summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Re-enable the TLSv1.3 client since the known issues have been addressed.jsing2020-02-061-3/+1
| | | | ok tb@
* Add a workaround to make SSL_set_session() work with TLSv1.3.jsing2020-02-061-1/+9
| | | | | | | | While we do not currently do session resumption, just return the TLS_client_method() or TLS_server_method() when asked for a method that does TLSv1.3. ok tb@ (who also arrived at the same diff)
* Add support for handling hello retry requests in the TLSv1.3 client.jsing2020-02-061-5/+100
| | | | | | | | | In the case of a hello retry request, we need to replace the client hello with a synthetic handshake message, switch key share to that selected by the server, build and send a new client hello, then process the resulting server hello. ok tb@
* Correctly handle key share extensions in a hello retry request.jsing2020-02-062-4/+11
| | | | | | | | In a hello retry request the server will only send the selected group and not actually provide a key exchange. In this case we need to store the server selected group for further processing. ok tb@
* Refactor the server hello processing code in the TLSv1.3 client.jsing2020-02-052-22/+46
| | | | | | | | | | | | | Use flags to signal the need to switch to the legacy client and to identify a hello retry request. This allows the caller to take appropriate action, rather than trying to do this in the parsing/processing code. Split the key deriviation and record protection engagement code into a separate function, both for readability and reuse. Change handshake states outside of the processing code. ok tb@
* Remove the hello retry request processing code that was previously added.jsing2020-02-052-65/+16
| | | | | | | This got added to the wrong functions (server side, not client) - swap the now unimplemented send/recv functions between client and server. ok tb@
* Provide tls1_transcript_unfreeze() to avoid the need for manual flagsjsing2020-02-052-3/+10
| | | | | | mangling. ok tb@
* Pull the handshake message transcript code into its own function.jsing2020-02-052-7/+14
| | | | | | This is soon going to be used in the TLSv1.3 client code. ok tb@
* Rework tls13_legacy_handshake_message_{recv,sent}_cb() to usetb2020-02-053-16/+22
| | | | | | their own CBS as a preparation for upcoming HRR diffs. ok jsing
* Add support for TLSv1.3 key shares with secp256r1 and secp384r1 groups.jsing2020-02-041-5/+98
| | | | ok inoguchi@ tb@
* Free the transcript as soon as we initialise the transcript hash.jsing2020-02-042-2/+4
| | | | | | | | Unlike TLSv1.2 there is only a single hash in use, hence as soon as we know what the hash is and have initialised the transcript hash, we can free the transcript buffers. ok inoguchi@ tb@
* Correctly unpack client key shares.jsing2020-02-012-14/+11
| | | | | | | | Even if we're not processing/using the peer public key from the key share, we still need to unpack it in order to parse the TLS extension correctly. Resolves issues with TLSv1.3 clients talking to TLSv1.2 server. ok tb@
* Disable TLSv1.3 client while some known issues are being addressed.jsing2020-02-011-1/+3
|
* Provide struct/functions for handling TLSv1.3 key shares.jsing2020-01-308-130/+299
| | | | | | | Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
* Factor out/rewrite the ECDHE EC point key exchange code.jsing2020-01-305-173/+188
| | | | | | | | | This reduces replication between the existing TLS client/server and allows the code to soon be reused for TLSv1.3. With feedback from inoguchi@ and tb@ ok inoguchi@ tb@
* Remove dead prototypes.jsing2020-01-291-10/+1
|
* If the TLSv1.3 code has not recorded an error and something already existsjsing2020-01-293-3/+9
| | | | | | | | on the error stack, refrain from pushing an 'unknown' error on the stack. This should allow libcrypto errors (including bio) to be visible, where we have nothing better to offer. ok tb@
* Remove unused stub implementation of tls13_accept(). The correcttb2020-01-291-11/+1
| | | | | | and used version is in tls13_server.c. ok inoguchi jsing
* Fix SSL_CIPHER_descriptioninoguchi2020-01-261-2/+2
| | | | ok jsing@
* Avoid 32 bit right shift with unsigned int in crypto/cast/cast_lcl.hinoguchi2020-01-261-2/+2
| | | | ok tb@
* tweak previous; ok tbjmc2020-01-261-3/+3
|
* typotb2020-01-261-2/+2
|
* Document the change in EVP_chacha20(3).tb2020-01-261-3/+5
| | | | Discussed with jsing
* Improve the comment explaining why the previous change matches OpenSSL'stb2020-01-261-8/+15
| | | | | | behavior. ok jsing
* When an SSL method is set, bump the max version back to that of thejsing2020-01-261-1/+10
| | | | | | | | | | incoming method if it is a client. This addresses the case where TLS_method() is used to initialise a SSL_CTX, then a TLS_client_method() is then set, resulting in TLSv1.2 being used instead of TLSv1.3. This is observable in smtpd. ok beck@
