summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_enc.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Currently tls1_PRF() requires that a temporary buffer be provided, thatjsing2017-03-181-50/+32
| | | | | | | | | | | | | | matches the size of the output buffer. This is used in the case where there are multiple hashes - tls_P_hash() is called with the temporary buffer and the result is then xored into the output buffer. Avoid this by simply using a local buffer in tls_P_hash() and then xoring the result into the output buffer. Overall this makes the code cleaner and simplifies all of the tls_PRF() callers. Similar to BoringSSL. ok inoguchi@
* Remove the handshake digests and related code, replacing remaining usesjsing2017-03-101-95/+2
| | | | | | | with the handshake hash. For now tls1_digest_cached_records() is retained to release the handshake buffer. ok beck@ inoguchi@
* First pass at cleaning up the tls1_P_hash() function - remove a pointlessjsing2017-03-101-20/+19
| | | | | | | EVP_DigestSignInit() call and avoid the need for ctx_tmp by reordering the code slightly. ok inoguchi@
* Make tls1_PRF() non-static so it can be regress tested.jsing2017-03-101-2/+7
|
* Correctly handle TLS PRF with MD5+SHA1 - the secret has to be partitionedjsing2017-03-071-5/+26
| | | | | | and each hash processed separately. Tested by tb@
* Clean up and simplify the tls1_PRF() implementation now that we have ajsing2017-03-061-48/+19
| | | | | | single EVP MD for the PRF hash. ok beck@ inoguchi@
* Provide a rolling handshake hash that commences as soon as the cipherjsing2017-03-051-41/+19
| | | | | | | | | | suite has been selected, and convert the final finish MAC to use this handshake hash. This is a first step towards cleaning up the current handshake buffer/digest code. ok beck@ inoguchi@
* Change SSLerror() back to taking two args, with the first one being an SSL *.beck2017-02-071-22/+22
| | | | | | | | | Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible
* Finish the fallout of the SSLerr->SSLerror cleanup to get rid of the uglybeck2017-01-261-21/+11
| | | | line wraps that resulted
* Send the error function codes to rot in the depths of hell where they belongbeck2017-01-261-22/+22
| | | | | | | We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
* Move options and mode from SSL_CTX and SSL to internal, since these can bejsing2017-01-231-2/+2
| | | | set and cleared via existing functions.
* Split most of SSL_METHOD out into an internal variant, which is opaque.jsing2017-01-231-2/+2
| | | | Discussed with beck@
* move back read_hash and enc_read_ctx into ssl_st. wpa_supplicant andbeck2017-01-231-16/+16
| | | | other perversions touches them sickly and unnaturally.
* Move a large part of ssl_st into internal, so we can see what squeals.beck2017-01-231-40/+40
| | | | ok jsing@
* Move most of the SSL3_STATE fields to internal - the ones that remain arejsing2017-01-221-76/+76
| | | | | | known to be used by ports. ok beck@
* Move most of DTLS1_STATE to internal.beck2017-01-221-4/+4
| | | | ok jsing@
* Remove unused SSLv3 from ssl3_cbc_record_digest_supported().jsing2016-11-061-3/+2
| | | | | | From Markus Uhlin <markus.uhlin at bredband dot net> ok beck@ bcooK@
* Clean up the TLS handshake digest handling - this refactors some of thejsing2016-11-031-28/+41
| | | | | | | | | | | | | | | | | | | code for improved readability, however it also address two issues. The first of these is a hard-to-hit double free that will occur if EVP_DigestInit_ex() fails. To avoid this and to be more robust, ensure that tls1_digest_cached_records() either completes successfully and sets up all of the necessary digests, or it cleans up and frees everything that was allocated. The second issue is that EVP_DigestUpdate() can fail - detect and handle this in tls1_finish_mac() and change the return type to an int so that a failure can be propagated to the caller (the callers still need to be fixed to handle this, in a later diff). The double-free was reported by Matthew Dillon. ok beck@ doug@ miod@
* Implement the IETF ChaCha20-Poly1305 cipher suites.jsing2016-04-281-28/+81
| | | | | | | | | Rename the existing ChaCha20-Poly1305 cipher suites with an "-OLD" suffix, effectively replaces the original Google implementation. We continue to support both the IETF and Google versions, however the existing names now refer to the ciphers from draft-ietf-tls-chacha20-poly1305-04. Feedback from doug@
* Make sure stdio functions don't end up in the library, from miod@beck2016-03-061-3/+5
| | | | ok doug@ bcook@
* Rename functions that moved to t1_enc.c, with a tls1_ prefix instead of ajsing2015-09-111-15/+15
| | | | | | ssl3_ prefix. ok beck@
* Merge the remnants of s3_enc.c into t1_enc.c.jsing2015-09-111-1/+123
| | | | ok beck@
* Correct spelling of OPENSSL_cleanse.jsing2015-09-101-3/+3
| | | | ok miod@
* Change AEAD out_len argument to size_t instead of ssize_t - while here,jsing2015-08-271-10/+8
| | | | | | | rename it to out_len so that its purpose is more obvious. Also, drop two checks that are no longer possible (and have not been for a long time). Spotted by and ok doug@
* Remove workaround for TLS padding bug from SSLeay days.doug2015-07-171-5/+1
| | | | | | | | | OpenSSL doesn't remember which clients were impacted and the functionality has been broken in their stable releases for 2 years. Based on OpenSSL commit a8e4ac6a2fe67c19672ecf0c6aeafa15801ce3a5. ok jsing@
