summaryrefslogtreecommitdiff
path: root/src/lib/libtls/tls_config.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add tls_config_[add|set]keypair_ocsp functions so that ocsp staples may bebeck2017-01-311-14/+99
| | | | | | | | added associated to a keypair used for SNI, and are usable for more than just the "main" certificate. Modify httpd to use this. Bump libtls minor. ok jsing@
* Move the ocsp staple to being part of the keypair structure internally,beck2017-01-291-5/+21
| | | | | | | so that it does not send back bogus staples when SNI is in use. (Further change is required to be able to use staples on all keypairs and not just the main one) ok jsing@
* Introduce ticket support. To enable them it is enough to set a positiveclaudio2017-01-241-1/+101
| | | | | | | | | | | | | | | | | | | | lifetime with tls_config_set_session_lifetime(). This enables tickets and uses an internal automatic rekeying mode for the ticket keys. If multiple processes are involved the following functions can be used to make tickets work accross all instances: - tls_config_set_session_id() sets the session identifier - tls_config_add_ticket_key() adds an encryption and authentication key For now only the last 4 keys added will be used (unless they are too old). If tls_config_add_ticket_key() is used the caller must ensure to add new keys regularly. It is best to do this 4 times per session lifetime (which is also the ticket key lifetime). Since tickets break PFS it is best to minimize the session lifetime according to needs. With a lot of help, input and OK beck@, jsing@
* Change the return value of tls_config_set_protocols() andjsing2016-11-111-5/+11
| | | | | | | | | | tls_config_set_verify_depth() from void to int. This makes them consistent with all other tls_config_set_* functions and will allow for call time validation to be implemented. Rides libtls major bump. ok beck@
* Add support for server side OCSP stapling to libtls.beck2016-11-051-1/+15
| | | | Add support for server side OCSP stapling to netcat.
* Make the tls_keypair_new() function a valid prototype.jsing2016-11-041-2/+2
|
* Avoid another signed vs unsigned comparison.jsing2016-11-041-2/+6
| | | | ok miod@
* Add ocsp_require_stapling config option for tls - allows a connectionbeck2016-11-041-1/+7
| | | | | | to indicate that it requires the peer to provide a stapled OCSP response with the handshake. Provide a "-T muststaple" for nc that uses it. ok jsing@, guenther@
* Provide an API that enables server side SNI support - add the ability tojsing2016-08-221-1/+57
| | | | | | | | provide additional keypairs (via tls_config_add_keypair_{file,mem}()) and allow the server to determine what servername the client requested (via tls_conn_servername()). ok beck@
* Avoid leaking memory if tls_config_set_alpn() is called multiple timesjsing2016-08-131-4/+5
| | | | (this was in the original commit, but got reverted in the recommit).
* Load CA, certificate and key files into memory when the appropriatejsing2016-08-131-13/+68
| | | | | | | | | | tls_config_set_*_file() function is called. This allows us to immediately propagate useful error messages, play more nicely with privsep/pledge and have a single code path. Instead of always loading the default CA when tls_config_new() is called, defer and only load the default CA when tls_configure() is invoked, if a CA has not already been specified. ok beck@ bluhm@
* Add ALPN support to libtls.jsing2016-08-121-1/+68
| | | | ok beck@ doug@
* Revert previous since it adds new symbols.jsing2016-08-021-69/+1
| | | | Requested by deraadt@
* Add ALPN support to libtls.jsing2016-08-011-1/+69
| | | | ok beck@ doug@
* Split the existing TLS cipher suite groups into four:jsing2016-07-131-3/+7
| | | | | | | | | | | | "secure" (TLSv1.2+AEAD+PFS) "compat" (HIGH:!aNULL) "legacy" (HIGH:MEDIUM:!aNULL) "insecure" (ALL:!aNULL:!eNULL) This allows for flexibility and finer grained control, rather than having two extremes (an issue raised by Marko Kreen some time ago). ok beck@ tedu@
* Revert previous - it introduces problems with a common privsep use case.jsing2016-07-071-68/+11
|
* Check that the given ciphers string is syntactically valid and results injsing2016-07-061-1/+17
| | | | | | at least one matching cipher suite. ok doug@
* Always load CA, key and certificate files at the time the configurationjsing2016-07-061-11/+68
| | | | | | | | | | function is called. This simplifies code and results in a single memory based code path being used to provide data to libssl. Errors that occur when accessing the specified file are now detected and propagated immediately. Since the file access now occurs when the configuration function is called, we now play nicely with privsep/pledge. ok beck@ bluhm@ doug@
* Rename some of the internal error setting functions to more closely followjsing2016-05-271-3/+3
| | | | | | existing naming standards. Also provide functions for setting a struct tls_error * directly (rather than having to have a struct tls * or a struct tls_config *).
