openbsd/src/lib/libtls/tls_internal.h, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2024-12-10T08:40:30+00:00Provide tls_peer_cert_common_name()2024-12-10T08:40:30+00:00tb2024-12-10T08:40:30+00:00urn:sha1:d3da05396af6da5d0c94da0425031aa4fd529ac9
There is currently no sane way of getting your hands on the common name or
subject alternative name of the peer certificate from libtls. It is possible
to extract it from the peer cert's PEM by hand, but that way lies madness.
While the common name is close to being deprecated in the webpki, it is
still the de facto standard to identify client certs. It would be nice to
have a way to access the subject alternative names as well, but this is a
lot more difficult to expose in a clean and sane C interface due to its
multivaluedness.
Initial diff from henning, with input from beck, jsing and myself
henning and bluhm have plans of using this in syslogd.
ok beck
Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
Use errno_value instead of num for readability2024-03-26T00:50:22+00:00joshua2024-03-26T00:50:22+00:00urn:sha1:ebb5d184382e45fee186dab409ffc48de54983b6
ok beck@ jsing@
Zap stray space2023-06-27T18:19:59+00:00tb2023-06-27T18:19:59+00:00urn:sha1:0fbd7fe654d8ec5bc487af1a7412d3c479b48fa6libtls: switch ECDSA_METHOD usage to EC_KEY_METHOD2023-06-18T11:43:03+00:00op2023-06-18T11:43:03+00:00urn:sha1:d4df7cddd1d4ded9778f0ab6b2c234b2d54515c3
smtpd and the bits it needs in libtls are the only consumer left of
ECDSA_METHOD, which is long deprecated. This paves the way for the
removal in libcrypto.
The diff is from gilles' work on OpenSMTPD-portable, libretls had a
similar diff.
ok tb@, jsing@
Drop X9.31 support from libtls2023-04-09T18:26:26+00:00tb2023-04-09T18:26:26+00:00urn:sha1:f5072cf9562fff0cb2416b6d99a9975b34d4bbf3
The TLS signer isn't exposed in public API (we should finally fix it...)
and it supports X9.31, a standard that has been retired and deprecated for
a very long time. libcrypto will stop supporting it soon, this step is
needed to prepare userland.
ok jsing
Hide the tls_signer from public visibility. It's not ready yet and2022-03-24T15:56:34+00:00tb2022-03-24T15:56:34+00:00urn:sha1:3ec89a9ed2faefa8b6b6deaf561a2a72744e1335
should not be used. It will be revisited after release.
ok beck inoguchi jsing
Introduce a signer interface intented to make TLS privsep simpler2022-01-25T21:51:24+00:00eric2022-01-25T21:51:24+00:00urn:sha1:bff2f4430c3c0f9cc4584883118372ffbdcbd1e6
to implement.
Add a tls_config_set_sign_cb() function that allows to register
a callback for the signing operation on a tls_config. When used,
the context installs fake pivate keys internally, and the callback
receives the hash of the public key.
Add a tls_signer_*() set of functions to manage tls_signer objects.
A tls_signer is an opaque structure on which keys are added.
It is used to compute signatures with private keys identified by
their associated public key hash.
Discussed with and ok jsing@ tb@
Allow setting a keypair on a tls context without specifying the private2021-01-21T19:09:10+00:00eric2021-01-21T19:09:10+00:00urn:sha1:d2ab351fe9c988b44fe7daa9c749b02330249121
key, and fake it internally with the certificate public key instead.
It makes it easier for privsep engines like relayd that don't have to
use bogus keys anymore.
ok beck@ tb@ jsing@
Allow 1.3 ciphers in libtls.2019-11-16T21:39:52+00:00beck2019-11-16T21:39:52+00:00urn:sha1:da504cd806978b7bc31863fbdc28c3463abe3348
ok jsing@