aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-2216-57/+456
|\ | | | | | | | | | | 6bcbae3d22e4d873a8e941d0325ad666482ac4da) to branch 'net.randombit.botan.tls-session-ticket' (head 9048722b5d18b39cf21f8542942dab94a9bd4e6b)
| * Server side handling of session tickets, though currently with alloyd2012-03-227-33/+106
| | | | | | | | hard-coded key.
| * Working client-side session tickets. Tested against gmail.com andlloyd2012-03-226-17/+37
| | | | | | | | OpenSSL 1.0.1-beta2 running on localhost.
| * Correct ticket decoding/encodinglloyd2012-03-221-5/+6
| |
| * Add missing source file for New_Session_Ticket msglloyd2012-03-221-0/+39
| |
| * propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-225-3/+313
| |\ | | | | | | | | | | | | | | | f761c340d4390c232d1a9896f3fde5c9dec7858b) to branch 'net.randombit.botan.tls-session-ticket' (head bf9feb245aa7185e22948a21a3099acac7237b44)
| * | Basic protocol message flow for session ticketslloyd2012-03-2011-64/+120
| | |
| * | Small fixes, cleanupslloyd2012-03-195-9/+22
| | |
| * | Various merge fixups.lloyd2012-03-165-47/+58
| | | | | | | | | | | | | | | Use AES-256 so we don't encrypt session tickets with a weaker algo than the ciphersuites.
| * | propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-167-4/+190
| |\ \ | | | | | | | | | | | | | | | | | | | | 9a12f28252f9b0a051a85c4647679a715161d06c) to branch 'net.randombit.botan.tls-session-ticket' (head ebf45d24a44fb4d1e66e59fe8abefe6f8a53cf02)
| | * \ propagate from branch 'net.randombit.botan.tls-state-machine' (head ↵lloyd2012-03-1671-2055/+4463
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | c24b5d6b012131b177d38bddb8b06d73f81f70c4) to branch 'net.randombit.botan.tls-session-ticket' (head 9977d4c118e1ac26425cef676ebf26cd5b2a470e)
| | * | | Build fixeslloyd2012-01-114-11/+20
| | | | |
| | * | | Outline of RFC 5077 session ticketslloyd2012-01-115-3/+170
| | | | |
* | | | | Add some helper functions for data accesslloyd2012-03-221-22/+33
| |_|_|/ |/| | |
* | | | Reorder schema and make the session id a primary key since it shouldlloyd2012-03-221-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | not only be unique but fast searches on it are likely useful. Not bothering to put an index on the (hostname,hostport) tuple as it's only used by clients on initial connection, and even at a 10K rows that search wouldn't take long at all.
* | | | Oops, libsqlite is sqlite2, link to libsqlite3lloyd2012-03-221-1/+1
| | | |
* | | | Expire old sessions and limit the cache size in the sqlite session manager.lloyd2012-03-222-16/+62
| | | | | | | | | | | | | | | | | | | | Also when pulling a session via host info, try the most recent session first (rather than the oldest!).
* | | | First rev at a SQLite TLS session manager. Should be encrypting thelloyd2012-03-223-0/+265
| | | | | | | | | | | | | | | | | | | | | | | | sessions; will defer until session ticket support lands. Also currently isn't handling session expiry or limiting the number of stored sessions.
* | | | Remove extra BER_Decoder objectlloyd2012-03-221-2/+0
| | | |
* | | | Off by one in decode_constrained_integer, broke Session DER decodinglloyd2012-03-221-1/+2
|/ / /
* | / Add missing source for DTLS hello verifylloyd2012-03-161-0/+61
| |/ |/|
* | Add SecureQueue::emptylloyd2012-03-079-27/+56
| | | | | | | | | | | | Hide the handshake reader behind a function. Add pieces for DTLS hello verify request message
* | Add an abstraction for reading handshake messages (as DTLS handles itlloyd2012-03-0514-91/+215
| | | | | | | | | | | | | | | | quite differently). Avoid using a queue for reading certificates. Hide the version code in the handshake state with a getter and setter.
