aboutsummaryrefslogtreecommitdiffstats
path: root/ssl
Commit message (Collapse)AuthorAgeFilesLines
* RT3999: Remove sub-component version stringsRich Salz2015-08-103-5/+0
| | | | | | Especially since after the #ifdef cleanups this is not useful. Reviewed-by: Matt Caswell <matt@openssl.org>
* Change error reason to match previous behaviour.Adam Eijdenberg2015-08-041-1/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix unhandled error condition in sslv2 client hello parsing.Adam Eijdenberg2015-08-041-0/+3
| | | | | | | | | --strict-warnings started showing warnings for this today... Surely an error should be raised if these reads fail? Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* PACKETise NextProtoMatt Caswell2015-08-041-19/+24
| | | | | | Change NextProto message processing to use the PACKET API. Reviewed-by: Stephen Henson <steve@openssl.org>
* PACKETise CertificateVerify processingMatt Caswell2015-08-041-17/+30
| | | | | | Modify CertificateVerify processing to use the new PACKET API. Reviewed-by: Stephen Henson <steve@openssl.org>
* PACKETise ClientCertificate processingMatt Caswell2015-08-041-13/+20
| | | | | | Use the PACKET API for processing ClientCertificate messages Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix a bug in the new PACKET implementationMatt Caswell2015-08-041-8/+8
| | | | | | | Some of the PACKET functions were returning incorrect data. An unfortunate choice of test data in the unit test was masking the failure. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix make errors for the CCS changesMatt Caswell2015-08-031-1/+1
| | | | | | | The move of CCS into the state machine was causing make errors to fail. This fixes it. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix ssl3_read_bytes handshake fragment bugMatt Caswell2015-08-031-0/+4
| | | | | | | | | The move of CCS into the state machine introduced a bug in ssl3_read_bytes. The value of |recvd_type| was not being set if we are satisfying the request from handshake fragment storage. This can occur, for example, with renegotiation and causes the handshake to fail. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move DTLS CCS processing into the state machineMatt Caswell2015-08-036-92/+129
| | | | | | | Continuing on from the previous commit this moves the processing of DTLS CCS messages out of the record layer and into the state machine. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move TLS CCS processing into the state machineMatt Caswell2015-08-0310-137/+170
| | | | | | | | | | | | | | | | | | | | | The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: Tim Hudson <tjh@openssl.org>
* PACKETise ClientHello processingMatt Caswell2015-08-036-336/+344
| | | | | | | Uses the new PACKET code to process the incoming ClientHello including all extensions etc. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add initial packet parsing codeMatt Caswell2015-08-033-605/+1036
| | | | | | | | | Provide more robust (inline) functions to replace n2s, n2l, etc. These functions do the same thing as the previous macros, but also keep track of the amount of data remaining and return an error if we try to read more data than we've got. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Make BSD make happy with subdirectories.Ben Laurie2015-08-011-0/+4
| | | | Reviewed-by: Richard Levitte
* Remove erroneous server_random fillingMatt Caswell2015-07-311-7/+4
| | | | | | | | | | | | | Commit e481f9b90b164 removed OPENSSL_NO_TLSEXT from the code. Previously if OPENSSL_NO_TLSEXT *was not* defined then the server random was filled during getting of the ClientHello. If it *was* defined then the server random would be filled in ssl3_send_server_hello(). Unfortunately in commit e481f9b90b164 the OPENSSL_NO_TLSEXT guards were removed but *both* server random fillings were left in. This could cause problems for session ticket callbacks. Reviewed-by: Stephen Henson <steve@openssl.org>
* cleanse psk_identity on errorDr. Stephen Henson2015-07-301-2/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Free and cleanse pms on errorDr. Stephen Henson2015-07-301-2/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Don't request certificates for any PSK ciphersuiteDr. Stephen Henson2015-07-301-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* CAMELLIA PSK ciphersuites from RFC6367Dr. Stephen Henson2015-07-301-0/+114
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add RFC4785 ciphersuitesDr. Stephen Henson2015-07-301-0/+47
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add RFC4279, RFC5487 and RFC5489 ciphersuites.Dr. Stephen Henson2015-07-301-1/+532
| | | | | | Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
* Add full PSK trace supportDr. Stephen Henson2015-07-301-13/+36
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* PSK premaster secret derivation.Dr. Stephen Henson2015-07-301-7/+46
| | | | | | | | Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
* Extended PSK server support.Dr. Stephen Henson2015-07-302-120/+136
| | | | | | | | | | | | | | | | Add support for RSAPSK, DHEPSK and ECDHEPSK server side. Update various checks to ensure certificate and server key exchange messages are only sent when required. Update message handling. PSK server key exchange parsing now include an identity hint prefix for all PSK server key exchange messages. PSK client key exchange message expects PSK identity and requests key for all PSK key exchange ciphersuites. Update flags for RSA, DH and ECDH so they are also used in PSK. Reviewed-by: Matt Caswell <matt@openssl.org>
* Extended PSK client support.Dr. Stephen Henson2015-07-301-106/+112
| | | | | | | | | | | | | | | | Add support for RSAPSK, DHEPSK and ECDHEPSK client side. Update various checks to ensure certificate and server key exchange messages are only expected when required. Update message handling. PSK server key exchange parsing now expects an identity hint prefix for all PSK server key exchange messages. PSK client key exchange message requests PSK identity and key for all PSK key exchange ciphersuites and includes identity in message. Update flags for RSA, DH and ECDH so they are also used in PSK. Reviewed-by: Matt Caswell <matt@openssl.org>
