kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
c0fc7a1385
boringssl/include/openssl/tls1.h

646 lines
29 KiB
C
Raw Normal View History

Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
*
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
*
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
*
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
* 4. If you include any Windows specific code (or a derivative thereof) from
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
*
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
*
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* ====================================================================
* Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
* notice, this list of conditions and the following disclaimer.
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
* Portions of the attached software ("Contribution") are developed by
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
*
* The Contribution is licensed pursuant to the OpenSSL open source
* license provided above.
*
* ECC cipher suite support in OpenSSL originally written by
* Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
*
*/
/* ====================================================================
* Copyright 2005 Nokia. All rights reserved.
*
* The portions of the attached software ("Contribution") is developed by
* Nokia Corporation and is licensed pursuant to the OpenSSL open source
* license.
*
* The Contribution, originally written by Mika Kousa and Pasi Eronen of
* Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
* support (see RFC 4279) to OpenSSL.
*
* No patent licenses or other rights except those expressly stated in
* the OpenSSL open source license shall be deemed granted or received
* expressly, by implication, estoppel, or otherwise.
*
* No assurances are provided by Nokia that the Contribution does not
* infringe the patent or other intellectual property rights of any third
* party or that the license provides you with all the necessary rights
* to make use of the Contribution.
*
* THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
* ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
* SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
* OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
* OTHERWISE.
*/
Move remaining functions out of tls1.h. Now tls1.h is just a pile of protocol constants with no more circular dependency problem. I've preserved SSL_get_servername's behavior where it's simultaneously a lookup of handshake state and local configuration. I've removed it from SSL_get_servername_type. It got the logic wrong anyway with the order of the s->session check. (Searching through code, neither is used on the client, but the SSL_get_servername one is easy.) Change-Id: I61bb8fb0858b07d76a7835bffa6dc793812fb027 Reviewed-on: https://boringssl-review.googlesource.com/6298 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-17 18:48:04 +01:00
#ifndef OPENSSL_HEADER_TLS1_H
#define OPENSSL_HEADER_TLS1_H
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Move remaining functions out of tls1.h. Now tls1.h is just a pile of protocol constants with no more circular dependency problem. I've preserved SSL_get_servername's behavior where it's simultaneously a lookup of handshake state and local configuration. I've removed it from SSL_get_servername_type. It got the logic wrong anyway with the order of the s->session check. (Searching through code, neither is used on the client, but the SSL_get_servername one is easy.) Change-Id: I61bb8fb0858b07d76a7835bffa6dc793812fb027 Reviewed-on: https://boringssl-review.googlesource.com/6298 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-17 18:48:04 +01:00
#include <openssl/base.h>
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#ifdef __cplusplus
extern "C" {
#endif
Adding new TLS 1.3 alert/extension IDs. Change-Id: Id8eb09b89010167d0f1e79d9d9e664d76020d959 Reviewed-on: https://boringssl-review.googlesource.com/8273 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-14 20:37:26 +01:00
#define TLS1_AD_END_OF_EARLY_DATA 1
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_AD_DECRYPTION_FAILED 21
#define TLS1_AD_RECORD_OVERFLOW 22
Add the certificate_required alert. This is part of TLS 1.3 draft 16 but isn't much of a wire format change, so go ahead and add it now. When rolling into Chromium, we'll want to add an entry to the error mapping. Change-Id: I8fd7f461dca83b725a31ae19ef96c890d603ce53 Reviewed-on: https://boringssl-review.googlesource.com/11563 Reviewed-by: David Benjamin <davidben@google.com>
2016-10-08 01:51:43 +01:00
#define TLS1_AD_UNKNOWN_CA 48
#define TLS1_AD_ACCESS_DENIED 49
#define TLS1_AD_DECODE_ERROR 50
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_AD_DECRYPT_ERROR 51
Add the certificate_required alert. This is part of TLS 1.3 draft 16 but isn't much of a wire format change, so go ahead and add it now. When rolling into Chromium, we'll want to add an entry to the error mapping. Change-Id: I8fd7f461dca83b725a31ae19ef96c890d603ce53 Reviewed-on: https://boringssl-review.googlesource.com/11563 Reviewed-by: David Benjamin <davidben@google.com>
2016-10-08 01:51:43 +01:00
#define TLS1_AD_EXPORT_RESTRICTION 60
#define TLS1_AD_PROTOCOL_VERSION 70
#define TLS1_AD_INSUFFICIENT_SECURITY 71
#define TLS1_AD_INTERNAL_ERROR 80
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_AD_USER_CANCELLED 90
#define TLS1_AD_NO_RENEGOTIATION 100
Adding new TLS 1.3 alert/extension IDs. Change-Id: Id8eb09b89010167d0f1e79d9d9e664d76020d959 Reviewed-on: https://boringssl-review.googlesource.com/8273 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-14 20:37:26 +01:00
#define TLS1_AD_MISSING_EXTENSION 109
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* codes 110-114 are from RFC3546 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_AD_UNSUPPORTED_EXTENSION 110
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_AD_UNRECOGNIZED_NAME 112
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113
#define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114
