int AES_set_decrypt_key(const unsigned char *userKey, const int bits,\r
AES_KEY *key);\r
\r
+int private_AES_set_encrypt_key(const unsigned char *userKey, const int bits,\r
+ AES_KEY *key);\r
+int private_AES_set_decrypt_key(const unsigned char *userKey, const int bits,\r
+ AES_KEY *key);\r
+\r
void AES_encrypt(const unsigned char *in, unsigned char *out,\r
const AES_KEY *key);\r
void AES_decrypt(const unsigned char *in, unsigned char *out,\r
*/\r
#define ASN1_STRING_FLAG_MSTRING 0x040\r
/* This is the base type that holds just about everything :-) */\r
-typedef struct asn1_string_st\r
+struct asn1_string_st\r
{\r
int length;\r
int type;\r
* input data has a non-zero 'unused bits' value, it will be\r
* handled correctly */\r
long flags;\r
- } ASN1_STRING;\r
+ };\r
\r
/* ASN1_ENCODING structure: this is used to save the received\r
* encoding of an ASN1 type. This is useful to get round\r
* see asn1t.h\r
*/\r
typedef struct ASN1_TEMPLATE_st ASN1_TEMPLATE;\r
-typedef struct ASN1_ITEM_st ASN1_ITEM;\r
typedef struct ASN1_TLC_st ASN1_TLC;\r
/* This is just an opaque pointer */\r
typedef struct ASN1_VALUE_st ASN1_VALUE;\r
#define ASN1_F_ASN1_ITEM_I2D_FP 193\r
#define ASN1_F_ASN1_ITEM_PACK 198\r
#define ASN1_F_ASN1_ITEM_SIGN 195\r
+#define ASN1_F_ASN1_ITEM_SIGN_CTX 220\r
#define ASN1_F_ASN1_ITEM_UNPACK 199\r
#define ASN1_F_ASN1_ITEM_VERIFY 197\r
#define ASN1_F_ASN1_MBSTRING_NCOPY 122\r
#define ASN1_F_PKCS5_PBE2_SET_IV 167\r
#define ASN1_F_PKCS5_PBE_SET 202\r
#define ASN1_F_PKCS5_PBE_SET0_ALGOR 215\r
+#define ASN1_F_PKCS5_PBKDF2_SET 219\r
#define ASN1_F_SMIME_READ_ASN1 212\r
#define ASN1_F_SMIME_TEXT 213\r
#define ASN1_F_X509_CINF_NEW 168\r
#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH 106\r
#define ASN1_R_BUFFER_TOO_SMALL 107\r
#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER 108\r
+#define ASN1_R_CONTEXT_NOT_INITIALISED 217\r
#define ASN1_R_DATA_IS_WRONG 109\r
#define ASN1_R_DECODE_ERROR 110\r
#define ASN1_R_DECODING_ERROR 111\r
\r
#include <openssl/crypto.h>\r
\r
+#ifndef OPENSSL_NO_SCTP\r
+# ifndef OPENSSL_SYS_VMS\r
+# include <stdint.h>\r
+# else\r
+# include <inttypes.h>\r
+# endif\r
+#endif\r
+\r
#ifdef __cplusplus\r
extern "C" {\r
#endif\r
#define BIO_TYPE_BIO (19|0x0400) /* (half a) BIO pair */\r
#define BIO_TYPE_LINEBUFFER (20|0x0200) /* filter */\r
#define BIO_TYPE_DGRAM (21|0x0400|0x0100)\r
+#ifndef OPENSSL_NO_SCTP\r
+#define BIO_TYPE_DGRAM_SCTP (24|0x0400|0x0100)\r
+#endif\r
#define BIO_TYPE_ASN1 (22|0x0200) /* filter */\r
#define BIO_TYPE_COMP (23|0x0200) /* filter */\r
\r
/* #endif */\r
\r
#define BIO_CTRL_DGRAM_QUERY_MTU 40 /* as kernel for current MTU */\r
+#define BIO_CTRL_DGRAM_GET_FALLBACK_MTU 47\r
#define BIO_CTRL_DGRAM_GET_MTU 41 /* get cached value for MTU */\r
#define BIO_CTRL_DGRAM_SET_MTU 42 /* set cached value for\r
* MTU. want to use this\r
#define BIO_CTRL_DGRAM_SET_PEER 44 /* Destination for the data */\r
\r
#define BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT 45 /* Next DTLS handshake timeout to\r
- * adjust socket timeouts */\r
+ * adjust socket timeouts */\r
+\r
+#ifndef OPENSSL_NO_SCTP\r
+/* SCTP stuff */\r
+#define BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE 50\r
+#define BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY 51\r
+#define BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY 52\r
+#define BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD 53\r
+#define BIO_CTRL_DGRAM_SCTP_GET_SNDINFO 60\r
+#define BIO_CTRL_DGRAM_SCTP_SET_SNDINFO 61\r
+#define BIO_CTRL_DGRAM_SCTP_GET_RCVINFO 62\r
+#define BIO_CTRL_DGRAM_SCTP_SET_RCVINFO 63\r
+#define BIO_CTRL_DGRAM_SCTP_GET_PRINFO 64\r
+#define BIO_CTRL_DGRAM_SCTP_SET_PRINFO 65\r
+#define BIO_CTRL_DGRAM_SCTP_SAVE_SHUTDOWN 70\r
+#endif\r
\r
/* modifiers */\r
#define BIO_FP_READ 0x02\r
/* Prefix and suffix callback in ASN1 BIO */\r
typedef int asn1_ps_func(BIO *b, unsigned char **pbuf, int *plen, void *parg);\r
\r
+#ifndef OPENSSL_NO_SCTP\r
+/* SCTP parameter structs */\r
+struct bio_dgram_sctp_sndinfo\r
+ {\r
+ uint16_t snd_sid;\r
+ uint16_t snd_flags;\r
+ uint32_t snd_ppid;\r
+ uint32_t snd_context;\r
+ };\r
+\r
+struct bio_dgram_sctp_rcvinfo\r
+ {\r
+ uint16_t rcv_sid;\r
+ uint16_t rcv_ssn;\r
+ uint16_t rcv_flags;\r
+ uint32_t rcv_ppid;\r
+ uint32_t rcv_tsn;\r
+ uint32_t rcv_cumtsn;\r
+ uint32_t rcv_context;\r
+ };\r
+\r
+struct bio_dgram_sctp_prinfo\r
+ {\r
+ uint16_t pr_policy;\r
+ uint32_t pr_value;\r
+ };\r
+#endif\r
+\r
/* connect BIO stuff */\r
#define BIO_CONN_S_BEFORE 1\r
#define BIO_CONN_S_GET_IP 2\r
BIO_METHOD *BIO_f_nbio_test(void);\r
#ifndef OPENSSL_NO_DGRAM\r
BIO_METHOD *BIO_s_datagram(void);\r
+#ifndef OPENSSL_NO_SCTP\r
+BIO_METHOD *BIO_s_datagram_sctp(void);\r
+#endif\r
#endif\r
\r
/* BIO_METHOD *BIO_f_ber(void); */\r
\r
BIO *BIO_new_socket(int sock, int close_flag);\r
BIO *BIO_new_dgram(int fd, int close_flag);\r
+#ifndef OPENSSL_NO_SCTP\r
+BIO *BIO_new_dgram_sctp(int fd, int close_flag);\r
+int BIO_dgram_is_sctp(BIO *bio);\r
+int BIO_dgram_sctp_notification_cb(BIO *b,\r
+ void (*handle_notifications)(BIO *bio, void *context, void *buf),\r
+ void *context);\r
+int BIO_dgram_sctp_wait_for_dry(BIO *b);\r
+int BIO_dgram_sctp_msg_waiting(BIO *b);\r
+#endif\r
BIO *BIO_new_fd(int fd, int close_flag);\r
BIO *BIO_new_connect(char *host_port);\r
BIO *BIO_new_accept(char *host_port);\r
#define BIO_F_BUFFER_CTRL 114\r
#define BIO_F_CONN_CTRL 127\r
#define BIO_F_CONN_STATE 115\r
+#define BIO_F_DGRAM_SCTP_READ 132\r
#define BIO_F_FILE_CTRL 116\r
#define BIO_F_FILE_READ 130\r
#define BIO_F_LINEBUFFER_CTRL 129\r
BF_LONG S[4*256];\r
} BF_KEY;\r
\r
-\r
+#ifdef OPENSSL_FIPS\r
+void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);\r
+#endif\r
void BF_set_key(BF_KEY *key, int len, const unsigned char *data);\r
\r
void BF_encrypt(BF_LONG *data,const BF_KEY *key);\r
int BN_is_prime_fasttest_ex(const BIGNUM *p,int nchecks, BN_CTX *ctx,\r
int do_trial_division, BN_GENCB *cb);\r
\r
+int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx);\r
+\r
+int BN_X931_derive_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,\r
