summaryrefslogtreecommitdiffstats
path: root/ssl/ssl_local.h
AgeCommit message (Collapse)Author
2023-08-14ssl_local.h: Define SSL_OP_CISCO_ANYCONNECT if undefined in public headersTomas Mraz
Fixes #21626 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/21677)
2023-07-05Rework options handlingHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20061)
2023-07-05QUIC: Control SSL option settingHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20061)
2023-07-05QUIC SSL Behaviours: Allow detection of an SSL connection used for QUIC ↵Hugo Landau
handshake Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20061)
2023-07-01tls: update to structure based atomicsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21260)
2023-06-06Add SSL_get0_group_name() to get name of the group used for KEXAlex Bozarth
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20866)
2023-06-02[feat] SSL RTT in both client and server statem. SSL_get_handshake_rtt makes ↵Jairus Christensen
it available Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20248)
2023-05-24Create internal/ssl.hMatt Caswell
We create the internal/ssl.h header file and move the typedef for ossl_msg_cb. This is needed by both the QUIC code (which generally doesn't include ssl_local.h) and the rest of libssl. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20914)
2023-05-24Add initial QUIC support for the msg_callbackMatt Caswell
At this stage we just support msg_callback on receipt of a datagram. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20914)
2023-05-12QUIC Dispatch: Introduce the QUIC_XSO objectHugo Landau
The QUIC_XSO (external stream object) is to a QUIC stream what a QUIC_CONNECTION is to a QUIC connection. Both are SSL objects. The QUIC_CONNECTION type is the internal representation of a QUIC connection SSL object (QCSO) and the QUIC_XSO type is the internal representation of a QUIC stream SSL object (QSSO) type. The name QUIC_XSO has been chosen to be distinct from the existing QUIC_STREAM type which is our existing internal stream type. QUIC_XSO is to a QUIC_STREAM what QUIC_CONNECTION is to a QUIC_CHANNEL; in other words, QUIC_CONNECTION and QUIC_XSO objects form part of the API personality layer, whereas QUIC_CHANNEL and QUIC_STREAM objects form part of the QUIC core and are distinct from the API personality layer. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20765)
2023-04-24dtls: code cleanup and refactorizationFdaSilvaYY
- factorize BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT calls. - simplify a return type - style nits Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20602)
2023-04-12Make the data field for get_record() constMatt Caswell
Improves consistency with the QUIC rstream implementation - and improves the abstraction between the TLS implementation and the abstract record layer. We should not expect that the TLS implementation should be able to change the underlying buffer. Future record layers may not expect that. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20404)
2023-03-28RFC7250 (RPK) supportTodd Short
Add support for the RFC7250 certificate-type extensions. Alows the use of only private keys for connection (i.e. certs not needed). Add APIs Add unit tests Add documentation Add s_client/s_server support Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18185)
2023-02-24first cut at sigalg loadingMichael Baentsch
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19312)
2023-02-22Don't declare SSL_CONNECTION twiceMatt Caswell
It causes problems with some compilation options Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20030)
2023-02-22Add the ability to mutate TLS handshake messages before they are writtenMatt Caswell
We add callbacks so that TLS handshake messages can be modified by the test framework before they are passed to the handshake hash, possibly encrypted and written to the network. This enables us to simulate badly behaving endpoints. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20030)
2023-02-08Rationalize FIPS sourcesTomas Mraz
Avoid including QUIC related stuff in the FIPS sources. Also avoid including libssl headers in ssl3_cbc.c. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19658)
2023-01-24Remove the user_ssl fieldMatt Caswell
The user_ssl field in an SSL_CONNECTION is no longer used - so remove it. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19748)
2023-01-24Add the ability to add a custom extension on an SSL objectMatt Caswell
Previously we could only do this at the SSL_CTX level. We add the ability to also do this on an SSL - but only for internal code. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19748)
2023-01-24Add support for setting a custom TLS Record LayerMatt Caswell
This is just an internal API for now. Something like this will be made public API at some point - but it is likely to be based on the provider interface rather that a direct setting of a METHOD like we do for now. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19748)
2023-01-24Move recordmethod.h to be an "internal" headerMatt Caswell
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19748)
2023-01-24Create the SSL object for QUIC-TLSMatt Caswell
The "user" SSL object which represents the QUIC connection should have an "inner" SSL object to represent the TLS connection. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19748)
2022-11-14Resolve a TODO in ssl3_dispatch_alertMatt Caswell
Properly handle the case where there is pending write data and we want to send an alert. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19550)
2022-11-14Remove references to read_mac_secret and write_mac_secretMatt Caswell
They are no longer used and can be removed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove the read_iv/write_iv fields from SSL_CONNECTIONMatt Caswell
These fields are instead held in the new record layer code and are therefore no longer needed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove compress/expand fields from SSL_CONNECTIONMatt Caswell
They are no longer needed. The new record layer handles this. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-11-14Remove remaining refs to enc_(write|read)_ctx/(read|write)_hashMatt Caswell
Those fields are no longer used. Their previous function is now in the new record layer. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19586)
2022-10-20Remove some redundant codeMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Remove the old buffer management codeMatt Caswell
We no longer use the old buffer management code now that it has all been moved to the new record layer. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-20Convert dtls_write_records to use standard record layer functionsMatt Caswell
We have standard functions for most of the work that dtls_write_records does - so we convert it to use those functions instead. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19424)
2022-10-18Add `for_comp` flag when retrieving certs for compressionTodd Short
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-18Add support for compressed certificates (RFC8879)Todd Short
* Compressed Certificate extension (server/client) * Server certificates (send/receive) * Client certificate (send/receive) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-12Convert the TLSv1.3 crypto code to the new write record layerMatt Caswell
We also clean up some of the KTLS code while we are doing it now that all users of KTLS have been moved to the new write record layer. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19343)
2022-10-07Partial revert and reimplement "Enable brainpool curves for TLS1.3"Matt Caswell
This partially reverts commit 0a10825a0 in order to reimplement it in a simpler way in the next commit. The reverted aspects are all related to the TLSv1.3 brainpool curves in the supported_groups extension. Rather than special casing the handling of these curves we simply add new entries to the groups table to represent them. They can then be handled without any additional special casing. This makes the code simpler to maintain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19315)
2022-09-27ssl_log_secret call in tls13_key_updatevisbjn
Newly computed traffic secrets are now logged upon key update Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19241)
2022-09-23Move the record block_padding capability fully into the record layerMatt Caswell
Previously we were referencing the block_padding value through the SSL_CONNECTION. Now it is held within OSSL_RECORD_LAYER. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19198)
2022-09-23Move need_empty_fragments inside the record layerMatt Caswell
This flag can now be managed entirely by the new record layer code so we move it into ossl_record_layer_st. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19198)
2022-09-23Remove empty_fragment_doneMatt Caswell
Now that we are no longer recursively addinng the prefix record this doesn't seem necessary any more. We always add it every time we do tls_write_records. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19198)
2022-09-13ssl: modify libssl so that it uses OSSL_TIMEPauli
This is instead of time_t and struct timeval. Some public APIs mandate a presence of these two types, but they are converted to OSSL_TIME internally. Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19082)
2022-09-02QUIC Demuxer and Record Layer (RX Side)Hugo Landau
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18949)
2022-08-18Remove redefinition of SSL_AD_NO_ALERTMatt Caswell
The SSL_AD_NO_ALERT value was defined in two places. We centralise its definition. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Standardise type for epochMatt Caswell
The value for epoch was being represented internally via various types: uint16_t, unsigned short, unsigned int, unsigned long We standardise on uint16_t Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Move some fields out of the SSL object and into the record layer objectMatt Caswell
Fields such as rrlmethod and rrl are entirely related to the record layer, and so should be in that object. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Remove some unnecessary function pointers from OSSL_RECORD_METHODMatt Caswell
We had some temporary function pointers in OSSL_RECORD_METHOD which were only necessary during the process of refactoring the read record layer. These are no longer required so can be removed. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Remove some final references to the SSL object in the record layerMatt Caswell
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Make the record layer directly aware of EtMMatt Caswell
We no longer have to go through the SSL object to discover whether EtM has been negotiated. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Add support for moving data from one epoch to the nextMatt Caswell
Sometimes data read by a record layer in one epoch is actually intended for the next epoch. For example in a TLS with read_ahead, the read_ahead data could contain a KeyUpdate message followed by application data encrypted with new keys. Therefore we implement a mechanism for passing this data across the epochs. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Implement KTLS in the new read record layer codeMatt Caswell
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Move protocol version specific code into separate filesMatt Caswell
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
2022-08-18Transfer the functionality from ssl3_read_n to the new record layerMatt Caswell
This transfers the low level function ssl3_read_n to the new record layer. We temporarily make the read_n function a top level record layer function. Eventually, in later commits in this refactor, we will remove it as a top level function and it will just be called from read_record. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18132)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-29 13:55:41 +0000