summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2020-08-31Send alert on ssl_get_prev_session failureTheo Buehler
ssl_get_prev_session() can fail for various reasons some of which may be internal_error others decode_error alerts. Propagate the appropriate alert up to the caller so we can abort the handshake by sending a fatal alert instead of rudely closing the pipe. Currently only 28 of 292 test cases of tlsfuzzer's test-extension.py pass. With this diff, 272 pass. The rest will require fixes elsewhere. ok beck inoguchi jsing
2020-08-30Remove duplicate definition of _null_auth.mortimer
ok millert@ deraadt@
2020-08-30Start replacing the existing TLSv1.2 record layer.Joel Sing
This takes the same design/approach used in TLSv1.3 and provides an opaque struct that is self contained and cannot reach back into other layers. For now this just implements/replaces the writing of records for DTLSv1/TLSv1.0/TLSv1.1/TLSv1.2. In doing so we stop copying the plaintext into the same buffer that is used to transmit to the wire. ok inoguchi@ tb@
2020-08-29define OPENSSL_NO_SSL_TRACE in opensslfeatures.hKinichiro Inoguchi
ok jsing@ tb@
2020-08-23amd64: TSC timecounter: prefix RDTSC with LFENCEcheloha
Regarding RDTSC, the Intel ISA reference says (Vol 2B. 4-545): > The RDTSC instruction is not a serializing instruction. > > It does not necessarily wait until all previous instructions > have been executed before reading the counter. > > Similarly, subsequent instructions may begin execution before the > read operation is performed. > > If software requires RDTSC to be executed only after all previous > instructions have completed locally, it can either use RDTSCP (if > the processor supports that instruction) or execute the sequence > LFENCE;RDTSC. To mitigate this problem, Linux and DragonFly use LFENCE. FreeBSD and NetBSD take a more complex route: they selectively use MFENCE, LFENCE, or CPUID depending on whether the CPU is AMD, Intel, VIA or something else. Let's start with just LFENCE. We only use the TSC as a timecounter on SSE2 systems so there is no need to conditionally compile the LFENCE. We can explore conditionally using MFENCE later. Microbenchmarking on my machine (Core i7-8650) suggests a penalty of about 7-10% over a "naked" RDTSC. This is acceptable. It's a bit of a moot point though: the alternative is a considerably weaker monotonicity guarantee when comparing timestamps between threads, which is not acceptable. It's worth noting that kernel timecounting is not *exactly* like userspace timecounting. However, they are similar enough that we can use userspace benchmarks to make conjectures about possible impacts on kernel performance. Concerns about kernel performance, in particular the network stack, were the blocking issue for this patch. Regarding networking performance, claudio@ says a 10% slower nanotime(9) or nanouptime(9) is acceptable and that shaving off "tens of cycles" is a micro-optimization. There are bigger optimizations to chase down before such a difference would matter. There is additional work to be done here. We could experiment with conditionally using MFENCE. Also, the userspace TSC timecounter doesn't have access to the adjustment skews available to the kernel timecounter. pirofti@ has suggested a scheme involving RDTSCP and an array of skews mapped into user memory. deraadt@ has suggested a scheme where the skew would be kept in the TCB. However it is done, access to the skews will improve monotonicity, which remains a problem with the TSC. First proposed by kettenis@ and pirofti@. With input from pirofti@, deraadt@, guenther@, naddy@, kettenis@, and claudio@. Based on similar changes in Linux, FreeBSD, NetBSD, and DragonFlyBSD. ok deraadt@ pirofti@ kettenis@ naddy@ claudio@
2020-08-23check errno against EINTR; not return value from poll()Damien Miller
spotted by Pedro Martelletto
2020-08-23update to libfido2 46710ac06, picking up a few API changesDamien Miller
ok tb@ deraadt@ NB. major crank
2020-08-17Fix append mode so it always writes to the end and expand regress.Todd C. Miller
OK deraadt@ martijn@
2020-08-14Fix handling of "w+" mode, we were only truncating for "w".Todd C. Miller
OK martijn@ mpi@
2020-08-13select.2: Xr directly to timersub(3) now that it has a dedicated manpagecheloha
Reported by Fabian Raetz <fabian.raetz@gmail.com>.
