lolengine
/
binaries
1
0
複製 0
程式碼 問題 0 合併請求 0 版本發佈 0 Wiki 活動
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2 提交
1 分支
7.3 MiB
 
 
 
 
 
 
分支: master
分支列表 標籤
${ item.name }
建立分支 ${ searchTerm }
從 'master'
${ noResults }
binaries/openssl-1.1.1g/include/openssl/ssl.h

2439 line
109 KiB
原始文件 永久連結 Blame 歷史記錄 

  1. /*

  2.  * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.

  3.  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved

  4.  * Copyright 2005 Nokia. All rights reserved.

  5.  *

  6.  * Licensed under the OpenSSL license (the "License").  You may not use

  7.  * this file except in compliance with the License.  You can obtain a copy

  8.  * in the file LICENSE in the source distribution or at

  9.  * https://www.openssl.org/source/license.html

  10.  */

  11. 

  12. #ifndef HEADER_SSL_H

  13. # define HEADER_SSL_H

  14. 

  15. # include <openssl/e_os2.h>

  16. # include <openssl/opensslconf.h>

  17. # include <openssl/comp.h>

  18. # include <openssl/bio.h>

  19. # if OPENSSL_API_COMPAT < 0x10100000L

  20. #  include <openssl/x509.h>

  21. #  include <openssl/crypto.h>

  22. #  include <openssl/buffer.h>

  23. # endif

  24. # include <openssl/lhash.h>

  25. # include <openssl/pem.h>

  26. # include <openssl/hmac.h>

  27. # include <openssl/async.h>

  28. 

  29. # include <openssl/safestack.h>

  30. # include <openssl/symhacks.h>

  31. # include <openssl/ct.h>

  32. # include <openssl/sslerr.h>

  33. 

  34. #ifdef  __cplusplus

  35. extern "C" {

  36. #endif

  37. 

  38. /* OpenSSL version number for ASN.1 encoding of the session information */

  39. /*-

  40.  * Version 0 - initial version

  41.  * Version 1 - added the optional peer certificate

  42.  */

  43. # define SSL_SESSION_ASN1_VERSION 0x0001

  44. 

  45. # define SSL_MAX_SSL_SESSION_ID_LENGTH           32

  46. # define SSL_MAX_SID_CTX_LENGTH                  32

  47. 

  48. # define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES     (512/8)

  49. # define SSL_MAX_KEY_ARG_LENGTH                  8

  50. # define SSL_MAX_MASTER_KEY_LENGTH               48

  51. 

  52. /* The maximum number of encrypt/decrypt pipelines we can support */

  53. # define SSL_MAX_PIPELINES  32

  54. 

  55. /* text strings for the ciphers */

  56. 

  57. /* These are used to specify which ciphers to use and not to use */

  58. 

  59. # define SSL_TXT_LOW             "LOW"

  60. # define SSL_TXT_MEDIUM          "MEDIUM"

  61. # define SSL_TXT_HIGH            "HIGH"

  62. # define SSL_TXT_FIPS            "FIPS"

  63. 

  64. # define SSL_TXT_aNULL           "aNULL"

  65. # define SSL_TXT_eNULL           "eNULL"

  66. # define SSL_TXT_NULL            "NULL"

  67. 

  68. # define SSL_TXT_kRSA            "kRSA"

  69. # define SSL_TXT_kDHr            "kDHr"/* this cipher class has been removed */

  70. # define SSL_TXT_kDHd            "kDHd"/* this cipher class has been removed */

  71. # define SSL_TXT_kDH             "kDH"/* this cipher class has been removed */

  72. # define SSL_TXT_kEDH            "kEDH"/* alias for kDHE */

  73. # define SSL_TXT_kDHE            "kDHE"

  74. # define SSL_TXT_kECDHr          "kECDHr"/* this cipher class has been removed */

  75. # define SSL_TXT_kECDHe          "kECDHe"/* this cipher class has been removed */

  76. # define SSL_TXT_kECDH           "kECDH"/* this cipher class has been removed */

  77. # define SSL_TXT_kEECDH          "kEECDH"/* alias for kECDHE */

  78. # define SSL_TXT_kECDHE          "kECDHE"

  79. # define SSL_TXT_kPSK            "kPSK"

  80. # define SSL_TXT_kRSAPSK         "kRSAPSK"

  81. # define SSL_TXT_kECDHEPSK       "kECDHEPSK"

  82. # define SSL_TXT_kDHEPSK         "kDHEPSK"

  83. # define SSL_TXT_kGOST           "kGOST"

  84. # define SSL_TXT_kSRP            "kSRP"

  85. 

  86. # define SSL_TXT_aRSA            "aRSA"

  87. # define SSL_TXT_aDSS            "aDSS"

  88. # define SSL_TXT_aDH             "aDH"/* this cipher class has been removed */

  89. # define SSL_TXT_aECDH           "aECDH"/* this cipher class has been removed */

  90. # define SSL_TXT_aECDSA          "aECDSA"

  91. # define SSL_TXT_aPSK            "aPSK"

  92. # define SSL_TXT_aGOST94         "aGOST94"

  93. # define SSL_TXT_aGOST01         "aGOST01"

  94. # define SSL_TXT_aGOST12         "aGOST12"

  95. # define SSL_TXT_aGOST           "aGOST"

  96. # define SSL_TXT_aSRP            "aSRP"

  97. 

  98. # define SSL_TXT_DSS             "DSS"

  99. # define SSL_TXT_DH              "DH"

  100. # define SSL_TXT_DHE             "DHE"/* same as "kDHE:-ADH" */

  101. # define SSL_TXT_EDH             "EDH"/* alias for DHE */

  102. # define SSL_TXT_ADH             "ADH"

  103. # define SSL_TXT_RSA             "RSA"

  104. # define SSL_TXT_ECDH            "ECDH"

  105. # define SSL_TXT_EECDH           "EECDH"/* alias for ECDHE" */

  106. # define SSL_TXT_ECDHE           "ECDHE"/* same as "kECDHE:-AECDH" */

  107. # define SSL_TXT_AECDH           "AECDH"

  108. # define SSL_TXT_ECDSA           "ECDSA"

  109. # define SSL_TXT_PSK             "PSK"

  110. # define SSL_TXT_SRP             "SRP"

  111. 

  112. # define SSL_TXT_DES             "DES"

  113. # define SSL_TXT_3DES            "3DES"

  114. # define SSL_TXT_RC4             "RC4"

  115. # define SSL_TXT_RC2             "RC2"

  116. # define SSL_TXT_IDEA            "IDEA"

  117. # define SSL_TXT_SEED            "SEED"

  118. # define SSL_TXT_AES128          "AES128"

  119. # define SSL_TXT_AES256          "AES256"

  120. # define SSL_TXT_AES             "AES"

  121. # define SSL_TXT_AES_GCM         "AESGCM"

  122. # define SSL_TXT_AES_CCM         "AESCCM"

  123. # define SSL_TXT_AES_CCM_8       "AESCCM8"

  124. # define SSL_TXT_CAMELLIA128     "CAMELLIA128"

  125. # define SSL_TXT_CAMELLIA256     "CAMELLIA256"

  126. # define SSL_TXT_CAMELLIA        "CAMELLIA"

  127. # define SSL_TXT_CHACHA20        "CHACHA20"

  128. # define SSL_TXT_GOST            "GOST89"

  129. # define SSL_TXT_ARIA            "ARIA"

  130. # define SSL_TXT_ARIA_GCM        "ARIAGCM"

  131. # define SSL_TXT_ARIA128         "ARIA128"

  132. # define SSL_TXT_ARIA256         "ARIA256"

  133. 

  134. # define SSL_TXT_MD5             "MD5"

  135. # define SSL_TXT_SHA1            "SHA1"

  136. # define SSL_TXT_SHA             "SHA"/* same as "SHA1" */

  137. # define SSL_TXT_GOST94          "GOST94"

  138. # define SSL_TXT_GOST89MAC       "GOST89MAC"

  139. # define SSL_TXT_GOST12          "GOST12"

  140. # define SSL_TXT_GOST89MAC12     "GOST89MAC12"

  141. # define SSL_TXT_SHA256          "SHA256"

  142. # define SSL_TXT_SHA384          "SHA384"

  143. 

  144. # define SSL_TXT_SSLV3           "SSLv3"

  145. # define SSL_TXT_TLSV1           "TLSv1"

  146. # define SSL_TXT_TLSV1_1         "TLSv1.1"

  147. # define SSL_TXT_TLSV1_2         "TLSv1.2"

  148. 

  149. # define SSL_TXT_ALL             "ALL"

  150. 

  151. /*-

  152.  * COMPLEMENTOF* definitions. These identifiers are used to (de-select)

  153.  * ciphers normally not being used.

  154.  * Example: "RC4" will activate all ciphers using RC4 including ciphers

  155.  * without authentication, which would normally disabled by DEFAULT (due

  156.  * the "!ADH" being part of default). Therefore "RC4:!COMPLEMENTOFDEFAULT"

  157.  * will make sure that it is also disabled in the specific selection.

  158.  * COMPLEMENTOF* identifiers are portable between version, as adjustments

  159.  * to the default cipher setup will also be included here.

  160.  *

  161.  * COMPLEMENTOFDEFAULT does not experience the same special treatment that

  162.  * DEFAULT gets, as only selection is being done and no sorting as needed

  163.  * for DEFAULT.

  164.  */

  165. # define SSL_TXT_CMPALL          "COMPLEMENTOFALL"

  166. # define SSL_TXT_CMPDEF          "COMPLEMENTOFDEFAULT"

  167. 

  168. /*

  169.  * The following cipher list is used by default. It also is substituted when

  170.  * an application-defined cipher list string starts with 'DEFAULT'.

  171.  * This applies to ciphersuites for TLSv1.2 and below.

  172.  */

  173. # define SSL_DEFAULT_CIPHER_LIST "ALL:!COMPLEMENTOFDEFAULT:!eNULL"

  174. /* This is the default set of TLSv1.3 ciphersuites */

  175. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)

  176. #  define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \

  177.                                    "TLS_CHACHA20_POLY1305_SHA256:" \

  178.                                    "TLS_AES_128_GCM_SHA256"

  179. # else

  180. #  define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \

  181.                                    "TLS_AES_128_GCM_SHA256"

  182. #endif

  183. /*

  184.  * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always

  185.  * starts with a reasonable order, and all we have to do for DEFAULT is

  186.  * throwing out anonymous and unencrypted ciphersuites! (The latter are not

  187.  * actually enabled by ALL, but "ALL:RSA" would enable some of them.)

  188.  */

  189. 

  190. /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */

  191. # define SSL_SENT_SHUTDOWN       1

  192. # define SSL_RECEIVED_SHUTDOWN   2

  193. 

  194. #ifdef __cplusplus

  195. }

  196. #endif

  197. 

  198. #ifdef  __cplusplus

  199. extern "C" {

  200. #endif

  201. 

  202. # define SSL_FILETYPE_ASN1       X509_FILETYPE_ASN1

  203. # define SSL_FILETYPE_PEM        X509_FILETYPE_PEM

  204. 

  205. /*

  206.  * This is needed to stop compilers complaining about the 'struct ssl_st *'

  207.  * function parameters used to prototype callbacks in SSL_CTX.

  208.  */

  209. typedef struct ssl_st *ssl_crock_st;

  210. typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;

  211. typedef struct ssl_method_st SSL_METHOD;

  212. typedef struct ssl_cipher_st SSL_CIPHER;

  213. typedef struct ssl_session_st SSL_SESSION;

  214. typedef struct tls_sigalgs_st TLS_SIGALGS;

  215. typedef struct ssl_conf_ctx_st SSL_CONF_CTX;

  216. typedef struct ssl_comp_st SSL_COMP;

  217. 

  218. STACK_OF(SSL_CIPHER);

  219. STACK_OF(SSL_COMP);

  220. 

  221. /* SRTP protection profiles for use with the use_srtp extension (RFC 5764)*/

  222. typedef struct srtp_protection_profile_st {

  223.     const char *name;

  224.     unsigned long id;

  225. } SRTP_PROTECTION_PROFILE;

  226. 

  227. DEFINE_STACK_OF(SRTP_PROTECTION_PROFILE)

  228. 

  229. typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data,

  230.                                             int len, void *arg);

  231. typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len,

  232.                                         STACK_OF(SSL_CIPHER) *peer_ciphers,

  233.                                         const SSL_CIPHER **cipher, void *arg);

  234. 

  235. /* Extension context codes */

  236. /* This extension is only allowed in TLS */

  237. #define SSL_EXT_TLS_ONLY                        0x0001

  238. /* This extension is only allowed in DTLS */

  239. #define SSL_EXT_DTLS_ONLY                       0x0002

  240. /* Some extensions may be allowed in DTLS but we don't implement them for it */

  241. #define SSL_EXT_TLS_IMPLEMENTATION_ONLY         0x0004

  242. /* Most extensions are not defined for SSLv3 but EXT_TYPE_renegotiate is */

  243. #define SSL_EXT_SSL3_ALLOWED                    0x0008

  244. /* Extension is only defined for TLS1.2 and below */

  245. #define SSL_EXT_TLS1_2_AND_BELOW_ONLY           0x0010

  246. /* Extension is only defined for TLS1.3 and above */

  247. #define SSL_EXT_TLS1_3_ONLY                     0x0020

  248. /* Ignore this extension during parsing if we are resuming */

  249. #define SSL_EXT_IGNORE_ON_RESUMPTION            0x0040

  250. #define SSL_EXT_CLIENT_HELLO                    0x0080

  251. /* Really means TLS1.2 or below */

  252. #define SSL_EXT_TLS1_2_SERVER_HELLO             0x0100

  253. #define SSL_EXT_TLS1_3_SERVER_HELLO             0x0200

  254. #define SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS     0x0400

  255. #define SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST      0x0800

  256. #define SSL_EXT_TLS1_3_CERTIFICATE              0x1000

  257. #define SSL_EXT_TLS1_3_NEW_SESSION_TICKET       0x2000

  258. #define SSL_EXT_TLS1_3_CERTIFICATE_REQUEST      0x4000

  259. 

  260. /* Typedefs for handling custom extensions */

  261. 

  262. typedef int (*custom_ext_add_cb)(SSL *s, unsigned int ext_type,

  263.                                  const unsigned char **out, size_t *outlen,

  264.                                  int *al, void *add_arg);

  265. 

  266. typedef void (*custom_ext_free_cb)(SSL *s, unsigned int ext_type,

  267.                                    const unsigned char *out, void *add_arg);

  268. 

  269. typedef int (*custom_ext_parse_cb)(SSL *s, unsigned int ext_type,

  270.                                    const unsigned char *in, size_t inlen,

  271.                                    int *al, void *parse_arg);

  272. 

  273. 

  274. typedef int (*SSL_custom_ext_add_cb_ex)(SSL *s, unsigned int ext_type,

  275.                                         unsigned int context,

  276.                                         const unsigned char **out,

  277.                                         size_t *outlen, X509 *x,

  278.                                         size_t chainidx,

  279.                                         int *al, void *add_arg);

  280. 

  281. typedef void (*SSL_custom_ext_free_cb_ex)(SSL *s, unsigned int ext_type,

  282.                                           unsigned int context,

  283.                                           const unsigned char *out,

  284.                                           void *add_arg);

  285. 

  286. typedef int (*SSL_custom_ext_parse_cb_ex)(SSL *s, unsigned int ext_type,

  287.                                           unsigned int context,

  288.                                           const unsigned char *in,

  289.                                           size_t inlen, X509 *x,

  290.                                           size_t chainidx,

  291.                                           int *al, void *parse_arg);

  292. 

  293. /* Typedef for verification callback */

  294. typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx);

  295. 

  296. /*

  297.  * Some values are reserved until OpenSSL 1.2.0 because they were previously

  298.  * included in SSL_OP_ALL in a 1.1.x release.

  299.  *

  300.  * Reserved value (until OpenSSL 1.2.0)                  0x00000001U

  301.  * Reserved value (until OpenSSL 1.2.0)                  0x00000002U

  302.  */

  303. /* Allow initial connection to servers that don't support RI */

  304. # define SSL_OP_LEGACY_SERVER_CONNECT                    0x00000004U

  305. 

  306. /* Reserved value (until OpenSSL 1.2.0)                  0x00000008U */

  307. # define SSL_OP_TLSEXT_PADDING                           0x00000010U

  308. /* Reserved value (until OpenSSL 1.2.0)                  0x00000020U */

  309. # define SSL_OP_SAFARI_ECDHE_ECDSA_BUG                   0x00000040U

  310. /*

  311.  * Reserved value (until OpenSSL 1.2.0)                  0x00000080U

  312.  * Reserved value (until OpenSSL 1.2.0)                  0x00000100U

  313.  * Reserved value (until OpenSSL 1.2.0)                  0x00000200U

  314.  */

  315. 

