summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2021-02-22Make the ober_get_* set of function to accept a NULL-pointer.Martijn van Duren
This allows us to do ber-type checking inside ober_scanf_elements, which will allow for stricter ASN.1 parsing in the future. Manpage feedback and OK claudio@, jmc@ OK claudio@
2021-02-22Fix bizarre punctuation and capitalization in a comment.Theo Buehler
2021-02-22Simplify version checks in the TLSv1.3 clientTheo Buehler
Ensure that the server announced TLSv1.3 (and nothing higher) in the supported_versions extension. In that case, the legacy_version must be TLSv1.2 according to RFC 8446, 4.1.3 and 4.2.1. This commit also removes some unreachable code which is a remnant of very early TLSv1.3 code from before the legacy fallback was introduced. Simplify a few checks and adjust some comments nearby. ok jsing
2021-02-22Factor out/change some of the legacy client version handling code.Joel Sing
This consolidates the version handling code and will make upcoming changes easier. ok tb@
2021-02-20ugly whitespaceTheo Buehler
2021-02-20Rename f_err into fatal_err.Theo Buehler
discussed with jsing
2021-02-20Rename the truncated label into decode_err. This describes its purposeTheo Buehler
better and doesn't look odd if there's trailing data for exapmle. Indent a few labels in the neighborhood while there. ok jsing
2021-02-20Return a min/max version of zero if set to zero.Joel Sing
OpenSSL's SSL{_CTX,}_get_{min,max}_proto_version() return a version of zero if the minimum or maximum has been set to zero (which means the minimum or maximum version supported by the method). Previously we returned the minimum or maximum version supported by the method, instead of zero. Match OpenSSL's behaviour by using shadow variables. Discussed with tb@
2021-02-20Add DTLSv1.2 methods.Joel Sing
These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
2021-02-20Handle DTLS1_2_VERSION in various places.Joel Sing
ok tb@
2021-02-20Revise HelloVerifyRequest handling for DTLSv1.2.Joel Sing
Per RFC 6347 section 4.2.1, the HelloVerifyRequest should always contain DTLSv1.0 - ensure this is the case on the server side, allow both DTLSv1.0 and DTLSv1.2 on the client. ok tb@
2021-02-20Group HelloVerifyRequest decoding and add missing check for trailing data.Joel Sing
ok tb@
2021-02-20Add various public DTLS related defines.Joel Sing
These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
2021-02-20Clean up/simplify dtls1_get_cipher().Joel Sing
ok tb@
2021-02-18Pull in fix for EVP_CipherUpdate() overflow from OpenSSL.Theo Buehler
ok inoguchi commit 6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 Author: Matt Caswell <matt@openssl.org> Date: Tue Feb 2 17:17:23 2021 +0000 Don't overflow the output length in EVP_CipherUpdate calls CVE-2021-23840 Reviewed-by: Paul Dale <pauli@openssl.org>
2021-02-15Back-out USB data toggle fix for HID devices, since we received multipleMarcus Glocker
reports about broken devices, e.g. for ukbd(4) and fido(4). ok mpi@
2021-02-12Some people still argue that rand(3) and random(3) have suitable deterministicTheo de Raadt
use cases, so explain the situation a bit more. Since the 80's, I estimate around 5 algorithm changes, so any chosen seed is unrepeatable UB. +The deterministic sequence algorithm changed a number of times since +original development, is underspecified, and should not be relied upon to +remain consistent between platforms and over time. ok jmc kettenis
2021-02-12Sync cert.pem with Mozilla NSS root CAs, except "GeoTrust Global CA", ok tb@Stuart Henderson
