X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssl_locl.h;h=27fba36748636c118df2e24dd1ebaa5806cefb97;hp=56d6108ea30b5dd62734ac802b802b57153d6259;hb=7a7048aff053929feaadee4895749fe0a661d353;hpb=b6ba401497001c2f042feff693ed292b21c8369c;ds=sidebyside diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 56d6108ea3..27fba36748 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -165,6 +165,10 @@ # include # include +#include "record/ssl3_buffer.h" +#include "record/ssl3_record.h" +#include "record/rec_layer.h" + # ifdef OPENSSL_BUILD_SHLIBSSL # undef OPENSSL_EXTERN # define OPENSSL_EXTERN OPENSSL_EXPORT @@ -597,6 +601,7 @@ struct ssl_method_st { * Ticket [10] EXPLICIT OCTET STRING, -- session ticket (clients only) * Compression_meth [11] EXPLICIT OCTET STRING, -- optional compression method * SRP_username [ 12 ] EXPLICIT OCTET STRING -- optional SRP username + * flags [ 13 ] EXPLICIT INTEGER -- optional flags * } * Look in ssl/ssl_asn1.c for more details * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-). @@ -669,13 +674,17 @@ struct ssl_session_st { /* RFC4507 info */ unsigned char *tlsext_tick; /* Session ticket */ size_t tlsext_ticklen; /* Session ticket length */ - long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */ + unsigned long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */ # endif # ifndef OPENSSL_NO_SRP char *srp_username; # endif + long flags; }; +/* Extended master secret support */ +# define SSL_SESS_FLAG_EXTMS 0x1 + # ifndef OPENSSL_NO_SRP @@ -1020,13 +1029,10 @@ struct ssl_st { * ssl3_get_message() */ int init_num; /* amount read/written */ int init_off; /* amount read/written */ - /* used internally to point at a raw packet */ - unsigned char *packet; - unsigned int packet_length; + struct ssl3_state_st *s3; /* SSLv3 variables */ struct dtls1_state_st *d1; /* DTLSv1 variables */ - int read_ahead; /* Read as many input bytes as possible (for - * non-blocking reads) */ + /* callback that allows applications to peek at protocol messages */ void (*msg_callback) (int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg); @@ -1212,60 +1218,10 @@ struct ssl_st { * basis, depending on the chosen cipher. */ int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure); + + RECORD_LAYER rlayer; }; -typedef struct ssl3_record_st { - /* type of record */ - /* - * r - */ int type; - /* How many bytes available */ - /* - * rw - */ unsigned int length; - /* - * How many bytes were available before padding was removed? This is used - * to implement the MAC check in constant time for CBC records. - */ - /* - * rw - */ unsigned int orig_len; - /* read/write offset into 'buf' */ - /* - * r - */ unsigned int off; - /* pointer to the record data */ - /* - * rw - */ unsigned char *data; - /* where the decode bytes are */ - /* - * rw - */ unsigned char *input; - /* only used with decompression - malloc()ed */ - /* - * r - */ unsigned char *comp; - /* epoch number, needed by DTLS1 */ - /* - * r - */ unsigned long epoch; - /* sequence number, needed by DTLS1 */ - /* - * r - */ unsigned char seq_num[8]; -} SSL3_RECORD; - -typedef struct ssl3_buffer_st { - /* at least SSL3_RT_MAX_PACKET_SIZE bytes, see ssl3_setup_buffers() */ - unsigned char *buf; - /* buffer size */ - size_t len; - /* where to 'copy from' */ - int offset; - /* how many bytes left */ - int left; -} SSL3_BUFFER; typedef struct ssl3_state_st { long flags; @@ -1283,10 +1239,6 @@ typedef struct ssl3_state_st { int empty_fragment_done; /* The value of 'extra' when the buffers were initialized */ int init_extra; - SSL3_BUFFER rbuf; /* read IO goes into here */ - SSL3_BUFFER wbuf; /* write IO goes into here */ - SSL3_RECORD rrec; /* each decoded record goes in here */ - SSL3_RECORD wrec; /* goes out from here */ /* * storage for Alert/Handshake protocol data received but not yet * processed by ssl3_read_bytes: @@ -1345,7 +1297,7 @@ typedef struct ssl3_state_st { # ifndef OPENSSL_NO_DH DH *dh; # endif -# ifndef OPENSSL_NO_ECDH +# ifndef OPENSSL_NO_EC EC_KEY *ecdh; /* holds short lived ECDH key */ # endif /* used when SSL_ST_FLUSH_DATA is entered */ @@ -1422,13 +1374,6 @@ typedef struct ssl3_state_st { /* Max MTU overhead we know about so far is 40 for IPv6 + 8 for UDP */ # define DTLS1_MAX_MTU_OVERHEAD 48 -typedef struct dtls1_bitmap_st { - unsigned long map; /* track 32 packets on 32-bit systems and 64 - * - on 64-bit systems */ - unsigned char max_seq_num[8]; /* max record number seen so far, 64-bit - * value in big-endian encoding */ -} DTLS1_BITMAP; - struct dtls1_retransmit_state { EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */ EVP_MD_CTX *write_hash; /* used for mac generation */ @@ -1465,11 +1410,6 @@ struct dtls1_timeout_st { unsigned int num_alerts; }; -typedef struct record_pqueue_st { - unsigned short epoch; - pqueue q; -} record_pqueue; - typedef struct hm_fragment_st { struct hm_header_st msg_header; unsigned char *fragment; @@ -1657,7 +1597,7 @@ typedef struct cert_st { DH *(*dh_tmp_cb) (SSL *ssl, int is_export, int keysize); int dh_tmp_auto; # endif -# ifndef OPENSSL_NO_ECDH +# ifndef OPENSSL_NO_EC EC_KEY *ecdh_tmp; /* Callback for generating ephemeral ECDH keys */ EC_KEY *(*ecdh_tmp_cb) (SSL *ssl, int is_export, int keysize); @@ -1674,6 +1614,9 @@ typedef struct cert_st { */ unsigned char *ctypes; size_t ctype_num; + /* Temporary storage for premaster secret */ + unsigned char *pms; + size_t pmslen; /* * signature algorithms peer reports: e.g. supported signature algorithms * extension for server or as part of a certificate request for client. @@ -1752,7 +1695,7 @@ typedef struct sess_cert_st { # ifndef OPENSSL_NO_DH DH *peer_dh_tmp; /* not used for SSL 2 */ # endif -# ifndef OPENSSL_NO_ECDH +# ifndef OPENSSL_NO_EC EC_KEY *peer_ecdh_tmp; # endif int references; /* actually always 1 at the moment */ @@ -1831,7 +1774,7 @@ typedef struct ssl3_enc_method { /* Handshake header length */ unsigned int hhlen; /* Set the handshake header */ - void (*set_handshake_header) (SSL *s, int type, unsigned long len); + int (*set_handshake_header) (SSL *s, int type, unsigned long len); /* Write out handshake message */ int (*do_write) (SSL *s); } SSL3_ENC_METHOD; @@ -2034,388 +1977,357 @@ const SSL_METHOD *func_name(void) \ struct openssl_ssl_test_functions { int (*p_ssl_init_wbio_buffer) (SSL *s, int push); int (*p_ssl3_setup_buffers) (SSL *s); - int (*p_tls1_process_heartbeat) (SSL *s); - int (*p_dtls1_process_heartbeat) (SSL *s); + int (*p_tls1_process_heartbeat) (SSL *s, + unsigned char *p, unsigned int length); + int (*p_dtls1_process_heartbeat) (SSL *s, + unsigned char *p, unsigned int length); }; # ifndef OPENSSL_UNIT_TEST void ssl_clear_cipher_ctx(SSL *s); int ssl_clear_bad_session(SSL *s); -CERT *ssl_cert_new(void); -CERT *ssl_cert_dup(CERT *cert); +__owur CERT *ssl_cert_new(void); +__owur CERT *ssl_cert_dup(CERT *cert); void ssl_cert_set_default_md(CERT *cert); -int ssl_cert_inst(CERT **o); void ssl_cert_clear_certs(CERT *c); void ssl_cert_free(CERT *c); -SESS_CERT *ssl_sess_cert_new(void); +__owur SESS_CERT *ssl_sess_cert_new(void); void ssl_sess_cert_free(SESS_CERT *sc); -int ssl_set_peer_cert_type(SESS_CERT *c, int type); -int ssl_get_new_session(SSL *s, int session); -int ssl_get_prev_session(SSL *s, unsigned char *session, int len, +__owur int ssl_set_peer_cert_type(SESS_CERT *c, int type); +__owur int ssl_get_new_session(SSL *s, int session); +__owur int ssl_get_prev_session(SSL *s, unsigned char *session, int len, const unsigned char *limit); -int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b); +__owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b); DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id); -int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, +__owur int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, const SSL_CIPHER *const *bp); -STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s, unsigned char *p, +__owur STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s, unsigned char *p, int num, STACK_OF(SSL_CIPHER) **skp); -int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, +__owur int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, unsigned char *p, int (*put_cb) (const SSL_CIPHER *, unsigned char *)); -STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth, +__owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth, STACK_OF(SSL_CIPHER) **pref, STACK_OF(SSL_CIPHER) **sorted, const char *rule_str, CERT *c); void ssl_update_cache(SSL *s, int mode); -int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, +__owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size, SSL_COMP **comp, int use_etm); -int ssl_get_handshake_digest(int i, long *mask, const EVP_MD **md); -int ssl_cipher_get_cert_index(const SSL_CIPHER *c); -const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr); -int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain); -int ssl_cert_set1_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain); -int ssl_cert_add0_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x); -int ssl_cert_add1_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x); -int ssl_cert_select_current(CERT *c, X509 *x); -int ssl_cert_set_current(CERT *c, long arg); -X509 *ssl_cert_get0_next_certificate(CERT *c, int first); +__owur int ssl_get_handshake_digest(int i, long *mask, const EVP_MD **md); +__owur int ssl_cipher_get_cert_index(const SSL_CIPHER *c); +__owur const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr); +__owur int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain); +__owur int ssl_cert_set1_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain); +__owur int ssl_cert_add0_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x); +__owur int ssl_cert_add1_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x); +__owur int ssl_cert_select_current(CERT *c, X509 *x); +__owur int ssl_cert_set_current(CERT *c, long arg); +__owur X509 *ssl_cert_get0_next_certificate(CERT *c, int first); void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg); -int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk); -int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l); -int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags); -int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref); +__owur int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk); +__owur int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l); +__owur int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags); +__owur int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref); -int ssl_security(SSL *s, int op, int bits, int nid, void *other); -int ssl_ctx_security(SSL_CTX *ctx, int op, int bits, int nid, void *other); +__owur int ssl_security(SSL *s, int op, int bits, int nid, void *other); +__owur int ssl_ctx_security(SSL_CTX *ctx, int op, int bits, int nid, void *other); int ssl_undefined_function(SSL *s); -int ssl_undefined_void_function(void); -int ssl_undefined_const_function(const SSL *s); -CERT_PKEY *ssl_get_server_send_pkey(const SSL *s); +__owur int ssl_undefined_void_function(void); +__owur int ssl_undefined_const_function(const SSL *s); +__owur CERT_PKEY *ssl_get_server_send_pkey(const SSL *s); # ifndef OPENSSL_NO_TLSEXT -int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo, +__owur int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo, size_t *serverinfo_length); # endif -EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *c, const EVP_MD **pmd); -int ssl_cert_type(X509 *x, EVP_PKEY *pkey); +__owur EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *c, const EVP_MD **pmd); +__owur int ssl_cert_type(X509 *x, EVP_PKEY *pkey); void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher); -STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s); -int ssl_verify_alarm_type(long type); +__owur STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s); +__owur int ssl_verify_alarm_type(long type); void ssl_load_ciphers(void); -int ssl_fill_hello_random(SSL *s, int server, unsigned char *field, int len); +__owur int ssl_fill_hello_random(SSL *s, int server, unsigned char *field, int len); -const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p); -int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p); +__owur const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p); +__owur int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p); void ssl3_init_finished_mac(SSL *s); -int ssl3_send_server_certificate(SSL *s); -int ssl3_send_newsession_ticket(SSL *s); -int ssl3_send_cert_status(SSL *s); -int ssl3_get_finished(SSL *s, int state_a, int state_b); -int ssl3_setup_key_block(SSL *s); -int ssl3_send_change_cipher_spec(SSL *s, int state_a, int state_b); -int ssl3_change_cipher_state(SSL *s, int which); +__owur int ssl3_send_server_certificate(SSL *s); +__owur int ssl3_send_newsession_ticket(SSL *s); +__owur int ssl3_send_cert_status(SSL *s); +__owur int ssl3_get_finished(SSL *s, int state_a, int state_b); +__owur int ssl3_setup_key_block(SSL *s); +__owur int ssl3_send_change_cipher_spec(SSL *s, int state_a, int state_b); +__owur int ssl3_change_cipher_state(SSL *s, int which); void ssl3_cleanup_key_block(SSL *s); -int ssl3_do_write(SSL *s, int type); +__owur int ssl3_do_write(SSL *s, int type); int ssl3_send_alert(SSL *s, int level, int desc); -int ssl3_generate_master_secret(SSL *s, unsigned char *out, +__owur int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, int len); -int ssl3_get_req_cert_type(SSL *s, unsigned char *p); -long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok); -int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen); -int ssl3_num_ciphers(void); -const SSL_CIPHER *ssl3_get_cipher(unsigned int u); +__owur int ssl3_get_req_cert_type(SSL *s, unsigned char *p); +__owur long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok); +__owur int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen); +__owur int ssl3_num_ciphers(void); +__owur const SSL_CIPHER *ssl3_get_cipher(unsigned int u); int ssl3_renegotiate(SSL *ssl); int ssl3_renegotiate_check(SSL *ssl); -int ssl3_dispatch_alert(SSL *s); -int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek); -int ssl3_write_bytes(SSL *s, int type, const void *buf, int len); -int ssl3_final_finish_mac(SSL *s, const char *sender, int slen, +__owur int ssl3_dispatch_alert(SSL *s); +__owur int ssl3_final_finish_mac(SSL *s, const char *sender, int slen, unsigned char *p); -int ssl3_cert_verify_mac(SSL *s, int md_nid, unsigned char *p); +__owur int ssl3_cert_verify_mac(SSL *s, int md_nid, unsigned char *p); void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len); -int ssl3_enc(SSL *s, int send_data); -int n_ssl3_mac(SSL *ssl, unsigned char *md, int send_data); void ssl3_free_digest_list(SSL *s); -unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk); -SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt, +__owur unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk); +__owur SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt, STACK_OF(SSL_CIPHER) *srvr); -int ssl3_setup_buffers(SSL *s); -int ssl3_setup_read_buffer(SSL *s); -int ssl3_setup_write_buffer(SSL *s); -int ssl3_release_read_buffer(SSL *s); -int ssl3_release_write_buffer(SSL *s); -int ssl3_digest_cached_records(SSL *s); -int ssl3_new(SSL *s); +__owur int ssl3_digest_cached_records(SSL *s); +__owur int ssl3_new(SSL *s); void ssl3_free(SSL *s); -int ssl3_accept(SSL *s); -int ssl3_connect(SSL *s); -int ssl3_read(SSL *s, void *buf, int len); -int ssl3_peek(SSL *s, void *buf, int len); -int ssl3_write(SSL *s, const void *buf, int len); -int ssl3_shutdown(SSL *s); +__owur int ssl3_accept(SSL *s); +__owur int ssl3_connect(SSL *s); +__owur int ssl3_read(SSL *s, void *buf, int len); +__owur int ssl3_peek(SSL *s, void *buf, int len); +__owur int ssl3_write(SSL *s, const void *buf, int len); +__owur int ssl3_shutdown(SSL *s); void ssl3_clear(SSL *s); -long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg); -long ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg); -long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void)); -long ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp) (void)); -int ssl3_pending(const SSL *s); +__owur long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg); +__owur long ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg); +__owur long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void)); +__owur long ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp) (void)); void ssl3_record_sequence_update(unsigned char *seq); -int ssl3_do_change_cipher_spec(SSL *ssl); -long ssl3_default_timeout(void); - -void ssl3_set_handshake_header(SSL *s, int htype, unsigned long len); -int ssl3_handshake_write(SSL *s); - -int ssl23_num_ciphers(void); -const SSL_CIPHER *ssl23_get_cipher(unsigned int u); -int ssl23_read(SSL *s, void *buf, int len); -int ssl23_peek(SSL *s, void *buf, int len); -int ssl23_write(SSL *s, const void *buf, int len); -int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p); -const SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p); -long ssl23_default_timeout(void); - -int ssl_allow_compression(SSL *s); - -long tls1_default_timeout(void); -int dtls1_do_write(SSL *s, int type); -int ssl3_read_n(SSL *s, int n, int max, int extend); -int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek); -int ssl3_do_compress(SSL *ssl); -int ssl3_do_uncompress(SSL *ssl); -int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, - unsigned int len); -unsigned char *dtls1_set_message_header(SSL *s, - unsigned char *p, unsigned char mt, - unsigned long len, - unsigned long frag_off, - unsigned long frag_len); - -int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf, int len); -int dtls1_write_bytes(SSL *s, int type, const void *buf, int len); - -int dtls1_send_change_cipher_spec(SSL *s, int a, int b); -int dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen); -int dtls1_read_failed(SSL *s, int code); -int dtls1_buffer_message(SSL *s, int ccs); -int dtls1_retransmit_message(SSL *s, unsigned short seq, +__owur int ssl3_do_change_cipher_spec(SSL *ssl); +__owur long ssl3_default_timeout(void); + +__owur int ssl3_set_handshake_header(SSL *s, int htype, unsigned long len); +__owur int ssl3_handshake_write(SSL *s); + +__owur int ssl23_num_ciphers(void); +__owur const SSL_CIPHER *ssl23_get_cipher(unsigned int u); +__owur int ssl23_read(SSL *s, void *buf, int len); +__owur int ssl23_peek(SSL *s, void *buf, int len); +__owur int ssl23_write(SSL *s, const void *buf, int len); +__owur int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p); +__owur const SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p); +__owur long ssl23_default_timeout(void); + +__owur int ssl_allow_compression(SSL *s); + +__owur long tls1_default_timeout(void); +__owur int dtls1_do_write(SSL *s, int type); +void dtls1_set_message_header(SSL *s, + unsigned char *p, unsigned char mt, + unsigned long len, + unsigned long frag_off, + unsigned long frag_len); + +__owur int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf, int len); +__owur int dtls1_write_bytes(SSL *s, int type, const void *buf, int len); + +__owur int dtls1_send_change_cipher_spec(SSL *s, int a, int b); +__owur int dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen); +__owur int dtls1_read_failed(SSL *s, int code); +__owur int dtls1_buffer_message(SSL *s, int ccs); +__owur int dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off, int *found); -int dtls1_get_queue_priority(unsigned short seq, int is_ccs); +__owur int dtls1_get_queue_priority(unsigned short seq, int is_ccs); int dtls1_retransmit_buffered_messages(SSL *s); void dtls1_clear_record_buffer(SSL *s); void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr); void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr); -void dtls1_reset_seq_numbers(SSL *s, int rw); -long dtls1_default_timeout(void); -struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft); -int dtls1_check_timeout_num(SSL *s); -int dtls1_handle_timeout(SSL *s); -const SSL_CIPHER *dtls1_get_cipher(unsigned int u); +__owur long dtls1_default_timeout(void); +__owur struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft); +__owur int dtls1_check_timeout_num(SSL *s); +__owur int dtls1_handle_timeout(SSL *s); +__owur const SSL_CIPHER *dtls1_get_cipher(unsigned int u); void dtls1_start_timer(SSL *s); void dtls1_stop_timer(SSL *s); -int dtls1_is_timer_expired(SSL *s); +__owur int dtls1_is_timer_expired(SSL *s); void dtls1_double_timeout(SSL *s); -int dtls1_send_newsession_ticket(SSL *s); -unsigned int dtls1_min_mtu(SSL *s); -unsigned int dtls1_link_min_mtu(void); +__owur int dtls1_send_newsession_ticket(SSL *s); +__owur unsigned int dtls1_min_mtu(SSL *s); +__owur unsigned int dtls1_link_min_mtu(void); void dtls1_hm_fragment_free(hm_fragment *frag); /* some client-only functions */ -int ssl3_client_hello(SSL *s); -int ssl3_get_server_hello(SSL *s); -int ssl3_get_certificate_request(SSL *s); -int ssl3_get_new_session_ticket(SSL *s); -int ssl3_get_cert_status(SSL *s); -int ssl3_get_server_done(SSL *s); -int ssl3_send_client_verify(SSL *s); -int ssl3_send_client_certificate(SSL *s); -int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey); -int ssl3_send_client_key_exchange(SSL *s); -int ssl3_get_key_exchange(SSL *s); -int ssl3_get_server_certificate(SSL *s); -int ssl3_check_cert_and_algorithm(SSL *s); +__owur int ssl3_client_hello(SSL *s); +__owur int ssl3_get_server_hello(SSL *s); +__owur int ssl3_get_certificate_request(SSL *s); +__owur int ssl3_get_new_session_ticket(SSL *s); +__owur int ssl3_get_cert_status(SSL *s); +__owur int ssl3_get_server_done(SSL *s); +__owur int ssl3_send_client_verify(SSL *s); +__owur int ssl3_send_client_certificate(SSL *s); +__owur int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey); +__owur int ssl3_send_client_key_exchange(SSL *s); +__owur int ssl3_get_key_exchange(SSL *s); +__owur int ssl3_get_server_certificate(SSL *s); +__owur int ssl3_check_cert_and_algorithm(SSL *s); # ifndef OPENSSL_NO_TLSEXT # ifndef OPENSSL_NO_NEXTPROTONEG -int ssl3_send_next_proto(SSL *s); +__owur int ssl3_send_next_proto(SSL *s); # endif # endif int dtls1_client_hello(SSL *s); /* some server-only functions */ -int ssl3_get_client_hello(SSL *s); -int ssl3_send_server_hello(SSL *s); -int ssl3_send_hello_request(SSL *s); -int ssl3_send_server_key_exchange(SSL *s); -int ssl3_send_certificate_request(SSL *s); -int ssl3_send_server_done(SSL *s); -int ssl3_get_client_certificate(SSL *s); -int ssl3_get_client_key_exchange(SSL *s); -int ssl3_get_cert_verify(SSL *s); +__owur int ssl3_get_client_hello(SSL *s); +__owur int ssl3_send_server_hello(SSL *s); +__owur int ssl3_send_hello_request(SSL *s); +__owur int ssl3_send_server_key_exchange(SSL *s); +__owur int ssl3_send_certificate_request(SSL *s); +__owur int ssl3_send_server_done(SSL *s); +__owur int ssl3_get_client_certificate(SSL *s); +__owur int ssl3_get_client_key_exchange(SSL *s); +__owur int ssl3_get_cert_verify(SSL *s); # ifndef OPENSSL_NO_NEXTPROTONEG -int ssl3_get_next_proto(SSL *s); +__owur int ssl3_get_next_proto(SSL *s); # endif -int ssl23_accept(SSL *s); -int ssl23_connect(SSL *s); -int ssl23_read_bytes(SSL *s, int n); -int ssl23_write_bytes(SSL *s); +__owur int ssl23_accept(SSL *s); +__owur int ssl23_connect(SSL *s); -int tls1_new(SSL *s); +__owur int tls1_new(SSL *s); void tls1_free(SSL *s); void tls1_clear(SSL *s); long tls1_ctrl(SSL *s, int cmd, long larg, void *parg); long tls1_callback_ctrl(SSL *s, int cmd, void (*fp) (void)); -int dtls1_new(SSL *s); -int dtls1_accept(SSL *s); -int dtls1_connect(SSL *s); +__owur int dtls1_new(SSL *s); +__owur int dtls1_accept(SSL *s); +__owur int dtls1_connect(SSL *s); void dtls1_free(SSL *s); void dtls1_clear(SSL *s); long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg); -int dtls1_shutdown(SSL *s); +__owur int dtls1_shutdown(SSL *s); -long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok); -int dtls1_get_record(SSL *s); -int do_dtls1_write(SSL *s, int type, const unsigned char *buf, - unsigned int len, int create_empty_fragement); -int dtls1_dispatch_alert(SSL *s); +__owur long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok); +__owur int dtls1_dispatch_alert(SSL *s); -int ssl_init_wbio_buffer(SSL *s, int push); +__owur int ssl_init_wbio_buffer(SSL *s, int push); void ssl_free_wbio_buffer(SSL *s); -int tls1_change_cipher_state(SSL *s, int which); -int tls1_setup_key_block(SSL *s); -int tls1_enc(SSL *s, int snd); -int tls1_final_finish_mac(SSL *s, +__owur int tls1_change_cipher_state(SSL *s, int which); +__owur int tls1_setup_key_block(SSL *s); +__owur int tls1_final_finish_mac(SSL *s, const char *str, int slen, unsigned char *p); -int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *p); -int tls1_mac(SSL *ssl, unsigned char *md, int snd); -int tls1_generate_master_secret(SSL *s, unsigned char *out, +__owur int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *p); +__owur int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, int len); -int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, +__owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, const char *label, size_t llen, const unsigned char *p, size_t plen, int use_context); -int tls1_alert_code(int code); -int ssl3_alert_code(int code); -int ssl_ok(SSL *s); +__owur int tls1_alert_code(int code); +__owur int ssl3_alert_code(int code); +__owur int ssl_ok(SSL *s); -# ifndef OPENSSL_NO_ECDH -int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s); +# ifndef OPENSSL_NO_EC +__owur int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s); # endif SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n); # ifndef OPENSSL_NO_EC -int tls1_ec_curve_id2nid(int curve_id); -int tls1_ec_nid2curve_id(int nid); -int tls1_check_curve(SSL *s, const unsigned char *p, size_t len); -int tls1_shared_curve(SSL *s, int nmatch); -int tls1_set_curves(unsigned char **pext, size_t *pextlen, +__owur int tls1_ec_curve_id2nid(int curve_id); +__owur int tls1_ec_nid2curve_id(int nid); +__owur int tls1_check_curve(SSL *s, const unsigned char *p, size_t len); +__owur int tls1_shared_curve(SSL *s, int nmatch); +__owur int tls1_set_curves(unsigned char **pext, size_t *pextlen, int *curves, size_t ncurves); -int tls1_set_curves_list(unsigned char **pext, size_t *pextlen, +__owur int tls1_set_curves_list(unsigned char **pext, size_t *pextlen, const char *str); -# ifndef OPENSSL_NO_ECDH -int tls1_check_ec_tmp_key(SSL *s, unsigned long id); -# endif /* OPENSSL_NO_ECDH */ +__owur int tls1_check_ec_tmp_key(SSL *s, unsigned long id); # endif /* OPENSSL_NO_EC */ # ifndef OPENSSL_NO_TLSEXT -int tls1_shared_list(SSL *s, +__owur int tls1_shared_list(SSL *s, const unsigned char *l1, size_t l1len, const unsigned char *l2, size_t l2len, int nmatch); -unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, +__owur unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al); -unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, +__owur unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al); -int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **data, +__owur int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n); -int tls1_set_server_sigalgs(SSL *s); -int ssl_check_clienthello_tlsext_late(SSL *s); -int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, +__owur int tls1_set_server_sigalgs(SSL *s); +__owur int ssl_check_clienthello_tlsext_late(SSL *s); +__owur int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n); -int ssl_prepare_clienthello_tlsext(SSL *s); -int ssl_prepare_serverhello_tlsext(SSL *s); +__owur int ssl_prepare_clienthello_tlsext(SSL *s); +__owur int ssl_prepare_serverhello_tlsext(SSL *s); # ifndef OPENSSL_NO_HEARTBEATS -int tls1_heartbeat(SSL *s); -int dtls1_heartbeat(SSL *s); -int tls1_process_heartbeat(SSL *s); -int dtls1_process_heartbeat(SSL *s); +__owur int tls1_heartbeat(SSL *s); +__owur int dtls1_heartbeat(SSL *s); +__owur int tls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length); +__owur int dtls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length); # endif -int tls1_process_ticket(SSL *s, unsigned char *session_id, int len, +__owur int tls1_process_ticket(SSL *s, unsigned char *session_id, int len, const unsigned char *limit, SSL_SESSION **ret); -int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, +__owur int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md); -int tls12_get_sigid(const EVP_PKEY *pk); -const EVP_MD *tls12_get_hash(unsigned char hash_alg); +__owur int tls12_get_sigid(const EVP_PKEY *pk); +__owur const EVP_MD *tls12_get_hash(unsigned char hash_alg); void ssl_set_sig_mask(unsigned long *pmask_a, SSL *s, int op); -int tls1_set_sigalgs_list(CERT *c, const char *str, int client); -int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, int client); +__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client); +__owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, int client); int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain, int idx); void tls1_set_cert_validity(SSL *s); # endif # ifndef OPENSSL_NO_DH -DH *ssl_get_auto_dh(SSL *s); +__owur DH *ssl_get_auto_dh(SSL *s); # endif -int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee); -int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex, int vfy); +__owur int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee); +__owur int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex, int vfy); -EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md); +__owur EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md); void ssl_clear_hash_ctx(EVP_MD_CTX **hash); -int ssl_add_serverhello_renegotiate_ext(SSL *s, unsigned char *p, int *len, +__owur int ssl_add_serverhello_renegotiate_ext(SSL *s, unsigned char *p, int *len, int maxlen); -int ssl_parse_serverhello_renegotiate_ext(SSL *s, unsigned char *d, int len, +__owur int ssl_parse_serverhello_renegotiate_ext(SSL *s, unsigned char *d, int len, int *al); -int ssl_add_clienthello_renegotiate_ext(SSL *s, unsigned char *p, int *len, +__owur int ssl_add_clienthello_renegotiate_ext(SSL *s, unsigned char *p, int *len, int maxlen); -int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len, +__owur int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len, int *al); -long ssl_get_algorithm2(SSL *s); -size_t tls12_copy_sigalgs(SSL *s, unsigned char *out, +__owur long ssl_get_algorithm2(SSL *s); +__owur size_t tls12_copy_sigalgs(SSL *s, unsigned char *out, const unsigned char *psig, size_t psiglen); -int tls1_save_sigalgs(SSL *s, const unsigned char *data, int dsize); -int tls1_process_sigalgs(SSL *s); -size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs); -int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s, +__owur int tls1_save_sigalgs(SSL *s, const unsigned char *data, int dsize); +__owur int tls1_process_sigalgs(SSL *s); +__owur size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs); +__owur int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s, const unsigned char *sig, EVP_PKEY *pkey); void ssl_set_client_disabled(SSL *s); -int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op); +__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op); -int ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, +__owur int ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen); -int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len, +__owur int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len, int *al); -int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, +__owur int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen); -int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len, +__owur int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len, int *al); +__owur int ssl_handshake_hash(SSL *s, unsigned char *out, int outlen); + /* s3_cbc.c */ -void ssl3_cbc_copy_mac(unsigned char *out, - const SSL3_RECORD *rec, unsigned md_size); -int ssl3_cbc_remove_padding(const SSL *s, - SSL3_RECORD *rec, - unsigned block_size, unsigned mac_size); -int tls1_cbc_remove_padding(const SSL *s, - SSL3_RECORD *rec, - unsigned block_size, unsigned mac_size); -char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx); +__owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx); void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char *md_out, size_t *md_out_size, @@ -2430,19 +2342,19 @@ void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len, size_t orig_len); -int srp_verify_server_param(SSL *s, int *al); +__owur int srp_verify_server_param(SSL *s, int *al); /* t1_ext.c */ void custom_ext_init(custom_ext_methods *meths); -int custom_ext_parse(SSL *s, int server, +__owur int custom_ext_parse(SSL *s, int server, unsigned int ext_type, const unsigned char *ext_data, size_t ext_size, int *al); -int custom_ext_add(SSL *s, int server, +__owur int custom_ext_add(SSL *s, int server, unsigned char **pret, unsigned char *limit, int *al); -int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src); +__owur int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src); void custom_exts_free(custom_ext_methods *exts); # else