1 ssl.h

     1 /* ssl/ssl.h */

     2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     3  * All rights reserved.

     4  *

     5  * This package is an SSL implementation written

     6  * by Eric Young (eay@cryptsoft.com).

     7  * The implementation was written so as to conform with Netscapes SSL.

     8  * 

     9  * This library is free for commercial and non-commercial use as long as

    10  * the following conditions are aheared to.  The following conditions

    11  * apply to all code found in this distribution, be it the RC4, RSA,

    12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    13  * included with this distribution is covered by the same copyright terms

    14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    15  * 

    16  * Copyright remains Eric Young's, and as such any Copyright notices in

    17  * the code are not to be removed.

    18  * If this package is used in a product, Eric Young should be given attribution

    19  * as the author of the parts of the library used.

    20  * This can be in the form of a textual message at program startup or

    21  * in documentation (online or textual) provided with the package.

    22  * 

    23  * Redistribution and use in source and binary forms, with or without

    24  * modification, are permitted provided that the following conditions

    25  * are met:

    26  * 1. Redistributions of source code must retain the copyright

    27  *    notice, this list of conditions and the following disclaimer.

    28  * 2. Redistributions in binary form must reproduce the above copyright

    29  *    notice, this list of conditions and the following disclaimer in the

    30  *    documentation and/or other materials provided with the distribution.

    31  * 3. All advertising materials mentioning features or use of this software

    32  *    must display the following acknowledgement:

    33  *    "This product includes cryptographic software written by

    34  *     Eric Young (eay@cryptsoft.com)"

    35  *    The word 'cryptographic' can be left out if the rouines from the library

    36  *    being used are not cryptographic related :-).

    37  * 4. If you include any Windows specific code (or a derivative thereof) from 

    38  *    the apps directory (application code) you must include an acknowledgement:

    39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    40  * 

    41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    51  * SUCH DAMAGE.

    52  * 

    53  * The licence and distribution terms for any publically available version or

    54  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    55  * copied and put under another distribution licence

    56  * [including the GNU Public Licence.]

    57  */

    58 /* ====================================================================

    59  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.

    60  *

    61  * Redistribution and use in source and binary forms, with or without

    62  * modification, are permitted provided that the following conditions

    63  * are met:

    64  *

    65  * 1. Redistributions of source code must retain the above copyright

    66  *    notice, this list of conditions and the following disclaimer. 

    67  *

    68  * 2. Redistributions in binary form must reproduce the above copyright

    69  *    notice, this list of conditions and the following disclaimer in

    70  *    the documentation and/or other materials provided with the

    71  *    distribution.

    72  *

    73  * 3. All advertising materials mentioning features or use of this

    74  *    software must display the following acknowledgment:

    75  *    "This product includes software developed by the OpenSSL Project

    76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

    77  *

    78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

    79  *    endorse or promote products derived from this software without

    80  *    prior written permission. For written permission, please contact

    81  *    openssl-core@openssl.org.

    82  *

    83  * 5. Products derived from this software may not be called "OpenSSL"

    84  *    nor may "OpenSSL" appear in their names without prior written

    85  *    permission of the OpenSSL Project.

    86  *

    87  * 6. Redistributions of any form whatsoever must retain the following

    88  *    acknowledgment:

    89  *    "This product includes software developed by the OpenSSL Project

    90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

    91  *

    92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

    93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

    95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

    96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

    97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

    98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

    99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   103  * OF THE POSSIBILITY OF SUCH DAMAGE.

   104  * ====================================================================

   105  *

   106  * This product includes cryptographic software written by Eric Young

   107  * (eay@cryptsoft.com).  This product includes software written by Tim

   108  * Hudson (tjh@cryptsoft.com).

   109  *

   110  */

   111 /* ====================================================================

   112  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.

   113  *

   114  * Redistribution and use in source and binary forms, with or without

   115  * modification, are permitted provided that the following conditions

   116  * are met:

   117  *

   118  * 1. Redistributions of source code must retain the above copyright

   119  *    notice, this list of conditions and the following disclaimer. 

   120  *

   121  * 2. Redistributions in binary form must reproduce the above copyright

   122  *    notice, this list of conditions and the following disclaimer in

   123  *    the documentation and/or other materials provided with the

   124  *    distribution.

   125  *

   126  * 3. All advertising materials mentioning features or use of this

   127  *    software must display the following acknowledgment:

   128  *    "This product includes software developed by the OpenSSL Project

   129  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

   130  *

   131  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

   132  *    endorse or promote products derived from this software without

   133  *    prior written permission. For written permission, please contact

   134  *    openssl-core@openssl.org.

   135  *

   136  * 5. Products derived from this software may not be called "OpenSSL"

   137  *    nor may "OpenSSL" appear in their names without prior written

   138  *    permission of the OpenSSL Project.

   139  *

   140  * 6. Redistributions of any form whatsoever must retain the following

   141  *    acknowledgment:

   142  *    "This product includes software developed by the OpenSSL Project

   143  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

   144  *

   145  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

   146  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

   147  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

   148  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

   149  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

   150  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

   151  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

   152  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   153  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   154  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   155  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   156  * OF THE POSSIBILITY OF SUCH DAMAGE.

   157  * ====================================================================

   158  *

   159  * This product includes cryptographic software written by Eric Young

   160  * (eay@cryptsoft.com).  This product includes software written by Tim

   161  * Hudson (tjh@cryptsoft.com).

   162  *

   163  */

   164 /* ====================================================================

   165  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.

   166  * ECC cipher suite support in OpenSSL originally developed by 

   167  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.

   168  */

   169 

   170 #ifndef HEADER_SSL_H 

   171 #define HEADER_SSL_H 

   172 

   173 #if (defined(__SYMBIAN32__) && !defined(SYMBIAN))

