summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2019-01-07Don't complain if we receive the cryptopro extension in the ClientHelloMatt Caswell
The cryptopro extension is supposed to be unsolicited and appears in the ServerHello only. Additionally it is unofficial and unregistered - therefore we should really treat it like any other unknown extension if we see it in the ClientHello. Fixes #7747 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7984) (cherry picked from commit 23fed8ba0ec895e1b2a089cae380697f15170afc)
2019-01-06Restore compatibility with GOST2001 implementations.Dmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7985) (cherry picked from commit 673e0bbbe4b9cbd19a247c0b18c171bb0421915a)
2019-01-04Fix a RUN_ONCE bugMatt Caswell
We have a number of instances where there are multiple "init" functions for a single CRYPTO_ONCE variable, e.g. to load config automatically or to not load config automatically. Unfortunately the RUN_ONCE mechanism was not correctly giving the right return value where an alternative init function was being used. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7983)
2019-01-03Eliminate unused buffers from ssl3_change_cipher_stateDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7971) (cherry picked from commit 9c5ef4ea486f675f33592b34775c3e453f60ee69)
2019-01-03Remove unused variables from tls1_change_cipher_stateDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7971) (cherry picked from commit d072eea2e39c4444ecce3598556053a4c552d9a2)
2018-12-30Fix a minor nit in the hkdflabel sizeBernd Edlinger
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7913) (cherry picked from commit 0b4233f5a4a181a6dcb7c511cd2663e500e659a4)
2018-12-05Fix some SSL_export_keying_material() issuesMatt Caswell
Fix some issues in tls13_hkdf_expand() which impact the above function for TLSv1.3. In particular test that we can use the maximum label length in TLSv1.3. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7755) (cherry picked from commit 0fb2815b873304d145ed00283454fc9f3bd35e6b)
2018-12-05Revert "Reduce stack usage in tls13_hkdf_expand"Matt Caswell
This reverts commit ec0c5f5693e39c5a013f81e6dd9dfd09ec65162d. SSL_export_keying_material() may use longer label lengths. Fixes #7712 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7755) (cherry picked from commit ed371b8cbac0d0349667558c061c1ae380cf75eb)
2018-11-27Fix access zero memory if SSL_DEBUG is enabledPaul Yang
If compile OpenSSL with SSL_DEBUG macro, some test cases will cause the process crashed in the debug code. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7707) (cherry picked from commit 5a4481f0e0bbf836c7f41805e84617784cb6b1db)
2018-11-24Honour mandatory digest on private key in has_usable_cert()David Woodhouse
If the private key says it can only support one specific digest, then don't ask it to perform a different one. Fixes: #7348 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 2d263a4a73f852005b16359873475d48755999ad) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7609)
2018-11-22Fix wrong return value in ssl3_ctx_ctrlPaul Yang
This fixes issue #7677 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7678)
2018-11-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7669)
2018-11-14Fix no-ec and no-tls1_2Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7620) (cherry picked from commit 65d2c16cbe0da8efed2f285f59930297326fb435)
2018-11-12Added missing signature algorithm reflection functionsViktor Dukhovni
SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-12Separate ca_names handling for client and serverMatt Caswell
SSL(_CTX)?_set_client_CA_list() was a server side only function in 1.1.0. If it was called on the client side then it was ignored. In 1.1.1 it now makes sense to have a CA list defined for both client and server (the client now sends it the the TLSv1.3 certificate_authorities extension). Unfortunately some applications were using the same SSL_CTX for both clients and servers and this resulted in some client ClientHellos being excessively large due to the number of certificate authorities being sent. This commit seperates out the CA list updated by SSL(_CTX)?_set_client_CA_list() and the more generic SSL(_CTX)?_set0_CA_list(). This means that SSL(_CTX)?_set_client_CA_list() still has no effect on the client side. If both CA lists are set then SSL(_CTX)?_set_client_CA_list() takes priority. Fixes #7411 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7503) (cherry picked from commit 98732979001dbb59320803713c4c91ba40234250)
