1 /* $OpenBSD: tls_internal.h,v 1.78 2021/01/21 19:09:10 eric Exp $ */ 2 /* 3 * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org> 4 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #ifndef HEADER_TLS_INTERNAL_H 20 #define HEADER_TLS_INTERNAL_H 21 22 #include <pthread.h> 23 24 #include <arpa/inet.h> 25 #include <netinet/in.h> 26 27 #include <openssl/ssl.h> 28 29 __BEGIN_HIDDEN_DECLS 30 31 #ifndef TLS_DEFAULT_CA_FILE 32 #define TLS_DEFAULT_CA_FILE "/etc/ssl/cert.pem" 33 #endif 34 35 #define TLS_CIPHERS_DEFAULT "TLSv1.3:TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE" 36 #define TLS_CIPHERS_COMPAT "HIGH:!aNULL" 37 #define TLS_CIPHERS_LEGACY "HIGH:MEDIUM:!aNULL" 38 #define TLS_CIPHERS_ALL "ALL:!aNULL:!eNULL" 39 40 #define TLS_ECDHE_CURVES "X25519,P-256,P-384" 41 42 union tls_addr { 43 struct in_addr ip4; 44 struct in6_addr ip6; 45 }; 46 47 struct tls_error { 48 char *msg; 49 int num; 50 int tls; 51 }; 52 53 struct tls_keypair { 54 struct tls_keypair *next; 55 56 char *cert_mem; 57 size_t cert_len; 58 char *key_mem; 59 size_t key_len; 60 char *ocsp_staple; 61 size_t ocsp_staple_len; 62 char *pubkey_hash; 63 }; 64 65 #define TLS_MIN_SESSION_TIMEOUT (4) 66 #define TLS_MAX_SESSION_TIMEOUT (24 * 60 * 60) 67 68 #define TLS_NUM_TICKETS 4 69 #define TLS_TICKET_NAME_SIZE 16 70 #define TLS_TICKET_AES_SIZE 32 71 #define TLS_TICKET_HMAC_SIZE 16 72 73 struct tls_ticket_key { 74 /* The key_name must be 16 bytes according to -lssl */ 75 unsigned char key_name[TLS_TICKET_NAME_SIZE]; 76 unsigned char aes_key[TLS_TICKET_AES_SIZE]; 77 unsigned char hmac_key[TLS_TICKET_HMAC_SIZE]; 78 time_t time; 79 }; 80 81 struct tls_config { 82 struct tls_error error; 83 84 pthread_mutex_t mutex; 85 int refcount; 86 87 char *alpn; 88 size_t alpn_len; 89 const char *ca_path; 90 char *ca_mem; 91 size_t ca_len; 92 const char *ciphers; 93 int ciphers_server; 94 char *crl_mem; 95 size_t crl_len; 96 int dheparams; 97 int *ecdhecurves; 98 size_t ecdhecurves_len; 99 struct tls_keypair *keypair; 100 int ocsp_require_stapling; 101 uint32_t protocols; 102 unsigned char session_id[TLS_MAX_SESSION_ID_LENGTH]; 103 int session_fd; 104 int session_lifetime; 105 struct tls_ticket_key ticket_keys[TLS_NUM_TICKETS]; 106 uint32_t ticket_keyrev; 107 int ticket_autorekey; 108 int verify_cert; 109 int verify_client; 110 int verify_depth; 111 int verify_name; 112 int verify_time; 113 int skip_private_key_check; 114 int use_fake_private_key; 115 }; 116 117 struct tls_conninfo { 118 char *alpn; 119 char *cipher; 120 int cipher_strength; 121 char *servername; 122 int session_resumed; 123 char *version; 124 125 char *hash; 126 char *issuer; 127 char *subject; 128 129 uint8_t *peer_cert; 130 size_t peer_cert_len; 131 132 time_t notbefore; 133 time_t notafter; 134 }; 135 136 #define TLS_CLIENT (1 << 0) 137 #define TLS_SERVER (1 << 1) 138 #define TLS_SERVER_CONN (1 << 2) 139 140 #define TLS_EOF_NO_CLOSE_NOTIFY (1 << 0) 141 #define TLS_CONNECTED (1 << 1) 142 #define TLS_HANDSHAKE_COMPLETE (1 << 2) 143 #define TLS_SSL_NEEDS_SHUTDOWN (1 << 3) 144 145 struct tls_ocsp_result { 146 const char *result_msg; 147 int response_status; 148 int cert_status; 149 int crl_reason; 150 time_t this_update; 151 time_t next_update; 152 time_t revocation_time; 153 }; 154 155 struct tls_ocsp { 156 /* responder location */ 157 char *ocsp_url; 158 159 /* cert data, this struct does not own these */ 160 X509 *main_cert; 161 STACK_OF(X509) *extra_certs; 162 163 struct tls_ocsp_result *ocsp_result; 164 }; 165 166 struct tls_sni_ctx { 167 struct tls_sni_ctx *next; 168 169 struct tls_keypair *keypair; 170 171 SSL_CTX *ssl_ctx; 172 X509 *ssl_cert; 173 }; 174 175 struct tls { 176 struct tls_config *config; 177 struct tls_keypair *keypair; 178 179 struct tls_error error; 180 181 uint32_t flags; 182 uint32_t state; 183 184 char *servername; 185 int socket; 186 187 SSL *ssl_conn; 188 SSL_CTX *ssl_ctx; 189 190 struct tls_sni_ctx *sni_ctx; 191 192 X509 *ssl_peer_cert; 193 STACK_OF(X509) *ssl_peer_chain; 194 195 struct tls_conninfo *conninfo; 196 197 struct tls_ocsp *ocsp; 198 199 tls_read_cb read_cb; 200 tls_write_cb write_cb; 201 void *cb_arg; 202 }; 203 204 int tls_set_mem(char **_dest, size_t *_destlen, const void *_src, 205 size_t _srclen); 206 int tls_set_string(const char **_dest, const