aboutsummaryrefslogtreecommitdiffstats
path: root/ssl/s3_srvr.c
Commit message (Collapse)AuthorAgeFilesLines
* Change error reason to match previous behaviour.Adam Eijdenberg2015-08-041-1/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix unhandled error condition in sslv2 client hello parsing.Adam Eijdenberg2015-08-041-0/+3
| | | | | | | | | --strict-warnings started showing warnings for this today... Surely an error should be raised if these reads fail? Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* PACKETise NextProtoMatt Caswell2015-08-041-19/+24
| | | | | | Change NextProto message processing to use the PACKET API. Reviewed-by: Stephen Henson <steve@openssl.org>
* PACKETise CertificateVerify processingMatt Caswell2015-08-041-17/+30
| | | | | | Modify CertificateVerify processing to use the new PACKET API. Reviewed-by: Stephen Henson <steve@openssl.org>
* PACKETise ClientCertificate processingMatt Caswell2015-08-041-13/+20
| | | | | | Use the PACKET API for processing ClientCertificate messages Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move TLS CCS processing into the state machineMatt Caswell2015-08-031-47/+22
| | | | | | | | | | | | | | | | | | | | | The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: Tim Hudson <tjh@openssl.org>
* PACKETise ClientHello processingMatt Caswell2015-08-031-83/+86
| | | | | | | Uses the new PACKET code to process the incoming ClientHello including all extensions etc. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove erroneous server_random fillingMatt Caswell2015-07-311-7/+4
| | | | | | | | | | | | | Commit e481f9b90b164 removed OPENSSL_NO_TLSEXT from the code. Previously if OPENSSL_NO_TLSEXT *was not* defined then the server random was filled during getting of the ClientHello. If it *was* defined then the server random would be filled in ssl3_send_server_hello(). Unfortunately in commit e481f9b90b164 the OPENSSL_NO_TLSEXT guards were removed but *both* server random fillings were left in. This could cause problems for session ticket callbacks. Reviewed-by: Stephen Henson <steve@openssl.org>
* Don't request certificates for any PSK ciphersuiteDr. Stephen Henson2015-07-301-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Extended PSK server support.Dr. Stephen Henson2015-07-301-120/+134
| | | | | | | | | | | | | | | | Add support for RSAPSK, DHEPSK and ECDHEPSK server side. Update various checks to ensure certificate and server key exchange messages are only sent when required. Update message handling. PSK server key exchange parsing now include an identity hint prefix for all PSK server key exchange messages. PSK client key exchange message expects PSK identity and requests key for all PSK key exchange ciphersuites. Update flags for RSA, DH and ECDH so they are also used in PSK. Reviewed-by: Matt Caswell <matt@openssl.org>
* Use single master secret generation function.Dr. Stephen Henson2015-06-291-45/+11
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Tidy up ssl3_digest_cached_records logic.Dr. Stephen Henson2015-06-231-20/+12
| | | | | | | | | | | | | | | Rewrite ssl3_digest_cached_records handling. Only digest cached records if digest array is NULL: this means it is safe to call ssl3_digest_cached_records multiple times (subsequent calls are no op). Remove flag TLS1_FLAGS_KEEP_HANDSHAKE instead only update handshake buffer if digest array is NULL. Add additional "keep" parameter to ssl3_digest_cached_records to indicate if the handshake buffer should be retained after digesting cached records (needed for TLS 1.2 client authentication). Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove SESS_CERT entirely.Dr. Stephen Henson2015-06-221-11/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move peer chain to SSL_SESSION structure.Dr. Stephen Henson2015-06-221-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Clean premaster_secret for GOSTMatt Caswell2015-06-041-0/+1
| | | | | | | | Ensure OPENSSL_cleanse() is called on the premaster secret value calculated for GOST. With thanks to the Open Crypto Audit Project for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* clear/cleanse cleanupRich Salz2015-05-301-2/+1
| | | | | | | Where we called openssl_cleanse, make sure we do it on all error paths. Be consistent in use of sizeof(foo) when possible. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove support for OPENSSL_NO_TLSEXTMatt Caswell2015-05-221-33/+13
| | | | | | | | | | Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* CERT tidyDr. Stephen Henson2015-05-181-4/+4
| | | | | | | | | | Move per-connection state out of the CERT structure: which should just be for shared configuration data (e.g. certificates to use). In particular move temporary premaster secret, raw ciphers, peer signature algorithms and shared signature algorithms. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Further version negotiation updatesMatt Caswell2015-05-161-25/+21
| | | | | | More miscellaneous updates to version negotiation following feedback. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Move SSLv3_*method() functionsMatt Caswell2015-05-161-14/+0
