summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_locl.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Pass the session ID down to the session/ticket handling code as a CBS.jsing2019-04-221-5/+4
| | | | | | | | | Convert ssl_get_prev_session(), tls1_process_ticket() and tls1_decrypt_ticket() to handle the session ID from the client hello as a CBS. While here also swap the order of arguments for tls1_decrypt_ticket() so that it is consistent with the other functions. ok tb@
* Inline and remove the tlsext_tick_md macro.jsing2019-04-221-2/+1
| | | | | | | There is not much point having a tlsext_tick_md macro that replaces EVP_sha256() in two places, when the cipher is just hardcoded. ok tb@
* Clean up the cipher/digest table mess.jsing2019-04-041-2/+1
| | | | | | | | | | The original implementation allows for libcrypto to be compiled without a given algorithm and libssl then detects that ciphers or digests are unavailable so that it can disable the associated cipher suites. This is unnecessary since we do not compile out algorithms. ok beck@, tb@ (a while back)
* Strip out all of the pkey to sigalg and sigalg to pkey linkages.jsing2019-03-251-3/+1
| | | | | | These are no longer used now that we defer signature algorithm selection. ok beck@
* tls1_process_sigalgs() is no longer needed.jsing2019-03-251-2/+1
| | | | ok beck@
* Defer sigalgs selection until the certificate is known.jsing2019-03-251-1/+5
| | | | | | | | | | | | | Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@.
* Remove ssl_get_server_send_cert() which is now unused.jsing2019-03-251-2/+1
| | | | ok beck@ tb@
* Rework ssl3_output_cert_chain() to take a CERT_PKEY and consider chains.jsing2019-03-251-2/+2
| | | | | | | | | | We will now include the certificates in the chain in the certificate list, or use the existing extra_certs if present. Failing that we fall back to the automatic chain building if not disabled. This also simplifies the code significantly. ok beck@ tb@
* Add a chain member to CERT_PKEY and provide functions for manipulating it.jsing2019-03-251-1/+8
| | | | | | | | | Note that this is not the full chain, as the leaf certificate currently remains in the x509 member of CERT_PKEY. Unfortunately we've got to contend with the fact that some OpenSSL *_chain_* APIs exclude the leaf certificate while others include it... ok beck@ tb@
* revert "Move struct ssl_handshake_tls13_st definition", i.e., movetb2019-02-251-1/+24
| | | | | | SSL_HANDSHAKE_TLS13 back to ssl_locl.h. discussed with jsing and inoguchi
* Move struct ssl_handshake_tls13_st definitioninoguchi2019-02-251-24/+1
| | | | | | This solves build error on luna88k with gcc3. ok aoyama@ jca@ jsing@ tb@
* Provide a TLS 1.3 capable client method.jsing2019-02-141-1/+3
| | | | ok tb@
* Preserve the transcript hash at specific stages of the TLSv1.3 handshake.jsing2019-02-101-1/+5
| | | | | | | | | There are various points where we need the hash of all messages prior to the current message. Support this by having the handshake code preserve the transcript hash prior to recording the current message, which avoids the need to sprinkle this throughout multiple handlers. ok inoguchi@ tb@
* Rename tls1_handshake_hash*() to tls1_transcript_hash*().jsing2019-02-091-5/+5
| | | | | | | | | While handshake hash is correct (in as far as it is a hash of handshake messages), using tls1_transcript_hash*() aligns them with the naming of the tls1_transcript*() functions. Additionally, the TLSv1.3 specification uses Transcript-Hash and "transcript hash", which this matches. ok inoguchi@ tb@
* Add server side of versions, keyshare, and client and server of cookiebeck2019-01-241-1/+4
| | | | | | | | extensions for tls1.3. versions is currently defanged to ignore its result until tls13 server side wired in full, so that server side code still works today when we only support tls 1.2 ok bcook@ tb@ jsing@
* move the extensions_seen into the handshake structbeck2019-01-241-1/+4
| | | | ok jsing@
* Modify sigalgs extension processing to accomodate TLS 1.3.beck2019-01-231-2/+2
| | | | | | | | | | - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2. - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 from a 1.3 handshake. ok jsing@ tb@