Add the certificate_required alert. This is part of TLS 1.3 draft 16 but isn't much of a wire format change, so go ahead and add it now. When rolling into Chromium, we'll want to add an entry to the error mapping. Change-Id: I8fd7f461dca83b725a31ae19ef96c890d603ce53 Reviewed-on: https://boringssl-review.googlesource.com/11563 Reviewed-by: David Benjamin <davidben@google.com>
2016-10-08 01:51:43 +01:00
#define TLS1_AD_UNKNOWN_PSK_IDENTITY 115
#define TLS1_AD_CERTIFICATE_REQUIRED 116
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Take out a bunch of unused constants. Code search confirms they're never used externally either. Change-Id: Id90bc15e18555dcfd757b318ab7e2d3ca7c31661 Reviewed-on: https://boringssl-review.googlesource.com/8540 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-27 23:16:13 +01:00
/* ExtensionType values from RFC6066 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_server_name 0
#define TLSEXT_TYPE_status_request 5
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ExtensionType values from RFC4492 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_ec_point_formats 11
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ExtensionType values from RFC5246 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_signature_algorithms 13
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ExtensionType value from RFC5764 */
Convert the SRTP extension to the new system Change-Id: I12f1d06562c34d357d82bbde7e5d0c15096046e6 Reviewed-on: https://boringssl-review.googlesource.com/5463 Reviewed-by: Adam Langley <agl@google.com>
2015-07-16 03:06:07 +01:00
#define TLSEXT_TYPE_srtp 14
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update references to RFCs. Some code predated the RFCs themselves, but the RFCs now exist. Also remove now obsolete comments and some unused #defines. See upstream's cffeacd91e70712c99c431bf32a655fa1b561482. (Though this predates it; I just remembered I never uploaded it.) Change-Id: I5e56f0ab6b7f558820f72e84dfdbc71a8c23cb91 Reviewed-on: https://boringssl-review.googlesource.com/2475 Reviewed-by: Adam Langley <agl@google.com>
2014-10-13 21:12:45 +01:00
/* ExtensionType value from RFC7301 */
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#define TLSEXT_TYPE_application_layer_protocol_negotiation 16
Update references to the padding draft. The padding draft is now RFC 7685: https://www.rfc-editor.org/rfc/rfc7685.txt Change-Id: I26945b10e7923e75c016232c663baac11c4389ae
2015-10-21 22:49:23 +01:00
/* ExtensionType value from RFC7685 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_padding 21
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update references to the extended master secret draft. It's now an RFC too. Change-Id: I2aa7a862bf51ff01215455e87b16f259fc468490 Reviewed-on: https://boringssl-review.googlesource.com/7028 Reviewed-by: Adam Langley <agl@google.com>
2016-02-01 13:42:19 +00:00
/* ExtensionType value from RFC7627 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_extended_master_secret 23
Extended master secret support. This change implements support for the extended master secret. See https://tools.ietf.org/html/draft-ietf-tls-session-hash-01 https://secure-resumption.com/ Change-Id: Ifc7327763149ab0894b4f1d48cdc35e0f1093b93 Reviewed-on: https://boringssl-review.googlesource.com/1930 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-10-11 00:23:43 +01:00
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ExtensionType value from RFC4507 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_session_ticket 35
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
/* ExtensionType values from draft-ietf-tls-tls13-18 */
Group 1.3 extension constants together and remove ticket_age. I'd meant to change the other -latest to -13 when I merged this, but we may as well group the two together anyway. Also remove ticket_age as that's likely to go away in PR#503. Change-Id: Ibb2f447e344d0b13c937291de69ace37ac9a5e8d Reviewed-on: https://boringssl-review.googlesource.com/8567 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-01 00:06:08 +01:00
#define TLSEXT_TYPE_supported_groups 10
Adding new TLS 1.3 alert/extension IDs. Change-Id: Id8eb09b89010167d0f1e79d9d9e664d76020d959 Reviewed-on: https://boringssl-review.googlesource.com/8273 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-14 20:37:26 +01:00
#define TLSEXT_TYPE_key_share 40
#define TLSEXT_TYPE_pre_shared_key 41
#define TLSEXT_TYPE_early_data 42
Moving TLS 1.3 version negotiation into extension. Change-Id: I73f9fd64b46f26978b897409d817b34ec9d93afd Reviewed-on: https://boringssl-review.googlesource.com/11080 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-15 21:27:05 +01:00
#define TLSEXT_TYPE_supported_versions 43
Adding new TLS 1.3 alert/extension IDs. Change-Id: Id8eb09b89010167d0f1e79d9d9e664d76020d959 Reviewed-on: https://boringssl-review.googlesource.com/8273 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-14 20:37:26 +01:00
#define TLSEXT_TYPE_cookie 44
Update to TLS 1.3 draft 18. This is the squash of the following CLs: https://boringssl-review.googlesource.com/c/12021/9 https://boringssl-review.googlesource.com/c/12022/9 https://boringssl-review.googlesource.com/c/12107/19 https://boringssl-review.googlesource.com/c/12141/22 https://boringssl-review.googlesource.com/c/12181/33 The Go portions were written by Nick Harper BUG=112 Change-Id: I375a1fcead493ec3e0282e231ccc8d7c4dde5063 Reviewed-on: https://boringssl-review.googlesource.com/12300 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-11-01 17:39:36 +00:00
#define TLSEXT_TYPE_psk_key_exchange_modes 45
Adding new TLS 1.3 alert/extension IDs. Change-Id: Id8eb09b89010167d0f1e79d9d9e664d76020d959 Reviewed-on: https://boringssl-review.googlesource.com/8273 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-14 20:37:26 +01:00
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ExtensionType value from RFC5746 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_renegotiate 0xff01
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Implement client side of TLS signed certificate stamps extension. https://crbug.com/389420 and 3.3 in rfc6962. Change-Id: Ib22bcd4e4bde5a314ed33e123e19a76cdb714da4 Reviewed-on: https://boringssl-review.googlesource.com/1491 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-08-14 13:42:37 +01:00
/* ExtensionType value from RFC6962 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_certificate_timestamp 18