+ const BIGNUM *Xp, const BIGNUM *Xp1, const BIGNUM *Xp2,\r
+ const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb);\r
+int BN_X931_generate_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,\r
+ BIGNUM *Xp1, BIGNUM *Xp2,\r
+ const BIGNUM *Xp,\r
+ const BIGNUM *e, BN_CTX *ctx,\r
+ BN_GENCB *cb);\r
+\r
BN_MONT_CTX *BN_MONT_CTX_new(void );\r
void BN_MONT_CTX_init(BN_MONT_CTX *ctx);\r
int BN_mod_mul_montgomery(BIGNUM *r,const BIGNUM *a,const BIGNUM *b,\r
int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,\r
BN_RECP_CTX *recp, BN_CTX *ctx);\r
\r
+#ifndef OPENSSL_NO_EC2M\r
+\r
/* Functions for arithmetic over binary polynomials represented by BIGNUMs.\r
*\r
* The BIGNUM::neg property of BIGNUMs representing binary polynomials is\r
int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max);\r
int BN_GF2m_arr2poly(const int p[], BIGNUM *a);\r
\r
+#endif\r
+\r
/* faster mod functions for the 'NIST primes'\r
* 0 <= a < p^2 */\r
int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);\r
};\r
typedef struct camellia_key_st CAMELLIA_KEY;\r
\r
+#ifdef OPENSSL_FIPS\r
+int private_Camellia_set_key(const unsigned char *userKey, const int bits,\r
+ CAMELLIA_KEY *key);\r
+#endif\r
int Camellia_set_key(const unsigned char *userKey, const int bits,\r
CAMELLIA_KEY *key);\r
\r
int short_key; /* Use reduced rounds for short key */\r
} CAST_KEY;\r
\r
-\r
+#ifdef OPENSSL_FIPS\r
+void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);\r
+#endif\r
void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);\r
void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out, const CAST_KEY *key,\r
int enc);\r
--- /dev/null
+/* crypto/cmac/cmac.h */\r
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL\r
+ * project.\r
+ */\r
+/* ====================================================================\r
+ * Copyright (c) 2010 The OpenSSL Project. All rights reserved.\r
+ *\r
+ * Redistribution and use in source and binary forms, with or without\r
+ * modification, are permitted provided that the following conditions\r
+ * are met:\r
+ *\r
+ * 1. Redistributions of source code must retain the above copyright\r
+ * notice, this list of conditions and the following disclaimer.\r
+ *\r
+ * 2. Redistributions in binary form must reproduce the above copyright\r
+ * notice, this list of conditions and the following disclaimer in\r
+ * the documentation and/or other materials provided with the\r
+ * distribution.\r
+ *\r
+ * 3. All advertising materials mentioning features or use of this\r
+ * software must display the following acknowledgment:\r
+ * "This product includes software developed by the OpenSSL Project\r
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"\r
+ *\r
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to\r
+ * endorse or promote products derived from this software without\r
+ * prior written permission. For written permission, please contact\r
+ * licensing@OpenSSL.org.\r
+ *\r
+ * 5. Products derived from this software may not be called "OpenSSL"\r
+ * nor may "OpenSSL" appear in their names without prior written\r
+ * permission of the OpenSSL Project.\r
+ *\r
+ * 6. Redistributions of any form whatsoever must retain the following\r
+ * acknowledgment:\r
+ * "This product includes software developed by the OpenSSL Project\r
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"\r
+ *\r
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY\r
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\r
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\r
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR\r
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT\r
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\r
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\r
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)\r
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\r
+ * OF THE POSSIBILITY OF SUCH DAMAGE.\r
+ * ====================================================================\r
+ */\r
+\r
+\r
+#ifndef HEADER_CMAC_H\r
+#define HEADER_CMAC_H\r
+\r
+#ifdef __cplusplus\r
+extern "C" {\r
+#endif\r
+\r
+#include <openssl/evp.h>\r
+\r
+/* Opaque */\r
+typedef struct CMAC_CTX_st CMAC_CTX;\r
+\r
+CMAC_CTX *CMAC_CTX_new(void);\r
+void CMAC_CTX_cleanup(CMAC_CTX *ctx);\r
+void CMAC_CTX_free(CMAC_CTX *ctx);\r
+EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx);\r
+int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in);\r
+\r
+int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,\r
+ const EVP_CIPHER *cipher, ENGINE *impl);\r
+int CMAC_Update(CMAC_CTX *ctx, const void *data, size_t dlen);\r
+int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen);\r
+int CMAC_resume(CMAC_CTX *ctx);\r
+\r
+#ifdef __cplusplus\r
+}\r
+#endif\r
+#endif\r
#define CMS_PARTIAL 0x4000\r
#define CMS_REUSE_DIGEST 0x8000\r
#define CMS_USE_KEYID 0x10000\r
+#define CMS_DEBUG_DECRYPT 0x20000\r
\r
const ASN1_OBJECT *CMS_get0_type(CMS_ContentInfo *cms);\r
\r
int CMS_decrypt_set1_key(CMS_ContentInfo *cms,\r
unsigned char *key, size_t keylen,\r
unsigned char *id, size_t idlen);\r
+int CMS_decrypt_set1_password(CMS_ContentInfo *cms,\r
+ unsigned char *pass, ossl_ssize_t passlen);\r
\r
STACK_OF(CMS_RecipientInfo) *CMS_get0_RecipientInfos(CMS_ContentInfo *cms);\r
int CMS_RecipientInfo_type(CMS_RecipientInfo *ri);\r
int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri,\r
const unsigned char *id, size_t idlen);\r
\r
+int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri,\r
+ unsigned char *pass,\r
+ ossl_ssize_t passlen);\r
+\r
+CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,\r
+ int iter, int wrap_nid, int pbe_nid,\r
+ unsigned char *pass,\r
+ ossl_ssize_t passlen,\r
+ const EVP_CIPHER *kekciph);\r
+\r
int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri);\r
\r
int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,\r
#define CMS_F_CHECK_CONTENT 99\r
#define CMS_F_CMS_ADD0_CERT 164\r
#define CMS_F_CMS_ADD0_RECIPIENT_KEY 100\r
+#define CMS_F_CMS_ADD0_RECIPIENT_PASSWORD 165\r
#define CMS_F_CMS_ADD1_RECEIPTREQUEST 158\r
#define CMS_F_CMS_ADD1_RECIPIENT_CERT 101\r
