summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Get rid of struct dtls1_retransmit_state.jsing2026-05-062-26/+10
| | | | | | | | | | | | | In order to retransmit DTLS messages we potentially need to use the record protection from a previous epoch. However, DTLS currently also saves and restores the session, which is unnecessary - all of the record protection and keys are handled in the TLS record layer. Remove the rather useless dtls1_retransmit_state struct and just keep the epoch - keeping pointers hanging around to sessions is pretty nasty and unnecessary. ok kenjiro@ tb@
* Avoid use of uninitialised decode_error variable.jsing2026-05-061-10/+14
| | | | | | | | | | | | | | | | | | Pull initialisation of decode_error and invalid_key up to tls_key_share_{client,server}_peer_public(), which are the entry points for the key share code. The entry point was previously tls_key_share_peer_public(), however with the introduction of MLKEM this was split into separate client and server functions, without the initialisation being included. Also initialise decode_error and invalid_params on entry to tls_key_share_peer_params(). Code that reaches tls_key_share_client_peer_public_mlkem768x25519() could previously result in code branching based on decode_error, which is uninitialised stack based memory. Thanks to Guido Vranken of Aisle Research for reporting this issue. With and ok tb@
* Refactor dtls1_do_write_handshake_message().jsing2026-04-301-43/+44
| | | | | | | | If the call to dtls1_write_bytes() fails, handle the potential MTU update and return/continue, which allows for the remainder to be moved out of an else statement. ok kenjiro@ tb@
* Split dtls1_do_write() into handshake message and CCS handling.jsing2026-04-291-33/+59
| | | | | | | | | | | | dtls1_do_write() is currently a single function that handles both handshake messages and CCS. This is a strange mix that only serves to complicate the code - handshake messages have their own headers and may need to be fragmented, while CCS must be sent verbatim (and only contain a single byte). Pull the CCS part out into a separate function, simplifying the code. By definition, when sending a CCS message the MTU will already be set appropriately. ok kenjiro@ tb@
* Avoid unnecessary lookups in dtls1_retransmit_message().jsing2026-04-291-37/+6
| | | | | | | | | | dtls1_retransmit_buffered_messages() is iterating over the sent_messages pqueue, only to pass dtls1_retransmit_message() a sequence number that it turns back into a priority, to then do a lookup on the sent_messages pqueue. This is pointless given that we already have the message that we need to retransmit - just pass that to dtls1_retransmit_message() directly. ok kenjiro@ tb@
* Remove unused frag_off argument from dtls1_retransmit_message().jsing2026-04-291-4/+3
| | | | ok kenjiro@ tb@
* Make dtls1_retransmit_message() static.jsing2026-04-292-78/+76
| | | | | | | This function is only called from dtls1_retransmit_buffered_messages(). Make it static and move it above the caller. ok kenjiro@ tb@
* Inline dtls1_fix_message_header().jsing2026-04-291-16/+5
| | | | | | | | This is only used in one place and it makes no sense to have it as a separate function. Furthermore, pull up an assertion so that we check before assigning frag_len. ok kenjiro@ tb@
* Convert DTLS code to ssl_msg_callback().jsing2026-04-291-14/+7
| | | | ok kenjiro@ tb@
* Remove lib/libssl/test.jsing2026-04-0353-4409/+0
| | | | | | This is all unhelpful historical cruft. Discussed with tb@
* Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability.jsing2026-04-035-80/+8
| | | | | | | | We no longer support TLSv1.0 and definitely do not support SSLv3 - remove the empty fragments workaround for the CBC vulnerability in these protocols. ok kenjiro@ tb@
* Ensure that we cannot negotiate TLSv1.1 or lower.jsing2026-04-033-13/+21
| | | | | | | | | TLS versions prior to TLSv1.2 were disabled a while ago, however this was done in the version handling code. Remove TLSv1.1 and earlier from ssl_get_method() and add an explicit min version check in the legacy client and server, to provide a stronger guarantee. ok kenjiro@ tb@
* Remove ssl_server_legacy_first_packet()jsing2026-04-033-97/+2
