summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-02-27Merge third_party/boringssl/src from ↵HEADwebview-m40_r4webview-m40_r3webview-m40_r2android-m-preview-2android-m-preview-1ub-webview-m40-releasemastermainTorne (Richard Coles)
https://boringssl.googlesource.com/boringssl.git at 345b735e31460dfdefc95302b92baef9565d6028 Update to latest M40 boringssl version; pulls in: Import RSAEphemeralKey tests from master. Only allow ephemeral RSA keys in export ciphersuites.
2015-02-26Import RSAEphemeralKey tests from master.David Benjamin
This is a cherry-pick of https://boringssl-review.googlesource.com/#/c/2232/ and https://boringssl-review.googlesource.com/#/c/3650/ from master. Change-Id: Ia488e629f20a92121beefcf7e106292030b41f67 Reviewed-on: https://boringssl-review.googlesource.com/3660 Reviewed-by: Adam Langley <agl@google.com>
2015-02-26Only allow ephemeral RSA keys in export ciphersuites.Adam Langley
OpenSSL clients would tolerate temporary RSA keys in non-export ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which enabled this server side. Remove both options as they are a protocol violation. Thanks to Karthikeyan Bhargavan for reporting this issue. (CVE-2015-0204) (This is a backport of upstream's 37580f43b5a39f5f4e920d17273fab9713d3a744 to the M40 branch. In BoringSSL master we fixed this with https://boringssl.googlesource.com/boringssl/+/525a0fe315282ca1840f8f9f170c8a26ce5fab2a, but that's a larger patch than we really want to be backporting.) Change-Id: Ibfb0c46648bbecffb9d3b1a4ebdf10a5a79523b3 Reviewed-on: https://boringssl-review.googlesource.com/3640 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-16Merge from Chromium at DEPS revision 40.0.2214.87webview-m40_r1Ben Murdoch
This commit was generated by merge_to_master.py. Change-Id: I0b70505528e1d8edd49f779d849a2be616596b60
2015-01-16Merge third_party/boringssl/src from ↵Ben Murdoch
https://boringssl.googlesource.com/boringssl.git at 54e455157a6e1899eb6fef9440d2410cb7fedeff This commit was generated by merge_from_chromium.py. Change-Id: I8e88df721d075be5ffef28c287fb29efe4a70395
2015-01-06Set output EC_KEY to NULL when d2i_ECPrivateKey() fails.Eric Roman
BUG=crbug.com/445679 Change-Id: Ia012d806964bd7240148779797eccd326484f364 Reviewed-on: https://boringssl-review.googlesource.com/2722 Reviewed-by: Adam Langley <agl@google.com> (cherry picked from commit 517073cd4b7051811d1ede44aa8e59214e9759c8)
2014-11-06Merge from Chromium at DEPS revision db3f05efe0f9android-m-previewmaster-soongTorne (Richard Coles)
This commit was generated by merge_to_master.py. Change-Id: Ia542726d5df7935b2f79e8de6880d101853bb4c9
2014-11-06Merge third_party/boringssl/src from ↵Android Chromium Automerger
https://boringssl.googlesource.com/boringssl.git at 817ec3462e246b8301a73e44854e2bb3df90d5e6 This commit was generated by merge_from_chromium.py. Change-Id: Id13608e8a67ec3ad4e94a0b52adb6c6df089cdf0
2014-11-05Rename example_sign to evp_test.David Benjamin
This stopped being a sample program a bit ago. Change-Id: I23301fd71a373f995847dcfd64346bd262811f39 Reviewed-on: https://boringssl-review.googlesource.com/2131 Reviewed-by: Adam Langley <agl@google.com>
2014-11-05Allow PKCS#8 in d2i_AutoPrivateKey.David Benjamin
This got lost in the initial commit. Add a test for d2i_AutoPrivateKey. BUG=crbug.com/428671 Change-Id: Ib4f6114b03536edcfe3b1720a513f57f748e81d2 Reviewed-on: https://boringssl-review.googlesource.com/2130 Reviewed-by: Adam Langley <agl@google.com>
2014-11-05Call RtlGenRandom directly in RAND_bytes.David Benjamin
It works within the Chromium sandbox, unlike CryptAcquireContext and CryptGenRandom which requires the HCRYPTPROV be pre-warmed and held within the sandbox. Also account for the mismatch between size_t and ULONG/DWORD. See https://chromium.googlesource.com/chromium/src/+/master/base/rand_util_win.cc BUG=crbug.com/429919 Change-Id: Ia684124736c0c039ca9410509973192a597856ab Reviewed-on: https://boringssl-review.googlesource.com/2190 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Remove KSSL_DEBUG.Adam Langley