#define CMS_F_CMS_ADD1_SIGNER 102\r
#define CMS_F_CMS_DATAINIT 111\r
#define CMS_F_CMS_DECRYPT 112\r
#define CMS_F_CMS_DECRYPT_SET1_KEY 113\r
+#define CMS_F_CMS_DECRYPT_SET1_PASSWORD 166\r
#define CMS_F_CMS_DECRYPT_SET1_PKEY 114\r
#define CMS_F_CMS_DIGESTALGORITHM_FIND_CTX 115\r
#define CMS_F_CMS_DIGESTALGORITHM_INIT_BIO 116\r
#define CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT 141\r
#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS 142\r
#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID 143\r
+#define CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT 167\r
#define CMS_F_CMS_RECIPIENTINFO_SET0_KEY 144\r
+#define CMS_F_CMS_RECIPIENTINFO_SET0_PASSWORD 168\r
#define CMS_F_CMS_RECIPIENTINFO_SET0_PKEY 145\r
#define CMS_F_CMS_SET1_SIGNERIDENTIFIER 146\r
#define CMS_F_CMS_SET_DETACHED 147\r
#define CMS_R_ERROR_SETTING_KEY 115\r
#define CMS_R_ERROR_SETTING_RECIPIENTINFO 116\r
#define CMS_R_INVALID_ENCRYPTED_KEY_LENGTH 117\r
+#define CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER 176\r
#define CMS_R_INVALID_KEY_LENGTH 118\r
#define CMS_R_MD_BIO_INIT_ERROR 119\r
#define CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH 120\r
#define CMS_R_NOT_ENCRYPTED_DATA 122\r
#define CMS_R_NOT_KEK 123\r
#define CMS_R_NOT_KEY_TRANSPORT 124\r
+#define CMS_R_NOT_PWRI 177\r
#define CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE 125\r
#define CMS_R_NO_CIPHER 126\r
#define CMS_R_NO_CONTENT 127\r
#define CMS_R_NO_MATCHING_RECIPIENT 132\r
#define CMS_R_NO_MATCHING_SIGNATURE 166\r
#define CMS_R_NO_MSGSIGDIGEST 167\r
+#define CMS_R_NO_PASSWORD 178\r
#define CMS_R_NO_PRIVATE_KEY 133\r
#define CMS_R_NO_PUBLIC_KEY 134\r
#define CMS_R_NO_RECEIPT_REQUEST 168\r
#define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM 151\r
#define CMS_R_UNSUPPORTED_CONTENT_TYPE 152\r
#define CMS_R_UNSUPPORTED_KEK_ALGORITHM 153\r
+#define CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM 179\r
#define CMS_R_UNSUPPORTED_RECIPIENT_TYPE 154\r
#define CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE 155\r
#define CMS_R_UNSUPPORTED_TYPE 156\r
#define CMS_R_UNWRAP_ERROR 157\r
+#define CMS_R_UNWRAP_FAILURE 180\r
#define CMS_R_VERIFICATION_FAILURE 158\r
#define CMS_R_WRAP_ERROR 159\r
\r
#define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))\r
int OPENSSL_isservice(void);\r
\r
+int FIPS_mode(void);\r
+int FIPS_mode_set(int r);\r
+\r
+void OPENSSL_init(void);\r
+\r
+#define fips_md_init(alg) fips_md_init_ctx(alg, alg)\r
+\r
+#ifdef OPENSSL_FIPS\r
+#define fips_md_init_ctx(alg, cx) \\r
+ int alg##_Init(cx##_CTX *c) \\r
+ { \\r
+ if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \\r
+ "Low level API call to digest " #alg " forbidden in FIPS mode!"); \\r
+ return private_##alg##_Init(c); \\r
+ } \\r
+ int private_##alg##_Init(cx##_CTX *c)\r
+\r
+#define fips_cipher_abort(alg) \\r
+ if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \\r
+ "Low level API call to cipher " #alg " forbidden in FIPS mode!")\r
+\r
+#else\r
+#define fips_md_init_ctx(alg, cx) \\r
+ int alg##_Init(cx##_CTX *c)\r
+#define fips_cipher_abort(alg) while(0)\r
+#endif\r
+\r
/* BEGIN ERROR CODES */\r
/* The following lines are auto generated by the script mkerr.pl. Any changes\r
* made after this point may be overwritten when the script is next run.\r
#define CRYPTO_F_CRYPTO_SET_EX_DATA 102\r
#define CRYPTO_F_DEF_ADD_INDEX 104\r
#define CRYPTO_F_DEF_GET_CLASS 105\r
+#define CRYPTO_F_FIPS_MODE_SET 109\r
#define CRYPTO_F_INT_DUP_EX_DATA 106\r
#define CRYPTO_F_INT_FREE_EX_DATA 107\r
#define CRYPTO_F_INT_NEW_EX_DATA 108\r
\r
/* Reason codes. */\r
+#define CRYPTO_R_FIPS_MODE_NOT_SUPPORTED 101\r
#define CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK 100\r
\r
#ifdef __cplusplus\r
int DES_key_sched(const_DES_cblock *key,DES_key_schedule *schedule);\r
int DES_set_key_checked(const_DES_cblock *key,DES_key_schedule *schedule);\r
void DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);\r
+#ifdef OPENSSL_FIPS\r
+void private_DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);\r
+#endif\r
void DES_string_to_key(const char *str,DES_cblock *key);\r
void DES_string_to_2keys(const char *str,DES_cblock *key1,DES_cblock *key2);\r
void DES_cfb64_encrypt(const unsigned char *in,unsigned char *out,long length,\r
* be used for all exponents.\r
*/\r
\r
+/* If this flag is set the DH method is FIPS compliant and can be used\r
+ * in FIPS mode. This is set in the validated module method. If an\r
+ * application sets this flag in its own methods it is its reposibility\r
+ * to ensure the result is compliant.\r
+ */\r
+\r
+#define DH_FLAG_FIPS_METHOD 0x0400\r
+\r
+/* If this flag is set the operations normally disabled in FIPS mode are\r
+ * permitted it is then the applications responsibility to ensure that the\r
+ * usage is compliant.\r
+ */\r
+\r
+#define DH_FLAG_NON_FIPS_ALLOW 0x0400\r
+\r
#ifdef __cplusplus\r
extern "C" {\r
#endif\r
#define DH_F_COMPUTE_KEY 102\r
#define DH_F_DHPARAMS_PRINT_FP 101\r
#define DH_F_DH_BUILTIN_GENPARAMS 106\r
+#define DH_F_DH_COMPUTE_KEY 114\r
+#define DH_F_DH_GENERATE_KEY 115\r
+#define DH_F_DH_GENERATE_PARAMETERS_EX 116\r
#define DH_F_DH_NEW_METHOD 105\r
#define DH_F_DH_PARAM_DECODE 107\r
#define DH_F_DH_PRIV_DECODE 110\r
#define DH_R_DECODE_ERROR 104\r
#define DH_R_INVALID_PUBKEY 102\r
#define DH_R_KEYS_NOT_SET 108\r
+#define DH_R_KEY_SIZE_TOO_SMALL 110\r
#define DH_R_MODULUS_TOO_LARGE 103\r
+#define DH_R_NON_FIPS_METHOD 111\r
#define DH_R_NO_PARAMETERS_SET 107\r
#define DH_R_NO_PRIVATE_VALUE 100\r
#define DH_R_PARAMETER_ENCODING_ERROR 105\r
* be used for all exponents.\r
*/\r
\r
+/* If this flag is set the DSA method is FIPS compliant and can be used\r
+ * in FIPS mode. This is set in the validated module method. If an\r
+ * application sets this flag in its own methods it is its reposibility\r
+ * to ensure the result is compliant.\r
+ */\r
+\r
+#define DSA_FLAG_FIPS_METHOD 0x0400\r
+\r
+/* If this flag is set the operations normally disabled in FIPS mode are\r
+ * permitted it is then the applications responsibility to ensure that the\r
