xref: /openbsd/lib/libssl/ssl_local.h (revision 4fb9ab68)
1 /* $OpenBSD: ssl_local.h,v 1.21 2024/07/20 04:04:23 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer.
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113  * ECC cipher suite support in OpenSSL originally developed by
114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
115  */
116 /* ====================================================================
117  * Copyright 2005 Nokia. All rights reserved.
118  *
119  * The portions of the attached software ("Contribution") is developed by
120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
121  * license.
122  *
123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
125  * support (see RFC 4279) to OpenSSL.
126  *
127  * No patent licenses or other rights except those expressly stated in
128  * the OpenSSL open source license shall be deemed granted or received
129  * expressly, by implication, estoppel, or otherwise.
130  *
131  * No assurances are provided by Nokia that the Contribution does not
132  * infringe the patent or other intellectual property rights of any third
133  * party or that the license provides you with all the necessary rights
134  * to make use of the Contribution.
135  *
136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
140  * OTHERWISE.
141  */
142 
143 #ifndef HEADER_SSL_LOCL_H
144 #define HEADER_SSL_LOCL_H
145 
146 #include <sys/types.h>
147 
148 #include <errno.h>
149 #include <stdlib.h>
150 #include <string.h>
151 #include <time.h>
152 #include <unistd.h>
153 
154 #include <openssl/opensslconf.h>
155 
156 #include <openssl/bio.h>
157 #include <openssl/buffer.h>
158 #include <openssl/dsa.h>
159 #include <openssl/err.h>
160 #include <openssl/rsa.h>
161 #include <openssl/ssl.h>
162 #include <openssl/stack.h>
163 
164 #include "bytestring.h"
165 #include "tls_content.h"
166 #include "tls13_internal.h"
167 
168 __BEGIN_HIDDEN_DECLS
169 
170 #ifndef CTASSERT
171 #define CTASSERT(x)	extern char  _ctassert[(x) ? 1 : -1 ]   \
172 			    __attribute__((__unused__))
173 #endif
174 
175 #ifndef LIBRESSL_HAS_DTLS1_2
176 #define LIBRESSL_HAS_DTLS1_2
177 #endif
178 
179 /* LOCAL STUFF */
180 
181 #define SSL_DECRYPT	0
182 #define SSL_ENCRYPT	1
183 
184 /*
185  * Define the Bitmasks for SSL_CIPHER.algorithms.
186  * This bits are used packed as dense as possible. If new methods/ciphers
187  * etc will be added, the bits a likely to change, so this information
188  * is for internal library use only, even though SSL_CIPHER.algorithms
189  * can be publicly accessed.
190  * Use the according functions for cipher management instead.
191  *
192  * The bit mask handling in the selection and sorting scheme in
193  * ssl_create_cipher_list() has only limited capabilities, reflecting
194  * that the different entities within are mutually exclusive:
195  * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
196  */
197 
198 /* Bits for algorithm_mkey (key exchange algorithm) */
199 #define SSL_kRSA		0x00000001L /* RSA key exchange */
200 #define SSL_kDHE		0x00000008L /* tmp DH key no DH cert */
201 #define SSL_kECDHE		0x00000080L /* ephemeral ECDH */
202 #define SSL_kTLS1_3		0x00000400L /* TLSv1.3 key exchange */
203 
204 /* Bits for algorithm_auth (server authentication) */
205 #define SSL_aRSA		0x00000001L /* RSA auth */
206 #define SSL_aDSS		0x00000002L /* DSS auth */
207 #define SSL_aNULL		0x00000004L /* no auth (i.e. use ADH or AECDH) */
208 #define SSL_aECDSA              0x00000040L /* ECDSA auth*/
209 #define SSL_aTLS1_3		0x00000400L /* TLSv1.3 authentication */
210 
211 /* Bits for algorithm_enc (symmetric encryption) */
212 #define SSL_DES			0x00000001L
213 #define SSL_3DES		0x00000002L
214 #define SSL_RC4			0x00000004L
215 #define SSL_IDEA		0x00000008L
216 #define SSL_eNULL		0x00000010L
217 #define SSL_AES128		0x00000020L
218 #define SSL_AES256		0x00000040L
219 #define SSL_CAMELLIA128		0x00000080L
220 #define SSL_CAMELLIA256		0x00000100L
221 #define SSL_AES128GCM		0x00000400L
222 #define SSL_AES256GCM		0x00000800L
223 #define SSL_CHACHA20POLY1305	0x00001000L
224 
225 #define SSL_AES			(SSL_AES128|SSL_AES256|SSL_AES128GCM|SSL_AES256GCM)
226 #define SSL_CAMELLIA		(SSL_CAMELLIA128|SSL_CAMELLIA256)
227 
228 
229 /* Bits for algorithm_mac (symmetric authentication) */
230 
231 #define SSL_MD5			0x00000001L
232 #define SSL_SHA1		0x00000002L
233 #define SSL_SHA256		0x00000010L
234 #define SSL_SHA384		0x00000020L
235 /* Not a real MAC, just an indication it is part of cipher */
236 #define SSL_AEAD		0x00000040L
237 #define SSL_STREEBOG256		0x00000080L
238 
239 /* Bits for algorithm_ssl (protocol version) */
240 #define SSL_SSLV3		0x00000002L
241 #define SSL_TLSV1		SSL_SSLV3	/* for now */
242 #define SSL_TLSV1_2		0x00000004L
243 #define SSL_TLSV1_3		0x00000008L
244 
245 
246 /* Bits for algorithm2 (handshake digests and other extra flags) */
247 
248 #define SSL_HANDSHAKE_MAC_MASK		0xff0
249 #define SSL_HANDSHAKE_MAC_SHA256	0x080
250 #define SSL_HANDSHAKE_MAC_SHA384	0x100
251 
252 #define SSL3_CK_ID		0x03000000
253 #define SSL3_CK_VALUE_MASK	0x0000ffff
254 
255 /*
256  * Cipher strength information.
257  */
258 #define SSL_STRONG_MASK		0x000001fcL
259 #define SSL_STRONG_NONE		0x00000004L
260 #define SSL_LOW			0x00000020L
261 #define SSL_MEDIUM		0x00000040L
262 #define SSL_HIGH		0x00000080L
263 
264 /*
265  * The keylength (measured in RSA key bits, I guess)  for temporary keys.
266  * Cipher argument is so that this can be variable in the future.
