Make ssl code consistent with FIPS branch. The new code has no effect

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 10f6d81c2a35b828dfc17e0c80090ba40cc96159..6360521fd58eada4f940879e82cc7ccbc9ee9a23 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -187,6 +187,7 @@
 #include <openssl/buffer.h>
 #endif
 #include <openssl/pem.h>
+#include <openssl/hmac.h>
 
 #include <openssl/kssl.h>
 #include <openssl/safestack.h>
@@ -251,6 +252,7 @@ extern "C" {
 #define SSL_TXT_LOW            "LOW"
 #define SSL_TXT_MEDIUM         "MEDIUM"
 #define SSL_TXT_HIGH           "HIGH"
+#define SSL_TXT_FIPS           "FIPS"
 #define SSL_TXT_kFZA           "kFZA"
 #define        SSL_TXT_aFZA            "aFZA"
 #define SSL_TXT_eFZA           "eFZA"
@@ -360,9 +362,6 @@ typedef struct ssl_cipher_st
 
 DECLARE_STACK_OF(SSL_CIPHER)
 
-typedef struct ssl_st SSL;
-typedef struct ssl_ctx_st SSL_CTX;
-
 /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
 typedef struct ssl_method_st
        {
@@ -759,6 +758,12 @@ struct ssl_ctx_st
 
        int quiet_shutdown;
 
+#ifndef OPENSSL_ENGINE
+       /* Engine to pass requests for client certs to
+        */
+       ENGINE *client_cert_engine;
+#endif
+
 #ifndef OPENSSL_NO_TLSEXT
        /* TLS extensions servername callback */
        int (*tlsext_servername_callback)(SSL*, int *, void *);
@@ -767,7 +772,12 @@ struct ssl_ctx_st
        unsigned char tlsext_tick_key_name[16];
        unsigned char tlsext_tick_hmac_key[16];
        unsigned char tlsext_tick_aes_key[16];
-  
+       /* Callback to support customisation of ticket key setting */
+       int (*tlsext_ticket_key_cb)(SSL *ssl,
+                                       unsigned char *name, unsigned char *iv,
+                                       EVP_CIPHER_CTX *ectx,
+                                       HMAC_CTX *hctx, int enc);
+
        /* certificate status request info */
        /* Callback for status request */
        int (*tlsext_status_cb)(SSL *ssl, void *arg);
@@ -823,6 +833,9 @@ void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl,int type,
 void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val);
 void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
 int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
+#ifndef OPENSSL_NO_ENGINE
+int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e);
+#endif
 void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len));
 void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len));
 
@@ -995,7 +1008,6 @@ struct ssl_st
        int first_packet;
        int client_version;     /* what was passed, used for
                                 * SSLv3/TLS rollback check */
-       unsigned int max_send_fragment;
 #ifndef OPENSSL_NO_TLSEXT
        /* TLS extension debug callback */
        void (*tlsext_debug_cb)(SSL *s, int client_server, int type,
@@ -1253,6 +1265,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS     69
 #define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP       70
 #define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP       71
+
+#define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB      72
 #endif
 
 #define SSL_session_reused(ssl) \
@@ -1748,6 +1762,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY                         168
 #define SSL_F_SSL_CTX_NEW                               169
 #define SSL_F_SSL_CTX_SET_CIPHER_LIST                   269
+#define SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE            278
 #define SSL_F_SSL_CTX_SET_PURPOSE                       226
 #define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT            219
 #define SSL_F_SSL_CTX_SET_SSL_VERSION                   170
@@ -1928,6 +1943,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_NO_CIPHERS_SPECIFIED                      183
 #define SSL_R_NO_CIPHER_LIST                            184
 #define SSL_R_NO_CIPHER_MATCH                           185
+#define SSL_R_NO_CLIENT_CERT_METHOD                     317
 #define SSL_R_NO_CLIENT_CERT_RECEIVED                   186
 #define SSL_R_NO_COMPRESSION_SPECIFIED                  187
 #define SSL_R_NO_METHOD_SPECIFIED                       188