Updated OpenSSL, because Google Play complains about it's version
This commit is contained in:
Sergii Pylypenko
@@ -266,6 +266,9 @@ void BIO_clear_flags(BIO *b, int flags);
|
||||
#define BIO_RR_CONNECT 0x02
|
||||
/* Returned from the accept BIO when an accept would have blocked */
|
||||
#define BIO_RR_ACCEPT 0x03
|
||||
/* Returned from the SSL bio when the channel id retrieval code cannot find the
|
||||
* private key. */
|
||||
#define BIO_RR_SSL_CHANNEL_ID_LOOKUP 0x04
|
||||
|
||||
/* These are passed by the BIO callback */
|
||||
#define BIO_CB_FREE 0x01
|
||||
|
||||
@@ -538,6 +538,8 @@ BIGNUM *BN_mod_inverse(BIGNUM *ret,
|
||||
BIGNUM *BN_mod_sqrt(BIGNUM *ret,
|
||||
const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
|
||||
|
||||
void BN_consttime_swap(BN_ULONG swap, BIGNUM *a, BIGNUM *b, int nwords);
|
||||
|
||||
/* Deprecated versions */
|
||||
#ifndef OPENSSL_NO_DEPRECATED
|
||||
BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int safe,
|
||||
@@ -692,6 +694,10 @@ const BIGNUM *BN_get0_nist_prime_256(void);
|
||||
const BIGNUM *BN_get0_nist_prime_384(void);
|
||||
const BIGNUM *BN_get0_nist_prime_521(void);
|
||||
|
||||
int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range, const BIGNUM *priv,
|
||||
const unsigned char *message, size_t message_len,
|
||||
BN_CTX *ctx);
|
||||
|
||||
/* library internal functions */
|
||||
|
||||
#define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
|
||||
@@ -774,11 +780,20 @@ int RAND_pseudo_bytes(unsigned char *buf,int num);
|
||||
|
||||
#define bn_fix_top(a) bn_check_top(a)
|
||||
|
||||
#define bn_check_size(bn, bits) bn_wcheck_size(bn, ((bits+BN_BITS2-1))/BN_BITS2)
|
||||
#define bn_wcheck_size(bn, words) \
|
||||
do { \
|
||||
const BIGNUM *_bnum2 = (bn); \
|
||||
assert(words <= (_bnum2)->dmax && words >= (_bnum2)->top); \
|
||||
} while(0)
|
||||
|
||||
#else /* !BN_DEBUG */
|
||||
|
||||
#define bn_pollute(a)
|
||||
#define bn_check_top(a)
|
||||
#define bn_fix_top(a) bn_correct_top(a)
|
||||
#define bn_check_size(bn, bits)
|
||||
#define bn_wcheck_size(bn, words)
|
||||
|
||||
#endif
|
||||
|
||||
@@ -842,6 +857,7 @@ void ERR_load_BN_strings(void);
|
||||
#define BN_F_BN_EXP 123
|
||||
#define BN_F_BN_EXPAND2 108
|
||||
#define BN_F_BN_EXPAND_INTERNAL 120
|
||||
#define BN_F_BN_GENERATE_DSA_NONCE 140
|
||||
#define BN_F_BN_GF2M_MOD 131
|
||||
#define BN_F_BN_GF2M_MOD_EXP 132
|
||||
#define BN_F_BN_GF2M_MOD_MUL 133
|
||||
@@ -881,6 +897,7 @@ void ERR_load_BN_strings(void);
|
||||
#define BN_R_NOT_INITIALIZED 107
|
||||
#define BN_R_NO_INVERSE 108
|
||||
#define BN_R_NO_SOLUTION 116
|
||||
#define BN_R_PRIVATE_KEY_TOO_LARGE 117
|
||||
#define BN_R_P_IS_NOT_PRIME 112
|
||||
#define BN_R_TOO_MANY_ITERATIONS 113
|
||||
#define BN_R_TOO_MANY_TEMPORARY_VARIABLES 109
|
||||
|
||||
@@ -88,7 +88,7 @@ int BUF_MEM_grow_clean(BUF_MEM *str, size_t len);
|
||||
char * BUF_strdup(const char *str);
|
||||
char * BUF_strndup(const char *str, size_t siz);
|
||||
void * BUF_memdup(const void *data, size_t siz);
|
||||
void BUF_reverse(unsigned char *out, unsigned char *in, size_t siz);
|
||||
void BUF_reverse(unsigned char *out, const unsigned char *in, size_t siz);
|
||||
|
||||
/* safe string functions */
|
||||
size_t BUF_strlcpy(char *dst,const char *src,size_t siz);
|
||||
|
||||
@@ -96,6 +96,10 @@
|
||||
* faster variable sliding window method to
|
||||
* be used for all exponents.
