#include <openssl/ssl.h>
- typedef int (*custom_ext_add_cb_ex) (SSL *s, unsigned int ext_type,
- unsigned int context,
- const unsigned char **out,
- size_t *outlen, X509 *x, size_t chainidx,
- int *al, void *add_arg);
-
- typedef void (*custom_ext_free_cb_ex) (SSL *s, unsigned int ext_type,
- unsigned int context,
- const unsigned char *out,
- void *add_arg);
-
- typedef int (*custom_ext_parse_cb_ex) (SSL *s, unsigned int ext_type,
- unsigned int context,
- const unsigned char *in,
- size_t inlen, X509 *x, size_t chainidx,
- int *al, void *parse_arg);
+ typedef int (*SSL_custom_ext_add_cb_ex) (SSL *s, unsigned int ext_type,
+ unsigned int context,
+ const unsigned char **out,
+ size_t *outlen, X509 *x,
+ size_t chainidx, int *al,
+ void *add_arg);
+
+ typedef void (*SSL_custom_ext_free_cb_ex) (SSL *s, unsigned int ext_type,
+ unsigned int context,
+ const unsigned char *out,
+ void *add_arg);
+
+ typedef int (*SSL_custom_ext_parse_cb_ex) (SSL *s, unsigned int ext_type,
+ unsigned int context,
+ const unsigned char *in,
+ size_t inlen, X509 *x,
+ size_t chainidx, int *al,
+ void *parse_arg);
int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
unsigned int context,
- custom_ext_add_cb_ex add_cb,
- custom_ext_free_cb_ex free_cb,
+ SSL_custom_ext_add_cb_ex add_cb,
+ SSL_custom_ext_free_cb_ex free_cb,
void *add_arg,
- custom_ext_parse_cb_ex parse_cb, void *parse_arg);
+ SSL_custom_ext_parse_cb_ex parse_cb,
+ void *parse_arg);
typedef int (*custom_ext_add_cb)(SSL *s, unsigned int ext_type,
const unsigned char **out,
=head1 DESCRIPTION
-SSL_CTX_add_custom_ext() adds a custom extension for a (D)TLS client or server
+SSL_CTX_add_custom_ext() adds a custom extension for a TLS/DTLS client or server
for all supported protocol versions with extension type B<ext_type> and
callbacks B<add_cb>, B<free_cb> and B<parse_cb> (see the
L</EXTENSION CALLBACKS> section below). The B<context> value determines
which messages and under what conditions the extension will be added/parsed (see
the L</EXTENSION CONTEXTS> section below).
-SSL_CTX_add_client_custom_ext() adds a custom extension for a (D)TLS client with
-extension type B<ext_type> and callbacks B<add_cb>, B<free_cb> and B<parse_cb>.
-This function is similar to SSL_CTX_add_custom_ext() except it only applies
-to clients, uses the older style of callbacks, and implicitly sets the
+SSL_CTX_add_client_custom_ext() adds a custom extension for a TLS/DTLS client
+with extension type B<ext_type> and callbacks B<add_cb>, B<free_cb> and
+B<parse_cb>. This function is similar to SSL_CTX_add_custom_ext() except it only
+applies to clients, uses the older style of callbacks, and implicitly sets the
B<context> value to:
SSL_EXT_TLS1_2_AND_BELOW_ONLY | SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_IGNORE_ON_RESUMPTION
-SSL_CTX_add_server_custom_ext() adds a custom extension for a (D)TLS server with
-extension type B<ext_type> and callbacks B<add_cb>, B<free_cb> and
+SSL_CTX_add_server_custom_ext() adds a custom extension for a TLS/DTLS server
+
with extension type B<ext_type> and callbacks B<add_cb>, B<free_cb> and
B<parse_cb>. This function is similar to SSL_CTX_add_custom_ext() except it
only applies to servers, uses the older style of callbacks, and implicitly sets
the B<context> value to the same as for SSL_CTX_add_client_custom_ext() above.
-In all cases the extension type must not be handled by OpenSSL internally
-or an error occurs.
+The B<ext_type> parameter corresponds to the B<extension_type> field of
+RFC5246 et al. It is B<not> a NID. In all cases the extension type must not be
+handled by OpenSSL internally or an error occurs.
SSL_extension_supported() returns 1 if the extension B<ext_type> is handled
internally by OpenSSL and 0 otherwise.
If B<add_cb> returns -1 a fatal handshake error occurs using the TLS
alert value specified in B<*al>.
-When constructing the ClientHello if B<add_cb> is set to NULL a zero length
+When constructing the ClientHello
, if B<add_cb> is set to NULL a zero length
extension is added for B<ext_type>. For all other messages if B<add_cb> is set
to NULL then no extension is added.
certificate in the message. The B<x> parameter will indicate the
current certificate and the B<chainidx> parameter will indicate the position
of the certificate in the message. The first certificate is always the end
-entity certificate and has a B<chainidx> value of 0.
+entity certificate and has a B<chainidx> value of 0. The certificates are in the
+order that they were received in the Certificate message.
For all messages except the ServerHello and EncryptedExtensions every
registered B<add_cb> is always called to see if the application wishes to add an
=item SSL_EXT_TLS1_2_AND_BELOW_ONLY
-The extension is only defined for (D)TLSv1.2 and below. Servers will ignore this
-extension if it is present in the ClientHello and TLSv1.3 is negotiated.
+The extension is only defined for TLSv1.2/DTLSv1.2 and below. Servers will
+ignore this extension if it is present in the ClientHello and TLSv1.3 is
+negotiated.
=item SSL_EXT_TLS1_3_ONLY
be used to store the extension data received in a convenient structure or
pass the extension data to be added or freed when adding extensions.
-The B<ext_type> parameter corresponds to the B<extension_type> field of
-RFC5246 et al. It is B<not> a NID.
-
If the same custom extension type is received multiple times a fatal
B<decode_error> alert is sent and the handshake aborts. If a custom extension
is received in a ServerHello/EncryptedExtensions message which was not sent in
=head1 HISTORY
-The function SSL_CTX_add_custom_ext() was added in OpenSSL version 1.1.1.
+The SSL_CTX_add_custom_ext() function was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
-Licensed under the OpenSSL license (the "License"). You may not use
+Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
projects / openssl.git / blobdiff