Line data Source code
1 : #ifndef HEADER_fd_src_waltz_tls_fd_tls_proto_h
2 : #define HEADER_fd_src_waltz_tls_fd_tls_proto_h
3 :
4 : /* fd_tls_proto.h declares various TLS v1.3 data structures and provides
5 : internal APIs to decode and encode them from/to wire format.
6 :
7 : Most encodings in TLS v1.3 are laid out dynamically and cannot be
8 : represented with packed C structs, such as variable-length lists and
9 : "unions" (fields that may hold one of multiple data types). For this
10 : dynamic kind of data, fd_tls_proto declares custom structs and
11 : provides an encode/decode API.
12 :
13 : A small number of type encodings are laid out statically. For these,
14 : a packed C struct and a "bswap" (endianness conversion) function is
15 : provided. */
16 :
17 : #include "../fd_waltz_base.h"
18 : #include <stddef.h>
19 :
20 : /* TLS Extensions *****************************************************/
21 :
22 : struct __attribute__((packed)) fd_tls_ext_hdr {
23 : ushort type;
24 : ushort sz;
25 : };
26 :
27 : typedef struct fd_tls_ext_hdr fd_tls_ext_hdr_t;
28 :
29 : /* Supported TLS versions (RFC 8446)
30 : Type: FD_TLS_EXT_TYPE_SUPPORTED_VERSIONS */
31 :
32 : struct fd_tls_ext_supported_versions {
33 : uchar tls13 : 1;
34 : };
35 :
36 : typedef struct fd_tls_ext_supported_versions fd_tls_ext_supported_versions_t;
37 :
38 : /* Server name indication (RFC 6066)
39 : Type: FD_TLS_EXT_TYPE_SERVER_NAME (0) */
40 :
41 : struct fd_tls_ext_server_name {
42 : ushort host_name_len; /* Length of name cstr (excluding NUL) */
43 : char host_name[ 254 ]; /* Name cstr */
44 : };
45 :
46 : typedef struct fd_tls_ext_server_name fd_tls_ext_server_name_t;
47 :
48 : /* Supported ECDHE groups (RFC 8422, 7919)
49 : Type: FD_TLS_EXT_TYPE_SUPPORTED_GROUPS */
50 :
51 : struct fd_tls_ext_supported_groups {
52 : uchar x25519 : 1;
53 : };
54 :
55 : typedef struct fd_tls_ext_supported_groups fd_tls_ext_supported_groups_t;
56 :
57 : /* Supported signature schemes (RFC 8446)
58 : Type: FD_TLS_EXT_TYPE_SIGNATURE_ALGORITHMS */
59 :
60 : struct fd_tls_ext_signature_algorithms {
61 : uchar ed25519 : 1;
62 : uchar ecdsa_secp256r1_sha256 : 1;
63 : uchar ecdsa_secp384r1_sha384 : 1;
64 : uchar rsa_pkcs1_sha256 : 1;
65 : uchar rsa_pkcs1_sha384 : 1;
66 : uchar rsa_pkcs1_sha512 : 1;
67 : uchar rsa_pss_rsae_sha256 : 1;
68 : uchar rsa_pss_rsae_sha384 : 1;
69 : uchar rsa_pss_rsae_sha512 : 1;
70 : };
71 :
72 : typedef struct fd_tls_ext_signature_algorithms fd_tls_ext_signature_algorithms_t;
73 :
74 : struct fd_tls_key_share {
75 : uchar has_x25519 : 1;
76 : uchar x25519[ 32 ];
77 : };
78 :
79 : typedef struct fd_tls_key_share fd_tls_key_share_t;
80 :
81 : /* fd_tls_ext_opaque_t holds a pointer to opaque serialized extension
82 : data. Lifetime of buf depends on context -- Look for documentation
83 : in usages of this structure.
84 :
85 : This structure can have 3 subtly different meanings:
86 : (!!buf) & (!!bufsz) Extension present, non-zero sz
87 : (!!buf) & ( !bufsz) Extension present, zero sz
88 : ( !buf) & ( !bufsz) Extension absent
89 :
90 : Notably,
91 : (!buf ) ... implies extension is absent
92 : (!bufsz) ... implies extension is absent or zero sz */
93 :
94 : struct fd_tls_ext_opaque {
95 : uchar const * buf;
96 : ulong bufsz;
97 : };
98 :
99 : typedef struct fd_tls_ext_opaque fd_tls_ext_opaque_t;
100 : typedef struct fd_tls_ext_opaque fd_tls_ext_quic_tp_t;
101 : typedef struct fd_tls_ext_opaque fd_tls_ext_alpn_t;
102 :
103 : /* TLS Messages *******************************************************/
104 :
105 : /* fd_tls_u24_t is a 24-bit / 3 byte big-endian integer.
106 : Matches wire representation. */
107 :
108 : struct fd_tls_u24 { uchar v[3]; };
109 : typedef struct fd_tls_u24 fd_tls_u24_t;
110 :
111 : /* fd_tls_msg_hdr_t is the header that all message types share. */
112 :
113 : struct __attribute__((packed)) fd_tls_msg_hdr {
114 : uchar type; /* FD_TLS_MSG_{...} */
115 : fd_tls_u24_t sz; /* Byte size of fields following this header */
116 : };
117 :
118 : typedef struct fd_tls_msg_hdr fd_tls_msg_hdr_t;
119 :
120 : /* fd_tls_client_hello_t describes a TLS v1.3 ClientHello (RFC 8446,
121 : Section 4.1.2). */
122 :
123 : struct fd_tls_client_hello {
124 : uchar random[ 32 ];
125 :
126 : struct {
127 : uchar aes_128_gcm_sha256 : 1;
128 : /* Add more cipher suites here */
129 : } cipher_suites;
130 :
131 : fd_tls_ext_opaque_t session_id;
132 :
133 : /* Presence is independent of whether a supported algorithm was found. */
134 : uchar has_supported_groups : 1;
135 : uchar has_signature_algorithms : 1;
136 : uchar has_key_share : 1;
137 :
138 : fd_tls_ext_supported_versions_t supported_versions;
139 : fd_tls_ext_server_name_t server_name;
140 : fd_tls_ext_supported_groups_t supported_groups;
141 : fd_tls_ext_signature_algorithms_t signature_algorithms;
142 : fd_tls_ext_signature_algorithms_t signature_algorithms_cert;
143 : fd_tls_key_share_t key_share;
144 : fd_tls_ext_quic_tp_t quic_tp;
145 : fd_tls_ext_alpn_t alpn;
146 : };
147 :
148 : typedef struct fd_tls_client_hello fd_tls_client_hello_t;
149 :
150 : /* fd_tls_server_hello_t describes a TLS v1.3 ServerHello (RFC 8446,
151 : Section 4.1.3). */
152 :
153 : struct fd_tls_server_hello {
154 : uchar random[ 32 ];
155 : ushort cipher_suite;
156 :
157 : fd_tls_ext_opaque_t session_id;
158 : fd_tls_key_share_t key_share;
159 : };
160 :
161 : typedef struct fd_tls_server_hello fd_tls_server_hello_t;
162 :
163 : /* fd_tls_enc_ext_t describes a TLS v1.3 EncryptedExtensions message
164 : (RFC 8446, Section 4.3.1). */
165 :
166 : struct fd_tls_enc_ext {
167 : fd_tls_ext_quic_tp_t quic_tp;
168 : fd_tls_ext_alpn_t alpn;
169 : uint server_name:1;
170 : };
171 :
172 : typedef struct fd_tls_enc_ext fd_tls_enc_ext_t;
173 :
174 : /* fd_tls_cert_verify_t describes a CertificateVerify (RFC 8446, Section
175 : 4.4.3). Supports Ed25519 (64 byte sig), ECDSA-P256 (DER encoded,
176 : up to 73 bytes), and RSA-PSS (modulus size, up to 512 bytes). */
177 :
178 : #define FD_TLS_CV_SIG_SZ_MAX (512UL)
179 :
180 : struct fd_tls_cert_verify {
181 : ushort algorithm; /* FD_TLS_SIGNATURE_{...} */
182 : ushort signature_len;
183 : uchar signature[ FD_TLS_CV_SIG_SZ_MAX ];
184 : };
185 :
186 : typedef struct fd_tls_cert_verify fd_tls_cert_verify_t;
187 :
188 : /* fd_tls_finished_t matches the wire representation of Finished (RFC
189 : 8446, Section 4.4.4). Only supports TLS cipher suites with 32 byte
190 : hash output size. */
191 :
192 : struct __attribute__((packed)) fd_tls_finished {
193 : uchar verify[ 32 ];
194 : };
195 :
196 : typedef struct fd_tls_finished fd_tls_finished_t;
197 :
198 : /* Enums **************************************************************/
199 :
200 : /* TLS Legacy Version field */
201 :
202 0 : #define FD_TLS_VERSION_TLS12 ((ushort)0x0303)
203 : #define FD_TLS_VERSION_TLS13 ((ushort)0x0304)
204 :
205 : /* TLS cipher suite IDs */
206 :
207 0 : #define FD_TLS_CIPHER_SUITE_AES_128_GCM_SHA256 ((ushort)0x1301)
208 :
209 : /* TLS extension IDs */
210 :
211 0 : #define FD_TLS_EXT_SERVER_NAME ((ushort) 0)
212 0 : #define FD_TLS_EXT_SUPPORTED_GROUPS ((ushort)10)
213 0 : #define FD_TLS_EXT_SIGNATURE_ALGORITHMS ((ushort)13)
214 0 : #define FD_TLS_EXT_ALPN ((ushort)16)
215 0 : #define FD_TLS_EXT_CLIENT_CERT_TYPE ((ushort)19)
216 0 : #define FD_TLS_EXT_SERVER_CERT_TYPE ((ushort)20)
217 0 : #define FD_TLS_EXT_PRE_SHARED_KEY ((ushort)41)
218 0 : #define FD_TLS_EXT_SUPPORTED_VERSIONS ((ushort)43)
219 0 : #define FD_TLS_EXT_PSK_KEY_EXCHANGE_MODES ((ushort)45)
220 0 : #define FD_TLS_EXT_SIGNATURE_ALGORITHMS_CERT ((ushort)50)
221 0 : #define FD_TLS_EXT_KEY_SHARE ((ushort)51)
222 0 : #define FD_TLS_EXT_QUIC_TRANSPORT_PARAMS ((ushort)57)
223 :
224 : /* TLS Alert Protocol */
225 :
226 0 : #define FD_TLS_ALERT_CLOSE_NOTIFY ((uchar) 0)
227 0 : #define FD_TLS_ALERT_UNEXPECTED_MESSAGE ((uchar) 10)
228 0 : #define FD_TLS_ALERT_BAD_RECORD_MAC ((uchar) 20)
229 0 : #define FD_TLS_ALERT_RECORD_OVERFLOW ((uchar) 22)
230 0 : #define FD_TLS_ALERT_HANDSHAKE_FAILURE ((uchar) 40)
231 0 : #define FD_TLS_ALERT_BAD_CERTIFICATE ((uchar) 42)
232 0 : #define FD_TLS_ALERT_UNSUPPORTED_CERTIFICATE ((uchar) 43)
233 0 : #define FD_TLS_ALERT_CERTIFICATE_REVOKED ((uchar) 44)
234 0 : #define FD_TLS_ALERT_CERTIFICATE_EXPIRED ((uchar) 45)
235 0 : #define FD_TLS_ALERT_CERTIFICATE_UNKNOWN ((uchar) 46)
236 0 : #define FD_TLS_ALERT_ILLEGAL_PARAMETER ((uchar) 47)
237 0 : #define FD_TLS_ALERT_UNKNOWN_CA ((uchar) 48)
238 0 : #define FD_TLS_ALERT_ACCESS_DENIED ((uchar) 49)
239 0 : #define FD_TLS_ALERT_DECODE_ERROR ((uchar) 50)
240 0 : #define FD_TLS_ALERT_DECRYPT_ERROR ((uchar) 51)
241 0 : #define FD_TLS_ALERT_PROTOCOL_VERSION ((uchar) 70)
242 0 : #define FD_TLS_ALERT_INSUFFICIENT_SECURITY ((uchar) 71)
243 0 : #define FD_TLS_ALERT_INTERNAL_ERROR ((uchar) 80)
244 0 : #define FD_TLS_ALERT_INAPPROPRIATE_FALLBACK ((uchar) 86)
245 0 : #define FD_TLS_ALERT_USER_CANCELED ((uchar) 90)
246 0 : #define FD_TLS_ALERT_MISSING_EXTENSION ((uchar)109)
247 0 : #define FD_TLS_ALERT_UNSUPPORTED_EXTENSION ((uchar)110)
248 0 : #define FD_TLS_ALERT_UNRECOGNIZED_NAME ((uchar)112)
249 0 : #define FD_TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE ((uchar)113)
250 0 : #define FD_TLS_ALERT_UNKNOWN_PSK_IDENTITY ((uchar)115)
251 0 : #define FD_TLS_ALERT_CERTIFICATE_REQUIRED ((uchar)116)
252 0 : #define FD_TLS_ALERT_NO_APPLICATION_PROTOCOL ((uchar)120)
