ssl_locl.h 94.8 KB
Newer Older
R
Rich Salz 已提交
1
/*
2
 * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
3
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4
 * Copyright 2005 Nokia. All rights reserved.
B
Bodo Möller 已提交
5
 *
R
Rich Salz 已提交
6 7 8 9
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
B
Bodo Möller 已提交
10
 */
R
Rich Salz 已提交
11

12
#ifndef HEADER_SSL_LOCL_H
13
# define HEADER_SSL_LOCL_H
P
Pauli 已提交
14 15

# include "e_os.h"              /* struct timeval for DTLS */
16 17 18 19
# include <stdlib.h>
# include <time.h>
# include <string.h>
# include <errno.h>
20

21
# include <openssl/buffer.h>
R
Rich Salz 已提交
22
# include <openssl/comp.h>
23 24
# include <openssl/bio.h>
# include <openssl/stack.h>
R
Rich Salz 已提交
25 26
# include <openssl/rsa.h>
# include <openssl/dsa.h>
27 28
# include <openssl/err.h>
# include <openssl/ssl.h>
M
Matt Caswell 已提交
29
# include <openssl/async.h>
30
# include <openssl/symhacks.h>
R
Rich Salz 已提交
31
# include <openssl/ct.h>
E
Emilia Kasper 已提交
32 33 34 35
# include "record/record.h"
# include "statem/statem.h"
# include "packet_locl.h"
# include "internal/dane.h"
36
# include "internal/refcount.h"
37

38 39 40 41
# ifdef OPENSSL_BUILD_SHLIBSSL
#  undef OPENSSL_EXTERN
#  define OPENSSL_EXTERN OPENSSL_EXPORT
# endif
42

43 44 45 46
# define c2l(c,l)        (l = ((unsigned long)(*((c)++)))     , \
                         l|=(((unsigned long)(*((c)++)))<< 8), \
                         l|=(((unsigned long)(*((c)++)))<<16), \
                         l|=(((unsigned long)(*((c)++)))<<24))
47 48

/* NOTE - c is not incremented as per c2l */
49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73
# define c2ln(c,l1,l2,n) { \
                        c+=n; \
                        l1=l2=0; \
                        switch (n) { \
                        case 8: l2 =((unsigned long)(*(--(c))))<<24; \
                        case 7: l2|=((unsigned long)(*(--(c))))<<16; \
                        case 6: l2|=((unsigned long)(*(--(c))))<< 8; \
                        case 5: l2|=((unsigned long)(*(--(c))));     \
                        case 4: l1 =((unsigned long)(*(--(c))))<<24; \
                        case 3: l1|=((unsigned long)(*(--(c))))<<16; \
                        case 2: l1|=((unsigned long)(*(--(c))))<< 8; \
                        case 1: l1|=((unsigned long)(*(--(c))));     \
                                } \
                        }

# define l2c(l,c)        (*((c)++)=(unsigned char)(((l)    )&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff))

# define n2l(c,l)        (l =((unsigned long)(*((c)++)))<<24, \
                         l|=((unsigned long)(*((c)++)))<<16, \
                         l|=((unsigned long)(*((c)++)))<< 8, \
                         l|=((unsigned long)(*((c)++))))

74 75 76 77 78 79 80 81 82 83
# define n2l8(c,l)       (l =((uint64_t)(*((c)++)))<<56, \
                         l|=((uint64_t)(*((c)++)))<<48, \
                         l|=((uint64_t)(*((c)++)))<<40, \
                         l|=((uint64_t)(*((c)++)))<<32, \
                         l|=((uint64_t)(*((c)++)))<<24, \
                         l|=((uint64_t)(*((c)++)))<<16, \
                         l|=((uint64_t)(*((c)++)))<< 8, \
                         l|=((uint64_t)(*((c)++))))


84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104
# define l2n(l,c)        (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

# define l2n6(l,c)       (*((c)++)=(unsigned char)(((l)>>40)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

# define l2n8(l,c)       (*((c)++)=(unsigned char)(((l)>>56)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>48)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>40)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                         *((c)++)=(unsigned char)(((l)    )&0xff))

105
/* NOTE - c is not incremented as per l2c */
106 107 108 109 110 111 112 113 114 115 116 117 118 119
# define l2cn(l1,l2,c,n) { \
                        c+=n; \
                        switch (n) { \
                        case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
                        case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
                        case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
                        case 5: *(--(c))=(unsigned char)(((l2)    )&0xff); \
                        case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
                        case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
                        case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
                        case 1: *(--(c))=(unsigned char)(((l1)    )&0xff); \
                                } \
                        }

M
Matt Caswell 已提交
120 121 122 123 124 125 126 127 128 129 130 131
# define n2s(c,s)        ((s=(((unsigned int)((c)[0]))<< 8)| \
                             (((unsigned int)((c)[1]))    )),(c)+=2)
# define s2n(s,c)        (((c)[0]=(unsigned char)(((s)>> 8)&0xff), \
                           (c)[1]=(unsigned char)(((s)    )&0xff)),(c)+=2)

# define n2l3(c,l)       ((l =(((unsigned long)((c)[0]))<<16)| \
                              (((unsigned long)((c)[1]))<< 8)| \
                              (((unsigned long)((c)[2]))    )),(c)+=3)

# define l2n3(l,c)       (((c)[0]=(unsigned char)(((l)>>16)&0xff), \
                           (c)[1]=(unsigned char)(((l)>> 8)&0xff), \
                           (c)[2]=(unsigned char)(((l)    )&0xff)),(c)+=3)
132

E
Emilia Kasper 已提交
133 134 135 136 137 138 139 140 141
/*
 * DTLS version numbers are strange because they're inverted. Except for
 * DTLS1_BAD_VER, which should be considered "lower" than the rest.
 */
# define dtls_ver_ordinal(v1) (((v1) == DTLS1_BAD_VER) ? 0xff00 : (v1))
# define DTLS_VERSION_GT(v1, v2) (dtls_ver_ordinal(v1) < dtls_ver_ordinal(v2))
# define DTLS_VERSION_GE(v1, v2) (dtls_ver_ordinal(v1) <= dtls_ver_ordinal(v2))
# define DTLS_VERSION_LT(v1, v2) (dtls_ver_ordinal(v1) > dtls_ver_ordinal(v2))
# define DTLS_VERSION_LE(v1, v2) (dtls_ver_ordinal(v1) >= dtls_ver_ordinal(v2))
142

143

144 145 146 147 148 149 150 151
/*
 * Define the Bitmasks for SSL_CIPHER.algorithms.
 * This bits are used packed as dense as possible. If new methods/ciphers
 * etc will be added, the bits a likely to change, so this information
 * is for internal library use only, even though SSL_CIPHER.algorithms
 * can be publicly accessed.
 * Use the according functions for cipher management instead.
 *
U
Ulf Möller 已提交
152
 * The bit mask handling in the selection and sorting scheme in
153
 * ssl_create_cipher_list() has only limited capabilities, reflecting
U
Ulf Möller 已提交
154
 * that the different entities within are mutually exclusive:
155 156
 * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
 */
157 158

/* Bits for algorithm_mkey (key exchange algorithm) */
159
/* RSA key exchange */
D
Dr. Stephen Henson 已提交
160
# define SSL_kRSA                0x00000001U
161
/* tmp DH key no DH cert */
D
Dr. Stephen Henson 已提交
162
# define SSL_kDHE                0x00000002U
163
/* synonym */
164
# define SSL_kEDH                SSL_kDHE
165
/* ephemeral ECDH */
D
Dr. Stephen Henson 已提交
166
# define SSL_kECDHE              0x00000004U
167
/* synonym */
168
# define SSL_kEECDH              SSL_kECDHE
169
/* PSK */
D
Dr. Stephen Henson 已提交
170
# define SSL_kPSK                0x00000008U
171
/* GOST key exchange */
D
Dr. Stephen Henson 已提交
172
# define SSL_kGOST               0x00000010U
173
/* SRP */
D
Dr. Stephen Henson 已提交
174
# define SSL_kSRP                0x00000020U
175

D
Dr. Stephen Henson 已提交
176 177 178
# define SSL_kRSAPSK             0x00000040U
# define SSL_kECDHEPSK           0x00000080U
# define SSL_kDHEPSK             0x00000100U
179 180 181

/* all PSK */

E
Emilia Kasper 已提交
182
# define SSL_PSK     (SSL_kPSK | SSL_kRSAPSK | SSL_kECDHEPSK | SSL_kDHEPSK)
183

D
Dr. Stephen Henson 已提交
184 185 186
/* Any appropriate key exchange algorithm (for TLS 1.3 ciphersuites) */
# define SSL_kANY                0x00000000U

187
/* Bits for algorithm_auth (server authentication) */
188
/* RSA auth */
D
Dr. Stephen Henson 已提交
189
# define SSL_aRSA                0x00000001U
190
/* DSS auth */
D
Dr. Stephen Henson 已提交
191
# define SSL_aDSS                0x00000002U
192
/* no auth (i.e. use ADH or AECDH) */
D
Dr. Stephen Henson 已提交
193
# define SSL_aNULL               0x00000004U
194
/* ECDSA auth*/
D
Dr. Stephen Henson 已提交
195
# define SSL_aECDSA              0x00000008U
196
/* PSK auth */
D
Dr. Stephen Henson 已提交
197
# define SSL_aPSK                0x00000010U
198
/* GOST R 34.10-2001 signature auth */
D
Dr. Stephen Henson 已提交
199
# define SSL_aGOST01             0x00000020U
200
/* SRP auth */
D
Dr. Stephen Henson 已提交
201
# define SSL_aSRP                0x00000040U
202
/* GOST R 34.10-2012 signature auth */
D
Dr. Stephen Henson 已提交
203
# define SSL_aGOST12             0x00000080U
D
Dr. Stephen Henson 已提交
204 205
/* Any appropriate signature auth (for TLS 1.3 ciphersuites) */
# define SSL_aANY                0x00000000U
206 207 208
/* All bits requiring a certificate */
#define SSL_aCERT \
    (SSL_aRSA | SSL_aDSS | SSL_aECDSA | SSL_aGOST01 | SSL_aGOST12)
209 210

/* Bits for algorithm_enc (symmetric encryption) */
D
Dr. Stephen Henson 已提交
211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228
# define SSL_DES                 0x00000001U
# define SSL_3DES                0x00000002U
# define SSL_RC4                 0x00000004U
# define SSL_RC2                 0x00000008U
# define SSL_IDEA                0x00000010U
# define SSL_eNULL               0x00000020U
# define SSL_AES128              0x00000040U
# define SSL_AES256              0x00000080U
# define SSL_CAMELLIA128         0x00000100U
# define SSL_CAMELLIA256         0x00000200U
# define SSL_eGOST2814789CNT     0x00000400U
# define SSL_SEED                0x00000800U
# define SSL_AES128GCM           0x00001000U
# define SSL_AES256GCM           0x00002000U
# define SSL_AES128CCM           0x00004000U
# define SSL_AES256CCM           0x00008000U
# define SSL_AES128CCM8          0x00010000U
# define SSL_AES256CCM8          0x00020000U
229
# define SSL_eGOST2814789CNT12   0x00040000U
A
Andy Polyakov 已提交
230
# define SSL_CHACHA20POLY1305    0x00080000U
231 232
# define SSL_ARIA128GCM          0x00100000U
# define SSL_ARIA256GCM          0x00200000U
233

E
Emilia Kasper 已提交
234 235 236
# define SSL_AESGCM              (SSL_AES128GCM | SSL_AES256GCM)
# define SSL_AESCCM              (SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8)
# define SSL_AES                 (SSL_AES128|SSL_AES256|SSL_AESGCM|SSL_AESCCM)
237
# define SSL_CAMELLIA            (SSL_CAMELLIA128|SSL_CAMELLIA256)
T
Todd Short 已提交
238
# define SSL_CHACHA20            (SSL_CHACHA20POLY1305)
239 240
# define SSL_ARIAGCM             (SSL_ARIA128GCM | SSL_ARIA256GCM)
# define SSL_ARIA                (SSL_ARIAGCM)
241 242

/* Bits for algorithm_mac (symmetric authentication) */
243

D
Dr. Stephen Henson 已提交
244 245 246 247 248 249
# define SSL_MD5                 0x00000001U
# define SSL_SHA1                0x00000002U
# define SSL_GOST94      0x00000004U
# define SSL_GOST89MAC   0x00000008U
# define SSL_SHA256              0x00000010U
# define SSL_SHA384              0x00000020U
250
/* Not a real MAC, just an indication it is part of cipher */
D
Dr. Stephen Henson 已提交
251
# define SSL_AEAD                0x00000040U
252 253 254
# define SSL_GOST12_256          0x00000080U
# define SSL_GOST89MAC12         0x00000100U
# define SSL_GOST12_512          0x00000200U
255

256
/*
257
 * When adding new digest in the ssl_ciph.c and increment SSL_MD_NUM_IDX make
258 259
 * sure to update this constant too
 */
260 261 262 263 264 265 266 267 268 269 270

# define SSL_MD_MD5_IDX  0
# define SSL_MD_SHA1_IDX 1
# define SSL_MD_GOST94_IDX 2
# define SSL_MD_GOST89MAC_IDX 3
# define SSL_MD_SHA256_IDX 4
# define SSL_MD_SHA384_IDX 5
# define SSL_MD_GOST12_256_IDX  6
# define SSL_MD_GOST89MAC12_IDX 7
# define SSL_MD_GOST12_512_IDX  8
# define SSL_MD_MD5_SHA1_IDX 9
271 272 273
# define SSL_MD_SHA224_IDX 10
# define SSL_MD_SHA512_IDX 11
# define SSL_MAX_DIGEST 12
274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295

/* Bits for algorithm2 (handshake digests and other extra flags) */

/* Bits 0-7 are handshake MAC */
# define SSL_HANDSHAKE_MAC_MASK  0xFF
# define SSL_HANDSHAKE_MAC_MD5_SHA1 SSL_MD_MD5_SHA1_IDX
# define SSL_HANDSHAKE_MAC_SHA256   SSL_MD_SHA256_IDX
# define SSL_HANDSHAKE_MAC_SHA384   SSL_MD_SHA384_IDX
# define SSL_HANDSHAKE_MAC_GOST94 SSL_MD_GOST94_IDX
# define SSL_HANDSHAKE_MAC_GOST12_256 SSL_MD_GOST12_256_IDX
# define SSL_HANDSHAKE_MAC_GOST12_512 SSL_MD_GOST12_512_IDX
# define SSL_HANDSHAKE_MAC_DEFAULT  SSL_HANDSHAKE_MAC_MD5_SHA1

