aboutsummaryrefslogtreecommitdiffstats
path: root/ssl/d1_lib.c
Commit message (Collapse)AuthorAgeFilesLines
...
* Move pqueue into sslRich Salz2016-01-241-2/+2
| | | | | | | | | | | This is an internal facility, never documented, not for public consumption. Move it into ssl (where it's only used for DTLS). I also made the typedef's for pqueue and pitem follow our style: they name structures, not pointers. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Regenerate SSL record/statem error stringsViktor Dukhovni2016-01-101-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Protocol version selection and negotiation rewriteViktor Dukhovni2016-01-021-35/+3
| | | | | | | | | | | | | | | | | | | The protocol selection code is now consolidated in a few consecutive short functions in a single file and is table driven. Protocol-specific constraints that influence negotiation are moved into the flags field of the method structure. The same protocol version constraints are now applied in all code paths. It is now much easier to add new protocol versions without reworking the protocol selection logic. In the presence of "holes" in the list of enabled client protocols we no longer select client protocols below the hole based on a subset of the constraints and then fail shortly after when it is found that these don't meet the remaining constraints (suiteb, FIPS, security level, ...). Ideally, with the new min/max controls users will be less likely to create "holes" in the first place. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Add support for minimum and maximum protocol versionKurt Roeckx2016-01-021-3/+13
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Remove unused cert_verify_mac codeDr. Stephen Henson2015-11-251-2/+0
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Standardise our style for checking malloc failuresMatt Caswell2015-11-091-1/+1
| | | | | | | | if we have a malloc |x = OPENSSL_malloc(...)| sometimes we check |x| for NULL and sometimes we treat it as a boolean |if(!x) ...|. Standardise the approach in libssl. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove a trivially true OPENSSL_assertMatt Caswell2015-11-021-6/+0
| | | | | | | | | This OPENSSL_assert in (d)tls1_hearbeat is trivially always going to be true because it is testing the sum of values that have been set as constants just a few lines above and nothing has changed them. Therefore remove this. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make dtls1_link_min_mtu staticMatt Caswell2015-10-301-1/+2
| | | | | | | | The function dtls1_link_min_mtu() was only used within d1_lib.c so make it static. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move in_handshake into STATEMMatt Caswell2015-10-301-1/+1
| | | | | | | | The SSL variable |in_handshake| seems misplaced. It would be better to have it in the STATEM structure. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix DTLSv1_listen following state machine changesMatt Caswell2015-10-301-2/+5
| | | | | | | | | | Adding the new state machine broke the DTLSv1_listen code because calling SSL_in_before() was erroneously returning true after DTLSv1_listen had successfully completed. This change ensures that SSL_in_before returns false. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Change statem prefix to ossl_statemMatt Caswell2015-10-301-1/+1
| | | | | | | | Change various state machine functions to use the prefix ossl_statem instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Reorganise state machine filesMatt Caswell2015-10-301-2/+239
| | | | | | | | | | Pull out the state machine into a separate sub directory. Also moved some functions which were nothing to do with the state machine but were in state machine files. Pulled all the SSL_METHOD definitions into one place...most of those files had very little left in them any more. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Convert DTLSv1_listen to use new state machine codeMatt Caswell2015-10-301-5/+2
| | | | | | | | The DTLSv1_listen code set the state value explicitly to move into init. Change to use state_set_in_init() instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* DTLS: remove unused cookie fieldEmilia Kasper2015-10-091-3/+3
| | | | | | | | Note that this commit constifies a user callback parameter and therefore will break compilation for applications using this callback. But unless they are abusing write access to the buffer, the fix is trivial. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Sanity check cookie_lenMatt Caswell2015-09-231-1/+2
| | | | | | | Add a sanity check that the cookie_len returned by app_gen_cookie_cb is valid. Reviewed-by: Andy Polyakov <appro@openssl.org>
* DTLSv1_listen rewriteMatt Caswell2015-09-231-7/+378
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The existing implementation of DTLSv1_listen() is fundamentally flawed. This function is used in DTLS solutions to listen for new incoming connections from DTLS clients. A client will send an initial ClientHello. The server will respond with a HelloVerifyRequest containing a unique cookie. The client the responds with a second ClientHello - which this time contains the cookie. Once the cookie has been verified then DTLSv1_listen() returns to user code, which is typically expected to continue the handshake with a call to (for example) SSL_accept(). Whilst listening for incoming ClientHellos, the underlying BIO is usually in an unconnected state. Therefore ClientHellos can come in from *any* peer. The arrival of the first ClientHello without the cookie, and the second one with it, could be interspersed with other intervening messages from different clients. The whole purpose of this mechanism is as a defence against DoS attacks. The idea is to avoid allocating state on the server until the client has verified that it is capable of receiving messages at the address it claims to come from. However the existing DTLSv1_listen() implementation completely fails to do this. It attempts to super-impose itself on the standard state machine and reuses all of this code. However the standard state machine expects to operate in a stateful manner with a single client, and this can cause various problems. A second more minor issue is that the return codes from this function are quite confused, with no distinction made between fatal and non-fatal errors. Most user code treats all errors as non-fatal, and simply retries the call to DTLSv1_listen(). This commit completely rewrites the implementation of DTLSv1_listen() and provides a stand alone implementation that does not rely on the existing state machine. It also provides more consistent return codes. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Add and use OPENSSL_zallocRich Salz2015-09-021-2/+1
