ssl.h revision 1.8
1204642Srdivacky/* $OpenBSD: ssl.h,v 1.8 2014/05/20 14:21:46 reyk Exp $ */ 2204642Srdivacky/* 3204642Srdivacky * Copyright (c) 2013 Gilles Chehade <gilles@poolp.org> 4204642Srdivacky * 5204642Srdivacky * Permission to use, copy, modify, and distribute this software for any 6204642Srdivacky * purpose with or without fee is hereby granted, provided that the above 7204642Srdivacky * copyright notice and this permission notice appear in all copies. 8204642Srdivacky * 9204642Srdivacky * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10204642Srdivacky * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11204642Srdivacky * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12204642Srdivacky * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13204642Srdivacky * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14204642Srdivacky * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15204642Srdivacky * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16204642Srdivacky */ 17204642Srdivacky 18204642Srdivacky#define SSL_CIPHERS "HIGH:!aNULL:!MD5" 19204642Srdivacky#define SSL_ECDH_CURVE "prime256v1" 20204642Srdivacky#define SSL_SESSION_TIMEOUT 300 21204642Srdivacky 22204642Srdivackystruct pki { 23204642Srdivacky char pki_name[PATH_MAX]; 24204642Srdivacky 25204642Srdivacky char *pki_ca_file; 26204642Srdivacky char *pki_ca; 27204642Srdivacky off_t pki_ca_len; 28204642Srdivacky 29204642Srdivacky char *pki_cert_file; 30204642Srdivacky char *pki_cert; 31204642Srdivacky off_t pki_cert_len; 32204642Srdivacky 33204642Srdivacky char *pki_key_file; 34204642Srdivacky char *pki_key; 35204642Srdivacky off_t pki_key_len; 36204642Srdivacky 37204642Srdivacky EVP_PKEY *pki_pkey; 38204642Srdivacky 39204642Srdivacky char *pki_dhparams_file; 40204642Srdivacky char *pki_dhparams; 41204642Srdivacky off_t pki_dhparams_len; 42204642Srdivacky}; 43204642Srdivacky 44204642Srdivacky/* ssl.c */ 45204642Srdivackyvoid ssl_init(void); 46204642Srdivackyint ssl_setup(SSL_CTX **, struct pki *); 47204642SrdivackySSL_CTX *ssl_ctx_create(const char *, char *, off_t); 48204642Srdivackyint ssl_cmp(struct pki *, struct pki *); 49204642SrdivackyDH *get_dh1024(void); 50204642SrdivackyDH *get_dh_from_memory(char *, size_t); 51204642Srdivackyvoid ssl_set_ephemeral_key_exchange(SSL_CTX *, DH *); 52204642Srdivackyvoid ssl_set_ecdh_curve(SSL_CTX *, const char *); 53204642Srdivackyextern int ssl_ctx_load_verify_memory(SSL_CTX *, char *, off_t); 54204642Srdivackychar *ssl_load_file(const char *, off_t *, mode_t); 55204642Srdivackychar *ssl_load_key(const char *, off_t *, char *, mode_t, const char *); 56204642Srdivacky 57204642Srdivackyconst char *ssl_to_text(const SSL *); 58204642Srdivackyvoid ssl_error(const char *); 59204642Srdivacky 60204642Srdivackyint ssl_load_certificate(struct pki *, const char *); 61204642Srdivackyint ssl_load_keyfile(struct pki *, const char *, const char *); 62204642Srdivackyint ssl_load_cafile(struct pki *, const char *); 63204642Srdivackyint ssl_load_dhparams(struct pki *, const char *); 64204642Srdivacky 65204642Srdivackyint ssl_ctx_load_pkey(SSL_CTX *, char *, off_t, 66204642Srdivacky X509 **, EVP_PKEY **); 67204642Srdivackyint ssl_ctx_fake_private_key(SSL_CTX *, const void *, size_t, 68204642Srdivacky char *, off_t); 69204642Srdivacky 70204642Srdivacky/* ssl_privsep.c */ 71204642Srdivackyint ssl_ctx_use_certificate_chain(SSL_CTX *, char *, off_t); 72204642Srdivackyint ssl_ctx_load_verify_memory(SSL_CTX *, char *, off_t); 73204642Srdivackyint ssl_by_mem_ctrl(X509_LOOKUP *, int, const char *, long, char **); 74204642Srdivacky