wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
11262 commits 20 branches 302 tags 153 MiB
Commit graph

1358 commits

Author SHA1 Message Date
Andy Polyakov
6b2a843970 ssl/s3_cbc.c: uint64_t portability fix. 
Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
(cherry picked from commit cab13fc847)
 2013-02-06 14:19:09 +00:00
Dr. Stephen Henson
6b1f7beeee typo. 
(cherry picked from commit 34ab3c8c71)
 2013-02-06 14:19:09 +00:00
Dr. Stephen Henson
c4e6fb1524 Timing fix mitigation for FIPS mode. 
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
to cover any timing differences caused by removal of padding.
(cherry picked from commit b908e88ec1)
 2013-02-06 14:19:08 +00:00
Ben Laurie
a693ead6dc Oops. Add missing file. 
(cherry picked from commit 014265eb02)
 2013-02-06 14:19:08 +00:00
Ben Laurie
e33ac0e71d Update DTLS code to match CBC decoding in TLS. 
This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
(cherry picked from commit 9f27de170d)
 2013-02-06 14:19:07 +00:00
Ben Laurie
93cab6b319 Don't crash when processing a zero-length, TLS >= 1.1 record. 
The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
(cherry picked from commit 6cb19b7681)
 2013-02-06 14:19:07 +00:00
Ben Laurie
2acc020b77 Make CBC decoding constant time. 
This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.

This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.

In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
(cherry picked from commit e130841bcc)
 2013-02-06 14:19:07 +00:00
Ben Laurie
7c770d572a Add and use a constant-time memcmp. 
This change adds CRYPTO_memcmp, which compares two vectors of bytes in
an amount of time that's independent of their contents. It also changes
several MAC compares in the code to use this over the standard memcmp,
which may leak information about the size of a matching prefix.
(cherry picked from commit 2ee798880a)
 2013-02-06 14:16:55 +00:00
Dr. Stephen Henson
ea34a58385 Fix for trace code: SSL3 doesn't include a length value for 
encrypted premaster secret value.
 2013-02-04 15:13:12 +00:00
Dr. Stephen Henson
c38b76bf69 Fix warning: lenmax isn't used any more. 2013-01-24 14:06:54 +00:00
Andy Polyakov
a006fef78e Improve WINCE support. 
Submitted by: Pierre Delaage
 2013-01-19 21:23:13 +01:00
Ben Laurie
eef6935426 Remove extraneous brackets (clang doesn't like them). 2013-01-19 15:12:08 +00:00
Ben Laurie
517dd307f9 Can't check a size_t for < 0. 2013-01-19 15:00:27 +00:00
Ben Laurie
a6bbbf2ff5 Make "make depend" work on MacOS out of the box. 2013-01-19 14:14:30 +00:00
Dr. Stephen Henson
a4c4a7d5ca stop warning when compiling with no-comp 2012-12-29 23:37:56 +00:00
Dr. Stephen Henson
024e6fed62 typo 2012-12-26 15:23:42 +00:00
Dr. Stephen Henson
230ec17d74 Use client version when deciding which cipher suites to disable. 2012-12-18 13:25:47 +00:00
Andy Polyakov
f469880c61 d1_lib.c,bss_dgram.c: eliminate dependency on _ftime. 2012-12-16 19:02:59 +00:00
Dr. Stephen Henson
b34aa49c25 revert SUITEB128ONLY patch, anything wanting to use P-384 can use SUITEB128 instead 2012-12-10 02:02:16 +00:00
Dr. Stephen Henson
d372d36592 allow ECDSA+SHA384 signature algorithm in SUITEB128ONLY mode 2012-12-09 16:03:34 +00:00
Dr. Stephen Henson
36b5bb6f2f send out the raw SSL/TLS headers to the msg_callback and display them in SSL_trace 2012-12-07 23:42:33 +00:00
Dr. Stephen Henson
083bec780d typo 2012-12-07 13:23:49 +00:00
Dr. Stephen Henson
1edf8f1b4e really fix automatic ;-) 2012-12-07 12:41:13 +00:00
Dr. Stephen Henson
f1f5c70a04 fix handling of "automatic" in file mode 2012-12-06 21:53:05 +00:00
Dr. Stephen Henson
4842dde80c return error if Suite B mode is selected and TLS 1.2 can't be used. Correct error coded 2012-12-01 18:33:21 +00:00
Dr. Stephen Henson
84bafb7471 Print out point format list for clients too. 2012-11-26 18:39:38 +00:00
Dr. Stephen Henson
5087afa108 Use default point formats extension for server side as well as client 
side, if possible.

