?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "Merged all Chromoting Host code into remoting_core.dll (Windows)."
[chromium-blink-merge.git] / net / third_party / nss / ssl / sslimpl.h
blobfb2e9f9a3463f4eafeb79875bb94bf7db559339e
1 /*
2 * This file is PRIVATE to SSL and should be the first thing included by
3 * any SSL implementation file.
4 *
5 * This Source Code Form is subject to the terms of the Mozilla Public
6 * License, v. 2.0. If a copy of the MPL was not distributed with this
7 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
8 /* $Id: sslimpl.h,v 1.108 2012/09/28 01:46:45 wtc%google.com Exp $ */
9
10 #ifndef __sslimpl_h_
11 #define __sslimpl_h_
12
13 #ifdef DEBUG
14 #undef NDEBUG
15 #else
16 #undef NDEBUG
17 #define NDEBUG
18 #endif
19 #include "secport.h"
20 #include "secerr.h"
21 #include "sslerr.h"
22 #include "ssl3prot.h"
23 #include "hasht.h"
24 #include "nssilock.h"
25 #include "pkcs11t.h"
26 #if defined(XP_UNIX) || defined(XP_BEOS)
27 #include "unistd.h"
28 #endif
29 #include "nssrwlk.h"
30 #include "prthread.h"
31 #include "prclist.h"
32
33 #include "sslt.h" /* for some formerly private types, now public */
34
35 #ifdef NSS_PLATFORM_CLIENT_AUTH
36 #if defined(XP_WIN32)
37 #include <windows.h>
38 #include <wincrypt.h>
39 #elif defined(XP_MACOSX)
40 #include <Security/Security.h>
41 #endif
42 #endif
43
44 /* to make some of these old enums public without namespace pollution,
45 ** it was necessary to prepend ssl_ to the names.
46 ** These #defines preserve compatibility with the old code here in libssl.
47 */
48 typedef SSLKEAType SSL3KEAType;
49 typedef SSLMACAlgorithm SSL3MACAlgorithm;
50 typedef SSLSignType SSL3SignType;
51
52 #define sign_null ssl_sign_null
53 #define sign_rsa ssl_sign_rsa
54 #define sign_dsa ssl_sign_dsa
55 #define sign_ecdsa ssl_sign_ecdsa
56
57 #define calg_null ssl_calg_null
58 #define calg_rc4 ssl_calg_rc4
59 #define calg_rc2 ssl_calg_rc2
60 #define calg_des ssl_calg_des
61 #define calg_3des ssl_calg_3des
62 #define calg_idea ssl_calg_idea
63 #define calg_fortezza ssl_calg_fortezza /* deprecated, must preserve */
64 #define calg_aes ssl_calg_aes
65 #define calg_camellia ssl_calg_camellia
66 #define calg_seed ssl_calg_seed
67
68 #define mac_null ssl_mac_null
69 #define mac_md5 ssl_mac_md5
70 #define mac_sha ssl_mac_sha
71 #define hmac_md5 ssl_hmac_md5
72 #define hmac_sha ssl_hmac_sha
73
74 #define SET_ERROR_CODE /* reminder */
75 #define SEND_ALERT /* reminder */
76 #define TEST_FOR_FAILURE /* reminder */
77 #define DEAL_WITH_FAILURE /* reminder */
78
79 #if defined(DEBUG) || defined(TRACE)
80 #ifdef __cplusplus
81 #define Debug 1
82 #else
83 extern int Debug;
84 #endif
85 #else
86 #undef Debug
87 #endif
88
89 #if defined(DEBUG) && !defined(TRACE) && !defined(NISCC_TEST)
90 #define TRACE
91 #endif
92
93 #ifdef TRACE
94 #define SSL_TRC(a,b) if (ssl_trace >= (a)) ssl_Trace b
95 #define PRINT_BUF(a,b) if (ssl_trace >= (a)) ssl_PrintBuf b
96 #define DUMP_MSG(a,b) if (ssl_trace >= (a)) ssl_DumpMsg b
97 #else
98 #define SSL_TRC(a,b)
99 #define PRINT_BUF(a,b)
100 #define DUMP_MSG(a,b)
101 #endif
102
103 #ifdef DEBUG
104 #define SSL_DBG(b) if (ssl_debug) ssl_Trace b
105 #else
106 #define SSL_DBG(b)
107 #endif
108
109 #include "private/pprthred.h" /* for PR_InMonitor() */
110 #define ssl_InMonitor(m) PZ_InMonitor(m)
111
112 #define LSB(x) ((unsigned char) ((x) & 0xff))
113 #define MSB(x) ((unsigned char) (((unsigned)(x)) >> 8))
114
115 /************************************************************************/
116
117 typedef enum { SSLAppOpRead = 0,
118 SSLAppOpWrite,
119 SSLAppOpRDWR,
120 SSLAppOpPost,
121 SSLAppOpHeader
122 } SSLAppOperation;
123
124 #define SSL_MIN_MASTER_KEY_BYTES 5
125 #define SSL_MAX_MASTER_KEY_BYTES 64
126
127 #define SSL2_SESSIONID_BYTES 16
128 #define SSL3_SESSIONID_BYTES 32
129
130 #define SSL_MIN_CHALLENGE_BYTES 16
131 #define SSL_MAX_CHALLENGE_BYTES 32
132 #define SSL_CHALLENGE_BYTES 16
133
134 #define SSL_CONNECTIONID_BYTES 16
135
136 #define SSL_MIN_CYPHER_ARG_BYTES 0
137 #define SSL_MAX_CYPHER_ARG_BYTES 32
138
139 #define SSL_MAX_MAC_BYTES 16
140
141 #define SSL3_RSA_PMS_LENGTH 48
142 #define SSL3_MASTER_SECRET_LENGTH 48
143
144 /* number of wrap mechanisms potentially used to wrap master secrets. */
145 #define SSL_NUM_WRAP_MECHS 16
146
147 /* This makes the cert cache entry exactly 4k. */
148 #define SSL_MAX_CACHED_CERT_LEN 4060
149
150 #define NUM_MIXERS 9
151
152 /* Mask of the 25 named curves we support. */
153 #ifndef NSS_ECC_MORE_THAN_SUITE_B
154 #define SSL3_SUPPORTED_CURVES_MASK 0x3800000 /* only 3 curves, suite B*/
155 #else
156 #define SSL3_SUPPORTED_CURVES_MASK 0x3fffffe
157 #endif
158
159 #ifndef BPB
160 #define BPB 8 /* Bits Per Byte */
161 #endif
162
163 #define EXPORT_RSA_KEY_LENGTH 64 /* bytes */
164
165 #define INITIAL_DTLS_TIMEOUT_MS 1000 /* Default value from RFC 4347 = 1s*/
166 #define MAX_DTLS_TIMEOUT_MS 60000 /* 1 minute */
167 #define DTLS_FINISHED_TIMER_MS 120000 /* Time to wait in FINISHED state */
168
169 typedef struct sslBufferStr sslBuffer;
170 typedef struct sslConnectInfoStr sslConnectInfo;
171 typedef struct sslGatherStr sslGather;
172 typedef struct sslSecurityInfoStr sslSecurityInfo;
173 typedef struct sslSessionIDStr sslSessionID;
174 typedef struct sslSocketStr sslSocket;
175 typedef struct sslSocketOpsStr sslSocketOps;
176
177 typedef struct ssl3StateStr ssl3State;
178 typedef struct ssl3CertNodeStr ssl3CertNode;
179 typedef struct ssl3BulkCipherDefStr ssl3BulkCipherDef;
180 typedef struct ssl3MACDefStr ssl3MACDef;
181 typedef struct ssl3KeyPairStr ssl3KeyPair;
182
183 struct ssl3CertNodeStr {
184 struct ssl3CertNodeStr *next;
185 CERTCertificate * cert;
186 };
187
188 typedef SECStatus (*sslHandshakeFunc)(sslSocket *ss);
189
190 /* This type points to the low layer send func,
191 ** e.g. ssl2_SendStream or ssl3_SendPlainText.
192 ** These functions return the same values as PR_Send,
193 ** i.e. >= 0 means number of bytes sent, < 0 means error.
194 */
195 typedef PRInt32 (*sslSendFunc)(sslSocket *ss, const unsigned char *buf,
196 PRInt32 n, PRInt32 flags);
197
198 typedef void (*sslSessionIDCacheFunc) (sslSessionID *sid);
199 typedef void (*sslSessionIDUncacheFunc)(sslSessionID *sid);
200 typedef sslSessionID *(*sslSessionIDLookupFunc)(const PRIPv6Addr *addr,
201 unsigned char* sid,
202 unsigned int sidLen,
203 CERTCertDBHandle * dbHandle);
204
205 /* registerable callback function that either appends extension to buffer
206 * or returns length of data that it would have appended.
207 */
208 typedef PRInt32 (*ssl3HelloExtensionSenderFunc)(sslSocket *ss, PRBool append,
209 PRUint32 maxBytes);
210
211 /* registerable callback function that handles a received extension,
212 * of the given type.
213 */
214 typedef SECStatus (* ssl3HelloExtensionHandlerFunc)(sslSocket *ss,
215 PRUint16 ex_type,
216 SECItem * data);
217
218 /* row in a table of hello extension senders */
219 typedef struct {
220 PRInt32 ex_type;
221 ssl3HelloExtensionSenderFunc ex_sender;
222 } ssl3HelloExtensionSender;
223
224 /* row in a table of hello extension handlers */
225 typedef struct {
226 PRInt32 ex_type;
227 ssl3HelloExtensionHandlerFunc ex_handler;
228 } ssl3HelloExtensionHandler;
229
230 extern SECStatus
231 ssl3_RegisterServerHelloExtensionSender(sslSocket *ss, PRUint16 ex_type,
232 ssl3HelloExtensionSenderFunc cb);
233
234 extern PRInt32
235 ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes,
236 const ssl3HelloExtensionSender *sender);
237
238 /* Socket ops */
239 struct sslSocketOpsStr {
240 int (*connect) (sslSocket *, const PRNetAddr *);
241 PRFileDesc *(*accept) (sslSocket *, PRNetAddr *);
242 int (*bind) (sslSocket *, const PRNetAddr *);
243 int (*listen) (sslSocket *, int);
244 int (*shutdown)(sslSocket *, int);
245 int (*close) (sslSocket *);
246
247 int (*recv) (sslSocket *, unsigned char *, int, int);
248
249 /* points to the higher-layer send func, e.g. ssl_SecureSend. */
250 int (*send) (sslSocket *, const unsigned char *, int, int);
251 int (*read) (sslSocket *, unsigned char *, int);
252 int (*write) (sslSocket *, const unsigned char *, int);
253
254 int (*getpeername)(sslSocket *, PRNetAddr *);
255 int (*getsockname)(sslSocket *, PRNetAddr *);
256 };
257
258 /* Flags interpreted by ssl send functions. */
259 #define ssl_SEND_FLAG_FORCE_INTO_BUFFER 0x40000000
260 #define ssl_SEND_FLAG_NO_BUFFER 0x20000000
261 #define ssl_SEND_FLAG_USE_EPOCH 0x10000000 /* DTLS only */
262 #define ssl_SEND_FLAG_NO_RETRANSMIT 0x08000000 /* DTLS only */
263 #define ssl_SEND_FLAG_CAP_RECORD_VERSION \
264 0x04000000 /* TLS only */
265 #define ssl_SEND_FLAG_MASK 0x7f000000
266
267 /*
268 ** A buffer object.
