summaryrefslogtreecommitdiff
path: root/lib/libssl/d1_pkt.c
AgeCommit message (Collapse)Author
2017-05-07Move state from ssl->internal to the handshake structure.Bob Beck
while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
2017-02-07Change SSLerror() back to taking two args, with the first one being an SSL *.Bob Beck
Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible
2017-01-26Send the error function codes to rot in the depths of hell where they belongBob Beck
We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
2017-01-26Remove most of SSL3_ENC_METHOD - we can just inline the function callsJoel Sing
and defines since they are the same everywhere. ok beck@
2017-01-25Provide ssl3_packet_read() and ssl3_packet_extend() functions that improveJoel Sing
the awkward API provided by ssl3_read_n(). Call these when we need to read or extend a packet. ok beck@
2017-01-23Move options and mode from SSL_CTX and SSL to internal, since these can beJoel Sing
set and cleared via existing functions.
2017-01-23Split most of SSL_METHOD out into an internal variant, which is opaque.Joel Sing
Discussed with beck@
2017-01-23send state and rstate from ssl_st into internal. There are accessorsBob Beck
so these should not be diddled with directly ok jsing@
2017-01-23move back read_hash and enc_read_ctx into ssl_st. wpa_supplicant andBob Beck
other perversions touches them sickly and unnaturally.
2017-01-23Move a large part of ssl_st into internal, so we can see what squeals.Bob Beck
ok jsing@
2017-01-23move the callbacks from ssl_st to internalBob Beck
ok jsing@
2017-01-23Move callback function pointers and argument pointers from SSL_CTX toJoel Sing
internal. ok beck@
2017-01-22Move most of the SSL3_STATE fields to internal - the ones that remain areJoel Sing
known to be used by ports. ok beck@
2017-01-22Move most of DTLS1_STATE to internal.Bob Beck
ok jsing@
2016-11-04Make do_dtls1_write() static to d1_pkt.c and delete declarations forPhilip Guenther
three functions that were removed a while ago ok jsing@
2015-09-11Rename functions that moved to t1_enc.c, with a tls1_ prefix instead of aJoel Sing
ssl3_ prefix. ok beck@
2015-09-10Remove support for DTLS_BAD_VER. We do not support non-standard andJoel Sing
incomplete implementations just so that we can interoperate with products from vendors who have not bothered to fix things in the last ~10 years. ok bcook@ miod@
2015-07-19Assign p to CBS_data since it is used later.Doug Hogan
The p initialization was hiding this bug but Coverity 126279 saw it. ok miod@ bcook@ beck@
2015-07-18Convert dtls1_get_message_header to CBS and change to int.Doug Hogan
Changed return value from void to int. It should never return an error given that the input length is not checked yet. ok miod@
2015-07-18Convert dtls1_get_record to CBS.Doug Hogan
ok miod@, input + ok jsing@
2015-07-18Remove repeated code in dtls1_get_record.Doug Hogan
The "if" is a bit ugly, but this does remove a lot of repetitive code. This will be converted to CBS later as well. ok miod@ jsing@ roughly ok with it after seeing the CBS version
2015-06-17KNF whitespace.Doug Hogan
ok miod@ jsing@
2015-06-13Fix bad indenting in LibreSSL.Doug Hogan
jsg@ noticed that some of the lines in libssl and libcrypto are not indented properly. At a quick glance, it looks like it has a different control flow than it really does. I checked the history in our tree and in OpenSSL to make sure these were simple mistakes. ok miod@ jsing@
2015-02-09Jettison DTLS over SCTP.Joel Sing
OpenBSD does not have SCTP support and it sees little use in the wild. OPENSSL_NO_SCTP is already specified via opensslfeatures.h, hence this is a code removal only and symbols should remain unchanged. ok beck@ miod@ tedu@
2015-01-21Fix DTLS memory leak (CVE-2015-0206).Doug Hogan
There were four bugs fixed by this patch: * dtls1_buffer_record() now frees rdata->rbuf.buf on error. Since s->s3->rbuf was memset, rdata->rbuf is the only pointer left which points to the old rbuf. On error, rdata is freed so there will not be any way of freeing this memory unless we do it here. * Changed the return code of dtls1_buffer_record() to differentiate between queue full (0) and error (-1). See below as this differs from upstream. * Handle errors if calls to dtls1_buffer_record() fail with -1. Previously, it did not check the return value. * Changed the way receipts are recorded. Previously, it was recorded when processed successfully (whether buffered or not) in dtls1_process_record(). Now, it records when it is handled in dtls1_get_record(): either when it is entered into the queue to buffer for the next epoch or when it is processed directly. Processing buffered records does not add a receipt because it needed one in order to get into the queue. The above bugs combined contributed to an eventual DoS through memory exhaustion. The memory leak came from dtls1_buffer_record()'s error handling. The error handling can be triggered by a duplicate record or malloc failure. It was possible to add duplicate records because they were not being dropped. The faulty receipts logic did not detect replays when dealing with records for the next epoch. Additionally, dtls1_buffer_record()'s return value was not checked so an attacker could send repeated replay records for the next epoch. Reported to OpenSSL by Chris Mueller. Patch based on OpenSSL commit 103b171d8fc282ef435f8de9afbf7782e312961f and BoringSSL commit 44e2709cd65fbd2172b9516c79e56f1875f60300. Our patch matches BoringSSL's commit. OpenSSL returns 0 when the queue is full or when malloc() or pitem_new() fails. They return -1 on error including !ssl3_setup_buffers() which is another failure to allocate memory. BoringSSL and LibreSSL changed the return code for dtls1_buffer_record() to be 1 on success, 0 when the queue is full and -1 on error. input + ok bcook@, jsing@
2014-12-14Remove trailing whitespace.Joel Sing
2014-11-16Sort and group includes.Joel Sing
2014-10-22Avoid a NULL pointer dereference that can be triggered byJoel Sing
SSL3_RT_HANDSHAKE replays. Reported by Markus Stenberg <markus.stenberg at iki.fi> - thanks! ok deraadt@
2014-10-18Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().Joel Sing
arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
2014-08-07Oops, revert changes commited by mistake. The previous commit was supposedMiod Vallat
to only apply to s23_srvr.c.
2014-08-07When you expect a function to return a particular value, don't put a commentMiod Vallat
saying that you expect it to return that value and compare it against zero because it is supposedly faster, for this leads to bugs (especially given the high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this library). Instead, compare for the exact value it ought to return upon success. ok deraadt@
2014-07-10decompress libssl. ok beck jsingTed Unangst
2014-07-09Remove leading underscore from _BYTE_ORDER and _{LITTLE,BIG}_ENDIAN, to beMiod Vallat
more friendly to systems where the underscore flavours may be defined as empty. Found the hard way be bcook@; joint brainstrom with bcook beck and guenther
2014-06-19convert CRYPTO_memcmp to timingsafe_memcmp based on current policy favoringTed Unangst
libc interfaces over libcrypto interfaces. for now we also prefer timingsafe_memcmp over timingsafe_bcmp, even when the latter is acceptable. ok beck deraadt matthew miod
2014-06-15Rename ssl3_record_sequence_update() to ssl3_record_sequence_increment(),Joel Sing
so that it reflects what it is actually doing. Use this function in a number of places that still have the hand rolled version. ok beck@ miod@
2014-06-12tags as requested by miod and teduTheo de Raadt
2014-06-11Disable TLS support...Joel Sing
Just kidding! unifdef OPENSSL_NO_TLS since we will never want to actually do that. ok deraadt@
2014-05-30remove some #if 0 code. we don't need any more reminders that we're usingTed Unangst
a not quite appropriate data structure. ok jsing
2014-05-30While working on another diff I ended up looking to see why on earth theJoel Sing
DTLS code had a chunk that checked to see if the SSL version was *not* DTLS. Turns out that this is inside a big #if 0 block with a comment explaining why DTLS will never need this code... The DTLS code was clearly written by wholesale copying the SSLv3 code. Any code not applicable to DTLS was seemingly #if 0'd or commented out and left for others to find. d1_pkt.c is copied from s3_pkt.c and it has a do_dtls1_write() function that has the same function signature as do_ssl3_write(), except that the create_empty_fragement (yes, that is the spelling in ssl_locl.h) argument is unused for DTLS (although there is code that pretends to use it) since it uses explicit IV (as the comment notes). Instead of leaving this turd lying around, nuke the #if 0'd code (along with the check for *not* DTLS) and remove the pointless create_empty_fragment argument given the only two do_dtls1_write() calls specify zero. This kind of thing also makes you wonder how much actual peer review occurred before the code was initially committed... ok beck@
2014-05-28There is no point in checking if a pointer is non-NULL before calling free,Joel Sing
since free already does this for us. Also remove some pointless NULL assignments, where the result from malloc(3) is immediately assigned to the same variable. ok miod@
2014-05-27Remove redundant test introduced in s3_pkt.c on 20001225, which got cargo-cultedMiod Vallat
(with an XXX comment, though) in d1_pkt.c in 2005.
2014-05-26Make sure all error paths in dtls1_buffer_record() invoke SSLErr byMiod Vallat
factoring error handling. ok jsing@
2014-05-25Remove TLS_DEBUG, SSL_DEBUG, CIPHER_DEBUG and OPENSSL_RI_DEBUG. Much ofJoel Sing
this is sporadic, hacked up and can easily be put back in an improved form should we ever need it. ok miod@
2014-05-22Stop pulling pqueue.h into ssl_locl.h since only a small part of libsslJoel Sing
actually needs it. Instead, just include it in the files where it is actually necessary. Also remove standard includes from pqueue.h so that they are not available as a side effect. Just add the two includes that are needed to pqueue.c. ok miod@
2014-05-18Make sure ssl3_setup_buffers() does not return upon error with a freedMiod Vallat
pqueue still chained, by inserting it into the list only after all possible failure conditions have been avoided. Reported and fix proposed by David Ramos; ok beck@
2014-05-15No longer make pqueue.h a public (and installed) header file. Replace itsMiod Vallat
inclusion in <ssl/dtls1.h> by the benign `struct _pqueue; typedef struct _pqueue *pqueue;'. Note that said dtls1.h should probably be considered a private header as well... ok beck@
2014-04-26Replace all use of ERR_add_error_data with ERR_asprintf_error_data.Bob Beck
This avoids a lot of ugly gymnastics to do snprintfs before sending the bag of strings to ERR, and eliminates at least one place in dso_dlfctn.c where it was being called with the incorrect number of arguments and using random things off the stack as addresses of strings. ok krw@, jsing@
2014-04-23Figure out endianness at compile-time, using _BYTE_ORDER fromMiod Vallat
<machine/endian.h>, rather than writing 1 to a 32-bit variable and checking whether the first byte is nonzero. tweaks and ok matthew@; ok beck@ tedu@
2014-04-17whack a bunch of disabled code. ok beck lteoTed Unangst
2014-04-17Change library to use intrinsic memory allocation functions instead ofBob Beck
OPENSSL_foo wrappers. This changes: OPENSSL_malloc->malloc OPENSSL_free->free OPENSSL_relloc->realloc OPENSSL_freeFunc->free
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 11:08:22 +0000