ssl_tls1.h 9.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302
  1. /*
  2. * Copyright (c) 2007, Cameron Rich
  3. *
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions are met:
  8. *
  9. * * Redistributions of source code must retain the above copyright notice,
  10. * this list of conditions and the following disclaimer.
  11. * * Redistributions in binary form must reproduce the above copyright notice,
  12. * this list of conditions and the following disclaimer in the documentation
  13. * and/or other materials provided with the distribution.
  14. * * Neither the name of the axTLS project nor the names of its contributors
  15. * may be used to endorse or promote products derived from this software
  16. * without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
  22. * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  23. * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  24. * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  25. * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  26. * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  27. * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  28. * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. */
  30. /**
  31. * @file tls1.h
  32. *
  33. * @brief The definitions for the TLS library.
  34. */
  35. #ifndef HEADER_SSL_LIB_H
  36. #define HEADER_SSL_LIB_H
  37. #ifdef __cplusplus
  38. extern "C" {
  39. #endif
  40. #include "c_types.h"
  41. #include "ssl/ssl_version.h"
  42. #include "ssl/ssl_config.h"
  43. //#include "../crypto/os_int.h"
  44. #include "ssl/ssl_crypto.h"
  45. #include "ssl/ssl_crypto_misc.h"
  46. #include "lwip/tcp.h"
  47. #define SSL_PROTOCOL_MIN_VERSION 0x31 /* TLS v1.0 */
  48. #define SSL_PROTOCOL_MINOR_VERSION 0x02 /* TLS v1.1 */
  49. #define SSL_PROTOCOL_VERSION_MAX 0x32 /* TLS v1.1 */
  50. #define SSL_PROTOCOL_VERSION1_1 0x32 /* TLS v1.1 */
  51. #define SSL_RANDOM_SIZE 32
  52. #define SSL_SECRET_SIZE 48
  53. #define SSL_FINISHED_HASH_SIZE 12
  54. #define SSL_RECORD_SIZE 5
  55. #define SSL_SERVER_READ 0
  56. #define SSL_SERVER_WRITE 1
  57. #define SSL_CLIENT_READ 2
  58. #define SSL_CLIENT_WRITE 3
  59. #define SSL_HS_HDR_SIZE 4
  60. /* the flags we use while establishing a connection */
  61. #define SSL_NEED_RECORD 0x0001
  62. #define SSL_TX_ENCRYPTED 0x0002
  63. #define SSL_RX_ENCRYPTED 0x0004
  64. #define SSL_SESSION_RESUME 0x0008
  65. #define SSL_IS_CLIENT 0x0010
  66. #define SSL_HAS_CERT_REQ 0x0020
  67. #define SSL_SENT_CLOSE_NOTIFY 0x0040
  68. /* some macros to muck around with flag bits */
  69. #define SET_SSL_FLAG(A) (ssl->flag |= A)
  70. #define CLR_SSL_FLAG(A) (ssl->flag &= ~A)
  71. #define IS_SET_SSL_FLAG(A) (ssl->flag & A)
  72. #define MAX_KEY_BYTE_SIZE 512 /* for a 4096 bit key */
  73. #define RT_MAX_PLAIN_LENGTH 4096
  74. #define RT_EXTRA 1024
  75. #define BM_RECORD_OFFSET 5
  76. #ifdef CONFIG_SSL_SKELETON_MODE
  77. #define NUM_PROTOCOLS 1
  78. #else
  79. #define NUM_PROTOCOLS 4
  80. #endif
  81. #define PARANOIA_CHECK(A, B) if (A < B) { \
  82. ret = SSL_ERROR_INVALID_HANDSHAKE; goto error; }
  83. /* protocol types */
  84. enum
  85. {
  86. PT_CHANGE_CIPHER_SPEC = 20,
  87. PT_ALERT_PROTOCOL,
  88. PT_HANDSHAKE_PROTOCOL,
  89. PT_APP_PROTOCOL_DATA
