summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Hook up X25519MKLEM768 to the TLS 1.3 handshakebeck2025-12-045-39/+100
| | | | | | | | | | | | | | | | | | | | | | | | This does the following: 1) Adds a second key share prediction to the TLS 1.3 handshake. We only add one as we are unlikely to want to send more than one PQ one, and one classical one and are unlikely to waste bytes on a second PQ algorithm (anything that wants something else that we support can HRR to get it) 2) Adds X25519MLKEM768 (4588) to our list of supported groups. We add this to our preferred client and server key shares for TLS 1.3 and we now have a separate list for TLS 1.2 which does not do this, cleaning up the old "full list" from the comments. 3) Updates the golden magic numbers in the regression tests to allow for the above two things changing the handshake, so the regress tests pass. With this you can successfully hybrid PQ with servers and clients that support it. ok tb@ kenjiro@
* Add a MLKEM768_X25519 hybrid key share.beck2025-12-047-26/+348
| | | | | | | | | | | | This implements the currently in use MLKEM768_X25519 hybrid key share as outlined in https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ This commit does not yet wire this up to anything, that is done in follow on changes. ok tb@ jsing@ kenjiro@
* Simplify tls13_server_hello_build()tb2025-10-251-5/+5
| | | | | | | | There's no need to pass in the hrr parameter as it is redundant with the tls13.hrr flag. This avoids boolean blindness in the caller and removes a leftover from before we had tls13.hrr. ok jsing kenjiro
* Add missing Nm line for SSL_SESSION_duptb2025-10-241-2/+3
|
* bump lib{crypto,ssl,tls} minors after symbol additiontb2025-10-241-1/+1
|
* Document SSL_SESSION_dup(3)tb2025-10-241-3/+20
| | | | ok kenjiro
* Provide SSL_SESSION_dup()tb2025-10-244-3/+13
| | | | | | | As reported by ajacoutot and sthen, an update to net/neon is blocked on that missing symbol. ok kenjiro
* libssl: const correct the ssl_session_dup() helpertb2025-10-242-5/+5
| | | | | | | | | This allows a const correct SSL_SESSION_dup() implementation at the cost of casting away const due to the const incorrect CRYPTO_dup_ex_data()... (I should look into fixing that, but things like rust-openssl make that hard at this point in the release cycle.) ok kenjiro (as part of a larger diff)
* Ensure that we specify the correct group when creating a HelloRetryRequest.jsing2025-10-162-9/+4
| | | | | | | | | | | | | | | | | When processing the client supported groups and key shares extensions, the group selection is currently based on client preference. However, when building a HRR the preferred group is identified by calling tls1_get_supported_group(). If SSL_OP_CIPHER_SERVER_PREFERENCE is enabled, group selection will be based on server instead of client preference. This in turn can result in the server sending a HRR for a group that the client has already provided a key share for, violating the RFC. Avoid this issue by storing the client preferred group when processing the key share extension, then using this group when creating the HRR. Thanks to dzwdz for identifying and reporting the issue. ok beck@ tb@
* same crank for libssl and libtls as for libcryptotb2025-08-191-1/+1
|
* sync with crypto_namespace.h: avoid asm("") for MSVCtb2025-08-181-1/+5
| | | | Removes another patch in portable
* revert accidental disabling of ssl_security_cert() in -r1.52tb2025-08-141-2/+2
|
* Add a reasonable ML-KEM API for public use.beck2025-08-141-2/+2
| | | | | | | | | | | | | | | Adapt the tests to use this API. This does not yet make the symbols public in Symbols.list which will happen shortly with a bump. This includes some partial rototilling of the non-public interfaces which will be shortly continued when the internal code is deduplicated to not have multiple copies for ML-KEM 768 and ML-KEM 1024 (which is just an artifact of unravelling the boring C++ code). ok jsing@, tb@
* bump major for libssl and libtls to match libcryptotb2025-07-161-2/+2
|
* The mdoc(7) .Ft macro does not need quoting of its arguments, but aboutschwarze2025-06-131-3/+3
| | | | | | | 10% of our manual pages using this macro employed useless quoting anyway. Remove these quotes such that they do not incite fear, uncertainty, and doubt in developers who happen to look at these pages. jmc@ and tb@ agree with the direction.
