1*1dcdf01fSchristos /* 2*1dcdf01fSchristos * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. 3*1dcdf01fSchristos * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved 4*1dcdf01fSchristos * Copyright 2005 Nokia. All rights reserved. 5*1dcdf01fSchristos * 6*1dcdf01fSchristos * Licensed under the OpenSSL license (the "License"). You may not use 7*1dcdf01fSchristos * this file except in compliance with the License. You can obtain a copy 8*1dcdf01fSchristos * in the file LICENSE in the source distribution or at 9*1dcdf01fSchristos * https://www.openssl.org/source/license.html 10*1dcdf01fSchristos */ 11*1dcdf01fSchristos 12*1dcdf01fSchristos #ifndef HEADER_SSL_H 13*1dcdf01fSchristos # define HEADER_SSL_H 14*1dcdf01fSchristos 15*1dcdf01fSchristos # include <openssl/e_os2.h> 16*1dcdf01fSchristos # include <openssl/opensslconf.h> 17*1dcdf01fSchristos # include <openssl/comp.h> 18*1dcdf01fSchristos # include <openssl/bio.h> 19*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 20*1dcdf01fSchristos # include <openssl/x509.h> 21*1dcdf01fSchristos # include <openssl/crypto.h> 22*1dcdf01fSchristos # include <openssl/buffer.h> 23*1dcdf01fSchristos # endif 24*1dcdf01fSchristos # include <openssl/lhash.h> 25*1dcdf01fSchristos # include <openssl/pem.h> 26*1dcdf01fSchristos # include <openssl/hmac.h> 27*1dcdf01fSchristos # include <openssl/async.h> 28*1dcdf01fSchristos 29*1dcdf01fSchristos # include <openssl/safestack.h> 30*1dcdf01fSchristos # include <openssl/symhacks.h> 31*1dcdf01fSchristos # include <openssl/ct.h> 32*1dcdf01fSchristos # include <openssl/sslerr.h> 33*1dcdf01fSchristos 34*1dcdf01fSchristos #ifdef __cplusplus 35*1dcdf01fSchristos extern "C" { 36*1dcdf01fSchristos #endif 37*1dcdf01fSchristos 38*1dcdf01fSchristos /* OpenSSL version number for ASN.1 encoding of the session information */ 39*1dcdf01fSchristos /*- 40*1dcdf01fSchristos * Version 0 - initial version 41*1dcdf01fSchristos * Version 1 - added the optional peer certificate 42*1dcdf01fSchristos */ 43*1dcdf01fSchristos # define SSL_SESSION_ASN1_VERSION 0x0001 44*1dcdf01fSchristos 45*1dcdf01fSchristos # define SSL_MAX_SSL_SESSION_ID_LENGTH 32 46*1dcdf01fSchristos # define SSL_MAX_SID_CTX_LENGTH 32 47*1dcdf01fSchristos 48*1dcdf01fSchristos # define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8) 49*1dcdf01fSchristos # define SSL_MAX_KEY_ARG_LENGTH 8 50*1dcdf01fSchristos # define SSL_MAX_MASTER_KEY_LENGTH 48 51*1dcdf01fSchristos 52*1dcdf01fSchristos /* The maximum number of encrypt/decrypt pipelines we can support */ 53*1dcdf01fSchristos # define SSL_MAX_PIPELINES 32 54*1dcdf01fSchristos 55*1dcdf01fSchristos /* text strings for the ciphers */ 56*1dcdf01fSchristos 57*1dcdf01fSchristos /* These are used to specify which ciphers to use and not to use */ 58*1dcdf01fSchristos 59*1dcdf01fSchristos # define SSL_TXT_LOW "LOW" 60*1dcdf01fSchristos # define SSL_TXT_MEDIUM "MEDIUM" 61*1dcdf01fSchristos # define SSL_TXT_HIGH "HIGH" 62*1dcdf01fSchristos # define SSL_TXT_FIPS "FIPS" 63*1dcdf01fSchristos 64*1dcdf01fSchristos # define SSL_TXT_aNULL "aNULL" 65*1dcdf01fSchristos # define SSL_TXT_eNULL "eNULL" 66*1dcdf01fSchristos # define SSL_TXT_NULL "NULL" 67*1dcdf01fSchristos 68*1dcdf01fSchristos # define SSL_TXT_kRSA "kRSA" 69*1dcdf01fSchristos # define SSL_TXT_kDHr "kDHr"/* this cipher class has been removed */ 70*1dcdf01fSchristos # define SSL_TXT_kDHd "kDHd"/* this cipher class has been removed */ 71*1dcdf01fSchristos # define SSL_TXT_kDH "kDH"/* this cipher class has been removed */ 72*1dcdf01fSchristos # define SSL_TXT_kEDH "kEDH"/* alias for kDHE */ 73*1dcdf01fSchristos # define SSL_TXT_kDHE "kDHE" 74*1dcdf01fSchristos # define SSL_TXT_kECDHr "kECDHr"/* this cipher class has been removed */ 75*1dcdf01fSchristos # define SSL_TXT_kECDHe "kECDHe"/* this cipher class has been removed */ 76*1dcdf01fSchristos # define SSL_TXT_kECDH "kECDH"/* this cipher class has been removed */ 77*1dcdf01fSchristos # define SSL_TXT_kEECDH "kEECDH"/* alias for kECDHE */ 78*1dcdf01fSchristos # define SSL_TXT_kECDHE "kECDHE" 79*1dcdf01fSchristos # define SSL_TXT_kPSK "kPSK" 80*1dcdf01fSchristos # define SSL_TXT_kRSAPSK "kRSAPSK" 81*1dcdf01fSchristos # define SSL_TXT_kECDHEPSK "kECDHEPSK" 82*1dcdf01fSchristos # define SSL_TXT_kDHEPSK "kDHEPSK" 83*1dcdf01fSchristos # define SSL_TXT_kGOST "kGOST" 84*1dcdf01fSchristos # define SSL_TXT_kSRP "kSRP" 85*1dcdf01fSchristos 86*1dcdf01fSchristos # define SSL_TXT_aRSA "aRSA" 87*1dcdf01fSchristos # define SSL_TXT_aDSS "aDSS" 88*1dcdf01fSchristos # define SSL_TXT_aDH "aDH"/* this cipher class has been removed */ 89*1dcdf01fSchristos # define SSL_TXT_aECDH "aECDH"/* this cipher class has been removed */ 90*1dcdf01fSchristos # define SSL_TXT_aECDSA "aECDSA" 91*1dcdf01fSchristos # define SSL_TXT_aPSK "aPSK" 92*1dcdf01fSchristos # define SSL_TXT_aGOST94 "aGOST94" 93*1dcdf01fSchristos # define SSL_TXT_aGOST01 "aGOST01" 94*1dcdf01fSchristos # define SSL_TXT_aGOST12 "aGOST12" 95*1dcdf01fSchristos # define SSL_TXT_aGOST "aGOST" 96*1dcdf01fSchristos # define SSL_TXT_aSRP "aSRP" 97*1dcdf01fSchristos 98*1dcdf01fSchristos # define SSL_TXT_DSS "DSS" 99*1dcdf01fSchristos # define SSL_TXT_DH "DH" 100*1dcdf01fSchristos # define SSL_TXT_DHE "DHE"/* same as "kDHE:-ADH" */ 101*1dcdf01fSchristos # define SSL_TXT_EDH "EDH"/* alias for DHE */ 102*1dcdf01fSchristos # define SSL_TXT_ADH "ADH" 103*1dcdf01fSchristos # define SSL_TXT_RSA "RSA" 104*1dcdf01fSchristos # define SSL_TXT_ECDH "ECDH" 105*1dcdf01fSchristos # define SSL_TXT_EECDH "EECDH"/* alias for ECDHE" */ 106*1dcdf01fSchristos # define SSL_TXT_ECDHE "ECDHE"/* same as "kECDHE:-AECDH" */ 107*1dcdf01fSchristos # define SSL_TXT_AECDH "AECDH" 108*1dcdf01fSchristos # define SSL_TXT_ECDSA "ECDSA" 109*1dcdf01fSchristos # define SSL_TXT_PSK "PSK" 110*1dcdf01fSchristos # define SSL_TXT_SRP "SRP" 111*1dcdf01fSchristos 112*1dcdf01fSchristos # define SSL_TXT_DES "DES" 113*1dcdf01fSchristos # define SSL_TXT_3DES "3DES" 114*1dcdf01fSchristos # define SSL_TXT_RC4 "RC4" 115*1dcdf01fSchristos # define SSL_TXT_RC2 "RC2" 116*1dcdf01fSchristos # define SSL_TXT_IDEA "IDEA" 117*1dcdf01fSchristos # define SSL_TXT_SEED "SEED" 118*1dcdf01fSchristos # define SSL_TXT_AES128 "AES128" 119*1dcdf01fSchristos # define SSL_TXT_AES256 "AES256" 120*1dcdf01fSchristos # define SSL_TXT_AES "AES" 121*1dcdf01fSchristos # define SSL_TXT_AES_GCM "AESGCM" 122*1dcdf01fSchristos # define SSL_TXT_AES_CCM "AESCCM" 123*1dcdf01fSchristos # define SSL_TXT_AES_CCM_8 "AESCCM8" 124*1dcdf01fSchristos # define SSL_TXT_CAMELLIA128 "CAMELLIA128" 125*1dcdf01fSchristos # define SSL_TXT_CAMELLIA256 "CAMELLIA256" 126*1dcdf01fSchristos # define SSL_TXT_CAMELLIA "CAMELLIA" 127*1dcdf01fSchristos # define SSL_TXT_CHACHA20 "CHACHA20" 128*1dcdf01fSchristos # define SSL_TXT_GOST "GOST89" 129*1dcdf01fSchristos # define SSL_TXT_ARIA "ARIA" 130*1dcdf01fSchristos # define SSL_TXT_ARIA_GCM "ARIAGCM" 131*1dcdf01fSchristos # define SSL_TXT_ARIA128 "ARIA128" 132*1dcdf01fSchristos # define SSL_TXT_ARIA256 "ARIA256" 133*1dcdf01fSchristos 134*1dcdf01fSchristos # define SSL_TXT_MD5 "MD5" 135*1dcdf01fSchristos # define SSL_TXT_SHA1 "SHA1" 136*1dcdf01fSchristos # define SSL_TXT_SHA "SHA"/* same as "SHA1" */ 137*1dcdf01fSchristos # define SSL_TXT_GOST94 "GOST94" 138*1dcdf01fSchristos # define SSL_TXT_GOST89MAC "GOST89MAC" 139*1dcdf01fSchristos # define SSL_TXT_GOST12 "GOST12" 140*1dcdf01fSchristos # define SSL_TXT_GOST89MAC12 "GOST89MAC12" 141*1dcdf01fSchristos # define SSL_TXT_SHA256 "SHA256" 142*1dcdf01fSchristos # define SSL_TXT_SHA384 "SHA384" 143*1dcdf01fSchristos 144*1dcdf01fSchristos # define SSL_TXT_SSLV3 "SSLv3" 145*1dcdf01fSchristos # define SSL_TXT_TLSV1 "TLSv1" 146*1dcdf01fSchristos # define SSL_TXT_TLSV1_1 "TLSv1.1" 147*1dcdf01fSchristos # define SSL_TXT_TLSV1_2 "TLSv1.2" 148*1dcdf01fSchristos 149*1dcdf01fSchristos # define SSL_TXT_ALL "ALL" 150*1dcdf01fSchristos 151*1dcdf01fSchristos /*- 152*1dcdf01fSchristos * COMPLEMENTOF* definitions. These identifiers are used to (de-select) 153*1dcdf01fSchristos * ciphers normally not being used. 154*1dcdf01fSchristos * Example: "RC4" will activate all ciphers using RC4 including ciphers 155*1dcdf01fSchristos * without authentication, which would normally disabled by DEFAULT (due 156*1dcdf01fSchristos * the "!ADH" being part of default). Therefore "RC4:!COMPLEMENTOFDEFAULT" 157*1dcdf01fSchristos * will make sure that it is also disabled in the specific selection. 158*1dcdf01fSchristos * COMPLEMENTOF* identifiers are portable between version, as adjustments 159*1dcdf01fSchristos * to the default cipher setup will also be included here. 160*1dcdf01fSchristos * 161*1dcdf01fSchristos * COMPLEMENTOFDEFAULT does not experience the same special treatment that 162*1dcdf01fSchristos * DEFAULT gets, as only selection is being done and no sorting as needed 163*1dcdf01fSchristos * for DEFAULT. 164*1dcdf01fSchristos */ 165*1dcdf01fSchristos # define SSL_TXT_CMPALL "COMPLEMENTOFALL" 166*1dcdf01fSchristos # define SSL_TXT_CMPDEF "COMPLEMENTOFDEFAULT" 167*1dcdf01fSchristos 168*1dcdf01fSchristos /* 169*1dcdf01fSchristos * The following cipher list is used by default. It also is substituted when 170*1dcdf01fSchristos * an application-defined cipher list string starts with 'DEFAULT'. 171*1dcdf01fSchristos * This applies to ciphersuites for TLSv1.2 and below. 172*1dcdf01fSchristos */ 173*1dcdf01fSchristos # define SSL_DEFAULT_CIPHER_LIST "ALL:!COMPLEMENTOFDEFAULT:!eNULL" 174*1dcdf01fSchristos /* This is the default set of TLSv1.3 ciphersuites */ 175*1dcdf01fSchristos # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) 176*1dcdf01fSchristos # define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \ 177*1dcdf01fSchristos "TLS_CHACHA20_POLY1305_SHA256:" \ 178*1dcdf01fSchristos "TLS_AES_128_GCM_SHA256" 179*1dcdf01fSchristos # else 180*1dcdf01fSchristos # define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \ 181*1dcdf01fSchristos "TLS_AES_128_GCM_SHA256" 182*1dcdf01fSchristos #endif 183*1dcdf01fSchristos /* 184*1dcdf01fSchristos * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always 185*1dcdf01fSchristos * starts with a reasonable order, and all we have to do for DEFAULT is 186*1dcdf01fSchristos * throwing out anonymous and unencrypted ciphersuites! (The latter are not 187*1dcdf01fSchristos * actually enabled by ALL, but "ALL:RSA" would enable some of them.) 188*1dcdf01fSchristos */ 189*1dcdf01fSchristos 190*1dcdf01fSchristos /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ 191*1dcdf01fSchristos # define SSL_SENT_SHUTDOWN 1 192*1dcdf01fSchristos # define SSL_RECEIVED_SHUTDOWN 2 193*1dcdf01fSchristos 194*1dcdf01fSchristos #ifdef __cplusplus 195*1dcdf01fSchristos } 196*1dcdf01fSchristos #endif 197*1dcdf01fSchristos 198*1dcdf01fSchristos #ifdef __cplusplus 199*1dcdf01fSchristos extern "C" { 200*1dcdf01fSchristos #endif 201*1dcdf01fSchristos 202*1dcdf01fSchristos # define SSL_FILETYPE_ASN1 X509_FILETYPE_ASN1 203*1dcdf01fSchristos # define SSL_FILETYPE_PEM X509_FILETYPE_PEM 204*1dcdf01fSchristos 205*1dcdf01fSchristos /* 206*1dcdf01fSchristos * This is needed to stop compilers complaining about the 'struct ssl_st *' 207*1dcdf01fSchristos * function parameters used to prototype callbacks in SSL_CTX. 208*1dcdf01fSchristos */ 209*1dcdf01fSchristos typedef struct ssl_st *ssl_crock_st; 210*1dcdf01fSchristos typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT; 211*1dcdf01fSchristos typedef struct ssl_method_st SSL_METHOD; 212*1dcdf01fSchristos typedef struct ssl_cipher_st SSL_CIPHER; 213*1dcdf01fSchristos typedef struct ssl_session_st SSL_SESSION; 214*1dcdf01fSchristos typedef struct tls_sigalgs_st TLS_SIGALGS; 215*1dcdf01fSchristos typedef struct ssl_conf_ctx_st SSL_CONF_CTX; 216*1dcdf01fSchristos typedef struct ssl_comp_st SSL_COMP; 217*1dcdf01fSchristos 218*1dcdf01fSchristos STACK_OF(SSL_CIPHER); 219*1dcdf01fSchristos STACK_OF(SSL_COMP); 220*1dcdf01fSchristos 221*1dcdf01fSchristos /* SRTP protection profiles for use with the use_srtp extension (RFC 5764)*/ 222*1dcdf01fSchristos typedef struct srtp_protection_profile_st { 223*1dcdf01fSchristos const char *name; 224*1dcdf01fSchristos unsigned long id; 225*1dcdf01fSchristos } SRTP_PROTECTION_PROFILE; 226*1dcdf01fSchristos 227*1dcdf01fSchristos DEFINE_STACK_OF(SRTP_PROTECTION_PROFILE) 228*1dcdf01fSchristos 229*1dcdf01fSchristos typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, 230*1dcdf01fSchristos int len, void *arg); 231*1dcdf01fSchristos typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, 232*1dcdf01fSchristos STACK_OF(SSL_CIPHER) *peer_ciphers, 233*1dcdf01fSchristos const SSL_CIPHER **cipher, void *arg); 234*1dcdf01fSchristos 235*1dcdf01fSchristos /* Extension context codes */ 236*1dcdf01fSchristos /* This extension is only allowed in TLS */ 237*1dcdf01fSchristos #define SSL_EXT_TLS_ONLY 0x0001 238*1dcdf01fSchristos /* This extension is only allowed in DTLS */ 239*1dcdf01fSchristos #define SSL_EXT_DTLS_ONLY 0x0002 240*1dcdf01fSchristos /* Some extensions may be allowed in DTLS but we don't implement them for it */ 241*1dcdf01fSchristos #define SSL_EXT_TLS_IMPLEMENTATION_ONLY 0x0004 242*1dcdf01fSchristos /* Most extensions are not defined for SSLv3 but EXT_TYPE_renegotiate is */ 243*1dcdf01fSchristos #define SSL_EXT_SSL3_ALLOWED 0x0008 244*1dcdf01fSchristos /* Extension is only defined for TLS1.2 and below */ 245*1dcdf01fSchristos #define SSL_EXT_TLS1_2_AND_BELOW_ONLY 0x0010 246*1dcdf01fSchristos /* Extension is only defined for TLS1.3 and above */ 247*1dcdf01fSchristos #define SSL_EXT_TLS1_3_ONLY 0x0020 248*1dcdf01fSchristos /* Ignore this extension during parsing if we are resuming */ 249*1dcdf01fSchristos #define SSL_EXT_IGNORE_ON_RESUMPTION 0x0040 250*1dcdf01fSchristos #define SSL_EXT_CLIENT_HELLO 0x0080 251*1dcdf01fSchristos /* Really means TLS1.2 or below */ 252*1dcdf01fSchristos #define SSL_EXT_TLS1_2_SERVER_HELLO 0x0100 253*1dcdf01fSchristos #define SSL_EXT_TLS1_3_SERVER_HELLO 0x0200 254*1dcdf01fSchristos #define SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS 0x0400 255*1dcdf01fSchristos #define SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST 0x0800 256*1dcdf01fSchristos #define SSL_EXT_TLS1_3_CERTIFICATE 0x1000 257*1dcdf01fSchristos #define SSL_EXT_TLS1_3_NEW_SESSION_TICKET 0x2000 258*1dcdf01fSchristos #define SSL_EXT_TLS1_3_CERTIFICATE_REQUEST 0x4000 259*1dcdf01fSchristos 260*1dcdf01fSchristos /* Typedefs for handling custom extensions */ 261*1dcdf01fSchristos 262*1dcdf01fSchristos typedef int (*custom_ext_add_cb)(SSL *s, unsigned int ext_type, 263*1dcdf01fSchristos const unsigned char **out, size_t *outlen, 264*1dcdf01fSchristos int *al, void *add_arg); 265*1dcdf01fSchristos 266*1dcdf01fSchristos typedef void (*custom_ext_free_cb)(SSL *s, unsigned int ext_type, 267*1dcdf01fSchristos const unsigned char *out, void *add_arg); 268*1dcdf01fSchristos 269*1dcdf01fSchristos typedef int (*custom_ext_parse_cb)(SSL *s, unsigned int ext_type, 270*1dcdf01fSchristos const unsigned char *in, size_t inlen, 271*1dcdf01fSchristos int *al, void *parse_arg); 272*1dcdf01fSchristos 273*1dcdf01fSchristos 274*1dcdf01fSchristos typedef int (*SSL_custom_ext_add_cb_ex)(SSL *s, unsigned int ext_type, 275*1dcdf01fSchristos unsigned int context, 276*1dcdf01fSchristos const unsigned char **out, 277*1dcdf01fSchristos size_t *outlen, X509 *x, 278*1dcdf01fSchristos size_t chainidx, 279*1dcdf01fSchristos int *al, void *add_arg); 280*1dcdf01fSchristos 281*1dcdf01fSchristos typedef void (*SSL_custom_ext_free_cb_ex)(SSL *s, unsigned int ext_type, 282*1dcdf01fSchristos unsigned int context, 283*1dcdf01fSchristos const unsigned char *out, 284*1dcdf01fSchristos void *add_arg); 285*1dcdf01fSchristos 286*1dcdf01fSchristos typedef int (*SSL_custom_ext_parse_cb_ex)(SSL *s, unsigned int ext_type, 287*1dcdf01fSchristos unsigned int context, 288*1dcdf01fSchristos const unsigned char *in, 289*1dcdf01fSchristos size_t inlen, X509 *x, 290*1dcdf01fSchristos size_t chainidx, 291*1dcdf01fSchristos int *al, void *parse_arg); 292*1dcdf01fSchristos 293*1dcdf01fSchristos /* Typedef for verification callback */ 294*1dcdf01fSchristos typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx); 295*1dcdf01fSchristos 296*1dcdf01fSchristos /* 297*1dcdf01fSchristos * Some values are reserved until OpenSSL 1.2.0 because they were previously 298*1dcdf01fSchristos * included in SSL_OP_ALL in a 1.1.x release. 299*1dcdf01fSchristos * 300*1dcdf01fSchristos * Reserved value (until OpenSSL 1.2.0) 0x00000001U 301*1dcdf01fSchristos * Reserved value (until OpenSSL 1.2.0) 0x00000002U 302*1dcdf01fSchristos */ 303*1dcdf01fSchristos /* Allow initial connection to servers that don't support RI */ 304*1dcdf01fSchristos # define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004U 305*1dcdf01fSchristos 306*1dcdf01fSchristos /* Reserved value (until OpenSSL 1.2.0) 0x00000008U */ 307*1dcdf01fSchristos # define SSL_OP_TLSEXT_PADDING 0x00000010U 308*1dcdf01fSchristos /* Reserved value (until OpenSSL 1.2.0) 0x00000020U */ 309*1dcdf01fSchristos # define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x00000040U 310*1dcdf01fSchristos /* 311*1dcdf01fSchristos * Reserved value (until OpenSSL 1.2.0) 0x00000080U 312*1dcdf01fSchristos * Reserved value (until OpenSSL 1.2.0) 0x00000100U 313*1dcdf01fSchristos * Reserved value (until OpenSSL 1.2.0) 0x00000200U 314*1dcdf01fSchristos */ 315*1dcdf01fSchristos 316*1dcdf01fSchristos /* In TLSv1.3 allow a non-(ec)dhe based kex_mode */ 317*1dcdf01fSchristos # define SSL_OP_ALLOW_NO_DHE_KEX 0x00000400U 318*1dcdf01fSchristos 319*1dcdf01fSchristos /* 320*1dcdf01fSchristos * Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added in 321*1dcdf01fSchristos * OpenSSL 0.9.6d. Usually (depending on the application protocol) the 322*1dcdf01fSchristos * workaround is not needed. Unfortunately some broken SSL/TLS 323*1dcdf01fSchristos * implementations cannot handle it at all, which is why we include it in 324*1dcdf01fSchristos * SSL_OP_ALL. Added in 0.9.6e 325*1dcdf01fSchristos */ 326*1dcdf01fSchristos # define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 0x00000800U 327*1dcdf01fSchristos 328*1dcdf01fSchristos /* DTLS options */ 329*1dcdf01fSchristos # define SSL_OP_NO_QUERY_MTU 0x00001000U 330*1dcdf01fSchristos /* Turn on Cookie Exchange (on relevant for servers) */ 331*1dcdf01fSchristos # define SSL_OP_COOKIE_EXCHANGE 0x00002000U 332*1dcdf01fSchristos /* Don't use RFC4507 ticket extension */ 333*1dcdf01fSchristos # define SSL_OP_NO_TICKET 0x00004000U 334*1dcdf01fSchristos # ifndef OPENSSL_NO_DTLS1_METHOD 335*1dcdf01fSchristos /* Use Cisco's "speshul" version of DTLS_BAD_VER 336*1dcdf01fSchristos * (only with deprecated DTLSv1_client_method()) */ 337*1dcdf01fSchristos # define SSL_OP_CISCO_ANYCONNECT 0x00008000U 338*1dcdf01fSchristos # endif 339*1dcdf01fSchristos 340*1dcdf01fSchristos /* As server, disallow session resumption on renegotiation */ 341*1dcdf01fSchristos # define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0x00010000U 342*1dcdf01fSchristos /* Don't use compression even if supported */ 343*1dcdf01fSchristos # define SSL_OP_NO_COMPRESSION 0x00020000U 344*1dcdf01fSchristos /* Permit unsafe legacy renegotiation */ 345*1dcdf01fSchristos # define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0x00040000U 346*1dcdf01fSchristos /* Disable encrypt-then-mac */ 347*1dcdf01fSchristos # define SSL_OP_NO_ENCRYPT_THEN_MAC 0x00080000U 348*1dcdf01fSchristos 349*1dcdf01fSchristos /* 350*1dcdf01fSchristos * Enable TLSv1.3 Compatibility mode. This is on by default. A future version 351*1dcdf01fSchristos * of OpenSSL may have this disabled by default. 