/home/dko/projects/mobilec/trunk/src/security/xyssl-0.7/include/xyssl/ssl.h

Go to the documentation of this file.

#ifndef _SSL_H
#define _SSL_H

#ifdef __cplusplus
extern "C" {
#endif

#include "x509.h"
#include "rsa.h"
#include "dhm.h"
#include "md5.h"
#include "sha1.h"

#define ERR_SSL_FEATURE_UNAVAILABLE             0x1000
#define ERR_SSL_INVALID_MAC                     0x1800
#define ERR_SSL_INVALID_RECORD                  0x2000
#define ERR_SSL_INVALID_MODULUS_SIZE            0x2800
#define ERR_SSL_UNKNOWN_CIPHER                  0x3000
#define ERR_SSL_NO_CIPHER_CHOSEN                0x3800
#define ERR_SSL_NO_SESSION_FOUND                0x4000
#define ERR_SSL_NO_CLIENT_CERTIFICATE           0x4800
#define ERR_SSL_CERTIFICATE_TOO_LARGE           0x5000
#define ERR_SSL_CERTIFICATE_REQUIRED            0x5800
#define ERR_SSL_PRIVATE_KEY_REQUIRED            0x6000
#define ERR_SSL_CA_CHAIN_REQUIRED               0x6800
#define ERR_SSL_UNEXPECTED_MESSAGE              0x7000
#define ERR_SSL_FATAL_ALERT_MESSAGE             0x7800
#define ERR_SSL_PEER_VERIFY_FAILED              0x8000
#define ERR_SSL_PEER_CLOSE_NOTIFY               0x8800
#define ERR_SSL_BAD_HS_CLIENT_HELLO             0x9000
#define ERR_SSL_BAD_HS_SERVER_HELLO             0x9800
#define ERR_SSL_BAD_HS_CERTIFICATE              0xA000
#define ERR_SSL_BAD_HS_CERTIFICATE_REQUEST      0xA800
#define ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE      0xB000
#define ERR_SSL_BAD_HS_SERVER_HELLO_DONE        0xB800
#define ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE      0xC000
#define ERR_SSL_BAD_HS_CERTIFICATE_VERIFY       0xC800
#define ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC       0xD000
#define ERR_SSL_BAD_HS_FINISHED                 0xD800

/*
 * Various constants
 */
#define SSLV3_MAJOR_VERSION             3
#define SSLV3_MINOR_VERSION             0
#define TLS10_MINOR_VERSION             1
#define TLS11_MINOR_VERSION             2

#define SSL_IS_CLIENT                   0
#define SSL_IS_SERVER                   1
#define SSL_COMPRESS_NULL               0

#define SSL_VERIFY_NONE                 0
#define SSL_VERIFY_OPTIONAL             1
#define SSL_VERIFY_REQUIRED             2

#define SSL_SESSION_TBL_LEN          8192
#define SSL_MAX_CONTENT_LEN         16384
#define SSL_EXPIRATION_TIME         86400

/*
 * Allow an extra 512 bytes for the record header
 * and encryption overhead (counter + MAC + padding).
 */
#define SSL_BUFFER_LEN (SSL_MAX_CONTENT_LEN + 512)

/*
 * Supported ciphersuites
 */
#define SSL3_RSA_RC4_128_MD5            4
#define SSL3_RSA_RC4_128_SHA            5
#define SSL3_RSA_DES_168_SHA           10
#define SSL3_EDH_RSA_DES_168_SHA       22
#define TLS1_RSA_AES_256_SHA           53
#define TLS1_EDH_RSA_AES_256_SHA       57

extern int ssl_default_ciphers[];

/*
 * Message, alert and handshake types
 */
#define SSL_MSG_CHANGE_CIPHER_SPEC     20
#define SSL_MSG_ALERT                  21
#define SSL_MSG_HANDSHAKE              22
#define SSL_MSG_APPLICATION_DATA       23

#define SSL_ALERT_CLOSE_NOTIFY          0
#define SSL_ALERT_WARNING               1
#define SSL_ALERT_FATAL                 2
#define SSL_ALERT_NO_CERTIFICATE       41

#define SSL_HS_HELLO_REQUEST            0
#define SSL_HS_CLIENT_HELLO             1
#define SSL_HS_SERVER_HELLO             2
#define SSL_HS_CERTIFICATE             11
#define SSL_HS_SERVER_KEY_EXCHANGE     12
#define SSL_HS_CERTIFICATE_REQUEST     13
#define SSL_HS_SERVER_HELLO_DONE       14
#define SSL_HS_CERTIFICATE_VERIFY      15
#define SSL_HS_CLIENT_KEY_EXCHANGE     16
#define SSL_HS_FINISHED                20

