winscp/libs/openssl/doc/designs/quic-design/quic-api-ssl-funcs.md

Behaviour of SSL functions on QUIC SSL objects

This document is a companion to the QUIC API Overview which lists all SSL functions and controls and notes their behaviour with QUIC SSL objects.

The Category column is as follows:

• Global: These API items do not relate to SSL objects. They may be stateless or may relate only to global state.

Can also be used for APIs implemented only in terms of other public libssl APIs.

• Object: Object management APIs. Some of these may require QUIC-specific implementation.
• HL: Handshake layer API.

These calls should generally be dispatched to the handshake layer, unless they are not applicable to QUIC. Modifications inside the handshake layer for the QUIC case may or may not be required.

• CSSM: Connection/Stream State Machine. API related to lifecycle of a connection or stream. Needs QUIC-specific implementation.
• ADP: App Data Path. Application-side data path API. QUIC-specific implementation.
• NDP: Net Data Path. Network-side data path control API. Also includes I/O ticking and timeout handling.
• RL: Record layer related API. If these API items only relate to the TLS record layer, they must be disabled for QUIC; if they are also relevant to the QUIC record layer, they will require QUIC-specific implementation.
• Async: Relates to the async functionality.
• 0-RTT: Relates to early data/0-RTT functionality.
• Special: Other calls which defy classification.

The Semantics column is as follows:

• 🟩U: Unchanged. The semantics of the API are not changed for QUIC.
• 🟧C: Changed. The semantics of the API are changed for QUIC.
• 🟦N: New. The API is new for QUIC.
• 🟥TBD: Yet to be determined if semantic changes will be required.

The Applicability column is as follows:

• 🟦U: Unrelated. Not applicable to QUIC — fully unrelated (e.g. functions for other SSL methods).
• 🟥FC: Not applicable to QUIC (or not currently supported) — fail closed.
• 🟧NO: Not applicable to QUIC (nor not currently supported) — no-op.
• 🟩A: Applicable.

The Implementation Requirements column is as follows:

• 🟩NC: No changes are expected to be needed (where marked *, dispatch to handshake layer).

Note: Where this value is used with an applicability of FC or NO, this means that the desired behaviour is already an emergent consequence of the existing code.

• 🟨C: Modifications are expected to be needed (where marked *, dispatch to handshake layer with changes inside the handshake layer).
• 🟧QSI: QUIC specific implementation.
• 🟥QSA: QUIC specific API.

The Status column is as follows:

• 🔴Pending Triage: Have not determined the classification of this API item yet.
• 🟠Design TBD: It has not yet been determined how this API item will work for QUIC.
• 🟡TODO: It has been determined how this API item should work for QUIC but it has not yet been implemented.
• 🟢Done: No further work is anticipated to be needed for this API item.

Notes:

• †1: Must restrict which ciphers can be used with QUIC; otherwise, no changes.
• †2: ALPN usage must be mandated; otherwise, no changes.
• †3: NPN usage should be forced off as it should never be used with QUIC; otherwise, no changes.
• †4: Controls needing changes are listed separately.
• †5: TLS compression and renegotiation must not be used with QUIC, but these features are already forbidden in TLS 1.3, which is a requirement for QUIC, thus no changes should be needed.
• †6: Callback specified is called for handshake layer messages (TLSv1.3).
• †7: Tickets are issued using NEW_TOKEN frames in QUIC and this will require handshake layer changes. However these APIs as such do not require changes.
• †8: Use of post-handshake authentication is prohibited by QUIC.
• †9: QUIC always uses AES-128-GCM initially. We need to determine when and what ciphers we report as being in use.
• †10: Not supporting async for now.
• †11: Since these functions only configure cipher suite lists used for TLSv1.2, which is never used for QUIC, they do not require changes, and we can allow applications to configure these lists freely, as they will be ignored.

