Archives/SSLproxy
2
0
Fork 0
mirror of https://github.com/sonertari/SSLproxy synced 2024-11-18 03:25:31 +00:00
Code Issues Packages Projects Releases Wiki Activity
88973e1757
SSLproxy/ssl.h

205 lines
7.2 KiB
C
Raw Normal View History

Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
/*
Update copyright, license and tagline - Update copyright to 2015 - Remove the non-standard "unmodified" from the 2-clause BSD license - Remove scalable from the tagline to avoid misinterpretations
2015-02-24 18:19:20 +00:00
* SSLsplit - transparent SSL/TLS interception
* Copyright (c) 2009-2015, Daniel Roethlisberger <daniel@roe.ch>
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
* All rights reserved.
* http://www.roe.ch/SSLsplit
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
Update copyright, license and tagline - Update copyright to 2015 - Remove the non-standard "unmodified" from the 2-clause BSD license - Remove scalable from the tagline to avoid misinterpretations
2015-02-24 18:19:20 +00:00
* notice, this list of conditions, and the following disclaimer.
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef SSL_H
#define SSL_H
#include "attrib.h"
#include <openssl/opensslv.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
State why ECDH is disabled with OpenSSL < 1.0.0e
2012-05-11 16:03:07 +00:00
/*
* ECDH is disabled when building against OpenSSL < 1.0.0e due to issues with
* thread-safety and security in server mode ephemereal ECDH cipher suites.
* http://www.openssl.org/news/secadv_20110906.txt
*/
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#if (OPENSSL_VERSION_NUMBER < 0x10000000L) && !defined(OPENSSL_NO_THREADID)
#define OPENSSL_NO_THREADID
#endif
#if (OPENSSL_VERSION_NUMBER < 0x0090806FL) && !defined(OPENSSL_NO_TLSEXT)
#define OPENSSL_NO_TLSEXT
#endif
#if (OPENSSL_VERSION_NUMBER < 0x1000005FL) && !defined(OPENSSL_NO_ECDH)
#define OPENSSL_NO_ECDH
#endif
#if (OPENSSL_VERSION_NUMBER < 0x0090802FL) && !defined(OPENSSL_NO_ECDSA)
#define OPENSSL_NO_ECDSA
#endif
#if (OPENSSL_VERSION_NUMBER < 0x0090802FL) && !defined(OPENSSL_NO_EC)
#define OPENSSL_NO_EC
#endif
Fix SSL_METHOD* const mismatch on OpenSSL < 1.0.0
2014-11-19 21:38:21 +00:00
/*
* The constructors returning a SSL_METHOD * were changed to return
* a const SSL_METHOD * between 0.9.8 and 1.0.0.
*/
#if (OPENSSL_VERSION_NUMBER < 0x1000000fL)
#define CONST_SSL_METHOD SSL_METHOD
#else /* >= OpenSSL 1.0.0 */
#define CONST_SSL_METHOD const SSL_METHOD
#endif /* >= OpensSL 1.0.0 */
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
/*
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
* Workaround for bug in OpenSSL 0.9.8y, 1.0.0k and 1.0.1e
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
* http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703031
* http://openssl.6102.n7.nabble.com/NULL-ptr-deref-when-calling-SSL-get-certificate-with-1-0-0k-td43636.html
*/
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
#if (OPENSSL_VERSION_NUMBER == 0x0090819fL) || \
(OPENSSL_VERSION_NUMBER == 0x100000bfL) || \
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
(OPENSSL_VERSION_NUMBER == 0x1000105fL)
#define SSL_get_certificate(x) ssl_ssl_cert_get(x)
X509 * ssl_ssl_cert_get(SSL *);
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
#endif /* OpenSSL 0.9.8y or 1.0.0k or 1.0.1e */
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
/*
* SSL_OP_NO_* is used as an indication that OpenSSL is sufficiently recent
* to have the respective protocol implemented.
*
* OPENSSL_NO_SSL2 indicates the complete removal of SSL 2.0 support.
*
* OPENSSL_NO_SSL3 indicates that no SSL 3.0 connections will be made by
* default, but support is still present, unless OPENSSL_NO_SSL3_METHOD is
* also defined.
*/
#if defined(SSL_OP_NO_SSLv2) && !defined(OPENSSL_NO_SSL2) && \
defined(WITH_SSLV2)
#define HAVE_SSLV2
#endif /* SSL_OP_NO_SSLv2 && !OPENSSL_NO_SSL2 && WITH_SSLV2 */
#if defined(SSL_OP_NO_SSLv3) && !defined(OPENSSL_NO_SSL3_METHOD)
#define HAVE_SSLV3
#endif /* SSL_OP_NO_SSLv2 && !OPENSSL_NO_SSL3_METHOD */
#ifdef SSL_OP_NO_TLSv1
#define HAVE_TLSV10
#endif /* SSL_OP_NO_TLSv1 */
#ifdef SSL_OP_NO_TLSv1_1
#define HAVE_TLSV11
#endif /* SSL_OP_NO_TLSv1_1 */
#ifdef SSL_OP_NO_TLSv1_2
#define HAVE_TLSV12
#endif /* SSL_OP_NO_TLSv1_2 */
#ifdef HAVE_SSLV2
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL2_S "ssl2 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_SSLV2 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL2_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_SSLV2 */
#ifdef HAVE_SSLV3
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL3_S "ssl3 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_SSLV3 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL3_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_SSLV3 */
#ifdef HAVE_TLSV10
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS10_S "tls10 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_TLSV10 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS10_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_TLSV10 */
#ifdef HAVE_TLSV11
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS11_S "tls11 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_TLSV11 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS11_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_TLSV11 */
#ifdef HAVE_TLSV12
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS12_S "tls12 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_TLSV12 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS12_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_TLSV12 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL_PROTO_SUPPORT_S SSL2_S SSL3_S TLS10_S TLS11_S TLS12_S
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
void ssl_openssl_version(void);
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
int ssl_init(void) WUNRES;
Reinitialize SSL mutexes after fork See issue #5.
2012-10-16 22:11:53 +00:00
void ssl_reinit(void);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
void ssl_fini(void);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_sha1_to_str(unsigned char *, int) NONNULL(1) MALLOC;
Print status of free'd SSL structs in debug mode
2014-01-11 16:28:41 +00:00
char * ssl_ssl_state_to_str(SSL *) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_DH
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
DH * ssl_tmp_dh_callback(SSL *, int, int) NONNULL(1) MALLOC;
DH * ssl_dh_load(const char *) NONNULL(1) MALLOC;
void ssl_dh_refcount_inc(DH *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_DH */
Generic EC loading, new default curve 'secp160r2'
2012-05-11 15:39:12 +00:00
#ifndef OPENSSL_NO_EC
EC_KEY * ssl_ec_by_name(const char *) MALLOC;
#endif /* !OPENSSL_NO_EC */
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
EVP_PKEY * ssl_key_load(const char *) NONNULL(1) MALLOC;
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
EVP_PKEY * ssl_key_genrsa(const int) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
void ssl_key_refcount_inc(EVP_PKEY *) NONNULL(1);
Add ssl_key_identifier_sha1() utility function Issue: #67
2014-12-12 16:38:34 +00:00
#define SSL_KEY_IDSZ 20
int ssl_key_identifier_sha1(EVP_PKEY *, unsigned char *) NONNULL(1,2);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_key_identifier(EVP_PKEY *, int) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_TLSEXT
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_v3ext_add(X509V3_CTX *, X509 *, char *, char *) NONNULL(1,2,3,4);
int ssl_x509_v3ext_copy_by_nid(X509 *, X509 *, int) NONNULL(1,2);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_TLSEXT */
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_serial_copyrand(X509 *, X509 *) NONNULL(1,2);
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
X509 * ssl_x509_forge(X509 *, EVP_PKEY *, X509 *, const char *, EVP_PKEY *)
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
NONNULL(1,2,3,5) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
X509 * ssl_x509_load(const char *) NONNULL(1) MALLOC;
char * ssl_x509_subject(X509 *) NONNULL(1) MALLOC;
char * ssl_x509_subject_cn(X509 *, size_t *) NONNULL(1,2) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#define SSL_X509_FPRSZ 20
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_fingerprint_sha1(X509 *, unsigned char *) NONNULL(1,2);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_x509_fingerprint(X509 *, int) NONNULL(1) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char ** ssl_x509_names(X509 *) NONNULL(1) MALLOC;
int ssl_x509_names_match(X509 *, const char *) NONNULL(1,2);
char * ssl_x509_names_to_str(X509 *) NONNULL(1) MALLOC;
Add OCSP URL parsing
2012-04-17 21:03:59 +00:00
char ** ssl_x509_aias(X509 *, const int) NONNULL(1) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char ** ssl_x509_ocsps(X509 *) NONNULL(1) MALLOC;
int ssl_x509_is_valid(X509 *) NONNULL(1) WUNRES;
char * ssl_x509_to_str(X509 *) NONNULL(1) MALLOC;
char * ssl_x509_to_pem(X509 *) NONNULL(1) MALLOC;
void ssl_x509_refcount_inc(X509 *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
int ssl_x509chain_load(X509 **, STACK_OF(X509) **, const char *) NONNULL(2,3);
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
void ssl_x509chain_use(SSL_CTX *, X509 *, STACK_OF(X509) *) NONNULL(1,2,3);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char * ssl_session_to_str(SSL_SESSION *) NONNULL(1) MALLOC;
int ssl_session_is_valid(SSL_SESSION *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_is_ocspreq(const unsigned char *, size_t) NONNULL(1) WUNRES;
Add facility to recognize OCSP requests
2012-04-22 16:02:58 +00:00
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_TLSEXT
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
char * ssl_tls_clienthello_parse_sni(const unsigned char *, ssize_t *)
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
NONNULL(1,2) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_TLSEXT */
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
int ssl_dnsname_match(const char *, size_t, const char *, size_t)
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
NONNULL(1,3) WUNRES;
char * ssl_wildcardify(const char *) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !SSL_H */
/* vim: set noet ft=c: */
Reference in New Issue Copy Permalink