summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2022-11-16QUIC tx record layer: use list.hPauli
As opposed to implementing a linked list explicitly. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/19377)
2022-11-16uint_set: convert uint_set to use the list data typePauli
This is instead of re-implementing a linked list itself. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/19377)
2022-11-14Resolve a TODO in ssl3_dispatch_alertMatt Caswell
Properly handle the case where there is pending write data and we want to send an alert. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19550)
2022-11-14Plug the QUIC_RSTREAM to the RX depacketizerTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19351)
2022-11-14QUIC Receive Stream Management: Call QUIC flow controlTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19351)
2022-11-14QUIC Receive Stream ManagementTomas Mraz
Added SFRAME_LIST structure and QUIC_RSTREAM object to manage received stream data. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19351)
2022-11-14Fix memory leak when freeing the DTLS record layerMatt Caswell
We need to check whether the sent_messages has actually buffered any messages in it. If not we won't free the old record layer later when we clear out the old buffered messages and a memory leak will result. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Rename SSL3_RECORD to TLS_RL_RECORDMatt Caswell
The SSL3 prefix no longer seems appropriate. We choose TLS_RL_RECORD instead of TLS_RECORD because that type already exists elsewhere. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Rename SSL3_BUFFER to TLS_BUFFERMatt Caswell
The SSL3 prefix no longer seems appropriate. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Move declarations out of record.h and record_local.hMatt Caswell
We move many of the declarations in record.h and record_local.h into locations inside ssl/record/methods instead. Also many declarations were no longer required and could be removed completely. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Move tls_pad.c into ssl/record/methodsMatt Caswell
This file is used by libssl record layer methods and therefore should now be in the methods subdir Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove references to read_mac_secret and write_mac_secretMatt Caswell
They are no longer used and can be removed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove the read_iv/write_iv fields from SSL_CONNECTIONMatt Caswell
These fields are instead held in the new record layer code and are therefore no longer needed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove compress/expand fields from SSL_CONNECTIONMatt Caswell
They are no longer needed. The new record layer handles this. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove remaining refs to enc_(write|read)_ctx/(read|write)_hashMatt Caswell
Those fields are no longer used. Their previous function is now in the new record layer. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14use OSSL_PARAM_construct_uint32 for max_early_dataJ.W. Jagersma
Otherwise, this causes a warning on platforms where 'uint32_t' is defined as 'unsigned long int' instead of 'unsigned int'. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
2022-11-14Cast values to match printf format strings.J.W. Jagersma
For some reason djgpp uses '(unsigned) long int' for (u)int32_t. This causes errors with -Werror=format, even though these types are in practice identical. Obvious solution: cast to the types indicated by the format string. For asn1_time_test.c I changed the format string to %lli since time_t may be 'long long' some platforms. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19322)
2022-11-08Fix CertificateCompressionAlgorithm to be read as 2-octet-wideAlexander Sosedkin
CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19600)
2022-11-07QUIC CFQ FixesHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
2022-11-07QUIC FIFDHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
2022-11-07QUIC TXPIMHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
2022-11-07QUIC CFQHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19206)
2022-11-07Use the same encryption growth macro consistentlyMatt Caswell
We had two different macros for calculating the potential growth due to encryption. The macro we use for allocating the underlying buffer should be the same one that we use for reserving bytes for encryption growth. Also if we are adding the MAC independently of the cipher algorithm then the encryption growth will not include that MAC so we should remove it from the amount of bytes that we reserve for that growth. Otherwise we might exceed our buffer size and the WPACKET_reserve operation will fail. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19622)
2022-11-07Assert that we do not exceed the DTLS MTUMatt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19516)
2022-11-07Fix dtls_get_max_record_overhead()Matt Caswell
We fix dtls_get_max_record_overhead() to give a better value for the max record overhead. We can't realistically handle the compression case so we just ignore that. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19516)
2022-11-07Fix the ceiling on how much encryption growth we can haveMatt Caswell
Stitched ciphersuites can grow by more during encryption than the code allowed for. We fix the calculation and add an assert to check we go it right. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19516)
2022-11-07Add zlib oneshot compressionTodd Short
Fixes #19520 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19603)
2022-11-02Fix coverity 1516093 tainted scalarTodd Short
|uclen| is created from three byte values, so this seems a bit redundant, but if it makes coverity happy Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19519)
2022-11-02Fix read pipeliningMatt Caswell
During read pipelining we must ensure that the buffer is sufficiently large to read enough data to fill our pipelines. We also remove some code that moved data to the start of the packet if we can. This was unnecessary because of later code which would end up moving it anyway. The earlier move was also incorrect in the case that |clearold| was 0. This would cause the read pipelining code to fail with sufficiently large records. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19456)
2022-11-02Pipeline output/input buf arrays must live until the EVP_Cipher is calledMatt Caswell
The pipeline input/output buf arrays must remain accessible to the EVP_CIPHER_CTX until EVP_Cipher is subsequently called. This fixes an asan error discovered by the newly added pipeline test. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19456)
2022-11-02Add a test for TLS pipeliningMatt Caswell
TLS pipelining provides the ability for libssl to read or write multiple records in parallel. It requires special ciphers to do this, and there are currently no built-in ciphers that provide this capability. However, the dasync engine does have such a cipher, so we add a test for this capability using that engine. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19456)
2022-10-27Remove some unused OSSL_RECORD_METHOD functionsMatt Caswell
Remove two function pointers from the OSSL_RECORD_METHOD. Those functions were no-ops and were never called. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19472)
2022-10-27Make SSL_alloc_buffers() and SSL_free_buffers() work againMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19472)
2022-10-26ssl_cipher_process_rulestr: don't read outside rule_str bufferTodd C. Miller
If rule_str ended in a "-", "l" was incremented one byte past the end of the buffer. This resulted in an out-of-bounds read when "l" is dereferenced at the end of the loop. It is safest to just return early in this case since the condition occurs inside a nested loop. CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19166)
2022-10-25Fix 32-bit Windows issues related to QUIC Wire functionsRichard Levitte
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19345)
2022-10-25Fix 32-bit Windows issues related to QUIC_STREAMRichard Levitte
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19345)
2022-10-25Fix 32-bit Windows issues related to QUIC_ACKM / QUIC_CCRichard Levitte
The re-occuring surprise is that in Win32, size_t is 32 bits... Fixed by changing size_t to uint64_t in QUIC_CC Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19345)
2022-10-25Fix definitions of SHUT_RD and SHUT_WRRichard Levitte
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19345)
2022-10-25Fix test_tls13_encryption()Matt Caswell
This test was disabled during the record write record layer refactor. We can now enable it again. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19470)
2022-10-24Fix coverity 1516101 deadcodeDaniel Fiala
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19464)
2022-10-21stack: Do not add error if pop/shift/value accesses outside of the stackTomas Mraz
This partially reverts commit 30eba7f35983a917f1007bce45040c0af3442e42. This is legitimate use of the stack functions and no error should be reported apart from the NULL return value. Fixes #19389 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19400)
2022-10-21Fix coverity 1516094 uninitTodd Short
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19440)
2022-10-21Fix coverity 1516093 tainted scalarTodd Short
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19440)
2022-10-20Move freeing of BIOs as late as possibleMatt Caswell
Calling SSL_free() will call BIO_free_all() on the rbio and wbio. We keep references to the rbio and wbio inside the record layer object. References to that object are held directly, as well as in fragment retransmission queues. We need to ensure all record layer objects are cleaned up before we call BIO_free_all() on rbio/wbio - otherwise the "top" BIO may not have its reference count drop to 0 when BIO_free_all() is called. This means that the rest of the BIOs in the chain don't get freed and a memory leak can occur. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Remove some redundant codeMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Remove the old buffer management codeMatt Caswell
We no longer use the old buffer management code now that it has all been moved to the new record layer. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Remove some TODO(RECLAYER) comments now that DTLS has been movedMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Remove dtls_write_recordsMatt Caswell
The dtls_write_records function, after the previous series of commits, was functionally equivalent to tls_write_records_default - so it can be removed completely. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Move sequence increment to post encryption processingMatt Caswell
This change make dtls_write_records virtuall the same as tls_write_records_default, which will enable us to merge them in a subsequent commit. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Remove supurious set of the record typeMatt Caswell
We already set the record type on the SSL3_RECORD structure. We don't need to do it again (inconsistently). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-06 18:40:54 +0000