Move CHANGES entry to 0.9.8l section

[openssl.git] / ssl / ssl3.h

diff --git a/ssl/ssl3.h b/ssl/ssl3.h
index 5ddadb2cd12328346f6ffc2a1891bdcbb626fda2..a4a6ce28c300e544171c377ab3e823dc5db26b69 100644 (file)
--- a/ssl/ssl3.h
+++ b/ssl/ssl3.h
@@ -368,13 +368,14 @@ typedef struct ssl3_buffer_st
  * enough to contain all of the cert types defined either for
  * SSLv3 and TLSv1.
  */
-#define SSL3_CT_NUMBER                 7
+#define SSL3_CT_NUMBER                 9
 
 
 #define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS      0x0001
 #define SSL3_FLAGS_DELAY_CLIENT_FINISHED       0x0002
 #define SSL3_FLAGS_POP_BUFFER                  0x0004
 #define TLS1_FLAGS_TLS_PADDING_BUG             0x0008
+#define TLS1_FLAGS_SKIP_CERT_VERIFY            0x0010
 
 typedef struct ssl3_state_st
        {
@@ -382,8 +383,10 @@ typedef struct ssl3_state_st
        int delay_buf_pop_ret;
 
        unsigned char read_sequence[8];
+       int read_mac_secret_size;
        unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
        unsigned char write_sequence[8];
+       int write_mac_secret_size;
        unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
 
        unsigned char server_random[SSL3_RANDOM_SIZE];
@@ -417,9 +420,11 @@ typedef struct ssl3_state_st
        const unsigned char *wpend_buf;
 
        /* used during startup, digest all incoming/outgoing packets */
-       EVP_MD_CTX finish_dgst1;
-       EVP_MD_CTX finish_dgst2;
-
+       BIO *handshake_buffer;
+       /* When set of handshake digests is determined, buffer is hashed
+        * and freed and MD_CTX-es for all required digests are stored in
+        * this array */
+       EVP_MD_CTX **handshake_dgst;
        /* this is set whenerver we see a change_cipher_spec message
         * come in when we are not looking for one */
        int change_cipher_spec;
@@ -439,6 +444,14 @@ typedef struct ssl3_state_st
 
        int in_read_app_data;
 
+       /* Opaque PRF input as used for the current handshake.
+        * These fields are used only if TLSEXT_TYPE_opaque_prf_input is defined
+        * (otherwise, they are merely present to improve binary compatibility) */
+       void *client_opaque_prf_input;
+       size_t client_opaque_prf_input_len;
+       void *server_opaque_prf_input;
+       size_t server_opaque_prf_input_len;
+
        struct  {
                /* actually only needs to be 16+20 */
                unsigned char cert_verify_md[EVP_MAX_MD_SIZE*2];
@@ -453,7 +466,7 @@ typedef struct ssl3_state_st
                int message_type;
 
                /* used to hold the new cipher we are going to use */
-               SSL_CIPHER *new_cipher;
+               const SSL_CIPHER *new_cipher;
 #ifndef OPENSSL_NO_DH
                DH *dh;
 #endif
@@ -480,6 +493,8 @@ typedef struct ssl3_state_st
 
                const EVP_CIPHER *new_sym_enc;
                const EVP_MD *new_hash;
+               int new_mac_pkey_type;
+               int new_mac_secret_size;
 #ifndef OPENSSL_NO_COMP
                const SSL_COMP *new_compression;
 #else
@@ -529,6 +544,10 @@ typedef struct ssl3_state_st
 #define SSL3_ST_CR_CHANGE_B            (0x1C1|SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_A          (0x1D0|SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_B          (0x1D1|SSL_ST_CONNECT)
+#define SSL3_ST_CR_SESSION_TICKET_A    (0x1E0|SSL_ST_CONNECT)
+#define SSL3_ST_CR_SESSION_TICKET_B    (0x1E1|SSL_ST_CONNECT)
+#define SSL3_ST_CR_CERT_STATUS_A       (0x1F0|SSL_ST_CONNECT)
+#define SSL3_ST_CR_CERT_STATUS_B       (0x1F1|SSL_ST_CONNECT)
 
 /* server */
 /* extra state */
@@ -570,10 +589,15 @@ typedef struct ssl3_state_st
 #define SSL3_ST_SW_CHANGE_B            (0x1D1|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_A          (0x1E0|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_B          (0x1E1|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_SESSION_TICKET_A    (0x1F0|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_SESSION_TICKET_B    (0x1F1|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_CERT_STATUS_A       (0x200|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_CERT_STATUS_B       (0x201|SSL_ST_ACCEPT)
 
 #define SSL3_MT_HELLO_REQUEST                  0
 #define SSL3_MT_CLIENT_HELLO                   1
 #define SSL3_MT_SERVER_HELLO                   2
+#define        SSL3_MT_NEWSESSION_TICKET               4
 #define SSL3_MT_CERTIFICATE                    11
 #define SSL3_MT_SERVER_KEY_EXCHANGE            12
 #define SSL3_MT_CERTIFICATE_REQUEST            13
@@ -581,6 +605,7 @@ typedef struct ssl3_state_st
 #define SSL3_MT_CERTIFICATE_VERIFY             15
 #define SSL3_MT_CLIENT_KEY_EXCHANGE            16
 #define SSL3_MT_FINISHED                       20
+#define SSL3_MT_CERTIFICATE_STATUS             22
 #define DTLS1_MT_HELLO_VERIFY_REQUEST    3