aboutsummaryrefslogtreecommitdiffstats
path: root/ssl/d1_srvr.c
Commit message (Collapse)AuthorAgeFilesLines
* Code style: space after 'if'Viktor Dukhovni2015-04-161-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove last trace of non-record layer code reading and writing sequenceMatt Caswell2015-03-261-2/+1
| | | | | | numbers directly Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move read_sequence and write_sequence from s->s3 to s->rlayerMatt Caswell2015-03-261-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't send a for ServerKeyExchange for kDHr and kDHdKurt Roeckx2015-03-231-1/+1
| | | | | | | The certificate already contains the DH parameters in that case. ssl3_send_server_key_exchange() would fail in that case anyway. Reviewed-by: Matt Caswell <matt@openssl.org>
* Make sure that cert is never NULLKurt Roeckx2015-03-231-4/+0
| | | | | | Also removes for it being NULL Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix missing return value checksMatt Caswell2015-03-231-2/+4
| | | | | | | | Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove NETSCAPE_HANG_BUGMatt Caswell2015-02-261-11/+0
| | | | | | | | | | | | | NETSCAPE_HANG_BUG is a workaround for a browser bug from many years ago (2000). It predates DTLS, so certainly has no place in d1_srvr.c. In s3_srvr.c it forces the ServerDone to appear in the same record as the CertificateRequest when doing client auth. BoringSSL have already made the same commit: 79ae85e4f777f94d91b7be19e8a62016cb55b3c5 Reviewed-by: Tim Hudson <tjh@openssl.org>
* dead code cleanup: #if 0 in sslRich Salz2015-02-061-5/+0
| | | | | | | | I left many "#if 0" lines, usually because I thought we would probably want to revisit them later, or because they provided some useful internal documentation tips. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Add extms support to master key generation.Dr. Stephen Henson2015-02-031-7/+9
| | | | | | | | | | | | Update master secret calculation to support extended master secret. TLS 1.2 client authentication adds a complication because we need to cache the handshake messages. This is simpllified however because the point at which the handshake hashes are calculated for extended master secret is identical to that required for TLS 1.2 client authentication (immediately after client key exchange which is also immediately before certificate verify). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Rerun util/openssl-format-source -v -c .master-post-auto-reformatMatt Caswell2015-01-221-2/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-743/+763
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* fix compilation errorDr. Stephen Henson2015-01-061-1/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Only allow ephemeral RSA keys in export ciphersuites.Dr. Stephen Henson2015-01-061-15/+6
| | | | | | | | | | | OpenSSL clients would tolerate temporary RSA keys in non-export ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which enabled this server side. Remove both options as they are a protocol violation. Thanks to Karthikeyan Bhargavan for reporting this issue. (CVE-2015-0204) Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove MS SGCDr. Stephen Henson2015-01-021-16/+5
| | | | | | | MS Server gated cryptography is obsolete and dates from the time of export restrictions on strong encryption and is only used by ancient versions of MSIE. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fixed memory leak if BUF_MEM_grow failsMatt Caswell2014-12-131-0/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Ensure SSL3_FLAGS_CCS_OK (or d1->change_cipher_spec_ok for DTLS) is resetEmilia Kasper2014-11-201-3/+23
| | | | | | | | | | | | | | once the ChangeCipherSpec message is received. Previously, the server would set the flag once at SSL3_ST_SR_CERT_VRFY and again at SSL3_ST_SR_FINISHED. This would allow a second CCS to arrive and would corrupt the server state. (Because the first CCS would latch the correct keys and subsequent CCS messages would have to be encrypted, a MitM attacker cannot exploit this, though.) Thanks to Joeri de Ruiter for reporting this issue. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix DTLS certificate requesting code.Dr. Stephen Henson2014-07-151-4/+5
| | | | | | | Use same logic when determining when to expect a client certificate for both TLS and DTLS. PR#3452
* use SSL_kDHE throughout instead of SSL_kEDHDaniel Kahn Gillmor2014-01-091-1/+1
| | | | | | | | | | | DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
* use SSL_kECDHE throughout instead of SSL_kEECDHDaniel Kahn Gillmor2014-01-091-1/+1
| | | | | | | | | | | ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
* DTLS/SCTP Finished Auth BugRobin Seggelmann2013-11-011-4/+16
| | | | | | | | | | | | | | | | | | PR: 2808 With DTLS/SCTP the SCTP extension SCTP-AUTH is used to protect DATA and FORWARD-TSN chunks. The key for this extension is derived from the master secret and changed with the next ChangeCipherSpec, whenever a new key has been negotiated. The following Finished then already uses the new key. Unfortunately, the ChangeCipherSpec and Finished are part of the same flight as the ClientKeyExchange, which is necessary for the computation of the new secret. Hence, these messages are sent immediately following each other, leaving the server very little time to compute the new secret and pass it to SCTP before the finished arrives. So the Finished is likely to be discarded by SCTP and a retransmission becomes necessary. To prevent this issue, the Finished of the client is still sent with the old key. (cherry picked from commit 9fb523adce6fd6015b68da2ca8e4ac4900ac2be2)
* DTLS message_sequence number wrong in rehandshake ServerHelloMichael Tuexen2013-08-131-1/+2
| | | | | | | | | | This fix ensures that * A HelloRequest is retransmitted if not responded by a ClientHello * The HelloRequest "consumes" the sequence number 0. The subsequent ServerHello uses the sequence number 1. * The client also expects the sequence number of the ServerHello to be 1 if a HelloRequest was received earlier. This patch fixes the RFC violation.