Implement client side of TLS signed certificate stamps extension. https://crbug.com/389420 and 3.3 in rfc6962. Change-Id: Ib22bcd4e4bde5a314ed33e123e19a76cdb714da4 Reviewed-on: https://boringssl-review.googlesource.com/1491 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-08-14 13:42:37 +01:00
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* This is not an IANA defined extension number */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_TYPE_next_proto_neg 13172
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* This is not an IANA defined extension number */
Convert the Channel ID extension to the new system. This also removes support for the “old” Channel ID extension. Change-Id: I1168efb9365c274db6b9d7e32013336e4404ff54 Reviewed-on: https://boringssl-review.googlesource.com/5462 Reviewed-by: Adam Langley <agl@google.com>
2015-07-10 22:33:46 +01:00
#define TLSEXT_TYPE_channel_id 30032
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* status request value from RFC 3546 */
#define TLSEXT_STATUSTYPE_ocsp 1
Update references to RFCs. Some code predated the RFCs themselves, but the RFCs now exist. Also remove now obsolete comments and some unused #defines. See upstream's cffeacd91e70712c99c431bf32a655fa1b561482. (Though this predates it; I just remembered I never uploaded it.) Change-Id: I5e56f0ab6b7f558820f72e84dfdbc71a8c23cb91 Reviewed-on: https://boringssl-review.googlesource.com/2475 Reviewed-by: Adam Langley <agl@google.com>
2014-10-13 21:12:45 +01:00
/* ECPointFormat values from RFC 4492 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_ECPOINTFORMAT_uncompressed 0
#define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime 1
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Signature and hash algorithms from RFC 5246 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_signature_anonymous 0
#define TLSEXT_signature_rsa 1
#define TLSEXT_signature_dsa 2
#define TLSEXT_signature_ecdsa 3
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLSEXT_hash_none 0
#define TLSEXT_hash_md5 1
#define TLSEXT_hash_sha1 2
#define TLSEXT_hash_sha224 3
#define TLSEXT_hash_sha256 4
#define TLSEXT_hash_sha384 5
#define TLSEXT_hash_sha512 6
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#define TLSEXT_MAXLEN_host_name 255
/* PSK ciphersuites from 4279 */
#define TLS1_CK_PSK_WITH_RC4_128_SHA 0x0300008A
#define TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA 0x0300008B
#define TLS1_CK_PSK_WITH_AES_128_CBC_SHA 0x0300008C
#define TLS1_CK_PSK_WITH_AES_256_CBC_SHA 0x0300008D
Add ECDHE-PSK-AES{128,256}-SHA cipher suites. If we're going to have PSK and use standard cipher suites, this might be the best that we can do for the moment. Change-Id: I35d9831b2991dc5b23c9e24d98cdc0db95919d39 Reviewed-on: https://boringssl-review.googlesource.com/5052 Reviewed-by: Adam Langley <agl@google.com>
2015-06-09 17:54:04 +01:00
/* PSK ciphersuites from RFC 5489 */
#define TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA 0x0300C035
#define TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA 0x0300C036
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Additional TLS ciphersuites from expired Internet Draft
* draft-ietf-tls-56-bit-ciphersuites-01.txt
* (available if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is defined, see
* s3_lib.c). We actually treat them like SSL 3.0 ciphers, which we probably
* shouldn't. Note that the first two are actually not in the IDs. */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 0x03000060 /* not in ID */
#define TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 0x03000061 /* not in ID */
#define TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x03000062
#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x03000063
#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA 0x03000064
#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065
#define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* AES ciphersuites from RFC3268 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_AES_128_SHA 0x0300002F
#define TLS1_CK_DH_DSS_WITH_AES_128_SHA 0x03000030
#define TLS1_CK_DH_RSA_WITH_AES_128_SHA 0x03000031
#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA 0x03000032
#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA 0x03000033
#define TLS1_CK_ADH_WITH_AES_128_SHA 0x03000034
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_AES_256_SHA 0x03000035
#define TLS1_CK_DH_DSS_WITH_AES_256_SHA 0x03000036
#define TLS1_CK_DH_RSA_WITH_AES_256_SHA 0x03000037
#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA 0x03000038
#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039
#define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* TLS v1.2 ciphersuites */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_NULL_SHA256 0x0300003B
#define TLS1_CK_RSA_WITH_AES_128_SHA256 0x0300003C
#define TLS1_CK_RSA_WITH_AES_256_SHA256 0x0300003D
#define TLS1_CK_DH_DSS_WITH_AES_128_SHA256 0x0300003E
#define TLS1_CK_DH_RSA_WITH_AES_128_SHA256 0x0300003F
#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA256 0x03000040
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Camellia ciphersuites from RFC4132 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000041
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000042
#define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000043
#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000044
#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000045
#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA 0x03000046
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* TLS v1.2 ciphersuites */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA256 0x03000067
#define TLS1_CK_DH_DSS_WITH_AES_256_SHA256 0x03000068
#define TLS1_CK_DH_RSA_WITH_AES_256_SHA256 0x03000069
#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA256 0x0300006A
#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA256 0x0300006B
#define TLS1_CK_ADH_WITH_AES_128_SHA256 0x0300006C
#define TLS1_CK_ADH_WITH_AES_256_SHA256 0x0300006D
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Camellia ciphersuites from RFC4132 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000084
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000085
