summaryrefslogtreecommitdiffstats
path: root/lib
AgeCommit message (Collapse)AuthorFilesLines
2021-04-02swap rname and mname in debug output, and handle the USE_CD flageric1-3/+4
from Boudewijn Dijkstra
2021-04-01For the snprintf range check demo, add a (size_t) cast in the right placederaadt1-3/+3
which will satisfy the toughest compiler options
2021-03-31tweak column widths of a .Bl -column tableschwarze1-3/+4
and avoid an over-long source line while here; OK martijn@ jmc@
2021-03-31Update for DTLSv1.2 support.tb1-2/+4
2021-03-31change the barrier so that fd's are always passed and received witheric1-8/+10
the first byte of the imsg they belong to. idea, tweaks and ok claudio@
2021-03-31Bump minors after symbol additiontb3-3/+3
2021-03-31Expose various DTLSv1.2 specific functions and definestb5-27/+8
ok bcook inoguchi jsing
2021-03-31Document SSL_set_hostflags(3) and SSL_get0_peername(3)tb1-18/+4
ok bcook inoguchi jsing
2021-03-31Expose SSL_set_hostflags(3) and SSL_get0_peername(3)tb2-3/+3
ok bcook inoguchi jsing
2021-03-31Document SSL_use_certificate_chain_file(3)tb1-11/+3
ok bcook inoguchi jsing
2021-03-31Expose SSL_use_certificate_chain_file(3)tb2-3/+2
ok bcook inoguchi jsing
2021-03-31Provide missing prototype for d2i_DSAPrivateKey_fp(3)tb1-1/+2
ok bcook inoguchi jsing
2021-03-31Document EVP_PKEY_new_CMAC_key(3)tb1-16/+4
ok bcook inoguchi jsing
2021-03-31Provide EVP_PKEY_new_CMAC_key(3)tb2-5/+2
ok bcook inoguchi jsing
2021-03-29whitespace nitstb1-4/+4
2021-03-29Prepare documenting EVP_PKEY_new_CMAC_key(3)tb1-2/+54
Based on some text in OpenSSL 1.1.1's EVP_PKEY_new.pod.
2021-03-29Remove pointless assignment in SSL_get0_alpn_selected().jsing1-4/+1
ok tb@
2021-03-29Avoid transcript initialisation when sending a TLS HelloRequest.jsing1-4/+6
When server side renegotiation is triggered, the TLSv1.2 state machine sends a HelloRequest before going to ST_SW_FLUSH and ST_OK. In this case we do not need the transcript and currently hit the sanity check in ST_OK that ensures the transcript has been freed, breaking server initiated renegotiation. We do however need the transcript in the DTLS case. ok tb@
2021-03-29Move finished and peer finished to the handshake struct.jsing7-44/+44
This moves the finish_md and peer_finish_md from the 'tmp' struct to the handshake struct, renaming to finished and peer_finished in the process. This also allows the remaining S3I(s) references to be removed from the TLSv1.3 client and server. ok inoguchi@ tb@
2021-03-29Move the TLSv1.2 record number increment into the new record layer.jsing3-19/+44
This adds checks (based on the TLSv1.3 implementation) to ensure that the TLS/DTLS sequence numbers do not wrap, as required by the respective RFCs. ok inoguchi@ tb@
2021-03-29Prepare to provide EVP_PKEY_new_CMAC_key()tb4-20/+84
sebastia ran into this when attempting to update security/hcxtools. This will be tested via wycheproof.go once the symbol is public. ok jsing, tested by sebastia
2021-03-27Garbage collect s->internal->typetb6-18/+9
This variable is used in the legacy stack to decide whether we are a server or a client. That's what s->server is for... The new TLSv1.3 stack failed to set s->internal->type, which resulted in hilarious mishandling of previous_{client,server}_finished. Indeed, both client and server would first store the client's verify_data in previous_server_finished and later overwrite it with the server's verify_data. Consequently, renegotiation has been completely broken for more than a year. In fact, server side renegotiation was broken during the 6.5 release cycle. Clearly, no-one uses this. This commit fixes client side renegotiation and restores the previous behavior of SSL_get_client_CA_list(). Server side renegotiation will be fixed in a later commit. ok jsing
2021-03-25Avoid mangled output in BIO_debug_callbacktb1-4/+12
Instead of blindly skipping 14 characters, we can use the return value of snprintf() to determine how much we should skip. From Martin Vahlensieck with minor tweaks by me
2021-03-24Rename new_cipher to cipher.jsing11-64/+64
This is in the SSL_HANDSHAKE struct and is what we're currently negotiating, so there is really nothing more "new" about the cipher than there is the key block or other parts of the handshake data. ok inoguchi@ tb@
2021-03-24Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data.jsing5-40/+48
Move TLSv1.2 specific components over from SSL_HANDSHAKE. ok inoguchi@ tb@
2021-03-23OCSP_basic_verify() doesn't set errno, so use tls_set_errorx()tb1-2/+2
ok inoguchi
2021-03-21Fully initialize rrec in tls12_record_layer_open_record_protectedtb1-1/+2
The CBC code path initializes rrec.padding_length in an indirect fashion and later makes use of it for copying the MAC. This is confusing some static analyzers as well as people investigating the whining. Avoid this confusion and add a bit of robustness by clearing the stack variable up front. ok jsing
2021-03-21Move the TLSv1.3 handshake struct inside the shared handshake struct.jsing9-226/+227
There are currently three different handshake structs that are in use - the SSL_HANDSHAKE struct (as S3I(s)->hs), the SSL_HANDSHAKE_TLS13 struct (as S3I(s)->hs_tls13 or ctx->hs in the TLSv1.3 code) and the infamous 'tmp' embedded in SSL3_STATE_INTERNAL (as S3I(s)->tmp)). This is the first step towards cleaning up the handshake structs so that shared data is in the SSL_HANDSHAKE struct, with sub-structs for TLSv1.2 and TLSv1.3 specific information. Place SSL_HANDSHAKE_TLS13 inside SSL_HANDSHAKE and change ctx->hs to refer to the SSL_HANDSHAKE struct instead of the SSL_HANDSHAKE_TLS13 struct. This allows the TLSv1.3 code to access the shared handshake data without needing the SSL struct. ok inoguchi@ tb@
2021-03-21Split TLSv1.3 record protection from record layer.jsing1-46/+72
This makes the TLSv1.2 and TLSv1.3 record layers more consistent and while it is not currently necessary from a functionality perspective, it makes for more readable and simpler code. ok inoguchi@ tb@
2021-03-21Avoid a use-after-scope in tls13_cert_add().jsing1-4/+3
A parent CBB retains a reference to a child CBB until CBB_flush() or CBB_cleanup() is called. As such, the cert_exts CBB must be at function scope. Reported by Ilya Shipitsin. ok tb@
2021-03-19Prepare documenting SSL_use_certificate_chain_filetb1-2/+19
2021-03-19Undo previous. As pointed out by jsing I clearly wasn't fully awake...tb1-2/+2
2021-03-19Prepare to provide SSL_use_certificate_chain_file()tb2-15/+40
This is the same as SSL_CTX_use_certificate_chain_file() but for an SSL object instead of an SSL_CTX object. remi found this in a recent librelp update, so we need to provide it. The function will be exposed in an upcoming library bump. ok inoguchi on an earlier version, input/ok jsing
2021-03-19Fix copy-paste error in previoustb1-2/+2
Found the hard way by lists y42 org via an OCSP validation failure that in turn caused pkg_add over TLS to fail. Detailed report by sthen. ok sthen
2021-03-18Type-cast getpagesize() from int to size_t for the comparison with d.claudio1-2/+2
getpagesize() will only return positive numbers (there is no negative page size system) and it can not fail. Should fix some compiler warnings seen in -portable projects. OK otto@
2021-03-17fix whitespace nit in previoustb1-2/+2
2021-03-17Enable DTLSv1.2.jsing1-1/+5
This means that the DTLS_method() will now use DTLSv1.2 rather than DTLSv1. Additional DTLSv1.2 related symbols and defines will be made publicly visible in the near future. ok inoguchi@ tb@
2021-03-17Add support for DTLSv1.2 version handling.jsing1-45/+117
This teaches the version functions that handle protocol versions about DTLSv1.2 and the SSL_OP_NO_DTLS* options. We effectively convert between TLS and TLS protocol versions where necessary. ok inoguchi@ tb@
2021-03-13Use EXFLAG_INVALID to handle out of memory and parse errors intobhe2-11/+45
x509v3_cache_extensions(). ok tb@
2021-03-12Zap a useless variable.tb1-4/+2
suggested by jsing
2021-03-12Missing void in function definitiontb1-2/+2
ok jsing
2021-03-12Fix checks of memory caps of constraints namestb3-20/+32
x509_internal.h defines caps on the number of name constraints and other names (such as subjectAltNames) that we want to allocate per cert chain. These limits are checked too late. In a particularly silly cert that jan found on ugos.ugm.ac.id 443, we ended up allocating six times 2048 x509_constraint_name structures before deciding that these are more than 512. Fix this by adding a names_max member to x509_constraints_names which is set on allocation against which each addition of a name is checked. cluebat/ok jsing ok inoguchi on earlier version
2021-03-12fix previousjsg1-2/+2
2021-03-12spelling: refenece -> referencejmc1-3/+3
2021-03-12spellingjsg17-52/+52
2021-03-11Remove ssl_downgrade_max_version().jsing5-54/+15
Now that we store our maximum TLS version at the start of the handshake, we can check against that directly. ok inoguchi@ tb@
2021-03-11that 0 should be NULLderaadt1-2/+2
2021-03-10Don't return ERR if resize didn't change sizemillert6-20/+25
This is a backport of the ncurses 5.9 20120707 patch. Previously, getch() would return ERR if SIGWINCH was received but the window didn't actually change size. This can happen, for example, when the xterm font is changed. OK tb@
2021-03-10Guard TLS1_get_{client_,}version() macros with #ifndef LIBRESSL_INTERNAL.jsing1-1/+3
These are no longer used (and should not be used) internally.
2021-03-10Improve internal version handling.jsing9-108/+145
Add handshake fields for our minimum TLS version, our maximum TLS version and the TLS version negotiated during the handshake. Initialise our min/max versions at the start of the handshake and leave these unchanged. The negotiated TLS version is set in the client once we receive the ServerHello and in the server at the point we select the highest shared version. Provide an ssl_effective_version() function that returns the negotiated TLS version if known, otherwise our maximum TLS version - this is effectively what is stored in s->version currently. Convert most of the internal code to use one of these three version fields, which greatly simplifies code (especially in the TLS extension handling code). ok tb@
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.