+ * usage is compliant.\r
+ */\r
+\r
+#define DSA_FLAG_NON_FIPS_ALLOW 0x0400\r
+\r
#ifdef __cplusplus\r
extern "C" {\r
#endif\r
#define DSA_F_DSAPARAMS_PRINT_FP 101\r
#define DSA_F_DSA_DO_SIGN 112\r
#define DSA_F_DSA_DO_VERIFY 113\r
+#define DSA_F_DSA_GENERATE_KEY 124\r
+#define DSA_F_DSA_GENERATE_PARAMETERS_EX 123\r
#define DSA_F_DSA_NEW_METHOD 103\r
#define DSA_F_DSA_PARAM_DECODE 119\r
#define DSA_F_DSA_PRINT_FP 105\r
#define DSA_F_DSA_SIGN 106\r
#define DSA_F_DSA_SIGN_SETUP 107\r
#define DSA_F_DSA_SIG_NEW 109\r
+#define DSA_F_DSA_SIG_PRINT 125\r
#define DSA_F_DSA_VERIFY 108\r
#define DSA_F_I2D_DSA_SIG 111\r
#define DSA_F_OLD_DSA_PRIV_DECODE 122\r
#define DSA_R_INVALID_DIGEST_TYPE 106\r
#define DSA_R_MISSING_PARAMETERS 101\r
#define DSA_R_MODULUS_TOO_LARGE 103\r
+#define DSA_R_NEED_NEW_SETUP_VALUES 110\r
+#define DSA_R_NON_FIPS_DSA_METHOD 111\r
#define DSA_R_NO_PARAMETERS_SET 107\r
#define DSA_R_PARAMETER_ENCODING_ERROR 105\r
\r
#define DTLS1_AL_HEADER_LENGTH 2\r
#endif\r
\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
+#ifndef OPENSSL_NO_SCTP\r
+#define DTLS1_SCTP_AUTH_LABEL "EXPORTER_DTLS_OVER_SCTP"\r
+#endif\r
\r
typedef struct dtls1_bitmap_st\r
{\r
\r
struct dtls1_timeout_st timeout;\r
\r
- /* Indicates when the last handshake msg sent will timeout */\r
+ /* Indicates when the last handshake msg or heartbeat sent will timeout */\r
struct timeval next_timeout;\r
\r
/* Timeout duration */\r
unsigned int retransmitting;\r
unsigned int change_cipher_spec_ok;\r
\r
+#ifndef OPENSSL_NO_SCTP\r
+ /* used when SSL_ST_XX_FLUSH is entered */\r
+ int next_state;\r
+\r
+ int shutdown_received;\r
+#endif\r
+\r
} DTLS1_STATE;\r
\r
typedef struct dtls1_record_data_st\r
unsigned int packet_length;\r
SSL3_BUFFER rbuf;\r
SSL3_RECORD rrec;\r
+#ifndef OPENSSL_NO_SCTP\r
+ struct bio_dgram_sctp_rcvinfo recordinfo;\r
+#endif\r
} DTLS1_RECORD_DATA;\r
\r
+#endif\r
\r
/* Timeout multipliers (timeout slice is defined in apps/timeouts.h */\r
#define DTLS1_TMO_READ_COUNT 2\r
# define OPENSSL_GLOBAL_REF(name) _shadow_##name\r
#endif\r
\r
+#if defined(OPENSSL_SYS_MACINTOSH_CLASSIC) && macintosh==1 && !defined(MAC_OS_GUSI_SOURCE)\r
+# define ossl_ssize_t long\r
+#endif\r
+\r
+#ifdef OPENSSL_SYS_MSDOS\r
+# define ossl_ssize_t long\r
+#endif\r
+\r
+#if defined(NeXT) || defined(OPENSSL_SYS_NEWS4) || defined(OPENSSL_SYS_SUNOS)\r
+# define ssize_t int\r
+#endif\r
+\r
+#if defined(__ultrix) && !defined(ssize_t)\r
+# define ossl_ssize_t int\r
+#endif\r
+\r
+#ifndef ossl_ssize_t\r
+# define ossl_ssize_t ssize_t\r
+#endif\r
+\r
#ifdef __cplusplus\r
}\r
#endif\r
*/\r
const EC_METHOD *EC_GFp_nist_method(void);\r
\r
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128\r
+/** Returns 64-bit optimized methods for nistp224\r
+ * \return EC_METHOD object\r
+ */\r
+const EC_METHOD *EC_GFp_nistp224_method(void);\r
+\r
+/** Returns 64-bit optimized methods for nistp256\r
+ * \return EC_METHOD object\r
+ */\r
+const EC_METHOD *EC_GFp_nistp256_method(void);\r
+\r
+/** Returns 64-bit optimized methods for nistp521\r
+ * \return EC_METHOD object\r
+ */\r
+const EC_METHOD *EC_GFp_nistp521_method(void);\r
+#endif\r
\r
+#ifndef OPENSSL_NO_EC2M\r
/********************************************************************/\r
/* EC_METHOD for curves over GF(2^m) */\r
/********************************************************************/\r
*/\r
const EC_METHOD *EC_GF2m_simple_method(void);\r
\r
+#endif\r
+\r
\r
/********************************************************************/\r
/* EC_GROUP functions */\r
*/\r
int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);\r
\r
+#ifndef OPENSSL_NO_EC2M\r
/** Sets the parameter of a ec over GF2m defined by y^2 + x*y = x^3 + a*x^2 + b\r
* \param group EC_GROUP object\r
* \param p BIGNUM with the polynomial defining the underlying field\r
* \return 1 on success and 0 if an error occured\r
*/\r
int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);\r
-\r
+#endif\r
/** Returns the number of bits needed to represent a field element\r
* \param group EC_GROUP object\r
* \return number of bits needed to represent a field element\r
* \return newly created EC_GROUP object with the specified parameters\r
*/\r
EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);\r
-\r
+#ifndef OPENSSL_NO_EC2M\r
/** Creates a new EC_GROUP object with the specified parameters defined\r
* over GF2m (defined by the equation y^2 + x*y = x^3 + a*x^2 + b)\r
* \param p BIGNUM with the polynomial defining the underlying field\r
* \return newly created EC_GROUP object with the specified parameters\r
*/\r
EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);\r
-\r
+#endif\r
/** Creates a EC_GROUP object with a curve specified by a NID\r
* \param nid NID of the OID of the curve name\r
* \return newly created EC_GROUP object with specified curve or NULL\r
*/\r
int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *p,\r
const BIGNUM *x, int y_bit, BN_CTX *ctx);\r
-\r
+#ifndef OPENSSL_NO_EC2M\r
/** Sets the affine coordinates of a EC_POINT over GF2m\r
* \param group underlying EC_GROUP object\r
* \param p EC_POINT object\r
*/\r
int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *group, EC_POINT *p,\r
const BIGNUM *x, int y_bit, BN_CTX *ctx);\r
-\r
+#endif\r
/** Encodes a EC_POINT object to a octet string\r
* \param group underlying EC_GROUP object\r
* \param p EC_POINT object\r
/* EC_GROUP_get_basis_type() returns the NID of the basis type\r
* used to represent the field elements */\r
int EC_GROUP_get_basis_type(const EC_GROUP *);\r
+#ifndef OPENSSL_NO_EC2M\r
int EC_GROUP_get_trinomial_basis(const EC_GROUP *, unsigned int *k);\r
int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1,\r
unsigned int *k2, unsigned int *k3);\r
+#endif\r
\r
#define OPENSSL_EC_NAMED_CURVE 0x001\r
\r
#define EC_PKEY_NO_PARAMETERS 0x001\r
#define EC_PKEY_NO_PUBKEY 0x002\r
\r
+/* some values for the flags field */\r
+#define EC_FLAG_NON_FIPS_ALLOW 0x1\r
+#define EC_FLAG_FIPS_CHECKED 0x2\r
+\r
/** Creates a new EC_KEY object.\r
* \return EC_KEY object or NULL if an error occurred.\r
*/\r
