summaryrefslogtreecommitdiff
path: root/lib/libssl/t1_lib.c
AgeCommit message (Collapse)Author
2017-01-22Move most of the SSL3_STATE fields to internal - the ones that remain areJoel Sing
known to be used by ports. ok beck@
2017-01-22Move ALPN and NPN fields from SSL/SSL_CTX to internal.Joel Sing
ok beck@
2017-01-22Move internal parts of ssl_session_st to internalBob Beck
ok jsing@
2016-12-21Add support for ECDHE with X25519.Joel Sing
Testing of an earlier revision by naddy@. ok beck@
2016-12-18Convert ssl3_get_server_hello() to CBS.Joel Sing
ok doug@
2016-11-05Convert ssl3_get_server_kex_ecdhe() to CBS, simplifying tls1_check_curve()Joel Sing
in the process. This also fixes a long standing bug where tls1_ec_curve_id2nid() is called with only one byte of the curve ID. ok beck@ miod@
2016-10-19Remove support for fixed ECDH cipher suites - these is not widely supportedJoel Sing
and more importantly they do not provide PFS (if you want to use ECDH, use ECDHE instead). With input from guenther@. ok deraadt@ guenther@
2016-10-02Check for and handle failure of HMAC_{Update,Final} or EVP_DecryptUpdate()Philip Guenther
based on openssl commit a5184a6c89ff954261e73d1e8691ab73b9b4b2d4 ok bcook@
2016-10-02Detect zero-length encrypted session data early, instead of when malloc(0)Philip Guenther
fails or the HMAC check fails. Noted independently by jsing@ and Kurt Cancemi (kurt (at) x64architecture.com) ok bcook@
2016-09-22Avoid unbounded memory growth, which can be triggered by a clientJoel Sing
repeatedly renegotiating and sending OCSP Status Request TLS extensions. Fix based on OpenSSL.
2016-09-22Improve ticket validity checking when tlsext_ticket_key_cb() callbackPhilip Guenther
chooses a different HMAC algorithm. Avert memory leaks if the callback preps the HMAC in some way. Based on openssl commit 1bbe48ab149893a78bf99c8eb8895c928900a16f but retaining a pre-callback length check to guarantee the callback is provided the buffer that the API claims. ok bcook@ jsing@
2016-08-27Be more strict when parsing TLS extensions.Joel Sing
Based on a diff from Kinichiro Inoguchi. ok beck@
2016-05-30deprecate internal use of EVP_[Cipher|Encrypt|Decrypt]_Final.Bob Beck
14 years ago these were changed in OpenSSL to be the same as the _ex functions. We use the _ex functions only internally to ensure it is obvious the ctx must be cleared. ok bcook@
2016-03-10http -> https for a few more IETF URLs in comments or man pagesMichael McConville
2015-09-12Remove most of the SSLv3 version checks and a few TLS v1.0.Doug Hogan
We can now assume >= TLS v1.0 since SSL2_VERSION, SSL3_VERSION and DTLS1_BAD_VER support was removed. "reads ok" miod@
2015-09-01Remove the ssl_prepare_{client,server}hello_tlsext() functions, which areJoel Sing
now nothing more than noops. ok bcook@ doug@
2015-08-19Properly handle missing TLS extensions in client hello as a non-failure.Brent Cook
Noticed by @Ligushka from github. ok miod@, doug@
2015-07-24Convert tls1_process_ticket to CBS.Doug Hogan
ok miod@ jsing@
2015-07-24Convert tls1_process_sigalgs to CBS.Doug Hogan
ok miod@ jsing@
2015-07-19Allow *_free() functions in libssl to handle NULL input.Doug Hogan
This mimics free()'s behavior which makes error handling simpler. ok bcook@ miod@
2015-07-17Remove compat hack that disabled ECDHE-ECDSA on OS X.Doug Hogan
For a few old releases, ECDHE-ECDSA was broken on OS X. This option cannot differentiate between working and broken OS X so it disabled ECDHE-ECDSA support on all OS X >= 10.6. 10.8-10.8.3 were the faulty releases but these are no longer relevant. Tested on OS X 10.10 by jsing. ok jsing@
2015-06-19Convert tls1_alpn_handle_client_hello() to CBS.Doug Hogan
tweak + ok miod@ jsing@
2015-06-17Convert ssl_next_proto_validate to CBS.Doug Hogan
ok miod@, tweak + ok jsing@
2015-06-17Convert tls1_check_curve to CBS.Doug Hogan
ok miod@ jsing@
2015-03-02Fix a minor information leak that was introduced in t1_lib.c r1.71, wherebyJoel Sing
an additional 28 bytes of .rodata (or .data) is provided to the network. In most cases this is a non-issue since the memory content is already public. Issue found and reported by Felix Groebert of the Google Security Team. ok bcook@ beck@
2014-12-14unifdef OPENSSL_NO_NEXTPROTONEG, which is one of the last standing #ifndefJoel Sing
mazes in libssl. NPN is being replaced by ALPN, however it is still going to be around for a while yet. ok miod@
2014-12-10Remove support for GOST R 34.10-94 signature authentication, along withJoel Sing
the two ciphersuites that use it. GOST94 public/private keys have been long obsoleted and libcrypto does not have support for them anyway. Discussed with Dmitry Eremin-Solenikov.
