summaryrefslogtreecommitdiff
path: root/lib/libssl/ssl.h
AgeCommit message (Collapse)Author
2020-03-16Consistently spell 'unsigned' as 'unsigned int', as style(9) seemsTheo Buehler
to prefer that. No binary change except in d1_srtp.c where the generated assembly differs only in line numbers (due to a wrapped long line) and in s3_cbc.c where there is no change in the generated assembly. ok inoguchi jsing
2020-01-22Move guards from public to internal headers, and fix not use values.Bob Beck
reverts previous attempt which would have broken ports ok jsing@
2020-01-22Split the TLSv1.3 guards into separate client and server guards.Joel Sing
ok beck@ tb@
2020-01-21Provide SSL_R_UNKNOWN.Joel Sing
This allows us to indicate that the cause of the failure is unknown, rather than implying that it was an internal error when it was not. ok beck@
2020-01-02Revise SSL_CTX_get_extra_chain_certs() to match OpenSSL behaviour.Joel Sing
In OpenSSL, SSL_CTX_get_extra_chain_certs() really means return extra certs, unless there are none, in which case return the chain associated with the certificate. If you really just want the extra certs, including knowing if there are no extra certs, then you need to call SSL_CTX_get_extra_chain_certs_only()! And to make this even more entertaining, these functions are not documented in any OpenSSL release. Reported by sephiroth-j on github, since the difference in behaviour apparently breaks OCSP stapling with nginx. ok beck@ inoguchi@ tb@
2019-04-04Provide SSL chain/cert chain APIs.Joel Sing
These allow for chains to be managed on a per-certificate basis rather than as a single "extra certificates" list. Note that "chain" in this context does not actually include the leaf certificate however, unlike SSL_CTX_use_certificate_chain_{file,mem}(). Thanks to sthen@ for running this through a bulk ports build. ok beck@ tb@
2019-03-17Provide version agnostic DTLS methods.Joel Sing
ok tb@
2019-01-22Add a re-implementation of SSL_get1_supported_ciphers().Theo Buehler
Part of OpenSSL 1.1 API (pre-licence-change). input schwarze ok jsing
2019-01-22Provide SSL_get_client_ciphers().Theo Buehler
Part of OpenSSL 1.1 API, pre-licence change. ok jsing
2018-11-11Add SSL_set1_host(), a thin wrapper around X509_VERIFY_PARAM_set1_host().Theo Buehler
Used by unbound's DNS over TLS implementation to do server name verification. ok jsing
2018-11-07Add TLSv1.3 cipher suites (with appropriate guards).Joel Sing
ok beck@ tb@
2018-11-06Add TLS1_3_VERSION and SSL_OP_NO_TLSv1_3 defines under guards.Joel Sing
ok beck@ bluhm@ tb@
2018-08-24Let SSL_copy_session_id() return an int for error checking.Theo Buehler
Accordingly, add some error checking to SSL_copy_session_id(), BIO_ssl_copy_session_id(), and SSL_dup(). Prompted by OpenSSL commit 17dd65e6e1f Tested in a bulk build by sthen ok jsing
2018-05-01const for BIO_f_ssl(), the last const difference to OpenSSL in ourTheo Buehler
public API in libssl. ok beck, jsing
2018-04-25Fix capitalization of data. Pointed out by jsing and forgotten inTheo Buehler
previous commit.
2018-04-25OpenSSL started adding const to functions all over the place. Make allTheo Buehler
our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing
2018-04-11Nuke SSL_OP_TLS_ROLLBACK_BUG - this is a workaround for buggy clients fromJoel Sing
around the SSLv3/TLSv1.0 period... and buggy clients are buggy. This also helps to clean up the RSA key exchange code. ok "kill it with fire" beck@ tb@
2018-03-20Provide SSL_SESSION_set1_id()Theo Buehler
ok jsing
2018-03-17Bring in compatibility for OpenSSL 1.1 style init functions.Bob Beck
This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
2018-03-17Provide SSL_SESSION_get_ticket_lifetime_hint() andTheo Buehler
SSL_SESSION_has_ticket() ok jsing
2018-03-17Provide SSL_CTX_get_default_passwd_cb{,_userdata}()Theo Buehler
ok jsing
2018-03-17SSL_SESSION_get_protocol_version() takes a const SSL_SESSION *.Theo Buehler
Noted by schwarze@ ok jsing@
2018-03-17Provide SSL_CIPHER_get_auth_nid(), SSL_CIPHER_get_cipher_nid(),Joel Sing
SSL_CIPHER_get_digest_nid(), SSL_CIPHER_get_kx_nid() and SSL_CIPHER_is_aead().
