aboutsummaryrefslogtreecommitdiffstats
path: root/ssl
Commit message (Collapse)AuthorAgeFilesLines
* Update SSL_trace() to know about ticket_nonceMatt Caswell2017-07-071-0/+3
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3852)
* Update the early_secret generation to use the new ticket_nonce fieldMatt Caswell2017-07-071-3/+26
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3852)
* Update tls13_hkdf_expand() to take the length of the dataMatt Caswell2017-07-073-18/+21
| | | | | | | | | In most scenarios the length of the input data is the hashsize, or 0 if the data is NULL. However with the new ticket_nonce changes the length can be different. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3852)
* Send and receive the ticket_nonce field in a NewSessionTicketMatt Caswell2017-07-075-3/+56
| | | | | | | | This just adds the processing for sending and receiving the newly added ticket_nonce field. It doesn't actually use it yet. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3852)
* Error out when forcing an unsupported TLS versionBenjamin Kaduk2017-07-051-8/+122
| | | | | | | | | | | If the result of a SSL_{CTX_,}set_{min,max}_proto_version() call leaves the min and max version identical, and support for that version is compiled out of the library, return an error. Such an object has no hope of successfully completing a handshake, and this error may be easier to decipher than the resulting handshake failure. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3422)
* Fix potential crash in tls_construct_finished.Bernd Edlinger2017-07-031-1/+6
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3667)
* Fix a crash in tls_construct_client_certificate.Bernd Edlinger2017-07-031-1/+6
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3667)
* Fix TLSv1.3 exporterMatt Caswell2017-07-031-1/+1
| | | | | | | | | | | | | | We need to use the hashsize in generating the exportsecret not 0! Otherwise we end up with random garbage for the secret. It was pure chance that this passed the tests previously. It so happens that, because we call SSL_export_keying_material() repeatedly for different scenarios in the test, we end up in the tls13_export_keying_material() at exactly the same position in the stack each time and therefore end up using the same random garbage secret each time! Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3810)
* Drop support for OPENSSL_NO_TLS1_3_METHODMatt Caswell2017-06-301-6/+0
| | | | | | | | There are no public TLSv1_3_*method() functions so OPENSSL_NO_TLS1_3_METHOD doesn't make any sense and should be removed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3800)
* Updates following review of SSL_export_key_material() changesMatt Caswell2017-06-291-4/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3782)
* Update SSL_export_keying_material() for TLSv1.3Matt Caswell2017-06-293-1/+54
| | | | | | | Fixes #3680 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3782)
* ssl_session_dup() missing ext.alpn_sessionTodd Short2017-06-281-0/+10
| | | | | | | | | Properly copy ext.alpn_session in ssl_session_dup() Use OPENSSL_strndup() as that's used in ssl_asn1.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3770)
* Disallow DSA/SHA1/etc. for pure TLS 1.3 ClientHellosBenjamin Kaduk2017-06-241-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In draft-ietf-tls-tls13-20 Appendix B we find that: This section describes protocol types and constants. Values listed as _RESERVED were used in previous versions of TLS and are listed here for completeness. TLS 1.3 implementations MUST NOT send them but might receive them from older TLS implementations. Similarly, in section 4.2.3 we see: Legacy algorithms Indicates algorithms which are being deprecated because they use algorithms with known weaknesses, specifically SHA-1 which is used in this context with either with RSA using RSASSA-PKCS1-v1_5 or ECDSA. These values refer solely to signatures which appear in certificates (see Section 4.4.2.2) and are not defined for use in signed TLS handshake messages. Endpoints SHOULD NOT negotiate these algorithms but are permitted to do so solely for backward compatibility. Clients offering these values MUST list them as the lowest priority (listed after all other algorithms in SignatureSchemeList). TLS 1.3 servers MUST NOT offer a SHA-1 signed certificate unless no valid certificate chain can be produced without it (see Section 4.4.2.2). However, we are currently sending the SHA2-based DSA signature schemes and many SHA1-based schemes, which is in contradiction with the specification. Because TLS 1.3 support will appear in OpenSSL 1.1, we are bound by stability requirements to continue to offer the DSA signature schemes and the deprecated hash algorithms. at least until OpenSSL 1.2. However, for pure TLS 1.3 clients that do not offer lower TLS versions, we can be compliant. Do so, and leave a note to revisit the issue when we are permitted to break with sacred historical tradition. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3326)
* Fix another EVP_DigestVerify() instanceMatt Caswell2017-06-231-4/+1
| | | | | | | | Following on from the previous commit this fixes another instance where we need to treat a -ve return from EVP_DigestVerify() as a bad signature. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3756)
* Treat all failures from EVP_DigestVerify() as a bad signatureMatt Caswell2017-06-231-5/+1
| | | | | | | | | | | | | | | | Prior to 72ceb6a we treated all failures from the call to EVP_DigestVerifyFinal() as if it were a bad signature, and failures in EVP_DigestUpdate() as an internal error. After that commit we replaced this with the one-shot function EVP_DigestVerify() and treated a 0 return as a bad signature and a negative return as an internal error. However, some signature errors can be negative (e.g. according to the docs if the form of the signature is wrong). Therefore we should treat all <=0 returns as a bad signature. This fixes a boringssl test failure. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3756)
* Fix tls1_generate_master_secretAlexey Komnin2017-06-221-2/+2
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3751)
* Fix the names of ChaCha20-Poly1305 cipher suites in t1_trce.c.David Benjamin2017-06-221-7/+7
| | | | | | | | | | Per RFC 7905, the cipher suite names end in "_SHA256". The original implementation targeted the -03 draft, but there was a -04 draft right before the RFC was published to make the names consistent. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3748)