#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000086
#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000087
#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000088
#define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA 0x03000089
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* SEED ciphersuites from RFC4162 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_SEED_SHA 0x03000096
#define TLS1_CK_DH_DSS_WITH_SEED_SHA 0x03000097
#define TLS1_CK_DH_RSA_WITH_SEED_SHA 0x03000098
#define TLS1_CK_DHE_DSS_WITH_SEED_SHA 0x03000099
#define TLS1_CK_DHE_RSA_WITH_SEED_SHA 0x0300009A
#define TLS1_CK_ADH_WITH_SEED_SHA 0x0300009B
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* TLS v1.2 GCM ciphersuites from RFC5288 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 0x0300009C
#define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 0x0300009D
#define TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 0x0300009E
#define TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384 0x0300009F
#define TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256 0x030000A0
#define TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384 0x030000A1
#define TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256 0x030000A2
#define TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384 0x030000A3
#define TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256 0x030000A4
#define TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384 0x030000A5
#define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256 0x030000A6
#define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384 0x030000A7
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update references to RFCs. Some code predated the RFCs themselves, but the RFCs now exist. Also remove now obsolete comments and some unused #defines. See upstream's cffeacd91e70712c99c431bf32a655fa1b561482. (Though this predates it; I just remembered I never uploaded it.) Change-Id: I5e56f0ab6b7f558820f72e84dfdbc71a8c23cb91 Reviewed-on: https://boringssl-review.googlesource.com/2475 Reviewed-by: Adam Langley <agl@google.com>
2014-10-13 21:12:45 +01:00
/* ECC ciphersuites from RFC4492 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA 0x0300C001
#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA 0x0300C002
#define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C003
#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0x0300C004
#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0x0300C005
#define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA 0x0300C006
#define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA 0x0300C007
#define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C008
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0x0300C009
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0x0300C00A
#define TLS1_CK_ECDH_RSA_WITH_NULL_SHA 0x0300C00B
#define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA 0x0300C00C
#define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA 0x0300C00D
#define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA 0x0300C00E
#define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA 0x0300C00F
#define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA 0x0300C010
#define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA 0x0300C011
#define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA 0x0300C012
#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA 0x0300C013
#define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA 0x0300C014
#define TLS1_CK_ECDH_anon_WITH_NULL_SHA 0x0300C015
#define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA 0x0300C016
#define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA 0x0300C017
#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA 0x0300C018
#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA 0x0300C019
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* SRP ciphersuites from RFC 5054 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA 0x0300C01A
#define TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA 0x0300C01B
#define TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA 0x0300C01C
#define TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA 0x0300C01D
#define TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA 0x0300C01E
#define TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA 0x0300C01F
#define TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA 0x0300C020
#define TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA 0x0300C021
#define TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA 0x0300C022
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ECDH HMAC based ciphersuites from RFC5289 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 0x0300C023
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384 0x0300C024
#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256 0x0300C025
#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384 0x0300C026
#define TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 0x0300C027
#define TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384 0x0300C028
#define TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256 0x0300C029
#define TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384 0x0300C02A
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ECDH GCM based ciphersuites from RFC5289 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02B
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02C
#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02D
#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02E
#define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0x0300C02F
#define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0x0300C030
#define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031
#define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032
Refactor ChaCha20-Poly1305 AEAD nonce handling. This change reduces unnecessary copying and makes the pre-RFC-7539 nonces 96 bits just like the AES-GCM, AES-CCM, and RFC 7539 ChaCha20-Poly1305 cipher suites. Also, all the symbols related to the pre-RFC-7539 cipher suites now have "_OLD" appended, in preparation for adding the RFC 7539 variants. Change-Id: I1f85bd825b383c3134df0b6214266069ded029ae Reviewed-on: https://boringssl-review.googlesource.com/6103 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-04 00:53:33 +01:00
