summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2013-11-06Enable PSK in FIPS mode.Dr. Stephen Henson
Enable PSK ciphersuites with AES or DES3 in FIPS mode. (cherry picked from commit e0ffd129c16af90eb5e2ce54e57832c0046d1aaf)
2013-11-02Add brainpool curves to trace output.Dr. Stephen Henson
2013-11-02Fix warning.Dr. Stephen Henson
(cherry picked from commit 96e16bddb42563dc09187939dc20b35369d413b7)
2013-11-02Add SSL_CONF command to set DH Parameters.Dr. Stephen Henson
(cherry picked from commit c557f921dcb20a1bf2ce75e9dc7dd164e59ec3ea)
2013-11-02Fix argument processing.Dr. Stephen Henson
(cherry picked from commit abf840e4f71c3a8795428c213fd37ece2a910443)
2013-11-02Constification.Dr. Stephen Henson
(cherry picked from commit 27f3b65f49ea91fcf4b46ec0298be51b4207214a)
2013-11-02Extend SSL_CONFDr. Stephen Henson
Extend SSL_CONF to return command value types. Add certificate and key options. Update documentation. (cherry picked from commit ec2f7e568ea18a22ab57326fffe78ef2aa6884f5)
2013-11-02Typo.Dr. Stephen Henson
(cherry picked from commit 13af1451595b514524b0efc17f99f6392ce090d5)
2013-11-01Fix SSL_OP_SINGLE_ECDH_USEPiotr Sikora
Don't require a public key in tls1_set_ec_id if compression status is not needed. This fixes a bug where SSL_OP_SINGLE_ECDH_USE wouldn't work.
2013-11-01Add -ecdh_single option.Dr. Stephen Henson
Add -ecdh_single option to set SSL_OP_SINGLE_ECDH_USE on the command line.
2013-10-30DTLS/SCTP Finished Auth BugRobin Seggelmann
PR: 2808 With DTLS/SCTP the SCTP extension SCTP-AUTH is used to protect DATA and FORWARD-TSN chunks. The key for this extension is derived from the master secret and changed with the next ChangeCipherSpec, whenever a new key has been negotiated. The following Finished then already uses the new key. Unfortunately, the ChangeCipherSpec and Finished are part of the same flight as the ClientKeyExchange, which is necessary for the computation of the new secret. Hence, these messages are sent immediately following each other, leaving the server very little time to compute the new secret and pass it to SCTP before the finished arrives. So the Finished is likely to be discarded by SCTP and a retransmission becomes necessary. To prevent this issue, the Finished of the client is still sent with the old key.
2013-10-21Remove unused variable.Ben Laurie
2013-10-20Fix another gmt_unix_time case in server_randomNick Mathewson
2013-10-20Do not include a timestamp in the Client/ServerHello Random field.Nick Mathewson
Instead, send random bytes, unless SSL_SEND_{CLIENT,SERVER}RANDOM_MODE is set. This is a forward-port of commits: 4af793036f6ef4f0a1078e5d7155426a98d50e37 f4c93b46edb51da71f09eda99e83eaf193a33c08 3da721dac9382c48812c8eba455528fd59af2eef 2583270191a8b27eed303c03ece1da97b9b69fd3 While the gmt_unix_time record was added in an ostensible attempt to mitigate the dangers of a bad RNG, its presence leaks the host's view of the current time in the clear. This minor leak can help fingerprint TLS instances across networks and protocols... and what's worse, it's doubtful thet the gmt_unix_time record does any good at all for its intended purpose, since: * It's quite possible to open two TLS connections in one second. * If the PRNG output is prone to repeat itself, ephemeral handshakes (and who knows what else besides) are broken.
