summaryrefslogtreecommitdiffstats
path: root/ssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add TODO comment for a nonsensical public APIBenjamin Kaduk2018-07-201-0/+9
| | | | | | | | | | | | | The API used to set what SNI value to send in the ClientHello can also be used on server SSL objects, with undocumented and un-useful behavior. Unfortunately, when generic SSL_METHODs are used, s->server is still set, prior to the start of the handshake, so we cannot prevent this nonsensical usage at the present time. Leave a note to revisit this when ABI-breaking changes are permitted. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6378)
* Normalize SNI hostname handling for SSL and SSL_SESSIONBenjamin Kaduk2018-07-204-20/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular, adhere to the rule that we must not modify any property of an SSL_SESSION object once it is (or might be) in a session cache. Such modifications are thread-unsafe and have been observed to cause crashes at runtime. To effect this change, standardize on the property that SSL_SESSION->ext.hostname is set only when that SNI value has been negotiated by both parties for use with that session. For session resumption this is trivially the case, so only new handshakes are affected. On the client, the new semantics are that the SSL->ext.hostname is for storing the value configured by the caller, and this value is used when constructing the ClientHello. On the server, SSL->ext.hostname is used to hold the value received from the client. Only if the SNI negotiation is successful will the hostname be stored into the session object; the server can do this after it sends the ServerHello, and the client after it has received and processed the ServerHello. This obviates the need to remove the hostname from the session object in case of failed negotiation (a change that was introduced in commit 9fb6cb810b769abbd60f11ef6e936a4e4456b19d in order to allow TLS 1.3 early data when SNI was present in the ClientHello but not the session being resumed), which was modifying cached sessions in certain cases. (In TLS 1.3 we always produce a new SSL_SESSION object for new connections, even in the case of resumption, so no TLS 1.3 handshakes were affected.) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6378)
* const-ify some input SSL * argumentsBenjamin Kaduk2018-07-201-3/+3
| | | | | | | | | These tiny functions only read from the input SSL, and we are about to use them from functions that only have a const SSL* available, so propagate const a bit further. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6378)
* Validate legacy_versionMatt Caswell2018-07-202-0/+13
| | | | | | | | | | The spec says that a client MUST set legacy_version to TLSv1.2, and requires servers to verify that it isn't SSLv3. Fixes #6600 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6747)
* Don't skip over early_data if we sent an HRRMatt Caswell2018-07-191-1/+3
| | | | | | | | | It is not valid to send early_data after an HRR has been received. Fixes #6734 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6737)
* Check that the public key OID matches the sig algMatt Caswell2018-07-183-10/+32
| | | | | | | | | | | | Using the rsa_pss_rsae_sha256 sig alg should imply that the key OID is rsaEncryption. Similarly rsa_pss_pss_sha256 implies the key OID is rsassaPss. However we did not check this and incorrectly tolerated a key OID that did not match the sig alg sent by the peer. Fixes #6611 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6732)
* Fix no-pskMatt Caswell2018-07-171-1/+6
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6724)
* Always issue new tickets when using TLSv1.3 stateful ticketsMatt Caswell2018-07-171-1/+2
| | | | | | | | | | Previously we were failing to issue new tickets if a resumption attempt failed. Fixes #6654 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6722)
* Don't remove sessions from the cache during PHA in TLSv1.3Matt Caswell2018-07-171-9/+0
| | | | | | | | | | If we issue new tickets due to post-handshake authentication there is no reason to remove previous tickets from the cache. The code that did that only removed the last session anyway - so if more than one ticket got issued then those other tickets are still valid. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6722)
* As a server don't select TLSv1.3 if we're not capable of itMatt Caswell2018-07-131-3/+35
| | | | | | | | | | Check that we are either configured for PSK, or that we have a TLSv1.3 capable certificate type. DSA certs can't be used in TLSv1.3 and we don't (currently) allow GOST ones either (owing to the lack of standard sig algs). Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6650)
* Use ssl_version_supported() when choosing server versionMatt Caswell2018-07-133-19/+11
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6650)
* Do not use GOST sig algs in TLSv1.3 where possibleMatt Caswell2018-07-131-0/+41
| | | | | | | Fixes #6513 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6650)
* Introduce the recv_max_early_data settingMatt Caswell2018-07-063-5/+63
| | | | | | | | | | | | | | | | | | | Previoulsy we just had max_early_data which controlled both the value of max early_data that we advertise in tickets *and* the amount of early_data that we are willing to receive from clients. This doesn't work too well in the case where we want to reduce a previously advertised max_early_data value. In that case clients with old, stale tickets may attempt to send us more early data than we are willing to receive. Instead of rejecting the early data we abort the connection if that happens. To avoid this we introduce a new "recv_max_early_data" value. The old max_early_data becomes the value that is advertised in tickets while recv_max_early_data is the maximum we will tolerate from clients. Fixes #6647 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6655)
