Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/mono/boringssl.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-11-23Disable RSA-PSS by default.chromium-stableAdam Langley
This change reverts 57e929f3c8c3d412639eb123382c79ff3bdc3ed3, although it was done by hand due to conflicts. BUG=chromium:667806 Change-Id: I17ddf2e5aa7d5129fe09cdeaf63c675091b445b0 Reviewed-on: https://boringssl-review.googlesource.com/12420 Reviewed-by: Adam Langley <agl@google.com>
2016-09-28Refresh fuzzer corpus.David Benjamin
We've switched to the version extension, so refresh the corpus. Change-Id: Ic50f58bd83d62dccae26063c9ea2d4a2c799da1f Reviewed-on: https://boringssl-review.googlesource.com/11326 Reviewed-by: Adam Langley <agl@google.com>
2016-09-28Apply GREASE to the version extension.David Benjamin
BUG=106 Change-Id: Iaa12aeb67627f3c22fe4a917c89c646cb3dc1843 Reviewed-on: https://boringssl-review.googlesource.com/11325 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Teach generate_build_files.py about ppc64le.David Benjamin
Change-Id: Ia535741caa914072f31beeb02ad1d26f7ad692b9 Reviewed-on: https://boringssl-review.googlesource.com/11324 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-27Moving TLS 1.3 version negotiation into extension.Steven Valdez
Change-Id: I73f9fd64b46f26978b897409d817b34ec9d93afd Reviewed-on: https://boringssl-review.googlesource.com/11080 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Update aes.c for new ARM asm names.Adam Langley
In order to align ppc64le with the existing code, 4467e59b changed the prefix for both the ARM and ppc64le AES assembly code to be “aes_hw_”. However, it didn't update aes.c as well. Change-Id: I8e3c7dea1c49ddad8a613369af274e25d572a8fd Reviewed-on: https://boringssl-review.googlesource.com/11342 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Add PPC64LE assembly for AES-GCM.Adam Langley
This change adds AES and GHASH assembly from upstream, with the aim of speeding up AES-GCM. The PPC64LE assembly matches the interface of the ARMv8 assembly so I've changed the prefix of both sets of asm functions to be the same ("aes_hw_"). Otherwise, the new assmebly files and Perlasm match exactly those from upstream's c536b6be1a (from their master branch). Before: Did 1879000 AES-128-GCM (16 bytes) seal operations in 1000428us (1878196.1 ops/sec): 30.1 MB/s Did 61000 AES-128-GCM (1350 bytes) seal operations in 1006660us (60596.4 ops/sec): 81.8 MB/s Did 11000 AES-128-GCM (8192 bytes) seal operations in 1072649us (10255.0 ops/sec): 84.0 MB/s Did 1665000 AES-256-GCM (16 bytes) seal operations in 1000591us (1664016.6 ops/sec): 26.6 MB/s Did 52000 AES-256-GCM (1350 bytes) seal operations in 1006971us (51640.0 ops/sec): 69.7 MB/s Did 8840 AES-256-GCM (8192 bytes) seal operations in 1013294us (8724.0 ops/sec): 71.5 MB/s After: Did 4994000 AES-128-GCM (16 bytes) seal operations in 1000017us (4993915.1 ops/sec): 79.9 MB/s Did 1389000 AES-128-GCM (1350 bytes) seal operations in 1000073us (1388898.6 ops/sec): 1875.0 MB/s Did 319000 AES-128-GCM (8192 bytes) seal operations in 1000101us (318967.8 ops/sec): 2613.0 MB/s Did 4668000 AES-256-GCM (16 bytes) seal operations in 1000149us (4667304.6 ops/sec): 74.7 MB/s Did 1202000 AES-256-GCM (1350 bytes) seal operations in 1000646us (1201224.0 ops/sec): 1621.7 MB/s Did 269000 AES-256-GCM (8192 bytes) seal operations in 1002804us (268247.8 ops/sec): 2197.5 MB/s Change-Id: Id848562bd4e1aa79a4683012501dfa5e6c08cfcc Reviewed-on: https://boringssl-review.googlesource.com/11262 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Add a test for SSL_version.David Benjamin
We were never really testing this. Change-Id: Ia953870053d16d3994ae48172017d384c7bc3601 Reviewed-on: https://boringssl-review.googlesource.com/11341 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Avoid using empty initializer lists.David Benjamin
One of Chromium's toolchains can't handle this for some reason. See also empty_crls and empty in TestVerify. Change-Id: I5e6a849f3042288da2e406882ae5cfec249a86ae Reviewed-on: https://boringssl-review.googlesource.com/11340 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Prepare runner's wire/version conversions for the version extension.David Benjamin
This mirror's 2dc0204603f777597e2f97662e42887d1af5013f on the C side. BUG=90 Change-Id: Iebb72df5a5ae98cb2fd8db519d973cd734ff05ea Reviewed-on: https://boringssl-review.googlesource.com/11320 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Apply version/wire mapping at a higher layer in runner.David Benjamin
This is in preparation for implementing the version extension and is probably what we should have done from the beginning as it makes intolerance bugs simpler. This means knobs like SendClientVersion and SendServerVersion deal with the wire values while knobs like NegotiateVersion and MaxVersion deal with logical versions. (This matches how the bugs have always worked. SendFoo is just a weird post-processing bit on the handshake messages while NegotiateVersion actually changes how BoGo behaves.) BUG=90 Change-Id: I7f359d798d0899fa2742107fb3d854be19e731a4 Reviewed-on: https://boringssl-review.googlesource.com/11300 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Fix ssl_ctx_make_profiles error handling.David Benjamin
It didn't clean up |profiles| on error or check for sk_SRTP_PROTECTION_PROFILE_push failures. Change-Id: I44d7f64896ad73347fbb0fc79752be4de70d3ab7 Reviewed-on: https://boringssl-review.googlesource.com/11323 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-27Check for sk_X509_NAME_push failures.David Benjamin
Also tidy up the logic slightly. Change-Id: I708254406b2df52435ec434ac9806e8eb2cbe928 Reviewed-on: https://boringssl-review.googlesource.com/11322 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-27Fix run_tests target.Adam Langley
The COMMANDs will “not necessarily composed into a stateful shell or batch script” so the change directory needs to be linked with the command that needs it. This fixes “make run_tests”. Change-Id: I364530fe1331aba7fa9899616916f610981c2c95 Reviewed-on: https://boringssl-review.googlesource.com/11263 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-27Add deleters for some more X.509 things.Matthew Braithwaite
Change-Id: I49cab08b085dde187e9b1aaaee0e5aa44595f8b7 Reviewed-on: https://boringssl-review.googlesource.com/11280 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-26Add some sanity checks when checking CRL scores and testsSteven Valdez
Note: this was accidentally omitted from OpenSSL 1.0.2 branch. Without this fix any attempt to use CRLs will crash. CVE-2016-7052 (Imported from upstream's 6e629b5be45face20b4ca71c4fcbfed78b864a2e) Test CRL Root Key: -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3BS/dUBpbrzd1aeFzN lI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+5R/Du0iCb1tCZIPY 07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWpuRqO6rctN9qUoMlT IAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n8H922qmvPNA9idmX 9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbLP2o9orxGx7aCtnnB ZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABAoIBAQCJF9MTHfHGkk+/ DwCXlA0Wg0e6hBuHl10iNobYkMWIl/xXjOknhYiqOqb181py76472SVC5ERprC+r Lf0PXzqKuA117mnkwT2bYLCL9Skf8WEhoFLQNbVlloF6wYjqXcYgKYKh8HgQbZl4 aLg2YQl2NADTNABsUWj/4H2WEelsODVviqfFs725lFg9KHDI8zxAZXLzDt/M9uVL GxJiX12tr0AwaeAFZ1oPM/y+LznM3N3+Ht3jHHw3jZ/u8Z1RdAmdpu3bZ6tbwGBr 9edsH5rKkm9aBvMrY7eX5VHqaqyRNFyG152ZOJh4XiiFG7EmgTPCpaHo50Y018Re grVtk+FBAoGBANY3lY+V8ZOwMxSHes+kTnoimHO5Ob7nxrOC71i27x+4HHsYUeAr /zOOghiDIn+oNkuiX5CIOWZKx159Bp65CPpCbTb/fh+HYnSgXFgCw7XptycO7LXM 5GwR5jSfpfzBFdYxjxoUzDMFBwTEYRTm0HkUHkH+s+ajjw5wqqbcGLcfAoGBAMM8 DKW6Tb66xsf708f0jonAjKYTLZ+WOcwsBEWSFHoY8dUjvW5gqx5acHTEsc5ZTeh4 BCFLa+Mn9cuJWVJNs09k7Xb2PNl92HQ4GN2vbdkJhExbkT6oLDHg1hVD0w8KLfz1 lTAW6pS+6CdOHMEJpvqx89EgU/1GgIQ1fXYczE75AoGAKeJoXdDFkUjsU+FBhAPu TDcjc80Nm2QaF9NMFR5/lsYa236f06MGnQAKM9zADBHJu/Qdl1brUjLg1HrBppsr RDNkw1IlSOjhuUf5hkPUHGd8Jijm440SRIcjabqla8wdBupdvo2+d2NOQgJbsQiI ToQ+fkzcxAXK3Nnuo/1436UCgYBjLH7UNOZHS8OsVM0I1r8NVKVdu4JCfeJQR8/H s2P5ffBir+wLRMnH+nMDreMQiibcPxMCArkERAlE4jlgaJ38Z62E76KLbLTmnJRt EC9Bv+bXjvAiHvWMRMUbOj/ddPNVez7Uld+FvdBaHwDWQlvzHzBWfBCOKSEhh7Z6 qDhUqQKBgQDPMDx2i5rfmQp3imV9xUcCkIRsyYQVf8Eo7NV07IdUy/otmksgn4Zt Lbf3v2dvxOpTNTONWjp2c+iUQo8QxJCZr5Sfb21oQ9Ktcrmc/CY7LeBVDibXwxdM vRG8kBzvslFWh7REzC3u06GSVhyKDfW93kN2cKVwGoahRlhj7oHuZQ== -----END RSA PRIVATE KEY----- Change-Id: Icc58811c78d4682591f5bb460cdd219bd41566d8 Reviewed-on: https://boringssl-review.googlesource.com/11246 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-26Require custom private keys to specify curve in 1.3.David Benjamin
If someone is still using EVP_PKEY_EC (I really should get on converting Chromium...), don't silently skip the curve match check in TLS 1.3, otherwise it may work on accident. Refuse to sign anything so this gets caught. Change-Id: I4ea46efb0b8f31a656771b9d2e5f882bba64eb99 Reviewed-on: https://boringssl-review.googlesource.com/11244 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-09-24Implement draft-davidben-tls-grease-01.David Benjamin
This GREASEs cipher suites, groups, and extensions. For now, we'll always place them in a hard-coded position. We can experiment with more interesting strategies later. If we add new ciphers and curves, presumably we prefer them over current ones, so place GREASE values at the front. This prevents implementations from parsing only the first value and ignoring the rest. Add two new extensions, one empty and one non-empty. Place the empty one in front (IBM WebSphere can't handle trailing empty extensions) and the non-empty one at the end. Change-Id: If2e009936bc298cedf2a7a593ce7d5d5ddbb841a Reviewed-on: https://boringssl-review.googlesource.com/11241 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-23Better explain usage of CBB_flushNick Harper
The high-level documentation for CBB describes using CBB_flush when a child goes out of scope, but the function level documentation for CBB_flush is less clear that CBB_flush will result in the CBB being safe to use after the children go out of scope. Change-Id: I58bf9e59a87d2be31a969097455aeeae6381efb3 Reviewed-on: https://boringssl-review.googlesource.com/11261 Reviewed-by: David Benjamin <davidben@google.com>
2016-09-23Fix up x509_vpm.c comment.David Benjamin
We used upstream's reformat script, but they had stuck hyphens everywhere to tell indent to leave a comment alone. Fix this one since it was especially hard to read. Change-Id: I9f43bd57dbcf66b79b775ad10ee67867d815ed33 Reviewed-on: https://boringssl-review.googlesource.com/11243 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-09-23Fix documentation for POINT_CONVERSION_UNCOMPRESSED in ec.hNick Harper
Change-Id: I79ff94f5a36dccb9afb1df1ae96f527f438c915b Reviewed-on: https://boringssl-review.googlesource.com/11260 Reviewed-by: David Benjamin <davidben@google.com>
2016-09-23Refresh TLS fuzzer corpora.David Benjamin
This was done by first minimizing the existing set and then merging in a fresh recording from runner. Glancing through LCOV output does not reveal anything anomolous. Fuzzer mode seems to be working as expected. Change-Id: Ife0959a5e16e3c7e2e5a2deb0c32539ff2bc740b Reviewed-on: https://boringssl-review.googlesource.com/11229 Reviewed-by: Adam Langley <agl@google.com>
2016-09-23Disable Channel ID signature checking in fuzzer mode.David Benjamin
Get us a little bit more room here. BUG=79 Change-Id: Ifadad94ead7794755a33f02d340111694b3572af Reviewed-on: https://boringssl-review.googlesource.com/11228 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-23Rename NPN-Server test.David Benjamin
That is an extremely confusing name. It should be NPN-Declined-TLS13. Change-Id: I0e5fa50a3ddb0b80e88a8bc10d0ef87d0fff0a54 Reviewed-on: https://boringssl-review.googlesource.com/11227 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-23Record resumption and renewal transcripts separately.David Benjamin
We recently added a three-connection option, but the transcripts were still assuming just -Normal and -Resume. Change-Id: I8816bce95dd7fac779af658e3eb86bc78bb95c91 Reviewed-on: https://boringssl-review.googlesource.com/11226 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-23Enable more features in the fuzzers.David Benjamin
Also IWYU the headers. BUG=79 Change-Id: Iafee0444c9979496166885db6ba5009cb597cb4d Reviewed-on: https://boringssl-review.googlesource.com/11225 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-23No-op ticket encryption in fuzzer mode.David Benjamin
This allows the fuzzer to discover server-side resumption paths by simply supplying what we'd like the ticket to decrypt to in the clear. We also have a natural way to get transcripts out of runner. We record the runner-side transcripts, so all resumption handshakes will replay the shim-created unencrypted tickets. BUG=104 Change-Id: Icf9cbf4af520077d38e2c8c2766b6f8bfa3c9ab5 Reviewed-on: https://boringssl-review.googlesource.com/11224 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-23Document how to refresh the TLS corpora.David Benjamin
Change-Id: I9165357ca6c20b964ed13dc4e1f336c7b747033e Reviewed-on: https://boringssl-review.googlesource.com/11223 Reviewed-by: Adam Langley <agl@google.com>
2016-09-23Fix remaining non-determinism in fuzzer transcripts.David Benjamin
Both the C and Go code were sampling the real clock. With this, two successive iterations of runner transcripts give the same output. Change-Id: I4d9e219e863881bf518c5ac199dce938a49cdfaa Reviewed-on: https://boringssl-review.googlesource.com/11222 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-23Add a fuzzer mode suppressions file.David Benjamin
We want to ensure -fuzzer passes tests, except for the tests it intentionally fails on. This ensures that we don't lose our ability to refresh the fuzzer transcripts. Change-Id: I761856c30379a3934fd46a24627ef8415b136f93 Reviewed-on: https://boringssl-review.googlesource.com/11221 Reviewed-by: Adam Langley <agl@google.com>
2016-09-22Add a InvalidChannelIDSignature test.David Benjamin
Apparently we never wrote one of those. Also send a decrypt_error alert to be consistent with all the other signature checks. Change-Id: Ib5624d098d1e3086245192cdce92f5df26005064 Reviewed-on: https://boringssl-review.googlesource.com/11180 Reviewed-by: David Benjamin <davidben@google.com>
2016-09-22Switch from readdir_r back to readdir.David Benjamin
readdir and readdir_r have a sad history: https://www.gnu.org/software/libc/manual/html_node/Reading_002fClosing-Directory.html https://womble.decadent.org.uk/readdir_r-advisory.html http://austingroupbugs.net/view.php?id=696 Martin Thomson reports that newer glibcs warn that readdir_r is deprecated. Especially since this has been banished to libdecrepit anyway, go ahead and honor that warning. OpenSSL also uses readdir, so we're no worse than they are. While I'm here, rewrite this to remove a useless layer of abstraction, now that we've punted on supporting most platforms here. Also remove the redundant documentation comment (there's one in the header already). Change-Id: I5350c55417a7f5c4c4725f97dd63f960aeb96801 Reviewed-on: https://boringssl-review.googlesource.com/11220 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-22Add tests for SSL_peek.David Benjamin
SSL_peek works fine for us, but OpenSSL 1.1.0 regressed this (https://github.com/openssl/openssl/issues/1563), and we don't have tests either. Fix this. SSL_peek can handle all weird events that SSL_read can, so use runner and tell bssl_shim to do a SSL_peek + SSL_peek + SSL_read instead of SSL_read. Then add tests for all the events we may discover. Change-Id: I9e8635e3ca19653a02a883f220ab1332d4412f98 Reviewed-on: https://boringssl-review.googlesource.com/11090 Reviewed-by: Adam Langley <agl@google.com>
2016-09-22Support default versions with set_{min,max}_proto_version.David Benjamin
Upstream makes 0 mean "min/max supported version". Match that behavior, although call it "default" instead. It shouldn't get you TLS 1.3 until we're ready to turn it on everywhere. BUG=90 Change-Id: I9f122fceb701b7d4de2ff70afbc1ffdf370cb97e Reviewed-on: https://boringssl-review.googlesource.com/11181 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-22Only predict X25519 in TLS 1.3.David Benjamin