API Item	Cat.	Sema.	Appl.	Impl. Req.	Status
⇒ Global Information and Functions
OSSL_default_cipher_list	Global	🟩U	🟦U	🟩NC	🟢Done
OSSL_default_ciphersuites	Global	🟩U	🟦U	🟩NC	🟢Done
ERR_load_SSL_strings	Global	🟩U	🟦U	🟩NC	🟢Done
OPENSSL_init_ssl	Global	🟩U	🟦U	🟩NC	🟢Done
OPENSSL_cipher_name	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_alert_desc_string	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_alert_desc_string_long	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_alert_type_string	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_alert_type_string_long	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_extension_supported	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_add_ssl_module	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_test_functions	Global	🟩U	🟦U	🟩NC	🟢Done
SSL_select_next_proto	Global	🟩U	🟦U	🟩NC	🟢Done
⇒ Methods
SSLv3_method	Global	🟩U	🟦U	🟩NC	🟢Done
SSLv3_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
SSLv3_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLS_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLS_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLS_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_1_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_1_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_1_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_2_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_2_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
TLSv1_2_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLS_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLS_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLS_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLSv1_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLSv1_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLSv1_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLSv1_2_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLSv1_2_client_method	Global	🟩U	🟦U	🟩NC	🟢Done
DTLSv1_2_server_method	Global	🟩U	🟦U	🟩NC	🟢Done
OSSL_QUIC_client_method	Global	🟩U	🟦U	🟥QSA	🟢Done
OSSL_QUIC_client_thread_method	Global	🟩U	🟦U	🟥QSA	🟢Done
OSSL_QUIC_server_method	Global	🟩U	🟦U	🟥QSA	🟠Design TBD
⇒ Instantiation
BIO_f_ssl	Object	🟩U	🟩A	🟩NC	🟢Done
BIO_new_ssl	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_CTX_new	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_CTX_new_ex	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_CTX_up_ref	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_CTX_free	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_new	Object	🟩U	🟩A	🟧QSI	🟢Done
SSL_dup	Object	🟩U	🟩A	🟥FC	🟢Done
SSL_up_ref	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_free	Object	🟩U	🟩A	🟧QSI	🟢Done
SSL_is_dtls	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_CTX_get_ex_data	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_CTX_set_ex_data	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_get_ex_data	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_set_ex_data	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_get_SSL_CTX	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_set_SSL_CTX	Object	🟩U	🟩A	🟩NC	🟢Done
⇒ Method Manipulation
SSL_CTX_get_ssl_method	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_get_ssl_method	Object	🟩U	🟩A	🟩NC	🟢Done
SSL_set_ssl_method	Object	🟩U	🟥FC	🟧QSI	🟢Done
⇒ SRTP
SSL_get_selected_srtp_profile	HL	🟩U	🟧NO	🟨C*	🟢Done
SSL_get_srtp_profiles	HL	🟩U	🟧NO	🟨C*	🟢Done
SSL_CTX_set_tlsext_use_srtp	HL	🟩U	🟥FC	🟨C*	🟢Done
SSL_set_tlsext_use_srtp	HL	🟩U	🟥FC	🟩NC*	🟢Done
⇒ Ciphersuite Configuration
SSL_CTX_set_cipher_list	HL	🟩U	🟩A	🟩NC* †11	🟢Done
SSL_CTX_set_ciphersuites	HL	🟩U	🟩A	🟨C* †1	🟢Done
SSL_CTX_get_ciphers	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_ciphersuites	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get1_supported_ciphers	HL	🟩U	🟩A	🟨C* †1	🟢Done
SSL_bytes_to_cipher_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_ciphers	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_cipher_list	HL	🟩U	🟩A	🟩NC* †11	🟢Done
SSL_set_cipher_list	HL	🟩U	🟩A	🟩NC* †11	🟢Done
⇒ Negotiated Ciphersuite Queries
SSL_get_current_cipher	HL	🟩U	🟩A	🟩NC* †9	🟢Done
SSL_get_pending_cipher	HL	🟩U	🟩A	🟩NC* †9	🟢Done
SSL_get_shared_ciphers	HL	🟩U	🟩A	🟩NC* †9	🟢Done
SSL_get_client_ciphers	HL	🟩U	🟩A	🟩NC* †9	🟢Done
SSL_get_current_compression	HL	🟩U	🟩A	🟩HLNC	🟢Done
SSL_get_current_expansion	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_shared_sigalgs	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_sigalgs	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_peer_signature_nid	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_peer_signature_type_nid	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_signature_nid	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_signature_type_nid	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ ALPN	†2
SSL_SESSION_set1_alpn_selected	HL	🟩U	🟩A	🟨C* †2	🟢Done
SSL_SESSION_get0_alpn_selected	HL	🟩U	🟩A	🟨C* †2	🟢Done
SSL_CTX_set_alpn_select_cb	HL	🟩U	🟩A	🟨C* †2	🟢Done
SSL_set_alpn_protos	HL	🟩U	🟩A	🟨C* †2	🟢Done
SSL_get0_alpn_selected	HL	🟩U	🟩A	🟨C* †2	🟢Done
SSL_CTX_set_alpn_protos	HL	🟩U	🟩A	🟨C* †2	🟢Done
⇒ NPN	†3
SSL_CTX_set_next_proto_select_cb	HL	🟩U	🟥FC	🟨C* †3	🟢Done
SSL_CTX_set_next_protos_advertised_cb	HL	🟩U	🟥FC	🟨C* †3	🟢Done
SSL_get0_next_proto_negotiated	HL	🟩U	🟥FC	🟩NC* †3	🟢Done
⇒ Narrow Waist Interface	†4
SSL_CTX_ctrl	Object	🟩U	🟩A	🟩NC* †4	🟢Done
SSL_ctrl	Object	🟩U	🟩A	🟩NC* †4	🟢Done
SSL_CTX_callback_ctrl	Object	🟩U	🟩A	🟩NC* †4	🟢Done
SSL_callback_ctrl	Object	🟩U	🟩A	🟩NC* †4	🟢Done
⇒ Miscellaneous Accessors
SSL_get_server_random	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_client_random	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_finished	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_peer_finished	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Ciphersuite Information
SSL_CIPHER_description	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_find	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_auth_nid	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_bits	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_cipher_nid	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_digest_nid	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_handshake_digest	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_id	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_kx_nid	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_name	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_protocol_id	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_get_version	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_is_aead	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CIPHER_standard_name	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_group_to_name	Global	🟩U	🟦U	🟩NC*	🟢Done
⇒ Version Queries
SSL_get_version	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_version	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_version	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Certificate Chain Management
