summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2021-03-25Avoid mangled output in BIO_debug_callbackTheo Buehler
Instead of blindly skipping 14 characters, we can use the return value of snprintf() to determine how much we should skip. From Martin Vahlensieck with minor tweaks by me
2021-03-24Rename new_cipher to cipher.Joel Sing
This is in the SSL_HANDSHAKE struct and is what we're currently negotiating, so there is really nothing more "new" about the cipher than there is the key block or other parts of the handshake data. ok inoguchi@ tb@
2021-03-24Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data.Joel Sing
Move TLSv1.2 specific components over from SSL_HANDSHAKE. ok inoguchi@ tb@
2021-03-23OCSP_basic_verify() doesn't set errno, so use tls_set_errorx()Theo Buehler
ok inoguchi
2021-03-21Fully initialize rrec in tls12_record_layer_open_record_protectedTheo Buehler
The CBC code path initializes rrec.padding_length in an indirect fashion and later makes use of it for copying the MAC. This is confusing some static analyzers as well as people investigating the whining. Avoid this confusion and add a bit of robustness by clearing the stack variable up front. ok jsing
2021-03-21Move the TLSv1.3 handshake struct inside the shared handshake struct.Joel Sing
There are currently three different handshake structs that are in use - the SSL_HANDSHAKE struct (as S3I(s)->hs), the SSL_HANDSHAKE_TLS13 struct (as S3I(s)->hs_tls13 or ctx->hs in the TLSv1.3 code) and the infamous 'tmp' embedded in SSL3_STATE_INTERNAL (as S3I(s)->tmp)). This is the first step towards cleaning up the handshake structs so that shared data is in the SSL_HANDSHAKE struct, with sub-structs for TLSv1.2 and TLSv1.3 specific information. Place SSL_HANDSHAKE_TLS13 inside SSL_HANDSHAKE and change ctx->hs to refer to the SSL_HANDSHAKE struct instead of the SSL_HANDSHAKE_TLS13 struct. This allows the TLSv1.3 code to access the shared handshake data without needing the SSL struct. ok inoguchi@ tb@
2021-03-21Split TLSv1.3 record protection from record layer.Joel Sing
This makes the TLSv1.2 and TLSv1.3 record layers more consistent and while it is not currently necessary from a functionality perspective, it makes for more readable and simpler code. ok inoguchi@ tb@
2021-03-21Avoid a use-after-scope in tls13_cert_add().Joel Sing
A parent CBB retains a reference to a child CBB until CBB_flush() or CBB_cleanup() is called. As such, the cert_exts CBB must be at function scope. Reported by Ilya Shipitsin. ok tb@
2021-03-19Prepare documenting SSL_use_certificate_chain_fileTheo Buehler
2021-03-19Undo previous. As pointed out by jsing I clearly wasn't fully awake...Theo Buehler
2021-03-19Prepare to provide SSL_use_certificate_chain_file()Theo Buehler
This is the same as SSL_CTX_use_certificate_chain_file() but for an SSL object instead of an SSL_CTX object. remi found this in a recent librelp update, so we need to provide it. The function will be exposed in an upcoming library bump. ok inoguchi on an earlier version, input/ok jsing
2021-03-19Fix copy-paste error in previousTheo Buehler
Found the hard way by lists y42 org via an OCSP validation failure that in turn caused pkg_add over TLS to fail. Detailed report by sthen. ok sthen
2021-03-18Type-cast getpagesize() from int to size_t for the comparison with d.Claudio Jeker
getpagesize() will only return positive numbers (there is no negative page size system) and it can not fail. Should fix some compiler warnings seen in -portable projects. OK otto@
2021-03-17fix whitespace nit in previousTheo Buehler
2021-03-17Enable DTLSv1.2.Joel Sing
This means that the DTLS_method() will now use DTLSv1.2 rather than DTLSv1. Additional DTLSv1.2 related symbols and defines will be made publicly visible in the near future. ok inoguchi@ tb@
2021-03-17Add support for DTLSv1.2 version handling.Joel Sing
This teaches the version functions that handle protocol versions about DTLSv1.2 and the SSL_OP_NO_DTLS* options. We effectively convert between TLS and TLS protocol versions where necessary. ok inoguchi@ tb@
2021-03-13Use EXFLAG_INVALID to handle out of memory and parse errors intobhe
x509v3_cache_extensions(). ok tb@
2021-03-12Zap a useless variable.Theo Buehler
suggested by jsing
2021-03-12Missing void in function definitionTheo Buehler
ok jsing
2021-03-12Fix checks of memory caps of constraints namesTheo Buehler
