summaryrefslogtreecommitdiff
path: root/src/lib/libssl/tls13_internal.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Wire up the servername callback in the TLSv1.3 server.jsing2020-05-291-1/+2
| | | | | | | | This makes SNI work correctly with TLSv1.3. Found the hard way by danj@, gonzalo@ and others. ok beck@ inoguchi@ tb@
* Provide the option to retry or return after post-handshake messages.jsing2020-05-231-1/+2
| | | | | | | | | | | In TLSv1.3 post-handshake handshake messages are used for key updates and session tickets. These are in-band and mean that when the upper layer goes to read application data, we can end up reading and having to process handshake messages - this option changes whether we retry and read the next TLS record, or if we return, signalling that we want more data to be available. ok beck@ inoguchi@ tb@
* Add support for TLS 1.3 server to send certificate statusbeck2020-05-191-2/+3
| | | | | | messages with oscp staples. ok jsing@ tb@
* Add TLS13_ERR_NO_CERTIFICATE.jsing2020-05-161-2/+3
| | | | | | This was missed in previous tls13_server.c commit. ok inoguchi@ tb@
* Propagate record overflows to the record layer and alert.jsing2020-05-111-1/+2
| | | | ok beck@ tb@
* Add record version checks.jsing2020-05-111-12/+13
| | | | | | | | When legacy version is below TLSv1.2 ensure that the record version is SSL3/TLS, however when the legacy version is set to TLSv1.2 require this specifically. ok beck@ tb@
* Provide an alert sent record layer callback.jsing2020-05-111-1/+2
| | | | | | | | Use this to push an error on to the SSL error stack so that we report the details of the alert that we sent, rather than failing with an unknown error. ok tb@
* Move the record layer callbacks into a struct.jsing2020-05-111-5/+11
| | | | | | | | This makes the code more readable, requires less code churn when adding a new callback and is likely to avoid bugs due to function argument ordering. ok beck@ inoguchi@ tb@
* Send dummy ChangeCipherSpec messages from the TLSv1.3 servertb2020-05-101-1/+3
| | | | | | | | | | | | | | | If the client has requested middle box compatibility mode by sending a non-empty legacy_session_id, the server must send a dummy CCS right after its first handshake message. This means right after ServerHello or HelloRetryRequest. Two important improvements over the backed-out diffr: make sure that First: client and server can send their dummy CCS at the correct moment (right before the next flight or right after the current flight). Second: as jsing noted, we also need to deal with the corner case that tls13_send_dummy_ccs() can return TLS13_IO_WANT_POLLOUT. with/ok jsing
* Honour SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the TLSv1.3 server.jsing2020-05-101-1/+2
| | | | ok beck@
* Provide alert defines for TLSv1.3 and use in the TLSv1.3 code.jsing2020-05-101-1/+32
| | | | | | | | Rather than using a mess of SSL_AL_*, SSL_AD_*, SSL3_AD_* and TLS1_AD_* defines, provide our own TLS13_ALERT_* defines and use those. This also provides the alerts that are new to TLSv1.3. ok beck@
* Back out server side CCS sending. It breaks TLSv1.3 client communicationtb2020-05-091-2/+1
| | | | | | | | with TLSv1.2 servers, since it makes clients send their dummy CCS too early... There's an obvious but dirty bandaid which I can't bring myself to applying - this business is already disgusting enough. Issue found the hard way by sthen
* Send dummy ChangeCipherSpec messages from the TLSv1.3 servertb2020-05-091-1/+2
| | | | | | | | | If the client has requested middle box compatibility mode by sending a non-empty legacy_session_id, the server must send a dummy CCS right after its first handshake message. This means right after ServerHello or HelloRetryRequest. ok jsing
* Send dummy ChangeCipherSpec messages from the TLSv1.3 client.jsing2020-05-091-1/+3
| | | | | | | | When operating in middlebox compatibility mode, the TLSv1.3 client needs to send a dummy ChangeCipherSpec message immediately before its second flight of handshake messages (when early data is not offered). ok tb@
* Add a middlebox_compat flag and condition session ID randomisation on it.jsing2020-05-091-1/+2