2014-12-10Add support for ALPN.Joel Sing
Based on OpenSSL and BoringSSL. ok bcook@
2014-12-06Use appropriate internal types for EC curves and formats, rather thanJoel Sing
storing and processing in wire encoded form. Inspired by boringssl. ok miod@
2014-12-06Ensure that the client specified EC curve list length is a multiple of two.Joel Sing
The EC curve handling code assumes this to be the case and will read one byte off the end of the curve list during processing, in the case where it is not. ok miod@
2014-12-06Fix two cases where it is possible to read one or two bytes past the end ofJoel Sing
the buffer. The later size check would catch this, however reading first and checking later is less than ideal. ok miod@
2014-12-02Add brainpool curves to eccurves_default[], accidentally missing from 1.32;Miod Vallat
from OpenSSL HEAD via Thomas Jakobi.
2014-11-18Update the GOST code in libssl, as contributed by Dmitry Eremin-Solenikov.Miod Vallat
This causes a libssl major version bump as this affects the layout of some internal-but-unfortunately-made-visible structs.
2014-11-03only call SRTP (whatever that is) functions when the connection type isTed Unangst
DTLS (whatever that is) instead of for TLS too. ok jsing.
2014-10-18Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().Joel Sing
arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
2014-10-15Only require an EC public key in tls1_set_ec_id(), if we need to provideJoel Sing
a compression identifier. In the case of a server using ephemeral EC keys, the supplied key is unlikely to have a public key where SSL_CTX_set_tmp_ecdh() is called after SSL_OP_SINGLE_ECDH_USE has been set. This makes ECDHE ciphers work again for this use case.
2014-10-05Use more specific curves/formats naming for local variables inJoel Sing
ssl_add_clienthello_tlsext() and ssl_add_serverhello_tlsext(), rather than the current generic naming. ok miod@
2014-10-05Use tls1_get_curvelist() in ssl_add_clienthello_tlsext(), rather thanJoel Sing
hand rolling the same code. ok miod@
2014-10-05Make tls1_get_formatlist() behave the same as tls1_get_curvelist() andJoel Sing
return the client format list if the client_formats flag is specified. Use tls1_get_formatlist()/tls1_get_curvelist() in tls1_check_ec_key(), simplifying the code. ok miod@
2014-10-03Add support for automatic ephemeral EC keys.Joel Sing
This allows an SSL server to enable ECDHE ciphers with a single setting, which results in an EC key being generated using the first preference shared curve. Based on OpenSSL with inspiration from boringssl. ok miod@
2014-09-30Clean up EC cipher handling in ssl3_choose_cipher().Joel Sing
The existing code reaches around into various internals of EC, which it should not know anything about. Replace this with a set of functions that that can correctly extract the necessary details and handle the comparisions. Based on a commit to OpenSSL, with some inspiration from boringssl. ok miod@
2014-09-27Check that the specified curve is one of the client preferences.Joel Sing
Based on OpenSSL. ok miod@
2014-09-26Now that we have a static version of the default EC formats, also use itJoel Sing
for the server hello. From OpenSSL. ok miod@
2014-09-22Refactor and simplify the ECC extension handling. The existing codeJoel Sing
effectively built two "static" data structures - instead of doing this, just use static data structures to start with. From OpenSSL (part of a larger commit). ok miod@
2014-09-21Move the TLS padding extension under an SSL_OP_TLSEXT_PADDING option, whichJoel Sing
is off by default (instead of being enabled unconditionally). The TLS padding extension was added as a workaround for a bug in F5 SSL terminators, however appears to trigger bugs in IronPort SMTP appliances. Now the SSL client gets to choose which of these devices it wants to trigger bugs in... Ported from OpenSSL. Discussed with many. ok miod@
2014-08-07Correct test reversed during merge of fix for CVE-2014-3509Philip Guenther
pointed out by Watson Ladd (watson (at) matasano.com) ok deraadt@
2014-08-06merge fix for CVE-2014-3509 -- basically a missing s->hit check; ok guentherTheo de Raadt
2014-07-13Expand the tlsext_sigalg macros. The end result is about the same numberJoel Sing
of lines and much more readable. ok miod@
2014-07-13The bell tolls for BUF_strdup - Start the migration to usingBob Beck
intrinsics. This is the easy ones, a few left to check one at a time. ok miod@ deraadt@
2014-07-12The correct name for EDH is DHE, likewise EECDH should be ECDHE.Joel Sing
Based on changes to OpenSSL trunk. ok beck@ miod@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 00:42:59 +0000