|
||||
*/
|
||||
#define DSA_FLAG_NONCE_FROM_HASH 0x04 /* Causes the DSA nonce to be calculated
|
||||
from SHA512(private_key + H(message) +
|
||||
random). This strengthens DSA against a
|
||||
weak PRNG. */
|
||||
|
||||
/* If this flag is set the DSA method is FIPS compliant and can be used
|
||||
* in FIPS mode. This is set in the validated module method. If an
|
||||
@@ -130,8 +134,9 @@ struct dsa_method
|
||||
{
|
||||
const char *name;
|
||||
DSA_SIG * (*dsa_do_sign)(const unsigned char *dgst, int dlen, DSA *dsa);
|
||||
int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
|
||||
BIGNUM **rp);
|
||||
int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in,
|
||||
BIGNUM **kinvp, BIGNUM **rp,
|
||||
const unsigned char *dgst, int dlen);
|
||||
int (*dsa_do_verify)(const unsigned char *dgst, int dgst_len,
|
||||
DSA_SIG *sig, DSA *dsa);
|
||||
int (*dsa_mod_exp)(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
|
||||
@@ -317,6 +322,7 @@ void ERR_load_DSA_strings(void);
|
||||
#define DSA_R_MISSING_PARAMETERS 101
|
||||
#define DSA_R_MODULUS_TOO_LARGE 103
|
||||
#define DSA_R_NEED_NEW_SETUP_VALUES 110
|
||||
#define DSA_R_NONCE_CANNOT_BE_PRECOMPUTED 112
|
||||
#define DSA_R_NON_FIPS_DSA_METHOD 111
|
||||
#define DSA_R_NO_PARAMETERS_SET 107
|
||||
#define DSA_R_PARAMETER_ENCODING_ERROR 105
|
||||
|
||||
@@ -84,6 +84,8 @@ extern "C" {
|
||||
#endif
|
||||
|
||||
#define DTLS1_VERSION 0xFEFF
|
||||
#define DTLS_MAX_VERSION DTLS1_VERSION
|
||||
|
||||
#define DTLS1_BAD_VER 0x0100
|
||||
|
||||
#if 0
|
||||
@@ -284,4 +286,3 @@ typedef struct dtls1_record_data_st
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
||||
|
||||
@@ -5,6 +5,10 @@
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Avoid name clashes with other applications */
|
||||
#define os_toascii _openssl_os_toascii
|
||||
#define os_toebcdic _openssl_os_toebcdic
|
||||
@@ -16,4 +20,7 @@ extern const unsigned char os_toebcdic[256];
|
||||
void *ebcdic2ascii(void *dest, const void *srce, size_t count);
|
||||
void *ascii2ebcdic(void *dest, const void *srce, size_t count);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
||||
@@ -629,7 +629,7 @@ int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b, BN
|
||||
int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx);
|
||||
int EC_POINTs_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx);
|
||||
|
||||
/** Computes r = generator * n sum_{i=0}^num p[i] * m[i]
|
||||
/** Computes r = generator * n sum_{i=0}^{num-1} p[i] * m[i]
|
||||
* \param group underlying EC_GROUP object
|
||||
* \param r EC_POINT object for the result
|
||||
* \param n BIGNUM with the multiplier for the group generator (optional)
|
||||
@@ -819,6 +819,17 @@ void *EC_KEY_insert_key_method_data(EC_KEY *key, void *data,
|
||||
/* wrapper functions for the underlying EC_GROUP object */
|
||||
void EC_KEY_set_asn1_flag(EC_KEY *eckey, int asn1_flag);
|
||||
|
||||
/** Sets whether ECDSA operations with the given key will calculate their k
|
||||
* value from SHA512(private_key + message + random) in order to protect
|
||||
* against a weak PRNG.
|
||||
* \param on Whether to calculate k from a hash or not
|
||||
*/
|
||||
void EC_KEY_set_nonce_from_hash(EC_KEY *key, int on);
|
||||
|
||||
/** Returns the value of nonce_from_hash
|
||||
*/
|
||||
int EC_KEY_get_nonce_from_hash(const EC_KEY *key);
|
||||
|
||||
/** Creates a table of pre-computed multiples of the generator to
|
||||
* accelerate further EC_KEY operations.
|
||||
* \param key EC_KEY object
|
||||
|
||||
@@ -250,6 +250,7 @@ void ERR_load_ECDSA_strings(void);
|
||||
#define ECDSA_R_ERR_EC_LIB 102
|
||||
#define ECDSA_R_MISSING_PARAMETERS 103
|
||||
#define ECDSA_R_NEED_NEW_SETUP_VALUES 106
|
||||
#define ECDSA_R_NONCE_CANNOT_BE_PRECOMPUTED 108
|
||||
#define ECDSA_R_NON_FIPS_METHOD 107
|
||||
#define ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED 104
|
||||
#define ECDSA_R_SIGNATURE_MALLOC_FAILED 105
|
||||
|
||||
@@ -70,6 +70,15 @@
|
||||
#include <stdio.h>
|
||||
#include <ctype.h>
|
||||
#include <krb5.h>
|
||||
#ifdef OPENSSL_SYS_WIN32
|
||||
/* These can sometimes get redefined indirectly by krb5 header files
|
||||
* after they get undefed in ossl_typ.h
|
||||
*/
|
||||
#undef X509_NAME
|
||||
#undef X509_EXTENSIONS
|
||||
#undef OCSP_REQUEST
|
||||
#undef OCSP_RESPONSE
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
||||
@@ -7,6 +7,9 @@
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
typedef void (*block128_f)(const unsigned char in[16],
|
||||
unsigned char out[16],
|
||||
const void *key);
|
||||
@@ -133,3 +136,6 @@ typedef struct xts128_context XTS128_CONTEXT;
|
||||
|
||||
int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16],
|
||||
const unsigned char *inp, unsigned char *out, size_t len, int enc);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -90,6 +90,13 @@ extern "C" {
|
||||
#define OCSP_RESPID_KEY 0x400
|
||||
#define OCSP_NOTIME 0x800
|
||||
|
||||
#ifdef OPENSSL_SYS_WIN32
|
||||
/* Under Win32 these are defined in wincrypt.h */
|
||||
#undef OCSP_REQUEST
|
||||
#undef X509_NAME
|
||||
#undef OCSP_RESPONSE
|
||||
#endif
|
||||
|
||||
/* CertID ::= SEQUENCE {
|
||||
* hashAlgorithm AlgorithmIdentifier,
|
||||
* issuerNameHash OCTET STRING, -- Hash of Issuer's DN
|
||||
|
||||
@@ -1,322 +1,10 @@
|
||||
/* opensslconf.h */
|
||||
/* WARNING: Generated automatically from opensslconf.h.in by Configure. */
|
||||
|
||||
/* OpenSSL was configured with the following options: */
|
||||
#ifndef OPENSSL_DOING_MAKEDEPEND
|
||||
|
||||
|
||||
#ifndef OPENSSL_NO_CAMELLIA
|
||||
# define OPENSSL_NO_CAMELLIA
|
||||
// Auto-generated - DO NOT EDIT!
|
||||
#ifndef OPENSSL_SYS_TRUSTY
|
||||
#if defined(__LP64__)
|
||||
#include "opensslconf-64.h"
|
||||
#else
|
||||
#include "opensslconf-32.h"
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAPIENG
|
||||
# define OPENSSL_NO_CAPIENG
|
||||
#else
|
||||
#include "opensslconf-trusty.h"
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CAST
|
||||
# define OPENSSL_NO_CAST
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CMS
|
||||
# define OPENSSL_NO_CMS
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DTLS1
|
||||
# define OPENSSL_NO_DTLS1
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
|
||||
# define OPENSSL_NO_EC_NISTP_64_GCC_128
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_GMP
|
||||
# define OPENSSL_NO_GMP
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_GOST
|
||||
# define OPENSSL_NO_GOST
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_HEARTBEATS
|
||||
# define OPENSSL_NO_HEARTBEATS
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_IDEA
|
||||
# define OPENSSL_NO_IDEA
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_JPAKE
|
||||
# define OPENSSL_NO_JPAKE
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_KRB5
|
||||
# define OPENSSL_NO_KRB5
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_MD2
|
||||
# define OPENSSL_NO_MD2
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_MDC2
|
||||
# define OPENSSL_NO_MDC2
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RC5
|
||||
# define OPENSSL_NO_RC5
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RDRAND
|
||||
# define OPENSSL_NO_RDRAND
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RFC3779
|
||||
# define OPENSSL_NO_RFC3779
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_RSAX
|
||||
# define OPENSSL_NO_RSAX
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SCTP
|
||||
# define OPENSSL_NO_SCTP
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SEED
|
||||
# define OPENSSL_NO_SEED
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_SHA0
|
||||
# define OPENSSL_NO_SHA0
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_STATIC_ENGINE
|
||||
# define OPENSSL_NO_STATIC_ENGINE
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_STORE
|
||||
# define OPENSSL_NO_STORE
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_WHIRLPOOL
|
||||
# define OPENSSL_NO_WHIRLPOOL
|
||||
#endif
|
||||
|
||||
#endif /* OPENSSL_DOING_MAKEDEPEND */
|
||||
|
||||
#ifndef OPENSSL_THREADS
|
||||
# define OPENSSL_THREADS
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_DYNAMIC_ENGINE
|
||||
# define OPENSSL_NO_DYNAMIC_ENGINE
|
||||
#endif
|
||||
|
||||
/* The OPENSSL_NO_* macros are also defined as NO_* if the application
|
||||
asks for it. This is a transient feature that is provided for those
|
||||
who haven't had the time to do the appropriate changes in their
|
||||
applications. */
|
||||
#ifdef OPENSSL_ALGORITHM_DEFINES
|
||||
# if defined(OPENSSL_NO_CAMELLIA) && !defined(NO_CAMELLIA)
|
||||
# define NO_CAMELLIA
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_CAPIENG) && !defined(NO_CAPIENG)
|
||||
# define NO_CAPIENG
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_CAST) && !defined(NO_CAST)
|
||||
# define NO_CAST
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_CMS) && !defined(NO_CMS)
|
||||
# define NO_CMS
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_DTLS1) && !defined(NO_DTLS1)
|
||||
# define NO_DTLS1
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_EC_NISTP_64_GCC_128) && !defined(NO_EC_NISTP_64_GCC_128)
|
||||
# define NO_EC_NISTP_64_GCC_128
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_GMP) && !defined(NO_GMP)
|
||||
# define NO_GMP
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_GOST) && !defined(NO_GOST)
|
||||
# define NO_GOST
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_HEARTBEATS) && !defined(NO_HEARTBEATS)
|
||||
# define NO_HEARTBEATS
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_IDEA) && !defined(NO_IDEA)
|
||||
# define NO_IDEA
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_JPAKE) && !defined(NO_JPAKE)
|
||||
# define NO_JPAKE
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_KRB5) && !defined(NO_KRB5)
|
||||
# define NO_KRB5
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_MD2) && !defined(NO_MD2)
|
||||
# define NO_MD2
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_MDC2) && !defined(NO_MDC2)
|
||||
# define NO_MDC2
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_RC5) && !defined(NO_RC5)
|
||||
# define NO_RC5
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_RDRAND) && !defined(NO_RDRAND)
|
||||
# define NO_RDRAND
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_RFC3779) && !defined(NO_RFC3779)
|
||||
# define NO_RFC3779
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_RSAX) && !defined(NO_RSAX)
|
||||
# define NO_RSAX
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_SCTP) && !defined(NO_SCTP)
|
||||
# define NO_SCTP
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
|
||||
# define NO_SEED
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_SHA0) && !defined(NO_SHA0)
|
||||
# define NO_SHA0
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_STATIC_ENGINE) && !defined(NO_STATIC_ENGINE)
|
||||
# define NO_STATIC_ENGINE
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
|
||||
# define NO_STORE
|
||||
# endif
|
||||
# if defined(OPENSSL_NO_WHIRLPOOL) && !defined(NO_WHIRLPOOL)
|
||||
# define NO_WHIRLPOOL
|
||||
# endif
|
||||
#endif
|
||||
|
||||
/* crypto/opensslconf.h.in */
|
||||
|
||||
/* Generate 80386 code? */
|
||||
#undef I386_ONLY
|
||||
|
||||
#if !(defined(VMS) || defined(__VMS)) /* VMS uses logical names instead */
|
||||
#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
|
||||
#define ENGINESDIR "/usr/local/ssl/lib/engines"
|
||||
#define OPENSSLDIR "/usr/local/ssl"
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#undef OPENSSL_UNISTD
|
||||
#define OPENSSL_UNISTD <unistd.h>
|
||||
|
||||
#undef OPENSSL_EXPORT_VAR_AS_FUNCTION
|
||||
|
||||
#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
|
||||
#define IDEA_INT unsigned int
|
||||
#endif
|
||||
|
||||
#if defined(HEADER_MD2_H) && !defined(MD2_INT)
|
||||
#define MD2_INT unsigned int
|
||||
#endif
|
||||
|
||||
#if defined(HEADER_RC2_H) && !defined(RC2_INT)
|
||||
/* I need to put in a mod for the alpha - eay */
|
||||
#define RC2_INT unsigned int
|
||||
#endif
|
||||
|
||||
#if defined(HEADER_RC4_H)
|
||||
#if !defined(RC4_INT)
|
||||
/* using int types make the structure larger but make the code faster
|
||||
* on most boxes I have tested - up to %20 faster. */
|
||||
/*
|
||||
* I don't know what does "most" mean, but declaring "int" is a must on:
|
||||
* - Intel P6 because partial register stalls are very expensive;
|
||||
* - elder Alpha because it lacks byte load/store instructions;
|
||||
*/
|
||||
#define RC4_INT unsigned char
|
||||
#endif
|
||||
#if !defined(RC4_CHUNK)
|
||||
/*
|
||||
* This enables code handling data aligned at natural CPU word
|
||||
* boundary. See crypto/rc4/rc4_enc.c for further details.
|
||||
*/
|
||||
#define RC4_CHUNK unsigned long
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG)
|
||||
/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
|
||||
* %20 speed up (longs are 8 bytes, int's are 4). */
|
||||
#ifndef DES_LONG
|
||||
#define DES_LONG unsigned int
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
|
||||
#define CONFIG_HEADER_BN_H
|
||||
#define BN_LLONG
|
||||
|
||||
/* Should we define BN_DIV2W here? */
|
||||
|
||||
/* Only one for the following should be defined */
|
||||
#undef SIXTY_FOUR_BIT_LONG
|
||||
#undef SIXTY_FOUR_BIT
|
||||
#define THIRTY_TWO_BIT
|
||||
#endif
|
||||
|
||||
#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
|
||||
#define CONFIG_HEADER_RC4_LOCL_H
|
||||
/* if this is defined data[i] is used instead of *data, this is a %20
|
||||
* speedup on x86 */
|
||||
#undef RC4_INDEX
|
||||
#endif
|
||||
|
||||
#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
|
||||
#define CONFIG_HEADER_BF_LOCL_H
|
||||
#define BF_PTR
|
||||
#endif /* HEADER_BF_LOCL_H */
|
||||
|
||||
#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
|
||||
#define CONFIG_HEADER_DES_LOCL_H
|
||||
#ifndef DES_DEFAULT_OPTIONS
|
||||
/* the following is tweaked from a config script, that is why it is a
|
||||
* protected undef/define */
|
||||
#ifndef DES_PTR
|
||||
#undef DES_PTR
|
||||
#endif
|
||||
|
||||
/* This helps C compiler generate the correct code for multiple functional
|
||||
* units. It reduces register dependancies at the expense of 2 more
|
||||
* registers */
|
||||
#ifndef DES_RISC1
|
||||
#undef DES_RISC1
|
||||
#endif
|
||||
|
||||
#ifndef DES_RISC2
|
||||
#undef DES_RISC2
|
||||
#endif
|
||||
|
||||
#if defined(DES_RISC1) && defined(DES_RISC2)
|
||||
YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
|
||||
#endif
|
||||
|
||||
/* Unroll the inner loop, this sometimes helps, sometimes hinders.
|
||||
* Very mucy CPU dependant */
|
||||
#ifndef DES_UNROLL
|
||||
#define DES_UNROLL
|
||||
#endif
|
||||
|
||||
/* These default values were supplied by
|
||||
* Peter Gutman <pgut001@cs.auckland.ac.nz>
|
||||
* They are only used if nothing else has been defined */
|
||||
#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)
|
||||
/* Special defines which change the way the code is built depending on the
|
||||
CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find
|
||||
even newer MIPS CPU's, but at the moment one size fits all for
|
||||
optimization options. Older Sparc's work better with only UNROLL, but
|
||||
there's no way to tell at compile time what it is you're running on */
|
||||
|
||||
#if defined( sun ) /* Newer Sparc's */
|
||||
# define DES_PTR
|
||||
# define DES_RISC1
|
||||
# define DES_UNROLL
|
||||
#elif defined( __ultrix ) /* Older MIPS */
|
||||
# define DES_PTR
|
||||
# define DES_RISC2
|
||||
# define DES_UNROLL
|
||||
#elif defined( __osf1__ ) /* Alpha */
|
||||
# define DES_PTR
|
||||
# define DES_RISC2
|
||||
#elif defined ( _AIX ) /* RS6000 */
|
||||
/* Unknown */
|
||||
#elif defined( __hpux ) /* HP-PA */
|
||||
/* Unknown */
|
||||
#elif defined( __aux ) /* 68K */
|
||||
/* Unknown */
|
||||
#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */
|
||||
# define DES_UNROLL
|
||||
#elif defined( __sgi ) /* Newer MIPS */
|
||||
# define DES_PTR
|
||||
# define DES_RISC2
|
||||
# define DES_UNROLL
|
||||
#elif defined(i386) || defined(__i386__) /* x86 boxes, should be gcc */
|
||||
# define DES_PTR
|
||||
# define DES_RISC1
|
||||
# define DES_UNROLL
|
||||
#endif /* Systems-specific speed defines */
|
||||
#endif
|
||||
|
||||
#endif /* DES_DEFAULT_OPTIONS */
|
||||
#endif /* HEADER_DES_LOCL_H */
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
#ifndef HEADER_OPENSSLV_H
|
||||
#define HEADER_OPENSSLV_H
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Numeric release version identifier:
|
||||
* MNNFFPPS: major minor fix patch status
|
||||
* The status nibble has one of the values 0 for development, 1 to e for betas
|
||||
@@ -25,11 +29,11 @@
|
||||
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
|
||||
* major minor fix final patch/beta)
|
||||
*/
|
||||
#define OPENSSL_VERSION_NUMBER 0x1000105fL
|
||||
#define OPENSSL_VERSION_NUMBER 0x100010afL
|
||||
#ifdef OPENSSL_FIPS
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1e-fips 11 Feb 2013"
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j-fips 15 Oct 2014"
|
||||
#else
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1e 11 Feb 2013"
|
||||
#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1j 15 Oct 2014"
|
||||
#endif
|
||||
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
|
||||
|
||||
@@ -86,4 +90,7 @@
|
||||
#define SHLIB_VERSION_NUMBER "1.0.0"
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif /* HEADER_OPENSSLV_H */
|
||||
|
||||
@@ -55,6 +55,10 @@
|
||||
#ifndef HEADER_OPENSSL_TYPES_H
|
||||
#define HEADER_OPENSSL_TYPES_H
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#include <openssl/e_os2.h>
|
||||
|
||||
#ifdef NO_ASN1_TYPEDEFS
|
||||
@@ -199,4 +203,7 @@ typedef struct ocsp_req_ctx_st OCSP_REQ_CTX;
|
||||
typedef struct ocsp_response_st OCSP_RESPONSE;
|
||||
typedef struct ocsp_responder_id_st OCSP_RESPID;
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif /* def HEADER_OPENSSL_TYPES_H */
|
||||
|
||||
@@ -233,10 +233,6 @@ DECLARE_PKCS12_STACK_OF(PKCS7)
|
||||
(OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped)
|
||||
#define PKCS7_type_is_data(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_data)
|
||||
#define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest)
|
||||
#define PKCS7_type_is_encrypted(a) \
|
||||
(OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted)
|
||||
|
||||
#define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest)
|
||||
|
||||
#define PKCS7_set_detached(p,v) \
|
||||
PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL)
|
||||
@@ -453,6 +449,7 @@ void ERR_load_PKCS7_strings(void);
|
||||
#define PKCS7_R_ERROR_SETTING_CIPHER 121
|
||||
#define PKCS7_R_INVALID_MIME_TYPE 131
|
||||
#define PKCS7_R_INVALID_NULL_POINTER 143
|
||||
#define PKCS7_R_INVALID_SIGNED_DATA_TYPE 155
|
||||
#define PKCS7_R_MIME_NO_CONTENT_TYPE 132
|
||||
#define PKCS7_R_MIME_PARSE_ERROR 133
|
||||
#define PKCS7_R_MIME_SIG_PARSE_ERROR 134
|
||||
|
||||
@@ -64,6 +64,9 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
typedef struct _pqueue *pqueue;
|
||||
|
||||
typedef struct _pitem
|
||||
@@ -91,4 +94,7 @@ pitem *pqueue_next(piterator *iter);
|
||||
void pqueue_print(pqueue pq);
|
||||
int pqueue_size(pqueue pq);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif /* ! HEADER_PQUEUE_H */
|
||||
|
||||
@@ -138,6 +138,7 @@ void ERR_load_RAND_strings(void);
|
||||
#define RAND_F_SSLEAY_RAND_BYTES 100
|
||||
|
||||
/* Reason codes. */
|
||||
#define RAND_R_DUAL_EC_DRBG_DISABLED 104
|
||||
#define RAND_R_ERROR_INITIALISING_DRBG 102
|
||||
#define RAND_R_ERROR_INSTANTIATING_DRBG 103
|
||||
#define RAND_R_NO_FIPS_RANDOM_METHOD_SET 101
|
||||
|
||||
@@ -559,6 +559,7 @@ void ERR_load_RSA_strings(void);
|
||||
#define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE 158
|
||||
#define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 148
|
||||
#define RSA_R_PADDING_CHECK_FAILED 114
|
||||
#define RSA_R_PKCS_DECODING_ERROR 159
|
||||
#define RSA_R_P_NOT_PRIME 128
|
||||
#define RSA_R_Q_NOT_PRIME 129
|
||||
#define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED 130
|
||||
|
||||
@@ -57,6 +57,10 @@
|
||||
|
||||
#include <openssl/stack.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#ifndef CHECKED_PTR_OF
|
||||
#define CHECKED_PTR_OF(type, p) \
|
||||
((void*) (1 ? p : (type*)0))
|
||||
@@ -2660,4 +2664,8 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
|
||||
#define lh_SSL_SESSION_free(lh) LHM_lh_free(SSL_SESSION,lh)
|
||||
/* End of util/mkstack.pl block, you may now edit :-) */
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif /* !defined HEADER_SAFESTACK_H */
|
||||
|
||||
@@ -130,6 +130,8 @@ extern "C" {
|
||||
#define SRTP_NULL_SHA1_80 0x0005
|
||||
#define SRTP_NULL_SHA1_32 0x0006
|
||||
|
||||
#ifndef OPENSSL_NO_SRTP
|
||||
|
||||
int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles);
|
||||
int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles);
|
||||
SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s);
|
||||
@@ -137,6 +139,8 @@ SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s);
|
||||
STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl);
|
||||
SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s);
|
||||
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -264,6 +264,7 @@ extern "C" {
|
||||
#define SSL_TXT_aGOST94 "aGOST94"
|
||||
#define SSL_TXT_aGOST01 "aGOST01"
|
||||
#define SSL_TXT_aGOST "aGOST"
|
||||
#define SSL_TXT_aSRP "aSRP"
|
||||
|
||||
#define SSL_TXT_DSS "DSS"
|
||||
#define SSL_TXT_DH "DH"
|
||||
@@ -544,6 +545,13 @@ struct ssl_session_st
|
||||
#ifndef OPENSSL_NO_SRP
|
||||
char *srp_username;
|
||||
#endif
|
||||
|
||||
/* original_handshake_hash contains the handshake hash (either
|
||||
* SHA-1+MD5 or SHA-2, depending on TLS version) for the original, full
|
||||
* handshake that created a session. This is used by Channel IDs during
|
||||
* resumption. */
|
||||
unsigned char original_handshake_hash[EVP_MAX_MD_SIZE];
|
||||
unsigned int original_handshake_hash_len;
|
||||
};
|
||||
|
||||
#endif
|
||||
@@ -553,18 +561,27 @@ struct ssl_session_st
|
||||
/* Allow initial connection to servers that don't support RI */
|
||||
#define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004L
|
||||
#define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x00000008L
|
||||
#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x00000010L
|
||||
#define SSL_OP_TLSEXT_PADDING 0x00000010L
|
||||
#define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L
|
||||
#define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x00000040L /* no effect since 0.9.7h and 0.9.8b */
|
||||
#define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x00000040L
|
||||
#define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x00000080L
|
||||
#define SSL_OP_TLS_D5_BUG 0x00000100L
|
||||
#define SSL_OP_TLS_BLOCK_PADDING_BUG 0x00000200L
|
||||
|
||||
/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
|
||||
* in OpenSSL 0.9.6d. Usually (depending on the application protocol)
|
||||
* the workaround is not needed. Unfortunately some broken SSL/TLS
|
||||
* implementations cannot handle it at all, which is why we include
|
||||
* it in SSL_OP_ALL. */
|
||||
/* Hasn't done anything since OpenSSL 0.9.7h, retained for compatibility */
|
||||
#define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x0
|
||||
/* Refers to ancient SSLREF and SSLv2, retained for compatibility */
|
||||
#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x0
|
||||
|
||||
/* SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS is vestigial. Previously it disabled the
|
||||
* insertion of empty records in CBC mode, but the empty records were commonly
|
||||
* misinterpreted as EOF by other TLS stacks and so this was disabled by
|
||||
* SSL_OP_ALL.
|
||||
*
|
||||
* This has been replaced by 1/n-1 record splitting, which is enabled by
|
||||
* SSL_MODE_CBC_RECORD_SPLITTING in SSL_set_mode. This involves sending a
|
||||
* one-byte record rather than an empty record and has much better
|
||||
* compatibility. */
|
||||
#define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 0x00000800L /* added in 0.9.6e */
|
||||
|
||||
/* SSL_OP_ALL: various bug workarounds that should be rather harmless.
|
||||
@@ -641,10 +658,28 @@ struct ssl_session_st
|
||||
* TLS only.) "Released" buffers are put onto a free-list in the context
|
||||
* or just freed (depending on the context's setting for freelist_max_len). */
|
||||
#define SSL_MODE_RELEASE_BUFFERS 0x00000010L
|
||||
|
||||
/* Send the current time in the Random fields of the ClientHello and
|
||||
* ServerHello records for compatibility with hypothetical implementations
|
||||
* that require it.
|
||||
*/
|
||||
#define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
|
||||
#define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
|
||||
/* Send TLS_FALLBACK_SCSV in the ClientHello.