269 */
270 struct sslBufferStr {
271 unsigned char * buf;
272 unsigned int len;
273 unsigned int space;
274 };
275
276 /*
277 ** SSL3 cipher suite policy and preference struct.
278 */
279 typedef struct {
280 #if !defined(_WIN32)
281 unsigned int cipher_suite : 16;
282 unsigned int policy : 8;
283 unsigned int enabled : 1;
284 unsigned int isPresent : 1;
285 #else
286 ssl3CipherSuite cipher_suite;
287 PRUint8 policy;
288 unsigned char enabled : 1;
289 unsigned char isPresent : 1;
290 #endif
291 } ssl3CipherSuiteCfg;
292
293 #ifdef NSS_ENABLE_ECC
294 #define ssl_V3_SUITES_IMPLEMENTED 50
295 #else
296 #define ssl_V3_SUITES_IMPLEMENTED 30
297 #endif /* NSS_ENABLE_ECC */
298
299 #define MAX_DTLS_SRTP_CIPHER_SUITES 4
300
301 typedef struct sslOptionsStr {
302 /* If SSL_SetNextProtoNego has been called, then this contains the
303 * list of supported protocols. */
304 SECItem nextProtoNego;
305
306 unsigned int useSecurity : 1; /* 1 */
307 unsigned int useSocks : 1; /* 2 */
308 unsigned int requestCertificate : 1; /* 3 */
309 unsigned int requireCertificate : 2; /* 4-5 */
310 unsigned int handshakeAsClient : 1; /* 6 */
311 unsigned int handshakeAsServer : 1; /* 7 */
312 unsigned int enableSSL2 : 1; /* 8 */
313 unsigned int unusedBit9 : 1; /* 9 */
314 unsigned int unusedBit10 : 1; /* 10 */
315 unsigned int noCache : 1; /* 11 */
316 unsigned int fdx : 1; /* 12 */
317 unsigned int v2CompatibleHello : 1; /* 13 */
318 unsigned int detectRollBack : 1; /* 14 */
319 unsigned int noStepDown : 1; /* 15 */
320 unsigned int bypassPKCS11 : 1; /* 16 */
321 unsigned int noLocks : 1; /* 17 */
322 unsigned int enableSessionTickets : 1; /* 18 */
323 unsigned int enableDeflate : 1; /* 19 */
324 unsigned int enableRenegotiation : 2; /* 20-21 */
325 unsigned int requireSafeNegotiation : 1; /* 22 */
326 unsigned int enableFalseStart : 1; /* 23 */
327 unsigned int cbcRandomIV : 1; /* 24 */
328 unsigned int enableOCSPStapling : 1; /* 25 */
329 } sslOptions;
330
331 typedef enum { sslHandshakingUndetermined = 0,
332 sslHandshakingAsClient,
333 sslHandshakingAsServer
334 } sslHandshakingType;
335
336 typedef struct sslServerCertsStr {
337 /* Configuration state for server sockets */
338 CERTCertificate * serverCert;
339 CERTCertificateList * serverCertChain;
340 ssl3KeyPair * serverKeyPair;
341 unsigned int serverKeyBits;
342 } sslServerCerts;
343
344 #define SERVERKEY serverKeyPair->privKey
345
346 #define SSL_LOCK_RANK_SPEC 255
347 #define SSL_LOCK_RANK_GLOBAL NSS_RWLOCK_RANK_NONE
348
349 /* These are the valid values for shutdownHow.
350 ** These values are each 1 greater than the NSPR values, and the code
351 ** depends on that relation to efficiently convert PR_SHUTDOWN values
352 ** into ssl_SHUTDOWN values. These values use one bit for read, and
353 ** another bit for write, and can be used as bitmasks.
354 */
355 #define ssl_SHUTDOWN_NONE 0 /* NOT shutdown at all */
356 #define ssl_SHUTDOWN_RCV 1 /* PR_SHUTDOWN_RCV +1 */
357 #define ssl_SHUTDOWN_SEND 2 /* PR_SHUTDOWN_SEND +1 */
358 #define ssl_SHUTDOWN_BOTH 3 /* PR_SHUTDOWN_BOTH +1 */
359
360 /*
361 ** A gather object. Used to read some data until a count has been
362 ** satisfied. Primarily for support of async sockets.
363 ** Everything in here is protected by the recvBufLock.
364 */
365 struct sslGatherStr {
366 int state; /* see GS_ values below. */ /* ssl 2 & 3 */
367
368 /* "buf" holds received plaintext SSL records, after decrypt and MAC check.
369 * SSL2: recv'd ciphertext records are put here, then decrypted in place.
370 * SSL3: recv'd ciphertext records are put in inbuf (see below), then
371 * decrypted into buf.
372 */
373 sslBuffer buf; /*recvBufLock*/ /* ssl 2 & 3 */
374
375 /* number of bytes previously read into hdr or buf(ssl2) or inbuf (ssl3).
376 ** (offset - writeOffset) is the number of ciphertext bytes read in but
377 ** not yet deciphered.
378 */
379 unsigned int offset; /* ssl 2 & 3 */
380
381 /* number of bytes to read in next call to ssl_DefRecv (recv) */
382 unsigned int remainder; /* ssl 2 & 3 */
383
384 /* Number of ciphertext bytes to read in after 2-byte SSL record header. */
385 unsigned int count; /* ssl2 only */
386
387 /* size of the final plaintext record.
388 ** == count - (recordPadding + MAC size)
389 */
390 unsigned int recordLen; /* ssl2 only */
391
392 /* number of bytes of padding to be removed after decrypting. */
393 /* This value is taken from the record's hdr[2], which means a too large
394 * value could crash us.
395 */
396 unsigned int recordPadding; /* ssl2 only */
397
398 /* plaintext DATA begins this many bytes into "buf". */
399 unsigned int recordOffset; /* ssl2 only */
400
401 int encrypted; /* SSL2 session is now encrypted. ssl2 only */
402
403 /* These next two values are used by SSL2 and SSL3.
404 ** DoRecv uses them to extract application data.
405 ** The difference between writeOffset and readOffset is the amount of
406 ** data available to the application. Note that the actual offset of
407 ** the data in "buf" is recordOffset (above), not readOffset.
408 ** In the current implementation, this is made available before the
409 ** MAC is checked!!
410 */
411 unsigned int readOffset; /* Spot where DATA reader (e.g. application
412 ** or handshake code) will read next.
413 ** Always zero for SSl3 application data.
414 */
415 /* offset in buf/inbuf/hdr into which new data will be read from socket. */
416 unsigned int writeOffset;
417
418 /* Buffer for ssl3 to read (encrypted) data from the socket */
419 sslBuffer inbuf; /*recvBufLock*/ /* ssl3 only */
420
421 /* The ssl[23]_GatherData functions read data into this buffer, rather
422 ** than into buf or inbuf, while in the GS_HEADER state.
423 ** The portion of the SSL record header put here always comes off the wire
424 ** as plaintext, never ciphertext.
425 ** For SSL2, the plaintext portion is two bytes long. For SSl3 it is 5.
426 ** For DTLS it is 13.
427 */
428 unsigned char hdr[13]; /* ssl 2 & 3 or dtls */
429
430 /* Buffer for DTLS data read off the wire as a single datagram */
431 sslBuffer dtlsPacket;
432
433 /* the start of the buffered DTLS record in dtlsPacket */
434 unsigned int dtlsPacketOffset;
435 };
436
437 /* sslGather.state */
438 #define GS_INIT 0
439 #define GS_HEADER 1
440 #define GS_MAC 2
441 #define GS_DATA 3
442 #define GS_PAD 4
443
444 typedef SECStatus (*SSLCipher)(void * context,
445 unsigned char * out,
446 int * outlen,
447 int maxout,
448 const unsigned char *in,
449 int inlen);
450 typedef SECStatus (*SSLCompressor)(void * context,
451 unsigned char * out,
452 int * outlen,
453 int maxout,
454 const unsigned char *in,
455 int inlen);
456 typedef SECStatus (*SSLDestroy)(void *context, PRBool freeit);
457
458 #if defined(NSS_PLATFORM_CLIENT_AUTH) && defined(XP_WIN32)
459 typedef PCERT_KEY_CONTEXT PlatformKey;
460 #elif defined(NSS_PLATFORM_CLIENT_AUTH) && defined(XP_MACOSX)
461 typedef SecKeyRef PlatformKey;
462 #else
463 typedef void *PlatformKey;
464 #endif
465
466
467
468 /*
469 ** ssl3State and CipherSpec structs
470 */
471
472 /* The SSL bulk cipher definition */
473 typedef enum {
474 cipher_null,
475 cipher_rc4,
476 cipher_rc4_40,
477 cipher_rc4_56,
478 cipher_rc2,
479 cipher_rc2_40,
480 cipher_des,
481 cipher_3des,
482 cipher_des40,
483 cipher_idea,
484 cipher_aes_128,
485 cipher_aes_256,
486 cipher_camellia_128,
487 cipher_camellia_256,
488 cipher_seed,
489 cipher_missing /* reserved for no such supported cipher */
490 /* This enum must match ssl3_cipherName[] in ssl3con.c. */
491 } SSL3BulkCipher;
492
493 typedef enum { type_stream, type_block } CipherType;
494
495 #define MAX_IV_LENGTH 24
496
497 /*
498 * Do not depend upon 64 bit arithmetic in the underlying machine.
499 */
500 typedef struct {
501 PRUint32 high;
502 PRUint32 low;
503 } SSL3SequenceNumber;
504
505 typedef PRUint16 DTLSEpoch;
506
507 typedef void (*DTLSTimerCb)(sslSocket *);
508
509 #define MAX_MAC_CONTEXT_BYTES 400
510 #define MAX_MAC_CONTEXT_LLONGS (MAX_MAC_CONTEXT_BYTES / 8)
511
512 #define MAX_CIPHER_CONTEXT_BYTES 2080
513 #define MAX_CIPHER_CONTEXT_LLONGS (MAX_CIPHER_CONTEXT_BYTES / 8)
514
515 typedef struct {
516 SSL3Opaque wrapped_master_secret[48];
517 PRUint16 wrapped_master_secret_len;
518 PRUint8 msIsWrapped;
519 PRUint8 resumable;
520 } ssl3SidKeys; /* 52 bytes */
521
522 typedef struct {
523 PK11SymKey *write_key;
524 PK11SymKey *write_mac_key;
525 PK11Context *write_mac_context;
526 SECItem write_key_item;
527 SECItem write_iv_item;
528 SECItem write_mac_key_item;
529 SSL3Opaque write_iv[MAX_IV_LENGTH];
530 PRUint64 cipher_context[MAX_CIPHER_CONTEXT_LLONGS];
531 } ssl3KeyMaterial;
532
533 /* The DTLS anti-replay window. Defined here because we need it in
534 * the cipher spec. Note that this is a ring buffer but left and
535 * right represent the true window, with modular arithmetic used to
536 * map them onto the buffer.
