[thirdparty/openssl.git] / ssl / statem / statem_locl.h

/* ====================================================================
 * Copyright (c) 1998-2015 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

/*****************************************************************************
 *                                                                           *
 * The following definitions are PRIVATE to the state machine. They should   *
 * NOT be used outside of the state machine.                                 *
 *                                                                           *
 *****************************************************************************/

/* Max message length definitions */

/* The spec allows for a longer length than this, but we limit it */
#define HELLO_VERIFY_REQUEST_MAX_LENGTH 258
#define SERVER_HELLO_MAX_LENGTH         20000
#define SERVER_KEY_EXCH_MAX_LENGTH      102400
#define SERVER_HELLO_DONE_MAX_LENGTH    0
#define CCS_MAX_LENGTH                  1
/* Max should actually be 36 but we are generous */
#define FINISHED_MAX_LENGTH             64

/* Message processing return codes */
typedef enum {
    /* Something bad happened */
    MSG_PROCESS_ERROR,
    /* We've finished reading - swap to writing */
    MSG_PROCESS_FINISHED_READING,
    /*
     * We've completed the main processing of this message but there is some
     * post processing to be done.
     */
    MSG_PROCESS_CONTINUE_PROCESSING,
    /* We've finished this message - read the next message */
    MSG_PROCESS_CONTINUE_READING
} MSG_PROCESS_RETURN;

/* Flush the write BIO */
int statem_flush(SSL *s);

/*
 * TLS/DTLS client state machine functions
 */
int ossl_statem_client_read_transition(SSL *s, int mt);
WRITE_TRAN ossl_statem_client_write_transition(SSL *s);
WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst);
WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst);
int ossl_statem_client_construct_message(SSL *s);
unsigned long ossl_statem_client_max_message_size(SSL *s);
MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt);
WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst);

/*
 * TLS/DTLS server state machine functions
 */
int ossl_statem_server_read_transition(SSL *s, int mt);
WRITE_TRAN ossl_statem_server_write_transition(SSL *s);
WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst);
WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst);
int ossl_statem_server_construct_message(SSL *s);
unsigned long ossl_statem_server_max_message_size(SSL *s);
MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt);
WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst);

/* Functions for getting new message data */
__owur int tls_get_message_header(SSL *s, int *mt);
__owur int tls_get_message_body(SSL *s, unsigned long *len);
__owur int dtls_get_message(SSL *s, int *mt, unsigned long *len);

/* Message construction and processing functions */
__owur MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL *s, PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt);
__owur int tls_construct_change_cipher_spec(SSL *s);
__owur int dtls_construct_change_cipher_spec(SSL *s);

__owur int tls_construct_finished(SSL *s, const char *sender, int slen);
__owur WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst);
__owur WORK_STATE dtls_wait_for_dry(SSL *s);

/* some client-only functions */
__owur int tls_construct_client_hello(SSL *s);
__owur MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt);
__owur int tls_construct_client_verify(SSL *s);
__owur WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst);
__owur int tls_construct_client_certificate(SSL *s);
__owur int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey);
__owur int tls_construct_client_key_exchange(SSL *s);
__owur int tls_client_key_exchange_post_work(SSL *s);
__owur int tls_construct_cert_status(SSL *s);
__owur MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s,
                                                        PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt);
__owur int ssl3_check_cert_and_algorithm(SSL *s);
#  ifndef OPENSSL_NO_NEXTPROTONEG
__owur int tls_construct_next_proto(SSL *s);
#  endif
__owur MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt);

