summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* spelling fixes; from paul tagliamontejmc2022-12-261-2/+2
| | | | ok tb
* Expose SSL_get_share_{group,curve}() and related #definestb2022-09-111-7/+3
| | | | ok jsing
* Expose some error codes needed for QUIC supporttb2022-09-111-3/+1
| | | | ok jsing
* Provide the remaining QUIC API.jsing2022-08-211-1/+43
| | | | | | | While more work is still required, this is sufficient to get ngtcp2 to compile with QUIC and for curl to be able to make HTTP/3 requests. ok tb@
* Provide SSL_QUIC_METHOD.jsing2022-08-211-6/+145
| | | | | | | | | | | | | | | | | | | This provides SSL_QUIC_METHOD (aka ssl_quic_method_st), which allows for QUIC callback hooks to be passed to an SSL_CTX or SSL. This is largely ported/adapted from BoringSSL. It is worth noting that this struct is not opaque and the original interface exposed by BoringSSL differs to the one they now use. The original interface was copied by quictls and it appears that this API will not be updated to match BoringSSL. To make things even more challenging, at least one consumer does not use named initialisers, making code completely dependent on the order in which the function pointers are defined as struct members. In order to try to support both variants, the set_read_secret/set_write_secret functions are included, however they have to go at the end. ok tb@
* Provide and use QUIC specific error reasons.jsing2022-08-211-1/+3
| | | | ok tb@
* Prepare to provide SSL_ERROR_WANT_{ASYNC,ASYNC_JOB,CLIENT_HELLO_CB}jsing2022-08-211-10/+15
| | | | | | | LibreSSL will not return these values, however software is starting to check for these as return values from SSL_get_error(). ok tb@
* Add SSL_get_shared_{curve,group}()tb2022-08-171-2/+10
| | | | | | | | These are wrappers of SSL_ctrl() using the SSL_CTRL_GET_SHARED_GROUP control. Do not provide SSL_CTRL_GET_SHARED_CURVE since that is only mentioned in Net::SSLeay docs according to codesearch.debian.net. ok jsing
* Provide QUIC encryption levels.jsing2022-07-241-1/+12
| | | | | | | | | | | | QUIC wants to know what "encryption level" handshake messages should be sent at. Provide an ssl_encryption_level_t enum (via BoringSSL) that defines these (of course quictls decided to make this an OSSL_ENCRYPTION_LEVEL typedef, so provide that as well). Wire these through to tls13_record_layer_set_{read,write}_traffic_key() so that they can be used in upcoming commits. ok tb@
* Provide SSL_is_quic()jsing2022-07-171-2/+4
| | | | | | | | This function will allow code to know if the SSL connection is configured for use with QUIC or not. Also move existing SSL_.*quic.* functions under LIBRESSL_HAS_QUIC to prevent exposing them prematurely. ok beck@ tb@
* Remove mkerr.pl remnants from LibreSSLkn2022-07-121-5/+1
| | | | | | | This script is not used at all and files are edited by hand instead. Thus remove misleading comments incl. the obsolete script/config. Feedback OK jsing tb
* Expose security level symbols and error codes in the headers.tb2022-07-071-3/+1
| | | | ok jsing
* Add support for sending QUIC transport parametersbeck2022-06-291-1/+25
| | | | | | | | | | This is the start of adding the boringssl API for QUIC support, and the TLS extensions necessary to send and receive QUIC transport data. Inspired by boringssl's https://boringssl-review.googlesource.com/24464 ok jsing@ tb@
* Add error code definstb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Add #defines and prototypes for security level APItb2022-06-281-1/+72
| | | | | | | This marks the start of one of the worst API additions in the history of this library. And as everybody knows the bar is high. Very high. ok beck jsing sthen
* Unifdef LIBRESSL_NEW_API. Now that the library is bumped, this istb2021-11-011-5/+1
| | | | | | no longer needed. ok jsing
* Add SSL_get0_verified_chain - needed by some new stuffbeck2021-10-231-1/+2
| | | | | | symbol will be exposed with tb@'s forthcoming bump ok tb@
* Add new OpenSSL API SSL_CTX_set_num_tickets and friends.beck2021-10-231-1/+5
| | | | | | | | | Since we don't support session tickets in LibreSSL at the moment these functions currently do not have any effect. Again, symbols will appear with tb@'s reptar sized bump.. ok tb@
* Add new OpenSSL api SSL_write_ex, SSL_read_ex and SSL_peek_exbeck2021-10-231-1/+6
| | | | | | | | | | As these still meet the usual expectations for special, I will leave it up to ingo to decide to either document separately or in one man page like OpenSSL did. Will also need Symbols.list additions by tb@ when he starts the rapture ok tb@ jsing@
* Add SSL_CTX_set_keylog_callback and SSL_CTX_get_keylog_callbackbeck2021-10-231-1/+6
| | | | | | | | Some things in ports care about calling these functions. Since we will not provide private key logging functionality they are documented as being for compatibility and that they don't do anything. ok tb@
* Move various structs from ssl.h/tls1.h to ssl_locl.h.jsing2021-10-151-130/+1
| | | | | | These were already under LIBRESSL_INTERNAL hence no ABI change. ok tb@
* Avoid typedef redefinitionlibressl-v3.4.0inoguchi2021-09-141-3/+1
| | | | | | | "typedef struct ssl_st SSL;" is defined in ossl_typ.h. This reverts part of r1.204. ok tb@
* Move SSL_set0_rbio() outside of LIBRESSL_HAS_TLS1_3tb2021-09-101-3/+1
| | | | ok inoguchi jsing
* Expose SSL_R_NO_APPLICATION_PROTOCOL in ssl.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE in ssl.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_CTX_get0_privatekey() in ssl.htb2021-09-101-3/+1
| | | | ok beck
* Make SSL opaquetb2021-09-101-2/+4
| | | | with/ok jsing
* Remove struct tls_session_ticket_ext_st and TLS_SESSION_TICKET_EXTtb2021-09-101-1/+3
| | | | | | from public visibility. with/ok jsing
* Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callbacktb2021-09-101-1/+4
| | | | | | | | | | | | | | | | | | | As reported by Jeremy Harris, we inherited a strange behavior from OpenSSL, in that we ignore the SSL_TLSEXT_ERR_FATAL return from the ALPN callback. RFC 7301, 3.2 states: 'In the event that the server supports no protocols that the client advertises, then the server SHALL respond with a fatal "no_application_protocol" alert.' Honor this requirement and succeed only on SSL_TLSEXT_ERR_{OK,NOACK} which is the current behavior of OpenSSL. The documentation change is taken from OpenSSL 1.1.1 as well. As pointed out by jsing, there is more to be fixed here: - ensure that the same protocol is selected on session resumption - should the callback be called even if no ALPN extension was sent? - ensure for TLSv1.2 and earlier that the SNI has already been processed ok beck jsing
* Prepare to provide SSL_CTX_get0_privatekey()tb2021-09-101-1/+4
| | | | ok beck
* Provide SSL_SESSION_is_resumable and SSL_set_psk_use_session_callback stubstb2021-09-081-1/+10
| | | | ok jsing
* Prepare to provide API stubs for PHAtb2021-09-081-1/+8
| | | | ok bcook jsing
* Prepare to provide SSL_get_tlsext_status_type()tb2021-09-081-1/+4
| | | | | | Needed for nginx-lua to build with opaque SSL. ok inoguchi jsing
* Prepare to provide SSL_set0_rbio()tb2021-09-081-1/+4
| | | | | | | This is needed for telephony/coturn and telephony/resiprocate to compile without opaque SSL. ok inoguchi jsing
* Prepare to provide SSL_get_signature_nid() and friends.jsing2021-06-301-1/+15
| | | | | | | | | | | This adds functionality for SSL_get_signature_nid(), SSL_get_peer_signature_nid(), SSL_get_signature_type_nid() and SSL_get_peer_signature_type_nid(). This is not currently publicly visible and will be exposed at a later date. ok inoguchi@ tb@
* Move some structs from public to private headers.jsing2021-06-301-108/+1
| | | | | | | | Move struct ssl_cipher_st, struct ssl_method_st, struct ssl_session_st and struct ssl3_state_st from public to private headers. These are already under #ifdef LIBRESSL_INTERNAL and are no longer publicly visible. ok inoguchi@ tb@
* Add SSL_AD_MISSING_EXTENSION.jsing2021-06-131-1/+2
| | | | | | | This is an alert that was added in TLSv1.3 - we already use it internally, but did not provide the SSL_AD_* define previously. ok tb@
* Define SSL_AD_* as actual values.jsing2021-06-131-34/+43
| | | | | | | | | Rather than having SSL_AD_* as defines that refer to SSL3_AD_* or TLS1_AD_*, just give them actual values directly since it is more readable and the indirection provides no value. Place SSL3_AD_* and TLS1_AD_* under #ifndef LIBRESSL_INTERNAL to prevent further usage. ok tb@
* Place obsolete alerts under #ifndef LIBRESSL_INTERNAL.jsing2021-06-131-4/+7
| | | | ok tb@
* Absorb SSL_AEAD_CTX into struct tls12_record_protection.jsing2021-05-161-1/+3
| | | | | | | | The information contained in SSL_AEAD_CTX really belongs in the tls12_record_protection struct. Absorb SSL_AEAD_CTX, using more appropriate types in the process. ok tb@
* Make SSL_CIPHER, SSL_CTX, SSL_SESSION, {DTLS1,SSL3}_STATEtb2021-05-101-3/+3
| | | | | | and a few other structs in libssl opaque. from/ok jsing
* Provide SSL_SESSION_get0_cipher(3)tb2021-05-101-1/+2
| | | | ok jsing
* Provide SSL_CTX_get_ssl_method(3)tb2021-05-101-1/+3
| | | | ok jsing
* Provide SSL_CIPHER_find(3)tb2021-05-101-1/+2
| | | | ok jsing
* Expose various DTLSv1.2 specific functions and definestb2021-03-311-9/+1
| | | | ok bcook inoguchi jsing
* Expose SSL_set_hostflags(3) and SSL_get0_peername(3)tb2021-03-311-3/+1
| | | | ok bcook inoguchi jsing
* Expose SSL_use_certificate_chain_file(3)tb2021-03-311-3/+1
| | | | ok bcook inoguchi jsing
* Prepare to provide SSL_use_certificate_chain_file()tb2021-03-191-1/+4
| | | | | | | | | This is the same as SSL_CTX_use_certificate_chain_file() but for an SSL object instead of an SSL_CTX object. remi found this in a recent librelp update, so we need to provide it. The function will be exposed in an upcoming library bump. ok inoguchi on an earlier version, input/ok jsing
* Add DTLSv1.2 methods.jsing2021-02-201-1/+7
| | | | | | These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
* Add various public DTLS related defines.jsing2021-02-201-1/+9
| | | | | | These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 22:55:56 +0000