gitweb.dragonflybsd.org Git - dragonfly.git/blob - crypto/libressl/tls/tls

1 /* $OpenBSD: tls_internal.h,v 1.80 2022/03/24 15:56:34 tb Exp $ */

2 /*

5 *

6 * Permission to use, copy, modify, and distribute this software for any

7 * purpose with or without fee is hereby granted, provided that the above

8 * copyright notice and this permission notice appear in all copies.

9 *

10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

17 */

19 #ifndef HEADER_TLS_INTERNAL_H

20 #define HEADER_TLS_INTERNAL_H

22 #include <pthread.h>

24 #include <arpa/inet.h>

25 #include <netinet/in.h>

27 #include <openssl/ssl.h>

29 __BEGIN_HIDDEN_DECLS

31 #ifndef TLS_DEFAULT_CA_FILE

32 #define TLS_DEFAULT_CA_FILE "/etc/ssl/cert.pem"

33 #endif

35 #define TLS_CIPHERS_DEFAULT "TLSv1.3:TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE"

36 #define TLS_CIPHERS_COMPAT "HIGH:!aNULL"

37 #define TLS_CIPHERS_LEGACY "HIGH:MEDIUM:!aNULL"

38 #define TLS_CIPHERS_ALL "ALL:!aNULL:!eNULL"

40 #define TLS_ECDHE_CURVES "X25519,P-256,P-384"

42 union tls_addr {

43 struct in_addr ip4;

44 struct in6_addr ip6;

45 };

47 struct tls_error {

48 char *msg;

49 int num;

50 int tls;

51 };

53 struct tls_keypair {

54 struct tls_keypair *next;

56 char *cert_mem;

57 size_t cert_len;

58 char *key_mem;

59 size_t key_len;

60 char *ocsp_staple;

61 size_t ocsp_staple_len;

62 char *pubkey_hash;

63 };

65 #define TLS_MIN_SESSION_TIMEOUT (4)

66 #define TLS_MAX_SESSION_TIMEOUT (24 * 60 * 60)

68 #define TLS_NUM_TICKETS 4

69 #define TLS_TICKET_NAME_SIZE 16

70 #define TLS_TICKET_AES_SIZE 32

71 #define TLS_TICKET_HMAC_SIZE 16

73 struct tls_ticket_key {

74 /* The key_name must be 16 bytes according to -lssl */

75 unsigned char key_name[TLS_TICKET_NAME_SIZE];

76 unsigned char aes_key[TLS_TICKET_AES_SIZE];

77 unsigned char hmac_key[TLS_TICKET_HMAC_SIZE];

78 time_t time;

79 };

81 typedef int (*tls_sign_cb)(void *_cb_arg, const char *_pubkey_hash,

82 const uint8_t *_input, size_t _input_len, int _padding_type,

83 uint8_t **_out_signature, size_t *_out_signature_len);

85 struct tls_config {

86 struct tls_error error;

88 pthread_mutex_t mutex;

89 int refcount;

91 char *alpn;

92 size_t alpn_len;

93 const char *ca_path;

94 char *ca_mem;

95 size_t ca_len;

96 const char *ciphers;

97 int ciphers_server;

98 char *crl_mem;

99 size_t crl_len;

100 int dheparams;

101 int *ecdhecurves;

102 size_t ecdhecurves_len;

103 struct tls_keypair *keypair;

104 int ocsp_require_stapling;

105 uint32_t protocols;

106 unsigned char session_id[TLS_MAX_SESSION_ID_LENGTH];

107 int session_fd;

108 int session_lifetime;

109 struct tls_ticket_key ticket_keys[TLS_NUM_TICKETS];

110 uint32_t ticket_keyrev;

111 int ticket_autorekey;

112 int verify_cert;

113 int verify_client;

114 int verify_depth;

115 int verify_name;

116 int verify_time;

117 int skip_private_key_check;

118 int use_fake_private_key;

119 tls_sign_cb sign_cb;

120 void *sign_cb_arg;

121 };

122

123 struct tls_conninfo {

124 char *alpn;

125 char *cipher;

126 int cipher_strength;

127 char *servername;

128 int session_resumed;

129 char *version;

130

131 char *hash;

132 char *issuer;

133 char *subject;

