summaryrefslogtreecommitdiff
path: root/lib/libssl/ssl_locl.h
AgeCommit message (Collapse)Author
2017-05-07Move state from ssl->internal to the handshake structure.Bob Beck
while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@
2017-05-06Bring in an SSL_HANDSHAKE structure and commence the great shovellingBob Beck
ok jsing@, gcc@, regress@
2017-05-06Provide SSL{,_CTX}_set_{min,max}_proto_version() functions.Joel Sing
Rides minor bump. ok beck@
2017-03-10Remove the handshake digests and related code, replacing remaining usesJoel Sing
with the handshake hash. For now tls1_digest_cached_records() is retained to release the handshake buffer. ok beck@ inoguchi@
2017-03-05Provide a rolling handshake hash that commences as soon as the cipherJoel Sing
suite has been selected, and convert the final finish MAC to use this handshake hash. This is a first step towards cleaning up the current handshake buffer/digest code. ok beck@ inoguchi@
2017-03-04Drop the second argument of dtls1_set_message_header() and make it a voidJoel Sing
function. Nothing makes use of the return value and the second argument was only used to produce the return value...
2017-02-28Stop pretending that MD5 and SHA1 might not exist - rather than locatingJoel Sing
"ssl3-md5" and "ssl-sha1", call the EVP_md5() and EVP_sha1() functions directly. ok beck@ inoguchi@
2017-02-21Remove STREEBOG 512 as a TLS MAC since there are currently no cipher suitesJoel Sing
that make use of it. ok bcook@ inoguchi@
2017-02-07Change SSLerror() back to taking two args, with the first one being an SSL *.Bob Beck
Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible
2017-01-26Send the error function codes to rot in the depths of hell where they belongBob Beck
We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
2017-01-26Limit the number of sequential empty records that we will processBob Beck
before yielding, and fail if we exceed a maximum. loosely based on what boring and openssl are doing ok jsing@
2017-01-26Remove most of SSL3_ENC_METHOD - we can just inline the function callsJoel Sing
and defines since they are the same everywhere. ok beck@
2017-01-26Merge the client/server version negotiation into the existing (currentlyJoel Sing
fixed version) client/server code. ok beck@
2017-01-26Remove ssl3_undef_enc_method - if we have internal bugs we want to segfaultJoel Sing
so that we can debug it, rather than adding a "should not be called" error to the stack. Discussed with beck@
2017-01-25Limit enabled version range by the versions configured on the SSL_CTX/SSL,Joel Sing
provide an ssl_supported_versions_range() function which also limits the versions to those supported by the current method. ok beck@
2017-01-25Change the SSL_IS_DTLS() macro to check the version, rather than using aJoel Sing
flag in the encryption methods. We can do this since there is currently only one DTLS version. This makes upcoming changes easier. ok beck@
2017-01-25Provide ssl3_packet_read() and ssl3_packet_extend() functions that improveJoel Sing
the awkward API provided by ssl3_read_n(). Call these when we need to read or extend a packet. ok beck@
2017-01-24Add support for setting the supported EC curves viaJoel Sing
SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous SSL{_CTX}_set1_curves{_list} names. This also changes the default list of EC curves to be X25519, P-256 and P-384. If you want others (such a brainpool) you need to configure this yourself. Inspired by parts of BoringSSL and OpenSSL. ok beck@
2017-01-23move default_passwd_cb and default_passwd_cb_userdata back intoBob Beck
the ssl_ctx from internal - these are used directly by python and openvpn and a few other things - we have the set accessors but the get accessors were added in 1.1 and these roll their own caveat OPENSSL_VERSION chickenpluckery
2017-01-23Move options and mode from SSL_CTX and SSL to internal, since these can beJoel Sing
set and cleared via existing functions.
2017-01-23Split most of SSL_METHOD out into an internal variant, which is opaque.Joel Sing
Discussed with beck@
2017-01-23send state and rstate from ssl_st into internal. There are accessorsBob Beck
so these should not be diddled with directly ok jsing@
2017-01-23move back read_hash and enc_read_ctx into ssl_st. wpa_supplicant andBob Beck
other perversions touches them sickly and unnaturally.
