summaryrefslogtreecommitdiff
path: root/lib/libssl/Makefile
AgeCommit message (Collapse)Author
2021-10-23Rename tls13_buffer to tls_buffer.Joel Sing
This code will soon be used in the DTLSv1.2 and TLSv1.2 stack. Also introduce tls_internal.h and move/rename the read/write/flush callbacks. ok beck@ tb@
2021-09-04Factor out the TLSv1.3 code that handles content from TLS records.Joel Sing
Currently, the plaintext content from opened TLS records is handled via the rbuf code in the TLSv1.3 record layer. Factor this out and provide a separate struct tls_content, which knows how to track and manipulate the content. This makes the TLSv1.3 code cleaner, however it will also soon also be used to untangle parts of the legacy record layer. ok beck@ tb@
2021-05-05Rewrite TLSv1.2 key block handling.Joel Sing
For TLSv1.2 a single key block is generated, then partitioned into individual secrets for use as IVs and keys. The previous implementation splits this across two functions tls1_setup_key_block() and tls1_change_cipher_state(), which means that the IV and key sizes have to be known in multiple places. This implementation generates and partitions the key block in a single step, meaning that the secrets are then simply handed out when requested. ok inoguchi@ tb@
2021-04-25Clean up derivation of finished/peer finished.Joel Sing
Make this process more readable by having specific client/server functions, calling the correct one based on s->server. This allows to remove various SSL_ST_ACCEPT/SSL_ST_CONNECT checks, along with duplicate code. ok inoguchi@ tb@
2020-10-03Merge d1_{clnt,srvr}.c into ssl_{clnt,srvr}.cJoel Sing
The d1_{clnt,srvr}.c contain a single function each - merge these into the ssl_{clnt,srvr}.c, renaming them with an ssl3_ prefix for consistency. ok beck@ tb@
2020-08-30Start replacing the existing TLSv1.2 record layer.Joel Sing
This takes the same design/approach used in TLSv1.3 and provides an opaque struct that is self contained and cannot reach back into other layers. For now this just implements/replaces the writing of records for DTLSv1/TLSv1.0/TLSv1.1/TLSv1.2. In doing so we stop copying the plaintext into the same buffer that is used to transmit to the wire. ok inoguchi@ tb@
2020-06-09The check_includes step is incorrect dependency management model forTheo de Raadt
how our tree gets built. If this was done in all the libraries (imagine sys/dev), it would disrupt the development process hugely. So it should not be done here either. use 'make includes' by hand instead.
2020-05-10Provide an easy way to get debug information from TLSv1.3 handshakes.Joel Sing
This makes it easier to debug TLSv1.3 handshake failures. "Yes please!" tb@, ok beck@
2020-03-13Remove dtls1_enc().Joel Sing
Like much of the original DTLS code, dtls1_enc() is effectively a renamed copy of tls1_enc(). Since then tls1_enc() has been modified, however the non-AEAD code remains largely the same. As such, remove dtls1_enc() and instead call tls1_enc() from the DTLS code. The tls1_enc() AEAD code does not currently work correctly with DTLS, however this is a non-issue since we do not support AEAD cipher suites with DTLS currently. ok tb@
2020-02-15Move the TLSv1.3 code that interfaces with the legacy APIs/stack into aJoel Sing
separate file. Discussed with beck@ and tb@
2020-01-30Provide struct/functions for handling TLSv1.3 key shares.Joel Sing
Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
2020-01-30Factor out/rewrite the ECDHE EC point key exchange code.Joel Sing
This reduces replication between the existing TLS client/server and allows the code to soon be reused for TLSv1.3. With feedback from inoguchi@ and tb@ ok inoguchi@ tb@
2020-01-22Add checks to ensure that lib{crypto,ssl,tls} public headers have actuallyJoel Sing
been installed prior to building. Requested by and ok tb@
2020-01-22Split the TLSv1.3 guards into separate client and server guards.Joel Sing
ok beck@ tb@
2020-01-20Provide an error framework for use with the TLSv1.3 code.Joel Sing
This is based on the libtls error handling code, but adds machine readable codes and subcodes. We then map these codes back to libssl error codes. ok beck@ inoguchi@
2019-11-17Add the initial framework for the TLSv1.3 server.Joel Sing
ok beck@
2019-02-09Rename the file that contains the transcript handling code.Joel Sing
ok inoguchi@ tb@
2019-02-04Make it easier to build with LIBRESSL_HAS_TLS1_3 enabled.Joel Sing
ok tb@
2019-01-23No need to include <bsd.prog.mk> here.Theo Buehler
ok bcook
2019-01-21Provide the initial TLSv1.3 client implementation.Joel Sing
Move tls13_connect() to a new tls13_client.c file and provide a legacy wrapper to it, which allocates a struct tls_ctx if necessary. Also move tls13_client_hello_send() to tls13_client.c and actual implement the building of a client hello. ok tb@
2019-01-21Add ssl_cipher_is_permitted(), an internal helper function thatTheo Buehler
will be used in a few places shortly, e.g. in ssl_cipher_list_to_bytes(). ok jsing
2019-01-21Provide TLS 1.3 cipher AEAD/hash and legacy I/O handling functions.Joel Sing
Provide functionality for determining AEADs and hashes for TLS 1.3 ciphers. Also provide wire read/write callbacks that interface with BIO and functions that interface between SSL_read/SSL_write and the TLS 1.3 record layer API. ok tb@