SSL_get_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_certificate_chain_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_certificate_chain_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_certificate_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_load_verify_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_load_verify_dir	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_load_verify_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_load_verify_locations	HL	🟩U	🟩A	🟩NC*	🟢Done
CertSSL_use_cert_and_key	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_certificate_ASN1	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_PrivateKey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_PrivateKey_ASN1	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_PrivateKey_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_RSAPrivateKey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_RSAPrivateKey_ASN1	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_use_RSAPrivateKey_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_verify_dir	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_verify_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_verify_paths	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_verify_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_cert_and_key	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_certificate_ASN1	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_certificate_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_PrivateKey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_PrivateKey_ASN1	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_PrivateKey_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_RSAPrivateKey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_RSAPrivateKey_ASN1	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_RSAPrivateKey_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_check_chain	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_check_private_key	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_check_private_key	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_add_client_CA	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_add1_to_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_add_dir_cert_subjects_to_stack	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_add_file_cert_subjects_to_stack	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_add_store_cert_subjects_to_stack	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_load_client_CA_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_load_client_CA_file_ex	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_dup_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set0_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_client_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_add_client_CA	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_privatekey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_cert_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set1_cert_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_client_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_add1_to_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set0_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_client_cert_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_default_passwd_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_default_passwd_cb_userdata	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_client_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_privatekey	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Certificate Compression
SSL_CTX_set1_cert_comp_preference	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set1_cert_comp_preference	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_compress_certs	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_compress_certs	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set1_compressed_cert	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set1_compressed_cert	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get1_compressed_cert	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get1_compressed_cert	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Certificate Verification
SSL_set1_host	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_add1_host	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_hostflags	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_verify	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_verify	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_verify_depth	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_verify_result	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_verify_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_verify_depth	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_verify_mode	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_verify_result	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_peer_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_peer_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_verified_chain	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get1_peer_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_peer_cert_chain	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_peer_certificate	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_certs_clear	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_verify_mode	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_verify_depth	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_verify_depth	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_peername	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set1_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set1_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_purpose	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_purpose	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_trust	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_trust	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ PSK
SSL_use_psk_identity_hint	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_psk_identity_hint	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_psk_client_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_psk_find_session_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_psk_server_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_psk_use_session_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_psk_identity	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_psk_identity_hint	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ SRP