* SSL_shutdown(): remove pointless NULL check.tb2025-06-091-2/+2
| | | | | reported by smatch via jsg ok beck
* .Lb libssl libcrypto ; OK tb@schwarze2025-06-08121-244/+365
|
* delete an "intentionally undocumented" comment regarding stuffschwarze2025-06-081-8/+3
| | | | | that no longer exists, and add .Lb libssl libcrypto; OK tb@
* add the missing .In line and add .Lb libssl libcrypto ; OK tb@schwarze2025-06-082-4/+8
|
* Trim trailing whitespacetb2025-06-071-8/+8
|
* Spelling, discussed with jsingtb2025-06-071-1/+1
|
* tls13_ctx_new(): fix calloc() incantationtb2025-06-071-2/+2
| | | | | | Switch argument order and use sizeof(*ctx) rather than sizeof(struct ...). ok jsg
* Fix weird calloc() argument ordertb2025-06-071-5/+5
| | | | ok jsg
* correct indentation, no functional changejsg2025-06-022-7/+6
| | | | found with smatch, ok tb@
* zap weird empty added to tls1_ec_nid2group_id() in previoustb2025-05-311-2/+1
|
* Simplify SSL_alert_desc_stringtb2025-05-221-67/+2
| | | | | | | | | | SSL_alert_desc_string() is only used by our good old friends M2Crypto and Net::SSLeay. While some of the two-letter combinations can be made sense of without looking at the switch, I guess, this is just a completely useless interface. The same level of uselessness can be acchieved in a single line matching BoringSSL. ok joshua kenjiro
* Don't use the array index as the group_idbeck2025-05-201-51/+97
| | | | | | | | | | | | This is a precursor to adding new group ids for post quantum stuff which are up in the 4000 range, so using the array index as the group id will be silly. Instead we just add the group id to the structure and we walk the list to find it. This should never be a very large list for us, so no need to do anything cuter than linear search for now. ok jsing@, joshua@
* ssl_local.h: stop guarding SYSerror() with an #ifdeftb2025-05-101-3/+1
|
* ssl_local: provide an SSL-internal version of SYSerror()tb2025-05-101-1/+4
|
* SSL_error_internal: remove a superfluous pair of parenstb2025-05-101-3/+2
|
* ssl_local.h: adjust some whitespacetb2025-05-101-3/+3
|
* const correct SSL_error_internal()tb2025-05-102-4/+4
|
* sigh. pqueue_find() also needs a const treatmenttb2025-05-042-4/+4
|
* pqueue.h: zap trailing whitespacetb2025-05-041-3/+3
|
* const correct first argument of pitem_new()tb2025-05-042-4/+4
| | | | Makes upcoming changes in regress less ugly.
* tlsext: stop sending SNI before ALPN in clientstb2025-04-301-24/+1
| | | | | | | | | | | All supported releases of LibreSSL ensure that the corresponding callbacks are called in a predefined order rather than honoring the order in which a client sends its extensions. Therefore the ALPN callback for apache-httpd's virtual host setups can rely on SNI information being available and we no longer need to work around this on hte client side. Cuts the amount of code needed for tlsext randomization in half. ok jsing
* SSL_set_tlsext_host_name: as a setter it cannot take a const ssltb2025-04-181-3/+3
|
* Remove two unused defines, update standard referencetb2025-04-181-7/+3
| | | | ok jsing
* Fix annoying whitespacetb2025-04-184-52/+52
|
* typo: primtive -> primitivetb2025-03-281-2/+2
|
* minor libssl bump (SSL_OP_NO_RENEGOTIATION/SSL_OP_ALLOW_CLIENT_RENEGOTIATION)sthen2025-03-131-1/+1
| | | | | | | | | code #ifdef'ing these and compiled with new headers won't work as expected on earlier libraries minor libtls bump to match libssl bump ok tb@
* Make srtp.h self-standing by including ssl.htb2025-03-131-1/+3
| | | | ok miod
* Provide SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.jsing2025-03-124-6/+36
| | | | | | | | | | | | | | | | | | | | | | In January 2017 we added SSL_OP_NO_CLIENT_RENEGOTIATION, which results in a SSL_AD_NO_RENEGOTIATION fatal alert if a ClientHello message is seen on an active connection (client initiated renegotation). Then in May 2017 OpenSSL added SSL_OP_NO_RENEGOTIATION, which results in a SSL_AD_NO_RENEGOTIATION warning alert if a server receives a ClientHello on an active connection (client initiated renegotation), or a client receives a HelloRequest (server requested renegotation). This option also causes calls to SSL_renegotiate() and SSL_renegotiate_abbreviated() to fail. Then in 2021, OpenSSL also added SSL_OP_ALLOW_CLIENT_RENEGOTIATION, which trumps SSL_OP_NO_RENEGOTIATION but only for incoming ClientHello messages (apparently unsetting SSL_OP_NO_RENEGOTIATION is too hard). Provide SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION, primarily to make life easier for ports. If SSL_OP_NO_CLIENT_RENEGOTIATION is set it will take precedence and render SSL_OP_ALLOW_CLIENT_RENEGOTIATION ineffective. The rest of the behaviour should match OpenSSL, with the exception of ClientHellos triggering fatal alerts instead of warnings. ok tb@
* Give libssl the same bump as libcryptotb2025-03-091-1/+1
|
* const correct tls_session_secret_cb_fn()tb2025-03-094-8/+8
| | | | | | | | | Various ports throw a warning since their tls_session_secret_cb's signature doesn't match what we expect. Aligns us with OpenSSL 1.1. This is only useful for RFC 4851 EAP-FAST implementations and surprisingly it's undocumented. ok jsing
* Support OPENSSL_NO_FILENAMEStb2025-03-093-8/+8
| | | | | | | | | | Some people are concerned that leaking a user name is a privacy issue. Allow disabling the __FILE__ and __LINE__ argument in the error stack to avoid this. This can be improved a bit in tree. From Viktor Szakats in https://github.com/libressl/portable/issues/761 ok bcook jsing
* SSL_select_next_proto: fix invalid octal escape by switching to hexadecimaltb2025-02-041-3/+3
|
* Simplify tls1_check_ec_key()tb2025-01-181-7/+7
| | | | | | | It doesn't need to have optional arguments anymore, so we can pass in values and don't need NULL checks and dereferencing. ok jsing
* Rename grp to group like almost everywhere elsetb2025-01-181-4/+4
|
* Remove parentheses in return statementstb2025-01-181-14/+14
| | | | ok cc + sha256
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-01-03 20:40:22 +0000