ssl_locl.h 89.5 KB
Newer Older
R
Rich Salz 已提交
1 2
/*
 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
B
Bodo Möller 已提交
3
 *
R
Rich Salz 已提交
4 5 6 7
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
B
Bodo Möller 已提交
8
 */
R
Rich Salz 已提交
9

B
Bodo Möller 已提交
10 11
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
12
 * ECC cipher suite support in OpenSSL originally developed by
B
Bodo Möller 已提交
13 14
 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 */
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
/* ====================================================================
 * Copyright 2005 Nokia. All rights reserved.
 *
 * The portions of the attached software ("Contribution") is developed by
 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 * license.
 *
 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 * support (see RFC 4279) to OpenSSL.
 *
 * No patent licenses or other rights except those expressly stated in
 * the OpenSSL open source license shall be deemed granted or received
 * expressly, by implication, estoppel, or otherwise.
 *
 * No assurances are provided by Nokia that the Contribution does not
 * infringe the patent or other intellectual property rights of any third
 * party or that the license provides you with all the necessary rights
 * to make use of the Contribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 * OTHERWISE.
 */
41 42

#ifndef HEADER_SSL_LOCL_H
43 44 45 46 47
# define HEADER_SSL_LOCL_H
# include <stdlib.h>
# include <time.h>
# include <string.h>
# include <errno.h>
48

49
# include "e_os.h"
A
Andy Polyakov 已提交
50
# if defined(__unix) || defined(__unix__)
E
Emilia Kasper 已提交
51
#  include <sys/time.h>         /* struct timeval for DTLS */
A
Andy Polyakov 已提交
52
# endif
53

54
# include <openssl/buffer.h>
R
Rich Salz 已提交
55
# include <openssl/comp.h>
56 57
# include <openssl/bio.h>
# include <openssl/stack.h>
R
Rich Salz 已提交
58 59
# include <openssl/rsa.h>
# include <openssl/dsa.h>
60 61
# include <openssl/err.h>
# include <openssl/ssl.h>
M
Matt Caswell 已提交
62
# include <openssl/async.h>
63
# include <openssl/symhacks.h>
R
Rich Salz 已提交
64
# include <openssl/ct.h>
E
Emilia Kasper 已提交
65 66 67 68
# include "record/record.h"
# include "statem/statem.h"
# include "packet_locl.h"
# include "internal/dane.h"
69
# include "internal/refcount.h"
70

71 72 73 74
# ifdef OPENSSL_BUILD_SHLIBSSL
#  undef OPENSSL_EXTERN
#  define OPENSSL_EXTERN OPENSSL_EXPORT
# endif
75

76
# undef PKCS1_CHECK
77

78 79 80 81
# define c2l(c,l)        (l = ((unsigned long)(*((c)++)))     , \
                         l|=(((unsigned long)(*((c)++)))<< 8), \
                         l|=(((unsigned long)(*((c)++)))<<16), \
                         l|=(((unsigned long)(*((c)++)))<<24))
82 83

/* NOTE - c is not incremented as per c2l */
84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108
# define c2ln(c,l1,l2,n) { \
                        c+=n; \
                        l1=l2=0; \
                        switch (n) { \
                        case 8: l2 =((unsigned long)(*(--(c))))<<24; \
                        case 7: l2|=((unsigned long)(*(--(c))))<<16; \
                        case 6: l2|=((unsigned long)(*(--(c))))<< 8; \
                        case 5: l2|=((unsigned long)(*(--(c))));     \
                        case 4: l1 =((unsigned long)(*(--(c))))<<24; \
                        case 3: l1|=((unsigned long)(*(--(c))))<<16; \
                        case 2: l1|=((unsigned long)(*(--(c))))<< 8; \
                        case 1: l1|=((unsigned long)(*(--(c))));     \
                                } \
                        }

# define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff))

# define n2l(c,l)        (l =((unsigned long)(*((c)++)))<<24, \
                         l|=((unsigned long)(*((c)++)))<<16, \
                         l|=((unsigned long)(*((c)++)))<< 8, \
                         l|=((unsigned long)(*((c)++))))

109 110 111 112 113 114 115 116 117 118
# define n2l8(c,l)       (l =((uint64_t)(*((c)++)))<<56, \
                         l|=((uint64_t)(*((c)++)))<<48, \
                         l|=((uint64_t)(*((c)++)))<<40, \
                         l|=((uint64_t)(*((c)++)))<<32, \
                         l|=((uint64_t)(*((c)++)))<<24, \
                         l|=((uint64_t)(*((c)++)))<<16, \
                         l|=((uint64_t)(*((c)++)))<< 8, \
                         l|=((uint64_t)(*((c)++))))


119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139
# define l2n(l,c)        (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

# define l2n6(l,c)       (*((c)++)=(unsigned char)(((l)>>40)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

# define l2n8(l,c)       (*((c)++)=(unsigned char)(((l)>>56)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>48)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>40)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

140
/* NOTE - c is not incremented as per l2c */
141 142 143 144 145 146 147 148 149 150 151 152 153 154
# define l2cn(l1,l2,c,n) { \
                        c+=n; \
                        switch (n) { \
                        case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
                        case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
                        case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
                        case 5: *(--(c))=(unsigned char)(((l2)    )&0xff); \
                        case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
                        case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
                        case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
                        case 1: *(--(c))=(unsigned char)(((l1)    )&0xff); \
                                } \
                        }

M
Matt Caswell 已提交
155 156 157 158 159 160 161 162 163 164 165 166
# define n2s(c,s)        ((s=(((unsigned int)((c)[0]))<< 8)| \
                             (((unsigned int)((c)[1]))    )),(c)+=2)
# define s2n(s,c)        (((c)[0]=(unsigned char)(((s)>> 8)&0xff), \
                           (c)[1]=(unsigned char)(((s)    )&0xff)),(c)+=2)

# define n2l3(c,l)       ((l =(((unsigned long)((c)[0]))<<16)| \
                              (((unsigned long)((c)[1]))<< 8)| \
                              (((unsigned long)((c)[2]))    )),(c)+=3)

# define l2n3(l,c)       (((c)[0]=(unsigned char)(((l)>>16)&0xff), \
                           (c)[1]=(unsigned char)(((l)>> 8)&0xff), \
                           (c)[2]=(unsigned char)(((l)    )&0xff)),(c)+=3)
167

E
Emilia Kasper 已提交
168 169 170 171 172 173 174 175 176
/*
 * DTLS version numbers are strange because they're inverted. Except for
 * DTLS1_BAD_VER, which should be considered "lower" than the rest.
 */
# define dtls_ver_ordinal(v1) (((v1) == DTLS1_BAD_VER) ? 0xff00 : (v1))
# define DTLS_VERSION_GT(v1, v2) (dtls_ver_ordinal(v1) < dtls_ver_ordinal(v2))
# define DTLS_VERSION_GE(v1, v2) (dtls_ver_ordinal(v1) <= dtls_ver_ordinal(v2))
# define DTLS_VERSION_LT(v1, v2) (dtls_ver_ordinal(v1) > dtls_ver_ordinal(v2))
# define DTLS_VERSION_LE(v1, v2) (dtls_ver_ordinal(v1) >= dtls_ver_ordinal(v2))
177

178 179
/* LOCAL STUFF */

180 181
# define SSL_DECRYPT     0
# define SSL_ENCRYPT     1
182

183 184 185 186
# define TWO_BYTE_BIT    0x80
# define SEC_ESC_BIT     0x40
# define TWO_BYTE_MASK   0x7fff
# define THREE_BYTE_MASK 0x3fff
187

188 189 190
# define INC32(a)        ((a)=((a)+1)&0xffffffffL)
# define DEC32(a)        ((a)=((a)-1)&0xffffffffL)
# define MAX_MAC_SIZE    20     /* up from 16 for SSLv3 */
191

192 193 194 195 196 197 198 199
/*
 * Define the Bitmasks for SSL_CIPHER.algorithms.
 * This bits are used packed as dense as possible. If new methods/ciphers
 * etc will be added, the bits a likely to change, so this information
 * is for internal library use only, even though SSL_CIPHER.algorithms
 * can be publicly accessed.
 * Use the according functions for cipher management instead.
 *
U
Ulf Möller 已提交
200
 * The bit mask handling in the selection and sorting scheme in
201
 * ssl_create_cipher_list() has only limited capabilities, reflecting
U
Ulf Möller 已提交
202
 * that the different entities within are mutually exclusive:
203 204
 * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
 */
205 206

/* Bits for algorithm_mkey (key exchange algorithm) */
207
/* RSA key exchange */
D
Dr. Stephen Henson 已提交
208
# define SSL_kRSA                0x00000001U
209
/* tmp DH key no DH cert */
D
Dr. Stephen Henson 已提交
210
# define SSL_kDHE                0x00000002U
211
/* synonym */
212
# define SSL_kEDH                SSL_kDHE
213
/* ephemeral ECDH */
D
Dr. Stephen Henson 已提交
214
# define SSL_kECDHE              0x00000004U
215
/* synonym */
216
# define SSL_kEECDH              SSL_kECDHE
217
/* PSK */
D
Dr. Stephen Henson 已提交
218
# define SSL_kPSK                0x00000008U
219
/* GOST key exchange */
D
Dr. Stephen Henson 已提交
220
# define SSL_kGOST               0x00000010U
221
/* SRP */
D
Dr. Stephen Henson 已提交
222
# define SSL_kSRP                0x00000020U
223

D
Dr. Stephen Henson 已提交
224 225 226
# define SSL_kRSAPSK             0x00000040U
# define SSL_kECDHEPSK           0x00000080U
# define SSL_kDHEPSK             0x00000100U
227 228 229

/* all PSK */

E
Emilia Kasper 已提交
230
# define SSL_PSK     (SSL_kPSK | SSL_kRSAPSK | SSL_kECDHEPSK | SSL_kDHEPSK)
231

D
Dr. Stephen Henson 已提交
232 233 234
/* Any appropriate key exchange algorithm (for TLS 1.3 ciphersuites) */
# define SSL_kANY                0x00000000U

235
/* Bits for algorithm_auth (server authentication) */
236
/* RSA auth */
D
Dr. Stephen Henson 已提交
237
# define SSL_aRSA                0x00000001U
238
/* DSS auth */
D
Dr. Stephen Henson 已提交
239
# define SSL_aDSS                0x00000002U
240
/* no auth (i.e. use ADH or AECDH) */
D
Dr. Stephen Henson 已提交
241
# define SSL_aNULL               0x00000004U
242
/* ECDSA auth*/
D
Dr. Stephen Henson 已提交
243
# define SSL_aECDSA              0x00000008U
244
/* PSK auth */
D
Dr. Stephen Henson 已提交
245
# define SSL_aPSK                0x00000010U
246
/* GOST R 34.10-2001 signature auth */
D
Dr. Stephen Henson 已提交
247
# define SSL_aGOST01             0x00000020U
248
/* SRP auth */
D
Dr. Stephen Henson 已提交
249
# define SSL_aSRP                0x00000040U
250
/* GOST R 34.10-2012 signature auth */
D
Dr. Stephen Henson 已提交
251
# define SSL_aGOST12             0x00000080U
D
Dr. Stephen Henson 已提交
252 253
/* Any appropriate signature auth (for TLS 1.3 ciphersuites) */
# define SSL_aANY                0x00000000U
254 255

/* Bits for algorithm_enc (symmetric encryption) */
D
Dr. Stephen Henson 已提交
256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273
# define SSL_DES                 0x00000001U
# define SSL_3DES                0x00000002U
# define SSL_RC4                 0x00000004U
# define SSL_RC2                 0x00000008U
# define SSL_IDEA                0x00000010U
# define SSL_eNULL               0x00000020U
# define SSL_AES128              0x00000040U
# define SSL_AES256              0x00000080U
# define SSL_CAMELLIA128         0x00000100U
# define SSL_CAMELLIA256         0x00000200U
# define SSL_eGOST2814789CNT     0x00000400U
# define SSL_SEED                0x00000800U
# define SSL_AES128GCM           0x00001000U
# define SSL_AES256GCM           0x00002000U
# define SSL_AES128CCM           0x00004000U
# define SSL_AES256CCM           0x00008000U
# define SSL_AES128CCM8          0x00010000U
# define SSL_AES256CCM8          0x00020000U
274
# define SSL_eGOST2814789CNT12   0x00040000U
A
Andy Polyakov 已提交
275
# define SSL_CHACHA20POLY1305    0x00080000U
276

E
Emilia Kasper 已提交
277 278 279
# define SSL_AESGCM              (SSL_AES128GCM | SSL_AES256GCM)
# define SSL_AESCCM              (SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8)
# define SSL_AES                 (SSL_AES128|SSL_AES256|SSL_AESGCM|SSL_AESCCM)
280
# define SSL_CAMELLIA            (SSL_CAMELLIA128|SSL_CAMELLIA256)
T
Todd Short 已提交
281
# define SSL_CHACHA20            (SSL_CHACHA20POLY1305)
282 283

/* Bits for algorithm_mac (symmetric authentication) */
284

D
Dr. Stephen Henson 已提交
285 286 287 288 289 290
# define SSL_MD5                 0x00000001U
# define SSL_SHA1                0x00000002U
# define SSL_GOST94      0x00000004U
# define SSL_GOST89MAC   0x00000008U
# define SSL_SHA256              0x00000010U
# define SSL_SHA384              0x00000020U
291
/* Not a real MAC, just an indication it is part of cipher */
D
Dr. Stephen Henson 已提交
292
# define SSL_AEAD                0x00000040U
293 294 295
# define SSL_GOST12_256          0x00000080U
# define SSL_GOST89MAC12         0x00000100U
# define SSL_GOST12_512          0x00000200U
296

