Add SSL_[CTX_]_set_compliance_policy.
These functions aid in meeting specific compliance goals and allows
configuration of things like TLS 1.3 cipher suites, which are otherwise
not configurable.
Change-Id: I668afc734a19ecd4b996eaa23be73ce259b13fa2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/52625
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/ssl/internal.h b/ssl/internal.h
index fbf9745..2400f90 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -660,10 +660,15 @@
size_t ssl_cipher_get_record_split_len(const SSL_CIPHER *cipher);
// ssl_choose_tls13_cipher returns an |SSL_CIPHER| corresponding with the best
-// available from |cipher_suites| compatible with |version| and |group_id|. It
-// returns NULL if there isn't a compatible cipher.
+// available from |cipher_suites| compatible with |version|, |group_id|, and
+// |only_fips|. It returns NULL if there isn't a compatible cipher.
const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, uint16_t version,
- uint16_t group_id);
+ uint16_t group_id, bool only_fips);
+
+// ssl_tls13_cipher_meets_policy returns true if |cipher_id| is acceptable given
+// |only_fips|. (For now there's only a single policy and so the policy argument
+// is just a bool.)
+bool ssl_tls13_cipher_meets_policy(uint16_t cipher_id, bool only_fips);
// Transcript layer.
@@ -3087,6 +3092,10 @@
// permute_extensions is whether to permute extensions when sending messages.
bool permute_extensions : 1;
+
+ // only_fips_cipher_suites_in_tls13 constrains the selection of cipher suites
+ // in TLS 1.3 such that only FIPS approved ones will be selected.
+ bool only_fips_cipher_suites_in_tls13 : 1;
};
// From RFC 8446, used in determining PSK modes.
@@ -3694,6 +3703,10 @@
// If enable_early_data is true, early data can be sent and accepted.
bool enable_early_data : 1;
+ // only_fips_cipher_suites_in_tls13 constrains the selection of cipher suites
+ // in TLS 1.3 such that only FIPS approved ones will be selected.
+ bool only_fips_cipher_suites_in_tls13 : 1;
+
private:
~ssl_ctx_st();
friend OPENSSL_EXPORT void SSL_CTX_free(SSL_CTX *);
