summaryrefslogtreecommitdiff
path: root/lib/libssl
AgeCommit message (Collapse)Author
2022-02-06Remove i <= 0 checks from SSL_get_error()Joel Sing
In order for SSL_get_error() to work with SSL_read_ex() and SSL_write_ex() the error handling needs to be performed without checking i <= 0. This is effectively part of OpenSSL 8051ab2b6f8 and should bring the behaviour of SSL_get_error() largely inline with OpenSSL 1.1. Issue reported by Johannes Nixdorf. ok inoguchi@ tb@
2022-02-06Handle zero byte reads/writes that trigger handshakes in the TLSv1.3 stack.Joel Sing
With the legaacy stack, it is possible to do a zero byte SSL_read() or SSL_write() that triggers the handshake, but then returns zero without SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE being flagged. This currently works in the TLSv1.3 stack by returning TLS_IO_WANT_POLLIN or TLS_IO_WANT_POLLOUT, which is then hidden by SSL_get_error(). However, due to upcoming changes to SSL_get_error() this will no longer be the case. In order to maintain the existing legacy behaviour, explicitly handle zero byte reads and writes in the TLSv1.3 stack, following completion of a handshake. ok inoguchi@ tb@
2022-02-06remove please from manual pagesJonathan Gray
ok jmc@ sthen@ millert@
2022-02-05Switch TLSv1.3 cipher names from AEAD- to OpenSSL's TLS_Theo Buehler
OpenSSL chose to break the previous naming convention for ciphers and to adopt TLS_* "RFC" names instead. Unfortunately, these names are exposed in several APIs and some language bindings test for these non-standard names instead of cipher values, which is ... unfortunate (others would say "plain crazy"). We currently have to maintain patches in regress and ports (p5-Net-SSLeay, openssl-ruby-tests - which means that Ruby will pick this up at some point) to work around this difference and that's just not worth the effort. The old AEAD- names will become aliases and continue to work, but in openssl ciphers and netcat output the TLS_* names will now be displayed. "I would be very happy if this gets committed" bluhm ok beck inoguchi, begrudgingly ok jsing
2022-02-05Bye bye S3I.Joel Sing
S3I has served us well, however now that libssl is fully opaque it is time to say goodbye. Aside from removing the calloc/free/memset, the rest is mechanical sed. ok inoguchi@ tb@
2022-02-04Bump libressl's version in pkgconfig to 2.0.0Theo Buehler
LibreSSL's pc files effectively hardcode the version to 1.0.0 since LibreSSL exists. That probably never made much sense. This causes some pain for ports that "need 'openssl' ['>= +1.1.0'] found '1.0.0'" or similar while they would build perfectly fine with LibreSSL. This only affects OpenBSD. We do not put the actual LibreSSL version in there since it may cause trouble Discussed with sthen, millert, inoguchi, beck over the past year. Diff from/ok sthen
2022-02-03Cleanup/simplify ssl_cert_type()Joel Sing
Remove the X509 argument as it is unused - this was passed so that ssl_cert_type() can get the public key from the X509 object if the EVP_PKEY argument is NULL, however this is never the case. ok tb@
2022-01-28Error check for sk_push in libsslKinichiro Inoguchi
CID 118976 118979 ok tb@
2022-01-28Error check for sk_push in libsslKinichiro Inoguchi
CID 24838 comment and ok tb@
2022-01-26whitespaceTheo Buehler
2022-01-25Rewrite paragraph to refer to EVP_CIPHER_CTX_new() and HMAC_CTX_new()Theo Buehler
to match reality. spotted by/ok jmc
2022-01-25Fix another return 0 bug in SSL_shutdown()Theo Buehler
If tls13_recod_layer_send_pending() returns TLS13_IO_EOF, we will bubble this up to the caller via tls13_legacy_return_code(), which translates TLS13_IO_EOF to 0. This can happen if we have pending post handshake-handshake data and the peer closes the pipe. Presumably tls13_legacy_shutdown() should be rewritten yet again. ok jsing
2022-01-25Avoid an infinite loop in SSL_shutdown()Theo Buehler
If the peer closed the write side of the connection and we have not yet received the close_notify, SSL_shutdown() makes an extra read to try and read the peer's close_notify from the pipe. In that situation, we receive EOF. The legacy stack will return -1 while the TLSv1.3 stack will end up returning 0. Since the documentation is not super explicit about what should be done if SSL_shutdown() returns 0, some applications will enter an infinite loop. The code and documentation indicate that SSL_shutdown() should only be called once more if it returned 0. Newer versions of the OpenSSL documentation explicitly say that one should call SSL_read() if SSL_shutdown() returns 0 in order to retrieve the close_notify. Doing this would also have avoided this infinite loop. Reported by Carsten Arzig and bluhm with a test case extracted from the syslogd tests using IO::Socket::SSL, which has such an infinite loop. ok bluhm jsing
2022-01-24Garbage collect unused ret in ssl3_get_new_session_ticket()Theo Buehler
ret is used to bubble up an error from ssl3_get_message() and is unused otherwise. Zap dead store and silly ret = 1; return ret; ok inoguchi jsing
2022-01-24In ssl3_get_server_key_exchange() switch a 'goto err' toTheo Buehler
'goto fatal_err' so that the illegal_parameter alert is actually sent in case of X509_get0_pubkey() failure. ok inoguchi jsing
2022-01-24Avoid use of uninitialized in tlsext_sni_server_parse()Theo Buehler
If the hostname is too long, tlsext_sni_is_valid_hostname() will fail without having initialized *is_ip. As a result, the garbage value could lead to accepting (but otherwise ignoring) overlong and possibly invalid hostnames without erroring in tlsext_sni_server_parse(). ok inoguchi jsing
2022-01-24Garbage collect the unused rv in tls1_check_ec_server_key() andTheo Buehler
convert to usual form of error checking. ok inoguchi jsing
2022-01-20Remove the remaining three parens in return statements.Theo Buehler
2022-01-20Use correct spelling of NULL.Theo Buehler
2022-01-15spellingJonathan Gray
ok tb@
2022-01-14bump libcrypto, libssl, libtls majors after struct visibility changesTheo Buehler
and Symbol addition and removal in libcrypto.
2022-01-14Use the correct type for ssl_callback_ctrl()Theo Buehler
2022-01-14Convert the new record layers to opaque EVP_AEAD_CTXTheo Buehler
ok jsing
2022-01-14Convert ssl_kex.c to opaque DHTheo Buehler
Stop reaching into DH internals and use the new API functions instead. ok inoguchi jsing
2022-01-14Use BIO_next/BIO_set_next in ssl_lib.cTheo Buehler
Trivial conversion to cope with opaque BIO.
2022-01-14bio_ssl.c needs to peek into bio_local.hTheo Buehler
2022-01-14Garbage collect last use of EVP_ecdsa()Theo Buehler
ok inoguchi jsing
2022-01-11Remove peer_pkeys from SSL_SESSION.Joel Sing
peer_pkeys comes from some world where peers can send multiple certificates - in fact, one of each known type. Since we do not live in such a world, get rid of peer_pkeys and simply use peer_cert instead (in both TLSv1.2 and TLSv1.3, both clients and servers can only send a single leaf (aka end-entity) certificate). ok inoguchi@ tb@
2022-01-11Simplify SSL_get_peer_certificate()Joel Sing
ok inoguchi@ tb@
2022-01-11Rename 'peer' to 'peer_cert' in SSL_SESSION.Joel Sing
The 'peer' member of SSL_SESSION is the leaf/end-entity certificate provided by our peer. Rename it since 'peer' on its own is unhelpful. ok inoguchi@ tb@
2022-01-11Plumb decode errors through key share parsing code.Joel Sing
Distinguish between decode errors and other errors, so that we can send a SSL_AD_DECODE_ERROR alert when appropriate. Fixes a tlsfuzzer failure, due to it expecting a decode error alert and not receiving one. Prompted by anton@ ok tb@
2022-01-11Use SSL_AD_INTERNAL_ERROR for non-decoding alerts when parsing keyshares.Joel Sing
ok tb@
2022-01-11Simplify tlsext_keyshare_server_parse()Joel Sing
SSL_AD_DECODE_ERROR is the default alert for a TLS extension parsing failure - remove the various gotos and simply return 0 instead. ok tb@
2022-01-09ssl_check_srvr_ecc_cert_and_alg() only returns 0/1 - test accordingly.Joel Sing
2022-01-09Swap arguments to ssl_check_srvr_ecc_cert_and_alg()Joel Sing
If a libssl function takes an SSL *, it should normally be the first argument.
