openbsd/src/lib/libtls/tls_internal.h, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2019-11-16T21:39:52+00:00 Allow 1.3 ciphers in libtls. 2019-11-16T21:39:52+00:00 beck 2019-11-16T21:39:52+00:00 urn:sha1:da504cd806978b7bc31863fbdc28c3463abe3348 ok jsing@ Allow portable to override the default CA bundle location 2019-11-16T06:44:33+00:00 beck 2019-11-16T06:44:33+00:00 urn:sha1:91f9d7d40c9378009df5654394df39b98eaff9f3 ok kinichiro@ jsing@ Provide tls_conn_cipher_strength(). 2019-11-02T13:37:59+00:00 jsing 2019-11-02T13:37:59+00:00 urn:sha1:914deddb0bc7631f9603d3f22c07d8b3b6031d80 This returns the strength in bits of the symmetric cipher used for the connection. Diff from gilles@ ok tb@ Add a mutex to guard reference counting for tls_config. 2019-04-01T15:58:02+00:00 jsing 2019-04-01T15:58:02+00:00 urn:sha1:21c42a511c7d5693d9e491b79f765c4e74d2c16e This makes libtls more friendly for multithreaded use - otherwise we can end up with incorrect refcounts and end up freeing when we should not be (or not freeing when we should be). ok beck@ Define TLS_CA_CERT_FILE rather than having every application create their 2018-11-06T20:34:54+00:00 jsing 2018-11-06T20:34:54+00:00 urn:sha1:c572182382f504af52f71f2197c113d5be045376 own define for /etc/ssl/cert.pem. ok beck@ bluhm@ tb@ Correct tls_config_clear_keys() behaviour. 2018-04-07T16:35:34+00:00 jsing 2018-04-07T16:35:34+00:00 urn:sha1:111c0ba098842c9337026115c4d68b9a0f312b9d Previously this incorrectly called tls_keypair_clear(), which results in the private key being cleared, along with the certificate, OCSP staple and pubkey hash. This breaks OCSP stapling if tls_config_clear_keys() is called following tls_configure(), as is done by httpd. Fix this by calling tls_keypair_clear_key() so that only the private key is cleared, leaving the other public data untouched. While here, remove tls_keypair_clear() and fold the necessary parts into tls_keypair_free(). ok beck@ Automatically handle library initialisation for libtls. 2018-03-19T16:34:47+00:00 jsing 2018-03-19T16:34:47+00:00 urn:sha1:5fd38b4657cfd0f2e0b0b92fd650c6710e8fbc8b Now that we have tls_init() under pthread_once(), automatically initialise libtls from the entry point functions (tls_config(), tls_client() and tls_server()) - this makes an explicit tls_init() call no longer a requirement. ok bcook@ beck@ inoguchi@ Move the keypair pubkey hash handling code to during config. 2018-02-10T04:57:35+00:00 jsing 2018-02-10T04:57:35+00:00 urn:sha1:351d578b1eacfbf1586f49fbbabbdb4e7efdbf5c The keypair pubkey hash was being generated and set in the keypair when the TLS context was being configured. This code should not be messing around with the keypair contents, since it is part of the config (and not the context). Instead, generate the pubkey hash and store it in the keypair when the certificate is configured. This means that we are guaranteed to have the pubkey hash and as a side benefit, we identify bad certificate content when it is provided, instead of during the context configuration. ok beck@ Add support to libtls for client-side TLS session resumption. 2018-02-10T04:41:24+00:00 jsing 2018-02-10T04:41:24+00:00 urn:sha1:7f2c0ca878baa76136bb91e6e42ba28feb243a6b A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@ Have tls_keypair_pubkey_hash() call tls_keypair_load_cert() instead of 2018-02-08T10:19:31+00:00 jsing 2018-02-08T10:19:31+00:00 urn:sha1:1f7ca2478ab23918c94907b989d2935db2a2b660 rolling its own certificate loading. This also means we get better error reporting on failure.