char *_src); 207 208 struct tls_keypair *tls_keypair_new(void); 209 void tls_keypair_clear_key(struct tls_keypair *_keypair); 210 void tls_keypair_free(struct tls_keypair *_keypair); 211 int tls_keypair_set_cert_file(struct tls_keypair *_keypair, 212 struct tls_error *_error, const char *_cert_file); 213 int tls_keypair_set_cert_mem(struct tls_keypair *_keypair, 214 struct tls_error *_error, const uint8_t *_cert, size_t _len); 215 int tls_keypair_set_key_file(struct tls_keypair *_keypair, 216 struct tls_error *_error, const char *_key_file); 217 int tls_keypair_set_key_mem(struct tls_keypair *_keypair, 218 struct tls_error *_error, const uint8_t *_key, size_t _len); 219 int tls_keypair_set_ocsp_staple_file(struct tls_keypair *_keypair, 220 struct tls_error *_error, const char *_ocsp_file); 221 int tls_keypair_set_ocsp_staple_mem(struct tls_keypair *_keypair, 222 struct tls_error *_error, const uint8_t *_staple, size_t _len); 223 int tls_keypair_load_cert(struct tls_keypair *_keypair, 224 struct tls_error *_error, X509 **_cert); 225 226 struct tls_sni_ctx *tls_sni_ctx_new(void); 227 void tls_sni_ctx_free(struct tls_sni_ctx *sni_ctx); 228 229 struct tls_config *tls_config_new_internal(void); 230 231 struct tls *tls_new(void); 232 struct tls *tls_server_conn(struct tls *ctx); 233 234 int tls_check_name(struct tls *ctx, X509 *cert, const char *servername, 235 int *match); 236 int tls_configure_server(struct tls *ctx); 237 238 int tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx); 239 int tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx, 240 struct tls_keypair *keypair, int required); 241 int tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify); 242 243 int tls_handshake_client(struct tls *ctx); 244 int tls_handshake_server(struct tls *ctx); 245 246 int tls_config_load_file(struct tls_error *error, const char *filetype, 247 const char *filename, char **buf, size_t *len); 248 int tls_config_ticket_autorekey(struct tls_config *config); 249 int tls_host_port(const char *hostport, char **host, char **port); 250 251 int tls_set_cbs(struct tls *ctx, 252 tls_read_cb read_cb, tls_write_cb write_cb, void *cb_arg); 253 254 void tls_error_clear(struct tls_error *error); 255 int tls_error_set(struct tls_error *error, const char *fmt, ...) 256 __attribute__((__format__ (printf, 2, 3))) 257 __attribute__((__nonnull__ (2))); 258 int tls_error_setx(struct tls_error *error, const char *fmt, ...) 259 __attribute__((__format__ (printf, 2, 3))) 260 __attribute__((__nonnull__ (2))); 261 int tls_config_set_error(struct tls_config *cfg, const char *fmt, ...) 262 __attribute__((__format__ (printf, 2, 3))) 263 __attribute__((__nonnull__ (2))); 264 int tls_config_set_errorx(struct tls_config *cfg, const char *fmt, ...) 265 __attribute__((__format__ (printf, 2, 3))) 266 __attribute__((__nonnull__ (2))); 267 int tls_set_error(struct tls *ctx, const char *fmt, ...) 268 __attribute__((__format__ (printf, 2, 3))) 269 __attribute__((__nonnull__ (2))); 270 int tls_set_errorx(struct tls *ctx, const char *fmt, ...) 271 __attribute__((__format__ (printf, 2, 3))) 272 __attribute__((__nonnull__ (2))); 273 int tls_set_ssl_errorx(struct tls *ctx, const char *fmt, ...) 274 __attribute__((__format__ (printf, 2, 3))) 275 __attribute__((__nonnull__ (2))); 276 277 int tls_ssl_error(struct tls *ctx, SSL *ssl_conn, int ssl_ret, 278 const char *prefix); 279 280 int tls_conninfo_populate(struct tls *ctx); 281 void tls_conninfo_free(struct tls_conninfo *conninfo); 282 283 int tls_ocsp_verify_cb(SSL *ssl, void *arg); 284 int tls_ocsp_stapling_cb(SSL *ssl, void *arg); 285 void tls_ocsp_free(struct tls_ocsp *ctx); 286 struct tls_ocsp *tls_ocsp_setup_from_peer(struct tls *ctx); 287 int tls_hex_string(const unsigned char *_in, size_t _inlen, char **_out, 288 size_t *_outlen); 289 int tls_cert_hash(X509 *_cert, char **_hash); 290 int tls_cert_pubkey_hash(X509 *_cert, char **_hash); 291 292 int tls_password_cb(char *_buf, int _size, int _rwflag, void *_u); 293 294 __END_HIDDEN_DECLS 295 296 /* XXX this function is not fully hidden so relayd can use it */ 297 void tls_config_skip_private_key_check(struct tls_config *config); 298 void tls_config_use_fake_private_key(struct tls_config *config); 299 300 #endif /* HEADER_TLS_INTERNAL_H */ 301