X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssl_locl.h;h=f9c4e127f4f2e7cf725bee1e08d05291e436c76a;hp=cd844ad935cd95740f72467a510f5bd06b8b40b5;hb=857048a7f339913fc4e510ddf033878850c655cd;hpb=4bcdb4a6019e57b3de077b17940e18befe745531 diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index cd844ad935..f9c4e127f4 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -165,6 +165,8 @@ # include # include +#include "record/record.h" + # ifdef OPENSSL_BUILD_SHLIBSSL # undef OPENSSL_EXTERN # define OPENSSL_EXTERN OPENSSL_EXPORT @@ -298,8 +300,6 @@ # define SSL_kDHE 0x00000008L /* synonym */ # define SSL_kEDH SSL_kDHE -/* Kerberos5 key exchange */ -# define SSL_kKRB5 0x00000010L /* ECDH cert, RSA CA cert */ # define SSL_kECDHr 0x00000020L /* ECDH cert, ECDSA CA cert */ @@ -326,8 +326,6 @@ # define SSL_aDH 0x00000008L /* Fixed ECDH auth (kECDHe or kECDHr) */ # define SSL_aECDH 0x00000010L -/* KRB5 auth */ -# define SSL_aKRB5 0x00000020L /* ECDSA auth*/ # define SSL_aECDSA 0x00000040L /* PSK auth */ @@ -583,7 +581,6 @@ struct ssl_method_st { * Cipher OCTET STRING, -- the 3 byte cipher ID * Session_ID OCTET STRING, -- the Session ID * Master_key OCTET STRING, -- the master key - * KRB5_principal OCTET STRING -- optional Kerberos principal * Key_Arg [ 0 ] IMPLICIT OCTET STRING, -- the optional Key argument * Time [ 1 ] EXPLICIT INTEGER, -- optional Start Time * Timeout [ 2 ] EXPLICIT INTEGER, -- optional Timeout ins seconds @@ -617,10 +614,6 @@ struct ssl_session_st { */ unsigned int sid_ctx_length; unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH]; -# ifndef OPENSSL_NO_KRB5 - unsigned int krb5_client_princ_len; - unsigned char krb5_client_princ[SSL_MAX_KRB5_PRINCIPAL_LENGTH]; -# endif /* OPENSSL_NO_KRB5 */ # ifndef OPENSSL_NO_PSK char *psk_identity_hint; char *psk_identity; @@ -703,15 +696,12 @@ typedef struct srp_ctx_st { # endif +typedef struct ssl_comp_st SSL_COMP; struct ssl_comp_st { int id; const char *name; -# ifndef OPENSSL_NO_COMP COMP_METHOD *method; -# else - char *method; -# endif }; DECLARE_STACK_OF(SSL_COMP) @@ -1018,20 +1008,15 @@ struct ssl_st { int shutdown; /* where we are */ int state; - /* where we are when reading */ - int rstate; BUF_MEM *init_buf; /* buffer used during init */ void *init_msg; /* pointer to handshake message body, set by * ssl3_get_message() */ int init_num; /* amount read/written */ int init_off; /* amount read/written */ - /* used internally to point at a raw packet */ - unsigned char *packet; - unsigned int packet_length; + struct ssl3_state_st *s3; /* SSLv3 variables */ struct dtls1_state_st *d1; /* DTLSv1 variables */ - int read_ahead; /* Read as many input bytes as possible (for - * non-blocking reads) */ + /* callback that allows applications to peek at protocol messages */ void (*msg_callback) (int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg); @@ -1048,18 +1033,10 @@ struct ssl_st { int mac_flags; EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */ EVP_MD_CTX *read_hash; /* used for mac generation */ -# ifndef OPENSSL_NO_COMP + COMP_CTX *compress; /* compression */ COMP_CTX *expand; /* uncompress */ -# else - char *expand; -# endif EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */ EVP_MD_CTX *write_hash; /* used for mac generation */ -# ifndef OPENSSL_NO_COMP - COMP_CTX *compress; /* compression */ -# else - char *compress; -# endif /* session info */ /* client cert? */ /* This is used to hold the server certificate used */ @@ -1088,10 +1065,6 @@ struct ssl_st { int error; /* actual code */ int error_code; -# ifndef OPENSSL_NO_KRB5 - /* Kerberos 5 context */ - KSSL_CTX *kssl_ctx; -# endif /* OPENSSL_NO_KRB5 */ # ifndef OPENSSL_NO_PSK unsigned int (*psk_client_callback) (SSL *ssl, const char *hint, char *identity, @@ -1217,68 +1190,16 @@ struct ssl_st { * basis, depending on the chosen cipher. */ int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure); + + RECORD_LAYER rlayer; }; -typedef struct ssl3_record_st { - /* type of record */ - /* - * r - */ int type; - /* How many bytes available */ - /* - * rw - */ unsigned int length; - /* - * How many bytes were available before padding was removed? This is