summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Avoid typedef redefinitionlibressl-v3.4.0inoguchi2021-09-141-3/+1
| | | | | | | "typedef struct ssl_st SSL;" is defined in ossl_typ.h. This reverts part of r1.204. ok tb@
* Move SSL_set0_rbio() outside of LIBRESSL_HAS_TLS1_3tb2021-09-101-3/+1
| | | | ok inoguchi jsing
* Expose SSL_R_NO_APPLICATION_PROTOCOL in ssl.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE in ssl.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_CTX_get0_privatekey() in ssl.htb2021-09-101-3/+1
| | | | ok beck
* Make SSL opaquetb2021-09-101-2/+4
| | | | with/ok jsing
* Remove struct tls_session_ticket_ext_st and TLS_SESSION_TICKET_EXTtb2021-09-101-1/+3
| | | | | | from public visibility. with/ok jsing
* Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callbacktb2021-09-101-1/+4
| | | | | | | | | | | | | | | | | | | As reported by Jeremy Harris, we inherited a strange behavior from OpenSSL, in that we ignore the SSL_TLSEXT_ERR_FATAL return from the ALPN callback. RFC 7301, 3.2 states: 'In the event that the server supports no protocols that the client advertises, then the server SHALL respond with a fatal "no_application_protocol" alert.' Honor this requirement and succeed only on SSL_TLSEXT_ERR_{OK,NOACK} which is the current behavior of OpenSSL. The documentation change is taken from OpenSSL 1.1.1 as well. As pointed out by jsing, there is more to be fixed here: - ensure that the same protocol is selected on session resumption - should the callback be called even if no ALPN extension was sent? - ensure for TLSv1.2 and earlier that the SNI has already been processed ok beck jsing
* Prepare to provide SSL_CTX_get0_privatekey()tb2021-09-101-1/+4
| | | | ok beck
* Provide SSL_SESSION_is_resumable and SSL_set_psk_use_session_callback stubstb2021-09-081-1/+10
| | | | ok jsing
* Prepare to provide API stubs for PHAtb2021-09-081-1/+8
| | | | ok bcook jsing
* Prepare to provide SSL_get_tlsext_status_type()tb2021-09-081-1/+4
| | | | | | Needed for nginx-lua to build with opaque SSL. ok inoguchi jsing
* Prepare to provide SSL_set0_rbio()tb2021-09-081-1/+4
| | | | | | | This is needed for telephony/coturn and telephony/resiprocate to compile without opaque SSL. ok inoguchi jsing
* Prepare to provide SSL_get_signature_nid() and friends.jsing2021-06-301-1/+15
| | | | | | | | | | | This adds functionality for SSL_get_signature_nid(), SSL_get_peer_signature_nid(), SSL_get_signature_type_nid() and SSL_get_peer_signature_type_nid(). This is not currently publicly visible and will be exposed at a later date. ok inoguchi@ tb@
* Move some structs from public to private headers.jsing2021-06-301-108/+1
| | | | | | | | Move struct ssl_cipher_st, struct ssl_method_st, struct ssl_session_st and struct ssl3_state_st from public to private headers. These are already under #ifdef LIBRESSL_INTERNAL and are no longer publicly visible. ok inoguchi@ tb@
* Add SSL_AD_MISSING_EXTENSION.jsing2021-06-131-1/+2
| | | | | | | This is an alert that was added in TLSv1.3 - we already use it internally, but did not provide the SSL_AD_* define previously. ok tb@
* Define SSL_AD_* as actual values.jsing2021-06-131-34/+43
| | | | | | | | | Rather than having SSL_AD_* as defines that refer to SSL3_AD_* or TLS1_AD_*, just give them actual values directly since it is more readable and the indirection provides no value. Place SSL3_AD_* and TLS1_AD_* under #ifndef LIBRESSL_INTERNAL to prevent further usage. ok tb@
* Place obsolete alerts under #ifndef LIBRESSL_INTERNAL.jsing2021-06-131-4/+7
| | | | ok tb@
* Absorb SSL_AEAD_CTX into struct tls12_record_protection.jsing2021-05-161-1/+3
| | | | | | | | The information contained in SSL_AEAD_CTX really belongs in the tls12_record_protection struct. Absorb SSL_AEAD_CTX, using more appropriate types in the process. ok tb@
* Make SSL_CIPHER, SSL_CTX, SSL_SESSION, {DTLS1,SSL3}_STATEtb2021-05-101-3/+3
| | | | | | and a few other structs in libssl opaque. from/ok jsing
* Provide SSL_SESSION_get0_cipher(3)tb2021-05-101-1/+2
| | | | ok jsing
* Provide SSL_CTX_get_ssl_method(3)tb2021-05-101-1/+3
| | | | ok jsing
* Provide SSL_CIPHER_find(3)tb2021-05-101-1/+2
| | | | ok jsing
* Expose various DTLSv1.2 specific functions and definestb2021-03-311-9/+1
| | | | ok bcook inoguchi jsing
* Expose SSL_set_hostflags(3) and SSL_get0_peername(3)tb2021-03-311-3/+1
| | | | ok bcook inoguchi jsing
* Expose SSL_use_certificate_chain_file(3)tb2021-03-311-3/+1
| | | | ok bcook inoguchi jsing
* Prepare to provide SSL_use_certificate_chain_file()tb2021-03-191-1/+4
| | | | | | | | | This is the same as SSL_CTX_use_certificate_chain_file() but for an SSL object instead of an SSL_CTX object. remi found this in a recent librelp update, so we need to provide it. The function will be exposed in an upcoming library bump. ok inoguchi on an earlier version, input/ok jsing
* Add DTLSv1.2 methods.jsing2021-02-201-1/+7
| | | | | | These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
* Add various public DTLS related defines.jsing2021-02-201-1/+9
| | | | | | These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
* Prepare to provide SSL_set_hostflags()tb2021-01-261-1/+2
| | | | | | | | Yet another one of these X509_VERIFY_PARAM reacharounds into libcrypto. Recently found in imapfilter, also used elsewhere. Will be made publicly visible with the next minor bump. ok jsing
* Provide SSL_is_dtls().jsing2020-10-141-1/+4
| | | | | | | For now this is #ifdef LIBRESSL_INTERNAL and will be exposed during the next library bump. ok tb@
* Add guards around SSL_get0_peername that were accidentally omitted.tb2020-09-201-1/+3
|
* Prepare to provide SSL_get0_peernametb2020-09-191-1/+2
| | | | | | | | | This is a convenience reacharound to libcrypto that trivially wraps X509_VERIFY_PARAM_get0_peername(). It is used by unbound 1.11.0 for better logging. As it's part of the API that landed with OpenSSL's DANE, more recent postfix snapshots use it as well. ok beck inoguchi jsing
* Prepare to provide stubbed out versions for reading/writing 0-RTT datatb2020-09-191-1/+12
| | | | | | | | | | | We do not support this feature but need to provide OpenSSL's API since software assumes it's available whenever TLS1_3_VERSION is available. These are minimal stubs that should have a decent chance to interact reasonably with software expecting the tricky upstream semantics, but this will have to be sorted out with runtime testing, so will likely have to be refined and revisited. ok beck jsing
* Prepare to provide SSL{,_CTX}_{get,set}_max_early_datatb2020-09-191-1/+10
| | | | | | | Similar to the SSL_SESSION versions, these are noops that are expected to be available by some configure tests. ok beck jsing
* Prepare to provide SSL_SESSION_{set,get}_max_early_data()tb2020-09-191-1/+5
| | | | | | | Since we do not support 0-RTT, these are noops. Some software expects this API to be available if TLS1_3_VERSION is defined. ok beck jsing
* Prepare to provide SSL_get_peer_tmp_key().jsing2020-09-171-1/+11
| | | | | | | | OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@
* Implement SSL_{CTX_,}set_ciphersuites().jsing2020-09-131-1/+7
| | | | | | | | | | OpenSSL added a separate API for configuring TLSv1.3 ciphersuites. Provide this API, while retaining the current behaviour of being able to configure TLSv1.3 via the existing interface. Note that this is not currently exposed in the headers/exported symbols. ok beck@ inoguchi@ tb@
* Consistently spell 'unsigned' as 'unsigned int', as style(9) seemstb2020-03-161-3/+3
| | | | | | | | | to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
* Move guards from public to internal headers, and fix not use values.beck2020-01-221-7/+1
| | | | | | reverts previous attempt which would have broken ports ok jsing@
* Split the TLSv1.3 guards into separate client and server guards.jsing2020-01-221-1/+7
| | | | ok beck@ tb@
* Provide SSL_R_UNKNOWN.jsing2020-01-211-1/+2
| | | | | | | This allows us to indicate that the cause of the failure is unknown, rather than implying that it was an internal error when it was not. ok beck@
* Revise SSL_CTX_get_extra_chain_certs() to match OpenSSL behaviour.jsing2020-01-021-6/+8
| | | | | | | | | | | | | | In OpenSSL, SSL_CTX_get_extra_chain_certs() really means return extra certs, unless there are none, in which case return the chain associated with the certificate. If you really just want the extra certs, including knowing if there are no extra certs, then you need to call SSL_CTX_get_extra_chain_certs_only()! And to make this even more entertaining, these functions are not documented in any OpenSSL release. Reported by sephiroth-j on github, since the difference in behaviour apparently breaks OCSP stapling with nginx. ok beck@ inoguchi@ tb@
* Provide SSL chain/cert chain APIs.jsing2019-04-041-1/+36
| | | | | | | | | | | These allow for chains to be managed on a per-certificate basis rather than as a single "extra certificates" list. Note that "chain" in this context does not actually include the leaf certificate however, unlike SSL_CTX_use_certificate_chain_{file,mem}(). Thanks to sthen@ for running this through a bulk ports build. ok beck@ tb@
* Provide version agnostic DTLS methods.jsing2019-03-171-1/+5
| | | | ok tb@
* Add a re-implementation of SSL_get1_supported_ciphers().tb2019-01-221-1/+2
| | | | | | | Part of OpenSSL 1.1 API (pre-licence-change). input schwarze ok jsing
* Provide SSL_get_client_ciphers().tb2019-01-221-1/+2
| | | | | | Part of OpenSSL 1.1 API, pre-licence change. ok jsing
* Add SSL_set1_host(), a thin wrapper around X509_VERIFY_PARAM_set1_host().tb2018-11-111-1/+2
| | | | | | | Used by unbound's DNS over TLS implementation to do server name verification. ok jsing
* Add TLSv1.3 cipher suites (with appropriate guards).jsing2018-11-071-1/+4
| | | | ok beck@ tb@
* Add TLS1_3_VERSION and SSL_OP_NO_TLSv1_3 defines under guards.jsing2018-11-061-1/+6
| | | | ok beck@ bluhm@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-03 01:30:13 +0000