summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2020-06-02Remove const modifier in return type of tls13_handshake_active_state()Theo Buehler
which make no sense as pointed out by gcc on sparc64. ok jsing
2020-06-02distracting whitespaceTheo Buehler
2020-06-01Split the handling of post handshake handshake messages into itsTheo Buehler
own recv function. This simplifies tls13_recod_layer_read_internal() greatly and makes the phh handling easier to reason about since the code is no longer glued to the right hand edge of the terminal. ok jsing
2020-06-01Remove expired certificate, ok tb@Stuart Henderson
/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
2020-06-01Send an illegal_parameter alert if a client sends us invalid DH keyTheo Buehler
shares. Previously we would fail and just close the pipe. Fixes the remaining failing test-dhe-rsa-key-exchange-with-bad-messages.py tests of tlsfuzzer. ok beck (earlier version) jsing
2020-06-01Add a mechanism to set an alert in those parts of the read half ofTheo Buehler
the record layer that don't do I/O themselves. Use this mechanism to send a record overflow alert for messages that have overlong plaintext or inner plaintext. Fixes most of the remaining record-layer-limits failures of tlsfuzzer. ok jsing
2020-06-01bump to LibreSSL 3.2.1Brent Cook
2020-05-31Replace ssl_max_server_version() with ssl_downgrade_max_version()Joel Sing
Replace the only occurrence of ssl_max_server_version() with a call to ssl_downgrade_max_version() and remove ssl_max_server_version(). ok beck@ tb@
2020-05-31When building a chain look for non-expired certificates first.Joel Sing
Currently, when building a certificate chain we look up an issuer and if it is the only issuer certificate available we still use it even if it has expired. When X509_V_FLAG_TRUSTED_FIRST is not in use, untrusted certificates are processed first and if one of these happens to be expired it will be used to build the chain, even if there is another non-expired option in the trusted store. Rework this code so that we first look for a non-expired untrusted certificate. If one does not exist then we take a look in the trusted store to see if we would be able to build the chain and only if there is not, do we then look for an expired untrusted certificate. This makes certificate validation possible for various sites that are serving expired AddTrust certificates. Issue reported by Christian Heimes via GitHub. ok beck@ tb@
2020-05-31Correct downgrade sentinels when a version pinned method is in use.Joel Sing
Previously only the enabled protocol versions were considered, however we also have to consider the method in use which may be version pinned. Found the hard way by danj@ with haproxy and force-tlsv12. ok beck@ inoguchi@ tb@
2020-05-31Fix printing long doubles on architectures with hm and lm bits.mortimer
Issue reported with initial patch by enh@google.com. ok deraadt@
2020-05-31Remove an outdated BUGS section.Visa Hankala
OK mpi@ beck@
2020-05-29Add a fix from ncurses 20200523 via Hiltjo Posthuma that preventsNicholas Marriott
ncurses passing strings to tputs() that look like BSD padding when using the rep terminfo(5) capability (with BSD_TPUTS which we and upstream both have enabled). Upstream change: + add a check in EmitRange to guard against repeat_char emitting digits which could be interpreted as BSD-style padding when --enable-bsdpad is configured (report/patch by Hiltjo Posthuma). ok millert
2020-05-29Improve server certificate selection for TLSv1.3.Joel Sing
This allows an EC certificate to be selected and used, if the client sigalgs would allow it. With feedback from tb@ ok inoguchi@ tb@
2020-05-29Handle the case where we receive a valid 0 byte application data record.Joel Sing
In this situation we cannot return zero bytes, as that signals EOF. Rather we need to return TLS13_IO_WANT_POLLIN so tell the caller to call us again, at which point we'll pull up the next record. ok tb@
2020-05-29Wire up the servername callback in the TLSv1.3 server.Joel Sing
This makes SNI work correctly with TLSv1.3. Found the hard way by danj@, gonzalo@ and others. ok beck@ inoguchi@ tb@
2020-05-29Mop up servername_done, which is unused.Joel Sing
ok beck@ inoguchi@ tb@
2020-05-29from edgar pettijohn: correct return type in pcap_open_live.3;Jason McIntyre
ok djm
2020-05-27This patch fixes one bug and one instance of undesirable behaviour.Ingo Schwarze
The bug, present since 4.4BSD, was that a trailing dash in an option group, when the dash is not permitted as an option letter, resulted in the whole option group being returned as an argument, even though the previous option in the group was already parsed as an option: OPTS=abc ./getopt-test -a- -c arg ===>> OPT(a)ARG(-a-)ARG(-c)ARG(arg). Instead, treat the dash as an invalid option and continue parsing options: ===>> OPT(a)ERR(?-)OPT(c)ARG(arg). The undesirable behaviour was that allowing the dash as an option letter only allowed isolated dashes ("-") and trailing dashes in groups ("-a-"), but neither middle dashes in groups ("-a-b"), even though that already partially worked in 4.4BSD, nor leading dashes in groups ("--a"), even though that works on all other BSDs and on glibc. Also, while POSIX does not require that the dash can be used as an option letter at all, arguably, it encourages that letters either be fully supported or not supported at all. It is dubious whether supporting an option letter in some positions but not in others can be considered conforming. This patch makes OpenBSD behaviour identical to FreeBSD and NetBSD, improves compatibility with glibc (except that glibc does not support isolated "-"), improves compatibility with DragonFly (except that DragonFly is buggy when the dash option letter can take an optional argument but that argument is not present), improves compatibility with Illumos and Solaris 11 (except those do not support "-" and mishandle "--a"), and restores 4.4BSD behaviour for "-a-b". In no respect i'm aware of is compatibility with any other systems reduced. For the full rationale, see my mail to tech@ on 30 Mar 2020 14:26:41 +0200. Part of the problem was originally reported by an anonymous coward on tech@ on 12 Mar 2020 03:40:24 +0200, additional analysis was contributed by martijn@, and then the OP sent the final version of the patch i'm now committing on 17 Mar 2020 19:17:56 +0200. No licensing problem here because after the commit, the file does not contain a single word written by the OP. Also, the OP told me in private mail that he intends to publish the patch under the ISC license already contained in the file and that he wishes to be known by the pseudonym "0xef967c36". OK martijn@, and no objection when shown on tech@, but commit delayed to stay clear of the release.
2020-05-27document PKCS7_dataFinal(3);Ingo Schwarze
tweak and OK tb@
2020-05-27add support for pcap_breakloop when reading packets from files.David Gwynne
djm pulled support in for pcap_breakloop on the bpf side of things, this makes it work when reading files too. from Caspar Schutijser lteo@ seems keen ok djm@
2020-05-26minor cleanup ahead of the following work:Ingo Schwarze
remove references to the SSL protocol which is no longer supported and use .Xr rather than .Fn for functions documented elsewhere
2020-05-26Add additional length checks for TLSv1.3 plaintext and inner plaintext.Joel Sing
Reminded by and ok beck@
2020-05-25from edgar pettijohn:Jason McIntyre
fix example to compile without warnings and apply style changes; ok mpi
2020-05-25Add missing .Xr and .Nm, reword and simplify few sentencesAlexandre Ratchov
from schwarze@
2020-05-24Fix some stylistic nits from jsing.Theo Buehler
ok jsing
2020-05-24Clear SSL_MODE_AUTO_RETRY in libtls, since we handle WANT_POLLIN correctly.Joel Sing
2020-05-24Minimally document PKCS7_dataInit(3).Ingo Schwarze
No comment when shown around among LibreSSL devs except "very very strange function" from beck@ and "cannot say much about it" from tb@. If needed, this can be further polished in the tree, review is still welcome.
2020-05-24Briefly mention the obsolete function OPENSSL_init(3).Ingo Schwarze
Suggested by bluhm@, OK beck@ tb@.
2020-05-23Enforce that SNI hostnames be correct as per rfc 6066 and 5980.Bob Beck
Correct SNI alerts to differentiate between illegal parameter and an unknown name. ok tb@`
2020-05-23Enable SSL_MODE_AUTO_RETRY by default.Joel Sing
In TLSv1.2 and earlier, when an application goes to read application data, handshake messages may be received instead, when the peer has triggered renegotation. A similar thing occurs in TLSv1.3 when key updates are triggered or the server sends new session tickets. Due to the SSL_read() API there is no way to indicate that we got no application data, instead after processing the in-band handshake messages it would be normal to return SSL_ERROR_WANT_READ and have the caller call SSL_read() again. However, various applications expect SSL_read() to return with either application data or a fatal error, when used on a blocking socket. These applications do not play well with TLSv1.3 post-handshake handshake messages (PHH), as they fail to handle SSL_ERROR_WANT_READ. The same code is also broken in the case of a TLSv1.2 or older renegotiation, however these are less likely to be encountered. Such code should set SSL_MODE_AUTO_RETRY in order to avoid these issues. Contrary to the naming, SSL_MODE_AUTO_RETRY does not actually retry in every case - it retries following handshake messages in the application data stream (i.e. renegotiation and PHH messages). This works around the unretried SSL_read() on a blocking socket case, however in the case where poll/select is used with blocking sockets, the retry will likely result in the read blocking after the handshake messages are processed. Rather than pushing for broken code to be fixed, OpenSSL decided to enable SSL_MODE_AUTO_RETRY by default, instead breaking code that does poll or select on blocking sockets (like s_client and s_server). Unfortunately we get to follow suit. ok beck@ inoguchi@ tb@
