From fcc903ee8faa79f7dedb22f05008724ea327bdba Mon Sep 17 00:00:00 2001 From: tb <> Date: Fri, 21 Aug 2026 17:15:22 +0000 Subject: Change RFC references from 8446 to 9846 and adjust section numbers with/ok kenjiro --- src/lib/libcrypto/rsa/rsa_ameth.c | 4 ++-- src/lib/libssl/man/SSL_get_finished.3 | 6 +++--- src/lib/libssl/man/SSL_read_early_data.3 | 12 +++++------ src/lib/libssl/s3_lib.c | 4 ++-- src/lib/libssl/ssl_clnt.c | 4 ++-- src/lib/libssl/ssl_local.h | 4 ++-- src/lib/libssl/ssl_sigalgs.h | 6 +++--- src/lib/libssl/ssl_srvr.c | 4 ++-- src/lib/libssl/ssl_tlsext.c | 34 +++++++++++++++----------------- src/lib/libssl/ssl_tlsext.h | 4 ++-- src/lib/libssl/tls1.h | 12 +++++------ src/lib/libssl/tls13_client.c | 18 ++++++++--------- src/lib/libssl/tls13_handshake.c | 4 ++-- src/lib/libssl/tls13_internal.h | 6 +++--- src/lib/libssl/tls13_key_schedule.c | 12 +++++------ src/lib/libssl/tls13_lib.c | 16 +++++++-------- src/lib/libssl/tls13_record.h | 6 +++--- src/lib/libssl/tls13_record_layer.c | 24 +++++++++++----------- src/lib/libssl/tls13_server.c | 16 +++++++-------- 19 files changed, 97 insertions(+), 99 deletions(-) (limited to 'src') diff --git a/src/lib/libcrypto/rsa/rsa_ameth.c b/src/lib/libcrypto/rsa/rsa_ameth.c index aca00a9ec8..9d8e2d2789 100644 --- a/src/lib/libcrypto/rsa/rsa_ameth.c +++ b/src/lib/libcrypto/rsa/rsa_ameth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rsa_ameth.c,v 1.65 2026/04/07 13:16:41 tb Exp $ */ +/* $OpenBSD: rsa_ameth.c,v 1.66 2026/08/21 17:15:22 tb Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2006. */ @@ -879,7 +879,7 @@ rsa_pss_signature_info(const X509_ALGOR *alg, int *out_md_nid, goto err; /* - * RFC 8446, section 4.2.3 - restricts the digest algorithm: + * RFC 9846, section 4.3.3 - restricts the digest algorithm: * - it must be one of SHA256, SHA384, and SHA512; * - the same digest must be used in the mask generation function; * - the salt length must match the output length of the digest. diff --git a/src/lib/libssl/man/SSL_get_finished.3 b/src/lib/libssl/man/SSL_get_finished.3 index 74e398563e..bf3913f7f0 100644 --- a/src/lib/libssl/man/SSL_get_finished.3 +++ b/src/lib/libssl/man/SSL_get_finished.3 @@ -1,4 +1,4 @@ -.\" $OpenBSD: SSL_get_finished.3,v 1.4 2026/08/21 17:05:01 tb Exp $ +.\" $OpenBSD: SSL_get_finished.3,v 1.5 2026/08/21 17:15:22 tb Exp $ .\" .\" Copyright (c) 2020 Theo Buehler .\" @@ -62,8 +62,8 @@ finished message. .Xr SSL_get_session 3 , .Xr SSL_set_session 3 .Sh STANDARDS -RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3, -section 4.4.4: Finished. +RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3, +section 4.5.3: Finished. .Pp RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2, section 7.4.9: Finished. diff --git a/src/lib/libssl/man/SSL_read_early_data.3 b/src/lib/libssl/man/SSL_read_early_data.3 index d36b1e49f7..5ad0dc1d9d 100644 --- a/src/lib/libssl/man/SSL_read_early_data.3 +++ b/src/lib/libssl/man/SSL_read_early_data.3 @@ -1,4 +1,4 @@ -.\" $OpenBSD: SSL_read_early_data.3,v 1.5 2025/06/08 22:52:00 schwarze Exp $ +.\" $OpenBSD: SSL_read_early_data.3,v 1.6 2026/08/21 17:15:22 tb Exp $ .\" content checked up to: OpenSSL 6328d367 Jul 4 21:58:30 2020 +0200 .\" .\" Copyright (c) 2020 Ingo Schwarze @@ -15,7 +15,7 @@ .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.Dd $Mdocdate: June 8 2025 $ +.Dd $Mdocdate: August 21 2026 $ .Dt SSL_READ_EARLY_DATA 3 .Os .Sh NAME @@ -158,15 +158,15 @@ or .Xr SSL_read 3 , .Xr SSL_write 3 .Sh STANDARDS -RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3: -.Bl -tag -width "section 4.2.10" -compact +RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3: +.Bl -tag -width "section 4.3.10" -compact .It Section 2.3 0-RTT data -.It Section 4.2.10 +.It Section 4.3.10 Early Data Indication .It Section 8 0-RTT and Anti-Replay -.It Appendix E.5 +.It Appendix F.5 Replay Attacks on 0-RTT .El .Sh HISTORY diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c index 929de03a3d..9a5e8cd2cc 