/src/wolfssl-fastmath/wolfssl/internal.h
Line | Count | Source |
1 | | /* internal.h |
2 | | * |
3 | | * Copyright (C) 2006-2026 wolfSSL Inc. |
4 | | * |
5 | | * This file is part of wolfSSL. |
6 | | * |
7 | | * wolfSSL is free software; you can redistribute it and/or modify |
8 | | * it under the terms of the GNU General Public License as published by |
9 | | * the Free Software Foundation; either version 3 of the License, or |
10 | | * (at your option) any later version. |
11 | | * |
12 | | * wolfSSL is distributed in the hope that it will be useful, |
13 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
14 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
15 | | * GNU General Public License for more details. |
16 | | * |
17 | | * You should have received a copy of the GNU General Public License |
18 | | * along with this program; if not, write to the Free Software |
19 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA |
20 | | */ |
21 | | |
22 | | |
23 | | |
24 | | #ifndef WOLFSSL_INT_H |
25 | | #define WOLFSSL_INT_H |
26 | | |
27 | | #include <wolfssl/wolfcrypt/types.h> |
28 | | #include <wolfssl/ssl.h> |
29 | | #include <wolfssl/wolfio.h> |
30 | | #ifdef HAVE_CRL |
31 | | #include <wolfssl/crl.h> |
32 | | #endif |
33 | | #include <wolfssl/wolfcrypt/random.h> |
34 | | #ifndef NO_DES3 |
35 | | #include <wolfssl/wolfcrypt/des3.h> |
36 | | #endif |
37 | | #ifdef HAVE_CHACHA |
38 | | #include <wolfssl/wolfcrypt/chacha.h> |
39 | | #endif |
40 | | #ifndef NO_ASN |
41 | | #include <wolfssl/wolfcrypt/asn.h> |
42 | | #include <wolfssl/wolfcrypt/pkcs12.h> |
43 | | #endif |
44 | | #ifndef NO_MD5 |
45 | | #include <wolfssl/wolfcrypt/md5.h> |
46 | | #endif |
47 | | #ifndef NO_SHA |
48 | | #include <wolfssl/wolfcrypt/sha.h> |
49 | | #endif |
50 | | #ifndef NO_AES |
51 | | #include <wolfssl/wolfcrypt/aes.h> |
52 | | #endif |
53 | | #ifdef HAVE_POLY1305 |
54 | | #include <wolfssl/wolfcrypt/poly1305.h> |
55 | | #endif |
56 | | #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && defined(OPENSSL_EXTRA) |
57 | | #include <wolfssl/wolfcrypt/chacha20_poly1305.h> |
58 | | #endif |
59 | | #ifdef HAVE_ARIA |
60 | | #include <wolfssl/wolfcrypt/port/aria/aria-crypt.h> |
61 | | #endif |
62 | | #ifdef HAVE_CAMELLIA |
63 | | #include <wolfssl/wolfcrypt/camellia.h> |
64 | | #endif |
65 | | #ifdef WOLFSSL_SM4 |
66 | | #include <wolfssl/wolfcrypt/sm4.h> |
67 | | #endif |
68 | | #include <wolfssl/wolfcrypt/logging.h> |
69 | | #ifndef NO_HMAC |
70 | | #include <wolfssl/wolfcrypt/hmac.h> |
71 | | #endif |
72 | | #ifndef NO_RC4 |
73 | | #include <wolfssl/wolfcrypt/arc4.h> |
74 | | #endif |
75 | | #ifndef NO_SHA256 |
76 | | #include <wolfssl/wolfcrypt/sha256.h> |
77 | | #endif |
78 | | #if defined(WOLFSSL_SHA384) |
79 | | #include <wolfssl/wolfcrypt/sha512.h> |
80 | | #endif |
81 | | #ifdef HAVE_OCSP |
82 | | #include <wolfssl/ocsp.h> |
83 | | #endif |
84 | | #ifdef WOLFSSL_QUIC |
85 | | #include <wolfssl/quic.h> |
86 | | #endif |
87 | | #ifdef WOLFSSL_SHA384 |
88 | | #include <wolfssl/wolfcrypt/sha512.h> |
89 | | #endif |
90 | | #ifdef WOLFSSL_SHA512 |
91 | | #include <wolfssl/wolfcrypt/sha512.h> |
92 | | #endif |
93 | | #ifdef WOLFSSL_SM3 |
94 | | #include <wolfssl/wolfcrypt/sm3.h> |
95 | | #endif |
96 | | #ifdef HAVE_AESGCM |
97 | | #include <wolfssl/wolfcrypt/sha512.h> |
98 | | #endif |
99 | | #ifdef WOLFSSL_RIPEMD |
100 | | #include <wolfssl/wolfcrypt/ripemd.h> |
101 | | #endif |
102 | | #ifndef NO_RSA |
103 | | #include <wolfssl/wolfcrypt/rsa.h> |
104 | | #endif |
105 | | #ifdef HAVE_ECC |
106 | | #include <wolfssl/wolfcrypt/ecc.h> |
107 | | #endif |
108 | | #ifdef WOLFSSL_SM2 |
109 | | #include <wolfssl/wolfcrypt/sm2.h> |
110 | | #endif |
111 | | #ifndef NO_DH |
112 | | #include <wolfssl/wolfcrypt/dh.h> |
113 | | #endif |
114 | | #ifdef HAVE_ED25519 |
115 | | #include <wolfssl/wolfcrypt/ed25519.h> |
116 | | #endif |
117 | | #ifdef HAVE_CURVE25519 |
118 | | #include <wolfssl/wolfcrypt/curve25519.h> |
119 | | #endif |
120 | | #ifdef HAVE_ED448 |
121 | | #include <wolfssl/wolfcrypt/ed448.h> |
122 | | #endif |
123 | | #ifdef HAVE_CURVE448 |
124 | | #include <wolfssl/wolfcrypt/curve448.h> |
125 | | #endif |
126 | | #ifdef HAVE_FALCON |
127 | | #include <wolfssl/wolfcrypt/falcon.h> |
128 | | #endif |
129 | | #ifdef WOLFSSL_HAVE_MLDSA |
130 | | #include <wolfssl/wolfcrypt/wc_mldsa.h> |
131 | | #endif |
132 | | #ifdef HAVE_HKDF |
133 | | #include <wolfssl/wolfcrypt/kdf.h> |
134 | | #endif |
135 | | #ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB |
136 | | #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && \ |
137 | | !defined(WOLFSSL_TICKET_ENC_AES128_GCM) && \ |
138 | | !defined(WOLFSSL_TICKET_ENC_AES256_GCM) |
139 | | #include <wolfssl/wolfcrypt/chacha20_poly1305.h> |
140 | | #else |
141 | | #include <wolfssl/wolfcrypt/aes.h> |
142 | | #endif |
143 | | #endif |
144 | | |
145 | | #include <wolfssl/wolfcrypt/wc_encrypt.h> |
146 | | #include <wolfssl/wolfcrypt/hash.h> |
147 | | |
148 | | #if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA) |
149 | | #include <wolfssl/callbacks.h> |
150 | | #endif |
151 | | #ifdef WOLFSSL_CALLBACKS |
152 | | #include <signal.h> |
153 | | #endif |
154 | | |
155 | | #ifdef WOLFSSL_APACHE_MYNEWT |
156 | | #if !defined(WOLFSSL_LWIP) |
157 | | void mynewt_ctx_clear(void *ctx); |
158 | | void* mynewt_ctx_new(); |
159 | | #endif |
160 | | #endif |
161 | | |
162 | | #if !defined(WOLFCRYPT_ONLY) && !defined(INT_MAX) |
163 | | /* Needed for TLS/DTLS limit checking (Added in 91aad90c59 Jan 24, 2025) */ |
164 | | #include <limits.h> |
165 | | #endif |
166 | | |
167 | | |
168 | | #ifdef HAVE_LIBZ |
169 | | #include "zlib.h" |
170 | | #endif |
171 | | |
172 | | #ifdef WOLFSSL_ASYNC_CRYPT |
173 | | #include <wolfssl/wolfcrypt/async.h> |
174 | | #endif |
175 | | |
176 | | #ifdef OPENSSL_EXTRA |
177 | | #ifdef WOLFCRYPT_HAVE_SRP |
178 | | #include <wolfssl/wolfcrypt/srp.h> |
179 | | #endif |
180 | | #endif |
181 | | |
182 | | #ifdef _MSC_VER |
183 | | /* 4996 warning to use MS extensions e.g., strcpy_s instead of strncpy */ |
184 | | #pragma warning(disable: 4996) |
185 | | #endif |
186 | | |
187 | | #ifdef NO_SHA |
188 | | #define WC_SHA_DIGEST_SIZE 20 |
189 | | #endif |
190 | | |
191 | | #ifdef NO_SHA256 |
192 | | #define WC_SHA256_DIGEST_SIZE 32 |
193 | | #endif |
194 | | |
195 | | #ifdef NO_MD5 |
196 | | #define WC_MD5_DIGEST_SIZE 16 |
197 | | #endif |
198 | | |
199 | | #ifdef WOLFSSL_IOTSAFE |
200 | | #include <wolfssl/wolfcrypt/port/iotsafe/iotsafe.h> |
201 | | #endif |
202 | | |
203 | | #if defined(WOLFSSL_RENESAS_TSIP_TLS) |
204 | | #include <wolfssl/wolfcrypt/port/Renesas/renesas_tsip_internal.h> |
205 | | #endif |
206 | | |
207 | | #include <wolfssl/wolfcrypt/hpke.h> |
208 | | |
209 | | #if defined(WOLFSSL_SNIFFER) && defined(WOLFSSL_SNIFFER_KEYLOGFILE) |
210 | | #include <wolfssl/sniffer.h> |
211 | | #endif /* WOLFSSL_SNIFFER && WOLFSSL_SNIFFER_KEYLOGFILE */ |
212 | | |
213 | | #ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION |
214 | | #include <CoreFoundation/CoreFoundation.h> |
215 | | #endif /* WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION */ |
216 | | |
217 | | #ifdef __cplusplus |
218 | | extern "C" { |
219 | | #endif |
220 | | |
221 | | /* Define or comment out the cipher suites you'd like to be compiled in |
222 | | make sure to use at least one BUILD_SSL_xxx or BUILD_TLS_xxx is defined |
223 | | |
224 | | When adding cipher suites, add name to cipher_names, idx to cipher_name_idx |
225 | | |
226 | | Now that there is a maximum strength crypto build, the following BUILD_XXX |
227 | | flags need to be divided into two groups selected by WOLFSSL_MAX_STRENGTH. |
228 | | Those that do not use Perfect Forward Security and do not use AEAD ciphers |
229 | | need to be switched off. Allowed suites use (EC)DHE, AES-GCM|CCM, or |
230 | | CHACHA-POLY. |
231 | | */ |
232 | | |
233 | | /* Check that if WOLFSSL_MAX_STRENGTH is set that all the required options are |
234 | | * not turned off. */ |
235 | | #if defined(WOLFSSL_MAX_STRENGTH) && \ |
236 | | ((!defined(HAVE_ECC) && (defined(NO_DH) || defined(NO_RSA))) || \ |
237 | | (!defined(HAVE_AESGCM) && !defined(HAVE_AESCCM) && \ |
238 | | (!defined(HAVE_POLY1305) || !defined(HAVE_CHACHA))) || \ |
239 | | (defined(NO_SHA256) && !defined(WOLFSSL_SHA384)) || \ |
240 | | !defined(NO_OLD_TLS)) |
241 | | |
242 | | #error "You are trying to build max strength with requirements disabled." |
243 | | #endif |
244 | | |
245 | | #ifndef WOLFSSL_NO_TLS12 |
246 | | |
247 | | #ifndef WOLFSSL_MAX_STRENGTH |
248 | | |
249 | | #ifdef WOLFSSL_AEAD_ONLY |
250 | | /* AES CBC ciphers are not allowed in AEAD only mode */ |
251 | | #undef HAVE_AES_CBC |
252 | | #endif |
253 | | |
254 | | /* When adding new ciphersuites, make sure that they have appropriate |
255 | | * guards for WOLFSSL_HARDEN_TLS. */ |
256 | | #if defined(WOLFSSL_HARDEN_TLS) && \ |
257 | | !defined(WOLFSSL_HARDEN_TLS_ALLOW_ALL_CIPHERSUITES) |
258 | | /* Use a separate define (undef'ed later) to simplify macro logic. */ |
259 | | #define WSSL_HARDEN_TLS WOLFSSL_HARDEN_TLS |
260 | | #define NO_TLS_DH |
261 | | #endif |
262 | | |
263 | | #ifndef WOLFSSL_AEAD_ONLY |
264 | | #if !defined(NO_RSA) && !defined(NO_RC4) && !defined(WSSL_HARDEN_TLS) |
265 | | /* MUST NOT negotiate RC4 cipher suites |
266 | | * https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
267 | | #if defined(WOLFSSL_STATIC_RSA) |
268 | | #if !defined(NO_SHA) |
269 | | #define BUILD_SSL_RSA_WITH_RC4_128_SHA |
270 | | #endif |
271 | | #if !defined(NO_MD5) |
272 | | #define BUILD_SSL_RSA_WITH_RC4_128_MD5 |
273 | | #endif |
274 | | #endif |
275 | | #endif |
276 | | |
277 | | #if !defined(NO_RSA) && !defined(NO_DES3) && !defined(NO_DES3_TLS_SUITES) |
278 | | #if !defined(NO_SHA) |
279 | | #if defined(WOLFSSL_STATIC_RSA) |
280 | | #define BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA |
281 | | #endif |
282 | | #endif |
283 | | #endif |
284 | | #endif /* !WOLFSSL_AEAD_ONLY */ |
285 | | |
286 | | #if !defined(NO_RSA) && !defined(NO_AES) && !defined(NO_TLS) |
287 | | #if !defined(NO_SHA) && defined(HAVE_AES_CBC) |
288 | | #if defined(WOLFSSL_STATIC_RSA) |
289 | | #ifdef WOLFSSL_AES_128 |
290 | | #define BUILD_TLS_RSA_WITH_AES_128_CBC_SHA |
291 | | #endif |
292 | | #ifdef WOLFSSL_AES_256 |
293 | | #define BUILD_TLS_RSA_WITH_AES_256_CBC_SHA |
294 | | #endif |
295 | | #endif |
296 | | #endif |
297 | | #if defined(WOLFSSL_STATIC_RSA) |
298 | | #if !defined (NO_SHA256) && defined(HAVE_AES_CBC) |
299 | | #ifdef WOLFSSL_AES_128 |
300 | | #define BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256 |
301 | | #endif |
302 | | #ifdef WOLFSSL_AES_256 |
303 | | #define BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256 |
304 | | #endif |
305 | | #endif |
306 | | #if defined (HAVE_AESGCM) |
307 | | #ifdef WOLFSSL_AES_128 |
308 | | #define BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256 |
309 | | #endif |
310 | | #if defined (WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) |
311 | | #define BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384 |
312 | | #endif |
313 | | #endif |
314 | | #if defined (HAVE_AESCCM) |
315 | | #ifdef WOLFSSL_AES_128 |
316 | | #define BUILD_TLS_RSA_WITH_AES_128_CCM_8 |
317 | | #endif |
318 | | #ifdef WOLFSSL_AES_256 |
319 | | #define BUILD_TLS_RSA_WITH_AES_256_CCM_8 |
320 | | #endif |
321 | | #endif |
322 | | #endif |
323 | | #endif |
324 | | |
325 | | #if defined(HAVE_CAMELLIA) && !defined(NO_TLS) && !defined(NO_CAMELLIA_CBC) |
326 | | #ifndef NO_RSA |
327 | | #if defined(WOLFSSL_STATIC_RSA) |
328 | | #if !defined(NO_SHA) |
329 | | #define BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA |
330 | | #define BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA |
331 | | #endif |
332 | | #ifndef NO_SHA256 |
333 | | #define BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 |
334 | | #define BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 |
335 | | #endif |
336 | | #endif |
337 | | #if !defined(NO_DH) && !defined(NO_TLS_DH) |
338 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
339 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
340 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
341 | | #if !defined(NO_SHA) |
342 | | #define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA |
343 | | #define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA |
344 | | #endif |
345 | | #ifndef NO_SHA256 |
346 | | #define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 |
347 | | #define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 |
348 | | #endif |
349 | | #endif |
350 | | #endif |
351 | | #endif |
352 | | |
353 | | #if defined(WOLFSSL_STATIC_PSK) |
354 | | #if !defined(NO_PSK) && !defined(NO_AES) && !defined(NO_TLS) |
355 | | #if !defined(NO_SHA) |
356 | | #ifdef WOLFSSL_AES_128 |
357 | | #define BUILD_TLS_PSK_WITH_AES_128_CBC_SHA |
358 | | #endif |
359 | | #ifdef WOLFSSL_AES_256 |
360 | | #define BUILD_TLS_PSK_WITH_AES_256_CBC_SHA |
361 | | #endif |
362 | | #endif |
363 | | #ifndef NO_SHA256 |
364 | | #ifdef WOLFSSL_AES_128 |
365 | | #ifdef HAVE_AES_CBC |
366 | | #define BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256 |
367 | | #endif |
368 | | #ifdef HAVE_AESGCM |
369 | | #define BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256 |
370 | | #endif |
371 | | #endif /* WOLFSSL_AES_128 */ |
372 | | #ifdef HAVE_AESCCM |
373 | | #ifdef WOLFSSL_AES_128 |
374 | | #define BUILD_TLS_PSK_WITH_AES_128_CCM_8 |
375 | | #define BUILD_TLS_PSK_WITH_AES_128_CCM |
376 | | #endif |
377 | | #ifdef WOLFSSL_AES_256 |
378 | | #define BUILD_TLS_PSK_WITH_AES_256_CCM_8 |
379 | | #define BUILD_TLS_PSK_WITH_AES_256_CCM |
380 | | #endif |
381 | | #endif |
382 | | #endif |
383 | | #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) |
384 | | #ifdef HAVE_AES_CBC |
385 | | #define BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384 |
386 | | #endif |
387 | | #ifdef HAVE_AESGCM |
388 | | #define BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384 |
389 | | #endif |
390 | | #endif |
391 | | #endif |
392 | | #endif |
393 | | |
394 | | #if !defined(NO_TLS) && defined(HAVE_NULL_CIPHER) |
395 | | #if !defined(NO_RSA) |
396 | | #if defined(WOLFSSL_STATIC_RSA) |
397 | | #ifndef NO_MD5 |
398 | | #define BUILD_TLS_RSA_WITH_NULL_MD5 |
399 | | #endif |
400 | | #if !defined(NO_SHA) |
401 | | #define BUILD_TLS_RSA_WITH_NULL_SHA |
402 | | #endif |
403 | | #ifndef NO_SHA256 |
404 | | #define BUILD_TLS_RSA_WITH_NULL_SHA256 |
405 | | #endif |
406 | | #endif |
407 | | #endif |
408 | | #if !defined(NO_PSK) && defined(WOLFSSL_STATIC_PSK) |
409 | | #if !defined(NO_SHA) |
410 | | #define BUILD_TLS_PSK_WITH_NULL_SHA |
411 | | #endif |
412 | | #ifndef NO_SHA256 |
413 | | #define BUILD_TLS_PSK_WITH_NULL_SHA256 |
414 | | #endif |
415 | | #ifdef WOLFSSL_SHA384 |
416 | | #define BUILD_TLS_PSK_WITH_NULL_SHA384 |
417 | | #endif |
418 | | #endif |
419 | | #endif |
420 | | |
421 | | #if !defined(NO_DH) && !defined(NO_AES) && !defined(NO_TLS) && \ |
422 | | !defined(NO_RSA) && !defined(NO_TLS_DH) |
423 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
424 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
425 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
426 | | |
427 | | #if !defined(NO_SHA) |
428 | | #if defined(WOLFSSL_AES_128) && defined(HAVE_AES_CBC) |
429 | | #define BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA |
430 | | #endif |
431 | | #if defined(WOLFSSL_AES_256) && defined(HAVE_AES_CBC) |
432 | | #define BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA |
433 | | #endif |
434 | | #if !defined(NO_DES3) && !defined(NO_DES3_TLS_SUITES) |
435 | | #define BUILD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA |
436 | | #endif |
437 | | #endif |
438 | | #if !defined(NO_SHA256) && defined(HAVE_AES_CBC) |
439 | | #ifdef WOLFSSL_AES_128 |
440 | | #define BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 |
441 | | #endif |
442 | | #ifdef WOLFSSL_AES_256 |
443 | | #define BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 |
444 | | #endif |
445 | | #endif |
446 | | #endif |
447 | | |
448 | | #if defined(HAVE_ANON) && !defined(NO_TLS) && !defined(NO_DH) && \ |
449 | | !defined(NO_AES) |
450 | | #if !defined(NO_SHA) && defined(HAVE_AES_CBC) && \ |
451 | | defined(WOLFSSL_AES_128) |
452 | | #define BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA |
453 | | #endif |
454 | | #if defined(WOLFSSL_SHA384) && defined(HAVE_AESGCM) && \ |
455 | | defined(WOLFSSL_AES_256) |
456 | | #define BUILD_TLS_DH_anon_WITH_AES_256_GCM_SHA384 |
457 | | #endif |
458 | | #endif |
459 | | |
460 | | #if !defined(NO_DH) && !defined(NO_PSK) && !defined(NO_TLS) && \ |
461 | | !defined(NO_TLS_DH) |
462 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
463 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
464 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
465 | | #ifndef NO_SHA256 |
466 | | #if !defined(NO_AES) && defined(WOLFSSL_AES_128) && \ |
467 | | defined(HAVE_AES_CBC) |
468 | | #define BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 |
469 | | #endif |
470 | | #ifdef HAVE_NULL_CIPHER |
471 | | #define BUILD_TLS_DHE_PSK_WITH_NULL_SHA256 |
472 | | #endif |
473 | | #endif |
474 | | #ifdef WOLFSSL_SHA384 |
475 | | #if !defined(NO_AES) && defined(WOLFSSL_AES_256) && \ |
476 | | defined(HAVE_AES_CBC) |
477 | | #define BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 |
478 | | #endif |
479 | | #ifdef HAVE_NULL_CIPHER |
480 | | #define BUILD_TLS_DHE_PSK_WITH_NULL_SHA384 |
481 | | #endif |
482 | | #endif |
483 | | #endif |
484 | | |
485 | | #if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \ |
486 | | defined(HAVE_CURVE448)) && !defined(NO_TLS) |
487 | | #if !defined(NO_AES) |
488 | | #if !defined(NO_SHA) && defined(HAVE_AES_CBC) |
489 | | #if !defined(NO_RSA) |
490 | | #ifdef WOLFSSL_AES_128 |
491 | | #define BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
492 | | #endif |
493 | | #ifdef WOLFSSL_AES_256 |
494 | | #define BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
495 | | #endif |
496 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
497 | | #ifdef WOLFSSL_AES_128 |
498 | | #define BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA |
499 | | #endif |
500 | | #ifdef WOLFSSL_AES_256 |
501 | | #define BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA |
502 | | #endif |
503 | | #endif |
504 | | #endif |
505 | | |
506 | | #if defined(HAVE_ECC) || \ |
507 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
508 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
509 | | #ifdef WOLFSSL_AES_128 |
510 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
511 | | #endif |
512 | | #ifdef WOLFSSL_AES_256 |
513 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA |
514 | | #endif |
515 | | #endif |
516 | | |
517 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
518 | | #ifdef WOLFSSL_AES_128 |
519 | | #define BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA |
520 | | #endif |
521 | | #ifdef WOLFSSL_AES_256 |
522 | | #define BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA |
523 | | #endif |
524 | | #endif |
525 | | #endif /* NO_SHA */ |
526 | | #if !defined(NO_SHA256) && defined(WOLFSSL_AES_128) && \ |
527 | | defined(HAVE_AES_CBC) |
528 | | #if !defined(NO_RSA) |
529 | | #define BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
530 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
531 | | #define BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 |
532 | | #endif |
533 | | #endif |
534 | | #if defined(HAVE_ECC) || \ |
535 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
536 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
537 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 |
538 | | #endif |
539 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
540 | | #define BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 |
541 | | #endif |
542 | | #endif |
543 | | |
544 | | #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) && \ |
545 | | defined(HAVE_AES_CBC) |
546 | | #if !defined(NO_RSA) |
547 | | #define BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
548 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
549 | | #define BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 |
550 | | #endif |
551 | | #endif |
552 | | #if defined(HAVE_ECC) || \ |
553 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
554 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
555 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 |
556 | | #endif |
557 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
558 | | #define BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 |
559 | | #endif |
560 | | #endif |
561 | | |
562 | | #if defined (HAVE_AESGCM) |
563 | | #if !defined(NO_RSA) |
564 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
565 | | #ifdef WOLFSSL_AES_128 |
566 | | #define BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 |
567 | | #endif |
568 | | #endif |
569 | | #if defined(WOLFSSL_SHA384) |
570 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
571 | | #ifdef WOLFSSL_AES_256 |
572 | | #define BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 |
573 | | #endif |
574 | | #endif |
575 | | #endif |
576 | | #endif |
577 | | |
578 | | #if defined(WOLFSSL_STATIC_DH) && defined(WOLFSSL_AES_128) && \ |
579 | | defined(HAVE_ECC) |
580 | | #define BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 |
581 | | #endif |
582 | | |
583 | | #if defined(WOLFSSL_SHA384) |
584 | | #if defined(WOLFSSL_STATIC_DH) && \ |
585 | | defined(WOLFSSL_AES_256) && defined(HAVE_ECC) |
586 | | #define BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 |
587 | | #endif |
588 | | #endif |
589 | | #endif |
590 | | #endif /* NO_AES */ |
591 | | #ifdef HAVE_ARIA |
592 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 |
593 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 |
594 | | #endif /* HAVE_ARIA */ |
595 | | #if !defined(NO_RC4) && !defined(WSSL_HARDEN_TLS) |
596 | | /* MUST NOT negotiate RC4 cipher suites |
597 | | * https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
598 | | #if !defined(NO_SHA) |
599 | | #if !defined(NO_RSA) |
600 | | #ifndef WOLFSSL_AEAD_ONLY |
601 | | #define BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA |
602 | | #endif |
603 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
604 | | #define BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA |
605 | | #endif |
606 | | #endif |
607 | | |
608 | | #if defined(HAVE_ECC) || \ |
609 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
610 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
611 | | #ifndef WOLFSSL_AEAD_ONLY |
612 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA |
613 | | #endif |
614 | | #endif |
615 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
616 | | #define BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA |
617 | | #endif |
618 | | #endif |
619 | | #endif |
620 | | #if !defined(NO_DES3) && !(defined(WSSL_HARDEN_TLS) && \ |
621 | | WSSL_HARDEN_TLS > 112) && \ |
622 | | !defined(NO_DES3_TLS_SUITES) |
623 | | /* 3DES offers only 112 bits of security. |
624 | | * Using guidance from section 5.6.1 |
625 | | * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf */ |
626 | | #ifndef NO_SHA |
627 | | #if !defined(NO_RSA) |
628 | | #define BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA |
629 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
630 | | #define BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA |
631 | | #endif |
632 | | #endif |
633 | | |
634 | | #if defined(HAVE_ECC) || \ |
635 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
636 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
637 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA |
638 | | #endif |
639 | | #if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC) |
640 | | #define BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA |
641 | | #endif |
642 | | #endif /* NO_SHA */ |
643 | | #endif |
644 | | #if defined(HAVE_NULL_CIPHER) |
645 | | #if !defined(NO_SHA) |
646 | | #if defined(HAVE_ECC) || \ |
647 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
648 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
649 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_NULL_SHA |
650 | | #endif |
651 | | #endif |
652 | | #if !defined(NO_PSK) && !defined(NO_SHA256) |
653 | | #define BUILD_TLS_ECDHE_PSK_WITH_NULL_SHA256 |
654 | | #endif |
655 | | #endif |
656 | | #if !defined(NO_PSK) && !defined(NO_SHA256) && !defined(NO_AES) && \ |
657 | | defined(WOLFSSL_AES_128) && defined(HAVE_AES_CBC) |
658 | | #define BUILD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 |
659 | | #endif |
660 | | #if !defined(NO_PSK) && !defined(NO_SHA256) && !defined(NO_AES) && \ |
661 | | defined(WOLFSSL_AES_128) && defined(HAVE_AESGCM) |
662 | | #define BUILD_TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 |
663 | | #endif |
664 | | #endif |
665 | | #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && !defined(NO_SHA256) |
666 | | #if !defined(NO_OLD_POLY1305) |
667 | | #if defined(HAVE_ECC) || \ |
668 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
669 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
670 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256 |
671 | | #endif |
672 | | #if !defined(NO_RSA) && defined(HAVE_ECC) |
673 | | #define BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 |
674 | | #endif |
675 | | #if !defined(NO_DH) && !defined(NO_RSA) && !defined(NO_TLS_DH) |
676 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
677 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
678 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
679 | | #define BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 |
680 | | #endif |
681 | | #endif /* NO_OLD_POLY1305 */ |
682 | | #if !defined(NO_PSK) |
683 | | #define BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 |
684 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || \ |
685 | | defined(HAVE_ED448) |
686 | | #define BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 |
687 | | #endif |
688 | | #if !defined(NO_DH) && !defined(NO_TLS_DH) |
689 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
690 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
691 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
692 | | #define BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 |
693 | | #endif |
694 | | #endif /* !NO_PSK */ |
695 | | #endif |
696 | | |
697 | | #endif /* !WOLFSSL_MAX_STRENGTH */ |
698 | | |
699 | | #if !defined(NO_DH) && !defined(NO_AES) && !defined(NO_TLS) && \ |
700 | | !defined(NO_RSA) && defined(HAVE_AESGCM) && !defined(NO_TLS_DH) |
701 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
702 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
703 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
704 | | |
705 | | #if !defined(NO_SHA256) && defined(WOLFSSL_AES_128) |
706 | | #define BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
707 | | #endif |
708 | | |
709 | | #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) |
710 | | #define BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 |
711 | | #endif |
712 | | #endif |
713 | | |
714 | | #if !defined(NO_DH) && !defined(NO_PSK) && !defined(NO_TLS) && \ |
715 | | !defined(NO_TLS_DH) |
716 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
717 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
718 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
719 | | #ifndef NO_SHA256 |
720 | | #if defined(HAVE_AESGCM) && defined(WOLFSSL_AES_128) |
721 | | #define BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 |
722 | | #endif |
723 | | #ifdef HAVE_AESCCM |
724 | | #ifdef WOLFSSL_AES_128 |
725 | | #define BUILD_TLS_DHE_PSK_WITH_AES_128_CCM |
726 | | #endif |
727 | | #ifdef WOLFSSL_AES_256 |
728 | | #define BUILD_TLS_DHE_PSK_WITH_AES_256_CCM |
729 | | #endif |
730 | | #endif |
731 | | #endif |
732 | | #if defined(WOLFSSL_SHA384) && defined(HAVE_AESGCM) && \ |
733 | | defined(WOLFSSL_AES_256) |
734 | | #define BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 |
735 | | #endif |
736 | | #endif |
737 | | |
738 | | #if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)) \ |
739 | | && !defined(NO_TLS) && !defined(NO_AES) |
740 | | #ifdef HAVE_AESGCM |
741 | | #if !defined(NO_SHA256) && defined(WOLFSSL_AES_128) |
742 | | #if defined(HAVE_ECC) || \ |
743 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
744 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
745 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
746 | | #endif |
747 | | #ifndef NO_RSA |
748 | | #define BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
749 | | #endif |
750 | | #endif |
751 | | #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) |
752 | | #if defined(HAVE_ECC) || \ |
753 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
754 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
755 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
756 | | #endif |
757 | | #ifndef NO_RSA |
758 | | #define BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
759 | | #endif |
760 | | #endif |
761 | | #endif |
762 | | #if defined(HAVE_AESCCM) && !defined(NO_SHA256) |
763 | | #if defined(HAVE_ECC) || \ |
764 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
765 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
766 | | #ifdef WOLFSSL_AES_128 |
767 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM |
768 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 |
769 | | #endif |
770 | | #ifdef WOLFSSL_AES_256 |
771 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 |
772 | | #endif |
773 | | #endif |
774 | | #endif |
775 | | #endif |
776 | | |
777 | | #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && !defined(NO_SHA256) |
778 | | #if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448) |
779 | | #if defined(HAVE_ECC) || \ |
780 | | (defined(HAVE_CURVE25519) && defined(HAVE_ED25519)) || \ |
781 | | (defined(HAVE_CURVE448) && defined(HAVE_ED448)) |
782 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 |
783 | | #endif |
784 | | #ifndef NO_RSA |
785 | | #define BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
786 | | #endif |
787 | | #endif |
788 | | #if !defined(NO_DH) && !defined(NO_RSA) && !defined(NO_TLS_DH) |
789 | | /* SHOULD NOT negotiate cipher suites based on ephemeral |
790 | | * finite-field Diffie-Hellman key agreement (i.e., "TLS_DHE_*" |
791 | | * suites). https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
792 | | #define BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
793 | | #endif |
794 | | #endif |
795 | | |
796 | | #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3) |
797 | | #ifdef WOLFSSL_SM4_CBC |
798 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_SM4_CBC_SM3 |
799 | | #endif |
800 | | #ifdef WOLFSSL_SM4_GCM |
801 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_SM4_GCM_SM3 |
802 | | #endif |
803 | | #ifdef WOLFSSL_SM4_CCM |
804 | | #define BUILD_TLS_ECDHE_ECDSA_WITH_SM4_CCM_SM3 |
805 | | #endif |
806 | | #endif |
807 | | #endif |
808 | | |
809 | | #if defined(WOLFSSL_TLS13) |
810 | | #ifdef HAVE_AESGCM |
811 | | #if !defined(NO_SHA256) && defined(WOLFSSL_AES_128) |
812 | | #define BUILD_TLS_AES_128_GCM_SHA256 |
813 | | #endif |
814 | | #if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256) |
815 | | #define BUILD_TLS_AES_256_GCM_SHA384 |
816 | | #endif |
817 | | #endif |
818 | | |
819 | | #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) |
820 | | #ifndef NO_SHA256 |
821 | | #define BUILD_TLS_CHACHA20_POLY1305_SHA256 |
822 | | #endif |
823 | | #endif |
824 | | |
825 | | #ifdef HAVE_AESCCM |
826 | | #if !defined(NO_SHA256) && defined(WOLFSSL_AES_128) |
827 | | #define BUILD_TLS_AES_128_CCM_SHA256 |
828 | | #define BUILD_TLS_AES_128_CCM_8_SHA256 |
829 | | #endif |
830 | | #endif |
831 | | #ifdef HAVE_NULL_CIPHER |
832 | | #ifndef NO_SHA256 |
833 | | #define BUILD_TLS_SHA256_SHA256 |
834 | | #endif |
835 | | #ifdef WOLFSSL_SHA384 |
836 | | #define BUILD_TLS_SHA384_SHA384 |
837 | | #endif |
838 | | #endif |
839 | | |
840 | | #ifdef WOLFSSL_SM3 |
841 | | #ifdef WOLFSSL_SM4_GCM |
842 | | #define BUILD_TLS_SM4_GCM_SM3 |
843 | | #endif |
844 | | |
845 | | #ifdef WOLFSSL_SM4_CCM |
846 | | #define BUILD_TLS_SM4_CCM_SM3 |
847 | | #endif |
848 | | #endif |
849 | | #endif |
850 | | |
851 | | #if !defined(WOLFCRYPT_ONLY) && defined(NO_PSK) && \ |
852 | | (defined(NO_DH) || !defined(HAVE_ANON)) && \ |
853 | | defined(NO_RSA) && !defined(HAVE_ECC) && \ |
854 | | !defined(HAVE_ED25519) && !defined(HAVE_ED448) |
855 | | #error "No cipher suites available with this build" |
856 | | #endif |
857 | | |
858 | | #ifdef WOLFSSL_MULTICAST |
859 | | #if defined(HAVE_NULL_CIPHER) && !defined(NO_SHA256) |
860 | | #define BUILD_WDM_WITH_NULL_SHA256 |
861 | | #endif |
862 | | #endif |
863 | | |
864 | | #if defined(BUILD_SSL_RSA_WITH_RC4_128_SHA) || \ |
865 | | defined(BUILD_SSL_RSA_WITH_RC4_128_MD5) |
866 | | #define BUILD_ARC4 |
867 | | #endif |
868 | | |
869 | | #if defined(BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA) |
870 | | #define BUILD_DES3 |
871 | | #endif |
872 | | |
873 | | #if defined(BUILD_TLS_RSA_WITH_AES_128_CBC_SHA) || \ |
874 | | defined(BUILD_TLS_RSA_WITH_AES_256_CBC_SHA) || \ |
875 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) || \ |
876 | | defined(BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256) |
877 | | #undef BUILD_AES |
878 | | #define BUILD_AES |
879 | | #endif |
880 | | |
881 | | #if defined(BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256) || \ |
882 | | defined(BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) || \ |
883 | | defined(BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) || \ |
884 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) || \ |
885 | | defined(BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256) || \ |
886 | | defined(BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256) || \ |
887 | | defined(BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384) || \ |
888 | | defined(BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) || \ |
889 | | defined(BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) || \ |
890 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) || \ |
891 | | defined(BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384) || \ |
892 | | defined(BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384) || \ |
893 | | defined(BUILD_TLS_AES_128_GCM_SHA256) || \ |
894 | | defined(BUILD_TLS_AES_256_GCM_SHA384) |
895 | | #define BUILD_AESGCM |
896 | | #else |
897 | | /* No AES-GCM cipher suites available with build */ |
898 | | #define NO_AESGCM_AEAD |
899 | | #endif |
900 | | |
901 | | #if defined(BUILD_TLS_RSA_WITH_AES_128_CCM_8) || \ |
902 | | defined(BUILD_TLS_RSA_WITH_AES_256_CCM_8) || \ |
903 | | defined(BUILD_TLS_PSK_WITH_AES_128_CCM_8) || \ |
904 | | defined(BUILD_TLS_PSK_WITH_AES_128_CCM) || \ |
905 | | defined(BUILD_TLS_PSK_WITH_AES_256_CCM_8) || \ |
906 | | defined(BUILD_TLS_PSK_WITH_AES_256_CCM) || \ |
907 | | defined(BUILD_TLS_DHE_PSK_WITH_AES_128_CCM) || \ |
908 | | defined(BUILD_TLS_DHE_PSK_WITH_AES_256_CCM) || \ |
909 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM) || \ |
910 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8) || \ |
911 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8) || \ |
912 | | defined(BUILD_TLS_AES_128_CCM_SHA256) || \ |
913 | | defined(BUILD_TLS_AES_128_CCM_8_SHA256) |
914 | | #define BUILD_AESCCM |
915 | | #else |
916 | | /* No AES-CCM cipher suites available with build */ |
917 | | #define NO_AESCCM_AEAD |
918 | | #endif |
919 | | |
920 | | #if defined(BUILD_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256) || \ |
921 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384) |
922 | | #define BUILD_ARIA |
923 | | #endif |
924 | | |
925 | | #if defined(BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) || \ |
926 | | defined(BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256) || \ |
927 | | defined(BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256) || \ |
928 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) || \ |
929 | | defined(BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256) || \ |
930 | | defined(BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) || \ |
931 | | defined(BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256) || \ |
932 | | defined(BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256) || \ |
933 | | defined(BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256) || \ |
934 | | defined(BUILD_TLS_CHACHA20_POLY1305_SHA256) |
935 | | /* Have an available ChaCha Poly cipher suite */ |
936 | | #else |
937 | | /* No ChaCha Poly cipher suites available with build */ |
938 | | #define NO_CHAPOL_AEAD |
939 | | #endif |
940 | | |
941 | | #ifdef NO_DES3 |
942 | | #define DES_BLOCK_SIZE 8 |
943 | | #else |
944 | | #undef BUILD_DES3 |
945 | | #define BUILD_DES3 |
946 | | #endif |
947 | | |
948 | | #if defined(NO_AES) || !defined(HAVE_AES_DECRYPT) |
949 | | #undef WC_AES_BLOCK_SIZE |
950 | | #define WC_AES_BLOCK_SIZE 16 |
951 | | #undef BUILD_AES |
952 | | #else |
953 | | #undef BUILD_AES |
954 | | #define BUILD_AES |
955 | | #endif |
956 | | |
957 | | #if !defined(NO_RC4) && !defined(WSSL_HARDEN_TLS) |
958 | | /* MUST NOT negotiate RC4 cipher suites |
959 | | * https://www.rfc-editor.org/rfc/rfc9325#section-4.1 */ |
960 | | #undef BUILD_ARC4 |
961 | | #define BUILD_ARC4 |
962 | | #endif |
963 | | |
964 | | #ifdef HAVE_CHACHA |
965 | 0 | #define CHACHA20_BLOCK_SIZE 16 |
966 | | #endif |
967 | | |
968 | | #if defined(WOLFSSL_MAX_STRENGTH) || \ |
969 | | (defined(HAVE_AESGCM) && !defined(NO_AESGCM_AEAD)) || \ |
970 | | defined(HAVE_AESCCM) || \ |
971 | | defined(HAVE_ARIA) || \ |
972 | | (defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && \ |
973 | | !defined(NO_CHAPOL_AEAD)) || \ |
974 | | defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM) || \ |
975 | | (defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER)) |
976 | | |
977 | | #define HAVE_AEAD |
978 | | #endif |
979 | | |
980 | | #if defined(WOLFSSL_MAX_STRENGTH) || \ |
981 | | defined(HAVE_ECC) || !defined(NO_DH) |
982 | | |
983 | | #define HAVE_PFS |
984 | | #endif |
985 | | |
986 | | #ifdef WSSL_HARDEN_TLS |
987 | | #ifdef HAVE_NULL_CIPHER |
988 | | #error "NULL ciphers not allowed https://www.rfc-editor.org/rfc/rfc9325#section-4.1" |
989 | | #endif |
990 | | #ifdef WOLFSSL_STATIC_RSA |
991 | | #error "Static RSA ciphers not allowed https://www.rfc-editor.org/rfc/rfc9325#section-4.1" |
992 | | #endif |
993 | | #ifdef WOLFSSL_STATIC_DH |
994 | | #error "Static DH ciphers not allowed https://www.rfc-editor.org/rfc/rfc9325#section-4.1" |
995 | | #endif |
996 | | #ifdef HAVE_ANON |
997 | | #error "At least the server side has to be authenticated" |
998 | | #endif |
999 | | #endif |
1000 | | |
1001 | | #undef WSSL_HARDEN_TLS |
1002 | | |
1003 | | /* CA Names feature */ |
1004 | | #if !defined(WOLFSSL_NO_CA_NAMES) && defined(OPENSSL_EXTRA) |
1005 | | #define SSL_CLIENT_CA_NAMES(ssl) ((ssl)->client_ca_names != NULL ? \ |
1006 | | (ssl)->client_ca_names : \ |
1007 | | (ssl)->ctx->client_ca_names) |
1008 | | #define SSL_CA_NAMES(ssl) ((ssl)->ca_names != NULL ? \ |
1009 | | (ssl)->ca_names : \ |
1010 | | (ssl)->ctx->ca_names) |
1011 | | /* On the server, client_ca_names has priority over ca_names if both are |
1012 | | * set. This mimics OpenSSL's API: |
1013 | | * https://docs.openssl.org/3.6/man3/SSL_CTX_set0_CA_list/ */ |
1014 | | #define SSL_PRIORITY_CA_NAMES(ssl) \ |
1015 | | (((ssl)->options.side == WOLFSSL_SERVER_END && \ |
1016 | | SSL_CLIENT_CA_NAMES(ssl) != NULL) ? \ |
1017 | | SSL_CLIENT_CA_NAMES(ssl) : \ |
1018 | | SSL_CA_NAMES(ssl)) |
1019 | | #else |
1020 | | #undef WOLFSSL_NO_CA_NAMES |
1021 | | #define WOLFSSL_NO_CA_NAMES |
1022 | | #endif |
1023 | | |
1024 | | |
1025 | | /* actual cipher values, 2nd byte */ |
1026 | | enum { |
1027 | | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x16, |
1028 | | TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x39, |
1029 | | TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x33, |
1030 | | TLS_DH_anon_WITH_AES_128_CBC_SHA = 0x34, |
1031 | | TLS_RSA_WITH_AES_256_CBC_SHA = 0x35, |
1032 | | TLS_RSA_WITH_AES_128_CBC_SHA = 0x2F, |
1033 | | TLS_RSA_WITH_NULL_MD5 = 0x01, |
1034 | | TLS_RSA_WITH_NULL_SHA = 0x02, |
1035 | | TLS_PSK_WITH_AES_256_CBC_SHA = 0x8d, |
1036 | | TLS_PSK_WITH_AES_128_CBC_SHA256 = 0xae, |
1037 | | TLS_PSK_WITH_AES_256_CBC_SHA384 = 0xaf, |
1038 | | TLS_PSK_WITH_AES_128_CBC_SHA = 0x8c, |
1039 | | TLS_PSK_WITH_NULL_SHA256 = 0xb0, |
1040 | | TLS_PSK_WITH_NULL_SHA384 = 0xb1, |
1041 | | TLS_PSK_WITH_NULL_SHA = 0x2c, |
1042 | | SSL_RSA_WITH_RC4_128_SHA = 0x05, |
1043 | | SSL_RSA_WITH_RC4_128_MD5 = 0x04, |
1044 | | SSL_RSA_WITH_3DES_EDE_CBC_SHA = 0x0A, |
1045 | | |
1046 | | /* ECC suites, first byte is 0xC0 (ECC_BYTE) */ |
1047 | | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x14, |
1048 | | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x13, |
1049 | | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0x0A, |
1050 | | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0x09, |
1051 | | TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0x11, |
1052 | | TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0x07, |
1053 | | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x12, |
1054 | | TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA = 0x08, |
1055 | | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0x27, |
1056 | | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0x23, |
1057 | | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0x28, |
1058 | | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0x24, |
1059 | | TLS_ECDHE_ECDSA_WITH_NULL_SHA = 0x06, |
1060 | | TLS_ECDHE_PSK_WITH_NULL_SHA256 = 0x3a, |
1061 | | TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 = 0x37, |
1062 | | |
1063 | | /* static ECDH, first byte is 0xC0 (ECC_BYTE) */ |
1064 | | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA = 0x0F, |
1065 | | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA = 0x0E, |
1066 | | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0x05, |
1067 | | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA = 0x04, |
1068 | | TLS_ECDH_RSA_WITH_RC4_128_SHA = 0x0C, |
1069 | | TLS_ECDH_ECDSA_WITH_RC4_128_SHA = 0x02, |
1070 | | TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA = 0x0D, |
1071 | | TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA = 0x03, |
1072 | | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 = 0x29, |
1073 | | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 = 0x25, |
1074 | | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 = 0x2A, |
1075 | | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 = 0x26, |
1076 | | |
1077 | | WDM_WITH_NULL_SHA256 = 0xFE, /* wolfSSL DTLS Multicast */ |
1078 | | |
1079 | | /* SHA256 */ |
1080 | | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x6b, |
1081 | | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x67, |
1082 | | TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x3d, |
1083 | | TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x3c, |
1084 | | TLS_RSA_WITH_NULL_SHA256 = 0x3b, |
1085 | | TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = 0xb2, |
1086 | | TLS_DHE_PSK_WITH_NULL_SHA256 = 0xb4, |
1087 | | |
1088 | | /* SHA384 */ |
1089 | | TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = 0xb3, |
1090 | | TLS_DHE_PSK_WITH_NULL_SHA384 = 0xb5, |
1091 | | |
1092 | | /* AES-GCM */ |
1093 | | TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x9c, |
1094 | | TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x9d, |
1095 | | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x9e, |
1096 | | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x9f, |
1097 | | TLS_DH_anon_WITH_AES_256_GCM_SHA384 = 0xa7, |
1098 | | TLS_PSK_WITH_AES_128_GCM_SHA256 = 0xa8, |
1099 | | TLS_PSK_WITH_AES_256_GCM_SHA384 = 0xa9, |
1100 | | TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = 0xaa, |
1101 | | TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = 0xab, |
1102 | | |
1103 | | /* ECC AES-GCM, first byte is 0xC0 (ECC_BYTE) */ |
1104 | | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x2b, |
1105 | | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0x2c, |
1106 | | TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 = 0x2d, |
1107 | | TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 = 0x2e, |
1108 | | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x2f, |
1109 | | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0x30, |
1110 | | TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 = 0x31, |
1111 | | TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 = 0x32, |
1112 | | |
1113 | | /* AES-CCM, first byte is 0xC0 but isn't ECC, |
1114 | | * also, in some of the other AES-CCM suites |
1115 | | * there will be second byte number conflicts |
1116 | | * with non-ECC AES-GCM */ |
1117 | | TLS_RSA_WITH_AES_128_CCM_8 = 0xa0, |
1118 | | TLS_RSA_WITH_AES_256_CCM_8 = 0xa1, |
1119 | | TLS_ECDHE_ECDSA_WITH_AES_128_CCM = 0xac, |
1120 | | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 = 0xae, |
1121 | | TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 = 0xaf, |
1122 | | TLS_PSK_WITH_AES_128_CCM = 0xa4, |
1123 | | TLS_PSK_WITH_AES_256_CCM = 0xa5, |
1124 | | TLS_PSK_WITH_AES_128_CCM_8 = 0xa8, |
1125 | | TLS_PSK_WITH_AES_256_CCM_8 = 0xa9, |
1126 | | TLS_DHE_PSK_WITH_AES_128_CCM = 0xa6, |
1127 | | TLS_DHE_PSK_WITH_AES_256_CCM = 0xa7, |
1128 | | |
1129 | | /* Camellia */ |
1130 | | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x41, |
1131 | | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x84, |
1132 | | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0xba, |
1133 | | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0xc0, |
1134 | | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x45, |
1135 | | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x88, |
1136 | | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0xbe, |
1137 | | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0xc4, |
1138 | | |
1139 | | /* chacha20-poly1305 suites first byte is 0xCC (CHACHA_BYTE) */ |
1140 | | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xa8, |
1141 | | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 = 0xa9, |
1142 | | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xaa, |
1143 | | TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 = 0xac, |
1144 | | TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 = 0xab, |
1145 | | TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 = 0xad, |
1146 | | |
1147 | | /* chacha20-poly1305 earlier version of nonce and padding (CHACHA_BYTE) */ |
1148 | | TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 = 0x13, |
1149 | | TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256 = 0x14, |
1150 | | TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 = 0x15, |
1151 | | |
1152 | | /* ECDHE_PSK RFC8442, first byte is 0xD0 (EDHE_PSK_BYTE) */ |
1153 | | TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 = 0x01, |
1154 | | |
1155 | | /* TLS v1.3 cipher suites */ |
1156 | | TLS_AES_128_GCM_SHA256 = 0x01, |
1157 | | TLS_AES_256_GCM_SHA384 = 0x02, |
1158 | | TLS_CHACHA20_POLY1305_SHA256 = 0x03, |
1159 | | TLS_AES_128_CCM_SHA256 = 0x04, |
1160 | | TLS_AES_128_CCM_8_SHA256 = 0x05, |
1161 | | |
1162 | | /* TLS v1.3 Integrity only cipher suites - 0xC0 (ECC) first byte */ |
1163 | | TLS_SHA256_SHA256 = 0xB4, |
1164 | | TLS_SHA384_SHA384 = 0xB5, |
1165 | | |
1166 | | /* ARIA-GCM, first byte is 0xC0 (ECC_BYTE) |
1167 | | * See: https://www.rfc-editor.org/rfc/rfc6209.html#section-5 |
1168 | | */ |
1169 | | TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 = 0x5c, |
1170 | | TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 = 0x5d, |
1171 | | |
1172 | | /* TLS v1.3 SM cipher suites - 0x00 (CIPHER_BYTE) is first byte */ |
1173 | | TLS_SM4_GCM_SM3 = 0xC6, |
1174 | | TLS_SM4_CCM_SM3 = 0xC7, |
1175 | | |
1176 | | /* TLS v1.2 SM cipher suites - 0xE0 (SM_BYTE) is first byte */ |
1177 | | TLS_ECDHE_ECDSA_WITH_SM4_CBC_SM3 = 0x11, |
1178 | | TLS_ECDHE_ECDSA_WITH_SM4_GCM_SM3 = 0x51, |
1179 | | TLS_ECDHE_ECDSA_WITH_SM4_CCM_SM3 = 0x52, |
1180 | | |
1181 | | /* Fallback SCSV (Signaling Cipher Suite Value) */ |
1182 | | TLS_FALLBACK_SCSV = 0x56, |
1183 | | /* Renegotiation Indication Extension Special Suite */ |
1184 | | TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0xff |
1185 | | }; |
1186 | | |
1187 | | |
1188 | | #ifndef WOLFSSL_SESSION_TIMEOUT |
1189 | 5.46k | #define WOLFSSL_SESSION_TIMEOUT 500 |
1190 | | /* default session resumption cache timeout in seconds */ |
1191 | | #endif |
1192 | | |
1193 | | |
1194 | | #ifndef WOLFSSL_DTLS_WINDOW_WORDS |
1195 | | #define WOLFSSL_DTLS_WINDOW_WORDS 2 |
1196 | | #endif /* WOLFSSL_DTLS_WINDOW_WORDS */ |
1197 | | #define DTLS_WORD_BITS (sizeof(word32) * CHAR_BIT) |
1198 | | #define DTLS_SEQ_BITS (WOLFSSL_DTLS_WINDOW_WORDS * DTLS_WORD_BITS) |
1199 | | #define DTLS_SEQ_SZ (sizeof(word32) * WOLFSSL_DTLS_WINDOW_WORDS) |
1200 | | |
1201 | | #ifndef WOLFSSL_MULTICAST |
1202 | | #define WOLFSSL_DTLS_PEERSEQ_SZ 1 |
1203 | | #else |
1204 | | #ifndef WOLFSSL_MULTICAST_PEERS |
1205 | | /* max allowed multicast group peers */ |
1206 | | #define WOLFSSL_MULTICAST_PEERS 100 |
1207 | | #endif |
1208 | | #define WOLFSSL_DTLS_PEERSEQ_SZ WOLFSSL_MULTICAST_PEERS |
1209 | | #endif /* WOLFSSL_MULTICAST */ |
1210 | | |
1211 | | #ifndef WOLFSSL_MAX_MTU |
1212 | | /* 1500 - 100 bytes to account for UDP and IP headers */ |
1213 | | #define WOLFSSL_MAX_MTU 1400 |
1214 | | #endif /* WOLFSSL_MAX_MTU */ |
1215 | | |
1216 | | #ifndef WOLFSSL_DTLS_MTU_ADDITIONAL_READ_BUFFER |
1217 | | #define WOLFSSL_DTLS_MTU_ADDITIONAL_READ_BUFFER 500 |
1218 | | #endif /* WOLFSSL_DTLS_MTU_ADDITIONAL_READ_BUFFER */ |
1219 | | |
1220 | | #ifndef WOLFSSL_DTLS_FRAG_POOL_SZ |
1221 | | #define WOLFSSL_DTLS_FRAG_POOL_SZ 10 |
1222 | | #endif |
1223 | | |
1224 | | /* set minimum DH key size allowed */ |
1225 | | #ifndef WOLFSSL_MIN_DHKEY_BITS |
1226 | | #if defined(WOLFSSL_HARDEN_TLS) && !defined(WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK) |
1227 | | /* Using guidance from section 5.6.1 |
1228 | | * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf */ |
1229 | | #if WOLFSSL_HARDEN_TLS >= 128 |
1230 | | #define WOLFSSL_MIN_DHKEY_BITS 3072 |
1231 | | #elif WOLFSSL_HARDEN_TLS >= 112 |
1232 | | #define WOLFSSL_MIN_DHKEY_BITS 2048 |
1233 | | #endif |
1234 | | #else |
1235 | 5.46k | #define WOLFSSL_MIN_DHKEY_BITS DH_MIN_SIZE |
1236 | | #endif |
1237 | | #endif |
1238 | | #if defined(WOLFSSL_HARDEN_TLS) && WOLFSSL_MIN_DHKEY_BITS < 2048 && \ |
1239 | | !defined(WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK) |
1240 | | /* Implementations MUST NOT negotiate cipher suites offering less than |
1241 | | * 112 bits of security. |
1242 | | * https://www.rfc-editor.org/rfc/rfc9325#section-4.1 |
1243 | | * Using guidance from section 5.6.1 |
1244 | | * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf */ |
1245 | | #error "For 112 bits of security DH needs at least 2048 bit keys" |
1246 | | #endif |
1247 | | #if (WOLFSSL_MIN_DHKEY_BITS % 8) |
1248 | | #error DH minimum bit size must be multiple of 8 |
1249 | | #endif |
1250 | | #if (WOLFSSL_MIN_DHKEY_BITS > 16000) |
1251 | | #error DH minimum bit size must not be greater than 16000 |
1252 | | #endif |
1253 | | #if (WOLFSSL_MIN_DHKEY_BITS < DH_MIN_SIZE) |
1254 | | /* The TLS-layer minimum must not be looser than the wolfCrypt DH primitive |
1255 | | * minimum (DH_MIN_SIZE), otherwise a key size accepted during negotiation |
1256 | | * is later rejected by wc_DhAgree with WC_KEY_SIZE_E. */ |
1257 | | #error "WOLFSSL_MIN_DHKEY_BITS must be >= DH_MIN_SIZE" |
1258 | | #endif |
1259 | 5.46k | #define MIN_DHKEY_SZ (WOLFSSL_MIN_DHKEY_BITS / 8) |
1260 | | /* set maximum DH key size allowed */ |
1261 | | #ifndef WOLFSSL_MAX_DHKEY_BITS |
1262 | | #if (defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS >= 16384) |
1263 | | #define WOLFSSL_MAX_DHKEY_BITS (FP_MAX_BITS / 2) |
1264 | | #elif (defined(WOLFSSL_SP_MATH_ALL) || defined(WOLFSSL_SP_MATH)) && \ |
1265 | | defined(SP_INT_BITS) |
1266 | | /* SP implementation supports numbers of SP_INT_BITS bits. */ |
1267 | | #define WOLFSSL_MAX_DHKEY_BITS WC_BITS_FULL_BYTES(SP_INT_BITS) |
1268 | | #else |
1269 | 5.46k | #define WOLFSSL_MAX_DHKEY_BITS 4096 |
1270 | | #endif |
1271 | | #endif |
1272 | | #if (WOLFSSL_MAX_DHKEY_BITS % 8) |
1273 | | #error DH maximum bit size must be multiple of 8 |
1274 | | #endif |
1275 | | #if (WOLFSSL_MAX_DHKEY_BITS > 16384) |
1276 | | #error DH maximum bit size must not be greater than 16384 |
1277 | | #endif |
1278 | 5.46k | #define MAX_DHKEY_SZ (WOLFSSL_MAX_DHKEY_BITS / 8) |
1279 | | |
1280 | | #ifndef NO_DH |
1281 | | #if WOLFSSL_MAX_DHKEY_BITS < WOLFSSL_MIN_DHKEY_BITS |
1282 | | #error "WOLFSSL_MAX_DHKEY_BITS has to be greater than WOLFSSL_MIN_DHKEY_BITS" |
1283 | | #endif |
1284 | | #endif /* NO_DH */ |
1285 | | |
1286 | | #ifndef MAX_PSK_KEY_LEN |
1287 | | #define MAX_PSK_KEY_LEN 64 |
1288 | | #endif |
1289 | | |
1290 | | #ifndef MAX_EARLY_DATA_SZ |
1291 | | /* maximum early data size */ |
1292 | | #define MAX_EARLY_DATA_SZ 4096 |
1293 | | #endif |
1294 | | |
1295 | | /* Anti-replay eviction keys off the ticket's session ID. */ |
1296 | | #if defined(WOLFSSL_EARLY_DATA) && defined(HAVE_SESSION_TICKET) && \ |
1297 | | !defined(WOLFSSL_TICKET_HAVE_ID) |
1298 | | #define WOLFSSL_TICKET_HAVE_ID |
1299 | | #endif |
1300 | | |
1301 | | |
1302 | | #if !defined(NO_RSA) || !defined(NO_DH) || defined(HAVE_ECC) |
1303 | | /* MySQL wants to be able to use 8192-bit numbers. */ |
1304 | | #if defined(USE_FAST_MATH) && defined(FP_MAX_BITS) |
1305 | | /* Use the FP size up to 8192-bit and down to a min of 1024-bit. */ |
1306 | | #if FP_MAX_BITS >= 16384 |
1307 | | #define ENCRYPT_BASE_BITS 8192 |
1308 | | #elif defined(HAVE_ECC) |
1309 | | #if FP_MAX_BITS > 2224 |
1310 | | #define ENCRYPT_BASE_BITS (FP_MAX_BITS / 2) |
1311 | | #else |
1312 | | /* 521-bit ASN.1 signature - 3 + 2 * (2 + 66) bytes. */ |
1313 | | #define ENCRYPT_BASE_BITS 1112 |
1314 | | #endif |
1315 | | #else |
1316 | | #if FP_MAX_BITS > 2048 |
1317 | | #define ENCRYPT_BASE_BITS (FP_MAX_BITS / 2) |
1318 | | #else |
1319 | | #define ENCRYPT_BASE_BITS 1024 |
1320 | | #endif |
1321 | | #endif |
1322 | | |
1323 | | /* Check MySQL size requirements met. */ |
1324 | | #if defined(WOLFSSL_MYSQL_COMPATIBLE) && ENCRYPT_BASE_BITS < 8192 |
1325 | | #error "MySQL needs FP_MAX_BITS at least at 16384" |
1326 | | #endif |
1327 | | |
1328 | | #if !defined(NO_RSA) && defined(WC_MAX_RSA_BITS) && \ |
1329 | | WC_MAX_RSA_BITS > ENCRYPT_BASE_BITS |
1330 | | #error "FP_MAX_BITS too small for WC_MAX_RSA_BITS" |
1331 | | #endif |
1332 | | #elif defined(WOLFSSL_SP_MATH_ALL) || defined(WOLFSSL_SP_MATH) |
1333 | | /* Use the SP size up to 8192-bit and down to a min of 1024-bit. */ |
1334 | | #if SP_INT_BITS >= 8192 |
1335 | | #define ENCRYPT_BASE_BITS 8192 |
1336 | | #elif defined(HAVE_ECC) |
1337 | | #if SP_INT_BITS > 1112 |
1338 | | #define ENCRYPT_BASE_BITS SP_INT_BITS |
1339 | | #else |
1340 | | /* 521-bit ASN.1 signature - 3 + 2 * (2 + 66) bytes. */ |
1341 | | #define ENCRYPT_BASE_BITS 1112 |
1342 | | #endif |
1343 | | #else |
1344 | | #if SP_INT_BITS > 1024 |
1345 | | #define ENCRYPT_BASE_BITS SP_INT_BITS |
1346 | | #else |
1347 | | #define ENCRYPT_BASE_BITS 1024 |
1348 | | #endif |
1349 | | #endif |
1350 | | |
1351 | | /* Check MySQL size requirements met. */ |
1352 | | #if defined(WOLFSSL_MYSQL_COMPATIBLE) && ENCRYPT_BASE_BITS < 8192 |
1353 | | #error "MySQL needs SP_INT_BITS at least at 8192" |
1354 | | #endif |
1355 | | |
1356 | | #if !defined(NO_RSA) && defined(WC_MAX_RSA_BITS) && \ |
1357 | | WC_MAX_RSA_BITS > SP_INT_BITS |
1358 | | #error "SP_INT_BITS too small for WC_MAX_RSA_BITS" |
1359 | | #endif |
1360 | | #else |
1361 | | /* Integer/heap maths - support 4096-bit. */ |
1362 | | #define ENCRYPT_BASE_BITS 4096 |
1363 | | #endif |
1364 | | #elif defined(HAVE_CURVE448) |
1365 | | #define ENCRYPT_BASE_BITS (456 * 2) |
1366 | | #elif defined(HAVE_CURVE25519) |
1367 | | #define ENCRYPT_BASE_BITS (256 * 2) |
1368 | | #else |
1369 | | /* No secret from public key operation but PSK key plus length used. */ |
1370 | | #define ENCRYPT_BASE_BITS ((MAX_PSK_KEY_LEN + 2) * 8) |
1371 | | #endif |
1372 | | |
1373 | | #ifdef WOLFSSL_DTLS_CID |
1374 | | #ifndef DTLS_CID_MAX_SIZE |
1375 | | /* DTLS parsing code copies the record header in a static buffer to decrypt |
1376 | | * the record. Increasing the CID max size does increase also this buffer, |
1377 | | * impacting on per-session runtime memory footprint. */ |
1378 | | #define DTLS_CID_MAX_SIZE 10 |
1379 | | #endif |
1380 | | #else |
1381 | | #undef DTLS_CID_MAX_SIZE |
1382 | | #define DTLS_CID_MAX_SIZE 0 |
1383 | | #endif /* WOLFSSL_DTLS_CID */ |
1384 | | |
1385 | | #if DTLS_CID_MAX_SIZE > 255 |
1386 | | #error "Max size for DTLS CID is 255 bytes" |
1387 | | #endif |
1388 | | |
1389 | | /* Record Payload Protection Section 5 |
1390 | | * https://www.rfc-editor.org/rfc/rfc9146.html#section-5 */ |
1391 | | #define WOLFSSL_TLS_HMAC_CID_INNER_SZ \ |
1392 | | (8 + /* seq_num_placeholder */ \ |
1393 | | 1 + /* tls12_cid */ \ |
1394 | | 1 + /* cid_length */ \ |
1395 | | 1 + /* tls12_cid */ \ |
1396 | | 2 + /* DTLSCiphertext.version */ \ |
1397 | | 2 + /* epoch */ \ |
1398 | | 6 + /* sequence_number */ \ |
1399 | | DTLS_CID_MAX_SIZE + /* cid */ \ |
1400 | | 2) /* length_of_DTLSInnerPlaintext */ |
1401 | | |
1402 | | #define WOLFSSL_TLS_AEAD_CID_AAD_SZ \ |
1403 | | (8 + /* seq_num_placeholder */ \ |
1404 | | 1 + /* tls12_cid */ \ |
1405 | | 1 + /* cid_length */ \ |
1406 | | 1 + /* tls12_cid */ \ |
1407 | | 2 + /* DTLSCiphertext.version */ \ |
1408 | | 2 + /* epoch */ \ |
1409 | | 6 + /* sequence_number */ \ |
1410 | | DTLS_CID_MAX_SIZE + /* cid */ \ |
1411 | | 2) /* length_of_DTLSInnerPlaintext */ |
1412 | | |
1413 | | #ifndef MAX_TICKET_AGE_DIFF |
1414 | | /* maximum ticket age difference in seconds, 10 seconds */ |
1415 | | #define MAX_TICKET_AGE_DIFF 10 |
1416 | | #endif |
1417 | | #ifndef TLS13_MAX_TICKET_AGE |
1418 | | /* max ticket age in seconds, 7 days */ |
1419 | | #define TLS13_MAX_TICKET_AGE (7*24*60*60) |
1420 | | #endif |
1421 | | |
1422 | | |
1423 | | /* Limit is 2^24.5 |
1424 | | * https://www.rfc-editor.org/rfc/rfc8446#section-5.5 |
1425 | | * Without the fraction is 23726566 (0x016A09E6) */ |
1426 | | #define AEAD_AES_LIMIT w64From32(0, 0x016A09E6) |
1427 | | /* Limit is 2^23 |
1428 | | * https://www.rfc-editor.org/rfc/rfc9147.html#name-integrity-limits */ |
1429 | | #define DTLS_AEAD_AES_CCM_LIMIT w64From32(0, 1 << 22) |
1430 | | |
1431 | | /* Limit is 2^36 |
1432 | | * https://www.rfc-editor.org/rfc/rfc9147.html#name-aead-limits */ |
1433 | | #define DTLS_AEAD_AES_GCM_CHACHA_FAIL_LIMIT w64From32(1 << 3, 0) |
1434 | | #define DTLS_AEAD_AES_GCM_CHACHA_FAIL_KU_LIMIT w64From32(1 << 2, 0) |
1435 | | /* Limit is 2^7 |
1436 | | * https://www.rfc-editor.org/rfc/rfc9147.html#name-limits-for-aead_aes_128_ccm */ |
1437 | | #define DTLS_AEAD_AES_CCM_8_FAIL_LIMIT w64From32(0, 1 << 6) |
1438 | | #define DTLS_AEAD_AES_CCM_8_FAIL_KU_LIMIT w64From32(0, 1 << 5) |
1439 | | /* Limit is 2^23.5. |
1440 | | * https://www.rfc-editor.org/rfc/rfc9147.html#name-integrity-limits |
1441 | | * Without the fraction is 11863283 (0x00B504F3) |
1442 | | * Half of this value is 5931641 (0x005A8279) */ |
1443 | | #define DTLS_AEAD_AES_CCM_FAIL_LIMIT w64From32(0, 0x00B504F3) |
1444 | | #define DTLS_AEAD_AES_CCM_FAIL_KU_LIMIT w64From32(0, 0x005A8279) |
1445 | | |
1446 | | /* Limit is (2^22 - 1) full messages [2^36 - 31 octets] |
1447 | | * https://www.rfc-editor.org/rfc/rfc8998.html#name-aead_sm4_gcm |
1448 | | */ |
1449 | | #define AEAD_SM4_GCM_LIMIT w64From32(0, (1 << 22) - 1) |
1450 | | /* Limit is (2^10 - 1) full messages [2^24 - 1 octets] |
1451 | | * https://www.rfc-editor.org/rfc/rfc8998.html#name-aead_sm4_ccm |
1452 | | */ |
1453 | | #define AEAD_SM4_CCM_LIMIT w64From32(0, (1 << 10) - 1) |
1454 | | |
1455 | | #ifndef WOLFSSL_COOKIE_LEN |
1456 | | /* Maximum size for a DTLS cookie */ |
1457 | | #define WOLFSSL_COOKIE_LEN 32 |
1458 | | #endif |
1459 | | |
1460 | | #if WOLFSSL_COOKIE_LEN > 255 |
1461 | | #error "WOLFSSL_COOKIE_LEN must be <= 255 per RFC 6347 (opaque<0..2^8-1>)" |
1462 | | #endif |
1463 | | |
1464 | | #if defined(WOLFSSL_TLS13) || !defined(NO_PSK) |
1465 | | |
1466 | | #define TLS13_TICKET_NONCE_MAX_SZ 255 |
1467 | | |
1468 | | #if (defined(HAVE_FIPS) && \ |
1469 | | !(defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3))) && \ |
1470 | | defined(TLS13_TICKET_NONCE_STATIC_SZ) |
1471 | | #error "TLS13_TICKET_NONCE_STATIC_SZ is not supported in this FIPS version" |
1472 | | #endif |
1473 | | |
1474 | | #ifndef TLS13_TICKET_NONCE_STATIC_SZ |
1475 | | #define TLS13_TICKET_NONCE_STATIC_SZ 8 |
1476 | | #endif |
1477 | | |
1478 | | #if TLS13_TICKET_NONCE_STATIC_SZ > TLS13_TICKET_NONCE_MAX_SZ |
1479 | | #error "Max size for ticket nonce is 255 bytes" |
1480 | | #endif |
1481 | | |
1482 | | #endif /* WOLFSSL_TLS13 || !NO_PSK */ |
1483 | | |
1484 | | #ifdef WOLFSSL_TLS13 |
1485 | | /* The length of the certificate verification label - client and server. */ |
1486 | 340 | #define CERT_VFY_LABEL_SZ 34 |
1487 | | /* The number of prefix bytes for signature data. */ |
1488 | 340 | #define SIGNING_DATA_PREFIX_SZ 64 |
1489 | | /* Maximum length of the signature data. */ |
1490 | | #define MAX_SIG_DATA_SZ (SIGNING_DATA_PREFIX_SZ + \ |
1491 | | CERT_VFY_LABEL_SZ + \ |
1492 | | WC_MAX_DIGEST_SIZE) |
1493 | | #endif /* WOLFSSL_TLS13 */ |
1494 | | |
1495 | | enum Misc { |
1496 | | CIPHER_BYTE = 0x00, /* Default ciphers */ |
1497 | | ECC_BYTE = 0xC0, /* ECC first cipher suite byte */ |
1498 | | CHACHA_BYTE = 0xCC, /* ChaCha first cipher suite */ |
1499 | | TLS13_BYTE = 0x13, /* TLS v1.3 first byte of cipher suite */ |
1500 | | ECDHE_PSK_BYTE = 0xD0, /* RFC 8442 */ |
1501 | | SM_BYTE = 0xE0, /* SM first byte - private range */ |
1502 | | |
1503 | | SEND_CERT = 1, |
1504 | | SEND_BLANK_CERT = 2, |
1505 | | |
1506 | | DTLS_MAJOR = 0xfe, /* DTLS major version number */ |
1507 | | DTLS_MINOR = 0xff, /* DTLS minor version number */ |
1508 | | DTLS_BOGUS_MINOR = 0xfe, /* DTLS 0xfe was skipped, see RFC6347 Sec. 1 */ |
1509 | | DTLSv1_2_MINOR = 0xfd, /* DTLS minor version number */ |
1510 | | DTLSv1_3_MINOR = 0xfc, /* DTLS minor version number */ |
1511 | | SSLv3_MAJOR = 3, /* SSLv3 and TLSv1+ major version number */ |
1512 | | SSLv3_MINOR = 0, /* TLSv1 minor version number */ |
1513 | | TLSv1_MINOR = 1, /* TLSv1 minor version number */ |
1514 | | TLSv1_1_MINOR = 2, /* TLSv1_1 minor version number */ |
1515 | | TLSv1_2_MINOR = 3, /* TLSv1_2 minor version number */ |
1516 | | TLSv1_3_MINOR = 4, /* TLSv1_3 minor version number */ |
1517 | | TLS_DRAFT_MAJOR = 0x7f, /* Draft TLS major version number */ |
1518 | | OLD_HELLO_ID = 0x01, /* SSLv2 Client Hello Indicator */ |
1519 | | INVALID_BYTE = 0xff, /* Used to initialize cipher specs values */ |
1520 | | NO_COMPRESSION = 0, |
1521 | | ZLIB_COMPRESSION = 221, /* wolfSSL zlib compression */ |
1522 | | HELLO_EXT_SIG_ALGO = 13, /* ID for the sig_algo hello extension */ |
1523 | | HELLO_EXT_EXTMS = 0x0017, /* ID for the extended master secret ext */ |
1524 | | SECRET_LEN = WOLFSSL_MAX_MASTER_KEY_LENGTH, |
1525 | | /* pre RSA and all master */ |
1526 | | #if !defined(WOLFSSL_TLS13) || defined(WOLFSSL_32BIT_MILLI_TIME) |
1527 | | TIMESTAMP_LEN = 4, /* timestamp size in ticket */ |
1528 | | #else |
1529 | | TIMESTAMP_LEN = 8, /* timestamp size in ticket */ |
1530 | | #endif |
1531 | | #ifdef WOLFSSL_TLS13 |
1532 | | AGEADD_LEN = 4, /* ageAdd size in ticket */ |
1533 | | NAMEDGROUP_LEN = 2, /* namedGroup size in ticket */ |
1534 | | #ifdef WOLFSSL_EARLY_DATA |
1535 | | MAXEARLYDATASZ_LEN = 4, /* maxEarlyDataSz size in ticket */ |
1536 | | #endif |
1537 | | #endif |
1538 | | #ifndef NO_PSK |
1539 | | ENCRYPT_LEN = (ENCRYPT_BASE_BITS / 8) + MAX_PSK_KEY_LEN + 2, |
1540 | | #else |
1541 | | ENCRYPT_LEN = (ENCRYPT_BASE_BITS / 8), |
1542 | | #endif |
1543 | | SIZEOF_SENDER = 4, /* clnt or srvr */ |
1544 | | FINISHED_SZ = 36, /* WC_MD5_DIGEST_SIZE + WC_SHA_DIGEST_SIZE */ |
1545 | | MAX_PLAINTEXT_SZ = (1 << 14), /* Max plaintext sz */ |
1546 | | MAX_TLS_CIPHER_SZ = (1 << 14) + 2048, /* Max TLS encrypted data sz */ |
1547 | | #ifdef WOLFSSL_TLS13 |
1548 | | MAX_TLS13_PLAIN_SZ = (1 << 14) + 1, /* Max unencrypted data sz */ |
1549 | | MAX_TLS13_ENC_SZ = (1 << 14) + 256, /* Max encrypted data sz */ |
1550 | | #endif |
1551 | | MAX_MSG_EXTRA = 38 + WC_MAX_DIGEST_SIZE, |
1552 | | /* max added to msg, mac + pad from */ |
1553 | | /* RECORD_HEADER_SZ + BLOCK_SZ (pad) + Max |
1554 | | digest sz + BLOC_SZ (iv) + pad byte (1) */ |
1555 | | MAX_COMP_EXTRA = 1024, /* max compression extra */ |
1556 | | MAX_MTU = WOLFSSL_MAX_MTU, /* max expected MTU */ |
1557 | | MAX_UDP_SIZE = 8192 - 100, /* was MAX_MTU - 100 */ |
1558 | | MAX_DH_SZ = (MAX_DHKEY_SZ * 3) + 12, /* DH_P, DH_G and DH_Pub */ |
1559 | | /* 4096 p, pub, g + 2 byte size for each */ |
1560 | | MAX_STR_VERSION = 8, /* string rep of protocol version */ |
1561 | | |
1562 | | PAD_MD5 = 48, /* pad length for finished */ |
1563 | | PAD_SHA = 40, /* pad length for finished */ |
1564 | | MAX_PAD_SIZE = 256, /* maximum length of padding */ |
1565 | | |
1566 | | LENGTH_SZ = 2, /* length field for HMAC, data only */ |
1567 | | VERSION_SZ = 2, /* length of proctocol version */ |
1568 | | SEQ_SZ = 8, /* 64 bit sequence number */ |
1569 | | ALERT_SIZE = 2, /* level + description */ |
1570 | | VERIFY_HEADER = 2, /* always use 2 bytes */ |
1571 | | EXTS_SZ = 2, /* always use 2 bytes */ |
1572 | | EXT_ID_SZ = 2, /* always use 2 bytes */ |
1573 | | MAX_DH_SIZE = MAX_DHKEY_SZ+1, |
1574 | | /* Max size plus possible leading 0 */ |
1575 | | MIN_FFHDE_GROUP = 0x100, /* Named group minimum for FFDHE parameters */ |
1576 | | MAX_FFHDE_GROUP = 0x1FF, /* Named group maximum for FFDHE parameters */ |
1577 | | SESSION_HINT_SZ = 4, /* session timeout hint */ |
1578 | | SESSION_ADD_SZ = 4, /* session age add */ |
1579 | | TICKET_NONCE_LEN_SZ = 1, /* Ticket nonce length size */ |
1580 | | DEF_TICKET_NONCE_SZ = 1, /* Default ticket nonce size */ |
1581 | | #if defined(WOLFSSL_TLS13) || !defined(NO_PSK) |
1582 | | MAX_TICKET_NONCE_STATIC_SZ = TLS13_TICKET_NONCE_STATIC_SZ, |
1583 | | /* maximum ticket nonce static size */ |
1584 | | #endif /* WOLFSSL_TLS13 || !NO_PSK */ |
1585 | | MAX_LIFETIME = 604800, /* maximum ticket lifetime */ |
1586 | | |
1587 | | RAN_LEN = 32, /* random length */ |
1588 | | SEED_LEN = RAN_LEN * 2, /* tls prf seed length */ |
1589 | | ID_LEN = 32, /* session id length */ |
1590 | | COOKIE_SECRET_SZ = 14, /* dtls cookie secret size */ |
1591 | | MAX_COOKIE_LEN = WOLFSSL_COOKIE_LEN, /* max dtls cookie size */ |
1592 | | COOKIE_SZ = 20, /* use a 20 byte cookie */ |
1593 | | SUITE_LEN = 2, /* cipher suite sz length */ |
1594 | | ENUM_LEN = 1, /* always a byte */ |
1595 | | OPAQUE8_LEN = 1, /* 1 byte */ |
1596 | | OPAQUE16_LEN = 2, /* 2 bytes */ |
1597 | | OPAQUE24_LEN = 3, /* 3 bytes */ |
1598 | | OPAQUE32_LEN = 4, /* 4 bytes */ |
1599 | | OPAQUE64_LEN = 8, /* 8 bytes */ |
1600 | | COMP_LEN = 1, /* compression length */ |
1601 | | CURVE_LEN = 2, /* ecc named curve length */ |
1602 | | KE_GROUP_LEN = 2, /* key exchange group length */ |
1603 | | #if defined(NO_SHA) && !defined(NO_SHA256) |
1604 | | SERVER_ID_LEN = WC_SHA256_DIGEST_SIZE, |
1605 | | #else |
1606 | | SERVER_ID_LEN = WC_SHA_DIGEST_SIZE, |
1607 | | #endif |
1608 | | |
1609 | | HANDSHAKE_HEADER_SZ = 4, /* type + length(3) */ |
1610 | | DTLS13_HANDSHAKE_HEADER_SZ = 12, /* sizeof(Dtls13HandshakeHeader) */ |
1611 | | RECORD_HEADER_SZ = 5, /* type + version + len(2) */ |
1612 | | CERT_HEADER_SZ = 3, /* always 3 bytes */ |
1613 | | REQ_HEADER_SZ = 2, /* cert request header sz */ |
1614 | | HINT_LEN_SZ = 2, /* length of hint size field */ |
1615 | | TRUNCATED_HMAC_SZ = 10, /* length of hmac w/ truncated hmac extension */ |
1616 | | HELLO_EXT_SZ = 4, /* base length of a hello extension */ |
1617 | | HELLO_EXT_TYPE_SZ = 2, /* length of a hello extension type */ |
1618 | | HELLO_EXT_SZ_SZ = 2, /* length of a hello extension size */ |
1619 | | HELLO_EXT_SIGALGO_SZ = 2, /* length of number of items in sigalgo list */ |
1620 | | |
1621 | | DTLS_HANDSHAKE_HEADER_SZ = 12, /* normal + seq(2) + offset(3) + length(3) */ |
1622 | | DTLS_RECORD_HEADER_SZ = 13, /* normal + epoch(2) + seq_num(6) */ |
1623 | | DTLS12_CID_OFFSET = 11, |
1624 | | DTLS_UNIFIED_HEADER_MIN_SZ = 2, |
1625 | | /* flags + seq_number(2) + length(2) + CID */ |
1626 | | DTLS_RECVD_RL_HEADER_MAX_SZ = 5 + DTLS_CID_MAX_SIZE, |
1627 | | DTLS_RECORD_HEADER_MAX_SZ = 13, |
1628 | | DTLS_HANDSHAKE_EXTRA = 8, /* diff from normal */ |
1629 | | DTLS_RECORD_EXTRA = 8, /* diff from normal */ |
1630 | | DTLS_HANDSHAKE_SEQ_SZ = 2, /* handshake header sequence number */ |
1631 | | DTLS_HANDSHAKE_FRAG_SZ = 3, /* fragment offset and length are 24 bit */ |
1632 | | DTLS_POOL_SZ = 20, /* allowed number of list items in TX and |
1633 | | * RX pool */ |
1634 | | DTLS_FRAG_POOL_SZ = WOLFSSL_DTLS_FRAG_POOL_SZ, |
1635 | | /* allowed number of fragments per msg */ |
1636 | | DTLS_EXPORT_PRO = 165,/* wolfSSL protocol for serialized session */ |
1637 | | DTLS_EXPORT_STATE_PRO = 166,/* wolfSSL protocol for serialized state */ |
1638 | | TLS_EXPORT_PRO = 167,/* wolfSSL protocol for serialized TLS */ |
1639 | | DTLS_EXPORT_OPT_SZ = 66, /* number of bytes used from Options */ |
1640 | | DTLS_EXPORT_OPT_SZ_5 = 62, /* number of bytes used from Options */ |
1641 | | DTLS_EXPORT_OPT_SZ_4 = 61, /* number of bytes used from Options */ |
1642 | | TLS_EXPORT_OPT_SZ = 66, /* number of bytes used from Options */ |
1643 | | TLS_EXPORT_OPT_SZ_5 = 66, /* number of bytes used from Options */ |
1644 | | TLS_EXPORT_OPT_SZ_4 = 65, /* number of bytes used from Options */ |
1645 | | DTLS_EXPORT_OPT_SZ_3 = 60, /* number of bytes used from Options */ |
1646 | | DTLS_EXPORT_KEY_SZ = 325 + (DTLS_SEQ_SZ * 2), |
1647 | | /* max number of bytes used from Keys */ |
1648 | | DTLS_EXPORT_MIN_KEY_SZ = 85 + (DTLS_SEQ_SZ * 2), |
1649 | | /* min number of bytes used from Keys */ |
1650 | | WOLFSSL_EXPORT_TLS = 1, |
1651 | | WOLFSSL_EXPORT_DTLS = 0, |
1652 | | #ifndef WOLFSSL_EXPORT_SPC_SZ |
1653 | | WOLFSSL_EXPORT_SPC_SZ = 16, /* number of bytes used from CipherSpecs */ |
1654 | | #endif |
1655 | | WOLFSSL_EXPORT_LEN = 2, /* 2 bytes for length and protocol */ |
1656 | | WOLFSSL_EXPORT_VERSION = 6, /* wolfSSL version for serialized session */ |
1657 | | |
1658 | | /* older export versions supported */ |
1659 | | WOLFSSL_EXPORT_VERSION_5 = 5, /* version before DTLS Encrypt-Then-MAC */ |
1660 | | WOLFSSL_EXPORT_VERSION_4 = 4, /* 5.6.4 release and before */ |
1661 | | WOLFSSL_EXPORT_VERSION_3 = 3, /* wolfSSL version before TLS 1.3 addition */ |
1662 | | |
1663 | | MAX_EXPORT_IP = 46, /* max ip size IPv4 mapped IPv6 */ |
1664 | | DTLS_MTU_ADDITIONAL_READ_BUFFER = WOLFSSL_DTLS_MTU_ADDITIONAL_READ_BUFFER, |
1665 | | /* Additional bytes to read so that |
1666 | | * we can work with a peer that has |
1667 | | * a slightly different MTU than us. */ |
1668 | | MAX_EXPORT_BUFFER = 514, /* max size of buffer for exporting */ |
1669 | | MAX_EXPORT_STATE_BUFFER = (DTLS_EXPORT_MIN_KEY_SZ) + (3 * WOLFSSL_EXPORT_LEN), |
1670 | | /* max size of buffer for exporting state */ |
1671 | | FINISHED_LABEL_SZ = 15, /* TLS finished label size */ |
1672 | | TLS_FINISHED_SZ = 12, /* TLS has a shorter size */ |
1673 | | TLS_FINISHED_SZ_MAX = WC_MAX_DIGEST_SIZE, |
1674 | | /* longest message digest size is SHA512, 64 */ |
1675 | | EXT_MASTER_LABEL_SZ = 22, /* TLS extended master secret label sz */ |
1676 | | MASTER_LABEL_SZ = 13, /* TLS master secret label sz */ |
1677 | | KEY_LABEL_SZ = 13, /* TLS key block expansion sz */ |
1678 | | PROTOCOL_LABEL_SZ = 9, /* Length of the protocol label */ |
1679 | | MAX_LABEL_SZ = 34, /* Maximum length of a label */ |
1680 | | MAX_REQUEST_SZ = 256, /* Maximum cert req len (no auth yet */ |
1681 | | SESSION_FLUSH_COUNT = 256, /* Flush session cache unless user turns off */ |
1682 | | TLS_MAX_PAD_SZ = 255, /* Max padding in TLS */ |
1683 | | MAX_EXT_DATA_LEN = 65535, |
1684 | | /* Max extension data length <0..2^16-1> RFC 8446 |
1685 | | * Section 4.2 */ |
1686 | | MAX_SV_EXT_LEN = 255, |
1687 | | /* Max supported_versions extension length |
1688 | | * <2..254> RFC 8446 Section 4.2.1.*/ |
1689 | | |
1690 | | #if defined(HAVE_NULL_CIPHER) && defined(WOLFSSL_TLS13) |
1691 | | #if defined(WOLFSSL_SHA384) && WC_MAX_SYM_KEY_SIZE < 48 |
1692 | | MAX_SYM_KEY_SIZE = WC_SHA384_DIGEST_SIZE, |
1693 | | #elif !defined(NO_SHA256) && WC_MAX_SYM_KEY_SIZE < 32 |
1694 | | MAX_SYM_KEY_SIZE = WC_SHA256_DIGEST_SIZE, |
1695 | | #else |
1696 | | MAX_SYM_KEY_SIZE = WC_MAX_SYM_KEY_SIZE, |
1697 | | #endif |
1698 | | #else |
1699 | | MAX_SYM_KEY_SIZE = WC_MAX_SYM_KEY_SIZE, |
1700 | | #endif |
1701 | | |
1702 | | #if defined(HAVE_SELFTEST) && \ |
1703 | | (!defined(HAVE_SELFTEST_VERSION) || (HAVE_SELFTEST_VERSION < 2)) |
1704 | | #ifndef WOLFSSL_AES_KEY_SIZE_ENUM |
1705 | | #define WOLFSSL_AES_KEY_SIZE_ENUM |
1706 | | AES_IV_SIZE = 16, |
1707 | | AES_128_KEY_SIZE = 16, |
1708 | | AES_192_KEY_SIZE = 24, |
1709 | | AES_256_KEY_SIZE = 32, |
1710 | | #endif |
1711 | | #endif |
1712 | | |
1713 | | MAX_IV_SZ = WC_AES_BLOCK_SIZE, |
1714 | | |
1715 | | AEAD_SEQ_OFFSET = 4, /* Auth Data: Sequence number */ |
1716 | | AEAD_TYPE_OFFSET = 8, /* Auth Data: Type */ |
1717 | | AEAD_VMAJ_OFFSET = 9, /* Auth Data: Major Version */ |
1718 | | AEAD_VMIN_OFFSET = 10, /* Auth Data: Minor Version */ |
1719 | | AEAD_LEN_OFFSET = 11, /* Auth Data: Length */ |
1720 | | AEAD_AUTH_DATA_SZ = 13, /* Size of the data to authenticate */ |
1721 | | AEAD_NONCE_SZ = 12, |
1722 | | AESGCM_IMP_IV_SZ = 4, /* Size of GCM AEAD implicit IV */ |
1723 | | AESCCM_IMP_IV_SZ = 4, /* Size of CCM AEAD implicit IV */ |
1724 | | AESGCM_EXP_IV_SZ = 8, /* Size of GCM/CCM AEAD explicit IV */ |
1725 | | AESGCM_NONCE_SZ = AESGCM_EXP_IV_SZ + AESGCM_IMP_IV_SZ, |
1726 | | GCM_IMP_IV_SZ = 4, /* Size of GCM AEAD implicit IV */ |
1727 | | CCM_IMP_IV_SZ = 4, /* Size of CCM AEAD implicit IV */ |
1728 | | GCM_EXP_IV_SZ = 8, /* Size of GCM/CCM AEAD explicit IV */ |
1729 | | GCM_NONCE_SZ = GCM_EXP_IV_SZ + GCM_IMP_IV_SZ, |
1730 | | |
1731 | | CHACHA20_IMP_IV_SZ = 12, /* Size of ChaCha20 AEAD implicit IV */ |
1732 | | CHACHA20_NONCE_SZ = 12, /* Size of ChacCha20 nonce */ |
1733 | | CHACHA20_OLD_OFFSET = 4, /* Offset for seq # in old poly1305 */ |
1734 | | CHACHA20_OFFSET = 4, /* Offset for seq # in poly1305 */ |
1735 | | |
1736 | | /* For any new implicit/explicit IV size adjust AEAD_MAX_***_SZ */ |
1737 | | |
1738 | | AES_GCM_AUTH_SZ = 16, /* AES-GCM Auth Tag length */ |
1739 | | AES_CCM_16_AUTH_SZ = 16, /* AES-CCM-16 Auth Tag length */ |
1740 | | AES_CCM_8_AUTH_SZ = 8, /* AES-CCM-8 Auth Tag Length */ |
1741 | | AESCCM_NONCE_SZ = 12, |
1742 | | |
1743 | | SM4_GCM_AUTH_SZ = 16, /* SM4-GCM Auth Tag length */ |
1744 | | SM4_GCM_NONCE_SZ = 12, /* SM4 GCM Nonce length */ |
1745 | | SM4_CCM_AUTH_SZ = 16, /* SM4-CCM Auth Tag length */ |
1746 | | SM4_CCM_NONCE_SZ = 12, /* SM4 CCM Nonce length */ |
1747 | | |
1748 | | CAMELLIA_128_KEY_SIZE = 16, /* for 128 bit */ |
1749 | | CAMELLIA_192_KEY_SIZE = 24, /* for 192 bit */ |
1750 | | CAMELLIA_256_KEY_SIZE = 32, /* for 256 bit */ |
1751 | | CAMELLIA_IV_SIZE = 16, /* always block size */ |
1752 | | |
1753 | | CHACHA20_256_KEY_SIZE = 32, /* for 256 bit */ |
1754 | | CHACHA20_128_KEY_SIZE = 16, /* for 128 bit */ |
1755 | | CHACHA20_IV_SIZE = 12, /* 96 bits for iv */ |
1756 | | |
1757 | | POLY1305_AUTH_SZ = 16, /* 128 bits */ |
1758 | | |
1759 | | HMAC_NONCE_SZ = 12, /* Size of HMAC nonce */ |
1760 | | |
1761 | | EVP_SALT_SIZE = 8, /* evp salt size 64 bits */ |
1762 | | |
1763 | | #ifndef ECDHE_SIZE /* allow this to be overridden at compile-time */ |
1764 | | ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */ |
1765 | | #endif |
1766 | | MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */ |
1767 | | MAX_CURVE_NAME_SZ = 20, /* Maximum size of curve name string */ |
1768 | | |
1769 | | NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */ |
1770 | | RSA_PSS_RSAE_SHA256_MINOR = 0x04, |
1771 | | RSA_PSS_RSAE_SHA384_MINOR = 0x05, |
1772 | | RSA_PSS_RSAE_SHA512_MINOR = 0x06, |
1773 | | RSA_PSS_PSS_SHA256_MINOR = 0x09, |
1774 | | RSA_PSS_PSS_SHA384_MINOR = 0x0A, |
1775 | | RSA_PSS_PSS_SHA512_MINOR = 0x0B, |
1776 | | ECDSA_BRAINPOOLP256R1TLS13_SHA256_MINOR = 0x1A, |
1777 | | ECDSA_BRAINPOOLP384R1TLS13_SHA384_MINOR = 0x1B, |
1778 | | ECDSA_BRAINPOOLP512R1TLS13_SHA512_MINOR = 0x1C, |
1779 | | |
1780 | | ED25519_SA_MAJOR = 8, /* Most significant byte for ED25519 */ |
1781 | | ED25519_SA_MINOR = 7, /* Least significant byte for ED25519 */ |
1782 | | ED448_SA_MAJOR = 8, /* Most significant byte for ED448 */ |
1783 | | ED448_SA_MINOR = 8, /* Least significant byte for ED448 */ |
1784 | | SM2_SA_MAJOR = 7, /* Most significant byte for SM2 with SM3 */ |
1785 | | SM2_SA_MINOR = 8, /* Least significant byte for SM2 with SM3 */ |
1786 | | |
1787 | | FALCON_SA_MAJOR = 0xFE,/* Most significant byte used with falcon sig algs */ |
1788 | | MLDSA_SA_MAJOR = 0x09,/* Most significant byte used with ML-DSA sig algs */ |
1789 | | |
1790 | | /* These values for falcon match what OQS has defined. */ |
1791 | | FALCON_LEVEL1_SA_MAJOR = 0xFE, |
1792 | | FALCON_LEVEL1_SA_MINOR = 0xD7, |
1793 | | FALCON_LEVEL5_SA_MAJOR = 0xFE, |
1794 | | FALCON_LEVEL5_SA_MINOR = 0xDA, |
1795 | | |
1796 | | /* These values for ML-DSA correspond to what is proposed in the IETF. */ |
1797 | | MLDSA_44_SA_MAJOR = 0x09, |
1798 | | MLDSA_44_SA_MINOR = 0x04, |
1799 | | MLDSA_65_SA_MAJOR = 0x09, |
1800 | | MLDSA_65_SA_MINOR = 0x05, |
1801 | | MLDSA_87_SA_MAJOR = 0x09, |
1802 | | MLDSA_87_SA_MINOR = 0x06, |
1803 | | |
1804 | | MIN_RSA_SHA512_PSS_BITS = 512 * 2 + 8 * 8, /* Min key size */ |
1805 | | MIN_RSA_SHA384_PSS_BITS = 384 * 2 + 8 * 8, /* Min key size */ |
1806 | | |
1807 | | CLIENT_HELLO_FIRST = 35, /* Protocol + RAN_LEN + sizeof(id_len) */ |
1808 | | MAX_SUITE_NAME = 48, /* maximum length of cipher suite string */ |
1809 | | |
1810 | | DTLS_TIMEOUT_INIT = 1, /* default timeout init for DTLS receive */ |
1811 | | DTLS_TIMEOUT_MAX = 64, /* default max timeout for DTLS receive */ |
1812 | | DTLS_TIMEOUT_MULTIPLIER = 2, /* default timeout multiplier for DTLS recv */ |
1813 | | |
1814 | | NULL_TERM_LEN = 1, /* length of null '\0' termination character */ |
1815 | | MIN_PSK_ID_LEN = 6, /* min length of identities */ |
1816 | | MIN_PSK_BINDERS_LEN = 33, /* min length of binders */ |
1817 | | |
1818 | | #ifndef MAX_WOLFSSL_FILE_SIZE |
1819 | | MAX_WOLFSSL_FILE_SIZE = 1024UL * 1024UL * 4, /* 4 mb file size alloc limit */ |
1820 | | #endif |
1821 | | #if defined(WOLFSSL_SYS_CRYPTO_POLICY) |
1822 | | MAX_WOLFSSL_CRYPTO_POLICY_SIZE = 1024UL, /* Crypto-policy file is one line. |
1823 | | * It should not be large. */ |
1824 | | MIN_WOLFSSL_SEC_LEVEL = 0, |
1825 | | MAX_WOLFSSL_SEC_LEVEL = 5, |
1826 | | #endif /* WOLFSSL_SYS_CRYPTO_POLICY */ |
1827 | | |
1828 | | CERT_MIN_SIZE = 256, /* min PEM cert size with header/footer */ |
1829 | | |
1830 | | NO_SNIFF = 0, /* not sniffing */ |
1831 | | SNIFF = 1, /* currently sniffing */ |
1832 | | |
1833 | | HASH_SIG_SIZE = 2, /* default SHA1 RSA */ |
1834 | | |
1835 | | NO_COPY = 0, /* should we copy static buffer for write */ |
1836 | | COPY = 1, /* should we copy static buffer for write */ |
1837 | | |
1838 | | INVALID_PEER_ID = 0xFFFF, /* Initialize value for peer ID. */ |
1839 | | |
1840 | | PREV_ORDER = -1, /* Sequence number is in previous epoch. */ |
1841 | | PEER_ORDER = 1, /* Peer sequence number for verify. */ |
1842 | | CUR_ORDER = 0, /* Current sequence number. */ |
1843 | | WRITE_PROTO = 1, /* writing a protocol message */ |
1844 | | READ_PROTO = 0 /* reading a protocol message */ |
1845 | | }; |
1846 | | |
1847 | | |
1848 | | /* Size of the data to authenticate */ |
1849 | | #if defined(WOLFSSL_DTLS) && defined(WOLFSSL_DTLS_CID) |
1850 | | #define AEAD_AUTH_DATA_SZ WOLFSSL_TLS_AEAD_CID_AAD_SZ |
1851 | | #else |
1852 | 0 | #define AEAD_AUTH_DATA_SZ 13 |
1853 | | #endif |
1854 | | |
1855 | | #define WOLFSSL_NAMED_GROUP_IS_FFDHE(group) \ |
1856 | 53.6k | (WOLFSSL_FFDHE_START <= (group) && (group) <= WOLFSSL_FFDHE_END) |
1857 | | #ifdef WOLFSSL_HAVE_MLKEM |
1858 | | WOLFSSL_LOCAL int NamedGroupIsPqc(int group); |
1859 | | WOLFSSL_LOCAL int NamedGroupIsPqcHybrid(int group); |
1860 | 14.4k | #define WOLFSSL_NAMED_GROUP_IS_PQC(group) NamedGroupIsPqc(group) |
1861 | 10.6k | #define WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group) NamedGroupIsPqcHybrid(group) |
1862 | | #else |
1863 | | #define WOLFSSL_NAMED_GROUP_IS_PQC(group) ((void)(group), 0) |
1864 | | #define WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(group) ((void)(group), 0) |
1865 | | #endif /* WOLFSSL_HAVE_MLKEM */ |
1866 | | |
1867 | | /* minimum Downgrade Minor version */ |
1868 | | #ifndef WOLFSSL_MIN_DOWNGRADE |
1869 | | #ifndef NO_OLD_TLS |
1870 | | #define WOLFSSL_MIN_DOWNGRADE TLSv1_MINOR |
1871 | | #else |
1872 | 5.46k | #define WOLFSSL_MIN_DOWNGRADE TLSv1_2_MINOR |
1873 | | #endif |
1874 | | #endif |
1875 | | |
1876 | | /* minimum DTLS Downgrade Minor version */ |
1877 | | #ifndef WOLFSSL_MIN_DTLS_DOWNGRADE |
1878 | | #define WOLFSSL_MIN_DTLS_DOWNGRADE DTLS_MINOR; |
1879 | | #endif |
1880 | | |
1881 | | /* Set max implicit IV size for AEAD cipher suites */ |
1882 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER) && defined(WOLFSSL_SHA384) |
1883 | | /* Integrity-only cipher suites use IV size equal to hash output size */ |
1884 | | #define AEAD_MAX_IMP_SZ 48 |
1885 | | #elif defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER) && !defined(NO_SHA256) |
1886 | | /* Integrity-only cipher suites use IV size equal to hash output size */ |
1887 | | #define AEAD_MAX_IMP_SZ 32 |
1888 | | #else |
1889 | | #define AEAD_MAX_IMP_SZ 12 |
1890 | | #endif |
1891 | | |
1892 | | /* Set max explicit IV size for AEAD cipher suites */ |
1893 | 132 | #define AEAD_MAX_EXP_SZ 8 |
1894 | | |
1895 | | |
1896 | | #ifndef WOLFSSL_MAX_SUITE_SZ |
1897 | 14.0k | #define WOLFSSL_MAX_SUITE_SZ 300 |
1898 | | /* 150 suites for now! */ |
1899 | | #endif |
1900 | | |
1901 | | /* number of items in the signature algo list */ |
1902 | | #ifndef WOLFSSL_MAX_SIGALGO |
1903 | | #if (defined(WOLFSSL_LEANPSK) || defined(WOLFSSL_LEANTLS)) && \ |
1904 | | !defined(HAVE_FALCON) && !defined(WOLFSSL_HAVE_MLDSA) |
1905 | | /* Lean builds keep the list small to minimize the memory footprint, unless |
1906 | | * they are post-quantum builds: those want to inter-op with OQS's OpenSSL |
1907 | | * that sends a lot more sigalgs, so they fall through to the larger default. |
1908 | | */ |
1909 | | #define WOLFSSL_MAX_SIGALGO 44 |
1910 | | #else |
1911 | 3.65k | #define WOLFSSL_MAX_SIGALGO 128 |
1912 | | #endif |
1913 | | #endif |
1914 | | |
1915 | | |
1916 | | /* set minimum ECC key size allowed */ |
1917 | | #ifndef WOLFSSL_MIN_ECC_BITS |
1918 | | #ifdef WOLFSSL_MAX_STRENGTH |
1919 | | #define WOLFSSL_MIN_ECC_BITS 256 |
1920 | | #else |
1921 | 10.9k | #define WOLFSSL_MIN_ECC_BITS 224 |
1922 | | #endif |
1923 | | #endif /* WOLFSSL_MIN_ECC_BITS */ |
1924 | | #if (WOLFSSL_MIN_ECC_BITS % 8) |
1925 | | /* Some ECC keys are not divisible by 8 such as prime239v1 or sect131r1. |
1926 | | In these cases round down to the nearest value divisible by 8. The |
1927 | | restriction of being divisible by 8 is in place to match wc_ecc_size |
1928 | | function from wolfSSL. |
1929 | | */ |
1930 | | #error ECC minimum bit size must be a multiple of 8 |
1931 | | #endif |
1932 | 10.9k | #define MIN_ECCKEY_SZ (WOLFSSL_MIN_ECC_BITS / 8) |
1933 | | |
1934 | | #ifdef HAVE_FALCON |
1935 | | #ifndef MIN_FALCONKEY_SZ |
1936 | | #define MIN_FALCONKEY_SZ 1281 |
1937 | | #endif |
1938 | | #endif |
1939 | | #ifdef WOLFSSL_HAVE_MLDSA |
1940 | | #ifndef MIN_MLDSAKEY_SZ |
1941 | | #define MIN_MLDSAKEY_SZ 2528 |
1942 | | #endif |
1943 | | #endif |
1944 | | |
