openssl

History

Benjamin Kaduk c589c34e61 Add support for the TLS 1.3 signature_algorithms_cert extension The new extension is like signature_algorithms, but only for the signature on the certificate we will present to the peer (the old signature_algorithms extension is still used for signatures that we generate, i.e., those over TLS data structures). We do not need to generate this extension, since we are the same implementation as our X.509 stack and can handle the same types of signatures, but we need to be prepared to receive it, and use the received information when selecting what certificate to present. There is a lot of interplay between signature_algorithms_cert and signature_algorithms, since both affect what certificate we can use, and thus the resulting signature algorithm used for TLS messages. So, apply signature_algorithms_cert (if present) as a filter on what certificates we can consider when choosing a certificate+sigalg pair. As part of this addition, we also remove the fallback code that let keys of type EVP_PKEY_RSA be used to generate RSA-PSS signatures -- the new rsa_pss_pss_* and rsa_pss_rsae_* signature schemes have pulled the key type into what is covered by the signature algorithm, so we should not apply this sort of compatibility workaround. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5068)		2018-01-25 12:57:22 -06:00
..
extensions.c	Add support for the TLS 1.3 signature_algorithms_cert extension	2018-01-25 12:57:22 -06:00
extensions_clnt.c	Remove spaces at end of line in ssl/statem	2017-12-17 23:04:41 +01:00
extensions_cust.c	Convert the state machine code to use SSLfatal()	2017-12-04 13:31:48 +00:00
extensions_srvr.c	Add support for the TLS 1.3 signature_algorithms_cert extension	2018-01-25 12:57:22 -06:00
README	Add a state machine README	2015-10-30 08:38:18 +00:00
statem.c	Fix interaction between SSL_stateless() and SSL_clear()	2018-01-24 18:02:36 +00:00
statem.h	Don't flush the ClientHello if we're going to send early data	2017-12-28 17:32:41 +00:00
statem_clnt.c	Add support for the TLS 1.3 signature_algorithms_cert extension	2018-01-25 12:57:22 -06:00
statem_dtls.c	More record layer conversions to use SSLfatal()	2017-12-08 16:42:02 +00:00
statem_lib.c	Don't send unexpected_message if we receive CCS while stateless	2018-01-24 18:02:37 +00:00
statem_locl.h	Add support for the TLS 1.3 signature_algorithms_cert extension	2018-01-25 12:57:22 -06:00
statem_srvr.c	Fix logic around when to send an HRR based on cookies	2018-01-24 18:02:36 +00:00

README

State Machine Design
====================

This file provides some guidance on the thinking behind the design of the
state machine code to aid future maintenance.

The state machine code replaces an older state machine present in OpenSSL
versions 1.0.2 and below. The new state machine has the following objectives:
    - Remove duplication of state code between client and server
    - Remove duplication of state code between TLS and DTLS
    - Simplify transitions and bring the logic together in a single location
      so that it is easier to validate
    - Remove duplication of code between each of the message handling functions
    - Receive a message first and then work out whether that is a valid
      transition - not the other way around (the other way causes lots of issues
      where we are expecting one type of message next but actually get something
      else)
    - Separate message flow state from handshake state (in order to better
      understand each)
      - message flow state = when to flush buffers; handling restarts in the
        event of NBIO events; handling the common flow of steps for reading a
        message and the common flow of steps for writing a message etc
      - handshake state = what handshake message are we working on now
    - Control complexity: only the state machine can change state: keep all
      the state changes local to the state machine component

The message flow state machine is divided into a reading sub-state machine and a
writing sub-state machine. See the source comments in statem.c for a more
detailed description of the various states and transitions possible.

Conceptually the state machine component is designed as follows:

                        libssl
                           |
---------------------------|-----statem.h--------------------------------------
                           |
                    _______V____________________
                   |                            |
                   |    statem.c                |
                   |                            |
                   |    Core state machine code |
                   |____________________________|
        statem_locl.h     ^          ^
                 _________|          |_______
                |                            |
   _____________|____________   _____________|____________
  |                          | |                          |
  | statem_clnt.c            | | statem_srvr.c            |
  |                          | |                          |
  | TLS/DTLS client specific | | TLS/DTLS server specific |
  | state machine code       | | state machine code       |
  |__________________________| |__________________________|
               |        |_______________|__       |
               |        ________________|  |      |
               |       |                   |      |
   ____________V_______V________   ________V______V_______________
  |                             | |                               |
  | statem_both.c               | | statem_dtls.c                 |
  |                             | |                               |
  | Non core functions common   | | Non core functions common to  |
  | to both servers and clients | | both DTLS servers and clients |
  |_____________________________| |_______________________________|