summaryrefslogtreecommitdiffstats
path: root/ssl/s3_srvr.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Fix for CVE-2014-0224Dr. Stephen Henson2014-06-051-0/+5
| | | | | | | | | | Only accept change cipher spec when it is expected instead of at any time. This prevents premature setting of session keys before the master secret is determined which an attacker could use as a MITM attack. Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue and providing the initial fix this patch is based on. (cherry picked from commit bc8923b1ec9c467755cd86f7848c50ee8812e441)
* Allocate extra space when NETSCAPE_HANG_BUG defined.David Ramos2014-06-011-0/+5
| | | | | | | Make sure there is an extra 4 bytes for server done message when NETSCAPE_HANG_BUG is defined. PR#3361
* Replace manual ASN1 decoder with ASN1_get_objectSerguei E. Leontiev2014-05-121-16/+7
| | | | | | | | Replace manual ASN.1 decoder with ASN1_get object. This will decode the tag and length properly and check against it does not exceed the supplied buffer length. PR#3335
* Security framework.Dr. Stephen Henson2014-03-281-5/+39
| | | | | | | | | | | | | | | | | Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
* Check return value of ssl3_output_cert_chainDr. Stephen Henson2014-03-281-1/+5
|
* Auto DH support.Dr. Stephen Henson2014-03-281-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
* Retry callback only after ClientHello received.Piotr Sikora2014-03-191-1/+1
|
* fix WIN32 warningsDr. Stephen Henson2014-02-201-1/+1
| | | | (cherry picked from commit b709f8ef54b1c9ad513878ba0213aa651a9acef8)
* Fix whitespace, new-style comments.Ben Laurie2014-02-051-8/+7
|
* Re-add alert variables removed during rebaseScott Deboy2014-02-051-14/+15
| | | | Whitespace fixes
* Update custom TLS extension and supplemental data 'generate' callbacks to ↵Scott Deboy2014-02-051-4/+9
| | | | | | | | support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.
* Check i before r[i].Dr. Stephen Henson2014-01-281-2/+2
| | | | | PR#3244 (cherry picked from commit 9614d2c676ffe74ce0c919d9e5c0d622a011cbed)
* Support retries in certificate callbackDr. Stephen Henson2014-01-261-10/+22
|
* use SSL_kDHE throughout instead of SSL_kEDHDaniel Kahn Gillmor2014-01-091-4/+4
| | | | | | | | | | | DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
* use SSL_kECDHE throughout instead of SSL_kEECDHDaniel Kahn Gillmor2014-01-091-6/+6
| | | | | | | | | | | ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
* Don't change version number if session establishedDr. Stephen Henson2014-01-021-4/+5
| | | | | | | | | | When sending an invalid version number alert don't change the version number to the client version if a session is already established. Thanks to Marek Majkowski for additional analysis of this issue. PR#3191
* Use correct header length in ssl3_send_certifcate_requestDr. Stephen Henson2013-11-171-2/+2
|
* Fix another gmt_unix_time case in server_randomNick Mathewson2013-10-211-7/+1
|
* Do not include a timestamp in the Client/ServerHello Random field.Nick Mathewson2013-10-211-4/+1
| | | | | | | | | | | | | | | | | | | | | | | Instead, send random bytes, unless SSL_SEND_{CLIENT,SERVER}RANDOM_MODE is set. This is a forward-port of commits: 4af793036f6ef4f0a1078e5d7155426a98d50e37 f4c93b46edb51da71f09eda99e83eaf193a33c08 3da721dac9382c48812c8eba455528fd59af2eef 2583270191a8b27eed303c03ece1da97b9b69fd3 While the gmt_unix_time record was added in an ostensible attempt to mitigate the dangers of a bad RNG, its presence leaks the host's view of the current time in the clear. This minor leak can help fingerprint TLS instances across networks and protocols... and what's worse, it's doubtful thet the gmt_unix_time record does any good at all for its intended purpose, since: * It's quite possible to open two TLS connections in one second. * If the PRNG output is prone to repeat itself, ephemeral handshakes (and who knows what else besides) are broken.