| | | | ok tb@
* Add support for certificate status requests in TLS 1.3 clientbeck2020-05-091-1/+3
| | | | ok jsing@, tb@, inoguchi@
* Move legacy stack interfacing functions into tls13_legacy.c.jsing2020-04-281-1/+8
| | | | | | No functional change. ok inoguchi@ tb@
* Rename tls13_client_synthetic_handshake_message() and move to tls13_lib.c.jsing2020-04-281-1/+2
| | | | | | | | The server-side will need to use the same function. No functional change. ok inoguchi@ tb@
* Improve TLSv1.3 state machine for HelloRetryRequest handling.jsing2020-04-221-3/+3
| | | | | | | | | | | | | | | | | | | The state machine currently handles the HelloRetryRequest case by using WITH_HRR - in other words, we're explicitly indicating when we transition to the alternate path. The problem here is that we do not know if we're going to receive a ServerHello or a HelloRetryRequest until we process the message. This means that the ServerHello processing code has to handle both types of messages. The state machine and associated processing code becomes cleaner if we flip this around so that we assume we are going to receive a HelloRetryRequest and upon discovering that it is not, trigger WITHOUT_HRR and hand off to the ServerHello processing function. In particular, this makes the logic much more straight forward on the server side, when adding support for HRR. With feedback from tb@ ok tb@
* Consolidate TLSv1.3 constants.jsing2020-04-211-6/+7
| | | | | | | Move all of the TLSv1.3 constants to the top of tls13_lib.c. Also mark these all as const so that they end up in .rodata rather than .data. ok tb@
* Expose the peer ephemeral public key used for TLSv1.3 key exchange.jsing2020-04-181-1/+2
| | | | | | | | | SSL_get_server_tmp_key() provides the peer ephemeral public key used for key exchange. In the case of TLSv1.3 this is essentially the peer public key from the key share used for TLSv1.3 key exchange, hence make it availaable via SSL_get_server_tmp_key(). ok inoguchi@ tb@
* Generate client key share using our preferred group.jsing2020-04-171-2/+3
| | | | | | | | Generate a client key share using our preferred group, rather than always using X25519. This means that the key share group can be controlled via SSL{_CTX,}_set1_groups() and SSL{_CTX,}_set1_groups_list(). ok beck@
* Remove some unnecessary handshake enums/functions.jsing2020-03-101-3/+1
| | | | | | | Both session tickets and key updates are post-handshake handshake messages, which were originally included in the handshake code. ok inoguchi@ tb@
* Pull the handshake message transcript code into its own function.jsing2020-02-051-1/+2
| | | | | | This is soon going to be used in the TLSv1.3 client code. ok tb@
* Rework tls13_legacy_handshake_message_{recv,sent}_cb() to usetb2020-02-051-2/+2
| | | | | | their own CBS as a preparation for upcoming HRR diffs. ok jsing
* Provide struct/functions for handling TLSv1.3 key shares.jsing2020-01-301-1/+23
| | | | | | | Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
* Move pad and verify context into tls13_lib.cbeck2020-01-261-1/+6
| | | | ok jsing@
* Add an underbar for consistency.tb2020-01-251-2/+2
|
* Support legacy message callbacks. First step for SSL_set_msg_callback(3)tb2020-01-251-1/+5
| | | | | | support. Makes openssl s_client -msg work for handshake messages. ok beck jsing
* It is possible to receive a pre-TLSv1.3 alert in response to a TLSv1.3jsing2020-01-251-1/+2
| | | | | | | | | | | | client hello. Allow pre-TLSv1.3 alerts (including warnings) to be received before the server hello message. Disallow pre-TLSv1.3 alerts as soon as we know that we are using TLSv1.3. Noticed by ajacoutot@ while connecting to www.openprinting.org. ok tb@
* Complete the initial TLSv1.3 implementation.jsing2020-01-241-1/+2
| | | | ok beck@ tb@
* Switch to encrypted records in the TLSv1.3 server.jsing2020-01-241-1/+2
| | | | | | | This adds code to perform key derivation and set the traffic keys once the ServerHello message has been sent, enabling encrypted records. ok beck@ tb@
* Fix breakage in SSL_connect, SSL_accept, etc. by not propagatingbeck2020-01-241-2/+3
| | | | | | | | | new retry conditions from the record layer all the way up to the callers. Instead we catch them at the top of the record layer and retry the operations, unless we actually got a retry indicated from actual IO operations. ok jsing@ tb@
* Implement client hello processing in the TLSv1.3 server.jsing2020-01-231-4/+5
| | | | ok beck@
* Add checking int the client to check the magic values which arebeck2020-01-231-1/+4
| | | | | | | set by a 1.3 server when it downgrades to tls 1.2 or 1.1 as per RFC 8446 section 4.1.3 ok jsing@
* Implement pending for TLSv1.3.jsing2020-01-231-1/+3
| | | | | | Makes `openssl s_client -peekaboo` work with TLSv1.3. ok beck@ tb@
* Add a TLS13_IO_ALERT return value so that we can explicitly signal whenjsing2020-01-231-4/+5
| | | | | | | | | | we sent or received a fatal alert. Pull the fatal_alert check up into tls13_legacy_error(). Also, if sending an alert resulted in EOF, do not propagate this back since we do not want to signal EOF to the caller (rather we want to indicate failure). ok beck@ tb@
* Pass a CBB to TLSv1.3 send handlers.jsing2020-01-231-15/+15
| | | | | | | This avoids the need for each send handler to call tls13_handshake_msg_start() and tls13_handshake_msg_finish(). ok beck@ tb@
* Pass a handshake message content CBS to TLSv1.3 receive handlers.jsing2020-01-221-15/+16
| | | | | | | | | This avoids every receive handler from having to get the handshake message content itself. Additionally, pull the trailing data check up so that each receive handler does not have to implement it. This makes the code more readable and reduces duplication. ok beck@ tb@
* Implement support for SSL_peek() in the TLSv1.3 record layer.jsing2020-01-221-1/+2
| | | | ok beck@ tb@
* After the ClientHello has been sent or received and before the peer'stb2020-01-221-1/+2
| | | | | | | | Finished message has been received, a change cipher spec may be received and must be ignored. Add a flag to the record layer struct and set it at the appropriate moments during the handshake so that we will ignore it. ok jsing
* The legacy_record_version must be set to TLS1_2_VERSION excepttb2020-01-221-1/+4
| | | | | | | | | in the ClientHello where it may be set to TLS1_VERSION. Use the minimal supported version to decide whether we choose to do so or not. Use a sent hook to set it back TLS1_2_VERSION right after the ClientHello message is on the wire. ok beck jsing
* Add minimal support for hello retry request for RFC conformance.beck2020-01-221-1/+2
| | | | | | We currently don't support sending a modified clienthello ok jsing@ tb@
* Implement close-notify and SSL_shutdown() handling for the TLSv1.3 client.jsing2020-01-221-1/+6
| | | | ok beck@ inoguchi@ tb@
* Correct legacy fallback for TLSv1.3 client.jsing2020-01-211-1/+2
| | | | | | | | | When falling back to the legacy TLS client, in the case where a server has sent a TLS record that contains more than one handshake message, we also need to stash the unprocessed record data for later processing. Otherwise we end up with missing handshake data. ok beck@ tb@
* Add alert processing in tls client code, by adding alert to thebeck2020-01-211-1/+2
| | | | | | | tls13 context, and emiting the alert at the upper layers when the lower level code fails ok jsing@, tb@
* Provide an error framework for use with the TLSv1.3 code.jsing2020-01-201-1/+28
| | | | | | | This is based on the libtls error handling code, but adds machine readable codes and subcodes. We then map these codes back to libssl error codes. ok beck@ inoguchi@
* Add support for TLS 1.3 post handshake messages and key updating.beck2019-11-261-5/+14
| | | | | | tested against openssl 1.1's server. ok jsing@ tb@
* Add accessors to change the buffer in a handshake message.beck2019-11-201-1/+3
| | | | | | Needed for doing TLS 1.3 Post Handshake Handshake messages. ok jsing@
* Add prototypes for the functions that update application secretsbeck2019-11-181-1/+3
| | | | so that the regress tests will work for them
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-18 19:53:51 +0000