summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* This commit was manufactured by cvs2git to create tag 'OPENBSD_5_8_BASE'.OPENBSD_5_8_BASEcvs2svn2015-08-021-2423/+0
|
* Convert tls1_process_ticket to CBS.doug2015-07-241-28/+36
| | | | ok miod@ jsing@
* Convert tls1_process_sigalgs to CBS.doug2015-07-241-5/+14
| | | | ok miod@ jsing@
* Allow *_free() functions in libssl to handle NULL input.doug2015-07-191-1/+4
| | | | | | This mimics free()'s behavior which makes error handling simpler. ok bcook@ miod@
* Remove compat hack that disabled ECDHE-ECDSA on OS X.doug2015-07-171-85/+1
| | | | | | | | | For a few old releases, ECDHE-ECDSA was broken on OS X. This option cannot differentiate between working and broken OS X so it disabled ECDHE-ECDSA support on all OS X >= 10.6. 10.8-10.8.3 were the faulty releases but these are no longer relevant. Tested on OS X 10.10 by jsing. ok jsing@
* Convert tls1_alpn_handle_client_hello() to CBS.doug2015-06-191-20/+14
| | | | tweak + ok miod@ jsing@
* Convert ssl_next_proto_validate to CBS.doug2015-06-171-11/+12
| | | | ok miod@, tweak + ok jsing@
* Convert tls1_check_curve to CBS.doug2015-06-171-4/+10
| | | | ok miod@ jsing@
* Fix a minor information leak that was introduced in t1_lib.c r1.71, wherebyjsing2015-03-021-2/+2
| | | | | | | | | an additional 28 bytes of .rodata (or .data) is provided to the network. In most cases this is a non-issue since the memory content is already public. Issue found and reported by Felix Groebert of the Google Security Team. ok bcook@ beck@
* unifdef OPENSSL_NO_NEXTPROTONEG, which is one of the last standing #ifndefjsing2014-12-141-17/+1
| | | | | | | mazes in libssl. NPN is being replaced by ALPN, however it is still going to be around for a while yet. ok miod@
* Remove support for GOST R 34.10-94 signature authentication, along withjsing2014-12-101-4/+1
| | | | | | | the two ciphersuites that use it. GOST94 public/private keys have been long obsoleted and libcrypto does not have support for them anyway. Discussed with Dmitry Eremin-Solenikov.
* Add support for ALPN.jsing2014-12-101-3/+152
| | | | | | Based on OpenSSL and BoringSSL. ok bcook@
* Use appropriate internal types for EC curves and formats, rather thanjsing2014-12-061-103/+115
| | | | | | | | storing and processing in wire encoded form. Inspired by boringssl. ok miod@
* Ensure that the client specified EC curve list length is a multiple of two.jsing2014-12-061-2/+3
| | | | | | | | The EC curve handling code assumes this to be the case and will read one byte off the end of the curve list during processing, in the case where it is not. ok miod@
* Fix two cases where it is possible to read one or two bytes past the end ofjsing2014-12-061-3/+15
| | | | | | | the buffer. The later size check would catch this, however reading first and checking later is less than ideal. ok miod@
* Add brainpool curves to eccurves_default[], accidentally missing from 1.32;miod2014-12-021-2/+5
| | | | from OpenSSL HEAD via Thomas Jakobi.
* Update the GOST code in libssl, as contributed by Dmitry Eremin-Solenikov.miod2014-11-181-3/+36
| | | | | This causes a libssl major version bump as this affects the layout of some internal-but-unfortunately-made-visible structs.
* only call SRTP (whatever that is) functions when the connection type istedu2014-11-031-5/+5
| | | | DTLS (whatever that is) instead of for TLS too. ok jsing.
* Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().jsing2014-10-181-2/+1
| | | | | | | | | | | | | | | arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
* Only require an EC public key in tls1_set_ec_id(), if we need to providejsing2014-10-151-4/+4
| | | | | | | a compression identifier. In the case of a server using ephemeral EC keys, the supplied key is unlikely to have a public key where SSL_CTX_set_tmp_ecdh() is called after SSL_OP_SINGLE_ECDH_USE has been set. This makes ECDHE ciphers work again for this use case.
* Use more specific curves/formats naming for local variables injsing2014-10-051-30/+28
| | | | | | | ssl_add_clienthello_tlsext() and ssl_add_serverhello_tlsext(), rather than the current generic naming. ok miod@
* Use tls1_get_curvelist() in ssl_add_clienthello_tlsext(), rather thanjsing2014-10-051-11/+2
| | | | | | hand rolling the same code. ok miod@
* Make tls1_get_formatlist() behave the same as tls1_get_curvelist() andjsing2014-10-051-21/+29
| | | | | | | | return the client format list if the client_formats flag is specified. Use tls1_get_formatlist()/tls1_get_curvelist() in tls1_check_ec_key(), simplifying the code. ok miod@
* Add support for automatic ephemeral EC keys.jsing2014-10-031-3/+38
| | | | | | | | | | This allows an SSL server to enable ECDHE ciphers with a single setting, which results in an EC key being generated using the first preference shared curve. Based on OpenSSL with inspiration from boringssl. ok miod@
* Clean up EC cipher handling in ssl3_choose_cipher().jsing2014-09-301-3/+132
| | | | | | | | | | | The existing code reaches around into various internals of EC, which it should not know anything about. Replace this with a set of functions that that can correctly extract the necessary details and handle the comparisions. Based on a commit to OpenSSL, with some inspiration from boringssl. ok miod@
* Check that the specified curve is one of the client preferences.jsing2014-09-271-1/+44
| | | | | | Based on OpenSSL. ok miod@
* Now that we have a static version of the default EC formats, also use itjsing2014-09-261-47/+44
| | | | | | | | for the server hello. From OpenSSL. ok miod@
* Refactor and simplify the ECC extension handling. The existing codejsing2014-09-221-101/+97
| | | | | | | | | effectively built two "static" data structures - instead of doing this, just use static data structures to start with. From OpenSSL (part of a larger commit). ok miod@
* Move the TLS padding extension under an SSL_OP_TLSEXT_PADDING option, whichjsing2014-09-211-8/+13
| | | | | | | | | | | | | | | is off by default (instead of being enabled unconditionally). The TLS padding extension was added as a workaround for a bug in F5 SSL terminators, however appears to trigger bugs in IronPort SMTP appliances. Now the SSL client gets to choose which of these devices it wants to trigger bugs in... Ported from OpenSSL. Discussed with many. ok miod@
* Correct test reversed during merge of fix for CVE-2014-3509guenther2014-08-071-2/+2
| | | | | pointed out by Watson Ladd (watson (at) matasano.com) ok deraadt@
* merge fix for CVE-2014-3509 -- basically a missing s->hit check; ok guentherderaadt2014-08-061-9/+13
|
* Expand the tlsext_sigalg macros. The end result is about the same numberjsing2014-07-131-16/+19
| | | | | | of lines and much more readable. ok miod@
* The bell tolls for BUF_strdup - Start the migration to usingbeck2014-07-131-2/+3
| | | | | | intrinsics. This is the easy ones, a few left to check one at a time. ok miod@ deraadt@
* The correct name for EDH is DHE, likewise EECDH should be ECDHE.jsing2014-07-121-4/+4
| | | | | | Based on changes to OpenSSL trunk. ok beck@ miod@
* remove unused, private version strings except SSL_version_strbcook2014-07-091-3/+1
| | | | | | Also remove unused des_ver.h, which exports some of these strings, but is not installed. ok miod@ tedu@
* convert CRYPTO_memcmp to timingsafe_memcmp based on current policy favoringtedu2014-06-191-3/+3
| | | | | | libc interfaces over libcrypto interfaces. for now we also prefer timingsafe_memcmp over timingsafe_bcmp, even when the latter is acceptable. ok beck deraadt matthew miod
* Make sure to always invoke EVP_CIPHER_CTX_cleanup() before returning in themiod2014-06-181-4/+10
| | | | | | error paths from tls_decrypt_ticket(). ok tedu@
* Remove support for the `opaque PRF input' extension, which draft has expiredmiod2014-06-131-213/+1
| | | | | | | | 7 years ago and never made it into an RFC. That code wasn't compiled in anyway unless one would define the actual on-the-wire extension id bytes; crank libssl major. With help and enlightenment from Brendan MacDonell.
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* Sanitize use of client_opaque_prf_input: set it to NULL immediately aftermiod2014-06-041-18/+22
| | | | | | | | | | free()ing it, rather than in conditional code. Also do not bother setting server_opaque_prf_input (server, not client) to NULL in conditional code 10 lines after explicitely free()ing it and setting it to NULL (were the developers afraid of zombie pointers?) ok guenther@
* without overthinking it, replace a few memcmp calls with CRYPTO_memcmptedu2014-06-041-1/+1
| | | | where it is feasible to do so. better safe than sorry.
* ECDH and ECDSA will not work overly well if there is no EC, so unifdefjsing2014-05-311-22/+0
| | | | | | OPENSSL_NO_EC. ok tedu@
* TLS would not be entirely functional without extensions, so unifdefjsing2014-05-311-6/+0
| | | | | | OPENSSL_NO_TLSEXT. ok tedu@
* remove some #if 0 code. we don't need any more reminders that we're usingtedu2014-05-301-36/+0
| | | | a not quite appropriate data structure. ok jsing
* Make use of SSL_IS_DTLS, SSL_USE_EXPLICIT_IV, SSL_USE_SIGALGS andjsing2014-05-301-3/+4
| | | | | | SSL_USE_TLS1_2_CIPHERS. Largely based on OpenSSL head.
* unidef DH, ECDH, and ECDSA. there's no purpose to a libssl without them.tedu2014-05-291-10/+0
| | | | ok deraadt jsing
* Make it substantially easier to identify protocol version requirementsjsing2014-05-291-0/+38
| | | | | | | | | | | | | | by adding an enc_flags field to the ssl3_enc_method, specifying four flags that are used with this field and providing macros for evaluating these conditions. Currently the version requirements are identified by continually checking the version number and other criteria. This change also adds separate SSL3_ENC_METHOD data for TLS v1.1 and v1.2, since they have different enc_flags from TLS v1. Based on changes in OpenSSL head. No objection from miod@
* There is no point in checking if a pointer is non-NULL before calling free,jsing2014-05-281-32/+18
| | | | | | | | since free already does this for us. Also remove some pointless NULL assignments, where the result from malloc(3) is immediately assigned to the same variable. ok miod@
* Replace the following logic:miod2014-05-261-26/+39
| | | | | | | | | | | | | | | | | | | | | if (nothing to allocate) ptr = malloc(1) else { if ((ptr = malloc(size to allocate)) memcpy(ptr, data to copy, size to allocate) } if (ptr == NULL) OMG ERROR with a saner logic where the NULL pointer check if moved to the actual malloc branch, so that we do not need to malloc a single byte, just to avoid having a NULL pointer. Whoever thought allocating a single byte was a smart idea was obviously not taking his meds. ok beck@ guenther@
* tls_decrypt_ticket(): memory leak and uncleaned EVP_CIPHER_CTX upon error.miod2014-05-261-1/+4
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-23 20:45:17 +0000