2018-11-12Don't negotiate TLSv1.3 if our EC cert isn't TLSv1.3 capableMatt Caswell
TLSv1.3 is more restrictive about the curve used. There must be a matching sig alg defined for that curve. Therefore if we are using some other curve in our certificate then we should not negotiate TLSv1.3. Fixes #7435 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7442) (cherry picked from commit de4dc598024fd0a9c2b7a466fd5323755d369522)
2018-11-10Unbreak SECLEVEL 3 regression causing it to not accept any ciphers.Tomas Mraz
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #7391 (cherry picked from commit 75b68c9e4e8591a4ebe083cb207aeb121baf549f)
2018-11-08Give a better error if an attempt is made to set a zero length groups listMatt Caswell
Previously we indicated this as a malloc failure which isn't very helpful. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7479) (cherry picked from commit 680bd131b69d57e891888ab70d300176a5a16617)
2018-11-08Ignore disabled ciphers when deciding if we are using ECCMatt Caswell
use_ecc() was always returning 1 because there are default (TLSv1.3) ciphersuites that use ECC - even if those ciphersuites are disabled by other options. Fixes #7471 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7479) (cherry picked from commit 589b6227a85ea0133fe91d744b16dd72edee929a)
2018-11-06Fix return formatting.Pauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7564) (cherry picked from commit 2087028612027368e9508e1b253aab715a5a35d6)
2018-11-06Cleanse the key log buffer.Pauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7564) (cherry picked from commit e931f370aa38d8645b35fb8d6260cb44d37b6b61)
2018-11-03Restore sensible "sess_accept" counter trackingBenjamin Kaduk
Commit 9ef9088c1585e13b9727796f15f77da64dbbe623 switched the SSL/SSL_CTX statistics counters to using Thread-Sanitizer-friendly primitives. However, it erroneously converted an addition of -1 (for s->session_ctx->stats.sess_accept) to an addition of +1, since that is the only counter API provided by the internal tsan_assist.h header until the previous commit. This means that for each accepted (initial) connection, the session_ctx's counter would get doubly incremented, and the (switched) ctx's counter would also get incremented. Restore the counter decrement so that each accepted connection increments exactly one counter exactly once (in net effect). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7464) (cherry picked from commit 2aaa0b146b967397a6e61fa8df969e7847f82086)
2018-10-30Don't call the client_cert_cb immediately in TLSv1.3Matt Caswell
In TLSv1.2 and below a CertificateRequest is sent after the Certificate from the server. This means that by the time the client_cert_cb is called on receipt of the CertificateRequest a call to SSL_get_peer_certificate() will return the server certificate as expected. In TLSv1.3 a CertificateRequest is sent before a Certificate message so calling SSL_get_peer_certificate() returns NULL. To workaround this we delay calling the client_cert_cb until after we have processed the CertificateVerify message, when we are doing TLSv1.3. Fixes #7384 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7413) (cherry picked from commit e45620140fce22c3251440063bc17440289d730c)
2018-10-29ssl/statem: Don't compare size_t with less than zeroRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7194) (cherry picked from commit 60690b5b8396d7d5234cd067206190fb8aca78d2)
2018-10-26Properly handle duplicated messages from the next epochMatt Caswell
Since 1fb9fdc30 we may attempt to buffer a record from the next epoch that has already been buffered. Prior to that this never occurred. We simply ignore a failure to buffer a duplicated record. Fixes #6902 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7414) (cherry picked from commit 840facc3ccab481e1a0bc2cb6e7740e362df7422)
2018-10-19Buffer a ClientHello with a cookie received via DTLSv1_listenMatt Caswell
Previously when a ClientHello arrives with a valid cookie using DTLSv1_listen() we only "peeked" at the message and left it on the underlying fd. This works fine for single threaded applications but for multi-threaded apps this does not work since the fd is typically reused for the server thread, while a new fd is created and connected for the client. By "peeking" we leave the message on the server fd, and consequently we think we've received another valid ClientHello and so we create yet another fd for the client, and so on until we run out of fds. In this new approach we remove the ClientHello and buffer it in the SSL object. Fixes #6934 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7375) (cherry picked from commit 079ef6bd534d2f708d8013cfcd8ea0d2f600c788)
2018-10-19Use the read and write buffers in DTLSv1_listen()Matt Caswell
Rather than using init_buf we use the record layer read and write buffers in DTLSv1_listen(). These seem more appropriate anyway and will help with the next commit. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7375) (cherry picked from commit 2fc4c77c3f06443f4c476f6f58d83e5e108d1dce)
2018-10-19Fix a DTLS memory leakMatt Caswell
Fixes #7428 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7431) (cherry picked from commit 01666a8c1db3ecfb999e1a8f2c5436d114f95681)
2018-10-19Fix tls_cbc_digest_record is slow using SHA-384 and short messagesarmfazh
The formula used for this is now kVarianceBlocks = ((255 + 1 + md_size + md_block_size - 1) / md_block_size) + 1 Notice that md_block_size=64 for SHA256, which results on the magic constant kVarianceBlocks = 6. However, md_block_size=128 for SHA384 leading to kVarianceBlocks = 4. CLA:trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7342) (cherry picked from commit cb8164b05e3bad5586c2a109bbdbab1ad65a1a6f)
2018-10-17Add a missing check on s->s3->tmp.pkeyMansour Ahmadi
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7405) (cherry picked from commit 61bef9bde09dc6099a7c59baa79898e3b003fec3)
2018-10-15Fix no-pskMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7306) (cherry picked from commit 734af93a278a7a06710167219e1f05e525c9dd49)
2018-10-12ssl/s3_enc.c: fix logical errors in ssl3_final_finish_mac.Andy Polyakov
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7085) (cherry picked from commit 7d0effeacbb50b12bfc24df7614d7cf5c8686f51)
2018-09-24Reduce stack usage in tls13_hkdf_expandBernd Edlinger
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7297) (cherry picked from commit ec0c5f5693e39c5a013f81e6dd9dfd09ec65162d)
2018-09-21Fix the max psk len for TLSv1.3Matt Caswell
If using an old style TLSv1.2 PSK callback then the maximum possible PSK len is PSK_MAX_PSK_LEN (256) - not 64. Fixes #7261 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7267) (cherry picked from commit f39a02c68abc8936db24499cb3cfcba206a2e7eb)
2018-09-21Delay setting the sig algs until after the cert_cb has been calledMatt Caswell
Otherwise the sig algs are reset if SSL_set_SSL_CTX() gets called. Fixes #7244 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7257) (cherry picked from commit 524006dd1b80c1a86a20119ad988666a80d8d8f5)
2018-09-19Reset TLS 1.3 ciphers in SSL_CTX_set_ssl_version()Benjamin Kaduk
Historically SSL_CTX_set_ssl_version() has reset the cipher list to the default. Splitting TLS 1.3 ciphers to be tracked separately caused a behavior change, in that TLS 1.3 cipher configuration was preserved across calls to SSL_CTX_set_ssl_version(). To restore commensurate behavior with the historical behavior, set the ciphersuites to the default as well as setting the cipher list to the default. Closes: #7226 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7270) (cherry picked from commit 2340ed277b7c5365e83a32eb7d5fa32c4071fb21)
2018-09-18ssl/ssl_ciph.c: make set_ciphersuites staticDr. Matthias St. Pierre
Fixes #7252 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7253) (cherry picked from commit f9a22815f386dbe7a13822f0ac3629ae8521cd76)
2018-09-12Fix a possible recursion in SSLfatal handlingBernd Edlinger
Fixes: #7161 (hopefully) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7175) (cherry picked from commit 6839a7a7f4973a3fc2f87b12664c26d524bef1f4)
2018-09-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7176)
2018-09-07Do not reset SNI data in SSL_do_handshake()Matt Caswell
PR #3783 introduce coded to reset the server side SNI state in SSL_do_handshake() to ensure any erroneous config time SNI changes are cleared. Unfortunately SSL_do_handshake() can be called mid-handshake multiple times so this is the wrong place to do this and can mean that any SNI data is cleared later on in the handshake too. Therefore move the code to a more appropriate place. Fixes #7014 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7149)
2018-09-07Simplify SSL_get_servername() to avoid session referencesBen Kaduk
Ideally, SSL_get_servername() would do exactly as it is documented and return exactly what the client sent (i.e., what we currently are stashing in the SSL's ext.hostname), without needing to refer to an SSL_SESSION object. For historical reasons, including the parsed SNI value from the ClientHello originally being stored in the SSL_SESSION's ext.hostname field, we have had references to the SSL_SESSION in this function. We cannot fully excise them due to the interaction between user-supplied callbacks and TLS 1.2 resumption flows, where we call all callbacks but the client did not supply an SNI value. Existing callbacks expect to receive a valid SNI value in this case, so we must fake one up from the resumed session in order to avoid breakage. Otherwise, greatly simplify the implementation and just return the value in the SSL, as sent by the client. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7115)
2018-09-07Restore historical SSL_get_servername() behaviorBen Kaduk
Commit 1c4aa31d79821dee9be98e915159d52cc30d8403 modified the state machine to clean up stale ext.hostname values from SSL objects in the case when SNI was not negotiated for the current handshake. This is natural from the TLS perspective, since this information is an extension that the client offered but we ignored, and since we ignored it we do not need to keep it around for anything else. However, as documented in https://github.com/openssl/openssl/issues/7014 , there appear to be some deployed code that relies on retrieving such an ignored SNI value from the client, after the handshake has completed. Because the 1.1.1 release is on a stable branch and should preserve the published ABI, restore the historical behavior by retaining the ext.hostname value sent by the client, in the SSL structure, for subsequent retrieval. [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7115)
2018-09-07Ensure certificate callbacks work correctly in TLSv1.3Matt Caswell
The is_tls13_capable() function should not return 0 if no certificates are configured directly because a certificate callback is present. Fixes #7140 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7141)
2018-09-07Process KeyUpdate and NewSessionTicket messages after a close_notifyMatt Caswell
If we've sent a close_notify then we are restricted about what we can do in response to handshake messages that we receive. However we can sensibly process NewSessionTicket messages. We can also process a KeyUpdate message as long as we also ignore any request for us to update our sending keys. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7114)
2018-09-05key zeroization fix for a branch path of tls13_final_finish_macShane Lontis
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7110)
2018-09-04Don't use an RSA-PSS cert for RSA key exchangeMatt Caswell
If we have selected a ciphersuite using RSA key exchange then we must not attempt to use an RSA-PSS cert for that. Fixes #7059 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7099)
2018-09-04Send a NewSessionTicket after using an external PSKMatt Caswell
Treat a connection using an external PSK like we would a resumption and send a single NewSessionTicket afterwards. Fixes #6941 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7097)
2018-09-04Ignore EPIPE when sending NewSessionTickets in TLSv1.3Matt Caswell
If a client sends data to a server and then immediately closes without waiting to read the NewSessionTickets then the server can receive EPIPE when trying to write the tickets and never gets the opportunity to read the data that was sent. Therefore we ignore EPIPE when writing out the tickets in TLSv1.3 Fixes #6904 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6944)
2018-09-03Rename SSL[_CTX]_add1_CA_list -> SSL[_CTX]_add1_to_CA_listRichard Levitte
They add a single item, so the names give a false impression of what they do, making them hard to remember. Better to give them a somewhat better name. Fixes #6930 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6931)
2018-09-01Fix ssl/t1_trce.c to parse certificate chainsErik Forsberg
Fixes #6994 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7009)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-26 20:43:14 +0000