352*1dcdf01fSchristos */ 353*1dcdf01fSchristos # define SSL_OP_ENABLE_MIDDLEBOX_COMPAT 0x00100000U 354*1dcdf01fSchristos 355*1dcdf01fSchristos /* Prioritize Chacha20Poly1305 when client does. 356*1dcdf01fSchristos * Modifies SSL_OP_CIPHER_SERVER_PREFERENCE */ 357*1dcdf01fSchristos # define SSL_OP_PRIORITIZE_CHACHA 0x00200000U 358*1dcdf01fSchristos 359*1dcdf01fSchristos /* 360*1dcdf01fSchristos * Set on servers to choose the cipher according to the server's preferences 361*1dcdf01fSchristos */ 362*1dcdf01fSchristos # define SSL_OP_CIPHER_SERVER_PREFERENCE 0x00400000U 363*1dcdf01fSchristos /* 364*1dcdf01fSchristos * If set, a server will allow a client to issue a SSLv3.0 version number as 365*1dcdf01fSchristos * latest version supported in the premaster secret, even when TLSv1.0 366*1dcdf01fSchristos * (version 3.1) was announced in the client hello. Normally this is 367*1dcdf01fSchristos * forbidden to prevent version rollback attacks. 368*1dcdf01fSchristos */ 369*1dcdf01fSchristos # define SSL_OP_TLS_ROLLBACK_BUG 0x00800000U 370*1dcdf01fSchristos 371*1dcdf01fSchristos /* 372*1dcdf01fSchristos * Switches off automatic TLSv1.3 anti-replay protection for early data. This 373*1dcdf01fSchristos * is a server-side option only (no effect on the client). 374*1dcdf01fSchristos */ 375*1dcdf01fSchristos # define SSL_OP_NO_ANTI_REPLAY 0x01000000U 376*1dcdf01fSchristos 377*1dcdf01fSchristos # define SSL_OP_NO_SSLv3 0x02000000U 378*1dcdf01fSchristos # define SSL_OP_NO_TLSv1 0x04000000U 379*1dcdf01fSchristos # define SSL_OP_NO_TLSv1_2 0x08000000U 380*1dcdf01fSchristos # define SSL_OP_NO_TLSv1_1 0x10000000U 381*1dcdf01fSchristos # define SSL_OP_NO_TLSv1_3 0x20000000U 382*1dcdf01fSchristos 383*1dcdf01fSchristos # define SSL_OP_NO_DTLSv1 0x04000000U 384*1dcdf01fSchristos # define SSL_OP_NO_DTLSv1_2 0x08000000U 385*1dcdf01fSchristos 386*1dcdf01fSchristos # define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv3|\ 387*1dcdf01fSchristos SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2|SSL_OP_NO_TLSv1_3) 388*1dcdf01fSchristos # define SSL_OP_NO_DTLS_MASK (SSL_OP_NO_DTLSv1|SSL_OP_NO_DTLSv1_2) 389*1dcdf01fSchristos 390*1dcdf01fSchristos /* Disallow all renegotiation */ 391*1dcdf01fSchristos # define SSL_OP_NO_RENEGOTIATION 0x40000000U 392*1dcdf01fSchristos 393*1dcdf01fSchristos /* 394*1dcdf01fSchristos * Make server add server-hello extension from early version of cryptopro 395*1dcdf01fSchristos * draft, when GOST ciphersuite is negotiated. Required for interoperability 396*1dcdf01fSchristos * with CryptoPro CSP 3.x 397*1dcdf01fSchristos */ 398*1dcdf01fSchristos # define SSL_OP_CRYPTOPRO_TLSEXT_BUG 0x80000000U 399*1dcdf01fSchristos 400*1dcdf01fSchristos /* 401*1dcdf01fSchristos * SSL_OP_ALL: various bug workarounds that should be rather harmless. 402*1dcdf01fSchristos * This used to be 0x000FFFFFL before 0.9.7. 403*1dcdf01fSchristos * This used to be 0x80000BFFU before 1.1.1. 404*1dcdf01fSchristos */ 405*1dcdf01fSchristos # define SSL_OP_ALL (SSL_OP_CRYPTOPRO_TLSEXT_BUG|\ 406*1dcdf01fSchristos SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS|\ 407*1dcdf01fSchristos SSL_OP_LEGACY_SERVER_CONNECT|\ 408*1dcdf01fSchristos SSL_OP_TLSEXT_PADDING|\ 409*1dcdf01fSchristos SSL_OP_SAFARI_ECDHE_ECDSA_BUG) 410*1dcdf01fSchristos 411*1dcdf01fSchristos /* OBSOLETE OPTIONS: retained for compatibility */ 412*1dcdf01fSchristos 413*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00000001L */ 414*1dcdf01fSchristos /* Related to removed SSLv2. */ 415*1dcdf01fSchristos # define SSL_OP_MICROSOFT_SESS_ID_BUG 0x0 416*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00000002L */ 417*1dcdf01fSchristos /* Related to removed SSLv2. */ 418*1dcdf01fSchristos # define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x0 419*1dcdf01fSchristos /* Removed from OpenSSL 0.9.8q and 1.0.0c. Was 0x00000008L */ 420*1dcdf01fSchristos /* Dead forever, see CVE-2010-4180 */ 421*1dcdf01fSchristos # define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x0 422*1dcdf01fSchristos /* Removed from OpenSSL 1.0.1h and 1.0.2. Was 0x00000010L */ 423*1dcdf01fSchristos /* Refers to ancient SSLREF and SSLv2. */ 424*1dcdf01fSchristos # define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x0 425*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00000020 */ 426*1dcdf01fSchristos # define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x0 427*1dcdf01fSchristos /* Removed from OpenSSL 0.9.7h and 0.9.8b. Was 0x00000040L */ 428*1dcdf01fSchristos # define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x0 429*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00000080 */ 430*1dcdf01fSchristos /* Ancient SSLeay version. */ 431*1dcdf01fSchristos # define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x0 432*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00000100L */ 433*1dcdf01fSchristos # define SSL_OP_TLS_D5_BUG 0x0 434*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00000200L */ 435*1dcdf01fSchristos # define SSL_OP_TLS_BLOCK_PADDING_BUG 0x0 436*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00080000L */ 437*1dcdf01fSchristos # define SSL_OP_SINGLE_ECDH_USE 0x0 438*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x00100000L */ 439*1dcdf01fSchristos # define SSL_OP_SINGLE_DH_USE 0x0 440*1dcdf01fSchristos /* Removed from OpenSSL 1.0.1k and 1.0.2. Was 0x00200000L */ 441*1dcdf01fSchristos # define SSL_OP_EPHEMERAL_RSA 0x0 442*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x01000000L */ 443*1dcdf01fSchristos # define SSL_OP_NO_SSLv2 0x0 444*1dcdf01fSchristos /* Removed from OpenSSL 1.0.1. Was 0x08000000L */ 445*1dcdf01fSchristos # define SSL_OP_PKCS1_CHECK_1 0x0 446*1dcdf01fSchristos /* Removed from OpenSSL 1.0.1. Was 0x10000000L */ 447*1dcdf01fSchristos # define SSL_OP_PKCS1_CHECK_2 0x0 448*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x20000000L */ 449*1dcdf01fSchristos # define SSL_OP_NETSCAPE_CA_DN_BUG 0x0 450*1dcdf01fSchristos /* Removed from OpenSSL 1.1.0. Was 0x40000000L */ 451*1dcdf01fSchristos # define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG 0x0 452*1dcdf01fSchristos 453*1dcdf01fSchristos /* 454*1dcdf01fSchristos * Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success 455*1dcdf01fSchristos * when just a single record has been written): 456*1dcdf01fSchristos */ 457*1dcdf01fSchristos # define SSL_MODE_ENABLE_PARTIAL_WRITE 0x00000001U 458*1dcdf01fSchristos /* 459*1dcdf01fSchristos * Make it possible to retry SSL_write() with changed buffer location (buffer 460*1dcdf01fSchristos * contents must stay the same!); this is not the default to avoid the 461*1dcdf01fSchristos * misconception that non-blocking SSL_write() behaves like non-blocking 462*1dcdf01fSchristos * write(): 463*1dcdf01fSchristos */ 464*1dcdf01fSchristos # define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002U 465*1dcdf01fSchristos /* 466*1dcdf01fSchristos * Never bother the application with retries if the transport is blocking: 467*1dcdf01fSchristos */ 468*1dcdf01fSchristos # define SSL_MODE_AUTO_RETRY 0x00000004U 469*1dcdf01fSchristos /* Don't attempt to automatically build certificate chain */ 470*1dcdf01fSchristos # define SSL_MODE_NO_AUTO_CHAIN 0x00000008U 471*1dcdf01fSchristos /* 472*1dcdf01fSchristos * Save RAM by releasing read and write buffers when they're empty. (SSL3 and 473*1dcdf01fSchristos * TLS only.) Released buffers are freed. 474*1dcdf01fSchristos */ 475*1dcdf01fSchristos # define SSL_MODE_RELEASE_BUFFERS 0x00000010U 476*1dcdf01fSchristos /* 477*1dcdf01fSchristos * Send the current time in the Random fields of the ClientHello and 478*1dcdf01fSchristos * ServerHello records for compatibility with hypothetical implementations 479*1dcdf01fSchristos * that require it. 480*1dcdf01fSchristos */ 481*1dcdf01fSchristos # define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020U 482*1dcdf01fSchristos # define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040U 483*1dcdf01fSchristos /* 484*1dcdf01fSchristos * Send TLS_FALLBACK_SCSV in the ClientHello. To be set only by applications 485*1dcdf01fSchristos * that reconnect with a downgraded protocol version; see 486*1dcdf01fSchristos * draft-ietf-tls-downgrade-scsv-00 for details. DO NOT ENABLE THIS if your 487*1dcdf01fSchristos * application attempts a normal handshake. Only use this in explicit 488*1dcdf01fSchristos * fallback retries, following the guidance in 489*1dcdf01fSchristos * draft-ietf-tls-downgrade-scsv-00. 490*1dcdf01fSchristos */ 491*1dcdf01fSchristos # define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080U 492*1dcdf01fSchristos /* 493*1dcdf01fSchristos * Support Asynchronous operation 494*1dcdf01fSchristos */ 495*1dcdf01fSchristos # define SSL_MODE_ASYNC 0x00000100U 496*1dcdf01fSchristos 497*1dcdf01fSchristos /* 498*1dcdf01fSchristos * When using DTLS/SCTP, include the terminating zero in the label 499*1dcdf01fSchristos * used for computing the endpoint-pair shared secret. Required for 500*1dcdf01fSchristos * interoperability with implementations having this bug like these 501*1dcdf01fSchristos * older version of OpenSSL: 502*1dcdf01fSchristos * - OpenSSL 1.0.0 series 503*1dcdf01fSchristos * - OpenSSL 1.0.1 series 504*1dcdf01fSchristos * - OpenSSL 1.0.2 series 505*1dcdf01fSchristos * - OpenSSL 1.1.0 series 506*1dcdf01fSchristos * - OpenSSL 1.1.1 and 1.1.1a 507*1dcdf01fSchristos */ 508*1dcdf01fSchristos # define SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG 0x00000400U 509*1dcdf01fSchristos 510*1dcdf01fSchristos /* Cert related flags */ 511*1dcdf01fSchristos /* 512*1dcdf01fSchristos * Many implementations ignore some aspects of the TLS standards such as 513*1dcdf01fSchristos * enforcing certificate chain algorithms. When this is set we enforce them. 514*1dcdf01fSchristos */ 515*1dcdf01fSchristos # define SSL_CERT_FLAG_TLS_STRICT 0x00000001U 516*1dcdf01fSchristos 517*1dcdf01fSchristos /* Suite B modes, takes same values as certificate verify flags */ 518*1dcdf01fSchristos # define SSL_CERT_FLAG_SUITEB_128_LOS_ONLY 0x10000 519*1dcdf01fSchristos /* Suite B 192 bit only mode */ 520*1dcdf01fSchristos # define SSL_CERT_FLAG_SUITEB_192_LOS 0x20000 521*1dcdf01fSchristos /* Suite B 128 bit mode allowing 192 bit algorithms */ 522*1dcdf01fSchristos # define SSL_CERT_FLAG_SUITEB_128_LOS 0x30000 523*1dcdf01fSchristos 524*1dcdf01fSchristos /* Perform all sorts of protocol violations for testing purposes */ 525*1dcdf01fSchristos # define SSL_CERT_FLAG_BROKEN_PROTOCOL 0x10000000 526*1dcdf01fSchristos 527*1dcdf01fSchristos /* Flags for building certificate chains */ 528*1dcdf01fSchristos /* Treat any existing certificates as untrusted CAs */ 529*1dcdf01fSchristos # define SSL_BUILD_CHAIN_FLAG_UNTRUSTED 0x1 530*1dcdf01fSchristos /* Don't include root CA in chain */ 531*1dcdf01fSchristos # define SSL_BUILD_CHAIN_FLAG_NO_ROOT 0x2 532*1dcdf01fSchristos /* Just check certificates already there */ 533*1dcdf01fSchristos # define SSL_BUILD_CHAIN_FLAG_CHECK 0x4 534*1dcdf01fSchristos /* Ignore verification errors */ 535*1dcdf01fSchristos # define SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR 0x8 536*1dcdf01fSchristos /* Clear verification errors from queue */ 537*1dcdf01fSchristos # define SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR 0x10 538*1dcdf01fSchristos 539*1dcdf01fSchristos /* Flags returned by SSL_check_chain */ 540*1dcdf01fSchristos /* Certificate can be used with this session */ 541*1dcdf01fSchristos # define CERT_PKEY_VALID 0x1 542*1dcdf01fSchristos /* Certificate can also be used for signing */ 543*1dcdf01fSchristos # define CERT_PKEY_SIGN 0x2 544*1dcdf01fSchristos /* EE certificate signing algorithm OK */ 545*1dcdf01fSchristos # define CERT_PKEY_EE_SIGNATURE 0x10 546*1dcdf01fSchristos /* CA signature algorithms OK */ 547*1dcdf01fSchristos # define CERT_PKEY_CA_SIGNATURE 0x20 548*1dcdf01fSchristos /* EE certificate parameters OK */ 549*1dcdf01fSchristos # define CERT_PKEY_EE_PARAM 0x40 550*1dcdf01fSchristos /* CA certificate parameters OK */ 551*1dcdf01fSchristos # define CERT_PKEY_CA_PARAM 0x80 552*1dcdf01fSchristos /* Signing explicitly allowed as opposed to SHA1 fallback */ 553*1dcdf01fSchristos # define CERT_PKEY_EXPLICIT_SIGN 0x100 554*1dcdf01fSchristos /* Client CA issuer names match (always set for server cert) */ 555*1dcdf01fSchristos # define CERT_PKEY_ISSUER_NAME 0x200 556*1dcdf01fSchristos /* Cert type matches client types (always set for server cert) */ 557*1dcdf01fSchristos # define CERT_PKEY_CERT_TYPE 0x400 558*1dcdf01fSchristos /* Cert chain suitable to Suite B */ 559*1dcdf01fSchristos # define CERT_PKEY_SUITEB 0x800 560*1dcdf01fSchristos 561*1dcdf01fSchristos # define SSL_CONF_FLAG_CMDLINE 0x1 562*1dcdf01fSchristos # define SSL_CONF_FLAG_FILE 0x2 563*1dcdf01fSchristos # define SSL_CONF_FLAG_CLIENT 0x4 564*1dcdf01fSchristos # define SSL_CONF_FLAG_SERVER 0x8 565*1dcdf01fSchristos # define SSL_CONF_FLAG_SHOW_ERRORS 0x10 566*1dcdf01fSchristos # define SSL_CONF_FLAG_CERTIFICATE 0x20 567*1dcdf01fSchristos # define SSL_CONF_FLAG_REQUIRE_PRIVATE 0x40 568*1dcdf01fSchristos /* Configuration value types */ 569*1dcdf01fSchristos # define SSL_CONF_TYPE_UNKNOWN 0x0 570*1dcdf01fSchristos # define SSL_CONF_TYPE_STRING 0x1 571*1dcdf01fSchristos # define SSL_CONF_TYPE_FILE 0x2 572*1dcdf01fSchristos # define SSL_CONF_TYPE_DIR 0x3 573*1dcdf01fSchristos # define SSL_CONF_TYPE_NONE 0x4 574*1dcdf01fSchristos 575*1dcdf01fSchristos /* Maximum length of the application-controlled segment of a a TLSv1.3 cookie */ 576*1dcdf01fSchristos # define SSL_COOKIE_LENGTH 4096 577*1dcdf01fSchristos 578*1dcdf01fSchristos /* 579*1dcdf01fSchristos * Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, they 580*1dcdf01fSchristos * cannot be used to clear bits. 581*1dcdf01fSchristos */ 582*1dcdf01fSchristos 583*1dcdf01fSchristos unsigned long SSL_CTX_get_options(const SSL_CTX *ctx); 584*1dcdf01fSchristos unsigned long SSL_get_options(const SSL *s); 585*1dcdf01fSchristos unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op); 586*1dcdf01fSchristos unsigned long SSL_clear_options(SSL *s, unsigned long op); 587*1dcdf01fSchristos unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long op); 588*1dcdf01fSchristos unsigned long SSL_set_options(SSL *s, unsigned long op); 589*1dcdf01fSchristos 590*1dcdf01fSchristos # define SSL_CTX_set_mode(ctx,op) \ 591*1dcdf01fSchristos SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL) 592*1dcdf01fSchristos # define SSL_CTX_clear_mode(ctx,op) \ 593*1dcdf01fSchristos SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_MODE,(op),NULL) 594*1dcdf01fSchristos # define SSL_CTX_get_mode(ctx) \ 595*1dcdf01fSchristos SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL) 596*1dcdf01fSchristos # define SSL_clear_mode(ssl,op) \ 597*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_CLEAR_MODE,(op),NULL) 598*1dcdf01fSchristos # define SSL_set_mode(ssl,op) \ 599*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL) 600*1dcdf01fSchristos # define SSL_get_mode(ssl) \ 601*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL) 602*1dcdf01fSchristos # define SSL_set_mtu(ssl, mtu) \ 603*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL) 604*1dcdf01fSchristos # define DTLS_set_link_mtu(ssl, mtu) \ 605*1dcdf01fSchristos SSL_ctrl((ssl),DTLS_CTRL_SET_LINK_MTU,(mtu),NULL) 606*1dcdf01fSchristos # define DTLS_get_link_min_mtu(ssl) \ 607*1dcdf01fSchristos SSL_ctrl((ssl),DTLS_CTRL_GET_LINK_MIN_MTU,0,NULL) 608*1dcdf01fSchristos 609*1dcdf01fSchristos # define SSL_get_secure_renegotiation_support(ssl) \ 610*1dcdf01fSchristos SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL) 611*1dcdf01fSchristos 612*1dcdf01fSchristos # ifndef OPENSSL_NO_HEARTBEATS 613*1dcdf01fSchristos # define SSL_heartbeat(ssl) \ 614*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_DTLS_EXT_SEND_HEARTBEAT,0,NULL) 615*1dcdf01fSchristos # endif 616*1dcdf01fSchristos 617*1dcdf01fSchristos # define SSL_CTX_set_cert_flags(ctx,op) \ 618*1dcdf01fSchristos SSL_CTX_ctrl((ctx),SSL_CTRL_CERT_FLAGS,(op),NULL) 619*1dcdf01fSchristos # define SSL_set_cert_flags(s,op) \ 620*1dcdf01fSchristos SSL_ctrl((s),SSL_CTRL_CERT_FLAGS,(op),NULL) 621*1dcdf01fSchristos # define SSL_CTX_clear_cert_flags(ctx,op) \ 622*1dcdf01fSchristos SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_CERT_FLAGS,(op),NULL) 623*1dcdf01fSchristos # define SSL_clear_cert_flags(s,op) \ 624*1dcdf01fSchristos SSL_ctrl((s),SSL_CTRL_CLEAR_CERT_FLAGS,(op),NULL) 625*1dcdf01fSchristos 626*1dcdf01fSchristos void SSL_CTX_set_msg_callback(SSL_CTX *ctx, 627*1dcdf01fSchristos void (*cb) (int write_p, int version, 628*1dcdf01fSchristos int content_type, const void *buf, 629*1dcdf01fSchristos size_t len, SSL *ssl, void *arg)); 630*1dcdf01fSchristos void SSL_set_msg_callback(SSL *ssl, 631*1dcdf01fSchristos void (*cb) (int write_p, int version, 632*1dcdf01fSchristos int content_type, const void *buf, 633*1dcdf01fSchristos size_t len, SSL *ssl, void *arg)); 634*1dcdf01fSchristos # define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg)) 635*1dcdf01fSchristos # define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg)) 636*1dcdf01fSchristos 637*1dcdf01fSchristos # define SSL_get_extms_support(s) \ 638*1dcdf01fSchristos SSL_ctrl((s),SSL_CTRL_GET_EXTMS_SUPPORT,0,NULL) 639*1dcdf01fSchristos 640*1dcdf01fSchristos # ifndef OPENSSL_NO_SRP 641*1dcdf01fSchristos 642*1dcdf01fSchristos /* see tls_srp.c */ 643*1dcdf01fSchristos __owur int SSL_SRP_CTX_init(SSL *s); 644*1dcdf01fSchristos __owur int SSL_CTX_SRP_CTX_init(SSL_CTX *ctx); 645*1dcdf01fSchristos int SSL_SRP_CTX_free(SSL *ctx); 646*1dcdf01fSchristos int SSL_CTX_SRP_CTX_free(SSL_CTX *ctx); 647*1dcdf01fSchristos __owur int SSL_srp_server_param_with_username(SSL *s, int *ad); 648*1dcdf01fSchristos __owur int SRP_Calc_A_param(SSL *s); 649*1dcdf01fSchristos 650*1dcdf01fSchristos # endif 651*1dcdf01fSchristos 652*1dcdf01fSchristos /* 100k max cert list */ 653*1dcdf01fSchristos # define SSL_MAX_CERT_LIST_DEFAULT 1024*100 654*1dcdf01fSchristos 655*1dcdf01fSchristos # define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT (1024*20) 656*1dcdf01fSchristos 657*1dcdf01fSchristos /* 658*1dcdf01fSchristos * This callback type is used inside SSL_CTX, SSL, and in the functions that 659*1dcdf01fSchristos * set them. It is used to override the generation of SSL/TLS session IDs in 660*1dcdf01fSchristos * a server. Return value should be zero on an error, non-zero to proceed. 