1945 | | /* set minimum RSA key size allowed */ |
1946 | | #ifndef WOLFSSL_MIN_RSA_BITS |
1947 | | #if defined(WOLFSSL_HARDEN_TLS) && !defined(WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK) |
1948 | | /* Using guidance from section 5.6.1 |
1949 | | * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf */ |
1950 | | #if WOLFSSL_HARDEN_TLS >= 128 |
1951 | | #define WOLFSSL_MIN_RSA_BITS 3072 |
1952 | | #elif WOLFSSL_HARDEN_TLS >= 112 |
1953 | | #define WOLFSSL_MIN_RSA_BITS 2048 |
1954 | | #endif |
1955 | | #elif defined(WOLFSSL_MAX_STRENGTH) |
1956 | | #define WOLFSSL_MIN_RSA_BITS 2048 |
1957 | | #else |
1958 | 10.9k | #define WOLFSSL_MIN_RSA_BITS 1024 |
1959 | | #endif |
1960 | | #endif /* WOLFSSL_MIN_RSA_BITS */ |
1961 | | #if defined(WOLFSSL_HARDEN_TLS) && WOLFSSL_MIN_RSA_BITS < 2048 && \ |
1962 | | !defined(WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK) |
1963 | | /* Implementations MUST NOT negotiate cipher suites offering less than |
1964 | | * 112 bits of security. |
1965 | | * https://www.rfc-editor.org/rfc/rfc9325#section-4.1 |
1966 | | * Using guidance from section 5.6.1 |
1967 | | * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf */ |
1968 | | #error "For 112 bits of security RSA needs at least 2048 bit keys" |
1969 | | #endif |
1970 | | #if (WOLFSSL_MIN_RSA_BITS % 8) |
1971 | | /* This is to account for the example case of a min size of 2050 bits but |
1972 | | still allows 2049 bit key. So we need the measurement to be in bytes. */ |
1973 | | #error RSA minimum bit size must be a multiple of 8 |
1974 | | #endif |
1975 | 10.9k | #define MIN_RSAKEY_SZ (WOLFSSL_MIN_RSA_BITS / 8) |
1976 | | |
1977 | | #ifdef SESSION_INDEX |
1978 | | /* Shift values for making a session index */ |
1979 | | #define SESSIDX_ROW_SHIFT 4 |
1980 | | #define SESSIDX_IDX_MASK 0x0F |
1981 | | #endif |
1982 | | |
1983 | | #ifndef MAX_X509_SIZE |
1984 | | #if defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) |
1985 | | #define MAX_X509_SIZE (8*1024) /* max static x509 buffer size; ML-DSA is big */ |
1986 | | #elif defined(WOLFSSL_HAPROXY) |
1987 | | #define MAX_X509_SIZE 3072 /* max static x509 buffer size */ |
1988 | | #else |
1989 | 64.8k | #define MAX_X509_SIZE 2048 /* max static x509 buffer size */ |
1990 | | #endif |
1991 | | #endif |
1992 | | |
1993 | | /* max cert chain peer depth */ |
1994 | | #ifndef MAX_CHAIN_DEPTH |
1995 | 70.3k | #define MAX_CHAIN_DEPTH 9 |
1996 | | #endif |
1997 | | |
1998 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \ |
1999 | | defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) |
2000 | | #if !defined(HAVE_OCSP) |
2001 | | #error OCSP Stapling and Stapling V2 needs OCSP. Please define HAVE_OCSP. |
2002 | | #endif |
2003 | | #endif |
2004 | | |
2005 | | /* Max certificate extensions in TLS1.3 */ |
2006 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) |
2007 | | /* Number of extensions to set each OCSP response */ |
2008 | | #define MAX_CERT_EXTENSIONS (1 + MAX_CHAIN_DEPTH) |
2009 | | #else |
2010 | | /* Only empty extensions */ |
2011 | 0 | #define MAX_CERT_EXTENSIONS 1 |
2012 | | #endif |
2013 | | |
2014 | | /* max size of a certificate message payload */ |
2015 | | /* assumes MAX_CHAIN_DEPTH number of certificates at 2kb per certificate */ |
2016 | | #ifndef MAX_CERTIFICATE_SZ |
2017 | | #define MAX_CERTIFICATE_SZ \ |
2018 | 64.8k | (CERT_HEADER_SZ + \ |
2019 | 64.8k | (MAX_X509_SIZE + CERT_HEADER_SZ) * MAX_CHAIN_DEPTH) |
2020 | | #endif |
2021 | | |
2022 | | /* max size of a handshake message, currently set to the certificate */ |
2023 | | #ifndef MAX_HANDSHAKE_SZ |
2024 | 64.8k | #define MAX_HANDSHAKE_SZ MAX_CERTIFICATE_SZ |
2025 | | #endif |
2026 | | |
2027 | | #ifndef PREALLOC_SESSION_TICKET_LEN |
2028 | | #define PREALLOC_SESSION_TICKET_LEN 512 |
2029 | | #endif |
2030 | | |
2031 | | #ifndef PREALLOC_SESSION_TICKET_NONCE_LEN |
2032 | | #define PREALLOC_SESSION_TICKET_NONCE_LEN 32 |
2033 | | #endif |
2034 | | |
2035 | | #ifndef SESSION_TICKET_HINT_DEFAULT |
2036 | | #define SESSION_TICKET_HINT_DEFAULT 300 |
2037 | | #endif |
2038 | | |
2039 | | #if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_WOLFSSL_SERVER) |
2040 | | /* Check chosen encryption is available. */ |
2041 | | #if !(defined(HAVE_CHACHA) && defined(HAVE_POLY1305)) && \ |
2042 | | defined(WOLFSSL_TICKET_ENC_CHACHA20_POLY1305) |
2043 | | #error "ChaCha20-Poly1305 not available for default ticket encryption" |
2044 | | #endif |
2045 | | #if !defined(HAVE_AESGCM) && (defined(WOLFSSL_TICKET_ENC_AES128_GCM) || \ |
2046 | | defined(WOLFSSL_TICKET_ENC_AES256_GCM)) |
2047 | | #error "AES-GCM not available for default ticket encryption" |
2048 | | #endif |
2049 | | |
2050 | | #ifndef WOLFSSL_TICKET_KEY_LIFETIME |
2051 | | /* Default lifetime is 1 hour from issue of first ticket with key. */ |
2052 | | #define WOLFSSL_TICKET_KEY_LIFETIME (60 * 60) |
2053 | | #endif |
2054 | | #if WOLFSSL_TICKET_KEY_LIFETIME <= SESSION_TICKET_HINT_DEFAULT |
2055 | | #error "Ticket Key lifetime must be longer than ticket life hint." |
2056 | | #endif |
2057 | | #endif |
2058 | | |
2059 | 0 | #define MAX_ENCRYPT_SZ ENCRYPT_LEN |
2060 | | |
2061 | | #define WOLFSSL_ASSERT_EQ(x, y) wc_static_assert((x) == (y)) |
2062 | | #define WOLFSSL_ASSERT_GE(x, y) wc_static_assert((x) >= (y)) |
2063 | | |
2064 | 0 | #define WOLFSSL_ASSERT_SIZEOF_GE(x, y) wc_static_assert(sizeof(x) >= sizeof(y)) |
2065 | | #define WOLFSSL_ASSERT_SIZEOF_EQ(x, y) wc_static_assert(sizeof(x) == sizeof(y)) |
2066 | | |
2067 | | /* states. Adding state before HANDSHAKE_DONE will break session importing */ |
2068 | | enum states { |
2069 | | NULL_STATE = 0, |
2070 | | |
2071 | | SERVER_HELLOVERIFYREQUEST_COMPLETE, |
2072 | | SERVER_HELLO_RETRY_REQUEST_COMPLETE, |
2073 | | SERVER_HELLO_COMPLETE, |
2074 | | SERVER_ENCRYPTED_EXTENSIONS_COMPLETE, |
2075 | | SERVER_CERT_COMPLETE, |
2076 | | SERVER_CERT_VERIFY_COMPLETE, |
2077 | | SERVER_KEYEXCHANGE_COMPLETE, |
2078 | | SERVER_HELLODONE_COMPLETE, |
2079 | | SERVER_CHANGECIPHERSPEC_COMPLETE, |
2080 | | SERVER_FINISHED_COMPLETE, |
2081 | | |
2082 | | CLIENT_HELLO_RETRY, |
2083 | | CLIENT_HELLO_COMPLETE, |
2084 | | CLIENT_KEYEXCHANGE_COMPLETE, |
2085 | | CLIENT_CHANGECIPHERSPEC_COMPLETE, |
2086 | | CLIENT_FINISHED_COMPLETE, |
2087 | | |
2088 | | HANDSHAKE_DONE, |
2089 | | |
2090 | | #ifdef WOLFSSL_DTLS13 |
2091 | | SERVER_FINISHED_ACKED, |
2092 | | #endif /* WOLFSSL_DTLS13 */ |
2093 | | WOLF_ENUM_DUMMY_LAST_ELEMENT(states) |
2094 | | }; |
2095 | | |
2096 | | /* SSL Version */ |
2097 | | typedef struct ProtocolVersion { |
2098 | | byte major; |
2099 | | byte minor; |
2100 | | } WOLFSSL_PACK ProtocolVersion; |
2101 | | |
2102 | | |
2103 | | WOLFSSL_LOCAL ProtocolVersion MakeSSLv3(void); |
2104 | | WOLFSSL_LOCAL ProtocolVersion MakeTLSv1(void); |
2105 | | WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_1(void); |
2106 | | WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_2(void); |
2107 | | WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_3(void); |
2108 | | |
2109 | | #ifdef WOLFSSL_DTLS |
2110 | | WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1(void); |
2111 | | WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1_2(void); |
2112 | | |
2113 | | #ifdef WOLFSSL_DTLS13 |
2114 | | WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1_3(void); |
2115 | | #endif /* WOLFSSL_DTLS13 */ |
2116 | | |
2117 | | #endif |
2118 | | #ifdef WOLFSSL_SESSION_EXPORT |
2119 | | WOLFSSL_LOCAL int wolfSSL_session_export_internal(WOLFSSL* ssl, byte* buf, |
2120 | | word32* sz, int type); |
2121 | | WOLFSSL_LOCAL int wolfSSL_session_import_internal(WOLFSSL* ssl, const byte* buf, |
2122 | | word32 sz, int type); |
2123 | | #ifdef WOLFSSL_DTLS |
2124 | | WOLFSSL_LOCAL int wolfSSL_dtls_export_state_internal(WOLFSSL* ssl, |
2125 | | byte* buf, word32 sz); |
2126 | | WOLFSSL_LOCAL int wolfSSL_dtls_import_state_internal(WOLFSSL* ssl, |
2127 | | const byte* buf, word32 sz); |
2128 | | WOLFSSL_LOCAL int wolfSSL_send_session(WOLFSSL* ssl); |
2129 | | #endif |
2130 | | #endif |
2131 | | |
2132 | | struct WOLFSSL_BY_DIR_HASH { |
2133 | | unsigned long hash_value; |
2134 | | int last_suffix; |
2135 | | }; |
2136 | | |
2137 | | struct WOLFSSL_BY_DIR_entry { |
2138 | | char* dir_name; |
2139 | | int dir_type; |
2140 | | WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *hashes; |
2141 | | }; |
2142 | | |
2143 | | struct WOLFSSL_BY_DIR { |
2144 | | WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *dir_entry; |
2145 | | wolfSSL_Mutex lock; /* dir list lock */ |
2146 | | }; |
2147 | | |
2148 | | /* wolfSSL method type */ |
2149 | | struct WOLFSSL_METHOD { |
2150 | | ProtocolVersion version; |
2151 | | byte side; /* connection side, server or client */ |
2152 | | byte downgrade; /* whether to downgrade version, default no */ |
2153 | | }; |
2154 | | |
2155 | | /* wolfSSL buffer type - internal uses "buffer" type */ |
2156 | | typedef WOLFSSL_BUFFER_INFO buffer; |
2157 | | |
2158 | | typedef struct Suites Suites; |
2159 | | |
2160 | | /* Declare opaque struct for API to use */ |
2161 | | #ifndef WOLFSSL_CLIENT_SESSION_DEFINED |
2162 | | typedef struct ClientSession ClientSession; |
2163 | | #define WOLFSSL_CLIENT_SESSION_DEFINED |
2164 | | #endif |
2165 | | |
2166 | | /* defaults to client */ |
2167 | | WOLFSSL_LOCAL void InitSSL_Method(WOLFSSL_METHOD* method, ProtocolVersion pv); |
2168 | | |
2169 | | WOLFSSL_LOCAL void InitSSL_CTX_Suites(WOLFSSL_CTX* ctx); |
2170 | | WOLFSSL_LOCAL int InitSSL_Suites(WOLFSSL* ssl); |
2171 | | WOLFSSL_LOCAL int InitSSL_Side(WOLFSSL* ssl, word16 side); |
2172 | | |
2173 | | |
2174 | | WOLFSSL_LOCAL int DoHandShakeMsgType(WOLFSSL* ssl, byte* input, |
2175 | | word32* inOutIdx, byte type, word32 size, word32 totalSz); |
2176 | | /* for sniffer */ |
2177 | | WOLFSSL_LOCAL int DoFinished(WOLFSSL* ssl, const byte* input, word32* inOutIdx, |
2178 | | word32 size, word32 totalSz, int sniff); |
2179 | | #ifdef WOLFSSL_TLS13 |
2180 | | WOLFSSL_LOCAL int DoTls13Finished(WOLFSSL* ssl, const byte* input, word32* inOutIdx, |
2181 | | word32 size, word32 totalSz, int sniff); |
2182 | | #endif |
2183 | | #ifdef WOLFSSL_API_PREFIX_MAP |
2184 | | #define DoApplicationData wolfSSL_DoApplicationData |
2185 | | #endif |
2186 | | WOLFSSL_TEST_VIS int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx, |
2187 | | int sniff); |
2188 | | /* TLS v1.3 needs these */ |
2189 | | WOLFSSL_LOCAL int HandleTlsResumption(WOLFSSL* ssl, Suites* clSuites); |
2190 | | #ifdef WOLFSSL_TLS13 |
2191 | | WOLFSSL_LOCAL byte SuiteMac(const byte* suite); |
2192 | | #endif |
2193 | | WOLFSSL_LOCAL int DoClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx, |
2194 | | word32 helloSz); |
2195 | | #ifdef WOLFSSL_TLS13 |
2196 | | WOLFSSL_LOCAL int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, |
2197 | | word32* inOutIdx, word32 helloSz); |
2198 | | #endif |
2199 | | WOLFSSL_LOCAL int DoServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx, |
2200 | | word32 helloSz); |
2201 | | WOLFSSL_LOCAL int CompleteServerHello(WOLFSSL *ssl); |
2202 | | WOLFSSL_LOCAL int CheckVersion(WOLFSSL *ssl, ProtocolVersion pv); |
2203 | | WOLFSSL_LOCAL int PickHashSigAlgo(WOLFSSL* ssl, const byte* hashSigAlgo, |
2204 | | word32 hashSigAlgoSz, int matchSuites); |
2205 | | #if defined(WOLF_PRIVATE_KEY_ID) && !defined(NO_CHECK_PRIVATE_KEY) |
2206 | | WOLFSSL_LOCAL int CreateDevPrivateKey(void** pkey, byte* data, word32 length, |
2207 | | int hsType, int label, int id, |
2208 | | void* heap, int devId); |
2209 | | #endif |
2210 | | #ifdef WOLFSSL_BLIND_PRIVATE_KEY |
2211 | | WOLFSSL_LOCAL int wolfssl_priv_der_blind(WC_RNG* rng, DerBuffer* key, |
2212 | | DerBuffer** mask); |
2213 | | WOLFSSL_LOCAL void wolfssl_priv_der_blind_toggle(DerBuffer* key, |
2214 | | const DerBuffer* mask); |
2215 | | WOLFSSL_LOCAL WARN_UNUSED_RESULT DerBuffer *wolfssl_priv_der_unblind( |
2216 | | const DerBuffer* key, const DerBuffer* mask); |
2217 | | WOLFSSL_LOCAL void wolfssl_priv_der_unblind_free(DerBuffer* key); |
2218 | | #endif |
2219 | | WOLFSSL_LOCAL int DecodePrivateKey(WOLFSSL *ssl, word32* sigLen); |
2220 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
2221 | | WOLFSSL_LOCAL int DecodeAltPrivateKey(WOLFSSL *ssl, word32* sigLen); |
2222 | | #endif |
2223 | | #if defined(WOLF_PRIVATE_KEY_ID) || defined(HAVE_PK_CALLBACKS) |
2224 | | WOLFSSL_LOCAL int GetPrivateKeySigSize(WOLFSSL* ssl); |
2225 | | #ifndef NO_ASN |
2226 | | WOLFSSL_LOCAL int InitSigPkCb(WOLFSSL* ssl, SignatureCtx* sigCtx); |
2227 | | #endif |
2228 | | #endif |
2229 | | WOLFSSL_LOCAL int CreateSigData(WOLFSSL* ssl, byte* sigData, word16* sigDataSz, |
2230 | | int check); |
2231 | | WOLFSSL_LOCAL int CreateRSAEncodedSig(byte* sig, byte* sigData, int sigDataSz, |
2232 | | int sigAlgo, int hashAlgo); |
2233 | | #ifdef WOLFSSL_ASYNC_IO |
2234 | | WOLFSSL_LOCAL void FreeAsyncCtx(WOLFSSL* ssl, byte freeAsync); |
2235 | | #endif |
2236 | | WOLFSSL_LOCAL void FreeKeyExchange(WOLFSSL* ssl); |
2237 | | WOLFSSL_LOCAL void FreeSuites(WOLFSSL* ssl); |
2238 | | WOLFSSL_LOCAL int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, word32 totalSz); |
2239 | | #ifdef WOLFSSL_API_PREFIX_MAP |
2240 | | #define MatchDomainName wolfSSL_MatchDomainName |
2241 | | #endif |
2242 | | WOLFSSL_TEST_VIS int MatchDomainName(const char* pattern, int len, |
2243 | | const char* str, word32 strLen, |
2244 | | unsigned int flags); |
2245 | | #if !defined(NO_CERTS) && !defined(NO_ASN) |
2246 | | WOLFSSL_LOCAL int CheckForAltNames(DecodedCert* dCert, const char* domain, |
2247 | | word32 domainLen, int* checkCN, |
2248 | | unsigned int flags, byte isIP); |
2249 | | WOLFSSL_LOCAL int CheckIPAddr(DecodedCert* dCert, const char* ipasc); |
2250 | | WOLFSSL_LOCAL void CopyDecodedName(WOLFSSL_X509_NAME* name, DecodedCert* dCert, int nameType); |
2251 | | #endif |
2252 | | WOLFSSL_LOCAL int SetupTicket(WOLFSSL* ssl); |
2253 | | WOLFSSL_LOCAL int CreateTicket(WOLFSSL* ssl); |
2254 | | WOLFSSL_LOCAL int DefTicketHintTooLarge(WOLFSSL* ssl); |
2255 | | WOLFSSL_LOCAL int HashRaw(WOLFSSL* ssl, const byte* data, int sz); |
2256 | | WOLFSSL_LOCAL int HashOutput(WOLFSSL* ssl, const byte* output, int sz, |
2257 | | int ivSz); |
2258 | | WOLFSSL_LOCAL int HashInput(WOLFSSL* ssl, const byte* input, int sz); |
2259 | | |
2260 | | #ifdef HAVE_SNI |
2261 | | #ifndef NO_WOLFSSL_SERVER |
2262 | | WOLFSSL_LOCAL int SNI_Callback(WOLFSSL* ssl); |
2263 | | #endif |
2264 | | #endif |
2265 | | |
2266 | | #ifdef HAVE_ALPN |
2267 | | WOLFSSL_LOCAL int ALPN_Select(WOLFSSL* ssl); |
2268 | | #endif |
2269 | | |
2270 | | WOLFSSL_LOCAL int ChachaAEADEncrypt(WOLFSSL* ssl, byte* out, const byte* input, |
2271 | | word16 sz, byte type); /* needed by sniffer */ |
2272 | | WOLFSSL_LOCAL int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input, |
2273 | | word16 sz); /* needed by sniffer */ |
2274 | | |
2275 | | #ifdef WOLFSSL_TLS13 |
2276 | | WOLFSSL_LOCAL int DecryptTls13(WOLFSSL* ssl, byte* output, const byte* input, |
2277 | | word16 sz, const byte* aad, word16 aadSz); |
2278 | | WOLFSSL_LOCAL int DoTls13HandShakeMsgType(WOLFSSL* ssl, byte* input, |
2279 | | word32* inOutIdx, byte type, |
2280 | | word32 size, word32 totalSz); |
2281 | | WOLFSSL_LOCAL int DoTls13HandShakeMsg(WOLFSSL* ssl, byte* input, |
2282 | | word32* inOutIdx, word32 totalSz); |
2283 | | WOLFSSL_LOCAL int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, |
2284 | | word32* inOutIdx, word32 helloSz, |
2285 | | byte* extMsgType); |
2286 | | WOLFSSL_LOCAL int RestartHandshakeHash(WOLFSSL* ssl); |
2287 | | |
2288 | | WOLFSSL_LOCAL int Tls13DeriveKey(WOLFSSL *ssl, byte *output, int outputLen, |
2289 | | const byte *secret, const byte *label, word32 labelLen, int hashAlgo, |
2290 | | int includeMsgs, int side); |
2291 | | #endif |
2292 | | int TimingPadVerify(WOLFSSL* ssl, const byte* input, int padLen, int macSz, |
2293 | | int pLen, int content); |
2294 | | |
2295 | | |
2296 | | enum { |
2297 | | FORCED_FREE = 1, |
2298 | | NO_FORCED_FREE = 0 |
2299 | | }; |
2300 | | |
2301 | | |
2302 | | /* only use compression extra if using compression */ |
2303 | | #ifdef HAVE_LIBZ |
2304 | | #define COMP_EXTRA MAX_COMP_EXTRA |
2305 | | #else |
2306 | 0 | #define COMP_EXTRA 0 |
2307 | | #endif |
2308 | | |
2309 | | /* only the sniffer needs space in the buffer for extra MTU record(s) */ |
2310 | | #ifdef WOLFSSL_SNIFFER |
2311 | | #define MTU_EXTRA MAX_MTU * 3 |
2312 | | #else |
2313 | | #define MTU_EXTRA 0 |
2314 | | #endif |
2315 | | |
2316 | | |
2317 | | /* embedded callbacks require large static buffers, make sure on */ |
2318 | | #ifdef WOLFSSL_CALLBACKS |
2319 | | #undef LARGE_STATIC_BUFFERS |
2320 | | #define LARGE_STATIC_BUFFERS |
2321 | | #endif |
2322 | | |
2323 | | |
2324 | | /* determine maximum record size */ |
2325 | 0 | #define MAX_RECORD_SIZE 16384 /* 2^14, max size by standard */ |
2326 | | |
2327 | | #ifdef RECORD_SIZE |
2328 | | /* user supplied value */ |
2329 | | #if RECORD_SIZE < 128 || RECORD_SIZE > MAX_RECORD_SIZE |
2330 | | #error Invalid record size |
2331 | | #endif |
2332 | | #else |
2333 | | /* give user option to use 16K static buffers */ |
2334 | | #if defined(LARGE_STATIC_BUFFERS) |
2335 | | #define RECORD_SIZE MAX_RECORD_SIZE |
2336 | | #else |
2337 | | #ifdef WOLFSSL_DTLS |
2338 | | #define RECORD_SIZE MAX_MTU |
2339 | | #else |
2340 | | #define RECORD_SIZE 128 |
2341 | | #endif |
2342 | | #endif |
2343 | | #endif |
2344 | | |
2345 | | |
2346 | | /* user option to turn off 16K output option */ |
2347 | | /* if using small static buffers (default) and SSL_write tries to write data |
2348 | | larger than the record we have, dynamically get it, unless user says only |
2349 | | write in static buffer chunks */ |
2350 | | #ifndef STATIC_CHUNKS_ONLY |
2351 | 0 | #define OUTPUT_RECORD_SIZE MAX_RECORD_SIZE |
2352 | | #else |
2353 | | #define OUTPUT_RECORD_SIZE RECORD_SIZE |
2354 | | #endif |
2355 | | |
2356 | | /* wolfSSL input buffer |
2357 | | |
2358 | | RFC 2246: |
2359 | | |
2360 | | length |
2361 | | The length (in bytes) of the following TLSPlaintext.fragment. |
2362 | | The length should not exceed 2^14. |
2363 | | */ |
2364 | | #ifdef STATIC_BUFFER_LEN |
2365 | | /* user supplied option */ |
2366 | | #if STATIC_BUFFER_LEN < 5 || STATIC_BUFFER_LEN > (RECORD_HEADER_SZ + \ |
2367 | | RECORD_SIZE + COMP_EXTRA + MTU_EXTRA + MAX_MSG_EXTRA)) |
2368 | | #error Invalid static buffer length |
2369 | | #endif |
2370 | | #elif defined(LARGE_STATIC_BUFFERS) |
2371 | | #define STATIC_BUFFER_LEN (RECORD_HEADER_SZ + RECORD_SIZE + COMP_EXTRA + \ |
2372 | | MTU_EXTRA + MAX_MSG_EXTRA) |
2373 | | #else |
2374 | | /* don't fragment memory from the record header */ |
2375 | 602k | #define STATIC_BUFFER_LEN RECORD_HEADER_SZ |
2376 | | #endif |
2377 | | |
2378 | | typedef struct { |
2379 | | ALIGN16 byte staticBuffer[STATIC_BUFFER_LEN]; |
2380 | | byte* buffer; /* place holder for static or dynamic buffer */ |
2381 | | word32 length; /* total buffer length used */ |
2382 | | word32 idx; /* idx to part of length already consumed */ |
2383 | | word32 bufferSize; /* current buffer size */ |
2384 | | byte dynamicFlag; /* dynamic memory currently in use */ |
2385 | | byte offset; /* alignment offset attempt */ |
2386 | | } bufferStatic; |
2387 | | |
2388 | | /* Cipher Suites holder */ |
2389 | | struct Suites { |
2390 | | word16 suiteSz; /* suite length in bytes */ |
2391 | | word16 hashSigAlgoSz; /* SigAlgo extension length in bytes */ |
2392 | | byte suites[WOLFSSL_MAX_SUITE_SZ]; |
2393 | | byte hashSigAlgo[WOLFSSL_MAX_SIGALGO]; /* sig/algo to offer */ |
2394 | | byte setSuites:1; /* user set suites from default */ |
2395 | | }; |
2396 | | |
2397 | | typedef struct CipherSuite { |
2398 | | byte cipherSuite0; |
2399 | | byte cipherSuite; |
2400 | | word32 ecdhCurveOID; |
2401 | | struct KeyShareEntry* clientKSE; |
2402 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) |
2403 | | int doHelloRetry; |
2404 | | #endif |
2405 | | } CipherSuite; |
2406 | | |
2407 | | #ifdef WOLFSSL_API_PREFIX_MAP |
2408 | | #define InitSuitesHashSigAlgo wolfSSL_InitSuitesHashSigAlgo |
2409 | | #endif |
2410 | | WOLFSSL_TEST_VIS void InitSuitesHashSigAlgo(byte* hashSigAlgo, int have, |
2411 | | int tls1_2, int tls1_3, int keySz, |
2412 | | word16* len); |
2413 | | WOLFSSL_LOCAL int AllocateCtxSuites(WOLFSSL_CTX* ctx); |
2414 | | WOLFSSL_LOCAL int AllocateSuites(WOLFSSL* ssl); |
2415 | | WOLFSSL_LOCAL void InitSuites(Suites* suites, ProtocolVersion pv, int keySz, |
2416 | | word16 haveRSA, word16 havePSK, word16 haveDH, |
2417 | | word16 haveECDSAsig, word16 haveECC, |
2418 | | word16 haveStaticRSA, word16 haveStaticECC, |
2419 | | word16 haveAnon, word16 haveNull, |
2420 | | word16 haveAES128, word16 haveSHA1, |
2421 | | word16 haveRC4, int side); |
2422 | | |
2423 | | void refineSuites(const Suites* sslSuites, const Suites* peerSuites, |
2424 | | Suites* outSuites, byte useClientOrder); |
2425 | | void sslRefineSuites(WOLFSSL* ssl, Suites* peerSuites); |
2426 | | |
2427 | | typedef struct TLSX TLSX; |
2428 | | WOLFSSL_LOCAL int MatchSuite_ex(const WOLFSSL* ssl, Suites* peerSuites, |
2429 | | CipherSuite* cs, TLSX* extensions); |
2430 | | WOLFSSL_LOCAL int MatchSuite(WOLFSSL* ssl, Suites* peerSuites); |
2431 | | WOLFSSL_LOCAL int SetCipherList_ex(const WOLFSSL_CTX* ctx, const WOLFSSL* ssl, |
2432 | | Suites* suites, const char* list); |
2433 | | WOLFSSL_LOCAL int SetCipherList(const WOLFSSL_CTX* ctx, Suites* suites, |
2434 | | const char* list); |
2435 | | WOLFSSL_LOCAL int SetCipherListFromBytes(WOLFSSL_CTX* ctx, Suites* suites, |
2436 | | const byte* list, const int listSz); |
2437 | | WOLFSSL_LOCAL int SetSuitesHashSigAlgo(Suites* suites, const char* list); |
2438 | | |
2439 | | #ifndef PSK_TYPES_DEFINED |
2440 | | typedef unsigned int (*wc_psk_client_callback)(WOLFSSL*, const char*, char*, |
2441 | | unsigned int, unsigned char*, unsigned int); |
2442 | | typedef unsigned int (*wc_psk_server_callback)(WOLFSSL*, const char*, |
2443 | | unsigned char*, unsigned int); |
2444 | | #ifdef WOLFSSL_TLS13 |
2445 | | typedef unsigned int (*wc_psk_client_cs_callback)(WOLFSSL*, const char*, |
2446 | | char*, unsigned int, unsigned char*, unsigned int, |
2447 | | const char* cipherName); |
2448 | | typedef unsigned int (*wc_psk_client_tls13_callback)(WOLFSSL*, const char*, |
2449 | | char*, unsigned int, unsigned char*, unsigned int, |
2450 | | const char** cipherName); |
2451 | | typedef unsigned int (*wc_psk_server_tls13_callback)(WOLFSSL*, const char*, |
2452 | | unsigned char*, unsigned int, |
2453 | | const char** cipherName); |
2454 | | #endif |
2455 | | #endif /* PSK_TYPES_DEFINED */ |
2456 | | #if defined(WOLFSSL_DTLS) && defined(WOLFSSL_SESSION_EXPORT) && \ |
2457 | | !defined(WOLFSSL_DTLS_EXPORT_TYPES) |
2458 | | typedef int (*wc_dtls_export)(WOLFSSL* ssl, |
2459 | | |
2460 | | #define WOLFSSL_DTLS_EXPORT_TYPES |
2461 | | #endif /* WOLFSSL_DTLS_EXPORT_TYPES */ |
2462 | | |
2463 | | |
2464 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) |
2465 | | #define MAX_DESCRIPTION_SZ 255 |
2466 | | #endif |
2467 | | struct WOLFSSL_CIPHER { |
2468 | | byte cipherSuite0; |
2469 | | byte cipherSuite; |
2470 | | const WOLFSSL* ssl; |
2471 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) |
2472 | | char description[MAX_DESCRIPTION_SZ]; |
2473 | | unsigned long offset; |
2474 | | unsigned int in_stack; /* TRUE if added to stack in wolfSSL_get_ciphers_compat */ |
2475 | | int bits; |
2476 | | #endif |
2477 | | }; |
2478 | | |
2479 | | |
2480 | | #ifdef NO_ASN |
2481 | | /* no_asn won't have */ |
2482 | | typedef struct CertStatus CertStatus; |
2483 | | #endif |
2484 | | |
2485 | | #ifndef HAVE_OCSP |
2486 | | typedef struct WOLFSSL_OCSP WOLFSSL_OCSP; |
2487 | | #endif |
2488 | | |
2489 | | /* wolfSSL OCSP controller */ |
2490 | | #ifdef HAVE_OCSP |
2491 | | struct WOLFSSL_OCSP { |
2492 | | WOLFSSL_CERT_MANAGER* cm; /* pointer back to cert manager */ |
2493 | | OcspEntry* ocspList; /* OCSP response list */ |
2494 | | wolfSSL_Mutex ocspLock; /* OCSP list lock */ |
2495 | | int error; |
2496 | | int(*statusCb)(WOLFSSL*, void*); |
2497 | | void* statusCbArg; |
2498 | | }; |
2499 | | #endif |
2500 | | |
2501 | | typedef struct CRL_Entry CRL_Entry; |
2502 | | |
2503 | | #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3) |
2504 | | #define CRL_DIGEST_SIZE WC_SM3_DIGEST_SIZE |
2505 | | #elif defined(NO_SHA) |
2506 | | #define CRL_DIGEST_SIZE WC_SHA256_DIGEST_SIZE |
2507 | | #else |
2508 | | #define CRL_DIGEST_SIZE WC_SHA_DIGEST_SIZE |
2509 | | #endif |
2510 | | |
2511 | | #ifdef NO_ASN |
2512 | | typedef struct RevokedCert RevokedCert; |
2513 | | #endif |
2514 | | #ifdef CRL_STATIC_REVOKED_LIST |
2515 | | #ifndef CRL_MAX_REVOKED_CERTS |
2516 | | #define CRL_MAX_REVOKED_CERTS 4 |
2517 | | #elif CRL_MAX_REVOKED_CERTS > 22000 |
2518 | | #error CRL_MAX_REVOKED_CERTS too big, max is 22000 |
2519 | | #endif |
2520 | | #endif |
2521 | | |
2522 | | #ifdef HAVE_CRL |
2523 | | /* Complete CRL */ |
2524 | | struct CRL_Entry { |
2525 | | byte* toBeSigned; |
2526 | | byte* signature; |
2527 | | #ifdef WC_RSA_PSS |
2528 | | byte* sigParams; /* buffer with signature parameters */ |
2529 | | #endif |
2530 | | #if defined(OPENSSL_EXTRA) |
2531 | | WOLFSSL_X509_NAME* issuer; /* X509_NAME type issuer */ |
2532 | | #endif |
2533 | | CRL_Entry* next; /* next entry */ |
2534 | | wolfSSL_Mutex verifyMutex; |
2535 | | /* DupCRL_Entry copies data after the `verifyMutex` member. Using the mutex |
2536 | | * as the marker because clang-tidy doesn't like taking the sizeof a |
2537 | | * pointer. */ |
2538 | | char crlNumber[CRL_MAX_NUM_HEX_STR_SZ]; /* CRL number extension */ |
2539 | | byte issuerHash[CRL_DIGEST_SIZE]; /* issuer hash */ |
2540 | | /* byte crlHash[CRL_DIGEST_SIZE]; raw crl data hash */ |
2541 | | /* restore the hash here if needed for optimized comparisons */ |
2542 | | byte lastDate[MAX_DATE_SIZE]; /* last date updated */ |
2543 | | byte nextDate[MAX_DATE_SIZE]; /* next update date */ |
2544 | | byte lastDateFormat; /* last date format */ |
2545 | | byte nextDateFormat; /* next date format */ |
2546 | | #if defined(OPENSSL_EXTRA) |
2547 | | WOLFSSL_ASN1_TIME lastDateAsn1; /* last date updated */ |
2548 | | WOLFSSL_ASN1_TIME nextDateAsn1; /* next update date */ |
2549 | | #endif |
2550 | | #ifdef CRL_STATIC_REVOKED_LIST |
2551 | | RevokedCert certs[CRL_MAX_REVOKED_CERTS]; |
2552 | | #else |
2553 | | RevokedCert* certs; /* revoked cert list */ |
2554 | | #endif |
2555 | | int totalCerts; /* number on list */ |
2556 | | int version; /* version of certificate */ |
2557 | | int verified; |
2558 | | word32 tbsSz; |
2559 | | word32 signatureSz; |
2560 | | #ifdef WC_RSA_PSS |
2561 | | word32 sigParamsSz; /* length of signature parameters */ |
2562 | | #endif |
2563 | | word32 signatureOID; |
2564 | | #if !defined(NO_SKID) && !defined(NO_ASN) |
2565 | | byte extAuthKeyId[KEYID_SIZE]; |
2566 | | byte extAuthKeyIdSet:1; /* Auth key identifier set indicator */ |
2567 | | #endif |
2568 | | byte crlNumberSet:1; /* CRL number set indicator */ |
2569 | | }; |
2570 | | |
2571 | | |
2572 | | #ifdef HAVE_CRL_MONITOR |
2573 | | typedef struct CRL_Monitor CRL_Monitor; |
2574 | | |
2575 | | /* CRL directory monitor */ |
2576 | | struct CRL_Monitor { |
2577 | | char* path; /* full dir path, if valid pointer we're using */ |
2578 | | int type; /* PEM or ASN1 type */ |
2579 | | }; |
2580 | | |
2581 | | |
2582 | | #if defined(HAVE_CRL) && defined(NO_FILESYSTEM) |
2583 | | #undef HAVE_CRL_MONITOR |
2584 | | #endif |
2585 | | |
2586 | | /* PEM and DER possible */ |
2587 | | #define WOLFSSL_CRL_MONITORS_LEN (2) |
2588 | | |
2589 | | #if defined(__MACH__) || defined(__FreeBSD__) || defined(__linux__) |
2590 | | typedef int wolfSSL_CRL_mfd_t; /* monitor fd, -1 if no init yet */ |
2591 | | /* mfd for bsd is kqueue fd, eventfd for linux */ |
2592 | | #define WOLFSSL_CRL_MFD_INIT_VAL (-1) |
2593 | | #elif defined(_MSC_VER) |
2594 | | typedef HANDLE wolfSSL_CRL_mfd_t; /* monitor fd, INVALID_HANDLE_VALUE if |
2595 | | * no init yet */ |
2596 | | #define WOLFSSL_CRL_MFD_INIT_VAL (INVALID_HANDLE_VALUE) |
2597 | | #endif |
2598 | | #endif |
2599 | | |
2600 | | /* wolfSSL CRL controller */ |
2601 | | struct WOLFSSL_CRL { |
2602 | | WOLFSSL_CERT_MANAGER* cm; /* pointer back to cert manager */ |
2603 | | CRL_Entry* crlList; /* our CRL list */ |
2604 | | #ifdef HAVE_CRL_IO |
2605 | | CbCrlIO crlIOCb; |
2606 | | #endif |
2607 | | wolfSSL_RwLock crlLock; /* CRL list lock */ |
2608 | | #ifdef HAVE_CRL_MONITOR |
2609 | | CRL_Monitor monitors[WOLFSSL_CRL_MONITORS_LEN]; |
2610 | | COND_TYPE cond; /* condition to signal setup */ |
2611 | | THREAD_TYPE tid; /* monitoring thread */ |
2612 | | wolfSSL_CRL_mfd_t mfd; |
2613 | | int setup; /* thread is setup predicate */ |
2614 | | #endif |
2615 | | #ifdef OPENSSL_ALL |
2616 | | wolfSSL_Ref ref; |
2617 | | #endif |
2618 | | #if defined(OPENSSL_EXTRA) |
2619 | | WOLFSSL_STACK* revokedStack; /* cached STACK_OF(X509_REVOKED) */ |
2620 | | #endif |
2621 | | void* heap; /* heap hint for dynamic memory */ |
2622 | | }; |
2623 | | #endif |
2624 | | |
2625 | | |
2626 | | #ifdef NO_ASN |
2627 | | typedef struct Signer Signer; |
2628 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
2629 | | typedef struct TrustedPeerCert TrustedPeerCert; |
2630 | | #endif |
2631 | | #endif |
2632 | | |
2633 | | |
2634 | | #ifndef CA_TABLE_SIZE |
2635 | 132k | #define CA_TABLE_SIZE 11 |
2636 | | #endif |
2637 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
2638 | | #define TP_TABLE_SIZE 11 |
2639 | | #endif |
2640 | | |
2641 | | /* wolfSSL Certificate Manager */ |
2642 | | struct WOLFSSL_CERT_MANAGER { |
2643 | | Signer* caTable[CA_TABLE_SIZE]; /* the CA signer table */ |
2644 | | void* heap; /* heap helper */ |
2645 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
2646 | | TrustedPeerCert* tpTable[TP_TABLE_SIZE]; /* table of trusted peer certs */ |
2647 | | wolfSSL_Mutex tpLock; /* trusted peer list lock */ |
2648 | | #endif |
2649 | | WOLFSSL_CRL* crl; /* CRL checker */ |
2650 | | WOLFSSL_OCSP* ocsp; /* OCSP checker */ |
2651 | | #if !defined(NO_WOLFSSL_SERVER) && (defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ |
2652 | | || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)) |
2653 | | WOLFSSL_OCSP* ocsp_stapling; /* OCSP checker for OCSP stapling */ |
2654 | | #endif |
2655 | | char* ocspOverrideURL; /* use this responder */ |
2656 | | void* ocspIOCtx; /* I/O callback CTX */ |
2657 | | #ifndef NO_WOLFSSL_CM_VERIFY |
2658 | | VerifyCallback verifyCallback; /* Verify callback */ |
2659 | | #endif |
2660 | | CallbackCACache caCacheCallback; /* CA cache addition callback */ |
2661 | | CbMissingCRL cbMissingCRL; /* notify thru cb of missing crl */ |
2662 | | crlErrorCb crlCb; /* Allow user to override error */ |
2663 | | void* crlCbCtx; |
2664 | | CbOCSPIO ocspIOCb; /* I/O callback for OCSP lookup */ |
2665 | | CbOCSPRespFree ocspRespFreeCb; /* Frees OCSP Response from IO Cb */ |
2666 | | wolfSSL_Mutex caLock; /* CA list lock */ |
2667 | | byte crlEnabled:1; /* is CRL on ? */ |
2668 | | byte crlCheckAll:1; /* always leaf, but all ? */ |
2669 | | byte ocspEnabled:1; /* is OCSP on ? */ |
2670 | | byte ocspCheckAll:1; /* always leaf, but all ? */ |
2671 | | byte ocspFailIfNotSupported:1; /* refuse a cert that advertises |
2672 | | * no OCSP responder ? */ |
2673 | | byte ocspSendNonce:1; /* send the OCSP nonce ? */ |
2674 | | byte ocspUseOverrideURL:1; /* ignore cert responder, override */ |
2675 | | byte ocspStaplingEnabled:1; /* is OCSP Stapling on ? */ |
2676 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ |
2677 | | || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) |
2678 | | byte ocspMustStaple:1; /* server must respond with staple */ |
2679 | | #endif |
2680 | | /* Tracks which resources were successfully initialized so that |
2681 | | * DoCertManagerFree can dispose of them safely even when construction |
2682 | | * fails partway through. */ |
2683 | | WC_BITFIELD caLockInit:1; /* caLock has been initialized */ |
2684 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
2685 | | WC_BITFIELD tpLockInit:1; /* tpLock has been initialized */ |
2686 | | #endif |
2687 | | WC_BITFIELD refInit:1; /* ref has been initialized */ |
2688 | | |
2689 | | #ifndef NO_RSA |
2690 | | short minRsaKeySz; /* minimum allowed RSA key size */ |
2691 | | #endif |
2692 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) |
2693 | | short minEccKeySz; /* minimum allowed ECC key size */ |
2694 | | #endif |
2695 | | #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL) |
2696 | | WOLFSSL_X509_STORE *x509_store_p; /* a pointer back to CTX x509 store */ |
2697 | | /* CTX has ownership and free this */ |
2698 | | /* with CTX free. */ |
2699 | | #endif |
2700 | | wolfSSL_Ref ref; |
2701 | | #ifdef HAVE_FALCON |
2702 | | short minFalconKeySz; /* minimum allowed Falcon key size */ |
2703 | | #endif |
2704 | | #ifdef WOLFSSL_HAVE_MLDSA |
2705 | | short minMlDsaKeySz; /* minimum allowed ML-DSA key size */ |
2706 | | #endif |
2707 | | #ifdef WC_ASN_UNKNOWN_EXT_CB |
2708 | | wc_UnknownExtCallback unknownExtCallback; |
2709 | | #endif |
2710 | | #ifdef HAVE_CRL_UPDATE_CB |
2711 | | CbUpdateCRL cbUpdateCRL; /* notify thru cb that crl has updated */ |
2712 | | #endif |
2713 | | }; |
2714 | | |
2715 | | WOLFSSL_LOCAL int CM_SaveCertCache(WOLFSSL_CERT_MANAGER* cm, |
2716 | | const char* fname); |
2717 | | WOLFSSL_LOCAL int CM_RestoreCertCache(WOLFSSL_CERT_MANAGER* cm, |
2718 | | const char* fname); |
2719 | | WOLFSSL_LOCAL int CM_MemSaveCertCache(WOLFSSL_CERT_MANAGER* cm, void* mem, |
2720 | | int sz, int* used); |
2721 | | WOLFSSL_LOCAL int CM_MemRestoreCertCache(WOLFSSL_CERT_MANAGER* cm, |
2722 | | const void* mem, int sz); |
2723 | | WOLFSSL_LOCAL int CM_GetCertCacheMemSize(WOLFSSL_CERT_MANAGER* cm); |
2724 | | WOLFSSL_LOCAL int CM_VerifyBuffer_ex(WOLFSSL_CERT_MANAGER* cm, const byte* buff, |
2725 | | long sz, int format, int prev_err); |
2726 | | |
2727 | | |
2728 | | #ifndef NO_CERTS |
2729 | | #if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH) |
2730 | | typedef struct ProcPeerCertArgs { |
2731 | | buffer* certs; |
2732 | | #ifdef WOLFSSL_TLS13 |
2733 | | buffer* exts; /* extensions */ |
2734 | | #endif |
2735 | | #ifndef NO_ASN |
2736 | | DecodedCert* dCert; |
2737 | | #endif |
2738 | | word32 idx; |
2739 | | word32 begin; |
2740 | | int totalCerts; /* number of certs in certs buffer */ |
2741 | | int count; |
2742 | | int certIdx; |
2743 | | int lastErr; |
2744 | | int leafVerifyErr; |
2745 | | #ifdef WOLFSSL_TLS13 |
2746 | | byte ctxSz; |
2747 | | #endif |
2748 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
2749 | | char untrustedDepth; |
2750 | | #endif |
2751 | | word16 fatal:1; |
2752 | | word16 verifyErr:1; |
2753 | | word16 dCertInit:1; |
2754 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
2755 | | word16 haveTrustPeer:1; /* was cert verified by loaded trusted peer cert */ |
2756 | | #endif |
2757 | | } ProcPeerCertArgs; |
2758 | | WOLFSSL_LOCAL int DoVerifyCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, |
2759 | | int cert_err, ProcPeerCertArgs* args); |
2760 | | WOLFSSL_LOCAL void DoCrlCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, |
2761 | | ProcPeerCertArgs* args, int* outRet); |
2762 | | |
2763 | | WOLFSSL_LOCAL int SetupStoreCtxCallback(WOLFSSL_X509_STORE_CTX** store_pt, |
2764 | | WOLFSSL* ssl, WOLFSSL_CERT_MANAGER* cm, ProcPeerCertArgs* args, |
2765 | | int cert_err, void* heap, int* x509Free); |
2766 | | WOLFSSL_LOCAL void CleanupStoreCtxCallback(WOLFSSL_X509_STORE_CTX* store, |
2767 | | WOLFSSL* ssl, void* heap, int x509Free); |
2768 | | #endif /* !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH) */ |
2769 | | WOLFSSL_LOCAL int X509StoreLoadCertBuffer(WOLFSSL_X509_STORE *str, |
2770 | | byte *buf, word32 bufLen, int type); |
2771 | | WOLFSSL_LOCAL int X509StorePushCertsToCM(WOLFSSL_X509_STORE* store); |
2772 | | #endif /* !defined NO_CERTS */ |
2773 | | |
2774 | | /* wolfSSL Sock Addr */ |
2775 | | struct WOLFSSL_SOCKADDR { |
2776 | | unsigned int sz; /* sockaddr size */ |
2777 | | unsigned int bufSz; /* size of allocated buffer */ |
2778 | | void* sa; /* pointer to the sockaddr_in or sockaddr_in6 */ |
2779 | | }; |
2780 | | |
2781 | | #ifdef WOLFSSL_DTLS |
2782 | | typedef struct WOLFSSL_DTLS_CTX { |
2783 | | #ifdef WOLFSSL_RW_THREADED |
2784 | | /* Protect peer access after the handshake */ |
2785 | | wolfSSL_RwLock peerLock; |
2786 | | #endif |
2787 | | WOLFSSL_SOCKADDR peer; |
2788 | | #ifdef WOLFSSL_DTLS_CID |
2789 | | WOLFSSL_SOCKADDR pendingPeer; /* When using CID's, we don't want to update |
2790 | | * the peer's address until we successfully |
2791 | | * de-protect the record. */ |
2792 | | #endif |
2793 | | int rfd; |
2794 | | int wfd; |
2795 | | WolfSSLRecvFrom recvfrom; |
2796 | | WolfSSLSento sendto; |
2797 | | byte userSet:1; |
2798 | | byte connected:1; /* When set indicates rfd and wfd sockets are |
2799 | | * connected (connect() and bind() both called). |
2800 | | * This means that sendto and recvfrom do not need to |
2801 | | * specify and store the peer address. */ |
2802 | | byte rfdIsDGram:1; /* whether rfd is a SOCK_DGRAM socket; probed with |
2803 | | * getsockopt(SO_TYPE) where rfd is assigned to keep |
2804 | | * the syscall out of the I/O callbacks. */ |
2805 | | byte wfdIsDGram:1; /* as rfdIsDGram, for wfd; rfd and wfd may be |
2806 | | * different sockets of different types. */ |
2807 | | #ifdef WOLFSSL_DTLS_CID |
2808 | | byte processingPendingRecord:1; |
2809 | | #endif |
2810 | | } WOLFSSL_DTLS_CTX; |
2811 | | #endif |
2812 | | |
2813 | | |
2814 | | typedef struct WOLFSSL_DTLS_PEERSEQ { |
2815 | | word32 window[WOLFSSL_DTLS_WINDOW_WORDS]; |
2816 | | /* Sliding window for current epoch */ |
2817 | | word16 nextEpoch; /* Expected epoch in next record */ |
2818 | | word16 nextSeq_hi; /* Expected sequence in next record */ |
2819 | | word32 nextSeq_lo; |
2820 | | |
2821 | | word32 prevWindow[WOLFSSL_DTLS_WINDOW_WORDS]; |
2822 | | /* Sliding window for old epoch */ |
2823 | | word32 prevSeq_lo; |
2824 | | word16 prevSeq_hi; /* Next sequence in allowed old epoch */ |
2825 | | |
2826 | | #ifdef WOLFSSL_MULTICAST |
2827 | | word16 peerId; |
2828 | | word32 highwaterMark; |
2829 | | #endif |
2830 | | } WOLFSSL_DTLS_PEERSEQ; |
2831 | | |
2832 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
2833 | | struct WOLFSSL_BIO { |
2834 | | WOLFSSL_BUF_MEM* mem_buf; |
2835 | | WOLFSSL_BIO_METHOD* method; |
2836 | | WOLFSSL_BIO* prev; /* previous in chain */ |
2837 | | WOLFSSL_BIO* next; /* next in chain */ |
2838 | | WOLFSSL_BIO* pair; /* BIO paired with */ |
2839 | | void* heap; /* user heap hint */ |
2840 | | union { |
2841 | | byte* mem_buf_data; |
2842 | | #ifndef WOLFCRYPT_ONLY |
2843 | | WOLFSSL* ssl; |
2844 | | WOLFSSL_EVP_MD_CTX* md_ctx; |
2845 | | #endif |
2846 | | #ifndef NO_FILESYSTEM |
2847 | | XFILE fh; |
2848 | | #endif |
2849 | | } ptr; |
2850 | | void* usrCtx; /* user set pointer */ |
2851 | | char* ip; /* IP address for wolfIO_TcpConnect */ |
2852 | | word16 port; /* Port for wolfIO_TcpConnect */ |
2853 | | char* infoArg; /* BIO callback argument */ |
2854 | | wolf_bio_info_cb infoCb; /* BIO callback */ |
2855 | | int wrSz; /* write buffer size (mem) */ |
2856 | | int wrSzReset; /* First buffer size (mem) - read ONLY data */ |
2857 | | int wrIdx; /* current index for write buffer */ |
2858 | | int rdIdx; /* current read index */ |
2859 | | int readRq; /* read request */ |
2860 | | union { |
2861 | | SOCKET_T fd; |
2862 | | size_t length; |
2863 | | } num; |
2864 | | int eof; /* eof flag */ |
2865 | | int flags; |
2866 | | int type; /* method type */ |
2867 | | byte init:1; /* bio has been initialized */ |
2868 | | byte shutdown:1; /* close flag */ |
2869 | | byte connected:1; /* connected state, for datagram BIOs -- as for |
2870 | | * struct WOLFSSL_DTLS_CTX, when set, sendto and |
2871 | | * recvfrom leave the peer_addr unchanged. */ |
2872 | | #ifdef WOLFSSL_HAVE_BIO_ADDR |
2873 | | union WOLFSSL_BIO_ADDR peer_addr; /* for datagram BIOs, the socket address stored |
2874 | | * with BIO_CTRL_DGRAM_CONNECT, |
2875 | | * BIO_CTRL_DGRAM_SET_CONNECTED, or |
2876 | | * BIO_CTRL_DGRAM_SET_PEER, or stored when a |
2877 | | * packet was received on an unconnected BIO. */ |
2878 | | #endif |
2879 | | |
2880 | | #if defined(WORD64_AVAILABLE) && !defined(WOLFSSL_BIO_NO_FLOW_STATS) |
2881 | | #define WOLFSSL_BIO_HAVE_FLOW_STATS |
2882 | | word64 bytes_read; |
2883 | | word64 bytes_written; |
2884 | | #endif |
2885 | | |
2886 | | #ifdef HAVE_EX_DATA |
2887 | | WOLFSSL_CRYPTO_EX_DATA ex_data; |
2888 | | #endif |
2889 | | #if defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA) |
2890 | | wolfSSL_Ref ref; |
2891 | | #endif |
2892 | | }; |
2893 | | #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */ |
2894 | | |
2895 | | #if defined(WOLFSSL_HAVE_BIO_ADDR) && defined(OPENSSL_EXTRA) |
2896 | | WOLFSSL_LOCAL socklen_t wolfSSL_BIO_ADDR_size(const WOLFSSL_BIO_ADDR *addr); |
2897 | | #endif |
2898 | | |
2899 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER) && defined(WOLFSSL_SHA384) |
2900 | | /* Integrity-only cipher suites use IV size equal to hash output size */ |
2901 | | #define MAX_WRITE_IV_SZ 48 |
2902 | | #elif defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER) && !defined(NO_SHA256) |
2903 | | /* Integrity-only cipher suites use IV size equal to hash output size */ |
2904 | | #define MAX_WRITE_IV_SZ 32 |
2905 | | #else |
2906 | | #define MAX_WRITE_IV_SZ 16 /* max size of client/server write_IV */ |
2907 | | #endif |
2908 | | |
2909 | | /* keys and secrets |
2910 | | * keep as a constant size (no additional ifdefs) for session export */ |
2911 | | typedef struct Keys { |
2912 | | #if !defined(WOLFSSL_AEAD_ONLY) || defined(WOLFSSL_TLS13) |
2913 | | byte client_write_MAC_secret[WC_MAX_DIGEST_SIZE]; /* max sizes */ |
2914 | | byte server_write_MAC_secret[WC_MAX_DIGEST_SIZE]; |
2915 | | #endif |
2916 | | byte client_write_key[MAX_SYM_KEY_SIZE]; /* max sizes */ |
2917 | | byte server_write_key[MAX_SYM_KEY_SIZE]; |
2918 | | byte client_write_IV[MAX_WRITE_IV_SZ]; /* max sizes */ |