297
/*
298
 * When adding new digest in the ssl_ciph.c and increment SSL_MD_NUM_IDX make
299 300
 * sure to update this constant too
 */
301 302 303 304 305 306 307 308 309 310 311

# define SSL_MD_MD5_IDX  0
# define SSL_MD_SHA1_IDX 1
# define SSL_MD_GOST94_IDX 2
# define SSL_MD_GOST89MAC_IDX 3
# define SSL_MD_SHA256_IDX 4
# define SSL_MD_SHA384_IDX 5
# define SSL_MD_GOST12_256_IDX  6
# define SSL_MD_GOST89MAC12_IDX 7
# define SSL_MD_GOST12_512_IDX  8
# define SSL_MD_MD5_SHA1_IDX 9
312 313 314
# define SSL_MD_SHA224_IDX 10
# define SSL_MD_SHA512_IDX 11
# define SSL_MAX_DIGEST 12
315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336

/* Bits for algorithm2 (handshake digests and other extra flags) */

/* Bits 0-7 are handshake MAC */
# define SSL_HANDSHAKE_MAC_MASK  0xFF
# define SSL_HANDSHAKE_MAC_MD5_SHA1 SSL_MD_MD5_SHA1_IDX
# define SSL_HANDSHAKE_MAC_SHA256   SSL_MD_SHA256_IDX
# define SSL_HANDSHAKE_MAC_SHA384   SSL_MD_SHA384_IDX
# define SSL_HANDSHAKE_MAC_GOST94 SSL_MD_GOST94_IDX
# define SSL_HANDSHAKE_MAC_GOST12_256 SSL_MD_GOST12_256_IDX
# define SSL_HANDSHAKE_MAC_GOST12_512 SSL_MD_GOST12_512_IDX
# define SSL_HANDSHAKE_MAC_DEFAULT  SSL_HANDSHAKE_MAC_MD5_SHA1

/* Bits 8-15 bits are PRF */
# define TLS1_PRF_DGST_SHIFT 8
# define TLS1_PRF_SHA1_MD5 (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_SHA256 (SSL_MD_SHA256_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_SHA384 (SSL_MD_SHA384_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST94 (SSL_MD_GOST94_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST12_256 (SSL_MD_GOST12_256_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST12_512 (SSL_MD_GOST12_512_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF            (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
337

338 339 340 341
/*
 * Stream MAC for GOST ciphersuites from cryptopro draft (currently this also
 * goes into algorithm2)
 */
342
# define TLS1_STREAM_MAC 0x10000
343

344
# define SSL_STRONG_MASK         0x0000001FU
345
# define SSL_DEFAULT_MASK        0X00000020U
346

347 348 349 350 351 352
# define SSL_STRONG_NONE         0x00000001U
# define SSL_LOW                 0x00000002U
# define SSL_MEDIUM              0x00000004U
# define SSL_HIGH                0x00000008U
# define SSL_FIPS                0x00000010U
# define SSL_NOT_DEFAULT         0x00000020U
353

354
/* we have used 0000003f - 26 bits left to go */
355

356 357 358
/* Flag used on OpenSSL ciphersuite ids to indicate they are for SSLv3+ */
# define SSL3_CK_CIPHERSUITE_FLAG                0x03000000

D
Dr. Stephen Henson 已提交
359
/* Check if an SSL structure is using DTLS */
360
# define SSL_IS_DTLS(s)  (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
361 362

/* Check if we are using TLSv1.3 */
M
Matt Caswell 已提交
363 364 365
# define SSL_IS_TLS13(s) (!SSL_IS_DTLS(s) \
                          && (s)->method->version >= TLS1_3_VERSION \
                          && (s)->method->version != TLS_ANY_VERSION)
366

367 368
# define SSL_IS_FIRST_HANDSHAKE(S) ((s)->s3->tmp.finish_md_len == 0)

369
/* See if we need explicit IV */
370 371 372 373 374
# define SSL_USE_EXPLICIT_IV(s)  \
                (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_EXPLICIT_IV)
/*
 * See if we use signature algorithms extension and signature algorithm
 * before signatures.
375
 */
376 377 378 379 380
# define SSL_USE_SIGALGS(s)      \
                        (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SIGALGS)
/*
 * Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2: may
 * apply to others in future.
381
 */
382 383 384 385
# define SSL_USE_TLS1_2_CIPHERS(s)       \
                (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)
/*
 * Determine if a client can use TLS 1.2 ciphersuites: can't rely on method
386 387
 * flags because it may not be set to correct version yet.
 */
388
# define SSL_CLIENT_USE_TLS1_2_CIPHERS(s)        \
389 390
    ((!SSL_IS_DTLS(s) && s->client_version >= TLS1_2_VERSION) || \
     (SSL_IS_DTLS(s) && DTLS_VERSION_GE(s->client_version, DTLS1_2_VERSION)))
391 392 393 394 395 396
/*
 * Determine if a client should send signature algorithms extension:
 * as with TLS1.2 cipher we can't rely on method flags.
 */
# define SSL_CLIENT_USE_SIGALGS(s)        \
    SSL_CLIENT_USE_TLS1_2_CIPHERS(s)
397

398 399
# define SSL_READ_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_READ)
# define SSL_WRITE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE)
400

401
/* Mostly for SSLv3 */
402 403 404 405 406 407 408
# define SSL_PKEY_RSA            0
# define SSL_PKEY_DSA_SIGN       1
# define SSL_PKEY_ECC            2
# define SSL_PKEY_GOST01         3
# define SSL_PKEY_GOST12_256     4
# define SSL_PKEY_GOST12_512     5
# define SSL_PKEY_NUM            6
409 410 411 412 413
/*
 * Pseudo-constant. GOST cipher suites can use different certs for 1
 * SSL_CIPHER. So let's see which one we have in fact.
 */
# define SSL_PKEY_GOST_EC SSL_PKEY_NUM+1
414

415
/*
416
 * TODO(TLS1.3) for now use SSL_PKEY_RSA keys for PSS
417 418
 */

419
#define SSL_PKEY_RSA_PSS_SIGN SSL_PKEY_RSA
420

421
/*-
422
 * SSL_kRSA <- RSA_ENC
423
 * SSL_kDH  <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN)
424
 * SSL_kDHE <- RSA_ENC | RSA_SIGN | DSA_SIGN
425 426 427 428
 * SSL_aRSA <- RSA_ENC | RSA_SIGN
 * SSL_aDSS <- DSA_SIGN
 */

M
Matt Caswell 已提交
429
/*-
430 431 432
#define CERT_INVALID            0
#define CERT_PUBLIC_KEY         1
#define CERT_PRIVATE_KEY        2
433 434
*/

E
Emilia Kasper 已提交
435
/* CipherSuite length. SSLv3 and all TLS versions. */
E
Emilia Kasper 已提交
436
# define TLS_CIPHER_LEN 2
437 438
/* used to hold info on the particular ciphers used */
struct ssl_cipher_st {
439
    uint32_t valid;
E
Emilia Kasper 已提交
440 441
    const char *name;           /* text name */
    uint32_t id;                /* id, 4 bytes, first is version */
442
    /*
443
     * changed in 1.0.0: these four used to be portions of a single value
444 445
     * 'algorithms'
     */
E
Emilia Kasper 已提交
446 447 448 449 450 451 452 453 454 455 456 457
    uint32_t algorithm_mkey;    /* key exchange algorithm */
    uint32_t algorithm_auth;    /* server authentication */
    uint32_t algorithm_enc;     /* symmetric encryption */
    uint32_t algorithm_mac;     /* symmetric authentication */
    int min_tls;                /* minimum SSL/TLS protocol version */
    int max_tls;                /* maximum SSL/TLS protocol version */
    int min_dtls;               /* minimum DTLS protocol version */
    int max_dtls;               /* maximum DTLS protocol version */
    uint32_t algo_strength;     /* strength and export flags */
    uint32_t algorithm2;        /* Extra flags */
    int32_t strength_bits;      /* Number of bits really used */
    uint32_t alg_bits;          /* Number of bits for algorithm */
458 459
};

M
Matt Caswell 已提交
460
/* Used to hold SSL/TLS functions */
461 462
struct ssl_method_st {
    int version;
463 464
    unsigned flags;
    unsigned long mask;
465 466 467 468 469
    int (*ssl_new) (SSL *s);
    void (*ssl_clear) (SSL *s);
    void (*ssl_free) (SSL *s);
    int (*ssl_accept) (SSL *s);
    int (*ssl_connect) (SSL *s);
470 471
    int (*ssl_read) (SSL *s, void *buf, size_t len, size_t *readbytes);
    int (*ssl_peek) (SSL *s, void *buf, size_t len, size_t *readbytes);
M
Matt Caswell 已提交
472
    int (*ssl_write) (SSL *s, const void *buf, size_t len, size_t *written);
473 474
    int (*ssl_shutdown) (SSL *s);
    int (*ssl_renegotiate) (SSL *s);
475
    int (*ssl_renegotiate_check) (SSL *s, int);
476
    int (*ssl_read_bytes) (SSL *s, int type, int *recvd_type,
477
                           unsigned char *buf, size_t len, int peek,
478
                           size_t *readbytes);
M
Matt Caswell 已提交
479 480
    int (*ssl_write_bytes) (SSL *s, int type, const void *buf_, size_t len,
                            size_t *written);
481 482 483 484
    int (*ssl_dispatch_alert) (SSL *s);
    long (*ssl_ctrl) (SSL *s, int cmd, long larg, void *parg);
    long (*ssl_ctx_ctrl) (SSL_CTX *ctx, int cmd, long larg, void *parg);
    const SSL_CIPHER *(*get_cipher_by_char) (const unsigned char *ptr);
M
Matt Caswell 已提交
485
    int (*put_cipher_by_char) (const SSL_CIPHER *cipher, WPACKET *pkt,
486
                               size_t *len);
M
Matt Caswell 已提交
487
    size_t (*ssl_pending) (const SSL *s);
488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517
    int (*num_ciphers) (void);
    const SSL_CIPHER *(*get_cipher) (unsigned ncipher);
    long (*get_timeout) (void);
    const struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
    int (*ssl_version) (void);
    long (*ssl_callback_ctrl) (SSL *s, int cb_id, void (*fp) (void));
    long (*ssl_ctx_callback_ctrl) (SSL_CTX *s, int cb_id, void (*fp) (void));
};

/*-
 * Lets make this into an ASN.1 type structure as follows
 * SSL_SESSION_ID ::= SEQUENCE {
 *      version                 INTEGER,        -- structure version number
 *      SSLversion              INTEGER,        -- SSL version number
 *      Cipher                  OCTET STRING,   -- the 3 byte cipher ID
 *      Session_ID              OCTET STRING,   -- the Session ID
 *      Master_key              OCTET STRING,   -- the master key
 *      Key_Arg [ 0 ] IMPLICIT  OCTET STRING,   -- the optional Key argument
 *      Time [ 1 ] EXPLICIT     INTEGER,        -- optional Start Time
 *      Timeout [ 2 ] EXPLICIT  INTEGER,        -- optional Timeout ins seconds
 *      Peer [ 3 ] EXPLICIT     X509,           -- optional Peer Certificate
 *      Session_ID_context [ 4 ] EXPLICIT OCTET STRING,   -- the Session ID context
 *      Verify_result [ 5 ] EXPLICIT INTEGER,   -- X509_V_... code for `Peer'
 *      HostName [ 6 ] EXPLICIT OCTET STRING,   -- optional HostName from servername TLS extension
 *      PSK_identity_hint [ 7 ] EXPLICIT OCTET STRING, -- optional PSK identity hint
 *      PSK_identity [ 8 ] EXPLICIT OCTET STRING,  -- optional PSK identity
 *      Ticket_lifetime_hint [9] EXPLICIT INTEGER, -- server's lifetime hint for session ticket
 *      Ticket [10]             EXPLICIT OCTET STRING, -- session ticket (clients only)
 *      Compression_meth [11]   EXPLICIT OCTET STRING, -- optional compression method
 *      SRP_username [ 12 ] EXPLICIT OCTET STRING -- optional SRP username
518
 *      flags [ 13 ] EXPLICIT INTEGER -- optional flags
519 520 521 522 523
 *      }
 * Look in ssl/ssl_asn1.c for more details
 * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
 */
struct ssl_session_st {
E
Emilia Kasper 已提交
524 525
    int ssl_version;            /* what ssl version session info is being kept
                                 * in here? */
526
    size_t master_key_length;
527 528 529 530 531

    /*
     * For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
     * master secret
     */
M
Matt Caswell 已提交
532
    unsigned char master_key[TLS13_MAX_RESUMPTION_MASTER_LENGTH];
533
    /* session_id - valid? */
534
    size_t session_id_length;
535 536 537 538 539 540
    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
    /*
     * this is used to determine whether the session is being reused in the
     * appropriate context. It is up to the application to set this, via
     * SSL_new
     */
541
    size_t sid_ctx_length;
542 543 544 545 546 547 548 549 550 551 552
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
# ifndef OPENSSL_NO_PSK
    char *psk_identity_hint;
    char *psk_identity;
# endif
    /*
     * Used to indicate that session resumption is not allowed. Applications
     * can also set this bit for a new session via not_resumable_session_cb
     * to disable session caching and tickets.
     */
    int not_resumable;
553
    /* This is the cert and type for the other end. */
554
    X509 *peer;
555
    int peer_type;
556
    /* Certificate chain peer sent */
557
    STACK_OF(X509) *peer_chain;
558 559 560 561 562
    /*
     * when app_verify_callback accepts a session where the peer's
     * certificate is not ok, we must remember the error for session reuse:
     */
    long verify_result;         /* only for servers */
563
    CRYPTO_REF_COUNT references;
564 565 566 567
    long timeout;
    long time;
    unsigned int compress_meth; /* Need to lookup the method */
    const SSL_CIPHER *cipher;
E
Emilia Kasper 已提交
568 569
    unsigned long cipher_id;    /* when ASN.1 loaded, this needs to be used to
                                 * load the 'cipher' structure */
570 571 572 573 574 575 576
    STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */
    CRYPTO_EX_DATA ex_data;     /* application specific data */
    /*
     * These are used to make removal of session-ids more efficient and to
     * implement a maximum cache size.
     */
    struct ssl_session_st *prev, *next;
R
Rich Salz 已提交
577 578 579

    struct {
        char *hostname;
580
# ifndef OPENSSL_NO_EC
R
Rich Salz 已提交
581 582 583 584
        size_t ecpointformats_len;
        unsigned char *ecpointformats; /* peer's list */
        size_t supportedgroups_len;
        unsigned char *supportedgroups; /* peer's list */
E
Emilia Kasper 已提交
585
# endif                         /* OPENSSL_NO_EC */
586
    /* RFC4507 info */
R
Rich Salz 已提交
587 588 589 590
        unsigned char *tick; /* Session ticket */
        size_t ticklen;      /* Session ticket length */
        /* Session lifetime hint in seconds */
        unsigned long tick_lifetime_hint;
M
Matt Caswell 已提交
591
        uint32_t tick_age_add;
592
        int tick_identity;
R
Rich Salz 已提交
593
    } ext;
594 595 596
# ifndef OPENSSL_NO_SRP
    char *srp_username;
# endif
597
    uint32_t flags;
598
    CRYPTO_RWLOCK *lock;
599 600
};

601
/* Extended master secret support */
E
Emilia Kasper 已提交
602
# define SSL_SESS_FLAG_EXTMS             0x1
603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630

# ifndef OPENSSL_NO_SRP

typedef struct srp_ctx_st {
    /* param for all the callbacks */
    void *SRP_cb_arg;
    /* set client Hello login callback */
    int (*TLS_ext_srp_username_callback) (SSL *, int *, void *);
    /* set SRP N/g param callback for verification */
    int (*SRP_verify_param_callback) (SSL *, void *);
    /* set SRP client passwd callback */
    char *(*SRP_give_srp_client_pwd_callback) (SSL *, void *);
    char *login;
    BIGNUM *N, *g, *s, *B, *A;
    BIGNUM *a, *b, *v;
    char *info;
    int strength;
    unsigned long srp_Mask;
} SRP_CTX;

# endif

struct ssl_comp_st {
    int id;
    const char *name;
    COMP_METHOD *method;
};

631
DEFINE_LHASH_OF(SSL_SESSION);
V
Viktor Dukhovni 已提交
632 633
/* Needed in ssl_cert.c */
DEFINE_LHASH_OF(X509_NAME);
634

E
Emilia Kasper 已提交
635
# define TLSEXT_KEYNAME_LENGTH 16
K
Kurt Roeckx 已提交
636

637 638 639 640 641 642 643 644 645 646 647
struct ssl_ctx_st {
    const SSL_METHOD *method;
    STACK_OF(SSL_CIPHER) *cipher_list;
    /* same as above but sorted for lookup */
    STACK_OF(SSL_CIPHER) *cipher_list_by_id;
    struct x509_store_st /* X509_STORE */ *cert_store;
    LHASH_OF(SSL_SESSION) *sessions;
    /*
     * Most session-ids that will be cached, default is
     * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited.
     */
M
Matt Caswell 已提交
648
    size_t session_cache_size;
649 650 651 652 653 654 655
    struct ssl_session_st *session_cache_head;
    struct ssl_session_st *session_cache_tail;
    /*
     * This can have one of 2 values, ored together, SSL_SESS_CACHE_CLIENT,
     * SSL_SESS_CACHE_SERVER, Default is SSL_SESSION_CACHE_SERVER, which
     * means only SSL_accept which cache SSL_SESSIONS.
     */
656
    uint32_t session_cache_mode;
657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674
    /*
     * If timeout is not 0, it is the default timeout value set when
     * SSL_new() is called.  This has been put in to make life easier to set
     * things up
     */
    long session_timeout;
    /*
     * If this callback is not null, it will be called each time a session id
     * is added to the cache.  If this function returns 1, it means that the
     * callback will do a SSL_SESSION_free() when it has finished using it.
     * Otherwise, on 0, it means the callback has finished with it. If
     * remove_session_cb is not null, it will be called when a session-id is
     * removed from the cache.  After the call, OpenSSL will
     * SSL_SESSION_free() it.
     */
    int (*new_session_cb) (struct ssl_st *ssl, SSL_SESSION *sess);
    void (*remove_session_cb) (struct ssl_ctx_st *ctx, SSL_SESSION *sess);
    SSL_SESSION *(*get_session_cb) (struct ssl_st *ssl,
E
Emilia Kasper 已提交
675 676
                                    const unsigned char *data, int len,
                                    int *copy);
677 678 679 680 681 682 683 684 685 686 687 688 689
    struct {
        int sess_connect;       /* SSL new conn - started */
        int sess_connect_renegotiate; /* SSL reneg - requested */
        int sess_connect_good;  /* SSL new conne/reneg - finished */
        int sess_accept;        /* SSL new accept - started */
        int sess_accept_renegotiate; /* SSL reneg - requested */
        int sess_accept_good;   /* SSL accept/reneg - finished */
        int sess_miss;          /* session lookup misses */
        int sess_timeout;       /* reuse attempt on timeouted session */
        int sess_cache_full;    /* session removed due to full cache */
        int sess_hit;           /* session reuse actually done */
        int sess_cb_hit;        /* session-id that was not in the cache was
                                 * passed back via the callback.  This
E
Emilia Kasper 已提交
690 691 692
                                 * indicates that the application is supplying
                                 * session-id's from other processes - spooky
                                 * :-) */
693 694
    } stats;

695
    CRYPTO_REF_COUNT references;
696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718

    /* if defined, these override the X509_verify_cert() calls */
    int (*app_verify_callback) (X509_STORE_CTX *, void *);
    void *app_verify_arg;
    /*
     * before OpenSSL 0.9.7, 'app_verify_arg' was ignored
     * ('app_verify_callback' was called with just one argument)
     */

    /* Default password callback. */
    pem_password_cb *default_passwd_callback;

    /* Default password callback user data. */
    void *default_passwd_callback_userdata;

    /* get client cert callback */
    int (*client_cert_cb) (SSL *ssl, X509 **x509, EVP_PKEY **pkey);

    /* cookie generate callback */
    int (*app_gen_cookie_cb) (SSL *ssl, unsigned char *cookie,
                              unsigned int *cookie_len);

    /* verify cookie callback */
E
Emilia Kasper 已提交
719
    int (*app_verify_cookie_cb) (SSL *ssl, const unsigned char *cookie,
720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742
                                 unsigned int cookie_len);

    CRYPTO_EX_DATA ex_data;

    const EVP_MD *md5;          /* For SSLv3/TLSv1 'ssl3-md5' */
    const EVP_MD *sha1;         /* For SSLv3/TLSv1 'ssl3->sha1' */

    STACK_OF(X509) *extra_certs;
    STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */

    /* Default values used when no per-SSL value is defined follow */

    /* used if SSL's info_callback is NULL */
    void (*info_callback) (const SSL *ssl, int type, int val);

    /* what we put in client cert requests */
    STACK_OF(X509_NAME) *client_CA;

    /*
     * Default values to use in SSL structures follow (these are copied by
     * SSL_new)
     */

743 744
    uint32_t options;
    uint32_t mode;
745 746
    int min_proto_version;
    int max_proto_version;
747
    size_t max_cert_list;
748 749 750 751 752 753 754 755 756

    struct cert_st /* CERT */ *cert;
    int read_ahead;

    /* callback that allows applications to peek at protocol messages */
    void (*msg_callback) (int write_p, int version, int content_type,
                          const void *buf, size_t len, SSL *ssl, void *arg);
    void *msg_callback_arg;

757
    uint32_t verify_mode;
758
    size_t sid_ctx_length;
759 760 761 762 763 764 765 766 767 768 769
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
    /* called 'verify_callback' in the SSL */
    int (*default_verify_callback) (int ok, X509_STORE_CTX *ctx);

    /* Default generate session ID callback. */
    GEN_SESSION_CB generate_session_id;

    X509_VERIFY_PARAM *param;

    int quiet_shutdown;

E
Emilia Kasper 已提交
770 771
# ifndef OPENSSL_NO_CT
    CTLOG_STORE *ctlog_store;   /* CT Log Store */
772
    /*
E
Emilia Kasper 已提交
773 774 775
     * Validates that the SCTs (Signed Certificate Timestamps) are sufficient.
     * If they are not, the connection should be aborted.
     */
776
    ssl_ct_validation_cb ct_validation_callback;
777
    void *ct_validation_callback_arg;
E
Emilia Kasper 已提交
778
# endif
779

780 781 782 783
    /*
     * If we're using more than one pipeline how should we divide the data
     * up between the pipes?
     */
M
Matt Caswell 已提交
784
    size_t split_send_fragment;
785 786 787 788
    /*
     * Maximum amount of data to send in one fragment. actual record size can
     * be more than this due to padding and MAC overheads.
     */
M
Matt Caswell 已提交
789
    size_t max_send_fragment;
790

791
    /* Up to how many pipelines should we use? If 0 then 1 is assumed */
M
Matt Caswell 已提交
792
    size_t max_pipelines;
793

794 795 796
    /* The default read buffer length to use (0 means not set) */
    size_t default_read_buf_len;

E
Emilia Kasper 已提交
797
# ifndef OPENSSL_NO_ENGINE
798 799 800 801
    /*
     * Engine to pass requests for client certs to
     */
    ENGINE *client_cert_engine;
E
Emilia Kasper 已提交
802
# endif
803

R
Rich Salz 已提交
804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823
    /* TLS extensions. */
    struct {
        /* TLS extensions servername callback */
        int (*servername_cb) (SSL *, int *, void *);
        void *servername_arg;
        /* RFC 4507 session ticket keys */
        unsigned char tick_key_name[TLSEXT_KEYNAME_LENGTH];
        unsigned char tick_hmac_key[32];
        unsigned char tick_aes_key[32];
        /* Callback to support customisation of ticket key setting */
        int (*ticket_key_cb) (SSL *ssl,
                              unsigned char *name, unsigned char *iv,
                              EVP_CIPHER_CTX *ectx, HMAC_CTX *hctx, int enc);

        /* certificate status request info */
        /* Callback for status request */
        int (*status_cb) (SSL *ssl, void *arg);
        void *status_arg;
        /* ext status type used for CSR extension (OCSP Stapling) */
        int status_type;
824

R
Rich Salz 已提交
825 826 827 828 829 830 831
# ifndef OPENSSL_NO_EC
        /* EC extension values inherited by SSL structure */
        size_t ecpointformats_len;
        unsigned char *ecpointformats;
        size_t supportedgroups_len;
        unsigned char *supportedgroups;
# endif                         /* OPENSSL_NO_EC */
832

R
Rich Salz 已提交
833 834 835 836
        /*
         * ALPN information (we are in the process of transitioning from NPN to
         * ALPN.)
         */
837 838 839 840 841 842 843 844 845 846 847

        /*-
         * For a server, this contains a callback function that allows the
         * server to select the protocol for the connection.
         *   out: on successful return, this must point to the raw protocol
         *        name (without the length prefix).
         *   outlen: on successful return, this contains the length of |*out|.
         *   in: points to the client's list of supported protocols in
         *       wire-format.
         *   inlen: the length of |in|.
         */
R
Rich Salz 已提交
848 849 850 851 852 853
        int (*alpn_select_cb) (SSL *s,
                               const unsigned char **out,
                               unsigned char *outlen,
                               const unsigned char *in,
                               unsigned int inlen, void *arg);
        void *alpn_select_cb_arg;
854

R
Rich Salz 已提交
855 856 857 858 859 860 861
        /*
         * For a client, this contains the list of supported protocols in wire
         * format.
         */
        unsigned char *alpn;
        size_t alpn_len;

862
# ifndef OPENSSL_NO_NEXTPROTONEG
R
Rich Salz 已提交
863 864 865 866 867 868
        /* Next protocol negotiation information */

        /*
         * For a server, this contains a callback function by which the set of
         * advertised protocols can be provided.
         */
869
        SSL_CTX_npn_advertised_cb_func npn_advertised_cb;
R
Rich Salz 已提交
870 871 872 873 874
        void *npn_advertised_cb_arg;
        /*
         * For a client, this contains a callback function that selects the next
         * protocol from the list provided by the server.
         */
875
        SSL_CTX_npn_select_cb_func npn_select_cb;
R
Rich Salz 已提交
876 877 878 879 880
        void *npn_select_cb_arg;
# endif
    } ext;

# ifndef OPENSSL_NO_PSK
881 882
    SSL_psk_client_cb_func psk_client_callback;
    SSL_psk_server_cb_func psk_server_callback;
R
Rich Salz 已提交
883 884 885 886 887
# endif

# ifndef OPENSSL_NO_SRP
    SRP_CTX srp_ctx;            /* ctx for SRP authentication */
# endif
888

889 890 891
    /* Shared DANE context */
    struct dane_ctx_st dane;

892 893 894 895 896 897 898
    /* SRTP profiles we are willing to do from RFC 5764 */
    STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
    /*
     * Callback for disabling session caching and ticket support on a session
     * basis, depending on the chosen cipher.
     */
    int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
899

900
    CRYPTO_RWLOCK *lock;
901 902 903 904 905 906

    /*
     * Callback for logging key material for use with debugging tools like
     * Wireshark. The callback should log `line` followed by a newline.
     */
    SSL_CTX_keylog_cb_func keylog_callback;
907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940
};

struct ssl_st {
    /*
     * protocol version (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION,
     * DTLS1_VERSION)
     */
    int version;
    /* SSLv3 */
    const SSL_METHOD *method;
    /*
     * There are 2 BIO's even though they are normally both the same.  This
     * is so data can be read and written to different handlers
     */
    /* used by SSL_read */
    BIO *rbio;
    /* used by SSL_write */
    BIO *wbio;
    /* used during session-id reuse to concatenate messages */
    BIO *bbio;
    /*
     * This holds a variable that indicates what we were doing when a 0 or -1
     * is returned.  This is needed for non-blocking IO so we know what
     * request needs re-doing when in SSL_accept or SSL_connect
     */
    int rwstate;
    int (*handshake_func) (SSL *);
    /*
     * Imagine that here's a boolean member "init" that is switched as soon
     * as SSL_set_{accept/connect}_state is called for the first time, so
     * that "state" and "handshake_func" are properly initialized.  But as
     * handshake_func is == 0 until then, we use this test instead of an
     * "init" member.
     */
M
Matt Caswell 已提交
941
    /* are we the server side? */
942 943 944 945 946 947 948 949 950 951 952 953 954
    int server;
    /*
     * Generate a new session or reuse an old one.
     * NB: For servers, the 'new' session may actually be a previously
     * cached session or even the previous session unless
     * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set
     */
    int new_session;
    /* don't send shutdown packets */
    int quiet_shutdown;
    /* we have shut things down, 0x01 sent, 0x02 for received */
    int shutdown;
    /* where we are */
M
Matt Caswell 已提交
955
    OSSL_STATEM statem;
956 957 958
    BUF_MEM *init_buf;          /* buffer used during init */
    void *init_msg;             /* pointer to handshake message body, set by
                                 * ssl3_get_message() */
959 960
    size_t init_num;               /* amount read/written */
    size_t init_off;               /* amount read/written */
961 962 963 964 965 966 967 968
    struct ssl3_state_st *s3;   /* SSLv3 variables */
    struct dtls1_state_st *d1;  /* DTLSv1 variables */
    /* callback that allows applications to peek at protocol messages */
    void (*msg_callback) (int write_p, int version, int content_type,
                          const void *buf, size_t len, SSL *ssl, void *arg);
    void *msg_callback_arg;
    int hit;                    /* reusing a previous session */
    X509_VERIFY_PARAM *param;
969
    /* Per connection DANE state */
970
    SSL_DANE dane;
971 972 973 974 975 976 977
    /* crypto */
    STACK_OF(SSL_CIPHER) *cipher_list;
    STACK_OF(SSL_CIPHER) *cipher_list_by_id;
    /*
     * These are the ones being used, the ones in SSL_SESSION are the ones to
     * be 'copied' into these ones
     */
978
    uint32_t mac_flags;
979
    /*
980 981
     * The TLS1.3 secrets. The resumption master secret is stored in the
     * session.
982 983 984
     */
    unsigned char early_secret[EVP_MAX_MD_SIZE];
    unsigned char handshake_secret[EVP_MAX_MD_SIZE];
985
    unsigned char master_secret[EVP_MAX_MD_SIZE];
M
Matt Caswell 已提交
986 987
    unsigned char client_finished_secret[EVP_MAX_MD_SIZE];
    unsigned char server_finished_secret[EVP_MAX_MD_SIZE];
988
    unsigned char server_finished_hash[EVP_MAX_MD_SIZE];
989
    EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */
M
Matt Caswell 已提交
990
    unsigned char read_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static read IV */
991
    EVP_MD_CTX *read_hash;      /* used for mac generation */
R
Rich Salz 已提交
992
    COMP_CTX *compress;         /* compression */
993 994
    COMP_CTX *expand;           /* uncompress */
    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
M
Matt Caswell 已提交
995
    unsigned char write_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static write IV */
996 997 998 999 1000
    EVP_MD_CTX *write_hash;     /* used for mac generation */
    /* session info */
    /* client cert? */
    /* This is used to hold the server certificate used */
    struct cert_st /* CERT */ *cert;
1001 1002 1003 1004 1005 1006 1007 1008

    /*
     * The hash of all messages prior to the CertificateVerify, and the length
     * of that hash.
     */
    unsigned char cert_verify_hash[EVP_MAX_MD_SIZE];
    size_t cert_verify_hash_len;

1009 1010 1011
    /* Flag to indicate whether we should send a HelloRetryRequest or not */
    int hello_retry_request;

1012 1013 1014 1015
    /*
     * the session_id_context is used to ensure sessions are only reused in
     * the appropriate context
     */
1016
    size_t sid_ctx_length;
1017 1018 1019 1020 1021 1022 1023 1024 1025 1026
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
    /* This can also be in the session once a session is established */
    SSL_SESSION *session;
    /* Default generate session ID callback. */
    GEN_SESSION_CB generate_session_id;
    /* Used in SSL3 */
    /*
     * 0 don't care about verify failure.
     * 1 fail if verify fails
     */
1027
    uint32_t verify_mode;
1028 1029 1030 1031 1032 1033 1034 1035
    /* fail if callback returns 0 */
    int (*verify_callback) (int ok, X509_STORE_CTX *ctx);
    /* optional informational callback */
    void (*info_callback) (const SSL *ssl, int type, int val);
    /* error bytes to be written */
    int error;
    /* actual code */
    int error_code;
E
Emilia Kasper 已提交
1036
# ifndef OPENSSL_NO_PSK
1037 1038
    SSL_psk_client_cb_func psk_client_callback;
    SSL_psk_server_cb_func psk_server_callback;
E
Emilia Kasper 已提交
1039
# endif
1040
    SSL_CTX *ctx;
1041 1042
    /* Verified chain of peer */
    STACK_OF(X509) *verified_chain;
1043
    long verify_result;
1044
    /* extra application data */
1045 1046 1047
    CRYPTO_EX_DATA ex_data;
    /* for server side, keep the list of CA_dn we can use */
    STACK_OF(X509_NAME) *client_CA;
1048
    CRYPTO_REF_COUNT references;
1049
    /* protocol behaviour */
1050
    uint32_t options;
1051
    /* API behaviour */
1052
    uint32_t mode;
1053 1054
    int min_proto_version;
    int max_proto_version;
1055
    size_t max_cert_list;
1056
    int first_packet;
1057 1058 1059 1060
    /*
     * What was passed in ClientHello.legacy_version. Used for RSA pre-master
     * secret and SSLv3/TLS (<=1.2) rollback check
     */
1061
    int client_version;
1062 1063 1064 1065
    /*
     * If we're using more than one pipeline how should we divide the data
     * up between the pipes?
     */
M
Matt Caswell 已提交
1066
    size_t split_send_fragment;
1067 1068 1069 1070
    /*
     * Maximum amount of data to send in one fragment. actual record size can
     * be more than this due to padding and MAC overheads.
     */
M
Matt Caswell 已提交
1071
    size_t max_send_fragment;
1072
    /* Up to how many pipelines should we use? If 0 then 1 is assumed */
M
Matt Caswell 已提交
1073
    size_t max_pipelines;
R
Rich Salz 已提交
1074 1075 1076

    struct {
        /* TLS extension debug callback */
R
Rich Salz 已提交
1077 1078
        void (*debug_cb)(SSL *s, int client_server, int type,
                         const unsigned char *data, int len, void *arg);
R
Rich Salz 已提交
1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132
        void *debug_arg;
        char *hostname;
        /* certificate status request info */
        /* Status type or -1 if no status type */
        int status_type;
        /* Raw extension data, if seen */
        unsigned char *scts;
        /* Length of raw extension data, if seen */
        uint16_t scts_len;
        /* Expect OCSP CertificateStatus message */
        int status_expected;

        struct {
            /* OCSP status request only */
            STACK_OF(OCSP_RESPID) *ids;
            X509_EXTENSIONS *exts;
            /* OCSP response received or to be sent */
            unsigned char *resp;
            size_t resp_len;
        } ocsp;

        /* RFC4507 session ticket expected to be received or sent */
        int ticket_expected;
# ifndef OPENSSL_NO_EC
        size_t ecpointformats_len;
        /* our list */
        unsigned char *ecpointformats;
        size_t supportedgroups_len;
        /* our list */
        unsigned char *supportedgroups;
# endif                         /* OPENSSL_NO_EC */
        /* TLS Session Ticket extension override */
        TLS_SESSION_TICKET_EXT *session_ticket;
        /* TLS Session Ticket extension callback */
        tls_session_ticket_ext_cb_fn session_ticket_cb;
        void *session_ticket_cb_arg;
        /* TLS pre-shared secret session resumption */
        tls_session_secret_cb_fn session_secret_cb;
        void *session_secret_cb_arg;
        /*
         * For a client, this contains the list of supported protocols in wire
         * format.
         */
        unsigned char *alpn;
        size_t alpn_len;
        /*
         * Next protocol negotiation. For the client, this is the protocol that
         * we sent in NextProtocol and is set when handling ServerHello
         * extensions. For a server, this is the client's selected_protocol from
         * NextProtocol and is set when handling the NextProtocol message, before
         * the Finished message.
         */
        unsigned char *npn;
        size_t npn_len;
1133

M
Matt Caswell 已提交
1134
        /* The available PSK key exchange modes */
1135
        int psk_kex_mode;
1136 1137 1138

        /* Set to one if we have negotiated ETM */
        int use_etm;
R
Rich Salz 已提交
1139 1140
    } ext;

1141 1142 1143 1144 1145 1146 1147
    /*-
     * no further mod of servername
     * 0 : call the servername extension callback.
     * 1 : prepare 2, allow last ack just after in server callback.
     * 2 : don't call servername callback, no ack in server hello
     */
    int servername_done;
E
Emilia Kasper 已提交
1148
# ifndef OPENSSL_NO_CT
1149
    /*
E
Emilia Kasper 已提交
1150 1151 1152
     * Validates that the SCTs (Signed Certificate Timestamps) are sufficient.
     * If they are not, the connection should be aborted.
     */
1153
    ssl_ct_validation_cb ct_validation_callback;
F
FdaSilvaYY 已提交
1154
    /* User-supplied argument that is passed to the ct_validation_callback */
1155 1156 1157 1158 1159 1160 1161 1162
    void *ct_validation_callback_arg;
    /*
     * Consolidated stack of SCTs from all sources.
     * Lazily populated by CT_get_peer_scts(SSL*)
     */
    STACK_OF(SCT) *scts;
    /* Have we attempted to find/parse SCTs yet? */
    int scts_parsed;
E
Emilia Kasper 已提交
1163
# endif
1164
    SSL_CTX *session_ctx;       /* initial ctx, used to store sessions */
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174
    /* What we'll do */
    STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
    /* What's been chosen */
    SRTP_PROTECTION_PROFILE *srtp_profile;
    /*-
     * 1 if we are renegotiating.
     * 2 if we are a server and are inside a handshake
     * (i.e. not just sending a HelloRequest)
     */
    int renegotiate;
1175 1176
    /* If sending a KeyUpdate is pending */
    SSL_KEY_UPDATE key_update;
E
Emilia Kasper 已提交
1177
# ifndef OPENSSL_NO_SRP
1178 1179
    /* ctx for SRP authentication */
    SRP_CTX srp_ctx;
E
Emilia Kasper 已提交
1180
# endif
1181 1182 1183 1184 1185
    /*
     * Callback for disabling session caching and ticket support on a session
     * basis, depending on the chosen cipher.
     */
    int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
1186
    RECORD_LAYER rlayer;
M
Matt Caswell 已提交
1187 1188 1189 1190
    /* Default password callback. */
    pem_password_cb *default_passwd_callback;
    /* Default password callback user data. */
    void *default_passwd_callback_userdata;
M
Matt Caswell 已提交
1191 1192
    /* Async Job info */
    ASYNC_JOB *job;
M
Matt Caswell 已提交
1193
    ASYNC_WAIT_CTX *waitctx;
M
Matt Caswell 已提交
1194
    size_t asyncrw;
1195

1196
    CRYPTO_RWLOCK *lock;
1197 1198
};

1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209
/*
 * Structure containing table entry of values associated with the signature
 * algorithms (signature scheme) extension
*/
typedef struct sigalg_lookup_st {
    /* TLS 1.3 signature scheme name */
    const char *name;
    /* Raw value used in extension */
    uint16_t sigalg;
    /* NID of hash algorithm */
    int hash;
1210 1211
    /* Index of hash algorithm */
    int hash_idx;
1212 1213
    /* NID of signature algorithm */
    int sig;
1214 1215
    /* Index of signature algorithm */
    int sig_idx;
1216 1217 1218 1219 1220 1221
    /* Combined hash and signature NID, if any */
    int sigandhash;
    /* Required public key curve (ECDSA only) */
    int curve;
} SIGALG_LOOKUP;

1222 1223
typedef struct cert_pkey_st CERT_PKEY;

1224 1225
typedef struct ssl3_state_st {
    long flags;
1226
    size_t read_mac_secret_size;
1227
    unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
1228
    size_t write_mac_secret_size;
1229 1230 1231 1232 1233 1234 1235 1236 1237
    unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
    unsigned char server_random[SSL3_RANDOM_SIZE];
    unsigned char client_random[SSL3_RANDOM_SIZE];
    /* flags for countermeasure against known-IV weakness */
    int need_empty_fragments;
    int empty_fragment_done;
    /* used during startup, digest all incoming/outgoing packets */
    BIO *handshake_buffer;
    /*
1238 1239
     * When handshake digest is determined, buffer is hashed and
     * freed and MD_CTX for the required digest is stored here.
1240
     */
1241
    EVP_MD_CTX *handshake_dgst;
1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266
    /*
     * Set whenever an expected ChangeCipherSpec message is processed.
     * Unset when the peer's Finished message is received.
     * Unexpected ChangeCipherSpec messages trigger a fatal alert.
     */
    int change_cipher_spec;
    int warn_alert;
    int fatal_alert;
    /*
     * we allow one fatal and one warning alert to be outstanding, send close
     * alert via the warning alert
     */
    int alert_dispatch;
    unsigned char send_alert[2];
    /*
     * This flag is set when we should renegotiate ASAP, basically when there
     * is no more data in the read or write buffers
     */
    int renegotiate;
    int total_renegotiations;
    int num_renegotiations;
    int in_read_app_data;
    struct {
        /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
        unsigned char finish_md[EVP_MAX_MD_SIZE * 2];
1267
        size_t finish_md_len;
1268
        unsigned char peer_finish_md[EVP_MAX_MD_SIZE * 2];
1269
        size_t peer_finish_md_len;
1270
        size_t message_size;
1271 1272 1273
        int message_type;
        /* used to hold the new cipher we are going to use */
        const SSL_CIPHER *new_cipher;
E
Emilia Kasper 已提交
1274 1275 1276
# if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
        EVP_PKEY *pkey;         /* holds short lived DH/ECDH key */
# endif
1277 1278 1279 1280 1281
        /* used for certificate requests */
        int cert_req;
        int ctype_num;
        char ctype[SSL3_CT_NUMBER];
        STACK_OF(X509_NAME) *ca_names;
1282
        size_t key_block_length;
1283 1284 1285 1286
        unsigned char *key_block;
        const EVP_CIPHER *new_sym_enc;
        const EVP_MD *new_hash;
        int new_mac_pkey_type;
1287
        size_t new_mac_secret_size;
E
Emilia Kasper 已提交
1288
# ifndef OPENSSL_NO_COMP
1289
        const SSL_COMP *new_compression;
E
Emilia Kasper 已提交
1290
# else
1291
        char *new_compression;
E
Emilia Kasper 已提交
1292
# endif
1293
        int cert_request;
D
Dr. Stephen Henson 已提交
1294 1295 1296 1297 1298 1299
        /* Raw values of the cipher list from a client */
        unsigned char *ciphers_raw;
        size_t ciphers_rawlen;
        /* Temporary storage for premaster secret */
        unsigned char *pms;
        size_t pmslen;
E
Emilia Kasper 已提交
1300
# ifndef OPENSSL_NO_PSK
1301 1302 1303
        /* Temporary storage for PSK key */
        unsigned char *psk;
        size_t psklen;
E
Emilia Kasper 已提交
1304
# endif
1305 1306
        /* Signature algorithm we actually use */
        const SIGALG_LOOKUP *sigalg;
1307 1308
        /* Pointer to certificate we use */
        CERT_PKEY *cert;
D
Dr. Stephen Henson 已提交
1309 1310 1311 1312 1313
        /*
         * signature algorithms peer reports: e.g. supported signature
         * algorithms extension for server or as part of a certificate
         * request for client.
         */
1314
        uint16_t *peer_sigalgs;
D
Dr. Stephen Henson 已提交
1315 1316
        /* Size of above array */
        size_t peer_sigalgslen;
1317 1318
        /* Sigalg peer actualy uses */
        const SIGALG_LOOKUP *peer_sigalg;
1319 1320
        /* Array of digests used for signing */
        const EVP_MD *md[SSL_PKEY_NUM];
1321 1322 1323 1324 1325
        /*
         * Set if corresponding CERT_PKEY can be used with current
         * SSL session: e.g. appropriate curve, signature algorithms etc.
         * If zero it can't be used at all.
         */
1326
        uint32_t valid_flags[SSL_PKEY_NUM];
1327 1328 1329 1330 1331
        /*
         * For servers the following masks are for the key and auth algorithms
         * that are supported by the certs below. For clients they are masks of
         * *disabled* algorithms based on the current session.
         */
1332 1333
        uint32_t mask_k;
        uint32_t mask_a;
1334 1335 1336 1337 1338 1339 1340
        /*
         * The following are used by the client to see if a cipher is allowed or
         * not.  It contains the minimum and maximum version the client's using
         * based on what it knows so far.
         */
        int min_ver;
        int max_ver;
1341 1342 1343 1344
    } tmp;

    /* Connection binding to prevent renegotiation attacks */
    unsigned char previous_client_finished[EVP_MAX_MD_SIZE];
1345
    size_t previous_client_finished_len;
1346
    unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
1347
    size_t previous_server_finished_len;
1348 1349
    int send_connection_binding; /* TODOEKR */

E
Emilia Kasper 已提交
1350
# ifndef OPENSSL_NO_NEXTPROTONEG
1351 1352 1353
    /*
     * Set if we saw the Next Protocol Negotiation extension from our peer.
     */
R
Rich Salz 已提交
1354
    int npn_seen;
E
Emilia Kasper 已提交
1355
# endif
1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367

    /*
     * ALPN information (we are in the process of transitioning from NPN to
     * ALPN.)
     */

    /*
     * In a server these point to the selected ALPN protocol after the
     * ClientHello has been processed. In a client these contain the protocol
     * that the server selected once the ServerHello has been processed.
     */
    unsigned char *alpn_selected;
T
Todd Short 已提交
1368 1369 1370 1371 1372 1373
    size_t alpn_selected_len;
    /* used by the server to know what options were proposed */
    unsigned char *alpn_proposed;
    size_t alpn_proposed_len;
    /* used by the client to know if it actually sent alpn */
    int alpn_sent;
1374

E
Emilia Kasper 已提交
1375
# ifndef OPENSSL_NO_EC
1376 1377 1378 1379 1380 1381
    /*
     * This is set to true if we believe that this is a version of Safari
     * running on OS X 10.6 or newer. We wish to know this because Safari on
     * 10.8 .. 10.8.3 has broken ECDHE-ECDSA support.
     */
    char is_probably_safari;
E
Emilia Kasper 已提交
1382
# endif                         /* !OPENSSL_NO_EC */
1383 1384

    /* For clients: peer temporary key */
D
Dr. Stephen Henson 已提交
1385
# if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
1386 1387
    /* The group_id for the DH/ECDH key */
    unsigned int group_id;
1388
    EVP_PKEY *peer_tmp;
1389 1390
# endif

1391 1392 1393 1394
} SSL3_STATE;

/* DTLS structures */

E
Emilia Kasper 已提交
1395 1396 1397
# ifndef OPENSSL_NO_SCTP
#  define DTLS1_SCTP_AUTH_LABEL   "EXPORTER_DTLS_OVER_SCTP"
# endif
1398 1399

/* Max MTU overhead we know about so far is 40 for IPv6 + 8 for UDP */
E
Emilia Kasper 已提交
1400
# define DTLS1_MAX_MTU_OVERHEAD                   48
1401

M
Matt Caswell 已提交
1402 1403 1404 1405
/*
 * Flag used in message reuse to indicate the buffer contains the record
 * header as well as the the handshake message header.
 */
E
Emilia Kasper 已提交
1406
# define DTLS1_SKIP_RECORD_HEADER                 2
M
Matt Caswell 已提交
1407

1408 1409 1410 1411 1412 1413 1414 1415 1416 1417
struct dtls1_retransmit_state {
    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
    EVP_MD_CTX *write_hash;     /* used for mac generation */
    COMP_CTX *compress;         /* compression */
    SSL_SESSION *session;
    unsigned short epoch;
};

struct hm_header_st {
    unsigned char type;
M
Matt Caswell 已提交
1418
    size_t msg_len;
1419
    unsigned short seq;
M
Matt Caswell 已提交
1420 1421
    size_t frag_off;
    size_t frag_len;
1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440
    unsigned int is_ccs;
    struct dtls1_retransmit_state saved_retransmit_state;
};

struct dtls1_timeout_st {
    /* Number of read timeouts so far */
    unsigned int read_timeouts;
    /* Number of write timeouts so far */
    unsigned int write_timeouts;
    /* Number of alerts received so far */
    unsigned int num_alerts;
};

typedef struct hm_fragment_st {
    struct hm_header_st msg_header;
    unsigned char *fragment;
    unsigned char *reassembly;
} hm_fragment;

R
Rich Salz 已提交
1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
typedef struct pqueue_st pqueue;
typedef struct pitem_st pitem;

struct pitem_st {
    unsigned char priority[8];  /* 64-bit value in big-endian encoding */
    void *data;
    pitem *next;
};

typedef struct pitem_st *piterator;

pitem *pitem_new(unsigned char *prio64be, void *data);
void pitem_free(pitem *item);
E
Emilia Kasper 已提交
1454
pqueue *pqueue_new(void);
R
Rich Salz 已提交
1455 1456 1457 1458 1459 1460 1461
void pqueue_free(pqueue *pq);
pitem *pqueue_insert(pqueue *pq, pitem *item);
pitem *pqueue_peek(pqueue *pq);
pitem *pqueue_pop(pqueue *pq);
pitem *pqueue_find(pqueue *pq, unsigned char *prio64be);
pitem *pqueue_iterator(pqueue *pq);
pitem *pqueue_next(piterator *iter);
M
Matt Caswell 已提交
1462
size_t pqueue_size(pqueue *pq);
R
Rich Salz 已提交
1463

1464 1465
typedef struct dtls1_state_st {
    unsigned char cookie[DTLS1_COOKIE_LENGTH];
M
Matt Caswell 已提交
1466
    size_t cookie_len;
M
Matt Caswell 已提交
1467
    unsigned int cookie_verified;
1468 1469 1470 1471 1472
    /* handshake message numbers */
    unsigned short handshake_write_seq;
    unsigned short next_handshake_write_seq;
    unsigned short handshake_read_seq;
    /* Buffered handshake messages */
R
Rich Salz 已提交
1473
    pqueue *buffered_messages;
1474
    /* Buffered (sent) handshake records */
R
Rich Salz 已提交
1475
    pqueue *sent_messages;
M
Matt Caswell 已提交
1476 1477
    size_t link_mtu;      /* max on-the-wire DTLS packet size */
    size_t mtu;           /* max DTLS packet size */
1478 1479 1480 1481
    struct hm_header_st w_msg_hdr;
    struct hm_header_st r_msg_hdr;
    struct dtls1_timeout_st timeout;
    /*
R
Richard Levitte 已提交
1482
     * Indicates when the last handshake msg sent will timeout
1483 1484 1485 1486 1487
     */
    struct timeval next_timeout;
    /* Timeout duration */
    unsigned short timeout_duration;
    unsigned int retransmitting;
E
Emilia Kasper 已提交
1488
# ifndef OPENSSL_NO_SCTP
1489
    int shutdown_received;
E
Emilia Kasper 已提交
1490
# endif
1491 1492
} DTLS1_STATE;

1493 1494 1495
# ifndef OPENSSL_NO_EC
/*
 * From ECC-TLS draft, used in encoding the curve type in ECParameters
B
Bodo Möller 已提交
1496
 */
1497 1498 1499 1500 1501
#  define EXPLICIT_PRIME_CURVE_TYPE  1
#  define EXPLICIT_CHAR2_CURVE_TYPE  2
#  define NAMED_CURVE_TYPE           3
# endif                         /* OPENSSL_NO_EC */

1502
struct cert_pkey_st {
1503 1504 1505 1506
    X509 *x509;
    EVP_PKEY *privatekey;
    /* Chain for this certificate */
    STACK_OF(X509) *chain;
1507 1508 1509 1510 1511 1512 1513
    /*-
     * serverinfo data for this certificate.  The data is in TLS Extension
     * wire format, specifically it's a series of records like:
     *   uint16_t extension_type; // (RFC 5246, 7.4.1.4, Extension)
     *   uint16_t length;
     *   uint8_t data[length];
     */
1514 1515
    unsigned char *serverinfo;
    size_t serverinfo_length;
1516
};
1517
/* Retrieve Suite B flags */
1518
# define tls1_suiteb(s)  (s->cert->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS)
1519
/* Uses to check strict mode: suite B modes are always strict */
1520 1521
# define SSL_CERT_FLAGS_CHECK_TLS_STRICT \
        (SSL_CERT_FLAG_SUITEB_128_LOS|SSL_CERT_FLAG_TLS_STRICT)
1522

1523
typedef struct {
1524 1525 1526 1527 1528
    unsigned short ext_type;
    /*
     * Per-connection flags relating to this extension type: not used if
     * part of an SSL_CTX structure.
     */
1529
    uint32_t ext_flags;
1530 1531 1532 1533 1534
    custom_ext_add_cb add_cb;
    custom_ext_free_cb free_cb;
    void *add_arg;
    custom_ext_parse_cb parse_cb;
    void *parse_arg;
D
Dr. Stephen Henson 已提交
1535
} custom_ext_method;
1536

1537 1538
/* ext_flags values */

1539 1540 1541
/*
 * Indicates an extension has been received. Used to check for unsolicited or
 * duplicate extensions.
1542
 */
1543 1544 1545 1546
# define SSL_EXT_FLAG_RECEIVED   0x1
/*
 * Indicates an extension has been sent: used to enable sending of
 * corresponding ServerHello extension.
1547
 */
1548
# define SSL_EXT_FLAG_SENT       0x2
1549

1550
typedef struct {
1551 1552
    custom_ext_method *meths;
    size_t meths_count;
D
Dr. Stephen Henson 已提交
1553
} custom_ext_methods;
1554

1555 1556 1557 1558 1559 1560 1561 1562 1563
typedef struct cert_st {
    /* Current active set */
    /*
     * ALWAYS points to an element of the pkeys array
     * Probably it would make more sense to store
     * an index, not a pointer.
     */
    CERT_PKEY *key;
# ifndef OPENSSL_NO_DH
1564
    EVP_PKEY *dh_tmp;
1565 1566 1567 1568
    DH *(*dh_tmp_cb) (SSL *ssl, int is_export, int keysize);
    int dh_tmp_auto;
# endif
    /* Flags related to certificates */
1569
    uint32_t cert_flags;
1570 1571 1572 1573 1574 1575 1576 1577 1578
    CERT_PKEY pkeys[SSL_PKEY_NUM];
    /*
     * Certificate types (received or sent) in certificate request message.
     * On receive this is only set if number of certificate types exceeds
     * SSL3_CT_NUMBER.
     */
    unsigned char *ctypes;
    size_t ctype_num;
    /*
1579
     * supported signature algorithms. When set on a client this is sent in
1580 1581 1582
     * the client hello as the supported signature algorithms extension. For
     * servers it represents the signature algorithms we are willing to use.
     */
1583
    uint16_t *conf_sigalgs;
1584 1585 1586 1587 1588
    /* Size of above array */
    size_t conf_sigalgslen;
    /*
     * Client authentication signature algorithms, if not set then uses
     * conf_sigalgs. On servers these will be the signature algorithms sent
F
FdaSilvaYY 已提交
1589 1590
     * to the client in a certificate request for TLS 1.2. On a client this
     * represents the signature algorithms we are willing to use for client
1591 1592
     * authentication.
     */
1593
    uint16_t *client_sigalgs;
1594 1595 1596 1597 1598 1599
    /* Size of above array */
    size_t client_sigalgslen;
    /*
     * Signature algorithms shared by client and server: cached because these
     * are used most often.
     */
1600
    const SIGALG_LOOKUP **shared_sigalgs;
1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620
    size_t shared_sigalgslen;
    /*
     * Certificate setup callback: if set is called whenever a certificate
     * may be required (client or server). the callback can then examine any
     * appropriate parameters and setup any certificates required. This
     * allows advanced applications to select certificates on the fly: for
     * example based on supported signature algorithms or curves.
     */
    int (*cert_cb) (SSL *ssl, void *arg);
    void *cert_cb_arg;
    /*
     * Optional X509_STORE for chain building or certificate validation If
     * NULL the parent SSL_CTX store is used instead.
     */
    X509_STORE *chain_store;
    X509_STORE *verify_store;
    /* Custom extension methods for server and client */
    custom_ext_methods cli_ext;
    custom_ext_methods srv_ext;
    /* Security callback */
K
Kurt Roeckx 已提交
1621
    int (*sec_cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid,
1622 1623 1624 1625
                   void *other, void *ex);
    /* Security level */
    int sec_level;
    void *sec_ex;
E
Emilia Kasper 已提交
1626
# ifndef OPENSSL_NO_PSK
1627 1628
    /* If not NULL psk identity hint to use for servers */
    char *psk_identity_hint;
E
Emilia Kasper 已提交
1629
# endif
1630
    CRYPTO_REF_COUNT references;             /* >1 only if SSL_copy_session_id is used */
1631
    CRYPTO_RWLOCK *lock;
1632 1633 1634 1635 1636 1637 1638 1639 1640
} CERT;

# define FP_ICC  (int (*)(const void *,const void *))

/*
 * This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff It is a bit
 * of a mess of functions, but hell, think of it as an opaque structure :-)
 */
typedef struct ssl3_enc_method {
1641
    int (*enc) (SSL *, SSL3_RECORD *, size_t, int);
1642
    int (*mac) (SSL *, SSL3_RECORD *, unsigned char *, int);
1643 1644
    int (*setup_key_block) (SSL *);
    int (*generate_master_secret) (SSL *, unsigned char *, unsigned char *,
1645
                                   size_t, size_t *);
1646
    int (*change_cipher_state) (SSL *, int);
1647
    size_t (*final_finish_mac) (SSL *, const char *, size_t, unsigned char *);
1648
    const char *client_finished_label;
M
Matt Caswell 已提交
1649
    size_t client_finished_label_len;
1650
    const char *server_finished_label;
M
Matt Caswell 已提交
1651
    size_t server_finished_label_len;
1652 1653 1654 1655 1656 1657
    int (*alert_value) (int);
    int (*export_keying_material) (SSL *, unsigned char *, size_t,
                                   const char *, size_t,
                                   const unsigned char *, size_t,
                                   int use_context);
    /* Various flags indicating protocol version requirements */
1658
    uint32_t enc_flags;
1659
    /* Set the handshake header */
M
Matt Caswell 已提交
1660
    int (*set_handshake_header) (SSL *s, WPACKET *pkt, int type);
1661
    /* Close construction of the handshake message */
1662
    int (*close_construct_packet) (SSL *s, WPACKET *pkt, int htype);
1663 1664 1665 1666
    /* Write out handshake message */
    int (*do_write) (SSL *s);
} SSL3_ENC_METHOD;

M
Matt Caswell 已提交
1667 1668
# define ssl_set_handshake_header(s, pkt, htype) \
        s->method->ssl3_enc->set_handshake_header((s), (pkt), (htype))
1669 1670
# define ssl_close_construct_packet(s, pkt, htype) \
        s->method->ssl3_enc->close_construct_packet((s), (pkt), (htype))
1671
# define ssl_do_write(s)  s->method->ssl3_enc->do_write(s)
D
Dr. Stephen Henson 已提交
1672 1673 1674 1675

/* Values for enc_flags */

/* Uses explicit IV for CBC mode */
1676
# define SSL_ENC_FLAG_EXPLICIT_IV        0x1
D
Dr. Stephen Henson 已提交
1677
/* Uses signature algorithms extension */
1678
# define SSL_ENC_FLAG_SIGALGS            0x2
1679
/* Uses SHA256 default PRF */
1680
# define SSL_ENC_FLAG_SHA256_PRF         0x4
D
Dr. Stephen Henson 已提交
1681
/* Is DTLS */
1682 1683 1684 1685
# define SSL_ENC_FLAG_DTLS               0x8
/*
 * Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2: may
 * apply to others in future.
1686
 */
1687
# define SSL_ENC_FLAG_TLS1_2_CIPHERS     0x10
D
Dr. Stephen Henson 已提交
1688

1689
# ifndef OPENSSL_NO_COMP
1690
/* Used for holding the relevant compression methods loaded into SSL_CTX */
1691 1692 1693 1694 1695 1696 1697
typedef struct ssl3_comp_st {
    int comp_id;                /* The identifier byte for this compression
                                 * type */
    char *name;                 /* Text name used for the compression type */
    COMP_METHOD *method;        /* The method :-) */
} SSL3_COMP;
# endif
1698

1699
typedef struct raw_extension_st {
1700
    /* Raw packet data for the extension */
1701
    PACKET data;
1702 1703
    /* Set to 1 if the extension is present or 0 otherwise */
    int present;
1704 1705
    /* Set to 1 if we have already parsed the extension or 0 otherwise */
    int parsed;
1706
    /* The type of this extension, i.e. a TLSEXT_TYPE_* value */
1707
    unsigned int type;
1708 1709
} RAW_EXTENSION;

1710 1711 1712 1713
/*
 * Extension index values NOTE: Any updates to these defines should be mirrored
 * with equivalent updates to ext_defs in extensions.c
 */
1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729
typedef enum tlsext_index_en {
    TLSEXT_IDX_renegotiate,
    TLSEXT_IDX_server_name,
    TLSEXT_IDX_srp,
    TLSEXT_IDX_ec_point_formats,
    TLSEXT_IDX_supported_groups,
    TLSEXT_IDX_session_ticket,
    TLSEXT_IDX_signature_algorithms,
    TLSEXT_IDX_status_request,
    TLSEXT_IDX_next_proto_neg,
    TLSEXT_IDX_application_layer_protocol_negotiation,
    TLSEXT_IDX_use_srtp,
    TLSEXT_IDX_encrypt_then_mac,
    TLSEXT_IDX_signed_certificate_timestamp,
    TLSEXT_IDX_extended_master_secret,
    TLSEXT_IDX_supported_versions,
1730
    TLSEXT_IDX_psk_kex_modes,
1731 1732
    TLSEXT_IDX_key_share,
    TLSEXT_IDX_cryptopro_bug,
1733 1734
    TLSEXT_IDX_padding,
    TLSEXT_IDX_psk
1735
} TLSEXT_INDEX;
1736

1737 1738 1739 1740 1741 1742
/*
 * Dummy status type for the status_type extension. Indicates no status type
 * set
 */
#define TLSEXT_STATUSTYPE_nothing  -1

1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762
/* Sigalgs values */
#define TLSEXT_SIGALG_ecdsa_secp256r1_sha256                    0x0403
#define TLSEXT_SIGALG_ecdsa_secp384r1_sha384                    0x0503
#define TLSEXT_SIGALG_ecdsa_secp521r1_sha512                    0x0603
#define TLSEXT_SIGALG_ecdsa_sha1                                0x0203
#define TLSEXT_SIGALG_rsa_pss_sha256                            0x0804
#define TLSEXT_SIGALG_rsa_pss_sha384                            0x0805
#define TLSEXT_SIGALG_rsa_pss_sha512                            0x0806
#define TLSEXT_SIGALG_rsa_pkcs1_sha256                          0x0401
#define TLSEXT_SIGALG_rsa_pkcs1_sha384                          0x0501
#define TLSEXT_SIGALG_rsa_pkcs1_sha512                          0x0601
#define TLSEXT_SIGALG_rsa_pkcs1_sha1                            0x0201
#define TLSEXT_SIGALG_dsa_sha256                                0x0402
#define TLSEXT_SIGALG_dsa_sha384                                0x0502
#define TLSEXT_SIGALG_dsa_sha512                                0x0602
#define TLSEXT_SIGALG_dsa_sha1                                  0x0202
#define TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256       0xeeee
#define TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512       0xefef
#define TLSEXT_SIGALG_gostr34102001_gostr3411                   0xeded

1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773
/* Known PSK key exchange modes */
#define TLSEXT_KEX_MODE_KE                                      0x00
#define TLSEXT_KEX_MODE_KE_DHE                                  0x01

/*
 * Internal representations of key exchange modes
 */
#define TLSEXT_KEX_MODE_FLAG_NONE                               0
#define TLSEXT_KEX_MODE_FLAG_KE                                 1
#define TLSEXT_KEX_MODE_FLAG_KE_DHE                             2

1774 1775 1776
/* An invalid index into the TLSv1.3 PSK identities */
#define TLSEXT_PSK_BAD_IDENTITY                                 -1

1777 1778
#define SSL_USE_PSS(s) (s->s3->tmp.peer_sigalg != NULL && \
                        s->s3->tmp.peer_sigalg->sig == EVP_PKEY_RSA_PSS)
1779

1780 1781 1782 1783
/* A dummy signature value not valid for TLSv1.2 signature algs */
#define TLSEXT_signature_rsa_pss                                0x0101


1784 1785 1786 1787
#define MAX_COMPRESSIONS_SIZE   255

typedef struct {
    unsigned int isv2;
1788
    unsigned int legacy_version;
1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800
    unsigned char random[SSL3_RANDOM_SIZE];
    size_t session_id_len;
    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
    size_t dtls_cookie_len;
    unsigned char dtls_cookie[DTLS1_COOKIE_LENGTH];
    PACKET ciphersuites;
    size_t compressions_len;
    unsigned char compressions[MAX_COMPRESSIONS_SIZE];
    PACKET extensions;
    RAW_EXTENSION *pre_proc_exts;
} CLIENTHELLO_MSG;

1801
extern SSL3_ENC_METHOD ssl3_undef_enc_method;
U
Ulf Möller 已提交
1802

1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815
__owur const SSL_METHOD *ssl_bad_method(int ver);
__owur const SSL_METHOD *sslv3_method(void);
__owur const SSL_METHOD *sslv3_server_method(void);
__owur const SSL_METHOD *sslv3_client_method(void);
__owur const SSL_METHOD *tlsv1_method(void);
__owur const SSL_METHOD *tlsv1_server_method(void);
__owur const SSL_METHOD *tlsv1_client_method(void);
__owur const SSL_METHOD *tlsv1_1_method(void);
__owur const SSL_METHOD *tlsv1_1_server_method(void);
__owur const SSL_METHOD *tlsv1_1_client_method(void);
__owur const SSL_METHOD *tlsv1_2_method(void);
__owur const SSL_METHOD *tlsv1_2_server_method(void);
__owur const SSL_METHOD *tlsv1_2_client_method(void);
1816 1817 1818
__owur const SSL_METHOD *tlsv1_3_method(void);
__owur const SSL_METHOD *tlsv1_3_server_method(void);
__owur const SSL_METHOD *tlsv1_3_client_method(void);
1819 1820 1821
__owur const SSL_METHOD *dtlsv1_method(void);
__owur const SSL_METHOD *dtlsv1_server_method(void);
__owur const SSL_METHOD *dtlsv1_client_method(void);
1822
__owur const SSL_METHOD *dtls_bad_ver_client_method(void);
1823 1824 1825
__owur const SSL_METHOD *dtlsv1_2_method(void);
__owur const SSL_METHOD *dtlsv1_2_server_method(void);
__owur const SSL_METHOD *dtlsv1_2_client_method(void);
1826

B
Ben Laurie 已提交
1827 1828 1829
extern const SSL3_ENC_METHOD TLSv1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_2_enc_data;
1830
extern const SSL3_ENC_METHOD TLSv1_3_enc_data;
1831 1832 1833
extern const SSL3_ENC_METHOD SSLv3_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_2_enc_data;
1834

1835 1836 1837
/*
 * Flags for SSL methods
 */
E
Emilia Kasper 已提交
1838 1839
# define SSL_METHOD_NO_FIPS      (1U<<0)
# define SSL_METHOD_NO_SUITEB    (1U<<1)
1840 1841

# define IMPLEMENT_tls_meth_func(version, flags, mask, func_name, s_accept, \
1842
                                 s_connect, enc_data) \
1843
const SSL_METHOD *func_name(void)  \
1844 1845 1846
        { \
        static const SSL_METHOD func_name##_data= { \
                version, \
1847 1848
                flags, \
                mask, \
1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878
                tls1_new, \
                tls1_clear, \
                tls1_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                ssl3_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                ssl3_read_bytes, \
                ssl3_write_bytes, \
                ssl3_dispatch_alert, \
                ssl3_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
                ssl3_get_cipher, \
                tls1_default_timeout, \
                &enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

1879
# define IMPLEMENT_ssl3_meth_func(func_name, s_accept, s_connect) \
1880
const SSL_METHOD *func_name(void)  \
1881 1882 1883
        { \
        static const SSL_METHOD func_name##_data= { \
                SSL3_VERSION, \
1884 1885
                SSL_METHOD_NO_FIPS | SSL_METHOD_NO_SUITEB, \
                SSL_OP_NO_SSLv3, \
1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915
                ssl3_new, \
                ssl3_clear, \
                ssl3_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                ssl3_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                ssl3_read_bytes, \
                ssl3_write_bytes, \
                ssl3_dispatch_alert, \
                ssl3_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
                ssl3_get_cipher, \
                ssl3_default_timeout, \
                &SSLv3_enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

1916
# define IMPLEMENT_dtls1_meth_func(version, flags, mask, func_name, s_accept, \
1917
                                        s_connect, enc_data) \
1918
const SSL_METHOD *func_name(void)  \
1919 1920 1921
        { \
        static const SSL_METHOD func_name##_data= { \
                version, \
1922 1923
                flags, \
                mask, \
1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943
                dtls1_new, \
                dtls1_clear, \
                dtls1_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                dtls1_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                dtls1_read_bytes, \
                dtls1_write_app_data_bytes, \
                dtls1_dispatch_alert, \
                dtls1_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
1944
                ssl3_get_cipher, \
1945 1946 1947 1948 1949 1950 1951 1952 1953 1954
                dtls1_default_timeout, \
                &enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

struct openssl_ssl_test_functions {
M
Matt Caswell 已提交
1955
    int (*p_ssl_init_wbio_buffer) (SSL *s);
1956 1957 1958
    int (*p_ssl3_setup_buffers) (SSL *s);
};

1959
const char *ssl_protocol_to_string(int version);
1960

D
Dr. Stephen Henson 已提交
1961 1962 1963 1964 1965 1966 1967 1968 1969
/* Returns true if certificate and private key for 'idx' are present */
static ossl_inline int ssl_has_cert(const SSL *s, int idx)
{
    if (idx < 0 || idx >= SSL_PKEY_NUM)
        return 0;
    return s->cert->pkeys[idx].x509 != NULL
        && s->cert->pkeys[idx].privatekey != NULL;
}

1970
# ifndef OPENSSL_UNIT_TEST
1971

1972 1973
void ssl_clear_cipher_ctx(SSL *s);
int ssl_clear_bad_session(SSL *s);
M
Matt Caswell 已提交
1974 1975
__owur CERT *ssl_cert_new(void);
__owur CERT *ssl_cert_dup(CERT *cert);
1976
void ssl_cert_clear_certs(CERT *c);
1977
void ssl_cert_free(CERT *c);
M
Matt Caswell 已提交
1978
__owur int ssl_get_new_session(SSL *s, int session);
1979
__owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello, int *al);
1980
__owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
M
Matt Caswell 已提交
1981
__owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
1982
DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
M
Matt Caswell 已提交
1983
__owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
E
Emilia Kasper 已提交
1984
                                 const SSL_CIPHER *const *bp);
M
Matt Caswell 已提交
1985
__owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
E
Emilia Kasper 已提交
1986 1987 1988 1989 1990
                                                    STACK_OF(SSL_CIPHER) **pref,
                                                    STACK_OF(SSL_CIPHER)
                                                    **sorted,
                                                    const char *rule_str,
                                                    CERT *c);
1991
void ssl_update_cache(SSL *s, int mode);
M
Matt Caswell 已提交
1992
__owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
E
Emilia Kasper 已提交
1993
                              const EVP_MD **md, int *mac_pkey_type,
1994
                              size_t *mac_secret_size, SSL_COMP **comp,
E
Emilia Kasper 已提交
1995
                              int use_etm);
D
David Woodhouse 已提交
1996 1997 1998
__owur int ssl_cipher_get_overhead(const SSL_CIPHER *c, size_t *mac_overhead,
                                   size_t *int_overhead, size_t *blocksize,
                                   size_t *ext_overhead);
M
Matt Caswell 已提交
1999
__owur int ssl_cipher_get_cert_index(const SSL_CIPHER *c);
E
Emilia Kasper 已提交
2000 2001
__owur const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl,
                                                const unsigned char *ptr);
M
Matt Caswell 已提交
2002 2003 2004 2005 2006 2007 2008
__owur int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_set1_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_add0_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
__owur int ssl_cert_add1_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
__owur int ssl_cert_select_current(CERT *c, X509 *x);
__owur int ssl_cert_set_current(CERT *c, long arg);
__owur X509 *ssl_cert_get0_next_certificate(CERT *c, int first);
E
Emilia Kasper 已提交
2009
void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg);
2010

M
Matt Caswell 已提交
2011 2012
__owur int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk);
__owur int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags);
E
Emilia Kasper 已提交
2013 2014
__owur int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain,
                                   int ref);
D
Dr. Stephen Henson 已提交
2015

K
Kurt Roeckx 已提交
2016
__owur int ssl_security(const SSL *s, int op, int bits, int nid, void *other);
E
Emilia Kasper 已提交
2017 2018
__owur int ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid,
                            void *other);
D
Dr. Stephen Henson 已提交
2019

2020
int ssl_undefined_function(SSL *s);
M
Matt Caswell 已提交
2021 2022
__owur int ssl_undefined_void_function(void);
__owur int ssl_undefined_const_function(const SSL *s);
E
Emilia Kasper 已提交
2023 2024 2025
__owur int ssl_get_server_cert_serverinfo(SSL *s,
                                          const unsigned char **serverinfo,
                                          size_t *serverinfo_length);
D
Dr. Stephen Henson 已提交
2026
__owur int ssl_cert_type(const X509 *x, const EVP_PKEY *pkey);
2027
void ssl_set_masks(SSL *s);
M
Matt Caswell 已提交
2028 2029
__owur STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
__owur int ssl_verify_alarm_type(long type);
R
Rich Salz 已提交
2030
void ssl_sort_cipher_list(void);
2031
void ssl_load_ciphers(void);
E
Emilia Kasper 已提交
2032
__owur int ssl_fill_hello_random(SSL *s, int server, unsigned char *field,
2033
                                 size_t len);
2034 2035
__owur int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
                                      int free_pms);
D
Dr. Stephen Henson 已提交
2036
__owur EVP_PKEY *ssl_generate_pkey(EVP_PKEY *pm);
2037 2038
__owur int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey,
                      int genmaster);
D
Dr. Stephen Henson 已提交
2039
__owur EVP_PKEY *ssl_dh_to_pkey(DH *dh);
2040

2041
__owur const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id);
M
Matt Caswell 已提交
2042
__owur const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
M
Matt Caswell 已提交
2043
__owur int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt,
2044
                                   size_t *len);
2045
int ssl3_init_finished_mac(SSL *s);
M
Matt Caswell 已提交
2046 2047
__owur int ssl3_setup_key_block(SSL *s);
__owur int ssl3_change_cipher_state(SSL *s, int which);
2048
void ssl3_cleanup_key_block(SSL *s);
M
Matt Caswell 已提交
2049
__owur int ssl3_do_write(SSL *s, int type);
2050
int ssl3_send_alert(SSL *s, int level, int desc);
M
Matt Caswell 已提交
2051
__owur int ssl3_generate_master_secret(SSL *s, unsigned char *out,
2052 2053
                                       unsigned char *p, size_t len,
                                       size_t *secret_size);
2054
__owur int ssl3_get_req_cert_type(SSL *s, WPACKET *pkt);
M
Matt Caswell 已提交
2055 2056
__owur int ssl3_num_ciphers(void);
__owur const SSL_CIPHER *ssl3_get_cipher(unsigned int u);
2057
int ssl3_renegotiate(SSL *ssl);
2058
int ssl3_renegotiate_check(SSL *ssl, int initok);
M
Matt Caswell 已提交
2059
__owur int ssl3_dispatch_alert(SSL *s);
2060
__owur size_t ssl3_final_finish_mac(SSL *s, const char *sender, size_t slen,
2061
                                    unsigned char *p);
M
Matt Caswell 已提交
2062
__owur int ssl3_finish_mac(SSL *s, const unsigned char *buf, size_t len);
2063
void ssl3_free_digest_list(SSL *s);
2064
__owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt,
2065
                                            CERT_PKEY *cpk, int *al);
2066 2067 2068
__owur const SSL_CIPHER *ssl3_choose_cipher(SSL *ssl,
                                            STACK_OF(SSL_CIPHER) *clnt,
                                            STACK_OF(SSL_CIPHER) *srvr);
2069
__owur int ssl3_digest_cached_records(SSL *s, int keep);
M
Matt Caswell 已提交
2070
__owur int ssl3_new(SSL *s);
2071
void ssl3_free(SSL *s);
2072 2073
__owur int ssl3_read(SSL *s, void *buf, size_t len, size_t *readbytes);
__owur int ssl3_peek(SSL *s, void *buf, size_t len, size_t *readbytes);
M
Matt Caswell 已提交
2074
__owur int ssl3_write(SSL *s, const void *buf, size_t len, size_t *written);
M
Matt Caswell 已提交
2075
__owur int ssl3_shutdown(SSL *s);
2076
void ssl3_clear(SSL *s);
M
Matt Caswell 已提交
2077 2078 2079 2080
__owur long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg);
__owur long ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg);
__owur long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void));
__owur long ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp) (void));
2081

M
Matt Caswell 已提交
2082 2083
__owur int ssl3_do_change_cipher_spec(SSL *ssl);
__owur long ssl3_default_timeout(void);
2084

M
Matt Caswell 已提交
2085
__owur int ssl3_set_handshake_header(SSL *s, WPACKET *pkt, int htype);
2086
__owur int tls_close_construct_packet(SSL *s, WPACKET *pkt, int htype);
2087
__owur int tls_setup_handshake(SSL *s);
M
Matt Caswell 已提交
2088
__owur int dtls1_set_handshake_header(SSL *s, WPACKET *pkt, int htype);
2089
__owur int dtls1_close_construct_packet(SSL *s, WPACKET *pkt, int htype);
M
Matt Caswell 已提交
2090 2091 2092 2093
__owur int ssl3_handshake_write(SSL *s);

__owur int ssl_allow_compression(SSL *s);

2094 2095
__owur int ssl_version_supported(const SSL *s, int version);

2096 2097 2098
__owur int ssl_set_client_hello_version(SSL *s);
__owur int ssl_check_version_downgrade(SSL *s);
__owur int ssl_set_version_bound(int method_version, int version, int *bound);
2099
__owur int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello);
2100
__owur int ssl_choose_client_version(SSL *s, int version);
E
Emilia Kasper 已提交
2101 2102
int ssl_get_client_min_max_version(const SSL *s, int *min_version,
                                   int *max_version);
2103

M
Matt Caswell 已提交
2104 2105 2106
__owur long tls1_default_timeout(void);
__owur int dtls1_do_write(SSL *s, int type);
void dtls1_set_message_header(SSL *s,
2107
                              unsigned char mt,
2108 2109
                              size_t len,
                              size_t frag_off, size_t frag_len);
M
Matt Caswell 已提交
2110

M
Matt Caswell 已提交
2111 2112
int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf_, size_t len,
                               size_t *written);
M
Matt Caswell 已提交
2113 2114 2115

__owur int dtls1_read_failed(SSL *s, int code);
__owur int dtls1_buffer_message(SSL *s, int ccs);
2116
__owur int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found);
M
Matt Caswell 已提交
2117
__owur int dtls1_get_queue_priority(unsigned short seq, int is_ccs);
M
Matt Caswell 已提交
2118
int dtls1_retransmit_buffered_messages(SSL *s);
2119 2120
void dtls1_clear_received_buffer(SSL *s);
void dtls1_clear_sent_buffer(SSL *s);
2121 2122
void dtls1_get_message_header(unsigned char *data,
                              struct hm_header_st *msg_hdr);
M
Matt Caswell 已提交
2123 2124 2125 2126
__owur long dtls1_default_timeout(void);
__owur struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft);
__owur int dtls1_check_timeout_num(SSL *s);
__owur int dtls1_handle_timeout(SSL *s);
2127 2128
void dtls1_start_timer(SSL *s);
void dtls1_stop_timer(SSL *s);
M
Matt Caswell 已提交
2129
__owur int dtls1_is_timer_expired(SSL *s);
2130
void dtls1_double_timeout(SSL *s);
2131
__owur int dtls_raw_hello_verify_request(WPACKET *pkt, unsigned char *cookie,
M
Matt Caswell 已提交
2132
                                         size_t cookie_len);
M
Matt Caswell 已提交
2133
__owur int dtls1_send_newsession_ticket(SSL *s);
M
Matt Caswell 已提交
2134
__owur size_t dtls1_min_mtu(SSL *s);
2135
void dtls1_hm_fragment_free(hm_fragment *frag);
M
Matt Caswell 已提交
2136
__owur int dtls1_query_mtu(SSL *s);
2137

M
Matt Caswell 已提交
2138
__owur int tls1_new(SSL *s);
2139 2140
void tls1_free(SSL *s);
void tls1_clear(SSL *s);
2141 2142
long tls1_ctrl(SSL *s, int cmd, long larg, void *parg);
long tls1_callback_ctrl(SSL *s, int cmd, void (*fp) (void));
2143

M
Matt Caswell 已提交
2144
__owur int dtls1_new(SSL *s);
B
Ben Laurie 已提交
2145 2146
void dtls1_free(SSL *s);
void dtls1_clear(SSL *s);
2147
long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg);
M
Matt Caswell 已提交
2148
__owur int dtls1_shutdown(SSL *s);
B
Ben Laurie 已提交
2149

M
Matt Caswell 已提交
2150
__owur int dtls1_dispatch_alert(SSL *s);
B
Ben Laurie 已提交
2151

M
Matt Caswell 已提交
2152
__owur int ssl_init_wbio_buffer(SSL *s);
2153
void ssl_free_wbio_buffer(SSL *s);
2154

M
Matt Caswell 已提交
2155 2156
__owur int tls1_change_cipher_state(SSL *s, int which);
__owur int tls1_setup_key_block(SSL *s);
2157
__owur size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen,
2158
                                    unsigned char *p);
M
Matt Caswell 已提交
2159
__owur int tls1_generate_master_secret(SSL *s, unsigned char *out,
2160 2161
                                       unsigned char *p, size_t len,
                                       size_t *secret_size);
2162 2163 2164
__owur int tls13_setup_key_block(SSL *s);
__owur size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
                                     unsigned char *p);
2165
__owur int tls13_change_cipher_state(SSL *s, int which);
2166 2167
__owur int tls13_hkdf_expand(SSL *s, const EVP_MD *md,
                             const unsigned char *secret,
2168 2169 2170
                             const unsigned char *label, size_t labellen,
                             const unsigned char *hash,
                             unsigned char *out, size_t outlen);
2171 2172 2173 2174
__owur int tls13_derive_key(SSL *s, const unsigned char *secret,
                            unsigned char *key, size_t keylen);
__owur int tls13_derive_iv(SSL *s, const unsigned char *secret,
                           unsigned char *iv, size_t ivlen);
2175 2176 2177 2178 2179 2180 2181 2182
__owur int tls13_derive_finishedkey(SSL *s, const EVP_MD *md,
                                    const unsigned char *secret,
                                    unsigned char *fin, size_t finlen);
int tls13_generate_secret(SSL *s, const EVP_MD *md,
                          const unsigned char *prevsecret,
                          const unsigned char *insecret,
                          size_t insecretlen,
                          unsigned char *outsecret);
2183 2184 2185 2186 2187 2188
__owur int tls13_generate_handshake_secret(SSL *s,
                                           const unsigned char *insecret,
                                           size_t insecretlen);
__owur int tls13_generate_master_secret(SSL *s, unsigned char *out,
                                        unsigned char *prev, size_t prevlen,
                                        size_t *secret_size);
M
Matt Caswell 已提交
2189
__owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
E
Emilia Kasper 已提交
2190 2191 2192
                                       const char *label, size_t llen,
                                       const unsigned char *p, size_t plen,
                                       int use_context);
M
Matt Caswell 已提交
2193
__owur int tls1_alert_code(int code);
2194
__owur int tls13_alert_code(int code);
M
Matt Caswell 已提交
2195 2196
__owur int ssl3_alert_code(int code);
__owur int ssl_ok(SSL *s);
2197

2198
#  ifndef OPENSSL_NO_EC
M
Matt Caswell 已提交
2199
__owur int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s);
2200
#  endif
B
Bodo Möller 已提交
2201

B
Ben Laurie 已提交
2202
SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
2203

2204
#  ifndef OPENSSL_NO_EC
2205 2206 2207 2208 2209 2210
/* Flags values from tls1_ec_curve_id2nid() */
/* Mask for curve type */
# define TLS_CURVE_TYPE          0x3
# define TLS_CURVE_PRIME         0x0
# define TLS_CURVE_CHAR2         0x1
# define TLS_CURVE_CUSTOM        0x2
M
Matt Caswell 已提交
2211 2212 2213

#define bytestogroup(bytes) ((unsigned int)(bytes[0] << 8 | bytes[1]))

2214
__owur int tls1_ec_curve_id2nid(int curve_id, unsigned int *pflags);
M
Matt Caswell 已提交
2215 2216
__owur int tls1_ec_nid2curve_id(int nid);
__owur int tls1_check_curve(SSL *s, const unsigned char *p, size_t len);
2217 2218
__owur int tls1_shared_group(SSL *s, int nmatch);
__owur int tls1_set_groups(unsigned char **pext, size_t *pextlen,
E
Emilia Kasper 已提交
2219
                           int *curves, size_t ncurves);
2220
__owur int tls1_set_groups_list(unsigned char **pext, size_t *pextlen,
E
Emilia Kasper 已提交
2221
                                const char *str);
2222 2223
void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
                         size_t *num_formats);
M
Matt Caswell 已提交
2224
__owur int tls1_check_ec_tmp_key(SSL *s, unsigned long id);
D
Dr. Stephen Henson 已提交
2225
__owur EVP_PKEY *ssl_generate_pkey_curve(int id);
2226
#  endif                        /* OPENSSL_NO_EC */
2227

M
Matt Caswell 已提交
2228
__owur int tls1_shared_list(SSL *s,
E
Emilia Kasper 已提交
2229 2230
                            const unsigned char *l1, size_t l1len,
                            const unsigned char *l2, size_t l2len, int nmatch);
2231 2232 2233 2234
__owur int tls_curve_allowed(SSL *s, const unsigned char *curve, int op);
__owur  int tls1_get_curvelist(SSL *s, int sess, const unsigned char **pcurves,
                               size_t *num_curves);

2235
void ssl_set_default_md(SSL *s);
M
Matt Caswell 已提交
2236
__owur int tls1_set_server_sigalgs(SSL *s);
2237 2238 2239

/* Return codes for tls_get_ticket_from_client() and tls_decrypt_ticket() */
typedef enum ticket_en {
2240
    /* fatal error, malloc failure */
2241
    TICKET_FATAL_ERR_MALLOC,
2242
    /* fatal error, either from parsing or decrypting the ticket */
2243
    TICKET_FATAL_ERR_OTHER,
2244
    /* No ticket present */
2245
    TICKET_NONE,
2246
    /* Empty ticket present */
2247
    TICKET_EMPTY,
2248
    /* the ticket couldn't be decrypted */
2249
    TICKET_NO_DECRYPT,
2250
    /* a ticket was successfully decrypted */
2251
    TICKET_SUCCESS,
2252
    /* same as above but the ticket needs to be reneewed */
2253 2254 2255 2256 2257 2258 2259 2260 2261
    TICKET_SUCCESS_RENEW
} TICKET_RETURN;

__owur TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
                                                SSL_SESSION **ret);
__owur TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
                                        size_t eticklen,
                                        const unsigned char *sess_id,
                                        size_t sesslen, SSL_SESSION **psess);
2262

2263
__owur int tls_use_ticket(SSL *s);
2264

2265
void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op);
2266

M
Matt Caswell 已提交
2267
__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
E
Emilia Kasper 已提交
2268 2269
__owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen,
                            int client);
M
Matt Caswell 已提交
2270
int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
2271
                     int idx);
2272
void tls1_set_cert_validity(SSL *s);
2273

E
Emilia Kasper 已提交
2274
#  ifndef OPENSSL_NO_CT
2275
__owur int ssl_validate_ct(SSL *s);
E
Emilia Kasper 已提交
2276
#  endif
2277

2278
#  ifndef OPENSSL_NO_DH
M
Matt Caswell 已提交
2279
__owur DH *ssl_get_auto_dh(SSL *s);
2280
#  endif
D
Dr. Stephen Henson 已提交
2281

M
Matt Caswell 已提交
2282
__owur int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee);
E
Emilia Kasper 已提交
2283 2284
__owur int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex,
                                   int vfy);
D
Dr. Stephen Henson 已提交
2285

2286
int tls_choose_sigalg(SSL *s, int *al);
2287

M
Matt Caswell 已提交
2288
__owur EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md);
2289
void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
M
Matt Caswell 已提交
2290
__owur long ssl_get_algorithm2(SSL *s);
M
Matt Caswell 已提交
2291
__owur int tls12_copy_sigalgs(SSL *s, WPACKET *pkt,
2292
                              const uint16_t *psig, size_t psiglen);
2293
__owur int tls1_save_sigalgs(SSL *s, PACKET *pkt);
M
Matt Caswell 已提交
2294
__owur int tls1_process_sigalgs(SSL *s);
2295
__owur int tls1_set_peer_legacy_sigalg(SSL *s, const EVP_PKEY *pkey);
2296
__owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs);
2297
__owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey);
2298
void ssl_set_client_disabled(SSL *s);
M
Matt Caswell 已提交
2299
__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op);
2300

2301 2302
__owur int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
                                 size_t *hashlen);
2303
__owur const EVP_MD *ssl_md(int idx);
2304 2305
__owur const EVP_MD *ssl_handshake_md(SSL *s);
__owur const EVP_MD *ssl_prf_md(SSL *s);
2306

2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318
/*
 * ssl_log_rsa_client_key_exchange logs |premaster| to the SSL_CTX associated
 * with |ssl|, if logging is enabled. It returns one on success and zero on
 * failure. The entry is identified by the first 8 bytes of
 * |encrypted_premaster|.
 */
__owur int ssl_log_rsa_client_key_exchange(SSL *ssl,
                                           const uint8_t *encrypted_premaster,
                                           size_t encrypted_premaster_len,
                                           const uint8_t *premaster,
                                           size_t premaster_len);

2319 2320 2321 2322
/*
 * ssl_log_secret logs |secret| to the SSL_CTX associated with |ssl|, if
 * logging is available. It returns one on success and zero on failure. It tags
 * the entry with |label|.
2323
 */
2324 2325 2326 2327 2328 2329 2330 2331
__owur int ssl_log_secret(SSL *ssl, const char *label,
                          const uint8_t *secret, size_t secret_len);

#define MASTER_SECRET_LABEL "CLIENT_RANDOM"
#define CLIENT_HANDSHAKE_LABEL "CLIENT_HANDSHAKE_TRAFFIC_SECRET"
#define SERVER_HANDSHAKE_LABEL "SERVER_HANDSHAKE_TRAFFIC_SECRET"
#define CLIENT_APPLICATION_LABEL "CLIENT_TRAFFIC_SECRET_0"
#define SERVER_APPLICATION_LABEL "SERVER_TRAFFIC_SECRET_0"
2332

B
Ben Laurie 已提交
2333
/* s3_cbc.c */
M
Matt Caswell 已提交
2334
__owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
2335 2336 2337 2338 2339 2340 2341 2342
__owur int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
                                  unsigned char *md_out,
                                  size_t *md_out_size,
                                  const unsigned char header[13],
                                  const unsigned char *data,
                                  size_t data_plus_mac_size,
                                  size_t data_plus_mac_plus_padding_size,
                                  const unsigned char *mac_secret,
2343
                                  size_t mac_secret_length, char is_sslv3);
2344

2345 2346 2347
__owur int tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
                                 EVP_MD_CTX *mac_ctx, const unsigned char *data,
                                 size_t data_len, size_t orig_len);
D
Dr. Stephen Henson 已提交
2348

2349 2350
__owur int srp_generate_server_master_secret(SSL *s);
__owur int srp_generate_client_master_secret(SSL *s);
M
Matt Caswell 已提交
2351
__owur int srp_verify_server_param(SSL *s, int *al);
D
Dr. Stephen Henson 已提交
2352

D
Dr. Stephen Henson 已提交
2353 2354
/* t1_ext.c */

2355 2356
void custom_ext_init(custom_ext_methods *meths);

M
Matt Caswell 已提交
2357
__owur int custom_ext_parse(SSL *s, int server,
E
Emilia Kasper 已提交
2358 2359 2360
                            unsigned int ext_type,
                            const unsigned char *ext_data, size_t ext_size,
                            int *al);
M
Matt Caswell 已提交
2361
__owur int custom_ext_add(SSL *s, int server, WPACKET *pkt, int *al);
E
Emilia Kasper 已提交
2362 2363 2364

__owur int custom_exts_copy(custom_ext_methods *dst,
                            const custom_ext_methods *src);
D
Dr. Stephen Henson 已提交
2365 2366
void custom_exts_free(custom_ext_methods *exts);

2367
void ssl_comp_free_compression_methods_int(void);
2368

2369
# else
2370

2371 2372
#  define ssl_init_wbio_buffer SSL_test_functions()->p_ssl_init_wbio_buffer
#  define ssl3_setup_buffers SSL_test_functions()->p_ssl3_setup_buffers
2373

2374
# endif
2375
#endif