2022-01-09Clean up ssl3_{send,get}_client_kex_gost()Joel Sing
Fix leaks, use sizeof() instead of hardcoded sizes, actually check return codes, explicit_bzero() the premaster secret on the server side and generally try to kick the GOST kex code into some sort of shape. ok inoguchi@ tb@
2022-01-09Return 0/1 from ssl3_{send,get}_client_kex_gost()Joel Sing
Like other KEX handling functions, there is no need to return anything other than failure/success here. ok inoguchi@ tb@
2022-01-09Remove a comment from Captain Obvious.Joel Sing
2022-01-09Fix GOST skip certificate verify handling.Joel Sing
GOST skip certificate verify handling got broken in r1.132 of s3_srvr.c circa 2016. Prior to this, ssl3_get_client_key_exchange() returned an 'extra special' value to indicate that the state machine should skip certificate verify. Fix this by setting and checking the TLS1_FLAGS_SKIP_CERT_VERIFY flag, which is the same as is done in the client. ok inoguchi@ tb@
2022-01-09Clean up pkey handling in ssl3_get_server_key_exchange()Joel Sing
With TLSv1.2 and earlier, the authentication algorithm used to sign the ServerKeyExchange message is dependent on the cipher suite in use and has nothing to do with the key exchange algorithm. As such, check the authentication algorithm based on the cipher suite in ssl3_get_server_key_exchange() and handle things accordingly. ok inoguchi@ tb@
2022-01-08Merge SESS_CERT into SSL_SESSION.Joel Sing
There is no reason for SESS_CERT to exist - remove it and merge its members into SSL_SESSION for the time being. More clean up to follow. ok inoguchi@ tb@
2022-01-08Remove commented out CERT_* defines.Joel Sing
2022-01-08Rename CERT to SSL_CERT and CERT_PKEY to SSL_CERT_PKEY.Joel Sing
Nearly all structs in libssl start with an SSL_ suffix, rename CERT and CERT_PKEY for consistency. ok inoguchi@ tb@
2022-01-07Rename dh_tmp to dhe_params.Joel Sing
Support for non-ephemeral DH was removed a long time ago - as such, the dh_tmp and dh_tmp_cb are used for DHE parameters. Rename them to reflect reality. ok inoguchi@ tb@
2022-01-07Stop attempting to duplicate the public and private key of dh_tmp.Joel Sing
Support for non-ephemeral DH was removed a very long time ago - the only way that dh_tmp is set is via DHparams_dup(), hence the public and private keys are always going to be NULL. ok inoguchi@ tb@
2022-01-07Convert legacy server to tls_key_share.Joel Sing
This requires a few more additions to the DHE key share code - we need to be able to either set the DHE parameters or specify the number of key bits for use with auto DHE parameters. Additionally, we need to be able to serialise the DHE parameters to send to the client. This removes the infamous 'tmp' struct from ssl3_state_internal_st. ok inoguchi@ tb@
2022-01-06Convert legacy TLS client to tls_key_share.Joel Sing
This requires adding DHE support to tls_key_share. In doing so, tls_key_share_peer_public() has to lose the group argument and gains an invalid_key argument. The one place that actually needs the group check is tlsext_keyshare_client_parse(), so add code to do this. ok inoguchi@ tb@
2022-01-06Allocate and free the EVP_AEAD_CTX struct in tls13_record_protection.Joel Sing
This brings the code more in line with the tls12_record_layer and reduces the effort needed to make EVP_AEAD_CTX opaque. Prompted by and ok tb@
2022-01-06Provide CBB_add_u64()Joel Sing
Prompted by and ok tb@
2022-01-05Rename tls13_key_share to tls_key_share.Joel Sing
In preparation to use the key share code in both the TLSv1.3 and legacy stacks, rename tls13_key_share to tls_key_share, moving it into the shared handshake struct. Further changes will then allow the legacy stack to make use of the same code for ephemeral key exchange. ok inoguchi@ tb@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 21:35:07 +0000