| | | | | | | | | Move these functions into t1_clnt.c, t1_srvr.c and t1_meth.c and take advantage of the existing tls1_get*_method() functions that all the other methods are using. Since these now have to support SSLv3 anyway we might as well use the same set of get functions for both TLS and SSLv3. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Updates following review commentsMatt Caswell2015-05-161-8/+122
| | | | | | | Miscellaneous updates following review comments on the version negotiation rewrite patches. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Server side version negotiation rewriteMatt Caswell2015-05-161-223/+384
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit changes the way that we do server side protocol version negotiation. Previously we had a whole set of code that had an "up front" state machine dedicated to the negotiating the protocol version. This adds significant complexity to the state machine. Historically the justification for doing this was the support of SSLv2 which works quite differently to SSLv3+. However, we have now removed support for SSLv2 so there is little reason to maintain this complexity. The one slight difficulty is that, although we no longer support SSLv2, we do still support an SSLv3+ ClientHello in an SSLv2 backward compatible ClientHello format. This is generally only used by legacy clients. This commit adds support within the SSLv3 code for these legacy format ClientHellos. Server side version negotiation now works in much the same was as DTLS, i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to that then when a ClientHello is received it will work out the most appropriate version to respond with. Also, SSLv23_method and SSLv23_server_method have been replaced with TLS_method and TLS_server_method respectively. The old SSLv23* names still exist as macros pointing at the new name, although they are deprecated. Subsequent commits will look at client side version negotiation, as well of removal of the old s23* code. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Identify and move OpenSSL internal header filesRichard Levitte2015-05-141-1/+1
| | | | | | | | | | | | | | There are header files in crypto/ that are used by the rest of OpenSSL. Move those to include/internal and adapt the affected source code, Makefiles and scripts. The header files that got moved are: crypto/constant_time_locl.h crypto/o_dir.h crypto/o_str.h Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove Kerberos support from libsslMatt Caswell2015-05-131-209/+9
| | | | | | | Remove RFC2712 Kerberos support from libssl. This code and the associated standard is no longer considered fit-for-purpose. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Don't allow a CCS when expecting a CertificateVerifyMatt Caswell2015-05-131-50/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we set change_cipher_spec_ok to 1 before calling ssl3_get_cert_verify(). This is because this message is optional and if it is not sent then the next thing we would expect to get is the CCS. However, although it is optional, we do actually know whether we should be receiving one in advance. If we have received a client cert then we should expect a CertificateVerify message. By the time we get to this point we will already have bombed out if we didn't get a Certificate when we should have done, so it is safe just to check whether |peer| is NULL or not. If it is we won't get a CertificateVerify, otherwise we will. Therefore we should change the logic so that we only attempt to get the CertificateVerify if we are expecting one, and not allow a CCS in this scenario. Whilst this is good practice for TLS it is even more important for DTLS. In DTLS messages can be lost. Therefore we may be in a situation where a CertificateVerify message does not arrive even though one was sent. In that case the next message the server will receive will be the CCS. This could also happen if messages get re-ordered in-flight. In DTLS if |change_cipher_spec_ok| is not set and a CCS is received it is ignored. However if |change_cipher_spec_ok| *is* set then a CCS arrival will immediately move the server into the next epoch. Any messages arriving for the previous epoch will be ignored. This means that, in this scenario, the handshake can never complete. The client will attempt to retransmit missing messages, but the server will ignore them because they are the wrong epoch. The server meanwhile will still be waiting for the CertificateVerify which is never going to arrive. RT#2958 Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Use p==NULL not !p (in if statements, mainly)Rich Salz2015-05-111-1/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-051-3/+2
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add more error state transitionsMatt Caswell2015-05-051-12/+59
| | | | | | | Ensure all fatal errors transition into the new error state on the server side. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add Error stateMatt Caswell2015-05-051-1/+4
| | | | | | | | Reusing an SSL object when it has encountered a fatal error can have bad consequences. This is a bug in application code not libssl but libssl should be more forgiving and not crash. Reviewed-by: Rich Salz <rsalz@openssl.org>
