X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssl_locl.h;h=655783426565460180b38442e80abc0b79240d98;hp=099f8ccadc6cb9a8cbdfb7effe6ec21b326271d9;hb=9195ddcd0fd810de755893571eebe459485bf8c4;hpb=7d061fced39d72bd664d04e254c1e3ba6cf99fbc diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 099f8ccadc..6557834265 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -395,7 +395,8 @@ # define SSL_CLIENT_USE_SIGALGS(s) \ SSL_CLIENT_USE_TLS1_2_CIPHERS(s) -# define SSL_USE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) +# define SSL_READ_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_READ) +# define SSL_WRITE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE) /* Mostly for SSLv3 */ # define SSL_PKEY_RSA 0 @@ -985,6 +986,8 @@ struct ssl_st { unsigned char client_finished_secret[EVP_MAX_MD_SIZE]; unsigned char server_finished_secret[EVP_MAX_MD_SIZE]; unsigned char server_finished_hash[EVP_MAX_MD_SIZE]; + unsigned char client_app_traffic_secret[EVP_MAX_MD_SIZE]; + unsigned char server_app_traffic_secret[EVP_MAX_MD_SIZE]; EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */ unsigned char read_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static read IV */ EVP_MD_CTX *read_hash; /* used for mac generation */ @@ -993,6 +996,8 @@ struct ssl_st { EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */ unsigned char write_iv[EVP_MAX_IV_LENGTH]; /* TLSv1.3 static write IV */ EVP_MD_CTX *write_hash; /* used for mac generation */ + /* Count of how many KeyUpdate messages we have received */ + unsigned int key_update_count; /* session info */ /* client cert? */ /* This is used to hold the server certificate used */ @@ -1132,6 +1137,9 @@ struct ssl_st { /* The available PSK key exchange modes */ int psk_kex_mode; + + /* Set to one if we have negotiated ETM */ + int use_etm; } ext; /*- @@ -1168,6 +1176,8 @@ struct ssl_st { * (i.e. not just sending a HelloRequest) */ int renegotiate; + /* If sending a KeyUpdate is pending */ + int key_update; # ifndef OPENSSL_NO_SRP /* ctx for SRP authentication */ SRP_CTX srp_ctx; @@ -1213,6 +1223,8 @@ typedef struct sigalg_lookup_st { int curve; } SIGALG_LOOKUP; +typedef struct cert_pkey_st CERT_PKEY; + typedef struct ssl3_state_st { long flags; size_t read_mac_secret_size; @@ -1296,8 +1308,8 @@ typedef struct ssl3_state_st { # endif /* Signature algorithm we actually use */ const SIGALG_LOOKUP *sigalg; - /* Index of certificate we use */ - int cert_idx; + /* Pointer to certificate we use */ + CERT_PKEY *cert; /* * signature algorithms peer reports: e.g. supported signature * algorithms extension for server or as part of a certificate @@ -1308,8 +1320,6 @@ typedef struct ssl3_state_st { size_t peer_sigalgslen; /* Sigalg peer actualy uses */ const SIGALG_LOOKUP *peer_sigalg; - /* Array of digests used for signing */ - const EVP_MD *md[SSL_PKEY_NUM]; /* * Set if corresponding CERT_PKEY can be used with current * SSL session: e.g. appropriate curve, signature algorithms etc. @@ -1491,7 +1501,7 @@ typedef struct dtls1_state_st { # define NAMED_CURVE_TYPE 3 # endif /* OPENSSL_NO_EC */ -typedef struct cert_pkey_st { +struct cert_pkey_st { X509 *x509; EVP_PKEY *privatekey; /* Chain for this certificate */ @@ -1505,7 +1515,7 @@ typedef struct cert_pkey_st { */ unsigned char *serverinfo; size_t serverinfo_length; -} CERT_PKEY; +}; /* Retrieve Suite B flags */ # define tls1_suiteb(s) (s->cert->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS) /* Uses to check strict mode: suite B modes are always strict */ @@ -1950,6 +1960,15 @@ struct openssl_ssl_test_functions { const char *ssl_protocol_to_string(int version); +/* Returns true if certificate and private key for 'idx' are present */ +static ossl_inline int ssl_has_cert(const SSL *s, int idx) +{ + if (idx < 0 || idx >= SSL_PKEY_NUM) + return 0; + return s->cert->pkeys[idx].x509 != NULL + && s->cert->pkeys[idx].privatekey != NULL; +} + # ifndef OPENSSL_UNIT_TEST void ssl_clear_cipher_ctx(SSL *s); @@ -2003,12 +2022,9 @@ __owur int ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid, int ssl_undefined_function(SSL *s); __owur int ssl_undefined_void_function(void); __owur int ssl_undefined_const_function(const SSL *s); -__owur CERT_PKEY *ssl_get_server_send_pkey(SSL *s); __owur int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo, size_t *serverinfo_length); -__owur EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *c, - const EVP_MD **pmd); __owur int ssl_cert_type(const X509 *x, const EVP_PKEY *pkey); void ssl_set_masks(SSL *s); __owur STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s); @@ -2149,6 +2165,7 @@ __owur int tls13_setup_key_block(SSL *s); __owur size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen, unsigned char *p); __owur int tls13_change_cipher_state(SSL *s, int which); +__owur int tls13_update_key(SSL *s, int send); __owur int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret, const unsigned char *label, size_t labellen, @@ -2194,6 +2211,9 @@ SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n); # define TLS_CURVE_PRIME 0x0 # define TLS_CURVE_CHAR2 0x1 # define TLS_CURVE_CUSTOM 0x2 + +#define bytestogroup(bytes) ((unsigned int)(bytes[0] << 8 | bytes[1])) + __owur int tls1_ec_curve_id2nid(int curve_id, unsigned int *pflags); __owur int tls1_ec_nid2curve_id(int nid); __owur int tls1_check_curve(SSL *s, const unsigned char *p, size_t len); @@ -2245,8 +2265,6 @@ __owur TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, __owur int tls_use_ticket(SSL *s); -__owur int tls12_get_sigandhash(SSL *s, WPACKET *pkt, const EVP_PKEY *pk, - const EVP_MD *md, int *ispss); void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op); __owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client); @@ -2268,7 +2286,7 @@ __owur int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee); __owur int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex, int vfy); -int tls_choose_sigalg(SSL *s); +int tls_choose_sigalg(SSL *s, int *al); __owur EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md); void ssl_clear_hash_ctx(EVP_MD_CTX **hash); @@ -2277,6 +2295,7 @@ __owur int tls12_copy_sigalgs(SSL *s, WPACKET *pkt, const uint16_t *psig, size_t psiglen); __owur int tls1_save_sigalgs(SSL *s, PACKET *pkt); __owur int tls1_process_sigalgs(SSL *s); +__owur int tls1_set_peer_legacy_sigalg(SSL *s, const EVP_PKEY *pkey); __owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs); __owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey); void ssl_set_client_disabled(SSL *s);