EC_KEY *EC_KEY_new(void);\r
\r
+int EC_KEY_get_flags(const EC_KEY *key);\r
+\r
+void EC_KEY_set_flags(EC_KEY *key, int flags);\r
+\r
+void EC_KEY_clear_flags(EC_KEY *key, int flags);\r
+\r
/** Creates a new EC_KEY object using a named curve as underlying\r
* EC_GROUP object.\r
* \param nid NID of the named curve.\r
*/\r
int EC_KEY_check_key(const EC_KEY *key);\r
\r
+/** Sets a public key from affine coordindates performing\r
+ * neccessary NIST PKV tests.\r
+ * \param key the EC_KEY object\r
+ * \param x public key x coordinate\r
+ * \param y public key y coordinate\r
+ * \return 1 on success and 0 otherwise.\r
+ */\r
+int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y);\r
+\r
\r
/********************************************************************/\r
/* de- and encoding functions for SEC1 ECPrivateKey */\r
/* Error codes for the EC functions. */\r
\r
/* Function codes. */\r
+#define EC_F_BN_TO_FELEM 224\r
#define EC_F_COMPUTE_WNAF 143\r
#define EC_F_D2I_ECPARAMETERS 144\r
#define EC_F_D2I_ECPKPARAMETERS 145\r
#define EC_F_EC_GFP_MONT_FIELD_SQR 132\r
#define EC_F_EC_GFP_MONT_GROUP_SET_CURVE 189\r
#define EC_F_EC_GFP_MONT_GROUP_SET_CURVE_GFP 135\r
+#define EC_F_EC_GFP_NISTP224_GROUP_SET_CURVE 225\r
+#define EC_F_EC_GFP_NISTP224_POINTS_MUL 228\r
+#define EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES 226\r
+#define EC_F_EC_GFP_NISTP256_GROUP_SET_CURVE 230\r
+#define EC_F_EC_GFP_NISTP256_POINTS_MUL 231\r
+#define EC_F_EC_GFP_NISTP256_POINT_GET_AFFINE_COORDINATES 232\r
+#define EC_F_EC_GFP_NISTP521_GROUP_SET_CURVE 233\r
+#define EC_F_EC_GFP_NISTP521_POINTS_MUL 234\r
+#define EC_F_EC_GFP_NISTP521_POINT_GET_AFFINE_COORDINATES 235\r
#define EC_F_EC_GFP_NIST_FIELD_MUL 200\r
#define EC_F_EC_GFP_NIST_FIELD_SQR 201\r
#define EC_F_EC_GFP_NIST_GROUP_SET_CURVE 202\r
#define EC_F_EC_KEY_NEW 182\r
#define EC_F_EC_KEY_PRINT 180\r
#define EC_F_EC_KEY_PRINT_FP 181\r
+#define EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES 229\r
#define EC_F_EC_POINTS_MAKE_AFFINE 136\r
#define EC_F_EC_POINT_ADD 112\r
#define EC_F_EC_POINT_CMP 113\r
#define EC_F_I2D_ECPKPARAMETERS 191\r
#define EC_F_I2D_ECPRIVATEKEY 192\r
#define EC_F_I2O_ECPUBLICKEY 151\r
+#define EC_F_NISTP224_PRE_COMP_NEW 227\r
+#define EC_F_NISTP256_PRE_COMP_NEW 236\r
+#define EC_F_NISTP521_PRE_COMP_NEW 237\r
#define EC_F_O2I_ECPUBLICKEY 152\r
#define EC_F_OLD_EC_PRIV_DECODE 222\r
#define EC_F_PKEY_EC_CTRL 197\r
/* Reason codes. */\r
#define EC_R_ASN1_ERROR 115\r
#define EC_R_ASN1_UNKNOWN_FIELD 116\r
+#define EC_R_BIGNUM_OUT_OF_RANGE 144\r
#define EC_R_BUFFER_TOO_SMALL 100\r
+#define EC_R_COORDINATES_OUT_OF_RANGE 146\r
#define EC_R_D2I_ECPKPARAMETERS_FAILURE 117\r
#define EC_R_DECODE_ERROR 142\r
#define EC_R_DISCRIMINANT_IS_ZERO 118\r
#define EC_R_EC_GROUP_NEW_BY_NAME_FAILURE 119\r
#define EC_R_FIELD_TOO_LARGE 143\r
+#define EC_R_GF2M_NOT_SUPPORTED 147\r
#define EC_R_GROUP2PKPARAMETERS_FAILURE 120\r
#define EC_R_I2D_ECPKPARAMETERS_FAILURE 121\r
#define EC_R_INCOMPATIBLE_OBJECTS 101\r
#define EC_R_UNKNOWN_GROUP 129\r
#define EC_R_UNKNOWN_ORDER 114\r
#define EC_R_UNSUPPORTED_FIELD 131\r
+#define EC_R_WRONG_CURVE_PARAMETERS 145\r
#define EC_R_WRONG_ORDER 130\r
\r
#ifdef __cplusplus\r
/* Error codes for the ECDH functions. */\r
\r
/* Function codes. */\r
+#define ECDH_F_ECDH_CHECK 102\r
#define ECDH_F_ECDH_COMPUTE_KEY 100\r
#define ECDH_F_ECDH_DATA_NEW_METHOD 101\r
\r
/* Reason codes. */\r
#define ECDH_R_KDF_FAILED 102\r
+#define ECDH_R_NON_FIPS_METHOD 103\r
#define ECDH_R_NO_PRIVATE_VALUE 100\r
#define ECDH_R_POINT_ARITHMETIC_FAILURE 101\r
\r
/* Error codes for the ECDSA functions. */\r
\r
/* Function codes. */\r
+#define ECDSA_F_ECDSA_CHECK 104\r
#define ECDSA_F_ECDSA_DATA_NEW_METHOD 100\r
#define ECDSA_F_ECDSA_DO_SIGN 101\r
#define ECDSA_F_ECDSA_DO_VERIFY 102\r
#define ECDSA_R_ERR_EC_LIB 102\r
#define ECDSA_R_MISSING_PARAMETERS 103\r
#define ECDSA_R_NEED_NEW_SETUP_VALUES 106\r
+#define ECDSA_R_NON_FIPS_METHOD 107\r
#define ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED 104\r
#define ECDSA_R_SIGNATURE_MALLOC_FAILED 105\r
\r
* the existing ENGINE's structural reference count. */\r
#define ENGINE_FLAGS_BY_ID_COPY (int)0x0004\r
\r
+/* This flag if for an ENGINE that does not want its methods registered as\r
+ * part of ENGINE_register_all_complete() for example if the methods are\r
+ * not usable as default methods.\r
+ */\r
+\r
+#define ENGINE_FLAGS_NO_REGISTER_ALL (int)0x0008\r
+\r
/* ENGINEs can support their own command types, and these flags are used in\r
* ENGINE_CTRL_GET_CMD_FLAGS to indicate to the caller what kind of input each\r
* command expects. Currently only numeric and string input is supported. If a\r
#endif\r
#endif\r
void ENGINE_load_cryptodev(void);\r
+void ENGINE_load_rsax(void);\r
+void ENGINE_load_rdrand(void);\r
void ENGINE_load_builtin_engines(void);\r
\r
/* Get and set global flags (ENGINE_TABLE_FLAG_***) for the implementation\r
#endif\r
#ifndef OPENSSL_NO_BIO\r
void ERR_print_errors(BIO *bp);\r
-void ERR_add_error_data(int num, ...);\r
#endif\r
+void ERR_add_error_data(int num, ...);\r
+void ERR_add_error_vdata(int num, va_list args);\r
void ERR_load_strings(int lib,ERR_STRING_DATA str[]);\r
void ERR_unload_strings(int lib,ERR_STRING_DATA str[]);\r
void ERR_load_ERR_strings(void);\r
#define EVP_RC5_32_12_16_KEY_SIZE 16\r
*/\r
#define EVP_MAX_MD_SIZE 64 /* longest known is SHA512 */\r
-#define EVP_MAX_KEY_LENGTH 32\r
+#define EVP_MAX_KEY_LENGTH 64\r
#define EVP_MAX_IV_LENGTH 16\r
#define EVP_MAX_BLOCK_LENGTH 32\r
\r
#define EVP_PKEY_DH NID_dhKeyAgreement\r
#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey\r
#define EVP_PKEY_HMAC NID_hmac\r
+#define EVP_PKEY_CMAC NID_cmac\r
\r
#ifdef __cplusplus\r
extern "C" {\r
\r
#define EVP_MD_FLAG_DIGALGID_CUSTOM 0x0018\r
\r
+#define EVP_MD_FLAG_FIPS 0x0400 /* Note if suitable for use in FIPS mode */\r
+\r
/* Digest ctrls */\r
\r
#define EVP_MD_CTRL_DIGALGID 0x1\r
#define EVP_CIPH_CBC_MODE 0x2\r
#define EVP_CIPH_CFB_MODE 0x3\r
#define EVP_CIPH_OFB_MODE 0x4\r
+#define EVP_CIPH_CTR_MODE 0x5\r
+#define EVP_CIPH_GCM_MODE 0x6\r