Don't advertise compressed char2 for SuiteB as it is not supported.
 2012-11-26 18:38:10 +00:00
Dr. Stephen Henson
93c2c9befc change inaccurate error message 2012-11-26 15:47:32 +00:00
Dr. Stephen Henson
d900c0ae14 set auto ecdh parameter selction for Suite B 2012-11-26 15:10:50 +00:00
Dr. Stephen Henson
1c16fd1f03 add Suite B 128 bit mode offering only combination 2 2012-11-24 00:59:51 +00:00
Dr. Stephen Henson
20b431e3a9 Add support for printing out and retrieving EC point formats extension. 2012-11-22 15:20:53 +00:00
Dr. Stephen Henson
e83aefb3a0 reject zero length point format list or supported curves extensions 2012-11-22 14:15:44 +00:00
Dr. Stephen Henson
2588d4ca41 curves can be set in both client and server 2012-11-21 17:01:46 +00:00
Dr. Stephen Henson
878b5d07ef use correct return values when callin cmd 2012-11-21 16:59:33 +00:00
Dr. Stephen Henson
98a7edf9f0 make depend 2012-11-19 13:18:09 +00:00
Dr. Stephen Henson
ddd13d677b fix typo and warning 2012-11-19 02:46:46 +00:00
Dr. Stephen Henson
3db935a9e5 add SSL_CONF functions and documentation 2012-11-16 19:12:24 +00:00
Dr. Stephen Henson
51b9115b6d new command line option -stdname to ciphers utility 2012-11-16 00:35:46 +00:00
Dr. Stephen Henson
8ab92fc646 add "missing" TLSv1.2 cipher alias 2012-11-15 19:14:47 +00:00
Dr. Stephen Henson
8bb870df9e new feature: if ctx==NULL in SSL_CTX_ctrl perform syntax checking only for some operations (currently curves and signature algorithms) 2012-11-08 14:24:51 +00:00
Dr. Stephen Henson
323fa64559 If OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL is set allow the use of "SCSV" as 
a ciphersuite to position the SCSV value in different places for testing
purposes.
 2012-09-30 12:39:27 +00:00
Richard Levitte
4d88fc8173 * ssl/t1_enc.c (tls1_change_cipher_state): Stupid bug. Fortunately in 
debugging code that's seldom used.
 2012-09-21 13:08:24 +00:00
Dr. Stephen Henson
94a209d8e1 Add ctrl and utility functions to retrieve raw cipher list sent by client in 
client hello message. Previously this could only be retrieved on an initial
connection and it was impossible to determine the cipher IDs of any uknown
ciphersuites.
 2012-09-12 13:57:48 +00:00
Dr. Stephen Henson
e5db9c3b67 Minor enhancement to PR#2836 fix. Instead of modifying SSL_get_certificate 
change the current certificate (in s->cert->key) to the one used and then
SSL_get_certificate and SSL_get_privatekey will automatically work.
 2012-09-11 13:34:08 +00:00
Ben Laurie
2daceb0342 Call OCSP Stapling callback after ciphersuite has been chosen, so the 
right response is stapled. Also change SSL_get_certificate() so it
returns the certificate actually sent.  See
http://rt.openssl.org/Ticket/Display.html?id=2836.
 2012-09-11 12:57:46 +00:00
Dr. Stephen Henson
33a8de69dc new ctrl to retrive value of received temporary key in server key exchange message, print out details in s_client 2012-09-08 13:59:51 +00:00
Dr. Stephen Henson
319354eb6c store and print out message digest peer signed with in TLS 1.2 2012-09-07 12:53:42 +00:00
Dr. Stephen Henson
d47c01a31a perform sanity checks on server certificate type as soon as it is received instead of waiting until server key exchange 2012-08-31 11:18:54 +00:00
Dr. Stephen Henson
becfdb995b give more meaningful error if presented with wrong certificate type by server 2012-08-30 12:46:22 +00:00
Dr. Stephen Henson
ed83ba5321 Add compilation flag to disable certain protocol checks and allow use of 
some invalid operations for testing purposes. Currently this can be used
to sign using digests the peer doesn't support, EC curves the peer
doesn't support and use certificates which don't match the type associated
with a ciphersuite.
 2012-08-29 13:18:34 +00:00