summaryrefslogtreecommitdiff
path: root/src/lib/libssl/s3_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add missing pointer invalidationlibressl-v3.6.3OPENBSD_7_2tb2023-05-261-1/+2
| | | | | | | ok tb from jcs This is errata/7.2/026_ssl.patch.sig
* Wire up SSL_QUIC_METHOD callbacks to the record layer callbacks for QUIC.jsing2022-08-211-1/+8
| | | | ok tb@
* Implement the SSL_CTRL_GET_SHARED_GROUP controltb2022-08-171-1/+37
| | | | | | | | | | | | | | | | | | | | | | | This implements SSL_get_shared_{curve,group}() in a bug-compatible fashion with OpenSSL. This is your average OpenSSL-style overloaded parameter API where n >= 0 means "return the n-th shared group's NID" (as if anyone possibly ever cared about the case n > 0) and n == -1 means "return the number of shared groups". There is also an undocumented case n == -2 for Suite B profile support which falls back to n == 0 in case Suite B profile support is disabled, so n == -2 is the same as n == 0 in LibreSSL. The API also returns 0 for error, which is indistinguishable from a count of 0 shared groups but coincides with NID_undef. Contrary to claims in the documentation, the API doesn't actually return -1 for clients, rather it returns 0. Obviously this entire exercise is pretty useless, but since somebody exposed it because they could and someone else used it because they could we need to provide it. ok jsing
* Deduplicate peer certificate chain processing code.jsing2022-08-171-4/+11
| | | | | | | | | | | | | | Rather than reimplement this in each TLS client and server, deduplicate it into a single function. Furthermore, rather than dealing with the API hazard that is SSL_get_peer_cert_chain() in this code, simply produce two chains - one that has the leaf and one that does not. SSL_get_peer_cert_chain() can then return the appropriate one. This also moves the peer cert chain from the SSL_SESSION to the SSL_HANDSHAKE, which makes more sense since it is not available on resumption. ok tb@
* Stop using ssl{_ctx,}_security() outside of ssl_seclevel.ctb2022-07-021-3/+2
| | | | | | | | | The API is ugly and we can easily abstract it away. The SSL_SECOP_* stuff is now confined into ssl_seclevel.c and the rest of the library can make use of the more straightforward wrappers, which makes it a lot easier on the eyes. ok beck jsing
* Rename uses 'curve' to 'group' and rework tls1 group API.tb2022-07-021-3/+3
| | | | | | | | | | This reworks various tls1_ curve APIs to indicate success via a boolean return value and move the output to an out parameter. This makes the caller code easier and more consistent. Based on a suggestion by jsing ok jsing
* Make ssl_cert_add{0,1}_chain_cert() take ssl/ctxtb2022-06-291-5/+5
| | | | ok beck jsing
* ssl_cert_set{0,1}_chain() take ssl/ctxtb2022-06-291-7/+7
| | | | ok beck jsing
* Add support for sending QUIC transport parametersbeck2022-06-291-1/+9
| | | | | | | | | | This is the start of adding the boringssl API for QUIC support, and the TLS extensions necessary to send and receive QUIC transport data. Inspired by boringssl's https://boringssl-review.googlesource.com/24464 ok jsing@ tb@
* Also check the security level when choosing a shared ciphertb2022-06-291-1/+5
| | | | ok beck jsing
* Also check the security level of the 'tmp dh'tb2022-06-291-1/+11
| | | | ok beck jsing
* Clean up and simplify ssl3_renegotiate{,_check}()jsing2022-03-171-22/+15
| | | | ok inoguchi@ tb@
* Switch TLSv1.3 cipher names from AEAD- to OpenSSL's TLS_tb2022-02-051-4/+4
