# include <openssl/symhacks.h>
#include "record/record.h"
+#include "statem/statem.h"
#include "packet_locl.h"
# ifdef OPENSSL_BUILD_SHLIBSSL
/* Bits for algorithm_mkey (key exchange algorithm) */
/* RSA key exchange */
-# define SSL_kRSA 0x00000001L
+# define SSL_kRSA 0x00000001U
/* DH cert, RSA CA cert */
-# define SSL_kDHr 0x00000002L
+# define SSL_kDHr 0x00000002U
/* DH cert, DSA CA cert */
-# define SSL_kDHd 0x00000004L
+# define SSL_kDHd 0x00000004U
/* tmp DH key no DH cert */
-# define SSL_kDHE 0x00000008L
+# define SSL_kDHE 0x00000008U
/* synonym */
# define SSL_kEDH SSL_kDHE
/* ECDH cert, RSA CA cert */
-# define SSL_kECDHr 0x00000020L
+# define SSL_kECDHr 0x00000020U
/* ECDH cert, ECDSA CA cert */
-# define SSL_kECDHe 0x00000040L
+# define SSL_kECDHe 0x00000040U
/* ephemeral ECDH */
-# define SSL_kECDHE 0x00000080L
+# define SSL_kECDHE 0x00000080U
/* synonym */
# define SSL_kEECDH SSL_kECDHE
/* PSK */
-# define SSL_kPSK 0x00000100L
+# define SSL_kPSK 0x00000100U
/* GOST key exchange */
-# define SSL_kGOST 0x00000200L
+# define SSL_kGOST 0x00000200U
/* SRP */
-# define SSL_kSRP 0x00000400L
+# define SSL_kSRP 0x00000400U
-# define SSL_kRSAPSK 0x00000800L
-# define SSL_kECDHEPSK 0x00001000L
-# define SSL_kDHEPSK 0x00002000L
+# define SSL_kRSAPSK 0x00000800U
+# define SSL_kECDHEPSK 0x00001000U
+# define SSL_kDHEPSK 0x00002000U
/* all PSK */
/* Bits for algorithm_auth (server authentication) */
/* RSA auth */
-# define SSL_aRSA 0x00000001L
+# define SSL_aRSA 0x00000001U
/* DSS auth */
-# define SSL_aDSS 0x00000002L
+# define SSL_aDSS 0x00000002U
/* no auth (i.e. use ADH or AECDH) */
-# define SSL_aNULL 0x00000004L
+# define SSL_aNULL 0x00000004U
/* Fixed DH auth (kDHd or kDHr) */
-# define SSL_aDH 0x00000008L
+# define SSL_aDH 0x00000008U
/* Fixed ECDH auth (kECDHe or kECDHr) */
-# define SSL_aECDH 0x00000010L
+# define SSL_aECDH 0x00000010U
/* ECDSA auth*/
-# define SSL_aECDSA 0x00000040L
+# define SSL_aECDSA 0x00000040U
/* PSK auth */
-# define SSL_aPSK 0x00000080L
+# define SSL_aPSK 0x00000080U
/* GOST R 34.10-2001 signature auth */
-# define SSL_aGOST01 0x00000200L
+# define SSL_aGOST01 0x00000200U
/* SRP auth */
-# define SSL_aSRP 0x00000400L
+# define SSL_aSRP 0x00000400U
/* Bits for algorithm_enc (symmetric encryption) */
-# define SSL_DES 0x00000001L
-# define SSL_3DES 0x00000002L
