aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Replace 0 and NULL pointer constants with nullptr. Also fix an oldlloyd2012-05-1863-176/+179
| | | | style cast in secmem.h
* Fairly huge update that replaces the old secmem types with std::vectorlloyd2012-05-18379-2834/+2047
| | | | | | using a custom allocator. Currently our allocator just does new/delete with a memset before deletion, and the mmap and mlock allocators have been removed.
* propagate from branch 'net.randombit.botan' (head ↵lloyd2012-05-1812-99/+793
|\ | | | | | | | | | | 6332543aa5a8a4cc13662008ff9ac0f0016d9a4d) to branch 'net.randombit.botan.cxx11' (head 5517c9f8f6d1990f269afb94f569a97a80c5a5f4)
| * NR_Verification_Operation::verify_mr would return false if the inputlloyd2012-05-182-2/+5
| | | | | | | | | | | | | | | | | | | | was not the right size for a signature (following DSA). This would silently convert to an empty vector which we would treat as a valid message on the return. However the EMSA checks will always fail so not a huge problem. While checking this out I noticed that an empty value for EMSA4 would result in us reading memory we didn't own.
| * Pipe::reset's requirement that a message be completed meant thatlloyd2012-05-181-2/+0
| | | | | | | | | | | | exceptions thrown in end_msg (for instance in CBC decryption when the padding is bad) more or less screwed up the pipe completely. Allowing reset here at least allows an escape hatch.
| * We were checking the wrong bit for rdrand support. Found using SDE'slloyd2012-05-101-1/+1
| | | | | | | | | | | | | | | | -ivb_rdrnd_cpuid option to toggle the bit off and on. Fortunately on Intel processors the bit we were actually checking is also enabled by Ivy Bridge. However it is also used on AMD Bulldozer processors to signal half-precision floating point support so we could false positive there.
| * Markus Wanner pointed out on the mailing list that using rdrand opcodelloyd2012-05-071-3/+8
| | | | | | | | | | | | | | didn't work on older GCC/binutils. Instead hardcode the expression for rdrand %eax, which should work everywhere. Also, avoid including immintrin.h unless we're going to use it, to avoid problems with older compilers that lack that header (this caused build failures under GCC 3.4.6).
| * Padding wasn't set for DSA keys. Irrelevant for cert verify as thatlloyd2012-05-022-3/+3
| | | | | | | | isn't working here anyway, but also broke DSA servers.
| * Partially roll back b2aef16225863cef27cdee4b91703966b3ed1458, itlloyd2012-04-281-2/+2
| | | | | | | | caused huge performance issues with DSA/ECDSA signing performance.
| * For all but the first and last rounds, use a set of 64 bit tables tolloyd2012-04-273-92/+669
| | | | | | | | implement Camellia's F function. Roughtly 60 - 80% speedup on Nehalem.
| * Add support for the rdrand instruction, added in Intel's Ivy Bridgelloyd2012-04-264-0/+111
| | | | | | | | | | | | | | processors. Tested using SDE on Linux with GCC 4.6, Intel C++ 11.1, and Clang 3.0, all using the inline asm variant. I do not know if current Visual C++ has the intrinsics available or not, so it's only marked as available for those compilers at the moment.
* | Remove all uses of MemoryRegion::copy outside of internal uses inlloyd2012-05-1818-42/+39
| | | | | | | | secmem.h. Mostly replaced by assign or copy_mem.
* | First step towards replacing the existing containers with std::vectorlloyd2012-05-1821-53/+73
| | | | | | | | | | | | with a custom allocator; remove the 3 argument version of MemoryRegion::copy, replacing with freestanding buffer_insert function.
* | Remove OctetString::change, only allow construction. Turns out nothinglloyd2012-05-172-26/+11
| | | | | | | | was using this, so no other changes needed.
* | Huge pile of post merge fixups, mtn really fucked that mergelloyd2012-04-2528-157/+117
| |
* | propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-04-2560-1009/+1751
|\ \ | | | | | | | | | | | | | | | a4741cd07f50a9e1b29b0dd97c6fb8697c038ade) to branch 'net.randombit.botan.cxx11' (head 116e5ff139c07000be431e07d3472cc8f3919b91)
| * | Camellia is now split by key lengthlloyd2012-04-241-26/+26
| | |
| * | propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-24102-4517/+10024
| |\ \ | | |/ | |/| | | | | | | | | | 494c5d548ce3f370c2b771ca6b11e5f41e720da2) to branch 'net.randombit.botan.tls-state-machine' (head b2cd26ff6f093caa79aecb2d674205f45b6aadff)
| | * propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-205-11/+21
| | |\ | | | | | | | | | | | | | | | | | | | | 50fa70d871f837c3c3338fabf5fb45649669aabf) to branch 'net.randombit.botan.tls-state-machine' (head 2358daac57db0411e62da2ef5a484468cb9307b7)
| | * | Compile fixlloyd2012-04-201-1/+1
| | | |
| | * | Put the implementation of Policy::dh_group in source so it's easier tolloyd2012-04-192-1/+6
| | | | | | | | | | | | | | | | | | | | update. Increase DHE group size from 1536 to 2048 bits, which per NIST/ECRYPT should be good to 2030 or so.