|
||||
* To be set by applications that reconnect with a downgraded protocol
|
||||
* version; see draft-ietf-tls-downgrade-scsv-00 for details. */
|
||||
#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
|
||||
|
||||
/* When set, clients may send application data before receipt of CCS
|
||||
* and Finished. This mode enables full-handshakes to 'complete' in
|
||||
* one RTT. */
|
||||
#define SSL_MODE_HANDSHAKE_CUTTHROUGH 0x00000020L
|
||||
#define SSL_MODE_HANDSHAKE_CUTTHROUGH 0x00000200L
|
||||
|
||||
/* When set, TLS 1.0 and SSLv3, multi-byte, CBC records will be split in two:
|
||||
* the first record will contain a single byte and the second will contain the
|
||||
* rest of the bytes. This effectively randomises the IV and prevents BEAST
|
||||
* attacks. */
|
||||
#define SSL_MODE_CBC_RECORD_SPLITTING 0x00000100L
|
||||
|
||||
/* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
|
||||
* they cannot be used to clear bits. */
|
||||
@@ -848,6 +883,9 @@ struct ssl_ctx_st
|
||||
/* get client cert callback */
|
||||
int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
|
||||
|
||||
/* get channel id callback */
|
||||
void (*channel_id_cb)(SSL *ssl, EVP_PKEY **pkey);
|
||||
|
||||
/* cookie generate callback */
|
||||
int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie,
|
||||
unsigned int *cookie_len);
|
||||
@@ -910,7 +948,7 @@ struct ssl_ctx_st
|
||||
*/
|
||||
unsigned int max_send_fragment;
|
||||
|
||||
#ifndef OPENSSL_ENGINE
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
/* Engine to pass requests for client certs to
|
||||
*/
|
||||
ENGINE *client_cert_engine;
|
||||
@@ -1010,6 +1048,10 @@ struct ssl_ctx_st
|
||||
/* If true, a client will advertise the Channel ID extension and a
|
||||
* server will echo it. */
|
||||
char tlsext_channel_id_enabled;
|
||||
/* tlsext_channel_id_enabled_new is a hack to support both old and new
|
||||
* ChannelID signatures. It indicates that a client should advertise the
|
||||
* new ChannelID extension number. */
|
||||
char tlsext_channel_id_enabled_new;
|
||||
/* The client's Channel ID private key. */
|
||||
EVP_PKEY *tlsext_channel_id_private;
|
||||
#endif
|
||||
@@ -1068,6 +1110,8 @@ void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl,int type,
|
||||
void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val);
|
||||
void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
|
||||
int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
|
||||
void SSL_CTX_set_channel_id_cb(SSL_CTX *ctx, void (*channel_id_cb)(SSL *ssl, EVP_PKEY **pkey));
|
||||
void (*SSL_CTX_get_channel_id_cb(SSL_CTX *ctx))(SSL *ssl, EVP_PKEY **pkey);
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e);
|
||||
#endif
|
||||
@@ -1144,12 +1188,14 @@ const char *SSL_get_psk_identity(const SSL *s);
|
||||
#define SSL_WRITING 2
|
||||
#define SSL_READING 3
|
||||
#define SSL_X509_LOOKUP 4
|
||||
#define SSL_CHANNEL_ID_LOOKUP 5
|
||||
|
||||
/* These will only be used when doing non-blocking IO */
|
||||
#define SSL_want_nothing(s) (SSL_want(s) == SSL_NOTHING)
|
||||
#define SSL_want_read(s) (SSL_want(s) == SSL_READING)
|
||||
#define SSL_want_write(s) (SSL_want(s) == SSL_WRITING)
|
||||
#define SSL_want_x509_lookup(s) (SSL_want(s) == SSL_X509_LOOKUP)
|
||||
#define SSL_want_channel_id_lookup(s) (SSL_want(s) == SSL_CHANNEL_ID_LOOKUP)
|
||||
|
||||
#define SSL_MAC_FLAG_READ_MAC_STREAM 1
|
||||
#define SSL_MAC_FLAG_WRITE_MAC_STREAM 2
|
||||
@@ -1297,6 +1343,10 @@ struct ssl_st
|
||||
#endif /* OPENSSL_NO_KRB5 */
|
||||
|
||||
#ifndef OPENSSL_NO_PSK
|
||||
/* PSK identity hint is stored here only to enable setting a hint on an SSL object before an
|
||||
* SSL_SESSION is associated with it. Once an SSL_SESSION is associated with this SSL object,
|
||||
* the psk_identity_hint from the session takes precedence over this one. */
|
||||
char *psk_identity_hint;
|
||||
unsigned int (*psk_client_callback)(SSL *ssl, const char *hint, char *identity,
|
||||
unsigned int max_identity_len, unsigned char *psk,
|
||||
unsigned int max_psk_len);
|
||||
@@ -1570,6 +1620,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
|
||||
#define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
|
||||
#define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
|
||||
#define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
|
||||
#define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
|
||||
|
||||
#define SSL_ERROR_NONE 0
|
||||
#define SSL_ERROR_SSL 1
|
||||
@@ -1580,6 +1631,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
|
||||
#define SSL_ERROR_ZERO_RETURN 6
|
||||
#define SSL_ERROR_WANT_CONNECT 7
|
||||
#define SSL_ERROR_WANT_ACCEPT 8
|
||||
#define SSL_ERROR_WANT_CHANNEL_ID_LOOKUP 9
|
||||
|
||||
#define SSL_CTRL_NEED_TMP_RSA 1
|
||||
#define SSL_CTRL_SET_TMP_RSA 2
|
||||
@@ -1683,6 +1735,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
|
||||
#define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82
|
||||
#define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83
|
||||
|
||||
#define SSL_CTRL_CHECK_PROTO_VERSION 119
|
||||
|
||||
#define DTLSv1_get_timeout(ssl, arg) \
|
||||
SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
|
||||
#define DTLSv1_handle_timeout(ssl) \
|
||||
@@ -1717,10 +1771,11 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
|
||||
#define SSL_set_tmp_ecdh(ssl,ecdh) \
|
||||
SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
|
||||
|
||||
/* SSL_enable_tls_channel_id configures a TLS server to accept TLS client
|
||||
* IDs from clients. Returns 1 on success. */
|
||||
#define SSL_enable_tls_channel_id(ctx) \
|
||||
SSL_ctrl(ctx,SSL_CTRL_CHANNEL_ID,0,NULL)
|
||||
/* SSL_enable_tls_channel_id either configures a TLS server to accept TLS client
|
||||
* IDs from clients, or configure a client to send TLS client IDs to server.
|
||||
* Returns 1 on success. */
|
||||
#define SSL_enable_tls_channel_id(s) \
|
||||
SSL_ctrl(s,SSL_CTRL_CHANNEL_ID,0,NULL)
|
||||
/* SSL_set1_tls_channel_id configures a TLS client to send a TLS Channel ID to
|
||||
* compatible servers. private_key must be a P-256 EVP_PKEY*. Returns 1 on
|
||||
* success. */
|
||||
@@ -1770,7 +1825,7 @@ int SSL_CIPHER_get_bits(const SSL_CIPHER *c,int *alg_bits);
|
||||
char * SSL_CIPHER_get_version(const SSL_CIPHER *c);
|
||||
const char * SSL_CIPHER_get_name(const SSL_CIPHER *c);
|
||||
unsigned long SSL_CIPHER_get_id(const SSL_CIPHER *c);
|
||||
const char* SSL_CIPHER_authentication_method(const SSL_CIPHER* cipher);
|
||||
const char * SSL_CIPHER_authentication_method(const SSL_CIPHER* cipher);
|
||||
|
||||
int SSL_get_fd(const SSL *s);
|
||||
int SSL_get_rfd(const SSL *s);
|
||||
@@ -2144,6 +2199,10 @@ int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secre
|
||||
void SSL_set_debug(SSL *s, int debug);
|
||||
int SSL_cache_hit(SSL *s);
|
||||
|
||||
#ifndef OPENSSL_NO_UNIT_TEST
|
||||
const struct openssl_ssl_test_functions *SSL_test_functions(void);
|
||||
#endif
|
||||
|
||||
/* BEGIN ERROR CODES */
|
||||
/* The following lines are auto generated by the script mkerr.pl. Any changes
|
||||
* made after this point may be overwritten when the script is next run.
|
||||
@@ -2412,6 +2471,7 @@ void ERR_load_SSL_strings(void);
|
||||
#define SSL_R_BAD_SRP_B_LENGTH 348
|
||||
#define SSL_R_BAD_SRP_G_LENGTH 349
|
||||
#define SSL_R_BAD_SRP_N_LENGTH 350
|
||||
#define SSL_R_BAD_SRP_PARAMETERS 371
|
||||
#define SSL_R_BAD_SRP_S_LENGTH 351
|
||||
#define SSL_R_BAD_SRTP_MKI_VALUE 352
|
||||
#define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST 353
|
||||
@@ -2472,6 +2532,7 @@ void ERR_load_SSL_strings(void);
|
||||
#define SSL_R_HTTPS_PROXY_REQUEST 155
|
||||
#define SSL_R_HTTP_REQUEST 156
|
||||
#define SSL_R_ILLEGAL_PADDING 283
|
||||
#define SSL_R_INAPPROPRIATE_FALLBACK 373
|
||||
#define SSL_R_INCONSISTENT_COMPRESSION 340
|
||||
#define SSL_R_INVALID_CHALLENGE_LENGTH 158
|
||||
#define SSL_R_INVALID_COMMAND 280
|
||||
@@ -2531,7 +2592,7 @@ void ERR_load_SSL_strings(void);
|
||||
#define SSL_R_NO_COMPRESSION_SPECIFIED 187
|
||||
#define SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER 330
|
||||
#define SSL_R_NO_METHOD_SPECIFIED 188
|
||||
#define SSL_R_NO_P256_SUPPORT 373
|
||||
#define SSL_R_NO_P256_SUPPORT 380
|
||||
#define SSL_R_NO_PRIVATEKEY 189
|
||||
#define SSL_R_NO_PRIVATE_KEY_ASSIGNED 190
|
||||
#define SSL_R_NO_PROTOCOLS_AVAILABLE 191
|
||||
@@ -2621,6 +2682,7 @@ void ERR_load_SSL_strings(void);
|
||||
#define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021
|
||||
#define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051
|
||||
#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060
|
||||
#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086
|
||||
#define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071
|
||||
#define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080
|
||||
#define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100
|
||||
|
||||
@@ -128,9 +128,14 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */
|
||||
/* Signalling cipher suite value from RFC 5746
|
||||
* (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */
|
||||
#define SSL3_CK_SCSV 0x030000FF
|
||||
|
||||
/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00
|
||||
* (TLS_FALLBACK_SCSV) */
|
||||
#define SSL3_CK_FALLBACK_SCSV 0x03005600
|
||||
|
||||
#define SSL3_CK_RSA_NULL_MD5 0x03000001
|
||||
#define SSL3_CK_RSA_NULL_SHA 0x03000002
|
||||
#define SSL3_CK_RSA_RC4_40_MD5 0x03000003
|
||||
@@ -388,6 +393,7 @@ typedef struct ssl3_buffer_st
|
||||
#define TLS1_FLAGS_TLS_PADDING_BUG 0x0008
|
||||
#define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010
|
||||
#define TLS1_FLAGS_KEEP_HANDSHAKE 0x0020
|
||||
#define SSL3_FLAGS_CCS_OK 0x0080
|
||||
|
||||
/* SSL3_FLAGS_SGC_RESTART_DONE is set when we
|
||||
* restart a handshake because of MS SGC and so prevents us
|
||||
@@ -418,8 +424,8 @@ typedef struct ssl3_state_st
|
||||
unsigned char client_random[SSL3_RANDOM_SIZE];
|
||||
|
||||
/* flags for countermeasure against known-IV weakness */
|
||||
int need_empty_fragments;
|
||||
int empty_fragment_done;
|
||||
int need_record_splitting;
|
||||
int record_split_done;
|
||||
|
||||
/* The value of 'extra' when the buffers were initialized */
|
||||
int init_extra;
|
||||
@@ -540,11 +546,25 @@ typedef struct ssl3_state_st
|
||||
int next_proto_neg_seen;
|
||||
#endif
|
||||
|
||||
#ifndef OPENSSL_NO_TLSEXT
|
||||
#ifndef OPENSSL_NO_EC
|
||||
/* This is set to true if we believe that this is a version of Safari
|
||||
* running on OS X 10.6 or newer. We wish to know this because Safari
|
||||
* on 10.8 .. 10.8.3 has broken ECDHE-ECDSA support. */
|
||||
char is_probably_safari;
|
||||
#endif /* !OPENSSL_NO_EC */
|
||||
#endif /* !OPENSSL_NO_TLSEXT */
|
||||
|
||||
/* In a client, this means that the server supported Channel ID and that
|
||||
* a Channel ID was sent. In a server it means that we echoed support
|
||||
* for Channel IDs and that tlsext_channel_id will be valid after the
|
||||
* handshake. */
|
||||
char tlsext_channel_id_valid;
|
||||
/* tlsext_channel_id_new means that the updated Channel ID extension
|
||||
* was negotiated. This is a temporary hack in the code to support both
|
||||
* forms of Channel ID extension while we transition to the new format,
|
||||
* which fixed a security issue. */
|
||||
char tlsext_channel_id_new;
|
||||
/* For a server:
|
||||
* If |tlsext_channel_id_valid| is true, then this contains the
|
||||
* verified Channel ID from the client: a P256 point, (x,y), where
|
||||
@@ -665,11 +685,11 @@ typedef struct ssl3_state_st
|
||||
#define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_POST_CLIENT_CERT (0x1BF|SSL_ST_ACCEPT)
|
||||
#ifndef OPENSSL_NO_NEXTPROTONEG
|
||||
#define SSL3_ST_SR_NEXT_PROTO_A (0x210|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_NEXT_PROTO_B (0x211|SSL_ST_ACCEPT)
|
||||
#endif
|
||||
#define SSL3_ST_SR_POST_CLIENT_CERT (0x1BF|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_CHANNEL_ID_A (0x220|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_CHANNEL_ID_B (0x221|SSL_ST_ACCEPT)
|
||||
#define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT)
|
||||
|
||||
@@ -204,6 +204,12 @@
|
||||
#define SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_next_protos_adv_cb
|
||||
#undef SSL_CTX_set_next_proto_select_cb
|
||||
#define SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_proto_sel_cb
|
||||
#undef ssl3_cbc_record_digest_supported
|
||||
#define ssl3_cbc_record_digest_supported ssl3_cbc_record_digest_support
|
||||
#undef ssl_check_clienthello_tlsext_late
|
||||
#define ssl_check_clienthello_tlsext_late ssl_check_clihello_tlsext_late
|
||||
#undef ssl_check_clienthello_tlsext_early
|
||||
#define ssl_check_clienthello_tlsext_early ssl_check_clihello_tlsext_early
|
||||
|
||||
/* Hack some long ENGINE names */
|
||||
#undef ENGINE_get_default_BN_mod_exp_crt
|
||||
|
||||
@@ -159,17 +159,19 @@ extern "C" {
|
||||
|
||||
#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0
|
||||
|
||||
#define TLS1_2_VERSION 0x0303
|
||||
#define TLS1_2_VERSION_MAJOR 0x03
|
||||
#define TLS1_2_VERSION_MINOR 0x03
|
||||
|
||||
#define TLS1_VERSION 0x0301
|
||||
#define TLS1_1_VERSION 0x0302
|
||||
#define TLS1_2_VERSION 0x0303
|
||||
#define TLS_MAX_VERSION TLS1_2_VERSION
|
||||
|
||||
#define TLS1_VERSION_MAJOR 0x03
|
||||
#define TLS1_VERSION_MINOR 0x01
|
||||
|
||||
#define TLS1_1_VERSION_MAJOR 0x03
|
||||
#define TLS1_1_VERSION_MINOR 0x02
|
||||
|
||||
#define TLS1_VERSION 0x0301
|
||||
#define TLS1_VERSION_MAJOR 0x03
|
||||
#define TLS1_VERSION_MINOR 0x01
|
||||
#define TLS1_2_VERSION_MAJOR 0x03
|
||||
#define TLS1_2_VERSION_MINOR 0x03
|
||||
|
||||
#define TLS1_get_version(s) \
|
||||
((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)
|
||||
@@ -187,6 +189,7 @@ extern "C" {
|
||||
#define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */
|
||||
#define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */
|
||||
#define TLS1_AD_INTERNAL_ERROR 80 /* fatal */
|
||||
#define TLS1_AD_INAPPROPRIATE_FALLBACK 86 /* fatal */
|
||||
#define TLS1_AD_USER_CANCELLED 90
|
||||
#define TLS1_AD_NO_RENEGOTIATION 100
|
||||
/* codes 110-114 are from RFC3546 */
|
||||
@@ -230,6 +233,12 @@ extern "C" {
|
||||
/* ExtensionType value from RFC5620 */
|
||||
#define TLSEXT_TYPE_heartbeat 15
|
||||
|
||||
/* ExtensionType value for TLS padding extension.
|
||||
* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
|
||||
* http://tools.ietf.org/html/draft-agl-tls-padding-03
|
||||
*/
|
||||
#define TLSEXT_TYPE_padding 21
|
||||
|
||||
/* ExtensionType value from draft-ietf-tls-applayerprotoneg-00 */
|
||||
#define TLSEXT_TYPE_application_layer_protocol_negotiation 16
|
||||
|
||||
@@ -253,6 +262,7 @@ extern "C" {
|
||||
|
||||
/* This is not an IANA defined extension number */
|
||||
#define TLSEXT_TYPE_channel_id 30031
|
||||
#define TLSEXT_TYPE_channel_id_new 30032
|
||||
|
||||
/* NameType value from RFC 3546 */
|
||||
#define TLSEXT_NAMETYPE_host_name 0
|
||||
@@ -525,6 +535,12 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
|
||||
#define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031
|
||||
#define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032
|
||||
|
||||
/* ECDHE PSK ciphersuites from RFC5489
|
||||
* SHA-2 cipher suites are omitted because they cannot be used safely with
|
||||
* SSLv3. */
|
||||
#define TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA 0x0300C035
|
||||
#define TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA 0x0300C036
|
||||
|
||||
/* XXX
|
||||
* Inconsistency alert:
|
||||
* The OpenSSL names of ciphers with ephemeral DH here include the string
|
||||
@@ -676,6 +692,10 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
|
||||
#define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256"
|
||||
#define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384"
|
||||
|
||||
/* ECDHE PSK ciphersuites from RFC5489 */
|
||||
#define TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA "ECDHE-PSK-AES128-CBC-SHA"
|
||||
#define TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA "ECDHE-PSK-AES256-CBC-SHA"
|
||||
|
||||
#define TLS_CT_RSA_SIGN 1
|
||||
#define TLS_CT_DSS_SIGN 2
|
||||
#define TLS_CT_RSA_FIXED_DH 3
|
||||
|
||||
Reference in New Issue
Block a user