   174 #define SYMBIAN

   175 #endif

   176 

   177 #include <openssl/e_os2.h>

   178 

   179 #ifndef OPENSSL_NO_COMP

   180 #include <openssl/comp.h>

   181 #endif

   182 #ifndef OPENSSL_NO_BIO

   183 #include <openssl/bio.h>

   184 #endif

   185 #ifndef OPENSSL_NO_DEPRECATED

   186 #ifndef OPENSSL_NO_X509

   187 #include <openssl/x509.h>

   188 #endif

   189 #include <openssl/crypto.h>

   190 #include <openssl/lhash.h>

   191 #include <openssl/buffer.h>

   192 #endif

   193 #include <openssl/pem.h>

   194 

   195 #include <openssl/kssl.h>

   196 #include <openssl/safestack.h>

   197 #include <openssl/symhacks.h>

   198 

   199 #ifdef  __cplusplus

   200 extern "C" {

   201 #endif

   202 

   203 /* SSLeay version number for ASN.1 encoding of the session information */

   204 /* Version 0 - initial version

   205  * Version 1 - added the optional peer certificate

   206  */

   207 #define SSL_SESSION_ASN1_VERSION 0x0001

   208 

   209 /* text strings for the ciphers */

   210 #define SSL_TXT_NULL_WITH_MD5		SSL2_TXT_NULL_WITH_MD5			

   211 #define SSL_TXT_RC4_128_WITH_MD5	SSL2_TXT_RC4_128_WITH_MD5		

   212 #define SSL_TXT_RC4_128_EXPORT40_WITH_MD5 SSL2_TXT_RC4_128_EXPORT40_WITH_MD5	

   213 #define SSL_TXT_RC2_128_CBC_WITH_MD5	SSL2_TXT_RC2_128_CBC_WITH_MD5		

   214 #define SSL_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5	

   215 #define SSL_TXT_IDEA_128_CBC_WITH_MD5	SSL2_TXT_IDEA_128_CBC_WITH_MD5		

   216 #define SSL_TXT_DES_64_CBC_WITH_MD5	SSL2_TXT_DES_64_CBC_WITH_MD5		

   217 #define SSL_TXT_DES_64_CBC_WITH_SHA	SSL2_TXT_DES_64_CBC_WITH_SHA		

   218 #define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5	

   219 #define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA	

   220 

   221 /*    VRS Additional Kerberos5 entries

   222  */

   223 #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA

   224 #define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA

   225 #define SSL_TXT_KRB5_RC4_128_SHA      SSL3_TXT_KRB5_RC4_128_SHA

   226 #define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA

   227 #define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5       

   228 #define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5       

   229 #define SSL_TXT_KRB5_RC4_128_MD5      SSL3_TXT_KRB5_RC4_128_MD5

   230 #define SSL_TXT_KRB5_IDEA_128_CBC_MD5 SSL3_TXT_KRB5_IDEA_128_CBC_MD5 

   231 

   232 #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA 

   233 #define SSL_TXT_KRB5_RC2_40_CBC_SHA   SSL3_TXT_KRB5_RC2_40_CBC_SHA 

   234 #define SSL_TXT_KRB5_RC4_40_SHA	      SSL3_TXT_KRB5_RC4_40_SHA

   235 #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5 

   236 #define SSL_TXT_KRB5_RC2_40_CBC_MD5   SSL3_TXT_KRB5_RC2_40_CBC_MD5 

   237 #define SSL_TXT_KRB5_RC4_40_MD5	      SSL3_TXT_KRB5_RC4_40_MD5

   238 

   239 #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA

   240 #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5

   241 #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA

   242 #define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5

   243 #define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA

   244 #define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5

   245 #define SSL_MAX_KRB5_PRINCIPAL_LENGTH  256

   246 

   247 #define SSL_MAX_SSL_SESSION_ID_LENGTH		32

   248 #define SSL_MAX_SID_CTX_LENGTH			32

   249 

   250 #define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES	(512/8)

   251 #define SSL_MAX_KEY_ARG_LENGTH			8

   252 #define SSL_MAX_MASTER_KEY_LENGTH		48

   253 

   254 /* These are used to specify which ciphers to use and not to use */

   255 #define SSL_TXT_LOW		"LOW"

   256 #define SSL_TXT_MEDIUM		"MEDIUM"

   257 #define SSL_TXT_HIGH		"HIGH"

   258 #define SSL_TXT_kFZA		"kFZA"

   259 #define	SSL_TXT_aFZA		"aFZA"

   260 #define SSL_TXT_eFZA		"eFZA"

   261 #define SSL_TXT_FZA		"FZA"

   262 

   263 #define	SSL_TXT_aNULL		"aNULL"

   264 #define	SSL_TXT_eNULL		"eNULL"

   265 #define	SSL_TXT_NULL		"NULL"

   266 

   267 #define SSL_TXT_kKRB5     	"kKRB5"

   268 #define SSL_TXT_aKRB5     	"aKRB5"

   269 #define SSL_TXT_KRB5      	"KRB5"

   270 

   271 #define SSL_TXT_kRSA		"kRSA"

   272 #define SSL_TXT_kDHr		"kDHr"

   273 #define SSL_TXT_kDHd		"kDHd"

   274 #define SSL_TXT_kEDH		"kEDH"

   275 #define	SSL_TXT_aRSA		"aRSA"

   276 #define	SSL_TXT_aDSS		"aDSS"

   277 #define	SSL_TXT_aDH		"aDH"

   278 #define	SSL_TXT_DSS		"DSS"

   279 #define SSL_TXT_DH		"DH"

   280 #define SSL_TXT_EDH		"EDH"

   281 #define SSL_TXT_ADH		"ADH"

   282 #define SSL_TXT_RSA		"RSA"

   283 #define SSL_TXT_DES		"DES"

   284 #define SSL_TXT_3DES		"3DES"

   285 #define SSL_TXT_RC4		"RC4"

   286 #define SSL_TXT_RC2		"RC2"

   287 #define SSL_TXT_IDEA		"IDEA"

   288 #define SSL_TXT_AES		"AES"

   289 #define SSL_TXT_MD5		"MD5"

   290 #define SSL_TXT_SHA1		"SHA1"

   291 #define SSL_TXT_SHA		"SHA"

   292 #define SSL_TXT_EXP		"EXP"

   293 #define SSL_TXT_EXPORT		"EXPORT"

   294 #define SSL_TXT_EXP40		"EXPORT40"

   295 #define SSL_TXT_EXP56		"EXPORT56"

   296 #define SSL_TXT_SSLV2		"SSLv2"

   297 #define SSL_TXT_SSLV3		"SSLv3"

   298 #define SSL_TXT_TLSV1		"TLSv1"

   299 #define SSL_TXT_ALL		"ALL"

   300 #define SSL_TXT_ECC		"ECCdraft" /* ECC ciphersuites are not yet official */

   301 

   302 /*

   303  * COMPLEMENTOF* definitions. These identifiers are used to (de-select)

   304  * ciphers normally not being used.

   305  * Example: "RC4" will activate all ciphers using RC4 including ciphers

   306  * without authentication, which would normally disabled by DEFAULT (due

   307  * the "!ADH" being part of default). Therefore "RC4:!COMPLEMENTOFDEFAULT"

   308  * will make sure that it is also disabled in the specific selection.

   309  * COMPLEMENTOF* identifiers are portable between version, as adjustments

   310  * to the default cipher setup will also be included here.

   311  *

   312  * COMPLEMENTOFDEFAULT does not experience the same special treatment that

   313  * DEFAULT gets, as only selection is being done and no sorting as needed

   314  * for DEFAULT.

   315  */

   316 #define SSL_TXT_CMPALL		"COMPLEMENTOFALL"

   317 #define SSL_TXT_CMPDEF		"COMPLEMENTOFDEFAULT"

   318 

   319 /* The following cipher list is used by default.

