openbsd/src/lib/libssl/ssl_methods.c, branch OPENBSD_7_9_BASE

Ensure that we cannot negotiate TLSv1.1 or lower.

2026-04-03T12:58:19+00:00

TLS versions prior to TLSv1.2 were disabled a while ago, however this was done in the version handling code. Remove TLSv1.1 and earlier from ssl_get_method() and add an explicit min version check in the legacy client and server, to provide a stronger guarantee. ok kenjiro@ tb@

Remove get_cipher from SSL_METHOD.

2024-07-23T14:40:54+00:00

Inline the get_cipher implementation (including the special handling for DTLS) in ssl_cipher_collect_ciphers() (the only consumer), remove the get_cipher member of SSL_METHOD and mop up dtls1_get_cipher(). ssl3_get_cipher() has always had a strange property of being a reverse index, which is relied on by the cipher list ordering code, since it currently assumes that high cipher suite values are preferable. Rather than complicating ssl3_get_cipher() (and regress), change the iteration order in ssl_cipher_collect_ciphers() to match what it requires. Lastly, rename ssl3_get_cipher() to be more descriptive. ok tb@

Hide all public symbols in libssl

2023-07-08T16:40:14+00:00

With the guentherizer 9000 ok tb@

unifdef the LIBRESSL_HAS_TLS1_3_[CLIENT|SERVER] goo

2023-07-06T07:56:32+00:00

And remove the tendrils. This was useful for transition but we are now well past this.

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Dedup dtls1_dispatch_alert()/ssl3_dispatch_alert().

2021-07-26T03:17:38+00:00

The code for dtls1_dispatch_alert() and ssl3_dispatch_alert() is largely identical - with a bit of reshuffling we can use ssl3_dispatch_alert() for both protocols and remove the ssl_dispatch_alert function pointer. ok inoguchi@ tb@

Do a first pass clean up of SSL_METHOD.

2021-07-03T16:06:45+00:00

The num_ciphers, get_cipher_by_char and put_cipher_by_char function pointers use the same function for all methods - call ssl3_num_ciphers() directly, absorb ssl3_get_cipher_by_char() into SSL_CIPHER_find() and remove the unused ssl3_put_cipher_by_char() code. ok inoguchi@ tb@

Merge SSL_METHOD_INTERNAL into SSL_METHOD.

2021-07-01T17:53:39+00:00

Now that SSL_METHOD is opaque and in internal headers, we can remove SSL_METHOD_INTERNAL by merging it back into SSL_METHOD. ok tb@

Move DTLS structs/definitions/prototypes to dtls_locl.h.

2021-05-16T13:56:31+00:00

Now that the DTLS structs are opaque, add a dtls_locl.h header and move internal-only structs from dtls1.h, along with prototypes from ssl_locl.h. Only pull this header in where DTLS code actually exists. ok inoguchi@ tb@

Expose various DTLSv1.2 specific functions and defines

2021-03-31T16:59:32+00:00

ok bcook inoguchi jsing