#include "includes.h"#include <openssl/ssl.h>#include <openssl/err.h>#include <openssl/pkcs12.h>#include <openssl/x509v3.h>#include "common.h"#include "crypto.h"#include "tls.h"
Go to the source code of this file.
Classes | |
| struct | tls_connection |
| struct | tls_global |
Defines | |
| #define | OPENSSL_d2i_TYPE unsigned char ** |
| #define | OPENSSL_NO_ENGINE |
Functions | |
| static struct wpabuf * | get_x509_cert (X509 *cert) |
| static struct wpabuf * | openssl_connection_handshake (struct tls_connection *conn, const struct wpabuf *in_data, struct wpabuf **appl_data, int server) |
| static struct wpabuf * | openssl_get_appl_data (struct tls_connection *conn, size_t max_len) |
| static struct wpabuf * | openssl_handshake (struct tls_connection *conn, const struct wpabuf *in_data, int server) |
| static void | openssl_tls_cert_event (struct tls_connection *conn, X509 *err_cert, int depth, const char *subject) |
| static void | openssl_tls_fail_event (struct tls_connection *conn, X509 *err_cert, int err, int depth, const char *subject, const char *err_str, enum tls_fail_reason reason) |
| static enum tls_fail_reason | openssl_tls_fail_reason (int err) |
| static void | ssl_info_cb (const SSL *ssl, int where, int ret) |
| unsigned int | tls_capabilities (void *tls_ctx) |
| static int | tls_connection_ca_cert (void *_ssl_ctx, struct tls_connection *conn, const char *ca_cert, const u8 *ca_cert_blob, size_t ca_cert_blob_len, const char *ca_path) |
| static int | tls_connection_client_cert (struct tls_connection *conn, const char *client_cert, const u8 *client_cert_blob, size_t client_cert_blob_len) |
| struct wpabuf * | tls_connection_decrypt (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data) |
| void | tls_connection_deinit (void *ssl_ctx, struct tls_connection *conn) |
| static int | tls_connection_dh (struct tls_connection *conn, const char *dh_file) |
| int | tls_connection_enable_workaround (void *ssl_ctx, struct tls_connection *conn) |
| struct wpabuf * | tls_connection_encrypt (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data) |
| static int | tls_connection_engine_ca_cert (void *_ssl_ctx, struct tls_connection *conn, const char *ca_cert_id) |
| static int | tls_connection_engine_client_cert (struct tls_connection *conn, const char *cert_id) |
| static int | tls_connection_engine_private_key (struct tls_connection *conn) |
| int | tls_connection_established (void *ssl_ctx, struct tls_connection *conn) |
| int | tls_connection_get_failed (void *ssl_ctx, struct tls_connection *conn) |
| int | tls_connection_get_keyblock_size (void *tls_ctx, struct tls_connection *conn) |
| int | tls_connection_get_keys (void *ssl_ctx, struct tls_connection *conn, struct tls_keys *keys) |
| int | tls_connection_get_read_alerts (void *ssl_ctx, struct tls_connection *conn) |
| int | tls_connection_get_write_alerts (void *ssl_ctx, struct tls_connection *conn) |
| struct wpabuf * | tls_connection_handshake (void *ssl_ctx, struct tls_connection *conn, const struct wpabuf *in_data, struct wpabuf **appl_data) |
| int | tls_connection_ia_final_phase_finished (void *tls_ctx, struct tls_connection *conn) |
| int | tls_connection_ia_permute_inner_secret (void *tls_ctx, struct tls_connection *conn, const u8 *key, size_t key_len) |
| struct wpabuf * | tls_connection_ia_send_phase_finished (void *tls_ctx, struct tls_connection *conn, int final) |
| struct tls_connection * | tls_connection_init (void *ssl_ctx) |
| int | tls_connection_prf (void *tls_ctx, struct tls_connection *conn, const char *label, int server_random_first, u8 *out, size_t out_len) |
| static int | tls_connection_private_key (void *_ssl_ctx, struct tls_connection *conn, const char *private_key, const char *private_key_passwd, const u8 *private_key_blob, size_t private_key_blob_len) |
| int | tls_connection_resumed (void *ssl_ctx, struct tls_connection *conn) |
| struct wpabuf * | tls_connection_server_handshake (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data, struct wpabuf **appl_data) |