2018-03-17Provide SSL_SESSION_get0_id_context().Joel Sing
2018-03-15Provide SSL_CTX_get_min_proto_version and SSL_CTX_get_max_proto_versionJeremie Courreges-Anglas
We already provided the setters, so also provide the getters like OpenSSL does. Addition prompted by the use of those functions in recent openvpn releases. manpage diff from schwarze@ (thanks!) with input from jsing@, ok tb@ jsing@
2018-03-03Provide macro versions of SSL_CTX_set_min/max_proto_version and friendsJeremie Courreges-Anglas
Needed at least by openvpn-2.4.5, which detects availability of this interface using #ifdefs... Discussed with & ok jsing@
2018-02-22Provide SSL_is_server().Joel Sing
2018-02-22Provide SSL_up_ref().Joel Sing
2018-02-22Provide SSL_CTX_get_ciphers().Joel Sing
2018-02-22Provide SSL_SESSION_up_ref().Joel Sing
2018-02-20Provide SSL_SESSION_get_protocol_version()Theo Buehler
ok jsing
2018-02-17Provide SSL_SESSION_get_master_key()Joel Sing
2018-02-17Provide SSL_get_client_random() and SSL_get_server_random()Joel Sing
2018-02-17Provide SSL_CTX_get0_certificate()Joel Sing
2018-02-17Provide SSL_CTX_get_tlsext_status_cb() and SSL_CTX_get_tlsext_status_arg().Joel Sing
2018-02-14Provide SSL_CTX_up_ref().Joel Sing
2018-02-14Provide SSL_CTX_get0_param() and SSL_get0_param().Joel Sing
Some applications that use X509_VERIFY_PARAM expect these to exist, since they're also part of the OpenSSL 1.0.2 API.
2017-08-30Bring back the NPN related symbols.Joel Sing
Several pieces of software make use of these based on a conditional around OPENSSL_NPN_NEGOTIATED, rather than using the presence of the symbols, the non-existence of a OPENSSL_NO_NEXTPROTONEG define or even the existence of the TLS extension type. Unfortunately we cannot remove OPENSSL_NPN_NEGOTIATED since the API for ALPN was effectively botched and reuses two parts from the NPN implementation, rather than providing ALPN specific or generic versions.
2017-08-28Completely remove NPN remnants.Joel Sing
Based on a diff from doug@, similar diff from inoguchi@
2017-08-13Remove support for the TLS padding extension.Joel Sing
This was added as a workaround for broken F5 TLS termination, which then created issues talking to broken IronPorts. The size of the padding is hardcoded so it cannot be used in any generic sense. ok bcook@ beck@ doug@
2017-08-13Nuke SSL_OP_CRYPTOPRO_TLSEXT_BUG.Joel Sing
This was a workaround for a server that needed to talk GOST to old/broken CryptoPro clients. This has no impact on TLS clients that are using GOST. ok bcook@ beck@ doug@
2017-08-10Clean up the EC key/curve configuration handling.Joel Sing
Over the years OpenSSL grew multiple ways of being able to specify EC keys (and/or curves) for use with ECDH and ECDHE key exchange. You could specify a static EC key (SSL{_CTX,}_set_tmp_ecdh()), use that as a curve and generate ephemeral keys (SSL_OP_SINGLE_ECDH_USE), provide the EC key via a callback that was provided with insufficient information (SSL{_CTX,}_set_tmp_ecdh_cb()) or enable automatic selection and generation of EC keys via SSL{_CTX,}_set_ecdh_auto(). This complexity leads to problems (like ECDHE not being enabled) and potential weird configuration (like being able to do ECDHE without the ephemeral part...). We no longer support ECDH and ECDHE can be disabled by removing ECDHE ciphers from the cipher list. As such, permanently enable automatic EC curve selection and generation, effectively disabling all of the configuration knobs. The only exception is the SSL{_CTX,}_set_tmp_ecdh() functions, which retain part of their previous behaviour by configuring the curve of the given EC key as the only curve being enabled. Everything else becomes a no-op. ok beck@ doug@
2017-05-07Move state from ssl->internal to the handshake structure.Bob Beck
while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
2017-05-06Provide SSL{,_CTX}_set_{min,max}_proto_version() functions.Joel Sing
Rides minor bump. ok beck@
2017-02-05Define values for SSL_CTRL_SET_GROUPS{,_LIST} and wire them up to theJoel Sing
SSL_{,CTX_}ctrl() functions. As crazy as it is, some software appears to call the control functions directly rather than using the macros (or functions) provided by the library. Discussed with beck@ and sthen@
2017-01-31Provide an SSL_OP_NO_CLIENT_RENEGOTIATION option that disallowsJoel Sing
client-initiated renegotiation. The current default behaviour remains unchanged. ok beck@ reyk@
2017-01-26Limit the number of sequential empty records that we will processBob Beck
before yielding, and fail if we exceed a maximum. loosely based on what boring and openssl are doing ok jsing@
2017-01-26Remove a sess_cert reference from a comment in the public header.Joel Sing
Noted by zhuk@
2017-01-25Provide defines for SSL_CTRL_SET_CURVES/SSL_CTRL_SET_CURVES_LIST for thingsJoel Sing
that are conditioning on these. From BoringSSL. ok beck@
2017-01-24Add support for setting the supported EC curves viaJoel Sing
SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous SSL{_CTX}_set1_curves{_list} names. This also changes the default list of EC curves to be X25519, P-256 and P-384. If you want others (such a brainpool) you need to configure this yourself. Inspired by parts of BoringSSL and OpenSSL. ok beck@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-30 22:53:35 +0000