Integrate J-PAKE and TLS-PSK. Increase PSK buffer size. Fix memory leaks.

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index ab13f0ddc4fa292f357c9a763f4e5fa79006db95..e43b5c27c6db5dba22d4f1490c2f540c1ceec2f1 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -229,6 +229,7 @@ extern "C" {
 #define SSL_TXT_LOW            "LOW"
 #define SSL_TXT_MEDIUM         "MEDIUM"
 #define SSL_TXT_HIGH           "HIGH"
+#define SSL_TXT_FIPS           "FIPS"
 
 #define SSL_TXT_kFZA           "kFZA" /* unused! */
 #define        SSL_TXT_aFZA            "aFZA" /* unused! */
@@ -354,6 +355,7 @@ extern "C" {
  * 'struct ssl_st *' function parameters used to prototype callbacks
  * in SSL_CTX. */
 typedef struct ssl_st *ssl_crock_st;
+typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;
 
 /* used to hold info on the particular ciphers used */
 typedef struct ssl_cipher_st
@@ -377,6 +379,9 @@ typedef struct ssl_cipher_st
 
 DECLARE_STACK_OF(SSL_CIPHER)
 
+typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, int len, void *arg);
+typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);
+
 /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
 typedef struct ssl_method_st
        {
@@ -400,11 +405,11 @@ typedef struct ssl_method_st
        int (*ssl_dispatch_alert)(SSL *s);
        long (*ssl_ctrl)(SSL *s,int cmd,long larg,void *parg);
        long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,void *parg);
-       SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);
+       const SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);
        int (*put_cipher_by_char)(const SSL_CIPHER *cipher,unsigned char *ptr);
        int (*ssl_pending)(const SSL *s);
        int (*num_ciphers)(void);
-       SSL_CIPHER *(*get_cipher)(unsigned ncipher);
+       const SSL_CIPHER *(*get_cipher)(unsigned ncipher);
        const struct ssl_method_st *(*get_ssl_method)(int version);
        long (*get_timeout)(void);
        struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
@@ -482,7 +487,7 @@ typedef struct ssl_session_st
 
        int compress_meth;              /* Need to lookup the method */
 
-       SSL_CIPHER *cipher;
+       const SSL_CIPHER *cipher;
        unsigned long cipher_id;        /* when ASN.1 loaded, this
                                         * needs to be used to load
                                         * the 'cipher' structure */
@@ -905,7 +910,7 @@ void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL
 /* the maximum length of the buffer given to callbacks containing the
  * resulting identity/psk */
 #define PSK_MAX_IDENTITY_LEN 128
-#define PSK_MAX_PSK_LEN 64
+#define PSK_MAX_PSK_LEN 256
 void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, 
        unsigned int (*psk_client_callback)(SSL *ssl, const char *hint, 
                char *identity, unsigned int max_identity_len, unsigned char *psk,
@@ -1144,6 +1149,17 @@ struct ssl_st
        void *tlsext_opaque_prf_input;
        size_t tlsext_opaque_prf_input_len;
 
+       /* TLS Session Ticket extension override */
+       TLS_SESSION_TICKET_EXT *tlsext_session_ticket;
+
+       /* TLS Session Ticket extension callback */
+       tls_session_ticket_ext_cb_fn tls_session_ticket_ext_cb;
+       void *tls_session_ticket_ext_cb_arg;
+
+       /* TLS pre-shared secret session resumption */
+       tls_session_secret_cb_fn tls_session_secret_cb;
+       void *tls_session_secret_cb_arg;
+
        SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
 #define session_ctx initial_ctx
 #else
@@ -1430,7 +1446,7 @@ int       SSL_clear(SSL *s);
 
 void   SSL_CTX_flush_sessions(SSL_CTX *ctx,long tm);
 
-SSL_CIPHER *SSL_get_current_cipher(const SSL *s);
+const SSL_CIPHER *SSL_get_current_cipher(const SSL *s);
 int    SSL_CIPHER_get_bits(const SSL_CIPHER *c,int *alg_bits);
 char * SSL_CIPHER_get_version(const SSL_CIPHER *c);
 const char *   SSL_CIPHER_get_name(const SSL_CIPHER *c);
@@ -1745,6 +1761,15 @@ void *SSL_COMP_get_compression_methods(void);
 int SSL_COMP_add_compression_method(int id,void *cm);
 #endif
 
+/* TLS extensions functions */
+int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);
+
+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
+                                 void *arg);
+
+/* Pre-shared secret session resumption functions */
+int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -1947,6 +1972,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_TLS1_PRF                                  284
 #define SSL_F_TLS1_SETUP_KEY_BLOCK                      211
 #define SSL_F_WRITE_PENDING                             212
+#define SSL_F_SSL_SET_SESSION_TICKET_EXT                213
 
 /* Reason codes. */
 #define SSL_R_APP_DATA_IN_HANDSHAKE                     100