* PSK PRF correction.Dr. Stephen Henson2015-07-301-3/+9
| | | | | | | For SHA384 PRF PSK ciphersuites we have to switch to default PRF for TLS < 1.2 Reviewed-by: Matt Caswell <matt@openssl.org>
* Make auto DH work with DHEPSKDr. Stephen Henson2015-07-301-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Check for kECDH with extensions.Dr. Stephen Henson2015-07-301-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Enable PSK if corresponding mask set.Dr. Stephen Henson2015-07-301-0/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Disable all PSK if no callback.Dr. Stephen Henson2015-07-302-2/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Disable unsupported PSK algorithmsDr. Stephen Henson2015-07-301-4/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* new PSK text constantsDr. Stephen Henson2015-07-301-0/+9
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* New PSK aliases.Dr. Stephen Henson2015-07-301-1/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* fields for PSK key, new constantsDr. Stephen Henson2015-07-301-0/+11
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix write failure handling in DTLS1.2Matt Caswell2015-07-301-1/+1
| | | | | | | | | | | | | The DTLS code is supposed to drop packets if we try to write them out but the underlying BIO write buffers are full. ssl3_write_pending() contains an incorrect test for DTLS that controls this. The test only checks for DTLS1 so DTLS1.2 does not correctly clear the internal OpenSSL buffer which can later cause an assert to be hit. This commit changes the test to cover all DTLS versions. RT#3967 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Allow any order for signature algorithm string.Dr. Stephen Henson2015-07-281-13/+19
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove support for SSL3_FLAGS_DELAY_CLIENT_FINISHEDMatt Caswell2015-07-274-78/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This flag was not set anywhere within the codebase (only read). It could only be set by an app reaching directly into s->s3->flags and setting it directly. However that method became impossible when libssl was opaquified. Even in 1.0.2/1.0.1 if an app set the flag directly it is only relevant to ssl3_connect(), which calls SSL_clear() during initialisation that clears any flag settings. Therefore it could take effect if the app set the flag after the handshake has started but before it completed. It seems quite unlikely that any apps really do this (especially as it is completely undocumented). The purpose of the flag is suppress flushing of the write bio on the client side at the end of the handshake after the client has written the Finished message whilst resuming a session. This enables the client to send application data as part of the same flight as the Finished message. This flag also controls the setting of a second flag SSL3_FLAGS_POP_BUFFER. There is an interesting comment in the code about this second flag in the implementation of ssl3_write: /* This is an experimental flag that sends the * last handshake message in the same packet as the first * use data - used to see if it helps the TCP protocol during * session-id reuse */ It seems the experiment did not work because as far as I can tell nothing is using this code. The above comment has been in the code since SSLeay. This commit removes support for SSL3_FLAGS_DELAY_CLIENT_FINISHED, as well as the associated SSL3_FLAGS_POP_BUFFER. Reviewed-by: Rich Salz <rsalz@openssl.org>
* free names before contextDr. Stephen Henson2015-07-211-1/+1
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* typoDr. Stephen Henson2015-07-211-1/+1
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* SSL_CONF additions.Dr. Stephen Henson2015-07-211-12/+144
| | | | | | | | | | Add support for loading verify and chain stores in SSL_CONF. Commands to set verify mode and client CA names. Add documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Use uint32_t consistently for flags.Dr. Stephen Henson2015-07-184-18/+18
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Dup peer_chain properly in SSL_SESSIONDr. Stephen Henson2015-06-301-0/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Use single master secret generation function.Dr. Stephen Henson2015-06-295-67/+37
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix PSK client handling.Dr. Stephen Henson2015-06-231-25/+5
| | | | | | | | The PSK identity hint should be stored in the SSL_SESSION structure and not in the parent context (which will overwrite values used by other SSL structures with the same SSL_CTX). Reviewed-by: Matt Caswell <matt@openssl.org>
* Add PSK GCM ciphersuites from RFC5487Dr. Stephen Henson2015-06-231-0/+34
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* PSK trace keyex fixes.Dr. Stephen Henson2015-06-231-0/+14
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Avoid duplication.Dr. Stephen Henson2015-06-232-4/+7
| | | | | | | | We always free the handshake buffer when digests are freed so move it into ssl_free_digest_list() Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Tidy up ssl3_digest_cached_records logic.Dr. Stephen Henson2015-06-236-92/+63
| | | | | | | | | | | | | | | Rewrite ssl3_digest_cached_records handling. Only digest cached records if digest array is NULL: this means it is safe to call ssl3_digest_cached_records multiple times (subsequent calls are no op). Remove flag TLS1_FLAGS_KEEP_HANDSHAKE instead only update handshake buffer if digest array is NULL. Add additional "keep" parameter to ssl3_digest_cached_records to indicate if the handshake buffer should be retained after digesting cached records (needed for TLS 1.2 client authentication). Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove SESS_CERT entirely.Dr. Stephen Henson2015-06-226-102/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move peer chain to SSL_SESSION structure.Dr. Stephen Henson2015-06-226-8/+8
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-27 04:42:33 +0000