Separate client and server permitted signature algorithm support: by default

[openssl.git] / ssl / ssl_locl.h

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 16fa9436485c09f4bf92f955efe01cb41502eaa5..fd23a9c1894f5141da4771c8a9da90efb8fcfc58 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -466,6 +466,14 @@
 #define NAMED_CURVE_TYPE           3
 #endif  /* OPENSSL_NO_EC */
 
+/* Values for valid_flags in CERT_PKEY structure */
+/* Certificate inconsistent with session, key missing etc */
+#define CERT_PKEY_INVALID      0x0
+/* Certificate can be used with this sesstion */
+#define CERT_PKEY_VALID                0x1
+/* Certificate can also be used for signing */
+#define CERT_PKEY_SIGN         0x2
+
 typedef struct cert_pkey_st
        {
        X509 *x509;
@@ -483,6 +491,11 @@ typedef struct cert_pkey_st
        unsigned char *authz;
        size_t authz_length;
 #endif
+       /* Set if CERT_PKEY can be used with current SSL session: e.g.
+        * appropriate curve, signature algorithms etc. If zero it can't be
+        * used at all.
+        */
+       int valid_flags;
        } CERT_PKEY;
 
 typedef struct cert_st
@@ -514,7 +527,8 @@ typedef struct cert_st
        /* Select ECDH parameters automatically */
        int ecdh_tmp_auto;
 #endif
-
+       /* Flags related to certificates */
+       unsigned int cert_flags;
        CERT_PKEY pkeys[SSL_PKEY_NUM];
 
        /* signature algorithms peer reports: e.g. supported signature
@@ -524,18 +538,39 @@ typedef struct cert_st
        unsigned char *peer_sigalgs;
        /* Size of above array */
        size_t peer_sigalgslen;
-       /* configured signature algorithms (can be NULL for default).
-        * sent in signature algorithms extension or certificate request.
+       /* suppported signature algorithms.
+        * When set on a client this is sent in the client hello as the 
+        * supported signature algorithms extension. For servers
+        * it represents the signature algorithms we are willing to use.
         */
        unsigned char *conf_sigalgs;
        /* Size of above array */
        size_t conf_sigalgslen;
+       /* Client authentication signature algorithms, if not set then
+        * uses conf_sigalgs. On servers these will be the signature
+        * algorithms sent to the client in a cerificate request for TLS 1.2.
+        * On a client this represents the signature algortithms we are
+        * willing to use for client authentication.
+        */
+       unsigned char *client_sigalgs;
+       /* Size of above array */
+       size_t client_sigalgslen;
        /* Signature algorithms shared by client and server: cached
-        * because these are used most often
+        * because these are used most often.
         */
        TLS_SIGALGS *shared_sigalgs;
        size_t shared_sigalgslen;
 
+       /* Certificate setup callback: if set is called whenever a
+        * certificate may be required (client or server). the callback
+        * can then examine any appropriate parameters and setup any
+        * certificates required. This allows advanced applications
+        * to select certificates on the fly: for example based on
+        * supported signature algorithms or curves.
+        */
+       int (*cert_cb)(SSL *ssl, void *arg);
+       void *cert_cb_arg;
+
        int references; /* >1 only if SSL_copy_session_id is used */
        } CERT;
 
@@ -874,6 +909,7 @@ int ssl_cert_set0_chain(CERT *c, STACK_OF(X509) *chain);
 int ssl_cert_set1_chain(CERT *c, STACK_OF(X509) *chain);
 int ssl_cert_add0_chain_cert(CERT *c, X509 *x);
 int ssl_cert_add1_chain_cert(CERT *c, X509 *x);
+void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg), void *arg);
 
 int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l);
@@ -1135,7 +1171,6 @@ int tls1_set_curves(unsigned char **pext, size_t *pextlen,
                        int *curves, size_t ncurves);
 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen, 
                                const char *str);
-int tls1_check_ec_server_key(SSL *s);
 int tls1_check_ec_tmp_key(SSL *s);
 #endif /* OPENSSL_NO_EC */
 
@@ -1176,8 +1211,11 @@ int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk,
 int tls12_get_sigid(const EVP_PKEY *pk);
 const EVP_MD *tls12_get_hash(unsigned char hash_alg);
 
-int tls1_set_sigalgs_list(CERT *c, const char *str);
-int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen);
+int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
+int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, int client);
+int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
+                                                               int idx);
+void tls1_set_cert_validity(SSL *s);
 
 #endif
 EVP_MD_CTX* ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) ;