2919 | | byte server_write_IV[MAX_WRITE_IV_SZ]; |
2920 | | #if defined(HAVE_AEAD) || defined(WOLFSSL_SESSION_EXPORT) |
2921 | | byte aead_exp_IV[AEAD_MAX_EXP_SZ]; |
2922 | | byte aead_enc_imp_IV[AEAD_MAX_IMP_SZ]; |
2923 | | byte aead_dec_imp_IV[AEAD_MAX_IMP_SZ]; |
2924 | | #endif |
2925 | | |
2926 | | #ifdef WOLFSSL_DTLS13 |
2927 | | byte client_sn_key[MAX_SYM_KEY_SIZE]; |
2928 | | byte server_sn_key[MAX_SYM_KEY_SIZE]; |
2929 | | #endif /* WOLFSSL_DTLS13 */ |
2930 | | |
2931 | | word32 peer_sequence_number_hi; |
2932 | | word32 peer_sequence_number_lo; |
2933 | | word32 sequence_number_hi; |
2934 | | word32 sequence_number_lo; |
2935 | | |
2936 | | #ifdef WOLFSSL_DTLS |
2937 | | word16 curEpoch; /* Received epoch in current record */ |
2938 | | word16 curSeq_hi; /* Received sequence in current record */ |
2939 | | word32 curSeq_lo; |
2940 | | |
2941 | | #ifdef WOLFSSL_DTLS13 |
2942 | | w64wrapper curEpoch64; /* Received epoch in current record */ |
2943 | | w64wrapper curSeq; |
2944 | | #endif /* WOLFSSL_DTLS13 */ |
2945 | | |
2946 | | #ifdef WOLFSSL_MULTICAST |
2947 | | byte curPeerId; /* Received peer group ID in current record */ |
2948 | | #endif |
2949 | | WOLFSSL_DTLS_PEERSEQ peerSeq[WOLFSSL_DTLS_PEERSEQ_SZ]; |
2950 | | |
2951 | | word16 dtls_peer_handshake_number; |
2952 | | word16 dtls_expected_peer_handshake_number; |
2953 | | |
2954 | | word16 dtls_epoch; /* Current epoch */ |
2955 | | word16 dtls_sequence_number_hi; /* Current epoch */ |
2956 | | word32 dtls_sequence_number_lo; |
2957 | | word16 dtls_prev_sequence_number_hi; /* Previous epoch */ |
2958 | | word32 dtls_prev_sequence_number_lo; |
2959 | | word16 dtls_handshake_number; /* Current tx handshake seq */ |
2960 | | #endif |
2961 | | |
2962 | | word32 encryptSz; /* last size of encrypted data */ |
2963 | | word32 padSz; /* how much to advance after decrypt part */ |
2964 | | byte encryptionOn; /* true after change cipher spec */ |
2965 | | byte decryptedCur; /* only decrypt current record once */ |
2966 | | #ifdef WOLFSSL_TLS13 |
2967 | | byte updateResponseReq; /* KeyUpdate response from peer required. */ |
2968 | | byte keyUpdateRespond; /* KeyUpdate is to be responded to. */ |
2969 | | w64wrapper keyUpdateCount; /* Sending key updates performed (RFC 9846). */ |
2970 | | #endif |
2971 | | #ifdef WOLFSSL_RENESAS_TSIP_TLS |
2972 | | |
2973 | | tsip_hmac_sha_key_index_t tsip_client_write_MAC_secret; |
2974 | | tsip_hmac_sha_key_index_t tsip_server_write_MAC_secret; |
2975 | | |
2976 | | #endif |
2977 | | #ifdef WOLFSSL_RENESAS_FSPSM_TLS |
2978 | | FSPSM_HMAC_WKEY fspsm_client_write_MAC_secret; |
2979 | | FSPSM_HMAC_WKEY fspsm_server_write_MAC_secret; |
2980 | | #endif |
2981 | | } Keys; |
2982 | | |
2983 | | /* RFC 9846 Section 4.7.3: a TLS 1.3 sender MUST NOT allow its number of key |
2984 | | * updates to exceed 2^48-1. Receivers MUST NOT enforce this. Expressed as the |
2985 | | * high and low 32-bit halves of a w64wrapper. */ |
2986 | 0 | #define TLS13_KEY_UPDATE_MAX_HI32 0x0000FFFFU |
2987 | 0 | #define TLS13_KEY_UPDATE_MAX_LO32 0xFFFFFFFFU |
2988 | | |
2989 | | /* Forward declare opaque pointer to make available for func def */ |
2990 | | typedef struct Options Options; |
2991 | | |
2992 | | |
2993 | | /** TLS Extensions - RFC 6066 */ |
2994 | | #ifdef HAVE_TLS_EXTENSIONS |
2995 | | |
2996 | 985 | #define TLSXT_SERVER_NAME 0x0000 /* a.k.a. SNI */ |
2997 | 268 | #define TLSXT_MAX_FRAGMENT_LENGTH 0x0001 |
2998 | 237 | #define TLSXT_TRUSTED_CA_KEYS 0x0003 |
2999 | 561 | #define TLSXT_TRUNCATED_HMAC 0x0004 |
3000 | 3.08k | #define TLSXT_STATUS_REQUEST 0x0005 /* a.k.a. OCSP stapling */ |
3001 | 8.94k | #define TLSXT_SUPPORTED_GROUPS 0x000a /* a.k.a. Supported Curves */ |
3002 | 1.39k | #define TLSXT_EC_POINT_FORMATS 0x000b |
3003 | 6.03k | #define TLSXT_SIGNATURE_ALGORITHMS 0x000d /* HELLO_EXT_SIG_ALGO */ |
3004 | 231 | #define TLSXT_USE_SRTP 0x000e /* 14 */ |
3005 | 314 | #define TLSXT_APPLICATION_LAYER_PROTOCOL 0x0010 /* a.k.a. ALPN */ |
3006 | 234 | #define TLSXT_STATUS_REQUEST_V2 0x0011 /* a.k.a. OCSP stapling v2 */ |
3007 | 96 | #define TLSXT_CLIENT_CERTIFICATE 0x0013 /* RFC8446 */ |
3008 | 58 | #define TLSXT_SERVER_CERTIFICATE 0x0014 /* RFC8446 */ |
3009 | 2.06k | #define TLSXT_ENCRYPT_THEN_MAC 0x0016 /* RFC 7366 */ |
3010 | | #define TLSXT_EXTENDED_MASTER_SECRET 0x0017 /* HELLO_EXT_EXTMS */ |
3011 | 61 | #define TLSXT_CERT_WITH_EXTERN_PSK 0x0021 /* RFC 9973 */ |
3012 | 1.09k | #define TLSXT_SESSION_TICKET 0x0023 |
3013 | 1.40k | #define TLSXT_PRE_SHARED_KEY 0x0029 |
3014 | 2.96k | #define TLSXT_EARLY_DATA 0x002a |
3015 | | #define TLSXT_SUPPORTED_VERSIONS 0x002b |
3016 | 122 | #define TLSXT_COOKIE 0x002c |
3017 | 1.22k | #define TLSXT_PSK_KEY_EXCHANGE_MODES 0x002d |
3018 | 571 | #define TLSXT_CERTIFICATE_AUTHORITIES 0x002f |
3019 | 276 | #define TLSXT_POST_HANDSHAKE_AUTH 0x0031 |
3020 | 275 | #define TLSXT_SIGNATURE_ALGORITHMS_CERT 0x0032 |
3021 | 4.83k | #define TLSXT_KEY_SHARE 0x0033 |
3022 | 115 | #define TLSXT_CONNECTION_ID 0x0036 |
3023 | | #define TLSXT_KEY_QUIC_TP_PARAMS 0x0039 /* RFC 9001, ch. 8.2 */ |
3024 | 42 | #define TLSXT_ECH 0xfe0d /* RFC 9849 */ |
3025 | | #define TLSXT_ECH_OUTER_EXTENSIONS 0xfd00 /* RFC 9849 */ |
3026 | | /* The 0xFF section is experimental/custom/personal use */ |
3027 | | #define TLSXT_CKS 0xff92 /* X9.146 */ |
3028 | 276 | #define TLSXT_RENEGOTIATION_INFO 0xff01 |
3029 | 16 | #define TLSXT_KEY_QUIC_TP_PARAMS_DRAFT 0xffa5 /* from */ |
3030 | | /* draft-ietf-quic-tls-27 */ |
3031 | | |
3032 | | typedef enum { |
3033 | | #ifdef HAVE_SNI |
3034 | | TLSX_SERVER_NAME = TLSXT_SERVER_NAME, |
3035 | | #endif |
3036 | | TLSX_MAX_FRAGMENT_LENGTH = TLSXT_MAX_FRAGMENT_LENGTH, |
3037 | | TLSX_TRUSTED_CA_KEYS = TLSXT_TRUSTED_CA_KEYS, |
3038 | | TLSX_TRUNCATED_HMAC = TLSXT_TRUNCATED_HMAC, |
3039 | | TLSX_STATUS_REQUEST = TLSXT_STATUS_REQUEST, |
3040 | | TLSX_SUPPORTED_GROUPS = TLSXT_SUPPORTED_GROUPS, |
3041 | | TLSX_EC_POINT_FORMATS = TLSXT_EC_POINT_FORMATS, |
3042 | | #if !defined(NO_CERTS) && !defined(WOLFSSL_NO_SIGALG) |
3043 | | TLSX_SIGNATURE_ALGORITHMS = TLSXT_SIGNATURE_ALGORITHMS, |
3044 | | #endif |
3045 | | #ifdef WOLFSSL_SRTP |
3046 | | TLSX_USE_SRTP = TLSXT_USE_SRTP, |
3047 | | #endif |
3048 | | TLSX_APPLICATION_LAYER_PROTOCOL = TLSXT_APPLICATION_LAYER_PROTOCOL, |
3049 | | TLSX_STATUS_REQUEST_V2 = TLSXT_STATUS_REQUEST_V2, |
3050 | | #ifdef HAVE_RPK |
3051 | | TLSX_CLIENT_CERTIFICATE_TYPE = TLSXT_CLIENT_CERTIFICATE, |
3052 | | TLSX_SERVER_CERTIFICATE_TYPE = TLSXT_SERVER_CERTIFICATE, |
3053 | | #endif |
3054 | | #if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY) |
3055 | | TLSX_ENCRYPT_THEN_MAC = TLSXT_ENCRYPT_THEN_MAC, |
3056 | | #endif |
3057 | | TLSX_EXTENDED_MASTER_SECRET = TLSXT_EXTENDED_MASTER_SECRET, |
3058 | | TLSX_SESSION_TICKET = TLSXT_SESSION_TICKET, |
3059 | | #ifdef WOLFSSL_TLS13 |
3060 | | #ifdef WOLFSSL_EARLY_DATA |
3061 | | TLSX_EARLY_DATA = TLSXT_EARLY_DATA, |
3062 | | #endif |
3063 | | TLSX_SUPPORTED_VERSIONS = TLSXT_SUPPORTED_VERSIONS, |
3064 | | TLSX_COOKIE = TLSXT_COOKIE, |
3065 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
3066 | | TLSX_PSK_KEY_EXCHANGE_MODES = TLSXT_PSK_KEY_EXCHANGE_MODES, |
3067 | | #if defined(WOLFSSL_CERT_WITH_EXTERN_PSK) |
3068 | | TLSX_CERT_WITH_EXTERN_PSK = TLSXT_CERT_WITH_EXTERN_PSK, |
3069 | | #endif |
3070 | | #endif |
3071 | | #if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CA_NAMES) |
3072 | | TLSX_CERTIFICATE_AUTHORITIES = TLSXT_CERTIFICATE_AUTHORITIES, |
3073 | | #endif |
3074 | | #ifdef WOLFSSL_POST_HANDSHAKE_AUTH |
3075 | | TLSX_POST_HANDSHAKE_AUTH = TLSXT_POST_HANDSHAKE_AUTH, |
3076 | | #endif |
3077 | | #if !defined(NO_CERTS) && !defined(WOLFSSL_NO_SIGALG) |
3078 | | TLSX_SIGNATURE_ALGORITHMS_CERT = TLSXT_SIGNATURE_ALGORITHMS_CERT, |
3079 | | #endif |
3080 | | #ifdef WOLFSSL_QUIC |
3081 | | TLSX_KEY_QUIC_TP_PARAMS = TLSXT_KEY_QUIC_TP_PARAMS, |
3082 | | #endif |
3083 | | #ifdef HAVE_ECH |
3084 | | TLSX_ECH = TLSXT_ECH, |
3085 | | #endif |
3086 | | #endif |
3087 | | #if defined(WOLFSSL_DTLS_CID) |
3088 | | TLSX_CONNECTION_ID = TLSXT_CONNECTION_ID, |
3089 | | #endif /* defined(WOLFSSL_DTLS_CID) */ |
3090 | | #if defined(WOLFSSL_TLS13) || !defined(WOLFSSL_NO_TLS12) || !defined(NO_OLD_TLS) |
3091 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
3092 | | TLSX_PRE_SHARED_KEY = TLSXT_PRE_SHARED_KEY, |
3093 | | #endif |
3094 | | TLSX_KEY_SHARE = TLSXT_KEY_SHARE, |
3095 | | #endif |
3096 | | #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_DUAL_ALG_CERTS) |
3097 | | TLSX_CKS = TLSXT_CKS, |
3098 | | #endif |
3099 | | #ifdef WOLFSSL_QUIC |
3100 | | TLSX_KEY_QUIC_TP_PARAMS_DRAFT = TLSXT_KEY_QUIC_TP_PARAMS_DRAFT, |
3101 | | #endif |
3102 | | TLSX_RENEGOTIATION_INFO = TLSXT_RENEGOTIATION_INFO |
3103 | | } TLSX_Type; |
3104 | | |
3105 | | /* TLS Certificate type defined RFC7250 |
3106 | | * https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-3 |
3107 | | */ |
3108 | | #if defined(HAVE_RPK) |
3109 | | /* WOLFSSL_MAX_RPK_PINS (default 4) is defined in the public header |
3110 | | * wolfssl/ssl.h, which this header includes, so applications can see and |
3111 | | * override it. The pin table is stored inline in RpkConfig (see below), |
3112 | | * costing WOLFSSL_MAX_RPK_PINS * WC_SHA256_DIGEST_SIZE bytes per WOLFSSL_CTX and |
3113 | | * WOLFSSL. Out-of-band RPK pinning needs SHA-256 (pins are stored as digests); |
3114 | | * under NO_SHA256 there is no in-library pinning and trust must be expressed |
3115 | | * through a verify callback instead. */ |
3116 | | |
3117 | | typedef struct RpkConfig { |
3118 | | /* user's preference */ |
3119 | | byte preferred_ClientCertTypeCnt; |
3120 | | byte preferred_ClientCertTypes[MAX_CLIENT_CERT_TYPE_CNT]; |
3121 | | byte preferred_ServerCertTypeCnt; |
3122 | | byte preferred_ServerCertTypes[MAX_CLIENT_CERT_TYPE_CNT]; |
3123 | | /* reflect to client_certificate_type extension in xxxHello */ |
3124 | | #ifndef NO_SHA256 |
3125 | | /* SHA-256 digests of the DER SubjectPublicKeyInfo(s) the peer is expected |
3126 | | * to present as a Raw Public Key (RFC 7250), pinned out of band via |
3127 | | * wolfSSL_set_expected_rpk()/wolfSSL_CTX_set_expected_rpk(). A received RPK |
3128 | | * whose SPKI digest matches one of these is treated as authenticated. |
3129 | | * Stored inline (not a pointer) so the by-value RpkConfig copy from CTX to |
3130 | | * SSL needs no deep-copy or free handling. */ |
3131 | | byte expectedRpkCnt; |
3132 | | byte expectedRpk[WOLFSSL_MAX_RPK_PINS][WC_SHA256_DIGEST_SIZE]; |
3133 | | #endif /* !NO_SHA256 */ |
3134 | | } RpkConfig; |
3135 | | |
3136 | | typedef struct RpkState { |
3137 | | byte sending_ClientCertTypeCnt; |
3138 | | byte sending_ClientCertTypes[MAX_CLIENT_CERT_TYPE_CNT]; |
3139 | | /* reflect to server_certificate_type extension in xxxHello */ |
3140 | | byte sending_ServerCertTypeCnt; |
3141 | | byte sending_ServerCertTypes[MAX_SERVER_CERT_TYPE_CNT]; |
3142 | | /* client_certificate_type extension in received yyyHello */ |
3143 | | byte received_ClientCertTypeCnt; |
3144 | | byte received_ClientCertTypes[MAX_CLIENT_CERT_TYPE_CNT]; |
3145 | | /* server_certificate_type extension in received yyyHello */ |
3146 | | byte received_ServerCertTypeCnt; |
3147 | | byte received_ServerCertTypes[MAX_SERVER_CERT_TYPE_CNT]; |
3148 | | /* set if Raw-public-key cert is loaded as own certificate */ |
3149 | | int isRPKLoaded; |
3150 | | } RpkState; |
3151 | | #endif /* HAVE_RPK */ |
3152 | | |
3153 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
3154 | | #define ECH_ACCEPT_CONFIRMATION_SZ 8 |
3155 | | #define ECH_PADDING_TO_32(length) (31 - (((length) - 1) % 32)) |
3156 | | |
3157 | | typedef enum { |
3158 | | ECH_TYPE_OUTER = 0, |
3159 | | ECH_TYPE_INNER = 1 |
3160 | | } EchType; |
3161 | | |
3162 | | typedef enum { |
3163 | | ECH_WRITE_GREASE, |
3164 | | ECH_WRITE_REAL, |
3165 | | ECH_WRITE_RETRY_CONFIGS, |
3166 | | ECH_WRITE_NONE, |
3167 | | ECH_PARSED_INTERNAL, |
3168 | | } EchState; |
3169 | | |
3170 | | typedef struct EchCipherSuite { |
3171 | | word16 kdfId; |
3172 | | word16 aeadId; |
3173 | | } EchCipherSuite; |
3174 | | |
3175 | | typedef struct WOLFSSL_EchConfig { |
3176 | | byte* raw; |
3177 | | char* publicName; |
3178 | | void* receiverPrivkey; |
3179 | | struct WOLFSSL_EchConfig* next; |
3180 | | EchCipherSuite* cipherSuites; |
3181 | | word32 rawLen; |
3182 | | word16 kemId; |
3183 | | byte configId; |
3184 | | byte numCipherSuites; |
3185 | | byte receiverPubkey[HPKE_Npk_MAX]; |
3186 | | byte maxNameLen; |
3187 | | } WOLFSSL_EchConfig; |
3188 | | |
3189 | | typedef struct WOLFSSL_ECH { |
3190 | | Hpke* hpke; |
3191 | | HpkeBaseContext* hpkeContext; |
3192 | | const byte* aad; |
3193 | | void* ephemeralKey; |
3194 | | WOLFSSL_EchConfig* echConfig; |
3195 | | byte* innerClientHello; |
3196 | | byte* outerClientPayload; |
3197 | | /* the 'public' extensions (i.e., the public SNI would be stored here) */ |
3198 | | TLSX* extensions; |
3199 | | byte* confBuf; |
3200 | | EchCipherSuite cipherSuite; |
3201 | | word32 aadLen; |
3202 | | word32 innerClientHelloLen; |
3203 | | word16 paddingLen; |
3204 | | word16 kemId; |
3205 | | word16 encLen; |
3206 | | EchState state; |
3207 | | byte type; |
3208 | | byte configId; |
3209 | | byte enc[HPKE_Npk_MAX]; |
3210 | | byte innerCount; |
3211 | | byte writeEncoded; |
3212 | | } WOLFSSL_ECH; |
3213 | | |
3214 | | WOLFSSL_LOCAL int EchConfigGetSupportedCipherSuite(WOLFSSL_EchConfig* config); |
3215 | | |
3216 | | WOLFSSL_LOCAL int TLSX_FinalizeEch(WOLFSSL* ssl, WOLFSSL_ECH* ech, byte* aad, |
3217 | | word32 aadLen); |
3218 | | |
3219 | | WOLFSSL_LOCAL int TLSX_EchReplaceExtensions(WOLFSSL* ssl, byte accepted); |
3220 | | |
3221 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3222 | | #define TLSX_EchSwapExtensions wolfSSL_TLSX_EchSwapExtensions |
3223 | | #endif |
3224 | | WOLFSSL_TEST_VIS int TLSX_EchSwapExtensions(TLSX** sslExts, TLSX** echExts, |
3225 | | word16* appended); |
3226 | | |
3227 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3228 | | #define TLSX_ServerECH_Use wolfSSL_TLSX_ServerECH_Use |
3229 | | #endif |
3230 | | WOLFSSL_TEST_VIS int TLSX_ServerECH_Use(TLSX** extensions, void* heap, |
3231 | | WOLFSSL_EchConfig* configs); |
3232 | | |
3233 | | WOLFSSL_LOCAL int SetEchConfigsEx(WOLFSSL_EchConfig** outputConfigs, void* heap, |
3234 | | const byte* echConfigs, word32 echConfigsLen); |
3235 | | |
3236 | | WOLFSSL_LOCAL int GetEchConfig(WOLFSSL_EchConfig* config, byte* output, |
3237 | | word32* outputLen); |
3238 | | |
3239 | | WOLFSSL_LOCAL int GetEchConfigsEx(WOLFSSL_EchConfig* configs, |
3240 | | byte* output, word32* outputLen); |
3241 | | |
3242 | | WOLFSSL_LOCAL void FreeEchConfigs(WOLFSSL_EchConfig* configs, void* heap); |
3243 | | |
3244 | | WOLFSSL_LOCAL int SetRetryConfigs(WOLFSSL* ssl, const byte* echConfigs, |
3245 | | word32 echConfigsLen); |
3246 | | #endif |
3247 | | |
3248 | | struct TLSX { |
3249 | | TLSX_Type type; /* Extension Type */ |
3250 | | void* data; /* Extension Data */ |
3251 | | word32 val; /* Extension Value */ |
3252 | | byte resp; /* IsResponse Flag */ |
3253 | | struct TLSX* next; /* List Behavior */ |
3254 | | }; |
3255 | | |
3256 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3257 | | #define TLSX_Find wolfSSL_TLSX_Find |
3258 | | #endif |
3259 | | WOLFSSL_TEST_VIS TLSX* TLSX_Find(TLSX* list, TLSX_Type type); |
3260 | | WOLFSSL_LOCAL void TLSX_Remove(TLSX** list, TLSX_Type type, void* heap); |
3261 | | WOLFSSL_LOCAL void TLSX_FreeAll(TLSX* list, void* heap); |
3262 | | WOLFSSL_LOCAL int TLSX_SupportExtensions(WOLFSSL* ssl); |
3263 | | WOLFSSL_LOCAL int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isRequest); |
3264 | | |
3265 | | #if defined(WOLFSSL_TLS13) || !defined(NO_WOLFSSL_CLIENT) |
3266 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3267 | | #define TLSX_GetRequestSize wolfSSL_TLSX_GetRequestSize |
3268 | | #define TLSX_WriteRequest wolfSSL_TLSX_WriteRequest |
3269 | | #endif |
3270 | | WOLFSSL_TEST_VIS int TLSX_GetRequestSize(WOLFSSL* ssl, byte msgType, |
3271 | | word32* pLength); |
3272 | | WOLFSSL_TEST_VIS int TLSX_WriteRequest(WOLFSSL* ssl, byte* output, |
3273 | | byte msgType, word32* pOffset); |
3274 | | #endif |
3275 | | |
3276 | | #if defined(WOLFSSL_TLS13) || !defined(NO_WOLFSSL_SERVER) |
3277 | | /* TLS 1.3 Certificate messages have extensions. */ |
3278 | | WOLFSSL_LOCAL int TLSX_GetResponseSize(WOLFSSL* ssl, byte msgType, |
3279 | | word16* pLength); |
3280 | | WOLFSSL_LOCAL int TLSX_WriteResponse(WOLFSSL *ssl, byte* output, byte msgType, |
3281 | | word16* pOffset); |
3282 | | #endif |
3283 | | |
3284 | | WOLFSSL_LOCAL int TLSX_ParseVersion(WOLFSSL* ssl, const byte* input, |
3285 | | word16 length, byte msgType, int* found); |
3286 | | WOLFSSL_LOCAL int TLSX_SupportedVersions_Parse(const WOLFSSL* ssl, |
3287 | | const byte* input, word16 length, byte msgType, ProtocolVersion* pv, |
3288 | | Options* opts, TLSX** exts); |
3289 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3290 | | #define TLSX_Parse wolfSSL_TLSX_Parse |
3291 | | #endif |
3292 | | WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, |
3293 | | byte msgType, Suites *suites); |
3294 | | WOLFSSL_LOCAL int TLSX_Push(TLSX** list, TLSX_Type type, |
3295 | | const void* data, void* heap); |
3296 | | WOLFSSL_LOCAL int TLSX_Append(TLSX** list, TLSX_Type type, |
3297 | | const void* data, void* heap); |
3298 | | |
3299 | | #elif defined(HAVE_SNI) \ |
3300 | | || defined(HAVE_MAX_FRAGMENT) \ |
3301 | | || defined(HAVE_TRUSTED_CA) \ |
3302 | | || defined(HAVE_TRUNCATED_HMAC) \ |
3303 | | || defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ |
3304 | | || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) \ |
3305 | | || defined(HAVE_SUPPORTED_CURVES) \ |
3306 | | || defined(HAVE_ALPN) \ |
3307 | | || defined(HAVE_SESSION_TICKET) \ |
3308 | | || defined(HAVE_SECURE_RENEGOTIATION) \ |
3309 | | || defined(HAVE_SERVER_RENEGOTIATION_INFO) |
3310 | | |
3311 | | #ifndef NO_TLS |
3312 | | #error Using TLS extensions requires HAVE_TLS_EXTENSIONS to be defined. |
3313 | | #endif |
3314 | | #endif /* HAVE_TLS_EXTENSIONS */ |
3315 | | |
3316 | | /** Server Name Indication - RFC 6066 (session 3) */ |
3317 | | #ifdef HAVE_SNI |
3318 | | |
3319 | | typedef struct SNI { |
3320 | | byte type; /* SNI Type */ |
3321 | | union { char* host_name; } data; /* SNI Data */ |
3322 | | struct SNI* next; /* List Behavior */ |
3323 | | byte status; /* Matching result */ |
3324 | | #ifndef NO_WOLFSSL_SERVER |
3325 | | byte options; /* Behavior options */ |
3326 | | #endif |
3327 | | } SNI; |
3328 | | |
3329 | | WOLFSSL_LOCAL int TLSX_UseSNI(TLSX** extensions, byte type, const void* data, |
3330 | | word16 size, void* heap); |
3331 | | WOLFSSL_LOCAL byte TLSX_SNI_Status(TLSX* extensions, byte type); |
3332 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3333 | | #define TLSX_SNI_GetRequest wolfSSL_TLSX_SNI_GetRequest |
3334 | | #endif |
3335 | | WOLFSSL_TEST_VIS word16 TLSX_SNI_GetRequest(TLSX* extensions, byte type, |
3336 | | void** data, byte ignoreStatus); |
3337 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3338 | | #define TLSX_SNI_GetSize wolfSSL_TLSX_SNI_GetSize |
3339 | | #endif |
3340 | | WOLFSSL_TEST_VIS word16 TLSX_SNI_GetSize(SNI* list); |
3341 | | |
3342 | | #ifndef NO_WOLFSSL_SERVER |
3343 | | WOLFSSL_LOCAL void TLSX_SNI_SetOptions(TLSX* extensions, byte type, |
3344 | | byte options); |
3345 | | WOLFSSL_LOCAL int TLSX_SNI_GetFromBuffer(const byte* clientHello, |
3346 | | word32 helloSz, byte type, byte* sni, word32* inOutSz); |
3347 | | #endif |
3348 | | |
3349 | | #endif /* HAVE_SNI */ |
3350 | | |
3351 | | /* Trusted CA Key Indication - RFC 6066 (section 6) */ |
3352 | | #ifdef HAVE_TRUSTED_CA |
3353 | | |
3354 | | typedef struct TCA { |
3355 | | byte type; /* TCA Type */ |
3356 | | byte* id; /* TCA identifier */ |
3357 | | word16 idSz; /* TCA identifier size */ |
3358 | | struct TCA* next; /* List Behavior */ |
3359 | | } TCA; |
3360 | | |
3361 | | WOLFSSL_LOCAL int TLSX_UseTrustedCA(TLSX** extensions, byte type, |
3362 | | const byte* id, word16 idSz, void* heap); |
3363 | | |
3364 | | #endif /* HAVE_TRUSTED_CA */ |
3365 | | |
3366 | | /* Application-Layer Protocol Negotiation - RFC 7301 */ |
3367 | | #ifdef HAVE_ALPN |
3368 | | typedef struct ALPN { |
3369 | | char* protocol_name; /* ALPN protocol name */ |
3370 | | struct ALPN* next; /* List Behavior */ |
3371 | | byte options; /* Behavior options */ |
3372 | | byte negotiated; /* ALPN protocol negotiated or not */ |
3373 | | } ALPN; |
3374 | | |
3375 | | WOLFSSL_LOCAL int TLSX_ALPN_GetRequest(TLSX* extensions, |
3376 | | void** data, word16 *dataSz); |
3377 | | |
3378 | | WOLFSSL_LOCAL int TLSX_UseALPN(TLSX** extensions, const void* data, |
3379 | | word16 size, byte options, void* heap); |
3380 | | |
3381 | | WOLFSSL_LOCAL int TLSX_ALPN_SetOptions(TLSX** extensions, byte option); |
3382 | | |
3383 | | #endif /* HAVE_ALPN */ |
3384 | | |
3385 | | /** Maximum Fragment Length Negotiation - RFC 6066 (session 4) */ |
3386 | | #ifdef HAVE_MAX_FRAGMENT |
3387 | | |
3388 | | WOLFSSL_LOCAL int TLSX_UseMaxFragment(TLSX** extensions, byte mfl, void* heap); |
3389 | | |
3390 | | #endif /* HAVE_MAX_FRAGMENT */ |
3391 | | |
3392 | | /** Truncated HMAC - RFC 6066 (session 7) */ |
3393 | | #ifdef HAVE_TRUNCATED_HMAC |
3394 | | |
3395 | | WOLFSSL_LOCAL int TLSX_UseTruncatedHMAC(TLSX** extensions, void* heap); |
3396 | | |
3397 | | #endif /* HAVE_TRUNCATED_HMAC */ |
3398 | | |
3399 | | /** Certificate Status Request - RFC 6066 (session 8) */ |
3400 | | #ifdef HAVE_CERTIFICATE_STATUS_REQUEST |
3401 | | |
3402 | | typedef struct { |
3403 | | byte status_type; |
3404 | | byte options; |
3405 | | WOLFSSL* ssl; |
3406 | | union { |
3407 | | OcspRequest ocsp[MAX_CERT_EXTENSIONS]; |
3408 | | } request; |
3409 | | word16 requests; |
3410 | | #ifdef WOLFSSL_TLS13 |
3411 | | buffer responses[MAX_CERT_EXTENSIONS]; |
3412 | | #endif |
3413 | | } CertificateStatusRequest; |
3414 | | |
3415 | | WOLFSSL_LOCAL int TLSX_UseCertificateStatusRequest(TLSX** extensions, |
3416 | | byte status_type, byte options, WOLFSSL* ssl, void* heap, int devId); |
3417 | | #ifndef NO_CERTS |
3418 | | WOLFSSL_LOCAL int TLSX_CSR_InitRequest(TLSX* extensions, DecodedCert* cert, |
3419 | | void* heap); |
3420 | | WOLFSSL_LOCAL int TLSX_CSR_InitRequest_ex(TLSX* extensions, DecodedCert* cert, |
3421 | | void* heap, int idx); |
3422 | | #endif |
3423 | | WOLFSSL_LOCAL void* TLSX_CSR_GetRequest(TLSX* extensions); |
3424 | | WOLFSSL_LOCAL int TLSX_CSR_ForceRequest(WOLFSSL* ssl); |
3425 | | WOLFSSL_LOCAL word16 TLSX_CSR_GetSize_ex(CertificateStatusRequest* csr, |
3426 | | byte isRequest, |
3427 | | int idx); |
3428 | | WOLFSSL_LOCAL int TLSX_CSR_Write_ex(CertificateStatusRequest* csr, byte* output, |
3429 | | byte isRequest, int idx); |
3430 | | WOLFSSL_LOCAL void* TLSX_CSR_GetRequest_ex(TLSX* extensions, int idx); |
3431 | | |
3432 | | WOLFSSL_LOCAL int TLSX_CSR_SetResponseWithStatusCB(WOLFSSL *ssl); |
3433 | | WOLFSSL_LOCAL int ProcessChainOCSPRequest(WOLFSSL* ssl); |
3434 | | |
3435 | | #endif |
3436 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \ |
3437 | | defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) |
3438 | | WOLFSSL_LOCAL int CreateOcspRequest(WOLFSSL* ssl, OcspRequest* request, |
3439 | | DecodedCert* cert, byte* certData, word32 length, |
3440 | | byte *ctxOwnsRequest); |
3441 | | #endif |
3442 | | /** Certificate Status Request v2 - RFC 6961 */ |
3443 | | #ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2 |
3444 | | |
3445 | | typedef struct CSRIv2 { |
3446 | | byte status_type; |
3447 | | byte options; |
3448 | | word16 requests; |
3449 | | union { |
3450 | | OcspRequest ocsp[1 + MAX_CHAIN_DEPTH]; |
3451 | | } request; |
3452 | | struct CSRIv2* next; |
3453 | | Signer *pendingSigners; |
3454 | | } CertificateStatusRequestItemV2; |
3455 | | |
3456 | | WOLFSSL_LOCAL int TLSX_UseCertificateStatusRequestV2(TLSX** extensions, |
3457 | | byte status_type, byte options, void* heap, int devId); |
3458 | | #ifndef NO_CERTS |
3459 | | WOLFSSL_LOCAL int TLSX_CSR2_IsMulti(TLSX *extensions); |
3460 | | WOLFSSL_LOCAL int TLSX_CSR2_AddPendingSigner(TLSX *extensions, Signer *s); |
3461 | | WOLFSSL_LOCAL Signer* TLSX_CSR2_GetPendingSigners(TLSX *extensions); |
3462 | | WOLFSSL_LOCAL int TLSX_CSR2_ClearPendingCA(WOLFSSL *ssl); |
3463 | | WOLFSSL_LOCAL int TLSX_CSR2_MergePendingCA(WOLFSSL* ssl); |
3464 | | WOLFSSL_LOCAL int TLSX_CSR2_InitRequests(TLSX* extensions, DecodedCert* cert, |
3465 | | byte isPeer, void* heap); |
3466 | | #endif |
3467 | | WOLFSSL_LOCAL void* TLSX_CSR2_GetRequest(TLSX* extensions, byte status_type, |
3468 | | byte idx); |
3469 | | WOLFSSL_LOCAL int TLSX_CSR2_ForceRequest(WOLFSSL* ssl); |
3470 | | |
3471 | | #endif |
3472 | | |
3473 | | #if defined(WOLFSSL_PUBLIC_ASN) && defined(HAVE_PK_CALLBACKS) |
3474 | | /* Internal callback guarded by WOLFSSL_TEST_VIS because of DecodedCert. */ |
3475 | | typedef int (*CallbackProcessPeerCert)(WOLFSSL* ssl, DecodedCert* p_cert); |
3476 | | WOLFSSL_TEST_VIS void wolfSSL_CTX_SetProcessPeerCertCb(WOLFSSL_CTX* ctx, |
3477 | | CallbackProcessPeerCert cb); |
3478 | | #endif /* DecodedCert && HAVE_PK_CALLBACKS */ |
3479 | | |
3480 | | #if !defined(NO_CERTS) && !defined(WOLFSSL_NO_SIGALG) |
3481 | | typedef struct SignatureAlgorithms { |
3482 | | /* Not const since it is modified in TLSX_SignatureAlgorithms_MapPss */ |
3483 | | WOLFSSL* ssl; |
3484 | | word16 hashSigAlgoSz; /* SigAlgo extension length in bytes */ |
3485 | | /* Ignore "nonstandard extension used : zero-sized array in struct/union" |
3486 | | * MSVC warning */ |
3487 | | #ifdef _MSC_VER |
3488 | | #pragma warning(disable: 4200) |
3489 | | #endif |
3490 | | /* sig/algo to offer */ |
3491 | | byte hashSigAlgo[WC_FLEXIBLE_ARRAY_SIZE]; |
3492 | | } SignatureAlgorithms; |
3493 | | |
3494 | | WOLFSSL_LOCAL SignatureAlgorithms* TLSX_SignatureAlgorithms_New( |
3495 | | WOLFSSL* ssl, word16 hashSigAlgoSz, void* heap); |
3496 | | WOLFSSL_LOCAL void TLSX_SignatureAlgorithms_FreeAll(SignatureAlgorithms* sa, |
3497 | | void* heap); |
3498 | | #endif |
3499 | | |
3500 | | /** Supported Elliptic Curves - RFC 4492 (session 4) */ |
3501 | | #ifdef HAVE_SUPPORTED_CURVES |
3502 | | |
3503 | | typedef struct SupportedCurve { |
3504 | | word16 name; /* Curve Names */ |
3505 | | struct SupportedCurve* next; /* List Behavior */ |
3506 | | } SupportedCurve; |
3507 | | |
3508 | | typedef struct PointFormat { |
3509 | | byte format; /* PointFormat */ |
3510 | | struct PointFormat* next; /* List Behavior */ |
3511 | | } PointFormat; |
3512 | | |
3513 | | WOLFSSL_LOCAL int TLSX_SupportedCurve_Copy(TLSX* src, TLSX** dst, void* heap); |
3514 | | WOLFSSL_LOCAL int TLSX_UseSupportedCurve(TLSX** extensions, word16 name, |
3515 | | void* heap, int side); |
3516 | | |
3517 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3518 | | #define TLSX_UsePointFormat wolfSSL_TLSX_UsePointFormat |
3519 | | #endif |
3520 | | /* WOLFSSL_TEST_VIS so the API tests can seed a client's ec_point_formats |
3521 | | * extension (the point-format negotiation has no public API). */ |
3522 | | WOLFSSL_TEST_VIS int TLSX_UsePointFormat(TLSX** extensions, byte point, |
3523 | | void* heap); |
3524 | | WOLFSSL_LOCAL int TLSX_IsGroupSupported(int namedGroup, int side); |
3525 | | |
3526 | | #ifndef NO_WOLFSSL_SERVER |
3527 | | WOLFSSL_LOCAL int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, |
3528 | | byte second, word32* ecdhCurveOID); |
3529 | | WOLFSSL_LOCAL int TLSX_SupportedCurve_CheckPriority(WOLFSSL* ssl); |
3530 | | WOLFSSL_LOCAL int TLSX_SupportedFFDHE_Set(WOLFSSL* ssl); |
3531 | | #endif |
3532 | | WOLFSSL_LOCAL int TLSX_SupportedCurve_IsSupported(WOLFSSL* ssl, word16 name); |
3533 | | WOLFSSL_LOCAL int TLSX_SupportedCurve_Preferred(WOLFSSL* ssl, |
3534 | | int checkSupported); |
3535 | | WOLFSSL_LOCAL int TLSX_SupportedCurve_Parse(const WOLFSSL* ssl, |
3536 | | const byte* input, word16 length, byte isRequest, TLSX** extensions); |
3537 | | |
3538 | | #endif /* HAVE_SUPPORTED_CURVES */ |
3539 | | |
3540 | | /** Renegotiation Indication - RFC 5746 */ |
3541 | | #if defined(HAVE_SECURE_RENEGOTIATION) \ |
3542 | | || defined(HAVE_SERVER_RENEGOTIATION_INFO) |
3543 | | |
3544 | | enum key_cache_state { |
3545 | | SCR_CACHE_NULL = 0, /* empty / begin state */ |
3546 | | SCR_CACHE_NEEDED, /* need to cache keys */ |
3547 | | SCR_CACHE_COPY, /* we have a cached copy */ |
3548 | | SCR_CACHE_PARTIAL, /* partial restore to real keys */ |
3549 | | SCR_CACHE_COMPLETE /* complete restore to real keys */ |
3550 | | }; |
3551 | | |
3552 | | /* Additional Connection State according to rfc5746 section 3.1 */ |
3553 | | typedef struct SecureRenegotiation { |
3554 | | /* Single-bit flags grouped together so they pack into one storage unit. */ |
3555 | | WC_BITFIELD enabled:1; /* secure_renegotiation flag in rfc */ |
3556 | | WC_BITFIELD verifySet:1; |
3557 | | WC_BITFIELD startScr:1; /* server requested client to start scr */ |
3558 | | WC_BITFIELD renegInfoSeen:1; /* renegotiation_info ext seen this |
3559 | | * handshake (RFC 5746 3.7) */ |
3560 | | WC_BITFIELD subject_hash_set:1; /* if peer cert hash is set */ |
3561 | | enum key_cache_state cache_status; /* track key cache state */ |
3562 | | byte client_verify_data[TLS_FINISHED_SZ]; /* cached */ |
3563 | | byte server_verify_data[TLS_FINISHED_SZ]; /* cached */ |
3564 | | byte subject_hash[KEYID_SIZE]; /* peer cert hash */ |
3565 | | Keys tmp_keys; /* can't overwrite real keys yet */ |
3566 | | } SecureRenegotiation; |
3567 | | |
3568 | | WOLFSSL_LOCAL int TLSX_UseSecureRenegotiation(TLSX** extensions, void* heap); |
3569 | | |
3570 | | #ifdef HAVE_SERVER_RENEGOTIATION_INFO |
3571 | | WOLFSSL_LOCAL int TLSX_AddEmptyRenegotiationInfo(TLSX** extensions, void* heap); |
3572 | | #endif |
3573 | | |
3574 | | #endif /* HAVE_SECURE_RENEGOTIATION */ |
3575 | | |
3576 | | #ifdef HAVE_SESSION_TICKET |
3577 | | /* Max peer cert size for ticket: 2KB is reasonable for most RSA/ECC certs */ |
3578 | | #ifndef MAX_TICKET_PEER_CERT_SZ |
3579 | | #define MAX_TICKET_PEER_CERT_SZ 2048 |
3580 | | #endif |
3581 | | #if defined(HAVE_SNI) || defined(HAVE_ALPN) |
3582 | | /* Hash algorithm used for SNI/ALPN binding in session tickets. |
3583 | | * Pick the best available at compile time. */ |
3584 | | #ifndef TICKET_BINDING_HASH_TYPE |
3585 | | #if !defined(NO_SHA256) |
3586 | | #define TICKET_BINDING_HASH_TYPE WC_HASH_TYPE_SHA256 |
3587 | | #define TICKET_BINDING_HASH_SZ WC_SHA256_DIGEST_SIZE |
3588 | | #elif defined(WOLFSSL_SHA384) |
3589 | | #define TICKET_BINDING_HASH_TYPE WC_HASH_TYPE_SHA384 |
3590 | | #define TICKET_BINDING_HASH_SZ WC_SHA384_DIGEST_SIZE |
3591 | | #elif !defined(NO_SHA) |
3592 | | #define TICKET_BINDING_HASH_TYPE WC_HASH_TYPE_SHA |
3593 | | #define TICKET_BINDING_HASH_SZ WC_SHA_DIGEST_SIZE |
3594 | | #else |
3595 | | #error "No hash algorithm available for ticket binding" |
3596 | | #endif |
3597 | | #endif |
3598 | | #endif |
3599 | | |
3600 | | /* Our ticket format. All members need to be a byte or array of byte to |
3601 | | * avoid alignment issues */ |
3602 | | typedef struct InternalTicket { |
3603 | | ProtocolVersion pv; /* version when ticket created */ |
3604 | | byte suite[SUITE_LEN]; /* cipher suite when created */ |
3605 | | byte msecret[SECRET_LEN]; /* master secret */ |
3606 | | byte timestamp[TIMESTAMP_LEN]; /* born on */ |
3607 | | byte haveEMS; /* have extended master secret */ |
3608 | | #ifdef WOLFSSL_TLS13 |
3609 | | byte ageAdd[AGEADD_LEN]; /* Obfuscation of age */ |
3610 | | byte namedGroup[NAMEDGROUP_LEN]; /* Named group used */ |
3611 | | byte ticketNonceLen; |
3612 | | byte ticketNonce[MAX_TICKET_NONCE_STATIC_SZ]; |
3613 | | #ifdef WOLFSSL_EARLY_DATA |
3614 | | byte maxEarlyDataSz[MAXEARLYDATASZ_LEN]; /* Max size of |
3615 | | * early data */ |
3616 | | #endif |
3617 | | #endif |
3618 | | #ifdef WOLFSSL_TICKET_HAVE_ID |
3619 | | byte id[ID_LEN]; |
3620 | | #endif |
3621 | | #ifdef HAVE_SNI |
3622 | | byte sniHash[TICKET_BINDING_HASH_SZ]; /* digest of server name |
3623 | | * at ticket issue */ |
3624 | | #endif |
3625 | | #ifdef HAVE_ALPN |
3626 | | byte alpnHash[TICKET_BINDING_HASH_SZ]; /* digest of negotiated |
3627 | | * ALPN at issue */ |
3628 | | #endif |
3629 | | #ifdef OPENSSL_EXTRA |
3630 | | byte sessionCtxSz; /* sessionCtx length */ |
3631 | | byte sessionCtx[ID_LEN]; /* app specific context id */ |
3632 | | #endif /* OPENSSL_EXTRA */ |
3633 | | #if defined(OPENSSL_ALL) && defined(KEEP_PEER_CERT) && \ |
3634 | | !defined(NO_CERT_IN_TICKET) |
3635 | | byte peerCertLen[OPAQUE16_LEN]; /* peer cert length */ |
3636 | | byte peerCert[]; /* peer certificate DER - variable length */ |
3637 | | #endif |
3638 | | } InternalTicket; |
3639 | | |
3640 | | /* Base size of InternalTicket without the variable-length peerCert field */ |
3641 | | #define WOLFSSL_INTERNAL_TICKET_BASE_SZ (sizeof(InternalTicket)) |
3642 | | |
3643 | | /* Minimum internal ticket length (no peer cert) */ |
3644 | | #ifndef WOLFSSL_TICKET_ENC_CBC_HMAC |
3645 | | #define WOLFSSL_INTERNAL_TICKET_LEN WOLFSSL_INTERNAL_TICKET_BASE_SZ |
3646 | | #else |
3647 | | #define WOLFSSL_INTERNAL_TICKET_LEN \ |
3648 | | (((WOLFSSL_INTERNAL_TICKET_BASE_SZ + 15) / 16) * 16) |
3649 | | #endif |
3650 | | |
3651 | | /* Maximum internal ticket length (with max peer cert) */ |
3652 | | #if defined(OPENSSL_ALL) && defined(KEEP_PEER_CERT) && \ |
3653 | | !defined(NO_CERT_IN_TICKET) |
3654 | | #define WOLFSSL_INTERNAL_TICKET_MAX_SZ \ |
3655 | | (WOLFSSL_INTERNAL_TICKET_BASE_SZ + MAX_TICKET_PEER_CERT_SZ) |
3656 | | #else |
3657 | | #define WOLFSSL_INTERNAL_TICKET_MAX_SZ WOLFSSL_INTERNAL_TICKET_BASE_SZ |
3658 | | #endif |
3659 | | |
3660 | | #ifndef WOLFSSL_TICKET_EXTRA_PADDING_SZ |
3661 | | #define WOLFSSL_TICKET_EXTRA_PADDING_SZ 32 |
3662 | | #endif |
3663 | | |
3664 | | /* Maximum encrypted ticket size */ |
3665 | | #define WOLFSSL_TICKET_ENC_SZ \ |
3666 | | (WOLFSSL_INTERNAL_TICKET_MAX_SZ + WOLFSSL_TICKET_EXTRA_PADDING_SZ) |
3667 | | |
3668 | | /* RFC 5077 defines this for session tickets. All members need to be a byte or |
3669 | | * array of byte to avoid alignment issues */ |
3670 | | typedef struct ExternalTicket { |
3671 | | byte key_name[WOLFSSL_TICKET_NAME_SZ]; /* key context name - 16 */ |
3672 | | byte iv[WOLFSSL_TICKET_IV_SZ]; /* this ticket's iv - 16 */ |
3673 | | byte enc_len[OPAQUE16_LEN]; /* encrypted length - 2 */ |
3674 | | byte enc_ticket[WC_FLEXIBLE_ARRAY_SIZE]; /* encrypted ticket - var length |
3675 | | * + total mac - 32 */ |
3676 | | } ExternalTicket; |
3677 | | |
3678 | | /* Fixed portion of external ticket (key_name + iv + enc_len) */ |
3679 | | #define WOLFSSL_TICKET_FIXED_SZ \ |
3680 | | (WOLFSSL_TICKET_NAME_SZ + WOLFSSL_TICKET_IV_SZ + OPAQUE16_LEN + \ |
3681 | | WOLFSSL_TICKET_MAC_SZ) |
3682 | | |
3683 | | /* Maximum session ticket length */ |
3684 | | #define SESSION_TICKET_LEN \ |
3685 | | ((int)(WOLFSSL_TICKET_FIXED_SZ + WOLFSSL_TICKET_ENC_SZ)) |
3686 | | |
3687 | | typedef struct SessionTicket { |
3688 | | word32 lifetime; |
3689 | | #ifdef WOLFSSL_TLS13 |
3690 | | word64 seen; |
3691 | | word32 ageAdd; |
3692 | | #endif |
3693 | | byte* data; |
3694 | | word16 size; |
3695 | | } SessionTicket; |
3696 | | |
3697 | | #if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_WOLFSSL_SERVER) |
3698 | | |
3699 | | /* Data passed to default SessionTicket enc/dec callback. */ |
3700 | | typedef struct TicketEncCbCtx { |
3701 | | /* Name for this context. */ |
3702 | | byte name[WOLFSSL_TICKET_NAME_SZ]; |
3703 | | /* Current keys - current and next. */ |
3704 | | byte key[2][WOLFSSL_TICKET_KEY_SZ]; |
3705 | | /* Expirary date of keys. */ |
3706 | | word32 expirary[2]; |
3707 | | /* Random number generator to use for generating name, keys and IV. */ |
3708 | | WC_RNG rng; |
3709 | | #ifndef SINGLE_THREADED |
3710 | | /* Mutex for access to changing keys. */ |
3711 | | wolfSSL_Mutex mutex; |
3712 | | #endif |
3713 | | /* Pointer back to SSL_CTX. */ |
3714 | | WOLFSSL_CTX* ctx; |
3715 | | } TicketEncCbCtx; |
3716 | | |
3717 | | #endif /* !WOLFSSL_NO_DEF_TICKET_ENC_CB && !NO_WOLFSSL_SERVER */ |
3718 | | |
3719 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3720 | | #define TLSX_UseSessionTicket wolfSSL_TLSX_UseSessionTicket |
3721 | | #define TLSX_SessionTicket_Create wolfSSL_TLSX_SessionTicket_Create |
3722 | | #define TLSX_SessionTicket_Free wolfSSL_TLSX_SessionTicket_Free |
3723 | | #endif |
3724 | | WOLFSSL_TEST_VIS int TLSX_UseSessionTicket(TLSX** extensions, |
3725 | | SessionTicket* ticket, void* heap); |
3726 | | WOLFSSL_TEST_VIS SessionTicket* TLSX_SessionTicket_Create(word32 lifetime, |
3727 | | byte* data, word16 size, void* heap); |
3728 | | WOLFSSL_TEST_VIS void TLSX_SessionTicket_Free(SessionTicket* ticket, void* heap); |
3729 | | |
3730 | | #endif /* HAVE_SESSION_TICKET */ |
3731 | | |
3732 | | #ifndef MAX_PSK_ID_LEN |
3733 | | /* max psk identity/hint supported */ |
3734 | | #if defined(WOLFSSL_TLS13) |
3735 | | #ifdef SESSION_TICKET_LEN |
3736 | | #define MAX_PSK_ID_LEN SESSION_TICKET_LEN |
3737 | | #else |
3738 | | /* Previous value. Use as fallback for when tickets are disabled. */ |
3739 | | #define MAX_PSK_ID_LEN 1536 |
3740 | | #endif |
3741 | | #else |
3742 | | #define MAX_PSK_ID_LEN 128 |
3743 | | #endif |
3744 | | #endif |
3745 | | |
3746 | | #if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY) |
3747 | | int TLSX_EncryptThenMac_Respond(WOLFSSL* ssl); |
3748 | | #endif |
3749 | | |
3750 | | #ifdef WOLFSSL_TLS13 |
3751 | | /* Cookie extension information - cookie data. */ |
3752 | | typedef struct Cookie { |
3753 | | word16 len; |
3754 | | /* Ignore "nonstandard extension used : zero-sized array in struct/union" |
3755 | | * MSVC warning */ |
3756 | | #ifdef _MSC_VER |
3757 | | #pragma warning(disable: 4200) |
3758 | | #endif |
3759 | | byte data[WC_FLEXIBLE_ARRAY_SIZE]; |
3760 | | } Cookie; |
3761 | | |
3762 | | WOLFSSL_LOCAL int TLSX_Cookie_Use(const WOLFSSL* ssl, const byte* data, |
3763 | | word16 len, byte* mac, byte macSz, int resp, TLSX** exts); |
3764 | | WOLFSSL_LOCAL int TlsCheckCookie(const WOLFSSL* ssl, const byte* cookie, |
3765 | | word16 cookieSz); |
3766 | | |
3767 | | |
3768 | | /* Key Share - TLS v1.3 Specification */ |
3769 | | |
3770 | | /* The KeyShare extension information - entry in a linked list. */ |
3771 | | typedef struct KeyShareEntry { |
3772 | | word16 group; /* NamedGroup */ |
3773 | | byte* ke; /* Key exchange data */ |
3774 | | word32 keLen; /* Key exchange data length */ |
3775 | | void* key; /* Key struct */ |
3776 | | word32 keyLen; /* Key size (bytes) */ |
3777 | | byte* pubKey; /* Public key */ |
3778 | | word32 pubKeyLen; /* Public key length */ |
3779 | | #if !defined(NO_DH) || defined(WOLFSSL_HAVE_MLKEM) |
3780 | | byte* privKey; /* Private key */ |
3781 | | word32 privKeyLen;/* Private key length - PQC only */ |
3782 | | #endif |
3783 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
3784 | | word16 session; /* NamedGroup that was in session */ |
3785 | | word16 derived; /* preMaster has been derived */ |
3786 | | #endif |
3787 | | #ifdef WOLFSSL_ASYNC_CRYPT |
3788 | | int lastRet; |
3789 | | #endif |
3790 | | struct KeyShareEntry* next; /* List pointer */ |
3791 | | } KeyShareEntry; |
3792 | | |
3793 | | WOLFSSL_LOCAL int TLSX_KeyShare_Use(const WOLFSSL* ssl, word16 group, |
3794 | | word16 len, byte* data, KeyShareEntry **kse, TLSX** extensions); |
3795 | | WOLFSSL_LOCAL int TLSX_KeyShare_Empty(WOLFSSL* ssl); |
3796 | | WOLFSSL_LOCAL int TLSX_KeyShare_SetSupported(const WOLFSSL* ssl, |
3797 | | TLSX** extensions); |
3798 | | WOLFSSL_LOCAL int TLSX_KeyShare_GenKey(WOLFSSL *ssl, KeyShareEntry *kse); |
3799 | | WOLFSSL_LOCAL int TLSX_KeyShare_Choose(const WOLFSSL *ssl, TLSX* extensions, |
3800 | | byte cipherSuite0, byte cipherSuite, KeyShareEntry** kse, |
3801 | | byte* searched); |
3802 | | WOLFSSL_LOCAL int TLSX_KeyShare_Setup(WOLFSSL *ssl, KeyShareEntry* clientKSE); |
3803 | | WOLFSSL_LOCAL int TLSX_KeyShare_Establish(WOLFSSL* ssl, int* doHelloRetry); |
3804 | | WOLFSSL_LOCAL int TLSX_KeyShare_DeriveSecret(WOLFSSL* sclientKSEclientKSEsl); |
3805 | | WOLFSSL_LOCAL int TLSX_KeyShare_Parse(WOLFSSL* ssl, const byte* input, |
3806 | | word16 length, byte msgType); |
3807 | | WOLFSSL_LOCAL int TLSX_KeyShare_Parse_ClientHello(const WOLFSSL* ssl, |
3808 | | const byte* input, word16 length, TLSX** extensions); |
3809 | | WOLFSSL_LOCAL int TLSX_KeyShare_HandlePqcHybridKeyServer(WOLFSSL* ssl, |
3810 | | KeyShareEntry* keyShareEntry, byte* data, word16 len); |
3811 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
3812 | | WOLFSSL_LOCAL int TLSX_CKS_Parse(WOLFSSL* ssl, byte* input, |
3813 | | word16 length, TLSX** extensions); |
3814 | | WOLFSSL_LOCAL int TLSX_CKS_Set(WOLFSSL* ssl, TLSX** extensions); |
3815 | | #endif |
3816 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
3817 | | |
3818 | | enum PskDecryptReturn { |
3819 | | PSK_DECRYPT_NONE = 0, |
3820 | | PSK_DECRYPT_OK, |
3821 | | PSK_DECRYPT_CREATE, |
3822 | | PSK_DECRYPT_FAIL |
3823 | | }; |
3824 | | |
3825 | | #ifdef HAVE_SESSION_TICKET |
3826 | | typedef struct psk_sess_free_cb_ctx { |
3827 | | word32 row; |
3828 | | #ifdef HAVE_EXT_CACHE |
3829 | | int extCache; |
3830 | | int freeSess; |
3831 | | #endif |
3832 | | } psk_sess_free_cb_ctx; |
3833 | | typedef void (psk_sess_free_cb)(const WOLFSSL* ssl, const WOLFSSL_SESSION* sess, |
3834 | | psk_sess_free_cb_ctx* freeCtx); |
3835 | | #endif |
3836 | | |
3837 | | /* The PreSharedKey extension information - entry in a linked list. */ |
3838 | | typedef struct PreSharedKey { |
3839 | | word16 identityLen; /* Length of identity */ |
3840 | | byte* identity; /* PSK identity */ |
3841 | | word32 ticketAge; /* Age of the ticket */ |
3842 | | byte cipherSuite0; /* Cipher Suite */ |
3843 | | byte cipherSuite; /* Cipher Suite */ |
3844 | | word32 binderLen; /* Length of HMAC */ |
3845 | | byte binder[WC_MAX_DIGEST_SIZE]; /* HMAC of handshake */ |
3846 | | byte hmac; /* HMAC algorithm */ |
3847 | | #ifdef HAVE_SESSION_TICKET |
3848 | | InternalTicket* it; /* ptr to ticket */ |
3849 | | const WOLFSSL_SESSION* sess; /* ptr to session either from external cache or |
3850 | | * into SessionCache. Work around so that we |
3851 | | * don't call into the cache more than once */ |
3852 | | psk_sess_free_cb* sess_free_cb; /* callback to free sess */ |
3853 | | psk_sess_free_cb_ctx sess_free_cb_ctx; /* info for sess_free_cb */ |
3854 | | #endif |
3855 | | byte resumption:1; /* Resumption PSK */ |
3856 | | byte chosen:1; /* Server's choice */ |
3857 | | byte decryptRet:3; /* Ticket decrypt return */ |
3858 | | struct PreSharedKey* next; /* List pointer */ |
3859 | | } PreSharedKey; |
3860 | | |
3861 | | WOLFSSL_LOCAL int TLSX_PreSharedKey_WriteBinders(PreSharedKey* list, |
3862 | | byte* output, byte msgType, |
3863 | | word16* pSz); |
3864 | | WOLFSSL_LOCAL int TLSX_PreSharedKey_GetSizeBinders(PreSharedKey* list, |
3865 | | byte msgType, word16* pSz); |
3866 | | WOLFSSL_LOCAL int TLSX_PreSharedKey_Use(TLSX** extensions, const byte* identity, |
3867 | | word16 len, word32 age, byte hmac, |
3868 | | byte cipherSuite0, byte cipherSuite, |
3869 | | byte resumption, |
3870 | | PreSharedKey **preSharedKey, |
3871 | | void* heap); |
3872 | | WOLFSSL_LOCAL int TLSX_PreSharedKey_Parse_ClientHello(TLSX** extensions, |
3873 | | const byte* input, word16 length, void* heap); |
3874 | | #if defined(WOLFSSL_CERT_WITH_EXTERN_PSK) && defined(WOLFSSL_TLS13) |
3875 | | WOLFSSL_LOCAL int TLSX_CertWithExternPsk_Use(WOLFSSL* ssl); |
3876 | | #endif |
3877 | | |
3878 | | /* The possible Pre-Shared Key key exchange modes. */ |
3879 | | enum PskKeyExchangeMode { |
3880 | | PSK_KE, |
3881 | | PSK_DHE_KE |
3882 | | }; |
3883 | | |
3884 | | /* User can define this. */ |
3885 | | #ifndef WOLFSSL_DEF_PSK_CIPHER |
3886 | | #define WOLFSSL_DEF_PSK_CIPHER TLS_AES_128_GCM_SHA256 |
3887 | | #endif |
3888 | | |
3889 | | WOLFSSL_LOCAL int TLSX_PskKeyModes_Use(WOLFSSL* ssl, byte modes); |
3890 | | WOLFSSL_LOCAL int TLSX_PskKeyModes_Parse_Modes(const byte* input, word16 length, |
3891 | | byte msgType, byte* modes); |
3892 | | |
3893 | | #ifdef WOLFSSL_EARLY_DATA |
3894 | | WOLFSSL_LOCAL int TLSX_EarlyData_Use(WOLFSSL* ssl, word32 max, int is_response); |
3895 | | #endif |
3896 | | #endif /* HAVE_SESSION_TICKET || !NO_PSK */ |
3897 | | |
3898 | | |
3899 | | /* The types of keys to derive for. */ |
3900 | | enum DeriveKeyType { |
3901 | | no_key, |
3902 | | early_data_key, |
3903 | | handshake_key, |
3904 | | traffic_key, |
3905 | | update_traffic_key |
3906 | | }; |
3907 | | |
3908 | | WOLFSSL_LOCAL int DeriveEarlySecret(WOLFSSL* ssl); |
3909 | | WOLFSSL_LOCAL int DeriveHandshakeSecret(WOLFSSL* ssl); |
3910 | | #ifdef WOLFSSL_API_PREFIX_MAP |
3911 | | #define DeriveTls13Keys wolfSSL_DeriveTls13Keys |
3912 | | #endif |
3913 | | WOLFSSL_TEST_VIS int DeriveTls13Keys(WOLFSSL* ssl, int secret, int side, int store); |
3914 | | WOLFSSL_LOCAL int DeriveMasterSecret(WOLFSSL* ssl); |
3915 | | WOLFSSL_LOCAL int DeriveResumptionPSK(WOLFSSL* ssl, byte* nonce, byte nonceLen, byte* secret); |
3916 | | WOLFSSL_LOCAL int DeriveResumptionSecret(WOLFSSL* ssl, byte* key); |
3917 | | |
3918 | | WOLFSSL_LOCAL int Tls13_Exporter(WOLFSSL* ssl, unsigned char *out, size_t outLen, |
3919 | | const char *label, size_t labelLen, |
3920 | | const unsigned char *context, size_t contextLen); |
3921 | | |
3922 | | /* The key update request values for KeyUpdate message. */ |
3923 | | enum KeyUpdateRequest { |
3924 | | update_not_requested, |
3925 | | update_requested |
3926 | | }; |
3927 | | #endif /* WOLFSSL_TLS13 */ |
3928 | | |
3929 | | #ifdef WOLFSSL_DTLS_CID |
3930 | | WOLFSSL_LOCAL void TLSX_ConnectionID_Free(byte* ext, void* heap); |
3931 | | WOLFSSL_LOCAL word16 TLSX_ConnectionID_Write(byte* ext, byte* output); |
3932 | | WOLFSSL_LOCAL word16 TLSX_ConnectionID_GetSize(byte* ext); |
3933 | | WOLFSSL_LOCAL int TLSX_ConnectionID_Use(WOLFSSL* ssl); |
3934 | | WOLFSSL_LOCAL int TLSX_ConnectionID_Parse(WOLFSSL* ssl, const byte* input, |
3935 | | word16 length, byte isRequest); |
3936 | | WOLFSSL_LOCAL void DtlsCIDOnExtensionsParsed(WOLFSSL* ssl); |
3937 | | WOLFSSL_LOCAL byte DtlsCIDCheck(WOLFSSL* ssl, const byte* input, |
3938 | | word16 inputSize); |
3939 | | WOLFSSL_LOCAL int DtlsCidReplaceTx(WOLFSSL* ssl, const byte* cid, byte size); |
3940 | | WOLFSSL_LOCAL int Dtls13UnifiedHeaderCIDPresent(byte flags); |
3941 | | #endif /* WOLFSSL_DTLS_CID */ |
3942 | | WOLFSSL_LOCAL byte DtlsGetCidTxSize(WOLFSSL* ssl); |
3943 | | WOLFSSL_LOCAL byte DtlsGetCidRxSize(WOLFSSL* ssl); |
3944 | | |
3945 | | #ifdef OPENSSL_EXTRA |
3946 | | enum SetCBIO { |
3947 | | WOLFSSL_CBIO_NONE = 0, |
3948 | | WOLFSSL_CBIO_RECV = 0x1, |
3949 | | WOLFSSL_CBIO_SEND = 0x2, |
3950 | | }; |
3951 | | #endif |
3952 | | |
3953 | | #ifdef WOLFSSL_STATIC_EPHEMERAL |
3954 | | /* contains static ephemeral keys */ |
3955 | | typedef struct { |
3956 | | #ifndef NO_DH |
3957 | | DerBuffer* dhKey; |
3958 | | #endif |
3959 | | #ifdef HAVE_ECC |
3960 | | DerBuffer* ecKey; |
3961 | | #endif |
3962 | | #ifdef HAVE_CURVE25519 |
3963 | | DerBuffer* x25519Key; |
3964 | | #endif |
3965 | | #ifdef HAVE_CURVE448 |
3966 | | DerBuffer* x448Key; |
3967 | | #endif |
3968 | | } StaticKeyExchangeInfo_t; |
3969 | | #endif /* WOLFSSL_STATIC_EPHEMERAL */ |
3970 | | |
3971 | | |
3972 | | /* wolfSSL context type */ |
3973 | | struct WOLFSSL_CTX { |
3974 | | WOLFSSL_METHOD* method; |
3975 | | #ifdef SINGLE_THREADED |
3976 | | WC_RNG* rng; /* to be shared with WOLFSSL w/o locking */ |
3977 | | #endif |
3978 | | wolfSSL_RefWithMutex ref; |
3979 | | int err; /* error code in case of mutex not created */ |
3980 | | #ifndef NO_DH |
3981 | | buffer serverDH_P; |
3982 | | buffer serverDH_G; |
3983 | | #endif |
3984 | | #ifndef NO_CERTS |
3985 | | DerBuffer* certificate; |
3986 | | DerBuffer* certChain; |
3987 | | int certChainCnt; |
3988 | | /* chain after self, in DER, with leading size for each cert */ |
3989 | | #ifndef WOLFSSL_NO_CA_NAMES |
3990 | | WOLF_STACK_OF(WOLFSSL_X509_NAME)* client_ca_names; |
3991 | | WOLF_STACK_OF(WOLFSSL_X509_NAME)* ca_names; |
3992 | | #endif |
3993 | | #ifdef OPENSSL_EXTRA |
3994 | | WOLF_STACK_OF(WOLFSSL_X509)* x509Chain; |
3995 | | #endif |
3996 | | #ifdef WOLFSSL_CERT_SETUP_CB |
3997 | | #ifdef OPENSSL_EXTRA |
3998 | | client_cert_cb CBClientCert; /* client certificate callback */ |
3999 | | #endif |
4000 | | CertSetupCallback certSetupCb; |
4001 | | void* certSetupCbArg; |
4002 | | #endif |
4003 | | DerBuffer* privateKey; |
4004 | | #ifdef WOLFSSL_BLIND_PRIVATE_KEY |
4005 | | DerBuffer* privateKeyMask; /* Mask of private key DER. */ |
4006 | | #endif |
4007 | | byte privateKeyType; |
4008 | | byte privateKeyId:1; |
4009 | | byte privateKeyLabel:1; |
4010 | | int privateKeySz; |
4011 | | int privateKeyDevId; |
4012 | | |
4013 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
4014 | | DerBuffer* altPrivateKey; |
4015 | | #ifdef WOLFSSL_BLIND_PRIVATE_KEY |
4016 | | DerBuffer* altPrivateKeyMask; /* Mask of alt private key DER. */ |
4017 | | #endif |
4018 | | byte altPrivateKeyType; |
4019 | | byte altPrivateKeyId:1; |
4020 | | byte altPrivateKeyLabel:1; |
4021 | | int altPrivateKeySz; |
4022 | | int altPrivateKeyDevId; |
4023 | | #endif /* WOLFSSL_DUAL_ALG_CERTS */ |
4024 | | #ifdef OPENSSL_ALL |
4025 | | /* note it is the privateKeyPKey pointer that is volatile, not the object it |
4026 | | * points to: |
4027 | | */ |
4028 | | WOLFSSL_EVP_PKEY* volatile privateKeyPKey; |
4029 | | #endif |
4030 | | WOLFSSL_CERT_MANAGER* cm; /* our cert manager, ctx owns SSL will use */ |
4031 | | #endif |
4032 | | #ifdef KEEP_OUR_CERT |
4033 | | WOLFSSL_X509* ourCert; /* keep alive a X509 struct of cert */ |
4034 | | int ownOurCert; /* Dispose of certificate if we own */ |
4035 | | #endif |
4036 | | Suites* suites; /* make dynamic, user may not need/set */ |
4037 | | void* heap; /* for user memory overrides */ |
4038 | | byte verifyDepth; |
4039 | | byte verifyPeer:1; |
4040 | | byte verifyNone:1; |
4041 | | byte failNoCert:1; |
4042 | | byte failNoCertxPSK:1; /* fail if no cert with the exception of PSK*/ |
4043 | | byte failNoPSK:1; /* fail if no PSK is negotiated */ |
4044 | | byte sessionCacheOff:1; |
4045 | | byte sessionCacheFlushOff:1; |
4046 | | #ifdef HAVE_EXT_CACHE |
4047 | | byte internalCacheOff:1; |
4048 | | byte internalCacheLookupOff:1; |
4049 | | #endif |
4050 | | byte sendVerify:2; /* for client side (can not be single bit) */ |
4051 | | byte haveRSA:1; /* RSA available */ |
4052 | | byte haveECC:1; /* ECC available */ |
4053 | | byte haveDH:1; /* server DH params set by user */ |
4054 | | byte haveECDSAsig:1; /* server cert signed w/ ECDSA */ |
4055 | | byte haveFalconSig:1; /* server cert signed w/ Falcon */ |
4056 | | byte haveMlDsaSig:1; /* server cert signed w/ ML-DSA */ |
4057 | | byte haveStaticECC:1; /* static server ECC private key */ |
4058 | | byte partialWrite:1; /* only one msg per write call */ |
4059 | | byte autoRetry:1; /* retry read/write on a WANT_{READ|WRITE} */ |
4060 | | byte quietShutdown:1; /* don't send close notify */ |
4061 | | byte groupMessages:1; /* group handshake messages before sending */ |
4062 | | byte minDowngrade; /* minimum downgrade version */ |
4063 | | byte haveEMS:1; /* have extended master secret extension */ |
4064 | | byte useClientOrder:1; /* Use client's cipher preference order */ |
4065 | | #if defined(HAVE_SESSION_TICKET) |
4066 | | byte noTicketTls12:1; /* TLS 1.2 server won't send ticket */ |
4067 | | #endif |
4068 | | #ifdef WOLFSSL_TLS13 |
4069 | | #if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER) |
4070 | | unsigned int maxTicketTls13; /* maximum number of tickets to send */ |
4071 | | #endif |
4072 | | byte noTicketTls13:1; /* TLS 1.3 Server won't create new Ticket */ |
4073 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
4074 | | byte noPskDheKe:1; /* Don't use (EC)DHE with PSK */ |
4075 | | #ifdef HAVE_SUPPORTED_CURVES |
4076 | | byte onlyPskDheKe:1; /* Only use (EC)DHE with PSK */ |
4077 | | #endif |
4078 | | #if defined(WOLFSSL_CERT_WITH_EXTERN_PSK) |
4079 | | byte certWithExternPsk:1; /* Use tls_cert_with_extern_psk extension */ |
4080 | | #endif |
4081 | | #endif |
4082 | | #endif /* WOLFSSL_TLS13 */ |
4083 | | byte mutualAuth:1; /* Mutual authentication required */ |
4084 | | #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) |
4085 | | byte postHandshakeAuth:1; /* Post-handshake auth supported. */ |
4086 | | byte verifyPostHandshake:1; /* Only send client cert req post |
4087 | | * handshake, not also during */ |
4088 | | #endif |
4089 | | #ifndef NO_DH |
4090 | | #if !defined(WOLFSSL_OLD_PRIME_CHECK) && !defined(HAVE_FIPS) && \ |
4091 | | !defined(HAVE_SELFTEST) |
4092 | | byte dhKeyTested:1; /* Set when key has been tested. */ |
4093 | | #endif |
4094 | | #endif |
4095 | | #if defined(HAVE_SECURE_RENEGOTIATION) || defined(HAVE_SERVER_RENEGOTIATION_INFO) |
4096 | | byte useSecureReneg:1; /* when set will set WOLFSSL objects generated to enable */ |
4097 | | #endif |
4098 | | #ifdef HAVE_ENCRYPT_THEN_MAC |
4099 | | byte disallowEncThenMac:1; /* Don't do Encrypt-Then-MAC */ |
4100 | | #endif |
4101 | | #ifdef WOLFSSL_STATIC_MEMORY |
4102 | | byte onHeapHint:1; /* whether the ctx/method is put on heap hint */ |
4103 | | #endif |
4104 | | #if defined(WOLFSSL_STATIC_EPHEMERAL) && !defined(SINGLE_THREADED) |
4105 | | byte staticKELockInit:1; |
4106 | | #endif |
4107 | | #if defined(WOLFSSL_DTLS) && defined(WOLFSSL_SCTP) |
4108 | | byte dtlsSctp:1; /* DTLS-over-SCTP mode */ |
4109 | | #endif |
4110 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
4111 | | byte disableECH:1; |
4112 | | byte enableEchTrialDecrypt:1; /* Trial decryption of the |
4113 | | inner hello */ |
4114 | | #endif |
4115 | | word16 minProto:1; /* sets min to min available */ |
4116 | | word16 maxProto:1; /* sets max to max available */ |
4117 | | #if defined(HAVE_RPK) |
4118 | | RpkConfig rpkConfig; |
4119 | | RpkState rpkState; |
4120 | | #endif /* HAVE_RPK */ |
4121 | | #ifdef WOLFSSL_SRTP |
4122 | | word16 dtlsSrtpProfiles; /* DTLS-with-SRTP mode |
4123 | | * (list of selected profiles - up to 16) */ |
4124 | | #endif |
4125 | | #if defined(WOLFSSL_DTLS) && defined(WOLFSSL_MULTICAST) |
4126 | | byte haveMcast; /* multicast requested */ |
4127 | | byte mcastID; /* multicast group ID */ |
4128 | | #endif |
4129 | | #if defined(WOLFSSL_DTLS) && \ |
4130 | | (defined(WOLFSSL_SCTP) || defined(WOLFSSL_DTLS_MTU)) |
4131 | | word16 dtlsMtuSz; /* DTLS MTU size */ |
4132 | | #endif |
4133 | | #ifndef NO_DH |
4134 | | word16 minDhKeySz; /* minimum DH key size */ |
4135 | | word16 maxDhKeySz; /* maximum DH key size */ |
4136 | | #endif |
4137 | | #ifndef NO_RSA |
4138 | | short minRsaKeySz; /* minimum RSA key size */ |
4139 | | #ifdef WC_RSA_PSS |
4140 | | word8 useRsaPss; /* cert supports RSA-PSS */ |
4141 | | #endif |
4142 | | #endif |
4143 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) |
4144 | | short minEccKeySz; /* minimum ECC key size */ |
4145 | | #endif |
4146 | | #ifdef HAVE_FALCON |
4147 | | short minFalconKeySz; /* minimum Falcon key size */ |
4148 | | #endif |
4149 | | #ifdef WOLFSSL_HAVE_MLDSA |
4150 | | short minMlDsaKeySz; /* minimum ML-DSA key size */ |
4151 | | #endif |
4152 | | unsigned long mask; /* store SSL_OP_ flags */ |
4153 | | #if defined(OPENSSL_EXTRA) || defined(HAVE_CURL) |
4154 | | word32 disabledCurves; /* curves disabled by user */ |
4155 | | #endif |
4156 | | #ifdef WOLFSSL_SESSION_ID_CTX |
4157 | | byte sessionCtx[ID_LEN]; /* app session context ID */ |
4158 | | byte sessionCtxSz; |
4159 | | #endif |
4160 | | #ifdef OPENSSL_EXTRA |
4161 | | const unsigned char *alpn_cli_protos;/* ALPN client protocol list */ |
4162 | | unsigned int alpn_cli_protos_len; |
4163 | | byte cbioFlag; /* WOLFSSL_CBIO_RECV/SEND: CBIORecv/Send is set */ |
4164 | | CallbackInfoState* CBIS; /* used to get info about SSL state */ |
4165 | | WOLFSSL_X509_VERIFY_PARAM* param; /* verification parameters*/ |
4166 | | #endif |
4167 | | #ifdef WOLFSSL_WOLFSENTRY_HOOKS |
4168 | | NetworkFilterCallback_t AcceptFilter; |
4169 | | void *AcceptFilter_arg; |
4170 | | NetworkFilterCallback_t ConnectFilter; |
4171 | | void *ConnectFilter_arg; |
4172 | | #endif /* WOLFSSL_WOLFSENTRY_HOOKS */ |
4173 | | CallbackIORecv CBIORecv; |
4174 | | CallbackIOSend CBIOSend; |
4175 | | #ifdef WOLFSSL_DTLS |
4176 | | CallbackGenCookie CBIOCookie; /* gen cookie callback */ |
4177 | | #endif /* WOLFSSL_DTLS */ |
4178 | | #ifdef WOLFSSL_SESSION_EXPORT |
4179 | | #ifdef WOLFSSL_DTLS |
4180 | | wc_dtls_export dtls_export; /* export function for DTLS session */ |
4181 | | #endif |
4182 | | CallbackGetPeer CBGetPeer; |
4183 | | CallbackSetPeer CBSetPeer; |
4184 | | #endif |
4185 | | VerifyCallback verifyCallback; /* cert verification callback */ |
4186 | | void* verifyCbCtx; /* cert verify callback user ctx*/ |
4187 | | #ifdef OPENSSL_ALL |
4188 | | CertVerifyCallback verifyCertCb; |
4189 | | void* verifyCertCbArg; |
4190 | | #endif /* OPENSSL_ALL */ |
4191 | | #ifdef OPENSSL_EXTRA |
4192 | | SSL_Msg_Cb protoMsgCb; /* inspect protocol message callback */ |
4193 | | void* protoMsgCtx; /* user set context with msg callback */ |
4194 | | #endif |
4195 | | word32 timeout; /* session timeout */ |
4196 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_CURVE25519) || \ |
4197 | | defined(HAVE_ED448) |
4198 | | word32 ecdhCurveOID; /* curve Ecc_Sum */ |
4199 | | #endif |
4200 | | #ifdef HAVE_ECC |
4201 | | word16 eccTempKeySz; /* in octets 20 - 66 */ |
4202 | | #endif |
4203 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \ |
4204 | | defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) |
4205 | | word32 pkCurveOID; /* curve Ecc_Sum */ |
4206 | | #endif |
4207 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
4208 | | byte havePSK; /* psk key set by user */ |
4209 | | wc_psk_client_callback client_psk_cb; /* client callback */ |
4210 | | wc_psk_server_callback server_psk_cb; /* server callback */ |
4211 | | #ifdef WOLFSSL_TLS13 |
4212 | | wc_psk_client_cs_callback client_psk_cs_cb; /* client callback */ |
4213 | | wc_psk_client_tls13_callback client_psk_tls13_cb; /* client callback */ |
4214 | | wc_psk_server_tls13_callback server_psk_tls13_cb; /* server callback */ |
4215 | | #endif |
4216 | | void* psk_ctx; |
4217 | | char server_hint[MAX_PSK_ID_LEN + NULL_TERM_LEN]; |
4218 | | #endif /* HAVE_SESSION_TICKET || !NO_PSK */ |
4219 | | #ifdef WOLFSSL_TLS13 |
4220 | | word16 group[WOLFSSL_MAX_GROUP_COUNT]; |
4221 | | byte numGroups; |
4222 | | #endif |
4223 | | #ifdef WOLFSSL_EARLY_DATA |
4224 | | word32 maxEarlyDataSz; |
4225 | | #endif |
4226 | | #ifdef HAVE_ANON |
4227 | | byte useAnon; /* User wants to allow Anon suites */ |
4228 | | #endif /* HAVE_ANON */ |
4229 | | #ifdef WOLFSSL_ENCRYPTED_KEYS |
4230 | | wc_pem_password_cb* passwd_cb; |
4231 | | void* passwd_userdata; |
4232 | | #endif |
4233 | | #ifdef WOLFSSL_LOCAL_X509_STORE |
4234 | | WOLFSSL_X509_STORE x509_store; /* points to ctx->cm */ |
4235 | | WOLFSSL_X509_STORE* x509_store_pt; /* take ownership of external store */ |
4236 | | #endif |
4237 | | #if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL) |
4238 | | byte readAhead; |
4239 | | void* userPRFArg; /* passed to prf callback */ |
4240 | | #endif |
4241 | | #ifdef HAVE_EX_DATA |
4242 | | WOLFSSL_CRYPTO_EX_DATA ex_data; |
4243 | | #endif |
4244 | | #if defined(HAVE_ALPN) && (defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || \ |
4245 | | defined(WOLFSSL_HAPROXY) || defined(HAVE_LIGHTY) || defined(WOLFSSL_QUIC)) |
4246 | | CallbackALPNSelect alpnSelect; |
4247 | | void* alpnSelectArg; |
4248 | | #endif |
4249 | | #ifdef HAVE_SNI |
4250 | | CallbackSniRecv sniRecvCb; |
4251 | | void* sniRecvCbArg; |
4252 | | #endif |
4253 | | #if defined(WOLFSSL_MULTICAST) && defined(WOLFSSL_DTLS) |
4254 | | CallbackMcastHighwater mcastHwCb; /* Sequence number highwater callback */ |
4255 | | word32 mcastFirstSeq; /* first trigger level */ |
4256 | | word32 mcastSecondSeq; /* second trigger level */ |
4257 | | word32 mcastMaxSeq; /* max level */ |
4258 | | #endif |
4259 | | #ifdef HAVE_OCSP |
4260 | | WOLFSSL_OCSP ocsp; |
4261 | | #endif |
4262 | | int devId; /* async device id to use */ |
4263 | | #ifdef HAVE_TLS_EXTENSIONS |
4264 | | TLSX* extensions; /* RFC 6066 TLS Extensions data */ |
4265 | | #ifndef NO_WOLFSSL_SERVER |
4266 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ |
4267 | | || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) |
4268 | | OcspRequest* certOcspRequest; |
4269 | | ocspVerifyStatusCb ocspStatusVerifyCb; |
4270 | | void* ocspStatusVerifyCbArg; |
4271 | | #endif |
4272 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) |
4273 | | OcspRequest* chainOcspRequest[MAX_CHAIN_DEPTH]; |
4274 | | #endif |
4275 | | #endif |
4276 | | #if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER) |
4277 | | SessionTicketEncCb ticketEncCb; /* enc/dec session ticket Cb */ |
4278 | | void* ticketEncCtx; /* session encrypt context */ |
4279 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) \ |
4280 | | || defined(OPENSSL_EXTRA) || defined(HAVE_LIGHTY) |
4281 | | ticketCompatCb ticketEncWrapCb; /* callback for OpenSSL ticket key callback */ |
4282 | | #endif |
4283 | | int ticketHint; /* ticket hint in seconds */ |
4284 | | #ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB |
4285 | | TicketEncCbCtx ticketKeyCtx; |
4286 | | #endif |
4287 | | #endif |
4288 | | #endif |
4289 | | #ifdef HAVE_SUPPORTED_CURVES |
4290 | | byte userCurves; /* indicates user called wolfSSL_CTX_UseSupportedCurve */ |
4291 | | #endif |
4292 | | #ifdef ATOMIC_USER |
4293 | | CallbackMacEncrypt MacEncryptCb; /* Atomic User Mac/Encrypt Cb */ |
4294 | | CallbackDecryptVerify DecryptVerifyCb; /* Atomic User Decrypt/Verify Cb */ |
4295 | | #ifdef HAVE_ENCRYPT_THEN_MAC |
4296 | | CallbackEncryptMac EncryptMacCb; /* Atomic User Mac/Enc Cb */ |
4297 | | CallbackVerifyDecrypt VerifyDecryptCb; /* Atomic User Dec/Verify Cb */ |
4298 | | #endif |
4299 | | #endif |
4300 | | #ifdef HAVE_PK_CALLBACKS |
4301 | | #ifdef HAVE_ECC |
4302 | | CallbackEccKeyGen EccKeyGenCb; /* User EccKeyGen Callback Handler */ |
4303 | | CallbackEccSign EccSignCb; /* User EccSign Callback handler */ |
4304 | | void* EccSignCtx; /* Ecc Sign Callback Context */ |
4305 | | CallbackEccVerify EccVerifyCb; /* User EccVerify Callback handler */ |
4306 | | CallbackEccSharedSecret EccSharedSecretCb; /* User EccVerify Callback handler */ |
4307 | | #endif /* HAVE_ECC */ |
4308 | | #ifdef HAVE_HKDF |
4309 | | CallbackHKDFExtract HkdfExtractCb; /* User hkdf Extract Callback handler */ |
4310 | | #endif |
4311 | | #ifdef HAVE_ED25519 |
4312 | | /* User Ed25519Sign Callback handler */ |
4313 | | CallbackEd25519Sign Ed25519SignCb; |
4314 | | /* User Ed25519Verify Callback handler */ |
4315 | | CallbackEd25519Verify Ed25519VerifyCb; |
4316 | | #endif |
4317 | | #ifdef HAVE_CURVE25519 |
4318 | | /* User X25519 KeyGen Callback Handler */ |
4319 | | CallbackX25519KeyGen X25519KeyGenCb; |
4320 | | /* User X25519 SharedSecret Callback handler */ |
4321 | | CallbackX25519SharedSecret X25519SharedSecretCb; |
4322 | | #endif |
4323 | | #ifdef HAVE_ED448 |
4324 | | /* User Ed448Sign Callback handler */ |
4325 | | CallbackEd448Sign Ed448SignCb; |
4326 | | /* User Ed448Verify Callback handler */ |
4327 | | CallbackEd448Verify Ed448VerifyCb; |
4328 | | #endif |
4329 | | #ifdef HAVE_CURVE448 |
4330 | | /* User X448 KeyGen Callback Handler */ |
4331 | | CallbackX448KeyGen X448KeyGenCb; |
4332 | | /* User X448 SharedSecret Callback handler */ |
4333 | | CallbackX448SharedSecret X448SharedSecretCb; |
4334 | | #endif |
4335 | | #ifndef NO_DH |
4336 | | /* User DH KeyGen Callback handler*/ |
4337 | | CallbackDhGenerateKeyPair DhGenerateKeyPairCb; |
4338 | | /* User DH Agree Callback handler */ |
4339 | | CallbackDhAgree DhAgreeCb; |
4340 | | #endif |
4341 | | #ifndef NO_RSA |
4342 | | /* User RsaSign Callback handler (priv key) */ |
4343 | | CallbackRsaSign RsaSignCb; |
4344 | | /* User RsaVerify Callback handler (pub key) */ |
4345 | | CallbackRsaVerify RsaVerifyCb; |
4346 | | /* User VerifyRsaSign Callback handler (priv key) */ |
4347 | | CallbackRsaVerify RsaSignCheckCb; |
4348 | | #ifdef WC_RSA_PSS |
4349 | | /* User RsaSign (priv key) */ |
4350 | | CallbackRsaPssSign RsaPssSignCb; |
4351 | | /* User RsaVerify (pub key) */ |
4352 | | CallbackRsaPssVerify RsaPssVerifyCb; |
4353 | | /* User VerifyRsaSign (priv key) */ |
4354 | | CallbackRsaPssVerify RsaPssSignCheckCb; |
4355 | | #endif |
4356 | | CallbackRsaEnc RsaEncCb; /* User Rsa Public Encrypt handler */ |
4357 | | CallbackRsaDec RsaDecCb; /* User Rsa Private Decrypt handler */ |
4358 | | #endif /* NO_RSA */ |
4359 | | |
4360 | | /* User generate pre-master handler */ |
4361 | | CallbackGenPreMaster GenPreMasterCb; |
4362 | | /* User generate master secret handler */ |
4363 | | CallbackGenMasterSecret GenMasterCb; |
4364 | | /* User generate Extended master secret handler */ |
4365 | | CallbackGenExtMasterSecret GenExtMasterCb; |
4366 | | /* User generate session key handler */ |
4367 | | CallbackGenSessionKey GenSessionKeyCb; |
4368 | | /* User setting encrypt keys handler */ |
4369 | | CallbackEncryptKeys EncryptKeysCb; |
4370 | | /* User Tls finished handler */ |
4371 | | CallbackTlsFinished TlsFinishedCb; |
4372 | | #if !defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_AEAD_ONLY) |
4373 | | /* User Verify mac handler */ |
4374 | | CallbackVerifyMac VerifyMacCb; |
4375 | | #endif |
4376 | | #if defined(WOLFSSL_PUBLIC_ASN) |
4377 | | /* User handler to process a certificate */ |
4378 | | CallbackProcessPeerCert ProcessPeerCertCb; |
4379 | | #endif |
4380 | | /* User handler to process the server's key exchange public key */ |
4381 | | CallbackProcessServerSigKex ProcessServerSigKexCb; |
4382 | | /* User handler to process the TLS record */ |
4383 | | CallbackPerformTlsRecordProcessing PerformTlsRecordProcessingCb; |
4384 | | /* User handler to do HKDF expansions */ |
4385 | | CallbackHKDFExpandLabel HKDFExpandLabelCb; |
4386 | | |
4387 | | #endif /* HAVE_PK_CALLBACKS */ |
4388 | | #ifdef HAVE_WOLF_EVENT |
4389 | | WOLF_EVENT_QUEUE event_queue; |
4390 | | #endif /* HAVE_WOLF_EVENT */ |
4391 | | #ifdef HAVE_EXT_CACHE |
4392 | | WOLFSSL_SESSION*(*get_sess_cb)(WOLFSSL*, const unsigned char*, int, int*); |
4393 | | int (*new_sess_cb)(WOLFSSL*, WOLFSSL_SESSION*); |
4394 | | #endif |
4395 | | #if defined(HAVE_EXT_CACHE) || defined(HAVE_EX_DATA) |
4396 | | Rem_Sess_Cb rem_sess_cb; |
4397 | | #endif |
4398 | | #if defined(OPENSSL_EXTRA) && defined(WOLFCRYPT_HAVE_SRP) && !defined(NO_SHA256) |
4399 | | Srp* srp; /* TLS Secure Remote Password Protocol*/ |
4400 | | byte* srp_password; |
4401 | | #endif |
4402 | | #if defined(OPENSSL_EXTRA) && defined(HAVE_SECRET_CALLBACK) |
4403 | | wolfSSL_CTX_keylog_cb_func keyLogCb; |
4404 | | #endif /* OPENSSL_EXTRA && HAVE_SECRET_CALLBACK */ |
4405 | | #ifdef WOLFSSL_STATIC_EPHEMERAL |
4406 | | StaticKeyExchangeInfo_t staticKE; |
4407 | | #ifndef SINGLE_THREADED |
4408 | | wolfSSL_Mutex staticKELock; |
4409 | | #endif |
4410 | | #endif |
4411 | | #ifdef WOLFSSL_QUIC |
4412 | | struct { |
4413 | | const WOLFSSL_QUIC_METHOD *method; |
4414 | | } quic; |
4415 | | #endif |
4416 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
4417 | | WOLFSSL_EchConfig* echConfigs; |
4418 | | #endif |
4419 | | #if defined(__APPLE__) && defined(WOLFSSL_SYS_CA_CERTS) |
4420 | | byte doAppleNativeCertValidationFlag:1; |
4421 | | #endif /* defined(__APPLE__) && defined(WOLFSSL_SYS_CA_CERTS) */ |
4422 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
4423 | | byte *sigSpec; |
4424 | | word16 sigSpecSz; |
4425 | | #endif |
4426 | | #if defined(WOLFSSL_SYS_CRYPTO_POLICY) |
4427 | | int secLevel; /* The security level of system-wide crypto policy. */ |
4428 | | #endif /* WOLFSSL_SYS_CRYPTO_POLICY */ |
4429 | | |
4430 | | #ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION |
4431 | | CFMutableArrayRef testTrustedCAs; |
4432 | | #endif /* WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION */ |
4433 | | }; |
4434 | | |
4435 | | WOLFSSL_LOCAL |
4436 | | int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method, void* heap); |
4437 | | WOLFSSL_LOCAL |
4438 | | void FreeSSL_Ctx(WOLFSSL_CTX* ctx); |
4439 | | WOLFSSL_LOCAL |
4440 | | void SSL_CtxResourceFree(WOLFSSL_CTX* ctx); |
4441 | | |
4442 | | #ifdef HAVE_EX_DATA_CLEANUP_HOOKS |
4443 | | #ifndef HAVE_EX_DATA |
4444 | | #error "HAVE_EX_DATA_CLEANUP_HOOKS requires HAVE_EX_DATA to be defined" |
4445 | | #endif |
4446 | | void wolfSSL_CRYPTO_cleanup_ex_data(WOLFSSL_CRYPTO_EX_DATA* ex_data); |
4447 | | #endif |
4448 | | |
4449 | | WOLFSSL_LOCAL |
4450 | | int DeriveTlsKeys(WOLFSSL* ssl); |
4451 | | WOLFSSL_LOCAL |
4452 | | int ProcessOldClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx, |
4453 | | word32 inSz, word16 sz); |
4454 | | |
4455 | | #ifndef NO_CERTS |
4456 | | WOLFSSL_LOCAL int AddSigner(WOLFSSL_CERT_MANAGER* cm, Signer *s); |
4457 | | WOLFSSL_LOCAL |
4458 | | int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify); |
4459 | | WOLFSSL_LOCAL int RemoveCA(WOLFSSL_CERT_MANAGER* cm, byte* hash, int type); |
4460 | | WOLFSSL_LOCAL int SetCAType(WOLFSSL_CERT_MANAGER* cm, byte* hash, int type); |
4461 | | WOLFSSL_LOCAL |
4462 | | int AlreadySigner(WOLFSSL_CERT_MANAGER* cm, byte* hash); |
4463 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
4464 | | WOLFSSL_LOCAL |
4465 | | int AddTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int verify); |
4466 | | WOLFSSL_LOCAL |
4467 | | int AlreadyTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DecodedCert* cert); |
4468 | | #endif |
4469 | | #endif |
4470 | | |
4471 | | #ifdef WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION |
4472 | | WOLFSSL_API |
4473 | | int wolfSSL_TestAppleNativeCertValidation_AppendCA(WOLFSSL_CTX* ctx, |
4474 | | const byte* derCert, |
4475 | | int derLen); |
4476 | | #endif /* WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION */ |
4477 | | |
4478 | | /* All cipher suite related info |
4479 | | * Keep as a constant size (no ifdefs) for session export */ |
4480 | | typedef struct CipherSpecs { |
4481 | | word16 key_size; |
4482 | | word16 iv_size; |
4483 | | word16 block_size; |
4484 | | word16 aead_mac_size; |
4485 | | byte bulk_cipher_algorithm; |
4486 | | byte cipher_type; /* block, stream, or aead */ |
4487 | | byte mac_algorithm; |
4488 | | byte kea; /* key exchange algo */ |
4489 | | byte sig_algo; |
4490 | | byte hash_size; |
4491 | | byte pad_size; |
4492 | | byte static_ecdh; |
4493 | | } CipherSpecs; |
4494 | | |
4495 | | |
4496 | | void InitCipherSpecs(CipherSpecs* cs); |
4497 | | |
4498 | | |
4499 | | /* Supported Key Exchange Protocols */ |
4500 | | enum KeyExchangeAlgorithm { |
4501 | | no_kea, |
4502 | | rsa_kea, |
4503 | | diffie_hellman_kea, |
4504 | | fortezza_kea, |
4505 | | psk_kea, |
4506 | | dhe_psk_kea, |
4507 | | ecdhe_psk_kea, |
4508 | | ecc_diffie_hellman_kea, |
4509 | | ecc_static_diffie_hellman_kea, /* for verify suite only */ |
4510 | | any_kea |
4511 | | }; |
4512 | | |
4513 | | /* Used with InitSuitesHashSigAlgo */ |
4514 | 0 | #define SIG_ECDSA 0x01 |
4515 | 0 | #define SIG_RSA 0x02 |
4516 | 0 | #define SIG_SM2 0x04 |
4517 | 0 | #define SIG_FALCON 0x08 |
4518 | 0 | #define SIG_MLDSA 0x10 |
4519 | | #define SIG_ANON 0x20 |
4520 | | /* SIG_ANON is omitted by default */ |
4521 | 0 | #define SIG_ALL (SIG_ECDSA | SIG_RSA | SIG_SM2 | SIG_FALCON | \ |
4522 | 0 | SIG_MLDSA) |
4523 | | |
4524 | | /* Supported Authentication Schemes */ |
4525 | | enum SignatureAlgorithm { |
4526 | | anonymous_sa_algo = 0, |
4527 | | rsa_sa_algo = 1, |
4528 | | dsa_sa_algo = 2, |
4529 | | ecc_dsa_sa_algo = 3, |
4530 | | rsa_pss_sa_algo = 8, |
4531 | | ed25519_sa_algo = 9, |
4532 | | rsa_pss_pss_algo = 10, |
4533 | | ed448_sa_algo = 11, |
4534 | | falcon_level1_sa_algo = 12, |
4535 | | falcon_level5_sa_algo = 13, |
4536 | | mldsa_44_sa_algo = 14, |
4537 | | mldsa_65_sa_algo = 15, |
4538 | | mldsa_87_sa_algo = 16, |
4539 | | sm2_sa_algo = 17, |
4540 | | any_sa_algo = 18, |
4541 | | ecc_brainpool_sa_algo = 19, |
4542 | | invalid_sa_algo = 255 |
4543 | | }; |
4544 | | |
4545 | | #define PSS_RSAE_TO_PSS_PSS(macAlgo) \ |
4546 | | ((macAlgo) + (pss_sha256 - sha256_mac)) |
4547 | | |
4548 | | #define PSS_PSS_HASH_TO_MAC(macAlgo) \ |
4549 | | ((macAlgo) - (pss_sha256 - sha256_mac)) |
4550 | | |
4551 | | enum SigAlgRsaPss { |
4552 | | pss_sha256 = 0x09, |
4553 | | pss_sha384 = 0x0a, |
4554 | | pss_sha512 = 0x0b |
4555 | | }; |
4556 | | |
4557 | | #ifdef WOLFSSL_SM2 |
4558 | | /* Default SM2 signature ID. */ |
4559 | 0 | #define TLS12_SM2_SIG_ID ((byte*)"1234567812345678") |
4560 | | /* Length of default SM2 signature ID. */ |
4561 | 0 | #define TLS12_SM2_SIG_ID_SZ 16 |
4562 | | |
4563 | | /* https://www.rfc-editor.org/rfc/rfc8998.html#name-sm2-signature-scheme */ |
4564 | | /* ID to use when signing/verifying TLS v1.3 data. */ |
4565 | 0 | #define TLS13_SM2_SIG_ID ((byte*)"TLSv1.3+GM+Cipher+Suite") |
4566 | | /* Length of ID to use when signing/verifying TLS v1.3 data. */ |
4567 | 0 | #define TLS13_SM2_SIG_ID_SZ 23 |
4568 | | #endif |
4569 | | |
4570 | | /* Supported ECC Curve Types */ |
4571 | | enum EccCurves { |
4572 | | named_curve = 3 |
4573 | | }; |
4574 | | |
4575 | | |
4576 | | /* Valid client certificate request types from page 27 */ |
4577 | | enum ClientCertificateType { |
4578 | | rsa_sign = 1, |
4579 | | dss_sign = 2, |
4580 | | rsa_fixed_dh = 3, |
4581 | | dss_fixed_dh = 4, |
4582 | | rsa_ephemeral_dh = 5, |
4583 | | dss_ephemeral_dh = 6, |
4584 | | fortezza_kea_cert = 20, |
4585 | | ecdsa_sign = 64, |
4586 | | rsa_fixed_ecdh = 65, |
4587 | | ecdsa_fixed_ecdh = 66, |
4588 | | falcon_sign = 67, |
4589 | | mldsa_sign = 68 |
4590 | | }; |
4591 | | |
4592 | | /* Maximum number of ClientCertificateType bytes the server emits in a |
4593 | | * CertificateRequest. Currently rsa_sign and ecdsa_sign. */ |
4594 | | #define MAX_CERT_REQ_CERT_TYPE_CNT 2 |
4595 | | |
4596 | | |
4597 | | #ifndef WOLFSSL_AEAD_ONLY |
4598 | | enum CipherType { stream, block, aead }; |
4599 | | #else |
4600 | | enum CipherType { aead }; |
4601 | | #endif |
4602 | | |
4603 | | |
4604 | | #if defined(BUILD_AES) || defined(BUILD_AESGCM) || defined(HAVE_ARIA) || \ |
4605 | | (defined(HAVE_CHACHA) && defined(HAVE_POLY1305)) || defined(WOLFSSL_TLS13) |
4606 | | #define CIPHER_NONCE |
4607 | | #endif |
4608 | | |
4609 | | #if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION) |
4610 | | enum CipherSrc { |
4611 | | KEYS_NOT_SET = 0, |
4612 | | KEYS, /* keys from ssl->keys are loaded */ |
4613 | | SCR /* keys from ssl->secure_renegotiation->tmp_keys are loaded */ |
4614 | | }; |
4615 | | #endif |
4616 | | |
4617 | | #ifdef WOLFSSL_CIPHER_TEXT_CHECK |
4618 | | #ifndef WOLFSSL_CIPHER_CHECK_SZ |
4619 | | /* 64-bits to confirm encrypt operation worked */ |
4620 | | #define WOLFSSL_CIPHER_CHECK_SZ 8 |
4621 | | #endif |
4622 | | #endif |
4623 | | |
4624 | | /* cipher for now */ |
4625 | | typedef struct Ciphers { |
4626 | | #ifdef BUILD_ARC4 |
4627 | | Arc4* arc4; |
4628 | | #endif |
4629 | | #ifdef BUILD_DES3 |
4630 | | Des3* des3; |
4631 | | #endif |
4632 | | #if defined(BUILD_AES) || defined(BUILD_AESGCM) |
4633 | | Aes* aes; |
4634 | | #endif |
4635 | | #if (defined(BUILD_AESGCM) || defined(HAVE_AESCCM)) && !defined(WOLFSSL_NO_TLS12) |
4636 | | byte* additional; |
4637 | | #endif |
4638 | | #ifdef HAVE_ARIA |
4639 | | wc_Aria* aria; |
4640 | | #endif |
4641 | | #ifdef CIPHER_NONCE |
4642 | | byte* nonce; |
4643 | | #endif |
4644 | | #ifdef HAVE_CAMELLIA |
4645 | | wc_Camellia* cam; |
4646 | | #endif |
4647 | | #ifdef HAVE_CHACHA |
4648 | | ChaCha* chacha; |
4649 | | #endif |
4650 | | #ifdef WOLFSSL_SM4 |
4651 | | wc_Sm4* sm4; |
4652 | | #endif |
4653 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER) && !defined(NO_HMAC) |
4654 | | Hmac* hmac; |
4655 | | #endif |
4656 | | #ifdef WOLFSSL_CIPHER_TEXT_CHECK |
4657 | | word32 sanityCheck[WOLFSSL_CIPHER_CHECK_SZ/sizeof(word32)]; |
4658 | | #endif |
4659 | | byte state; |
4660 | | byte setup; /* have we set it up flag for detection */ |
4661 | | #if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION) |
4662 | | enum CipherSrc src; /* DTLS uses this to determine which keys |
4663 | | * are currently loaded */ |
4664 | | #endif |
4665 | | } Ciphers; |
4666 | | |
4667 | | #ifdef WOLFSSL_DTLS13 |
4668 | | typedef struct RecordNumberCiphers { |
4669 | | #if defined(BUILD_AES) || defined(BUILD_AESGCM) |
4670 | | Aes *aes; |
4671 | | #endif /* BUILD_AES || BUILD_AESGCM */ |
4672 | | #ifdef HAVE_CHACHA |
4673 | | ChaCha *chacha; |
4674 | | #endif |
4675 | | } RecordNumberCiphers; |
4676 | | #endif /* WOLFSSL_DTLS13 */ |
4677 | | |
4678 | | #ifdef HAVE_ONE_TIME_AUTH |
4679 | | /* Ciphers for one time authentication such as poly1305 */ |
4680 | | typedef struct OneTimeAuth { |
4681 | | #ifdef HAVE_POLY1305 |
4682 | | Poly1305* poly1305; |
4683 | | #endif |
4684 | | byte setup; /* flag for if a cipher has been set */ |
4685 | | |
4686 | | } OneTimeAuth; |
4687 | | #endif |
4688 | | |
4689 | | |
4690 | | WOLFSSL_LOCAL void InitCiphers(WOLFSSL* ssl); |
4691 | | WOLFSSL_LOCAL void FreeCiphers(WOLFSSL* ssl); |
4692 | | |
4693 | | |
4694 | | /* hashes type */ |
4695 | | typedef struct Hashes { |
4696 | | #if !defined(NO_MD5) && !defined(NO_OLD_TLS) |
4697 | | byte md5[WC_MD5_DIGEST_SIZE]; |
4698 | | #endif |
4699 | | #if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \ |
4700 | | defined(WOLFSSL_ALLOW_TLS_SHA1)) |
4701 | | byte sha[WC_SHA_DIGEST_SIZE]; |
4702 | | #endif |
4703 | | #ifndef NO_SHA256 |
4704 | | byte sha256[WC_SHA256_DIGEST_SIZE]; |
4705 | | #endif |
4706 | | #ifdef WOLFSSL_SHA384 |
4707 | | byte sha384[WC_SHA384_DIGEST_SIZE]; |
4708 | | #endif |
4709 | | #ifdef WOLFSSL_SHA512 |
4710 | | byte sha512[WC_SHA512_DIGEST_SIZE]; |
4711 | | #endif |
4712 | | #ifdef WOLFSSL_SM3 |
4713 | | byte sm3[WC_SM3_DIGEST_SIZE]; |
4714 | | #endif |
4715 | | } Hashes; |
4716 | | |
4717 | | WOLFSSL_LOCAL int BuildCertHashes(const WOLFSSL* ssl, Hashes* hashes); |
4718 | | |
4719 | | #ifdef WOLFSSL_TLS13 |
4720 | | typedef union Digest { |
4721 | | #ifndef NO_SHA256 |
4722 | | wc_Sha256 sha256; |
4723 | | #endif |
4724 | | #ifdef WOLFSSL_SHA384 |
4725 | | wc_Sha384 sha384; |
4726 | | #endif |
4727 | | #ifdef WOLFSSL_SHA512 |
4728 | | wc_Sha512 sha512; |
4729 | | #endif |
4730 | | #ifdef WOLFSSL_SM3 |
4731 | | wc_Sm3 sm3; |
4732 | | #endif |
4733 | | } Digest; |
4734 | | #endif |
4735 | | |
4736 | | /* Static x509 buffer */ |
4737 | | typedef struct x509_buffer { |
4738 | | int length; /* actual size */ |
4739 | | byte buffer[MAX_X509_SIZE]; /* max static cert size */ |
4740 | | } x509_buffer; |
4741 | | |
4742 | | |
4743 | | /* wolfSSL X509_CHAIN, for no dynamic memory SESSION_CACHE */ |
4744 | | struct WOLFSSL_X509_CHAIN { |
4745 | | int count; /* total number in chain */ |
4746 | | x509_buffer certs[MAX_CHAIN_DEPTH]; /* only allow max depth 4 for now */ |
4747 | | }; |
4748 | | |
4749 | | typedef enum WOLFSSL_SESSION_TYPE { |
4750 | | WOLFSSL_SESSION_TYPE_UNKNOWN, |
4751 | | WOLFSSL_SESSION_TYPE_SSL, /* in ssl->session */ |
4752 | | WOLFSSL_SESSION_TYPE_CACHE, /* pointer to internal cache */ |
4753 | | WOLFSSL_SESSION_TYPE_HEAP /* allocated from heap SESSION_new */ |
4754 | | } WOLFSSL_SESSION_TYPE; |
4755 | | |
4756 | | #ifdef WOLFSSL_QUIC |
4757 | | typedef struct QuicRecord QuicRecord; |
4758 | | typedef struct QuicRecord { |
4759 | | struct QuicRecord *next; |
4760 | | uint8_t *data; |
4761 | | word32 capacity; |
4762 | | word32 len; |
4763 | | word32 start; |
4764 | | word32 end; |
4765 | | WOLFSSL_ENCRYPTION_LEVEL level; |
4766 | | word32 rec_hdr_remain; |
4767 | | } QuicEncData; |
4768 | | |
4769 | | typedef struct QuicTransportParam QuicTransportParam; |
4770 | | struct QuicTransportParam { |
4771 | | const uint8_t *data; |
4772 | | word16 len; |
4773 | | }; |
4774 | | |
4775 | | WOLFSSL_LOCAL const QuicTransportParam *QuicTransportParam_new(const uint8_t *data, size_t len, void *heap); |
4776 | | WOLFSSL_LOCAL const QuicTransportParam *QuicTransportParam_dup(const QuicTransportParam *tp, void *heap); |
4777 | | WOLFSSL_LOCAL void QuicTransportParam_free(const QuicTransportParam *tp, void *heap); |
4778 | | WOLFSSL_LOCAL int TLSX_QuicTP_Use(WOLFSSL* ssl, TLSX_Type ext_type, int is_response); |
4779 | | WOLFSSL_LOCAL int wolfSSL_quic_add_transport_extensions(WOLFSSL *ssl, int msg_type); |
4780 | | |
4781 | | #define QTP_FREE QuicTransportParam_free |
4782 | | |
4783 | | #endif /* WOLFSSL_QUIC */ |
4784 | | |
4785 | | /** Session Ticket - RFC 5077 (session 3.2) */ |
4786 | | #if defined(WOLFSSL_TLS13) && (defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)) |
4787 | | /* Ticket nonce - for deriving PSK. |
4788 | | Length allowed to be: 1..255. Only support |
4789 | | * TLS13_TICKET_NONCE_STATIC_SZ length bytes. |
4790 | | */ |
4791 | | typedef struct TicketNonce { |
4792 | | byte len; |
4793 | | #if defined(WOLFSSL_TICKET_NONCE_MALLOC) && \ |
4794 | | (!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3))) |
4795 | | byte *data; |
4796 | | byte dataStatic[MAX_TICKET_NONCE_STATIC_SZ]; |
4797 | | #else |
4798 | | byte data[MAX_TICKET_NONCE_STATIC_SZ]; |
4799 | | #endif /* WOLFSSL_TICKET_NONCE_MALLOC && FIPS_VERSION_GE(5,3) */ |
4800 | | } TicketNonce; |
4801 | | #endif |
4802 | | |
4803 | | /* wolfSSL session type */ |
4804 | | struct WOLFSSL_SESSION { |
4805 | | /* WARNING Do not add fields here. They will be ignored in |
4806 | | * wolfSSL_DupSession. */ |
4807 | | WOLFSSL_SESSION_TYPE type; |
4808 | | #ifndef NO_SESSION_CACHE |
4809 | | int cacheRow; /* row in session cache */ |
4810 | | #endif |
4811 | | wolfSSL_Ref ref; |
4812 | | byte altSessionID[ID_LEN]; |
4813 | | byte haveAltSessionID:1; |
4814 | | #ifdef HAVE_EX_DATA |
4815 | | byte ownExData:1; |
4816 | | #endif |
4817 | | #if defined(HAVE_EXT_CACHE) || defined(HAVE_EX_DATA) |
4818 | | Rem_Sess_Cb rem_sess_cb; |
4819 | | #endif |
4820 | | void* heap; |
4821 | | /* WARNING The above fields (up to and including the heap) are not copied |
4822 | | * in wolfSSL_DupSession. Place new fields after the heap |
4823 | | * member */ |
4824 | | |
4825 | | byte side; /* Either WOLFSSL_CLIENT_END or |
4826 | | WOLFSSL_SERVER_END */ |
4827 | | |
4828 | | word32 bornOn; /* create time in seconds */ |
4829 | | word32 timeout; /* timeout in seconds */ |
4830 | | |
4831 | | byte sessionID[ID_LEN]; /* id for protocol or bogus |
4832 | | * ID for TLS 1.3 */ |
4833 | | byte sessionIDSz; |
4834 | | |
4835 | | byte masterSecret[SECRET_LEN]; /* stored secret */ |
4836 | | word16 haveEMS; /* ext master secret flag */ |
4837 | | #if defined(SESSION_CERTS) && defined(OPENSSL_EXTRA) |
4838 | | WOLFSSL_X509* peer; /* peer cert */ |
4839 | | #endif |
4840 | | ProtocolVersion version; /* which version was used */ |
4841 | | #if defined(SESSION_CERTS) || !defined(NO_RESUME_SUITE_CHECK) || \ |
4842 | | (defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET)) |
4843 | | byte cipherSuite0; /* first byte, normally 0 */ |
4844 | | byte cipherSuite; /* 2nd byte, actual suite */ |
4845 | | #endif |
4846 | | #ifndef NO_CLIENT_CACHE |
4847 | | word16 idLen; /* serverID length */ |
4848 | | byte serverID[SERVER_ID_LEN]; /* for easier client lookup */ |
4849 | | #endif |
4850 | | #ifdef WOLFSSL_SESSION_ID_CTX |
4851 | | byte sessionCtxSz; /* sessionCtx length */ |
4852 | | byte sessionCtx[ID_LEN]; /* app specific context id */ |
4853 | | #endif /* WOLFSSL_SESSION_ID_CTX */ |
4854 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
4855 | | byte peerVerifyRet; /* cert verify error */ |
4856 | | #endif |
4857 | | #ifdef WOLFSSL_TLS13 |
4858 | | word16 namedGroup; |
4859 | | #endif |
4860 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
4861 | | #ifdef WOLFSSL_TLS13 |
4862 | | #ifdef WOLFSSL_32BIT_MILLI_TIME |
4863 | | word32 ticketSeen; /* Time ticket seen (ms) */ |
4864 | | #else |
4865 | | sword64 ticketSeen; /* Time ticket seen (ms) */ |
4866 | | #endif |
4867 | | word32 ticketAdd; /* Added by client */ |
4868 | | TicketNonce ticketNonce; /* Nonce used to derive PSK */ |