As far as I know, this is scar tissue left over from a Solaris feature: http://www.c0t0d0s0.org/archives/5575-Less-known-Solaris-Features-kssl.html Change-Id: I9fdc21de225f15d29bf856174bcd42e2592f8d95 Reviewed-on: https://boringssl-review.googlesource.com/2141 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Test renegotiation with BoringSSL as the client.Adam Langley
This also contains a test for the issue fixed in 88333ef7d7d47221ede66a2a31626fc426466297. Change-Id: Id705a82cee34c018491dc301eba8b5097b9c83d5 Reviewed-on: https://boringssl-review.googlesource.com/2083 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Make SSL_MODE_AUTO_RETRY the default.Adam Langley
Without SSL_MODE_AUTO_RETRY, even blocking mode will return SSL_ERROR_WANT_{READ|WRITE} in the event of a renegotiation. The comments in the code speak only of "nasty problems" unless this is done. The original commit that added SSL_MODE_AUTO_RETRY (54f10e6adce56eb2e59936e32216162aadc5d050) gives a little more detail: The [...] behaviour is needed by applications such as s_client and s_server that use select() to determine when to use SSL_read. Without the -nbio flag, s_client will use select() to find when the socket is readable and then call SSL_read with a blocking socket. However, this will still block in the event of an incomplete record, so the delay is already unbounded. This it's very unclear what the point of this behaviour ever was. Perhaps if the read and write paths were different sockets where the read socket was non-blocking but the write socket was blocking. But that seems like an implausible situation to worry too much about. Change-Id: I9d9f2526afc2e0fd0e5440e9a047f419a2d61afa Reviewed-on: https://boringssl-review.googlesource.com/2140 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Remove unused EVP_PKEY_ASN1_METHODs and flags.David Benjamin
The only alias, EVP_PKEY_RSA2, is handled programmatically. ASN1_PKEY_ALIAS and ASN1_PKEY_DYNAMIC are then unused and unexported and can be removed. Change-Id: I990650636bac3b802c8b439257c67ce7a3f8bc70 Reviewed-on: https://boringssl-review.googlesource.com/2124 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Remove BN_LONG macro.David Benjamin
It's never used, upstream or downstream. The 64-bit value is wrong anyway for LLP64 platforms. Change-Id: I56afc51f4c17ed3f1c30959b574034f181b5b0c7 Reviewed-on: https://boringssl-review.googlesource.com/2123 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Remove remnants of EVP_MD_FLAG_PKEY_METHOD_SIGNATURE.David Benjamin
Some archaeology: it was added in upstream's ee1d9ec019a7584482bd95891404f1cad66a4a0a. This seems to come from upstream's arrangement where an EVP_MD can specify both the signing algorithm and the message digest. (Most of the usual hash algorithms were tied to RSA.) The flag is set on EVP_MDs that should use the EVP_PKEY's method table in EVP_Sign* rather than the one attached to the EVP_MD (there's also required_pkey_type to filter on EVP_PKEY to prevent a mismatch). Without the flag, the old codepath is hit where they're tied together. Interestingly, EVP_md5 does not have the flag, but I suppose this is because no one would sign ECDSA + MD5. EVP_DigestSign* also postdates this and doesn't use the legacy mechanism anyway. Upstream also has, e.g., EVP_ecdsa(). Although those too have since also gained the flag in bce1af776247fee153223ea156228810779483ce. Let's get rid of these TODOs. We don't have the old codepath. It's unclear if upstream really does either at this point. Note: EVP_PKEY_RSA_method in upstream is actually a macro that expands to three fields, which is why it's so difficult to figure out what's going on with those structs. Change-Id: I1aea4d3f79f1eb1755063bb96c1c65276c6e3643 Reviewed-on: https://boringssl-review.googlesource.com/2122 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04DTLS1_AD_MISSING_HANDSHAKE_MESSAGE does not exist.David Benjamin
This code isn't compiled in. It seems there was some half-baked logic for a 7-byte alert that includes more information about handshake messages retransmit. No such alert exists, and the code had a FIXME anyway. If it gets resurrected in DTLS 1.3 or some extension, we can deal with it then. Change-Id: I8784ea8ee44bb8da4b0fe5d5d507997526557432 Reviewed-on: https://boringssl-review.googlesource.com/2121 Reviewed-by: Adam Langley <agl@google.com>
2014-11-04Remove remnant of MS SGC second ClientHello.David Benjamin
This code was dead as ssl3_get_client_certificate no longer allows a ClientHello; the hash would be reset, but then the handshake would fail anyway. Change-Id: Ib98e6a319c048c263d7ee3a27832ea57bdd0e2ad Reviewed-on: https://boringssl-review.googlesource.com/2120 Reviewed-by: Adam Langley <agl@google.com>
2014-11-03Test server-side renegotiation.Adam Langley
This change adds support to the Go code for renegotiation as a client, meaning that we can test BoringSSL's renegotiation as a server. Change-Id: Iaa9fb1a6022c51023bce36c47d4ef7abee74344b Reviewed-on: https://boringssl-review.googlesource.com/2082 Reviewed-by: Adam Langley <agl@google.com>
2014-11-03Fix unused variables in bn/generic.cDavid Benjamin
bl and bh are never used by macros if either BN_UMULT_LOHI or BN_UMULT_HIGH are defined. Change-Id: I7fdd45014a6b78cc586b5223396e09bc213608a5 Reviewed-on: https://boringssl-review.googlesource.com/2105 Reviewed-by: Adam Langley <agl@google.com>
2014-10-31Build with yasm on Win64 as well.David Benjamin
Chromium's doesn't have built-in support for ml64.exe. Seems easier to just build consistently with Yasm on both Win32 and Win64. (This will require an equivalent change in Chromium's build, but keep upstream and downstream builds consistent.) Also don't set CMAKE_ASM_NASM_COMPILER explicitly; cmake's default ASM_NASM behavior will search for both nasm or yasm in %PATH%. Leave it unset so it can be overwritten on the command-line to point to a particular yasm. Update BUILDING accordingly. Verified the tests still pass. Change-Id: I7e434be474b5b2d49e3bafbced5b41cc0246bd00 Reviewed-on: https://boringssl-review.googlesource.com/2104 Reviewed-by: Adam Langley <agl@google.com>
2014-10-31Get bssl tool building on Windows.David Benjamin
This lets us run bssl speed at least. bssl client is currently compiled out until we clean up our socket story on Windows and get it working. Change-Id: Ib1dc0d0e0a6eed7544207e7bbe138503731fda67 Reviewed-on: https://boringssl-review.googlesource.com/2103 Reviewed-by: Adam Langley <agl@google.com>
2014-10-31Fix standalone Win64 build.David Benjamin
generic.c still needs to include generic implementations in Win64. Those are currently done with inline assembly and won't work on MSVC. Change-Id: Ifeb5470872d8c97b2ccffeae6f3ccb5661051de3 Reviewed-on: https://boringssl-review.googlesource.com/2102 Reviewed-by: Adam Langley <agl@google.com>
2014-10-31Remove remnant of SRP.David Benjamin
Dead #ifdef. Change-Id: Ic8fcd56a2ee15dc4f8be485cd784eb1399640365 Reviewed-on: https://boringssl-review.googlesource.com/2101 Reviewed-by: Adam Langley <agl@google.com>
2014-10-31Port ssl3_{get,send}_server_key_exchange to EVP_Digest{Verify,Sign}*.David Benjamin
Minor change, but they're the users of the old API left within BoringSSL. Change-Id: Ic24e0d006c97fa5265abc3373d3f98aa8d2f8b1e Reviewed-on: https://boringssl-review.googlesource.com/2100 Reviewed-by: Adam Langley <agl@google.com>
2014-10-31Remove ERR_LIB_PKCS12.Adam Langley
This is no longer used but, by retaining it, we might miss cases where code is still testing against it. Change-Id: I40ed47e41f903aaf2c5e5354d4348f8890021382 Reviewed-on: https://boringssl-review.googlesource.com/2110 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-10-30Merge third_party/boringssl/src from ↵Android Chromium Automerger
https://boringssl.googlesource.com/boringssl.git at 03a739d8d2cdc2560531a7446ead0f705409670a This commit was generated by merge_from_chromium.py. Change-Id: I52d83e7a5a0a9b94fd10dbaf5350aef57d1c1f88
2014-10-29Build Win32 with Yasm rather than MASM.David Benjamin
Although x86masm.pl exists, upstream's documentation suggest only x86nasm.pl is supported. Yasm seems to handle it fine with a small change. Change-Id: Ia77be57c6b743527225924b2b398f2f07a084a7f Reviewed-on: https://boringssl-review.googlesource.com/2092 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Get MASM output working on Win32.David Benjamin