* ssl/s3_srvr.c: Fix typo introduced via 69f682374868b.mancha security2015-05-031-1/+1
| | | | | | | | Incorrect name used for SSL_AD_INTERNAL_ERROR. Signed-off-by: mancha security <mancha1@zoho.com> Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* free NULL cleanup -- codaRich Salz2015-05-011-16/+7
| | | | | | | | After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove goto inside an if(0) blockRich Salz2015-05-011-10/+8
| | | | | | | There were a dozen-plus instances of this construct: if (0) { label: ..... } Reviewed-by: Tim Hudson <tjh@openssl.org>
* free null cleanup finaleRich Salz2015-05-011-10/+5
| | | | | | Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup 5aRich Salz2015-04-301-8/+4
| | | | | | | | | Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* Error out immediately on empty ciphers list.Emilia Kasper2015-04-171-7/+6
| | | | | | | | | A 0-length ciphers list is never permitted. The old code only used to reject an empty ciphers list for connections with a session ID. It would later error out on a NULL structure, so this change just moves the alert closer to the problem source. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Code style: space after 'if'Viktor Dukhovni2015-04-161-13/+13
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Check for ClientHello message overrunsMatt Caswell2015-04-141-1/+41
| | | | | | | | | | | The ClientHello processing is insufficiently rigorous in its checks to make sure that we don't read past the end of the message. This does not have security implications due to the size of the underlying buffer - but still needs to be fixed. With thanks to Qinghao Tang for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* free NULL cleanupRich Salz2015-03-281-2/+1
| | | | | | | | | EVP_.*free; this gets: EVP_CIPHER_CTX_free EVP_PKEY_CTX_free EVP_PKEY_asn1_free EVP_PKEY_asn1_set_free EVP_PKEY_free EVP_PKEY_free_it EVP_PKEY_meth_free; and also EVP_CIPHER_CTX_cleanup Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* free NULL cleanup.Rich Salz2015-03-251-2/+1
| | | | | | | This gets EC_GROUP_clear_free EC_GROUP_free, EC_KEY_free, EC_POINT_clear_free, EC_POINT_free Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RAND_bytes updatesMatt Caswell2015-03-251-4/+1
| | | | | | | Ensure RAND_bytes return value is checked correctly, and that we no longer use RAND_pseudo_bytes. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add ticket length before buffering DTLS messageMatt Caswell2015-03-251-2/+2
| | | | | | | | | | | | | In ssl3_send_new_session_ticket the message to be sent is constructed. We skip adding the length of the session ticket initially, then call ssl_set_handshake_header, and finally go back and add in the length of the ticket. Unfortunately, in DTLS, ssl_set_handshake_header also has the side effect of buffering the message for subsequent retransmission if required. By adding the ticket length after the call to ssl_set_handshake_header the message that is buffered is incomplete, causing an invalid message to be sent on retransmission. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make sure that cert is never NULLKurt Roeckx2015-03-231-4/+0
| | | | | | Also removes for it being NULL Reviewed-by: Matt Caswell <matt@openssl.org>
* ssl3_set_handshake_header returnsMatt Caswell2015-03-231-6/+23
| | | | | | | Change ssl_set_handshake_header from return void to returning int, and handle error return code appropriately. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix missing return value checksMatt Caswell2015-03-231-2/+34
| | | | | | | | Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix DHE Null CKE vulnerabilityMatt Caswell2015-03-191-2/+9
| | | | | | | | | | If client auth is used then a server can seg fault in the event of a DHE cipher being used and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. CVE-2015-1787 Reviewed-by: Richard Levitte <levitte@openssl.org>
* OPENSSL_NO_EC* merge; missed one fileRich Salz2015-03-151-5/+5
| | | | | | Missed one file in the #ifdef merge; thanks Kurt. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Merge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_ECRich Salz2015-03-111-5/+5
| | | | | | Suggested by John Foley <foleyj@cisco.com>. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix missing return value checks.Matt Caswell2015-02-271-30/+49
| | | | | | | Fixed various missing return value checks in ssl3_send_newsession_ticket. Also a mem leak on error. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove NETSCAPE_HANG_BUGMatt Caswell2015-02-261-22/+0
| | | | | | | | | | | | | NETSCAPE_HANG_BUG is a workaround for a browser bug from many years ago (2000). It predates DTLS, so certainly has no place in d1_srvr.c. In s3_srvr.c it forces the ServerDone to appear in the same record as the CertificateRequest when doing client auth. BoringSSL have already made the same commit: 79ae85e4f777f94d91b7be19e8a62016cb55b3c5 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Removed support for SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG. Also removedMatt Caswell2015-02-261-24/+1
| | | | | | the "-hack" option from s_server that set this option. Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-13 16:51:02 +0000