summaryrefslogtreecommitdiff
path: root/src/lib/libssl/tls13_buffer.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-09-15The undocumented public function SSL_set_SSL_CTX(3) changes theschwarze1-4/+4
context used by an SSL object, so do not talk about the SSL_CTX that "an SSL object was created from"; fixing an inaccuracy pointed out by jsing@.
2020-09-15Split the tls12_record_layer_write_mac() function.jsing1-10/+19
Split the existing tls12_record_layer_write_mac() function so that we can soon reuse part of it for the read side. No functional change. ok tb@
2020-09-15Do not destroy an existing cipher list when ssl_parse_ciphersuites()schwarze1-4/+2
fails, to match the behaviour of ssl_create_cipher_list(). This also agrees with the behaviour of SSL_set_ciphersuites(3) in OpenSSL. Issue found while writing documentation. OK jsing@
2020-09-15Correct a failure case in tls12_record_layer_seal_record_protected()jsing1-2/+2
This should be a 'goto err' rather than returning.
2020-09-15Create the missing RETURN VALUES section and move the appropriateschwarze1-57/+103
content there. Clarify when the returned pointers become invalid, which is far from obvious but sets surprising traps for the user. For three of the functions, correct statements about when they fail. Also improve a number of wordings while here. OK beck@
2020-09-15set error_depth and current_cert to make more legacy callbacks that don't checkbeck1-1/+3
happy ok tb@
2020-09-15Deduplicate the time validation code between the legacy and newbeck3-27/+8
verification code. ok jsing@
2020-09-15ifdef out code that is no longer used in here. once we are certainbeck1-2/+5
of staying with the new name constraint code this will be deleted ok jsing@
2020-09-15Cleanup/simplify SSL_set_ssl_method().jsing1-18/+18
In particular, figure what the handshake_func should be early on, so we can just assign later. ok beck@
2020-09-15Mop up the get_ssl_method function pointer.jsing2-50/+2
Now that get_ssl_method is no longer used, we can garbage collect the function pointer and some associated machinery. ok beck@
2020-09-15Test botan TLS client with libressl, openssl, openssl11 server.bluhm4-6/+305
2020-09-14Move state initialisation from SSL_clear() to ssl3_clear().jsing2-4/+4
If we use the default method (now TLSv1.3) and end up talking to a TLSv1.2 server that gives us a session ticket, then try to resume that session, we end up trying to talk TLS without doing a handshake. This is caused by the state (S3I(s)->hs.state) getting cleared, which results in SSL_do_handshake() and others thinking they do not need to do anything (as SSL_in_init() and SSL_in_before() are not true). The reason this occurs is due to SSL_set_ssl_method() calling ssl_free() and ssl_new() when switching methods. The end result is that the S3I(s) has been freed and reallocated, losing the state in the process. Since the state is part of the S3I(s) structure, move its initialisation into ssl3_clear() - this ensures it gets correctly reinitialised across a SSL_set_ssl_method() call. Issue noticed by sthen@ with nginx and unifi. ok beck@ tb@
2020-09-14Cleanup and simplify SSL_set_session().jsing1-36/+22
SSL_set_ssl_method() checks to see if the method is already the same, so we do not need to do this check in three different places. Switch to dtls1_get_client_method()/tls1_get_client_method() to find the method - this is a slight change in behaviour, however there is not much point trying to resume a session on something other than a client. ok beck@
2020-09-14Avoid NULL deref SSL_{,CTX_}set_ciphersuitestb1-2/+2
Move assignment to the correct place so that the run continuation condition actually checks what it is supposed to. Found by getting lucky when running regress. ok beck jsing
2020-09-14simplify RETURN VALUES for x509_verify(3) after beck@ made the rulesschwarze1-7/+3
simpler and more consistent in x509_verify.c rev. 1.6; OK beck@