We'd previously been assuming we'd want to predict P-256 and X25519 but, on reflection, that's nonsense. Although, today, P-256 is widespread and X25519 is less so, that's not the right question to ask. Those servers are all 1.2. The right question is whether we believe enough servers will get to TLS 1.3 before X25519 to justify wasting 64 bytes on all other connections. Given that OpenSSL has already shipped X25519 and Microsoft was doing interop testing on X25519 around when we were shipping it, I think the answer is no. Moreover, if we are wrong, it will be easier to go from predicting one group to two rather than the inverse (provided we send a fake one with GREASE). I anticipate prediction-miss HelloRetryRequest logic across the TLS/TCP ecosystem will be largely untested (no one wants to pay an RTT), so taking a group out of the predicted set will likely be a risky operation. Only predicting one group also makes things a bit simpler. I haven't done this here, but we'll be able to fold the 1.2 and 1.3 ecdh_ctx's together, even. Change-Id: Ie7e42d3105aca48eb9d97e2e05a16c5379aa66a3 Reviewed-on: https://boringssl-review.googlesource.com/10960 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Renumber TLS 1.3 signature algorithms.David Benjamin
The old numbers violate a MUST-level requirement in TLS 1.2 to not advertise anonymous (0x0700 ends in 0x00). The spec has been updated with new allocations which avoid these. BUG=webrtc:6342 Change-Id: Ia5663ada98fa1ebf0f8a7f50fe74a0e9206c4194 Reviewed-on: https://boringssl-review.googlesource.com/11131 Reviewed-by: Adam Langley <agl@google.com>
2016-09-21Start fuzzing the TLS 1.3 code.David Benjamin
Corpus recorded from runner and merged into existing corpus with libFuzzer's -merge flag. BUG=79 Change-Id: I986a50976ffef141b63e31de3a81fdb4ed5c1348 Reviewed-on: https://boringssl-review.googlesource.com/11130 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-09-21Fix some bugs in TLS 1.3 server key_share code.David Benjamin
Found by libFuzzer and then one more mistake caught by valgrind. Add a test for this case. Change-Id: I92773bc1231bafe5fc069e8568d93ac0df4c8acb Reviewed-on: https://boringssl-review.googlesource.com/11129 Reviewed-by: David Benjamin <davidben@google.com>
2016-09-21Align SSL_set_{min,max}_version with upstream.David Benjamin
Upstream added these functions after we did but decided to change the names slightly. I'm not sure why they wanted to add the "proto" in there, but align with them nonetheless so the ecosystem only has one set of these functions. BUG=90 Change-Id: Ia9863c58c9734374092051f02952b112806040cc Reviewed-on: https://boringssl-review.googlesource.com/11123 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Don't return invalid versions in version_from_wire.David Benjamin
This is in preparation for using the supported_versions extension to experiment with draft TLS 1.3 versions, since we don't wish to restore the fallback. With versions begin opaque values, we will want version_from_wire to reject unknown values, not attempt to preserve order in some way. This means ClientHello.version processing needs to be separate code. That's just written out fully in negotiate_version now. It also means SSL_set_{min,max}_version will notice invalid inputs which aligns us better with upstream's versions of those APIs. This CL doesn't replace ssl->version with an internal-representation version, though follow work should do it once a couple of changes land in consumers. BUG=90 Change-Id: Id2f5e1fa72847c823ee7f082e9e69f55e51ce9da Reviewed-on: https://boringssl-review.googlesource.com/11122 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Take the version parameter out of ssl_do_msg_callback.David Benjamin
This will make it a little easier to store the normalized version rather than the wire version. Also document the V2ClientHello behavior. Change-Id: I5ce9ccce44ca48be2e60ddf293c0fab6bba1356e Reviewed-on: https://boringssl-review.googlesource.com/11121 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Improve -valgrind error-handling.David Benjamin
Passing --quiet makes valgrind only print out errors, so we don't need to suppress things. Combine that with checking valgrind's dedicated exit code so we notice errors that happen before the "---DONE---" marker. This makes that marker unnecessary for valgrind. all_tests.go was not sensitive to this, but still would do well to have valgrind be silent. Change-Id: I841edf7de87081137e38990e647e989fd7567295 Reviewed-on: https://boringssl-review.googlesource.com/11128 Reviewed-by: Adam Langley <agl@google.com>
