summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2020-02-23The decryption_failed alert must not be sent by compliant implementations.Theo Buehler
Use a bad_record_mac alert instead. Found with tlsfuzzer's ChaCha20 test. ok beck inoguchi jsing
2020-02-23According to RFC 8446, Section 4.4.4, recipients of incorrect FinishedTheo Buehler
messages must terminate the connection with a decrypt_error alert, so replace the use of the deprecated decryption_failed alert accordingly. ok beck inoguchi jsing
2020-02-21Remove the s2n macro now that it is finally unused.Joel Sing
ok inoguchi@ tb@
2020-02-21Convert the SSL/TLS record creation code to CBB.Joel Sing
ok inoguchi@ tb@
2020-02-21Convert the DTLS header creation code to CBB.Joel Sing
Also consolidate it into the one place, since there is no reason to write the epoch and sequence out later. ok inoguchi@ tb@
2020-02-21Remove some commented code, remove some pointless comments and move someJoel Sing
comments to their correct places. ok inoguchi@ tb@
2020-02-21Convert dtls1_build_sequence_number() to CBB.Joel Sing
ok inoguchi@ tb@
2020-02-21Move l2n/l2n8 into s3_cbc.c, since this is the only code that uses it.Joel Sing
ok inoguchi@ tb@
2020-02-21Remove prefix_len, since it is always zero.Joel Sing
ok inoguchi@ tb@
2020-02-21Remove now unused variable.Joel Sing
ok inoguchi@ tb@
2020-02-19Refactor do_ssl3_write().Joel Sing
When empty fragments were added as a countermeasure against chosen plaintext attacks on CBC, it was done by adding a recursive call to do_ssl3_write(). This makes the code more complex and difficult to change. Split the record creation code into a separate ssl3_create_record() function, which do_ssl3_write() calls. In the case where an empty fragment is needed, ssl3_create_record() is simply called twice, removing the need for recursion. ok inoguchi@ tb@
2020-02-18drop unused include <openssl/curve25519.h>Theo Buehler
ok inoguchi jsing
2020-02-18Now that the kernel skips the two instructions immediately followingMark Kettenis
a syscall, replace the double nop with a dsb nsh; isb; sequence which stops the CPU from speculating any further. This fix was suggested by Anthony Steinhauser. ok deraadt@
2020-02-17Describe the restriction for length of openssl conf value stringKinichiro Inoguchi
ok and suggestion jmc@
2020-02-17Restrict the length of openssl conf value stringKinichiro Inoguchi
There was no limitation for the length of openssl conf value. This brings possibility of out-of-memory problem as oss-fuzz had detected. This diff restricts the length of conf value up to 64k. ok jsing@
2020-02-16Avoid potential NULL dereference when parsing a server keyshare extension.Joel Sing
It is currently possible for key_share to be NULL when a TLS client receives a keyshare extension. However, for this to occur the client has to be doing TLS 1.2 or earlier, which means that it was invalid for the server to send the extension. As such, check for NULL and treat it as an invalid extension. Found by oss-fuzz (#20741 and #20745). ok inoguchi@ tb@
2020-02-16Avoid leak for tmp.x25519Kinichiro Inoguchi
Changed to use local variable to hold malloc address rather than directly set to S3I(s)->tmp.x25519, and set that private_key pointer to S3I(s)->tmp.x25519 after all the "goto err;". Also added freezero for S3I(s)->tmp.x25519 to ssl3_free() and ssl3_clear(). ok jsing@ tb@
2020-02-15Move the TLSv1.3 code that interfaces with the legacy APIs/stack into aJoel Sing
separate file. Discussed with beck@ and tb@
2020-02-15Remove #include that is not needed.Joel Sing
2020-02-11Some system calls can fail due to an open-ended variety of causesIngo Schwarze
in many underlying subsystems and device drivers. guenther@ pointed out this applies to system calls taking a file descriptor as an argument. deraadt@ warned against attempting to be excessively precise and against spreading fear, uncertainty, and doubt. So apply a minimal patch that merely avoids the misleading wording "will succeed unless", given that the lists aren't really exhaustive, and simply uses a more usual wording. Unfortunate wording reported by <David dot Raymond at nmt dot edu>.
2020-02-09A getlogin() function which used utmp(5) appeared in v7.Jonathan Gray
This was replaced by a getlogin() system call which Ingo discovered we incorrectly list as being 4.2BSD when it was introduced in 4.3BSD Reno. ok schwarze@
2020-02-08correct Research Unix edition "appeared in" use in HISTORYJonathan Gray
Starting from "Combined Table of Contents" in Doug McIlroy's "A Research UNIX Reader" a table of which edition manuals appeared in. Checked against manuals from bitsavers/TUHS and source from TUHS where available. Ingo points out there are cases where something is included but not documented until a later release. bcd(6) v6 v7 printf(3) v2 v4 abort(3) v5 v6 system(3) v6 v7 fmod(3) v5 v6 ok schwarze@
2020-02-07It appears we have come full-circle, where source code starts to useTheo de Raadt
clang / "super new gcc" ism's, in particular ones which are totally pointless as far as language goes. Delete them.
