aboutsummaryrefslogtreecommitdiffstats
path: root/ssl
Commit message (Collapse)AuthorAgeFilesLines
* ssl/statem/extensions_clnt.c: fix return code buglet.Andy Polyakov2017-09-011-1/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4297)
* ssl/statem/*.c: address "enum mixed with another type" warnings.Andy Polyakov2017-09-014-9/+12
| | | | | | | | This is actually not all warnings, only return values. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4297)
* struct timeval include guardsPauli2017-09-012-11/+2
| | | | | | | | | | Move struct timeval includes into e_os.h (where the Windows ones were). Enaure that the include is guarded canonically. Refer #4271 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4312)
* Avoid possible uninitialized variable.Rich Salz2017-08-311-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4307)
* Various review fixes for PSK early_data supportMatt Caswell2017-08-312-6/+10
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Client side sanity check of ALPN after server has accepted early_dataMatt Caswell2017-08-313-19/+61
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Add some fixes for Travis failuresMatt Caswell2017-08-311-1/+1
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Add server side sanity checks of SNI/ALPN for use with early_dataMatt Caswell2017-08-314-14/+53
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Make sure we save ALPN data in the sessionMatt Caswell2017-08-311-0/+11
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Complain if we are writing early data but SNI or ALPN is incorrectMatt Caswell2017-08-312-4/+52
| | | | | | | | SNI and ALPN must be set to be consistent with the PSK. Otherwise this is an error. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Add functions for getting/setting SNI/ALPN info in SSL_SESSIONMatt Caswell2017-08-311-0/+39
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Make sure we use the correct cipher when using the early_secretMatt Caswell2017-08-311-2/+18
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Add SSL_SESSION_set_max_early_data()Matt Caswell2017-08-311-0/+7
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Enable the ability to use an external PSK for sending early_dataMatt Caswell2017-08-318-37/+95
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
* Add ARIA as an alias for all ARIA based modes.Pauli2017-08-311-0/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4300)
* Introduce SSL_CIPHER_get_protocol_idPaul Yang2017-08-301-0/+5
| | | | | | | | | | | The returned ID matches with what IANA specifies (or goes on the wire anyway, IANA notwithstanding). Doc is added. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4107)
* Implement Aria GCM/CCM Modes and TLS cipher suitesJon Spillett2017-08-304-4/+286
| | | | | | | | | | | | | | AEAD cipher mode implementation is based on that used for AES: https://tools.ietf.org/html/rfc5116 TLS GCM cipher suites as specified in: https://tools.ietf.org/html/rfc6209 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4287)
* Move OPENSSL_CONF from e_os.h to cryptlib.hPauli2017-08-301-1/+1
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
* Move e_os.h to be the very first include.Pauli2017-08-305-8/+3
| | | | | | | | cryptilib.h is the second. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
* Move the REF_PRINT support from e_os.h to internal/refcount.h.Pauli2017-08-303-3/+3
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
* e_os.h removal from other headers and source files.Pauli2017-08-3012-9/+24
| | | | | | | | | | | | | Removed e_os.h from all bar three headers (apps/apps.h crypto/bio/bio_lcl.h and ssl/ssl_locl.h). Added e_os.h into the files that need it now. Directly reference internal/nelem.h when required. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
* Don't auto-instantiate a DRBG when trying to use it and it's notKurt Roeckx2017-08-281-1/+2
| | | | | | | | | | | | | The one creating the DRBG should instantiate it, it's there that we know which parameters we should use to instantiate it. This splits the rand init in two parts to avoid a deadlock because when the global drbg is created it wands to call rand_add on the global rand method. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #4268
* NO_SYS_TYPES_H isn't defined anywhere, stop using it as a guardRichard Levitte2017-08-251-4/+1
| | | | | | | This is a vestige from pre-1.1.0 OpenSSL Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4256)
* Do not lookup zero-length session IDKazuki Yamaguchi2017-08-251-1/+2
| | | | | | | | | | A condition was removed by commit 1053a6e2281d; presumably it was an unintended change. Restore the previous behavior so the get_session_cb won't be called with zero-length session ID. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4236)
* (Re)move some things from e_os.hRich Salz2017-08-225-5/+0
| | | | | | | | | | | Remove GETPID_IS_MEANINGLESS and osslargused. Move socket-related things to new file internal/sockets.h; this is now only needed by four(!!!) files. Compiles should be a bit faster. Remove USE_SOCKETS ifdef's Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4209)
* Fix ctype arguments.Pauli2017-08-221-1/+2
| | | | | | | | Cast arguments to the various ctype functions to unsigned char to match their documentation. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4203)
* Reorder extensions to put SigAlgs lastTodd Short2017-08-183-10/+15
| | | | | | | | | | | | | Force non-empty padding extension. When enabled, force the padding extension to be at least 1 byte long. WebSphere application server cannot handle having an empty extension (e.g. EMS/EtM) as the last extension in a client hello. This moves the SigAlgs extension last for TLSv1.2 to avoid this issue. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3921)