#define TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305_OLD 0x0300CC13
#define TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305_OLD 0x0300CC14
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update references to RFC 7905. Change-Id: I6ef23a23da3957eccbe6cd03727b9a9f367f6ef0 Reviewed-on: https://boringssl-review.googlesource.com/8470 Reviewed-by: Adam Langley <agl@google.com>
2016-06-22 23:37:39 +01:00
/* ChaCha20-Poly1305 cipher suites from RFC 7905. */
Implement draft-ietf-tls-chacha20-poly1305-04. Only ECDHE-based ciphers are implemented. To ease the transition, the pre-standard cipher shares a name with the standard one. The cipher rule parser is hacked up to match the name to both ciphers. From the perspective of the cipher suite configuration language, there is only one cipher. This does mean it is impossible to disable the old variant without a code change, but this situation will be very short-lived, so this is fine. Also take this opportunity to make the CK and TXT names align with convention. Change-Id: Ie819819c55bce8ff58e533f1dbc8bef5af955c21 Reviewed-on: https://boringssl-review.googlesource.com/6686 Reviewed-by: Adam Langley <agl@google.com>
2015-12-10 04:02:39 +00:00
#define TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0x0300CCA8
#define TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0x0300CCA9
#define TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0x0300CCAC
/* TODO(davidben): Remove this. Historically, the CK names for CHACHA20_POLY1305
* were missing 'WITH' and 'SHA256'. */
Resolve another ChaCha20-Poly1305 rename deadlock. WebRTC can't roll into Chromium without picking up the iOS build fix, but we can't roll BoringSSL forwards because WebRTC also depends on the previously exposed ChaCha20-Poly1305 cipher suite constants. Define the old constants again. Change-Id: If8434a0317e42b3aebe1bc1c5a58ed97a89a0230 Reviewed-on: https://boringssl-review.googlesource.com/6382 Reviewed-by: Adam Langley <agl@google.com>
2015-10-28 18:32:42 +00:00
#define TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305 \
Implement draft-ietf-tls-chacha20-poly1305-04. Only ECDHE-based ciphers are implemented. To ease the transition, the pre-standard cipher shares a name with the standard one. The cipher rule parser is hacked up to match the name to both ciphers. From the perspective of the cipher suite configuration language, there is only one cipher. This does mean it is impossible to disable the old variant without a code change, but this situation will be very short-lived, so this is fine. Also take this opportunity to make the CK and TXT names align with convention. Change-Id: Ie819819c55bce8ff58e533f1dbc8bef5af955c21 Reviewed-on: https://boringssl-review.googlesource.com/6686 Reviewed-by: Adam Langley <agl@google.com>
2015-12-10 04:02:39 +00:00
TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Resolve another ChaCha20-Poly1305 rename deadlock. WebRTC can't roll into Chromium without picking up the iOS build fix, but we can't roll BoringSSL forwards because WebRTC also depends on the previously exposed ChaCha20-Poly1305 cipher suite constants. Define the old constants again. Change-Id: If8434a0317e42b3aebe1bc1c5a58ed97a89a0230 Reviewed-on: https://boringssl-review.googlesource.com/6382 Reviewed-by: Adam Langley <agl@google.com>
2015-10-28 18:32:42 +00:00
Update the TLS 1.3 draft version to draft 16. This should land in the same group of revisions as the two parent commits. Change-Id: Id9d769b890b3308ea70b705e7241c73cb1930ede Reviewed-on: https://boringssl-review.googlesource.com/11581 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-10-13 19:26:33 +01:00
/* TLS 1.3 ciphersuites from draft-ietf-tls-tls13-16 */
Update crypto negotation to draft 15. BUG=77 Change-Id: If568412655aae240b072c29d763a5b17bb5ca3f7 Reviewed-on: https://boringssl-review.googlesource.com/10840 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Commit-Queue: David Benjamin <davidben@google.com>
2016-09-06 19:13:43 +01:00
#define TLS1_CK_AES_128_GCM_SHA256 0x03001301
#define TLS1_CK_AES_256_GCM_SHA384 0x03001302
#define TLS1_CK_CHACHA20_POLY1305_SHA256 0x03001303
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* XXX
* Inconsistency alert:
* The OpenSSL names of ciphers with ephemeral DH here include the string
* "DHE", while elsewhere it has always been "EDH".
* (The alias for the list of all such ciphers also is "EDH".)
* The specifications speak of "EDH"; maybe we should allow both forms
* for everything. */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 "EXP1024-RC4-MD5"
#define TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 "EXP1024-RC2-CBC-MD5"
#define TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DES-CBC-SHA"
#define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA \
"EXP1024-DHE-DSS-DES-CBC-SHA"
#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA "EXP1024-RC4-SHA"
#define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA "EXP1024-DHE-DSS-RC4-SHA"
#define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA "DHE-DSS-RC4-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* AES ciphersuites from RFC3268 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_RSA_WITH_AES_128_SHA "AES128-SHA"
#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA "DH-DSS-AES128-SHA"
#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA "DH-RSA-AES128-SHA"
#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA "DHE-DSS-AES128-SHA"
#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA "DHE-RSA-AES128-SHA"
#define TLS1_TXT_ADH_WITH_AES_128_SHA "ADH-AES128-SHA"
#define TLS1_TXT_RSA_WITH_AES_256_SHA "AES256-SHA"
#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA "DH-DSS-AES256-SHA"
#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA "DH-RSA-AES256-SHA"
#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA "DHE-DSS-AES256-SHA"
#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA "DHE-RSA-AES256-SHA"
#define TLS1_TXT_ADH_WITH_AES_256_SHA "ADH-AES256-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update references to RFCs. Some code predated the RFCs themselves, but the RFCs now exist. Also remove now obsolete comments and some unused #defines. See upstream's cffeacd91e70712c99c431bf32a655fa1b561482. (Though this predates it; I just remembered I never uploaded it.) Change-Id: I5e56f0ab6b7f558820f72e84dfdbc71a8c23cb91 Reviewed-on: https://boringssl-review.googlesource.com/2475 Reviewed-by: Adam Langley <agl@google.com>
2014-10-13 21:12:45 +01:00
/* ECC ciphersuites from RFC4492 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA "ECDH-ECDSA-NULL-SHA"
#define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA "ECDH-ECDSA-RC4-SHA"
#define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA "ECDH-ECDSA-DES-CBC3-SHA"
#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA "ECDH-ECDSA-AES128-SHA"
#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA "ECDH-ECDSA-AES256-SHA"
#define TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA "ECDHE-ECDSA-NULL-SHA"
#define TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA "ECDHE-ECDSA-RC4-SHA"
#define TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA "ECDHE-ECDSA-DES-CBC3-SHA"
#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA "ECDHE-ECDSA-AES128-SHA"
#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA "ECDHE-ECDSA-AES256-SHA"
#define TLS1_TXT_ECDH_RSA_WITH_NULL_SHA "ECDH-RSA-NULL-SHA"
#define TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA "ECDH-RSA-RC4-SHA"
#define TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA "ECDH-RSA-DES-CBC3-SHA"
#define TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA "ECDH-RSA-AES128-SHA"
#define TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA "ECDH-RSA-AES256-SHA"
#define TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA "ECDHE-RSA-NULL-SHA"
#define TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA "ECDHE-RSA-RC4-SHA"
#define TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA "ECDHE-RSA-DES-CBC3-SHA"
#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA "ECDHE-RSA-AES128-SHA"
#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA "ECDHE-RSA-AES256-SHA"
#define TLS1_TXT_ECDH_anon_WITH_NULL_SHA "AECDH-NULL-SHA"
#define TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA "AECDH-RC4-SHA"
#define TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA "AECDH-DES-CBC3-SHA"
#define TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA "AECDH-AES128-SHA"
#define TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA "AECDH-AES256-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* PSK ciphersuites from RFC 4279 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_PSK_WITH_RC4_128_SHA "PSK-RC4-SHA"
#define TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA "PSK-3DES-EDE-CBC-SHA"
#define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA "PSK-AES128-CBC-SHA"
#define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA "PSK-AES256-CBC-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Add ECDHE-PSK-AES{128,256}-SHA cipher suites. If we're going to have PSK and use standard cipher suites, this might be the best that we can do for the moment. Change-Id: I35d9831b2991dc5b23c9e24d98cdc0db95919d39 Reviewed-on: https://boringssl-review.googlesource.com/5052 Reviewed-by: Adam Langley <agl@google.com>
2015-06-09 17:54:04 +01:00
/* PSK ciphersuites from RFC 5489 */
#define TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA "ECDHE-PSK-AES128-CBC-SHA"
#define TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA "ECDHE-PSK-AES256-CBC-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* SRP ciphersuite from RFC 5054 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA "SRP-3DES-EDE-CBC-SHA"
#define TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA "SRP-RSA-3DES-EDE-CBC-SHA"
#define TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA "SRP-DSS-3DES-EDE-CBC-SHA"
#define TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA "SRP-AES-128-CBC-SHA"
#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA "SRP-RSA-AES-128-CBC-SHA"
#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA "SRP-DSS-AES-128-CBC-SHA"
#define TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA "SRP-AES-256-CBC-SHA"
#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA "SRP-RSA-AES-256-CBC-SHA"
#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA "SRP-DSS-AES-256-CBC-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* Camellia ciphersuites from RFC4132 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA "CAMELLIA128-SHA"
#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA "DH-DSS-CAMELLIA128-SHA"
#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA "DH-RSA-CAMELLIA128-SHA"
#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA "DHE-DSS-CAMELLIA128-SHA"
#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA "DHE-RSA-CAMELLIA128-SHA"
#define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA "ADH-CAMELLIA128-SHA"
#define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA "CAMELLIA256-SHA"
#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA "DH-DSS-CAMELLIA256-SHA"
#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA "DH-RSA-CAMELLIA256-SHA"
#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA "DHE-DSS-CAMELLIA256-SHA"
#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA "DHE-RSA-CAMELLIA256-SHA"
#define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA "ADH-CAMELLIA256-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* SEED ciphersuites from RFC4162 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_RSA_WITH_SEED_SHA "SEED-SHA"
#define TLS1_TXT_DH_DSS_WITH_SEED_SHA "DH-DSS-SEED-SHA"
#define TLS1_TXT_DH_RSA_WITH_SEED_SHA "DH-RSA-SEED-SHA"
#define TLS1_TXT_DHE_DSS_WITH_SEED_SHA "DHE-DSS-SEED-SHA"
#define TLS1_TXT_DHE_RSA_WITH_SEED_SHA "DHE-RSA-SEED-SHA"
#define TLS1_TXT_ADH_WITH_SEED_SHA "ADH-SEED-SHA"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* TLS v1.2 ciphersuites */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_RSA_WITH_NULL_SHA256 "NULL-SHA256"
#define TLS1_TXT_RSA_WITH_AES_128_SHA256 "AES128-SHA256"
#define TLS1_TXT_RSA_WITH_AES_256_SHA256 "AES256-SHA256"
#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA256 "DH-DSS-AES128-SHA256"
#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA256 "DH-RSA-AES128-SHA256"
