wireguard-openbsd/lib/libtls/tls.h, branch jd/queueboosts

Enable TLS version 1.3 in the default protocols for libtls.

2020-01-22T06:44:02Z

This will as yet not do anything, until we turn it on in the lower level libraries. ok jsing@

Add support for TLSv1.3 as a protocol to libtls.

2020-01-20T08:39:21Z

This makes tls_config_parse_protocols() recognise and handle "tlsv1.3". If TLSv1.3 is enabled libtls will also request libssl to enable it. ok beck@ tb@

Provide tls_conn_cipher_strength().

2019-11-02T13:37:59Z

This returns the strength in bits of the symmetric cipher used for the connection. Diff from gilles@ ok tb@

expose the default cert file as a function, not a define. it's really

2018-11-29T14:24:23Z

an internal detail of the library, so the string should live inside it, not in the application code. ok jsing

Define TLS_CA_CERT_FILE rather than having every application create their

2018-11-06T20:34:54Z

own define for /etc/ssl/cert.pem. ok beck@ bluhm@ tb@

Bump TLS API version since we've added more functionality.

2018-02-10T04:58:08Z

Add support to libtls for client-side TLS session resumption.

2018-02-10T04:41:24Z

A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@

Add a tls_config_set_ecdhecurves() function to libtls, which allows the

2017-08-10T18:18:30Z

names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@

Add support for providing CRLs to libtls - once a CRL is provided we

2017-07-06T17:12:22Z

enable CRL checking for the full certificate chain. Based on a diff from Jack Burton , thanks! Discussed with beck@

Provide a tls_unload_file() function, that frees the memory returned from

2017-05-06T20:57:45Z

a tls_load_file() call, ensuring that it the contents become inaccessible. This is specifically needed on platforms where the library allocators may be different from the application allocator. ok beck@