* Add SSL_get_pending_cipher()Benjamin Kaduk2017-08-151-0/+5
| | | | | | | | | | | | | | | | | | | The existing function SSL_get_current_cipher() queries the current session for the ciphersuite in use, but there is no way for application code to determine what ciphersuite has been negotiated and will be used in the future, prior to ChangeCipherState (or the TLS 1.3 equivalent) causing the new cipher to take effect and become visible in the session information. Expose this information to appropriate application callbacks to use during the handshake. The name SSL_get_pending_cipher() was chosen for compatibility with BoringSSL's routine of that name. Improve the note on macro implementations in SSL_get_current_cipher.pod while here. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4070)
* Move ALPN handling from finalizer to delayed callBenjamin Kaduk2017-08-152-40/+49
| | | | | | | | | | | | | | | | | | | | | | | | Commit 02f0274e8c0596dcf7e2d104250232a42c650b96 moved ALPN processing into an extension finalization function, as the only documented ordering requirement from previous commits was that ALPN processing occur after SNI processing, and SNI processing is performed before the extension finalization step. However, it is useful for applications' alpn_select callbacks to run after ciphersuite selection as well -- at least one application protocol specification (HTTP/2) imposes restrictions on which ciphersuites are usable with that protocol. Since it is generally more preferrable to have a successful TLS connection with a default application protocol than to fail the TLS connection and not be able to have the preferred application protocol, it is good to give the alpn_select callback information about the ciphersuite to be used, so that appropriate restrctions can be enforced in application code. Accordingly, split the ALPN handling out into a separate tls_handl_alpn() function akin to tls_handle_status_request(), called from tls_post_process_client_hello(). This is an alternative to resuscitating ssl_check_clienthello_tlsext_late(), something of an awkwward name itself. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4070)
* Fix some Typos and indentsFdaSilvaYY2017-08-113-6/+5
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4108)
* Don't modify resumed session objectsBenjamin Kaduk2017-08-091-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If s->hit is set, s->session corresponds to a session created on a previous connection, and is a data structure that is potentially shared across other SSL objects. As such, there are thread-safety issues with modifying the structure without taking its lock (and of course all corresponding read accesses would also need to take the lock as well), which have been observed to cause double-frees. Regardless of thread-safety, the resumed session object is intended to reflect parameters of the connection that created the session, and modifying it to reflect the parameters from the current connection is confusing. So, modifications to the session object during ClientHello processing should only be performed on new connections, i.e., those where s->hit is not set. The code mostly got this right, providing such checks when processing SNI and EC point formats, but the supported groups (formerly supported curves) extension was missing it, which is fixed by this commit. However, TLS 1.3 makes the suppported_groups extension mandatory (when using (EC)DHE, which is the normal case), checking for the group list in the key_share extension processing. But, TLS 1.3 only [0] supports session tickets for session resumption, so the session object in question is the output of d2i_SSL_SESSION(), and will not be shared across SSL objects. Thus, it is safe to modify s->session for TLS 1.3 connections. [0] A psk_find_session callback can also be used, but the restriction that each callback execution must produce a distinct SSL_SESSION structure can be documented when the psk_find_session callback documentation is completed. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4123)
* Add an SSL_SESSION_dup() functionMatt Caswell2017-08-091-0/+5
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4072)
* Add missing include of cryptlib.hRich Salz2017-08-061-0/+1
| | | | | | | Also use "" not <> for all include cryptlib Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4082)
* Add a DRBG to each SSL objectRich Salz2017-08-038-17/+38
| | | | | | | | | | | Give each SSL object it's own DRBG, chained to the parent global DRBG which is used only as a source of randomness into the per-SSL DRBG. This is used for all session, ticket, and pre-master secret keys. It is NOT used for ECDH key generation which use only the global DRBG. (Doing that without changing the API is tricky, if not impossible.) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4050)
* Switch from ossl_rand to DRBG randRich Salz2017-08-031-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If RAND_add wraps around, XOR with existing. Add test to drbgtest that does the wrap-around. Re-order seeding and stop after first success. Add RAND_poll_ex() Use the DF and therefore lower RANDOMNESS_NEEDED. Also, for child DRBG's, mix in the address as the personalization bits. Centralize the entropy callbacks, from drbg_lib to rand_lib. (Conceptually, entropy is part of the enclosing application.) Thanks to Dr. Matthias St Pierre for the suggestion. Various code cleanups: -Make state an enum; inline RANDerr calls. -Add RAND_POLL_RETRIES (thanks Pauli for the idea) -Remove most RAND_seed calls from rest of library -Rename DRBG_CTX to RAND_DRBG, etc. -Move some code from drbg_lib to drbg_rand; drbg_lib is now only the implementation of NIST DRBG. -Remove blocklength Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4019)