267  */
268 #define SSL_C_PKEYLENGTH(c)	1024
269 
270 /* See if we use signature algorithms extension. */
271 #define SSL_USE_SIGALGS(s) \
272 	(s->method->enc_flags & SSL_ENC_FLAG_SIGALGS)
273 
274 /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */
275 #define SSL_USE_TLS1_2_CIPHERS(s) \
276 	(s->method->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)
277 
278 /* Allow TLS 1.3 ciphersuites only. */
279 #define SSL_USE_TLS1_3_CIPHERS(s) \
280 	(s->method->enc_flags & SSL_ENC_FLAG_TLS1_3_CIPHERS)
281 
282 #define SSL_PKEY_RSA		0
283 #define SSL_PKEY_ECC		1
284 #define SSL_PKEY_NUM		2
285 
286 #define SSL_MAX_EMPTY_RECORDS	32
287 
288 /* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) |
289  *	    <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN)
290  * SSL_kDH  <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN)
291  * SSL_kDHE <- RSA_ENC | RSA_SIGN | DSA_SIGN
292  * SSL_aRSA <- RSA_ENC | RSA_SIGN
293  * SSL_aDSS <- DSA_SIGN
294  */
295 
296 /* From ECC-TLS draft, used in encoding the curve type in
297  * ECParameters
298  */
299 #define EXPLICIT_PRIME_CURVE_TYPE  1
300 #define EXPLICIT_CHAR2_CURVE_TYPE  2
301 #define NAMED_CURVE_TYPE           3
302 
303 typedef struct ssl_cert_pkey_st {
304 	X509 *x509;
305 	EVP_PKEY *privatekey;
306 	STACK_OF(X509) *chain;
307 } SSL_CERT_PKEY;
308 
309 typedef struct ssl_cert_st {
310 	/* Current active set */
311 	/* ALWAYS points to an element of the pkeys array
312 	 * Probably it would make more sense to store
313 	 * an index, not a pointer. */
314 	SSL_CERT_PKEY *key;
315 
316 	SSL_CERT_PKEY pkeys[SSL_PKEY_NUM];
317 
318 	/* The following masks are for the key and auth
319 	 * algorithms that are supported by the certs below */
320 	int valid;
321 	unsigned long mask_k;
322 	unsigned long mask_a;
323 
324 	DH *dhe_params;
325 	DH *(*dhe_params_cb)(SSL *ssl, int is_export, int keysize);
326 	int dhe_params_auto;
327 
328 	int (*security_cb)(const SSL *s, const SSL_CTX *ctx, int op, int bits,
329 	    int nid, void *other, void *ex_data); /* Not exposed in API. */
330 	int security_level;
331 	void *security_ex_data; /* Not exposed in API. */
332 
333 	int references; /* >1 only if SSL_copy_session_id is used */
334 } SSL_CERT;
335 
336 struct ssl_comp_st {
337 	int id;
338 	const char *name;
339 };
340 
341 struct ssl_cipher_st {
342 	int valid;
343 	const char *name;		/* text name */
344 	unsigned long id;		/* id, 4 bytes, first is version */
345 
346 	unsigned long algorithm_mkey;	/* key exchange algorithm */
347 	unsigned long algorithm_auth;	/* server authentication */
348 	unsigned long algorithm_enc;	/* symmetric encryption */
349 	unsigned long algorithm_mac;	/* symmetric authentication */
350 	unsigned long algorithm_ssl;	/* (major) protocol version */
351 
352 	unsigned long algo_strength;	/* strength and export flags */
353 	unsigned long algorithm2;	/* Extra flags */
354 	int strength_bits;		/* Number of bits really used */
355 	int alg_bits;			/* Number of bits for algorithm */
356 };
357 
358 struct ssl_method_st {
359 	int dtls;
360 	int server;
361 	int version;
362 
363 	uint16_t min_tls_version;
364 	uint16_t max_tls_version;
365 
366 	int (*ssl_new)(SSL *s);
367 	void (*ssl_clear)(SSL *s);
368 	void (*ssl_free)(SSL *s);
369 
370 	int (*ssl_accept)(SSL *s);
371 	int (*ssl_connect)(SSL *s);
372 	int (*ssl_shutdown)(SSL *s);
373 
374 	int (*ssl_renegotiate)(SSL *s);
375 	int (*ssl_renegotiate_check)(SSL *s);
376 
377 	int (*ssl_pending)(const SSL *s);
378 	int (*ssl_read_bytes)(SSL *s, int type, unsigned char *buf, int len,
379 	    int peek);
380 	int (*ssl_write_bytes)(SSL *s, int type, const void *buf_, int len);
381 
382 	const SSL_CIPHER *(*get_cipher)(unsigned int ncipher);
383 
384 	unsigned int enc_flags;		/* SSL_ENC_FLAG_* */
385 };
386 
387 /*
388  * Let's make this into an ASN.1 type structure as follows
389  * SSL_SESSION_ID ::= SEQUENCE {
390  *	version			INTEGER,	-- structure version number
391  *	SSLversion		INTEGER,	-- SSL version number
392  *	Cipher			OCTET STRING,	-- the 2 byte cipher ID
393  *	Session_ID		OCTET STRING,	-- the Session ID
394  *	Master_key		OCTET STRING,	-- the master key
395  *	KRB5_principal		OCTET STRING	-- optional Kerberos principal
396  *	Time [ 1 ] EXPLICIT	INTEGER,	-- optional Start Time
397  *	Timeout [ 2 ] EXPLICIT	INTEGER,	-- optional Timeout ins seconds
398  *	Peer [ 3 ] EXPLICIT	X509,		-- optional Peer Certificate
399  *	Session_ID_context [ 4 ] EXPLICIT OCTET STRING,   -- the Session ID context
400  *	Verify_result [ 5 ] EXPLICIT INTEGER,   -- X509_V_... code for `Peer'
401  *	HostName [ 6 ] EXPLICIT OCTET STRING,   -- optional HostName from servername TLS extension
402  *	PSK_identity_hint [ 7 ] EXPLICIT OCTET STRING, -- optional PSK identity hint
403  *	PSK_identity [ 8 ] EXPLICIT OCTET STRING,  -- optional PSK identity
404  *	Ticket_lifetime_hint [9] EXPLICIT INTEGER, -- server's lifetime hint for session ticket
405  *	Ticket [10]             EXPLICIT OCTET STRING, -- session ticket (clients only)
406  *	Compression_meth [11]   EXPLICIT OCTET STRING, -- optional compression method
407  *	SRP_username [ 12 ] EXPLICIT OCTET STRING -- optional SRP username
408  * }
409  * Look in ssl/ssl_asn1.c for more details
410  * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
411  */
412 struct ssl_session_st {
413 	int ssl_version;	/* what ssl version session info is
414 				 * being kept in here? */
415 
416 	size_t master_key_length;
417 	unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
418 
419 	/* session_id - valid? */
420 	size_t session_id_length;
421 	unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
422 
423 	/* this is used to determine whether the session is being reused in
424 	 * the appropriate context. It is up to the application to set this,
425 	 * via SSL_new */
426 	size_t sid_ctx_length;
427 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
428 
429 	/* Peer provided leaf (end-entity) certificate. */
430 	X509 *peer_cert;
431 	int peer_cert_type;
432 
433 	/* when app_verify_callback accepts a session where the peer's certificate
434 	 * is not ok, we must remember the error for session reuse: */
435 	long verify_result; /* only for servers */
436 
437 	long timeout;
438 	time_t time;
439 	int references;
440 
441 	unsigned long cipher_id;	/* when ASN.1 loaded, this
442 					 * needs to be used to load
443 					 * the 'cipher' structure */
444 
445 	char *tlsext_hostname;
446 
447 	/* Session resumption - RFC 5077 and RFC 8446. */
448 	unsigned char *tlsext_tick;		/* Session ticket */
449 	size_t tlsext_ticklen;			/* Session ticket length */
450 	uint32_t tlsext_tick_lifetime_hint;	/* Session lifetime hint in seconds */
451 	uint32_t tlsext_tick_age_add; /* TLSv1.3 ticket age obfuscation (in ms) */
452 	struct tls13_secret resumption_master_secret;
453 
454 	CRYPTO_EX_DATA ex_data; /* application specific data */
455 
456 	/* These are used to make removal of session-ids more
457 	 * efficient and to implement a maximum cache size. */
458 	struct ssl_session_st *prev, *next;
459 
460 	/* Used to indicate that session resumption is not allowed.