Notably this update removes various old Symantec roots (GeoTrust, thawte, VeriSign) that were set in NSS to be distrusted on 1/1/2021. Nobody should have been using these for years; only certain subCAs signed by these were valid in NSS in that time due to an exemption: https://wiki.mozilla.org/CA/Additional_Trust_Changes#Symantec Notably Apple's "Apple IST CA 2 - G1" which is still in use for some endpoints (it is cross signed by another CA too but these endpoints are publishing the GeoTrust intermediate cert). So for now I have skipped removal of "GeoTrust Global CA" to avoid affecting these sites. Debian ran into this when they updated their cert database and had to back this part out, affected sites are not reachable on Android Firefox and maybe other newer Firefoxes. Some sites that were affected have moved to a different CA in the last few days but others, notably api.push.apple.com, remain (I can only guess that there is a complicated problem involved, possibly cert pinning on old devices - the clock is ticking though as this expires in May 2022 anyway ;) Additions: /C=RO/O=CERTSIGN SA/OU=certSIGN ROOT CA G2 /C=HU/L=Budapest/O=Microsec Ltd./2.5.4.97=VATHU-23584497/CN=e-Szigno Root CA 2017 /C=KR/O=NAVER BUSINESS PLATFORM Corp./CN=NAVER Global Root Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P256 Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P384 Certification Authority Removals: /C=US/O=GeoTrust Inc./CN=GeoTrust Primary Certification Authority /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA 2 /C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3 /C=TW/O=Government Root Certification Authority /C=LU/O=LuxTrust S.A./CN=LuxTrust Global Root 2 /C=US/O=thawte, Inc./OU=(c) 2007 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G2 /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2007 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G4 /C=CH/O=WISeKey/OU=Copyright (c) 2005/OU=OISTE Foundation Endorsed/CN=OISTE WISeKey Global Root GA CA
2021-02-11KNFTheo Buehler
2021-02-08correct return type for compressBound();Jason McIntyre
from pedro martelletto
2021-02-08Remove bogus DTLS checks to disable ECC and OCSP.Joel Sing
ECC and OCSP can be used with DTLS, so remove bogus checks that currently prevent it. These are long lasting remnants from the original OpenSSL code. ok tb@
2021-02-08Enforce read ahead with DTLS.Joel Sing
DTLS is largely broken/useless without read ahead being enabled, so enforce it for DTLS. This behaviour matches both our documentation and OpenSSL. ok tb@
2021-02-08Use dtls1_retrieve_buffered_record() to load buffered application data.Joel Sing
Replace the current copy of dtls1_retrieve_buffered_record() with a call to it instead. ok tb@
2021-02-08Revert the convertion of per-process thread into a SMR_TAILQ.Martin Pieuchot
We did not reach a consensus about using SMR to unlock single_thread_set() so there's no point in keeping this change.
2021-02-07Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md().Joel Sing
The mess that is ssl_get_algorithm2() only exists to upgrade the handshake MAC of a pre-TLSv1.2 cipher suite to SHA256 when used with TLSv1.2. We can readily do this in ssl_get_handshake_evp_md(), which is far more readable. ok tb@
2021-02-07Correct handshake MAC/PRF for various TLSv1.2 cipher suites.Joel Sing
For some reason various TLSv1.2 cipher suites were added with the default handshake MAC and PRF, rather than the SHA256 handshake MAC and PRF. This gets patched up in ssl3_get_algorithm2(), hence goes unnoticed. ok tb@
2021-02-07Factor out the legacy stack version checks.Joel Sing
Also check for explicit version numbers, rather than just the major version value. ok tb@
2021-02-05Remove the terrible_ping_kludge() workaround. We have committed a fix toMarcus Glocker
the USB stack in the meantime for uhidev(4) and ugen(4) to resolve the data toggle issue in relation to xhci(4). ok gnezdo@, djm@
2021-02-04Referece trpt(8) from the SO_DEBUG section of getsockopt(2).Alexander Bluhm
OK claudio@ visa@
2021-02-03Fail early in legacy exporter if master secret is not availableTheo Buehler
