summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2020-03-16Consistently spell 'unsigned' as 'unsigned int', as style(9) seemsTheo Buehler
to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
2020-03-16The RFC is clear (section 5.3) that sequence number should never wrap.Theo Buehler
We currently throw an error on overflow, but still wrap. Check up front if we would need to wrap and only increment if that case is excluded. This simplifies the increment loop and makes the returns in this function less magic. ok jsing
2020-03-13Remove dtls1_enc().Joel Sing
Like much of the original DTLS code, dtls1_enc() is effectively a renamed copy of tls1_enc(). Since then tls1_enc() has been modified, however the non-AEAD code remains largely the same. As such, remove dtls1_enc() and instead call tls1_enc() from the DTLS code. The tls1_enc() AEAD code does not currently work correctly with DTLS, however this is a non-issue since we do not support AEAD cipher suites with DTLS currently. ok tb@
2020-03-13Correct TLSv1.3 sequence number increment and wrapping check.Joel Sing
Fix proposed by tb@
2020-03-13Ensure that CBB_add_space() always provides zeroed memory.Joel Sing
ok tb@
2020-03-13Anthony Steinhauser reports that 32-bit arm cpus have the same speculationTheo de Raadt
problems as 64-bit models. To resolve the syscall speculation, as a first step "nop; nop" was added after all occurances of the syscall ("swi 0") instruction. Then the kernel was changed to jump over the 2 extra instructions. In this final step, those pair of nops are converted into the speculation-blocking sequence ("dsb nsh; isb"). Don't try to build through these multiple steps, use a snapshot instead. Packages matching the new ABI will be out in a while... ok kettenis
2020-03-13typo in commentDamien Miller
spotted at https://fossies.org/linux/misc/openssh-8.2p1.tar.gz/codespell.html
2020-03-12Use calloc() rather than malloc() when allocating initial CBB buffer.Joel Sing
CBB uses recallocarray() to expand buffers, however was still using malloc() for the initial buffer, which could result in memory being leaked in incorrect use cases. While here also use calloc() to allocate internal structs. ok inoguchi@ tb@
2020-03-12Use calloc() rather than malloc() when allocating buffers.Joel Sing
This reduces the chance of accidently leaking stack memory. ok inoguchi@ tb@
2020-03-12Stop overloading the record type for padding length.Joel Sing
Currently the CBC related code stuffs the padding length in the upper bits of the type field... stop doing that and add a padding_length field to the record struct instead. ok inoguchi@ tb@
2020-03-12Use internal versions of SSL3_BUFFER, SSL3_RECORD and DTLS1_RECORD_DATA.Joel Sing
SSL3_BUFFER, SSL3_RECORD and DTLS1_RECORD_DATA are currently still in public headers, even though their usage is internal. This moves to using _INTERNAL suffixed versions that are in internal headers, which then allows us to change them without any potential public API fallout. ok inoguchi@ tb@
2020-03-11Anthony Steinhauser reports that 32-bit arm cpus have the same speculationTheo de Raadt
problems as 64-bit models. For the syscall instruction issue, add nop;nop after swi 0, in preparation for jumping over a speculation barrier here later.
