ssl_locl.h 94.8 KB
Newer Older
R
Rich Salz 已提交
1
/*
2
 * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
3
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4
 * Copyright 2005 Nokia. All rights reserved.
B
Bodo Möller 已提交
5
 *
R
Rich Salz 已提交
6 7 8 9
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
B
Bodo Möller 已提交
10
 */
R
Rich Salz 已提交
11

12
#ifndef HEADER_SSL_LOCL_H
13
# define HEADER_SSL_LOCL_H
P
Pauli 已提交
14 15

# include "e_os.h"              /* struct timeval for DTLS */
16 17 18 19
# include <stdlib.h>
# include <time.h>
# include <string.h>
# include <errno.h>
20

21
# include <openssl/buffer.h>
R
Rich Salz 已提交
22
# include <openssl/comp.h>
23 24
# include <openssl/bio.h>
# include <openssl/stack.h>
R
Rich Salz 已提交
25 26
# include <openssl/rsa.h>
# include <openssl/dsa.h>
27 28
# include <openssl/err.h>
# include <openssl/ssl.h>
M
Matt Caswell 已提交
29
# include <openssl/async.h>
30
# include <openssl/symhacks.h>
R
Rich Salz 已提交
31
# include <openssl/ct.h>
E
Emilia Kasper 已提交
32 33 34 35
# include "record/record.h"
# include "statem/statem.h"
# include "packet_locl.h"
# include "internal/dane.h"
36
# include "internal/refcount.h"
37

38 39 40 41
# ifdef OPENSSL_BUILD_SHLIBSSL
#  undef OPENSSL_EXTERN
#  define OPENSSL_EXTERN OPENSSL_EXPORT
# endif
42

43 44 45 46
# define c2l(c,l)        (l = ((unsigned long)(*((c)++)))     , \
                         l|=(((unsigned long)(*((c)++)))<< 8), \
                         l|=(((unsigned long)(*((c)++)))<<16), \
                         l|=(((unsigned long)(*((c)++)))<<24))
47 48

/* NOTE - c is not incremented as per c2l */
49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73
# define c2ln(c,l1,l2,n) { \
                        c+=n; \
                        l1=l2=0; \
                        switch (n) { \
                        case 8: l2 =((unsigned long)(*(--(c))))<<24; \
                        case 7: l2|=((unsigned long)(*(--(c))))<<16; \
                        case 6: l2|=((unsigned long)(*(--(c))))<< 8; \
                        case 5: l2|=((unsigned long)(*(--(c))));     \
                        case 4: l1 =((unsigned long)(*(--(c))))<<24; \
                        case 3: l1|=((unsigned long)(*(--(c))))<<16; \
                        case 2: l1|=((unsigned long)(*(--(c))))<< 8; \
                        case 1: l1|=((unsigned long)(*(--(c))));     \
                                } \
                        }

# define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff))

# define n2l(c,l)        (l =((unsigned long)(*((c)++)))<<24, \
                         l|=((unsigned long)(*((c)++)))<<16, \
                         l|=((unsigned long)(*((c)++)))<< 8, \
                         l|=((unsigned long)(*((c)++))))

74 75 76 77 78 79 80 81 82 83
# define n2l8(c,l)       (l =((uint64_t)(*((c)++)))<<56, \
                         l|=((uint64_t)(*((c)++)))<<48, \
                         l|=((uint64_t)(*((c)++)))<<40, \
                         l|=((uint64_t)(*((c)++)))<<32, \
                         l|=((uint64_t)(*((c)++)))<<24, \
                         l|=((uint64_t)(*((c)++)))<<16, \
                         l|=((uint64_t)(*((c)++)))<< 8, \
                         l|=((uint64_t)(*((c)++))))


84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104
# define l2n(l,c)        (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

# define l2n6(l,c)       (*((c)++)=(unsigned char)(((l)>>40)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

# define l2n8(l,c)       (*((c)++)=(unsigned char)(((l)>>56)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>48)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>40)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

105
/* NOTE - c is not incremented as per l2c */
106 107 108 109 110 111 112 113 114 115 116 117 118 119
# define l2cn(l1,l2,c,n) { \
                        c+=n; \
                        switch (n) { \
                        case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
                        case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
                        case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
                        case 5: *(--(c))=(unsigned char)(((l2)    )&0xff); \
                        case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
                        case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
                        case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
                        case 1: *(--(c))=(unsigned char)(((l1)    )&0xff); \
                                } \
                        }

M
Matt Caswell 已提交
120 121 122 123 124 125 126 127 128 129 130 131
# define n2s(c,s)        ((s=(((unsigned int)((c)[0]))<< 8)| \
                             (((unsigned int)((c)[1]))    )),(c)+=2)
# define s2n(s,c)        (((c)[0]=(unsigned char)(((s)>> 8)&0xff), \
                           (c)[1]=(unsigned char)(((s)    )&0xff)),(c)+=2)

# define n2l3(c,l)       ((l =(((unsigned long)((c)[0]))<<16)| \
                              (((unsigned long)((c)[1]))<< 8)| \
                              (((unsigned long)((c)[2]))    )),(c)+=3)

# define l2n3(l,c)       (((c)[0]=(unsigned char)(((l)>>16)&0xff), \
                           (c)[1]=(unsigned char)(((l)>> 8)&0xff), \
                           (c)[2]=(unsigned char)(((l)    )&0xff)),(c)+=3)
132

E
Emilia Kasper 已提交
133 134 135 136 137 138 139 140 141
/*
 * DTLS version numbers are strange because they're inverted. Except for
 * DTLS1_BAD_VER, which should be considered "lower" than the rest.
 */
# define dtls_ver_ordinal(v1) (((v1) == DTLS1_BAD_VER) ? 0xff00 : (v1))
# define DTLS_VERSION_GT(v1, v2) (dtls_ver_ordinal(v1) < dtls_ver_ordinal(v2))
# define DTLS_VERSION_GE(v1, v2) (dtls_ver_ordinal(v1) <= dtls_ver_ordinal(v2))
# define DTLS_VERSION_LT(v1, v2) (dtls_ver_ordinal(v1) > dtls_ver_ordinal(v2))
# define DTLS_VERSION_LE(v1, v2) (dtls_ver_ordinal(v1) >= dtls_ver_ordinal(v2))
142

143

144 145 146 147 148 149 150 151
/*
 * Define the Bitmasks for SSL_CIPHER.algorithms.
 * This bits are used packed as dense as possible. If new methods/ciphers
 * etc will be added, the bits a likely to change, so this information
 * is for internal library use only, even though SSL_CIPHER.algorithms
 * can be publicly accessed.
 * Use the according functions for cipher management instead.
 *
U
Ulf Möller 已提交
152
 * The bit mask handling in the selection and sorting scheme in
153
 * ssl_create_cipher_list() has only limited capabilities, reflecting
U
Ulf Möller 已提交
154
 * that the different entities within are mutually exclusive:
155 156
 * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
 */
157 158

/* Bits for algorithm_mkey (key exchange algorithm) */
159
/* RSA key exchange */
D
Dr. Stephen Henson 已提交
160
# define SSL_kRSA                0x00000001U
161
/* tmp DH key no DH cert */
D
Dr. Stephen Henson 已提交
162
# define SSL_kDHE                0x00000002U
163
/* synonym */
164
# define SSL_kEDH                SSL_kDHE
165
/* ephemeral ECDH */
D
Dr. Stephen Henson 已提交
166
# define SSL_kECDHE              0x00000004U
167
/* synonym */
168
# define SSL_kEECDH              SSL_kECDHE
169
/* PSK */
D
Dr. Stephen Henson 已提交
170
# define SSL_kPSK                0x00000008U
171
/* GOST key exchange */
D
Dr. Stephen Henson 已提交
172
# define SSL_kGOST               0x00000010U
173
/* SRP */
D
Dr. Stephen Henson 已提交
174
# define SSL_kSRP                0x00000020U
175

D
Dr. Stephen Henson 已提交
176 177 178
# define SSL_kRSAPSK             0x00000040U
# define SSL_kECDHEPSK           0x00000080U
# define SSL_kDHEPSK             0x00000100U
179 180 181

/* all PSK */

E
Emilia Kasper 已提交
182
# define SSL_PSK     (SSL_kPSK | SSL_kRSAPSK | SSL_kECDHEPSK | SSL_kDHEPSK)
183

D
Dr. Stephen Henson 已提交
184 185 186
/* Any appropriate key exchange algorithm (for TLS 1.3 ciphersuites) */
# define SSL_kANY                0x00000000U

187
/* Bits for algorithm_auth (server authentication) */
188
/* RSA auth */
D
Dr. Stephen Henson 已提交
189
# define SSL_aRSA                0x00000001U
190
/* DSS auth */
D
Dr. Stephen Henson 已提交
191
# define SSL_aDSS                0x00000002U
192
/* no auth (i.e. use ADH or AECDH) */
D
Dr. Stephen Henson 已提交
193
# define SSL_aNULL               0x00000004U
194
/* ECDSA auth*/
D
Dr. Stephen Henson 已提交
195
# define SSL_aECDSA              0x00000008U
196
/* PSK auth */
D
Dr. Stephen Henson 已提交
197
# define SSL_aPSK                0x00000010U
198
/* GOST R 34.10-2001 signature auth */
D
Dr. Stephen Henson 已提交
199
# define SSL_aGOST01             0x00000020U
200
/* SRP auth */
D
Dr. Stephen Henson 已提交
201
# define SSL_aSRP                0x00000040U
202
/* GOST R 34.10-2012 signature auth */
D
Dr. Stephen Henson 已提交
203
# define SSL_aGOST12             0x00000080U
D
Dr. Stephen Henson 已提交
204 205
/* Any appropriate signature auth (for TLS 1.3 ciphersuites) */
# define SSL_aANY                0x00000000U
206 207 208
/* All bits requiring a certificate */
#define SSL_aCERT \
    (SSL_aRSA | SSL_aDSS | SSL_aECDSA | SSL_aGOST01 | SSL_aGOST12)
209 210

/* Bits for algorithm_enc (symmetric encryption) */
D
Dr. Stephen Henson 已提交
211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228
# define SSL_DES                 0x00000001U
# define SSL_3DES                0x00000002U
# define SSL_RC4                 0x00000004U
# define SSL_RC2                 0x00000008U
# define SSL_IDEA                0x00000010U
# define SSL_eNULL               0x00000020U
# define SSL_AES128              0x00000040U
# define SSL_AES256              0x00000080U
# define SSL_CAMELLIA128         0x00000100U
# define SSL_CAMELLIA256         0x00000200U
# define SSL_eGOST2814789CNT     0x00000400U
# define SSL_SEED                0x00000800U
# define SSL_AES128GCM           0x00001000U
# define SSL_AES256GCM           0x00002000U
# define SSL_AES128CCM           0x00004000U
# define SSL_AES256CCM           0x00008000U
# define SSL_AES128CCM8          0x00010000U
# define SSL_AES256CCM8          0x00020000U
229
# define SSL_eGOST2814789CNT12   0x00040000U
A
Andy Polyakov 已提交
230
# define SSL_CHACHA20POLY1305    0x00080000U
231 232
# define SSL_ARIA128GCM          0x00100000U
# define SSL_ARIA256GCM          0x00200000U
233

E
Emilia Kasper 已提交
234 235 236
# define SSL_AESGCM              (SSL_AES128GCM | SSL_AES256GCM)
# define SSL_AESCCM              (SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8)
# define SSL_AES                 (SSL_AES128|SSL_AES256|SSL_AESGCM|SSL_AESCCM)
237
# define SSL_CAMELLIA            (SSL_CAMELLIA128|SSL_CAMELLIA256)
T
Todd Short 已提交
238
# define SSL_CHACHA20            (SSL_CHACHA20POLY1305)
239 240
# define SSL_ARIAGCM             (SSL_ARIA128GCM | SSL_ARIA256GCM)
# define SSL_ARIA                (SSL_ARIAGCM)
241 242

/* Bits for algorithm_mac (symmetric authentication) */
243

D
Dr. Stephen Henson 已提交
244 245 246 247 248 249
# define SSL_MD5                 0x00000001U
# define SSL_SHA1                0x00000002U
# define SSL_GOST94      0x00000004U
# define SSL_GOST89MAC   0x00000008U
# define SSL_SHA256              0x00000010U
# define SSL_SHA384              0x00000020U
250
/* Not a real MAC, just an indication it is part of cipher */
D
Dr. Stephen Henson 已提交
251
# define SSL_AEAD                0x00000040U
252 253 254
# define SSL_GOST12_256          0x00000080U
# define SSL_GOST89MAC12         0x00000100U
# define SSL_GOST12_512          0x00000200U
255

256
/*
257
 * When adding new digest in the ssl_ciph.c and increment SSL_MD_NUM_IDX make
258 259
 * sure to update this constant too
 */
260 261 262 263 264 265 266 267 268 269 270

# define SSL_MD_MD5_IDX  0
# define SSL_MD_SHA1_IDX 1
# define SSL_MD_GOST94_IDX 2
# define SSL_MD_GOST89MAC_IDX 3
# define SSL_MD_SHA256_IDX 4
# define SSL_MD_SHA384_IDX 5
# define SSL_MD_GOST12_256_IDX  6
# define SSL_MD_GOST89MAC12_IDX 7
# define SSL_MD_GOST12_512_IDX  8
# define SSL_MD_MD5_SHA1_IDX 9
271 272 273
# define SSL_MD_SHA224_IDX 10
# define SSL_MD_SHA512_IDX 11
# define SSL_MAX_DIGEST 12
274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295

/* Bits for algorithm2 (handshake digests and other extra flags) */

/* Bits 0-7 are handshake MAC */
# define SSL_HANDSHAKE_MAC_MASK  0xFF
# define SSL_HANDSHAKE_MAC_MD5_SHA1 SSL_MD_MD5_SHA1_IDX
# define SSL_HANDSHAKE_MAC_SHA256   SSL_MD_SHA256_IDX
# define SSL_HANDSHAKE_MAC_SHA384   SSL_MD_SHA384_IDX
# define SSL_HANDSHAKE_MAC_GOST94 SSL_MD_GOST94_IDX
# define SSL_HANDSHAKE_MAC_GOST12_256 SSL_MD_GOST12_256_IDX
# define SSL_HANDSHAKE_MAC_GOST12_512 SSL_MD_GOST12_512_IDX
# define SSL_HANDSHAKE_MAC_DEFAULT  SSL_HANDSHAKE_MAC_MD5_SHA1

