1 /* ssl/ssl.h */

     2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     3  * All rights reserved.

     4  *

     5  * This package is an SSL implementation written

     6  * by Eric Young (eay@cryptsoft.com).

     7  * The implementation was written so as to conform with Netscapes SSL.

     8  * 

     9  * This library is free for commercial and non-commercial use as long as

    10  * the following conditions are aheared to.  The following conditions

    11  * apply to all code found in this distribution, be it the RC4, RSA,

    12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    13  * included with this distribution is covered by the same copyright terms

    14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    15  * 

    16  * Copyright remains Eric Young's, and as such any Copyright notices in

    17  * the code are not to be removed.

    18  * If this package is used in a product, Eric Young should be given attribution

    19  * as the author of the parts of the library used.

    20  * This can be in the form of a textual message at program startup or

    21  * in documentation (online or textual) provided with the package.

    22  * 

    23  * Redistribution and use in source and binary forms, with or without

    24  * modification, are permitted provided that the following conditions

    25  * are met:

    26  * 1. Redistributions of source code must retain the copyright

    27  *    notice, this list of conditions and the following disclaimer.

    28  * 2. Redistributions in binary form must reproduce the above copyright

    29  *    notice, this list of conditions and the following disclaimer in the

    30  *    documentation and/or other materials provided with the distribution.

    31  * 3. All advertising materials mentioning features or use of this software

    32  *    must display the following acknowledgement:

    33  *    "This product includes cryptographic software written by

    34  *     Eric Young (eay@cryptsoft.com)"

    35  *    The word 'cryptographic' can be left out if the rouines from the library

    36  *    being used are not cryptographic related :-).

    37  * 4. If you include any Windows specific code (or a derivative thereof) from 

    38  *    the apps directory (application code) you must include an acknowledgement:

    39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    40  * 

    41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    51  * SUCH DAMAGE.

    52  * 

    53  * The licence and distribution terms for any publically available version or

    54  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    55  * copied and put under another distribution licence

    56  * [including the GNU Public Licence.]

    57  */

    58 /* ====================================================================

    59  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.

    60  *

    61  * Redistribution and use in source and binary forms, with or without

    62  * modification, are permitted provided that the following conditions

    63  * are met:

    64  *

    65  * 1. Redistributions of source code must retain the above copyright

    66  *    notice, this list of conditions and the following disclaimer. 

    67  *

    68  * 2. Redistributions in binary form must reproduce the above copyright

    69  *    notice, this list of conditions and the following disclaimer in

    70  *    the documentation and/or other materials provided with the

    71  *    distribution.

    72  *

    73  * 3. All advertising materials mentioning features or use of this

    74  *    software must display the following acknowledgment:

    75  *    "This product includes software developed by the OpenSSL Project

    76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

    77  *

    78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

    79  *    endorse or promote products derived from this software without

    80  *    prior written permission. For written permission, please contact

    81  *    openssl-core@openssl.org.

    82  *

    83  * 5. Products derived from this software may not be called "OpenSSL"

    84  *    nor may "OpenSSL" appear in their names without prior written

    85  *    permission of the OpenSSL Project.

    86  *

    87  * 6. Redistributions of any form whatsoever must retain the following

    88  *    acknowledgment:

    89  *    "This product includes software developed by the OpenSSL Project

    90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

    91  *

    92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

    93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

    95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

    96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

    97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

    98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

    99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   103  * OF THE POSSIBILITY OF SUCH DAMAGE.

   104  * ====================================================================

   105  *

   106  * This product includes cryptographic software written by Eric Young

   107  * (eay@cryptsoft.com).  This product includes software written by Tim

   108  * Hudson (tjh@cryptsoft.com).

   109  *

   110  */

   111 /* ====================================================================

   112  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.

   113  *

   114  * Redistribution and use in source and binary forms, with or without

   115  * modification, are permitted provided that the following conditions

   116  * are met:

   117  *

   118  * 1. Redistributions of source code must retain the above copyright

   119  *    notice, this list of conditions and the following disclaimer. 

   120  *

   121  * 2. Redistributions in binary form must reproduce the above copyright

   122  *    notice, this list of conditions and the following disclaimer in

   123  *    the documentation and/or other materials provided with the

   124  *    distribution.

   125  *

   126  * 3. All advertising materials mentioning features or use of this

   127  *    software must display the following acknowledgment:

   128  *    "This product includes software developed by the OpenSSL Project

   129  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

   130  *

   131  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

   132  *    endorse or promote products derived from this software without

   133  *    prior written permission. For written permission, please contact

   134  *    openssl-core@openssl.org.

   135  *

   136  * 5. Products derived from this software may not be called "OpenSSL"

   137  *    nor may "OpenSSL" appear in their names without prior written

   138  *    permission of the OpenSSL Project.

   139  *

   140  * 6. Redistributions of any form whatsoever must retain the following

   141  *    acknowledgment:

   142  *    "This product includes software developed by the OpenSSL Project

   143  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

   144  *

   145  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

   146  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

   147  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

   148  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

   149  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

   150  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

   151  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

   152  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   153  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   154  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   155  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   156  * OF THE POSSIBILITY OF SUCH DAMAGE.

   157  * ====================================================================

   158  *

   159  * This product includes cryptographic software written by Eric Young

   160  * (eay@cryptsoft.com).  This product includes software written by Tim

   161  * Hudson (tjh@cryptsoft.com).