100644 --- a/src/lib/libssl/s3_lib.c +++ b/src/lib/libssl/s3_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_lib.c,v 1.261 2026/07/31 03:59:50 kenjiro Exp $ */ +/* $OpenBSD: s3_lib.c,v 1.262 2026/08/21 17:15:22 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -722,7 +722,7 @@ const SSL_CIPHER ssl3_ciphers[] = { #ifdef LIBRESSL_HAS_TLS1_3 /* - * TLSv1.3 cipher suites (RFC 8446). + * TLSv1.3 cipher suites (RFC 9846). */ { .value = 0x1301, diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c index 4803e35dd2..69221332f5 100644 --- a/src/lib/libssl/ssl_clnt.c +++ b/src/lib/libssl/ssl_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_clnt.c,v 1.175 2026/07/15 15:00:17 jsing Exp $ */ +/* $OpenBSD: ssl_clnt.c,v 1.176 2026/08/21 17:15:22 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -893,7 +893,7 @@ ssl3_get_server_hello(SSL *s) if (s->s3->hs.our_max_tls_version >= TLS1_2_VERSION && s->s3->hs.negotiated_tls_version < s->s3->hs.our_max_tls_version) { /* - * RFC 8446 section 4.1.3. We must not downgrade if the server + * RFC 9846 section 4.2.3. We must not downgrade if the server * random value contains the TLS 1.2 or TLS 1.1 magical value. */ if (!CBS_skip(&server_random, diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h index 9999d55963..67ca4a5511 100644 --- a/src/lib/libssl/ssl_local.h +++ b/src/lib/libssl/ssl_local.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_local.h,v 1.42 2026/06/08 11:38:04 tb Exp $ */ +/* $OpenBSD: ssl_local.h,v 1.43 2026/08/21 17:15:22 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -428,7 +428,7 @@ struct ssl_session_st { char *tlsext_hostname; - /* Session resumption - RFC 5077 and RFC 8446. */ + /* Session resumption - RFC 5077 and RFC 9846. */ unsigned char *tlsext_tick; /* Session ticket */ size_t tlsext_ticklen; /* Session ticket length */ uint32_t tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */ diff --git a/src/lib/libssl/ssl_sigalgs.h b/src/lib/libssl/ssl_sigalgs.h index 775842a093..e435ccc287 100644 --- a/src/lib/libssl/ssl_sigalgs.h +++ b/src/lib/libssl/ssl_sigalgs.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_sigalgs.h,v 1.28 2026/05/31 14:34:44 jsing Exp $ */ +/* $OpenBSD: ssl_sigalgs.h,v 1.29 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018-2019 Bob Beck * @@ -23,8 +23,8 @@ __BEGIN_HIDDEN_DECLS #define SIGALG_NONE 0x0000 /* - * RFC 8446 Section 4.2.3 - * RFC 5246 Section 7.4.1.4.1 + * RFC 9846 section 4.3.3 + * RFC 5246 section 7.4.1.4.1 */ #define SIGALG_RSA_PKCS1_SHA224 0x0301 #define SIGALG_RSA_PKCS1_SHA256 0x0401 diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c index 73bdeacce0..43260d8065 100644 --- a/src/lib/libssl/ssl_srvr.c +++ b/src/lib/libssl/ssl_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_srvr.c,v 1.170 2026/06/06 15:24:26 jsing Exp $ */ +/* $OpenBSD: ssl_srvr.c,v 1.171 2026/08/21 17:15:22 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1027,7 +1027,7 @@ ssl3_get_client_hello(SSL *s) if (s->s3->hs.our_max_tls_version >= TLS1_2_VERSION && s->s3->hs.negotiated_tls_version < s->s3->hs.our_max_tls_version) { /* - * RFC 8446 section 4.1.3. If we are downgrading from TLS 1.3 + * RFC 9846 section 4.2.3. If we are downgrading from TLS 1.3 * we must set the last 8 bytes of the server random to magical * values to indicate we meant to downgrade. For TLS 1.2 it is * recommended that we do the same. diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c index 039218e1ef..35e554e292 100644 --- a/src/lib/libssl/ssl_tlsext.c +++ b/src/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.165 2026/08/18 04:40:17 tb Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.166 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2016, 2017, 2019 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -281,10 +281,8 @@ tlsext_supportedgroups_server_process(SSL *s, uint16_t msg_type, CBS *cbs, if (!CBS_get_u16(&grouplist, &groups[i])) goto err; /* - * Do not allow duplicate groups to be sent. This is not - * currently specified in RFC 8446 or earlier, but there is no - * legitimate justification for this to occur in TLS 1.2 or TLS - * 1.3. + * RFC 9846 section 4.3.7: The "named_group_list" MUST NOT + * contain any duplicate entries. */ for (j = 0; j < i; j++) { if (groups[i] == groups[j]) { @@ -336,7 +334,7 @@ tlsext_supportedgroups_client_process(SSL *s, uint16_t msg_type, CBS *cbs, return 0; /* - * RFC 8446, section 4.2.7: TLSv1.3 servers can send this extension but + * RFC 9846 section 4.3.7: TLSv1.3 servers can send this extension but * clients must not act on it during the handshake. This allows servers * to advertise their preferences for subsequent handshakes. We ignore * this complication. @@ -1064,7 +1062,7 @@ tlsext_ocsp_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) if (ssl_effective_tls_version(s) >= TLS1_3_VERSION) { if (msg_type == SSL_TLSEXT_MSG_CR) { /* - * RFC 8446, 4.4.2.1 - the server may request an OCSP + * RFC 9846, 4.5.1.1 - the server may request an OCSP * response with an empty status_request. */ if (CBS_len(cbs) == 0) @@ -1440,7 +1438,7 @@ tlsext_srtp_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) #endif /* OPENSSL_NO_SRTP */ /* - * TLSv1.3 Key Share - RFC 8446 section 4.2.8. + * TLSv1.3 Key Share - RFC 9846 section 4.3.8. */ static int tlsext_keyshare_client_needs(SSL *s, uint16_t msg_type) @@ -1508,7 +1506,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) CBS client_shares, key_exchange; /* - * RFC 8446 section 4.2.8: + * RFC 9846 section 4.3.8: * * Each KeyShareEntry value MUST correspond to a group offered in the * "supported_groups" extension and MUST appear in the same order. @@ -1597,7 +1595,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) /* * There are no supported groups that are shared between the * client and server - this is treated as a handshake failure - * or as insufficient security - see RFC 8446 section 4.1.1. + * or as insufficient security - see RFC 9846 section 4.2.1. */ *alert = TLS13_ALERT_HANDSHAKE_FAILURE; return 0; @@ -1766,7 +1764,7 @@ tlsext_keyshare_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) } /* - * Supported Versions - RFC 8446 section 4.2.1. + * Supported Versions - RFC 9846 section 4.3.1. */ static int tlsext_versions_client_needs(SSL *s, uint16_t msg_type) @@ -1868,7 +1866,7 @@ tlsext_versions_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) /* - * Cookie - RFC 8446 section 4.2.2. + * Cookie - RFC 9846 section 4.3.2. */ static int @@ -1980,7 +1978,7 @@ tlsext_cookie_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) } /* - * Pre-Shared Key Exchange Modes - RFC 8446, 4.2.9. + * Pre-Shared Key Exchange Modes - RFC 9846 section 4.3.9. */ static int @@ -2050,7 +2048,7 @@ tlsext_psk_kex_modes_client_process(SSL *s, uint16_t msg_type, CBS *cbs, } /* - * Pre-Shared Key Extension - RFC 8446, 4.2.11 + * Pre-Shared Key Extension - RFC 9846 section 4.3.11 */ static int @@ -2484,7 +2482,7 @@ tlsext_randomize_build_order(SSL *s) return 0; s->tlsext_build_order_len = N_TLS_EXTENSIONS; - /* RFC 8446, section 4.2 - PSK MUST be the last extension in the CH. */ + /* RFC 9846 section 4.3 - PSK MUST be the last extension in the CH. */ if ((psk_ext = tls_extension_find(TLSEXT_TYPE_pre_shared_key, NULL)) == NULL) return 0; @@ -2538,7 +2536,7 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb) tlsext = s->tlsext_build_order[i]; ext = tlsext_funcs(tlsext, is_server); - /* RFC 8446 Section 4.2 */ + /* RFC 9846 section 4.3 */ if (tls_version >= TLS1_3_VERSION && !(tlsext->messages & msg_type)) continue; @@ -2571,7 +2569,7 @@ static int tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs) { /* - * RFC 8446 4.1.2. For subsequent CH, early data will be removed, + * RFC 9846, 4.2.2. For subsequent CH, early data will be removed, * cookie may be added, padding may be removed. */ struct tls13_ctx *ctx = s->tls13; @@ -2644,7 +2642,7 @@ tlsext_parse(SSL *s, struct tlsext_data *td, int is_server, uint16_t msg_type, goto err; } - /* RFC 8446 Section 4.2 */ + /* RFC 9846 section 4.3 */ if (tls_version >= TLS1_3_VERSION && !