\r
#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0\r
\r
+#define TLS1_2_VERSION 0x0303\r
+#define TLS1_2_VERSION_MAJOR 0x03\r
+#define TLS1_2_VERSION_MINOR 0x03\r
+\r
+#define TLS1_1_VERSION 0x0302\r
+#define TLS1_1_VERSION_MAJOR 0x03\r
+#define TLS1_1_VERSION_MINOR 0x02\r
+\r
#define TLS1_VERSION 0x0301\r
#define TLS1_VERSION_MAJOR 0x03\r
#define TLS1_VERSION_MINOR 0x01\r
\r
+#define TLS1_get_version(s) \\r
+ ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)\r
+\r
+#define TLS1_get_client_version(s) \\r
+ ((s->client_version >> 8) == TLS1_VERSION_MAJOR ? s->client_version : 0)\r
+\r
#define TLS1_AD_DECRYPTION_FAILED 21\r
#define TLS1_AD_RECORD_OVERFLOW 22\r
#define TLS1_AD_UNKNOWN_CA 48 /* fatal */\r
#define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114\r
#define TLS1_AD_UNKNOWN_PSK_IDENTITY 115 /* fatal */\r
\r
-/* ExtensionType values from RFC3546 / RFC4366 */\r
+/* ExtensionType values from RFC3546 / RFC4366 / RFC6066 */\r
#define TLSEXT_TYPE_server_name 0\r
#define TLSEXT_TYPE_max_fragment_length 1\r
#define TLSEXT_TYPE_client_certificate_url 2\r
#define TLSEXT_TYPE_trusted_ca_keys 3\r
#define TLSEXT_TYPE_truncated_hmac 4\r
#define TLSEXT_TYPE_status_request 5\r
+/* ExtensionType values from RFC4681 */\r
+#define TLSEXT_TYPE_user_mapping 6\r
+\r
+/* ExtensionType values from RFC5878 */\r
+#define TLSEXT_TYPE_client_authz 7\r
+#define TLSEXT_TYPE_server_authz 8\r
+\r
+/* ExtensionType values from RFC6091 */\r
+#define TLSEXT_TYPE_cert_type 9\r
+\r
/* ExtensionType values from RFC4492 */\r
#define TLSEXT_TYPE_elliptic_curves 10\r
#define TLSEXT_TYPE_ec_point_formats 11\r
+\r
+/* ExtensionType value from RFC5054 */\r
+#define TLSEXT_TYPE_srp 12\r
+\r
+/* ExtensionType values from RFC5246 */\r
+#define TLSEXT_TYPE_signature_algorithms 13\r
+\r
+/* ExtensionType value from RFC5764 */\r
+#define TLSEXT_TYPE_use_srtp 14\r
+\r
+/* ExtensionType value from RFC5620 */\r
+#define TLSEXT_TYPE_heartbeat 15\r
+\r
+/* ExtensionType value from RFC4507 */\r
#define TLSEXT_TYPE_session_ticket 35\r
+\r
/* ExtensionType value from draft-rescorla-tls-opaque-prf-input-00.txt */\r
#if 0 /* will have to be provided externally for now ,\r
* i.e. build with -DTLSEXT_TYPE_opaque_prf_input=38183\r
/* Temporary extension type */\r
#define TLSEXT_TYPE_renegotiate 0xff01\r
\r
+#ifndef OPENSSL_NO_NEXTPROTONEG\r
+/* This is not an IANA defined extension number */\r
+#define TLSEXT_TYPE_next_proto_neg 13172\r
+#endif\r
+\r
/* NameType value from RFC 3546 */\r
#define TLSEXT_NAMETYPE_host_name 0\r
/* status request value from RFC 3546 */\r
#define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2 2\r
#define TLSEXT_ECPOINTFORMAT_last 2\r
\r
+/* Signature and hash algorithms from RFC 5246 */\r
+\r
+#define TLSEXT_signature_anonymous 0\r
+#define TLSEXT_signature_rsa 1\r
+#define TLSEXT_signature_dsa 2\r
+#define TLSEXT_signature_ecdsa 3\r
+\r
+#define TLSEXT_hash_none 0\r
+#define TLSEXT_hash_md5 1\r
+#define TLSEXT_hash_sha1 2\r
+#define TLSEXT_hash_sha224 3\r
+#define TLSEXT_hash_sha256 4\r
+#define TLSEXT_hash_sha384 5\r
+#define TLSEXT_hash_sha512 6\r
+\r
#ifndef OPENSSL_NO_TLSEXT\r
\r
#define TLSEXT_MAXLEN_host_name 255\r
\r
-const char *SSL_get_servername(const SSL *s, const int type) ;\r
-int SSL_get_servername_type(const SSL *s) ;\r
+const char *SSL_get_servername(const SSL *s, const int type);\r
+int SSL_get_servername_type(const SSL *s);\r
+/* SSL_export_keying_material exports a value derived from the master secret,\r
+ * as specified in RFC 5705. It writes |olen| bytes to |out| given a label and\r
+ * optional context. (Since a zero length context is allowed, the |use_context|\r
+ * flag controls whether a context is included.)\r
+ *\r
+ * It returns 1 on success and zero otherwise.\r
+ */\r
+int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,\r
+ const char *label, size_t llen, const unsigned char *p, size_t plen,\r
+ int use_context);\r
\r
#define SSL_set_tlsext_host_name(s,name) \\r
SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,(char *)name)\r
#define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \\r
SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)\r
\r
+#ifndef OPENSSL_NO_HEARTBEATS\r
+#define SSL_TLSEXT_HB_ENABLED 0x01\r
+#define SSL_TLSEXT_HB_DONT_SEND_REQUESTS 0x02\r
+#define SSL_TLSEXT_HB_DONT_RECV_REQUESTS 0x04\r
+\r
+#define SSL_get_tlsext_heartbeat_pending(ssl) \\r
+ SSL_ctrl((ssl),SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING,0,NULL)\r
+#define SSL_set_tlsext_heartbeat_no_requests(ssl, arg) \\r
+ SSL_ctrl((ssl),SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS,arg,NULL)\r
+#endif\r
#endif\r
\r
/* PSK ciphersuites from 4279 */\r
#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039\r
#define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A\r
\r
+/* TLS v1.2 ciphersuites */\r
+#define TLS1_CK_RSA_WITH_NULL_SHA256 0x0300003B\r
+#define TLS1_CK_RSA_WITH_AES_128_SHA256 0x0300003C\r
+#define TLS1_CK_RSA_WITH_AES_256_SHA256 0x0300003D\r
+#define TLS1_CK_DH_DSS_WITH_AES_128_SHA256 0x0300003E\r
+#define TLS1_CK_DH_RSA_WITH_AES_128_SHA256 0x0300003F\r
+#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA256 0x03000040\r
+\r
/* Camellia ciphersuites from RFC4132 */\r
#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000041\r
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000042\r
#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000045\r
#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA 0x03000046\r
\r
+/* TLS v1.2 ciphersuites */\r
+#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA256 0x03000067\r
+#define TLS1_CK_DH_DSS_WITH_AES_256_SHA256 0x03000068\r
+#define TLS1_CK_DH_RSA_WITH_AES_256_SHA256 0x03000069\r
+#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA256 0x0300006A\r
+#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA256 0x0300006B\r
+#define TLS1_CK_ADH_WITH_AES_128_SHA256 0x0300006C\r
+#define TLS1_CK_ADH_WITH_AES_256_SHA256 0x0300006D\r
+\r
+/* Camellia ciphersuites from RFC4132 */\r
#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000084\r
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000085\r
#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000086\r
#define TLS1_CK_DHE_RSA_WITH_SEED_SHA 0x0300009A\r
#define TLS1_CK_ADH_WITH_SEED_SHA 0x0300009B\r
\r
+/* TLS v1.2 GCM ciphersuites from RFC5288 */\r
+#define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 0x0300009C\r
+#define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 0x0300009D\r
+#define TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 0x0300009E\r
+#define TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384 0x0300009F\r
+#define TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256 0x030000A0\r
+#define TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384 0x030000A1\r
+#define TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256 0x030000A2\r
+#define TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384 0x030000A3\r
+#define TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256 0x030000A4\r
+#define TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384 0x030000A5\r
+#define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256 0x030000A6\r
+#define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384 0x030000A7\r
+\r
/* ECC ciphersuites from draft-ietf-tls-ecc-12.txt with changes soon to be in draft 13 */\r
#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA 0x0300C001\r
#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA 0x0300C002\r
#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA 0x0300C018\r
#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA 0x0300C019\r
\r
+/* SRP ciphersuites from RFC 5054 */\r
+#define TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA 0x0300C01A\r
+#define TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA 0x0300C01B\r
+#define TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA 0x0300C01C\r
+#define TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA 0x0300C01D\r
+#define TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA 0x0300C01E\r
+#define TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA 0x0300C01F\r
+#define TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA 0x0300C020\r
+#define TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA 0x0300C021\r
+#define TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA 0x0300C022\r
+\r
+/* ECDH HMAC based ciphersuites from RFC5289 */\r
+\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 0x0300C023\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384 0x0300C024\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256 0x0300C025\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384 0x0300C026\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 0x0300C027\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384 0x0300C028\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256 0x0300C029\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384 0x0300C02A\r
+\r
+/* ECDH GCM based ciphersuites from RFC5289 */\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02B\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02C\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02D\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02E\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0x0300C02F\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0x0300C030\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032\r
+\r
/* XXX\r
* Inconsistency alert:\r
* The OpenSSL names of ciphers with ephemeral DH here include the string\r
#define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA "PSK-AES128-CBC-SHA"\r
#define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA "PSK-AES256-CBC-SHA"\r
\r
+/* SRP ciphersuite from RFC 5054 */\r
+#define TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA "SRP-3DES-EDE-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA "SRP-RSA-3DES-EDE-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA "SRP-DSS-3DES-EDE-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA "SRP-AES-128-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA "SRP-RSA-AES-128-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA "SRP-DSS-AES-128-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA "SRP-AES-256-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA "SRP-RSA-AES-256-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA "SRP-DSS-AES-256-CBC-SHA"\r
+\r
/* Camellia ciphersuites from RFC4132 */\r
#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA "CAMELLIA128-SHA"\r
#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA "DH-DSS-CAMELLIA128-SHA"\r
#define TLS1_TXT_DHE_RSA_WITH_SEED_SHA "DHE-RSA-SEED-SHA"\r
#define TLS1_TXT_ADH_WITH_SEED_SHA "ADH-SEED-SHA"\r
\r
+/* TLS v1.2 ciphersuites */\r
+#define TLS1_TXT_RSA_WITH_NULL_SHA256 "NULL-SHA256"\r
+#define TLS1_TXT_RSA_WITH_AES_128_SHA256 "AES128-SHA256"\r
+#define TLS1_TXT_RSA_WITH_AES_256_SHA256 "AES256-SHA256"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA256 "DH-DSS-AES128-SHA256"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA256 "DH-RSA-AES128-SHA256"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256 "DHE-DSS-AES128-SHA256"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256 "DHE-RSA-AES128-SHA256"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA256 "DH-DSS-AES256-SHA256"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA256 "DH-RSA-AES256-SHA256"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256 "DHE-DSS-AES256-SHA256"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256 "DHE-RSA-AES256-SHA256"\r
+#define TLS1_TXT_ADH_WITH_AES_128_SHA256 "ADH-AES128-SHA256"\r
+#define TLS1_TXT_ADH_WITH_AES_256_SHA256 "ADH-AES256-SHA256"\r
+\r
+/* TLS v1.2 GCM ciphersuites from RFC5288 */\r
+#define TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256 "AES128-GCM-SHA256"\r
+#define TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384 "AES256-GCM-SHA384"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256 "DHE-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384 "DHE-RSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256 "DH-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384 "DH-RSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256 "DHE-DSS-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384 "DHE-DSS-AES256-GCM-SHA384"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256 "DH-DSS-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384 "DH-DSS-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256 "ADH-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384 "ADH-AES256-GCM-SHA384"\r
+\r
+/* ECDH HMAC based ciphersuites from RFC5289 */\r
+\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256 "ECDHE-ECDSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384 "ECDHE-ECDSA-AES256-SHA384"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256 "ECDH-ECDSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384 "ECDH-ECDSA-AES256-SHA384"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 "ECDHE-RSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384 "ECDHE-RSA-AES256-SHA384"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256 "ECDH-RSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384 "ECDH-RSA-AES256-SHA384"\r
+\r
+/* ECDH GCM based ciphersuites from RFC5289 */\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 "ECDHE-ECDSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 "ECDHE-ECDSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 "ECDH-ECDSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 "ECDH-ECDSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 "ECDHE-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384 "ECDHE-RSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384"\r
\r
#define TLS_CT_RSA_SIGN 1\r
#define TLS_CT_DSS_SIGN 2\r
OSDN Git Service