2020-05-23Wire up SSL_MODE_AUTO_RETRY mode to retrying after PHH messages.Joel Sing
ok beck@ inoguchi@ tb@
2020-05-23Provide the option to retry or return after post-handshake messages.Joel Sing
In TLSv1.3 post-handshake handshake messages are used for key updates and session tickets. These are in-band and mean that when the upper layer goes to read application data, we can end up reading and having to process handshake messages - this option changes whether we retry and read the next TLS record, or if we return, signalling that we want more data to be available. ok beck@ inoguchi@ tb@
2020-05-23fix a confusingly wrapped lineTheo Buehler
2020-05-23Do not assume that server_group != 0 or tlsext_supportedgroups != NULLTheo Buehler
implies that we're dealing with a HRR in the extension handling code. Explicitly check that we're in this situation by inspecting the flag in the handshake context. Add missing error checks and send the appropriate alerts. The hrr flag needs to be unset after parsing the client hello retry to avoid breaking the server hello handling. All this is far from ideal, but better than nothing. The correct fix would likely be to make the message type available but that would need to be part of a more extensive rearchitecture of the extension handling. Discussed at length with jsing
2020-05-22Ensure we only attach an ocsp staple to a leaf certificate, becauseBob Beck
for the moment that is all we support. fixes an issue where gnuTLS cares that mistmatching staples come back on the certs in the chain. This should be fixed correctly later by associating the staple to the individual certs rather than the ssl, so this is temporary. running on www@. ok tb@, "got that's oopy but an interim ok" jsing@
2020-05-21Simplify: transform a dangling else into an early return andTheo Buehler
unindent a bunch of code. Suggested by jsing
2020-05-21Make ssl_set_cert_masks() more consistent and closer to readable.Joel Sing
Prompted by tb@ ok tb@
2020-05-21Avoid a shadowing issue by renaming cbs and cbb to cbb_hs and cbb_hs,Theo Buehler
respectively. Discussed with jsing
2020-05-21A failure of tls13_handshake_msg_new() could lead to a NULL derefTheo Buehler
in the following tls13_handshake_msg_start() call. Add a check. Stop clobbering the ctx's hs_msg variable, use a local variable instead. ok beck jsing
2020-05-21Actually set the hrr flag when sending a HelloRetryRequest.Joel Sing
Without this, when SNI is in use the second ClientHello will result in an error. Found the hard way by sthen@. ok sthen@ tb@
2020-05-20Revert 1.43 - this fix for PHH in blocking mode breaks SSL_accept andBob Beck
SSL_connect in blocking mode. While this will probably need a rethink, until we land on a solution for PHH in blocking mode, the breakage this causes is visible in real things, and we've only managed to hit the PHH breakage in a test case. ok tb@
2020-05-20new manual page for PKCS7_set_content(3) and PKCS7_content_new(3);Ingo Schwarze
OK beck@ tb@
2020-05-19Replace SSL_PKEY_RSA_ENC/SSL_PKEY_RSA_SIGN with SSL_PKEY_RSA.Joel Sing
Some time prior to SSLeay 0.8.1b, SSL_PKEY_RSA_SIGN got added with the intention of handling RSA sign only certificates... this incomplete code had the following comment: /* check to see if this is a signing only certificate */ /* EAY EAY EAY EAY */ And while the comment was removed in 2005, the incomplete RSA sign-only handling has remained ever since. Remove SSL_PKEY_RSA_SIGN and rename SSL_PKEY_RSA_ENC to SSL_PKEY_RSA. While here also remove the unused SSL_PKEY_DH_RSA. ok tb@
2020-05-19Disable builtins on ppc in order to prevent the compiler from optimizing inmortimer
calls to libc in the process boot code that might not work before things like the GOT are set up. Suggested by deraadt@ ok visa@
2020-05-19remove information already given in same sentence;Jason McIntyre
ok ratchov
2020-05-19Replace off-topic parts of the desciption by an architecture overviewAlexandre Ratchov
Remove useless (re)wording of what are audio(4) and midi(4), add a quick description of sndiod as intermediate layer. Try to focuse on what the sndio library and sndiod do instead of how they do it. As suggested by schwarze, use the word "device descriptor" instead of "device name" to avoid the common confusion with the device files. ok and tweaks from jmc
2020-05-19Only send ocsp staples if the client asked for ocsp certificate status.Bob Beck
noticed by dlg@ on www.openbsd.org with curl. ok dlg@
2020-05-19Add support for TLS 1.3 server to send certificate statusBob Beck
messages with oscp staples. ok jsing@ tb@
2020-05-18update libelf from elftoolchain r3717 to r3833Jonathan Gray
ok deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-18 03:37:39 +0000