Make tls1_check_chain return a set of flags indicating checks passed

[openssl.git] / ssl / ssl_locl.h

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index a81c4e2ab74dc39cfbf6cbecef2c16db3583b2f6..e02c70a2251030ae2e2c1c68e5276424da28443d 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -468,14 +468,6 @@
 #define NAMED_CURVE_TYPE           3
 #endif  /* OPENSSL_NO_EC */
 
-/* Values for valid_flags in CERT_PKEY structure */
-/* Certificate inconsistent with session, key missing etc */
-#define CERT_PKEY_INVALID      0x0
-/* Certificate can be used with this sesstion */
-#define CERT_PKEY_VALID                0x1
-/* Certificate can also be used for signing */
-#define CERT_PKEY_SIGN         0x2
-
 typedef struct cert_pkey_st
        {
        X509 *x509;
@@ -507,13 +499,18 @@ typedef struct cert_st
                         * Probably it would make more sense to store
                         * an index, not a pointer. */
  
-       /* The following masks are for the key and auth
-        * algorithms that are supported by the certs below */
+       /* For servers the following masks are for the key and auth
+        * algorithms that are supported by the certs below.
+        * For clients they are masks of *disabled* algorithms based
+        * on the current session.
+        */
        int valid;
        unsigned long mask_k;
        unsigned long mask_a;
        unsigned long export_mask_k;
        unsigned long export_mask_a;
+       /* Client only */
+       unsigned long mask_ssl;
 #ifndef OPENSSL_NO_RSA
        RSA *rsa_tmp;
        RSA *(*rsa_tmp_cb)(SSL *ssl,int is_export,int keysize);
@@ -533,6 +530,13 @@ typedef struct cert_st
        unsigned int cert_flags;
        CERT_PKEY pkeys[SSL_PKEY_NUM];
 
+       /* Certificate types (received or sent) in certificate request
+        * message. On receive this is only set if number of certificate
+        * types exceeds SSL3_CT_NUMBER.
+        */
+       unsigned char *ctypes;
+       size_t ctype_num;
+
        /* signature algorithms peer reports: e.g. supported signature
         * algorithms extension for server or as part of a certificate
         * request for client.
@@ -540,14 +544,25 @@ typedef struct cert_st
        unsigned char *peer_sigalgs;
        /* Size of above array */
        size_t peer_sigalgslen;
-       /* configured signature algorithms (can be NULL for default).
-        * sent in signature algorithms extension or certificate request.
+       /* suppported signature algorithms.
+        * When set on a client this is sent in the client hello as the 
+        * supported signature algorithms extension. For servers
+        * it represents the signature algorithms we are willing to use.
         */
        unsigned char *conf_sigalgs;
        /* Size of above array */
        size_t conf_sigalgslen;
+       /* Client authentication signature algorithms, if not set then
+        * uses conf_sigalgs. On servers these will be the signature
+        * algorithms sent to the client in a cerificate request for TLS 1.2.
+        * On a client this represents the signature algortithms we are
+        * willing to use for client authentication.
+        */
+       unsigned char *client_sigalgs;
+       /* Size of above array */
+       size_t client_sigalgslen;
        /* Signature algorithms shared by client and server: cached
-        * because these are used most often
+        * because these are used most often.
         */
        TLS_SIGALGS *shared_sigalgs;
        size_t shared_sigalgslen;
@@ -562,6 +577,12 @@ typedef struct cert_st
        int (*cert_cb)(SSL *ssl, void *arg);
        void *cert_cb_arg;
 
+       /* Optional X509_STORE for chain building or certificate validation
+        * If NULL the parent SSL_CTX store is used instead.
+        */
+       X509_STORE *chain_store;
+       X509_STORE *verify_store;
+
        int references; /* >1 only if SSL_copy_session_id is used */
        } CERT;
 
@@ -904,6 +925,8 @@ void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg), void *arg);
 
 int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l);
+int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags);
+int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref);
 int ssl_undefined_function(SSL *s);
 int ssl_undefined_void_function(void);
 int ssl_undefined_const_function(const SSL *s);
@@ -1157,6 +1180,7 @@ SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
 #ifndef OPENSSL_NO_EC
 int tls1_ec_curve_id2nid(int curve_id);
 int tls1_ec_nid2curve_id(int nid);
+int tls1_check_curve(SSL *s, const unsigned char *p, size_t len);
 int tls1_shared_curve(SSL *s, int nmatch);
 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
                        int *curves, size_t ncurves);
@@ -1203,8 +1227,8 @@ int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk,
 int tls12_get_sigid(const EVP_PKEY *pk);
 const EVP_MD *tls12_get_hash(unsigned char hash_alg);
 
-int tls1_set_sigalgs_list(CERT *c, const char *str);
-int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen);
+int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
+int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, int client);
 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
                                                                int idx);
 void tls1_set_cert_validity(SSL *s);
@@ -1222,7 +1246,10 @@ int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
                                          int *al);
 long ssl_get_algorithm2(SSL *s);
 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize);
-size_t tls12_get_sig_algs(SSL *s, unsigned char *p);
+size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs);
+int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
+                               const unsigned char *sig, EVP_PKEY *pkey);
+void ssl_set_client_disabled(SSL *s);
 
 int ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen);
 int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al);