summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Expose various DTLSv1.2 specific functions and definestb2021-03-311-9/+1
| | | | ok bcook inoguchi jsing
* Expose SSL_set_hostflags(3) and SSL_get0_peername(3)tb2021-03-311-3/+1
| | | | ok bcook inoguchi jsing
* Expose SSL_use_certificate_chain_file(3)tb2021-03-311-3/+1
| | | | ok bcook inoguchi jsing
* Prepare to provide SSL_use_certificate_chain_file()tb2021-03-191-1/+4
| | | | | | | | | This is the same as SSL_CTX_use_certificate_chain_file() but for an SSL object instead of an SSL_CTX object. remi found this in a recent librelp update, so we need to provide it. The function will be exposed in an upcoming library bump. ok inoguchi on an earlier version, input/ok jsing
* Add DTLSv1.2 methods.jsing2021-02-201-1/+7
| | | | | | These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
* Add various public DTLS related defines.jsing2021-02-201-1/+9
| | | | | | These are currently guarded by LIBRESSL_HAS_DTLS1_2 and LIBRESSL_INTERNAL. ok tb@
* Prepare to provide SSL_set_hostflags()tb2021-01-261-1/+2
| | | | | | | | Yet another one of these X509_VERIFY_PARAM reacharounds into libcrypto. Recently found in imapfilter, also used elsewhere. Will be made publicly visible with the next minor bump. ok jsing
* Provide SSL_is_dtls().jsing2020-10-141-1/+4
| | | | | | | For now this is #ifdef LIBRESSL_INTERNAL and will be exposed during the next library bump. ok tb@
* Add guards around SSL_get0_peername that were accidentally omitted.tb2020-09-201-1/+3
|
* Prepare to provide SSL_get0_peernametb2020-09-191-1/+2
| | | | | | | | | This is a convenience reacharound to libcrypto that trivially wraps X509_VERIFY_PARAM_get0_peername(). It is used by unbound 1.11.0 for better logging. As it's part of the API that landed with OpenSSL's DANE, more recent postfix snapshots use it as well. ok beck inoguchi jsing
* Prepare to provide stubbed out versions for reading/writing 0-RTT datatb2020-09-191-1/+12
| | | | | | | | | | | We do not support this feature but need to provide OpenSSL's API since software assumes it's available whenever TLS1_3_VERSION is available. These are minimal stubs that should have a decent chance to interact reasonably with software expecting the tricky upstream semantics, but this will have to be sorted out with runtime testing, so will likely have to be refined and revisited. ok beck jsing
* Prepare to provide SSL{,_CTX}_{get,set}_max_early_datatb2020-09-191-1/+10
| | | | | | | Similar to the SSL_SESSION versions, these are noops that are expected to be available by some configure tests. ok beck jsing
* Prepare to provide SSL_SESSION_{set,get}_max_early_data()tb2020-09-191-1/+5
| | | | | | | Since we do not support 0-RTT, these are noops. Some software expects this API to be available if TLS1_3_VERSION is defined. ok beck jsing
* Prepare to provide SSL_get_peer_tmp_key().jsing2020-09-171-1/+11
| | | | | | | | OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@
* Implement SSL_{CTX_,}set_ciphersuites().jsing2020-09-131-1/+7
| | | | | | | | | | OpenSSL added a separate API for configuring TLSv1.3 ciphersuites. Provide this API, while retaining the current behaviour of being able to configure TLSv1.3 via the existing interface. Note that this is not currently exposed in the headers/exported symbols. ok beck@ inoguchi@ tb@
* Consistently spell 'unsigned' as 'unsigned int', as style(9) seemstb2020-03-161-3/+3
| | | | | | | | | to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
* Move guards from public to internal headers, and fix not use values.beck2020-01-221-7/+1
| | | | | | reverts previous attempt which would have broken ports ok jsing@
* Split the TLSv1.3 guards into separate client and server guards.jsing2020-01-221-1/+7
| | | | ok beck@ tb@
* Provide SSL_R_UNKNOWN.jsing2020-01-211-1/+2
| | | | | | | This allows us to indicate that the cause of the failure is unknown, rather than implying that it was an internal error when it was not. ok beck@
* Revise SSL_CTX_get_extra_chain_certs() to match OpenSSL behaviour.jsing2020-01-021-6/+8
| | | | | | | | | | | | | | In OpenSSL, SSL_CTX_get_extra_chain_certs() really means return extra certs, unless there are none, in which case return the chain associated with the certificate. If you really just want the extra certs, including knowing if there are no extra certs, then you need to call SSL_CTX_get_extra_chain_certs_only()! And to make this even more entertaining, these functions are not documented in any OpenSSL release. Reported by sephiroth-j on github, since the difference in behaviour apparently breaks OCSP stapling with nginx. ok beck@ inoguchi@ tb@
* Provide SSL chain/cert chain APIs.jsing2019-04-041-1/+36
| | | | | | | | | | | These allow for chains to be managed on a per-certificate basis rather than as a single "extra certificates" list. Note that "chain" in this context does not actually include the leaf certificate however, unlike SSL_CTX_use_certificate_chain_{file,mem}(). Thanks to sthen@ for running this through a bulk ports build. ok beck@ tb@
* Provide version agnostic DTLS methods.jsing2019-03-171-1/+5
| | | | ok tb@
* Add a re-implementation of SSL_get1_supported_ciphers().tb2019-01-221-1/+2
| | | | | | | Part of OpenSSL 1.1 API (pre-licence-change). input schwarze ok jsing
* Provide SSL_get_client_ciphers().tb2019-01-221-1/+2
| | | | | | Part of OpenSSL 1.1 API, pre-licence change. ok jsing
* Add SSL_set1_host(), a thin wrapper around X509_VERIFY_PARAM_set1_host().tb2018-11-111-1/+2
| | | | | | | Used by unbound's DNS over TLS implementation to do server name verification. ok jsing
* Add TLSv1.3 cipher suites (with appropriate guards).jsing2018-11-071-1/+4
| | | | ok beck@ tb@
* Add TLS1_3_VERSION and SSL_OP_NO_TLSv1_3 defines under guards.jsing2018-11-061-1/+6
| | | | ok beck@ bluhm@ tb@
* Let SSL_copy_session_id() return an int for error checking.tb2018-08-241-2/+2
| | | | | | | | | | Accordingly, add some error checking to SSL_copy_session_id(), BIO_ssl_copy_session_id(), and SSL_dup(). Prompted by OpenSSL commit 17dd65e6e1f Tested in a bulk build by sthen ok jsing
* const for BIO_f_ssl(), the last const difference to OpenSSL in ourtb2018-05-011-2/+2
| | | | | | public API in libssl. ok beck, jsing
* Fix capitalization of data. Pointed out by jsing and forgotten intb2018-04-251-2/+2
| | | | previous commit.
* OpenSSL started adding const to functions all over the place. Make alltb2018-04-251-9/+9
| | | | | | | | our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing
* Nuke SSL_OP_TLS_ROLLBACK_BUG - this is a workaround for buggy clients fromjsing2018-04-111-6/+2
| | | | | | | around the SSLv3/TLSv1.0 period... and buggy clients are buggy. This also helps to clean up the RSA key exchange code. ok "kill it with fire" beck@ tb@
* Provide SSL_SESSION_set1_id()tb2018-03-201-1/+4
| | | | ok jsing
* Bring in compatibility for OpenSSL 1.1 style init functions.beck2018-03-171-1/+14
| | | | | | | | | This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
* Provide SSL_SESSION_get_ticket_lifetime_hint() andtb2018-03-171-1/+3
| | | | | | SSL_SESSION_has_ticket() ok jsing
* Provide SSL_CTX_get_default_passwd_cb{,_userdata}()tb2018-03-171-1/+3
| | | | ok jsing
* SSL_SESSION_get_protocol_version() takes a const SSL_SESSION *.tb2018-03-171-2/+2
| | | | | | Noted by schwarze@ ok jsing@
* Provide SSL_CIPHER_get_auth_nid(), SSL_CIPHER_get_cipher_nid(),jsing2018-03-171-1/+6
| | | | | SSL_CIPHER_get_digest_nid(), SSL_CIPHER_get_kx_nid() and SSL_CIPHER_is_aead().
* Provide SSL_SESSION_get0_id_context().jsing2018-03-171-3/+5
|
* Provide SSL_CTX_get_min_proto_version and SSL_CTX_get_max_proto_versionjca2018-03-151-1/+11
| | | | | | | | | We already provided the setters, so also provide the getters like OpenSSL does. Addition prompted by the use of those functions in recent openvpn releases. manpage diff from schwarze@ (thanks!) with input from jsing@, ok tb@ jsing@
* Provide macro versions of SSL_CTX_set_min/max_proto_version and friendsjca2018-03-031-1/+16
| | | | | Needed at least by openvpn-2.4.5, which detects availability of this interface using #ifdefs... Discussed with & ok jsing@
* Provide SSL_is_server().jsing2018-02-221-1/+2
|
* Provide SSL_up_ref().jsing2018-02-221-2/+3
|
* Provide SSL_CTX_get_ciphers().jsing2018-02-221-1/+2
|
* Provide SSL_SESSION_up_ref().jsing2018-02-221-2/+3
|
* Provide SSL_SESSION_get_protocol_version()tb2018-02-201-1/+2
| | | | ok jsing
* Provide SSL_SESSION_get_master_key()jsing2018-02-171-1/+3
|
* Provide SSL_get_client_random() and SSL_get_server_random()jsing2018-02-171-1/+4
|
* Provide SSL_CTX_get0_certificate()jsing2018-02-171-1/+2
|
* Provide SSL_CTX_get_tlsext_status_cb() and SSL_CTX_get_tlsext_status_arg().jsing2018-02-171-1/+3
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 22:17:41 +0000