openbsd/src/lib/libssl/ssl.h, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92026-04-03T13:11:00+00:00Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability.2026-04-03T13:11:00+00:00jsing2026-04-03T13:11:00+00:00urn:sha1:9726691a1e7289634e04b2e44da815e69091af49
We no longer support TLSv1.0 and definitely do not support SSLv3 - remove
the empty fragments workaround for the CBC vulnerability in these
protocols.
ok kenjiro@ tb@
Provide SSL_SESSION_dup()2025-10-24T11:36:08+00:00tb2025-10-24T11:36:08+00:00urn:sha1:da2e8f3e57cf705fb1f88e94e321027a68cb42cf
As reported by ajacoutot and sthen, an update to net/neon is blocked on
that missing symbol.
ok kenjiro
Fix annoying whitespace2025-04-18T07:34:01+00:00tb2025-04-18T07:34:01+00:00urn:sha1:1afbc22dbc8e6d4c3acfc0dfe953e57a700731baProvide SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.2025-03-12T14:03:55+00:00jsing2025-03-12T14:03:55+00:00urn:sha1:b150ad681869b78ec3662f92df947a5790b32862
In January 2017 we added SSL_OP_NO_CLIENT_RENEGOTIATION, which results in a
SSL_AD_NO_RENEGOTIATION fatal alert if a ClientHello message is seen on an
active connection (client initiated renegotation). Then in May 2017 OpenSSL
added SSL_OP_NO_RENEGOTIATION, which results in a SSL_AD_NO_RENEGOTIATION
warning alert if a server receives a ClientHello on an active connection
(client initiated renegotation), or a client receives a HelloRequest
(server requested renegotation). This option also causes calls to
SSL_renegotiate() and SSL_renegotiate_abbreviated() to fail. Then in 2021,
OpenSSL also added SSL_OP_ALLOW_CLIENT_RENEGOTIATION, which trumps
SSL_OP_NO_RENEGOTIATION but only for incoming ClientHello messages
(apparently unsetting SSL_OP_NO_RENEGOTIATION is too hard).
Provide SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION,
primarily to make life easier for ports. If SSL_OP_NO_CLIENT_RENEGOTIATION
is set it will take precedence and render SSL_OP_ALLOW_CLIENT_RENEGOTIATION
ineffective. The rest of the behaviour should match OpenSSL, with the
exception of ClientHellos triggering fatal alerts instead of warnings.
ok tb@
const correct tls_session_secret_cb_fn()2025-03-09T15:53:36+00:00tb2025-03-09T15:53:36+00:00urn:sha1:868965d7ddee60d0be2a9a0555eaa25936c7b901
Various ports throw a warning since their tls_session_secret_cb's
signature doesn't match what we expect. Aligns us with OpenSSL 1.1.
This is only useful for RFC 4851 EAP-FAST implementations and
surprisingly it's undocumented.
ok jsing
remove duplicate defines; ok tb@2024-10-23T01:57:19+00:00jsg2024-10-23T01:57:19+00:00urn:sha1:ab34d71bcab207147c9318dde7698c75df4c5d4bRemove SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER2024-10-09T10:27:52+00:00tb2024-10-09T10:27:52+00:00urn:sha1:760f0968a9d8553e7813e752f2328f378d2e7a90
Nothing uses this and it collides with ALPN
Add missing alert errors and error strings2024-10-09T08:00:29+00:00tb2024-10-09T08:00:29+00:00urn:sha1:5970d14d0f56ef1cf034b25e99a18b9b0d2775cd
For every TLS alert there needs a corresponding error with error code
having an offset of SSL_AD_REASON_OFFSET (aka 1000), otherwise the error
stack fails to set the reason correctly.
ok beck
Remove SSL_add_compression_method2024-08-31T10:51:48+00:00tb2024-08-31T10:51:48+00:00urn:sha1:a0ced14fec228fa0dfd2fa5d87c942b0af9326d8Expose SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest()2024-08-12T21:01:00+00:00tb2024-08-12T21:01:00+00:00urn:sha1:256a003a11f25911f3043525bd58b6c6a5fff015