used - * to implement the MAC check in constant time for CBC records. - */ - /* - * rw - */ unsigned int orig_len; - /* read/write offset into 'buf' */ - /* - * r - */ unsigned int off; - /* pointer to the record data */ - /* - * rw - */ unsigned char *data; - /* where the decode bytes are */ - /* - * rw - */ unsigned char *input; - /* only used with decompression - malloc()ed */ - /* - * r - */ unsigned char *comp; - /* epoch number, needed by DTLS1 */ - /* - * r - */ unsigned long epoch; - /* sequence number, needed by DTLS1 */ - /* - * r - */ unsigned char seq_num[8]; -} SSL3_RECORD; - -typedef struct ssl3_buffer_st { - /* at least SSL3_RT_MAX_PACKET_SIZE bytes, see ssl3_setup_buffers() */ - unsigned char *buf; - /* buffer size */ - size_t len; - /* where to 'copy from' */ - int offset; - /* how many bytes left */ - int left; -} SSL3_BUFFER; typedef struct ssl3_state_st { long flags; int delay_buf_pop_ret; - unsigned char read_sequence[8]; int read_mac_secret_size; unsigned char read_mac_secret[EVP_MAX_MD_SIZE]; - unsigned char write_sequence[8]; int write_mac_secret_size; unsigned char write_mac_secret[EVP_MAX_MD_SIZE]; unsigned char server_random[SSL3_RANDOM_SIZE]; @@ -1288,24 +1209,6 @@ typedef struct ssl3_state_st { int empty_fragment_done; /* The value of 'extra' when the buffers were initialized */ int init_extra; - SSL3_BUFFER rbuf; /* read IO goes into here */ - SSL3_BUFFER wbuf; /* write IO goes into here */ - SSL3_RECORD rrec; /* each decoded record goes in here */ - SSL3_RECORD wrec; /* goes out from here */ - /* - * storage for Alert/Handshake protocol data received but not yet - * processed by ssl3_read_bytes: - */ - unsigned char alert_fragment[2]; - unsigned int alert_fragment_len; - unsigned char handshake_fragment[4]; - unsigned int handshake_fragment_len; - /* partial write - check the numbers match */ - unsigned int wnum; /* number of bytes sent so far */ - int wpend_tot; /* number bytes written */ - int wpend_type; - int wpend_ret; /* number of bytes submitted */ - const unsigned char *wpend_buf; /* used during startup, digest all incoming/outgoing packets */ BIO *handshake_buffer; /* @@ -1427,21 +1330,10 @@ typedef struct ssl3_state_st { /* Max MTU overhead we know about so far is 40 for IPv6 + 8 for UDP */ # define DTLS1_MAX_MTU_OVERHEAD 48 -typedef struct dtls1_bitmap_st { - unsigned long map; /* track 32 packets on 32-bit systems and 64 - * - on 64-bit systems */ - unsigned char max_seq_num[8]; /* max record number seen so far, 64-bit - * value in big-endian encoding */ -} DTLS1_BITMAP; - struct dtls1_retransmit_state { EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */ EVP_MD_CTX *write_hash; /* used for mac generation */ -# ifndef OPENSSL_NO_COMP COMP_CTX *compress; /* compression */ -# else - char *compress; -# endif SSL_SESSION *session; unsigned short epoch; }; @@ -1470,11 +1362,6 @@ struct dtls1_timeout_st { unsigned int num_alerts; }; -typedef struct record_pqueue_st { - unsigned short epoch; - pqueue q; -} record_pqueue; - typedef struct hm_fragment_st { struct hm_header_st msg_header; unsigned char *fragment; @@ -1486,36 +1373,17 @@ typedef struct dtls1_state_st { unsigned char cookie[DTLS1_COOKIE_LENGTH]; unsigned char rcvd_cookie[DTLS1_COOKIE_LENGTH]; unsigned int cookie_len; - /* - * The current data and handshake epoch. This is initially - * undefined, and starts at zero once the initial handshake is - * completed - */ - unsigned short r_epoch; - unsigned short w_epoch; - /* records being received in the current epoch */ - DTLS1_BITMAP bitmap; - /* renegotiation starts a new set of sequence numbers */ - DTLS1_BITMAP next_bitmap; + /* handshake message numbers */ unsigned short handshake_write_seq; unsigned short next_handshake_write_seq; unsigned short handshake_read_seq; - /* save last sequence number for retransmissions */ - unsigned char last_write_sequence[8]; - /* Received handshake records (processed and unprocessed) */ - record_pqueue unprocessed_rcds; - record_pqueue processed_rcds; + /* Buffered handshake messages */ pqueue buffered_messages; /* Buffered (sent) handshake records */ pqueue sent_messages; - /* - * Buffered application records. Only for records between CCS and - * Finished to prevent either protocol violation or unnecessary message - * loss. - */ - record_pqueue buffered_app_data; + /* Is set when listening for new connections with dtls1_listen() */ unsigned int listen; unsigned int link_mtu; /* max on-the-wire DTLS packet size */ @@ -1529,14 +1397,7 @@ typedef struct dtls1_state_st { struct timeval next_timeout; /* Timeout duration */ unsigned short timeout_duration; - /* - * storage for Alert/Handshake protocol data received but not yet - * processed by ssl3_read_bytes: - */ - unsigned char alert_fragment[DTLS1_AL_HEADER_LENGTH]; - unsigned int alert_fragment_len; - unsigned char handshake_fragment[DTLS1_HM_HEADER_LENGTH]; - unsigned int handshake_fragment_len; + unsigned int retransmitting; /* * Set when the handshake is ready to process peer's ChangeCipherSpec message. @@ -1550,15 +1411,6 @@ typedef struct dtls1_state_st { # endif } DTLS1_STATE; -typedef struct dtls1_record_data_st { - unsigned char *packet; - unsigned int packet_length; - SSL3_BUFFER rbuf; - SSL3_RECORD rrec; -# ifndef OPENSSL_NO_SCTP - struct bio_dgram_sctp_rcvinfo recordinfo; -# endif -} DTLS1_RECORD_DATA; # ifndef OPENSSL_NO_EC @@ -1839,7 +1691,7 @@ typedef struct ssl3_enc_method { /* Handshake header length */ unsigned int hhlen; /* Set the handshake header */ - void (*set_handshake_header) (SSL *s, int type, unsigned long len); + int (*set_handshake_header) (SSL *s, int type, unsigned long len); /* Write out handshake message */ int (*do_write) (SSL *s); } SSL3_ENC_METHOD; @@ -2042,8 +1894,10 @@ const SSL_METHOD *func_name(void) \ struct openssl_ssl_test_functions { int (*p_ssl_init_wbio_buffer) (SSL *s, int push); int (*p_ssl3_setup_buffers) (SSL *s); - int (*p_tls1_process_heartbeat) (SSL *s); - int (*p_dtls1_process_heartbeat) (SSL *s); + int (*p_tls1_process_heartbeat) (SSL *s, + unsigned char *p, unsigned int length); + int (*p_dtls1_process_heartbeat) (SSL *s, + unsigned char *p, unsigned int length); }; # ifndef OPENSSL_UNIT_TEST @@ -2140,23 +1994,14 @@ __owur const SSL_CIPHER *ssl3_get_cipher(unsigned int u); int ssl3_renegotiate(SSL *ssl); int ssl3_renegotiate_check(SSL *ssl); __owur int ssl3_dispatch_alert(SSL *s); -__owur int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek); -__owur int ssl3_write_bytes(SSL *s, int type, const void *buf, int len); __owur int ssl3_final_finish_mac(SSL *s, const char *sender, int slen, unsigned char *p); __owur int ssl3_cert_verify_mac(SSL *s, int md_nid, unsigned char *p); void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len); -__owur int ssl3_enc(SSL *s, int send_data); -__owur int n_ssl3_mac(SSL *ssl, unsigned char *md, int send_data); void ssl3_free_digest_list(SSL *s); __owur unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk); __owur SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt, STACK_OF(SSL_CIPHER) *srvr); -__owur int ssl3_setup_buffers(SSL *s); -__owur int ssl3_setup_read_buffer(SSL *s); -__owur int ssl3_setup_write_buffer(SSL *s); -int ssl3_release_read_buffer(SSL *s); -int ssl3_release_write_buffer(SSL *s); __owur int ssl3_digest_cached_records(SSL *s); __owur int ssl3_new(SSL *s); void ssl3_free(SSL *s); @@ -2171,13 +2016,11 @@ __owur long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg); __owur long ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg); __owur long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void)); __owur long ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp) (void)); -__owur int ssl3_pending(const SSL *s); -void ssl3_record_sequence_update(unsigned char *seq); __owur int ssl3_do_change_cipher_spec(SSL *ssl); __owur long ssl3_default_timeout(void); -void ssl3_set_handshake_header(SSL *s, int htype, unsigned long len); +__owur int ssl3_set_handshake_header(SSL *s, int htype, unsigned long len); __owur int ssl3_handshake_write(SSL *s); __owur int ssl23_num_ciphers(void); @@ -2193,12 +2036,6 @@ __owur int ssl_allow_compression(SSL *s); __owur long tls1_default_timeout(void); __owur int dtls1_do_write(SSL *s, int type); -__owur int ssl3_read_n(SSL *s, int n, int max, int extend); -__owur int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek); -__owur int ssl3_do_compress(SSL *ssl); -__owur int ssl3_do_uncompress(SSL *ssl); -__owur int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, - unsigned int len); void dtls1_set_message_header(SSL *s, unsigned char *p, unsigned char mt, unsigned long len, @@ -2206,21 +2043,18 @@ void dtls1_set_message_header(SSL *s, unsigned long frag_len); __owur int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf, int len); -__owur int dtls1_write_bytes(SSL *s, int type, const void *buf, int len); __owur int dtls1_send_change_cipher_spec(SSL *s, int a, int b); -__owur int dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen); __owur int dtls1_read_failed(SSL *s, int code); __owur int dtls1_buffer_message(SSL *s, int ccs); __owur int dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off, int *found); __owur int dtls1_get_queue_priority(unsigned short seq, int is_ccs); -__owur int dtls1_retransmit_buffered_messages(SSL *s); +int dtls1_retransmit_buffered_messages(SSL *s); void dtls1_clear_record_buffer(SSL *s); void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr); void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr); -void dtls1_reset_seq_numbers(SSL *s, int rw); __owur long dtls1_default_timeout(void); __owur struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft); __owur int dtls1_check_timeout_num(SSL *s); @@ -2273,8 +2107,6 @@ __owur int ssl3_get_next_proto(SSL *s); __owur int ssl23_accept(SSL *s); __owur int ssl23_connect(SSL *s); -__owur int ssl23_read_bytes(SSL *s, int n); -__owur int ssl23_write_bytes(SSL *s); __owur int tls1_new(SSL *s); void tls1_free(SSL *s); @@ -2291,9 +2123,6 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg); __owur int dtls1_shutdown(SSL *s); __owur long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok); -__owur int dtls1_get_record(SSL *s); -__owur int do_dtls1_write(SSL *s, int type, const unsigned char *buf, - unsigned int len, int create_empty_fragement); __owur int dtls1_dispatch_alert(SSL *s); __owur int ssl_init_wbio_buffer(SSL *s, int push); @@ -2301,11 +2130,9 @@ void ssl_free_wbio_buffer(SSL *s); __owur int tls1_change_cipher_state(SSL *s, int which); __owur int tls1_setup_key_block(SSL *s); -__owur int tls1_enc(SSL *s, int snd); __owur int tls1_final_finish_mac(SSL *s, const char *str, int slen, unsigned char *p); __owur int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *p); -__owur int tls1_mac(SSL *ssl, unsigned char *md, int snd); __owur int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, int len); __owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, @@ -2354,8 +2181,8 @@ __owur int ssl_prepare_serverhello_tlsext(SSL *s); # ifndef OPENSSL_NO_HEARTBEATS __owur int tls1_heartbeat(SSL *s); __owur int dtls1_heartbeat(SSL *s); -__owur int tls1_process_heartbeat(SSL *s); -__owur int dtls1_process_heartbeat(SSL *s); +__owur int tls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length); +__owur int dtls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length); # endif __owur int tls1_process_ticket(SSL *s, unsigned char *session_id, int len, @@ -2369,7 +2196,7 @@ void ssl_set_sig_mask(unsigned long *pmask_a, SSL *s, int op); __owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client); __owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, int client); -__owur int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain, +int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain, int idx); void tls1_set_cert_validity(SSL *s); @@ -2414,14 +2241,6 @@ __owur int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len, __owur int ssl_handshake_hash(SSL *s, unsigned char *out, int outlen); /* s3_cbc.c */ -void ssl3_cbc_copy_mac(unsigned char *out, - const SSL3_RECORD *rec, unsigned md_size); -__owur int ssl3_cbc_remove_padding(const SSL *s, - SSL3_RECORD *rec, - unsigned block_size, unsigned mac_size); -__owur int tls1_cbc_remove_padding(const SSL *s, - SSL3_RECORD *rec, - unsigned block_size, unsigned mac_size); __owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx); void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char *md_out,