| | | | | | | | | | | | | | | | | | OpenSSL chose to break the previous naming convention for ciphers and to adopt TLS_* "RFC" names instead. Unfortunately, these names are exposed in several APIs and some language bindings test for these non-standard names instead of cipher values, which is ... unfortunate (others would say "plain crazy"). We currently have to maintain patches in regress and ports (p5-Net-SSLeay, openssl-ruby-tests - which means that Ruby will pick this up at some point) to work around this difference and that's just not worth the effort. The old AEAD- names will become aliases and continue to work, but in openssl ciphers and netcat output the TLS_* names will now be displayed. "I would be very happy if this gets committed" bluhm ok beck inoguchi, begrudgingly ok jsing
* Bye bye S3I.jsing2022-02-051-76/+67
| | | | | | | | S3I has served us well, however now that libssl is fully opaque it is time to say goodbye. Aside from removing the calloc/free/memset, the rest is mechanical sed. ok inoguchi@ tb@
* whitespacetb2022-01-261-4/+4
|
* Rename CERT to SSL_CERT and CERT_PKEY to SSL_CERT_PKEY.jsing2022-01-081-2/+2
| | | | | | | Nearly all structs in libssl start with an SSL_ suffix, rename CERT and CERT_PKEY for consistency. ok inoguchi@ tb@
* Rename dh_tmp to dhe_params.jsing2022-01-071-13/+18
| | | | | | | | Support for non-ephemeral DH was removed a long time ago - as such, the dh_tmp and dh_tmp_cb are used for DHE parameters. Rename them to reflect reality. ok inoguchi@ tb@
* Convert legacy server to tls_key_share.jsing2022-01-071-13/+1
| | | | | | | | | | | This requires a few more additions to the DHE key share code - we need to be able to either set the DHE parameters or specify the number of key bits for use with auto DHE parameters. Additionally, we need to be able to serialise the DHE parameters to send to the client. This removes the infamous 'tmp' struct from ssl3_state_internal_st. ok inoguchi@ tb@
* Convert legacy TLS client to tls_key_share.jsing2022-01-061-23/+5
| | | | | | | | | This requires adding DHE support to tls_key_share. In doing so, tls_key_share_peer_public() has to lose the group argument and gains an invalid_key argument. The one place that actually needs the group check is tlsext_keyshare_client_parse(), so add code to do this. ok inoguchi@ tb@
* Rename tls13_key_share to tls_key_share.jsing2022-01-051-6/+7
| | | | | | | | | In preparation to use the key share code in both the TLSv1.3 and legacy stacks, rename tls13_key_share to tls_key_share, moving it into the shared handshake struct. Further changes will then allow the legacy stack to make use of the same code for ephemeral key exchange. ok inoguchi@ tb@
* Do not take the strlen() of a NULL name. Defer the CBS_init() to later.tb2021-11-021-3/+3
| | | | | | Found the hard way by sthen. ok sthen
* Ensure SSL_set_tlsext_host_name() is given a valid hostname.jsing2021-11-011-3/+8
| | | | ok inoguchi@ tb@
* Fold SSL_SESSION_INTERNAL back into SSL_SESSION.jsing2021-10-251-3/+3
| | | | ok beck@ tb@
* Don't leak internal->verfied_chain, clean it up in ssl3_clear and free.beck2021-10-241-1/+4
| | | | spotted by and ok jsing@
* Prepare to provide SSL_get_tlsext_status_type()tb2021-09-081-1/+10
| | | | | | Needed for nginx-lua to build with opaque SSL. ok inoguchi jsing
* Dedup dtls1_dispatch_alert()/ssl3_dispatch_alert().jsing2021-07-261-2/+2
| | | | | | | | The code for dtls1_dispatch_alert() and ssl3_dispatch_alert() is largely identical - with a bit of reshuffling we can use ssl3_dispatch_alert() for both protocols and remove the ssl_dispatch_alert function pointer. ok inoguchi@ tb@
* Do a first pass clean up of SSL_METHOD.jsing2021-07-031-46/+1
| | | | | | | | | The num_ciphers, get_cipher_by_char and put_cipher_by_char function pointers use the same function for all methods - call ssl3_num_ciphers() directly, absorb ssl3_get_cipher_by_char() into SSL_CIPHER_find() and remove the unused ssl3_put_cipher_by_char() code. ok inoguchi@ tb@
* Merge SSL_METHOD_INTERNAL into SSL_METHOD.jsing2021-07-011-9/+10
| | | | | | | Now that SSL_METHOD is opaque and in internal headers, we can remove SSL_METHOD_INTERNAL by merging it back into SSL_METHOD. ok tb@
* Prepare to provide SSL_get_signature_nid() and friends.jsing2021-06-301-1/+66
| | | | | | | | | | | This adds functionality for SSL_get_signature_nid(), SSL_get_peer_signature_nid(), SSL_get_signature_type_nid() and SSL_get_peer_signature_type_nid(). This is not currently publicly visible and will be exposed at a later date. ok inoguchi@ tb@
* Move DTLS structs/definitions/prototypes to dtls_locl.h.jsing2021-05-161-2/+3
| | | | | | | | Now that the DTLS structs are opaque, add a dtls_locl.h header and move internal-only structs from dtls1.h, along with prototypes from ssl_locl.h. Only pull this header in where DTLS code actually exists. ok inoguchi@ tb@
* Explicitly include <openssl/opensslconf.h> in files using OPENSSL_NO_*jsing2021-05-161-1/+2
| | | | | | Where a file references to OPENSSL_NO_* conditions, ensure that we explicitly include <openssl/opensslconf.h> before any references, rather than relying on another header to pull this in.
* Clean up TLSv1.2 certificate request handshake data.jsing2021-04-211-3/+3
| | | | | | | | | | Currently cert_req is used by clients and cert_request is used by servers. Replace this by a single cert_request used by either client or server. Remove the certificate types as they are currently unused. This also fixes a bug whereby if the number of certificate types exceeds SSL3_CT_NUMBER the number of bytes read in is insufficient, which will break decoding. ok inoguchi@ tb@
* Set alpn_selected_len to zero when freeing alpn_selected.jsing2021-04-191-1/+2
| | | | | | | This is not strictly necessary since we proceed to zero the entire struct, however it keeps the code consistent and easily auditable. ok tb@
* Rename new_cipher to cipher.jsing2021-03-241-2/+2
| | | | | | | | This is in the SSL_HANDSHAKE struct and is what we're currently negotiating, so there is really nothing more "new" about the cipher than there is the key block or other parts of the handshake data. ok inoguchi@ tb@
* Move the TLSv1.3 handshake struct inside the shared handshake struct.jsing2021-03-211-15/+15
| | | | | | | | | | | | | | | | There are currently three different handshake structs that are in use - the SSL_HANDSHAKE struct (as S3I(s)->hs), the SSL_HANDSHAKE_TLS13 struct (as S3I(s)->hs_tls13 or ctx->hs in the TLSv1.3 code) and the infamous 'tmp' embedded in SSL3_STATE_INTERNAL (as S3I(s)->tmp)). This is the first step towards cleaning up the handshake structs so that shared data is in the SSL_HANDSHAKE struct, with sub-structs for TLSv1.2 and TLSv1.3 specific information. Place SSL_HANDSHAKE_TLS13 inside SSL_HANDSHAKE and change ctx->hs to refer to the SSL_HANDSHAKE struct instead of the SSL_HANDSHAKE_TLS13 struct. This allows the TLSv1.3 code to access the shared handshake data without needing the SSL struct. ok inoguchi@ tb@
* Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md().jsing2021-02-071-15/+1
| | | | | | | | The mess that is ssl_get_algorithm2() only exists to upgrade the handshake MAC of a pre-TLSv1.2 cipher suite to SHA256 when used with TLSv1.2. We can readily do this in ssl_get_handshake_evp_md(), which is far more readable. ok tb@
* Correct handshake MAC/PRF for various TLSv1.2 cipher suites.jsing2021-02-071-8/+8
| | | | | | | | For some reason various TLSv1.2 cipher suites were added with the default handshake MAC and PRF, rather than the SHA256 handshake MAC and PRF. This gets patched up in ssl3_get_algorithm2(), hence goes unnoticed. ok tb@
