summaryrefslogtreecommitdiff
path: root/lib/libssl
AgeCommit message (Collapse)Author
2014-11-19Fix a memory leak with pkey in client key exchangeDoug Hogan
Based on boringssl commit: 1df112448b41c3568477f3fcd3b8fc820ce80066 ok miod@ jsing@
2014-11-18Update the GOST code in libssl, as contributed by Dmitry Eremin-Solenikov.Miod Vallat
This causes a libssl major version bump as this affects the layout of some internal-but-unfortunately-made-visible structs.
2014-11-16Sort and group includes.Joel Sing
2014-11-08Clean up more SSLv2 remnants.Joel Sing
2014-11-03only call SRTP (whatever that is) functions when the connection type isTed Unangst
DTLS (whatever that is) instead of for TLS too. ok jsing.
2014-11-02Remove remnants from RC2 and SEED - there are no longer any cipher suitesJoel Sing
that use these algorithms (and SEED was removed from libcrypto some time ago). ok doug@
2014-10-31Remove an outdated comment re EDH vs DHE - DHE is now used consistently andJoel Sing
there are backwards compatible names/aliases for EDH.
2014-10-31Update comments for TLS ExtensionType values - many of the referencedJoel Sing
drafts are now RFCs. Also add the TLS extension type for ALPN and be consistent with RFC reference formatting.
2014-10-31Crank libssl major due to recent additions, removals and changes.Joel Sing
2014-10-31Remove now unused remnants from public structs.Joel Sing
2014-10-31Add support for automatic DH ephemeral keys.Joel Sing
This allows an SSL server to enable DHE ciphers with a single setting, which results in an DH key being generated based on the server key length. Partly based on OpenSSL.
2014-10-31Remove support for ephemeral/temporary RSA private keys.Joel Sing
The only use for these is via SSL_OP_EPHEMERAL_RSA (which is effectively a standards violation) and for RSA sign-only, should only be possible if you are using an export cipher and have an RSA private key that is more than 512 bits in size (however we no longer support export ciphers). ok bcook@ miod@
2014-10-22Avoid a NULL pointer dereference that can be triggered byJoel Sing
SSL3_RT_HANDSHAKE replays. Reported by Markus Stenberg <markus.stenberg at iki.fi> - thanks! ok deraadt@
2014-10-20SSL: Fix memory leak in d2i_SSL_SESSION.Brent Cook
Modified version of patch from Dmitry Eremin-Solenikov. ==28360== 98 bytes in 2 blocks are definitely lost in loss record 7 of 7 ==28360== at 0x402AC54: realloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==28360== by 0x40E2D2C: ASN1_STRING_set (asn1_lib.c:393) ==28360== by 0x40EC22C: asn1_ex_c2i (tasn_dec.c:959) ==28360== by 0x40EC632: asn1_d2i_ex_primitive (tasn_dec.c:824) ==28360== by 0x40ED2E6: ASN1_item_ex_d2i (tasn_dec.c:230) ==28360== by 0x40ED421: ASN1_item_d2i (tasn_dec.c:133) ==28360== by 0x40F0335: d2i_ASN1_OCTET_STRING (tasn_typ.c:75) ==28360== by 0x405FD6D: d2i_SSL_SESSION (ssl_asn1.c:367) ==28360== by 0x405DD6E: ssl3_send_newsession_ticket (s3_srvr.c:2743) ==28360== by 0x405EA48: ssl3_accept (s3_srvr.c:665) ==28360== by 0x4067C34: SSL_accept (ssl_lib.c:922) ==28360== by 0x404E97B: ssl23_get_client_hello (s23_srvr.c:573) ok miod@ beck@
2014-10-18Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().Joel Sing
arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
2014-10-18Typical malloc() with size multiplication to reallocarray().Doug Hogan
ok deraadt@
2014-10-16Get rid of the last remaining BUF_strdup and BUF_strlcpy and friends, useBob Beck
intrinsic functions everywhere, and wrap these functions in an #ifndef LIBRESSL_INTERNAL to make sure we don't bring their use back.
2014-10-15Disable SSLv3 by default.Joel Sing
SSLv3 has been long known to have weaknesses and the POODLE attack has once again shown that it is effectively broken/insecure. As such, it is time to stop enabling a protocol was deprecated almost 15 years ago. If an application really wants to provide backwards compatibility, at the cost of security, for now SSL_CTX_clear_option(ctx, SSL_OP_NO_SSLv3) can be used to re-enable it on a per-application basis. General agreement from many. ok miod@
2014-10-15Only require an EC public key in tls1_set_ec_id(), if we need to provideJoel Sing
a compression identifier. In the case of a server using ephemeral EC keys, the supplied key is unlikely to have a public key where SSL_CTX_set_tmp_ecdh() is called after SSL_OP_SINGLE_ECDH_USE has been set. This makes ECDHE ciphers work again for this use case.
2014-10-15Add cipher aliases for DHE (the correct name for EDH) and ECDHE (theJoel Sing
correct name for EECDH). The EDH and EECDH aliases remain for backwards compatibility.
2014-10-12Convert libssl manpages from pod to mdoc(7).Anthony J. Bentley
libcrypto has not been started yet. ok schwarze@ miod@
2014-10-05Use more specific curves/formats naming for local variables inJoel Sing
ssl_add_clienthello_tlsext() and ssl_add_serverhello_tlsext(), rather than the current generic naming. ok miod@
2014-10-05Use tls1_get_curvelist() in ssl_add_clienthello_tlsext(), rather thanJoel Sing
hand rolling the same code. ok miod@
2014-10-05Make tls1_get_formatlist() behave the same as tls1_get_curvelist() andJoel Sing
return the client format list if the client_formats flag is specified. Use tls1_get_formatlist()/tls1_get_curvelist() in tls1_check_ec_key(), simplifying the code. ok miod@
2014-10-03Bump minor version for ECDH auto.Joel Sing
While there are no additional symbols, there is an additional command that clients will potentially depend on.
2014-10-03Add support for automatic ephemeral EC keys.Joel Sing
This allows an SSL server to enable ECDHE ciphers with a single setting, which results in an EC key being generated using the first preference shared curve. Based on OpenSSL with inspiration from boringssl. ok miod@
2014-10-03Use string literals in printf style calls so gcc's -Wformat works.Doug Hogan
ok tedu@, miod@
2014-09-30Clean up EC cipher handling in ssl3_choose_cipher().Joel Sing
The existing code reaches around into various internals of EC, which it should not know anything about. Replace this with a set of functions that that can correctly extract the necessary details and handle the comparisions. Based on a commit to OpenSSL, with some inspiration from boringssl. ok miod@
2014-09-28Bump minor after adding SSL_CTX_use_certificate_chain().Reyk Floeter
ok jsing@ miod@
2014-09-28Add a new API function SSL_CTX_use_certificate_chain() that allows toReyk Floeter
read the PEM-encoded certificate chain from memory instead of a file. This idea is derived from an older implementation in relayd that was needed to use the function with a privep'ed process in a chroot. Now it is time to get it into LibreSSL to make the API more privsep- friendly and to make it available for other programs and the ressl library. ok jsing@ miod@
2014-09-27There is not much point checking ecdhp is not NULL... twice.Joel Sing
ok miod@
2014-09-27Check that the specified curve is one of the client preferences.Joel Sing
Based on OpenSSL. ok miod@
2014-09-26Now that we have a static version of the default EC formats, also use itJoel Sing
for the server hello. From OpenSSL. ok miod@
2014-09-22Refactor and simplify the ECC extension handling. The existing codeJoel Sing
effectively built two "static" data structures - instead of doing this, just use static data structures to start with. From OpenSSL (part of a larger commit). ok miod@
2014-09-22Also check the result from final_finish_mac() against finish_mac_length inJoel Sing
ssl3_send_finished(). While this previously checked against a zero return value (which could occur on failure), we may as well test against the expected length, since we already know what that is.
2014-09-22It is possible (although unlikely in practice) for peer_finish_md_len toJoel Sing
end up with a value of zero, primarily since ssl3_take_mac() fails to check the return value from the final_finish_mac() call. This would then mean that an SSL finished message with a zero-byte payload would successfully match against the calculated finish MAC. Avoid this by checking the length of peer_finish_md_len and the SSL finished message payload, against the known length already stored in the SSL3_ENC_METHOD finish_mac_length field (making use of a previously unused field). ok miod@ (a little while back)
2014-09-21Move the TLS padding extension under an SSL_OP_TLSEXT_PADDING option, whichJoel Sing
is off by default (instead of being enabled unconditionally). The TLS padding extension was added as a workaround for a bug in F5 SSL terminators, however appears to trigger bugs in IronPort SMTP appliances. Now the SSL client gets to choose which of these devices it wants to trigger bugs in... Ported from OpenSSL. Discussed with many. ok miod@
2014-09-19Add CHACHA20 as a cipher symmetric encryption alias.Joel Sing
From Ming <gzchenym at 126.com>
2014-09-19remove obfuscating parens. man operator is your friend.Ted Unangst
2014-09-07Remove SSL_kDHr, SSL_kDHd and SSL_aDH. No supported ciphersuites use them,Joel Sing
nor do we plan on supporting them. ok guenther@
2014-08-24Replace the remaining uses of ssl3_put_cipher_by_char() with s2n and aJoel Sing
ssl3_cipher_get_value() helper function, which returns the cipher suite value for the given cipher. ok miod@
2014-08-23Remove non-standard GOST cipher suites (which are not compiled inJoel Sing
currently). From Dmitry Eremin-Solenikov.
2014-08-23Replace the remaining ssl3_get_cipher_by_char() calls with n2s() andJoel Sing
ssl3_get_cipher_by_id(). ok bcook@
2014-08-11Check the return value of sk_SSL_CIPHER_new_null(), since it allocatesJoel Sing
memory and can return NULL. ok miod@
2014-08-11Unchecked memory allocation and potential leak upon error inMiod Vallat
ssl3_get_cert_verify(). ok guenther@ jsing@
2014-08-11Remove now-unused SSL2_STATE as well as ssl2-specific state machine values.Miod Vallat
ok guenther@ jsing@
2014-08-11Currently, ssl3_put_char_by_bytes(NULL, NULL) is just a long handed wayJoel Sing
of writing "2". Add a define for the SSL3_CIPHER_VALUE_SIZE (rather than using a less-readable hardcoded constant everywhere) and replace the ssl3_put_char_by_bytes(NULL, NULL) calls with it. ok bcook@ miod@
2014-08-11Provide a ssl3_get_cipher_by_id() function that allows ciphers to be lookedJoel Sing
up by their ID. For one, this avoids an ugly mess in ssl_sess.c, where the cipher value is manually written into a buffer, just so the cipher can be located using ssl3_get_cipher_by_char(). ok bcook@ miod@
2014-08-10Tweak cipher list comments and add missing cipher value comments.Joel Sing
2014-08-10Remove disabled (weakened export and non-ephemeral DH) cipher suites fromJoel Sing
the cipher list. This reduces code size, saves data segment space and prevents them from being turned back on at runtime by flipping a bit in memory. ok guenther@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-25 05:41:37 +0000