4869 | | #endif |
4870 | | #ifdef WOLFSSL_EARLY_DATA |
4871 | | word32 maxEarlyDataSz; |
4872 | | #endif |
4873 | | #endif |
4874 | | #ifdef HAVE_SESSION_TICKET |
4875 | | byte staticTicket[SESSION_TICKET_LEN]; |
4876 | | byte* ticket; |
4877 | | word16 ticketLen; |
4878 | | word16 ticketLenAlloc; /* is dynamic */ |
4879 | | #ifdef HAVE_SNI |
4880 | | byte sniHash[TICKET_BINDING_HASH_SZ]; /* SNI at issue */ |
4881 | | #endif |
4882 | | #ifdef HAVE_ALPN |
4883 | | byte alpnHash[TICKET_BINDING_HASH_SZ]; /* ALPN at issue */ |
4884 | | #endif |
4885 | | #endif |
4886 | | |
4887 | | #ifdef SESSION_CERTS |
4888 | | WOLFSSL_X509_CHAIN chain; /* peer cert chain, static */ |
4889 | | #ifdef WOLFSSL_ALT_CERT_CHAINS |
4890 | | WOLFSSL_X509_CHAIN altChain; /* peer alt cert chain, static */ |
4891 | | #endif |
4892 | | #endif |
4893 | | #ifdef HAVE_EX_DATA |
4894 | | WOLFSSL_CRYPTO_EX_DATA ex_data; |
4895 | | #endif |
4896 | | #ifdef HAVE_MAX_FRAGMENT |
4897 | | byte mfl; /* max fragment length negotiated i.e. |
4898 | | * WOLFSSL_MFL_2_8 (6) */ |
4899 | | #endif |
4900 | | byte isSetup:1; |
4901 | | }; |
4902 | | |
4903 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET) && \ |
4904 | | defined(WOLFSSL_TICKET_NONCE_MALLOC) && \ |
4905 | | (!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3))) |
4906 | | WOLFSSL_LOCAL int SessionTicketNoncePopulate(WOLFSSL_SESSION *session, |
4907 | | const byte* nonce, byte len); |
4908 | | #endif /* WOLFSSL_TLS13 && */ |
4909 | | |
4910 | | WOLFSSL_LOCAL int wolfSSL_RAND_Init(void); |
4911 | | |
4912 | | WOLFSSL_LOCAL WOLFSSL_SESSION* wolfSSL_NewSession(void* heap); |
4913 | | WOLFSSL_LOCAL WOLFSSL_SESSION* wolfSSL_GetSession( |
4914 | | WOLFSSL* ssl, byte* masterSecret, byte restoreSessionCerts); |
4915 | | WOLFSSL_LOCAL void SetupSession(WOLFSSL* ssl); |
4916 | | WOLFSSL_LOCAL void AddSession(WOLFSSL* ssl); |
4917 | | #ifdef WOLFSSL_API_PREFIX_MAP |
4918 | | #define AddSessionToCache wolfSSL_AddSessionToCache |
4919 | | #endif |
4920 | | WOLFSSL_TEST_VIS int AddSessionToCache(WOLFSSL_CTX* ctx, |
4921 | | WOLFSSL_SESSION* addSession, const byte* id, byte idSz, int* sessionIndex, |
4922 | | int side, word16 useTicket, ClientSession** clientCacheEntry); |
4923 | | #ifndef NO_CLIENT_CACHE |
4924 | | WOLFSSL_LOCAL ClientSession* AddSessionToClientCache(int side, int row, int idx, |
4925 | | byte* serverID, word16 idLen, const byte* sessionID, |
4926 | | word16 useTicket); |
4927 | | #endif |
4928 | | WOLFSSL_LOCAL |
4929 | | WOLFSSL_SESSION* ClientSessionToSession(const WOLFSSL_SESSION* session); |
4930 | | WOLFSSL_LOCAL void TlsSessionCacheUnlockRow(word32 row); |
4931 | | WOLFSSL_LOCAL int TlsSessionCacheGetAndRdLock(const byte *id, |
4932 | | const WOLFSSL_SESSION **sess, word32 *lockedRow, byte side); |
4933 | | WOLFSSL_LOCAL int TlsSessionCacheGetAndWrLock(const byte *id, |
4934 | | WOLFSSL_SESSION **sess, word32 *lockedRow, byte side); |
4935 | | WOLFSSL_LOCAL void EvictSessionFromCache(WOLFSSL_SESSION* session); |
4936 | | WOLFSSL_TEST_VIS int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output); |
4937 | | WOLFSSL_LOCAL int wolfSSL_SetSession(WOLFSSL* ssl, WOLFSSL_SESSION* session); |
4938 | | WOLFSSL_LOCAL void wolfSSL_FreeSession(WOLFSSL_CTX* ctx, |
4939 | | WOLFSSL_SESSION* session); |
4940 | | WOLFSSL_LOCAL int wolfSSL_DupSession(const WOLFSSL_SESSION* input, |
4941 | | WOLFSSL_SESSION* output, int avoidSysCalls); |
4942 | | |
4943 | | |
4944 | | typedef int (*hmacfp) (WOLFSSL*, byte*, const byte*, word32, int, int, int, int); |
4945 | | |
4946 | | #ifndef NO_CLIENT_CACHE |
4947 | | WOLFSSL_LOCAL WOLFSSL_SESSION* wolfSSL_GetSessionClient( |
4948 | | WOLFSSL* ssl, const byte* id, int len); |
4949 | | #endif |
4950 | | |
4951 | | /* client connect state for nonblocking restart */ |
4952 | | enum ConnectState { |
4953 | | CONNECT_BEGIN = 0, |
4954 | | CLIENT_HELLO_SENT, |
4955 | | HELLO_AGAIN, /* HELLO_AGAIN s for DTLS case */ |
4956 | | HELLO_AGAIN_REPLY, |
4957 | | FIRST_REPLY_DONE, |
4958 | | FIRST_REPLY_FIRST, |
4959 | | FIRST_REPLY_SECOND, |
4960 | | FIRST_REPLY_THIRD, |
4961 | | FIRST_REPLY_FOURTH, |
4962 | | FINISHED_DONE, |
4963 | | SECOND_REPLY_DONE, |
4964 | | |
4965 | | #ifdef WOLFSSL_DTLS13 |
4966 | | WAIT_FINISHED_ACK |
4967 | | #endif /* WOLFSSL_DTLS13 */ |
4968 | | |
4969 | | }; |
4970 | | |
4971 | | |
4972 | | /* server accept state for nonblocking restart */ |
4973 | | enum AcceptState { |
4974 | | ACCEPT_BEGIN = 0, |
4975 | | ACCEPT_BEGIN_RENEG, |
4976 | | ACCEPT_CLIENT_HELLO_DONE, |
4977 | | ACCEPT_HELLO_RETRY_REQUEST_DONE, |
4978 | | ACCEPT_FIRST_REPLY_DONE, |
4979 | | SERVER_HELLO_SENT, |
4980 | | CERT_SENT, |
4981 | | CERT_VERIFY_SENT, |
4982 | | CERT_STATUS_SENT, |
4983 | | KEY_EXCHANGE_SENT, |
4984 | | CERT_REQ_SENT, |
4985 | | SERVER_HELLO_DONE, |
4986 | | ACCEPT_SECOND_REPLY_DONE, |
4987 | | TICKET_SENT, |
4988 | | CHANGE_CIPHER_SENT, |
4989 | | ACCEPT_FINISHED_DONE, |
4990 | | ACCEPT_THIRD_REPLY_DONE |
4991 | | }; |
4992 | | |
4993 | | /* TLS 1.3 server accept state for nonblocking restart */ |
4994 | | enum AcceptStateTls13 { |
4995 | | TLS13_ACCEPT_BEGIN = 0, |
4996 | | TLS13_ACCEPT_BEGIN_RENEG, |
4997 | | TLS13_ACCEPT_CLIENT_HELLO_DONE, |
4998 | | TLS13_ACCEPT_HELLO_RETRY_REQUEST_DONE, |
4999 | | TLS13_ACCEPT_FIRST_REPLY_DONE, |
5000 | | TLS13_ACCEPT_SECOND_REPLY_DONE, |
5001 | | TLS13_SERVER_HELLO_SENT, |
5002 | | TLS13_ACCEPT_THIRD_REPLY_DONE, |
5003 | | TLS13_SERVER_EXTENSIONS_SENT, |
5004 | | TLS13_CERT_REQ_SENT, |
5005 | | TLS13_CERT_SENT, |
5006 | | TLS13_CERT_VERIFY_SENT, |
5007 | | TLS13_ACCEPT_FINISHED_SENT, |
5008 | | TLS13_PRE_TICKET_SENT, |
5009 | | TLS13_ACCEPT_FINISHED_DONE, |
5010 | | TLS13_TICKET_SENT |
5011 | | }; |
5012 | | |
5013 | | #ifdef WOLFSSL_THREADED_CRYPT |
5014 | | |
5015 | | #include <pthread.h> |
5016 | | |
5017 | | typedef struct ThreadCrypt { |
5018 | | Ciphers encrypt; |
5019 | | bufferStatic buffer; |
5020 | | unsigned char nonce[AESGCM_NONCE_SZ]; |
5021 | | unsigned char additional[AEAD_AUTH_DATA_SZ]; |
5022 | | int init; |
5023 | | int offset; |
5024 | | int cryptLen; |
5025 | | int done; |
5026 | | int avail; |
5027 | | int stop; |
5028 | | WOLFSSL_THREAD_SIGNAL signal; |
5029 | | void* signalCtx; |
5030 | | } ThreadCrypt; |
5031 | | |
5032 | | #endif |
5033 | | |
5034 | | /* buffers for struct WOLFSSL */ |
5035 | | typedef struct Buffers { |
5036 | | bufferStatic inputBuffer; |
5037 | | bufferStatic outputBuffer; |
5038 | | #ifdef WOLFSSL_THREADED_CRYPT |
5039 | | ThreadCrypt encrypt[WOLFSSL_THREADED_CRYPT_CNT]; |
5040 | | #endif |
5041 | | buffer domainName; /* for client check */ |
5042 | | buffer ipasc; /* for client IP SAN check */ |
5043 | | buffer clearOutputBuffer; |
5044 | | buffer sig; /* signature data */ |
5045 | | buffer digest; /* digest data */ |
5046 | | word32 prevSent; /* previous plain text bytes sent |
5047 | | when got WANT_WRITE */ |
5048 | | word32 plainSz; /* plain text bytes in buffer to send |
5049 | | when got WANT_WRITE */ |
5050 | | byte weOwnCert; /* SSL own cert flag */ |
5051 | | byte weOwnCertChain; /* SSL own cert chain flag */ |
5052 | | byte weOwnKey; /* SSL own key flag */ |
5053 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
5054 | | byte weOwnAltKey; /* SSL own alt key flag */ |
5055 | | #endif |
5056 | | byte weOwnDH; /* SSL own dh (p,g) flag */ |
5057 | | #ifndef NO_DH |
5058 | | buffer serverDH_P; /* WOLFSSL_CTX owns, unless we own */ |
5059 | | buffer serverDH_G; /* WOLFSSL_CTX owns, unless we own */ |
5060 | | buffer serverDH_Pub; |
5061 | | buffer serverDH_Priv; |
5062 | | DhKey* serverDH_Key; |
5063 | | #endif |
5064 | | #ifndef NO_CERTS |
5065 | | DerBuffer* certificate; /* WOLFSSL_CTX owns, unless we own */ |
5066 | | DerBuffer* key; /* WOLFSSL_CTX owns, unless we own */ |
5067 | | #ifdef WOLFSSL_BLIND_PRIVATE_KEY |
5068 | | DerBuffer* keyMask; /* Mask of private key DER. */ |
5069 | | #endif |
5070 | | byte keyType; /* Type of key */ |
5071 | | byte keyId:1; /* Key data is an id not data */ |
5072 | | byte keyLabel:1; /* Key data is a label not data */ |
5073 | | int keySz; /* Size of RSA key */ |
5074 | | int keyDevId; /* Device Id for key */ |
5075 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
5076 | | DerBuffer* altKey; /* WOLFSSL_CTX owns, unless we own */ |
5077 | | #ifdef WOLFSSL_BLIND_PRIVATE_KEY |
5078 | | DerBuffer* altKeyMask; /* Mask of alt private key DER. */ |
5079 | | #endif |
5080 | | byte altKeyType; /* Type of alt key */ |
5081 | | byte altKeyId:1; /* Key data is an id not data */ |
5082 | | byte altKeyLabel:1; /* Key data is a label not data */ |
5083 | | int altKeySz; /* Size of alt key */ |
5084 | | int altKeyDevId; /* Device Id for alt key */ |
5085 | | #endif |
5086 | | DerBuffer* certChain; /* WOLFSSL_CTX owns, unless we own */ |
5087 | | /* chain after self, in DER, with leading size for each cert */ |
5088 | | int certChainCnt; |
5089 | | #ifdef WOLFSSL_TLS13 |
5090 | | DerBuffer* certExts[MAX_CERT_EXTENSIONS]; |
5091 | | #endif |
5092 | | #endif |
5093 | | #ifdef WOLFSSL_SEND_HRR_COOKIE |
5094 | | buffer tls13CookieSecret; /* HRR cookie secret */ |
5095 | | #endif |
5096 | | #ifdef WOLFSSL_DTLS |
5097 | | WOLFSSL_DTLS_CTX dtlsCtx; /* DTLS connection context */ |
5098 | | #ifndef NO_WOLFSSL_SERVER |
5099 | | buffer dtlsCookieSecret; /* DTLS cookie secret */ |
5100 | | #endif /* NO_WOLFSSL_SERVER */ |
5101 | | #endif |
5102 | | #ifdef HAVE_PK_CALLBACKS |
5103 | | #ifdef HAVE_ECC |
5104 | | buffer peerEccDsaKey; /* we own for Ecc Verify Callbacks */ |
5105 | | #endif /* HAVE_ECC */ |
5106 | | #ifdef HAVE_ED25519 |
5107 | | buffer peerEd25519Key; /* for Ed25519 Verify Callbacks */ |
5108 | | #endif /* HAVE_ED25519 */ |
5109 | | #ifdef HAVE_ED448 |
5110 | | buffer peerEd448Key; /* for Ed448 Verify Callbacks */ |
5111 | | #endif /* HAVE_ED448 */ |
5112 | | #ifndef NO_RSA |
5113 | | buffer peerRsaKey; /* we own for Rsa Verify Callbacks */ |
5114 | | #endif /* NO_RSA */ |
5115 | | #endif /* HAVE_PK_CALLBACKS */ |
5116 | | } Buffers; |
5117 | | |
5118 | | /* sub-states for send/do key share (key exchange) */ |
5119 | | enum asyncState { |
5120 | | TLS_ASYNC_BEGIN = 0, |
5121 | | TLS_ASYNC_BUILD, |
5122 | | TLS_ASYNC_DO, |
5123 | | TLS_ASYNC_VERIFY, |
5124 | | TLS_ASYNC_FINALIZE, |
5125 | | TLS_ASYNC_END |
5126 | | }; |
5127 | | |
5128 | | /* sub-states for build message */ |
5129 | | enum buildMsgState { |
5130 | | BUILD_MSG_BEGIN = 0, |
5131 | | BUILD_MSG_SIZE, |
5132 | | BUILD_MSG_HASH, |
5133 | | BUILD_MSG_VERIFY_MAC, |
5134 | | BUILD_MSG_ENCRYPT, |
5135 | | BUILD_MSG_ENCRYPTED_VERIFY_MAC |
5136 | | }; |
5137 | | |
5138 | | /* sub-states for cipher operations */ |
5139 | | enum cipherState { |
5140 | | CIPHER_STATE_BEGIN = 0, |
5141 | | CIPHER_STATE_DO, |
5142 | | CIPHER_STATE_END |
5143 | | }; |
5144 | | |
5145 | | struct Options { |
5146 | | #ifndef NO_PSK |
5147 | | wc_psk_client_callback client_psk_cb; |
5148 | | wc_psk_server_callback server_psk_cb; |
5149 | | #ifdef OPENSSL_EXTRA |
5150 | | wc_psk_use_session_cb_func session_psk_cb; |
5151 | | #endif |
5152 | | #ifdef WOLFSSL_TLS13 |
5153 | | wc_psk_client_cs_callback client_psk_cs_cb; /* client callback */ |
5154 | | wc_psk_client_tls13_callback client_psk_tls13_cb; /* client callback */ |
5155 | | wc_psk_server_tls13_callback server_psk_tls13_cb; /* server callback */ |
5156 | | #endif |
5157 | | void* psk_ctx; |
5158 | | #endif /* NO_PSK */ |
5159 | | unsigned long mask; /* store SSL_OP_ flags */ |
5160 | | #if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL) |
5161 | | word16 minProto:1; /* sets min to min available */ |
5162 | | word16 maxProto:1; /* sets max to max available */ |
5163 | | #endif |
5164 | | #if defined(HAVE_SESSION_TICKET) && defined(WOLFSSL_TLS13) |
5165 | | unsigned int maxTicketTls13; /* maximum number of tickets to send */ |
5166 | | unsigned int ticketsSent; /* keep track of the total sent */ |
5167 | | #endif |
5168 | | |
5169 | | /* on/off or small bit flags, optimize layout */ |
5170 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
5171 | | word16 havePSK:1; /* psk key set by user */ |
5172 | | #endif /* HAVE_SESSION_TICKET || !NO_PSK */ |
5173 | | word16 sendVerify:2; /* false = 0, true = 1, sendBlank = 2 */ |
5174 | | word16 sessionCacheOff:1; |
5175 | | word16 sessionCacheFlushOff:1; |
5176 | | #ifdef HAVE_EXT_CACHE |
5177 | | word16 internalCacheOff:1; |
5178 | | word16 internalCacheLookupOff:1; |
5179 | | #endif |
5180 | | word16 side:2; /* client, server or neither end */ |
5181 | | word16 verifyPeer:1; |
5182 | | word16 verifyNone:1; |
5183 | | word16 failNoCert:1; |
5184 | | word16 failNoCertxPSK:1; /* fail for no cert except with PSK */ |
5185 | | word16 failNoPSK:1; /* fail if no PSK is negotiated */ |
5186 | | word16 downgrade:1; /* allow downgrade of versions */ |
5187 | | word16 resuming:1; |
5188 | | #ifdef HAVE_SECURE_RENEGOTIATION |
5189 | | word16 resumed:1; /* resuming may be reset on SCR */ |
5190 | | #endif |
5191 | | word16 isPSK:1; |
5192 | | word16 haveSessionId:1; /* server may not send */ |
5193 | | word16 tls:1; /* using TLS ? */ |
5194 | | word16 tls1_1:1; /* using TLSv1.1+ ? */ |
5195 | | word16 tls1_3:1; /* using TLSv1.3+ ? */ |
5196 | | word16 dtls:1; /* using datagrams ? */ |
5197 | | #ifdef WOLFSSL_DTLS |
5198 | | word16 dtlsStateful:1; /* allow stateful processing ? */ |
5199 | | #endif |
5200 | | word16 connReset:1; /* has the peer reset */ |
5201 | | word16 isClosed:1; /* if we consider conn closed */ |
5202 | | word16 closeNotify:1; /* we've received a close notify */ |
5203 | | word16 sentNotify:1; /* we've sent a close notify */ |
5204 | | word16 usingCompression:1; /* are we using compression */ |
5205 | | word16 haveRSA:1; /* RSA available */ |
5206 | | word16 haveECC:1; /* ECC available */ |
5207 | | word16 haveDH:1; /* server DH params set by user */ |
5208 | | word16 haveECDSAsig:1; /* server ECDSA signed cert */ |
5209 | | word16 haveStaticECC:1; /* static server ECC private key */ |
5210 | | word16 haveFalconSig:1; /* server Falcon signed cert */ |
5211 | | word16 haveMlDsaSig:1; /* server ML-DSA signed cert */ |
5212 | | word16 havePeerCert:1; /* do we have peer's cert */ |
5213 | | word16 havePeerVerify:1; /* and peer's cert verify */ |
5214 | | word16 usingPSK_cipher:1; /* are using psk as cipher */ |
5215 | | word16 usingAnon_cipher:1; /* are we using an anon cipher */ |
5216 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
5217 | | word16 noPskDheKe:1; /* Don't use (EC)DHE with PSK */ |
5218 | | #ifdef HAVE_SUPPORTED_CURVES |
5219 | | word16 onlyPskDheKe:1; /* Only use (EC)DHE with PSK */ |
5220 | | #endif |
5221 | | #if defined(WOLFSSL_CERT_WITH_EXTERN_PSK) |
5222 | | word16 certWithExternPsk:1; /* Cert auth with external PSK */ |
5223 | | #endif |
5224 | | #endif |
5225 | | word16 partialWrite:1; /* only one msg per write call */ |
5226 | | word16 quietShutdown:1; /* don't send close notify */ |
5227 | | word16 certOnly:1; /* stop once we get cert */ |
5228 | | word16 groupMessages:1; /* group handshake messages */ |
5229 | | word16 saveArrays:1; /* save array Memory for user get keys |
5230 | | or psk */ |
5231 | | word16 weOwnRng:1; /* will be true unless CTX owns */ |
5232 | | word16 dontFreeDigest:1; /* when true, we used SetDigest */ |
5233 | | word16 haveEMS:1; /* using extended master secret */ |
5234 | | #ifdef HAVE_POLY1305 |
5235 | | word16 oldPoly:1; /* set when to use old rfc way of poly*/ |
5236 | | #endif |
5237 | | word16 useAnon:1; /* User wants to allow Anon suites */ |
5238 | | #ifdef HAVE_SESSION_TICKET |
5239 | | word16 createTicket:1; /* Server to create new Ticket */ |
5240 | | word16 useTicket:1; /* Use Ticket not session cache */ |
5241 | | word16 rejectTicket:1; /* Callback rejected ticket */ |
5242 | | word16 noTicketTls12:1; /* TLS 1.2 server won't send ticket */ |
5243 | | #ifdef WOLFSSL_TLS13 |
5244 | | word16 noTicketTls13:1; /* Server won't create new Ticket */ |
5245 | | #endif |
5246 | | #endif |
5247 | | #ifdef WOLFSSL_DTLS |
5248 | | #ifdef HAVE_SECURE_RENEGOTIATION |
5249 | | word16 dtlsDoSCR:1; /* Enough packets were dropped. We |
5250 | | * need to re-key. */ |
5251 | | #endif |
5252 | | word16 dtlsUseNonblock:1; /* are we using nonblocking socket */ |
5253 | | word16 dtlsHsRetain:1; /* DTLS retaining HS data */ |
5254 | | #ifdef WOLFSSL_SCTP |
5255 | | word16 dtlsSctp:1; /* DTLS-over-SCTP mode */ |
5256 | | #endif |
5257 | | #endif /* WOLFSSL_DTLS */ |
5258 | | #if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_SUPPORTED_CURVES) |
5259 | | word16 userCurves:1; /* indicates user called wolfSSL_UseSupportedCurve */ |
5260 | | word16 peerNoUncompPF:1; /* peer sent ec_point_formats without |
5261 | | * the uncompressed (0) format */ |
5262 | | #endif |
5263 | | word16 keepResources:1; /* Keep resources after handshake */ |
5264 | | word16 useClientOrder:1; /* Use client's cipher order */ |
5265 | | word16 mutualAuth:1; /* Mutual authentication is required */ |
5266 | | word16 peerAuthGood:1; /* Any required peer auth done */ |
5267 | | #if defined(WOLFSSL_TLS13) && (defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)) |
5268 | | word16 pskNegotiated:1; /* Session Ticket/PSK negotiated. */ |
5269 | | #endif |
5270 | | #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) |
5271 | | word16 postHandshakeAuth:1;/* Client send post_handshake_auth |
5272 | | * extension */ |
5273 | | word16 verifyPostHandshake:1; /* Only send client cert req post |
5274 | | * handshake, not also during */ |
5275 | | #endif |
5276 | | #if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_SERVER) |
5277 | | word16 sendCookie:1; /* Server creates a Cookie in HRR */ |
5278 | | #endif |
5279 | | #ifdef WOLFSSL_ALT_CERT_CHAINS |
5280 | | word16 usingAltCertChain:1;/* Alternate cert chain was used */ |
5281 | | #endif |
5282 | | #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_TLS13_MIDDLEBOX_COMPAT) |
5283 | | word16 sentChangeCipher:1; /* Change Cipher Spec sent */ |
5284 | | #endif |
5285 | | #if !defined(WOLFSSL_NO_CLIENT_AUTH) && \ |
5286 | | ((defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)) || \ |
5287 | | (defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \ |
5288 | | (defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH))) |
5289 | | word16 cacheMessages:1; /* Cache messages for sign/verify */ |
5290 | | #endif |
5291 | | #ifndef NO_DH |
5292 | | #if !defined(WOLFSSL_OLD_PRIME_CHECK) && \ |
5293 | | !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) |
5294 | | word16 dhDoKeyTest:1; /* Need to do the DH Key prime test */ |
5295 | | word16 dhKeyTested:1; /* Set when key has been tested. */ |
5296 | | #endif |
5297 | | #endif |
5298 | | #ifdef HAVE_ENCRYPT_THEN_MAC |
5299 | | word16 disallowEncThenMac:1; /* Don't do Encrypt-Then-MAC */ |
5300 | | word16 encThenMac:1; /* Doing Encrypt-Then-MAC */ |
5301 | | word16 startedETMRead:1; /* Doing Encrypt-Then-MAC read */ |
5302 | | word16 startedETMWrite:1; /* Doing Encrypt-Then-MAC write */ |
5303 | | #endif |
5304 | | #ifdef WOLFSSL_ASYNC_CRYPT |
5305 | | word16 buildArgsSet:1; /* buildArgs are set and need to |
5306 | | * be free'd */ |
5307 | | #endif |
5308 | | #ifdef WOLFSSL_DTLS13 |
5309 | | word16 dtls13SendMoreAcks:1; /* Send more acks during the |
5310 | | * handshake process */ |
5311 | | #ifdef WOLFSSL_DTLS13_NO_HRR_ON_RESUME |
5312 | | word16 dtls13NoHrrOnResume:1; |
5313 | | #endif |
5314 | | #ifdef WOLFSSL_DTLS_CH_FRAG |
5315 | | word16 dtls13ChFrag:1; |
5316 | | #endif |
5317 | | #endif |
5318 | | #ifdef WOLFSSL_TLS13 |
5319 | | word16 tls13MiddleBoxCompat:1; /* TLSv1.3 middlebox compatibility */ |
5320 | | #endif |
5321 | | #ifdef WOLFSSL_DTLS_CID |
5322 | | word16 useDtlsCID:1; |
5323 | | #endif /* WOLFSSL_DTLS_CID */ |
5324 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
5325 | | word16 echAccepted:1; |
5326 | | word16 disableECH:1; /* Did the user disable ech */ |
5327 | | word16 echProcessingInner:1; /* Processing the inner hello */ |
5328 | | word16 echRetryConfigsAccepted:1; |
5329 | | word16 enableEchTrialDecrypt:1; /* Trial decryption of the |
5330 | | inner hello */ |
5331 | | #endif |
5332 | | #ifdef WOLFSSL_SEND_HRR_COOKIE |
5333 | | word16 cookieGood:1; |
5334 | | #endif |
5335 | | #ifdef WOLFSSL_TLS13 |
5336 | | #ifdef WOLFSSL_SEND_HRR_COOKIE |
5337 | | word16 hrrSentCookie:1; /* HRR sent with cookie */ |
5338 | | #endif |
5339 | | word16 hrrSentKeyShare:1; /* HRR sent with key share */ |
5340 | | word16 shSentKeyShare:1; /* SH sent with key share */ |
5341 | | #endif |
5342 | | word16 returnOnGoodCh:1; |
5343 | | word16 disableRead:1; |
5344 | | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WOLFSSL_ASYNC_CERT_YIELD) |
5345 | | /* Opt-in (WOLFSSL_ASYNC_CERT_YIELD): set when we deliberately returned |
5346 | | * WC_PENDING_E between peer certificate verifies so a cooperative scheduler |
5347 | | * can run. Lives in (zero-initialized, persistent) ssl->options so the |
5348 | | * fresh-entry vs. resume decision in ProcessPeerCerts is reliable; the |
5349 | | * transient ProcPeerCertArgs scratch buffer is not zeroed on alloc. */ |
5350 | | word16 certYieldPending:1; |
5351 | | #endif |
5352 | | |
5353 | | #ifdef WOLFSSL_EARLY_DATA |
5354 | | word16 clientInEarlyData:1; /* Client is in wolfSSL_read_early_data */ |
5355 | | #endif |
5356 | | #ifdef WOLFSSL_DTLS |
5357 | | byte haveMcast; /* using multicast ? */ |
5358 | | #endif |
5359 | | byte buildingMsg; /* If set then we need to re-enter the |
5360 | | * handshake logic. */ |
5361 | | byte seenUnifiedHdr; /* received msg with unified header */ |
5362 | | byte shutdownDone; /* we've completed a shutdown */ |
5363 | | byte sendKeyUpdate; /* Key Update to write */ |
5364 | | #if defined(HAVE_RPK) |
5365 | | RpkConfig rpkConfig; |
5366 | | RpkState rpkState; |
5367 | | #endif /* HAVE_RPK */ |
5368 | | |
5369 | | /* need full byte values for this section */ |
5370 | | byte processReply; /* nonblocking resume */ |
5371 | | byte cipherSuite0; /* first byte, normally 0 */ |
5372 | | byte cipherSuite; /* second byte, actual suite */ |
5373 | | #ifdef WOLFSSL_TLS13 |
5374 | | byte hrrCipherSuite0; /* first byte, normally 0 */ |
5375 | | byte hrrCipherSuite; /* second byte, actual suite */ |
5376 | | #endif |
5377 | | byte hashAlgo; /* selected hash algorithm */ |
5378 | | byte sigAlgo; /* selected sig algorithm */ |
5379 | | byte peerHashAlgo; /* peer's chosen hash algo */ |
5380 | | byte peerSigAlgo; /* peer's chosen sig algo */ |
5381 | | byte serverState; |
5382 | | byte clientState; |
5383 | | byte handShakeState; |
5384 | | byte handShakeDone; /* at least one handshake complete */ |
5385 | | byte minDowngrade; /* minimum downgrade version */ |
5386 | | byte connectState; /* nonblocking resume */ |
5387 | | byte acceptState; /* nonblocking resume */ |
5388 | | byte asyncState; /* sub-state for enum asyncState */ |
5389 | | byte buildMsgState; /* sub-state for enum buildMsgState */ |
5390 | | byte alertCount; /* detect warning dos attempt */ |
5391 | | byte emptyRecordCount; /* detect empty record dos attempt */ |
5392 | | #ifdef WOLFSSL_MULTICAST |
5393 | | word16 mcastID; /* Multicast group ID */ |
5394 | | #endif |
5395 | | #ifndef NO_DH |
5396 | | word16 minDhKeySz; /* minimum DH key size */ |
5397 | | word16 maxDhKeySz; /* minimum DH key size */ |
5398 | | word16 dhKeySz; /* actual DH key size */ |
5399 | | #endif |
5400 | | #ifndef NO_RSA |
5401 | | short minRsaKeySz; /* minimum RSA key size */ |
5402 | | #endif |
5403 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) |
5404 | | short minEccKeySz; /* minimum ECC key size */ |
5405 | | #endif |
5406 | | #if defined(HAVE_FALCON) |
5407 | | short minFalconKeySz; /* minimum Falcon key size */ |
5408 | | #endif |
5409 | | #if defined(WOLFSSL_HAVE_MLDSA) |
5410 | | short minMlDsaKeySz; /* minimum ML-DSA key size */ |
5411 | | #endif |
5412 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
5413 | | byte verifyDepth; /* maximum verification depth */ |
5414 | | #endif |
5415 | | #ifdef WOLFSSL_EARLY_DATA |
5416 | | word16 pskIdIndex; |
5417 | | word32 maxEarlyDataSz; |
5418 | | #endif |
5419 | | #ifdef WOLFSSL_TLS13 |
5420 | | byte oldMinor; /* client preferred version < TLS 1.3 */ |
5421 | | #endif |
5422 | | }; |
5423 | | |
5424 | | typedef struct Arrays { |
5425 | | byte* preMasterSecret; |
5426 | | word32 preMasterSz; /* differs for DH, actual size */ |
5427 | | #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) |
5428 | | word32 psk_keySz; /* actual size */ |
5429 | | char client_identity[MAX_PSK_ID_LEN + NULL_TERM_LEN]; |
5430 | | char server_hint[MAX_PSK_ID_LEN + NULL_TERM_LEN]; |
5431 | | byte psk_key[MAX_PSK_KEY_LEN]; |
5432 | | #endif |
5433 | | byte clientRandom[RAN_LEN]; |
5434 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
5435 | | byte clientRandomInner[RAN_LEN]; |
5436 | | #endif |
5437 | | byte serverRandom[RAN_LEN]; |
5438 | | byte sessionID[ID_LEN]; |
5439 | | byte sessionIDSz; |
5440 | | #ifdef WOLFSSL_TLS13 |
5441 | | byte secret[SECRET_LEN]; |
5442 | | #endif |
5443 | | #ifdef HAVE_KEYING_MATERIAL |
5444 | | byte exporterSecret[WC_MAX_DIGEST_SIZE]; |
5445 | | #endif |
5446 | | byte masterSecret[SECRET_LEN]; |
5447 | | #if defined(WOLFSSL_RENESAS_TSIP_TLS) && \ |
5448 | | !defined(NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION) |
5449 | | byte tsip_masterSecret[TSIP_TLS_MASTERSECRET_SIZE]; |
5450 | | #endif |
5451 | | #if defined(WOLFSSL_RENESAS_FSPSM_TLS) |
5452 | | byte fspsm_masterSecret[FSPSM_TLS_MASTERSECRET_SIZE]; |
5453 | | #endif |
5454 | | #ifdef WOLFSSL_DTLS |
5455 | | byte cookie[MAX_COOKIE_LEN]; |
5456 | | byte cookieSz; |
5457 | | #endif |
5458 | | } Arrays; |
5459 | | |
5460 | | #ifndef ASN_NAME_MAX |
5461 | | #ifndef NO_ASN |
5462 | | /* use value from asn.h */ |
5463 | 0 | #define ASN_NAME_MAX WC_ASN_NAME_MAX |
5464 | | #else |
5465 | | /* calculate for WOLFSSL_X509 */ |
5466 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \ |
5467 | | defined(WOLFSSL_CERT_EXT) |
5468 | | #define ASN_NAME_MAX 330 |
5469 | | #else |
5470 | | #define ASN_NAME_MAX 256 |
5471 | | #endif |
5472 | | #endif |
5473 | | #endif |
5474 | | |
5475 | | typedef enum { |
5476 | | STACK_TYPE_X509 = 0, |
5477 | | STACK_TYPE_GEN_NAME = 1, |
5478 | | STACK_TYPE_BIO = 2, |
5479 | | STACK_TYPE_OBJ = 3, |
5480 | | STACK_TYPE_STRING = 4, |
5481 | | STACK_TYPE_CIPHER = 5, |
5482 | | STACK_TYPE_ACCESS_DESCRIPTION = 6, |
5483 | | STACK_TYPE_X509_EXT = 7, |
5484 | | STACK_TYPE_NULL = 8, |
5485 | | STACK_TYPE_X509_NAME = 9, |
5486 | | STACK_TYPE_CONF_VALUE = 10, |
5487 | | STACK_TYPE_X509_INFO = 11, |
5488 | | STACK_TYPE_BY_DIR_entry = 12, |
5489 | | STACK_TYPE_BY_DIR_hash = 13, |
5490 | | STACK_TYPE_X509_OBJ = 14, |
5491 | | STACK_TYPE_DIST_POINT = 15, |
5492 | | STACK_TYPE_X509_CRL = 16, |
5493 | | STACK_TYPE_X509_NAME_ENTRY = 17, |
5494 | | STACK_TYPE_X509_REQ_ATTR = 18, |
5495 | | STACK_TYPE_GENERAL_SUBTREE = 19, |
5496 | | STACK_TYPE_X509_REVOKED = 20 |
5497 | | } WOLF_STACK_TYPE; |
5498 | | |
5499 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
5500 | | |
5501 | | struct WOLFSSL_STACK { |
5502 | | unsigned long num; /* number of nodes in stack |
5503 | | * (safety measure for freeing and shortcut for count) */ |
5504 | | #if defined(OPENSSL_ALL) |
5505 | | wolf_sk_hash_cb hash_fn; |
5506 | | unsigned long hash; |
5507 | | #endif |
5508 | | |
5509 | | union { |
5510 | | WOLFSSL_X509* x509; |
5511 | | WOLFSSL_X509_NAME* name; |
5512 | | WOLFSSL_X509_NAME_ENTRY* name_entry; |
5513 | | WOLFSSL_X509_INFO* info; |
5514 | | WOLFSSL_BIO* bio; |
5515 | | WOLFSSL_ASN1_OBJECT* obj; |
5516 | | WOLFSSL_CIPHER cipher; |
5517 | | WOLFSSL_ACCESS_DESCRIPTION* access; |
5518 | | WOLFSSL_X509_EXTENSION* ext; |
5519 | | #ifdef OPENSSL_EXTRA |
5520 | | WOLFSSL_CONF_VALUE* conf; |
5521 | | #endif |
5522 | | void* generic; |
5523 | | char* string; |
5524 | | WOLFSSL_GENERAL_NAME* gn; |
5525 | | WOLFSSL_GENERAL_SUBTREE* subtree; |
5526 | | WOLFSSL_BY_DIR_entry* dir_entry; |
5527 | | WOLFSSL_BY_DIR_HASH* dir_hash; |
5528 | | WOLFSSL_X509_OBJECT* x509_obj; |
5529 | | WOLFSSL_DIST_POINT* dp; |
5530 | | WOLFSSL_X509_CRL* crl; |
5531 | | WOLFSSL_X509_REVOKED* revoked; |
5532 | | } data; |
5533 | | void* heap; /* memory heap hint */ |
5534 | | WOLFSSL_STACK* next; |
5535 | | WOLF_STACK_TYPE type; /* Identifies type of stack. */ |
5536 | | }; |
5537 | | |
5538 | | #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */ |
5539 | | |
5540 | | struct WOLFSSL_X509_NAME { |
5541 | | char *name; |
5542 | | int dynamicName; |
5543 | | int sz; |
5544 | | char staticName[ASN_NAME_MAX]; |
5545 | | #if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) && \ |
5546 | | !defined(NO_ASN) |
5547 | | DecodedName fullName; |
5548 | | int entrySz; /* number of entries */ |
5549 | | WOLFSSL_X509_NAME_ENTRY entry[MAX_NAME_ENTRIES]; /* all entries i.e. CN */ |
5550 | | WOLFSSL_X509* x509; /* x509 that struct belongs to */ |
5551 | | #endif /* OPENSSL_EXTRA */ |
5552 | | #ifndef WOLFSSL_NO_CA_NAMES |
5553 | | byte raw[ASN_NAME_MAX]; |
5554 | | int rawLen; |
5555 | | |
5556 | | WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* entries; |
5557 | | #endif |
5558 | | void* heap; |
5559 | | }; |
5560 | | |
5561 | | #ifndef EXTERNAL_SERIAL_SIZE |
5562 | | #define EXTERNAL_SERIAL_SIZE 32 |
5563 | | #endif |
5564 | | |
5565 | | #ifdef NO_ASN |
5566 | | typedef struct DNS_entry DNS_entry; |
5567 | | #ifndef IGNORE_NAME_CONSTRAINTS |
5568 | | typedef struct Base_entry Base_entry; |
5569 | | #endif |
5570 | | #endif |
5571 | | |
5572 | | #ifndef WOLFSSL_AIA_ENTRY_DEFINED |
5573 | | #ifndef WOLFSSL_MAX_AIA_ENTRIES |
5574 | | #define WOLFSSL_MAX_AIA_ENTRIES 8 |
5575 | | #endif |
5576 | | |
5577 | | #define WOLFSSL_AIA_ENTRY_DEFINED |
5578 | | typedef struct WOLFSSL_AIA_ENTRY { |
5579 | | word32 method; /* AIA method OID sum (e.g., AIA_OCSP_OID). */ |
5580 | | const byte* uri; /* Pointer into cert DER for the URI. */ |
5581 | | word32 uriSz; /* Length of URI data. */ |
5582 | | } WOLFSSL_AIA_ENTRY; |
5583 | | #endif /* WOLFSSL_AIA_ENTRY_DEFINED */ |
5584 | | |
5585 | | struct WOLFSSL_X509 { |
5586 | | int version; |
5587 | | int serialSz; |
5588 | | #ifdef WOLFSSL_SEP |
5589 | | int deviceTypeSz; |
5590 | | int hwTypeSz; |
5591 | | byte deviceType[EXTERNAL_SERIAL_SIZE]; |
5592 | | byte hwType[EXTERNAL_SERIAL_SIZE]; |
5593 | | int hwSerialNumSz; |
5594 | | byte hwSerialNum[EXTERNAL_SERIAL_SIZE]; |
5595 | | byte certPolicySet; |
5596 | | byte certPolicyCrit; |
5597 | | #endif /* WOLFSSL_SEP */ |
5598 | | #if defined(WOLFSSL_QT) || defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA) |
5599 | | WOLFSSL_STACK* ext_sk; /* Store X509_EXTENSIONS from wolfSSL_X509_get_ext */ |
5600 | | WOLFSSL_STACK* ext_sk_full; /* Store X509_EXTENSIONS from wolfSSL_X509_get0_extensions */ |
5601 | | WOLFSSL_STACK* ext_d2i;/* Store d2i extensions from wolfSSL_X509_get_ext_d2i */ |
5602 | | #endif /* WOLFSSL_QT || OPENSSL_ALL */ |
5603 | | #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL) |
5604 | | WOLFSSL_ASN1_INTEGER* serialNumber; /* Stores SN from wolfSSL_X509_get_serialNumber */ |
5605 | | #endif |
5606 | | WOLFSSL_ASN1_TIME notBefore; |
5607 | | WOLFSSL_ASN1_TIME notAfter; |
5608 | | buffer sig; |
5609 | | int sigOID; |
5610 | | DNS_entry* altNames; /* alt names list */ |
5611 | | #ifndef IGNORE_NAME_CONSTRAINTS |
5612 | | Base_entry* permittedNames; /* name constraints */ |
5613 | | Base_entry* excludedNames; |
5614 | | byte nameConstraintCrit:1; |
5615 | | #endif |
5616 | | buffer pubKey; |
5617 | | int pubKeyOID; |
5618 | | DNS_entry* altNamesNext; /* hint for retrieval */ |
5619 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \ |
5620 | | defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) |
5621 | | word32 pkCurveOID; |
5622 | | #endif |
5623 | | #ifndef NO_CERTS |
5624 | | DerBuffer* derCert; /* may need */ |
5625 | | #endif |
5626 | | void* heap; /* heap hint */ |
5627 | | byte dynamicMemory; /* dynamic memory flag */ |
5628 | | byte isCa:1; |
5629 | | #ifdef WOLFSSL_CERT_EXT |
5630 | | char certPolicies[MAX_CERTPOL_NB][MAX_CERTPOL_SZ]; |
5631 | | int certPoliciesNb; |
5632 | | #endif /* WOLFSSL_CERT_EXT */ |
5633 | | #if defined(OPENSSL_EXTRA_X509_SMALL) || defined(OPENSSL_EXTRA) |
5634 | | wolfSSL_Ref ref; |
5635 | | #endif |
5636 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
5637 | | #ifdef HAVE_EX_DATA |
5638 | | WOLFSSL_CRYPTO_EX_DATA ex_data; |
5639 | | #endif |
5640 | | byte* authKeyId; /* Points into authKeyIdSrc */ |
5641 | | byte* authKeyIdSrc; |
5642 | | byte* subjKeyId; |
5643 | | WOLFSSL_ASN1_STRING* subjKeyIdStr; |
5644 | | byte* extKeyUsageSrc; |
5645 | | #ifdef OPENSSL_ALL |
5646 | | byte* subjAltNameSrc; |
5647 | | #endif |
5648 | | byte* rawCRLInfo; |
5649 | | byte* CRLInfo; |
5650 | | byte* authInfo; |
5651 | | #ifdef WOLFSSL_ASN_CA_ISSUER |
5652 | | byte* authInfoCaIssuer; |
5653 | | int authInfoCaIssuerSz; |
5654 | | #endif |
5655 | | WOLFSSL_AIA_ENTRY authInfoList[WOLFSSL_MAX_AIA_ENTRIES]; |
5656 | | byte authInfoListSz:7; |
5657 | | byte authInfoListOverflow:1; |
5658 | | word32 pathLength; |
5659 | | word16 keyUsage; |
5660 | | int rawCRLInfoSz; |
5661 | | int CRLInfoSz; |
5662 | | int authInfoSz; |
5663 | | word32 authKeyIdSz; |
5664 | | word32 authKeyIdSrcSz; |
5665 | | word32 subjKeyIdSz; |
5666 | | byte extKeyUsage; |
5667 | | word32 extKeyUsageSz; |
5668 | | word32 extKeyUsageCount; |
5669 | | #ifndef IGNORE_NETSCAPE_CERT_TYPE |
5670 | | byte nsCertType; |
5671 | | #endif |
5672 | | #ifdef OPENSSL_ALL |
5673 | | word32 subjAltNameSz; |
5674 | | #endif |
5675 | | |
5676 | | byte CRLdistSet:1; |
5677 | | byte CRLdistCrit:1; |
5678 | | byte authInfoSet:1; |
5679 | | byte authInfoCrit:1; |
5680 | | byte keyUsageSet:1; |
5681 | | byte keyUsageCrit:1; |
5682 | | byte extKeyUsageCrit:1; |
5683 | | byte subjKeyIdSet:1; |
5684 | | byte pathLengthSet:1; |
5685 | | |
5686 | | byte subjKeyIdCrit:1; |
5687 | | byte basicConstSet:1; |
5688 | | byte basicConstCrit:1; |
5689 | | byte basicConstPlSet:1; |
5690 | | byte subjAltNameSet:1; |
5691 | | byte subjAltNameCrit:1; |
5692 | | byte authKeyIdSet:1; |
5693 | | byte authKeyIdCrit:1; |
5694 | | byte issuerSet:1; |
5695 | | #ifdef WOLFSSL_CUSTOM_OID |
5696 | | CertExtension custom_exts[NUM_CUSTOM_EXT]; |
5697 | | int customExtCount; |
5698 | | #endif /* WOLFSSL_CUSTOM_OID */ |
5699 | | #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */ |
5700 | | #ifdef WOLFSSL_CERT_REQ |
5701 | | byte isCSR:1; |
5702 | | #endif |
5703 | | byte serial[EXTERNAL_SERIAL_SIZE]; |
5704 | | char subjectCN[ASN_NAME_MAX]; /* common name short cut */ |
5705 | | #if defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_GEN) |
5706 | | #if defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA) |
5707 | | /* stack of CSR attributes */ |
5708 | | WOLF_STACK_OF(WOLFSSL_X509_ATRIBUTE)* reqAttributes; |
5709 | | #endif |
5710 | | #if defined(WOLFSSL_CERT_REQ) |
5711 | | char challengePw[CTC_NAME_SIZE]; /* for REQ certs */ |
5712 | | char contentType[CTC_NAME_SIZE]; |
5713 | | #endif |
5714 | | #endif /* WOLFSSL_CERT_REQ || WOLFSSL_CERT_GEN */ |
5715 | | WOLFSSL_X509_NAME issuer; |
5716 | | WOLFSSL_X509_NAME subject; |
5717 | | #if defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA) || \ |
5718 | | defined(OPENSSL_EXTRA_X509_SMALL) || defined(WOLFSSL_APACHE_HTTPD) || \ |
5719 | | defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_WPAS) |
5720 | | WOLFSSL_X509_ALGOR algor; |
5721 | | WOLFSSL_X509_PUBKEY key; |
5722 | | #endif |
5723 | | #if defined(OPENSSL_EXTRA_X509_SMALL) || defined(OPENSSL_EXTRA) || \ |
5724 | | defined(OPENSSL_ALL) || defined(KEEP_OUR_CERT) || \ |
5725 | | defined(KEEP_PEER_CERT) || defined(SESSION_CERTS) |
5726 | | byte notBeforeData[CTC_DATE_SIZE]; |
5727 | | byte notAfterData[CTC_DATE_SIZE]; |
5728 | | #endif |
5729 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
5730 | | /* Subject Alternative Public Key Info */ |
5731 | | byte *sapkiDer; |
5732 | | int sapkiLen; |
5733 | | /* Alternative Signature Algorithm */ |
5734 | | byte *altSigAlgDer; |
5735 | | int altSigAlgLen; |
5736 | | /* Alternative Signature Value */ |
5737 | | byte *altSigValDer; |
5738 | | int altSigValLen; |
5739 | | |
5740 | | byte sapkiCrit:1; |
5741 | | byte altSigAlgCrit:1; |
5742 | | byte altSigValCrit:1; |
5743 | | #endif /* WOLFSSL_DUAL_ALG_CERTS */ |
5744 | | }; |
5745 | | |
5746 | | #if defined(WOLFSSL_ACERT) |
5747 | | struct WOLFSSL_X509_ACERT { |
5748 | | int version; |
5749 | | int serialSz; |
5750 | | byte serial[EXTERNAL_SERIAL_SIZE]; |
5751 | | WOLFSSL_ASN1_TIME notBefore; |
5752 | | WOLFSSL_ASN1_TIME notAfter; |
5753 | | buffer sig; |
5754 | | int sigOID; |
5755 | | #ifndef NO_CERTS |
5756 | | DerBuffer * derCert; |
5757 | | #endif |
5758 | | void * heap; |
5759 | | int dynamic; /* whether struct was dynamically allocated */ |
5760 | | /* copy of raw Attributes field from */ |
5761 | | byte holderSerial[EXTERNAL_SERIAL_SIZE]; |
5762 | | int holderSerialSz; |
5763 | | DNS_entry * holderEntityName; /* Holder entityName from ACERT */ |
5764 | | DNS_entry * holderIssuerName; /* issuerName from ACERT */ |
5765 | | DNS_entry * AttCertIssuerName; /* AttCertIssuer name from ACERT */ |
5766 | | byte * rawAttr; |
5767 | | word32 rawAttrLen; |
5768 | | }; |
5769 | | #endif /* WOLFSSL_ACERT */ |
5770 | | |
5771 | | /* record layer header for PlainText, Compressed, and CipherText */ |
5772 | | typedef struct RecordLayerHeader { |
5773 | | byte type; |
5774 | | byte pvMajor; |
5775 | | byte pvMinor; |
5776 | | byte length[2]; |
5777 | | } RecordLayerHeader; |
5778 | | |
5779 | | |
5780 | | /* record layer header for DTLS PlainText, Compressed, and CipherText */ |
5781 | | typedef struct DtlsRecordLayerHeader { |
5782 | | byte type; |
5783 | | byte pvMajor; |
5784 | | byte pvMinor; |
5785 | | byte sequence_number[8]; /* per record */ |
5786 | | byte length[2]; |
5787 | | } DtlsRecordLayerHeader; |
5788 | | |
5789 | | typedef struct DtlsFragBucket { |
5790 | | /* m stands for meta */ |
5791 | | union { |
5792 | | struct { |
5793 | | struct DtlsFragBucket* next; |
5794 | | word32 offset; |
5795 | | word32 sz; |
5796 | | } m; |
5797 | | /* Make sure we have at least DTLS_HANDSHAKE_HEADER_SZ bytes before the |
5798 | | * buf so that we can reconstruct the header in the allocated |
5799 | | * DtlsFragBucket buffer. */ |
5800 | | byte padding[DTLS_HANDSHAKE_HEADER_SZ]; |
5801 | | } m; |
5802 | | /* Ignore "nonstandard extension used : zero-sized array in struct/union" |
5803 | | * MSVC warning */ |
5804 | | #ifdef _MSC_VER |
5805 | | #pragma warning(disable: 4200) |
5806 | | #endif |
5807 | | byte buf[WC_FLEXIBLE_ARRAY_SIZE]; |
5808 | | } DtlsFragBucket; |
5809 | | |
5810 | | typedef struct DtlsMsg { |
5811 | | struct DtlsMsg* next; |
5812 | | byte* raw; |
5813 | | byte* fullMsg; /* for TX fullMsg == raw. For RX this points to |
5814 | | * the start of the message after headers. */ |
5815 | | DtlsFragBucket* fragBucketList; |
5816 | | word32 bytesReceived; |
5817 | | word16 epoch; /* Epoch that this message belongs to */ |
5818 | | word32 seq; /* Handshake sequence number */ |
5819 | | word32 sz; /* Length of whole message */ |
5820 | | byte type; |
5821 | | byte fragBucketListCount; |
5822 | | byte ready:1; |
5823 | | byte encrypted:1; |
5824 | | } DtlsMsg; |
5825 | | |
5826 | | |
5827 | | #ifdef HAVE_NETX |
5828 | | |
5829 | | /* NETX I/O Callback default */ |
5830 | | typedef struct NetX_Ctx { |
5831 | | NX_TCP_SOCKET* nxTcpSocket; /* send/recv tcp socket handle */ |
5832 | | NX_PACKET* nxPacket; /* incoming packet handle for short reads */ |
5833 | | ULONG nxOffset; /* offset already read from nxPacket */ |
5834 | | ULONG nxWait; /* wait option flag */ |
5835 | | /* WOLFSSL_NETX_DUO: requires ThreadX NetX Duo (NXD_ADDRESS, nxd_udp_socket_send) */ |
5836 | | #if defined(WOLFSSL_DTLS) && defined(WOLFSSL_NETX_DUO) |
5837 | | NX_UDP_SOCKET* nxUdpSocket; /* send/recv udp socket handle */ |
5838 | | NXD_ADDRESS nxdIp; /* destination IP address for udp send */ |
5839 | | USHORT nxPort; /* destination port for udp send */ |
5840 | | #endif /* WOLFSSL_DTLS && WOLFSSL_NETX_DUO */ |
5841 | | } NetX_Ctx; |
5842 | | |
5843 | | #endif |
5844 | | |
5845 | | /* Handshake messages received from peer (plus change cipher */ |
5846 | | typedef struct MsgsReceived { |
5847 | | word16 got_hello_request:1; |
5848 | | word16 got_client_hello:2; |
5849 | | word16 got_server_hello:1; |
5850 | | word16 got_hello_verify_request:1; |
5851 | | word16 got_session_ticket:1; |
5852 | | word16 got_end_of_early_data:1; |
5853 | | word16 got_hello_retry_request:1; |
5854 | | word16 got_encrypted_extensions:1; |
5855 | | word16 got_certificate:1; |
5856 | | word16 got_certificate_status:1; |
5857 | | word16 got_server_key_exchange:1; |
5858 | | word16 got_certificate_request:1; |
5859 | | word16 got_server_hello_done:1; |
5860 | | word16 got_certificate_verify:1; |
5861 | | word16 got_client_key_exchange:1; |
5862 | | word16 got_finished:1; |
5863 | | word16 got_key_update:1; |
5864 | | word16 got_change_cipher:1; |
5865 | | } MsgsReceived; |
5866 | | |
5867 | | |
5868 | | /* Handshake hashes */ |
5869 | | typedef struct HS_Hashes { |
5870 | | Hashes verifyHashes; |
5871 | | Hashes certHashes; /* for cert verify */ |
5872 | | #if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \ |
5873 | | defined(WOLFSSL_ALLOW_TLS_SHA1)) |
5874 | | wc_Sha hashSha; /* sha hash of handshake msgs */ |
5875 | | #endif |
5876 | | #if !defined(NO_MD5) && !defined(NO_OLD_TLS) |
5877 | | wc_Md5 hashMd5; /* md5 hash of handshake msgs */ |
5878 | | #endif |
5879 | | #ifndef NO_SHA256 |
5880 | | wc_Sha256 hashSha256; /* sha256 hash of handshake msgs */ |
5881 | | #endif |
5882 | | #ifdef WOLFSSL_SHA384 |
5883 | | wc_Sha384 hashSha384; /* sha384 hash of handshake msgs */ |
5884 | | #endif |
5885 | | #ifdef WOLFSSL_SHA512 |
5886 | | wc_Sha512 hashSha512; /* sha512 hash of handshake msgs */ |
5887 | | #endif |
5888 | | #ifdef WOLFSSL_SM3 |
5889 | | wc_Sm3 hashSm3; /* sm3 hash of handshake msgs */ |
5890 | | #endif |
5891 | | #if (defined(HAVE_ED25519) || defined(HAVE_ED448) || \ |