  316. /* In TLSv1.3 allow a non-(ec)dhe based kex_mode */

  317. # define SSL_OP_ALLOW_NO_DHE_KEX                         0x00000400U

  318. 

  319. /*

  320.  * Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added in

  321.  * OpenSSL 0.9.6d.  Usually (depending on the application protocol) the

  322.  * workaround is not needed.  Unfortunately some broken SSL/TLS

  323.  * implementations cannot handle it at all, which is why we include it in

  324.  * SSL_OP_ALL. Added in 0.9.6e

  325.  */

  326. # define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS              0x00000800U

  327. 

  328. /* DTLS options */

  329. # define SSL_OP_NO_QUERY_MTU                             0x00001000U

  330. /* Turn on Cookie Exchange (on relevant for servers) */

  331. # define SSL_OP_COOKIE_EXCHANGE                          0x00002000U

  332. /* Don't use RFC4507 ticket extension */

  333. # define SSL_OP_NO_TICKET                                0x00004000U

  334. # ifndef OPENSSL_NO_DTLS1_METHOD

  335. /* Use Cisco's "speshul" version of DTLS_BAD_VER

  336.  * (only with deprecated DTLSv1_client_method())  */

  337. #  define SSL_OP_CISCO_ANYCONNECT                        0x00008000U

  338. # endif

  339. 

  340. /* As server, disallow session resumption on renegotiation */

  341. # define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION   0x00010000U

  342. /* Don't use compression even if supported */

  343. # define SSL_OP_NO_COMPRESSION                           0x00020000U

  344. /* Permit unsafe legacy renegotiation */

  345. # define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION        0x00040000U

  346. /* Disable encrypt-then-mac */

  347. # define SSL_OP_NO_ENCRYPT_THEN_MAC                      0x00080000U

  348. 

  349. /*

  350.  * Enable TLSv1.3 Compatibility mode. This is on by default. A future version

  351.  * of OpenSSL may have this disabled by default.

  352.  */

  353. # define SSL_OP_ENABLE_MIDDLEBOX_COMPAT                  0x00100000U

  354. 

  355. /* Prioritize Chacha20Poly1305 when client does.

  356.  * Modifies SSL_OP_CIPHER_SERVER_PREFERENCE */

  357. # define SSL_OP_PRIORITIZE_CHACHA                        0x00200000U

  358. 

  359. /*

  360.  * Set on servers to choose the cipher according to the server's preferences

  361.  */

  362. # define SSL_OP_CIPHER_SERVER_PREFERENCE                 0x00400000U

  363. /*

  364.  * If set, a server will allow a client to issue a SSLv3.0 version number as

  365.  * latest version supported in the premaster secret, even when TLSv1.0

  366.  * (version 3.1) was announced in the client hello. Normally this is

  367.  * forbidden to prevent version rollback attacks.

  368.  */

  369. # define SSL_OP_TLS_ROLLBACK_BUG                         0x00800000U

  370. 

  371. /*

  372.  * Switches off automatic TLSv1.3 anti-replay protection for early data. This

  373.  * is a server-side option only (no effect on the client).

  374.  */

  375. # define SSL_OP_NO_ANTI_REPLAY                           0x01000000U

  376. 

  377. # define SSL_OP_NO_SSLv3                                 0x02000000U

  378. # define SSL_OP_NO_TLSv1                                 0x04000000U

  379. # define SSL_OP_NO_TLSv1_2                               0x08000000U

  380. # define SSL_OP_NO_TLSv1_1                               0x10000000U

  381. # define SSL_OP_NO_TLSv1_3                               0x20000000U

  382. 

  383. # define SSL_OP_NO_DTLSv1                                0x04000000U

  384. # define SSL_OP_NO_DTLSv1_2                              0x08000000U

  385. 

  386. # define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv3|\

  387.         SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2|SSL_OP_NO_TLSv1_3)

  388. # define SSL_OP_NO_DTLS_MASK (SSL_OP_NO_DTLSv1|SSL_OP_NO_DTLSv1_2)

  389. 

  390. /* Disallow all renegotiation */

  391. # define SSL_OP_NO_RENEGOTIATION                         0x40000000U

  392. 

  393. /*

  394.  * Make server add server-hello extension from early version of cryptopro

  395.  * draft, when GOST ciphersuite is negotiated. Required for interoperability

  396.  * with CryptoPro CSP 3.x

  397.  */

  398. # define SSL_OP_CRYPTOPRO_TLSEXT_BUG                     0x80000000U

  399. 

  400. /*

  401.  * SSL_OP_ALL: various bug workarounds that should be rather harmless.

  402.  * This used to be 0x000FFFFFL before 0.9.7.

  403.  * This used to be 0x80000BFFU before 1.1.1.

  404.  */

  405. # define SSL_OP_ALL        (SSL_OP_CRYPTOPRO_TLSEXT_BUG|\

  406.                             SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS|\

  407.                             SSL_OP_LEGACY_SERVER_CONNECT|\

  408.                             SSL_OP_TLSEXT_PADDING|\

  409.                             SSL_OP_SAFARI_ECDHE_ECDSA_BUG)

  410. 

  411. /* OBSOLETE OPTIONS: retained for compatibility */

  412. 

  413. /* Removed from OpenSSL 1.1.0. Was 0x00000001L */

  414. /* Related to removed SSLv2. */

  415. # define SSL_OP_MICROSOFT_SESS_ID_BUG                    0x0

  416. /* Removed from OpenSSL 1.1.0. Was 0x00000002L */

  417. /* Related to removed SSLv2. */

  418. # define SSL_OP_NETSCAPE_CHALLENGE_BUG                   0x0

  419. /* Removed from OpenSSL 0.9.8q and 1.0.0c. Was 0x00000008L */

  420. /* Dead forever, see CVE-2010-4180 */

  421. # define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG         0x0

  422. /* Removed from OpenSSL 1.0.1h and 1.0.2. Was 0x00000010L */

  423. /* Refers to ancient SSLREF and SSLv2. */

  424. # define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG              0x0

  425. /* Removed from OpenSSL 1.1.0. Was 0x00000020 */

  426. # define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER               0x0

  427. /* Removed from OpenSSL 0.9.7h and 0.9.8b. Was 0x00000040L */

  428. # define SSL_OP_MSIE_SSLV2_RSA_PADDING                   0x0

  429. /* Removed from OpenSSL 1.1.0. Was 0x00000080 */

  430. /* Ancient SSLeay version. */

  431. # define SSL_OP_SSLEAY_080_CLIENT_DH_BUG                 0x0

  432. /* Removed from OpenSSL 1.1.0. Was 0x00000100L */

  433. # define SSL_OP_TLS_D5_BUG                               0x0

  434. /* Removed from OpenSSL 1.1.0. Was 0x00000200L */

  435. # define SSL_OP_TLS_BLOCK_PADDING_BUG                    0x0

  436. /* Removed from OpenSSL 1.1.0. Was 0x00080000L */

  437. # define SSL_OP_SINGLE_ECDH_USE                          0x0

  438. /* Removed from OpenSSL 1.1.0. Was 0x00100000L */

  439. # define SSL_OP_SINGLE_DH_USE                            0x0

  440. /* Removed from OpenSSL 1.0.1k and 1.0.2. Was 0x00200000L */

  441. # define SSL_OP_EPHEMERAL_RSA                            0x0

  442. /* Removed from OpenSSL 1.1.0. Was 0x01000000L */

  443. # define SSL_OP_NO_SSLv2                                 0x0

  444. /* Removed from OpenSSL 1.0.1. Was 0x08000000L */

  445. # define SSL_OP_PKCS1_CHECK_1                            0x0

  446. /* Removed from OpenSSL 1.0.1. Was 0x10000000L */

  447. # define SSL_OP_PKCS1_CHECK_2                            0x0

  448. /* Removed from OpenSSL 1.1.0. Was 0x20000000L */

  449. # define SSL_OP_NETSCAPE_CA_DN_BUG                       0x0

  450. /* Removed from OpenSSL 1.1.0. Was 0x40000000L */

  451. # define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG          0x0

  452. 

  453. /*

  454.  * Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success

  455.  * when just a single record has been written):

  456.  */

  457. # define SSL_MODE_ENABLE_PARTIAL_WRITE       0x00000001U

  458. /*

  459.  * Make it possible to retry SSL_write() with changed buffer location (buffer

  460.  * contents must stay the same!); this is not the default to avoid the

  461.  * misconception that non-blocking SSL_write() behaves like non-blocking

  462.  * write():

  463.  */

  464. # define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002U

  465. /*

  466.  * Never bother the application with retries if the transport is blocking:

  467.  */

  468. # define SSL_MODE_AUTO_RETRY 0x00000004U

  469. /* Don't attempt to automatically build certificate chain */

  470. # define SSL_MODE_NO_AUTO_CHAIN 0x00000008U

  471. /*

  472.  * Save RAM by releasing read and write buffers when they're empty. (SSL3 and

  473.  * TLS only.) Released buffers are freed.

  474.  */

  475. # define SSL_MODE_RELEASE_BUFFERS 0x00000010U

  476. /*

  477.  * Send the current time in the Random fields of the ClientHello and

  478.  * ServerHello records for compatibility with hypothetical implementations

  479.  * that require it.

  480.  */

  481. # define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020U

  482. # define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040U

  483. /*

  484.  * Send TLS_FALLBACK_SCSV in the ClientHello. To be set only by applications

  485.  * that reconnect with a downgraded protocol version; see

  486.  * draft-ietf-tls-downgrade-scsv-00 for details. DO NOT ENABLE THIS if your

  487.  * application attempts a normal handshake. Only use this in explicit

  488.  * fallback retries, following the guidance in

  489.  * draft-ietf-tls-downgrade-scsv-00.

  490.  */

  491. # define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080U

  492. /*

  493.  * Support Asynchronous operation

  494.  */

  495. # define SSL_MODE_ASYNC 0x00000100U

  496. 

  497. /*

  498.  * When using DTLS/SCTP, include the terminating zero in the label

  499.  * used for computing the endpoint-pair shared secret. Required for

  500.  * interoperability with implementations having this bug like these

  501.  * older version of OpenSSL:

  502.  * - OpenSSL 1.0.0 series

  503.  * - OpenSSL 1.0.1 series

  504.  * - OpenSSL 1.0.2 series

  505.  * - OpenSSL 1.1.0 series

  506.  * - OpenSSL 1.1.1 and 1.1.1a

  507.  */

  508. # define SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG 0x00000400U

  509. 

  510. /* Cert related flags */

  511. /*

  512.  * Many implementations ignore some aspects of the TLS standards such as

  513.  * enforcing certificate chain algorithms. When this is set we enforce them.

  514.  */

  515. # define SSL_CERT_FLAG_TLS_STRICT                0x00000001U

  516. 

  517. /* Suite B modes, takes same values as certificate verify flags */

  518. # define SSL_CERT_FLAG_SUITEB_128_LOS_ONLY       0x10000

  519. /* Suite B 192 bit only mode */

  520. # define SSL_CERT_FLAG_SUITEB_192_LOS            0x20000

  521. /* Suite B 128 bit mode allowing 192 bit algorithms */

  522. # define SSL_CERT_FLAG_SUITEB_128_LOS            0x30000

  523. 

  524. /* Perform all sorts of protocol violations for testing purposes */

  525. # define SSL_CERT_FLAG_BROKEN_PROTOCOL           0x10000000

  526. 

  527. /* Flags for building certificate chains */

  528. /* Treat any existing certificates as untrusted CAs */

  529. # define SSL_BUILD_CHAIN_FLAG_UNTRUSTED          0x1

  530. /* Don't include root CA in chain */

  531. # define SSL_BUILD_CHAIN_FLAG_NO_ROOT            0x2

  532. /* Just check certificates already there */

  533. # define SSL_BUILD_CHAIN_FLAG_CHECK              0x4

  534. /* Ignore verification errors */

  535. # define SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR       0x8

  536. /* Clear verification errors from queue */

  537. # define SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR        0x10

  538. 

  539. /* Flags returned by SSL_check_chain */

  540. /* Certificate can be used with this session */

  541. # define CERT_PKEY_VALID         0x1

  542. /* Certificate can also be used for signing */

  543. # define CERT_PKEY_SIGN          0x2

  544. /* EE certificate signing algorithm OK */

  545. # define CERT_PKEY_EE_SIGNATURE  0x10

  546. /* CA signature algorithms OK */

  547. # define CERT_PKEY_CA_SIGNATURE  0x20

  548. /* EE certificate parameters OK */

  549. # define CERT_PKEY_EE_PARAM      0x40

  550. /* CA certificate parameters OK */

  551. # define CERT_PKEY_CA_PARAM      0x80

  552. /* Signing explicitly allowed as opposed to SHA1 fallback */

  553. # define CERT_PKEY_EXPLICIT_SIGN 0x100

  554. /* Client CA issuer names match (always set for server cert) */

  555. # define CERT_PKEY_ISSUER_NAME   0x200

  556. /* Cert type matches client types (always set for server cert) */

  557. # define CERT_PKEY_CERT_TYPE     0x400

  558. /* Cert chain suitable to Suite B */

  559. # define CERT_PKEY_SUITEB        0x800

  560. 

  561. # define SSL_CONF_FLAG_CMDLINE           0x1

  562. # define SSL_CONF_FLAG_FILE              0x2

  563. # define SSL_CONF_FLAG_CLIENT            0x4

  564. # define SSL_CONF_FLAG_SERVER            0x8

  565. # define SSL_CONF_FLAG_SHOW_ERRORS       0x10

  566. # define SSL_CONF_FLAG_CERTIFICATE       0x20

  567. # define SSL_CONF_FLAG_REQUIRE_PRIVATE   0x40

  568. /* Configuration value types */

  569. # define SSL_CONF_TYPE_UNKNOWN           0x0

  570. # define SSL_CONF_TYPE_STRING            0x1

  571. # define SSL_CONF_TYPE_FILE              0x2

  572. # define SSL_CONF_TYPE_DIR               0x3

  573. # define SSL_CONF_TYPE_NONE              0x4

  574. 

  575. /* Maximum length of the application-controlled segment of a a TLSv1.3 cookie */

  576. # define SSL_COOKIE_LENGTH                       4096

  577. 

  578. /*

  579.  * Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, they

  580.  * cannot be used to clear bits.

  581.  */

  582. 

  583. unsigned long SSL_CTX_get_options(const SSL_CTX *ctx);

  584. unsigned long SSL_get_options(const SSL *s);

  585. unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op);

  586. unsigned long SSL_clear_options(SSL *s, unsigned long op);

  587. unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long op);

  588. unsigned long SSL_set_options(SSL *s, unsigned long op);

  589. 

  590. # define SSL_CTX_set_mode(ctx,op) \

  591.         SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)

  592. # define SSL_CTX_clear_mode(ctx,op) \

  593.         SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_MODE,(op),NULL)

  594. # define SSL_CTX_get_mode(ctx) \

  595.         SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL)

  596. # define SSL_clear_mode(ssl,op) \

  597.         SSL_ctrl((ssl),SSL_CTRL_CLEAR_MODE,(op),NULL)

  598. # define SSL_set_mode(ssl,op) \

  599.         SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)

  600. # define SSL_get_mode(ssl) \

  601.         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)

  602. # define SSL_set_mtu(ssl, mtu) \

  603.         SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL)

  604. # define DTLS_set_link_mtu(ssl, mtu) \

  605.         SSL_ctrl((ssl),DTLS_CTRL_SET_LINK_MTU,(mtu),NULL)

  606. # define DTLS_get_link_min_mtu(ssl) \

  607.         SSL_ctrl((ssl),DTLS_CTRL_GET_LINK_MIN_MTU,0,NULL)

  608. 

  609. # define SSL_get_secure_renegotiation_support(ssl) \

  610.         SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL)

  611. 

  612. # ifndef OPENSSL_NO_HEARTBEATS

  613. #  define SSL_heartbeat(ssl) \

  614.         SSL_ctrl((ssl),SSL_CTRL_DTLS_EXT_SEND_HEARTBEAT,0,NULL)

  615. # endif

  616. 

  617. # define SSL_CTX_set_cert_flags(ctx,op) \

  618.         SSL_CTX_ctrl((ctx),SSL_CTRL_CERT_FLAGS,(op),NULL)

  619. # define SSL_set_cert_flags(s,op) \

  620.         SSL_ctrl((s),SSL_CTRL_CERT_FLAGS,(op),NULL)

  621. # define SSL_CTX_clear_cert_flags(ctx,op) \

  622.         SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_CERT_FLAGS,(op),NULL)

  623. # define SSL_clear_cert_flags(s,op) \

  624.         SSL_ctrl((s),SSL_CTRL_CLEAR_CERT_FLAGS,(op),NULL)

  625. 

  626. void SSL_CTX_set_msg_callback(SSL_CTX *ctx,

  627.                               void (*cb) (int write_p, int version,

  628.                                           int content_type, const void *buf,

  629.                                           size_t len, SSL *ssl, void *arg));

  630. void SSL_set_msg_callback(SSL *ssl,

  631.                           void (*cb) (int write_p, int version,

  632.                                       int content_type, const void *buf,

  633.                                       size_t len, SSL *ssl, void *arg));

  634. # define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))

  635. # define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))

  636. 

  637. # define SSL_get_extms_support(s) \

  638.         SSL_ctrl((s),SSL_CTRL_GET_EXTMS_SUPPORT,0,NULL)

  639. 

  640. # ifndef OPENSSL_NO_SRP

  641. 

  642. /* see tls_srp.c */

  643. __owur int SSL_SRP_CTX_init(SSL *s);

  644. __owur int SSL_CTX_SRP_CTX_init(SSL_CTX *ctx);

  645. int SSL_SRP_CTX_free(SSL *ctx);

  646. int SSL_CTX_SRP_CTX_free(SSL_CTX *ctx);

  647. __owur int SSL_srp_server_param_with_username(SSL *s, int *ad);

  648. __owur int SRP_Calc_A_param(SSL *s);

  649. 

  650. # endif

  651. 

  652. /* 100k max cert list */

  653. # define SSL_MAX_CERT_LIST_DEFAULT 1024*100

  654. 

  655. # define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT      (1024*20)

  656. 

  657. /*

  658.  * This callback type is used inside SSL_CTX, SSL, and in the functions that

  659.  * set them. It is used to override the generation of SSL/TLS session IDs in

  660.  * a server. Return value should be zero on an error, non-zero to proceed.

  661.  * Also, callbacks should themselves check if the id they generate is unique

  662.  * otherwise the SSL handshake will fail with an error - callbacks can do

  663.  * this using the 'ssl' value they're passed by;

  664.  * SSL_has_matching_session_id(ssl, id, *id_len) The length value passed in

  665.  * is set at the maximum size the session ID can be. In SSLv3/TLSv1 it is 32

  666.  * bytes. The callback can alter this length to be less if desired. It is

  667.  * also an error for the callback to set the size to zero.

  668.  */

  669. typedef int (*GEN_SESSION_CB) (SSL *ssl, unsigned char *id,

  670.                                unsigned int *id_len);

  671. 

  672. # define SSL_SESS_CACHE_OFF                      0x0000

  673. # define SSL_SESS_CACHE_CLIENT                   0x0001

  674. # define SSL_SESS_CACHE_SERVER                   0x0002

  675. # define SSL_SESS_CACHE_BOTH     (SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER)

  676. # define SSL_SESS_CACHE_NO_AUTO_CLEAR            0x0080

  677. /* enough comments already ... see SSL_CTX_set_session_cache_mode(3) */

  678. # define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP       0x0100

  679. # define SSL_SESS_CACHE_NO_INTERNAL_STORE        0x0200

  680. # define SSL_SESS_CACHE_NO_INTERNAL \

  681.         (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP|SSL_SESS_CACHE_NO_INTERNAL_STORE)

  682. 

  683. LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx);

  684. # define SSL_CTX_sess_number(ctx) \

  685.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL)

  686. # define SSL_CTX_sess_connect(ctx) \

  687.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL)

  688. # define SSL_CTX_sess_connect_good(ctx) \

  689.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL)

  690. # define SSL_CTX_sess_connect_renegotiate(ctx) \

  691.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL)

  692. # define SSL_CTX_sess_accept(ctx) \

  693.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL)

  694. # define SSL_CTX_sess_accept_renegotiate(ctx) \

  695.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL)

  696. # define SSL_CTX_sess_accept_good(ctx) \

  697.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL)

  698. # define SSL_CTX_sess_hits(ctx) \

  699.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL)

  700. # define SSL_CTX_sess_cb_hits(ctx) \

  701.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL)

  702. # define SSL_CTX_sess_misses(ctx) \

  703.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL)

  704. # define SSL_CTX_sess_timeouts(ctx) \

  705.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL)

  706. # define SSL_CTX_sess_cache_full(ctx) \

  707.         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL)

  708. 

  709. void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,

  710.                              int (*new_session_cb) (struct ssl_st *ssl,

  711.                                                     SSL_SESSION *sess));

  712. int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx)) (struct ssl_st *ssl,

  713.                                               SSL_SESSION *sess);

  714. void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,

  715.                                 void (*remove_session_cb) (struct ssl_ctx_st

  716.                                                            *ctx,

  717.                                                            SSL_SESSION *sess));

  718. void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx)) (struct ssl_ctx_st *ctx,

  719.                                                   SSL_SESSION *sess);

  720. void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,

  721.                              SSL_SESSION *(*get_session_cb) (struct ssl_st

  722.                                                              *ssl,

  723.                                                              const unsigned char

  724.                                                              *data, int len,

  725.                                                              int *copy));

  726. SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx)) (struct ssl_st *ssl,

  727.                                                        const unsigned char *data,

  728.                                                        int len, int *copy);

  729. void SSL_CTX_set_info_callback(SSL_CTX *ctx,

  730.                                void (*cb) (const SSL *ssl, int type, int val));

  731. void (*SSL_CTX_get_info_callback(SSL_CTX *ctx)) (const SSL *ssl, int type,

  732.                                                  int val);

  733. void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,

  734.                                 int (*client_cert_cb) (SSL *ssl, X509 **x509,

  735.                                                        EVP_PKEY **pkey));

  736. int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx)) (SSL *ssl, X509 **x509,

  737.                                                  EVP_PKEY **pkey);

  738. # ifndef OPENSSL_NO_ENGINE

  739. __owur int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e);

  740. # endif

  741. void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,

  742.                                     int (*app_gen_cookie_cb) (SSL *ssl,

  743.                                                               unsigned char

  744.                                                               *cookie,

  745.                                                               unsigned int

  746.                                                               *cookie_len));

  747. void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,

  748.                                   int (*app_verify_cookie_cb) (SSL *ssl,

  749.                                                                const unsigned

  750.                                                                char *cookie,

  751.                                                                unsigned int

  752.                                                                cookie_len));

  753. 

  754. void SSL_CTX_set_stateless_cookie_generate_cb(

  755.     SSL_CTX *ctx,

  756.     int (*gen_stateless_cookie_cb) (SSL *ssl,

  757.                                     unsigned char *cookie,

  758.                                     size_t *cookie_len));

  759. void SSL_CTX_set_stateless_cookie_verify_cb(

  760.     SSL_CTX *ctx,

  761.     int (*verify_stateless_cookie_cb) (SSL *ssl,

  762.                                        const unsigned char *cookie,

  763.                                        size_t cookie_len));

  764. # ifndef OPENSSL_NO_NEXTPROTONEG

  765. 

  766. typedef int (*SSL_CTX_npn_advertised_cb_func)(SSL *ssl,

  767.                                               const unsigned char **out,

  768.                                               unsigned int *outlen,

  769.                                               void *arg);

  770. void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *s,

  771.                                            SSL_CTX_npn_advertised_cb_func cb,

  772.                                            void *arg);

  773. #  define SSL_CTX_set_npn_advertised_cb SSL_CTX_set_next_protos_advertised_cb

  774. 

  775. typedef int (*SSL_CTX_npn_select_cb_func)(SSL *s,

  776.                                           unsigned char **out,

  777.                                           unsigned char *outlen,

  778.                                           const unsigned char *in,

  779.                                           unsigned int inlen,

  780.                                           void *arg);

  781. void SSL_CTX_set_next_proto_select_cb(SSL_CTX *s,

  782.                                       SSL_CTX_npn_select_cb_func cb,

  783.                                       void *arg);

  784. #  define SSL_CTX_set_npn_select_cb SSL_CTX_set_next_proto_select_cb

  785. 

  786. void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,

  787.                                     unsigned *len);

  788. #  define SSL_get0_npn_negotiated SSL_get0_next_proto_negotiated

  789. # endif

  790. 

  791. __owur int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,

  792.                                  const unsigned char *in, unsigned int inlen,

  793.                                  const unsigned char *client,

  794.                                  unsigned int client_len);

  795. 

  796. # define OPENSSL_NPN_UNSUPPORTED 0

  797. # define OPENSSL_NPN_NEGOTIATED  1

  798. # define OPENSSL_NPN_NO_OVERLAP  2

  799. 

  800. __owur int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,

  801.                                    unsigned int protos_len);

  802. __owur int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,

  803.                                unsigned int protos_len);

  804. typedef int (*SSL_CTX_alpn_select_cb_func)(SSL *ssl,

  805.                                            const unsigned char **out,

  806.                                            unsigned char *outlen,

  807.                                            const unsigned char *in,

  808.                                            unsigned int inlen,

  809.                                            void *arg);

  810. void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,

  811.                                 SSL_CTX_alpn_select_cb_func cb,

  812.                                 void *arg);

  813. void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,

  814.                             unsigned int *len);

  815. 

  816. # ifndef OPENSSL_NO_PSK

  817. /*

  818.  * the maximum length of the buffer given to callbacks containing the

  819.  * resulting identity/psk

  820.  */

  821. #  define PSK_MAX_IDENTITY_LEN 128

  822. #  define PSK_MAX_PSK_LEN 256

  823. typedef unsigned int (*SSL_psk_client_cb_func)(SSL *ssl,

  824.                                                const char *hint,

  825.                                                char *identity,

  826.                                                unsigned int max_identity_len,

  827.                                                unsigned char *psk,

  828.                                                unsigned int max_psk_len);

  829. void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb);

  830. void SSL_set_psk_client_callback(SSL *ssl, SSL_psk_client_cb_func cb);

  831. 

  832. typedef unsigned int (*SSL_psk_server_cb_func)(SSL *ssl,

  833.                                                const char *identity,

  834.                                                unsigned char *psk,

  835.                                                unsigned int max_psk_len);

  836. void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb);

  837. void SSL_set_psk_server_callback(SSL *ssl, SSL_psk_server_cb_func cb);

  838. 

  839. __owur int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint);

  840. __owur int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint);

  841. const char *SSL_get_psk_identity_hint(const SSL *s);

  842. const char *SSL_get_psk_identity(const SSL *s);

  843. # endif

  844. 

  845. typedef int (*SSL_psk_find_session_cb_func)(SSL *ssl,

  846.                                             const unsigned char *identity,

  847.                                             size_t identity_len,

  848.                                             SSL_SESSION **sess);

  849. typedef int (*SSL_psk_use_session_cb_func)(SSL *ssl, const EVP_MD *md,

  850.                                            const unsigned char **id,

  851.                                            size_t *idlen,

  852.                                            SSL_SESSION **sess);

  853. 

  854. void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb);

  855. void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx,

  856.                                            SSL_psk_find_session_cb_func cb);

  857. void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb);

  858. void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx,

  859.                                           SSL_psk_use_session_cb_func cb);

  860. 

  861. /* Register callbacks to handle custom TLS Extensions for client or server. */

  862. 

  863. __owur int SSL_CTX_has_client_custom_ext(const SSL_CTX *ctx,

  864.                                          unsigned int ext_type);

  865. 

  866. __owur int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx,

  867.                                          unsigned int ext_type,

  868.                                          custom_ext_add_cb add_cb,

  869.                                          custom_ext_free_cb free_cb,

  870.                                          void *add_arg,

  871.                                          custom_ext_parse_cb parse_cb,

  872.                                          void *parse_arg);

  873. 

  874. __owur int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx,

  875.                                          unsigned int ext_type,

  876.                                          custom_ext_add_cb add_cb,

  877.                                          custom_ext_free_cb free_cb,

  878.                                          void *add_arg,

  879.                                          custom_ext_parse_cb parse_cb,

  880.                                          void *parse_arg);

  881. 

  882. __owur int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type,

  883.                                   unsigned int context,

  884.                                   SSL_custom_ext_add_cb_ex add_cb,

  885.                                   SSL_custom_ext_free_cb_ex free_cb,

  886.                                   void *add_arg,

  887.                                   SSL_custom_ext_parse_cb_ex parse_cb,

  888.                                   void *parse_arg);

  889. 

  890. __owur int SSL_extension_supported(unsigned int ext_type);

  891. 

  892. # define SSL_NOTHING            1

  893. # define SSL_WRITING            2

  894. # define SSL_READING            3

  895. # define SSL_X509_LOOKUP        4

  896. # define SSL_ASYNC_PAUSED       5

  897. # define SSL_ASYNC_NO_JOBS      6

  898. # define SSL_CLIENT_HELLO_CB    7

  899. 

  900. /* These will only be used when doing non-blocking IO */

  901. # define SSL_want_nothing(s)         (SSL_want(s) == SSL_NOTHING)

  902. # define SSL_want_read(s)            (SSL_want(s) == SSL_READING)

  903. # define SSL_want_write(s)           (SSL_want(s) == SSL_WRITING)

  904. # define SSL_want_x509_lookup(s)     (SSL_want(s) == SSL_X509_LOOKUP)

  905. # define SSL_want_async(s)           (SSL_want(s) == SSL_ASYNC_PAUSED)

  906. # define SSL_want_async_job(s)       (SSL_want(s) == SSL_ASYNC_NO_JOBS)

  907. # define SSL_want_client_hello_cb(s) (SSL_want(s) == SSL_CLIENT_HELLO_CB)

  908. 

  909. # define SSL_MAC_FLAG_READ_MAC_STREAM 1

  910. # define SSL_MAC_FLAG_WRITE_MAC_STREAM 2

  911. 

  912. /*

  913.  * A callback for logging out TLS key material. This callback should log out

  914.  * |line| followed by a newline.

  915.  */

  916. typedef void (*SSL_CTX_keylog_cb_func)(const SSL *ssl, const char *line);

  917. 

  918. /*

  919.  * SSL_CTX_set_keylog_callback configures a callback to log key material. This

  920.  * is intended for debugging use with tools like Wireshark. The cb function

  921.  * should log line followed by a newline.

  922.  */

  923. void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb);

  924. 

  925. /*

  926.  * SSL_CTX_get_keylog_callback returns the callback configured by

  927.  * SSL_CTX_set_keylog_callback.

  928.  */

  929. SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx);

  930. 

  931. int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data);

  932. uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx);

  933. int SSL_set_max_early_data(SSL *s, uint32_t max_early_data);

  934. uint32_t SSL_get_max_early_data(const SSL *s);

  935. int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data);

  936. uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx);

  937. int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data);

  938. uint32_t SSL_get_recv_max_early_data(const SSL *s);

  939. 

  940. #ifdef __cplusplus

  941. }

  942. #endif

  943. 

  944. # include <openssl/ssl2.h>

  945. # include <openssl/ssl3.h>

  946. # include <openssl/tls1.h>      /* This is mostly sslv3 with a few tweaks */

  947. # include <openssl/dtls1.h>     /* Datagram TLS */

  948. # include <openssl/srtp.h>      /* Support for the use_srtp extension */

  949. 

  950. #ifdef  __cplusplus

  951. extern "C" {

  952. #endif

  953. 

  954. /*

  955.  * These need to be after the above set of includes due to a compiler bug

  956.  * in VisualStudio 2015

  957.  */

  958. DEFINE_STACK_OF_CONST(SSL_CIPHER)

  959. DEFINE_STACK_OF(SSL_COMP)

  960. 

  961. /* compatibility */

  962. # define SSL_set_app_data(s,arg)         (SSL_set_ex_data(s,0,(char *)(arg)))

  963. # define SSL_get_app_data(s)             (SSL_get_ex_data(s,0))

  964. # define SSL_SESSION_set_app_data(s,a)   (SSL_SESSION_set_ex_data(s,0, \

  965.                                                                   (char *)(a)))

  966. # define SSL_SESSION_get_app_data(s)     (SSL_SESSION_get_ex_data(s,0))

  967. # define SSL_CTX_get_app_data(ctx)       (SSL_CTX_get_ex_data(ctx,0))

  968. # define SSL_CTX_set_app_data(ctx,arg)   (SSL_CTX_set_ex_data(ctx,0, \

  969.                                                               (char *)(arg)))

  970. DEPRECATEDIN_1_1_0(void SSL_set_debug(SSL *s, int debug))

  971. 

  972. /* TLSv1.3 KeyUpdate message types */

  973. /* -1 used so that this is an invalid value for the on-the-wire protocol */

  974. #define SSL_KEY_UPDATE_NONE             -1

  975. /* Values as defined for the on-the-wire protocol */

  976. #define SSL_KEY_UPDATE_NOT_REQUESTED     0

  977. #define SSL_KEY_UPDATE_REQUESTED         1

  978. 

