summaryrefslogtreecommitdiff
path: root/lib/handshake.c
Commit message (Collapse)AuthorAgeFilesLines
* doc: assorted typo fixestmp-typo-fixesDaiki Ueno2020-08-121-1/+1
| | | | | | Spotted by codespell. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: use valgrind client request to detect undefined memory usetmp-valgrind-memcheckDaiki Ueno2020-04-041-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | This tightens the check introduced in ac2f71b892d13a7ab4cc39086eef179042c7e23c, by using the valgrind client request to explicitly mark the "uninitialized but initialization is needed before use" regions. With this patch and the fix (c01011c2d8533dbbbe754e49e256c109cb848d0d) reverted, you will see the following error when running dtls_hello_random_value under valgrind: $ valgrind ./dtls_hello_random_value testing: default ==520145== Conditional jump or move depends on uninitialised value(s) ==520145== at 0x4025F5: hello_callback (dtls_hello_random_value.c:90) ==520145== by 0x488BF97: _gnutls_call_hook_func (handshake.c:1215) ==520145== by 0x488C1AA: _gnutls_send_handshake2 (handshake.c:1332) ==520145== by 0x488FC7E: send_client_hello (handshake.c:2290) ==520145== by 0x48902A1: handshake_client (handshake.c:2908) ==520145== by 0x48902A1: gnutls_handshake (handshake.c:2740) ==520145== by 0x402CB3: client (dtls_hello_random_value.c:153) ==520145== by 0x402CB3: start (dtls_hello_random_value.c:317) ==520145== by 0x402EFE: doit (dtls_hello_random_value.c:331) ==520145== by 0x4023D4: main (utils.c:254) ==520145== Signed-off-by: Daiki Ueno <dueno@redhat.com>
* dtls client hello: fix zeroed random (fixes #960)Stefan Bühler2020-03-271-1/+1
| | | | | | | This broke with bcf4de03 "handshake: treat reply to HRR as a reply to hello verify request", which failed to "De Morgan" properly. Signed-off-by: Stefan Bühler <stbuehler@web.de>
* handshake.c: Suppress warning in fuzzing buildTim Rühsen2020-01-031-0/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* lib/handshake.c: Check return value of _gnutls_version_max()Tim Rühsen2019-10-121-0/+2
| | | | | | | Fixes Coverity issue 1454674 Fixes Coverity issue 1454658 Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Remove trailing spaces in several filesTim Rühsen2019-10-121-19/+19
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* handshake: move early secrets calculation to pre_shared_keyDaiki Ueno2019-04-191-121/+38
| | | | | | | TLS 1.3 Early Secret and the derived keys are calculated upon a PSK being selected, thus the code fits better in ext/pre_shared_key.c. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Improved estimation of wait in gnutls_session_get_data2tmp-improve-session-resumptionNikos Mavrogiannopoulos2019-03-191-1/+13
| | | | | | | | | | | | | Previously we would wait an arbitrary value of 50ms for the server to send session tickets. This change makes the client wait for the estimated single trip time + 60 ms for the server to calculate the session tickets. This improves the chance to obtain tickets from internet servers during the call of gnutls_session_get_data2(). Resolves: #706 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Removed all FIXME comments in code [ci skip]Nikos Mavrogiannopoulos2019-03-161-4/+0
| | | | | | | | We expand informational comments on limitations, but with removing FIXME (keyword didn't help fixing these), and remove completely unhelpful comments, obsolete ones, or comments about ideas. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Merge branch 'tmp-explicit-sanity-checks' into 'master'Nikos Mavrogiannopoulos2019-03-061-3/+23
|\ | | | | | | | | cleanup: _gnutls_recv_handshake: added explicit sanity checks See merge request gnutls/gnutls!937
| * _gnutls_recv_handshake: added explicit sanity checkstmp-explicit-sanity-checksNikos Mavrogiannopoulos2019-02-231-3/+23
| | | | | | | | | | | | | | | | | | Although, this function acts on the message provided as expected and thus it should never call a message parsing function on unexpected messages, we make a more explicit sanity check. This unifies the sanity checks existing within the involved functions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* | gnutls_record_send2: try to ensure integrity of operations on false and ↵Nikos Mavrogiannopoulos2019-03-021-3/+8
|/ | | | | | | | | | early start This adds a double check in the sanity check of gnutls_record_send2() for the initial_negotiation_completed value, making sure that the check will be successful even in parallel operation of send/recv. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fallback to TLS 1.2 when incompatible with signature certs are providedNikos Mavrogiannopoulos2019-02-061-1/+7
| | | | | | | | | | This only takes into account certificates in the credentials structure. If certificates are provided in a callback, these must be checked by the provider. For that we assume that the credentials structure is filled when associated with a session; if not then the fallback mechanism will not work and the handshake will fail. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fix typos in lib/tmp-fix-typos-in-libTim Rühsen2019-01-041-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Fix gnutls_handshake_set_timeout() for values < 1000tmp-fix-timeoutTim Rühsen2018-12-061-4/+15
| | | | | | | handshake-timeout.c now tests for <1000ms timeout and for >=1000ms timeout. The test duration decreased from 45s to 1.2s. Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* handshake: handle early dataDaiki Ueno2018-11-111-5/+92
| | | | | | | | | | | This plumbers early data handling in the handshake processes, which consists of: - traffic key updates taking into account of client_early_traffic_secret - early data buffering in both server and client - the EndOfEarlyData message handling - making use of max_early_data_size extension in NewSessionTicket Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: refactor early secret derivationDaiki Ueno2018-11-111-16/+0