2019-01-20Provide a handshake message handling implementation for TLS 1.3.Joel Sing
It receives handshake messages by reading and parsing data from the record layer. It also provides support for building and sending handshake messages. ok tb@
2019-01-20Provide an initial implementation of the TLS 1.3 record layer.Joel Sing
This is entirely self-contained and knows nothing about SSL or BIO. The bottom of the stack is provided by wire read and write callbacks, with the API to the record layer primarily being via tls13_{read,write}_{application,handshake}_data(). This currently lacks some functionality, however will be worked on in tree. ok tb@
2019-01-19Sort HDRS/SRCS lists and use one line per source file for maintainability.Joel Sing
ok tb@
2019-01-19Provide a TLS record handling implementation.Joel Sing
This is a self-contained struct and set of functions that knows how to decode and read a TLS record from data supplied via a read callback, and send itself via a write callback. This will soon be used to build the TLSv1.3 record layer handling code. ok beck@ tb@
2019-01-18Remove this copy, we have decided we can do this in placeBob Beck
ok jsing@
2019-01-17Provide an extensible buffer implementation that uses a read callback.Joel Sing
The read callback returns a TLS13_IO_* value on EOF, failure, want pollin or want pollout, or a positive value indicating the number of bytes read. This will be used by upcoming TLSv1.3 handshake message and record processing code, both of which need the ability to read a fixed size header, before extending the buffer to the number of bytes specified in the header. ok beck@ tb@
2019-01-17Add a direct copy of the exension parsing code to be modified for tls13.Bob Beck
At the moment this is mechanical, with the functions renamed. This will be refactored for tls13. ok jsing@
2018-11-09Reimplement the sigalgs processing code into a new implementationBob Beck
that will be usable with TLS 1.3 with less eye bleed. ok jsing@ tb@
2018-11-08First skeleton of the TLS 1.3 state machine. Based on RFC 8446 andTheo Buehler
inspired by s2n's state machine. Lots of help and input from jsing. ok beck, jsing
2018-11-07Add initial TLS 1.3 key schedule support with basic regress testsBob Beck
ok jsing@ tb@
2018-11-05Consolidate all of the SSL method structs/functions into a single file.Joel Sing
Discussed with tb@
2018-03-17Bring in compatibility for OpenSSL 1.1 style init functions.Bob Beck
This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
2017-08-13Switch to -Werror with clang for libressl.Doug Hogan
Discussed with beck@ and jsing@ ok beck@
2017-07-24Rewrite the TLS Renegotiation Indication extension handling using CBB/CBSJoel Sing
and the new extension framework. Feedback from doug@ ok inoguchi@
2017-07-16Start rewriting TLS extension handling.Joel Sing
Introduce a TLS extension handling framework that has per-extension type functions to determine if an extension is needed, to build the extension data and parse the extension data. This is somewhat analogous to BoringSSL, however these build and parse functions are intentionally symetrical. The framework is hooked into the existing TLS handling code in such a way that we can gradual convert the extension handling code. Convert the TLS Server Name Indication extension to the new framework, while rewriting it to use CBB/CBS and be more strict in the process. Discussed with beck@ ok inoguchi@
2017-04-30Only enable -Werror on libcrypto/libssl/libtls if we are building withJoel Sing
gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@
2017-04-29Revert previous - we still want to do this, but I forgot about the installerBob Beck
and want to avoid the wrath of theo when he arrives home in a couple of hours :)
2017-04-29We now require you to have a working libpthreadBob Beck
2017-03-05Provide a rolling handshake hash that commences as soon as the cipherJoel Sing
suite has been selected, and convert the final finish MAC to use this handshake hash. This is a first step towards cleaning up the current handshake buffer/digest code. ok beck@ inoguchi@
2017-01-26Merge the single two line function from ssl_err2.c into ssl_err.c.Joel Sing
ok beck@
2017-01-26Move relatively new version range code from ssl_lib.c into a separateJoel Sing
ssl_versions.c file. ok beck@
2017-01-26Rename s3_{both,clnt,pkt_srvr}.c to have an ssl_ prefix since they are noJoel Sing
longer SSLv3 code. ok beck@
2017-01-26Merge the client/server version negotiation into the existing (currentlyJoel Sing
fixed version) client/server code. ok beck@
2016-11-05move manual pages from doc/ to man/ for consistency with otherIngo Schwarze
libraries, in particular considering that there are unrelated files in doc/; requested by jsing@ and beck@
2016-11-05after getting rid of the pod files, clean up the Makefiles; ok bcook@Ingo Schwarze
2016-11-05Remove generated Symbols.map on make clean.Joel Sing
ok guenther@
2016-11-04Add an explict list of exported symbols with just the functionsPhilip Guenther
declared in the public headers, and use __{BEGIN,END}_HIDDEN_DECLS in the internal headers to optimize internal functions ok jsing@
2016-09-19Update ld search path for libssl/libcrypto, fixes cross-build after source ↵Brent Cook
moved. from Patrick Wildt
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 10:25:12 +0000