diff options
| author | Richard Levitte <levitte@openssl.org> | 2015-03-26 21:33:18 +0100 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2015-03-31 20:16:01 +0200 |
| commit | dee502be89e78e2979e3bd1d7724cf79daa6ef61 (patch) | |
| tree | 53e97582c488f1a484bd42e570de6a99768fd1df /ssl | |
| parent | 30cd4ff294252c4b6a4b69cbef6a5b4117705d22 (diff) | |
| download | openssl-dee502be89e78e2979e3bd1d7724cf79daa6ef61.tar.gz | |
Stop symlinking, move files to intended directory
Rather than making include/openssl/foo.h a symlink to
crypto/foo/foo.h, this change moves the file to include/openssl/foo.h
once and for all.
Likewise, move crypto/foo/footest.c to test/footest.c, instead of
symlinking it there.
Originally-by: Geoff Thorpe <geoff@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/dtls1.h | 124 | ||||
| -rw-r--r-- | ssl/heartbeat_test.c | 468 | ||||
| -rw-r--r-- | ssl/kssl.h | 197 | ||||
| -rw-r--r-- | ssl/srtp.h | 147 | ||||
| -rw-r--r-- | ssl/ssl.h | 2440 | ||||
| -rw-r--r-- | ssl/ssl2.h | 73 | ||||
| -rw-r--r-- | ssl/ssl23.h | 84 | ||||
| -rw-r--r-- | ssl/ssl3.h | 552 | ||||
| -rw-r--r-- | ssl/ssltest.c | 3207 | ||||
| -rw-r--r-- | ssl/tls1.h | 848 |
10 files changed, 0 insertions, 8140 deletions
diff --git a/ssl/dtls1.h b/ssl/dtls1.h deleted file mode 100644 index 542ae04627..0000000000 --- a/ssl/dtls1.h +++ /dev/null @@ -1,124 +0,0 @@ -/* ssl/dtls1.h */ -/* - * DTLS implementation written by Nagendra Modadugu - * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. - */ -/* ==================================================================== - * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -#ifndef HEADER_DTLS1_H -# define HEADER_DTLS1_H - -# include <openssl/buffer.h> -# include <openssl/pqueue.h> -# ifdef OPENSSL_SYS_VMS -# include <resource.h> -# include <sys/timeb.h> -# endif -# ifdef OPENSSL_SYS_WIN32 -/* Needed for struct timeval */ -# include <winsock.h> -# elif defined(OPENSSL_SYS_NETWARE) && !defined(_WINSOCK2API_) -# include <sys/timeval.h> -# else -# if defined(OPENSSL_SYS_VXWORKS) -# include <sys/times.h> -# else -# include <sys/time.h> -# endif -# endif - -#ifdef __cplusplus -extern "C" { -#endif - -# define DTLS1_VERSION 0xFEFF -# define DTLS1_2_VERSION 0xFEFD -# define DTLS_MAX_VERSION DTLS1_2_VERSION -# define DTLS1_VERSION_MAJOR 0xFE - -# define DTLS1_BAD_VER 0x0100 - -/* Special value for method supporting multiple versions */ -# define DTLS_ANY_VERSION 0x1FFFF - -/* lengths of messages */ -# define DTLS1_COOKIE_LENGTH 256 - -# define DTLS1_RT_HEADER_LENGTH 13 - -# define DTLS1_HM_HEADER_LENGTH 12 - -# define DTLS1_HM_BAD_FRAGMENT -2 -# define DTLS1_HM_FRAGMENT_RETRY -3 - -# define DTLS1_CCS_HEADER_LENGTH 1 - -# ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE -# define DTLS1_AL_HEADER_LENGTH 7 -# else -# define DTLS1_AL_HEADER_LENGTH 2 -# endif - - -/* Timeout multipliers (timeout slice is defined in apps/timeouts.h */ -# define DTLS1_TMO_READ_COUNT 2 -# define DTLS1_TMO_WRITE_COUNT 2 - -# define DTLS1_TMO_ALERT_COUNT 12 - -#ifdef __cplusplus -} -#endif -#endif diff --git a/ssl/heartbeat_test.c b/ssl/heartbeat_test.c deleted file mode 100644 index 491bbedd18..0000000000 --- a/ssl/heartbeat_test.c +++ /dev/null @@ -1,468 +0,0 @@ -/* test/heartbeat_test.c */ -/*- - * Unit test for TLS heartbeats. - * - * Acts as a regression test against the Heartbleed bug (CVE-2014-0160). - * - * Author: Mike Bland (mbland@acm.org, http://mike-bland.com/) - * Date: 2014-04-12 - * License: Creative Commons Attribution 4.0 International (CC By 4.0) - * http://creativecommons.org/licenses/by/4.0/deed.en_US - * - * OUTPUT - * ------ - * The program returns zero on success. It will print a message with a count - * of the number of failed tests and return nonzero if any tests fail. - * - * It will print the contents of the request and response buffers for each - * failing test. In a "fixed" version, all the tests should pass and there - * should be no output. - * - * In a "bleeding" version, you'll see: - * - * test_dtls1_heartbleed failed: - * expected payload len: 0 - * received: 1024 - * sent 26 characters - * "HEARTBLEED " - * received 1024 characters - * "HEARTBLEED \xde\xad\xbe\xef..." - * ** test_dtls1_heartbleed failed ** - * - * The contents of the returned buffer in the failing test will depend on the - * contents of memory on your machine. - * - * MORE INFORMATION - * ---------------- - * http://mike-bland.com/2014/04/12/heartbleed.html - * http://mike-bland.com/tags/heartbleed.html - */ - -#define OPENSSL_UNIT_TEST - -#include "../ssl/ssl_locl.h" - -#include "testutil.h" -#include <ctype.h> -#include <stdio.h> -#include <stdlib.h> -#include <string.h> - -#if !defined(OPENSSL_NO_HEARTBEATS) && !defined(OPENSSL_NO_UNIT_TEST) - -/* As per https://tools.ietf.org/html/rfc6520#section-4 */ -# define MIN_PADDING_SIZE 16 - -/* Maximum number of payload characters to print as test output */ -# define MAX_PRINTABLE_CHARACTERS 1024 - -typedef struct heartbeat_test_fixture { - SSL_CTX *ctx; - SSL *s; - const char *test_case_name; - int (*process_heartbeat) (SSL *s, unsigned char *p, unsigned int length); - unsigned char *payload; - int sent_payload_len; - int expected_return_value; - int return_payload_offset; - int expected_payload_len; - const char *expected_return_payload; -} HEARTBEAT_TEST_FIXTURE; - -static HEARTBEAT_TEST_FIXTURE set_up(const char *const test_case_name, - const SSL_METHOD *meth) -{ - HEARTBEAT_TEST_FIXTURE fixture; - int setup_ok = 1; - memset(&fixture, 0, sizeof(fixture)); - fixture.test_case_name = test_case_name; - - fixture.ctx = SSL_CTX_new(meth); - if (!fixture.ctx) { - fprintf(stderr, "Failed to allocate SSL_CTX for test: %s\n", - test_case_name); - setup_ok = 0; - goto fail; - } - - fixture.s = SSL_new(fixture.ctx); - if (!fixture.s) { - fprintf(stderr, "Failed to allocate SSL for test: %s\n", - test_case_name); - setup_ok = 0; - goto fail; - } - - if (!ssl_init_wbio_buffer(fixture.s, 1)) { - fprintf(stderr, "Failed to set up wbio buffer for test: %s\n", - test_case_name); - setup_ok = 0; - goto fail; - } - - if (!ssl3_setup_buffers(fixture.s)) { - fprintf(stderr, "Failed to setup buffers for test: %s\n", - test_case_name); - setup_ok = 0; - goto fail; - } - - /* - * Clear the memory for the return buffer, since this isn't automatically - * zeroed in opt mode and will cause spurious test failures that will - * change with each execution. - */ - memset(fixture.s->rlayer.wbuf.buf, 0, fixture.s->rlayer.wbuf.len); - - fail: - if (!setup_ok) { - ERR_print_errors_fp(stderr); - exit(EXIT_FAILURE); - } - return fixture; -} - -static HEARTBEAT_TEST_FIXTURE set_up_dtls(const char *const test_case_name) -{ - HEARTBEAT_TEST_FIXTURE fixture = set_up(test_case_name, - DTLSv1_server_method()); - fixture.process_heartbeat = dtls1_process_heartbeat; - - /* - * As per dtls1_get_record(), skipping the following from the beginning - * of the returned heartbeat message: type-1 byte; version-2 bytes; - * sequence number-8 bytes; length-2 bytes And then skipping the 1-byte - * type encoded by process_heartbeat for a total of 14 bytes, at which - * point we can grab the length and the payload we seek. - */ - fixture.return_payload_offset = 14; - return fixture; -} - -/* Needed by ssl3_write_bytes() */ -static int dummy_handshake(SSL *s) -{ - return 1; -} - -static HEARTBEAT_TEST_FIXTURE set_up_tls(const char *const test_case_name) -{ - HEARTBEAT_TEST_FIXTURE fixture = set_up(test_case_name, - TLSv1_server_method()); - fixture.process_heartbeat = tls1_process_heartbeat; - fixture.s->handshake_func = dummy_handshake; - - /* - * As per do_ssl3_write(), skipping the following from the beginning of - * the returned heartbeat message: type-1 byte; version-2 bytes; length-2 - * bytes And then skipping the 1-byte type encoded by process_heartbeat - * for a total of 6 bytes, at which point we can grab the length and the - * payload we seek. - */ - fixture.return_payload_offset = 6; - return fixture; -} - -static void tear_down(HEARTBEAT_TEST_FIXTURE fixture) -{ - ERR_print_errors_fp(stderr); - SSL_free(fixture.s); - SSL_CTX_free(fixture.ctx); -} - -static void print_payload(const char *const prefix, - const unsigned char *payload, const int n) -{ - const int end = n < MAX_PRINTABLE_CHARACTERS ? n - : MAX_PRINTABLE_CHARACTERS; - int i = 0; - - printf("%s %d character%s", prefix, n, n == 1 ? "" : "s"); - if (end != n) - printf(" (first %d shown)", end); - printf("\n \""); - - for (; i != end; ++i) { - const unsigned char c = payload[i]; - if (isprint(c)) - fputc(c, stdout); - else - printf("\\x%02x", c); - } - printf("\"\n"); -} - -static int execute_heartbeat(HEARTBEAT_TEST_FIXTURE fixture) -{ - int result = 0; - SSL *s = fixture.s; - unsigned char *payload = fixture.payload; - unsigned char sent_buf[MAX_PRINTABLE_CHARACTERS + 1]; - int return_value; - unsigned const char *p; - int actual_payload_len; - - s->rlayer.rrec.data = payload; - s->rlayer.rrec.length = strlen((const char *)payload); - *payload++ = TLS1_HB_REQUEST; - s2n(fixture.sent_payload_len, payload); - - /* - * Make a local copy of the request, since it gets overwritten at some - * point - */ - memcpy((char *)sent_buf, (const char *)payload, sizeof(sent_buf)); - - return_value = fixture.process_heartbeat(s, s->rlayer.rrec.data, - s->rlayer.rrec.length); - - if (return_value != fixture.expected_return_value) { - printf("%s failed: expected return value %d, received %d\n", - fixture.test_case_name, fixture.expected_return_value, - return_value); - result = 1; - } - - /* - * If there is any byte alignment, it will be stored in wbuf.offset. - */ - p = &(s->rlayer. - wbuf.buf[fixture.return_payload_offset + s->rlayer.wbuf.offset]); - actual_payload_len = 0; - n2s(p, actual_payload_len); - - if (actual_payload_len != fixture.expected_payload_len) { - printf("%s failed:\n expected payload len: %d\n received: %d\n", - fixture.test_case_name, fixture.expected_payload_len, - actual_payload_len); - print_payload("sent", sent_buf, strlen((const char *)sent_buf)); - print_payload("received", p, actual_payload_len); - result = 1; - } else { - char *actual_payload = - BUF_strndup((const char *)p, actual_payload_len); - if (strcmp(actual_payload, fixture.expected_return_payload) != 0) { - printf - ("%s failed:\n expected payload: \"%s\"\n received: \"%s\"\n", - fixture.test_case_name, fixture.expected_return_payload, - actual_payload); - result = 1; - } - OPENSSL_free(actual_payload); - } - - if (result != 0) { - printf("** %s failed **\n--------\n", fixture.test_case_name); - } - return result; -} - -static int honest_payload_size(unsigned char payload_buf[]) -{ - /* Omit three-byte pad at the beginning for type and payload length */ - return strlen((const char *)&payload_buf[3]) - MIN_PADDING_SIZE; -} - -# define SETUP_HEARTBEAT_TEST_FIXTURE(type)\ - SETUP_TEST_FIXTURE(HEARTBEAT_TEST_FIXTURE, set_up_##type) - -# define EXECUTE_HEARTBEAT_TEST()\ - EXECUTE_TEST(execute_heartbeat, tear_down) - -static int test_dtls1_not_bleeding() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(dtls); - /* Three-byte pad at the beginning for type and payload length */ - unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4] = - " Not bleeding, sixteen spaces of padding" " "; - const int payload_buf_len = honest_payload_size(payload_buf); - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = payload_buf_len; - fixture.expected_return_value = 0; - fixture.expected_payload_len = payload_buf_len; - fixture.expected_return_payload = - "Not bleeding, sixteen spaces of padding"; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_dtls1_not_bleeding_empty_payload() -{ - int payload_buf_len; - - SETUP_HEARTBEAT_TEST_FIXTURE(dtls); - /* - * Three-byte pad at the beginning for type and payload length, plus a - * NUL at the end - */ - unsigned char payload_buf[4 + MAX_PRINTABLE_CHARACTERS]; - memset(payload_buf, ' ', MIN_PADDING_SIZE + 3); - payload_buf[MIN_PADDING_SIZE + 3] = '\0'; - payload_buf_len = honest_payload_size(payload_buf); - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = payload_buf_len; - fixture.expected_return_value = 0; - fixture.expected_payload_len = payload_buf_len; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_dtls1_heartbleed() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(dtls); - /* Three-byte pad at the beginning for type and payload length */ - unsigned char payload_buf[4 + MAX_PRINTABLE_CHARACTERS] = - " HEARTBLEED "; - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS; - fixture.expected_return_value = 0; - fixture.expected_payload_len = 0; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_dtls1_heartbleed_empty_payload() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(dtls); - /* - * Excluding the NUL at the end, one byte short of type + payload length - * + minimum padding - */ - unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4]; - memset(payload_buf, ' ', MIN_PADDING_SIZE + 2); - payload_buf[MIN_PADDING_SIZE + 2] = '\0'; - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS; - fixture.expected_return_value = 0; - fixture.expected_payload_len = 0; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_dtls1_heartbleed_excessive_plaintext_length() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(dtls); - /* - * Excluding the NUL at the end, one byte in excess of maximum allowed - * heartbeat message length - */ - unsigned char payload_buf[SSL3_RT_MAX_PLAIN_LENGTH + 2]; - memset(payload_buf, ' ', sizeof(payload_buf)); - payload_buf[sizeof(payload_buf) - 1] = '\0'; - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = honest_payload_size(payload_buf); - fixture.expected_return_value = 0; - fixture.expected_payload_len = 0; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_tls1_not_bleeding() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(tls); - /* Three-byte pad at the beginning for type and payload length */ - unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4] = - " Not bleeding, sixteen spaces of padding" " "; - const int payload_buf_len = honest_payload_size(payload_buf); - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = payload_buf_len; - fixture.expected_return_value = 0; - fixture.expected_payload_len = payload_buf_len; - fixture.expected_return_payload = - "Not bleeding, sixteen spaces of padding"; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_tls1_not_bleeding_empty_payload() -{ - int payload_buf_len; - - SETUP_HEARTBEAT_TEST_FIXTURE(tls); - /* - * Three-byte pad at the beginning for type and payload length, plus a - * NUL at the end - */ - unsigned char payload_buf[4 + MAX_PRINTABLE_CHARACTERS]; - memset(payload_buf, ' ', MIN_PADDING_SIZE + 3); - payload_buf[MIN_PADDING_SIZE + 3] = '\0'; - payload_buf_len = honest_payload_size(payload_buf); - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = payload_buf_len; - fixture.expected_return_value = 0; - fixture.expected_payload_len = payload_buf_len; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_tls1_heartbleed() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(tls); - /* Three-byte pad at the beginning for type and payload length */ - unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4] = - " HEARTBLEED "; - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS; - fixture.expected_return_value = 0; - fixture.expected_payload_len = 0; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -static int test_tls1_heartbleed_empty_payload() -{ - SETUP_HEARTBEAT_TEST_FIXTURE(tls); - /* - * Excluding the NUL at the end, one byte short of type + payload length - * + minimum padding - */ - unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4]; - memset(payload_buf, ' ', MIN_PADDING_SIZE + 2); - payload_buf[MIN_PADDING_SIZE + 2] = '\0'; - - fixture.payload = &payload_buf[0]; - fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS; - fixture.expected_return_value = 0; - fixture.expected_payload_len = 0; - fixture.expected_return_payload = ""; - EXECUTE_HEARTBEAT_TEST(); -} - -# undef EXECUTE_HEARTBEAT_TEST -# undef SETUP_HEARTBEAT_TEST_FIXTURE - -int main(int argc, char *argv[]) -{ - int result = 0; - - SSL_library_init(); - SSL_load_error_strings(); - - ADD_TEST(test_dtls1_not_bleeding); - ADD_TEST(test_dtls1_not_bleeding_empty_payload); - ADD_TEST(test_dtls1_heartbleed); - ADD_TEST(test_dtls1_heartbleed_empty_payload); - ADD_TEST(test_dtls1_heartbleed_excessive_plaintext_length); - ADD_TEST(test_tls1_not_bleeding); - ADD_TEST(test_tls1_not_bleeding_empty_payload); - ADD_TEST(test_tls1_heartbleed); - ADD_TEST(test_tls1_heartbleed_empty_payload); - - result = run_tests(argv[0]); - ERR_print_errors_fp(stderr); - return result; -} - -#else /* OPENSSL_NO_HEARTBEATS */ - -int main(int argc, char *argv[]) -{ - return EXIT_SUCCESS; -} -#endif /* OPENSSL_NO_HEARTBEATS */ diff --git a/ssl/kssl.h b/ssl/kssl.h deleted file mode 100644 index 9a57672801..0000000000 --- a/ssl/kssl.h +++ /dev/null @@ -1,197 +0,0 @@ -/* ssl/kssl.h -*- mode: C; c-file-style: "eay" -*- */ -/* - * Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project - * 2000. project 2000. - */ -/* ==================================================================== - * Copyright (c) 2000 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * licensing@OpenSSL.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ - -/* - ** 19990701 VRS Started. - */ - -#ifndef KSSL_H -# define KSSL_H - -# include <openssl/opensslconf.h> - -# ifndef OPENSSL_NO_KRB5 - -# include <stdio.h> -# include <ctype.h> -# include <krb5.h> -# ifdef OPENSSL_SYS_WIN32 -/* - * These can sometimes get redefined indirectly by krb5 header files after - * they get undefed in ossl_typ.h - */ -# undef X509_NAME -# undef X509_EXTENSIONS -# undef OCSP_REQUEST -# undef OCSP_RESPONSE -# endif - -#ifdef __cplusplus -extern "C" { -#endif - -/* - * Depending on which KRB5 implementation used, some types from - * the other may be missing. Resolve that here and now - */ -# ifdef KRB5_HEIMDAL -typedef unsigned char krb5_octet; -# define FAR -# else - -# ifndef FAR -# define FAR -# endif - -# endif - -/*- - * Uncomment this to debug kssl problems or - * to trace usage of the Kerberos session key - * - * #define KSSL_DEBUG - */ - -# ifndef KRB5SVC -# define KRB5SVC "host" -# endif - -# ifndef KRB5KEYTAB -# define KRB5KEYTAB "/etc/krb5.keytab" -# endif - -# ifndef KRB5SENDAUTH -# define KRB5SENDAUTH 1 -# endif - -# ifndef KRB5CHECKAUTH -# define KRB5CHECKAUTH 1 -# endif - -# ifndef KSSL_CLOCKSKEW -# define KSSL_CLOCKSKEW 300; -# endif - -# define KSSL_ERR_MAX 255 -typedef struct kssl_err_st { - int reason; - char text[KSSL_ERR_MAX + 1]; -} KSSL_ERR; - -/*- Context for passing - * (1) Kerberos session key to SSL, and - * (2) Config data between application and SSL lib - */ -typedef struct kssl_ctx_st { - /* used by: disposition: */ - char *service_name; /* C,S default ok (kssl) */ - char *service_host; /* C input, REQUIRED */ - char *client_princ; /* S output from krb5 ticket */ - char *keytab_file; /* S NULL (/etc/krb5.keytab) */ - char *cred_cache; /* C NULL (default) */ - krb5_enctype enctype; - int length; - krb5_octet FAR *key; -} KSSL_CTX; - -# define KSSL_CLIENT 1 -# define KSSL_SERVER 2 -# define KSSL_SERVICE 3 -# define KSSL_KEYTAB 4 - -# define KSSL_CTX_OK 0 -# define KSSL_CTX_ERR 1 -# define KSSL_NOMEM 2 - -/* Public (for use by applications that use OpenSSL with Kerberos 5 support */ -krb5_error_code kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text); -KSSL_CTX *kssl_ctx_new(void); -KSSL_CTX *kssl_ctx_free(KSSL_CTX *kssl_ctx); -void kssl_ctx_show(KSSL_CTX *kssl_ctx); -krb5_error_code kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which, - krb5_data *realm, krb5_data *entity, - int nentities); -krb5_error_code kssl_cget_tkt(KSSL_CTX *kssl_ctx, krb5_data **enc_tktp, - krb5_data *authenp, KSSL_ERR *kssl_err); -krb5_error_code kssl_sget_tkt(KSSL_CTX *kssl_ctx, krb5_data *indata, - krb5_ticket_times *ttimes, KSSL_ERR *kssl_err); -krb5_error_code kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session); -void kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text); -void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data); -krb5_error_code kssl_build_principal_2(krb5_context context, - krb5_principal *princ, int rlen, - const char *realm, int slen, - const char *svc, int hlen, - const char *host); -krb5_error_code kssl_validate_times(krb5_timestamp atime, - krb5_ticket_times *ttimes); -krb5_error_code kssl_check_authent(KSSL_CTX *kssl_ctx, krb5_data *authentp, - krb5_timestamp *atimep, - KSSL_ERR *kssl_err); -unsigned char *kssl_skip_confound(krb5_enctype enctype, unsigned char *authn); - -void SSL_set0_kssl_ctx(SSL *s, KSSL_CTX *kctx); -KSSL_CTX *SSL_get0_kssl_ctx(SSL *s); -char *kssl_ctx_get0_client_princ(KSSL_CTX *kctx); - -#ifdef __cplusplus -} -#endif -# endif /* OPENSSL_NO_KRB5 */ -#endif /* KSSL_H */ diff --git a/ssl/srtp.h b/ssl/srtp.h deleted file mode 100644 index 611f5efade..0000000000 --- a/ssl/srtp.h +++ /dev/null @@ -1,147 +0,0 @@ -/* ssl/srtp.h */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ -/* - * DTLS code by Eric Rescorla <ekr@rtfm.com> - * - * Copyright (C) 2006, Network Resonance, Inc. Copyright (C) 2011, RTFM, Inc. - */ - -#ifndef HEADER_D1_SRTP_H -# define HEADER_D1_SRTP_H - -# include <openssl/ssl.h> - -#ifdef __cplusplus -extern "C" { -#endif - -# define SRTP_AES128_CM_SHA1_80 0x0001 -# define SRTP_AES128_CM_SHA1_32 0x0002 -# define SRTP_AES128_F8_SHA1_80 0x0003 -# define SRTP_AES128_F8_SHA1_32 0x0004 -# define SRTP_NULL_SHA1_80 0x0005 -# define SRTP_NULL_SHA1_32 0x0006 - -# ifndef OPENSSL_NO_SRTP - -__owur int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles); -__owur int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles); - -__owur STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl); -__owur SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s); - -# endif - -#ifdef __cplusplus -} -#endif - -#endif diff --git a/ssl/ssl.h b/ssl/ssl.h deleted file mode 100644 index 50a79a8a69..0000000000 --- a/ssl/ssl.h +++ /dev/null @@ -1,2440 +0,0 @@ -/* ssl/ssl.h */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ -/* ==================================================================== - * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. - * ECC cipher suite support in OpenSSL originally developed by - * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. - */ -/* ==================================================================== - * Copyright 2005 Nokia. All rights reserved. - * - * The portions of the attached software ("Contribution") is developed by - * Nokia Corporation and is licensed pursuant to the OpenSSL open source - * license. - * - * The Contribution, originally written by Mika Kousa and Pasi Eronen of - * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites - * support (see RFC 4279) to OpenSSL. - * - * No patent licenses or other rights except those expressly stated in - * the OpenSSL open source license shall be deemed granted or received - * expressly, by implication, estoppel, or otherwise. - * - * No assurances are provided by Nokia that the Contribution does not - * infringe the patent or other intellectual property rights of any third - * party or that the license provides you with all the necessary rights - * to make use of the Contribution. - * - * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN - * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA - * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY - * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR - * OTHERWISE. - */ - -#ifndef HEADER_SSL_H -# define HEADER_SSL_H - -# include <openssl/e_os2.h> - -# ifndef OPENSSL_NO_COMP -# include <openssl/comp.h> -# endif -# include <openssl/bio.h> -# ifdef OPENSSL_USE_DEPRECATED -# include <openssl/x509.h> -# include <openssl/crypto.h> -# include <openssl/lhash.h> -# include <openssl/buffer.h> -# endif -# include <openssl/pem.h> -# include <openssl/hmac.h> - -# include <openssl/kssl.h> -# include <openssl/safestack.h> -# include <openssl/symhacks.h> - -#ifdef __cplusplus -extern "C" { -#endif - -/* SSLeay version number for ASN.1 encoding of the session information */ -/*- - * Version 0 - initial version - * Version 1 - added the optional peer certificate - */ -# define SSL_SESSION_ASN1_VERSION 0x0001 - -/* text strings for the ciphers */ - -/* - * VRS Additional Kerberos5 entries - */ -# define SSL_TXT_KRB5_DES_64_CBC_SHA SSL3_TXT_KRB5_DES_64_CBC_SHA -# define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA -# define SSL_TXT_KRB5_RC4_128_SHA SSL3_TXT_KRB5_RC4_128_SHA -# define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA -# define SSL_TXT_KRB5_DES_64_CBC_MD5 SSL3_TXT_KRB5_DES_64_CBC_MD5 -# define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5 -# define SSL_TXT_KRB5_RC4_128_MD5 SSL3_TXT_KRB5_RC4_128_MD5 -# define SSL_TXT_KRB5_IDEA_128_CBC_MD5 SSL3_TXT_KRB5_IDEA_128_CBC_MD5 - -# define SSL_TXT_KRB5_DES_40_CBC_SHA SSL3_TXT_KRB5_DES_40_CBC_SHA -# define SSL_TXT_KRB5_RC2_40_CBC_SHA SSL3_TXT_KRB5_RC2_40_CBC_SHA -# define SSL_TXT_KRB5_RC4_40_SHA SSL3_TXT_KRB5_RC4_40_SHA -# define SSL_TXT_KRB5_DES_40_CBC_MD5 SSL3_TXT_KRB5_DES_40_CBC_MD5 -# define SSL_TXT_KRB5_RC2_40_CBC_MD5 SSL3_TXT_KRB5_RC2_40_CBC_MD5 -# define SSL_TXT_KRB5_RC4_40_MD5 SSL3_TXT_KRB5_RC4_40_MD5 - -# define SSL_TXT_KRB5_DES_40_CBC_SHA SSL3_TXT_KRB5_DES_40_CBC_SHA -# define SSL_TXT_KRB5_DES_40_CBC_MD5 SSL3_TXT_KRB5_DES_40_CBC_MD5 -# define SSL_TXT_KRB5_DES_64_CBC_SHA SSL3_TXT_KRB5_DES_64_CBC_SHA -# define SSL_TXT_KRB5_DES_64_CBC_MD5 SSL3_TXT_KRB5_DES_64_CBC_MD5 -# define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA -# define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5 -# define SSL_MAX_KRB5_PRINCIPAL_LENGTH 256 - -# define SSL_MAX_SSL_SESSION_ID_LENGTH 32 -# define SSL_MAX_SID_CTX_LENGTH 32 - -# define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8) -# define SSL_MAX_KEY_ARG_LENGTH 8 -# define SSL_MAX_MASTER_KEY_LENGTH 48 - -/* These are used to specify which ciphers to use and not to use */ - -# define SSL_TXT_EXP40 "EXPORT40" -# define SSL_TXT_EXP56 "EXPORT56" -# define SSL_TXT_LOW "LOW" -# define SSL_TXT_MEDIUM "MEDIUM" -# define SSL_TXT_HIGH "HIGH" -# define SSL_TXT_FIPS "FIPS" - -# define SSL_TXT_aNULL "aNULL" -# define SSL_TXT_eNULL "eNULL" -# define SSL_TXT_NULL "NULL" - -# define SSL_TXT_kRSA "kRSA" -# define SSL_TXT_kDHr "kDHr" -# define SSL_TXT_kDHd "kDHd" -# define SSL_TXT_kDH "kDH" -# define SSL_TXT_kEDH "kEDH"/* alias for kDHE */ -# define SSL_TXT_kDHE "kDHE" -# define SSL_TXT_kKRB5 "kKRB5" -# define SSL_TXT_kECDHr "kECDHr" -# define SSL_TXT_kECDHe "kECDHe" -# define SSL_TXT_kECDH "kECDH" -# define SSL_TXT_kEECDH "kEECDH"/* alias for kECDHE */ -# define SSL_TXT_kECDHE "kECDHE" -# define SSL_TXT_kPSK "kPSK" -# define SSL_TXT_kGOST "kGOST" -# define SSL_TXT_kSRP "kSRP" - -# define SSL_TXT_aRSA "aRSA" -# define SSL_TXT_aDSS "aDSS" -# define SSL_TXT_aDH "aDH" -# define SSL_TXT_aECDH "aECDH" -# define SSL_TXT_aKRB5 "aKRB5" -# define SSL_TXT_aECDSA "aECDSA" -# define SSL_TXT_aPSK "aPSK" -# define SSL_TXT_aGOST94 "aGOST94" -# define SSL_TXT_aGOST01 "aGOST01" -# define SSL_TXT_aGOST "aGOST" -# define SSL_TXT_aSRP "aSRP" - -# define SSL_TXT_DSS "DSS" -# define SSL_TXT_DH "DH" -# define SSL_TXT_DHE "DHE"/* same as "kDHE:-ADH" */ -# define SSL_TXT_EDH "EDH"/* alias for DHE */ -# define SSL_TXT_ADH "ADH" -# define SSL_TXT_RSA "RSA" -# define SSL_TXT_ECDH "ECDH" -# define SSL_TXT_EECDH "EECDH"/* alias for ECDHE" */ -# define SSL_TXT_ECDHE "ECDHE"/* same as "kECDHE:-AECDH" */ -# define SSL_TXT_AECDH "AECDH" -# define SSL_TXT_ECDSA "ECDSA" -# define SSL_TXT_KRB5 "KRB5" -# define SSL_TXT_PSK "PSK" -# define SSL_TXT_SRP "SRP" - -# define SSL_TXT_DES "DES" -# define SSL_TXT_3DES "3DES" -# define SSL_TXT_RC4 "RC4" -# define SSL_TXT_RC2 "RC2" -# define SSL_TXT_IDEA "IDEA" -# define SSL_TXT_SEED "SEED" -# define SSL_TXT_AES128 "AES128" -# define SSL_TXT_AES256 "AES256" -# define SSL_TXT_AES "AES" -# define SSL_TXT_AES_GCM "AESGCM" -# define SSL_TXT_CAMELLIA128 "CAMELLIA128" -# define SSL_TXT_CAMELLIA256 "CAMELLIA256" -# define SSL_TXT_CAMELLIA "CAMELLIA" - -# define SSL_TXT_MD5 "MD5" -# define SSL_TXT_SHA1 "SHA1" -# define SSL_TXT_SHA "SHA"/* same as "SHA1" */ -# define SSL_TXT_GOST94 "GOST94" -# define SSL_TXT_GOST89MAC "GOST89MAC" -# define SSL_TXT_SHA256 "SHA256" -# define SSL_TXT_SHA384 "SHA384" - -# define SSL_TXT_SSLV3 "SSLv3" -# define SSL_TXT_TLSV1 "TLSv1" -# define SSL_TXT_TLSV1_1 "TLSv1.1" -# define SSL_TXT_TLSV1_2 "TLSv1.2" - -# define SSL_TXT_EXP "EXP" -# define SSL_TXT_EXPORT "EXPORT" - -# define SSL_TXT_ALL "ALL" - -/*- - * COMPLEMENTOF* definitions. These identifiers are used to (de-select) - * ciphers normally not being used. - * Example: "RC4" will activate all ciphers using RC4 including ciphers - * without authentication, which would normally disabled by DEFAULT (due - * the "!ADH" being part of default). Therefore "RC4:!COMPLEMENTOFDEFAULT" - * will make sure that it is also disabled in the specific selection. - * COMPLEMENTOF* identifiers are portable between version, as adjustments - * to the default cipher setup will also be included here. - * - * COMPLEMENTOFDEFAULT does not experience the same special treatment that - * DEFAULT gets, as only selection is being done and no sorting as needed - * for DEFAULT. - */ -# define SSL_TXT_CMPALL "COMPLEMENTOFALL" -# define SSL_TXT_CMPDEF "COMPLEMENTOFDEFAULT" - -/* - * The following cipher list is used by default. It also is substituted when - * an application-defined cipher list string starts with 'DEFAULT'. - */ -# define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL" -/* - * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always - * starts with a reasonable order, and all we have to do for DEFAULT is - * throwing out anonymous and unencrypted ciphersuites! (The latter are not - * actually enabled by ALL, but "ALL:RSA" would enable some of them.) - */ - -/* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ -# define SSL_SENT_SHUTDOWN 1 -# define SSL_RECEIVED_SHUTDOWN 2 - -#ifdef __cplusplus -} -#endif - -#ifdef __cplusplus -extern "C" { -#endif - -# define SSL_FILETYPE_ASN1 X509_FILETYPE_ASN1 -# define SSL_FILETYPE_PEM X509_FILETYPE_PEM - -/* - * This is needed to stop compilers complaining about the 'struct ssl_st *' - * function parameters used to prototype callbacks in SSL_CTX. - */ -typedef struct ssl_st *ssl_crock_st; -typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT; -typedef struct ssl_method_st SSL_METHOD; -typedef struct ssl_cipher_st SSL_CIPHER; -typedef struct ssl_session_st SSL_SESSION; -typedef struct tls_sigalgs_st TLS_SIGALGS; -typedef struct ssl_conf_ctx_st SSL_CONF_CTX; - -DECLARE_STACK_OF(SSL_CIPHER) - -/* SRTP protection profiles for use with the use_srtp extension (RFC 5764)*/ -typedef struct srtp_protection_profile_st { - const char *name; - unsigned long id; -} SRTP_PROTECTION_PROFILE; - -DECLARE_STACK_OF(SRTP_PROTECTION_PROFILE) - -typedef int (*tls_session_ticket_ext_cb_fn) (SSL *s, - const unsigned char *data, - int len, void *arg); -typedef int (*tls_session_secret_cb_fn) (SSL *s, void *secret, - int *secret_len, - STACK_OF(SSL_CIPHER) *peer_ciphers, - SSL_CIPHER **cipher, void *arg); - -# ifndef OPENSSL_NO_TLSEXT - -/* Typedefs for handling custom extensions */ - -typedef int (*custom_ext_add_cb) (SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *add_arg); - -typedef void (*custom_ext_free_cb) (SSL *s, unsigned int ext_type, - const unsigned char *out, void *add_arg); - -typedef int (*custom_ext_parse_cb) (SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *parse_arg); - -# endif - -/* Allow initial connection to servers that don't support RI */ -# define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004L -/* Removed from OpenSSL 0.9.8q and 1.0.0c */ -# define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x0L -# define SSL_OP_TLSEXT_PADDING 0x00000010L -# define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L -# define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x00000040L -# define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x00000080L -# define SSL_OP_TLS_D5_BUG 0x00000100L -# define SSL_OP_TLS_BLOCK_PADDING_BUG 0x00000200L - -/* Hasn't done anything since OpenSSL 0.9.7h, retained for compatibility */ -# define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x0 -/* Refers to ancient SSLREF and SSLv2, retained for compatibility */ -# define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x0 -/* Related to removed SSLv2 */ -# define SSL_OP_MICROSOFT_SESS_ID_BUG 0x0 -# define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x0 - -/* - * Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added in - * OpenSSL 0.9.6d. Usually (depending on the application protocol) the - * workaround is not needed. Unfortunately some broken SSL/TLS - * implementations cannot handle it at all, which is why we include it in - * SSL_OP_ALL. - */ -/* added in 0.9.6e */ -# define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 0x00000800L - -/* - * SSL_OP_ALL: various bug workarounds that should be rather harmless. This - * used to be 0x000FFFFFL before 0.9.7. - */ -# define SSL_OP_ALL 0x80000BFFL - -/* DTLS options */ -# define SSL_OP_NO_QUERY_MTU 0x00001000L -/* Turn on Cookie Exchange (on relevant for servers) */ -# define SSL_OP_COOKIE_EXCHANGE 0x00002000L -/* Don't use RFC4507 ticket extension */ -# define SSL_OP_NO_TICKET 0x00004000L -/* Use Cisco's "speshul" version of DTLS_BAD_VER (as client) */ -# define SSL_OP_CISCO_ANYCONNECT 0x00008000L - -/* As server, disallow session resumption on renegotiation */ -# define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0x00010000L -/* Don't use compression even if supported */ -# define SSL_OP_NO_COMPRESSION 0x00020000L -/* Permit unsafe legacy renegotiation */ -# define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0x00040000L -/* If set, always create a new key when using tmp_ecdh parameters */ -# define SSL_OP_SINGLE_ECDH_USE 0x00080000L -/* If set, always create a new key when using tmp_dh parameters */ -# define SSL_OP_SINGLE_DH_USE 0x00100000L -/* Does nothing: retained for compatibiity */ -# define SSL_OP_EPHEMERAL_RSA 0x0 -/* - * Set on servers to choose the cipher according to the server's preferences - */ -# define SSL_OP_CIPHER_SERVER_PREFERENCE 0x00400000L -/* - * If set, a server will allow a client to issue a SSLv3.0 version number as - * latest version supported in the premaster secret, even when TLSv1.0 - * (version 3.1) was announced in the client hello. Normally this is - * forbidden to prevent version rollback attacks. - */ -# define SSL_OP_TLS_ROLLBACK_BUG 0x00800000L - -# define SSL_OP_NO_SSLv2 0x00000000L -# define SSL_OP_NO_SSLv3 0x02000000L -# define SSL_OP_NO_TLSv1 0x04000000L -# define SSL_OP_NO_TLSv1_2 0x08000000L -# define SSL_OP_NO_TLSv1_1 0x10000000L - -# define SSL_OP_NO_DTLSv1 0x04000000L -# define SSL_OP_NO_DTLSv1_2 0x08000000L - -# define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv3|\ - SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2) - -/* - * These next two were never actually used for anything since SSLeay zap so - * we have some more flags. - */ -/* - * The next flag deliberately changes the ciphertest, this is a check for the - * PKCS#1 attack - */ -# define SSL_OP_PKCS1_CHECK_1 0x0 -# define SSL_OP_PKCS1_CHECK_2 0x0 - -/* Removed as of OpenSSL 1.1.0 */ -# define SSL_OP_NETSCAPE_CA_DN_BUG 0x0 -/* Removed as of OpenSSL 1.1.0 */ -# define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG 0x0L -/* - * Make server add server-hello extension from early version of cryptopro - * draft, when GOST ciphersuite is negotiated. Required for interoperability - * with CryptoPro CSP 3.x - */ -# define SSL_OP_CRYPTOPRO_TLSEXT_BUG 0x80000000L - -/* - * Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success - * when just a single record has been written): - */ -# define SSL_MODE_ENABLE_PARTIAL_WRITE 0x00000001L -/* - * Make it possible to retry SSL_write() with changed buffer location (buffer - * contents must stay the same!); this is not the default to avoid the - * misconception that non-blocking SSL_write() behaves like non-blocking - * write(): - */ -# define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L -/* - * Never bother the application with retries if the transport is blocking: - */ -# define SSL_MODE_AUTO_RETRY 0x00000004L -/* Don't attempt to automatically build certificate chain */ -# define SSL_MODE_NO_AUTO_CHAIN 0x00000008L -/* - * Save RAM by releasing read and write buffers when they're empty. (SSL3 and - * TLS only.) "Released" buffers are put onto a free-list in the context or - * just freed (depending on the context's setting for freelist_max_len). - */ -# define SSL_MODE_RELEASE_BUFFERS 0x00000010L -/* - * Send the current time in the Random fields of the ClientHello and - * ServerHello records for compatibility with hypothetical implementations - * that require it. - */ -# define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L -# define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L -/* - * Send TLS_FALLBACK_SCSV in the ClientHello. To be set only by applications - * that reconnect with a downgraded protocol version; see - * draft-ietf-tls-downgrade-scsv-00 for details. DO NOT ENABLE THIS if your - * application attempts a normal handshake. Only use this in explicit - * fallback retries, following the guidance in - * draft-ietf-tls-downgrade-scsv-00. - */ -# define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L - -/* Cert related flags */ -/* - * Many implementations ignore some aspects of the TLS standards such as - * enforcing certifcate chain algorithms. When this is set we enforce them. - */ -# define SSL_CERT_FLAG_TLS_STRICT 0x00000001L - -/* Suite B modes, takes same values as certificate verify flags */ -# define SSL_CERT_FLAG_SUITEB_128_LOS_ONLY 0x10000 -/* Suite B 192 bit only mode */ -# define SSL_CERT_FLAG_SUITEB_192_LOS 0x20000 -/* Suite B 128 bit mode allowing 192 bit algorithms */ -# define SSL_CERT_FLAG_SUITEB_128_LOS 0x30000 - -/* Perform all sorts of protocol violations for testing purposes */ -# define SSL_CERT_FLAG_BROKEN_PROTOCOL 0x10000000 - -/* Flags for building certificate chains */ -/* Treat any existing certificates as untrusted CAs */ -# define SSL_BUILD_CHAIN_FLAG_UNTRUSTED 0x1 -/* Don't include root CA in chain */ -# define SSL_BUILD_CHAIN_FLAG_NO_ROOT 0x2 -/* Just check certificates already there */ -# define SSL_BUILD_CHAIN_FLAG_CHECK 0x4 -/* Ignore verification errors */ -# define SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR 0x8 -/* Clear verification errors from queue */ -# define SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR 0x10 - -/* Flags returned by SSL_check_chain */ -/* Certificate can be used with this session */ -# define CERT_PKEY_VALID 0x1 -/* Certificate can also be used for signing */ -# define CERT_PKEY_SIGN 0x2 -/* EE certificate signing algorithm OK */ -# define CERT_PKEY_EE_SIGNATURE 0x10 -/* CA signature algorithms OK */ -# define CERT_PKEY_CA_SIGNATURE 0x20 -/* EE certificate parameters OK */ -# define CERT_PKEY_EE_PARAM 0x40 -/* CA certificate parameters OK */ -# define CERT_PKEY_CA_PARAM 0x80 -/* Signing explicitly allowed as opposed to SHA1 fallback */ -# define CERT_PKEY_EXPLICIT_SIGN 0x100 -/* Client CA issuer names match (always set for server cert) */ -# define CERT_PKEY_ISSUER_NAME 0x200 -/* Cert type matches client types (always set for server cert) */ -# define CERT_PKEY_CERT_TYPE 0x400 -/* Cert chain suitable to Suite B */ -# define CERT_PKEY_SUITEB 0x800 - -# define SSL_CONF_FLAG_CMDLINE 0x1 -# define SSL_CONF_FLAG_FILE 0x2 -# define SSL_CONF_FLAG_CLIENT 0x4 -# define SSL_CONF_FLAG_SERVER 0x8 -# define SSL_CONF_FLAG_SHOW_ERRORS 0x10 -# define SSL_CONF_FLAG_CERTIFICATE 0x20 -# define SSL_CONF_FLAG_REQUIRE_PRIVATE 0x40 -/* Configuration value types */ -# define SSL_CONF_TYPE_UNKNOWN 0x0 -# define SSL_CONF_TYPE_STRING 0x1 -# define SSL_CONF_TYPE_FILE 0x2 -# define SSL_CONF_TYPE_DIR 0x3 - -/* - * Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, they - * cannot be used to clear bits. - */ - -# define SSL_CTX_set_options(ctx,op) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL) -# define SSL_CTX_clear_options(ctx,op) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL) -# define SSL_CTX_get_options(ctx) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL) -# define SSL_set_options(ssl,op) \ - SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL) -# define SSL_clear_options(ssl,op) \ - SSL_ctrl((ssl),SSL_CTRL_CLEAR_OPTIONS,(op),NULL) -# define SSL_get_options(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL) - -# define SSL_CTX_set_mode(ctx,op) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL) -# define SSL_CTX_clear_mode(ctx,op) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_MODE,(op),NULL) -# define SSL_CTX_get_mode(ctx) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL) -# define SSL_clear_mode(ssl,op) \ - SSL_ctrl((ssl),SSL_CTRL_CLEAR_MODE,(op),NULL) -# define SSL_set_mode(ssl,op) \ - SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL) -# define SSL_get_mode(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL) -# define SSL_set_mtu(ssl, mtu) \ - SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL) -# define DTLS_set_link_mtu(ssl, mtu) \ - SSL_ctrl((ssl),DTLS_CTRL_SET_LINK_MTU,(mtu),NULL) -# define DTLS_get_link_min_mtu(ssl) \ - SSL_ctrl((ssl),DTLS_CTRL_GET_LINK_MIN_MTU,0,NULL) - -# define SSL_get_secure_renegotiation_support(ssl) \ - SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL) - -# ifndef OPENSSL_NO_HEARTBEATS -# define SSL_heartbeat(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_TLS_EXT_SEND_HEARTBEAT,0,NULL) -# endif - -# define SSL_CTX_set_cert_flags(ctx,op) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_CERT_FLAGS,(op),NULL) -# define SSL_set_cert_flags(s,op) \ - SSL_ctrl((s),SSL_CTRL_CERT_FLAGS,(op),NULL) -# define SSL_CTX_clear_cert_flags(ctx,op) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_CERT_FLAGS,(op),NULL) -# define SSL_clear_cert_flags(s,op) \ - SSL_ctrl((s),SSL_CTRL_CLEAR_CERT_FLAGS,(op),NULL) - -void SSL_CTX_set_msg_callback(SSL_CTX *ctx, - void (*cb) (int write_p, int version, - int content_type, const void *buf, - size_t len, SSL *ssl, void *arg)); -void SSL_set_msg_callback(SSL *ssl, - void (*cb) (int write_p, int version, - int content_type, const void *buf, - size_t len, SSL *ssl, void *arg)); -# define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg)) -# define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg)) - -# define SSL_get_extms_support(s) \ - SSL_ctrl((s),SSL_CTRL_GET_EXTMS_SUPPORT,0,NULL) - -# ifndef OPENSSL_NO_SRP - -/* see tls_srp.c */ -__owur int SSL_SRP_CTX_init(SSL *s); -__owur int SSL_CTX_SRP_CTX_init(SSL_CTX *ctx); -int SSL_SRP_CTX_free(SSL *ctx); -int SSL_CTX_SRP_CTX_free(SSL_CTX *ctx); -__owur int SSL_srp_server_param_with_username(SSL *s, int *ad); -__owur int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key); -__owur int SRP_Calc_A_param(SSL *s); -__owur int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key); - -# endif - -# if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32) -# define SSL_MAX_CERT_LIST_DEFAULT 1024*30 - /* 30k max cert list :-) */ -# else -# define SSL_MAX_CERT_LIST_DEFAULT 1024*100 - /* 100k max cert list :-) */ -# endif - -# define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT (1024*20) - -/* - * This callback type is used inside SSL_CTX, SSL, and in the functions that - * set them. It is used to override the generation of SSL/TLS session IDs in - * a server. Return value should be zero on an error, non-zero to proceed. - * Also, callbacks should themselves check if the id they generate is unique - * otherwise the SSL handshake will fail with an error - callbacks can do - * this using the 'ssl' value they're passed by; - * SSL_has_matching_session_id(ssl, id, *id_len) The length value passed in - * is set at the maximum size the session ID can be. In SSLv3/TLSv1 it is 32 - * bytes. The callback can alter this length to be less if desired. It is - * also an error for the callback to set the size to zero. - */ -typedef int (*GEN_SESSION_CB) (const SSL *ssl, unsigned char *id, - unsigned int *id_len); - -typedef struct ssl_comp_st SSL_COMP; - - -# define SSL_SESS_CACHE_OFF 0x0000 -# define SSL_SESS_CACHE_CLIENT 0x0001 -# define SSL_SESS_CACHE_SERVER 0x0002 -# define SSL_SESS_CACHE_BOTH (SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER) -# define SSL_SESS_CACHE_NO_AUTO_CLEAR 0x0080 -/* enough comments already ... see SSL_CTX_set_session_cache_mode(3) */ -# define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP 0x0100 -# define SSL_SESS_CACHE_NO_INTERNAL_STORE 0x0200 -# define SSL_SESS_CACHE_NO_INTERNAL \ - (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP|SSL_SESS_CACHE_NO_INTERNAL_STORE) - -LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx); -# define SSL_CTX_sess_number(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL) -# define SSL_CTX_sess_connect(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL) -# define SSL_CTX_sess_connect_good(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL) -# define SSL_CTX_sess_connect_renegotiate(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL) -# define SSL_CTX_sess_accept(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL) -# define SSL_CTX_sess_accept_renegotiate(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL) -# define SSL_CTX_sess_accept_good(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL) -# define SSL_CTX_sess_hits(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL) -# define SSL_CTX_sess_cb_hits(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL) -# define SSL_CTX_sess_misses(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL) -# define SSL_CTX_sess_timeouts(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL) -# define SSL_CTX_sess_cache_full(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL) - -void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, - int (*new_session_cb) (struct ssl_st *ssl, - SSL_SESSION *sess)); -int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx)) (struct ssl_st *ssl, - SSL_SESSION *sess); -void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, - void (*remove_session_cb) (struct ssl_ctx_st - *ctx, - SSL_SESSION - *sess)); -void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx)) (struct ssl_ctx_st *ctx, - SSL_SESSION *sess); -void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, - SSL_SESSION *(*get_session_cb) (struct ssl_st - *ssl, - unsigned char - *data, int len, - int *copy)); -SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx)) (struct ssl_st *ssl, - unsigned char *Data, - int len, int *copy); -void SSL_CTX_set_info_callback(SSL_CTX *ctx, - void (*cb) (const SSL *ssl, int type, - int val)); -void (*SSL_CTX_get_info_callback(SSL_CTX *ctx)) (const SSL *ssl, int type, - int val); -void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, - int (*client_cert_cb) (SSL *ssl, X509 **x509, - EVP_PKEY **pkey)); -int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx)) (SSL *ssl, X509 **x509, - EVP_PKEY **pkey); -# ifndef OPENSSL_NO_ENGINE -__owur int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e); -# endif -void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, - int (*app_gen_cookie_cb) (SSL *ssl, - unsigned char - *cookie, - unsigned int - *cookie_len)); -void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, - int (*app_verify_cookie_cb) (SSL *ssl, - unsigned char - *cookie, - unsigned int - cookie_len)); -# ifndef OPENSSL_NO_NEXTPROTONEG -void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *s, - int (*cb) (SSL *ssl, - const unsigned char - **out, - unsigned int *outlen, - void *arg), void *arg); -void SSL_CTX_set_next_proto_select_cb(SSL_CTX *s, - int (*cb) (SSL *ssl, - unsigned char **out, - unsigned char *outlen, - const unsigned char *in, - unsigned int inlen, - void *arg), void *arg); -void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, - unsigned *len); -# endif - -# ifndef OPENSSL_NO_TLSEXT -__owur int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, - const unsigned char *in, unsigned int inlen, - const unsigned char *client, - unsigned int client_len); -# endif - -# define OPENSSL_NPN_UNSUPPORTED 0 -# define OPENSSL_NPN_NEGOTIATED 1 -# define OPENSSL_NPN_NO_OVERLAP 2 - -__owur int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, - unsigned protos_len); -__owur int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos, - unsigned protos_len); -void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, - int (*cb) (SSL *ssl, - const unsigned char **out, - unsigned char *outlen, - const unsigned char *in, - unsigned int inlen, - void *arg), void *arg); -void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, - unsigned *len); - -# ifndef OPENSSL_NO_PSK -/* - * the maximum length of the buffer given to callbacks containing the - * resulting identity/psk - */ -# define PSK_MAX_IDENTITY_LEN 128 -# define PSK_MAX_PSK_LEN 256 -void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, - unsigned int (*psk_client_callback) (SSL - *ssl, - const - char - *hint, - char - *identity, - unsigned - int - max_identity_len, - unsigned - char - *psk, - unsigned - int - max_psk_len)); -void SSL_set_psk_client_callback(SSL *ssl, - unsigned int (*psk_client_callback) (SSL - *ssl, - const - char - *hint, - char - *identity, - unsigned - int - max_identity_len, - unsigned - char - *psk, - unsigned - int - max_psk_len)); -void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, - unsigned int (*psk_server_callback) (SSL - *ssl, - const - char - *identity, - unsigned - char - *psk, - unsigned - int - max_psk_len)); -void SSL_set_psk_server_callback(SSL *ssl, - unsigned int (*psk_server_callback) (SSL - *ssl, - const - char - *identity, - unsigned - char - *psk, - unsigned - int - max_psk_len)); -__owur int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint); -__owur int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint); -const char *SSL_get_psk_identity_hint(const SSL *s); -const char *SSL_get_psk_identity(const SSL *s); -# endif - -# ifndef OPENSSL_NO_TLSEXT -/* Register callbacks to handle custom TLS Extensions for client or server. */ - -__owur int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type, - custom_ext_add_cb add_cb, - custom_ext_free_cb free_cb, - void *add_arg, - custom_ext_parse_cb parse_cb, - void *parse_arg); - -__owur int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type, - custom_ext_add_cb add_cb, - custom_ext_free_cb free_cb, - void *add_arg, - custom_ext_parse_cb parse_cb, - void *parse_arg); - -__owur int SSL_extension_supported(unsigned int ext_type); - -# endif - -# define SSL_NOTHING 1 -# define SSL_WRITING 2 -# define SSL_READING 3 -# define SSL_X509_LOOKUP 4 - -/* These will only be used when doing non-blocking IO */ -# define SSL_want_nothing(s) (SSL_want(s) == SSL_NOTHING) -# define SSL_want_read(s) (SSL_want(s) == SSL_READING) -# define SSL_want_write(s) (SSL_want(s) == SSL_WRITING) -# define SSL_want_x509_lookup(s) (SSL_want(s) == SSL_X509_LOOKUP) - -# define SSL_MAC_FLAG_READ_MAC_STREAM 1 -# define SSL_MAC_FLAG_WRITE_MAC_STREAM 2 - -#ifdef __cplusplus -} -#endif - -# include <openssl/ssl2.h> -# include <openssl/ssl3.h> -# include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */ -# include <openssl/dtls1.h> /* Datagram TLS */ -# include <openssl/ssl23.h> -# include <openssl/srtp.h> /* Support for the use_srtp extension */ - -#ifdef __cplusplus -extern "C" { -#endif - -/* compatibility */ -# define SSL_set_app_data(s,arg) (SSL_set_ex_data(s,0,(char *)arg)) -# define SSL_get_app_data(s) (SSL_get_ex_data(s,0)) -# define SSL_SESSION_set_app_data(s,a) (SSL_SESSION_set_ex_data(s,0,(char *)a)) -# define SSL_SESSION_get_app_data(s) (SSL_SESSION_get_ex_data(s,0)) -# define SSL_CTX_get_app_data(ctx) (SSL_CTX_get_ex_data(ctx,0)) -# define SSL_CTX_set_app_data(ctx,arg) (SSL_CTX_set_ex_data(ctx,0,(char *)arg)) - -/* - * The following are the possible values for ssl->state are are used to - * indicate where we are up to in the SSL connection establishment. The - * macros that follow are about the only things you should need to use and - * even then, only when using non-blocking IO. It can also be useful to work - * out where you were when the connection failed - */ - -# define SSL_ST_CONNECT 0x1000 -# define SSL_ST_ACCEPT 0x2000 -# define SSL_ST_MASK 0x0FFF -# define SSL_ST_INIT (SSL_ST_CONNECT|SSL_ST_ACCEPT) -# define SSL_ST_BEFORE 0x4000 -# define SSL_ST_OK 0x03 -# define SSL_ST_RENEGOTIATE (0x04|SSL_ST_INIT) - -# define SSL_CB_LOOP 0x01 -# define SSL_CB_EXIT 0x02 -# define SSL_CB_READ 0x04 -# define SSL_CB_WRITE 0x08 -# define SSL_CB_ALERT 0x4000/* used in callback */ -# define SSL_CB_READ_ALERT (SSL_CB_ALERT|SSL_CB_READ) -# define SSL_CB_WRITE_ALERT (SSL_CB_ALERT|SSL_CB_WRITE) -# define SSL_CB_ACCEPT_LOOP (SSL_ST_ACCEPT|SSL_CB_LOOP) -# define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT|SSL_CB_EXIT) -# define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT|SSL_CB_LOOP) -# define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT|SSL_CB_EXIT) -# define SSL_CB_HANDSHAKE_START 0x10 -# define SSL_CB_HANDSHAKE_DONE 0x20 - -/* Is the SSL_connection established? */ -# define SSL_get_state(a) SSL_state(a) -# define SSL_is_init_finished(a) (SSL_state(a) == SSL_ST_OK) -# define SSL_in_init(a) (SSL_state(a)&SSL_ST_INIT) -# define SSL_in_before(a) (SSL_state(a)&SSL_ST_BEFORE) -# define SSL_in_connect_init(a) (SSL_state(a)&SSL_ST_CONNECT) -# define SSL_in_accept_init(a) (SSL_state(a)&SSL_ST_ACCEPT) - -/* - * The following 3 states are kept in ssl->rlayer.rstate when reads fail, you - * should not need these - */ -# define SSL_ST_READ_HEADER 0xF0 -# define SSL_ST_READ_BODY 0xF1 -# define SSL_ST_READ_DONE 0xF2 - -/*- - * Obtain latest Finished message - * -- that we sent (SSL_get_finished) - * -- that we expected from peer (SSL_get_peer_finished). - * Returns length (0 == no Finished so far), copies up to 'count' bytes. - */ -size_t SSL_get_finished(const SSL *s, void *buf, size_t count); -size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count); - -/* - * use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options are - * 'ored' with SSL_VERIFY_PEER if they are desired - */ -# define SSL_VERIFY_NONE 0x00 -# define SSL_VERIFY_PEER 0x01 -# define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02 -# define SSL_VERIFY_CLIENT_ONCE 0x04 - -# define OpenSSL_add_ssl_algorithms() SSL_library_init() -# define SSLeay_add_ssl_algorithms() SSL_library_init() - -/* More backward compatibility */ -# define SSL_get_cipher(s) \ - SSL_CIPHER_get_name(SSL_get_current_cipher(s)) -# define SSL_get_cipher_bits(s,np) \ - SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np) -# define SSL_get_cipher_version(s) \ - SSL_CIPHER_get_version(SSL_get_current_cipher(s)) -# define SSL_get_cipher_name(s) \ - SSL_CIPHER_get_name(SSL_get_current_cipher(s)) -# define SSL_get_time(a) SSL_SESSION_get_time(a) -# define SSL_set_time(a,b) SSL_SESSION_set_time((a),(b)) -# define SSL_get_timeout(a) SSL_SESSION_get_timeout(a) -# define SSL_set_timeout(a,b) SSL_SESSION_set_timeout((a),(b)) - -# define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id) -# define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id) - -DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) -# define SSL_AD_REASON_OFFSET 1000/* offset to get SSL_R_... value - * from SSL_AD_... */ -/* These alert types are for SSLv3 and TLSv1 */ -# define SSL_AD_CLOSE_NOTIFY SSL3_AD_CLOSE_NOTIFY -/* fatal */ -# define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE -/* fatal */ -# define SSL_AD_BAD_RECORD_MAC SSL3_AD_BAD_RECORD_MAC -# define SSL_AD_DECRYPTION_FAILED TLS1_AD_DECRYPTION_FAILED -# define SSL_AD_RECORD_OVERFLOW TLS1_AD_RECORD_OVERFLOW -/* fatal */ -# define SSL_AD_DECOMPRESSION_FAILURE SSL3_AD_DECOMPRESSION_FAILURE -/* fatal */ -# define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE -/* Not for TLS */ -# define SSL_AD_NO_CERTIFICATE SSL3_AD_NO_CERTIFICATE -# define SSL_AD_BAD_CERTIFICATE SSL3_AD_BAD_CERTIFICATE -# define SSL_AD_UNSUPPORTED_CERTIFICATE SSL3_AD_UNSUPPORTED_CERTIFICATE -# define SSL_AD_CERTIFICATE_REVOKED SSL3_AD_CERTIFICATE_REVOKED -# define SSL_AD_CERTIFICATE_EXPIRED SSL3_AD_CERTIFICATE_EXPIRED -# define SSL_AD_CERTIFICATE_UNKNOWN SSL3_AD_CERTIFICATE_UNKNOWN -/* fatal */ -# define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER -/* fatal */ -# define SSL_AD_UNKNOWN_CA TLS1_AD_UNKNOWN_CA -/* fatal */ -# define SSL_AD_ACCESS_DENIED TLS1_AD_ACCESS_DENIED -/* fatal */ -# define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR -# define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR -/* fatal */ -# define SSL_AD_EXPORT_RESTRICTION TLS1_AD_EXPORT_RESTRICTION -/* fatal */ -# define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION -/* fatal */ -# define SSL_AD_INSUFFICIENT_SECURITY TLS1_AD_INSUFFICIENT_SECURITY -/* fatal */ -# define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR -# define SSL_AD_USER_CANCELLED TLS1_AD_USER_CANCELLED -# define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION -# define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION -# define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE -# define SSL_AD_UNRECOGNIZED_NAME TLS1_AD_UNRECOGNIZED_NAME -# define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE -# define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE -/* fatal */ -# define SSL_AD_UNKNOWN_PSK_IDENTITY TLS1_AD_UNKNOWN_PSK_IDENTITY -/* fatal */ -# define SSL_AD_INAPPROPRIATE_FALLBACK TLS1_AD_INAPPROPRIATE_FALLBACK -# define SSL_ERROR_NONE 0 -# define SSL_ERROR_SSL 1 -# define SSL_ERROR_WANT_READ 2 -# define SSL_ERROR_WANT_WRITE 3 -# define SSL_ERROR_WANT_X509_LOOKUP 4 -# define SSL_ERROR_SYSCALL 5/* look at error stack/return - * value/errno */ -# define SSL_ERROR_ZERO_RETURN 6 -# define SSL_ERROR_WANT_CONNECT 7 -# define SSL_ERROR_WANT_ACCEPT 8 -# define SSL_CTRL_NEED_TMP_RSA 1 -# define SSL_CTRL_SET_TMP_RSA 2 -# define SSL_CTRL_SET_TMP_DH 3 -# define SSL_CTRL_SET_TMP_ECDH 4 -# define SSL_CTRL_SET_TMP_RSA_CB 5 -# define SSL_CTRL_SET_TMP_DH_CB 6 -# define SSL_CTRL_SET_TMP_ECDH_CB 7 -# define SSL_CTRL_GET_SESSION_REUSED 8 -# define SSL_CTRL_GET_CLIENT_CERT_REQUEST 9 -# define SSL_CTRL_GET_NUM_RENEGOTIATIONS 10 -# define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS 11 -# define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS 12 -# define SSL_CTRL_GET_FLAGS 13 -# define SSL_CTRL_EXTRA_CHAIN_CERT 14 -# define SSL_CTRL_SET_MSG_CALLBACK 15 -# define SSL_CTRL_SET_MSG_CALLBACK_ARG 16 -/* only applies to datagram connections */ -# define SSL_CTRL_SET_MTU 17 -/* Stats */ -# define SSL_CTRL_SESS_NUMBER 20 -# define SSL_CTRL_SESS_CONNECT 21 -# define SSL_CTRL_SESS_CONNECT_GOOD 22 -# define SSL_CTRL_SESS_CONNECT_RENEGOTIATE 23 -# define SSL_CTRL_SESS_ACCEPT 24 -# define SSL_CTRL_SESS_ACCEPT_GOOD 25 -# define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE 26 -# define SSL_CTRL_SESS_HIT 27 -# define SSL_CTRL_SESS_CB_HIT 28 -# define SSL_CTRL_SESS_MISSES 29 -# define SSL_CTRL_SESS_TIMEOUTS 30 -# define SSL_CTRL_SESS_CACHE_FULL 31 -# define SSL_CTRL_OPTIONS 32 -# define SSL_CTRL_MODE 33 -# define SSL_CTRL_GET_READ_AHEAD 40 -# define SSL_CTRL_SET_READ_AHEAD 41 -# define SSL_CTRL_SET_SESS_CACHE_SIZE 42 -# define SSL_CTRL_GET_SESS_CACHE_SIZE 43 -# define SSL_CTRL_SET_SESS_CACHE_MODE 44 -# define SSL_CTRL_GET_SESS_CACHE_MODE 45 -# define SSL_CTRL_GET_MAX_CERT_LIST 50 -# define SSL_CTRL_SET_MAX_CERT_LIST 51 -# define SSL_CTRL_SET_MAX_SEND_FRAGMENT 52 -/* see tls1.h for macros based on these */ -# ifndef OPENSSL_NO_TLSEXT -# define SSL_CTRL_SET_TLSEXT_SERVERNAME_CB 53 -# define SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG 54 -# define SSL_CTRL_SET_TLSEXT_HOSTNAME 55 -# define SSL_CTRL_SET_TLSEXT_DEBUG_CB 56 -# define SSL_CTRL_SET_TLSEXT_DEBUG_ARG 57 -# define SSL_CTRL_GET_TLSEXT_TICKET_KEYS 58 -# define SSL_CTRL_SET_TLSEXT_TICKET_KEYS 59 -/*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT 60 */ -/*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB 61 */ -/*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG 62 */ -# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB 63 -# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG 64 -# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE 65 -# define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS 66 -# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS 67 -# define SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS 68 -# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS 69 -# define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP 70 -# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP 71 -# define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB 72 -# define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB 75 -# define SSL_CTRL_SET_SRP_VERIFY_PARAM_CB 76 -# define SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB 77 -# define SSL_CTRL_SET_SRP_ARG 78 -# define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME 79 -# define SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH 80 -# define SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD 81 -# ifndef OPENSSL_NO_HEARTBEATS -# define SSL_CTRL_TLS_EXT_SEND_HEARTBEAT 85 -# define SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING 86 -# define SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS 87 -# endif -# endif /* OPENSSL_NO_TLSEXT */ -# define DTLS_CTRL_GET_TIMEOUT 73 -# define DTLS_CTRL_HANDLE_TIMEOUT 74 -# define DTLS_CTRL_LISTEN 75 -# define SSL_CTRL_GET_RI_SUPPORT 76 -# define SSL_CTRL_CLEAR_OPTIONS 77 -# define SSL_CTRL_CLEAR_MODE 78 -# define SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB 79 -# define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82 -# define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83 -# define SSL_CTRL_CHAIN 88 -# define SSL_CTRL_CHAIN_CERT 89 -# define SSL_CTRL_GET_CURVES 90 -# define SSL_CTRL_SET_CURVES 91 -# define SSL_CTRL_SET_CURVES_LIST 92 -# define SSL_CTRL_GET_SHARED_CURVE 93 -# define SSL_CTRL_SET_ECDH_AUTO 94 -# define SSL_CTRL_SET_SIGALGS 97 -# define SSL_CTRL_SET_SIGALGS_LIST 98 -# define SSL_CTRL_CERT_FLAGS 99 -# define