  90. };
  91. /* handshaking types */
  92. enum
  93. {
  94. HS_HELLO_REQUEST,
  95. HS_CLIENT_HELLO,
  96. HS_SERVER_HELLO,
  97. HS_CERTIFICATE = 11,
  98. HS_SERVER_KEY_XCHG,
  99. HS_CERT_REQ,
  100. HS_SERVER_HELLO_DONE,
  101. HS_CERT_VERIFY,
  102. HS_CLIENT_KEY_XCHG,
  103. HS_FINISHED = 20
  104. };
  105. typedef struct
  106. {
  107. uint8_t cipher;
  108. uint8_t key_size;
  109. uint8_t iv_size;
  110. uint8_t key_block_size;
  111. uint8_t padding_size;
  112. uint8_t digest_size;
  113. hmac_func hmac;
  114. crypt_func encrypt;
  115. crypt_func decrypt;
  116. } cipher_info_t;
  117. struct _SSLObjLoader
  118. {
  119. uint8_t *buf;
  120. int len;
  121. };
  122. typedef struct _SSLObjLoader SSLObjLoader;
  123. typedef struct
  124. {
  125. time_t conn_time;
  126. uint8_t session_id[SSL_SESSION_ID_SIZE];
  127. uint8_t master_secret[SSL_SECRET_SIZE];
  128. } SSL_SESSION;
  129. typedef struct
  130. {
  131. uint8_t *buf;
  132. int size;
  133. } SSL_CERT;
  134. typedef struct
  135. {
  136. MD5_CTX md5_ctx;
  137. SHA1_CTX sha1_ctx;
  138. uint8_t final_finish_mac[SSL_FINISHED_HASH_SIZE];
  139. uint8_t *key_block;
  140. uint8_t master_secret[SSL_SECRET_SIZE];
  141. uint8_t client_random[SSL_RANDOM_SIZE]; /* client's random sequence */
  142. uint8_t server_random[SSL_RANDOM_SIZE]; /* server's random sequence */
  143. uint16_t bm_proc_index;
  144. } DISPOSABLE_CTX;
  145. struct _SSL
  146. {
  147. uint32_t flag;
  148. uint16_t need_bytes;
  149. uint16_t got_bytes;
  150. uint8_t record_type;
  151. uint8_t cipher;
  152. uint8_t sess_id_size;
  153. uint8_t version;
  154. uint8_t client_version;
  155. sint16_t next_state;
  156. sint16_t hs_status;
  157. DISPOSABLE_CTX *dc; /* temporary data which we'll get rid of soon */
  158. //int client_fd;
  159. struct tcp_pcb *SslClient_pcb;//add by ives 12.12.2013
  160. struct pbuf *ssl_pbuf;//add by ives 12.12.2013
  161. const cipher_info_t *cipher_info;
  162. void *encrypt_ctx;
  163. void *decrypt_ctx;
  164. uint8_t bm_all_data[RT_MAX_PLAIN_LENGTH+RT_EXTRA];
  165. uint8_t *bm_data;
  166. uint16_t bm_index;
  167. uint16_t bm_read_index;
  168. struct _SSL *next; /* doubly linked list */
  169. struct _SSL *prev;
  170. struct _SSL_CTX *ssl_ctx; /* back reference to a clnt/svr ctx */
  171. #ifndef CONFIG_SSL_SKELETON_MODE
  172. uint16_t session_index;
  173. SSL_SESSION *session;
  174. #endif
  175. #ifdef CONFIG_SSL_CERT_VERIFICATION
  176. X509_CTX *x509_ctx;
  177. #endif
  178. uint8_t session_id[SSL_SESSION_ID_SIZE];
  179. uint8_t client_mac[SHA1_SIZE]; /* for HMAC verification */
  180. uint8_t server_mac[SHA1_SIZE]; /* for HMAC verification */
  181. uint8_t read_sequence[8]; /* 64 bit sequence number */
  182. uint8_t write_sequence[8]; /* 64 bit sequence number */
  183. uint8_t hmac_header[SSL_RECORD_SIZE]; /* rx hmac */
  184. };
  185. typedef struct _SSL SSL;
  186. struct _SSL_CTX
  187. {
  188. uint32_t options;
  189. uint8_t chain_length;
  190. RSA_CTX *rsa_ctx;
  191. #ifdef CONFIG_SSL_CERT_VERIFICATION
  192. CA_CERT_CTX *ca_cert_ctx;
  193. #endif
  194. SSL *head;
  195. SSL *tail;
  196. SSL_CERT certs[CONFIG_SSL_MAX_CERTS];
  197. #ifndef CONFIG_SSL_SKELETON_MODE
  198. uint16_t num_sessions;