| | | | | | | | | There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT3999: Remove sub-component version stringsRich Salz2015-08-101-1/+0
| | | | | | Especially since after the #ifdef cleanups this is not useful. Reviewed-by: Matt Caswell <matt@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-051-6/+6
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use safer sizeof variant in mallocRich Salz2015-05-041-2/+2
| | | | | | | | | | | | | For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup -- codaRich Salz2015-05-011-4/+2
| | | | | | | | After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove redundant includes from dtls1.hMatt Caswell2015-04-301-0/+6
| | | | | | | | | There were a set of includes in dtls1.h which are now redundant due to the libssl opaque work. This commit removes those includes, which also has the effect of resolving one issue preventing building on windows (i.e. the include of winsock.h) Reviewed-by: Andy Polyakov <appro@openssl.org>
* Code style: space after 'if'Viktor Dukhovni2015-04-161-3/+3
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Move buffered_app_data from s->d1 to s->rlayer.dMatt Caswell2015-03-261-19/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix seg fault in dtls1_newMatt Caswell2015-03-261-6/+4
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Moved processed_rcds and unprocessed_rcds from s->d1 to s->rlayer.dMatt Caswell2015-03-261-34/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move r_epoch and w_epoch from s->d1 to s->rlayer.dMatt Caswell2015-03-261-2/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Introduce a DTLS_RECORD_LAYER type for DTLS record layer stateMatt Caswell2015-03-261-0/+10
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix SSL_clear unused returnMatt Caswell2015-03-231-1/+2
| | | | | | Fix missing return value check in dtls1_listen when calling SSL_clear(). Reviewed-by: Richard Levitte <levitte@openssl.org>
* ssl3_set_handshake_header returnsMatt Caswell2015-03-231-7/+7
| | | | | | | Change ssl_set_handshake_header from return void to returning int, and handle error return code appropriately. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix missing return value checksMatt Caswell2015-03-231-1/+5
| | | | | | | | Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix Seg fault in DTLSv1_listenMatt Caswell2015-03-191-0/+3
| | | | | | | | | | | | | | | | The DTLSv1_listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1_listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1_listen means that state is preserved in the SSL object from one invokation to the next that can lead to a segmentation fault. Erorrs processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only server. CVE-2015-0207 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Wrong SSL version in DTLS1_BAD_VER ClientHelloDavid Woodhouse2015-03-091-1/+1
| | | | | | | | | | | | Since commit 741c9959 ("DTLS revision."), we put the wrong protocol version into our ClientHello for DTLS1_BAD_VER. The old DTLS code which used ssl->version was replaced by the more generic SSL3 code which uses ssl->client_version. The Cisco ASA no longer likes our ClientHello. RT#3711 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix post-reformat errors preventing windows compilationMatt Caswell2015-01-221-1/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-426/+414
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* dtls1_new: free s on error pathKurt Roeckx2014-12-041-4/+9
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove incorrect code inadvertently introduced through commit 59669b6ab.Matt Caswell2014-12-041-4/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Only use the fallback mtu after 2 unsuccessful retransmissions if it is lessMatt Caswell2014-12-031-1/+5
| | | | | | than the mtu we are already using Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove instances in libssl of the constant 28 (for size of IPv4 header + UDP)Matt Caswell2014-12-031-0/+25
| | | | | | | | | | and instead use the value provided by the underlying BIO. Also provide some new DTLS_CTRLs so that the library user can set the mtu without needing to know this constant. These new DTLS_CTRLs provide the capability to set the link level mtu to be used (i.e. including this IP/UDP overhead). The previous DTLS_CTRLs required the library user to subtract this overhead first. Reviewed-by: Tim Hudson <tjh@openssl.org>
* The SSL_OP_NO_QUERY_MTU option is supposed to stop the mtu from beingMatt Caswell2014-12-031-1/+2
| | | | | | | automatically updated, and we should use the one provided instead. Unfortunately there are a couple of locations where this is not respected. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fixed memory leak due to incorrect freeing of DTLS reassembly bit maskMatt Caswell2014-11-261-4/+2
| | | | | | PR#3608 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Support TLS_FALLBACK_SCSV.Bodo Moeller2014-10-151-0/+19
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* Constification - mostly originally from Chromium.Ben Laurie2014-06-291-2/+2
|
* Free up s->d1->buffered_app_data.q properly.zhu qun-ying2014-06-021-3/+6
| | | | PR#3286
* bss_dgram.c,d1_lib.c: make it compile with mingw.Andy Polyakov2014-03-061-0/+4
| | | | Submitted by: Roumen Petrov
* Dual DTLS version methods.Dr. Stephen Henson2013-04-091-2/+2
| | | | | | | | Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.
* Set s->d1 to NULL after freeing it.Dr. Stephen Henson2013-04-081-0/+1
|
* Enable TLS 1.2 ciphers in DTLS 1.2.Dr. Stephen Henson2013-03-281-3/+4
| | | | | Port TLS 1.2 GCM code to DTLS. Enable use of TLS 1.2 only ciphers when in DTLS 1.2 mode too.
* Provisional DTLS 1.2 support.Dr. Stephen Henson2013-03-261-1/+20
| | | | | | | | Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing.
* DTLS revision.Dr. Stephen Henson2013-03-181-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-23 03:16:50 +0000