2020-08-11Send an unexpected message alert if no valid content type is found.Joel Sing
When record protection is engaged, the plaintext must be followed by a non-zero content type and optional zero padding. If the plaintext is zero length or only consists of zero bytes then it is not a valid message, since the content type is unspecified. ok tb@
2020-08-11Increment the epoch in the same place for both read and write.Joel Sing
ok inoguchi@ tb@
2020-08-11Use 0 instead of 0x00 for memset() calls.Joel Sing
ok inoguchi@ tb@
2020-08-11Use SSL3_SEQUENCE_SIZE for last_write_sequence[] rather than hardcoding.Joel Sing
ok inoguchi@ tb@
2020-08-11In SSL_new() just 'goto err' on allocation failure.Joel Sing
The error path does the same as the currently duplicated code. ok inoguchi@ tb@
2020-08-11sync with upstream libfido2 rev 2fa20b889, picking up ~7 monthsDamien Miller
of fixes and a few new APIs that we'd like to use in OpenSSH ok deraadt@
2020-08-10Tedu compiler-rt 8.0.1.Patrick Wildt
2020-08-10Un-hook and re-hook libcompiler_rt.Patrick Wildt
ok kettenis@
2020-08-10Avoid passing -1 to freezero.Theo Buehler
If a peer sends a bogus record consisting of all-zero plaintext, the content_len would be decremented to -1 and cause a crash in freezero. ok inoguchi jsing
2020-08-09Fix some wrapping/indent.Joel Sing
2020-08-09Add P-521 to the list of curves supported by default in the client.Joel Sing
A certain VPN provider appears to have configured their servers to only accept P-521 for TLSv1.3 key exchange. The particular VPN software in use also does not currently allow for the TLSv1.3 key share groups to be configured, which means that there is no way to easily use LibreSSL in this situation. Include P-521 in the list of curves that are supported by default in the client, in order to increase interoperability. Discussed at length with beck@, inoguchi@ and tb@. ok tb@
2020-08-09Use CBB more correctly when writing SSL3/DTLS records.Joel Sing
Previously we used CBB to build the record headers, but not the entire record. Use CBB_init_fixed() upfront, then build the record header and add space for the record content. However, in order to do this we need to determine the length of the record upfront. This simplifies the code, removes a number of manual bounds checks and makes way for further improvements. ok inoguchi@ tb@
2020-08-09Make the explicit IV length handling in DTLS the same as SSL3/TLS.Joel Sing
ok inoguchi@ tb@
2020-08-06delete another word to improve the wording; suggested by jmc@Ingo Schwarze
2020-08-06Explain the purpose of CMAC_resume(3) in more detail.Ingo Schwarze
Triggered by jmc@ apparently misunderstanding the intention of the text and fixing a grammatical error in a way that wasn't ideal, so i guess he wouldn't have been the only one to find the previous version hard to understand. OK jmc@
2020-08-04Cleanup aead_ctxKinichiro Inoguchi
ok jsing@ tb@
2020-08-04We have `pipexinq' and `pipexoutq' mbuf(9) queues to store pipex(4)mvs
related mbufs. Each mbuf(9) passed to these queues stores the pointer to corresponding pipex(4) session referenced as `m_pkthdr.ph_cookie'. When session was destroyed its reference can still be in these queues so we have use after free issue while pipexintr() dereference it. I removed `pipexinq', `pipexoutq' and pipexintr(). This not only allows us to avoid issue described above, but also removes unnecessary context switch in packet processing. Also it makes code simpler. ok mpi@ yasuoka@
2020-08-03Only parse a client's status_request in the CHTheo Buehler
A client should only send a status_request as part of the CH. Pointed out by Michael Forney ok inoguchi jsing
2020-08-03Ensure clients only send a status_request in the CHTheo Buehler
The current code might cause a client to send a status_request containing a CertificateStatusRequest with its certificate. This makes no sense. Pointed out by Michael Forney ok inoguchi jsing
2020-08-03Correctly handle server requests for an OCSP responseTheo Buehler
According to RFC 8446, 4.4.2.1, a server may request that a client present an OCSP response with its certificate by sending an empty status_request extension as part of the certificate request. The current code expects a full CertificateStatus structure, which is only sent if the server sends an OCSP response with its certificate. This causes interoperability issues with Go's TLS server and with newer GnuTLS where we would abort the handshake with a decode_error alert and length mismatch error. Issue reported and diagnosed by Michael Forney Problem also found by Mikolaj Kucharski and inoguchi. ok inoguchi jsing
2020-08-03Bump libc++ and libc++abi majors due to floating point typePatrick Wildt
changes with LLVM 10. found by kettenis@ ok deraadt@
2020-08-03crank the major cos grammar.c has grown.David Gwynne
pointed out by tb@, who also provided the diff. maybe someone should/could add a Symbols.list here? ok tb@ deraadt@
2020-08-03add "sample NUM" so you can ask to capture 1/NUM packets from a filter.David Gwynne
the use of the sample keyword matches similar config in other products. NUM can be a number between 2 and 1048576, and is used to divide 0x100000000 into a threshold that is then compared against a randomly generated number produced by a load of BPF_RND. having sampling as part of the grammar means you can write things like "icmp or sample 128". this lets you capture all icmp traffic and a sample of the rest of the traffic. ok jmatthew@ kn@ tb@
2020-08-03add support for handling loads from BPF_RND.David Gwynne
this adds "rnd" and "random" as keywords in the grammar, and handles them as an arithmetic operator. the decoder recognises the load, so tcpdump can print it as 'ld #random'. most of the handling is copied from the "len"/"length" keywoard handling that generates and decodes a load of the actual wire length of the packet. ok jmatthew@ tb@ kn@
2020-08-03sync to upstream libcbor v0.7.0; some minor fixes, but a note majorDamien Miller
crank due to ABI change.
2020-08-02Squelch warning by using idiom from libc bcrypt(3)Theo Buehler
Clang 10 warns about the expression sizeof(cdata) / sizeof(uint64_t) as cdata is an array of uint32_t and it expects that the intent of this is to compute the number of array elements. Use BCRYPT_WORDS / 2 instead. Same diff as millert's commit sys/lib/libsa/bcrypt_pbkdf.c -r1.2, which was ok kettenis. deraadt confirms that this satisfies clang 10.
2020-08-02Check the return value of tls1_enc() in the write path.Joel Sing
The write path can return a failure in the AEAD path and there is no reason not to check a return value. Spotted by tb@ during another review. ok tb@
2020-08-01Clean up/simplify more of the dtls1/ssl3 record writing code:Joel Sing
- Make the DTLS code much more consistent with the ssl3 code. - Avoid assigning wr->input and wr->length just so they can be used as arguments to memcpy(). - Remove the arc4random_buf() call for the explicit IV, since tls1_enc() already does this for us. ok tb@
2020-08-01Pull record version selection code up and pass it as an argument toJoel Sing
ssl3_create_record(). ok tb@
2020-07-30Have ssl_init_wbio_buffer() push the buffering BIO rather than doing itJoel Sing
ourselves. Spotted by tb@ during a previous review.
2020-07-30Clean up and simplify some of the SSL3/DTLS1 record writing code.Joel Sing
This will allow for further changes to be made with less complexity and easier review. In particular, decide if we need an empty fragment early on and only do the alignment calculation once (rather than in two separate parts of the function. ok tb@ inoguchi@
2020-07-30Add minimal info callback support for TLSv1.3Theo Buehler
As abieber@ found the hard way, some python frameworks (twisted, synapse) thought it a great idea to use the info callback mechanism (designed to get state information about SSL objects) to modify state information such as setting and verifying the SNI. The switch of TLS_method() to default to TLSv1.3 broke these contraptions. Further bits of the info callback mechanism will likely metastasize throughout the TLSv1.3 stack if we need them, so we only do what's really necessary now. Lots of debugging, crucial hint and testing by abieber input & ok jsing
2020-07-27Fix two cases where we shpould compare/store 64-bit values instead ofMark Kettenis
32-bit values. ok gkoehler@, drahn@
2020-07-27Fix powerpc64's sbrk()gkoehler
Initialize __curbrk = &_end. It's a 64-bit pointer, so use ld/std instead of lwz/stw. ok drahn@
2020-07-26Reference unveil(2) in system accounting and daily.8.rob
Reminder that unveil does not kill from brynet and gsoares. Wording tweaks from jmc; feedback from deraadt. ok jmc@, millert@, solene@, "fine with me" deraadt@
2020-07-25Handle SSL_MODE_AUTO_RETRY being changed during a TLSv1.3 session.Joel Sing
Both Perl's HTTP::Tiny and IO::Socket::SSL know about SSL_MODE_AUTO_RETRY and try to work around the fact that OpenSSL enabled it by default. However, this can lead to the mode being disabled prior to the TLSv1.3 handshake and then enabled after the handshake has completed. In order to handle this correctly we have to check the mode and inform the record layer prior to every read. Issue reported and test case provided by Nathanael Rensen <nathanael@polymorpheus.com>. ok inoguchi@ tb@
2020-07-25remove half a dozen "goto" statements and a labelIngo Schwarze
that change nothing whatsoever, except making the code harder to read; OK tb@
2020-07-24tweak previous;Jason McIntyre
2020-07-23document PEM_X509_INFO_read(3) and PEM_X509_INFO_read_bio(3)Ingo Schwarze
OK tb@
2020-07-23Fix a bug in PEM_X509_INFO_read_bio(3) that is very likely to causeIngo Schwarze
use-after-free and double-free issues in calling programs. The bug was introduced in SSLeay-0.6.0 released on June 21, 1996 and has been present since OpenBSD 2.4. I found the bug while documenting the function. The bug could bite in two ways that looked quite different from the perspective of the calling code: * If a stack was passed in that already contained some X509_INFO objects and an error occurred, all the objects passed in would be freed, but without removing the freed pointers from the stack, so the calling code would probable continue to access the freed pointers and eventually free them a second time. * If the input BIO contained at least two valid PEM objects followed by at least one PEM object causing an error, at least one freed pointer would be put onto the stack, even though the function would return NULL rather than the stack. But the calling code would still have a pointer to the stack, so it would be likely to access the new bogus pointers sooner or later. Fix all this by remembering the size of the input stack on entry and cutting it back to exactly that size when exiting due to an error, but no further. While here, do some related cleanup: * Garbage collect the automatic variables "error" and "i" which were only used at one single place each. * Use NULL rather than 0 for pointers. I like bugfixes that make the code four lines shorter, reduce the number of variables by one, reduce the number of brace-blocks by one, reduce the number if if-statements by one, and reduce the number of else-clauses by one. Tweaks and OK tb@.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 00:44:37 +0000