diff options
| author | Emilia Kasper <emilia@openssl.org> | 2015-09-22 15:20:26 +0200 |
|---|---|---|
| committer | Emilia Kasper <emilia@openssl.org> | 2016-03-03 13:53:26 +0100 |
| commit | 062178678f5374b09f00d70796f6e692e8775aca (patch) | |
| tree | ae299cf72a32514f7e5315af16977976f6083c86 /include | |
| parent | make update (diff) | |
| download | openssl-062178678f5374b09f00d70796f6e692e8775aca.tar.xz openssl-062178678f5374b09f00d70796f6e692e8775aca.zip | |
Refactor ClientHello extension parsing
1) Simplify code with better PACKET methods.
2) Make broken SNI parsing explicit. SNI was intended to be extensible
to new name types but RFC 4366 defined the syntax inextensibly, and
OpenSSL has never parsed SNI in a way that would allow adding a new name
type. RFC 6066 fixed the definition but due to broken implementations
being widespread, it appears impossible to ever extend SNI.
3) Annotate resumption behaviour. OpenSSL doesn't currently handle all
extensions correctly upon resumption. Annotate for further clean-up.
4) Send an alert on ALPN protocol mismatch.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/ssl.h | 1 | ||||
| -rw-r--r-- | include/openssl/tls1.h | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index c9119e345e..6e223960a9 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -1109,6 +1109,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) # define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */ # define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK +# define SSL_AD_NO_APPLICATION_PROTOCOL TLS1_AD_NO_APPLICATION_PROTOCOL # define SSL_ERROR_NONE 0 # define SSL_ERROR_SSL 1 # define SSL_ERROR_WANT_READ 2 diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h index 0f0d4a3713..c2fe36430b 100644 --- a/include/openssl/tls1.h +++ b/include/openssl/tls1.h @@ -204,6 +204,7 @@ extern "C" { # define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 # define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114 # define TLS1_AD_UNKNOWN_PSK_IDENTITY 115/* fatal */ +# define TLS1_AD_NO_APPLICATION_PROTOCOL 120 /* fatal */ /* ExtensionType values from RFC3546 / RFC4366 / RFC6066 */ # define TLSEXT_TYPE_server_name 0 |