2017-01-23Move a large part of ssl_st into internal, so we can see what squeals.Bob Beck
ok jsing@
2017-01-23Move ex_data, next and prev from SSL_SESSION to internal.Joel Sing
ok beck@
2017-01-23Move most of the fields in SSL_CTX to internal - the ones that remain areJoel Sing
known to be in use. ok beck@
2017-01-23move the callbacks from ssl_st to internalBob Beck
ok jsing@
2017-01-23Move callback function pointers and argument pointers from SSL_CTX toJoel Sing
internal. ok beck@
2017-01-23Move not_resumable and sess_cert from SSL_SESSION to internal.Joel Sing
ok beck@
2017-01-23Move the stats struct from SSL_CTX to internal.Joel Sing
ok beck@
2017-01-22Move most of the SSL3_STATE fields to internal - the ones that remain areJoel Sing
known to be used by ports. ok beck@
2017-01-22Move most of DTLS1_STATE to internal.Bob Beck
ok jsing@
2017-01-22Move ALPN and NPN fields from SSL/SSL_CTX to internal.Joel Sing
ok beck@
2017-01-22Move internal parts of ssl_session_st to internalBob Beck
ok jsing@
2017-01-22Move recently added min_version/max_version from SSL and SSL_CTX to theirJoel Sing
opaque structs.
2017-01-22Convert publically visible structs to translucent structs.Joel Sing
This change adds an internal opaque struct for each of the significant publically visible structs. The opaque struct is then allocated and attached to the publically visible struct when the appropriate *_new() function is called, then cleared and freed as necessary. This will allow for changes to be made to the internals of libssl, without requiring a major bump each time the publically visible structs are modified. ok beck@
2017-01-21Expand DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN macro.Joel Sing
No change in preprocessor output (ignoring whitespace and line numbers).
2017-01-03Pull out, rework and dedup the code that determines the highest sharedJoel Sing
version. ok beck@ doug@
2016-12-30Pull out (and largely rewrite) the code that determines the enabledJoel Sing
protocol version range. This also fixes a bug whereby if all protocols were disabled, the client would still use TLSv1.2 in the client hello, only to have if fail with unsupported version when it received and processed the server hello. ok doug@
2016-12-30Remove now unused c2l, c2ln, l2c, n2l, l2cn and n2l3 macros.Joel Sing
2016-12-21Add support for ECDHE with X25519.Joel Sing
Testing of an earlier revision by naddy@. ok beck@
2016-12-18Convert ssl3_get_server_hello() to CBS.Joel Sing
ok doug@
2016-12-06Now that ssl3_send_{client,server}_certificate() are using the commonJoel Sing
handshake functions, we can remove more copied code from DTLS.
2016-12-06Convert certificate handshake message generation to CBB, with some cleanJoel Sing
up and restructure. This also adds CBB based variants of the ssl3_handshake_msg_{start,finish} functions - for the time being these use a CBB to build the messages, then copy back into the init_buf. ok doug@
2016-12-04Convert ssl_cipher_list_to_bytes() to CBB, changing the function to returnJoel Sing
the number of bytes written via an explicit *outlen argument and retaining the return value to indicate success or failure. ok doug@
2016-11-06Remove unused SSLv3 from ssl3_cbc_record_digest_supported().Joel Sing
From Markus Uhlin <markus.uhlin at bredband dot net> ok beck@ bcooK@
2016-11-05Convert ssl3_get_server_kex_ecdhe() to CBS, simplifying tls1_check_curve()Joel Sing
in the process. This also fixes a long standing bug where tls1_ec_curve_id2nid() is called with only one byte of the curve ID. ok beck@ miod@
2016-11-04Rename ssl3_get_key_exchange() to ssl3_get_server_key_exchange(), sinceJoel Sing
that's what it really is. ok miod@
2016-11-04Add an explict list of exported symbols with just the functionsPhilip Guenther
declared in the public headers, and use __{BEGIN,END}_HIDDEN_DECLS in the internal headers to optimize internal functions ok jsing@
2016-11-04Make do_dtls1_write() static to d1_pkt.c and delete declarations forPhilip Guenther
three functions that were removed a while ago ok jsing@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 09:24:02 +0000