2013-10-20Prevent use of RSA+MD5 in TLS 1.2 by default.Dr. Stephen Henson
Removing RSA+MD5 from the default signature algorithm list prevents its use by default. If a broken implementation attempts to use RSA+MD5 anyway the sanity checking of signature algorithms will cause a fatal alert. (cherry picked from commit 77a0f740d00ecf8f6b01c0685a2f858c3f65a3dd)
2013-10-15Add brainpool curves to NID table too.Dr. Stephen Henson
(cherry picked from commit 6699cb84912f0d7c04acbf91c3e3dbdae5929857)
2013-10-15RFC7027 (Brainpool for TLS) support.Dr. Stephen Henson
(cherry picked from commit 695e8c36528f9c3275f5f56e9633ac6a0c11f2e3)
2013-10-01Re-add accidentally deleted #endif.Ben Laurie
2013-10-01Merge remote-tracking branch 'agl/1.0.2alpn' into agl-alpnBen Laurie
Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-09-24Show useful errors.Ben Laurie
2013-09-20Merge remote-tracking branch 'trevp/pemfix' into trev-pem-fixBen Laurie
2013-09-18DTLS version usage fixes.Dr. Stephen Henson
Make DTLS behave like TLS when negotiating version: record layer has DTLS 1.0, message version is 1.2. Tolerate different version numbers if version hasn't been negotiated yet. (cherry picked from commit 40088d8b8190a2a33828a769c23bf35de542c7dc)
2013-09-18DTLS trace support.Dr. Stephen Henson
Add DTLS record header parsing, different client hello format and add HelloVerifyRequest message type. Add code to d1_pkt.c to send message headers to the message callback. (cherry picked from commit 890f2f8b92b385ef3898cdb4a15a071ffcf8107f) Conflicts: ssl/ssl_locl.h
2013-09-18Suite B support for DTLS 1.2Dr. Stephen Henson
Check for Suite B support using method flags instead of version numbers: anything supporting TLS 1.2 cipher suites will also support Suite B. Return an error if an attempt to use DTLS 1.0 is made in Suite B mode. (cherry picked from commit 4544f0a69161a37ee3edce3cc1bc34c3678a4d64)
2013-09-18Always return errors in ssl3_get_client_helloDr. Stephen Henson
If we successfully match a cookie don't set return value to 2 as this results in other error conditions returning 2 as well. Instead set return value to -2 which can be checked later if everything else is OK. (cherry picked from commit c56f5b8edfbcec704f924870daddd96a5f768fbb)
2013-09-18Dual DTLS version methods.Dr. Stephen Henson
Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2. (cherry picked from commit c6913eeb762edffddecaaba5c84909d7a7962927) Conflicts: CHANGES
2013-09-18Enable TLS 1.2 ciphers in DTLS 1.2.Dr. Stephen Henson
Port TLS 1.2 GCM code to DTLS. Enable use of TLS 1.2 only ciphers when in DTLS 1.2 mode too. (cherry picked from commit 4221c0dd3004117c63b182af5e8ab345b7265902)
2013-09-18Update fixed DH requirements.Dr. Stephen Henson
The relaxed signing requirements for fixed DH certificates apply to DTLS 1.2 too. (cherry picked from commit fbbaaccaca32742f09dfb02e5e28dcd20f64a17f)
2013-09-18DTLS 1.2 cached record support.Dr. Stephen Henson
Add DTLS1.2 support for cached records when computing handshake macs instead of the MD5+SHA1 case for DTLS < 1.2 (this is a port of the equivalent TLS 1.2 code to DTLS). (cherry picked from commit 04fac50045929e7078cad4835478dd7f16b6d4bd)
2013-09-18Provisional DTLS 1.2 support.Dr. Stephen Henson
Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing. (cherry picked from commit c3b344e36a088283731b4f65a70e85b100f55686) Conflicts: apps/s_server.c
2013-09-18Remove versions test from dtls1_buffer_messageDr. Stephen Henson
Since this is always called from DTLS code it is safe to assume the header length should be the DTLS value. This avoids the need to check the version number and should work with any version of DTLS (not just 1.0). (cherry picked from commit 9cf0f187542f080031f83c5e538d3e1872ac09d1)