537 */
538 #define DTLS_RECVD_RECORDS_WINDOW 1024 /* Packets; approximate
539 * Must be divisible by 8
540 */
541 typedef struct DTLSRecvdRecordsStr {
542 unsigned char data[DTLS_RECVD_RECORDS_WINDOW/8];
543 PRUint64 left;
544 PRUint64 right;
545 } DTLSRecvdRecords;
546
547 /*
548 ** These are the "specs" in the "ssl3" struct.
549 ** Access to the pointers to these specs, and all the specs' contents
550 ** (direct and indirect) is protected by the reader/writer lock ss->specLock.
551 */
552 typedef struct {
553 const ssl3BulkCipherDef *cipher_def;
554 const ssl3MACDef * mac_def;
555 SSLCompressionMethod compression_method;
556 int mac_size;
557 SSLCipher encode;
558 SSLCipher decode;
559 SSLDestroy destroy;
560 void * encodeContext;
561 void * decodeContext;
562 SSLCompressor compressor; /* Don't name these fields compress */
563 SSLCompressor decompressor; /* and uncompress because zconf.h */
564 /* may define them as macros. */
565 SSLDestroy destroyCompressContext;
566 void * compressContext;
567 SSLDestroy destroyDecompressContext;
568 void * decompressContext;
569 PRBool bypassCiphers; /* did double bypass (at least) */
570 PK11SymKey * master_secret;
571 SSL3SequenceNumber write_seq_num;
572 SSL3SequenceNumber read_seq_num;
573 SSL3ProtocolVersion version;
574 ssl3KeyMaterial client;
575 ssl3KeyMaterial server;
576 SECItem msItem;
577 unsigned char key_block[NUM_MIXERS * MD5_LENGTH];
578 unsigned char raw_master_secret[56];
579 SECItem srvVirtName; /* for server: name that was negotiated
580 * with a client. For client - is
581 * always set to NULL.*/
582 DTLSEpoch epoch;
583 DTLSRecvdRecords recvdRecords;
584 } ssl3CipherSpec;
585
586 typedef enum { never_cached,
587 in_client_cache,
588 in_server_cache,
589 invalid_cache /* no longer in any cache. */
590 } Cached;
591
592 #define MAX_PEER_CERT_CHAIN_SIZE 8
593
594 struct sslSessionIDStr {
595 sslSessionID * next; /* chain used for client sockets, only */
596
597 CERTCertificate * peerCert;
598 CERTCertificate * peerCertChain[MAX_PEER_CERT_CHAIN_SIZE];
599 const char * peerID; /* client only */
600 const char * urlSvrName; /* client only */
601 CERTCertificate * localCert;
602
603 PRIPv6Addr addr;
604 PRUint16 port;
605
606 SSL3ProtocolVersion version;
607
608 PRUint32 creationTime; /* seconds since Jan 1, 1970 */
609 PRUint32 lastAccessTime; /* seconds since Jan 1, 1970 */
610 PRUint32 expirationTime; /* seconds since Jan 1, 1970 */
611 Cached cached;
612 int references;
613
614 SSLSignType authAlgorithm;
615 PRUint32 authKeyBits;
616 SSLKEAType keaType;
617 PRUint32 keaKeyBits;
618
619 union {
620 struct {
621 /* the V2 code depends upon the size of sessionID. */
622 unsigned char sessionID[SSL2_SESSIONID_BYTES];
623
624 /* Stuff used to recreate key and read/write cipher objects */
625 SECItem masterKey; /* never wrapped */
626 int cipherType;
627 SECItem cipherArg;
628 int keyBits;
629 int secretKeyBits;
630 } ssl2;
631 struct {
632 /* values that are copied into the server's on-disk SID cache. */
633 uint8 sessionIDLength;
634 SSL3Opaque sessionID[SSL3_SESSIONID_BYTES];
635
636 ssl3CipherSuite cipherSuite;
637 SSLCompressionMethod compression;
638 int policy;
639 ssl3SidKeys keys;
640 CK_MECHANISM_TYPE masterWrapMech;
641 /* mechanism used to wrap master secret */
642 SSL3KEAType exchKeyType;
643 /* key type used in exchange algorithm,
644 * and to wrap the sym wrapping key. */
645 #ifdef NSS_ENABLE_ECC
646 PRUint32 negotiatedECCurves;
647 #endif /* NSS_ENABLE_ECC */
648
649 /* The following values are NOT restored from the server's on-disk
650 * session cache, but are restored from the client's cache.
651 */
652 PK11SymKey * clientWriteKey;
653 PK11SymKey * serverWriteKey;
654
655 /* The following values pertain to the slot that wrapped the
656 ** master secret. (used only in client)
657 */
658 SECMODModuleID masterModuleID;
659 /* what module wrapped the master secret */
660 CK_SLOT_ID masterSlotID;
661 PRUint16 masterWrapIndex;
662 /* what's the key index for the wrapping key */
663 PRUint16 masterWrapSeries;
664 /* keep track of the slot series, so we don't
665 * accidently try to use new keys after the
666 * card gets removed and replaced.*/
667
668 /* The following values pertain to the slot that did the signature
669 ** for client auth. (used only in client)
670 */
671 SECMODModuleID clAuthModuleID;
672 CK_SLOT_ID clAuthSlotID;
673 PRUint16 clAuthSeries;
674
675 char masterValid;
676 char clAuthValid;
677
678 /* Session ticket if we have one, is sent as an extension in the
679 * ClientHello message. This field is used by clients.
680 */
681 NewSessionTicket sessionTicket;
682 SECItem srvName;
683 } ssl3;
684 } u;
685 };
686
687
688 typedef struct ssl3CipherSuiteDefStr {
689 ssl3CipherSuite cipher_suite;
690 SSL3BulkCipher bulk_cipher_alg;
691 SSL3MACAlgorithm mac_alg;
692 SSL3KeyExchangeAlgorithm key_exchange_alg;
693 } ssl3CipherSuiteDef;
694
695 /*
696 ** There are tables of these, all const.
697 */
698 typedef struct {
699 SSL3KeyExchangeAlgorithm kea;
700 SSL3KEAType exchKeyType;
701 SSL3SignType signKeyType;
702 PRBool is_limited;
703 int key_size_limit;
704 PRBool tls_keygen;
705 } ssl3KEADef;
706
707 typedef enum { kg_null, kg_strong, kg_export } SSL3KeyGenMode;
708
709 /*
710 ** There are tables of these, all const.
711 */
712 struct ssl3BulkCipherDefStr {
713 SSL3BulkCipher cipher;
714 SSLCipherAlgorithm calg;
715 int key_size;
716 int secret_key_size;
717 CipherType type;
718 int iv_size;
719 int block_size;
720 SSL3KeyGenMode keygen_mode;
721 };
722
723 /*
724 ** There are tables of these, all const.
725 */
726 struct ssl3MACDefStr {
727 SSL3MACAlgorithm mac;
728 CK_MECHANISM_TYPE mmech;
729 int pad_size;
730 int mac_size;
731 };
732
733 typedef enum {
734 wait_client_hello,
735 wait_client_cert,
736 wait_client_key,
737 wait_cert_verify,
738 wait_change_cipher,
739 wait_finished,
740 wait_server_hello,
741 wait_server_cert,
742 wait_server_key,
743 wait_cert_request,
744 wait_hello_done,
745 wait_new_session_ticket,
746 idle_handshake
747 } SSL3WaitState;
748
749 /*
750 * TLS extension related constants and data structures.
751 */
752 typedef struct TLSExtensionDataStr TLSExtensionData;
753 typedef struct SessionTicketDataStr SessionTicketData;
754
755 struct TLSExtensionDataStr {
756 /* registered callbacks that send server hello extensions */
757 ssl3HelloExtensionSender serverSenders[SSL_MAX_EXTENSIONS];
758 /* Keep track of the extensions that are negotiated. */
759 PRUint16 numAdvertised;
760 PRUint16 numNegotiated;
761 PRUint16 advertised[SSL_MAX_EXTENSIONS];
762 PRUint16 negotiated[SSL_MAX_EXTENSIONS];
763
764 /* SessionTicket Extension related data. */
765 PRBool ticketTimestampVerified;
766 PRBool emptySessionTicket;
767
768 /* SNI Extension related data
769 * Names data is not coppied from the input buffer. It can not be
770 * used outside the scope where input buffer is defined and that
771 * is beyond ssl3_HandleClientHello function. */
772 SECItem *sniNameArr;
773 PRUint32 sniNameArrSize;
774 };
775
776 typedef SECStatus (*sslRestartTarget)(sslSocket *);
777
778 /*
779 ** A DTLS queued message (potentially to be retransmitted)
780 */
781 typedef struct DTLSQueuedMessageStr {
782 PRCList link; /* The linked list link */
783 DTLSEpoch epoch; /* The epoch to use */
784 SSL3ContentType type; /* The message type */
785 unsigned char *data; /* The data */
786 PRUint16 len; /* The data length */
787 } DTLSQueuedMessage;
788
789 /*
790 ** This is the "hs" member of the "ssl3" struct.
791 ** This entire struct is protected by ssl3HandshakeLock
792 */
793 typedef struct SSL3HandshakeStateStr {
794 SSL3Random server_random;
795 SSL3Random client_random;
796 SSL3WaitState ws;
797 PRUint64 md5_cx[MAX_MAC_CONTEXT_LLONGS];
798 PRUint64 sha_cx[MAX_MAC_CONTEXT_LLONGS];
799 PK11Context * md5; /* handshake running hashes */
800 PK11Context * sha;
801 const ssl3KEADef * kea_def;
802 ssl3CipherSuite cipher_suite;
803 const ssl3CipherSuiteDef *suite_def;
804 SSLCompressionMethod compression;
805 sslBuffer msg_body; /* protected by recvBufLock */
806 /* partial handshake message from record layer */
807 unsigned int header_bytes;
808 /* number of bytes consumed from handshake */
809 /* message for message type and header length */
810 SSL3HandshakeType msg_type;
811 unsigned long msg_len;
812 SECItem ca_list; /* used only by client */
813 PRBool isResuming; /* are we resuming a session */
814 PRBool usedStepDownKey; /* we did a server key exchange. */
815 PRBool sendingSCSV; /* instead of empty RI */
816 PRBool may_get_cert_status; /* the server echoed a
817 * status_request extension so
818 * may send a CertificateStatus
819 * handshake message. */
820 SECItem pending_cert_msg; /* a Certificate message which we
821 * save temporarily if we may get
822 * a CertificateStatus message */
823 SECItem cert_status; /* an OCSP response */
824 sslBuffer msgState; /* current state for handshake messages*/
825 /* protected by recvBufLock */
826 sslBuffer messages; /* Accumulated handshake messages */
827 PRUint16 finishedBytes; /* size of single finished below */
828 union {
829 TLSFinished tFinished[2]; /* client, then server */
830 SSL3Hashes sFinished[2];
831 SSL3Opaque data[72];
832 } finishedMsgs;
833 #ifdef NSS_ENABLE_ECC
834 PRUint32 negotiatedECCurves; /* bit mask */
835 #endif /* NSS_ENABLE_ECC */
836
837 PRBool authCertificatePending;
838 /* Which function should SSL_RestartHandshake* call if we're blocked?
