New extension callback features.

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index c434b86a54e204c72fde6c7e2f62e9699da4ab7a..2a0d9283c0c4397d8c21f7c1e9f61bc528545b71 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -389,55 +389,23 @@ typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, i
 typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);
 
 #ifndef OPENSSL_NO_TLSEXT
 typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);
 
 #ifndef OPENSSL_NO_TLSEXT

-/* Callbacks and structures for handling custom TLS Extensions: 
- *   cli_ext_first_cb  - sends data for ClientHello TLS Extension
- *   cli_ext_second_cb - receives data from ServerHello TLS Extension
- *   srv_ext_first_cb  - receives data from ClientHello TLS Extension
- *   srv_ext_second_cb - sends data for ServerHello TLS Extension
- *
- *   All these functions return nonzero on success.  Zero will terminate
- *   the handshake (and return a specific TLS Fatal alert, if the function
- *   declaration has an "al" parameter).  -1 for the "sending" functions
- *   will cause the TLS Extension to be omitted.
- * 
- *   "ext_type" is a TLS "ExtensionType" from 0-65535.
- *   "in" is a pointer to TLS "extension_data" being provided to the cb.
- *   "out" is used by the callback to return a pointer to "extension data"
- *     which OpenSSL will later copy into the TLS handshake.  The contents
- *     of this buffer should not be changed until the handshake is complete.
- *   "inlen" and "outlen" are TLS Extension lengths from 0-65535.
- *   "al" is a TLS "AlertDescription" from 0-255 which WILL be sent as a 
- *     fatal TLS alert, if the callback returns zero.
- */
-typedef int (*custom_cli_ext_first_cb_fn)(SSL *s, unsigned short ext_type,
+
+/* Typedefs for handling custom extensions */
+
+typedef int (*custom_ext_add_cb)(SSL *s, unsigned int ext_type,

                                          const unsigned char **out,
                                          const unsigned char **out,

-                                         unsigned short *outlen, int *al, void *arg);
-typedef int (*custom_cli_ext_second_cb_fn)(SSL *s, unsigned short ext_type,
-                                          const unsigned char *in,
-                                          unsigned short inlen, int *al,
-                                          void *arg);
-
-typedef int (*custom_srv_ext_first_cb_fn)(SSL *s, unsigned short ext_type,
-                                         const unsigned char *in,
-                                         unsigned short inlen, int *al,
-                                         void *arg);
-typedef int (*custom_srv_ext_second_cb_fn)(SSL *s, unsigned short ext_type,
-                                          const unsigned char **out,
-                                          unsigned short *outlen, int *al, void *arg);
+                                         size_t *outlen, int *al,
+                                          void *add_arg);

 
 

-typedef struct {
-       unsigned short ext_type;
-       custom_cli_ext_first_cb_fn fn1; 
-       custom_cli_ext_second_cb_fn fn2; 
-       void *arg;
-} custom_cli_ext_record;
+typedef void (*custom_ext_free_cb)(SSL *s, unsigned int ext_type,
+                                          const unsigned char *out,
+                                          void *add_arg);
+
+typedef int (*custom_ext_parse_cb)(SSL *s, unsigned int ext_type,
+                                          const unsigned char *in,
+                                          size_t inlen, int *al,
+                                          void *parse_arg);

 
 

-typedef struct {
-       unsigned short ext_type;
-       custom_srv_ext_first_cb_fn fn1; 
-       custom_srv_ext_second_cb_fn fn2; 
-       void *arg;
-} custom_srv_ext_record;

 
 #endif
 
 
 #endif
 


@@ -1160,11 +1128,6 @@ struct ssl_ctx_st
        size_t tlsext_ellipticcurvelist_length;
        unsigned char *tlsext_ellipticcurvelist;
 # endif /* OPENSSL_NO_EC */
        size_t tlsext_ellipticcurvelist_length;
        unsigned char *tlsext_ellipticcurvelist;
 # endif /* OPENSSL_NO_EC */

-       /* Arrays containing the callbacks for custom TLS Extensions. */
-       custom_cli_ext_record *custom_cli_ext_records;
-       size_t custom_cli_ext_records_count;
-       custom_srv_ext_record *custom_srv_ext_records;
-       size_t custom_srv_ext_records_count;

        };
 
 #endif
        };
 
 #endif


@@ -1288,30 +1251,19 @@ const char *SSL_get_psk_identity(const SSL *s);
 #endif
 
 #ifndef OPENSSL_NO_TLSEXT
 #endif
 
 #ifndef OPENSSL_NO_TLSEXT

-/* Register callbacks to handle custom TLS Extensions as client or server.
- * 
- * Returns nonzero on success.  You cannot register twice for the same 
- * extension number, and registering for an extension number already 
- * handled by OpenSSL will succeed, but the callbacks will not be invoked.
- *
- * NULL can be registered for any callback function.  For the client
- * functions, a NULL custom_cli_ext_first_cb_fn sends an empty ClientHello
- * Extension, and a NULL custom_cli_ext_second_cb_fn ignores the ServerHello
- * response (if any).
- *
- * For the server functions, a NULL custom_srv_ext_first_cb_fn means the
- * ClientHello extension's data will be ignored, but the extension will still
- * be noted and custom_srv_ext_second_cb_fn will still be invoked.  A NULL
- * custom_srv_ext_second_cb doesn't send a ServerHello extension.
- */
-int SSL_CTX_set_custom_cli_ext(SSL_CTX *ctx, unsigned short ext_type,
-                              custom_cli_ext_first_cb_fn fn1, 
-                              custom_cli_ext_second_cb_fn fn2, void *arg);
+/* Register callbacks to handle custom TLS Extensions for client or server. */

 
 

-int SSL_CTX_set_custom_srv_ext(SSL_CTX *ctx, unsigned short ext_type,
-                              custom_srv_ext_first_cb_fn fn1, 
-                              custom_srv_ext_second_cb_fn fn2, void *arg);
+int SSL_CTX_set_custom_cli_ext(SSL_CTX *ctx, unsigned int ext_type,
+                              custom_ext_add_cb add_cb,
+                              custom_ext_free_cb free_cb,
+                               void *add_arg,
+                              custom_ext_parse_cb parse_cb, void *parse_arg);

 
 

+int SSL_CTX_set_custom_srv_ext(SSL_CTX *ctx, unsigned int ext_type,
+                              custom_ext_add_cb add_cb,
+                              custom_ext_free_cb free_cb,
+                               void *add_arg,
+                              custom_ext_parse_cb parse_cb, void *parse_arg);

 #endif
 
 #define SSL_NOTHING    1
 #endif
 
 #define SSL_NOTHING    1


@@ -2098,7 +2050,7 @@ void SSL_set_cert_cb(SSL *s, int (*cb)(SSL *ssl, void *arg), void *arg);
 #ifndef OPENSSL_NO_RSA
 int    SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);
 #endif
 #ifndef OPENSSL_NO_RSA
 int    SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);
 #endif

-int    SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len);
+int    SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, long len);

 int    SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);
 int    SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, const unsigned char *d, long len);
 int    SSL_use_certificate(SSL *ssl, X509 *x);
 int    SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);
 int    SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, const unsigned char *d, long len);
 int    SSL_use_certificate(SSL *ssl, X509 *x);


@@ -2570,6 +2522,10 @@ int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx))(SSL *s, SSL_CTX *ctx, i
 void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex);
 void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx);
 
 void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex);
 void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx);
 

+#ifndef OPENSSL_NO_UNIT_TEST
+const struct openssl_ssl_test_functions *SSL_test_functions(void);
+#endif
+

 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.


@@ -2849,6 +2805,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_BAD_SRP_B_LENGTH                          348
 #define SSL_R_BAD_SRP_G_LENGTH                          349
 #define SSL_R_BAD_SRP_N_LENGTH                          350
 #define SSL_R_BAD_SRP_B_LENGTH                          348
 #define SSL_R_BAD_SRP_G_LENGTH                          349
 #define SSL_R_BAD_SRP_N_LENGTH                          350

+#define SSL_R_BAD_SRP_PARAMETERS                        371

 #define SSL_R_BAD_SRP_S_LENGTH                          351
 #define SSL_R_BAD_SRTP_MKI_VALUE                        352
 #define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST          353
 #define SSL_R_BAD_SRP_S_LENGTH                          351
 #define SSL_R_BAD_SRTP_MKI_VALUE                        352
 #define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST          353


@@ -2910,7 +2867,6 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_ILLEGAL_PADDING                           283
 #define SSL_R_ILLEGAL_SUITEB_DIGEST                     380
 #define SSL_R_INCONSISTENT_COMPRESSION                  340
 #define SSL_R_ILLEGAL_PADDING                           283
 #define SSL_R_ILLEGAL_SUITEB_DIGEST                     380
 #define SSL_R_INCONSISTENT_COMPRESSION                  340

-#define SSL_R_INVALID_AUDIT_PROOF                       371

 #define SSL_R_INVALID_CHALLENGE_LENGTH                  158
 #define SSL_R_INVALID_COMMAND                           280
 #define SSL_R_INVALID_COMPRESSION_ALGORITHM             341
 #define SSL_R_INVALID_CHALLENGE_LENGTH                  158
 #define SSL_R_INVALID_COMMAND                           280
 #define SSL_R_INVALID_COMPRESSION_ALGORITHM             341


@@ -3057,6 +3013,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION        228
 #define SSL_R_SSL_HANDSHAKE_FAILURE                     229
 #define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS                230
 #define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION        228
 #define SSL_R_SSL_HANDSHAKE_FAILURE                     229
 #define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS                230

+#define SSL_R_SSL_NEGATIVE_LENGTH                       372

 #define SSL_R_SSL_SESSION_ID_CALLBACK_FAILED            301
 #define SSL_R_SSL_SESSION_ID_CONFLICT                   302
 #define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG           273
 #define SSL_R_SSL_SESSION_ID_CALLBACK_FAILED            301
 #define SSL_R_SSL_SESSION_ID_CONFLICT                   302
 #define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG           273


@@ -3086,7 +3043,6 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST            157
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG   234
 #define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST            157
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG   234

-#define SSL_R_TOO_MANY_EMPTY_FRAGMENTS                  393

 #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER           235
 #define SSL_R_UNABLE_TO_DECODE_DH_CERTS                         236
 #define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS               313
 #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER           235
 #define SSL_R_UNABLE_TO_DECODE_DH_CERTS                         236
 #define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS               313