* For a server, this contains a callback function by which the set of
* advertised protocols can be provided.
*/
- int (*npn_advertised_cb) (SSL *s, const unsigned char **buf,
- unsigned int *len, void *arg);
+ SSL_CTX_npn_advertised_cb_func npn_advertised_cb;
void *npn_advertised_cb_arg;
/*
* For a client, this contains a callback function that selects the next
* protocol from the list provided by the server.
*/
- int (*npn_select_cb) (SSL *s, unsigned char **out,
- unsigned char *outlen,
- const unsigned char *in,
- unsigned int inlen, void *arg);
+ SSL_CTX_npn_select_cb_func npn_select_cb;
void *npn_select_cb_arg;
# endif
} ext;
# ifndef OPENSSL_NO_PSK
- unsigned int (*psk_client_callback) (SSL *ssl, const char *hint,
- char *identity,
- unsigned int max_identity_len,
- unsigned char *psk,
- unsigned int max_psk_len);
- unsigned int (*psk_server_callback) (SSL *ssl, const char *identity,
- unsigned char *psk,
- unsigned int max_psk_len);
+ SSL_psk_client_cb_func psk_client_callback;
+ SSL_psk_server_cb_func psk_server_callback;
# endif
# ifndef OPENSSL_NO_SRP
/* client cert? */
/* This is used to hold the server certificate used */
struct cert_st /* CERT */ *cert;
+
+ /*
+ * The hash of all messages prior to the CertificateVerify, and the length
+ * of that hash.
+ */
+ unsigned char cert_verify_hash[EVP_MAX_MD_SIZE];
+ size_t cert_verify_hash_len;
+
/*
* the session_id_context is used to ensure sessions are only reused in
* the appropriate context
/* actual code */
int error_code;
# ifndef OPENSSL_NO_PSK
- unsigned int (*psk_client_callback) (SSL *ssl, const char *hint,
- char *identity,
- unsigned int max_identity_len,
- unsigned char *psk,
- unsigned int max_psk_len);
- unsigned int (*psk_server_callback) (SSL *ssl, const char *identity,
- unsigned char *psk,
- unsigned int max_psk_len);
+ SSL_psk_client_cb_func psk_client_callback;
+ SSL_psk_server_cb_func psk_server_callback;
# endif
SSL_CTX *ctx;
/* Verified chain of peer */
struct {
/* TLS extension debug callback */
- void (*debug_cb) (SSL *s, int client_server, int type,
- const unsigned char *data, int len, void *arg);
+ void (*debug_cb)(SSL *s, int client_server, int type,
+ const unsigned char *data, int len, void *arg);
void *debug_arg;
char *hostname;
/* certificate status request info */
* algorithms extension for server or as part of a certificate
* request for client.
*/
- unsigned char *peer_sigalgs;
+ unsigned int *peer_sigalgs;
/* Size of above array */
size_t peer_sigalgslen;
/* Digest peer uses for signing */
* the client hello as the supported signature algorithms extension. For
* servers it represents the signature algorithms we are willing to use.
*/
- unsigned char *conf_sigalgs;
+ unsigned int *conf_sigalgs;
/* Size of above array */
size_t conf_sigalgslen;
/*
* represents the signature algortithms we are willing to use for client
* authentication.
*/
- unsigned char *client_sigalgs;
+ unsigned int *client_sigalgs;
/* Size of above array */
size_t client_sigalgslen;
/*
int sign_nid;
/* Combined hash and signature NID */
int signandhash_nid;
- /* Raw values used in extension */
- unsigned char rsign;
- unsigned char rhash;
+ /* Raw value used in extension */
+ unsigned int rsigalg;
};
# define FP_ICC (int (*)(const void *,const void *))
*/
#define TLSEXT_STATUSTYPE_nothing -1
+/* Sigalgs values */
+#define TLSEXT_SIGALG_ecdsa_secp256r1_sha256 0x0403
+#define TLSEXT_SIGALG_ecdsa_secp384r1_sha384 0x0503
+#define TLSEXT_SIGALG_ecdsa_secp521r1_sha512 0x0603
+#define TLSEXT_SIGALG_ecdsa_sha1 0x0203
+#define TLSEXT_SIGALG_rsa_pss_sha256 0x0804
+#define TLSEXT_SIGALG_rsa_pss_sha384 0x0805
+#define TLSEXT_SIGALG_rsa_pss_sha512 0x0806
+#define TLSEXT_SIGALG_rsa_pkcs1_sha256 0x0401
+#define TLSEXT_SIGALG_rsa_pkcs1_sha384 0x0501
+#define TLSEXT_SIGALG_rsa_pkcs1_sha512 0x0601
+#define TLSEXT_SIGALG_rsa_pkcs1_sha1 0x0201
+#define TLSEXT_SIGALG_dsa_sha256 0x0402
+#define TLSEXT_SIGALG_dsa_sha384 0x0502
+#define TLSEXT_SIGALG_dsa_sha512 0x0602
+#define TLSEXT_SIGALG_dsa_sha1 0x0202
+#define TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256 0xeeee
+#define TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512 0xefef
+#define TLSEXT_SIGALG_gostr34102001_gostr3411 0xeded
+
+/* A dummy signature value not valid for TLSv1.2 signature algs */
+#define TLSEXT_signature_rsa_pss 0x0101
+
+
#define MAX_COMPRESSIONS_SIZE 255
typedef struct {
void ssl_set_default_md(SSL *s);
__owur int tls1_set_server_sigalgs(SSL *s);
-__owur RAW_EXTENSION *tls_get_extension_by_type(RAW_EXTENSION *exts,
- size_t numexts,
- unsigned int type);
__owur int tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
SSL_SESSION **ret);
__owur int tls_use_ticket(SSL *s);
-__owur int tls12_get_sigandhash(WPACKET *pkt, const EVP_PKEY *pk,
+__owur int tls12_get_sigandhash(SSL *s, WPACKET *pkt, const EVP_PKEY *pk,
const EVP_MD *md);
-__owur int tls12_get_sigid(const EVP_PKEY *pk);
-__owur const EVP_MD *tls12_get_hash(unsigned char hash_alg);
+__owur const EVP_MD *tls12_get_hash(int hash_nid);
void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op);
__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
__owur long ssl_get_algorithm2(SSL *s);
__owur int tls12_copy_sigalgs(SSL *s, WPACKET *pkt,
- const unsigned char *psig, size_t psiglen);
-__owur int tls1_save_sigalgs(SSL *s, const unsigned char *data, size_t dsize);
+ const unsigned int *psig, size_t psiglen);
+__owur int tls1_save_sigalgs(SSL *s, PACKET *pkt);
__owur int tls1_process_sigalgs(SSL *s);
-__owur size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs);
-__owur int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
- const unsigned char *sig, EVP_PKEY *pkey);
+__owur size_t tls12_get_psigalgs(SSL *s, const unsigned int **psigs);
+__owur int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s, unsigned int sig,
+ EVP_PKEY *pkey);
void ssl_set_client_disabled(SSL *s);
__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op);
projects / openssl.git / blobdiff