2020-02-07update to upstream libfido2 780ad3c25 (20120123)Damien Miller
install manual pages crank major feedback & ok jmc@ and naddy@
2020-02-06Re-enable the TLSv1.3 client since the known issues have been addressed.Joel Sing
ok tb@
2020-02-06Add a workaround to make SSL_set_session() work with TLSv1.3.Joel Sing
While we do not currently do session resumption, just return the TLS_client_method() or TLS_server_method() when asked for a method that does TLSv1.3. ok tb@ (who also arrived at the same diff)
2020-02-06Add support for handling hello retry requests in the TLSv1.3 client.Joel Sing
In the case of a hello retry request, we need to replace the client hello with a synthetic handshake message, switch key share to that selected by the server, build and send a new client hello, then process the resulting server hello. ok tb@
2020-02-06Correctly handle key share extensions in a hello retry request.Joel Sing
In a hello retry request the server will only send the selected group and not actually provide a key exchange. In this case we need to store the server selected group for further processing. ok tb@
2020-02-06Instead of opting in to futexes on archs with atomics opt out on archsJonathan Gray
without atomics, a smaller list. ok mpi@ visa@
2020-02-05Refactor the server hello processing code in the TLSv1.3 client.Joel Sing
Use flags to signal the need to switch to the legacy client and to identify a hello retry request. This allows the caller to take appropriate action, rather than trying to do this in the parsing/processing code. Split the key deriviation and record protection engagement code into a separate function, both for readability and reuse. Change handshake states outside of the processing code. ok tb@
2020-02-05Remove the hello retry request processing code that was previously added.Joel Sing
This got added to the wrong functions (server side, not client) - swap the now unimplemented send/recv functions between client and server. ok tb@
2020-02-05Provide tls1_transcript_unfreeze() to avoid the need for manual flagsJoel Sing
mangling. ok tb@
2020-02-05Pull the handshake message transcript code into its own function.Joel Sing
This is soon going to be used in the TLSv1.3 client code. ok tb@
2020-02-05More precision regarding the openlog(3) *ident argument;Ingo Schwarze
direction suggested by Laurence Tratt <laurie at tratt dot net>, part of the wording from deraadt@. While here, add the missing STANDARDS section, correct HISTORY, drop redundant verbiage from RETURN VALUES, and garbage collect .Tn. OK sthen@ jmc@ millert@ and Laurence Tratt, and deraadt@ likes one line of the patch in particular.
2020-02-05Mention AUDIO_MIXER_{DEVINFO,READ,WRITE} in the "audio" sectionAlexandre Ratchov
2020-02-05Rework tls13_legacy_handshake_message_{recv,sent}_cb() to useTheo Buehler
their own CBS as a preparation for upcoming HRR diffs. ok jsing
2020-02-04Add support for TLSv1.3 key shares with secp256r1 and secp384r1 groups.Joel Sing
ok inoguchi@ tb@
2020-02-04Free the transcript as soon as we initialise the transcript hash.Joel Sing
Unlike TLSv1.2 there is only a single hash in use, hence as soon as we know what the hash is and have initialised the transcript hash, we can free the transcript buffers. ok inoguchi@ tb@
2020-02-01Correctly unpack client key shares.Joel Sing
Even if we're not processing/using the peer public key from the key share, we still need to unpack it in order to parse the TLS extension correctly. Resolves issues with TLSv1.3 clients talking to TLSv1.2 server. ok tb@
2020-02-01Disable TLSv1.3 client while some known issues are being addressed.Joel Sing
2020-01-30Provide struct/functions for handling TLSv1.3 key shares.Joel Sing
Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@
2020-01-30Factor out/rewrite the ECDHE EC point key exchange code.Joel Sing
This reduces replication between the existing TLS client/server and allows the code to soon be reused for TLSv1.3. With feedback from inoguchi@ and tb@ ok inoguchi@ tb@
2020-01-29Remove dead prototypes.Joel Sing
2020-01-29If the TLSv1.3 code has not recorded an error and something already existsJoel Sing
on the error stack, refrain from pushing an 'unknown' error on the stack. This should allow libcrypto errors (including bio) to be visible, where we have nothing better to offer. ok tb@
2020-01-29Remove unused stub implementation of tls13_accept(). The correctTheo Buehler
and used version is in tls13_server.c. ok inoguchi jsing
2020-01-26Fix SSL_CIPHER_descriptionKinichiro Inoguchi
ok jsing@
2020-01-26Avoid 32 bit right shift with unsigned int in crypto/cast/cast_lcl.hKinichiro Inoguchi
ok tb@
2020-01-26tweak previous; ok tbJason McIntyre
2020-01-26typoTheo Buehler
2020-01-26Document the change in EVP_chacha20(3).Theo Buehler
Discussed with jsing
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 20:51:06 +0000