The exporter depends on having a master secret. If the handshake is not completed, it is neither guaranteed that a shared ciphersuite was selected (in which case tls1_PRF() will currently NULL deref) or that a master secret was set up (in which case the exporter will succeed with a predictable value). Neither outcome is desirable, so error out early instead of entering the sausage factory unprepared. This aligns the legacy exporter with the TLSv1.3 exporter in that regard. with/ok jsing
2021-02-03Adding a hard-trap instruction after the __threxit syscall instructionKurt Miller
broke pthreads on hppa. Reverting. Ok deraadt@
2021-02-03Add OID for draft-ietf-opsawg-finding-geofeedsjob
https://tools.ietf.org/html/draft-ietf-opsawg-finding-geofeeds describes a mechanism to authenticate RFC 8805 Geofeed data files through the RPKI. OpenSSL counterpart https://github.com/openssl/openssl/pull/14050 OK tb@ jsing@
2021-02-02Add a bunch of RPKI OIDsjob
RFC6482 - A Profile for Route Origin Authorizations (ROAs) RFC6484 - Certificate Policy (CP) for the RPKI RFC6493 - The RPKI Ghostbusters Record RFC8182 - The RPKI Repository Delta Protocol (RRDP) RFC8360 - RPKI Validation Reconsidered draft-ietf-sidrops-rpki-rta - A profile for RTAs Also in OpenSSL: https://github.com/openssl/openssl/commit/d3372c2f35495d0c61ab09daf7fba3ecbbb595aa OK sthen@ tb@ jsing@
2021-02-02article fixes; from eddie yousephJason McIntyre
2021-02-01Use "EC/RSA key setup failure" to align error with othersTheo Buehler
ok eric jsing
2021-01-30missing word in commentTheo Buehler
2021-01-28Add '$' to ober_scanf_elements().Martijn van Duren
This allows us to enforce end of sequence/set without having to manually check be_next for NULL. No lib bump needed according to millert@ OK millert@ rob@
2021-01-28Remove direct assignment of aead_ctx.Joel Sing
Now that AEAD is handled internally, we should no longer be assigning aead_ctx directly, as this will result in a leak. Missed during the previous change.
2021-01-28Move AEAD handling into the new TLSv1.2 record layer.Joel Sing
ok tb@
2021-01-27Link SSL_get_finished.3 to build.Theo Buehler
2021-01-27Write SSL_get_finished() documentation from scratch.Theo Buehler
ok beck
2021-01-27Merge SSL_set_hostflags documentation from OpenSSL 1.1.1i andTheo Buehler
add HISTORY section. This is currently ignored input next to SSL_get0_peername() and will be unignored once the symbols are made publicly visible in libssl.
2021-01-26Rewrap a comment line to fit into 80 columns.Theo Buehler
2021-01-26zap a tabTheo Buehler
2021-01-26Prepare to provide SSL_set_hostflags()Theo Buehler
Yet another one of these X509_VERIFY_PARAM reacharounds into libcrypto. Recently found in imapfilter, also used elsewhere. Will be made publicly visible with the next minor bump. ok jsing
2021-01-26Move sequence numbers into the new TLSv1.2 record layer.Joel Sing
This allows for all of the DTLS sequence number save/restore code to be removed. ok inoguchi@ "whee!" tb@
2021-01-26Move private key setup to a helper function with proper errorEric Faurot
checking. Only install the hash on the key if fake key is used, and do it for EC keys too. ok tb@ jsing@
2021-01-26When checking for available address family for AI_ADDRCONFIG considerFlorian Obser
the routing domain we are currently in. Otherwise we might end up with address families that are not available in the current rdomain but in others since getifaddrs(3) gives us all interface addresses in the system. Clue-bat & OK claudio, input & OK eric, OK kn
2021-01-22Gracefully handle any erroneous closing bracket/brace trailers inrob
ober_scanf_elements(). OK martijn@
2021-01-22Valid integer and enumerated types always have non-zero length. Performrob
check to ensure we avoid a possible (undefined) negative shift. Found with clang static analyzer. Tweaked and OK martijn@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 01:03:39 +0000