SSL_SRP_CTX_init	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_SRP_CTX_init	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_SRP_CTX_free	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SRP_CTX_free	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_client_pwd_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_password	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_srp_g	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_cb_arg	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_srp_N	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_username_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_srp_username	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_srp_server_param	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_srp_userinfo	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_srp_server_param_with_username	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_strength	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_verify_param_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_srp_server_param_pw	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_srp_username	HL	🟩U	🟩A	🟩NC*	🟢Done
SRP_Calc_A_param	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ DANE
SSL_CTX_dane_enable	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_dane_tlsa	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_dane_set_flags	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_dane_set_flags	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_dane_clear_flags	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_dane_clear_flags	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_dane	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_dane_enable	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_dane_authority	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_dane_mtype_set	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_dane_tlsa_add	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Certificate Transparency
SSL_CTX_enable_ct	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_ct_is_enabled	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_ctlog_list_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_ctlog_list_file	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_ct_validation_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set0_ctlog_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_ctlog_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_enable_ct	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_ct_is_enabled	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_peer_scts	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_ct_validation_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Compression
SSL_COMP_add_compression_method	HL	🟩U	🟩A	🟩NC* †5	🟢Done
SSL_COMP_get0_name	HL	🟩U	🟩A	🟩NC* †5	🟢Done
SSL_COMP_get_compression_methods	HL	🟩U	🟩A	🟩NC* †5	🟢Done
SSL_COMP_get_id	HL	🟩U	🟩A	🟩NC* †5	🟢Done
SSL_COMP_get_name	HL	🟩U	🟩A	🟩NC* †5	🟢Done
SSL_COMP_set0_compression_methods	HL	🟩U	🟩A	🟩NC* †5	🟢Done
⇒ Exporters
SSL_export_keying_material	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_export_keying_material_early	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Renegotiation
SSL_renegotiate	HL	🟩U	🟥FC	🟩NC* †5	🟢Done
SSL_renegotiate_abbreviated	HL	🟩U	🟥FC	🟩NC* †5	🟢Done
SSL_renegotiate_pending	HL	🟩U	🟧NO	🟩NC* †5	🟢Done
⇒ Options
SSL_CTX_clear_options	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_CTX_set_options	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_CTX_get_options	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_clear_options	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_set_options	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_get_options	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Configuration
SSL_CONF_CTX_new	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_free	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_set_ssl	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_set_ssl_ctx	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_set1_prefix	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_set_flags	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_clear_flags	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_CTX_finish	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_cmd	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_cmd_argv	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_CONF_cmd_value_type	Global	🟩U	🟩A	🟩NC*	🟢Done
SSL_config	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_config	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Callbacks
SSL_CTX_set_cert_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_cert_store	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_cert_verify_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_client_CA_list	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_client_cert_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_client_cert_engine	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_client_hello_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_cookie_generate_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_cookie_verify_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_passwd_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_passwd_cb_userdata	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_default_read_buffer_len	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_info_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_info_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_info_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_info_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_msg_callback	HL	🟩U	🟩A	🟩NC* †6	🟢Done
SSL_set_cert_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_default_passwd_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_default_passwd_cb_userdata	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_default_passwd_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_default_passwd_cb_userdata	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_keylog_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_keylog_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_psk_client_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_psk_find_session_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_psk_server_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_psk_use_session_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_verify_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_not_resumable_session_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_not_resumable_session_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_session_secret_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Session Management
d2i_SSL_SESSION	HL	🟩U	🟩A	🟩NC*	🟢Done
i2d_SSL_SESSION	HL	🟩U	🟩A	🟩NC*	🟢Done
PEM_read_bio_SSL_SESSION	HL	🟩U	🟩A	🟩NC*	🟢Done
PEM_read_SSL_SESSION	HL	🟩U	🟩A	🟩NC*	🟢Done
PEM_write_bio_SSL_SESSION	HL	🟩U	🟩A	🟩NC*	🟢Done
PEM_write_SSL_SESSION	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_new	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_up_ref	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_dup	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_free	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_print	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_print_fp	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_print_keylog	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_cipher	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set_cipher	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_hostname	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set1_hostname	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_id_context	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set1_id_context	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_peer	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_ticket	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_ticket_appdata	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set1_ticket_appdata	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_has_ticket	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_protocol_version	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set_protocol_version	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_compress_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set1_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_time	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set_time	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_timeout	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set_timeout	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_ex_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set_ex_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get0_hostname	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_set1_hostname	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_master_key	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_master_key	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_is_resumable	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_max_early_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_max_early_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_max_fragment_length	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_SESSION_get_ticket_lifetime_hint	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_add_session	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_remove_session	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get1_session	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_session	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_session	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sess_get_get_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sess_set_get_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sess_get_new_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sess_set_new_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sess_get_remove_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sess_set_remove_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_session_id_context	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_session_id_context	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_generate_session_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_generate_session_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_has_matching_session_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_flush_sessions	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_session_reused	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_timeout	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_timeout	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_default_timeout	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_sessions	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Session Ticket Management
SSL_get_num_tickets	HL	🟩U	🟩A	🟩NC* †7	🟢Done
SSL_set_num_tickets	HL	🟩U	🟩A	🟩NC* †7	🟢Done
SSL_CTX_get_num_tickets	HL	🟩U	🟩A	🟩NC* †7	🟢Done
SSL_CTX_set_num_tickets	HL	🟩U	🟩A	🟩NC* †7	🟢Done
SSL_new_session_ticket	HL	🟩U	🟩A	🟩NC* †7	🟢Done
SSL_set_session_ticket_ext	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_session_ticket_ext_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_tlsext_ticket_key_evp_cb	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Security Levels
SSL_CTX_get_security_level	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_security_level	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_security_level	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_security_level	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get_security_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_security_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_security_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_security_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_get0_security_ex_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set0_security_ex_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get0_security_ex_data	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set0_security_ex_data	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Custom Extensions
SSL_CTX_add_custom_ext	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_add_client_custom_ext	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_add_server_custom_ext	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_has_client_custom_ext	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Early ClientHello Processing
SSL_client_hello_get_extension_order	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get0_ciphers	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get0_compression_methods	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get0_ext	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get0_legacy_version	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get0_random	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get0_session_id	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_get1_extensions_present	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_client_hello_isv2	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ SNI
SSL_get_servername	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_servername_type	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Server Info
SSL_CTX_use_serverinfo	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_serverinfo_ex	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_use_serverinfo_file	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Post-Handshake Authentication
SSL_verify_client_post_handshake	HL	🟩U	🟥FC	🟨C* †8	🟢Done
SSL_CTX_set_post_handshake_auth	HL	🟩U	🟥FC	🟨C* †8	🟢Done
SSL_set_post_handshake_auth	HL	🟩U	🟥FC	🟨C* †8	🟢Done
⇒ DH Parameters
SSL_CTX_set_dh_auto	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_dh_auto	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set0_tmp_dh_pkey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set0_tmp_dh_pkey	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_tmp_dh_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_tmp_dh_callback	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTX_set_tmp_dh	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_tmp_dh	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ State Queries
