aboutsummaryrefslogtreecommitdiff
path: root/include/openssl/tls1.h
diff options
context:
space:
mode:
Diffstat (limited to 'include/openssl/tls1.h')
-rw-r--r--include/openssl/tls1.h141
1 files changed, 68 insertions, 73 deletions
diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
index 91558fa8d1a5..8e9b110bb303 100644
--- a/include/openssl/tls1.h
+++ b/include/openssl/tls1.h
@@ -28,7 +28,7 @@ extern "C" {
/* Default security level if not overridden at config time */
# ifndef OPENSSL_TLS_SECURITY_LEVEL
-# define OPENSSL_TLS_SECURITY_LEVEL 1
+# define OPENSSL_TLS_SECURITY_LEVEL 2
# endif
/* TLS*_VERSION constants are defined in prov_ssl.h */
@@ -123,6 +123,14 @@ extern "C" {
# define TLSEXT_TYPE_signed_certificate_timestamp 18
/*
+ * Extension type for Raw Public Keys
+ * https://tools.ietf.org/html/rfc7250
+ * https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
+ */
+# define TLSEXT_TYPE_client_cert_type 19
+# define TLSEXT_TYPE_server_cert_type 20
+
+/*
* ExtensionType value for TLS padding extension.
* http://tools.ietf.org/html/draft-agl-tls-padding
*/
@@ -134,6 +142,9 @@ extern "C" {
/* ExtensionType value from RFC7627 */
# define TLSEXT_TYPE_extended_master_secret 23
+/* ExtensionType value from RFC8879 */
+# define TLSEXT_TYPE_compress_certificate 27
+
/* ExtensionType value from RFC4507 */
# define TLSEXT_TYPE_session_ticket 35
@@ -147,6 +158,7 @@ extern "C" {
# define TLSEXT_TYPE_post_handshake_auth 49
# define TLSEXT_TYPE_signature_algorithms_cert 50
# define TLSEXT_TYPE_key_share 51
+# define TLSEXT_TYPE_quic_transport_parameters 57
/* Temporary extension type */
# define TLSEXT_TYPE_renegotiate 0xff01
@@ -195,6 +207,15 @@ extern "C" {
# define TLSEXT_hash_num 10
+/* Possible compression values from RFC8879 */
+/* Not defined in RFC8879, but used internally for no-compression */
+# define TLSEXT_comp_cert_none 0
+# define TLSEXT_comp_cert_zlib 1
+# define TLSEXT_comp_cert_brotli 2
+# define TLSEXT_comp_cert_zstd 3
+/* one more than the number of defined values - used as size of 0-terminated array */
+# define TLSEXT_comp_cert_limit 4
+
/* Flag set for unrecognised algorithms */
# define TLSEXT_nid_unknown 0x1000000
@@ -213,6 +234,15 @@ extern "C" {
/* OpenSSL value for unset maximum fragment length extension */
# define TLSEXT_max_fragment_length_UNSPECIFIED 255
+/*
+ * TLS Certificate Type (for RFC7250)
+ * https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-3
+ */
+# define TLSEXT_cert_type_x509 0
+# define TLSEXT_cert_type_pgp 1 /* recognized, but not supported */
+# define TLSEXT_cert_type_rpk 2
+# define TLSEXT_cert_type_1609dot2 3 /* recognized, but not supported */
+
int SSL_CTX_set_tlsext_max_fragment_length(SSL_CTX *ctx, uint8_t mode);
int SSL_set_tlsext_max_fragment_length(SSL *ssl, uint8_t mode);
@@ -252,6 +282,8 @@ int SSL_get_sigalgs(SSL *s, int idx,
int *psign, int *phash, int *psignandhash,
unsigned char *rsig, unsigned char *rhash);
+char *SSL_get1_builtin_sigalgs(OSSL_LIB_CTX *libctx);
+
int SSL_get_shared_sigalgs(SSL *s, int idx,
int *psign, int *phash, int *psignandhash,
unsigned char *rsig, unsigned char *rhash);
@@ -594,6 +626,10 @@ int SSL_CTX_set_tlsext_ticket_key_evp_cb
# define TLS1_3_CK_AES_128_CCM_SHA256 0x03001304
# define TLS1_3_CK_AES_128_CCM_8_SHA256 0x03001305
+/* Integrity-only ciphersuites from RFC 9150 */
+# define TLS1_3_CK_SHA256_SHA256 0x0300C0B4
+# define TLS1_3_CK_SHA384_SHA384 0x0300C0B5
+
/* Aria ciphersuites from RFC6209 */
# define TLS1_CK_RSA_WITH_ARIA_128_GCM_SHA256 0x0300C050
# define TLS1_CK_RSA_WITH_ARIA_256_GCM_SHA384 0x0300C051
@@ -671,6 +707,8 @@ int SSL_CTX_set_tlsext_ticket_key_evp_cb
# define TLS1_3_RFC_AES_128_GCM_SHA256 "TLS_AES_128_GCM_SHA256"
# define TLS1_3_RFC_AES_256_GCM_SHA384 "TLS_AES_256_GCM_SHA384"
# define TLS1_3_RFC_CHACHA20_POLY1305_SHA256 "TLS_CHACHA20_POLY1305_SHA256"
+# define TLS1_3_RFC_SHA256_SHA256 "TLS_SHA256_SHA256"
+# define TLS1_3_RFC_SHA384_SHA384 "TLS_SHA384_SHA384"
# define TLS1_3_RFC_AES_128_CCM_SHA256 "TLS_AES_128_CCM_SHA256"
# define TLS1_3_RFC_AES_128_CCM_8_SHA256 "TLS_AES_128_CCM_8_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_NULL_SHA "TLS_ECDHE_ECDSA_WITH_NULL_SHA"
@@ -1140,78 +1178,35 @@ int SSL_CTX_set_tlsext_ticket_key_evp_cb
# define TLS1_FINISH_MAC_LENGTH 12
-# define TLS_MD_MAX_CONST_SIZE 22
-# define TLS_MD_CLIENT_FINISH_CONST "client finished"
-# define TLS_MD_CLIENT_FINISH_CONST_SIZE 15
-# define TLS_MD_SERVER_FINISH_CONST "server finished"
-# define TLS_MD_SERVER_FINISH_CONST_SIZE 15
-# define TLS_MD_KEY_EXPANSION_CONST "key expansion"
-# define TLS_MD_KEY_EXPANSION_CONST_SIZE 13
-# define TLS_MD_CLIENT_WRITE_KEY_CONST "client write key"
-# define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16
-# define TLS_MD_SERVER_WRITE_KEY_CONST "server write key"
-# define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16
-# define TLS_MD_IV_BLOCK_CONST "IV block"
-# define TLS_MD_IV_BLOCK_CONST_SIZE 8
-# define TLS_MD_MASTER_SECRET_CONST "master secret"
-# define TLS_MD_MASTER_SECRET_CONST_SIZE 13
-# define TLS_MD_EXTENDED_MASTER_SECRET_CONST "extended master secret"
-# define TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE 22
-
-# ifdef CHARSET_EBCDIC
-# undef TLS_MD_CLIENT_FINISH_CONST
-/*
- * client finished
- */
-# define TLS_MD_CLIENT_FINISH_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x66\x69\x6e\x69\x73\x68\x65\x64"
-
-# undef TLS_MD_SERVER_FINISH_CONST
-/*
- * server finished
- */
-# define TLS_MD_SERVER_FINISH_CONST "\x73\x65\x72\x76\x65\x72\x20\x66\x69\x6e\x69\x73\x68\x65\x64"
-
-# undef TLS_MD_SERVER_WRITE_KEY_CONST
-/*
- * server write key
- */
-# define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"
-
-# undef TLS_MD_KEY_EXPANSION_CONST
-/*
- * key expansion
- */
-# define TLS_MD_KEY_EXPANSION_CONST "\x6b\x65\x79\x20\x65\x78\x70\x61\x6e\x73\x69\x6f\x6e"
-
-# undef TLS_MD_CLIENT_WRITE_KEY_CONST
-/*
- * client write key
- */
-# define TLS_MD_CLIENT_WRITE_KEY_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"
-
-# undef TLS_MD_SERVER_WRITE_KEY_CONST
-/*
- * server write key
- */
-# define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"
-
-# undef TLS_MD_IV_BLOCK_CONST
-/*
- * IV block
- */
-# define TLS_MD_IV_BLOCK_CONST "\x49\x56\x20\x62\x6c\x6f\x63\x6b"
-
-# undef TLS_MD_MASTER_SECRET_CONST
-/*
- * master secret
- */
-# define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
-# undef TLS_MD_EXTENDED_MASTER_SECRET_CONST
-/*
- * extended master secret
- */
-# define TLS_MD_EXTENDED_MASTER_SECRET_CONST "\x65\x78\x74\x65\x6e\x64\x65\x64\x20\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
-# endif
+# define TLS_MD_MAX_CONST_SIZE 22
+
+/* ASCII: "client finished", in hex for EBCDIC compatibility */
+# define TLS_MD_CLIENT_FINISH_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x66\x69\x6e\x69\x73\x68\x65\x64"
+# define TLS_MD_CLIENT_FINISH_CONST_SIZE 15
+/* ASCII: "server finished", in hex for EBCDIC compatibility */
+# define TLS_MD_SERVER_FINISH_CONST "\x73\x65\x72\x76\x65\x72\x20\x66\x69\x6e\x69\x73\x68\x65\x64"
+# define TLS_MD_SERVER_FINISH_CONST_SIZE 15
+/* ASCII: "server write key", in hex for EBCDIC compatibility */
+# define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"
+# define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16
+/* ASCII: "key expansion", in hex for EBCDIC compatibility */
+# define TLS_MD_KEY_EXPANSION_CONST "\x6b\x65\x79\x20\x65\x78\x70\x61\x6e\x73\x69\x6f\x6e"
+# define TLS_MD_KEY_EXPANSION_CONST_SIZE 13
+/* ASCII: "client write key", in hex for EBCDIC compatibility */
+# define TLS_MD_CLIENT_WRITE_KEY_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"
+# define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16
+/* ASCII: "server write key", in hex for EBCDIC compatibility */
+# define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"
+# define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16
+/* ASCII: "IV block", in hex for EBCDIC compatibility */
+# define TLS_MD_IV_BLOCK_CONST "\x49\x56\x20\x62\x6c\x6f\x63\x6b"
+# define TLS_MD_IV_BLOCK_CONST_SIZE 8
+/* ASCII: "master secret", in hex for EBCDIC compatibility */
+# define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
+# define TLS_MD_MASTER_SECRET_CONST_SIZE 13
+/* ASCII: "extended master secret", in hex for EBCDIC compatibility */
+# define TLS_MD_EXTENDED_MASTER_SECRET_CONST "\x65\x78\x74\x65\x6e\x64\x65\x64\x20\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
+# define TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE 22
/* TLS Session Ticket extension struct */
struct tls_session_ticket_ext_st {
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-10 08:46:42 +0000