summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Make internal header file names consistenttb2022-11-261-2/+2
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Get rid of SSL_CTX_INTERNAL and SSL_INTERNAL.jsing2022-10-021-53/+53
| | | | | | | | These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@
* Refactor tls1_get_supported_group()tb2022-08-171-28/+95
| | | | | | | | | | | | | This splits tls1_get_supported_group() into a few helper functions to be able to count shared groups and to return the n-th shared group since someone thought it is a great idea to expose that in a single API and some others thought it is useful to add this info to log noise. This is all made a bit more complicated thanks to the security level having its tentacles everywhere and because a user-provided security callback can influence the list of groups shared by the peers. ok jsing
* Make tls1_get_{format,group_}list() take a const SSLtb2022-08-171-3/+3
| | | | ok jsing
* Simplify tls1_ec_nid2group_id()tb2022-07-031-98/+10
| | | | | | | Replace long switch statement duplicating data from nid_list[] with a linear scan. requested by and ok jsing
* Simplify tls1_ec_group_id2{bits,nid}()tb2022-07-031-9/+9
| | | | | | | Instead of a nonsensical NULL check, check nid_list[group_id].{bits,nid} is not 0. This way we can drop the group_id < 1 check. ok jsing
* Rename uses 'curve' to 'group' and rework tls1 group API.tb2022-07-021-116/+158
| | | | | | | | | | This reworks various tls1_ curve APIs to indicate success via a boolean return value and move the output to an out parameter. This makes the caller code easier and more consistent. Based on a suggestion by jsing ok jsing
* Fix off-by-one in length check.tb2022-07-021-3/+3
| | | | Spotted by jsing
* Make tls1_ec_curve_id2nid() return explicit NID_undef instead of 0 on errortb2022-07-021-3/+3
| | | | | | and adjust the only caller that didn't check for NID_undef already. ok beck jsing
* Remove redundant commentstb2022-06-301-30/+30
| | | | discussed with jsing
* Check security level for supported groups.tb2022-06-301-32/+149
| | | | ok jsing
* Garbage collect the unused rv in tls1_check_ec_server_key() andtb2022-01-241-3/+2
| | | | | | convert to usual form of error checking. ok inoguchi jsing
* Rename CERT to SSL_CERT and CERT_PKEY to SSL_CERT_PKEY.jsing2022-01-081-3/+3
| | | | | | | Nearly all structs in libssl start with an SSL_ suffix, rename CERT and CERT_PKEY for consistency. ok inoguchi@ tb@
* Stop reaching into EVP_PKEY in the rest of libssl.tb2021-11-261-5/+6
| | | | ok inoguchi jsing
* Fold SSL_SESSION_INTERNAL back into SSL_SESSION.jsing2021-10-251-5/+5
| | | | ok beck@ tb@
* Merge SSL_METHOD_INTERNAL into SSL_METHOD.jsing2021-07-011-3/+3
| | | | | | | Now that SSL_METHOD is opaque and in internal headers, we can remove SSL_METHOD_INTERNAL by merging it back into SSL_METHOD. ok tb@
* Indent all labels with a single space.jsing2021-06-111-2/+2
| | | | | | This ensures that diff reports the correct function prototype. Prompted by tb@
* Make local header inclusion consistent.jsing2021-05-161-3/+2
| | | | | Consistently include local headers in the same location, using the same grouping/sorting across all files.
