For better forward-security support, add functions

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 5a35c672852cd7ad2e8f99025e0e591b0547377d..20e49ec376f117eb22b08e44baea34002a51923b 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -468,6 +468,9 @@ typedef struct ssl_session_st
        char *psk_identity_hint;
        char *psk_identity;
 #endif
+       /* Used to indicate that session resumption is not allowed.
+        * Applications can also set this bit for a new session via
+        * not_resumable_session_cb to disable session caching and tickets. */
        int not_resumable;
 
        /* The cert is the certificate used to establish this connection */
@@ -811,6 +814,10 @@ struct ssl_ctx_st
 
        X509_VERIFY_PARAM *param;
 
+       /* Callback for disabling session caching and ticket support
+        * on a session basis, depending on the chosen cipher. */
+       int (*not_resumable_session_cb)(SSL *ssl, int is_forward_secure);
+
 #if 0
        int purpose;            /* Purpose setting */
        int trust;              /* Trust setting */
@@ -1088,6 +1095,10 @@ struct ssl_st
 
        X509_VERIFY_PARAM *param;
 
+       /* Callback for disabling session caching and ticket support
+        * on a session basis, depending on the chosen cipher. */
+       int (*not_resumable_session_cb)(SSL *ssl, int is_forward_secure);
+
 #if 0
        int purpose;            /* Purpose setting */
        int trust;              /* Trust setting */
@@ -1477,6 +1488,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_CTRL_GET_RI_SUPPORT                        76
 #define SSL_CTRL_CLEAR_OPTIONS                 77
 #define SSL_CTRL_CLEAR_MODE                    78
+#define SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB     79
 
 #define DTLSv1_get_timeout(ssl, arg) \
        SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
@@ -1875,6 +1887,12 @@ int SSL_tls1_key_exporter(SSL *s, unsigned char *label, int label_len,
                            unsigned char *context, int context_len,
                            unsigned char *out, int olen);
 
+void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,
+       int (*cb)(SSL *ssl, int is_forward_secure));
+
+void SSL_set_not_resumable_session_callback(SSL *ssl,
+       int (*cb)(SSL *ssl, int is_forward_secure));
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.