| | | | | | | | | This has not been reachable since we made the TLSv1.3 stack the default entry point - tls13_record_layer_read_record() will send a protocol version alert and raise an error, which means we never transition into the legacy stack. ok kenjiro@
* Mop up mac_packet.jsing2026-04-034-15/+8
| | | | | | This is a left over from when we accepted SSLv2 ClientHello messages. ok kenjiro@
* libssl: announce support for RSASSA-PSS signature schemestb2026-03-301-1/+7
| | | | | | | | | | | | | | | Announce the signature schemes for RSASSA-PSS with pubkey OID RSASSA-PSS between RSASSA-PSS with pubkey OID rsaEncryption and RSASSA-PKCS1-v1_5. This is the last step in the everlasting saga for making these signature schemes and certificates with RSASSA-PSS OID work. Fortunately, these are rarely used since they are extremely complex and inefficient also due to the large size of the parameters. This addresses bug reports by Steffen Ullrich and Tom Lane. Tested by bluhm. ok djm jsing kenjiro
* ssl_sigalg_pkey_ok: allow RSASSA-PSS with pubkey OID RSASSA-PSStb2026-03-301-5/+6
| | | | | | | | | | | | This fixes a long-standing logic error that hasn't been noticed because we never announced the rsa_pss_pss_sha{256,384,512} SignatureScheme. The EVP_PKEY_id() of a RSA-PSS pubkey is EVP_PKEY_RSA_PSS, not EVP_PKEY_RSA. Thanks to beck for helping me figure out how to fix this correctly. It drove me nuts for a very long time. Problem also noticed by Tom Lane due to some PostgreSQL regress failures. ok djm jsing kenjiro
* ssl_sigalgs: whitespace tweaktb2026-03-301-1/+2
|
* Rename RANK{768,1024} to MLKEM{768,1024}_RANKtb2026-01-011-3/+3
| | | | | | | | | RANK768 and RANK1024 are awfully short and generic names for public constants. Before we make it worse with similarly named constants for ML-DSA, let's fix this. This follows the naming convention used by the other macros in the mlkem code. ok kenjiro jsing
* Hook up X25519MKLEM768 to the TLS 1.3 handshakebeck2025-12-045-39/+100
| | | | | | | | | | | | | | | | | | | | | | | | This does the following: 1) Adds a second key share prediction to the TLS 1.3 handshake. We only add one as we are unlikely to want to send more than one PQ one, and one classical one and are unlikely to waste bytes on a second PQ algorithm (anything that wants something else that we support can HRR to get it) 2) Adds X25519MLKEM768 (4588) to our list of supported groups. We add this to our preferred client and server key shares for TLS 1.3 and we now have a separate list for TLS 1.2 which does not do this, cleaning up the old "full list" from the comments. 3) Updates the golden magic numbers in the regression tests to allow for the above two things changing the handshake, so the regress tests pass. With this you can successfully hybrid PQ with servers and clients that support it. ok tb@ kenjiro@
* Add a MLKEM768_X25519 hybrid key share.beck2025-12-047-26/+348
| | | | | | | | | | | | This implements the currently in use MLKEM768_X25519 hybrid key share as outlined in https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ This commit does not yet wire this up to anything, that is done in follow on changes. ok tb@ jsing@ kenjiro@
* Simplify tls13_server_hello_build()tb2025-10-251-5/+5
| | | | | | | | There's no need to pass in the hrr parameter as it is redundant with the tls13.hrr flag. This avoids boolean blindness in the caller and removes a leftover from before we had tls13.hrr. ok jsing kenjiro
* Add missing Nm line for SSL_SESSION_duptb2025-10-241-2/+3
|
* bump lib{crypto,ssl,tls} minors after symbol additiontb2025-10-241-1/+1
|
* Document SSL_SESSION_dup(3)tb2025-10-241-3/+20
| | | | ok kenjiro
* Provide SSL_SESSION_dup()tb2025-10-244-3/+13
| | | | | | | As reported by ajacoutot and sthen, an update to net/neon is blocked on that missing symbol. ok kenjiro
* libssl: const correct the ssl_session_dup() helpertb2025-10-242-5/+5
| | | | | | | | | This allows a const correct SSL_SESSION_dup() implementation at the cost of casting away const due to the const incorrect CRYPTO_dup_ex_data()... (I should look into fixing that, but things like rust-openssl make that hard at this point in the release cycle.) ok kenjiro (as part of a larger diff)
