summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove some unnecessary function pointers from SSL_METHOD_INTERNAL.jsing2020-07-071-3/+13
| | | | | | ssl_version is completely unused and get_timeout is the same everywhere. ok beck@ inoguchi@ tb@
* Enable SSL_MODE_AUTO_RETRY by default.jsing2020-05-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In TLSv1.2 and earlier, when an application goes to read application data, handshake messages may be received instead, when the peer has triggered renegotation. A similar thing occurs in TLSv1.3 when key updates are triggered or the server sends new session tickets. Due to the SSL_read() API there is no way to indicate that we got no application data, instead after processing the in-band handshake messages it would be normal to return SSL_ERROR_WANT_READ and have the caller call SSL_read() again. However, various applications expect SSL_read() to return with either application data or a fatal error, when used on a blocking socket. These applications do not play well with TLSv1.3 post-handshake handshake messages (PHH), as they fail to handle SSL_ERROR_WANT_READ. The same code is also broken in the case of a TLSv1.2 or older renegotiation, however these are less likely to be encountered. Such code should set SSL_MODE_AUTO_RETRY in order to avoid these issues. Contrary to the naming, SSL_MODE_AUTO_RETRY does not actually retry in every case - it retries following handshake messages in the application data stream (i.e. renegotiation and PHH messages). This works around the unretried SSL_read() on a blocking socket case, however in the case where poll/select is used with blocking sockets, the retry will likely result in the read blocking after the handshake messages are processed. Rather than pushing for broken code to be fixed, OpenSSL decided to enable SSL_MODE_AUTO_RETRY by default, instead breaking code that does poll or select on blocking sockets (like s_client and s_server). Unfortunately we get to follow suit. ok beck@ inoguchi@ tb@
* fix a confusingly wrapped linetb2020-05-231-3/+3
|
* Make ssl_set_cert_masks() more consistent and closer to readable.jsing2020-05-211-44/+27
| | | | | | Prompted by tb@ ok tb@
* Replace SSL_PKEY_RSA_ENC/SSL_PKEY_RSA_SIGN with SSL_PKEY_RSA.jsing2020-05-191-16/+8
| | | | | | | | | | | | | | | | | Some time prior to SSLeay 0.8.1b, SSL_PKEY_RSA_SIGN got added with the intention of handling RSA sign only certificates... this incomplete code had the following comment: /* check to see if this is a signing only certificate */ /* EAY EAY EAY EAY */ And while the comment was removed in 2005, the incomplete RSA sign-only handling has remained ever since. Remove SSL_PKEY_RSA_SIGN and rename SSL_PKEY_RSA_ENC to SSL_PKEY_RSA. While here also remove the unused SSL_PKEY_DH_RSA. ok tb@
* Use size_t for OCSP response length.jsing2020-05-101-2/+2
| | | | | | | | | The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@
* Consistently spell 'unsigned' as 'unsigned int', as style(9) seemstb2020-03-161-3/+3
| | | | | | | | | to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
* When an SSL method is set, bump the max version back to that of thejsing2020-01-261-1/+10
| | | | | | | | | | incoming method if it is a client. This addresses the case where TLS_method() is used to initialise a SSL_CTX, then a TLS_client_method() is then set, resulting in TLSv1.2 being used instead of TLSv1.3. This is observable in smtpd. ok beck@
* Correctly handle TLSv1.3 ciphers suites in ssl3_choose_cipher().jsing2020-01-231-1/+4
| | | | | | | | | | Currently, TLSv1.3 cipher suites are filtered out by the fact that they have authentication and key exchange algorithms that are not being set in ssl_set_cert_masks(). Fix this so that ssl3_choose_cipher() works for TLSv1.3, however we also now need to ensure that we filter out TLSv1.3 for non-TLSv1.3 and only select TLSv1.3 for TLSv1.3. ok beck@ tb@
* Switch back to a function pointer for ssl_pending.jsing2020-01-231-10/+2
| | | | | | | This will allow the TLSv1.3 stack to provide its own implementation. Nuke a completely bogus comment from SSL_pending() whilst here. ok beck@
* Clear and free the tls13_ctx that hangs off an SSL *s fromtb2020-01-211-1/+6
| | | | | | | | | SSL_{clear,free}(3). Make sure the handshake context is cleaned up completely: the hs_tls13 reacharound is taken care of by ssl3_{clear,free}(3). Add a missing tls13_handshake_msg_free() call to tls13_ctx_free(). ok beck jsing
* Bring back the ssl_shutdown internal method pointer.jsing2019-11-171-2/+2
| | | | | | | For now ssl3_shutdown() is called in all cases, however TLSv1.3 will soon get its own version. ok beck@
* Allow ip addresses as argument to SSL_set1_host() but be careful to nototto2019-11-041-2/+14
| | | | poison the context. ok and help jsing@ tb@
* s3 is never NULL since s2 (formerly used for SSLv2) does not exist, so there isbcook2019-05-151-19/+13
| | | | | | | no need to check for it. Fixes COV-165788, identified with help from Alex Bumstead. ok jsing@
* Strip out all of the pkey to sigalg and sigalg to pkey linkages.jsing2019-03-251-10/+4
| | | | | | These are no longer used now that we defer signature algorithm selection. ok beck@
* Defer sigalgs selection until the certificate is known.jsing2019-03-251-13/+2
| | | | | | | | | | | | | Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@.