/* some server-only functions */
__owur MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt);
__owur WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst);
__owur int tls_construct_server_hello(SSL *s);
__owur int tls_construct_hello_request(SSL *s);
__owur int dtls_construct_hello_verify_request(SSL *s);
__owur int tls_construct_server_certificate(SSL *s);
__owur int tls_construct_server_key_exchange(SSL *s);
__owur int tls_construct_certificate_request(SSL *s);
__owur int tls_construct_server_done(SSL *s);
__owur MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt);
__owur MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt);
__owur WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst);
__owur MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt);
#  ifndef OPENSSL_NO_NEXTPROTONEG
__owur MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt);
#  endif
__owur int tls_construct_new_session_ticket(SSL *s);
Commit	Line	Data
61ae935a MC	1	/* ====================================================================
	2	* Copyright (c) 1998-2015 The OpenSSL Project. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	*
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	*
	11	* 2. Redistributions in binary form must reproduce the above copyright
	12	* notice, this list of conditions and the following disclaimer in
	13	* the documentation and/or other materials provided with the
	14	* distribution.
	15	*
	16	* 3. All advertising materials mentioning features or use of this
	17	* software must display the following acknowledgment:
	18	* "This product includes software developed by the OpenSSL Project
	19	* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
	20	*
	21	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	22	* endorse or promote products derived from this software without
	23	* prior written permission. For written permission, please contact
	24	* openssl-core@openssl.org.
	25	*
	26	* 5. Products derived from this software may not be called "OpenSSL"
	27	* nor may "OpenSSL" appear in their names without prior written
	28	* permission of the OpenSSL Project.
	29	*
	30	* 6. Redistributions of any form whatsoever must retain the following
	31	* acknowledgment:
	32	* "This product includes software developed by the OpenSSL Project
	33	* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
	34	*
	35	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	36	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	37	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	38	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	39	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	40	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	41	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	42	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	43	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	44	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	45	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	46	* OF THE POSSIBILITY OF SUCH DAMAGE.
	47	* ====================================================================
	48	*
	49	* This product includes cryptographic software written by Eric Young
	50	* (eay@cryptsoft.com). This product includes software written by Tim
	51	* Hudson (tjh@cryptsoft.com).
	52	*
	53	*/
	54
	55	/*****************************************************************************
	56	* *
	57	* The following definitions are PRIVATE to the state machine. They should *
	58	* NOT be used outside of the state machine. *
	59	* *
	60	*****************************************************************************/
	61
	62	/* Max message length definitions */
	63
	64	/* The spec allows for a longer length than this, but we limit it */
65	#define HELLO_VERIFY_REQUEST_MAX_LENGTH 258
66	#define SERVER_HELLO_MAX_LENGTH 20000
67	#define SERVER_KEY_EXCH_MAX_LENGTH 102400
68	#define SERVER_HELLO_DONE_MAX_LENGTH 0
69	#define CCS_MAX_LENGTH 1
70	/* Max should actually be 36 but we are generous */
71	#define FINISHED_MAX_LENGTH 64
72
73	/* Message processing return codes */
be3583fa	74	typedef enum {
61ae935a MC	75	/* Something bad happened */
	76	MSG_PROCESS_ERROR,
	77	/* We've finished reading - swap to writing */
	78	MSG_PROCESS_FINISHED_READING,
	79	/*
	80	* We've completed the main processing of this message but there is some
	81	* post processing to be done.
	82	*/
	83	MSG_PROCESS_CONTINUE_PROCESSING,
	84	/* We've finished this message - read the next message */
	85	MSG_PROCESS_CONTINUE_READING
be3583fa	86	} MSG_PROCESS_RETURN;
61ae935a MC	87
	88	/* Flush the write BIO */
	89	int statem_flush(SSL *s);
	90
	91	/*
	92	* TLS/DTLS client state machine functions
	93	*/
8481f583 MC	94	int ossl_statem_client_read_transition(SSL *s, int mt);
	95	WRITE_TRAN ossl_statem_client_write_transition(SSL *s);
	96	WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst);
	97	WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst);
	98	int ossl_statem_client_construct_message(SSL *s);
	99	unsigned long ossl_statem_client_max_message_size(SSL *s);
	100	MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL s, PACKET pkt);
	101	WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst);
61ae935a MC	102
	103	/*
	104	* TLS/DTLS server state machine functions
	105	*/
8481f583 MC	106	int ossl_statem_server_read_transition(SSL *s, int mt);
	107	WRITE_TRAN ossl_statem_server_write_transition(SSL *s);
	108	WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst);
	109	WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst);
	110	int ossl_statem_server_construct_message(SSL *s);
	111	unsigned long ossl_statem_server_max_message_size(SSL *s);
	112	MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL s, PACKET pkt);
	113	WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst);
61ae935a MC	114
	115	/* Functions for getting new message data */
	116	__owur int tls_get_message_header(SSL s, int mt);
	117	__owur int tls_get_message_body(SSL s, unsigned long len);
	118	__owur int dtls_get_message(SSL s, int mt, unsigned long *len);
	119
	120	/* Message construction and processing functions */
be3583fa MC	121	__owur MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL s, PACKET pkt);
be3583fa MC	122	__owur MSG_PROCESS_RETURN tls_process_finished(SSL s, PACKET pkt);
61ae935a MC	123	__owur int tls_construct_change_cipher_spec(SSL *s);
	124	__owur int dtls_construct_change_cipher_spec(SSL *s);
	125
	126	__owur int tls_construct_finished(SSL s, const char sender, int slen);
be3583fa MC	127	__owur WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst);
be3583fa MC	128	__owur WORK_STATE dtls_wait_for_dry(SSL *s);
61ae935a MC	129
	130	/* some client-only functions */
	131	__owur int tls_construct_client_hello(SSL *s);
be3583fa MC	132	__owur MSG_PROCESS_RETURN tls_process_server_hello(SSL s, PACKET pkt);
	133	__owur MSG_PROCESS_RETURN tls_process_certificate_request(SSL s, PACKET pkt);
	134	__owur MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL s, PACKET pkt);
	135	__owur MSG_PROCESS_RETURN tls_process_cert_status(SSL s, PACKET pkt);
	136	__owur MSG_PROCESS_RETURN tls_process_server_done(SSL s, PACKET pkt);
61ae935a	137	__owur int tls_construct_client_verify(SSL *s);
be3583fa	138	__owur WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst);
61ae935a MC	139	__owur int tls_construct_client_certificate(SSL *s);
	140	__owur int ssl_do_client_cert_cb(SSL s, X509 px509, EVP_PKEY *ppkey);
	141	__owur int tls_construct_client_key_exchange(SSL *s);
	142	__owur int tls_client_key_exchange_post_work(SSL *s);
	143	__owur int tls_construct_cert_status(SSL *s);
be3583fa	144	__owur MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s,
61ae935a	145	PACKET *pkt);
be3583fa	146	__owur MSG_PROCESS_RETURN tls_process_server_certificate(SSL s, PACKET pkt);
61ae935a MC	147	__owur int ssl3_check_cert_and_algorithm(SSL *s);
	148	# ifndef OPENSSL_NO_NEXTPROTONEG
	149	__owur int tls_construct_next_proto(SSL *s);
	150	# endif
be3583fa	151	__owur MSG_PROCESS_RETURN dtls_process_hello_verify(SSL s, PACKET pkt);
61ae935a MC	152
61ae935a MC	153	/* some server-only functions */
be3583fa MC	154	__owur MSG_PROCESS_RETURN tls_process_client_hello(SSL s, PACKET pkt);
be3583fa MC	155	__owur WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst);
61ae935a MC	156	__owur int tls_construct_server_hello(SSL *s);
	157	__owur int tls_construct_hello_request(SSL *s);
	158	__owur int dtls_construct_hello_verify_request(SSL *s);
	159	__owur int tls_construct_server_certificate(SSL *s);
	160	__owur int tls_construct_server_key_exchange(SSL *s);
	161	__owur int tls_construct_certificate_request(SSL *s);
	162	__owur int tls_construct_server_done(SSL *s);
be3583fa MC	163	__owur MSG_PROCESS_RETURN tls_process_client_certificate(SSL s, PACKET pkt);
	164	__owur MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL s, PACKET pkt);
	165	__owur WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst);
	166	__owur MSG_PROCESS_RETURN tls_process_cert_verify(SSL s, PACKET pkt);
61ae935a	167	# ifndef OPENSSL_NO_NEXTPROTONEG
be3583fa	168	__owur MSG_PROCESS_RETURN tls_process_next_proto(SSL s, PACKET pkt);
61ae935a MC	169	# endif
61ae935a MC	170	__owur int tls_construct_new_session_ticket(SSL *s);