Implement Supported Elliptic Curves Extension.

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 33792ea8fe788870d49f5c787071a3584c5b9869..f0ed4f105c6de97bd4927546d4d33181a0aaf33f 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -430,18 +430,20 @@ typedef struct ssl_method_st
  * SSL_SESSION_ID ::= SEQUENCE {
  *     version                 INTEGER,        -- structure version number
  *     SSLversion              INTEGER,        -- SSL version number
- *     Cipher                  OCTET_STRING,   -- the 3 byte cipher ID
- *     Session_ID              OCTET_STRING,   -- the Session ID
- *     Master_key              OCTET_STRING,   -- the master key
- *     KRB5_principal          OCTET_STRING    -- optional Kerberos principal
- *     Key_Arg [ 0 ] IMPLICIT  OCTET_STRING,   -- the optional Key argument
+ *     Cipher                  OCTET STRING,   -- the 3 byte cipher ID
+ *     Session_ID              OCTET STRING,   -- the Session ID
+ *     Master_key              OCTET STRING,   -- the master key
+ *     KRB5_principal          OCTET STRING    -- optional Kerberos principal
+ *     Key_Arg [ 0 ] IMPLICIT  OCTET STRING,   -- the optional Key argument
  *     Time [ 1 ] EXPLICIT     INTEGER,        -- optional Start Time
  *     Timeout [ 2 ] EXPLICIT  INTEGER,        -- optional Timeout ins seconds
  *     Peer [ 3 ] EXPLICIT     X509,           -- optional Peer Certificate
- *     Session_ID_context [ 4 ] EXPLICIT OCTET_STRING,   -- the Session ID context
+ *     Session_ID_context [ 4 ] EXPLICIT OCTET STRING,   -- the Session ID context
  *     Verify_result [ 5 ] EXPLICIT INTEGER,   -- X509_V_... code for `Peer'
- *     PSK_identity_hint [ 6 ] EXPLICIT OCTET_STRING, -- PSK identity hint
- *      PSK_identity [ 7 ] EXPLICIT OCTET_STRING -- PSK identity
+ *     HostName [ 6 ] EXPLICY OCTET STRING,      -- optional HostName from servername TLS extension 
+ *     ECPointFormatList [ 7 ] OCTET STRING,     -- optional EC point format list from TLS extension
+ *     PSK_identity_hint [ 8 ] EXPLICIT OCTET STRING, -- optional PSK identity hint
+ *     PSK_identity [ 9 ] EXPLICIT OCTET STRING -- optional PSK identity
  *     }
  * Look in ssl/ssl_asn1.c for more details
  * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
@@ -507,6 +509,12 @@ typedef struct ssl_session_st
        struct ssl_session_st *prev,*next;
 #ifndef OPENSSL_NO_TLSEXT
        char *tlsext_hostname;
+#ifndef OPENSSL_NO_EC
+       size_t tlsext_ecpointformatlist_length;
+       unsigned char *tlsext_ecpointformatlist; /* peer's list */
+       size_t tlsext_ellipticcurvelist_length;
+       unsigned char *tlsext_ellipticcurvelist; /* peer's list */
+#endif /* OPENSSL_NO_EC */
 #endif
        } SSL_SESSION;
 
@@ -1057,6 +1065,12 @@ struct ssl_st
                                  1 : prepare 2, allow last ack just after in server callback.
                                  2 : don't call servername callback, no ack in server hello
                               */
+#ifndef OPENSSL_NO_EC
+       size_t tlsext_ecpointformatlist_length;
+       unsigned char *tlsext_ecpointformatlist; /* our list */
+       size_t tlsext_ellipticcurvelist_length;
+       unsigned char *tlsext_ellipticcurvelist; /* our list */
+#endif /* OPENSSL_NO_EC */
        SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
 #define session_ctx initial_ctx
 #else
@@ -1754,8 +1768,10 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_SETUP_KEY_BLOCK                      157
 #define SSL_F_SSL3_WRITE_BYTES                          158
 #define SSL_F_SSL3_WRITE_PENDING                        159
+#define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT                277
 #define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK        215
 #define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK       216
+#define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT                278
 #define SSL_F_SSL_BAD_METHOD                            160
 #define SSL_F_SSL_BYTES_TO_CIPHER_LIST                  161
 #define SSL_F_SSL_CERT_DUP                              221
@@ -1829,7 +1845,10 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_VERIFY_CERT_CHAIN                     207
 #define SSL_F_SSL_WRITE                                         208
 #define SSL_F_TLS1_CHANGE_CIPHER_STATE                  209
+#define SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT             274
 #define SSL_F_TLS1_ENC                                  210
+#define SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT           275
+#define SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT           276
 #define SSL_F_TLS1_SETUP_KEY_BLOCK                      211
 #define SSL_F_WRITE_PENDING                             212
 
@@ -1880,7 +1899,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_CIPHER_CODE_WRONG_LENGTH                  137
 #define SSL_R_CIPHER_OR_HASH_UNAVAILABLE                138
 #define SSL_R_CIPHER_TABLE_SRC_ERROR                    139
-#define SSL_R_CLIENTHELLO_TLS_EXT                       316
+#define SSL_R_CLIENTHELLO_TLSEXT                        226
 #define SSL_R_COMPRESSED_LENGTH_TOO_LONG                140
 #define SSL_R_COMPRESSION_FAILURE                       141
 #define SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE   307
@@ -1965,7 +1984,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED           197
 #define SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE             297
 #define SSL_R_PACKET_LENGTH_TOO_LONG                    198
-#define SSL_R_PARSE_TLS_EXT                             317
+#define SSL_R_PARSE_TLSEXT                              227
 #define SSL_R_PATH_TOO_LONG                             270
 #define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE                 199
 #define SSL_R_PEER_ERROR                                200
@@ -1992,12 +2011,13 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO                216
 #define SSL_R_REUSE_CERT_TYPE_NOT_ZERO                  217
 #define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO                218
-#define SSL_R_SERVERHELLO_TLS_EXT                       318
+#define SSL_R_SERVERHELLO_TLSEXT                        275
 #define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED          277
 #define SSL_R_SHORT_READ                                219
 #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE     220
 #define SSL_R_SSL23_DOING_SESSION_ID_REUSE              221
 #define SSL_R_SSL2_CONNECTION_ID_TOO_LONG               299
+#define SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT            321
 #define SSL_R_SSL3_EXT_INVALID_SERVERNAME               319
 #define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE          320
 #define SSL_R_SSL3_SESSION_ID_TOO_LONG                  300
@@ -2039,6 +2059,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLSV1_UNRECOGNIZED_NAME                   1112
 #define SSL_R_TLSV1_UNSUPPORTED_EXTENSION               1110
 #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER      232
+#define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST            157
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG   234
 #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER           235