summaryrefslogtreecommitdiffstats
path: root/lib/libssl
AgeCommit message (Collapse)AuthorFilesLines
2021-03-31Update for DTLSv1.2 support.tb1-2/+4
2021-03-31Bump minors after symbol additiontb1-1/+1
2021-03-31Expose various DTLSv1.2 specific functions and definestb4-27/+7
ok bcook inoguchi jsing
2021-03-31Document SSL_set_hostflags(3) and SSL_get0_peername(3)tb1-18/+4
ok bcook inoguchi jsing
2021-03-31Expose SSL_set_hostflags(3) and SSL_get0_peername(3)tb2-3/+3
ok bcook inoguchi jsing
2021-03-31Document SSL_use_certificate_chain_file(3)tb1-11/+3
ok bcook inoguchi jsing
2021-03-31Expose SSL_use_certificate_chain_file(3)tb2-3/+2
ok bcook inoguchi jsing
2021-03-29whitespace nitstb1-4/+4
2021-03-29Remove pointless assignment in SSL_get0_alpn_selected().jsing1-4/+1
ok tb@
2021-03-29Avoid transcript initialisation when sending a TLS HelloRequest.jsing1-4/+6
When server side renegotiation is triggered, the TLSv1.2 state machine sends a HelloRequest before going to ST_SW_FLUSH and ST_OK. In this case we do not need the transcript and currently hit the sanity check in ST_OK that ensures the transcript has been freed, breaking server initiated renegotiation. We do however need the transcript in the DTLS case. ok tb@
2021-03-29Move finished and peer finished to the handshake struct.jsing7-44/+44
This moves the finish_md and peer_finish_md from the 'tmp' struct to the handshake struct, renaming to finished and peer_finished in the process. This also allows the remaining S3I(s) references to be removed from the TLSv1.3 client and server. ok inoguchi@ tb@
2021-03-29Move the TLSv1.2 record number increment into the new record layer.jsing3-19/+44
This adds checks (based on the TLSv1.3 implementation) to ensure that the TLS/DTLS sequence numbers do not wrap, as required by the respective RFCs. ok inoguchi@ tb@
2021-03-27Garbage collect s->internal->typetb6-18/+9
This variable is used in the legacy stack to decide whether we are a server or a client. That's what s->server is for... The new TLSv1.3 stack failed to set s->internal->type, which resulted in hilarious mishandling of previous_{client,server}_finished. Indeed, both client and server would first store the client's verify_data in previous_server_finished and later overwrite it with the server's verify_data. Consequently, renegotiation has been completely broken for more than a year. In fact, server side renegotiation was broken during the 6.5 release cycle. Clearly, no-one uses this. This commit fixes client side renegotiation and restores the previous behavior of SSL_get_client_CA_list(). Server side renegotiation will be fixed in a later commit. ok jsing
2021-03-24Rename new_cipher to cipher.jsing11-64/+64
This is in the SSL_HANDSHAKE struct and is what we're currently negotiating, so there is really nothing more "new" about the cipher than there is the key block or other parts of the handshake data. ok inoguchi@ tb@
2021-03-24Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data.jsing5-40/+48
Move TLSv1.2 specific components over from SSL_HANDSHAKE. ok inoguchi@ tb@
2021-03-21Fully initialize rrec in tls12_record_layer_open_record_protectedtb1-1/+2
The CBC code path initializes rrec.padding_length in an indirect fashion and later makes use of it for copying the MAC. This is confusing some static analyzers as well as people investigating the whining. Avoid this confusion and add a bit of robustness by clearing the stack variable up front. ok jsing
2021-03-21Move the TLSv1.3 handshake struct inside the shared handshake struct.jsing9-226/+227
There are currently three different handshake structs that are in use - the SSL_HANDSHAKE struct (as S3I(s)->hs), the SSL_HANDSHAKE_TLS13 struct (as S3I(s)->hs_tls13 or ctx->hs in the TLSv1.3 code) and the infamous 'tmp' embedded in SSL3_STATE_INTERNAL (as S3I(s)->tmp)). This is the first step towards cleaning up the handshake structs so that shared data is in the SSL_HANDSHAKE struct, with sub-structs for TLSv1.2 and TLSv1.3 specific information. Place SSL_HANDSHAKE_TLS13 inside SSL_HANDSHAKE and change ctx->hs to refer to the SSL_HANDSHAKE struct instead of the SSL_HANDSHAKE_TLS13 struct. This allows the TLSv1.3 code to access the shared handshake data without needing the SSL struct. ok inoguchi@ tb@
2021-03-21Split TLSv1.3 record protection from record layer.jsing1-46/+72
This makes the TLSv1.2 and TLSv1.3 record layers more consistent and while it is not currently necessary from a functionality perspective, it makes for more readable and simpler code. ok inoguchi@ tb@
2021-03-21Avoid a use-after-scope in tls13_cert_add().jsing1-4/+3
A parent CBB retains a reference to a child CBB until CBB_flush() or CBB_cleanup() is called. As such, the cert_exts CBB must be at function scope. Reported by Ilya Shipitsin. ok tb@
2021-03-19Prepare documenting SSL_use_certificate_chain_filetb1-2/+19
2021-03-19Undo previous. As pointed out by jsing I clearly wasn't fully awake...tb1-2/+2
2021-03-19Prepare to provide SSL_use_certificate_chain_file()tb2-15/+40
This is the same as SSL_CTX_use_certificate_chain_file() but for an SSL object instead of an SSL_CTX object. remi found this in a recent librelp update, so we need to provide it. The function will be exposed in an upcoming library bump. ok inoguchi on an earlier version, input/ok jsing
2021-03-17fix whitespace nit in previoustb1-2/+2
2021-03-17Enable DTLSv1.2.jsing1-1/+5
This means that the DTLS_method() will now use DTLSv1.2 rather than DTLSv1. Additional DTLSv1.2 related symbols and defines will be made publicly visible in the near future. ok inoguchi@ tb@
2021-03-17Add support for DTLSv1.2 version handling.jsing1-45/+117
This teaches the version functions that handle protocol versions about DTLSv1.2 and the SSL_OP_NO_DTLS* options. We effectively convert between TLS and TLS protocol versions where necessary. ok inoguchi@ tb@
2021-03-11Remove ssl_downgrade_max_version().jsing5-54/+15
Now that we store our maximum TLS version at the start of the handshake, we can check against that directly. ok inoguchi@ tb@
2021-03-10Guard TLS1_get_{client_,}version() macros with #ifndef LIBRESSL_INTERNAL.jsing1-1/+3
These are no longer used (and should not be used) internally.
2021-03-10Improve internal version handling.jsing9-108/+145
Add handshake fields for our minimum TLS version, our maximum TLS version and the TLS version negotiated during the handshake. Initialise our min/max versions at the start of the handshake and leave these unchanged. The negotiated TLS version is set in the client once we receive the ServerHello and in the server at the point we select the highest shared version. Provide an ssl_effective_version() function that returns the negotiated TLS version if known, otherwise our maximum TLS version - this is effectively what is stored in s->version currently. Convert most of the internal code to use one of these three version fields, which greatly simplifies code (especially in the TLS extension handling code). ok tb@
2021-03-02Separate variable declaration and assignment.jsing1-2/+4
Requested by tb@
2021-03-02Replace two handrolled tls12_record_protection_engaged().jsing1-3/+3
Noted by tb@
2021-03-02Move key/IV length checks closer to usage sites.jsing1-5/+11
Also add explicit checks against EVP_CIPHER_iv_length() and EVP_CIPHER_key_length(). Requested by tb@ during review. ok tb@
2021-03-02Add tls12_record_protection_unused() and call from CCS functions.jsing1-8/+17
This moves the check closer to where a leak could occur and checks all pointers in the struct. Suggested by tb@ during review. ok tb@
2021-03-02Fix misleading indentation in SSL_get_error()tb1-2/+2
2021-02-27Move handling of cipher/hash based cipher suites into the new record layer.jsing5-200/+141
ok tb@
2021-02-27Identify DTLS based on the version major value.jsing1-2/+2
This avoids the need to match specific DTLS version numbers.
2021-02-25Only use TLS versions internally (rather than both TLS and DTLS versions).jsing9-128/+132
DTLS protocol version numbers are the 1's compliment of human readable TLS version numbers, which means that newer versions decrease in value and there is no direct mapping between TLS protocol version numbers and DTLS protocol version numbers. Rather than having to deal with this internally, only use TLS versions internally and map between DTLS and TLS protocol versions when necessary. Rename functions and variables to use 'tls_version' when they contain a TLS version (and never a DTLS version). ok tb@
2021-02-22Fix bizarre punctuation and capitalization in a comment.tb1-2/+2
2021-02-22Simplify version checks in the TLSv1.3 clienttb1-22/+10
Ensure that the server announced TLSv1.3 (and nothing higher) in the supported_versions extension. In that case, the legacy_version must be TLSv1.2 according to RFC 8446, 4.1.3 and 4.2.1. This commit also removes some unreachable code which is a remnant of very early TLSv1.3 code from before the legacy fallback was introduced. Simplify a few checks and adjust some comments nearby. ok jsing
2021-02-22Factor out/change some of the legacy client version handling code.jsing3-12/+36
This consolidates the version handling code and will make upcoming changes easier. ok tb@
2021-02-20ugly whitespacetb2-14/+14
2021-02-20Rename f_err into fatal_err.tb7-183/+183
discussed with jsing
2021-02-20Rename the truncated label into decode_err. This describes its purposetb2-73/+73
better and doesn't look odd if there's trailing data for exapmle. Indent a few labels in the neighborhood while there. ok jsing
2021-02-20Return a min/max version of zero if set to zero.jsing3-17/+41
OpenSSL's SSL{_CTX,}_get_{min,max}_proto_version() return a version of zero if the minimum or maximum has been set to zero (which means the minimum or maximum version supported by the method). Previously we returned the minimum or maximum version supported by the method, instead of zero. Match OpenSSL's behaviour by using shadow variables. Discussed with tb@
2021-02-20Add DTLSv1.2 methods.jsing2-3/+159
These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
2021-02-20Handle DTLS1_2_VERSION in various places.jsing3-6/+9
ok tb@
2021-02-20Revise HelloVerifyRequest handling for DTLSv1.2.jsing2-4/+14
Per RFC 6347 section 4.2.1, the HelloVerifyRequest should always contain DTLSv1.0 - ensure this is the case on the server side, allow both DTLSv1.0 and DTLSv1.2 on the client. ok tb@
2021-02-20Group HelloVerifyRequest decoding and add missing check for trailing data.jsing1-4/+5
ok tb@
2021-02-20Add various public DTLS related defines.jsing2-2/+14
These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
2021-02-20Clean up/simplify dtls1_get_cipher().jsing1-7/+8
ok tb@
2021-02-08Remove bogus DTLS checks to disable ECC and OCSP.jsing2-10/+3
ECC and OCSP can be used with DTLS, so remove bogus checks that currently prevent it. These are long lasting remnants from the original OpenSSL code. ok tb@
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.