| | * | Various dependency/amalgamation fixeslloyd2012-04-195-6/+13
| | | |
| | * | Add a bool param to renegotiate on if we should force a fulllloyd2012-04-189-28/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | renegotiation or not. Save the hostname in the client so we can pull the session from the session manager.
| | * | Send almost all of the extensions on a renegotiation on an existinglloyd2012-04-181-14/+12
| | | | | | | | | | | | | | | | | | | | channel, except NPN which is strictly a per-connection extension. Makes life easier for servers. OpenSSL seems to behave the same way.
| | * | The secure renegotiation state was not updated on a sessionlloyd2012-04-181-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | resumption, which would cause failures if doing a renegotiation under the same session (eg to refresh keys). The peer_certs variable was not set until after the Session object was created, meaning the session (or session ticket) would not include client certs. Worse, they would be included in the next session saved, so if a client presented one cert, then renegotiated and presented another one, the first cert would be associated with the second session!
| | * | Add very basic wildcarding in X509_Certificate::matches_dns_namelloyd2012-04-181-2/+18
| | | |
| | * | Only do the hostname/DNS comparison if it is set. Otherwise, we havelloyd2012-04-171-1/+1
| | | | | | | | | | | | | | | | nothing meaningful to compare to.
| | * | As best I can tell the client is allowed to send a certificate chainlloyd2012-04-161-5/+0
| | | | | | | | | | | | | | | | in response to a certificate request.
| | * | The encoding of Certificate Request messages was wrong, each DERlloyd2012-04-161-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | encoded CA DN has a length field but also the entire block has one. This caused decoding errors if we requested a certificate and sent one or more DNs to request particular CAs. The decoding side had it correct.
| | * | Add support for TLS heartbeats (RFC 6520). Heartbeat initiations fromlloyd2012-04-1617-38/+282
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the peer are automatically responded to. TLS::Channel::heartbeat can initiate a new heartbeat if the peer allows it. Heartbeat replies are passed back to the application processing function with an Alert value of HEARTBEAT_PAYLOAD (a 'fake' value, 256, which is out of range of the valid TLS alert space), along with the sent payload. The RFC requires us to have no more than one heartbeat 'in flight' at a time, ie without getting a response (or a timeout in the case of DTLS). Currently we do not prevent an application from requesting more.
| | * | Add support for the 3 alert types we didn't have codes for.lloyd2012-04-092-32/+38
| | | |
| | * | Finish up server side SRP support, a little ugly but it works.lloyd2012-04-069-55/+130
| | | | | | | | | | | | | | | | | | | | | | | | Add SRP hooks in the examples Fix next protocol support in the tls_server example.
| | * | propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-06101-4518/+9636
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | 058444ec216dd9690938c82922d911df2da535b4) to branch 'net.randombit.botan.tls-state-machine' (head 54985e112aecb7b7c98a7dace924a2f704e6c9c1)
| | | * | Re-enable TLS (was disabled by trunk merge), and require the srp6 modulelloyd2012-04-053-3/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Initial outline of server side SRP support. Need to figure out how to transfer the v, b, B params from the server key exchange message to the client key exchange. The DH variants do this by passing a Private_Key via server_kex_key call, but wrapping SRP params in a Private_Key really doesn't feel right. Not sure what to do here. Possibly both SRP and DH should return a Key_Exchange_Material* that a client key exchange knows how to dynamic cast on.
| | | * | Initial client-side support for SRP (finally!). Tested against OpenSSLlloyd2012-04-054-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | 1.0.1, only the certificate versions tested currently as OpenSSL doesn't support anon SRP.
| | | * | propagate from branch 'net.randombit.botan' (head ↵lloyd2012-04-0520-291/+400
| | | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 91305e3daaae9ea8a1786daf058d961991c68251) to branch 'net.randombit.botan.tls-state-machine' (head 474a00b316f5b21a4e56033d4d990d87d9d3eed6)
| | | * | | Remove Policy::choose_compression and move to tls_serverlloyd2012-04-044-62/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make ciphersuite_list a free standing function Now the Policy interface only contains actual policy hooks (no non-virtual functions). Though choose_curve is a little dubious.
| | | * | | Limit the lifetime of tickets to Policy::session_ticket_lifetime()lloyd2012-04-0415-178/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | seconds and report that value to the client in the NewSessionTicket message. After that point, a session ticket is ignored and a full renegotiation is forced. Only send a new session ticket on a new session, or on a resumed session where the client indicated it supports session tickets but for whatever reason didn't send one in the hello. Perhaps in this case, we should also remove the session from the session manager? Clean up server selection of the ciphersuite a bit, all in an anon function in tls_server instead of scattered over Server, Policy, and Server_Hello. Add Session::session_age and Session_Manager::session_lifetime
| | | * | | Add anonymous DH/ECDH ciphersuites to the cipher list. Interop checkedlloyd2012-04-022-18/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | against OpenSSL. One big issue that needs to be resolved is that with these ciphersuites available to be negotiated, we want to make sure they only are used when the application/user expects them to. Problem is that PSK and SRP are "anonymous" but authenticated via the shared secret. We need to be able to distinguish these on a policy level. Otherwise a MITM could simply offer anon DH, which would be somewhat unfortunate. A client could detect this in the handshake callback, but might not. In the short term to ensure this doesn't occur, disable both anon DH and PSK/SRP in the default policy.
| | | * | | Use SHA-256 when MD5 is negotiated as the HMAC hash in TLS 1.2,lloyd2012-04-022-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | previously negotiating any MD5-based ciphersuite in TLS 1.2 would cause MAC failures as the master secret would come out differently due to using the wrong PRF.
| | | * | | Remove the Ciphersuite_Code enum and move all ciphersuitelloyd2012-03-307-351/+298
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | integer->info mapping to tls_suite_info.cpp which is mostly autogenerated by a Python script from the IANA parameters file. The SRP method now uses kex "SRP_SHA" which is what the RFC calls it. (And hypothetically, SRP_SHA256 might be defined at some point and we'd need to be able to distinguish them). Remove IDEA ciphersuite; we don't want to require IDEA be available due to the European patent still being valid (IIRC), but I didn't want to have to hand-edit the autogenerated switch with an #if check. Not a huge issue though as most sites don't support it anyway.
| * | | | | Patrick Pelletier noted on the mailing list that the implementation oflloyd2012-04-243-99/+179
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Camellia exposed by the OpenSSL module is parameterized by the key length, much as AES is, while the version in the main source uses a single name/type for all variants. For consistency, convert to using a key length parameterized name in our version as well. In the future this might allow for better loop unrolling, etc but currently we don't make use of that.
| * | | | | Patrick Pelletier pointed out the hook for Qt_Mutex in libstate.cpplloyd2012-04-234-83/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | was broken, and after fixing that and trying to compile the module it becamse clear that the Qt mutex did not work at all with recent Qt versions. Taking this as a clear indicator that it is not being used, remove it.
| * | | | | Fix various typos, and remove an unused macro in checks/bench.cpplloyd2012-04-236-7/+7
| | |_|_|/ | |/| | | | | | | | | | | | | All reported by Patrick Pelletier.
| * | | | Avoid a few maintainer mode flag warnings. Remove -Weffc++ from thelloyd2012-04-206-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | | list of maintainer mode flags. It produces some very useful warnings, but also a lot of noisy junk that I really don't care about.
| * | | | merge of '058444ec216dd9690938c82922d911df2da535b4'lloyd2012-04-091-4/+4
| |\ \ \ \ | | |/ / / | |/| | | | | | | | and 'bc49da394c675517b140a404c19094020d6e9d40'
| | * | | The comments incorrectly described end as returning the last element,lloyd2012-04-091-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | rather than one past the end. Reported by Stuart Maclean on the mailing list.
| * | | | Use just 256 bits of secret exponent (recomended value in RFC 5054).lloyd2012-04-064-21/+22
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | Much faster, especially when using 8192 bit groups as OpenSSL does by default. Use BOTAN_DLL symbol visibility macros.
| * | | Remove the client SRP6 class, really free standing functions are finelloyd2012-04-053-47/+152
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for this. Add a new function that identifies a named SRP group from the N/g params - this is important as we need to verify the SRP groups, the easiest way to do that is to to force them to be a known/published value. Add the 1536, 3072, 4096, 6144, and 8192 bit groups from RFC 5054
| * | Add more comments explaining what is going on in dl_work_factorlloyd2012-03-302-28/+29
| | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 06:44:12 +0000