1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/os/ossrv/ssl/libcrypto/inc/include/openssl/ssl3.h Fri Jun 15 03:10:57 2012 +0200
1.3 @@ -0,0 +1,560 @@
1.4 +/* ssl/ssl3.h */
1.5 +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
1.6 + * All rights reserved.
1.7 + *
1.8 + * This package is an SSL implementation written
1.9 + * by Eric Young (eay@cryptsoft.com).
1.10 + * The implementation was written so as to conform with Netscapes SSL.
1.11 + *
1.12 + * This library is free for commercial and non-commercial use as long as
1.13 + * the following conditions are aheared to. The following conditions
1.14 + * apply to all code found in this distribution, be it the RC4, RSA,
1.15 + * lhash, DES, etc., code; not just the SSL code. The SSL documentation
1.16 + * included with this distribution is covered by the same copyright terms
1.17 + * except that the holder is Tim Hudson (tjh@cryptsoft.com).
1.18 + *
1.19 + * Copyright remains Eric Young's, and as such any Copyright notices in
1.20 + * the code are not to be removed.
1.21 + * If this package is used in a product, Eric Young should be given attribution
1.22 + * as the author of the parts of the library used.
1.23 + * This can be in the form of a textual message at program startup or
1.24 + * in documentation (online or textual) provided with the package.
1.25 + *
1.26 + * Redistribution and use in source and binary forms, with or without
1.27 + * modification, are permitted provided that the following conditions
1.28 + * are met:
1.29 + * 1. Redistributions of source code must retain the copyright
1.30 + * notice, this list of conditions and the following disclaimer.
1.31 + * 2. Redistributions in binary form must reproduce the above copyright
1.32 + * notice, this list of conditions and the following disclaimer in the
1.33 + * documentation and/or other materials provided with the distribution.
1.34 + * 3. All advertising materials mentioning features or use of this software
1.35 + * must display the following acknowledgement:
1.36 + * "This product includes cryptographic software written by
1.37 + * Eric Young (eay@cryptsoft.com)"
1.38 + * The word 'cryptographic' can be left out if the rouines from the library
1.39 + * being used are not cryptographic related :-).
1.40 + * 4. If you include any Windows specific code (or a derivative thereof) from
1.41 + * the apps directory (application code) you must include an acknowledgement:
1.42 + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
1.43 + *
1.44 + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
1.45 + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1.46 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1.47 + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
1.48 + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1.49 + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1.50 + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1.51 + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1.52 + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1.53 + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1.54 + * SUCH DAMAGE.
1.55 + *
1.56 + * The licence and distribution terms for any publically available version or
1.57 + * derivative of this code cannot be changed. i.e. this code cannot simply be
1.58 + * copied and put under another distribution licence
1.59 + * [including the GNU Public Licence.]
1.60 + */
1.61 +/* ====================================================================
1.62 + * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
1.63 + *
1.64 + * Redistribution and use in source and binary forms, with or without
1.65 + * modification, are permitted provided that the following conditions
1.66 + * are met:
1.67 + *
1.68 + * 1. Redistributions of source code must retain the above copyright
1.69 + * notice, this list of conditions and the following disclaimer.
1.70 + *
1.71 + * 2. Redistributions in binary form must reproduce the above copyright
1.72 + * notice, this list of conditions and the following disclaimer in
1.73 + * the documentation and/or other materials provided with the
1.74 + * distribution.
1.75 + *
1.76 + * 3. All advertising materials mentioning features or use of this
1.77 + * software must display the following acknowledgment:
1.78 + * "This product includes software developed by the OpenSSL Project
1.79 + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
1.80 + *
1.81 + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
1.82 + * endorse or promote products derived from this software without
1.83 + * prior written permission. For written permission, please contact
1.84 + * openssl-core@openssl.org.
1.85 + *
1.86 + * 5. Products derived from this software may not be called "OpenSSL"
1.87 + * nor may "OpenSSL" appear in their names without prior written
1.88 + * permission of the OpenSSL Project.
