ag/cpython-source-deps
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Import OpenSSL 1.1.0h

Browse Source
This commit is contained in:
Steve Dower
2018-04-13 17:45:41 +00:00
parent f39d324ed3
commit 807cee26df
513 changed files with 11248 additions and 3603 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
doc/ssl/SSL_CONF_cmd.pod
View File

@@ -110,6 +110,11 @@ Attempts to use the file B<value> as the set of temporary DH parameters for
the appropriate context. This option is only supported if certificate
operations are permitted.
=item B<-no_renegotiation>
Disables all attempts at renegotiation in TLSv1.2 and earlier, same as setting
B<SSL_OP_NO_RENEGOTIATION>.
=item B<-min_protocol>, B<-max_protocol>
Sets the minimum and maximum supported protocol.
@@ -227,6 +232,11 @@ Attempts to use the file B<value> as the set of temporary DH parameters for
the appropriate context. This option is only supported if certificate
operations are permitted.
=item B<NoRenegotiation>
Disables all attempts at renegotiation in TLSv1.2 and earlier, same as setting
B<SSL_OP_NO_RENEGOTIATION>.
=item B<SignatureAlgorithms>
This sets the supported signature algorithms for TLS v1.2. For clients this
@@ -424,7 +434,7 @@ SSLv3 is B<always> disabled and attempt to override this by the user are
ignored.
By checking the return code of SSL_CTX_cmd() it is possible to query if a
given B<cmd> is recognised, this is useful is SSL_CTX_cmd() values are
given B<cmd> is recognised, this is useful if SSL_CTX_cmd() values are
mixed with additional application specific operations.
For example an application might call SSL_CTX_cmd() and if it returns
@@ -543,7 +553,7 @@ B<MinProtocol> and B<MaxProtocol> where added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2012-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2012-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy

2
doc/ssl/SSL_CTX_config.pod
View File

@@ -40,7 +40,7 @@ If the file "config.cnf" contains the following:
testapp = test_sect
[test_sect]
# list of confuration modules
# list of configuration modules
ssl_conf = ssl_sect

10
doc/ssl/SSL_CTX_dane_enable.pod
View File

@@ -3,10 +3,10 @@
=head1 NAME
SSL_CTX_dane_enable, SSL_CTX_dane_mtype_set, SSL_dane_enable,
SSL_dane_tlsa_add, SSL_get0_dane_authority, SSL_get0_dane_tlsa
SSL_dane_tlsa_add, SSL_get0_dane_authority, SSL_get0_dane_tlsa,
SSL_CTX_dane_set_flags, SSL_CTX_dane_clear_flags,
SSL_dane_set_flags, SSL_dane_clear_flags -
enable DANE TLS authentication of the remote TLS server in the local
SSL_dane_set_flags, SSL_dane_clear_flags
- enable DANE TLS authentication of the remote TLS server in the local
TLS client
=head1 SYNOPSIS
@@ -76,6 +76,8 @@ TLSA records that apply to the remote TLS peer.
The arguments specify the fields of the TLSA record.
The B<data> field is provided in binary (wire RDATA) form, not the hexadecimal
ASCII presentation form, with an explicit length passed via B<dlen>.
The library takes a copy of the B<data> buffer contents and the caller may
free the original B<data> buffer when convenient.
A return value of 0 indicates that "unusable" TLSA records (with invalid or
unsupported parameters) were provided.
A negative return value indicates an internal error in processing the record.
@@ -372,7 +374,7 @@ These functions were first added to OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy

21
doc/ssl/SSL_CTX_set_min_proto_version.pod
View File

@@ -3,7 +3,9 @@
=head1 NAME
SSL_CTX_set_min_proto_version, SSL_CTX_set_max_proto_version,
SSL_set_min_proto_version, SSL_set_max_proto_version - Set minimum
SSL_CTX_get_min_proto_version, SSL_CTX_get_max_proto_version,
SSL_set_min_proto_version, SSL_set_max_proto_version,
SSL_get_min_proto_version, SSL_get_max_proto_version - Get and set minimum
and maximum supported protocol version
=head1 SYNOPSIS
@@ -12,12 +14,17 @@ and maximum supported protocol version
int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_get_min_proto_version(SSL_CTX *ctx);
int SSL_CTX_get_max_proto_version(SSL_CTX *ctx);
int SSL_set_min_proto_version(SSL *ssl, int version);
int SSL_set_max_proto_version(SSL *ssl, int version);
int SSL_get_min_proto_version(SSL *ssl);
int SSL_get_max_proto_version(SSL *ssl);
=head1 DESCRIPTION
The functions set the minimum and maximum supported protocol versions
The functions get or set the minimum and maximum supported protocol versions
for the B<ctx> or B<ssl>.
This works in combination with the options set via
L<SSL_CTX_set_options(3)> that also make it possible to disable
@@ -28,13 +35,18 @@ Setting the minimum or maximum version to 0, will enable protocol
versions down to the lowest version, or up to the highest version
supported by the library, respectively.
Getters return 0 in case B<ctx> or B<ssl> have been configured to
automatically use the lowest or highest version supported by the library.
Currently supported versions are B<SSL3_VERSION>, B<TLS1_VERSION>,
B<TLS1_1_VERSION>, B<TLS1_2_VERSION> for TLS and B<DTLS1_VERSION>,
B<DTLS1_2_VERSION> for DTLS.
=head1 RETURN VALUES
These functions return 1 on success and 0 on failure.
These setter functions return 1 on success and 0 on failure. The getter
functions return the configured version or 0 for auto-configuration of
lowest or highest protocol, respectively.
=head1 NOTES
@@ -42,7 +54,8 @@ All these functions are implemented using macros.
=head1 HISTORY
The functions were added in OpenSSL 1.1.0
The setter functions were added in OpenSSL 1.1.0. The getter functions
were added in OpenSSL 1.1.1.
=head1 SEE ALSO