/*
 * SSL state machine
 */
typedef enum
{
    SSL_HELLO_REQUEST,
    SSL_CLIENT_HELLO,
    SSL_SERVER_HELLO,
    SSL_SERVER_CERTIFICATE,
    SSL_SERVER_KEY_EXCHANGE,
    SSL_CERTIFICATE_REQUEST,
    SSL_SERVER_HELLO_DONE,
    SSL_CLIENT_CERTIFICATE,
    SSL_CLIENT_KEY_EXCHANGE,
    SSL_CERTIFICATE_VERIFY,
    SSL_CLIENT_CHANGE_CIPHER_SPEC,
    SSL_CLIENT_FINISHED,
    SSL_SERVER_CHANGE_CIPHER_SPEC,
    SSL_SERVER_FINISHED,
    SSL_HANDSHAKE_OVER
}
ssl_states;

typedef struct
{
    int state;                  
    /*
     * Negotiated protocol version
     */
    int major_ver;              
    int minor_ver;              
    unsigned char max_ver[2];   
    /*
     * Record layer -- incoming data
     */
    unsigned char *in_ctr;      
    unsigned char *in_hdr;      
    unsigned char *in_msg;      
    unsigned char *in_offt;     
    int read_fd;                
    int in_msgtype;             
    int in_msglen;              
    int in_left;                
    int in_hslen;               
    int nb_zero;                
    /*
     * Record layer -- outgoing data
     */
    unsigned char *out_ctr;     
    unsigned char *out_hdr;     
    unsigned char *out_msg;     
    int write_fd;               
    int out_msgtype;            
    int out_msglen;             
    int out_left;               
    int out_uoff;               
    /*
     * PKI stuff
     */
    rsa_context *own_key;               
    x509_cert *own_cert;                
    x509_cert *ca_chain;                
    x509_cert *peer_cert;               
    char *peer_cn;                      
    int endpoint;                       
    int authmode;                       
    int client_auth;                    
    int verify_result;                  
    /*
     * Session stuff
     */
    int resumed;                        
    int sidlen;                         
    unsigned char sessid[32];           
    unsigned char *sidtable;            
    /*
     * Crypto stuff
     */
     md5_context hs_md5;                
    sha1_context hs_sha1;               
     dhm_context dhm_ctx;               
    int (*rng_f)(void *);               
    void *rng_d;                        
    int pmslen;                         
    unsigned char premaster[256];       
    unsigned char randbytes[64];        
    unsigned char master[48];           
    int *cipherlist;                    
    int cipher;                         
    int keylen;                         
    int minlen;                         
    int ctxlen;                         
    void *ctx_enc;                      
    void *ctx_dec;                      
    int ivlen;                          
    unsigned char iv_enc[16];           
    unsigned char iv_dec[16];           
    int maclen;                         
    unsigned char mac_enc[32];          
    unsigned char mac_dec[32];          
}
ssl_context;

/*
 * Internal functions (do not call directly)
 */
int ssl_client_start( ssl_context *ssl );
int ssl_server_start( ssl_context *ssl );

int ssl_derive_keys( ssl_context *ssl );
int ssl_calc_verify( ssl_context *ssl, unsigned char hash[36] );

int ssl_read_record(  ssl_context *ssl, int do_crypt );
int ssl_write_record( ssl_context *ssl, int do_crypt );
int ssl_flush_output( ssl_context *ssl );

int ssl_write_certificate( ssl_context *ssl );
int ssl_parse_certificate( ssl_context *ssl );

int ssl_write_change_cipher_spec( ssl_context *ssl );
int ssl_parse_change_cipher_spec( ssl_context *ssl );

int ssl_write_finished( ssl_context *ssl );
int ssl_parse_finished( ssl_context *ssl );

int ssl_init( ssl_context *ssl, int client_resume );

void ssl_set_endpoint( ssl_context *ssl, int endpoint );

void ssl_set_authmode( ssl_context *ssl, int authmode );

void ssl_set_rng_func( ssl_context *ssl,
                       int (*rng_f)(void *),
                       void *rng_d );

void ssl_set_io_files( ssl_context *ssl, int read_fd, int write_fd );

void ssl_set_ciphlist( ssl_context *ssl, int *ciphers );

void ssl_set_ca_chain( ssl_context *ssl, x509_cert *ca, char *cn );

void ssl_set_rsa_cert( ssl_context *ssl, x509_cert *own_cert,
                       rsa_context *own_key );

void ssl_set_sidtable( ssl_context *ssl, unsigned char *sidtable );

int ssl_set_dhm_vals( ssl_context *ssl, char *dhm_P, char *dhm_G );

int ssl_get_verify_result( ssl_context *ssl );

char *ssl_get_cipher_name( ssl_context *ssl );

int ssl_handshake( ssl_context *ssl );

int ssl_read( ssl_context *ssl, unsigned char *buf, int *len );

int ssl_write( ssl_context *ssl, unsigned char *buf, int len );

int ssl_close_notify( ssl_context *ssl );

void ssl_free( ssl_context *ssl );

#ifdef __cplusplus
}
#endif

#endif /* ssl.h */

---