134

135 uint8_t *peer_cert;

136 size_t peer_cert_len;

137

138 time_t notbefore;

139 time_t notafter;

140 };

141

142 #define TLS_CLIENT (1 << 0)

143 #define TLS_SERVER (1 << 1)

144 #define TLS_SERVER_CONN (1 << 2)

145

146 #define TLS_EOF_NO_CLOSE_NOTIFY (1 << 0)

147 #define TLS_CONNECTED (1 << 1)

148 #define TLS_HANDSHAKE_COMPLETE (1 << 2)

149 #define TLS_SSL_NEEDS_SHUTDOWN (1 << 3)

150

151 struct tls_ocsp_result {

152 const char *result_msg;

153 int response_status;

154 int cert_status;

155 int crl_reason;

156 time_t this_update;

157 time_t next_update;

158 time_t revocation_time;

159 };

160

161 struct tls_ocsp {

162 /* responder location */

163 char *ocsp_url;

164

165 /* cert data, this struct does not own these */

166 X509 *main_cert;

167 STACK_OF(X509) *extra_certs;

168

169 struct tls_ocsp_result *ocsp_result;

170 };

171

172 struct tls_sni_ctx {

173 struct tls_sni_ctx *next;

174

175 struct tls_keypair *keypair;

176

177 SSL_CTX *ssl_ctx;

178 X509 *ssl_cert;

179 };

180

181 struct tls {

182 struct tls_config *config;

183 struct tls_keypair *keypair;

184

185 struct tls_error error;

186

187 uint32_t flags;

188 uint32_t state;

189

190 char *servername;

191 int socket;

192

193 SSL *ssl_conn;

194 SSL_CTX *ssl_ctx;

195

196 struct tls_sni_ctx *sni_ctx;

197

198 X509 *ssl_peer_cert;

199 STACK_OF(X509) *ssl_peer_chain;

200

201 struct tls_conninfo *conninfo;

202

203 struct tls_ocsp *ocsp;

204

205 tls_read_cb read_cb;

206 tls_write_cb write_cb;

207 void *cb_arg;

208 };

209

210 int tls_set_mem(char **_dest, size_t *_destlen, const void *_src,

211 size_t _srclen);

212 int tls_set_string(const char **_dest, const char *_src);

213

214 struct tls_keypair *tls_keypair_new(void);

215 void tls_keypair_clear_key(struct tls_keypair *_keypair);

216 void tls_keypair_free(struct tls_keypair *_keypair);

217 int tls_keypair_set_cert_file(struct tls_keypair *_keypair,

218 struct tls_error *_error, const char *_cert_file);

219 int tls_keypair_set_cert_mem(struct tls_keypair *_keypair,

220 struct tls_error *_error, const uint8_t *_cert, size_t _len);

221 int tls_keypair_set_key_file(struct tls_keypair *_keypair,

222 struct tls_error *_error, const char *_key_file);

223 int tls_keypair_set_key_mem(struct tls_keypair *_keypair,

224 struct tls_error *_error, const uint8_t *_key, size_t _len);

225 int tls_keypair_set_ocsp_staple_file(struct tls_keypair *_keypair,

226 struct tls_error *_error, const char *_ocsp_file);

227 int tls_keypair_set_ocsp_staple_mem(struct tls_keypair *_keypair,

228 struct tls_error *_error, const uint8_t *_staple, size_t _len);

229 int tls_keypair_load_cert(struct tls_keypair *_keypair,

230 struct tls_error *_error, X509 **_cert);

231

232 struct tls_sni_ctx *tls_sni_ctx_new(void);

233 void tls_sni_ctx_free(struct tls_sni_ctx *sni_ctx);

234

235 struct tls_config *tls_config_new_internal(void);

236

237 struct tls *tls_new(void);

238 struct tls *tls_server_conn(struct tls *ctx);

239

240 int tls_check_name(struct tls *ctx, X509 *cert, const char *servername,

241 int *match);

242 int tls_configure_server(struct tls *ctx);

243

244 int tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx);

245 int tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,

246 struct tls_keypair *keypair, int required);

247 int tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify);

248

249 int tls_handshake_client(struct tls *ctx);

250 int tls_handshake_server(struct tls *ctx);

251

252 int tls_config_load_file(struct tls_error *error, const char *filetype,

253 const char *filename, char **buf, size_t *len);

254 int tls_config_ticket_autorekey(struct tls_config *config);

255 int tls_host_port(const char *hostport, char **host, char **port);

256

257 int tls_set_cbs(struct tls *ctx,

258 tls_read_cb read_cb, tls_write_cb write_cb, void *cb_arg);

259

260 void tls_error_clear(struct tls_error *error);

261 int tls_error_set(struct tls_error *error, const char *fmt, ...)