* | Move the handshake serialization code to Record_Writerlloyd2012-03-0311-39/+44
| |
* | Move min_version and pref_version to the source file so they can belloyd2012-03-022-4/+12
| | | | | | | | | | overridden easily in a new release without changing binaries linked against an earlier version.
* | Bad conditionallloyd2012-02-281-1/+1
| |
* | We would call the handshake callback twice on session resumption:lloyd2012-02-281-20/+19
| | | | | | | | misplaced braces.
* | Indentationlloyd2012-02-276-38/+38
| |
* | Actually check CA signatures in Credentials_Manager. This area needs alloyd2012-02-016-18/+55
| | | | | | | | lot more work before this can be deployed.
* | Support getting ciphersuites by name as well as suite IDlloyd2012-01-286-10/+29
| |
* | Add Camellia ciphersuites from RFC 4132.lloyd2012-01-283-5/+40
| | | | | | | | | | | | Fix Ciphersuite_Preference_Ordering which treated two ciphersuites with the same algos but different keylengths as equivalent, causing them to be lost. Always prefer the longer key.
* | propagate from branch 'net.randombit.botan' (head ↵lloyd2012-01-2890-4462/+8276
|\ \ | | | | | | | | | | | | | | | 3f6b267bc00d2da1b5d36ca2215c3e1b6a40e796) to branch 'net.randombit.botan.tls-state-machine' (head 7df407e6678bd51328c348fd2a665f20fb22d62d)
| * | Add anon SRP ciphersuites to the list, add missing _CBC on thelloyd2012-01-282-12/+27
| | | | | | | | | | | | existing enum values.
| * | Support alternate PRF hashes in TLS 1.2. Add support for the SHA-384lloyd2012-01-288-74/+90
| | | | | | | | | | | | ciphersuites.
| * | Fix inverted conditionallloyd2012-01-271-2/+2
| | |
| * | Change naming convention to match RFCslloyd2012-01-275-30/+26
| | |
| * | Remove debug outputlloyd2012-01-271-11/+0
| | |
| * | Server side PSKlloyd2012-01-274-101/+124
| | |
| * | Working though somewhat clumsy DHE_PSK and ECDHE_PSK. Tested against GnuTLSlloyd2012-01-275-24/+100
| | |
| * | Somewhat cleaner PSK handlinglloyd2012-01-273-27/+34
| | |
| * | Server side PSK kexlloyd2012-01-274-13/+37
| | |
| * | Split up the psk function as the server also wants to be able to looklloyd2012-01-273-22/+37
| | | | | | | | | | | | up a PSK from an identity.
| * | Credentials hooks for PSKlloyd2012-01-272-2/+27
| | |
| * | Add client-side support for PSK kex. Tested against OpenSSL.lloyd2012-01-278-14/+97
| | |
| * | First attempt to get certificates matching the name the client sent inlloyd2012-01-271-3/+27
| | | | | | | | | | | | | | | the SNI extension. If we can't find anything, send an unrecognized_name alert and then retry with the requested server name as "" (ie default).
| * | Remove Alert::Level enum, replace with boollloyd2012-01-265-14/+10
| | |
| * | Change callback interface to pass the Alert object itself insteadlloyd2012-01-268-17/+86
| | | | | | | | | | | | | | | | | | of just the type code. Implement Alert::type_string
| * | Make Alert a first class object ala Version. Move the alert codes intolloyd2012-01-2623-177/+224
| | | | | | | | | | | | the Alert class for namespacing.
| * | Deleting the return of private_key_for in the TLS server forces thelloyd2012-01-264-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | credentials server to return a new copy each time which is slow and mostly pointless. Instead, specify that the key remains owned by the credentials manager. This is theoretically an issue if you have thousands of keys to manage; the credentials server doesn't actually know when they have gone out of scope until its destructor runs. So it could be forced to use a lot of memory in the meantime. I'm not sure that this is a case worth optimizing for, at least until someone comes along who actually has this as a problem.
| * | Clean up record writer a bitlloyd2012-01-251-55/+60
| | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-27 01:08:37 +0000