* Avoid leaking ca_mem when freeing a tls_config.jsing2016-05-271-1/+2
|
* Factor our the keypair handling in libtls. This results in more readablejsing2016-04-281-14/+100
| | | | | | | | | and self-contained code, while preparing for the ability to handle multiple keypairs. Also provide two additional functions that allow a public certificate and private key to be set with a single function call. ok beck@
* Rework the error handling in libtls so that we can associate errors withjsing2016-04-281-3/+15
| | | | | | | | | | | both configuration and contexts. This allows us to propagate errors that occur during configuration, rather than either just failing with no reason or delaying the failure until it can be propagated via the tls context. Also provide a tls_config_error() function for retrieving the last error from a tls_config *. ok bcook@
* clean some ugly intendation wartsderaadt2015-09-291-2/+2
|
* Provide tls_config_insecure_noverifytime() in order to be able to disablejsing2015-09-141-1/+8
| | | | | | certificate validity checking. ok beck@
* Add support for preferring the server's cipher list or the client's cipherjsing2015-09-101-1/+15
| | | | | | | | list. Prefer the server's cipher list by default. Based on a diff from Kyle Thompson <jmp at giga dot moe>. ok beck@ bcook@
* Indent labels with a space so that diff -p is more friendly.jsing2015-09-091-2/+2
| | | | Requested by bluhm@
* Add client certificate support. Still needs a few tweaks but this willbeck2015-09-091-1/+13
| | | | | ride upcoming minor bump ok jsing@
* Rename tls_config_insecure_noverifyhost() tojsing2015-02-221-6/+5
| | | | | | | tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
* Check return values when setting dheparams and ecdhecurve for the defaultjsing2015-02-221-11/+14
| | | | configuration.
* In the interests of being secure by default, make the default TLS ciphersjsing2015-02-221-1/+13
| | | | | | | be those that are TLSv1.2 with AEAD and PFS. Provide a "compat" mode that allows the previous default ciphers to be selected. Discussed with tedu@ during s2k15.
* Add a tls_config_parse_protocols() function that allows a protocols stringjsing2015-02-121-1/+60
| | | | | | | | | to be converted into a libtls protocols value. This allows for things like: "tlsv1.0,tlsv1.1" (TLSv1.0 and TLSv1.1) "all,!tlsv1.0" (all protocols except TLSv1.0) Discussed with tedu@ and reyk@
* Fix handling of "legacy" mode for tls_config_set_dheparams().jsing2015-02-121-2/+2
| | | | Found by reyk@
* Be consistent with naming - only use "host" and "hostname" when referringjsing2015-02-111-3/+4
| | | | | | | | | | to an actual host and use "servername" when referring to the name of the TLS server that we expect to be indentified in the server certificate. Likewise, rename verify_host to verify_name and use the term "name" throughout the verification code (rather than host or hostname). Requested by and ok tedu@
* Add tls_config_set_dheparams() to allow specification of the parameters tojsing2015-02-071-5/+25
| | | | | | | | | use for DHE. This enables the use of DHE cipher suites. Rename tls_config_set_ecdhcurve() to tls_config_set_ecdhecurve() since it is only used to specify the curve for ephemeral ECDH. Discussed with reyk@
* Allow to to load the CA chain directly from memory instead ofreyk2015-01-221-1/+8
| | | | | | | | specifying a file. This enables CA verification in privsep'ed processes that are running chroot'ed without direct access to the certificate files. With feedback, tests, and OK from bluhm@
* Rename libressl to libtls to avoid confusion and to make it easier tojsing2014-10-311-0/+201
distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-20 03:49:34 +0000