diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 9a180324..b19f3e70 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -1997,8 +1997,6 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) #define SSL_ERROR_PENDING_CERTIFICATE 12 #define SSL_ERROR_WANT_PRIVATE_KEY_OPERATION 13 -#define SSL_CTRL_GET_CURVES 90 -#define SSL_CTRL_SET_CURVES 91 #define SSL_CTRL_SET_SIGALGS 97 #define SSL_CTRL_SET_CLIENT_SIGALGS 101 @@ -2095,11 +2093,17 @@ OPENSSL_EXPORT size_t SSL_get_tls_channel_id(SSL *ssl, uint8_t *out, OPENSSL_EXPORT size_t SSL_get0_certificate_types(SSL *ssl, const uint8_t **out_types); -#define SSL_get1_curves(ctx, s) SSL_ctrl(ctx, SSL_CTRL_GET_CURVES, 0, (char *)s) -#define SSL_CTX_set1_curves(ctx, clist, clistlen) \ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_CURVES, clistlen, (char *)clist) -#define SSL_set1_curves(ctx, clist, clistlen) \ - SSL_ctrl(ctx, SSL_CTRL_SET_CURVES, clistlen, (char *)clist) +/* SSL_CTX_set1_curves sets the preferred curves for |ctx| to be |curves|. Each + * element of |curves| should be a curve nid. It returns one on success and + * zero on failure. */ +OPENSSL_EXPORT int SSL_CTX_set1_curves(SSL_CTX *ctx, const int *curves, + size_t curves_len); + +/* SSL_set1_curves sets the preferred curves for |ssl| to be |curves|. Each + * element of |curves| should be a curve nid. It returns one on success and + * zero on failure. */ +OPENSSL_EXPORT int SSL_set1_curves(SSL *ssl, const int *curves, + size_t curves_len); #define SSL_CTX_set1_sigalgs(ctx, slist, slistlen) \ SSL_CTX_ctrl(ctx, SSL_CTRL_SET_SIGALGS, slistlen, (int *)slist) @@ -2719,6 +2723,7 @@ OPENSSL_EXPORT const char *SSLeay_version(int unused); #define SSL_CTRL_OPTIONS doesnt_exist #define SSL_CTRL_SESS_NUMBER doesnt_exist #define SSL_CTRL_SET_CHANNEL_ID doesnt_exist +#define SSL_CTRL_SET_CURVES doesnt_exist #define SSL_CTRL_SET_MAX_CERT_LIST doesnt_exist #define SSL_CTRL_SET_MAX_SEND_FRAGMENT doesnt_exist #define SSL_CTRL_SET_MSG_CALLBACK doesnt_exist @@ -2763,6 +2768,7 @@ OPENSSL_EXPORT const char *SSLeay_version(int unused); #define SSL_CTX_sess_set_cache_size SSL_CTX_sess_set_cache_size #define SSL_CTX_set0_chain SSL_CTX_set0_chain #define SSL_CTX_set1_chain SSL_CTX_set1_chain +#define SSL_CTX_set1_curves SSL_CTX_set1_curves #define SSL_CTX_set1_tls_channel_id SSL_CTX_set1_tls_channel_id #define SSL_CTX_set_max_cert_list SSL_CTX_set_max_cert_list #define SSL_CTX_set_max_send_fragment SSL_CTX_set_max_send_fragment @@ -2798,6 +2804,7 @@ OPENSSL_EXPORT const char *SSLeay_version(int unused); #define SSL_session_reused SSL_session_reused #define SSL_set0_chain SSL_set0_chain #define SSL_set1_chain SSL_set1_chain +#define SSL_set1_curves SSL_set1_curves #define SSL_set1_tls_channel_id SSL_set1_tls_channel_id #define SSL_set_max_cert_list SSL_set_max_cert_list #define SSL_set_max_send_fragment SSL_set_max_send_fragment diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index 7c221273..f8fbf6df 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -378,33 +378,22 @@ size_t SSL_get0_certificate_types(SSL *ssl, const uint8_t **out_types) { return ssl->s3->tmp.num_certificate_types; } +int SSL_CTX_set1_curves(SSL_CTX *ctx, const int *curves, size_t curves_len) { + return tls1_set_curves(&ctx->tlsext_ellipticcurvelist, + &ctx->tlsext_ellipticcurvelist_length, curves, + curves_len); +} + +int SSL_set1_curves(SSL *ssl, const int *curves, size_t curves_len) { + return tls1_set_curves(&ssl->tlsext_ellipticcurvelist, + &ssl->tlsext_ellipticcurvelist_length, curves, + curves_len); +} + long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) { int ret = 0; switch (cmd) { - case SSL_CTRL_GET_CURVES: { - const uint16_t *clist = s->s3->tmp.peer_ellipticcurvelist; - size_t clistlen = s->s3->tmp.peer_ellipticcurvelist_length; - if (parg) { - size_t i; - int *cptr = parg; - int nid; - for (i = 0; i < clistlen; i++) { - nid = tls1_ec_curve_id2nid(clist[i]); - if (nid != NID_undef) { - cptr[i] = nid; - } else { - cptr[i] = TLSEXT_nid_unknown | clist[i]; - } - } - } - return (int)clistlen; - } - - case SSL_CTRL_SET_CURVES: - return tls1_set_curves(&s->tlsext_ellipticcurvelist, - &s->tlsext_ellipticcurvelist_length, parg, larg); - case SSL_CTRL_SET_SIGALGS: return tls1_set_sigalgs(s->cert, parg, larg, 0); @@ -420,10 +409,6 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) { long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) { switch (cmd) { - case SSL_CTRL_SET_CURVES: - return tls1_set_curves(&ctx->tlsext_ellipticcurvelist, - &ctx->tlsext_ellipticcurvelist_length, parg, larg); - case SSL_CTRL_SET_SIGALGS: return tls1_set_sigalgs(ctx->cert, parg, larg, 0);