aboutsummaryrefslogtreecommitdiff
path: root/ssl/d1_lib.c
AgeCommit message (Collapse)AuthorFilesLines
2017-12-08More record layer conversions to use SSLfatal()Matt Caswell1-2/+6
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4841)
2017-10-18Remove parentheses of return.KaoruToda1-1/+1
Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-09-06add callback handler for setting DTLS timer intervalAlfred E. Heggestad1-8/+41
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4011)
2017-09-01struct timeval include guardsPauli1-6/+0
Move struct timeval includes into e_os.h (where the Windows ones were). Enaure that the include is guarded canonically. Refer #4271 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4312)
2017-08-30Move e_os.h to be the very first include.Pauli1-1/+1
cryptilib.h is the second. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
2017-08-30e_os.h removal from other headers and source files.Pauli1-1/+2
Removed e_os.h from all bar three headers (apps/apps.h crypto/bio/bio_lcl.h and ssl/ssl_locl.h). Added e_os.h into the files that need it now. Directly reference internal/nelem.h when required. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
2017-08-22(Re)move some things from e_os.hRich Salz1-1/+0
Remove GETPID_IS_MEANINGLESS and osslargused. Move socket-related things to new file internal/sockets.h; this is now only needed by four(!!!) files. Compiles should be a bit faster. Remove USE_SOCKETS ifdef's Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4209)
2017-05-22Convert existing usage of assert() to ossl_assert() in libsslMatt Caswell1-3/+9
Provides consistent output and approach. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22Fix some style issues in returnsMatt Caswell1-4/+4
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-02-28Code health: Stop using timeb.h / ftime() (VMS only)Richard Levitte1-8/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2775)
2017-02-16Don't change the state of the ETM flags until CCS processingMatt Caswell1-1/+1
In 1.1.0 changing the ciphersuite during a renegotiation can result in a crash leading to a DoS attack. In master this does not occur with TLS (instead you get an internal error, which is still wrong but not a security issue) - but the problem still exists in the DTLS code. The problem is caused by changing the flag indicating whether to use ETM or not immediately on negotiation of ETM, rather than at CCS. Therefore, during a renegotiation, if the ETM state is changing (usually due to a change of ciphersuite), then an error/crash will occur. Due to the fact that there are separate CCS messages for read and write we actually now need two flags to determine whether to use ETM or not. CVE-2017-3733 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-29Ensure we are in accept state in DTLSv1_listenMatt Caswell1-0/+5
Calling SSL_set_accept_state() after DTLSv1_listen() clears the state, so SSL_accept() no longer works. In 1.0.2 calling DTLSv1_listen() would set the accept state automatically. We should still do that. Fixes #1989 Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-11-13Remove heartbeat supportRichard Levitte1-168/+0
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1669)
2016-11-04Add some PACKET functions for size_tMatt Caswell1-3/+3
And use them in the DTLS code Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some missed size_t updatesMatt Caswell1-8/+4
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert libssl writing for size_tMatt Caswell1-18/+20
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02Add DTLS_get_data_mtu() functionDavid Woodhouse1-0/+36
We add ssl_cipher_get_overhead() as an internal function, to avoid having too much ciphersuite-specific knowledge in DTLS_get_data_mtu() itself. It's going to need adjustment for TLSv1.3... but then again, so is fairly much *all* of the SSL_CIPHER handling. This bit is in the noise. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-10-02Rename ssl_set_handshake_header2()Matt Caswell1-2/+2
ssl_set_handshake_header2() was only ever a temporary name while we had to have ssl_set_handshake_header() for code that hadn't been converted to WPACKET yet. No code remains that needed that so we can rename it. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-02Remove ssl_set_handshake_header()Matt Caswell1-16/+0
Remove the old ssl_set_handshake_header() implementations. Later we will rename ssl_set_handshake_header2() to ssl_set_handshake_header(). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-22Convert HelloVerifyRequest construction to WPACKETMatt Caswell1-48/+68
We actually construct a HelloVerifyRequest in two places with common code pulled into a single function. This one commit handles both places. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-13Convert tls_construct_client_hello() to use PACKETWMatt Caswell1-0/+4
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-22Fix DTLS buffered message DoS attackMatt Caswell1-1/+14
DTLS can handle out of order record delivery. Additionally since handshake messages can be bigger than will fit into a single packet, the messages can be fragmented across multiple records (as with normal TLS). That means that the messages can arrive mixed up, and we have to reassemble them. We keep a queue of buffered messages that are "from the future", i.e. messages we're not ready to deal with yet but have arrived early. The messages held there may not be full yet - they could be one or more fragments that are still in the process of being reassembled. The code assumes that we will eventually complete the reassembly and when that occurs the complete message is removed from the queue at the point that we need to use it. However, DTLS is also tolerant of packet loss. To get around that DTLS messages can be retransmitted. If we receive a full (non-fragmented) message from the peer after previously having received a fragment of that message, then we ignore the message in the queue and just use the non-fragmented version. At that point the queued message will never get removed. Additionally the peer could send "future" messages that we never get to in order to complete the handshake. Each message has a sequence number (starting from 0). We will accept a message fragment for the current message sequence number, or for any sequence up to 10 into the future. However if the Finished message has a sequence number of 2, anything greater than that in the queue is just left there. So, in those two ways we can end up with "orphaned" data in the queue that will never get removed - except when the connection is closed. At that point all the queues are flushed. An attacker could seek to exploit this by filling up the queues with lots of large messages that are never going to be used in order to attempt a DoS by memory exhaustion. I will assume that we are only concerned with servers here. It does not seem reasonable to be concerned about a memory exhaustion attack on a client. They are unlikely to process enough connections for this to be an issue. A "long" handshake with many messages might be 5 messages long (in the incoming direction), e.g. ClientHello, Certificate, ClientKeyExchange, CertificateVerify, Finished. So this would be message sequence numbers 0 to 4. Additionally we can buffer up to 10 messages in the future. Therefore the maximum number of messages that an attacker could send that could get orphaned would typically be 15. The maximum size that a DTLS message is allowed to be is defined by max_cert_list, which by default is 100k. Therefore the maximum amount of "orphaned" memory per connection is 1500k. Message sequence numbers get reset after the Finished message, so renegotiation will not extend the maximum number of messages that can be orphaned per connection. As noted above, the queues do get cleared when the connection is closed. Therefore in order to mount an effective attack, an attacker would have to open many simultaneous connections. Issue reported by Quan Luo. CVE-2016-2179 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-18Indent ssl/Emilia Kasper1-12/+13
Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-04Make DTLS1_BAD_VER work with DTLS_client_method()David Woodhouse1-3/+6
DTLSv1_client_method() is deprecated, but it was the only way to obtain DTLS1_BAD_VER support. The SSL_OP_CISCO_ANYCONNECT hack doesn't work with DTLS_client_method(), and it's relatively non-trivial to make it work without expanding the hack into lots of places. So deprecate SSL_OP_CISCO_ANYCONNECT with DTLSv1_client_method(), and make it work with SSL_CTX_set_{min,max}_proto_version(DTLS1_BAD_VER) instead. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-20Fix a few if(, for(, while( inside code.FdaSilvaYY1-6/+6
Fix some indentation at the same time Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1292)
2016-06-29Whitespace cleanup in ssl folderFdaSilvaYY1-1/+1
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1264)
2016-06-22Spelling... and more spellingFdaSilvaYY1-2/+2
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1245)
2016-05-17Copyright consolidation 01/10Rich Salz1-54/+5
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-05-05Improve heartbeats coding styleMatt Caswell1-18/+18
Based on an orignal commit by GitHub user BertramScharpf. Rebased and updated to take account of all the updates since this was first raised. GH PR#62 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-28various spelling fixesFdaSilvaYY1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/952)
2016-04-04Revert "various spelling fixes"Rich Salz1-1/+1
This reverts commit 620d540bd47a96fb6905fbbdd8ea5167a8841a3e. It wasn't reviewed. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-04various spelling fixesFdaSilvaYY1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-21Fix no-sockMatt Caswell1-1/+2
Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17Remove Netware and OS/2Rich Salz1-2/+0
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-09Move disabling of RC4 for DTLS to the cipher list.Kurt Roeckx1-19/+0
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-22Remove unused parameters from internal functionsRich Salz1-2/+1
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-11Remove TLS heartbeat, disable DTLS heartbeatRich Salz1-7/+7
To enable heartbeats for DTLS, configure with enable-heartbeats. Heartbeats for TLS have been completely removed. This addresses RT 3647 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-05Add tests for DTLSv1_listenMatt Caswell1-10/+13
Adds a set of tests for the newly rewritten DTLSv1_listen function. The test pokes various packets at the function and then checks the return value and the data written out to ensure it is what we would have expected. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Provide partial support for fragmented DTLS ClientHellosMatt Caswell1-6/+20
The recently rewriten DTLSv1_listen code does not support fragmented ClientHello messages because fragment reassembly requires server state which is against the whole point of DTLSv1_listen. This change adds some partial support for fragmented ClientHellos. It requires that the cookie must be within the initial fragment. That way any non-initial ClientHello fragments can be dropped and fragment reassembly is not required. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Make DTLSv1_listen a first class function and change its typeMatt Caswell1-27/+23
The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-03Refactoring BIO: Adapt BIO_s_datagram and all that depends on itRichard Levitte1-5/+9
The control commands that previously took a struct sockaddr * have been changed to take a BIO_ADDR * instead. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-01constify PACKETEmilia Kasper1-1/+2
PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-26Remove /* foo.c */ commentsRich Salz1-1/+0
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-24Move pqueue into sslRich Salz1-2/+2
This is an internal facility, never documented, not for public consumption. Move it into ssl (where it's only used for DTLS). I also made the typedef's for pqueue and pitem follow our style: they name structures, not pointers. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-10Regenerate SSL record/statem error stringsViktor Dukhovni1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-02Protocol version selection and negotiation rewriteViktor Dukhovni1-35/+3
The protocol selection code is now consolidated in a few consecutive short functions in a single file and is table driven. Protocol-specific constraints that influence negotiation are moved into the flags field of the method structure. The same protocol version constraints are now applied in all code paths. It is now much easier to add new protocol versions without reworking the protocol selection logic. In the presence of "holes" in the list of enabled client protocols we no longer select client protocols below the hole based on a subset of the constraints and then fail shortly after when it is found that these don't meet the remaining constraints (suiteb, FIPS, security level, ...). Ideally, with the new min/max controls users will be less likely to create "holes" in the first place. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-02Add support for minimum and maximum protocol versionKurt Roeckx1-3/+13
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-11-25Remove unused cert_verify_mac codeDr. Stephen Henson1-2/+0
Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-11-09Standardise our style for checking malloc failuresMatt Caswell1-1/+1
if we have a malloc |x = OPENSSL_malloc(...)| sometimes we check |x| for NULL and sometimes we treat it as a boolean |if(!x) ...|. Standardise the approach in libssl. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-11-02Remove a trivially true OPENSSL_assertMatt Caswell1-6/+0
This OPENSSL_assert in (d)tls1_hearbeat is trivially always going to be true because it is testing the sum of values that have been set as constants just a few lines above and nothing has changed them. Therefore remove this. Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.1 at 2024-07-13 15:03:28 +0000