(tlsext->messages & msg_type)) { alert_desc = SSL_AD_ILLEGAL_PARAMETER; diff --git a/src/lib/libssl/ssl_tlsext.h b/src/lib/libssl/ssl_tlsext.h index 4fd2ec05a0..e1fc2634c2 100644 --- a/src/lib/libssl/ssl_tlsext.h +++ b/src/lib/libssl/ssl_tlsext.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.h,v 1.34 2024/03/26 03:44:11 beck Exp $ */ +/* $OpenBSD: ssl_tlsext.h,v 1.35 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2016, 2017 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -20,7 +20,7 @@ #ifndef HEADER_SSL_TLSEXT_H #define HEADER_SSL_TLSEXT_H -/* TLSv1.3 - RFC 8446 Section 4.2. */ +/* TLSv1.3 - RFC 9846 section 4.3. */ #define SSL_TLSEXT_MSG_CH 0x0001 /* ClientHello */ #define SSL_TLSEXT_MSG_SH 0x0002 /* ServerHello */ #define SSL_TLSEXT_MSG_EE 0x0004 /* EncryptedExtension */ diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h index 2d5dffc6cf..42451a4214 100644 --- a/src/lib/libssl/tls1.h +++ b/src/lib/libssl/tls1.h @@ -1,4 +1,4 @@ -/* $OpenBSD: tls1.h,v 1.61 2025/04/18 07:34:01 tb Exp $ */ +/* $OpenBSD: tls1.h,v 1.62 2026/08/21 17:15:22 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -240,7 +240,7 @@ extern "C" { /* ExtensionType value from RFC 5054. */ #define TLSEXT_TYPE_srp 12 -/* ExtensionType value from RFC 5246/RFC 8446. */ +/* ExtensionType value from RFC 5246/RFC 9846. */ #define TLSEXT_TYPE_signature_algorithms 13 /* ExtensionType value from RFC 5764. */ @@ -258,7 +258,7 @@ extern "C" { /* ExtensionType value from RFC 4507. */ #define TLSEXT_TYPE_session_ticket 35 -/* ExtensionType values from RFC 8446 section 4.2 */ +/* ExtensionType values from RFC 9846 section 4.3 */ #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) #define TLSEXT_TYPE_pre_shared_key 41 #define TLSEXT_TYPE_early_data 42 @@ -279,7 +279,7 @@ extern "C" { /* * TLS 1.3 extension names from OpenSSL, where they decided to use a different - * name from that given in RFC 8446. + * name from that given in RFC 9846. */ #if defined(LIBRESSL_HAS_TLS1_3) #define TLSEXT_TYPE_psk TLSEXT_TYPE_pre_shared_key @@ -486,7 +486,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb) #define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C4 #define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256 0x030000C5 -/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */ +/* TLS 1.3 cipher suites from RFC 9846 appendix B.4. */ #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) #define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 #define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 @@ -725,7 +725,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb) #define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 "ECDHE-ECDSA-CHACHA20-POLY1305" #define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305 "DHE-RSA-CHACHA20-POLY1305" -/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */ +/* TLS 1.3 cipher suites from RFC 9846 appendix B.4. */ #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) #define TLS1_3_TXT_AES_128_GCM_SHA256 "AEAD-AES128-GCM-SHA256" #define TLS1_3_TXT_AES_256_GCM_SHA384 "AEAD-AES256-GCM-SHA384" diff --git a/src/lib/libssl/tls13_client.c b/src/lib/libssl/tls13_client.c index fec3e825fe..8abfdbdd1f 100644 --- a/src/lib/libssl/tls13_client.c +++ b/src/lib/libssl/tls13_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_client.c,v 1.108 2026/06/14 15:51:17 jsing Exp $ */ +/* $OpenBSD: tls13_client.c,v 1.109 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018, 2019 Joel Sing * @@ -73,8 +73,8 @@ tls13_client_init(struct tls13_ctx *ctx) /* * The legacy session identifier should either be set to an * unpredictable 32-byte value or zero length... a non-zero length - * legacy session identifier triggers compatibility mode (see RFC 8446 - * Appendix D.4). In the pre-TLSv1.3 case a zero length value is used. + * legacy session identifier triggers compatibility mode (see RFC 9846 + * Appendix E.4). In the pre-TLSv1.3 case a zero length value is used. */ if (ctx->middlebox_compat && ctx->hs->our_max_tls_version >= TLS1_3_VERSION) { @@ -242,7 +242,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs) if (tls13_server_hello_is_legacy(cbs)) { if (ctx->hs->our_max_tls_version >= TLS1_3_VERSION) { /* - * RFC 8446 section 4.1.3: we must not downgrade if + * RFC 9846 section 4.2.3: we must not downgrade if * the server random value contains the TLS 1.2 or 1.1 * magical value. */ @@ -285,7 +285,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs) /* * The supported versions extension indicated 0x0304 or greater. * Ensure that it was 0x0304 and that legacy version is set to 0x0303 - * (RFC 8446 section 4.2.1). + * (RFC 9846 section 4.3.1). */ if (ctx->hs->tls13.server_version != TLS1_3_VERSION || legacy_version != TLS1_2_VERSION) { @@ -318,7 +318,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs) if (!(ctx->handshake_stage.hs_type & WITHOUT_HRR) && !ctx->hs->tls13.hrr) { /* * A ServerHello following a HelloRetryRequest MUST use the same - * cipher suite (RFC 8446 section 4.1.4). + * cipher suite (RFC 9846 section 4.2.4). */ if (ctx->hs->cipher != cipher) { ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER; @@ -450,7 +450,7 @@ tls13_client_hello_retry_send(struct tls13_ctx *ctx, CBB *cbb) /* * Ensure that the server supported group is one that we listed in our * supported groups and is not the same as the key share we previously - * offered. See RFC 8446 section 4.2.8. + * offered. See RFC 9846 section 4.3.8. */ if (!tls1_check_group(ctx->ssl, ctx->hs->tls13.server_group)) { ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER; @@ -855,8 +855,8 @@ tls13_client_select_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY **out_cpk, *out_sigalg = NULL; /* - * XXX - RFC 8446, 4.4.2.3: the server can communicate preferences - * with the certificate_authorities (4.2.4) and oid_filters (4.2.5) + * XXX - RFC 9846, 4.5.1.2: the server can communicate preferences + * with the certificate_authorities (4.3.4) and oid_filters (4.3.5) * extensions. We should honor the former and must apply the latter. */ diff --git a/src/lib/libssl/tls13_handshake.c b/src/lib/libssl/tls13_handshake.c index 0dc2333708..24178a3396 100644 --- a/src/lib/libssl/tls13_handshake.c +++ b/src/lib/libssl/tls13_handshake.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_handshake.c,v 1.73 2024/02/03 19:57:14 tb Exp $ */ +/* $OpenBSD: tls13_handshake.c,v 1.74 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018-2021 Theo Buehler * Copyright (c) 2019 Joel Sing @@ -22,7 +22,7 @@ #include "tls13_handshake.h" #include "tls13_internal.h" -/* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */ +/* Based on RFC 9846 and inspired by s2n's TLS 1.2 state machine. */ struct tls13_handshake_action { uint8_t handshake_type; diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h index 7a7f8abc63..d3d7ddb9b3 100644 --- a/src/lib/libssl/tls13_internal.h +++ b/src/lib/libssl/tls13_internal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_internal.h,v 1.105 2025/03/09 15:12:18 tb Exp $ */ +/* $OpenBSD: tls13_internal.h,v 1.106 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018 Bob Beck * Copyright (c) 2018 Theo Buehler @@ -114,7 +114,7 @@ struct tls13_secret { size_t len; }; -/* RFC 8446 Section 7.1 Page 92 */ +/* RFC 9846 section 7.1 */ struct tls13_secrets { const EVP_MD *digest; int resumption; @@ -339,7 +339,7 @@ int tls13_legacy_shutdown(SSL *ssl); int tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert); /* - * Message Types - RFC 8446, Section B.3. + * Message Types - RFC 9846 section B.3. * * Values listed as "_RESERVED" were used in previous versions of TLS and are * listed here for completeness. TLS 1.3 implementations MUST NOT send them but diff --git a/src/lib/libssl/tls13_key_schedule.c b/src/lib/libssl/tls13_key_schedule.c index 05bcf0f006..01fbe6603e 100644 --- a/src/lib/libssl/tls13_key_schedule.c +++ b/src/lib/libssl/tls13_key_schedule.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_key_schedule.c,v 1.18 2022/11/26 16:08:56 tb Exp $ */ +/* $OpenBSD: tls13_key_schedule.c,v 1.19 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018, Bob Beck * @@ -47,7 +47,7 @@ tls13_secret_cleanup(struct tls13_secret *secret) /* * Allocate a set of secrets for a key schedule using - * a size of hash_length from RFC 8446 section 7.1. + * a size of hash_length from RFC 9846 section 7.1. */ struct tls13_secrets * tls13_secrets_create(const EVP_MD *digest, int resumption) @@ -256,7 +256,7 @@ tls13_derive_early_secrets(struct tls13_secrets *secrets, &secrets->empty_hash)) return 0; - /* RFC 8446 recommends */ + /* RFC 9846 recommends */ if (!secrets->insecure) explicit_bzero(secrets->extracted_early.data, secrets->extracted_early.len); @@ -300,7 +300,7 @@ tls13_derive_handshake_secrets(struct tls13_secrets *secrets, &secrets->empty_hash)) return 0; - /* RFC 8446 recommends */ + /* RFC 9846 recommends */ if (!secrets->insecure) explicit_bzero(secrets->extracted_handshake.data, secrets->extracted_handshake.len); @@ -349,7 +349,7 @@ tls13_derive_application_secrets(struct tls13_secrets *secrets, context)) return 0; - /* RFC 8446 recommends */ + /* RFC 9846 recommends */ if (!secrets->insecure) explicit_bzero(secrets->extracted_master.data, secrets->extracted_master.len); @@ -400,7 +400,7 @@ tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len, int ret = 0; /* - * RFC 8446 Section 7.5. + * RFC 9846 section 7.5. */ memset(&context, 0, sizeof(context)); diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c index c3470b2931..f93452402f 100644 --- a/src/lib/libssl/tls13_lib.c +++ b/src/lib/libssl/tls13_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_lib.c,v 1.78 2025/06/07 10:25:12 tb Exp $ */ +/* $OpenBSD: tls13_lib.c,v 1.79 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018, 2019 Joel Sing * Copyright (c) 2019 Bob Beck @@ -25,14 +25,14 @@ #include "tls13_internal.h" /* - * RFC 8446, section 4.6.1. Servers must not indicate a lifetime longer than + * RFC 9846 section 4.7.1. Servers must not indicate a lifetime longer than * 7 days and clients must not cache tickets for longer than 7 days. */ #define TLS13_MAX_TICKET_LIFETIME (7 * 24 * 3600) /* - * Downgrade sentinels - RFC 8446 section 4.1.3, magic values which must be set + * Downgrade sentinels - RFC 9846 section 4.2.3, magic values which must be set * by the server in server random if it is willing to downgrade but supports * TLSv1.3 */ @@ -44,7 +44,7 @@ const uint8_t tls13_downgrade_11[8] = { }; /* - * HelloRetryRequest hash - RFC 8446 section 4.1.3. + * HelloRetryRequest hash - RFC 9846 section 4.2.3. */ const uint8_t tls13_hello_retry_request_hash[32] = { 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, @@ -54,7 +54,7 @@ const uint8_t tls13_hello_retry_request_hash[32] = { }; /* - * Certificate Verify padding - RFC 8446 section 4.4.3. + * Certificate Verify padding - RFC 9846 section 4.5.2. */ const uint8_t tls13_cert_verify_pad[64] = { 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, @@ -156,7 +156,7 @@ tls13_alert_received_cb(uint8_t alert_level, uint8_t alert_desc, void *arg) if (alert_desc == TLS13_ALERT_USER_CANCELED) { /* * We treat this as advisory, since a close_notify alert - * SHOULD follow this alert (RFC 8446 section 6.1). + * MUST follow this alert (RFC 9846 section 6.1). */ return; } @@ -369,7 +369,7 @@ tls13_key_update_recv(struct tls13_ctx *ctx, CBS *cbs) return tls13_send_alert(ctx->rl, alert); } -/* RFC 8446 section 4.6.1 */ +/* RFC 9846 section 4.7.1 */ static ssize_t tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs) { @@ -628,7 +628,7 @@ tls13_synthetic_handshake_message(struct tls13_ctx *ctx) /* * Replace ClientHello with synthetic handshake message - see - * RFC 8446 section 