diff options
| author |   jsing <jsing@openbsd.org> | 2017-01-24 09:03:21 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2017-01-24 09:03:21 +0000 |
| commit | 67f294b8e3587e3d09e4afc14f161cec75987629 (patch) | |
| tree | 9019f18203e1d1fafdb17a46e46b0bded040c95a /lib/libssl/ssl.h | |
| parent | SVM: matching i386 commit (missing host save area pa msr) (diff) | |
| download | wireguard-openbsd-67f294b8e3587e3d09e4afc14f161cec75987629.tar.xz wireguard-openbsd-67f294b8e3587e3d09e4afc14f161cec75987629.zip | |
Add support for setting the supported EC curves via
SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous
SSL{_CTX}_set1_curves{_list} names.
This also changes the default list of EC curves to be X25519, P-256 and
P-384. If you want others (such a brainpool) you need to configure this
yourself.
Inspired by parts of BoringSSL and OpenSSL.
ok beck@
Diffstat (limited to 'lib/libssl/ssl.h')
| -rw-r--r-- | lib/libssl/ssl.h | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/lib/libssl/ssl.h b/lib/libssl/ssl.h index 80e7558a2a0..cf75130faf7 100644 --- a/lib/libssl/ssl.h +++ b/lib/libssl/ssl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl.h,v 1.121 2017/01/24 02:56:17 jsing Exp $ */ +/* $OpenBSD: ssl.h,v 1.122 2017/01/24 09:03:21 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1169,6 +1169,19 @@ int PEM_write_SSL_SESSION(FILE *fp, SSL_SESSION *x); #define SSL_set_ecdh_auto(s, onoff) \ SSL_ctrl(s,SSL_CTRL_SET_ECDH_AUTO,onoff,NULL) +int SSL_CTX_set1_groups(SSL_CTX *ctx, const int *groups, size_t groups_len); +int SSL_CTX_set1_groups_list(SSL_CTX *ctx, const char *groups); + +int SSL_set1_groups(SSL *ssl, const int *groups, size_t groups_len); +int SSL_set1_groups_list(SSL *ssl, const char *groups); + +#ifndef LIBRESSL_INTERNAL +#define SSL_CTX_set1_curves SSL_CTX_set1_groups +#define SSL_CTX_set1_curves_list SSL_CTX_set1_groups_list +#define SSL_set1_curves SSL_set1_groups +#define SSL_set1_curves_list SSL_set1_groups_list +#endif + #define SSL_CTX_add_extra_chain_cert(ctx,x509) \ SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509) #define SSL_CTX_get_extra_chain_certs(ctx,px509) \ |