   320  * It also is substituted when an application-defined cipher list string

   321  * starts with 'DEFAULT'. */

   322 #define SSL_DEFAULT_CIPHER_LIST	"AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" /* low priority for RC4 */

   323 

   324 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */

   325 #define SSL_SENT_SHUTDOWN	1

   326 #define SSL_RECEIVED_SHUTDOWN	2

   327 

   328 #ifdef __cplusplus

   329 }

   330 #endif

   331 

   332 #ifdef  __cplusplus

   333 extern "C" {

   334 #endif

   335 

   336 #if (defined(OPENSSL_NO_RSA) || defined(OPENSSL_NO_MD5)) && !defined(OPENSSL_NO_SSL2)

   337 #define OPENSSL_NO_SSL2

   338 #endif

   339 

   340 #define SSL_FILETYPE_ASN1	X509_FILETYPE_ASN1

   341 #define SSL_FILETYPE_PEM	X509_FILETYPE_PEM

   342 

   343 /* This is needed to stop compilers complaining about the

   344  * 'struct ssl_st *' function parameters used to prototype callbacks

   345  * in SSL_CTX. */

   346 typedef struct ssl_st *ssl_crock_st;

   347 

   348 /* used to hold info on the particular ciphers used */

   349 typedef struct ssl_cipher_st

   350 	{

   351 	int valid;

   352 	const char *name;		/* text name */

   353 	unsigned long id;		/* id, 4 bytes, first is version */

   354 	unsigned long algorithms;	/* what ciphers are used */

   355 	unsigned long algo_strength;	/* strength and export flags */

   356 	unsigned long algorithm2;	/* Extra flags */

   357 	int strength_bits;		/* Number of bits really used */

   358 	int alg_bits;			/* Number of bits for algorithm */

   359 	unsigned long mask;		/* used for matching */

   360 	unsigned long mask_strength;	/* also used for matching */

   361 	} SSL_CIPHER;

   362 

   363 DECLARE_STACK_OF(SSL_CIPHER)

   364 

   365 typedef struct ssl_st SSL;

   366 typedef struct ssl_ctx_st SSL_CTX;

   367 

   368 /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */

   369 typedef struct ssl_method_st

   370 	{

   371 	int version;

   372 	int (*ssl_new)(SSL *s);

   373 	void (*ssl_clear)(SSL *s);

   374 	void (*ssl_free)(SSL *s);

   375 	int (*ssl_accept)(SSL *s);

   376 	int (*ssl_connect)(SSL *s);

   377 	int (*ssl_read)(SSL *s,void *buf,int len);

   378 	int (*ssl_peek)(SSL *s,void *buf,int len);

   379 	int (*ssl_write)(SSL *s,const void *buf,int len);

   380 	int (*ssl_shutdown)(SSL *s);

   381 	int (*ssl_renegotiate)(SSL *s);

   382 	int (*ssl_renegotiate_check)(SSL *s);

   383 	long (*ssl_get_message)(SSL *s, int st1, int stn, int mt, long

   384 		max, int *ok);

   385 	int (*ssl_read_bytes)(SSL *s, int type, unsigned char *buf, int len, 

   386 		int peek);

   387 	int (*ssl_write_bytes)(SSL *s, int type, const void *buf_, int len);

   388 	int (*ssl_dispatch_alert)(SSL *s);

   389 	long (*ssl_ctrl)(SSL *s,int cmd,long larg,void *parg);

   390 	long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,void *parg);

   391 	SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);

   392 	int (*put_cipher_by_char)(const SSL_CIPHER *cipher,unsigned char *ptr);

   393 	int (*ssl_pending)(const SSL *s);

   394 	int (*num_ciphers)(void);

   395 	SSL_CIPHER *(*get_cipher)(unsigned ncipher);

   396 	struct ssl_method_st *(*get_ssl_method)(int version);

   397 	long (*get_timeout)(void);

   398 	struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */

   399 	int (*ssl_version)(void);

   400 	long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)(void));

   401 	long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)(void));

   402 	} SSL_METHOD;

   403 

   404 /* Lets make this into an ASN.1 type structure as follows

   405  * SSL_SESSION_ID ::= SEQUENCE {

   406  *	version 		INTEGER,	-- structure version number

   407  *	SSLversion 		INTEGER,	-- SSL version number

   408  *	Cipher 			OCTET_STRING,	-- the 3 byte cipher ID

   409  *	Session_ID 		OCTET_STRING,	-- the Session ID

   410  *	Master_key 		OCTET_STRING,	-- the master key

   411  *	KRB5_principal		OCTET_STRING	-- optional Kerberos principal

   412  *	Key_Arg [ 0 ] IMPLICIT	OCTET_STRING,	-- the optional Key argument

   413  *	Time [ 1 ] EXPLICIT	INTEGER,	-- optional Start Time

   414  *	Timeout [ 2 ] EXPLICIT	INTEGER,	-- optional Timeout ins seconds

   415  *	Peer [ 3 ] EXPLICIT	X509,		-- optional Peer Certificate

   416  *	Session_ID_context [ 4 ] EXPLICIT OCTET_STRING,   -- the Session ID context

   417  *	Verify_result [ 5 ] EXPLICIT INTEGER    -- X509_V_... code for `Peer'

   418  *	Compression [6] IMPLICIT ASN1_OBJECT	-- compression OID XXXXX

   419  *	}

   420  * Look in ssl/ssl_asn1.c for more details

   421  * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).

   422  */

   423 typedef struct ssl_session_st

   424 	{

   425 	int ssl_version;	/* what ssl version session info is

   426 				 * being kept in here? */

   427 

   428 	/* only really used in SSLv2 */

   429 	unsigned int key_arg_length;

   430 	unsigned char key_arg[SSL_MAX_KEY_ARG_LENGTH];

   431 	int master_key_length;

   432 	unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];

   433 	/* session_id - valid? */

   434 	unsigned int session_id_length;

   435 	unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];

   436 	/* this is used to determine whether the session is being reused in

   437 	 * the appropriate context. It is up to the application to set this,

   438 	 * via SSL_new */

   439 	unsigned int sid_ctx_length;

   440 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

   441 

   442 #ifndef OPENSSL_NO_KRB5

   443         unsigned int krb5_client_princ_len;

   444         unsigned char krb5_client_princ[SSL_MAX_KRB5_PRINCIPAL_LENGTH];

   445 #endif /* OPENSSL_NO_KRB5 */

   446 

   447 	int not_resumable;

   448 

   449 	/* The cert is the certificate used to establish this connection */

   450 	struct sess_cert_st /* SESS_CERT */ *sess_cert;

   451 

   452 	/* This is the cert for the other end.

