summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Simplify session ticket parsing/handling.jsing2018-08-244-69/+46
| | | | | | | | | | | | The original implementation is rather crazy and means that we effectively have two lots of code that parse a ClientHello and two lots of code that parse TLS extensions. Partially simplify this by passing a CBS containing the extension block through to the session handling functions, removing the need to reimplement the ClientHello parsing. While here standarise on naming for session_id and session_id_len. ok inoguchi@ tb@
* Pull up the parsing of a ClientHello.jsing2018-08-241-20/+20
| | | | | | | | | Parse up until the extensions (if any), then proceed with processing, rather than gradually parsing while processing. This makes the code cleaner, requires messages to be valid before processing and makes way for upcoming changes. ok inoguchi@ tb@
* Clean up handshake message start/finish functions.jsing2018-08-246-76/+38
| | | | | | | | Now that all handshake messages are created using CBB, remove the non-CBB ssl3_handshake_msg_start()/ssl3_handshake_msg_finish() functions. Rename the CBB variants by dropping the _cbb suffix. ok bcook@ inoguchi@ tb@
* Correct session ticket encryption.jsing2018-08-221-4/+11
| | | | | | | | | | The CBB conversion resulted in the ticket encryption being handled incorrectly, resulting in only the last block being used. Fix this and restore the previous behaviour. Issue found by inoguchi@ and sebastia@. ok inoguchi@ and tb@
* typo in argument type, from Mario dot Andres dot Campos at gmail dot comschwarze2018-08-211-3/+3
|
* Don't leak sktmp in X509_verify_cert().tb2018-08-191-5/+5
| | | | | | CID #118791 ok jsing mestre
* whitespace fixtb2018-08-191-2/+2
|
* Don't leak db on error in RSA_padding_check_PKCS1_OAEP().tb2018-08-191-7/+7
| | | | | | CID #183499. input & ok jsing, ok mestre on first version
* Rename and collapse tls12_get_sigandhash_cbb().jsing2018-08-194-39/+28
| | | | | | | | | | Now that all callers of tls12_get_sigandhash() have been converted to CBB, collapse tls12_get_sigandhash() and tls12_get_sigandhash_cbb() into a single function. Rename it to tls12_gethashandsig() to be representative of the actual order of the sigalgs parameters, and perform some other clean up. ok inoguchi@ tb@
* Convert ssl3_send_newsession_ticket() to CBB.jsing2018-08-191-55/+64
| | | | | | This removes a memorable BUF_MEM_grow() and associated comment. ok inoguchi@ tb@
* Convert ssl3_send_client_verify() to CBB.jsing2018-08-171-43/+50
| | | | ok inoguchi@ tb@
* Provide CBB_add_u32(), as needed for an upcoming conversion.jsing2018-08-162-2/+17
| | | | ok tb@
* Simplify the add signature code/logic in ssl3_send_server_key_exchange().jsing2018-08-161-13/+8
| | | | ok tb@
* Convert ssl3_send_server_key_exchange() to CBB.jsing2018-08-163-47/+71
| | | | ok inoguchi@ tb@
* Convert ssl3_get_server_key_exchange() to CBS.jsing2018-08-161-69/+55
| | | | ok inoguchi@ tb@
* Add a comment that explains what the check is doing and why len >= 1.tb2018-08-141-1/+2
| | | | Prompted by a remark by jsing
* The UI_add_{input,verify}_string() functions want a length not includingtb2018-08-141-5/+8
| | | | | | | | | | | | | | the terminating NUL. EVP_read_pw_string_min() got this wrong, leading to a one-byte buffer overrun in all callers of EVP_read_pw_string(). Found by mestre running 'openssl passwd' with MALLOC_OPTIONS including C. Fix this by doing some basic sanity checking in EVP_read_pw_string_min(). Cap the len argument at BUFSIZ and ensure that min < len as well as 0 <= min and 1 <= len. The last two checks are important as these numbers may end up in reallocarray(). ok bcook (on previous version), jsing, mestre
* Remove now unused variable, that got left behind from a previous change.jsing2018-08-141-3/+1
|
* Actually check the return values for EVP_Sign* and EVP_Verify*.jsing2018-08-142-15/+23
| | | | ok bcook@ beck@ tb@
* Simplify server key exchange signature verification.jsing2018-08-101-49/+18
| | | | | | Everything can go through the EVP_Verify* code path. ok inoguchi@ tb@
* Simplify server kex exchange signature generation.jsing2018-08-101-61/+33
| | | | | | Everything can go through the single EVP_Sign* code path. ok inoguchi@ tb@
* Add glue to EVP_md5_sha1() so that it can be used with EVP_Sign* andjsing2018-08-101-1/+12
| | | | | | EVP_Verify*. ok tb@
* Add missing include to X25519 synopsis.jsing2018-08-101-2/+3
|
* typo: macro-generates wrappers -> macro-generated wrapperstb2018-08-081-3/+3
|
* Remove unnecessary NULL check from get_cert_by_subject sincelibressl-v2.8.0bcook2018-08-051-3/+3
| | | | | | sk_BY_DIR_HASH_find already does it, removing ambiguity later in the function. ok tb@
* Fix a memory leak in i2d_RSA_NET on failure of ASN1_STRING_set.bcook2018-08-051-2/+2
| | | | | Found by Coverity. Feedback and ok tb@
* In RSA_padding_add_PKCS1_OAEP, dbmask needs to be freed on failure.bcook2018-08-051-3/+7
| | | | ok tb@
* Fix memory leak in i2b_PVK in error handling.bcook2018-08-051-14/+10
| | | | | | | Simplify parameter checks since this is only called from one place. Found by Coverity, CID 183502. ok beck@
* Document that X509_{NAME,REQ,REQ_INFO}_free() are all NULL safe.tb2018-07-292-4/+19
| | | | From Ross L. Richardson
* add c++ symbol annotationsbcook2018-07-241-1/+9
| | | | from Cameron Palmer
* Use the same order in NAME, SYNOPSIS, DESCRIPTION, and RETURN VALUES totb2018-07-241-27/+28
| | | | | | | improve readability and ease of maintenance. Positive feedback jmc Detailed suggestion & ok schwarze
* Document tls_peer_ocsp_result() and use it in place of the non-existenttb2018-07-231-6/+12
| | | | | | | tls_peer_ocsp_result_msg() in the documentation. input & ok jsing Reads fine to jmc and makes sense to schwarze
* Use BN_swap_ct() instead of BN_consttime_swap() intb2018-07-231-5/+10
| | | | | | | | | ec_GF2m_montgomery_point_multiply(). The new BN_swap_ct() API is an improved version of the public BN_consttime_swap() function: it allows error checking, doesn't assert(), and has fewer assumptions on the input. This diff eliminates the last use of BN_consttime_swap() in our tree. ok inoguchi, jsing
* Use a size_t instead of an int for the byte count in BN_swap_ct().tb2018-07-232-8/+11
| | | | | | | | Since bignums use ints for the same purpose, this still uses an int internally after an overflow check. Suggested by and discussed with jsing. ok inoguchi, jsing
* Clean up our disgusting implementations of BN_{,u}{add,sub}(), followingtb2018-07-231-157/+67
| | | | | | | | | changes made in OpenSSL by Davide Galassi and others, so that one can actually follow what is going on. There is no performance impact from this change as the code still does essentially the same thing. There's a ton of work still to be done to make the BN code less terrible. ok jsing, kn
* Implement RSASSA-PKCS1-v1_5 as specified in RFC 8017.tb2018-07-231-120/+148
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on an OpenSSL commit by David Benjamin. Alex Gaynor and Paul Kehrer from the pyca/cryptography Python library reported that more than 200 "expected to fail" signatures among Project Wycheproof's test vectors validated on LibreSSL. This patch makes them all fail. ok jsing commit 608a026494c1e7a14f6d6cfcc5e4994fe2728836 Author: David Benjamin <davidben@google.com> Date: Sat Aug 20 13:35:17 2016 -0400 Implement RSASSA-PKCS1-v1_5 as specified. RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode the DigestInfo struct and then compare the result against the public key operation result. This implies that one and only one encoding is legal. OpenSSL instead parses with crypto/asn1, then checks that the encoding round-trips, and allows some variations for the parameter. Sufficient laxness in this area can allow signature forgeries, as described in https://www.imperialviolet.org/2014/09/26/pkcs1.html Although there aren't known attacks against OpenSSL's current scheme, this change makes OpenSSL implement the algorithm as specified. This avoids the uncertainty and, more importantly, helps grow a healthy ecosystem. Laxness beyond the spec, particularly in implementations which enjoy wide use, risks harm to the ecosystem for all. A signature producer which only tests against OpenSSL may not notice bugs and accidentally become widely deployed. Thus implementations have a responsibility to honor the specification as tightly as is practical. In some cases, the damage is permanent and the spec deviation and security risk becomes a tax all implementors must forever pay, but not here. Both BoringSSL and Go successfully implemented and deployed RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so this change should be compatible enough to pin down in future OpenSSL releases. See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00 As a bonus, by not having to deal with sign/verify differences, this version is also somewhat clearer. It also more consistently enforces digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath wasn't quite doing this right. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1474
* Document behavior change of EC_POINTs_mul() again.tb2018-07-161-4/+22
|
* Recommit Billy Brumley's ECC constant time patch with a fix for sparc64tb2018-07-166-47/+341
| | | | | | | from Nicola Tuveri (who spotted the omission of ecp_nist.c from the PR). discussed with jsing tested by jsg
* recommit label indentation part of the backout; clearly unrelated to thetb2018-07-1519-91/+93
| | | | breakage.
* back out ecc constant time changesjsg2018-07-1521-448/+137
| | | | | | | | after the constant time commits various regress tests started failing on sparc64 ssh t9, libcrypto ec ecdh ecdsa and trying to ssh out resulted in 'invalid elliptic curve value' ok tb@
* Eliminate the weird condition in the BN_swap_ct() API that at most one bittb2018-07-131-3/+3
| | | | | | | | be set in condition. This makes the constant time bit-twiddling a bit trickier, but it's not too bad. Thanks to halex for an extensive rubber ducking session over a non-spicy spicy tabouleh falafel.. ok jsing, kn
* Sync commentkn2018-07-111-3/+5
| | | | | | Makes it a tad easier to read through and compare with BN_swap_ct(). OK tb
* Document behavior change of EC_POINTs_mul(3) from EC constant time changes.tb2018-07-111-4/+22
| | | | ok beck on earlier version, markup help from Schwarze.
* Turn yesterday's optimistic ! in an XXX comment into a more cautious ?tb2018-07-111-2/+2
|
* Indent labels by a space so they don't obliterate function names in diffs.tb2018-07-1019-91/+93
|
* ECC constant time scalar multiplication support. First step in overhaulingtb2018-07-105-46/+337
| | | | | | | | | | | the EC module. From Billy Brumley and his team, via https://github.com/libressl-portable/openbsd/pull/94 With tweaks from jsing and me. ok jsing
* Provide BN_swap_ct(), a constant time function that conditionally swapstb2018-07-102-2/+53
| | | | | | | | | | two bignums. It's saner and substantially less ugly than the existing public BN_constantime_swap() function and will be used in forthcoming work on constant time ECC code. From Billy Brumley and his team. Thanks! ok jsing
* Factor out a bit of ugly code that truncates the digest to the order_bitstb2018-07-101-32/+32
| | | | | | | | leftmost bits of a longer digest, according to FIPS 183-6, 6.4. Eliminate a microoptimization that only converts the relevant part of the digest to a bignum. ok beck, jsing
* Move a detail on tls_connect(3) to its documentation and be a bit moretb2018-07-091-5/+7
| | | | | | explicit about the servername argument of tls_connect_servername(3). input & ok jsing, input & ok schwarze on earlier version
* wording tweak for tls_init() from jsingtb2018-07-091-4/+4
| | | | ok jsing, schwarze
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-28 11:34:16 +0000