Jon Shallow 45731f1c0e Add in support for OpenSSL 1.1.1 to support TLS1.3 (RFC8446) ...

OpenSSL 1.1.0 has support for making decisions during receipt of
the Client Hello - the call back function is set up using
SSL_CTX_set_tlsext_servername_callback() which is called later in the
Client Hello processing - but called every Client Hello.
Certificates and Preshared Keys have to be set up in the SSL CTX before
SSL_Accept() is called, making the code messy to decide whether this is a
PKI or PSK incoming request to handle things accordingly if both are
defined.  SNI has to create a new SSL CTX to handle different server names
with different crtificates.

OpenSSL 1.1.1 introduces a new function SSL_CTX_set_client_hello_cb().
The call back is invoked early on in the Client Hello processing giving
the ability to easily use different Preshared Keys, Certificates etc.
Certificates do not have to be set up in the SSL CTX before SSL_Accept is
called.
Later in the Client Hello code, the callback for
SSL_CTX_set_tlsext_servername_callback() is still called, but only if SNI
is being used by the client, so cannot be used for doing things the
OpenSSL 1.1.0 way.

OpenSSL 1.1.1 supports TLS1.3.

Consequently, this code has to have compile time options to include /
exclude code based on whether compiled against 1.1.0 or 1.1.1, as well as
have additional run time checks.

Updated:
examples/client.c
examples/coap-server.c
include/coap/coap_dtls.h
man/coap_context.txt.in
man/coap_encryption.txt.in
man/coap_session.txt.in
src/coap_openssl.c

In addition, the callback app_override_tls_setup_call_back has been removed
from coap_dtls_pki_t and replaced with additional_tls_setup_call_back
as app_override_tls_setup_call_back became very messy with 2 versions
of OpenSSL.  If the application now wants to make additional checks/
changes etc., app_override_tls_setup_call_back will get invoked after
the defined configuration checks are done.

SNI has been added into coap-client for testing / demonstration

2018-08-21 11:09:59 +01:00

..

coap

Add in support for OpenSSL 1.1.1 to support TLS1.3 (RFC8446)

2018-08-21 11:09:59 +01:00