4.4.1. + * RFC 9846 section 4.1. */ if (!tls1_transcript_hash_init(s)) goto err; diff --git a/src/lib/libssl/tls13_record.h b/src/lib/libssl/tls13_record.h index 18e4fa1aba..e9bcae6efd 100644 --- a/src/lib/libssl/tls13_record.h +++ b/src/lib/libssl/tls13_record.h @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_record.h,v 1.5 2021/10/23 13:12:14 jsing Exp $ */ +/* $OpenBSD: tls13_record.h,v 1.6 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2019 Joel Sing * @@ -23,7 +23,7 @@ __BEGIN_HIDDEN_DECLS /* - * TLSv1.3 Record Protocol - RFC 8446 section 5. + * TLSv1.3 Record Protocol - RFC 9846 section 5. * * The maximum plaintext is 2^14, however for inner plaintext an additional * byte is allowed for the content type. A maximum AEAD overhead of 255-bytes @@ -41,7 +41,7 @@ __BEGIN_HIDDEN_DECLS (TLS13_RECORD_HEADER_LEN + TLS13_RECORD_MAX_CIPHERTEXT_LEN) /* - * TLSv1.3 Per-Record Nonces and Sequence Numbers - RFC 8446 section 5.3. + * TLSv1.3 Per-Record Nonces and Sequence Numbers - RFC 9846 section 5.3. */ #define TLS13_RECORD_SEQ_NUM_LEN 8 diff --git a/src/lib/libssl/tls13_record_layer.c b/src/lib/libssl/tls13_record_layer.c index 778356af15..e573b50760 100644 --- a/src/lib/libssl/tls13_record_layer.c +++ b/src/lib/libssl/tls13_record_layer.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_record_layer.c,v 1.75 2026/07/31 03:59:50 kenjiro Exp $ */ +/* $OpenBSD: tls13_record_layer.c,v 1.76 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2018, 2019 Joel Sing * @@ -95,7 +95,7 @@ struct tls13_record_layer { uint8_t alert_level; uint8_t alert_desc; - /* Pending post-handshake handshake messages (RFC 8446, section 4.6). */ + /* Pending post-handshake handshake messages (RFC 9846, section 4.7). */ CBS phh_cbs; uint8_t *phh_data; size_t phh_len; @@ -200,7 +200,7 @@ tls13_record_layer_inc_seq_num(uint8_t *seq_num) { int i; - /* RFC 8446 section 5.3 - sequence numbers must not wrap. */ + /* RFC 9846 section 5.3 - sequence numbers must not wrap. */ if (memcmp(seq_num, tls13_max_seq_num, TLS13_RECORD_SEQ_NUM_LEN) == 0) return 0; @@ -222,7 +222,7 @@ tls13_record_layer_update_nonce(struct tls13_secret *nonce, return 0; /* - * RFC 8446 section 5.3 - sequence number is zero padded and XOR'd + * RFC 9846 section 5.3 - sequence number is zero padded and XOR'd * with the IV to produce a per-record nonce. The IV will also be * at least 8-bytes in length. */ @@ -284,7 +284,7 @@ tls13_record_layer_process_alert(struct tls13_record_layer *rl) ssize_t ret = TLS13_IO_FAILURE; /* - * RFC 8446 - sections 5.1 and 6. + * RFC 9846 - sections 5.1 and 6. * * A TLSv1.3 alert record can only contain a single alert - this means * that processing the alert must consume all of the record. The alert @@ -305,8 +305,8 @@ tls13_record_layer_process_alert(struct tls13_record_layer *rl) tls_content_clear(rl->rcontent); /* - * Alert level is ignored for closure alerts (RFC 8446 section 6.1), - * however for error alerts (RFC 8446 section 6.2), the alert level + * Alert level is ignored for closure alerts (RFC 9846 section 6.1), + * however for error alerts (RFC 9846 section 6.2), the alert level * must be specified as fatal. */ if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) { @@ -344,7 +344,7 @@ tls13_record_layer_send_alert(struct tls13_record_layer *rl) { ssize_t ret; - /* This has to fit into a single record, per RFC 8446 section 5.1. */ + /* This has to fit into a single record, per RFC 9846 section 5.1. */ if ((ret = tls13_record_layer_write_record(rl, SSL3_RT_ALERT, rl->alert_data, rl->alert_len)) != rl->alert_len) { if (ret == TLS13_IO_EOF) @@ -604,7 +604,7 @@ tls13_record_layer_open_record_protected(struct tls13_record_layer *rl) break; } if (content_type == 0) { - /* Unexpected message per RFC 8446 section 5.4. */ + /* Unexpected message per RFC 9846 section 5.4. */ rl->alert = TLS13_ALERT_UNEXPECTED_MESSAGE; goto err; } @@ -835,7 +835,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl) /* * In