* Keep alerts sorted by alert code.jsing2015-06-171-3/+3
|
* Reluctantly add server-side support for TLS_FALLBACK_SCSV.jsing2015-02-221-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | This allows for clients that willingly choose to perform a downgrade and attempt to establish a second connection at a lower protocol after the previous attempt unexpectedly failed, to be notified and have the second connection aborted, if the server does in fact support a higher protocol. TLS has perfectly good version negotiation and client-side fallback is dangerous. Despite this, in order to maintain maximum compatability with broken web servers, most mainstream browsers implement this. Furthermore, TLS_FALLBACK_SCSV only works if both the client and server support it and there is effectively no way to tell if this is the case, unless you control both ends. Unfortunately, various auditors and vulnerability scanners (including certain online assessment websites) consider the presence of a not yet standardised feature to be important for security, even if the clients do not perform client-side downgrade or the server only supports current TLS protocols. Diff is loosely based on OpenSSL with some inspiration from BoringSSL. Discussed with beck@ and miod@. ok bcook@
* Remove useless variables and use the values directly.doug2015-02-071-5/+3
| | | | | | From OpenSSL commit 3d47c1d331fdc7574d2275cda1a630ccdb624b08. ok miod@, jsing@
* Add error handling for EVP_DigestInit_ex().doug2014-12-151-3/+4
| | | | | | | | | | | | | A few EVP_DigestInit_ex() calls were left alone since reporting an error would change the public API. Changed internal ssl3_cbc_digest_record() to return a value due to the above change. It will also now set md_out_size=0 on failure. This is based on part of BoringSSL's commit to fix malloc crashes: https://boringssl.googlesource.com/boringssl/+/69a01608f33ab6fe2c3485d94aef1fe9eacf5364 ok miod@
* Remove trailing whitespace.jsing2014-12-141-3/+3
|
* Update the GOST code in libssl, as contributed by Dmitry Eremin-Solenikov.miod2014-11-181-1/+13
| | | | | This causes a libssl major version bump as this affects the layout of some internal-but-unfortunately-made-visible structs.
* Sort and group includes.jsing2014-11-161-1/+3
|
* Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().jsing2014-10-181-4/+3
| | | | | | | | | | | | | | | arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
* Typical malloc() with size multiplication to reallocarray().doug2014-10-181-4/+4
| | | | ok deraadt@
* Oops, revert changes commited by mistake. The previous commit was supposedmiod2014-08-071-4/+3
| | | | to only apply to s23_srvr.c.
* When you expect a function to return a particular value, don't put a commentmiod2014-08-071-3/+4
| | | | | | | | | | | saying that you expect it to return that value and compare it against zero because it is supposedly faster, for this leads to bugs (especially given the high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this library). Instead, compare for the exact value it ought to return upon success. ok deraadt@
* Remove more compression related code.jsing2014-07-101-8/+1
|
* decompress libssl. ok beck jsingtedu2014-07-101-44/+1
|
* tedu the SSL export cipher handling - since we do not have enabled exportjsing2014-07-091-63/+1
| | | | | | ciphers we no longer need the flags or code to support it. ok beck@ miod@
* pedantic avoidance of division by zero, likely not actuallybeck2014-07-081-1/+6
| | | | | possible to hit for real. ok miod@ jsing@
* Pull the code that builds a DTLS sequence number out into its own functionjsing2014-06-211-20/+10
| | | | | | to avoid duplication. Also use fewer magic numbers. ok miod@
* Pull out the sequence number selection and handle this up front. Also, thejsing2014-06-211-9/+6
| | | | correct record is already known, so avoid reassignment.
* More KNF and clean up.jsing2014-06-211-13/+9
|
* Rename ssl3_record_sequence_update() to ssl3_record_sequence_increment(),jsing2014-06-151-19/+5
| | | | | | | so that it reflects what it is actually doing. Use this function in a number of places that still have the hand rolled version. ok beck@ miod@
* Correctly calculate the key block length when using export ciphers.jsing2014-06-131-1/+5
|
* Swap compress/expand around so they are in the correct order - these endedjsing2014-06-131-14/+14
| | | | up in the wrong order when the code was refactored.
* Combine the MAC handling for both !EVP_CIPH_FLAG_AEAD_CIPHER andjsing2014-06-131-14/+11
| | | | EVP_CIPH_FLAG_AEAD_CIPHER into the same if/else block.
* Add support for handling SSL_CIPHER_ALGORITHM2_AEAD ciphers, which arejsing2014-06-131-27/+238
| | | | | | | | | | | | | those that use EVP_AEAD instead ov EVP_CIPHER. This means being able to change cipher state with an EVP_AEAD and being able to encrypt/decrypt TLS using the EVP_AEAD. This has no change on existing non-SSL_CIPHER_ALGORITHM2_AEAD ciphers. Based on Adam Langley's chromium patches. Rides the recent libssl bump. Tested by sthen@
* Remove support for the `opaque PRF input' extension, which draft has expiredmiod2014-06-131-18/+1
| | | | | | | | 7 years ago and never made it into an RFC. That code wasn't compiled in anyway unless one would define the actual on-the-wire extension id bytes; crank libssl major. With help and enlightenment from Brendan MacDonell.
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-26 14:56:24 +0000