| int | tls_connection_set_cipher_list (void *tls_ctx, struct tls_connection *conn, u8 *ciphers) |
| int | tls_connection_set_ia (void *tls_ctx, struct tls_connection *conn, int tls_ia) |
| int | tls_connection_set_params (void *tls_ctx, struct tls_connection *conn, const struct tls_connection_params *params) |
| int | tls_connection_set_session_ticket_cb (void *tls_ctx, struct tls_connection *conn, tls_session_ticket_cb cb, void *ctx) |
| static int | tls_connection_set_subject_match (struct tls_connection *conn, const char *subject_match, const char *altsubject_match) |
| int | tls_connection_set_verify (void *ssl_ctx, struct tls_connection *conn, int verify_peer) |
| int | tls_connection_shutdown (void *ssl_ctx, struct tls_connection *conn) |
| static int | tls_cryptoapi_cert (SSL *ssl, const char *name) |
| void | tls_deinit (void *ssl_ctx) |
| static void | tls_engine_deinit (struct tls_connection *conn) |
| static int | tls_engine_init (struct tls_connection *conn, const char *engine_id, const char *pin, const char *key_id, const char *cert_id, const char *ca_cert_id) |
| int | tls_get_cipher (void *ssl_ctx, struct tls_connection *conn, char *buf, size_t buflen) |
| int | tls_get_errors (void *ssl_ctx) |
| static int | tls_global_ca_cert (SSL_CTX *ssl_ctx, const char *ca_cert) |
| static int | tls_global_client_cert (SSL_CTX *ssl_ctx, const char *client_cert) |
| static int | tls_global_dh (SSL_CTX *ssl_ctx, const char *dh_file) |
| static int | tls_global_private_key (SSL_CTX *ssl_ctx, const char *private_key, const char *private_key_passwd) |
| int | tls_global_set_params (void *tls_ctx, const struct tls_connection_params *params) |
| int | tls_global_set_verify (void *ssl_ctx, int check_crl) |
| void * | tls_init (const struct tls_config *conf) |
| static int | tls_load_ca_der (void *_ssl_ctx, const char *ca_cert) |
| static int | tls_match_altsubject (X509 *cert, const char *match) |
| static int | tls_match_altsubject_component (X509 *cert, int type, const char *value, size_t len) |
| static int | tls_passwd_cb (char *buf, int size, int rwflag, void *password) |
| static int | tls_read_pkcs12 (SSL_CTX *ssl_ctx, SSL *ssl, const char *private_key, const char *passwd) |
| static int | tls_read_pkcs12_blob (SSL_CTX *ssl_ctx, SSL *ssl, const u8 *blob, size_t len, const char *passwd) |
| static void | tls_show_errors (int level, const char *func, const char *txt) |
| static int | tls_verify_cb (int preverify_ok, X509_STORE_CTX *x509_ctx) |
Variables | |
| static struct tls_global * | tls_global = NULL |
| static int | tls_openssl_ref_count = 0 |
Define Documentation
| #define OPENSSL_d2i_TYPE unsigned char ** |
Definition at line 38 of file tls_openssl.c.
| #define OPENSSL_NO_ENGINE |
Definition at line 19 of file tls_openssl.c.
Function Documentation
| static struct wpabuf* get_x509_cert | ( | X509 * | cert | ) | [static, read] |
Definition at line 1083 of file tls_openssl.c.
| static struct wpabuf* openssl_connection_handshake | ( | struct tls_connection * | conn, |
| const struct wpabuf * | in_data, | ||
| struct wpabuf ** | appl_data, | ||
| int | server | ||
| ) | [static, read] |
Definition at line 2343 of file tls_openssl.c.
| static struct wpabuf* openssl_get_appl_data | ( | struct tls_connection * | conn, |
| size_t | max_len | ||
| ) | [static, read] |
Definition at line 2308 of file tls_openssl.c.
| static struct wpabuf* openssl_handshake | ( | struct tls_connection * | conn, |
| const struct wpabuf * | in_data, | ||
| int | server | ||
| ) | [static, read] |
Definition at line 2239 of file tls_openssl.c.
| static void openssl_tls_cert_event | ( | struct tls_connection * | conn, |
| X509 * | err_cert, | ||
| int | depth, | ||
| const char * | subject | ||
| ) | [static] |
Definition at line 1126 of file tls_openssl.c.
| static void openssl_tls_fail_event | ( | struct tls_connection * | conn, |
| X509 * | err_cert, | ||
| int | err, | ||
| int | depth, | ||
| const char * | subject, | ||
| const char * | err_str, | ||
| enum tls_fail_reason | reason | ||
| ) | [static] |
Definition at line 1102 of file tls_openssl.c.
| static enum tls_fail_reason openssl_tls_fail_reason | ( | int | err | ) | [static] |
Definition at line 1045 of file tls_openssl.c.
| static void ssl_info_cb | ( | const SSL * | ssl, |
| int | where, | ||
| int | ret | ||
| ) | [static] |
Definition at line 494 of file tls_openssl.c.
| unsigned int tls_capabilities | ( | void * | tls_ctx | ) |
tls_capabilities - Get supported TLS capabilities : TLS context data from tls_init() Returns: Bit field of supported TLS capabilities (TLS_CAPABILITY_*)
Definition at line 2728 of file tls_openssl.c.
| static int tls_connection_ca_cert | ( | void * | _ssl_ctx, |
| struct tls_connection * | conn, | ||
| const char * | ca_cert, | ||
| const u8 * | ca_cert_blob, | ||
| size_t | ca_cert_blob_len, | ||
| const char * | ca_path | ||
| ) | [static] |
Definition at line 1293 of file tls_openssl.c.
| static int tls_connection_client_cert | ( | struct tls_connection * | conn, |
| const char * | client_cert, | ||
| const u8 * | client_cert_blob, | ||
| size_t | client_cert_blob_len | ||
| ) | [static] |
Definition at line 1531 of file tls_openssl.c.
| struct wpabuf* tls_connection_decrypt | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const struct wpabuf * | in_data | ||
| ) | [read] |
tls_connection_decrypt - Decrypt data from TLS tunnel : TLS context data from tls_init() : Connection context data from tls_connection_init() : Encrypted TLS data Returns: Decrypted TLS data or NULL on failure
This function is used after TLS handshake has been completed successfully to receive data from the encrypted tunnel. The caller is responsible for freeing the returned output data.
Definition at line 2421 of file tls_openssl.c.
| void tls_connection_deinit | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_deinit - Free TLS connection data : TLS context data from tls_init() : Connection context data from tls_connection_init()
Release all resources allocated for TLS connection.
Definition at line 947 of file tls_openssl.c.
| static int tls_connection_dh | ( | struct tls_connection * | conn, |
| const char * | dh_file | ||
| ) | [static] |
Definition at line 2059 of file tls_openssl.c.
| int tls_connection_enable_workaround | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_enable_workaround - Enable TLS workaround options : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 0 on success, -1 on failure
This function is used to enable connection-specific workaround options for buffer SSL/TLS implementations.
Definition at line 2542 of file tls_openssl.c.
| struct wpabuf* tls_connection_encrypt | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const struct wpabuf * | in_data | ||
| ) | [read] |
tls_connection_encrypt - Encrypt data into TLS tunnel : TLS context data from tls_init() : Connection context data from tls_connection_init() : Plaintext data to be encrypted Returns: Encrypted TLS data or NULL on failure
This function is used after TLS handshake has been completed successfully to send data in the encrypted tunnel. The caller is responsible for freeing the returned output data.
Definition at line 2381 of file tls_openssl.c.
| static int tls_connection_engine_ca_cert | ( | void * | _ssl_ctx, |
| struct tls_connection * | conn, | ||
| const char * | ca_cert_id | ||
| ) | [static] |
Definition at line 1801 of file tls_openssl.c.
| static int tls_connection_engine_client_cert | ( | struct tls_connection * | conn, |
| const char * | cert_id | ||
| ) | [static] |
Definition at line 1775 of file tls_openssl.c.
| static int tls_connection_engine_private_key | ( | struct tls_connection * | conn | ) | [static] |
Definition at line 1848 of file tls_openssl.c.
| int tls_connection_established | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_established - Has the TLS connection been completed? : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 1 if TLS connection has been completed, 0 if not.
Definition at line 960 of file tls_openssl.c.
| int tls_connection_get_failed | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_get_failed - Get connection failure status : TLS context data from tls_init() : Connection context data from tls_connection_init()
Returns >0 if connection has failed, 0 if not.
Definition at line 2577 of file tls_openssl.c.
| int tls_connection_get_keyblock_size | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_get_keyblock_size - Get TLS key_block size : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: Size of the key_block for the negotiated cipher suite or -1 on failure
Definition at line 2703 of file tls_openssl.c.
| int tls_connection_get_keys | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| struct tls_keys * | keys | ||
| ) |
tls_connection_get_keys - Get master key and random data from TLS connection : TLS context data from tls_init() : Connection context data from tls_connection_init() : Structure of key/random data (filled on success) Returns: 0 on success, -1 on failure
Definition at line 2207 of file tls_openssl.c.
| int tls_connection_get_read_alerts | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_get_read_alerts - Get connection read alert status : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: Number of times a fatal read (remote end reported error) has happened during this connection.