We were building the NASM flavor with MASM which is why it didn't work. Get the MASM output working: cpuid and cmove are not available in MASM unless the file declares .686. Also work around MASM rejecting a very long line in SHA-256. The follow-up change will get the NASM flavor working. We should probably use that one as it's documented as supported upstream. But let's make this one functional too. Change-Id: Ica69cc042a7250c7bc9ba9325caab597cd4ce616 Reviewed-on: https://boringssl-review.googlesource.com/2091 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Fix standalone bio_test and v3name_test on Win64.David Benjamin
Win32 still has assembly issues and bssl wants to select() on both sockets and stdin (doesn't work on Windows). But this is a start. Change-Id: Iafc5215be281aed836c5ac2dc8b379399848a2c2 Reviewed-on: https://boringssl-review.googlesource.com/2090 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Add -cipher option to bssl client.Adam Langley
Change-Id: I3da1af62de9a94317fa7f14fda00e230b32bf5d5 Reviewed-on: https://boringssl-review.googlesource.com/2081 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Fix double-frees on malloc failure in ssl3_get_client_key_exchange.David Benjamin
If generating the master secret or applying the PSK post-processing fails, we'll double-free all the ECDH state. Change-Id: Id52931af73bdef5eceb06f7e64d32fdda629521e Reviewed-on: https://boringssl-review.googlesource.com/2063 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Refactor ssl3_send_client_key_exchange slightly.David Benjamin
Like ssl3_get_client_key_exchange, it is split into three parts: - If PSK, query the PSK and write out the PSK identity. - Compute the base pre-master secret. - If PSK, compute the final pre-master secret. This also fixes some double-frees on malloc failures in the ECDHE case. And it avoids using the handshake output buffer to start the premaster secret. Change-Id: I8631ee33c1e9c19604b3dcce2c676c83893c308d Reviewed-on: https://boringssl-review.googlesource.com/2062 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Add tests for ECDHE_PSK.David Benjamin
pskKeyAgreement is now a wrapper over a base key agreement. Change-Id: Ic18862d3e98f7513476f878b8df5dcd8d36a0eac Reviewed-on: https://boringssl-review.googlesource.com/2053 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Fix ECDHE_PSK key exchange.David Benjamin
The current implementation switches the order of other_secret and psk; other_secret is first. Fix it and rewrite with CBB instead. The server half got fixed on accident in a prior refactor. Change-Id: Ib52a756aadd66e4bf22c66794447f71f4772da09 Reviewed-on: https://boringssl-review.googlesource.com/2052 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29Add tests for PSK cipher suites.David Benjamin
Only the three plain PSK suites for now. ECDHE_PSK_WITH_AES_128_GCM_SHA256 will be in a follow-up. Change-Id: Iafc116a5b2798c61d90c139b461cf98897ae23b3 Reviewed-on: https://boringssl-review.googlesource.com/2051 Reviewed-by: Adam Langley <agl@google.com>
2014-10-28Move the X509_NAME typedef into x509.h.David Benjamin
X509_NAME is one of the symbols that collide with wincrypt.h. Move it to x509.h so libraries which only use the pure-crypto portions of BoringSSL without X.509 needn't have to resolve the collision. Change-Id: I057873498e58fe4a4cf264356f9a58d7a15397b7 Reviewed-on: https://boringssl-review.googlesource.com/2080 Reviewed-by: Adam Langley <agl@google.com>
2014-10-28Make EVP_DigestVerifyFinal return only zero or one.David Benjamin
It was already almost there. Just a malloc failure away. now all the EVP_Digest{Sign,Verify}* functions may be used without worrying about -1 return values. Change-Id: I96a9750b300010615979bd5f1522b1d241764665 Reviewed-on: https://boringssl-review.googlesource.com/2064 Reviewed-by: Adam Langley <agl@google.com>
2014-10-28Add SSL_SESSION_to_bytes to replace i2d_SSL_SESSION.David Benjamin
Deprecate the old two-pass version of the function. If the ticket is too long, replace it with a placeholder value but keep the connection working. Change-Id: Ib9fdea66389b171862143d79b5540ea90a9bd5fb Reviewed-on: https://boringssl-review.googlesource.com/2011 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27Fix build (broken by removal of key_arg from SSL_SESSION parsing).Piotr Sikora
