summaryrefslogtreecommitdiff
path: root/lib/handshake.c
Commit message (Collapse)AuthorAgeFilesLines
* build: re-indent codeDaiki Ueno2023-04-241-756/+635
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* priority: add %FORCE_SESSION_HASH modifierDaiki Ueno2023-03-091-8/+28
| | | | | | | | This adds a new priority string modifier %FORCE_SESSION_HASH, which requires to negotiate extended master secret and aborts the connection if the peer does not send the extension in hello messages. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Indent codeZoltan Fridrich2023-01-271-370/+438
| | | | | Co-authored-by: Simon Josefsson <simon@josefsson.org> Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
* KTLS: Invalidate session on ktls errorFrantisek Krenzelok2022-12-041-0/+1
| | | | | | | | | | | We invalidate the session if an KTLS related error occurs after it was initialized i.e. keys were set on the interfaces. As of now this only affects key_update() which should be fixed via a kernel patch. Thus future fallback mechanism implementation is not likely as that would require yet another kernel patch. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* KTLS: fallback to defaultFrantisek Krenzelok2022-10-051-1/+6
| | | | | | | | If an error occurs during setting of keys either initial or key update then fallback to default mode of operation (disable ktls) and let the user know Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* KTLS: set key on specific interfacesFrantisek Krenzelok2022-10-051-1/+1
| | | | | | | It is now possible to set key on specific interface. If interface given is not ktls enabled then it will be ignored. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* KTLS: hotfixFrantisek Krenzelok2022-07-291-1/+2
| | | | | | | | | | session->internals.pull_func is set to system_read during gnutls_init() so check for user set pull/push function added in commit mentioned bellow will never pass. source: 2d3cba6bb21acb40141180298f3924c73c7de8f8 Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* handshake: do not enable KTLS if custom pull/push functions are setDaiki Ueno2022-07-271-1/+8
| | | | | | | | If gnutls_transport_set_pull_function or gnutls_transport_set_push_function is used, we can't assume the underlying transport handle is an FD. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: do not reset KTLS enablement in gnutls_handshakeDaiki Ueno2022-06-281-6/+6
| | | | | | | As gnutls_handshake can be repeatedly called upon non-blocking setup, we shouldn't try to call setsockopt for KTLS upon every call. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* KTLS: disable by default enable by configFrantišek Krenželok2022-06-141-1/+1
| | | | | | | KTLS will be disabled by default when build with `--enable-ktls` to enable it, use config file option `ktls = true` in [global] section. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* system config disable KTLSFrantisek Krenzelok2022-03-291-4/+4
| | | | | | | Added option for system config `ktls = false` to disable ktls system-wide Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* Add compress_certificate extension (RFC8879)Zoltan Fridrich2022-03-011-0/+3
| | | | Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
* KTLS: hotfixFrantisek Krenzelok2022-01-271-1/+3
| | | | | | | | fixed: keys will be set only when both sockets were enabled for ktls fixed: session->internals.ktls_enabled left uninitialized for non ktls-enabled build Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* ktls: flagsFrantisek Krenzelok2021-12-161-1/+1
| | | | | | ktls enum flags API Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* KTLS: APIFrantisek Krenzelok2021-12-151-8/+4
| | | | | | | ktls is enabled by default, we can check if inicialization was succesfull with gnutls_transport_is_ktls_enabled Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* ktls: basic implementation of SW modeHedgehog50402021-10-191-0/+16
| | | | | | | | | | | | | | | | | ktls enables us to offload encryption/decryption to the kernel prerequisites: - configured with `--enable-ktls` - tls module `modprobe tls` check with 'lsmod | grep tls' - per connection: gnutls_transport_set_int{2} must be set When prerequisities are met then ktls is used by default. If GnuTLS encounters a error during KTLS initialization, it will not use ktls and fallback to userspace. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* mem: instrument with ASan memory poisoning as well as valgrindDaiki Ueno2021-08-091-20/+30
| | | | | | | This makes it possible to catch undefined memory access in the more lightweight CI runs. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: fix timing of sending early dataDaiki Ueno2021-04-251-0/+70
| | | | | | | | | | | | | | | | | | Previously, the client was sending early data after receiving a Server Hello message, which not only negates the benefit of 0-RTT, but also was a logic error as it can only be decrypted by the server when the initial handshake and the resuming handshake agree on the same ciphersuites. This fixes that behavior in the following ways: - extend the session data format to include the selected ciphersuites, even in TLS 1.3 - setup the epoch for early data, right before the client sending early data (also right after the server deciding to accept early data). - extend the test case to use different ciphersuites in the initial and resuming handshakes Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: don't regenerate legacy_session_id in second CH after HRRDaiki Ueno2021-04-221-9/+11
| | | | | | | | According to RFC 8446 4.1.2, the client must send the same Client Hello after Hello Retry Request, except for the certain extensions, and thus legacy_session_id must be preserved. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* priority: add option to disable TLS 1.3 middlebox compatibility modeDaiki Ueno2021-04-171-1/+3
| | | | | | | This adds a new option %DISABLE_TLS13_COMPAT_MODE to disable TLS 1.3 compatibility mode at run-time. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: TLS 1.3: don't generate session ID in resumption modeDaiki Ueno2021-02-041-10/+11
| | | | | | | | | | | The commit e0bb98e1f71f94691f600839ff748d3a9f469d3e revealed that the previous code always generated session ID in the TLS 1.3 middlebox compatibility mode even when the handshake is being resumed. This could cause a difference in PSK binder calculation if the server sends an HRR in the resumption handshake. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: replace TRUE and FALSE with <stdbool.h>Daiki Ueno2021-02-041-13/+10
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: replace RESUME_TRUE and RESUME_FALSE with <stdbool.h>Daiki Ueno2021-02-041-35/+35
| | | | | | | | | | | | | | | | | | Having those constants could cause wrong impression that there is a third possible value. To reproduce the changes other than lib/gnutls_int.h: for i in `git ls-files lib`; do sed -i -e 's/\(session->internals.\(resumed\|resumable\)\) *\(== *RESUME_FALSE\|!= *RESUME_TRUE\)/!\1/' \ -e 's/\(session->internals.\(resumed\|resumable\)\) *\(== *RESUME_TRUE\|!= *RESUME_FALSE\)/\1/' \ -e 's/RESUME_TRUE/true/' \ -e 's/RESUME_FALSE/false/' \ $i done Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Fix non-empty session id (TLS13_APPENDIX_D4)Norbert Pocs2020-12-081-1/+4
| | | | | | | | | When TLS1.3 is used with middlebox compatible mode, the session id should be filled with random session id, but remained empty. Signed-off-by: Norbert Pocs <npocs@redhat.com> Closes #1074
* handshake: reject no_renegotiation alert if handshake is incompletetmp-renegotiationDaiki Ueno2020-09-031-13/+35
| | | | | | | | | | | | | | If the initial handshake is incomplete and the server sends a no_renegotiation alert, the client should treat it as a fatal error even if its level is warning. Otherwise the same handshake state (e.g., DHE parameters) are reused in the next gnutls_handshake call, if it is called in the loop idiom: do { ret = gnutls_handshake(session); } while (ret < 0 && gnutls_error_is_fatal(ret) == 0); Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'tmp-tls12-version-checks' into 'master'Daiki Ueno2020-08-211-1/+11
|\ | | | | | | | | | | | | handshake: check TLS version against modified server priorities Closes #1054 See merge request gnutls/gnutls!1309
| * handshake: check TLS version against modified server prioritiestmp-tls12-version-checksDaiki Ueno2020-08-171-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | The server needs to take into account of multiple factors when determining the TLS protocol version actually being used: - the legacy version - "supported_versions" extension - user_hello_func that may modify the server's priorities Only after that it can check whether the TLS version is enabled in the server's priorities. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | doc: assorted typo fixestmp-typo-fixesDaiki Ueno2020-08-121-1/+1
|/ | | | | | Spotted by codespell. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: use valgrind client request to detect undefined memory usetmp-valgrind-memcheckDaiki Ueno2020-04-041-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | This tightens the check introduced in ac2f71b892d13a7ab4cc39086eef179042c7e23c, by using the valgrind client request to explicitly mark the "uninitialized but initialization is needed before use" regions. With this patch and the fix (c01011c2d8533dbbbe754e49e256c109cb848d0d) reverted, you will see the following error when running dtls_hello_random_value under valgrind: $ valgrind ./dtls_hello_random_value testing: default ==520145== Conditional jump or move depends on uninitialised value(s) ==520145== at 0x4025F5: hello_callback (dtls_hello_random_value.c:90) ==520145== by 0x488BF97: _gnutls_call_hook_func (handshake.c:1215) ==520145== by 0x488C1AA: _gnutls_send_handshake2 (handshake.c:1332) ==520145== by 0x488FC7E: send_client_hello (handshake.c:2290) ==520145== by 0x48902A1: handshake_client (handshake.c:2908) ==520145== by 0x48902A1: gnutls_handshake (handshake.c:2740) ==520145== by 0x402CB3: client (dtls_hello_random_value.c:153) ==520145== by 0x402CB3: start (dtls_hello_random_value.c:317) ==520145== by 0x402EFE: doit (dtls_hello_random_value.c:331) ==520145== by 0x4023D4: main (utils.c:254) ==520145== Signed-off-by: Daiki Ueno <dueno@redhat.com>
* dtls client hello: fix zeroed random (fixes #960)Stefan Bühler2020-03-271-1/+1
| | | | | | | This broke with bcf4de03 "handshake: treat reply to HRR as a reply to hello verify request", which failed to "De Morgan" properly. Signed-off-by: Stefan Bühler <stbuehler@web.de>
* handshake.c: Suppress warning in fuzzing buildTim Rühsen2020-01-031-0/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* lib/handshake.c: Check return value of _gnutls_version_max()Tim Rühsen2019-10-121-0/+2