Definition at line 2585 of file tls_openssl.c.
| int tls_connection_get_write_alerts | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_get_write_alerts - Get connection write alert status : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: Number of times a fatal write (locally detected error) has happened during this connection.
Definition at line 2593 of file tls_openssl.c.
| struct wpabuf* tls_connection_handshake | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const struct wpabuf * | in_data, | ||
| struct wpabuf ** | appl_data | ||
| ) | [read] |
tls_connection_handshake - Process TLS handshake (client side) : TLS context data from tls_init() : Connection context data from tls_connection_init() : Input data from TLS server : Pointer to application data pointer, or NULL if dropped Returns: Output data, NULL on failure
The caller is responsible for freeing the returned output data. If the final handshake message includes application data, this is decrypted and appl_data (if not NULL) is set to point this data. The caller is responsible for freeing appl_data.
This function is used during TLS handshake. The first call is done with in_data == NULL and the library is expected to return ClientHello packet. This packet is then send to the server and a response from server is given to TLS library by calling this function again with in_data pointing to the TLS message from the server.
If the TLS handshake fails, this function may return NULL. However, if the TLS library has a TLS alert to send out, that should be returned as the output data. In this case, tls_connection_get_failed() must return failure (> 0).
tls_connection_established() should return 1 once the TLS handshake has been completed successfully.
Definition at line 2364 of file tls_openssl.c.
| int tls_connection_ia_final_phase_finished | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_ia_final_phase_finished - Has final phase been completed : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 1 if valid FinalPhaseFinished has been received, 0 if not, or -1 on failure
Definition at line 2748 of file tls_openssl.c.
| int tls_connection_ia_permute_inner_secret | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const u8 * | key, | ||
| size_t | key_len | ||
| ) |
tls_connection_ia_permute_inner_secret - Permute TLS/IA inner secret : TLS context data from tls_init() : Connection context data from tls_connection_init() : Session key material (session_key vectors with 2-octet length), or NULL if no session key was generating in the current phase : Length of session key material Returns: 0 on success, -1 on failure
Definition at line 2755 of file tls_openssl.c.
| struct wpabuf* tls_connection_ia_send_phase_finished | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| int | final | ||
| ) | [read] |
tls_connection_ia_send_phase_finished - Send a TLS/IA PhaseFinished message : TLS context data from tls_init() : Connection context data from tls_connection_init() : 1 = FinalPhaseFinished, 0 = IntermediatePhaseFinished Returns: Encrypted TLS/IA data, NULL on failure
This function is used to send the TLS/IA end phase message, e.g., when the EAP server completes EAP-TTLSv1.
Definition at line 2741 of file tls_openssl.c.
| struct tls_connection* tls_connection_init | ( | void * | tls_ctx | ) | [read] |
tls_connection_init - Initialize a new TLS connection : TLS context data from tls_init() Returns: Connection context data, conn for other function calls
Definition at line 897 of file tls_openssl.c.
| int tls_connection_prf | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const char * | label, | ||
| int | server_random_first, | ||
| u8 * | out, | ||
| size_t | out_len | ||
| ) |
tls_connection_prf - Use TLS-PRF to derive keying material : TLS context data from tls_init() : Connection context data from tls_connection_init() : Label (e.g., description of the key) for PRF : seed is 0 = client_random|server_random, 1 = server_random|client_random : Buffer for output data from TLS-PRF : Length of the output buffer Returns: 0 on success, -1 on failure
This function is optional to implement if tls_connection_get_keys() provides access to master secret and server/client random values. If these values are not exported from the TLS library, tls_connection_prf() is required so that further keying material can be derived from the master secret. If not implemented, the function will still need to be defined, but it can just return -1. Example implementation of this function is in tls_prf() function when it is called with seed set to client_random|server_random (or server_random|client_random).
Definition at line 2230 of file tls_openssl.c.
| static int tls_connection_private_key | ( | void * | _ssl_ctx, |
| struct tls_connection * | conn, | ||
| const char * | private_key, | ||
| const char * | private_key_passwd, | ||
| const u8 * | private_key_blob, | ||
| size_t | private_key_blob_len | ||
| ) | [static] |
Definition at line 1870 of file tls_openssl.c.
| int tls_connection_resumed | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_resumed - Was session resumption used : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 1 if current session used session resumption, 0 if not
Definition at line 2464 of file tls_openssl.c.
| struct wpabuf* tls_connection_server_handshake | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const struct wpabuf * | in_data, | ||
| struct wpabuf ** | appl_data | ||
| ) | [read] |
tls_connection_server_handshake - Process TLS handshake (server side) : TLS context data from tls_init() : Connection context data from tls_connection_init() : Input data from TLS peer : Pointer to application data pointer, or NULL if dropped Returns: Output data, NULL on failure
The caller is responsible for freeing the returned output data.
Definition at line 2372 of file tls_openssl.c.
| int tls_connection_set_cipher_list | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| u8 * | ciphers | ||
| ) |
tls_connection_set_cipher_list - Configure acceptable cipher suites : TLS context data from tls_init() : Connection context data from tls_connection_init() : Zero (TLS_CIPHER_NONE) terminated list of allowed ciphers (TLS_CIPHER_*). Returns: 0 on success, -1 on failure
Definition at line 2470 of file tls_openssl.c.
| int tls_connection_set_ia | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| int | tls_ia | ||
| ) |
tls_connection_set_ia - Set TLS/IA parameters : TLS context data from tls_init() : Connection context data from tls_connection_init() : 1 = enable TLS/IA Returns: 0 on success, -1 on failure
This function is used to configure TLS/IA in server mode where tls_connection_set_params() is not used.
Definition at line 2734 of file tls_openssl.c.
| int tls_connection_set_params | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| const struct tls_connection_params * | params | ||
| ) |
tls_connection_set_params - Set TLS connection parameters : TLS context data from tls_init() : Connection context data from tls_connection_init() : Connection parameters Returns: 0 on success, -1 on failure, TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED (-2) on possible PIN error causing PKCS#11 engine failure, or TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED (-3) on failure to verify the PKCS#11 engine private key.
Definition at line 2601 of file tls_openssl.c.
| int tls_connection_set_session_ticket_cb | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| tls_session_ticket_cb | cb, | ||
| void * | ctx | ||
| ) |
Definition at line 2879 of file tls_openssl.c.
| static int tls_connection_set_subject_match | ( | struct tls_connection * | conn, |
| const char * | subject_match, | ||
| const char * | altsubject_match | ||
| ) | [static] |
Definition at line 1470 of file tls_openssl.c.
| int tls_connection_set_verify | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| int | verify_peer | ||
| ) |
tls_connection_set_verify - Set certificate verification options : TLS context data from tls_init() : Connection context data from tls_connection_init() : 1 = verify peer certificate Returns: 0 on success, -1 on failure
Definition at line 1494 of file tls_openssl.c.
| int tls_connection_shutdown | ( | void * | tls_ctx, |
| struct tls_connection * | conn | ||
| ) |
tls_connection_shutdown - Shutdown TLS connection : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 0 on success, -1 on failure
Shutdown current TLS connection without releasing all resources. New connection can be started by using the same conn without having to call tls_connection_init() or setting certificates etc. again. The new connection should try to use session resumption.
Definition at line 966 of file tls_openssl.c.
| static int tls_cryptoapi_cert | ( | SSL * | ssl, |
| const char * | name | ||
| ) | [static] |
Definition at line 486 of file tls_openssl.c.
| void tls_deinit | ( | void * | tls_ctx | ) |
tls_deinit - Deinitialize TLS library : TLS context data from tls_init()
Called once during program shutdown and once for each RSN pre-authentication session. If global library deinitialization is needed (i.e., one that is shared between both authentication types), the TLS library wrapper should maintain a reference counter and do global deinitialization only when moving from 1 to 0 references.
Definition at line 763 of file tls_openssl.c.
| static void tls_engine_deinit | ( | struct tls_connection * | conn | ) | [static] |
Definition at line 867 of file tls_openssl.c.
| static int tls_engine_init | ( | struct tls_connection * | conn, |
| const char * | engine_id, | ||
| const char * | pin, | ||
| const char * | key_id, | ||
| const char * | cert_id, | ||
| const char * | ca_cert_id | ||
| ) | [static] |
Definition at line 783 of file tls_openssl.c.
| int tls_get_cipher | ( | void * | tls_ctx, |
| struct tls_connection * | conn, | ||
| char * | buf, | ||
| size_t | buflen | ||
| ) |
tls_get_cipher - Get current cipher name : TLS context data from tls_init() : Connection context data from tls_connection_init() : Buffer for the cipher name : buf size Returns: 0 on success, -1 on failure
Get the name of the currently used cipher.