17
doc/ssl/SSL_CTX_set_options.pod
View File

@@ -189,6 +189,19 @@ Allow legacy insecure renegotiation between OpenSSL and unpatched servers
B<only>: this option is currently set by default. See the
B<SECURE RENEGOTIATION> section for more details.
=item SSL_OP_NO_ENCRYPT_THEN_MAC
Normally clients and servers will transparently attempt to negotiate the
RFC7366 Encrypt-then-MAC option on TLS and DTLS connection.
If this option is set, Encrypt-then-MAC is disabled. Clients will not
propose, and servers will not accept the extension.
=item SSL_OP_NO_RENEGOTIATION
Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest
messages, and ignore renegotiation requests via ClientHello.
=back
=head1 SECURE RENEGOTIATION
@@ -280,9 +293,11 @@ L<dhparam(1)>
The attempt to always try to use secure renegotiation was added in
Openssl 0.9.8m.
B<SSL_OP_NO_RENEGOTIATION> was added in OpenSSL 1.1.0h.
=head1 COPYRIGHT
Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy

61
doc/ssl/SSL_export_keying_material.pod Normal file
View File

@@ -0,0 +1,61 @@
=pod
=head1 NAME
SSL_export_keying_material - obtain keying material for application use
=head1 SYNOPSIS
#include <openssl/ssl.h>
int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
const char *label, size_t llen,
const unsigned char *context,
size_t contextlen, int use_context);
=head1 DESCRIPTION
During the creation of a TLS or DTLS connection shared keying material is
established between the two endpoints. The function SSL_export_keying_material()
enables an application to use some of this keying material for its own purposes
in accordance with RFC5705.
An application may need to securely establish the context within which this
keying material will be used. For example this may include identifiers for the
application session, application algorithms or parameters, or the lifetime of
the context. The context value is left to the application but must be the same
on both sides of the communication.
For a given SSL connection B<s>, B<olen> bytes of data will be written to
B<out>. The application specific context should be supplied in the location
pointed to by B<context> and should be B<contextlen> bytes long. Provision of
a context is optional. If the context should be omitted entirely then
B<use_context> should be set to 0. Otherwise it should be any other value. If
B<use_context> is 0 then the values of B<context> and B<contextlen> are ignored.
Note that a zero length context is treated differently to no context at all, and
will result in different keying material being returned.
An application specific label should be provided in the location pointed to by
B<label> and should be B<llen> bytes long. Typically this will be a value from
the IANA Exporter Label Registry
(L<https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels>).
Alternatively labels beginning with "EXPERIMENTAL" are permitted by the standard
to be used without registration.
Note that this function is only defined for TLSv1.0 and above, and DTLSv1.0 and
above. Attempting to use it in SSLv3 will result in an error.
=head1 RETURN VALUES
SSL_export_keying_material() returns 0 or -1 on failure or 1 on success.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut

2
doc/ssl/SSL_set_connect_state.pod
View File

@@ -25,7 +25,7 @@ it was either assigned a dedicated client method, a dedicated server
method, or a generic method, that can be used for both client and
server connections. (The method might have been changed with
L<SSL_CTX_set_ssl_version(3)> or
SSL_set_ssl_method().)
SSL_set_ssl_method(3).)
When beginning a new handshake, the SSL engine must know whether it must
call the connect (client) or accept (server) routines. Even though it may

14
doc/ssl/ssl.pod
View File

@@ -1,5 +1,7 @@
=pod
=for comment openssl_manual_section:7
=head1 NAME
ssl - OpenSSL SSL/TLS library
@@ -89,6 +91,12 @@ includes both more private SSL headers and headers from the B<crypto> library.
Whenever you need hard-core details on the internals of the SSL API, look
inside this header file.
OPENSSL_VERSION_AT_LEAST(major,minor) can be
used in C<#if> statements in order to determine which version of the library is
being used. This can be used to either enable optional features at compile
time, or work around issues with a previous version.
See L<OPENSSL_VERSION_NUMBER(3)>.
=item B<ssl2.h>
Unused. Present for backwards compatibility only.
@@ -320,8 +328,6 @@ protocol context defined in the B<SSL_CTX> structure.
=item void B<SSL_CTX_set_cert_store>(SSL_CTX *ctx, X509_STORE *cs);
=item void B<SSL_CTX_set1_cert_store>(SSL_CTX *ctx, X509_STORE *cs);
=item void B<SSL_CTX_set_cert_verify_cb>(SSL_CTX *ctx, int (*cb)(), char *arg)
=item int B<SSL_CTX_set_cipher_list>(SSL_CTX *ctx, char *str);
@@ -819,7 +825,7 @@ L<DTLSv1_listen(3)>
=head1 HISTORY
B<SSLv2_client_method>, B<SSLv2_server_method> and B<SSLv2_method> where removed
B<SSLv2_client_method>, B<SSLv2_server_method> and B<SSLv2_method> were removed
in OpenSSL 1.1.0.
The return type of B<SSL_copy_session_id> was changed from void to int in
@@ -827,7 +833,7 @@ OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy