openbsd/src/lib/libtls/Symbols.list, branch OPENBSD_7_9_BASE

expose tls_peer_cert_common_name()

2024-12-10T08:40:45+00:00

Hide the tls_signer from public visibility. It's not ready yet and

2022-03-24T15:56:34+00:00

should not be used. It will be revisited after release. ok beck inoguchi jsing

Expose tls_signer_error()

2022-01-28T03:46:46+00:00

Add tls_signer_error to Symbols.list - this was missed during the last libtls minor bump and can ride along. ok deraadt@

Introduce a signer interface intented to make TLS privsep simpler

2022-01-25T21:51:24+00:00

to implement. Add a tls_config_set_sign_cb() function that allows to register a callback for the signing operation on a tls_config. When used, the context installs fake pivate keys internally, and the callback receives the hash of the public key. Add a tls_signer_*() set of functions to manage tls_signer objects. A tls_signer is an opaque structure on which keys are added. It is used to compute signatures with private keys identified by their associated public key hash. Discussed with and ok jsing@ tb@

Allow setting a keypair on a tls context without specifying the private

2021-01-21T19:09:10+00:00

key, and fake it internally with the certificate public key instead. It makes it easier for privsep engines like relayd that don't have to use bogus keys anymore. ok beck@ tb@ jsing@

Provide tls_conn_cipher_strength().

2019-11-02T13:37:59+00:00

This returns the strength in bits of the symmetric cipher used for the connection. Diff from gilles@ ok tb@

missed adding tls_default_ca_cert_file here. found by sthen

2018-11-29T15:51:49+00:00

Add support to libtls for client-side TLS session resumption.

2018-02-10T04:41:24+00:00

A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@

Add a tls_config_set_ecdhecurves() function to libtls, which allows the

2017-08-10T18:18:30+00:00

names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@

Add support for providing CRLs to libtls - once a CRL is provided we

2017-07-06T17:12:22+00:00

enable CRL checking for the full certificate chain. Based on a diff from Jack Burton , thanks! Discussed with beck@