2013-09-18Extend DTLS method macros.Dr. Stephen Henson
Extend DTLS method creation macros to support version numbers and encryption methods. Update existing code. (cherry picked from commit cfd298b7aef2b095bee8d172a6a40d6c59d1574b)
2013-09-18Enable various DTLS extensions.Dr. Stephen Henson
Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again. (cherry picked from commit 874a18cfadc6bac0ad73482325f2ca72dfccdb82)
2013-09-18Use enc_flags when deciding protocol variations.Dr. Stephen Henson
Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement. (cherry picked from commit cbd64894ec687c6f37d8e43c16dff78e63f6be87) Conflicts: ssl/ssl_locl.h
2013-09-18Use appropriate versions of SSL3_ENC_METHODDr. Stephen Henson
(cherry picked from commit 6de2649a6b349bde9c9fb62c3a3d5d6344d8259c)
2013-09-18DTLS revision.Dr. Stephen Henson
Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. (cherry picked from commit 173e72e64c6a07ae97660c322396b66215009f33)
2013-09-16Various custom extension fixes.Trevor Perrin
Force no SSL2 when custom extensions in use. Don't clear extension state when cert is set. Clear on renegotiate. Conflicts: ssl/t1_lib.c
2013-09-16Tidy up comments.Rob Stradling
2013-09-16Use TLS version supplied by client when fingerprinting Safari.Rob Stradling
2013-09-16Fix compilation with no-ec and/or no-tlsext.Rob Stradling
2013-09-16Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.Rob Stradling
OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-14Add missing code from SSL_CONF backport.Dr. Stephen Henson
2013-09-13Add tests for ALPN functionality.Adam Langley
Cherry-picked from a898936218bc279b5d7cdf76d58a25e7a2d419cb.
2013-09-13Support ALPN.Adam Langley
This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. Cherry-picked from 6f017a8f9db3a79f3a3406cf8d493ccd346db691. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00
2013-08-19Make no-ec compilation work.Dr. Stephen Henson
(cherry picked from commit 14536c8c9c0abb894afcadb9a58b4b29fc8f7a4d)
2013-08-18Return 1 when setting ECDH auto mode.Dr. Stephen Henson
(cherry picked from commit 42082eda6f3d64ce87184d65c4eae06d677e971c)
2013-08-13DTLS message_sequence number wrong in rehandshake ServerHelloMichael Tuexen
This fix ensures that * A HelloRequest is retransmitted if not responded by a ClientHello * The HelloRequest "consumes" the sequence number 0. The subsequent ServerHello uses the sequence number 1. * The client also expects the sequence number of the ServerHello to be 1 if a HelloRequest was received earlier. This patch fixes the RFC violation. (cherry picked from commit b62f4daac00303280361924b9cc19b3e27528b15)
2013-08-08DTLS handshake fix.Michael Tuexen
Reported by: Prashant Jaikumar <rmstar@gmail.com> Fix handling of application data received before a handshake. (cherry picked from commit 0c75eeacd3285b395dc75b65c3e6fe6ffbef59f0)
2013-07-31Cosmetic touchups.Trevor
2013-07-03Trying cherrypick:Trevor
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin. Conflicts: CHANGES ssl/ssl.h ssl/ssltest.c test/testssl Fix compilation due to #endif. Cherrypicking more stuff. Cleanup of custom extension stuff. serverinfo rejects non-empty extensions. Omit extension if no relevant serverinfo data. Improve error-handling in serverinfo callback. Cosmetic cleanups. s_client documentation. s_server documentation. SSL_CTX_serverinfo documentation. Cleaup -1 and NULL callback handling for custom extensions, add tests. Cleanup ssl_rsa.c serverinfo code. Whitespace cleanup. Improve comments in ssl.h for serverinfo. Whitespace. Cosmetic cleanup. Reject non-zero-len serverinfo extensions. Whitespace. Make it build. Conflicts: test/testssl
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-24 06:57:35 +0000