Expose a few more OpenSSL functions that are useful for DTLS support

src/_cffi_src/openssl/bio.py

@@ -10,6 +10,7 @@
 TYPES = """
 typedef ... BIO;
 typedef ... BIO_METHOD;
+typedef ... BIO_ADDR;
 """
 
 FUNCTIONS = """
@@ -37,7 +38,23 @@
 int BIO_reset(BIO *);
 void BIO_set_retry_read(BIO *);
 void BIO_clear_retry_flags(BIO *);
+
+BIO_ADDR *BIO_ADDR_new(void);
+void BIO_ADDR_free(BIO_ADDR *);
 """
 
 CUSTOMIZATIONS = """
+#if CRYPTOGRAPHY_IS_LIBRESSL
+#include <sys/socket.h>
+#include <stdlib.h>
+typedef struct sockaddr BIO_ADDR;
+
+BIO_ADDR *BIO_ADDR_new(void) {
+    return malloc(sizeof(struct sockaddr_storage));
+}
+
+void BIO_ADDR_free(BIO_ADDR *ptr) {
+    free(ptr);
+}
+#endif
 """

src/_cffi_src/openssl/ssl.py

@@ -35,6 +35,7 @@
  * supported
  */
 static const long Cryptography_HAS_OP_NO_COMPRESSION;
+static const long Cryptography_HAS_OP_NO_RENEGOTIATION;
 static const long Cryptography_HAS_SSL_OP_MSIE_SSLV2_RSA_PADDING;
 static const long Cryptography_HAS_SSL_SET_SSL_CTX;
 static const long Cryptography_HAS_SSL_OP_NO_TICKET;
@@ -43,6 +44,7 @@
 static const long Cryptography_HAS_SET_CERT_CB;
 static const long Cryptography_HAS_CUSTOM_EXT;
 static const long Cryptography_HAS_SRTP;
+static const long Cryptography_HAS_DTLS_GET_DATA_MTU;
 
 static const long SSL_FILETYPE_PEM;
 static const long SSL_FILETYPE_ASN1;
@@ -64,6 +66,7 @@
 static const long SSL_OP_NO_TLSv1_3;
 static const long SSL_OP_NO_DTLSv1;
 static const long SSL_OP_NO_DTLSv1_2;
+static const long SSL_OP_NO_RENEGOTIATION;
 static const long SSL_OP_NO_COMPRESSION;
 static const long SSL_OP_SINGLE_DH_USE;
 static const long SSL_OP_EPHEMERAL_RSA;
@@ -225,6 +228,13 @@
                                         unsigned char *,
                                         unsigned int *
                                     ));
+void SSL_CTX_set_cookie_verify_cb(SSL_CTX *,
+                                    int (*)(
+                                        SSL *,
+                                        const unsigned char *,
+                                        unsigned int
+                                    ));
+
 long SSL_CTX_get_read_ahead(SSL_CTX *);
 long SSL_CTX_set_read_ahead(SSL_CTX *, long);
 
@@ -468,6 +478,10 @@
 long DTLSv1_handle_timeout(SSL *);
 long DTLS_set_link_mtu(SSL *, long);
 long DTLS_get_link_min_mtu(SSL *);
+long SSL_set_mtu(SSL *, long);
+int DTLSv1_listen(SSL *, BIO_ADDR *);
+size_t DTLS_get_data_mtu(SSL *);
+
 
 /* Custom extensions. */
 typedef int (*custom_ext_add_cb)(SSL *, unsigned int,
@@ -556,6 +570,13 @@
 static const long Cryptography_HAS_NEXTPROTONEG = 0;
 static const long Cryptography_HAS_ALPN = 1;
 
+#ifdef SSL_OP_NO_RENEGOTIATION
+static const long Cryptography_HAS_OP_NO_RENEGOTIATION = 1;
+#else
+static const long Cryptography_HAS_OP_NO_RENEGOTIATION = 0;
+static const long SSL_OP_NO_RENEGOTIATION = 0;
+#endif
+
 #if CRYPTOGRAPHY_IS_LIBRESSL
 void (*SSL_CTX_set_cert_cb)(SSL_CTX *, int (*)(SSL *, void *), void *) = NULL;
 void (*SSL_set_cert_cb)(SSL *, int (*)(SSL *, void *), void *) = NULL;
@@ -594,6 +615,13 @@
 long (*DTLS_get_link_min_mtu)(SSL *) = NULL;
 #endif
 
+#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_111
+static const long Cryptography_HAS_DTLS_GET_DATA_MTU = 0;
+size_t (*DTLS_get_data_mtu)(SSL *) = NULL;
+#else
+static const long Cryptography_HAS_DTLS_GET_DATA_MTU = 1;
+#endif
+
 static const long Cryptography_HAS_DTLS = 1;
 /* Wrap DTLSv1_get_timeout to avoid cffi to handle a 'struct timeval'. */
 long Cryptography_DTLSv1_get_timeout(SSL *ssl, time_t *ptv_sec,

src/cryptography/hazmat/bindings/openssl/_conditional.py

@@ -244,6 +244,18 @@ def cryptography_has_providers():
     ]
 
 
+def cryptography_has_op_no_renegotiation():
+    return [
+        "SSL_OP_NO_RENEGOTIATION",
+    ]
+
+
+def cryptography_has_dtls_get_data_mtu():
+    return [
+        "DTLS_get_data_mtu",
+    ]
+
+
 # This is a mapping of
 # {condition: function-returning-names-dependent-on-that-condition} so we can
 # loop over them and delete unsupported names at runtime. It will be removed
@@ -291,4 +303,8 @@ def cryptography_has_providers():
     "Cryptography_HAS_SRTP": cryptography_has_srtp,
     "Cryptography_HAS_GET_PROTO_VERSION": cryptography_has_get_proto_version,
     "Cryptography_HAS_PROVIDERS": cryptography_has_providers,
+    "Cryptography_HAS_OP_NO_RENEGOTIATION": (
+        cryptography_has_op_no_renegotiation
+    ),
+    "Cryptography_HAS_DTLS_GET_DATA_MTU": cryptography_has_dtls_get_data_mtu,
 }