summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove lib/libssl/test.jsing2026-04-0353-4409/+0
| | | | | | This is all unhelpful historical cruft. Discussed with tb@
* Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability.jsing2026-04-035-80/+8
| | | | | | | | We no longer support TLSv1.0 and definitely do not support SSLv3 - remove the empty fragments workaround for the CBC vulnerability in these protocols. ok kenjiro@ tb@
* Ensure that we cannot negotiate TLSv1.1 or lower.jsing2026-04-033-13/+21
| | | | | | | | | TLS versions prior to TLSv1.2 were disabled a while ago, however this was done in the version handling code. Remove TLSv1.1 and earlier from ssl_get_method() and add an explicit min version check in the legacy client and server, to provide a stronger guarantee. ok kenjiro@ tb@
* Remove ssl_server_legacy_first_packet()jsing2026-04-033-97/+2
| | | | | | | | | This has not been reachable since we made the TLSv1.3 stack the default entry point - tls13_record_layer_read_record() will send a protocol version alert and raise an error, which means we never transition into the legacy stack. ok kenjiro@
* Mop up mac_packet.jsing2026-04-034-15/+8
| | | | | | This is a left over from when we accepted SSLv2 ClientHello messages. ok kenjiro@
* libssl: announce support for RSASSA-PSS signature schemestb2026-03-301-1/+7
| | | | | | | | | | | | | | | Announce the signature schemes for RSASSA-PSS with pubkey OID RSASSA-PSS between RSASSA-PSS with pubkey OID rsaEncryption and RSASSA-PKCS1-v1_5. This is the last step in the everlasting saga for making these signature schemes and certificates with RSASSA-PSS OID work. Fortunately, these are rarely used since they are extremely complex and inefficient also due to the large size of the parameters. This addresses bug reports by Steffen Ullrich and Tom Lane. Tested by bluhm. ok djm jsing kenjiro
* ssl_sigalg_pkey_ok: allow RSASSA-PSS with pubkey OID RSASSA-PSStb2026-03-301-5/+6
| | | | | | | | | | | | This fixes a long-standing logic error that hasn't been noticed because we never announced the rsa_pss_pss_sha{256,384,512} SignatureScheme. The EVP_PKEY_id() of a RSA-PSS pubkey is EVP_PKEY_RSA_PSS, not EVP_PKEY_RSA. Thanks to beck for helping me figure out how to fix this correctly. It drove me nuts for a very long time. Problem also noticed by Tom Lane due to some PostgreSQL regress failures. ok djm jsing kenjiro
* ssl_sigalgs: whitespace tweaktb2026-03-301-1/+2
|
* Rename RANK{768,1024} to MLKEM{768,1024}_RANKtb2026-01-011-3/+3
| | | | | | | | | RANK768 and RANK1024 are awfully short and generic names for public constants. Before we make it worse with similarly named constants for ML-DSA, let's fix this. This follows the naming convention used by the other macros in the mlkem code. ok kenjiro jsing
* Hook up X25519MKLEM768 to the TLS 1.3 handshakebeck2025-12-045-39/+100
| | | | | | | | | | | | | | | | | | | | | | | | This does the following: 1) Adds a second key share prediction to the TLS 1.3 handshake. We only add one as we are unlikely to want to send more than one PQ one, and one classical one and are unlikely to waste bytes on a second PQ algorithm (anything that wants something else that we support can HRR to get it) 2) Adds X25519MLKEM768 (4588) to our list of supported groups. We add this to our preferred client and server key shares for TLS 1.3 and we now have a separate list for TLS 1.2 which does not do this, cleaning up the old "full list" from the comments. 3) Updates the golden magic numbers in the regression tests to allow for the above two things changing the handshake, so the regress tests pass. With this you can successfully hybrid PQ with servers and clients that support it. ok tb@ kenjiro@
* Add a MLKEM768_X25519 hybrid key share.beck2025-12-047-26/+348
| | | | | | | | | | | | This implements the currently in use MLKEM768_X25519 hybrid key share as outlined in https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ This commit does not yet wire this up to anything, that is done in follow on changes. ok tb@ jsing@ kenjiro@
* Simplify tls13_server_hello_build()tb2025-10-251-5/+5
| | | | | | | | There's no need to pass in the hrr parameter as it is redundant with the tls13.hrr flag. This avoids boolean blindness in the caller and removes a leftover from before we had tls13.hrr. ok jsing kenjiro
* Add missing Nm line for SSL_SESSION_duptb2025-10-241-2/+3
|
* bump lib{crypto,ssl,tls} minors after symbol additiontb2025-10-241-1/+1
|
* Document SSL_SESSION_dup(3)tb2025-10-241-3/+20
| | | | ok kenjiro
* Provide SSL_SESSION_dup()tb2025-10-244-3/+13
| | | | | | | As reported by ajacoutot and sthen, an update to net/neon is blocked on that missing symbol. ok kenjiro
* libssl: const correct the ssl_session_dup() helpertb2025-10-242-5/+5
| | | | | | | | | This allows a const correct SSL_SESSION_dup() implementation at the cost of casting away const due to the const incorrect CRYPTO_dup_ex_data()... (I should look into fixing that, but things like rust-openssl make that hard at this point in the release cycle.) ok kenjiro (as part of a larger diff)
* Ensure that we specify the correct group when creating a HelloRetryRequest.jsing2025-10-162-9/+4
| | | | | | | | | | | | | | | | | When processing the client supported groups and key shares extensions, the group selection is currently based on client preference. However, when building a HRR the preferred group is identified by calling tls1_get_supported_group(). If SSL_OP_CIPHER_SERVER_PREFERENCE is enabled, group selection will be based on server instead of client preference. This in turn can result in the server sending a HRR for a group that the client has already provided a key share for, violating the RFC. Avoid this issue by storing the client preferred group when processing the key share extension, then using this group when creating the HRR. Thanks to dzwdz for identifying and reporting the issue. ok beck@ tb@
* same crank for libssl and libtls as for libcryptotb2025-08-191-1/+1
|
* sync with crypto_namespace.h: avoid asm("") for MSVCtb2025-08-181-1/+5
| | | | Removes another patch in portable
* revert accidental disabling of ssl_security_cert() in -r1.52tb2025-08-141-2/+2
|
* Add a reasonable ML-KEM API for public use.beck2025-08-141-2/+2
| | | | | | | | | | | | | | | Adapt the tests to use this API. This does not yet make the symbols public in Symbols.list which will happen shortly with a bump. This includes some partial rototilling of the non-public interfaces which will be shortly continued when the internal code is deduplicated to not have multiple copies for ML-KEM 768 and ML-KEM 1024 (which is just an artifact of unravelling the boring C++ code). ok jsing@, tb@
* bump major for libssl and libtls to match libcryptotb2025-07-161-2/+2
|
* The mdoc(7) .Ft macro does not need quoting of its arguments, but aboutschwarze2025-06-131-3/+3
| | | | | | | 10% of our manual pages using this macro employed useless quoting anyway. Remove these quotes such that they do not incite fear, uncertainty, and doubt in developers who happen to look at these pages. jmc@ and tb@ agree with the direction.
* SSL_shutdown(): remove pointless NULL check.tb2025-06-091-2/+2
| | | | | reported by smatch via jsg ok beck
* .Lb libssl libcrypto ; OK tb@schwarze2025-06-08121-244/+365
|
* delete an "intentionally undocumented" comment regarding stuffschwarze2025-06-081-8/+3
| | | | | that no longer exists, and add .Lb libssl libcrypto; OK tb@
* add the missing .In line and add .Lb libssl libcrypto ; OK tb@schwarze2025-06-082-4/+8
|
* Trim trailing whitespacetb2025-06-071-8/+8
|
* Spelling, discussed with jsingtb2025-06-071-1/+1
|
* tls13_ctx_new(): fix calloc() incantationtb2025-06-071-2/+2
| | | | | | Switch argument order and use sizeof(*ctx) rather than sizeof(struct ...). ok jsg
* Fix weird calloc() argument ordertb2025-06-071-5/+5
| | | | ok jsg
* correct indentation, no functional changejsg2025-06-022-7/+6
| | | | found with smatch, ok tb@
* zap weird empty added to tls1_ec_nid2group_id() in previoustb2025-05-311-2/+1
|
* Simplify SSL_alert_desc_stringtb2025-05-221-67/+2
| | | | | | | | | | SSL_alert_desc_string() is only used by our good old friends M2Crypto and Net::SSLeay. While some of the two-letter combinations can be made sense of without looking at the switch, I guess, this is just a completely useless interface. The same level of uselessness can be acchieved in a single line matching BoringSSL. ok joshua kenjiro
* Don't use the array index as the group_idbeck2025-05-201-51/+97
| | | | | | | | | | | | This is a precursor to adding new group ids for post quantum stuff which are up in the 4000 range, so using the array index as the group id will be silly. Instead we just add the group id to the structure and we walk the list to find it. This should never be a very large list for us, so no need to do anything cuter than linear search for now. ok jsing@, joshua@
* ssl_local.h: stop guarding SYSerror() with an #ifdeftb2025-05-101-3/+1
|
* ssl_local: provide an SSL-internal version of SYSerror()tb2025-05-101-1/+4
|
* SSL_error_internal: remove a superfluous pair of parenstb2025-05-101-3/+2
|
* ssl_local.h: adjust some whitespacetb2025-05-101-3/+3
|
* const correct SSL_error_internal()tb2025-05-102-4/+4
|
* sigh. pqueue_find() also needs a const treatmenttb2025-05-042-4/+4
|
* pqueue.h: zap trailing whitespacetb2025-05-041-3/+3
|
* const correct first argument of pitem_new()tb2025-05-042-4/+4
| | | | Makes upcoming changes in regress less ugly.
* tlsext: stop sending SNI before ALPN in clientstb2025-04-301-24/+1
| | | | | | | | | | | All supported releases of LibreSSL ensure that the corresponding callbacks are called in a predefined order rather than honoring the order in which a client sends its extensions. Therefore the ALPN callback for apache-httpd's virtual host setups can rely on SNI information being available and we no longer need to work around this on hte client side. Cuts the amount of code needed for tlsext randomization in half. ok jsing
* SSL_set_tlsext_host_name: as a setter it cannot take a const ssltb2025-04-181-3/+3
|
* Remove two unused defines, update standard referencetb2025-04-181-7/+3
| | | | ok jsing
* Fix annoying whitespacetb2025-04-184-52/+52
|
* typo: primtive -> primitivetb2025-03-281-2/+2
|
* minor libssl bump (SSL_OP_NO_RENEGOTIATION/SSL_OP_ALLOW_CLIENT_RENEGOTIATION)sthen2025-03-131-1/+1
| | | | | | | | | code #ifdef'ing these and compiled with new headers won't work as expected on earlier libraries minor libtls bump to match libssl bump ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-06-02 08:15:05 +0000