SSL_in_init	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_in_before	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_is_init_finished	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_get_state	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_rstate_string	HL	🟩U	🟩A	🟧QSI	🟢Done
SSL_rstate_string_long	HL	🟩U	🟩A	🟧QSI	🟢Done
SSL_state_string	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_state_string_long	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Data Path and CSSM
SSL_set_connect_state	CSSM	🟩U	🟩A	🟧QSI	🟢Done
SSL_set_accept_state	CSSM	🟩U	🟩A	🟧QSI	🟢Done
SSL_is_server	CSSM	🟩U	🟩A	🟩NC*	🟢Done
SSL_peek	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_peek_ex	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_read	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_read_ex	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_write	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_write_ex	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_sendfile	ADP	🟩U	🟥FC	🟩NC*	🟢Done
SSL_pending	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_has_pending	ADP	🟧C	🟩A	🟧QSI	🟢Done
SSL_accept	CSSM	🟩U	🟩A	🟧QSI	🟢Done
SSL_connect	CSSM	🟩U	🟩A	🟧QSI	🟢Done
SSL_do_handshake	CSSM	🟩U	🟩A	🟧QSI	🟢Done
SSL_set0_wbio	NDP	🟩U	🟩A	🟧QSI	🟢Done
SSL_set0_rbio	NDP	🟧C	🟩A	🟧QSI	🟢Done
SSL_set_bio	NDP	🟧C	🟩A	🟧QSI	🟢Done
SSL_get_wbio	NDP	🟧C	🟩A	🟧QSI	🟢Done
SSL_get_rbio	NDP	🟧C	🟩A	🟧QSI	🟢Done
SSL_get_error	NDP	🟩U	🟩A	🟧QSI	🟢Done
SSL_get_rfd	NDP	🟩U	🟩A	🟩NC	🟢Done
SSL_get_wfd	NDP	🟩U	🟩A	🟩NC	🟢Done
SSL_get_fd	NDP	🟩U	🟩A	🟩NC	🟢Done
SSL_set_rfd	NDP	🟧C	🟩A	🟧QSI	🟢Done
SSL_set_wfd	NDP	🟧C	🟩A	🟧QSI	🟢Done
SSL_set_fd	NDP	🟩U	🟩A	🟧QSI	🟢Done
SSL_key_update	RL	🟩U	🟩A	🟧QSI	🟢Done
SSL_get_key_update_type	RL	🟩U	🟩A	🟧QSI	🟢Done
SSL_clear (connection)	CSSM	🟩U	🟥FC	🟧QSI	🟢Done
SSL_clear (stream)	CSSM	🟩U	🟥FC	🟧QSI	🟢Done
SSL_shutdown	CSSM	🟧C	🟩A	🟧QSI	🟢Done
SSL_want	ADP	🟧C	🟩A	🟧QSI	🟢Done
BIO_new_ssl_connect	Global	🟩U	🟩A	🟧QSI	🟢Done
BIO_new_buffer_ssl_connect	Global	🟩U	🟦U	🟧QSI	🟢Done
SSL_get_shutdown	CSSM	🟩U	🟩A	🟧QSI	🟢Done
SSL_set_shutdown	CSSM	🟩U	🟩A	🟧QSI	🟢Done
⇒ New APIs
SSL_is_tls	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_is_quic	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_handle_events	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_event_timeout	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_blocking_mode	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_set_blocking_mode	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_rpoll_descriptor	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_wpoll_descriptor	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_net_read_desired	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_net_write_desired	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_set1_initial_peer_addr	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_shutdown_ex	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_stream_conclude	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_stream_reset	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_stream_read_state	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_stream_write_state	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_stream_read_error_code	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_stream_write_error_code	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_conn_close_info	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_inject_net_dgram	NDP	🟦N	🟩A	🟥QSA	🟢Done
⇒ New APIs for Multi-Stream
SSL_get0_connection	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_is_connection	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_stream_id	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_stream_type	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_is_stream_local	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_new_stream	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_accept_stream	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_get_accept_stream_queue_len	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_set_default_stream_mode	CSSM	🟦N	🟩A	🟥QSA	🟢Done
SSL_set_incoming_stream_policy	CSSM	🟦N	🟩A	🟥QSA	🟢Done
⇒ Currently Not Supported
SSL_copy_session_id	Special	🟩U	🟥FC	🟨C*	🟢Done
BIO_ssl_copy_session_id	Special	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTX_set_quiet_shutdown	CSSM	🟩U	🟦U	🟩NC	🟢Done
SSL_CTX_get_quiet_shutdown	CSSM	🟩U	🟦U	🟩NC	🟢Done
SSL_set_quiet_shutdown	CSSM	🟩U	🟥FC	🟨C	🟢Done
SSL_get_quiet_shutdown	CSSM	🟩U	🟧NO	🟨C	🟢Done
SSL_CTX_set_ssl_version	HL	🟩U	🟥FC	🟨C	🟢Done
⇒ Async
SSL_CTX_set_async_callback	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_set_async_callback	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_CTX_set_async_callback_arg	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_set_async_callback_arg	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_waiting_for_async	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_get_async_status	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_get_all_async_fds	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
SSL_get_changed_async_fds	Async	🟩U	🟧NO	🟩NC* †10	🟢Done
⇒ Readahead
SSL_CTX_get_default_read_ahead	RL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTX_get_read_ahead	RL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTX_set_read_ahead	RL	🟩U	🟧NO	🟨C*	🟢Done
SSL_get_read_ahead	RL	🟩U	🟧NO	🟨C*	🟢Done
SSL_set_read_ahead	RL	🟩U	🟧NO	🟨C*	🟢Done
SSL_CTX_set_default_read_buffer_len	RL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_set_default_read_buffer_len	RL	🟩U	🟧NO	🟨C*	🟢Done
⇒ Record Padding and Fragmentation
SSL_CTX_set_record_padding_callback	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_record_padding_callback	RL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTX_get_record_padding_callback_arg	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_CTX_set_record_padding_callback_arg	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_get_record_padding_callback_arg	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_record_padding_callback_arg	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_CTX_set_block_padding	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_block_padding	RL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTX_set_tlsext_max_fragment_length	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_tlsext_max_fragment_length	RL	🟩U	🟥FC	🟨C*	🟢Done
⇒ Stateless/HelloRetryRequest
SSL_stateless	RL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTX_set_stateless_cookie_generate_cb	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_CTX_set_stateless_cookie_verify_cb	RL	🟩U	🟥FC	🟩NC*	🟢Done
⇒ Early Data/0-RTT
