Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-05-17 20:27:18 +09:00
parent ad9fce94c2
commit 3a6d64bb68
619 changed files with 13638 additions and 4698 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssl/bio_ssl.c
+2 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -284,6 +284,7 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
ssl_free(b);
if (!ssl_new(b))
return 0;
bs = BIO_get_data(b);
}
BIO_set_shutdown(b, num);
ssl = (SSL *)ptr;
ssl/d1_srtp.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2011-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -19,6 +19,8 @@
#ifndef OPENSSL_NO_SRTP
DEFINE_STACK_OF(SRTP_PROTECTION_PROFILE)
static SRTP_PROTECTION_PROFILE srtp_known_profiles[] = {
{
"SRTP_AES128_CM_SHA1_80",
ssl/record/rec_layer_s3.c
+5 -3
View File
@@ -384,10 +384,12 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, size_t len,
s->rlayer.wnum = 0;
/*
* If we are supposed to be sending a KeyUpdate then go into init unless we
* have writes pending - in which case we should finish doing that first.
* If we are supposed to be sending a KeyUpdate or NewSessionTicket then go
* into init unless we have writes pending - in which case we should finish
* doing that first.
*/
if (wb->left == 0 && s->key_update != SSL_KEY_UPDATE_NONE)
if (wb->left == 0 && (s->key_update != SSL_KEY_UPDATE_NONE
|| s->ext.extra_tickets_expected > 0))
ossl_statem_set_in_init(s, 1);
/*
ssl/record/ssl3_buffer.c
+1 -1
View File
@@ -94,7 +94,7 @@ int ssl3_setup_write_buffer(SSL *s, size_t numwpipes, size_t len)
headerlen = SSL3_RT_HEADER_LENGTH;
#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1);
align = SSL3_ALIGN_PAYLOAD - 1;
#endif
len = ssl_get_max_send_fragment(s)
ssl/s3_lib.c
+4
View File
@@ -20,6 +20,10 @@
#include <openssl/x509v3.h>
#include "internal/cryptlib.h"
DEFINE_STACK_OF(X509_NAME)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
#define TLS13_NUM_CIPHERS OSSL_NELEM(tls13_ciphers)
#define SSL3_NUM_CIPHERS OSSL_NELEM(ssl3_ciphers)
#define SSL3_NUM_SCSVS OSSL_NELEM(ssl3_scsvs)
ssl/ssl_cert.c
+18 -11
View File
@@ -25,6 +25,9 @@
#include "ssl_cert_table.h"
#include "internal/thread_once.h"
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_NAME)
static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx,
int op, int bits, int nid, void *other,
void *ex);
@@ -869,7 +872,10 @@ int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags)
untrusted = cpk->chain;
}
xs_ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);
if (s == NULL)
xs_ctx = X509_STORE_CTX_new_with_libctx(ctx->libctx, ctx->propq);
else
xs_ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);
if (xs_ctx == NULL) {
SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, ERR_R_MALLOC_FAILURE);
goto err;
@@ -1062,19 +1068,20 @@ int ssl_cert_lookup_by_nid(int nid, size_t *pidx)
const SSL_CERT_LOOKUP *ssl_cert_lookup_by_pkey(const EVP_PKEY *pk, size_t *pidx)
{
int nid = EVP_PKEY_id(pk);
size_t tmpidx;
size_t i;
if (nid == NID_undef)
return NULL;
for (i = 0; i < OSSL_NELEM(ssl_cert_info); i++) {
const SSL_CERT_LOOKUP *tmp_lu = &ssl_cert_info[i];
if (!ssl_cert_lookup_by_nid(nid, &tmpidx))
return NULL;
if (EVP_PKEY_is_a(pk, OBJ_nid2sn(tmp_lu->nid))
|| EVP_PKEY_is_a(pk, OBJ_nid2ln(tmp_lu->nid))) {
if (pidx != NULL)
*pidx = i;
return tmp_lu;
}
}
if (pidx != NULL)
*pidx = tmpidx;
return &ssl_cert_info[tmpidx];
return NULL;
}
const SSL_CERT_LOOKUP *ssl_cert_lookup_by_idx(size_t idx)
ssl/ssl_ciph.c
+3
View File
@@ -22,6 +22,9 @@
#include "internal/thread_once.h"
#include "internal/cryptlib.h"
DEFINE_STACK_OF(SSL_COMP)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
#define SSL_ENC_DES_IDX 0
#define SSL_ENC_3DES_IDX 1
#define SSL_ENC_RC4_IDX 2
ssl/ssl_conf.c
+5 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -14,6 +14,8 @@
#include <openssl/dh.h>
#include "internal/nelem.h"
DEFINE_STACK_OF(X509_NAME)
/*
* structure holding name tables. This is used for permitted elements in lists
* such as TLSv1.
@@ -381,7 +383,8 @@ static int cmd_Options(SSL_CONF_CTX *cctx, const char *value)
SSL_FLAG_TBL("PrioritizeChaCha", SSL_OP_PRIORITIZE_CHACHA),
SSL_FLAG_TBL("MiddleboxCompat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT),
SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY),
SSL_FLAG_TBL_INV("ExtendedMasterSecret", SSL_OP_NO_EXTENDED_MASTER_SECRET)
SSL_FLAG_TBL_INV("ExtendedMasterSecret", SSL_OP_NO_EXTENDED_MASTER_SECRET),
SSL_FLAG_TBL_INV("CANames", SSL_OP_DISABLE_TLSEXT_CA_NAMES)
};
if (value == NULL)
return -3;
ssl/ssl_lib.c
+17
View File
@@ -26,6 +26,14 @@
#include "internal/refcount.h"
#include "internal/ktls.h"
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_NAME)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
DEFINE_STACK_OF(X509_EXTENSION)
DEFINE_STACK_OF(OCSP_RESPID)
DEFINE_STACK_OF(SRTP_PROTECTION_PROFILE)
DEFINE_STACK_OF(SCT)
static int ssl_undefined_function_1(SSL *ssl, SSL3_RECORD *r, size_t s, int t)
{
(void)r;
@@ -2361,6 +2369,15 @@ int SSL_renegotiate_pending(const SSL *s)
return (s->renegotiate != 0);
}
int SSL_new_session_ticket(SSL *s)
{
if (SSL_in_init(s) || SSL_IS_FIRST_HANDSHAKE(s) || !s->server
|| !SSL_IS_TLS13(s))
return 0;
s->ext.extra_tickets_expected++;
return 1;
}
long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
{
long l;
ssl/ssl_local.h
+2
View File
@@ -1548,6 +1548,8 @@ struct ssl_st {
/* RFC4507 session ticket expected to be received or sent */
int ticket_expected;
/* TLS 1.3 tickets requested by the application. */
int extra_tickets_expected;
# ifndef OPENSSL_NO_EC
size_t ecpointformats_len;
/* our list */
ssl/ssl_rsa.c
+2
View File
@@ -17,6 +17,8 @@
#include <openssl/x509v3.h>
#include <openssl/pem.h>
DEFINE_STACK_OF(X509)
static int ssl_set_cert(CERT *c, X509 *x509);
static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
ssl/ssl_sess.c
+2
View File
@@ -16,6 +16,8 @@
#include "ssl_local.h"
#include "statem/statem_local.h"
DEFINE_STACK_OF(X509)
static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s);
static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
ssl/statem/extensions.c
+2
View File
@@ -14,6 +14,8 @@
#include "statem_local.h"
#include "internal/cryptlib.h"
DEFINE_STACK_OF(X509_NAME)
static int final_renegotiate(SSL *s, unsigned int context, int sent);
static int init_server_name(SSL *s, unsigned int context);
static int final_server_name(SSL *s, unsigned int context, int sent);
ssl/statem/extensions_clnt.c
+4
View File
@@ -12,6 +12,10 @@
#include "internal/cryptlib.h"
#include "statem_local.h"
DEFINE_STACK_OF(SRTP_PROTECTION_PROFILE)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
DEFINE_STACK_OF(OCSP_RESPID)
EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt,
unsigned int context, X509 *x,
size_t chainidx)
ssl/statem/extensions_srvr.c
+4
View File
@@ -12,6 +12,10 @@
#include "statem_local.h"
#include "internal/cryptlib.h"
DEFINE_STACK_OF(SRTP_PROTECTION_PROFILE)
DEFINE_STACK_OF(OCSP_RESPID)
DEFINE_STACK_OF(X509_EXTENSION)
#define COOKIE_STATE_FORMAT_VERSION 0
/*
ssl/statem/statem_clnt.c
+4
View File
@@ -25,6 +25,10 @@
#include <openssl/trace.h>
#include <internal/cryptlib.h>
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(SSL_COMP)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt);
static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt);
ssl/statem/statem_lib.c
+5 -1
View File
@@ -21,6 +21,10 @@
#include <openssl/x509.h>
#include <openssl/trace.h>
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_NAME)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
/*
* Map error codes to TLS/SSL alart types.
