j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Added flag to prohibit renegotiations.

Browse source
This commit is contained in:
Thomas Pornin 2016-11-20 18:50:37 +01:00
parent 3b044d4296
commit d16eee962a
10 changed files with 626 additions and 583 deletions
Download patch file Download diff file Expand all files Collapse all files

95
inc/bearssl_ssl.h
View file

@ -574,6 +574,11 @@ typedef struct {
unsigned char reneg;
unsigned char saved_finished[24];
/*
* Behavioural flags.
*/
uint32_t flags;
/*
* Context variables for the handshake processor.
* The 'pad' must be large enough to accommodate an
@ -653,6 +658,45 @@ typedef struct {
} br_ssl_engine_context;
/*
* Get currently defined engine behavioural flags.
*/
static inline uint32_t
br_ssl_engine_get_flags(br_ssl_engine_context *cc)
{
return cc->flags;
}
/*
* Set all engine flags. Flags which are not in the 'flags' argument
* are cleared.
*/
static inline void
br_ssl_engine_set_all_flags(br_ssl_engine_context *cc, uint32_t flags)
{
cc->flags = flags;
}
/*
* Add some engine flags. The provided flags are set in the engine context,
* but other flags are untouched.
*/
static inline void
br_ssl_engine_add_flags(br_ssl_engine_context *cc, uint32_t flags)
{
cc->flags |= flags;
}
/*
* Remove some engine flags. The provided flags are cleared from the
* engine context, but other flags are untouched.
*/
static inline void
br_ssl_engine_remove_flags(br_ssl_engine_context *cc, uint32_t flags)
{
cc->flags &= ~flags;
}
/*
* Set the minimum and maximum supported protocol versions.
*/
@ -1370,11 +1414,6 @@ struct br_ssl_server_context_ {
*/
br_ssl_engine_context eng;
/*
* Flags.
*/
uint32_t flags;
/*
* Maximum version from the client.
*/
@ -1437,51 +1476,19 @@ struct br_ssl_server_context_ {
*/
};
/*
* Get currently defined server behavioural flags.
*/
static inline uint32_t
br_ssl_server_get_flags(br_ssl_server_context *cc)
{
return cc->flags;
}
/*
* Set all server flags. Flags which are not in the 'flags' argument
* are cleared.
*/
static inline void
br_ssl_server_set_all_flags(br_ssl_server_context *cc, uint32_t flags)
{
cc->flags = flags;
}
/*
* Add some server flags. The provided flags are set in the server context,
* but other flags are untouched.
*/
static inline void
br_ssl_server_add_flags(br_ssl_server_context *cc, uint32_t flags)
{
cc->flags |= flags;
}
/*
* Remove some server flags. The provided flags are cleared from the
* server context, but other flags are untouched.
*/
static inline void
br_ssl_server_remove_flags(br_ssl_server_context *cc, uint32_t flags)
{
cc->flags &= ~flags;
}
/*
* If this flag is set, then the server will enforce its own cipher suite
* preference order; otherwise, it follows the client preferences.
*/
#define BR_OPT_ENFORCE_SERVER_PREFERENCES ((uint32_t)1 << 0)
/*
* If this flag is set, then renegotiations are rejected unconditionally:
* they won't be honoured if asked for programmatically, and requests from
* the peer are rejected.
*/
#define BR_OPT_NO_RENEGOTIATION ((uint32_t)1 << 1)
/*
* Each br_ssl_server_init_xxx() function sets the list of supported
* cipher suites and used implementations, as specified by the profile