839 * One of NULL, ssl3_SendClientSecondRound, ssl3_FinishHandshake,
840 * or ssl3_AlwaysFail */
841 sslRestartTarget restartTarget;
842 /* Shared state between ssl3_HandleFinished and ssl3_FinishHandshake */
843 PRBool cacheSID;
844
845 /* This group of values is used for DTLS */
846 PRUint16 sendMessageSeq; /* The sending message sequence
847 * number */
848 PRCList lastMessageFlight; /* The last message flight we
849 * sent */
850 PRUint16 maxMessageSent; /* The largest message we sent */
851 PRUint16 recvMessageSeq; /* The receiving message sequence
852 * number */
853 sslBuffer recvdFragments; /* The fragments we have received in
854 * a bitmask */
855 PRInt32 recvdHighWater; /* The high water mark for fragments
856 * received. -1 means no reassembly
857 * in progress. */
858 unsigned char cookie[32]; /* The cookie */
859 unsigned char cookieLen; /* The length of the cookie */
860 PRIntervalTime rtTimerStarted; /* When the timer was started */
861 DTLSTimerCb rtTimerCb; /* The function to call on expiry */
862 PRUint32 rtTimeoutMs; /* The length of the current timeout
863 * used for backoff (in ms) */
864 PRUint32 rtRetries; /* The retry counter */
865 } SSL3HandshakeState;
866
867
868
869 /*
870 ** This is the "ssl3" struct, as in "ss->ssl3".
871 ** note:
872 ** usually, crSpec == cwSpec and prSpec == pwSpec.
873 ** Sometimes, crSpec == pwSpec and prSpec == cwSpec.
874 ** But there are never more than 2 actual specs.
875 ** No spec must ever be modified if either "current" pointer points to it.
876 */
877 struct ssl3StateStr {
878
879 /*
880 ** The following Specs and Spec pointers must be protected using the
881 ** Spec Lock.
882 */
883 ssl3CipherSpec * crSpec; /* current read spec. */
884 ssl3CipherSpec * prSpec; /* pending read spec. */
885 ssl3CipherSpec * cwSpec; /* current write spec. */
886 ssl3CipherSpec * pwSpec; /* pending write spec. */
887
888 CERTCertificate * clientCertificate; /* used by client */
889 SECKEYPrivateKey * clientPrivateKey; /* used by client */
890 /* platformClientKey is present even when NSS_PLATFORM_CLIENT_AUTH is not
891 * defined in order to allow cleaner conditional code.
892 * At most one of clientPrivateKey and platformClientKey may be set. */
893 PlatformKey platformClientKey; /* used by client */
894 CERTCertificateList *clientCertChain; /* used by client */
895 PRBool sendEmptyCert; /* used by client */
896
897 SECKEYPrivateKey *channelID; /* used by client */
898 SECKEYPublicKey *channelIDPub; /* used by client */
899
900 int policy;
901 /* This says what cipher suites we can do, and should
902 * be either SSL_ALLOWED or SSL_RESTRICTED
903 */
904 PRArenaPool * peerCertArena;
905 /* These are used to keep track of the peer CA */
906 void * peerCertChain;
907 /* chain while we are trying to validate it. */
908 CERTDistNames * ca_list;
909 /* used by server. trusted CAs for this socket. */
910 PRBool initialized;
911 SSL3HandshakeState hs;
912 ssl3CipherSpec specs[2]; /* one is current, one is pending. */
913
914 /* In a client: if the server supports Next Protocol Negotiation, then
915 * this is the protocol that was negotiated.
916 */
917 SECItem nextProto;
918 SSLNextProtoState nextProtoState;
919
920 PRUint16 mtu; /* Our estimate of the MTU */
921
922 /* DTLS-SRTP cipher suite preferences (if any) */
923 PRUint16 dtlsSRTPCiphers[MAX_DTLS_SRTP_CIPHER_SUITES];
924 PRUint16 dtlsSRTPCipherCount;
925 PRUint16 dtlsSRTPCipherSuite; /* 0 if not selected */
926 };
927
928 #define DTLS_MAX_MTU 1500 /* Ethernet MTU but without subtracting the
929 * headers, so slightly larger than expected */
930 #define IS_DTLS(ss) (ss->protocolVariant == ssl_variant_datagram)
931
932 typedef struct {
933 SSL3ContentType type;
934 SSL3ProtocolVersion version;
935 SSL3SequenceNumber seq_num; /* DTLS only */
936 sslBuffer * buf;
937 } SSL3Ciphertext;
938
939 struct ssl3KeyPairStr {
940 SECKEYPrivateKey * privKey;
941 SECKEYPublicKey * pubKey;
942 PRInt32 refCount; /* use PR_Atomic calls for this. */
943 };
944
945 typedef struct SSLWrappedSymWrappingKeyStr {
946 SSL3Opaque wrappedSymmetricWrappingkey[512];
947 CK_MECHANISM_TYPE symWrapMechanism;
948 /* unwrapped symmetric wrapping key uses this mechanism */
949 CK_MECHANISM_TYPE asymWrapMechanism;
950 /* mechanism used to wrap the SymmetricWrappingKey using
951 * server's public and/or private keys. */
952 SSL3KEAType exchKeyType; /* type of keys used to wrap SymWrapKey*/
953 PRInt32 symWrapMechIndex;
954 PRUint16 wrappedSymKeyLen;
955 } SSLWrappedSymWrappingKey;
956
957 typedef struct SessionTicketStr {
958 uint16 ticket_version;
959 SSL3ProtocolVersion ssl_version;
960 ssl3CipherSuite cipher_suite;
961 SSLCompressionMethod compression_method;
962 SSLSignType authAlgorithm;
963 uint32 authKeyBits;
964 SSLKEAType keaType;
965 uint32 keaKeyBits;
966 /*
967 * exchKeyType and msWrapMech contain meaningful values only if
968 * ms_is_wrapped is true.
969 */
970 uint8 ms_is_wrapped;
971 SSLKEAType exchKeyType; /* XXX(wtc): same as keaType above? */
972 CK_MECHANISM_TYPE msWrapMech;
973 uint16 ms_length;
974 SSL3Opaque master_secret[48];
975 ClientIdentity client_identity;
976 SECItem peer_cert;
977 uint32 timestamp;
978 SECItem srvName; /* negotiated server name */
979 } SessionTicket;
980
981 /*
982 * SSL2 buffers used in SSL3.
983 * writeBuf in the SecurityInfo maintained by sslsecur.c is used
984 * to hold the data just about to be passed to the kernel
985 * sendBuf in the ConnectInfo maintained by sslcon.c is used
986 * to hold handshake messages as they are accumulated
987 */
988
989 /*
990 ** This is "ci", as in "ss->sec.ci".
991 **
992 ** Protection: All the variables in here are protected by
993 ** firstHandshakeLock AND (in ssl3) ssl3HandshakeLock
994 */
995 struct sslConnectInfoStr {
996 /* outgoing handshakes appended to this. */
997 sslBuffer sendBuf; /*xmitBufLock*/ /* ssl 2 & 3 */
998
999 PRIPv6Addr peer; /* ssl 2 & 3 */
1000 unsigned short port; /* ssl 2 & 3 */
1001
1002 sslSessionID *sid; /* ssl 2 & 3 */
1003
1004 /* see CIS_HAVE defines below for the bit values in *elements. */
1005 char elements; /* ssl2 only */
1006 char requiredElements; /* ssl2 only */
1007 char sentElements; /* ssl2 only */
1008
1009 char sentFinished; /* ssl2 only */
1010
1011 /* Length of server challenge. Used by client when saving challenge */
1012 int serverChallengeLen; /* ssl2 only */
1013 /* type of authentication requested by server */
1014 unsigned char authType; /* ssl2 only */
1015
1016 /* Challenge sent by client to server in client-hello message */
1017 /* SSL3 gets a copy of this. See ssl3_StartHandshakeHash(). */
1018 unsigned char clientChallenge[SSL_MAX_CHALLENGE_BYTES]; /* ssl 2 & 3 */
1019
1020 /* Connection-id sent by server to client in server-hello message */
1021 unsigned char connectionID[SSL_CONNECTIONID_BYTES]; /* ssl2 only */
1022
1023 /* Challenge sent by server to client in request-certificate message */
1024 unsigned char serverChallenge[SSL_MAX_CHALLENGE_BYTES]; /* ssl2 only */
1025
1026 /* Information kept to handle a request-certificate message */
1027 unsigned char readKey[SSL_MAX_MASTER_KEY_BYTES]; /* ssl2 only */
1028 unsigned char writeKey[SSL_MAX_MASTER_KEY_BYTES]; /* ssl2 only */
1029 unsigned keySize; /* ssl2 only */
1030 };
1031
1032 /* bit values for ci->elements, ci->requiredElements, sentElements. */
1033 #define CIS_HAVE_MASTER_KEY 0x01
1034 #define CIS_HAVE_CERTIFICATE 0x02
1035 #define CIS_HAVE_FINISHED 0x04
1036 #define CIS_HAVE_VERIFY 0x08
1037
1038 /* Note: The entire content of this struct and whatever it points to gets
1039 * blown away by SSL_ResetHandshake(). This is "sec" as in "ss->sec".
1040 *
1041 * Unless otherwise specified below, the contents of this struct are
1042 * protected by firstHandshakeLock AND (in ssl3) ssl3HandshakeLock.
1043 */
1044 struct sslSecurityInfoStr {
1045 sslSendFunc send; /*xmitBufLock*/ /* ssl 2 & 3 */
1046 int isServer; /* Spec Lock?*/ /* ssl 2 & 3 */
1047 sslBuffer writeBuf; /*xmitBufLock*/ /* ssl 2 & 3 */
1048
1049 int cipherType; /* ssl 2 & 3 */
1050 int keyBits; /* ssl 2 & 3 */
1051 int secretKeyBits; /* ssl 2 & 3 */
1052 CERTCertificate *localCert; /* ssl 2 & 3 */
1053 CERTCertificate *peerCert; /* ssl 2 & 3 */
1054 SECKEYPublicKey *peerKey; /* ssl3 only */
1055
1056 SSLSignType authAlgorithm;
1057 PRUint32 authKeyBits;
1058 SSLKEAType keaType;
1059 PRUint32 keaKeyBits;
1060
1061 /*
1062 ** Procs used for SID cache (nonce) management.
1063 ** Different implementations exist for clients/servers
1064 ** The lookup proc is only used for servers. Baloney!
1065 */
1066 sslSessionIDCacheFunc cache; /* ssl 2 & 3 */
1067 sslSessionIDUncacheFunc uncache; /* ssl 2 & 3 */
1068
1069 /*
1070 ** everything below here is for ssl2 only.
1071 ** This stuff is equivalent to SSL3's "spec", and is protected by the
1072 ** same "Spec Lock" as used for SSL3's specs.
1073 */
1074 PRUint32 sendSequence; /*xmitBufLock*/ /* ssl2 only */
1075 PRUint32 rcvSequence; /*recvBufLock*/ /* ssl2 only */
1076
1077 /* Hash information; used for one-way-hash functions (MD2, MD5, etc.) */
1078 const SECHashObject *hash; /* Spec Lock */ /* ssl2 only */
1079 void *hashcx; /* Spec Lock */ /* ssl2 only */
1080
1081 SECItem sendSecret; /* Spec Lock */ /* ssl2 only */
1082 SECItem rcvSecret; /* Spec Lock */ /* ssl2 only */
1083
1084 /* Session cypher contexts; one for each direction */
1085 void *readcx; /* Spec Lock */ /* ssl2 only */
1086 void *writecx; /* Spec Lock */ /* ssl2 only */
1087 SSLCipher enc; /* Spec Lock */ /* ssl2 only */
1088 SSLCipher dec; /* Spec Lock */ /* ssl2 only */
1089 void (*destroy)(void *, PRBool); /* Spec Lock */ /* ssl2 only */
1090
1091 /* Blocking information for the session cypher */
1092 int blockShift; /* Spec Lock */ /* ssl2 only */
1093 int blockSize; /* Spec Lock */ /* ssl2 only */
1094
1095 /* These are used during a connection handshake */
1096 sslConnectInfo ci; /* ssl 2 & 3 */
1097
1098 };
1099
1100 /*
1101 ** SSL Socket struct
1102 **
1103 ** Protection: XXX
1104 */
1105 struct sslSocketStr {
1106 PRFileDesc * fd;
1107
1108 /* Pointer to operations vector for this socket */
1109 const sslSocketOps * ops;
1110
1111 /* SSL socket options */
1112 sslOptions opt;
1113 /* Enabled version range */
1114 SSLVersionRange vrange;
1115
1116 /* State flags */
1117 unsigned long clientAuthRequested;
1118 unsigned long delayDisabled; /* Nagle delay disabled */
1119 unsigned long firstHsDone; /* first handshake is complete. */
1120 unsigned long handshakeBegun;
1121 unsigned long lastWriteBlocked;
1122 unsigned long recvdCloseNotify; /* received SSL EOF. */
1123 unsigned long TCPconnected;
1124 unsigned long appDataBuffered;
1125 unsigned long peerRequestedProtection; /* from old renegotiation */
1126
1127 /* version of the protocol to use */
1128 SSL3ProtocolVersion version;
1129 SSL3ProtocolVersion clientHelloVersion; /* version sent in client hello. */
1130
1131 sslSecurityInfo sec; /* not a pointer any more */
1132
1133 /* protected by firstHandshakeLock AND (in ssl3) ssl3HandshakeLock. */
1134 const char *url; /* ssl 2 & 3 */
1135
1136 sslHandshakeFunc handshake; /*firstHandshakeLock*/
1137 sslHandshakeFunc nextHandshake; /*firstHandshakeLock*/
1138 sslHandshakeFunc securityHandshake; /*firstHandshakeLock*/
1139
1140 /* the following variable is only used with socks or other proxies. */
1141 char * peerID; /* String uniquely identifies target server. */
1142
1143 unsigned char * cipherSpecs;
1144 unsigned int sizeCipherSpecs;
1145 const unsigned char * preferredCipher;
1146
1147 /* TLS ClientCertificateTypes requested during HandleCertificateRequest. */
1148 /* Will be NULL at all other times. */
1149 const SECItem *requestedCertTypes;
1150
1151 ssl3KeyPair * stepDownKeyPair; /* RSA step down keys */
1152
1153 /* Callbacks */
1154 SSLAuthCertificate authCertificate;
1155 void *authCertificateArg;
1156 SSLGetClientAuthData getClientAuthData;
1157 void *getClientAuthDataArg;
1158 #ifdef NSS_PLATFORM_CLIENT_AUTH
1159 SSLGetPlatformClientAuthData getPlatformClientAuthData;
1160 void *getPlatformClientAuthDataArg;
1161 #endif /* NSS_PLATFORM_CLIENT_AUTH */
1162 SSLSNISocketConfig sniSocketConfig;
1163 void *sniSocketConfigArg;
1164 SSLBadCertHandler handleBadCert;
1165 void *badCertArg;
1166 SSLHandshakeCallback handshakeCallback;
1167 void *handshakeCallbackData;
1168 void *pkcs11PinArg;
1169 SSLNextProtoCallback nextProtoCallback;
1170 void *nextProtoArg;
1171 SSLClientChannelIDCallback getChannelID;
1172 void *getChannelIDArg;
1173
1174 PRIntervalTime rTimeout; /* timeout for NSPR I/O */
1175 PRIntervalTime wTimeout; /* timeout for NSPR I/O */
1176 PRIntervalTime cTimeout; /* timeout for NSPR I/O */
1177
1178 PZLock * recvLock; /* lock against multiple reader threads. */
1179 PZLock * sendLock; /* lock against multiple sender threads. */
1180
1181 PZMonitor * recvBufLock; /* locks low level recv buffers. */
1182 PZMonitor * xmitBufLock; /* locks low level xmit buffers. */
1183
1184 /* Only one thread may operate on the socket until the initial handshake
1185 ** is complete. This Monitor ensures that. Since SSL2 handshake is
1186 ** only done once, this is also effectively the SSL2 handshake lock.
1187 */
1188 PZMonitor * firstHandshakeLock;
1189
1190 /* This monitor protects the ssl3 handshake state machine data.
1191 ** Only one thread (reader or writer) may be in the ssl3 handshake state
1192 ** machine at any time. */
1193 PZMonitor * ssl3HandshakeLock;
1194
1195 /* reader/writer lock, protects the secret data needed to encrypt and MAC
1196 ** outgoing records, and to decrypt and MAC check incoming ciphertext
1197 ** records. */
1198 NSSRWLock * specLock;
1199
1200 /* handle to perm cert db (and implicitly to the temp cert db) used
1201 ** with this socket.
1202 */
1203 CERTCertDBHandle * dbHandle;
1204
1205 PRThread * writerThread; /* thread holds SSL_LOCK_WRITER lock */
1206
1207 PRUint16 shutdownHow; /* See ssl_SHUTDOWN defines below. */
1208
1209 PRUint16 allowedByPolicy; /* copy of global policy bits. */
1210 PRUint16 maybeAllowedByPolicy; /* copy of global policy bits. */
1211 PRUint16 chosenPreference; /* SSL2 cipher preferences. */
1212
1213 sslHandshakingType handshaking;
1214
1215 /* Gather object used for gathering data */
1216 sslGather gs; /*recvBufLock*/
1217
1218 sslBuffer saveBuf; /*xmitBufLock*/
1219 sslBuffer pendingBuf; /*xmitBufLock*/
1220
1221 /* Configuration state for server sockets */
1222 /* server cert and key for each KEA type */
1223 sslServerCerts serverCerts[kt_kea_size];
1224
1225 ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED];
1226 ssl3KeyPair * ephemeralECDHKeyPair; /* for ECDHE-* handshake */
1227
1228 /* SSL3 state info. Formerly was a pointer */
1229 ssl3State ssl3;
1230
1231 /*
1232 * TLS extension related data.
1233 */
1234 /* True when the current session is a stateless resume. */
1235 PRBool statelessResume;
1236 TLSExtensionData xtnData;
1237
1238 /* Whether we are doing stream or datagram mode */
1239 SSLProtocolVariant protocolVariant;
1240 };
1241
1242
1243
1244 /* All the global data items declared here should be protected using the
1245 ** ssl_global_data_lock, which is a reader/writer lock.
1246 */
1247 extern NSSRWLock * ssl_global_data_lock;
1248 extern char ssl_debug;
1249 extern char ssl_trace;
1250 extern FILE * ssl_trace_iob;
1251 extern FILE * ssl_keylog_iob;
1252 extern CERTDistNames * ssl3_server_ca_list;
1253 extern PRUint32 ssl_sid_timeout;
1254 extern PRUint32 ssl3_sid_timeout;
1255
1256 extern const char * const ssl_cipherName[];
1257 extern const char * const ssl3_cipherName[];
1258
1259 extern sslSessionIDLookupFunc ssl_sid_lookup;
1260 extern sslSessionIDCacheFunc ssl_sid_cache;
1261 extern sslSessionIDUncacheFunc ssl_sid_uncache;
1262
1263 /************************************************************************/
1264
1265 SEC_BEGIN_PROTOS
1266
1267 /* Internal initialization and installation of the SSL error tables */
1268 extern SECStatus ssl_Init(void);
1269 extern SECStatus ssl_InitializePRErrorTable(void);
1270
1271 /* Implementation of ops for default (non socks, non secure) case */
1272 extern int ssl_DefConnect(sslSocket *ss, const PRNetAddr *addr);
1273 extern PRFileDesc *ssl_DefAccept(sslSocket *ss, PRNetAddr *addr);
1274 extern int ssl_DefBind(sslSocket *ss, const PRNetAddr *addr);
1275 extern int ssl_DefListen(sslSocket *ss, int backlog);
1276 extern int ssl_DefShutdown(sslSocket *ss, int how);
1277 extern int ssl_DefClose(sslSocket *ss);
1278 extern int ssl_DefRecv(sslSocket *ss, unsigned char *buf, int len, int flags);
1279 extern int ssl_DefSend(sslSocket *ss, const unsigned char *buf,
1280 int len, int flags);
1281 extern int ssl_DefRead(sslSocket *ss, unsigned char *buf, int len);
1282 extern int ssl_DefWrite(sslSocket *ss, const unsigned char *buf, int len);
1283 extern int ssl_DefGetpeername(sslSocket *ss, PRNetAddr *name);
1284 extern int ssl_DefGetsockname(sslSocket *ss, PRNetAddr *name);
1285 extern int ssl_DefGetsockopt(sslSocket *ss, PRSockOption optname,
1286 void *optval, PRInt32 *optlen);
1287 extern int ssl_DefSetsockopt(sslSocket *ss, PRSockOption optname,
1288 const void *optval, PRInt32 optlen);
1289
1290 /* Implementation of ops for socks only case */
1291 extern int ssl_SocksConnect(sslSocket *ss, const PRNetAddr *addr);
1292 extern PRFileDesc *ssl_SocksAccept(sslSocket *ss, PRNetAddr *addr);
1293 extern int ssl_SocksBind(sslSocket *ss, const PRNetAddr *addr);
1294 extern int ssl_SocksListen(sslSocket *ss, int backlog);
1295 extern int ssl_SocksGetsockname(sslSocket *ss, PRNetAddr *name);
1296 extern int ssl_SocksRecv(sslSocket *ss, unsigned char *buf, int len, int flags);
1297 extern int ssl_SocksSend(sslSocket *ss, const unsigned char *buf,
1298 int len, int flags);
1299 extern int ssl_SocksRead(sslSocket *ss, unsigned char *buf, int len);
1300 extern int ssl_SocksWrite(sslSocket *ss, const unsigned char *buf, int len);
1301
1302 /* Implementation of ops for secure only case */
1303 extern int ssl_SecureConnect(sslSocket *ss, const PRNetAddr *addr);
1304 extern PRFileDesc *ssl_SecureAccept(sslSocket *ss, PRNetAddr *addr);
1305 extern int ssl_SecureRecv(sslSocket *ss, unsigned char *buf,
1306 int len, int flags);
1307 extern int ssl_SecureSend(sslSocket *ss, const unsigned char *buf,
1308 int len, int flags);
1309 extern int ssl_SecureRead(sslSocket *ss, unsigned char *buf, int len);
1310 extern int ssl_SecureWrite(sslSocket *ss, const unsigned char *buf, int len);
1311 extern int ssl_SecureShutdown(sslSocket *ss, int how);
1312 extern int ssl_SecureClose(sslSocket *ss);
1313
1314 /* Implementation of ops for secure socks case */
1315 extern int ssl_SecureSocksConnect(sslSocket *ss, const PRNetAddr *addr);
1316 extern PRFileDesc *ssl_SecureSocksAccept(sslSocket *ss, PRNetAddr *addr);
1317 extern PRFileDesc *ssl_FindTop(sslSocket *ss);
1318
1319 /* Gather funcs. */
1320 extern sslGather * ssl_NewGather(void);
1321 extern SECStatus ssl_InitGather(sslGather *gs);
1322 extern void ssl_DestroyGather(sslGather *gs);
1323 extern int ssl2_GatherData(sslSocket *ss, sslGather *gs, int flags);
1324 extern int ssl2_GatherRecord(sslSocket *ss, int flags);
1325 extern SECStatus ssl_GatherRecord1stHandshake(sslSocket *ss);
1326
1327 extern SECStatus ssl2_HandleClientHelloMessage(sslSocket *ss);
1328 extern SECStatus ssl2_HandleServerHelloMessage(sslSocket *ss);
1329 extern int ssl2_StartGatherBytes(sslSocket *ss, sslGather *gs,
1330 unsigned int count);
1331
1332 extern SECStatus ssl_CreateSecurityInfo(sslSocket *ss);
1333 extern SECStatus ssl_CopySecurityInfo(sslSocket *ss, sslSocket *os);
1334 extern void ssl_ResetSecurityInfo(sslSecurityInfo *sec, PRBool doMemset);
1335 extern void ssl_DestroySecurityInfo(sslSecurityInfo *sec);
1336
1337 extern void ssl_PrintBuf(sslSocket *ss, const char *msg, const void *cp, int len);
1338 extern void ssl_DumpMsg(sslSocket *ss, unsigned char *bp, unsigned len);
1339
1340 extern int ssl_SendSavedWriteData(sslSocket *ss);
1341 extern SECStatus ssl_SaveWriteData(sslSocket *ss,
1342 const void* p, unsigned int l);
1343 extern SECStatus ssl2_BeginClientHandshake(sslSocket *ss);
1344 extern SECStatus ssl2_BeginServerHandshake(sslSocket *ss);
1345 extern int ssl_Do1stHandshake(sslSocket *ss);
1346
1347 extern SECStatus sslBuffer_Grow(sslBuffer *b, unsigned int newLen);
1348 extern SECStatus sslBuffer_Append(sslBuffer *b, const void * data,
1349 unsigned int len);
1350
1351 extern void ssl2_UseClearSendFunc(sslSocket *ss);
1352 extern void ssl_ChooseSessionIDProcs(sslSecurityInfo *sec);
1353
1354 extern sslSessionID *ssl3_NewSessionID(sslSocket *ss, PRBool is_server);
1355 extern sslSessionID *ssl_LookupSID(const PRIPv6Addr *addr, PRUint16 port,
1356 const char *peerID, const char *urlSvrName);
1357 extern void ssl_FreeSID(sslSessionID *sid);
1358
1359 extern int ssl3_SendApplicationData(sslSocket *ss, const PRUint8 *in,
1360 int len, int flags);
1361
1362 extern PRBool ssl_FdIsBlocking(PRFileDesc *fd);
1363
1364 extern PRBool ssl_SocketIsBlocking(sslSocket *ss);
1365
1366 extern void ssl3_SetAlwaysBlock(sslSocket *ss);
1367
1368 extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled);
1369
1370 extern PRBool ssl3_CanFalseStart(sslSocket *ss);
1371 extern SECStatus
1372 ssl3_CompressMACEncryptRecord(ssl3CipherSpec * cwSpec,
1373 PRBool isServer,
1374 PRBool isDTLS,
1375 PRBool capRecordVersion,
1376 SSL3ContentType type,
1377 const SSL3Opaque * pIn,
1378 PRUint32 contentLen,
1379 sslBuffer * wrBuf);
1380 extern PRInt32 ssl3_SendRecord(sslSocket *ss, DTLSEpoch epoch,
1381 SSL3ContentType type,
1382 const SSL3Opaque* pIn, PRInt32 nIn,
1383 PRInt32 flags);
1384
1385 #ifdef NSS_ENABLE_ZLIB
1386 /*
1387 * The DEFLATE algorithm can result in an expansion of 0.1% + 12 bytes. For a
1388 * maximum TLS record payload of 2**14 bytes, that's 29 bytes.
1389 */
1390 #define SSL3_COMPRESSION_MAX_EXPANSION 29
1391 #else /* !NSS_ENABLE_ZLIB */
1392 #define SSL3_COMPRESSION_MAX_EXPANSION 0
1393 #endif
1394
1395 /*
1396 * make sure there is room in the write buffer for padding and
1397 * other compression and cryptographic expansions.
1398 */
1399 #define SSL3_BUFFER_FUDGE 100 + SSL3_COMPRESSION_MAX_EXPANSION
1400
1401 #define SSL_LOCK_READER(ss) if (ss->recvLock) PZ_Lock(ss->recvLock)
1402 #define SSL_UNLOCK_READER(ss) if (ss->recvLock) PZ_Unlock(ss->recvLock)
1403 #define SSL_LOCK_WRITER(ss) if (ss->sendLock) PZ_Lock(ss->sendLock)
1404 #define SSL_UNLOCK_WRITER(ss) if (ss->sendLock) PZ_Unlock(ss->sendLock)
1405
1406 /* firstHandshakeLock -> recvBufLock */
1407 #define ssl_Get1stHandshakeLock(ss) \
1408 { if (!ss->opt.noLocks) { \
1409 PORT_Assert(PZ_InMonitor((ss)->firstHandshakeLock) || \
1410 !ssl_HaveRecvBufLock(ss)); \
1411 PZ_EnterMonitor((ss)->firstHandshakeLock); \
1412 } }
1413 #define ssl_Release1stHandshakeLock(ss) \
1414 { if (!ss->opt.noLocks) PZ_ExitMonitor((ss)->firstHandshakeLock); }
1415 #define ssl_Have1stHandshakeLock(ss) \
1416 (PZ_InMonitor((ss)->firstHandshakeLock))
1417
1418 /* ssl3HandshakeLock -> xmitBufLock */
1419 #define ssl_GetSSL3HandshakeLock(ss) \
1420 { if (!ss->opt.noLocks) { \
1421 PORT_Assert(!ssl_HaveXmitBufLock(ss)); \
1422 PZ_EnterMonitor((ss)->ssl3HandshakeLock); \
1423 } }
1424 #define ssl_ReleaseSSL3HandshakeLock(ss) \
1425 { if (!ss->opt.noLocks) PZ_ExitMonitor((ss)->ssl3HandshakeLock); }
1426 #define ssl_HaveSSL3HandshakeLock(ss) \
1427 (PZ_InMonitor((ss)->ssl3HandshakeLock))
1428
1429 #define ssl_GetSpecReadLock(ss) \
1430 { if (!ss->opt.noLocks) NSSRWLock_LockRead((ss)->specLock); }
1431 #define ssl_ReleaseSpecReadLock(ss) \
1432 { if (!ss->opt.noLocks) NSSRWLock_UnlockRead((ss)->specLock); }
1433 /* NSSRWLock_HaveReadLock is not exported so there's no
1434 * ssl_HaveSpecReadLock macro. */
1435
1436 #define ssl_GetSpecWriteLock(ss) \
1437 { if (!ss->opt.noLocks) NSSRWLock_LockWrite((ss)->specLock); }
1438 #define ssl_ReleaseSpecWriteLock(ss) \
1439 { if (!ss->opt.noLocks) NSSRWLock_UnlockWrite((ss)->specLock); }
1440 #define ssl_HaveSpecWriteLock(ss) \
1441 (NSSRWLock_HaveWriteLock((ss)->specLock))
1442
1443 /* recvBufLock -> ssl3HandshakeLock -> xmitBufLock */
1444 #define ssl_GetRecvBufLock(ss) \
1445 { if (!ss->opt.noLocks) { \
1446 PORT_Assert(!ssl_HaveSSL3HandshakeLock(ss)); \
1447 PORT_Assert(!ssl_HaveXmitBufLock(ss)); \
1448 PZ_EnterMonitor((ss)->recvBufLock); \
1449 } }
1450 #define ssl_ReleaseRecvBufLock(ss) \
1451 { if (!ss->opt.noLocks) PZ_ExitMonitor( (ss)->recvBufLock); }
1452 #define ssl_HaveRecvBufLock(ss) \
1453 (PZ_InMonitor((ss)->recvBufLock))
1454
1455 /* xmitBufLock -> specLock */
1456 #define ssl_GetXmitBufLock(ss) \
1457 { if (!ss->opt.noLocks) PZ_EnterMonitor((ss)->xmitBufLock); }
1458 #define ssl_ReleaseXmitBufLock(ss) \
1459 { if (!ss->opt.noLocks) PZ_ExitMonitor( (ss)->xmitBufLock); }
1460 #define ssl_HaveXmitBufLock(ss) \
1461 (PZ_InMonitor((ss)->xmitBufLock))
1462
1463 /* Placeholder value used in version ranges when SSL 3.0 and all
1464 * versions of TLS are disabled.
1465 */
1466 #define SSL_LIBRARY_VERSION_NONE 0
1467
1468 /* SSL_LIBRARY_VERSION_MAX_SUPPORTED is the maximum version that this version
1469 * of libssl supports. Applications should use SSL_VersionRangeGetSupported at
1470 * runtime to determine which versions are supported by the version of libssl
1471 * in use.
1472 */
1473 #define SSL_LIBRARY_VERSION_MAX_SUPPORTED SSL_LIBRARY_VERSION_TLS_1_1
1474
1475 /* Rename this macro SSL_ALL_VERSIONS_DISABLED when SSL 2.0 is removed. */
1476 #define SSL3_ALL_VERSIONS_DISABLED(vrange) \
1477 ((vrange)->min == SSL_LIBRARY_VERSION_NONE)
1478
1479 extern PRBool ssl3_VersionIsSupported(SSLProtocolVariant protocolVariant,
1480 SSL3ProtocolVersion version);
1481
1482 extern SECStatus ssl3_KeyAndMacDeriveBypass(ssl3CipherSpec * pwSpec,
1483 const unsigned char * cr, const unsigned char * sr,
1484 PRBool isTLS, PRBool isExport);
1485 extern SECStatus ssl3_MasterKeyDeriveBypass( ssl3CipherSpec * pwSpec,
1486 const unsigned char * cr, const unsigned char * sr,
1487 const SECItem * pms, PRBool isTLS, PRBool isRSA);
1488
1489 /* These functions are called from secnav, even though they're "private". */
1490
1491 extern int ssl2_SendErrorMessage(struct sslSocketStr *ss, int error);
1492 extern sslSocket *ssl_FindSocket(PRFileDesc *fd);
1493 extern void ssl_FreeSocket(struct sslSocketStr *ssl);
1494 extern SECStatus SSL3_SendAlert(sslSocket *ss, SSL3AlertLevel level,
1495 SSL3AlertDescription desc);
1496 extern SECStatus ssl3_DecodeError(sslSocket *ss);
1497
1498 extern SECStatus ssl3_RestartHandshakeAfterCertReq(sslSocket * ss,
1499 CERTCertificate * cert,
1500 SECKEYPrivateKey * key,
1501 CERTCertificateList *certChain);
1502
1503 extern SECStatus ssl3_RestartHandshakeAfterChannelIDReq(
1504 sslSocket *ss,
1505 SECKEYPublicKey *channelIDPub,
1506 SECKEYPrivateKey *channelID);
1507
1508 extern SECStatus ssl3_AuthCertificateComplete(sslSocket *ss, PRErrorCode error);
1509
1510 /*
1511 * for dealing with SSL 3.0 clients sending SSL 2.0 format hellos
1512 */
1513 extern SECStatus ssl3_HandleV2ClientHello(
1514 sslSocket *ss, unsigned char *buffer, int length);
1515 extern SECStatus ssl3_StartHandshakeHash(
1516 sslSocket *ss, unsigned char *buf, int length);
1517
1518 /*
1519 * SSL3 specific routines
1520 */
1521 SECStatus ssl3_SendClientHello(sslSocket *ss, PRBool resending);
1522
1523 /*
1524 * input into the SSL3 machinery from the actualy network reading code
1525 */
1526 SECStatus ssl3_HandleRecord(
1527 sslSocket *ss, SSL3Ciphertext *cipher, sslBuffer *out);
1528
1529 int ssl3_GatherAppDataRecord(sslSocket *ss, int flags);
1530 int ssl3_GatherCompleteHandshake(sslSocket *ss, int flags);
1531 /*
1532 * When talking to export clients or using export cipher suites, servers
1533 * with public RSA keys larger than 512 bits need to use a 512-bit public
1534 * key, signed by the larger key. The smaller key is a "step down" key.
1535 * Generate that key pair and keep it around.
1536 */
1537 extern SECStatus ssl3_CreateRSAStepDownKeys(sslSocket *ss);
1538
1539 #ifdef NSS_ENABLE_ECC
1540 extern void ssl3_FilterECCipherSuitesByServerCerts(sslSocket *ss);
1541 extern PRBool ssl3_IsECCEnabled(sslSocket *ss);
1542 extern SECStatus ssl3_DisableECCSuites(sslSocket * ss,
1543 const ssl3CipherSuite * suite);
1544
1545 /* Macro for finding a curve equivalent in strength to RSA key's */
1546 #define SSL_RSASTRENGTH_TO_ECSTRENGTH(s) \
1547 ((s <= 1024) ? 160 \
1548 : ((s <= 2048) ? 224 \
1549 : ((s <= 3072) ? 256 \
1550 : ((s <= 7168) ? 384 : 521 ) ) ) )
1551
1552 /* Types and names of elliptic curves used in TLS */
1553 typedef enum { ec_type_explicitPrime = 1,
1554 ec_type_explicitChar2Curve = 2,
1555 ec_type_named
1556 } ECType;
1557
1558 typedef enum { ec_noName = 0,
1559 ec_sect163k1 = 1,
1560 ec_sect163r1 = 2,
1561 ec_sect163r2 = 3,
1562 ec_sect193r1 = 4,
1563 ec_sect193r2 = 5,
1564 ec_sect233k1 = 6,
1565 ec_sect233r1 = 7,
1566 ec_sect239k1 = 8,
1567 ec_sect283k1 = 9,
1568 ec_sect283r1 = 10,
1569 ec_sect409k1 = 11,
1570 ec_sect409r1 = 12,
1571 ec_sect571k1 = 13,
1572 ec_sect571r1 = 14,
1573 ec_secp160k1 = 15,
1574 ec_secp160r1 = 16,
1575 ec_secp160r2 = 17,
1576 ec_secp192k1 = 18,
1577 ec_secp192r1 = 19,
1578 ec_secp224k1 = 20,
1579 ec_secp224r1 = 21,
1580 ec_secp256k1 = 22,
1581 ec_secp256r1 = 23,
1582 ec_secp384r1 = 24,
1583 ec_secp521r1 = 25,
1584 ec_pastLastName
1585 } ECName;
1586
1587 extern SECStatus ssl3_ECName2Params(PRArenaPool *arena, ECName curve,
1588 SECKEYECParams *params);
1589 ECName ssl3_GetCurveWithECKeyStrength(PRUint32 curvemsk, int requiredECCbits);
1590
1591
1592 #endif /* NSS_ENABLE_ECC */
1593
1594 extern SECStatus ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool on);
1595 extern SECStatus ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *on);
1596 extern SECStatus ssl2_CipherPrefSetDefault(PRInt32 which, PRBool enabled);
1597 extern SECStatus ssl2_CipherPrefGetDefault(PRInt32 which, PRBool *enabled);
1598
1599 extern SECStatus ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool on);
1600 extern SECStatus ssl3_CipherPrefGet(sslSocket *ss, ssl3CipherSuite which, PRBool *on);
1601 extern SECStatus ssl2_CipherPrefSet(sslSocket *ss, PRInt32 which, PRBool enabled);
1602 extern SECStatus ssl2_CipherPrefGet(sslSocket *ss, PRInt32 which, PRBool *enabled);
1603
1604 extern SECStatus ssl3_SetPolicy(ssl3CipherSuite which, PRInt32 policy);
1605 extern SECStatus ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *policy);
1606 extern SECStatus ssl2_SetPolicy(PRInt32 which, PRInt32 policy);
1607 extern SECStatus ssl2_GetPolicy(PRInt32 which, PRInt32 *policy);
1608
1609 extern void ssl2_InitSocketPolicy(sslSocket *ss);
1610 extern void ssl3_InitSocketPolicy(sslSocket *ss);
1611
1612 extern SECStatus ssl3_ConstructV2CipherSpecsHack(sslSocket *ss,
1613 unsigned char *cs, int *size);
1614
1615 extern SECStatus ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache);
1616 extern SECStatus ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b,
1617 PRUint32 length);
1618
1619 extern void ssl3_DestroySSL3Info(sslSocket *ss);
1620
1621 extern SECStatus ssl3_NegotiateVersion(sslSocket *ss,
1622 SSL3ProtocolVersion peerVersion,
1623 PRBool allowLargerPeerVersion);
1624
1625 extern SECStatus ssl_GetPeerInfo(sslSocket *ss);
1626
1627 #ifdef NSS_ENABLE_ECC
1628 /* ECDH functions */
1629 extern SECStatus ssl3_SendECDHClientKeyExchange(sslSocket * ss,
1630 SECKEYPublicKey * svrPubKey);
1631 extern SECStatus ssl3_HandleECDHServerKeyExchange(sslSocket *ss,
1632 SSL3Opaque *b, PRUint32 length);
1633 extern SECStatus ssl3_HandleECDHClientKeyExchange(sslSocket *ss,
1634 SSL3Opaque *b, PRUint32 length,
1635 SECKEYPublicKey *srvrPubKey,
1636 SECKEYPrivateKey *srvrPrivKey);
1637 extern SECStatus ssl3_SendECDHServerKeyExchange(sslSocket *ss);
1638 #endif
1639
1640 extern SECStatus ssl3_ComputeCommonKeyHash(PRUint8 * hashBuf,
1641 unsigned int bufLen, SSL3Hashes *hashes,
1642 PRBool bypassPKCS11);
1643 extern void ssl3_DestroyCipherSpec(ssl3CipherSpec *spec, PRBool freeSrvName);
1644 extern SECStatus ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms);
1645 extern SECStatus ssl3_AppendHandshake(sslSocket *ss, const void *void_src,
1646 PRInt32 bytes);
1647 extern SECStatus ssl3_AppendHandshakeHeader(sslSocket *ss,
1648 SSL3HandshakeType t, PRUint32 length);
1649 extern SECStatus ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num,
1650 PRInt32 lenSize);
1651 extern SECStatus ssl3_AppendHandshakeVariable( sslSocket *ss,
1652 const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize);
1653 extern SECStatus ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRInt32 bytes,
1654 SSL3Opaque **b, PRUint32 *length);
1655 extern PRInt32 ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRInt32 bytes,
1656 SSL3Opaque **b, PRUint32 *length);
1657 extern SECStatus ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i,
1658 PRInt32 bytes, SSL3Opaque **b, PRUint32 *length);
1659 extern SECStatus ssl3_SignHashes(SSL3Hashes *hash, SECKEYPrivateKey *key,
1660 SECItem *buf, PRBool isTLS);
1661 extern SECStatus ssl3_VerifySignedHashes(SSL3Hashes *hash,
1662 CERTCertificate *cert, SECItem *buf, PRBool isTLS,
1663 void *pwArg);
1664 extern SECStatus ssl3_CacheWrappedMasterSecret(sslSocket *ss,
1665 sslSessionID *sid, ssl3CipherSpec *spec,
1666 SSL3KEAType effectiveExchKeyType);
1667
1668 /* Functions that handle ClientHello and ServerHello extensions. */
1669 extern SECStatus ssl3_HandleServerNameXtn(sslSocket * ss,
1670 PRUint16 ex_type, SECItem *data);
1671 extern SECStatus ssl3_HandleSupportedCurvesXtn(sslSocket * ss,
1672 PRUint16 ex_type, SECItem *data);
1673 extern SECStatus ssl3_HandleSupportedPointFormatsXtn(sslSocket * ss,
1674 PRUint16 ex_type, SECItem *data);
1675 extern SECStatus ssl3_ClientHandleSessionTicketXtn(sslSocket *ss,
1676 PRUint16 ex_type, SECItem *data);
1677 extern SECStatus ssl3_ClientHandleStatusRequestXtn(sslSocket *ss,
1678 PRUint16 ex_type, SECItem *data);
1679 extern SECStatus ssl3_ServerHandleSessionTicketXtn(sslSocket *ss,
1680 PRUint16 ex_type, SECItem *data);
1681
1682 /* ClientHello and ServerHello extension senders.
1683 * Note that not all extension senders are exposed here; only those that
1684 * that need exposure.
1685 */
1686 extern PRInt32 ssl3_SendSessionTicketXtn(sslSocket *ss, PRBool append,
1687 PRUint32 maxBytes);
1688 extern PRInt32 ssl3_ClientSendStatusRequestXtn(sslSocket *ss, PRBool append,
1689 PRUint32 maxBytes);
1690
1691 /* ClientHello and ServerHello extension senders.
1692 * The code is in ssl3ext.c.
1693 */
1694 extern PRInt32 ssl3_SendServerNameXtn(sslSocket *ss, PRBool append,
1695 PRUint32 maxBytes);
1696
1697 /* Assigns new cert, cert chain and keys to ss->serverCerts
1698 * struct. If certChain is NULL, tries to find one. Aborts if
1699 * fails to do so. If cert and keyPair are NULL - unconfigures
1700 * sslSocket of kea type.*/
1701 extern SECStatus ssl_ConfigSecureServer(sslSocket *ss, CERTCertificate *cert,
1702 const CERTCertificateList *certChain,
1703 ssl3KeyPair *keyPair, SSLKEAType kea);
1704
1705 #ifdef NSS_ENABLE_ECC
1706 extern PRInt32 ssl3_SendSupportedCurvesXtn(sslSocket *ss,
1707 PRBool append, PRUint32 maxBytes);
1708 extern PRInt32 ssl3_SendSupportedPointFormatsXtn(sslSocket *ss,
1709 PRBool append, PRUint32 maxBytes);
1710 #endif
1711
1712 /* call the registered extension handlers. */
1713 extern SECStatus ssl3_HandleHelloExtensions(sslSocket *ss,
1714 SSL3Opaque **b, PRUint32 *length);
1715
1716 /* Hello Extension related routines. */
1717 extern PRBool ssl3_ExtensionNegotiated(sslSocket *ss, PRUint16 ex_type);
1718 extern SECStatus ssl3_SetSIDSessionTicket(sslSessionID *sid,
1719 NewSessionTicket *session_ticket);
1720 extern SECStatus ssl3_SendNewSessionTicket(sslSocket *ss);
1721 extern PRBool ssl_GetSessionTicketKeys(unsigned char *keyName,
1722 unsigned char *encKey, unsigned char *macKey);
1723 extern PRBool ssl_GetSessionTicketKeysPKCS11(SECKEYPrivateKey *svrPrivKey,
1724 SECKEYPublicKey *svrPubKey, void *pwArg,
1725 unsigned char *keyName, PK11SymKey **aesKey,
1726 PK11SymKey **macKey);
1727
1728 /* Tell clients to consider tickets valid for this long. */
1729 #define TLS_EX_SESS_TICKET_LIFETIME_HINT (2 * 24 * 60 * 60) /* 2 days */
1730 #define TLS_EX_SESS_TICKET_VERSION (0x0100)
1731
1732 extern SECStatus ssl3_ValidateNextProtoNego(const unsigned char* data,
1733 unsigned int length);
1734
1735 extern SECStatus ssl3_GetTLSUniqueChannelBinding(sslSocket *ss,
1736 unsigned char *out,
1737 unsigned int *outLen,
1738 unsigned int outLenMax);
1739
1740 /* Construct a new NSPR socket for the app to use */
1741 extern PRFileDesc *ssl_NewPRSocket(sslSocket *ss, PRFileDesc *fd);
1742 extern void ssl_FreePRSocket(PRFileDesc *fd);
1743
1744 /* Internal config function so SSL2 can initialize the present state of
1745 * various ciphers */
1746 extern int ssl3_config_match_init(sslSocket *);
1747
1748 /* Create a new ref counted key pair object from two keys. */
1749 extern ssl3KeyPair * ssl3_NewKeyPair( SECKEYPrivateKey * privKey,
1750 SECKEYPublicKey * pubKey);
1751
1752 /* get a new reference (bump ref count) to an ssl3KeyPair. */
1753 extern ssl3KeyPair * ssl3_GetKeyPairRef(ssl3KeyPair * keyPair);
1754
1755 /* Decrement keypair's ref count and free if zero. */
1756 extern void ssl3_FreeKeyPair(ssl3KeyPair * keyPair);
1757
1758 /* calls for accessing wrapping keys across processes. */
1759 extern PRBool
1760 ssl_GetWrappingKey( PRInt32 symWrapMechIndex,
1761 SSL3KEAType exchKeyType,
1762 SSLWrappedSymWrappingKey *wswk);
1763
1764 /* The caller passes in the new value it wants
1765 * to set. This code tests the wrapped sym key entry in the file on disk.
1766 * If it is uninitialized, this function writes the caller's value into
1767 * the disk entry, and returns false.
1768 * Otherwise, it overwrites the caller's wswk with the value obtained from
1769 * the disk, and returns PR_TRUE.
1770 * This is all done while holding the locks/semaphores necessary to make
1771 * the operation atomic.
1772 */
1773 extern PRBool
1774 ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk);
1775
1776 /* get rid of the symmetric wrapping key references. */
1777 extern SECStatus SSL3_ShutdownServerCache(void);
1778
1779 extern SECStatus ssl_InitSymWrapKeysLock(void);
1780
1781 extern SECStatus ssl_FreeSymWrapKeysLock(void);
1782
1783 extern SECStatus ssl_InitSessionCacheLocks(PRBool lazyInit);
1784
1785 extern SECStatus ssl_FreeSessionCacheLocks(void);
1786
1787 /***************** platform client auth ****************/
1788
1789 #ifdef NSS_PLATFORM_CLIENT_AUTH
1790 // Releases the platform key.
1791 extern void ssl_FreePlatformKey(PlatformKey key);
1792
1793 // Implement the client CertificateVerify message for SSL3/TLS1.0
1794 extern SECStatus ssl3_PlatformSignHashes(SSL3Hashes *hash,
1795 PlatformKey key, SECItem *buf,
1796 PRBool isTLS);
1797
1798 // Converts a CERTCertList* (A collection of CERTCertificates) into a
1799 // CERTCertificateList* (A collection of SECItems), or returns NULL if
1800 // it cannot be converted.
1801 // This is to allow the platform-supplied chain to be created with purely
1802 // public API functions, using the preferred CERTCertList mutators, rather
1803 // pushing this hack to clients.
1804 extern CERTCertificateList* hack_NewCertificateListFromCertList(
1805 CERTCertList* list);
1806 #endif /* NSS_PLATFORM_CLIENT_AUTH */
1807
1808 /**************** DTLS-specific functions **************/
1809 extern void dtls_FreeQueuedMessage(DTLSQueuedMessage *msg);
1810 extern void dtls_FreeQueuedMessages(PRCList *lst);
1811 extern void dtls_FreeHandshakeMessages(PRCList *lst);
1812
1813 extern SECStatus dtls_HandleHandshake(sslSocket *ss, sslBuffer *origBuf);
1814 extern SECStatus dtls_HandleHelloVerifyRequest(sslSocket *ss,
1815 SSL3Opaque *b, PRUint32 length);
1816 extern SECStatus dtls_StageHandshakeMessage(sslSocket *ss);
1817 extern SECStatus dtls_QueueMessage(sslSocket *ss, SSL3ContentType type,
1818 const SSL3Opaque *pIn, PRInt32 nIn);
1819 extern SECStatus dtls_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags);
1820 extern SECStatus dtls_CompressMACEncryptRecord(sslSocket *ss,
1821 DTLSEpoch epoch,
1822 PRBool use_epoch,
1823 SSL3ContentType type,
1824 const SSL3Opaque *pIn,
1825 PRUint32 contentLen,
1826 sslBuffer *wrBuf);
1827 SECStatus ssl3_DisableNonDTLSSuites(sslSocket * ss);
1828 extern SECStatus dtls_StartTimer(sslSocket *ss, DTLSTimerCb cb);
1829 extern SECStatus dtls_RestartTimer(sslSocket *ss, PRBool backoff,
1830 DTLSTimerCb cb);
1831 extern void dtls_CheckTimer(sslSocket *ss);
1832 extern void dtls_CancelTimer(sslSocket *ss);
1833 extern void dtls_FinishedTimerCb(sslSocket *ss);
1834 extern void dtls_SetMTU(sslSocket *ss, PRUint16 advertised);
1835 extern void dtls_InitRecvdRecords(DTLSRecvdRecords *records);
1836 extern int dtls_RecordGetRecvd(DTLSRecvdRecords *records, PRUint64 seq);
1837 extern void dtls_RecordSetRecvd(DTLSRecvdRecords *records, PRUint64 seq);
1838 extern void dtls_RehandshakeCleanup(sslSocket *ss);
1839 extern SSL3ProtocolVersion
1840 dtls_TLSVersionToDTLSVersion(SSL3ProtocolVersion tlsv);
1841 extern SSL3ProtocolVersion
1842 dtls_DTLSVersionToTLSVersion(SSL3ProtocolVersion dtlsv);
1843
1844 /********************** misc calls *********************/
1845
1846 extern int ssl_MapLowLevelError(int hiLevelError);
1847
1848 extern PRUint32 ssl_Time(void);
1849
1850 extern void SSL_AtomicIncrementLong(long * x);
1851
1852 SECStatus SSL_DisableDefaultExportCipherSuites(void);
1853 SECStatus SSL_DisableExportCipherSuites(PRFileDesc * fd);
1854 PRBool SSL_IsExportCipherSuite(PRUint16 cipherSuite);
1855
1856 extern SECStatus
1857 ssl3_TLSPRFWithMasterSecret(ssl3CipherSpec *spec,
1858 const char *label, unsigned int labelLen,
1859 const unsigned char *val, unsigned int valLen,
1860 unsigned char *out, unsigned int outLen);
1861
1862 #ifdef TRACE
1863 #define SSL_TRACE(msg) ssl_Trace msg
1864 #else
1865 #define SSL_TRACE(msg)
1866 #endif
1867
1868 void ssl_Trace(const char *format, ...);
1869
1870 SEC_END_PROTOS
1871
1872 #if defined(XP_UNIX) || defined(XP_OS2) || defined(XP_BEOS)
1873 #define SSL_GETPID getpid
1874 #elif defined(_WIN32_WCE)
1875 #define SSL_GETPID GetCurrentProcessId
1876 #elif defined(WIN32)
1877 extern int __cdecl _getpid(void);
1878 #define SSL_GETPID _getpid
1879 #else
1880 #define SSL_GETPID() 0
1881 #endif
1882
1883 #endif /* __sslimpl_h_ */