* Rewrap a comment line to fit into 80 columns.tb2021-01-261-3/+3
|
* Replace SSL_IS_DTLS with SSL_is_dtls().jsing2020-10-141-5/+5
| | | | | | Garbage collect the now unused SSL_IS_DTLS macro. ok tb@
* SSL3_ENC_METHOD is just a flag word; merge it into SSL_METHOD_INTERNALguenther2020-10-111-2/+2
| | | | | | | with #defines for the per-version initializers instead of extern globals. Add SSL_USE_SHA256_PRF() to complete the abstraction. ok tb@ jsing@
* Constipate ssl3_ciphers and tls1[23]_sigalgs*, pushing them intoguenther2020-10-111-2/+2
| | | | | | .data.rel.ro and .rodata respectively. ok tb@ jsing@
* Prepare to provide SSL_get_peer_tmp_key().jsing2020-09-171-8/+9
| | | | | | | | OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@
* Move state initialisation from SSL_clear() to ssl3_clear().jsing2020-09-141-1/+3
| | | | | | | | | | | | | | | | | | | | | | If we use the default method (now TLSv1.3) and end up talking to a TLSv1.2 server that gives us a session ticket, then try to resume that session, we end up trying to talk TLS without doing a handshake. This is caused by the state (S3I(s)->hs.state) getting cleared, which results in SSL_do_handshake() and others thinking they do not need to do anything (as SSL_in_init() and SSL_in_before() are not true). The reason this occurs is due to SSL_set_ssl_method() calling ssl_free() and ssl_new() when switching methods. The end result is that the S3I(s) has been freed and reallocated, losing the state in the process. Since the state is part of the S3I(s) structure, move its initialisation into ssl3_clear() - this ensures it gets correctly reinitialised across a SSL_set_ssl_method() call. Issue noticed by sthen@ with nginx and unifi. ok beck@ tb@
* Implement a rolling hash of the ClientHello message, Enforce RFC 8446beck2020-06-061-1/+3
| | | | | | | | section 4.1.2 to ensure subsequent ClientHello messages after a HelloRetryRequest messages must be unchanged from the initial ClientHello. ok tb@ jsing@
* Use IANA allocated GOST ClientCertificateTypes.jsing2020-06-051-1/+5
| | | | | | | | | | | IANA has allocated numbers for GOST ClientCertificateType. Use them in addition to private values (left in place for compatibility). Diff from Dmitry Baryshkov <dbaryshkov@gmail.com> Sponsored by ROSA Linux ok inoguchi@ tb@
* Stop sending GOST R 34.10-94 as a CertificateType.jsing2020-06-051-3/+1
| | | | | | | | | | | | GOST R 34.10-94 is an obsolete certificate type, unsupported by LibreSSL and by the rest of current software, so there is no point in sending in the CertificateTypes. Diff from Dmitry Baryshkov <dbaryshkov@gmail.com> Sponsored by ROSA Linux ok inoguchi@ tb@
* Use size_t for OCSP response length.jsing2020-05-101-4/+18
| | | | | | | | | The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@
* Expose the peer ephemeral public key used for TLSv1.3 key exchange.jsing2020-04-181-32/+16
| | | | | | | | | SSL_get_server_tmp_key() provides the peer ephemeral public key used for key exchange. In the case of TLSv1.3 this is essentially the peer public key from the key share used for TLSv1.3 key exchange, hence make it availaable via SSL_get_server_tmp_key(). ok inoguchi@ tb@
* Avoid leak for tmp.x25519inoguchi2020-02-161-1/+4
| | | | | | | | | | Changed to use local variable to hold malloc address rather than directly set to S3I(s)->tmp.x25519, and set that private_key pointer to S3I(s)->tmp.x25519 after all the "goto err;". Also added freezero for S3I(s)->tmp.x25519 to ssl3_free() and ssl3_clear(). ok jsing@ tb@
* Provide struct/functions for handling TLSv1.3 key shares.jsing2020-01-301-14/+6
| | | | | | | Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-17 21:25:12 +0000