| Age | Commit message (Collapse) | Author |
|---|
|
|
|
The callback should be called as soon as the connection is established,
and if we actually set the callback when it already is, we expect it to
be called immediately.
|
|
|
|
This is 23febbed41d8296cf9e532a17145822cd099b591 but without the bug
that makes the CI hang :^)
|
|
This reverts commit 23febbed41d8296cf9e532a17145822cd099b591.
It breaks the TestTLSHandshake test used in CI, it causes it
to hang, and all CI jobs have been hanging.
|
|
There's no reason to limit ourselves to 4KiB, this socket is not
blocking anyway.
|
|
There's no reason to keep waiting when there's nothing else to come.
This makes RequestServer not spin on Core::Socket::read() (in some
scenarios).
|
|
|
|
If we can easily communicate failure, let's avoid asserting and report
failure instead.
|
|
Only one place used this argument and it was to hold on to a strong ref
for the object. Since we already do that now, there's no need to keep
this argument around since this can be easily captured.
This commit contains no changes.
|
|
This patch brings the ConfigFile helpers for opening lib, app and system
configs more inline with the regular ConfigFile::open functions.
|
|
This adds the following cipher suites:
* DHE_RSA_WITH_AES_128_GCM_SHA256
* DHE_RSA_WITH_AES_256_GCM_SHA384
|
|
This adds two methods, handle_dhe_rsa_server_key_exchange and
build_dhe_rsa_pre_master_secret, to TLSv12 and a struct,
server_diffie_hellman_params, to Context, which are used to implement
the DHE_RSA key exchange algorithm. This grants us the benefits of
forward secrecy and access to sites which support DHE_RSA.
It is worth noting that the signature of the server provided
Diffie-Hellman parameters is not currently validated. This will need to
be addressed to prevent man-in-the-middle attacks.
|
|
|
|
|
|
This allows us to support parsing and serializing BigIntegers to and
from any base N (such that 2 <= N <= 36).
|
|
Connection state changes when the logical transport is closed should
not trigger tls_finished.
|
|
|
|
|
|
Previously ByteBuffer::grow() behaved like Vector<T>::resize().
However the function name was somewhat ambiguous - and so this patch
updates ByteBuffer to behave more like Vector<T> by replacing grow()
with resize() and adding an ensure_capacity() method.
This also lets the user change the buffer's capacity without affecting
the size which was not previously possible.
Additionally this patch makes the capacity() method public (again).
|
|
The standard allows for ciphers to define which hash to use.
Fixes #7348
|
|
The old enumeration didn't allow discriminating the key exchange
algorithms used, but only allowed the handshake with the server. With
this new enumeration, we can know which key exchange algorithm we are
actually supposed to use :^)
|
|
Also sort the existing cipher suites, and remove the unsupported ones.
We don't support any of these recommended ciphers, but at least we now
know which ones we should focus on :^)
|
|
This is more of an example commit of how to add new ciphers to TLS.
|
|
After this, we aren't hardcoding RSA in everything we do anymore!
|
|
This is better than using the AEAD flag :^)
|
|
|
|
This commit only moves and renames methods. The code hasn't changed.
|
|
Instead of sprinkling the definition of the ciper suites all over the
TLS implementation, let's regroup it all once and for all in a single
place, and then add our new implementations there.
|
|
|
|
|
|
Nobody seems to use this particular feature, in fact there were some
bugs which were uncovered by removing operator bool.
|
|
This fixes a few compiler warnings and makes some variables const-ref
in preparation for the next commit which changes how ByteBuffer works.
|
|
This was likely commented out at some point to debug something.
|
|
This adds an `AK::ByteReader` to help with that so we don't duplicate
the logic all over the place.
No more `*(const u16*)` and `*(const u32*)` for anyone.
This should help a little with #7060.
|
|
Fixes #7071.
|
|
|
|
...and make it an enum class so people don't omit "OpenMode".
|
|
At some point since Sep 2018, OpenSSL added a ~~bug~~ feature that makes
the default set of signature algorithms defined in TLSv1.2 unusable
without reducing what they call the "security level", which caused
communication with servers using more recent versions of openssl to
fail with "internal error".
This commit makes LibTLS always send its supported sigalgs, making the
server not default to the insecure defaults, and thus enabling us to
talk to such servers.
|
|
|
|
Otherwise the notification would be deferred until the next read event,
which means the client will not get any events if the server initiates
the appdata transfers.
|
|
|
|
SPDX License Identifiers are a more compact / standardized
way of representing file license information.
See: https://spdx.dev/resources/use/#identifiers
This was done with the `ambr` search and replace tool.
ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
|
|
As a nice side effect, also correctly test for certificate validity :^)
|
|
|
|
|
|
According to RFC6066, empty extension_data for an SNI extension is
absolutely one of the possibilities - so let's support this instead of
spamming the debug log.
|
|
The debug console was full of 'Update hash with message of size x'.
|
|
The user may now request specific cipher suites, the use of SNI, and
whether we should validate certificates (not that we're doing a good job
of that).
|
|
|