+#define EVP_CIPH_CCM_MODE 0x7\r
+#define EVP_CIPH_XTS_MODE 0x10001\r
#define EVP_CIPH_MODE 0xF0007\r
/* Set if variable length cipher */\r
#define EVP_CIPH_VARIABLE_LENGTH 0x8\r
#define EVP_CIPH_FLAG_DEFAULT_ASN1 0x1000\r
/* Buffer length in bits not bytes: CFB1 mode only */\r
#define EVP_CIPH_FLAG_LENGTH_BITS 0x2000\r
+/* Note if suitable for use in FIPS mode */\r
+#define EVP_CIPH_FLAG_FIPS 0x4000\r
+/* Allow non FIPS cipher in FIPS mode */\r
+#define EVP_CIPH_FLAG_NON_FIPS_ALLOW 0x8000\r
+/* Cipher handles any and all padding logic as well\r
+ * as finalisation.\r
+ */\r
+#define EVP_CIPH_FLAG_CUSTOM_CIPHER 0x100000\r
+#define EVP_CIPH_FLAG_AEAD_CIPHER 0x200000\r
\r
/* ctrl() values */\r
\r
#define EVP_CTRL_RAND_KEY 0x6\r
#define EVP_CTRL_PBE_PRF_NID 0x7\r
#define EVP_CTRL_COPY 0x8\r
+#define EVP_CTRL_GCM_SET_IVLEN 0x9\r
+#define EVP_CTRL_GCM_GET_TAG 0x10\r
+#define EVP_CTRL_GCM_SET_TAG 0x11\r
+#define EVP_CTRL_GCM_SET_IV_FIXED 0x12\r
+#define EVP_CTRL_GCM_IV_GEN 0x13\r
+#define EVP_CTRL_CCM_SET_IVLEN EVP_CTRL_GCM_SET_IVLEN\r
+#define EVP_CTRL_CCM_GET_TAG EVP_CTRL_GCM_GET_TAG\r
+#define EVP_CTRL_CCM_SET_TAG EVP_CTRL_GCM_SET_TAG\r
+#define EVP_CTRL_CCM_SET_L 0x14\r
+#define EVP_CTRL_CCM_SET_MSGLEN 0x15\r
+/* AEAD cipher deduces payload length and returns number of bytes\r
+ * required to store MAC and eventual padding. Subsequent call to\r
+ * EVP_Cipher even appends/verifies MAC.\r
+ */\r
+#define EVP_CTRL_AEAD_TLS1_AAD 0x16\r
+/* Used by composite AEAD ciphers, no-op in GCM, CCM... */\r
+#define EVP_CTRL_AEAD_SET_MAC_KEY 0x17\r
+/* Set the GCM invocation field, decrypt only */\r
+#define EVP_CTRL_GCM_SET_IV_INV 0x18\r
+\r
+/* GCM TLS constants */\r
+/* Length of fixed part of IV derived from PRF */\r
+#define EVP_GCM_TLS_FIXED_IV_LEN 4\r
+/* Length of explicit part of IV part of TLS records */\r
+#define EVP_GCM_TLS_EXPLICIT_IV_LEN 8\r
+/* Length of tag for TLS */\r
+#define EVP_GCM_TLS_TAG_LEN 16\r
+\r
\r
typedef struct evp_cipher_info_st\r
{\r
unsigned char oiv[EVP_MAX_IV_LENGTH]; /* original iv */\r
unsigned char iv[EVP_MAX_IV_LENGTH]; /* working iv */\r
unsigned char buf[EVP_MAX_BLOCK_LENGTH];/* saved partial block */\r
- int num; /* used by cfb/ofb mode */\r
+ int num; /* used by cfb/ofb/ctr mode */\r
\r
void *app_data; /* application stuff */\r
int key_len; /* May change for variable length cipher */\r
#ifndef OPENSSL_NO_RC4\r
const EVP_CIPHER *EVP_rc4(void);\r
const EVP_CIPHER *EVP_rc4_40(void);\r
+#ifndef OPENSSL_NO_MD5\r
+const EVP_CIPHER *EVP_rc4_hmac_md5(void);\r
+#endif\r
#endif\r
#ifndef OPENSSL_NO_IDEA\r
const EVP_CIPHER *EVP_idea_ecb(void);\r
const EVP_CIPHER *EVP_aes_128_cfb128(void);\r
# define EVP_aes_128_cfb EVP_aes_128_cfb128\r
const EVP_CIPHER *EVP_aes_128_ofb(void);\r
-#if 0\r
const EVP_CIPHER *EVP_aes_128_ctr(void);\r
-#endif\r
+const EVP_CIPHER *EVP_aes_128_gcm(void);\r
+const EVP_CIPHER *EVP_aes_128_ccm(void);\r
+const EVP_CIPHER *EVP_aes_128_xts(void);\r
const EVP_CIPHER *EVP_aes_192_ecb(void);\r
const EVP_CIPHER *EVP_aes_192_cbc(void);\r
const EVP_CIPHER *EVP_aes_192_cfb1(void);\r
const EVP_CIPHER *EVP_aes_192_cfb128(void);\r
# define EVP_aes_192_cfb EVP_aes_192_cfb128\r
const EVP_CIPHER *EVP_aes_192_ofb(void);\r
-#if 0\r
const EVP_CIPHER *EVP_aes_192_ctr(void);\r
-#endif\r
+const EVP_CIPHER *EVP_aes_192_gcm(void);\r
+const EVP_CIPHER *EVP_aes_192_ccm(void);\r
const EVP_CIPHER *EVP_aes_256_ecb(void);\r
const EVP_CIPHER *EVP_aes_256_cbc(void);\r
const EVP_CIPHER *EVP_aes_256_cfb1(void);\r
const EVP_CIPHER *EVP_aes_256_cfb128(void);\r
# define EVP_aes_256_cfb EVP_aes_256_cfb128\r
const EVP_CIPHER *EVP_aes_256_ofb(void);\r
-#if 0\r
const EVP_CIPHER *EVP_aes_256_ctr(void);\r
+const EVP_CIPHER *EVP_aes_256_gcm(void);\r
+const EVP_CIPHER *EVP_aes_256_ccm(void);\r
+const EVP_CIPHER *EVP_aes_256_xts(void);\r
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)\r
+const EVP_CIPHER *EVP_aes_128_cbc_hmac_sha1(void);\r
+const EVP_CIPHER *EVP_aes_256_cbc_hmac_sha1(void);\r
#endif\r
#endif\r
#ifndef OPENSSL_NO_CAMELLIA\r
#define EVP_PKEY_CTRL_CMS_DECRYPT 10\r
#define EVP_PKEY_CTRL_CMS_SIGN 11\r
\r
+#define EVP_PKEY_CTRL_CIPHER 12\r
+\r
#define EVP_PKEY_ALG_CTRL 0x1000\r
\r
\r
#define EVP_PKEY_FLAG_AUTOARGLEN 2\r
+/* Method handles all operations: don't assume any digest related\r
+ * defaults.\r
+ */\r
+#define EVP_PKEY_FLAG_SIGCTX_CUSTOM 4\r
\r
const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type);\r
EVP_PKEY_METHOD* EVP_PKEY_meth_new(int id, int flags);\r
+void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,\r
+ const EVP_PKEY_METHOD *meth);\r
+void EVP_PKEY_meth_copy(EVP_PKEY_METHOD *dst, const EVP_PKEY_METHOD *src);\r
void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth);\r
int EVP_PKEY_meth_add0(const EVP_PKEY_METHOD *pmeth);\r
\r
void EVP_PKEY_CTX_set0_keygen_info(EVP_PKEY_CTX *ctx, int *dat, int datlen);\r
\r
EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e,\r
- unsigned char *key, int keylen);\r
+ const unsigned char *key, int keylen);\r
\r
void EVP_PKEY_CTX_set_data(EVP_PKEY_CTX *ctx, void *data);\r
void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx);\r
/* Error codes for the EVP functions. */\r
\r
/* Function codes. */\r
+#define EVP_F_AESNI_INIT_KEY 165\r
+#define EVP_F_AESNI_XTS_CIPHER 176\r
#define EVP_F_AES_INIT_KEY 133\r
+#define EVP_F_AES_XTS 172\r
+#define EVP_F_AES_XTS_CIPHER 175\r
#define EVP_F_CAMELLIA_INIT_KEY 159\r
+#define EVP_F_CMAC_INIT 173\r
#define EVP_F_D2I_PKEY 100\r
#define EVP_F_DO_SIGVER_INIT 161\r
#define EVP_F_DSAPKEY2PKCS8 134\r
#define EVP_F_EVP_RIJNDAEL 126\r
#define EVP_F_EVP_SIGNFINAL 107\r
#define EVP_F_EVP_VERIFYFINAL 108\r
+#define EVP_F_FIPS_CIPHERINIT 166\r
+#define EVP_F_FIPS_CIPHER_CTX_COPY 170\r
+#define EVP_F_FIPS_CIPHER_CTX_CTRL 167\r
+#define EVP_F_FIPS_CIPHER_CTX_SET_KEY_LENGTH 171\r
+#define EVP_F_FIPS_DIGESTINIT 168\r
+#define EVP_F_FIPS_MD_CTX_COPY 169\r
+#define EVP_F_HMAC_INIT_EX 174\r
#define EVP_F_INT_CTX_NEW 157\r
#define EVP_F_PKCS5_PBE_KEYIVGEN 117\r
#define EVP_F_PKCS5_V2_PBE_KEYIVGEN 118\r
+#define EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN 164\r
