summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2021-03-12spellingJonathan Gray
2021-03-11Remove ssl_downgrade_max_version().Joel Sing
Now that we store our maximum TLS version at the start of the handshake, we can check against that directly. ok inoguchi@ tb@
2021-03-11that 0 should be NULLTheo de Raadt
2021-03-10Don't return ERR if resize didn't change sizeTodd C. Miller
This is a backport of the ncurses 5.9 20120707 patch. Previously, getch() would return ERR if SIGWINCH was received but the window didn't actually change size. This can happen, for example, when the xterm font is changed. OK tb@
2021-03-10Guard TLS1_get_{client_,}version() macros with #ifndef LIBRESSL_INTERNAL.Joel Sing
These are no longer used (and should not be used) internally.
2021-03-10Improve internal version handling.Joel Sing
Add handshake fields for our minimum TLS version, our maximum TLS version and the TLS version negotiated during the handshake. Initialise our min/max versions at the start of the handshake and leave these unchanged. The negotiated TLS version is set in the client once we receive the ServerHello and in the server at the point we select the highest shared version. Provide an ssl_effective_version() function that returns the negotiated TLS version if known, otherwise our maximum TLS version - this is effectively what is stored in s->version currently. Convert most of the internal code to use one of these three version fields, which greatly simplifies code (especially in the TLS extension handling code). ok tb@
2021-03-09Early daemons like dhcpleased(8), slaacd(8), unwind(8), resolvd(8)Alexander Bluhm
are started before syslogd(8). This resulted in ugly sendsyslog(2) dropped logs and the real message was lost. Create a temporary stash for log messages within the kernel. It has a limited size of 100 messages, and each message is truncated to 8192 bytes. When the stash is exhausted, the well-known dropped message is generated with a counter. After syslogd(8) has setup everything, it sends a debug line through libc to flush the kernel stash. Then syslogd receives all messages from the kernel before the usual logs. OK deraadt@ visa@
2021-03-09Change the implementation of the malloc cache to keep lists ofOtto Moerbeek
regions of a given size. In snaps for a while, committing since no issues were reported and a wider audience is good. ok deraadt@
2021-03-07LibreSSL 3.3.2Brent Cook
2021-03-05Stop abusing display blocks under the authors section in order toanton
respect literal line breaks. This has the unwanted side effect of rendering the authors section using a monospace font over at man.openbsd.org. Instead use br macros to force line breaks. With help from and ok jmc@
2021-03-03s/byte/characterMartijn van Duren
Discussed with claudio@ Feedback jmc@
2021-03-02document ENOTSUP wxallowed/wxneeded behaviour more clearly; ok kurtTheo de Raadt
2021-03-02Separate variable declaration and assignment.Joel Sing
Requested by tb@
2021-03-02Replace two handrolled tls12_record_protection_engaged().Joel Sing
Noted by tb@
2021-03-02Move key/IV length checks closer to usage sites.Joel Sing
Also add explicit checks against EVP_CIPHER_iv_length() and EVP_CIPHER_key_length(). Requested by tb@ during review. ok tb@
2021-03-02Add tls12_record_protection_unused() and call from CCS functions.Joel Sing
This moves the check closer to where a leak could occur and checks all pointers in the struct. Suggested by tb@ during review. ok tb@
2021-03-02Fix misleading indentation in SSL_get_error()Theo Buehler
2021-02-27Move handling of cipher/hash based cipher suites into the new record layer.Joel Sing
ok tb@
2021-02-27Identify DTLS based on the version major value.Joel Sing
This avoids the need to match specific DTLS version numbers.
2021-02-26Set is_trusted in x509_verify_ctx_add_chain()Theo Buehler
If we're about to add a chain we have a trust path, so we have at least one trusted certificate. This fixes a thinko from r1.31 and fixes the openssl(1) cms verify test. ok jsing (who had the same diff)
2021-02-25Fix two bugs in the legacy verifierTheo Buehler
To integrate the new X.509 verifier, X509_verify_cert() was refactored. The code building chains in the legacy verifier was split into a separate function. The first bug is that its return value was treated as a Boolean although it wasn't. Second, the return alone is not enough to decide whether to carry on the validation or not. Slightly rearrange things to restore the behavior of the legacy verifier prior to this refactoring. Issue found and test case provided by Anton Borowka and jan. ok jan jsing
2021-02-25Only use TLS versions internally (rather than both TLS and DTLS versions).Joel Sing
DTLS protocol version numbers are the 1's compliment of human readable TLS version numbers, which means that newer versions decrease in value and there is no direct mapping between TLS protocol version numbers and DTLS protocol version numbers. Rather than having to deal with this internally, only use TLS versions internally and map between DTLS and TLS protocol versions when necessary. Rename functions and variables to use 'tls_version' when they contain a TLS version (and never a DTLS version). ok tb@
2021-02-25Rename depth to num_untrusted so it identifies what it actually represents.Joel Sing
ok tb@
2021-02-25Avoid passing last and depth to x509_verify_cert_error() on ENOMEM.Joel Sing
In x509_verify_ctx_set_xsc_chain(), an ENOMEM case is currently passing the last certificate and depth (which is no longer actually depth) to x509_verify_cert_error(). Given we've hit an ENOMEM situation, neither of these are useful so remove both. ok tb@
2021-02-25- Make use of the fact that we know how the chunks are aligned, andOtto Moerbeek
write 8 bytes at the time by using a uint64_t pointer. For an allocation a max of 4 such uint64_t's are written spread over the allocation. For pages sized and larger, the first page is junked in such a way. - Delayed free of a small chunk checks the corresponiding way. - Pages ending up in the cache are validated upon unmapping or re-use. In snaps for a while
2021-02-24Fix comment explaining last_untrusted. This should really be calledTheo Buehler
num_untrusted, but unfortunately it's public... ok jsing tobhe
2021-02-24Make the new validator check for EXFLAG_CRITICALTheo Buehler
As should be obvious from the name and the comment in x509_vfy.h int last_untrusted; /* index of last untrusted cert */ last_untrusted actually counts the number of untrusted certs at the bottom of the chain. Unfortunately, an earlier fix introducing x509_verify_set_xsc_chain() assumed that last_untrusted actually meant the index of the last untrusted cert in the chain, resulting in an off-by-one, which in turn led to x509_vfy_check_chain_extension() skipping the check for the EXFLAG_CRITICAL flag. A second bug in x509_verify_set_xsc_chain() assumed that it is always called with a trusted root, which is not necessarily the case anymore. Address this with a temporary fix which will have to be revisited once we will allow chains with more than one trusted cert. Reported with a test case by tobhe. ok jsing tobhe
2021-02-22Make the ober_get_* set of function to accept a NULL-pointer.Martijn van Duren
This allows us to do ber-type checking inside ober_scanf_elements, which will allow for stricter ASN.1 parsing in the future. Manpage feedback and OK claudio@, jmc@ OK claudio@
2021-02-22Fix bizarre punctuation and capitalization in a comment.Theo Buehler
2021-02-22Simplify version checks in the TLSv1.3 clientTheo Buehler
Ensure that the server announced TLSv1.3 (and nothing higher) in the supported_versions extension. In that case, the legacy_version must be TLSv1.2 according to RFC 8446, 4.1.3 and 4.2.1. This commit also removes some unreachable code which is a remnant of very early TLSv1.3 code from before the legacy fallback was introduced. Simplify a few checks and adjust some comments nearby. ok jsing
2021-02-22Factor out/change some of the legacy client version handling code.Joel Sing
This consolidates the version handling code and will make upcoming changes easier. ok tb@
2021-02-20ugly whitespaceTheo Buehler
2021-02-20Rename f_err into fatal_err.Theo Buehler
discussed with jsing
2021-02-20Rename the truncated label into decode_err. This describes its purposeTheo Buehler
better and doesn't look odd if there's trailing data for exapmle. Indent a few labels in the neighborhood while there. ok jsing
2021-02-20Return a min/max version of zero if set to zero.Joel Sing
OpenSSL's SSL{_CTX,}_get_{min,max}_proto_version() return a version of zero if the minimum or maximum has been set to zero (which means the minimum or maximum version supported by the method). Previously we returned the minimum or maximum version supported by the method, instead of zero. Match OpenSSL's behaviour by using shadow variables. Discussed with tb@
2021-02-20Add DTLSv1.2 methods.Joel Sing
These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
2021-02-20Handle DTLS1_2_VERSION in various places.Joel Sing
ok tb@
2021-02-20Revise HelloVerifyRequest handling for DTLSv1.2.Joel Sing
Per RFC 6347 section 4.2.1, the HelloVerifyRequest should always contain DTLSv1.0 - ensure this is the case on the server side, allow both DTLSv1.0 and DTLSv1.2 on the client. ok tb@
2021-02-20Group HelloVerifyRequest decoding and add missing check for trailing data.Joel Sing
ok tb@
2021-02-20Add various public DTLS related defines.Joel Sing
These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
2021-02-20Clean up/simplify dtls1_get_cipher().Joel Sing
ok tb@
2021-02-18Pull in fix for EVP_CipherUpdate() overflow from OpenSSL.Theo Buehler
ok inoguchi commit 6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 Author: Matt Caswell <matt@openssl.org> Date: Tue Feb 2 17:17:23 2021 +0000 Don't overflow the output length in EVP_CipherUpdate calls CVE-2021-23840 Reviewed-by: Paul Dale <pauli@openssl.org>
2021-02-15Back-out USB data toggle fix for HID devices, since we received multipleMarcus Glocker
reports about broken devices, e.g. for ukbd(4) and fido(4). ok mpi@
2021-02-12Some people still argue that rand(3) and random(3) have suitable deterministicTheo de Raadt
use cases, so explain the situation a bit more. Since the 80's, I estimate around 5 algorithm changes, so any chosen seed is unrepeatable UB. +The deterministic sequence algorithm changed a number of times since +original development, is underspecified, and should not be relied upon to +remain consistent between platforms and over time. ok jmc kettenis
2021-02-12Sync cert.pem with Mozilla NSS root CAs, except "GeoTrust Global CA", ok tb@Stuart Henderson
Notably this update removes various old Symantec roots (GeoTrust, thawte, VeriSign) that were set in NSS to be distrusted on 1/1/2021. Nobody should have been using these for years; only certain subCAs signed by these were valid in NSS in that time due to an exemption: https://wiki.mozilla.org/CA/Additional_Trust_Changes#Symantec Notably Apple's "Apple IST CA 2 - G1" which is still in use for some endpoints (it is cross signed by another CA too but these endpoints are publishing the GeoTrust intermediate cert). So for now I have skipped removal of "GeoTrust Global CA" to avoid affecting these sites. Debian ran into this when they updated their cert database and had to back this part out, affected sites are not reachable on Android Firefox and maybe other newer Firefoxes. Some sites that were affected have moved to a different CA in the last few days but others, notably api.push.apple.com, remain (I can only guess that there is a complicated problem involved, possibly cert pinning on old devices - the clock is ticking though as this expires in May 2022 anyway ;) Additions: /C=RO/O=CERTSIGN SA/OU=certSIGN ROOT CA G2 /C=HU/L=Budapest/O=Microsec Ltd./2.5.4.97=VATHU-23584497/CN=e-Szigno Root CA 2017 /C=KR/O=NAVER BUSINESS PLATFORM Corp./CN=NAVER Global Root Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P256 Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P384 Certification Authority Removals: /C=US/O=GeoTrust Inc./CN=GeoTrust Primary Certification Authority /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA 2 /C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3 /C=TW/O=Government Root Certification Authority /C=LU/O=LuxTrust S.A./CN=LuxTrust Global Root 2 /C=US/O=thawte, Inc./OU=(c) 2007 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G2 /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2007 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G4 /C=CH/O=WISeKey/OU=Copyright (c) 2005/OU=OISTE Foundation Endorsed/CN=OISTE WISeKey Global Root GA CA
2021-02-11KNFTheo Buehler
2021-02-08correct return type for compressBound();Jason McIntyre
from pedro martelletto
2021-02-08Remove bogus DTLS checks to disable ECC and OCSP.Joel Sing
ECC and OCSP can be used with DTLS, so remove bogus checks that currently prevent it. These are long lasting remnants from the original OpenSSL code. ok tb@
2021-02-08Enforce read ahead with DTLS.Joel Sing
DTLS is largely broken/useless without read ahead being enabled, so enforce it for DTLS. This behaviour matches both our documentation and OpenSSL. ok tb@
2021-02-08Use dtls1_retrieve_buffered_record() to load buffered application data.Joel Sing
Replace the current copy of dtls1_retrieve_buffered_record() with a call to it instead. ok tb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 05:10:07 +0000