SSL_CTX_set_allow_early_data_cb	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_allow_early_data_cb	0-RTT	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTX_get_recv_max_early_data	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_CTX_set_recv_max_early_data	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_get_recv_max_early_data	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_recv_max_early_data	0-RTT	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTX_get_max_early_data	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_CTX_set_max_early_data	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_get_max_early_data	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
SSL_set_max_early_data	0-RTT	🟩U	🟥FC	🟨C*	🟢Done
SSL_read_early_data	0-RTT	🟩U	🟥FC	🟨C*	🟢Done
SSL_write_early_data	0-RTT	🟩U	🟥FC	🟨C*	🟢Done
SSL_get_early_data_status	0-RTT	🟩U	🟥FC	🟩NC*	🟢Done
⇒ Miscellaneous
DTLSv1_listen	RL	🟩U	🟦U	🟩NC	🟢Done
DTLS_set_timer_cb	NDP	🟩U	🟦U	🟩NC	🟢Done
DTLS_get_data_mtu	NDP	🟩U	🟦U	🟩NC	🟢Done
SSL_get_ex_data_X509_STORE_CTX_idx	Global	🟩U	🟦U	🟩NC	🟢Done
BIO_ssl_shutdown	Global	🟩U	🟩A	🟩NC	🟢Done
SSL_alloc_buffers	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_free_buffers	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_trace	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_set_debug	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ Controls
SSL_CTRL_MODE	Special	🟩U	🟩A	🟧QSI	🟢Done
SSL_CTRL_CLEAR_MODE	Special	🟩U	🟩A	🟧QSI	🟢Done
SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS	HL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTRL_GET_NUM_RENEGOTIATIONS	HL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTRL_GET_TOTAL_RENEGOTIATIONS	HL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTRL_GET_RI_SUPPORT	HL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTRL_GET_READ_AHEAD	HL	🟩U	🟧NO	🟩NC*	🟢Done
SSL_CTRL_SET_READ_AHEAD	HL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTRL_SET_MAX_PIPELINES	RL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTRL_SET_MAX_SEND_FRAGMENT	RL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTRL_SET_SPLIT_SEND_FRAGMENT	RL	🟩U	🟥FC	🟨C*	🟢Done
SSL_CTRL_SET_MTU	RL	🟩U	🟥FC	🟩NC*	🟢Done
SSL_CTRL_SET_MAX_PROTO_VERSION	HL	🟩U	🟩A	🟨C*	🟢Done
SSL_CTRL_SET_MIN_PROTO_VERSION	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_MAX_PROTO_VERSION	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_MIN_PROTO_VERSION	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_BUILD_CERT_CHAIN	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_CERT_FLAGS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_CHAIN	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_CHAIN_CERT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_CLEAR_CERT_FLAGS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_EXTRA_CHAIN_CERT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_CHAIN_CERTS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_CHAIN_CERT_STORE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_CLIENT_CERT_REQUEST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_CLIENT_CERT_TYPES	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_EC_POINT_FORMATS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_EXTMS_SUPPORT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_EXTRA_CHAIN_CERTS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_FLAGS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_GROUPS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_IANA_GROUPS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_MAX_CERT_LIST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_NEGOTIATED_GROUP	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_PEER_SIGNATURE_NID	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_PEER_TMP_KEY	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_RAW_CIPHERLIST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_SESS_CACHE_MODE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_SESS_CACHE_SIZE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_SHARED_GROUP	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_SIGNATURE_NID	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TLSEXT_TICKET_KEYS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_TMP_KEY	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_GET_VERIFY_CERT_STORE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SELECT_CURRENT_CERT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_ACCEPT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_ACCEPT_GOOD	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_ACCEPT_RENEGOTIATE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_CACHE_FULL	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_CB_HIT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_CONNECT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_CONNECT_GOOD	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_CONNECT_RENEGOTIATE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_HIT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_MISSES	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_NUMBER	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SESS_TIMEOUTS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_CHAIN_CERT_STORE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_CLIENT_CERT_TYPES	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_CLIENT_SIGALGS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_CLIENT_SIGALGS_LIST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_CURRENT_CERT	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_DH_AUTO	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_GROUPS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_GROUPS_LIST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_MAX_CERT_LIST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_MSG_CALLBACK	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_MSG_CALLBACK_ARG	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_RETRY_VERIFY	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SESS_CACHE_MODE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SESS_CACHE_SIZE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SIGALGS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SIGALGS_LIST	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SRP_ARG	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_SRP_VERIFY_PARAM_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_DEBUG_ARG	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_DEBUG_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_HOSTNAME	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_SERVERNAME_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLS_EXT_SRP_USERNAME	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TLSEXT_TICKET_KEYS	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TMP_DH	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TMP_DH_CB	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_TMP_ECDH	HL	🟩U	🟩A	🟩NC*	🟢Done
SSL_CTRL_SET_VERIFY_CERT_STORE	HL	🟩U	🟩A	🟩NC*	🟢Done
⇒ SSL Modes
SSL_MODE_ENABLE_PARTIAL_WRITE	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER	ADP	🟩U	🟩A	🟧QSI	🟢Done
SSL_MODE_RELEASE_BUFFERS	ADP	🟩U	🟧NO	🟩NC	🟢Done
SSL_MODE_ASYNC	ADP	🟩U	🟧NO	🟩NC	🟢Done
SSL_MODE_AUTO_RETRY	ADP	🟩U	🟧NO	🟩NC	🟢Done
SSL_MODE_SEND_FALLBACK_SCSV	HL	🟩U	🟩U	🟩NC	🟢Done

