kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
b16346b0ad
boringssl/include/openssl
History
David Benjamin b16346b0ad Add SSL_set_reject_peer_renegotiations. 
This causes any unexpected handshake records to be met with a fatal
no_renegotiation alert.

In addition, restore the redundant version sanity-checks in the handshake state
machines. Some code would zero the version field as a hacky way to break the
handshake on renego. Those will be removed when switching to this API.

The spec allows for a non-fatal no_renegotiation alert, but ssl3_read_bytes
makes it difficult to find the end of a ClientHello and skip it entirely. Given
that OpenSSL goes out of its way to map non-fatal no_renegotiation alerts to
fatal ones, this seems probably fine. This avoids needing to account for
another source of the library consuming an unbounded number of bytes without
returning data up.

Change-Id: Ie5050d9c9350c29cfe32d03a3c991bdc1da9e0e4
Reviewed-on: https://boringssl-review.googlesource.com/4300
Reviewed-by: Adam Langley <agl@google.com>
2015-04-13 22:38:58 +00:00
..
aead.h Add AEADs for AES-CTR with HMAC-SHA256. 2015-03-18 21:16:55 +00:00
aes.h Add some more Android compatibility declarations. 2015-03-20 11:50:29 -07:00
asn1_mac.h Prune away (almost) all of asn1_mac.h 2015-04-08 20:42:57 +00:00
asn1.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
asn1t.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
base64.h Various documentation fixes. 2015-01-14 21:50:50 +00:00
base.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
bio.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
blowfish.h Add decrepit, initially containing CAST and Blowfish. 2015-04-06 16:58:45 -07:00
bn.h Convert bn_test to C++. 2015-04-01 19:53:51 +00:00
buf.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
bytestring.h Don't accept tag number 31 (long form identifier octets) in CBB_add_asn1. 2015-02-03 11:03:59 -08:00
cast.h Add decrepit, initially containing CAST and Blowfish. 2015-04-06 16:58:45 -07:00
chacha.h Move public headers to include/openssl/ 2014-07-14 22:42:18 +00:00
cipher.h Remove crypto/obj dependencies from low-level crypto tests. 2015-04-13 20:25:45 +00:00
conf.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
cpu.h Never set RC4_CHAR. 2015-02-20 23:59:59 +00:00
crypto.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
des.h Add support for 3DES ECB. 2015-03-18 19:55:14 +00:00
dh.h Add a couple of compatibility #defines for DH. 2015-04-06 16:58:46 -07:00
digest.h Replace MD5 in examples with SHA-256. 2015-04-13 20:55:48 +00:00
dsa.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
dtls1.h Remove buffered_app_data as well. 2015-04-06 21:39:27 +00:00
ec_key.h Fix typo. 2015-04-10 22:25:59 +00:00
ec.h Unexport EC_GROUP_copy. 2015-02-27 19:43:02 +00:00
ecdh.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
ecdsa.h Remove TODO about removing ECDSA_do_sign/ECDSA_do_verify. 2015-04-07 00:07:19 +00:00
engine.h Remove support for dynamic METHODs. 2015-02-06 20:56:10 +00:00
err.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
evp.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
ex_data.h Remove unused ex_data indexes. 2015-04-07 00:09:47 +00:00
hkdf.h Implement HKDF. 2014-12-18 20:13:06 +00:00
hmac.h Forbid reusing HMAC key without reusing the hash function. 2015-03-02 23:16:12 +00:00
lhash_macros.h Use thread-local storage for ERR. 2015-04-08 16:23:03 -07:00
lhash.h Use thread-local storage for ERR. 2015-04-08 16:23:03 -07:00
md4.h Add digest_test with tests for all existing EVP_MDs. 2014-11-06 01:49:03 +00:00
md5.h Readd MD4. 2014-08-26 21:51:48 +00:00
mem.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
modes.h Add visibility rules. 2014-07-31 22:03:11 +00:00
obj_mac.h Renegerate OID outputs. 2014-12-04 22:13:50 +00:00
obj.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
objects.h Move public headers to include/openssl/ 2014-07-14 22:42:18 +00:00
opensslfeatures.h Remove remaining remnants of RIPEMD-160 support. 2015-03-17 21:03:42 +00:00
opensslv.h Add some more Android compatibility declarations. 2015-03-20 11:50:29 -07:00
ossl_typ.h Move public headers to include/openssl/ 2014-07-14 22:42:18 +00:00
pem.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
pkcs7.h Move public headers to include/openssl/ 2014-07-14 22:42:18 +00:00
pkcs8.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
pkcs12.h Move public headers to include/openssl/ 2014-07-14 22:42:18 +00:00
poly1305.h Always write the Poly1305 tag to an aligned buffer. 2015-01-14 23:38:25 +00:00
pqueue.h Export pqueue functions. 2014-09-03 21:38:19 +00:00
rand.h Add some missing headers to doc.config. 2015-04-13 22:07:47 +00:00
rc4.h Fix up whitespace in headers for doc.go. 2015-04-08 17:32:55 -07:00
rsa.h Fix up whitespace in headers for doc.go. 2015-04-08 17:32:55 -07:00
safestack.h Rename safe_stack.h to safestack.h. 2015-02-20 23:33:48 +00:00
sha.h Fix SHA-384 and -512 in NO_ASM mode. 2015-03-05 22:44:00 +00:00
srtp.h Store SRTP_PROTECTION_PROFILES as const. 2015-01-14 22:10:08 +00:00
ssl2.h Rename ssl_locl.h to internal.h 2015-04-10 22:14:09 +00:00
ssl3.h Tidy record length check. 2015-04-06 20:50:45 +00:00
ssl23.h Reformat SSL/TLS headers. 2015-01-26 20:23:09 +00:00
ssl.h Add SSL_set_reject_peer_renegotiations. 2015-04-13 22:38:58 +00:00
stack_macros.h Add sk_deep_copy and its macro. 2015-02-13 10:59:10 -08:00
stack.h Fix a couple of issues with building with strict C99. 2015-03-18 21:17:40 +00:00
thread.h Fix up whitespace in headers for doc.go. 2015-04-08 17:32:55 -07:00
time_support.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
tls1.h Clean up SSL_export_keying_material implementation. 2015-04-06 20:47:54 +00:00
type_check.h Move public headers to include/openssl/ 2014-07-14 22:42:18 +00:00
x509_vfy.h Update API to use (char *) for email addresses and hostnames. 2015-02-13 11:00:48 -08:00
x509.h Add support for reading PKCS#7 data from PEM files. 2015-02-27 21:02:38 +00:00
x509v3.h Update API to use (char *) for email addresses and hostnames. 2015-02-13 11:00:48 -08:00