summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-08-28unifdef a bunch of OPENSSL_NO_* ifdefs.David Benjamin
Get all this stuff out of the way. - OPENSSL_NO_MD5 - OPENSSL_NO_SHA - OPENSSL_NO_EC - OPENSSL_NO_ECDSA - OPENSSL_NO_ECDH - OPENSSL_NO_NEXTPROTONEG - OPENSSL_NO_DH - OPENSSL_NO_SSL3 - OPENSSL_NO_RC4 - OPENSSL_NO_RSA Also manually removed a couple instances of OPENSSL_NO_DSA that seemed to be confused anyway. Did some minor manual cleanup. (Removed a few now-pointless 'if (0)'s.) Change-Id: Id540ba97ee22ff2309ab20ceb24c7eabe766d4c4 Reviewed-on: https://boringssl-review.googlesource.com/1662 Reviewed-by: Adam Langley <agl@google.com>
2014-08-28Merge third_party/boringssl/src from ↵Android Chromium Automerger
https://boringssl.googlesource.com/boringssl.git at 1f3591d4c75fc4039dbd120ff1c459b311e976e2 This commit was generated by merge_from_chromium.py. Change-Id: I411d53504ee19f98131a4433e00dfd52400b39cf
2014-08-27Export CBS_asn1_ber_to_der.Adam Langley
We don't really want to expose this but the bytestring test calls this function directly and, when linked against a shared library, thus needs it to be in the dynamic symbol table. Change-Id: Ife01da36fe142026a6a3e545cff746512b966ee6
2014-08-27Fix BN_sub documentation.David Benjamin
BUG=405370 Change-Id: Ia44cbdcc4d0d90e610d1a1f2eb49b056b07ae5e4 Reviewed-on: https://boringssl-review.googlesource.com/1660 Reviewed-by: Adam Langley <agl@google.com>
2014-08-27Refactor server-side CertificateVerify handling.David Benjamin
This moves CertificateVerify digest processing to the new SSL_GET_MESSAGE_DONT_HASH_MESSAGE flag. It also refactors it similarly to ssl3_send_cert_verify and moves that logic to a common ssl3_cert_verify_hash function to compute the handshake hash. This removes a large chunk of duplicate (and divergent!) logic between TLS and DTLS. It also removes TLS1_FLAGS_KEEP_HANDSHAKE. Change-Id: Ia63c94f7d76d901bc9c4c33454fbfede411adf63 Reviewed-on: https://boringssl-review.googlesource.com/1633 Reviewed-by: Adam Langley <agl@google.com>
2014-08-27Revise hash management for reading the Finished message.David Benjamin
Upstream originally sampled the Finished message's hash at ChangeCipherSpec, but our patches to add messages between the two complicated this. Move DTLS to this path, but use the new SSL_GET_MESSAGE_DONT_HASH_MESSAGE flag to avoid special-casing message types in ssl3_get_message. Change-Id: I9c8ddd9cc500c94dff2ec2f696f89d50ab01b3ad Reviewed-on: https://boringssl-review.googlesource.com/1632 Reviewed-by: Adam Langley <agl@google.com>
2014-08-27Compute the Channel ID hash after ssl_get_message.David Benjamin
This avoids needing the save the hash on the SSL* (and use some field for two purposes). Instead, use the new SSL_GET_MESSAGE_DONT_HASH_MESSAGE flag (which actually was already used here, but at the time, pointlessly). Also fix a minor bug where the hash would be recomputed in non-blocking mode because init_num may stay zero for a few state machine iterations. Change-Id: I3d8331cf3134c5f9a3eda9e988bba5bcebe40933 Reviewed-on: https://boringssl-review.googlesource.com/1631 Reviewed-by: Adam Langley <agl@google.com>
2014-08-27Introduce a hash_message parameter to ssl_get_message.David Benjamin
This replaces the special-case in ssl3_get_message for Channel ID. Also add ssl3_hash_current_message to hash the current message, taking TLS vs DTLS handshake header size into account. One subtlety with this flag is that a message intended to be processed with SSL_GET_MESSAGE_DONT_HASH_MESSAGE cannot follow an optional message (reprocessed with reuse_message, etc.). There is an assertion to that effect. If need be, we can loosen it to requiring that the preceeding optional message also pass SSL_GET_MESSAGE_DONT_HASH_MESSAGE and then maintain some state to perform the more accurate assertion, but this is sufficient for now. Change-Id: If8c87342b291ac041a35885b9b5ee961aee86eab Reviewed-on: https://boringssl-review.googlesource.com/1630 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Fix build (broken by MD4_CTX redefine).Piotr Sikora
Change-Id: I0ce6f88ac2734e0267de5fed2cdd35bc20c9a8b5 Signed-off-by: Piotr Sikora <piotr@cloudflare.com> Reviewed-on: https://boringssl-review.googlesource.com/1650 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Add missing <errno.h> include.Piotr Sikora
Change-Id: I33d9dddbae277bcbfaeff6aacedd6d1371605207 Signed-off-by: Piotr Sikora <piotr@cloudflare.com> Reviewed-on: https://boringssl-review.googlesource.com/1651 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Move a variable declaration to function start.Adam Langley
(Fixes the Windows build.) Change-Id: Ibc7e3fe7cee275c8bc24198e996e4f92100ea9fc Reviewed-on: https://boringssl-review.googlesource.com/1642 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Fix "integer constant is too large for 'long' type" errors.Adam Langley
(Based on Piotr Sikora's change: https://boringssl-review.googlesource.com/#/c/1361) Change-Id: I7b62b81f4e4ef3064eee1b39334dc2e50d17f163 Reviewed-on: https://boringssl-review.googlesource.com/1641 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Remove hack in parsing PKCS#12.Adam Langley
This change removes the previous OpenSSL/NSS hack in PKCS#12 parsing and limits the hacks purely to the BER->DER conversion function, where they belong. PKCS#7 and #12 switch between implicit and explicit tags in different places and sometimes only implicitly define that they are using implicit tags. This change fixes a previous confusion where an implicit tag was thought to be explicit. Change-Id: Ib68c78cf2a1bfcbf90a296cb98313ab86ed2a1f3 Reviewed-on: https://boringssl-review.googlesource.com/1640 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Readd EC_GROUP_get_curve_GFp.Adam Langley
wpa_supplicant needs this in order to get the order of the coordinate field, apparently so that they can hash to a point. Change-Id: I92d5df7b37b67ace5f497c25f53f16bbe134aced Reviewed-on: https://boringssl-review.googlesource.com/1622 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Readd EVP_CIPHER_CTX_set_key_length.Adam Langley
This only applies to RC4, but it is still used by some Android code. Change-Id: I4cf86269ffb7a230576da1bb2bfef7e1d4f234d6 Reviewed-on: https://boringssl-review.googlesource.com/1621 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Readd MD4.Adam Langley
Sadly this is needed by wpa_supplicant for NTLM hashes. Change-Id: I1c362c676a11ee01f301ff6fbd33d0669396ea23 Reviewed-on: https://boringssl-review.googlesource.com/1620 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Rename some message functions for consistency.David Benjamin
Make the get/send functions match. ssl3_client_hello -> ssl3_send_client_hello. ssl3_send_newsession_ticket -> ssl3_send_new_session_ticket. ssl3_send_client_verify -> ssl3_send_cert_verify Change-Id: Iea5579479b8a8f392167b8fb3b7e9fe961d0f007 Reviewed-on: https://boringssl-review.googlesource.com/1613 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Add a test to ensure False Start occurs.David Benjamin
This adds the missing test coverage for 7e3305eebd7fb06d57e7f25b3bbf9c10d526f7d5. Change-Id: I8c9f1dc998afa9bb1f6fb2a7872a651037bb4844 Reviewed-on: https://boringssl-review.googlesource.com/1610 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Remove logic for non-signing client certificates.David Benjamin
Now that only RSA and ECDSA certificates are supported, the server should just reject non-signing ones outright, rather than allowing them to skip CertificateVerify. Change-Id: I7fe5ed3adde14481016ee841ed241faba18c26f0 Reviewed-on: https://boringssl-review.googlesource.com/1609 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26Add basic TLS Channel ID tests.David Benjamin
Change-Id: I7ccf2b8282dfa8f3985775e8b67edcf3c2949752 Reviewed-on: https://boringssl-review.googlesource.com/1606 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Fix FalseStart-SessionTicketsDisabled tests.David Benjamin
They weren't inheriting async settings. Change-Id: I5e9c04914926910dce63f93462cce4024627fb26 Reviewed-on: https://boringssl-review.googlesource.com/1605 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Introduce a mechanism for base64 options.David Benjamin