* revert previous, accidentally contained another diff in additionbeck2019-01-231-8/+2
| | | | to the one I intended to commit
* Modify sigalgs extension processing for TLS 1.3.beck2019-01-231-2/+8
| | | | | | | | | - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@
* Add ssl_cipher_is_permitted(), an internal helper function thattb2019-01-211-1/+3
| | | | | | | will be used in a few places shortly, e.g. in ssl_cipher_list_to_bytes(). ok jsing
* Move struct tls13_ctx into a header since other things need access to it.jsing2019-01-211-1/+3
| | | | | | | | While here, rename struct handshake to struct handshake_stage to avoid potential ambiguity/conflict with the handshake data struct. Also add forward and back pointers between SSL and struct tls13_ctx. ok tb@
* Add client side of supported versions and keyshare extensions with basic regressbeck2019-01-181-1/+19
| | | | ok jsing@
* Fix DTLS transcript handling for HelloVerifyRequest.jsing2018-11-211-1/+2
| | | | | | | | | | | | | If DTLS sees a HelloVerifyRequest the transcript is reset - the previous tls1_init_finished_mac() function could be called multiple times and would discard any existing state. The replacement tls1_transcript_init() is more strict and fails if a transcript already exists. Provide an explicit tls1_transcript_reset() function and call it from the appropriate places. This also lets us make DTLS less of a special snowflake and call tls1_transcript_init() in the same place as used for TLS. ok beck@ tb@
* Stop keeping track of sigalgs by guessing it from digest and pkey,beck2018-11-101-4/+6
| | | | | | just keep the sigalg around so we can remember what we actually decided to use. ok jsing@
* Reimplement the sigalgs processing code into a new implementationbeck2018-11-091-7/+1
| | | | | that will be usable with TLS 1.3 with less eye bleed. ok jsing@ tb@
* Clean up and simplify the handshake transcript code.jsing2018-11-081-7/+10
| | | | | | | This provides a cleaner, simpler and more readable API, with code that uses a BUF_MEM instead of a BIO. ok beck@ ("hurry up") and tb@.
* Stop pretending that a cert member in a SSL and SSL_CTX can be NULL.jsing2018-11-081-2/+1
| | | | ok beck@ tb@
* Add TLSv1.3 cipher suites (with appropriate guards).jsing2018-11-071-1/+4
| | | | ok beck@ tb@
* Rename the TLS Supported Elliptic Curves extension to Supported Groups.jsing2018-11-051-8/+8
| | | | | | | | | RFC 7919 renamed the Supported Elliptic Curves TLS extension to Supported Groups and redefined it to include finite field DH (FFDH) in addition to elliptic curve DH (ECDH). As such, rename the TLS extension and change the associated code to refer to groups rather than curves. ok beck@ tb@
* Clean up the code that checks if we can choose an EC cipher suite.jsing2018-11-051-2/+1
| | | | | | | | | The tls1_check_ec_tmp_key() function is now rather misnamed, so just inline the code. Also, rather than running tls1_get_shared_curve() once per EC cipher suite, we can run it once at the start of the ssl3_choose_cipher() function. ok bluhm@ tb@
* Mop up ecdh_tmp, since it is no longer used.jsing2018-11-051-3/+1
| | | | ok bluhm@ tb@
* Make more of libssl's record layer state internal.jsing2018-10-241-1/+11
| | | | | | | | | | In January 2017, we changed large amounts of libssl's data structures to be non-visible/internal, however intentionally left things that the software ecosystem was needing to use. The four or so applications that reached into libssl for record layer related state now implement alternative code. As such, make these data structures internal. ok tb@
* SSL_MAX_DIGEST is no longer needed.jsing2018-09-081-5/+1
|
* Drop SSL_CIPHER_ALGORITHM2_AEAD flag.jsing2018-09-061-10/+6
| | | | | | | All of our algorithm_mac == SSL_AEAD cipher suites use EVP_AEAD, so we can condition on that rather than having a separate redundant flag. ok tb@
* Correctly clear the current cipher state, when changing cipher state.jsing2018-09-051-3/+4
