Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update - OpenSSL 1.1.1-pre7-dev

Browse Source
This commit is contained in:
Hakase
2018-05-23 23:52:41 +09:00
parent e8a0afd4a0
commit ef253190c7
624 changed files with 189420 additions and 8064 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man1/ciphers.pod
+28 -30
View File
@@ -22,6 +22,7 @@ B<openssl> B<ciphers>
[B<-srp>]
[B<-stdname>]
[B<-convert name>]
[B<-ciphersuites val>]
[B<cipherlist>]
=head1 DESCRIPTION
@@ -105,10 +106,21 @@ Precede each cipher suite by its standard name.
Convert a standard cipher B<name> to its OpenSSL name.
=item B<-ciphersuites val>
Sets the list of TLSv1.3 ciphersuites. This list will be combined with any
TLSv1.2 and below ciphersuites that have been configured. The format for this
list is a simple colon (":") separated list of TLSv1.3 ciphersuite names. By
default this value is:
"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
=item B<cipherlist>
A cipher list to convert to a cipher preference list. If it is not included
then the default cipher list will be used. The format is described below.
A cipher list of TLSv1.2 and below ciphersuites to convert to a cipher
preference list. This list will be combined with any TLSv1.3 ciphersuites that
have been configured. If it is not included then the default cipher list will be
used. The format is described below.
=back
@@ -156,19 +168,20 @@ The cipher string B<@SECLEVEL=n> can be used at any point to set the security
level to B<n>, which should be a number between zero and five, inclusive.
See L<SSL_CTX_set_security_level> for a description of what each level means.
The cipher list can be prefixed with the B<DEFAULT> keyword, which enables
the default cipher list as defined below. Unlike cipher strings,
this prefix may not be combined with other strings using B<+> character.
For example, B<DEFAULT+DES> is not valid.
The content of the default list is determined at compile time and normally
corresponds to B<ALL:!COMPLEMENTOFDEFAULT:!eNULL>.
=head1 CIPHER STRINGS
The following is a list of all permitted cipher strings and their meanings.
=over 4
=item B<DEFAULT>
The default cipher list.
This is determined at compile time and is normally
B<ALL:!COMPLEMENTOFDEFAULT:!eNULL>.
When used, this must be the first cipherstring specified.
=item B<COMPLEMENTOFDEFAULT>
The ciphers included in B<ALL>, but not enabled by default. Currently
@@ -405,21 +418,6 @@ permissible.
=back
=head1 EQUAL PREFERENCE GROUPS
If configuring a server, one may also configure equal-preference groups to
partially respect the client's preferences when
B<SSL_OP_CIPHER_SERVER_PREFERENCE> is enabled. Ciphers in an equal-preference
group have equal priority and use the client order. This may be used to
enforce that AEADs are preferred but select AES-GCM vs. ChaCha20-Poly1305
based on client preferences. An equal-preference is specified with square
brackets, combining multiple selectors separated by |. For example:
[ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES128-GCM-SHA256]
Once an equal-preference group is used, future directives must be
opcode-less.
=head1 CIPHER SUITE NAMES
The following lists give the SSL or TLS cipher suites names from the
@@ -720,11 +718,11 @@ Note: the CBC modes mentioned in this RFC are not supported.
=head2 TLS v1.3 cipher suites
TLS_AES_128_GCM_SHA256 TLS13-AES-128-GCM-SHA256
TLS_AES_256_GCM_SHA384 TLS13-AES-256-GCM-SHA384
TLS_CHACHA20_POLY1305_SHA256 TLS13-CHACHA20-POLY1305-SHA256
TLS_AES_128_CCM_SHA256 TLS13-AES-128-CCM-SHA256
TLS_AES_128_CCM_8_SHA256 TLS13-AES-128-CCM-8-SHA256
TLS_AES_128_GCM_SHA256 TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384 TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256 TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_SHA256
TLS_AES_128_CCM_8_SHA256 TLS_AES_128_CCM_8_SHA256
=head2 Older names used by OpenSSL
@@ -786,7 +784,7 @@ The B<-convert> was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy