openbsd/src/lib/libssl/ssl.h, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-09-20T09:42:00+00:00 Add guards around SSL_get0_peername that were accidentally omitted. 2020-09-20T09:42:00+00:00 tb 2020-09-20T09:42:00+00:00 urn:sha1:37e374b9312a434bc3744d7582b97de9d912390b Prepare to provide SSL_get0_peername 2020-09-19T10:17:56+00:00 tb 2020-09-19T10:17:56+00:00 urn:sha1:3efe302d9cf5eaaed1c23c0b40d5bb43404367da This is a convenience reacharound to libcrypto that trivially wraps X509_VERIFY_PARAM_get0_peername(). It is used by unbound 1.11.0 for better logging. As it's part of the API that landed with OpenSSL's DANE, more recent postfix snapshots use it as well. ok beck inoguchi jsing Prepare to provide stubbed out versions for reading/writing 0-RTT data 2020-09-19T10:12:06+00:00 tb 2020-09-19T10:12:06+00:00 urn:sha1:ca0243067b7fd199734d0175dd0fadafdce122fc We do not support this feature but need to provide OpenSSL's API since software assumes it's available whenever TLS1_3_VERSION is available. These are minimal stubs that should have a decent chance to interact reasonably with software expecting the tricky upstream semantics, but this will have to be sorted out with runtime testing, so will likely have to be refined and revisited. ok beck jsing Prepare to provide SSL{,_CTX}_{get,set}_max_early_data 2020-09-19T10:05:00+00:00 tb 2020-09-19T10:05:00+00:00 urn:sha1:1e4262bd018904cc16b72e9d2f9d77fa1615d2e5 Similar to the SSL_SESSION versions, these are noops that are expected to be available by some configure tests. ok beck jsing Prepare to provide SSL_SESSION_{set,get}_max_early_data() 2020-09-19T09:56:35+00:00 tb 2020-09-19T09:56:35+00:00 urn:sha1:64d116f977e819c5c3ec5361ae30c2df9e5f9101 Since we do not support 0-RTT, these are noops. Some software expects this API to be available if TLS1_3_VERSION is defined. ok beck jsing Prepare to provide SSL_get_peer_tmp_key(). 2020-09-17T15:42:14+00:00 jsing 2020-09-17T15:42:14+00:00 urn:sha1:181e322485985db2e19534d34ecc9005bd54c698 OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@ Implement SSL_{CTX_,}set_ciphersuites(). 2020-09-13T16:49:05+00:00 jsing 2020-09-13T16:49:05+00:00 urn:sha1:413d6dece592534652ab298d8c9f26aca9ce2063 OpenSSL added a separate API for configuring TLSv1.3 ciphersuites. Provide this API, while retaining the current behaviour of being able to configure TLSv1.3 via the existing interface. Note that this is not currently exposed in the headers/exported symbols. ok beck@ inoguchi@ tb@ Consistently spell 'unsigned' as 'unsigned int', as style(9) seems 2020-03-16T15:25:14+00:00 tb 2020-03-16T15:25:14+00:00 urn:sha1:168e0561df78f7340b3a674c6ffe771fb5b4bbb2 to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing Move guards from public to internal headers, and fix not use values. 2020-01-22T07:49:33+00:00 beck 2020-01-22T07:49:33+00:00 urn:sha1:a51d351bce20a83e3ca3ca7f6b906a3cabb79ee2 reverts previous attempt which would have broken ports ok jsing@ Split the TLSv1.3 guards into separate client and server guards. 2020-01-22T01:21:43+00:00 jsing 2020-01-22T01:21:43+00:00 urn:sha1:4c51eb4a7e69d292be8035dde8373d7945494bae ok beck@ tb@