#define EVP_F_PKCS8_SET_BROKEN 112\r
#define EVP_F_PKEY_SET_TYPE 158\r
#define EVP_F_RC2_MAGIC_TO_METH 109\r
#define EVP_F_RC5_CTRL 125\r
\r
/* Reason codes. */\r
+#define EVP_R_AES_IV_SETUP_FAILED 162\r
#define EVP_R_AES_KEY_SETUP_FAILED 143\r
#define EVP_R_ASN1_LIB 140\r
#define EVP_R_BAD_BLOCK_LENGTH 136\r
#define EVP_R_DECODE_ERROR 114\r
#define EVP_R_DIFFERENT_KEY_TYPES 101\r
#define EVP_R_DIFFERENT_PARAMETERS 153\r
+#define EVP_R_DISABLED_FOR_FIPS 163\r
#define EVP_R_ENCODE_ERROR 115\r
#define EVP_R_EVP_PBE_CIPHERINIT_ERROR 119\r
#define EVP_R_EXPECTING_AN_RSA_KEY 127\r
#define EVP_R_PRIVATE_KEY_DECODE_ERROR 145\r
#define EVP_R_PRIVATE_KEY_ENCODE_ERROR 146\r
#define EVP_R_PUBLIC_KEY_NOT_RSA 106\r
+#define EVP_R_TOO_LARGE 164\r
#define EVP_R_UNKNOWN_CIPHER 160\r
#define EVP_R_UNKNOWN_DIGEST 161\r
#define EVP_R_UNKNOWN_PBE_ALGORITHM 121\r
const char *idea_options(void);\r
void idea_ecb_encrypt(const unsigned char *in, unsigned char *out,\r
IDEA_KEY_SCHEDULE *ks);\r
+#ifdef OPENSSL_FIPS\r
+void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);\r
+#endif\r
void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);\r
void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);\r
void idea_cbc_encrypt(const unsigned char *in, unsigned char *out,\r
krb5_timestamp *atimep, KSSL_ERR *kssl_err);\r
unsigned char *kssl_skip_confound(krb5_enctype enctype, unsigned char *authn);\r
\r
+void SSL_set0_kssl_ctx(SSL *s, KSSL_CTX *kctx);\r
+KSSL_CTX * SSL_get0_kssl_ctx(SSL *s);\r
+char *kssl_ctx_get0_client_princ(KSSL_CTX *kctx);\r
+\r
#ifdef __cplusplus\r
}\r
#endif\r
unsigned int num;\r
} MD4_CTX;\r
\r
+#ifdef OPENSSL_FIPS\r
+int private_MD4_Init(MD4_CTX *c);\r
+#endif\r
int MD4_Init(MD4_CTX *c);\r
int MD4_Update(MD4_CTX *c, const void *data, size_t len);\r
int MD4_Final(unsigned char *md, MD4_CTX *c);\r
unsigned int num;\r
} MD5_CTX;\r
\r
+#ifdef OPENSSL_FIPS\r
+int private_MD5_Init(MD5_CTX *c);\r
+#endif\r
int MD5_Init(MD5_CTX *c);\r
int MD5_Update(MD5_CTX *c, const void *data, size_t len);\r
int MD5_Final(unsigned char *md, MD5_CTX *c);\r
} MDC2_CTX;\r
\r
\r
+#ifdef OPENSSL_FIPS\r
+int private_MDC2_Init(MDC2_CTX *c);\r
+#endif\r
int MDC2_Init(MDC2_CTX *c);\r
int MDC2_Update(MDC2_CTX *c, const unsigned char *data, size_t len);\r
int MDC2_Final(unsigned char *md, MDC2_CTX *c);\r
size_t len, const void *key,\r
unsigned char ivec[16], int enc);\r
\r
+typedef void (*ctr128_f)(const unsigned char *in, unsigned char *out,\r
+ size_t blocks, const void *key,\r
+ const unsigned char ivec[16]);\r
+\r
+typedef void (*ccm128_f)(const unsigned char *in, unsigned char *out,\r
+ size_t blocks, const void *key,\r
+ const unsigned char ivec[16],unsigned char cmac[16]);\r
+\r
void CRYPTO_cbc128_encrypt(const unsigned char *in, unsigned char *out,\r
size_t len, const void *key,\r
unsigned char ivec[16], block128_f block);\r
unsigned char ivec[16], unsigned char ecount_buf[16],\r
unsigned int *num, block128_f block);\r
\r
+void CRYPTO_ctr128_encrypt_ctr32(const unsigned char *in, unsigned char *out,\r
+ size_t len, const void *key,\r
+ unsigned char ivec[16], unsigned char ecount_buf[16],\r
+ unsigned int *num, ctr128_f ctr);\r
+\r
void CRYPTO_ofb128_encrypt(const unsigned char *in, unsigned char *out,\r
size_t len, const void *key,\r
unsigned char ivec[16], int *num,\r
size_t CRYPTO_cts128_decrypt(const unsigned char *in, unsigned char *out,\r
size_t len, const void *key,\r
unsigned char ivec[16], cbc128_f cbc);\r
+\r
+size_t CRYPTO_nistcts128_encrypt_block(const unsigned char *in, unsigned char *out,\r
+ size_t len, const void *key,\r
+ unsigned char ivec[16], block128_f block);\r
+size_t CRYPTO_nistcts128_encrypt(const unsigned char *in, unsigned char *out,\r
+ size_t len, const void *key,\r
+ unsigned char ivec[16], cbc128_f cbc);\r
+size_t CRYPTO_nistcts128_decrypt_block(const unsigned char *in, unsigned char *out,\r
+ size_t len, const void *key,\r
+ unsigned char ivec[16], block128_f block);\r
+size_t CRYPTO_nistcts128_decrypt(const unsigned char *in, unsigned char *out,\r
+ size_t len, const void *key,\r
+ unsigned char ivec[16], cbc128_f cbc);\r
+\r
+typedef struct gcm128_context GCM128_CONTEXT;\r
+\r
+GCM128_CONTEXT *CRYPTO_gcm128_new(void *key, block128_f block);\r
+void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx,void *key,block128_f block);\r
+void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx, const unsigned char *iv,\r
+ size_t len);\r
+int CRYPTO_gcm128_aad(GCM128_CONTEXT *ctx, const unsigned char *aad,\r
+ size_t len);\r
+int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,\r
+ const unsigned char *in, unsigned char *out,\r
+ size_t len);\r
+int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,\r
+ const unsigned char *in, unsigned char *out,\r
+ size_t len);\r
+int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,\r
+ const unsigned char *in, unsigned char *out,\r
+ size_t len, ctr128_f stream);\r
+int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,\r
+ const unsigned char *in, unsigned char *out,\r
+ size_t len, ctr128_f stream);\r
+int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx,const unsigned char *tag,\r
+ size_t len);\r
+void CRYPTO_gcm128_tag(GCM128_CONTEXT *ctx, unsigned char *tag, size_t len);\r
+void CRYPTO_gcm128_release(GCM128_CONTEXT *ctx);\r
+\r
+typedef struct ccm128_context CCM128_CONTEXT;\r
+\r
+void CRYPTO_ccm128_init(CCM128_CONTEXT *ctx,\r
+ unsigned int M, unsigned int L, void *key,block128_f block);\r
+int CRYPTO_ccm128_setiv(CCM128_CONTEXT *ctx,\r
+ const unsigned char *nonce, size_t nlen, size_t mlen);\r
+void CRYPTO_ccm128_aad(CCM128_CONTEXT *ctx,\r
+ const unsigned char *aad, size_t alen);\r
+int CRYPTO_ccm128_encrypt(CCM128_CONTEXT *ctx,\r
+ const unsigned char *inp, unsigned char *out, size_t len);\r
+int CRYPTO_ccm128_decrypt(CCM128_CONTEXT *ctx,\r
+ const unsigned char *inp, unsigned char *out, size_t len);\r
+int CRYPTO_ccm128_encrypt_ccm64(CCM128_CONTEXT *ctx,\r
+ const unsigned char *inp, unsigned char *out, size_t len,\r
+ ccm128_f stream);\r
+int CRYPTO_ccm128_decrypt_ccm64(CCM128_CONTEXT *ctx,\r