/* Bits 8-15 bits are PRF */
# define TLS1_PRF_DGST_SHIFT 8
# define TLS1_PRF_SHA1_MD5 (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_SHA256 (SSL_MD_SHA256_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_SHA384 (SSL_MD_SHA384_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST94 (SSL_MD_GOST94_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST12_256 (SSL_MD_GOST12_256_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF_GOST12_512 (SSL_MD_GOST12_512_IDX << TLS1_PRF_DGST_SHIFT)
# define TLS1_PRF            (SSL_MD_MD5_SHA1_IDX << TLS1_PRF_DGST_SHIFT)
296

297 298 299 300
/*
 * Stream MAC for GOST ciphersuites from cryptopro draft (currently this also
 * goes into algorithm2)
 */
301
# define TLS1_STREAM_MAC 0x10000
302

303
# define SSL_STRONG_MASK         0x0000001FU
304
# define SSL_DEFAULT_MASK        0X00000020U
305

306 307 308 309 310 311
# define SSL_STRONG_NONE         0x00000001U
# define SSL_LOW                 0x00000002U
# define SSL_MEDIUM              0x00000004U
# define SSL_HIGH                0x00000008U
# define SSL_FIPS                0x00000010U
# define SSL_NOT_DEFAULT         0x00000020U
312

313
/* we have used 0000003f - 26 bits left to go */
314

315 316 317
/* Flag used on OpenSSL ciphersuite ids to indicate they are for SSLv3+ */
# define SSL3_CK_CIPHERSUITE_FLAG                0x03000000

D
Dr. Stephen Henson 已提交
318
/* Check if an SSL structure is using DTLS */
319
# define SSL_IS_DTLS(s)  (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
320 321

/* Check if we are using TLSv1.3 */
M
Matt Caswell 已提交
322 323 324
# define SSL_IS_TLS13(s) (!SSL_IS_DTLS(s) \
                          && (s)->method->version >= TLS1_3_VERSION \
                          && (s)->method->version != TLS_ANY_VERSION)
325

326
# define SSL_TREAT_AS_TLS13(s) \
327 328
    (SSL_IS_TLS13(s) || (s)->early_data_state == SSL_EARLY_DATA_WRITING \
     || (s)->early_data_state == SSL_EARLY_DATA_WRITE_RETRY)
329

330 331
# define SSL_IS_FIRST_HANDSHAKE(S) ((s)->s3->tmp.finish_md_len == 0)

332
/* See if we need explicit IV */
333 334 335 336 337
# define SSL_USE_EXPLICIT_IV(s)  \
                (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_EXPLICIT_IV)
/*
 * See if we use signature algorithms extension and signature algorithm
 * before signatures.
338
 */
339 340 341 342 343
# define SSL_USE_SIGALGS(s)      \
                        (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SIGALGS)
/*
 * Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2: may
 * apply to others in future.
344
 */
345 346 347 348
# define SSL_USE_TLS1_2_CIPHERS(s)       \
                (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)
/*
 * Determine if a client can use TLS 1.2 ciphersuites: can't rely on method
349 350
 * flags because it may not be set to correct version yet.
 */
351
# define SSL_CLIENT_USE_TLS1_2_CIPHERS(s)        \
352 353
    ((!SSL_IS_DTLS(s) && s->client_version >= TLS1_2_VERSION) || \
     (SSL_IS_DTLS(s) && DTLS_VERSION_GE(s->client_version, DTLS1_2_VERSION)))
354 355 356 357 358 359
/*
 * Determine if a client should send signature algorithms extension:
 * as with TLS1.2 cipher we can't rely on method flags.
 */
# define SSL_CLIENT_USE_SIGALGS(s)        \
    SSL_CLIENT_USE_TLS1_2_CIPHERS(s)
360

361 362
# define SSL_READ_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_READ)
# define SSL_WRITE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE)
363

364
/* Mostly for SSLv3 */
365
# define SSL_PKEY_RSA            0
366 367 368 369 370 371 372 373
# define SSL_PKEY_RSA_PSS_SIGN   1
# define SSL_PKEY_DSA_SIGN       2
# define SSL_PKEY_ECC            3
# define SSL_PKEY_GOST01         4
# define SSL_PKEY_GOST12_256     5
# define SSL_PKEY_GOST12_512     6
# define SSL_PKEY_ED25519        7
# define SSL_PKEY_NUM            8
374 375 376 377 378
/*
 * Pseudo-constant. GOST cipher suites can use different certs for 1
 * SSL_CIPHER. So let's see which one we have in fact.
 */
# define SSL_PKEY_GOST_EC SSL_PKEY_NUM+1
379

380
/*-
381
 * SSL_kRSA <- RSA_ENC
382
 * SSL_kDH  <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN)
383
 * SSL_kDHE <- RSA_ENC | RSA_SIGN | DSA_SIGN
384 385 386 387
 * SSL_aRSA <- RSA_ENC | RSA_SIGN
 * SSL_aDSS <- DSA_SIGN
 */

M
Matt Caswell 已提交
388
/*-
389 390 391
#define CERT_INVALID            0
#define CERT_PUBLIC_KEY         1
#define CERT_PRIVATE_KEY        2
392 393
*/

E
Emilia Kasper 已提交
394
/* CipherSuite length. SSLv3 and all TLS versions. */
E
Emilia Kasper 已提交
395
# define TLS_CIPHER_LEN 2
396 397
/* used to hold info on the particular ciphers used */
struct ssl_cipher_st {
398
    uint32_t valid;
E
Emilia Kasper 已提交
399
    const char *name;           /* text name */
400
    const char *stdname;        /* RFC name */
E
Emilia Kasper 已提交
401
    uint32_t id;                /* id, 4 bytes, first is version */
402
    /*
403
     * changed in 1.0.0: these four used to be portions of a single value
404 405
     * 'algorithms'
     */
E
Emilia Kasper 已提交
406 407 408 409 410 411 412 413 414 415 416 417
    uint32_t algorithm_mkey;    /* key exchange algorithm */
    uint32_t algorithm_auth;    /* server authentication */
    uint32_t algorithm_enc;     /* symmetric encryption */
    uint32_t algorithm_mac;     /* symmetric authentication */
    int min_tls;                /* minimum SSL/TLS protocol version */
    int max_tls;                /* maximum SSL/TLS protocol version */
    int min_dtls;               /* minimum DTLS protocol version */
    int max_dtls;               /* maximum DTLS protocol version */
    uint32_t algo_strength;     /* strength and export flags */
    uint32_t algorithm2;        /* Extra flags */
    int32_t strength_bits;      /* Number of bits really used */
    uint32_t alg_bits;          /* Number of bits for algorithm */
418 419
};

M
Matt Caswell 已提交
420
/* Used to hold SSL/TLS functions */
421 422
struct ssl_method_st {
    int version;
423 424
    unsigned flags;
    unsigned long mask;
425
    int (*ssl_new) (SSL *s);
426
    int (*ssl_clear) (SSL *s);
427 428 429
    void (*ssl_free) (SSL *s);
    int (*ssl_accept) (SSL *s);
    int (*ssl_connect) (SSL *s);
430 431
    int (*ssl_read) (SSL *s, void *buf, size_t len, size_t *readbytes);
    int (*ssl_peek) (SSL *s, void *buf, size_t len, size_t *readbytes);
M
Matt Caswell 已提交
432
    int (*ssl_write) (SSL *s, const void *buf, size_t len, size_t *written);
433 434
    int (*ssl_shutdown) (SSL *s);
    int (*ssl_renegotiate) (SSL *s);
435
    int (*ssl_renegotiate_check) (SSL *s, int);
436
    int (*ssl_read_bytes) (SSL *s, int type, int *recvd_type,
437
                           unsigned char *buf, size_t len, int peek,
438
                           size_t *readbytes);
M
Matt Caswell 已提交
439 440
    int (*ssl_write_bytes) (SSL *s, int type, const void *buf_, size_t len,
                            size_t *written);
441 442 443 444
    int (*ssl_dispatch_alert) (SSL *s);
    long (*ssl_ctrl) (SSL *s, int cmd, long larg, void *parg);
    long (*ssl_ctx_ctrl) (SSL_CTX *ctx, int cmd, long larg, void *parg);
    const SSL_CIPHER *(*get_cipher_by_char) (const unsigned char *ptr);
M
Matt Caswell 已提交
445
    int (*put_cipher_by_char) (const SSL_CIPHER *cipher, WPACKET *pkt,
446
                               size_t *len);
M
Matt Caswell 已提交
447
    size_t (*ssl_pending) (const SSL *s);
448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477
    int (*num_ciphers) (void);
    const SSL_CIPHER *(*get_cipher) (unsigned ncipher);
    long (*get_timeout) (void);
    const struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
    int (*ssl_version) (void);
    long (*ssl_callback_ctrl) (SSL *s, int cb_id, void (*fp) (void));
    long (*ssl_ctx_callback_ctrl) (SSL_CTX *s, int cb_id, void (*fp) (void));
};

/*-
 * Lets make this into an ASN.1 type structure as follows
 * SSL_SESSION_ID ::= SEQUENCE {
 *      version                 INTEGER,        -- structure version number
 *      SSLversion              INTEGER,        -- SSL version number
 *      Cipher                  OCTET STRING,   -- the 3 byte cipher ID
 *      Session_ID              OCTET STRING,   -- the Session ID
 *      Master_key              OCTET STRING,   -- the master key
 *      Key_Arg [ 0 ] IMPLICIT  OCTET STRING,   -- the optional Key argument
 *      Time [ 1 ] EXPLICIT     INTEGER,        -- optional Start Time
 *      Timeout [ 2 ] EXPLICIT  INTEGER,        -- optional Timeout ins seconds
 *      Peer [ 3 ] EXPLICIT     X509,           -- optional Peer Certificate
 *      Session_ID_context [ 4 ] EXPLICIT OCTET STRING,   -- the Session ID context
 *      Verify_result [ 5 ] EXPLICIT INTEGER,   -- X509_V_... code for `Peer'
 *      HostName [ 6 ] EXPLICIT OCTET STRING,   -- optional HostName from servername TLS extension
 *      PSK_identity_hint [ 7 ] EXPLICIT OCTET STRING, -- optional PSK identity hint
 *      PSK_identity [ 8 ] EXPLICIT OCTET STRING,  -- optional PSK identity
 *      Ticket_lifetime_hint [9] EXPLICIT INTEGER, -- server's lifetime hint for session ticket
 *      Ticket [10]             EXPLICIT OCTET STRING, -- session ticket (clients only)
 *      Compression_meth [11]   EXPLICIT OCTET STRING, -- optional compression method
 *      SRP_username [ 12 ] EXPLICIT OCTET STRING -- optional SRP username
478
 *      flags [ 13 ] EXPLICIT INTEGER -- optional flags
479 480 481 482 483
 *      }
 * Look in ssl/ssl_asn1.c for more details
 * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
 */
struct ssl_session_st {
E
Emilia Kasper 已提交
484 485
    int ssl_version;            /* what ssl version session info is being kept
                                 * in here? */
486
    size_t master_key_length;
487

488 489
    /* TLSv1.3 early_secret used for external PSKs */
    unsigned char early_secret[EVP_MAX_MD_SIZE];
490 491 492 493
    /*
     * For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
     * master secret
     */
M
Matt Caswell 已提交
494
    unsigned char master_key[TLS13_MAX_RESUMPTION_MASTER_LENGTH];
495
    /* session_id - valid? */
496
    size_t session_id_length;
497 498 499 500 501 502
    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
    /*
     * this is used to determine whether the session is being reused in the
     * appropriate context. It is up to the application to set this, via
     * SSL_new
     */
503
    size_t sid_ctx_length;
504 505 506 507 508 509 510 511 512 513 514
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
# ifndef OPENSSL_NO_PSK
    char *psk_identity_hint;
    char *psk_identity;
# endif
    /*
     * Used to indicate that session resumption is not allowed. Applications
     * can also set this bit for a new session via not_resumable_session_cb
     * to disable session caching and tickets.
     */
    int not_resumable;
515
    /* This is the cert and type for the other end. */
516
    X509 *peer;
517
    int peer_type;
518
    /* Certificate chain peer sent. */
519
    STACK_OF(X509) *peer_chain;
520 521 522 523 524
    /*
     * when app_verify_callback accepts a session where the peer's
     * certificate is not ok, we must remember the error for session reuse:
     */
    long verify_result;         /* only for servers */
525
    CRYPTO_REF_COUNT references;
526 527 528 529
    long timeout;
    long time;
    unsigned int compress_meth; /* Need to lookup the method */
    const SSL_CIPHER *cipher;
E
Emilia Kasper 已提交
530 531
    unsigned long cipher_id;    /* when ASN.1 loaded, this needs to be used to
                                 * load the 'cipher' structure */
532 533 534 535 536 537 538
    STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */
    CRYPTO_EX_DATA ex_data;     /* application specific data */
    /*
     * These are used to make removal of session-ids more efficient and to
     * implement a maximum cache size.
     */
    struct ssl_session_st *prev, *next;
R
Rich Salz 已提交
539 540 541

    struct {
        char *hostname;
542
# ifndef OPENSSL_NO_EC
R
Rich Salz 已提交
543 544 545 546
        size_t ecpointformats_len;
        unsigned char *ecpointformats; /* peer's list */
        size_t supportedgroups_len;
        unsigned char *supportedgroups; /* peer's list */
E
Emilia Kasper 已提交
547
# endif                         /* OPENSSL_NO_EC */
548
    /* RFC4507 info */
R
Rich Salz 已提交
549 550 551 552
        unsigned char *tick; /* Session ticket */
        size_t ticklen;      /* Session ticket length */
        /* Session lifetime hint in seconds */
        unsigned long tick_lifetime_hint;
M
Matt Caswell 已提交
553
        uint32_t tick_age_add;
554 555
        unsigned char *tick_nonce;
        size_t tick_nonce_len;
556
        int tick_identity;
557 558
        /* Max number of bytes that can be sent as early data */
        uint32_t max_early_data;
559 560 561
        /* The ALPN protocol selected for this session */
        unsigned char *alpn_selected;
        size_t alpn_selected_len;
R
Rich Salz 已提交
562
    } ext;
563 564 565
# ifndef OPENSSL_NO_SRP
    char *srp_username;
# endif
566
    uint32_t flags;
567
    CRYPTO_RWLOCK *lock;
568 569
};

570
/* Extended master secret support */
E
Emilia Kasper 已提交
571
# define SSL_SESS_FLAG_EXTMS             0x1
572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593