Definition at line 2526 of file tls_openssl.c.
| int tls_get_errors | ( | void * | tls_ctx | ) |
tls_get_errors - Process pending errors : TLS context data from tls_init() Returns: Number of found error, 0 if no errors detected.
Process all pending TLS errors.
Definition at line 883 of file tls_openssl.c.
| static int tls_global_ca_cert | ( | SSL_CTX * | ssl_ctx, |
| const char * | ca_cert | ||
| ) | [static] |
Definition at line 1425 of file tls_openssl.c.
| static int tls_global_client_cert | ( | SSL_CTX * | ssl_ctx, |
| const char * | client_cert | ||
| ) | [static] |
Definition at line 1581 of file tls_openssl.c.
| static int tls_global_dh | ( | SSL_CTX * | ssl_ctx, |
| const char * | dh_file | ||
| ) | [static] |
Definition at line 2133 of file tls_openssl.c.
| static int tls_global_private_key | ( | SSL_CTX * | ssl_ctx, |
| const char * | private_key, | ||
| const char * | private_key_passwd | ||
| ) | [static] |
Definition at line 2014 of file tls_openssl.c.
| int tls_global_set_params | ( | void * | tls_ctx, |
| const struct tls_connection_params * | params | ||
| ) |
tls_global_set_params - Set TLS parameters for all TLS connection : TLS context data from tls_init() : Global TLS parameters Returns: 0 on success, -1 on failure, TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED (-2) on possible PIN error causing PKCS#11 engine failure, or TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED (-3) on failure to verify the PKCS#11 engine private key.
Definition at line 2672 of file tls_openssl.c.
| int tls_global_set_verify | ( | void * | tls_ctx, |
| int | check_crl | ||
| ) |
tls_global_set_verify - Set global certificate verification options : TLS context data from tls_init() : 0 = do not verify CRLs, 1 = verify CRL for the user certificate, 2 = verify CRL for all certificates Returns: 0 on success, -1 on failure
Definition at line 1449 of file tls_openssl.c.
| void* tls_init | ( | const struct tls_config * | conf | ) |
tls_init - Initialize TLS library : Configuration data for TLS library Returns: Context data to be used as tls_ctx in calls to other functions, or NULL on failure.
Called once during program startup and once for each RSN pre-authentication session. In other words, there can be two concurrent TLS contexts. If global library initialization is needed (i.e., one that is shared between both authentication types), the TLS library wrapper should maintain a reference counter and do global initialization only when moving from 0 to 1 reference.
Definition at line 679 of file tls_openssl.c.
| static int tls_load_ca_der | ( | void * | _ssl_ctx, |
| const char * | ca_cert | ||
| ) | [static] |
Definition at line 1261 of file tls_openssl.c.
| static int tls_match_altsubject | ( | X509 * | cert, |
| const char * | match | ||
| ) | [static] |
Definition at line 1002 of file tls_openssl.c.
| static int tls_match_altsubject_component | ( | X509 * | cert, |
| int | type, | ||
| const char * | value, | ||
| size_t | len | ||
| ) | [static] |
Definition at line 980 of file tls_openssl.c.
| static int tls_passwd_cb | ( | char * | buf, |
| int | size, | ||
| int | rwflag, | ||
| void * | password | ||
| ) | [static] |
Definition at line 1605 of file tls_openssl.c.
| static int tls_read_pkcs12 | ( | SSL_CTX * | ssl_ctx, |
| SSL * | ssl, | ||
| const char * | private_key, | ||
| const char * | passwd | ||
| ) | [static] |
Definition at line 1691 of file tls_openssl.c.
| static int tls_read_pkcs12_blob | ( | SSL_CTX * | ssl_ctx, |
| SSL * | ssl, | ||
| const u8 * | blob, | ||
| size_t | len, | ||
| const char * | passwd | ||
| ) | [static] |
Definition at line 1721 of file tls_openssl.c.
| static void tls_show_errors | ( | int | level, |
| const char * | func, | ||
| const char * | txt | ||
| ) | [static] |
Definition at line 101 of file tls_openssl.c.
| static int tls_verify_cb | ( | int | preverify_ok, |
| X509_STORE_CTX * | x509_ctx | ||
| ) | [static] |
Definition at line 1163 of file tls_openssl.c.
Variable Documentation
struct tls_global* tls_global = NULL [static] |
Definition at line 59 of file tls_openssl.c.
int tls_openssl_ref_count = 0 [static] |
Definition at line 51 of file tls_openssl.c.