661*1dcdf01fSchristos * Also, callbacks should themselves check if the id they generate is unique 662*1dcdf01fSchristos * otherwise the SSL handshake will fail with an error - callbacks can do 663*1dcdf01fSchristos * this using the 'ssl' value they're passed by; 664*1dcdf01fSchristos * SSL_has_matching_session_id(ssl, id, *id_len) The length value passed in 665*1dcdf01fSchristos * is set at the maximum size the session ID can be. In SSLv3/TLSv1 it is 32 666*1dcdf01fSchristos * bytes. The callback can alter this length to be less if desired. It is 667*1dcdf01fSchristos * also an error for the callback to set the size to zero. 668*1dcdf01fSchristos */ 669*1dcdf01fSchristos typedef int (*GEN_SESSION_CB) (SSL *ssl, unsigned char *id, 670*1dcdf01fSchristos unsigned int *id_len); 671*1dcdf01fSchristos 672*1dcdf01fSchristos # define SSL_SESS_CACHE_OFF 0x0000 673*1dcdf01fSchristos # define SSL_SESS_CACHE_CLIENT 0x0001 674*1dcdf01fSchristos # define SSL_SESS_CACHE_SERVER 0x0002 675*1dcdf01fSchristos # define SSL_SESS_CACHE_BOTH (SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER) 676*1dcdf01fSchristos # define SSL_SESS_CACHE_NO_AUTO_CLEAR 0x0080 677*1dcdf01fSchristos /* enough comments already ... see SSL_CTX_set_session_cache_mode(3) */ 678*1dcdf01fSchristos # define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP 0x0100 679*1dcdf01fSchristos # define SSL_SESS_CACHE_NO_INTERNAL_STORE 0x0200 680*1dcdf01fSchristos # define SSL_SESS_CACHE_NO_INTERNAL \ 681*1dcdf01fSchristos (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP|SSL_SESS_CACHE_NO_INTERNAL_STORE) 682*1dcdf01fSchristos 683*1dcdf01fSchristos LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx); 684*1dcdf01fSchristos # define SSL_CTX_sess_number(ctx) \ 685*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL) 686*1dcdf01fSchristos # define SSL_CTX_sess_connect(ctx) \ 687*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL) 688*1dcdf01fSchristos # define SSL_CTX_sess_connect_good(ctx) \ 689*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL) 690*1dcdf01fSchristos # define SSL_CTX_sess_connect_renegotiate(ctx) \ 691*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL) 692*1dcdf01fSchristos # define SSL_CTX_sess_accept(ctx) \ 693*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL) 694*1dcdf01fSchristos # define SSL_CTX_sess_accept_renegotiate(ctx) \ 695*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL) 696*1dcdf01fSchristos # define SSL_CTX_sess_accept_good(ctx) \ 697*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL) 698*1dcdf01fSchristos # define SSL_CTX_sess_hits(ctx) \ 699*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL) 700*1dcdf01fSchristos # define SSL_CTX_sess_cb_hits(ctx) \ 701*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL) 702*1dcdf01fSchristos # define SSL_CTX_sess_misses(ctx) \ 703*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL) 704*1dcdf01fSchristos # define SSL_CTX_sess_timeouts(ctx) \ 705*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL) 706*1dcdf01fSchristos # define SSL_CTX_sess_cache_full(ctx) \ 707*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL) 708*1dcdf01fSchristos 709*1dcdf01fSchristos void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, 710*1dcdf01fSchristos int (*new_session_cb) (struct ssl_st *ssl, 711*1dcdf01fSchristos SSL_SESSION *sess)); 712*1dcdf01fSchristos int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx)) (struct ssl_st *ssl, 713*1dcdf01fSchristos SSL_SESSION *sess); 714*1dcdf01fSchristos void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, 715*1dcdf01fSchristos void (*remove_session_cb) (struct ssl_ctx_st 716*1dcdf01fSchristos *ctx, 717*1dcdf01fSchristos SSL_SESSION *sess)); 718*1dcdf01fSchristos void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx)) (struct ssl_ctx_st *ctx, 719*1dcdf01fSchristos SSL_SESSION *sess); 720*1dcdf01fSchristos void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, 721*1dcdf01fSchristos SSL_SESSION *(*get_session_cb) (struct ssl_st 722*1dcdf01fSchristos *ssl, 723*1dcdf01fSchristos const unsigned char 724*1dcdf01fSchristos *data, int len, 725*1dcdf01fSchristos int *copy)); 726*1dcdf01fSchristos SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx)) (struct ssl_st *ssl, 727*1dcdf01fSchristos const unsigned char *data, 728*1dcdf01fSchristos int len, int *copy); 729*1dcdf01fSchristos void SSL_CTX_set_info_callback(SSL_CTX *ctx, 730*1dcdf01fSchristos void (*cb) (const SSL *ssl, int type, int val)); 731*1dcdf01fSchristos void (*SSL_CTX_get_info_callback(SSL_CTX *ctx)) (const SSL *ssl, int type, 732*1dcdf01fSchristos int val); 733*1dcdf01fSchristos void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, 734*1dcdf01fSchristos int (*client_cert_cb) (SSL *ssl, X509 **x509, 735*1dcdf01fSchristos EVP_PKEY **pkey)); 736*1dcdf01fSchristos int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx)) (SSL *ssl, X509 **x509, 737*1dcdf01fSchristos EVP_PKEY **pkey); 738*1dcdf01fSchristos # ifndef OPENSSL_NO_ENGINE 739*1dcdf01fSchristos __owur int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e); 740*1dcdf01fSchristos # endif 741*1dcdf01fSchristos void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, 742*1dcdf01fSchristos int (*app_gen_cookie_cb) (SSL *ssl, 743*1dcdf01fSchristos unsigned char 744*1dcdf01fSchristos *cookie, 745*1dcdf01fSchristos unsigned int 746*1dcdf01fSchristos *cookie_len)); 747*1dcdf01fSchristos void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, 748*1dcdf01fSchristos int (*app_verify_cookie_cb) (SSL *ssl, 749*1dcdf01fSchristos const unsigned 750*1dcdf01fSchristos char *cookie, 751*1dcdf01fSchristos unsigned int 752*1dcdf01fSchristos cookie_len)); 753*1dcdf01fSchristos 754*1dcdf01fSchristos void SSL_CTX_set_stateless_cookie_generate_cb( 755*1dcdf01fSchristos SSL_CTX *ctx, 756*1dcdf01fSchristos int (*gen_stateless_cookie_cb) (SSL *ssl, 757*1dcdf01fSchristos unsigned char *cookie, 758*1dcdf01fSchristos size_t *cookie_len)); 759*1dcdf01fSchristos void SSL_CTX_set_stateless_cookie_verify_cb( 760*1dcdf01fSchristos SSL_CTX *ctx, 761*1dcdf01fSchristos int (*verify_stateless_cookie_cb) (SSL *ssl, 762*1dcdf01fSchristos const unsigned char *cookie, 763*1dcdf01fSchristos size_t cookie_len)); 764*1dcdf01fSchristos # ifndef OPENSSL_NO_NEXTPROTONEG 765*1dcdf01fSchristos 766*1dcdf01fSchristos typedef int (*SSL_CTX_npn_advertised_cb_func)(SSL *ssl, 767*1dcdf01fSchristos const unsigned char **out, 768*1dcdf01fSchristos unsigned int *outlen, 769*1dcdf01fSchristos void *arg); 770*1dcdf01fSchristos void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *s, 771*1dcdf01fSchristos SSL_CTX_npn_advertised_cb_func cb, 772*1dcdf01fSchristos void *arg); 773*1dcdf01fSchristos # define SSL_CTX_set_npn_advertised_cb SSL_CTX_set_next_protos_advertised_cb 774*1dcdf01fSchristos 775*1dcdf01fSchristos typedef int (*SSL_CTX_npn_select_cb_func)(SSL *s, 776*1dcdf01fSchristos unsigned char **out, 777*1dcdf01fSchristos unsigned char *outlen, 778*1dcdf01fSchristos const unsigned char *in, 779*1dcdf01fSchristos unsigned int inlen, 780*1dcdf01fSchristos void *arg); 781*1dcdf01fSchristos void SSL_CTX_set_next_proto_select_cb(SSL_CTX *s, 782*1dcdf01fSchristos SSL_CTX_npn_select_cb_func cb, 783*1dcdf01fSchristos void *arg); 784*1dcdf01fSchristos # define SSL_CTX_set_npn_select_cb SSL_CTX_set_next_proto_select_cb 785*1dcdf01fSchristos 786*1dcdf01fSchristos void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, 787*1dcdf01fSchristos unsigned *len); 788*1dcdf01fSchristos # define SSL_get0_npn_negotiated SSL_get0_next_proto_negotiated 789*1dcdf01fSchristos # endif 790*1dcdf01fSchristos 791*1dcdf01fSchristos __owur int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, 792*1dcdf01fSchristos const unsigned char *in, unsigned int inlen, 793*1dcdf01fSchristos const unsigned char *client, 794*1dcdf01fSchristos unsigned int client_len); 795*1dcdf01fSchristos 796*1dcdf01fSchristos # define OPENSSL_NPN_UNSUPPORTED 0 797*1dcdf01fSchristos # define OPENSSL_NPN_NEGOTIATED 1 798*1dcdf01fSchristos # define OPENSSL_NPN_NO_OVERLAP 2 799*1dcdf01fSchristos 800*1dcdf01fSchristos __owur int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, 801*1dcdf01fSchristos unsigned int protos_len); 802*1dcdf01fSchristos __owur int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos, 803*1dcdf01fSchristos unsigned int protos_len); 804*1dcdf01fSchristos typedef int (*SSL_CTX_alpn_select_cb_func)(SSL *ssl, 805*1dcdf01fSchristos const unsigned char **out, 806*1dcdf01fSchristos unsigned char *outlen, 807*1dcdf01fSchristos const unsigned char *in, 808*1dcdf01fSchristos unsigned int inlen, 809*1dcdf01fSchristos void *arg); 810*1dcdf01fSchristos void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, 811*1dcdf01fSchristos SSL_CTX_alpn_select_cb_func cb, 812*1dcdf01fSchristos void *arg); 813*1dcdf01fSchristos void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, 814*1dcdf01fSchristos unsigned int *len); 815*1dcdf01fSchristos 816*1dcdf01fSchristos # ifndef OPENSSL_NO_PSK 817*1dcdf01fSchristos /* 818*1dcdf01fSchristos * the maximum length of the buffer given to callbacks containing the 819*1dcdf01fSchristos * resulting identity/psk 820*1dcdf01fSchristos */ 821*1dcdf01fSchristos # define PSK_MAX_IDENTITY_LEN 128 822*1dcdf01fSchristos # define PSK_MAX_PSK_LEN 256 823*1dcdf01fSchristos typedef unsigned int (*SSL_psk_client_cb_func)(SSL *ssl, 824*1dcdf01fSchristos const char *hint, 825*1dcdf01fSchristos char *identity, 826*1dcdf01fSchristos unsigned int max_identity_len, 827*1dcdf01fSchristos unsigned char *psk, 828*1dcdf01fSchristos unsigned int max_psk_len); 829*1dcdf01fSchristos void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb); 830*1dcdf01fSchristos void SSL_set_psk_client_callback(SSL *ssl, SSL_psk_client_cb_func cb); 831*1dcdf01fSchristos 832*1dcdf01fSchristos typedef unsigned int (*SSL_psk_server_cb_func)(SSL *ssl, 833*1dcdf01fSchristos const char *identity, 834*1dcdf01fSchristos unsigned char *psk, 835*1dcdf01fSchristos unsigned int max_psk_len); 836*1dcdf01fSchristos void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb); 837*1dcdf01fSchristos void SSL_set_psk_server_callback(SSL *ssl, SSL_psk_server_cb_func cb); 838*1dcdf01fSchristos 839*1dcdf01fSchristos __owur int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint); 840*1dcdf01fSchristos __owur int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint); 841*1dcdf01fSchristos const char *SSL_get_psk_identity_hint(const SSL *s); 842*1dcdf01fSchristos const char *SSL_get_psk_identity(const SSL *s); 843*1dcdf01fSchristos # endif 844*1dcdf01fSchristos 845*1dcdf01fSchristos typedef int (*SSL_psk_find_session_cb_func)(SSL *ssl, 846*1dcdf01fSchristos const unsigned char *identity, 847*1dcdf01fSchristos size_t identity_len, 848*1dcdf01fSchristos SSL_SESSION **sess); 849*1dcdf01fSchristos typedef int (*SSL_psk_use_session_cb_func)(SSL *ssl, const EVP_MD *md, 850*1dcdf01fSchristos const unsigned char **id, 851*1dcdf01fSchristos size_t *idlen, 852*1dcdf01fSchristos SSL_SESSION **sess); 853*1dcdf01fSchristos 854*1dcdf01fSchristos void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb); 855*1dcdf01fSchristos void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx, 856*1dcdf01fSchristos SSL_psk_find_session_cb_func cb); 857*1dcdf01fSchristos void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb); 858*1dcdf01fSchristos void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx, 859*1dcdf01fSchristos SSL_psk_use_session_cb_func cb); 860*1dcdf01fSchristos 861*1dcdf01fSchristos /* Register callbacks to handle custom TLS Extensions for client or server. */ 862*1dcdf01fSchristos 863*1dcdf01fSchristos __owur int SSL_CTX_has_client_custom_ext(const SSL_CTX *ctx, 864*1dcdf01fSchristos unsigned int ext_type); 865*1dcdf01fSchristos 866*1dcdf01fSchristos __owur int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, 867*1dcdf01fSchristos unsigned int ext_type, 868*1dcdf01fSchristos custom_ext_add_cb add_cb, 869*1dcdf01fSchristos custom_ext_free_cb free_cb, 870*1dcdf01fSchristos void *add_arg, 871*1dcdf01fSchristos custom_ext_parse_cb parse_cb, 872*1dcdf01fSchristos void *parse_arg); 873*1dcdf01fSchristos 874*1dcdf01fSchristos __owur int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, 875*1dcdf01fSchristos unsigned int ext_type, 876*1dcdf01fSchristos custom_ext_add_cb add_cb, 877*1dcdf01fSchristos custom_ext_free_cb free_cb, 878*1dcdf01fSchristos void *add_arg, 879*1dcdf01fSchristos custom_ext_parse_cb parse_cb, 880*1dcdf01fSchristos void *parse_arg); 881*1dcdf01fSchristos 882*1dcdf01fSchristos __owur int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type, 883*1dcdf01fSchristos unsigned int context, 884*1dcdf01fSchristos SSL_custom_ext_add_cb_ex add_cb, 885*1dcdf01fSchristos SSL_custom_ext_free_cb_ex free_cb, 886*1dcdf01fSchristos void *add_arg, 887*1dcdf01fSchristos SSL_custom_ext_parse_cb_ex parse_cb, 888*1dcdf01fSchristos void *parse_arg); 889*1dcdf01fSchristos 890*1dcdf01fSchristos __owur int SSL_extension_supported(unsigned int ext_type); 891*1dcdf01fSchristos 892*1dcdf01fSchristos # define SSL_NOTHING 1 893*1dcdf01fSchristos # define SSL_WRITING 2 894*1dcdf01fSchristos # define SSL_READING 3 895*1dcdf01fSchristos # define SSL_X509_LOOKUP 4 896*1dcdf01fSchristos # define SSL_ASYNC_PAUSED 5 897*1dcdf01fSchristos # define SSL_ASYNC_NO_JOBS 6 898*1dcdf01fSchristos # define SSL_CLIENT_HELLO_CB 7 899*1dcdf01fSchristos 900*1dcdf01fSchristos /* These will only be used when doing non-blocking IO */ 901*1dcdf01fSchristos # define SSL_want_nothing(s) (SSL_want(s) == SSL_NOTHING) 902*1dcdf01fSchristos # define SSL_want_read(s) (SSL_want(s) == SSL_READING) 903*1dcdf01fSchristos # define SSL_want_write(s) (SSL_want(s) == SSL_WRITING) 904*1dcdf01fSchristos # define SSL_want_x509_lookup(s) (SSL_want(s) == SSL_X509_LOOKUP) 905*1dcdf01fSchristos # define SSL_want_async(s) (SSL_want(s) == SSL_ASYNC_PAUSED) 906*1dcdf01fSchristos # define SSL_want_async_job(s) (SSL_want(s) == SSL_ASYNC_NO_JOBS) 907*1dcdf01fSchristos # define SSL_want_client_hello_cb(s) (SSL_want(s) == SSL_CLIENT_HELLO_CB) 908*1dcdf01fSchristos 909*1dcdf01fSchristos # define SSL_MAC_FLAG_READ_MAC_STREAM 1 910*1dcdf01fSchristos # define SSL_MAC_FLAG_WRITE_MAC_STREAM 2 911*1dcdf01fSchristos 912*1dcdf01fSchristos /* 913*1dcdf01fSchristos * A callback for logging out TLS key material. This callback should log out 914*1dcdf01fSchristos * |line| followed by a newline. 915*1dcdf01fSchristos */ 916*1dcdf01fSchristos typedef void (*SSL_CTX_keylog_cb_func)(const SSL *ssl, const char *line); 917*1dcdf01fSchristos 918*1dcdf01fSchristos /* 919*1dcdf01fSchristos * SSL_CTX_set_keylog_callback configures a callback to log key material. This 920*1dcdf01fSchristos * is intended for debugging use with tools like Wireshark. The cb function 921*1dcdf01fSchristos * should log line followed by a newline. 922*1dcdf01fSchristos */ 923*1dcdf01fSchristos void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb); 924*1dcdf01fSchristos 925*1dcdf01fSchristos /* 926*1dcdf01fSchristos * SSL_CTX_get_keylog_callback returns the callback configured by 927*1dcdf01fSchristos * SSL_CTX_set_keylog_callback. 928*1dcdf01fSchristos */ 929*1dcdf01fSchristos SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx); 930*1dcdf01fSchristos 931*1dcdf01fSchristos int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data); 932*1dcdf01fSchristos uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx); 933*1dcdf01fSchristos int SSL_set_max_early_data(SSL *s, uint32_t max_early_data); 934*1dcdf01fSchristos uint32_t SSL_get_max_early_data(const SSL *s); 935*1dcdf01fSchristos int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data); 936*1dcdf01fSchristos uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx); 937*1dcdf01fSchristos int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data); 938*1dcdf01fSchristos uint32_t SSL_get_recv_max_early_data(const SSL *s); 939*1dcdf01fSchristos 940*1dcdf01fSchristos #ifdef __cplusplus 941*1dcdf01fSchristos } 942*1dcdf01fSchristos #endif 943*1dcdf01fSchristos 944*1dcdf01fSchristos # include <openssl/ssl2.h> 945*1dcdf01fSchristos # include <openssl/ssl3.h> 946*1dcdf01fSchristos # include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */ 947*1dcdf01fSchristos # include <openssl/dtls1.h> /* Datagram TLS */ 948*1dcdf01fSchristos # include <openssl/srtp.h> /* Support for the use_srtp extension */ 949*1dcdf01fSchristos 950*1dcdf01fSchristos #ifdef __cplusplus 951*1dcdf01fSchristos extern "C" { 952*1dcdf01fSchristos #endif 953*1dcdf01fSchristos 954*1dcdf01fSchristos /* 955*1dcdf01fSchristos * These need to be after the above set of includes due to a compiler bug 956*1dcdf01fSchristos * in VisualStudio 2015 957*1dcdf01fSchristos */ 958*1dcdf01fSchristos DEFINE_STACK_OF_CONST(SSL_CIPHER) 959*1dcdf01fSchristos DEFINE_STACK_OF(SSL_COMP) 960*1dcdf01fSchristos 961*1dcdf01fSchristos /* compatibility */ 962*1dcdf01fSchristos # define SSL_set_app_data(s,arg) (SSL_set_ex_data(s,0,(char *)(arg))) 963*1dcdf01fSchristos # define SSL_get_app_data(s) (SSL_get_ex_data(s,0)) 964*1dcdf01fSchristos # define SSL_SESSION_set_app_data(s,a) (SSL_SESSION_set_ex_data(s,0, \ 965*1dcdf01fSchristos (char *)(a))) 966*1dcdf01fSchristos # define SSL_SESSION_get_app_data(s) (SSL_SESSION_get_ex_data(s,0)) 967*1dcdf01fSchristos # define SSL_CTX_get_app_data(ctx) (SSL_CTX_get_ex_data(ctx,0)) 968*1dcdf01fSchristos # define SSL_CTX_set_app_data(ctx,arg) (SSL_CTX_set_ex_data(ctx,0, \ 969*1dcdf01fSchristos (char *)(arg))) 970*1dcdf01fSchristos DEPRECATEDIN_1_1_0(void SSL_set_debug(SSL *s, int debug)) 971*1dcdf01fSchristos 972*1dcdf01fSchristos /* TLSv1.3 KeyUpdate message types */ 973*1dcdf01fSchristos /* -1 used so that this is an invalid value for the on-the-wire protocol */ 974*1dcdf01fSchristos #define SSL_KEY_UPDATE_NONE -1 975*1dcdf01fSchristos /* Values as defined for the on-the-wire protocol */ 976*1dcdf01fSchristos #define SSL_KEY_UPDATE_NOT_REQUESTED 0 977*1dcdf01fSchristos #define SSL_KEY_UPDATE_REQUESTED 1 978*1dcdf01fSchristos 979*1dcdf01fSchristos /* 980*1dcdf01fSchristos * The valid handshake states (one for each type message sent