* Remove TLSv1.3 tickets from the client cache as we use themMatt Caswell2018-07-032-5/+15
| | | | | | | | | | Tickets are supposed to be single use so we remove them from the cache on use. Fixes #6377 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6601)
* Restore behaviour from commit 36ff232cf that was incorrectly removedMatt Caswell2018-07-031-0/+11
| | | | | | | | | In TLSv1.2 and below we should remove an old session from the client session cache in the event that we receive a new session ticket from the server. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6601)
* Add the ability to configure anti-replay via SSL_CONFMatt Caswell2018-07-021-2/+9
| | | | | | | | This also adds the ability to control this through s_server Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
* Add setters to set the early_data callbackMatt Caswell2018-07-023-3/+31
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
* Make the anti-replay feature optionalMatt Caswell2018-07-024-4/+12
| | | | | | | | Fixes #6389 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
* Fix a NULL ptr deref in error path in tls_process_cke_dhe()Matt Caswell2018-07-021-4/+3
| | | | | | | Fixes #6574 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6593)
* Address coverity-reported NULL dereference in SSL_SESSION_print()Benjamin Kaduk2018-07-021-1/+2
| | | | | | | | We need to check the provided SSL_SESSION* for NULL before attempting to derference it to see if it's a TLS 1.3 session. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6622)
* Check return from BN_set_word.Pauli2018-06-291-3/+6
| | | | | | | In ssl/t1_lib.c. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6613)
* Return a fatal error if application data is encountered during shutdownMatt Caswell2018-06-272-4/+13
| | | | | | | | | | | | | | Currently if you encounter application data while waiting for a close_notify from the peer, and you have called SSL_shutdown() then you will get a -1 return (fatal error) and SSL_ERROR_SYSCALL from SSL_get_error(). This isn't accurate (it should be SSL_ERROR_SSL) and isn't persistent (you can call SSL_shutdown() again and it might then work). We change this into a proper fatal error that is persistent. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6340)
* Return SSL_ERROR_WANT_READ if SSL_shutdown() encounters handshake dataMatt Caswell2018-06-271-5/+15
| | | | | | | | | | | In the case where we are shutdown for writing and awaiting a close_notify back from a subsequent SSL_shutdown() call we skip over handshake data that is received. This should not be treated as an error - instead it should be signalled with SSL_ERROR_WANT_READ. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6340)
* Auto retry if we ditch records during shutdownMatt Caswell2018-06-271-36/+43
| | | | | | | | | | | | | If we've sent a close_notify and we're waiting for one back we drop incoming records until we see the close_notify we're looking for. If SSL_MODE_AUTO_RETRY is on, then we should immediately try and read the next record. Fixes #6262 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6340)
* Use stateful tickets if we are doing anti-replayMatt Caswell2018-06-262-2/+14
| | | | | | | | | | | During anti-replay we cache the ticket anyway, so there is no point in using a full stateless ticket. Fixes #6391 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6563)
* Respect SSL_OP_NO_TICKET in TLSv1.3Matt Caswell2018-06-266-90/+162
| | | | | | | | | Implement support for stateful TLSv1.3 tickets, and use them if SSL_OP_NO_TICKET is set. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6563)
* Restructure the ticket construction codeMatt Caswell2018-06-262-133/+182
| | | | | | | | | Separate out as a new function the code to write out data which is specific to a stateless ticket. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6563)
* Update SSL_SESSION_print for TLSv1.3Matt Caswell2018-06-261-1/+11
| | | | | | | Make SSL_SESSION_print() show a bit more information for TLSv1.3 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6590)
* Don't change a session once its in the cacheMatt Caswell2018-06-251-3/+4
| | | | | | | | | Sessions should be immutable once they are in the cache because they could be shared with other threads. If you change them then this can cause corruptions and races Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6561)
* Remove __cplusplus preamble from internal headersNicola Tuveri2018-06-221-8/+0
| | | | | | | | | | | These headers are internal and never exposed to a cpp compiler, hence no need for the preamble. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6554)
* Don't use OPENSSL_strdup() for copying alpn_selectedMatt Caswell2018-06-212-10/+10
| | | | | | | | | | | An alpn_selected value containing NUL bytes in it will result in ext.alpn_selected_len having a larger value than the number of bytes allocated in ext.alpn_selected. Issue found by OSS-fuzz. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6507)
* Fix enable-ssl3 enable-ssl3-methodMatt Caswell2018-06-191-0/+3
| | | | | | | | | | | | | Commit 4aa5a5669 accidentally missed off the catch all case of ignoring all warning alerts that are otherwise unhandled. This breaks the SSLv3 tests which send a "no certificate" warning alert. Fixes #6496 [extended tests] Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/6509)
* Remodel the if sequence for handling alertsMatt Caswell2018-06-111-36/+28
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6370)
* Don't send a warning alert in TLSv1.3Matt Caswell2018-06-111-1/+3
| | | | | | | | | | TLSv1.3 ignores the alert level, so we should suppress sending of warning only alerts. Fixes #6211 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6370)
* Fix TLSv1.3 alert handlingMatt Caswell2018-06-111-26/+31
| | | | | | | | In TLSv1.3 we should ignore the severity level of an alert according to the spec. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6370)
* Do not free a session before calling the remove_session_cbMarcus Huewe2018-06-071-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If the remove_session_cb accesses the session's data (for instance, via SSL_SESSION_get_protocol_version), a potential use after free can occur. For this, consider the following scenario when adding a new session via SSL_CTX_add_session: - The session cache is full (SSL_CTX_sess_number(ctx) > SSL_CTX_sess_get_cache_size(ctx)) - Only the session cache has a reference to ctx->session_cache_tail (that is, ctx->session_cache_tail->references == 1) Since the cache is full, remove_session_lock is called to remove ctx->session_cache_tail from the cache. That is, it SSL_SESSION_free()s the session, which free()s the data. Afterwards, the free()d session is passed to the remove_session_cb. If the callback accesses the session's data, we have a use after free. The free before calling the callback behavior was introduced in commit e4612d02c53cccd24fa97b08fc01250d1238cca1 ("Remove sessions from external cache, even if internal cache not used."). CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6222)
* Reformulate the if condition in tls_process_new_session_ticketMatt Caswell2018-06-071-3/+2
| | | | | | | Improves readability Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6415)
* Don't store the ticket nonce in the sessionMatt Caswell2018-06-075-54/+16
| | | | | | | | We generate the secrets based on the nonce immediately so there is no need to keep the nonce. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6415)
* Fix TLSv1.3 ticket noncesMatt Caswell2018-06-076-39/+90
| | | | | | | | | | | | All tickets on a connection need to have a unique nonce. When this was originally implemented we only ever sent one ticket on the conneciton so this didn't matter. We were just using the value 0. Now we can get multiple tickets to we need to start doing the ticket nonce properly. Fixes #6387 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6415)
* Fix EAP-FASTMatt Caswell2018-06-071-5/+7
| | | | | | | | | Commit 61fb59238d broke EAP-FAST support. This fixes it. Fixes #6395 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6428)
* EVP_MD_size() can return an errorMatt Caswell2018-05-312-3/+29
| | | | | | | Fix some instances where we weren't checking the error return. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
* Send GOST SignatureAlgorithms when TLS 1.2 in useDmitry Belyavskiy2018-05-301-1/+6
| | | | | | Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6168)
* Bugfix: GOST2012 certificates for GOST ciphersuites were broken.Dmitry Belyavskiy2018-05-302-5/+15
| | | | | | Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6168)
* Update copyright yearMatt Caswell2018-05-291-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6371)
* Fix array bounds violation in ssl_session_dupBernd Edlinger2018-05-251-1/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6353)
* Use the client app traffic secret for PHA Finished messageMatt Caswell2018-05-231-2/+13
| | | | | | | | | | | The TLSv1.3 spec requires us to use the client application traffic secret during generation of the Finished message following a post handshake authentication. Fixes #6263 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/6297)
* Enable SSL_MODE_AUTO_RETRY by defaultKurt Roeckx2018-05-221-0/+1
| | | | | | | | | | | | | Because TLS 1.3 sends more non-application data records some clients run into problems because they don't expect SSL_read() to return and set SSL_ERROR_WANT_READ after processing it. This can cause problems for clients that use blocking I/O and use select() to see if data is available. It can be cleared using SSL_CTX_clear_mode(). Reviewed-by: Matt Caswell <matt@openssl.org> GH: #6260
* Fix no-ec in combination with no-dhMatt Caswell2018-05-221-2/+9
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6321)
* ssl/ssl_txt: fix NULL-checkTilman Keskinöz2018-05-211-7/+7
| | | | | | | | | | | | NULL-check for cipher is redundant, instead check if cipher->name is NULL While here fix formatting of BIO_printf calls as suggested by Andy Polyakov. CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6282)
* Don't cache stateless tickets in TLSv1.3Matt Caswell2018-05-211-7/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | In TLSv1.2 and below we always cache new sessions by default on the server side in the internal cache (even when we're using session tickets). This is in order to support resumption from a session id. In TLSv1.3 there is no session id. It is only possible to resume using the ticket. Therefore, in the default case, there is no point in caching the session in the internal store. There is still a reason to call the external cache new session callback because applications may be using the callbacks just to know about when sessions are created (and not necessarily implementing a full cache). If the application also implements the remove session callback then we are forced to also store it in the internal cache so that we can create timeout events. Otherwise the external cache could just fill up indefinitely. This mostly addresses the issue described in #5628. That issue also proposes having an option to not create full stateless tickets when using the internal cache. That aspect hasn't been addressed yet. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/6293)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-06 04:58:33 +0100