2020-03-11Anthony Steinhauser reports that 32-bit arm cpus have the same speculationTheo de Raadt
problems as 64-bit models. For the syscall instruction issue, add nop;nop after swi 0, in preparation for jumping over a speculation barrier here later. ok kettenis
2020-03-11typo; from bryan stensonJason McIntyre
2020-03-10Use ctx->hs->secrets rather than the S3I(s) version.Joel Sing
ok inoguchi@ tb@
2020-03-10Remove some unnecessary handshake enums/functions.Joel Sing
Both session tickets and key updates are post-handshake handshake messages, which were originally included in the handshake code. ok inoguchi@ tb@
2020-03-10Add a return value check to tls13_buffer_extend().Joel Sing
In the unlikely event that the return value from the read callback is larger than the number of bytes we asked for, we can end up incrementing buf->len beyond capacity. Check the return value from the read callback to prevent this. ok inoguchi@ tb@
2020-03-10Remove the enc function pointers.Joel Sing
The enc function pointers do not serve any purpose these days - remove a layer of indirection and call dtls1_enc()/tls1_enc() directly. ok inoguchi@ tb@
2020-03-06RFC 8446, section 4.1.3: If a TLSv1.2 client receives a ServerHello forTheo Buehler
TLSv1.1 or below, it should check whether the server's random value contains the magic downgrade protection cookie and in that case abort the handshake with an illegal parameter alert. ok inoguchi, jsing
2020-03-06TLSv1.3 servers that intend to downgrade are required to set the lastTheo Buehler
eight bytes of the server's random to a magic cookie (RFC 8446, 4.1.3). The TLSv1.3 spec changes the TLSv1.2 spec in that it recommends that TLSv1.2 servers that negotiate TLSv1.1 or below do the same. This gives a limited additional protection against downgrade attacks beyond what is already present in the Finished exchange. The TLSv1.3 part was already implemented in Hobart and can be trivially modified to do the TLSv1.2 bit as well. ok inoguchi, jsing
2020-03-04crank major versions of libLLVM libc++ libc++abigkoehler
OpenBSD macppc builds these libs with clang. Their ABI is changing because of clang -msvr4-struct-return
2020-03-04Check high bit for base64 decodeKinichiro Inoguchi
Referred to this OpenSSL commit and adopted to the codebase. b785504a10310cb2872270eb409b70971be5e76e suggest and ok tb@
2020-03-03Fix base64 processing of long linesKinichiro Inoguchi
Fix the problem that long unbroken line of base64 text is not decoded. Referred to this OpenSSL commit and adapted to the codebase. 3cdd1e94b1d71f2ce3002738f9506da91fe2af45 Reported by john.a.passaro <at> gmail.com to the LibreSSL ML. ok tb@
2020-02-28oops some snapshot tests fell inTheo de Raadt
2020-02-28syncTheo de Raadt
2020-02-26Fix .Dt line and copyright year.Alexandre Ratchov
From jmc@, thanks.
2020-02-26Add API to control audio device parameters exposed by sndiod.Alexandre Ratchov
The API exposes controls of modern audio hardware and sndiod software volume knobs in a uniform way. Hardware knobs are exposed through sndiod. Multiple programs may use the controls at the same time without the need to continuously scan the controls. For now sndiod exposes only its own controls and the master output and input volumes of the underlying hardware (if any), i.e. those typically exposed by acpi volume keys. ok deraadt
2020-02-23The decryption_failed alert must not be sent by compliant implementations.Theo Buehler
Use a bad_record_mac alert instead. Found with tlsfuzzer's ChaCha20 test. ok beck inoguchi jsing
2020-02-23According to RFC 8446, Section 4.4.4, recipients of incorrect FinishedTheo Buehler
messages must terminate the connection with a decrypt_error alert, so replace the use of the deprecated decryption_failed alert accordingly. ok beck inoguchi jsing
2020-02-21Remove the s2n macro now that it is finally unused.Joel Sing
ok inoguchi@ tb@
2020-02-21Convert the SSL/TLS record creation code to CBB.Joel Sing
ok inoguchi@ tb@
2020-02-21Convert the DTLS header creation code to CBB.Joel Sing
Also consolidate it into the one place, since there is no reason to write the epoch and sequence out later. ok inoguchi@ tb@
2020-02-21Remove some commented code, remove some pointless comments and move someJoel Sing