#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256 "DHE-DSS-AES128-SHA256"
#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256 "DHE-RSA-AES128-SHA256"
#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA256 "DH-DSS-AES256-SHA256"
#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA256 "DH-RSA-AES256-SHA256"
#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256 "DHE-DSS-AES256-SHA256"
#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256 "DHE-RSA-AES256-SHA256"
#define TLS1_TXT_ADH_WITH_AES_128_SHA256 "ADH-AES128-SHA256"
#define TLS1_TXT_ADH_WITH_AES_256_SHA256 "ADH-AES256-SHA256"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* TLS v1.2 GCM ciphersuites from RFC5288 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256 "AES128-GCM-SHA256"
#define TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384 "AES256-GCM-SHA384"
#define TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256 "DHE-RSA-AES128-GCM-SHA256"
#define TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384 "DHE-RSA-AES256-GCM-SHA384"
#define TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256 "DH-RSA-AES128-GCM-SHA256"
#define TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384 "DH-RSA-AES256-GCM-SHA384"
#define TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256 "DHE-DSS-AES128-GCM-SHA256"
#define TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384 "DHE-DSS-AES256-GCM-SHA384"
#define TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256 "DH-DSS-AES128-GCM-SHA256"
#define TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384 "DH-DSS-AES256-GCM-SHA384"
#define TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256 "ADH-AES128-GCM-SHA256"
#define TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384 "ADH-AES256-GCM-SHA384"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ECDH HMAC based ciphersuites from RFC5289 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256 "ECDHE-ECDSA-AES128-SHA256"
#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384 "ECDHE-ECDSA-AES256-SHA384"
#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256 "ECDH-ECDSA-AES128-SHA256"
#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384 "ECDH-ECDSA-AES256-SHA384"
#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 "ECDHE-RSA-AES128-SHA256"
#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384 "ECDHE-RSA-AES256-SHA384"
#define TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256 "ECDH-RSA-AES128-SHA256"
#define TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384 "ECDH-RSA-AES256-SHA384"
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
/* ECDH GCM based ciphersuites from RFC5289 */
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 \
"ECDHE-ECDSA-AES128-GCM-SHA256"
#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 \
"ECDHE-ECDSA-AES256-GCM-SHA384"
#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 \
"ECDH-ECDSA-AES128-GCM-SHA256"
#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 \
"ECDH-ECDSA-AES256-GCM-SHA384"
#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 "ECDHE-RSA-AES128-GCM-SHA256"
#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384 "ECDHE-RSA-AES256-GCM-SHA384"
#define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256"
#define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384"
Implement draft-ietf-tls-chacha20-poly1305-04. Only ECDHE-based ciphers are implemented. To ease the transition, the pre-standard cipher shares a name with the standard one. The cipher rule parser is hacked up to match the name to both ciphers. From the perspective of the cipher suite configuration language, there is only one cipher. This does mean it is impossible to disable the old variant without a code change, but this situation will be very short-lived, so this is fine. Also take this opportunity to make the CK and TXT names align with convention. Change-Id: Ie819819c55bce8ff58e533f1dbc8bef5af955c21 Reviewed-on: https://boringssl-review.googlesource.com/6686 Reviewed-by: Adam Langley <agl@google.com>
2015-12-10 04:02:39 +00:00
/* For convenience, the old and new CHACHA20_POLY1305 ciphers have the same
* name. In cipher strings, both will be selected. This is temporary and will be
* removed when the pre-standard construction is removed. */
Refactor ChaCha20-Poly1305 AEAD nonce handling. This change reduces unnecessary copying and makes the pre-RFC-7539 nonces 96 bits just like the AES-GCM, AES-CCM, and RFC 7539 ChaCha20-Poly1305 cipher suites. Also, all the symbols related to the pre-RFC-7539 cipher suites now have "_OLD" appended, in preparation for adding the RFC 7539 variants. Change-Id: I1f85bd825b383c3134df0b6214266069ded029ae Reviewed-on: https://boringssl-review.googlesource.com/6103 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-04 00:53:33 +01:00
#define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_OLD \
"ECDHE-RSA-CHACHA20-POLY1305"
#define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_OLD \
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
"ECDHE-ECDSA-CHACHA20-POLY1305"
Fix even more ChaCha20 rename deadlocks. QUIC code references the TXT macro. Also get rid of TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305 which wasn't renamed for some reason. Change-Id: I0308e07104b3cec394d748f3f1146bd786d2ace2 Reviewed-on: https://boringssl-review.googlesource.com/6384 Reviewed-by: Adam Langley <agl@google.com>
2015-10-28 19:56:56 +00:00
Implement draft-ietf-tls-chacha20-poly1305-04. Only ECDHE-based ciphers are implemented. To ease the transition, the pre-standard cipher shares a name with the standard one. The cipher rule parser is hacked up to match the name to both ciphers. From the perspective of the cipher suite configuration language, there is only one cipher. This does mean it is impossible to disable the old variant without a code change, but this situation will be very short-lived, so this is fine. Also take this opportunity to make the CK and TXT names align with convention. Change-Id: Ie819819c55bce8ff58e533f1dbc8bef5af955c21 Reviewed-on: https://boringssl-review.googlesource.com/6686 Reviewed-by: Adam Langley <agl@google.com>
2015-12-10 04:02:39 +00:00
#define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 \
"ECDHE-RSA-CHACHA20-POLY1305"