  979. /*

  980.  * The valid handshake states (one for each type message sent and one for each

  981.  * type of message received). There are also two "special" states:

  982.  * TLS = TLS or DTLS state

  983.  * DTLS = DTLS specific state

  984.  * CR/SR = Client Read/Server Read

  985.  * CW/SW = Client Write/Server Write

  986.  *

  987.  * The "special" states are:

  988.  * TLS_ST_BEFORE = No handshake has been initiated yet

  989.  * TLS_ST_OK = A handshake has been successfully completed

  990.  */

  991. typedef enum {

  992.     TLS_ST_BEFORE,

  993.     TLS_ST_OK,

  994.     DTLS_ST_CR_HELLO_VERIFY_REQUEST,

  995.     TLS_ST_CR_SRVR_HELLO,

  996.     TLS_ST_CR_CERT,

  997.     TLS_ST_CR_CERT_STATUS,

  998.     TLS_ST_CR_KEY_EXCH,

  999.     TLS_ST_CR_CERT_REQ,

  1000.     TLS_ST_CR_SRVR_DONE,

  1001.     TLS_ST_CR_SESSION_TICKET,

  1002.     TLS_ST_CR_CHANGE,

  1003.     TLS_ST_CR_FINISHED,

  1004.     TLS_ST_CW_CLNT_HELLO,

  1005.     TLS_ST_CW_CERT,

  1006.     TLS_ST_CW_KEY_EXCH,

  1007.     TLS_ST_CW_CERT_VRFY,

  1008.     TLS_ST_CW_CHANGE,

  1009.     TLS_ST_CW_NEXT_PROTO,

  1010.     TLS_ST_CW_FINISHED,

  1011.     TLS_ST_SW_HELLO_REQ,

  1012.     TLS_ST_SR_CLNT_HELLO,

  1013.     DTLS_ST_SW_HELLO_VERIFY_REQUEST,

  1014.     TLS_ST_SW_SRVR_HELLO,

  1015.     TLS_ST_SW_CERT,

  1016.     TLS_ST_SW_KEY_EXCH,

  1017.     TLS_ST_SW_CERT_REQ,

  1018.     TLS_ST_SW_SRVR_DONE,

  1019.     TLS_ST_SR_CERT,

  1020.     TLS_ST_SR_KEY_EXCH,

  1021.     TLS_ST_SR_CERT_VRFY,

  1022.     TLS_ST_SR_NEXT_PROTO,

  1023.     TLS_ST_SR_CHANGE,

  1024.     TLS_ST_SR_FINISHED,

  1025.     TLS_ST_SW_SESSION_TICKET,

  1026.     TLS_ST_SW_CERT_STATUS,

  1027.     TLS_ST_SW_CHANGE,

  1028.     TLS_ST_SW_FINISHED,

  1029.     TLS_ST_SW_ENCRYPTED_EXTENSIONS,

  1030.     TLS_ST_CR_ENCRYPTED_EXTENSIONS,

  1031.     TLS_ST_CR_CERT_VRFY,

  1032.     TLS_ST_SW_CERT_VRFY,

  1033.     TLS_ST_CR_HELLO_REQ,

  1034.     TLS_ST_SW_KEY_UPDATE,

  1035.     TLS_ST_CW_KEY_UPDATE,

  1036.     TLS_ST_SR_KEY_UPDATE,

  1037.     TLS_ST_CR_KEY_UPDATE,

  1038.     TLS_ST_EARLY_DATA,

  1039.     TLS_ST_PENDING_EARLY_DATA_END,

  1040.     TLS_ST_CW_END_OF_EARLY_DATA,

  1041.     TLS_ST_SR_END_OF_EARLY_DATA

  1042. } OSSL_HANDSHAKE_STATE;

  1043. 

  1044. /*

  1045.  * Most of the following state values are no longer used and are defined to be

  1046.  * the closest equivalent value in the current state machine code. Not all

  1047.  * defines have an equivalent and are set to a dummy value (-1). SSL_ST_CONNECT

  1048.  * and SSL_ST_ACCEPT are still in use in the definition of SSL_CB_ACCEPT_LOOP,

  1049.  * SSL_CB_ACCEPT_EXIT, SSL_CB_CONNECT_LOOP and SSL_CB_CONNECT_EXIT.

  1050.  */

  1051. 

  1052. # define SSL_ST_CONNECT                  0x1000

  1053. # define SSL_ST_ACCEPT                   0x2000

  1054. 

  1055. # define SSL_ST_MASK                     0x0FFF

  1056. 

  1057. # define SSL_CB_LOOP                     0x01

  1058. # define SSL_CB_EXIT                     0x02

  1059. # define SSL_CB_READ                     0x04

  1060. # define SSL_CB_WRITE                    0x08

  1061. # define SSL_CB_ALERT                    0x4000/* used in callback */

  1062. # define SSL_CB_READ_ALERT               (SSL_CB_ALERT|SSL_CB_READ)

  1063. # define SSL_CB_WRITE_ALERT              (SSL_CB_ALERT|SSL_CB_WRITE)

  1064. # define SSL_CB_ACCEPT_LOOP              (SSL_ST_ACCEPT|SSL_CB_LOOP)

  1065. # define SSL_CB_ACCEPT_EXIT              (SSL_ST_ACCEPT|SSL_CB_EXIT)

  1066. # define SSL_CB_CONNECT_LOOP             (SSL_ST_CONNECT|SSL_CB_LOOP)

  1067. # define SSL_CB_CONNECT_EXIT             (SSL_ST_CONNECT|SSL_CB_EXIT)

  1068. # define SSL_CB_HANDSHAKE_START          0x10

  1069. # define SSL_CB_HANDSHAKE_DONE           0x20

  1070. 

  1071. /* Is the SSL_connection established? */

  1072. # define SSL_in_connect_init(a)          (SSL_in_init(a) && !SSL_is_server(a))

  1073. # define SSL_in_accept_init(a)           (SSL_in_init(a) && SSL_is_server(a))

  1074. int SSL_in_init(const SSL *s);

  1075. int SSL_in_before(const SSL *s);

  1076. int SSL_is_init_finished(const SSL *s);

  1077. 

  1078. /*

  1079.  * The following 3 states are kept in ssl->rlayer.rstate when reads fail, you

  1080.  * should not need these

  1081.  */

  1082. # define SSL_ST_READ_HEADER                      0xF0

  1083. # define SSL_ST_READ_BODY                        0xF1

  1084. # define SSL_ST_READ_DONE                        0xF2

  1085. 

  1086. /*-

  1087.  * Obtain latest Finished message

  1088.  *   -- that we sent (SSL_get_finished)

  1089.  *   -- that we expected from peer (SSL_get_peer_finished).

  1090.  * Returns length (0 == no Finished so far), copies up to 'count' bytes.

  1091.  */

  1092. size_t SSL_get_finished(const SSL *s, void *buf, size_t count);

  1093. size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);

  1094. 

  1095. /*

  1096.  * use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 3 options are

  1097.  * 'ored' with SSL_VERIFY_PEER if they are desired

  1098.  */

  1099. # define SSL_VERIFY_NONE                 0x00

  1100. # define SSL_VERIFY_PEER                 0x01

  1101. # define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02

  1102. # define SSL_VERIFY_CLIENT_ONCE          0x04

  1103. # define SSL_VERIFY_POST_HANDSHAKE       0x08

  1104. 

  1105. # if OPENSSL_API_COMPAT < 0x10100000L

  1106. #  define OpenSSL_add_ssl_algorithms()   SSL_library_init()

  1107. #  define SSLeay_add_ssl_algorithms()    SSL_library_init()

  1108. # endif

  1109. 

  1110. /* More backward compatibility */

  1111. # define SSL_get_cipher(s) \

  1112.                 SSL_CIPHER_get_name(SSL_get_current_cipher(s))

  1113. # define SSL_get_cipher_bits(s,np) \

  1114.                 SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np)

  1115. # define SSL_get_cipher_version(s) \

  1116.                 SSL_CIPHER_get_version(SSL_get_current_cipher(s))

  1117. # define SSL_get_cipher_name(s) \

  1118.                 SSL_CIPHER_get_name(SSL_get_current_cipher(s))

  1119. # define SSL_get_time(a)         SSL_SESSION_get_time(a)

  1120. # define SSL_set_time(a,b)       SSL_SESSION_set_time((a),(b))

  1121. # define SSL_get_timeout(a)      SSL_SESSION_get_timeout(a)

  1122. # define SSL_set_timeout(a,b)    SSL_SESSION_set_timeout((a),(b))

  1123. 

  1124. # define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id)

  1125. # define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id)

  1126. 

  1127. DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)

  1128. # define SSL_AD_REASON_OFFSET            1000/* offset to get SSL_R_... value

  1129.                                               * from SSL_AD_... */

  1130. /* These alert types are for SSLv3 and TLSv1 */

  1131. # define SSL_AD_CLOSE_NOTIFY             SSL3_AD_CLOSE_NOTIFY

  1132. /* fatal */

  1133. # define SSL_AD_UNEXPECTED_MESSAGE       SSL3_AD_UNEXPECTED_MESSAGE

  1134. /* fatal */

  1135. # define SSL_AD_BAD_RECORD_MAC           SSL3_AD_BAD_RECORD_MAC

  1136. # define SSL_AD_DECRYPTION_FAILED        TLS1_AD_DECRYPTION_FAILED

  1137. # define SSL_AD_RECORD_OVERFLOW          TLS1_AD_RECORD_OVERFLOW

  1138. /* fatal */

  1139. # define SSL_AD_DECOMPRESSION_FAILURE    SSL3_AD_DECOMPRESSION_FAILURE

  1140. /* fatal */

  1141. # define SSL_AD_HANDSHAKE_FAILURE        SSL3_AD_HANDSHAKE_FAILURE

  1142. /* Not for TLS */

  1143. # define SSL_AD_NO_CERTIFICATE           SSL3_AD_NO_CERTIFICATE

  1144. # define SSL_AD_BAD_CERTIFICATE          SSL3_AD_BAD_CERTIFICATE

  1145. # define SSL_AD_UNSUPPORTED_CERTIFICATE  SSL3_AD_UNSUPPORTED_CERTIFICATE

  1146. # define SSL_AD_CERTIFICATE_REVOKED      SSL3_AD_CERTIFICATE_REVOKED

  1147. # define SSL_AD_CERTIFICATE_EXPIRED      SSL3_AD_CERTIFICATE_EXPIRED

  1148. # define SSL_AD_CERTIFICATE_UNKNOWN      SSL3_AD_CERTIFICATE_UNKNOWN

  1149. /* fatal */

  1150. # define SSL_AD_ILLEGAL_PARAMETER        SSL3_AD_ILLEGAL_PARAMETER

  1151. /* fatal */

  1152. # define SSL_AD_UNKNOWN_CA               TLS1_AD_UNKNOWN_CA

  1153. /* fatal */

  1154. # define SSL_AD_ACCESS_DENIED            TLS1_AD_ACCESS_DENIED

  1155. /* fatal */

  1156. # define SSL_AD_DECODE_ERROR             TLS1_AD_DECODE_ERROR

  1157. # define SSL_AD_DECRYPT_ERROR            TLS1_AD_DECRYPT_ERROR

  1158. /* fatal */

  1159. # define SSL_AD_EXPORT_RESTRICTION       TLS1_AD_EXPORT_RESTRICTION

  1160. /* fatal */

  1161. # define SSL_AD_PROTOCOL_VERSION         TLS1_AD_PROTOCOL_VERSION

  1162. /* fatal */

  1163. # define SSL_AD_INSUFFICIENT_SECURITY    TLS1_AD_INSUFFICIENT_SECURITY

  1164. /* fatal */

  1165. # define SSL_AD_INTERNAL_ERROR           TLS1_AD_INTERNAL_ERROR

  1166. # define SSL_AD_USER_CANCELLED           TLS1_AD_USER_CANCELLED

  1167. # define SSL_AD_NO_RENEGOTIATION         TLS1_AD_NO_RENEGOTIATION

  1168. # define SSL_AD_MISSING_EXTENSION        TLS13_AD_MISSING_EXTENSION

  1169. # define SSL_AD_CERTIFICATE_REQUIRED     TLS13_AD_CERTIFICATE_REQUIRED

  1170. # define SSL_AD_UNSUPPORTED_EXTENSION    TLS1_AD_UNSUPPORTED_EXTENSION

  1171. # define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE

  1172. # define SSL_AD_UNRECOGNIZED_NAME        TLS1_AD_UNRECOGNIZED_NAME

  1173. # define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE

  1174. # define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE

  1175. /* fatal */

  1176. # define SSL_AD_UNKNOWN_PSK_IDENTITY     TLS1_AD_UNKNOWN_PSK_IDENTITY

  1177. /* fatal */

  1178. # define SSL_AD_INAPPROPRIATE_FALLBACK   TLS1_AD_INAPPROPRIATE_FALLBACK

  1179. # define SSL_AD_NO_APPLICATION_PROTOCOL  TLS1_AD_NO_APPLICATION_PROTOCOL

  1180. # define SSL_ERROR_NONE                  0

  1181. # define SSL_ERROR_SSL                   1

  1182. # define SSL_ERROR_WANT_READ             2

  1183. # define SSL_ERROR_WANT_WRITE            3

  1184. # define SSL_ERROR_WANT_X509_LOOKUP      4

  1185. # define SSL_ERROR_SYSCALL               5/* look at error stack/return

  1186.                                            * value/errno */

  1187. # define SSL_ERROR_ZERO_RETURN           6

  1188. # define SSL_ERROR_WANT_CONNECT          7

  1189. # define SSL_ERROR_WANT_ACCEPT           8

  1190. # define SSL_ERROR_WANT_ASYNC            9

  1191. # define SSL_ERROR_WANT_ASYNC_JOB       10

  1192. # define SSL_ERROR_WANT_CLIENT_HELLO_CB 11

  1193. # define SSL_CTRL_SET_TMP_DH                     3

  1194. # define SSL_CTRL_SET_TMP_ECDH                   4

  1195. # define SSL_CTRL_SET_TMP_DH_CB                  6

  1196. # define SSL_CTRL_GET_CLIENT_CERT_REQUEST        9

  1197. # define SSL_CTRL_GET_NUM_RENEGOTIATIONS         10

  1198. # define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS       11

  1199. # define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS       12

  1200. # define SSL_CTRL_GET_FLAGS                      13

  1201. # define SSL_CTRL_EXTRA_CHAIN_CERT               14

  1202. # define SSL_CTRL_SET_MSG_CALLBACK               15

  1203. # define SSL_CTRL_SET_MSG_CALLBACK_ARG           16

  1204. /* only applies to datagram connections */

  1205. # define SSL_CTRL_SET_MTU                17

  1206. /* Stats */

  1207. # define SSL_CTRL_SESS_NUMBER                    20

  1208. # define SSL_CTRL_SESS_CONNECT                   21

  1209. # define SSL_CTRL_SESS_CONNECT_GOOD              22

  1210. # define SSL_CTRL_SESS_CONNECT_RENEGOTIATE       23

  1211. # define SSL_CTRL_SESS_ACCEPT                    24

  1212. # define SSL_CTRL_SESS_ACCEPT_GOOD               25

  1213. # define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE        26

  1214. # define SSL_CTRL_SESS_HIT                       27

  1215. # define SSL_CTRL_SESS_CB_HIT                    28

  1216. # define SSL_CTRL_SESS_MISSES                    29

  1217. # define SSL_CTRL_SESS_TIMEOUTS                  30

  1218. # define SSL_CTRL_SESS_CACHE_FULL                31

  1219. # define SSL_CTRL_MODE                           33

  1220. # define SSL_CTRL_GET_READ_AHEAD                 40

  1221. # define SSL_CTRL_SET_READ_AHEAD                 41

  1222. # define SSL_CTRL_SET_SESS_CACHE_SIZE            42

  1223. # define SSL_CTRL_GET_SESS_CACHE_SIZE            43

  1224. # define SSL_CTRL_SET_SESS_CACHE_MODE            44

  1225. # define SSL_CTRL_GET_SESS_CACHE_MODE            45

  1226. # define SSL_CTRL_GET_MAX_CERT_LIST              50

  1227. # define SSL_CTRL_SET_MAX_CERT_LIST              51

  1228. # define SSL_CTRL_SET_MAX_SEND_FRAGMENT          52

  1229. /* see tls1.h for macros based on these */

  1230. # define SSL_CTRL_SET_TLSEXT_SERVERNAME_CB       53

  1231. # define SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG      54

  1232. # define SSL_CTRL_SET_TLSEXT_HOSTNAME            55

  1233. # define SSL_CTRL_SET_TLSEXT_DEBUG_CB            56

  1234. # define SSL_CTRL_SET_TLSEXT_DEBUG_ARG           57

  1235. # define SSL_CTRL_GET_TLSEXT_TICKET_KEYS         58

  1236. # define SSL_CTRL_SET_TLSEXT_TICKET_KEYS         59

  1237. /*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT    60 */

  1238. /*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB 61 */

  1239. /*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG 62 */

  1240. # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB       63

  1241. # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG   64

  1242. # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE     65

  1243. # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS     66

  1244. # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS     67

  1245. # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS      68

  1246. # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS      69

  1247. # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP        70

  1248. # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP        71

  1249. # define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB       72

  1250. # define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB    75

  1251. # define SSL_CTRL_SET_SRP_VERIFY_PARAM_CB                76

  1252. # define SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB             77

