summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2020-05-09Back out server side CCS sending. It breaks TLSv1.3 client communicationTheo Buehler
with TLSv1.2 servers, since it makes clients send their dummy CCS too early... There's an obvious but dirty bandaid which I can't bring myself to applying - this business is already disgusting enough. Issue found the hard way by sthen
2020-05-09Forcibly ensure that only PSS may be used with RSA in TLS 1.3.Bob Beck
This prevents us from incorrectly choosing a PKCS1 based signature if the client advertises support for them but also prefers them to PSS such as appears to be the case with gnuTLS. ok jsing@
2020-05-09Send dummy ChangeCipherSpec messages from the TLSv1.3 serverTheo Buehler
If the client has requested middle box compatibility mode by sending a non-empty legacy_session_id, the server must send a dummy CCS right after its first handshake message. This means right after ServerHello or HelloRetryRequest. ok jsing
2020-05-09Send dummy ChangeCipherSpec messages from the TLSv1.3 client.Joel Sing
When operating in middlebox compatibility mode, the TLSv1.3 client needs to send a dummy ChangeCipherSpec message immediately before its second flight of handshake messages (when early data is not offered). ok tb@
2020-05-09Correct return value check to handle TLS13_IO_EOF case.Joel Sing
2020-05-09Add a middlebox_compat flag and condition session ID randomisation on it.Joel Sing
ok tb@
2020-05-09catch the other place this needs to changeBob Beck
2020-05-09now that 3.1.1 is out the door as a stable release bump the developmentBob Beck
version to 3.2.0
2020-05-09Add support for certificate status requests in TLS 1.3 clientBob Beck
ok jsing@, tb@, inoguchi@
2020-05-09Make the test for the legacy_compression_method vector in the ClientHelloTheo Buehler
stricter. Previously, we would accept any vector if it advertised the "null" compression method. RFC 8446 4.1.2 specifies that the only legal vector has length one and contains a zero byte for the null method. ok jsing
2020-05-09Drop a redundant test. It's effectively doing the same test twiceTheo Buehler
and if the two lengths differed, the later CBS_write_bytes() would correctly fail anyway. Discussed with jsing
2020-05-09On receiving an overlong session ID terminate with an illegal_parameterTheo Buehler
alert. Found with tlsfuzzer. ok jsing
2020-05-09Add support for HelloRetryRequests in the TLSv1.3 server.Joel Sing
ok inoguchi@ tb@
2020-05-09crazy whitespace on one lineTheo Buehler
2020-05-09Pull the sending of alerts up into tls13_handshake_perform().Joel Sing
This fixes the case where a send function signals that an alert should be sent, then returns failure. Previously the failure would be propagated up, without the alert being sent. Issued noted by tb@ ok tb@
2020-05-09Refactor tls13_server_hello_sent().Joel Sing
Split the record protection engagement code into a separate tls13_server_engage_record_protection() function and call this from tls13_server_hello_sent(). Also move some functions around to keep the logical ordering/grouping. ok inoguchi@ tb@ (as part of a larger diff)
2020-05-07On receiving a handshake or alert record with empty inner plaintext,Theo Buehler
terminate the connection with an unexpected_message alert. See RFC 8446 section 5.4. Found with tlsfuzzer hint/ok jsing
2020-05-06Bump LibreSSL version to 3.1.1Theo Buehler
ok bcook inoguchi deraadt
2020-05-03Accept two ChangeCipherSpec messages during a TLSv1.3 handshake.Joel Sing
In compatibility mode, a TLSv1.3 server MUST send a dummy CCS message immediately after its first handshake message. This is normally after the ServerHello message, but it can be after the HelloRetryRequest message. As such we accept one CCS message from the server during the handshake. However, it turns out that in the HelloRetryRequest case, Facebook's fizz TLSv1.3 stack sends CCS messages after both the HelloRetryRequest message and the ServerHello message. This is unexpected and as far as I'm aware, no other TLSv1.3 implementation does this. Unfortunately the RFC is rather ambiguous here, which probably means it is not strictly an RFC violation. Relax the CCS message handling to allow two dummy CCS messages during a TLSv1.3. This makes our TLSv1.3 client work with Facebook Fizz when HRR is triggered. Issue discovered by inoguchi@ and investigated by tb@. ok deraadt@ tb@
2020-05-02Add const to TLS1.3 internal vectorsKinichiro Inoguchi
ok tb@
2020-04-30Disallow setting the AES-GCM IV length to 0Theo Buehler
It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)
2020-04-30drop duplicate word;Ingo Schwarze
reported by Gordon Bergling <gbergling at gmail dot com>
2020-04-30If no "xxx.mute" control is found, try "xxx_mute"Alexandre Ratchov
Certain drivers (azalia, uaudio) use a control with the "_mute" suffix to expose the "mute" knob.
2020-04-29tls13_record_layer internal functions to static in libsslKinichiro Inoguchi
We might remove static again for further regress around record layer in the future. ok jsing@ tb@
2020-04-29tls13_handshake internal functions to static in libsslKinichiro Inoguchi
ok jsing@ tb@
2020-04-28Move legacy stack interfacing functions into tls13_legacy.c.Joel Sing
No functional change. ok inoguchi@ tb@
2020-04-28Rename tls13_client_synthetic_handshake_message() and move to tls13_lib.c.Joel Sing
The server-side will need to use the same function. No functional change. ok inoguchi@ tb@
2020-04-27Shuffle some functions around.Joel Sing
Move functions so that they are in the order that the TLSv1.3 messages are processed. While here, also move tls13_client_end_of_early_data_send() from tls13_client.c to tls13_server.c. No functional change. ok beck@ tb@
2020-04-27Disallow the use of zero length IVs in AES-GCM viaTheo Buehler
EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen.
2020-04-26Minimal maintenance to make this mess slightly less confusing:Ingo Schwarze
queue -> list; mention "intrusive"; element -> member at one place; delete a bogus remark that maybe referred to a long-gone implementation in VAX assembly code. Much more could be improved, but i don't want to waste too much time here.
2020-04-26fix the description; from andras farkasJason McIntyre
ok schwarze kill a Tn while here...
2020-04-25A comma is not appropriate here, use a semicolonJeremie Courreges-Anglas
Suggested by Evan Silberman, confirmed by jmc@
2020-04-25Switch to NEGOTIATED when using WITHOUT_HRR.Joel Sing
This ensures that we remain in a valid handshake state in the TLSv1.3 server. Ideally we would not switch to NEGOTIATED until after record protection has been enabled, but we'll revisit this later. Issue noted by inoguchi@ ok tb@
2020-04-25Discourage use of RES_USE_INET6Jeremie Courreges-Anglas
Suggested by eric@, input from deraadt@, ok deraadt@ eric@
2020-04-25Fix RES_USE_INET6 descriptionJeremie Courreges-Anglas
The previous wording implied this option does nothing, which is wrong. This option does affect the way gethostbyname(3) works on OpenBSD (return IPv6 addresses if available). On some systems, it also introduces IPv4-mapped IPv6 addresses, a "feature" that we don't support. ok deraadt@ eric@
2020-04-25Move unsupported, obsolete ciphers and deprecated aliases out ofIngo Schwarze
the main list of words to make it more readable, even though it remains long. Avoid using deprecated aliases in explanations what other words mean. Stop documenting aDSS because it is *both* a deprecated alias *and* no longer matches anything at all. General direction discussed with jsing@ some time ago.
2020-04-25tweak the wording to make it clearer under which conditions exactlyIngo Schwarze
the TLSv1.3 cipher suites are made available, too; related to ssl_ciph.c rev. 1.115
2020-04-25Clairify the point at which unveil first makes restricitons on theBob Beck
filesystem, and remove the BUGS section, as this was fixed by making realpath() a system call. ok ingo@ deraadt@
2020-04-24Remove the deprecation notice for timegm().Ingo Schwarze
The tzcode package marked it dprecated in the late 1980ies but it is universally supported and here to stay. Triggered by a question from Rodrigo <hruodr at gmail dot com> on misc@. William Ahern <william at 25thandclement dot com> listed a number of sound arguments why it shouldn't be considered deprecated, in particular that there is no better alternative, in particular none that is thread-safe. While here, fix the non-standard section name "NOTES", add the missing STANDARDS section and provide additional information in the HISTORY section, based on inspection of C89, C11, POSIX 2008, UNIX v4 and v5 at TUHS, Tahoe and Reno at the CSRG archives, amd the SunOS 3.5 and 4.0 manuals on bitsavers. Reasearch on tzcode and SunOS history done by millert@. OK millert@ on an earlier version of this patch, and deraadt@ agrees with the general direction.
2020-04-23 ce examples of "Ar arg Ar arg" with "Ar arg arg" and stop the spread;Jason McIntyre
2020-04-22Improve TLSv1.3 state machine for HelloRetryRequest handling.Joel Sing
The state machine currently handles the HelloRetryRequest case by using WITH_HRR - in other words, we're explicitly indicating when we transition to the alternate path. The problem here is that we do not know if we're going to receive a ServerHello or a HelloRetryRequest until we process the message. This means that the ServerHello processing code has to handle both types of messages. The state machine and associated processing code becomes cleaner if we flip this around so that we assume we are going to receive a HelloRetryRequest and upon discovering that it is not, trigger WITHOUT_HRR and hand off to the ServerHello processing function. In particular, this makes the logic much more straight forward on the server side, when adding support for HRR. With feedback from tb@ ok tb@
2020-04-21move mixerctl and audioctl man pages to section 8, as these workTheo de Raadt
against root-only device nodes.
2020-04-21Handle TLSv1.3 key shares other than X25519 on the server side.Joel Sing
Previously we would only select an X25519 key share from the client, ignoring any others. Change this so that we will select the first of the key shares that matches one of our supported groups. ok beck@ inoguchi@ tb@
2020-04-21Consolidate TLSv1.3 constants.Joel Sing
Move all of the TLSv1.3 constants to the top of tls13_lib.c. Also mark these all as const so that they end up in .rodata rather than .data. ok tb@
2020-04-21Prevent infinite for loop since i went from ssize_t to size_t. Patch fromDarren Tucker
eagleoflqj via OpenSSH github PR#178, ok djm@, feedback & ok millert@
2020-04-19Provide TLSv1.3 cipher suite aliases to match the names used in RFC 8446.Joel Sing
ok beck@ inoguchi@ tb@
2020-04-19spelling fix;Jason McIntyre
2020-04-19Mention SIO_DEVANY instead of nonexistent SIOCTL_DEVANY constantIngo Feinerer
OK ratchov@
2020-04-18When opening a completely empty file with gzopen(3), treat it as anIngo Schwarze
uncompressed file, such that the first gzread(3) results in Z_STREAM_END rather than in the misleading Z_BUF_ERROR. I checked that none of the many copies of libz in our tree suffer from the same bug, after deraadt@ asked. Bugfix patch from Olivier Taibi <oli at olitb dot net> on bugs@. OK millert@.
2020-04-18Fix wrapping/indentation.Joel Sing
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-17 09:13:58 +0000