5892 | | (defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3))) && \ |
5893 | | !defined(WOLFSSL_NO_CLIENT_AUTH) |
5894 | | byte* messages; /* handshake messages */ |
5895 | | int length; /* length of handshake messages' data */ |
5896 | | int prevLen; /* length of messages but last */ |
5897 | | #endif |
5898 | | } HS_Hashes; |
5899 | | |
5900 | | |
5901 | | #ifndef WOLFSSL_NO_TLS12 |
5902 | | /* Persistable BuildMessage arguments */ |
5903 | | typedef struct BuildMsgArgs { |
5904 | | word32 digestSz; |
5905 | | word32 sz; |
5906 | | word32 pad; |
5907 | | word32 idx; |
5908 | | word32 headerSz; |
5909 | | word16 size; |
5910 | | word32 ivSz; /* TLSv1.1 IV */ |
5911 | | byte type; |
5912 | | byte* iv; |
5913 | | ALIGN16 byte staticIvBuffer[MAX_IV_SZ]; |
5914 | | } BuildMsgArgs; |
5915 | | #endif |
5916 | | |
5917 | | #ifdef WOLFSSL_ASYNC_IO |
5918 | | #define MAX_ASYNC_ARGS 24 |
5919 | | typedef void (*FreeArgsCb)(struct WOLFSSL* ssl, void* pArgs); |
5920 | | |
5921 | | struct WOLFSSL_ASYNC { |
5922 | | #if defined(WOLFSSL_ASYNC_CRYPT) && !defined(WOLFSSL_NO_TLS12) |
5923 | | BuildMsgArgs buildArgs; /* holder for current BuildMessage args */ |
5924 | | #endif |
5925 | | FreeArgsCb freeArgs; /* function pointer to cleanup args */ |
5926 | | #ifdef WC_NO_PTR_INT_CAST |
5927 | | max_align_t args[MAX_ASYNC_ARGS * sizeof(word32) / sizeof(max_align_t)]; /* holder for current args */ |
5928 | | #else |
5929 | | word32 args[MAX_ASYNC_ARGS]; /* holder for current args */ |
5930 | | #endif |
5931 | | }; |
5932 | | #endif |
5933 | | |
5934 | | #ifdef HAVE_WRITE_DUP |
5935 | | |
5936 | | #define WRITE_DUP_SIDE 1 |
5937 | | #define READ_DUP_SIDE 2 |
5938 | | |
5939 | | typedef struct WriteDup { |
5940 | | wolfSSL_Mutex dupMutex; /* field access mutex */ |
5941 | | int dupCount; /* reference count */ |
5942 | | int dupErr; /* under dupMutex, pass to other side */ |
5943 | | #ifdef WOLFSSL_DTLS13 |
5944 | | struct Dtls13RecordNumber* sendAckList; /* ownership transferred */ |
5945 | | /* Key update ACK tracking: write side stores the (epoch, seq) of its |
5946 | | * in-flight KeyUpdate; read side sets keyUpdateAcked when the ACK for |
5947 | | * that exact record arrives. Both epoch and seq are checked to avoid |
5948 | | * false positives from data records in the same epoch. */ |
5949 | | w64wrapper keyUpdateEpoch; /* epoch of the KeyUpdate */ |
5950 | | w64wrapper keyUpdateSeq; /* seq num of the KeyUpdate */ |
5951 | | #endif /* WOLFSSL_DTLS13 */ |
5952 | | #ifdef WOLFSSL_TLS13 |
5953 | | #ifdef WOLFSSL_POST_HANDSHAKE_AUTH |
5954 | | /* Post-handshake certificate request delegation: the read side received |
5955 | | * a CertificateRequest but cannot write; it saves state here and the |
5956 | | * write side sends Certificate+CertificateVerify+Finished. */ |
5957 | | struct HS_Hashes* postHandshakeHashState; /* transcript at CR time */ |
5958 | | struct CertReqCtx* postHandshakeCertReqCtx; /* context from CR */ |
5959 | | byte postHandshakeSendVerify; /* ssl->options.sendVerify */ |
5960 | | byte postHandshakeSigAlgo; /* ssl->options.sigAlgo */ |
5961 | | byte postHandshakeHashAlgo; /* ssl->options.hashAlgo */ |
5962 | | #endif /* WOLFSSL_POST_HANDSHAKE_AUTH */ |
5963 | | #endif /* WOLFSSL_TLS13 */ |
5964 | | |
5965 | | /* Flags */ |
5966 | | #ifdef WOLFSSL_DTLS13 |
5967 | | WC_BITFIELD keyUpdateWaiting:1; /* write side has an unACKed KeyUpdate */ |
5968 | | WC_BITFIELD keyUpdateAcked:1; /* read side confirmed the ACK arrived */ |
5969 | | /* DTLS 1.3: read side cannot write, so it passes ACK work to the |
5970 | | * write side. */ |
5971 | | WC_BITFIELD sendAcks:1; |
5972 | | #endif /* WOLFSSL_DTLS13 */ |
5973 | | #ifdef WOLFSSL_TLS13 |
5974 | | /* TLS 1.3 (and DTLS 1.3): read side received a KeyUpdate(update_requested) |
5975 | | * but cannot send the response; write side handles it. */ |
5976 | | WC_BITFIELD keyUpdateRespond:1; /* write side must send a KeyUpdate response */ |
5977 | | #ifdef WOLFSSL_POST_HANDSHAKE_AUTH |
5978 | | WC_BITFIELD postHandshakeAuthPending:1; /* write side must respond */ |
5979 | | #endif /* WOLFSSL_POST_HANDSHAKE_AUTH */ |
5980 | | #endif /* WOLFSSL_TLS13 */ |
5981 | | } WriteDup; |
5982 | | |
5983 | | WOLFSSL_LOCAL void FreeWriteDup(WOLFSSL* ssl); |
5984 | | WOLFSSL_LOCAL int NotifyWriteSide(WOLFSSL* ssl, int err); |
5985 | | #endif /* HAVE_WRITE_DUP */ |
5986 | | |
5987 | | #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) |
5988 | | typedef struct CertReqCtx CertReqCtx; |
5989 | | |
5990 | | struct CertReqCtx { |
5991 | | CertReqCtx* next; |
5992 | | byte len; |
5993 | | byte ctx; |
5994 | | }; |
5995 | | #endif |
5996 | | |
5997 | | #ifdef WOLFSSL_EARLY_DATA |
5998 | | typedef enum EarlyDataState { |
5999 | | no_early_data, |
6000 | | early_data_ext, |
6001 | | expecting_early_data, |
6002 | | process_early_data, |
6003 | | done_early_data |
6004 | | } EarlyDataState; |
6005 | | #endif |
6006 | | |
6007 | | #ifdef WOLFSSL_DTLS13 |
6008 | | |
6009 | | /* size of the mask used to encrypt/decrypt Record Number */ |
6010 | | #define DTLS13_RN_MASK_SIZE 16 |
6011 | | |
6012 | | typedef struct Dtls13UnifiedHdrInfo { |
6013 | | word16 recordLength; |
6014 | | byte seqLo; |
6015 | | byte seqHi; |
6016 | | byte seqHiPresent:1; |
6017 | | byte epochBits; |
6018 | | } Dtls13UnifiedHdrInfo; |
6019 | | |
6020 | | enum { |
6021 | | DTLS13_EPOCH_EARLYDATA = 1, |
6022 | | DTLS13_EPOCH_HANDSHAKE = 2, |
6023 | | DTLS13_EPOCH_TRAFFIC0 = 3 |
6024 | | }; |
6025 | | |
6026 | | /* Sender-side DTLS 1.3 epoch ceiling: we MUST NOT advance our own epoch past |
6027 | | * 2^48-1 (RFC 9147 Section 4.2.1). This gates only the sending epoch; receivers |
6028 | | * MUST NOT enforce it on the peer epoch (RFC 9147 Section 8). Expressed as the |
6029 | | * high/low 32-bit halves of a w64wrapper. */ |
6030 | | #define DTLS13_EPOCH_MAX_HI32 0x0000FFFFU |
6031 | | #define DTLS13_EPOCH_MAX_LO32 0xFFFFFFFFU |
6032 | | |
6033 | | /* 64-bit epoch + 64-bit sequence number */ |
6034 | | #define DTLS13_RN_SIZE (OPAQUE64_LEN + OPAQUE64_LEN) |
6035 | | /* Maximum number of ACK records allowed in an ACK message */ |
6036 | | #ifndef DTLS13_ACK_MAX_RECORDS |
6037 | | #define DTLS13_ACK_MAX_RECORDS 128 |
6038 | | #endif |
6039 | | /* WOLFSSL_MAX_16BIT / DTLS13_RN_SIZE (0xffff / (OPAQUE64_LEN + OPAQUE64_LEN)) |
6040 | | * Literals are used because OPAQUE64_LEN is an enum value, invisible to the |
6041 | | * preprocessor. */ |
6042 | | #if DTLS13_ACK_MAX_RECORDS > 0xffff / 16 |
6043 | | #error "DTLS13_ACK_MAX_RECORDS exceeds the maximum encodable in the word16 length field" |
6044 | | #endif |
6045 | | |
6046 | | |
6047 | | typedef struct Dtls13Epoch { |
6048 | | w64wrapper epochNumber; |
6049 | | |
6050 | | w64wrapper nextSeqNumber; |
6051 | | w64wrapper nextPeerSeqNumber; |
6052 | | |
6053 | | #ifndef WOLFSSL_TLS13_IGNORE_AEAD_LIMITS |
6054 | | w64wrapper dropCount; /* Amount of records that failed decryption */ |
6055 | | #endif |
6056 | | |
6057 | | word32 window[WOLFSSL_DTLS_WINDOW_WORDS]; |
6058 | | |
6059 | | /* key material for the epoch */ |
6060 | | byte client_write_key[MAX_SYM_KEY_SIZE]; |
6061 | | byte server_write_key[MAX_SYM_KEY_SIZE]; |
6062 | | byte client_write_IV[MAX_WRITE_IV_SZ]; |
6063 | | byte server_write_IV[MAX_WRITE_IV_SZ]; |
6064 | | |
6065 | | byte aead_exp_IV[AEAD_MAX_EXP_SZ]; |
6066 | | byte aead_enc_imp_IV[AEAD_MAX_IMP_SZ]; |
6067 | | byte aead_dec_imp_IV[AEAD_MAX_IMP_SZ]; |
6068 | | |
6069 | | byte client_sn_key[MAX_SYM_KEY_SIZE]; |
6070 | | byte server_sn_key[MAX_SYM_KEY_SIZE]; |
6071 | | |
6072 | | byte isValid; |
6073 | | byte side; |
6074 | | } Dtls13Epoch; |
6075 | | |
6076 | | #ifndef DTLS13_EPOCH_SIZE |
6077 | | #define DTLS13_EPOCH_SIZE 4 |
6078 | | #endif |
6079 | | |
6080 | | #ifndef DTLS13_RETRANS_RN_SIZE |
6081 | | #define DTLS13_RETRANS_RN_SIZE 3 |
6082 | | #endif |
6083 | | |
6084 | | enum Dtls13RtxFsmState { |
6085 | | DTLS13_RTX_FSM_PREPARING = 0, |
6086 | | DTLS13_RTX_FSM_SENDING, |
6087 | | DTLS13_RTX_FSM_WAITING, |
6088 | | DTLS13_RTX_FSM_FINISHED |
6089 | | }; |
6090 | | |
6091 | | typedef struct Dtls13RtxRecord { |
6092 | | struct Dtls13RtxRecord *next; |
6093 | | word16 length; |
6094 | | byte *data; |
6095 | | w64wrapper epoch; |
6096 | | w64wrapper seq[DTLS13_RETRANS_RN_SIZE]; |
6097 | | byte rnIdx; |
6098 | | byte handshakeType; |
6099 | | } Dtls13RtxRecord; |
6100 | | |
6101 | | typedef struct Dtls13RecordNumber { |
6102 | | struct Dtls13RecordNumber *next; |
6103 | | w64wrapper epoch; |
6104 | | w64wrapper seq; |
6105 | | } Dtls13RecordNumber; |
6106 | | |
6107 | | typedef struct Dtls13Rtx { |
6108 | | #ifdef WOLFSSL_RW_THREADED |
6109 | | wolfSSL_Mutex mutex; |
6110 | | #endif |
6111 | | enum Dtls13RtxFsmState state; /* Unused? */ |
6112 | | Dtls13RtxRecord *rtxRecords; |
6113 | | Dtls13RtxRecord **rtxRecordTailPtr; |
6114 | | Dtls13RecordNumber *seenRecords; |
6115 | | word16 seenRecordsCount; |
6116 | | #ifdef WOLFSSL_32BIT_MILLI_TIME |
6117 | | word32 lastRtx; |
6118 | | #else |
6119 | | sword64 lastRtx; |
6120 | | #endif |
6121 | | byte triggeredRtxs; /* Unused? */ |
6122 | | byte sendAcks; |
6123 | | byte retransmit; |
6124 | | } Dtls13Rtx; |
6125 | | |
6126 | | #endif /* WOLFSSL_DTLS13 */ |
6127 | | |
6128 | | #ifdef WOLFSSL_DTLS_CID |
6129 | | typedef struct ConnectionID { |
6130 | | byte length; |
6131 | | /* Ignore "nonstandard extension used : zero-sized array in struct/union" |
6132 | | * MSVC warning */ |
6133 | | #ifdef _MSC_VER |
6134 | | #pragma warning(disable: 4200) |
6135 | | #endif |
6136 | | byte id[]; |
6137 | | } ConnectionID; |
6138 | | |
6139 | | typedef struct CIDInfo { |
6140 | | ConnectionID* tx; |
6141 | | ConnectionID* rx; |
6142 | | byte negotiated : 1; |
6143 | | } CIDInfo; |
6144 | | |
6145 | | /* ConnectionIdUsage of the NewConnectionId message (RFC 9147 Section 9) */ |
6146 | | enum ConnectionIdUsage { |
6147 | | cid_immediate = 0, |
6148 | | cid_spare = 1 |
6149 | | }; |
6150 | | #endif /* WOLFSSL_DTLS_CID */ |
6151 | | |
6152 | | /* The idea is to reuse the context suites object whenever possible to save |
6153 | | * space. */ |
6154 | | #define WOLFSSL_SUITES(ssl) \ |
6155 | 60.6k | ((const Suites*) ((ssl)->suites != NULL ? \ |
6156 | 60.6k | (ssl)->suites : \ |
6157 | 60.6k | (ssl)->ctx->suites)) |
6158 | | |
6159 | | /* wolfSSL ssl type */ |
6160 | | struct WOLFSSL { |
6161 | | WOLFSSL_CTX* ctx; |
6162 | | #if defined(WOLFSSL_HAPROXY) |
6163 | | WOLFSSL_CTX* initial_ctx; /* preserve session key materials */ |
6164 | | #endif |
6165 | | Suites* suites; /* Only need during handshake. Can be NULL when |
6166 | | * reusing the context's object. When WOLFSSL |
6167 | | * object needs separate instance of suites use |
6168 | | * AllocateSuites(). */ |
6169 | | Suites* clSuites; |
6170 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL) || \ |
6171 | | defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) |
6172 | | WOLF_STACK_OF(WOLFSSL_CIPHER)* suitesStack; /* stack of available cipher |
6173 | | * suites */ |
6174 | | WOLF_STACK_OF(WOLFSSL_CIPHER)* clSuitesStack; /* stack of client cipher |
6175 | | * suites */ |
6176 | | #endif |
6177 | | Arrays* arrays; |
6178 | | /* Buffer used to reassemble a handshake message that is fragmented across |
6179 | | * multiple records. Kept in WOLFSSL (not Arrays) so that post-handshake |
6180 | | * messages (e.g. a TLS 1.3 NewSessionTicket) can still be defragmented |
6181 | | * after the handshake arrays have been released by FreeArrays(). */ |
6182 | | byte* pendingMsg; /* defrag buffer */ |
6183 | | word32 pendingMsgSz; /* defrag buffer size */ |
6184 | | word32 pendingMsgOffset; /* current offset into defrag buffer */ |
6185 | | byte pendingMsgType; /* defrag buffer message type */ |
6186 | | #ifdef WOLFSSL_TLS13 |
6187 | | byte clientSecret[SECRET_LEN]; |
6188 | | byte serverSecret[SECRET_LEN]; |
6189 | | #endif |
6190 | | HS_Hashes* hsHashes; |
6191 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
6192 | | HS_Hashes* hsHashesEch; |
6193 | | #endif |
6194 | | void* IOCB_ReadCtx; |
6195 | | void* IOCB_WriteCtx; |
6196 | | WC_RNG* rng; |
6197 | | void* verifyCbCtx; /* cert verify callback user ctx*/ |
6198 | | VerifyCallback verifyCallback; /* cert verification callback */ |
6199 | | void* heap; /* for user overrides */ |
6200 | | #ifdef HAVE_WRITE_DUP |
6201 | | WriteDup* dupWrite; /* valid pointer indicates ON */ |
6202 | | /* side that decrements dupCount to zero frees overall structure */ |
6203 | | byte dupSide; /* write side or read side */ |
6204 | | #endif |
6205 | | #ifdef OPENSSL_EXTRA |
6206 | | byte cbioFlag; /* WOLFSSL_CBIO_RECV/SEND: |
6207 | | * CBIORecv/Send is set */ |
6208 | | #endif |
6209 | | #ifdef WOLFSSL_WOLFSENTRY_HOOKS |
6210 | | NetworkFilterCallback_t AcceptFilter; |
6211 | | void *AcceptFilter_arg; |
6212 | | NetworkFilterCallback_t ConnectFilter; |
6213 | | void *ConnectFilter_arg; |
6214 | | #endif /* WOLFSSL_WOLFSENTRY_HOOKS */ |
6215 | | CallbackIORecv CBIORecv; |
6216 | | CallbackIOSend CBIOSend; |
6217 | | #ifdef WOLFSSL_STATIC_MEMORY |
6218 | | WOLFSSL_HEAP_HINT heap_hint; |
6219 | | #endif |
6220 | | #if defined(WOLFSSL_DTLS) && !defined(NO_WOLFSSL_SERVER) |
6221 | | ClientHelloGoodCb chGoodCb; /* notify user we parsed a verified |
6222 | | * ClientHello that passed basic tests */ |
6223 | | void* chGoodCtx; /* user ClientHello cb context */ |
6224 | | #endif |
6225 | | #ifndef NO_HANDSHAKE_DONE_CB |
6226 | | HandShakeDoneCb hsDoneCb; /* notify user handshake done */ |
6227 | | void* hsDoneCtx; /* user handshake cb context */ |
6228 | | #endif |
6229 | | #ifdef WOLFSSL_ASYNC_IO |
6230 | | #ifdef WOLFSSL_ASYNC_CRYPT |
6231 | | WC_ASYNC_DEV* asyncDev; |
6232 | | #endif |
6233 | | /* Message building context should be stored here for functions that expect |
6234 | | * to encounter encryption blocking or fragment the message. */ |
6235 | | struct WOLFSSL_ASYNC* async; |
6236 | | #endif |
6237 | | void* hsKey; /* Handshake key (RsaKey or ecc_key) |
6238 | | * allocated from heap */ |
6239 | | word32 hsType; /* Type of Handshake key (hsKey) */ |
6240 | | WOLFSSL_CIPHER cipher; |
6241 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
6242 | | void* hsAltKey; /* Handshake key (ML-DSA, falcon) |
6243 | | * allocated from heap */ |
6244 | | word32 hsAltType; /* Type of Handshake key (hsAltKey) */ |
6245 | | #endif |
6246 | | #ifndef WOLFSSL_AEAD_ONLY |
6247 | | hmacfp hmac; |
6248 | | #endif |
6249 | | Ciphers encrypt; |
6250 | | Ciphers decrypt; |
6251 | | Buffers buffers; |
6252 | | WOLFSSL_SESSION* session; |
6253 | | #ifndef NO_CLIENT_CACHE |
6254 | | ClientSession* clientSession; |
6255 | | #endif |
6256 | | WOLFSSL_ALERT_HISTORY alert_history; |
6257 | | WOLFSSL_ALERT pendingAlert; |
6258 | | int error; |
6259 | | int rfd; /* read file descriptor */ |
6260 | | int wfd; /* write file descriptor */ |
6261 | | int rflags; /* user read flags */ |
6262 | | int wflags; /* user write flags */ |
6263 | | word32 timeout; /* session timeout */ |
6264 | | word32 fragOffset; /* fragment offset */ |
6265 | | word16 curSize; |
6266 | | word32 curStartIdx; |
6267 | | byte verifyDepth; |
6268 | | RecordLayerHeader curRL; |
6269 | | MsgsReceived msgsReceived; /* peer messages received */ |
6270 | | ProtocolVersion version; /* negotiated version */ |
6271 | | ProtocolVersion chVersion; /* client hello version */ |
6272 | | CipherSpecs specs; |
6273 | | Keys keys; |
6274 | | Options options; |
6275 | | #ifdef WOLFSSL_SESSION_ID_CTX |
6276 | | byte sessionCtx[ID_LEN]; /* app session context ID */ |
6277 | | byte sessionCtxSz; /* size of sessionCtx stored */ |
6278 | | #endif |
6279 | | #ifdef OPENSSL_EXTRA |
6280 | | CallbackInfoState* CBIS; /* used to get info about SSL state */ |
6281 | | int cbmode; /* read or write on info callback */ |
6282 | | int cbtype; /* event type in info callback */ |
6283 | | WOLFSSL_BIO* biord; /* socket bio read to free/close */ |
6284 | | WOLFSSL_BIO* biowr; /* socket bio write to free/close */ |
6285 | | WOLFSSL_X509_VERIFY_PARAM* param; /* verification parameters*/ |
6286 | | #endif |
6287 | | #if defined(OPENSSL_EXTRA) || defined(HAVE_CURL) |
6288 | | word32 disabledCurves; /* curves disabled by user */ |
6289 | | #endif |
6290 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \ |
6291 | | defined(OPENSSL_ALL) |
6292 | | unsigned long peerVerifyRet; |
6293 | | #endif |
6294 | | #ifdef OPENSSL_EXTRA |
6295 | | byte readAhead; |
6296 | | #ifdef HAVE_PK_CALLBACKS |
6297 | | void* loggingCtx; /* logging callback argument */ |
6298 | | #endif |
6299 | | #endif /* OPENSSL_EXTRA */ |
6300 | | #ifndef NO_RSA |
6301 | | RsaKey* peerRsaKey; |
6302 | | #if defined(WOLFSSL_RENESAS_TSIP_TLS) || defined(WOLFSSL_RENESAS_FSPSM_TLS) |
6303 | | void* RenesasUserCtx; |
6304 | | byte* peerSceTsipEncRsaKeyIndex; |
6305 | | #endif |
6306 | | byte peerRsaKeyPresent; |
6307 | | #ifdef WC_RSA_PSS |
6308 | | word8 useRsaPss; /* cert supports RSA-PSS */ |
6309 | | #endif |
6310 | | #endif |
6311 | | #if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE) |
6312 | | word16 namedGroup; |
6313 | | #endif |
6314 | | #ifdef WOLFSSL_TLS13 |
6315 | | word16 group[WOLFSSL_MAX_GROUP_COUNT]; |
6316 | | byte numGroups; |
6317 | | #endif |
6318 | | word16 pssAlgo; |
6319 | | #ifdef WOLFSSL_TLS13 |
6320 | | word16 certHashSigAlgoSz; /* SigAlgoCert ext length in bytes */ |
6321 | | byte certHashSigAlgo[WOLFSSL_MAX_SIGALGO]; /* cert sig/algo to |
6322 | | * offer */ |
6323 | | #endif |
6324 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) |
6325 | | int eccVerifyRes; |
6326 | | #endif |
6327 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_CURVE25519) || \ |
6328 | | defined(HAVE_ED448) || defined(HAVE_CURVE448) |
6329 | | word32 ecdhCurveOID; /* curve Ecc_Sum */ |
6330 | | ecc_key* eccTempKey; /* private ECDHE key */ |
6331 | | byte eccTempKeyPresent; /* also holds type */ |
6332 | | byte peerEccKeyPresent; |
6333 | | #endif |
6334 | | #ifdef HAVE_ECC |
6335 | | ecc_key* peerEccKey; /* peer's ECDHE key */ |
6336 | | ecc_key* peerEccDsaKey; /* peer's ECDSA key */ |
6337 | | word16 eccTempKeySz; /* in octets 20 - 66 */ |
6338 | | byte peerEccDsaKeyPresent; |
6339 | | #endif |
6340 | | #if defined(HAVE_ECC) || defined(HAVE_ED25519) || \ |
6341 | | defined(HAVE_CURVE448) || defined(HAVE_ED448) || \ |
6342 | | defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) |
6343 | | word32 pkCurveOID; /* curve Ecc_Sum */ |
6344 | | #endif |
6345 | | #ifdef HAVE_ED25519 |
6346 | | ed25519_key* peerEd25519Key; |
6347 | | byte peerEd25519KeyPresent; |
6348 | | #endif |
6349 | | #ifdef HAVE_CURVE25519 |
6350 | | curve25519_key* peerX25519Key; |
6351 | | byte peerX25519KeyPresent; |
6352 | | #endif |
6353 | | #ifdef HAVE_ED448 |
6354 | | ed448_key* peerEd448Key; |
6355 | | byte peerEd448KeyPresent; |
6356 | | #endif |
6357 | | #ifdef HAVE_CURVE448 |
6358 | | curve448_key* peerX448Key; |
6359 | | byte peerX448KeyPresent; |
6360 | | #endif |
6361 | | #ifdef HAVE_FALCON |
6362 | | falcon_key* peerFalconKey; |
6363 | | byte peerFalconKeyPresent; |
6364 | | #endif |
6365 | | #ifdef WOLFSSL_HAVE_MLDSA |
6366 | | wc_MlDsaKey* peerMlDsaKey; |
6367 | | byte peerMlDsaKeyPresent; |
6368 | | #endif |
6369 | | #ifdef HAVE_LIBZ |
6370 | | z_stream c_stream; /* compression stream */ |
6371 | | z_stream d_stream; /* decompression stream */ |
6372 | | byte didStreamInit; /* for stream init and end */ |
6373 | | #endif |
6374 | | #ifdef WOLFSSL_DTLS |
6375 | | int dtls_timeout_init; /* starting timeout value */ |
6376 | | int dtls_timeout_max; /* maximum timeout value */ |
6377 | | int dtls_timeout; /* current timeout value, changes */ |
6378 | | #ifndef NO_ASN_TIME |
6379 | | word32 dtls_start_timeout; |
6380 | | #endif /* !NO_ASN_TIME */ |
6381 | | word32 dtls_tx_msg_list_sz; |
6382 | | word32 dtls_rx_msg_list_sz; |
6383 | | DtlsMsg* dtls_tx_msg_list; |
6384 | | DtlsMsg* dtls_tx_msg; |
6385 | | DtlsMsg* dtls_rx_msg_list; |
6386 | | void* IOCB_CookieCtx; /* gen cookie ctx */ |
6387 | | #ifdef WOLFSSL_SESSION_EXPORT |
6388 | | wc_dtls_export dtls_export; /* export function for session */ |
6389 | | #endif |
6390 | | #if defined(WOLFSSL_SCTP) || defined(WOLFSSL_DTLS_MTU) |
6391 | | word16 dtlsMtuSz; |
6392 | | #endif /* WOLFSSL_SCTP || WOLFSSL_DTLS_MTU */ |
6393 | | #ifdef WOLFSSL_MULTICAST |
6394 | | void* mcastHwCbCtx; /* Multicast highwater callback ctx */ |
6395 | | #endif /* WOLFSSL_MULTICAST */ |
6396 | | #ifdef WOLFSSL_DTLS_DROP_STATS |
6397 | | word32 macDropCount; |
6398 | | word32 replayDropCount; |
6399 | | #endif /* WOLFSSL_DTLS_DROP_STATS */ |
6400 | | #ifdef WOLFSSL_SRTP |
6401 | | word16 dtlsSrtpProfiles; /* DTLS-with-SRTP profiles list |
6402 | | * (selected profiles - up to 16) */ |
6403 | | word16 dtlsSrtpId; /* DTLS-with-SRTP profile ID selected */ |
6404 | | #endif |
6405 | | #ifdef WOLFSSL_DTLS13 |
6406 | | RecordNumberCiphers dtlsRecordNumberEncrypt; |
6407 | | RecordNumberCiphers dtlsRecordNumberDecrypt; |
6408 | | Dtls13Epoch dtls13Epochs[DTLS13_EPOCH_SIZE]; |
6409 | | Dtls13Epoch *dtls13EncryptEpoch; |
6410 | | Dtls13Epoch *dtls13DecryptEpoch; |
6411 | | w64wrapper dtls13Epoch; |
6412 | | w64wrapper dtls13PeerEpoch; |
6413 | | w64wrapper dtls13InvalidateBefore; |
6414 | | byte dtls13CurRL[DTLS_RECVD_RL_HEADER_MAX_SZ]; |
6415 | | word16 dtls13CurRlLength; |
6416 | | |
6417 | | /* used to store the message if it needs to be fragmented */ |
6418 | | buffer dtls13FragmentsBuffer; |
6419 | | byte dtls13SendingFragments:1; |
6420 | | byte dtls13SendingAckOrRtx; |
6421 | | byte dtls13FastTimeout:1; |
6422 | | #ifdef HAVE_WRITE_DUP |
6423 | | byte dtls13KeyUpdateAcked:1; |
6424 | | #endif |
6425 | | byte dtls13WaitKeyUpdateAck; |
6426 | | byte dtls13DoKeyUpdate; |
6427 | | word32 dtls13MessageLength; |
6428 | | word32 dtls13FragOffset; |
6429 | | byte dtls13FragHandshakeType; |
6430 | | Dtls13Rtx dtls13Rtx; |
6431 | | byte *dtls13ClientHello; |
6432 | | word16 dtls13ClientHelloSz; |
6433 | | |
6434 | | #endif /* WOLFSSL_DTLS13 */ |
6435 | | #ifdef WOLFSSL_DTLS_CID |
6436 | | CIDInfo *dtlsCidInfo; |
6437 | | #endif /* WOLFSSL_DTLS_CID */ |
6438 | | |
6439 | | #endif /* WOLFSSL_DTLS */ |
6440 | | #ifdef WOLFSSL_CALLBACKS |
6441 | | TimeoutInfo timeoutInfo; /* info saved during handshake */ |
6442 | | HandShakeInfo handShakeInfo; /* info saved during handshake */ |
6443 | | #endif |
6444 | | #ifdef OPENSSL_EXTRA |
6445 | | SSL_Msg_Cb protoMsgCb; /* inspect protocol message callback */ |
6446 | | void* protoMsgCtx; /* user set context with msg callback */ |
6447 | | #endif |
6448 | | #if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA) |
6449 | | byte hsInfoOn; /* track handshake info */ |
6450 | | byte toInfoOn; /* track timeout info */ |
6451 | | #endif |
6452 | | #ifdef HAVE_FUZZER |
6453 | | CallbackFuzzer fuzzerCb; /* for testing with using fuzzer */ |
6454 | | void* fuzzerCtx; /* user defined pointer */ |
6455 | | #endif |
6456 | | #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) |
6457 | | CertReqCtx* certReqCtx; |
6458 | | #endif |
6459 | | #ifdef WOLFSSL_LOCAL_X509_STORE |
6460 | | WOLFSSL_X509_STORE* x509_store_pt; /* take ownership of external store */ |
6461 | | #endif |
6462 | | #ifdef KEEP_PEER_CERT |
6463 | | /* TODO put this on the heap so we can properly use the |
6464 | | * reference counter and not have to duplicate it. */ |
6465 | | WOLFSSL_X509 peerCert; /* X509 peer cert */ |
6466 | | #endif |
6467 | | #ifdef KEEP_OUR_CERT |
6468 | | WOLFSSL_X509* ourCert; /* keep alive a X509 struct of cert. |
6469 | | points to ctx if not owned (owned |
6470 | | flag found in buffers.weOwnCert) */ |
6471 | | #endif |
6472 | | byte keepCert; /* keep certificate after handshake */ |
6473 | | #ifdef HAVE_EX_DATA |
6474 | | WOLFSSL_CRYPTO_EX_DATA ex_data; /* external data, for Fortress */ |
6475 | | #endif |
6476 | | int devId; /* async device id to use */ |
6477 | | #ifdef HAVE_ONE_TIME_AUTH |
6478 | | OneTimeAuth auth; |
6479 | | #endif |
6480 | | #ifdef HAVE_TLS_EXTENSIONS |
6481 | | TLSX* extensions; /* RFC 6066 TLS Extensions data */ |
6482 | | #ifdef HAVE_MAX_FRAGMENT |
6483 | | word16 max_fragment; |
6484 | | #endif |
6485 | | #ifdef HAVE_TRUNCATED_HMAC |
6486 | | byte truncated_hmac; |
6487 | | #endif |
6488 | | #ifdef HAVE_CERTIFICATE_STATUS_REQUEST |
6489 | | byte status_request; |
6490 | | #endif |
6491 | | #ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2 |
6492 | | byte status_request_v2; |
6493 | | #endif |
6494 | | #if defined(HAVE_SECURE_RENEGOTIATION) \ |
6495 | | || defined(HAVE_SERVER_RENEGOTIATION_INFO) |
6496 | | int secure_rene_count; /* how many times */ |
6497 | | SecureRenegotiation* secure_renegotiation; /* valid pointer indicates */ |
6498 | | #endif /* user turned on */ |
6499 | | #ifdef HAVE_ALPN |
6500 | | byte *alpn_peer_requested; /* the ALPN bytes requested by peer, sequence |
6501 | | * of length byte + chars */ |
6502 | | word16 alpn_peer_requested_length; /* number of bytes total */ |
6503 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || \ |
6504 | | defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_QUIC) |
6505 | | CallbackALPNSelect alpnSelect; |
6506 | | void* alpnSelectArg; |
6507 | | #endif |
6508 | | #endif /* of accepted protocols */ |
6509 | | #if !defined(NO_WOLFSSL_CLIENT) && defined(HAVE_SESSION_TICKET) |
6510 | | CallbackSessionTicket session_ticket_cb; |
6511 | | void* session_ticket_ctx; |
6512 | | byte expect_session_ticket; |
6513 | | #endif |
6514 | | word16 hrr_keyshare_group; |
6515 | | #endif /* HAVE_TLS_EXTENSIONS */ |
6516 | | #ifdef HAVE_OCSP |
6517 | | void* ocspIOCtx; |
6518 | | byte ocspProducedDate[MAX_DATE_SIZE]; |
6519 | | int ocspProducedDateFormat; |
6520 | | buffer ocspCsrResp[1 + MAX_CHAIN_DEPTH]; |
6521 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) |
6522 | | char* url; |
6523 | | #endif |
6524 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_CERTIFICATE_STATUS_REQUEST) |
6525 | | word32 response_idx; |
6526 | | #endif |
6527 | | #endif |
6528 | | #ifdef HAVE_NETX |
6529 | | NetX_Ctx nxCtx; /* NetX IO Context */ |
6530 | | #endif |
6531 | | #if defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP) |
6532 | | void* mnCtx; /* mynewt mn_socket IO Context */ |
6533 | | #endif /* defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP) */ |
6534 | | #ifdef WOLFSSL_GNRC |
6535 | | struct gnrc_wolfssl_ctx *gnrcCtx; /* Riot-OS GNRC UDP/IP context */ |
6536 | | #endif |
6537 | | #ifdef SESSION_INDEX |
6538 | | int sessionIndex; /* Session's location in the cache. */ |
6539 | | #endif |
6540 | | #ifdef ATOMIC_USER |
6541 | | void* MacEncryptCtx; /* Atomic User Mac/Encrypt Callback Context */ |
6542 | | void* DecryptVerifyCtx; /* Atomic User Decrypt/Verify Callback Context */ |
6543 | | #ifdef HAVE_ENCRYPT_THEN_MAC |
6544 | | void* EncryptMacCtx; /* Atomic User Encrypt/Mac Callback Ctx */ |
6545 | | void* VerifyDecryptCtx; /* Atomic User Verify/Decrypt Callback Ctx */ |
6546 | | #endif |
6547 | | #endif |
6548 | | #ifdef HAVE_PK_CALLBACKS |
6549 | | #ifdef HAVE_ECC |
6550 | | void* EccKeyGenCtx; /* EccKeyGen Callback Context */ |
6551 | | void* EccSignCtx; /* Ecc Sign Callback Context */ |
6552 | | void* EccVerifyCtx; /* Ecc Verify Callback Context */ |
6553 | | void* EccSharedSecretCtx; /* Ecc Pms Callback Context */ |
6554 | | #endif /* HAVE_ECC */ |
6555 | | #ifdef HAVE_HKDF |
6556 | | void* HkdfExtractCtx; /* Hkdf extract callback context */ |
6557 | | #endif |
6558 | | #ifdef HAVE_ED25519 |
6559 | | void* Ed25519SignCtx; /* ED25519 Sign Callback Context */ |
6560 | | void* Ed25519VerifyCtx; /* ED25519 Verify Callback Context */ |
6561 | | #endif |
6562 | | #ifdef HAVE_CURVE25519 |
6563 | | void* X25519KeyGenCtx; /* X25519 KeyGen Callback Context */ |
6564 | | void* X25519SharedSecretCtx; /* X25519 Pms Callback Context */ |
6565 | | #endif |
6566 | | #ifdef HAVE_ED448 |
6567 | | void* Ed448SignCtx; /* ED448 Sign Callback Context */ |
6568 | | void* Ed448VerifyCtx; /* ED448 Verify Callback Context */ |
6569 | | #endif |
6570 | | #ifdef HAVE_CURVE448 |
6571 | | void* X448KeyGenCtx; /* X448 KeyGen Callback Context */ |
6572 | | void* X448SharedSecretCtx; /* X448 Pms Callback Context */ |
6573 | | #endif |
6574 | | #ifndef NO_DH |
6575 | | void* DhAgreeCtx; /* DH Pms Callback Context */ |
6576 | | #endif /* !NO_DH */ |
6577 | | #ifndef NO_RSA |
6578 | | void* RsaSignCtx; /* Rsa Sign Callback Context */ |
6579 | | void* RsaVerifyCtx; /* Rsa Verify Callback Context */ |
6580 | | #ifdef WC_RSA_PSS |
6581 | | void* RsaPssSignCtx; /* Rsa PSS Sign Callback Context */ |
6582 | | void* RsaPssVerifyCtx; /* Rsa PSS Verify Callback Context */ |
6583 | | #endif |
6584 | | void* RsaEncCtx; /* Rsa Public Encrypt Callback Context */ |
6585 | | void* RsaDecCtx; /* Rsa Private Decrypt Callback Context */ |
6586 | | #endif /* NO_RSA */ |
6587 | | void* GenPreMasterCtx; /* Generate Premaster Callback Context */ |
6588 | | void* GenMasterCtx; /* Generate Master Callback Context */ |
6589 | | void* GenExtMasterCtx; /* Generate Extended Master Callback Context */ |
6590 | | void* GenSessionKeyCtx; /* Generate Session Key Callback Context */ |
6591 | | void* EncryptKeysCtx; /* Set Encrypt keys Callback Context */ |
6592 | | void* TlsFinishedCtx; /* Generate Tls Finished Callback Context */ |
6593 | | void* VerifyMacCtx; /* Verify mac Callback Context */ |
6594 | | #endif /* HAVE_PK_CALLBACKS */ |
6595 | | #ifdef HAVE_SECRET_CALLBACK |
6596 | | SessionSecretCb sessionSecretCb; |
6597 | | void* sessionSecretCtx; |
6598 | | TicketParseCb ticketParseCb; |
6599 | | void* ticketParseCtx; |
6600 | | TlsSecretCb tlsSecretCb; |
6601 | | void* tlsSecretCtx; |
6602 | | #ifdef WOLFSSL_TLS13 |
6603 | | Tls13SecretCb tls13SecretCb; |
6604 | | void* tls13SecretCtx; |
6605 | | #endif |
6606 | | #ifdef OPENSSL_EXTRA |
6607 | | SessionSecretCb keyLogCb; |
6608 | | #ifdef WOLFSSL_TLS13 |
6609 | | Tls13SecretCb tls13KeyLogCb; |
6610 | | #endif |
6611 | | #endif |
6612 | | #endif /* HAVE_SECRET_CALLBACK */ |
6613 | | #ifdef WOLFSSL_JNI |
6614 | | void* jObjectRef; /* reference to WolfSSLSession in JNI wrapper */ |
6615 | | #endif /* WOLFSSL_JNI */ |
6616 | | #ifdef WOLFSSL_EARLY_DATA |
6617 | | EarlyDataState earlyData; |
6618 | | word32 earlyDataSz; |
6619 | | byte earlyDataStatus; |
6620 | | #endif |
6621 | | #if defined(OPENSSL_EXTRA) |
6622 | | WOLFSSL_STACK* supportedCiphers; /* Used in wolfSSL_get_ciphers_compat */ |
6623 | | WOLFSSL_STACK* peerCertChain; /* Used in wolfSSL_get_peer_cert_chain */ |
6624 | | WOLFSSL_STACK* verifiedChain; /* peer cert chain to CA */ |
6625 | | #ifdef KEEP_OUR_CERT |
6626 | | WOLFSSL_STACK* ourCertChain; /* Used in wolfSSL_add1_chain_cert */ |
6627 | | #endif |
6628 | | #endif |
6629 | | #ifdef WOLFSSL_STATIC_EPHEMERAL |
6630 | | StaticKeyExchangeInfo_t staticKE; |
6631 | | #endif |
6632 | | #ifdef WOLFSSL_MAXQ10XX_TLS |
6633 | | maxq_ssl_t maxq_ctx; |
6634 | | #endif |
6635 | | #ifdef WOLFSSL_HAVE_TLS_UNIQUE |
6636 | | /* Added in libest port: allow applications to get the 'tls-unique' Channel |
6637 | | * Binding Type (https://tools.ietf.org/html/rfc5929#section-3). This is |
6638 | | * used in the EST protocol to bind an enrollment to a TLS session through |
6639 | | * 'proof-of-possession' (https://tools.ietf.org/html/rfc7030#section-3.4 |
6640 | | * and https://tools.ietf.org/html/rfc7030#section-3.5). */ |
6641 | | byte clientFinished[TLS_FINISHED_SZ_MAX]; |
6642 | | byte serverFinished[TLS_FINISHED_SZ_MAX]; |
6643 | | byte clientFinished_len; |
6644 | | byte serverFinished_len; |
6645 | | #endif |
6646 | | #ifndef WOLFSSL_NO_CA_NAMES |
6647 | | WOLF_STACK_OF(WOLFSSL_X509_NAME)* client_ca_names; /* Used in *_set/get_client_CA_list |
6648 | | (server only) */ |
6649 | | WOLF_STACK_OF(WOLFSSL_X509_NAME)* ca_names; /* Used in *_set0/get0_CA_list */ |
6650 | | WOLF_STACK_OF(WOLFSSL_X509_NAME)* peer_ca_names; /* Used in *_get0_peer_CA_list |
6651 | | and (client only) |
6652 | | wolfSSL_get_client_CA_list */ |
6653 | | #endif |
6654 | | #if defined(WOLFSSL_IOTSAFE) && defined(HAVE_PK_CALLBACKS) |
6655 | | IOTSAFE iotsafe; |
6656 | | #endif |
6657 | | #ifdef WOLFSSL_LWIP_NATIVE |
6658 | | WOLFSSL_LWIP_NATIVE_STATE lwipCtx; /* LwIP native socket IO Context */ |
6659 | | #endif |
6660 | | #ifdef WOLFSSL_QUIC |
6661 | | struct { |
6662 | | const WOLFSSL_QUIC_METHOD* method; |
6663 | | WOLFSSL_ENCRYPTION_LEVEL enc_level_read; |
6664 | | WOLFSSL_ENCRYPTION_LEVEL enc_level_read_next; |
6665 | | WOLFSSL_ENCRYPTION_LEVEL enc_level_latest_recvd; |
6666 | | WOLFSSL_ENCRYPTION_LEVEL enc_level_write; |
6667 | | WOLFSSL_ENCRYPTION_LEVEL enc_level_write_next; |
6668 | | int transport_version; |
6669 | | const QuicTransportParam* transport_local; |
6670 | | const QuicTransportParam* transport_peer; |
6671 | | const QuicTransportParam* transport_peer_draft; |
6672 | | QuicRecord* input_head; /* we own, data for handshake */ |
6673 | | QuicRecord* input_tail; /* points to last element for append */ |
6674 | | QuicRecord* scratch; /* we own, record construction */ |
6675 | | enum wolfssl_encryption_level_t output_rec_level; |
6676 | | /* encryption level of current output record */ |
6677 | | word32 output_rec_remain; /* how many bytes of output TLS record |
6678 | | * content have not been handled yet by quic */ |
6679 | | } quic; |
6680 | | #endif /* WOLFSSL_QUIC */ |
6681 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) |
6682 | | WOLFSSL_EchConfig* echConfigs; |
6683 | | WOLFSSL_EchConfig* echRetryConfigs; |
6684 | | #endif |
6685 | | #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) && defined(WOLFSSL_TEST_ECH) |
6686 | | /* Test-only hook: called on the client before ECH encryption, after the |
6687 | | * inner ClientHello body is fully constructed. The callback may modify |
6688 | | * innerCh in-place (length stays the same). */ |
6689 | | int (*echInnerHelloCb)(byte* innerCh, word32 innerChLen); |
6690 | | #endif |
6691 | | |
6692 | | #if defined(WOLFSSL_SNIFFER) && defined(WOLFSSL_SNIFFER_KEYLOGFILE) |
6693 | | SSLSnifferSecretCb snifferSecretCb; |
6694 | | #endif /* WOLFSSL_SNIFFER && WOLFSSL_SNIFFER_KEYLOGFILE */ |
6695 | | #ifdef WOLFSSL_DUAL_ALG_CERTS |
6696 | | byte *sigSpec; /* This pointer never owns the memory. */ |
6697 | | word16 sigSpecSz; |
6698 | | byte *peerSigSpec; /* This pointer always owns the memory. */ |
6699 | | word16 peerSigSpecSz; |
6700 | | #endif |
6701 | | #if defined(WOLFSSL_SYS_CRYPTO_POLICY) |
6702 | | int secLevel; /* The security level of system-wide crypto policy. */ |
6703 | | #endif /* WOLFSSL_SYS_CRYPTO_POLICY */ |
6704 | | #if !defined(NO_WOLFSSL_CLIENT) && !defined(WOLFSSL_NO_TLS12) && \ |
6705 | | defined(WOLFSSL_HARDEN_TLS) && !defined(WOLFSSL_HARDEN_TLS_NO_SCR_CHECK) |
6706 | | WC_BITFIELD scr_check_enabled:1; /* enable/disable SCR check */ |
6707 | | #endif |
6708 | | #ifdef HAVE_WRITE_DUP |
6709 | | #ifdef WOLFSSL_TLS13 |
6710 | | #ifdef WOLFSSL_POST_HANDSHAKE_AUTH |
6711 | | WC_BITFIELD postHandshakeAuthPending:1; |
6712 | | #endif |
6713 | | #endif |
6714 | | #endif |
6715 | | /* Cached BuildMessage(sizeOnly) overhead (recordSz - payloadSz) for AEAD |
6716 | | * ciphers; 0 means uncached and is never a valid AEAD overhead. EtM does |
6717 | | * not apply to AEAD. */ |
6718 | | word32 recordSzOverhead; |
6719 | | }; |
6720 | | |
6721 | | #if defined(WOLFSSL_SYS_CRYPTO_POLICY) |
6722 | | #define WOLFSSL_SECLEVEL_STR "@SECLEVEL=" |
6723 | | struct SystemCryptoPolicy { |
6724 | | int enabled; |
6725 | | int secLevel; |
6726 | | char str[MAX_WOLFSSL_CRYPTO_POLICY_SIZE + 1]; /* + 1 for null term */ |
6727 | | }; |
6728 | | #endif /* WOLFSSL_SYS_CRYPTO_POLICY */ |
6729 | | |
6730 | | /* |
6731 | | * wolfSSL_PEM_read_bio_X509 pushes an ASN_NO_PEM_HEADER error |
6732 | | * to the error queue on file end. This should not be left |
6733 | | * for the caller to find so we clear the last error. |
6734 | | */ |
6735 | | #if defined(OPENSSL_EXTRA) && defined(WOLFSSL_HAVE_ERROR_QUEUE) |
6736 | | #define CLEAR_ASN_NO_PEM_HEADER_ERROR(err) \ |
6737 | | do { \ |
6738 | | (err) = wolfSSL_ERR_peek_last_error(); \ |
6739 | | if (wolfSSL_ERR_GET_LIB(err) == WOLFSSL_ERR_LIB_PEM && \ |
6740 | | wolfSSL_ERR_GET_REASON(err) == -WOLFSSL_PEM_R_NO_START_LINE_E) { \ |
6741 | | unsigned long peekErr; \ |
6742 | | do { \ |
6743 | | wc_RemoveErrorNode(-1); \ |
6744 | | peekErr = wolfSSL_ERR_peek_last_error(); \ |
6745 | | } while (wolfSSL_ERR_GET_LIB(peekErr) == WOLFSSL_ERR_LIB_PEM && \ |
6746 | | wolfSSL_ERR_GET_REASON(peekErr) == \ |
6747 | | -WOLFSSL_PEM_R_NO_START_LINE_E); \ |
6748 | | } \ |
6749 | | } while(0) |
6750 | | #else |
6751 | 0 | #define CLEAR_ASN_NO_PEM_HEADER_ERROR(err) (void)(err); |
6752 | | #endif |
6753 | | |
6754 | | /* |
6755 | | * The SSL object may have its own certificate store. The below macros simplify |
6756 | | * logic for choosing which WOLFSSL_CERT_MANAGER and WOLFSSL_X509_STORE to use. |
6757 | | * Always use SSL specific objects when available and revert to CTX otherwise. |
6758 | | */ |
6759 | | #ifdef WOLFSSL_LOCAL_X509_STORE |
6760 | | #define SSL_CM(ssl) ((ssl)->x509_store_pt ? (ssl)->x509_store_pt->cm : \ |
6761 | | ((ssl)->ctx->x509_store_pt ? (ssl)->ctx->x509_store_pt->cm : \ |
6762 | | (ssl)->ctx->cm)) |
6763 | | #define SSL_STORE(ssl) ((ssl)->x509_store_pt ? (ssl)->x509_store_pt : \ |
6764 | | ((ssl)->ctx->x509_store_pt ? (ssl)->ctx->x509_store_pt : \ |
6765 | | &(ssl)->ctx->x509_store)) |
6766 | | #define CTX_STORE(ctx) ((ctx)->x509_store_pt ? (ctx)->x509_store_pt : \ |
6767 | | &(ctx)->x509_store) |
6768 | | #else |
6769 | 0 | #define SSL_CM(ssl) (ssl)->ctx->cm |
6770 | | #endif |
6771 | | /* Issue warning when we are modifying the overall context CM */ |
6772 | | #define SSL_CM_WARNING(ssl) \ |
6773 | 0 | do { \ |
6774 | 0 | if (SSL_CM( (ssl) ) == (ssl)->ctx->cm) { \ |
6775 | 0 | WOLFSSL_MSG("Modifying SSL_CTX CM not SSL specific CM"); \ |
6776 | 0 | } \ |
6777 | 0 | } while (0) |
6778 | | |
6779 | | WOLFSSL_LOCAL int SetSSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup); |
6780 | | WOLFSSL_LOCAL int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup); |
6781 | | WOLFSSL_LOCAL int ReinitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup); |
6782 | | WOLFSSL_LOCAL void FreeSSL(WOLFSSL* ssl, void* heap); |
6783 | | WOLFSSL_TEST_VIS void wolfSSL_ResourceFree(WOLFSSL* ssl); /* Micrium uses */ |
6784 | | #ifndef OPENSSL_COEXIST |
6785 | | #define SSL_ResourceFree wolfSSL_ResourceFree |
6786 | | #endif |
6787 | | |
6788 | | |
6789 | | #ifndef NO_CERTS |
6790 | | |
6791 | | WOLFSSL_LOCAL int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff, |
6792 | | long sz, int format, int type, WOLFSSL* ssl, |
6793 | | long* used, int userChain, int verify, |
6794 | | const char *source_name); |
6795 | | WOLFSSL_LOCAL int ProcessFile(WOLFSSL_CTX* ctx, const char* fname, int format, |
6796 | | int type, WOLFSSL* ssl, int userChain, |
6797 | | WOLFSSL_CRL* crl, int verify); |
6798 | | |
6799 | | #ifndef NO_ASN |
6800 | | WOLFSSL_LOCAL int CheckHostName(DecodedCert* dCert, const char *domainName, |
6801 | | size_t domainNameLen, unsigned int flags, |
6802 | | byte isIP); |
6803 | | #endif |
6804 | | #endif |
6805 | | |
6806 | | |
6807 | | #if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA) |
6808 | | WOLFSSL_LOCAL void InitHandShakeInfo(HandShakeInfo* info, WOLFSSL* ssl); |
6809 | | WOLFSSL_LOCAL void FinishHandShakeInfo(HandShakeInfo* info); |
6810 | | WOLFSSL_LOCAL void AddPacketName(WOLFSSL* ssl, const char* name); |
6811 | | |
6812 | | WOLFSSL_LOCAL void InitTimeoutInfo(TimeoutInfo* info); |
6813 | | WOLFSSL_LOCAL void FreeTimeoutInfo(TimeoutInfo* info, void* heap); |
6814 | | WOLFSSL_LOCAL int AddPacketInfo(WOLFSSL* ssl, const char* name, int type, |
6815 | | const byte* data, int sz, int written, int lateRL, |
6816 | | void* heap); |
6817 | | WOLFSSL_LOCAL void AddLateName(const char* name, TimeoutInfo* info); |
6818 | | WOLFSSL_LOCAL void AddLateRecordHeader(const RecordLayerHeader* rl, |
6819 | | TimeoutInfo* info); |
6820 | | #endif |
6821 | | |
6822 | | |
6823 | | /* Record Layer Header identifier from page 12 */ |
6824 | | enum ContentType { |
6825 | | no_type = 0, |
6826 | | change_cipher_spec = 20, |
6827 | | alert = 21, |
6828 | | handshake = 22, |
6829 | | application_data = 23, |
6830 | | dtls12_cid = 25, |
6831 | | #ifdef WOLFSSL_DTLS13 |
6832 | | ack = 26, |
6833 | | #endif /* WOLFSSL_DTLS13 */ |
6834 | | WOLF_ENUM_DUMMY_LAST_ELEMENT(ContentType) |
6835 | | }; |
6836 | | |
6837 | | |
6838 | | /* handshake header, same for each message type, pgs 20/21 */ |
6839 | | typedef struct HandShakeHeader { |
6840 | | byte type; |
6841 | | word24 length; |
6842 | | } HandShakeHeader; |
6843 | | |
6844 | | |
6845 | | /* DTLS handshake header, same for each message type */ |
6846 | | typedef struct DtlsHandShakeHeader { |
6847 | | byte type; |
6848 | | word24 length; |
6849 | | byte message_seq[2]; /* start at 0, retransmit gets same # */ |
6850 | | word24 fragment_offset; /* bytes in previous fragments */ |
6851 | | word24 fragment_length; /* length of this fragment */ |
6852 | | } DtlsHandShakeHeader; |
6853 | | |
6854 | | |
6855 | | enum HandShakeType { |
6856 | | hello_request = 0, |
6857 | | client_hello = 1, |
6858 | | server_hello = 2, |
6859 | | hello_verify_request = 3, /* DTLS addition */ |
6860 | | session_ticket = 4, |
6861 | | end_of_early_data = 5, |
6862 | | hello_retry_request = 6, |
6863 | | encrypted_extensions = 8, |
6864 | | request_connection_id = 9, /* DTLS v1.3 addition (RFC 9147) */ |
6865 | | new_connection_id = 10, /* DTLS v1.3 addition (RFC 9147) */ |
6866 | | certificate = 11, |
6867 | | server_key_exchange = 12, |
6868 | | certificate_request = 13, |
6869 | | server_hello_done = 14, |
6870 | | certificate_verify = 15, |
6871 | | client_key_exchange = 16, |
6872 | | finished = 20, |
6873 | | certificate_status = 22, |
6874 | | key_update = 24, |
6875 | | change_cipher_hs = 55, /* simulate unique handshake type for sanity |
6876 | | checks. record layer change_cipher |
6877 | | conflicts with handshake finished */ |
6878 | | message_hash = 254, /* synthetic message type for TLS v1.3 */ |
6879 | | no_shake = 255 /* used to initialize the DtlsMsg record */ |
6880 | | }; |
6881 | | |
6882 | | enum ProvisionSide { |
6883 | | PROVISION_CLIENT = 1, |
6884 | | PROVISION_SERVER = 2, |
6885 | | PROVISION_CLIENT_SERVER = 3 |
6886 | | }; |
6887 | | |
6888 | | /* cipher requirements */ |
6889 | | enum { |
6890 | | REQUIRES_RSA, |
6891 | | REQUIRES_DHE, |
6892 | | REQUIRES_ECC, |
6893 | | REQUIRES_ECC_STATIC, |
6894 | | REQUIRES_PSK, |
6895 | | REQUIRES_RSA_SIG, |
6896 | | REQUIRES_AEAD |
6897 | | }; |
6898 | | |
6899 | | static const byte kTlsClientStr[SIZEOF_SENDER+1] = { 0x43, 0x4C, 0x4E, 0x54, 0x00 }; /* CLNT */ |
6900 | | static const byte kTlsServerStr[SIZEOF_SENDER+1] = { 0x53, 0x52, 0x56, 0x52, 0x00 }; /* SRVR */ |
6901 | | |
6902 | | static const byte kTlsClientFinStr[FINISHED_LABEL_SZ + 1] = "client finished"; |
6903 | | static const byte kTlsServerFinStr[FINISHED_LABEL_SZ + 1] = "server finished"; |
6904 | | |
6905 | | #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL) || defined(HAVE_CURL) |
6906 | | typedef struct { |
6907 | | int name_len; |
6908 | | const char *name; |
6909 | | int nid; |
6910 | | word16 curve; |
6911 | | } WOLF_EC_NIST_NAME; |
6912 | | extern const WOLF_EC_NIST_NAME kNistCurves[]; |
6913 | | WOLFSSL_LOCAL int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, |
6914 | | const char* names, byte curves_only); |
6915 | | #endif /* OPENSSL_EXTRA || WOLFSSL_WPAS_SMALL || HAVE_CURL */ |
6916 | | |
6917 | | /* internal functions */ |
6918 | | WOLFSSL_LOCAL int SendChangeCipher(WOLFSSL* ssl); |
6919 | | WOLFSSL_LOCAL int SendTicket(WOLFSSL* ssl); |
6920 | | #ifdef HAVE_SESSION_TICKET |
6921 | | WOLFSSL_LOCAL int DoDecryptTicket(const WOLFSSL* ssl, const byte* input, |
6922 | | word32 len, InternalTicket **it); |
6923 | | /* Return 0 when check successful. <0 on failure. */ |
6924 | | WOLFSSL_LOCAL void DoClientTicketFinalize(WOLFSSL* ssl, InternalTicket* it, |
6925 | | const WOLFSSL_SESSION* sess); |
6926 | | |
6927 | | #ifdef WOLFSSL_TLS13 |
6928 | | WOLFSSL_LOCAL int DoClientTicketCheck(const WOLFSSL* ssl, |
6929 | | const PreSharedKey* psk, sword64 timeout, const byte* suite); |
6930 | | WOLFSSL_LOCAL void CleanupClientTickets(PreSharedKey* psk); |
6931 | | WOLFSSL_LOCAL int DoClientTicket_ex(const WOLFSSL* ssl, PreSharedKey* psk, |
6932 | | int retainSess); |
6933 | | #endif |
6934 | | |
6935 | | WOLFSSL_LOCAL int DoClientTicket(WOLFSSL* ssl, const byte* input, word32 len); |
6936 | | /* TicketSniHash, TicketAlpnHash, and VerifyTicketBinding are defined in |
6937 | | * internal.c only when !NO_WOLFSSL_SERVER && !NO_TLS - gate the |
6938 | | * declarations to match so client-only or no-TLS builds don't compile in |
6939 | | * call sites that would fail to link. */ |
6940 | | #if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS) |
6941 | | #ifdef HAVE_SNI |
6942 | | WOLFSSL_LOCAL int TicketSniHash(WOLFSSL* ssl, byte* dst); |
6943 | | #endif |
6944 | | #ifdef HAVE_ALPN |
6945 | | WOLFSSL_LOCAL int TicketAlpnHash(WOLFSSL* ssl, byte* dst); |
6946 | | #endif |
6947 | | #if defined(HAVE_SNI) || defined(HAVE_ALPN) |
6948 | | WOLFSSL_LOCAL int VerifyTicketBinding(WOLFSSL* ssl); |
6949 | | #endif |
6950 | | #endif /* !NO_WOLFSSL_SERVER && !NO_TLS */ |
6951 | | #endif /* HAVE_SESSION_TICKET */ |
6952 | | WOLFSSL_LOCAL int SendData(WOLFSSL* ssl, const void* data, size_t sz); |
6953 | | #ifdef WOLFSSL_THREADED_CRYPT |
6954 | | WOLFSSL_LOCAL int SendAsyncData(WOLFSSL* ssl); |
6955 | | #endif |
6956 | | #ifdef WOLFSSL_TLS13 |
6957 | | WOLFSSL_LOCAL int SendTls13ServerHello(WOLFSSL* ssl, byte extMsgType); |
6958 | | #endif |
6959 | | WOLFSSL_LOCAL int SendCertificate(WOLFSSL* ssl); |
6960 | | WOLFSSL_LOCAL int SendCertificateRequest(WOLFSSL* ssl); |
6961 | | #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \ |
6962 | | || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) |
6963 | | WOLFSSL_LOCAL int CreateOcspResponse(WOLFSSL* ssl, OcspRequest** ocspRequest, |
6964 | | buffer* response); |
6965 | | #endif |
6966 | | #if defined(HAVE_SECURE_RENEGOTIATION) && \ |
6967 | | !defined(NO_WOLFSSL_SERVER) |
6968 | | WOLFSSL_LOCAL int SendHelloRequest(WOLFSSL* ssl); |
6969 | | #endif |
6970 | | WOLFSSL_LOCAL int SendCertificateStatus(WOLFSSL* ssl); |
6971 | | WOLFSSL_LOCAL int SendServerKeyExchange(WOLFSSL* ssl); |
6972 | | WOLFSSL_LOCAL int SendBuffered(WOLFSSL* ssl); |
6973 | | WOLFSSL_LOCAL int ReceiveData(WOLFSSL* ssl, byte* output, size_t sz, int peek); |
6974 | | WOLFSSL_LOCAL int SendFinished(WOLFSSL* ssl); |
6975 | | WOLFSSL_LOCAL int RetrySendAlert(WOLFSSL* ssl); |
6976 | | WOLFSSL_LOCAL int SendAlert(WOLFSSL* ssl, int severity, int type); |
6977 | | WOLFSSL_LOCAL int SendFatalAlertOnly(WOLFSSL *ssl, int error); |
6978 | | WOLFSSL_LOCAL int ProcessReply(WOLFSSL* ssl); |
6979 | | WOLFSSL_LOCAL int ProcessReplyEx(WOLFSSL* ssl, int allowSocketErr); |
6980 | | |
6981 | | WOLFSSL_LOCAL const char* AlertTypeToString(int type); |
6982 | | |
6983 | | WOLFSSL_LOCAL int SetCipherSpecs(WOLFSSL* ssl); |
6984 | | WOLFSSL_LOCAL int GetCipherSpec(word16 side, byte cipherSuite0, |
6985 | | byte cipherSuite, CipherSpecs* specs, Options* opts); |
6986 | | WOLFSSL_LOCAL int MakeMasterSecret(WOLFSSL* ssl); |
6987 | | |
6988 | | WOLFSSL_LOCAL int DeriveKeys(WOLFSSL* ssl); |
6989 | | WOLFSSL_LOCAL int StoreKeys(WOLFSSL* ssl, const byte* keyData, int side); |
6990 | | |
6991 | | WOLFSSL_LOCAL int IsTLS(const WOLFSSL* ssl); |
6992 | | WOLFSSL_LOCAL int IsTLS_ex(const ProtocolVersion pv); |
6993 | | WOLFSSL_LOCAL int IsAtLeastTLSv1_2(const WOLFSSL* ssl); |
6994 | | WOLFSSL_LOCAL int IsAtLeastTLSv1_3(const ProtocolVersion pv); |
6995 | | WOLFSSL_LOCAL int IsEncryptionOn(const WOLFSSL* ssl, int isSend); |
6996 | | WOLFSSL_LOCAL int TLSv1_3_Capable(WOLFSSL* ssl); |
6997 | | |
6998 | | WOLFSSL_LOCAL void FreeHandshakeResources(WOLFSSL* ssl); |
6999 | | WOLFSSL_LOCAL void ShrinkInputBuffer(WOLFSSL* ssl, int forcedFree); |
7000 | | WOLFSSL_LOCAL void ShrinkOutputBuffer(WOLFSSL* ssl); |
7001 | | WOLFSSL_LOCAL byte* GetOutputBuffer(WOLFSSL* ssl); |
7002 | | |
7003 | | WOLFSSL_LOCAL int CipherRequires(byte first, byte second, int requirement); |
7004 | | WOLFSSL_LOCAL int VerifyClientSuite(word16 havePSK, byte cipherSuite0, |
7005 | | byte cipherSuite); |
7006 | | |
7007 | | WOLFSSL_LOCAL int SetTicket(WOLFSSL* ssl, const byte* ticket, word32 length); |
7008 | | WOLFSSL_TEST_VIS int wolfssl_local_GetRecordSize(WOLFSSL *ssl, int payloadSz, |
7009 | | int isEncrypted); |
7010 | | WOLFSSL_LOCAL int wolfssl_local_GetMaxPlaintextSize(WOLFSSL *ssl); |
7011 | | WOLFSSL_LOCAL int wolfSSL_GetMaxFragSize(WOLFSSL* ssl); |
7012 | | |
7013 | | #if defined(WOLFSSL_IOTSAFE) && defined(HAVE_PK_CALLBACKS) |
7014 | | WOLFSSL_LOCAL IOTSAFE *wolfSSL_get_iotsafe_ctx(WOLFSSL *ssl); |
7015 | | WOLFSSL_LOCAL int wolfSSL_set_iotsafe_ctx(WOLFSSL *ssl, IOTSAFE *iotsafe); |
7016 | | #endif |
7017 | | |
7018 | | #if (defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)) && defined(HAVE_ECC) |
7019 | | WOLFSSL_LOCAL int SetECKeyInternal(WOLFSSL_EC_KEY* eckey); |
7020 | | WOLFSSL_LOCAL int SetECKeyExternal(WOLFSSL_EC_KEY* eckey); |
7021 | | #endif |
7022 | | |
7023 | | #if defined(OPENSSL_EXTRA) || defined(HAVE_CURL) |
7024 | | WOLFSSL_LOCAL int wolfSSL_curve_is_disabled(const WOLFSSL* ssl, |
7025 | | word16 curve_id); |
7026 | | #else |
7027 | | static WC_INLINE int wolfSSL_curve_is_disabled(const WOLFSSL* ssl, |
7028 | | word16 curve_id) |
7029 | 0 | { |
7030 | 0 | (void)ssl; |
7031 | 0 | (void)curve_id; |
7032 | 0 | return 0; |
7033 | 0 | } Unexecuted instantiation: asn.c:wolfSSL_curve_is_disabled Unexecuted instantiation: ssl.c:wolfSSL_curve_is_disabled Unexecuted instantiation: tls.c:wolfSSL_curve_is_disabled Unexecuted instantiation: tls13.c:wolfSSL_curve_is_disabled Unexecuted instantiation: internal.c:wolfSSL_curve_is_disabled Unexecuted instantiation: keys.c:wolfSSL_curve_is_disabled Unexecuted instantiation: wolfio.c:wolfSSL_curve_is_disabled |
7034 | | #endif |
7035 | | |
7036 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
7037 | | WOLFSSL_LOCAL WC_RNG* WOLFSSL_RSA_GetRNG(WOLFSSL_RSA *rsa, WC_RNG **tmpRNG, |
7038 | | int *initTmpRng); |
7039 | | #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */ |
7040 | | |
7041 | | #ifndef NO_RSA |
7042 | | #ifdef WC_RSA_PSS |
7043 | | WOLFSSL_LOCAL int CheckRsaPssPadding(const byte* plain, word32 plainSz, |
7044 | | byte* out, word32 sigSz, enum wc_HashType hashType); |
7045 | | WOLFSSL_LOCAL int ConvertHashPss(int hashAlgo, |
7046 | | enum wc_HashType* hashType, int* mgf); |
7047 | | #endif |
7048 | | WOLFSSL_LOCAL int VerifyRsaSign(WOLFSSL* ssl, byte* verifySig, |
7049 | | word32 sigSz, const byte* plain, word32 plainSz, int sigAlgo, |
7050 | | int hashAlgo, RsaKey* key, DerBuffer* keyBufInfo); |
7051 | | WOLFSSL_LOCAL int RsaSign(WOLFSSL* ssl, const byte* in, word32 inSz, |
7052 | | byte* out, word32* outSz, int sigAlgo, int hashAlgo, RsaKey* key, |
7053 | | DerBuffer* keyBufInfo); |
7054 | | WOLFSSL_LOCAL int RsaVerify(WOLFSSL* ssl, byte* in, word32 inSz, |
7055 | | byte** out, int sigAlgo, int hashAlgo, RsaKey* key, |
7056 | | buffer* keyBufInfo); |
7057 | | WOLFSSL_LOCAL int RsaDec(WOLFSSL* ssl, byte* in, word32 inSz, byte** out, |
7058 | | word32* outSz, RsaKey* key, DerBuffer* keyBufInfo); |
7059 | | WOLFSSL_LOCAL int RsaEnc(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out, |
7060 | | word32* outSz, RsaKey* key, buffer* keyBufInfo); |
7061 | | #endif /* !NO_RSA */ |
7062 | | |
7063 | | #ifdef HAVE_ECC |
7064 | | WOLFSSL_LOCAL int EccSign(WOLFSSL* ssl, const byte* in, word32 inSz, |
7065 | | byte* out, word32* outSz, ecc_key* key, DerBuffer* keyBufInfo); |
7066 | | WOLFSSL_LOCAL int EccVerify(WOLFSSL* ssl, const byte* in, word32 inSz, |
7067 | | const byte* out, word32 outSz, ecc_key* key, buffer* keyBufInfo); |
7068 | | WOLFSSL_LOCAL int EccSharedSecret(WOLFSSL* ssl, ecc_key* priv_key, |
7069 | | ecc_key* pub_key, byte* pubKeyDer, word32* pubKeySz, byte* out, |
7070 | | word32* outlen, int side); |
7071 | | #endif /* HAVE_ECC */ |
7072 | | #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3) |
7073 | | WOLFSSL_LOCAL int Sm2wSm3Sign(WOLFSSL* ssl, const byte* id, word32 idSz, |
7074 | | const byte* in, word32 inSz, byte* out, word32* outSz, ecc_key* key, |
7075 | | DerBuffer* keyBufInfo); |
7076 | | WOLFSSL_LOCAL int Sm2wSm3Verify(WOLFSSL* ssl, const byte* id, |
7077 | | word32 idSz, const byte* in, word32 inSz, const byte* out, |
7078 | | word32 outSz, ecc_key* key, buffer* keyBufInfo); |
7079 | | #endif /* WOLFSSL_SM2 && WOLFSSL_SM3 */ |
7080 | | #ifdef HAVE_ED25519 |
7081 | | WOLFSSL_LOCAL int Ed25519CheckPubKey(WOLFSSL* ssl); |
7082 | | WOLFSSL_LOCAL int Ed25519Sign(WOLFSSL* ssl, const byte* in, word32 inSz, |
7083 | | byte* out, word32* outSz, ed25519_key* key, DerBuffer* keyBufInfo); |
7084 | | WOLFSSL_LOCAL int Ed25519Verify(WOLFSSL* ssl, const byte* in, |
7085 | | word32 inSz, const byte* msg, word32 msgSz, ed25519_key* key, |
7086 | | buffer* keyBufInfo); |
7087 | | #endif /* HAVE_ED25519 */ |
7088 | | #ifdef HAVE_ED448 |
7089 | | WOLFSSL_LOCAL int Ed448CheckPubKey(WOLFSSL* ssl); |
7090 | | WOLFSSL_LOCAL int Ed448Sign(WOLFSSL* ssl, const byte* in, word32 inSz, |
7091 | | byte* out, word32* outSz, ed448_key* key, DerBuffer* keyBufInfo); |
7092 | | WOLFSSL_LOCAL int Ed448Verify(WOLFSSL* ssl, const byte* in, |
7093 | | word32 inSz, const byte* msg, word32 msgSz, ed448_key* key, |
7094 | | buffer* keyBufInfo); |
7095 | | #endif /* HAVE_ED448 */ |
7096 | | |
7097 | | #ifndef NO_CERTS |
7098 | | #ifdef WOLFSSL_TRUST_PEER_CERT |
7099 | | |
7100 | | /* options for searching hash table for a matching trusted peer cert */ |
7101 | | #define WC_MATCH_SKID 0 |
7102 | | #define WC_MATCH_NAME 1 |
7103 | | |
7104 | | WOLFSSL_LOCAL TrustedPeerCert* GetTrustedPeer(void* vp, DecodedCert* cert); |
7105 | | WOLFSSL_LOCAL int MatchTrustedPeer(TrustedPeerCert* tp, |
7106 | | DecodedCert* cert); |
7107 | | #endif |
7108 | | |
7109 | | |
7110 | | #ifndef GetCA |
7111 | | WOLFSSL_LOCAL Signer* GetCA(void* vp, byte* hash); |
7112 | | #endif |
7113 | | #if defined(WOLFSSL_AKID_NAME) && !defined(WC_SYM_RELOC_TABLES) |
7114 | | /* note WOLFSSL_API_PREFIX_MAPping is in asn.h, and if |
7115 | | * WC_SYM_RELOC_TABLES, the prototype is in the port layer |
7116 | | * (e.g. linuxkm_wc_port.h), to allow shimming. |
7117 | | */ |
7118 | | WOLFSSL_TEST_VIS Signer* GetCAByAKID(void* vp, const byte* issuer, |
7119 | | word32 issuerSz, const byte* serial, word32 serialSz); |
7120 | | #endif |
7121 | | #if defined(HAVE_OCSP) && !defined(GetCAByKeyHash) |
7122 | | WOLFSSL_LOCAL Signer* GetCAByKeyHash(void* vp, const byte* keyHash); |
7123 | | #endif |
7124 | | #if !defined(NO_SKID) && !defined(GetCAByName) |
7125 | | WOLFSSL_LOCAL Signer* GetCAByName(void* vp, byte* hash); |
7126 | | #endif |
7127 | | #endif /* !NO_CERTS */ |
7128 | | WOLFSSL_LOCAL int BuildTlsHandshakeHash(WOLFSSL* ssl, byte* hash, |
7129 | | word32* hashLen); |
7130 | | WOLFSSL_LOCAL int BuildTlsFinished(WOLFSSL* ssl, Hashes* hashes, |
7131 | | const byte* sender); |
7132 | | WOLFSSL_LOCAL void FreeArrays(WOLFSSL* ssl, int keep); |
7133 | | WOLFSSL_LOCAL int CheckAvailableSize(WOLFSSL *ssl, int size); |
7134 | | WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength); |
7135 | | WOLFSSL_LOCAL int MsgCheckEncryption(WOLFSSL* ssl, byte type, byte encrypted); |
7136 | | WOLFSSL_LOCAL int EarlySanityCheckMsgReceived(WOLFSSL* ssl, byte type, |
7137 | | word32 msgSz); |
7138 | | WOLFSSL_LOCAL int GetHandshakeHeader(WOLFSSL* ssl, const byte* input, |
7139 | | word32* inOutIdx, byte* type, word32* size, word32 totalSz); |
7140 | | #if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH) |
7141 | | WOLFSSL_LOCAL void DoCertFatalAlert(WOLFSSL* ssl, int ret); |
7142 | | #endif |
7143 | | #ifndef NO_TLS |
7144 | | WOLFSSL_LOCAL int MakeTlsMasterSecret(WOLFSSL* ssl); |
7145 | | #ifndef WOLFSSL_AEAD_ONLY |
7146 | | WOLFSSL_LOCAL int TLS_hmac(WOLFSSL* ssl, byte* digest, const byte* in, |
7147 | | word32 sz, int padSz, int content, int verify, int epochOrder); |
7148 | | #endif |
7149 | | #endif |
7150 | | |
7151 | | WOLFSSL_LOCAL int cipherExtraData(WOLFSSL* ssl); |
7152 | | WOLFSSL_LOCAL word32 MacSize(const WOLFSSL* ssl); |
7153 | | |
7154 | | #ifndef NO_WOLFSSL_CLIENT |
7155 | | WOLFSSL_LOCAL int HaveUniqueSessionObj(WOLFSSL* ssl); |
7156 | | WOLFSSL_LOCAL int SendClientHello(WOLFSSL* ssl); |
7157 | | WOLFSSL_LOCAL int DoHelloVerifyRequest(WOLFSSL* ssl, const byte* input, word32* inOutIdx, |
7158 | | word32 size); |
7159 | | #ifdef WOLFSSL_TLS13 |
7160 | | WOLFSSL_LOCAL int SendTls13ClientHello(WOLFSSL* ssl); |
7161 | | #endif |
7162 | | WOLFSSL_LOCAL int SendClientKeyExchange(WOLFSSL* ssl); |
7163 | | WOLFSSL_LOCAL int SendCertificateVerify(WOLFSSL* ssl); |
7164 | | #endif /* NO_WOLFSSL_CLIENT */ |
7165 | | |
7166 | | #ifndef NO_WOLFSSL_SERVER |
7167 | | WOLFSSL_LOCAL int SendServerHello(WOLFSSL* ssl); |
7168 | | WOLFSSL_LOCAL int SendServerHelloDone(WOLFSSL* ssl); |
7169 | | #endif /* NO_WOLFSSL_SERVER */ |
7170 | | |
7171 | | #ifdef WOLFSSL_TLS13 |
7172 | | WOLFSSL_LOCAL int SendTls13KeyUpdate(WOLFSSL* ssl); |
7173 | | #endif |
7174 | | |
7175 | | #ifdef WOLFSSL_DTLS |
7176 | | #ifdef WOLFSSL_API_PREFIX_MAP |
7177 | | #define DtlsMsgListDelete wolfSSL_DtlsMsgListDelete |
7178 | | #define DtlsMsgFind wolfSSL_DtlsMsgFind |
7179 | | #define DtlsMsgStore wolfSSL_DtlsMsgStore |
7180 | | #endif /* WOLFSSL_API_PREFIX_MAP */ |
7181 | | WOLFSSL_LOCAL DtlsMsg* DtlsMsgNew(word32 sz, byte tx, void* heap); |
7182 | | WOLFSSL_LOCAL void DtlsMsgDelete(DtlsMsg* item, void* heap); |
7183 | | WOLFSSL_TEST_VIS void DtlsMsgListDelete(DtlsMsg* head, void* heap); |
7184 | | WOLFSSL_LOCAL void DtlsTxMsgListClean(WOLFSSL* ssl); |
7185 | | WOLFSSL_LOCAL int DtlsMsgSet(DtlsMsg* msg, word32 seq, word16 epoch, |
7186 | | const byte* data, byte type, |
7187 | | word32 fragOffset, word32 fragSz, void* heap, |
7188 | | word32 totalLen, byte encrypted); |
7189 | | WOLFSSL_TEST_VIS DtlsMsg* DtlsMsgFind(DtlsMsg* head, word16 epoch, word32 seq); |
7190 | | |
7191 | | WOLFSSL_TEST_VIS void DtlsMsgStore(WOLFSSL* ssl, word16 epoch, word32 seq, |
7192 | | const byte* data, word32 dataSz, byte type, |
7193 | | word32 fragOffset, word32 fragSz, |
7194 | | void* heap); |
7195 | | WOLFSSL_LOCAL DtlsMsg* DtlsMsgInsert(DtlsMsg* head, DtlsMsg* item); |
7196 | | |
7197 | | WOLFSSL_LOCAL int DtlsMsgPoolSave(WOLFSSL* ssl, const byte* data, |
7198 | | word32 dataSz, enum HandShakeType type); |
7199 | | WOLFSSL_LOCAL int DtlsMsgPoolTimeout(WOLFSSL* ssl); |
7200 | | WOLFSSL_LOCAL int VerifyForDtlsMsgPoolSend(WOLFSSL* ssl, byte type, |
7201 | | word32 fragOffset); |
7202 | | WOLFSSL_LOCAL int VerifyForTxDtlsMsgDelete(WOLFSSL* ssl, DtlsMsg* item); |
7203 | | WOLFSSL_LOCAL void DtlsMsgPoolReset(WOLFSSL* ssl); |
7204 | | WOLFSSL_LOCAL int DtlsMsgPoolSend(WOLFSSL* ssl, int sendOnlyFirstPacket); |
7205 | | WOLFSSL_LOCAL void DtlsMsgDestroyFragBucket(DtlsFragBucket* fragBucket, void* heap); |
7206 | | WOLFSSL_LOCAL int GetDtlsHandShakeHeader(WOLFSSL *ssl, const byte *input, |
7207 | | word32 *inOutIdx, byte *type, word32 *size, word32 *fragOffset, |
7208 | | word32 *fragSz, word32 totalSz); |
7209 | | WOLFSSL_LOCAL int DtlsMsgDrain(WOLFSSL *ssl); |
7210 | | WOLFSSL_LOCAL int SendHelloVerifyRequest(WOLFSSL* ssl, |
7211 | | const byte* cookie, byte cookieSz); |
7212 | | |
7213 | | #if !defined(NO_WOLFSSL_SERVER) |
7214 | | WOLFSSL_LOCAL int DoClientHelloStateless(WOLFSSL* ssl, |
7215 | | const byte* input, word32 helloSz, byte isFirstCHFrag, byte* tls13); |
7216 | | #endif /* !defined(NO_WOLFSSL_SERVER) */ |
7217 | | #if !defined(WOLFCRYPT_ONLY) && !defined(WOLFSSL_NO_SOCK) && \ |
7218 | | (defined(USE_WOLFSSL_IO) || defined(WOLFSSL_USER_IO)) |
7219 | | WOLFSSL_LOCAL int sockAddrEqual(SOCKADDR_S *a, XSOCKLENT aLen, |
7220 | | SOCKADDR_S *b, XSOCKLENT bLen); |
7221 | | #endif |
7222 | | #endif /* WOLFSSL_DTLS */ |
7223 | | |
7224 | | #if defined(HAVE_SECURE_RENEGOTIATION) && defined(WOLFSSL_DTLS) |
7225 | | WOLFSSL_LOCAL int DtlsSCRKeysSet(WOLFSSL* ssl); |
7226 | | WOLFSSL_LOCAL int IsDtlsMsgSCRKeys(WOLFSSL* ssl); |
7227 | | WOLFSSL_LOCAL int DtlsUseSCRKeys(WOLFSSL* ssl); |
7228 | | WOLFSSL_LOCAL int DtlsCheckOrder(WOLFSSL* ssl, int order); |
7229 | | #endif |
7230 | | WOLFSSL_LOCAL int IsSCR(WOLFSSL* ssl); |
7231 | | WOLFSSL_LOCAL int IsDtlsNotSctpMode(WOLFSSL* ssl); |
7232 | | WOLFSSL_LOCAL int IsDtlsNotSrtpMode(WOLFSSL* ssl); |
7233 | | |
7234 | | WOLFSSL_LOCAL void WriteSEQ(WOLFSSL* ssl, int verifyOrder, byte* out); |
7235 | | |
7236 | | #if defined(WOLFSSL_TLS13) && (defined(HAVE_SESSION_TICKET) || \ |
7237 | | !defined(NO_PSK) || defined(WOLFSSL_DTLS13)) |
7238 | | #ifdef WOLFSSL_32BIT_MILLI_TIME |
7239 | | WOLFSSL_LOCAL word32 TimeNowInMilliseconds(void); |
7240 | | #else |
7241 | | WOLFSSL_LOCAL sword64 TimeNowInMilliseconds(void); |
7242 | | #endif |
7243 | | |
7244 | | #endif |
7245 | | WOLFSSL_LOCAL word32 LowResTimer(void); |
7246 | | |
7247 | | WOLFSSL_LOCAL int FindSuiteSSL(const WOLFSSL* ssl, byte* suite); |
7248 | | WOLFSSL_LOCAL int FindSuite(const Suites* suites, byte first, byte second); |
7249 | | |
7250 | | WOLFSSL_LOCAL void DecodeSigAlg(const byte* input, byte* hashAlgo, |
7251 | | byte* hsType); |
7252 | | WOLFSSL_LOCAL enum wc_HashType HashAlgoToType(int hashAlgo); |
7253 | | |
7254 | | #ifndef NO_CERTS |
7255 | | WOLFSSL_LOCAL void InitX509Name(WOLFSSL_X509_NAME* name, int dynamicFlag, |
7256 | | void* heap); |
7257 | | WOLFSSL_LOCAL void FreeX509Name(WOLFSSL_X509_NAME* name); |
7258 | | WOLFSSL_LOCAL void InitX509(WOLFSSL_X509* x509, int dynamicFlag, |
7259 | | void* heap); |
7260 | | WOLFSSL_LOCAL void FreeX509(WOLFSSL_X509* x509); |
7261 | | #ifndef NO_ASN |
7262 | | WOLFSSL_LOCAL int CopyDecodedToX509(WOLFSSL_X509* x509, |
7263 | | DecodedCert* dCert); |
7264 | | #endif |
7265 | | #endif |
7266 | | |
7267 | | #if defined(WOLFSSL_ACERT) |
7268 | | WOLFSSL_LOCAL int CopyDecodedAcertToX509(WOLFSSL_X509_ACERT* x509, |
7269 | | DecodedAcert* dAcert); |
7270 | | #endif /* WOLFSSL_ACERT */ |
7271 | | |
7272 | | |
7273 | | #ifndef MAX_CIPHER_NAME |
7274 | | #define MAX_CIPHER_NAME 50 |
7275 | | #endif |
7276 | | |
7277 | | #ifdef WOLFSSL_NAMES_STATIC |
7278 | | typedef char cipher_name[MAX_CIPHER_NAME]; |
7279 | | #else |
7280 | | typedef const char* cipher_name; |
7281 | | #endif |
7282 | | |
7283 | | typedef struct CipherSuiteInfo { |
7284 | | cipher_name name; |
7285 | | #ifndef NO_ERROR_STRINGS |
7286 | | cipher_name name_iana; |
7287 | | #endif |
7288 | | byte cipherSuite0; |
7289 | | byte cipherSuite; |
7290 | | #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_QT) || \ |
7291 | | defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_NGINX) |
7292 | | byte minor; |
7293 | | byte major; |
7294 | | #endif |
7295 | | byte flags; |
7296 | | } CipherSuiteInfo; |
7297 | | |
7298 | | #ifdef WOLFSSL_API_PREFIX_MAP |
7299 | | #define GetCipherNames wolfSSL_GetCipherNames |
7300 | | #define GetCipherNamesSize wolfSSL_GetCipherNamesSize |
7301 | | #endif |
7302 | | WOLFSSL_TEST_VIS const CipherSuiteInfo* GetCipherNames(void); |
7303 | | WOLFSSL_TEST_VIS int GetCipherNamesSize(void); |
7304 | | WOLFSSL_LOCAL const char* GetCipherNameInternal(const byte cipherSuite0, const byte cipherSuite); |
7305 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) |
7306 | | /* used in wolfSSL_sk_CIPHER_description */ |
7307 | | #define MAX_SEGMENTS 5 |
7308 | | #define MAX_SEGMENT_SZ 20 |
7309 | | WOLFSSL_LOCAL int wolfSSL_sk_CIPHER_description(WOLFSSL_CIPHER* cipher); |
7310 | | WOLFSSL_LOCAL const char* GetCipherSegment(const WOLFSSL_CIPHER* cipher, |
7311 | | char n[][MAX_SEGMENT_SZ]); |
7312 | | WOLFSSL_LOCAL const char* GetCipherProtocol(byte minor); |
7313 | | WOLFSSL_LOCAL const char* GetCipherKeaStr(char n[][MAX_SEGMENT_SZ]); |
7314 | | WOLFSSL_LOCAL const char* GetCipherAuthStr(char n[][MAX_SEGMENT_SZ]); |
7315 | | WOLFSSL_LOCAL const char* GetCipherEncStr(char n[][MAX_SEGMENT_SZ]); |
7316 | | WOLFSSL_LOCAL const char* GetCipherMacStr(char n[][MAX_SEGMENT_SZ]); |
7317 | | WOLFSSL_LOCAL int SetCipherBits(const char* enc); |
7318 | | WOLFSSL_LOCAL int IsCipherAEAD(char n[][MAX_SEGMENT_SZ]); |
7319 | | #endif |
7320 | | WOLFSSL_LOCAL const char* GetCipherNameIana(const byte cipherSuite0, const byte cipherSuite); |
7321 | | WOLFSSL_LOCAL const char* wolfSSL_get_cipher_name_internal(WOLFSSL* ssl); |
7322 | | WOLFSSL_LOCAL const char* wolfSSL_get_cipher_name_iana(WOLFSSL* ssl); |
7323 | | WOLFSSL_LOCAL int GetCipherSuiteFromName(const char* name, byte* cipherSuite0, |
7324 | | byte* cipherSuite, byte* major, byte* minor, int* flags); |
7325 | | |
7326 | | |
7327 | | enum encrypt_side { |
7328 | | ENCRYPT_SIDE_ONLY = 1, |
7329 | | DECRYPT_SIDE_ONLY, |
7330 | | ENCRYPT_AND_DECRYPT_SIDE |
7331 | | }; |
7332 | | |
7333 | | WOLFSSL_LOCAL int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, |
7334 | | CipherSpecs* specs, int side, void* heap, int devId, WC_RNG* rng, |
7335 | | int tls13); |
7336 | | WOLFSSL_LOCAL int SetKeysSide(WOLFSSL* ssl, enum encrypt_side side); |
7337 | | |
7338 | | /* Set*Internal and Set*External functions */ |
7339 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
7340 | | WOLFSSL_LOCAL int SetDsaInternal(WOLFSSL_DSA* dsa); |
7341 | | WOLFSSL_LOCAL int SetDsaExternal(WOLFSSL_DSA* dsa); |
7342 | | WOLFSSL_LOCAL int SetRsaExternal(WOLFSSL_RSA* rsa); |
7343 | | WOLFSSL_LOCAL int SetRsaInternal(WOLFSSL_RSA* rsa); |
7344 | | |
7345 | | typedef enum elem_set { |
7346 | | ELEMENT_P = 0x01, |
7347 | | ELEMENT_Q = 0x02, |
7348 | | ELEMENT_G = 0x04, |
7349 | | ELEMENT_PUB = 0x08, |
7350 | | ELEMENT_PRV = 0x10, |
7351 | | } Element_Set; |
7352 | | WOLFSSL_LOCAL int SetDhExternal_ex(WOLFSSL_DH *dh, int elm ); |
7353 | | WOLFSSL_LOCAL int SetDhInternal(WOLFSSL_DH* dh); |
7354 | | WOLFSSL_LOCAL int SetDhExternal(WOLFSSL_DH *dh); |
7355 | | #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */ |
7356 | | |
7357 | | #if !defined(NO_DH) && (!defined(NO_CERTS) || !defined(NO_PSK)) |
7358 | | WOLFSSL_LOCAL int DhGenKeyPair(WOLFSSL* ssl, DhKey* dhKey, |
7359 | | byte* priv, word32* privSz, |
7360 | | byte* pub, word32* pubSz); |
7361 | | WOLFSSL_LOCAL int DhAgree(WOLFSSL* ssl, DhKey* dhKey, |
7362 | | const byte* priv, word32 privSz, |
7363 | | const byte* otherPub, word32 otherPubSz, |
7364 | | byte* agree, word32* agreeSz, |
7365 | | const byte* prime, word32 primeSz); |
7366 | | #endif /* !NO_DH */ |
7367 | | |
7368 | | #ifdef HAVE_ECC |
7369 | | WOLFSSL_LOCAL int EccMakeKey(WOLFSSL* ssl, ecc_key* key, ecc_key* peer); |
7370 | | WOLFSSL_LOCAL word16 GetCurveByOID(int oidSum); |
7371 | | #endif |
7372 | | |
7373 | | WOLFSSL_LOCAL int InitHandshakeHashes(WOLFSSL* ssl); |
7374 | | WOLFSSL_LOCAL void Free_HS_Hashes(HS_Hashes* hsHashes, void* heap); |
7375 | | WOLFSSL_LOCAL void FreeHandshakeHashes(WOLFSSL* ssl); |
7376 | | WOLFSSL_LOCAL int InitHandshakeHashesAndCopy(WOLFSSL* ssl, HS_Hashes* source, |
7377 | | HS_Hashes** destination); |
7378 | | |
7379 | | |
7380 | | #ifndef WOLFSSL_NO_TLS12 |
7381 | | WOLFSSL_LOCAL void FreeBuildMsgArgs(WOLFSSL* ssl, BuildMsgArgs* args); |
7382 | | #endif |
7383 | | #ifdef WOLFSSL_API_PREFIX_MAP |
7384 | | #define BuildMessage wolfSSL_BuildMessage |
7385 | | #endif |
7386 | | WOLFSSL_TEST_VIS int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, |
7387 | | const byte* input, int inSz, int type, int hashOutput, |
7388 | | int sizeOnly, int asyncOkay, int epochOrder); |
7389 | | |
7390 | | #ifdef WOLFSSL_TLS13 |
7391 | | #ifdef WOLFSSL_API_PREFIX_MAP |
7392 | | #define BuildTls13Message wolfSSL_BuildTls13Message |
7393 | | #endif |
7394 | | WOLFSSL_TEST_VIS int BuildTls13Message(WOLFSSL* ssl, byte* output, int outSz, const byte* input, |
7395 | | int inSz, int type, int hashOutput, int sizeOnly, int asyncOkay); |
7396 | | WOLFSSL_LOCAL int Tls13UpdateKeys(WOLFSSL* ssl); |
7397 | | #endif |
7398 | | |
7399 | | WOLFSSL_LOCAL int AllocKey(WOLFSSL* ssl, int type, void** pKey); |
7400 | | WOLFSSL_LOCAL void FreeKey(WOLFSSL* ssl, int type, void** pKey); |
7401 | | |
7402 | | #ifdef WOLFSSL_ASYNC_CRYPT |
7403 | | WOLFSSL_LOCAL int wolfSSL_AsyncInit(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev, word32 flags); |
7404 | | WOLFSSL_LOCAL int wolfSSL_AsyncPop(WOLFSSL* ssl, byte* state); |
7405 | | WOLFSSL_LOCAL int wolfSSL_AsyncPush(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev); |
7406 | | #endif |
7407 | | |
7408 | | #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \ |
7409 | | (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \ |
7410 | | !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) |
7411 | | WOLFSSL_LOCAL int LoadCertByIssuer(WOLFSSL_X509_STORE* store, |
7412 | | X509_NAME* issuer, int Type); |
7413 | | #endif |
7414 | | #if defined(OPENSSL_ALL) && !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) |
7415 | | WOLFSSL_LOCAL WOLFSSL_BY_DIR_HASH* wolfSSL_BY_DIR_HASH_new(void); |
7416 | | WOLFSSL_LOCAL void wolfSSL_BY_DIR_HASH_free(WOLFSSL_BY_DIR_HASH* dir_hash); |
7417 | | WOLFSSL_LOCAL WOLFSSL_STACK* wolfSSL_sk_BY_DIR_HASH_new_null(void); |
7418 | | WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_HASH_find( |
7419 | | WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk, const WOLFSSL_BY_DIR_HASH* toFind); |
7420 | | WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_HASH_num(const WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk); |
7421 | | WOLFSSL_LOCAL WOLFSSL_BY_DIR_HASH* wolfSSL_sk_BY_DIR_HASH_value( |
7422 | | const WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk, int i); |
7423 | | WOLFSSL_LOCAL WOLFSSL_BY_DIR_HASH* wolfSSL_sk_BY_DIR_HASH_pop( |
7424 | | WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk); |
7425 | | WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_HASH_pop_free(WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk, |
7426 | | void (*f) (WOLFSSL_BY_DIR_HASH*)); |
7427 | | WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_HASH_free(WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk); |
7428 | | WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_HASH_push(WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk, |
7429 | | WOLFSSL_BY_DIR_HASH* in); |
7430 | | /* WOLFSSL_BY_DIR_entry stuff */ |
7431 | | WOLFSSL_LOCAL WOLFSSL_BY_DIR_entry* wolfSSL_BY_DIR_entry_new(void); |
7432 | | WOLFSSL_LOCAL void wolfSSL_BY_DIR_entry_free(WOLFSSL_BY_DIR_entry* entry); |
7433 | | WOLFSSL_LOCAL WOLFSSL_STACK* wolfSSL_sk_BY_DIR_entry_new_null(void); |
7434 | | WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_entry_num(const WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *sk); |
7435 | | WOLFSSL_LOCAL WOLFSSL_BY_DIR_entry* wolfSSL_sk_BY_DIR_entry_value( |
7436 | | const WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *sk, int i); |
7437 | | WOLFSSL_LOCAL WOLFSSL_BY_DIR_entry* wolfSSL_sk_BY_DIR_entry_pop( |
7438 | | WOLF_STACK_OF(WOLFSSL_BY_DIR_entry)* sk); |
7439 | | WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_entry_pop_free(WOLF_STACK_OF(wolfSSL_BY_DIR_entry)* sk, |
7440 | | void (*f) (WOLFSSL_BY_DIR_entry*)); |
7441 | | WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_entry_free(WOLF_STACK_OF(wolfSSL_BY_DIR_entry) *sk); |
7442 | | WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_entry_push(WOLF_STACK_OF(wolfSSL_BY_DIR_entry)* sk, |
7443 | | WOLFSSL_BY_DIR_entry* in); |
7444 | | #endif /* OPENSSL_ALL && !NO_FILESYSTEM && !NO_WOLFSSL_DIR */ |
7445 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
7446 | | WOLFSSL_LOCAL int oid2nid(word32 oid, int grp); |
7447 | | WOLFSSL_LOCAL word32 nid2oid(int nid, int grp); |
7448 | | #endif |
7449 | | |
7450 | | #ifdef WOLFSSL_DTLS |
7451 | | WOLFSSL_TEST_VIS int wolfSSL_DtlsUpdateWindow(word16 cur_hi, word32 cur_lo, |
7452 | | word16* next_hi, word32* next_lo, word32 *window); |
7453 | | WOLFSSL_LOCAL int DtlsUpdateWindow(WOLFSSL* ssl); |
7454 | | WOLFSSL_LOCAL void DtlsResetState(WOLFSSL *ssl); |
7455 | | WOLFSSL_LOCAL int DtlsIgnoreError(int err); |
7456 | | WOLFSSL_LOCAL void DtlsSetSeqNumForReply(WOLFSSL* ssl); |
7457 | | #endif |
7458 | | |
7459 | | #ifdef WOLFSSL_DTLS13 |
7460 | | #ifdef WOLFSSL_API_PREFIX_MAP |
7461 | | #define Dtls13GetEpoch wolfSSL_Dtls13GetEpoch |
7462 | | #define Dtls13CheckEpoch wolfSSL_Dtls13CheckEpoch |
7463 | | #define Dtls13WriteAckMessage wolfSSL_Dtls13WriteAckMessage |
7464 | | #define Dtls13RtxAddAck wolfSSL_Dtls13RtxAddAck |
7465 | | #define Dtls13DoScheduledWork wolfSSL_Dtls13DoScheduledWork |
7466 | | #endif |
7467 | | |
7468 | | WOLFSSL_TEST_VIS struct Dtls13Epoch* Dtls13GetEpoch(WOLFSSL* ssl, |
7469 | | w64wrapper epochNumber); |
7470 | | WOLFSSL_LOCAL void Dtls13SetOlderEpochSide(WOLFSSL* ssl, w64wrapper epochNumber, |
7471 | | int side); |
7472 | | WOLFSSL_LOCAL int Dtls13NewEpoch(WOLFSSL* ssl, w64wrapper epochNumber, |
7473 | | int side); |
7474 | | WOLFSSL_LOCAL int Dtls13SetEpochKeys(WOLFSSL* ssl, w64wrapper epochNumber, |
7475 | | enum encrypt_side side); |
7476 | | WOLFSSL_LOCAL int Dtls13GetSeq(WOLFSSL* ssl, int order, word32* seq, |
7477 | | byte increment); |
7478 | | WOLFSSL_LOCAL void Dtls13RtxRemoveRecord(WOLFSSL* ssl, w64wrapper epoch, |
7479 | | w64wrapper seq); |
7480 | | WOLFSSL_TEST_VIS int Dtls13DoScheduledWork(WOLFSSL* ssl); |
7481 | | WOLFSSL_LOCAL int Dtls13DeriveSnKeys(WOLFSSL* ssl, int provision); |
7482 | | WOLFSSL_LOCAL int Dtls13SetRecordNumberKeys(WOLFSSL* ssl, |
7483 | | enum encrypt_side side); |
7484 | | |
7485 | | WOLFSSL_LOCAL int Dtls13AddHeaders(byte* output, word32 length, |
7486 | | enum HandShakeType hs_type, WOLFSSL* ssl); |
7487 | | WOLFSSL_LOCAL word16 Dtls13GetHeadersLength(WOLFSSL *ssl, |
7488 | | enum HandShakeType type); |
7489 | | WOLFSSL_LOCAL word16 Dtls13GetRlHeaderLength(WOLFSSL *ssl, byte is_encrypted); |
7490 | | WOLFSSL_LOCAL int Dtls13RlAddCiphertextHeader(WOLFSSL* ssl, byte* out, |
7491 | | word16 length); |
7492 | | WOLFSSL_LOCAL int Dtls13RlAddPlaintextHeader(WOLFSSL* ssl, byte* out, |
7493 | | enum ContentType content_type, word16 length); |
7494 | | WOLFSSL_LOCAL int Dtls13MinimumRecordLength(WOLFSSL* ssl); |
7495 | | WOLFSSL_LOCAL int Dtls13EncryptRecordNumber(WOLFSSL* ssl, byte* hdr, |
7496 | | word16 recordLength); |
7497 | | WOLFSSL_LOCAL int Dtls13IsUnifiedHeader(byte header_flags); |
7498 | | WOLFSSL_LOCAL int Dtls13GetUnifiedHeaderSize(WOLFSSL* ssl, const byte input, |
7499 | | word16* size); |
7500 | | WOLFSSL_LOCAL int Dtls13ParseUnifiedRecordLayer(WOLFSSL* ssl, const byte* input, |
7501 | | word16 input_size, Dtls13UnifiedHdrInfo* hdrInfo); |
7502 | | WOLFSSL_LOCAL int Dtls13HandshakeSend(WOLFSSL* ssl, byte* output, |
7503 | | word16 output_size, word16 length, enum HandShakeType handshake_type, |
7504 | | int hash_output); |
7505 | | WOLFSSL_LOCAL int Dtls13RecordRecvd(WOLFSSL* ssl); |
7506 | | WOLFSSL_TEST_VIS int Dtls13CheckEpoch(WOLFSSL* ssl, enum HandShakeType type); |
7507 | | WOLFSSL_LOCAL int Dtls13HandshakeRecv(WOLFSSL* ssl, byte* input, |
7508 | | word32* inOutIdx, word32 totalSz); |
7509 | | WOLFSSL_LOCAL int Dtls13HandshakeAddHeader(WOLFSSL* ssl, byte* output, |
7510 | | enum HandShakeType msg_type, word32 length); |
7511 | | #define EE_MASK (0x3) |
7512 | | WOLFSSL_LOCAL int Dtls13FragmentsContinue(WOLFSSL* ssl); |
7513 | | WOLFSSL_LOCAL int DoDtls13KeyUpdateAck(WOLFSSL* ssl); |
7514 | | #ifdef WOLFSSL_DTLS_CID |
7515 | | WOLFSSL_LOCAL int DoDtls13RequestConnectionId(WOLFSSL* ssl, const byte* input, |
7516 | | word32* inOutIdx, word32 size); |
7517 | | WOLFSSL_LOCAL int DoDtls13NewConnectionId(WOLFSSL* ssl, const byte* input, |
7518 | | word32* inOutIdx, word32 size); |
7519 | | #endif /* WOLFSSL_DTLS_CID */ |
7520 | | WOLFSSL_LOCAL int DoDtls13Ack(WOLFSSL* ssl, const byte* input, word32 inputSize, |
7521 | | word32* processedSize); |
7522 | | WOLFSSL_LOCAL int Dtls13ReconstructEpochNumber(WOLFSSL* ssl, byte epochBits, |
7523 | | w64wrapper* epoch); |
7524 | | WOLFSSL_LOCAL int Dtls13ReconstructSeqNumber(WOLFSSL* ssl, |
7525 | | Dtls13UnifiedHdrInfo* hdrInfo, w64wrapper* out); |
7526 | | WOLFSSL_TEST_VIS int Dtls13WriteAckMessage(WOLFSSL* ssl, |
7527 | | Dtls13RecordNumber* recordNumberList, word16 recordsCount, word32* length); |
7528 | | WOLFSSL_LOCAL int SendDtls13Ack(WOLFSSL* ssl); |
7529 | | WOLFSSL_TEST_VIS int Dtls13RtxAddAck(WOLFSSL* ssl, w64wrapper epoch, w64wrapper seq); |
7530 | | WOLFSSL_LOCAL int Dtls13RtxProcessingCertificate(WOLFSSL* ssl, byte* input, |
7531 | | word32 inputSize); |
7532 | | WOLFSSL_LOCAL int Dtls13HashHandshake(WOLFSSL* ssl, const byte* input, |
7533 | | word16 length); |
7534 | | WOLFSSL_LOCAL int Dtls13HashClientHello(const WOLFSSL* ssl, byte* hash, |
7535 | | int* hashSz, const byte* body, word32 length, CipherSpecs* specs); |
7536 | | WOLFSSL_LOCAL void Dtls13FreeFsmResources(WOLFSSL* ssl); |
7537 | | WOLFSSL_LOCAL void Dtls13RtxFlushBuffered(WOLFSSL* ssl, |
7538 | | byte keepNewSessionTicket); |
7539 | | WOLFSSL_LOCAL int Dtls13RtxTimeout(WOLFSSL* ssl); |
7540 | | WOLFSSL_LOCAL int Dtls13ProcessBufferedMessages(WOLFSSL* ssl); |
7541 | | WOLFSSL_LOCAL int Dtls13CheckAEADFailLimit(WOLFSSL* ssl); |
7542 | | WOLFSSL_LOCAL int Dtls13UpdateWindowRecordRecvd(WOLFSSL* ssl); |
7543 | | #endif /* WOLFSSL_DTLS13 */ |
7544 | | |
7545 | | #ifdef WOLFSSL_STATIC_EPHEMERAL |
7546 | | WOLFSSL_LOCAL int wolfSSL_StaticEphemeralKeyLoad(WOLFSSL* ssl, int keyAlgo, void* keyPtr); |
7547 | | #endif |
7548 | | |
7549 | | #ifndef NO_CERTS |
7550 | | #if defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA) || \ |
7551 | | defined(OPENSSL_EXTRA_X509_SMALL) |
7552 | | WOLFSSL_LOCAL int wolfSSL_ASN1_STRING_canon(WOLFSSL_ASN1_STRING* asn_out, |
7553 | | const WOLFSSL_ASN1_STRING* asn_in); |
7554 | | #endif |
7555 | | #ifdef OPENSSL_EXTRA |
7556 | | WOLFSSL_LOCAL int GetX509Error(int e); |
7557 | | #endif |
7558 | | #endif |
7559 | | |
7560 | | #ifdef HAVE_EX_DATA_CRYPTO |
7561 | | typedef struct CRYPTO_EX_cb_ctx { |
7562 | | long ctx_l; |
7563 | | void *ctx_ptr; |
7564 | | WOLFSSL_CRYPTO_EX_new* new_func; |
7565 | | WOLFSSL_CRYPTO_EX_free* free_func; |
7566 | | WOLFSSL_CRYPTO_EX_dup* dup_func; |
7567 | | struct CRYPTO_EX_cb_ctx* next; |
7568 | | } CRYPTO_EX_cb_ctx; |
7569 | | |
7570 | | WOLFSSL_TEST_VIS extern CRYPTO_EX_cb_ctx* crypto_ex_cb_ctx_session; |
7571 | | #ifdef WOLFSSL_API_PREFIX_MAP |
7572 | | #define crypto_ex_cb_free wolfSSL_crypto_ex_cb_free |
7573 | | #endif |
7574 | | WOLFSSL_TEST_VIS void crypto_ex_cb_free(CRYPTO_EX_cb_ctx* cb_ctx); |
7575 | | WOLFSSL_LOCAL void crypto_ex_cb_setup_new_data(void *new_obj, |
7576 | | CRYPTO_EX_cb_ctx* cb_ctx, WOLFSSL_CRYPTO_EX_DATA* ex_data); |
7577 | | WOLFSSL_LOCAL void crypto_ex_cb_free_data(void *obj, CRYPTO_EX_cb_ctx* cb_ctx, |
7578 | | WOLFSSL_CRYPTO_EX_DATA* ex_data); |
7579 | | WOLFSSL_LOCAL int crypto_ex_cb_dup_data(const WOLFSSL_CRYPTO_EX_DATA *in, |
7580 | | WOLFSSL_CRYPTO_EX_DATA *out, CRYPTO_EX_cb_ctx* cb_ctx); |
7581 | | WOLFSSL_LOCAL int wolfssl_local_get_ex_new_index(int class_index, long ctx_l, |
7582 | | void* ctx_ptr, WOLFSSL_CRYPTO_EX_new* new_func, |
7583 | | WOLFSSL_CRYPTO_EX_dup* dup_func, WOLFSSL_CRYPTO_EX_free* free_func); |
7584 | | #endif /* HAVE_EX_DATA_CRYPTO */ |
7585 | | |
7586 | | WOLFSSL_LOCAL WC_RNG* wolfssl_get_global_rng(void); |
7587 | | WOLFSSL_LOCAL WC_RNG* wolfssl_make_global_rng(void); |
7588 | | |
7589 | | #if !defined(WOLFCRYPT_ONLY) && defined(OPENSSL_EXTRA) |
7590 | | #if defined(WOLFSSL_KEY_GEN) && defined(WOLFSSL_PEM_TO_DER) |
7591 | | WOLFSSL_LOCAL int EncryptDerKey(byte *der, int *derSz, |
7592 | | const WOLFSSL_EVP_CIPHER* cipher, unsigned char* passwd, int passwdSz, |
7593 | | byte **cipherInfo, int maxDerSz, int hashType); |
7594 | | #endif |
7595 | | #endif |
7596 | | |
7597 | | #if !defined(NO_RSA) && defined(OPENSSL_EXTRA) |
7598 | | WOLFSSL_LOCAL int wolfSSL_RSA_To_Der(WOLFSSL_RSA* rsa, byte** outBuf, |
7599 | | int publicKey, void* heap); |
7600 | | #endif |
7601 | | |
7602 | | #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) \ |
7603 | | || defined(OPENSSL_EXTRA) || defined(HAVE_LIGHTY) || defined(HAVE_SECRET_CALLBACK) |
7604 | | WOLFSSL_LOCAL int wolfSSL_SSL_do_handshake_internal(WOLFSSL *s); |
7605 | | #endif |
7606 | | |
7607 | | #ifdef WOLFSSL_QUIC |
7608 | | #define WOLFSSL_IS_QUIC(s) (((s) != NULL) && ((s)->quic.method != NULL)) |
7609 | | WOLFSSL_LOCAL int wolfSSL_quic_receive(WOLFSSL* ssl, byte* buf, word32 sz); |
7610 | | WOLFSSL_LOCAL int wolfSSL_quic_send(WOLFSSL* ssl); |
7611 | | WOLFSSL_LOCAL void wolfSSL_quic_clear(WOLFSSL* ssl); |
7612 | | WOLFSSL_LOCAL void wolfSSL_quic_free(WOLFSSL* ssl); |
7613 | | WOLFSSL_LOCAL int wolfSSL_quic_forward_secrets(WOLFSSL *ssl, |
7614 | | int ktype, int side); |
7615 | | WOLFSSL_LOCAL int wolfSSL_quic_keys_active(WOLFSSL* ssl, enum encrypt_side side); |
7616 | | |
7617 | | #else |
7618 | 0 | #define WOLFSSL_IS_QUIC(s) 0 |
7619 | | #endif /* WOLFSSL_QUIC (else) */ |
7620 | | |
7621 | | #if defined(SHOW_SECRETS) && defined(WOLFSSL_SSLKEYLOGFILE) |
7622 | | WOLFSSL_LOCAL int tls13ShowSecrets(WOLFSSL* ssl, int id, const unsigned char* secret, |
7623 | | int secretSz, void* ctx); |
7624 | | #endif |
7625 | | |
7626 | | #if defined(SHOW_SECRETS) |
7627 | | WOLFSSL_LOCAL int tlsShowSecrets(WOLFSSL* ssl, void* secret, |
7628 | | int secretSz, void* ctx); |
7629 | | #endif |
7630 | | |
7631 | | /* Optional Pre-Master-Secret logging for Wireshark */ |
7632 | | #if !defined(NO_FILESYSTEM) && defined(WOLFSSL_SSLKEYLOGFILE) |
7633 | | #ifndef WOLFSSL_SSLKEYLOGFILE_OUTPUT |
7634 | | #define WOLFSSL_SSLKEYLOGFILE_OUTPUT "sslkeylog.log" |
7635 | | #endif |
7636 | | #endif |
7637 | | |
7638 | | #if defined(WOLFSSL_TLS13) && !defined(NO_PSK) |
7639 | | WOLFSSL_LOCAL int FindPskSuite(const WOLFSSL* ssl, PreSharedKey* psk, |
7640 | | byte* psk_key, word32* psk_keySz, const byte* suite, int* found, |
7641 | | byte* foundSuite); |
7642 | | #endif |
7643 | | |
7644 | | WOLFSSL_LOCAL int wolfSSL_GetHmacType_ex(CipherSpecs* specs); |
7645 | | |
7646 | | #if defined(WOLFSSL_SEND_HRR_COOKIE) && !defined(NO_WOLFSSL_SERVER) |
7647 | | WOLFSSL_LOCAL int CreateCookieExt(const WOLFSSL* ssl, byte* hash, |
7648 | | word16 hashSz, TLSX** exts, |
7649 | | byte cipherSuite0, byte cipherSuite); |
7650 | | #endif |
7651 | | |
7652 | | WOLFSSL_LOCAL int TranslateErrorToAlert(int err); |
7653 | | |
7654 | | #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL) |
7655 | | WOLFSSL_LOCAL void* wolfssl_sk_pop_type(WOLFSSL_STACK* sk, |
7656 | | WOLF_STACK_TYPE type); |
7657 | | WOLFSSL_LOCAL void* wolfSSL_sk_pop_node(WOLFSSL_STACK* sk, int idx); |
7658 | | WOLFSSL_LOCAL WOLFSSL_STACK* wolfssl_sk_new_type(WOLF_STACK_TYPE type); |
7659 | | WOLFSSL_LOCAL WOLFSSL_STACK* wolfssl_sk_new_type_ex(WOLF_STACK_TYPE type, |
7660 | | void* heap); |
7661 | | |
7662 | | WOLFSSL_LOCAL int wolfssl_asn1_obj_set(WOLFSSL_ASN1_OBJECT* obj, |
7663 | | const byte* der, word32 len, int addHdr); |
7664 | | #endif |
7665 | | |
7666 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) |
7667 | | WOLFSSL_LOCAL int pkcs8_encode(WOLFSSL_EVP_PKEY* pkey, byte* key, |
7668 | | word32* keySz); |
7669 | | WOLFSSL_LOCAL int pkcs8_encrypt(WOLFSSL_EVP_PKEY* pkey, |
7670 | | const WOLFSSL_EVP_CIPHER* enc, char* passwd, int passwdSz, byte* key, |
7671 | | word32* keySz); |
7672 | | #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */ |
7673 | | |
7674 | | #if (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && !defined(NO_BIO) |
7675 | | WOLFSSL_LOCAL int wolfSSL_PEM_X509_X509_CRL_X509_PKEY_read_bio( |
7676 | | WOLFSSL_BIO* bio, wc_pem_password_cb* cb, WOLFSSL_X509** x509, |
7677 | | WOLFSSL_X509_CRL** crl, WOLFSSL_X509_PKEY** x_pkey); |
7678 | | #endif |
7679 | | #if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL) |
7680 | | WOLFSSL_LOCAL void wolfSSL_X509_PKEY_free(WOLFSSL_X509_PKEY* xPkey); |
7681 | | #endif |
7682 | | |
7683 | | WOLFSSL_LOCAL void wolfssl_local_MaybeCheckAlertOnErr(WOLFSSL* ssl, int err); |
7684 | | |
7685 | | #ifdef __cplusplus |
7686 | | } /* extern "C" */ |
7687 | | #endif |
7688 | | |
7689 | | #endif /* wolfSSL_INT_H */ |