253 :
254 : /* TLS server_name extension */
255 :
256 0 : #define FD_TLS_SERVER_NAME_TYPE_DNS ((uchar)0) /* RFC 6066 */
257 :
258 : /* TLS signature scheme IDs */
259 :
260 0 : #define FD_TLS_SIGNATURE_RSA_PKCS1_SHA256 ((ushort)0x0401)
261 0 : #define FD_TLS_SIGNATURE_ECDSA_SECP256R1_SHA256 ((ushort)0x0403)
262 0 : #define FD_TLS_SIGNATURE_RSA_PKCS1_SHA384 ((ushort)0x0501)
263 0 : #define FD_TLS_SIGNATURE_ECDSA_SECP384R1_SHA384 ((ushort)0x0503)
264 0 : #define FD_TLS_SIGNATURE_RSA_PKCS1_SHA512 ((ushort)0x0601)
265 0 : #define FD_TLS_SIGNATURE_RSA_PSS_RSAE_SHA256 ((ushort)0x0804)
266 0 : #define FD_TLS_SIGNATURE_RSA_PSS_RSAE_SHA384 ((ushort)0x0805)
267 0 : #define FD_TLS_SIGNATURE_RSA_PSS_RSAE_SHA512 ((ushort)0x0806)
268 0 : #define FD_TLS_SIGNATURE_ED25519 ((ushort)0x0807)
269 :
270 : /* TLS supported_groups extension */
271 :
272 : #define FD_TLS_GROUP_SECP256R1 ((ushort)23)
273 0 : #define FD_TLS_GROUP_X25519 ((ushort)29)
274 :
275 : /* TLS supported_versions extension */
276 :
277 0 : #define FD_TLS_VERSION_TLS13 ((ushort)0x0304)
278 :
279 : /* TLS key_share extension */
280 :
281 : #define FD_TLS_KEY_SHARE_TYPE_X25519 ((ushort)29)
282 :
283 : /* TLS v1.3 message types */
284 :
285 0 : #define FD_TLS_MSG_CLIENT_HELLO ((uchar) 1)
286 0 : #define FD_TLS_MSG_SERVER_HELLO ((uchar) 2)
287 0 : #define FD_TLS_MSG_NEW_SESSION_TICKET ((uchar) 4)
288 0 : #define FD_TLS_MSG_ENCRYPTED_EXT ((uchar) 8)
289 0 : #define FD_TLS_MSG_CERT ((uchar) 11)
290 0 : #define FD_TLS_MSG_CERT_REQ ((uchar) 13)
291 0 : #define FD_TLS_MSG_CERT_VERIFY ((uchar) 15)
292 0 : #define FD_TLS_MSG_FINISHED ((uchar) 20)
293 0 : #define FD_TLS_MSG_KEY_UPDATE ((uchar) 24)
294 :
295 : /* Serialization related **********************************************/
296 :
297 : /* ### Decode functions
298 :
299 : Most deserializers follow the same prototype:
300 :
301 : long
302 : fd_tls_decode_TYPE( TYPE_t * out,
303 : void const * wire,
304 : ulong wire_sz );
305 :
306 : Reads bytes from wire and populates the data structure pointed to
307 : by out. out must be zero-initialized, as the decoder does not
308 : promise to fill in all fields. wire points to the first byte of the
309 : encoded payload that may span up to wire_sz bytes. Returns number of
310 : bytes read from wire on success. On failure, returns a negated TLS
311 : error code. (Typically DECODE_ERROR alert)
312 :
313 : wire is read-only. Output fields may reference its bytes; retain
314 : the input while those references are in use.
315 :
316 : ### Encode functions
317 :
318 : Most serializers follow the same prototype:
319 :
320 : long
321 : fd_tls_encode_TYPE( TYPE_t const * in,
322 : void * wire,
323 : ulong wire_sz );
324 :
325 : Writes bytes containing serialized version of data structure pointed
326 : to by in. wire points to the first byte of the buffer to fill.
327 : wire_sz is the size of that buffer. Returns number of bytes written
328 : on success (can be 0). On failure, returns a negated TLS error code. */
329 :
330 : FD_PROTOTYPES_BEGIN
331 :
332 : /* Methods for static layout types */
333 :
334 : /* Macro STATIC_SERDE defines decode/encode implementations for structs
335 : that match their wire encoding */
336 :
337 : #define STATIC_SERDE( NAME, TYPE_T ) \
338 : static inline long \
339 : fd_tls_decode_##NAME( TYPE_T * out, \
340 : uchar const * wire, \
341 0 : ulong wire_sz ) { \
342 0 : if( FD_UNLIKELY( wire_sz < sizeof(TYPE_T) ) ) \
343 0 : return -(long)FD_TLS_ALERT_DECODE_ERROR; \
344 0 : memcpy( out, wire, sizeof(TYPE_T) ); \
345 0 : fd_tls_##NAME##_bswap( out ); \
346 0 : return (long)sizeof(TYPE_T); \
347 0 : } \
348 : static inline long \
349 : fd_tls_encode_##NAME ( TYPE_T const * in, \
350 : void * wire, \
351 0 : ulong wire_sz ) { \
352 0 : if( FD_UNLIKELY( wire_sz < sizeof(TYPE_T) ) ) \
353 0 : return -(long)FD_TLS_ALERT_DECODE_ERROR; \
354 0 : TYPE_T * out = (TYPE_T *)wire; \
355 0 : memcpy( out, in, sizeof(TYPE_T) ); \
356 0 : fd_tls_##NAME##_bswap( out ); \
357 0 : return (long)sizeof(TYPE_T); \
358 0 : }
359 :
360 : /* End of STATIC_SERDE macro */
361 :
362 : /* Static serialization methods for fd_tls_u24_t */
363 :
364 : static inline fd_tls_u24_t
365 0 : fd_tls_u24_bswap( fd_tls_u24_t x ) {
366 0 : fd_tls_u24_t ret = {{ x.v[2], x.v[1], x.v[0] }};
367 0 : return ret;
368 0 : }
369 :
370 : static inline uint
371 0 : fd_tls_u24_to_uint( fd_tls_u24_t x ) {
372 0 : return fd_uint_load_3( x.v );
373 0 : }
374 :
375 : static inline fd_tls_u24_t
376 0 : fd_uint_to_tls_u24( uint x ) {
377 0 : fd_tls_u24_t ret = {{ (uchar)( x &0xffU),
378 0 : (uchar)((x>> 8)&0xffU),
379 0 : (uchar)((x>>16)&0xffU) }};
380 0 : return ret;
381 0 : }
382 :
383 : /* Static serde methods for fd_tls_ext_hdr_t */
384 :
385 : static inline void
386 0 : fd_tls_ext_hdr_bswap( fd_tls_ext_hdr_t * x ) {
387 0 : x->type = fd_ushort_bswap( x->type );
388 0 : x->sz = fd_ushort_bswap( x->sz );
389 0 : }
390 :
391 : STATIC_SERDE( ext_hdr, fd_tls_ext_hdr_t )
392 :
393 : /* Static serde methods for fd_tls_msg_hdr_t */
394 :
395 : static inline void
396 0 : fd_tls_msg_hdr_bswap( fd_tls_msg_hdr_t * x ) {
397 0 : x->sz = fd_tls_u24_bswap( x->sz );
398 0 : }
399 :
400 : STATIC_SERDE( msg_hdr, fd_tls_msg_hdr_t )
401 :
402 : /* Static serde methods for fd_tls_finished_t */
403 :
404 0 : static inline void fd_tls_finished_bswap( fd_tls_finished_t * x FD_FN_UNUSED ) {}
405 :
406 : STATIC_SERDE( finished, fd_tls_finished_t )
407 :
408 : /* Methods for dynamic layout types */
409 :
410 : long
411 : fd_tls_decode_client_hello( fd_tls_client_hello_t * out,
412 : uchar const * wire,
413 : ulong wire_sz );
414 :
415 : long
416 : fd_tls_encode_client_hello( fd_tls_client_hello_t const * in,
417 : uchar * wire,
418 : ulong wire_sz );
419 :
420 : long
421 : fd_tls_decode_server_hello( fd_tls_server_hello_t * out,
422 : uchar const * wire,
423 : ulong wire_sz );
424 :
425 : long
426 : fd_tls_encode_server_hello( fd_tls_server_hello_t const * in,
427 : uchar * wire,
428 : ulong wire_sz );
429 :
430 : long
431 : fd_tls_encode_hello_retry_request( fd_tls_server_hello_t const * in,
432 : uchar * wire,
433 : ulong wire_sz );
434 :
435 : long
436 : fd_tls_decode_enc_ext( fd_tls_enc_ext_t * out,
437 : uchar const * wire,
438 : ulong wire_sz );
439 :
440 : long
441 : fd_tls_encode_enc_ext( fd_tls_enc_ext_t const * in,
442 : uchar * wire,
443 : ulong wire_sz );
444 :
445 : long
446 : fd_tls_encode_cert_x509( uchar const * x509,
447 : ulong x509_sz,
448 : uchar * wire,
449 : ulong wire_sz );
450 :
451 : long
452 : fd_tls_decode_cert_req( fd_tls_ext_signature_algorithms_t * out,
453 : uchar const * wire,
454 : ulong wire_sz );
455 :
456 : long
457 : fd_tls_decode_cert_verify( fd_tls_cert_verify_t * out,
458 : uchar const * wire,
459 : ulong wire_sz );
460 :
461 : long
462 : fd_tls_encode_cert_verify( fd_tls_cert_verify_t const * in,
463 : uchar * wire,
464 : ulong wire_sz );
465 :
466 : static inline void
467 0 : fd_tls_cert_verify_bswap( fd_tls_cert_verify_t * x ) {
468 0 : x->algorithm = fd_ushort_bswap( x->algorithm );
469 0 : }
470 :
471 : long
472 : fd_tls_decode_ext_server_name( fd_tls_ext_server_name_t * out,
473 : uchar const * wire,
474 : ulong wire_sz );
475 :
476 : long
477 : fd_tls_decode_ext_supported_groups( fd_tls_ext_supported_groups_t * out,
478 : uchar const * wire,
479 : ulong wire_sz );
480 :
481 : long
482 : fd_tls_decode_ext_supported_versions( fd_tls_ext_supported_versions_t * out,
483 : uchar const * wire,
484 : ulong wire_sz );
485 :
486 : long
487 : fd_tls_decode_ext_signature_algorithms( fd_tls_ext_signature_algorithms_t * out,
488 : uchar const * wire,
489 : ulong wire_sz );
490 :
491 : long
492 : fd_tls_decode_key_share( fd_tls_key_share_t * out,
493 : uchar const * wire,
494 : ulong wire_sz );
495 :
496 : long
497 : fd_tls_decode_key_share_list( fd_tls_key_share_t * out,
498 : uchar const * wire,
499 : ulong wire_sz );
500 :
501 : /* fd_tls_decode_ext_opaque is special:
502 : out->{buf,buf_sz} will be set to {wire,wire_sz}.
503 : i.e. lifetime of out->quic_tp is that of wire. */
504 :
505 : long
506 : fd_tls_decode_ext_opaque( fd_tls_ext_opaque_t * const out,
507 : uchar const * const wire,
508 : ulong wire_sz );
509 :
510 : static inline long
511 : fd_tls_decode_ext_quic_tp( fd_tls_ext_quic_tp_t * const out,
512 : uchar const * const wire,
513 0 : ulong wire_sz ) {
514 0 : return fd_tls_decode_ext_opaque( out, wire, wire_sz );
515 0 : }
516 :
517 : long
518 : fd_tls_decode_ext_alpn( fd_tls_ext_alpn_t * const out,
519 : uchar const * const wire,
520 : ulong wire_sz );
521 :
522 : long
523 : fd_tls_encode_ext_alpn( fd_tls_ext_alpn_t const * in,
524 : uchar * wire,
525 : ulong wire_sz );
526 :
527 : /* fd_tls_extract_cert_pubkey validates the initial-handshake Certificate
528 : envelope and extracts its leaf public key. Requires an empty request
529 : context and a nonempty, exactly framed certificate_list. Rejects
530 : CertificateEntry extensions, which our CH and CR do not solicit.
531 : Does not authenticate the X.509 chain or establish trust. */
532 :
533 : struct fd_tls_extract_cert_pubkey_res {
534 : uchar const * pubkey; /* see fd_x509_cert_info_t.pubkey */
535 : ulong pubkey_len;
536 : uchar key_type; /* FD_TLS_KEY_{...} */
537 : uint alert;
538 : ushort reason;
539 : };
540 :
541 : typedef struct fd_tls_extract_cert_pubkey_res fd_tls_extract_cert_pubkey_res_t;
542 :
543 : fd_tls_extract_cert_pubkey_res_t
544 : fd_tls_extract_cert_pubkey( uchar const * cert,
545 : ulong cert_sz );
546 :
547 : FD_PROTOTYPES_END
548 :
549 : #undef STATIC_SERDE
550 :
551 : #endif /* HEADER_fd_src_waltz_tls_fd_tls_proto_h */
|