* Ensure that we specify the correct group when creating a HelloRetryRequest.jsing2025-10-162-9/+4
| | | | | | | | | | | | | | | | | When processing the client supported groups and key shares extensions, the group selection is currently based on client preference. However, when building a HRR the preferred group is identified by calling tls1_get_supported_group(). If SSL_OP_CIPHER_SERVER_PREFERENCE is enabled, group selection will be based on server instead of client preference. This in turn can result in the server sending a HRR for a group that the client has already provided a key share for, violating the RFC. Avoid this issue by storing the client preferred group when processing the key share extension, then using this group when creating the HRR. Thanks to dzwdz for identifying and reporting the issue. ok beck@ tb@
* same crank for libssl and libtls as for libcryptotb2025-08-191-1/+1
|
* sync with crypto_namespace.h: avoid asm("") for MSVCtb2025-08-181-1/+5
| | | | Removes another patch in portable
* revert accidental disabling of ssl_security_cert() in -r1.52tb2025-08-141-2/+2
|
* Add a reasonable ML-KEM API for public use.beck2025-08-141-2/+2
| | | | | | | | | | | | | | | Adapt the tests to use this API. This does not yet make the symbols public in Symbols.list which will happen shortly with a bump. This includes some partial rototilling of the non-public interfaces which will be shortly continued when the internal code is deduplicated to not have multiple copies for ML-KEM 768 and ML-KEM 1024 (which is just an artifact of unravelling the boring C++ code). ok jsing@, tb@
* bump major for libssl and libtls to match libcryptotb2025-07-161-2/+2
|
* The mdoc(7) .Ft macro does not need quoting of its arguments, but aboutschwarze2025-06-131-3/+3
| | | | | | | 10% of our manual pages using this macro employed useless quoting anyway. Remove these quotes such that they do not incite fear, uncertainty, and doubt in developers who happen to look at these pages. jmc@ and tb@ agree with the direction.
* SSL_shutdown(): remove pointless NULL check.tb2025-06-091-2/+2
| | | | | reported by smatch via jsg ok beck
* .Lb libssl libcrypto ; OK tb@schwarze2025-06-08121-244/+365
|
* delete an "intentionally undocumented" comment regarding stuffschwarze2025-06-081-8/+3
| | | | | that no longer exists, and add .Lb libssl libcrypto; OK tb@
* add the missing .In line and add .Lb libssl libcrypto ; OK tb@schwarze2025-06-082-4/+8
|
* Trim trailing whitespacetb2025-06-071-8/+8
|
* Spelling, discussed with jsingtb2025-06-071-1/+1
|
* tls13_ctx_new(): fix calloc() incantationtb2025-06-071-2/+2
| | | | | | Switch argument order and use sizeof(*ctx) rather than sizeof(struct ...). ok jsg
* Fix weird calloc() argument ordertb2025-06-071-5/+5
| | | | ok jsg
* correct indentation, no functional changejsg2025-06-022-7/+6
| | | | found with smatch, ok tb@
* zap weird empty added to tls1_ec_nid2group_id() in previoustb2025-05-311-2/+1
|
* Simplify SSL_alert_desc_stringtb2025-05-221-67/+2
| | | | | | | | | | SSL_alert_desc_string() is only used by our good old friends M2Crypto and Net::SSLeay. While some of the two-letter combinations can be made sense of without looking at the switch, I guess, this is just a completely useless interface. The same level of uselessness can be acchieved in a single line matching BoringSSL. ok joshua kenjiro
* Don't use the array index as the group_idbeck2025-05-201-51/+97
| | | | | | | | | | | | This is a precursor to adding new group ids for post quantum stuff which are up in the 4000 range, so using the array index as the group id will be silly. Instead we just add the group id to the structure and we walk the list to find it. This should never be a very large list for us, so no need to do anything cuter than linear search for now. ok jsing@, joshua@
* ssl_local.h: stop guarding SYSerror() with an #ifdeftb2025-05-101-3/+1
|
* ssl_local: provide an SSL-internal version of SYSerror()tb2025-05-101-1/+4
|
* SSL_error_internal: remove a superfluous pair of parenstb2025-05-101-3/+2
|
* ssl_local.h: adjust some whitespacetb2025-05-101-3/+3
|
* const correct SSL_error_internal()tb2025-05-102-4/+4
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-09 21:41:36 +0000