# ifndef OPENSSL_NO_SRP

typedef struct srp_ctx_st {
    /* param for all the callbacks */
    void *SRP_cb_arg;
    /* set client Hello login callback */
    int (*TLS_ext_srp_username_callback) (SSL *, int *, void *);
    /* set SRP N/g param callback for verification */
    int (*SRP_verify_param_callback) (SSL *, void *);
    /* set SRP client passwd callback */
    char *(*SRP_give_srp_client_pwd_callback) (SSL *, void *);
    char *login;
    BIGNUM *N, *g, *s, *B, *A;
    BIGNUM *a, *b, *v;
    char *info;
    int strength;
    unsigned long srp_Mask;
} SRP_CTX;

# endif

594 595 596 597 598 599
typedef enum {
    SSL_EARLY_DATA_NONE = 0,
    SSL_EARLY_DATA_CONNECT_RETRY,
    SSL_EARLY_DATA_CONNECTING,
    SSL_EARLY_DATA_WRITE_RETRY,
    SSL_EARLY_DATA_WRITING,
600
    SSL_EARLY_DATA_UNAUTH_WRITING,
601 602 603 604 605 606
    SSL_EARLY_DATA_FINISHED_WRITING,
    SSL_EARLY_DATA_ACCEPT_RETRY,
    SSL_EARLY_DATA_ACCEPTING,
    SSL_EARLY_DATA_READ_RETRY,
    SSL_EARLY_DATA_READING,
    SSL_EARLY_DATA_FINISHED_READING
607 608
} SSL_EARLY_DATA_STATE;

609 610 611 612 613 614 615 616 617 618 619 620
/*
 * We check that the amount of unreadable early data doesn't exceed
 * max_early_data. max_early_data is given in plaintext bytes. However if it is
 * unreadable then we only know the number of ciphertext bytes. We also don't
 * know how much the overhead should be because it depends on the ciphersuite.
 * We make a small allowance. We assume 5 records of actual data plus the end
 * of early data alert record. Each record has a tag and a content type byte.
 * The longest tag length we know of is EVP_GCM_TLS_TAG_LEN. We don't count the
 * content of the alert record either which is 2 bytes.
 */
# define EARLY_DATA_CIPHERTEXT_OVERHEAD ((6 * (EVP_GCM_TLS_TAG_LEN + 1)) + 2)

621 622 623 624 625 626 627 628
/*
 * The allowance we have between the client's calculated ticket age and our own.
 * We allow for 10 seconds (units are in ms). If a ticket is presented and the
 * client's age calculation is different by more than this than our own then we
 * do not allow that ticket for early_data.
 */
# define TICKET_AGE_ALLOWANCE   (10 * 1000)

629 630
#define MAX_COMPRESSIONS_SIZE   255

631 632 633 634 635 636
struct ssl_comp_st {
    int id;
    const char *name;
    COMP_METHOD *method;
};

637 638 639 640 641 642 643 644 645
typedef struct raw_extension_st {
    /* Raw packet data for the extension */
    PACKET data;
    /* Set to 1 if the extension is present or 0 otherwise */
    int present;
    /* Set to 1 if we have already parsed the extension or 0 otherwise */
    int parsed;
    /* The type of this extension, i.e. a TLSEXT_TYPE_* value */
    unsigned int type;
646 647
    /* Track what order extensions are received in (0-based). */
    size_t received_order;
648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665
} RAW_EXTENSION;

typedef struct {
    unsigned int isv2;
    unsigned int legacy_version;
    unsigned char random[SSL3_RANDOM_SIZE];
    size_t session_id_len;
    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
    size_t dtls_cookie_len;
    unsigned char dtls_cookie[DTLS1_COOKIE_LENGTH];
    PACKET ciphersuites;
    size_t compressions_len;
    unsigned char compressions[MAX_COMPRESSIONS_SIZE];
    PACKET extensions;
    size_t pre_proc_exts_len;
    RAW_EXTENSION *pre_proc_exts;
} CLIENTHELLO_MSG;

666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683
/*
 * Extension index values NOTE: Any updates to these defines should be mirrored
 * with equivalent updates to ext_defs in extensions.c
 */
typedef enum tlsext_index_en {
    TLSEXT_IDX_renegotiate,
    TLSEXT_IDX_server_name,
    TLSEXT_IDX_srp,
    TLSEXT_IDX_ec_point_formats,
    TLSEXT_IDX_supported_groups,
    TLSEXT_IDX_session_ticket,
    TLSEXT_IDX_status_request,
    TLSEXT_IDX_next_proto_neg,
    TLSEXT_IDX_application_layer_protocol_negotiation,
    TLSEXT_IDX_use_srtp,
    TLSEXT_IDX_encrypt_then_mac,
    TLSEXT_IDX_signed_certificate_timestamp,
    TLSEXT_IDX_extended_master_secret,
684
    TLSEXT_IDX_signature_algorithms,
685 686 687 688 689 690 691 692 693 694 695 696 697
    TLSEXT_IDX_supported_versions,
    TLSEXT_IDX_psk_kex_modes,
    TLSEXT_IDX_key_share,
    TLSEXT_IDX_cookie,
    TLSEXT_IDX_cryptopro_bug,
    TLSEXT_IDX_early_data,
    TLSEXT_IDX_certificate_authorities,
    TLSEXT_IDX_padding,
    TLSEXT_IDX_psk,
    /* Dummy index - must always be the last entry */
    TLSEXT_IDX_num_builtins
} TLSEXT_INDEX;

698
DEFINE_LHASH_OF(SSL_SESSION);
V
Viktor Dukhovni 已提交
699 700
/* Needed in ssl_cert.c */
DEFINE_LHASH_OF(X509_NAME);
701

E
Emilia Kasper 已提交
702
# define TLSEXT_KEYNAME_LENGTH 16
K
Kurt Roeckx 已提交
703

704 705 706 707 708 709 710 711 712 713 714
struct ssl_ctx_st {
    const SSL_METHOD *method;
    STACK_OF(SSL_CIPHER) *cipher_list;
    /* same as above but sorted for lookup */
    STACK_OF(SSL_CIPHER) *cipher_list_by_id;
    struct x509_store_st /* X509_STORE */ *cert_store;
    LHASH_OF(SSL_SESSION) *sessions;
    /*
     * Most session-ids that will be cached, default is
     * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited.
     */
M
Matt Caswell 已提交
715
    size_t session_cache_size;
716 717 718 719 720 721 722
    struct ssl_session_st *session_cache_head;
    struct ssl_session_st *session_cache_tail;
    /*
     * This can have one of 2 values, ored together, SSL_SESS_CACHE_CLIENT,
     * SSL_SESS_CACHE_SERVER, Default is SSL_SESSION_CACHE_SERVER, which
     * means only SSL_accept which cache SSL_SESSIONS.
     */
723
    uint32_t session_cache_mode;
724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741
    /*
     * If timeout is not 0, it is the default timeout value set when
     * SSL_new() is called.  This has been put in to make life easier to set
     * things up
     */
    long session_timeout;
    /*
     * If this callback is not null, it will be called each time a session id
     * is added to the cache.  If this function returns 1, it means that the
     * callback will do a SSL_SESSION_free() when it has finished using it.
     * Otherwise, on 0, it means the callback has finished with it. If
     * remove_session_cb is not null, it will be called when a session-id is
     * removed from the cache.  After the call, OpenSSL will
     * SSL_SESSION_free() it.
     */
    int (*new_session_cb) (struct ssl_st *ssl, SSL_SESSION *sess);
    void (*remove_session_cb) (struct ssl_ctx_st *ctx, SSL_SESSION *sess);
    SSL_SESSION *(*get_session_cb) (struct ssl_st *ssl,
E
Emilia Kasper 已提交
742 743
                                    const unsigned char *data, int len,
                                    int *copy);
744 745 746 747 748 749 750 751 752 753 754 755 756
    struct {
        int sess_connect;       /* SSL new conn - started */
        int sess_connect_renegotiate; /* SSL reneg - requested */
        int sess_connect_good;  /* SSL new conne/reneg - finished */
        int sess_accept;        /* SSL new accept - started */
        int sess_accept_renegotiate; /* SSL reneg - requested */
        int sess_accept_good;   /* SSL accept/reneg - finished */
        int sess_miss;          /* session lookup misses */
        int sess_timeout;       /* reuse attempt on timeouted session */
        int sess_cache_full;    /* session removed due to full cache */
        int sess_hit;           /* session reuse actually done */
        int sess_cb_hit;        /* session-id that was not in the cache was
                                 * passed back via the callback.  This
E
Emilia Kasper 已提交
757 758 759
                                 * indicates that the application is supplying
                                 * session-id's from other processes - spooky
                                 * :-) */
760 761
    } stats;

762
    CRYPTO_REF_COUNT references;
763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785

    /* if defined, these override the X509_verify_cert() calls */
    int (*app_verify_callback) (X509_STORE_CTX *, void *);
    void *app_verify_arg;
    /*
     * before OpenSSL 0.9.7, 'app_verify_arg' was ignored
     * ('app_verify_callback' was called with just one argument)
     */

    /* Default password callback. */
    pem_password_cb *default_passwd_callback;

    /* Default password callback user data. */
    void *default_passwd_callback_userdata;

    /* get client cert callback */
    int (*client_cert_cb) (SSL *ssl, X509 **x509, EVP_PKEY **pkey);

    /* cookie generate callback */
    int (*app_gen_cookie_cb) (SSL *ssl, unsigned char *cookie,
                              unsigned int *cookie_len);

    /* verify cookie callback */
E
Emilia Kasper 已提交
786
    int (*app_verify_cookie_cb) (SSL *ssl, const unsigned char *cookie,
787 788 789 790 791 792 793 794 795 796 797 798 799 800 801
                                 unsigned int cookie_len);

    CRYPTO_EX_DATA ex_data;

    const EVP_MD *md5;          /* For SSLv3/TLSv1 'ssl3-md5' */
    const EVP_MD *sha1;         /* For SSLv3/TLSv1 'ssl3->sha1' */

    STACK_OF(X509) *extra_certs;
    STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */

    /* Default values used when no per-SSL value is defined follow */

    /* used if SSL's info_callback is NULL */
    void (*info_callback) (const SSL *ssl, int type, int val);

802 803 804 805 806 807
    /*
     * What we put in certificate_authorities extension for TLS 1.3
     * (ClientHello and CertificateRequest) or just client cert requests for
     * earlier versions.
     */
    STACK_OF(X509_NAME) *ca_names;
808 809 810 811 812 813

    /*
     * Default values to use in SSL structures follow (these are copied by
     * SSL_new)
     */

814 815
    uint32_t options;
    uint32_t mode;
816 817
    int min_proto_version;
    int max_proto_version;
818
    size_t max_cert_list;
819 820 821 822 823 824 825 826 827

    struct cert_st /* CERT */ *cert;
    int read_ahead;

    /* callback that allows applications to peek at protocol messages */
    void (*msg_callback) (int write_p, int version, int content_type,
                          const void *buf, size_t len, SSL *ssl, void *arg);
    void *msg_callback_arg;

828
    uint32_t verify_mode;
829
    size_t sid_ctx_length;
830 831 832 833 834 835 836 837 838 839 840
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
    /* called 'verify_callback' in the SSL */
    int (*default_verify_callback) (int ok, X509_STORE_CTX *ctx);

    /* Default generate session ID callback. */
    GEN_SESSION_CB generate_session_id;

    X509_VERIFY_PARAM *param;

    int quiet_shutdown;

E
Emilia Kasper 已提交
841 842
# ifndef OPENSSL_NO_CT
    CTLOG_STORE *ctlog_store;   /* CT Log Store */
843
    /*
E
Emilia Kasper 已提交
844 845 846
     * Validates that the SCTs (Signed Certificate Timestamps) are sufficient.
     * If they are not, the connection should be aborted.
     */
847
    ssl_ct_validation_cb ct_validation_callback;
848
    void *ct_validation_callback_arg;
E
Emilia Kasper 已提交
849
# endif
850

851 852 853 854
    /*
     * If we're using more than one pipeline how should we divide the data
     * up between the pipes?
     */
M
Matt Caswell 已提交
855
    size_t split_send_fragment;
856 857 858 859
    /*
     * Maximum amount of data to send in one fragment. actual record size can
     * be more than this due to padding and MAC overheads.
     */
M
Matt Caswell 已提交
860
    size_t max_send_fragment;
861

862
    /* Up to how many pipelines should we use? If 0 then 1 is assumed */
M
Matt Caswell 已提交
863
    size_t max_pipelines;
864

865 866 867
    /* The default read buffer length to use (0 means not set) */
    size_t default_read_buf_len;

E
Emilia Kasper 已提交
868
# ifndef OPENSSL_NO_ENGINE
869 870 871 872
    /*
     * Engine to pass requests for client certs to
     */
    ENGINE *client_cert_engine;
E
Emilia Kasper 已提交
873
# endif
874

875 876 877
    /* ClientHello callback.  Mostly for extensions, but not entirely. */
    SSL_client_hello_cb_fn client_hello_cb;
    void *client_hello_cb_arg;
B
Benjamin Kaduk 已提交
878

R
Rich Salz 已提交
879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898
    /* TLS extensions. */
    struct {
        /* TLS extensions servername callback */
        int (*servername_cb) (SSL *, int *, void *);
        void *servername_arg;
        /* RFC 4507 session ticket keys */
        unsigned char tick_key_name[TLSEXT_KEYNAME_LENGTH];
        unsigned char tick_hmac_key[32];
        unsigned char tick_aes_key[32];
        /* Callback to support customisation of ticket key setting */
        int (*ticket_key_cb) (SSL *ssl,
                              unsigned char *name, unsigned char *iv,
                              EVP_CIPHER_CTX *ectx, HMAC_CTX *hctx, int enc);

        /* certificate status request info */
        /* Callback for status request */
        int (*status_cb) (SSL *ssl, void *arg);
        void *status_arg;
        /* ext status type used for CSR extension (OCSP Stapling) */
        int status_type;
899

R
Rich Salz 已提交
900 901 902 903 904 905 906
# ifndef OPENSSL_NO_EC
        /* EC extension values inherited by SSL structure */
        size_t ecpointformats_len;
        unsigned char *ecpointformats;
        size_t supportedgroups_len;
        unsigned char *supportedgroups;
# endif                         /* OPENSSL_NO_EC */
907

R
Rich Salz 已提交
908 909 910 911
        /*
         * ALPN information (we are in the process of transitioning from NPN to
         * ALPN.)
         */
912 913 914 915 916 917 918 919 920 921 922

        /*-
         * For a server, this contains a callback function that allows the
         * server to select the protocol for the connection.
         *   out: on successful return, this must point to the raw protocol
         *        name (without the length prefix).
         *   outlen: on successful return, this contains the length of |*out|.
         *   in: points to the client's list of supported protocols in
         *       wire-format.
         *   inlen: the length of |in|.
         */
R
Rich Salz 已提交
923 924 925 926 927 928
        int (*alpn_select_cb) (SSL *s,
                               const unsigned char **out,
                               unsigned char *outlen,
                               const unsigned char *in,
                               unsigned int inlen, void *arg);
        void *alpn_select_cb_arg;
929

R
Rich Salz 已提交
930 931 932 933 934 935 936
        /*
         * For a client, this contains the list of supported protocols in wire
         * format.
         */
        unsigned char *alpn;
        size_t alpn_len;

937
# ifndef OPENSSL_NO_NEXTPROTONEG
R
Rich Salz 已提交
938 939 940 941 942 943
        /* Next protocol negotiation information */

        /*
         * For a server, this contains a callback function by which the set of
         * advertised protocols can be provided.
         */
944
        SSL_CTX_npn_advertised_cb_func npn_advertised_cb;
R
Rich Salz 已提交
945 946 947 948 949
        void *npn_advertised_cb_arg;
        /*
         * For a client, this contains a callback function that selects the next
         * protocol from the list provided by the server.
         */
950
        SSL_CTX_npn_select_cb_func npn_select_cb;
R
Rich Salz 已提交
951 952 953 954 955
        void *npn_select_cb_arg;
# endif
    } ext;

# ifndef OPENSSL_NO_PSK
956 957
    SSL_psk_client_cb_func psk_client_callback;
    SSL_psk_server_cb_func psk_server_callback;
R
Rich Salz 已提交
958
# endif
959
    SSL_psk_find_session_cb_func psk_find_session_cb;
960
    SSL_psk_use_session_cb_func psk_use_session_cb;
R
Rich Salz 已提交
961 962 963 964

# ifndef OPENSSL_NO_SRP
    SRP_CTX srp_ctx;            /* ctx for SRP authentication */
# endif
965

966 967 968
    /* Shared DANE context */
    struct dane_ctx_st dane;

969 970 971 972 973 974 975
    /* SRTP profiles we are willing to do from RFC 5764 */
    STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
    /*
     * Callback for disabling session caching and ticket support on a session
     * basis, depending on the chosen cipher.
     */
    int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
976

977
    CRYPTO_RWLOCK *lock;
978 979 980 981 982 983

    /*
     * Callback for logging key material for use with debugging tools like
     * Wireshark. The callback should log `line` followed by a newline.
     */
    SSL_CTX_keylog_cb_func keylog_callback;
984 985 986

    /* The maximum number of bytes that can be sent as early data */
    uint32_t max_early_data;
T
Todd Short 已提交
987 988 989 990 991

    /* TLS1.3 padding callback */
    size_t (*record_padding_cb)(SSL *s, int type, size_t len, void *arg);
    void *record_padding_arg;
    size_t block_padding;
992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025
};

struct ssl_st {
    /*
     * protocol version (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION,
     * DTLS1_VERSION)
     */
    int version;
    /* SSLv3 */
    const SSL_METHOD *method;
    /*
     * There are 2 BIO's even though they are normally both the same.  This
     * is so data can be read and written to different handlers
     */
    /* used by SSL_read */
    BIO *rbio;
    /* used by SSL_write */
    BIO *wbio;
    /* used during session-id reuse to concatenate messages */
    BIO *bbio;
    /*
     * This holds a variable that indicates what we were doing when a 0 or -1
     * is returned.  This is needed for non-blocking IO so we know what
     * request needs re-doing when in SSL_accept or SSL_connect
     */
    int rwstate;
    int (*handshake_func) (SSL *);
    /*
     * Imagine that here's a boolean member "init" that is switched as soon
     * as SSL_set_{accept/connect}_state is called for the first time, so
     * that "state" and "handshake_func" are properly initialized.  But as
     * handshake_func is == 0 until then, we use this test instead of an
     * "init" member.
     */
M
Matt Caswell 已提交
1026
    /* are we the server side? */
1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039
    int server;
    /*
     * Generate a new session or reuse an old one.
     * NB: For servers, the 'new' session may actually be a previously
     * cached session or even the previous session unless
     * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set
     */
    int new_session;
    /* don't send shutdown packets */
    int quiet_shutdown;
    /* we have shut things down, 0x01 sent, 0x02 for received */
    int shutdown;
    /* where we are */
M
Matt Caswell 已提交
1040
    OSSL_STATEM statem;
1041
    SSL_EARLY_DATA_STATE early_data_state;
1042 1043 1044
    BUF_MEM *init_buf;          /* buffer used during init */
    void *init_msg;             /* pointer to handshake message body, set by
                                 * ssl3_get_message() */
1045 1046
    size_t init_num;               /* amount read/written */
    size_t init_off;               /* amount read/written */
1047 1048 1049 1050 1051 1052 1053 1054
    struct ssl3_state_st *s3;   /* SSLv3 variables */
    struct dtls1_state_st *d1;  /* DTLSv1 variables */
    /* callback that allows applications to peek at protocol messages */
    void (*msg_callback) (int write_p, int version, int content_type,
                          const void *buf, size_t len, SSL *ssl, void *arg);
    void *msg_callback_arg;
    int hit;                    /* reusing a previous session */
    X509_VERIFY_PARAM *param;
1055
    /* Per connection DANE state */
1056
    SSL_DANE dane;
1057 1058 1059 1060 1061 1062 1063
    /* crypto */
    STACK_OF(SSL_CIPHER) *cipher_list;
    STACK_OF(SSL_CIPHER) *cipher_list_by_id;
    /*
     * These are the ones being used, the ones in SSL_SESSION are the ones to
     * be 'copied' into these ones
     */
1064
    uint32_t mac_flags;
1065
    /*
1066 1067
     * The TLS1.3 secrets. The resumption master secret is stored in the
     * session.
1068 1069 1070
     */
    unsigned char early_secret[EVP_MAX_MD_SIZE];
    unsigned char handshake_secret[EVP_MAX_MD_SIZE];
1071
    unsigned char master_secret[EVP_MAX_MD_SIZE];
M
Matt Caswell 已提交
1072 1073
    unsigned char client_finished_secret[EVP_MAX_MD_SIZE];
    unsigned char server_finished_secret[EVP_MAX_MD_SIZE];
1074
    unsigned char server_finished_hash[EVP_MAX_MD_SIZE];
1075
    unsigned char handshake_traffic_hash[EVP_MAX_MD_SIZE];
1076 1077
    unsigned char client_app_traffic_secret[EVP_MAX_MD_SIZE];
    unsigned char server_app_traffic_secret[EVP_MAX_MD_SIZE];
1078
    unsigned char exporter_master_secret[EVP_MAX_MD_SIZE];
1079
    EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */
M
Matt Caswell 已提交
1080
    unsigned char read_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static read IV */
1081
    EVP_MD_CTX *read_hash;      /* used for mac generation */
R
Rich Salz 已提交
1082
    COMP_CTX *compress;         /* compression */
1083 1084
    COMP_CTX *expand;           /* uncompress */
    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
M
Matt Caswell 已提交
1085
    unsigned char write_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static write IV */
1086
    EVP_MD_CTX *write_hash;     /* used for mac generation */
1087 1088
    /* Count of how many KeyUpdate messages we have received */
    unsigned int key_update_count;
1089 1090 1091 1092
    /* session info */
    /* client cert? */
    /* This is used to hold the server certificate used */
    struct cert_st /* CERT */ *cert;
1093 1094 1095 1096 1097 1098 1099 1100

    /*
     * The hash of all messages prior to the CertificateVerify, and the length
     * of that hash.
     */
    unsigned char cert_verify_hash[EVP_MAX_MD_SIZE];
    size_t cert_verify_hash_len;

1101 1102 1103
    /* Flag to indicate whether we should send a HelloRetryRequest or not */
    int hello_retry_request;

1104 1105 1106 1107
    /*
     * the session_id_context is used to ensure sessions are only reused in
     * the appropriate context
     */
1108
    size_t sid_ctx_length;
1109 1110 1111
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
    /* This can also be in the session once a session is established */
    SSL_SESSION *session;
1112 1113
    /* TLSv1.3 PSK session */
    SSL_SESSION *psksession;
1114 1115
    unsigned char *psksession_id;
    size_t psksession_id_len;
1116 1117 1118 1119 1120 1121 1122
    /* Default generate session ID callback. */
    GEN_SESSION_CB generate_session_id;
    /* Used in SSL3 */
    /*
     * 0 don't care about verify failure.
     * 1 fail if verify fails
     */
1123
    uint32_t verify_mode;
1124 1125 1126 1127 1128 1129 1130 1131
    /* fail if callback returns 0 */
    int (*verify_callback) (int ok, X509_STORE_CTX *ctx);
    /* optional informational callback */
    void (*info_callback) (const SSL *ssl, int type, int val);
    /* error bytes to be written */
    int error;
    /* actual code */
    int error_code;
E
Emilia Kasper 已提交
1132
# ifndef OPENSSL_NO_PSK
1133 1134
    SSL_psk_client_cb_func psk_client_callback;
    SSL_psk_server_cb_func psk_server_callback;
E
Emilia Kasper 已提交
1135
# endif
1136
    SSL_psk_find_session_cb_func psk_find_session_cb;
1137
    SSL_psk_use_session_cb_func psk_use_session_cb;
1138
    SSL_CTX *ctx;
1139 1140
    /* Verified chain of peer */
    STACK_OF(X509) *verified_chain;
1141
    long verify_result;
1142
    /* extra application data */
1143 1144
    CRYPTO_EX_DATA ex_data;
    /* for server side, keep the list of CA_dn we can use */
1145
    STACK_OF(X509_NAME) *ca_names;
1146
    CRYPTO_REF_COUNT references;
1147
    /* protocol behaviour */
1148
    uint32_t options;
1149
    /* API behaviour */
1150
    uint32_t mode;
1151 1152
    int min_proto_version;
    int max_proto_version;
1153
    size_t max_cert_list;
1154
    int first_packet;
1155 1156 1157 1158
    /*
     * What was passed in ClientHello.legacy_version. Used for RSA pre-master
     * secret and SSLv3/TLS (<=1.2) rollback check
     */
1159
    int client_version;
1160 1161 1162 1163
    /*
     * If we're using more than one pipeline how should we divide the data
     * up between the pipes?
     */
M
Matt Caswell 已提交
1164
    size_t split_send_fragment;
1165 1166 1167 1168
    /*
     * Maximum amount of data to send in one fragment. actual record size can
     * be more than this due to padding and MAC overheads.
     */
M
Matt Caswell 已提交
1169
    size_t max_send_fragment;
1170
    /* Up to how many pipelines should we use? If 0 then 1 is assumed */
M
Matt Caswell 已提交
1171
    size_t max_pipelines;
R
Rich Salz 已提交
1172 1173

    struct {
1174 1175
        /* Built-in extension flags */
        uint8_t extflags[TLSEXT_IDX_num_builtins];
R
Rich Salz 已提交
1176
        /* TLS extension debug callback */
R
Rich Salz 已提交
1177 1178
        void (*debug_cb)(SSL *s, int client_server, int type,
                         const unsigned char *data, int len, void *arg);
R
Rich Salz 已提交
1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232
        void *debug_arg;
        char *hostname;
        /* certificate status request info */
        /* Status type or -1 if no status type */
        int status_type;
        /* Raw extension data, if seen */
        unsigned char *scts;
        /* Length of raw extension data, if seen */
        uint16_t scts_len;
        /* Expect OCSP CertificateStatus message */
        int status_expected;

        struct {
            /* OCSP status request only */
            STACK_OF(OCSP_RESPID) *ids;
            X509_EXTENSIONS *exts;
            /* OCSP response received or to be sent */
            unsigned char *resp;
            size_t resp_len;
        } ocsp;

        /* RFC4507 session ticket expected to be received or sent */
        int ticket_expected;
# ifndef OPENSSL_NO_EC
        size_t ecpointformats_len;
        /* our list */
        unsigned char *ecpointformats;
        size_t supportedgroups_len;
        /* our list */
        unsigned char *supportedgroups;
# endif                         /* OPENSSL_NO_EC */
        /* TLS Session Ticket extension override */
        TLS_SESSION_TICKET_EXT *session_ticket;
        /* TLS Session Ticket extension callback */
        tls_session_ticket_ext_cb_fn session_ticket_cb;
        void *session_ticket_cb_arg;
        /* TLS pre-shared secret session resumption */
        tls_session_secret_cb_fn session_secret_cb;
        void *session_secret_cb_arg;
        /*
         * For a client, this contains the list of supported protocols in wire
         * format.
         */
        unsigned char *alpn;
        size_t alpn_len;
        /*
         * Next protocol negotiation. For the client, this is the protocol that
         * we sent in NextProtocol and is set when handling ServerHello
         * extensions. For a server, this is the client's selected_protocol from
         * NextProtocol and is set when handling the NextProtocol message, before
         * the Finished message.
         */
        unsigned char *npn;
        size_t npn_len;
1233

M
Matt Caswell 已提交
1234
        /* The available PSK key exchange modes */
1235
        int psk_kex_mode;
1236 1237 1238

        /* Set to one if we have negotiated ETM */
        int use_etm;
M
Matt Caswell 已提交
1239

1240 1241
        /* Are we expecting to receive early data? */
        int early_data;
1242 1243
        /* Is the session suitable for early data? */
        int early_data_ok;
M
Matt Caswell 已提交
1244 1245 1246 1247

        /* May be sent by a server in HRR. Must be echoed back in ClientHello */
        unsigned char *tls13_cookie;
        size_t tls13_cookie_len;
R
Rich Salz 已提交
1248 1249
    } ext;

1250 1251 1252 1253
    /*
     * Parsed form of the ClientHello, kept around across client_hello_cb
     * calls.
     */
B
Benjamin Kaduk 已提交
1254 1255
    CLIENTHELLO_MSG *clienthello;

1256 1257 1258 1259 1260 1261 1262
    /*-
     * no further mod of servername
     * 0 : call the servername extension callback.
     * 1 : prepare 2, allow last ack just after in server callback.
     * 2 : don't call servername callback, no ack in server hello
     */
    int servername_done;
E
Emilia Kasper 已提交
1263
# ifndef OPENSSL_NO_CT
1264
    /*
E
Emilia Kasper 已提交
1265 1266 1267
     * Validates that the SCTs (Signed Certificate Timestamps) are sufficient.
     * If they are not, the connection should be aborted.
     */
1268
    ssl_ct_validation_cb ct_validation_callback;
F
FdaSilvaYY 已提交
1269
    /* User-supplied argument that is passed to the ct_validation_callback */
1270 1271 1272 1273 1274 1275 1276 1277
    void *ct_validation_callback_arg;
    /*
     * Consolidated stack of SCTs from all sources.
     * Lazily populated by CT_get_peer_scts(SSL*)
     */
    STACK_OF(SCT) *scts;
    /* Have we attempted to find/parse SCTs yet? */
    int scts_parsed;
E
Emilia Kasper 已提交
1278
# endif
1279
    SSL_CTX *session_ctx;       /* initial ctx, used to store sessions */
1280 1281 1282 1283 1284 1285 1286 1287 1288 1289
    /* What we'll do */
    STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
    /* What's been chosen */
    SRTP_PROTECTION_PROFILE *srtp_profile;
    /*-
     * 1 if we are renegotiating.
     * 2 if we are a server and are inside a handshake
     * (i.e. not just sending a HelloRequest)
     */
    int renegotiate;
1290
    /* If sending a KeyUpdate is pending */
1291
    int key_update;
E
Emilia Kasper 已提交
1292
# ifndef OPENSSL_NO_SRP
1293 1294
    /* ctx for SRP authentication */
    SRP_CTX srp_ctx;
E
Emilia Kasper 已提交
1295
# endif
1296 1297 1298 1299 1300
    /*
     * Callback for disabling session caching and ticket support on a session
     * basis, depending on the chosen cipher.
     */
    int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
1301
    RECORD_LAYER rlayer;
M
Matt Caswell 已提交
1302 1303 1304 1305
    /* Default password callback. */
    pem_password_cb *default_passwd_callback;
    /* Default password callback user data. */
    void *default_passwd_callback_userdata;
M
Matt Caswell 已提交
1306 1307
    /* Async Job info */
    ASYNC_JOB *job;
M
Matt Caswell 已提交
1308
    ASYNC_WAIT_CTX *waitctx;
M
Matt Caswell 已提交
1309
    size_t asyncrw;
1310

1311
    /* The maximum number of plaintext bytes that can be sent as early data */
1312
    uint32_t max_early_data;
1313 1314 1315 1316 1317 1318
    /*
     * The number of bytes of early data received so far. If we accepted early
     * data then this is a count of the plaintext bytes. If we rejected it then
     * this is a count of the ciphertext bytes.
     */
    uint32_t early_data_count;
1319

T
Todd Short 已提交
1320 1321 1322 1323 1324
    /* TLS1.3 padding callback */
    size_t (*record_padding_cb)(SSL *s, int type, size_t len, void *arg);
    void *record_padding_arg;
    size_t block_padding;

1325
    CRYPTO_RWLOCK *lock;
R
Rich Salz 已提交
1326
    RAND_DRBG *drbg;
1327 1328
};

1329 1330 1331 1332 1333 1334 1335 1336 1337
/*
 * Structure containing table entry of values associated with the signature
 * algorithms (signature scheme) extension
*/
typedef struct sigalg_lookup_st {
    /* TLS 1.3 signature scheme name */
    const char *name;
    /* Raw value used in extension */
    uint16_t sigalg;
1338
    /* NID of hash algorithm or NID_undef if no hash */
1339
    int hash;
1340
    /* Index of hash algorithm or -1 if no hash algorithm */
1341
    int hash_idx;
1342 1343
    /* NID of signature algorithm */
    int sig;
1344 1345
    /* Index of signature algorithm */
    int sig_idx;
1346 1347 1348 1349 1350 1351
    /* Combined hash and signature NID, if any */
    int sigandhash;
    /* Required public key curve (ECDSA only) */
    int curve;
} SIGALG_LOOKUP;

1352 1353
typedef struct cert_pkey_st CERT_PKEY;

1354 1355 1356 1357 1358 1359 1360 1361 1362
/*
 * Structure containing table entry of certificate info corresponding to
 * CERT_PKEY entries
 */
typedef struct {
    int nid; /* NID of pubic key algorithm */
    uint32_t amask; /* authmask corresponding to key type */
} SSL_CERT_LOOKUP;

1363 1364
typedef struct ssl3_state_st {
    long flags;
1365
    size_t read_mac_secret_size;
1366
    unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
1367
    size_t write_mac_secret_size;
1368 1369 1370 1371 1372 1373 1374 1375 1376
    unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
    unsigned char server_random[SSL3_RANDOM_SIZE];
    unsigned char client_random[SSL3_RANDOM_SIZE];
    /* flags for countermeasure against known-IV weakness */
    int need_empty_fragments;
    int empty_fragment_done;
    /* used during startup, digest all incoming/outgoing packets */
    BIO *handshake_buffer;
    /*
1377 1378
     * When handshake digest is determined, buffer is hashed and
     * freed and MD_CTX for the required digest is stored here.
1379
     */
1380
    EVP_MD_CTX *handshake_dgst;
1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405
    /*
     * Set whenever an expected ChangeCipherSpec message is processed.
     * Unset when the peer's Finished message is received.
     * Unexpected ChangeCipherSpec messages trigger a fatal alert.
     */
    int change_cipher_spec;
    int warn_alert;
    int fatal_alert;
    /*
     * we allow one fatal and one warning alert to be outstanding, send close
     * alert via the warning alert
     */
    int alert_dispatch;
    unsigned char send_alert[2];
    /*
     * This flag is set when we should renegotiate ASAP, basically when there
     * is no more data in the read or write buffers
     */
    int renegotiate;
    int total_renegotiations;
    int num_renegotiations;
    int in_read_app_data;
    struct {
        /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
        unsigned char finish_md[EVP_MAX_MD_SIZE * 2];
1406
        size_t finish_md_len;
1407
        unsigned char peer_finish_md[EVP_MAX_MD_SIZE * 2];
1408
        size_t peer_finish_md_len;
1409
        size_t message_size;
1410 1411 1412
        int message_type;
        /* used to hold the new cipher we are going to use */
        const SSL_CIPHER *new_cipher;
E
Emilia Kasper 已提交
1413 1414 1415
# if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
        EVP_PKEY *pkey;         /* holds short lived DH/ECDH key */
# endif
1416 1417
        /* used for certificate requests */
        int cert_req;
1418 1419 1420
        /* Certificate types in certificate request message. */
        uint8_t *ctype;
        size_t ctype_len;
1421 1422
        /* Certificate authorities list peer sent */
        STACK_OF(X509_NAME) *peer_ca_names;
1423
        size_t key_block_length;
1424 1425 1426 1427
        unsigned char *key_block;
        const EVP_CIPHER *new_sym_enc;
        const EVP_MD *new_hash;
        int new_mac_pkey_type;
1428
        size_t new_mac_secret_size;
E
Emilia Kasper 已提交
1429
# ifndef OPENSSL_NO_COMP
1430
        const SSL_COMP *new_compression;
E
Emilia Kasper 已提交
1431
# else
1432
        char *new_compression;
E
Emilia Kasper 已提交
1433
# endif
1434
        int cert_request;
D
Dr. Stephen Henson 已提交
1435 1436 1437 1438 1439 1440
        /* Raw values of the cipher list from a client */
        unsigned char *ciphers_raw;
        size_t ciphers_rawlen;
        /* Temporary storage for premaster secret */
        unsigned char *pms;
        size_t pmslen;
E
Emilia Kasper 已提交
1441
# ifndef OPENSSL_NO_PSK
1442 1443 1444
        /* Temporary storage for PSK key */
        unsigned char *psk;
        size_t psklen;
E
Emilia Kasper 已提交
1445
# endif
1446 1447
        /* Signature algorithm we actually use */
        const SIGALG_LOOKUP *sigalg;
1448 1449
        /* Pointer to certificate we use */
        CERT_PKEY *cert;
D
Dr. Stephen Henson 已提交
1450 1451 1452 1453 1454
        /*
         * signature algorithms peer reports: e.g. supported signature
         * algorithms extension for server or as part of a certificate
         * request for client.
         */
1455
        uint16_t *peer_sigalgs;
D
Dr. Stephen Henson 已提交
1456 1457
        /* Size of above array */
        size_t peer_sigalgslen;
1458 1459
        /* Sigalg peer actualy uses */
        const SIGALG_LOOKUP *peer_sigalg;
1460 1461 1462 1463 1464
        /*
         * Set if corresponding CERT_PKEY can be used with current
         * SSL session: e.g. appropriate curve, signature algorithms etc.
         * If zero it can't be used at all.
         */
1465
        uint32_t valid_flags[SSL_PKEY_NUM];
1466 1467 1468 1469 1470
        /*
         * For servers the following masks are for the key and auth algorithms
         * that are supported by the certs below. For clients they are masks of
         * *disabled* algorithms based on the current session.
         */
1471 1472
        uint32_t mask_k;
        uint32_t mask_a;
1473 1474 1475 1476 1477 1478 1479
        /*
         * The following are used by the client to see if a cipher is allowed or
         * not.  It contains the minimum and maximum version the client's using
         * based on what it knows so far.
         */
        int min_ver;
        int max_ver;
1480 1481 1482 1483
    } tmp;

    /* Connection binding to prevent renegotiation attacks */
    unsigned char previous_client_finished[EVP_MAX_MD_SIZE];
1484
    size_t previous_client_finished_len;
1485
    unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
1486
    size_t previous_server_finished_len;
1487 1488
    int send_connection_binding; /* TODOEKR */

E
Emilia Kasper 已提交
1489
# ifndef OPENSSL_NO_NEXTPROTONEG
1490 1491 1492
    /*
     * Set if we saw the Next Protocol Negotiation extension from our peer.
     */
R
Rich Salz 已提交
1493
    int npn_seen;
E
Emilia Kasper 已提交
1494
# endif
1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506

    /*
     * ALPN information (we are in the process of transitioning from NPN to
     * ALPN.)
     */

    /*
     * In a server these point to the selected ALPN protocol after the
     * ClientHello has been processed. In a client these contain the protocol
     * that the server selected once the ServerHello has been processed.
     */
    unsigned char *alpn_selected;
T
Todd Short 已提交
1507 1508 1509 1510 1511 1512
    size_t alpn_selected_len;
    /* used by the server to know what options were proposed */
    unsigned char *alpn_proposed;
    size_t alpn_proposed_len;
    /* used by the client to know if it actually sent alpn */
    int alpn_sent;
1513

E
Emilia Kasper 已提交
1514
# ifndef OPENSSL_NO_EC
1515 1516 1517 1518 1519 1520
    /*
     * This is set to true if we believe that this is a version of Safari
     * running on OS X 10.6 or newer. We wish to know this because Safari on
     * 10.8 .. 10.8.3 has broken ECDHE-ECDSA support.
     */
    char is_probably_safari;
E
Emilia Kasper 已提交
1521
# endif                         /* !OPENSSL_NO_EC */
1522 1523

    /* For clients: peer temporary key */
D
Dr. Stephen Henson 已提交
1524
# if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
1525 1526
    /* The group_id for the DH/ECDH key */
    unsigned int group_id;
1527
    EVP_PKEY *peer_tmp;
1528 1529
# endif

1530 1531 1532 1533
} SSL3_STATE;

/* DTLS structures */

E
Emilia Kasper 已提交
1534 1535 1536
# ifndef OPENSSL_NO_SCTP
#  define DTLS1_SCTP_AUTH_LABEL   "EXPORTER_DTLS_OVER_SCTP"
# endif
1537 1538

/* Max MTU overhead we know about so far is 40 for IPv6 + 8 for UDP */
E
Emilia Kasper 已提交
1539
# define DTLS1_MAX_MTU_OVERHEAD                   48
1540

M
Matt Caswell 已提交
1541 1542 1543 1544
/*
 * Flag used in message reuse to indicate the buffer contains the record
 * header as well as the the handshake message header.
 */
E
Emilia Kasper 已提交
1545
# define DTLS1_SKIP_RECORD_HEADER                 2
M
Matt Caswell 已提交
1546

1547 1548 1549 1550 1551 1552 1553 1554 1555 1556
struct dtls1_retransmit_state {
    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
    EVP_MD_CTX *write_hash;     /* used for mac generation */
    COMP_CTX *compress;         /* compression */
    SSL_SESSION *session;
    unsigned short epoch;
};

struct hm_header_st {
    unsigned char type;
M
Matt Caswell 已提交
1557
    size_t msg_len;
1558
    unsigned short seq;
M
Matt Caswell 已提交
1559 1560
    size_t frag_off;
    size_t frag_len;
1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579
    unsigned int is_ccs;
    struct dtls1_retransmit_state saved_retransmit_state;
};

struct dtls1_timeout_st {
    /* Number of read timeouts so far */
    unsigned int read_timeouts;
    /* Number of write timeouts so far */
    unsigned int write_timeouts;
    /* Number of alerts received so far */
    unsigned int num_alerts;
};

typedef struct hm_fragment_st {
    struct hm_header_st msg_header;
    unsigned char *fragment;
    unsigned char *reassembly;
} hm_fragment;

R
Rich Salz 已提交
1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592
typedef struct pqueue_st pqueue;
typedef struct pitem_st pitem;

struct pitem_st {
    unsigned char priority[8];  /* 64-bit value in big-endian encoding */
    void *data;
    pitem *next;
};

typedef struct pitem_st *piterator;

pitem *pitem_new(unsigned char *prio64be, void *data);
void pitem_free(pitem *item);
E
Emilia Kasper 已提交
1593
pqueue *pqueue_new(void);
R
Rich Salz 已提交
1594 1595 1596 1597 1598 1599 1600
void pqueue_free(pqueue *pq);
pitem *pqueue_insert(pqueue *pq, pitem *item);
pitem *pqueue_peek(pqueue *pq);
pitem *pqueue_pop(pqueue *pq);
pitem *pqueue_find(pqueue *pq, unsigned char *prio64be);
pitem *pqueue_iterator(pqueue *pq);
pitem *pqueue_next(piterator *iter);
M
Matt Caswell 已提交
1601
size_t pqueue_size(pqueue *pq);
R
Rich Salz 已提交
1602

1603 1604
typedef struct dtls1_state_st {
    unsigned char cookie[DTLS1_COOKIE_LENGTH];
M
Matt Caswell 已提交
1605
    size_t cookie_len;
M
Matt Caswell 已提交
1606
    unsigned int cookie_verified;
1607 1608 1609 1610 1611
    /* handshake message numbers */
    unsigned short handshake_write_seq;
    unsigned short next_handshake_write_seq;
    unsigned short handshake_read_seq;
    /* Buffered handshake messages */
R
Rich Salz 已提交
1612
    pqueue *buffered_messages;
1613
    /* Buffered (sent) handshake records */
R
Rich Salz 已提交
1614
    pqueue *sent_messages;
M
Matt Caswell 已提交
1615 1616
    size_t link_mtu;      /* max on-the-wire DTLS packet size */
    size_t mtu;           /* max DTLS packet size */
1617 1618 1619 1620
    struct hm_header_st w_msg_hdr;
    struct hm_header_st r_msg_hdr;
    struct dtls1_timeout_st timeout;
    /*
R
Richard Levitte 已提交
1621
     * Indicates when the last handshake msg sent will timeout
1622 1623 1624
     */
    struct timeval next_timeout;
    /* Timeout duration */
1625 1626
    unsigned int timeout_duration_us;

1627
    unsigned int retransmitting;
E
Emilia Kasper 已提交
1628
# ifndef OPENSSL_NO_SCTP
1629
    int shutdown_received;
E
Emilia Kasper 已提交
1630
# endif
1631 1632 1633

    DTLS_timer_cb timer_cb;

1634 1635
} DTLS1_STATE;

1636 1637 1638
# ifndef OPENSSL_NO_EC
/*
 * From ECC-TLS draft, used in encoding the curve type in ECParameters
B
Bodo Möller 已提交
1639
 */
1640 1641 1642 1643 1644
#  define EXPLICIT_PRIME_CURVE_TYPE  1
#  define EXPLICIT_CHAR2_CURVE_TYPE  2
#  define NAMED_CURVE_TYPE           3
# endif                         /* OPENSSL_NO_EC */

1645
struct cert_pkey_st {
1646 1647 1648 1649
    X509 *x509;
    EVP_PKEY *privatekey;
    /* Chain for this certificate */
    STACK_OF(X509) *chain;
1650 1651 1652 1653 1654 1655 1656
    /*-
     * serverinfo data for this certificate.  The data is in TLS Extension
     * wire format, specifically it's a series of records like:
     *   uint16_t extension_type; // (RFC 5246, 7.4.1.4, Extension)
     *   uint16_t length;
     *   uint8_t data[length];
     */
1657 1658
    unsigned char *serverinfo;
    size_t serverinfo_length;
1659
};
1660
/* Retrieve Suite B flags */
1661
# define tls1_suiteb(s)  (s->cert->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS)
1662
/* Uses to check strict mode: suite B modes are always strict */
1663 1664
# define SSL_CERT_FLAGS_CHECK_TLS_STRICT \
        (SSL_CERT_FLAG_SUITEB_128_LOS|SSL_CERT_FLAG_TLS_STRICT)
1665

1666 1667 1668 1669 1670 1671 1672
typedef enum {
    ENDPOINT_CLIENT = 0,
    ENDPOINT_SERVER,
    ENDPOINT_BOTH
} ENDPOINT;


1673
typedef struct {
1674
    unsigned short ext_type;
1675
    ENDPOINT role;
1676 1677
    /* The context which this extension applies to */
    unsigned int context;
1678 1679 1680 1681
    /*
     * Per-connection flags relating to this extension type: not used if
     * part of an SSL_CTX structure.
     */
1682
    uint32_t ext_flags;
1683 1684
    SSL_custom_ext_add_cb_ex add_cb;
    SSL_custom_ext_free_cb_ex free_cb;
1685
    void *add_arg;
1686
    SSL_custom_ext_parse_cb_ex parse_cb;
1687
    void *parse_arg;
D
Dr. Stephen Henson 已提交
1688
} custom_ext_method;
1689

1690 1691
/* ext_flags values */

1692 1693 1694
/*
 * Indicates an extension has been received. Used to check for unsolicited or
 * duplicate extensions.
1695
 */
1696 1697 1698 1699
# define SSL_EXT_FLAG_RECEIVED   0x1
/*
 * Indicates an extension has been sent: used to enable sending of
 * corresponding ServerHello extension.
1700
 */
1701
# define SSL_EXT_FLAG_SENT       0x2
1702

1703
typedef struct {
1704 1705
    custom_ext_method *meths;
    size_t meths_count;
D
Dr. Stephen Henson 已提交
1706
} custom_ext_methods;
1707

1708 1709 1710 1711 1712 1713 1714 1715 1716
typedef struct cert_st {
    /* Current active set */
    /*
     * ALWAYS points to an element of the pkeys array
     * Probably it would make more sense to store
     * an index, not a pointer.
     */
    CERT_PKEY *key;
# ifndef OPENSSL_NO_DH
1717
    EVP_PKEY *dh_tmp;
1718 1719 1720 1721
    DH *(*dh_tmp_cb) (SSL *ssl, int is_export, int keysize);
    int dh_tmp_auto;
# endif
    /* Flags related to certificates */
1722
    uint32_t cert_flags;
1723
    CERT_PKEY pkeys[SSL_PKEY_NUM];
1724 1725 1726
    /* Custom certificate types sent in certificate request message. */
    uint8_t *ctype;
    size_t ctype_len;
1727
    /*
1728
     * supported signature algorithms. When set on a client this is sent in
1729 1730 1731
     * the client hello as the supported signature algorithms extension. For
     * servers it represents the signature algorithms we are willing to use.
     */
1732
    uint16_t *conf_sigalgs;
1733 1734 1735 1736 1737
    /* Size of above array */
    size_t conf_sigalgslen;
    /*
     * Client authentication signature algorithms, if not set then uses
     * conf_sigalgs. On servers these will be the signature algorithms sent
F
FdaSilvaYY 已提交
1738 1739
     * to the client in a certificate request for TLS 1.2. On a client this
     * represents the signature algorithms we are willing to use for client
1740 1741
     * authentication.
     */
1742
    uint16_t *client_sigalgs;
1743 1744 1745 1746 1747 1748
    /* Size of above array */
    size_t client_sigalgslen;
    /*
     * Signature algorithms shared by client and server: cached because these
     * are used most often.
     */
1749
    const SIGALG_LOOKUP **shared_sigalgs;
1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765
    size_t shared_sigalgslen;
    /*
     * Certificate setup callback: if set is called whenever a certificate
     * may be required (client or server). the callback can then examine any
     * appropriate parameters and setup any certificates required. This
     * allows advanced applications to select certificates on the fly: for
     * example based on supported signature algorithms or curves.
     */
    int (*cert_cb) (SSL *ssl, void *arg);
    void *cert_cb_arg;
    /*
     * Optional X509_STORE for chain building or certificate validation If
     * NULL the parent SSL_CTX store is used instead.
     */
    X509_STORE *chain_store;
    X509_STORE *verify_store;
1766 1767
    /* Custom extensions */
    custom_ext_methods custext;
1768
    /* Security callback */
K
Kurt Roeckx 已提交
1769
    int (*sec_cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid,
1770 1771 1772 1773
                   void *other, void *ex);
    /* Security level */
    int sec_level;
    void *sec_ex;
E
Emilia Kasper 已提交
1774
# ifndef OPENSSL_NO_PSK
1775 1776
    /* If not NULL psk identity hint to use for servers */
    char *psk_identity_hint;
E
Emilia Kasper 已提交
1777
# endif
1778
    CRYPTO_REF_COUNT references;             /* >1 only if SSL_copy_session_id is used */
1779
    CRYPTO_RWLOCK *lock;
1780 1781 1782 1783 1784 1785 1786 1787 1788
} CERT;

# define FP_ICC  (int (*)(const void *,const void *))

/*
 * This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff It is a bit
 * of a mess of functions, but hell, think of it as an opaque structure :-)
 */
typedef struct ssl3_enc_method {
1789
    int (*enc) (SSL *, SSL3_RECORD *, size_t, int);
1790
    int (*mac) (SSL *, SSL3_RECORD *, unsigned char *, int);
1791 1792
    int (*setup_key_block) (SSL *);
    int (*generate_master_secret) (SSL *, unsigned char *, unsigned char *,
1793
                                   size_t, size_t *);
1794
    int (*change_cipher_state) (SSL *, int);
1795
    size_t (*final_finish_mac) (SSL *, const char *, size_t, unsigned char *);
1796
    const char *client_finished_label;
M
Matt Caswell 已提交
1797
    size_t client_finished_label_len;
1798
    const char *server_finished_label;
M
Matt Caswell 已提交
1799
    size_t server_finished_label_len;
1800 1801 1802 1803 1804 1805
    int (*alert_value) (int);
    int (*export_keying_material) (SSL *, unsigned char *, size_t,
                                   const char *, size_t,
                                   const unsigned char *, size_t,
                                   int use_context);
    /* Various flags indicating protocol version requirements */
1806
    uint32_t enc_flags;
1807
    /* Set the handshake header */
M
Matt Caswell 已提交
1808
    int (*set_handshake_header) (SSL *s, WPACKET *pkt, int type);
1809
    /* Close construction of the handshake message */
1810
    int (*close_construct_packet) (SSL *s, WPACKET *pkt, int htype);
1811 1812 1813 1814
    /* Write out handshake message */
    int (*do_write) (SSL *s);
} SSL3_ENC_METHOD;

M
Matt Caswell 已提交
1815 1816
# define ssl_set_handshake_header(s, pkt, htype) \
        s->method->ssl3_enc->set_handshake_header((s), (pkt), (htype))
1817 1818
# define ssl_close_construct_packet(s, pkt, htype) \
        s->method->ssl3_enc->close_construct_packet((s), (pkt), (htype))
1819
# define ssl_do_write(s)  s->method->ssl3_enc->do_write(s)
D
Dr. Stephen Henson 已提交
1820 1821 1822 1823

/* Values for enc_flags */

/* Uses explicit IV for CBC mode */
1824
# define SSL_ENC_FLAG_EXPLICIT_IV        0x1
D
Dr. Stephen Henson 已提交
1825
/* Uses signature algorithms extension */
1826
# define SSL_ENC_FLAG_SIGALGS            0x2
1827
/* Uses SHA256 default PRF */
1828
# define SSL_ENC_FLAG_SHA256_PRF         0x4
D
Dr. Stephen Henson 已提交
1829
/* Is DTLS */
1830 1831 1832 1833
# define SSL_ENC_FLAG_DTLS               0x8
/*
 * Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2: may
 * apply to others in future.
1834
 */
1835
# define SSL_ENC_FLAG_TLS1_2_CIPHERS     0x10
D
Dr. Stephen Henson 已提交
1836

1837
# ifndef OPENSSL_NO_COMP
1838
/* Used for holding the relevant compression methods loaded into SSL_CTX */
1839 1840 1841 1842 1843 1844 1845
typedef struct ssl3_comp_st {
    int comp_id;                /* The identifier byte for this compression
                                 * type */
    char *name;                 /* Text name used for the compression type */
    COMP_METHOD *method;        /* The method :-) */
} SSL3_COMP;
# endif
1846

1847 1848 1849 1850 1851 1852
typedef enum downgrade_en {
    DOWNGRADE_NONE,
    DOWNGRADE_TO_1_2,
    DOWNGRADE_TO_1_1
} DOWNGRADE;

1853 1854 1855 1856 1857 1858
/*
 * Dummy status type for the status_type extension. Indicates no status type
 * set
 */
#define TLSEXT_STATUSTYPE_nothing  -1

1859 1860 1861 1862
/* Sigalgs values */
#define TLSEXT_SIGALG_ecdsa_secp256r1_sha256                    0x0403
#define TLSEXT_SIGALG_ecdsa_secp384r1_sha384                    0x0503
#define TLSEXT_SIGALG_ecdsa_secp521r1_sha512                    0x0603
1863
#define TLSEXT_SIGALG_ecdsa_sha224                              0x0303
1864 1865 1866 1867 1868 1869 1870
#define TLSEXT_SIGALG_ecdsa_sha1                                0x0203
#define TLSEXT_SIGALG_rsa_pss_sha256                            0x0804
#define TLSEXT_SIGALG_rsa_pss_sha384                            0x0805
#define TLSEXT_SIGALG_rsa_pss_sha512                            0x0806
#define TLSEXT_SIGALG_rsa_pkcs1_sha256                          0x0401
#define TLSEXT_SIGALG_rsa_pkcs1_sha384                          0x0501
#define TLSEXT_SIGALG_rsa_pkcs1_sha512                          0x0601
1871
#define TLSEXT_SIGALG_rsa_pkcs1_sha224                          0x0301
1872 1873 1874 1875
#define TLSEXT_SIGALG_rsa_pkcs1_sha1                            0x0201
#define TLSEXT_SIGALG_dsa_sha256                                0x0402
#define TLSEXT_SIGALG_dsa_sha384                                0x0502
#define TLSEXT_SIGALG_dsa_sha512                                0x0602
1876
#define TLSEXT_SIGALG_dsa_sha224                                0x0302
1877 1878 1879 1880 1881
#define TLSEXT_SIGALG_dsa_sha1                                  0x0202
#define TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256       0xeeee
#define TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512       0xefef
#define TLSEXT_SIGALG_gostr34102001_gostr3411                   0xeded

1882 1883
#define TLSEXT_SIGALG_ed25519                                   0x0807

1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894
/* Known PSK key exchange modes */
#define TLSEXT_KEX_MODE_KE                                      0x00
#define TLSEXT_KEX_MODE_KE_DHE                                  0x01

/*
 * Internal representations of key exchange modes
 */
#define TLSEXT_KEX_MODE_FLAG_NONE                               0
#define TLSEXT_KEX_MODE_FLAG_KE                                 1
#define TLSEXT_KEX_MODE_FLAG_KE_DHE                             2

1895 1896 1897
/* An invalid index into the TLSv1.3 PSK identities */
#define TLSEXT_PSK_BAD_IDENTITY                                 -1

1898 1899
#define SSL_USE_PSS(s) (s->s3->tmp.peer_sigalg != NULL && \
                        s->s3->tmp.peer_sigalg->sig == EVP_PKEY_RSA_PSS)
1900

1901 1902 1903
/* A dummy signature value not valid for TLSv1.2 signature algs */
#define TLSEXT_signature_rsa_pss                                0x0101

1904 1905 1906
/* TLSv1.3 downgrade protection sentinel values */
extern const unsigned char tls11downgrade[8];
extern const unsigned char tls12downgrade[8];
1907

1908
extern SSL3_ENC_METHOD ssl3_undef_enc_method;
U
Ulf Möller 已提交
1909

1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922
__owur const SSL_METHOD *ssl_bad_method(int ver);
__owur const SSL_METHOD *sslv3_method(void);
__owur const SSL_METHOD *sslv3_server_method(void);
__owur const SSL_METHOD *sslv3_client_method(void);
__owur const SSL_METHOD *tlsv1_method(void);
__owur const SSL_METHOD *tlsv1_server_method(void);
__owur const SSL_METHOD *tlsv1_client_method(void);
__owur const SSL_METHOD *tlsv1_1_method(void);
__owur const SSL_METHOD *tlsv1_1_server_method(void);
__owur const SSL_METHOD *tlsv1_1_client_method(void);
__owur const SSL_METHOD *tlsv1_2_method(void);
__owur const SSL_METHOD *tlsv1_2_server_method(void);
__owur const SSL_METHOD *tlsv1_2_client_method(void);
1923 1924 1925
__owur const SSL_METHOD *tlsv1_3_method(void);
__owur const SSL_METHOD *tlsv1_3_server_method(void);
__owur const SSL_METHOD *tlsv1_3_client_method(void);
1926 1927 1928
__owur const SSL_METHOD *dtlsv1_method(void);
__owur const SSL_METHOD *dtlsv1_server_method(void);
__owur const SSL_METHOD *dtlsv1_client_method(void);
1929
__owur const SSL_METHOD *dtls_bad_ver_client_method(void);
1930 1931 1932
__owur const SSL_METHOD *dtlsv1_2_method(void);
__owur const SSL_METHOD *dtlsv1_2_server_method(void);
__owur const SSL_METHOD *dtlsv1_2_client_method(void);
1933

B
Ben Laurie 已提交
1934 1935 1936
extern const SSL3_ENC_METHOD TLSv1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_2_enc_data;
1937
extern const SSL3_ENC_METHOD TLSv1_3_enc_data;
1938 1939 1940
extern const SSL3_ENC_METHOD SSLv3_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_2_enc_data;
1941

1942 1943 1944
/*
 * Flags for SSL methods
 */
E
Emilia Kasper 已提交
1945 1946
# define SSL_METHOD_NO_FIPS      (1U<<0)
# define SSL_METHOD_NO_SUITEB    (1U<<1)
1947 1948

# define IMPLEMENT_tls_meth_func(version, flags, mask, func_name, s_accept, \
1949
                                 s_connect, enc_data) \
1950
const SSL_METHOD *func_name(void)  \
1951 1952 1953
        { \
        static const SSL_METHOD func_name##_data= { \
                version, \
1954 1955
                flags, \
                mask, \
1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985
                tls1_new, \
                tls1_clear, \
                tls1_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                ssl3_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                ssl3_read_bytes, \
                ssl3_write_bytes, \
                ssl3_dispatch_alert, \
                ssl3_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
                ssl3_get_cipher, \
                tls1_default_timeout, \
                &enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

1986
# define IMPLEMENT_ssl3_meth_func(func_name, s_accept, s_connect) \
1987
const SSL_METHOD *func_name(void)  \
1988 1989 1990
        { \
        static const SSL_METHOD func_name##_data= { \
                SSL3_VERSION, \
1991 1992
                SSL_METHOD_NO_FIPS | SSL_METHOD_NO_SUITEB, \
                SSL_OP_NO_SSLv3, \
1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022
                ssl3_new, \
                ssl3_clear, \
                ssl3_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                ssl3_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                ssl3_read_bytes, \
                ssl3_write_bytes, \
                ssl3_dispatch_alert, \
                ssl3_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
                ssl3_get_cipher, \
                ssl3_default_timeout, \
                &SSLv3_enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

2023
# define IMPLEMENT_dtls1_meth_func(version, flags, mask, func_name, s_accept, \
2024
                                        s_connect, enc_data) \
2025
const SSL_METHOD *func_name(void)  \
2026 2027 2028
        { \
        static const SSL_METHOD func_name##_data= { \
                version, \
2029 2030
                flags, \
                mask, \
2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050
                dtls1_new, \
                dtls1_clear, \
                dtls1_free, \
                s_accept, \
                s_connect, \
                ssl3_read, \
                ssl3_peek, \
                ssl3_write, \
                dtls1_shutdown, \
                ssl3_renegotiate, \
                ssl3_renegotiate_check, \
                dtls1_read_bytes, \
                dtls1_write_app_data_bytes, \
                dtls1_dispatch_alert, \
                dtls1_ctrl, \
                ssl3_ctx_ctrl, \
                ssl3_get_cipher_by_char, \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
2051
                ssl3_get_cipher, \
2052 2053 2054 2055 2056 2057 2058 2059 2060 2061
                dtls1_default_timeout, \
                &enc_data, \
                ssl_undefined_void_function, \
                ssl3_callback_ctrl, \
                ssl3_ctx_callback_ctrl, \
        }; \
        return &func_name##_data; \
        }

struct openssl_ssl_test_functions {
M
Matt Caswell 已提交
2062
    int (*p_ssl_init_wbio_buffer) (SSL *s);
2063 2064 2065
    int (*p_ssl3_setup_buffers) (SSL *s);
};

2066
const char *ssl_protocol_to_string(int version);
2067

D
Dr. Stephen Henson 已提交
2068 2069 2070 2071 2072 2073 2074 2075 2076
/* Returns true if certificate and private key for 'idx' are present */
static ossl_inline int ssl_has_cert(const SSL *s, int idx)
{
    if (idx < 0 || idx >= SSL_PKEY_NUM)
        return 0;
    return s->cert->pkeys[idx].x509 != NULL
        && s->cert->pkeys[idx].privatekey != NULL;
}

2077
# ifndef OPENSSL_UNIT_TEST
2078

2079 2080
__owur int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes);
__owur int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written);
2081 2082
void ssl_clear_cipher_ctx(SSL *s);
int ssl_clear_bad_session(SSL *s);
M
Matt Caswell 已提交
2083 2084
__owur CERT *ssl_cert_new(void);
__owur CERT *ssl_cert_dup(CERT *cert);
2085
void ssl_cert_clear_certs(CERT *c);
2086
void ssl_cert_free(CERT *c);
M
Matt Caswell 已提交
2087
__owur int ssl_get_new_session(SSL *s, int session);
2088
__owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello, int *al);
2089
__owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
M
Matt Caswell 已提交
2090
__owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
2091
DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
M
Matt Caswell 已提交
2092
__owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
E
Emilia Kasper 已提交
2093
                                 const SSL_CIPHER *const *bp);
M
Matt Caswell 已提交
2094
__owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
E
Emilia Kasper 已提交
2095 2096 2097 2098 2099
                                                    STACK_OF(SSL_CIPHER) **pref,
                                                    STACK_OF(SSL_CIPHER)
                                                    **sorted,
                                                    const char *rule_str,
                                                    CERT *c);
2100 2101 2102 2103 2104 2105
__owur int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites,
                                int sslv2format, int *al);
__owur int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
                                STACK_OF(SSL_CIPHER) **skp,
                                STACK_OF(SSL_CIPHER) **scsvs, int sslv2format,
                                int *al);
2106
void ssl_update_cache(SSL *s, int mode);
M
Matt Caswell 已提交
2107
__owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
E
Emilia Kasper 已提交
2108
                              const EVP_MD **md, int *mac_pkey_type,
2109
                              size_t *mac_secret_size, SSL_COMP **comp,
E
Emilia Kasper 已提交
2110
                              int use_etm);
D
David Woodhouse 已提交
2111 2112 2113
__owur int ssl_cipher_get_overhead(const SSL_CIPHER *c, size_t *mac_overhead,
                                   size_t *int_overhead, size_t *blocksize,
                                   size_t *ext_overhead);
2114
__owur int ssl_cert_is_disabled(size_t idx);
E
Emilia Kasper 已提交
2115
__owur const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl,
2116 2117
                                                const unsigned char *ptr,
                                                int all);
M
Matt Caswell 已提交
2118 2119 2120 2121 2122 2123
__owur int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_set1_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_add0_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
__owur int ssl_cert_add1_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
__owur int ssl_cert_select_current(CERT *c, X509 *x);
__owur int ssl_cert_set_current(CERT *c, long arg);
E
Emilia Kasper 已提交
2124
void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg);
2125

M
Matt Caswell 已提交
2126 2127
__owur int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk);
__owur int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags);
E
Emilia Kasper 已提交
2128 2129
__owur int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain,
                                   int ref);
D
Dr. Stephen Henson 已提交
2130

R
Rich Salz 已提交
2131
__owur int ssl_randbytes(SSL *s, unsigned char *buf, size_t num);
K
Kurt Roeckx 已提交
2132
__owur int ssl_security(const SSL *s, int op, int bits, int nid, void *other);
E
Emilia Kasper 已提交
2133 2134
__owur int ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid,
                            void *other);
D
Dr. Stephen Henson 已提交
2135

2136 2137 2138 2139
__owur const SSL_CERT_LOOKUP *ssl_cert_lookup_by_pkey(const EVP_PKEY *pk,
                                                      size_t *pidx);
__owur const SSL_CERT_LOOKUP *ssl_cert_lookup_by_idx(size_t idx);

2140
int ssl_undefined_function(SSL *s);
M
Matt Caswell 已提交
2141 2142
__owur int ssl_undefined_void_function(void);
__owur int ssl_undefined_const_function(const SSL *s);
E
Emilia Kasper 已提交
2143 2144 2145
__owur int ssl_get_server_cert_serverinfo(SSL *s,
                                          const unsigned char **serverinfo,
                                          size_t *serverinfo_length);
2146
void ssl_set_masks(SSL *s);
M
Matt Caswell 已提交
2147 2148
__owur STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
__owur int ssl_verify_alarm_type(long type);
R
Rich Salz 已提交
2149
void ssl_sort_cipher_list(void);
2150
int ssl_load_ciphers(void);
E
Emilia Kasper 已提交
2151
__owur int ssl_fill_hello_random(SSL *s, int server, unsigned char *field,
2152
                                 size_t len, DOWNGRADE dgrd);
2153 2154
__owur int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
                                      int free_pms);
D
Dr. Stephen Henson 已提交
2155
__owur EVP_PKEY *ssl_generate_pkey(EVP_PKEY *pm);
2156 2157
__owur int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey,
                      int genmaster);
D
Dr. Stephen Henson 已提交
2158
__owur EVP_PKEY *ssl_dh_to_pkey(DH *dh);
2159

2160
__owur const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id);
2161
__owur const SSL_CIPHER *ssl3_get_cipher_by_std_name(const char *stdname);
M
Matt Caswell 已提交
2162
__owur const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
M
Matt Caswell 已提交
2163
__owur int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt,
2164
                                   size_t *len);
2165
int ssl3_init_finished_mac(SSL *s);
M
Matt Caswell 已提交
2166 2167
__owur int ssl3_setup_key_block(SSL *s);
__owur int ssl3_change_cipher_state(SSL *s, int which);
2168
void ssl3_cleanup_key_block(SSL *s);
M
Matt Caswell 已提交
2169
__owur int ssl3_do_write(SSL *s, int type);
2170
int ssl3_send_alert(SSL *s, int level, int desc);
M
Matt Caswell 已提交
2171
__owur int ssl3_generate_master_secret(SSL *s, unsigned char *out,
2172 2173
                                       unsigned char *p, size_t len,
                                       size_t *secret_size);
2174
__owur int ssl3_get_req_cert_type(SSL *s, WPACKET *pkt);
M
Matt Caswell 已提交
2175 2176
__owur int ssl3_num_ciphers(void);
__owur const SSL_CIPHER *ssl3_get_cipher(unsigned int u);
2177
int ssl3_renegotiate(SSL *ssl);
2178
int ssl3_renegotiate_check(SSL *ssl, int initok);
M
Matt Caswell 已提交
2179
__owur int ssl3_dispatch_alert(SSL *s);
2180
__owur size_t ssl3_final_finish_mac(SSL *s, const char *sender, size_t slen,
2181
                                    unsigned char *p);
M
Matt Caswell 已提交
2182
__owur int ssl3_finish_mac(SSL *s, const unsigned char *buf, size_t len);
2183
void ssl3_free_digest_list(SSL *s);
2184
__owur unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt,
2185
                                            CERT_PKEY *cpk, int *al);
2186 2187 2188
__owur const SSL_CIPHER *ssl3_choose_cipher(SSL *ssl,
                                            STACK_OF(SSL_CIPHER) *clnt,
                                            STACK_OF(SSL_CIPHER) *srvr);
2189
__owur int ssl3_digest_cached_records(SSL *s, int keep);
M
Matt Caswell 已提交
2190
__owur int ssl3_new(SSL *s);
2191
void ssl3_free(SSL *s);
2192 2193
__owur int ssl3_read(SSL *s, void *buf, size_t len, size_t *readbytes);
__owur int ssl3_peek(SSL *s, void *buf, size_t len, size_t *readbytes);
M
Matt Caswell 已提交
2194
__owur int ssl3_write(SSL *s, const void *buf, size_t len, size_t *written);
M
Matt Caswell 已提交
2195
__owur int ssl3_shutdown(SSL *s);
2196
int ssl3_clear(SSL *s);
M
Matt Caswell 已提交
2197 2198 2199 2200
__owur long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg);
__owur long ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg);
__owur long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void));
__owur long ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp) (void));
2201

M
Matt Caswell 已提交
2202 2203
__owur int ssl3_do_change_cipher_spec(SSL *ssl);
__owur long ssl3_default_timeout(void);
2204

M
Matt Caswell 已提交
2205
__owur int ssl3_set_handshake_header(SSL *s, WPACKET *pkt, int htype);
2206
__owur int tls_close_construct_packet(SSL *s, WPACKET *pkt, int htype);
2207
__owur int tls_setup_handshake(SSL *s);
M
Matt Caswell 已提交
2208
__owur int dtls1_set_handshake_header(SSL *s, WPACKET *pkt, int htype);
2209
__owur int dtls1_close_construct_packet(SSL *s, WPACKET *pkt, int htype);
M
Matt Caswell 已提交
2210 2211 2212 2213
__owur int ssl3_handshake_write(SSL *s);

__owur int ssl_allow_compression(SSL *s);

2214 2215
__owur int ssl_version_supported(const SSL *s, int version);

2216 2217 2218
__owur int ssl_set_client_hello_version(SSL *s);
__owur int ssl_check_version_downgrade(SSL *s);
__owur int ssl_set_version_bound(int method_version, int version, int *bound);
2219 2220
__owur int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello,
                                     DOWNGRADE *dgrd);
2221 2222
__owur int ssl_choose_client_version(SSL *s, int version, int checkdgrd,
                                     int *al);
2223
int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version);
2224

M
Matt Caswell 已提交
2225 2226 2227
__owur long tls1_default_timeout(void);
__owur int dtls1_do_write(SSL *s, int type);
void dtls1_set_message_header(SSL *s,
2228
                              unsigned char mt,
2229 2230
                              size_t len,
                              size_t frag_off, size_t frag_len);
M
Matt Caswell 已提交
2231

M
Matt Caswell 已提交
2232 2233
int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf_, size_t len,
                               size_t *written);
M
Matt Caswell 已提交
2234 2235 2236

__owur int dtls1_read_failed(SSL *s, int code);
__owur int dtls1_buffer_message(SSL *s, int ccs);
2237
__owur int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found);
M
Matt Caswell 已提交
2238
__owur int dtls1_get_queue_priority(unsigned short seq, int is_ccs);
M
Matt Caswell 已提交
2239
int dtls1_retransmit_buffered_messages(SSL *s);
2240 2241
void dtls1_clear_received_buffer(SSL *s);
void dtls1_clear_sent_buffer(SSL *s);
2242 2243
void dtls1_get_message_header(unsigned char *data,
                              struct hm_header_st *msg_hdr);
M
Matt Caswell 已提交
2244 2245 2246 2247
__owur long dtls1_default_timeout(void);
__owur struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft);
__owur int dtls1_check_timeout_num(SSL *s);
__owur int dtls1_handle_timeout(SSL *s);
2248 2249
void dtls1_start_timer(SSL *s);
void dtls1_stop_timer(SSL *s);
M
Matt Caswell 已提交
2250
__owur int dtls1_is_timer_expired(SSL *s);
2251
void dtls1_double_timeout(SSL *s);
2252
__owur int dtls_raw_hello_verify_request(WPACKET *pkt, unsigned char *cookie,
M
Matt Caswell 已提交
2253
                                         size_t cookie_len);
M
Matt Caswell 已提交
2254
__owur size_t dtls1_min_mtu(SSL *s);
2255
void dtls1_hm_fragment_free(hm_fragment *frag);
M
Matt Caswell 已提交
2256
__owur int dtls1_query_mtu(SSL *s);
2257

M
Matt Caswell 已提交
2258
__owur int tls1_new(SSL *s);
2259
void tls1_free(SSL *s);
2260
int tls1_clear(SSL *s);
2261

M
Matt Caswell 已提交
2262
__owur int dtls1_new(SSL *s);
B
Ben Laurie 已提交
2263
void dtls1_free(SSL *s);
2264
int dtls1_clear(SSL *s);
2265
long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg);
M
Matt Caswell 已提交
2266
__owur int dtls1_shutdown(SSL *s);
B
Ben Laurie 已提交
2267

M
Matt Caswell 已提交
2268
__owur int dtls1_dispatch_alert(SSL *s);
B
Ben Laurie 已提交
2269

M
Matt Caswell 已提交
2270
__owur int ssl_init_wbio_buffer(SSL *s);
2271
int ssl_free_wbio_buffer(SSL *s);
2272

M
Matt Caswell 已提交
2273 2274
__owur int tls1_change_cipher_state(SSL *s, int which);
__owur int tls1_setup_key_block(SSL *s);
2275
__owur size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen,
2276
                                    unsigned char *p);
M
Matt Caswell 已提交
2277
__owur int tls1_generate_master_secret(SSL *s, unsigned char *out,
2278 2279
                                       unsigned char *p, size_t len,
                                       size_t *secret_size);
2280 2281 2282
__owur int tls13_setup_key_block(SSL *s);
__owur size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
                                     unsigned char *p);
2283
__owur int tls13_change_cipher_state(SSL *s, int which);
2284
__owur int tls13_update_key(SSL *s, int send);
2285 2286
__owur int tls13_hkdf_expand(SSL *s, const EVP_MD *md,
                             const unsigned char *secret,
2287
                             const unsigned char *label, size_t labellen,
2288
                             const unsigned char *data, size_t datalen,
2289
                             unsigned char *out, size_t outlen);
2290 2291 2292 2293 2294 2295
__owur int tls13_derive_key(SSL *s, const EVP_MD *md,
                            const unsigned char *secret, unsigned char *key,
                            size_t keylen);
__owur int tls13_derive_iv(SSL *s, const EVP_MD *md,
                           const unsigned char *secret, unsigned char *iv,
                           size_t ivlen);
2296 2297 2298 2299 2300 2301 2302 2303
__owur int tls13_derive_finishedkey(SSL *s, const EVP_MD *md,
                                    const unsigned char *secret,
                                    unsigned char *fin, size_t finlen);
int tls13_generate_secret(SSL *s, const EVP_MD *md,
                          const unsigned char *prevsecret,
                          const unsigned char *insecret,
                          size_t insecretlen,
                          unsigned char *outsecret);
2304 2305 2306 2307 2308 2309
__owur int tls13_generate_handshake_secret(SSL *s,
                                           const unsigned char *insecret,
                                           size_t insecretlen);
__owur int tls13_generate_master_secret(SSL *s, unsigned char *out,
                                        unsigned char *prev, size_t prevlen,
                                        size_t *secret_size);
M
Matt Caswell 已提交
2310
__owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
E
Emilia Kasper 已提交
2311 2312 2313
                                       const char *label, size_t llen,
                                       const unsigned char *p, size_t plen,
                                       int use_context);
2314 2315 2316 2317
__owur int tls13_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                                        const char *label, size_t llen,
                                        const unsigned char *context,
                                        size_t contextlen, int use_context);
M
Matt Caswell 已提交
2318
__owur int tls1_alert_code(int code);
2319
__owur int tls13_alert_code(int code);
M
Matt Caswell 已提交
2320
__owur int ssl3_alert_code(int code);
2321

2322
#  ifndef OPENSSL_NO_EC
M
Matt Caswell 已提交
2323
__owur int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s);
2324
#  endif
B
Bodo Möller 已提交
2325

B
Ben Laurie 已提交
2326
SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
2327

2328
#  ifndef OPENSSL_NO_EC
2329 2330 2331 2332 2333 2334
/* Flags values from tls1_ec_curve_id2nid() */
/* Mask for curve type */
# define TLS_CURVE_TYPE          0x3
# define TLS_CURVE_PRIME         0x0
# define TLS_CURVE_CHAR2         0x1
# define TLS_CURVE_CUSTOM        0x2
M
Matt Caswell 已提交
2335 2336 2337

#define bytestogroup(bytes) ((unsigned int)(bytes[0] << 8 | bytes[1]))

2338
__owur int tls1_ec_curve_id2nid(int curve_id, unsigned int *pflags);
M
Matt Caswell 已提交
2339 2340
__owur int tls1_ec_nid2curve_id(int nid);
__owur int tls1_check_curve(SSL *s, const unsigned char *p, size_t len);
2341 2342
__owur int tls1_shared_group(SSL *s, int nmatch);
__owur int tls1_set_groups(unsigned char **pext, size_t *pextlen,
E
Emilia Kasper 已提交
2343
                           int *curves, size_t ncurves);
2344
__owur int tls1_set_groups_list(unsigned char **pext, size_t *pextlen,
E
Emilia Kasper 已提交
2345
                                const char *str);
2346 2347
void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
                         size_t *num_formats);
M
Matt Caswell 已提交
2348
__owur int tls1_check_ec_tmp_key(SSL *s, unsigned long id);
D
Dr. Stephen Henson 已提交
2349
__owur EVP_PKEY *ssl_generate_pkey_curve(int id);
2350
#  endif                        /* OPENSSL_NO_EC */
2351

2352 2353 2354 2355
__owur int tls_curve_allowed(SSL *s, const unsigned char *curve, int op);
__owur  int tls1_get_curvelist(SSL *s, int sess, const unsigned char **pcurves,
                               size_t *num_curves);

M
Matt Caswell 已提交
2356
__owur int tls1_set_server_sigalgs(SSL *s);
2357 2358 2359

/* Return codes for tls_get_ticket_from_client() and tls_decrypt_ticket() */
typedef enum ticket_en {
2360
    /* fatal error, malloc failure */
2361
    TICKET_FATAL_ERR_MALLOC,
2362
    /* fatal error, either from parsing or decrypting the ticket */
2363
    TICKET_FATAL_ERR_OTHER,
2364
    /* No ticket present */
2365
    TICKET_NONE,
2366
    /* Empty ticket present */
2367
    TICKET_EMPTY,
2368
    /* the ticket couldn't be decrypted */
2369
    TICKET_NO_DECRYPT,
2370
    /* a ticket was successfully decrypted */
2371
    TICKET_SUCCESS,
F
FdaSilvaYY 已提交
2372
    /* same as above but the ticket needs to be renewed */
2373 2374 2375 2376 2377 2378 2379 2380 2381
    TICKET_SUCCESS_RENEW
} TICKET_RETURN;

__owur TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
                                                SSL_SESSION **ret);
__owur TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
                                        size_t eticklen,
                                        const unsigned char *sess_id,
                                        size_t sesslen, SSL_SESSION **psess);
2382

2383
__owur int tls_use_ticket(SSL *s);
2384

2385
void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op);
2386

M
Matt Caswell 已提交
2387
__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
E
Emilia Kasper 已提交
2388 2389
__owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen,
                            int client);
M
Matt Caswell 已提交
2390
int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
2391
                     int idx);
2392
void tls1_set_cert_validity(SSL *s);
2393

E
Emilia Kasper 已提交
2394
#  ifndef OPENSSL_NO_CT
2395
__owur int ssl_validate_ct(SSL *s);
E
Emilia Kasper 已提交
2396
#  endif
2397

2398
#  ifndef OPENSSL_NO_DH
M
Matt Caswell 已提交
2399
__owur DH *ssl_get_auto_dh(SSL *s);
2400
#  endif
D
Dr. Stephen Henson 已提交
2401

M
Matt Caswell 已提交
2402
__owur int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee);
E
Emilia Kasper 已提交
2403 2404
__owur int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex,
                                   int vfy);
D
Dr. Stephen Henson 已提交
2405

2406
int tls_choose_sigalg(SSL *s, int *al);
2407

M
Matt Caswell 已提交
2408
__owur EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md);
2409
void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
M
Matt Caswell 已提交
2410
__owur long ssl_get_algorithm2(SSL *s);
M
Matt Caswell 已提交
2411
__owur int tls12_copy_sigalgs(SSL *s, WPACKET *pkt,
2412
                              const uint16_t *psig, size_t psiglen);
2413
__owur int tls1_save_sigalgs(SSL *s, PACKET *pkt);
M
Matt Caswell 已提交
2414
__owur int tls1_process_sigalgs(SSL *s);
2415
__owur int tls1_set_peer_legacy_sigalg(SSL *s, const EVP_PKEY *pkey);
2416
__owur int tls1_lookup_md(const SIGALG_LOOKUP *lu, const EVP_MD **pmd);
2417
__owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs);
2418
__owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey);
2419
void ssl_set_client_disabled(SSL *s);
2420
__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op, int echde);
2421

2422 2423
__owur int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
                                 size_t *hashlen);
2424
__owur const EVP_MD *ssl_md(int idx);
2425 2426
__owur const EVP_MD *ssl_handshake_md(SSL *s);
__owur const EVP_MD *ssl_prf_md(SSL *s);
2427

2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439
/*
 * ssl_log_rsa_client_key_exchange logs |premaster| to the SSL_CTX associated
 * with |ssl|, if logging is enabled. It returns one on success and zero on
 * failure. The entry is identified by the first 8 bytes of
 * |encrypted_premaster|.
 */
__owur int ssl_log_rsa_client_key_exchange(SSL *ssl,
                                           const uint8_t *encrypted_premaster,
                                           size_t encrypted_premaster_len,
                                           const uint8_t *premaster,
                                           size_t premaster_len);

2440 2441 2442 2443
/*
 * ssl_log_secret logs |secret| to the SSL_CTX associated with |ssl|, if
 * logging is available. It returns one on success and zero on failure. It tags
 * the entry with |label|.
2444
 */
2445 2446 2447 2448
__owur int ssl_log_secret(SSL *ssl, const char *label,
                          const uint8_t *secret, size_t secret_len);

#define MASTER_SECRET_LABEL "CLIENT_RANDOM"
2449
#define CLIENT_EARLY_LABEL "CLIENT_EARLY_TRAFFIC_SECRET"
2450 2451 2452 2453
#define CLIENT_HANDSHAKE_LABEL "CLIENT_HANDSHAKE_TRAFFIC_SECRET"
#define SERVER_HANDSHAKE_LABEL "SERVER_HANDSHAKE_TRAFFIC_SECRET"
#define CLIENT_APPLICATION_LABEL "CLIENT_TRAFFIC_SECRET_0"
#define SERVER_APPLICATION_LABEL "SERVER_TRAFFIC_SECRET_0"
2454

B
Ben Laurie 已提交
2455
/* s3_cbc.c */
M
Matt Caswell 已提交
2456
__owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
2457 2458 2459 2460 2461 2462 2463 2464
__owur int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
                                  unsigned char *md_out,
                                  size_t *md_out_size,
                                  const unsigned char header[13],
                                  const unsigned char *data,
                                  size_t data_plus_mac_size,
                                  size_t data_plus_mac_plus_padding_size,
                                  const unsigned char *mac_secret,
2465
                                  size_t mac_secret_length, char is_sslv3);
2466

2467 2468
__owur int srp_generate_server_master_secret(SSL *s);
__owur int srp_generate_client_master_secret(SSL *s);
M
Matt Caswell 已提交
2469
__owur int srp_verify_server_param(SSL *s, int *al);
D
Dr. Stephen Henson 已提交
2470

2471 2472
/* statem/extensions_cust.c */

2473 2474 2475
custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
                                   ENDPOINT role, unsigned int ext_type,
                                   size_t *idx);
D
Dr. Stephen Henson 已提交
2476

2477 2478
void custom_ext_init(custom_ext_methods *meths);

2479
__owur int custom_ext_parse(SSL *s, unsigned int context, unsigned int ext_type,
E
Emilia Kasper 已提交
2480
                            const unsigned char *ext_data, size_t ext_size,
2481 2482 2483
                            X509 *x, size_t chainidx, int *al);
__owur int custom_ext_add(SSL *s, int context, WPACKET *pkt, X509 *x,
                          size_t chainidx, int maxversion, int *al);
E
Emilia Kasper 已提交
2484 2485 2486

__owur int custom_exts_copy(custom_ext_methods *dst,
                            const custom_ext_methods *src);
2487 2488
__owur int custom_exts_copy_flags(custom_ext_methods *dst,
                                  const custom_ext_methods *src);
D
Dr. Stephen Henson 已提交
2489 2490
void custom_exts_free(custom_ext_methods *exts);

2491
void ssl_comp_free_compression_methods_int(void);
2492

2493
# else /* OPENSSL_UNIT_TEST */
2494

2495 2496
#  define ssl_init_wbio_buffer SSL_test_functions()->p_ssl_init_wbio_buffer
#  define ssl3_setup_buffers SSL_test_functions()->p_ssl3_setup_buffers
2497

2498
# endif
2499
#endif