* More cleanup.Ben Laurie2013-09-061-2/+0
|
* Make it build.Ben Laurie2013-09-061-12/+16
|
* Add callbacks supporting generation and retrieval of supplemental data ↵Scott Deboy2013-09-061-87/+151
| | | | | | | | entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
* This change alters the processing of invalid, RSA pre-master secrets soAdam Langley2013-06-131-45/+89
| | | | | that bad encryptions are treated like random session keys in constant time.
* Suite B support for DTLS 1.2Dr. Stephen Henson2013-04-091-0/+7
| | | | | | | Check for Suite B support using method flags instead of version numbers: anything supporting TLS 1.2 cipher suites will also support Suite B. Return an error if an attempt to use DTLS 1.0 is made in Suite B mode.
* Always return errors in ssl3_get_client_helloDr. Stephen Henson2013-04-091-4/+4
| | | | | | | | If we successfully match a cookie don't set return value to 2 as this results in other error conditions returning 2 as well. Instead set return value to -2 which can be checked later if everything else is OK.
* Dual DTLS version methods.Dr. Stephen Henson2013-04-091-2/+27
| | | | | | | | Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.
* Use enc_flags when deciding protocol variations.Dr. Stephen Henson2013-03-181-13/+11
| | | | | | Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement.
* DTLS revision.Dr. Stephen Henson2013-03-181-91/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
* stop warning when compiling with no-compDr. Stephen Henson2012-12-301-1/+4
|
* change inaccurate error messageDr. Stephen Henson2012-11-261-1/+1
|
* Call OCSP Stapling callback after ciphersuite has been chosen, so theBen Laurie2012-09-111-0/+10
| | | | | | right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
* Add three Suite B modes to TLS code, supporting RFC6460.Dr. Stephen Henson2012-08-151-2/+2
|
* Abort handshake if signature algorithm used not supported by peer.Dr. Stephen Henson2012-07-241-16/+5
|
* set ciphers to NULL before calling cert_cbDr. Stephen Henson2012-07-201-1/+1
|
* New function ssl_set_client_disabled to set masks for any ciphersuitesDr. Stephen Henson2012-07-181-2/+4
| | | | | that are disabled for this session (as opposed to always disabled by configuration).
* Add certificate callback. If set this is called whenever a certificateDr. Stephen Henson2012-06-291-0/+8
| | | | | | | | | is required by client or server. An application can decide which certificate chain to present based on arbitrary criteria: for example supported signature algorithms. Add very simple example to s_server. This fixes many of the problems and restrictions of the existing client certificate callback: for example you can now clear existing certificates and specify the whole chain.
* Add support for application defined signature algorithms for use withDr. Stephen Henson2012-06-221-1/+1
| | | | | | | | TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
* Parse authz correctly.Ben Laurie2012-06-061-0/+4
|
* Version skew reduction: trivia (I hope).Ben Laurie2012-06-041-3/+2
|
* RFC 5878 support.Ben Laurie2012-05-301-2/+114
|
* Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>Dr. Stephen Henson2012-04-241-5/+1
| | | | | Reviewed by: steve Improved localisation of TLS extension handling and code tidy.
* oops, not yet ;-)Dr. Stephen Henson2012-04-231-8/+0
|
* update NEWSDr. Stephen Henson2012-04-231-0/+8
|
* s3_srvr.c: fix typo.Andy Polyakov2012-04-151-1/+1
| | | | PR: 2538
* Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>Dr. Stephen Henson2012-04-061-7/+2
| | | | Localize client hello extension parsing in t1_lib.c
* Add support for automatic ECDH temporary key parameter selection. WhenDr. Stephen Henson2012-04-051-2/+11
| | | | | | enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
* initialise i if n == 0Dr. Stephen Henson2012-02-221-0/+2
|
* Fix bug in CVE-2011-4619: check we have really received a client helloDr. Stephen Henson2012-02-161-8/+7
| | | | before rejecting multiple SGC restarts.
* Revise ssl code to use a CERT_PKEY structure when outputting aDr. Stephen Henson2012-01-261-4/+4
| | | | | | | | certificate chain instead of an X509 structure. This makes it easier to enhance code in future and the chain output functions have access to the CERT_PKEY structure being used.
* add support for use of fixed DH client certificatesDr. Stephen Henson2012-01-251-30/+46
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-06 06:17:37 +0100