summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_locl.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* copy session id directly in ssl_get_prev_sessiontb2020-09-011-3/+2
| | | | | | | | | | | | ssl_get_prev_session() hands the session id down to tls_decrypt_ticket() which then copies it into the session pointer that it is about to return. It's a lot simpler to retrieve the session pointer and copy the session id inside ssl_get_prev_session(). Also, 'goto err' directly in TLS1_TICKET_NOT_DECRYPTED instead of skipping a couple of long if clauses before doing so. ok inoguchi jsing
* simplify tls1_process_ticket() exit pathtb2020-09-011-2/+1
| | | | | | | | | | | | | | | | tls1_process_ticket() - the only caller of tls_decrypt_ticket() - ends in a switch over the return value of tls_decrypt_ticket() to decide whether or not to set s->internal->tlsext_ticket_expected = 1. Since tls_decrypt_ticket() already knows what it will return and partly bases its decision on what to return on whether or not the ticket needs to be renewed, it can also take care of setting this flag. This way we don't need to have a confusing switch that conflates some return values and sets this flag. Moreover, we can get rid of the ugly TLS1_TICKET_DECRYPTED_RENEW whose only purpose is to signal that the flag should be set. ok jsing
* Return code tweaks for session ticket handlerstb2020-08-311-1/+8
| | | | | | | | In tls1_process_ticket() and tls_decrypt_ticket() use #defines with descriptive names instead of hardcoding -1 1 2 3 4 and occasionally explaining the magic numbers with comments. ok beck inoguchi
* Send alert on ssl_get_prev_session failuretb2020-08-311-3/+4
| | | | | | | | | | | | ssl_get_prev_session() can fail for various reasons some of which may be internal_error others decode_error alerts. Propagate the appropriate alert up to the caller so we can abort the handshake by sending a fatal alert instead of rudely closing the pipe. Currently only 28 of 292 test cases of tlsfuzzer's test-extension.py pass. With this diff, 272 pass. The rest will require fixes elsewhere. ok beck inoguchi jsing
* Start replacing the existing TLSv1.2 record layer.jsing2020-08-301-2/+31
| | | | | | | | | | This takes the same design/approach used in TLSv1.3 and provides an opaque struct that is self contained and cannot reach back into other layers. For now this just implements/replaces the writing of records for DTLSv1/TLSv1.0/TLSv1.1/TLSv1.2. In doing so we stop copying the plaintext into the same buffer that is used to transmit to the wire. ok inoguchi@ tb@
* Use SSL3_SEQUENCE_SIZE for last_write_sequence[] rather than hardcoding.jsing2020-08-111-2/+2
| | | | ok inoguchi@ tb@
* Remove some unnecessary function pointers from SSL_METHOD_INTERNAL.jsing2020-07-071-6/+1
| | | | | | ssl_version is completely unused and get_timeout is the same everywhere. ok beck@ inoguchi@ tb@
* Enable TLSv1.3 for the generic TLS_method().jsing2020-07-071-1/+2
| | | | | | This can be done now that we have both TLSv1.3 client and server. ok beck@ inoguchi@ tb@
* Implement a rolling hash of the ClientHello message, Enforce RFC 8446beck2020-06-061-1/+7
| | | | | | | | section 4.1.2 to ensure subsequent ClientHello messages after a HelloRetryRequest messages must be unchanged from the initial ClientHello. ok tb@ jsing@
* Replace ssl_max_server_version() with ssl_downgrade_max_version()jsing2020-05-311-2/+1
| | | | | | | Replace the only occurrence of ssl_max_server_version() with a call to ssl_downgrade_max_version() and remove ssl_max_server_version(). ok beck@ tb@
* Correct downgrade sentinels when a version pinned method is in use.jsing2020-05-311-1/+2
| | | | | | | | | Previously only the enabled protocol versions were considered, however we also have to consider the method in use which may be version pinned. Found the hard way by danj@ with haproxy and force-tlsv12. ok beck@ inoguchi@ tb@
* Improve server certificate selection for TLSv1.3.jsing2020-05-291-7/+11
| | | | | | | | | This allows an EC certificate to be selected and used, if the client sigalgs would allow it. With feedback from tb@ ok inoguchi@ tb@
* Mop up servername_done, which is unused.jsing2020-05-291-7/+1
| | | | ok beck@ inoguchi@ tb@
* Replace SSL_PKEY_RSA_ENC/SSL_PKEY_RSA_SIGN with SSL_PKEY_RSA.jsing2020-05-191-7/+5
| | | | | | | | | | | | | | | | | Some time prior to SSLeay 0.8.1b, SSL_PKEY_RSA_SIGN got added with the intention of handling RSA sign only certificates... this incomplete code had the following comment: /* check to see if this is a signing only certificate */ /* EAY EAY EAY EAY */ And while the comment was removed in 2005, the incomplete RSA sign-only handling has remained ever since. Remove SSL_PKEY_RSA_SIGN and rename SSL_PKEY_RSA_ENC to SSL_PKEY_RSA. While here also remove the unused SSL_PKEY_DH_RSA. ok tb@
* Enable the TLSv1.3 server.jsing2020-05-111-1/+5
| | | | ok beck@ tb@
* Use size_t for OCSP response length.jsing2020-05-101-2/+3
| | | | | | | | | The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@
* Expose the peer ephemeral public key used for TLSv1.3 key exchange.jsing2020-04-181-1/+2
| | | | | | | | | SSL_get_server_tmp_key() provides the peer ephemeral public key used for key exchange. In the case of TLSv1.3 this is essentially the peer public key from the key share used for TLSv1.3 key exchange, hence make it availaable via SSL_get_server_tmp_key(). ok inoguchi@ tb@
* Consistently spell 'unsigned' as 'unsigned int', as style(9) seemstb2020-03-161-6/+6
| | | | | | | | | to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
* Remove dtls1_enc().jsing2020-03-131-2/+1
| | | | | | | | | | | | | Like much of the original DTLS code, dtls1_enc() is effectively a renamed copy of tls1_enc(). Since then tls1_enc() has been modified, however the non-AEAD code remains largely the same. As such, remove dtls1_enc() and instead call tls1_enc() from the DTLS code. The tls1_enc() AEAD code does not currently work correctly with DTLS, however this is a non-issue since we do not support AEAD cipher suites with DTLS currently. ok tb@
* Stop overloading the record type for padding length.jsing2020-03-121-1/+2
| | | | | | | | Currently the CBC related code stuffs the padding length in the upper bits of the type field... stop doing that and add a padding_length field to the record struct instead. ok inoguchi@ tb@
* Use internal versions of SSL3_BUFFER, SSL3_RECORD and DTLS1_RECORD_DATA.jsing2020-03-121-7/+32
| | | | | | | | | SSL3_BUFFER, SSL3_RECORD and DTLS1_RECORD_DATA are currently still in public headers, even though their usage is internal. This moves to using _INTERNAL suffixed versions that are in internal headers, which then allows us to change them without any potential public API fallout. ok inoguchi@ tb@
* Remove the enc function pointers.jsing2020-03-101-2/+1
| | | | | | | The enc function pointers do not serve any purpose these days - remove a layer of indirection and call dtls1_enc()/tls1_enc() directly. ok inoguchi@ tb@
* Remove the s2n macro now that it is finally unused.jsing2020-02-211-4/+1
| | | | ok inoguchi@ tb@
* Move l2n/l2n8 into s3_cbc.c, since this is the only code that uses it.jsing2020-02-211-15/+1
| | | | ok inoguchi@ tb@
* Re-enable the TLSv1.3 client since the known issues have been addressed.jsing2020-02-061-3/+1
| | | | ok tb@
* Correctly handle key share extensions in a hello retry request.jsing2020-02-061-1/+2
| | | | | | | | In a hello retry request the server will only send the selected group and not actually provide a key exchange. In this case we need to store the server selected group for further processing. ok tb@
* Refactor the server hello processing code in the TLSv1.3 client.jsing2020-02-051-1/+4
| | | | | | | | | | | | | Use flags to signal the need to switch to the legacy client and to identify a hello retry request. This allows the caller to take appropriate action, rather than trying to do this in the parsing/processing code. Split the key deriviation and record protection engagement code into a separate function, both for readability and reuse. Change handshake states outside of the processing code. ok tb@
* Provide tls1_transcript_unfreeze() to avoid the need for manual flagsjsing2020-02-051-1/+2
| | | | | | mangling. ok tb@
* Disable TLSv1.3 client while some known issues are being addressed.jsing2020-02-011-1/+3
|
* Provide struct/functions for handling TLSv1.3 key shares.jsing2020-01-301-6/+2
| | | | | | | Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
* Factor out/rewrite the ECDHE EC point key exchange code.jsing2020-01-301-1/+9
| | | | | | | | | This reduces replication between the existing TLS client/server and allows the code to soon be reused for TLSv1.3. With feedback from inoguchi@ and tb@ ok inoguchi@ tb@
* Remove dead prototypes.jsing2020-01-291-10/+1
|
* Remove the ssl_get_message function pointer from SSL_METHOD_INTERNAL.jsing2020-01-231-3/+1
| | | | | | | | | ssl_get_message is essentially a switch between ssl3_get_message and dtls1_get_message, both only used by the legacy stack. Instead, use SSL_IS_DTLS() in ssl3_get_message to call the DTLS function when necessary. ok beck@ inoguchi@ tb@
* Correctly handle TLSv1.3 ciphers suites in ssl3_choose_cipher().jsing2020-01-231-1/+9
| | | | | | | | | | Currently, TLSv1.3 cipher suites are filtered out by the fact that they have authentication and key exchange algorithms that are not being set in ssl_set_cert_masks(). Fix this so that ssl3_choose_cipher() works for TLSv1.3, however we also now need to ensure that we filter out TLSv1.3 for non-TLSv1.3 and only select TLSv1.3 for TLSv1.3. ok beck@ tb@
* Save the legacy session id in the client, and enforce that it is returnedbeck2020-01-231-1/+5
| | | | | | the same from the server. ok jsing@ tb@
* Switch back to a function pointer for ssl_pending.jsing2020-01-231-3/+4
| | | | | | | This will allow the TLSv1.3 stack to provide its own implementation. Nuke a completely bogus comment from SSL_pending() whilst here. ok beck@
* Wire up the TLSv1.3 server.jsing2020-01-221-1/+2
| | | | | | | | This currently only has enough code to handle fallback to the legacy TLS stack for TLSv1.2 or earlier, however allows for further development and testing. ok beck@
* Fix things so that `make -DTLS1_3` works again.jsing2020-01-221-1/+3
|
* Enable the TLSv1.3 client in libssl.jsing2020-01-221-2/+3
| | | | | | | | | | | | | | This also makes it available to clients that use libtls, including ftp(1) and nc(1). Note that this does not expose additional defines via public headers, which means that any code conditioning on defines like TLS1_3_VERSION or SSL_OP_NO_TLSv1_3 will not enable or use TLSv1.3. This approach is necessary since too many pieces of software assume that if TLS1_3_VERSION is available, other OpenSSL 1.1 API will also be available, which is not necessarily the case. ok beck@ tb@
* Move guards from public to internal headers, and fix not use values.beck2020-01-221-1/+6
| | | | | | reverts previous attempt which would have broken ports ok jsing@
* Bring back the ssl_shutdown internal method pointer.jsing2019-11-171-1/+2
| | | | | | | For now ssl3_shutdown() is called in all cases, however TLSv1.3 will soon get its own version. ok beck@
* Pass the session ID down to the session/ticket handling code as a CBS.jsing2019-04-221-5/+4
| | | | | | | | | Convert ssl_get_prev_session(), tls1_process_ticket() and tls1_decrypt_ticket() to handle the session ID from the client hello as a CBS. While here also swap the order of arguments for tls1_decrypt_ticket() so that it is consistent with the other functions. ok tb@
* Inline and remove the tlsext_tick_md macro.jsing2019-04-221-2/+1
| | | | | | | There is not much point having a tlsext_tick_md macro that replaces EVP_sha256() in two places, when the cipher is just hardcoded. ok tb@
* Clean up the cipher/digest table mess.jsing2019-04-041-2/+1
| | | | | | | | | | The original implementation allows for libcrypto to be compiled without a given algorithm and libssl then detects that ciphers or digests are unavailable so that it can disable the associated cipher suites. This is unnecessary since we do not compile out algorithms. ok beck@, tb@ (a while back)
* Strip out all of the pkey to sigalg and sigalg to pkey linkages.jsing2019-03-251-3/+1
| | | | | | These are no longer used now that we defer signature algorithm selection. ok beck@
* tls1_process_sigalgs() is no longer needed.jsing2019-03-251-2/+1
| | | | ok beck@
* Defer sigalgs selection until the certificate is known.jsing2019-03-251-1/+5
| | | | | | | | | | | | | Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@.
* Remove ssl_get_server_send_cert() which is now unused.jsing2019-03-251-2/+1
| | | | ok beck@ tb@
* Rework ssl3_output_cert_chain() to take a CERT_PKEY and consider chains.jsing2019-03-251-2/+2
| | | | | | | | | | We will now include the certificates in the chain in the certificate list, or use the existing extra_certs if present. Failing that we fall back to the automatic chain building if not disabled. This also simplifies the code significantly. ok beck@ tb@
* Add a chain member to CERT_PKEY and provide functions for manipulating it.jsing2019-03-251-1/+8
| | | | | | | | | Note that this is not the full chain, as the leaf certificate currently remains in the x509 member of CERT_PKEY. Unfortunately we've got to contend with the fact that some OpenSSL *_chain_* APIs exclude the leaf certificate while others include it... ok beck@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-29 02:26:12 +0000