openbsd/src/lib/libtls/Symbols.list, branch OPENBSD_6_8_BASE

Provide tls_conn_cipher_strength().

2019-11-02T13:37:59+00:00

This returns the strength in bits of the symmetric cipher used for the connection. Diff from gilles@ ok tb@

missed adding tls_default_ca_cert_file here. found by sthen

2018-11-29T15:51:49+00:00

Add support to libtls for client-side TLS session resumption.

2018-02-10T04:41:24+00:00

A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@

Add a tls_config_set_ecdhecurves() function to libtls, which allows the

2017-08-10T18:18:30+00:00

names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@

Add support for providing CRLs to libtls - once a CRL is provided we

2017-07-06T17:12:22+00:00

enable CRL checking for the full certificate chain. Based on a diff from Jack Burton , thanks! Discussed with beck@

Provide a tls_unload_file() function, that frees the memory returned from

2017-05-06T20:57:45+00:00

a tls_load_file() call, ensuring that it the contents become inaccessible. This is specifically needed on platforms where the library allocators may be different from the application allocator. ok beck@

Add tls_peer_cert_chain_pem - To retreive the peer certificate and chain

2017-04-05T03:19:22+00:00

as PEM format. This allows for it to be used or examined with tools external to libtls bump minor ok jsing@

Internal changes to allow for relayd engine privsep. sends the hash of the

2017-04-05T03:13:53+00:00

public key as an identifier to RSA, and adds an function for relayd to use to disable private key checking when doing engine privsep. ok jsing@

Add tls_config_[add|set]keypair_ocsp functions so that ocsp staples may be

2017-01-31T16:18:57+00:00

added associated to a keypair used for SNI, and are usable for more than just the "main" certificate. Modify httpd to use this. Bump libtls minor. ok jsing@

Introduce ticket support. To enable them it is enough to set a positive

2017-01-24T01:48:05+00:00

lifetime with tls_config_set_session_lifetime(). This enables tickets and uses an internal automatic rekeying mode for the ticket keys. If multiple processes are involved the following functions can be used to make tickets work accross all instances: - tls_config_set_session_id() sets the session identifier - tls_config_add_ticket_key() adds an encryption and authentication key For now only the last 4 keys added will be used (unless they are too old). If tls_config_add_ticket_key() is used the caller must ensure to add new keys regularly. It is best to do this 4 times per session lifetime (which is also the ticket key lifetime). Since tickets break PFS it is best to minimize the session lifetime according to needs. With a lot of help, input and OK beck@, jsing@