# define SSL_PSK (SSL_kPSK | SSL_kRSAPSK | SSL_kECDHEPSK | SSL_kDHEPSK)
+/* Any appropriate key exchange algorithm (for TLS 1.3 ciphersuites) */
+# define SSL_kANY 0x00000000U
+
/* Bits for algorithm_auth (server authentication) */
/* RSA auth */
# define SSL_aRSA 0x00000001U
# define SSL_aSRP 0x00000040U
/* GOST R 34.10-2012 signature auth */
# define SSL_aGOST12 0x00000080U
+/* Any appropriate signature auth (for TLS 1.3 ciphersuites) */
+# define SSL_aANY 0x00000000U
/* Bits for algorithm_enc (symmetric encryption) */
# define SSL_DES 0x00000001U
/* we have used 0000003f - 26 bits left to go */
+/* Flag used on OpenSSL ciphersuite ids to indicate they are for SSLv3+ */
+# define SSL3_CK_CIPHERSUITE_FLAG 0x03000000
+
/* Check if an SSL structure is using DTLS */
# define SSL_IS_DTLS(s) (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
# define SSL_USE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC)
/* Mostly for SSLv3 */
-# define SSL_PKEY_RSA_ENC 0
-# define SSL_PKEY_RSA_SIGN 1
-# define SSL_PKEY_DSA_SIGN 2
-# define SSL_PKEY_ECC 3
-# define SSL_PKEY_GOST01 4
-# define SSL_PKEY_GOST12_256 5
-# define SSL_PKEY_GOST12_512 6
-# define SSL_PKEY_NUM 7
+# define SSL_PKEY_RSA 0
+# define SSL_PKEY_DSA_SIGN 1
+# define SSL_PKEY_ECC 2
+# define SSL_PKEY_GOST01 3
+# define SSL_PKEY_GOST12_256 4
+# define SSL_PKEY_GOST12_512 5
+# define SSL_PKEY_NUM 6
/*
* Pseudo-constant. GOST cipher suites can use different certs for 1
* SSL_CIPHER. So let's see which one we have in fact.
*/
# define SSL_PKEY_GOST_EC SSL_PKEY_NUM+1
+/*
+ * TODO(TLS1.3) for now use SSL_PKEY_RSA keys for PSS
+ */
+
+#define SSL_PKEY_RSA_PSS_SIGN SSL_PKEY_RSA
+
/*-
* SSL_kRSA <- RSA_ENC
* SSL_kDH <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN)
* For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
* master secret
*/
- unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
+ unsigned char master_key[TLS13_MAX_RESUMPTION_MASTER_LENGTH];
/* session_id - valid? */
size_t session_id_length;
unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
unsigned char *npn;
size_t npn_len;
- /* The selected PSK key exchange mode */
+ /* The available PSK key exchange modes */
int psk_kex_mode;
} ext;
/* Have we attempted to find/parse SCTs yet? */
int scts_parsed;
# endif
- SSL_CTX *initial_ctx; /* initial ctx, used to store sessions */
-# ifndef OPENSSL_NO_NEXTPROTONEG
-# endif
-# define session_ctx initial_ctx
+ SSL_CTX *session_ctx; /* initial ctx, used to store sessions */
/* What we'll do */
STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
/* What's been chosen */
CRYPTO_RWLOCK *lock;
};
+/*
+ * Structure containing table entry of values associated with the signature
+ * algorithms (signature scheme) extension
+*/
+typedef struct sigalg_lookup_st {
+ /* TLS 1.3 signature scheme name */
+ const char *name;
+ /* Raw value used in extension */
+ uint16_t sigalg;
+ /* NID of hash algorithm */
+ int hash;
+ /* Index of hash algorithm */
+ int hash_idx;
+ /* NID of signature algorithm */
+ int sig;
+ /* Index of signature algorithm */
+ int sig_idx;
+ /* Combined hash and signature NID, if any */
+ int sigandhash;
+ /* Required public key curve (ECDSA only) */
+ int curve;
+} SIGALG_LOOKUP;
+
typedef struct ssl3_state_st {
long flags;
size_t read_mac_secret_size;
unsigned char *psk;
size_t psklen;
# endif
+ /* Signature algorithm we actually use */
+ const SIGALG_LOOKUP *sigalg;
+ /* Index of certificate we use */
+ int cert_idx;
/*
* signature algorithms peer reports: e.g. supported signature
* algorithms extension for server or as part of a certificate
* request for client.
*/
- unsigned int *peer_sigalgs;
+ uint16_t *peer_sigalgs;
/* Size of above array */
size_t peer_sigalgslen;
- /* Digest peer uses for signing */
- const EVP_MD *peer_md;
+ /* Sigalg peer actualy uses */
+ const SIGALG_LOOKUP *peer_sigalg;
/* Array of digests used for signing */
const EVP_MD *md[SSL_PKEY_NUM];
/*
* the client hello as the supported signature algorithms extension. For
* servers it represents the signature algorithms we are willing to use.
*/
- unsigned int *conf_sigalgs;
+ uint16_t *conf_sigalgs;
/* Size of above array */
size_t conf_sigalgslen;
/*
* represents the signature algorithms we are willing to use for client
* authentication.
*/
- unsigned int *client_sigalgs;
+ uint16_t *client_sigalgs;
/* Size of above array */
size_t client_sigalgslen;
/*
* Signature algorithms shared by client and server: cached because these
* are used most often.