response to a client hello we may receive an alert in a * record with a legacy version. Otherwise enforce that the - * legacy record version is 0x0303 per RFC 8446, section 5.1. + * legacy record version is 0x0303 per RFC 9846, section 5.1. */ if (rl->legacy_version == TLS1_2_VERSION && tls13_record_version(rl->rrec) != TLS1_2_VERSION && @@ -846,7 +846,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl) * Bag of hacks ahead... after the first ClientHello message has been * sent or received and before the peer's Finished message has been * received, we may receive an unencrypted ChangeCipherSpec record - * (see RFC 8446 section 5 and appendix D.4). This record must be + * (see RFC 9846 section 5 and appendix E.4). This record must be * ignored. */ if (content_type == SSL3_RT_CHANGE_CIPHER_SPEC) { @@ -881,7 +881,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl) /* * On receiving a handshake or alert record with empty inner plaintext, * we must terminate the connection with an unexpected_message alert. - * See RFC 8446 section 5.4. + * See RFC 9846 section 5.4. */ if (tls_content_remaining(rl->rcontent) == 0 && (tls_content_type(rl->rcontent) == SSL3_RT_ALERT || diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c index 8ad11c6428..8b0dc8a26b 100644 --- a/src/lib/libssl/tls13_server.c +++ b/src/lib/libssl/tls13_server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_server.c,v 1.113 2026/07/31 03:59:50 kenjiro Exp $ */ +/* $OpenBSD: tls13_server.c,v 1.114 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2019, 2020 Joel Sing * Copyright (c) 2020 Bob Beck @@ -102,13 +102,13 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx) SSL *s = ctx->ssl; /* - * RFC 8446, section 9.2. If the ClientHello has supported_versions + * RFC 9846 section 9.2. If the ClientHello has supported_versions * containing TLSv1.3, presence or absence of some extensions requires * presence or absence of others. */ /* - * RFC 8446 section 4.2.9 - if we received a pre_shared_key, then we + * RFC 9846 section 4.3.9 - if we received a pre_shared_key, then we * also need psk_key_exchange_modes. Otherwise, section 9.2 specifies * that we need both signature_algorithms and supported_groups. */ @@ -133,7 +133,7 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx) /* * XXX - Require server_name from client? If so, we SHOULD enforce - * this here - RFC 8446, 9.2. + * this here - RFC 9846, 9.2. */ return 1; @@ -246,7 +246,7 @@ tls13_client_hello_process(struct tls13_ctx *ctx, CBS *cbs) /* * The legacy session identifier must either be zero length or a 32 byte * value (in which case the client is requesting middlebox compatibility - * mode), as per RFC 8446 section 4.1.2. If it is valid, store the value + * mode), as per RFC 9846 section 4.2.2. If it is valid, store the value * so that we can echo it back to the client. */ if (CBS_len(&session_id) != 0 && @@ -459,7 +459,7 @@ tls13_server_hello_retry_request_sent(struct tls13_ctx *ctx) /* * If the client has requested middlebox compatibility mode, * we MUST send a dummy CCS following our first handshake message. - * See RFC 8446 Appendix D.4. + * See RFC 9846 Appendix E.4. */ if (ctx->hs->tls13.legacy_session_id_len > 0) ctx->send_dummy_ccs_after = 1; @@ -519,7 +519,7 @@ tls13_server_hello_sent(struct tls13_ctx *ctx) /* * If the client has requested middlebox compatibility mode, * we MUST send a dummy CCS following our first handshake message. - * See RFC 8446 Appendix D.4. + * See RFC 9846 Appendix E.4. */ if ((ctx->handshake_stage.hs_type & WITHOUT_HRR) && ctx->hs->tls13.legacy_session_id_len > 0) @@ -572,7 +572,7 @@ tls13_server_check_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY *cpk, /* * The digitalSignature bit MUST be set if the Key Usage extension is - * present as per RFC 8446 section 4.4.2.2. + * present as per RFC 9846 section 4.5.1.2. */ if (!(X509_get_key_usage(cpk->x509) & X509v3_KU_DIGITAL_SIGNATURE)) goto done; -- cgit v1.2.3-55-g6feb