SSL_CTRL_CLEAR_CERT_FLAGS 100 -# define SSL_CTRL_SET_CLIENT_SIGALGS 101 -# define SSL_CTRL_SET_CLIENT_SIGALGS_LIST 102 -# define SSL_CTRL_GET_CLIENT_CERT_TYPES 103 -# define SSL_CTRL_SET_CLIENT_CERT_TYPES 104 -# define SSL_CTRL_BUILD_CERT_CHAIN 105 -# define SSL_CTRL_SET_VERIFY_CERT_STORE 106 -# define SSL_CTRL_SET_CHAIN_CERT_STORE 107 -# define SSL_CTRL_GET_PEER_SIGNATURE_NID 108 -# define SSL_CTRL_GET_SERVER_TMP_KEY 109 -# define SSL_CTRL_GET_RAW_CIPHERLIST 110 -# define SSL_CTRL_GET_EC_POINT_FORMATS 111 -# define SSL_CTRL_GET_CHAIN_CERTS 115 -# define SSL_CTRL_SELECT_CURRENT_CERT 116 -# define SSL_CTRL_SET_CURRENT_CERT 117 -# define SSL_CTRL_SET_DH_AUTO 118 -# define SSL_CTRL_CHECK_PROTO_VERSION 119 -# define DTLS_CTRL_SET_LINK_MTU 120 -# define DTLS_CTRL_GET_LINK_MIN_MTU 121 -# define SSL_CTRL_GET_EXTMS_SUPPORT 122 -# define SSL_CERT_SET_FIRST 1 -# define SSL_CERT_SET_NEXT 2 -# define SSL_CERT_SET_SERVER 3 -# define DTLSv1_get_timeout(ssl, arg) \ - SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg) -# define DTLSv1_handle_timeout(ssl) \ - SSL_ctrl(ssl,DTLS_CTRL_HANDLE_TIMEOUT,0, NULL) -# define DTLSv1_listen(ssl, peer) \ - SSL_ctrl(ssl,DTLS_CTRL_LISTEN,0, (void *)peer) -# define SSL_session_reused(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL) -# define SSL_num_renegotiations(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_GET_NUM_RENEGOTIATIONS,0,NULL) -# define SSL_clear_num_renegotiations(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS,0,NULL) -# define SSL_total_renegotiations(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_GET_TOTAL_RENEGOTIATIONS,0,NULL) -# define SSL_CTX_need_tmp_RSA(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_NEED_TMP_RSA,0,NULL) -# define SSL_CTX_set_tmp_rsa(ctx,rsa) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa) -# define SSL_CTX_set_tmp_dh(ctx,dh) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh) -# define SSL_CTX_set_tmp_ecdh(ctx,ecdh) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh) -# define SSL_CTX_set_dh_auto(ctx, onoff) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_DH_AUTO,onoff,NULL) -# define SSL_set_dh_auto(s, onoff) \ - SSL_ctrl(s,SSL_CTRL_SET_DH_AUTO,onoff,NULL) -# define SSL_need_tmp_RSA(ssl) \ - SSL_ctrl(ssl,SSL_CTRL_NEED_TMP_RSA,0,NULL) -# define SSL_set_tmp_rsa(ssl,rsa) \ - SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa) -# define SSL_set_tmp_dh(ssl,dh) \ - SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)dh) -# define SSL_set_tmp_ecdh(ssl,ecdh) \ - SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh) -# define SSL_CTX_add_extra_chain_cert(ctx,x509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509) -# define SSL_CTX_get_extra_chain_certs(ctx,px509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,0,px509) -# define SSL_CTX_get_extra_chain_certs_only(ctx,px509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,1,px509) -# define SSL_CTX_clear_extra_chain_certs(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS,0,NULL) -# define SSL_CTX_set0_chain(ctx,sk) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN,0,(char *)sk) -# define SSL_CTX_set1_chain(ctx,sk) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN,1,(char *)sk) -# define SSL_CTX_add0_chain_cert(ctx,x509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN_CERT,0,(char *)x509) -# define SSL_CTX_add1_chain_cert(ctx,x509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_CHAIN_CERT,1,(char *)x509) -# define SSL_CTX_get0_chain_certs(ctx,px509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERTS,0,px509) -# define SSL_CTX_clear_chain_certs(ctx) \ - SSL_CTX_set0_chain(ctx,NULL) -# define SSL_CTX_build_cert_chain(ctx, flags) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_BUILD_CERT_CHAIN, flags, NULL) -# define SSL_CTX_select_current_cert(ctx,x509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SELECT_CURRENT_CERT,0,(char *)x509) -# define SSL_CTX_set_current_cert(ctx, op) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CURRENT_CERT, op, NULL) -# define SSL_CTX_set0_verify_cert_store(ctx,st) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)st) -# define SSL_CTX_set1_verify_cert_store(ctx,st) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)st) -# define SSL_CTX_set0_chain_cert_store(ctx,st) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)st) -# define SSL_CTX_set1_chain_cert_store(ctx,st) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)st) -# define SSL_set0_chain(ctx,sk) \ - SSL_ctrl(ctx,SSL_CTRL_CHAIN,0,(char *)sk) -# define SSL_set1_chain(ctx,sk) \ - SSL_ctrl(ctx,SSL_CTRL_CHAIN,1,(char *)sk) -# define SSL_add0_chain_cert(ctx,x509) \ - SSL_ctrl(ctx,SSL_CTRL_CHAIN_CERT,0,(char *)x509) -# define SSL_add1_chain_cert(ctx,x509) \ - SSL_ctrl(ctx,SSL_CTRL_CHAIN_CERT,1,(char *)x509) -# define SSL_get0_chain_certs(ctx,px509) \ - SSL_ctrl(ctx,SSL_CTRL_GET_CHAIN_CERTS,0,px509) -# define SSL_clear_chain_certs(ctx) \ - SSL_set0_chain(ctx,NULL) -# define SSL_build_cert_chain(s, flags) \ - SSL_ctrl(s,SSL_CTRL_BUILD_CERT_CHAIN, flags, NULL) -# define SSL_select_current_cert(ctx,x509) \ - SSL_ctrl(ctx,SSL_CTRL_SELECT_CURRENT_CERT,0,(char *)x509) -# define SSL_set_current_cert(ctx,op) \ - SSL_ctrl(ctx,SSL_CTRL_SET_CURRENT_CERT, op, NULL) -# define SSL_set0_verify_cert_store(s,st) \ - SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,0,(char *)st) -# define SSL_set1_verify_cert_store(s,st) \ - SSL_ctrl(s,SSL_CTRL_SET_VERIFY_CERT_STORE,1,(char *)st) -# define SSL_set0_chain_cert_store(s,st) \ - SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,0,(char *)st) -# define SSL_set1_chain_cert_store(s,st) \ - SSL_ctrl(s,SSL_CTRL_SET_CHAIN_CERT_STORE,1,(char *)st) -# define SSL_get1_curves(ctx, s) \ - SSL_ctrl(ctx,SSL_CTRL_GET_CURVES,0,(char *)s) -# define SSL_CTX_set1_curves(ctx, clist, clistlen) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CURVES,clistlen,(char *)clist) -# define SSL_CTX_set1_curves_list(ctx, s) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CURVES_LIST,0,(char *)s) -# define SSL_set1_curves(ctx, clist, clistlen) \ - SSL_ctrl(ctx,SSL_CTRL_SET_CURVES,clistlen,(char *)clist) -# define SSL_set1_curves_list(ctx, s) \ - SSL_ctrl(ctx,SSL_CTRL_SET_CURVES_LIST,0,(char *)s) -# define SSL_get_shared_curve(s, n) \ - SSL_ctrl(s,SSL_CTRL_GET_SHARED_CURVE,n,NULL) -# define SSL_CTX_set_ecdh_auto(ctx, onoff) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_ECDH_AUTO,onoff,NULL) -# define SSL_set_ecdh_auto(s, onoff) \ - SSL_ctrl(s,SSL_CTRL_SET_ECDH_AUTO,onoff,NULL) -# define SSL_CTX_set1_sigalgs(ctx, slist, slistlen) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS,slistlen,(int *)slist) -# define SSL_CTX_set1_sigalgs_list(ctx, s) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)s) -# define SSL_set1_sigalgs(ctx, slist, slistlen) \ - SSL_ctrl(ctx,SSL_CTRL_SET_SIGALGS,clistlen,(int *)slist) -# define SSL_set1_sigalgs_list(ctx, s) \ - SSL_ctrl(ctx,SSL_CTRL_SET_SIGALGS_LIST,0,(char *)s) -# define SSL_CTX_set1_client_sigalgs(ctx, slist, slistlen) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS,slistlen,(int *)slist) -# define SSL_CTX_set1_client_sigalgs_list(ctx, s) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)s) -# define SSL_set1_client_sigalgs(ctx, slist, slistlen) \ - SSL_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS,clistlen,(int *)slist) -# define SSL_set1_client_sigalgs_list(ctx, s) \ - SSL_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)s) -# define SSL_get0_certificate_types(s, clist) \ - SSL_ctrl(s, SSL_CTRL_GET_CLIENT_CERT_TYPES, 0, (char *)clist) -# define SSL_CTX_set1_client_certificate_types(ctx, clist, clistlen) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)clist) -# define SSL_set1_client_certificate_types(s, clist, clistlen) \ - SSL_ctrl(s,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)clist) -# define SSL_get_peer_signature_nid(s, pn) \ - SSL_ctrl(s,SSL_CTRL_GET_PEER_SIGNATURE_NID,0,pn) -# define SSL_get_server_tmp_key(s, pk) \ - SSL_ctrl(s,SSL_CTRL_GET_SERVER_TMP_KEY,0,pk) -# define SSL_get0_raw_cipherlist(s, plst) \ - SSL_ctrl(s,SSL_CTRL_GET_RAW_CIPHERLIST,0,plst) -# define SSL_get0_ec_point_formats(s, plst) \ - SSL_ctrl(s,SSL_CTRL_GET_EC_POINT_FORMATS,0,plst) - -__owur BIO_METHOD *BIO_f_ssl(void); -__owur BIO *BIO_new_ssl(SSL_CTX *ctx, int client); -__owur BIO *BIO_new_ssl_connect(SSL_CTX *ctx); -__owur BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx); -__owur int BIO_ssl_copy_session_id(BIO *to, BIO *from); -void BIO_ssl_shutdown(BIO *ssl_bio); - -__owur int SSL_CTX_set_cipher_list(SSL_CTX *, const char *str); -__owur SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth); -void SSL_CTX_free(SSL_CTX *); -__owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); -__owur long SSL_CTX_get_timeout(const SSL_CTX *ctx); -__owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *); -void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *); -__owur int SSL_want(const SSL *s); -__owur int SSL_clear(SSL *s); - -void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm); - -__owur const SSL_CIPHER *SSL_get_current_cipher(const SSL *s); -__owur int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits); -__owur char *SSL_CIPHER_get_version(const SSL_CIPHER *c); -__owur const char *SSL_CIPHER_get_name(const SSL_CIPHER *c); -__owur unsigned long SSL_CIPHER_get_id(const SSL_CIPHER *c); - -__owur int SSL_get_fd(const SSL *s); -__owur int SSL_get_rfd(const SSL *s); -__owur int SSL_get_wfd(const SSL *s); -__owur const char *SSL_get_cipher_list(const SSL *s, int n); -__owur char *SSL_get_shared_ciphers(const SSL *s, char *buf, int len); -__owur int SSL_get_read_ahead(const SSL *s); -__owur int SSL_pending(const SSL *s); -# ifndef OPENSSL_NO_SOCK -__owur int SSL_set_fd(SSL *s, int fd); -__owur int SSL_set_rfd(SSL *s, int fd); -__owur int SSL_set_wfd(SSL *s, int fd); -# endif -void SSL_set_rbio(SSL *s, BIO *rbio); -void SSL_set_wbio(SSL *s, BIO *wbio); -void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio); -__owur BIO *SSL_get_rbio(const SSL *s); -__owur BIO *SSL_get_wbio(const SSL *s); -__owur int SSL_set_cipher_list(SSL *s, const char *str); -void SSL_set_read_ahead(SSL *s, int yes); -__owur int SSL_get_verify_mode(const SSL *s); -__owur int SSL_get_verify_depth(const SSL *s); -__owur int (*SSL_get_verify_callback(const SSL *s)) (int, X509_STORE_CTX *); -void SSL_set_verify(SSL *s, int mode, - int (*callback) (int ok, X509_STORE_CTX *ctx)); -void SSL_set_verify_depth(SSL *s, int depth); -void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg); -# ifndef OPENSSL_NO_RSA -__owur int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa); -# endif -__owur int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, long len); -__owur int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey); -__owur int SSL_use_PrivateKey_ASN1(int pk, SSL *ssl, const unsigned char *d, - long len); -__owur int SSL_use_certificate(SSL *ssl, X509 *x); -__owur int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len); - -# ifndef OPENSSL_NO_TLSEXT -/* Set serverinfo data for the current active cert. */ -__owur int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, - size_t serverinfo_length); -# ifndef OPENSSL_NO_STDIO -__owur int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file); -# endif /* NO_STDIO */ - -# endif - -# ifndef OPENSSL_NO_STDIO -__owur int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type); -__owur int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type); -__owur int SSL_use_certificate_file(SSL *ssl, const char *file, int type); -__owur int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type); -__owur int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type); -__owur int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type); -/* PEM type */ -__owur int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); -__owur STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file); -__owur int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, - const char *file); -# ifndef OPENSSL_SYS_VMS -int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, - const char *dir); -# endif - -# endif - -void SSL_load_error_strings(void); -__owur const char *SSL_state_string(const SSL *s); -__owur const char *SSL_rstate_string(const SSL *s); -__owur const char *SSL_state_string_long(const SSL *s); -__owur const char *SSL_rstate_string_long(const SSL *s); -__owur long SSL_SESSION_get_time(const SSL_SESSION *s); -__owur long SSL_SESSION_set_time(SSL_SESSION *s, long t); -__owur long SSL_SESSION_get_timeout(const SSL_SESSION *s); -__owur long SSL_SESSION_set_timeout(SSL_SESSION *s, long t); -__owur int SSL_SESSION_has_ticket(const SSL_SESSION *s); -__owur unsigned long SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s); -void SSL_SESSION_get0_ticket(const SSL_SESSION *s, unsigned char **tick, - size_t *len); -__owur int SSL_copy_session_id(SSL *to, const SSL *from); -__owur X509 *SSL_SESSION_get0_peer(SSL_SESSION *s); -__owur int SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx, - unsigned int sid_ctx_len); - -__owur SSL_SESSION *SSL_SESSION_new(void); -const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, - unsigned int *len); -__owur unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s); -# ifndef OPENSSL_NO_STDIO -int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *ses); -# endif -int SSL_SESSION_print(BIO *fp, const SSL_SESSION *ses); -int SSL_SESSION_print_keylog(BIO *bp, const SSL_SESSION *x); -void SSL_SESSION_free(SSL_SESSION *ses); -__owur int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp); -__owur int SSL_set_session(SSL *to, SSL_SESSION *session); -__owur int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c); -int SSL_CTX_remove_session(SSL_CTX *, SSL_SESSION *c); -__owur int SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB); -__owur int SSL_set_generate_session_id(SSL *, GEN_SESSION_CB); -__owur int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, - unsigned int id_len); -SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, - long length); - -# ifdef HEADER_X509_H -__owur X509 *SSL_get_peer_certificate(const SSL *s); -# endif - -__owur STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s); - -__owur int SSL_CTX_get_verify_mode(const SSL_CTX *ctx); -__owur int SSL_CTX_get_verify_depth(const SSL_CTX *ctx); -__owur int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx)) (int, - X509_STORE_CTX *); -void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, - int (*callback) (int, X509_STORE_CTX *)); -void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth); -void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, - int (*cb) (X509_STORE_CTX *, void *), - void *arg); -void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg), - void *arg); -# ifndef OPENSSL_NO_RSA -__owur int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa); -# endif -__owur int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, - long len); -__owur int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey); -__owur int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, - const unsigned char *d, long len); -__owur int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); -__owur int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, - const unsigned char *d); - -void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb); -void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u); - -__owur int SSL_CTX_check_private_key(const SSL_CTX *ctx); -__owur int SSL_check_private_key(const SSL *ctx); - -__owur int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx, - unsigned int sid_ctx_len); - -SSL *SSL_new(SSL_CTX *ctx); -__owur int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx, - unsigned int sid_ctx_len); - -__owur int SSL_CTX_set_purpose(SSL_CTX *s, int purpose); -__owur int SSL_set_purpose(SSL *s, int purpose); -__owur int SSL_CTX_set_trust(SSL_CTX *s, int trust); -__owur int SSL_set_trust(SSL *s, int trust); - -__owur int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm); -__owur int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm); - -__owur X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx); -__owur X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl); - -# ifndef OPENSSL_NO_SRP -int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name); -int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password); -int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength); -int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx, - char *(*cb) (SSL *, void *)); -int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx, - int (*cb) (SSL *, void *)); -int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx, - int (*cb) (SSL *, int *, void *)); -int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg); - -int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g, - BIGNUM *sa, BIGNUM *v, char *info); -int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass, - const char *grp); - -__owur BIGNUM *SSL_get_srp_g(SSL *s); -__owur BIGNUM *SSL_get_srp_N(SSL *s); - -__owur char *SSL_get_srp_username(SSL *s); -__owur char *SSL_get_srp_userinfo(SSL *s); -# endif - -void SSL_certs_clear(SSL *s); -void SSL_free(SSL *ssl); -__owur int SSL_accept(SSL *ssl); -__owur int SSL_connect(SSL *ssl); -__owur int SSL_read(SSL *ssl, void *buf, int num); -__owur int SSL_peek(SSL *ssl, void *buf, int num); -__owur int SSL_write(SSL *ssl, const void *buf, int num); -long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg); -long SSL_callback_ctrl(SSL *, int, void (*)(void)); -long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg); -long SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)(void)); - -__owur int SSL_get_error(const SSL *s, int ret_code); -__owur const char *SSL_get_version(const SSL *s); - -/* This sets the 'default' SSL version that SSL_new() will create */ -__owur int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); - -# ifndef OPENSSL_NO_SSL3_METHOD -__owur const SSL_METHOD *SSLv3_method(void); /* SSLv3 */ -__owur const SSL_METHOD *SSLv3_server_method(void); /* SSLv3 */ -__owur const SSL_METHOD *SSLv3_client_method(void); /* SSLv3 */ -# endif - -__owur const SSL_METHOD *SSLv23_method(void); /* Negotiate highest available SSL/TLS - * version */ -__owur const SSL_METHOD *SSLv23_server_method(void); /* Negotiate highest available - * SSL/TLS version */ -__owur const SSL_METHOD *SSLv23_client_method(void); /* Negotiate highest available - * SSL/TLS version */ - -__owur const SSL_METHOD *TLSv1_method(void); /* TLSv1.0 */ -__owur const SSL_METHOD *TLSv1_server_method(void); /* TLSv1.0 */ -__owur const SSL_METHOD *TLSv1_client_method(void); /* TLSv1.0 */ - -__owur const SSL_METHOD *TLSv1_1_method(void); /* TLSv1.1 */ -__owur const SSL_METHOD *TLSv1_1_server_method(void); /* TLSv1.1 */ -__owur const SSL_METHOD *TLSv1_1_client_method(void); /* TLSv1.1 */ - -__owur const SSL_METHOD *TLSv1_2_method(void); /* TLSv1.2 */ -__owur const SSL_METHOD *TLSv1_2_server_method(void); /* TLSv1.2 */ -__owur const SSL_METHOD *TLSv1_2_client_method(void); /* TLSv1.2 */ - -__owur const SSL_METHOD *DTLSv1_method(void); /* DTLSv1.0 */ -__owur const SSL_METHOD *DTLSv1_server_method(void); /* DTLSv1.0 */ -__owur const SSL_METHOD *DTLSv1_client_method(void); /* DTLSv1.0 */ - -__owur const SSL_METHOD *DTLSv1_2_method(void); /* DTLSv1.2 */ -__owur const SSL_METHOD *DTLSv1_2_server_method(void); /* DTLSv1.2 */ -__owur const SSL_METHOD *DTLSv1_2_client_method(void); /* DTLSv1.2 */ - -__owur const SSL_METHOD *DTLS_method(void); /* DTLS 1.0 and 1.2 */ -__owur const SSL_METHOD *DTLS_server_method(void); /* DTLS 1.0 and 1.2 */ -__owur const SSL_METHOD *DTLS_client_method(void); /* DTLS 1.0 and 1.2 */ - -__owur STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s); -__owur STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s); - -__owur int SSL_do_handshake(SSL *s); -int SSL_renegotiate(SSL *s); -__owur int SSL_renegotiate_abbreviated(SSL *s); -__owur int SSL_renegotiate_pending(SSL *s); -int SSL_shutdown(SSL *s); - -__owur const SSL_METHOD *SSL_CTX_get_ssl_method(SSL_CTX *ctx); -__owur const SSL_METHOD *SSL_get_ssl_method(SSL *s); -__owur int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method); -__owur const char *SSL_alert_type_string_long(int value); -__owur const char *SSL_alert_type_string(int value); -__owur const char *SSL_alert_desc_string_long(int value); -__owur const char *SSL_alert_desc_string(int value); - -void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list); -void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list); -__owur STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s); -__owur STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *s); -__owur int SSL_add_client_CA(SSL *ssl, X509 *x); -__owur int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); - -void SSL_set_connect_state(SSL *s); -void SSL_set_accept_state(SSL *s); - -__owur long SSL_get_default_timeout(const SSL *s); - -int SSL_library_init(void); - -__owur char *SSL_CIPHER_description(const SSL_CIPHER *, char *buf, int size); -__owur STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk); - -__owur SSL *SSL_dup(SSL *ssl); - -__owur X509 *SSL_get_certificate(const SSL *ssl); -/* - * EVP_PKEY - */ struct evp_pkey_st *SSL_get_privatekey(const SSL *ssl); - -__owur X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx); -__owur EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx); - -void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode); -__owur int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx); -void SSL_set_quiet_shutdown(SSL *ssl, int mode); -__owur int SSL_get_quiet_shutdown(const SSL *ssl); -void SSL_set_shutdown(SSL *ssl, int mode); -__owur int SSL_get_shutdown(const SSL *ssl); -__owur int SSL_version(const SSL *ssl); -__owur int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx); -__owur int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, - const char *CApath); -# define SSL_get0_session SSL_get_session/* just peek at pointer */ -__owur SSL_SESSION *SSL_get_session(const SSL *ssl); -__owur SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */ -__owur SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl); -SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx); -void SSL_set_info_callback(SSL *ssl, - void (*cb) (const SSL *ssl, int type, int val)); -void (*SSL_get_info_callback(const SSL *ssl)) (const SSL *ssl, int type, - int val); -__owur int SSL_state(const SSL *ssl); -void SSL_set_state(SSL *ssl, int state); - -void SSL_set_verify_result(SSL *ssl, long v); -__owur long SSL_get_verify_result(const SSL *ssl); - -__owur int SSL_set_ex_data(SSL *ssl, int idx, void *data); -void *SSL_get_ex_data(const SSL *ssl, int idx); -__owur int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, - CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); - -__owur int SSL_SESSION_set_ex_data(SSL_SESSION *ss, int idx, void *data); -void *SSL_SESSION_get_ex_data(const SSL_SESSION *ss, int idx); -__owur int SSL_SESSION_get_ex_new_index(long argl, void *argp, - CRYPTO_EX_new *new_func, - CRYPTO_EX_dup *dup_func, - CRYPTO_EX_free *free_func); - -__owur int SSL_CTX_set_ex_data(SSL_CTX *ssl, int idx, void *data); -void *SSL_CTX_get_ex_data(const SSL_CTX *ssl, int idx); -__owur int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, - CRYPTO_EX_dup *dup_func, - CRYPTO_EX_free *free_func); - -__owur int SSL_get_ex_data_X509_STORE_CTX_idx(void); - -# define SSL_CTX_sess_set_cache_size(ctx,t) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_SIZE,t,NULL) -# define SSL_CTX_sess_get_cache_size(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_SIZE,0,NULL) -# define SSL_CTX_set_session_cache_mode(ctx,m) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL) -# define SSL_CTX_get_session_cache_mode(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL) - -# define SSL_CTX_get_default_read_ahead(ctx) SSL_CTX_get_read_ahead(ctx) -# define SSL_CTX_set_default_read_ahead(ctx,m) SSL_CTX_set_read_ahead(ctx,m) -# define SSL_CTX_get_read_ahead(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_READ_AHEAD,0,NULL) -# define SSL_CTX_set_read_ahead(ctx,m) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_READ_AHEAD,m,NULL) -# define SSL_CTX_get_max_cert_list(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL) -# define SSL_CTX_set_max_cert_list(ctx,m) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL) -# define SSL_get_max_cert_list(ssl) \ - SSL_ctrl(ssl,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL) -# define SSL_set_max_cert_list(ssl,m) \ - SSL_ctrl(ssl,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL) - -# define SSL_CTX_set_max_send_fragment(ctx,m) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL) -# define SSL_set_max_send_fragment(ssl,m) \ - SSL_ctrl(ssl,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL) - - /* NB: the keylength is only applicable when is_export is true */ -# ifndef OPENSSL_NO_RSA -void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx, - RSA *(*cb) (SSL *ssl, int is_export, - int keylength)); - -void SSL_set_tmp_rsa_callback(SSL *ssl, - RSA *(*cb) (SSL *ssl, int is_export, - int keylength)); -# endif -# ifndef OPENSSL_NO_DH -void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, - DH *(*dh) (SSL *ssl, int is_export, - int keylength)); -void SSL_set_tmp_dh_callback(SSL *ssl, - DH *(*dh) (SSL *ssl, int is_export, - int keylength)); -# endif -# ifndef OPENSSL_NO_EC -void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx, - EC_KEY *(*ecdh) (SSL *ssl, int is_export, - int keylength)); -void SSL_set_tmp_ecdh_callback(SSL *ssl, - EC_KEY *(*ecdh) (SSL *ssl, int is_export, - int keylength)); -# endif - -# ifndef OPENSSL_NO_COMP -__owur const COMP_METHOD *SSL_get_current_compression(SSL *s); -__owur const COMP_METHOD *SSL_get_current_expansion(SSL *s); -__owur const char *SSL_COMP_get_name(const COMP_METHOD *comp); -STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void); -__owur STACK_OF(SSL_COMP) *SSL_COMP_set0_compression_methods(STACK_OF(SSL_COMP) - *meths); -void SSL_COMP_free_compression_methods(void); -__owur int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm); -# else -__owur const void *SSL_get_current_compression(SSL *s); -__owur const void *SSL_get_current_expansion(SSL *s); -__owur const char *SSL_COMP_get_name(const void *comp); -void *SSL_COMP_get_compression_methods(void); -__owur int SSL_COMP_add_compression_method(int id, void *cm); -# endif - -const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr); - -/* TLS extensions functions */ -__owur int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len); - -__owur int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb, - void *arg); - -/* Pre-shared secret session resumption functions */ -__owur int SSL_set_session_secret_cb(SSL *s, - tls_session_secret_cb_fn tls_session_secret_cb, - void *arg); - -void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, - int (*cb) (SSL *ssl, - int - is_forward_secure)); - -void SSL_set_not_resumable_session_callback(SSL *ssl, - int (*cb) (SSL *ssl, - int - is_forward_secure)); - -void SSL_set_debug(SSL *s, int debug); -__owur int SSL_cache_hit(SSL *s); -__owur int SSL_is_server(SSL *s); - -__owur __owur SSL_CONF_CTX *SSL_CONF_CTX_new(void); -int SSL_CONF_CTX_finish(SSL_CONF_CTX *cctx); -void SSL_CONF_CTX_free(SSL_CONF_CTX *cctx); -unsigned int SSL_CONF_CTX_set_flags(SSL_CONF_CTX *cctx, unsigned int flags); -__owur unsigned int SSL_CONF_CTX_clear_flags(SSL_CONF_CTX *cctx, unsigned int flags); -__owur int SSL_CONF_CTX_set1_prefix(SSL_CONF_CTX *cctx, const char *pre); - -void SSL_CONF_CTX_set_ssl(SSL_CONF_CTX *cctx, SSL *ssl); -void SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *cctx, SSL_CTX *ctx); - -__owur int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value); -__owur int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv); -__owur int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd); - -# ifndef OPENSSL_NO_SSL_TRACE -void SSL_trace(int write_p, int version, int content_type, - const void *buf, size_t len, SSL *ssl, void *arg); -__owur const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c); -# endif - -/* What the "other" parameter contains in security callback */ -/* Mask for type */ -# define SSL_SECOP_OTHER_TYPE 0xffff0000 -# define SSL_SECOP_OTHER_NONE 0 -# define SSL_SECOP_OTHER_CIPHER (1 << 16) -# define SSL_SECOP_OTHER_CURVE (2 << 16) -# define SSL_SECOP_OTHER_DH (3 << 16) -# define SSL_SECOP_OTHER_PKEY (4 << 16) -# define SSL_SECOP_OTHER_SIGALG (5 << 16) -# define SSL_SECOP_OTHER_CERT (6 << 16) - -/* Indicated operation refers to peer key or certificate */ -# define SSL_SECOP_PEER 0x1000 - -/* Values for "op" parameter in security callback */ - -/* Called to filter ciphers */ -/* Ciphers client supports */ -# define SSL_SECOP_CIPHER_SUPPORTED (1 | SSL_SECOP_OTHER_CIPHER) -/* Cipher shared by client/server */ -# define SSL_SECOP_CIPHER_SHARED (2 | SSL_SECOP_OTHER_CIPHER) -/* Sanity check of cipher server selects */ -# define SSL_SECOP_CIPHER_CHECK (3 | SSL_SECOP_OTHER_CIPHER) -/* Curves supported by client */ -# define SSL_SECOP_CURVE_SUPPORTED (4 | SSL_SECOP_OTHER_CURVE) -/* Curves shared by client/server */ -# define SSL_SECOP_CURVE_SHARED (5 | SSL_SECOP_OTHER_CURVE) -/* Sanity check of curve server selects */ -# define SSL_SECOP_CURVE_CHECK (6 | SSL_SECOP_OTHER_CURVE) -/* Temporary DH key */ -# define SSL_SECOP_TMP_DH (7 | SSL_SECOP_OTHER_DH) -/* SSL/TLS version */ -# define SSL_SECOP_VERSION (9 | SSL_SECOP_OTHER_NONE) -/* Session tickets */ -# define SSL_SECOP_TICKET (10 | SSL_SECOP_OTHER_NONE) -/* Supported signature algorithms sent to peer */ -# define SSL_SECOP_SIGALG_SUPPORTED (11 | SSL_SECOP_OTHER_SIGALG) -/* Shared signature algorithm */ -# define SSL_SECOP_SIGALG_SHARED (12 | SSL_SECOP_OTHER_SIGALG) -/* Sanity check signature algorithm allowed */ -# define SSL_SECOP_SIGALG_CHECK (13 | SSL_SECOP_OTHER_SIGALG) -/* Used to get mask of supported public key signature algorithms */ -# define SSL_SECOP_SIGALG_MASK (14 | SSL_SECOP_OTHER_SIGALG) -/* Use to see if compression is allowed */ -# define SSL_SECOP_COMPRESSION (15 | SSL_SECOP_OTHER_NONE) -/* EE key in certificate */ -# define SSL_SECOP_EE_KEY (16 | SSL_SECOP_OTHER_CERT) -/* CA key in certificate */ -# define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) -/* CA digest algorithm in certificate */ -# define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) -/* Peer EE key in certificate */ -# define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) -/* Peer CA key in certificate */ -# define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) -/* Peer CA digest algorithm in certificate */ -# define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) - -void SSL_set_security_level(SSL *s, int level); -__owur int SSL_get_security_level(const SSL *s); -void SSL_set_security_callback(SSL *s, - int (*cb) (SSL *s, SSL_CTX *ctx, int op, - int bits, int nid, void *other, - void *ex)); -int (*SSL_get_security_callback(const SSL *s)) (SSL *s, SSL_CTX *ctx, int op, - int bits, int nid, - void *other, void *ex); -void SSL_set0_security_ex_data(SSL *s, void *ex); -__owur void *SSL_get0_security_ex_data(const SSL *s); - -void SSL_CTX_set_security_level(SSL_CTX *ctx, int level); -__owur int SSL_CTX_get_security_level(const SSL_CTX *ctx); -void SSL_CTX_set_security_callback(SSL_CTX *ctx, - int (*cb) (SSL *s, SSL_CTX *ctx, int op, - int bits, int nid, void *other, - void *ex)); -int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (SSL *s, - SSL_CTX *ctx, - int op, int bits, - int nid, - void *other, - void *ex); -void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex); -__owur void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx); - -# ifndef OPENSSL_NO_UNIT_TEST -__owur const struct openssl_ssl_test_functions *SSL_test_functions(void); -# endif - -/* BEGIN ERROR CODES */ -/* - * The following lines are auto generated by the script mkerr.pl. Any changes - * made after this point may be overwritten when the script is next run. - */ -void ERR_load_SSL_strings(void); - -/* Error codes for the SSL functions. */ - -/* Function codes. */ -# define SSL_F_CHECK_SUITEB_CIPHER_LIST 331 -# define SSL_F_D2I_SSL_SESSION 103 -# define SSL_F_DO_DTLS1_WRITE 245 -# define SSL_F_DO_SSL3_WRITE 104 -# define SSL_F_DTLS1_ACCEPT 246 -# define SSL_F_DTLS1_ADD_CERT_TO_BUF 295 -# define SSL_F_DTLS1_BUFFER_RECORD 247 -# define SSL_F_DTLS1_CHECK_TIMEOUT_NUM 318 -# define SSL_F_DTLS1_CLIENT_HELLO 248 -# define SSL_F_DTLS1_CONNECT 249 -# define SSL_F_DTLS1_ENC 250 -# define SSL_F_DTLS1_GET_HELLO_VERIFY 251 -# define SSL_F_DTLS1_GET_MESSAGE 252 -# define SSL_F_DTLS1_GET_MESSAGE_FRAGMENT 253 -# define SSL_F_DTLS1_GET_RECORD 254 -# define SSL_F_DTLS1_HANDLE_TIMEOUT 297 -# define SSL_F_DTLS1_HEARTBEAT 305 -# define SSL_F_DTLS1_OUTPUT_CERT_CHAIN 255 -# define SSL_F_DTLS1_PREPROCESS_FRAGMENT 288 -# define SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE 256 -# define SSL_F_DTLS1_PROCESS_RECORD 257 -# define SSL_F_DTLS1_READ_BYTES 258 -# define SSL_F_DTLS1_READ_FAILED 259 -# define SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST 260 -# define SSL_F_DTLS1_SEND_CHANGE_CIPHER_SPEC 342 -# define SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE 261 -# define SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE 262 -# define SSL_F_DTLS1_SEND_CLIENT_VERIFY 263 -# define SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST 264 -# define SSL_F_DTLS1_SEND_SERVER_CERTIFICATE 265 -# define SSL_F_DTLS1_SEND_SERVER_HELLO 266 -# define SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE 267 -# define SSL_F_DTLS1_WRITE_APP_DATA_BYTES 268 -# define SSL_F_SSL23_ACCEPT 115 -# define SSL_F_SSL23_CLIENT_HELLO 116 -# define SSL_F_SSL23_CONNECT 117 -# define SSL_F_SSL23_GET_CLIENT_HELLO 118 -# define SSL_F_SSL23_GET_SERVER_HELLO 119 -# define SSL_F_SSL23_PEEK 237 -# define SSL_F_SSL23_READ 120 -# define SSL_F_SSL23_WRITE 121 -# define SSL_F_SSL3_ACCEPT 128 -# define SSL_F_SSL3_ADD_CERT_TO_BUF 296 -# define SSL_F_SSL3_CALLBACK_CTRL 233 -# define SSL_F_SSL3_CHANGE_CIPHER_STATE 129 -# define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130 -# define SSL_F_SSL3_CHECK_CLIENT_HELLO 304 -# define SSL_F_SSL3_CLIENT_HELLO 131 -# define SSL_F_SSL3_CONNECT 132 -# define SSL_F_SSL3_CTRL 213 -# define SSL_F_SSL3_CTX_CTRL 133 -# define SSL_F_SSL3_DIGEST_CACHED_RECORDS 293 -# define SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC 292 -# define SSL_F_SSL3_ENC 134 -# define SSL_F_SSL3_GENERATE_KEY_BLOCK 238 -# define SSL_F_SSL3_GET_CERTIFICATE_REQUEST 135 -# define SSL_F_SSL3_GET_CERT_STATUS 289 -# define SSL_F_SSL3_GET_CERT_VERIFY 136 -# define SSL_F_SSL3_GET_CLIENT_CERTIFICATE 137 -# define SSL_F_SSL3_GET_CLIENT_HELLO 138 -# define SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE 139 -# define SSL_F_SSL3_GET_FINISHED 140 -# define SSL_F_SSL3_GET_KEY_EXCHANGE 141 -# define SSL_F_SSL3_GET_MESSAGE 142 -# define SSL_F_SSL3_GET_NEW_SESSION_TICKET 283 -# define SSL_F_SSL3_GET_NEXT_PROTO 306 -# define SSL_F_SSL3_GET_RECORD 143 -# define SSL_F_SSL3_GET_SERVER_CERTIFICATE 144 -# define SSL_F_SSL3_GET_SERVER_DONE 145 -# define SSL_F_SSL3_GET_SERVER_HELLO 146 -# define SSL_F_SSL3_HANDSHAKE_MAC 285 -# define SSL_F_SSL3_NEW_SESSION_TICKET 287 -# define SSL_F_SSL3_OUTPUT_CERT_CHAIN 147 -# define SSL_F_SSL3_PEEK 235 -# define SSL_F_SSL3_READ_BYTES 148 -# define SSL_F_SSL3_READ_N 149 -# define SSL_F_SSL3_SEND_CERTIFICATE_REQUEST 150 -# define SSL_F_SSL3_SEND_CLIENT_CERTIFICATE 151 -# define SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE 152 -# define SSL_F_SSL3_SEND_CLIENT_VERIFY 153 -# define SSL_F_SSL3_SEND_FINISHED 343 -# define SSL_F_SSL3_SEND_HELLO_REQUEST 344 -# define SSL_F_SSL3_SEND_SERVER_CERTIFICATE 154 -# define SSL_F_SSL3_SEND_SERVER_DONE 345 -# define SSL_F_SSL3_SEND_SERVER_HELLO 242 -# define SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE 155 -# define SSL_F_SSL3_SETUP_KEY_BLOCK 157 -# define SSL_F_SSL3_SETUP_READ_BUFFER 156 -# define SSL_F_SSL3_SETUP_WRITE_BUFFER 291 -# define SSL_F_SSL3_WRITE_BYTES 158 -# define SSL_F_SSL3_WRITE_PENDING 159 -# define SSL_F_SSL_ADD_CERT_CHAIN 316 -# define SSL_F_SSL_ADD_CERT_TO_BUF 319 -# define SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT 298 -# define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT 277 -# define SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT 307 -# define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK 215 -# define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK 216 -# define SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT 299 -# define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT 278 -# define SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT 308 -# define SSL_F_SSL_BAD_METHOD 160 -# define SSL_F_SSL_BUILD_CERT_CHAIN 332 -# define SSL_F_SSL_BYTES_TO_CIPHER_LIST 161 -# define SSL_F_SSL_CERT_ADD0_CHAIN_CERT 339 -# define SSL_F_SSL_CERT_DUP 221 -# define SSL_F_SSL_CERT_INST 222 -# define SSL_F_SSL_CERT_INSTANTIATE 214 -# define SSL_F_SSL_CERT_NEW 162 -# define SSL_F_SSL_CERT_SET0_CHAIN 340 -# define SSL_F_SSL_CHECK_PRIVATE_KEY 163 -# define SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT 280 -# define SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG 279 -# define SSL_F_SSL_CIPHER_PROCESS_RULESTR 230 -# define SSL_F_SSL_CIPHER_STRENGTH_SORT 231 -# define SSL_F_SSL_CLEAR 164 -# define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD 165 -# define SSL_F_SSL_CONF_CMD 334 -# define SSL_F_SSL_CREATE_CIPHER_LIST 166 -# define SSL_F_SSL_CTRL 232 -# define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY 168 -# define SSL_F_SSL_CTX_MAKE_PROFILES 309 -# define SSL_F_SSL_CTX_NEW 169 -# define SSL_F_SSL_CTX_SET_CIPHER_LIST 269 -# define SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE 290 -# define SSL_F_SSL_CTX_SET_PURPOSE 226 -# define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT 219 -# define SSL_F_SSL_CTX_SET_SSL_VERSION 170 -# define SSL_F_SSL_CTX_SET_TRUST 229 -# define SSL_F_SSL_CTX_USE_CERTIFICATE 171 -# define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1 172 -# define SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE 220 -# define SSL_F_SSL_CTX_USE_CERTIFICATE_FILE 173 -# define SSL_F_SSL_CTX_USE_PRIVATEKEY 174 -# define SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1 175 -# define SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE 176 -# define SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT 272 -# define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY 177 -# define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1 178 -# define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE 179 -# define SSL_F_SSL_CTX_USE_SERVERINFO 336 -# define SSL_F_SSL_CTX_USE_SERVERINFO_FILE 337 -# define SSL_F_SSL_DO_HANDSHAKE 180 -# define SSL_F_SSL_GET_NEW_SESSION 181 -# define SSL_F_SSL_GET_PREV_SESSION 217 -# define SSL_F_SSL_GET_SERVER_CERT_INDEX 322 -# define SSL_F_SSL_GET_SERVER_SEND_CERT 182 -# define SSL_F_SSL_GET_SERVER_SEND_PKEY 317 -# define SSL_F_SSL_GET_SIGN_PKEY 183 -# define SSL_F_SSL_INIT_WBIO_BUFFER 184 -# define SSL_F_SSL_LOAD_CLIENT_CA_FILE 185 -# define SSL_F_SSL_NEW 186 -# define SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT 300 -# define SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT 302 -# define SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT 310 -# define SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT 301 -# define SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT 303 -# define SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT 311 -# define SSL_F_SSL_PEEK 270 -# define SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT 281 -# define SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT 282 -# define SSL_F_SSL_READ 223 -# define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT 320 -# define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT 321 -# define SSL_F_SSL_SESSION_NEW 189 -# define SSL_F_SSL_SESSION_PRINT_FP 190 -# define SSL_F_SSL_SESSION_SET1_ID_CONTEXT 312 -# define SSL_F_SSL_SESS_CERT_NEW 225 -# define SSL_F_SSL_SET_CERT 191 -# define SSL_F_SSL_SET_CIPHER_LIST 271 -# define SSL_F_SSL_SET_FD 192 -# define SSL_F_SSL_SET_PKEY 193 -# define SSL_F_SSL_SET_PURPOSE 227 -# define SSL_F_SSL_SET_RFD 194 -# define SSL_F_SSL_SET_SESSION 195 -# define SSL_F_SSL_SET_SESSION_ID_CONTEXT 218 -# define SSL_F_SSL_SET_SESSION_TICKET_EXT 294 -# define SSL_F_SSL_SET_TRUST 228 -# define SSL_F_SSL_SET_WFD 196 -# define SSL_F_SSL_SHUTDOWN 224 -# define SSL_F_SSL_SRP_CTX_INIT 313 -# define SSL_F_SSL_UNDEFINED_CONST_FUNCTION 243 -# define SSL_F_SSL_UNDEFINED_FUNCTION 197 -# define SSL_F_SSL_UNDEFINED_VOID_FUNCTION 244 -# define SSL_F_SSL_USE_CERTIFICATE 198 -# define SSL_F_SSL_USE_CERTIFICATE_ASN1 199 -# define SSL_F_SSL_USE_CERTIFICATE_FILE 200 -# define SSL_F_SSL_USE_PRIVATEKEY 201 -# define SSL_F_SSL_USE_PRIVATEKEY_ASN1 202 -# define SSL_F_SSL_USE_PRIVATEKEY_FILE 203 -# define SSL_F_SSL_USE_PSK_IDENTITY_HINT 273 -# define SSL_F_SSL_USE_RSAPRIVATEKEY 204 -# define SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1 205 -# define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 206 -# define SSL_F_SSL_VERIFY_CERT_CHAIN 207 -# define SSL_F_SSL_WRITE 208 -# define SSL_F_TLS12_CHECK_PEER_SIGALG 333 -# define SSL_F_TLS1_CERT_VERIFY_MAC 286 -# define SSL_F_TLS1_CHANGE_CIPHER_STATE 209 -# define SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT 274 -# define SSL_F_TLS1_ENC 210 -# define SSL_F_TLS1_EXPORT_KEYING_MATERIAL 314 -# define SSL_F_TLS1_GET_CURVELIST 338 -# define SSL_F_TLS1_HEARTBEAT 315 -# define SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT 275 -# define SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT 276 -# define SSL_F_TLS1_PRF 284 -# define SSL_F_TLS1_PROCESS_HEARTBEAT 341 -# define SSL_F_TLS1_SETUP_KEY_BLOCK 211 -# define SSL_F_TLS1_SET_SERVER_SIGALGS 335 - -/* Reason codes. */ -# define SSL_R_APP_DATA_IN_HANDSHAKE 100 -# define SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT 272 -# define SSL_R_BAD_ALERT_RECORD 101 -# define SSL_R_BAD_CHANGE_CIPHER_SPEC 103 -# define SSL_R_BAD_DATA 390 -# define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK 106 -# define SSL_R_BAD_DECOMPRESSION 107 -# define SSL_R_BAD_DH_G_LENGTH 108 -# define SSL_R_BAD_DH_PUB_KEY_LENGTH 109 -# define SSL_R_BAD_DH_P_LENGTH 110 -# define SSL_R_BAD_DIGEST_LENGTH 111 -# define SSL_R_BAD_DSA_SIGNATURE 112 -# define SSL_R_BAD_ECC_CERT 304 -# define SSL_R_BAD_ECDSA_SIGNATURE 305 -# define SSL_R_BAD_ECPOINT 306 -# define SSL_R_BAD_HANDSHAKE_LENGTH 332 -# define SSL_R_BAD_HELLO_REQUEST 105 -# define SSL_R_BAD_LENGTH 271 -# define SSL_R_BAD_MAC_LENGTH 333 -# define SSL_R_BAD_MESSAGE_TYPE 114 -# define SSL_R_BAD_PACKET_LENGTH 115 -# define SSL_R_BAD_PROTOCOL_VERSION_NUMBER 116 -# define SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH 316 -# define SSL_R_BAD_RSA_DECRYPT 118 -# define SSL_R_BAD_RSA_ENCRYPT 119 -# define SSL_R_BAD_RSA_E_LENGTH 120 -# define SSL_R_BAD_RSA_MODULUS_LENGTH 121 -# define SSL_R_BAD_RSA_SIGNATURE 122 -# define SSL_R_BAD_SIGNATURE 123 -# define SSL_R_BAD_SRP_A_LENGTH 347 -# define SSL_R_BAD_SRP_B_LENGTH 348 -# define SSL_R_BAD_SRP_G_LENGTH 349 -# define SSL_R_BAD_SRP_N_LENGTH 350 -# define SSL_R_BAD_SRP_PARAMETERS 371 -# define SSL_R_BAD_SRP_S_LENGTH 351 -# define SSL_R_BAD_SRTP_MKI_VALUE 352 -# define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST 353 -# define SSL_R_BAD_SSL_FILETYPE 124 -# define SSL_R_BAD_VALUE 384 -# define SSL_R_BAD_WRITE_RETRY 127 -# define SSL_R_BIO_NOT_SET 128 -# define SSL_R_BLOCK_CIPHER_PAD_IS_WRONG 129 -# define SSL_R_BN_LIB 130 -# define SSL_R_CA_DN_LENGTH_MISMATCH 131 -# define SSL_R_CA_DN_TOO_LONG 132 -# define SSL_R_CA_KEY_TOO_SMALL 397 -# define SSL_R_CA_MD_TOO_WEAK 398 -# define SSL_R_CCS_RECEIVED_EARLY 133 -# define SSL_R_CERTIFICATE_VERIFY_FAILED 134 -# define SSL_R_CERT_CB_ERROR 377 -# define SSL_R_CERT_LENGTH_MISMATCH 135 -# define SSL_R_CIPHER_CODE_WRONG_LENGTH 137 -# define SSL_R_CIPHER_OR_HASH_UNAVAILABLE 138 -# define SSL_R_CLIENTHELLO_TLSEXT 226 -# define SSL_R_COMPRESSED_LENGTH_TOO_LONG 140 -# define SSL_R_COMPRESSION_DISABLED 343 -# define SSL_R_COMPRESSION_FAILURE 141 -# define SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE 307 -# define SSL_R_COMPRESSION_LIBRARY_ERROR 142 -# define SSL_R_CONNECTION_TYPE_NOT_SET 144 -# define SSL_R_COOKIE_MISMATCH 308 -# define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED 145 -# define SSL_R_DATA_LENGTH_TOO_LONG 146 -# define SSL_R_DECRYPTION_FAILED 147 -# define SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC 281 -# define SSL_R_DH_KEY_TOO_SMALL 394 -# define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG 148 -# define SSL_R_DIGEST_CHECK_FAILED 149 -# define SSL_R_DTLS_MESSAGE_TOO_BIG 334 -# define SSL_R_DUPLICATE_COMPRESSION_ID 309 -# define SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT 317 -# define SSL_R_ECC_CERT_NOT_FOR_SIGNING 318 -# define SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE 322 -# define SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE 323 -# define SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE 374 -# define SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER 310 -# define SSL_R_EE_KEY_TOO_SMALL 399 -# define SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST 354 -# define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 150 -# define SSL_R_ERROR_GENERATING_TMP_RSA_KEY 282 -# define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 151 -# define SSL_R_EXCESSIVE_MESSAGE_SIZE 152 -# define SSL_R_EXTRA_DATA_IN_MESSAGE 153 -# define SSL_R_GOT_A_FIN_BEFORE_A_CCS 154 -# define SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS 355 -# define SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION 356 -# define SSL_R_HTTPS_PROXY_REQUEST 155 -# define SSL_R_HTTP_REQUEST 156 -# define SSL_R_ILLEGAL_SUITEB_DIGEST 380 -# define SSL_R_INAPPROPRIATE_FALLBACK 373 -# define SSL_R_INCONSISTENT_COMPRESSION 340 -# define SSL_R_INVALID_COMMAND 280 -# define SSL_R_INVALID_COMPRESSION_ALGORITHM 341 -# define SSL_R_INVALID_NULL_CMD_NAME 385 -# define SSL_R_INVALID_PURPOSE 278 -# define SSL_R_INVALID_SERVERINFO_DATA 388 -# define SSL_R_INVALID_SRP_USERNAME 357 -# define SSL_R_INVALID_STATUS_RESPONSE 328 -# define SSL_R_INVALID_TICKET_KEYS_LENGTH 325 -# define SSL_R_INVALID_TRUST 279 -# define SSL_R_KRB5 285 -# define SSL_R_KRB5_C_CC_PRINC 286 -# define SSL_R_KRB5_C_GET_CRED 287 -# define SSL_R_KRB5_C_INIT 288 -# define SSL_R_KRB5_C_MK_REQ 289 -# define SSL_R_KRB5_S_BAD_TICKET 290 -# define SSL_R_KRB5_S_INIT 291 -# define SSL_R_KRB5_S_RD_REQ 292 -# define SSL_R_KRB5_S_TKT_EXPIRED 293 -# define SSL_R_KRB5_S_TKT_NYV 294 -# define SSL_R_KRB5_S_TKT_SKEW 295 -# define SSL_R_LENGTH_MISMATCH 159 -# define SSL_R_LENGTH_TOO_SHORT 160 -# define SSL_R_LIBRARY_BUG 274 -# define SSL_R_LIBRARY_HAS_NO_CIPHERS 161 -# define SSL_R_MISSING_DH_DSA_CERT 162 -# define SSL_R_MISSING_DH_KEY 163 -# define SSL_R_MISSING_DH_RSA_CERT 164 -# define SSL_R_MISSING_DSA_SIGNING_CERT 165 -# define SSL_R_MISSING_ECDH_CERT 382 -# define SSL_R_MISSING_ECDSA_SIGNING_CERT 381 -# define SSL_R_MISSING_EXPORT_TMP_DH_KEY 166 -# define SSL_R_MISSING_EXPORT_TMP_RSA_KEY 167 -# define SSL_R_MISSING_RSA_CERTIFICATE 168 -# define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169 -# define SSL_R_MISSING_RSA_SIGNING_CERT 170 -# define SSL_R_MISSING_SRP_PARAM 358 -# define SSL_R_MISSING_TMP_DH_KEY 171 -# define SSL_R_MISSING_TMP_ECDH_KEY 311 -# define SSL_R_MISSING_TMP_RSA_KEY 172 -# define SSL_R_MISSING_TMP_RSA_PKEY 173 -# define SSL_R_MISSING_VERIFY_MESSAGE 174 -# define SSL_R_MULTIPLE_SGC_RESTARTS 346 -# define SSL_R_NO_CERTIFICATES_RETURNED 176 -# define SSL_R_NO_CERTIFICATE_ASSIGNED 177 -# define SSL_R_NO_CERTIFICATE_RETURNED 178 -# define SSL_R_NO_CERTIFICATE_SET 179 -# define SSL_R_NO_CIPHERS_AVAILABLE 181 -# define SSL_R_NO_CIPHERS_PASSED 182 -# define SSL_R_NO_CIPHERS_SPECIFIED 183 -# define SSL_R_NO_CIPHER_MATCH 185 -# define SSL_R_NO_CLIENT_CERT_METHOD 331 -# define SSL_R_NO_CLIENT_CERT_RECEIVED 186 -# define SSL_R_NO_COMPRESSION_SPECIFIED 187 -# define SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER 330 -# define SSL_R_NO_METHOD_SPECIFIED 188 -# define SSL_R_NO_PEM_EXTENSIONS 389 -# define SSL_R_NO_PRIVATE_KEY_ASSIGNED 190 -# define SSL_R_NO_PROTOCOLS_AVAILABLE 191 -# define SSL_R_NO_RENEGOTIATION 339 -# define SSL_R_NO_REQUIRED_DIGEST 324 -# define SSL_R_NO_SHARED_CIPHER 193 -# define SSL_R_NO_SHARED_SIGATURE_ALGORITHMS 376 -# define SSL_R_NO_SRTP_PROFILES 359 -# define SSL_R_NO_VERIFY_CALLBACK 194 -# define SSL_R_NULL_SSL_CTX 195 -# define SSL_R_NULL_SSL_METHOD_PASSED 196 -# define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED 197 -# define SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED 344 -# define SSL_R_ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE 387 -# define SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE 379 -# define SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE 297 -# define SSL_R_OPAQUE_PRF_INPUT_TOO_LONG 327 -# define SSL_R_PACKET_LENGTH_TOO_LONG 198 -# define SSL_R_PARSE_TLSEXT 227 -# define SSL_R_PATH_TOO_LONG 270 -# define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE 199 -# define SSL_R_PEM_NAME_BAD_PREFIX 391 -# define SSL_R_PEM_NAME_TOO_SHORT 392 -# define SSL_R_PRE_MAC_LENGTH_TOO_LONG 205 -# define SSL_R_PROTOCOL_IS_SHUTDOWN 207 -# define SSL_R_PSK_IDENTITY_NOT_FOUND 223 -# define SSL_R_PSK_NO_CLIENT_CB 224 -# define SSL_R_PSK_NO_SERVER_CB 225 -# define SSL_R_READ_BIO_NOT_SET 211 -# define SSL_R_READ_TIMEOUT_EXPIRED 312 -# define SSL_R_RECORD_LENGTH_MISMATCH 213 -# define SSL_R_RECORD_TOO_LARGE 214 -# define SSL_R_RECORD_TOO_SMALL 298 -# define SSL_R_RENEGOTIATE_EXT_TOO_LONG 335 -# define SSL_R_RENEGOTIATION_ENCODING_ERR 336 -# define SSL_R_RENEGOTIATION_MISMATCH 337 -# define SSL_R_REQUIRED_CIPHER_MISSING 215 -# define SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING 342 -# define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING 345 -# define SSL_R_SERVERHELLO_TLSEXT 275 -# define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277 -# define SSL_R_SIGNATURE_ALGORITHMS_ERROR 360 -# define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220 -# define SSL_R_SRP_A_CALC 361 -# define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362 -# define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363 -# define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364 -# define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221 -# define SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT 321 -# define SSL_R_SSL3_EXT_INVALID_SERVERNAME 319 -# define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE 320 -# define SSL_R_SSL3_SESSION_ID_TOO_LONG 300 -# define SSL_R_SSL3_SESSION_ID_TOO_SHORT 222 -# define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 1042 -# define SSL_R_SSLV3_ALERT_BAD_RECORD_MAC 1020 -# define SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED 1045 -# define SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED 1044 -# define SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN 1046 -# define SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE 1030 -# define SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE 1040 -# define SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER 1047 -# define SSL_R_SSLV3_ALERT_NO_CERTIFICATE 1041 -# define SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010 -# define SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE 1043 -# define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228 -# define SSL_R_SSL_HANDSHAKE_FAILURE 229 -# define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS 230 -# define SSL_R_SSL_NEGATIVE_LENGTH 372 -# define SSL_R_SSL_SESSION_ID_CALLBACK_FAILED 301 -# define SSL_R_SSL_SESSION_ID_CONFLICT 302 -# define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG 273 -# define SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH 303 -# define SSL_R_TLSV1_ALERT_ACCESS_DENIED 1049 -# define SSL_R_TLSV1_ALERT_DECODE_ERROR 1050 -# define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 -# define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 -# define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 -# define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 -# define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 -# define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 -# define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 -# define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION 1070 -# define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW 1022 -# define SSL_R_TLSV1_ALERT_UNKNOWN_CA 1048 -# define SSL_R_TLSV1_ALERT_USER_CANCELLED 1090 -# define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE 1114 -# define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE 1113 -# define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111 -# define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112 -# define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110 -# define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER 232 -# define SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT 365 -# define SSL_R_TLS_HEARTBEAT_PENDING 366 -# define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367 -# define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157 -# define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233 -# define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG 234 -# define SSL_R_UNABLE_TO_DECODE_DH_CERTS 236 -# define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS 313 -# define SSL_R_UNABLE_TO_FIND_DH_PARAMETERS 238 -# define SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS 314 -# define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS 239 -# define SSL_R_UNABLE_TO_FIND_SSL_METHOD 240 -# define SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES 242 -# define SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES 243 -# define SSL_R_UNEXPECTED_MESSAGE 244 -# define SSL_R_UNEXPECTED_RECORD 245 -# define SSL_R_UNINITIALIZED 276 -# define SSL_R_UNKNOWN_ALERT_TYPE 246 -# define SSL_R_UNKNOWN_CERTIFICATE_TYPE 247 -# define SSL_R_UNKNOWN_CIPHER_RETURNED 248 -# define SSL_R_UNKNOWN_CIPHER_TYPE 249 -# define SSL_R_UNKNOWN_CMD_NAME 386 -# define SSL_R_UNKNOWN_DIGEST 368 -# define SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE 250 -# define SSL_R_UNKNOWN_PKEY_TYPE 251 -# define SSL_R_UNKNOWN_PROTOCOL 252 -# define SSL_R_UNKNOWN_REMOTE_ERROR_TYPE 253 -# define SSL_R_UNKNOWN_SSL_VERSION 254 -# define SSL_R_UNKNOWN_STATE 255 -# define SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED 338 -# define SSL_R_UNSUPPORTED_CIPHER 256 -# define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM 257 -# define SSL_R_UNSUPPORTED_DIGEST_TYPE 326 -# define SSL_R_UNSUPPORTED_ELLIPTIC_CURVE 315 -# define SSL_R_UNSUPPORTED_PROTOCOL 258 -# define SSL_R_UNSUPPORTED_SSL_VERSION 259 -# define SSL_R_UNSUPPORTED_STATUS_TYPE 329 -# define SSL_R_USE_SRTP_NOT_NEGOTIATED 369 -# define SSL_R_VERSION_TOO_LOW 396 -# define SSL_R_WRONG_CERTIFICATE_TYPE 383 -# define SSL_R_WRONG_CIPHER_RETURNED 261 -# define SSL_R_WRONG_CURVE 378 -# define SSL_R_WRONG_MESSAGE_TYPE 262 -# define SSL_R_WRONG_SIGNATURE_LENGTH 264 -# define SSL_R_WRONG_SIGNATURE_SIZE 265 -# define SSL_R_WRONG_SIGNATURE_TYPE 370 -# define SSL_R_WRONG_SSL_VERSION 266 -# define SSL_R_WRONG_VERSION_NUMBER 267 -# define SSL_R_X509_LIB 268 -# define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS 269 - -#ifdef __cplusplus -} -#endif -#endif diff --git a/ssl/ssl2.h b/ssl/ssl2.h deleted file mode 100644 index 64e1b142ec..0000000000 --- a/ssl/ssl2.h +++ /dev/null @@ -1,73 +0,0 @@ -/* ssl/ssl2.h */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ - -#ifndef HEADER_SSL2_H -# define HEADER_SSL2_H - -#ifdef __cplusplus -extern "C" { -#endif - -# define SSL2_VERSION 0x0002 - -# define SSL2_MT_CLIENT_HELLO 1 - -#ifdef __cplusplus -} -#endif -#endif diff --git a/ssl/ssl23.h b/ssl/ssl23.h deleted file mode 100644 index 9de4685af9..0000000000 --- a/ssl/ssl23.h +++ /dev/null @@ -1,84 +0,0 @@ -/* ssl/ssl23.h */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ - -#ifndef HEADER_SSL23_H -# define HEADER_SSL23_H - -#ifdef __cplusplus -extern "C" { -#endif - -/* - * client - */ -/* write to server */ -# define SSL23_ST_CW_CLNT_HELLO_A (0x210|SSL_ST_CONNECT) -# define SSL23_ST_CW_CLNT_HELLO_B (0x211|SSL_ST_CONNECT) -/* read from server */ -# define SSL23_ST_CR_SRVR_HELLO_A (0x220|SSL_ST_CONNECT) -# define SSL23_ST_CR_SRVR_HELLO_B (0x221|SSL_ST_CONNECT) - -/* server */ -/* read from client */ -# define SSL23_ST_SR_CLNT_HELLO_A (0x210|SSL_ST_ACCEPT) -# define SSL23_ST_SR_CLNT_HELLO_B (0x211|SSL_ST_ACCEPT) - -#ifdef __cplusplus -} -#endif -#endif diff --git a/ssl/ssl3.h b/ssl/ssl3.h deleted file mode 100644 index 7d16d70de5..0000000000 --- a/ssl/ssl3.h +++ /dev/null @@ -1,552 +0,0 @@ -/* ssl/ssl3.h */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ -/* ==================================================================== - * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. - * ECC cipher suite support in OpenSSL originally developed by - * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. - */ - -#ifndef HEADER_SSL3_H -# define HEADER_SSL3_H - -# ifndef OPENSSL_NO_COMP -# include <openssl/comp.h> -# endif -# include <openssl/buffer.h> -# include <openssl/evp.h> -# include <openssl/ssl.h> - -#ifdef __cplusplus -extern "C" { -#endif - -/* - * Signalling cipher suite value from RFC 5746 - * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) - */ -# define SSL3_CK_SCSV 0x030000FF - -/* - * Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00 - * (TLS_FALLBACK_SCSV) - */ -# define SSL3_CK_FALLBACK_SCSV 0x03005600 - -# define SSL3_CK_RSA_NULL_MD5 0x03000001 -# define SSL3_CK_RSA_NULL_SHA 0x03000002 -# define SSL3_CK_RSA_RC4_40_MD5 0x03000003 -# define SSL3_CK_RSA_RC4_128_MD5 0x03000004 -# define SSL3_CK_RSA_RC4_128_SHA 0x03000005 -# define SSL3_CK_RSA_RC2_40_MD5 0x03000006 -# define SSL3_CK_RSA_IDEA_128_SHA 0x03000007 -# define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008 -# define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009 -# define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A - -# define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B -# define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C -# define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D -# define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E -# define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F -# define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010 - -# define SSL3_CK_DHE_DSS_DES_40_CBC_SHA 0x03000011 -# define SSL3_CK_EDH_DSS_DES_40_CBC_SHA SSL3_CK_DHE_DSS_DES_40_CBC_SHA -# define SSL3_CK_DHE_DSS_DES_64_CBC_SHA 0x03000012 -# define SSL3_CK_EDH_DSS_DES_64_CBC_SHA SSL3_CK_DHE_DSS_DES_64_CBC_SHA -# define SSL3_CK_DHE_DSS_DES_192_CBC3_SHA 0x03000013 -# define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA SSL3_CK_DHE_DSS_DES_192_CBC3_SHA -# define SSL3_CK_DHE_RSA_DES_40_CBC_SHA 0x03000014 -# define SSL3_CK_EDH_RSA_DES_40_CBC_SHA SSL3_CK_DHE_RSA_DES_40_CBC_SHA -# define SSL3_CK_DHE_RSA_DES_64_CBC_SHA 0x03000015 -# define SSL3_CK_EDH_RSA_DES_64_CBC_SHA SSL3_CK_DHE_RSA_DES_64_CBC_SHA -# define SSL3_CK_DHE_RSA_DES_192_CBC3_SHA 0x03000016 -# define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA SSL3_CK_DHE_RSA_DES_192_CBC3_SHA - -# define SSL3_CK_ADH_RC4_40_MD5 0x03000017 -# define SSL3_CK_ADH_RC4_128_MD5 0x03000018 -# define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019 -# define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A -# define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B - -/* - * VRS Additional Kerberos5 entries - */ -# define SSL3_CK_KRB5_DES_64_CBC_SHA 0x0300001E -# define SSL3_CK_KRB5_DES_192_CBC3_SHA 0x0300001F -# define SSL3_CK_KRB5_RC4_128_SHA 0x03000020 -# define SSL3_CK_KRB5_IDEA_128_CBC_SHA 0x03000021 -# define SSL3_CK_KRB5_DES_64_CBC_MD5 0x03000022 -# define SSL3_CK_KRB5_DES_192_CBC3_MD5 0x03000023 -# define SSL3_CK_KRB5_RC4_128_MD5 0x03000024 -# define SSL3_CK_KRB5_IDEA_128_CBC_MD5 0x03000025 - -# define SSL3_CK_KRB5_DES_40_CBC_SHA 0x03000026 -# define SSL3_CK_KRB5_RC2_40_CBC_SHA 0x03000027 -# define SSL3_CK_KRB5_RC4_40_SHA 0x03000028 -# define SSL3_CK_KRB5_DES_40_CBC_MD5 0x03000029 -# define SSL3_CK_KRB5_RC2_40_CBC_MD5 0x0300002A -# define SSL3_CK_KRB5_RC4_40_MD5 0x0300002B - -# define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5" -# define SSL3_TXT_RSA_NULL_SHA "NULL-SHA" -# define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5" -# define SSL3_TXT_RSA_RC4_128_MD5 "RC4-MD5" -# define SSL3_TXT_RSA_RC4_128_SHA "RC4-SHA" -# define SSL3_TXT_RSA_RC2_40_MD5 "EXP-RC2-CBC-MD5" -# define SSL3_TXT_RSA_IDEA_128_SHA "IDEA-CBC-SHA" -# define SSL3_TXT_RSA_DES_40_CBC_SHA "EXP-DES-CBC-SHA" -# define SSL3_TXT_RSA_DES_64_CBC_SHA "DES-CBC-SHA" -# define SSL3_TXT_RSA_DES_192_CBC3_SHA "DES-CBC3-SHA" - -# define SSL3_TXT_DH_DSS_DES_40_CBC_SHA "EXP-DH-DSS-DES-CBC-SHA" -# define SSL3_TXT_DH_DSS_DES_64_CBC_SHA "DH-DSS-DES-CBC-SHA" -# define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA" -# define SSL3_TXT_DH_RSA_DES_40_CBC_SHA "EXP-DH-RSA-DES-CBC-SHA" -# define SSL3_TXT_DH_RSA_DES_64_CBC_SHA "DH-RSA-DES-CBC-SHA" -# define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA" - -# define SSL3_TXT_DHE_DSS_DES_40_CBC_SHA "EXP-DHE-DSS-DES-CBC-SHA" -# define SSL3_TXT_DHE_DSS_DES_64_CBC_SHA "DHE-DSS-DES-CBC-SHA" -# define SSL3_TXT_DHE_DSS_DES_192_CBC3_SHA "DHE-DSS-DES-CBC3-SHA" -# define SSL3_TXT_DHE_RSA_DES_40_CBC_SHA "EXP-DHE-RSA-DES-CBC-SHA" -# define SSL3_TXT_DHE_RSA_DES_64_CBC_SHA "DHE-RSA-DES-CBC-SHA" -# define SSL3_TXT_DHE_RSA_DES_192_CBC3_SHA "DHE-RSA-DES-CBC3-SHA" - -/* - * This next block of six "EDH" labels is for backward compatibility with - * older versions of OpenSSL. New code should use the six "DHE" labels above - * instead: - */ -# define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA "EXP-EDH-DSS-DES-CBC-SHA" -# define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA "EDH-DSS-DES-CBC-SHA" -# define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA" -# define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA "EXP-EDH-RSA-DES-CBC-SHA" -# define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA "EDH-RSA-DES-CBC-SHA" -# define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA" - -# define SSL3_TXT_ADH_RC4_40_MD5 "EXP-ADH-RC4-MD5" -# define SSL3_TXT_ADH_RC4_128_MD5 "ADH-RC4-MD5" -# define SSL3_TXT_ADH_DES_40_CBC_SHA "EXP-ADH-DES-CBC-SHA" -# define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA" -# define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA" - -# define SSL3_TXT_KRB5_DES_64_CBC_SHA "KRB5-DES-CBC-SHA" -# define SSL3_TXT_KRB5_DES_192_CBC3_SHA "KRB5-DES-CBC3-SHA" -# define SSL3_TXT_KRB5_RC4_128_SHA "KRB5-RC4-SHA" -# define SSL3_TXT_KRB5_IDEA_128_CBC_SHA "KRB5-IDEA-CBC-SHA" -# define SSL3_TXT_KRB5_DES_64_CBC_MD5 "KRB5-DES-CBC-MD5" -# define SSL3_TXT_KRB5_DES_192_CBC3_MD5 "KRB5-DES-CBC3-MD5" -# define SSL3_TXT_KRB5_RC4_128_MD5 "KRB5-RC4-MD5" -# define SSL3_TXT_KRB5_IDEA_128_CBC_MD5 "KRB5-IDEA-CBC-MD5" - -# define SSL3_TXT_KRB5_DES_40_CBC_SHA "EXP-KRB5-DES-CBC-SHA" -# define SSL3_TXT_KRB5_RC2_40_CBC_SHA "EXP-KRB5-RC2-CBC-SHA" -# define SSL3_TXT_KRB5_RC4_40_SHA "EXP-KRB5-RC4-SHA" -# define SSL3_TXT_KRB5_DES_40_CBC_MD5 "EXP-KRB5-DES-CBC-MD5" -# define SSL3_TXT_KRB5_RC2_40_CBC_MD5 "EXP-KRB5-RC2-CBC-MD5" -# define SSL3_TXT_KRB5_RC4_40_MD5 "EXP-KRB5-RC4-MD5" - -# define SSL3_SSL_SESSION_ID_LENGTH 32 -# define SSL3_MAX_SSL_SESSION_ID_LENGTH 32 - -# define SSL3_MASTER_SECRET_SIZE 48 -# define SSL3_RANDOM_SIZE 32 -# define SSL3_SESSION_ID_SIZE 32 -# define SSL3_RT_HEADER_LENGTH 5 - -# define SSL3_HM_HEADER_LENGTH 4 - -# ifndef SSL3_ALIGN_PAYLOAD - /* - * Some will argue that this increases memory footprint, but it's not - * actually true. Point is that malloc has to return at least 64-bit aligned - * pointers, meaning that allocating 5 bytes wastes 3 bytes in either case. - * Suggested pre-gaping simply moves these wasted bytes from the end of - * allocated region to its front, but makes data payload aligned, which - * improves performance:-) - */ -# define SSL3_ALIGN_PAYLOAD 8 -# else -# if (SSL3_ALIGN_PAYLOAD&(SSL3_ALIGN_PAYLOAD-1))!=0 -# error "insane SSL3_ALIGN_PAYLOAD" -# undef SSL3_ALIGN_PAYLOAD -# endif -# endif - -/* - * This is the maximum MAC (digest) size used by the SSL library. Currently - * maximum of 20 is used by SHA1, but we reserve for future extension for - * 512-bit hashes. - */ - -# define SSL3_RT_MAX_MD_SIZE 64 - -/* - * Maximum block size used in all ciphersuites. Currently 16 for AES. - */ - -# define SSL_RT_MAX_CIPHER_BLOCK_SIZE 16 - -# define SSL3_RT_MAX_EXTRA (16384) - -/* Maximum plaintext length: defined by SSL/TLS standards */ -# define SSL3_RT_MAX_PLAIN_LENGTH 16384 -/* Maximum compression overhead: defined by SSL/TLS standards */ -# define SSL3_RT_MAX_COMPRESSED_OVERHEAD 1024 - -/* - * The standards give a maximum encryption overhead of 1024 bytes. In - * practice the value is lower than this. The overhead is the maximum number - * of padding bytes (256) plus the mac size. - */ -# define SSL3_RT_MAX_ENCRYPTED_OVERHEAD (256 + SSL3_RT_MAX_MD_SIZE) - -/* - * OpenSSL currently only uses a padding length of at most one block so the - * send overhead is smaller. - */ - -# define SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD \ - (SSL_RT_MAX_CIPHER_BLOCK_SIZE + SSL3_RT_MAX_MD_SIZE) - -/* If compression isn't used don't include the compression overhead */ - -# ifdef OPENSSL_NO_COMP -# define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH -# else -# define SSL3_RT_MAX_COMPRESSED_LENGTH \ - (SSL3_RT_MAX_PLAIN_LENGTH+SSL3_RT_MAX_COMPRESSED_OVERHEAD) -# endif -# define SSL3_RT_MAX_ENCRYPTED_LENGTH \ - (SSL3_RT_MAX_ENCRYPTED_OVERHEAD+SSL3_RT_MAX_COMPRESSED_LENGTH) -# define SSL3_RT_MAX_PACKET_SIZE \ - (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH) - -# define SSL3_MD_CLIENT_FINISHED_CONST "\x43\x4C\x4E\x54" -# define SSL3_MD_SERVER_FINISHED_CONST "\x53\x52\x56\x52" - -# define SSL3_VERSION 0x0300 -# define SSL3_VERSION_MAJOR 0x03 -# define SSL3_VERSION_MINOR 0x00 - -# define SSL3_RT_CHANGE_CIPHER_SPEC 20 -# define SSL3_RT_ALERT 21 -# define SSL3_RT_HANDSHAKE 22 -# define SSL3_RT_APPLICATION_DATA 23 -# define TLS1_RT_HEARTBEAT 24 - -/* Pseudo content types to indicate additional parameters */ -# define TLS1_RT_CRYPTO 0x1000 -# define TLS1_RT_CRYPTO_PREMASTER (TLS1_RT_CRYPTO | 0x1) -# define TLS1_RT_CRYPTO_CLIENT_RANDOM (TLS1_RT_CRYPTO | 0x2) -# define TLS1_RT_CRYPTO_SERVER_RANDOM (TLS1_RT_CRYPTO | 0x3) -# define TLS1_RT_CRYPTO_MASTER (TLS1_RT_CRYPTO | 0x4) - -# define TLS1_RT_CRYPTO_READ 0x0000 -# define TLS1_RT_CRYPTO_WRITE 0x0100 -# define TLS1_RT_CRYPTO_MAC (TLS1_RT_CRYPTO | 0x5) -# define TLS1_RT_CRYPTO_KEY (TLS1_RT_CRYPTO | 0x6) -# define TLS1_RT_CRYPTO_IV (TLS1_RT_CRYPTO | 0x7) -# define TLS1_RT_CRYPTO_FIXED_IV (TLS1_RT_CRYPTO | 0x8) - -/* Pseudo content type for SSL/TLS header info */ -# define SSL3_RT_HEADER 0x100 - -# define SSL3_AL_WARNING 1 -# define SSL3_AL_FATAL 2 - -# define SSL3_AD_CLOSE_NOTIFY 0 -# define SSL3_AD_UNEXPECTED_MESSAGE 10/* fatal */ -# define SSL3_AD_BAD_RECORD_MAC 20/* fatal */ -# define SSL3_AD_DECOMPRESSION_FAILURE 30/* fatal */ -# define SSL3_AD_HANDSHAKE_FAILURE 40/* fatal */ -# define SSL3_AD_NO_CERTIFICATE 41 -# define SSL3_AD_BAD_CERTIFICATE 42 -# define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 -# define SSL3_AD_CERTIFICATE_REVOKED 44 -# define SSL3_AD_CERTIFICATE_EXPIRED 45 -# define SSL3_AD_CERTIFICATE_UNKNOWN 46 -# define SSL3_AD_ILLEGAL_PARAMETER 47/* fatal */ - -# define TLS1_HB_REQUEST 1 -# define TLS1_HB_RESPONSE 2 - - -# define SSL3_CT_RSA_SIGN 1 -# define SSL3_CT_DSS_SIGN 2 -# define SSL3_CT_RSA_FIXED_DH 3 -# define SSL3_CT_DSS_FIXED_DH 4 -# define SSL3_CT_RSA_EPHEMERAL_DH 5 -# define SSL3_CT_DSS_EPHEMERAL_DH 6 -# define SSL3_CT_FORTEZZA_DMS 20 -/* - * SSL3_CT_NUMBER is used to size arrays and it must be large enough to - * contain all of the cert types defined either for SSLv3 and TLSv1. - */ -# define SSL3_CT_NUMBER 9 - -# define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS 0x0001 -# define SSL3_FLAGS_DELAY_CLIENT_FINISHED 0x0002 -# define SSL3_FLAGS_POP_BUFFER 0x0004 -# define TLS1_FLAGS_TLS_PADDING_BUG 0x0008 -# define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010 -# define TLS1_FLAGS_KEEP_HANDSHAKE 0x0020 -/* - * Set when the handshake is ready to process peer's ChangeCipherSpec message. - * Cleared after the message has been processed. - */ -# define SSL3_FLAGS_CCS_OK 0x0080 - -/* Set if we encrypt then mac instead of usual mac then encrypt */ -# define TLS1_FLAGS_ENCRYPT_THEN_MAC 0x0100 - - -/* SSLv3 */ -/* - * client - */ -/* extra state */ -# define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT) -# ifndef OPENSSL_NO_SCTP -# define DTLS1_SCTP_ST_CW_WRITE_SOCK (0x310|SSL_ST_CONNECT) -# define DTLS1_SCTP_ST_CR_READ_SOCK (0x320|SSL_ST_CONNECT) -# endif -/* write to server */ -# define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT) -# define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT) -/* read from server */ -# define SSL3_ST_CR_SRVR_HELLO_A (0x120|SSL_ST_CONNECT) -# define SSL3_ST_CR_SRVR_HELLO_B (0x121|SSL_ST_CONNECT) -# define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT) -# define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT) -# define SSL3_ST_CR_CERT_A (0x130|SSL_ST_CONNECT) -# define SSL3_ST_CR_CERT_B (0x131|SSL_ST_CONNECT) -# define SSL3_ST_CR_KEY_EXCH_A (0x140|SSL_ST_CONNECT) -# define SSL3_ST_CR_KEY_EXCH_B (0x141|SSL_ST_CONNECT) -# define SSL3_ST_CR_CERT_REQ_A (0x150|SSL_ST_CONNECT) -# define SSL3_ST_CR_CERT_REQ_B (0x151|SSL_ST_CONNECT) -# define SSL3_ST_CR_SRVR_DONE_A (0x160|SSL_ST_CONNECT) -# define SSL3_ST_CR_SRVR_DONE_B (0x161|SSL_ST_CONNECT) -/* write to server */ -# define SSL3_ST_CW_CERT_A (0x170|SSL_ST_CONNECT) -# define SSL3_ST_CW_CERT_B (0x171|SSL_ST_CONNECT) -# define SSL3_ST_CW_CERT_C (0x172|SSL_ST_CONNECT) -# define SSL3_ST_CW_CERT_D (0x173|SSL_ST_CONNECT) -# define SSL3_ST_CW_KEY_EXCH_A (0x180|SSL_ST_CONNECT) -# define SSL3_ST_CW_KEY_EXCH_B (0x181|SSL_ST_CONNECT) -# define SSL3_ST_CW_CERT_VRFY_A (0x190|SSL_ST_CONNECT) -# define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT) -# define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT) -# define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT) -# ifndef OPENSSL_NO_NEXTPROTONEG -# define SSL3_ST_CW_NEXT_PROTO_A (0x200|SSL_ST_CONNECT) -# define SSL3_ST_CW_NEXT_PROTO_B (0x201|SSL_ST_CONNECT) -# endif -# define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT) -# define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT) -/* read from server */ -# define SSL3_ST_CR_CHANGE_A (0x1C0|SSL_ST_CONNECT) -# define SSL3_ST_CR_CHANGE_B (0x1C1|SSL_ST_CONNECT) -# define SSL3_ST_CR_FINISHED_A (0x1D0|SSL_ST_CONNECT) -# define SSL3_ST_CR_FINISHED_B (0x1D1|SSL_ST_CONNECT) -# define SSL3_ST_CR_SESSION_TICKET_A (0x1E0|SSL_ST_CONNECT) -# define SSL3_ST_CR_SESSION_TICKET_B (0x1E1|SSL_ST_CONNECT) -# define SSL3_ST_CR_CERT_STATUS_A (0x1F0|SSL_ST_CONNECT) -# define SSL3_ST_CR_CERT_STATUS_B (0x1F1|SSL_ST_CONNECT) - -/* server */ -/* extra state */ -# define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT) -# ifndef OPENSSL_NO_SCTP -# define DTLS1_SCTP_ST_SW_WRITE_SOCK (0x310|SSL_ST_ACCEPT) -# define DTLS1_SCTP_ST_SR_READ_SOCK (0x320|SSL_ST_ACCEPT) -# endif -/* read from client */ -/* Do not change the number values, they do matter */ -# define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CLNT_HELLO_B (0x111|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CLNT_HELLO_C (0x112|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CLNT_HELLO_D (0x115|SSL_ST_ACCEPT) -/* write to client */ -# define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT) -# define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT) -# define SSL3_ST_SW_HELLO_REQ_A (0x120|SSL_ST_ACCEPT) -# define SSL3_ST_SW_HELLO_REQ_B (0x121|SSL_ST_ACCEPT) -# define SSL3_ST_SW_HELLO_REQ_C (0x122|SSL_ST_ACCEPT) -# define SSL3_ST_SW_SRVR_HELLO_A (0x130|SSL_ST_ACCEPT) -# define SSL3_ST_SW_SRVR_HELLO_B (0x131|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CERT_A (0x140|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CERT_B (0x141|SSL_ST_ACCEPT) -# define SSL3_ST_SW_KEY_EXCH_A (0x150|SSL_ST_ACCEPT) -# define SSL3_ST_SW_KEY_EXCH_B (0x151|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CERT_REQ_A (0x160|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CERT_REQ_B (0x161|SSL_ST_ACCEPT) -# define SSL3_ST_SW_SRVR_DONE_A (0x170|SSL_ST_ACCEPT) -# define SSL3_ST_SW_SRVR_DONE_B (0x171|SSL_ST_ACCEPT) -/* read from client */ -# define SSL3_ST_SR_CERT_A (0x180|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CERT_B (0x181|SSL_ST_ACCEPT) -# define SSL3_ST_SR_KEY_EXCH_A (0x190|SSL_ST_ACCEPT) -# define SSL3_ST_SR_KEY_EXCH_B (0x191|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CERT_VRFY_A (0x1A0|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT) -# define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT) -# ifndef OPENSSL_NO_NEXTPROTONEG -# define SSL3_ST_SR_NEXT_PROTO_A (0x210|SSL_ST_ACCEPT) -# define SSL3_ST_SR_NEXT_PROTO_B (0x211|SSL_ST_ACCEPT) -# endif -# define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT) -# define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT) -/* write to client */ -# define SSL3_ST_SW_CHANGE_A (0x1D0|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CHANGE_B (0x1D1|SSL_ST_ACCEPT) -# define SSL3_ST_SW_FINISHED_A (0x1E0|SSL_ST_ACCEPT) -# define SSL3_ST_SW_FINISHED_B (0x1E1|SSL_ST_ACCEPT) -# define SSL3_ST_SW_SESSION_TICKET_A (0x1F0|SSL_ST_ACCEPT) -# define SSL3_ST_SW_SESSION_TICKET_B (0x1F1|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CERT_STATUS_A (0x200|SSL_ST_ACCEPT) -# define SSL3_ST_SW_CERT_STATUS_B (0x201|SSL_ST_ACCEPT) - -# define SSL3_MT_HELLO_REQUEST 0 -# define SSL3_MT_CLIENT_HELLO 1 -# define SSL3_MT_SERVER_HELLO 2 -# define SSL3_MT_NEWSESSION_TICKET 4 -# define SSL3_MT_CERTIFICATE 11 -# define SSL3_MT_SERVER_KEY_EXCHANGE 12 -# define SSL3_MT_CERTIFICATE_REQUEST 13 -# define SSL3_MT_SERVER_DONE 14 -# define SSL3_MT_CERTIFICATE_VERIFY 15 -# define SSL3_MT_CLIENT_KEY_EXCHANGE 16 -# define SSL3_MT_FINISHED 20 -# define SSL3_MT_CERTIFICATE_STATUS 22 -# ifndef OPENSSL_NO_NEXTPROTONEG -# define SSL3_MT_NEXT_PROTO 67 -# endif -# define DTLS1_MT_HELLO_VERIFY_REQUEST 3 - -# define SSL3_MT_CCS 1 - -/* These are used when changing over to a new cipher */ -# define SSL3_CC_READ 0x01 -# define SSL3_CC_WRITE 0x02 -# define SSL3_CC_CLIENT 0x10 -# define SSL3_CC_SERVER 0x20 -# define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE) -# define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER|SSL3_CC_READ) -# define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT|SSL3_CC_READ) -# define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE) - -#ifdef __cplusplus -} -#endif -#endif diff --git a/ssl/ssltest.c b/ssl/ssltest.c deleted file mode 100644 index 508fedd613..0000000000 --- a/ssl/ssltest.c +++ /dev/null @@ -1,3207 +0,0 @@ -/* ssl/ssltest.c */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ -/* ==================================================================== - * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. - * ECC cipher suite support in OpenSSL originally developed by - * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. - */ -/* ==================================================================== - * Copyright 2005 Nokia. All rights reserved. - * - * The portions of the attached software ("Contribution") is developed by - * Nokia Corporation and is licensed pursuant to the OpenSSL open source - * license. - * - * The Contribution, originally written by Mika Kousa and Pasi Eronen of - * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites - * support (see RFC 4279) to OpenSSL. - * - * No patent licenses or other rights except those expressly stated in - * the OpenSSL open source license shall be deemed granted or received - * expressly, by implication, estoppel, or otherwise. - * - * No assurances are provided by Nokia that the Contribution does not - * infringe the patent or other intellectual property rights of any third - * party or that the license provides you with all the necessary rights - * to make use of the Contribution. - * - * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN - * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA - * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY - * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR - * OTHERWISE. - */ - -/* Or gethostname won't be declared properly on Linux and GNU platforms. */ -#define _BSD_SOURCE 1 - -#include <assert.h> -#include <errno.h> -#include <limits.h> -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#include <time.h> - -#define USE_SOCKETS -#include "e_os.h" - -#ifdef OPENSSL_SYS_VMS -/* - * Or isascii won't be declared properly on VMS (at least with DECompHP C). - */ -# define _XOPEN_SOURCE 500 -#endif - -#include <ctype.h> - -#include <openssl/bio.h> -#include <openssl/crypto.h> -#include <openssl/evp.h> -#include <openssl/x509.h> -#include <openssl/x509v3.h> -#include <openssl/ssl.h> -#ifndef OPENSSL_NO_ENGINE -# include <openssl/engine.h> -#endif -#include <openssl/err.h> -#include <openssl/rand.h> -#ifndef OPENSSL_NO_RSA -# include <openssl/rsa.h> -#endif -#ifndef OPENSSL_NO_DSA -# include <openssl/dsa.h> -#endif -#ifndef OPENSSL_NO_DH -# include <openssl/dh.h> -#endif -#ifndef OPENSSL_NO_SRP -# include <openssl/srp.h> -#endif -#include <openssl/bn.h> - -#include "../ssl/ssl_locl.h" - -/* - * Or gethostname won't be declared properly - * on Compaq platforms (at least with DEC C). - * Do not try to put it earlier, or IPv6 includes - * get screwed... - */ -#define _XOPEN_SOURCE_EXTENDED 1 - -#ifdef OPENSSL_SYS_WINDOWS -# include <winsock.h> -#else -# include OPENSSL_UNISTD -#endif - -#ifdef OPENSSL_SYS_VMS -# define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM" -# define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM" -#elif defined(OPENSSL_SYS_WINCE) -# define TEST_SERVER_CERT "\\OpenSSL\\server.pem" -# define TEST_CLIENT_CERT "\\OpenSSL\\client.pem" -#elif defined(OPENSSL_SYS_NETWARE) -# define TEST_SERVER_CERT "\\openssl\\apps\\server.pem" -# define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem" -#else -# define TEST_SERVER_CERT "../apps/server.pem" -# define TEST_CLIENT_CERT "../apps/client.pem" -#endif - -/* - * There is really no standard for this, so let's assign some tentative - * numbers. In any case, these numbers are only for this test - */ -#define COMP_RLE 255 -#define COMP_ZLIB 1 - -static int verify_callback(int ok, X509_STORE_CTX *ctx); -#ifndef OPENSSL_NO_RSA -static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength); -static void free_tmp_rsa(void); -#endif -static int app_verify_callback(X509_STORE_CTX *ctx, void *arg); -#define APP_CALLBACK_STRING "Test Callback Argument" -struct app_verify_arg { - char *string; - int app_verify; - int allow_proxy_certs; - char *proxy_auth; - char *proxy_cond; -}; - -#ifndef OPENSSL_NO_DH -static DH *get_dh512(void); -static DH *get_dh1024(void); -static DH *get_dh1024dsa(void); -#endif - -static char *psk_key = NULL; /* by default PSK is not used */ -#ifndef OPENSSL_NO_PSK -static unsigned int psk_client_callback(SSL *ssl, const char *hint, - char *identity, - unsigned int max_identity_len, - unsigned char *psk, - unsigned int max_psk_len); -static unsigned int psk_server_callback(SSL *ssl, const char *identity, - unsigned char *psk, - unsigned int max_psk_len); -#endif - -#ifndef OPENSSL_NO_SRP -/* SRP client */ -/* This is a context that we pass to all callbacks */ -typedef struct srp_client_arg_st { - char *srppassin; - char *srplogin; -} SRP_CLIENT_ARG; - -# define PWD_STRLEN 1024 - -static char *ssl_give_srp_client_pwd_cb(SSL *s, void *arg) -{ - SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg; - return BUF_strdup((char *)srp_client_arg->srppassin); -} - -/* SRP server */ -/* This is a context that we pass to SRP server callbacks */ -typedef struct srp_server_arg_st { - char *expected_user; - char *pass; -} SRP_SERVER_ARG; - -static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg) -{ - SRP_SERVER_ARG *p = (SRP_SERVER_ARG *)arg; - - if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0) { - fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s)); - return SSL3_AL_FATAL; - } - if (SSL_set_srp_server_param_pw(s, p->expected_user, p->pass, "1024") < 0) { - *ad = SSL_AD_INTERNAL_ERROR; - return SSL3_AL_FATAL; - } - return SSL_ERROR_NONE; -} -#endif - -static BIO *bio_err = NULL; -static BIO *bio_stdout = NULL; - -#ifndef OPENSSL_NO_NEXTPROTONEG -/* Note that this code assumes that this is only a one element list: */ -static const char NEXT_PROTO_STRING[] = "\x09testproto"; -int npn_client = 0; -int npn_server = 0; -int npn_server_reject = 0; - -static int cb_client_npn(SSL *s, unsigned char **out, unsigned char *outlen, - const unsigned char *in, unsigned int inlen, - void *arg) -{ - /* - * This callback only returns the protocol string, rather than a length - * prefixed set. We assume that NEXT_PROTO_STRING is a one element list - * and remove the first byte to chop off the length prefix. - */ - *out = (unsigned char *)NEXT_PROTO_STRING + 1; - *outlen = sizeof(NEXT_PROTO_STRING) - 2; - return SSL_TLSEXT_ERR_OK; -} - -static int cb_server_npn(SSL *s, const unsigned char **data, - unsigned int *len, void *arg) -{ - *data = (const unsigned char *)NEXT_PROTO_STRING; - *len = sizeof(NEXT_PROTO_STRING) - 1; - return SSL_TLSEXT_ERR_OK; -} - -static int cb_server_rejects_npn(SSL *s, const unsigned char **data, - unsigned int *len, void *arg) -{ - return SSL_TLSEXT_ERR_NOACK; -} - -static int verify_npn(SSL *client, SSL *server) -{ - const unsigned char *client_s; - unsigned client_len; - const unsigned char *server_s; - unsigned server_len; - - SSL_get0_next_proto_negotiated(client, &client_s, &client_len); - SSL_get0_next_proto_negotiated(server, &server_s, &server_len); - - if (client_len) { - BIO_printf(bio_stdout, "Client NPN: "); - BIO_write(bio_stdout, client_s, client_len); - BIO_printf(bio_stdout, "\n"); - } - - if (server_len) { - BIO_printf(bio_stdout, "Server NPN: "); - BIO_write(bio_stdout, server_s, server_len); - BIO_printf(bio_stdout, "\n"); - } - - /* - * If an NPN string was returned, it must be the protocol that we - * expected to negotiate. - */ - if (client_len && (client_len != sizeof(NEXT_PROTO_STRING) - 2 || - memcmp(client_s, NEXT_PROTO_STRING + 1, client_len))) - return -1; - if (server_len && (server_len != sizeof(NEXT_PROTO_STRING) - 2 || - memcmp(server_s, NEXT_PROTO_STRING + 1, server_len))) - return -1; - - if (!npn_client && client_len) - return -1; - if (!npn_server && server_len) - return -1; - if (npn_server_reject && server_len) - return -1; - if (npn_client && npn_server && (!client_len || !server_len)) - return -1; - - return 0; -} -#endif - -static const char *alpn_client; -static const char *alpn_server; -static const char *alpn_expected; -static unsigned char *alpn_selected; - -/*- - * next_protos_parse parses a comma separated list of strings into a string - * in a format suitable for passing to SSL_CTX_set_next_protos_advertised. - * outlen: (output) set to the length of the resulting buffer on success. - * err: (maybe NULL) on failure, an error message line is written to this BIO. - * in: a NUL terminated string like "abc,def,ghi" - * - * returns: a malloced buffer or NULL on failure. - */ -static unsigned char *next_protos_parse(unsigned short *outlen, - const char *in) -{ - size_t len; - unsigned char *out; - size_t i, start = 0; - - len = strlen(in); - if (len >= 65535) - return NULL; - - out = OPENSSL_malloc(strlen(in) + 1); - if (!out) - return NULL; - - for (i = 0; i <= len; ++i) { - if (i == len || in[i] == ',') { - if (i - start > 255) { - OPENSSL_free(out); - return NULL; - } - out[start] = i - start; - start = i + 1; - } else - out[i + 1] = in[i]; - } - - *outlen = len + 1; - return out; -} - -static int cb_server_alpn(SSL *s, const unsigned char **out, - unsigned char *outlen, const unsigned char *in, - unsigned int inlen, void *arg) -{ - unsigned char *protos; - unsigned short protos_len; - - protos = next_protos_parse(&protos_len, alpn_server); - if (protos == NULL) { - fprintf(stderr, "failed to parser ALPN server protocol string: %s\n", - alpn_server); - abort(); - } - - if (SSL_select_next_proto - ((unsigned char **)out, outlen, protos, protos_len, in, - inlen) != OPENSSL_NPN_NEGOTIATED) { - OPENSSL_free(protos); - return SSL_TLSEXT_ERR_NOACK; - } - - /* - * Make a copy of the selected protocol which will be freed in - * verify_alpn. - */ - alpn_selected = OPENSSL_malloc(*outlen); - memcpy(alpn_selected, *out, *outlen); - *out = alpn_selected; - - OPENSSL_free(protos); - return SSL_TLSEXT_ERR_OK; -} - -static int verify_alpn(SSL *client, SSL *server) -{ - const unsigned char *client_proto, *server_proto; - unsigned int client_proto_len = 0, server_proto_len = 0; - SSL_get0_alpn_selected(client, &client_proto, &client_proto_len); - SSL_get0_alpn_selected(server, &server_proto, &server_proto_len); - - if (alpn_selected != NULL) { - OPENSSL_free(alpn_selected); - alpn_selected = NULL; - } - - if (client_proto_len != server_proto_len || - memcmp(client_proto, server_proto, client_proto_len) != 0) { - BIO_printf(bio_stdout, "ALPN selected protocols differ!\n"); - goto err; - } - - if (client_proto_len > 0 && alpn_expected == NULL) { - BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\n"); - goto err; - } - - if (alpn_expected != NULL && - (client_proto_len != strlen(alpn_expected) || - memcmp(client_proto, alpn_expected, client_proto_len) != 0)) { - BIO_printf(bio_stdout, - "ALPN selected protocols not equal to expected protocol: %s\n", - alpn_expected); - goto err; - } - - return 0; - - err: - BIO_printf(bio_stdout, "ALPN results: client: '"); - BIO_write(bio_stdout, client_proto, client_proto_len); - BIO_printf(bio_stdout, "', server: '"); - BIO_write(bio_stdout, server_proto, server_proto_len); - BIO_printf(bio_stdout, "'\n"); - BIO_printf(bio_stdout, "ALPN configured: client: '%s', server: '%s'\n", - alpn_client, alpn_server); - return -1; -} - -#define SCT_EXT_TYPE 18 - -/* - * WARNING : below extension types are *NOT* IETF assigned, and could - * conflict if these types are reassigned and handled specially by OpenSSL - * in the future - */ -#define TACK_EXT_TYPE 62208 -#define CUSTOM_EXT_TYPE_0 1000 -#define CUSTOM_EXT_TYPE_1 1001 -#define CUSTOM_EXT_TYPE_2 1002 -#define CUSTOM_EXT_TYPE_3 1003 - -const char custom_ext_cli_string[] = "abc"; -const char custom_ext_srv_string[] = "defg"; - -/* These set from cmdline */ -char *serverinfo_file = NULL; -int serverinfo_sct = 0; -int serverinfo_tack = 0; - -/* These set based on extension callbacks */ -int serverinfo_sct_seen = 0; -int serverinfo_tack_seen = 0; -int serverinfo_other_seen = 0; - -/* This set from cmdline */ -int custom_ext = 0; - -/* This set based on extension callbacks */ -int custom_ext_error = 0; - -static int serverinfo_cli_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, size_t inlen, - int *al, void *arg) -{ - if (ext_type == SCT_EXT_TYPE) - serverinfo_sct_seen++; - else if (ext_type == TACK_EXT_TYPE) - serverinfo_tack_seen++; - else - serverinfo_other_seen++; - return 1; -} - -static int verify_serverinfo() -{ - if (serverinfo_sct != serverinfo_sct_seen) - return -1; - if (serverinfo_tack != serverinfo_tack_seen) - return -1; - if (serverinfo_other_seen) - return -1; - return 0; -} - -/*- - * Four test cases for custom extensions: - * 0 - no ClientHello extension or ServerHello response - * 1 - ClientHello with "abc", no response - * 2 - ClientHello with "abc", empty response - * 3 - ClientHello with "abc", "defg" response - */ - -static int custom_ext_0_cli_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_0) - custom_ext_error = 1; - return 0; /* Don't send an extension */ -} - -static int custom_ext_0_cli_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - return 1; -} - -static int custom_ext_1_cli_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_1) - custom_ext_error = 1; - *out = (const unsigned char *)custom_ext_cli_string; - *outlen = strlen(custom_ext_cli_string); - return 1; /* Send "abc" */ -} - -static int custom_ext_1_cli_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - return 1; -} - -static int custom_ext_2_cli_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_2) - custom_ext_error = 1; - *out = (const unsigned char *)custom_ext_cli_string; - *outlen = strlen(custom_ext_cli_string); - return 1; /* Send "abc" */ -} - -static int custom_ext_2_cli_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_2) - custom_ext_error = 1; - if (inlen != 0) - custom_ext_error = 1; /* Should be empty response */ - return 1; -} - -static int custom_ext_3_cli_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_3) - custom_ext_error = 1; - *out = (const unsigned char *)custom_ext_cli_string; - *outlen = strlen(custom_ext_cli_string); - return 1; /* Send "abc" */ -} - -static int custom_ext_3_cli_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_3) - custom_ext_error = 1; - if (inlen != strlen(custom_ext_srv_string)) - custom_ext_error = 1; - if (memcmp(custom_ext_srv_string, in, inlen) != 0) - custom_ext_error = 1; /* Check for "defg" */ - return 1; -} - -/* - * custom_ext_0_cli_add_cb returns 0 - the server won't receive a callback - * for this extension - */ -static int custom_ext_0_srv_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - custom_ext_error = 1; - return 1; -} - -/* 'add' callbacks are only called if the 'parse' callback is called */ -static int custom_ext_0_srv_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - /* Error: should not have been called */ - custom_ext_error = 1; - return 0; /* Don't send an extension */ -} - -static int custom_ext_1_srv_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_1) - custom_ext_error = 1; - /* Check for "abc" */ - if (inlen != strlen(custom_ext_cli_string)) - custom_ext_error = 1; - if (memcmp(in, custom_ext_cli_string, inlen) != 0) - custom_ext_error = 1; - return 1; -} - -static int custom_ext_1_srv_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - return 0; /* Don't send an extension */ -} - -static int custom_ext_2_srv_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_2) - custom_ext_error = 1; - /* Check for "abc" */ - if (inlen != strlen(custom_ext_cli_string)) - custom_ext_error = 1; - if (memcmp(in, custom_ext_cli_string, inlen) != 0) - custom_ext_error = 1; - return 1; -} - -static int custom_ext_2_srv_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - *out = NULL; - *outlen = 0; - return 1; /* Send empty extension */ -} - -static int custom_ext_3_srv_parse_cb(SSL *s, unsigned int ext_type, - const unsigned char *in, - size_t inlen, int *al, void *arg) -{ - if (ext_type != CUSTOM_EXT_TYPE_3) - custom_ext_error = 1; - /* Check for "abc" */ - if (inlen != strlen(custom_ext_cli_string)) - custom_ext_error = 1; - if (memcmp(in, custom_ext_cli_string, inlen) != 0) - custom_ext_error = 1; - return 1; -} - -static int custom_ext_3_srv_add_cb(SSL *s, unsigned int ext_type, - const unsigned char **out, - size_t *outlen, int *al, void *arg) -{ - *out = (const unsigned char *)custom_ext_srv_string; - *outlen = strlen(custom_ext_srv_string); - return 1; /* Send "defg" */ -} - -static char *cipher = NULL; -static int verbose = 0; -static int debug = 0; -static const char rnd_seed[] = - "string to make the random number generator think it has entropy"; - -int doit_biopair(SSL *s_ssl, SSL *c_ssl, long bytes, clock_t *s_time, - clock_t *c_time); -int doit(SSL *s_ssl, SSL *c_ssl, long bytes); -static int do_test_cipherlist(void); - -static void sv_usage(void) -{ - fprintf(stderr, "usage: ssltest [args ...]\n"); - fprintf(stderr, "\n"); -#ifdef OPENSSL_FIPS - fprintf(stderr, "-F - run test in FIPS mode\n"); -#endif - fprintf(stderr, " -server_auth - check server certificate\n"); - fprintf(stderr, " -client_auth - do client authentication\n"); - fprintf(stderr, " -proxy - allow proxy certificates\n"); - fprintf(stderr, " -proxy_auth <val> - set proxy policy rights\n"); - fprintf(stderr, - " -proxy_cond <val> - expression to test proxy policy rights\n"); - fprintf(stderr, " -v - more output\n"); - fprintf(stderr, " -d - debug output\n"); - fprintf(stderr, " -reuse - use session-id reuse\n"); - fprintf(stderr, " -num <val> - number of connections to perform\n"); - fprintf(stderr, - " -bytes <val> - number of bytes to swap between client/server\n"); -#ifndef OPENSSL_NO_DH - fprintf(stderr, - " -dhe1024 - use 1024 bit key (safe prime) for DHE\n"); - fprintf(stderr, - " -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n"); - fprintf(stderr, " -no_dhe - disable DHE\n"); -#endif -#ifndef OPENSSL_NO_EC - fprintf(stderr, " -no_ecdhe - disable ECDHE\n"); -#endif -#ifndef OPENSSL_NO_PSK - fprintf(stderr, " -psk arg - PSK in hex (without 0x)\n"); -#endif -#ifndef OPENSSL_NO_SRP - fprintf(stderr, " -srpuser user - SRP username to use\n"); - fprintf(stderr, " -srppass arg - password for 'user'\n"); -#endif -#ifndef OPENSSL_NO_SSL3_METHOD - fprintf(stderr, " -ssl3 - use SSLv3\n"); -#endif - fprintf(stderr, " -tls1 - use TLSv1\n"); -#ifndef OPENSSL_NO_DTLS - fprintf(stderr, " -dtls1 - use DTLSv1\n"); - fprintf(stderr, " -dtls12 - use DTLSv1.2\n"); -#endif - fprintf(stderr, " -CApath arg - PEM format directory of CA's\n"); - fprintf(stderr, " -CAfile arg - PEM format file of CA's\n"); - fprintf(stderr, " -cert arg - Server certificate file\n"); - fprintf(stderr, - " -key arg - Server key file (default: same as -cert)\n"); - fprintf(stderr, " -c_cert arg - Client certificate file\n"); - fprintf(stderr, - " -c_key arg - Client key file (default: same as -c_cert)\n"); - fprintf(stderr, " -cipher arg - The cipher list\n"); - fprintf(stderr, " -bio_pair - Use BIO pairs\n"); - fprintf(stderr, " -f - Test even cases that can't work\n"); - fprintf(stderr, - " -time - measure processor time used by client and server\n"); - fprintf(stderr, " -zlib - use zlib compression\n"); - fprintf(stderr, " -rle - use rle compression\n"); -#ifndef OPENSSL_NO_EC - fprintf(stderr, - " -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" - " Use \"openssl ecparam -list_curves\" for all names\n" - " (default is sect163r2).\n"); -#endif - fprintf(stderr, - " -test_cipherlist - Verifies the order of the ssl cipher lists.\n" - " When this option is requested, the cipherlist\n" - " tests are run instead of handshake tests.\n"); -#ifndef OPENSSL_NO_NEXTPROTONEG - fprintf(stderr, " -npn_client - have client side offer NPN\n"); - fprintf(stderr, " -npn_server - have server side offer NPN\n"); - fprintf(stderr, " -npn_server_reject - have server reject NPN\n"); -#endif - fprintf(stderr, " -serverinfo_file file - have server use this file\n"); - fprintf(stderr, " -serverinfo_sct - have client offer and expect SCT\n"); - fprintf(stderr, - " -serverinfo_tack - have client offer and expect TACK\n"); - fprintf(stderr, - " -custom_ext - try various custom extension callbacks\n"); - fprintf(stderr, " -alpn_client <string> - have client side offer ALPN\n"); - fprintf(stderr, " -alpn_server <string> - have server side offer ALPN\n"); - fprintf(stderr, - " -alpn_expected <string> - the ALPN protocol that should be negotiated\n"); -} - -static void print_key_details(BIO *out, EVP_PKEY *key) -{ - int keyid = EVP_PKEY_id(key); -#ifndef OPENSSL_NO_EC - if (keyid == EVP_PKEY_EC) { - EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); - int nid; - const char *cname; - nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); - EC_KEY_free(ec); - cname = EC_curve_nid2nist(nid); - if (!cname) - cname = OBJ_nid2sn(nid); - BIO_printf(out, "%d bits EC (%s)", EVP_PKEY_bits(key), cname); - } else -#endif - { - const char *algname; - switch (keyid) { - case EVP_PKEY_RSA: - algname = "RSA"; - break; - case EVP_PKEY_DSA: - algname = "DSA"; - break; - case EVP_PKEY_DH: - algname = "DH"; - break; - default: - algname = OBJ_nid2sn(keyid); - break; - } - BIO_printf(out, "%d bits %s", EVP_PKEY_bits(key), algname); - } -} - -static void print_details(SSL *c_ssl, const char *prefix) -{ - const SSL_CIPHER *ciph; - int mdnid; - X509 *cert; - EVP_PKEY *pkey; - - ciph = SSL_get_current_cipher(c_ssl); - BIO_printf(bio_stdout, "%s%s, cipher %s %s", - prefix, - SSL_get_version(c_ssl), - SSL_CIPHER_get_version(ciph), SSL_CIPHER_get_name(ciph)); - cert = SSL_get_peer_certificate(c_ssl); - if (cert != NULL) { - pkey = X509_get_pubkey(cert); - if (pkey != NULL) { - BIO_puts(bio_stdout, ", "); - print_key_details(bio_stdout, pkey); - EVP_PKEY_free(pkey); - } - X509_free(cert); - } - if (SSL_get_server_tmp_key(c_ssl, &pkey)) { - BIO_puts(bio_stdout, ", temp key: "); - print_key_details(bio_stdout, pkey); - EVP_PKEY_free(pkey); - } - if (SSL_get_peer_signature_nid(c_ssl, &mdnid)) - BIO_printf(bio_stdout, ", digest=%s", OBJ_nid2sn(mdnid)); - BIO_printf(bio_stdout, "\n"); -} - -static void lock_dbg_cb(int mode, int type, const char *file, int line) -{ - static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */ - const char *errstr = NULL; - int rw; - - rw = mode & (CRYPTO_READ | CRYPTO_WRITE); - if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE))) { - errstr = "invalid mode"; - goto err; - } - - if (type < 0 || type >= CRYPTO_NUM_LOCKS) { - errstr = "type out of bounds"; - goto err; - } - - if (mode & CRYPTO_LOCK) { - if (modes[type]) { - errstr = "already locked"; - /* - * must not happen in a single-threaded program (would deadlock) - */ - goto err; - } - - modes[type] = rw; - } else if (mode & CRYPTO_UNLOCK) { - if (!modes[type]) { - errstr = "not locked"; - goto err; - } - - if (modes[type] != rw) { - errstr = (rw == CRYPTO_READ) ? - "CRYPTO_r_unlock on write lock" : - "CRYPTO_w_unlock on read lock"; - } - - modes[type] = 0; - } else { - errstr = "invalid mode"; - goto err; - } - - err: - if (errstr) { - /* we cannot use bio_err here */ - fprintf(stderr, - "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n", - errstr, mode, type, file, line); - } -} - -int main(int argc, char *argv[]) -{ - char *CApath = NULL, *CAfile = NULL; - int badop = 0; - int bio_pair = 0; - int force = 0; - int dtls1 = 0, dtls12 = 0, tls1 = 0, ssl3 = 0, ret = 1; - int client_auth = 0; - int server_auth = 0, i; - struct app_verify_arg app_verify_arg = - { APP_CALLBACK_STRING, 0, 0, NULL, NULL }; - char *server_cert = TEST_SERVER_CERT; - char *server_key = NULL; - char *client_cert = TEST_CLIENT_CERT; - char *client_key = NULL; -#ifndef OPENSSL_NO_EC - char *named_curve = NULL; -#endif - SSL_CTX *s_ctx = NULL; - SSL_CTX *c_ctx = NULL; - const SSL_METHOD *meth = NULL; - SSL *c_ssl, *s_ssl; - int number = 1, reuse = 0; - long bytes = 256L; -#ifndef OPENSSL_NO_DH - DH *dh; - int dhe1024 = 0, dhe1024dsa = 0; -#endif -#ifndef OPENSSL_NO_EC - EC_KEY *ecdh = NULL; -#endif -#ifndef OPENSSL_NO_SRP - /* client */ - SRP_CLIENT_ARG srp_client_arg = { NULL, NULL }; - /* server */ - SRP_SERVER_ARG srp_server_arg = { NULL, NULL }; -#endif - int no_dhe = 0; - int no_ecdhe = 0; - int no_psk = 0; - int print_time = 0; - clock_t s_time = 0, c_time = 0; -#ifndef OPENSSL_NO_COMP - int comp = 0; - COMP_METHOD *cm = NULL; - STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; -#endif - int test_cipherlist = 0; -#ifdef OPENSSL_FIPS - int fips_mode = 0; -#endif - int no_protocol = 0; - - SSL_CONF_CTX *s_cctx = NULL, *c_cctx = NULL; - STACK_OF(OPENSSL_STRING) *conf_args = NULL; - const char *arg = NULL, *argn = NULL; - - verbose = 0; - debug = 0; - cipher = 0; - - bio_err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT); - - CRYPTO_set_locking_callback(lock_dbg_cb); - - /* enable memory leak checking unless explicitly disabled */ - if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) - && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off")))) { - CRYPTO_malloc_debug_init(); - CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL); - } else { - /* OPENSSL_DEBUG_MEMORY=off */ - CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0); - } - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); - - RAND_seed(rnd_seed, sizeof rnd_seed); - - bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE | BIO_FP_TEXT); - - s_cctx = SSL_CONF_CTX_new(); - c_cctx = SSL_CONF_CTX_new(); - - if (!s_cctx || !c_cctx) { - ERR_print_errors(bio_err); - goto end; - } - - SSL_CONF_CTX_set_flags(s_cctx, - SSL_CONF_FLAG_CMDLINE | SSL_CONF_FLAG_SERVER); - if (!SSL_CONF_CTX_set1_prefix(s_cctx, "-s_")) { - ERR_print_errors(bio_err); - goto end; - } - - SSL_CONF_CTX_set_flags(c_cctx, - SSL_CONF_FLAG_CMDLINE | SSL_CONF_FLAG_CLIENT); - if (!SSL_CONF_CTX_set1_prefix(c_cctx, "-c_")) { - ERR_print_errors(bio_err); - goto end; - } - - argc--; - argv++; - - while (argc >= 1) { - if (!strcmp(*argv, "-F")) { -#ifdef OPENSSL_FIPS - fips_mode = 1; -#else - fprintf(stderr, - "not compiled with FIPS support, so exiting without running.\n"); - EXIT(0); -#endif - } else if (strcmp(*argv, "-server_auth") == 0) - server_auth = 1; - else if (strcmp(*argv, "-client_auth") == 0) - client_auth = 1; - else if (strcmp(*argv, "-proxy_auth") == 0) { - if (--argc < 1) - goto bad; - app_verify_arg.proxy_auth = *(++argv); - } else if (strcmp(*argv, "-proxy_cond") == 0) { - if (--argc < 1) - goto bad; - app_verify_arg.proxy_cond = *(++argv); - } else if (strcmp(*argv, "-v") == 0) - verbose = 1; - else if (strcmp(*argv, "-d") == 0) - debug = 1; - else if (strcmp(*argv, "-reuse") == 0) - reuse = 1; - else if (strcmp(*argv, "-dhe1024") == 0) { -#ifndef OPENSSL_NO_DH - dhe1024 = 1; -#else - fprintf(stderr, - "ignoring -dhe1024, since I'm compiled without DH\n"); -#endif - } else if (strcmp(*argv, "-dhe1024dsa") == 0) { -#ifndef OPENSSL_NO_DH - dhe1024dsa = 1; -#else - fprintf(stderr, - "ignoring -dhe1024, since I'm compiled without DH\n"); -#endif - } else if (strcmp(*argv, "-no_dhe") == 0) - no_dhe = 1; - else if (strcmp(*argv, "-no_ecdhe") == 0) - no_ecdhe = 1; - else if (strcmp(*argv, "-psk") == 0) { - if (--argc < 1) - goto bad; - psk_key = *(++argv); -#ifndef OPENSSL_NO_PSK - if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key)) { - BIO_printf(bio_err, "Not a hex number '%s'\n", *argv); - goto bad; - } -#else - no_psk = 1; -#endif - } -#ifndef OPENSSL_NO_SRP - else if (strcmp(*argv, "-srpuser") == 0) { - if (--argc < 1) - goto bad; - srp_server_arg.expected_user = srp_client_arg.srplogin = - *(++argv); - tls1 = 1; - } else if (strcmp(*argv, "-srppass") == 0) { - if (--argc < 1) - goto bad; - srp_server_arg.pass = srp_client_arg.srppassin = *(++argv); - tls1 = 1; - } -#endif - else if (strcmp(*argv, "-tls1") == 0) { - tls1 = 1; - } else if (strcmp(*argv, "-ssl3") == 0) { -#ifdef OPENSSL_NO_SSL3_METHOD - no_protocol = 1; -#endif - ssl3 = 1; - } else if (strcmp(*argv, "-dtls1") == 0) { -#ifdef OPENSSL_NO_DTLS - no_protocol = 1; -#endif - dtls1 = 1; - } else if (strcmp(*argv, "-dtls12") == 0) { -#ifdef OPENSSL_NO_DTLS - no_protocol = 1; -#endif - dtls12 = 1; - } else if (strncmp(*argv, "-num", 4) == 0) { - if (--argc < 1) - goto bad; - number = atoi(*(++argv)); - if (number == 0) - number = 1; - } else if (strcmp(*argv, "-bytes") == 0) { - if (--argc < 1) - goto bad; - bytes = atol(*(++argv)); - if (bytes == 0L) - bytes = 1L; - i = strlen(argv[0]); - if (argv[0][i - 1] == 'k') - bytes *= 1024L; - if (argv[0][i - 1] == 'm') - bytes *= 1024L * 1024L; - } else if (strcmp(*argv, "-cert") == 0) { - if (--argc < 1) - goto bad; - server_cert = *(++argv); - } else if (strcmp(*argv, "-s_cert") == 0) { - if (--argc < 1) - goto bad; - server_cert = *(++argv); - } else if (strcmp(*argv, "-key") == 0) { - if (--argc < 1) - goto bad; - server_key = *(++argv); - } else if (strcmp(*argv, "-s_key") == 0) { - if (--argc < 1) - goto bad; - server_key = *(++argv); - } else if (strcmp(*argv, "-c_cert") == 0) { - if (--argc < 1) - goto bad; - client_cert = *(++argv); - } else if (strcmp(*argv, "-c_key") == 0) { - if (--argc < 1) - goto bad; - client_key = *(++argv); - } else if (strcmp(*argv, "-cipher") == 0) { - if (--argc < 1) - goto bad; - cipher = *(++argv); - } else if (strcmp(*argv, "-CApath") == 0) { - if (--argc < 1) - goto bad; - CApath = *(++argv); - } else if (strcmp(*argv, "-CAfile") == 0) { - if (--argc < 1) - goto bad; - CAfile = *(++argv); - } else if (strcmp(*argv, "-bio_pair") == 0) { - bio_pair = 1; - } else if (strcmp(*argv, "-f") == 0) { - force = 1; - } else if (strcmp(*argv, "-time") == 0) { - print_time = 1; - } -#ifndef OPENSSL_NO_COMP - else if (strcmp(*argv, "-zlib") == 0) { - comp = COMP_ZLIB; - } else if (strcmp(*argv, "-rle") == 0) { - comp = COMP_RLE; - } -#endif - else if (strcmp(*argv, "-named_curve") == 0) { - if (--argc < 1) - goto bad; -#ifndef OPENSSL_NO_EC - named_curve = *(++argv); -#else - fprintf(stderr, - "ignoring -named_curve, since I'm compiled without ECDH\n"); - ++argv; -#endif - } else if (strcmp(*argv, "-app_verify") == 0) { - app_verify_arg.app_verify = 1; - } else if (strcmp(*argv, "-proxy") == 0) { - app_verify_arg.allow_proxy_certs = 1; - } else if (strcmp(*argv, "-test_cipherlist") == 0) { - test_cipherlist = 1; - } -#ifndef OPENSSL_NO_NEXTPROTONEG - else if (strcmp(*argv, "-npn_client") == 0) { - npn_client = 1; - } else if (strcmp(*argv, "-npn_server") == 0) { - npn_server = 1; - } else if (strcmp(*argv, "-npn_server_reject") == 0) { - npn_server_reject = 1; - } -#endif - else if (strcmp(*argv, "-serverinfo_sct") == 0) { - serverinfo_sct = 1; - } else if (strcmp(*argv, "-serverinfo_tack") == 0) { - serverinfo_tack = 1; - } else if (strcmp(*argv, "-serverinfo_file") == 0) { - if (--argc < 1) - goto bad; - serverinfo_file = *(++argv); - } else if (strcmp(*argv, "-custom_ext") == 0) { - custom_ext = 1; - } else if (strcmp(*argv, "-alpn_client") == 0) { - if (--argc < 1) - goto bad; - alpn_client = *(++argv); - } else if (strcmp(*argv, "-alpn_server") == 0) { - if (--argc < 1) - goto bad; - alpn_server = *(++argv); - } else if (strcmp(*argv, "-alpn_expected") == 0) { - if (--argc < 1) - goto bad; - alpn_expected = *(++argv); - } else { - int rv; - arg = argv[0]; - argn = argv[1]; - /* Try to process command using SSL_CONF */ - rv = SSL_CONF_cmd_argv(c_cctx, &argc, &argv); - /* If not processed try server */ - if (rv == 0) - rv = SSL_CONF_cmd_argv(s_cctx, &argc, &argv); - /* Recognised: store it for later use */ - if (rv > 0) { - if (rv == 1) - argn = NULL; - if (!conf_args) { - conf_args = sk_OPENSSL_STRING_new_null(); - if (!conf_args) - goto end; - } - if (!sk_OPENSSL_STRING_push(conf_args, arg)) - goto end; - if (!sk_OPENSSL_STRING_push(conf_args, argn)) - goto end; - continue; - } - if (rv == -3) - BIO_printf(bio_err, "Missing argument for %s\n", arg); - else if (rv < 0) - BIO_printf(bio_err, "Error with command %s\n", arg); - else if (rv == 0) - BIO_printf(bio_err, "unknown option %s\n", arg); - badop = 1; - break; - } - argc--; - argv++; - } - if (badop) { - bad: - sv_usage(); - goto end; - } - - /* - * test_cipherlist prevails over protocol switch: we test the cipherlist - * for all enabled protocols. - */ - if (test_cipherlist == 1) { - /* - * ensure that the cipher list are correctly sorted and exit - */ - fprintf(stdout, "Testing cipherlist order only. Ignoring all " - "other options.\n"); - if (do_test_cipherlist() == 0) - EXIT(1); - ret = 0; - goto end; - } - - if (ssl3 + tls1 + dtls1 + dtls12 > 1) { - fprintf(stderr, "At most one of -ssl3, -tls1, -dtls1 or -dtls12 should " - "be requested.\n"); - EXIT(1); - } - - /* - * Testing was requested for a compiled-out protocol (e.g. SSLv3). - * Ideally, we would error out, but the generic test wrapper can't know - * when to expect failure. So we do nothing and return success. - */ - if (no_protocol) { - fprintf(stderr, "Testing was requested for a disabled protocol. " - "Skipping tests.\n"); - ret = 0; - goto end; - } - - if (!ssl3 && !tls1 && !dtls1 && !dtls12 && number > 1 && !reuse && !force) { - fprintf(stderr, "This case cannot work. Use -f to perform " - "the test anyway (and\n-d to see what happens), " - "or add one of -ssl3, -tls1, -dtls1, -dtls12, -reuse\n" - "to avoid protocol mismatch.\n"); - EXIT(1); - } -#ifdef OPENSSL_FIPS - if (fips_mode) { - if (!FIPS_mode_set(1)) { - ERR_load_crypto_strings(); - ERR_print_errors(BIO_new_fp(stderr, BIO_NOCLOSE)); - EXIT(1); - } else - fprintf(stderr, "*** IN FIPS MODE ***\n"); - } -#endif - - if (print_time) { - if (!bio_pair) { - fprintf(stderr, "Using BIO pair (-bio_pair)\n"); - bio_pair = 1; - } - if (number < 50 && !force) - fprintf(stderr, - "Warning: For accurate timings, use more connections (e.g. -num 1000)\n"); - } - -/* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */ - - SSL_library_init(); - SSL_load_error_strings(); - -#ifndef OPENSSL_NO_COMP - if (comp == COMP_ZLIB) - cm = COMP_zlib(); - if (comp == COMP_RLE) - cm = COMP_rle(); - if (cm != NULL) { - if (cm->type != NID_undef) { - if (SSL_COMP_add_compression_method(comp, cm) != 0) { - fprintf(stderr, "Failed to add compression method\n"); - ERR_print_errors_fp(stderr); - } - } else { - fprintf(stderr, - "Warning: %s compression not supported\n", - (comp == COMP_RLE ? "rle" : - (comp == COMP_ZLIB ? "zlib" : "unknown"))); - ERR_print_errors_fp(stderr); - } - } - ssl_comp_methods = SSL_COMP_get_compression_methods(); - fprintf(stderr, "Available compression methods:\n"); - { - int j, n = sk_SSL_COMP_num(ssl_comp_methods); - if (n == 0) - fprintf(stderr, " NONE\n"); - else - for (j = 0; j < n; j++) { - SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j); - fprintf(stderr, " %d: %s\n", c->id, c->name); - } - } -#endif - - /* - * At this point, ssl3/tls1 is only set if the protocol is available. - * (Otherwise we exit early.) However the compiler doesn't know this, so - * we ifdef. - */ -#ifndef OPENSSL_NO_SSL3 - if (ssl3) - meth = SSLv3_method(); - else -#endif -#ifndef OPENSSL_NO_DTLS - if (dtls1) - meth = DTLSv1_method(); - else if (dtls12) - meth = DTLSv1_2_method(); - else -#endif - if (tls1) - meth = TLSv1_method(); - else - meth = SSLv23_method(); - - c_ctx = SSL_CTX_new(meth); - s_ctx = SSL_CTX_new(meth); - if ((c_ctx == NULL) || (s_ctx == NULL)) { - ERR_print_errors(bio_err); - goto end; - } - /* - * Since we will use low security ciphersuites and keys for testing set - * security level to zero. - */ - SSL_CTX_set_security_level(c_ctx, 0); - SSL_CTX_set_security_level(s_ctx, 0); - - if (cipher != NULL) { - if(!SSL_CTX_set_cipher_list(c_ctx, cipher) - || !SSL_CTX_set_cipher_list(s_ctx, cipher)) { - ERR_print_errors(bio_err); - goto end; - } - } - - /* Process SSL_CONF arguments */ - SSL_CONF_CTX_set_ssl_ctx(c_cctx, c_ctx); - SSL_CONF_CTX_set_ssl_ctx(s_cctx, s_ctx); - - for (i = 0; i < sk_OPENSSL_STRING_num(conf_args); i += 2) { - int rv; - arg = sk_OPENSSL_STRING_value(conf_args, i); - argn = sk_OPENSSL_STRING_value(conf_args, i + 1); - rv = SSL_CONF_cmd(c_cctx, arg, argn); - /* If not recognised use server context */ - if (rv == -2) - rv = SSL_CONF_cmd(s_cctx, arg, argn); - if (rv <= 0) { - BIO_printf(bio_err, "Error processing %s %s\n", - arg, argn ? argn : ""); - ERR_print_errors(bio_err); - goto end; - } - } - - if (!SSL_CONF_CTX_finish(s_cctx) || !SSL_CONF_CTX_finish(c_cctx)) { - BIO_puts(bio_err, "Error finishing context\n"); - ERR_print_errors(bio_err); - goto end; - } -#ifndef OPENSSL_NO_DH - if (!no_dhe) { - if (dhe1024dsa) { - /* - * use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks - */ - SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE); - dh = get_dh1024dsa(); - } else if (dhe1024) - dh = get_dh1024(); - else - dh = get_dh512(); - SSL_CTX_set_tmp_dh(s_ctx, dh); - DH_free(dh); - } -#else - (void)no_dhe; -#endif - -#ifndef OPENSSL_NO_EC - if (!no_ecdhe) { - int nid; - - if (named_curve != NULL) { - nid = OBJ_sn2nid(named_curve); - if (nid == 0) { - BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve); - goto end; - } - } else -# ifdef OPENSSL_NO_EC2M - nid = NID_X9_62_prime256v1; -# else - nid = NID_sect163r2; -# endif - - ecdh = EC_KEY_new_by_curve_name(nid); - if (ecdh == NULL) { - BIO_printf(bio_err, "unable to create curve\n"); - goto end; - } - - SSL_CTX_set_tmp_ecdh(s_ctx, ecdh); - SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE); - EC_KEY_free(ecdh); - } -#else - (void)no_ecdhe; -#endif - -#ifndef OPENSSL_NO_RSA - SSL_CTX_set_tmp_rsa_callback(s_ctx, tmp_rsa_cb); -#endif - - if (!SSL_CTX_use_certificate_file(s_ctx, server_cert, SSL_FILETYPE_PEM)) { - ERR_print_errors(bio_err); - } else if (!SSL_CTX_use_PrivateKey_file(s_ctx, - (server_key ? server_key : - server_cert), - SSL_FILETYPE_PEM)) { - ERR_print_errors(bio_err); - goto end; - } - - if (client_auth) { - if(!SSL_CTX_use_certificate_file(c_ctx, client_cert, SSL_FILETYPE_PEM) - || !SSL_CTX_use_PrivateKey_file(c_ctx, - (client_key ? client_key : client_cert), - SSL_FILETYPE_PEM)) { - ERR_print_errors(bio_err); - goto end; - } - } - - if ((!SSL_CTX_load_verify_locations(s_ctx, CAfile, CApath)) || - (!SSL_CTX_set_default_verify_paths(s_ctx)) || - (!SSL_CTX_load_verify_locations(c_ctx, CAfile, CApath)) || - (!SSL_CTX_set_default_verify_paths(c_ctx))) { - /* fprintf(stderr,"SSL_load_verify_locations\n"); */ - ERR_print_errors(bio_err); - /* goto end; */ - } - - if (client_auth) { - BIO_printf(bio_err, "client authentication\n"); - SSL_CTX_set_verify(s_ctx, - SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, - verify_callback); - SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, - &app_verify_arg); - } - if (server_auth) { - BIO_printf(bio_err, "server authentication\n"); - SSL_CTX_set_verify(c_ctx, SSL_VERIFY_PEER, verify_callback); - SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, - &app_verify_arg); - } - - { - int session_id_context = 0; - if(!SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, - sizeof session_id_context)) { - ERR_print_errors(bio_err); - goto end; - } - } - - /* Use PSK only if PSK key is given */ - if (psk_key != NULL) { - /* - * no_psk is used to avoid putting psk command to openssl tool - */ - if (no_psk) { - /* - * if PSK is not compiled in and psk key is given, do nothing and - * exit successfully - */ - ret = 0; - goto end; - } -#ifndef OPENSSL_NO_PSK - SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback); - SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback); - if (debug) - BIO_printf(bio_err, "setting PSK identity hint to s_ctx\n"); - if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint")) { - BIO_printf(bio_err, "error setting PSK identity hint to s_ctx\n"); - ERR_print_errors(bio_err); - goto end; - } -#endif - } -#ifndef OPENSSL_NO_SRP - if (srp_client_arg.srplogin) { - if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin)) { - BIO_printf(bio_err, "Unable to set SRP username\n"); - goto end; - } - SSL_CTX_set_srp_cb_arg(c_ctx, &srp_client_arg); - SSL_CTX_set_srp_client_pwd_callback(c_ctx, - ssl_give_srp_client_pwd_cb); - /* - * SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength); - */ - } - - if (srp_server_arg.expected_user != NULL) { - SSL_CTX_set_verify(s_ctx, SSL_VERIFY_NONE, verify_callback); - SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg); - SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb); - } -#endif - -#ifndef OPENSSL_NO_NEXTPROTONEG - if (npn_client) { - SSL_CTX_set_next_proto_select_cb(c_ctx, cb_client_npn, NULL); - } - if (npn_server) { - if (npn_server_reject) { - BIO_printf(bio_err, - "Can't have both -npn_server and -npn_server_reject\n"); - goto end; - } - SSL_CTX_set_next_protos_advertised_cb(s_ctx, cb_server_npn, NULL); - } - if (npn_server_reject) { - SSL_CTX_set_next_protos_advertised_cb(s_ctx, cb_server_rejects_npn, - NULL); - } -#endif - - if (serverinfo_sct) { - if(!SSL_CTX_add_client_custom_ext(c_ctx, SCT_EXT_TYPE, - NULL, NULL, NULL, - serverinfo_cli_parse_cb, NULL)) { - BIO_printf(bio_err, "Error adding SCT extension\n"); - goto end; - } - } - if (serverinfo_tack) { - if(!SSL_CTX_add_client_custom_ext(c_ctx, TACK_EXT_TYPE, - NULL, NULL, NULL, - serverinfo_cli_parse_cb, NULL)) { - BIO_printf(bio_err, "Error adding TACK extension\n"); - goto end; - } - } - if (serverinfo_file) - if (!SSL_CTX_use_serverinfo_file(s_ctx, serverinfo_file)) { - BIO_printf(bio_err, "missing serverinfo file\n"); - goto end; - } - - if (custom_ext) { - if(!SSL_CTX_add_client_custom_ext(c_ctx, CUSTOM_EXT_TYPE_0, - custom_ext_0_cli_add_cb, - NULL, NULL, - custom_ext_0_cli_parse_cb, NULL) - || !SSL_CTX_add_client_custom_ext(c_ctx, CUSTOM_EXT_TYPE_1, - custom_ext_1_cli_add_cb, - NULL, NULL, - custom_ext_1_cli_parse_cb, NULL) - || !SSL_CTX_add_client_custom_ext(c_ctx, CUSTOM_EXT_TYPE_2, - custom_ext_2_cli_add_cb, - NULL, NULL, - custom_ext_2_cli_parse_cb, NULL) - || !SSL_CTX_add_client_custom_ext(c_ctx, CUSTOM_EXT_TYPE_3, - custom_ext_3_cli_add_cb, - NULL, NULL, - custom_ext_3_cli_parse_cb, NULL) - || !SSL_CTX_add_server_custom_ext(s_ctx, CUSTOM_EXT_TYPE_0, - custom_ext_0_srv_add_cb, - NULL, NULL, - custom_ext_0_srv_parse_cb, NULL) - || !SSL_CTX_add_server_custom_ext(s_ctx, CUSTOM_EXT_TYPE_1, - custom_ext_1_srv_add_cb, - NULL, NULL, - custom_ext_1_srv_parse_cb, NULL) - || !SSL_CTX_add_server_custom_ext(s_ctx, CUSTOM_EXT_TYPE_2, - custom_ext_2_srv_add_cb, - NULL, NULL, - custom_ext_2_srv_parse_cb, NULL) - || !SSL_CTX_add_server_custom_ext(s_ctx, CUSTOM_EXT_TYPE_3, - custom_ext_3_srv_add_cb, - NULL, NULL, - custom_ext_3_srv_parse_cb, NULL)) { - BIO_printf(bio_err, "Error setting custom extensions\n"); - goto end; - } - } - - if (alpn_server) - SSL_CTX_set_alpn_select_cb(s_ctx, cb_server_alpn, NULL); - - if (alpn_client) { - unsigned short alpn_len; - unsigned char *alpn = next_protos_parse(&alpn_len, alpn_client); - - if (alpn == NULL) { - BIO_printf(bio_err, "Error parsing -alpn_client argument\n"); - goto end; - } - /* Returns 0 on success!! */ - if(SSL_CTX_set_alpn_protos(c_ctx, alpn, alpn_len)) { - BIO_printf(bio_err, "Error setting ALPN\n"); - OPENSSL_free(alpn); - goto end; - } - OPENSSL_free(alpn); - } - - c_ssl = SSL_new(c_ctx); - s_ssl = SSL_new(s_ctx); - -#ifndef OPENSSL_NO_KRB5 - if (c_ssl && c_ssl->kssl_ctx) { - char localhost[MAXHOSTNAMELEN + 2]; - - if (gethostname(localhost, sizeof localhost - 1) == 0) { - localhost[sizeof localhost - 1] = '\0'; - if (strlen(localhost) == sizeof localhost - 1) { - BIO_printf(bio_err, "localhost name too long\n"); - goto end; - } - kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, localhost); - } - } -#endif /* OPENSSL_NO_KRB5 */ - - for (i = 0; i < number; i++) { - if (!reuse) { - if(!SSL_set_session(c_ssl, NULL)) { - BIO_printf(bio_err, "Failed to set session\n"); - goto end; - } - } - if (bio_pair) - ret = doit_biopair(s_ssl, c_ssl, bytes, &s_time, &c_time); - else - ret = doit(s_ssl, c_ssl, bytes); - if (ret) break; - } - - if (!verbose) { - print_details(c_ssl, ""); - } - if ((i > 1) || (bytes > 1L)) - BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n", i, - bytes); - if (print_time) { -#ifdef CLOCKS_PER_SEC - /* - * "To determine the time in seconds, the value returned by the clock - * function should be divided by the value of the macro - * CLOCKS_PER_SEC." -- ISO/IEC 9899 - */ - BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n" - "Approximate total client time: %6.2f s\n", - (double)s_time / CLOCKS_PER_SEC, - (double)c_time / CLOCKS_PER_SEC); -#else - BIO_printf(bio_stdout, - "Approximate total server time: %6.2f units\n" - "Approximate total client time: %6.2f units\n", - (double)s_time, (double)c_time); -#endif - } - - SSL_free(s_ssl); - SSL_free(c_ssl); - - end: - if (s_ctx != NULL) - SSL_CTX_free(s_ctx); - if (c_ctx != NULL) - SSL_CTX_free(c_ctx); - - if (s_cctx) - SSL_CONF_CTX_free(s_cctx); - if (c_cctx) - SSL_CONF_CTX_free(c_cctx); - sk_OPENSSL_STRING_free(conf_args); - - BIO_free(bio_stdout); - -#ifndef OPENSSL_NO_RSA - free_tmp_rsa(); -#endif -#ifndef OPENSSL_NO_ENGINE - ENGINE_cleanup(); -#endif - CRYPTO_cleanup_all_ex_data(); - ERR_free_strings(); - ERR_remove_thread_state(NULL); - EVP_cleanup(); - CRYPTO_mem_leaks(bio_err); - BIO_free(bio_err); - EXIT(ret); -} - -int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, - clock_t *s_time, clock_t *c_time) -{ - long cw_num = count, cr_num = count, sw_num = count, sr_num = count; - BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL; - BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL; - int ret = 1; - - size_t bufsiz = 256; /* small buffer for testing */ - - if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz)) - goto err; - if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz)) - goto err; - - s_ssl_bio = BIO_new(BIO_f_ssl()); - if (!s_ssl_bio) - goto err; - - c_ssl_bio = BIO_new(BIO_f_ssl()); - if (!c_ssl_bio) - goto err; - - SSL_set_connect_state(c_ssl); - SSL_set_bio(c_ssl, client, client); - (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE); - - SSL_set_accept_state(s_ssl); - SSL_set_bio(s_ssl, server, server); - (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE); - - do { - /*- - * c_ssl_bio: SSL filter BIO - * - * client: pseudo-I/O for SSL library - * - * client_io: client's SSL communication; usually to be - * relayed over some I/O facility, but in this - * test program, we're the server, too: - * - * server_io: server's SSL communication - * - * server: pseudo-I/O for SSL library - * - * s_ssl_bio: SSL filter BIO - * - * The client and the server each employ a "BIO pair": - * client + client_io, server + server_io. - * BIO pairs are symmetric. A BIO pair behaves similar - * to a non-blocking socketpair (but both endpoints must - * be handled by the same thread). - * [Here we could connect client and server to the ends - * of a single BIO pair, but then this code would be less - * suitable as an example for BIO pairs in general.] - * - * Useful functions for querying the state of BIO pair endpoints: - * - * BIO_ctrl_pending(bio) number of bytes we can read now - * BIO_ctrl_get_read_request(bio) number of bytes needed to fulfil - * other side's read attempt - * BIO_ctrl_get_write_guarantee(bio) number of bytes we can write now - * - * ..._read_request is never more than ..._write_guarantee; - * it depends on the application which one you should use. - */ - - /* - * We have non-blocking behaviour throughout this test program, but - * can be sure that there is *some* progress in each iteration; so we - * don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE -- - * we just try everything in each iteration - */ - - { - /* CLIENT */ - - char cbuf[1024 * 8]; - int i, r; - clock_t c_clock = clock(); - - memset(cbuf, 0, sizeof(cbuf)); - - if (debug) - if (SSL_in_init(c_ssl)) - printf("client waiting in SSL_connect - %s\n", - SSL_state_string_long(c_ssl)); - - if (cw_num > 0) { - /* Write to server. */ - - if (cw_num > (long)sizeof cbuf) - i = sizeof cbuf; - else - i = (int)cw_num; - r = BIO_write(c_ssl_bio, cbuf, i); - if (r < 0) { - if (!BIO_should_retry(c_ssl_bio)) { - fprintf(stderr, "ERROR in CLIENT\n"); - goto err; - } - /* - * BIO_should_retry(...) can just be ignored here. The - * library expects us to call BIO_write with the same - * arguments again, and that's what we will do in the - * next iteration. - */ - } else if (r == 0) { - fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); - goto err; - } else { - if (debug) - printf("client wrote %d\n", r); - cw_num -= r; - } - } - - if (cr_num > 0) { - /* Read from server. */ - - r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf)); - if (r < 0) { - if (!BIO_should_retry(c_ssl_bio)) { - fprintf(stderr, "ERROR in CLIENT\n"); - goto err; - } - /* - * Again, "BIO_should_retry" can be ignored. - */ - } else if (r == 0) { - fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); - goto err; - } else { - if (debug) - printf("client read %d\n", r); - cr_num -= r; - } - } - - /* - * c_time and s_time increments will typically be very small - * (depending on machine speed and clock tick intervals), but - * sampling over a large number of connections should result in - * fairly accurate figures. We cannot guarantee a lot, however - * -- if each connection lasts for exactly one clock tick, it - * will be counted only for the client or only for the server or - * even not at all. - */ - *c_time += (clock() - c_clock); - } - - { - /* SERVER */ - - char sbuf[1024 * 8]; - int i, r; - clock_t s_clock = clock(); - - memset(sbuf, 0, sizeof(sbuf)); - - if (debug) - if (SSL_in_init(s_ssl)) - printf("server waiting in SSL_accept - %s\n", - SSL_state_string_long(s_ssl)); - - if (sw_num > 0) { - /* Write to client. */ - - if (sw_num > (long)sizeof sbuf) - i = sizeof sbuf; - else - i = (int)sw_num; - r = BIO_write(s_ssl_bio, sbuf, i); - if (r < 0) { - if (!BIO_should_retry(s_ssl_bio)) { - fprintf(stderr, "ERROR in SERVER\n"); - goto err; - } - /* Ignore "BIO_should_retry". */ - } else if (r == 0) { - fprintf(stderr, "SSL SERVER STARTUP FAILED\n"); - goto err; - } else { - if (debug) - printf("server wrote %d\n", r); - sw_num -= r; - } - } - - if (sr_num > 0) { - /* Read from client. */ - - r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf)); - if (r < 0) { - if (!BIO_should_retry(s_ssl_bio)) { - fprintf(stderr, "ERROR in SERVER\n"); - goto err; - } - /* blah, blah */ - } else if (r == 0) { - fprintf(stderr, "SSL SERVER STARTUP FAILED\n"); - goto err; - } else { - if (debug) - printf("server read %d\n", r); - sr_num -= r; - } - } - - *s_time += (clock() - s_clock); - } - - { - /* "I/O" BETWEEN CLIENT AND SERVER. */ - - size_t r1, r2; - BIO *io1 = server_io, *io2 = client_io; - /* - * we use the non-copying interface for io1 and the standard - * BIO_write/BIO_read interface for io2 - */ - - static int prev_progress = 1; - int progress = 0; - - /* io1 to io2 */ - do { - size_t num; - int r; - - r1 = BIO_ctrl_pending(io1); - r2 = BIO_ctrl_get_write_guarantee(io2); - - num = r1; - if (r2 < num) - num = r2; - if (num) { - char *dataptr; - - if (INT_MAX < num) /* yeah, right */ - num = INT_MAX; - - r = BIO_nread(io1, &dataptr, (int)num); - assert(r > 0); - assert(r <= (int)num); - /* - * possibly r < num (non-contiguous data) - */ - num = r; - r = BIO_write(io2, dataptr, (int)num); - if (r != (int)num) { /* can't happen */ - fprintf(stderr, "ERROR: BIO_write could not write " - "BIO_ctrl_get_write_guarantee() bytes"); - goto err; - } - progress = 1; - - if (debug) - printf((io1 == client_io) ? - "C->S relaying: %d bytes\n" : - "S->C relaying: %d bytes\n", (int)num); - } - } - while (r1 && r2); - - /* io2 to io1 */ - { - size_t num; - int r; - - r1 = BIO_ctrl_pending(io2); - r2 = BIO_ctrl_get_read_request(io1); - /* - * here we could use ..._get_write_guarantee instead of - * ..._get_read_request, but by using the latter we test - * restartability of the SSL implementation more thoroughly - */ - num = r1; - if (r2 < num) - num = r2; - if (num) { - char *dataptr; - - if (INT_MAX < num) - num = INT_MAX; - - if (num > 1) - --num; /* test restartability even more thoroughly */ - - r = BIO_nwrite0(io1, &dataptr); - assert(r > 0); - if (r < (int)num) - num = r; - r = BIO_read(io2, dataptr, (int)num); - if (r != (int)num) { /* can't happen */ - fprintf(stderr, "ERROR: BIO_read could not read " - "BIO_ctrl_pending() bytes"); - goto err; - } - progress = 1; - r = BIO_nwrite(io1, &dataptr, (int)num); - if (r != (int)num) { /* can't happen */ - fprintf(stderr, "ERROR: BIO_nwrite() did not accept " - "BIO_nwrite0() bytes"); - goto err; - } - - if (debug) - printf((io2 == client_io) ? - "C->S relaying: %d bytes\n" : - "S->C relaying: %d bytes\n", (int)num); - } - } /* no loop, BIO_ctrl_get_read_request now - * returns 0 anyway */ - - if (!progress && !prev_progress) - if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0) { - fprintf(stderr, "ERROR: got stuck\n"); - fprintf(stderr, " ERROR.\n"); - goto err; - } - prev_progress = progress; - } - } - while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0); - - if (verbose) - print_details(c_ssl, "DONE via BIO pair: "); -#ifndef OPENSSL_NO_NEXTPROTONEG - if (verify_npn(c_ssl, s_ssl) < 0) { - ret = 1; - goto end; - } -#endif - if (verify_serverinfo() < 0) { - fprintf(stderr, "Server info verify error\n"); - ret = 1; - goto err; - } - if (verify_alpn(c_ssl, s_ssl) < 0) { - ret = 1; - goto err; - } - - if (custom_ext_error) { - fprintf(stderr, "Custom extension error\n"); - ret = 1; - goto err; - } - - end: - ret = 0; - - err: - ERR_print_errors(bio_err); - - BIO_free(server); - BIO_free(server_io); - BIO_free(client); - BIO_free(client_io); - BIO_free(s_ssl_bio); - BIO_free(c_ssl_bio); - - return ret; -} - -#define W_READ 1 -#define W_WRITE 2 -#define C_DONE 1 -#define S_DONE 2 - -int doit(SSL *s_ssl, SSL *c_ssl, long count) -{ - char *cbuf = NULL, *sbuf = NULL; - long bufsiz; - long cw_num = count, cr_num = count; - long sw_num = count, sr_num = count; - int ret = 1; - BIO *c_to_s = NULL; - BIO *s_to_c = NULL; - BIO *c_bio = NULL; - BIO *s_bio = NULL; - int c_r, c_w, s_r, s_w; - int i, j; - int done = 0; - int c_write, s_write; - int do_server = 0, do_client = 0; - int max_frag = 5 * 1024; - - bufsiz = count > 40 * 1024 ? 40 * 1024 : count; - - if ((cbuf = OPENSSL_malloc(bufsiz)) == NULL) - goto err; - if ((sbuf = OPENSSL_malloc(bufsiz)) == NULL) - goto err; - - memset(cbuf, 0, bufsiz); - memset(sbuf, 0, bufsiz); - - c_to_s = BIO_new(BIO_s_mem()); - s_to_c = BIO_new(BIO_s_mem()); - if ((s_to_c == NULL) || (c_to_s == NULL)) { - ERR_print_errors(bio_err); - goto err; - } - - c_bio = BIO_new(BIO_f_ssl()); - s_bio = BIO_new(BIO_f_ssl()); - if ((c_bio == NULL) || (s_bio == NULL)) { - ERR_print_errors(bio_err); - goto err; - } - - SSL_set_connect_state(c_ssl); - SSL_set_bio(c_ssl, s_to_c, c_to_s); - SSL_set_max_send_fragment(c_ssl, max_frag); - BIO_set_ssl(c_bio, c_ssl, BIO_NOCLOSE); - - SSL_set_accept_state(s_ssl); - SSL_set_bio(s_ssl, c_to_s, s_to_c); - SSL_set_max_send_fragment(s_ssl, max_frag); - BIO_set_ssl(s_bio, s_ssl, BIO_NOCLOSE); - - c_r = 0; - s_r = 1; - c_w = 1; - s_w = 0; - c_write = 1, s_write = 0; - - /* We can always do writes */ - for (;;) { - do_server = 0; - do_client = 0; - - i = (int)BIO_pending(s_bio); - if ((i && s_r) || s_w) - do_server = 1; - - i = (int)BIO_pending(c_bio); - if ((i && c_r) || c_w) - do_client = 1; - - if (do_server && debug) { - if (SSL_in_init(s_ssl)) - printf("server waiting in SSL_accept - %s\n", - SSL_state_string_long(s_ssl)); -/*- - else if (s_write) - printf("server:SSL_write()\n"); - else - printf("server:SSL_read()\n"); */ - } - - if (do_client && debug) { - if (SSL_in_init(c_ssl)) - printf("client waiting in SSL_connect - %s\n", - SSL_state_string_long(c_ssl)); -/*- - else if (c_write) - printf("client:SSL_write()\n"); - else - printf("client:SSL_read()\n"); */ - } - - if (!do_client && !do_server) { - fprintf(stdout, "ERROR IN STARTUP\n"); - ERR_print_errors(bio_err); - goto err; - } - if (do_client && !(done & C_DONE)) { - if (c_write) { - j = (cw_num > bufsiz) ? (int)bufsiz : (int)cw_num; - i = BIO_write(c_bio, cbuf, j); - if (i < 0) { - c_r = 0; - c_w = 0; - if (BIO_should_retry(c_bio)) { - if (BIO_should_read(c_bio)) - c_r = 1; - if (BIO_should_write(c_bio)) - c_w = 1; - } else { - fprintf(stderr, "ERROR in CLIENT\n"); - ERR_print_errors(bio_err); - goto err; - } - } else if (i == 0) { - fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); - goto err; - } else { - if (debug) - printf("client wrote %d\n", i); - /* ok */ - s_r = 1; - c_write = 0; - cw_num -= i; - if (max_frag > 1029) - SSL_set_max_send_fragment(c_ssl, max_frag -= 5); - } - } else { - i = BIO_read(c_bio, cbuf, bufsiz); - if (i < 0) { - c_r = 0; - c_w = 0; - if (BIO_should_retry(c_bio)) { - if (BIO_should_read(c_bio)) - c_r = 1; - if (BIO_should_write(c_bio)) - c_w = 1; - } else { - fprintf(stderr, "ERROR in CLIENT\n"); - ERR_print_errors(bio_err); - goto err; - } - } else if (i == 0) { - fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); - goto err; - } else { - if (debug) - printf("client read %d\n", i); - cr_num -= i; - if (sw_num > 0) { - s_write = 1; - s_w = 1; - } - if (cr_num <= 0) { - s_write = 1; - s_w = 1; - done = S_DONE | C_DONE; - } - } - } - } - - if (do_server && !(done & S_DONE)) { - if (!s_write) { - i = BIO_read(s_bio, sbuf, bufsiz); - if (i < 0) { - s_r = 0; - s_w = 0; - if (BIO_should_retry(s_bio)) { - if (BIO_should_read(s_bio)) - s_r = 1; - if (BIO_should_write(s_bio)) - s_w = 1; - } else { - fprintf(stderr, "ERROR in SERVER\n"); - ERR_print_errors(bio_err); - goto err; - } - } else if (i == 0) { - ERR_print_errors(bio_err); - fprintf(stderr, - "SSL SERVER STARTUP FAILED in SSL_read\n"); - goto err; - } else { - if (debug) - printf("server read %d\n", i); - sr_num -= i; - if (cw_num > 0) { - c_write = 1; - c_w = 1; - } - if (sr_num <= 0) { - s_write = 1; - s_w = 1; - c_write = 0; - } - } - } else { - j = (sw_num > bufsiz) ? (int)bufsiz : (int)sw_num; - i = BIO_write(s_bio, sbuf, j); - if (i < 0) { - s_r = 0; - s_w = 0; - if (BIO_should_retry(s_bio)) { - if (BIO_should_read(s_bio)) - s_r = 1; - if (BIO_should_write(s_bio)) - s_w = 1; - } else { - fprintf(stderr, "ERROR in SERVER\n"); - ERR_print_errors(bio_err); - goto err; - } - } else if (i == 0) { - ERR_print_errors(bio_err); - fprintf(stderr, - "SSL SERVER STARTUP FAILED in SSL_write\n"); - goto err; - } else { - if (debug) - printf("server wrote %d\n", i); - sw_num -= i; - s_write = 0; - c_r = 1; - if (sw_num <= 0) - done |= S_DONE; - if (max_frag > 1029) - SSL_set_max_send_fragment(s_ssl, max_frag -= 5); - } - } - } - - if ((done & S_DONE) && (done & C_DONE)) - break; - } - - if (verbose) - print_details(c_ssl, "DONE: "); -#ifndef OPENSSL_NO_NEXTPROTONEG - if (verify_npn(c_ssl, s_ssl) < 0) { - ret = 1; - goto err; - } -#endif - if (verify_serverinfo() < 0) { - fprintf(stderr, "Server info verify error\n"); - ret = 1; - goto err; - } - if (custom_ext_error) { - fprintf(stderr, "Custom extension error\n"); - ret = 1; - goto err; - } - ret = 0; - err: - /* - * We have to set the BIO's to NULL otherwise they will be - * OPENSSL_free()ed twice. Once when th s_ssl is SSL_free()ed and again - * when c_ssl is SSL_free()ed. This is a hack required because s_ssl and - * c_ssl are sharing the same BIO structure and SSL_set_bio() and - * SSL_free() automatically BIO_free non NULL entries. You should not - * normally do this or be required to do this - */ - if (s_ssl != NULL) { - s_ssl->rbio = NULL; - s_ssl->wbio = NULL; - } - if (c_ssl != NULL) { - c_ssl->rbio = NULL; - c_ssl->wbio = NULL; - } - - BIO_free(c_to_s); - BIO_free(s_to_c); - BIO_free_all(c_bio); - BIO_free_all(s_bio); - - if (cbuf) - OPENSSL_free(cbuf); - if (sbuf) - OPENSSL_free(sbuf); - - return (ret); -} - -static int get_proxy_auth_ex_data_idx(void) -{ - static volatile int idx = -1; - if (idx < 0) { - CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); - if (idx < 0) { - idx = X509_STORE_CTX_get_ex_new_index(0, - "SSLtest for verify callback", - NULL, NULL, NULL); - } - CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); - } - return idx; -} - -static int verify_callback(int ok, X509_STORE_CTX *ctx) -{ - char *s, buf[256]; - - s = X509_NAME_oneline(X509_get_subject_name(ctx->current_cert), buf, - sizeof buf); - if (s != NULL) { - if (ok) - fprintf(stderr, "depth=%d %s\n", ctx->error_depth, buf); - else { - fprintf(stderr, "depth=%d error=%d %s\n", - ctx->error_depth, ctx->error, buf); - } - } - - if (ok == 0) { - fprintf(stderr, "Error string: %s\n", - X509_verify_cert_error_string(ctx->error)); - switch (ctx->error) { - case X509_V_ERR_CERT_NOT_YET_VALID: - case X509_V_ERR_CERT_HAS_EXPIRED: - case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: - fprintf(stderr, " ... ignored.\n"); - ok = 1; - } - } - - if (ok == 1) { - X509 *xs = ctx->current_cert; - if (xs->ex_flags & EXFLAG_PROXY) { - unsigned int *letters = X509_STORE_CTX_get_ex_data(ctx, - get_proxy_auth_ex_data_idx - ()); - - if (letters) { - int found_any = 0; - int i; - PROXY_CERT_INFO_EXTENSION *pci = - X509_get_ext_d2i(xs, NID_proxyCertInfo, - NULL, NULL); - - switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage)) { - case NID_Independent: - /* - * Completely meaningless in this program, as there's no - * way to grant explicit rights to a specific PrC. - * Basically, using id-ppl-Independent is the perfect way - * to grant no rights at all. - */ - fprintf(stderr, " Independent proxy certificate"); - for (i = 0; i < 26; i++) - letters[i] = 0; - break; - case NID_id_ppl_inheritAll: - /* - * This is basically a NOP, we simply let the current - * rights stand as they are. - */ - fprintf(stderr, " Proxy certificate inherits all"); - break; - default: - s = (char *) - pci->proxyPolicy->policy->data; - i = pci->proxyPolicy->policy->length; - - /* - * The algorithm works as follows: it is assumed that - * previous iterations or the initial granted rights has - * already set some elements of `letters'. What we need - * to do is to clear those that weren't granted by the - * current PrC as well. The easiest way to do this is to - * add 1 to all the elements whose letters are given with - * the current policy. That way, all elements that are - * set by the current policy and were already set by - * earlier policies and through the original grant of - * rights will get the value 2 or higher. The last thing - * to do is to sweep through `letters' and keep the - * elements having the value 2 as set, and clear all the - * others. - */ - - fprintf(stderr, " Certificate proxy rights = %*.*s", i, - i, s); - while (i-- > 0) { - int c = *s++; - if (isascii(c) && isalpha(c)) { - if (islower(c)) - c = toupper(c); - letters[c - 'A']++; - } - } - for (i = 0; i < 26; i++) - if (letters[i] < 2) - letters[i] = 0; - else - letters[i] = 1; - } - - found_any = 0; - fprintf(stderr, ", resulting proxy rights = "); - for (i = 0; i < 26; i++) - if (letters[i]) { - fprintf(stderr, "%c", i + 'A'); - found_any = 1; - } - if (!found_any) - fprintf(stderr, "none"); - fprintf(stderr, "\n"); - - PROXY_CERT_INFO_EXTENSION_free(pci); - } - } - } - - return (ok); -} - -static void process_proxy_debug(int indent, const char *format, ...) -{ - /* That's 80 > */ - static const char indentation[] = - ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>" - ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; - char my_format[256]; - va_list args; - - BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s", - indent, indent, indentation, format); - - va_start(args, format); - vfprintf(stderr, my_format, args); - va_end(args); -} - -/*- - * Priority levels: - * 0 [!]var, () - * 1 & ^ - * 2 | - */ -static int process_proxy_cond_adders(unsigned int letters[26], - const char *cond, const char **cond_end, - int *pos, int indent); -static int process_proxy_cond_val(unsigned int letters[26], const char *cond, - const char **cond_end, int *pos, int indent) -{ - int c; - int ok = 1; - int negate = 0; - - while (isspace((int)*cond)) { - cond++; - (*pos)++; - } - c = *cond; - - if (debug) - process_proxy_debug(indent, - "Start process_proxy_cond_val at position %d: %s\n", - *pos, cond); - - while (c == '!') { - negate = !negate; - cond++; - (*pos)++; - while (isspace((int)*cond)) { - cond++; - (*pos)++; - } - c = *cond; - } - - if (c == '(') { - cond++; - (*pos)++; - ok = process_proxy_cond_adders(letters, cond, cond_end, pos, - indent + 1); - cond = *cond_end; - if (ok < 0) - goto end; - while (isspace((int)*cond)) { - cond++; - (*pos)++; - } - c = *cond; - if (c != ')') { - fprintf(stderr, - "Weird condition character in position %d: " - "%c\n", *pos, c); - ok = -1; - goto end; - } - cond++; - (*pos)++; - } else if (isascii(c) && isalpha(c)) { - if (islower(c)) - c = toupper(c); - ok = letters[c - 'A']; - cond++; - (*pos)++; - } else { - fprintf(stderr, - "Weird condition character in position %d: " "%c\n", *pos, c); - ok = -1; - goto end; - } - end: - *cond_end = cond; - if (ok >= 0 && negate) - ok = !ok; - - if (debug) - process_proxy_debug(indent, - "End process_proxy_cond_val at position %d: %s, returning %d\n", - *pos, cond, ok); - - return ok; -} - -static int process_proxy_cond_multipliers(unsigned int letters[26], - const char *cond, - const char **cond_end, int *pos, - int indent) -{ - int ok; - char c; - - if (debug) - process_proxy_debug(indent, - "Start process_proxy_cond_multipliers at position %d: %s\n", - *pos, cond); - - ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1); - cond = *cond_end; - if (ok < 0) - goto end; - - while (ok >= 0) { - while (isspace((int)*cond)) { - cond++; - (*pos)++; - } - c = *cond; - - switch (c) { - case '&': - case '^': - { - int save_ok = ok; - - cond++; - (*pos)++; - ok = process_proxy_cond_val(letters, - cond, cond_end, pos, indent + 1); - cond = *cond_end; - if (ok < 0) - break; - - switch (c) { - case '&': - ok &= save_ok; - break; - case '^': - ok ^= save_ok; - break; - default: - fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!" - " STOPPING\n"); - EXIT(1); - } - } - break; - default: - goto end; - } - } - end: - if (debug) - process_proxy_debug(indent, - "End process_proxy_cond_multipliers at position %d: %s, returning %d\n", - *pos, cond, ok); - - *cond_end = cond; - return ok; -} - -static int process_proxy_cond_adders(unsigned int letters[26], - const char *cond, const char **cond_end, - int *pos, int indent) -{ - int ok; - char c; - - if (debug) - process_proxy_debug(indent, - "Start process_proxy_cond_adders at position %d: %s\n", - *pos, cond); - - ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos, - indent + 1); - cond = *cond_end; - if (ok < 0) - goto end; - - while (ok >= 0) { - while (isspace((int)*cond)) { - cond++; - (*pos)++; - } - c = *cond; - - switch (c) { - case '|': - { - int save_ok = ok; - - cond++; - (*pos)++; - ok = process_proxy_cond_multipliers(letters, - cond, cond_end, pos, - indent + 1); - cond = *cond_end; - if (ok < 0) - break; - - switch (c) { - case '|': - ok |= save_ok; - break; - default: - fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!" - " STOPPING\n"); - EXIT(1); - } - } - break; - default: - goto end; - } - } - end: - if (debug) - process_proxy_debug(indent, - "End process_proxy_cond_adders at position %d: %s, returning %d\n", - *pos, cond, ok); - - *cond_end = cond; - return ok; -} - -static int process_proxy_cond(unsigned int letters[26], - const char *cond, const char **cond_end) -{ - int pos = 1; - return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1); -} - -static int app_verify_callback(X509_STORE_CTX *ctx, void *arg) -{ - int ok = 1; - struct app_verify_arg *cb_arg = arg; - unsigned int letters[26]; /* only used with proxy_auth */ - - if (cb_arg->app_verify) { - char *s = NULL, buf[256]; - - fprintf(stderr, "In app_verify_callback, allowing cert. "); - fprintf(stderr, "Arg is: %s\n", cb_arg->string); - fprintf(stderr, - "Finished printing do we have a context? 0x%p a cert? 0x%p\n", - (void *)ctx, (void *)ctx->cert); - if (ctx->cert) - s = X509_NAME_oneline(X509_get_subject_name(ctx->cert), buf, 256); - if (s != NULL) { - fprintf(stderr, "cert depth=%d %s\n", ctx->error_depth, buf); - } - return (1); - } - if (cb_arg->proxy_auth) { - int found_any = 0, i; - char *sp; - - for (i = 0; i < 26; i++) - letters[i] = 0; - for (sp = cb_arg->proxy_auth; *sp; sp++) { - int c = *sp; - if (isascii(c) && isalpha(c)) { - if (islower(c)) - c = toupper(c); - letters[c - 'A'] = 1; - } - } - - fprintf(stderr, " Initial proxy rights = "); - for (i = 0; i < 26; i++) - if (letters[i]) { - fprintf(stderr, "%c", i + 'A'); - found_any = 1; - } - if (!found_any) - fprintf(stderr, "none"); - fprintf(stderr, "\n"); - - X509_STORE_CTX_set_ex_data(ctx, - get_proxy_auth_ex_data_idx(), letters); - } - if (cb_arg->allow_proxy_certs) { - X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS); - } - ok = X509_verify_cert(ctx); - - if (cb_arg->proxy_auth) { - if (ok > 0) { - const char *cond_end = NULL; - - ok = process_proxy_cond(letters, cb_arg->proxy_cond, &cond_end); - - if (ok < 0) - EXIT(3); - if (*cond_end) { - fprintf(stderr, - "Stopped processing condition before it's end.\n"); - ok = 0; - } - if (!ok) - fprintf(stderr, - "Proxy rights check with condition '%s' proved invalid\n", - cb_arg->proxy_cond); - else - fprintf(stderr, - "Proxy rights check with condition '%s' proved valid\n", - cb_arg->proxy_cond); - } - } - return (ok); -} - -#ifndef OPENSSL_NO_RSA -static RSA *rsa_tmp = NULL; - -static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength) -{ - BIGNUM *bn = NULL; - if (rsa_tmp == NULL) { - bn = BN_new(); - rsa_tmp = RSA_new(); - if (!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4)) { - BIO_printf(bio_err, "Memory error..."); - goto end; - } - BIO_printf(bio_err, "Generating temp (%d bit) RSA key...", keylength); - (void)BIO_flush(bio_err); - if (!RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) { - BIO_printf(bio_err, "Error generating key."); - RSA_free(rsa_tmp); - rsa_tmp = NULL; - } - end: - BIO_printf(bio_err, "\n"); - (void)BIO_flush(bio_err); - } - if (bn) - BN_free(bn); - return (rsa_tmp); -} - -static void free_tmp_rsa(void) -{ - RSA_free(rsa_tmp); - rsa_tmp = NULL; -} -#endif - -#ifndef OPENSSL_NO_DH -/*- - * These DH parameters have been generated as follows: - * $ openssl dhparam -C -noout 512 - * $ openssl dhparam -C -noout 1024 - * $ openssl dhparam -C -noout -dsaparam 1024 - * (The third function has been renamed to avoid name conflicts.) - */ -static DH *get_dh512() -{ - static unsigned char dh512_p[] = { - 0xCB, 0xC8, 0xE1, 0x86, 0xD0, 0x1F, 0x94, 0x17, 0xA6, 0x99, 0xF0, - 0xC6, - 0x1F, 0x0D, 0xAC, 0xB6, 0x25, 0x3E, 0x06, 0x39, 0xCA, 0x72, 0x04, - 0xB0, - 0x6E, 0xDA, 0xC0, 0x61, 0xE6, 0x7A, 0x77, 0x25, 0xE8, 0x3B, 0xB9, - 0x5F, - 0x9A, 0xB6, 0xB5, 0xFE, 0x99, 0x0B, 0xA1, 0x93, 0x4E, 0x35, 0x33, - 0xB8, - 0xE1, 0xF1, 0x13, 0x4F, 0x59, 0x1A, 0xD2, 0x57, 0xC0, 0x26, 0x21, - 0x33, - 0x02, 0xC5, 0xAE, 0x23, - }; - static unsigned char dh512_g[] = { - 0x02, - }; - DH *dh; - - if ((dh = DH_new()) == NULL) - return (NULL); - dh->p = BN_bin2bn(dh512_p, sizeof(dh512_p), NULL); - dh->g = BN_bin2bn(dh512_g, sizeof(dh512_g), NULL); - if ((dh->p == NULL) || (dh->g == NULL)) { - DH_free(dh); - return (NULL); - } - return (dh); -} - -static DH *get_dh1024() -{ - static unsigned char dh1024_p[] = { - 0xF8, 0x81, 0x89, 0x7D, 0x14, 0x24, 0xC5, 0xD1, 0xE6, 0xF7, 0xBF, - 0x3A, - 0xE4, 0x90, 0xF4, 0xFC, 0x73, 0xFB, 0x34, 0xB5, 0xFA, 0x4C, 0x56, - 0xA2, - 0xEA, 0xA7, 0xE9, 0xC0, 0xC0, 0xCE, 0x89, 0xE1, 0xFA, 0x63, 0x3F, - 0xB0, - 0x6B, 0x32, 0x66, 0xF1, 0xD1, 0x7B, 0xB0, 0x00, 0x8F, 0xCA, 0x87, - 0xC2, - 0xAE, 0x98, 0x89, 0x26, 0x17, 0xC2, 0x05, 0xD2, 0xEC, 0x08, 0xD0, - 0x8C, - 0xFF, 0x17, 0x52, 0x8C, 0xC5, 0x07, 0x93, 0x03, 0xB1, 0xF6, 0x2F, - 0xB8, - 0x1C, 0x52, 0x47, 0x27, 0x1B, 0xDB, 0xD1, 0x8D, 0x9D, 0x69, 0x1D, - 0x52, - 0x4B, 0x32, 0x81, 0xAA, 0x7F, 0x00, 0xC8, 0xDC, 0xE6, 0xD9, 0xCC, - 0xC1, - 0x11, 0x2D, 0x37, 0x34, 0x6C, 0xEA, 0x02, 0x97, 0x4B, 0x0E, 0xBB, - 0xB1, - 0x71, 0x33, 0x09, 0x15, 0xFD, 0xDD, 0x23, 0x87, 0x07, 0x5E, 0x89, - 0xAB, - 0x6B, 0x7C, 0x5F, 0xEC, 0xA6, 0x24, 0xDC, 0x53, - }; - static unsigned char dh1024_g[] = { - 0x02, - }; - DH *dh; - - if ((dh = DH_new()) == NULL) - return (NULL); - dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL); - dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL); - if ((dh->p == NULL) || (dh->g == NULL)) { - DH_free(dh); - return (NULL); - } - return (dh); -} - -static DH *get_dh1024dsa() -{ - static unsigned char dh1024_p[] = { - 0xC8, 0x00, 0xF7, 0x08, 0x07, 0x89, 0x4D, 0x90, 0x53, 0xF3, 0xD5, - 0x00, - 0x21, 0x1B, 0xF7, 0x31, 0xA6, 0xA2, 0xDA, 0x23, 0x9A, 0xC7, 0x87, - 0x19, - 0x3B, 0x47, 0xB6, 0x8C, 0x04, 0x6F, 0xFF, 0xC6, 0x9B, 0xB8, 0x65, - 0xD2, - 0xC2, 0x5F, 0x31, 0x83, 0x4A, 0xA7, 0x5F, 0x2F, 0x88, 0x38, 0xB6, - 0x55, - 0xCF, 0xD9, 0x87, 0x6D, 0x6F, 0x9F, 0xDA, 0xAC, 0xA6, 0x48, 0xAF, - 0xFC, - 0x33, 0x84, 0x37, 0x5B, 0x82, 0x4A, 0x31, 0x5D, 0xE7, 0xBD, 0x52, - 0x97, - 0xA1, 0x77, 0xBF, 0x10, 0x9E, 0x37, 0xEA, 0x64, 0xFA, 0xCA, 0x28, - 0x8D, - 0x9D, 0x3B, 0xD2, 0x6E, 0x09, 0x5C, 0x68, 0xC7, 0x45, 0x90, 0xFD, - 0xBB, - 0x70, 0xC9, 0x3A, 0xBB, 0xDF, 0xD4, 0x21, 0x0F, 0xC4, 0x6A, 0x3C, - 0xF6, - 0x61, 0xCF, 0x3F, 0xD6, 0x13, 0xF1, 0x5F, 0xBC, 0xCF, 0xBC, 0x26, - 0x9E, - 0xBC, 0x0B, 0xBD, 0xAB, 0x5D, 0xC9, 0x54, 0x39, - }; - static unsigned char dh1024_g[] = { - 0x3B, 0x40, 0x86, 0xE7, 0xF3, 0x6C, 0xDE, 0x67, 0x1C, 0xCC, 0x80, - 0x05, - 0x5A, 0xDF, 0xFE, 0xBD, 0x20, 0x27, 0x74, 0x6C, 0x24, 0xC9, 0x03, - 0xF3, - 0xE1, 0x8D, 0xC3, 0x7D, 0x98, 0x27, 0x40, 0x08, 0xB8, 0x8C, 0x6A, - 0xE9, - 0xBB, 0x1A, 0x3A, 0xD6, 0x86, 0x83, 0x5E, 0x72, 0x41, 0xCE, 0x85, - 0x3C, - 0xD2, 0xB3, 0xFC, 0x13, 0xCE, 0x37, 0x81, 0x9E, 0x4C, 0x1C, 0x7B, - 0x65, - 0xD3, 0xE6, 0xA6, 0x00, 0xF5, 0x5A, 0x95, 0x43, 0x5E, 0x81, 0xCF, - 0x60, - 0xA2, 0x23, 0xFC, 0x36, 0xA7, 0x5D, 0x7A, 0x4C, 0x06, 0x91, 0x6E, - 0xF6, - 0x57, 0xEE, 0x36, 0xCB, 0x06, 0xEA, 0xF5, 0x3D, 0x95, 0x49, 0xCB, - 0xA7, - 0xDD, 0x81, 0xDF, 0x80, 0x09, 0x4A, 0x97, 0x4D, 0xA8, 0x22, 0x72, - 0xA1, - 0x7F, 0xC4, 0x70, 0x56, 0x70, 0xE8, 0x20, 0x10, 0x18, 0x8F, 0x2E, - 0x60, - 0x07, 0xE7, 0x68, 0x1A, 0x82, 0x5D, 0x32, 0xA2, - }; - DH *dh; - - if ((dh = DH_new()) == NULL) - return (NULL); - dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL); - dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL); - if ((dh->p == NULL) || (dh->g == NULL)) { - DH_free(dh); - return (NULL); - } - dh->length = 160; - return (dh); -} -#endif - -#ifndef OPENSSL_NO_PSK -/* convert the PSK key (psk_key) in ascii to binary (psk) */ -static int psk_key2bn(const char *pskkey, unsigned char *psk, - unsigned int max_psk_len) -{ - int ret; - BIGNUM *bn = NULL; - - ret = BN_hex2bn(&bn, pskkey); - if (!ret) { - BIO_printf(bio_err, "Could not convert PSK key '%s' to BIGNUM\n", - pskkey); - if (bn) - BN_free(bn); - return 0; - } - if (BN_num_bytes(bn) > (int)max_psk_len) { - BIO_printf(bio_err, - "psk buffer of callback is too small (%d) for key (%d)\n", - max_psk_len, BN_num_bytes(bn)); - BN_free(bn); - return 0; - } - ret = BN_bn2bin(bn, psk); - BN_free(bn); - return ret; -} - -static unsigned int psk_client_callback(SSL *ssl, const char *hint, - char *identity, - unsigned int max_identity_len, - unsigned char *psk, - unsigned int max_psk_len) -{ - int ret; - unsigned int psk_len = 0; - - ret = BIO_snprintf(identity, max_identity_len, "Client_identity"); - if (ret < 0) - goto out_err; - if (debug) - fprintf(stderr, "client: created identity '%s' len=%d\n", identity, - ret); - ret = psk_key2bn(psk_key, psk, max_psk_len); - if (ret < 0) - goto out_err; - psk_len = ret; - out_err: - return psk_len; -} - -static unsigned int psk_server_callback(SSL *ssl, const char *identity, - unsigned char *psk, - unsigned int max_psk_len) -{ - unsigned int psk_len = 0; - - if (strcmp(identity, "Client_identity") != 0) { - BIO_printf(bio_err, "server: PSK error: client identity not found\n"); - return 0; - } - psk_len = psk_key2bn(psk_key, psk, max_psk_len); - return psk_len; -} -#endif - -static int do_test_cipherlist(void) -{ - int i = 0; - const SSL_METHOD *meth; - const SSL_CIPHER *ci, *tci = NULL; - -#ifndef OPENSSL_NO_SSL3 - fprintf(stderr, "testing SSLv3 cipher list order: "); - meth = SSLv3_method(); - tci = NULL; - while ((ci = meth->get_cipher(i++)) != NULL) { - if (tci != NULL) - if (ci->id >= tci->id) { - fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id); - return 0; - } - tci = ci; - } - fprintf(stderr, "ok\n"); -#endif - fprintf(stderr, "testing TLSv1 cipher list order: "); - meth = TLSv1_method(); - tci = NULL; - while ((ci = meth->get_cipher(i++)) != NULL) { - if (tci != NULL) - if (ci->id >= tci->id) { - fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id); - return 0; - } - tci = ci; - } - fprintf(stderr, "ok\n"); - - return 1; -} diff --git a/ssl/tls1.h b/ssl/tls1.h deleted file mode 100644 index e1beaf3bbd..0000000000 --- a/ssl/tls1.h +++ /dev/null @@ -1,848 +0,0 @@ -/* ssl/tls1.h */ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * - */ -/* ==================================================================== - * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. - * - * Portions of the attached software ("Contribution") are developed by - * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. - * - * The Contribution is licensed pursuant to the OpenSSL open source - * license provided above. - * - * ECC cipher suite support in OpenSSL originally written by - * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories. - * - */ -/* ==================================================================== - * Copyright 2005 Nokia. All rights reserved. - * - * The portions of the attached software ("Contribution") is developed by - * Nokia Corporation and is licensed pursuant to the OpenSSL open source - * license. - * - * The Contribution, originally written by Mika Kousa and Pasi Eronen of - * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites - * support (see RFC 4279) to OpenSSL. - * - * No patent licenses or other rights except those expressly stated in - * the OpenSSL open source license shall be deemed granted or received - * expressly, by implication, estoppel, or otherwise. - * - * No assurances are provided by Nokia that the Contribution does not - * infringe the patent or other intellectual property rights of any third - * party or that the license provides you with all the necessary rights - * to make use of the Contribution. - * - * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN - * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA - * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY - * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR - * OTHERWISE. - */ - -#ifndef HEADER_TLS1_H -# define HEADER_TLS1_H - -# include <openssl/buffer.h> - -#ifdef __cplusplus -extern "C" { -#endif - -/* Default security level if not overriden at config time */ -# ifndef OPENSSL_TLS_SECURITY_LEVEL -# define OPENSSL_TLS_SECURITY_LEVEL 1 -# endif - -# define TLS1_VERSION 0x0301 -# define TLS1_1_VERSION 0x0302 -# define TLS1_2_VERSION 0x0303 -# define TLS_MAX_VERSION TLS1_2_VERSION - -# define TLS1_VERSION_MAJOR 0x03 -# define TLS1_VERSION_MINOR 0x01 - -# define TLS1_1_VERSION_MAJOR 0x03 -# define TLS1_1_VERSION_MINOR 0x02 - -# define TLS1_2_VERSION_MAJOR 0x03 -# define TLS1_2_VERSION_MINOR 0x03 - -# define TLS1_get_version(s) \ - ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0) - -# define TLS1_get_client_version(s) \ - ((s->client_version >> 8) == TLS1_VERSION_MAJOR ? s->client_version : 0) - -# define TLS1_AD_DECRYPTION_FAILED 21 -# define TLS1_AD_RECORD_OVERFLOW 22 -# define TLS1_AD_UNKNOWN_CA 48/* fatal */ -# define TLS1_AD_ACCESS_DENIED 49/* fatal */ -# define TLS1_AD_DECODE_ERROR 50/* fatal */ -# define TLS1_AD_DECRYPT_ERROR 51 -# define TLS1_AD_EXPORT_RESTRICTION 60/* fatal */ -# define TLS1_AD_PROTOCOL_VERSION 70/* fatal */ -# define TLS1_AD_INSUFFICIENT_SECURITY 71/* fatal */ -# define TLS1_AD_INTERNAL_ERROR 80/* fatal */ -# define TLS1_AD_INAPPROPRIATE_FALLBACK 86/* fatal */ -# define TLS1_AD_USER_CANCELLED 90 -# define TLS1_AD_NO_RENEGOTIATION 100 -/* codes 110-114 are from RFC3546 */ -# define TLS1_AD_UNSUPPORTED_EXTENSION 110 -# define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111 -# define TLS1_AD_UNRECOGNIZED_NAME 112 -# define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 -# define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114 -# define TLS1_AD_UNKNOWN_PSK_IDENTITY 115/* fatal */ - -/* ExtensionType values from RFC3546 / RFC4366 / RFC6066 */ -# define TLSEXT_TYPE_server_name 0 -# define TLSEXT_TYPE_max_fragment_length 1 -# define TLSEXT_TYPE_client_certificate_url 2 -# define TLSEXT_TYPE_trusted_ca_keys 3 -# define TLSEXT_TYPE_truncated_hmac 4 -# define TLSEXT_TYPE_status_request 5 -/* ExtensionType values from RFC4681 */ -# define TLSEXT_TYPE_user_mapping 6 -/* ExtensionType values from RFC5878 */ -# define TLSEXT_TYPE_client_authz 7 -# define TLSEXT_TYPE_server_authz 8 -/* ExtensionType values from RFC6091 */ -# define TLSEXT_TYPE_cert_type 9 - -/* ExtensionType values from RFC4492 */ -# define TLSEXT_TYPE_elliptic_curves 10 -# define TLSEXT_TYPE_ec_point_formats 11 - -/* ExtensionType value from RFC5054 */ -# define TLSEXT_TYPE_srp 12 - -/* ExtensionType values from RFC5246 */ -# define TLSEXT_TYPE_signature_algorithms 13 - -/* ExtensionType value from RFC5764 */ -# define TLSEXT_TYPE_use_srtp 14 - -/* ExtensionType value from RFC5620 */ -# define TLSEXT_TYPE_heartbeat 15 - -/* ExtensionType value from draft-ietf-tls-applayerprotoneg-00 */ -# define TLSEXT_TYPE_application_layer_protocol_negotiation 16 - -/* - * ExtensionType value for TLS padding extension. - * http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml - * http://tools.ietf.org/html/draft-agl-tls-padding-03 - */ -# define TLSEXT_TYPE_padding 21 -/* - * Extension type for Encrypt-then-MAC - * http://www.ietf.org/id/draft-ietf-tls-encrypt-then-mac-02.txt - */ -# define TLSEXT_TYPE_encrypt_then_mac 22 -/* - * Extended master secret extension. - * http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml - * https://tools.ietf.org/id/draft-ietf-tls-session-hash-03.txt - */ -# define TLSEXT_TYPE_extended_master_secret 23 - -/* ExtensionType value from RFC4507 */ -# define TLSEXT_TYPE_session_ticket 35 - -/* Temporary extension type */ -# define TLSEXT_TYPE_renegotiate 0xff01 - -# ifndef OPENSSL_NO_NEXTPROTONEG -/* This is not an IANA defined extension number */ -# define TLSEXT_TYPE_next_proto_neg 13172 -# endif - -/* NameType value from RFC 3546 */ -# define TLSEXT_NAMETYPE_host_name 0 -/* status request value from RFC 3546 */ -# define TLSEXT_STATUSTYPE_ocsp 1 - -/* ECPointFormat values from draft-ietf-tls-ecc-12 */ -# define TLSEXT_ECPOINTFORMAT_first 0 -# define TLSEXT_ECPOINTFORMAT_uncompressed 0 -# define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime 1 -# define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2 2 -# define TLSEXT_ECPOINTFORMAT_last 2 - -/* Signature and hash algorithms from RFC 5246 */ - -# define TLSEXT_signature_anonymous 0 -# define TLSEXT_signature_rsa 1 -# define TLSEXT_signature_dsa 2 -# define TLSEXT_signature_ecdsa 3 - -/* Total number of different signature algorithms */ -# define TLSEXT_signature_num 4 - -# define TLSEXT_hash_none 0 -# define TLSEXT_hash_md5 1 -# define TLSEXT_hash_sha1 2 -# define TLSEXT_hash_sha224 3 -# define TLSEXT_hash_sha256 4 -# define TLSEXT_hash_sha384 5 -# define TLSEXT_hash_sha512 6 - -/* Total number of different digest algorithms */ - -# define TLSEXT_hash_num 7 - -/* Flag set for unrecognised algorithms */ -# define TLSEXT_nid_unknown 0x1000000 - -/* ECC curves */ - -# define TLSEXT_curve_P_256 23 -# define TLSEXT_curve_P_384 24 - -# ifndef OPENSSL_NO_TLSEXT - -# define TLSEXT_MAXLEN_host_name 255 - -__owur const char *SSL_get_servername(const SSL *s, const int type); -__owur int SSL_get_servername_type(const SSL *s); -/* - * SSL_export_keying_material exports a value derived from the master secret, - * as specified in RFC 5705. It writes |olen| bytes to |out| given a label and - * optional context. (Since a zero length context is allowed, the |use_context| - * flag controls whether a context is included.) It returns 1 on success and - * zero otherwise. - */ -__owur int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, - const char *label, size_t llen, - const unsigned char *p, size_t plen, - int use_context); - -int SSL_get_sigalgs(SSL *s, int idx, - int *psign, int *phash, int *psignandhash, - unsigned char *rsig, unsigned char *rhash); - -int SSL_get_shared_sigalgs(SSL *s, int idx, - int *psign, int *phash, int *psignandhash, - unsigned char *rsig, unsigned char *rhash); - -__owur int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain); - -# define SSL_set_tlsext_host_name(s,name) \ -SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,(char *)name) - -# define SSL_set_tlsext_debug_callback(ssl, cb) \ -SSL_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_CB,(void (*)(void))cb) - -# define SSL_set_tlsext_debug_arg(ssl, arg) \ -SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_ARG,0, (void *)arg) - -# define SSL_set_tlsext_status_type(ssl, type) \ -SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE,type, NULL) - -# define SSL_get_tlsext_status_exts(ssl, arg) \ -SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg) - -# define SSL_set_tlsext_status_exts(ssl, arg) \ -SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg) - -# define SSL_get_tlsext_status_ids(ssl, arg) \ -SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg) - -# define SSL_set_tlsext_status_ids(ssl, arg) \ -SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg) - -# define SSL_get_tlsext_status_ocsp_resp(ssl, arg) \ -SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP,0, (void *)arg) - -# define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \ -SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen, (void *)arg) - -# define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \ -SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,(void (*)(void))cb) - -# define SSL_TLSEXT_ERR_OK 0 -# define SSL_TLSEXT_ERR_ALERT_WARNING 1 -# define SSL_TLSEXT_ERR_ALERT_FATAL 2 -# define SSL_TLSEXT_ERR_NOACK 3 - -# define SSL_CTX_set_tlsext_servername_arg(ctx, arg) \ -SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG,0, (void *)arg) - -# define SSL_CTX_get_tlsext_ticket_keys(ctx, keys, keylen) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_GET_TLSEXT_TICKET_KEYS,(keylen),(keys)) -# define SSL_CTX_set_tlsext_ticket_keys(ctx, keys, keylen) \ - SSL_CTX_ctrl((ctx),SSL_CTRL_SET_TLSEXT_TICKET_KEYS,(keylen),(keys)) - -# define SSL_CTX_set_tlsext_status_cb(ssl, cb) \ -SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB,(void (*)(void))cb) - -# define SSL_CTX_set_tlsext_status_arg(ssl, arg) \ -SSL_CTX_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG,0, (void *)arg) - -# define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \ -SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb) - -# ifndef OPENSSL_NO_HEARTBEATS -# define SSL_TLSEXT_HB_ENABLED 0x01 -# define SSL_TLSEXT_HB_DONT_SEND_REQUESTS 0x02 -# define SSL_TLSEXT_HB_DONT_RECV_REQUESTS 0x04 - -# define SSL_get_tlsext_heartbeat_pending(ssl) \ - SSL_ctrl((ssl),SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING,0,NULL) -# define SSL_set_tlsext_heartbeat_no_requests(ssl, arg) \ - SSL_ctrl((ssl),SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS,arg,NULL) -# endif -# endif - -/* PSK ciphersuites from 4279 */ -# define TLS1_CK_PSK_WITH_RC4_128_SHA 0x0300008A -# define TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA 0x0300008B -# define TLS1_CK_PSK_WITH_AES_128_CBC_SHA 0x0300008C -# define TLS1_CK_PSK_WITH_AES_256_CBC_SHA 0x0300008D - -/* AES ciphersuites from RFC3268 */ - -# define TLS1_CK_RSA_WITH_AES_128_SHA 0x0300002F -# define TLS1_CK_DH_DSS_WITH_AES_128_SHA 0x03000030 -# define TLS1_CK_DH_RSA_WITH_AES_128_SHA 0x03000031 -# define TLS1_CK_DHE_DSS_WITH_AES_128_SHA 0x03000032 -# define TLS1_CK_DHE_RSA_WITH_AES_128_SHA 0x03000033 -# define TLS1_CK_ADH_WITH_AES_128_SHA 0x03000034 - -# define TLS1_CK_RSA_WITH_AES_256_SHA 0x03000035 -# define TLS1_CK_DH_DSS_WITH_AES_256_SHA 0x03000036 -# define TLS1_CK_DH_RSA_WITH_AES_256_SHA 0x03000037 -# define TLS1_CK_DHE_DSS_WITH_AES_256_SHA 0x03000038 -# define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039 -# define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A - -/* TLS v1.2 ciphersuites */ -# define TLS1_CK_RSA_WITH_NULL_SHA256 0x0300003B -# define TLS1_CK_RSA_WITH_AES_128_SHA256 0x0300003C -# define TLS1_CK_RSA_WITH_AES_256_SHA256 0x0300003D -# define TLS1_CK_DH_DSS_WITH_AES_128_SHA256 0x0300003E -# define TLS1_CK_DH_RSA_WITH_AES_128_SHA256 0x0300003F -# define TLS1_CK_DHE_DSS_WITH_AES_128_SHA256 0x03000040 - -/* Camellia ciphersuites from RFC4132 */ -# define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000041 -# define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000042 -# define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000043 -# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000044 -# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000045 -# define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA 0x03000046 - -/* TLS v1.2 ciphersuites */ -# define TLS1_CK_DHE_RSA_WITH_AES_128_SHA256 0x03000067 -# define TLS1_CK_DH_DSS_WITH_AES_256_SHA256 0x03000068 -# define TLS1_CK_DH_RSA_WITH_AES_256_SHA256 0x03000069 -# define TLS1_CK_DHE_DSS_WITH_AES_256_SHA256 0x0300006A -# define TLS1_CK_DHE_RSA_WITH_AES_256_SHA256 0x0300006B -# define TLS1_CK_ADH_WITH_AES_128_SHA256 0x0300006C -# define TLS1_CK_ADH_WITH_AES_256_SHA256 0x0300006D - -/* Camellia ciphersuites from RFC4132 */ -# define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000084 -# define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000085 -# define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000086 -# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000087 -# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000088 -# define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA 0x03000089 - -/* SEED ciphersuites from RFC4162 */ -# define TLS1_CK_RSA_WITH_SEED_SHA 0x03000096 -# define TLS1_CK_DH_DSS_WITH_SEED_SHA 0x03000097 -# define TLS1_CK_DH_RSA_WITH_SEED_SHA 0x03000098 -# define TLS1_CK_DHE_DSS_WITH_SEED_SHA 0x03000099 -# define TLS1_CK_DHE_RSA_WITH_SEED_SHA 0x0300009A -# define TLS1_CK_ADH_WITH_SEED_SHA 0x0300009B - -/* TLS v1.2 GCM ciphersuites from RFC5288 */ -# define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 0x0300009C -# define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 0x0300009D -# define TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 0x0300009E -# define TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384 0x0300009F -# define TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256 0x030000A0 -# define TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384 0x030000A1 -# define TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256 0x030000A2 -# define TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384 0x030000A3 -# define TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256 0x030000A4 -# define TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384 0x030000A5 -# define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256 0x030000A6 -# define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384 0x030000A7 - -/* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */ -# define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x030000BA -# define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 0x030000BB -# define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x030000BC -# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 0x030000BD -# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x030000BE -# define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256 0x030000BF - -# define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C0 -# define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 0x030000C1 -# define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C2 -# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 0x030000C3 -# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C4 -# define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256 0x030000C5 - -/* - * ECC ciphersuites from draft-ietf-tls-ecc-12.txt with changes soon to be in - * draft 13 - */ -# define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA 0x0300C001 -# define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA 0x0300C002 -# define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C003 -# define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0x0300C004 -# define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0x0300C005 - -# define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA 0x0300C006 -# define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA 0x0300C007 -# define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C008 -# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0x0300C009 -# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0x0300C00A - -# define TLS1_CK_ECDH_RSA_WITH_NULL_SHA 0x0300C00B -# define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA 0x0300C00C -# define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA 0x0300C00D -# define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA 0x0300C00E -# define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA 0x0300C00F - -# define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA 0x0300C010 -# define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA 0x0300C011 -# define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA 0x0300C012 -# define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA 0x0300C013 -# define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA 0x0300C014 - -# define TLS1_CK_ECDH_anon_WITH_NULL_SHA 0x0300C015 -# define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA 0x0300C016 -# define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA 0x0300C017 -# define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA 0x0300C018 -# define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA 0x0300C019 - -/* SRP ciphersuites from RFC 5054 */ -# define TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA 0x0300C01A -# define TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA 0x0300C01B -# define TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA 0x0300C01C -# define TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA 0x0300C01D -# define TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA 0x0300C01E -# define TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA 0x0300C01F -# define TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA 0x0300C020 -# define TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA 0x0300C021 -# define TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA 0x0300C022 - -/* ECDH HMAC based ciphersuites from RFC5289 */ - -# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 0x0300C023 -# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384 0x0300C024 -# define TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256 0x0300C025 -# define TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384 0x0300C026 -# define TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 0x0300C027 -# define TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384 0x0300C028 -# define TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256 0x0300C029 -# define TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384 0x0300C02A - -/* ECDH GCM based ciphersuites from RFC5289 */ -# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02B -# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02C -# define TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02D -# define TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02E -# define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0x0300C02F -# define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0x0300C030 -# define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031 -# define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032 - -/* Camellia-CBC ciphersuites from RFC6367 */ -# define TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0x0300C072 -# define TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0x0300C073 -# define TLS1_CK_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0x0300C074 -# define TLS1_CK_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0x0300C075 -# define TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x0300C076 -# define TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0x0300C077 -# define TLS1_CK_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x0300C078 -# define TLS1_CK_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0x0300C079 - -/* - * XXX Backward compatibility alert: Older versions of OpenSSL gave some DHE - * ciphers names with "EDH" instead of "DHE". Going forward, we should be - * using DHE everywhere, though we may indefinitely maintain aliases for - * users or configurations that used "EDH" - */ -# define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 "EXP1024-RC4-MD5" -# define TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 "EXP1024-RC2-CBC-MD5" -# define TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DES-CBC-SHA" -# define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DHE-DSS-DES-CBC-SHA" -# define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA "EXP1024-RC4-SHA" -# define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA "EXP1024-DHE-DSS-RC4-SHA" -# define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA "DHE-DSS-RC4-SHA" - -/* AES ciphersuites from RFC3268 */ -# define TLS1_TXT_RSA_WITH_AES_128_SHA "AES128-SHA" -# define TLS1_TXT_DH_DSS_WITH_AES_128_SHA "DH-DSS-AES128-SHA" -# define TLS1_TXT_DH_RSA_WITH_AES_128_SHA "DH-RSA-AES128-SHA" -# define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA "DHE-DSS-AES128-SHA" -# define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA "DHE-RSA-AES128-SHA" -# define TLS1_TXT_ADH_WITH_AES_128_SHA "ADH-AES128-SHA" - -# define TLS1_TXT_RSA_WITH_AES_256_SHA "AES256-SHA" -# define TLS1_TXT_DH_DSS_WITH_AES_256_SHA "DH-DSS-AES256-SHA" -# define TLS1_TXT_DH_RSA_WITH_AES_256_SHA "DH-RSA-AES256-SHA" -# define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA "DHE-DSS-AES256-SHA" -# define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA "DHE-RSA-AES256-SHA" -# define TLS1_TXT_ADH_WITH_AES_256_SHA "ADH-AES256-SHA" - -/* ECC ciphersuites from draft-ietf-tls-ecc-01.txt (Mar 15, 2001) */ -# define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA "ECDH-ECDSA-NULL-SHA" -# define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA "ECDH-ECDSA-RC4-SHA" -# define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA "ECDH-ECDSA-DES-CBC3-SHA" -# define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA "ECDH-ECDSA-AES128-SHA" -# define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA "ECDH-ECDSA-AES256-SHA" - -# define TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA "ECDHE-ECDSA-NULL-SHA" -# define TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA "ECDHE-ECDSA-RC4-SHA" -# define TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA "ECDHE-ECDSA-DES-CBC3-SHA" -# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA "ECDHE-ECDSA-AES128-SHA" -# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA "ECDHE-ECDSA-AES256-SHA" - -# define TLS1_TXT_ECDH_RSA_WITH_NULL_SHA "ECDH-RSA-NULL-SHA" -# define TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA "ECDH-RSA-RC4-SHA" -# define TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA "ECDH-RSA-DES-CBC3-SHA" -# define TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA "ECDH-RSA-AES128-SHA" -# define TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA "ECDH-RSA-AES256-SHA" - -# define TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA "ECDHE-RSA-NULL-SHA" -# define TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA "ECDHE-RSA-RC4-SHA" -# define TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA "ECDHE-RSA-DES-CBC3-SHA" -# define TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA "ECDHE-RSA-AES128-SHA" -# define TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA "ECDHE-RSA-AES256-SHA" - -# define TLS1_TXT_ECDH_anon_WITH_NULL_SHA "AECDH-NULL-SHA" -# define TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA "AECDH-RC4-SHA" -# define TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA "AECDH-DES-CBC3-SHA" -# define TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA "AECDH-AES128-SHA" -# define TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA "AECDH-AES256-SHA" - -/* PSK ciphersuites from RFC 4279 */ -# define TLS1_TXT_PSK_WITH_RC4_128_SHA "PSK-RC4-SHA" -# define TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA "PSK-3DES-EDE-CBC-SHA" -# define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA "PSK-AES128-CBC-SHA" -# define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA "PSK-AES256-CBC-SHA" - -/* SRP ciphersuite from RFC 5054 */ -# define TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA "SRP-3DES-EDE-CBC-SHA" -# define TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA "SRP-RSA-3DES-EDE-CBC-SHA" -# define TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA "SRP-DSS-3DES-EDE-CBC-SHA" -# define TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA "SRP-AES-128-CBC-SHA" -# define TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA "SRP-RSA-AES-128-CBC-SHA" -# define TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA "SRP-DSS-AES-128-CBC-SHA" -# define TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA "SRP-AES-256-CBC-SHA" -# define TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA "SRP-RSA-AES-256-CBC-SHA" -# define TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA "SRP-DSS-AES-256-CBC-SHA" - -/* Camellia ciphersuites from RFC4132 */ -# define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA "CAMELLIA128-SHA" -# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA "DH-DSS-CAMELLIA128-SHA" -# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA "DH-RSA-CAMELLIA128-SHA" -# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA "DHE-DSS-CAMELLIA128-SHA" -# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA "DHE-RSA-CAMELLIA128-SHA" -# define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA "ADH-CAMELLIA128-SHA" - -# define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA "CAMELLIA256-SHA" -# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA "DH-DSS-CAMELLIA256-SHA" -# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA "DH-RSA-CAMELLIA256-SHA" -# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA "DHE-DSS-CAMELLIA256-SHA" -# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA "DHE-RSA-CAMELLIA256-SHA" -# define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA "ADH-CAMELLIA256-SHA" - -/* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */ -# define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256 "CAMELLIA128-SHA256" -# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 "DH-DSS-CAMELLIA128-SHA256" -# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 "DH-RSA-CAMELLIA128-SHA256" -# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 "DHE-DSS-CAMELLIA128-SHA256" -# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 "DHE-RSA-CAMELLIA128-SHA256" -# define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256 "ADH-CAMELLIA128-SHA256" - -# define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256 "CAMELLIA256-SHA256" -# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 "DH-DSS-CAMELLIA256-SHA256" -# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 "DH-RSA-CAMELLIA256-SHA256" -# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 "DHE-DSS-CAMELLIA256-SHA256" -# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 "DHE-RSA-CAMELLIA256-SHA256" -# define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256 "ADH-CAMELLIA256-SHA256" - -/* SEED ciphersuites from RFC4162 */ -# define TLS1_TXT_RSA_WITH_SEED_SHA "SEED-SHA" -# define TLS1_TXT_DH_DSS_WITH_SEED_SHA "DH-DSS-SEED-SHA" -# define TLS1_TXT_DH_RSA_WITH_SEED_SHA "DH-RSA-SEED-SHA" -# define TLS1_TXT_DHE_DSS_WITH_SEED_SHA "DHE-DSS-SEED-SHA" -# define TLS1_TXT_DHE_RSA_WITH_SEED_SHA "DHE-RSA-SEED-SHA" -# define TLS1_TXT_ADH_WITH_SEED_SHA "ADH-SEED-SHA" - -/* TLS v1.2 ciphersuites */ -# define TLS1_TXT_RSA_WITH_NULL_SHA256 "NULL-SHA256" -# define TLS1_TXT_RSA_WITH_AES_128_SHA256 "AES128-SHA256" -# define TLS1_TXT_RSA_WITH_AES_256_SHA256 "AES256-SHA256" -# define TLS1_TXT_DH_DSS_WITH_AES_128_SHA256 "DH-DSS-AES128-SHA256" -# define TLS1_TXT_DH_RSA_WITH_AES_128_SHA256 "DH-RSA-AES128-SHA256" -# define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256 "DHE-DSS-AES128-SHA256" -# define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256 "DHE-RSA-AES128-SHA256" -# define TLS1_TXT_DH_DSS_WITH_AES_256_SHA256 "DH-DSS-AES256-SHA256" -# define TLS1_TXT_DH_RSA_WITH_AES_256_SHA256 "DH-RSA-AES256-SHA256" -# define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256 "DHE-DSS-AES256-SHA256" -# define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256 "DHE-RSA-AES256-SHA256" -# define TLS1_TXT_ADH_WITH_AES_128_SHA256 "ADH-AES128-SHA256" -# define TLS1_TXT_ADH_WITH_AES_256_SHA256 "ADH-AES256-SHA256" - -/* TLS v1.2 GCM ciphersuites from RFC5288 */ -# define TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256 "AES128-GCM-SHA256" -# define TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384 "AES256-GCM-SHA384" -# define TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256 "DHE-RSA-AES128-GCM-SHA256" -# define TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384 "DHE-RSA-AES256-GCM-SHA384" -# define TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256 "DH-RSA-AES128-GCM-SHA256" -# define TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384 "DH-RSA-AES256-GCM-SHA384" -# define TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256 "DHE-DSS-AES128-GCM-SHA256" -# define TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384 "DHE-DSS-AES256-GCM-SHA384" -# define TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256 "DH-DSS-AES128-GCM-SHA256" -# define TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384 "DH-DSS-AES256-GCM-SHA384" -# define TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256 "ADH-AES128-GCM-SHA256" -# define TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384 "ADH-AES256-GCM-SHA384" - -/* ECDH HMAC based ciphersuites from RFC5289 */ - -# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256 "ECDHE-ECDSA-AES128-SHA256" -# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384 "ECDHE-ECDSA-AES256-SHA384" -# define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256 "ECDH-ECDSA-AES128-SHA256" -# define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384 "ECDH-ECDSA-AES256-SHA384" -# define TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 "ECDHE-RSA-AES128-SHA256" -# define TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384 "ECDHE-RSA-AES256-SHA384" -# define TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256 "ECDH-RSA-AES128-SHA256" -# define TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384 "ECDH-RSA-AES256-SHA384" - -/* ECDH GCM based ciphersuites from RFC5289 */ -# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 "ECDHE-ECDSA-AES128-GCM-SHA256" -# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 "ECDHE-ECDSA-AES256-GCM-SHA384" -# define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 "ECDH-ECDSA-AES128-GCM-SHA256" -# define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 "ECDH-ECDSA-AES256-GCM-SHA384" -# define TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 "ECDHE-RSA-AES128-GCM-SHA256" -# define TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384 "ECDHE-RSA-AES256-GCM-SHA384" -# define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256" -# define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384" - -/* Camellia-CBC ciphersuites from RFC6367 */ -# define TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 "ECDHE-ECDSA-CAMELLIA128-SHA256" -# define TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 "ECDHE-ECDSA-CAMELLIA256-SHA384" -# define TLS1_TXT_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 "ECDH-ECDSA-CAMELLIA128-SHA256" -# define TLS1_TXT_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 "ECDH-ECDSA-CAMELLIA256-SHA384" -# define TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 "ECDHE-RSA-CAMELLIA128-SHA256" -# define TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 "ECDHE-RSA-CAMELLIA256-SHA384" -# define TLS1_TXT_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 "ECDH-RSA-CAMELLIA128-SHA256" -# define TLS1_TXT_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 "ECDH-RSA-CAMELLIA256-SHA384" - -# define TLS_CT_RSA_SIGN 1 -# define TLS_CT_DSS_SIGN 2 -# define TLS_CT_RSA_FIXED_DH 3 -# define TLS_CT_DSS_FIXED_DH 4 -# define TLS_CT_ECDSA_SIGN 64 -# define TLS_CT_RSA_FIXED_ECDH 65 -# define TLS_CT_ECDSA_FIXED_ECDH 66 -# define TLS_CT_GOST94_SIGN 21 -# define TLS_CT_GOST01_SIGN 22 -/* - * when correcting this number, correct also SSL3_CT_NUMBER in ssl3.h (see - * comment there) - */ -# define TLS_CT_NUMBER 9 - -# define TLS1_FINISH_MAC_LENGTH 12 - -# define TLS_MD_MAX_CONST_SIZE 22 -# define TLS_MD_CLIENT_FINISH_CONST "client finished" -# define TLS_MD_CLIENT_FINISH_CONST_SIZE 15 -# define TLS_MD_SERVER_FINISH_CONST "server finished" -# define TLS_MD_SERVER_FINISH_CONST_SIZE 15 -# define TLS_MD_KEY_EXPANSION_CONST "key expansion" -# define TLS_MD_KEY_EXPANSION_CONST_SIZE 13 -# define TLS_MD_CLIENT_WRITE_KEY_CONST "client write key" -# define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16 -# define TLS_MD_SERVER_WRITE_KEY_CONST "server write key" -# define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16 -# define TLS_MD_IV_BLOCK_CONST "IV block" -# define TLS_MD_IV_BLOCK_CONST_SIZE 8 -# define TLS_MD_MASTER_SECRET_CONST "master secret" -# define TLS_MD_MASTER_SECRET_CONST_SIZE 13 -# define TLS_MD_EXTENDED_MASTER_SECRET_CONST "extended master secret" -# define TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE 22 - -# ifdef CHARSET_EBCDIC -# undef TLS_MD_CLIENT_FINISH_CONST -/* - * client finished - */ -# define TLS_MD_CLIENT_FINISH_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x66\x69\x6e\x69\x73\x68\x65\x64" - -# undef TLS_MD_SERVER_FINISH_CONST -/* - * server finished - */ -# define TLS_MD_SERVER_FINISH_CONST "\x73\x65\x72\x76\x65\x72\x20\x66\x69\x6e\x69\x73\x68\x65\x64" - -# undef TLS_MD_SERVER_WRITE_KEY_CONST -/* - * server write key - */ -# define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" - -# undef TLS_MD_KEY_EXPANSION_CONST -/* - * key expansion - */ -# define TLS_MD_KEY_EXPANSION_CONST "\x6b\x65\x79\x20\x65\x78\x70\x61\x6e\x73\x69\x6f\x6e" - -# undef TLS_MD_CLIENT_WRITE_KEY_CONST -/* - * client write key - */ -# define TLS_MD_CLIENT_WRITE_KEY_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" - -# undef TLS_MD_SERVER_WRITE_KEY_CONST -/* - * server write key - */ -# define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" - -# undef TLS_MD_IV_BLOCK_CONST -/* - * IV block - */ -# define TLS_MD_IV_BLOCK_CONST "\x49\x56\x20\x62\x6c\x6f\x63\x6b" - -# undef TLS_MD_MASTER_SECRET_CONST -/* - * master secret - */ -# define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" -# undef TLS_MD_EXTENDED_MASTER_SECRET_CONST -/* - * extended master secret - */ -# define TLS_MD_EXTENDED_MASTER_SECRET_CONST "\x65\x78\x74\x65\x63\x64\x65\x64\x20\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" -# endif - -/* TLS Session Ticket extension struct */ -struct tls_session_ticket_ext_st { - unsigned short length; - void *data; -}; - -#ifdef __cplusplus -} -#endif -#endif |