structures, instead of the currentjsing2017-04-101-6/+3
| | | | explicit_bzero()/free(). Less code and potentially less overhead.
* Change SSLerror() back to taking two args, with the first one being an SSL *.beck2017-02-071-2/+2
| | | | | | | | | Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible
* Send the error function codes to rot in the depths of hell where they belongbeck2017-01-261-2/+2
| | | | | | | We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
* Remove most of SSL3_ENC_METHOD - we can just inline the function callsjsing2017-01-261-14/+1
| | | | | | and defines since they are the same everywhere. ok beck@
* Change the SSL_IS_DTLS() macro to check the version, rather than using ajsing2017-01-251-2/+2
| | | | | | | flag in the encryption methods. We can do this since there is currently only one DTLS version. This makes upcoming changes easier. ok beck@
* Split most of SSL_METHOD out into an internal variant, which is opaque.jsing2017-01-231-2/+2
| | | | Discussed with beck@
* Move most of DTLS1_STATE to internal.beck2017-01-221-42/+42
| | | | ok jsing@
* Convert publically visible structs to translucent structs.jsing2017-01-221-4/+17
| | | | | | | | | | | | | This change adds an internal opaque struct for each of the significant publically visible structs. The opaque struct is then allocated and attached to the publically visible struct when the appropriate *_new() function is called, then cleared and freed as necessary. This will allow for changes to be made to the internals of libssl, without requiring a major bump each time the publically visible structs are modified. ok beck@
* Mark a couple local functions as staticguenther2016-11-041-2/+2
| | | | ok jsing@ beck@
* remove NULL checks for pqueue_free()mmcc2016-02-291-11/+6
| | | | ok doug@
* include <sys/time.h> for gettimeofday(2)bcook2015-10-071-1/+2
|
* Remove support for DTLS_BAD_VER. We do not support non-standard andjsing2015-09-101-5/+3
| | | | | | | incomplete implementations just so that we can interoperate with products from vendors who have not bothered to fix things in the last ~10 years. ok bcook@ miod@
* Correct spelling of OPENSSL_cleanse.jsing2015-09-101-2/+2
| | | | ok miod@
* Allow *_free() functions in libssl to handle NULL input.doug2015-07-191-1/+4
| | | | | | This mimics free()'s behavior which makes error handling simpler. ok bcook@ miod@
* Fix several crash causing defects from OpenSSL.tedu2015-03-191-1/+4
| | | | | | | | | | | | | These include: CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp CVE-2015-0287 - ASN.1 structure reuse memory corruption CVE-2015-0289 - PKCS7 NULL pointer dereferences Several other issues did not apply or were already fixed. Refer to https://www.openssl.org/news/secadv_20150319.txt joint work with beck, doug, guenther, jsing, miod
* Jettison DTLS over SCTP.jsing2015-02-091-8/+1
| | | | | | | | OpenBSD does not have SCTP support and it sees little use in the wild. OPENSSL_NO_SCTP is already specified via opensslfeatures.h, hence this is a code removal only and symbols should remain unchanged. ok beck@ miod@ tedu@
* Remove trailing whitespace.jsing2014-12-141-4/+4
|
* Sort and group includes.jsing2014-11-161-1/+2
|
* avoid sys/param.h; Jonas Termansenderaadt2014-07-171-2/+2
|
* In dtls1_clear_queues(), free buffered_add_data.q correctly, it's made ofmiod2014-07-111-4/+4
| | | | | | DTLS1_RECORD_DATA, not hm_fragment. OpenSSL PR #3286 via OpenSSL trunk.
* remove unused, private version strings except SSL_version_strbcook2014-07-091-2/+1
| | | | | | Also remove unused des_ver.h, which exports some of these strings, but is not installed. ok miod@ tedu@
* Pull the code that builds a DTLS sequence number out into its own functionjsing2014-06-211-1/+14
| | | | | | to avoid duplication. Also use fewer magic numbers. ok miod@
* Remove support for the `opaque PRF input' extension, which draft has expiredmiod2014-06-131-1/+3
| | | | | | | | 7 years ago and never made it into an RFC. That code wasn't compiled in anyway unless one would define the actual on-the-wire extension id bytes; crank libssl major. With help and enlightenment from Brendan MacDonell.
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* Fix memory leak: free s if calloc fails.logan2014-06-111-1/+3
| | | | | | (From Jonas Maebe) OK from beck@
* Make it substantially easier to identify protocol version requirementsjsing2014-05-291-0/+1
| | | | | | | | | | | | | | by adding an enc_flags field to the ssl3_enc_method, specifying four flags that are used with this field and providing macros for evaluating these conditions. Currently the version requirements are identified by continually checking the version number and other criteria. This change also adds separate SSL3_ENC_METHOD data for TLS v1.1 and v1.2, since they have different enc_flags from TLS v1. Based on changes in OpenSSL head. No objection from miod@
* There is no point in checking if a pointer is non-NULL before calling free,jsing2014-05-281-6/+2
| | | | | | | | since free already does this for us. Also remove some pointless NULL assignments, where the result from malloc(3) is immediately assigned to the same variable. ok miod@
* repair some KNF missed by the script; ok jsingderaadt2014-05-261-6/+10
|
* Use C99 initialisers for SSL3_ENC_METHOD structs.jsing2014-05-241-12/+14
| | | | ok miod@
* Stop pulling pqueue.h into ssl_locl.h since only a small part of libssljsing2014-05-221-0/+2
| | | | | | | | | | actually needs it. Instead, just include it in the files where it is actually necessary. Also remove standard includes from pqueue.h so that they are not available as a side effect. Just add the two includes that are needed to pqueue.c. ok miod@
* gettimeofday() is portable enough and does not need a wrapperderaadt2014-04-201-9/+2
|
* calloc() rather than malloc+memsetderaadt2014-04-201-2/+2
|
* More KNF and style consistency tweaksguenther2014-04-191-2/+2
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-03 01:41:32 +0000