* Mark nid_list[] const. This moves 116 bytes to .rodata.tb2020-12-051-2/+2
| | | | ok jsing kn
* SSL3_ENC_METHOD is just a flag word; merge it into SSL_METHOD_INTERNALguenther2020-10-111-14/+1
| | | | | | | with #defines for the per-version initializers instead of extern globals. Add SSL_USE_SHA256_PRF() to complete the abstraction. ok tb@ jsing@
* Mop up various things that are now unused with the new record layer.jsing2020-10-071-4/+4
| | | | ok inoguchi@ tb@
* Simplify tls1_set_ec_id() a bittb2020-09-121-24/+19
| | | | | | | Use more descriptive variable names, explain why NID_undef is fine and simplify the logic. ok beck jsing
* Garbage collect renew_ticket in tls_decrypt_tickettb2020-09-071-8/+5
| | | | | | | | | | | | This is only set in one place and read in one place to set the badly named tlsext_ticket_expected flag. It seems preferable to set this flag directly, thus simplifying the logic. This slightly changes the behavior in that this flag is now set earlier, but this seems preferable anyway. Any error between the old and the new position where the flag is set is either fatal (so the connection will be closed) or a decrypt error (so the flag will be set). discussed with jsing
* copy session id directly in ssl_get_prev_sessiontb2020-09-011-21/+5
| | | | | | | | | | | | ssl_get_prev_session() hands the session id down to tls_decrypt_ticket() which then copies it into the session pointer that it is about to return. It's a lot simpler to retrieve the session pointer and copy the session id inside ssl_get_prev_session(). Also, 'goto err' directly in TLS1_TICKET_NOT_DECRYPTED instead of skipping a couple of long if clauses before doing so. ok inoguchi jsing
* Hoist ERR_clear_error() call into the derr: labeltb2020-09-011-4/+2
| | | | | | | | | The only path that sets TLS1_TICKET_NOT_DECRPYTED is through this label and the ERR_clear_error() is called conditionally on this. We clear the errors to make decrypt errors non-fatal. The free functions should not set the errors and if they do, we don't want to hide that. discussed with jsing
* simplify tls1_process_ticket() exit pathtb2020-09-011-17/+6
| | | | | | | | | | | | | | | | tls1_process_ticket() - the only caller of tls_decrypt_ticket() - ends in a switch over the return value of tls_decrypt_ticket() to decide whether or not to set s->internal->tlsext_ticket_expected = 1. Since tls_decrypt_ticket() already knows what it will return and partly bases its decision on what to return on whether or not the ticket needs to be renewed, it can also take care of setting this flag. This way we don't need to have a confusing switch that conflates some return values and sets this flag. Moreover, we can get rid of the ugly TLS1_TICKET_DECRYPTED_RENEW whose only purpose is to signal that the flag should be set. ok jsing
* Return code tweaks for session ticket handlerstb2020-08-311-37/+36
| | | | | | | | In tls1_process_ticket() and tls_decrypt_ticket() use #defines with descriptive names instead of hardcoding -1 1 2 3 4 and occasionally explaining the magic numbers with comments. ok beck inoguchi
* Send alert on ssl_get_prev_session failuretb2020-08-311-8/+18
| | | | | | | | | | | | ssl_get_prev_session() can fail for various reasons some of which may be internal_error others decode_error alerts. Propagate the appropriate alert up to the caller so we can abort the handshake by sending a fatal alert instead of rudely closing the pipe. Currently only 28 of 292 test cases of tlsfuzzer's test-extension.py pass. With this diff, 272 pass. The rest will require fixes elsewhere. ok beck inoguchi jsing
* Add P-521 to the list of curves supported by default in the client.jsing2020-08-091-5/+18
| | | | | | | | | | | | | | | A certain VPN provider appears to have configured their servers to only accept P-521 for TLSv1.3 key exchange. The particular VPN software in use also does not currently allow for the TLSv1.3 key share groups to be configured, which means that there is no way to easily use LibreSSL in this situation. Include P-521 in the list of curves that are supported by default in the client, in order to increase interoperability. Discussed at length with beck@, inoguchi@ and tb@. ok tb@
* Remove some unnecessary function pointers from SSL_METHOD_INTERNAL.jsing2020-07-071-9/+1
| | | | | | ssl_version is completely unused and get_timeout is the same everywhere. ok beck@ inoguchi@ tb@
* Mop up servername_done, which is unused.jsing2020-05-291-5/+1
| | | | ok beck@ inoguchi@ tb@
* Use size_t for OCSP response length.jsing2020-05-101-5/+4
| | | | | | | | | The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@
* Remove the enc function pointers.jsing2020-03-101-4/+1
| | | | | | | The enc function pointers do not serve any purpose these days - remove a layer of indirection and call dtls1_enc()/tls1_enc() directly. ok inoguchi@ tb@
* Use calloc/freezero when allocating and freeing the session ticket data.jsing2019-04-251-4/+6
| | | | | | The decrypted session ticket contains key material. ok tb@
* Use EVP_CIPHER_CTX_{new,free}() and HMAC_CTX_{new,free}() instead ofjsing2019-04-251-24/+29
| | | | | | | | | allocating on stack. While here also check the return values from EVP_DecryptInit_ex() and HMAC_Init_ex(). ok tb@
* Rename some variables in tls_decrypt_ticket().jsing2019-04-251-18/+18
| | | | | | | | | Rename mlen to hlen since it is a hmac (and this matches hctx and hmac). Rename ctx to cctx since it is a cipher context and ctx is usually used to mean SSL_CTX in this code. ok tb@
* Convert tls_decrypt_ticket() to CBS.jsing2019-04-231-44/+72
| | | | | | This removes various pointer arithmetic and manual length checks. ok tb@
* Provide a derr label (decode/decrypt error) in tls1_decrypt_ticket().jsing2019-04-221-41/+29
| | | | | | This handles the ret = 2 case and makes the code more readable. ok tb@
* Pass the session ID down to the session/ticket handling code as a CBS.jsing2019-04-221-18/+20
| | | | | | | | | Convert ssl_get_prev_session(), tls1_process_ticket() and tls1_decrypt_ticket() to handle the session ID from the client hello as a CBS. While here also swap the order of arguments for tls1_decrypt_ticket() so that it is consistent with the other functions. ok tb@
* Inline and remove the tlsext_tick_md macro.jsing2019-04-221-2/+2
| | | | | | | There is not much point having a tlsext_tick_md macro that replaces EVP_sha256() in two places, when the cipher is just hardcoded. ok tb@
* Clean up tls1_process_ticket().jsing2019-04-211-39/+43
| | | | | | | | We only have to find one extension, so do that first then proceed with processing and decryption. This makes the code more readable and drops two levels of indent. ok tb@
* Cleanup more of tls_decrypt_ticket().jsing2019-04-211-5/+9
| | | | | | | | | | | Separate the malloc() check and EVP_DecryptUpdate() - the malloc() failure is fatal while a EVP_DecryptUpdate() is a decryption failure. Also ensure that we clear the error stack in all cases where we are indicating a failure to decrypt or decode the ticket - otherwise SSL_error() while later return failure when it should not. ok tb@
* Start cleaning up tls_decrypt_ticket().jsing2019-04-211-58/+63
| | | | | | | | | Rather than returning from multiple places and trying to clean up as we go, move to a single exit point and clean/free in one place. Also invert the logic that handles NULL sessions - fail early, rather than having an indented if test for success. ok tb@
* tls1_process_sigalgs() is no longer needed.jsing2019-03-251-55/+1
| | | | ok beck@
* Modify sigalgs extension processing to accomodate TLS 1.3.beck2019-01-231-5/+5
| | | | | | | | | | - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2. - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 from a 1.3 handshake. ok jsing@ tb@
* revert previous, accidentally contained another diff in additionbeck2019-01-231-5/+5
| | | | to the one I intended to commit
* Modify sigalgs extension processing for TLS 1.3.beck2019-01-231-5/+5
| | | | | | | | | - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@
* Stop keeping track of sigalgs by guessing it from digest and pkey,beck2018-11-101-19/+23
| | | | | | just keep the sigalg around so we can remember what we actually decided to use. ok jsing@
* Reimplement the sigalgs processing code into a new implementationbeck2018-11-091-173/+18
| | | | | that will be usable with TLS 1.3 with less eye bleed. ok jsing@ tb@
* Stop pretending that a cert member in a SSL and SSL_CTX can be NULL.jsing2018-11-081-5/+1
| | | | ok beck@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-25 18:11:56 +0000