We may wish to pass data to the runner that contains NULs. Change-Id: Id78dad0ad0b5b6d0537481c818e3febdf1740cc9 Reviewed-on: https://boringssl-review.googlesource.com/1603 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Introduce EVP_DecodeBase64.David Benjamin
This fixes several of the problems with the old API. - Padding was completely ignored. - ='s in the middle of the input were accepted. - It tries to be helpful and strips leading/trailing whitespace. Change-Id: I99b9d5e6583f7eaf9bf0b6ee9ca39799811b58dc Reviewed-on: https://boringssl-review.googlesource.com/1602 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Update ssl3_get_channel_id for the simpler ECDSA_do_verify.David Benjamin
The return values are now 1/0, not 1/0/-1. Change-Id: If65bb08a229c7944cb439ec779df461904d0ec19 Reviewed-on: https://boringssl-review.googlesource.com/1607 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Implement TLS Channel ID in runner.goDavid Benjamin
Change-Id: Ia349c7a7cdcfd49965cd0c4d6cf81a76fbffb696 Reviewed-on: https://boringssl-review.googlesource.com/1604 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Fix flipped DTLS checks.David Benjamin
09bd58d1f1c71ed7ea687d0295e23793ad3d98fa flipped a condition. Doing that memset in the DTLS case breaks retransmits across a CCS and fails to memset in the TLS case. Strangely, it didn't break any tests, but I think that's a function of us lacking renego tests. The sequence number doesn't seem to be used in the initial handshake for TLS, so it stayed at zero. After a renego, that codepath is relevant. Change-Id: I369a524021857a82e181af7798c7a10fe6279550 Reviewed-on: https://boringssl-review.googlesource.com/1601 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Fix duplicate test name.David Benjamin
Change-Id: I16be575e4a6a13c74bd45a8fe3e1473502a80c86 Reviewed-on: https://boringssl-review.googlesource.com/1600 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Add PKCS#12 parser.Adam Langley
This is cleaner than the OpenSSL code was, at least, but it's hardly beautiful due to the "standard" that it's trying to implement. (See [1].) The references from the PKCS#8 code to various ciphers have digests have been made into function pointer references rather than NIDs so that the linker will be able to drop RC2 code for binaries that don't call PKCS#8 or #12 functions. A bug that crashed OpenSSL/BoringSSL when parsing a malformed PKCS#8 structure has been fixed too. See https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html Change-Id: Iaa1039e04ed7877b90792835e8ce3ebc3b29f89e Reviewed-on: https://boringssl-review.googlesource.com/1592 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Rework support for ASN.1 BER.Adam Langley
Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-25Add 40-bit RC2 support.Adam Langley
As useless as it might seem, the certificates in PKCS#12 files appear to always be encrypted with 40-bit RC2. OpenSSL, NSS and Windows are all the same on this point. Thus, in order to be able to import PKCS#12 files we need RC2 support. RC2 has deliberately not been added to EVP_get_cipherbynid so that the linker can drop the RC2 code unless the PKCS#12 functions are actually called. Change-Id: I5b2062fdf78cb622a8038c326da01aac8fb58962 Reviewed-on: https://boringssl-review.googlesource.com/1590 Reviewed-by: Adam Langley <agl@google.com>
2014-08-22Merge third_party/boringssl/src from ↵Android Chromium Automerger
https://boringssl.googlesource.com/boringssl.git at 5213df4e9ed9ca130c40f142893cb91f2e18eee1 This commit was generated by merge_from_chromium.py. Change-Id: I5ee5ea637eccbf60c3b6d4f4648acc469595eef4
2014-08-21Implement client side of TLS signed certificate stamps extension.Håvard Molland
https://crbug.com/389420 and 3.3 in rfc6962. Change-Id: Ib22bcd4e4bde5a314ed33e123e19a76cdb714da4 Reviewed-on: https://boringssl-review.googlesource.com/1491 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-08-21Convert all zero-argument functions to '(void)'David Benjamin
Otherwise, in C, it becomes a K&R function declaration which doesn't actually type-check the number of arguments. Change-Id: I0731a9fefca46fb1c266bfb1c33d464cf451a22e Reviewed-on: https://boringssl-review.googlesource.com/1582 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Prefer AES-GCM when hardware support is available.David Benjamin
BUG=396787 Change-Id: I72ddb0ec3c71dbc70054403163930cbbde4b6009 Reviewed-on: https://boringssl-review.googlesource.com/1581 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove MS SGC support on the the server.David Benjamin
It doesn't appear to have ever been implemented on the client. The server code stopped working anyway because it now skips the ssl_get_message call, so we never cash in on the reuse_message, attempt to reprocess the repeated ClientHello, and reject it thinking it's a second MS SGC restart. Change-Id: Id536846e08460143f6fc0a550bdcc1b26b506b04 Reviewed-on: https://boringssl-review.googlesource.com/1580 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Move common code between two branches.David Benjamin
Some follow-up cleanup to bd30f8e34a38d04bf34df51ea0a2ce159e8ab273. Change-Id: Id996c6c43f42f4db410e1e612ee1e5e8e0233356 Reviewed-on: https://boringssl-review.googlesource.com/1569 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove some unused state and code.David Benjamin
Change-Id: I1f917d1fe70ef5046eeea8fed27cc402bcd674b9 Reviewed-on: https://boringssl-review.googlesource.com/1568 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Don't scan libfoo_error.c for error codes.Håvard Molland
This will have the effect that all dead error codes are removed from given lib when make_errors.go runs with --reset flag. Change-Id: I6303721c5d7cd18af7d47c95fdf3702a7628ad5a Reviewed-on: https://boringssl-review.googlesource.com/1570 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Prune removed key types from SSL_PKEY_*.David Benjamin
Remove all the logic managing key types that aren't being used anymore. Change-Id: I101369164588048e64ba1c84a6b8aac8f3a221cd Reviewed-on: https://boringssl-review.googlesource.com/1567 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove DSA-based cipher suites and client auth.David Benjamin
DSA is not connected up to EVP, so it wouldn't work anyway. We shouldn't advertise a cipher suite we don't support. Chrome UMA data says virtually no handshakes end up negotiating one of these. Change-Id: I874d934432da6318f05782ebd149432c1d1e5275 Reviewed-on: https://boringssl-review.googlesource.com/1566 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Mark some more globals as const.David Benjamin
Change-Id: Ie6f3a3713ce1482a787444678a65daa37bc0b273 Reviewed-on: https://boringssl-review.googlesource.com/1565 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove ECDH_RSA, ECDH_ECDSA, DH_RSA, and DH_DSS.David Benjamin
These are the variants where the CA signs a Diffie-Hellman keypair. They are not supported by Chrome on NSS. Change-Id: I569a7ac58454bd3ed1cd5292d1f98499012cdf01 Reviewed-on: https://boringssl-review.googlesource.com/1564 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove support on both sides for *_fixed_(ec)dh client auth.David Benjamin
In the fixed_ecdh case, it wasn't even implemented, but there was stub code for it. It complicates the ClientKeyExchange (the client parameters become implicit in the certificate) and isn't used. Change-Id: I3627a37042539c90e05e59cd0cb3cd6c56225561 Reviewed-on: https://boringssl-review.googlesource.com/1563 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove single-DES cipher suites.David Benjamin
This also removes the 'LOW' strength class. Change-Id: Iffd2356dadb4a4875c1547a613d51061101358fd Reviewed-on: https://boringssl-review.googlesource.com/1562 Reviewed-by: Adam Langley <agl@google.com>
2014-08-20Remove remnants of now-removed cipher suites.David Benjamin
NULL, SRP, CAMELLIA, export ciphers, SSLv2, IDEA, and SEED are gone. Unknown directives are silently ignored in the parser, so there is no need to retain their masks and entries in the cipher suite aliases. Change-Id: If43b9cbce56b3e1c401db764b88996940452a300 Reviewed-on: https://boringssl-review.googlesource.com/1561 Reviewed-by: Adam Langley <agl@google.com>
2014-08-19Export some extra functions and values.Adam Langley
This change exports SSL_cutthrough_complete and EVP_EncodedLength (which were missed below) and also exports all ASN.1 "item" values because Android needs that. Change-Id: I6d10f935bb52ed6d682607a4016dd2b87758e3de Reviewed-on: https://boringssl-review.googlesource.com/1557 Reviewed-by: Adam Langley <agl@google.com>
2014-08-19Fix (harmless) memory leak in the test harness.Adam Langley
Change-Id: Ia0daaaaf464cfa0e9d563d7f376ce2bb2e338685 Reviewed-on: https://boringssl-review.googlesource.com/1560 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-08-19Fix minor comment typos.Adam Langley
Change-Id: If7752709727fe33ba38a9d414089253bb2f89ea2 Reviewed-on: https://boringssl-review.googlesource.com/1558 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-08-19Remove some dead code.Adam Langley
This change removes the old ASN.1 functions (ASN1_seq_unpack and ASN1_seq_pack) which have always been disabled in BoringSSL. It also removes code enabled by OPENSSL_EXPORT_VAR_AS_FUNCTION, which we have never used. Change-Id: I1fe323abf945a8a5828a04cc195c072e100a5095 Reviewed-on: https://boringssl-review.googlesource.com/1556 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-08-19Tidy up cipher ordering.David Benjamin
To align with what Chrome sends on NSS, remove all 3DES cipher suites except RSA_WITH_3DES_EDE_CBC_SHA. This avoids having to order a PFS 3DES cipher against a non-PFS 3DES cipher. Remove the strength sort which wanted place AES_256_CBC ahead of AES_128_GCM and is not especially useful (everything under 128 is either 3DES or DES). Instead, explicitly order all the bulk ciphers. Continue to prefer PFS over non-PFS and ECDHE over DHE. This gives the following order in Chromium. We can probably prune it a bit (DHE_DSS, DH_*) in a follow-up. TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc14) Forward Secrecy 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13) Forward Secrecy 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc15) Forward Secrecy 256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Forward Secrecy 128 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 (0xa2) Forward Secrecy* 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) Forward Secrecy 128 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Forward Secrecy 256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Forward Secrecy 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) Forward Secrecy 256 TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x38) Forward Secrecy* 256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Forward Secrecy 128 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Forward Secrecy 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) Forward Secrecy 128 TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x32) Forward Secrecy* 128 TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011) Forward Secrecy 128 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007) Forward Secrecy 128 TLS_DH_DSS_WITH_AES_128_GCM_SHA256 (0xa4) 128 TLS_DH_RSA_WITH_AES_128_GCM_SHA256 (0xa0) 128 TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128 TLS_DH_RSA_WITH_AES_256_CBC_SHA (0x37) 256 TLS_DH_DSS_WITH_AES_256_CBC_SHA (0x36) 256 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256 TLS_DH_RSA_WITH_AES_128_CBC_SHA (0x31) 128 TLS_DH_DSS_WITH_AES_128_CBC_SHA (0x30) 128 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 TLS_RSA_WITH_RC4_128_SHA (0x5) 128 TLS_RSA_WITH_RC4_128_MD5 (0x4) 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112 BUG=405091 Change-Id: Ib8dd28469414a4eb496788a57a215e7e21f8c37f Reviewed-on: https://boringssl-review.googlesource.com/1559 Reviewed-by: Adam Langley <agl@google.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-25 03:02:51 +0000