This fixes error reported by clang: unused variable 'kKeyArgTag' [-Werror,-Wunused-const-variable]. Change-Id: I1d5c9937064bfadd810cbe1b73e0070cc2ead684 Signed-off-by: Piotr Sikora <piotr@cloudflare.com> Reviewed-on: https://boringssl-review.googlesource.com/2070 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27Fix build on Windows.David Benjamin
This broke in a19fc259f05e6ec2df0a55e7a37adc37506d3a91. Change-Id: Icbdb6c7ed7f1f4906cc9c948ecbd6cfd5a0d7e73 Reviewed-on: https://boringssl-review.googlesource.com/2061 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27Add less dangerous versions of SRTP functions.David Benjamin
The old ones inverted their return value. Add SSL_(CTX_)set_srtp_profiles which return success/failure correctly and deprecate the old functions. Also align srtp.h with the new style since it's very short. When this rolls through, we can move WebRTC over to the new ones. Change-Id: Ie55282e8858331910bba6ad330c8bcdd0e38f2f8 Reviewed-on: https://boringssl-review.googlesource.com/2060 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27Don't bother accepting key_arg when parsing SSL_SESSION.David Benjamin
Doing some archeaology, since the initial OpenSSL commit, key_arg has been omitted from the serialization if key_arg_length was 0. Since this is an SSLv2-only field and resuming an SSLv2 session with SSLv3+ is not possible, there is no need to support parsing those sessions. Interestingly, it is actually not the case that key_arg_length was only ever set in SSLv2, historically. In the initial commit of OpenSSL, SSLeay 0.8.1b, key_arg was used to store what appears to be the IV. That was then removed in the next commit, an import of SSLeay 0.9.0b, at which point key_arg was only ever set in SSLv3. That is old enough that there is certainly no need to parse pre-SSLeay-0.9.0b sessions... Change-Id: Ia768a2d97ddbe60309be20e2efe488640c4776d9 Reviewed-on: https://boringssl-review.googlesource.com/2050 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27Merge from Chromium at DEPS revision 614f7b807940Torne (Richard Coles)
This commit was generated by merge_to_master.py. Change-Id: Ifd5f8da9c17f42835b8627d7652025e00c0d9dbd
2014-10-24Fix "integer constant is too large for 'long' type" errors.Piotr Sikora
Change-Id: I018cdc805e19284b057a57d04c9665f0a35ccc3b Signed-off-by: Piotr Sikora <piotr@cloudflare.com> Reviewed-on: https://boringssl-review.googlesource.com/2040 Reviewed-by: Adam Langley <agl@google.com>
2014-10-24Extended master secret support.Adam Langley
This change implements support for the extended master secret. See https://tools.ietf.org/html/draft-ietf-tls-session-hash-01 https://secure-resumption.com/ Change-Id: Ifc7327763149ab0894b4f1d48cdc35e0f1093b93 Reviewed-on: https://boringssl-review.googlesource.com/1930 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-10-24Reimplement i2d_SSL_SESSION using CBB.David Benjamin
No more need for all the macros. For now, this still follows the two-pass i2d_* API despite paying a now-unnecessary malloc. The follow-on commit will expose a more reasonable API and deprecate this one. Change-Id: I50ec63e65afbd455ad3bcd2f1ae3c782d9e8f9d2 Reviewed-on: https://boringssl-review.googlesource.com/2000 Reviewed-by: Adam Langley <agl@google.com>
2014-10-24Reimplement d2i_SSL_SESSION with CBS.David Benjamin
Do away with all those unreadable macros. Also fix many many memory leaks in the SSL_SESSION reuse case. Add a number of helper functions in CBS to help with parsing optional fields. Change-Id: I2ce8fd0d5b060a1b56e7f99f7780997fabc5ce41 Reviewed-on: https://boringssl-review.googlesource.com/1998 Reviewed-by: Adam Langley <agl@google.com>
2014-10-24The empty contents are not a valid ASN.1 INTEGER.David Benjamin
Zero is encoded as a single zero octet. Per X.690, 8.3.1: The encoding of an integer value shall be primitive. The contents octets shall consist of one or more octets. Change-Id: If4304a2be5117b71446a3a62a2b8a6124f85a202 Reviewed-on: https://boringssl-review.googlesource.com/2010 Reviewed-by: Adam Langley <agl@google.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-06 08:21:57 +0000