1.89 + *
1.90 + * 6. Redistributions of any form whatsoever must retain the following
1.91 + * acknowledgment:
1.92 + * "This product includes software developed by the OpenSSL Project
1.93 + * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
1.94 + *
1.95 + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
1.96 + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1.97 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
1.98 + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
1.99 + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
1.100 + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
1.101 + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
1.102 + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1.103 + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
1.104 + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
1.105 + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
1.106 + * OF THE POSSIBILITY OF SUCH DAMAGE.
1.107 + * ====================================================================
1.108 + *
1.109 + * This product includes cryptographic software written by Eric Young
1.110 + * (eay@cryptsoft.com). This product includes software written by Tim
1.111 + * Hudson (tjh@cryptsoft.com).
1.112 + *
1.113 + */
1.114 +/* ====================================================================
1.115 + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
1.116 + * ECC cipher suite support in OpenSSL originally developed by
1.117 + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
1.118 + */
1.119 +
1.120 +#ifndef HEADER_SSL3_H
1.121 +#define HEADER_SSL3_H
1.122 +
1.123 +#ifndef OPENSSL_NO_COMP
1.124 +#include <openssl/comp.h>
1.125 +#endif
1.126 +#include <openssl/buffer.h>
1.127 +#include <openssl/evp.h>
1.128 +#include <openssl/ssl.h>
1.129 +#include <openssl/pq_compat.h>
1.130 +
1.131 +#ifdef __cplusplus
1.132 +extern "C" {
1.133 +#endif
1.134 +
1.135 +#define SSL3_CK_RSA_NULL_MD5 0x03000001
1.136 +#define SSL3_CK_RSA_NULL_SHA 0x03000002
1.137 +#define SSL3_CK_RSA_RC4_40_MD5 0x03000003
1.138 +#define SSL3_CK_RSA_RC4_128_MD5 0x03000004
1.139 +#define SSL3_CK_RSA_RC4_128_SHA 0x03000005
1.140 +#define SSL3_CK_RSA_RC2_40_MD5 0x03000006
1.141 +#define SSL3_CK_RSA_IDEA_128_SHA 0x03000007
1.142 +#define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008
1.143 +#define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009
1.144 +#define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A
1.145 +
1.146 +#define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B
1.147 +#define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C
1.148 +#define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D
1.149 +#define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E
1.150 +#define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F
1.151 +#define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010
1.152 +
1.153 +#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011