* Remove ssl_get_server_send_cert() which is now unused.jsing2019-03-251-12/+1
| | | | ok beck@ tb@
* Add a re-implementation of SSL_get1_supported_ciphers().tb2019-01-221-1/+35
| | | | | | | Part of OpenSSL 1.1 API (pre-licence-change). input schwarze ok jsing
* Provide SSL_get_client_ciphers().tb2019-01-221-1/+9
| | | | | | Part of OpenSSL 1.1 API, pre-licence change. ok jsing
* Move ssl_cipher_list_to_bytes() and ssl_bytes_to_cipher_list() totb2019-01-211-115/+1
| | | | | | | a more appropriately licenced file. jsing and doug have rewritten these functions (including the comments) over the past years. ok jsing
* Use ssl_cipher_is_permitted() in ssl_cipher_list_to_bytes().tb2019-01-211-9/+6
| | | | ok jsing
* Teach ssl_version_string() about TLS1_3_VERSION.jsing2019-01-211-1/+3
|
* Revert previous - DTLSv1 uses MD5+SHA1 for RSA signature verification.jsing2018-11-191-5/+2
| | | | Discussed with beck@
* Fix DTLS, because DTLS still remains a special flower, allows regress to passbeck2018-11-171-2/+5
|
* Fix wrong sizeof argument by using 'uint16_t *', with minor nit from tb@,mestre2018-11-141-2/+2
| | | | | | | | | | instead of 'uint16_t' Found with llvm's static analyzer, noticed that it was also already reported in Coverity CID 155890 and to ensure this was correct also inspected OpenSSL's equivalent code. OK tb@ and jsing@
* Add SSL_set1_host(), a thin wrapper around X509_VERIFY_PARAM_set1_host().tb2018-11-111-1/+7
| | | | | | | Used by unbound's DNS over TLS implementation to do server name verification. ok jsing
* Stop keeping track of sigalgs by guessing it from digest and pkey,beck2018-11-101-7/+29
| | | | | | just keep the sigalg around so we can remember what we actually decided to use. ok jsing@
* Stop pretending that a cert member in a SSL and SSL_CTX can be NULL.jsing2018-11-081-32/+9
| | | | ok beck@ tb@
* Add TLSv1.3 cipher suites (with appropriate guards).jsing2018-11-071-1/+6
| | | | ok beck@ tb@
* Use the newer/more sensible names for EVP_MD_CTX_* functions.jsing2018-09-051-3/+3
| | | | | | | | | | EVP_MD_CTX_create -> EVP_MD_CTX_new EVP_MD_CTX_destroy -> EVP_MD_CTX_free This should make the intent more obvious and reduce head scratching during code reviews. Raised by tb@
* Correctly clear the current cipher state, when changing cipher state.jsing2018-09-051-27/+25
| | | | | | | | | | | | | | | | | When a renegotiation results in a change of cipher suite, the renegotation would fail if it switched from AEAD to non-AEAD or vice versa. This is due to the fact that the previous EVP_AEAD or EVP_CIPHER state remained, resulting in incorrect logic that caused MAC failures. Rename ssl_clear_cipher_ctx() to ssl_clear_cipher_state() and split it into separate read/write components, then call these functions from the appropriate places when a ChangeCipherSpec message is being processed. Also, remove the separate ssl_clear_hash_ctx() calls and fold these into the ssl_clear_cipher_{read,write}_state() functions. Issue reported by Bernard Spil, who also tested this diff. ok tb@
* Nuke ssl_pending/ssl_shutdown function pointers.jsing2018-08-301-6/+6
| | | | | | | ssl3_pending() is used for all protocols and dtls1_shutdown() just calls ssl3_shutdown(), so just call the appropriate function directly instead. ok beck@ inoguchi@ tb@
* Let SSL_copy_session_id() return an int for error checking.tb2018-08-241-24/+25
