summaryrefslogtreecommitdiffstats
path: root/ssl/d1_lib.c
AgeCommit message (Collapse)Author
2015-05-05memset, memcpy, sizeof consistency fixesRich Salz
Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-04Use safer sizeof variant in mallocRich Salz
For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-01free NULL cleanup -- codaRich Salz
After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-04-30Remove redundant includes from dtls1.hMatt Caswell
There were a set of includes in dtls1.h which are now redundant due to the libssl opaque work. This commit removes those includes, which also has the effect of resolving one issue preventing building on windows (i.e. the include of winsock.h) Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-16Code style: space after 'if'Viktor Dukhovni
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-26Move buffered_app_data from s->d1 to s->rlayer.dMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-26Fix seg fault in dtls1_newMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-26Moved processed_rcds and unprocessed_rcds from s->d1 to s->rlayer.dMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-26Move r_epoch and w_epoch from s->d1 to s->rlayer.dMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-26Introduce a DTLS_RECORD_LAYER type for DTLS record layer stateMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-23Fix SSL_clear unused returnMatt Caswell
Fix missing return value check in dtls1_listen when calling SSL_clear(). Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-23ssl3_set_handshake_header returnsMatt Caswell
Change ssl_set_handshake_header from return void to returning int, and handle error return code appropriately. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-23Fix missing return value checksMatt Caswell
Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-19Fix Seg fault in DTLSv1_listenMatt Caswell
The DTLSv1_listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1_listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1_listen means that state is preserved in the SSL object from one invokation to the next that can lead to a segmentation fault. Erorrs processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only server. CVE-2015-0207 Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-09Wrong SSL version in DTLS1_BAD_VER ClientHelloDavid Woodhouse
Since commit 741c9959 ("DTLS revision."), we put the wrong protocol version into our ClientHello for DTLS1_BAD_VER. The old DTLS code which used ssl->version was replaced by the more generic SSL3 code which uses ssl->client_version. The Cisco ASA no longer likes our ClientHello. RT#3711 Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-01-22Fix post-reformat errors preventing windows compilationMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-04dtls1_new: free s on error pathKurt Roeckx
Reviewed-by: Richard Levitte <levitte@openssl.org>
2014-12-04Remove incorrect code inadvertently introduced through commit 59669b6ab.Matt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-03Only use the fallback mtu after 2 unsuccessful retransmissions if it is lessMatt Caswell
than the mtu we are already using Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-03Remove instances in libssl of the constant 28 (for size of IPv4 header + UDP)Matt Caswell
and instead use the value provided by the underlying BIO. Also provide some new DTLS_CTRLs so that the library user can set the mtu without needing to know this constant. These new DTLS_CTRLs provide the capability to set the link level mtu to be used (i.e. including this IP/UDP overhead). The previous DTLS_CTRLs required the library user to subtract this overhead first. Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-03The SSL_OP_NO_QUERY_MTU option is supposed to stop the mtu from beingMatt Caswell
automatically updated, and we should use the one provided instead. Unfortunately there are a couple of locations where this is not respected. Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-11-26Fixed memory leak due to incorrect freeing of DTLS reassembly bit maskMatt Caswell
PR#3608 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-10-15Support TLS_FALLBACK_SCSV.Bodo Moeller
Reviewed-by: Stephen Henson <steve@openssl.org>
2014-06-29Constification - mostly originally from Chromium.Ben Laurie
2014-06-02Free up s->d1->buffered_app_data.q properly.zhu qun-ying
PR#3286
2014-03-06bss_dgram.c,d1_lib.c: make it compile with mingw.Andy Polyakov
Submitted by: Roumen Petrov
2013-04-09Dual DTLS version methods.Dr. Stephen Henson
Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.
2013-04-08Set s->d1 to NULL after freeing it.Dr. Stephen Henson
2013-03-28Enable TLS 1.2 ciphers in DTLS 1.2.Dr. Stephen Henson
Port TLS 1.2 GCM code to DTLS. Enable use of TLS 1.2 only ciphers when in DTLS 1.2 mode too.
2013-03-26Provisional DTLS 1.2 support.Dr. Stephen Henson
Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing.
2013-03-18DTLS revision.Dr. Stephen Henson
Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
2013-01-19Improve WINCE support.Andy Polyakov
Submitted by: Pierre Delaage
2012-12-16d1_lib.c,bss_dgram.c: eliminate dependency on _ftime.Andy Polyakov
2012-04-18correct error codesDr. Stephen Henson
2012-03-09PR: 2756Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Fix DTLS timeout handling.
2012-03-06PR: 2755Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reduce MTU after failed transmissions.
2011-12-31PR: 2658Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-25PR: 2535Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Add SCTP support for DTLS (RFC 6083).
2011-11-15Add TLS exporter.Ben Laurie
2011-09-23PR: 2602Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fix DTLS bug which prevents manual MTU setting
2011-06-22PR: 2543Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Correctly handle errors in DTLSv1_handle_timeout()
2011-05-25Oops use up to date patch for PR#2506Dr. Stephen Henson
2011-05-25PR: 2506Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fully implement SSL_clear for DTLS.
2011-04-03PR: 2462Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fix DTLS Retransmission Buffer Bug
2010-11-22Taken from OpenSSL_1_0_0-stable:Richard Levitte
Include proper header files for time functions. Submitted by Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se>
2010-04-06PR: 2223Dr. Stephen Henson
Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de> Fixes for DTLS timeout bug
2009-12-08PR: 2121Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Add extension support to DTLS code mainly using existing implementation for TLS.
2009-12-01PR: 2115Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org Add Renegotiation extension to DTLS, fix DTLS ClientHello processing bug.
2009-09-09PR: 2033Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org DTLS listen support.
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-28 19:21:19 +0000