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: record transcript hash for ClientHelloDaiki Ueno2018-11-111-0/+7
| | | | | | | This is necessary to compute client_early_traffic_secret and early_exporter_master_secret in TLS 1.3. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* system: provide a means to replace gettime implementationDaiki Ueno2018-10-261-1/+1
| | | | | | | | | While gettime() is extensively used in the code, the library previously hadn't provided a way to replace it for testing. This adds a new internal function _gnutls_global_set_gettime_function and makes use of it through virt-time.h. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: send missing extension alertNikos Mavrogiannopoulos2018-10-161-6/+23
| | | | | | | When a key share extension is not seen under TLS1.3, send the missing extension alert. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_init: added flag for automatic re-authenticationNikos Mavrogiannopoulos2018-10-161-24/+0
| | | | | | | | | This introduces the GNUTLS_AUTO_REAUTH gnutls_init() flag and makes re-authentication under TLS simpler to enable and use. Resolves #571 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_priority_set: do not override version on handshaketmp-fix-priority-set-callNikos Mavrogiannopoulos2018-10-031-12/+30
| | | | | | | | | | When handshake is in progress, do not override the default TLS version in the session. This allows gnutls_priority_set to be called in the post_client_hello function without breaking the handshake. Resolves #580 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* handshake: do not negotiate TLS1.3 using the legacy version fieldtmp-update-version-numbersNikos Mavrogiannopoulos2018-08-201-4/+14
| | | | | | | | | Previously we could end-up with a TLS1.3 connection if the TLS1.3 ID was seen on the wire. We now explicitly fallback to TLS1.2 when we see a protocol with TLS1.3 semantics in an SSL2.0 or in the legacy version of the client hello. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: simplified protocol version checking functionsNikos Mavrogiannopoulos2018-08-201-24/+21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Implemented RFC7250 certificate type negotiation extensions.Tom Vrancken2018-08-201-2/+4
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* _gnutls_send_change_cipher_spec: removed unnecessary testNikos Mavrogiannopoulos2018-08-131-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* use a consistent method to mark fall-through in switch casesNikos Mavrogiannopoulos2018-08-081-39/+39
| | | | | | | | Also document that method in contribution guide. Resolves #306 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Ensure we are sending the right protocol version on second client helloNikos Mavrogiannopoulos2018-08-071-4/+5
| | | | | | | | | | | | That is, when we respond to a Hello Retry Request as client, we put the TLS1.2 version on the second client hello to send a hello that is as close as possible to the original hello. That effectively separates the handling of TLS1.2 rehandshake and TLS1.3 hello retry request when sending a client hello. Resolves #535 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* resume: keep persistent session identifiersNikos Mavrogiannopoulos2018-08-071-17/+29
| | | | | | | | | | | | With the introduction of session ticket support (TLS1.2) and TLS1.3, session identifiers have no persistency on server or client side. Improve the situation by introducing persistent session identifiers on server side in a backwards compatible way. Resolves #484 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tls1.3: server returns early on handshake when no cert is provided by clientNikos Mavrogiannopoulos2018-08-031-6/+6
| | | | | | | | | | | | Under TLS1.3 the server knows the negotiated keys early, if no client certificate is sent. In that case, the server is not only able to transmit the session ticket immediately after its finished message, but is also able to transmit data, similarly to false start. Resolves #481 Resolves #457 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* send_client_hello: don't override version after HRR is receivedNikos Mavrogiannopoulos2018-07-251-7/+9
| | | | | | | | | | | | | When a Hello Retry Request is received, do not set our (transient) version to TLS1.2 on the second client hello. That's because both peers have already negotiated TLS1.3. This addresses issue with peers which may send a changecipherspec message at this stage, which is now allowed when our version is set to be TLS1.2. Introduced test suite using openssl and resumption using HRR which reproduces the issue. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_session_ticket_send: allow sending multiple tickets in one goNikos Mavrogiannopoulos2018-07-121-2/+12
| | | | | | | This allows combining the tickets in a single record message when possible. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_send_change_cipher_spec: don't cache under TLS 1.3Daiki Ueno2018-06-151-0/+8
| | | | | | | | Under TLS 1.3, when the server sent HRR, CCS may be followed by receiving ClientHello. In that case, the messsage shouldn't be cached. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* priorities: introduced %FORCE_ETMtmp-measure-recordNikos Mavrogiannopoulos2018-06-121-1/+8
| | | | | | | | | This introduces a priority string option to force encrypt-then-mac during negotiation, to prevent negotiating the legacy CBC ciphersuites. Resolves #472 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* handshake: do not include async messages into transcriptNikos Mavrogiannopoulos2018-05-261-34/+38
| | | | | | | This prevents the session tickets to affect re-authentication or other operations that require the transcript. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: TLS1.3 async messages trigger the handshake hookNikos Mavrogiannopoulos2018-05-261-16/+15
| | | | | | | | | | That is, the callback set with gnutls_handshake_set_hook_function() is now called even on the async handshake messages received under TLS1.3, such as key update, etc. Resolves #441 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* TLS 1.3: Introduced TLS 1.3 session resumptionAnder Juaristi2018-05-261-55/+115
| | | | | | | | | | | | | | | | | This introduces session resumption under TLS 1.3. For that, it enables the psk_ke_modes extension when we enable session tickets. It enables sending session tickets in addition to PSK usernames. The detection of resumption vs pure PSK is done by comparing the indexes sent with the index received by the server. TLS 1.3 session tickets are always sent to the peer unless the GNUTLS_NO_TICKETS is specified. Resolves #290 Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: record transcript offset of client FinishedDaiki Ueno2018-05-261-0/+7
| | | | | | | This is for deriving resumption_master_secret, whose value is calculated over ClientHello...client Finished. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: use GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER consistentlyNikos Mavrogiannopoulos2018-05-071-1/+1
| | | | | | | | | Also treat GNUTLS_E_ILLEGAL_PARAMETER as a synonym if returned during a connection. Relates #442 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* handshake: cleanup in TLS1.3 initial secret calculationNikos Mavrogiannopoulos2018-05-041-15/+3
| | | | | | That eliminates duplicate code in server hello parsing. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_epoch_new: allow re-allocation epoch next epochtmp-constate-fixNikos Mavrogiannopoulos2018-04-181-1/+1
| | | | | | | | | | | On certain cases when re-handshake is interrupted by application data, _gnutls_epoch_new() will be called twice. Make sure that this does not lead to an error. We also rename the function to clarify its purpose _gnutls_epoch_setup_next(). Resolves #426 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ANON,SRP,NULL ciphersuites: when set do not negotiate TLS1.3 or laterNikos Mavrogiannopoulos2018-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The reason is that these ciphersuites cannot be negotiated using TLS1.3. There is a different strategy followed for these. * NULL ciphersuites: they are not something normally enabled and used for debugging purposes mostly. When set both in client and server side only TLS1.2 can be used. * SRP ciphersuites: they are used on client side when the client is actually performing a username-password authentication with SRP. On server side we can have indeed a server support SRP and non-SRP. In that case we limit both on TLS1.2. That an unfortunate restriction, but is not a regression and IMHO these servers would most likely be phased out as very few would want to stick to TLS1.2 connections for SRP; or we may have an SRP update for TLS1.3 which could lift that limitation in the future. * ANON ciphersuites: they are used in certain client/server setups where very basic level of security is required, and in opportunistic encryption scenarios. There is a difference in the handling of these cases. In the case of Anon-only server/clients they provide the session with anonymous credentials structure; in the case of opportunistic encryption they provide both certificate and anonymous credentials. Thus we allow the protocol (TLS1.3) be in the priorities, but if we see no certificate or PSK credentials we disable TLS1.3 negotiation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added support for out-of-band Pre-shared keys under TLS1.3Ander Juaristi2018-04-061-6/+62
| | | | | | | | | | | That adds support for pre-shared keys with and without Diffie-Hellman key exchange. That's a modified version of initial Ander's patch. Resolves #414 Resolves #125 Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.org>
* Hello retry request matches server helloNikos Mavrogiannopoulos2018-03-091-3/+9
| | | | | | | | | That also distinguishes between them by using the special random value, and implements the version check as in draft-ietf-tls-tls13-24. Resolves #391 #390 #392 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Server hello format follows TLS1.2 formatNikos Mavrogiannopoulos2018-03-081-154/+224
| | | | | | | | | | | Also version negotiation was moved to supported_versions extension, and session ID is set by client following appendix D.4. This is a draft-ietf-tls-tls13-22 change. Resolves #393, #389, #397 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* record: ignore any ChangeCipherSpec messages under TLS1.3 handshakeNikos Mavrogiannopoulos2018-03-081-9/+35
| | | | | | | | | | Also send ChangeCipherSpec messages under TLS1.3 handshake. This is a draft-ietf-tls-tls13-22 change. Resolves #395 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* session state: TLS1.2 and TLS1.3 state is stored as unionNikos Mavrogiannopoulos2018-02-191-4/+4
| | | | | | | | | That is, to reduce memory usage as these protocol cannot be used in parallel. Relates: #281 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* session state: organized key exchange keys into structuresNikos Mavrogiannopoulos2018-02-191-4/+4
| | | | | | | That is, with the view of separating the data needed for TLS1.2 and earlier and TLS1.3. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: false start flag merged with hsk_flagsNikos Mavrogiannopoulos2018-02-191-3/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status