summaryrefslogtreecommitdiff
path: root/lib/libssl/ssl.h
AgeCommit message (Collapse)Author
2018-08-24Let SSL_copy_session_id() return an int for error checking.Theo Buehler
Accordingly, add some error checking to SSL_copy_session_id(), BIO_ssl_copy_session_id(), and SSL_dup(). Prompted by OpenSSL commit 17dd65e6e1f Tested in a bulk build by sthen ok jsing
2018-05-01const for BIO_f_ssl(), the last const difference to OpenSSL in ourTheo Buehler
public API in libssl. ok beck, jsing
2018-04-25Fix capitalization of data. Pointed out by jsing and forgotten inTheo Buehler
previous commit.
2018-04-25OpenSSL started adding const to functions all over the place. Make allTheo Buehler
our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing
2018-04-11Nuke SSL_OP_TLS_ROLLBACK_BUG - this is a workaround for buggy clients fromJoel Sing
around the SSLv3/TLSv1.0 period... and buggy clients are buggy. This also helps to clean up the RSA key exchange code. ok "kill it with fire" beck@ tb@
2018-03-20Provide SSL_SESSION_set1_id()Theo Buehler
ok jsing
2018-03-17Bring in compatibility for OpenSSL 1.1 style init functions.Bob Beck
This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
2018-03-17Provide SSL_SESSION_get_ticket_lifetime_hint() andTheo Buehler
SSL_SESSION_has_ticket() ok jsing
2018-03-17Provide SSL_CTX_get_default_passwd_cb{,_userdata}()Theo Buehler
ok jsing
2018-03-17SSL_SESSION_get_protocol_version() takes a const SSL_SESSION *.Theo Buehler
Noted by schwarze@ ok jsing@
2018-03-17Provide SSL_CIPHER_get_auth_nid(), SSL_CIPHER_get_cipher_nid(),Joel Sing
SSL_CIPHER_get_digest_nid(), SSL_CIPHER_get_kx_nid() and SSL_CIPHER_is_aead().
2018-03-17Provide SSL_SESSION_get0_id_context().Joel Sing
2018-03-15Provide SSL_CTX_get_min_proto_version and SSL_CTX_get_max_proto_versionJeremie Courreges-Anglas
We already provided the setters, so also provide the getters like OpenSSL does. Addition prompted by the use of those functions in recent openvpn releases. manpage diff from schwarze@ (thanks!) with input from jsing@, ok tb@ jsing@
2018-03-03Provide macro versions of SSL_CTX_set_min/max_proto_version and friendsJeremie Courreges-Anglas
Needed at least by openvpn-2.4.5, which detects availability of this interface using #ifdefs... Discussed with & ok jsing@
2018-02-22Provide SSL_is_server().Joel Sing
2018-02-22Provide SSL_up_ref().Joel Sing
2018-02-22Provide SSL_CTX_get_ciphers().Joel Sing
2018-02-22Provide SSL_SESSION_up_ref().Joel Sing
2018-02-20Provide SSL_SESSION_get_protocol_version()Theo Buehler
ok jsing
2018-02-17Provide SSL_SESSION_get_master_key()Joel Sing
2018-02-17Provide SSL_get_client_random() and SSL_get_server_random()Joel Sing
2018-02-17Provide SSL_CTX_get0_certificate()Joel Sing
2018-02-17Provide SSL_CTX_get_tlsext_status_cb() and SSL_CTX_get_tlsext_status_arg().Joel Sing
2018-02-14Provide SSL_CTX_up_ref().Joel Sing
2018-02-14Provide SSL_CTX_get0_param() and SSL_get0_param().Joel Sing
Some applications that use X509_VERIFY_PARAM expect these to exist, since they're also part of the OpenSSL 1.0.2 API.
2017-08-30Bring back the NPN related symbols.Joel Sing
Several pieces of software make use of these based on a conditional around OPENSSL_NPN_NEGOTIATED, rather than using the presence of the symbols, the non-existence of a OPENSSL_NO_NEXTPROTONEG define or even the existence of the TLS extension type. Unfortunately we cannot remove OPENSSL_NPN_NEGOTIATED since the API for ALPN was effectively botched and reuses two parts from the NPN implementation, rather than providing ALPN specific or generic versions.
2017-08-28Completely remove NPN remnants.Joel Sing
Based on a diff from doug@, similar diff from inoguchi@
2017-08-13Remove support for the TLS padding extension.Joel Sing
This was added as a workaround for broken F5 TLS termination, which then created issues talking to broken IronPorts. The size of the padding is hardcoded so it cannot be used in any generic sense. ok bcook@ beck@ doug@
2017-08-13Nuke SSL_OP_CRYPTOPRO_TLSEXT_BUG.Joel Sing
This was a workaround for a server that needed to talk GOST to old/broken CryptoPro clients. This has no impact on TLS clients that are using GOST. ok bcook@ beck@ doug@
2017-08-10Clean up the EC key/curve configuration handling.Joel Sing
Over the years OpenSSL grew multiple ways of being able to specify EC keys (and/or curves) for use with ECDH and ECDHE key exchange. You could specify a static EC key (SSL{_CTX,}_set_tmp_ecdh()), use that as a curve and generate ephemeral keys (SSL_OP_SINGLE_ECDH_USE), provide the EC key via a callback that was provided with insufficient information (SSL{_CTX,}_set_tmp_ecdh_cb()) or enable automatic selection and generation of EC keys via SSL{_CTX,}_set_ecdh_auto(). This complexity leads to problems (like ECDHE not being enabled) and potential weird configuration (like being able to do ECDHE without the ephemeral part...). We no longer support ECDH and ECDHE can be disabled by removing ECDHE ciphers from the cipher list. As such, permanently enable automatic EC curve selection and generation, effectively disabling all of the configuration knobs. The only exception is the SSL{_CTX,}_set_tmp_ecdh() functions, which retain part of their previous behaviour by configuring the curve of the given EC key as the only curve being enabled. Everything else becomes a no-op. ok beck@ doug@
2017-05-07Move state from ssl->internal to the handshake structure.Bob Beck
while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
2017-05-06Provide SSL{,_CTX}_set_{min,max}_proto_version() functions.Joel Sing
Rides minor bump. ok beck@
2017-02-05Define values for SSL_CTRL_SET_GROUPS{,_LIST} and wire them up to theJoel Sing
SSL_{,CTX_}ctrl() functions. As crazy as it is, some software appears to call the control functions directly rather than using the macros (or functions) provided by the library. Discussed with beck@ and sthen@
2017-01-31Provide an SSL_OP_NO_CLIENT_RENEGOTIATION option that disallowsJoel Sing
client-initiated renegotiation. The current default behaviour remains unchanged. ok beck@ reyk@
2017-01-26Limit the number of sequential empty records that we will processBob Beck
before yielding, and fail if we exceed a maximum. loosely based on what boring and openssl are doing ok jsing@
2017-01-26Remove a sess_cert reference from a comment in the public header.Joel Sing
Noted by zhuk@
2017-01-25Provide defines for SSL_CTRL_SET_CURVES/SSL_CTRL_SET_CURVES_LIST for thingsJoel Sing
that are conditioning on these. From BoringSSL. ok beck@
2017-01-24Add support for setting the supported EC curves viaJoel Sing
SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous SSL{_CTX}_set1_curves{_list} names. This also changes the default list of EC curves to be X25519, P-256 and P-384. If you want others (such a brainpool) you need to configure this yourself. Inspired by parts of BoringSSL and OpenSSL. ok beck@
2017-01-24unifdef OPENSSL_NO_BIO - we do not support this in any form.Joel Sing
ok beck@
2017-01-23move default_passwd_cb and default_passwd_cb_userdata back intoBob Beck
the ssl_ctx from internal - these are used directly by python and openvpn and a few other things - we have the set accessors but the get accessors were added in 1.1 and these roll their own caveat OPENSSL_VERSION chickenpluckery
2017-01-23Move options and mode from SSL_CTX and SSL to internal, since these can beJoel Sing
set and cleared via existing functions.
2017-01-23Split most of SSL_METHOD out into an internal variant, which is opaque.Joel Sing
Discussed with beck@
2017-01-23Remove ssl_ctrl, ssl_ctx_ctrl, ssl_callback_ctrl and ssl_ctx_callback_ctrlJoel Sing
from SSL_METHOD, replacing usage with direct calls to the appropriate functions. ok beck@
2017-01-23send state and rstate from ssl_st into internal. There are accessorsBob Beck
so these should not be diddled with directly ok jsing@
2017-01-23move back read_hash and enc_read_ctx into ssl_st. wpa_supplicant andBob Beck
other perversions touches them sickly and unnaturally.
2017-01-23Move a large part of ssl_st into internal, so we can see what squeals.Bob Beck
ok jsing@
2017-01-23Move ex_data, next and prev from SSL_SESSION to internal.Joel Sing
ok beck@
2017-01-23Move most of the fields in SSL_CTX to internal - the ones that remain areJoel Sing
known to be in use. ok beck@
2017-01-23move the callbacks from ssl_st to internalBob Beck
ok jsing@
2017-01-23Move callback function pointers and argument pointers from SSL_CTX toJoel Sing
internal. ok beck@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 20:33:21 +0000