comments to their correct places. ok inoguchi@ tb@
2020-02-21Convert dtls1_build_sequence_number() to CBB.Joel Sing
ok inoguchi@ tb@
2020-02-21Move l2n/l2n8 into s3_cbc.c, since this is the only code that uses it.Joel Sing
ok inoguchi@ tb@
2020-02-21Remove prefix_len, since it is always zero.Joel Sing
ok inoguchi@ tb@
2020-02-21Remove now unused variable.Joel Sing
ok inoguchi@ tb@
2020-02-19Refactor do_ssl3_write().Joel Sing
When empty fragments were added as a countermeasure against chosen plaintext attacks on CBC, it was done by adding a recursive call to do_ssl3_write(). This makes the code more complex and difficult to change. Split the record creation code into a separate ssl3_create_record() function, which do_ssl3_write() calls. In the case where an empty fragment is needed, ssl3_create_record() is simply called twice, removing the need for recursion. ok inoguchi@ tb@
2020-02-18drop unused include <openssl/curve25519.h>Theo Buehler
ok inoguchi jsing
2020-02-18Now that the kernel skips the two instructions immediately followingMark Kettenis
a syscall, replace the double nop with a dsb nsh; isb; sequence which stops the CPU from speculating any further. This fix was suggested by Anthony Steinhauser. ok deraadt@
2020-02-17Describe the restriction for length of openssl conf value stringKinichiro Inoguchi
ok and suggestion jmc@
2020-02-17Restrict the length of openssl conf value stringKinichiro Inoguchi
There was no limitation for the length of openssl conf value. This brings possibility of out-of-memory problem as oss-fuzz had detected. This diff restricts the length of conf value up to 64k. ok jsing@
2020-02-16Avoid potential NULL dereference when parsing a server keyshare extension.Joel Sing
It is currently possible for key_share to be NULL when a TLS client receives a keyshare extension. However, for this to occur the client has to be doing TLS 1.2 or earlier, which means that it was invalid for the server to send the extension. As such, check for NULL and treat it as an invalid extension. Found by oss-fuzz (#20741 and #20745). ok inoguchi@ tb@
2020-02-16Avoid leak for tmp.x25519Kinichiro Inoguchi
Changed to use local variable to hold malloc address rather than directly set to S3I(s)->tmp.x25519, and set that private_key pointer to S3I(s)->tmp.x25519 after all the "goto err;". Also added freezero for S3I(s)->tmp.x25519 to ssl3_free() and ssl3_clear(). ok jsing@ tb@
2020-02-15Move the TLSv1.3 code that interfaces with the legacy APIs/stack into aJoel Sing
separate file. Discussed with beck@ and tb@
2020-02-15Remove #include that is not needed.Joel Sing
2020-02-11Some system calls can fail due to an open-ended variety of causesIngo Schwarze
in many underlying subsystems and device drivers. guenther@ pointed out this applies to system calls taking a file descriptor as an argument. deraadt@ warned against attempting to be excessively precise and against spreading fear, uncertainty, and doubt. So apply a minimal patch that merely avoids the misleading wording "will succeed unless", given that the lists aren't really exhaustive, and simply uses a more usual wording. Unfortunate wording reported by <David dot Raymond at nmt dot edu>.
2020-02-09A getlogin() function which used utmp(5) appeared in v7.Jonathan Gray
This was replaced by a getlogin() system call which Ingo discovered we incorrectly list as being 4.2BSD when it was introduced in 4.3BSD Reno. ok schwarze@
2020-02-08correct Research Unix edition "appeared in" use in HISTORYJonathan Gray
Starting from "Combined Table of Contents" in Doug McIlroy's "A Research UNIX Reader" a table of which edition manuals appeared in. Checked against manuals from bitsavers/TUHS and source from TUHS where available. Ingo points out there are cases where something is included but not documented until a later release. bcd(6) v6 v7 printf(3) v2 v4 abort(3) v5 v6 system(3) v6 v7 fmod(3) v5 v6 ok schwarze@
2020-02-07It appears we have come full-circle, where source code starts to useTheo de Raadt
clang / "super new gcc" ism's, in particular ones which are totally pointless as far as language goes. Delete them.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 09:28:09 +0000