aboutsummaryrefslogtreecommitdiffstats
path: root/ssl/s3_clnt.c
Commit message (Collapse)AuthorAgeFilesLines
* Reorganise state machine filesMatt Caswell2015-10-301-2819/+0
| | | | | | | | | | Pull out the state machine into a separate sub directory. Also moved some functions which were nothing to do with the state machine but were in state machine files. Pulled all the SSL_METHOD definitions into one place...most of those files had very little left in them any more. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move PACKET creation into the state machineMatt Caswell2015-10-301-97/+59
| | | | | | | | | Previously each message specific process function would create its own PACKET structure. Rather than duplicate all of this code lots of times we should create it in the state machine itself. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Delete unused functionsMatt Caswell2015-10-301-329/+0
| | | | | | | | Remove all the functions and dead code that is now no longer required as a result of the DTLS client move into the new state machine code. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Implement DTLS client move to new state machineMatt Caswell2015-10-301-1/+33
| | | | | | | | Move all DTLS client side processing into the new state machine code. A subsequent commit will clean up the old dead code. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Client TLS state machine rewrite cleanupMatt Caswell2015-10-301-520/+0
| | | | | | | | Remove redundant code following moving client side TLS handling to the new state machine implementation. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Implement Client TLS state machineMatt Caswell2015-10-301-0/+44
| | | | | | | | This swaps the implementation of the client TLS state machine to use the new state machine code instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Split client message reading and writing functionsMatt Caswell2015-10-301-951/+1124
| | | | | | | | | | | | | The new state machine code will split up the reading and writing of hanshake messages into discrete phases. In order to facilitate that the existing "get" type functions will be split into two halves: one to get the message and one to process it. The "send" type functions will also have all work relating to constructing the message split out into a separate function just for that. For some functions there will also be separate pre and post "work" phases to prepare or update state. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove useless codeAlessandro Ghedini2015-10-231-1/+0
| | | | | | | RT#4081 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix memory leaks and other mistakes on errorsAlessandro Ghedini2015-10-231-0/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* PACKET: simplify ServerKeyExchange parsingEmilia Kasper2015-10-081-196/+93
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* PACKET: simplify ServerHello parsingEmilia Kasper2015-09-281-38/+35
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* RT2772: accept empty SessionTicketEmilia Kasper2015-09-281-7/+16
| | | | | | | | | | | | | | RFC 5077 section 3.3 says: If the server determines that it does not want to include a ticket after it has included the SessionTicket extension in the ServerHello, then it sends a zero-length ticket in the NewSessionTicket handshake message. Previously the client would fail upon attempting to allocate a zero-length buffer. Now, we have the client ignore the empty ticket and keep the existing session. Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove ssl_put_cipher_by_charEmilia Kasper2015-09-221-16/+9
| | | | | | | | | Since SSLv3, a CipherSuite is always 2 bytes. The only place where we need 3-byte ciphers is SSLv2-compatible ClientHello processing. So, remove the ssl_put_cipher_by_char indirection. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove PACKET_(get|goto)_bookmarkEmilia Kasper2015-09-171-21/+17
| | | | | | | | The bookmark API results in a lot of boilerplate error checking that can be much more easily achieved with a simple struct copy. It also lays the path for removing the third PACKET field. Reviewed-by: Rich Salz <rsalz@openssl.org>
* PACKETise ServerKeyExchangeMatt Caswell2015-09-071-124/+88
| | | | | | Process the ServerKeyExchange message using the PACKET API Reviewed-by: Tim Hudson <tjh@openssl.org>
* PACKETise ServerHello processingMatt Caswell2015-09-071-28/+88
| | | | | | Process ServerHello messages using the PACKET API Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add X509_up_ref function.Dr. Stephen Henson2015-08-311-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* PACKETise CertificateRequestMatt Caswell2015-08-141-32/+34
| | | | | | Process CertificateRequest messages using the PACKET API Reviewed-by: Emilia Käsper <emilia@openssl.org>
* PACKETise NewSessionTicketMatt Caswell2015-08-141-15/+15
| | | | | | Process NewSessionTicket messages using the new PACKET API Reviewed-by: Emilia Käsper <emilia@openssl.org>
* PACKETise Certificate Status messageMatt Caswell2015-08-131-10/+16