* Move ossl_assertMatt Caswell2017-08-0312-1/+12
| | | | | | | | | | Move the definition of ossl_assert() out of e_os.h which is intended for OS specific things. Instead it is moved into internal/cryptlib.h. This also changes the definition to remove the (int) cast. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4073)
* remove horrible pragma macro and remove __owur from SSL_CTX_add_session() ↵Lingmo Zhu2017-08-031-3/+0
| | | | | | | | declaration Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4014)
* Remove the obsolete misleading comment and code related to it.Lingmo Zhu2017-08-031-4/+7
| | | | | | | | | | | | | | | | | | | The comment "The following should not return 1, otherwise, things are very strange" is from the very first commit of OpenSSL. The really meaning of the comment is if the identical session can be found from internal cache after calling get_session_cb but not found before calling get_session_cb, it is just strange. The value 1 was originated from the old doc of SSLeay, reversed from the actual return value of SSL_CTX_add_session(). Anyway either return value of SSL_CTX_add_session() should not interrupt the session resumption process. So the checking of return value of SSL_CTX_add_session() is not necessary. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4014)
* Fix new_session_cb calls in TLSv1.3Matt Caswell2017-08-013-10/+16
| | | | | | | | | | | If a new_session_cb is set then it was only ever getting invoked if !s->hit is true. This is sensible for <=TLSv1.2 but does not work for TLSv1.3. Fixes #4045 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4068)
* Fix SSL_set_tlsext_debug_callback/-tlsextdebugTodd Short2017-07-311-6/+5
| | | | | | | | | | | | | | Some extensions were being displayed twice, before they were parsed, and again after they were parsed. The supported_versions extension was not being fully displayed, as it was processed differently than other extensions. Move the debug callback to where the extensions are first collected, to catch all the extensions as they come in, so they are ordered correctly. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3911)
* Fix the names of older ciphers.David Benjamin2017-07-311-28/+28
| | | | | | | | | | | | | | The names of these ciphers have an "SSL_" prefix, but the RFC names use "TLS_": https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4 This dates back to these ciphers being originally defined in SSLv3. As SSLv3 is on its way out anyway and this is a new set of APIs, consistently use the TLS names. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4007)
* Fix errors in SSL_state_string_longXiaoyin Liu2017-07-311-3/+3
| | | | | | | | | TLS_ST_SR_NEXT_PROTO means "SSLv3/TLS read next proto" Fix typo in the message for TLS_ST_SW_CERT_STATUS Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4054)
* Fix typos in files in ssl directoryXiaoyin Liu2017-07-304-6/+6
| | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4052)
* Update copyright headerXiaoyin Liu2017-07-301-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4049)
* Remove redundant declarations in ssl_locl.hXiaoyin Liu2017-07-302-9/+1
| | | | | | | | | | | | Remove the function prototypes for ssl_cert_get0_next_certificate, ssl_set_default_md, tls1_shared_list, dtls1_send_newsession_ticket, tls1_ctrl, and tls1_callback_ctrl, all of which are not defined. It also changed the signature of the function pqueue_next to `pitem *pqueue_next(piterator *item)` in pqueue.c, making it match the prototype in ssl_locl.h. (`piterator *` is equivalent to `pitem **`.) Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4049)
* Remove redundant declarations in record_locl.hXiaoyin Liu2017-07-301-1/+0
| | | | | | | | This patch removes the prototype of function RECORD_LAYER_set_write_sequence from record_locl.h, since this function is not defined. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4051)
* Make SSL_set_tlsext_host_name no effect from server sidePaul Yang2017-07-281-0/+6
| | | | | | | | | Documentation and test cases are also updated Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3783)
* Add support to free/allocate SSL buffersTodd Short2017-07-261-0/+16
| | | | | | | | | | | | | | | | OpenSSL already has the feature of SSL_MODE_RELEASE_BUFFERS that can be set to release the read or write buffers when data has finished reading or writing. OpenSSL will automatically re-allocate the buffers as needed. This can be quite aggressive in terms of memory allocation. This provides a manual mechanism. SSL_free_buffers() will free the data buffers if there's no pending data. SSL_alloc_buffers() will realloc them; but this function is not strictly necessary, as it's still done automatically in the state machine. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2240)
* Support converting cipher name to RFC name and vice versaPaul Yang2017-07-215-127/+357
| | | | | | | | | | | | | | | Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
* Remove session checks from SSL_clear()Matt Caswell2017-07-181-5/+2
| | | | | | | | | We now allow a different protocol version when reusing a session so we can unconditionally reset the SSL_METHOD if it has changed. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3954)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 14:32:40 +0000