   453 	 * On clients, it will be the same as sess_cert->peer_key->x509

   454 	 * (the latter is not enough as sess_cert is not retained

   455 	 * in the external representation of sessions, see ssl_asn1.c). */

   456 	X509 *peer;

   457 	/* when app_verify_callback accepts a session where the peer's certificate

   458 	 * is not ok, we must remember the error for session reuse: */

   459 	long verify_result; /* only for servers */

   460 

   461 	int references;

   462 	long timeout;

   463 	long time;

   464 

   465 	int compress_meth;		/* Need to lookup the method */

   466 

   467 	SSL_CIPHER *cipher;

   468 	unsigned long cipher_id;	/* when ASN.1 loaded, this

   469 					 * needs to be used to load

   470 					 * the 'cipher' structure */

   471 

   472 	STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */

   473 

   474 	CRYPTO_EX_DATA ex_data; /* application specific data */

   475 

   476 	/* These are used to make removal of session-ids more

   477 	 * efficient and to implement a maximum cache size. */

   478 	struct ssl_session_st *prev,*next;

   479 

   480 	} SSL_SESSION;

   481 

   482 

   483 #define SSL_OP_MICROSOFT_SESS_ID_BUG			0x00000001L

   484 #define SSL_OP_NETSCAPE_CHALLENGE_BUG			0x00000002L

   485 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG		0x00000008L

   486 #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG		0x00000010L

   487 #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER		0x00000020L

   488 #define SSL_OP_MSIE_SSLV2_RSA_PADDING			0x00000040L /* no effect since 0.9.7h and 0.9.8b */

   489 #define SSL_OP_SSLEAY_080_CLIENT_DH_BUG			0x00000080L

   490 #define SSL_OP_TLS_D5_BUG				0x00000100L

   491 #define SSL_OP_TLS_BLOCK_PADDING_BUG			0x00000200L

   492 

   493 /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added

   494  * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)

   495  * the workaround is not needed.  Unfortunately some broken SSL/TLS

   496  * implementations cannot handle it at all, which is why we include

   497  * it in SSL_OP_ALL. */

   498 #define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS              0x00000800L /* added in 0.9.6e */

   499 

   500 /* SSL_OP_ALL: various bug workarounds that should be rather harmless.

   501  *             This used to be 0x000FFFFFL before 0.9.7. */

   502 #define SSL_OP_ALL					0x00000FFFL

   503 

   504 /* DTLS options */

   505 #define SSL_OP_NO_QUERY_MTU                 0x00001000L

   506 /* Turn on Cookie Exchange (on relevant for servers) */

   507 #define SSL_OP_COOKIE_EXCHANGE              0x00002000L

   508 /* Don't use RFC4507 ticket extension */

   509 #define SSL_OP_NO_TICKET	            0x00004000L

   510 

   511 /* As server, disallow session resumption on renegotiation */

   512 #define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION	0x00010000L

   513 /* If set, always create a new key when using tmp_ecdh parameters */

   514 #define SSL_OP_SINGLE_ECDH_USE				0x00080000L

   515 /* If set, always create a new key when using tmp_dh parameters */

   516 #define SSL_OP_SINGLE_DH_USE				0x00100000L

   517 /* Set to always use the tmp_rsa key when doing RSA operations,

   518  * even when this violates protocol specs */

   519 #define SSL_OP_EPHEMERAL_RSA				0x00200000L

   520 /* Set on servers to choose the cipher according to the server's

   521  * preferences */

   522 #define SSL_OP_CIPHER_SERVER_PREFERENCE			0x00400000L

   523 /* If set, a server will allow a client to issue a SSLv3.0 version number

   524  * as latest version supported in the premaster secret, even when TLSv1.0

   525  * (version 3.1) was announced in the client hello. Normally this is

   526  * forbidden to prevent version rollback attacks. */

   527 #define SSL_OP_TLS_ROLLBACK_BUG				0x00800000L

   528 

   529 #define SSL_OP_NO_SSLv2					0x01000000L

   530 #define SSL_OP_NO_SSLv3					0x02000000L

   531 #define SSL_OP_NO_TLSv1					0x04000000L

   532 

   533 /* The next flag deliberately changes the ciphertest, this is a check

   534  * for the PKCS#1 attack */

   535 #define SSL_OP_PKCS1_CHECK_1				0x08000000L

   536 #define SSL_OP_PKCS1_CHECK_2				0x10000000L

   537 #define SSL_OP_NETSCAPE_CA_DN_BUG			0x20000000L

   538 #define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG		0x40000000L

   539 

   540 

   541 /* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success

   542  * when just a single record has been written): */

   543 #define SSL_MODE_ENABLE_PARTIAL_WRITE       0x00000001L

   544 /* Make it possible to retry SSL_write() with changed buffer location

   545  * (buffer contents must stay the same!); this is not the default to avoid

   546  * the misconception that non-blocking SSL_write() behaves like

   547  * non-blocking write(): */

   548 #define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L

   549 /* Never bother the application with retries if the transport

   550  * is blocking: */

   551 #define SSL_MODE_AUTO_RETRY 0x00000004L

   552 /* Don't attempt to automatically build certificate chain */

   553 #define SSL_MODE_NO_AUTO_CHAIN 0x00000008L

   554 

   555 

   556 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,

   557  * they cannot be used to clear bits. */

   558 

   559 #define SSL_CTX_set_options(ctx,op) \

   560 	SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)

   561 #define SSL_CTX_get_options(ctx) \

   562 	SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)

   563 #define SSL_set_options(ssl,op) \

   564 	SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)

   565 #define SSL_get_options(ssl) \

   566         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)

   567 

   568 #define SSL_CTX_set_mode(ctx,op) \

   569 	SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)

   570 #define SSL_CTX_get_mode(ctx) \

   571 	SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL)

   572 #define SSL_set_mode(ssl,op) \

   573 	SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)

   574 #define SSL_get_mode(ssl) \

   575         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)

   576 #define SSL_set_mtu(ssl, mtu) \

   577         SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL)

   578 

   579 

   580 IMPORT_C void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));

   581 IMPORT_C void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));

   582 #define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))

   583 #define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))

   584 

   585 

   586 

   587 #if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32)

   588 #define SSL_MAX_CERT_LIST_DEFAULT 1024*30 /* 30k max cert list :-) */

   589 #else

   590 #define SSL_MAX_CERT_LIST_DEFAULT 1024*100 /* 100k max cert list :-) */

   591 #endif

   592 

   593 #define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT	(1024*20)

   594 

   595 /* This callback type is used inside SSL_CTX, SSL, and in the functions that set

   596  * them. It is used to override the generation of SSL/TLS session IDs in a

   597  * server. Return value should be zero on an error, non-zero to proceed. Also,

   598  * callbacks should themselves check if the id they generate is unique otherwise

   599  * the SSL handshake will fail with an error - callbacks can do this using the

   600  * 'ssl' value they're passed by;

   601  *      SSL_has_matching_session_id(ssl, id, *id_len)

   602  * The length value passed in is set at the maximum size the session ID can be.

   603  * In SSLv2 this is 16 bytes, whereas SSLv3/TLSv1 it is 32 bytes. The callback

   604  * can alter this length to be less if desired, but under SSLv2 session IDs are

   605  * supposed to be fixed at 16 bytes so the id will be padded after the callback

   606  * returns in this case. It is also an error for the callback to set the size to

   607  * zero. */

   608 typedef int (*GEN_SESSION_CB)(const SSL *ssl, unsigned char *id,

   609 				unsigned int *id_len);

   610 

   611 typedef struct ssl_comp_st

   612 	{

   613 	int id;

   614 	const char *name;

   615 #ifndef OPENSSL_NO_COMP

   616 	COMP_METHOD *method;

   617 #else

   618 	char *method;

   619 #endif

   620 	} SSL_COMP;

   621 

   622 DECLARE_STACK_OF(SSL_COMP)

   623 

   624 struct ssl_ctx_st

   625 	{

   626 	SSL_METHOD *method;

   627 

   628 	STACK_OF(SSL_CIPHER) *cipher_list;

   629 	/* same as above but sorted for lookup */

   630 	STACK_OF(SSL_CIPHER) *cipher_list_by_id;

   631 

   632 	struct x509_store_st /* X509_STORE */ *cert_store;

   633 	struct lhash_st /* LHASH */ *sessions;	/* a set of SSL_SESSIONs */

   634 	/* Most session-ids that will be cached, default is

   635 	 * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited. */

   636 	unsigned long session_cache_size;

   637 	struct ssl_session_st *session_cache_head;

   638 	struct ssl_session_st *session_cache_tail;

   639 

   640 	/* This can have one of 2 values, ored together,

   641 	 * SSL_SESS_CACHE_CLIENT,

   642 	 * SSL_SESS_CACHE_SERVER,

   643 	 * Default is SSL_SESSION_CACHE_SERVER, which means only

   644 	 * SSL_accept which cache SSL_SESSIONS. */

   645 	int session_cache_mode;

   646 

   647 	/* If timeout is not 0, it is the default timeout value set

   648 	 * when SSL_new() is called.  This has been put in to make

   649 	 * life easier to set things up */

   650 	long session_timeout;

   651 

   652 	/* If this callback is not null, it will be called each

   653 	 * time a session id is added to the cache.  If this function

   654 	 * returns 1, it means that the callback will do a

   655 	 * SSL_SESSION_free() when it has finished using it.  Otherwise,

   656 	 * on 0, it means the callback has finished with it.

   657 	 * If remove_session_cb is not null, it will be called when

   658 	 * a session-id is removed from the cache.  After the call,

   659 	 * OpenSSL will SSL_SESSION_free() it. */

   660 	int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess);

   661 	void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess);

   662 	SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl,

   663 		unsigned char *data,int len,int *copy);

   664 

   665 	struct

   666 		{

   667 		int sess_connect;	/* SSL new conn - started */

   668 		int sess_connect_renegotiate;/* SSL reneg - requested */

   669 		int sess_connect_good;	/* SSL new conne/reneg - finished */

   670 		int sess_accept;	/* SSL new accept - started */

   671 		int sess_accept_renegotiate;/* SSL reneg - requested */

   672 		int sess_accept_good;	/* SSL accept/reneg - finished */

   673 		int sess_miss;		/* session lookup misses  */

   674 		int sess_timeout;	/* reuse attempt on timeouted session */

   675 		int sess_cache_full;	/* session removed due to full cache */

   676 		int sess_hit;		/* session reuse actually done */

   677 		int sess_cb_hit;	/* session-id that was not

   678 					 * in the cache was

   679 					 * passed back via the callback.  This

   680 					 * indicates that the application is

   681 					 * supplying session-id's from other

   682 					 * processes - spooky :-) */

   683 		} stats;

   684 

   685 	int references;

   686 

   687 	/* if defined, these override the X509_verify_cert() calls */

   688 	int (*app_verify_callback)(X509_STORE_CTX *, void *);

   689 	void *app_verify_arg;

   690 	/* before OpenSSL 0.9.7, 'app_verify_arg' was ignored

   691 	 * ('app_verify_callback' was called with just one argument) */

   692 

   693 	/* Default password callback. */

   694 	pem_password_cb *default_passwd_callback;

   695 

   696 	/* Default password callback user data. */

   697 	void *default_passwd_callback_userdata;

   698 

   699 	/* get client cert callback */

   700 	int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);

   701 

   702     /* cookie generate callback */

   703     int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, 

   704         unsigned int *cookie_len);

   705 

   706     /* verify cookie callback */

   707     int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, 

   708         unsigned int cookie_len);

   709 

   710 	CRYPTO_EX_DATA ex_data;

   711 

   712 	const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */

   713 	const EVP_MD *md5;	/* For SSLv3/TLSv1 'ssl3-md5' */

   714 	const EVP_MD *sha1;   /* For SSLv3/TLSv1 'ssl3->sha1' */

   715 

   716 	STACK_OF(X509) *extra_certs;

   717 	STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */

   718 

   719 

   720 	/* Default values used when no per-SSL value is defined follow */

   721 

   722 	void (*info_callback)(const SSL *ssl,int type,int val); /* used if SSL's info_callback is NULL */

   723 

   724 	/* what we put in client cert requests */

   725 	STACK_OF(X509_NAME) *client_CA;

   726 

   727 

   728 	/* Default values to use in SSL structures follow (these are copied by SSL_new) */

   729 

   730 	unsigned long options;

   731 	unsigned long mode;

   732 	long max_cert_list;

   733 

   734 	struct cert_st /* CERT */ *cert;

   735 	int read_ahead;

   736 

   737 	/* callback that allows applications to peek at protocol messages */

   738 	void (*msg_callback)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg);

   739 	void *msg_callback_arg;

   740 

   741 	int verify_mode;

   742 	unsigned int sid_ctx_length;

   743 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

   744 	int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx); /* called 'verify_callback' in the SSL */

   745 

   746 	/* Default generate session ID callback. */

   747 	GEN_SESSION_CB generate_session_id;

   748 

   749 	X509_VERIFY_PARAM *param;

   750 

   751 #if 0

   752 	int purpose;		/* Purpose setting */

   753 	int trust;		/* Trust setting */

   754 #endif

   755 

   756 	int quiet_shutdown;

   757 

   758 

   759 

   760 	};

   761 

   762 #define SSL_SESS_CACHE_OFF			0x0000

   763 #define SSL_SESS_CACHE_CLIENT			0x0001

   764 #define SSL_SESS_CACHE_SERVER			0x0002

   765 #define SSL_SESS_CACHE_BOTH	(SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER)

   766 #define SSL_SESS_CACHE_NO_AUTO_CLEAR		0x0080

   767 /* enough comments already ... see SSL_CTX_set_session_cache_mode(3) */

   768 #define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP	0x0100

   769 #define SSL_SESS_CACHE_NO_INTERNAL_STORE	0x0200

   770 #define SSL_SESS_CACHE_NO_INTERNAL \

   771 	(SSL_SESS_CACHE_NO_INTERNAL_LOOKUP|SSL_SESS_CACHE_NO_INTERNAL_STORE)

   772 

   773 IMPORT_C  struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx);

   774 #define SSL_CTX_sess_number(ctx) \

   775 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL)

   776 #define SSL_CTX_sess_connect(ctx) \

   777 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL)

   778 #define SSL_CTX_sess_connect_good(ctx) \

   779 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL)

   780 #define SSL_CTX_sess_connect_renegotiate(ctx) \

   781 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL)

   782 #define SSL_CTX_sess_accept(ctx) \

   783 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL)

   784 #define SSL_CTX_sess_accept_renegotiate(ctx) \

   785 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL)

   786 #define SSL_CTX_sess_accept_good(ctx) \

   787 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL)

   788 #define SSL_CTX_sess_hits(ctx) \

   789 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL)

   790 #define SSL_CTX_sess_cb_hits(ctx) \

   791 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL)

   792 #define SSL_CTX_sess_misses(ctx) \

   793 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL)

   794 #define SSL_CTX_sess_timeouts(ctx) \

   795 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL)

   796 #define SSL_CTX_sess_cache_full(ctx) \

   797 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL)

   798 

   799 void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess));

   800 int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(struct ssl_st *ssl, SSL_SESSION *sess);

   801 void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess));

   802 void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(struct ssl_ctx_st *ctx, SSL_SESSION *sess);

   803 void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl, unsigned char *data,int len,int *copy));

   804 SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(struct ssl_st *ssl, unsigned char *Data, int len, int *copy);

   805 void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl,int type,int val));

   806 void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val);

   807 void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));

   808 int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);

   809 void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len));

   810 void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len));

   811 

   812 #define SSL_NOTHING	1

   813 #define SSL_WRITING	2

   814 #define SSL_READING	3

   815 #define SSL_X509_LOOKUP	4

   816 

   817 /* These will only be used when doing non-blocking IO */

   818 #define SSL_want_nothing(s)	(SSL_want(s) == SSL_NOTHING)

   819 #define SSL_want_read(s)	(SSL_want(s) == SSL_READING)

   820 #define SSL_want_write(s)	(SSL_want(s) == SSL_WRITING)

   821 #define SSL_want_x509_lookup(s)	(SSL_want(s) == SSL_X509_LOOKUP)

   822 

   823 struct ssl_st

   824 	{

   825 	/* protocol version

   826 	 * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION, DTLS1_VERSION)

   827 	 */

   828 	int version;

   829 	int type; /* SSL_ST_CONNECT or SSL_ST_ACCEPT */

   830 

   831 	SSL_METHOD *method; /* SSLv3 */

   832 

   833 	/* There are 2 BIO's even though they are normally both the

   834 	 * same.  This is so data can be read and written to different

   835 	 * handlers */

   836 

   837 #ifndef OPENSSL_NO_BIO

   838 	BIO *rbio; /* used by SSL_read */

   839 	BIO *wbio; /* used by SSL_write */

   840 	BIO *bbio; /* used during session-id reuse to concatenate

   841 		    * messages */

   842 #else

   843 	char *rbio; /* used by SSL_read */

   844 	char *wbio; /* used by SSL_write */

   845 	char *bbio;

   846 #endif

   847 	/* This holds a variable that indicates what we were doing

   848 	 * when a 0 or -1 is returned.  This is needed for

   849 	 * non-blocking IO so we know what request needs re-doing when

   850 	 * in SSL_accept or SSL_connect */

   851 	int rwstate;

   852 

   853 	/* true when we are actually in SSL_accept() or SSL_connect() */

   854 	int in_handshake;

   855 	int (*handshake_func)(SSL *);

   856 

   857 	/* Imagine that here's a boolean member "init" that is

   858 	 * switched as soon as SSL_set_{accept/connect}_state

   859 	 * is called for the first time, so that "state" and

   860 	 * "handshake_func" are properly initialized.  But as

   861 	 * handshake_func is == 0 until then, we use this

   862 	 * test instead of an "init" member.

   863 	 */

   864 

   865 	int server;	/* are we the server side? - mostly used by SSL_clear*/

   866 

   867 	int new_session;/* 1 if we are to use a new session.

   868 	                 * 2 if we are a server and are inside a handshake

   869 	                 *   (i.e. not just sending a HelloRequest)

   870 	                 * NB: For servers, the 'new' session may actually be a previously

   871 	                 * cached session or even the previous session unless

   872 	                 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */

   873 	int quiet_shutdown;/* don't send shutdown packets */

   874 	int shutdown;	/* we have shut things down, 0x01 sent, 0x02

   875 			 * for received */

   876 	int state;	/* where we are */

   877 	int rstate;	/* where we are when reading */

   878 

   879 	BUF_MEM *init_buf;	/* buffer used during init */

   880 	void *init_msg;   	/* pointer to handshake message body, set by ssl3_get_message() */

   881 	int init_num;		/* amount read/written */

   882 	int init_off;		/* amount read/written */

   883 

   884 	/* used internally to point at a raw packet */

   885 	unsigned char *packet;

   886 	unsigned int packet_length;

   887 

   888 	struct ssl2_state_st *s2; /* SSLv2 variables */

   889 	struct ssl3_state_st *s3; /* SSLv3 variables */

   890 	struct dtls1_state_st *d1; /* DTLSv1 variables */

   891 

   892 	int read_ahead;		/* Read as many input bytes as possible

   893 	               	 	 * (for non-blocking reads) */

   894 

   895 	/* callback that allows applications to peek at protocol messages */

   896 	void (*msg_callback)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg);

   897 	void *msg_callback_arg;

   898 

   899 	int hit;		/* reusing a previous session */

   900 

   901 	X509_VERIFY_PARAM *param;

   902 

   903 #if 0

   904 	int purpose;		/* Purpose setting */

   905 	int trust;		/* Trust setting */

   906 #endif

   907 

   908 	/* crypto */

   909 	STACK_OF(SSL_CIPHER) *cipher_list;

   910 	STACK_OF(SSL_CIPHER) *cipher_list_by_id;

   911 

   912 	/* These are the ones being used, the ones in SSL_SESSION are

   913 	 * the ones to be 'copied' into these ones */

   914 

   915 	EVP_CIPHER_CTX *enc_read_ctx;		/* cryptographic state */

   916 	const EVP_MD *read_hash;		/* used for mac generation */

   917 #ifndef OPENSSL_NO_COMP

   918 	COMP_CTX *expand;			/* uncompress */

   919 #else

   920 	char *expand;

   921 #endif

   922 

   923 	EVP_CIPHER_CTX *enc_write_ctx;		/* cryptographic state */

   924 	const EVP_MD *write_hash;		/* used for mac generation */

   925 #ifndef OPENSSL_NO_COMP

   926 	COMP_CTX *compress;			/* compression */

   927 #else

   928 	char *compress;	

   929 #endif

   930 

   931 	/* session info */

   932 

   933 	/* client cert? */

   934 	/* This is used to hold the server certificate used */

   935 	struct cert_st /* CERT */ *cert;

   936 

   937 	/* the session_id_context is used to ensure sessions are only reused

   938 	 * in the appropriate context */

   939 	unsigned int sid_ctx_length;

   940 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

   941 

   942 	/* This can also be in the session once a session is established */

   943 	SSL_SESSION *session;

   944 

   945 	/* Default generate session ID callback. */

   946 	GEN_SESSION_CB generate_session_id;

   947 

   948 	/* Used in SSL2 and SSL3 */

   949 	int verify_mode;	/* 0 don't care about verify failure.

   950 				 * 1 fail if verify fails */

   951 	int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */

   952 

   953 	void (*info_callback)(const SSL *ssl,int type,int val); /* optional informational callback */

   954 

   955 	int error;		/* error bytes to be written */

   956 	int error_code;		/* actual code */

   957 

   958 #ifndef OPENSSL_NO_KRB5

   959 	KSSL_CTX *kssl_ctx;     /* Kerberos 5 context */

   960 #endif	/* OPENSSL_NO_KRB5 */

   961 

   962 	SSL_CTX *ctx;

   963 	/* set this flag to 1 and a sleep(1) is put into all SSL_read()

   964 	 * and SSL_write() calls, good for nbio debuging :-) */

   965 	int debug;	

   966 

   967 	/* extra application data */

   968 	long verify_result;

   969 	CRYPTO_EX_DATA ex_data;

   970 

   971 	/* for server side, keep the list of CA_dn we can use */

   972 	STACK_OF(X509_NAME) *client_CA;

   973 

   974 	int references;

   975 	unsigned long options; /* protocol behaviour */

   976 	unsigned long mode; /* API behaviour */

   977 	long max_cert_list;

   978 	int first_packet;

   979 	int client_version;	/* what was passed, used for

   980 				 * SSLv3/TLS rollback check */

   981 

   982 	};

   983 

   984 #ifdef __cplusplus

   985 }

   986 #endif

   987 

   988 #include <openssl/ssl2.h>

   989 #include <openssl/ssl3.h>

   990 #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */

   991 #include <openssl/dtls1.h> /* Datagram TLS */

   992 #include <openssl/ssl23.h>

   993 

   994 #ifdef  __cplusplus

   995 extern "C" {

   996 #endif

   997 

   998 /* compatibility */

   999 #define SSL_set_app_data(s,arg)		(SSL_set_ex_data(s,0,(char *)arg))

  1000 #define SSL_get_app_data(s)		(SSL_get_ex_data(s,0))

  1001 #define SSL_SESSION_set_app_data(s,a)	(SSL_SESSION_set_ex_data(s,0,(char *)a))

  1002 #define SSL_SESSION_get_app_data(s)	(SSL_SESSION_get_ex_data(s,0))

  1003 #define SSL_CTX_get_app_data(ctx)	(SSL_CTX_get_ex_data(ctx,0))

  1004 #define SSL_CTX_set_app_data(ctx,arg)	(SSL_CTX_set_ex_data(ctx,0,(char *)arg))

  1005 

  1006 /* The following are the possible values for ssl->state are are

  1007  * used to indicate where we are up to in the SSL connection establishment.

  1008  * The macros that follow are about the only things you should need to use

  1009  * and even then, only when using non-blocking IO.

  1010  * It can also be useful to work out where you were when the connection

  1011  * failed */

  1012 

  1013 #define SSL_ST_CONNECT			0x1000

  1014 #define SSL_ST_ACCEPT			0x2000

  1015 #define SSL_ST_MASK			0x0FFF

  1016 #define SSL_ST_INIT			(SSL_ST_CONNECT|SSL_ST_ACCEPT)

  1017 #define SSL_ST_BEFORE			0x4000

  1018 #define SSL_ST_OK			0x03

  1019 #define SSL_ST_RENEGOTIATE		(0x04|SSL_ST_INIT)

  1020 

  1021 #define SSL_CB_LOOP			0x01

  1022 #define SSL_CB_EXIT			0x02

  1023 #define SSL_CB_READ			0x04

  1024 #define SSL_CB_WRITE			0x08

  1025 #define SSL_CB_ALERT			0x4000 /* used in callback */

  1026 #define SSL_CB_READ_ALERT		(SSL_CB_ALERT|SSL_CB_READ)

  1027 #define SSL_CB_WRITE_ALERT		(SSL_CB_ALERT|SSL_CB_WRITE)

  1028 #define SSL_CB_ACCEPT_LOOP		(SSL_ST_ACCEPT|SSL_CB_LOOP)

  1029 #define SSL_CB_ACCEPT_EXIT		(SSL_ST_ACCEPT|SSL_CB_EXIT)

  1030 #define SSL_CB_CONNECT_LOOP		(SSL_ST_CONNECT|SSL_CB_LOOP)

  1031 #define SSL_CB_CONNECT_EXIT		(SSL_ST_CONNECT|SSL_CB_EXIT)

  1032 #define SSL_CB_HANDSHAKE_START		0x10

  1033 #define SSL_CB_HANDSHAKE_DONE		0x20

  1034 

  1035 /* Is the SSL_connection established? */

  1036 #define SSL_get_state(a)		SSL_state(a)

  1037 #define SSL_is_init_finished(a)		(SSL_state(a) == SSL_ST_OK)

  1038 #define SSL_in_init(a)			(SSL_state(a)&SSL_ST_INIT)

  1039 #define SSL_in_before(a)		(SSL_state(a)&SSL_ST_BEFORE)

  1040 #define SSL_in_connect_init(a)		(SSL_state(a)&SSL_ST_CONNECT)

  1041 #define SSL_in_accept_init(a)		(SSL_state(a)&SSL_ST_ACCEPT)

  1042 

  1043 /* The following 2 states are kept in ssl->rstate when reads fail,

  1044  * you should not need these */

  1045 #define SSL_ST_READ_HEADER			0xF0

  1046 #define SSL_ST_READ_BODY			0xF1

  1047 #define SSL_ST_READ_DONE			0xF2

  1048 

  1049 /* Obtain latest Finished message

  1050  *   -- that we sent (SSL_get_finished)

  1051  *   -- that we expected from peer (SSL_get_peer_finished).