x509_internal.h defines caps on the number of name constraints and other names (such as subjectAltNames) that we want to allocate per cert chain. These limits are checked too late. In a particularly silly cert that jan found on ugos.ugm.ac.id 443, we ended up allocating six times 2048 x509_constraint_name structures before deciding that these are more than 512. Fix this by adding a names_max member to x509_constraints_names which is set on allocation against which each addition of a name is checked. cluebat/ok jsing ok inoguchi on earlier version
2021-03-12fix previousJonathan Gray
2021-03-12spelling: refenece -> referenceJason McIntyre
2021-03-12spellingJonathan Gray
2021-03-11Remove ssl_downgrade_max_version().Joel Sing
Now that we store our maximum TLS version at the start of the handshake, we can check against that directly. ok inoguchi@ tb@
2021-03-11that 0 should be NULLTheo de Raadt
2021-03-10Don't return ERR if resize didn't change sizeTodd C. Miller
This is a backport of the ncurses 5.9 20120707 patch. Previously, getch() would return ERR if SIGWINCH was received but the window didn't actually change size. This can happen, for example, when the xterm font is changed. OK tb@
2021-03-10Guard TLS1_get_{client_,}version() macros with #ifndef LIBRESSL_INTERNAL.Joel Sing
These are no longer used (and should not be used) internally.
2021-03-10Improve internal version handling.Joel Sing
Add handshake fields for our minimum TLS version, our maximum TLS version and the TLS version negotiated during the handshake. Initialise our min/max versions at the start of the handshake and leave these unchanged. The negotiated TLS version is set in the client once we receive the ServerHello and in the server at the point we select the highest shared version. Provide an ssl_effective_version() function that returns the negotiated TLS version if known, otherwise our maximum TLS version - this is effectively what is stored in s->version currently. Convert most of the internal code to use one of these three version fields, which greatly simplifies code (especially in the TLS extension handling code). ok tb@
2021-03-09Early daemons like dhcpleased(8), slaacd(8), unwind(8), resolvd(8)Alexander Bluhm
are started before syslogd(8). This resulted in ugly sendsyslog(2) dropped logs and the real message was lost. Create a temporary stash for log messages within the kernel. It has a limited size of 100 messages, and each message is truncated to 8192 bytes. When the stash is exhausted, the well-known dropped message is generated with a counter. After syslogd(8) has setup everything, it sends a debug line through libc to flush the kernel stash. Then syslogd receives all messages from the kernel before the usual logs. OK deraadt@ visa@
2021-03-09Change the implementation of the malloc cache to keep lists ofOtto Moerbeek
regions of a given size. In snaps for a while, committing since no issues were reported and a wider audience is good. ok deraadt@
2021-03-07LibreSSL 3.3.2Brent Cook
2021-03-05Stop abusing display blocks under the authors section in order toanton
respect literal line breaks. This has the unwanted side effect of rendering the authors section using a monospace font over at man.openbsd.org. Instead use br macros to force line breaks. With help from and ok jmc@
2021-03-03s/byte/characterMartijn van Duren
Discussed with claudio@ Feedback jmc@
2021-03-02document ENOTSUP wxallowed/wxneeded behaviour more clearly; ok kurtTheo de Raadt
2021-03-02Separate variable declaration and assignment.Joel Sing
Requested by tb@
2021-03-02Replace two handrolled tls12_record_protection_engaged().Joel Sing
Noted by tb@
2021-03-02Move key/IV length checks closer to usage sites.Joel Sing
Also add explicit checks against EVP_CIPHER_iv_length() and EVP_CIPHER_key_length(). Requested by tb@ during review. ok tb@
2021-03-02Add tls12_record_protection_unused() and call from CCS functions.Joel Sing
This moves the check closer to where a leak could occur and checks all pointers in the struct. Suggested by tb@ during review. ok tb@
2021-03-02Fix misleading indentation in SSL_get_error()Theo Buehler
2021-02-27Move handling of cipher/hash based cipher suites into the new record layer.Joel Sing
ok tb@
2021-02-27Identify DTLS based on the version major value.Joel Sing
This avoids the need to match specific DTLS version numbers.