461 	 * Applications can also set this bit for a new session via
462 	 * not_resumable_session_cb to disable session caching and tickets. */
463 	int not_resumable;
464 
465 	size_t tlsext_ecpointformatlist_length;
466 	uint8_t *tlsext_ecpointformatlist; /* peer's list */
467 	size_t tlsext_supportedgroups_length;
468 	uint16_t *tlsext_supportedgroups; /* peer's list */
469 };
470 
471 struct ssl_sigalg;
472 
473 typedef struct ssl_handshake_tls12_st {
474 	/* Used when SSL_ST_FLUSH_DATA is entered. */
475 	int next_state;
476 
477 	/* Handshake message type and size. */
478 	int message_type;
479 	unsigned long message_size;
480 
481 	/* Reuse current handshake message. */
482 	int reuse_message;
483 
484 	/* Client certificate requests. */
485 	int cert_request;
486 	STACK_OF(X509_NAME) *ca_names;
487 
488 	/* Record-layer key block for TLS 1.2 and earlier. */
489 	struct tls12_key_block *key_block;
490 
491 	/* Transcript hash prior to sending certificate verify message. */
492 	uint8_t cert_verify[EVP_MAX_MD_SIZE];
493 } SSL_HANDSHAKE_TLS12;
494 
495 typedef struct ssl_handshake_tls13_st {
496 	int use_legacy;
497 	int hrr;
498 
499 	/* Client indicates psk_dhe_ke support in PskKeyExchangeMode. */
500 	int use_psk_dhe_ke;
501 
502 	/* Certificate selected for use (static pointer). */
503 	const SSL_CERT_PKEY *cpk;
504 
505 	/* Version proposed by peer server. */
506 	uint16_t server_version;
507 
508 	uint16_t server_group;
509 	struct tls13_secrets *secrets;
510 
511 	uint8_t *cookie;
512 	size_t cookie_len;
513 
514 	/* Preserved transcript hash. */
515 	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
516 	size_t transcript_hash_len;
517 
518 	/* Legacy session ID. */
519 	uint8_t legacy_session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
520 	size_t legacy_session_id_len;
521 
522 	/* ClientHello hash, used to validate following HelloRetryRequest */
523 	EVP_MD_CTX *clienthello_md_ctx;
524 	unsigned char *clienthello_hash;
525 	unsigned int clienthello_hash_len;
526 
527 	/* QUIC read buffer and read/write encryption levels. */
528 	struct tls_buffer *quic_read_buffer;
529 	enum ssl_encryption_level_t quic_read_level;
530 	enum ssl_encryption_level_t quic_write_level;
531 } SSL_HANDSHAKE_TLS13;
532 
533 typedef struct ssl_handshake_st {
534 	/*
535 	 * Minimum and maximum versions supported for this handshake. These are
536 	 * initialised at the start of a handshake based on the method in use
537 	 * and the current protocol version configuration.
538 	 */
539 	uint16_t our_min_tls_version;
540 	uint16_t our_max_tls_version;
541 
542 	/*
543 	 * Version negotiated for this session. For a client this is set once
544 	 * the server selected version is parsed from the ServerHello (either
545 	 * from the legacy version or supported versions extension). For a
546 	 * server this is set once we select the version we will use with the
547 	 * client.
548 	 */
549 	uint16_t negotiated_tls_version;
550 
551 	/*
552 	 * Legacy version advertised by our peer. For a server this is the
553 	 * version specified by the client in the ClientHello message. For a
554 	 * client, this is the version provided in the ServerHello message.
555 	 */
556 	uint16_t peer_legacy_version;
557 
558 	/*
559 	 * Current handshake state - contains one of the SSL3_ST_* values and
560 	 * is used by the TLSv1.2 state machine, as well as being updated by
561 	 * the TLSv1.3 stack due to it being exposed externally.
562 	 */
563 	int state;
564 
565 	/* Cipher being negotiated in this handshake. */
566 	const SSL_CIPHER *cipher;
567 
568 	/* Ciphers sent by the client. */
569 	STACK_OF(SSL_CIPHER) *client_ciphers;
570 
571 	/* Extensions seen in this handshake. */
572 	uint32_t extensions_seen;
573 
574 	/* Extensions processed in this handshake. */
575 	uint32_t extensions_processed;
576 
577 	/* Signature algorithms selected for use (static pointers). */
578 	const struct ssl_sigalg *our_sigalg;
579 	const struct ssl_sigalg *peer_sigalg;
580 
581 	/* sigalgs offered in this handshake in wire form */
582 	uint8_t *sigalgs;
583 	size_t sigalgs_len;
584 
585 	/* Key share for ephemeral key exchange. */
586 	struct tls_key_share *key_share;
587 
588 	/*
589 	 * Copies of the verify data sent in our finished message and the
590 	 * verify data received in the finished message sent by our peer.
591 	 */
592 	uint8_t finished[EVP_MAX_MD_SIZE];
593 	size_t finished_len;
594 	uint8_t peer_finished[EVP_MAX_MD_SIZE];
595 	size_t peer_finished_len;
596 
597 	/* List of certificates received from our peer. */
598 	STACK_OF(X509) *peer_certs;
599 	STACK_OF(X509) *peer_certs_no_leaf;
600 
601 	/* Certificate chain resulting from X.509 verification. */
602 	STACK_OF(X509) *verified_chain;
603 
604 	SSL_HANDSHAKE_TLS12 tls12;
605 	SSL_HANDSHAKE_TLS13 tls13;
606 } SSL_HANDSHAKE;
607 
608 typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;
609 
610 /* TLS Session Ticket extension struct. */
611 struct tls_session_ticket_ext_st {
612 	unsigned short length;
613 	void *data;
614 };
615 
616 struct tls12_key_block;
617 
618 struct tls12_key_block *tls12_key_block_new(void);
619 void tls12_key_block_free(struct tls12_key_block *kb);
620 void tls12_key_block_client_write(struct tls12_key_block *kb, CBS *mac_key,
621     CBS *key, CBS *iv);
622 void tls12_key_block_server_write(struct tls12_key_block *kb, CBS *mac_key,
623     CBS *key, CBS *iv);
624 int tls12_key_block_generate(struct tls12_key_block *kb, SSL *s,
625     const EVP_AEAD *aead, const EVP_CIPHER *cipher, const EVP_MD *mac_hash);
626 
627 struct tls12_record_layer;
628 
629 struct tls12_record_layer *tls12_record_layer_new(void);
630 void tls12_record_layer_free(struct tls12_record_layer *rl);
631 void tls12_record_layer_alert(struct tls12_record_layer *rl,
632     uint8_t *alert_desc);
633 int tls12_record_layer_write_overhead(struct tls12_record_layer *rl,
634     size_t *overhead);
635 int tls12_record_layer_read_protected(struct tls12_record_layer *rl);
636 int tls12_record_layer_write_protected(struct tls12_record_layer *rl);
637 void tls12_record_layer_set_aead(struct tls12_record_layer *rl,
638     const EVP_AEAD *aead);
639 void tls12_record_layer_set_cipher_hash(struct tls12_record_layer *rl,
640     const EVP_CIPHER *cipher, const EVP_MD *handshake_hash,
641     const EVP_MD *mac_hash);
642 void tls12_record_layer_set_version(struct tls12_record_layer *rl,
643     uint16_t version);
644 void tls12_record_layer_set_initial_epoch(struct tls12_record_layer *rl,
645     uint16_t epoch);
646 uint16_t tls12_record_layer_read_epoch(struct tls12_record_layer *rl);
647 uint16_t tls12_record_layer_write_epoch(struct tls12_record_layer *rl);
648 int tls12_record_layer_use_write_epoch(struct tls12_record_layer *rl,
649     uint16_t epoch);
650 void tls12_record_layer_write_epoch_done(struct tls12_record_layer *rl,
651     uint16_t epoch);
652 void tls12_record_layer_clear_read_state(struct tls12_record_layer *rl);
653 void tls12_record_layer_clear_write_state(struct tls12_record_layer *rl);
654 void tls12_record_layer_reflect_seq_num(struct tls12_record_layer *rl);
655 int tls12_record_layer_change_read_cipher_state(struct tls12_record_layer *rl,
656     CBS *mac_key, CBS *key, CBS *iv);
657 int tls12_record_layer_change_write_cipher_state(struct tls12_record_layer *rl,
658     CBS *mac_key, CBS *key, CBS *iv);
659 int tls12_record_layer_open_record(struct tls12_record_layer *rl,
660     uint8_t *buf, size_t buf_len, struct tls_content *out);
661 int tls12_record_layer_seal_record(struct tls12_record_layer *rl,
662     uint8_t content_type, const uint8_t *content, size_t content_len,
663     CBB *out);
664 
665 typedef void (ssl_info_callback_fn)(const SSL *s, int type, int val);
666 typedef void (ssl_msg_callback_fn)(int is_write, int version, int content_type,
667     const void *buf, size_t len, SSL *ssl, void *arg);
668 
669 struct ssl_ctx_st {
670 	const SSL_METHOD *method;
671 	const SSL_QUIC_METHOD *quic_method;
672 
673 	STACK_OF(SSL_CIPHER) *cipher_list;
674 
675 	struct x509_store_st /* X509_STORE */ *cert_store;
676 
677 	/* If timeout is not 0, it is the default timeout value set
678 	 * when SSL_new() is called.  This has been put in to make
679 	 * life easier to set things up */
680 	long session_timeout;
681 
682 	int references;
683 
684 	/* Default values to use in SSL structures follow (these are copied by SSL_new) */
685 
686 	STACK_OF(X509) *extra_certs;
687 
688 	int verify_mode;
689 	size_t sid_ctx_length;
690 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
691 
692 	X509_VERIFY_PARAM *param;
693 
694 	/*
695 	 * XXX
696 	 * default_passwd_cb used by python and openvpn, need to keep it until we
697 	 * add an accessor
698 	 */
699 	/* Default password callback. */
700 	pem_password_cb *default_passwd_callback;
701 
702 	/* Default password callback user data. */
703 	void *default_passwd_callback_userdata;
704 
705 	uint16_t min_tls_version;
706 	uint16_t max_tls_version;
707 
708 	/*
709 	 * These may be zero to imply minimum or maximum version supported by
710 	 * the method.
711 	 */
712 	uint16_t min_proto_version;
713 	uint16_t max_proto_version;
714 
715 	unsigned long options;
716 	unsigned long mode;
717 
718 	/* If this callback is not null, it will be called each
719 	 * time a session id is added to the cache.  If this function
720 	 * returns 1, it means that the callback will do a
721 	 * SSL_SESSION_free() when it has finished using it.  Otherwise,
722 	 * on 0, it means the callback has finished with it.
723 	 * If remove_session_cb is not null, it will be called when
724 	 * a session-id is removed from the cache.  After the call,
725 	 * OpenSSL will SSL_SESSION_free() it. */
726 	int (*new_session_cb)(struct ssl_st *ssl, SSL_SESSION *sess);
727 	void (*remove_session_cb)(struct ssl_ctx_st *ctx, SSL_SESSION *sess);
728 	SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl,
729 	    const unsigned char *data, int len, int *copy);
730 
731 	/* if defined, these override the X509_verify_cert() calls */
732 	int (*app_verify_callback)(X509_STORE_CTX *, void *);
733 	    void *app_verify_arg;
734 
735 	/* get client cert callback */
736 	int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
737 
738 	/* cookie generate callback */
739 	int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie,
740 	    unsigned int *cookie_len);
741 
742 	/* verify cookie callback */
743 	int (*app_verify_cookie_cb)(SSL *ssl, const unsigned char *cookie,
744 	    unsigned int cookie_len);
745 
746 	ssl_info_callback_fn *info_callback;
747 
748 	/* callback that allows applications to peek at protocol messages */
749 	ssl_msg_callback_fn *msg_callback;
750 	void *msg_callback_arg;
751 
752 	int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx); /* called 'verify_callback' in the SSL */
753 
754 	/* Default generate session ID callback. */
755 	GEN_SESSION_CB generate_session_id;
756 
757 	/* TLS extensions servername callback */
758 	int (*tlsext_servername_callback)(SSL*, int *, void *);
759 	void *tlsext_servername_arg;
760 
761 	/* Callback to support customisation of ticket key setting */
762 	int (*tlsext_ticket_key_cb)(SSL *ssl, unsigned char *name,
763 	    unsigned char *iv, EVP_CIPHER_CTX *ectx, HMAC_CTX *hctx, int enc);
764 
765 	/* certificate status request info */
766 	/* Callback for status request */
767 	int (*tlsext_status_cb)(SSL *ssl, void *arg);
768 	void *tlsext_status_arg;
769 
770 	struct lhash_st_SSL_SESSION *sessions;
771 
772 	/* Most session-ids that will be cached, default is
773 	 * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited. */
774 	unsigned long session_cache_size;
775 	struct ssl_session_st *session_cache_head;
776 	struct ssl_session_st *session_cache_tail;
777 
778 	/* This can have one of 2 values, ored together,
779 	 * SSL_SESS_CACHE_CLIENT,
780 	 * SSL_SESS_CACHE_SERVER,
781 	 * Default is SSL_SESSION_CACHE_SERVER, which means only
782 	 * SSL_accept which cache SSL_SESSIONS. */
783 	int session_cache_mode;
784 
785 	struct {
786 		int sess_connect;	/* SSL new conn - started */
787 		int sess_connect_renegotiate;/* SSL reneg - requested */
788 		int sess_connect_good;	/* SSL new conne/reneg - finished */
789 		int sess_accept;	/* SSL new accept - started */
790 		int sess_accept_renegotiate;/* SSL reneg - requested */
791 		int sess_accept_good;	/* SSL accept/reneg - finished */
792 		int sess_miss;		/* session lookup misses  */
793 		int sess_timeout;	/* reuse attempt on timeouted session */
794 		int sess_cache_full;	/* session removed due to full cache */
795 		int sess_hit;		/* session reuse actually done */
796 		int sess_cb_hit;	/* session-id that was not
797 					 * in the cache was
798 					 * passed back via the callback.  This
799 					 * indicates that the application is
800 					 * supplying session-id's from other
801 					 * processes - spooky :-) */
802 	} stats;
803 
804 	CRYPTO_EX_DATA ex_data;
805 
806 	STACK_OF(SSL_CIPHER) *cipher_list_tls13;
807 
808 	SSL_CERT *cert;
809 
810 	/* Default values used when no per-SSL value is defined follow */
811 
812 	/* what we put in client cert requests */
813 	STACK_OF(X509_NAME) *client_CA;
814 
815 	long max_cert_list;
816 
817 	int read_ahead;
818 
819 	int quiet_shutdown;
820 
821 	/* Maximum amount of data to send in one fragment.
822 	 * actual record size can be more than this due to
823 	 * padding and MAC overheads.
824 	 */
825 	unsigned int max_send_fragment;
826 
827 	/* RFC 4507 session ticket keys */
828 	unsigned char tlsext_tick_key_name[16];
829 	unsigned char tlsext_tick_hmac_key[16];
830 	unsigned char tlsext_tick_aes_key[16];
831 
832 	/* SRTP profiles we are willing to do from RFC 5764 */
833 	STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
834 
835 	/*
836 	 * ALPN information.
837 	 */
838 
839 	/*
840 	 * Server callback function that allows the server to select the
841 	 * protocol for the connection.
842 	 *   out: on successful return, this must point to the raw protocol
843 	 *       name (without the length prefix).
844 	 *   outlen: on successful return, this contains the length of out.
845 	 *   in: points to the client's list of supported protocols in
846 	 *       wire-format.
847 	 *   inlen: the length of in.
848 	 */
849 	int (*alpn_select_cb)(SSL *s, const unsigned char **out,
850 	    unsigned char *outlen, const unsigned char *in, unsigned int inlen,
851 	    void *arg);
852 	void *alpn_select_cb_arg;
853 
854 	/* Client list of supported protocols in wire format. */
855 	uint8_t *alpn_client_proto_list;
856 	size_t alpn_client_proto_list_len;
857 
858 	size_t tlsext_ecpointformatlist_length;
859 	uint8_t *tlsext_ecpointformatlist; /* our list */
860 	size_t tlsext_supportedgroups_length;
861 	uint16_t *tlsext_supportedgroups; /* our list */
862 	SSL_CTX_keylog_cb_func keylog_callback; /* Unused. For OpenSSL compatibility. */
863 	size_t num_tickets; /* Unused, for OpenSSL compatibility */
864 };
865 
866 struct ssl_st {
867 	/* protocol version
868 	 * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION, DTLS1_VERSION)
869 	 */
870 	int version;
871 
872 	const SSL_METHOD *method;
873 	const SSL_QUIC_METHOD *quic_method;
874 
875 	/* There are 2 BIO's even though they are normally both the
876 	 * same.  This is so data can be read and written to different
877 	 * handlers */
878 
879 	BIO *rbio; /* used by SSL_read */
880 	BIO *wbio; /* used by SSL_write */
881 	BIO *bbio; /* used during session-id reuse to concatenate
882 		    * messages */
883 	int server;	/* are we the server side? - mostly used by SSL_clear*/
884 
885 	struct ssl3_state_st *s3; /* SSLv3 variables */
886 	struct dtls1_state_st *d1; /* DTLSv1 variables */
887 
888 	X509_VERIFY_PARAM *param;
889 
890 	/* crypto */
891 	STACK_OF(SSL_CIPHER) *cipher_list;
892 
893 	/* This is used to hold the server certificate used */
894 	SSL_CERT *cert;
895 
896 	/* the session_id_context is used to ensure sessions are only reused
897 	 * in the appropriate context */
898 	size_t sid_ctx_length;
899 	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
900 
901 	/* This can also be in the session once a session is established */
902 	SSL_SESSION *session;
903 
904 	/* Used in SSL2 and SSL3 */
905 	int verify_mode;	/* 0 don't care about verify failure.
906 				 * 1 fail if verify fails */
907 	int error;		/* error bytes to be written */
908 	int error_code;		/* actual code */
909 
910 	SSL_CTX *ctx;
911 
912 	long verify_result;
913 
914 	int references;
915 
916 	int client_version;	/* what was passed, used for
917 				 * SSLv3/TLS rollback check */
918 
919 	unsigned int max_send_fragment;
920 
921 	const struct tls_extension **tlsext_build_order;
922 	size_t tlsext_build_order_len;
923 
924 	char *tlsext_hostname;
925 
926 	/* certificate status request info */
927 	/* Status type or -1 if no status type */
928 	int tlsext_status_type;
929 
930 	SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
931 #define session_ctx initial_ctx
932 
933 	struct tls13_ctx *tls13;
934 
935 	uint16_t min_tls_version;
936 	uint16_t max_tls_version;
937 
938 	/*
939 	 * These may be zero to imply minimum or maximum version supported by
940 	 * the method.
941 	 */
942 	uint16_t min_proto_version;
943 	uint16_t max_proto_version;
944 
945 	unsigned long options; /* protocol behaviour */
946 	unsigned long mode; /* API behaviour */
947 
948 	/* Client list of supported protocols in wire format. */
949 	uint8_t *alpn_client_proto_list;
950 	size_t alpn_client_proto_list_len;
951 
952 	/* QUIC transport params we will send */
953 	uint8_t *quic_transport_params;
954 	size_t quic_transport_params_len;
955 
956 	/* XXX Callbacks */
957 
958 	/* true when we are actually in SSL_accept() or SSL_connect() */
959 	int in_handshake;
960 	int (*handshake_func)(SSL *);
961 
962 	ssl_info_callback_fn *info_callback;
963 
964 	/* callback that allows applications to peek at protocol messages */
965 	ssl_msg_callback_fn *msg_callback;
966 	void *msg_callback_arg;
967 
968 	int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */
969 
970 	/* Default generate session ID callback. */
971 	GEN_SESSION_CB generate_session_id;
972 
973 	/* TLS extension debug callback */
974 	void (*tlsext_debug_cb)(SSL *s, int client_server, int type,
975 	    unsigned char *data, int len, void *arg);
976 	void *tlsext_debug_arg;
977 
978 	/* TLS Session Ticket extension callback */
979 	tls_session_ticket_ext_cb_fn tls_session_ticket_ext_cb;
980 	void *tls_session_ticket_ext_cb_arg;
981 
982 	/* TLS pre-shared secret session resumption */
983 	tls_session_secret_cb_fn tls_session_secret_cb;
984 	void *tls_session_secret_cb_arg;
985 
986 	/* XXX non-callback */
987 
988 	/* This holds a variable that indicates what we were doing
989 	 * when a 0 or -1 is returned.  This is needed for
990 	 * non-blocking IO so we know what request needs re-doing when
991 	 * in SSL_accept or SSL_connect */
992 	int rwstate;
993 
994 	/* Imagine that here's a boolean member "init" that is
995 	 * switched as soon as SSL_set_{accept/connect}_state
996 	 * is called for the first time, so that "state" and
997 	 * "handshake_func" are properly initialized.  But as
998 	 * handshake_func is == 0 until then, we use this
999 	 * test instead of an "init" member.
1000 	 */
1001 
1002 	int new_session;/* Generate a new session or reuse an old one.
1003 			 * NB: For servers, the 'new' session may actually be a previously
1004 			 * cached session or even the previous session unless
1005 			 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */
1006 	int quiet_shutdown;/* don't send shutdown packets */
1007 	int shutdown;	/* we have shut things down, 0x01 sent, 0x02
1008 			 * for received */
1009 	BUF_MEM *init_buf;	/* buffer used during init */
1010 	void *init_msg;		/* pointer to handshake message body, set by ssl3_get_message() */
1011 	int init_num;		/* amount read/written */
1012 	int init_off;		/* amount read/written */
1013 
1014 	/* used internally to point at a raw packet */
1015 	unsigned char *packet;
1016 	unsigned int packet_length;
1017 
1018 	int read_ahead;		/* Read as many input bytes as possible
1019 				 * (for non-blocking reads) */
1020 
1021 	int hit;		/* reusing a previous session */
1022 
1023 	STACK_OF(SSL_CIPHER) *cipher_list_tls13;
1024 
1025 	struct tls12_record_layer *rl;
1026 
1027 	/* session info */
1028 
1029 	/* extra application data */
1030 	CRYPTO_EX_DATA ex_data;
1031 
1032 	/* client cert? */
1033 	/* for server side, keep the list of CA_dn we can use */
1034 	STACK_OF(X509_NAME) *client_CA;
1035 
1036 	long max_cert_list;
1037 	int first_packet;
1038 
1039 	/* Expect OCSP CertificateStatus message */
1040 	int tlsext_status_expected;
1041 	/* OCSP status request only */
1042 	STACK_OF(OCSP_RESPID) *tlsext_ocsp_ids;
1043 	X509_EXTENSIONS *tlsext_ocsp_exts;
1044 
1045 	/* OCSP response received or to be sent */
1046 	unsigned char *tlsext_ocsp_resp;
1047 	size_t tlsext_ocsp_resp_len;
1048 
1049 	/* RFC4507 session ticket expected to be received or sent */
1050 	int tlsext_ticket_expected;
1051 
1052 	size_t tlsext_ecpointformatlist_length;
1053 	uint8_t *tlsext_ecpointformatlist; /* our list */
1054 	size_t tlsext_supportedgroups_length;
1055 	uint16_t *tlsext_supportedgroups; /* our list */
1056 
1057 	/* TLS Session Ticket extension override */
1058 	TLS_SESSION_TICKET_EXT *tlsext_session_ticket;
1059 
1060 	STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;	/* What we'll do */
1061 	const SRTP_PROTECTION_PROFILE *srtp_profile;		/* What's been chosen */
1062 
1063 	int renegotiate;/* 1 if we are renegotiating.