  1253. # define SSL_CTRL_SET_SRP_ARG            78

  1254. # define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME               79

  1255. # define SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH               80

  1256. # define SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD               81

  1257. # ifndef OPENSSL_NO_HEARTBEATS

  1258. #  define SSL_CTRL_DTLS_EXT_SEND_HEARTBEAT               85

  1259. #  define SSL_CTRL_GET_DTLS_EXT_HEARTBEAT_PENDING        86

  1260. #  define SSL_CTRL_SET_DTLS_EXT_HEARTBEAT_NO_REQUESTS    87

  1261. # endif

  1262. # define DTLS_CTRL_GET_TIMEOUT           73

  1263. # define DTLS_CTRL_HANDLE_TIMEOUT        74

  1264. # define SSL_CTRL_GET_RI_SUPPORT                 76

  1265. # define SSL_CTRL_CLEAR_MODE                     78

  1266. # define SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB      79

  1267. # define SSL_CTRL_GET_EXTRA_CHAIN_CERTS          82

  1268. # define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS        83

  1269. # define SSL_CTRL_CHAIN                          88

  1270. # define SSL_CTRL_CHAIN_CERT                     89

  1271. # define SSL_CTRL_GET_GROUPS                     90

  1272. # define SSL_CTRL_SET_GROUPS                     91

  1273. # define SSL_CTRL_SET_GROUPS_LIST                92

  1274. # define SSL_CTRL_GET_SHARED_GROUP               93

  1275. # define SSL_CTRL_SET_SIGALGS                    97

  1276. # define SSL_CTRL_SET_SIGALGS_LIST               98

  1277. # define SSL_CTRL_CERT_FLAGS                     99

  1278. # define SSL_CTRL_CLEAR_CERT_FLAGS               100

  1279. # define SSL_CTRL_SET_CLIENT_SIGALGS             101

  1280. # define SSL_CTRL_SET_CLIENT_SIGALGS_LIST        102

  1281. # define SSL_CTRL_GET_CLIENT_CERT_TYPES          103

  1282. # define SSL_CTRL_SET_CLIENT_CERT_TYPES          104

  1283. # define SSL_CTRL_BUILD_CERT_CHAIN               105

  1284. # define SSL_CTRL_SET_VERIFY_CERT_STORE          106

  1285. # define SSL_CTRL_SET_CHAIN_CERT_STORE           107

  1286. # define SSL_CTRL_GET_PEER_SIGNATURE_NID         108

  1287. # define SSL_CTRL_GET_PEER_TMP_KEY               109

  1288. # define SSL_CTRL_GET_RAW_CIPHERLIST             110

  1289. # define SSL_CTRL_GET_EC_POINT_FORMATS           111

  1290. # define SSL_CTRL_GET_CHAIN_CERTS                115

  1291. # define SSL_CTRL_SELECT_CURRENT_CERT            116

  1292. # define SSL_CTRL_SET_CURRENT_CERT               117

  1293. # define SSL_CTRL_SET_DH_AUTO                    118

  1294. # define DTLS_CTRL_SET_LINK_MTU                  120

  1295. # define DTLS_CTRL_GET_LINK_MIN_MTU              121

  1296. # define SSL_CTRL_GET_EXTMS_SUPPORT              122

  1297. # define SSL_CTRL_SET_MIN_PROTO_VERSION          123

  1298. # define SSL_CTRL_SET_MAX_PROTO_VERSION          124

  1299. # define SSL_CTRL_SET_SPLIT_SEND_FRAGMENT        125

  1300. # define SSL_CTRL_SET_MAX_PIPELINES              126

  1301. # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE     127

  1302. # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB       128

  1303. # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG   129

  1304. # define SSL_CTRL_GET_MIN_PROTO_VERSION          130

  1305. # define SSL_CTRL_GET_MAX_PROTO_VERSION          131

  1306. # define SSL_CTRL_GET_SIGNATURE_NID              132

  1307. # define SSL_CTRL_GET_TMP_KEY                    133

  1308. # define SSL_CERT_SET_FIRST                      1

  1309. # define SSL_CERT_SET_NEXT                       2

  1310. # define SSL_CERT_SET_SERVER                     3

  1311. # define DTLSv1_get_timeout(ssl, arg) \

  1312.         SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)(arg))

  1313. # define DTLSv1_handle_timeout(ssl) \

  1314.         SSL_ctrl(ssl,DTLS_CTRL_HANDLE_TIMEOUT,0, NULL)

  1315. # define SSL_num_renegotiations(ssl) \

  1316.         SSL_ctrl((ssl),SSL_CTRL_GET_NUM_RENEGOTIATIONS,0,NULL)

  1317. # define SSL_clear_num_renegotiations(ssl) \

  1318.         SSL_ctrl((ssl),SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS,0,NULL)

  1319. # define SSL_total_renegotiations(ssl) \

  1320.         SSL_ctrl((ssl),SSL_CTRL_GET_TOTAL_RENEGOTIATIONS,0,NULL)

  1321. # define SSL_CTX_set_tmp_dh(ctx,dh) \

  1322.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)(dh))

  1323. # define SSL_CTX_set_tmp_ecdh(ctx,ecdh) \

  1324.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)(ecdh))

  1325. # define SSL_CTX_set_dh_auto(ctx, onoff) \

  1326.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_DH_AUTO,onoff,NULL)

  1327. # define SSL_set_dh_auto(s, onoff) \

  1328.         SSL_ctrl(s,SSL_CTRL_SET_DH_AUTO,onoff,NULL)

  1329. # define SSL_set_tmp_dh(ssl,dh) \

  1330.         SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)(dh))

  1331. # define SSL_set_tmp_ecdh(ssl,ecdh) \

  1332.         SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)(ecdh))

  1333. # define SSL_CTX_add_extra_chain_cert(ctx,x509) \

  1334.         SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)(x509))

  1335. # define SSL_CTX_get_extra_chain_certs(ctx,px509) \

  1336.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,0,px509)

  1337. # define SSL_CTX_get_extra_chain_certs_only(ctx,px509) \

  1338.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,1,px509)

  1339. # define SSL_CTX_clear_extra_chain_certs(ctx) \

  1340.         SSL_CTX_ctrl(ctx,SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS,0,NULL)

  1341. # define SSL_CTX_set0_chain(ctx,sk) \

  1342.         SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN,0,(char *)(sk))

  1343. # define SSL_CTX_set1_chain(ctx,sk) \

  1344.         SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN,1,(char *)(sk))

  1345. # define SSL_CTX_add0_chain_cert(ctx,x509) \

  1346.         SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN_CERT,0,(char *)(x509))

  1347. # define SSL_CTX_add1_chain_cert(ctx,x509) \

  1348.         SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN_CERT,1,(char *)(x509))

  1349. # define SSL_CTX_get0_chain_certs(ctx,px509) \

  1350.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERTS,0,px509)

  1351. # define SSL_CTX_clear_chain_certs(ctx) \

  1352.         SSL_CTX_set0_chain(ctx,NULL)

  1353. # define SSL_CTX_build_cert_chain(ctx, flags) \

  1354.         SSL_CTX_ctrl(ctx,SSL_CTRL_BUILD_CERT_CHAIN, flags, NULL)

  1355. # define SSL_CTX_select_current_cert(ctx,x509) \

  1356.         SSL_CTX_ctrl(ctx,SSL_CTRL_SELECT_CURRENT_CERT,0,(char *)(x509))

  1357. # define SSL_CTX_set_current_cert(ctx, op) \

  1358.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CURRENT_CERT, op, NULL)

  1359. # define SSL_CTX_set0_verify_cert_store(ctx,st) \

  1360.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st))

  1361. # define SSL_CTX_set1_verify_cert_store(ctx,st) \

  1362.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st))

  1363. # define SSL_CTX_set0_chain_cert_store(ctx,st) \

  1364.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st))

  1365. # define SSL_CTX_set1_chain_cert_store(ctx,st) \

  1366.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st))

  1367. # define SSL_set0_chain(s,sk) \

  1368.         SSL_ctrl(s,SSL_CTRL_CHAIN,0,(char *)(sk))

  1369. # define SSL_set1_chain(s,sk) \

  1370.         SSL_ctrl(s,SSL_CTRL_CHAIN,1,(char *)(sk))

  1371. # define SSL_add0_chain_cert(s,x509) \

  1372.         SSL_ctrl(s,SSL_CTRL_CHAIN_CERT,0,(char *)(x509))

  1373. # define SSL_add1_chain_cert(s,x509) \

  1374.         SSL_ctrl(s,SSL_CTRL_CHAIN_CERT,1,(char *)(x509))

  1375. # define SSL_get0_chain_certs(s,px509) \

  1376.         SSL_ctrl(s,SSL_CTRL_GET_CHAIN_CERTS,0,px509)

  1377. # define SSL_clear_chain_certs(s) \

  1378.         SSL_set0_chain(s,NULL)

  1379. # define SSL_build_cert_chain(s, flags) \

  1380.         SSL_ctrl(s,SSL_CTRL_BUILD_CERT_CHAIN, flags, NULL)

  1381. # define SSL_select_current_cert(s,x509) \

  1382.         SSL_ctrl(s,SSL_CTRL_SELECT_CURRENT_CERT,0,(char *)(x509))

  1383. # define SSL_set_current_cert(s,op) \

  1384.         SSL_ctrl(s,SSL_CTRL_SET_CURRENT_CERT, op, NULL)

  1385. # define SSL_set0_verify_cert_store(s,st) \

  1386.         SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)(st))

  1387. # define SSL_set1_verify_cert_store(s,st) \

  1388.         SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)(st))

  1389. # define SSL_set0_chain_cert_store(s,st) \

  1390.         SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)(st))

  1391. # define SSL_set1_chain_cert_store(s,st) \

  1392.         SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)(st))

  1393. # define SSL_get1_groups(s, glist) \

  1394.         SSL_ctrl(s,SSL_CTRL_GET_GROUPS,0,(int*)(glist))

  1395. # define SSL_CTX_set1_groups(ctx, glist, glistlen) \

  1396.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_GROUPS,glistlen,(char *)(glist))

  1397. # define SSL_CTX_set1_groups_list(ctx, s) \

  1398.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_GROUPS_LIST,0,(char *)(s))

  1399. # define SSL_set1_groups(s, glist, glistlen) \

  1400.         SSL_ctrl(s,SSL_CTRL_SET_GROUPS,glistlen,(char *)(glist))

  1401. # define SSL_set1_groups_list(s, str) \

  1402.         SSL_ctrl(s,SSL_CTRL_SET_GROUPS_LIST,0,(char *)(str))

  1403. # define SSL_get_shared_group(s, n) \

  1404.         SSL_ctrl(s,SSL_CTRL_GET_SHARED_GROUP,n,NULL)

  1405. # define SSL_CTX_set1_sigalgs(ctx, slist, slistlen) \

  1406.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS,slistlen,(int *)(slist))

  1407. # define SSL_CTX_set1_sigalgs_list(ctx, s) \

  1408.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)(s))

  1409. # define SSL_set1_sigalgs(s, slist, slistlen) \

  1410.         SSL_ctrl(s,SSL_CTRL_SET_SIGALGS,slistlen,(int *)(slist))

  1411. # define SSL_set1_sigalgs_list(s, str) \

  1412.         SSL_ctrl(s,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)(str))

  1413. # define SSL_CTX_set1_client_sigalgs(ctx, slist, slistlen) \

  1414.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS,slistlen,(int *)(slist))

  1415. # define SSL_CTX_set1_client_sigalgs_list(ctx, s) \

  1416.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)(s))

  1417. # define SSL_set1_client_sigalgs(s, slist, slistlen) \

  1418.         SSL_ctrl(s,SSL_CTRL_SET_CLIENT_SIGALGS,slistlen,(int *)(slist))

  1419. # define SSL_set1_client_sigalgs_list(s, str) \

  1420.         SSL_ctrl(s,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)(str))

  1421. # define SSL_get0_certificate_types(s, clist) \

  1422.         SSL_ctrl(s, SSL_CTRL_GET_CLIENT_CERT_TYPES, 0, (char *)(clist))

  1423. # define SSL_CTX_set1_client_certificate_types(ctx, clist, clistlen) \

  1424.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen, \

  1425.                      (char *)(clist))

  1426. # define SSL_set1_client_certificate_types(s, clist, clistlen) \

  1427.         SSL_ctrl(s,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)(clist))

  1428. # define SSL_get_signature_nid(s, pn) \

  1429.         SSL_ctrl(s,SSL_CTRL_GET_SIGNATURE_NID,0,pn)

  1430. # define SSL_get_peer_signature_nid(s, pn) \

  1431.         SSL_ctrl(s,SSL_CTRL_GET_PEER_SIGNATURE_NID,0,pn)

  1432. # define SSL_get_peer_tmp_key(s, pk) \

  1433.         SSL_ctrl(s,SSL_CTRL_GET_PEER_TMP_KEY,0,pk)

  1434. # define SSL_get_tmp_key(s, pk) \

  1435.         SSL_ctrl(s,SSL_CTRL_GET_TMP_KEY,0,pk)

  1436. # define SSL_get0_raw_cipherlist(s, plst) \

  1437.         SSL_ctrl(s,SSL_CTRL_GET_RAW_CIPHERLIST,0,plst)

  1438. # define SSL_get0_ec_point_formats(s, plst) \

  1439.         SSL_ctrl(s,SSL_CTRL_GET_EC_POINT_FORMATS,0,plst)

  1440. # define SSL_CTX_set_min_proto_version(ctx, version) \

  1441.         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)

  1442. # define SSL_CTX_set_max_proto_version(ctx, version) \

  1443.         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)

  1444. # define SSL_CTX_get_min_proto_version(ctx) \

  1445.         SSL_CTX_ctrl(ctx, SSL_CTRL_GET_MIN_PROTO_VERSION, 0, NULL)

  1446. # define SSL_CTX_get_max_proto_version(ctx) \

  1447.         SSL_CTX_ctrl(ctx, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL)

  1448. # define SSL_set_min_proto_version(s, version) \

  1449.         SSL_ctrl(s, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)

  1450. # define SSL_set_max_proto_version(s, version) \

  1451.         SSL_ctrl(s, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)

  1452. # define SSL_get_min_proto_version(s) \

  1453.         SSL_ctrl(s, SSL_CTRL_GET_MIN_PROTO_VERSION, 0, NULL)

  1454. # define SSL_get_max_proto_version(s) \

  1455.         SSL_ctrl(s, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL)

  1456. 

  1457. /* Backwards compatibility, original 1.1.0 names */

  1458. # define SSL_CTRL_GET_SERVER_TMP_KEY \

  1459.          SSL_CTRL_GET_PEER_TMP_KEY

  1460. # define SSL_get_server_tmp_key(s, pk) \

  1461.          SSL_get_peer_tmp_key(s, pk)

  1462. 

  1463. /*

  1464.  * The following symbol names are old and obsolete. They are kept

  1465.  * for compatibility reasons only and should not be used anymore.

  1466.  */

  1467. # define SSL_CTRL_GET_CURVES           SSL_CTRL_GET_GROUPS

  1468. # define SSL_CTRL_SET_CURVES           SSL_CTRL_SET_GROUPS

  1469. # define SSL_CTRL_SET_CURVES_LIST      SSL_CTRL_SET_GROUPS_LIST

  1470. # define SSL_CTRL_GET_SHARED_CURVE     SSL_CTRL_GET_SHARED_GROUP

  1471. 

  1472. # define SSL_get1_curves               SSL_get1_groups

  1473. # define SSL_CTX_set1_curves           SSL_CTX_set1_groups

  1474. # define SSL_CTX_set1_curves_list      SSL_CTX_set1_groups_list

  1475. # define SSL_set1_curves               SSL_set1_groups

  1476. # define SSL_set1_curves_list          SSL_set1_groups_list

  1477. # define SSL_get_shared_curve          SSL_get_shared_group

  1478. 

  1479. 

  1480. # if OPENSSL_API_COMPAT < 0x10100000L

  1481. /* Provide some compatibility macros for removed functionality. */

  1482. #  define SSL_CTX_need_tmp_RSA(ctx)                0

  1483. #  define SSL_CTX_set_tmp_rsa(ctx,rsa)             1

  1484. #  define SSL_need_tmp_RSA(ssl)                    0

  1485. #  define SSL_set_tmp_rsa(ssl,rsa)                 1

  1486. #  define SSL_CTX_set_ecdh_auto(dummy, onoff)      ((onoff) != 0)

  1487. #  define SSL_set_ecdh_auto(dummy, onoff)          ((onoff) != 0)

  1488. /*

  1489.  * We "pretend" to call the callback to avoid warnings about unused static

  1490.  * functions.

  1491.  */

  1492. #  define SSL_CTX_set_tmp_rsa_callback(ctx, cb)    while(0) (cb)(NULL, 0, 0)

  1493. #  define SSL_set_tmp_rsa_callback(ssl, cb)        while(0) (cb)(NULL, 0, 0)

  1494. # endif

  1495. __owur const BIO_METHOD *BIO_f_ssl(void);

  1496. __owur BIO *BIO_new_ssl(SSL_CTX *ctx, int client);

  1497. __owur BIO *BIO_new_ssl_connect(SSL_CTX *ctx);

  1498. __owur BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx);

  1499. __owur int BIO_ssl_copy_session_id(BIO *to, BIO *from);

  1500. void BIO_ssl_shutdown(BIO *ssl_bio);

  1501. 

  1502. __owur int SSL_CTX_set_cipher_list(SSL_CTX *, const char *str);

  1503. __owur SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth);

  1504. int SSL_CTX_up_ref(SSL_CTX *ctx);

  1505. void SSL_CTX_free(SSL_CTX *);

  1506. __owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t);

  1507. __owur long SSL_CTX_get_timeout(const SSL_CTX *ctx);

  1508. __owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *);

  1509. void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *);

  1510. void SSL_CTX_set1_cert_store(SSL_CTX *, X509_STORE *);

  1511. __owur int SSL_want(const SSL *s);

  1512. __owur int SSL_clear(SSL *s);

  1513. 

  1514. void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm);

  1515. 

  1516. __owur const SSL_CIPHER *SSL_get_current_cipher(const SSL *s);

  1517. __owur const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s);

  1518. __owur int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits);

  1519. __owur const char *SSL_CIPHER_get_version(const SSL_CIPHER *c);

  1520. __owur const char *SSL_CIPHER_get_name(const SSL_CIPHER *c);

  1521. __owur const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c);

  1522. __owur const char *OPENSSL_cipher_name(const char *rfc_name);

  1523. __owur uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);

  1524. __owur uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c);

  1525. __owur int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c);

  1526. __owur int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c);

  1527. __owur const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c);

  1528. __owur int SSL_CIPHER_is_aead(const SSL_CIPHER *c);

  1529. 

  1530. __owur int SSL_get_fd(const SSL *s);

  1531. __owur int SSL_get_rfd(const SSL *s);

  1532. __owur int SSL_get_wfd(const SSL *s);

  1533. __owur const char *SSL_get_cipher_list(const SSL *s, int n);

  1534. __owur char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size);

  1535. __owur int SSL_get_read_ahead(const SSL *s);

  1536. __owur int SSL_pending(const SSL *s);

  1537. __owur int SSL_has_pending(const SSL *s);

  1538. # ifndef OPENSSL_NO_SOCK

  1539. __owur int SSL_set_fd(SSL *s, int fd);

  1540. __owur int SSL_set_rfd(SSL *s, int fd);

  1541. __owur int SSL_set_wfd(SSL *s, int fd);

  1542. # endif

  1543. void SSL_set0_rbio(SSL *s, BIO *rbio);

  1544. void SSL_set0_wbio(SSL *s, BIO *wbio);

  1545. void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio);

  1546. __owur BIO *SSL_get_rbio(const SSL *s);

  1547. __owur BIO *SSL_get_wbio(const SSL *s);

  1548. __owur int SSL_set_cipher_list(SSL *s, const char *str);

  1549. __owur int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str);

  1550. __owur int SSL_set_ciphersuites(SSL *s, const char *str);

  1551. void SSL_set_read_ahead(SSL *s, int yes);

  1552. __owur int SSL_get_verify_mode(const SSL *s);

  1553. __owur int SSL_get_verify_depth(const SSL *s);

  1554. __owur SSL_verify_cb SSL_get_verify_callback(const SSL *s);

  1555. void SSL_set_verify(SSL *s, int mode, SSL_verify_cb callback);

  1556. void SSL_set_verify_depth(SSL *s, int depth);

  1557. void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg);

  1558. # ifndef OPENSSL_NO_RSA

  1559. __owur int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);

  1560. __owur int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d,

  1561.                                       long len);

  1562. # endif

  1563. __owur int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);

  1564. __owur int SSL_use_PrivateKey_ASN1(int pk, SSL *ssl, const unsigned char *d,

  1565.                                    long len);

  1566. __owur int SSL_use_certificate(SSL *ssl, X509 *x);

  1567. __owur int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len);

  1568. __owur int SSL_use_cert_and_key(SSL *ssl, X509 *x509, EVP_PKEY *privatekey,

  1569.                                 STACK_OF(X509) *chain, int override);

  1570. 

  1571. 

  1572. /* serverinfo file format versions */

  1573. # define SSL_SERVERINFOV1   1

  1574. # define SSL_SERVERINFOV2   2

  1575. 

  1576. /* Set serverinfo data for the current active cert. */

  1577. __owur int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo,

  1578.                                   size_t serverinfo_length);

  1579. __owur int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version,

  1580.                                      const unsigned char *serverinfo,

  1581.                                      size_t serverinfo_length);

  1582. __owur int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file);

  1583. 

  1584. #ifndef OPENSSL_NO_RSA

  1585. __owur int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type);

  1586. #endif

  1587. 

  1588. __owur int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type);

  1589. __owur int SSL_use_certificate_file(SSL *ssl, const char *file, int type);

  1590. 

  1591. #ifndef OPENSSL_NO_RSA

  1592. __owur int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file,

  1593.                                           int type);

  1594. #endif

  1595. __owur int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file,

  1596.                                        int type);

  1597. __owur int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file,

  1598.                                         int type);

  1599. /* PEM type */

  1600. __owur int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file);

  1601. __owur int SSL_use_certificate_chain_file(SSL *ssl, const char *file);

  1602. __owur STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file);

  1603. __owur int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs,

  1604.                                                const char *file);

  1605. int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs,

  1606.                                        const char *dir);

  1607. 

  1608. # if OPENSSL_API_COMPAT < 0x10100000L

  1609. #  define SSL_load_error_strings() \

  1610.     OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \

  1611.                      | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL)

  1612. # endif

  1613. 

  1614. __owur const char *SSL_state_string(const SSL *s);

  1615. __owur const char *SSL_rstate_string(const SSL *s);

  1616. __owur const char *SSL_state_string_long(const SSL *s);

  1617. __owur const char *SSL_rstate_string_long(const SSL *s);

  1618. __owur long SSL_SESSION_get_time(const SSL_SESSION *s);

  1619. __owur long SSL_SESSION_set_time(SSL_SESSION *s, long t);

  1620. __owur long SSL_SESSION_get_timeout(const SSL_SESSION *s);

  1621. __owur long SSL_SESSION_set_timeout(SSL_SESSION *s, long t);

  1622. __owur int SSL_SESSION_get_protocol_version(const SSL_SESSION *s);

  1623. __owur int SSL_SESSION_set_protocol_version(SSL_SESSION *s, int version);

  1624. 

  1625. __owur const char *SSL_SESSION_get0_hostname(const SSL_SESSION *s);

  1626. __owur int SSL_SESSION_set1_hostname(SSL_SESSION *s, const char *hostname);

  1627. void SSL_SESSION_get0_alpn_selected(const SSL_SESSION *s,

  1628.                                     const unsigned char **alpn,

  1629.                                     size_t *len);

  1630. __owur int SSL_SESSION_set1_alpn_selected(SSL_SESSION *s,

  1631.                                           const unsigned char *alpn,

  1632.                                           size_t len);

  1633. __owur const SSL_CIPHER *SSL_SESSION_get0_cipher(const SSL_SESSION *s);

  1634. __owur int SSL_SESSION_set_cipher(SSL_SESSION *s, const SSL_CIPHER *cipher);

  1635. __owur int SSL_SESSION_has_ticket(const SSL_SESSION *s);

  1636. __owur unsigned long SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s);

  1637. void SSL_SESSION_get0_ticket(const SSL_SESSION *s, const unsigned char **tick,

  1638.                              size_t *len);

  1639. __owur uint32_t SSL_SESSION_get_max_early_data(const SSL_SESSION *s);

  1640. __owur int SSL_SESSION_set_max_early_data(SSL_SESSION *s,

  1641.                                           uint32_t max_early_data);

  1642. __owur int SSL_copy_session_id(SSL *to, const SSL *from);

  1643. __owur X509 *SSL_SESSION_get0_peer(SSL_SESSION *s);

  1644. __owur int SSL_SESSION_set1_id_context(SSL_SESSION *s,

  1645.                                        const unsigned char *sid_ctx,

  1646.                                        unsigned int sid_ctx_len);

  1647. __owur int SSL_SESSION_set1_id(SSL_SESSION *s, const unsigned char *sid,

  1648.                                unsigned int sid_len);

  1649. __owur int SSL_SESSION_is_resumable(const SSL_SESSION *s);

  1650. 

  1651. __owur SSL_SESSION *SSL_SESSION_new(void);

  1652. __owur SSL_SESSION *SSL_SESSION_dup(SSL_SESSION *src);

  1653. const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,

  1654.                                         unsigned int *len);

  1655. const unsigned char *SSL_SESSION_get0_id_context(const SSL_SESSION *s,

  1656.                                                  unsigned int *len);

  1657. __owur unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s);

  1658. # ifndef OPENSSL_NO_STDIO

  1659. int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *ses);

  1660. # endif

  1661. int SSL_SESSION_print(BIO *fp, const SSL_SESSION *ses);

  1662. int SSL_SESSION_print_keylog(BIO *bp, const SSL_SESSION *x);

  1663. int SSL_SESSION_up_ref(SSL_SESSION *ses);

  1664. void SSL_SESSION_free(SSL_SESSION *ses);

  1665. __owur int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp);

  1666. __owur int SSL_set_session(SSL *to, SSL_SESSION *session);

  1667. int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *session);

  1668. int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *session);

  1669. __owur int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb);

  1670. __owur int SSL_set_generate_session_id(SSL *s, GEN_SESSION_CB cb);

  1671. __owur int SSL_has_matching_session_id(const SSL *s,

  1672.                                        const unsigned char *id,

  1673.                                        unsigned int id_len);

  1674. SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,

  1675.                              long length);

  1676. 

  1677. # ifdef HEADER_X509_H

  1678. __owur X509 *SSL_get_peer_certificate(const SSL *s);

  1679. # endif

  1680. 

  1681. __owur STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s);

  1682. 

  1683. __owur int SSL_CTX_get_verify_mode(const SSL_CTX *ctx);

  1684. __owur int SSL_CTX_get_verify_depth(const SSL_CTX *ctx);

  1685. __owur SSL_verify_cb SSL_CTX_get_verify_callback(const SSL_CTX *ctx);

  1686. void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, SSL_verify_cb callback);

  1687. void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth);

  1688. void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,

  1689.                                       int (*cb) (X509_STORE_CTX *, void *),

  1690.                                       void *arg);

  1691. void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg),

  1692.                          void *arg);

  1693. # ifndef OPENSSL_NO_RSA

  1694. __owur int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);

  1695. __owur int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d,

  1696.                                           long len);

  1697. # endif

  1698. __owur int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey);

  1699. __owur int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx,

  1700.                                        const unsigned char *d, long len);

  1701. __owur int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);

  1702. __owur int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len,

  1703.                                         const unsigned char *d);

  1704. __owur int SSL_CTX_use_cert_and_key(SSL_CTX *ctx, X509 *x509, EVP_PKEY *privatekey,

  1705.                                     STACK_OF(X509) *chain, int override);

  1706. 

  1707. void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb);

  1708. void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u);

  1709. pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx);

  1710. void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx);

  1711. void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb);

  1712. void SSL_set_default_passwd_cb_userdata(SSL *s, void *u);

  1713. pem_password_cb *SSL_get_default_passwd_cb(SSL *s);

  1714. void *SSL_get_default_passwd_cb_userdata(SSL *s);

  1715. 

  1716. __owur int SSL_CTX_check_private_key(const SSL_CTX *ctx);

  1717. __owur int SSL_check_private_key(const SSL *ctx);

  1718. 

  1719. __owur int SSL_CTX_set_session_id_context(SSL_CTX *ctx,

  1720.                                           const unsigned char *sid_ctx,

  1721.                                           unsigned int sid_ctx_len);

  1722. 

  1723. SSL *SSL_new(SSL_CTX *ctx);

  1724. int SSL_up_ref(SSL *s);

  1725. int SSL_is_dtls(const SSL *s);

  1726. __owur int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,

  1727.                                       unsigned int sid_ctx_len);

  1728. 

  1729. __owur int SSL_CTX_set_purpose(SSL_CTX *ctx, int purpose);

  1730. __owur int SSL_set_purpose(SSL *ssl, int purpose);

  1731. __owur int SSL_CTX_set_trust(SSL_CTX *ctx, int trust);

  1732. __owur int SSL_set_trust(SSL *ssl, int trust);

  1733. 

  1734. __owur int SSL_set1_host(SSL *s, const char *hostname);

  1735. __owur int SSL_add1_host(SSL *s, const char *hostname);

  1736. __owur const char *SSL_get0_peername(SSL *s);

  1737. void SSL_set_hostflags(SSL *s, unsigned int flags);

  1738. 

  1739. __owur int SSL_CTX_dane_enable(SSL_CTX *ctx);

  1740. __owur int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md,

  1741.                                   uint8_t mtype, uint8_t ord);

  1742. __owur int SSL_dane_enable(SSL *s, const char *basedomain);

  1743. __owur int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,

  1744.                              uint8_t mtype, unsigned const char *data, size_t dlen);

  1745. __owur int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki);

  1746. __owur int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector,

  1747.                               uint8_t *mtype, unsigned const char **data,

  1748.                               size_t *dlen);

  1749. /*

  1750.  * Bridge opacity barrier between libcrypt and libssl, also needed to support

  1751.  * offline testing in test/danetest.c

  1752.  */

  1753. SSL_DANE *SSL_get0_dane(SSL *ssl);

  1754. /*

  1755.  * DANE flags

  1756.  */

  1757. unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags);

  1758. unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags);

  1759. unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags);

  1760. unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags);

  1761. 

  1762. __owur int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm);

  1763. __owur int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm);

  1764. 

  1765. __owur X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx);

  1766. __owur X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl);

  1767. 

  1768. # ifndef OPENSSL_NO_SRP

  1769. int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name);

  1770. int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password);

  1771. int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength);

  1772. int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,

  1773.                                         char *(*cb) (SSL *, void *));

  1774. int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,

  1775.                                           int (*cb) (SSL *, void *));

  1776. int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,

  1777.                                       int (*cb) (SSL *, int *, void *));

  1778. int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg);

  1779. 

  1780. int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,

  1781.                              BIGNUM *sa, BIGNUM *v, char *info);

  1782. int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,

  1783.                                 const char *grp);

  1784. 

  1785. __owur BIGNUM *SSL_get_srp_g(SSL *s);

  1786. __owur BIGNUM *SSL_get_srp_N(SSL *s);

  1787. 

  1788. __owur char *SSL_get_srp_username(SSL *s);

  1789. __owur char *SSL_get_srp_userinfo(SSL *s);

  1790. # endif

  1791. 

  1792. /*

  1793.  * ClientHello callback and helpers.

  1794.  */

  1795. 

  1796. # define SSL_CLIENT_HELLO_SUCCESS 1

  1797. # define SSL_CLIENT_HELLO_ERROR   0

  1798. # define SSL_CLIENT_HELLO_RETRY   (-1)

  1799. 

  1800. typedef int (*SSL_client_hello_cb_fn) (SSL *s, int *al, void *arg);

  1801. void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb,

  1802.                                  void *arg);

  1803. int SSL_client_hello_isv2(SSL *s);

  1804. unsigned int SSL_client_hello_get0_legacy_version(SSL *s);

  1805. size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out);

  1806. size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out);

  1807. size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out);

  1808. size_t SSL_client_hello_get0_compression_methods(SSL *s,

  1809.                                                  const unsigned char **out);

  1810. int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen);

  1811. int SSL_client_hello_get0_ext(SSL *s, unsigned int type,

  1812.                               const unsigned char **out, size_t *outlen);

  1813. 