| | | | | | | | | | | | | | | | | When a renegotiation results in a change of cipher suite, the renegotation would fail if it switched from AEAD to non-AEAD or vice versa. This is due to the fact that the previous EVP_AEAD or EVP_CIPHER state remained, resulting in incorrect logic that caused MAC failures. Rename ssl_clear_cipher_ctx() to ssl_clear_cipher_state() and split it into separate read/write components, then call these functions from the appropriate places when a ChangeCipherSpec message is being processed. Also, remove the separate ssl_clear_hash_ctx() calls and fold these into the ssl_clear_cipher_{read,write}_state() functions. Issue reported by Bernard Spil, who also tested this diff. ok tb@
* Nuke ssl_pending/ssl_shutdown function pointers.jsing2018-08-301-4/+1
| | | | | | | ssl3_pending() is used for all protocols and dtls1_shutdown() just calls ssl3_shutdown(), so just call the appropriate function directly instead. ok beck@ inoguchi@ tb@
* n2s and l2n3 finally bite the dust!jsing2018-08-271-7/+1
|
* Simplify new session ticket encoding/generation.jsing2018-08-271-1/+3
| | | | | | | | | | | The original code did a crazy encode/malloc/encode/decode/modify/encode dance, in order to encode a session in the form needed to encrypt then add to a session ticket. By modifying the encoding functions slightly, we can do this entire dance as a single encode. Inspired by similar changes in BoringSSL. ok inoguchi@ tb@
* Simplify session ticket parsing/handling.jsing2018-08-241-6/+7
| | | | | | | | | | | | The original implementation is rather crazy and means that we effectively have two lots of code that parse a ClientHello and two lots of code that parse TLS extensions. Partially simplify this by passing a CBS containing the extension block through to the session handling functions, removing the need to reimplement the ClientHello parsing. While here standarise on naming for session_id and session_id_len. ok inoguchi@ tb@
* Clean up handshake message start/finish functions.jsing2018-08-241-5/+3
| | | | | | | | Now that all handshake messages are created using CBB, remove the non-CBB ssl3_handshake_msg_start()/ssl3_handshake_msg_finish() functions. Rename the CBB variants by dropping the _cbb suffix. ok bcook@ inoguchi@ tb@
* Rename and collapse tls12_get_sigandhash_cbb().jsing2018-08-191-5/+3
| | | | | | | | | | Now that all callers of tls12_get_sigandhash() have been converted to CBB, collapse tls12_get_sigandhash() and tls12_get_sigandhash_cbb() into a single function. Rename it to tls12_gethashandsig() to be representative of the actual order of the sigalgs parameters, and perform some other clean up. ok inoguchi@ tb@
* Convert ssl3_send_server_key_exchange() to CBB.jsing2018-08-161-1/+3
| | | | ok inoguchi@ tb@
* OpenSSL started adding const to functions all over the place. Make alltb2018-04-251-3/+3
| | | | | | | | our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing
* Remove function pointers for ssl_{read,write,peek}.jsing2018-04-071-4/+1
| | | | | | | Now that everything goes through the same code path, we can remove a layer of indirection and just call ssl3_{read,write,peek} directly. ok beck@ inoguchi@
* Nuke SSL3_FLAGS_DELAY_CLIENT_FINISHED and SSL3_FLAGS_POP_BUFFER.jsing2018-04-071-3/+1
| | | | | | | These flags enabled experimental behaviour in the write path, which nothing uses. Removing this code greatly simplifies ssl3_write(). ok beck@ inoguchi@ sthen@ tb@
* Complete the TLS extension handling rewrite for the server-side.jsing2018-01-271-3/+4
| | | | | | | | | | | | | This removes ssl_parse_clienthello_tlsext() and allows the CBS to be passed all the way through from ssl3_get_client_hello(). The renegotation check gets pulled up into ssl3_get_client_hello() which is where other such checks exist. The TLS extension parsing now also ensures that we do not get duplicates of any known extensions (the old pre-rewrite code only did this for some extensions). ok inoguchi@
* Rename ssl3_client_hello() to ssl3_send_client_hello() for consistency.jsing2017-10-121-2/+2
|
* Fold dtls1_accept() into ssl_accept(), removing a lot of duplicated code.jsing2017-10-121-2/+2
| | | | With review/feedback from inoguchi@
* Drop prototypes for ssl23_*() functions, which no longer exist.jsing2017-10-121-11/+1
|
* Convert ssl3_client_hello() to CBB.jsing2017-10-111-6/+2
| | | | | | | As part of this, change ssl_cipher_list_to_bytes() to take a CBB argument, rather than a pointer/length. Some additional clean up/renames while here. Based on a diff from doug@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-24 07:27:21 +0000