* When switching back to a legacy client or server, ensure we reset thejsing2020-01-262-2/+4
| | | | | | | | handshake function pointer. Fixes an isssue found by jca@ with OpenVPN. ok beck@ tb@
* Fix basement bug where record layer would not correctly deal withbeck2020-01-261-1/+4
| | | | | | traffic retries when not yet encrypting. ok jsing@
* Add server side support for requesting client certificates in tls 1.3beck2020-01-261-4/+173
| | | | ok jsing@
* Add client certificate support for tls 1.3beck2020-01-262-15/+149
| | | | ok jsing@
* Add sigalgs for server side to enable client certificate processingbeck2020-01-261-5/+34
| | | | | | | | in tls 1.3 Will be used in a follow on commit to enable tls1.3 client certificates ok jsing@
* Move pad and verify context into tls13_lib.cbeck2020-01-264-68/+60
| | | | ok jsing@
* Adjust EVP_chacha20()'s behavior to match OpenSSL's semantics:tb2020-01-261-7/+14
| | | | | | | | | | | | | | | | | The new IV is 128 bit long and is actually the 64 bit counter followed by 64 the bit initialization vector. This is needed by an upcoming change in OpenSSH and is a breaking change for all current callers. There are language bindings for Node.js, Rust and Erlang, but none of our ports use them. Note that EVP_chacha20() was first introduced in LibreSSL on May 1, 2014 while the entirely incompatible version in OpenSSL was committed on Dec 9, 2015. Initial diff from djm and myself, further refinements by djm. Ports grepping by sthen ok jsing
* Add an underbar for consistency.tb2020-01-251-2/+2
|
* Revert change to certificate request check from r1.45.jsing2020-01-251-3/+3
| | | | | | This code was correct, it was the entry in the table that was incorrect. ok beck@
* Only perform the downgrade check if our max version is less than TLSv1.3.jsing2020-01-251-15/+17
| | | | | | | Issue noticed by kn@ when talking to a TLSv1.3 capable mail server, but with smtpd capping max version to TLSv1.2. ok beck@
* Preserve the transcript hash for the client finished message,beck2020-01-251-2/+3
| | | | | | and correct the message type for certificate request. ok jsing@
* Support legacy message callbacks. First step for SSL_set_msg_callback(3)tb2020-01-253-3/+40
| | | | | | support. Makes openssl s_client -msg work for handshake messages. ok beck jsing
* Correct value for SSL_TLSEXT_MSG_HRR.jsing2020-01-251-2/+2
| | | | ok beck@ tb@
* Only discard the extension block for client hello and server hellojsing2020-01-251-2/+3
| | | | | | | | | messages. TLSv1.3 messages that include extensions need a length prefixed field with zero bytes, rather than no data at all. ok beck@ tb@
* Only send an RI extension for pre-TLSv1.3 versions.jsing2020-01-251-2/+2
| | | | ok beck@
* It is possible to receive a pre-TLSv1.3 alert in response to a TLSv1.3jsing2020-01-253-4/+24
| | | | | | | | | | | | client hello. Allow pre-TLSv1.3 alerts (including warnings) to be received before the server hello message. Disallow pre-TLSv1.3 alerts as soon as we know that we are using TLSv1.3. Noticed by ajacoutot@ while connecting to www.openprinting.org. ok tb@
* Correct backwards test so that we may accept a certificate requstbeck2020-01-251-3/+3
| | | | | | from the server. ok jsing@
* Complete the initial TLSv1.3 implementation.jsing2020-01-243-14/+300
| | | | ok beck@ tb@
* Preserve the TLS transcript at additional points.jsing2020-01-241-9/+23
| | | | | | | | | This is needed for the TLSv1.3 server and will also be needed for client certificate authentication. Note that we preserve on receive but before recording the new handshake message, whereas we preserve on send after recording the new handshake message. ok tb@
* Permit 0 length writes, because openssl s_client is specialbeck2020-01-241-2/+2
| | | | ok jsing@
* Store the legacy session identifier from the ClientHello so we can actuallyjsing2020-01-241-1/+10
| | | | | | echo it. ok beck@ tb@
* Switch to encrypted records in the TLSv1.3 server.jsing2020-01-243-4/+78
| | | | | | | This adds code to perform key derivation and set the traffic keys once the ServerHello message has been sent, enabling encrypted records. ok beck@ tb@
* Enable SSL_ENC_FLAG_SIGALGS on TLSv1_3_enc_data.jsing2020-01-241-2/+2
| | | | | | This means that we actually try to process and use signature algorithms. ok beck@ tb@
* Add strings for SSL_aTLS1_3 and SSL_kTLS1_3 to SSL_CIPHER_description().jsing2020-01-241-1/+7
| | | | | | | Mkaes `openssl ciphers -v` print au and kx values for TLSv1.3 cipher suites. ok beck@ tb@
* Fix breakage in SSL_connect, SSL_accept, etc. by not propagatingbeck2020-01-243-13/+42
| | | | | | | | | new retry conditions from the record layer all the way up to the callers. Instead we catch them at the top of the record layer and retry the operations, unless we actually got a retry indicated from actual IO operations. ok jsing@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-05 21:05:14 +0000