| | | | | | Process the Certificate Status message using the PACKET API Reviewed-by: Emilia Käsper <emilia@openssl.org>
* PACKETise Server Certificate processingMatt Caswell2015-08-131-14/+17
| | | | | | Use the PACKET API to process an incoming server Certificate message. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Remove Gost94 signature algorithm.Rich Salz2015-08-111-2/+1
| | | | | | | This was obsolete in 2001. This is not the same as Gost94 digest. Thanks to Dmitry Belyavsky <beldmit@gmail.com> for review and advice. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix seg fault with 0 p val in SKEGuy Leaver (guleaver)2015-08-111-0/+16
| | | | | | | | | | | | | | | If a client receives a ServerKeyExchange for an anon DH ciphersuite with the value of p set to 0 then a seg fault can occur. This commits adds a test to reject p, g and pub key parameters that have a 0 value (in accordance with RFC 5246) The security vulnerability only affects master and 1.0.2, but the fix is additionally applied to 1.0.1 for additional confidence. CVE-2015-1794 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Move TLS CCS processing into the state machineMatt Caswell2015-08-031-24/+22
| | | | | | | | | | | | | | | | | | | | | The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: Tim Hudson <tjh@openssl.org>
* cleanse psk_identity on errorDr. Stephen Henson2015-07-301-2/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Extended PSK client support.Dr. Stephen Henson2015-07-301-106/+112
| | | | | | | | | | | | | | | | Add support for RSAPSK, DHEPSK and ECDHEPSK client side. Update various checks to ensure certificate and server key exchange messages are only expected when required. Update message handling. PSK server key exchange parsing now expects an identity hint prefix for all PSK server key exchange messages. PSK client key exchange message requests PSK identity and key for all PSK key exchange ciphersuites and includes identity in message. Update flags for RSA, DH and ECDH so they are also used in PSK. Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove support for SSL3_FLAGS_DELAY_CLIENT_FINISHEDMatt Caswell2015-07-271-14/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This flag was not set anywhere within the codebase (only read). It could only be set by an app reaching directly into s->s3->flags and setting it directly. However that method became impossible when libssl was opaquified. Even in 1.0.2/1.0.1 if an app set the flag directly it is only relevant to ssl3_connect(), which calls SSL_clear() during initialisation that clears any flag settings. Therefore it could take effect if the app set the flag after the handshake has started but before it completed. It seems quite unlikely that any apps really do this (especially as it is completely undocumented). The purpose of the flag is suppress flushing of the write bio on the client side at the end of the handshake after the client has written the Finished message whilst resuming a session. This enables the client to send application data as part of the same flight as the Finished message. This flag also controls the setting of a second flag SSL3_FLAGS_POP_BUFFER. There is an interesting comment in the code about this second flag in the implementation of ssl3_write: /* This is an experimental flag that sends the * last handshake message in the same packet as the first * use data - used to see if it helps the TCP protocol during * session-id reuse */ It seems the experiment did not work because as far as I can tell nothing is using this code. The above comment has been in the code since SSLeay. This commit removes support for SSL3_FLAGS_DELAY_CLIENT_FINISHED, as well as the associated SSL3_FLAGS_POP_BUFFER. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use single master secret generation function.Dr. Stephen Henson2015-06-291-13/+3
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix PSK client handling.Dr. Stephen Henson2015-06-231-25/+5
| | | | | | | | The PSK identity hint should be stored in the SSL_SESSION structure and not in the parent context (which will overwrite values used by other SSL structures with the same SSL_CTX). Reviewed-by: Matt Caswell <matt@openssl.org>
* Tidy up ssl3_digest_cached_records logic.Dr. Stephen Henson2015-06-231-15/+6
| | | | | | | | | | | | | | | Rewrite ssl3_digest_cached_records handling. Only digest cached records if digest array is NULL: this means it is safe to call ssl3_digest_cached_records multiple times (subsequent calls are no op). Remove flag TLS1_FLAGS_KEEP_HANDSHAKE instead only update handshake buffer if digest array is NULL. Add additional "keep" parameter to ssl3_digest_cached_records to indicate if the handshake buffer should be retained after digesting cached records (needed for TLS 1.2 client authentication). Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove SESS_CERT entirely.Dr. Stephen Henson2015-06-221-38/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move peer chain to SSL_SESSION structure.Dr. Stephen Henson2015-06-221-1/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove unnuecessary ifdefs.Dr. Stephen Henson2015-06-221-18/+2
| | | | | | | | If RSA or DSA is disabled we will never use a ciphersuite with RSA/DSA authentication as it is already filtered out by the cipher list logic. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove certificates from sess_certDr. Stephen Henson2015-06-221-57/+18
| | | | | | | | As numerous comments indicate the certificate and key array is not an appopriate structure to store the peers certificate: so remove it and just the s->session->peer instead. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove peer temp keys from SESS_CERTDr. Stephen Henson2015-06-221-21/+21
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Only allow a temporary rsa key exchange when they key is larger than 512.Kurt Roeckx2015-06-091-1/+8
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> MR #588
* Properly check certificate in case of export ciphers.Kurt Roeckx2015-06-091-14/+43
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> MR #588
* Remove misleading commentMatt Caswell2015-06-041-2/+0
| | | | | | | | | Remove a comment that suggested further clean up was required. DH_free() performs the necessary cleanup. With thanks to the Open Crypto Audit Project for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix DTLS session resumptionMatt Caswell2015-06-041-1/+1
| | | | | | | | | | | | The session object on the client side is initially created during construction of the ClientHello. If the client is DTLS1.2 capable then it will store 1.2 as the version for the session. However if the server is only DTLS1.0 capable then when the ServerHello comes back the client switches to using DTLS1.0 from then on. However the session version does not get updated. Therefore when the client attempts to resume that session the server throws an alert because of an incorrect protocol version. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix race condition in NewSessionTicketMatt Caswell2015-06-021-0/+32
| | | | | | | | | | | | | | | | | If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data. CVE-2015-1791 This also fixes RT#3808 where a session ID is changed for a session already in the client session cache. Since the session ID is the key to the cache this breaks the cache access. Parts of this patch were inspired by this Akamai change: https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Set first_packet for TLS clientsMatt Caswell2015-05-241-3/+2
| | | | | | | | | Version negotiation was broken (one of the late changes in the review process broke it). The problem is that TLS clients do not set first_packet, whereas TLS/DTLS servers and DTLS clients do. The simple fix is to set first_packet for TLS clients too. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove support for OPENSSL_NO_TLSEXTMatt Caswell2015-05-221-34/+6
| | | | | | | | | | Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Correctly check for export size limitKurt Roeckx2015-05-201-1/+4
| | | | | | 40 bit ciphers are limited to 512 bit RSA, 56 bit ciphers to 1024 bit. Reviewed-by: Rich Salz <rsalz@openssl.org>
* move masks out of CERT structureDr. Stephen Henson2015-05-191-3/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move certificate validity flags out of CERT.Dr. Stephen Henson2015-05-181-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move signing digest out of CERT.Dr. Stephen Henson2015-05-181-3/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* CERT tidyDr. Stephen Henson2015-05-181-6/+6
| | | | | | | | | | Move per-connection state out of the CERT structure: which should just be for shared configuration data (e.g. certificates to use). In particular move temporary premaster secret, raw ciphers, peer signature algorithms and shared signature algorithms. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move SSLv3_*method() functionsMatt Caswell2015-05-161-12/+0
| | | | | | | | | Move these functions into t1_clnt.c, t1_srvr.c and t1_meth.c and take advantage of the existing tls1_get*_method() functions that all the other methods are using. Since these now have to support SSLv3 anyway we might as well use the same set of get functions for both TLS and SSLv3. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Updates following review commentsMatt Caswell2015-05-161-68/+177
| | | | | | | Miscellaneous updates following review comments on the version negotiation rewrite patches. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Client side version negotiation rewriteMatt Caswell2015-05-161-18/+86
| | | | | | | | | | Continuing from the previous commit this changes the way we do client side version negotiation. Similarly all of the s23* "up front" state machine code has been avoided and again things now work much the same way as they already did for DTLS, i.e. we just do most of the work in the ssl3_get_server_hello() function. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-18 22:58:37 +0000