summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add guards around SSL_get0_peername that were accidentally omitted.tb2020-09-201-1/+3
|
* Prepare to provide SSL_get0_peernametb2020-09-191-1/+2
| | | | | | | | | This is a convenience reacharound to libcrypto that trivially wraps X509_VERIFY_PARAM_get0_peername(). It is used by unbound 1.11.0 for better logging. As it's part of the API that landed with OpenSSL's DANE, more recent postfix snapshots use it as well. ok beck inoguchi jsing
* Prepare to provide stubbed out versions for reading/writing 0-RTT datatb2020-09-191-1/+12
| | | | | | | | | | | We do not support this feature but need to provide OpenSSL's API since software assumes it's available whenever TLS1_3_VERSION is available. These are minimal stubs that should have a decent chance to interact reasonably with software expecting the tricky upstream semantics, but this will have to be sorted out with runtime testing, so will likely have to be refined and revisited. ok beck jsing
* Prepare to provide SSL{,_CTX}_{get,set}_max_early_datatb2020-09-191-1/+10
| | | | | | | Similar to the SSL_SESSION versions, these are noops that are expected to be available by some configure tests. ok beck jsing
* Prepare to provide SSL_SESSION_{set,get}_max_early_data()tb2020-09-191-1/+5
| | | | | | | Since we do not support 0-RTT, these are noops. Some software expects this API to be available if TLS1_3_VERSION is defined. ok beck jsing
* Prepare to provide SSL_get_peer_tmp_key().jsing2020-09-171-1/+11
| | | | | | | | OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@
* Implement SSL_{CTX_,}set_ciphersuites().jsing2020-09-131-1/+7
| | | | | | | | | | OpenSSL added a separate API for configuring TLSv1.3 ciphersuites. Provide this API, while retaining the current behaviour of being able to configure TLSv1.3 via the existing interface. Note that this is not currently exposed in the headers/exported symbols. ok beck@ inoguchi@ tb@
* Consistently spell 'unsigned' as 'unsigned int', as style(9) seemstb2020-03-161-3/+3
| | | | | | | | | to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
* Move guards from public to internal headers, and fix not use values.beck2020-01-221-7/+1
| | | | | | reverts previous attempt which would have broken ports ok jsing@
* Split the TLSv1.3 guards into separate client and server guards.jsing2020-01-221-1/+7
| | | | ok beck@ tb@
* Provide SSL_R_UNKNOWN.jsing2020-01-211-1/+2
| | | | | | | This allows us to indicate that the cause of the failure is unknown, rather than implying that it was an internal error when it was not. ok beck@
* Revise SSL_CTX_get_extra_chain_certs() to match OpenSSL behaviour.jsing2020-01-021-6/+8
| | | | | | | | | | | | | | In OpenSSL, SSL_CTX_get_extra_chain_certs() really means return extra certs, unless there are none, in which case return the chain associated with the certificate. If you really just want the extra certs, including knowing if there are no extra certs, then you need to call SSL_CTX_get_extra_chain_certs_only()! And to make this even more entertaining, these functions are not documented in any OpenSSL release. Reported by sephiroth-j on github, since the difference in behaviour apparently breaks OCSP stapling with nginx. ok beck@ inoguchi@ tb@
* Provide SSL chain/cert chain APIs.jsing2019-04-041-1/+36
| | | | | | | | | | | These allow for chains to be managed on a per-certificate basis rather than as a single "extra certificates" list. Note that "chain" in this context does not actually include the leaf certificate however, unlike SSL_CTX_use_certificate_chain_{file,mem}(). Thanks to sthen@ for running this through a bulk ports build. ok beck@ tb@
* Provide version agnostic DTLS methods.jsing2019-03-171-1/+5
| | | | ok tb@
* Add a re-implementation of SSL_get1_supported_ciphers().tb2019-01-221-1/+2
| | | | | | | Part of OpenSSL 1.1 API (pre-licence-change). input schwarze ok jsing
* Provide SSL_get_client_ciphers().tb2019-01-221-1/+2
| | | | | | Part of OpenSSL 1.1 API, pre-licence change. ok jsing
* Add SSL_set1_host(), a thin wrapper around X509_VERIFY_PARAM_set1_host().tb2018-11-111-1/+2
| | | | | | | Used by unbound's DNS over TLS implementation to do server name verification. ok jsing
* Add TLSv1.3 cipher suites (with appropriate guards).jsing2018-11-071-1/+4
| | | | ok beck@ tb@
* Add TLS1_3_VERSION and SSL_OP_NO_TLSv1_3 defines under guards.jsing2018-11-061-1/+6
| | | | ok beck@ bluhm@ tb@
* Let SSL_copy_session_id() return an int for error checking.tb2018-08-241-2/+2
| | | | | | | | | | Accordingly, add some error checking to SSL_copy_session_id(), BIO_ssl_copy_session_id(), and SSL_dup(). Prompted by OpenSSL commit 17dd65e6e1f Tested in a bulk build by sthen ok jsing
* const for BIO_f_ssl(), the last const difference to OpenSSL in ourtb2018-05-011-2/+2
| | | | | | public API in libssl. ok beck, jsing
* Fix capitalization of data. Pointed out by jsing and forgotten intb2018-04-251-2/+2
| | | | previous commit.
* OpenSSL started adding const to functions all over the place. Make alltb2018-04-251-9/+9
| | | | | | | | our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing
* Nuke SSL_OP_TLS_ROLLBACK_BUG - this is a workaround for buggy clients fromjsing2018-04-111-6/+2
| | | | | | | around the SSLv3/TLSv1.0 period... and buggy clients are buggy. This also helps to clean up the RSA key exchange code. ok "kill it with fire" beck@ tb@
* Provide SSL_SESSION_set1_id()tb2018-03-201-1/+4
| | | | ok jsing
* Bring in compatibility for OpenSSL 1.1 style init functions.beck2018-03-171-1/+14
| | | | | | | | | This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
* Provide SSL_SESSION_get_ticket_lifetime_hint() andtb2018-03-171-1/+3
| | | | | | SSL_SESSION_has_ticket() ok jsing
* Provide SSL_CTX_get_default_passwd_cb{,_userdata}()tb2018-03-171-1/+3
| | | | ok jsing
* SSL_SESSION_get_protocol_version() takes a const SSL_SESSION *.tb2018-03-171-2/+2
| | | | | | Noted by schwarze@ ok jsing@
* Provide SSL_CIPHER_get_auth_nid(), SSL_CIPHER_get_cipher_nid(),jsing2018-03-171-1/+6
| | | | | SSL_CIPHER_get_digest_nid(), SSL_CIPHER_get_kx_nid() and SSL_CIPHER_is_aead().
* Provide SSL_SESSION_get0_id_context().jsing2018-03-171-3/+5
|
* Provide SSL_CTX_get_min_proto_version and SSL_CTX_get_max_proto_versionjca2018-03-151-1/+11
| | | | | | | | | We already provided the setters, so also provide the getters like OpenSSL does. Addition prompted by the use of those functions in recent openvpn releases. manpage diff from schwarze@ (thanks!) with input from jsing@, ok tb@ jsing@
* Provide macro versions of SSL_CTX_set_min/max_proto_version and friendsjca2018-03-031-1/+16
| | | | | Needed at least by openvpn-2.4.5, which detects availability of this interface using #ifdefs... Discussed with & ok jsing@
* Provide SSL_is_server().jsing2018-02-221-1/+2
|
* Provide SSL_up_ref().jsing2018-02-221-2/+3
|
* Provide SSL_CTX_get_ciphers().jsing2018-02-221-1/+2
|
* Provide SSL_SESSION_up_ref().jsing2018-02-221-2/+3
|
* Provide SSL_SESSION_get_protocol_version()tb2018-02-201-1/+2
| | | | ok jsing
* Provide SSL_SESSION_get_master_key()jsing2018-02-171-1/+3
|
* Provide SSL_get_client_random() and SSL_get_server_random()jsing2018-02-171-1/+4
|
* Provide SSL_CTX_get0_certificate()jsing2018-02-171-1/+2
|
* Provide SSL_CTX_get_tlsext_status_cb() and SSL_CTX_get_tlsext_status_arg().jsing2018-02-171-1/+3
|
* Provide SSL_CTX_up_ref().jsing2018-02-141-1/+2
|
* Provide SSL_CTX_get0_param() and SSL_get0_param().jsing2018-02-141-2/+3
| | | | | Some applications that use X509_VERIFY_PARAM expect these to exist, since they're also part of the OpenSSL 1.0.2 API.
* Bring back the NPN related symbols.jsing2017-08-301-2/+8
| | | | | | | | | | | Several pieces of software make use of these based on a conditional around OPENSSL_NPN_NEGOTIATED, rather than using the presence of the symbols, the non-existence of a OPENSSL_NO_NEXTPROTONEG define or even the existence of the TLS extension type. Unfortunately we cannot remove OPENSSL_NPN_NEGOTIATED since the API for ALPN was effectively botched and reuses two parts from the NPN implementation, rather than providing ALPN specific or generic versions.
* Completely remove NPN remnants.jsing2017-08-281-8/+2
| | | | Based on a diff from doug@, similar diff from inoguchi@
* Remove support for the TLS padding extension.jsing2017-08-131-4/+3
| | | | | | | | This was added as a workaround for broken F5 TLS termination, which then created issues talking to broken IronPorts. The size of the padding is hardcoded so it cannot be used in any generic sense. ok bcook@ beck@ doug@
* Nuke SSL_OP_CRYPTOPRO_TLSEXT_BUG.jsing2017-08-131-9/+3
| | | | | | | This was a workaround for a server that needed to talk GOST to old/broken CryptoPro clients. This has no impact on TLS clients that are using GOST. ok bcook@ beck@ doug@
* Clean up the EC key/curve configuration handling.jsing2017-08-101-3/+2
| | | | | | | | | | | | | | | | | | | | | | Over the years OpenSSL grew multiple ways of being able to specify EC keys (and/or curves) for use with ECDH and ECDHE key exchange. You could specify a static EC key (SSL{_CTX,}_set_tmp_ecdh()), use that as a curve and generate ephemeral keys (SSL_OP_SINGLE_ECDH_USE), provide the EC key via a callback that was provided with insufficient information (SSL{_CTX,}_set_tmp_ecdh_cb()) or enable automatic selection and generation of EC keys via SSL{_CTX,}_set_ecdh_auto(). This complexity leads to problems (like ECDHE not being enabled) and potential weird configuration (like being able to do ECDHE without the ephemeral part...). We no longer support ECDH and ECDHE can be disabled by removing ECDHE ciphers from the cipher list. As such, permanently enable automatic EC curve selection and generation, effectively disabling all of the configuration knobs. The only exception is the SSL{_CTX,}_set_tmp_ecdh() functions, which retain part of their previous behaviour by configuring the curve of the given EC key as the only curve being enabled. Everything else becomes a no-op. ok beck@ doug@
* Move state from ssl->internal to the handshake structure.beck2017-05-071-7/+7
| | | | | | | while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 22:52:05 +0000