*/
- TLS_SIGALGS *shared_sigalgs;
+ const SIGALG_LOOKUP **shared_sigalgs;
size_t shared_sigalgslen;
/*
* Certificate setup callback: if set is called whenever a certificate
CRYPTO_RWLOCK *lock;
} CERT;
-/* Structure containing decoded values of signature algorithms extension */
-struct tls_sigalgs_st {
- /* NID of hash algorithm */
- int hash_nid;
- /* NID of signature algorithm */
- int sign_nid;
- /* Combined hash and signature NID */
- int signandhash_nid;
- /* Raw value used in extension */
- unsigned int rsigalg;
-};
-
# define FP_ICC (int (*)(const void *,const void *))
/*
/* An invalid index into the TLSv1.3 PSK identities */
#define TLSEXT_PSK_BAD_IDENTITY -1
-#define SIGID_IS_PSS(sigid) ((sigid) == TLSEXT_SIGALG_rsa_pss_sha256 \
- || (sigid) == TLSEXT_SIGALG_rsa_pss_sha384 \
- || (sigid) == TLSEXT_SIGALG_rsa_pss_sha512)
-
+#define SSL_USE_PSS(s) (s->s3->tmp.peer_sigalg != NULL && \
+ s->s3->tmp.peer_sigalg->sig == EVP_PKEY_RSA_PSS)
/* A dummy signature value not valid for TLSv1.2 signature algs */
#define TLSEXT_signature_rsa_pss 0x0101
void ssl_cert_clear_certs(CERT *c);
void ssl_cert_free(CERT *c);
__owur int ssl_get_new_session(SSL *s, int session);
-__owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello);
+__owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello, int *al);
__owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
__owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
__owur int ssl_cipher_get_cert_index(const SSL_CIPHER *c);
__owur const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl,
const unsigned char *ptr);
-__owur const EVP_MD *ssl_cipher_get_handshake_md(int cipher_id);
__owur int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_set1_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain);
__owur int ssl_cert_add0_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x);
void ssl_set_default_md(SSL *s);
__owur int tls1_set_server_sigalgs(SSL *s);
-__owur int tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
- SSL_SESSION **ret);
-
-/* Return codes for tls_decrypt_ticket */
-#define TICKET_FATAL_ERR_MALLOC -2
-#define TICKET_FATAL_ERR_OTHER -1
-#define TICKET_NO_DECRYPT 2
-#define TICKET_SUCCESS 3
-#define TICKET_SUCCESS_RENEW 4
-__owur int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
- size_t eticklen, const unsigned char *sess_id,
- size_t sesslen, SSL_SESSION **psess);
+
+/* Return codes for tls_get_ticket_from_client() and tls_decrypt_ticket() */
+typedef enum ticket_en {
+ /* fatal error, malloc failure */
+ TICKET_FATAL_ERR_MALLOC,
+ /* fatal error, either from parsing or decrypting the ticket */
+ TICKET_FATAL_ERR_OTHER,
+ /* No ticket present */
+ TICKET_NONE,
+ /* Empty ticket present */
+ TICKET_EMPTY,
+ /* the ticket couldn't be decrypted */
+ TICKET_NO_DECRYPT,
+ /* a ticket was successfully decrypted */
+ TICKET_SUCCESS,
+ /* same as above but the ticket needs to be reneewed */
+ TICKET_SUCCESS_RENEW
+} TICKET_RETURN;
+
+__owur TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
+ SSL_SESSION **ret);
+__owur TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
+ size_t eticklen,
+ const unsigned char *sess_id,
+ size_t sesslen, SSL_SESSION **psess);
__owur int tls_use_ticket(SSL *s);
__owur int tls12_get_sigandhash(SSL *s, WPACKET *pkt, const EVP_PKEY *pk,
const EVP_MD *md, int *ispss);
-__owur const EVP_MD *tls12_get_hash(int hash_nid);
void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op);
__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client);
__owur int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *ex,
int vfy);
+int tls_choose_sigalg(SSL *s);
+
__owur EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md);
void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
__owur long ssl_get_algorithm2(SSL *s);
__owur int tls12_copy_sigalgs(SSL *s, WPACKET *pkt,
- const unsigned int *psig, size_t psiglen);
+ const uint16_t *psig, size_t psiglen);
__owur int tls1_save_sigalgs(SSL *s, PACKET *pkt);
__owur int tls1_process_sigalgs(SSL *s);
-__owur size_t tls12_get_psigalgs(SSL *s, int sent, const unsigned int **psigs);
-__owur int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s, unsigned int sig,
- EVP_PKEY *pkey);
+__owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs);
+__owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey);
void ssl_set_client_disabled(SSL *s);
__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op);
const uint8_t *premaster,
size_t premaster_len);
-/* ssl_log_master_secret logs |master| to the SSL_CTX associated with |ssl|, if
- * logging is enabled. It returns one on success and zero on failure. The entry
- * is identified by |client_random|.
+/*
+ * ssl_log_secret logs |secret| to the SSL_CTX associated with |ssl|, if
+ * logging is available. It returns one on success and zero on failure. It tags
+ * the entry with |label|.
*/
-__owur int ssl_log_master_secret(SSL *ssl, const uint8_t *client_random,
- size_t client_random_len,
- const uint8_t *master, size_t master_len);
+__owur int ssl_log_secret(SSL *ssl, const char *label,
+ const uint8_t *secret, size_t secret_len);
+
+#define MASTER_SECRET_LABEL "CLIENT_RANDOM"
+#define CLIENT_HANDSHAKE_LABEL "CLIENT_HANDSHAKE_TRAFFIC_SECRET"
+#define SERVER_HANDSHAKE_LABEL "SERVER_HANDSHAKE_TRAFFIC_SECRET"
+#define CLIENT_APPLICATION_LABEL "CLIENT_TRAFFIC_SECRET_0"
+#define SERVER_APPLICATION_LABEL "SERVER_TRAFFIC_SECRET_0"
/* s3_cbc.c */
__owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);