  1814. void SSL_certs_clear(SSL *s);

  1815. void SSL_free(SSL *ssl);

  1816. # ifdef OSSL_ASYNC_FD

  1817. /*

  1818.  * Windows application developer has to include windows.h to use these.

  1819.  */

  1820. __owur int SSL_waiting_for_async(SSL *s);

  1821. __owur int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds);

  1822. __owur int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd,

  1823.                                      size_t *numaddfds, OSSL_ASYNC_FD *delfd,

  1824.                                      size_t *numdelfds);

  1825. # endif

  1826. __owur int SSL_accept(SSL *ssl);

  1827. __owur int SSL_stateless(SSL *s);

  1828. __owur int SSL_connect(SSL *ssl);

  1829. __owur int SSL_read(SSL *ssl, void *buf, int num);

  1830. __owur int SSL_read_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes);

  1831. 

  1832. # define SSL_READ_EARLY_DATA_ERROR   0

  1833. # define SSL_READ_EARLY_DATA_SUCCESS 1

  1834. # define SSL_READ_EARLY_DATA_FINISH  2

  1835. 

  1836. __owur int SSL_read_early_data(SSL *s, void *buf, size_t num,

  1837.                                size_t *readbytes);

  1838. __owur int SSL_peek(SSL *ssl, void *buf, int num);

  1839. __owur int SSL_peek_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes);

  1840. __owur int SSL_write(SSL *ssl, const void *buf, int num);

  1841. __owur int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written);

  1842. __owur int SSL_write_early_data(SSL *s, const void *buf, size_t num,

  1843.                                 size_t *written);

  1844. long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg);

  1845. long SSL_callback_ctrl(SSL *, int, void (*)(void));

  1846. long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg);

  1847. long SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)(void));

  1848. 

  1849. # define SSL_EARLY_DATA_NOT_SENT    0

  1850. # define SSL_EARLY_DATA_REJECTED    1

  1851. # define SSL_EARLY_DATA_ACCEPTED    2

  1852. 

  1853. __owur int SSL_get_early_data_status(const SSL *s);

  1854. 

  1855. __owur int SSL_get_error(const SSL *s, int ret_code);

  1856. __owur const char *SSL_get_version(const SSL *s);

  1857. 

  1858. /* This sets the 'default' SSL version that SSL_new() will create */

  1859. __owur int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);

  1860. 

  1861. # ifndef OPENSSL_NO_SSL3_METHOD

  1862. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_method(void)) /* SSLv3 */

  1863. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_server_method(void))

  1864. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *SSLv3_client_method(void))

  1865. # endif

  1866. 

  1867. #define SSLv23_method           TLS_method

  1868. #define SSLv23_server_method    TLS_server_method

  1869. #define SSLv23_client_method    TLS_client_method

  1870. 

  1871. /* Negotiate highest available SSL/TLS version */

  1872. __owur const SSL_METHOD *TLS_method(void);

  1873. __owur const SSL_METHOD *TLS_server_method(void);

  1874. __owur const SSL_METHOD *TLS_client_method(void);

  1875. 

  1876. # ifndef OPENSSL_NO_TLS1_METHOD

  1877. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_method(void)) /* TLSv1.0 */

  1878. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_server_method(void))

  1879. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_client_method(void))

  1880. # endif

  1881. 

  1882. # ifndef OPENSSL_NO_TLS1_1_METHOD

  1883. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_1_method(void)) /* TLSv1.1 */

  1884. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_1_server_method(void))

  1885. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_1_client_method(void))

  1886. # endif

  1887. 

  1888. # ifndef OPENSSL_NO_TLS1_2_METHOD

  1889. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_method(void)) /* TLSv1.2 */

  1890. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_server_method(void))

  1891. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_client_method(void))

  1892. # endif

  1893. 

  1894. # ifndef OPENSSL_NO_DTLS1_METHOD

  1895. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_method(void)) /* DTLSv1.0 */

  1896. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_server_method(void))

  1897. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_client_method(void))

  1898. # endif

  1899. 

  1900. # ifndef OPENSSL_NO_DTLS1_2_METHOD

  1901. /* DTLSv1.2 */

  1902. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_2_method(void))

  1903. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_2_server_method(void))

  1904. DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *DTLSv1_2_client_method(void))

  1905. # endif

  1906. 

  1907. __owur const SSL_METHOD *DTLS_method(void); /* DTLS 1.0 and 1.2 */

  1908. __owur const SSL_METHOD *DTLS_server_method(void); /* DTLS 1.0 and 1.2 */

  1909. __owur const SSL_METHOD *DTLS_client_method(void); /* DTLS 1.0 and 1.2 */

  1910. 

  1911. __owur size_t DTLS_get_data_mtu(const SSL *s);

  1912. 

  1913. __owur STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s);

  1914. __owur STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx);

  1915. __owur STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s);

  1916. __owur STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s);

  1917. 

  1918. __owur int SSL_do_handshake(SSL *s);

  1919. int SSL_key_update(SSL *s, int updatetype);

  1920. int SSL_get_key_update_type(const SSL *s);

  1921. int SSL_renegotiate(SSL *s);

  1922. int SSL_renegotiate_abbreviated(SSL *s);

  1923. __owur int SSL_renegotiate_pending(const SSL *s);

  1924. int SSL_shutdown(SSL *s);

  1925. __owur int SSL_verify_client_post_handshake(SSL *s);

  1926. void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val);

  1927. void SSL_set_post_handshake_auth(SSL *s, int val);

  1928. 

  1929. __owur const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx);

  1930. __owur const SSL_METHOD *SSL_get_ssl_method(const SSL *s);

  1931. __owur int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method);

  1932. __owur const char *SSL_alert_type_string_long(int value);

  1933. __owur const char *SSL_alert_type_string(int value);

  1934. __owur const char *SSL_alert_desc_string_long(int value);

  1935. __owur const char *SSL_alert_desc_string(int value);

  1936. 

  1937. void SSL_set0_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list);

  1938. void SSL_CTX_set0_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list);

  1939. __owur const STACK_OF(X509_NAME) *SSL_get0_CA_list(const SSL *s);

  1940. __owur const STACK_OF(X509_NAME) *SSL_CTX_get0_CA_list(const SSL_CTX *ctx);

  1941. __owur int SSL_add1_to_CA_list(SSL *ssl, const X509 *x);

  1942. __owur int SSL_CTX_add1_to_CA_list(SSL_CTX *ctx, const X509 *x);

  1943. __owur const STACK_OF(X509_NAME) *SSL_get0_peer_CA_list(const SSL *s);

  1944. 

  1945. void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list);

  1946. void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list);

  1947. __owur STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s);

  1948. __owur STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *s);

  1949. __owur int SSL_add_client_CA(SSL *ssl, X509 *x);

  1950. __owur int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x);

  1951. 

  1952. void SSL_set_connect_state(SSL *s);

  1953. void SSL_set_accept_state(SSL *s);

  1954. 

  1955. __owur long SSL_get_default_timeout(const SSL *s);

  1956. 

  1957. # if OPENSSL_API_COMPAT < 0x10100000L

  1958. #  define SSL_library_init() OPENSSL_init_ssl(0, NULL)

  1959. # endif

  1960. 

  1961. __owur char *SSL_CIPHER_description(const SSL_CIPHER *, char *buf, int size);

  1962. __owur STACK_OF(X509_NAME) *SSL_dup_CA_list(const STACK_OF(X509_NAME) *sk);

  1963. 

  1964. __owur SSL *SSL_dup(SSL *ssl);

  1965. 

  1966. __owur X509 *SSL_get_certificate(const SSL *ssl);

  1967. /*

  1968.  * EVP_PKEY

  1969.  */

  1970. struct evp_pkey_st *SSL_get_privatekey(const SSL *ssl);

  1971. 

  1972. __owur X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx);

  1973. __owur EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx);

  1974. 

  1975. void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode);

  1976. __owur int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx);

  1977. void SSL_set_quiet_shutdown(SSL *ssl, int mode);

  1978. __owur int SSL_get_quiet_shutdown(const SSL *ssl);

  1979. void SSL_set_shutdown(SSL *ssl, int mode);

  1980. __owur int SSL_get_shutdown(const SSL *ssl);

  1981. __owur int SSL_version(const SSL *ssl);

  1982. __owur int SSL_client_version(const SSL *s);

  1983. __owur int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx);

  1984. __owur int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx);

  1985. __owur int SSL_CTX_set_default_verify_file(SSL_CTX *ctx);

  1986. __owur int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,

  1987.                                          const char *CApath);

  1988. # define SSL_get0_session SSL_get_session/* just peek at pointer */

  1989. __owur SSL_SESSION *SSL_get_session(const SSL *ssl);

  1990. __owur SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */

  1991. __owur SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl);

  1992. SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx);

  1993. void SSL_set_info_callback(SSL *ssl,

  1994.                            void (*cb) (const SSL *ssl, int type, int val));

  1995. void (*SSL_get_info_callback(const SSL *ssl)) (const SSL *ssl, int type,

  1996.                                                int val);

  1997. __owur OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl);

  1998. 

  1999. void SSL_set_verify_result(SSL *ssl, long v);

  2000. __owur long SSL_get_verify_result(const SSL *ssl);

  2001. __owur STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s);

  2002. 

  2003. __owur size_t SSL_get_client_random(const SSL *ssl, unsigned char *out,

  2004.                                     size_t outlen);

  2005. __owur size_t SSL_get_server_random(const SSL *ssl, unsigned char *out,

  2006.                                     size_t outlen);

  2007. __owur size_t SSL_SESSION_get_master_key(const SSL_SESSION *sess,

  2008.                                          unsigned char *out, size_t outlen);

  2009. __owur int SSL_SESSION_set1_master_key(SSL_SESSION *sess,

  2010.                                        const unsigned char *in, size_t len);

  2011. uint8_t SSL_SESSION_get_max_fragment_length(const SSL_SESSION *sess);

  2012. 

  2013. #define SSL_get_ex_new_index(l, p, newf, dupf, freef) \

  2014.     CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, l, p, newf, dupf, freef)

  2015. __owur int SSL_set_ex_data(SSL *ssl, int idx, void *data);

  2016. void *SSL_get_ex_data(const SSL *ssl, int idx);

  2017. #define SSL_SESSION_get_ex_new_index(l, p, newf, dupf, freef) \

  2018.     CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, l, p, newf, dupf, freef)

  2019. __owur int SSL_SESSION_set_ex_data(SSL_SESSION *ss, int idx, void *data);

  2020. void *SSL_SESSION_get_ex_data(const SSL_SESSION *ss, int idx);

  2021. #define SSL_CTX_get_ex_new_index(l, p, newf, dupf, freef) \

  2022.     CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, l, p, newf, dupf, freef)

  2023. __owur int SSL_CTX_set_ex_data(SSL_CTX *ssl, int idx, void *data);

  2024. void *SSL_CTX_get_ex_data(const SSL_CTX *ssl, int idx);

  2025. 

  2026. __owur int SSL_get_ex_data_X509_STORE_CTX_idx(void);

  2027. 

  2028. # define SSL_CTX_sess_set_cache_size(ctx,t) \

  2029.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_SIZE,t,NULL)

  2030. # define SSL_CTX_sess_get_cache_size(ctx) \

  2031.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_SIZE,0,NULL)

  2032. # define SSL_CTX_set_session_cache_mode(ctx,m) \

  2033.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL)

  2034. # define SSL_CTX_get_session_cache_mode(ctx) \

  2035.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL)

  2036. 

  2037. # define SSL_CTX_get_default_read_ahead(ctx) SSL_CTX_get_read_ahead(ctx)

  2038. # define SSL_CTX_set_default_read_ahead(ctx,m) SSL_CTX_set_read_ahead(ctx,m)

  2039. # define SSL_CTX_get_read_ahead(ctx) \

  2040.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_READ_AHEAD,0,NULL)

  2041. # define SSL_CTX_set_read_ahead(ctx,m) \

  2042.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_READ_AHEAD,m,NULL)

  2043. # define SSL_CTX_get_max_cert_list(ctx) \

  2044.         SSL_CTX_ctrl(ctx,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL)

  2045. # define SSL_CTX_set_max_cert_list(ctx,m) \

  2046.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL)

  2047. # define SSL_get_max_cert_list(ssl) \

  2048.         SSL_ctrl(ssl,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL)

  2049. # define SSL_set_max_cert_list(ssl,m) \

  2050.         SSL_ctrl(ssl,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL)

  2051. 

  2052. # define SSL_CTX_set_max_send_fragment(ctx,m) \

  2053.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL)

  2054. # define SSL_set_max_send_fragment(ssl,m) \

  2055.         SSL_ctrl(ssl,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL)

  2056. # define SSL_CTX_set_split_send_fragment(ctx,m) \

  2057.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SPLIT_SEND_FRAGMENT,m,NULL)

  2058. # define SSL_set_split_send_fragment(ssl,m) \

  2059.         SSL_ctrl(ssl,SSL_CTRL_SET_SPLIT_SEND_FRAGMENT,m,NULL)

  2060. # define SSL_CTX_set_max_pipelines(ctx,m) \

  2061.         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_PIPELINES,m,NULL)

  2062. # define SSL_set_max_pipelines(ssl,m) \

  2063.         SSL_ctrl(ssl,SSL_CTRL_SET_MAX_PIPELINES,m,NULL)

  2064. 

  2065. void SSL_CTX_set_default_read_buffer_len(SSL_CTX *ctx, size_t len);

  2066. void SSL_set_default_read_buffer_len(SSL *s, size_t len);

  2067. 

  2068. # ifndef OPENSSL_NO_DH

  2069. /* NB: the |keylength| is only applicable when is_export is true */

  2070. void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,

  2071.                                  DH *(*dh) (SSL *ssl, int is_export,

  2072.                                             int keylength));

  2073. void SSL_set_tmp_dh_callback(SSL *ssl,

  2074.                              DH *(*dh) (SSL *ssl, int is_export,

  2075.                                         int keylength));

  2076. # endif

  2077. 

  2078. __owur const COMP_METHOD *SSL_get_current_compression(const SSL *s);

  2079. __owur const COMP_METHOD *SSL_get_current_expansion(const SSL *s);

  2080. __owur const char *SSL_COMP_get_name(const COMP_METHOD *comp);

  2081. __owur const char *SSL_COMP_get0_name(const SSL_COMP *comp);

  2082. __owur int SSL_COMP_get_id(const SSL_COMP *comp);

  2083. STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);

  2084. __owur STACK_OF(SSL_COMP) *SSL_COMP_set0_compression_methods(STACK_OF(SSL_COMP)

  2085.                                                              *meths);

  2086. # if OPENSSL_API_COMPAT < 0x10100000L

  2087. #  define SSL_COMP_free_compression_methods() while(0) continue

  2088. # endif

  2089. __owur int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm);

  2090. 

  2091. const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr);

  2092. int SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c);

  2093. int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c);

  2094. int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len,

  2095.                              int isv2format, STACK_OF(SSL_CIPHER) **sk,

  2096.                              STACK_OF(SSL_CIPHER) **scsvs);

  2097. 

  2098. /* TLS extensions functions */

  2099. __owur int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);

  2100. 

  2101. __owur int SSL_set_session_ticket_ext_cb(SSL *s,

  2102.                                          tls_session_ticket_ext_cb_fn cb,

  2103.                                          void *arg);

  2104. 

  2105. /* Pre-shared secret session resumption functions */

  2106. __owur int SSL_set_session_secret_cb(SSL *s,

  2107.                                      tls_session_secret_cb_fn session_secret_cb,

  2108.                                      void *arg);

  2109. 

  2110. void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,

  2111.                                                 int (*cb) (SSL *ssl,

  2112.                                                            int

  2113.                                                            is_forward_secure));

  2114. 

  2115. void SSL_set_not_resumable_session_callback(SSL *ssl,

  2116.                                             int (*cb) (SSL *ssl,

  2117.                                                        int is_forward_secure));

  2118. 

  2119. void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,

  2120.                                          size_t (*cb) (SSL *ssl, int type,

  2121.                                                        size_t len, void *arg));

  2122. void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);

  2123. void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx);

  2124. int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size);

  2125. 

  2126. void SSL_set_record_padding_callback(SSL *ssl,

  2127.                                     size_t (*cb) (SSL *ssl, int type,

  2128.                                                   size_t len, void *arg));

  2129. void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg);

  2130. void *SSL_get_record_padding_callback_arg(const SSL *ssl);

  2131. int SSL_set_block_padding(SSL *ssl, size_t block_size);

  2132. 