262 __attribute__((__format__ (printf, 2, 3)))

263 __attribute__((__nonnull__ (2)));

264 int tls_error_setx(struct tls_error *error, const char *fmt, ...)

265 __attribute__((__format__ (printf, 2, 3)))

266 __attribute__((__nonnull__ (2)));

267 int tls_config_set_error(struct tls_config *cfg, const char *fmt, ...)

268 __attribute__((__format__ (printf, 2, 3)))

269 __attribute__((__nonnull__ (2)));

270 int tls_config_set_errorx(struct tls_config *cfg, const char *fmt, ...)

271 __attribute__((__format__ (printf, 2, 3)))

272 __attribute__((__nonnull__ (2)));

273 int tls_set_error(struct tls *ctx, const char *fmt, ...)

274 __attribute__((__format__ (printf, 2, 3)))

275 __attribute__((__nonnull__ (2)));

276 int tls_set_errorx(struct tls *ctx, const char *fmt, ...)

277 __attribute__((__format__ (printf, 2, 3)))

278 __attribute__((__nonnull__ (2)));

279 int tls_set_ssl_errorx(struct tls *ctx, const char *fmt, ...)

280 __attribute__((__format__ (printf, 2, 3)))

281 __attribute__((__nonnull__ (2)));

282

283 int tls_ssl_error(struct tls *ctx, SSL *ssl_conn, int ssl_ret,

284 const char *prefix);

285

286 int tls_conninfo_populate(struct tls *ctx);

287 void tls_conninfo_free(struct tls_conninfo *conninfo);

288

289 int tls_ocsp_verify_cb(SSL *ssl, void *arg);

290 int tls_ocsp_stapling_cb(SSL *ssl, void *arg);

291 void tls_ocsp_free(struct tls_ocsp *ctx);

292 struct tls_ocsp *tls_ocsp_setup_from_peer(struct tls *ctx);

293 int tls_hex_string(const unsigned char *_in, size_t _inlen, char **_out,

294 size_t *_outlen);

295 int tls_cert_hash(X509 *_cert, char **_hash);

296 int tls_cert_pubkey_hash(X509 *_cert, char **_hash);

297

298 int tls_password_cb(char *_buf, int _size, int _rwflag, void *_u);

299

300 RSA_METHOD *tls_signer_rsa_method(void);

301 ECDSA_METHOD *tls_signer_ecdsa_method(void);

302

303 #define TLS_PADDING_NONE 0

304 #define TLS_PADDING_RSA_PKCS1 1

305 #define TLS_PADDING_RSA_X9_31 2

306

307 int tls_config_set_sign_cb(struct tls_config *_config, tls_sign_cb _cb,

308 void *_cb_arg);

309

310 struct tls_signer* tls_signer_new(void);

311 void tls_signer_free(struct tls_signer * _signer);

312 const char *tls_signer_error(struct tls_signer * _signer);

313 int tls_signer_add_keypair_file(struct tls_signer *_signer,

314 const char *_cert_file, const char *_key_file);

315 int tls_signer_add_keypair_mem(struct tls_signer *_signer, const uint8_t *_cert,

316 size_t _cert_len, const uint8_t *_key, size_t _key_len);

317 int tls_signer_sign(struct tls_signer *_signer, const char *_pubkey_hash,

318 const uint8_t *_input, size_t _input_len, int _padding_type,

319 uint8_t **_out_signature, size_t *_out_signature_len);

320

321 __END_HIDDEN_DECLS

322

323 /* XXX this function is not fully hidden so relayd can use it */

324 void tls_config_skip_private_key_check(struct tls_config *config);

325 void tls_config_use_fake_private_key(struct tls_config *config);

326

327 #endif /* HEADER_TLS_INTERNAL_H */