#define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 \
"ECDHE-ECDSA-CHACHA20-POLY1305"
#define TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 \
"ECDHE-PSK-CHACHA20-POLY1305"
/* TODO(davidben): Remove this. Historically, the TXT names for CHACHA20_POLY1305
* were missing 'SHA256'. */
Fix even more ChaCha20 rename deadlocks. QUIC code references the TXT macro. Also get rid of TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305 which wasn't renamed for some reason. Change-Id: I0308e07104b3cec394d748f3f1146bd786d2ace2 Reviewed-on: https://boringssl-review.googlesource.com/6384 Reviewed-by: Adam Langley <agl@google.com>
2015-10-28 19:56:56 +00:00
#define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305 \
Implement draft-ietf-tls-chacha20-poly1305-04. Only ECDHE-based ciphers are implemented. To ease the transition, the pre-standard cipher shares a name with the standard one. The cipher rule parser is hacked up to match the name to both ciphers. From the perspective of the cipher suite configuration language, there is only one cipher. This does mean it is impossible to disable the old variant without a code change, but this situation will be very short-lived, so this is fine. Also take this opportunity to make the CK and TXT names align with convention. Change-Id: Ie819819c55bce8ff58e533f1dbc8bef5af955c21 Reviewed-on: https://boringssl-review.googlesource.com/6686 Reviewed-by: Adam Langley <agl@google.com>
2015-12-10 04:02:39 +00:00
TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
Update the TLS 1.3 draft version to draft 16. This should land in the same group of revisions as the two parent commits. Change-Id: Id9d769b890b3308ea70b705e7241c73cb1930ede Reviewed-on: https://boringssl-review.googlesource.com/11581 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-10-13 19:26:33 +01:00
/* TLS 1.3 ciphersuites from draft-ietf-tls-tls13-16 */
Update crypto negotation to draft 15. BUG=77 Change-Id: If568412655aae240b072c29d763a5b17bb5ca3f7 Reviewed-on: https://boringssl-review.googlesource.com/10840 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Commit-Queue: David Benjamin <davidben@google.com>
2016-09-06 19:13:43 +01:00
#define TLS1_TXT_AES_128_GCM_SHA256 "AEAD-AES128-GCM-SHA256"
#define TLS1_TXT_AES_256_GCM_SHA384 "AEAD-AES256-GCM-SHA384"
#define TLS1_TXT_CHACHA20_POLY1305_SHA256 "AEAD-CHACHA20-POLY1305-SHA256"
Adding ECDHE-PSK GCM Ciphersuites. Change-Id: Iecf534ca0ebdcf34dbf4f922f5000c096a266862 Reviewed-on: https://boringssl-review.googlesource.com/8101 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 17:07:20 +01:00
CECPQ1: change from named curve to ciphersuite. This is easier to deploy, and more obvious. This commit reverts a few pieces of e25775bc, but keeps most of it. Change-Id: If8d657a4221c665349c06041bb12fffca1527a2c Reviewed-on: https://boringssl-review.googlesource.com/8061 Reviewed-by: Adam Langley <agl@google.com>
2016-05-25 20:06:05 +01:00
Reformat SSL/TLS headers. Change-Id: Id9d848a6bb13a414d7c199674ff980c5011f92cf Reviewed-on: https://boringssl-review.googlesource.com/3000 Reviewed-by: Adam Langley <agl@google.com>
2015-01-23 23:10:10 +00:00
#define TLS_CT_RSA_SIGN 1
#define TLS_CT_DSS_SIGN 2
#define TLS_CT_RSA_FIXED_DH 3
#define TLS_CT_DSS_FIXED_DH 4
#define TLS_CT_ECDSA_SIGN 64
#define TLS_CT_RSA_FIXED_ECDH 65
#define TLS_CT_ECDSA_FIXED_ECDH 66
#define TLS_MD_MAX_CONST_SIZE 20
#define TLS_MD_CLIENT_FINISH_CONST "client finished"
#define TLS_MD_CLIENT_FINISH_CONST_SIZE 15
#define TLS_MD_SERVER_FINISH_CONST "server finished"
#define TLS_MD_SERVER_FINISH_CONST_SIZE 15
#define TLS_MD_KEY_EXPANSION_CONST "key expansion"
#define TLS_MD_KEY_EXPANSION_CONST_SIZE 13
#define TLS_MD_CLIENT_WRITE_KEY_CONST "client write key"
#define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16
#define TLS_MD_SERVER_WRITE_KEY_CONST "server write key"
#define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16
#define TLS_MD_IV_BLOCK_CONST "IV block"
#define TLS_MD_IV_BLOCK_CONST_SIZE 8
#define TLS_MD_MASTER_SECRET_CONST "master secret"
#define TLS_MD_MASTER_SECRET_CONST_SIZE 13
#define TLS_MD_EXTENDED_MASTER_SECRET_CONST "extended master secret"
#define TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE 22
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#ifdef __cplusplus
Move remaining functions out of tls1.h. Now tls1.h is just a pile of protocol constants with no more circular dependency problem. I've preserved SSL_get_servername's behavior where it's simultaneously a lookup of handshake state and local configuration. I've removed it from SSL_get_servername_type. It got the logic wrong anyway with the order of the s->session check. (Searching through code, neither is used on the client, but the SSL_get_servername one is easy.) Change-Id: I61bb8fb0858b07d76a7835bffa6dc793812fb027 Reviewed-on: https://boringssl-review.googlesource.com/6298 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-17 18:48:04 +01:00
} /* extern C */
Move public headers to include/openssl/ Previously, public headers lived next to the respective code and there were symlinks from include/openssl to them. This doesn't work on Windows. This change moves the headers to live in include/openssl. In cases where some symlinks pointed to the same header, I've added a file that just includes the intended target. These cases are all for backwards-compat. Change-Id: I6e285b74caf621c644b5168a4877db226b07fd92 Reviewed-on: https://boringssl-review.googlesource.com/1180 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-14 23:28:14 +01:00
#endif
Move remaining functions out of tls1.h. Now tls1.h is just a pile of protocol constants with no more circular dependency problem. I've preserved SSL_get_servername's behavior where it's simultaneously a lookup of handshake state and local configuration. I've removed it from SSL_get_servername_type. It got the logic wrong anyway with the order of the s->session check. (Searching through code, neither is used on the client, but the SSL_get_servername one is easy.) Change-Id: I61bb8fb0858b07d76a7835bffa6dc793812fb027 Reviewed-on: https://boringssl-review.googlesource.com/6298 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-17 18:48:04 +01:00
#endif /* OPENSSL_HEADER_TLS1_H */
Reference in New Issue Copy Permalink