1.154 +#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012
1.155 +#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013
1.156 +#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014
1.157 +#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015
1.158 +#define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016
1.159 +
1.160 +#define SSL3_CK_ADH_RC4_40_MD5 0x03000017
1.161 +#define SSL3_CK_ADH_RC4_128_MD5 0x03000018
1.162 +#define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019
1.163 +#define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A
1.164 +#define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B
1.165 +
1.166 +#define SSL3_CK_FZA_DMS_NULL_SHA 0x0300001C
1.167 +#define SSL3_CK_FZA_DMS_FZA_SHA 0x0300001D
1.168 +#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
1.169 + to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
1.170 + of the ietf-tls list */
1.171 +#define SSL3_CK_FZA_DMS_RC4_SHA 0x0300001E
1.172 +#endif
1.173 +
1.174 +/* VRS Additional Kerberos5 entries
1.175 + */
1.176 +#define SSL3_CK_KRB5_DES_64_CBC_SHA 0x0300001E
1.177 +#define SSL3_CK_KRB5_DES_192_CBC3_SHA 0x0300001F
1.178 +#define SSL3_CK_KRB5_RC4_128_SHA 0x03000020
1.179 +#define SSL3_CK_KRB5_IDEA_128_CBC_SHA 0x03000021
1.180 +#define SSL3_CK_KRB5_DES_64_CBC_MD5 0x03000022
1.181 +#define SSL3_CK_KRB5_DES_192_CBC3_MD5 0x03000023
1.182 +#define SSL3_CK_KRB5_RC4_128_MD5 0x03000024
1.183 +#define SSL3_CK_KRB5_IDEA_128_CBC_MD5 0x03000025
1.184 +
1.185 +#define SSL3_CK_KRB5_DES_40_CBC_SHA 0x03000026
1.186 +#define SSL3_CK_KRB5_RC2_40_CBC_SHA 0x03000027
1.187 +#define SSL3_CK_KRB5_RC4_40_SHA 0x03000028
1.188 +#define SSL3_CK_KRB5_DES_40_CBC_MD5 0x03000029
1.189 +#define SSL3_CK_KRB5_RC2_40_CBC_MD5 0x0300002A
1.190 +#define SSL3_CK_KRB5_RC4_40_MD5 0x0300002B
1.191 +
1.192 +#define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5"
1.193 +#define SSL3_TXT_RSA_NULL_SHA "NULL-SHA"
1.194 +#define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5"
1.195 +#define SSL3_TXT_RSA_RC4_128_MD5 "RC4-MD5"
1.196 +#define SSL3_TXT_RSA_RC4_128_SHA "RC4-SHA"
1.197 +#define SSL3_TXT_RSA_RC2_40_MD5 "EXP-RC2-CBC-MD5"
1.198 +#define SSL3_TXT_RSA_IDEA_128_SHA "IDEA-CBC-SHA"
1.199 +#define SSL3_TXT_RSA_DES_40_CBC_SHA "EXP-DES-CBC-SHA"
1.200 +#define SSL3_TXT_RSA_DES_64_CBC_SHA "DES-CBC-SHA"
1.201 +#define SSL3_TXT_RSA_DES_192_CBC3_SHA "DES-CBC3-SHA"
1.202 +
1.203 +#define SSL3_TXT_DH_DSS_DES_40_CBC_SHA "EXP-DH-DSS-DES-CBC-SHA"
1.204 +#define SSL3_TXT_DH_DSS_DES_64_CBC_SHA "DH-DSS-DES-CBC-SHA"
1.205 +#define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA"
1.206 +#define SSL3_TXT_DH_RSA_DES_40_CBC_SHA "EXP-DH-RSA-DES-CBC-SHA"
1.207 +#define SSL3_TXT_DH_RSA_DES_64_CBC_SHA "DH-RSA-DES-CBC-SHA"
1.208 +#define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA"
1.209 +
1.210 +#define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA "EXP-EDH-DSS-DES-CBC-SHA"
1.211 +#define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA "EDH-DSS-DES-CBC-SHA"
1.212 +#define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA"
1.213 +#define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA "EXP-EDH-RSA-DES-CBC-SHA"
1.214 +#define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA "EDH-RSA-DES-CBC-SHA"
1.215 +#define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA"
1.216 +
1.217 +#define SSL3_TXT_ADH_RC4_40_MD5 "EXP-ADH-RC4-MD5"
1.218 +#define SSL3_TXT_ADH_RC4_128_MD5 "ADH-RC4-MD5"
1.219 +#define SSL3_TXT_ADH_DES_40_CBC_SHA "EXP-ADH-DES-CBC-SHA"
1.220 +#define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA"
1.221 +#define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA"
1.222 +
1.223 +#define SSL3_TXT_FZA_DMS_NULL_SHA "FZA-NULL-SHA"
1.224 +#define SSL3_TXT_FZA_DMS_FZA_SHA "FZA-FZA-CBC-SHA"
1.225 +#define SSL3_TXT_FZA_DMS_RC4_SHA "FZA-RC4-SHA"
1.226 +
1.227 +#define SSL3_TXT_KRB5_DES_64_CBC_SHA "KRB5-DES-CBC-SHA"
1.228 +#define SSL3_TXT_KRB5_DES_192_CBC3_SHA "KRB5-DES-CBC3-SHA"
1.229 +#define SSL3_TXT_KRB5_RC4_128_SHA "KRB5-RC4-SHA"
1.230 +#define SSL3_TXT_KRB5_IDEA_128_CBC_SHA "KRB5-IDEA-CBC-SHA"
1.231 +#define SSL3_TXT_KRB5_DES_64_CBC_MD5 "KRB5-DES-CBC-MD5"
1.232 +#define SSL3_TXT_KRB5_DES_192_CBC3_MD5 "KRB5-DES-CBC3-MD5"
1.233 +#define SSL3_TXT_KRB5_RC4_128_MD5 "KRB5-RC4-MD5"
1.234 +#define SSL3_TXT_KRB5_IDEA_128_CBC_MD5 "KRB5-IDEA-CBC-MD5"
1.235 +
1.236 +#define SSL3_TXT_KRB5_DES_40_CBC_SHA "EXP-KRB5-DES-CBC-SHA"
1.237 +#define SSL3_TXT_KRB5_RC2_40_CBC_SHA "EXP-KRB5-RC2-CBC-SHA"
1.238 +#define SSL3_TXT_KRB5_RC4_40_SHA "EXP-KRB5-RC4-SHA"
1.239 +#define SSL3_TXT_KRB5_DES_40_CBC_MD5 "EXP-KRB5-DES-CBC-MD5"
1.240 +#define SSL3_TXT_KRB5_RC2_40_CBC_MD5 "EXP-KRB5-RC2-CBC-MD5"
1.241 +#define SSL3_TXT_KRB5_RC4_40_MD5 "EXP-KRB5-RC4-MD5"
1.242 +
1.243 +#define SSL3_SSL_SESSION_ID_LENGTH 32
1.244 +#define SSL3_MAX_SSL_SESSION_ID_LENGTH 32
1.245 +
1.246 +#define SSL3_MASTER_SECRET_SIZE 48
1.247 +#define SSL3_RANDOM_SIZE 32
1.248 +#define SSL3_SESSION_ID_SIZE 32
1.249 +#define SSL3_RT_HEADER_LENGTH 5
1.250 +
1.251 +/* Due to MS stuffing up, this can change.... */
1.252 +#if defined(OPENSSL_SYS_WIN16) || \
1.253 + (defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32))
1.254 +#define SSL3_RT_MAX_EXTRA (14000)
1.255 +#else
1.256 +#define SSL3_RT_MAX_EXTRA (16384)
1.257 +#endif
1.258 +
1.259 +#define SSL3_RT_MAX_PLAIN_LENGTH 16384
1.260 +#ifdef OPENSSL_NO_COMP
1.261 +#define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH
1.262 +#else
1.263 +#define SSL3_RT_MAX_COMPRESSED_LENGTH (1024+SSL3_RT_MAX_PLAIN_LENGTH)
1.264 +#endif
1.265 +#define SSL3_RT_MAX_ENCRYPTED_LENGTH (1024+SSL3_RT_MAX_COMPRESSED_LENGTH)
1.266 +#define SSL3_RT_MAX_PACKET_SIZE (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
1.267 +#define SSL3_RT_MAX_DATA_SIZE (1024*1024)
1.268 +
1.269 +#define SSL3_MD_CLIENT_FINISHED_CONST "\x43\x4C\x4E\x54"
1.270 +#define SSL3_MD_SERVER_FINISHED_CONST "\x53\x52\x56\x52"
1.271 +
1.272 +#define SSL3_VERSION 0x0300
1.273 +#define SSL3_VERSION_MAJOR 0x03