  2133. int SSL_set_num_tickets(SSL *s, size_t num_tickets);

  2134. size_t SSL_get_num_tickets(const SSL *s);

  2135. int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets);

  2136. size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);

  2137. 

  2138. # if OPENSSL_API_COMPAT < 0x10100000L

  2139. #  define SSL_cache_hit(s) SSL_session_reused(s)

  2140. # endif

  2141. 

  2142. __owur int SSL_session_reused(const SSL *s);

  2143. __owur int SSL_is_server(const SSL *s);

  2144. 

  2145. __owur __owur SSL_CONF_CTX *SSL_CONF_CTX_new(void);

  2146. int SSL_CONF_CTX_finish(SSL_CONF_CTX *cctx);

  2147. void SSL_CONF_CTX_free(SSL_CONF_CTX *cctx);

  2148. unsigned int SSL_CONF_CTX_set_flags(SSL_CONF_CTX *cctx, unsigned int flags);

  2149. __owur unsigned int SSL_CONF_CTX_clear_flags(SSL_CONF_CTX *cctx,

  2150.                                              unsigned int flags);

  2151. __owur int SSL_CONF_CTX_set1_prefix(SSL_CONF_CTX *cctx, const char *pre);

  2152. 

  2153. void SSL_CONF_CTX_set_ssl(SSL_CONF_CTX *cctx, SSL *ssl);

  2154. void SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *cctx, SSL_CTX *ctx);

  2155. 

  2156. __owur int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value);

  2157. __owur int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv);

  2158. __owur int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd);

  2159. 

  2160. void SSL_add_ssl_module(void);

  2161. int SSL_config(SSL *s, const char *name);

  2162. int SSL_CTX_config(SSL_CTX *ctx, const char *name);

  2163. 

  2164. # ifndef OPENSSL_NO_SSL_TRACE

  2165. void SSL_trace(int write_p, int version, int content_type,

  2166.                const void *buf, size_t len, SSL *ssl, void *arg);

  2167. # endif

  2168. 

  2169. # ifndef OPENSSL_NO_SOCK

  2170. int DTLSv1_listen(SSL *s, BIO_ADDR *client);

  2171. # endif

  2172. 

  2173. # ifndef OPENSSL_NO_CT

  2174. 

  2175. /*

  2176.  * A callback for verifying that the received SCTs are sufficient.

  2177.  * Expected to return 1 if they are sufficient, otherwise 0.

  2178.  * May return a negative integer if an error occurs.

  2179.  * A connection should be aborted if the SCTs are deemed insufficient.

  2180.  */

  2181. typedef int (*ssl_ct_validation_cb)(const CT_POLICY_EVAL_CTX *ctx,

  2182.                                     const STACK_OF(SCT) *scts, void *arg);

  2183. 

  2184. /*

  2185.  * Sets a |callback| that is invoked upon receipt of ServerHelloDone to validate

  2186.  * the received SCTs.

  2187.  * If the callback returns a non-positive result, the connection is terminated.

  2188.  * Call this function before beginning a handshake.

  2189.  * If a NULL |callback| is provided, SCT validation is disabled.

  2190.  * |arg| is arbitrary userdata that will be passed to the callback whenever it

  2191.  * is invoked. Ownership of |arg| remains with the caller.

  2192.  *

  2193.  * NOTE: A side-effect of setting a CT callback is that an OCSP stapled response

  2194.  *       will be requested.

  2195.  */

  2196. int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,

  2197.                                    void *arg);

  2198. int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,

  2199.                                        ssl_ct_validation_cb callback,

  2200.                                        void *arg);

  2201. #define SSL_disable_ct(s) \

  2202.         ((void) SSL_set_validation_callback((s), NULL, NULL))

  2203. #define SSL_CTX_disable_ct(ctx) \

  2204.         ((void) SSL_CTX_set_validation_callback((ctx), NULL, NULL))

  2205. 

  2206. /*

  2207.  * The validation type enumerates the available behaviours of the built-in SSL

  2208.  * CT validation callback selected via SSL_enable_ct() and SSL_CTX_enable_ct().

  2209.  * The underlying callback is a static function in libssl.

  2210.  */

  2211. enum {

  2212.     SSL_CT_VALIDATION_PERMISSIVE = 0,

  2213.     SSL_CT_VALIDATION_STRICT

  2214. };

  2215. 

  2216. /*

  2217.  * Enable CT by setting up a callback that implements one of the built-in

  2218.  * validation variants.  The SSL_CT_VALIDATION_PERMISSIVE variant always

  2219.  * continues the handshake, the application can make appropriate decisions at

  2220.  * handshake completion.  The SSL_CT_VALIDATION_STRICT variant requires at

  2221.  * least one valid SCT, or else handshake termination will be requested.  The

  2222.  * handshake may continue anyway if SSL_VERIFY_NONE is in effect.

  2223.  */

  2224. int SSL_enable_ct(SSL *s, int validation_mode);

  2225. int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode);

  2226. 

  2227. /*

  2228.  * Report whether a non-NULL callback is enabled.

  2229.  */

  2230. int SSL_ct_is_enabled(const SSL *s);

  2231. int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx);

  2232. 

  2233. /* Gets the SCTs received from a connection */

  2234. const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s);

  2235. 

  2236. /*

  2237.  * Loads the CT log list from the default location.

  2238.  * If a CTLOG_STORE has previously been set using SSL_CTX_set_ctlog_store,

  2239.  * the log information loaded from this file will be appended to the

  2240.  * CTLOG_STORE.

  2241.  * Returns 1 on success, 0 otherwise.

  2242.  */

  2243. int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx);

  2244. 

  2245. /*

  2246.  * Loads the CT log list from the specified file path.

  2247.  * If a CTLOG_STORE has previously been set using SSL_CTX_set_ctlog_store,

  2248.  * the log information loaded from this file will be appended to the

  2249.  * CTLOG_STORE.

  2250.  * Returns 1 on success, 0 otherwise.

  2251.  */

  2252. int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path);

  2253. 

  2254. /*

  2255.  * Sets the CT log list used by all SSL connections created from this SSL_CTX.

  2256.  * Ownership of the CTLOG_STORE is transferred to the SSL_CTX.

  2257.  */

  2258. void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE *logs);

  2259. 

  2260. /*

  2261.  * Gets the CT log list used by all SSL connections created from this SSL_CTX.

  2262.  * This will be NULL unless one of the following functions has been called:

  2263.  * - SSL_CTX_set_default_ctlog_list_file

  2264.  * - SSL_CTX_set_ctlog_list_file

  2265.  * - SSL_CTX_set_ctlog_store

  2266.  */

  2267. const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx);

  2268. 

  2269. # endif /* OPENSSL_NO_CT */

  2270. 

  2271. /* What the "other" parameter contains in security callback */

  2272. /* Mask for type */

  2273. # define SSL_SECOP_OTHER_TYPE    0xffff0000

  2274. # define SSL_SECOP_OTHER_NONE    0

  2275. # define SSL_SECOP_OTHER_CIPHER  (1 << 16)

  2276. # define SSL_SECOP_OTHER_CURVE   (2 << 16)

  2277. # define SSL_SECOP_OTHER_DH      (3 << 16)

  2278. # define SSL_SECOP_OTHER_PKEY    (4 << 16)

  2279. # define SSL_SECOP_OTHER_SIGALG  (5 << 16)

  2280. # define SSL_SECOP_OTHER_CERT    (6 << 16)

  2281. 

  2282. /* Indicated operation refers to peer key or certificate */

  2283. # define SSL_SECOP_PEER          0x1000

  2284. 

  2285. /* Values for "op" parameter in security callback */

  2286. 

  2287. /* Called to filter ciphers */

  2288. /* Ciphers client supports */

  2289. # define SSL_SECOP_CIPHER_SUPPORTED      (1 | SSL_SECOP_OTHER_CIPHER)

  2290. /* Cipher shared by client/server */

  2291. # define SSL_SECOP_CIPHER_SHARED         (2 | SSL_SECOP_OTHER_CIPHER)

  2292. /* Sanity check of cipher server selects */

  2293. # define SSL_SECOP_CIPHER_CHECK          (3 | SSL_SECOP_OTHER_CIPHER)

  2294. /* Curves supported by client */

  2295. # define SSL_SECOP_CURVE_SUPPORTED       (4 | SSL_SECOP_OTHER_CURVE)

  2296. /* Curves shared by client/server */

  2297. # define SSL_SECOP_CURVE_SHARED          (5 | SSL_SECOP_OTHER_CURVE)

  2298. /* Sanity check of curve server selects */

  2299. # define SSL_SECOP_CURVE_CHECK           (6 | SSL_SECOP_OTHER_CURVE)

  2300. /* Temporary DH key */

  2301. # define SSL_SECOP_TMP_DH                (7 | SSL_SECOP_OTHER_PKEY)

  2302. /* SSL/TLS version */

  2303. # define SSL_SECOP_VERSION               (9 | SSL_SECOP_OTHER_NONE)

  2304. /* Session tickets */

  2305. # define SSL_SECOP_TICKET                (10 | SSL_SECOP_OTHER_NONE)

  2306. /* Supported signature algorithms sent to peer */

  2307. # define SSL_SECOP_SIGALG_SUPPORTED      (11 | SSL_SECOP_OTHER_SIGALG)

  2308. /* Shared signature algorithm */

  2309. # define SSL_SECOP_SIGALG_SHARED         (12 | SSL_SECOP_OTHER_SIGALG)

  2310. /* Sanity check signature algorithm allowed */

  2311. # define SSL_SECOP_SIGALG_CHECK          (13 | SSL_SECOP_OTHER_SIGALG)

  2312. /* Used to get mask of supported public key signature algorithms */

  2313. # define SSL_SECOP_SIGALG_MASK           (14 | SSL_SECOP_OTHER_SIGALG)

  2314. /* Use to see if compression is allowed */

  2315. # define SSL_SECOP_COMPRESSION           (15 | SSL_SECOP_OTHER_NONE)

  2316. /* EE key in certificate */

  2317. # define SSL_SECOP_EE_KEY                (16 | SSL_SECOP_OTHER_CERT)

  2318. /* CA key in certificate */

  2319. # define SSL_SECOP_CA_KEY                (17 | SSL_SECOP_OTHER_CERT)

  2320. /* CA digest algorithm in certificate */

  2321. # define SSL_SECOP_CA_MD                 (18 | SSL_SECOP_OTHER_CERT)

  2322. /* Peer EE key in certificate */

  2323. # define SSL_SECOP_PEER_EE_KEY           (SSL_SECOP_EE_KEY | SSL_SECOP_PEER)

  2324. /* Peer CA key in certificate */

  2325. # define SSL_SECOP_PEER_CA_KEY           (SSL_SECOP_CA_KEY | SSL_SECOP_PEER)

  2326. /* Peer CA digest algorithm in certificate */

  2327. # define SSL_SECOP_PEER_CA_MD            (SSL_SECOP_CA_MD | SSL_SECOP_PEER)

  2328. 

  2329. void SSL_set_security_level(SSL *s, int level);

  2330. __owur int SSL_get_security_level(const SSL *s);

  2331. void SSL_set_security_callback(SSL *s,

  2332.                                int (*cb) (const SSL *s, const SSL_CTX *ctx,

  2333.                                           int op, int bits, int nid,

  2334.                                           void *other, void *ex));

  2335. int (*SSL_get_security_callback(const SSL *s)) (const SSL *s,

  2336.                                                 const SSL_CTX *ctx, int op,

  2337.                                                 int bits, int nid, void *other,

  2338.                                                 void *ex);

  2339. void SSL_set0_security_ex_data(SSL *s, void *ex);

  2340. __owur void *SSL_get0_security_ex_data(const SSL *s);

  2341. 

  2342. void SSL_CTX_set_security_level(SSL_CTX *ctx, int level);

  2343. __owur int SSL_CTX_get_security_level(const SSL_CTX *ctx);

  2344. void SSL_CTX_set_security_callback(SSL_CTX *ctx,

  2345.                                    int (*cb) (const SSL *s, const SSL_CTX *ctx,

  2346.                                               int op, int bits, int nid,

  2347.                                               void *other, void *ex));

  2348. int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s,

  2349.                                                           const SSL_CTX *ctx,

  2350.                                                           int op, int bits,

  2351.                                                           int nid,

  2352.                                                           void *other,

  2353.                                                           void *ex);

  2354. void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex);

  2355. __owur void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx);

  2356. 

  2357. /* OPENSSL_INIT flag 0x010000 reserved for internal use */

  2358. # define OPENSSL_INIT_NO_LOAD_SSL_STRINGS    0x00100000L

  2359. # define OPENSSL_INIT_LOAD_SSL_STRINGS       0x00200000L

  2360. 

  2361. # define OPENSSL_INIT_SSL_DEFAULT \

  2362.         (OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS)

  2363. 

  2364. int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings);

  2365. 

  2366. # ifndef OPENSSL_NO_UNIT_TEST

  2367. __owur const struct openssl_ssl_test_functions *SSL_test_functions(void);

  2368. # endif

  2369. 

  2370. __owur int SSL_free_buffers(SSL *ssl);

  2371. __owur int SSL_alloc_buffers(SSL *ssl);

  2372. 

  2373. /* Status codes passed to the decrypt session ticket callback. Some of these

  2374.  * are for internal use only and are never passed to the callback. */

  2375. typedef int SSL_TICKET_STATUS;

  2376. 

  2377. /* Support for ticket appdata */

  2378. /* fatal error, malloc failure */

  2379. # define SSL_TICKET_FATAL_ERR_MALLOC 0

  2380. /* fatal error, either from parsing or decrypting the ticket */

  2381. # define SSL_TICKET_FATAL_ERR_OTHER  1

  2382. /* No ticket present */

  2383. # define SSL_TICKET_NONE             2

  2384. /* Empty ticket present */

  2385. # define SSL_TICKET_EMPTY            3

  2386. /* the ticket couldn't be decrypted */

  2387. # define SSL_TICKET_NO_DECRYPT       4

  2388. /* a ticket was successfully decrypted */

  2389. # define SSL_TICKET_SUCCESS          5

  2390. /* same as above but the ticket needs to be renewed */

  2391. # define SSL_TICKET_SUCCESS_RENEW    6

  2392. 

  2393. /* Return codes for the decrypt session ticket callback */

  2394. typedef int SSL_TICKET_RETURN;

  2395. 

  2396. /* An error occurred */

  2397. #define SSL_TICKET_RETURN_ABORT             0

  2398. /* Do not use the ticket, do not send a renewed ticket to the client */

  2399. #define SSL_TICKET_RETURN_IGNORE            1

  2400. /* Do not use the ticket, send a renewed ticket to the client */

  2401. #define SSL_TICKET_RETURN_IGNORE_RENEW      2

  2402. /* Use the ticket, do not send a renewed ticket to the client */

  2403. #define SSL_TICKET_RETURN_USE               3

  2404. /* Use the ticket, send a renewed ticket to the client */

  2405. #define SSL_TICKET_RETURN_USE_RENEW         4

  2406. 

  2407. typedef int (*SSL_CTX_generate_session_ticket_fn)(SSL *s, void *arg);

  2408. typedef SSL_TICKET_RETURN (*SSL_CTX_decrypt_session_ticket_fn)(SSL *s, SSL_SESSION *ss,

  2409.                                                                const unsigned char *keyname,

  2410.                                                                size_t keyname_length,

  2411.                                                                SSL_TICKET_STATUS status,

  2412.                                                                void *arg);

  2413. int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,

  2414.                                   SSL_CTX_generate_session_ticket_fn gen_cb,

  2415.                                   SSL_CTX_decrypt_session_ticket_fn dec_cb,

  2416.                                   void *arg);

  2417. int SSL_SESSION_set1_ticket_appdata(SSL_SESSION *ss, const void *data, size_t len);

  2418. int SSL_SESSION_get0_ticket_appdata(SSL_SESSION *ss, void **data, size_t *len);

  2419. 

  2420. extern const char SSL_version_str[];

  2421. 

  2422. typedef unsigned int (*DTLS_timer_cb)(SSL *s, unsigned int timer_us);

  2423. 

  2424. void DTLS_set_timer_cb(SSL *s, DTLS_timer_cb cb);

  2425. 

  2426. 

  2427. typedef int (*SSL_allow_early_data_cb_fn)(SSL *s, void *arg);

  2428. void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx,

  2429.                                      SSL_allow_early_data_cb_fn cb,

  2430.                                      void *arg);

  2431. void SSL_set_allow_early_data_cb(SSL *s,

  2432.                                  SSL_allow_early_data_cb_fn cb,

  2433.                                  void *arg);

  2434. 

  2435. # ifdef  __cplusplus

  2436. }

  2437. # endif

  2438. #endif