aboutsummaryrefslogtreecommitdiff
path: root/ssl
AgeCommit message (Collapse)AuthorFilesLines
2016-11-09Ensure the key and iv labels are declared as staticMatt Caswell1-2/+2
Fixes a travis failure Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add support for TLS1.3 secret generationMatt Caswell3-1/+239
Nothing is using this yet, it just adds the underlying functions necesary for generating the TLS1.3 secrets. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add support for initialising WPACKETs from a static bufferMatt Caswell2-14/+51
Normally WPACKETs will use a BUF_MEM which can grow as required. Sometimes though that may be overkill for what is needed - a static buffer may be sufficient. This adds that capability. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Make some CLIENTHELLO_MSG function arguments constMatt Caswell2-3/+3
There were a few places where they could be declared const so this commit does that. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Update a commentMatt Caswell1-1/+1
The name and type of the argument to ssl_check_for_safari() has changed. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Swap back to using SSL3_RANDOM_SIZE instead of sizeof(clienthello.random)Matt Caswell1-5/+9
The size if fixed by the protocol and won't change even if sizeof(clienthello.random) does. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Move setting the session_id_len until after we filled the session_idMatt Caswell1-3/+2
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Load the sessionid directly in SSLv2 compat ClientHelloMatt Caswell1-7/+8
Don't use a sub-packet, just load it. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Rename clienthello.version to clienthello.legacy_versionMatt Caswell3-8/+8
For consistency with the TLSv1.3 spec. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix some minor style issuesMatt Caswell1-1/+1
Add a blank line, take one away - due to feedback received during review. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add some function documentation and update some existing commentsMatt Caswell2-4/+25
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix make update following extensions refactorMatt Caswell2-4/+4
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Improve some comment documentation following the extensions refactorMatt Caswell3-4/+10
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix various style issues in the extension parsing refactorMatt Caswell4-81/+71
Based on review feedback received. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Use an explicit name for the struct for definition of RAW_EXTENSIONMatt Caswell1-1/+1
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Fix a memory leak in the ClientHello extension parsingMatt Caswell1-0/+4
We should be freeing up the raw extension data after we've finished with it. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Handle compression methods correctly with SSLv2 compat ClientHelloMatt Caswell1-7/+6
In the case of an SSLv2 compat ClientHello we weren't setting up the compression methods correctly, which could lead to uninit reads or crashes. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Refactor ClientHello processing so that extensions get parsed earlierMatt Caswell7-292/+442
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Partial revert of "Fix client verify mode to check SSL_VERIFY_PEER"Matt Caswell1-1/+15
This partially reverts commit c636c1c47. It also tweaks the documentation and comments in this area. On the client side the documented interface for SSL_CTX_set_verify()/SSL_set_verify() is that setting the flag SSL_VERIFY_PEER causes verfication of the server certificate to take place. Previously what was implemented was that if *any* flag was set then verification would take place. The above commit improved the semantics to be as per the documented interface. However, we have had a report of at least one application where an application was incorrectly using the interface and used *only* SSL_VERIFY_FAIL_IF_NO_PEER_CERT on the client side. In OpenSSL prior to the above commit this still caused verification of the server certificate to take place. After this commit the application silently failed to verify the server certificate. Ideally SSL_CTX_set_verify()/SSL_set_verify() could be modified to indicate if invalid flags were being used. However these are void functions! The simplest short term solution is to revert to the previous behaviour which at least means we "fail closed" rather than "fail open". Thanks to Cory Benfield for reporting this issue. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-07Ignore the record version in TLS1.3Matt Caswell1-2/+3
The record layer version field must be ignored in TLSv1.3, so we remove the check when using that version. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Correct the Id for the TLS1.3 ciphersuiteMatt Caswell1-1/+1
We have one TLS1.3 ciphersuite, but there is a typo in the id that should be corrected. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Always ensure that init_msg is initialised for a CCSMatt Caswell1-0/+1
We read it later in grow_init_buf(). If CCS is the first thing received in a flight, then it will use the init_msg from the last flight we received. If the init_buf has been grown in the meantime then it will point to some arbitrary other memory location. This is likely to result in grow_init_buf() attempting to grow to some excessively large amount which is likely to fail. In practice this should never happen because the only time we receive a CCS as the first thing in a flight is in an abbreviated handshake. None of the preceding messages from the server flight would be large enough to trigger this. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix a missed size_t variable declarationMatt Caswell1-1/+1
pqueue_size() now returns a size_t, but the variable that gets returned was still declared as an int. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some style issues from libssl size_tify reviewMatt Caswell2-11/+7
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Rename all "read" variables with "readbytes"Matt Caswell8-72/+73
Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix a shadowed variable declaration warning picked up by TravisMatt Caswell1-3/+3
Rename "read" to "readbytes" Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Test the size_t constant time functionsMatt Caswell1-4/+0
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Ensure SSL_DEBUG works following size_t changesMatt Caswell2-3/+3
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some bogus warnings about uninitialised variablesMatt Caswell1-2/+2
Travis was failing in some builds due to a bogus complaint about uninit variables. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Remove a stray TODO that has already been fixedMatt Caswell2-7/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Provide some constant time functions for dealing with size_t valuesMatt Caswell2-23/+23
Also implement the using of them Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Now that we can use size_t in PACKET lets use itMatt Caswell1-4/+2
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix misc size_t issues causing Windows warnings in 64 bitMatt Caswell17-112/+137
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert the mac functions to just return 1 for success and 0 for failureMatt Caswell3-25/+23
Previously they return -1 for failure or the size of the mac. But the size was never used anywhere. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some ssl3_record code witch converstion to/from size_tMatt Caswell1-15/+17
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Add some PACKET functions for size_tMatt Caswell2-3/+55
And use them in the DTLS code Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert SSL BIO to use SSL_write_ex().Matt Caswell2-72/+61
We also modify the SSL_get_error() function to handle the fact that with SSL_write_ex() the error return is 0 not -1, and fix some bugs in the SSL BIO reading. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix some missed size_t updatesMatt Caswell13-49/+38
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Resolve some outstanding size_t related TODOsMatt Caswell3-15/+4
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Update misc function params in libssl for size_tMatt Caswell4-11/+12
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert some libssl local functions to size_tMatt Caswell5-18/+18
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Update cookie_len for size_tMatt Caswell3-7/+9
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Update numerous misc libssl fields to be size_tMatt Caswell6-46/+52
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert session_id_length and sid_ctx_len to size_tMatt Caswell6-24/+31
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert master_secret_size code to size_tMatt Caswell8-67/+93
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert various mac_secret_size usage to size_tMatt Caswell2-5/+6
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert ssl3_cbc_digest_record for size_tMatt Caswell2-7/+9
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert some misc record layer functions for size_tMatt Caswell5-47/+80
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert SSL3_RECORD_clear() and SSL3_RECORD_release() to size_tMatt Caswell2-6/+6
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert libssl writing for size_tMatt Caswell15-216/+267
Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.1 at 2024-07-13 15:54:25 +0000