1064 			 * 2 if we are a server and are inside a handshake
1065 	                 * (i.e. not just sending a HelloRequest) */
1066 
1067 	int rstate;	/* where we are when reading */
1068 
1069 	int mac_packet;
1070 
1071 	int empty_record_count;
1072 
1073 	size_t num_tickets; /* Unused, for OpenSSL compatibility */
1074 };
1075 
1076 typedef struct ssl3_record_internal_st {
1077 	int type;               /* type of record */
1078 	unsigned int length;    /* How many bytes available */
1079 	unsigned int padding_length; /* Number of padding bytes. */
1080 	unsigned int off;       /* read/write offset into 'buf' */
1081 	unsigned char *data;    /* pointer to the record data */
1082 	unsigned char *input;   /* where the decode bytes are */
1083 	uint16_t epoch;		/* epoch number, needed by DTLS1 */
1084 	unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */
1085 } SSL3_RECORD_INTERNAL;
1086 
1087 typedef struct ssl3_buffer_internal_st {
1088 	unsigned char *buf;	/* at least SSL3_RT_MAX_PACKET_SIZE bytes,
1089 	                         * see ssl3_setup_buffers() */
1090 	size_t len;		/* buffer size */
1091 	int offset;		/* where to 'copy from' */
1092 	int left;		/* how many bytes left */
1093 } SSL3_BUFFER_INTERNAL;
1094 
1095 typedef struct ssl3_state_st {
1096 	long flags;
1097 
1098 	unsigned char server_random[SSL3_RANDOM_SIZE];
1099 	unsigned char client_random[SSL3_RANDOM_SIZE];
1100 
1101 	SSL3_BUFFER_INTERNAL rbuf;	/* read IO goes into here */
1102 	SSL3_BUFFER_INTERNAL wbuf;	/* write IO goes into here */
1103 
1104 	SSL3_RECORD_INTERNAL rrec;	/* each decoded record goes in here */
1105 
1106 	struct tls_content *rcontent;	/* Content from opened TLS records. */
1107 
1108 	/* we allow one fatal and one warning alert to be outstanding,
1109 	 * send close alert via the warning alert */
1110 	int alert_dispatch;
1111 	unsigned char send_alert[2];
1112 
1113 	/* flags for countermeasure against known-IV weakness */
1114 	int need_empty_fragments;
1115 	int empty_fragment_done;
1116 
1117 	/* Unprocessed Alert/Handshake protocol data. */
1118 	struct tls_buffer *alert_fragment;
1119 	struct tls_buffer *handshake_fragment;
1120 
1121 	/* partial write - check the numbers match */
1122 	unsigned int wnum;	/* number of bytes sent so far */
1123 	int wpend_tot;		/* number bytes written */
1124 	int wpend_type;
1125 	int wpend_ret;		/* number of bytes submitted */
1126 	const unsigned char *wpend_buf;
1127 
1128 	/* Transcript of handshake messages that have been sent and received. */
1129 	struct tls_buffer *handshake_transcript;
1130 
1131 	/* Rolling hash of handshake messages. */
1132 	EVP_MD_CTX *handshake_hash;
1133 
1134 	/* this is set whenerver we see a change_cipher_spec message
1135 	 * come in when we are not looking for one */
1136 	int change_cipher_spec;
1137 
1138 	int warn_alert;
1139 	int fatal_alert;
1140 
1141 	/* This flag is set when we should renegotiate ASAP, basically when
1142 	 * there is no more data in the read or write buffers */
1143 	int renegotiate;
1144 	int total_renegotiations;
1145 	int num_renegotiations;
1146 
1147 	int in_read_app_data;
1148 
1149 	SSL_HANDSHAKE hs;
1150 
1151 	/* Connection binding to prevent renegotiation attacks */
1152 	unsigned char previous_client_finished[EVP_MAX_MD_SIZE];
1153 	unsigned char previous_client_finished_len;
1154 	unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
1155 	unsigned char previous_server_finished_len;
1156 	int send_connection_binding; /* TODOEKR */
1157 
1158 	/* Set if we saw a Renegotiation Indication extension from our peer. */
1159 	int renegotiate_seen;
1160 
1161 	/*
1162 	 * ALPN information.
1163 	 *
1164 	 * In a server these point to the selected ALPN protocol after the
1165 	 * ClientHello has been processed. In a client these contain the
1166 	 * protocol that the server selected once the ServerHello has been
1167 	 * processed.
1168 	 */
1169 	uint8_t *alpn_selected;
1170 	size_t alpn_selected_len;
1171 
1172 	/* Contains the QUIC transport params received from our peer. */
1173 	uint8_t *peer_quic_transport_params;
1174 	size_t peer_quic_transport_params_len;
1175 } SSL3_STATE;
1176 
1177 /*
1178  * Flag values for enc_flags.
1179  */
1180 
1181 /* Uses signature algorithms extension. */
1182 #define SSL_ENC_FLAG_SIGALGS            (1 << 1)
1183 
1184 /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */
1185 #define SSL_ENC_FLAG_TLS1_2_CIPHERS     (1 << 4)
1186 
1187 /* Allow TLS 1.3 ciphersuites only. */
1188 #define SSL_ENC_FLAG_TLS1_3_CIPHERS     (1 << 5)
1189 
1190 #define TLSV1_ENC_FLAGS		0
1191 #define TLSV1_1_ENC_FLAGS	0
1192 #define TLSV1_2_ENC_FLAGS	(SSL_ENC_FLAG_SIGALGS		| \
1193 				 SSL_ENC_FLAG_TLS1_2_CIPHERS)
1194 #define TLSV1_3_ENC_FLAGS	(SSL_ENC_FLAG_SIGALGS		| \
1195 				 SSL_ENC_FLAG_TLS1_3_CIPHERS)
1196 
1197 extern const SSL_CIPHER ssl3_ciphers[];
1198 
1199 const char *ssl_version_string(int ver);
1200 int ssl_version_set_min(const SSL_METHOD *meth, uint16_t proto_ver,
1201     uint16_t max_tls_ver, uint16_t *out_tls_ver, uint16_t *out_proto_ver);
1202 int ssl_version_set_max(const SSL_METHOD *meth, uint16_t proto_ver,
1203     uint16_t min_tls_ver, uint16_t *out_tls_ver, uint16_t *out_proto_ver);
1204 int ssl_enabled_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver);
1205 int ssl_supported_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver);
1206 uint16_t ssl_tls_version(uint16_t version);
1207 uint16_t ssl_effective_tls_version(SSL *s);
1208 int ssl_max_supported_version(SSL *s, uint16_t *max_ver);
1209 int ssl_max_legacy_version(SSL *s, uint16_t *max_ver);
1210 int ssl_max_shared_version(SSL *s, uint16_t peer_ver, uint16_t *max_ver);
1211 int ssl_check_version_from_server(SSL *s, uint16_t server_version);
1212 int ssl_legacy_stack_version(SSL *s, uint16_t version);
1213 int ssl_cipher_in_list(STACK_OF(SSL_CIPHER) *ciphers, const SSL_CIPHER *cipher);
1214 int ssl_cipher_allowed_in_tls_version_range(const SSL_CIPHER *cipher,
1215     uint16_t min_ver, uint16_t max_ver);
1216 