2021-02-26Set is_trusted in x509_verify_ctx_add_chain()Theo Buehler
If we're about to add a chain we have a trust path, so we have at least one trusted certificate. This fixes a thinko from r1.31 and fixes the openssl(1) cms verify test. ok jsing (who had the same diff)
2021-02-25Fix two bugs in the legacy verifierTheo Buehler
To integrate the new X.509 verifier, X509_verify_cert() was refactored. The code building chains in the legacy verifier was split into a separate function. The first bug is that its return value was treated as a Boolean although it wasn't. Second, the return alone is not enough to decide whether to carry on the validation or not. Slightly rearrange things to restore the behavior of the legacy verifier prior to this refactoring. Issue found and test case provided by Anton Borowka and jan. ok jan jsing
2021-02-25Only use TLS versions internally (rather than both TLS and DTLS versions).Joel Sing
DTLS protocol version numbers are the 1's compliment of human readable TLS version numbers, which means that newer versions decrease in value and there is no direct mapping between TLS protocol version numbers and DTLS protocol version numbers. Rather than having to deal with this internally, only use TLS versions internally and map between DTLS and TLS protocol versions when necessary. Rename functions and variables to use 'tls_version' when they contain a TLS version (and never a DTLS version). ok tb@
2021-02-25Rename depth to num_untrusted so it identifies what it actually represents.Joel Sing
ok tb@
2021-02-25Avoid passing last and depth to x509_verify_cert_error() on ENOMEM.Joel Sing
In x509_verify_ctx_set_xsc_chain(), an ENOMEM case is currently passing the last certificate and depth (which is no longer actually depth) to x509_verify_cert_error(). Given we've hit an ENOMEM situation, neither of these are useful so remove both. ok tb@
2021-02-25- Make use of the fact that we know how the chunks are aligned, andOtto Moerbeek
write 8 bytes at the time by using a uint64_t pointer. For an allocation a max of 4 such uint64_t's are written spread over the allocation. For pages sized and larger, the first page is junked in such a way. - Delayed free of a small chunk checks the corresponiding way. - Pages ending up in the cache are validated upon unmapping or re-use. In snaps for a while
2021-02-24Fix comment explaining last_untrusted. This should really be calledTheo Buehler
num_untrusted, but unfortunately it's public... ok jsing tobhe
2021-02-24Make the new validator check for EXFLAG_CRITICALTheo Buehler
As should be obvious from the name and the comment in x509_vfy.h int last_untrusted; /* index of last untrusted cert */ last_untrusted actually counts the number of untrusted certs at the bottom of the chain. Unfortunately, an earlier fix introducing x509_verify_set_xsc_chain() assumed that last_untrusted actually meant the index of the last untrusted cert in the chain, resulting in an off-by-one, which in turn led to x509_vfy_check_chain_extension() skipping the check for the EXFLAG_CRITICAL flag. A second bug in x509_verify_set_xsc_chain() assumed that it is always called with a trusted root, which is not necessarily the case anymore. Address this with a temporary fix which will have to be revisited once we will allow chains with more than one trusted cert. Reported with a test case by tobhe. ok jsing tobhe
2021-02-22Make the ober_get_* set of function to accept a NULL-pointer.Martijn van Duren
This allows us to do ber-type checking inside ober_scanf_elements, which will allow for stricter ASN.1 parsing in the future. Manpage feedback and OK claudio@, jmc@ OK claudio@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 17:34:52 +0000