*/
@@ -2338,7 +2342,7 @@ int construct_ca_names(SSL *s, const STACK_OF(X509_NAME) *ca_sk, WPACKET *pkt)
return 0;
}
if (ca_sk != NULL) {
if ((ca_sk != NULL) && !(s->options & SSL_OP_DISABLE_TLSEXT_CA_NAMES)) {
int i;
for (i = 0; i < sk_X509_NAME_num(ca_sk); i++) {
ssl/statem/statem_srvr.c
+19 -4
View File
@@ -26,6 +26,10 @@
#include <openssl/core_names.h>
#include <openssl/asn1t.h>
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(SSL_COMP)
DEFINE_STACK_OF_CONST(SSL_CIPHER)
#define TICKET_NONCE_SIZE 8
typedef struct {
@@ -437,6 +441,10 @@ static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s)
st->hand_state = TLS_ST_SW_CERT_REQ;
return WRITE_TRAN_CONTINUE;
}
if (s->ext.extra_tickets_expected > 0) {
st->hand_state = TLS_ST_SW_SESSION_TICKET;
return WRITE_TRAN_CONTINUE;
}
/* Try to read from the client instead */
return WRITE_TRAN_FINISHED;
@@ -527,7 +535,9 @@ static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s)
* Following an initial handshake we send the number of tickets we have
* been configured for.
*/
if (s->hit || s->num_tickets <= s->sent_tickets) {
if (!SSL_IS_FIRST_HANDSHAKE(s) && s->ext.extra_tickets_expected > 0) {
return WRITE_TRAN_CONTINUE;
} else if (s->hit || s->num_tickets <= s->sent_tickets) {
/* We've written enough tickets out. */
st->hand_state = TLS_ST_OK;
}
@@ -723,7 +733,8 @@ WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst)
return WORK_FINISHED_CONTINUE;
case TLS_ST_SW_SESSION_TICKET:
if (SSL_IS_TLS13(s) && s->sent_tickets == 0) {
if (SSL_IS_TLS13(s) && s->sent_tickets == 0
&& s->ext.extra_tickets_expected == 0) {
/*
* Actually this is the end of the handshake, but we're going
* straight into writing the session ticket out. So we finish off
@@ -732,7 +743,8 @@ WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst)
* Calls SSLfatal as required.
*/
return tls_finish_handshake(s, wst, 0, 0);
} if (SSL_IS_DTLS(s)) {
}
if (SSL_IS_DTLS(s)) {
/*
* We're into the last flight. We don't retransmit the last flight
* unless we need to, so we don't use the timer
@@ -4157,10 +4169,13 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
/*
* Increment both |sent_tickets| and |next_ticket_nonce|. |sent_tickets|
* gets reset to 0 if we send more tickets following a post-handshake
* auth, but |next_ticket_nonce| does not.
* auth, but |next_ticket_nonce| does not. If we're sending extra
* tickets, decrement the count of pending extra tickets.
*/
s->sent_tickets++;
s->next_ticket_nonce++;
if (s->ext.extra_tickets_expected > 0)
s->ext.extra_tickets_expected--;
ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
}
ssl/t1_lib.c
+11 -7
View File
@@ -26,6 +26,10 @@
#include "ssl_local.h"
#include <openssl/ct.h>
DEFINE_STACK_OF_CONST(SSL_CIPHER)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(X509_NAME)
static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey);
static int tls12_sigalg_allowed(const SSL *s, int op, const SIGALG_LOOKUP *lu);
@@ -174,13 +178,13 @@ static const TLS_GROUP_INFO nid_list[] = {
{EVP_PKEY_X448, "X448", 224, TLS_GROUP_CURVE_CUSTOM, 0x001E}, /* X448 (30) */
# endif /* OPENSSL_NO_EC */
# ifndef OPENSSL_NO_GOST
{NID_id_tc26_gost_3410_2012_256_paramSetA, "GOST_2012_256", 112, TLS_GROUP_CURVE_PRIME, 0x0022}, /* GC256A (34) */
{NID_id_tc26_gost_3410_2012_256_paramSetB, "GOST_2012_256", 112, TLS_GROUP_CURVE_PRIME, 0x0023}, /* GC256B (35) */
{NID_id_tc26_gost_3410_2012_256_paramSetC, "GOST_2012_256", 112, TLS_GROUP_CURVE_PRIME, 0x0024}, /* GC256C (36) */
{NID_id_tc26_gost_3410_2012_256_paramSetD, "GOST_2012_256", 112, TLS_GROUP_CURVE_PRIME, 0x0025}, /* GC256D (37) */
{NID_id_tc26_gost_3410_2012_512_paramSetA, "GOST_2012_512", 112, TLS_GROUP_CURVE_PRIME, 0x0026}, /* GC512A (38) */
{NID_id_tc26_gost_3410_2012_512_paramSetB, "GOST_2012_512", 112, TLS_GROUP_CURVE_PRIME, 0x0027}, /* GC512B (39) */
{NID_id_tc26_gost_3410_2012_512_paramSetC, "GOST_2012_512", 112, TLS_GROUP_CURVE_PRIME, 0x0028}, /* GC512C (40) */
{NID_id_tc26_gost_3410_2012_256_paramSetA, "GOST_2012_256", 128, TLS_GROUP_CURVE_PRIME, 0x0022}, /* GC256A (34) */
{NID_id_tc26_gost_3410_2012_256_paramSetB, "GOST_2012_256", 128, TLS_GROUP_CURVE_PRIME, 0x0023}, /* GC256B (35) */
{NID_id_tc26_gost_3410_2012_256_paramSetC, "GOST_2012_256", 128, TLS_GROUP_CURVE_PRIME, 0x0024}, /* GC256C (36) */
{NID_id_tc26_gost_3410_2012_256_paramSetD, "GOST_2012_256", 128, TLS_GROUP_CURVE_PRIME, 0x0025}, /* GC256D (37) */
{NID_id_tc26_gost_3410_2012_512_paramSetA, "GOST_2012_512", 256, TLS_GROUP_CURVE_PRIME, 0x0026}, /* GC512A (38) */
{NID_id_tc26_gost_3410_2012_512_paramSetB, "GOST_2012_512", 256, TLS_GROUP_CURVE_PRIME, 0x0027}, /* GC512B (39) */
{NID_id_tc26_gost_3410_2012_512_paramSetC, "GOST_2012_512", 256, TLS_GROUP_CURVE_PRIME, 0x0028}, /* GC512C (40) */
# endif /* OPENSSL_NO_GOST */
# ifndef OPENSSL_NO_DH
/* Security bit values for FFDHE groups are updated as per RFC 7919 */
ssl/tls13_enc.c
+9 -2
View File
@@ -413,11 +413,18 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
uint32_t algenc;
ivlen = EVP_CCM_TLS_IV_LEN;
if (s->s3.tmp.new_cipher == NULL) {
if (s->s3.tmp.new_cipher != NULL) {
algenc = s->s3.tmp.new_cipher->algorithm_enc;
} else if (s->session->cipher != NULL) {
/* We've not selected a cipher yet - we must be doing early data */
algenc = s->session->cipher->algorithm_enc;
} else if (s->psksession != NULL && s->psksession->cipher != NULL) {
/* We must be doing early data with out-of-band PSK */
algenc = s->psksession->cipher->algorithm_enc;
} else {
algenc = s->s3.tmp.new_cipher->algorithm_enc;
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
ERR_R_EVP_LIB);
goto err;
}
if (algenc & (SSL_AES128CCM8 | SSL_AES256CCM8))
taglen = EVP_CCM8_TLS_TAG_LEN;