1217 const SSL_METHOD *tls_legacy_method(void);
1218 const SSL_METHOD *ssl_get_method(uint16_t version);
1219 
1220 void ssl_clear_cipher_state(SSL *s);
1221 int ssl_clear_bad_session(SSL *s);
1222 
1223 void ssl_info_callback(const SSL *s, int type, int value);
1224 void ssl_msg_callback(SSL *s, int is_write, int content_type,
1225     const void *msg_buf, size_t msg_len);
1226 void ssl_msg_callback_cbs(SSL *s, int is_write, int content_type, CBS *cbs);
1227 
1228 SSL_CERT *ssl_cert_new(void);
1229 SSL_CERT *ssl_cert_dup(SSL_CERT *cert);
1230 void ssl_cert_free(SSL_CERT *c);
1231 SSL_CERT *ssl_get0_cert(SSL_CTX *ctx, SSL *ssl);
1232 int ssl_cert_set0_chain(SSL_CTX *ctx, SSL *ssl, STACK_OF(X509) *chain);
1233 int ssl_cert_set1_chain(SSL_CTX *ctx, SSL *ssl, STACK_OF(X509) *chain);
1234 int ssl_cert_add0_chain_cert(SSL_CTX *ctx, SSL *ssl, X509 *cert);
1235 int ssl_cert_add1_chain_cert(SSL_CTX *ctx, SSL *ssl, X509 *cert);
1236 
1237 int ssl_security_default_cb(const SSL *ssl, const SSL_CTX *ctx, int op,
1238     int bits, int nid, void *other, void *ex_data);
1239 
1240 int ssl_security_cipher_check(const SSL *ssl, SSL_CIPHER *cipher);
1241 int ssl_security_shared_cipher(const SSL *ssl, SSL_CIPHER *cipher);
1242 int ssl_security_supported_cipher(const SSL *ssl, SSL_CIPHER *cipher);
1243 int ssl_ctx_security_dh(const SSL_CTX *ctx, DH *dh);
1244 int ssl_security_dh(const SSL *ssl, DH *dh);
1245 int ssl_security_sigalg_check(const SSL *ssl, const EVP_PKEY *pkey);
1246 int ssl_security_tickets(const SSL *ssl);
1247 int ssl_security_version(const SSL *ssl, int version);
1248 int ssl_security_cert(const SSL_CTX *ctx, const SSL *ssl, X509 *x509,
1249     int is_peer, int *out_error);
1250 int ssl_security_cert_chain(const SSL *ssl, STACK_OF(X509) *sk,
1251     X509 *x509, int *out_error);
1252 int ssl_security_shared_group(const SSL *ssl, uint16_t group_id);
1253 int ssl_security_supported_group(const SSL *ssl, uint16_t group_id);
1254 
1255 SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int include_ticket);
1256 int ssl_get_new_session(SSL *s, int session);
1257 int ssl_get_prev_session(SSL *s, CBS *session_id, CBS *ext_block,
1258     int *alert);
1259 int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *ciphers, CBB *cbb);
1260 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s, CBS *cbs);
1261 STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,
1262     STACK_OF(SSL_CIPHER) **pref, STACK_OF(SSL_CIPHER) *tls13,
1263     const char *rule_str, SSL_CERT *cert);
1264 int ssl_parse_ciphersuites(STACK_OF(SSL_CIPHER) **out_ciphers, const char *str);
1265 int ssl_merge_cipherlists(STACK_OF(SSL_CIPHER) *cipherlist,
1266     STACK_OF(SSL_CIPHER) *cipherlist_tls13,
1267     STACK_OF(SSL_CIPHER) **out_cipherlist);
1268 void ssl_update_cache(SSL *s, int mode);
1269 int ssl_cipher_get_evp(SSL *s, const EVP_CIPHER **enc,
1270     const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size);
1271 int ssl_cipher_get_evp_aead(SSL *s, const EVP_AEAD **aead);
1272 int ssl_get_handshake_evp_md(SSL *s, const EVP_MD **md);
1273 
1274 int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk);
1275 int ssl_undefined_function(SSL *s);
1276 int ssl_undefined_void_function(void);
1277 int ssl_undefined_const_function(const SSL *s);
1278 SSL_CERT_PKEY *ssl_get_server_send_pkey(const SSL *s);
1279 EVP_PKEY *ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *c, const EVP_MD **pmd,
1280     const struct ssl_sigalg **sap);
1281 size_t ssl_dhe_params_auto_key_bits(SSL *s);
1282 int ssl_cert_type(EVP_PKEY *pkey);
1283 void ssl_set_cert_masks(SSL_CERT *c, const SSL_CIPHER *cipher);
1284 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
1285 int ssl_has_ecc_ciphers(SSL *s);
1286 int ssl_verify_alarm_type(long type);
1287 
1288 int SSL_SESSION_ticket(SSL_SESSION *ss, unsigned char **out, size_t *out_len);
1289 
1290 int ssl3_do_write(SSL *s, int type);
1291 int ssl3_send_alert(SSL *s, int level, int desc);
1292 int ssl3_get_req_cert_types(SSL *s, CBB *cbb);
1293 int ssl3_get_message(SSL *s, int st1, int stn, int mt, long max);
1294 int ssl3_num_ciphers(void);
1295 const SSL_CIPHER *ssl3_get_cipher(unsigned int u);
1296 const SSL_CIPHER *ssl3_get_cipher_by_id(unsigned long id);
1297 const SSL_CIPHER *ssl3_get_cipher_by_value(uint16_t value);
1298 uint16_t ssl3_cipher_get_value(const SSL_CIPHER *c);
1299 int ssl3_renegotiate(SSL *ssl);
1300 
1301 int ssl3_renegotiate_check(SSL *ssl);
1302 
1303 void ssl_force_want_read(SSL *s);
1304 
1305 int ssl3_dispatch_alert(SSL *s);
1306 int ssl3_read_alert(SSL *s);
1307 int ssl3_read_change_cipher_spec(SSL *s);
1308 int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek);
1309 int ssl3_write_bytes(SSL *s, int type, const void *buf, int len);
1310 int ssl3_output_cert_chain(SSL *s, CBB *cbb, SSL_CERT_PKEY *cpk);
1311 SSL_CIPHER *ssl3_choose_cipher(SSL *ssl, STACK_OF(SSL_CIPHER) *clnt,
1312     STACK_OF(SSL_CIPHER) *srvr);
1313 int	ssl3_setup_buffers(SSL *s);
1314 int	ssl3_setup_init_buffer(SSL *s);
1315 void ssl3_release_init_buffer(SSL *s);
1316 int	ssl3_setup_read_buffer(SSL *s);
1317 int	ssl3_setup_write_buffer(SSL *s);
1318 void ssl3_release_buffer(SSL3_BUFFER_INTERNAL *b);
1319 void ssl3_release_read_buffer(SSL *s);
1320 void ssl3_release_write_buffer(SSL *s);
1321 int	ssl3_new(SSL *s);
1322 void	ssl3_free(SSL *s);
1323 int	ssl3_accept(SSL *s);
1324 int	ssl3_connect(SSL *s);
1325 int	ssl3_read(SSL *s, void *buf, int len);
1326 int	ssl3_peek(SSL *s, void *buf, int len);
1327 int	ssl3_write(SSL *s, const void *buf, int len);
1328 int	ssl3_shutdown(SSL *s);
1329 void	ssl3_clear(SSL *s);
1330 long	ssl3_ctrl(SSL *s, int cmd, long larg, void *parg);
1331 long	ssl3_ctx_ctrl(SSL_CTX *s, int cmd, long larg, void *parg);
1332 long	ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void));
1333 long	ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp)(void));
1334 int	ssl3_pending(const SSL *s);
1335 
1336 int ssl3_handshake_msg_hdr_len(SSL *s);
1337 int ssl3_handshake_msg_start(SSL *s, CBB *handshake, CBB *body,