  1052  * Returns length (0 == no Finished so far), copies up to 'count' bytes. */

  1053 IMPORT_C size_t SSL_get_finished(const SSL *s, void *buf, size_t count);

  1054 IMPORT_C size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);

  1055 

  1056 /* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options

  1057  * are 'ored' with SSL_VERIFY_PEER if they are desired */

  1058 #define SSL_VERIFY_NONE			0x00

  1059 #define SSL_VERIFY_PEER			0x01

  1060 #define SSL_VERIFY_FAIL_IF_NO_PEER_CERT	0x02

  1061 #define SSL_VERIFY_CLIENT_ONCE		0x04

  1062 

  1063 #define OpenSSL_add_ssl_algorithms()	SSL_library_init()

  1064 #define SSLeay_add_ssl_algorithms()	SSL_library_init()

  1065 

  1066 /* this is for backward compatibility */

  1067 #if 0 /* NEW_SSLEAY */

  1068 #define SSL_CTX_set_default_verify(a,b,c) SSL_CTX_set_verify(a,b,c)

  1069 #define SSL_set_pref_cipher(c,n)	SSL_set_cipher_list(c,n)

  1070 #define SSL_add_session(a,b)            SSL_CTX_add_session((a),(b))

  1071 #define SSL_remove_session(a,b)		SSL_CTX_remove_session((a),(b))

  1072 #define SSL_flush_sessions(a,b)		SSL_CTX_flush_sessions((a),(b))

  1073 #endif

  1074 /* More backward compatibility */

  1075 #define SSL_get_cipher(s) \

  1076 		SSL_CIPHER_get_name(SSL_get_current_cipher(s))

  1077 #define SSL_get_cipher_bits(s,np) \

  1078 		SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np)

  1079 #define SSL_get_cipher_version(s) \

  1080 		SSL_CIPHER_get_version(SSL_get_current_cipher(s))

  1081 #define SSL_get_cipher_name(s) \

  1082 		SSL_CIPHER_get_name(SSL_get_current_cipher(s))

  1083 #define SSL_get_time(a)		SSL_SESSION_get_time(a)

  1084 #define SSL_set_time(a,b)	SSL_SESSION_set_time((a),(b))

  1085 #define SSL_get_timeout(a)	SSL_SESSION_get_timeout(a)

  1086 #define SSL_set_timeout(a,b)	SSL_SESSION_set_timeout((a),(b))

  1087 

  1088 #if 1 /*SSLEAY_MACROS*/

  1089 #define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id)

  1090 #define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id)

  1091 #define PEM_read_SSL_SESSION(fp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read( \

  1092 	(char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,fp,(char **)x,cb,u)

  1093 #define PEM_read_bio_SSL_SESSION(bp,x,cb,u) PEM_ASN1_read_bio_of(SSL_SESSION,d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,x,cb,u)

  1094 #define PEM_write_SSL_SESSION(fp,x) \

  1095 	PEM_ASN1_write((int (*)())i2d_SSL_SESSION, \

  1096 		PEM_STRING_SSL_SESSION,fp, (char *)x, NULL,NULL,0,NULL,NULL)

  1097 #define PEM_write_bio_SSL_SESSION(bp,x) \

  1098 	PEM_ASN1_write_bio_of(SSL_SESSION,i2d_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,x,NULL,NULL,0,NULL,NULL)

  1099 #endif

  1100 

  1101 #define SSL_AD_REASON_OFFSET		1000

  1102 /* These alert types are for SSLv3 and TLSv1 */

  1103 #define SSL_AD_CLOSE_NOTIFY		SSL3_AD_CLOSE_NOTIFY

  1104 #define SSL_AD_UNEXPECTED_MESSAGE	SSL3_AD_UNEXPECTED_MESSAGE /* fatal */

  1105 #define SSL_AD_BAD_RECORD_MAC		SSL3_AD_BAD_RECORD_MAC     /* fatal */

  1106 #define SSL_AD_DECRYPTION_FAILED	TLS1_AD_DECRYPTION_FAILED

  1107 #define SSL_AD_RECORD_OVERFLOW		TLS1_AD_RECORD_OVERFLOW

  1108 #define SSL_AD_DECOMPRESSION_FAILURE	SSL3_AD_DECOMPRESSION_FAILURE/* fatal */

  1109 #define SSL_AD_HANDSHAKE_FAILURE	SSL3_AD_HANDSHAKE_FAILURE/* fatal */

  1110 #define SSL_AD_NO_CERTIFICATE		SSL3_AD_NO_CERTIFICATE /* Not for TLS */

  1111 #define SSL_AD_BAD_CERTIFICATE		SSL3_AD_BAD_CERTIFICATE

  1112 #define SSL_AD_UNSUPPORTED_CERTIFICATE	SSL3_AD_UNSUPPORTED_CERTIFICATE

  1113 #define SSL_AD_CERTIFICATE_REVOKED	SSL3_AD_CERTIFICATE_REVOKED

  1114 #define SSL_AD_CERTIFICATE_EXPIRED	SSL3_AD_CERTIFICATE_EXPIRED

  1115 #define SSL_AD_CERTIFICATE_UNKNOWN	SSL3_AD_CERTIFICATE_UNKNOWN

  1116 #define SSL_AD_ILLEGAL_PARAMETER	SSL3_AD_ILLEGAL_PARAMETER   /* fatal */

  1117 #define SSL_AD_UNKNOWN_CA		TLS1_AD_UNKNOWN_CA	/* fatal */

  1118 #define SSL_AD_ACCESS_DENIED		TLS1_AD_ACCESS_DENIED	/* fatal */

  1119 #define SSL_AD_DECODE_ERROR		TLS1_AD_DECODE_ERROR	/* fatal */

  1120 #define SSL_AD_DECRYPT_ERROR		TLS1_AD_DECRYPT_ERROR

  1121 #define SSL_AD_EXPORT_RESTRICTION	TLS1_AD_EXPORT_RESTRICTION/* fatal */

  1122 #define SSL_AD_PROTOCOL_VERSION		TLS1_AD_PROTOCOL_VERSION /* fatal */

  1123 #define SSL_AD_INSUFFICIENT_SECURITY	TLS1_AD_INSUFFICIENT_SECURITY/* fatal */

  1124 #define SSL_AD_INTERNAL_ERROR		TLS1_AD_INTERNAL_ERROR	/* fatal */

  1125 #define SSL_AD_USER_CANCELLED		TLS1_AD_USER_CANCELLED

  1126 #define SSL_AD_NO_RENEGOTIATION		TLS1_AD_NO_RENEGOTIATION

  1127 #define SSL_AD_UNSUPPORTED_EXTENSION	TLS1_AD_UNSUPPORTED_EXTENSION

  1128 #define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE

  1129 #define SSL_AD_UNRECOGNIZED_NAME	TLS1_AD_UNRECOGNIZED_NAME

  1130 

  1131 #define SSL_ERROR_NONE			0

  1132 #define SSL_ERROR_SSL			1

  1133 #define SSL_ERROR_WANT_READ		2

  1134 #define SSL_ERROR_WANT_WRITE		3