openbsd/src/lib/libtls/tls_client.c, branch OPENBSD_6_8_BASE

Automatically handle library initialisation for libtls.

2018-03-19T16:34:47+00:00

Now that we have tls_init() under pthread_once(), automatically initialise libtls from the entry point functions (tls_config(), tls_client() and tls_server()) - this makes an explicit tls_init() call no longer a requirement. ok bcook@ beck@ inoguchi@

Add support to libtls for client-side TLS session resumption.

2018-02-10T04:41:24+00:00

A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@

Add a tls_config_set_ecdhecurves() function to libtls, which allows the

2017-08-10T18:18:30+00:00

names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@

Ensure that a client context has been connected before attempting to

2017-05-07T03:27:06+00:00

complete a TLS handshake.

Rework name verification code so that a match is indicated via an argument,

2017-04-10T17:11:13+00:00

rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg . ok beck@ jca@

Use a flag to track when we need to call SSL_shutdown(). This avoids an

2017-01-26T12:56:37+00:00

issue where by calling tls_close() on a TLS context that has not attempted a handshake, results in an unexpected failure. Reported by Vinay Sajip. ok beck@

If tls_set_cbs() fails an error will already be specified, so do not

2017-01-12T16:15:58+00:00

replace it with a less specific one.

Hook up a certificate verify callback so that we can set user friendly

2016-12-26T16:20:58+00:00

error messages, instead of libssl error strings. This gives us messages like: certificate verification failed: certificate has expired Instead of: 14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed This also lets us always enable peer verification since the no verification case is now handled via the callback. Tested by tedu@ ok beck@

Add OCSP client side support to libtls.

2016-11-02T15:18:42+00:00

- Provide access to certificate OCSP URL - Provide ability to check a raw OCSP reply against an established TLS ctx - Check and validate OCSP stapling info in the TLS handshake if a stapled OCSP response is provided.` Add example code to show OCSP URL and stapled info into netcat. ok jsing@

Maintain consistency with function naming.

2016-09-04T13:20:56+00:00