Coverage Report

Created: 2023-05-05 14:20

/src/openssl/include/internal/dane.h
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#ifndef OSSL_INTERNAL_DANE_H
11
#define OSSL_INTERNAL_DANE_H
12
13
#include <openssl/safestack.h>
14
15
/*-
16
 * Certificate usages:
17
 * https://tools.ietf.org/html/rfc6698#section-2.1.1
18
 */
19
#define DANETLS_USAGE_PKIX_TA   0
20
#define DANETLS_USAGE_PKIX_EE   1
21
0
#define DANETLS_USAGE_DANE_TA   2
22
#define DANETLS_USAGE_DANE_EE   3
23
#define DANETLS_USAGE_LAST      DANETLS_USAGE_DANE_EE
24
25
/*-
26
 * Selectors:
27
 * https://tools.ietf.org/html/rfc6698#section-2.1.2
28
 */
29
0
#define DANETLS_SELECTOR_CERT   0
30
0
#define DANETLS_SELECTOR_SPKI   1
31
#define DANETLS_SELECTOR_LAST   DANETLS_SELECTOR_SPKI
32
33
/*-
34
 * Matching types:
35
 * https://tools.ietf.org/html/rfc6698#section-2.1.3
36
 */
37
0
#define DANETLS_MATCHING_FULL   0
38
#define DANETLS_MATCHING_2256   1
39
#define DANETLS_MATCHING_2512   2
40
#define DANETLS_MATCHING_LAST   DANETLS_MATCHING_2512
41
42
typedef struct danetls_record_st {
43
    uint8_t usage;
44
    uint8_t selector;
45
    uint8_t mtype;
46
    unsigned char *data;
47
    size_t dlen;
48
    EVP_PKEY *spki;
49
} danetls_record;
50
51
DEFINE_STACK_OF(danetls_record)
52
53
/*
54
 * Shared DANE context
55
 */
56
struct dane_ctx_st {
57
    const EVP_MD  **mdevp;      /* mtype -> digest */
58
    uint8_t        *mdord;      /* mtype -> preference */
59
    uint8_t         mdmax;      /* highest supported mtype */
60
    unsigned long   flags;      /* feature bitmask */
61
};
62
63
/*
64
 * Per connection DANE state
65
 */
66
struct ssl_dane_st {
67
    struct dane_ctx_st *dctx;
68
    STACK_OF(danetls_record) *trecs;
69
    STACK_OF(X509) *certs;      /* DANE-TA(2) Cert(0) Full(0) certs */
70
    danetls_record *mtlsa;      /* Matching TLSA record */
71
    X509           *mcert;      /* DANE matched cert */
72
    uint32_t        umask;      /* Usages present */
73
    int             mdpth;      /* Depth of matched cert */
74
    int             pdpth;      /* Depth of PKIX trust */
75
    unsigned long   flags;      /* feature bitmask */
76
};
77
78
#define DANETLS_ENABLED(dane)  \
79
0
    ((dane) != NULL && sk_danetls_record_num((dane)->trecs) > 0)
80
81
0
#define DANETLS_USAGE_BIT(u)   (((uint32_t)1) << u)
82
83
0
#define DANETLS_PKIX_TA_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_PKIX_TA))
84
0
#define DANETLS_PKIX_EE_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_PKIX_EE))
85
0
#define DANETLS_DANE_TA_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_DANE_TA))
86
0
#define DANETLS_DANE_EE_MASK (DANETLS_USAGE_BIT(DANETLS_USAGE_DANE_EE))
87
88
0
#define DANETLS_PKIX_MASK (DANETLS_PKIX_TA_MASK | DANETLS_PKIX_EE_MASK)
89
0
#define DANETLS_DANE_MASK (DANETLS_DANE_TA_MASK | DANETLS_DANE_EE_MASK)
90
0
#define DANETLS_TA_MASK (DANETLS_PKIX_TA_MASK | DANETLS_DANE_TA_MASK)
91
0
#define DANETLS_EE_MASK (DANETLS_PKIX_EE_MASK | DANETLS_DANE_EE_MASK)
92
93
0
#define DANETLS_HAS_PKIX(dane) ((dane) && ((dane)->umask & DANETLS_PKIX_MASK))
94
0
#define DANETLS_HAS_DANE(dane) ((dane) && ((dane)->umask & DANETLS_DANE_MASK))
95
0
#define DANETLS_HAS_TA(dane)   ((dane) && ((dane)->umask & DANETLS_TA_MASK))
96
#define DANETLS_HAS_EE(dane)   ((dane) && ((dane)->umask & DANETLS_EE_MASK))
97
98
#define DANETLS_HAS_PKIX_TA(dane) ((dane)&&((dane)->umask & DANETLS_PKIX_TA_MASK))
99
#define DANETLS_HAS_PKIX_EE(dane) ((dane)&&((dane)->umask & DANETLS_PKIX_EE_MASK))
100
0
#define DANETLS_HAS_DANE_TA(dane) ((dane)&&((dane)->umask & DANETLS_DANE_TA_MASK))
101
#define DANETLS_HAS_DANE_EE(dane) ((dane)&&((dane)->umask & DANETLS_DANE_EE_MASK))
102
103
#endif /* OSSL_INTERNAL_DANE_H */