1.274 +#define SSL3_VERSION_MINOR 0x00
1.275 +
1.276 +#define SSL3_RT_CHANGE_CIPHER_SPEC 20
1.277 +#define SSL3_RT_ALERT 21
1.278 +#define SSL3_RT_HANDSHAKE 22
1.279 +#define SSL3_RT_APPLICATION_DATA 23
1.280 +
1.281 +#define SSL3_AL_WARNING 1
1.282 +#define SSL3_AL_FATAL 2
1.283 +
1.284 +#define SSL3_AD_CLOSE_NOTIFY 0
1.285 +#define SSL3_AD_UNEXPECTED_MESSAGE 10 /* fatal */
1.286 +#define SSL3_AD_BAD_RECORD_MAC 20 /* fatal */
1.287 +#define SSL3_AD_DECOMPRESSION_FAILURE 30 /* fatal */
1.288 +#define SSL3_AD_HANDSHAKE_FAILURE 40 /* fatal */
1.289 +#define SSL3_AD_NO_CERTIFICATE 41
1.290 +#define SSL3_AD_BAD_CERTIFICATE 42
1.291 +#define SSL3_AD_UNSUPPORTED_CERTIFICATE 43
1.292 +#define SSL3_AD_CERTIFICATE_REVOKED 44
1.293 +#define SSL3_AD_CERTIFICATE_EXPIRED 45
1.294 +#define SSL3_AD_CERTIFICATE_UNKNOWN 46
1.295 +#define SSL3_AD_ILLEGAL_PARAMETER 47 /* fatal */
1.296 +
1.297 +typedef struct ssl3_record_st
1.298 + {
1.299 +/*r */ int type; /* type of record */
1.300 +/*rw*/ unsigned int length; /* How many bytes available */
1.301 +/*r */ unsigned int off; /* read/write offset into 'buf' */
1.302 +/*rw*/ unsigned char *data; /* pointer to the record data */
1.303 +/*rw*/ unsigned char *input; /* where the decode bytes are */
1.304 +/*r */ unsigned char *comp; /* only used with decompression - malloc()ed */
1.305 +/*r */ unsigned long epoch; /* epoch number, needed by DTLS1 */
1.306 +/*r */ PQ_64BIT seq_num; /* sequence number, needed by DTLS1 */
1.307 + } SSL3_RECORD;
1.308 +
1.309 +typedef struct ssl3_buffer_st
1.310 + {
1.311 + unsigned char *buf; /* at least SSL3_RT_MAX_PACKET_SIZE bytes,
1.312 + * see ssl3_setup_buffers() */
1.313 + size_t len; /* buffer size */
1.314 + int offset; /* where to 'copy from' */
1.315 + int left; /* how many bytes left */
1.316 + } SSL3_BUFFER;
1.317 +
1.318 +#define SSL3_CT_RSA_SIGN 1
1.319 +#define SSL3_CT_DSS_SIGN 2
1.320 +#define SSL3_CT_RSA_FIXED_DH 3
1.321 +#define SSL3_CT_DSS_FIXED_DH 4
1.322 +#define SSL3_CT_RSA_EPHEMERAL_DH 5
1.323 +#define SSL3_CT_DSS_EPHEMERAL_DH 6
1.324 +#define SSL3_CT_FORTEZZA_DMS 20
1.325 +/* SSL3_CT_NUMBER is used to size arrays and it must be large
1.326 + * enough to contain all of the cert types defined either for
1.327 + * SSLv3 and TLSv1.
1.328 + */
1.329 +#define SSL3_CT_NUMBER 7
1.330 +
1.331 +
1.332 +#define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS 0x0001
1.333 +#define SSL3_FLAGS_DELAY_CLIENT_FINISHED 0x0002
1.334 +#define SSL3_FLAGS_POP_BUFFER 0x0004
1.335 +#define TLS1_FLAGS_TLS_PADDING_BUG 0x0008
1.336 +
1.337 +typedef struct ssl3_state_st
1.338 + {
1.339 + long flags;
1.340 + int delay_buf_pop_ret;
1.341 +
1.342 + unsigned char read_sequence[8];
1.343 + unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
1.344 + unsigned char write_sequence[8];
1.345 + unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
1.346 +
1.347 + unsigned char server_random[SSL3_RANDOM_SIZE];
1.348 + unsigned char client_random[SSL3_RANDOM_SIZE];
1.349 +
1.350 + /* flags for countermeasure against known-IV weakness */
1.351 + int need_empty_fragments;
1.352 + int empty_fragment_done;
1.353 +
1.354 + SSL3_BUFFER rbuf; /* read IO goes into here */
1.355 + SSL3_BUFFER wbuf; /* write IO goes into here */
1.356 +
1.357 + SSL3_RECORD rrec; /* each decoded record goes in here */
1.358 + SSL3_RECORD wrec; /* goes out from here */
1.359 +
1.360 + /* storage for Alert/Handshake protocol data received but not
1.361 + * yet processed by ssl3_read_bytes: */
1.362 + unsigned char alert_fragment[2];
1.363 + unsigned int alert_fragment_len;
1.364 + unsigned char handshake_fragment[4];
1.365 + unsigned int handshake_fragment_len;
1.366 +
1.367 + /* partial write - check the numbers match */
1.368 + unsigned int wnum; /* number of bytes sent so far */
1.369 + int wpend_tot; /* number bytes written */
1.370 + int wpend_type;
1.371 + int wpend_ret; /* number of bytes submitted */
1.372 + const unsigned char *wpend_buf;
1.373 +
1.374 + /* used during startup, digest all incoming/outgoing packets */
1.375 + EVP_MD_CTX finish_dgst1;
1.376 + EVP_MD_CTX finish_dgst2;
1.377 +
1.378 + /* this is set whenerver we see a change_cipher_spec message
1.379 + * come in when we are not looking for one */
1.380 + int change_cipher_spec;
1.381 +
1.382 + int warn_alert;
1.383 + int fatal_alert;
1.384 + /* we allow one fatal and one warning alert to be outstanding,
1.385 + * send close alert via the warning alert */
1.386 + int alert_dispatch;
1.387 + unsigned char send_alert[2];
1.388 +
1.389 + /* This flag is set when we should renegotiate ASAP, basically when
1.390 + * there is no more data in the read or write buffers */
1.391 + int renegotiate;
1.392 + int total_renegotiations;
1.393 + int num_renegotiations;
1.394 +
1.395 + int in_read_app_data;
1.396 +
1.397 + struct {
1.398 + /* actually only needs to be 16+20 */
1.399 + unsigned char cert_verify_md[EVP_MAX_MD_SIZE*2];
1.400 +
1.401 + /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
1.402 + unsigned char finish_md[EVP_MAX_MD_SIZE*2];
1.403 + int finish_md_len;
1.404 + unsigned char peer_finish_md[EVP_MAX_MD_SIZE*2];
1.405 + int peer_finish_md_len;
1.406 +
1.407 + unsigned long message_size;
1.408 + int message_type;
1.409 +
1.410 + /* used to hold the new cipher we are going to use */
1.411 + SSL_CIPHER *new_cipher;
1.412 +#ifndef OPENSSL_NO_DH
1.413 + DH *dh;
1.414 +#endif
1.415 +
1.416 +#ifndef OPENSSL_NO_ECDH
1.417 + EC_KEY *ecdh; /* holds short lived ECDH key */
1.418 +#endif
1.419 +
1.420 + /* used when SSL_ST_FLUSH_DATA is entered */
1.421 + int next_state;
1.422 +
1.423 + int reuse_message;
1.424 +
1.425 + /* used for certificate requests */
1.426 + int cert_req;
1.427 + int ctype_num;
1.428 + char ctype[SSL3_CT_NUMBER];
1.429 + STACK_OF(X509_NAME) *ca_names;
1.430 +
1.431 + int use_rsa_tmp;
1.432 +
1.433 + int key_block_length;
1.434 + unsigned char *key_block;
1.435 +
1.436 + const EVP_CIPHER *new_sym_enc;
1.437 + const EVP_MD *new_hash;
1.438 +#ifndef OPENSSL_NO_COMP
