3 * Written by Viktor Dukhovni (viktor@openssl.org) for the OpenSSL project
6 /* ====================================================================
7 * Copyright (c) 2015 The OpenSSL Project. All rights reserved.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * licensing@OpenSSL.org.
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
35 * 6. Redistributions of any form whatsoever must retain the following
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com). This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
59 #ifndef HEADER_INTERNAL_DANE_H
60 #define HEADER_INTERNAL_DANE_H
62 #include <openssl/safestack.h>
66 * https://tools.ietf.org/html/rfc6698#section-2.1.1
68 #define DANETLS_USAGE_PKIX_TA 0
69 #define DANETLS_USAGE_PKIX_EE 1
70 #define DANETLS_USAGE_DANE_TA 2
71 #define DANETLS_USAGE_DANE_EE 3
72 #define DANETLS_USAGE_LAST DANETLS_USAGE_DANE_EE
76 * https://tools.ietf.org/html/rfc6698#section-2.1.2
78 #define DANETLS_SELECTOR_CERT 0
79 #define DANETLS_SELECTOR_SPKI 1
80 #define DANETLS_SELECTOR_LAST DANETLS_SELECTOR_SPKI
84 * https://tools.ietf.org/html/rfc6698#section-2.1.3
86 #define DANETLS_MATCHING_FULL 0
87 #define DANETLS_MATCHING_2256 1
88 #define DANETLS_MATCHING_2512 2
89 #define DANETLS_MATCHING_LAST DANETLS_MATCHING_2512
91 typedef struct danetls_record_st {
100 DEFINE_STACK_OF(danetls_record)
103 * Shared DANE context
106 const EVP_MD **mdevp; /* mtype -> digest */
107 uint8_t *mdord; /* mtype -> preference */
108 uint8_t mdmax; /* highest supported mtype */
112 * Per connection DANE state
115 struct dane_ctx_st *dctx;
116 STACK_OF(danetls_record) *trecs;
117 STACK_OF(X509) *certs; /* DANE-TA(2) Cert(0) Full(0) certs */
118 danetls_record *mtlsa; /* Matching TLSA record */
119 X509 *mcert; /* DANE matched cert */
120 uint32_t umask; /* Usages present */
121 int mdpth; /* Depth of matched cert */
122 int pdpth; /* Depth of PKIX trust */
125 #define DANETLS_ENABLED(dane) ((dane) && ((dane)->trecs != NULL))
127 #define DANETLS_USAGE_BIT(u) (((uint32_t)1) << u)
129 #define DANETLS_PKIX_TA_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_PKIX_TA))
130 #define DANETLS_PKIX_EE_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_PKIX_EE))
131 #define DANETLS_DANE_TA_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_DANE_TA))
132 #define DANETLS_DANE_EE_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_DANE_EE))
134 #define DANETLS_PKIX_MASK (DANETLS_PKIX_TA_MASK | DANETLS_PKIX_EE_MASK)
135 #define DANETLS_DANE_MASK (DANETLS_DANE_TA_MASK | DANETLS_DANE_EE_MASK)
136 #define DANETLS_TA_MASK (DANETLS_PKIX_TA_MASK | DANETLS_DANE_TA_MASK)
137 #define DANETLS_EE_MASK (DANETLS_PKIX_EE_MASK | DANETLS_DANE_EE_MASK)
139 #define DANETLS_HAS_PKIX(dane) ((dane) && ((dane)->umask & DANETLS_PKIX_MASK))
140 #define DANETLS_HAS_DANE(dane) ((dane) && ((dane)->umask & DANETLS_DANE_MASK))
141 #define DANETLS_HAS_TA(dane) ((dane) && ((dane)->umask & DANETLS_TA_MASK))
142 #define DANETLS_HAS_EE(dane) ((dane) && ((dane)->umask & DANETLS_EE_MASK))
144 #define DANETLS_HAS_PKIX_TA(dane) ((dane)&&((dane)->umask & DANETLS_PKIX_TA_MASK))
145 #define DANETLS_HAS_PKIX_EE(dane) ((dane)&&((dane)->umask & DANETLS_PKIX_EE_MASK))
146 #define DANETLS_HAS_DANE_TA(dane) ((dane)&&((dane)->umask & DANETLS_DANE_TA_MASK))
147 #define DANETLS_HAS_DANE_EE(dane) ((dane)&&((dane)->umask & DANETLS_DANE_EE_MASK))
149 #endif /* HEADER_INTERNAL_DANE_H */