  199. SSL_SESSION **ssl_sessions;
  200. #endif
  201. #ifdef CONFIG_SSL_CTX_MUTEXING
  202. SSL_CTX_MUTEX_TYPE mutex;
  203. #endif
  204. #ifdef CONFIG_OPENSSL_COMPATIBLE
  205. void *bonus_attr;
  206. #endif
  207. };
  208. typedef struct _SSL_CTX SSL_CTX;
  209. /* backwards compatibility */
  210. typedef struct _SSL_CTX SSLCTX;
  211. extern const uint8_t ssl_prot_prefs[NUM_PROTOCOLS];
  212. SSL *ssl_new(SSL_CTX *ssl_ctx, int client_fd);
  213. SSL *ssl_new_context(SSL_CTX *ssl_ctx, struct tcp_pcb *SslClient_pcb);
  214. void disposable_new(SSL *ssl);
  215. void disposable_free(SSL *ssl);
  216. int send_packet(SSL *ssl, uint8_t protocol,
  217. const uint8_t *in, int length);
  218. int do_svr_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len);
  219. int do_clnt_handshake(SSL *ssl, int handshake_type, uint8_t *buf, int hs_len);
  220. int process_finished(SSL *ssl, uint8_t *buf, int hs_len);
  221. int process_sslv23_client_hello(SSL *ssl);
  222. int send_alert(SSL *ssl, int error_code);
  223. int send_finished(SSL *ssl);
  224. int send_certificate(SSL *ssl);
  225. int basic_read(SSL *ssl, uint8_t **in_data);
  226. int send_change_cipher_spec(SSL *ssl);
  227. void finished_digest(SSL *ssl, const char *label, uint8_t *digest);
  228. void generate_master_secret(SSL *ssl, const uint8_t *premaster_secret);
  229. void add_packet(SSL *ssl, const uint8_t *pkt, int len);
  230. int add_cert(SSL_CTX *ssl_ctx, const uint8_t *buf, int len);
  231. int add_private_key(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj);
  232. void ssl_obj_free(SSLObjLoader *ssl_obj);
  233. int pkcs8_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password);
  234. int pkcs12_decode(SSL_CTX *ssl_ctx, SSLObjLoader *ssl_obj, const char *password);
  235. int load_key_certs(SSL_CTX *ssl_ctx);
  236. #ifdef CONFIG_SSL_CERT_VERIFICATION
  237. int add_cert_auth(SSL_CTX *ssl_ctx, const uint8_t *buf, int len);
  238. void remove_ca_certs(CA_CERT_CTX *ca_cert_ctx);
  239. #endif
  240. #ifdef CONFIG_SSL_ENABLE_CLIENT
  241. int do_client_connect(SSL *ssl);
  242. #endif
  243. #ifdef CONFIG_SSL_FULL_MODE
  244. //void DISPLAY_STATE(SSL *ssl, int is_send, uint8_t state, int not_ok);
  245. //void DISPLAY_BYTES(SSL *ssl, const char *format,
  246. // const uint8_t *data, int size, ...);
  247. //void DISPLAY_CERT(SSL *ssl, const X509_CTX *x509_ctx);
  248. //void DISPLAY_RSA(SSL *ssl, const RSA_CTX *rsa_ctx);
  249. //void DISPLAY_ALERT(SSL *ssl, int alert);
  250. #else
  251. #define DISPLAY_STATE(A,B,C,D)
  252. #define DISPLAY_CERT(A,B)
  253. #define DISPLAY_RSA(A,B)
  254. #define DISPLAY_ALERT(A, B)
  255. #ifdef WIN32
  256. void DISPLAY_BYTES(SSL *ssl, const char *format,/* win32 has no variadic macros */
  257. const uint8_t *data, int size, ...);
  258. #else
  259. #define DISPLAY_BYTES(A,B,C,D,...)
  260. #endif
  261. #endif
  262. #ifdef CONFIG_SSL_CERT_VERIFICATION
  263. int process_certificate(SSL *ssl, X509_CTX **x509_ctx);
  264. #endif
  265. SSL_SESSION *ssl_session_update(int max_sessions,
  266. SSL_SESSION *ssl_sessions[], SSL *ssl,
  267. const uint8_t *session_id);
  268. void kill_ssl_session(SSL_SESSION **ssl_sessions, SSL *ssl);
  269. #ifdef __cplusplus
  270. }
  271. #endif
  272. #endif