2016-09-21Don't swallow tool output on failure.David Benjamin
If the test failed due to non-ASan reasons but ASan also had errors, output those too. Change-Id: Id908fe2a823c59255c6a9585dfaa894a4fcd9f59 Reviewed-on: https://boringssl-review.googlesource.com/11127 Reviewed-by: Adam Langley <agl@google.com>
2016-09-21Fix TLS 1.3 fuzzer mode in Go.David Benjamin
Runner needs to implement fuzzer mode as well so we can record transcripts from it. A bunch of tests were failing: - C and Go disagreed on what fuzzer mode did to TLS 1.3 padding. So we fuzz more code, align Go with C. Fuzzer mode TLS 1.3 still pads but just skips the final AEAD. - The deterministic RNG should be applied per test, not per exchange. It turns out, if your RNG is deterministic, one tends to pick the same session ID over and over which confuses clients. (Resumption is signaled by echoing the session ID.) Now the only failing tests are the ones one would expect to fail. BUG=79 Change-Id: Ica23881a6e726adae71e6767730519214ebcd62a Reviewed-on: https://boringssl-review.googlesource.com/11126 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Remove SSL_set_fallback_version.David Benjamin
Ding-dong the fallback's dead. https://mailarchive.ietf.org/arch/msg/tls/xfCh7D7hISFs5x-eA0xHwksoLrc Also we'll need to tweak the versioning code slightly to implement supported_versions and it's nice to have this out of the way. Change-Id: I0961e19ea56b4afd828f6f48858ac6310129503d Reviewed-on: https://boringssl-review.googlesource.com/11120 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Unwind unnecessary Android hacks.David Benjamin
wpa_supplicant in AOSP has now been updated, so these all can go. We're just left with the AES keywrap business. Change-Id: Ie4c3e08902a2a1f9b43e1907116c7d85791ad5e9 Reviewed-on: https://boringssl-review.googlesource.com/11160 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Test interaction of RSA key exchange and ClientHello.version.David Benjamin
If we see garbage in ClientHello.version and then select static RSA, that garbage is what goes in the premaster. Change-Id: I65190a44439745e6b5ffaf7669f063da725c8097 Reviewed-on: https://boringssl-review.googlesource.com/11092 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Do not distinguish NULL and empty PSK identity hints.David Benjamin
Plain PSK omits the ServerKeyExchange when there is no hint and includes it otherwise (it should have always sent it), while other PSK ciphers like ECDHE_PSK cannot omit the hint. Having different capabilities here is odd and RFC 4279 5.2 suggests that all PSK ciphers are capable of "[not] provid[ing] an identity hint". Interpret this to mean no identity hint and empty identity hint are the same state. Annoyingly, this gives a plain PSK implementation two options for spelling an empty hint. The spec isn't clear and this is not really a battle worth fighting, so I've left both acceptable and added a test for this case. See also https://android-review.googlesource.com/c/275217/. This is also consistent with Android's PskKeyManager API, our only consumer anyway. https://developer.android.com/reference/android/net/PskKeyManager.html Change-Id: I8a8e6cc1f7dd1b8b202cdaf3d4f151bebfb4a25b Reviewed-on: https://boringssl-review.googlesource.com/11087 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-21Move peer_psk_identity_hint to SSL_HANDSHAKE.David Benjamin
One less field to reset on renego and save a pointer of post-handshake memory. Change-Id: Ifc0c3c73072af244ee3848d9a798988d2c8a7c38 Reviewed-on: https://boringssl-review.googlesource.com/11086 Reviewed-by: Adam Langley <agl@google.com>
2016-09-21Shush a MinGW warning in crypto/x509.David Benjamin
The MinGW setup on Android already defines this stat macro. Change-Id: Ia8e89195c06ec01d4b5a2fa7357fb8d2d500aa06 Reviewed-on: https://boringssl-review.googlesource.com/11124 Reviewed-by: Kenny Root <kroot@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-17 01:37:55 +0300