summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Convert legacy server kex to one-shot sign/verifytb2023-06-112-47/+62
| | | | | | | | | | This converts ssl3_{get,send}_server_key_exchange() to EVP_DigestVerify() and EVP_DigestSign(). In order to do this, build the full signed_params up front and rework the way the key exchange parameters are constructed. This way we can do the verify and sign steps in one go and at the same use a more idiomatic approach with CBB/CBS. with/ok jsing
* Easy EVP_Digest{Sign,Verify} conversions for legacy stacktb2023-06-112-23/+8
| | | | | | | Convert ssl3_send_client_verify_{sigalgs,gost}() to EVP_DigestSign() and ssl3_get_cert_verify() to EVP_DigestVerify(). ok jsing
* Convert EVP_Digest{Sign,Verify}* to one-shot for TLSv1.3tb2023-06-102-22/+10
| | | | | | | Using one-shot EVP_DigestSign() and EVP_DigestVerify() is slightly shorter and is needed for Ed25519 support. ok jsing
* Move verified_chain from SSL to SSL_HANDSHAKEtb2023-05-264-14/+17
| | | | | | | | This is a better version of the fix for the missing pointer invalidation but a bit larger, so errata got the minimal fix. tested by jcs ok jsing
* add missing pointer invalidationjcs2023-05-161-1/+2
| | | | ok tb
* Use -Wshadow with clangtb2023-05-051-2/+2
| | | | ok jsing (a very long time ago)
* Too many stupid things whine about these being used uninitializedtb2023-04-281-2/+2
| | | | (which they aren't), so appease them.
* ssl_tlsext.c: Add an accessor for the tls extension type.tb2023-04-271-1/+7
| | | | | | Needed for the tlsexttest.c ok jsing
* Bump majors after symbol addition and removaltb2023-04-251-2/+2
|
* Fix allocation sizetb2023-04-251-3/+3
| | | | Reported by anton
* Unbreak tree: file missed in last committb2023-04-251-1/+3
| | | | Reported by anton
* Free and calloc() the tlsext_build_order and remember its lengthtb2023-04-241-2/+14
| | | | | | | Aligns tlsext_randomize_build_order() with tlsext_linearize_build_order() and will help regression testing. ok jsing
* Use TLSEXT_TYPE_alpn instead of the stupid long onetb2023-04-241-2/+2
|
* Randomize the order of TLS extensionstb2023-04-234-5/+71
| | | | | | | | | | | | | | | | | | | | | On creation of an SSL using SSL_new(), randomize the order in which the extensions will be sent. There are several constraints: the PSK extension must always come last. The order cannot be randomized on a per-message basis as the strict interpretation of the standard chosen in the CH hashing doesn't allow changing the order between first and second ClientHello. Another constraint is that the current code calls callbacks directly on parsing an extension, which means that the order callbacks are called depends on the order in which the peer sent the extensions. This results in breaking apache-httpd setups using virtual hosts with full ranomization because virtual hosts don't work if the SNI is unknown at the time the ALPN callback is called. So for the time being, we ensure that SNI always precedes ALPN to avoid issues until this issue is fixed. This is based on an idea by David Benjamin https://boringssl-review.googlesource.com/c/boringssl/+/48045 Input & ok jsing
* Document the RETURN VALUES of BIO_method_type(3) and BIO_method_name(3)schwarze2023-04-111-2/+11
| | | | for the various BIO types.
* Crankl libcrypto/libssl/libtls minors after symbol additiontb2023-03-101-1/+1
|
* libressl *_namespace.h: adjust *_ALIAS() to require a semicolontb2023-02-162-7/+7
| | | | | | | | | | LCRYPTO_ALIAS() and LSSL_ALIAS() contained a trailing semicolon. This does not conform to style(9), breaks editors and ctags and (most importantly) my workflow. Fix this by neutering them with asm("") so that -Wpedantic doesn't complain. There's precedent in libc's namespace.h fix suggested by & ok jsing
* fix another typo in comment in a line touched by the last commit (thissthen2022-12-261-1/+1
| | | | one wouldn't have triggered a spell checker though)
* spelling fixes; from paul tagliamontejmc2022-12-2610-23/+23
| | | | ok tb
* document the interaction with BIO_dup_chain(3)schwarze2022-12-181-2/+14
|
* Add a small blurb on @SECLEVEL=nlibressl-v3.7.0tb2022-12-111-2/+8
|
* Make header guards of internal headers consistenttb2022-11-262-4/+4
| | | | | Not all of them, only those that didn't leak into a public header... Yes.
