]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/statem/statem_locl.h
Add support for the psk_key_exchange_modes extension
[thirdparty/openssl.git] / ssl / statem / statem_locl.h
CommitLineData
846e33c7
RS
1/*
2 * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
61ae935a 3 *
846e33c7
RS
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
61ae935a
MC
8 */
9
10/*****************************************************************************
11 * *
12 * The following definitions are PRIVATE to the state machine. They should *
13 * NOT be used outside of the state machine. *
14 * *
15 *****************************************************************************/
16
17/* Max message length definitions */
18
19/* The spec allows for a longer length than this, but we limit it */
20#define HELLO_VERIFY_REQUEST_MAX_LENGTH 258
21#define SERVER_HELLO_MAX_LENGTH 20000
e46f2334 22#define ENCRYPTED_EXTENSIONS_MAX_LENGTH 20000
61ae935a
MC
23#define SERVER_KEY_EXCH_MAX_LENGTH 102400
24#define SERVER_HELLO_DONE_MAX_LENGTH 0
25#define CCS_MAX_LENGTH 1
26/* Max should actually be 36 but we are generous */
27#define FINISHED_MAX_LENGTH 64
28
fadd9a1e 29/* Extension context codes */
70af3d8e 30/* This extension is only allowed in TLS */
6b473aca 31#define EXT_TLS_ONLY 0x0001
70af3d8e 32/* This extension is only allowed in DTLS */
6b473aca
MC
33#define EXT_DTLS_ONLY 0x0002
34/* Some extensions may be allowed in DTLS but we don't implement them for it */
35#define EXT_TLS_IMPLEMENTATION_ONLY 0x0004
36/* Most extensions are not defined for SSLv3 but EXT_TYPE_renegotiate is */
37#define EXT_SSL3_ALLOWED 0x0008
70af3d8e 38/* Extension is only defined for TLS1.2 and above */
6b473aca 39#define EXT_TLS1_2_AND_BELOW_ONLY 0x0010
70af3d8e 40/* Extension is only defined for TLS1.3 and above */
6b473aca
MC
41#define EXT_TLS1_3_ONLY 0x0020
42#define EXT_CLIENT_HELLO 0x0040
fadd9a1e 43/* Really means TLS1.2 or below */
6b473aca
MC
44#define EXT_TLS1_2_SERVER_HELLO 0x0080
45#define EXT_TLS1_3_SERVER_HELLO 0x0100
46#define EXT_TLS1_3_ENCRYPTED_EXTENSIONS 0x0200
47#define EXT_TLS1_3_HELLO_RETRY_REQUEST 0x0400
48#define EXT_TLS1_3_CERTIFICATE 0x0800
49#define EXT_TLS1_3_NEW_SESSION_TICKET 0x1000
fadd9a1e 50
61ae935a 51/* Message processing return codes */
be3583fa 52typedef enum {
61ae935a
MC
53 /* Something bad happened */
54 MSG_PROCESS_ERROR,
55 /* We've finished reading - swap to writing */
56 MSG_PROCESS_FINISHED_READING,
57 /*
58 * We've completed the main processing of this message but there is some
59 * post processing to be done.
60 */
61 MSG_PROCESS_CONTINUE_PROCESSING,
62 /* We've finished this message - read the next message */
63 MSG_PROCESS_CONTINUE_READING
be3583fa 64} MSG_PROCESS_RETURN;
61ae935a
MC
65
66/* Flush the write BIO */
67int statem_flush(SSL *s);
68
a15c953f
MC
69typedef int (*confunc_f) (SSL *s, WPACKET *pkt);
70
61ae935a
MC
71/*
72 * TLS/DTLS client state machine functions
73 */
8481f583
MC
74int ossl_statem_client_read_transition(SSL *s, int mt);
75WRITE_TRAN ossl_statem_client_write_transition(SSL *s);
76WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst);
77WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst);
6392fb8e 78int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt,
a15c953f 79 confunc_f *confunc, int *mt);
eda75751 80size_t ossl_statem_client_max_message_size(SSL *s);
8481f583
MC
81MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt);
82WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst);
61ae935a
MC
83
84/*
85 * TLS/DTLS server state machine functions
86 */
8481f583
MC
87int ossl_statem_server_read_transition(SSL *s, int mt);
88WRITE_TRAN ossl_statem_server_write_transition(SSL *s);
89WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst);
90WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst);
6392fb8e 91int ossl_statem_server_construct_message(SSL *s, WPACKET *pkt,
a15c953f 92 confunc_f *confunc,int *mt);
eda75751 93size_t ossl_statem_server_max_message_size(SSL *s);
8481f583
MC
94MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt);
95WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst);
61ae935a
MC
96
97/* Functions for getting new message data */
98__owur int tls_get_message_header(SSL *s, int *mt);
eda75751
MC
99__owur int tls_get_message_body(SSL *s, size_t *len);
100__owur int dtls_get_message(SSL *s, int *mt, size_t *len);
61ae935a
MC
101
102/* Message construction and processing functions */
7776a36c 103__owur int tls_process_initial_server_flight(SSL *s, int *al);
be3583fa
MC
104__owur MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL *s, PACKET *pkt);
105__owur MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt);
7cea05dc
MC
106__owur int tls_construct_change_cipher_spec(SSL *s, WPACKET *pkt);
107__owur int dtls_construct_change_cipher_spec(SSL *s, WPACKET *pkt);
61ae935a 108
229185e6 109__owur int tls_construct_finished(SSL *s, WPACKET *pkt);
be3583fa
MC
110__owur WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst);
111__owur WORK_STATE dtls_wait_for_dry(SSL *s);
61ae935a
MC
112
113/* some client-only functions */
7cea05dc 114__owur int tls_construct_client_hello(SSL *s, WPACKET *pkt);
be3583fa
MC
115__owur MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt);
116__owur MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt);
117__owur MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt);
cc2455bf 118__owur MSG_PROCESS_RETURN tls13_process_new_session_ticket(SSL *s, PACKET *pkt);
f63e4288 119__owur int tls_process_cert_status_body(SSL *s, PACKET *pkt, int *al);
be3583fa
MC
120__owur MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt);
121__owur MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt);
d8bc1399 122__owur int tls_construct_cert_verify(SSL *s, WPACKET *pkt);
be3583fa 123__owur WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst);
7cea05dc 124__owur int tls_construct_client_certificate(SSL *s, WPACKET *pkt);
61ae935a 125__owur int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey);
7cea05dc 126__owur int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt);
61ae935a 127__owur int tls_client_key_exchange_post_work(SSL *s);
f63e4288 128__owur int tls_construct_cert_status_body(SSL *s, WPACKET *pkt);
7cea05dc 129__owur int tls_construct_cert_status(SSL *s, WPACKET *pkt);
a230b26e 130__owur MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt);
be3583fa 131__owur MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt);
61ae935a 132__owur int ssl3_check_cert_and_algorithm(SSL *s);
a230b26e 133#ifndef OPENSSL_NO_NEXTPROTONEG
7cea05dc 134__owur int tls_construct_next_proto(SSL *s, WPACKET *pkt);
a230b26e 135#endif
c7f47786 136__owur MSG_PROCESS_RETURN tls_process_hello_req(SSL *s, PACKET *pkt);
be3583fa 137__owur MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt);
61ae935a
MC
138
139/* some server-only functions */
be3583fa
MC
140__owur MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt);
141__owur WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst);
7cea05dc 142__owur int tls_construct_server_hello(SSL *s, WPACKET *pkt);
7cea05dc
MC
143__owur int dtls_construct_hello_verify_request(SSL *s, WPACKET *pkt);
144__owur int tls_construct_server_certificate(SSL *s, WPACKET *pkt);
145__owur int tls_construct_server_key_exchange(SSL *s, WPACKET *pkt);
146__owur int tls_construct_certificate_request(SSL *s, WPACKET *pkt);
147__owur int tls_construct_server_done(SSL *s, WPACKET *pkt);
be3583fa
MC
148__owur MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt);
149__owur MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt);
150__owur WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst);
151__owur MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt);
a230b26e 152#ifndef OPENSSL_NO_NEXTPROTONEG
be3583fa 153__owur MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt);
a230b26e 154#endif
7cea05dc 155__owur int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt);
6b473aca 156
70af3d8e
MC
157
158/* Extension processing */
159
160__owur int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
161 RAW_EXTENSION **res, int *al);
7d152a3c 162__owur int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
8521ced6 163 RAW_EXTENSION *exts, X509 *x, size_t chainidx,
f97d4c37 164 int *al);
4b299b8e 165__owur int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts,
8521ced6 166 X509 *x, size_t chainidx, int *al);
4b299b8e 167__owur int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
8521ced6 168 X509 *x, size_t chainidx, int *al);
25670f3e
MC
169
170/* Server Extension processing */
8521ced6 171int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 172 int *al);
8521ced6 173int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 174 int *al);
25670f3e 175#ifndef OPENSSL_NO_SRP
8521ced6 176int tls_parse_ctos_srp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
25670f3e
MC
177#endif
178#ifndef OPENSSL_NO_EC
8521ced6 179int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 180 int *al);
8521ced6
MC
181int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, X509 *x,
182 size_t chainidx, int *al);
25670f3e 183#endif
8521ced6 184int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 185 int *al);
8521ced6 186int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 187 int *al);
ab83e314 188#ifndef OPENSSL_NO_OCSP
8521ced6 189int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 190 int *al);
ab83e314 191#endif
25670f3e 192#ifndef OPENSSL_NO_NEXTPROTONEG
8521ced6 193int tls_parse_ctos_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
25670f3e 194#endif
8521ced6 195int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
25670f3e 196#ifndef OPENSSL_NO_SRTP
8521ced6 197int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 198 int *al);
25670f3e 199#endif
8521ced6
MC
200int tls_parse_ctos_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
201int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 202 int *al);
8521ced6 203int tls_parse_ctos_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
b2f7e8c0
MC
204int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
205 int *al);
7da160b0 206
8521ced6
MC
207int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, X509 *x,
208 size_t chainidx, int *al);
209int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, X509 *x,
210 size_t chainidx, int *al);
ab83e314 211#ifndef OPENSSL_NO_EC
30aeba43 212int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 213 size_t chainidx, int *al);
ab83e314 214#endif
30aeba43 215int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 216 size_t chainidx, int *al);
ab83e314 217#ifndef OPENSSL_NO_OCSP
30aeba43 218int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 219 size_t chainidx, int *al);
ab83e314
MC
220#endif
221#ifndef OPENSSL_NO_NEXTPROTONEG
30aeba43 222int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 223 size_t chainidx, int *al);
ab83e314 224#endif
8521ced6 225int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 226 int *al);
ab83e314 227#ifndef OPENSSL_NO_SRTP
8521ced6 228int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 229 int *al);
ab83e314 230#endif
8521ced6 231int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 232 int *al);
8521ced6 233int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 234 int *al);
8521ced6 235int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 236 int *al);
7da160b0
MC
237/*
238 * Not in public headers as this is not an official extension. Only used when
239 * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set.
240 */
241#define TLSEXT_TYPE_cryptopro_bug 0xfde8
30aeba43 242int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 243 size_t chainidx, int *al);
6dd083fd
MC
244
245/* Client Extension processing */
8521ced6
MC
246int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x,
247 size_t chainidx, int *al);
248int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, X509 *x,
249 size_t chainidx, int *al);
ab83e314 250#ifndef OPENSSL_NO_SRP
8521ced6 251int tls_construct_ctos_srp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 252 int *al);
ab83e314
MC
253#endif
254#ifndef OPENSSL_NO_EC
30aeba43 255int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 256 size_t chainidx, int *al);
30aeba43 257int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 258 size_t chainidx, int *al);
ab83e314 259#endif
30aeba43 260int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
8521ced6
MC
261 size_t chainidx, int *al);
262int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 263 int *al);
ab83e314 264#ifndef OPENSSL_NO_OCSP
30aeba43 265int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, X509 *x,
8521ced6 266 size_t chainidx, int *al);
ab83e314
MC
267#endif
268#ifndef OPENSSL_NO_NEXTPROTONEG
8521ced6 269int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 270 int *al);
ab83e314 271#endif
8521ced6 272int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 273 int *al);
ab83e314 274#ifndef OPENSSL_NO_SRTP
8521ced6 275int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 276 int *al);
ab83e314 277#endif
8521ced6 278int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 279 int *al);
ab83e314 280#ifndef OPENSSL_NO_CT
8521ced6 281int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 282 int *al);
ab83e314 283#endif
8521ced6 284int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43
MC
285 int *al);
286int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, X509 *x,
8521ced6
MC
287 size_t chainidx, int *al);
288int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 289 int *al);
b2f7e8c0
MC
290int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, X509 *x,
291 size_t chainidx, int *al);
8521ced6 292int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
30aeba43 293 int *al);
8521ced6 294int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 295 int *al);
8521ced6 296int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 297 int *al);
6dd083fd 298#ifndef OPENSSL_NO_EC
8521ced6 299int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 300 int *al);
6dd083fd 301#endif
8521ced6 302int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 303 int *al);
ab83e314 304#ifndef OPENSSL_NO_OCSP
8521ced6 305int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 306 int *al);
ab83e314 307#endif
6dd083fd 308#ifndef OPENSSL_NO_CT
8521ced6 309int tls_parse_stoc_sct(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
6dd083fd
MC
310#endif
311#ifndef OPENSSL_NO_NEXTPROTONEG
8521ced6 312int tls_parse_stoc_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
6dd083fd 313#endif
8521ced6 314int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
6dd083fd 315#ifndef OPENSSL_NO_SRTP
8521ced6 316int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 317 int *al);
6dd083fd 318#endif
8521ced6
MC
319int tls_parse_stoc_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
320int tls_parse_stoc_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
321int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
f97d4c37 322 int *al);