summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2016-11-09Make some CLIENTHELLO_MSG function arguments constMatt Caswell
There were a few places where they could be declared const so this commit does that. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Update a commentMatt Caswell
The name and type of the argument to ssl_check_for_safari() has changed. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Swap back to using SSL3_RANDOM_SIZE instead of sizeof(clienthello.random)Matt Caswell
The size if fixed by the protocol and won't change even if sizeof(clienthello.random) does. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Move setting the session_id_len until after we filled the session_idMatt Caswell
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Load the sessionid directly in SSLv2 compat ClientHelloMatt Caswell
Don't use a sub-packet, just load it. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Rename clienthello.version to clienthello.legacy_versionMatt Caswell
For consistency with the TLSv1.3 spec. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix some minor style issuesMatt Caswell
Add a blank line, take one away - due to feedback received during review. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add some function documentation and update some existing commentsMatt Caswell
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix make update following extensions refactorMatt Caswell
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Improve some comment documentation following the extensions refactorMatt Caswell
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix various style issues in the extension parsing refactorMatt Caswell
Based on review feedback received. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Use an explicit name for the struct for definition of RAW_EXTENSIONMatt Caswell
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix a memory leak in the ClientHello extension parsingMatt Caswell
We should be freeing up the raw extension data after we've finished with it. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Handle compression methods correctly with SSLv2 compat ClientHelloMatt Caswell
In the case of an SSLv2 compat ClientHello we weren't setting up the compression methods correctly, which could lead to uninit reads or crashes. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Refactor ClientHello processing so that extensions get parsed earlierMatt Caswell
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Partial revert of "Fix client verify mode to check SSL_VERIFY_PEER"Matt Caswell
This partially reverts commit c636c1c47. It also tweaks the documentation and comments in this area. On the client side the documented interface for SSL_CTX_set_verify()/SSL_set_verify() is that setting the flag SSL_VERIFY_PEER causes verfication of the server certificate to take place. Previously what was implemented was that if *any* flag was set then verification would take place. The above commit improved the semantics to be as per the documented interface. However, we have had a report of at least one application where an application was incorrectly using the interface and used *only* SSL_VERIFY_FAIL_IF_NO_PEER_CERT on the client side. In OpenSSL prior to the above commit this still caused verification of the server certificate to take place. After this commit the application silently failed to verify the server certificate. Ideally SSL_CTX_set_verify()/SSL_set_verify() could be modified to indicate if invalid flags were being used. However these are void functions! The simplest short term solution is to revert to the previous behaviour which at least means we "fail closed" rather than "fail open". Thanks to Cory Benfield for reporting this issue. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-07Ignore the record version in TLS1.3Matt Caswell
The record layer version field must be ignored in TLSv1.3, so we remove the check when using that version. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Correct the Id for the TLS1.3 ciphersuiteMatt Caswell
We have one TLS1.3 ciphersuite, but there is a typo in the id that should be corrected. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Always ensure that init_msg is initialised for a CCSMatt Caswell
We read it later in grow_init_buf(). If CCS is the first thing received in a flight, then it will use the init_msg from the last flight we received. If the init_buf has been grown in the meantime then it will point to some arbitrary other memory location. This is likely to result in grow_init_buf() attempting to grow to some excessively large amount which is likely to fail. In practice this should never happen because the only time we receive a CCS as the first thing in a flight is in an abbreviated handshake. None of the preceding messages from the server flight would be large enough to trigger this. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix a missed size_t variable declarationMatt Caswell
pqueue_size() now returns a size_t, but the variable that gets returned was still declared as an int. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some style issues from libssl size_tify reviewMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Rename all "read" variables with "readbytes"Matt Caswell
Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix a shadowed variable declaration warning picked up by TravisMatt Caswell
Rename "read" to "readbytes" Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Test the size_t constant time functionsMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Ensure SSL_DEBUG works following size_t changesMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some bogus warnings about uninitialised variablesMatt Caswell
Travis was failing in some builds due to a bogus complaint about uninit variables. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Remove a stray TODO that has already been fixedMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Provide some constant time functions for dealing with size_t valuesMatt Caswell
Also implement the using of them Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Now that we can use size_t in PACKET lets use itMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix misc size_t issues causing Windows warnings in 64 bitMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert the mac functions to just return 1 for success and 0 for failureMatt Caswell
Previously they return -1 for failure or the size of the mac. But the size was never used anywhere. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some ssl3_record code witch converstion to/from size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Add some PACKET functions for size_tMatt Caswell
And use them in the DTLS code Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert SSL BIO to use SSL_write_ex().Matt Caswell
We also modify the SSL_get_error() function to handle the fact that with SSL_write_ex() the error return is 0 not -1, and fix some bugs in the SSL BIO reading. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some missed size_t updatesMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Resolve some outstanding size_t related TODOsMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Update misc function params in libssl for size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert some libssl local functions to size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Update cookie_len for size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Update numerous misc libssl fields to be size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert session_id_length and sid_ctx_len to size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert master_secret_size code to size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert various mac_secret_size usage to size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert ssl3_cbc_digest_record for size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert some misc record layer functions for size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert SSL3_RECORD_clear() and SSL3_RECORD_release() to size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert libssl writing for size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Further libssl size_t-ify of readingMatt Caswell
Writing still to be done Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert record layer to use size_tMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02Fail if an unrecognised record type is receivedMatt Caswell
TLS1.0 and TLS1.1 say you SHOULD ignore unrecognised record types, but TLS 1.2 says you MUST send an unexpected message alert. We swap to the TLS 1.2 behaviour for all protocol versions to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. Issue reported by 郭志攀 Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-13 02:51:20 +0000