| | | | | | | | | | Accordingly, add some error checking to SSL_copy_session_id(), BIO_ssl_copy_session_id(), and SSL_dup(). Prompted by OpenSSL commit 17dd65e6e1f Tested in a bulk build by sthen ok jsing
* OpenSSL started adding const to functions all over the place. Make alltb2018-04-251-2/+2
| | | | | | | | our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing
* make ENGINE_finish() succeed on NULL and simplify callers as intb2018-04-141-3/+2
| | | | | | | | | | | OpenSSL commit 7c96dbcdab9 by Rich Salz. This cleans up the caller side quite a bit and reduces the number of lines enclosed in #ifndef OPENSSL_NO_ENGINE. codesearch.debian.net shows that almost nothing checks the return value of ENGINE_finish(). While there, replace a few nearby 'if (!ptr)' with 'if (ptr == NULL)'. ok jsing, tested by & ok inoguchi
* Remove function pointers for ssl_{read,write,peek}.jsing2018-04-071-4/+4
| | | | | | | Now that everything goes through the same code path, we can remove a layer of indirection and just call ssl3_{read,write,peek} directly. ok beck@ inoguchi@
* Bring in compatibility for OpenSSL 1.1 style init functions.beck2018-03-171-1/+6
| | | | | | | | | This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
* Provide SSL_CTX_get_default_passwd_cb{,_userdata}()tb2018-03-171-1/+13
| | | | ok jsing
* Provide SSL_CTX_get_min_proto_version and SSL_CTX_get_max_proto_versionjca2018-03-151-1/+24
| | | | | | | | | We already provided the setters, so also provide the getters like OpenSSL does. Addition prompted by the use of those functions in recent openvpn releases. manpage diff from schwarze@ (thanks!) with input from jsing@, ok tb@ jsing@
* Provide SSL_is_server().jsing2018-02-221-1/+7
|
* Provide SSL_up_ref().jsing2018-02-221-1/+8
|
* Provide SSL_CTX_get_ciphers().jsing2018-02-221-1/+7
|
* Provide SSL_get_client_random() and SSL_get_server_random()jsing2018-02-171-2/+35
|
* Provide SSL_CTX_get0_certificate()jsing2018-02-171-1/+10
|
* Provide SSL_CTX_up_ref().jsing2018-02-141-1/+8
|
* Provide SSL_CTX_get0_param() and SSL_get0_param().jsing2018-02-141-1/+13
| | | | | Some applications that use X509_VERIFY_PARAM expect these to exist, since they're also part of the OpenSSL 1.0.2 API.
* Convert ssl3_client_hello() to CBB.jsing2017-10-111-27/+16
| | | | | | | As part of this, change ssl_cipher_list_to_bytes() to take a CBB argument, rather than a pointer/length. Some additional clean up/renames while here. Based on a diff from doug@
* Make ssl_bytes_to_cipher_list() take a CBS, rather than a pointer andjsing2017-10-101-24/+14
| | | | | length, since the caller has already been converted to CBS. A small amount of additional clean up whilst here.
* Bring back the NPN related symbols.jsing2017-08-301-1/+25
| | | | | | | | | | | Several pieces of software make use of these based on a conditional around OPENSSL_NPN_NEGOTIATED, rather than using the presence of the symbols, the non-existence of a OPENSSL_NO_NEXTPROTONEG define or even the existence of the TLS extension type. Unfortunately we cannot remove OPENSSL_NPN_NEGOTIATED since the API for ALPN was effectively botched and reuses two parts from the NPN implementation, rather than providing ALPN specific or generic versions.
* Completely remove NPN remnants.jsing2017-08-281-25/+1
| | | | Based on a diff from doug@, similar diff from inoguchi@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-27 23:07:41 +0000