1.439 + const SSL_COMP *new_compression;
1.440 +#else
1.441 + char *new_compression;
1.442 +#endif
1.443 + int cert_request;
1.444 + } tmp;
1.445 +
1.446 + } SSL3_STATE;
1.447 +
1.448 +
1.449 +/* SSLv3 */
1.450 +/*client */
1.451 +/* extra state */
1.452 +#define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT)
1.453 +/* write to server */
1.454 +#define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT)
1.455 +#define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT)
1.456 +/* read from server */
1.457 +#define SSL3_ST_CR_SRVR_HELLO_A (0x120|SSL_ST_CONNECT)
1.458 +#define SSL3_ST_CR_SRVR_HELLO_B (0x121|SSL_ST_CONNECT)
1.459 +#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT)
1.460 +#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT)
1.461 +#define SSL3_ST_CR_CERT_A (0x130|SSL_ST_CONNECT)
1.462 +#define SSL3_ST_CR_CERT_B (0x131|SSL_ST_CONNECT)
1.463 +#define SSL3_ST_CR_KEY_EXCH_A (0x140|SSL_ST_CONNECT)
1.464 +#define SSL3_ST_CR_KEY_EXCH_B (0x141|SSL_ST_CONNECT)
1.465 +#define SSL3_ST_CR_CERT_REQ_A (0x150|SSL_ST_CONNECT)
1.466 +#define SSL3_ST_CR_CERT_REQ_B (0x151|SSL_ST_CONNECT)
1.467 +#define SSL3_ST_CR_SRVR_DONE_A (0x160|SSL_ST_CONNECT)
1.468 +#define SSL3_ST_CR_SRVR_DONE_B (0x161|SSL_ST_CONNECT)
1.469 +/* write to server */
1.470 +#define SSL3_ST_CW_CERT_A (0x170|SSL_ST_CONNECT)
1.471 +#define SSL3_ST_CW_CERT_B (0x171|SSL_ST_CONNECT)
1.472 +#define SSL3_ST_CW_CERT_C (0x172|SSL_ST_CONNECT)
1.473 +#define SSL3_ST_CW_CERT_D (0x173|SSL_ST_CONNECT)
1.474 +#define SSL3_ST_CW_KEY_EXCH_A (0x180|SSL_ST_CONNECT)
1.475 +#define SSL3_ST_CW_KEY_EXCH_B (0x181|SSL_ST_CONNECT)
1.476 +#define SSL3_ST_CW_CERT_VRFY_A (0x190|SSL_ST_CONNECT)
1.477 +#define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT)
1.478 +#define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT)
1.479 +#define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT)
1.480 +#define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT)
1.481 +#define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT)
1.482 +/* read from server */
1.483 +#define SSL3_ST_CR_CHANGE_A (0x1C0|SSL_ST_CONNECT)
1.484 +#define SSL3_ST_CR_CHANGE_B (0x1C1|SSL_ST_CONNECT)
1.485 +#define SSL3_ST_CR_FINISHED_A (0x1D0|SSL_ST_CONNECT)
1.486 +#define SSL3_ST_CR_FINISHED_B (0x1D1|SSL_ST_CONNECT)
1.487 +#define SSL3_ST_CR_SESSION_TICKET_A (0x1E0|SSL_ST_CONNECT)
1.488 +#define SSL3_ST_CR_SESSION_TICKET_B (0x1E1|SSL_ST_CONNECT)
1.489 +
1.490 +/* server */
1.491 +/* extra state */
1.492 +#define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT)
1.493 +/* read from client */
1.494 +/* Do not change the number values, they do matter */
1.495 +#define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT)
1.496 +#define SSL3_ST_SR_CLNT_HELLO_B (0x111|SSL_ST_ACCEPT)
1.497 +#define SSL3_ST_SR_CLNT_HELLO_C (0x112|SSL_ST_ACCEPT)
1.498 +/* write to client */
1.499 +#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT)
1.500 +#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT)
1.501 +#define SSL3_ST_SW_HELLO_REQ_A (0x120|SSL_ST_ACCEPT)
1.502 +#define SSL3_ST_SW_HELLO_REQ_B (0x121|SSL_ST_ACCEPT)
1.503 +#define SSL3_ST_SW_HELLO_REQ_C (0x122|SSL_ST_ACCEPT)
1.504 +#define SSL3_ST_SW_SRVR_HELLO_A (0x130|SSL_ST_ACCEPT)
1.505 +#define SSL3_ST_SW_SRVR_HELLO_B (0x131|SSL_ST_ACCEPT)
1.506 +#define SSL3_ST_SW_CERT_A (0x140|SSL_ST_ACCEPT)
1.507 +#define SSL3_ST_SW_CERT_B (0x141|SSL_ST_ACCEPT)
1.508 +#define SSL3_ST_SW_KEY_EXCH_A (0x150|SSL_ST_ACCEPT)
1.509 +#define SSL3_ST_SW_KEY_EXCH_B (0x151|SSL_ST_ACCEPT)
1.510 +#define SSL3_ST_SW_CERT_REQ_A (0x160|SSL_ST_ACCEPT)
1.511 +#define SSL3_ST_SW_CERT_REQ_B (0x161|SSL_ST_ACCEPT)
1.512 +#define SSL3_ST_SW_SRVR_DONE_A (0x170|SSL_ST_ACCEPT)
1.513 +#define SSL3_ST_SW_SRVR_DONE_B (0x171|SSL_ST_ACCEPT)
1.514 +/* read from client */
1.515 +#define SSL3_ST_SR_CERT_A (0x180|SSL_ST_ACCEPT)
1.516 +#define SSL3_ST_SR_CERT_B (0x181|SSL_ST_ACCEPT)
1.517 +#define SSL3_ST_SR_KEY_EXCH_A (0x190|SSL_ST_ACCEPT)
1.518 +#define SSL3_ST_SR_KEY_EXCH_B (0x191|SSL_ST_ACCEPT)
1.519 +#define SSL3_ST_SR_CERT_VRFY_A (0x1A0|SSL_ST_ACCEPT)
1.520 +#define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT)
1.521 +#define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT)
1.522 +#define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT)
1.523 +#define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT)
1.524 +#define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT)
1.525 +/* write to client */
1.526 +#define SSL3_ST_SW_CHANGE_A (0x1D0|SSL_ST_ACCEPT)
1.527 +#define SSL3_ST_SW_CHANGE_B (0x1D1|SSL_ST_ACCEPT)
1.528 +#define SSL3_ST_SW_FINISHED_A (0x1E0|SSL_ST_ACCEPT)
1.529 +#define SSL3_ST_SW_FINISHED_B (0x1E1|SSL_ST_ACCEPT)
1.530 +#define SSL3_ST_SW_SESSION_TICKET_A (0x1F0|SSL_ST_ACCEPT)
1.531 +#define SSL3_ST_SW_SESSION_TICKET_B (0x1F1|SSL_ST_ACCEPT)
1.532 +
1.533 +#define SSL3_MT_HELLO_REQUEST 0
1.534 +#define SSL3_MT_CLIENT_HELLO 1
1.535 +#define SSL3_MT_SERVER_HELLO 2
1.536 +#define SSL3_MT_NEWSESSION_TICKET 4
1.537 +#define SSL3_MT_CERTIFICATE 11
1.538 +#define SSL3_MT_SERVER_KEY_EXCHANGE 12
1.539 +#define SSL3_MT_CERTIFICATE_REQUEST 13
1.540 +#define SSL3_MT_SERVER_DONE 14
1.541 +#define SSL3_MT_CERTIFICATE_VERIFY 15
1.542 +#define SSL3_MT_CLIENT_KEY_EXCHANGE 16
1.543 +#define SSL3_MT_FINISHED 20
1.544 +#define DTLS1_MT_HELLO_VERIFY_REQUEST 3
1.545 +
1.546 +
1.547 +#define SSL3_MT_CCS 1
1.548 +
1.549 +/* These are used when changing over to a new cipher */
1.550 +#define SSL3_CC_READ 0x01
1.551 +#define SSL3_CC_WRITE 0x02
1.552 +#define SSL3_CC_CLIENT 0x10
1.553 +#define SSL3_CC_SERVER 0x20
1.554 +#define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE)
1.555 +#define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER|SSL3_CC_READ)
1.556 +#define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT|SSL3_CC_READ)
1.557 +#define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE)
1.558 +
1.559 +#ifdef __cplusplus
1.560 +}
1.561 +#endif
1.562 +#endif
1.563 +