* Suite B support for DTLS 1.2Dr. Stephen Henson2013-04-091-1/+1
| | | | | | | Check for Suite B support using method flags instead of version numbers: anything supporting TLS 1.2 cipher suites will also support Suite B. Return an error if an attempt to use DTLS 1.0 is made in Suite B mode.
* Dual DTLS version methods.Dr. Stephen Henson2013-04-091-2/+10
| | | | | | | | Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.
* DTLS 1.2 cached record support.Dr. Stephen Henson2013-03-281-0/+18
| | | | | | Add DTLS1.2 support for cached records when computing handshake macs instead of the MD5+SHA1 case for DTLS < 1.2 (this is a port of the equivalent TLS 1.2 code to DTLS).
* Provisional DTLS 1.2 support.Dr. Stephen Henson2013-03-261-0/+9
| | | | | | | | Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing.
* Extend DTLS method macros.Dr. Stephen Henson2013-03-261-2/+4
| | | | | Extend DTLS method creation macros to support version numbers and encryption methods. Update existing code.
* DTLS revision.Dr. Stephen Henson2013-03-181-834/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
* PR: 2778(part)Dr. Stephen Henson2012-03-311-1/+1
| | | | | | Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com> Time is always encoded as 4 bytes, not sizeof(Time).
* PR: 2748Dr. Stephen Henson2012-03-061-4/+3
| | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Fix possible DTLS timer deadlock.
* Revise ssl code to use a CERT_PKEY structure when outputting aDr. Stephen Henson2012-01-261-4/+4
| | | | | | | | certificate chain instead of an X509 structure. This makes it easier to enhance code in future and the chain output functions have access to the CERT_PKEY structure being used.
* PR: 2658Dr. Stephen Henson2011-12-311-0/+13
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
* PR: 2535Dr. Stephen Henson2011-12-251-7/+145
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Add SCTP support for DTLS (RFC 6083).
* PR: 2628Dr. Stephen Henson2011-10-271-1/+1
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fix for ECC keys and DTLS.
* Fix session handling.Bodo Möller2011-09-051-3/+0
|
* (EC)DH memory handling fixes.Bodo Möller2011-09-051-2/+1
| | | | Submitted by: Adam Langley
* PR: 2555Dr. Stephen Henson2011-07-201-0/+8
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fix DTLS sequence number bug
* PR: 2550Dr. Stephen Henson2011-07-201-1/+0
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fix DTLS HelloVerifyRequest Timer bug
* Oops use up to date patch for PR#2506Dr. Stephen Henson2011-05-251-1/+4
|
* Continuing TLS v1.2 support: add support for server parsing ofDr. Stephen Henson2011-05-061-1/+1
| | | | | | | | signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
* PR: 2458Dr. Stephen Henson2011-04-031-3/+6
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Don't change state when answering DTLS ClientHello.
* PR: 1833Dr. Stephen Henson2010-08-261-3/+4
| | | | | | Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de> Support for abbreviated handshakes when renegotiating.
* PR: 2160Dr. Stephen Henson2010-02-011-2/+3
| | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Make session tickets work with DTLS.
* PR: 2159Dr. Stephen Henson2010-02-011-1/+1
| | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Typo in PR#1949 bug, oops!
* PR: 1949Dr. Stephen Henson2010-01-261-10/+6
| | | | | | | Submitted by: steve@openssl.org More robust fix and workaround for PR#1949. Don't try to work out if there is any write pending data as this can be unreliable: always flush.
* PR: 2144Dr. Stephen Henson2010-01-191-2/+1
| | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Better fix for PR#2144
* PR: 2144Dr. Stephen Henson2010-01-161-0/+1
| | | | | | | Submitted by: steve@openssl.org Fix DTLS connection so new_session is reset if we read second client hello: new_session is used to detect renegotiation.
* Add patch to crypto/evp which didn't apply from PR#2124Dr. Stephen Henson2009-12-091-1/+1
|
* PR: 2121Dr. Stephen Henson2009-12-081-2/+160
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Add extension support to DTLS code mainly using existing implementation for TLS.
* PR: 2115Dr. Stephen Henson2009-12-011-0/+10
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org Add Renegotiation extension to DTLS, fix DTLS ClientHello processing bug.
* PR: 2033Dr. Stephen Henson2009-09-091-0/+9
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org DTLS listen support.
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-13 12:40:54 +0000