* Make internal header file names consistenttb2022-11-2646-104/+103
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Reverse arguments in CBS_dup()tb2022-11-231-2/+2
| | | | | | | | We want to copy the tls_content_cbs() into the cbs, not the other way around CID 377013 ok jsing
* Bump libssl minor to match libcryptotb2022-11-131-1/+1
|
* Convert the legacy TLS stack to tls_content.jsing2022-11-1110-190/+292
| | | | | | | | | | This converts the legacy TLS stack to tls_content - records are now opened into a tls_content structure, rather than being written back into the same buffer that the sealed record was read into. This will allow for further clean up of the legacy record layer. ok tb@
* Symbols.list: Drop comments and sort.tb2022-11-111-33/+22
| | | | | | | While grouping the API by its purpose is nice, it doesn't help much if >90% is "general API". ok jsing
* Add support for symbol hiding disabled by default.beck2022-11-114-2/+78
| | | | | | | | | | | | Fully explained in libcrypto/README. TL;DR make sure libcrypto and libssl's function calls internally and to each other are via symbol names that won't get overridden by linking other libraries. Mostly work by guenther@, which will currently be gated behind a build setting NAMESPACE=yes. once we convert all the symbols to this method we will do a major bump and pick up the changes. ok tb@ jsing@
* Use tls_buffer for alert and handshake fragments in the legacy stack.jsing2022-11-105-49/+94
| | | | | | This avoids a bunch of pointer munging and a handrolled memmove. ok tb@
* Sync CBS_strdup() documentation update from libcrypto.jsing2022-11-091-6/+4
|
* Rewrite TLSv1.2 key exporter.jsing2022-11-075-96/+163
| | | | | | | Replace the grotty TLSv1.2 key exporter with a cleaner version that uses CBB and CBS. ok tb@
* Move tls13_exporter() code.jsing2022-11-072-72/+73
| | | | | | | It makes more sense to have tls13_exporter() in tls13_key_schedule.c, rather than tls13_lib.c ok tb@
* Add extra NULL check after ssl3_setup_read_buffer()tb2022-10-211-2/+5
| | | | | | | | | | While ssl3_setup_read_buffer() success alone is enough to imply that the read bufer is non-NULL, several static analyzers fail to recognize that and throw fits about possible NULL accesses. CID 331010 Fix from and ok jsing
* Initial parsing of the NewSessionTicket messagetb2022-10-201-2/+103
| | | | | | | | | | | | | | | | | | | | TLSv1.3 introduces a New Session Ticket post-handshake handshake message that allows a unique association between a ticket value and a pre-shared key derived from the resumption master secret. Servers may send this message arbitrarily often at any time after receiving the client's Finished message. Implement tls13_new_session_ticket_recv() which parses the contents of the NewSessionTicket message into a fresh session derived from the current session so as to avoid modifying sessions that are already in the session cache. This uses tls13_new_session_ticket_recv() in tls13_phh_received_cb(). We currently rely on the general rate limiting of 100 PHH messages per connection and hour to avoid problems from connecting to a misbehaving or malicious server. ok jsing
* Provide TLS13_MAX_TICKET_LIFETIME #definetb2022-10-201-1/+8
| | | | | | | | TLSv1.3 servers must not indicate a lifetime longer than 7 days and clients must not cache sessions for longer than 7 days. Encode this in a macro internal to tls13_lib.c for now. ok jsing
* Provide ssl_session_dup()tb2022-10-202-2/+108
| | | | | | | | SSL_SESSION_dup() is a currently essentially unused public OpenSSL 1.1.1 API. Add a version that does not duplicate the secrets for internal use. If the public API should be needed, we can easily make it a wrapper. ok jsing
* Clean up resumption master secret in SSL_SESSION_free()tb2022-10-201-1/+3
| | | | ok jsing
* Extend SSL_SESSION struct for TLSv1.3 PSKtb2022-10-201-2/+4
| | | | | | | | Add members necessary to store the "ticket_age_add" value and the resumption master secret needed in the TLSv1.3 version of session resumption. ok jsing
* Annotate misuse of EVP_Digest()tb2022-10-201-1/+2
| | | | | | | | | | The session_id member of SSL_SESSION has 32 bytes for historical reasons. This precisely accommodates a SHA-256 and is currently computed using this hash. If the hash function is ever changed, this will likely overflow. This should be fixed in code. Leave it at an XXX comment for now. Pointed out by jsing
* Error out if the out secret wasn't properly initializedtb2022-10-141-2/+6
| | | | | | | | Calling HKDF_expand() with a length of 0 happens to succeed due to a quirk in the API inherited from BoringSSL. This hides caller-side errors during development. Error out to catch such mistakes early on. ok jsing
* unwrap two lines for readabilitytb2022-10-051-5/+3
|
* Get rid of SSL_CTX_INTERNAL and SSL_INTERNAL.jsing2022-10-0226-1237/+1220
| | | | | | | | These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@
* Move handshake message handling functions from ssl_both.c to client/server.jsing2022-10-014-225/+342
| | | | | | | | | | | | | | | Currently, ssl_both.c contains several functions that are used by both the legacy client and legacy server. This interwines the client and server, making it harder to make progressive changes. While it does deduplicate some code, it also ends up with code that is conditioned on s->server and forces the caller to pass in SSL3_ST_* values. Move these functions from ssl_both.c into ssl_clnt.c and ssl_srvr.c, renaming as appropriate and removing the s->server conditionals. Also move the client and server function prototypes from ssl_locl.h into the .c files, making them static in the process. ok tb@
* Allow TLSv1.3 clients to send CCS without middlebox compatibility mode.jsing2022-09-171-4/+2
| | | | | | | | | | | | | | | | | While RFC 8446 is clear about what legacy session identifiers can be sent by a TLSv1.3 client and how middlebox compatibility mode is requested, it is delightfully vague about the circumstances under which a client is permitted to send CCS messages. While it does not make sense for a client to send CCS messages when they are not requesting middlebox compatibility mode, it is not strictly forbidden by the RFC and at least one (unknown) TLSv1.3 stack has been observed to do this in the wild. Revert part of the previous change and allow clients to send CCS messages, even if they are not requesting middlebox compatibility mode. Found the hard way by florian@ ok tb@
* Link to SSL_read_early_data(3)kn2022-09-171-3/+3
| | | | OK tb
* Enforce the minimum TLS version requirement for QUIC.jsing2022-09-111-1/+9
| | | | ok tb@
* Crank major after symbol addition and libcrypto major bumptb2022-09-111-2/+2
|
* Update Symbols.listtb2022-09-111-0/+11
| | | | ok jsing
* Expose SSL_get_share_{group,curve}() and related #definestb2022-09-111-7/+3
| | | | ok jsing
* Expose some error codes needed for QUIC supporttb2022-09-111-3/+1
| | | | ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 00:42:09 +0000