/* Bits 8-15 bits are PRF */
# define TLS1_PRF_DGST_SHIFT 8
# define TLS1_PRF_SHA1_MD5 (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_SHA256 (SSL_MD_SHA256_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_SHA384 (SSL_MD_SHA384_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST94 (SSL_MD_GOST94_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST12_256 (SSL_MD_GOST12_256_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST12_512 (SSL_MD_GOST12_512_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF            (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
296

297 298 299 300
/*
 * Stream MAC for GOST ciphersuites from cryptopro draft (currently this also
 * goes into algorithm2)
 */
301
# define TLS1_STREAM_MAC 0x10000
302

303
# define SSL_STRONG_MASK         0x0000001FU
304
# define SSL_DEFAULT_MASK        0X00000020U
305

306 307 308 309 310 311
# define SSL_STRONG_NONE         0x00000001U
# define SSL_LOW                 0x00000002U
# define SSL_MEDIUM              0x00000004U
# define SSL_HIGH                0x00000008U
# define SSL_FIPS                0x00000010U
# define SSL_NOT_DEFAULT         0x00000020U
312

313
/* we have used 0000003f - 26 bits left to go */
314

315 316 317
/* Flag used on OpenSSL ciphersuite ids to indicate they are for SSLv3+ */
# define SSL3_CK_CIPHERSUITE_FLAG                0x03000000

D
Dr. Stephen Henson 已提交
318
/* Check if an SSL structure is using DTLS */
319
# define SSL_IS_DTLS(s)  (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
320 321

/* Check if we are using TLSv1.3 */
M
Matt Caswell 已提交
322 323 324
# define SSL_IS_TLS13(s) (!SSL_IS_DTLS(s) \
                          && (s)->method->version >= TLS1_3_VERSION \
                          && (s)->method->version != TLS_ANY_VERSION)
325

326
# define SSL_TREAT_AS_TLS13(s) \
327 328
    (SSL_IS_TLS13(s) || (s)->early_data_state == SSL_EARLY_DATA_WRITING \
     || (s)->early_data_state == SSL_EARLY_DATA_WRITE_RETRY)
329

330 331
# define SSL_IS_FIRST_HANDSHAKE(S) ((s)->s3->tmp.finish_md_len == 0)

332
/* See if we need explicit IV */
333 334 335 336 337
# define SSL_USE_EXPLICIT_IV(s)  \
                (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_EXPLICIT_IV)
/*
 * See if we use signature algorithms extension and signature algorithm
 * before signatures.
338
 */
339 340 341 342 343
# define SSL_USE_SIGALGS(s)      \
                        (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SIGALGS)
/*
 * Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2: may
 * apply to others in future.
344
 */
345 346 347 348
# define SSL_USE_TLS1_2_CIPHERS(s)       \
                (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)
/*
 * Determine if a client can use TLS 1.2 ciphersuites: can't rely on method
349 350
 * flags because it may not be set to correct version yet.
 */
351
# define SSL_CLIENT_USE_TLS1_2_CIPHERS(s)        \
352 353
    ((!SSL_IS_DTLS(s) && s->client_version >= TLS1_2_VERSION) || \
     (SSL_IS_DTLS(s) && DTLS_VERSION_GE(s->client_version, DTLS1_2_VERSION)))
354 355 356 357 358 359
/*
 * Determine if a client should send signature algorithms extension:
 * as with TLS1.2 cipher we can't rely on method flags.
 */
# define SSL_CLIENT_USE_SIGALGS(s)        \
    SSL_CLIENT_USE_TLS1_2_CIPHERS(s)
360

361 362
# define SSL_READ_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_READ)
# define SSL_WRITE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE)
363

364
/* Mostly for SSLv3 */
365 366 367 368 369 370
# define SSL_PKEY_RSA            0
# define SSL_PKEY_DSA_SIGN       1
# define SSL_PKEY_ECC            2
# define SSL_PKEY_GOST01         3
# define SSL_PKEY_GOST12_256     4
# define SSL_PKEY_GOST12_512     5
D
Dr. Stephen Henson 已提交
371 372
# define SSL_PKEY_ED25519        6
# define SSL_PKEY_NUM            7
373 374 375 376 377
/*
 * Pseudo-constant. GOST cipher suites can use different certs for 1
 * SSL_CIPHER. So let's see which one we have in fact.
 */
# define SSL_PKEY_GOST_EC SSL_PKEY_NUM+1
378

379
/*
380
 * TODO(TLS1.3) for now use SSL_PKEY_RSA keys for PSS
381 382
 */

383
#define SSL_PKEY_RSA_PSS_SIGN SSL_PKEY_RSA
384

385
/*-
386
 * SSL_kRSA <- RSA_ENC
387
 * SSL_kDH  <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN)
388
 * SSL_kDHE <- RSA_ENC | RSA_SIGN | DSA_SIGN
389 390 391 392
 * SSL_aRSA <- RSA_ENC | RSA_SIGN
 * SSL_aDSS <- DSA_SIGN
 */

M
Matt Caswell 已提交
393
/*-
394 395 396
#define CERT_INVALID            0
#define CERT_PUBLIC_KEY         1
#define CERT_PRIVATE_KEY        2
397 398
*/

E
Emilia Kasper 已提交
399
/* CipherSuite length. SSLv3 and all TLS versions. */
E
Emilia Kasper 已提交
400
# define TLS_CIPHER_LEN 2
401 402
/* used to hold info on the particular ciphers used */
struct ssl_cipher_st {
403
    uint32_t valid;
E
Emilia Kasper 已提交
404
    const char *name;           /* text name */
405
    const char *stdname;        /* RFC name */
E
Emilia Kasper 已提交
406
    uint32_t id;                /* id, 4 bytes, first is version */
407
    /*
408
     * changed in 1.0.0: these four used to be portions of a single value
409 410
     * 'algorithms'
     */
E
Emilia Kasper 已提交
411 412 413 414 415 416 417 418 419 420 421 422
    uint32_t algorithm_mkey;    /* key exchange algorithm */
    uint32_t algorithm_auth;    /* server authentication */
    uint32_t algorithm_enc;     /* symmetric encryption */
    uint32_t algorithm_mac;     /* symmetric authentication */
    int min_tls;                /* minimum SSL/TLS protocol version */
    int max_tls;                /* maximum SSL/TLS protocol version */
    int min_dtls;               /* minimum DTLS protocol version */
    int max_dtls;               /* maximum DTLS protocol version */
    uint32_t algo_strength;     /* strength and export flags */
    uint32_t algorithm2;        /* Extra flags */
    int32_t strength_bits;      /* Number of bits really used */
    uint32_t alg_bits;          /* Number of bits for algorithm */
423 424
};

M
Matt Caswell 已提交
425
/* Used to hold SSL/TLS functions */
426 427
struct ssl_method_st {
    int version;
428 429
    unsigned flags;
    unsigned long mask;
430
    int (*ssl_new) (SSL *s);
431
    int (*ssl_clear) (SSL *s);
432 433 434
    void (*ssl_free) (SSL *s);
    int (*ssl_accept) (SSL *s);
    int (*ssl_connect) (SSL *s);
435 436
    int (*ssl_read) (SSL *s, void *buf, size_t len, size_t *readbytes);
    int (*ssl_peek) (SSL *s, void *buf, size_t len, size_t *readbytes);
M
Matt Caswell 已提交
437
    int (*ssl_write) (SSL *s, const void *buf, size_t len, size_t *written);
438 439
    int (*ssl_shutdown) (SSL *s);
    int (*ssl_renegotiate) (SSL *s);
440
    int (*ssl_renegotiate_check) (SSL *s, int);
441
    int (*ssl_read_bytes) (SSL *s, int type, int *recvd_type,
442
                           unsigned char *buf, size_t len, int peek,
443
                           size_t *readbytes);
M
Matt Caswell 已提交
444 445
    int (*ssl_write_bytes) (SSL *s, int type, const void *buf_, size_t len,
                            size_t *written);
446 447 448 449
    int (*ssl_dispatch_alert) (SSL *s);
    long (*ssl_ctrl) (SSL *s, int cmd, long larg, void *parg);
    long (*ssl_ctx_ctrl) (SSL_CTX *ctx, int cmd, long larg, void *parg);
    const SSL_CIPHER *(*get_cipher_by_char) (const unsigned char *ptr);
M
Matt Caswell 已提交
450
    int (*put_cipher_by_char) (const SSL_CIPHER *cipher, WPACKET *pkt,
451
                               size_t *len);
M
Matt Caswell 已提交
452
    size_t (*ssl_pending) (const SSL *s);
453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482
    int (*num_ciphers) (void);
    const SSL_CIPHER *(*get_cipher) (unsigned ncipher);
    long (*get_timeout) (void);
    const struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
    int (*ssl_version) (void);
    long (*ssl_callback_ctrl) (SSL *s, int cb_id, void (*fp) (void));
    long (*ssl_ctx_callback_ctrl) (SSL_CTX *s, int cb_id, void (*fp) (void));
};

/*-
 * Lets make this into an ASN.1 type structure as follows
 * SSL_SESSION_ID ::= SEQUENCE {
 *      version                 INTEGER,        -- structure version number
 *      SSLversion              INTEGER,        -- SSL version number
 *      Cipher                  OCTET STRING,   -- the 3 byte cipher ID
 *      Session_ID              OCTET STRING,   -- the Session ID
 *      Master_key              OCTET STRING,   -- the master key
 *      Key_Arg [ 0 ] IMPLICIT  OCTET STRING,   -- the optional Key argument
 *      Time [ 1 ] EXPLICIT     INTEGER,        -- optional Start Time
 *      Timeout [ 2 ] EXPLICIT  INTEGER,        -- optional Timeout ins seconds
 *      Peer [ 3 ] EXPLICIT     X509,           -- optional Peer Certificate
 *      Session_ID_context [ 4 ] EXPLICIT OCTET STRING,   -- the Session ID context
 *      Verify_result [ 5 ] EXPLICIT INTEGER,   -- X509_V_... code for `Peer'
 *      HostName [ 6 ] EXPLICIT OCTET STRING,   -- optional HostName from servername TLS extension
 *      PSK_identity_hint [ 7 ] EXPLICIT OCTET STRING, -- optional PSK identity hint
 *      PSK_identity [ 8 ] EXPLICIT OCTET STRING,  -- optional PSK identity
 *      Ticket_lifetime_hint [9] EXPLICIT INTEGER, -- server's lifetime hint for session ticket
 *      Ticket [10]             EXPLICIT OCTET STRING, -- session ticket (clients only)
 *      Compression_meth [11]   EXPLICIT OCTET STRING, -- optional compression method
 *      SRP_username [ 12 ] EXPLICIT OCTET STRING -- optional SRP username
483
 *      flags [ 13 ] EXPLICIT INTEGER -- optional flags
484 485 486 487 488
 *      }
 * Look in ssl/ssl_asn1.c for more details
 * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
 */
struct ssl_session_st {
E
Emilia Kasper 已提交
489 490
    int ssl_version;            /* what ssl version session info is being kept
                                 * in here? */
491
    size_t master_key_length;
492

493 494
    /* TLSv1.3 early_secret used for external PSKs */
    unsigned char early_secret[EVP_MAX_MD_SIZE];
495 496 497 498
    /*
     * For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
     * master secret
     */
M
Matt Caswell 已提交
499
    unsigned char master_key[TLS13_MAX_RESUMPTION_MASTER_LENGTH];
500
    /* session_id - valid? */
501
    size_t session_id_length;
502 503 504 505 506 507
    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
    /*
     * this is used to determine whether the session is being reused in the
     * appropriate context. It is up to the application to set this, via
     * SSL_new
     */
508
    size_t sid_ctx_length;
509 510 511 512 513 514 515 516 517 518 519
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
# ifndef OPENSSL_NO_PSK
    char *psk_identity_hint;
    char *psk_identity;
# endif
    /*
     * Used to indicate that session resumption is not allowed. Applications
     * can also set this bit for a new session via not_resumable_session_cb
     * to disable session caching and tickets.
     */
    int not_resumable;
520
    /* This is the cert and type for the other end. */
521
    X509 *peer;
522
    int peer_type;
523
    /* Certificate chain peer sent. */
524
    STACK_OF(X509) *peer_chain;
525 526 527 528 529
    /*
     * when app_verify_callback accepts a session where the peer's
     * certificate is not ok, we must remember the error for session reuse:
     */
    long verify_result;         /* only for servers */
530
    CRYPTO_REF_COUNT references;
531 532 533 534
    long timeout;
    long time;
    unsigned int compress_meth; /* Need to lookup the method */
    const SSL_CIPHER *cipher;
E
Emilia Kasper 已提交
535 536
    unsigned long cipher_id;    /* when ASN.1 loaded, this needs to be used to
                                 * load the 'cipher' structure */
537 538 539 540 541 542 543
    STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */
    CRYPTO_EX_DATA ex_data;     /* application specific data */
    /*
     * These are used to make removal of session-ids more efficient and to
     * implement a maximum cache size.
     */
    struct ssl_session_st *prev, *next;
R
Rich Salz 已提交
544 545 546

    struct {
        char *hostname;
547
# ifndef OPENSSL_NO_EC
R
Rich Salz 已提交
548 549 550 551
        size_t ecpointformats_len;
        unsigned char *ecpointformats; /* peer's list */
        size_t supportedgroups_len;
        unsigned char *supportedgroups; /* peer's list */
E
Emilia Kasper 已提交
552
# endif                         /* OPENSSL_NO_EC */
553
    /* RFC4507 info */
R
Rich Salz 已提交
554 555 556 557
        unsigned char *tick; /* Session ticket */
        size_t ticklen;      /* Session ticket length */
        /* Session lifetime hint in seconds */
        unsigned long tick_lifetime_hint;
M
Matt Caswell 已提交
558
        uint32_t tick_age_add;
559 560
        unsigned char *tick_nonce;
        size_t tick_nonce_len;
561
        int tick_identity;
562 563
        /* Max number of bytes that can be sent as early data */
        uint32_t max_early_data;
564 565 566
        /* The ALPN protocol selected for this session */
        unsigned char *alpn_selected;
        size_t alpn_selected_len;
R
Rich Salz 已提交
567
    } ext;
568 569 570
# ifndef OPENSSL_NO_SRP
    char *srp_username;
# endif
571
    uint32_t flags;
572
    CRYPTO_RWLOCK *lock;
573 574
};

575
/* Extended master secret support */
E
Emilia Kasper 已提交
576
# define SSL_SESS_FLAG_EXTMS             0x1
577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598

# ifndef OPENSSL_NO_SRP

typedef struct srp_ctx_st {
    /* param for all the callbacks */
    void *SRP_cb_arg;
    /* set client Hello login callback */
    int (*TLS_ext_srp_username_callback) (SSL *, int *, void *);
    /* set SRP N/g param callback for verification */
    int (*SRP_verify_param_callback) (SSL *, void *);
    /* set SRP client passwd callback */
    char *(*SRP_give_srp_client_pwd_callback) (SSL *, void *);
    char *login;
    BIGNUM *N, *g, *s, *B, *A;
    BIGNUM *a, *b, *v;
    char *info;
    int strength;
    unsigned long srp_Mask;
} SRP_CTX;

# endif

599 600 601 602 603 604
typedef enum {
    SSL_EARLY_DATA_NONE = 0,
    SSL_EARLY_DATA_CONNECT_RETRY,
    SSL_EARLY_DATA_CONNECTING,
    SSL_EARLY_DATA_WRITE_RETRY,
    SSL_EARLY_DATA_WRITING,
605
    SSL_EARLY_DATA_UNAUTH_WRITING,
606 607 608 609 610 611
    SSL_EARLY_DATA_FINISHED_WRITING,
    SSL_EARLY_DATA_ACCEPT_RETRY,
    SSL_EARLY_DATA_ACCEPTING,
    SSL_EARLY_DATA_READ_RETRY,
    SSL_EARLY_DATA_READING,
    SSL_EARLY_DATA_FINISHED_READING
612 613
} SSL_EARLY_DATA_STATE;

614 615 616 617 618 619 620 621 622 623 624 625
/*
 * We check that the amount of unreadable early data doesn't exceed
 * max_early_data. max_early_data is given in plaintext bytes. However if it is
 * unreadable then we only know the number of ciphertext bytes. We also don't
 * know how much the overhead should be because it depends on the ciphersuite.
 * We make a small allowance. We assume 5 records of actual data plus the end
 * of early data alert record. Each record has a tag and a content type byte.
 * The longest tag length we know of is EVP_GCM_TLS_TAG_LEN. We don't count the
 * content of the alert record either which is 2 bytes.
 */
# define EARLY_DATA_CIPHERTEXT_OVERHEAD ((6 * (EVP_GCM_TLS_TAG_LEN + 1)) + 2)

626 627 628 629 630 631 632 633
/*
 * The allowance we have between the client's calculated ticket age and our own.
 * We allow for 10 seconds (units are in ms). If a ticket is presented and the
 * client's age calculation is different by more than this than our own then we
 * do not allow that ticket for early_data.
 */
# define TICKET_AGE_ALLOWANCE   (10 * 1000)

634 635
#define MAX_COMPRESSIONS_SIZE   255

636 637 638 639 640 641
struct ssl_comp_st {
    int id;
    const char *name;
    COMP_METHOD *method;
};

642 643 644 645 646 647 648 649 650
typedef struct raw_extension_st {
    /* Raw packet data for the extension */
    PACKET data;
    /* Set to 1 if the extension is present or 0 otherwise */
    int present;
    /* Set to 1 if we have already parsed the extension or 0 otherwise */
    int parsed;
    /* The type of this extension, i.e. a TLSEXT_TYPE_* value */
    unsigned int type;
651 652
    /* Track what order extensions are received in (0-based). */
    size_t received_order;
653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670
} RAW_EXTENSION;

typedef struct {
    unsigned int isv2;
    unsigned int legacy_version;
    unsigned char random[SSL3_RANDOM_SIZE];
    size_t session_id_len;
    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
    size_t dtls_cookie_len;
    unsigned char dtls_cookie[DTLS1_COOKIE_LENGTH];
    PACKET ciphersuites;
    size_t compressions_len;
    unsigned char compressions[MAX_COMPRESSIONS_SIZE];
    PACKET extensions;
    size_t pre_proc_exts_len;
    RAW_EXTENSION *pre_proc_exts;
} CLIENTHELLO_MSG;

671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688
/*
 * Extension index values NOTE: Any updates to these defines should be mirrored
 * with equivalent updates to ext_defs in extensions.c
 */
typedef enum tlsext_index_en {
    TLSEXT_IDX_renegotiate,
    TLSEXT_IDX_server_name,
    TLSEXT_IDX_srp,
    TLSEXT_IDX_ec_point_formats,
    TLSEXT_IDX_supported_groups,
    TLSEXT_IDX_session_ticket,
    TLSEXT_IDX_status_request,
    TLSEXT_IDX_next_proto_neg,
    TLSEXT_IDX_application_layer_protocol_negotiation,
    TLSEXT_IDX_use_srtp,
    TLSEXT_IDX_encrypt_then_mac,
    TLSEXT_IDX_signed_certificate_timestamp,
    TLSEXT_IDX_extended_master_secret,
689
    TLSEXT_IDX_signature_algorithms,
690 691 692 693 694 695 696 697 698 699 700 701 702
    TLSEXT_IDX_supported_versions,
    TLSEXT_IDX_psk_kex_modes,
    TLSEXT_IDX_key_share,
    TLSEXT_IDX_cookie,
    TLSEXT_IDX_cryptopro_bug,
    TLSEXT_IDX_early_data,
    TLSEXT_IDX_certificate_authorities,
    TLSEXT_IDX_padding,
    TLSEXT_IDX_psk,
    /* Dummy index - must always be the last entry */
    TLSEXT_IDX_num_builtins
} TLSEXT_INDEX;

703
DEFINE_LHASH_OF(SSL_SESSION);
V
Viktor Dukhovni 已提交
704 705
/* Needed in ssl_cert.c */
DEFINE_LHASH_OF(X509_NAME);
706

E
Emilia Kasper 已提交
707
# define TLSEXT_KEYNAME_LENGTH 16
K
Kurt Roeckx 已提交
708

709 710 711 712 713 714 715 716 717 718 719
struct ssl_ctx_st {
    const SSL_METHOD *method;
    STACK_OF(SSL_CIPHER) *cipher_list;
    /* same as above but sorted for lookup */
    STACK_OF(SSL_CIPHER) *cipher_list_by_id;
    struct x509_store_st /* X509_STORE */ *cert_store;
    LHASH_OF(SSL_SESSION) *sessions;
    /*
     * Most session-ids that will be cached, default is
     * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited.
     */
M
Matt Caswell 已提交
720
    size_t session_cache_size;
721 722 723 724 725 726 727
    struct ssl_session_st *session_cache_head;
    struct ssl_session_st *session_cache_tail;
    /*
     * This can have one of 2 values, ored together, SSL_SESS_CACHE_CLIENT,
     * SSL_SESS_CACHE_SERVER, Default is SSL_SESSION_CACHE_SERVER, which
     * means only SSL_accept which cache SSL_SESSIONS.
     */
728
    uint32_t session_cache_mode;
729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746
    /*
     * If timeout is not 0, it is the default timeout value set when
     * SSL_new() is called.  This has been put in to make life easier to set
     * things up
     */
    long session_timeout;
    /*
     * If this callback is not null, it will be called each time a session id
     * is added to the cache.  If this function returns 1, it means that the
     * callback will do a SSL_SESSION_free() when it has finished using it.
     * Otherwise, on 0, it means the callback has finished with it. If
     * remove_session_cb is not null, it will be called when a session-id is
     * removed from the cache.  After the call, OpenSSL will
     * SSL_SESSION_free() it.
     */
    int (*new_session_cb) (struct ssl_st *ssl, SSL_SESSION *sess);
    void (*remove_session_cb) (struct ssl_ctx_st *ctx, SSL_SESSION *sess);
    SSL_SESSION *(*get_session_cb) (struct ssl_st *ssl,
E
Emilia Kasper 已提交
747 748
                                    const unsigned char *data, int len,
                                    int *copy);
749 750 751 752 753 754 755 756 757 758 759 760 761
    struct {
        int sess_connect;       /* SSL new conn - started */
        int sess_connect_renegotiate; /* SSL reneg - requested */
        int sess_connect_good;  /* SSL new conne/reneg - finished */
        int sess_accept;        /* SSL new accept - started */
        int sess_accept_renegotiate; /* SSL reneg - requested */
        int sess_accept_good;   /* SSL accept/reneg - finished */
        int sess_miss;          /* session lookup misses */
        int sess_timeout;       /* reuse attempt on timeouted session */
        int sess_cache_full;    /* session removed due to full cache */
        int sess_hit;           /* session reuse actually done */
        int sess_cb_hit;        /* session-id that was not in the cache was
                                 * passed back via the callback.  This
E
Emilia Kasper 已提交
762 763 764
                                 * indicates that the application is supplying
                                 * session-id's from other processes - spooky
                                 * :-) */
765 766
    } stats;

767
    CRYPTO_REF_COUNT references;
768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790

    /* if defined, these override the X509_verify_cert() calls */
    int (*app_verify_callback) (X509_STORE_CTX *, void *);
    void *app_verify_arg;
    /*
     * before OpenSSL 0.9.7, 'app_verify_arg' was ignored
     * ('app_verify_callback' was called with just one argument)
     */

    /* Default password callback. */
    pem_password_cb *default_passwd_callback;

    /* Default password callback user data. */
    void *default_passwd_callback_userdata;

    /* get client cert callback */
    int (*client_cert_cb) (SSL *ssl, X509 **x509, EVP_PKEY **pkey);

    /* cookie generate callback */
    int (*app_gen_cookie_cb) (SSL *ssl, unsigned char *cookie,
                              unsigned int *cookie_len);

    /* verify cookie callback */
E
Emilia Kasper 已提交
791
    int (*app_verify_cookie_cb) (SSL *ssl, const unsigned char *cookie,
792 793 794 795 796 797 798 799 800 801 802 803 804 805 806
                                 unsigned int cookie_len);

    CRYPTO_EX_DATA ex_data;

    const EVP_MD *md5;          /* For SSLv3/TLSv1 'ssl3-md5' */
    const EVP_MD *sha1;         /* For SSLv3/TLSv1 'ssl3->sha1' */

    STACK_OF(X509) *extra_certs;
    STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */

    /* Default values used when no per-SSL value is defined follow */

    /* used if SSL's info_callback is NULL */
    void (*info_callback) (const SSL *ssl, int type, int val);

807 808 809 810 811 812
    /*
     * What we put in certificate_authorities extension for TLS 1.3
     * (ClientHello and CertificateRequest) or just client cert requests for
     * earlier versions.
     */
    STACK_OF(X509_NAME) *ca_names;
813 814 815 816 817 818

    /*
     * Default values to use in SSL structures follow (these are copied by
     * SSL_new)
     */

819 820
    uint32_t options;
    uint32_t mode;
821 822
    int min_proto_version;
    int max_proto_version;
823
    size_t max_cert_list;
824 825 826 827 828 829 830 831 832

    struct cert_st /* CERT */ *cert;
    int read_ahead;

    /* callback that allows applications to peek at protocol messages */
    void (*msg_callback) (int write_p, int version, int content_type,
                          const void *buf, size_t len, SSL *ssl, void *arg);
    void *msg_callback_arg;

833
    uint32_t verify_mode;
834
    size_t sid_ctx_length;
835 836 837 838 839 840 841 842 843 844 845
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
    /* called 'verify_callback' in the SSL */
    int (*default_verify_callback) (int ok, X509_STORE_CTX *ctx);

    /* Default generate session ID callback. */
    GEN_SESSION_CB generate_session_id;

    X509_VERIFY_PARAM *param;

    int quiet_shutdown;

E
Emilia Kasper 已提交
846 847
# ifndef OPENSSL_NO_CT
    CTLOG_STORE *ctlog_store;   /* CT Log Store */
848
    /*
E
Emilia Kasper 已提交
849 850 851
     * Validates that the SCTs (Signed Certificate Timestamps) are sufficient.
     * If they are not, the connection should be aborted.
     */
852
    ssl_ct_validation_cb ct_validation_callback;
853
    void *ct_validation_callback_arg;
E
Emilia Kasper 已提交
854
# endif
855

856 857 858 859
    /*
     * If we're using more than one pipeline how should we divide the data
     * up between the pipes?
     */
M
Matt Caswell 已提交
860
    size_t split_send_fragment;
861 862 863 864
    /*
     * Maximum amount of data to send in one fragment. actual record size can
     * be more than this due to padding and MAC overheads.
     */
M
Matt Caswell 已提交
865
    size_t max_send_fragment;
866

867
    /* Up to how many pipelines should we use? If 0 then 1 is assumed */
M
Matt Caswell 已提交
868
    size_t max_pipelines;
869

870 871 872
    /* The default read buffer length to use (0 means not set) */
    size_t default_read_buf_len;

E
Emilia Kasper 已提交
873
# ifndef OPENSSL_NO_ENGINE
874 875 876 877
    /*
     * Engine to pass requests for client certs to
     */
    ENGINE *client_cert_engine;
E
Emilia Kasper 已提交
878
# endif
879

880 881 882
    /* ClientHello callback.  Mostly for extensions, but not entirely. */
    SSL_client_hello_cb_fn client_hello_cb;
    void *client_hello_cb_arg;
B
Benjamin Kaduk 已提交
883

R
Rich Salz 已提交
884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903
    /* TLS extensions. */
    struct {
        /* TLS extensions servername callback */
        int (*servername_cb) (SSL *, int *, void *);
        void *servername_arg;
        /* RFC 4507 session ticket keys */
        unsigned char tick_key_name[TLSEXT_KEYNAME_LENGTH];
        unsigned char tick_hmac_key[32];
        unsigned char tick_aes_key[32];
        /* Callback to support customisation of ticket key setting */
        int (*ticket_key_cb) (SSL *ssl,
                              unsigned char *name, unsigned char *iv,
                              EVP_CIPHER_CTX *ectx, HMAC_CTX *hctx, int enc);

        /* certificate status request info */
        /* Callback for status request */
        int (*status_cb) (SSL *ssl, void *arg);
        void *status_arg;
        /* ext status type used for CSR extension (OCSP Stapling) */
        int status_type;
904

R
Rich Salz 已提交
905 906 907 908 909 910 911
# ifndef OPENSSL_NO_EC
        /* EC extension values inherited by SSL structure */
        size_t ecpointformats_len;
        unsigned char *ecpointformats;
        size_t supportedgroups_len;
        unsigned char *supportedgroups;
# endif                         /* OPENSSL_NO_EC */
912

R
Rich Salz 已提交
913 914 915 916
        /*
         * ALPN information (we are in the process of transitioning from NPN to
         * ALPN.)
         */
917 918 919 920 921 922 923 924 925 926 927

        /*-
         * For a server, this contains a callback function that allows the
         * server to select the protocol for the connection.
         *   out: on successful return, this must point to the raw protocol
         *        name (without the length prefix).
         *   outlen: on successful return, this contains the length of |*out|.
         *   in: points to the client's list of supported protocols in
         *       wire-format.
         *   inlen: the length of |in|.
         */
R
Rich Salz 已提交
928 929 930 931 932 933
        int (*alpn_select_cb) (SSL *s,
                               const unsigned char **out,
                               unsigned char *outlen,
                               const unsigned char *in,
                               unsigned int inlen, void *arg);
        void *alpn_select_cb_arg;
934

R
Rich Salz 已提交
935 936 937 938 939 940 941
        /*
         * For a client, this contains the list of supported protocols in wire
         * format.
         */
        unsigned char *alpn;
        size_t alpn_len;

942
# ifndef OPENSSL_NO_NEXTPROTONEG
R
Rich Salz 已提交
943 944 945 946 947 948
        /* Next protocol negotiation information */

        /*
         * For a server, this contains a callback function by which the set of
         * advertised protocols can be provided.
         */
949
        SSL_CTX_npn_advertised_cb_func npn_advertised_cb;
R
Rich Salz 已提交
950 951 952 953 954
        void *npn_advertised_cb_arg;
        /*
         * For a client, this contains a callback function that selects the next
         * protocol from the list provided by the server.
         */
955
        SSL_CTX_npn_select_cb_func npn_select_cb;
R
Rich Salz 已提交
956 957 958 959 960
        void *npn_select_cb_arg;
# endif
    } ext;

# ifndef OPENSSL_NO_PSK
961 962
    SSL_psk_client_cb_func psk_client_callback;
    SSL_psk_server_cb_func psk_server_callback;
R
Rich Salz 已提交
963
# endif
964
    SSL_psk_find_session_cb_func psk_find_session_cb;
965
    SSL_psk_use_session_cb_func psk_use_session_cb;
R
Rich Salz 已提交
966 967 968 969

# ifndef OPENSSL_NO_SRP
    SRP_CTX srp_ctx;            /* ctx for SRP authentication */
# endif
970

971 972 973
    /* Shared DANE context */
    struct dane_ctx_st dane;

974 975 976 977 978 979 980
    /* SRTP profiles we are willing to do from RFC 5764 */
    STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
    /*
     * Callback for disabling session caching and ticket support on a session
     * basis, depending on the chosen cipher.
     */
    int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
981

982
    CRYPTO_RWLOCK *lock;
983 984 985 986 987 988

    /*
     * Callback for logging key material for use with debugging tools like
     * Wireshark. The callback should log `line` followed by a newline.
     */
    SSL_CTX_keylog_cb_func keylog_callback;
989 990 991

    /* The maximum number of bytes that can be sent as early data */
    uint32_t max_early_data;
T
Todd Short 已提交
992 993 994 995 996

    /* TLS1.3 padding callback */
    size_t (*record_padding_cb)(SSL *s, int type, size_t len, void *arg);
    void *record_padding_arg;
    size_t block_padding;
997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030
};

struct ssl_st {
    /*
     * protocol version (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION,
     * DTLS1_VERSION)
     */
    int version;
    /* SSLv3 */
    const SSL_METHOD *method;
    /*
     * There are 2 BIO's even though they are normally both the same.  This
     * is so data can be read and written to different handlers
     */
    /* used by SSL_read */
    BIO *rbio;
    /* used by SSL_write */
    BIO *wbio;
    /* used during session-id reuse to concatenate messages */
    BIO *bbio;
    /*
     * This holds a variable that indicates what we were doing when a 0 or -1
     * is returned.  This is needed for non-blocking IO so we know what
     * request needs re-doing when in SSL_accept or SSL_connect
     */
    int rwstate;
    int (*handshake_func) (SSL *);
    /*
     * Imagine that here's a boolean member "init" that is switched as soon
     * as SSL_set_{accept/connect}_state is called for the first time, so
     * that "state" and "handshake_func" are properly initialized.  But as
     * handshake_func is == 0 until then, we use this test instead of an
     * "init" member.
     */
M
Matt Caswell 已提交
1031
    /* are we the server side? */
1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044
    int server;
    /*
     * Generate a new session or reuse an old one.
     * NB: For servers, the 'new' session may actually be a previously
     * cached session or even the previous session unless
     * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set
     */
    int new_session;
    /* don't send shutdown packets */
    int quiet_shutdown;
    /* we have shut things down, 0x01 sent, 0x02 for received */
    int shutdown;
    /* where we are */
M
Matt Caswell 已提交
1045
    OSSL_STATEM statem;
1046
    SSL_EARLY_DATA_STATE early_data_state;
1047 1048 1049
    BUF_MEM *init_buf;          /* buffer used during init */
    void *init_msg;             /* pointer to handshake message body, set by
                                 * ssl3_get_message() */
1050 1051
    size_t init_num;               /* amount read/written */
    size_t init_off;               /* amount read/written */
1052 1053 1054 1055 1056 1057 1058 1059
    struct ssl3_state_st *s3;   /* SSLv3 variables */
    struct dtls1_state_st *d1;  /* DTLSv1 variables */
    /* callback that allows applications to peek at protocol messages */
    void (*msg_callback) (int write_p, int version, int content_type,
                          const void *buf, size_t len, SSL *ssl, void *arg);
    void *msg_callback_arg;
    int hit;                    /* reusing a previous session */
    X509_VERIFY_PARAM *param;
1060
    /* Per connection DANE state */
1061
    SSL_DANE dane;
1062 1063 1064 1065 1066 1067 1068
    /* crypto */
    STACK_OF(SSL_CIPHER) *cipher_list;
    STACK_OF(SSL_CIPHER) *cipher_list_by_id;
    /*
     * These are the ones being used, the ones in SSL_SESSION are the ones to
     * be 'copied' into these ones
     */
1069
    uint32_t mac_flags;
1070
    /*
1071 1072
     * The TLS1.3 secrets. The resumption master secret is stored in the
     * session.
1073 1074 1075
     */
    unsigned char early_secret[EVP_MAX_MD_SIZE];
    unsigned char handshake_secret[EVP_MAX_MD_SIZE];
1076
    unsigned char master_secret[EVP_MAX_MD_SIZE];
M
Matt Caswell 已提交
1077 1078
    unsigned char client_finished_secret[EVP_MAX_MD_SIZE];
    unsigned char server_finished_secret[EVP_MAX_MD_SIZE];
1079
    unsigned char server_finished_hash[EVP_MAX_MD_SIZE];
1080
    unsigned char handshake_traffic_hash[EVP_MAX_MD_SIZE];
1081 1082
    unsigned char client_app_traffic_secret[EVP_MAX_MD_SIZE];
    unsigned char server_app_traffic_secret[EVP_MAX_MD_SIZE];
1083
    unsigned char exporter_master_secret[EVP_MAX_MD_SIZE];
1084
    EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */
M
Matt Caswell 已提交
1085
    unsigned char read_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static read IV */
1086
    EVP_MD_CTX *read_hash;      /* used for mac generation */
R
Rich Salz 已提交
1087
    COMP_CTX *compress;         /* compression */
1088 1089
    COMP_CTX *expand;           /* uncompress */
    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
M
Matt Caswell 已提交
1090
    unsigned char write_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static write IV */
1091
    EVP_MD_CTX *write_hash;     /* used for mac generation */
1092 1093
    /* Count of how many KeyUpdate messages we have received */
    unsigned int key_update_count;
1094 1095 1096 1097
    /* session info */
    /* client cert? */
    /* This is used to hold the server certificate used */
    struct cert_st /* CERT */ *cert;
1098 1099 1100 1101 1102 1103 1104 1105

    /*
     * The hash of all messages prior to the CertificateVerify, and the length
     * of that hash.
     */
    unsigned char cert_verify_hash[EVP_MAX_MD_SIZE];
    size_t cert_verify_hash_len;

1106 1107 1108
    /* Flag to indicate whether we should send a HelloRetryRequest or not */
    int hello_retry_request;

1109 1110 1111 1112
    /*
     * the session_id_context is used to ensure sessions are only reused in
     * the appropriate context
     */
1113
    size_t sid_ctx_length;
1114 1115 1116
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
    /* This can also be in the session once a session is established */
    SSL_SESSION *session;
1117 1118
    /* TLSv1.3 PSK session */
    SSL_SESSION *psksession;
1119 1120
    unsigned char *psksession_id;
    size_t psksession_id_len;
1121 1122 1123 1124 1125 1126 1127
    /* Default generate session ID callback. */
    GEN_SESSION_CB generate_session_id;
    /* Used in SSL3 */
    /*
     * 0 don't care about verify failure.
     * 1 fail if verify fails
     */
1128
    uint32_t verify_mode;
1129 1130 1131 1132 1133 1134 1135 1136
    /* fail if callback returns 0 */
    int (*verify_callback) (int ok, X509_STORE_CTX *ctx);
    /* optional informational callback */
    void (*info_callback) (const SSL *ssl, int type, int val);
    /* error bytes to be written */
    int error;
    /* actual code */
    int error_code;
E
Emilia Kasper 已提交
1137
# ifndef OPENSSL_NO_PSK
1138 1139
    SSL_psk_client_cb_func psk_client_callback;
    SSL_psk_server_cb_func psk_server_callback;
E
Emilia Kasper 已提交
1140
# endif
1141
    SSL_psk_find_session_cb_func psk_find_session_cb;
1142
    SSL_psk_use_session_cb_func psk_use_session_cb;
1143
    SSL_CTX *ctx;
1144 1145
    /* Verified chain of peer */
    STACK_OF(X509) *verified_chain;
1146
    long verify_result;
1147
    /* extra application data */
1148 1149
    CRYPTO_EX_DATA ex_data;
    /* for server side, keep the list of CA_dn we can use */
1150
    STACK_OF(X509_NAME) *ca_names;
1151
    CRYPTO_REF_COUNT references;
1152
    /* protocol behaviour */
1153
    uint32_t options;
1154
    /* API behaviour */
1155
    uint32_t mode;
1156 1157
    int min_proto_version;
    int max_proto_version;
1158
    size_t max_cert_list;
1159
    int first_packet;
1160 1161 1162 1163
    /*
     * What was passed in ClientHello.legacy_version. Used for RSA pre-master
     * secret and SSLv3/TLS (<=1.2) rollback check
     */
1164
    int client_version;
1165 1166 1167 1168
    /*
     * If we're using more than one pipeline how should we divide the data
     * up between the pipes?
     */
M
Matt Caswell 已提交
1169
    size_t split_send_fragment;
1170 1171 1172 1173
    /*
     * Maximum amount of data to send in one fragment. actual record size can
     * be more than this due to padding and MAC overheads.
     */
M
Matt Caswell 已提交
1174
    size_t max_send_fragment;
1175
    /* Up to how many pipelines should we use? If 0 then 1 is assumed */
M
Matt Caswell 已提交
1176
    size_t max_pipelines;
R
Rich Salz 已提交
1177 1178

    struct {
1179 1180
        /* Built-in extension flags */
        uint8_t extflags[TLSEXT_IDX_num_builtins];
R
Rich Salz 已提交
1181
        /* TLS extension debug callback */
R
Rich Salz 已提交
1182 1183
        void (*debug_cb)(SSL *s, int client_server, int type,
                         const unsigned char *data, int len, void *arg);
R
Rich Salz 已提交
1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237
        void *debug_arg;
        char *hostname;
        /* certificate status request info */
        /* Status type or -1 if no status type */
        int status_type;
        /* Raw extension data, if seen */
        unsigned char *scts;
        /* Length of raw extension data, if seen */
        uint16_t scts_len;
        /* Expect OCSP CertificateStatus message */
        int status_expected;

        struct {
            /* OCSP status request only */
            STACK_OF(OCSP_RESPID) *ids;
            X509_EXTENSIONS *exts;
            /* OCSP response received or to be sent */
            unsigned char *resp;
            size_t resp_len;
        } ocsp;

        /* RFC4507 session ticket expected to be received or sent */
        int ticket_expected;
# ifndef OPENSSL_NO_EC
        size_t ecpointformats_len;
        /* our list */
        unsigned char *ecpointformats;
        size_t supportedgroups_len;
        /* our list */
        unsigned char *supportedgroups;
# endif                         /* OPENSSL_NO_EC */
        /* TLS Session Ticket extension override */
        TLS_SESSION_TICKET_EXT *session_ticket;
        /* TLS Session Ticket extension callback */
        tls_session_ticket_ext_cb_fn session_ticket_cb;
        void *session_ticket_cb_arg;
        /* TLS pre-shared secret session resumption */
        tls_session_secret_cb_fn session_secret_cb;
        void *session_secret_cb_arg;
        /*
         * For a client, this contains the list of supported protocols in wire
         * format.
         */
        unsigned char *alpn;
        size_t alpn_len;
        /*
         * Next protocol negotiation. For the client, this is the protocol that
         * we sent in NextProtocol and is set when handling ServerHello
         * extensions. For a server, this is the client's selected_protocol from
         * NextProtocol and is set when handling the NextProtocol message, before
         * the Finished message.
         */
        unsigned char *npn;
        size_t npn_len;
1238

M
Matt Caswell 已提交
1239
        /* The available PSK key exchange modes */
1240
        int psk_kex_mode;
1241 1242 1243

        /* Set to one if we have negotiated ETM */
        int use_etm;
M
Matt Caswell 已提交
1244

1245 1246
        /* Are we expecting to receive early data? */
        int early_data;
1247 1248
        /* Is the session suitable for early data? */
        int early_data_ok;
M
Matt Caswell 已提交
1249 1250 1251 1252

        /* May be sent by a server in HRR. Must be echoed back in ClientHello */
        unsigned char *tls13_cookie;
        size_t tls13_cookie_len;
R
Rich Salz 已提交
1253 1254
    } ext;

1255 1256 1257 1258
    /*
     * Parsed form of the ClientHello, kept around across client_hello_cb
     * calls.
     */
B
Benjamin Kaduk 已提交
1259 1260
    CLIENTHELLO_MSG *clienthello;

1261 1262 1263 1264 1265 1266 1267
    /*-
     * no further mod of servername
     * 0 : call the servername extension callback.
     * 1 : prepare 2, allow last ack just after in server callback.
     * 2 : don't call servername callback, no ack in server hello
     */
    int servername_done;
E
Emilia Kasper 已提交
1268
# ifndef OPENSSL_NO_CT
1269
    /*
E
Emilia Kasper 已提交
1270 1271 1272
     * Validates that the SCTs (Signed Certificate Timestamps) are sufficient.
     * If they are not, the connection should be aborted.
     */
1273
    ssl_ct_validation_cb ct_validation_callback;
F
FdaSilvaYY 已提交
1274
    /* User-supplied argument that is passed to the ct_validation_callback */
1275 1276 1277 1278 1279 1280 1281 1282
    void *ct_validation_callback_arg;
    /*
     * Consolidated stack of SCTs from all sources.
     * Lazily populated by CT_get_peer_scts(SSL*)
     */
    STACK_OF(SCT) *scts;
    /* Have we attempted to find/parse SCTs yet? */
    int scts_parsed;
E
Emilia Kasper 已提交
1283
# endif
1284
    SSL_CTX *session_ctx;       /* initial ctx, used to store sessions */
1285 1286 1287 1288 1289 1290 1291 1292 1293 1294
    /* What we'll do */
    STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
    /* What's been chosen */
    SRTP_PROTECTION_PROFILE *srtp_profile;
    /*-
     * 1 if we are renegotiating.
     * 2 if we are a server and are inside a handshake
     * (i.e. not just sending a HelloRequest)
     */
    int renegotiate;
1295
    /* If sending a KeyUpdate is pending */
1296
    int key_update;
E
Emilia Kasper 已提交
1297
# ifndef OPENSSL_NO_SRP
1298 1299
    /* ctx for SRP authentication */
    SRP_CTX srp_ctx;
E
Emilia Kasper 已提交
1300
# endif
1301 1302 1303 1304 1305
    /*
     * Callback for disabling session caching and ticket support on a session
     * basis, depending on the chosen cipher.
     */
    int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
1306
    RECORD_LAYER rlayer;
M
Matt Caswell 已提交
1307 1308 1309 1310
    /* Default password callback. */
    pem_password_cb *default_passwd_callback;
    /* Default password callback user data. */
    void *default_passwd_callback_userdata;
M
Matt Caswell 已提交
1311 1312
    /* Async Job info */
    ASYNC_JOB *job;
M
Matt Caswell 已提交
1313
    ASYNC_WAIT_CTX *waitctx;
M
Matt Caswell 已提交
1314
    size_t asyncrw;
1315

1316
    /* The maximum number of plaintext bytes that can be sent as early data */
1317
    uint32_t max_early_data;
1318 1319 1320 1321 1322 1323
    /*
     * The number of bytes of early data received so far. If we accepted early
     * data then this is a count of the plaintext bytes. If we rejected it then
     * this is a count of the ciphertext bytes.
     */
    uint32_t early_data_count;
1324

T
Todd Short 已提交
1325 1326 1327 1328 1329
    /* TLS1.3 padding callback */
    size_t (*record_padding_cb)(SSL *s, int type, size_t len, void *arg);
    void *record_padding_arg;
    size_t block_padding;

1330
    CRYPTO_RWLOCK *lock;
R
Rich Salz 已提交
1331
    RAND_DRBG *drbg;
1332 1333
};

1334 1335 1336 1337 1338 1339 1340 1341 1342
/*
 * Structure containing table entry of values associated with the signature
 * algorithms (signature scheme) extension
*/
typedef struct sigalg_lookup_st {
    /* TLS 1.3 signature scheme name */
    const char *name;
    /* Raw value used in extension */
    uint16_t sigalg;
1343
    /* NID of hash algorithm or NID_undef if no hash */
1344
    int hash;
1345
    /* Index of hash algorithm or -1 if no hash algorithm */
1346
    int hash_idx;
1347 1348
    /* NID of signature algorithm */
    int sig;
1349 1350
    /* Index of signature algorithm */
    int sig_idx;
1351 1352 1353 1354 1355 1356
    /* Combined hash and signature NID, if any */
    int sigandhash;
    /* Required public key curve (ECDSA only) */
    int curve;
} SIGALG_LOOKUP;

1357 1358
typedef struct cert_pkey_st CERT_PKEY;

1359 1360 1361 1362 1363 1364 1365 1366 1367
/*
 * Structure containing table entry of certificate info corresponding to
 * CERT_PKEY entries
 */
typedef struct {
    int nid; /* NID of pubic key algorithm */
    uint32_t amask; /* authmask corresponding to key type */
} SSL_CERT_LOOKUP;

1368 1369
typedef struct ssl3_state_st {
    long flags;
1370
    size_t read_mac_secret_size;
1371
    unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
1372
    size_t write_mac_secret_size;
1373 1374 1375 1376 1377 1378 1379 1380 1381
    unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
    unsigned char server_random[SSL3_RANDOM_SIZE];
    unsigned char client_random[SSL3_RANDOM_SIZE];
    /* flags for countermeasure against known-IV weakness */
    int need_empty_fragments;
    int empty_fragment_done;
    /* used during startup, digest all incoming/outgoing packets */
    BIO *handshake_buffer;
    /*
1382 1383
     * When handshake digest is determined, buffer is hashed and
     * freed and MD_CTX for the required digest is stored here.
1384
     */
1385
    EVP_MD_CTX *handshake_dgst;
1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410
    /*
     * Set whenever an expected ChangeCipherSpec message is processed.
     * Unset when the peer's Finished message is received.
     * Unexpected ChangeCipherSpec messages trigger a fatal alert.
     */
    int change_cipher_spec;
    int warn_alert;
    int fatal_alert;
    /*
     * we allow one fatal and one warning alert to be outstanding, send close
     * alert via the warning alert
     */
    int alert_dispatch;
    unsigned char send_alert[2];
    /*
     * This flag is set when we should renegotiate ASAP, basically when there
     * is no more data in the read or write buffers
     */
    int renegotiate;
    int total_renegotiations;
    int num_renegotiations;
    int in_read_app_data;
    struct {
        /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
        unsigned char finish_md[EVP_MAX_MD_SIZE * 2];
1411
        size_t finish_md_len;
1412
        unsigned char peer_finish_md[EVP_MAX_MD_SIZE * 2];
1413
        size_t peer_finish_md_len;
1414
        size_t message_size;
1415 1416 1417
        int message_type;
        /* used to hold the new cipher we are going to use */
        const SSL_CIPHER *new_cipher;
E
Emilia Kasper 已提交
1418 1419 1420
# if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
        EVP_PKEY *pkey;         /* holds short lived DH/ECDH key */
# endif
1421 1422
        /* used for certificate requests */
        int cert_req;
1423 1424 1425
        /* Certificate types in certificate request message. */
        uint8_t *ctype;
        size_t ctype_len;
1426 1427
        /* Certificate authorities list peer sent */
        STACK_OF(X509_NAME) *peer_ca_names;
1428
        size_t key_block_length;
1429 1430 1431 1432
        unsigned char *key_block;
        const EVP_CIPHER *new_sym_enc;
        const EVP_MD *new_hash;
        int new_mac_pkey_type;
1433
        size_t new_mac_secret_size;
E
Emilia Kasper 已提交
1434
# ifndef OPENSSL_NO_COMP
1435
        const SSL_COMP *new_compression;
E
Emilia Kasper 已提交
1436
# else
1437
        char *new_compression;
E
Emilia Kasper 已提交
1438
# endif
1439
        int cert_request;
D
Dr. Stephen Henson 已提交
1440 1441 1442 1443 1444 1445
        /* Raw values of the cipher list from a client */
        unsigned char *ciphers_raw;
        size_t ciphers_rawlen;
        /* Temporary storage for premaster secret */
        unsigned char *pms;
        size_t pmslen;
E
Emilia Kasper 已提交
1446
# ifndef OPENSSL_NO_PSK
1447 1448 1449
        /* Temporary storage for PSK key */
        unsigned char *psk;
        size_t psklen;
E
Emilia Kasper 已提交
1450
# endif
1451 1452
        /* Signature algorithm we actually use */
        const SIGALG_LOOKUP *sigalg;
1453 1454
        /* Pointer to certificate we use */
        CERT_PKEY *cert;
D
Dr. Stephen Henson 已提交
1455 1456 1457 1458 1459
        /*
         * signature algorithms peer reports: e.g. supported signature
         * algorithms extension for server or as part of a certificate
         * request for client.
         */
1460
        uint16_t *peer_sigalgs;
D
Dr. Stephen Henson 已提交
1461 1462
        /* Size of above array */
        size_t peer_sigalgslen;
1463 1464
        /* Sigalg peer actualy uses */
        const SIGALG_LOOKUP *peer_sigalg;
1465 1466 1467 1468 1469
        /*
         * Set if corresponding CERT_PKEY can be used with current
         * SSL session: e.g. appropriate curve, signature algorithms etc.
         * If zero it can't be used at all.
         */
1470
        uint32_t valid_flags[SSL_PKEY_NUM];
1471 1472 1473 1474 1475
        /*
         * For servers the following masks are for the key and auth algorithms
         * that are supported by the certs below. For clients they are masks of
         * *disabled* algorithms based on the current session.
         */
1476 1477
        uint32_t mask_k;
        uint32_t mask_a;
1478 1479 1480 1481 1482 1483 1484
        /*
         * The following are used by the client to see if a cipher is allowed or
         * not.  It contains the minimum and maximum version the client's using
         * based on what it knows so far.
         */
        int min_ver;
        int max_ver;
1485 1486 1487 1488
    } tmp;

    /* Connection binding to prevent renegotiation attacks */
    unsigned char previous_client_finished[EVP_MAX_MD_SIZE];
1489
    size_t previous_client_finished_len;
1490
    unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
1491
    size_t previous_server_finished_len;
1492 1493
    int send_connection_binding; /* TODOEKR */

E
Emilia Kasper 已提交
1494
# ifndef OPENSSL_NO_NEXTPROTONEG
1495 1496 1497
    /*
     * Set if we saw the Next Protocol Negotiation extension from our peer.
     */
R
Rich Salz 已提交
1498
    int npn_seen;
E
Emilia Kasper 已提交
1499
# endif
1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511

    /*
     * ALPN information (we are in the process of transitioning from NPN to
     * ALPN.)
     */

    /*
     * In a server these point to the selected ALPN protocol after the
     * ClientHello has been processed. In a client these contain the protocol
     * that the server selected once the ServerHello has been processed.
     */
    unsigned char *alpn_selected;
T
Todd Short 已提交
1512 1513 1514 1515 1516 1517
    size_t alpn_selected_len;
    /* used by the server to know what options were proposed */
    unsigned char *alpn_proposed;
    size_t alpn_proposed_len;
    /* used by the client to know if it actually sent alpn */
    int alpn_sent;
1518

E
Emilia Kasper 已提交
1519
# ifndef OPENSSL_NO_EC
1520 1521 1522 1523 1524 1525
    /*
     * This is set to true if we believe that this is a version of Safari
     * running on OS X 10.6 or newer. We wish to know this because Safari on
     * 10.8 .. 10.8.3 has broken ECDHE-ECDSA support.
     */
    char is_probably_safari;
E
Emilia Kasper 已提交
1526
# endif                         /* !OPENSSL_NO_EC */
1527 1528

    /* For clients: peer temporary key */
D
Dr. Stephen Henson 已提交
1529
# if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
1530 1531
    /* The group_id for the DH/ECDH key */
    unsigned int group_id;
1532
    EVP_PKEY *peer_tmp;
1533 1534
# endif

1535 1536 1537 1538
} SSL3_STATE;

/* DTLS structures */

E
Emilia Kasper 已提交
1539 1540 1541
# ifndef OPENSSL_NO_SCTP
#  define DTLS1_SCTP_AUTH_LABEL   "EXPORTER_DTLS_OVER_SCTP"
# endif
1542 1543

/* Max MTU overhead we know about so far is 40 for IPv6 + 8 for UDP */
E
Emilia Kasper 已提交
1544
# define DTLS1_MAX_MTU_OVERHEAD                   48
1545

M
Matt Caswell 已提交
1546 1547 1548 1549
/*
 * Flag used in message reuse to indicate the buffer contains the record
 * header as well as the the handshake message header.
 */
E
Emilia Kasper 已提交
1550
# define DTLS1_SKIP_RECORD_HEADER                 2
M
Matt Caswell 已提交
1551

1552 1553 1554 1555 1556 1557 1558 1559 1560 1561
struct dtls1_retransmit_state {
    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
    EVP_MD_CTX *write_hash;     /* used for mac generation */
    COMP_CTX *compress;         /* compression */
    SSL_SESSION *session;
    unsigned short epoch;
};

struct hm_header_st {
    unsigned char type;
M
Matt Caswell 已提交
1562
    size_t msg_len;
1563
    unsigned short seq;
M
Matt Caswell 已提交
1564 1565
    size_t frag_off;
    size_t frag_len;
1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584
    unsigned int is_ccs;
    struct dtls1_retransmit_state saved_retransmit_state;
};

struct dtls1_timeout_st {
    /* Number of read timeouts so far */
    unsigned int read_timeouts;
    /* Number of write timeouts so far */
    unsigned int write_timeouts;
    /* Number of alerts received so far */
    unsigned int num_alerts;
};

typedef struct hm_fragment_st {
    struct hm_header_st msg_header;
    unsigned char *fragment;
    unsigned char *reassembly;
} hm_fragment;

R
Rich Salz 已提交
1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597
typedef struct pqueue_st pqueue;
typedef struct pitem_st pitem;

struct pitem_st {
    unsigned char priority[8];  /* 64-bit value in big-endian encoding */
    void *data;
    pitem *next;
};

typedef struct pitem_st *piterator;

pitem *pitem_new(unsigned char *prio64be, void *data);
void pitem_free(pitem *item);
E
Emilia Kasper 已提交
1598
pqueue *pqueue_new(void);
R
Rich Salz 已提交
1599 1600 1601 1602 1603 1604 1605
void pqueue_free(pqueue *pq);
pitem *pqueue_insert(pqueue *pq, pitem *item);
pitem *pqueue_peek(pqueue *pq);
pitem *pqueue_pop(pqueue *pq);
pitem *pqueue_find(pqueue *pq, unsigned char *prio64be);
pitem *pqueue_iterator(pqueue *pq);
pitem *pqueue_next(piterator *iter);
M
Matt Caswell 已提交
1606
size_t pqueue_size(pqueue *pq);
R
Rich Salz 已提交
1607

1608 1609
typedef struct dtls1_state_st {
    unsigned char cookie[DTLS1_COOKIE_LENGTH];
M
Matt Caswell 已提交
1610
    size_t cookie_len;
M
Matt Caswell 已提交
1611
    unsigned int cookie_verified;
1612 1613 1614 1615 1616
    /* handshake message numbers */
    unsigned short handshake_write_seq;
    unsigned short next_handshake_write_seq;
    unsigned short handshake_read_seq;
    /* Buffered handshake messages */
R
Rich Salz 已提交
1617
    pqueue *buffered_messages;
1618
    /* Buffered (sent) handshake records */
R
Rich Salz 已提交
1619
    pqueue *sent_messages;
M
Matt Caswell 已提交
1620 1621
    size_t link_mtu;      /* max on-the-wire DTLS packet size */
    size_t mtu;           /* max DTLS packet size */
1622 1623 1624 1625
    struct hm_header_st w_msg_hdr;
    struct hm_header_st r_msg_hdr;
    struct dtls1_timeout_st timeout;
    /*
R
Richard Levitte 已提交
1626
     * Indicates when the last handshake msg sent will timeout
1627 1628 1629
     */
    struct timeval next_timeout;
    /* Timeout duration */
1630 1631
    unsigned int timeout_duration_us;

1632
    unsigned int retransmitting;
E
Emilia Kasper 已提交
1633
# ifndef OPENSSL_NO_SCTP
1634
    int shutdown_received;
E
Emilia Kasper 已提交
1635
# endif
1636 1637 1638

    DTLS_timer_cb timer_cb;

1639 1640
} DTLS1_STATE;

1641 1642 1643
# ifndef OPENSSL_NO_EC
/*
 * From ECC-TLS draft, used in encoding the curve type in ECParameters
B
Bodo Möller 已提交
1644
 */
1645 1646 1647 1648 1649
#  define EXPLICIT_PRIME_CURVE_TYPE  1
#  define EXPLICIT_CHAR2_CURVE_TYPE  2
#  define NAMED_CURVE_TYPE           3
# endif                         /* OPENSSL_NO_EC */

1650
struct cert_pkey_st {
1651 1652 1653 1654
    X509 *x509;
    EVP_PKEY *privatekey;
    /* Chain for this certificate */
    STACK_OF(X509) *chain;
1655 1656 1657 1658 1659 1660 1661
    /*-
     * serverinfo data for this certificate.  The data is in TLS Extension
     * wire format, specifically it's a series of records like:
     *   uint16_t extension_type; // (RFC 5246, 7.4.1.4, Extension)
     *   uint16_t length;
     *   uint8_t data[length];
     */
1662 1663
    unsigned char *serverinfo;
    size_t serverinfo_length;
1664
};
1665
/* Retrieve Suite B flags */
1666
# define tls1_suiteb(s)  (s->cert->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS)
1667
/* Uses to check strict mode: suite B modes are always strict */
1668 1669
# define SSL_CERT_FLAGS_CHECK_TLS_STRICT \
        (SSL_CERT_FLAG_SUITEB_128_LOS|SSL_CERT_FLAG_TLS_STRICT)
1670

1671 1672 1673 1674 1675 1676 1677
typedef enum {
    ENDPOINT_CLIENT = 0,
    ENDPOINT_SERVER,
    ENDPOINT_BOTH
} ENDPOINT;


1678
typedef struct {
1679
    unsigned short ext_type;
1680
    ENDPOINT role;
1681 1682
    /* The context which this extension applies to */
    unsigned int context;
1683 1684 1685 1686
    /*
     * Per-connection flags relating to this extension type: not used if
     * part of an SSL_CTX structure.
     */
1687
    uint32_t ext_flags;
1688 1689
    SSL_custom_ext_add_cb_ex add_cb;
    SSL_custom_ext_free_cb_ex free_cb;
1690
    void *add_arg;
1691
    SSL_custom_ext_parse_cb_ex parse_cb;
1692
    void *parse_arg;
D
Dr. Stephen Henson 已提交
1693
} custom_ext_method;
1694

1695 1696
/* ext_flags values */

1697 1698 1699
/*
 * Indicates an extension has been received. Used to check for unsolicited or
 * duplicate extensions.
1700
 */
1701 1702 1703 1704
# define SSL_EXT_FLAG_RECEIVED   0x1
/*
 * Indicates an extension has been sent: used to enable sending of
 * corresponding ServerHello extension.
1705
 */
1706
# define SSL_EXT_FLAG_SENT       0x2
1707

1708
typedef struct {
1709 1710
    custom_ext_method *meths;
    size_t meths_count;
D
Dr. Stephen Henson 已提交
1711
} custom_ext_methods;
1712

1713 1714 1715 1716 1717 1718 1719 1720 1721
typedef struct cert_st {
    /* Current active set */
    /*
     * ALWAYS points to an element of the pkeys array
     * Probably it would make more sense to store
     * an index, not a pointer.
     */
    CERT_PKEY *key;
# ifndef OPENSSL_NO_DH
1722
    EVP_PKEY *dh_tmp;
1723 1724 1725 1726
    DH *(*dh_tmp_cb) (SSL *ssl, int is_export, int keysize);
    int dh_tmp_auto;
# endif
    /* Flags related to certificates */
1727
    uint32_t cert_flags;
1728
    CERT_PKEY pkeys[SSL_PKEY_NUM];
1729 1730 1731
    /* Custom certificate types sent in certificate request message. */
    uint8_t *ctype;
    size_t ctype_len;
1732
    /*
1733
     * supported signature algorithms. When set on a client this is sent in
1734 1735 1736
     * the client hello as the supported signature algorithms extension. For
     * servers it represents the signature algorithms we are willing to use.
     */
1737
    uint16_t *conf_sigalgs;
1738 1739 1740 1741 1742
    /* Size of above array */
    size_t conf_sigalgslen;
    /*
     * Client authentication signature algorithms, if not set then uses
     * conf_sigalgs. On servers these will be the signature algorithms sent
F
FdaSilvaYY 已提交
1743 1744
     * to the client in a certificate request for TLS 1.2. On a client this
     * represents the signature algorithms we are willing to use for client
1745 1746
     * authentication.
     */
1747
    uint16_t *client_sigalgs;
1748 1749 1750 1751 1752 1753
    /* Size of above array */
    size_t client_sigalgslen;
    /*
     * Signature algorithms shared by client and server: cached because these
     * are used most often.
     */
1754
    const SIGALG_LOOKUP **shared_sigalgs;
1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770
    size_t shared_sigalgslen;
    /*
     * Certificate setup callback: if set is called whenever a certificate
     * may be required (client or server). the callback can then examine any
     * appropriate parameters and setup any certificates required. This
     * allows advanced applications to select certificates on the fly: for
     * example based on supported signature algorithms or curves.
     */
    int (*cert_cb) (SSL *ssl, void *arg);
    void *cert_cb_arg;
    /*
     * Optional X509_STORE for chain building or certificate validation If
     * NULL the parent SSL_CTX store is used instead.
     */
    X509_STORE *chain_store;
    X509_STORE *verify_store;
1771 1772
    /* Custom extensions */
    custom_ext_methods custext;
1773
    /* Security callback */
K
Kurt Roeckx 已提交
1774
    int (*sec_cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid,
1775 1776 1777 1778
                   void *other, void *ex);
    /* Security level */
    int sec_level;
    void *sec_ex;
E
Emilia Kasper 已提交
1779
# ifndef OPENSSL_NO_PSK
1780 1781
    /* If not NULL psk identity hint to use for servers */
    char *psk_identity_hint;
E
Emilia Kasper 已提交
1782
# endif
1783
    CRYPTO_REF_COUNT references;             /* >1 only if SSL_copy_session_id is used */
1784
    CRYPTO_RWLOCK *lock;
1785 1786 1787 1788 1789 1790 1791 1792 1793
} CERT;

# define FP_ICC  (int (*)(const void *,const void *))

/*
 * This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff It is a bit
 * of a mess of functions, but hell, think of it as an opaque structure :-)
 */
typedef struct ssl3_enc_method {
1794
    int (*enc) (SSL *, SSL3_RECORD *, size_t, int);
1795
    int (*mac) (SSL *, SSL3_RECORD *, unsigned char *, int);
1796 1797
    int (*setup_key_block) (SSL *);
    int (*generate_master_secret) (SSL *, unsigned char *, unsigned char *,
1798
                                   size_t, size_t *);
1799
    int (*change_cipher_state) (SSL *, int);
1800
    size_t (*final_finish_mac) (SSL *, const char *, size_t, unsigned char *);
1801
    const char *client_finished_label;
M
Matt Caswell 已提交
1802
    size_t client_finished_label_len;
1803
    const char *server_finished_label;
M
Matt Caswell 已提交
1804
    size_t server_finished_label_len;
1805 1806 1807 1808 1809 1810
    int (*alert_value) (int);
    int (*export_keying_material) (SSL *, unsigned char *, size_t,
                                   const char *, size_t,
                                   const unsigned char *, size_t,
                                   int use_context);
    /* Various flags indicating protocol version requirements */
1811
    uint32_t enc_flags;
1812
    /* Set the handshake header */
M
Matt Caswell 已提交
1813
    int (*set_handshake_header) (SSL *s, WPACKET *pkt, int type);
1814
    /* Close construction of the handshake message */
1815
    int (*close_construct_packet) (SSL *s, WPACKET *pkt, int htype);
1816 1817 1818 1819
    /* Write out handshake message */
    int (*do_write) (SSL *s);
} SSL3_ENC_METHOD;

M
Matt Caswell 已提交
1820 1821
# define ssl_set_handshake_header(s, pkt, htype) \
        s->method->ssl3_enc->set_handshake_header((s), (pkt), (htype))
1822 1823
# define ssl_close_construct_packet(s, pkt, htype) \
        s->method->ssl3_enc->close_construct_packet((s), (pkt), (htype))
1824
# define ssl_do_write(s)  s->method->ssl3_enc->do_write(s)
D
Dr. Stephen Henson 已提交
1825 1826 1827 1828

/* Values for enc_flags */

/* Uses explicit IV for CBC mode */
1829
# define SSL_ENC_FLAG_EXPLICIT_IV        0x1
D
Dr. Stephen Henson 已提交
1830
/* Uses signature algorithms extension */
1831
# define SSL_ENC_FLAG_SIGALGS            0x2
1832
/* Uses SHA256 default PRF */
1833
# define SSL_ENC_FLAG_SHA256_PRF         0x4
D
Dr. Stephen Henson 已提交
1834
/* Is DTLS */
1835 1836 1837 1838
# define SSL_ENC_FLAG_DTLS               0x8
/*
 * Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2: may
 * apply to others in future.
1839
 */
1840
# define SSL_ENC_FLAG_TLS1_2_CIPHERS     0x10
D
Dr. Stephen Henson 已提交
1841

1842
# ifndef OPENSSL_NO_COMP
1843
/* Used for holding the relevant compression methods loaded into SSL_CTX */
1844 1845 1846 1847 1848 1849 1850
typedef struct ssl3_comp_st {
    int comp_id;                /* The identifier byte for this compression
                                 * type */
    char *name;                 /* Text name used for the compression type */
    COMP_METHOD *method;        /* The method :-) */
} SSL3_COMP;
# endif
1851

1852 1853 1854 1855 1856 1857
typedef enum downgrade_en {
    DOWNGRADE_NONE,
    DOWNGRADE_TO_1_2,
    DOWNGRADE_TO_1_1
} DOWNGRADE;

1858 1859 1860 1861 1862 1863
/*
 * Dummy status type for the status_type extension. Indicates no status type
 * set
 */
#define TLSEXT_STATUSTYPE_nothing  -1

1864 1865 1866 1867
/* Sigalgs values */
#define TLSEXT_SIGALG_ecdsa_secp256r1_sha256                    0x0403
#define TLSEXT_SIGALG_ecdsa_secp384r1_sha384                    0x0503
#define TLSEXT_SIGALG_ecdsa_secp521r1_sha512                    0x0603
1868
#define TLSEXT_SIGALG_ecdsa_sha224                              0x0303
1869 1870 1871 1872 1873 1874 1875
#define TLSEXT_SIGALG_ecdsa_sha1                                0x0203
#define TLSEXT_SIGALG_rsa_pss_sha256                            0x0804
#define TLSEXT_SIGALG_rsa_pss_sha384                            0x0805
#define TLSEXT_SIGALG_rsa_pss_sha512                            0x0806
#define TLSEXT_SIGALG_rsa_pkcs1_sha256                          0x0401
#define TLSEXT_SIGALG_rsa_pkcs1_sha384                          0x0501
#define TLSEXT_SIGALG_rsa_pkcs1_sha512                          0x0601
1876
#define TLSEXT_SIGALG_rsa_pkcs1_sha224                          0x0301
1877 1878 1879 1880
#define TLSEXT_SIGALG_rsa_pkcs1_sha1                            0x0201
#define TLSEXT_SIGALG_dsa_sha256                                0x0402
#define TLSEXT_SIGALG_dsa_sha384                                0x0502
#define TLSEXT_SIGALG_dsa_sha512                                0x0602
1881
#define TLSEXT_SIGALG_dsa_sha224                                0x0302
1882 1883 1884 1885 1886
#define TLSEXT_SIGALG_dsa_sha1                                  0x0202
#define TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256       0xeeee
#define TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512       0xefef
#define TLSEXT_SIGALG_gostr34102001_gostr3411                   0xeded

1887 1888
#define TLSEXT_SIGALG_ed25519                                   0x0807

1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899
/* Known PSK key exchange modes */
#define TLSEXT_KEX_MODE_KE                                      0x00
#define TLSEXT_KEX_MODE_KE_DHE                                  0x01

/*
 * Internal representations of key exchange modes
 */
#define TLSEXT_KEX_MODE_FLAG_NONE                               0
#define TLSEXT_KEX_MODE_FLAG_KE                                 1
#define TLSEXT_KEX_MODE_FLAG_KE_DHE                             2

1900 1901 1902
/* An invalid index into the TLSv1.3 PSK identities */
#define TLSEXT_PSK_BAD_IDENTITY                                 -1

1903 1904
#define SSL_USE_PSS(s) (s->s3->tmp.peer_sigalg != NULL && \
                        s->s3->tmp.peer_sigalg->sig == EVP_PKEY_RSA_PSS)
1905

1906 1907 1908
/* A dummy signature value not valid for TLSv1.2 signature algs */
#define TLSEXT_signature_rsa_pss                                0x0101

1909 1910 1911
/* TLSv1.3 downgrade protection sentinel values */
extern const unsigned char tls11downgrade[8];
extern const unsigned char tls12downgrade[8];
1912

1913
extern SSL3_ENC_METHOD ssl3_undef_enc_method;
U
Ulf Möller 已提交
1914

1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927
__owur const SSL_METHOD *ssl_bad_method(int ver);
__owur const SSL_METHOD *sslv3_method(void);
__owur const SSL_METHOD *sslv3_server_method(void);
__owur const SSL_METHOD *sslv3_client_method(void);
__owur const SSL_METHOD *tlsv1_method(void);
__owur const SSL_METHOD *tlsv1_server_method(void);
__owur const SSL_METHOD *tlsv1_client_method(void);
__owur const SSL_METHOD *tlsv1_1_method(void);
__owur const SSL_METHOD *tlsv1_1_server_method(void);
__owur const SSL_METHOD *tlsv1_1_client_method(void);
__owur const SSL_METHOD *tlsv1_2_method(void);
__owur const SSL_METHOD *tlsv1_2_server_method(void);
__owur const SSL_METHOD *tlsv1_2_client_method(void);
1928 1929 1930
__owur const SSL_METHOD *tlsv1_3_method(void);
__owur const SSL_METHOD *tlsv1_3_server_method(void);
__owur const SSL_METHOD *tlsv1_3_client_method(void);
1931 1932 1933
__owur const SSL_METHOD *dtlsv1_method(void);
__owur const SSL_METHOD *dtlsv1_server_method(void);
__owur const SSL_METHOD *dtlsv1_client_method(void);
1934
__owur const SSL_METHOD *dtls_bad_ver_client_method(void);
1935 1936 1937
__owur const SSL_METHOD *dtlsv1_2_method(void);
__owur const SSL_METHOD *dtlsv1_2_server_method(void);
__owur const SSL_METHOD *dtlsv1_2_client_method(void);
1938

B
Ben Laurie 已提交
1939 1940 1941
extern const SSL3_ENC_METHOD TLSv1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_2_enc_data;
1942
extern const SSL3_ENC_METHOD TLSv1_3_enc_data;
1943 1944 1945
extern const SSL3_ENC_METHOD SSLv3_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_2_enc_data;
1946

1947 1948 1949
/*
 * Flags for SSL methods
 */
E
Emilia Kasper 已提交
1950 1951
# define SSL_METHOD_NO_FIPS      (1U<<0)
# define SSL_METHOD_NO_SUITEB    (1U<<1)
1952 1953

# define IMPLEMENT_tls_meth_func(version, flags, mask, func_name, s_accept, \
1954
                                 s_connect, enc_data) \
1955
const SSL_METHOD *func_name(void)  \
1956 1957 1958
        { \
        static const SSL_METHOD func_name##_data= { \
                version, \
1959 1960
                flags, \
                mask, \
1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990
                tls1_new, \
                tls1_clear, \
                tls1_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                ssl3_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                ssl3_read_bytes, \
                ssl3_write_bytes, \
                ssl3_dispatch_alert, \
                ssl3_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
                ssl3_get_cipher, \
                tls1_default_timeout, \
                &enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

1991
# define IMPLEMENT_ssl3_meth_func(func_name, s_accept, s_connect) \
1992
const SSL_METHOD *func_name(void)  \
1993 1994 1995
        { \
        static const SSL_METHOD func_name##_data= { \
                SSL3_VERSION, \
1996 1997
                SSL_METHOD_NO_FIPS | SSL_METHOD_NO_SUITEB, \
                SSL_OP_NO_SSLv3, \
1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027
                ssl3_new, \
                ssl3_clear, \
                ssl3_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                ssl3_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                ssl3_read_bytes, \
                ssl3_write_bytes, \
                ssl3_dispatch_alert, \
                ssl3_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
                ssl3_get_cipher, \
                ssl3_default_timeout, \
                &SSLv3_enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

2028
# define IMPLEMENT_dtls1_meth_func(version, flags, mask, func_name, s_accept, \
2029
                                        s_connect, enc_data) \
2030
const SSL_METHOD *func_name(void)  \
2031 2032 2033
        { \
        static const SSL_METHOD func_name##_data= { \
                version, \
2034 2035
                flags, \
                mask, \
2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055
                dtls1_new, \
                dtls1_clear, \
                dtls1_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                dtls1_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                dtls1_read_bytes, \
                dtls1_write_app_data_bytes, \
                dtls1_dispatch_alert, \
                dtls1_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
2056
                ssl3_get_cipher, \
2057 2058 2059 2060 2061 2062 2063 2064 2065 2066
                dtls1_default_timeout, \
                &enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

struct openssl_ssl_test_functions {
M
Matt Caswell 已提交
2067
    int (*p_ssl_init_wbio_buffer) (SSL *s);
2068 2069 2070
    int (*p_ssl3_setup_buffers) (SSL *s);
};

2071
const char *ssl_protocol_to_string(int version);
2072

D
Dr. Stephen Henson 已提交
2073 2074 2075 2076 2077 2078 2079 2080 2081
/* Returns true if certificate and private key for 'idx' are present */
static ossl_inline int ssl_has_cert(const SSL *s, int idx)
{
    if (idx < 0 || idx >= SSL_PKEY_NUM)
        return 0;
    return s->cert->pkeys[idx].x509 != NULL
        && s->cert->pkeys[idx].privatekey != NULL;
}

2082
# ifndef OPENSSL_UNIT_TEST
2083

2084 2085
__owur int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes);
__owur int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written);
2086 2087
void ssl_clear_cipher_ctx(SSL *s);
int ssl_clear_bad_session(SSL *s);
M
Matt Caswell 已提交
2088 2089
__owur CERT *ssl_cert_new(void);
__owur CERT *ssl_cert_dup(CERT *cert);
2090
void ssl_cert_clear_certs(CERT *c);
2091
void ssl_cert_free(CERT *c);
M
Matt Caswell 已提交
2092
__owur int ssl_get_new_session(SSL *s, int session);
2093
__owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello, int *al);
2094
__owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
M
Matt Caswell 已提交
2095
__owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
2096
DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
M
Matt Caswell 已提交
2097
__owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
E
Emilia Kasper 已提交
2098
                                 const SSL_CIPHER *const *bp);
M
Matt Caswell 已提交
2099
__owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
E
Emilia Kasper 已提交
2100 2101 2102 2103 2104
                                                    STACK_OF(SSL_CIPHER) **pref,
                                                    STACK_OF(SSL_CIPHER)
                                                    **sorted,
                                                    const char *rule_str,
                                                    CERT *c);
2105 2106 2107 2108 2109 2110
__owur int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites,
                                int sslv2format, int *al);
__owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
                                STACK_OF(SSL_CIPHER) **skp,
                                STACK_OF(SSL_CIPHER) **scsvs, int sslv2format,
                                int *al);
2111
void ssl_update_cache(SSL *s, int mode);
M
Matt Caswell 已提交
2112
__owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
E
Emilia Kasper 已提交
2113
                              const EVP_MD **md, int *mac_pkey_type,
2114
                              size_t *mac_secret_size, SSL_COMP **comp,
E
Emilia Kasper 已提交
2115
                              int use_etm);
D
David Woodhouse 已提交
2116 2117 2118
__owur int ssl_cipher_get_overhead(const SSL_CIPHER *c, size_t *mac_overhead,
                                   size_t *int_overhead, size_t *blocksize,
                                   size_t *ext_overhead);
2119
__owur int ssl_cert_is_disabled(size_t idx);
E
Emilia Kasper 已提交
2120
__owur const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl,
2121 2122
                                                const unsigned char *ptr,
                                                int all);
M
Matt Caswell 已提交
2123 2124 2125 2126 2127 2128
__owur int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_set1_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_add0_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
__owur int ssl_cert_add1_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
__owur int ssl_cert_select_current(CERT *c, X509 *x);
__owur int ssl_cert_set_current(CERT *c, long arg);
E
Emilia Kasper 已提交
2129
void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg);
2130

M
Matt Caswell 已提交
2131 2132
__owur int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk);
__owur int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags);
E
Emilia Kasper 已提交
2133 2134
__owur int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain,
                                   int ref);
D
Dr. Stephen Henson 已提交
2135

R
Rich Salz 已提交
2136
__owur int ssl_randbytes(SSL *s, unsigned char *buf, size_t num);
K
Kurt Roeckx 已提交
2137
__owur int ssl_security(const SSL *s, int op, int bits, int nid, void *other);
E
Emilia Kasper 已提交
2138 2139
__owur int ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid,
                            void *other);
D
Dr. Stephen Henson 已提交
2140

2141 2142 2143 2144
__owur const SSL_CERT_LOOKUP *ssl_cert_lookup_by_pkey(const EVP_PKEY *pk,
                                                      size_t *pidx);
__owur const SSL_CERT_LOOKUP *ssl_cert_lookup_by_idx(size_t idx);

2145
int ssl_undefined_function(SSL *s);
M
Matt Caswell 已提交
2146 2147
__owur int ssl_undefined_void_function(void);
__owur int ssl_undefined_const_function(const SSL *s);
E
Emilia Kasper 已提交
2148 2149 2150
__owur int ssl_get_server_cert_serverinfo(SSL *s,
                                          const unsigned char **serverinfo,
                                          size_t *serverinfo_length);
2151
void ssl_set_masks(SSL *s);
M
Matt Caswell 已提交
2152 2153
__owur STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
__owur int ssl_verify_alarm_type(long type);
R
Rich Salz 已提交
2154
void ssl_sort_cipher_list(void);
2155
int ssl_load_ciphers(void);
E
Emilia Kasper 已提交
2156
__owur int ssl_fill_hello_random(SSL *s, int server, unsigned char *field,
2157
                                 size_t len, DOWNGRADE dgrd);
2158 2159
__owur int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
                                      int free_pms);
D
Dr. Stephen Henson 已提交
2160
__owur EVP_PKEY *ssl_generate_pkey(EVP_PKEY *pm);
2161 2162
__owur int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey,
                      int genmaster);
D
Dr. Stephen Henson 已提交
2163
__owur EVP_PKEY *ssl_dh_to_pkey(DH *dh);
2164

2165
__owur const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id);
2166
__owur const SSL_CIPHER *ssl3_get_cipher_by_std_name(const char *stdname);
M
Matt Caswell 已提交
2167
__owur const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
M
Matt Caswell 已提交
2168
__owur int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt,
2169
                                   size_t *len);
2170
int ssl3_init_finished_mac(SSL *s);
M
Matt Caswell 已提交
2171 2172
__owur int ssl3_setup_key_block(SSL *s);
__owur int ssl3_change_cipher_state(SSL *s, int which);
2173
void ssl3_cleanup_key_block(SSL *s);
M
Matt Caswell 已提交
2174
__owur int ssl3_do_write(SSL *s, int type);
2175
int ssl3_send_alert(SSL *s, int level, int desc);
M
Matt Caswell 已提交
2176
__owur int ssl3_generate_master_secret(SSL *s, unsigned char *out,
2177 2178
                                       unsigned char *p, size_t len,
                                       size_t *secret_size);
2179
__owur int ssl3_get_req_cert_type(SSL *s, WPACKET *pkt);
M
Matt Caswell 已提交
2180 2181
__owur int ssl3_num_ciphers(void);
__owur const SSL_CIPHER *ssl3_get_cipher(unsigned int u);
2182
int ssl3_renegotiate(SSL *ssl);
2183
int ssl3_renegotiate_check(SSL *ssl, int initok);
M
Matt Caswell 已提交
2184
__owur int ssl3_dispatch_alert(SSL *s);
2185
__owur size_t ssl3_final_finish_mac(SSL *s, const char *sender, size_t slen,
2186
                                    unsigned char *p);
M
Matt Caswell 已提交
2187
__owur int ssl3_finish_mac(SSL *s, const unsigned char *buf, size_t len);
2188
void ssl3_free_digest_list(SSL *s);
2189
__owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt,
2190
                                            CERT_PKEY *cpk, int *al);
2191 2192 2193
__owur const SSL_CIPHER *ssl3_choose_cipher(SSL *ssl,
                                            STACK_OF(SSL_CIPHER) *clnt,
                                            STACK_OF(SSL_CIPHER) *srvr);
2194
__owur int ssl3_digest_cached_records(SSL *s, int keep);
M
Matt Caswell 已提交
2195
__owur int ssl3_new(SSL *s);
2196
void ssl3_free(SSL *s);
2197 2198
__owur int ssl3_read(SSL *s, void *buf, size_t len, size_t *readbytes);
__owur int ssl3_peek(SSL *s, void *buf, size_t len, size_t *readbytes);
M
Matt Caswell 已提交
2199
__owur int ssl3_write(SSL *s, const void *buf, size_t len, size_t *written);
M
Matt Caswell 已提交
2200
__owur int ssl3_shutdown(SSL *s);
2201
int ssl3_clear(SSL *s);
M
Matt Caswell 已提交
2202 2203 2204 2205
__owur long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg);
__owur long ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg);
__owur long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void));
__owur long ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp) (void));
2206

M
Matt Caswell 已提交
2207 2208
__owur int ssl3_do_change_cipher_spec(SSL *ssl);
__owur long ssl3_default_timeout(void);
2209

M
Matt Caswell 已提交
2210
__owur int ssl3_set_handshake_header(SSL *s, WPACKET *pkt, int htype);
2211
__owur int tls_close_construct_packet(SSL *s, WPACKET *pkt, int htype);
2212
__owur int tls_setup_handshake(SSL *s);
M
Matt Caswell 已提交
2213
__owur int dtls1_set_handshake_header(SSL *s, WPACKET *pkt, int htype);
2214
__owur int dtls1_close_construct_packet(SSL *s, WPACKET *pkt, int htype);
M
Matt Caswell 已提交
2215 2216 2217 2218
__owur int ssl3_handshake_write(SSL *s);

__owur int ssl_allow_compression(SSL *s);

2219 2220
__owur int ssl_version_supported(const SSL *s, int version);

2221 2222 2223
__owur int ssl_set_client_hello_version(SSL *s);
__owur int ssl_check_version_downgrade(SSL *s);
__owur int ssl_set_version_bound(int method_version, int version, int *bound);
2224 2225
__owur int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello,
                                     DOWNGRADE *dgrd);
2226 2227
__owur int ssl_choose_client_version(SSL *s, int version, int checkdgrd,
                                     int *al);
2228
int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version);
2229

M
Matt Caswell 已提交
2230 2231 2232
__owur long tls1_default_timeout(void);
__owur int dtls1_do_write(SSL *s, int type);
void dtls1_set_message_header(SSL *s,
2233
                              unsigned char mt,
2234 2235
                              size_t len,
                              size_t frag_off, size_t frag_len);
M
Matt Caswell 已提交
2236

M
Matt Caswell 已提交
2237 2238
int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf_, size_t len,
                               size_t *written);
M
Matt Caswell 已提交
2239 2240 2241

__owur int dtls1_read_failed(SSL *s, int code);
__owur int dtls1_buffer_message(SSL *s, int ccs);
2242
__owur int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found);
M
Matt Caswell 已提交
2243
__owur int dtls1_get_queue_priority(unsigned short seq, int is_ccs);
M
Matt Caswell 已提交
2244
int dtls1_retransmit_buffered_messages(SSL *s);
2245 2246
void dtls1_clear_received_buffer(SSL *s);
void dtls1_clear_sent_buffer(SSL *s);
2247 2248
void dtls1_get_message_header(unsigned char *data,
                              struct hm_header_st *msg_hdr);
M
Matt Caswell 已提交
2249 2250 2251 2252
__owur long dtls1_default_timeout(void);
__owur struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft);
__owur int dtls1_check_timeout_num(SSL *s);
__owur int dtls1_handle_timeout(SSL *s);
2253 2254
void dtls1_start_timer(SSL *s);
void dtls1_stop_timer(SSL *s);
M
Matt Caswell 已提交
2255
__owur int dtls1_is_timer_expired(SSL *s);
2256
void dtls1_double_timeout(SSL *s);
2257
__owur int dtls_raw_hello_verify_request(WPACKET *pkt, unsigned char *cookie,
M
Matt Caswell 已提交
2258
                                         size_t cookie_len);
M
Matt Caswell 已提交
2259
__owur size_t dtls1_min_mtu(SSL *s);
2260
void dtls1_hm_fragment_free(hm_fragment *frag);
M
Matt Caswell 已提交
2261
__owur int dtls1_query_mtu(SSL *s);
2262

M
Matt Caswell 已提交
2263
__owur int tls1_new(SSL *s);
2264
void tls1_free(SSL *s);
2265
int tls1_clear(SSL *s);
2266

M
Matt Caswell 已提交
2267
__owur int dtls1_new(SSL *s);
B
Ben Laurie 已提交
2268
void dtls1_free(SSL *s);
2269
int dtls1_clear(SSL *s);
2270
long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg);
M
Matt Caswell 已提交
2271
__owur int dtls1_shutdown(SSL *s);
B
Ben Laurie 已提交
2272

M
Matt Caswell 已提交
2273
__owur int dtls1_dispatch_alert(SSL *s);
B
Ben Laurie 已提交
2274

M
Matt Caswell 已提交
2275
__owur int ssl_init_wbio_buffer(SSL *s);
2276
int ssl_free_wbio_buffer(SSL *s);
2277

M
Matt Caswell 已提交
2278 2279
__owur int tls1_change_cipher_state(SSL *s, int which);
__owur int tls1_setup_key_block(SSL *s);
2280
__owur size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen,
2281
                                    unsigned char *p);
M
Matt Caswell 已提交
2282
__owur int tls1_generate_master_secret(SSL *s, unsigned char *out,
2283 2284
                                       unsigned char *p, size_t len,
                                       size_t *secret_size);
2285 2286 2287
__owur int tls13_setup_key_block(SSL *s);
__owur size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
                                     unsigned char *p);
2288
__owur int tls13_change_cipher_state(SSL *s, int which);
2289
__owur int tls13_update_key(SSL *s, int send);
2290 2291
__owur int tls13_hkdf_expand(SSL *s, const EVP_MD *md,
                             const unsigned char *secret,
2292
                             const unsigned char *label, size_t labellen,
2293
                             const unsigned char *data, size_t datalen,
2294
                             unsigned char *out, size_t outlen);
2295 2296 2297 2298 2299 2300
__owur int tls13_derive_key(SSL *s, const EVP_MD *md,
                            const unsigned char *secret, unsigned char *key,
                            size_t keylen);
__owur int tls13_derive_iv(SSL *s, const EVP_MD *md,
                           const unsigned char *secret, unsigned char *iv,
                           size_t ivlen);
2301 2302 2303 2304 2305 2306 2307 2308
__owur int tls13_derive_finishedkey(SSL *s, const EVP_MD *md,
                                    const unsigned char *secret,
                                    unsigned char *fin, size_t finlen);
int tls13_generate_secret(SSL *s, const EVP_MD *md,
                          const unsigned char *prevsecret,
                          const unsigned char *insecret,
                          size_t insecretlen,
                          unsigned char *outsecret);
2309 2310 2311 2312 2313 2314
__owur int tls13_generate_handshake_secret(SSL *s,
                                           const unsigned char *insecret,
                                           size_t insecretlen);
__owur int tls13_generate_master_secret(SSL *s, unsigned char *out,
                                        unsigned char *prev, size_t prevlen,
                                        size_t *secret_size);
M
Matt Caswell 已提交
2315
__owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
E
Emilia Kasper 已提交
2316 2317 2318
                                       const char *label, size_t llen,
                                       const unsigned char *p, size_t plen,
                                       int use_context);
2319 2320 2321 2322
__owur int tls13_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                                        const char *label, size_t llen,
                                        const unsigned char *context,
                                        size_t contextlen, int use_context);
M
Matt Caswell 已提交
2323
__owur int tls1_alert_code(int code);
2324
__owur int tls13_alert_code(int code);
M
Matt Caswell 已提交
2325
__owur int ssl3_alert_code(int code);
2326

2327
#  ifndef OPENSSL_NO_EC
M
Matt Caswell 已提交
2328
__owur int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s);
2329
#  endif
B
Bodo Möller 已提交
2330

B
Ben Laurie 已提交
2331
SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
2332

2333
#  ifndef OPENSSL_NO_EC
2334 2335 2336 2337 2338 2339
/* Flags values from tls1_ec_curve_id2nid() */
/* Mask for curve type */
# define TLS_CURVE_TYPE          0x3
# define TLS_CURVE_PRIME         0x0
# define TLS_CURVE_CHAR2         0x1
# define TLS_CURVE_CUSTOM        0x2
M
Matt Caswell 已提交
2340 2341 2342

#define bytestogroup(bytes) ((unsigned int)(bytes[0] << 8 | bytes[1]))

2343
__owur int tls1_ec_curve_id2nid(int curve_id, unsigned int *pflags);
M
Matt Caswell 已提交
2344 2345
__owur int tls1_ec_nid2curve_id(int nid);
__owur int tls1_check_curve(SSL *s, const unsigned char *p, size_t len);
2346 2347
__owur int tls1_shared_group(SSL *s, int nmatch);
__owur int tls1_set_groups(unsigned char **pext, size_t *pextlen,
E
Emilia Kasper 已提交
2348
                           int *curves, size_t ncurves);
2349
__owur int tls1_set_groups_list(unsigned char **pext, size_t *pextlen,
E
Emilia Kasper 已提交
2350
                                const char *str);
2351 2352
void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
                         size_t *num_formats);
M
Matt Caswell 已提交
2353
__owur int tls1_check_ec_tmp_key(SSL *s, unsigned long id);
D
Dr. Stephen Henson 已提交
2354
__owur EVP_PKEY *ssl_generate_pkey_curve(int id);
2355
#  endif                        /* OPENSSL_NO_EC */
2356

2357 2358 2359 2360
__owur int tls_curve_allowed(SSL *s, const unsigned char *curve, int op);
__owur  int tls1_get_curvelist(SSL *s, int sess, const unsigned char **pcurves,
                               size_t *num_curves);

M
Matt Caswell 已提交
2361
__owur int tls1_set_server_sigalgs(SSL *s);
2362 2363 2364

/* Return codes for tls_get_ticket_from_client() and tls_decrypt_ticket() */
typedef enum ticket_en {
2365
    /* fatal error, malloc failure */
2366
    TICKET_FATAL_ERR_MALLOC,
2367
    /* fatal error, either from parsing or decrypting the ticket */
2368
    TICKET_FATAL_ERR_OTHER,
2369
    /* No ticket present */
2370
    TICKET_NONE,
2371
    /* Empty ticket present */
2372
    TICKET_EMPTY,
2373
    /* the ticket couldn't be decrypted */
2374
    TICKET_NO_DECRYPT,
2375
    /* a ticket was successfully decrypted */
2376
    TICKET_SUCCESS,
F
FdaSilvaYY 已提交
2377
    /* same as above but the ticket needs to be renewed */
2378 2379 2380 2381 2382 2383 2384 2385 2386
    TICKET_SUCCESS_RENEW
} TICKET_RETURN;

__owur TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
                                                SSL_SESSION **ret);
__owur TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
                                        size_t eticklen,
                                        const unsigned char *sess_id,
                                        size_t sesslen, SSL_SESSION **psess);
2387

2388
__owur int tls_use_ticket(SSL *s);
2389

2390
void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op);
2391

M
Matt Caswell 已提交
2392
__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
E
Emilia Kasper 已提交
2393 2394
__owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen,
                            int client);
M
Matt Caswell 已提交
2395
int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
2396
                     int idx);
2397
void tls1_set_cert_validity(SSL *s);
2398

E
Emilia Kasper 已提交
2399
#  ifndef OPENSSL_NO_CT
2400
__owur int ssl_validate_ct(SSL *s);
E
Emilia Kasper 已提交
2401
#  endif
2402

2403
#  ifndef OPENSSL_NO_DH
M
Matt Caswell 已提交
2404
__owur DH *ssl_get_auto_dh(SSL *s);
2405
#  endif
D
Dr. Stephen Henson 已提交
2406

M
Matt Caswell 已提交
2407
__owur int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee);
E
Emilia Kasper 已提交
2408 2409
__owur int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex,
                                   int vfy);
D
Dr. Stephen Henson 已提交
2410

2411
int tls_choose_sigalg(SSL *s, int *al);
2412

M
Matt Caswell 已提交
2413
__owur EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md);
2414
void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
M
Matt Caswell 已提交
2415
__owur long ssl_get_algorithm2(SSL *s);
M
Matt Caswell 已提交
2416
__owur int tls12_copy_sigalgs(SSL *s, WPACKET *pkt,
2417
                              const uint16_t *psig, size_t psiglen);
2418
__owur int tls1_save_sigalgs(SSL *s, PACKET *pkt);
M
Matt Caswell 已提交
2419
__owur int tls1_process_sigalgs(SSL *s);
2420
__owur int tls1_set_peer_legacy_sigalg(SSL *s, const EVP_PKEY *pkey);
2421
__owur int tls1_lookup_md(const SIGALG_LOOKUP *lu, const EVP_MD **pmd);
2422
__owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs);
2423
__owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey);
2424
void ssl_set_client_disabled(SSL *s);
2425
__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op, int echde);
2426

2427 2428
__owur int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
                                 size_t *hashlen);
2429
__owur const EVP_MD *ssl_md(int idx);
2430 2431
__owur const EVP_MD *ssl_handshake_md(SSL *s);
__owur const EVP_MD *ssl_prf_md(SSL *s);
2432

2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444
/*
 * ssl_log_rsa_client_key_exchange logs |premaster| to the SSL_CTX associated
 * with |ssl|, if logging is enabled. It returns one on success and zero on
 * failure. The entry is identified by the first 8 bytes of
 * |encrypted_premaster|.
 */
__owur int ssl_log_rsa_client_key_exchange(SSL *ssl,
                                           const uint8_t *encrypted_premaster,
                                           size_t encrypted_premaster_len,
                                           const uint8_t *premaster,
                                           size_t premaster_len);

2445 2446 2447 2448
/*
 * ssl_log_secret logs |secret| to the SSL_CTX associated with |ssl|, if
 * logging is available. It returns one on success and zero on failure. It tags
 * the entry with |label|.
2449
 */
2450 2451 2452 2453
__owur int ssl_log_secret(SSL *ssl, const char *label,
                          const uint8_t *secret, size_t secret_len);

#define MASTER_SECRET_LABEL "CLIENT_RANDOM"
2454
#define CLIENT_EARLY_LABEL "CLIENT_EARLY_TRAFFIC_SECRET"
2455 2456 2457 2458
#define CLIENT_HANDSHAKE_LABEL "CLIENT_HANDSHAKE_TRAFFIC_SECRET"
#define SERVER_HANDSHAKE_LABEL "SERVER_HANDSHAKE_TRAFFIC_SECRET"
#define CLIENT_APPLICATION_LABEL "CLIENT_TRAFFIC_SECRET_0"
#define SERVER_APPLICATION_LABEL "SERVER_TRAFFIC_SECRET_0"
2459

B
Ben Laurie 已提交
2460
/* s3_cbc.c */
M
Matt Caswell 已提交
2461
__owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
2462 2463 2464 2465 2466 2467 2468 2469
__owur int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
                                  unsigned char *md_out,
                                  size_t *md_out_size,
                                  const unsigned char header[13],
                                  const unsigned char *data,
                                  size_t data_plus_mac_size,
                                  size_t data_plus_mac_plus_padding_size,
                                  const unsigned char *mac_secret,
2470
                                  size_t mac_secret_length, char is_sslv3);
2471

2472 2473
__owur int srp_generate_server_master_secret(SSL *s);
__owur int srp_generate_client_master_secret(SSL *s);
M
Matt Caswell 已提交
2474
__owur int srp_verify_server_param(SSL *s, int *al);
D
Dr. Stephen Henson 已提交
2475

2476 2477
/* statem/extensions_cust.c */

2478 2479 2480
custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
                                   ENDPOINT role, unsigned int ext_type,
                                   size_t *idx);
D
Dr. Stephen Henson 已提交
2481

2482 2483
void custom_ext_init(custom_ext_methods *meths);

2484
__owur int custom_ext_parse(SSL *s, unsigned int context, unsigned int ext_type,
E
Emilia Kasper 已提交
2485
                            const unsigned char *ext_data, size_t ext_size,
2486 2487 2488
                            X509 *x, size_t chainidx, int *al);
__owur int custom_ext_add(SSL *s, int context, WPACKET *pkt, X509 *x,
                          size_t chainidx, int maxversion, int *al);
E
Emilia Kasper 已提交
2489 2490 2491

__owur int custom_exts_copy(custom_ext_methods *dst,
                            const custom_ext_methods *src);
2492 2493
__owur int custom_exts_copy_flags(custom_ext_methods *dst,
                                  const custom_ext_methods *src);
D
Dr. Stephen Henson 已提交
2494 2495
void custom_exts_free(custom_ext_methods *exts);

2496
void ssl_comp_free_compression_methods_int(void);
2497

2498
# else /* OPENSSL_UNIT_TEST */
2499

2500 2501
#  define ssl_init_wbio_buffer SSL_test_functions()->p_ssl_init_wbio_buffer
#  define ssl3_setup_buffers SSL_test_functions()->p_ssl3_setup_buffers
2502

2503
# endif
2504
#endif