| | | | | | | Fixes Coverity issue 1454674 Fixes Coverity issue 1454658 Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Remove trailing spaces in several filesTim Rühsen2019-10-121-19/+19
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* handshake: move early secrets calculation to pre_shared_keyDaiki Ueno2019-04-191-121/+38
| | | | | | | TLS 1.3 Early Secret and the derived keys are calculated upon a PSK being selected, thus the code fits better in ext/pre_shared_key.c. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Improved estimation of wait in gnutls_session_get_data2tmp-improve-session-resumptionNikos Mavrogiannopoulos2019-03-191-1/+13
| | | | | | | | | | | | | Previously we would wait an arbitrary value of 50ms for the server to send session tickets. This change makes the client wait for the estimated single trip time + 60 ms for the server to calculate the session tickets. This improves the chance to obtain tickets from internet servers during the call of gnutls_session_get_data2(). Resolves: #706 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Removed all FIXME comments in code [ci skip]Nikos Mavrogiannopoulos2019-03-161-4/+0
| | | | | | | | We expand informational comments on limitations, but with removing FIXME (keyword didn't help fixing these), and remove completely unhelpful comments, obsolete ones, or comments about ideas. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Merge branch 'tmp-explicit-sanity-checks' into 'master'Nikos Mavrogiannopoulos2019-03-061-3/+23
|\ | | | | | | | | cleanup: _gnutls_recv_handshake: added explicit sanity checks See merge request gnutls/gnutls!937
| * _gnutls_recv_handshake: added explicit sanity checkstmp-explicit-sanity-checksNikos Mavrogiannopoulos2019-02-231-3/+23
| | | | | | | | | | | | | | | | | | Although, this function acts on the message provided as expected and thus it should never call a message parsing function on unexpected messages, we make a more explicit sanity check. This unifies the sanity checks existing within the involved functions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* | gnutls_record_send2: try to ensure integrity of operations on false and ↵Nikos Mavrogiannopoulos2019-03-021-3/+8
|/ | | | | | | | | | early start This adds a double check in the sanity check of gnutls_record_send2() for the initial_negotiation_completed value, making sure that the check will be successful even in parallel operation of send/recv. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fallback to TLS 1.2 when incompatible with signature certs are providedNikos Mavrogiannopoulos2019-02-061-1/+7
| | | | | | | | | | This only takes into account certificates in the credentials structure. If certificates are provided in a callback, these must be checked by the provider. For that we assume that the credentials structure is filled when associated with a session; if not then the fallback mechanism will not work and the handshake will fail. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fix typos in lib/tmp-fix-typos-in-libTim Rühsen2019-01-041-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Fix gnutls_handshake_set_timeout() for values < 1000tmp-fix-timeoutTim Rühsen2018-12-061-4/+15
| | | | | | | handshake-timeout.c now tests for <1000ms timeout and for >=1000ms timeout. The test duration decreased from 45s to 1.2s. Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* handshake: handle early dataDaiki Ueno2018-11-111-5/+92
| | | | | | | | | | | This plumbers early data handling in the handshake processes, which consists of: - traffic key updates taking into account of client_early_traffic_secret - early data buffering in both server and client - the EndOfEarlyData message handling - making use of max_early_data_size extension in NewSessionTicket Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: refactor early secret derivationDaiki Ueno2018-11-111-16/+0
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: record transcript hash for ClientHelloDaiki Ueno2018-11-111-0/+7
| | | | | | | This is necessary to compute client_early_traffic_secret and early_exporter_master_secret in TLS 1.3. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* system: provide a means to replace gettime implementationDaiki Ueno2018-10-261-1/+1
| | | | | | | | | While gettime() is extensively used in the code, the library previously hadn't provided a way to replace it for testing. This adds a new internal function _gnutls_global_set_gettime_function and makes use of it through virt-time.h. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: send missing extension alertNikos Mavrogiannopoulos2018-10-161-6/+23
| | | | | | | When a key share extension is not seen under TLS1.3, send the missing extension alert. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_init: added flag for automatic re-authenticationNikos Mavrogiannopoulos2018-10-161-24/+0
| | | | | | | | | This introduces the GNUTLS_AUTO_REAUTH gnutls_init() flag and makes re-authentication under TLS simpler to enable and use. Resolves #571 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_priority_set: do not override version on handshaketmp-fix-priority-set-callNikos Mavrogiannopoulos2018-10-031-12/+30
| | | | | | | | | | When handshake is in progress, do not override the default TLS version in the session. This allows gnutls_priority_set to be called in the post_client_hello function without breaking the handshake. Resolves #580 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status