lib/libtls/tls_internal.h

   1 /* $OpenBSD: tls_internal.h,v 1.65 2017/09/20 17:05:17 jsing Exp $ */
   2 /*
   3  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
   4  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #ifndef HEADER_TLS_INTERNAL_H
  20 #define HEADER_TLS_INTERNAL_H
  21
  22 #include <arpa/inet.h>
  23 #include <netinet/in.h>
  24
  25 #include <openssl/ssl.h>
  26
  27 __BEGIN_HIDDEN_DECLS
  28
  29 #define _PATH_SSL_CA_FILE "/etc/ssl/cert.pem"
  30
  31 #define TLS_CIPHERS_DEFAULT     "TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE"
  32 #define TLS_CIPHERS_COMPAT      "HIGH:!aNULL"
  33 #define TLS_CIPHERS_LEGACY      "HIGH:MEDIUM:!aNULL"
  34 #define TLS_CIPHERS_ALL         "ALL:!aNULL:!eNULL"
  35
  36 #define TLS_ECDHE_CURVES        "X25519,P-256,P-384"
  37
  38 union tls_addr {
  39         struct in_addr ip4;
  40         struct in6_addr ip6;
  41 };
  42
  43 struct tls_error {
  44         char *msg;
  45         int num;
  46         int tls;
  47 };
  48
  49 struct tls_keypair {
  50         struct tls_keypair *next;
  51
  52         char *cert_mem;
  53         size_t cert_len;
  54         char *key_mem;
  55         size_t key_len;
  56         char *ocsp_staple;
  57         size_t ocsp_staple_len;
  58         char *pubkey_hash;
  59 };
  60
  61 #define TLS_MIN_SESSION_TIMEOUT (4)
  62 #define TLS_MAX_SESSION_TIMEOUT (24 * 60 * 60)
  63
  64 #define TLS_NUM_TICKETS                         4
  65 #define TLS_TICKET_NAME_SIZE                    16
  66 #define TLS_TICKET_AES_SIZE                     32
  67 #define TLS_TICKET_HMAC_SIZE                    16
  68
  69 struct tls_ticket_key {
  70         /* The key_name must be 16 bytes according to -lssl */
  71         unsigned char   key_name[TLS_TICKET_NAME_SIZE];
  72         unsigned char   aes_key[TLS_TICKET_AES_SIZE];
  73         unsigned char   hmac_key[TLS_TICKET_HMAC_SIZE];
  74         time_t          time;
  75 };
  76
  77 struct tls_config {
  78         struct tls_error error;
  79
  80         int refcount;
  81
  82         char *alpn;
  83         size_t alpn_len;
  84         const char *ca_path;
  85         char *ca_mem;
  86         size_t ca_len;
  87         const char *ciphers;
  88         int ciphers_server;
  89         char *crl_mem;
  90         size_t crl_len;
  91         int dheparams;
  92         int *ecdhecurves;
  93         size_t ecdhecurves_len;
  94         struct tls_keypair *keypair;
  95         int ocsp_require_stapling;
  96         uint32_t protocols;
  97         unsigned char session_id[TLS_MAX_SESSION_ID_LENGTH];
  98         int session_lifetime;
  99         struct tls_ticket_key ticket_keys[TLS_NUM_TICKETS];
 100         uint32_t ticket_keyrev;
 101         int ticket_autorekey;
 102         int verify_cert;
 103         int verify_client;
 104         int verify_depth;
 105         int verify_name;
 106         int verify_time;
 107         int skip_private_key_check;
 108 };
 109
 110 struct tls_conninfo {
 111         char *alpn;
 112         char *cipher;
 113         char *servername;
 114         char *version;
 115
 116         char *hash;
 117         char *issuer;
 118         char *subject;
 119
 120         uint8_t *peer_cert;
 121         size_t peer_cert_len;
 122
 123         time_t notbefore;
 124         time_t notafter;
 125 };
 126
 127 #define TLS_CLIENT              (1 << 0)
 128 #define TLS_SERVER              (1 << 1)
 129 #define TLS_SERVER_CONN         (1 << 2)
 130
 131 #define TLS_EOF_NO_CLOSE_NOTIFY (1 << 0)
 132 #define TLS_CONNECTED           (1 << 1)
 133 #define TLS_HANDSHAKE_COMPLETE  (1 << 2)
 134 #define TLS_SSL_NEEDS_SHUTDOWN  (1 << 3)
 135
 136 struct tls_ocsp_result {
 137         const char *result_msg;
 138         int response_status;
 139         int cert_status;
 140         int crl_reason;
 141         time_t this_update;
 142         time_t next_update;
 143         time_t revocation_time;
 144 };
 145
 146 struct tls_ocsp {
 147         /* responder location */
 148         char *ocsp_url;
 149
 150         /* cert data, this struct does not own these */
 151         X509 *main_cert;
 152         STACK_OF(X509) *extra_certs;
 153
 154         struct tls_ocsp_result *ocsp_result;
 155 };
 156
 157 struct tls_sni_ctx {
 158         struct tls_sni_ctx *next;
 159
 160         struct tls_keypair *keypair;
 161
 162         SSL_CTX *ssl_ctx;
 163         X509 *ssl_cert;
 164 };
 165
 166 struct tls {
 167         struct tls_config *config;
 168         struct tls_keypair *keypair;
 169
 170         struct tls_error error;
 171
 172         uint32_t flags;
 173         uint32_t state;
 174
 175         char *servername;
 176         int socket;
 177
 178         SSL *ssl_conn;
 179         SSL_CTX *ssl_ctx;
 180
 181         struct tls_sni_ctx *sni_ctx;
 182
 183         X509 *ssl_peer_cert;
 184         STACK_OF(X509) *ssl_peer_chain;
 185
 186         struct tls_conninfo *conninfo;
 187
 188         struct tls_ocsp *ocsp;
 189
 190         tls_read_cb read_cb;
 191         tls_write_cb write_cb;
 192         void *cb_arg;
 193 };
 194
 195 struct tls_sni_ctx *tls_sni_ctx_new(void);
 196 void tls_sni_ctx_free(struct tls_sni_ctx *sni_ctx);
 197
 198 struct tls *tls_new(void);
 199 struct tls *tls_server_conn(struct tls *ctx);
 200
 201 int tls_check_name(struct tls *ctx, X509 *cert, const char *servername,
 202     int *match);
 203 int tls_configure_server(struct tls *ctx);
 204
 205 int tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx);
 206 int tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
 207     struct tls_keypair *keypair, int required);
 208 int tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify);
 209
 210 int tls_handshake_client(struct tls *ctx);
 211 int tls_handshake_server(struct tls *ctx);
 212
 213 int tls_config_load_file(struct tls_error *error, const char *filetype,
 214     const char *filename, char **buf, size_t *len);
 215 int tls_config_ticket_autorekey(struct tls_config *config);
 216 int tls_host_port(const char *hostport, char **host, char **port);
 217
 218 int tls_set_cbs(struct tls *ctx,
 219     tls_read_cb read_cb, tls_write_cb write_cb, void *cb_arg);
 220
 221 void tls_error_clear(struct tls_error *error);
 222 int tls_error_set(struct tls_error *error, const char *fmt, ...)
 223     __attribute__((__format__ (printf, 2, 3)))
 224     __attribute__((__nonnull__ (2)));
 225 int tls_error_setx(struct tls_error *error, const char *fmt, ...)
 226     __attribute__((__format__ (printf, 2, 3)))
 227     __attribute__((__nonnull__ (2)));
 228 int tls_config_set_error(struct tls_config *cfg, const char *fmt, ...)
 229     __attribute__((__format__ (printf, 2, 3)))
 230     __attribute__((__nonnull__ (2)));
 231 int tls_config_set_errorx(struct tls_config *cfg, const char *fmt, ...)
 232     __attribute__((__format__ (printf, 2, 3)))
 233     __attribute__((__nonnull__ (2)));
 234 int tls_set_error(struct tls *ctx, const char *fmt, ...)
 235     __attribute__((__format__ (printf, 2, 3)))
 236     __attribute__((__nonnull__ (2)));
 237 int tls_set_errorx(struct tls *ctx, const char *fmt, ...)
 238     __attribute__((__format__ (printf, 2, 3)))
 239     __attribute__((__nonnull__ (2)));
 240 int tls_set_ssl_errorx(struct tls *ctx, const char *fmt, ...)
 241     __attribute__((__format__ (printf, 2, 3)))
 242     __attribute__((__nonnull__ (2)));
 243
 244 int tls_ssl_error(struct tls *ctx, SSL *ssl_conn, int ssl_ret,
 245     const char *prefix);
 246
 247 int tls_conninfo_populate(struct tls *ctx);
 248 void tls_conninfo_free(struct tls_conninfo *conninfo);
 249
 250 int tls_ocsp_verify_cb(SSL *ssl, void *arg);
 251 int tls_ocsp_stapling_cb(SSL *ssl, void *arg);
 252 void tls_ocsp_free(struct tls_ocsp *ctx);
 253 struct tls_ocsp *tls_ocsp_setup_from_peer(struct tls *ctx);
 254 int tls_hex_string(const unsigned char *_in, size_t _inlen, char **_out,
 255     size_t *_outlen);
 256 int tls_cert_hash(X509 *_cert, char **_hash);
 257
 258 int tls_password_cb(char *_buf, int _size, int _rwflag, void *_u);
 259
 260 __END_HIDDEN_DECLS
 261
 262 /* XXX this function is not fully hidden so relayd can use it */
 263 void tls_config_skip_private_key_check(struct tls_config *config);
 264
 265 #endif /* HEADER_TLS_INTERNAL_H */