1 /* $OpenBSD: ssl.h,v 1.21 2019/09/18 11:26:30 eric Exp $ */ 2 /* 3 * Copyright (c) 2013 Gilles Chehade <gilles@poolp.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #define SSL_CIPHERS "HIGH:!aNULL:!MD5" 19 #define SSL_SESSION_TIMEOUT 300 20 21 struct pki { 22 char pki_name[HOST_NAME_MAX+1]; 23 24 char *pki_cert_file; 25 char *pki_cert; 26 off_t pki_cert_len; 27 28 char *pki_key_file; 29 char *pki_key; 30 off_t pki_key_len; 31 32 EVP_PKEY *pki_pkey; 33 34 int pki_dhe; 35 }; 36 37 struct ca { 38 char ca_name[HOST_NAME_MAX+1]; 39 40 char *ca_cert_file; 41 char *ca_cert; 42 off_t ca_cert_len; 43 }; 44 45 46 /* ssl.c */ 47 void ssl_init(void); 48 int ssl_setup(SSL_CTX **, struct pki *, 49 int (*)(SSL *, int *, void *), const char *); 50 SSL_CTX *ssl_ctx_create(const char *, char *, off_t, const char *); 51 int ssl_cmp(struct pki *, struct pki *); 52 char *ssl_load_file(const char *, off_t *, mode_t); 53 char *ssl_load_key(const char *, off_t *, char *, mode_t, const char *); 54 55 const char *ssl_to_text(const SSL *); 56 void ssl_error(const char *); 57 58 int ssl_load_certificate(struct pki *, const char *); 59 int ssl_load_keyfile(struct pki *, const char *, const char *); 60 int ssl_load_cafile(struct ca *, const char *); 61 int ssl_load_pkey(const void *, size_t, char *, off_t, 62 X509 **, EVP_PKEY **); 63 int ssl_ctx_fake_private_key(SSL_CTX *, const void *, size_t, 64 char *, off_t, X509 **, EVP_PKEY **); 65 66 /* ssl_privsep.c */ 67 int ssl_by_mem_ctrl(X509_LOOKUP *, int, const char *, long, char **); 68 69 /* ssl_verify.c */ 70 int ssl_check_name(X509 *, const char *, int *); 71