   162  *

   163  */

   164 

   165 #ifndef HEADER_SSL_H 

   166 #define HEADER_SSL_H 

   167 

   168 #include <openssl/e_os2.h>

   169 

   170 #ifndef OPENSSL_NO_COMP

   171 #include <openssl/comp.h>

   172 #endif

   173 #ifndef OPENSSL_NO_BIO

   174 #include <openssl/bio.h>

   175 #endif

   176 #ifndef OPENSSL_NO_X509

   177 #include <openssl/x509.h>

   178 #endif

   179 #include <openssl/kssl.h>

   180 #include <openssl/safestack.h>

   181 #include <openssl/symhacks.h>

   182 

   183 #ifdef  __cplusplus

   184 extern "C" {

   185 #endif

   186 

   187 /* SSLeay version number for ASN.1 encoding of the session information */

   188 /* Version 0 - initial version

   189  * Version 1 - added the optional peer certificate

   190  */

   191 #define SSL_SESSION_ASN1_VERSION 0x0001

   192 

   193 /* text strings for the ciphers */

   194 #define SSL_TXT_NULL_WITH_MD5		SSL2_TXT_NULL_WITH_MD5			

   195 #define SSL_TXT_RC4_128_WITH_MD5	SSL2_TXT_RC4_128_WITH_MD5		

   196 #define SSL_TXT_RC4_128_EXPORT40_WITH_MD5 SSL2_TXT_RC4_128_EXPORT40_WITH_MD5	

   197 #define SSL_TXT_RC2_128_CBC_WITH_MD5	SSL2_TXT_RC2_128_CBC_WITH_MD5		

   198 #define SSL_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5	

   199 #define SSL_TXT_IDEA_128_CBC_WITH_MD5	SSL2_TXT_IDEA_128_CBC_WITH_MD5		

   200 #define SSL_TXT_DES_64_CBC_WITH_MD5	SSL2_TXT_DES_64_CBC_WITH_MD5		

   201 #define SSL_TXT_DES_64_CBC_WITH_SHA	SSL2_TXT_DES_64_CBC_WITH_SHA		

   202 #define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5	

   203 #define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA	

   204 

   205 /*    VRS Additional Kerberos5 entries

   206  */

   207 #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA

   208 #define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA

   209 #define SSL_TXT_KRB5_RC4_128_SHA      SSL3_TXT_KRB5_RC4_128_SHA

   210 #define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA

   211 #define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5       

   212 #define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5       

   213 #define SSL_TXT_KRB5_RC4_128_MD5      SSL3_TXT_KRB5_RC4_128_MD5

   214 #define SSL_TXT_KRB5_IDEA_128_CBC_MD5 SSL3_TXT_KRB5_IDEA_128_CBC_MD5 

   215 

   216 #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA 

   217 #define SSL_TXT_KRB5_RC2_40_CBC_SHA   SSL3_TXT_KRB5_RC2_40_CBC_SHA 

   218 #define SSL_TXT_KRB5_RC4_40_SHA	      SSL3_TXT_KRB5_RC4_40_SHA

   219 #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5 

   220 #define SSL_TXT_KRB5_RC2_40_CBC_MD5   SSL3_TXT_KRB5_RC2_40_CBC_MD5 

   221 #define SSL_TXT_KRB5_RC4_40_MD5	      SSL3_TXT_KRB5_RC4_40_MD5

   222 

   223 #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA

   224 #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5

   225 #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA

   226 #define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5

   227 #define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA

   228 #define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5

   229 #define SSL_MAX_KRB5_PRINCIPAL_LENGTH  256

   230 

   231 #define SSL_MAX_SSL_SESSION_ID_LENGTH		32

   232 #define SSL_MAX_SID_CTX_LENGTH			32

   233 

   234 #define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES	(512/8)

   235 #define SSL_MAX_KEY_ARG_LENGTH			8

   236 #define SSL_MAX_MASTER_KEY_LENGTH		48

   237 

   238 /* These are used to specify which ciphers to use and not to use */

   239 #define SSL_TXT_LOW		"LOW"

   240 #define SSL_TXT_MEDIUM		"MEDIUM"

   241 #define SSL_TXT_HIGH		"HIGH"

   242 #define SSL_TXT_kFZA		"kFZA"

   243 #define	SSL_TXT_aFZA		"aFZA"

   244 #define SSL_TXT_eFZA		"eFZA"

   245 #define SSL_TXT_FZA		"FZA"

   246 

   247 #define	SSL_TXT_aNULL		"aNULL"

   248 #define	SSL_TXT_eNULL		"eNULL"

   249 #define	SSL_TXT_NULL		"NULL"

   250 

   251 #define SSL_TXT_kKRB5     	"kKRB5"

   252 #define SSL_TXT_aKRB5     	"aKRB5"

   253 #define SSL_TXT_KRB5      	"KRB5"

   254 

   255 #define SSL_TXT_kRSA		"kRSA"

   256 #define SSL_TXT_kDHr		"kDHr"

   257 #define SSL_TXT_kDHd		"kDHd"

   258 #define SSL_TXT_kEDH		"kEDH"

   259 #define	SSL_TXT_aRSA		"aRSA"

   260 #define	SSL_TXT_aDSS		"aDSS"

   261 #define	SSL_TXT_aDH		"aDH"

   262 #define	SSL_TXT_DSS		"DSS"

   263 #define SSL_TXT_DH		"DH"

   264 #define SSL_TXT_EDH		"EDH"

   265 #define SSL_TXT_ADH		"ADH"

   266 #define SSL_TXT_RSA		"RSA"

   267 #define SSL_TXT_DES		"DES"

   268 #define SSL_TXT_3DES		"3DES"

   269 #define SSL_TXT_RC4		"RC4"

   270 #define SSL_TXT_RC2		"RC2"

   271 #define SSL_TXT_IDEA		"IDEA"

   272 #define SSL_TXT_AES		"AES"

   273 #define SSL_TXT_MD5		"MD5"

   274 #define SSL_TXT_SHA1		"SHA1"

   275 #define SSL_TXT_SHA		"SHA"

   276 #define SSL_TXT_EXP		"EXP"

   277 #define SSL_TXT_EXPORT		"EXPORT"

   278 #define SSL_TXT_EXP40		"EXPORT40"

   279 #define SSL_TXT_EXP56		"EXPORT56"

   280 #define SSL_TXT_SSLV2		"SSLv2"

   281 #define SSL_TXT_SSLV3		"SSLv3"

   282 #define SSL_TXT_TLSV1		"TLSv1"

   283 #define SSL_TXT_ALL		"ALL"

   284 

   285 /*

   286  * COMPLEMENTOF* definitions. These identifiers are used to (de-select)

   287  * ciphers normally not being used.

   288  * Example: "RC4" will activate all ciphers using RC4 including ciphers

   289  * without authentication, which would normally disabled by DEFAULT (due

   290  * the "!ADH" being part of default). Therefore "RC4:!COMPLEMENTOFDEFAULT"

   291  * will make sure that it is also disabled in the specific selection.

   292  * COMPLEMENTOF* identifiers are portable between version, as adjustments

   293  * to the default cipher setup will also be included here.

   294  *

   295  * COMPLEMENTOFDEFAULT does not experience the same special treatment that

   296  * DEFAULT gets, as only selection is being done and no sorting as needed

   297  * for DEFAULT.

   298  */

   299 #define SSL_TXT_CMPALL		"COMPLEMENTOFALL"

   300 #define SSL_TXT_CMPDEF		"COMPLEMENTOFDEFAULT"

   301 

   302 /* The following cipher list is used by default.

   303  * It also is substituted when an application-defined cipher list string

   304  * starts with 'DEFAULT'. */

   305 #define SSL_DEFAULT_CIPHER_LIST	"ALL:!ADH:+RC4:@STRENGTH" /* low priority for RC4 */

   306 

   307 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */

   308 #define SSL_SENT_SHUTDOWN	1

   309 #define SSL_RECEIVED_SHUTDOWN	2

   310 

   311 #ifdef __cplusplus

   312 }

   313 #endif

   314 

   315 #include <openssl/crypto.h>

   316 #include <openssl/lhash.h>

   317 #include <openssl/buffer.h>

   318 #include <openssl/pem.h>

   319 

   320 #ifdef  __cplusplus

   321 extern "C" {

   322 #endif

   323 

   324 #if (defined(OPENSSL_NO_RSA) || defined(OPENSSL_NO_MD5)) && !defined(OPENSSL_NO_SSL2)

   325 #define OPENSSL_NO_SSL2

   326 #endif

   327 

   328 #define SSL_FILETYPE_ASN1	X509_FILETYPE_ASN1

   329 #define SSL_FILETYPE_PEM	X509_FILETYPE_PEM

   330 

   331 /* This is needed to stop compilers complaining about the

   332  * 'struct ssl_st *' function parameters used to prototype callbacks

   333  * in SSL_CTX. */

   334 typedef struct ssl_st *ssl_crock_st;

   335 

   336 /* used to hold info on the particular ciphers used */

   337 typedef struct ssl_cipher_st

   338 	{

   339 	int valid;

   340 	const char *name;		/* text name */

   341 	unsigned long id;		/* id, 4 bytes, first is version */

   342 	unsigned long algorithms;	/* what ciphers are used */

   343 	unsigned long algo_strength;	/* strength and export flags */

   344 	unsigned long algorithm2;	/* Extra flags */

   345 	int strength_bits;		/* Number of bits really used */

   346 	int alg_bits;			/* Number of bits for algorithm */

   347 	unsigned long mask;		/* used for matching */

   348 	unsigned long mask_strength;	/* also used for matching */

   349 	} SSL_CIPHER;

   350 

   351 DECLARE_STACK_OF(SSL_CIPHER)

   352 

   353 typedef struct ssl_st SSL;

   354 typedef struct ssl_ctx_st SSL_CTX;

   355 

   356 /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */

   357 typedef struct ssl_method_st

   358 	{

   359 	int version;

   360 	int (*ssl_new)(SSL *s);

   361 	void (*ssl_clear)(SSL *s);

   362 	void (*ssl_free)(SSL *s);

   363 	int (*ssl_accept)(SSL *s);

   364 	int (*ssl_connect)(SSL *s);

   365 	int (*ssl_read)(SSL *s,void *buf,int len);

   366 	int (*ssl_peek)(SSL *s,void *buf,int len);

   367 	int (*ssl_write)(SSL *s,const void *buf,int len);

   368 	int (*ssl_shutdown)(SSL *s);

   369 	int (*ssl_renegotiate)(SSL *s);

   370 	int (*ssl_renegotiate_check)(SSL *s);

   371 	long (*ssl_ctrl)(SSL *s,int cmd,long larg,void *parg);

   372 	long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,void *parg);

   373 	SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);

   374 	int (*put_cipher_by_char)(const SSL_CIPHER *cipher,unsigned char *ptr);

   375 	int (*ssl_pending)(SSL *s);

   376 	int (*num_ciphers)(void);

   377 	SSL_CIPHER *(*get_cipher)(unsigned ncipher);

   378 	struct ssl_method_st *(*get_ssl_method)(int version);

   379 	long (*get_timeout)(void);

   380 	struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */

   381 	int (*ssl_version)();

   382 	long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)());

   383 	long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)());

   384 	} SSL_METHOD;

   385 

   386 /* Lets make this into an ASN.1 type structure as follows

   387  * SSL_SESSION_ID ::= SEQUENCE {

   388  *	version 		INTEGER,	-- structure version number

   389  *	SSLversion 		INTEGER,	-- SSL version number

   390  *	Cipher 			OCTET_STRING,	-- the 3 byte cipher ID

   391  *	Session_ID 		OCTET_STRING,	-- the Session ID

   392  *	Master_key 		OCTET_STRING,	-- the master key

   393  *	KRB5_principal		OCTET_STRING	-- optional Kerberos principal

   394  *	Key_Arg [ 0 ] IMPLICIT	OCTET_STRING,	-- the optional Key argument

   395  *	Time [ 1 ] EXPLICIT	INTEGER,	-- optional Start Time

   396  *	Timeout [ 2 ] EXPLICIT	INTEGER,	-- optional Timeout ins seconds

   397  *	Peer [ 3 ] EXPLICIT	X509,		-- optional Peer Certificate

   398  *	Session_ID_context [ 4 ] EXPLICIT OCTET_STRING,   -- the Session ID context

   399  *	Verify_result [ 5 ] EXPLICIT INTEGER    -- X509_V_... code for `Peer'

   400  *	Compression [6] IMPLICIT ASN1_OBJECT	-- compression OID XXXXX

   401  *	}

   402  * Look in ssl/ssl_asn1.c for more details

   403  * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).

   404  */

   405 typedef struct ssl_session_st

   406 	{

   407 	int ssl_version;	/* what ssl version session info is

   408 				 * being kept in here? */

   409 

   410 	/* only really used in SSLv2 */

   411 	unsigned int key_arg_length;

   412 	unsigned char key_arg[SSL_MAX_KEY_ARG_LENGTH];

   413 	int master_key_length;

   414 	unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];

   415 	/* session_id - valid? */

   416 	unsigned int session_id_length;

   417 	unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];

   418 	/* this is used to determine whether the session is being reused in

   419 	 * the appropriate context. It is up to the application to set this,

   420 	 * via SSL_new */

   421 	unsigned int sid_ctx_length;

   422 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

   423 

   424 #ifndef OPENSSL_NO_KRB5

   425         unsigned int krb5_client_princ_len;

   426         unsigned char krb5_client_princ[SSL_MAX_KRB5_PRINCIPAL_LENGTH];

   427 #endif /* OPENSSL_NO_KRB5 */

   428 

   429 	int not_resumable;

   430 

   431 	/* The cert is the certificate used to establish this connection */

   432 	struct sess_cert_st /* SESS_CERT */ *sess_cert;

   433 

   434 	/* This is the cert for the other end.

   435 	 * On clients, it will be the same as sess_cert->peer_key->x509

   436 	 * (the latter is not enough as sess_cert is not retained

   437 	 * in the external representation of sessions, see ssl_asn1.c). */

   438 	X509 *peer;

   439 	/* when app_verify_callback accepts a session where the peer's certificate

   440 	 * is not ok, we must remember the error for session reuse: */

   441 	long verify_result; /* only for servers */

   442 

   443 	int references;

   444 	long timeout;

   445 	long time;

   446 

   447 	int compress_meth;		/* Need to lookup the method */

   448 

   449 	SSL_CIPHER *cipher;

   450 	unsigned long cipher_id;	/* when ASN.1 loaded, this

   451 					 * needs to be used to load

   452 					 * the 'cipher' structure */

   453 

   454 	STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */

   455 

   456 	CRYPTO_EX_DATA ex_data; /* application specific data */

   457 

   458 	/* These are used to make removal of session-ids more

   459 	 * efficient and to implement a maximum cache size. */

   460 	struct ssl_session_st *prev,*next;

   461 	} SSL_SESSION;

   462 

   463 

   464 #define SSL_OP_MICROSOFT_SESS_ID_BUG			0x00000001L

   465 #define SSL_OP_NETSCAPE_CHALLENGE_BUG			0x00000002L

   466 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG		0x00000008L

   467 #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG		0x00000010L

   468 #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER		0x00000020L

   469 #define SSL_OP_MSIE_SSLV2_RSA_PADDING			0x00000040L

   470 #define SSL_OP_SSLEAY_080_CLIENT_DH_BUG			0x00000080L

   471 #define SSL_OP_TLS_D5_BUG				0x00000100L

   472 #define SSL_OP_TLS_BLOCK_PADDING_BUG			0x00000200L

   473 

   474 /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added

   475  * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)

   476  * the workaround is not needed.  Unfortunately some broken SSL/TLS

   477  * implementations cannot handle it at all, which is why we include

   478  * it in SSL_OP_ALL. */

   479 #define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS              0x00000800L /* added in 0.9.6e */

   480 

   481 /* SSL_OP_ALL: various bug workarounds that should be rather harmless.

   482  *             This used to be 0x000FFFFFL before 0.9.7. */

   483 #define SSL_OP_ALL					0x00000FFFL

   484 

   485 /* As server, disallow session resumption on renegotiation */

   486 #define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION	0x00010000L

   487 /* If set, always create a new key when using tmp_dh parameters */

   488 #define SSL_OP_SINGLE_DH_USE				0x00100000L

   489 /* Set to always use the tmp_rsa key when doing RSA operations,

   490  * even when this violates protocol specs */

   491 #define SSL_OP_EPHEMERAL_RSA				0x00200000L

   492 /* Set on servers to choose the cipher according to the server's

   493  * preferences */

   494 #define SSL_OP_CIPHER_SERVER_PREFERENCE			0x00400000L

   495 /* If set, a server will allow a client to issue a SSLv3.0 version number

   496  * as latest version supported in the premaster secret, even when TLSv1.0

   497  * (version 3.1) was announced in the client hello. Normally this is

   498  * forbidden to prevent version rollback attacks. */

   499 #define SSL_OP_TLS_ROLLBACK_BUG				0x00800000L

   500 

   501 #define SSL_OP_NO_SSLv2					0x01000000L

   502 #define SSL_OP_NO_SSLv3					0x02000000L

   503 #define SSL_OP_NO_TLSv1					0x04000000L

   504 

   505 /* The next flag deliberately changes the ciphertest, this is a check

   506  * for the PKCS#1 attack */

   507 #define SSL_OP_PKCS1_CHECK_1				0x08000000L

   508 #define SSL_OP_PKCS1_CHECK_2				0x10000000L

   509 #define SSL_OP_NETSCAPE_CA_DN_BUG			0x20000000L

   510 #define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG		0x40000000L

   511 

   512 

   513 /* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success

   514  * when just a single record has been written): */

   515 #define SSL_MODE_ENABLE_PARTIAL_WRITE       0x00000001L

   516 /* Make it possible to retry SSL_write() with changed buffer location

   517  * (buffer contents must stay the same!); this is not the default to avoid

   518  * the misconception that non-blocking SSL_write() behaves like

   519  * non-blocking write(): */

   520 #define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L

   521 /* Never bother the application with retries if the transport

   522  * is blocking: */

   523 #define SSL_MODE_AUTO_RETRY 0x00000004L

   524 /* Don't attempt to automatically build certificate chain */

   525 #define SSL_MODE_NO_AUTO_CHAIN 0x00000008L

   526 

   527 

   528 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,

   529  * they cannot be used to clear bits. */

   530 

   531 #define SSL_CTX_set_options(ctx,op) \

   532 	SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)

   533 #define SSL_CTX_get_options(ctx) \

   534 	SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)

   535 #define SSL_set_options(ssl,op) \

   536 	SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)

   537 #define SSL_get_options(ssl) \

   538         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)

   539 

   540 #define SSL_CTX_set_mode(ctx,op) \

   541 	SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)

   542 #define SSL_CTX_get_mode(ctx) \

   543 	SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL)

   544 #define SSL_set_mode(ssl,op) \

   545 	SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)

   546 #define SSL_get_mode(ssl) \

   547         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)

   548 

   549 

   550 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));

   551 void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));

   552 #define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))

   553 #define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))

   554 

   555 

   556 

   557 #if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32)

   558 #define SSL_MAX_CERT_LIST_DEFAULT 1024*30 /* 30k max cert list :-) */

   559 #else

   560 #define SSL_MAX_CERT_LIST_DEFAULT 1024*100 /* 100k max cert list :-) */

   561 #endif

   562 

   563 #define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT	(1024*20)

   564 

   565 /* This callback type is used inside SSL_CTX, SSL, and in the functions that set

   566  * them. It is used to override the generation of SSL/TLS session IDs in a

   567  * server. Return value should be zero on an error, non-zero to proceed. Also,

   568  * callbacks should themselves check if the id they generate is unique otherwise

   569  * the SSL handshake will fail with an error - callbacks can do this using the

   570  * 'ssl' value they're passed by;

   571  *      SSL_has_matching_session_id(ssl, id, *id_len)

   572  * The length value passed in is set at the maximum size the session ID can be.

   573  * In SSLv2 this is 16 bytes, whereas SSLv3/TLSv1 it is 32 bytes. The callback

   574  * can alter this length to be less if desired, but under SSLv2 session IDs are

   575  * supposed to be fixed at 16 bytes so the id will be padded after the callback

   576  * returns in this case. It is also an error for the callback to set the size to

   577  * zero. */

   578 typedef int (*GEN_SESSION_CB)(const SSL *ssl, unsigned char *id,

   579 				unsigned int *id_len);

   580 

   581 typedef struct ssl_comp_st

   582 	{

   583 	int id;

   584 	char *name;

   585 #ifndef OPENSSL_NO_COMP

   586 	COMP_METHOD *method;

   587 #else

   588 	char *method;

   589 #endif

   590 	} SSL_COMP;

   591 

   592 DECLARE_STACK_OF(SSL_COMP)

   593 

   594 struct ssl_ctx_st

   595 	{

   596 	SSL_METHOD *method;

   597 

   598 	STACK_OF(SSL_CIPHER) *cipher_list;

   599 	/* same as above but sorted for lookup */

   600 	STACK_OF(SSL_CIPHER) *cipher_list_by_id;

   601 

   602 	struct x509_store_st /* X509_STORE */ *cert_store;

   603 	struct lhash_st /* LHASH */ *sessions;	/* a set of SSL_SESSIONs */

   604 	/* Most session-ids that will be cached, default is

   605 	 * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited. */

   606 	unsigned long session_cache_size;

   607 	struct ssl_session_st *session_cache_head;

   608 	struct ssl_session_st *session_cache_tail;

   609 

   610 	/* This can have one of 2 values, ored together,

   611 	 * SSL_SESS_CACHE_CLIENT,

   612 	 * SSL_SESS_CACHE_SERVER,

   613 	 * Default is SSL_SESSION_CACHE_SERVER, which means only

   614 	 * SSL_accept which cache SSL_SESSIONS. */

   615 	int session_cache_mode;

   616 

   617 	/* If timeout is not 0, it is the default timeout value set

   618 	 * when SSL_new() is called.  This has been put in to make

   619 	 * life easier to set things up */

   620 	long session_timeout;

   621 

   622 	/* If this callback is not null, it will be called each

   623 	 * time a session id is added to the cache.  If this function

   624 	 * returns 1, it means that the callback will do a

   625 	 * SSL_SESSION_free() when it has finished using it.  Otherwise,

   626 	 * on 0, it means the callback has finished with it.

   627 	 * If remove_session_cb is not null, it will be called when

   628 	 * a session-id is removed from the cache.  After the call,

   629 	 * OpenSSL will SSL_SESSION_free() it. */

   630 	int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess);

   631 	void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess);

   632 	SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl,

   633 		unsigned char *data,int len,int *copy);

   634 

   635 	struct

   636 		{

   637 		int sess_connect;	/* SSL new conn - started */

   638 		int sess_connect_renegotiate;/* SSL reneg - requested */

   639 		int sess_connect_good;	/* SSL new conne/reneg - finished */

   640 		int sess_accept;	/* SSL new accept - started */

   641 		int sess_accept_renegotiate;/* SSL reneg - requested */

   642 		int sess_accept_good;	/* SSL accept/reneg - finished */

   643 		int sess_miss;		/* session lookup misses  */

   644 		int sess_timeout;	/* reuse attempt on timeouted session */

   645 		int sess_cache_full;	/* session removed due to full cache */

   646 		int sess_hit;		/* session reuse actually done */

   647 		int sess_cb_hit;	/* session-id that was not

   648 					 * in the cache was

   649 					 * passed back via the callback.  This

   650 					 * indicates that the application is

   651 					 * supplying session-id's from other

   652 					 * processes - spooky :-) */

   653 		} stats;

   654 

   655 	int references;

   656 

   657 	/* if defined, these override the X509_verify_cert() calls */

   658 	int (*app_verify_callback)(X509_STORE_CTX *, void *);

   659 	void *app_verify_arg;

   660 	/* before OpenSSL 0.9.7, 'app_verify_arg' was ignored

   661 	 * ('app_verify_callback' was called with just one argument) */

   662 

   663 	/* Default password callback. */

   664 	pem_password_cb *default_passwd_callback;

   665 

   666 	/* Default password callback user data. */

   667 	void *default_passwd_callback_userdata;

   668 

   669 	/* get client cert callback */

   670 	int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);

   671 

   672 	CRYPTO_EX_DATA ex_data;

   673 

   674 	const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */

   675 	const EVP_MD *md5;	/* For SSLv3/TLSv1 'ssl3-md5' */

   676 	const EVP_MD *sha1;   /* For SSLv3/TLSv1 'ssl3->sha1' */

   677 

   678 	STACK_OF(X509) *extra_certs;

   679 	STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */

   680 

   681 

   682 	/* Default values used when no per-SSL value is defined follow */

   683 

   684 	void (*info_callback)(const SSL *ssl,int type,int val); /* used if SSL's info_callback is NULL */

   685 

   686 	/* what we put in client cert requests */

   687 	STACK_OF(X509_NAME) *client_CA;

   688 

   689 

   690 	/* Default values to use in SSL structures follow (these are copied by SSL_new) */

   691 

   692 	unsigned long options;

   693 	unsigned long mode;

   694 	long max_cert_list;

   695 

   696 	struct cert_st /* CERT */ *cert;

   697 	int read_ahead;

   698 

   699 	/* callback that allows applications to peek at protocol messages */

   700 	void (*msg_callback)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg);

   701 	void *msg_callback_arg;

   702 

   703 	int verify_mode;

   704 	int verify_depth;

   705 	unsigned int sid_ctx_length;

   706 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

   707 	int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx); /* called 'verify_callback' in the SSL */

   708 

   709 	/* Default generate session ID callback. */

   710 	GEN_SESSION_CB generate_session_id;

   711 

   712 	int purpose;		/* Purpose setting */

   713 	int trust;		/* Trust setting */

   714 

   715 	int quiet_shutdown;

   716 	};

   717 

   718 #define SSL_SESS_CACHE_OFF			0x0000

   719 #define SSL_SESS_CACHE_CLIENT			0x0001

   720 #define SSL_SESS_CACHE_SERVER			0x0002

   721 #define SSL_SESS_CACHE_BOTH	(SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER)

   722 #define SSL_SESS_CACHE_NO_AUTO_CLEAR		0x0080

   723 /* enough comments already ... see SSL_CTX_set_session_cache_mode(3) */

   724 #define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP	0x0100

   725 #define SSL_SESS_CACHE_NO_INTERNAL_STORE	0x0200

   726 #define SSL_SESS_CACHE_NO_INTERNAL \

   727 	(SSL_SESS_CACHE_NO_INTERNAL_LOOKUP|SSL_SESS_CACHE_NO_INTERNAL_STORE)

   728 

   729   struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx);

   730 #define SSL_CTX_sess_number(ctx) \

   731 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL)

   732 #define SSL_CTX_sess_connect(ctx) \

   733 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL)

   734 #define SSL_CTX_sess_connect_good(ctx) \

   735 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL)

   736 #define SSL_CTX_sess_connect_renegotiate(ctx) \

   737 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL)

   738 #define SSL_CTX_sess_accept(ctx) \

   739 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL)

   740 #define SSL_CTX_sess_accept_renegotiate(ctx) \

   741 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL)

   742 #define SSL_CTX_sess_accept_good(ctx) \

   743 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL)

   744 #define SSL_CTX_sess_hits(ctx) \

   745 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL)

   746 #define SSL_CTX_sess_cb_hits(ctx) \

   747 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL)

   748 #define SSL_CTX_sess_misses(ctx) \

   749 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL)

   750 #define SSL_CTX_sess_timeouts(ctx) \

   751 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL)

   752 #define SSL_CTX_sess_cache_full(ctx) \

   753 	SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL)

   754 

   755 #define SSL_CTX_sess_set_new_cb(ctx,cb)	((ctx)->new_session_cb=(cb))

   756 #define SSL_CTX_sess_get_new_cb(ctx)	((ctx)->new_session_cb)

   757 #define SSL_CTX_sess_set_remove_cb(ctx,cb)	((ctx)->remove_session_cb=(cb))

   758 #define SSL_CTX_sess_get_remove_cb(ctx)	((ctx)->remove_session_cb)

   759 #define SSL_CTX_sess_set_get_cb(ctx,cb)	((ctx)->get_session_cb=(cb))

   760 #define SSL_CTX_sess_get_get_cb(ctx)	((ctx)->get_session_cb)

   761 #define SSL_CTX_set_info_callback(ctx,cb)	((ctx)->info_callback=(cb))

   762 #define SSL_CTX_get_info_callback(ctx)		((ctx)->info_callback)

   763 #define SSL_CTX_set_client_cert_cb(ctx,cb)	((ctx)->client_cert_cb=(cb))

   764 #define SSL_CTX_get_client_cert_cb(ctx)		((ctx)->client_cert_cb)

   765 

   766 #define SSL_NOTHING	1

   767 #define SSL_WRITING	2

   768 #define SSL_READING	3

   769 #define SSL_X509_LOOKUP	4

   770 

   771 /* These will only be used when doing non-blocking IO */

   772 #define SSL_want_nothing(s)	(SSL_want(s) == SSL_NOTHING)

   773 #define SSL_want_read(s)	(SSL_want(s) == SSL_READING)

   774 #define SSL_want_write(s)	(SSL_want(s) == SSL_WRITING)

   775 #define SSL_want_x509_lookup(s)	(SSL_want(s) == SSL_X509_LOOKUP)

   776 

   777 struct ssl_st

   778 	{

   779 	/* protocol version

   780 	 * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION)

   781 	 */

   782 	int version;

   783 	int type; /* SSL_ST_CONNECT or SSL_ST_ACCEPT */

   784 

   785 	SSL_METHOD *method; /* SSLv3 */

   786 

   787 	/* There are 2 BIO's even though they are normally both the

   788 	 * same.  This is so data can be read and written to different

   789 	 * handlers */

   790 

   791 #ifndef OPENSSL_NO_BIO

   792 	BIO *rbio; /* used by SSL_read */

   793 	BIO *wbio; /* used by SSL_write */

   794 	BIO *bbio; /* used during session-id reuse to concatenate

   795 		    * messages */

   796 #else

   797 	char *rbio; /* used by SSL_read */

   798 	char *wbio; /* used by SSL_write */

   799 	char *bbio;

   800 #endif

   801 	/* This holds a variable that indicates what we were doing

   802 	 * when a 0 or -1 is returned.  This is needed for

   803 	 * non-blocking IO so we know what request needs re-doing when

   804 	 * in SSL_accept or SSL_connect */

   805 	int rwstate;

   806 

   807 	/* true when we are actually in SSL_accept() or SSL_connect() */

   808 	int in_handshake;

   809 	int (*handshake_func)();

   810 

   811 	/* Imagine that here's a boolean member "init" that is

   812 	 * switched as soon as SSL_set_{accept/connect}_state

   813 	 * is called for the first time, so that "state" and

   814 	 * "handshake_func" are properly initialized.  But as

   815 	 * handshake_func is == 0 until then, we use this

   816 	 * test instead of an "init" member.

   817 	 */

   818 

   819 	int server;	/* are we the server side? - mostly used by SSL_clear*/

   820 

   821 	int new_session;/* 1 if we are to use a new session.

   822 	                 * 2 if we are a server and are inside a handshake

   823 	                 *   (i.e. not just sending a HelloRequest)

   824 	                 * NB: For servers, the 'new' session may actually be a previously

   825 	                 * cached session or even the previous session unless

   826 	                 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */

   827 	int quiet_shutdown;/* don't send shutdown packets */

   828 	int shutdown;	/* we have shut things down, 0x01 sent, 0x02

   829 			 * for received */

   830 	int state;	/* where we are */

   831 	int rstate;	/* where we are when reading */

   832 

   833 	BUF_MEM *init_buf;	/* buffer used during init */

   834 	void *init_msg;   	/* pointer to handshake message body, set by ssl3_get_message() */

   835 	int init_num;		/* amount read/written */

   836 	int init_off;		/* amount read/written */

   837 

   838 	/* used internally to point at a raw packet */

   839 	unsigned char *packet;

   840 	unsigned int packet_length;

   841 

   842 	struct ssl2_state_st *s2; /* SSLv2 variables */

   843 	struct ssl3_state_st *s3; /* SSLv3 variables */

   844 

   845 	int read_ahead;		/* Read as many input bytes as possible

   846 	               	 	 * (for non-blocking reads) */

   847 

   848 	/* callback that allows applications to peek at protocol messages */

   849 	void (*msg_callback)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg);

   850 	void *msg_callback_arg;

   851 

   852 	int hit;		/* reusing a previous session */

   853 

   854 	int purpose;		/* Purpose setting */

   855 	int trust;		/* Trust setting */

   856 

   857 	/* crypto */

   858 	STACK_OF(SSL_CIPHER) *cipher_list;

   859 	STACK_OF(SSL_CIPHER) *cipher_list_by_id;

   860 

   861 	/* These are the ones being used, the ones in SSL_SESSION are

   862 	 * the ones to be 'copied' into these ones */

   863 

   864 	EVP_CIPHER_CTX *enc_read_ctx;		/* cryptographic state */

   865 	const EVP_MD *read_hash;		/* used for mac generation */

   866 #ifndef OPENSSL_NO_COMP

   867 	COMP_CTX *expand;			/* uncompress */

   868 #else

   869 	char *expand;

   870 #endif

   871 

   872 	EVP_CIPHER_CTX *enc_write_ctx;		/* cryptographic state */

   873 	const EVP_MD *write_hash;		/* used for mac generation */

   874 #ifndef OPENSSL_NO_COMP

   875 	COMP_CTX *compress;			/* compression */

   876 #else

   877 	char *compress;	

   878 #endif

   879 

   880 	/* session info */

   881 

   882 	/* client cert? */

   883 	/* This is used to hold the server certificate used */

   884 	struct cert_st /* CERT */ *cert;

   885 

   886 	/* the session_id_context is used to ensure sessions are only reused

   887 	 * in the appropriate context */

   888 	unsigned int sid_ctx_length;

   889 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

   890 

   891 	/* This can also be in the session once a session is established */

   892 	SSL_SESSION *session;

   893 

   894 	/* Default generate session ID callback. */

   895 	GEN_SESSION_CB generate_session_id;

   896 

   897 	/* Used in SSL2 and SSL3 */

   898 	int verify_mode;	/* 0 don't care about verify failure.

   899 				 * 1 fail if verify fails */

   900 	int verify_depth;

   901 	int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */

   902 

   903 	void (*info_callback)(const SSL *ssl,int type,int val); /* optional informational callback */

   904 

   905 	int error;		/* error bytes to be written */

   906 	int error_code;		/* actual code */

   907 

   908 #ifndef OPENSSL_NO_KRB5

   909 	KSSL_CTX *kssl_ctx;     /* Kerberos 5 context */

   910 #endif	/* OPENSSL_NO_KRB5 */

   911 

   912 	SSL_CTX *ctx;

   913 	/* set this flag to 1 and a sleep(1) is put into all SSL_read()

   914 	 * and SSL_write() calls, good for nbio debuging :-) */

   915 	int debug;	

   916 

   917 	/* extra application data */

   918 	long verify_result;

   919 	CRYPTO_EX_DATA ex_data;

   920 

   921 	/* for server side, keep the list of CA_dn we can use */

   922 	STACK_OF(X509_NAME) *client_CA;

   923 

   924 	int references;

   925 	unsigned long options; /* protocol behaviour */

   926 	unsigned long mode; /* API behaviour */

   927 	long max_cert_list;

   928 	int first_packet;

   929 	int client_version;	/* what was passed, used for

   930 				 * SSLv3/TLS rollback check */

   931 	};

   932 

   933 #ifdef __cplusplus

   934 }

   935 #endif

   936 

   937 #include <openssl/ssl2.h>

   938 #include <openssl/ssl3.h>

   939 #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */

   940 #include <openssl/ssl23.h>

   941 

   942 #ifdef  __cplusplus

   943 extern "C" {

   944 #endif

   945 

   946 /* compatibility */

   947 #define SSL_set_app_data(s,arg)		(SSL_set_ex_data(s,0,(char *)arg))

   948 #define SSL_get_app_data(s)		(SSL_get_ex_data(s,0))

   949 #define SSL_SESSION_set_app_data(s,a)	(SSL_SESSION_set_ex_data(s,0,(char *)a))

   950 #define SSL_SESSION_get_app_data(s)	(SSL_SESSION_get_ex_data(s,0))

   951 #define SSL_CTX_get_app_data(ctx)	(SSL_CTX_get_ex_data(ctx,0))

   952 #define SSL_CTX_set_app_data(ctx,arg)	(SSL_CTX_set_ex_data(ctx,0,(char *)arg))

   953 

   954 /* The following are the possible values for ssl->state are are

   955  * used to indicate where we are up to in the SSL connection establishment.

   956  * The macros that follow are about the only things you should need to use

   957  * and even then, only when using non-blocking IO.

   958  * It can also be useful to work out where you were when the connection

   959  * failed */

   960 

   961 #define SSL_ST_CONNECT			0x1000

   962 #define SSL_ST_ACCEPT			0x2000

   963 #define SSL_ST_MASK			0x0FFF

   964 #define SSL_ST_INIT			(SSL_ST_CONNECT|SSL_ST_ACCEPT)

   965 #define SSL_ST_BEFORE			0x4000

   966 #define SSL_ST_OK			0x03

   967 #define SSL_ST_RENEGOTIATE		(0x04|SSL_ST_INIT)

   968 

   969 #define SSL_CB_LOOP			0x01

   970 #define SSL_CB_EXIT			0x02

   971 #define SSL_CB_READ			0x04

   972 #define SSL_CB_WRITE			0x08

   973 #define SSL_CB_ALERT			0x4000 /* used in callback */

   974 #define SSL_CB_READ_ALERT		(SSL_CB_ALERT|SSL_CB_READ)

   975 #define SSL_CB_WRITE_ALERT		(SSL_CB_ALERT|SSL_CB_WRITE)

   976 #define SSL_CB_ACCEPT_LOOP		(SSL_ST_ACCEPT|SSL_CB_LOOP)

   977 #define SSL_CB_ACCEPT_EXIT		(SSL_ST_ACCEPT|SSL_CB_EXIT)

   978 #define SSL_CB_CONNECT_LOOP		(SSL_ST_CONNECT|SSL_CB_LOOP)

   979 #define SSL_CB_CONNECT_EXIT		(SSL_ST_CONNECT|SSL_CB_EXIT)

   980 #define SSL_CB_HANDSHAKE_START		0x10

   981 #define SSL_CB_HANDSHAKE_DONE		0x20

   982 

   983 /* Is the SSL_connection established? */

   984 #define SSL_get_state(a)		SSL_state(a)

   985 #define SSL_is_init_finished(a)		(SSL_state(a) == SSL_ST_OK)

   986 #define SSL_in_init(a)			(SSL_state(a)&SSL_ST_INIT)

   987 #define SSL_in_before(a)		(SSL_state(a)&SSL_ST_BEFORE)

   988 #define SSL_in_connect_init(a)		(SSL_state(a)&SSL_ST_CONNECT)

   989 #define SSL_in_accept_init(a)		(SSL_state(a)&SSL_ST_ACCEPT)

   990 

   991 /* The following 2 states are kept in ssl->rstate when reads fail,

   992  * you should not need these */

   993 #define SSL_ST_READ_HEADER			0xF0

   994 #define SSL_ST_READ_BODY			0xF1

   995 #define SSL_ST_READ_DONE			0xF2

   996 

   997 /* Obtain latest Finished message

   998  *   -- that we sent (SSL_get_finished)

   999  *   -- that we expected from peer (SSL_get_peer_finished).

  1000  * Returns length (0 == no Finished so far), copies up to 'count' bytes. */

  1001 size_t SSL_get_finished(SSL *s, void *buf, size_t count);

  1002 size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count);

  1003 

  1004 /* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options

  1005  * are 'ored' with SSL_VERIFY_PEER if they are desired */

  1006 #define SSL_VERIFY_NONE			0x00

  1007 #define SSL_VERIFY_PEER			0x01

  1008 #define SSL_VERIFY_FAIL_IF_NO_PEER_CERT	0x02

  1009 #define SSL_VERIFY_CLIENT_ONCE		0x04

  1010 

  1011 #define OpenSSL_add_ssl_algorithms()	SSL_library_init()

  1012 #define SSLeay_add_ssl_algorithms()	SSL_library_init()

  1013 

  1014 /* this is for backward compatibility */

  1015 #if 0 /* NEW_SSLEAY */

  1016 #define SSL_CTX_set_default_verify(a,b,c) SSL_CTX_set_verify(a,b,c)

  1017 #define SSL_set_pref_cipher(c,n)	SSL_set_cipher_list(c,n)

  1018 #define SSL_add_session(a,b)            SSL_CTX_add_session((a),(b))

  1019 #define SSL_remove_session(a,b)		SSL_CTX_remove_session((a),(b))

  1020 #define SSL_flush_sessions(a,b)		SSL_CTX_flush_sessions((a),(b))

  1021 #endif

  1022 /* More backward compatibility */

  1023 #define SSL_get_cipher(s) \

  1024 		SSL_CIPHER_get_name(SSL_get_current_cipher(s))

  1025 #define SSL_get_cipher_bits(s,np) \

  1026 		SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np)

  1027 #define SSL_get_cipher_version(s) \

  1028 		SSL_CIPHER_get_version(SSL_get_current_cipher(s))

  1029 #define SSL_get_cipher_name(s) \

  1030 		SSL_CIPHER_get_name(SSL_get_current_cipher(s))

  1031 #define SSL_get_time(a)		SSL_SESSION_get_time(a)

  1032 #define SSL_set_time(a,b)	SSL_SESSION_set_time((a),(b))

  1033 #define SSL_get_timeout(a)	SSL_SESSION_get_timeout(a)

  1034 #define SSL_set_timeout(a,b)	SSL_SESSION_set_timeout((a),(b))

  1035 

  1036 #if 1 /*SSLEAY_MACROS*/

  1037 #define d2i_SSL_SESSION_bio(bp,s_id) (SSL_SESSION *)ASN1_d2i_bio( \

  1038 	(char *(*)())SSL_SESSION_new,(char *(*)())d2i_SSL_SESSION, \

  1039 	(bp),(unsigned char **)(s_id))

  1040 #define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio(i2d_SSL_SESSION, \

  1041 	bp,(unsigned char *)s_id)

  1042 #define PEM_read_SSL_SESSION(fp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read( \

  1043 	(char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,fp,(char **)x,cb,u)

  1044 #define PEM_read_bio_SSL_SESSION(bp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read_bio( \

  1045 	(char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,(char **)x,cb,u)

  1046 #define PEM_write_SSL_SESSION(fp,x) \

  1047 	PEM_ASN1_write((int (*)())i2d_SSL_SESSION, \

  1048 		PEM_STRING_SSL_SESSION,fp, (char *)x, NULL,NULL,0,NULL,NULL)

  1049 #define PEM_write_bio_SSL_SESSION(bp,x) \

  1050 	PEM_ASN1_write_bio((int (*)())i2d_SSL_SESSION, \

  1051 		PEM_STRING_SSL_SESSION,bp, (char *)x, NULL,NULL,0,NULL,NULL)

  1052 #endif

  1053 

  1054 #define SSL_AD_REASON_OFFSET		1000

  1055 /* These alert types are for SSLv3 and TLSv1 */

  1056 #define SSL_AD_CLOSE_NOTIFY		SSL3_AD_CLOSE_NOTIFY

  1057 #define SSL_AD_UNEXPECTED_MESSAGE	SSL3_AD_UNEXPECTED_MESSAGE /* fatal */

  1058 #define SSL_AD_BAD_RECORD_MAC		SSL3_AD_BAD_RECORD_MAC     /* fatal */

  1059 #define SSL_AD_DECRYPTION_FAILED	TLS1_AD_DECRYPTION_FAILED

  1060 #define SSL_AD_RECORD_OVERFLOW		TLS1_AD_RECORD_OVERFLOW

  1061 #define SSL_AD_DECOMPRESSION_FAILURE	SSL3_AD_DECOMPRESSION_FAILURE/* fatal */

  1062 #define SSL_AD_HANDSHAKE_FAILURE	SSL3_AD_HANDSHAKE_FAILURE/* fatal */

  1063 #define SSL_AD_NO_CERTIFICATE		SSL3_AD_NO_CERTIFICATE /* Not for TLS */

  1064 #define SSL_AD_BAD_CERTIFICATE		SSL3_AD_BAD_CERTIFICATE

  1065 #define SSL_AD_UNSUPPORTED_CERTIFICATE	SSL3_AD_UNSUPPORTED_CERTIFICATE

  1066 #define SSL_AD_CERTIFICATE_REVOKED	SSL3_AD_CERTIFICATE_REVOKED

  1067 #define SSL_AD_CERTIFICATE_EXPIRED	SSL3_AD_CERTIFICATE_EXPIRED

  1068 #define SSL_AD_CERTIFICATE_UNKNOWN	SSL3_AD_CERTIFICATE_UNKNOWN

  1069 #define SSL_AD_ILLEGAL_PARAMETER	SSL3_AD_ILLEGAL_PARAMETER   /* fatal */

  1070 #define SSL_AD_UNKNOWN_CA		TLS1_AD_UNKNOWN_CA	/* fatal */

  1071 #define SSL_AD_ACCESS_DENIED		TLS1_AD_ACCESS_DENIED	/* fatal */

  1072 #define SSL_AD_DECODE_ERROR		TLS1_AD_DECODE_ERROR	/* fatal */

  1073 #define SSL_AD_DECRYPT_ERROR		TLS1_AD_DECRYPT_ERROR

  1074 #define SSL_AD_EXPORT_RESTRICTION	TLS1_AD_EXPORT_RESTRICTION/* fatal */

  1075 #define SSL_AD_PROTOCOL_VERSION		TLS1_AD_PROTOCOL_VERSION /* fatal */

  1076 #define SSL_AD_INSUFFICIENT_SECURITY	TLS1_AD_INSUFFICIENT_SECURITY/* fatal */

  1077 #define SSL_AD_INTERNAL_ERROR		TLS1_AD_INTERNAL_ERROR	/* fatal */

  1078 #define SSL_AD_USER_CANCELLED		TLS1_AD_USER_CANCELLED

  1079 #define SSL_AD_NO_RENEGOTIATION		TLS1_AD_NO_RENEGOTIATION

  1080 

  1081 #define SSL_ERROR_NONE			0

  1082 #define SSL_ERROR_SSL			1

  1083 #define SSL_ERROR_WANT_READ		2

  1084 #define SSL_ERROR_WANT_WRITE		3

  1085 #define SSL_ERROR_WANT_X509_LOOKUP	4

  1086 #define SSL_ERROR_SYSCALL		5 /* look at error stack/return value/errno */

  1087 #define SSL_ERROR_ZERO_RETURN		6

  1088 #define SSL_ERROR_WANT_CONNECT		7

  1089 #define SSL_ERROR_WANT_ACCEPT		8

  1090 

  1091 #define SSL_CTRL_NEED_TMP_RSA			1

  1092 #define SSL_CTRL_SET_TMP_RSA			2

  1093 #define SSL_CTRL_SET_TMP_DH			3

  1094 #define SSL_CTRL_SET_TMP_RSA_CB			4

  1095 #define SSL_CTRL_SET_TMP_DH_CB			5

  1096 

  1097 #define SSL_CTRL_GET_SESSION_REUSED		6

  1098 #define SSL_CTRL_GET_CLIENT_CERT_REQUEST	7

  1099 #define SSL_CTRL_GET_NUM_RENEGOTIATIONS		8

  1100 #define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS	9

  1101 #define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS	10

  1102 #define SSL_CTRL_GET_FLAGS			11

  1103 #define SSL_CTRL_EXTRA_CHAIN_CERT		12

  1104 

  1105 #define SSL_CTRL_SET_MSG_CALLBACK               13

  1106 #define SSL_CTRL_SET_MSG_CALLBACK_ARG           14

  1107 

  1108 /* Stats */

  1109 #define SSL_CTRL_SESS_NUMBER			20

  1110 #define SSL_CTRL_SESS_CONNECT			21

  1111 #define SSL_CTRL_SESS_CONNECT_GOOD		22

  1112 #define SSL_CTRL_SESS_CONNECT_RENEGOTIATE	23

  1113 #define SSL_CTRL_SESS_ACCEPT			24

  1114 #define SSL_CTRL_SESS_ACCEPT_GOOD		25

  1115 #define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE	26

  1116 #define SSL_CTRL_SESS_HIT			27

  1117 #define SSL_CTRL_SESS_CB_HIT			28

  1118 #define SSL_CTRL_SESS_MISSES			29

  1119 #define SSL_CTRL_SESS_TIMEOUTS			30

  1120 #define SSL_CTRL_SESS_CACHE_FULL		31

  1121 #define SSL_CTRL_OPTIONS			32

  1122 #define SSL_CTRL_MODE				33

  1123 

  1124 #define SSL_CTRL_GET_READ_AHEAD			40

  1125 #define SSL_CTRL_SET_READ_AHEAD			41

  1126 #define SSL_CTRL_SET_SESS_CACHE_SIZE		42

  1127 #define SSL_CTRL_GET_SESS_CACHE_SIZE		43

  1128 #define SSL_CTRL_SET_SESS_CACHE_MODE		44

  1129 #define SSL_CTRL_GET_SESS_CACHE_MODE		45

  1130 

  1131 #define SSL_CTRL_GET_MAX_CERT_LIST		50

  1132 #define SSL_CTRL_SET_MAX_CERT_LIST		51

  1133 

  1134 #define SSL_session_reused(ssl) \

  1135 	SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL)