2 * Written by Viktor Dukhovni (viktor@openssl.org) for the OpenSSL project
5 /* ====================================================================
6 * Copyright (c) 2015 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
58 #ifndef HEADER_INTERNAL_DANE_H
59 #define HEADER_INTERNAL_DANE_H
61 #include <openssl/safestack.h>
65 * https://tools.ietf.org/html/rfc6698#section-2.1.1
67 #define DANETLS_USAGE_PKIX_TA 0
68 #define DANETLS_USAGE_PKIX_EE 1
69 #define DANETLS_USAGE_DANE_TA 2
70 #define DANETLS_USAGE_DANE_EE 3
71 #define DANETLS_USAGE_LAST DANETLS_USAGE_DANE_EE
75 * https://tools.ietf.org/html/rfc6698#section-2.1.2
77 #define DANETLS_SELECTOR_CERT 0
78 #define DANETLS_SELECTOR_SPKI 1
79 #define DANETLS_SELECTOR_LAST DANETLS_SELECTOR_SPKI
83 * https://tools.ietf.org/html/rfc6698#section-2.1.3
85 #define DANETLS_MATCHING_FULL 0
86 #define DANETLS_MATCHING_2256 1
87 #define DANETLS_MATCHING_2512 2
88 #define DANETLS_MATCHING_LAST DANETLS_MATCHING_2512
90 typedef struct danetls_record_st {
99 DEFINE_STACK_OF(danetls_record)
102 * Shared DANE context
105 const EVP_MD **mdevp; /* mtype -> digest */
106 uint8_t *mdord; /* mtype -> preference */
107 uint8_t mdmax; /* highest supported mtype */
111 * Per connection DANE state
114 struct dane_ctx_st *dctx;
115 STACK_OF(danetls_record) *trecs;
116 STACK_OF(X509) *certs; /* DANE-TA(2) Cert(0) Full(0) certs */
117 danetls_record *mtlsa; /* Matching TLSA record */
118 X509 *mcert; /* DANE matched cert */
119 uint32_t umask; /* Usages present */
120 int mdpth; /* Depth of matched cert */
121 int pdpth; /* Depth of PKIX trust */
124 #define DANETLS_ENABLED(dane) ((dane) != NULL && ((dane)->trecs != NULL))
126 #define DANETLS_USAGE_BIT(u) (((uint32_t)1) << u)
128 #define DANETLS_PKIX_TA_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_PKIX_TA))
129 #define DANETLS_PKIX_EE_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_PKIX_EE))
130 #define DANETLS_DANE_TA_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_DANE_TA))
131 #define DANETLS_DANE_EE_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_DANE_EE))
133 #define DANETLS_PKIX_MASK (DANETLS_PKIX_TA_MASK | DANETLS_PKIX_EE_MASK)
134 #define DANETLS_DANE_MASK (DANETLS_DANE_TA_MASK | DANETLS_DANE_EE_MASK)
135 #define DANETLS_TA_MASK (DANETLS_PKIX_TA_MASK | DANETLS_DANE_TA_MASK)
136 #define DANETLS_EE_MASK (DANETLS_PKIX_EE_MASK | DANETLS_DANE_EE_MASK)
138 #define DANETLS_HAS_PKIX(dane) ((dane) && ((dane)->umask & DANETLS_PKIX_MASK))
139 #define DANETLS_HAS_DANE(dane) ((dane) && ((dane)->umask & DANETLS_DANE_MASK))
140 #define DANETLS_HAS_TA(dane) ((dane) && ((dane)->umask & DANETLS_TA_MASK))
141 #define DANETLS_HAS_EE(dane) ((dane) && ((dane)->umask & DANETLS_EE_MASK))
143 #define DANETLS_HAS_PKIX_TA(dane) ((dane)&&((dane)->umask & DANETLS_PKIX_TA_MASK))
144 #define DANETLS_HAS_PKIX_EE(dane) ((dane)&&((dane)->umask & DANETLS_PKIX_EE_MASK))
145 #define DANETLS_HAS_DANE_TA(dane) ((dane)&&((dane)->umask & DANETLS_DANE_TA_MASK))
146 #define DANETLS_HAS_DANE_EE(dane) ((dane)&&((dane)->umask & DANETLS_DANE_EE_MASK))
148 #endif /* HEADER_INTERNAL_DANE_H */