1338     uint8_t msg_type);
1339 int ssl3_handshake_msg_finish(SSL *s, CBB *handshake);
1340 int ssl3_handshake_write(SSL *s);
1341 int ssl3_record_write(SSL *s, int type);
1342 
1343 int ssl3_do_change_cipher_spec(SSL *ssl);
1344 
1345 int ssl3_packet_read(SSL *s, int plen);
1346 int ssl3_packet_extend(SSL *s, int plen);
1347 int ssl_server_legacy_first_packet(SSL *s);
1348 int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
1349     unsigned int len);
1350 
1351 int ssl_kex_generate_dhe(DH *dh, DH *dh_params);
1352 int ssl_kex_generate_dhe_params_auto(DH *dh, size_t key_len);
1353 int ssl_kex_params_dhe(DH *dh, CBB *cbb);
1354 int ssl_kex_public_dhe(DH *dh, CBB *cbb);
1355 int ssl_kex_peer_params_dhe(DH *dh, CBS *cbs, int *decode_error,
1356     int *invalid_params);
1357 int ssl_kex_peer_public_dhe(DH *dh, CBS *cbs, int *decode_error,
1358     int *invalid_key);
1359 int ssl_kex_derive_dhe(DH *dh, DH *dh_peer,
1360     uint8_t **shared_key, size_t *shared_key_len);
1361 
1362 int ssl_kex_dummy_ecdhe_x25519(EVP_PKEY *pkey);
1363 int ssl_kex_generate_ecdhe_ecp(EC_KEY *ecdh, int nid);
1364 int ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb);
1365 int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs);
1366 int ssl_kex_derive_ecdhe_ecp(EC_KEY *ecdh, EC_KEY *ecdh_peer,
1367     uint8_t **shared_key, size_t *shared_key_len);
1368 
1369 int tls1_new(SSL *s);
1370 void tls1_free(SSL *s);
1371 void tls1_clear(SSL *s);
1372 
1373 int ssl_init_wbio_buffer(SSL *s, int push);
1374 void ssl_free_wbio_buffer(SSL *s);
1375 
1376 int tls1_transcript_hash_init(SSL *s);
1377 int tls1_transcript_hash_update(SSL *s, const unsigned char *buf, size_t len);
1378 int tls1_transcript_hash_value(SSL *s, unsigned char *out, size_t len,
1379     size_t *outlen);
1380 void tls1_transcript_hash_free(SSL *s);
1381 
1382 int tls1_transcript_init(SSL *s);
1383 void tls1_transcript_free(SSL *s);
1384 void tls1_transcript_reset(SSL *s);
1385 int tls1_transcript_append(SSL *s, const unsigned char *buf, size_t len);
1386 int tls1_transcript_data(SSL *s, const unsigned char **data, size_t *len);
1387 void tls1_transcript_freeze(SSL *s);
1388 void tls1_transcript_unfreeze(SSL *s);
1389 int tls1_transcript_record(SSL *s, const unsigned char *buf, size_t len);
1390 
1391 int tls1_PRF(SSL *s, const unsigned char *secret, size_t secret_len,
1392     const void *seed1, size_t seed1_len, const void *seed2, size_t seed2_len,
1393     const void *seed3, size_t seed3_len, const void *seed4, size_t seed4_len,
1394     const void *seed5, size_t seed5_len, unsigned char *out, size_t out_len);
1395 
1396 void tls1_cleanup_key_block(SSL *s);
1397 int tls1_change_read_cipher_state(SSL *s);
1398 int tls1_change_write_cipher_state(SSL *s);
1399 int tls1_setup_key_block(SSL *s);
1400 int tls1_generate_key_block(SSL *s, uint8_t *key_block, size_t key_block_len);
1401 int ssl_ok(SSL *s);
1402 
1403 int tls12_derive_finished(SSL *s);
1404 int tls12_derive_peer_finished(SSL *s);
1405 int tls12_derive_master_secret(SSL *s, uint8_t *premaster_secret,
1406     size_t premaster_secret_len);
1407 
1408 int ssl_using_ecc_cipher(SSL *s);
1409 int ssl_check_srvr_ecc_cert_and_alg(SSL *s, X509 *x);
1410 
1411 void tls1_get_formatlist(const SSL *s, int client_formats,
1412     const uint8_t **pformats, size_t *pformatslen);
1413 void tls1_get_group_list(const SSL *s, int client_groups,
1414     const uint16_t **pgroups, size_t *pgroupslen);
1415 
1416 int tls1_set_groups(uint16_t **out_group_ids, size_t *out_group_ids_len,
1417     const int *groups, size_t ngroups);
1418 int tls1_set_group_list(uint16_t **out_group_ids, size_t *out_group_ids_len,
1419     const char *groups);
1420 
1421 int tls1_ec_group_id2nid(uint16_t group_id, int *out_nid);
1422 int tls1_ec_group_id2bits(uint16_t group_id, int *out_bits);
1423 int tls1_ec_nid2group_id(int nid, uint16_t *out_group_id);
1424 int tls1_check_group(SSL *s, uint16_t group_id);
1425 int tls1_count_shared_groups(const SSL *ssl, size_t *out_count);
1426 int tls1_get_shared_group_by_index(const SSL *ssl, size_t index, int *out_nid);
1427 int tls1_get_supported_group(const SSL *s, int *out_nid);
1428 
1429 int ssl_check_clienthello_tlsext_early(SSL *s);
1430 int ssl_check_clienthello_tlsext_late(SSL *s);
1431 int ssl_check_serverhello_tlsext(SSL *s);
1432 
1433 #define TLS1_TICKET_FATAL_ERROR		-1
1434 #define TLS1_TICKET_NONE		 0
1435 #define TLS1_TICKET_EMPTY		 1
1436 #define TLS1_TICKET_NOT_DECRYPTED	 2
1437 #define TLS1_TICKET_DECRYPTED		 3
1438 
1439 int tls1_process_ticket(SSL *s, CBS *ext_block, int *alert, SSL_SESSION **ret);
1440 
1441 int tls1_check_ec_server_key(SSL *s);
1442 
1443 /* s3_cbc.c */
1444 void ssl3_cbc_copy_mac(unsigned char *out, const SSL3_RECORD_INTERNAL *rec,
1445     unsigned int md_size, unsigned int orig_len);
1446 int ssl3_cbc_remove_padding(SSL3_RECORD_INTERNAL *rec, unsigned int eiv_len,
1447     unsigned int mac_size);
1448 char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
1449 int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char *md_out,
1450     size_t *md_out_size, const unsigned char header[13],
1451     const unsigned char *data, size_t data_plus_mac_size,
1452     size_t data_plus_mac_plus_padding_size, const unsigned char *mac_secret,
1453     unsigned int mac_secret_length);
1454 int SSL_state_func_code(int _state);
1455 
1456 #define SSLerror(s, r) SSL_error_internal(s, r, __FILE__, __LINE__)
1457 #define SSLerrorx(r) ERR_PUT_error(ERR_LIB_SSL,(0xfff),(r),__FILE__,__LINE__)
1458 void SSL_error_internal(const SSL *s, int r, char *f, int l);
1459 
1460 #ifndef OPENSSL_NO_SRTP
1461 
1462 int srtp_find_profile_by_name(const char *profile_name,
1463     const SRTP_PROTECTION_PROFILE **pptr, unsigned int len);
1464 int srtp_find_profile_by_num(unsigned int profile_num,
1465     const SRTP_PROTECTION_PROFILE **pptr);
1466 
1467 #endif /* OPENSSL_NO_SRTP */
1468 
1469 int tls_process_peer_certs(SSL *s, STACK_OF(X509) *peer_certs);
1470 
1471 __END_HIDDEN_DECLS
1472 
1473 #endif /* !HEADER_SSL_LOCL_H */
1474