summaryrefslogtreecommitdiffstats
path: root/ssl/record
AgeCommit message (Collapse)Author
2017-03-14Fix some -Wshadow warningsBenjamin Kaduk
Found using various (old-ish) versions of gcc. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2940)
2017-03-08Fix no-compMatt Caswell
The value of SSL3_RT_MAX_ENCRYPTED_LENGTH normally includes the compression overhead (even if no compression is negotiated for a connection). Except in a build where no-comp is used the value of SSL3_RT_MAX_ENCRYPTED_LENGTH does not include the compression overhead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2872)
2017-03-07Provide a function to test whether we have unread records pendingMatt Caswell
Also updates SSL_has_pending() to use it. This actually fixes a bug in SSL_has_pending() which is supposed to return 1 if we have any processed or unprocessed data sitting in OpenSSL buffers. However it failed to return 1 if we had processed non-application data pending. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2875)
2017-03-06Tweak the TLSv1.3 record overflow limitsMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2861)
2017-03-02Don't attempt to write more early_data than we know the server will acceptMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Skip early_data if appropriate after a HelloRetryRequestMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Check max_early_data against the amount of early data we actually receiveMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Make sure we reset the read sequence when skipping recordsMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Provide an SSL_read_early() function for reading early dataMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Parse the early_data extensionMatt Caswell
We also skip any early_data that subsequently gets sent. Later commits will process it if we can. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Provide functions to write early dataMatt Caswell
We provide SSL_write_early() which *must* be called first on a connection (prior to any other IO function including SSL_connect()/SSL_do_handshake()). Also SSL_write_early_finish() which signals the end of early data. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
2017-03-02Fix a compression bugMatt Caswell
do_ssl3_write() was crashing when compression was enabled. We calculate the maximum length that a record will be after compression and reserve those bytes in the WPACKET. Unfortunately we were adding the maximum compression overhead onto the wrong variable resulting in a corrupted record. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2814)
2017-03-02Check for zero records and return immediatelyJon Spillett
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2822)
2017-03-01Remove some obsolete/obscure internal define switches:Emilia Kasper
- FLAT_INC - PKCS1_CHECK (the SSL_OP_PKCS1_CHECK options have been no-oped) - PKCS_TESTVECT (debugging leftovers) - SSL_AD_MISSING_SRP_USERNAME (unfinished feature) - DTLS_AD_MISSING_HANDSHAKE_MESSAGE (unfinished feature) - USE_OBJ_MAC (note this removes a define from the public header but very unlikely someone would be depending on it) - SSL_FORBID_ENULL Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org>
2017-02-28Remove some commented out code in libsslMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2774)
2017-02-28Clean up references to FIPSEmilia Kasper
This removes the fips configure option. This option is broken as the required FIPS code is not available. FIPS_mode() and FIPS_mode_set() are retained for compatibility, but FIPS_mode() always returns 0, and FIPS_mode_set() can only be used to turn FIPS mode off. Reviewed-by: Stephen Henson <steve@openssl.org>
2017-02-28Remove some dead code from libsslMatt Caswell
There are a small number of functions in libssl that are internal only and never used by anything. Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2770)
2017-02-16Remove an OPENSSL_assert() and replace with a soft assert and checkMatt Caswell
Following on from CVE-2017-3733, this removes the OPENSSL_assert() check that failed and replaces it with a soft assert, and an explicit check of value with an error return if it fails. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-02-16Don't change the state of the ETM flags until CCS processingMatt Caswell
In 1.1.0 changing the ciphersuite during a renegotiation can result in a crash leading to a DoS attack. In master this does not occur with TLS (instead you get an internal error, which is still wrong but not a security issue) - but the problem still exists in the DTLS code. The problem is caused by changing the flag indicating whether to use ETM or not immediately on negotiation of ETM, rather than at CCS. Therefore, during a renegotiation, if the ETM state is changing (usually due to a change of ciphersuite), then an error/crash will occur. Due to the fact that there are separate CCS messages for read and write we actually now need two flags to determine whether to use ETM or not. CVE-2017-3733 Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-02-08Fix crash in tls13_encMatt Caswell
If s->s3->tmp.new_cipher is NULL then a crash can occur. This can happen if an alert gets sent after version negotiation (i.e. we have selected TLSv1.3 and ended up in tls13_enc), but before a ciphersuite has been selected. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2575)
2017-02-08Use contants for Chacha/Poly, redo algorithm expressions.Dr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2550)
2017-02-08Add CCM mode support for TLS 1.3Dr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2550)
2017-01-30Move TLSv1.3 Session Ticket processing into the state machineMatt Caswell
We still ignore it for now, but at least its in the right place. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-30Move state machine knowledge out of the record layerMatt Caswell
The record layer was making decisions that should really be left to the state machine around unexpected handshake messages that are received after the initial handshake (i.e. renegotiation related messages). This commit removes that code from the record layer and updates the state machine accordingly. This simplifies the state machine and paves the way for handling other messages post-handshake such as the NewSessionTicket in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-30Remove use of the SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flagMatt Caswell
This flag is never set by anything so remove it. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-30ChangeCipherSpec is not allowed in TLSv1.3Matt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-24Cleanup EVP_CIPH/EP_CTRL duplicate definesTodd Short
Remove duplicate defines from EVP source files. Most of them were in evp.h, which is always included. Add new ones evp_int.h EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK is now always defined in evp.h, so remove conditionals on it Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2201)
2017-01-23Replace div-spoiler hack with simpler codeAndy Polyakov
This comes from a comment in GH issue #1027. Andy wrote the code, Rich made the PR. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2253)
2017-01-10Always use TLSv1.0 for record layer version in TLSv1.3Matt Caswell
TLSv1.3 freezes the record layer version and ensures that it is always set to TLSv1.0. Some implementations check this. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2157)
2017-01-10Temporarily ignore NewSessionTickets for TLS1.3Matt Caswell
We can't handle these messages yet, so ignore them for now. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2157)
2017-01-10Ensure the record sequence number gets incrementedMatt Caswell
We were not incrementing the sequence number every time we sent/received a record. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2157)
2017-01-10Mark a HelloRequest record as read if we ignore itMatt Caswell
Otherwise the client will try to process it again. The second time around it will try and move the record data into handshake fragment storage and realise that there is no data left. At that point it marks it as read anyway. However, it is a bug that we go around the loop a second time, so we prevent that. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2200)
2016-12-12Fix a leak in SSL_clear()Matt Caswell
SSL_clear() was resetting numwpipes to 0, but not freeing any allocated memory for existing write buffers. Fixes #2026 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Change various repeated wr[someindex]/pkt[someindex] references to a pointerMatt Caswell
Improves the readability of the code, and reduces the liklihood of errors. Also made a few minor style changes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Various style fixes from the TLSv1.3 record changes reviewMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Change various repeated rr[someindex] references to a pointerMatt Caswell
Improves the readability of the code, and reduces the liklihood of errors. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Ensure compressdata is always initialisedMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Add a TLS1.3 TODO for the msg callbackMatt Caswell
At the moment the msg callback only received the record header with the outer record type in it. We never pass the inner record type - we probably need to at some point. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Update the record layer to use TLSv1.3 style record constructionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Convert TLS Record receipt to use PACKETMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Convert TLS record construction to use WPACKETMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-29Fix some style issues in the TLSv1.3 nonce construction codeMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-29Use the TLSv1.3 nonce constructionMatt Caswell
This updates the record layer to use the TLSv1.3 style nonce construciton. It also updates TLSProxy and ossltest to be able to recognise the new layout. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-21Make SSL_read and SSL_write return the old behaviour and document it.Kurt Roeckx
This reverts commit 4880672a9b41a09a0984b55e219f02a2de7ab75e. Fixes: #1903 Reviewed-by: Matt Caswell <matt@openssl.org> GH: #1931
2016-11-17Fix missing SSL_IS_TLS13(s) usageMatt Caswell
We should use the macro for testing if we are using TLSv1.3 rather than checking s->version directly. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-13Remove heartbeat supportRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1669)
2016-11-07Ignore the record version in TLS1.3Matt Caswell
The record layer version field must be ignored in TLSv1.3, so we remove the check when using that version. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some style issues from libssl size_tify reviewMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Rename all "read" variables with "readbytes"Matt Caswell
Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix a shadowed variable declaration warning picked up by TravisMatt Caswell
Rename "read" to "readbytes" Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-09 01:35:07 +0000