Q&A For TLS-Related Calls

What should SSL_get_current_cipher, SSL_get_pending_cipher, etc. do?

QUIC always uses AES-128-GCM for Initial packets. At this time the handshake layer has not negotiated a ciphersuite so it has no “current” cipher. We could return AES-128-GCM here, but it seems reasonable to just return NULL as the encryption is mostly for protection against accidental modification and not “real” encryption. From the perspective of the Handshake layer encryption is not active yet. An application using QUIC can always interpret NULL as meaning AES-128-GCM is being used if needed as this is implied by using QUIC.

A. We return NULL here, because it allows applications to detect if a ciphersuite has been negotiated and NULL can be used to infer that Initial encryption is still being used. This also minimises the changes needed to the implementation.

What should SSL_CTX_set_cipher_list do?

Since this function configures the cipher list for TLSv1.2 and below only, there is no need to restrict it as TLSv1.3 is required for QUIC. For the sake of application compatibility, applications can still configure the TLSv1.2 cipher list; it will always be ignored. This function can still be used to set the SECLEVEL; no changes are needed to facilitate this.

What SSL options should be supported?

Options we explicitly want to support:

• SSL_OP_CIPHER_SERVER_PREFERENCE
• SSL_OP_DISABLE_TLSEXT_CA_NAMES
• SSL_OP_NO_TX_CERTIFICATE_COMPRESSION
• SSL_OP_NO_RX_CERTIFICATE_COMPRESSION
• SSL_OP_PRIORITIZE_CHACHA
• SSL_OP_NO_TICKET
• SSL_OP_CLEANSE_PLAINTEXT

Options we do not yet support but could support in the future, currently no-ops:

• SSL_OP_NO_QUERY_MTU
• SSL_OP_NO_ANTI_REPLAY

The following options must be explicitly forbidden:

• SSL_OP_NO_TLSv1_3 — TLSv1.3 is required for QUIC
• SSL_OP_ENABLE_MIDDLEBOX_COMPAT — forbidden by QUIC RFCs
• SSL_OP_ENABLE_KTLS — not currently supported for QUIC
• SSL_OP_SAFARI_ECDHE_ECDSA_BUG
• SSL_OP_TLSEXT_PADDING
• SSL_OP_TLS_ROLLBACK_BUG
• SSL_OP_IGNORE_UNEXPECTED_EOF
• SSL_OP_ALLOW_NO_DHE_KEX

The following options are ignored for TLSv1.3 or otherwise not applicable and may therefore be settable but ignored. We take this approach on the grounds that it is harmless and applications might want to see that options have been correctly set for protocols unrelated to QUIC.

• SSL_OP_CRYPTOPRO_TLSEXT_BUG
• SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
• SSL_OP_ALLOW_CLIENT_RENEGOTIATION
• SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
• SSL_OP_CISCO_ANYCONNECT
• SSL_OP_COOKIE_EXCHANGE
• SSL_OP_LEGACY_SERVER_CONNECT
• SSL_OP_NO_COMPRESSION
• SSL_OP_NO_ENCRYPT_THEN_MAC
• SSL_OP_NO_EXTENDED_MASTER_SECRET
• SSL_OP_NO_RENEGOTIATION
• SSL_OP_NO_RESSION_RESUMPTION_ON_NEGOTIATION
• SSL_OP_NO_SSLv3
• SSL_OP_NO_TLSv1
• SSL_OP_NO_TLSv1_1
• SSL_OP_NO_TLSv1_2
• SSL_OP_NO_DTLSv1
• SSL_OP_NO_DTLSv1_2

What should SSL_rstate_string and SSL_state_string do?

SSL_state_string is highly handshake layer specific, so it makes sense to just forward to the handshake layer.

SSL_rstate_string is record layer specific. A cursory evaluation of usage via GitHub code search did not appear to identify much usage of this function other than for debug output; i.e., there seems to be little usage of this in a way that depends on the output for the purposes of control flow. Since there is not really any direct correspondence to the QUIC record layer, we conservatively define the output of this function as "unknown".

TODO: forbid NPN TODO: enforce TLSv1.3 TODO: forbid PHA - DONE TODO: forbid middlebox compat mode in a deeper way? TODO: new_session_ticket doesn't need modifying as such, but ticket machinery

  will

What should SSL_pending and SSL_has_pending do?

SSL_pending traditionally yields the number of bytes buffered inside a SSL object available for immediate reading. For QUIC, we can just make this report the current size of the receive stream buffer.

SSL_has_pending returns a boolean value indicating whether there is processed or unprocessed incoming data pending. There is no direct correspondence to QUIC, so there are various implementation options:

• SSL_pending() > 0
• SSL_pending() > 0 || pending URXEs or RXEs exist

The latter can probably be viewed as more of a direct correspondence to the design intent of the API, so we go with this.

What should SSL_alloc_buffers and SSL_free_buffers do?

These do not really correspond to our internal architecture for QUIC. Since internal buffers are always available, SSL_alloc_buffers can simply always return 1. SSL_free_buffers can always return 0, as though the buffers are in use, which they generally will be.

What should SSL_key_update and SSL_get_key_update_type?

SSL_key_update can trigger a TX record layer key update, which will cause the peer to respond with a key update in turn. The update occurs asynchronously at next transmission, not immediately.

SSL_get_key_update_type returns an enumerated value which is only relevant to the TLSv1.3 protocol; for QUIC, it will always return SSL_KEY_UPDATE_NONE.

What should SSL_MODE_AUTO_RETRY do?

The absence of SSL_MODE_AUTO_RETRY causes SSL_read/SSL_write on a normal TLS connection to potentially return due to internal handshake message processing. This does not really make sense for our QUIC implementation, therefore we always act as though SSL_MODE_AUTO_RETRY is on, and this mode is ignored.

What should SSL_MODE_SEND_FALLBACK_SCSV do?

This is not relevant to QUIC because this functionality relates to protocol version downgrade attack protection and QUIC only supports TLSv1.3. Thus, it is ignored.

What should SSL_CTX_set_ssl_version do?

This is a deprecated function, so it needn't be supported for QUIC. Fail closed.

What should SSL_set_ssl_method do?

We do not currently support this for QUIC.

What should SSL_set_shutdown do?

This is not supported and is a no-op for QUIC.

What should SSL_dup and SSL_clear do?

These may be tricky to support. Currently they are blocked.