-# define SSL_RC4 0x00000004L
-# define SSL_RC2 0x00000008L
-# define SSL_IDEA 0x00000010L
-# define SSL_eNULL 0x00000020L
-# define SSL_AES128 0x00000040L
-# define SSL_AES256 0x00000080L
-# define SSL_CAMELLIA128 0x00000100L
-# define SSL_CAMELLIA256 0x00000200L
-# define SSL_eGOST2814789CNT 0x00000400L
-# define SSL_SEED 0x00000800L
-# define SSL_AES128GCM 0x00001000L
-# define SSL_AES256GCM 0x00002000L
-# define SSL_AES128CCM 0x00004000L
-# define SSL_AES256CCM 0x00008000L
-# define SSL_AES128CCM8 0x00010000L
-# define SSL_AES256CCM8 0x00020000L
+# define SSL_DES 0x00000001U
+# define SSL_3DES 0x00000002U
+# define SSL_RC4 0x00000004U
+# define SSL_RC2 0x00000008U
+# define SSL_IDEA 0x00000010U
+# define SSL_eNULL 0x00000020U
+# define SSL_AES128 0x00000040U
+# define SSL_AES256 0x00000080U
+# define SSL_CAMELLIA128 0x00000100U
+# define SSL_CAMELLIA256 0x00000200U
+# define SSL_eGOST2814789CNT 0x00000400U
+# define SSL_SEED 0x00000800U
+# define SSL_AES128GCM 0x00001000U
+# define SSL_AES256GCM 0x00002000U
+# define SSL_AES128CCM 0x00004000U
+# define SSL_AES256CCM 0x00008000U
+# define SSL_AES128CCM8 0x00010000U
+# define SSL_AES256CCM8 0x00020000U
# define SSL_AES (SSL_AES128|SSL_AES256|SSL_AES128GCM|SSL_AES256GCM|SSL_AES128CCM|SSL_AES256CCM|SSL_AES128CCM8|SSL_AES256CCM8)
# define SSL_CAMELLIA (SSL_CAMELLIA128|SSL_CAMELLIA256)
/* Bits for algorithm_mac (symmetric authentication) */
-# define SSL_MD5 0x00000001L
-# define SSL_SHA1 0x00000002L
-# define SSL_GOST94 0x00000004L
-# define SSL_GOST89MAC 0x00000008L
-# define SSL_SHA256 0x00000010L
-# define SSL_SHA384 0x00000020L
+# define SSL_MD5 0x00000001U
+# define SSL_SHA1 0x00000002U
+# define SSL_GOST94 0x00000004U
+# define SSL_GOST89MAC 0x00000008U
+# define SSL_SHA256 0x00000010U
+# define SSL_SHA384 0x00000020U
/* Not a real MAC, just an indication it is part of cipher */
-# define SSL_AEAD 0x00000040L
+# define SSL_AEAD 0x00000040U
/* Bits for algorithm_ssl (protocol version) */
-# define SSL_SSLV3 0x00000002L
-# define SSL_TLSV1 SSL_SSLV3/* for now */
-# define SSL_TLSV1_2 0x00000004L
+# define SSL_SSLV3 0x00000002U
+# define SSL_TLSV1 0x00000004U
+# define SSL_TLSV1_2 0x00000008U
/* Bits for algorithm2 (handshake digests and other extra flags) */
* and ciphers goes, another extension to SSL_SUPER and/or SSL_ULTRA would
* be possible.
*/
-# define SSL_EXP_MASK 0x00000003L
-# define SSL_STRONG_MASK 0x000001fcL
-# define SSL_DEFAULT_MASK 0X00000200L
+# define SSL_EXP_MASK 0x00000003U
+# define SSL_STRONG_MASK 0x000001fcU
+# define SSL_DEFAULT_MASK 0X00000200U
-# define SSL_NOT_EXP 0x00000001L
-# define SSL_EXPORT 0x00000002L
+# define SSL_NOT_EXP 0x00000001U
+# define SSL_EXPORT 0x00000002U
-# define SSL_STRONG_NONE 0x00000004L
-# define SSL_EXP40 0x00000008L
+# define SSL_STRONG_NONE 0x00000004U
+# define SSL_EXP40 0x00000008U
# define SSL_MICRO (SSL_EXP40)
-# define SSL_EXP56 0x00000010L
+# define SSL_EXP56 0x00000010U
# define SSL_MINI (SSL_EXP56)
-# define SSL_LOW 0x00000020L
-# define SSL_MEDIUM 0x00000040L
-# define SSL_HIGH 0x00000080L
-# define SSL_FIPS 0x00000100L
+# define SSL_LOW 0x00000020U
+# define SSL_MEDIUM 0x00000040U
+# define SSL_HIGH 0x00000080U
+# define SSL_FIPS 0x00000100U
-# define SSL_NOT_DEFAULT 0x00000200L
+# define SSL_NOT_DEFAULT 0x00000200U
/* we have used 000003ff - 22 bits left to go */
#define TLS_CIPHER_LEN 2
/* used to hold info on the particular ciphers used */
struct ssl_cipher_st {
- int valid;
- const char *name; /* text name */
- unsigned long id; /* id, 4 bytes, first is version */
+ uint32_t valid;
+ const char *name; /* text name */
+ uint32_t id; /* id, 4 bytes, first is version */
/*
- * changed in 0.9.9: these four used to be portions of a single value
+ * changed in 1.0.0: these four used to be portions of a single value
* 'algorithms'
*/
- unsigned long algorithm_mkey; /* key exchange algorithm */
- unsigned long algorithm_auth; /* server authentication */
- unsigned long algorithm_enc; /* symmetric encryption */
- unsigned long algorithm_mac; /* symmetric authentication */
- unsigned long algorithm_ssl; /* (major) protocol version */
- unsigned long algo_strength; /* strength and export flags */
- unsigned long algorithm2; /* Extra flags */
- int strength_bits; /* Number of bits really used */
- int alg_bits; /* Number of bits for algorithm */
+ uint32_t algorithm_mkey; /* key exchange algorithm */
+ uint32_t algorithm_auth; /* server authentication */
+ uint32_t algorithm_enc; /* symmetric encryption */
+ uint32_t algorithm_mac; /* symmetric authentication */
+ uint32_t algorithm_ssl; /* (major) protocol version */
+ uint32_t algo_strength; /* strength and export flags */
+ uint32_t algorithm2; /* Extra flags */
+ int32_t strength_bits; /* Number of bits really used */
+ uint32_t alg_bits; /* Number of bits for algorithm */
};
-/* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
+/* Used to hold SSL/TLS functions */
struct ssl_method_st {
int version;
int (*ssl_new) (SSL *s);
int (*ssl_shutdown) (SSL *s);
int (*ssl_renegotiate) (SSL *s);
int (*ssl_renegotiate_check) (SSL *s);
- long (*ssl_get_message) (SSL *s, int st1, int stn, int mt, long
- max, int *ok);
int (*ssl_read_bytes) (SSL *s, int type, int *recvd_type,
unsigned char *buf, int len, int peek);
int (*ssl_write_bytes) (SSL *s, int type, const void *buf_, int len);
DECLARE_STACK_OF(SSL_COMP)
DECLARE_LHASH_OF(SSL_SESSION);
+
struct ssl_ctx_st {
const SSL_METHOD *method;
STACK_OF(SSL_CIPHER) *cipher_list;
unsigned int *cookie_len);
/* verify cookie callback */
- int (*app_verify_cookie_cb) (SSL *ssl, unsigned char *cookie,
+ int (*app_verify_cookie_cb) (SSL *ssl, const unsigned char *cookie,
unsigned int cookie_len);
CRYPTO_EX_DATA ex_data;
* DTLS1_VERSION)
*/
int version;
- /* SSL_ST_CONNECT or SSL_ST_ACCEPT */
- int type;
+
/* SSLv3 */
const SSL_METHOD *method;
/*
* request needs re-doing when in SSL_accept or SSL_connect
*/
int rwstate;
- /* true when we are actually in SSL_accept() or SSL_connect() */
- int in_handshake;
+
int (*handshake_func) (SSL *);
/*
* Imagine that here's a boolean member "init" that is switched as soon
* handshake_func is == 0 until then, we use this test instead of an
* "init" member.
*/
- /* are we the server side? - mostly used by SSL_clear */
+ /* are we the server side? */
int server;
/*
* Generate a new session or reuse an old one.
/* we have shut things down, 0x01 sent, 0x02 for received */
int shutdown;
/* where we are */
- int state;
+ OSSL_STATEM statem;
+
BUF_MEM *init_buf; /* buffer used during init */
void *init_msg; /* pointer to handshake message body, set by
* ssl3_get_message() */
int (*not_resumable_session_cb) (SSL *ssl, int is_forward_secure);
RECORD_LAYER rlayer;
+
+ /* Default password callback. */
+ pem_password_cb *default_passwd_callback;
+
+ /* Default password callback user data. */
+ void *default_passwd_callback_userdata;
};
# ifndef OPENSSL_NO_EC
EC_KEY *ecdh; /* holds short lived ECDH key */
# endif
- /* used when SSL_ST_FLUSH_DATA is entered */
- int next_state;
- int reuse_message;
/* used for certificate requests */
int cert_req;
int ctype_num;
* that are supported by the certs below. For clients they are masks of
* *disabled* algorithms based on the current session.
*/
- unsigned long mask_k;
- unsigned long mask_a;
- unsigned long export_mask_k;
- unsigned long export_mask_a;
+ uint32_t mask_k;
+ uint32_t mask_a;
+ uint32_t export_mask_k;
+ uint32_t export_mask_a;
/* Client only */
- unsigned long mask_ssl;
+ uint32_t mask_ssl;
} tmp;
/* Connection binding to prevent renegotiation attacks */
} hm_fragment;
typedef struct dtls1_state_st {
- unsigned int send_cookie;
unsigned char cookie[DTLS1_COOKIE_LENGTH];
- unsigned char rcvd_cookie[DTLS1_COOKIE_LENGTH];
unsigned int cookie_len;
+ unsigned int cookie_verified;
/* handshake message numbers */
unsigned short handshake_write_seq;
unsigned int retransmitting;
# ifndef OPENSSL_NO_SCTP
- /* used when SSL_ST_XX_FLUSH is entered */
- int next_state;
int shutdown_received;
# endif
} DTLS1_STATE;
ssl3_shutdown, \
ssl3_renegotiate, \
ssl3_renegotiate_check, \
- ssl3_get_message, \
ssl3_read_bytes, \
ssl3_write_bytes, \
ssl3_dispatch_alert, \
ssl3_shutdown, \
ssl3_renegotiate, \
ssl3_renegotiate_check, \
- ssl3_get_message, \
ssl3_read_bytes, \
ssl3_write_bytes, \
ssl3_dispatch_alert, \
dtls1_shutdown, \
ssl3_renegotiate, \
ssl3_renegotiate_check, \
- dtls1_get_message, \
dtls1_read_bytes, \
dtls1_write_app_data_bytes, \
dtls1_dispatch_alert, \
__owur const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
__owur int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
void ssl3_init_finished_mac(SSL *s);
-__owur int ssl3_send_server_certificate(SSL *s);
-__owur int ssl3_send_newsession_ticket(SSL *s);
-__owur int ssl3_send_cert_status(SSL *s);
-__owur int ssl3_get_change_cipher_spec(SSL *s, int a, int b);
-__owur int ssl3_get_finished(SSL *s, int state_a, int state_b);
__owur int ssl3_setup_key_block(SSL *s);
-__owur int ssl3_send_change_cipher_spec(SSL *s, int state_a, int state_b);
__owur int ssl3_change_cipher_state(SSL *s, int which);
void ssl3_cleanup_key_block(SSL *s);
__owur int ssl3_do_write(SSL *s, int type);
__owur int ssl3_generate_master_secret(SSL *s, unsigned char *out,
unsigned char *p, int len);
__owur int ssl3_get_req_cert_type(SSL *s, unsigned char *p);
-__owur long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
-__owur int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen);
__owur int ssl3_num_ciphers(void);
__owur const SSL_CIPHER *ssl3_get_cipher(unsigned int u);
int ssl3_renegotiate(SSL *ssl);
__owur int ssl3_digest_cached_records(SSL *s, int keep);
__owur int ssl3_new(SSL *s);
void ssl3_free(SSL *s);
-__owur int ssl3_accept(SSL *s);
-__owur int ssl3_connect(SSL *s);
__owur int ssl3_read(SSL *s, void *buf, int len);
__owur int ssl3_peek(SSL *s, void *buf, int len);
__owur int ssl3_write(SSL *s, const void *buf, int len);
__owur int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf, int len);
-__owur int dtls1_send_change_cipher_spec(SSL *s, int a, int b);
__owur int dtls1_read_failed(SSL *s, int code);
__owur int dtls1_buffer_message(SSL *s, int ccs);
__owur int dtls1_retransmit_message(SSL *s, unsigned short seq,
void dtls1_stop_timer(SSL *s);
__owur int dtls1_is_timer_expired(SSL *s);
void dtls1_double_timeout(SSL *s);
-__owur unsigned int dtls1_raw_hello_verify_request(unsigned char *buf,
- unsigned char *cookie,
- unsigned char cookie_len);
+__owur unsigned int dtls_raw_hello_verify_request(unsigned char *buf,
+ unsigned char *cookie,
+ unsigned char cookie_len);
__owur int dtls1_send_newsession_ticket(SSL *s);
__owur unsigned int dtls1_min_mtu(SSL *s);
-__owur unsigned int dtls1_link_min_mtu(void);
void dtls1_hm_fragment_free(hm_fragment *frag);
-
-/* some client-only functions */
-__owur int ssl3_client_hello(SSL *s);
-__owur int ssl3_get_server_hello(SSL *s);
-__owur int ssl3_get_certificate_request(SSL *s);
-__owur int ssl3_get_new_session_ticket(SSL *s);
-__owur int ssl3_get_cert_status(SSL *s);
-__owur int ssl3_get_server_done(SSL *s);
-__owur int ssl3_send_client_verify(SSL *s);
-__owur int ssl3_send_client_certificate(SSL *s);
-__owur int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey);
-__owur int ssl3_send_client_key_exchange(SSL *s);
-__owur int ssl3_get_key_exchange(SSL *s);
-__owur int ssl3_get_server_certificate(SSL *s);
-__owur int ssl3_check_cert_and_algorithm(SSL *s);
-# ifndef OPENSSL_NO_NEXTPROTONEG
-__owur int ssl3_send_next_proto(SSL *s);
-# endif
-
-int dtls1_client_hello(SSL *s);
-
-/* some server-only functions */
-__owur int ssl3_get_client_hello(SSL *s);
-__owur int ssl3_send_server_hello(SSL *s);
-__owur int ssl3_send_hello_request(SSL *s);
-__owur int ssl3_send_server_key_exchange(SSL *s);
-__owur int ssl3_send_certificate_request(SSL *s);
-__owur int ssl3_send_server_done(SSL *s);
-__owur int ssl3_get_client_certificate(SSL *s);
-__owur int ssl3_get_client_key_exchange(SSL *s);
-__owur int ssl3_get_cert_verify(SSL *s);
-# ifndef OPENSSL_NO_NEXTPROTONEG
-__owur int ssl3_get_next_proto(SSL *s);
-# endif
+__owur int dtls1_query_mtu(SSL *s);
__owur int tls1_new(SSL *s);
void tls1_free(SSL *s);
long tls1_callback_ctrl(SSL *s, int cmd, void (*fp) (void));
__owur int dtls1_new(SSL *s);
-__owur int dtls1_accept(SSL *s);
-__owur int dtls1_connect(SSL *s);
void dtls1_free(SSL *s);
void dtls1_clear(SSL *s);
long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg);
__owur int dtls1_shutdown(SSL *s);
-__owur long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
__owur int dtls1_dispatch_alert(SSL *s);
__owur int ssl_init_wbio_buffer(SSL *s, int push);
const EVP_MD *md);
__owur int tls12_get_sigid(const EVP_PKEY *pk);
__owur const EVP_MD *tls12_get_hash(unsigned char hash_alg);
-void ssl_set_sig_mask(unsigned long *pmask_a, SSL *s, int op);
+void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op);
__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
__owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, int client);
projects / openssl.git / blobdiff