summaryrefslogtreecommitdiff
path: root/src/lib/libssl/s3_srvr.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove support for fixed ECDH cipher suites - these is not widely supportedjsing2016-10-191-15/+7
| | | | | | | | | and more importantly they do not provide PFS (if you want to use ECDH, use ECDHE instead). With input from guenther@. ok deraadt@ guenther@
* Check for packet with truncated DTLS cookie.guenther2016-09-221-12/+17
| | | | | | | | | | | Flip pointer comparison logic to avoid beyond-end-of-buffer pointers to make it less likely a compiler will decide to screw you. Based on parts of openssl commits 6f35f6deb5ca7daebe289f86477e061ce3ee5f46 and 89c2720298f875ac80777da2da88a64859775898 ok jsing@
* deprecate internal use of EVP_[Cipher|Encrypt|Decrypt]_Final.beck2016-05-301-2/+2
| | | | | | | 14 years ago these were changed in OpenSSL to be the same as the _ex functions. We use the _ex functions only internally to ensure it is obvious the ctx must be cleared. ok bcook@
* X509_free(3) is NULL-safe, so remove NULL checks before its calls.mmcc2016-03-111-5/+3
| | | | ok doug@
* deprecate SSL_OP_SINGLE_DH_USElibressl-v2.3.2beck2016-01-271-20/+5
| | | | ok jsing@
* Use ECDH_size() instead of rolling our own.jsing2015-09-131-6/+6
| | | | ok beck@
* The *_accept() functions increment in_handshake at the start of the function,jsing2015-09-131-16/+25
| | | | | | | | then decrement it and call a callback on exit from the function. As such, these functions should not return in the middle, otherwise in_handshake is never decremented and the callback never called. ok beck@ "with many sighs" miod@
* Remove most of the SSLv3 version checks and a few TLS v1.0.doug2015-09-121-37/+24
| | | | | | | We can now assume >= TLS v1.0 since SSL2_VERSION, SSL3_VERSION and DTLS1_BAD_VER support was removed. "reads ok" miod@
* Move handshake message header length determination into a separatejsing2015-09-121-5/+8
| | | | | | | ssl3_handshake_msg_hdr_len() function. Use this to correct several places that have magic numbers with header lengths hardcoded as '4'. ok beck@
* Convert the rest of the server handshake functions to ssl3_handshake_msg_*.jsing2015-09-121-44/+35
| | | | ok beck@
* Rename functions that moved to t1_enc.c, with a tls1_ prefix instead of ajsing2015-09-111-9/+9
| | | | | | ssl3_ prefix. ok beck@
* Remove support for DTLS_BAD_VER. We do not support non-standard andjsing2015-09-101-2/+2
| | | | | | | incomplete implementations just so that we can interoperate with products from vendors who have not bothered to fix things in the last ~10 years. ok bcook@ miod@
* Correct spelling of OPENSSL_cleanse.jsing2015-09-101-4/+4
| | | | ok miod@
* Remove the ssl_prepare_{client,server}hello_tlsext() functions, which arejsing2015-09-011-6/+1
| | | | | | now nothing more than noops. ok bcook@ doug@
* Remove SSLv3 method data structs and unlink s3_meth.c from the build.doug2015-08-291-41/+1
| | | | ok jsing@
* Remove SSLv3 support from LibreSSL.doug2015-08-271-15/+1
| | | | | | | | | | This is the first wave of SSLv3 removal which removes the main SSLv3 functions. Future commits will remove the rest of the SSLv3 support. Discussed the plan at c2k15. Input from jsing@, beck@, miod@, bcook@, sthen@, naddy@, and deraadt@. ok jsing@, beck@
* Add linker warnings in case SSLv3_{,client,server}_method are referenced.miod2015-07-291-1/+7
| | | | | | | Use of this symbols proves the existence of a code path willingly using SSLv3, even with OPENSSL_NO_SSL3 being defined, which hints that it needs fixing. Discussed with the LibreSSL cabal during c2k15; ok deraadt@
* Remove support for the SSL_OP_TLS_D5_BUG compat hack from SSLeay.doug2015-07-181-8/+4
| | | | | | | | This is a 17 year old workaround from SSLeay 0.9.0b. It was for clients that send RSA client key exchange in TLS using SSLv3 format (no length prefix). ok jsing@
* Convert ssl3_get_client_certificate to CBS.doug2015-07-141-15/+19
| | | | ok miod@ jsing@
* Convert ssl3_get_next_proto to CBS.doug2015-06-201-14/+19
| | | | tweak + ok miod@ jsing@
* Remove Microsoft Server Gated Crypto.doug2015-06-181-56/+7
| | | | | | | | | Another relic due to the old US crypto policy. From OpenSSL commit 63eab8a620944a990ab3985620966ccd9f48d681 and 95275599399e277e71d064790a1f828a99fc661a. ok jsing@ miod@
* KNF whitespace.doug2015-06-171-2/+3
| | | | ok miod@ jsing@
* Remove ancient SSL_OP_NETSCAPE_CA_DN_BUG from SSLeay days.doug2015-06-151-15/+5
| | | | | | | This commit matches the OpenSSL removal in commit 3c33c6f6b10864355553961e638514a6d1bb00f6. ok deraadt@
* Remove ancient compat hack SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG.doug2015-06-151-24/+1
| | | | | This was imported into OpenSSL from SSLeay. It was recently deleted in OpenSSL commit 7a4dadc3a6a487db92619622b820eb4f7be512c9
* Remove 1997's compat hack SSL_OP_SSLEAY_080_CLIENT_DH_BUG.doug2015-06-151-9/+4
| | | | This is a hack for an old version of SSLeay which predates OpenSSL.
* Fix return paths with missing EVP_CIPHER_CTX_cleanup() calls.jsg2015-05-151-1/+2
| | | | ok doug@
* Clean up the ssl_bytes_to_cipher_list() API - rather than having thejsing2015-04-151-4/+4
| | | | | | | | | | ability to pass or not pass a STACK_OF(SSL_CIPHER) *, which is then either zeroed or if NULL a new one is allocated, always allocate one and return it directly. Inspired by simliar changes in BoringSSL. ok beck@ doug@
* Factor out the init_buf initialisation code, rather than duplicating itjsing2015-03-271-15/+4
| | | | | | in four different places. ok doug@ guenther@
* Fix CVE-2015-0205: Do not accept client authentication with Diffie-Hellmanbcook2015-02-251-2/+2
| | | | | | | | | | certificates without requiring a CertificateVerify message. From OpenSSL commit: https://github.com/openssl/openssl/commit/1421e0c584ae9120ca1b88098f13d6d2e90b83a3 Thanks to Karthikeyan Bhargavan for reporting this. ok miod@
* Convert several of the server side handshake functions to the new handshakejsing2015-02-071-57/+25
| | | | | | message handling routines. ok miod@
* Unifdef NETSCAPE_HANG_BUG.jsing2015-02-061-22/+1
| | | | | | | If you're still using a buggy version of Netscape from 2000, for HTTPS with client certificates, it is probably a good time to find a new browser. "kill it softly... with napalm and kisses" miod@
* Bring back the horrible API that is get_cipher_by_char/put_cipher_by_char.jsing2015-02-061-1/+3
| | | | | | | | This API was intended to be an internal only, however like many things in OpenSSL, it is exposed externally and parts of the software ecosystem are now using it since there is no real alternative within the public API. ok doug@, tedu@ and reluctantly miod@
* don't leak timing info about padding errors by generating a fake keytedu2014-12-291-5/+10
| | | | | | | afterwards. openssl has a more complicated fix, but it's less intrusive for now to simply hoist the expensive part (fake key generation) up without sweating a branch or two. ok bcook jsing
* Add error handling for EVP_DigestInit_ex().doug2014-12-151-3/+4
| | | | | | | | | | | | | A few EVP_DigestInit_ex() calls were left alone since reporting an error would change the public API. Changed internal ssl3_cbc_digest_record() to return a value due to the above change. It will also now set md_out_size=0 on failure. This is based on part of BoringSSL's commit to fix malloc crashes: https://boringssl.googlesource.com/boringssl/+/69a01608f33ab6fe2c3485d94aef1fe9eacf5364 ok miod@
* unifdef OPENSSL_NO_NEXTPROTONEG, which is one of the last standing #ifndefjsing2014-12-141-17/+1
| | | | | | | mazes in libssl. NPN is being replaced by ALPN, however it is still going to be around for a while yet. ok miod@
* ssl3_init_finished_mac() calls BIO_new() which can fail since it in turnjsing2014-12-101-3/+10
| | | | | | | | calls malloc(). Instead of silently continuing on failure, check the return value of BIO_new() and propagate failure back to the caller for appropriate handling. ok bcook@
* Remove support for GOST R 34.10-94 signature authentication, along withjsing2014-12-101-4/+2
| | | | | | | the two ciphersuites that use it. GOST94 public/private keys have been long obsoleted and libcrypto does not have support for them anyway. Discussed with Dmitry Eremin-Solenikov.
* Update the GOST code in libssl, as contributed by Dmitry Eremin-Solenikov.miod2014-11-181-22/+56
| | | | | This causes a libssl major version bump as this affects the layout of some internal-but-unfortunately-made-visible structs.
* Sort and group includes.jsing2014-11-161-5/+7
|
* Add support for automatic DH ephemeral keys.jsing2014-10-311-4/+17
| | | | | | | This allows an SSL server to enable DHE ciphers with a single setting, which results in an DH key being generated based on the server key length. Partly based on OpenSSL.
* Remove support for ephemeral/temporary RSA private keys.jsing2014-10-311-80/+14
| | | | | | | | | The only use for these is via SSL_OP_EPHEMERAL_RSA (which is effectively a standards violation) and for RSA sign-only, should only be possible if you are using an export cipher and have an RSA private key that is more than 512 bits in size (however we no longer support export ciphers). ok bcook@ miod@
* Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().jsing2014-10-181-9/+4
| | | | | | | | | | | | | | | arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
* Add support for automatic ephemeral EC keys.jsing2014-10-031-3/+11
| | | | | | | | | | This allows an SSL server to enable ECDHE ciphers with a single setting, which results in an EC key being generated using the first preference shared curve. Based on OpenSSL with inspiration from boringssl. ok miod@
* There is not much point checking ecdhp is not NULL... twice.jsing2014-09-271-8/+3
| | | | ok miod@
* remove obfuscating parens. man operator is your friend.tedu2014-09-191-9/+9
|
* Remove SSL_kDHr, SSL_kDHd and SSL_aDH. No supported ciphersuites use them,jsing2014-09-071-5/+3
| | | | | | nor do we plan on supporting them. ok guenther@
* Replace the remaining uses of ssl3_put_cipher_by_char() with s2n and ajsing2014-08-241-4/+3
| | | | | | | ssl3_cipher_get_value() helper function, which returns the cipher suite value for the given cipher. ok miod@
* Unchecked memory allocation and potential leak upon error inmiod2014-08-111-5/+12
| | | | | ssl3_get_cert_verify(). ok guenther@ jsing@
* Since we no longer need to support SSLv2-style cipher lists, startjsing2014-08-101-3/+1
| | | | | | | | | | unravelling the maze of function pointers and callbacks by directly calling ssl3_{get,put}_cipher_by_char() and removing the ssl_{get,put}_cipher_by_char macros. Prompted by similar changes in boringssl. ok guenther.
* The RSA, DH, and ECDH temporary key callbacks expect the number of keybitsguenther2014-07-281-4/+7
| | | | | | | | | | | | | for the key (expressed in RSA key bits, which makes *no sense* for ECDH) as their second argument, not zero. (jsing@ notes that the RSA callback is only invoked for 'export' ciphers, which have been removed from LibreSSL, and for the SSL_OP_EPHEMERAL_RSA option, which is makes the application non-compliant. More fuel for the tedu fire...) jasper@ noted the breakage and bisected it down to the diff that broke this ok jsing@ miod@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-08 05:27:25 +0000