WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/lib/libssl/ssl_lib.c?h=jd%2Fhistogram 2020-05-23T12:14:52Z 2020-05-23T12:14:52Z jsing jsing@openbsd.org 2020-05-23T12:14:52Z urn:sha1:4a4f8340189388be6391e3ef4dd31948673548ca In TLSv1.2 and earlier, when an application goes to read application data, handshake messages may be received instead, when the peer has triggered renegotation. A similar thing occurs in TLSv1.3 when key updates are triggered or the server sends new session tickets. Due to the SSL_read() API there is no way to indicate that we got no application data, instead after processing the in-band handshake messages it would be normal to return SSL_ERROR_WANT_READ and have the caller call SSL_read() again. However, various applications expect SSL_read() to return with either application data or a fatal error, when used on a blocking socket. These applications do not play well with TLSv1.3 post-handshake handshake messages (PHH), as they fail to handle SSL_ERROR_WANT_READ. The same code is also broken in the case of a TLSv1.2 or older renegotiation, however these are less likely to be encountered. Such code should set SSL_MODE_AUTO_RETRY in order to avoid these issues. Contrary to the naming, SSL_MODE_AUTO_RETRY does not actually retry in every case - it retries following handshake messages in the application data stream (i.e. renegotiation and PHH messages). This works around the unretried SSL_read() on a blocking socket case, however in the case where poll/select is used with blocking sockets, the retry will likely result in the read blocking after the handshake messages are processed. Rather than pushing for broken code to be fixed, OpenSSL decided to enable SSL_MODE_AUTO_RETRY by default, instead breaking code that does poll or select on blocking sockets (like s_client and s_server). Unfortunately we get to follow suit. ok beck@ inoguchi@ tb@ 2020-05-23T11:30:12Z tb tb@openbsd.org 2020-05-23T11:30:12Z urn:sha1:10b56f99ea144df3192758cbf561dce06bc077f1 2020-05-21T19:28:32Z jsing jsing@openbsd.org 2020-05-21T19:28:32Z urn:sha1:9bb5a3477f6ebe4c2c44b68170e2519b5564a5f1 Prompted by tb@ ok tb@ 2020-05-19T16:35:20Z jsing jsing@openbsd.org 2020-05-19T16:35:20Z urn:sha1:169335620533869b7ff0801b3d95964c01249888 Some time prior to SSLeay 0.8.1b, SSL_PKEY_RSA_SIGN got added with the intention of handling RSA sign only certificates... this incomplete code had the following comment: /* check to see if this is a signing only certificate */ /* EAY EAY EAY EAY */ And while the comment was removed in 2005, the incomplete RSA sign-only handling has remained ever since. Remove SSL_PKEY_RSA_SIGN and rename SSL_PKEY_RSA_ENC to SSL_PKEY_RSA. While here also remove the unused SSL_PKEY_DH_RSA. ok tb@ 2020-05-10T14:17:47Z jsing jsing@openbsd.org 2020-05-10T14:17:47Z urn:sha1:d875fefd47f9f124550eb48e77679245674fcaf2 The OCSP response length is currently an integer, which is overloaded with -1 meaning "unset". Use a size_t for the OCSP response length and infer unset from the OCSP response being NULL. This makes code more readable, simpler and less error prone. ok beck@ 2020-03-16T15:25:13Z tb tb@openbsd.org 2020-03-16T15:25:13Z urn:sha1:ab91a68d0f0554a3c126655f22833d1b554a3051 to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing 2020-01-26T07:24:47Z jsing jsing@openbsd.org 2020-01-26T07:24:47Z urn:sha1:3fafa71a3b73b1cac42f2091764fa903368bf5d8 incoming method if it is a client. This addresses the case where TLS_method() is used to initialise a SSL_CTX, then a TLS_client_method() is then set, resulting in TLSv1.2 being used instead of TLSv1.3. This is observable in smtpd. ok beck@ 2020-01-23T10:40:59Z jsing jsing@openbsd.org 2020-01-23T10:40:59Z urn:sha1:d86fea2310d44192f1ec4014ebe43807a1d8b39f Currently, TLSv1.3 cipher suites are filtered out by the fact that they have authentication and key exchange algorithms that are not being set in ssl_set_cert_masks(). Fix this so that ssl3_choose_cipher() works for TLSv1.3, however we also now need to ensure that we filter out TLSv1.3 for non-TLSv1.3 and only select TLSv1.3 for TLSv1.3. ok beck@ tb@ 2020-01-23T03:17:40Z jsing jsing@openbsd.org 2020-01-23T03:17:40Z urn:sha1:8dc90bba8e974cb04a5df610612ea39231af0ebe This will allow the TLSv1.3 stack to provide its own implementation. Nuke a completely bogus comment from SSL_pending() whilst here. ok beck@ 2020-01-21T04:45:18Z tb tb@openbsd.org 2020-01-21T04:45:18Z urn:sha1:070fefd49d42f313a21115021854663912e5c7da SSL_{clear,free}(3). Make sure the handshake context is cleaned up completely: the hs_tls13 reacharound is taken care of by ssl3_{clear,free}(3). Add a missing tls13_handshake_msg_free() call to tls13_ctx_free(). ok beck jsing