* Avoid compiler complainingPaul Yang2017-06-211-4/+4
| | | | | | | | initialize some local variables Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3741)
* Add documentation for the SSL_export_keying_material() functionMatt Caswell2017-06-211-3/+3
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3735)
* Fix DTLS failure when used in a build which has SCTP enabledMatt Caswell2017-06-211-4/+4
| | | | | | | | | | | | | | | The value of BIO_CTRL_DGRAM_SET_PEEK_MODE was clashing with the value for BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE. In an SCTP enabled build BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE was used unconditionally with the reasoning that it would be ignored if SCTP wasn't in use. Unfortunately due to this clash, this wasn't the case. The BIO ended up going into peek mode and was continually reading the same data over and over - throwing it away as a replay. Fixes #3723 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3724)
* PSK related tweaks based on review feedbackMatt Caswell2017-06-213-20/+23
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Fix some bugs in the TLSv1.3 PSK codeMatt Caswell2017-06-212-3/+13
| | | | | | | Found while developing the PSK tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Make the input parameters for SSL_SESSION_set1_master_key constMatt Caswell2017-06-211-1/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add SSL_SESSION_set_protocol_version()Matt Caswell2017-06-211-0/+6
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add SSL_SESSION_set_cipher()Matt Caswell2017-06-211-0/+6
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add SSL_SESSION_set1_master_key()Matt Caswell2017-06-211-0/+13
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add a function to get the handshake digest for an SSL_CIPHERMatt Caswell2017-06-211-0/+10
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add public API functions for setting TLSv1.3 PSK callbacksMatt Caswell2017-06-211-0/+24
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add TLSv1.3 client side external PSK supportMatt Caswell2017-06-215-58/+164
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add TLSv1.3 server side external PSK supportMatt Caswell2017-06-215-52/+77
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Use EVP_PKEY_X25519, EVP_PKEY_ED25519 instead of NIDs where appropriate.Dr. Stephen Henson2017-06-212-6/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Allow Ed25519 in TLS 1.2Dr. Stephen Henson2017-06-214-11/+30
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Convert key exchange to one shot callDr. Stephen Henson2017-06-214-23/+51
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Add Ed25519 to trace outputDr. Stephen Henson2017-06-211-0/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Handle signature algorithms with no associated digestDr. Stephen Henson2017-06-213-23/+48
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Add Ed25519 signature algorithmDr. Stephen Henson2017-06-212-2/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Add Ed25519 to signature algorithm tableDr. Stephen Henson2017-06-211-0/+3
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Add index for ED25519Dr. Stephen Henson2017-06-213-2/+8
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Use X509_get_signature_info to get signature strength.Dr. Stephen Henson2017-06-211-9/+8
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Merge Nokia copyright notice into standardRich Salz2017-06-2112-324/+12
| | | | | | | This is done with the kind permission of Nokia. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3722)
* Modify Sun copyright to follow OpenSSL styleRich Salz2017-06-208-66/+8
| | | | | | | Approved by Oracle. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3585)
* Tweak the check that a ciphersuite has not changed since the HRRMatt Caswell2017-06-161-2/+3
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
* Fix an uninitialised variable warningMatt Caswell2017-06-161-3/+3
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
* Move ciphersuite selection before session resumption in TLSv1.3Matt Caswell2017-06-163-85/+93
| | | | | | | | | | This does things as per the recommendation in the TLSv1.3 spec. It also means that the server will always choose its preferred ciphersuite. Previously the server would only select ciphersuites compatible with the session. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
* Allow the server to change the ciphersuite on resumeMatt Caswell2017-06-164-13/+49
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
* Fix no-ecBenjamin Kaduk2017-06-151-2/+0
| | | | | | | | | Also remove nested OPENSSL_NO_EC conditional; it was properly indented, but a no-op. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Benjamin Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3693)
* Fix a memleak in tls13_generate_secret.Bernd Edlinger2017-06-121-1/+4
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3660)
* Put message strings in state filesRich Salz2017-06-121-86/+44
| | | | | | | | | | | | Add "*" as indicator meaning the function/reason is removed, so put an empty string in the function/reason string table; this preserves backward compatibility by keeping the #define's. In state files, trailing backslash means text is on the next line. Add copyright to state files Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3640)
* Add SSL_early_get1_extensions_present()Benjamin Kaduk2017-06-123-0/+36
| | | | | | | | | | It is an API to be used from the early callback that indicates what extensions were present in the ClientHello, and in what order. This can be used to eliminate unneeded calls to SSL_early_get0_ext() (which itself scales linearly in the number of extensions supported by the library). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2976)
* drop some no-longer-relevant TODO(TLS1.3) entriesBenjamin Kaduk2017-06-121-3/+0
| | | | | | | | | | | | | | We prevent compression both when the server is parsing the ClientHello and when the client is constructing the ClientHello. A 1.3 ServerHello has no way to hand us back a compression method, and we already check that the server does not try to give us back a compression method that we did not request, so these checks seem sufficient. Weaken the INSTALL note slightly, as we do now expect to interoperate with other implementations. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3131)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 18:38:35 +0000