and one for each 981*1dcdf01fSchristos * type of message received). There are also two "special" states: 982*1dcdf01fSchristos * TLS = TLS or DTLS state 983*1dcdf01fSchristos * DTLS = DTLS specific state 984*1dcdf01fSchristos * CR/SR = Client Read/Server Read 985*1dcdf01fSchristos * CW/SW = Client Write/Server Write 986*1dcdf01fSchristos * 987*1dcdf01fSchristos * The "special" states are: 988*1dcdf01fSchristos * TLS_ST_BEFORE = No handshake has been initiated yet 989*1dcdf01fSchristos * TLS_ST_OK = A handshake has been successfully completed 990*1dcdf01fSchristos */ 991*1dcdf01fSchristos typedef enum { 992*1dcdf01fSchristos TLS_ST_BEFORE, 993*1dcdf01fSchristos TLS_ST_OK, 994*1dcdf01fSchristos DTLS_ST_CR_HELLO_VERIFY_REQUEST, 995*1dcdf01fSchristos TLS_ST_CR_SRVR_HELLO, 996*1dcdf01fSchristos TLS_ST_CR_CERT, 997*1dcdf01fSchristos TLS_ST_CR_CERT_STATUS, 998*1dcdf01fSchristos TLS_ST_CR_KEY_EXCH, 999*1dcdf01fSchristos TLS_ST_CR_CERT_REQ, 1000*1dcdf01fSchristos TLS_ST_CR_SRVR_DONE, 1001*1dcdf01fSchristos TLS_ST_CR_SESSION_TICKET, 1002*1dcdf01fSchristos TLS_ST_CR_CHANGE, 1003*1dcdf01fSchristos TLS_ST_CR_FINISHED, 1004*1dcdf01fSchristos TLS_ST_CW_CLNT_HELLO, 1005*1dcdf01fSchristos TLS_ST_CW_CERT, 1006*1dcdf01fSchristos TLS_ST_CW_KEY_EXCH, 1007*1dcdf01fSchristos TLS_ST_CW_CERT_VRFY, 1008*1dcdf01fSchristos TLS_ST_CW_CHANGE, 1009*1dcdf01fSchristos TLS_ST_CW_NEXT_PROTO, 1010*1dcdf01fSchristos TLS_ST_CW_FINISHED, 1011*1dcdf01fSchristos TLS_ST_SW_HELLO_REQ, 1012*1dcdf01fSchristos TLS_ST_SR_CLNT_HELLO, 1013*1dcdf01fSchristos DTLS_ST_SW_HELLO_VERIFY_REQUEST, 1014*1dcdf01fSchristos TLS_ST_SW_SRVR_HELLO, 1015*1dcdf01fSchristos TLS_ST_SW_CERT, 1016*1dcdf01fSchristos TLS_ST_SW_KEY_EXCH, 1017*1dcdf01fSchristos TLS_ST_SW_CERT_REQ, 1018*1dcdf01fSchristos TLS_ST_SW_SRVR_DONE, 1019*1dcdf01fSchristos TLS_ST_SR_CERT, 1020*1dcdf01fSchristos TLS_ST_SR_KEY_EXCH, 1021*1dcdf01fSchristos TLS_ST_SR_CERT_VRFY, 1022*1dcdf01fSchristos TLS_ST_SR_NEXT_PROTO, 1023*1dcdf01fSchristos TLS_ST_SR_CHANGE, 1024*1dcdf01fSchristos TLS_ST_SR_FINISHED, 1025*1dcdf01fSchristos TLS_ST_SW_SESSION_TICKET, 1026*1dcdf01fSchristos TLS_ST_SW_CERT_STATUS, 1027*1dcdf01fSchristos TLS_ST_SW_CHANGE, 1028*1dcdf01fSchristos TLS_ST_SW_FINISHED, 1029*1dcdf01fSchristos TLS_ST_SW_ENCRYPTED_EXTENSIONS, 1030*1dcdf01fSchristos TLS_ST_CR_ENCRYPTED_EXTENSIONS, 1031*1dcdf01fSchristos TLS_ST_CR_CERT_VRFY, 1032*1dcdf01fSchristos TLS_ST_SW_CERT_VRFY, 1033*1dcdf01fSchristos TLS_ST_CR_HELLO_REQ, 1034*1dcdf01fSchristos TLS_ST_SW_KEY_UPDATE, 1035*1dcdf01fSchristos TLS_ST_CW_KEY_UPDATE, 1036*1dcdf01fSchristos TLS_ST_SR_KEY_UPDATE, 1037*1dcdf01fSchristos TLS_ST_CR_KEY_UPDATE, 1038*1dcdf01fSchristos TLS_ST_EARLY_DATA, 1039*1dcdf01fSchristos TLS_ST_PENDING_EARLY_DATA_END, 1040*1dcdf01fSchristos TLS_ST_CW_END_OF_EARLY_DATA, 1041*1dcdf01fSchristos TLS_ST_SR_END_OF_EARLY_DATA 1042*1dcdf01fSchristos } OSSL_HANDSHAKE_STATE; 1043*1dcdf01fSchristos 1044*1dcdf01fSchristos /* 1045*1dcdf01fSchristos * Most of the following state values are no longer used and are defined to be 1046*1dcdf01fSchristos * the closest equivalent value in the current state machine code. Not all 1047*1dcdf01fSchristos * defines have an equivalent and are set to a dummy value (-1). SSL_ST_CONNECT 1048*1dcdf01fSchristos * and SSL_ST_ACCEPT are still in use in the definition of SSL_CB_ACCEPT_LOOP, 1049*1dcdf01fSchristos * SSL_CB_ACCEPT_EXIT, SSL_CB_CONNECT_LOOP and SSL_CB_CONNECT_EXIT. 1050*1dcdf01fSchristos */ 1051*1dcdf01fSchristos 1052*1dcdf01fSchristos # define SSL_ST_CONNECT 0x1000 1053*1dcdf01fSchristos # define SSL_ST_ACCEPT 0x2000 1054*1dcdf01fSchristos 1055*1dcdf01fSchristos # define SSL_ST_MASK 0x0FFF 1056*1dcdf01fSchristos 1057*1dcdf01fSchristos # define SSL_CB_LOOP 0x01 1058*1dcdf01fSchristos # define SSL_CB_EXIT 0x02 1059*1dcdf01fSchristos # define SSL_CB_READ 0x04 1060*1dcdf01fSchristos # define SSL_CB_WRITE 0x08 1061*1dcdf01fSchristos # define SSL_CB_ALERT 0x4000/* used in callback */ 1062*1dcdf01fSchristos # define SSL_CB_READ_ALERT (SSL_CB_ALERT|SSL_CB_READ) 1063*1dcdf01fSchristos # define SSL_CB_WRITE_ALERT (SSL_CB_ALERT|SSL_CB_WRITE) 1064*1dcdf01fSchristos # define SSL_CB_ACCEPT_LOOP (SSL_ST_ACCEPT|SSL_CB_LOOP) 1065*1dcdf01fSchristos # define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT|SSL_CB_EXIT) 1066*1dcdf01fSchristos # define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT|SSL_CB_LOOP) 1067*1dcdf01fSchristos # define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT|SSL_CB_EXIT) 1068*1dcdf01fSchristos # define SSL_CB_HANDSHAKE_START 0x10 1069*1dcdf01fSchristos # define SSL_CB_HANDSHAKE_DONE 0x20 1070*1dcdf01fSchristos 1071*1dcdf01fSchristos /* Is the SSL_connection established? */ 1072*1dcdf01fSchristos # define SSL_in_connect_init(a) (SSL_in_init(a) && !SSL_is_server(a)) 1073*1dcdf01fSchristos # define SSL_in_accept_init(a) (SSL_in_init(a) && SSL_is_server(a)) 1074*1dcdf01fSchristos int SSL_in_init(const SSL *s); 1075*1dcdf01fSchristos int SSL_in_before(const SSL *s); 1076*1dcdf01fSchristos int SSL_is_init_finished(const SSL *s); 1077*1dcdf01fSchristos 1078*1dcdf01fSchristos /* 1079*1dcdf01fSchristos * The following 3 states are kept in ssl->rlayer.rstate when reads fail, you 1080*1dcdf01fSchristos * should not need these 1081*1dcdf01fSchristos */ 1082*1dcdf01fSchristos # define SSL_ST_READ_HEADER 0xF0 1083*1dcdf01fSchristos # define SSL_ST_READ_BODY 0xF1 1084*1dcdf01fSchristos # define SSL_ST_READ_DONE 0xF2 1085*1dcdf01fSchristos 1086*1dcdf01fSchristos /*- 1087*1dcdf01fSchristos * Obtain latest Finished message 1088*1dcdf01fSchristos * -- that we sent (SSL_get_finished) 1089*1dcdf01fSchristos * -- that we expected from peer (SSL_get_peer_finished). 1090*1dcdf01fSchristos * Returns length (0 == no Finished so far), copies up to 'count' bytes. 1091*1dcdf01fSchristos */ 1092*1dcdf01fSchristos size_t SSL_get_finished(const SSL *s, void *buf, size_t count); 1093*1dcdf01fSchristos size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count); 1094*1dcdf01fSchristos 1095*1dcdf01fSchristos /* 1096*1dcdf01fSchristos * use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 3 options are 1097*1dcdf01fSchristos * 'ored' with SSL_VERIFY_PEER if they are desired 1098*1dcdf01fSchristos */ 1099*1dcdf01fSchristos # define SSL_VERIFY_NONE 0x00 1100*1dcdf01fSchristos # define SSL_VERIFY_PEER 0x01 1101*1dcdf01fSchristos # define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02 1102*1dcdf01fSchristos # define SSL_VERIFY_CLIENT_ONCE 0x04 1103*1dcdf01fSchristos # define SSL_VERIFY_POST_HANDSHAKE 0x08 1104*1dcdf01fSchristos 1105*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 1106*1dcdf01fSchristos # define OpenSSL_add_ssl_algorithms() SSL_library_init() 1107*1dcdf01fSchristos # define SSLeay_add_ssl_algorithms() SSL_library_init() 1108*1dcdf01fSchristos # endif 1109*1dcdf01fSchristos 1110*1dcdf01fSchristos /* More backward compatibility */ 1111*1dcdf01fSchristos # define SSL_get_cipher(s) \ 1112*1dcdf01fSchristos SSL_CIPHER_get_name(SSL_get_current_cipher(s)) 1113*1dcdf01fSchristos # define SSL_get_cipher_bits(s,np) \ 1114*1dcdf01fSchristos SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np) 1115*1dcdf01fSchristos # define SSL_get_cipher_version(s) \ 1116*1dcdf01fSchristos SSL_CIPHER_get_version(SSL_get_current_cipher(s)) 1117*1dcdf01fSchristos # define SSL_get_cipher_name(s) \ 1118*1dcdf01fSchristos SSL_CIPHER_get_name(SSL_get_current_cipher(s)) 1119*1dcdf01fSchristos # define SSL_get_time(a) SSL_SESSION_get_time(a) 1120*1dcdf01fSchristos # define SSL_set_time(a,b) SSL_SESSION_set_time((a),(b)) 1121*1dcdf01fSchristos # define SSL_get_timeout(a) SSL_SESSION_get_timeout(a) 1122*1dcdf01fSchristos # define SSL_set_timeout(a,b) SSL_SESSION_set_timeout((a),(b)) 1123*1dcdf01fSchristos 1124*1dcdf01fSchristos # define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id) 1125*1dcdf01fSchristos # define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id) 1126*1dcdf01fSchristos 1127*1dcdf01fSchristos DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) 1128*1dcdf01fSchristos # define SSL_AD_REASON_OFFSET 1000/* offset to get SSL_R_... value 1129*1dcdf01fSchristos * from SSL_AD_... */ 1130*1dcdf01fSchristos /* These alert types are for SSLv3 and TLSv1 */ 1131*1dcdf01fSchristos # define SSL_AD_CLOSE_NOTIFY SSL3_AD_CLOSE_NOTIFY 1132*1dcdf01fSchristos /* fatal */ 1133*1dcdf01fSchristos # define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE 1134*1dcdf01fSchristos /* fatal */ 1135*1dcdf01fSchristos # define SSL_AD_BAD_RECORD_MAC SSL3_AD_BAD_RECORD_MAC 1136*1dcdf01fSchristos # define SSL_AD_DECRYPTION_FAILED TLS1_AD_DECRYPTION_FAILED 1137*1dcdf01fSchristos # define SSL_AD_RECORD_OVERFLOW TLS1_AD_RECORD_OVERFLOW 1138*1dcdf01fSchristos /* fatal */ 1139*1dcdf01fSchristos # define SSL_AD_DECOMPRESSION_FAILURE SSL3_AD_DECOMPRESSION_FAILURE 1140*1dcdf01fSchristos /* fatal */ 1141*1dcdf01fSchristos # define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE 1142*1dcdf01fSchristos /* Not for TLS */ 1143*1dcdf01fSchristos # define SSL_AD_NO_CERTIFICATE SSL3_AD_NO_CERTIFICATE 1144*1dcdf01fSchristos # define SSL_AD_BAD_CERTIFICATE SSL3_AD_BAD_CERTIFICATE 1145*1dcdf01fSchristos # define SSL_AD_UNSUPPORTED_CERTIFICATE SSL3_AD_UNSUPPORTED_CERTIFICATE 1146*1dcdf01fSchristos # define SSL_AD_CERTIFICATE_REVOKED SSL3_AD_CERTIFICATE_REVOKED 1147*1dcdf01fSchristos # define SSL_AD_CERTIFICATE_EXPIRED SSL3_AD_CERTIFICATE_EXPIRED 1148*1dcdf01fSchristos # define SSL_AD_CERTIFICATE_UNKNOWN SSL3_AD_CERTIFICATE_UNKNOWN 1149*1dcdf01fSchristos /* fatal */ 1150*1dcdf01fSchristos # define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER 1151*1dcdf01fSchristos /* fatal */ 1152*1dcdf01fSchristos # define SSL_AD_UNKNOWN_CA TLS1_AD_UNKNOWN_CA 1153*1dcdf01fSchristos /* fatal */ 1154*1dcdf01fSchristos # define SSL_AD_ACCESS_DENIED TLS1_AD_ACCESS_DENIED 1155*1dcdf01fSchristos /* fatal */ 1156*1dcdf01fSchristos # define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR 1157*1dcdf01fSchristos # define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR 1158*1dcdf01fSchristos /* fatal */ 1159*1dcdf01fSchristos # define SSL_AD_EXPORT_RESTRICTION TLS1_AD_EXPORT_RESTRICTION 1160*1dcdf01fSchristos /* fatal */ 1161*1dcdf01fSchristos # define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION 1162*1dcdf01fSchristos /* fatal */ 1163*1dcdf01fSchristos # define SSL_AD_INSUFFICIENT_SECURITY TLS1_AD_INSUFFICIENT_SECURITY 1164*1dcdf01fSchristos /* fatal */ 1165*1dcdf01fSchristos # define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR 1166*1dcdf01fSchristos # define SSL_AD_USER_CANCELLED TLS1_AD_USER_CANCELLED 1167*1dcdf01fSchristos # define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION 1168*1dcdf01fSchristos # define SSL_AD_MISSING_EXTENSION TLS13_AD_MISSING_EXTENSION 1169*1dcdf01fSchristos # define SSL_AD_CERTIFICATE_REQUIRED TLS13_AD_CERTIFICATE_REQUIRED 1170*1dcdf01fSchristos # define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION 1171*1dcdf01fSchristos # define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE 1172*1dcdf01fSchristos # define SSL_AD_UNRECOGNIZED_NAME TLS1_AD_UNRECOGNIZED_NAME 1173*1dcdf01fSchristos # define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 1174*1dcdf01fSchristos # define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 1175*1dcdf01fSchristos /* fatal */ 1176*1dcdf01fSchristos # define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY 1177*1dcdf01fSchristos /* fatal */ 1178*1dcdf01fSchristos # define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK 1179*1dcdf01fSchristos # define SSL_AD_NO_APPLICATION_PROTOCOL TLS1_AD_NO_APPLICATION_PROTOCOL 1180*1dcdf01fSchristos # define SSL_ERROR_NONE 0 1181*1dcdf01fSchristos # define SSL_ERROR_SSL 1 1182*1dcdf01fSchristos # define SSL_ERROR_WANT_READ 2 1183*1dcdf01fSchristos # define SSL_ERROR_WANT_WRITE 3 1184*1dcdf01fSchristos # define SSL_ERROR_WANT_X509_LOOKUP 4 1185*1dcdf01fSchristos # define SSL_ERROR_SYSCALL 5/* look at error stack/return 1186*1dcdf01fSchristos * value/errno */ 1187*1dcdf01fSchristos # define SSL_ERROR_ZERO_RETURN 6 1188*1dcdf01fSchristos # define SSL_ERROR_WANT_CONNECT 7 1189*1dcdf01fSchristos # define SSL_ERROR_WANT_ACCEPT 8 1190*1dcdf01fSchristos # define SSL_ERROR_WANT_ASYNC 9 1191*1dcdf01fSchristos # define SSL_ERROR_WANT_ASYNC_JOB 10 1192*1dcdf01fSchristos # define SSL_ERROR_WANT_CLIENT_HELLO_CB 11 1193*1dcdf01fSchristos # define SSL_CTRL_SET_TMP_DH 3 1194*1dcdf01fSchristos # define SSL_CTRL_SET_TMP_ECDH 4 1195*1dcdf01fSchristos # define SSL_CTRL_SET_TMP_DH_CB 6 1196*1dcdf01fSchristos # define SSL_CTRL_GET_CLIENT_CERT_REQUEST 9 1197*1dcdf01fSchristos # define SSL_CTRL_GET_NUM_RENEGOTIATIONS 10 1198*1dcdf01fSchristos # define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS 11 1199*1dcdf01fSchristos # define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS 12 1200*1dcdf01fSchristos # define SSL_CTRL_GET_FLAGS 13 1201*1dcdf01fSchristos # define SSL_CTRL_EXTRA_CHAIN_CERT 14 1202*1dcdf01fSchristos # define SSL_CTRL_SET_MSG_CALLBACK 15 1203*1dcdf01fSchristos # define SSL_CTRL_SET_MSG_CALLBACK_ARG 16 1204*1dcdf01fSchristos /* only applies to datagram connections */ 1205*1dcdf01fSchristos # define SSL_CTRL_SET_MTU 17 1206*1dcdf01fSchristos /* Stats */ 1207*1dcdf01fSchristos # define SSL_CTRL_SESS_NUMBER 20 1208*1dcdf01fSchristos # define SSL_CTRL_SESS_CONNECT 21 1209*1dcdf01fSchristos # define SSL_CTRL_SESS_CONNECT_GOOD 22 1210*1dcdf01fSchristos # define SSL_CTRL_SESS_CONNECT_RENEGOTIATE 23 1211*1dcdf01fSchristos # define SSL_CTRL_SESS_ACCEPT 24 1212*1dcdf01fSchristos # define SSL_CTRL_SESS_ACCEPT_GOOD 25 1213*1dcdf01fSchristos # define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE 26 1214*1dcdf01fSchristos # define SSL_CTRL_SESS_HIT 27 1215*1dcdf01fSchristos # define SSL_CTRL_SESS_CB_HIT 28 1216*1dcdf01fSchristos # define SSL_CTRL_SESS_MISSES 29 1217*1dcdf01fSchristos # define SSL_CTRL_SESS_TIMEOUTS 30 1218*1dcdf01fSchristos # define SSL_CTRL_SESS_CACHE_FULL 31 1219*1dcdf01fSchristos # define SSL_CTRL_MODE 33 1220*1dcdf01fSchristos # define SSL_CTRL_GET_READ_AHEAD 40 1221*1dcdf01fSchristos # define SSL_CTRL_SET_READ_AHEAD 41 1222*1dcdf01fSchristos # define SSL_CTRL_SET_SESS_CACHE_SIZE 42 1223*1dcdf01fSchristos # define SSL_CTRL_GET_SESS_CACHE_SIZE 43 1224*1dcdf01fSchristos # define SSL_CTRL_SET_SESS_CACHE_MODE 44 1225*1dcdf01fSchristos # define SSL_CTRL_GET_SESS_CACHE_MODE 45 1226*1dcdf01fSchristos # define SSL_CTRL_GET_MAX_CERT_LIST 50 1227*1dcdf01fSchristos # define SSL_CTRL_SET_MAX_CERT_LIST 51 1228*1dcdf01fSchristos # define SSL_CTRL_SET_MAX_SEND_FRAGMENT 52 1229*1dcdf01fSchristos /* see tls1.h for macros based on these */ 1230*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_SERVERNAME_CB 53 1231*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG 54 1232*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_HOSTNAME 55 1233*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_DEBUG_CB 56 1234*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_DEBUG_ARG 57 1235*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_TICKET_KEYS 58 1236*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_TICKET_KEYS 59 1237*1dcdf01fSchristos /*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT 60 */ 1238*1dcdf01fSchristos /*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB 61 */ 1239*1dcdf01fSchristos /*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG 62 */ 1240*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB 63 1241*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG 64 1242*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE 65 1243*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS 66 1244*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS 67 1245*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS 68 1246*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS 69 1247*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP 70 1248*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP 71 1249*1dcdf01fSchristos # define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB 72 1250*1dcdf01fSchristos # define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB 75 1251*1dcdf01fSchristos # define SSL_CTRL_SET_SRP_VERIFY_PARAM_CB 76 1252*1dcdf01fSchristos # define SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB 77 1253*1dcdf01fSchristos # define SSL_CTRL_SET_SRP_ARG 78 1254*1dcdf01fSchristos # define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME 79 1255*1dcdf01fSchristos # define SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH 80 1256*1dcdf01fSchristos # define SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD 81 1257*1dcdf01fSchristos # ifndef OPENSSL_NO_HEARTBEATS 1258*1dcdf01fSchristos # define SSL_CTRL_DTLS_EXT_SEND_HEARTBEAT 85 1259*1dcdf01fSchristos # define SSL_CTRL_GET_DTLS_EXT_HEARTBEAT_PENDING 86 1260*1dcdf01fSchristos # define SSL_CTRL_SET_DTLS_EXT_HEARTBEAT_NO_REQUESTS 87 1261*1dcdf01fSchristos # endif 1262*1dcdf01fSchristos # define DTLS_CTRL_GET_TIMEOUT 73 1263*1dcdf01fSchristos # define DTLS_CTRL_HANDLE_TIMEOUT 74 1264*1dcdf01fSchristos # define SSL_CTRL_GET_RI_SUPPORT 76 1265*1dcdf01fSchristos # define SSL_CTRL_CLEAR_MODE 78 1266*1dcdf01fSchristos # define SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB 79 1267*1dcdf01fSchristos # define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82 1268*1dcdf01fSchristos # define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83 1269*1dcdf01fSchristos # define SSL_CTRL_CHAIN 88 1270*1dcdf01fSchristos # define SSL_CTRL_CHAIN_CERT 89 1271*1dcdf01fSchristos # define SSL_CTRL_GET_GROUPS 90 1272*1dcdf01fSchristos # define SSL_CTRL_SET_GROUPS 91 1273*1dcdf01fSchristos # define SSL_CTRL_SET_GROUPS_LIST 92 1274*1dcdf01fSchristos # define SSL_CTRL_GET_SHARED_GROUP 93 1275*1dcdf01fSchristos # define SSL_CTRL_SET_SIGALGS 97 1276*1dcdf01fSchristos # define SSL_CTRL_SET_SIGALGS_LIST 98 1277*1dcdf01fSchristos # define SSL_CTRL_CERT_FLAGS 99 1278*1dcdf01fSchristos # define SSL_CTRL_CLEAR_CERT_FLAGS 100 1279*1dcdf01fSchristos # define SSL_CTRL_SET_CLIENT_SIGALGS 101 1280*1dcdf01fSchristos # define SSL_CTRL_SET_CLIENT_SIGALGS_LIST 102 1281*1dcdf01fSchristos # define SSL_CTRL_GET_CLIENT_CERT_TYPES 103 1282*1dcdf01fSchristos # define SSL_CTRL_SET_CLIENT_CERT_TYPES 104 1283*1dcdf01fSchristos # define SSL_CTRL_BUILD_CERT_CHAIN 105 1284*1dcdf01fSchristos # define SSL_CTRL_SET_VERIFY_CERT_STORE 106 1285*1dcdf01fSchristos # define SSL_CTRL_SET_CHAIN_CERT_STORE 107 1286*1dcdf01fSchristos # define SSL_CTRL_GET_PEER_SIGNATURE_NID 108 1287*1dcdf01fSchristos # define SSL_CTRL_GET_PEER_TMP_KEY 109 1288*1dcdf01fSchristos # define SSL_CTRL_GET_RAW_CIPHERLIST 110 1289*1dcdf01fSchristos # define SSL_CTRL_GET_EC_POINT_FORMATS 111 1290*1dcdf01fSchristos # define SSL_CTRL_GET_CHAIN_CERTS 115 1291*1dcdf01fSchristos # define SSL_CTRL_SELECT_CURRENT_CERT 116 1292*1dcdf01fSchristos # define SSL_CTRL_SET_CURRENT_CERT 117 1293*1dcdf01fSchristos # define SSL_CTRL_SET_DH_AUTO 118 1294*1dcdf01fSchristos # define DTLS_CTRL_SET_LINK_MTU 120 1295*1dcdf01fSchristos # define DTLS_CTRL_GET_LINK_MIN_MTU 121 1296*1dcdf01fSchristos # define SSL_CTRL_GET_EXTMS_SUPPORT 122 1297*1dcdf01fSchristos # define SSL_CTRL_SET_MIN_PROTO_VERSION 123 1298*1dcdf01fSchristos # define SSL_CTRL_SET_MAX_PROTO_VERSION 124 1299*1dcdf01fSchristos # define SSL_CTRL_SET_SPLIT_SEND_FRAGMENT 125 1300*1dcdf01fSchristos # define SSL_CTRL_SET_MAX_PIPELINES 126 1301*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE 127 1302*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB 128 1303*1dcdf01fSchristos # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG 129 1304*1dcdf01fSchristos # define SSL_CTRL_GET_MIN_PROTO_VERSION 130 1305*1dcdf01fSchristos # define SSL_CTRL_GET_MAX_PROTO_VERSION 131 1306*1dcdf01fSchristos # define SSL_CTRL_GET_SIGNATURE_NID 132 1307*1dcdf01fSchristos # define SSL_CTRL_GET_TMP_KEY 133 1308*1dcdf01fSchristos # define SSL_CTRL_GET_VERIFY_CERT_STORE 137 1309*1dcdf01fSchristos # define SSL_CTRL_GET_CHAIN_CERT_STORE 138 1310*1dcdf01fSchristos # define SSL_CERT_SET_FIRST 1 1311*1dcdf01fSchristos # define SSL_CERT_SET_NEXT 2 1312*1dcdf01fSchristos # define SSL_CERT_SET_SERVER 3 1313*1dcdf01fSchristos # define DTLSv1_get_timeout(ssl, arg) \ 1314*1dcdf01fSchristos SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)(arg)) 1315*1dcdf01fSchristos # define DTLSv1_handle_timeout(ssl) \ 1316*1dcdf01fSchristos SSL_ctrl(ssl,DTLS_CTRL_HANDLE_TIMEOUT,0, NULL) 1317*1dcdf01fSchristos # define SSL_num_renegotiations(ssl) \ 1318*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_GET_NUM_RENEGOTIATIONS,0,NULL) 1319*1dcdf01fSchristos # define SSL_clear_num_renegotiations(ssl) \ 1320*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS,0,NULL) 1321*1dcdf01fSchristos # define SSL_total_renegotiations(ssl) \ 1322*1dcdf01fSchristos SSL_ctrl((ssl),SSL_CTRL_GET_TOTAL_RENEGOTIATIONS,0,NULL) 1323*1dcdf01fSchristos # define SSL_CTX_set_tmp_dh(ctx,dh) \ 1324*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)(dh)) 1325*1dcdf01fSchristos # define SSL_CTX_set_tmp_ecdh(ctx,ecdh) \ 1326*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)(ecdh)) 1327*1dcdf01fSchristos # define SSL_CTX_set_dh_auto(ctx, onoff) \ 1328*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_DH_AUTO,onoff,NULL) 1329*1dcdf01fSchristos # define SSL_set_dh_auto(s, onoff) \ 1330*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_DH_AUTO,onoff,NULL) 1331*1dcdf01fSchristos # define SSL_set_tmp_dh(ssl,dh) \ 1332*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)(dh)) 1333*1dcdf01fSchristos # define SSL_set_tmp_ecdh(ssl,ecdh) \ 1334*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)(ecdh)) 1335*1dcdf01fSchristos # define SSL_CTX_add_extra_chain_cert(ctx,x509) \ 1336*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)(x509)) 1337*1dcdf01fSchristos # define SSL_CTX_get_extra_chain_certs(ctx,px509) \ 1338*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,0,px509) 1339*1dcdf01fSchristos # define SSL_CTX_get_extra_chain_certs_only(ctx,px509) \ 1340*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,1,px509) 1341*1dcdf01fSchristos # define SSL_CTX_clear_extra_chain_certs(ctx) \ 1342*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS,0,NULL) 1343*1dcdf01fSchristos # define SSL_CTX_set0_chain(ctx,sk) \ 1344*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN,0,(char *)(sk)) 1345*1dcdf01fSchristos # define SSL_CTX_set1_chain(ctx,sk) \ 1346*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN,1,(char *)(sk)) 1347*1dcdf01fSchristos # define SSL_CTX_add0_chain_cert(ctx,x509) \ 1348*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN_CERT,0,(char *)(x509)) 1349*1dcdf01fSchristos # define SSL_CTX_add1_chain_cert(ctx,x509) \ 1350*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN_CERT,1,(char *)(x509)) 1351*1dcdf01fSchristos # define SSL_CTX_get0_chain_certs(ctx,px509) \ 1352*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERTS,0,px509) 1353*1dcdf01fSchristos # define SSL_CTX_clear_chain_certs(ctx) \ 1354*1dcdf01fSchristos SSL_CTX_set0_chain(ctx,NULL) 1355*1dcdf01fSchristos # define SSL_CTX_build_cert_chain(ctx, flags) \ 1356*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_BUILD_CERT_CHAIN, flags, NULL) 1357*1dcdf01fSchristos # define SSL_CTX_select_current_cert(ctx,x509) \ 1358*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SELECT_CURRENT_CERT,0,(char *)(x509)) 1359*1dcdf01fSchristos # define SSL_CTX_set_current_cert(ctx, op) \ 1360*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CURRENT_CERT, op, NULL) 1361*1dcdf01fSchristos # define SSL_CTX_set0_verify_cert_store(ctx,st) \ 1362*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st)) 1363*1dcdf01fSchristos # define SSL_CTX_set1_verify_cert_store(ctx,st) \ 1364*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st)) 1365*1dcdf01fSchristos # define SSL_CTX_get0_verify_cert_store(ctx,st) \ 1366*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_VERIFY_CERT_STORE,0,(char *)(st)) 1367*1dcdf01fSchristos # define SSL_CTX_set0_chain_cert_store(ctx,st) \ 1368*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st)) 1369*1dcdf01fSchristos # define SSL_CTX_set1_chain_cert_store(ctx,st) \ 1370*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st)) 1371*1dcdf01fSchristos # define SSL_CTX_get0_chain_cert_store(ctx,st) \ 1372*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERT_STORE,0,(char *)(st)) 1373*1dcdf01fSchristos # define SSL_set0_chain(s,sk) \ 1374*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_CHAIN,0,(char *)(sk)) 1375*1dcdf01fSchristos # define SSL_set1_chain(s,sk) \ 1376*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_CHAIN,1,(char *)(sk)) 1377*1dcdf01fSchristos # define SSL_add0_chain_cert(s,x509) \ 1378*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_CHAIN_CERT,0,(char *)(x509)) 1379*1dcdf01fSchristos # define SSL_add1_chain_cert(s,x509) \ 1380*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_CHAIN_CERT,1,(char *)(x509)) 1381*1dcdf01fSchristos # define SSL_get0_chain_certs(s,px509) \ 1382*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_CHAIN_CERTS,0,px509) 1383*1dcdf01fSchristos # define SSL_clear_chain_certs(s) \ 1384*1dcdf01fSchristos SSL_set0_chain(s,NULL) 1385*1dcdf01fSchristos # define SSL_build_cert_chain(s, flags) \ 1386*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_BUILD_CERT_CHAIN, flags, NULL) 1387*1dcdf01fSchristos # define SSL_select_current_cert(s,x509) \ 1388*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SELECT_CURRENT_CERT,0,(char *)(x509)) 1389*1dcdf01fSchristos # define SSL_set_current_cert(s,op) \ 1390*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_CURRENT_CERT, op, NULL) 1391*1dcdf01fSchristos # define SSL_set0_verify_cert_store(s,st) \ 1392*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st)) 1393*1dcdf01fSchristos # define SSL_set1_verify_cert_store(s,st) \ 1394*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st)) 1395*1dcdf01fSchristos #define SSL_get0_verify_cert_store(s,st) \ 1396*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_VERIFY_CERT_STORE,0,(char *)(st)) 1397*1dcdf01fSchristos # define SSL_set0_chain_cert_store(s,st) \ 1398*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st)) 1399*1dcdf01fSchristos # define SSL_set1_chain_cert_store(s,st) \ 1400*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st)) 1401*1dcdf01fSchristos #define SSL_get0_chain_cert_store(s,st) \ 1402*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_CHAIN_CERT_STORE,0,(char *)(st)) 1403*1dcdf01fSchristos # define SSL_get1_groups(s, glist) \ 1404*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_GROUPS,0,(int*)(glist)) 1405*1dcdf01fSchristos # define SSL_CTX_set1_groups(ctx, glist, glistlen) \ 1406*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_GROUPS,glistlen,(int *)(glist)) 1407*1dcdf01fSchristos # define SSL_CTX_set1_groups_list(ctx, s) \ 1408*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_GROUPS_LIST,0,(char *)(s)) 1409*1dcdf01fSchristos # define SSL_set1_groups(s, glist, glistlen) \ 1410*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_GROUPS,glistlen,(char *)(glist)) 1411*1dcdf01fSchristos # define SSL_set1_groups_list(s, str) \ 1412*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_GROUPS_LIST,0,(char *)(str)) 1413*1dcdf01fSchristos # define SSL_get_shared_group(s, n) \ 1414*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_SHARED_GROUP,n,NULL) 1415*1dcdf01fSchristos # define SSL_CTX_set1_sigalgs(ctx, slist, slistlen) \ 1416*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS,slistlen,(int *)(slist)) 1417*1dcdf01fSchristos # define SSL_CTX_set1_sigalgs_list(ctx, s) \ 1418*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)(s)) 1419*1dcdf01fSchristos # define SSL_set1_sigalgs(s, slist, slistlen) \ 1420*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_SIGALGS,slistlen,(int *)(slist)) 1421*1dcdf01fSchristos # define SSL_set1_sigalgs_list(s, str) \ 1422*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)(str)) 1423*1dcdf01fSchristos # define SSL_CTX_set1_client_sigalgs(ctx, slist, slistlen) \ 1424*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS,slistlen,(int *)(slist)) 1425*1dcdf01fSchristos # define SSL_CTX_set1_client_sigalgs_list(ctx, s) \ 1426*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)(s)) 1427*1dcdf01fSchristos # define SSL_set1_client_sigalgs(s, slist, slistlen) \ 1428*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_CLIENT_SIGALGS,slistlen,(int *)(slist)) 1429*1dcdf01fSchristos # define SSL_set1_client_sigalgs_list(s, str) \ 1430*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)(str)) 1431*1dcdf01fSchristos # define SSL_get0_certificate_types(s, clist) \ 1432*1dcdf01fSchristos SSL_ctrl(s, SSL_CTRL_GET_CLIENT_CERT_TYPES, 0, (char *)(clist)) 1433*1dcdf01fSchristos # define SSL_CTX_set1_client_certificate_types(ctx, clist, clistlen) \ 1434*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen, \ 1435*1dcdf01fSchristos (char *)(clist)) 1436*1dcdf01fSchristos # define SSL_set1_client_certificate_types(s, clist, clistlen) \ 1437*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)(clist)) 1438*1dcdf01fSchristos # define SSL_get_signature_nid(s, pn) \ 1439*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_SIGNATURE_NID,0,pn) 1440*1dcdf01fSchristos # define SSL_get_peer_signature_nid(s, pn) \ 1441*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_PEER_SIGNATURE_NID,0,pn) 1442*1dcdf01fSchristos # define SSL_get_peer_tmp_key(s, pk) \ 1443*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_PEER_TMP_KEY,0,pk) 1444*1dcdf01fSchristos # define SSL_get_tmp_key(s, pk) \ 1445*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_TMP_KEY,0,pk) 1446*1dcdf01fSchristos # define SSL_get0_raw_cipherlist(s, plst) \ 1447*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_RAW_CIPHERLIST,0,plst) 1448*1dcdf01fSchristos # define SSL_get0_ec_point_formats(s, plst) \ 1449*1dcdf01fSchristos SSL_ctrl(s,SSL_CTRL_GET_EC_POINT_FORMATS,0,plst) 1450*1dcdf01fSchristos # define SSL_CTX_set_min_proto_version(ctx, version) \ 1451*1dcdf01fSchristos SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) 1452*1dcdf01fSchristos # define SSL_CTX_set_max_proto_version(ctx, version) \ 1453*1dcdf01fSchristos SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) 1454*1dcdf01fSchristos # define SSL_CTX_get_min_proto_version(ctx) \ 1455*1dcdf01fSchristos SSL_CTX_ctrl(ctx, SSL_CTRL_GET_MIN_PROTO_VERSION, 0, NULL) 1456*1dcdf01fSchristos # define SSL_CTX_get_max_proto_version(ctx) \ 1457*1dcdf01fSchristos SSL_CTX_ctrl(ctx, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL) 1458*1dcdf01fSchristos # define SSL_set_min_proto_version(s, version) \ 1459*1dcdf01fSchristos SSL_ctrl(s, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) 1460*1dcdf01fSchristos # define SSL_set_max_proto_version(s, version) \ 1461*1dcdf01fSchristos SSL_ctrl(s, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) 1462*1dcdf01fSchristos # define SSL_get_min_proto_version(s) \ 1463*1dcdf01fSchristos SSL_ctrl(s, SSL_CTRL_GET_MIN_PROTO_VERSION, 0, NULL) 1464*1dcdf01fSchristos # define SSL_get_max_proto_version(s) \ 1465*1dcdf01fSchristos SSL_ctrl(s, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL) 1466*1dcdf01fSchristos 1467*1dcdf01fSchristos /* Backwards compatibility, original 1.1.0 names */ 1468*1dcdf01fSchristos # define SSL_CTRL_GET_SERVER_TMP_KEY \ 1469*1dcdf01fSchristos SSL_CTRL_GET_PEER_TMP_KEY 1470*1dcdf01fSchristos # define SSL_get_server_tmp_key(s, pk) \ 1471*1dcdf01fSchristos SSL_get_peer_tmp_key(s, pk) 1472*1dcdf01fSchristos 1473*1dcdf01fSchristos /* 1474*1dcdf01fSchristos * The following symbol names are old and obsolete. They are kept 1475*1dcdf01fSchristos * for compatibility reasons only and should not be used anymore. 1476*1dcdf01fSchristos */ 1477*1dcdf01fSchristos # define SSL_CTRL_GET_CURVES SSL_CTRL_GET_GROUPS 1478*1dcdf01fSchristos # define SSL_CTRL_SET_CURVES SSL_CTRL_SET_GROUPS 1479*1dcdf01fSchristos # define SSL_CTRL_SET_CURVES_LIST SSL_CTRL_SET_GROUPS_LIST 1480*1dcdf01fSchristos # define SSL_CTRL_GET_SHARED_CURVE SSL_CTRL_GET_SHARED_GROUP 1481*1dcdf01fSchristos 1482*1dcdf01fSchristos # define SSL_get1_curves SSL_get1_groups 1483*1dcdf01fSchristos # define SSL_CTX_set1_curves SSL_CTX_set1_groups 1484*1dcdf01fSchristos # define SSL_CTX_set1_curves_list SSL_CTX_set1_groups_list 1485*1dcdf01fSchristos # define SSL_set1_curves SSL_set1_groups 1486*1dcdf01fSchristos # define SSL_set1_curves_list SSL_set1_groups_list 1487*1dcdf01fSchristos # define SSL_get_shared_curve SSL_get_shared_group 1488*1dcdf01fSchristos 1489*1dcdf01fSchristos 1490*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 1491*1dcdf01fSchristos /* Provide some compatibility macros for removed functionality. */ 1492*1dcdf01fSchristos # define SSL_CTX_need_tmp_RSA(ctx) 0 1493*1dcdf01fSchristos # define SSL_CTX_set_tmp_rsa(ctx,rsa) 1 1494*1dcdf01fSchristos # define SSL_need_tmp_RSA(ssl) 0 1495*1dcdf01fSchristos # define SSL_set_tmp_rsa(ssl,rsa) 1 1496*1dcdf01fSchristos # define SSL_CTX_set_ecdh_auto(dummy, onoff) ((onoff) != 0) 1497*1dcdf01fSchristos # define SSL_set_ecdh_auto(dummy, onoff) ((onoff) != 0) 1498*1dcdf01fSchristos /* 1499*1dcdf01fSchristos * We "pretend" to call the callback to avoid warnings about unused static 1500*1dcdf01fSchristos * functions. 1501*1dcdf01fSchristos */ 1502*1dcdf01fSchristos # define SSL_CTX_set_tmp_rsa_callback(ctx, cb) while(0) (cb)(NULL, 0, 0) 1503*1dcdf01fSchristos # define SSL_set_tmp_rsa_callback(ssl, cb) while(0) (cb)(NULL, 0, 0) 1504*1dcdf01fSchristos # endif 1505*1dcdf01fSchristos __owur const BIO_METHOD *BIO_f_ssl(void); 1506*1dcdf01fSchristos __owur BIO *BIO_new_ssl(SSL_CTX *ctx, int client); 1507*1dcdf01fSchristos __owur BIO *BIO_new_ssl_connect(SSL_CTX *ctx); 1508*1dcdf01fSchristos __owur BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx); 1509*1dcdf01fSchristos __owur int BIO_ssl_copy_session_id(BIO *to, BIO *from); 1510*1dcdf01fSchristos void BIO_ssl_shutdown(BIO *ssl_bio); 1511*1dcdf01fSchristos 1512*1dcdf01fSchristos __owur int SSL_CTX_set_cipher_list(SSL_CTX *, const char *str); 1513*1dcdf01fSchristos __owur SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth); 1514*1dcdf01fSchristos int SSL_CTX_up_ref(SSL_CTX *ctx); 1515*1dcdf01fSchristos void SSL_CTX_free(SSL_CTX *); 1516*1dcdf01fSchristos __owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); 1517*1dcdf01fSchristos __owur long SSL_CTX_get_timeout(const SSL_CTX *ctx); 1518*1dcdf01fSchristos __owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *); 1519*1dcdf01fSchristos void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *); 1520*1dcdf01fSchristos void SSL_CTX_set1_cert_store(SSL_CTX *, X509_STORE *); 1521*1dcdf01fSchristos __owur int SSL_want(const SSL *s); 1522*1dcdf01fSchristos __owur int SSL_clear(SSL *s); 1523*1dcdf01fSchristos 1524*1dcdf01fSchristos void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm); 1525*1dcdf01fSchristos 1526*1dcdf01fSchristos __owur const SSL_CIPHER *SSL_get_current_cipher(const SSL *s); 1527*1dcdf01fSchristos __owur const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s); 1528*1dcdf01fSchristos __owur int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits); 1529*1dcdf01fSchristos __owur const char *SSL_CIPHER_get_version(const SSL_CIPHER *c); 1530*1dcdf01fSchristos __owur const char *SSL_CIPHER_get_name(const SSL_CIPHER *c); 1531*1dcdf01fSchristos __owur const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c); 1532*1dcdf01fSchristos __owur const char *OPENSSL_cipher_name(const char *rfc_name); 1533*1dcdf01fSchristos __owur uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c); 1534*1dcdf01fSchristos __owur uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c); 1535*1dcdf01fSchristos __owur int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c); 1536*1dcdf01fSchristos __owur int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c); 1537*1dcdf01fSchristos __owur const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c); 1538*1dcdf01fSchristos __owur int SSL_CIPHER_is_aead(const SSL_CIPHER *c); 1539*1dcdf01fSchristos 1540*1dcdf01fSchristos __owur int SSL_get_fd(const SSL *s); 1541*1dcdf01fSchristos __owur int SSL_get_rfd(const SSL *s); 1542*1dcdf01fSchristos __owur int SSL_get_wfd(const SSL *s); 1543*1dcdf01fSchristos __owur const char *SSL_get_cipher_list(const SSL *s, int n); 1544*1dcdf01fSchristos __owur char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size); 1545*1dcdf01fSchristos __owur int SSL_get_read_ahead(const SSL *s); 1546*1dcdf01fSchristos __owur int SSL_pending(const SSL *s); 1547*1dcdf01fSchristos __owur int SSL_has_pending(const SSL *s); 1548*1dcdf01fSchristos # ifndef OPENSSL_NO_SOCK 1549*1dcdf01fSchristos __owur int SSL_set_fd(SSL *s, int fd); 1550*1dcdf01fSchristos __owur int SSL_set_rfd(SSL *s, int fd); 1551*1dcdf01fSchristos __owur int SSL_set_wfd(SSL *s, int fd); 1552*1dcdf01fSchristos # endif 1553*1dcdf01fSchristos void SSL_set0_rbio(SSL *s, BIO *rbio); 1554*1dcdf01fSchristos void SSL_set0_wbio(SSL *s, BIO *wbio); 1555*1dcdf01fSchristos void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio); 1556*1dcdf01fSchristos __owur BIO *SSL_get_rbio(const SSL *s); 1557*1dcdf01fSchristos __owur BIO *SSL_get_wbio(const SSL *s); 1558*1dcdf01fSchristos __owur int SSL_set_cipher_list(SSL *s, const char *str); 1559*1dcdf01fSchristos __owur int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str); 1560*1dcdf01fSchristos __owur int SSL_set_ciphersuites(SSL *s, const char *str); 1561*1dcdf01fSchristos void SSL_set_read_ahead(SSL *s, int yes); 1562*1dcdf01fSchristos __owur int SSL_get_verify_mode(const SSL *s); 1563*1dcdf01fSchristos __owur int SSL_get_verify_depth(const SSL *s); 1564*1dcdf01fSchristos __owur SSL_verify_cb SSL_get_verify_callback(const SSL *s); 1565*1dcdf01fSchristos void SSL_set_verify(SSL *s, int mode, SSL_verify_cb callback); 1566*1dcdf01fSchristos void SSL_set_verify_depth(SSL *s, int depth); 1567*1dcdf01fSchristos void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg); 1568*1dcdf01fSchristos # ifndef OPENSSL_NO_RSA 1569*1dcdf01fSchristos __owur int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa); 1570*1dcdf01fSchristos __owur int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, 1571*1dcdf01fSchristos long len); 1572*1dcdf01fSchristos # endif 1573*1dcdf01fSchristos __owur int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey); 1574*1dcdf01fSchristos __owur int SSL_use_PrivateKey_ASN1(int pk, SSL *ssl, const unsigned char *d, 1575*1dcdf01fSchristos long len); 1576*1dcdf01fSchristos __owur int SSL_use_certificate(SSL *ssl, X509 *x); 1577*1dcdf01fSchristos __owur int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len); 1578*1dcdf01fSchristos __owur int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey, 1579*1dcdf01fSchristos STACK_OF(X509) *chain, int override); 1580*1dcdf01fSchristos 1581*1dcdf01fSchristos 1582*1dcdf01fSchristos /* serverinfo file format versions */ 1583*1dcdf01fSchristos # define SSL_SERVERINFOV1 1 1584*1dcdf01fSchristos # define SSL_SERVERINFOV2 2 1585*1dcdf01fSchristos 1586*1dcdf01fSchristos /* Set serverinfo data for the current active cert. */ 1587*1dcdf01fSchristos __owur int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, 1588*1dcdf01fSchristos size_t serverinfo_length); 1589*1dcdf01fSchristos __owur int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version, 1590*1dcdf01fSchristos const unsigned char *serverinfo, 1591*1dcdf01fSchristos size_t serverinfo_length); 1592*1dcdf01fSchristos __owur int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file); 1593*1dcdf01fSchristos 1594*1dcdf01fSchristos #ifndef OPENSSL_NO_RSA 1595*1dcdf01fSchristos __owur int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type); 1596*1dcdf01fSchristos #endif 1597*1dcdf01fSchristos 1598*1dcdf01fSchristos __owur int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type); 1599*1dcdf01fSchristos __owur int SSL_use_certificate_file(SSL *ssl, const char *file, int type); 1600*1dcdf01fSchristos 1601*1dcdf01fSchristos #ifndef OPENSSL_NO_RSA 1602*1dcdf01fSchristos __owur int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, 1603*1dcdf01fSchristos int type); 1604*1dcdf01fSchristos #endif 1605*1dcdf01fSchristos __owur int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, 1606*1dcdf01fSchristos int type); 1607*1dcdf01fSchristos __owur int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, 1608*1dcdf01fSchristos int type); 1609*1dcdf01fSchristos /* PEM type */ 1610*1dcdf01fSchristos __owur int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); 1611*1dcdf01fSchristos __owur int SSL_use_certificate_chain_file(SSL *ssl, const char *file); 1612*1dcdf01fSchristos __owur STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file); 1613*1dcdf01fSchristos __owur int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, 1614*1dcdf01fSchristos const char *file); 1615*1dcdf01fSchristos int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, 1616*1dcdf01fSchristos const char *dir); 1617*1dcdf01fSchristos 1618*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 1619*1dcdf01fSchristos # define SSL_load_error_strings() \ 1620*1dcdf01fSchristos OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \ 1621*1dcdf01fSchristos | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL) 1622*1dcdf01fSchristos # endif 1623*1dcdf01fSchristos 1624*1dcdf01fSchristos __owur const char *SSL_state_string(const SSL *s); 1625*1dcdf01fSchristos __owur const char *SSL_rstate_string(const SSL *s); 1626*1dcdf01fSchristos __owur const char *SSL_state_string_long(const SSL *s); 1627*1dcdf01fSchristos __owur const char *SSL_rstate_string_long(const SSL *s); 1628*1dcdf01fSchristos __owur long SSL_SESSION_get_time(const SSL_SESSION *s); 1629*1dcdf01fSchristos __owur long SSL_SESSION_set_time(SSL_SESSION *s, long t); 1630*1dcdf01fSchristos __owur long SSL_SESSION_get_timeout(const SSL_SESSION *s); 1631*1dcdf01fSchristos __owur long SSL_SESSION_set_timeout(SSL_SESSION *s, long t); 1632*1dcdf01fSchristos __owur int SSL_SESSION_get_protocol_version(const SSL_SESSION *s); 1633*1dcdf01fSchristos __owur int SSL_SESSION_set_protocol_version(SSL_SESSION *s, int version); 1634*1dcdf01fSchristos 1635*1dcdf01fSchristos __owur const char *SSL_SESSION_get0_hostname(const SSL_SESSION *s); 1636*1dcdf01fSchristos __owur int SSL_SESSION_set1_hostname(SSL_SESSION *s, const char *hostname); 1637*1dcdf01fSchristos void SSL_SESSION_get0_alpn_selected(const SSL_SESSION *s, 1638*1dcdf01fSchristos const unsigned char **alpn, 1639*1dcdf01fSchristos size_t *len); 1640*1dcdf01fSchristos __owur int SSL_SESSION_set1_alpn_selected(SSL_SESSION *s, 1641*1dcdf01fSchristos const unsigned char *alpn, 1642*1dcdf01fSchristos size_t len); 1643*1dcdf01fSchristos __owur const SSL_CIPHER *SSL_SESSION_get0_cipher(const SSL_SESSION *s); 1644*1dcdf01fSchristos __owur int SSL_SESSION_set_cipher(SSL_SESSION *s, const SSL_CIPHER *cipher); 1645*1dcdf01fSchristos __owur int SSL_SESSION_has_ticket(const SSL_SESSION *s); 1646*1dcdf01fSchristos __owur unsigned long SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s); 1647*1dcdf01fSchristos void SSL_SESSION_get0_ticket(const SSL_SESSION *s, const unsigned char **tick, 1648*1dcdf01fSchristos size_t *len); 1649*1dcdf01fSchristos __owur uint32_t SSL_SESSION_get_max_early_data(const SSL_SESSION *s); 1650*1dcdf01fSchristos __owur int SSL_SESSION_set_max_early_data(SSL_SESSION *s, 1651*1dcdf01fSchristos uint32_t max_early_data); 1652*1dcdf01fSchristos __owur int SSL_copy_session_id(SSL *to, const SSL *from); 1653*1dcdf01fSchristos __owur X509 *SSL_SESSION_get0_peer(SSL_SESSION *s); 1654*1dcdf01fSchristos __owur int SSL_SESSION_set1_id_context(SSL_SESSION *s, 1655*1dcdf01fSchristos const unsigned char *sid_ctx, 1656*1dcdf01fSchristos unsigned int sid_ctx_len); 1657*1dcdf01fSchristos __owur int SSL_SESSION_set1_id(SSL_SESSION *s, const unsigned char *sid, 1658*1dcdf01fSchristos unsigned int sid_len); 1659*1dcdf01fSchristos __owur int SSL_SESSION_is_resumable(const SSL_SESSION *s); 1660*1dcdf01fSchristos 1661*1dcdf01fSchristos __owur SSL_SESSION *SSL_SESSION_new(void); 1662*1dcdf01fSchristos __owur SSL_SESSION *SSL_SESSION_dup(SSL_SESSION *src); 1663*1dcdf01fSchristos const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, 1664*1dcdf01fSchristos unsigned int *len); 1665*1dcdf01fSchristos const unsigned char *SSL_SESSION_get0_id_context(const SSL_SESSION *s, 1666*1dcdf01fSchristos unsigned int *len); 1667*1dcdf01fSchristos __owur unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s); 1668*1dcdf01fSchristos # ifndef OPENSSL_NO_STDIO 1669*1dcdf01fSchristos int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *ses); 1670*1dcdf01fSchristos # endif 1671*1dcdf01fSchristos int SSL_SESSION_print(BIO *fp, const SSL_SESSION *ses); 1672*1dcdf01fSchristos int SSL_SESSION_print_keylog(BIO *bp, const SSL_SESSION *x); 1673*1dcdf01fSchristos int SSL_SESSION_up_ref(SSL_SESSION *ses); 1674*1dcdf01fSchristos void SSL_SESSION_free(SSL_SESSION *ses); 1675*1dcdf01fSchristos __owur int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp); 1676*1dcdf01fSchristos __owur int SSL_set_session(SSL *to, SSL_SESSION *session); 1677*1dcdf01fSchristos int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *session); 1678*1dcdf01fSchristos int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *session); 1679*1dcdf01fSchristos __owur int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb); 1680*1dcdf01fSchristos __owur int SSL_set_generate_session_id(SSL *s, GEN_SESSION_CB cb); 1681*1dcdf01fSchristos __owur int SSL_has_matching_session_id(const SSL *s, 1682*1dcdf01fSchristos const unsigned char *id, 1683*1dcdf01fSchristos unsigned int id_len); 1684*1dcdf01fSchristos SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, 1685*1dcdf01fSchristos long length); 1686*1dcdf01fSchristos 1687*1dcdf01fSchristos # ifdef HEADER_X509_H 1688*1dcdf01fSchristos __owur X509 *SSL_get_peer_certificate(const SSL *s); 1689*1dcdf01fSchristos # endif 1690*1dcdf01fSchristos 1691*1dcdf01fSchristos __owur STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s); 1692*1dcdf01fSchristos 1693*1dcdf01fSchristos __owur int SSL_CTX_get_verify_mode(const SSL_CTX *ctx); 1694*1dcdf01fSchristos __owur int SSL_CTX_get_verify_depth(const SSL_CTX *ctx); 1695*1dcdf01fSchristos __owur SSL_verify_cb SSL_CTX_get_verify_callback(const SSL_CTX *ctx); 1696*1dcdf01fSchristos void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, SSL_verify_cb callback); 1697*1dcdf01fSchristos void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth); 1698*1dcdf01fSchristos void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, 1699*1dcdf01fSchristos int (*cb) (X509_STORE_CTX *, void *), 1700*1dcdf01fSchristos void *arg); 1701*1dcdf01fSchristos void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg), 1702*1dcdf01fSchristos void *arg); 1703*1dcdf01fSchristos # ifndef OPENSSL_NO_RSA 1704*1dcdf01fSchristos __owur int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa); 1705*1dcdf01fSchristos __owur int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, 1706*1dcdf01fSchristos long len); 1707*1dcdf01fSchristos # endif 1708*1dcdf01fSchristos __owur int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey); 1709*1dcdf01fSchristos __owur int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, 1710*1dcdf01fSchristos const unsigned char *d, long len); 1711*1dcdf01fSchristos __owur int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); 1712*1dcdf01fSchristos __owur int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, 1713*1dcdf01fSchristos const unsigned char *d); 1714*1dcdf01fSchristos __owur int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey, 1715*1dcdf01fSchristos STACK_OF(X509) *chain, int override); 1716*1dcdf01fSchristos 1717*1dcdf01fSchristos void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb); 1718*1dcdf01fSchristos void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u); 1719*1dcdf01fSchristos pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx); 1720*1dcdf01fSchristos void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx); 1721*1dcdf01fSchristos void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb); 1722*1dcdf01fSchristos void SSL_set_default_passwd_cb_userdata(SSL *s, void *u); 1723*1dcdf01fSchristos pem_password_cb *SSL_get_default_passwd_cb(SSL *s); 1724*1dcdf01fSchristos void *SSL_get_default_passwd_cb_userdata(SSL *s); 1725*1dcdf01fSchristos 1726*1dcdf01fSchristos __owur int SSL_CTX_check_private_key(const SSL_CTX *ctx); 1727*1dcdf01fSchristos __owur int SSL_check_private_key(const SSL *ctx); 1728*1dcdf01fSchristos 1729*1dcdf01fSchristos __owur int SSL_CTX_set_session_id_context(SSL_CTX *ctx, 1730*1dcdf01fSchristos const unsigned char *sid_ctx, 1731*1dcdf01fSchristos unsigned int sid_ctx_len); 1732*1dcdf01fSchristos 1733*1dcdf01fSchristos SSL *SSL_new(SSL_CTX *ctx); 1734*1dcdf01fSchristos int SSL_up_ref(SSL *s); 1735*1dcdf01fSchristos int SSL_is_dtls(const SSL *s); 1736*1dcdf01fSchristos __owur int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx, 1737*1dcdf01fSchristos unsigned int sid_ctx_len); 1738*1dcdf01fSchristos 1739*1dcdf01fSchristos __owur int SSL_CTX_set_purpose(SSL_CTX *ctx, int purpose); 1740*1dcdf01fSchristos __owur int SSL_set_purpose(SSL *ssl, int purpose); 1741*1dcdf01fSchristos __owur int SSL_CTX_set_trust(SSL_CTX *ctx, int trust); 1742*1dcdf01fSchristos __owur int SSL_set_trust(SSL *ssl, int trust); 1743*1dcdf01fSchristos 1744*1dcdf01fSchristos __owur int SSL_set1_host(SSL *s, const char *hostname); 1745*1dcdf01fSchristos __owur int SSL_add1_host(SSL *s, const char *hostname); 1746*1dcdf01fSchristos __owur const char *SSL_get0_peername(SSL *s); 1747*1dcdf01fSchristos void SSL_set_hostflags(SSL *s, unsigned int flags); 1748*1dcdf01fSchristos 1749*1dcdf01fSchristos __owur int SSL_CTX_dane_enable(SSL_CTX *ctx); 1750*1dcdf01fSchristos __owur int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, 1751*1dcdf01fSchristos uint8_t mtype, uint8_t ord); 1752*1dcdf01fSchristos __owur int SSL_dane_enable(SSL *s, const char *basedomain); 1753*1dcdf01fSchristos __owur int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector, 1754*1dcdf01fSchristos uint8_t mtype, unsigned const char *data, size_t dlen); 1755*1dcdf01fSchristos __owur int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki); 1756*1dcdf01fSchristos __owur int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector, 1757*1dcdf01fSchristos uint8_t *mtype, unsigned const char **data, 1758*1dcdf01fSchristos size_t *dlen); 1759*1dcdf01fSchristos /* 1760*1dcdf01fSchristos * Bridge opacity barrier between libcrypt and libssl, also needed to support 1761*1dcdf01fSchristos * offline testing in test/danetest.c 1762*1dcdf01fSchristos */ 1763*1dcdf01fSchristos SSL_DANE *SSL_get0_dane(SSL *ssl); 1764*1dcdf01fSchristos /* 1765*1dcdf01fSchristos * DANE flags 1766*1dcdf01fSchristos */ 1767*1dcdf01fSchristos unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags); 1768*1dcdf01fSchristos unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags); 1769*1dcdf01fSchristos unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags); 1770*1dcdf01fSchristos unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags); 1771*1dcdf01fSchristos 1772*1dcdf01fSchristos __owur int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm); 1773*1dcdf01fSchristos __owur int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm); 1774*1dcdf01fSchristos 1775*1dcdf01fSchristos __owur X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx); 1776*1dcdf01fSchristos __owur X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl); 1777*1dcdf01fSchristos 1778*1dcdf01fSchristos # ifndef OPENSSL_NO_SRP 1779*1dcdf01fSchristos int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name); 1780*1dcdf01fSchristos int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password); 1781*1dcdf01fSchristos int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength); 1782*1dcdf01fSchristos int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx, 1783*1dcdf01fSchristos char *(*cb) (SSL *, void *)); 1784*1dcdf01fSchristos int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx, 1785*1dcdf01fSchristos int (*cb) (SSL *, void *)); 1786*1dcdf01fSchristos int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx, 1787*1dcdf01fSchristos int (*cb) (SSL *, int *, void *)); 1788*1dcdf01fSchristos int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg); 1789*1dcdf01fSchristos 1790*1dcdf01fSchristos int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g, 1791*1dcdf01fSchristos BIGNUM *sa, BIGNUM *v, char *info); 1792*1dcdf01fSchristos int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass, 1793*1dcdf01fSchristos const char *grp); 1794*1dcdf01fSchristos 1795*1dcdf01fSchristos __owur BIGNUM *SSL_get_srp_g(SSL *s); 1796*1dcdf01fSchristos __owur BIGNUM *SSL_get_srp_N(SSL *s); 1797*1dcdf01fSchristos 1798*1dcdf01fSchristos __owur char *SSL_get_srp_username(SSL *s); 1799*1dcdf01fSchristos __owur char *SSL_get_srp_userinfo(SSL *s); 1800*1dcdf01fSchristos # endif 1801*1dcdf01fSchristos 1802*1dcdf01fSchristos /* 1803*1dcdf01fSchristos * ClientHello callback and helpers. 1804*1dcdf01fSchristos */ 1805*1dcdf01fSchristos 1806*1dcdf01fSchristos # define SSL_CLIENT_HELLO_SUCCESS 1 1807*1dcdf01fSchristos # define SSL_CLIENT_HELLO_ERROR 0 1808*1dcdf01fSchristos # define SSL_CLIENT_HELLO_RETRY (-1) 1809*1dcdf01fSchristos 1810*1dcdf01fSchristos typedef int (*SSL_client_hello_cb_fn) (SSL *s, int *al, void *arg); 1811*1dcdf01fSchristos void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb, 1812*1dcdf01fSchristos void *arg); 1813*1dcdf01fSchristos int SSL_client_hello_isv2(SSL *s); 1814*1dcdf01fSchristos unsigned int SSL_client_hello_get0_legacy_version(SSL *s); 1815*1dcdf01fSchristos size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out); 1816*1dcdf01fSchristos size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out); 1817*1dcdf01fSchristos size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out); 1818*1dcdf01fSchristos size_t SSL_client_hello_get0_compression_methods(SSL *s, 1819*1dcdf01fSchristos const unsigned char **out); 1820*1dcdf01fSchristos int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen); 1821*1dcdf01fSchristos int SSL_client_hello_get0_ext(SSL *s, unsigned int type, 1822*1dcdf01fSchristos const unsigned char **out, size_t *outlen); 1823*1dcdf01fSchristos 1824*1dcdf01fSchristos void SSL_certs_clear(SSL *s); 1825*1dcdf01fSchristos void SSL_free(SSL *ssl); 1826*1dcdf01fSchristos # ifdef OSSL_ASYNC_FD 1827*1dcdf01fSchristos /* 1828*1dcdf01fSchristos * Windows application developer has to include windows.h to use these. 1829*1dcdf01fSchristos */ 1830*1dcdf01fSchristos __owur int SSL_waiting_for_async(SSL *s); 1831*1dcdf01fSchristos __owur int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds); 1832*1dcdf01fSchristos __owur int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, 1833*1dcdf01fSchristos size_t *numaddfds, OSSL_ASYNC_FD *delfd, 1834*1dcdf01fSchristos size_t *numdelfds); 1835*1dcdf01fSchristos # endif 1836*1dcdf01fSchristos __owur int SSL_accept(SSL *ssl); 1837*1dcdf01fSchristos __owur int SSL_stateless(SSL *s); 1838*1dcdf01fSchristos __owur int SSL_connect(SSL *ssl); 1839*1dcdf01fSchristos __owur int SSL_read(SSL *ssl, void *buf, int num); 1840*1dcdf01fSchristos __owur int SSL_read_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes); 1841*1dcdf01fSchristos 1842*1dcdf01fSchristos # define SSL_READ_EARLY_DATA_ERROR 0 1843*1dcdf01fSchristos # define SSL_READ_EARLY_DATA_SUCCESS 1 1844*1dcdf01fSchristos # define SSL_READ_EARLY_DATA_FINISH 2 1845*1dcdf01fSchristos 1846*1dcdf01fSchristos __owur int SSL_read_early_data(SSL *s, void *buf, size_t num, 1847*1dcdf01fSchristos size_t *readbytes); 1848*1dcdf01fSchristos __owur int SSL_peek(SSL *ssl, void *buf, int num); 1849*1dcdf01fSchristos __owur int SSL_peek_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes); 1850*1dcdf01fSchristos __owur int SSL_write(SSL *ssl, const void *buf, int num); 1851*1dcdf01fSchristos __owur int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written); 1852*1dcdf01fSchristos __owur int SSL_write_early_data(SSL *s, const void *buf, size_t num, 1853*1dcdf01fSchristos size_t *written); 1854*1dcdf01fSchristos long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg); 1855*1dcdf01fSchristos long SSL_callback_ctrl(SSL *, int, void (*)(void)); 1856*1dcdf01fSchristos long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg); 1857*1dcdf01fSchristos long SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)(void)); 1858*1dcdf01fSchristos 1859*1dcdf01fSchristos # define SSL_EARLY_DATA_NOT_SENT 0 1860*1dcdf01fSchristos # define SSL_EARLY_DATA_REJECTED 1 1861*1dcdf01fSchristos # define SSL_EARLY_DATA_ACCEPTED 2 1862*1dcdf01fSchristos 1863*1dcdf01fSchristos __owur int SSL_get_early_data_status(const SSL *s); 1864*1dcdf01fSchristos 1865*1dcdf01fSchristos __owur int SSL_get_error(const SSL *s, int ret_code); 1866*1dcdf01fSchristos __owur const char *SSL_get_version(const SSL *s); 1867*1dcdf01fSchristos 1868*1dcdf01fSchristos /* This sets the 'default' SSL version that SSL_new() will create */ 1869*1dcdf01fSchristos __owur int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); 1870*1dcdf01fSchristos 1871*1dcdf01fSchristos # ifndef OPENSSL_NO_SSL3_METHOD 1872*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_method(void)) /* SSLv3 */ 1873*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_server_method(void)) 1874*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_client_method(void)) 1875*1dcdf01fSchristos # endif 1876*1dcdf01fSchristos 1877*1dcdf01fSchristos #define SSLv23_method TLS_method 1878*1dcdf01fSchristos #define SSLv23_server_method TLS_server_method 1879*1dcdf01fSchristos #define SSLv23_client_method TLS_client_method 1880*1dcdf01fSchristos 1881*1dcdf01fSchristos /* Negotiate highest available SSL/TLS version */ 1882*1dcdf01fSchristos __owur const SSL_METHOD *TLS_method(void); 1883*1dcdf01fSchristos __owur const SSL_METHOD *TLS_server_method(void); 1884*1dcdf01fSchristos __owur const SSL_METHOD *TLS_client_method(void); 1885*1dcdf01fSchristos 1886*1dcdf01fSchristos # ifndef OPENSSL_NO_TLS1_METHOD 1887*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_method(void)) /* TLSv1.0 */ 1888*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_server_method(void)) 1889*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_client_method(void)) 1890*1dcdf01fSchristos # endif 1891*1dcdf01fSchristos 1892*1dcdf01fSchristos # ifndef OPENSSL_NO_TLS1_1_METHOD 1893*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_1_method(void)) /* TLSv1.1 */ 1894*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_1_server_method(void)) 1895*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_1_client_method(void)) 1896*1dcdf01fSchristos # endif 1897*1dcdf01fSchristos 1898*1dcdf01fSchristos # ifndef OPENSSL_NO_TLS1_2_METHOD 1899*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_method(void)) /* TLSv1.2 */ 1900*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_server_method(void)) 1901*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_client_method(void)) 1902*1dcdf01fSchristos # endif 1903*1dcdf01fSchristos 1904*1dcdf01fSchristos # ifndef OPENSSL_NO_DTLS1_METHOD 1905*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_method(void)) /* DTLSv1.0 */ 1906*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_server_method(void)) 1907*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_client_method(void)) 1908*1dcdf01fSchristos # endif 1909*1dcdf01fSchristos 1910*1dcdf01fSchristos # ifndef OPENSSL_NO_DTLS1_2_METHOD 1911*1dcdf01fSchristos /* DTLSv1.2 */ 1912*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_2_method(void)) 1913*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_2_server_method(void)) 1914*1dcdf01fSchristos DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_2_client_method(void)) 1915*1dcdf01fSchristos # endif 1916*1dcdf01fSchristos 1917*1dcdf01fSchristos __owur const SSL_METHOD *DTLS_method(void); /* DTLS 1.0 and 1.2 */ 1918*1dcdf01fSchristos __owur const SSL_METHOD *DTLS_server_method(void); /* DTLS 1.0 and 1.2 */ 1919*1dcdf01fSchristos __owur const SSL_METHOD *DTLS_client_method(void); /* DTLS 1.0 and 1.2 */ 1920*1dcdf01fSchristos 1921*1dcdf01fSchristos __owur size_t DTLS_get_data_mtu(const SSL *s); 1922*1dcdf01fSchristos 1923*1dcdf01fSchristos __owur STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s); 1924*1dcdf01fSchristos __owur STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx); 1925*1dcdf01fSchristos __owur STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s); 1926*1dcdf01fSchristos __owur STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s); 1927*1dcdf01fSchristos 1928*1dcdf01fSchristos __owur int SSL_do_handshake(SSL *s); 1929*1dcdf01fSchristos int SSL_key_update(SSL *s, int updatetype); 1930*1dcdf01fSchristos int SSL_get_key_update_type(const SSL *s); 1931*1dcdf01fSchristos int SSL_renegotiate(SSL *s); 1932*1dcdf01fSchristos int SSL_renegotiate_abbreviated(SSL *s); 1933*1dcdf01fSchristos __owur int SSL_renegotiate_pending(const SSL *s); 1934*1dcdf01fSchristos int SSL_shutdown(SSL *s); 1935*1dcdf01fSchristos __owur int SSL_verify_client_post_handshake(SSL *s); 1936*1dcdf01fSchristos void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val); 1937*1dcdf01fSchristos void SSL_set_post_handshake_auth(SSL *s, int val); 1938*1dcdf01fSchristos 1939*1dcdf01fSchristos __owur const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx); 1940*1dcdf01fSchristos __owur const SSL_METHOD *SSL_get_ssl_method(const SSL *s); 1941*1dcdf01fSchristos __owur int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method); 1942*1dcdf01fSchristos __owur const char *SSL_alert_type_string_long(int value); 1943*1dcdf01fSchristos __owur const char *SSL_alert_type_string(int value); 1944*1dcdf01fSchristos __owur const char *SSL_alert_desc_string_long(int value); 1945*1dcdf01fSchristos __owur const char *SSL_alert_desc_string(int value); 1946*1dcdf01fSchristos 1947*1dcdf01fSchristos void SSL_set0_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list); 1948*1dcdf01fSchristos void SSL_CTX_set0_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list); 1949*1dcdf01fSchristos __owur const STACK_OF(X509_NAME) *SSL_get0_CA_list(const SSL *s); 1950*1dcdf01fSchristos __owur const STACK_OF(X509_NAME) *SSL_CTX_get0_CA_list(const SSL_CTX *ctx); 1951*1dcdf01fSchristos __owur int SSL_add1_to_CA_list(SSL *ssl, const X509 *x); 1952*1dcdf01fSchristos __owur int SSL_CTX_add1_to_CA_list(SSL_CTX *ctx, const X509 *x); 1953*1dcdf01fSchristos __owur const STACK_OF(X509_NAME) *SSL_get0_peer_CA_list(const SSL *s); 1954*1dcdf01fSchristos 1955*1dcdf01fSchristos void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list); 1956*1dcdf01fSchristos void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list); 1957*1dcdf01fSchristos __owur STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s); 1958*1dcdf01fSchristos __owur STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *s); 1959*1dcdf01fSchristos __owur int SSL_add_client_CA(SSL *ssl, X509 *x); 1960*1dcdf01fSchristos __owur int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); 1961*1dcdf01fSchristos 1962*1dcdf01fSchristos void SSL_set_connect_state(SSL *s); 1963*1dcdf01fSchristos void SSL_set_accept_state(SSL *s); 1964*1dcdf01fSchristos 1965*1dcdf01fSchristos __owur long SSL_get_default_timeout(const SSL *s); 1966*1dcdf01fSchristos 1967*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 1968*1dcdf01fSchristos # define SSL_library_init() OPENSSL_init_ssl(0, NULL) 1969*1dcdf01fSchristos # endif 1970*1dcdf01fSchristos 1971*1dcdf01fSchristos __owur char *SSL_CIPHER_description(const SSL_CIPHER *, char *buf, int size); 1972*1dcdf01fSchristos __owur STACK_OF(X509_NAME) *SSL_dup_CA_list(const STACK_OF(X509_NAME) *sk); 1973*1dcdf01fSchristos 1974*1dcdf01fSchristos __owur SSL *SSL_dup(SSL *ssl); 1975*1dcdf01fSchristos 1976*1dcdf01fSchristos __owur X509 *SSL_get_certificate(const SSL *ssl); 1977*1dcdf01fSchristos /* 1978*1dcdf01fSchristos * EVP_PKEY 1979*1dcdf01fSchristos */ 1980*1dcdf01fSchristos struct evp_pkey_st *SSL_get_privatekey(const SSL *ssl); 1981*1dcdf01fSchristos 1982*1dcdf01fSchristos __owur X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx); 1983*1dcdf01fSchristos __owur EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx); 1984*1dcdf01fSchristos 1985*1dcdf01fSchristos void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode); 1986*1dcdf01fSchristos __owur int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx); 1987*1dcdf01fSchristos void SSL_set_quiet_shutdown(SSL *ssl, int mode); 1988*1dcdf01fSchristos __owur int SSL_get_quiet_shutdown(const SSL *ssl); 1989*1dcdf01fSchristos void SSL_set_shutdown(SSL *ssl, int mode); 1990*1dcdf01fSchristos __owur int SSL_get_shutdown(const SSL *ssl); 1991*1dcdf01fSchristos __owur int SSL_version(const SSL *ssl); 1992*1dcdf01fSchristos __owur int SSL_client_version(const SSL *s); 1993*1dcdf01fSchristos __owur int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx); 1994*1dcdf01fSchristos __owur int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx); 1995*1dcdf01fSchristos __owur int SSL_CTX_set_default_verify_file(SSL_CTX *ctx); 1996*1dcdf01fSchristos __owur int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, 1997*1dcdf01fSchristos const char *CApath); 1998*1dcdf01fSchristos # define SSL_get0_session SSL_get_session/* just peek at pointer */ 1999*1dcdf01fSchristos __owur SSL_SESSION *SSL_get_session(const SSL *ssl); 2000*1dcdf01fSchristos __owur SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */ 2001*1dcdf01fSchristos __owur SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl); 2002*1dcdf01fSchristos SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx); 2003*1dcdf01fSchristos void SSL_set_info_callback(SSL *ssl, 2004*1dcdf01fSchristos void (*cb) (const SSL *ssl, int type, int val)); 2005*1dcdf01fSchristos void (*SSL_get_info_callback(const SSL *ssl)) (const SSL *ssl, int type, 2006*1dcdf01fSchristos int val); 2007*1dcdf01fSchristos __owur OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl); 2008*1dcdf01fSchristos 2009*1dcdf01fSchristos void SSL_set_verify_result(SSL *ssl, long v); 2010*1dcdf01fSchristos __owur long SSL_get_verify_result(const SSL *ssl); 2011*1dcdf01fSchristos __owur STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s); 2012*1dcdf01fSchristos 2013*1dcdf01fSchristos __owur size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, 2014*1dcdf01fSchristos size_t outlen); 2015*1dcdf01fSchristos __owur size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, 2016*1dcdf01fSchristos size_t outlen); 2017*1dcdf01fSchristos __owur size_t SSL_SESSION_get_master_key(const SSL_SESSION *sess, 2018*1dcdf01fSchristos unsigned char *out, size_t outlen); 2019*1dcdf01fSchristos __owur int SSL_SESSION_set1_master_key(SSL_SESSION *sess, 2020*1dcdf01fSchristos const unsigned char *in, size_t len); 2021*1dcdf01fSchristos uint8_t SSL_SESSION_get_max_fragment_length(const SSL_SESSION *sess); 2022*1dcdf01fSchristos 2023*1dcdf01fSchristos #define SSL_get_ex_new_index(l, p, newf, dupf, freef) \ 2024*1dcdf01fSchristos CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, l, p, newf, dupf, freef) 2025*1dcdf01fSchristos __owur int SSL_set_ex_data(SSL *ssl, int idx, void *data); 2026*1dcdf01fSchristos void *SSL_get_ex_data(const SSL *ssl, int idx); 2027*1dcdf01fSchristos #define SSL_SESSION_get_ex_new_index(l, p, newf, dupf, freef) \ 2028*1dcdf01fSchristos CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, l, p, newf, dupf, freef) 2029*1dcdf01fSchristos __owur int SSL_SESSION_set_ex_data(SSL_SESSION *ss, int idx, void *data); 2030*1dcdf01fSchristos void *SSL_SESSION_get_ex_data(const SSL_SESSION *ss, int idx); 2031*1dcdf01fSchristos #define SSL_CTX_get_ex_new_index(l, p, newf, dupf, freef) \ 2032*1dcdf01fSchristos CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, l, p, newf, dupf, freef) 2033*1dcdf01fSchristos __owur int SSL_CTX_set_ex_data(SSL_CTX *ssl, int idx, void *data); 2034*1dcdf01fSchristos void *SSL_CTX_get_ex_data(const SSL_CTX *ssl, int idx); 2035*1dcdf01fSchristos 2036*1dcdf01fSchristos __owur int SSL_get_ex_data_X509_STORE_CTX_idx(void); 2037*1dcdf01fSchristos 2038*1dcdf01fSchristos # define SSL_CTX_sess_set_cache_size(ctx,t) \ 2039*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_SIZE,t,NULL) 2040*1dcdf01fSchristos # define SSL_CTX_sess_get_cache_size(ctx) \ 2041*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_SIZE,0,NULL) 2042*1dcdf01fSchristos # define SSL_CTX_set_session_cache_mode(ctx,m) \ 2043*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL) 2044*1dcdf01fSchristos # define SSL_CTX_get_session_cache_mode(ctx) \ 2045*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL) 2046*1dcdf01fSchristos 2047*1dcdf01fSchristos # define SSL_CTX_get_default_read_ahead(ctx) SSL_CTX_get_read_ahead(ctx) 2048*1dcdf01fSchristos # define SSL_CTX_set_default_read_ahead(ctx,m) SSL_CTX_set_read_ahead(ctx,m) 2049*1dcdf01fSchristos # define SSL_CTX_get_read_ahead(ctx) \ 2050*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_READ_AHEAD,0,NULL) 2051*1dcdf01fSchristos # define SSL_CTX_set_read_ahead(ctx,m) \ 2052*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_READ_AHEAD,m,NULL) 2053*1dcdf01fSchristos # define SSL_CTX_get_max_cert_list(ctx) \ 2054*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL) 2055*1dcdf01fSchristos # define SSL_CTX_set_max_cert_list(ctx,m) \ 2056*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL) 2057*1dcdf01fSchristos # define SSL_get_max_cert_list(ssl) \ 2058*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL) 2059*1dcdf01fSchristos # define SSL_set_max_cert_list(ssl,m) \ 2060*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL) 2061*1dcdf01fSchristos 2062*1dcdf01fSchristos # define SSL_CTX_set_max_send_fragment(ctx,m) \ 2063*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL) 2064*1dcdf01fSchristos # define SSL_set_max_send_fragment(ssl,m) \ 2065*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL) 2066*1dcdf01fSchristos # define SSL_CTX_set_split_send_fragment(ctx,m) \ 2067*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SPLIT_SEND_FRAGMENT,m,NULL) 2068*1dcdf01fSchristos # define SSL_set_split_send_fragment(ssl,m) \ 2069*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_SET_SPLIT_SEND_FRAGMENT,m,NULL) 2070*1dcdf01fSchristos # define SSL_CTX_set_max_pipelines(ctx,m) \ 2071*1dcdf01fSchristos SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_PIPELINES,m,NULL) 2072*1dcdf01fSchristos # define SSL_set_max_pipelines(ssl,m) \ 2073*1dcdf01fSchristos SSL_ctrl(ssl,SSL_CTRL_SET_MAX_PIPELINES,m,NULL) 2074*1dcdf01fSchristos 2075*1dcdf01fSchristos void SSL_CTX_set_default_read_buffer_len(SSL_CTX *ctx, size_t len); 2076*1dcdf01fSchristos void SSL_set_default_read_buffer_len(SSL *s, size_t len); 2077*1dcdf01fSchristos 2078*1dcdf01fSchristos # ifndef OPENSSL_NO_DH 2079*1dcdf01fSchristos /* NB: the |keylength| is only applicable when is_export is true */ 2080*1dcdf01fSchristos void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, 2081*1dcdf01fSchristos DH *(*dh) (SSL *ssl, int is_export, 2082*1dcdf01fSchristos int keylength)); 2083*1dcdf01fSchristos void SSL_set_tmp_dh_callback(SSL *ssl, 2084*1dcdf01fSchristos DH *(*dh) (SSL *ssl, int is_export, 2085*1dcdf01fSchristos int keylength)); 2086*1dcdf01fSchristos # endif 2087*1dcdf01fSchristos 2088*1dcdf01fSchristos __owur const COMP_METHOD *SSL_get_current_compression(const SSL *s); 2089*1dcdf01fSchristos __owur const COMP_METHOD *SSL_get_current_expansion(const SSL *s); 2090*1dcdf01fSchristos __owur const char *SSL_COMP_get_name(const COMP_METHOD *comp); 2091*1dcdf01fSchristos __owur const char *SSL_COMP_get0_name(const SSL_COMP *comp); 2092*1dcdf01fSchristos __owur int SSL_COMP_get_id(const SSL_COMP *comp); 2093*1dcdf01fSchristos STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void); 2094*1dcdf01fSchristos __owur STACK_OF(SSL_COMP) *SSL_COMP_set0_compression_methods(STACK_OF(SSL_COMP) 2095*1dcdf01fSchristos *meths); 2096*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 2097*1dcdf01fSchristos # define SSL_COMP_free_compression_methods() while(0) continue 2098*1dcdf01fSchristos # endif 2099*1dcdf01fSchristos __owur int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm); 2100*1dcdf01fSchristos 2101*1dcdf01fSchristos const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr); 2102*1dcdf01fSchristos int SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c); 2103*1dcdf01fSchristos int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c); 2104*1dcdf01fSchristos int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len, 2105*1dcdf01fSchristos int isv2format, STACK_OF(SSL_CIPHER) **sk, 2106*1dcdf01fSchristos STACK_OF(SSL_CIPHER) **scsvs); 2107*1dcdf01fSchristos 2108*1dcdf01fSchristos /* TLS extensions functions */ 2109*1dcdf01fSchristos __owur int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len); 2110*1dcdf01fSchristos 2111*1dcdf01fSchristos __owur int SSL_set_session_ticket_ext_cb(SSL *s, 2112*1dcdf01fSchristos tls_session_ticket_ext_cb_fn cb, 2113*1dcdf01fSchristos void *arg); 2114*1dcdf01fSchristos 2115*1dcdf01fSchristos /* Pre-shared secret session resumption functions */ 2116*1dcdf01fSchristos __owur int SSL_set_session_secret_cb(SSL *s, 2117*1dcdf01fSchristos tls_session_secret_cb_fn session_secret_cb, 2118*1dcdf01fSchristos void *arg); 2119*1dcdf01fSchristos 2120*1dcdf01fSchristos void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, 2121*1dcdf01fSchristos int (*cb) (SSL *ssl, 2122*1dcdf01fSchristos int 2123*1dcdf01fSchristos is_forward_secure)); 2124*1dcdf01fSchristos 2125*1dcdf01fSchristos void SSL_set_not_resumable_session_callback(SSL *ssl, 2126*1dcdf01fSchristos int (*cb) (SSL *ssl, 2127*1dcdf01fSchristos int is_forward_secure)); 2128*1dcdf01fSchristos 2129*1dcdf01fSchristos void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, 2130*1dcdf01fSchristos size_t (*cb) (SSL *ssl, int type, 2131*1dcdf01fSchristos size_t len, void *arg)); 2132*1dcdf01fSchristos void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg); 2133*1dcdf01fSchristos void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx); 2134*1dcdf01fSchristos int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size); 2135*1dcdf01fSchristos 2136*1dcdf01fSchristos void SSL_set_record_padding_callback(SSL *ssl, 2137*1dcdf01fSchristos size_t (*cb) (SSL *ssl, int type, 2138*1dcdf01fSchristos size_t len, void *arg)); 2139*1dcdf01fSchristos void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg); 2140*1dcdf01fSchristos void *SSL_get_record_padding_callback_arg(const SSL *ssl); 2141*1dcdf01fSchristos int SSL_set_block_padding(SSL *ssl, size_t block_size); 2142*1dcdf01fSchristos 2143*1dcdf01fSchristos int SSL_set_num_tickets(SSL *s, size_t num_tickets); 2144*1dcdf01fSchristos size_t SSL_get_num_tickets(const SSL *s); 2145*1dcdf01fSchristos int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets); 2146*1dcdf01fSchristos size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx); 2147*1dcdf01fSchristos 2148*1dcdf01fSchristos # if OPENSSL_API_COMPAT < 0x10100000L 2149*1dcdf01fSchristos # define SSL_cache_hit(s) SSL_session_reused(s) 2150*1dcdf01fSchristos # endif 2151*1dcdf01fSchristos 2152*1dcdf01fSchristos __owur int SSL_session_reused(const SSL *s); 2153*1dcdf01fSchristos __owur int SSL_is_server(const SSL *s); 2154*1dcdf01fSchristos 2155*1dcdf01fSchristos __owur __owur SSL_CONF_CTX *SSL_CONF_CTX_new(void); 2156*1dcdf01fSchristos int SSL_CONF_CTX_finish(SSL_CONF_CTX *cctx); 2157*1dcdf01fSchristos void SSL_CONF_CTX_free(SSL_CONF_CTX *cctx); 2158*1dcdf01fSchristos unsigned int SSL_CONF_CTX_set_flags(SSL_CONF_CTX *cctx, unsigned int flags); 2159*1dcdf01fSchristos __owur unsigned int SSL_CONF_CTX_clear_flags(SSL_CONF_CTX *cctx, 2160*1dcdf01fSchristos unsigned int flags); 2161*1dcdf01fSchristos __owur int SSL_CONF_CTX_set1_prefix(SSL_CONF_CTX *cctx, const char *pre); 2162*1dcdf01fSchristos 2163*1dcdf01fSchristos void SSL_CONF_CTX_set_ssl(SSL_CONF_CTX *cctx, SSL *ssl); 2164*1dcdf01fSchristos void SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *cctx, SSL_CTX *ctx); 2165*1dcdf01fSchristos 2166*1dcdf01fSchristos __owur int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value); 2167*1dcdf01fSchristos __owur int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv); 2168*1dcdf01fSchristos __owur int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd); 2169*1dcdf01fSchristos 2170*1dcdf01fSchristos void SSL_add_ssl_module(void); 2171*1dcdf01fSchristos int SSL_config(SSL *s, const char *name); 2172*1dcdf01fSchristos int SSL_CTX_config(SSL_CTX *ctx, const char *name); 2173*1dcdf01fSchristos 2174*1dcdf01fSchristos # ifndef OPENSSL_NO_SSL_TRACE 2175*1dcdf01fSchristos void SSL_trace(int write_p, int version, int content_type, 2176*1dcdf01fSchristos const void *buf, size_t len, SSL *ssl, void *arg); 2177*1dcdf01fSchristos # endif 2178*1dcdf01fSchristos 2179*1dcdf01fSchristos # ifndef OPENSSL_NO_SOCK 2180*1dcdf01fSchristos int DTLSv1_listen(SSL *s, BIO_ADDR *client); 2181*1dcdf01fSchristos # endif 2182*1dcdf01fSchristos 2183*1dcdf01fSchristos # ifndef OPENSSL_NO_CT 2184*1dcdf01fSchristos 2185*1dcdf01fSchristos /* 2186*1dcdf01fSchristos * A callback for verifying that the received SCTs are sufficient. 2187*1dcdf01fSchristos * Expected to return 1 if they are sufficient, otherwise 0. 2188*1dcdf01fSchristos * May return a negative integer if an error occurs. 2189*1dcdf01fSchristos * A connection should be aborted if the SCTs are deemed insufficient. 2190*1dcdf01fSchristos */ 2191*1dcdf01fSchristos typedef int (*ssl_ct_validation_cb)(const CT_POLICY_EVAL_CTX *ctx, 2192*1dcdf01fSchristos const STACK_OF(SCT) *scts, void *arg); 2193*1dcdf01fSchristos 2194*1dcdf01fSchristos /* 2195*1dcdf01fSchristos * Sets a |callback| that is invoked upon receipt of ServerHelloDone to validate 2196*1dcdf01fSchristos * the received SCTs. 2197*1dcdf01fSchristos * If the callback returns a non-positive result, the connection is terminated. 2198*1dcdf01fSchristos * Call this function before beginning a handshake. 2199*1dcdf01fSchristos * If a NULL |callback| is provided, SCT validation is disabled. 2200*1dcdf01fSchristos * |arg| is arbitrary userdata that will be passed to the callback whenever it 2201*1dcdf01fSchristos * is invoked. Ownership of |arg| remains with the caller. 2202*1dcdf01fSchristos * 2203*1dcdf01fSchristos * NOTE: A side-effect of setting a CT callback is that an OCSP stapled response 2204*1dcdf01fSchristos * will be requested. 2205*1dcdf01fSchristos */ 2206*1dcdf01fSchristos int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback, 2207*1dcdf01fSchristos void *arg); 2208*1dcdf01fSchristos int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx, 2209*1dcdf01fSchristos ssl_ct_validation_cb callback, 2210*1dcdf01fSchristos void *arg); 2211*1dcdf01fSchristos #define SSL_disable_ct(s) \ 2212*1dcdf01fSchristos ((void) SSL_set_validation_callback((s), NULL, NULL)) 2213*1dcdf01fSchristos #define SSL_CTX_disable_ct(ctx) \ 2214*1dcdf01fSchristos ((void) SSL_CTX_set_validation_callback((ctx), NULL, NULL)) 2215*1dcdf01fSchristos 2216*1dcdf01fSchristos /* 2217*1dcdf01fSchristos * The validation type enumerates the available behaviours of the built-in SSL 2218*1dcdf01fSchristos * CT validation callback selected via SSL_enable_ct() and SSL_CTX_enable_ct(). 2219*1dcdf01fSchristos * The underlying callback is a static function in libssl. 2220*1dcdf01fSchristos */ 2221*1dcdf01fSchristos enum { 2222*1dcdf01fSchristos SSL_CT_VALIDATION_PERMISSIVE = 0, 2223*1dcdf01fSchristos SSL_CT_VALIDATION_STRICT 2224*1dcdf01fSchristos }; 2225*1dcdf01fSchristos 2226*1dcdf01fSchristos /* 2227*1dcdf01fSchristos * Enable CT by setting up a callback that implements one of the built-in 2228*1dcdf01fSchristos * validation variants. The SSL_CT_VALIDATION_PERMISSIVE variant always 2229*1dcdf01fSchristos * continues the handshake, the application can make appropriate decisions at 2230*1dcdf01fSchristos * handshake completion. The SSL_CT_VALIDATION_STRICT variant requires at 2231*1dcdf01fSchristos * least one valid SCT, or else handshake termination will be requested. The 2232*1dcdf01fSchristos * handshake may continue anyway if SSL_VERIFY_NONE is in effect. 2233*1dcdf01fSchristos */ 2234*1dcdf01fSchristos int SSL_enable_ct(SSL *s, int validation_mode); 2235*1dcdf01fSchristos int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode); 2236*1dcdf01fSchristos 2237*1dcdf01fSchristos /* 2238*1dcdf01fSchristos * Report whether a non-NULL callback is enabled. 2239*1dcdf01fSchristos */ 2240*1dcdf01fSchristos int SSL_ct_is_enabled(const SSL *s); 2241*1dcdf01fSchristos int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx); 2242*1dcdf01fSchristos 2243*1dcdf01fSchristos /* Gets the SCTs received from a connection */ 2244*1dcdf01fSchristos const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s); 2245*1dcdf01fSchristos 2246*1dcdf01fSchristos /* 2247*1dcdf01fSchristos * Loads the CT log list from the default location. 2248*1dcdf01fSchristos * If a CTLOG_STORE has previously been set using SSL_CTX_set_ctlog_store, 2249*1dcdf01fSchristos * the log information loaded from this file will be appended to the 2250*1dcdf01fSchristos * CTLOG_STORE. 2251*1dcdf01fSchristos * Returns 1 on success, 0 otherwise. 2252*1dcdf01fSchristos */ 2253*1dcdf01fSchristos int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx); 2254*1dcdf01fSchristos 2255*1dcdf01fSchristos /* 2256*1dcdf01fSchristos * Loads the CT log list from the specified file path. 2257*1dcdf01fSchristos * If a CTLOG_STORE has previously been set using SSL_CTX_set_ctlog_store, 2258*1dcdf01fSchristos * the log information loaded from this file will be appended to the 2259*1dcdf01fSchristos * CTLOG_STORE. 2260*1dcdf01fSchristos * Returns 1 on success, 0 otherwise. 2261*1dcdf01fSchristos */ 2262*1dcdf01fSchristos int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path); 2263*1dcdf01fSchristos 2264*1dcdf01fSchristos /* 2265*1dcdf01fSchristos * Sets the CT log list used by all SSL connections created from this SSL_CTX. 2266*1dcdf01fSchristos * Ownership of the CTLOG_STORE is transferred to the SSL_CTX. 2267*1dcdf01fSchristos */ 2268*1dcdf01fSchristos void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE *logs); 2269*1dcdf01fSchristos 2270*1dcdf01fSchristos /* 2271*1dcdf01fSchristos * Gets the CT log list used by all SSL connections created from this SSL_CTX. 2272*1dcdf01fSchristos * This will be NULL unless one of the following functions has been called: 2273*1dcdf01fSchristos * - SSL_CTX_set_default_ctlog_list_file 2274*1dcdf01fSchristos * - SSL_CTX_set_ctlog_list_file 2275*1dcdf01fSchristos * - SSL_CTX_set_ctlog_store 2276*1dcdf01fSchristos */ 2277*1dcdf01fSchristos const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx); 2278*1dcdf01fSchristos 2279*1dcdf01fSchristos # endif /* OPENSSL_NO_CT */ 2280*1dcdf01fSchristos 2281*1dcdf01fSchristos /* What the "other" parameter contains in security callback */ 2282*1dcdf01fSchristos /* Mask for type */ 2283*1dcdf01fSchristos # define SSL_SECOP_OTHER_TYPE 0xffff0000 2284*1dcdf01fSchristos # define SSL_SECOP_OTHER_NONE 0 2285*1dcdf01fSchristos # define SSL_SECOP_OTHER_CIPHER (1 << 16) 2286*1dcdf01fSchristos # define SSL_SECOP_OTHER_CURVE (2 << 16) 2287*1dcdf01fSchristos # define SSL_SECOP_OTHER_DH (3 << 16) 2288*1dcdf01fSchristos # define SSL_SECOP_OTHER_PKEY (4 << 16) 2289*1dcdf01fSchristos # define SSL_SECOP_OTHER_SIGALG (5 << 16) 2290*1dcdf01fSchristos # define SSL_SECOP_OTHER_CERT (6 << 16) 2291*1dcdf01fSchristos 2292*1dcdf01fSchristos /* Indicated operation refers to peer key or certificate */ 2293*1dcdf01fSchristos # define SSL_SECOP_PEER 0x1000 2294*1dcdf01fSchristos 2295*1dcdf01fSchristos /* Values for "op" parameter in security callback */ 2296*1dcdf01fSchristos 2297*1dcdf01fSchristos /* Called to filter ciphers */ 2298*1dcdf01fSchristos /* Ciphers client supports */ 2299*1dcdf01fSchristos # define SSL_SECOP_CIPHER_SUPPORTED (1 | SSL_SECOP_OTHER_CIPHER) 2300*1dcdf01fSchristos /* Cipher shared by client/server */ 2301*1dcdf01fSchristos # define SSL_SECOP_CIPHER_SHARED (2 | SSL_SECOP_OTHER_CIPHER) 2302*1dcdf01fSchristos /* Sanity check of cipher server selects */ 2303*1dcdf01fSchristos # define SSL_SECOP_CIPHER_CHECK (3 | SSL_SECOP_OTHER_CIPHER) 2304*1dcdf01fSchristos /* Curves supported by client */ 2305*1dcdf01fSchristos # define SSL_SECOP_CURVE_SUPPORTED (4 | SSL_SECOP_OTHER_CURVE) 2306*1dcdf01fSchristos /* Curves shared by client/server */ 2307*1dcdf01fSchristos # define SSL_SECOP_CURVE_SHARED (5 | SSL_SECOP_OTHER_CURVE) 2308*1dcdf01fSchristos /* Sanity check of curve server selects */ 2309*1dcdf01fSchristos # define SSL_SECOP_CURVE_CHECK (6 | SSL_SECOP_OTHER_CURVE) 2310*1dcdf01fSchristos /* Temporary DH key */ 2311*1dcdf01fSchristos # define SSL_SECOP_TMP_DH (7 | SSL_SECOP_OTHER_PKEY) 2312*1dcdf01fSchristos /* SSL/TLS version */ 2313*1dcdf01fSchristos # define SSL_SECOP_VERSION (9 | SSL_SECOP_OTHER_NONE) 2314*1dcdf01fSchristos /* Session tickets */ 2315*1dcdf01fSchristos # define SSL_SECOP_TICKET (10 | SSL_SECOP_OTHER_NONE) 2316*1dcdf01fSchristos /* Supported signature algorithms sent to peer */ 2317*1dcdf01fSchristos # define SSL_SECOP_SIGALG_SUPPORTED (11 | SSL_SECOP_OTHER_SIGALG) 2318*1dcdf01fSchristos /* Shared signature algorithm */ 2319*1dcdf01fSchristos # define SSL_SECOP_SIGALG_SHARED (12 | SSL_SECOP_OTHER_SIGALG) 2320*1dcdf01fSchristos /* Sanity check signature algorithm allowed */ 2321*1dcdf01fSchristos # define SSL_SECOP_SIGALG_CHECK (13 | SSL_SECOP_OTHER_SIGALG) 2322*1dcdf01fSchristos /* Used to get mask of supported public key signature algorithms */ 2323*1dcdf01fSchristos # define SSL_SECOP_SIGALG_MASK (14 | SSL_SECOP_OTHER_SIGALG) 2324*1dcdf01fSchristos /* Use to see if compression is allowed */ 2325*1dcdf01fSchristos # define SSL_SECOP_COMPRESSION (15 | SSL_SECOP_OTHER_NONE) 2326*1dcdf01fSchristos /* EE key in certificate */ 2327*1dcdf01fSchristos # define SSL_SECOP_EE_KEY (16 | SSL_SECOP_OTHER_CERT) 2328*1dcdf01fSchristos /* CA key in certificate */ 2329*1dcdf01fSchristos # define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) 2330*1dcdf01fSchristos /* CA digest algorithm in certificate */ 2331*1dcdf01fSchristos # define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) 2332*1dcdf01fSchristos /* Peer EE key in certificate */ 2333*1dcdf01fSchristos # define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) 2334*1dcdf01fSchristos /* Peer CA key in certificate */ 2335*1dcdf01fSchristos # define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) 2336*1dcdf01fSchristos /* Peer CA digest algorithm in certificate */ 2337*1dcdf01fSchristos # define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) 2338*1dcdf01fSchristos 2339*1dcdf01fSchristos void SSL_set_security_level(SSL *s, int level); 2340*1dcdf01fSchristos __owur int SSL_get_security_level(const SSL *s); 2341*1dcdf01fSchristos void SSL_set_security_callback(SSL *s, 2342*1dcdf01fSchristos int (*cb) (const SSL *s, const SSL_CTX *ctx, 2343*1dcdf01fSchristos int op, int bits, int nid, 2344*1dcdf01fSchristos void *other, void *ex)); 2345*1dcdf01fSchristos int (*SSL_get_security_callback(const SSL *s)) (const SSL *s, 2346*1dcdf01fSchristos const SSL_CTX *ctx, int op, 2347*1dcdf01fSchristos int bits, int nid, void *other, 2348*1dcdf01fSchristos void *ex); 2349*1dcdf01fSchristos void SSL_set0_security_ex_data(SSL *s, void *ex); 2350*1dcdf01fSchristos __owur void *SSL_get0_security_ex_data(const SSL *s); 2351*1dcdf01fSchristos 2352*1dcdf01fSchristos void SSL_CTX_set_security_level(SSL_CTX *ctx, int level); 2353*1dcdf01fSchristos __owur int SSL_CTX_get_security_level(const SSL_CTX *ctx); 2354*1dcdf01fSchristos void SSL_CTX_set_security_callback(SSL_CTX *ctx, 2355*1dcdf01fSchristos int (*cb) (const SSL *s, const SSL_CTX *ctx, 2356*1dcdf01fSchristos int op, int bits, int nid, 2357*1dcdf01fSchristos void *other, void *ex)); 2358*1dcdf01fSchristos int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s, 2359*1dcdf01fSchristos const SSL_CTX *ctx, 2360*1dcdf01fSchristos int op, int bits, 2361*1dcdf01fSchristos int nid, 2362*1dcdf01fSchristos void *other, 2363*1dcdf01fSchristos void *ex); 2364*1dcdf01fSchristos void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex); 2365*1dcdf01fSchristos __owur void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx); 2366*1dcdf01fSchristos 2367*1dcdf01fSchristos /* OPENSSL_INIT flag 0x010000 reserved for internal use */ 2368*1dcdf01fSchristos # define OPENSSL_INIT_NO_LOAD_SSL_STRINGS 0x00100000L 2369*1dcdf01fSchristos # define OPENSSL_INIT_LOAD_SSL_STRINGS 0x00200000L 2370*1dcdf01fSchristos 2371*1dcdf01fSchristos # define OPENSSL_INIT_SSL_DEFAULT \ 2372*1dcdf01fSchristos (OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS) 2373*1dcdf01fSchristos 2374*1dcdf01fSchristos int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings); 2375*1dcdf01fSchristos 2376*1dcdf01fSchristos # ifndef OPENSSL_NO_UNIT_TEST 2377*1dcdf01fSchristos __owur const struct openssl_ssl_test_functions *SSL_test_functions(void); 2378*1dcdf01fSchristos # endif 2379*1dcdf01fSchristos 2380*1dcdf01fSchristos __owur int SSL_free_buffers(SSL *ssl); 2381*1dcdf01fSchristos __owur int SSL_alloc_buffers(SSL *ssl); 2382*1dcdf01fSchristos 2383*1dcdf01fSchristos /* Status codes passed to the decrypt session ticket callback. Some of these 2384*1dcdf01fSchristos * are for internal use only and are never passed to the callback. */ 2385*1dcdf01fSchristos typedef int SSL_TICKET_STATUS; 2386*1dcdf01fSchristos 2387*1dcdf01fSchristos /* Support for ticket appdata */ 2388*1dcdf01fSchristos /* fatal error, malloc failure */ 2389*1dcdf01fSchristos # define SSL_TICKET_FATAL_ERR_MALLOC 0 2390*1dcdf01fSchristos /* fatal error, either from parsing or decrypting the ticket */ 2391*1dcdf01fSchristos # define SSL_TICKET_FATAL_ERR_OTHER 1 2392*1dcdf01fSchristos /* No ticket present */ 2393*1dcdf01fSchristos # define SSL_TICKET_NONE 2 2394*1dcdf01fSchristos /* Empty ticket present */ 2395*1dcdf01fSchristos # define SSL_TICKET_EMPTY 3 2396*1dcdf01fSchristos /* the ticket couldn't be decrypted */ 2397*1dcdf01fSchristos # define SSL_TICKET_NO_DECRYPT 4 2398*1dcdf01fSchristos /* a ticket was successfully decrypted */ 2399*1dcdf01fSchristos # define SSL_TICKET_SUCCESS 5 2400*1dcdf01fSchristos /* same as above but the ticket needs to be renewed */ 2401*1dcdf01fSchristos # define SSL_TICKET_SUCCESS_RENEW 6 2402*1dcdf01fSchristos 2403*1dcdf01fSchristos /* Return codes for the decrypt session ticket callback */ 2404*1dcdf01fSchristos typedef int SSL_TICKET_RETURN; 2405*1dcdf01fSchristos 2406*1dcdf01fSchristos /* An error occurred */ 2407*1dcdf01fSchristos #define SSL_TICKET_RETURN_ABORT 0 2408*1dcdf01fSchristos /* Do not use the ticket, do not send a renewed ticket to the client */ 2409*1dcdf01fSchristos #define SSL_TICKET_RETURN_IGNORE 1 2410*1dcdf01fSchristos /* Do not use the ticket, send a renewed ticket to the client */ 2411*1dcdf01fSchristos #define SSL_TICKET_RETURN_IGNORE_RENEW 2 2412*1dcdf01fSchristos /* Use the ticket, do not send a renewed ticket to the client */ 2413*1dcdf01fSchristos #define SSL_TICKET_RETURN_USE 3 2414*1dcdf01fSchristos /* Use the ticket, send a renewed ticket to the client */ 2415*1dcdf01fSchristos #define SSL_TICKET_RETURN_USE_RENEW 4 2416*1dcdf01fSchristos 2417*1dcdf01fSchristos typedef int (*SSL_CTX_generate_session_ticket_fn)(SSL *s, void *arg); 2418*1dcdf01fSchristos typedef SSL_TICKET_RETURN (*SSL_CTX_decrypt_session_ticket_fn)(SSL *s, SSL_SESSION *ss, 2419*1dcdf01fSchristos const unsigned char *keyname, 2420*1dcdf01fSchristos size_t keyname_length, 2421*1dcdf01fSchristos SSL_TICKET_STATUS status, 2422*1dcdf01fSchristos void *arg); 2423*1dcdf01fSchristos int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, 2424*1dcdf01fSchristos SSL_CTX_generate_session_ticket_fn gen_cb, 2425*1dcdf01fSchristos SSL_CTX_decrypt_session_ticket_fn dec_cb, 2426*1dcdf01fSchristos void *arg); 2427*1dcdf01fSchristos int SSL_SESSION_set1_ticket_appdata(SSL_SESSION *ss, const void *data, size_t len); 2428*1dcdf01fSchristos int SSL_SESSION_get0_ticket_appdata(SSL_SESSION *ss, void **data, size_t *len); 2429*1dcdf01fSchristos 2430*1dcdf01fSchristos extern const char SSL_version_str[]; 2431*1dcdf01fSchristos 2432*1dcdf01fSchristos typedef unsigned int (*DTLS_timer_cb)(SSL *s, unsigned int timer_us); 2433*1dcdf01fSchristos 2434*1dcdf01fSchristos void DTLS_set_timer_cb(SSL *s, DTLS_timer_cb cb); 2435*1dcdf01fSchristos 2436*1dcdf01fSchristos 2437*1dcdf01fSchristos typedef int (*SSL_allow_early_data_cb_fn)(SSL *s, void *arg); 2438*1dcdf01fSchristos void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx, 2439*1dcdf01fSchristos SSL_allow_early_data_cb_fn cb, 2440*1dcdf01fSchristos void *arg); 2441*1dcdf01fSchristos void SSL_set_allow_early_data_cb(SSL *s, 2442*1dcdf01fSchristos SSL_allow_early_data_cb_fn cb, 2443*1dcdf01fSchristos void *arg); 2444*1dcdf01fSchristos 2445*1dcdf01fSchristos # ifdef __cplusplus 2446*1dcdf01fSchristos } 2447*1dcdf01fSchristos # endif 2448*1dcdf01fSchristos #endif 2449