+ const unsigned char *inp, unsigned char *out, size_t len,\r
+ ccm128_f stream);\r
+size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len);\r
+\r
+typedef struct xts128_context XTS128_CONTEXT;\r
+\r
+int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16],\r
+ const unsigned char *inp, unsigned char *out, size_t len, int enc);\r
#define NID_sha1WithRSAEncryption 65\r
#define OBJ_sha1WithRSAEncryption OBJ_pkcs1,5L\r
\r
+#define SN_rsaesOaep "RSAES-OAEP"\r
+#define LN_rsaesOaep "rsaesOaep"\r
+#define NID_rsaesOaep 919\r
+#define OBJ_rsaesOaep OBJ_pkcs1,7L\r
+\r
+#define SN_mgf1 "MGF1"\r
+#define LN_mgf1 "mgf1"\r
+#define NID_mgf1 911\r
+#define OBJ_mgf1 OBJ_pkcs1,8L\r
+\r
+#define SN_rsassaPss "RSASSA-PSS"\r
+#define LN_rsassaPss "rsassaPss"\r
+#define NID_rsassaPss 912\r
+#define OBJ_rsassaPss OBJ_pkcs1,10L\r
+\r
#define SN_sha256WithRSAEncryption "RSA-SHA256"\r
#define LN_sha256WithRSAEncryption "sha256WithRSAEncryption"\r
#define NID_sha256WithRSAEncryption 668\r
#define NID_id_smime_alg_CMSRC2wrap 247\r
#define OBJ_id_smime_alg_CMSRC2wrap OBJ_id_smime_alg,7L\r
\r
+#define SN_id_alg_PWRI_KEK "id-alg-PWRI-KEK"\r
+#define NID_id_alg_PWRI_KEK 893\r
+#define OBJ_id_alg_PWRI_KEK OBJ_id_smime_alg,9L\r
+\r
#define SN_id_smime_cd_ldap "id-smime-cd-ldap"\r
#define NID_id_smime_cd_ldap 248\r
#define OBJ_id_smime_cd_ldap OBJ_id_smime_cd,1L\r
#define NID_no_rev_avail 403\r
#define OBJ_no_rev_avail OBJ_id_ce,56L\r
\r
+#define SN_anyExtendedKeyUsage "anyExtendedKeyUsage"\r
+#define LN_anyExtendedKeyUsage "Any Extended Key Usage"\r
+#define NID_anyExtendedKeyUsage 910\r
+#define OBJ_anyExtendedKeyUsage OBJ_ext_key_usage,0L\r
+\r
#define SN_netscape "Netscape"\r
#define LN_netscape "Netscape Communications Corp."\r
#define NID_netscape 57\r
#define NID_aes_128_cfb128 421\r
#define OBJ_aes_128_cfb128 OBJ_aes,4L\r
\r
+#define SN_id_aes128_wrap "id-aes128-wrap"\r
+#define NID_id_aes128_wrap 788\r
+#define OBJ_id_aes128_wrap OBJ_aes,5L\r
+\r
+#define SN_aes_128_gcm "id-aes128-GCM"\r
+#define LN_aes_128_gcm "aes-128-gcm"\r
+#define NID_aes_128_gcm 895\r
+#define OBJ_aes_128_gcm OBJ_aes,6L\r
+\r
+#define SN_aes_128_ccm "id-aes128-CCM"\r
+#define LN_aes_128_ccm "aes-128-ccm"\r
+#define NID_aes_128_ccm 896\r
+#define OBJ_aes_128_ccm OBJ_aes,7L\r
+\r
+#define SN_id_aes128_wrap_pad "id-aes128-wrap-pad"\r
+#define NID_id_aes128_wrap_pad 897\r
+#define OBJ_id_aes128_wrap_pad OBJ_aes,8L\r
+\r
#define SN_aes_192_ecb "AES-192-ECB"\r
#define LN_aes_192_ecb "aes-192-ecb"\r
#define NID_aes_192_ecb 422\r
#define NID_aes_192_cfb128 425\r
#define OBJ_aes_192_cfb128 OBJ_aes,24L\r
\r
+#define SN_id_aes192_wrap "id-aes192-wrap"\r
+#define NID_id_aes192_wrap 789\r
+#define OBJ_id_aes192_wrap OBJ_aes,25L\r
+\r
+#define SN_aes_192_gcm "id-aes192-GCM"\r
+#define LN_aes_192_gcm "aes-192-gcm"\r
+#define NID_aes_192_gcm 898\r
+#define OBJ_aes_192_gcm OBJ_aes,26L\r
+\r
+#define SN_aes_192_ccm "id-aes192-CCM"\r
+#define LN_aes_192_ccm "aes-192-ccm"\r
+#define NID_aes_192_ccm 899\r
+#define OBJ_aes_192_ccm OBJ_aes,27L\r
+\r
+#define SN_id_aes192_wrap_pad "id-aes192-wrap-pad"\r
+#define NID_id_aes192_wrap_pad 900\r
+#define OBJ_id_aes192_wrap_pad OBJ_aes,28L\r
+\r
#define SN_aes_256_ecb "AES-256-ECB"\r
#define LN_aes_256_ecb "aes-256-ecb"\r
#define NID_aes_256_ecb 426\r
#define NID_aes_256_cfb128 429\r
#define OBJ_aes_256_cfb128 OBJ_aes,44L\r
\r
+#define SN_id_aes256_wrap "id-aes256-wrap"\r
+#define NID_id_aes256_wrap 790\r
+#define OBJ_id_aes256_wrap OBJ_aes,45L\r
+\r
+#define SN_aes_256_gcm "id-aes256-GCM"\r
+#define LN_aes_256_gcm "aes-256-gcm"\r
+#define NID_aes_256_gcm 901\r
+#define OBJ_aes_256_gcm OBJ_aes,46L\r
+\r
+#define SN_aes_256_ccm "id-aes256-CCM"\r
+#define LN_aes_256_ccm "aes-256-ccm"\r
+#define NID_aes_256_ccm 902\r
+#define OBJ_aes_256_ccm OBJ_aes,47L\r
+\r
+#define SN_id_aes256_wrap_pad "id-aes256-wrap-pad"\r
+#define NID_id_aes256_wrap_pad 903\r
+#define OBJ_id_aes256_wrap_pad OBJ_aes,48L\r
+\r
#define SN_aes_128_cfb1 "AES-128-CFB1"\r
#define LN_aes_128_cfb1 "aes-128-cfb1"\r
#define NID_aes_128_cfb1 650\r
#define LN_aes_256_cfb8 "aes-256-cfb8"\r
#define NID_aes_256_cfb8 655\r
\r
+#define SN_aes_128_ctr "AES-128-CTR"\r
+#define LN_aes_128_ctr "aes-128-ctr"\r
+#define NID_aes_128_ctr 904\r
+\r
+#define SN_aes_192_ctr "AES-192-CTR"\r
+#define LN_aes_192_ctr "aes-192-ctr"\r
+#define NID_aes_192_ctr 905\r
+\r
+#define SN_aes_256_ctr "AES-256-CTR"\r
+#define LN_aes_256_ctr "aes-256-ctr"\r
+#define NID_aes_256_ctr 906\r
+\r
+#define SN_aes_128_xts "AES-128-XTS"\r
+#define LN_aes_128_xts "aes-128-xts"\r
+#define NID_aes_128_xts 913\r
+\r
+#define SN_aes_256_xts "AES-256-XTS"\r
+#define LN_aes_256_xts "aes-256-xts"\r
+#define NID_aes_256_xts 914\r
+\r
#define SN_des_cfb1 "DES-CFB1"\r
#define LN_des_cfb1 "des-cfb1"\r
#define NID_des_cfb1 656\r
#define LN_des_ede3_cfb8 "des-ede3-cfb8"\r
#define NID_des_ede3_cfb8 659\r
\r
-#define SN_id_aes128_wrap "id-aes128-wrap"\r
-#define NID_id_aes128_wrap 788\r
-#define OBJ_id_aes128_wrap OBJ_aes,5L\r
-\r
-#define SN_id_aes192_wrap "id-aes192-wrap"\r
-#define NID_id_aes192_wrap 789\r
-#define OBJ_id_aes192_wrap OBJ_aes,25L\r
-\r
-#define SN_id_aes256_wrap "id-aes256-wrap"\r
-#define NID_id_aes256_wrap 790\r
-#define OBJ_id_aes256_wrap OBJ_aes,45L\r
-\r
#define OBJ_nist_hashalgs OBJ_nistAlgorithms,2L\r
\r
#define SN_sha256 "SHA256"\r
#define NID_camellia_256_cbc 753\r
#define OBJ_camellia_256_cbc 1L,2L,392L,200011L,61L,1L,1L,1L,4L\r
\r
+#define SN_id_camellia128_wrap "id-camellia128-wrap"\r
+#define NID_id_camellia128_wrap 907\r
+#define OBJ_id_camellia128_wrap 1L,2L,392L,200011L,61L,1L,1L,3L,2L\r
+\r
+#define SN_id_camellia192_wrap "id-camellia192-wrap"\r
+#define NID_id_camellia192_wrap 908\r
+#define OBJ_id_camellia192_wrap 1L,2L,392L,200011L,61L,1L,1L,3L,3L\r
+\r
+#define SN_id_camellia256_wrap "id-camellia256-wrap"\r
+#define NID_id_camellia256_wrap 909\r
+#define OBJ_id_camellia256_wrap 1L,2L,392L,200011L,61L,1L,1L,3L,4L\r
+\r
#define OBJ_ntt_ds 0L,3L,4401L,5L\r
\r
#define OBJ_camellia OBJ_ntt_ds,3L,1L,9L\r
#define LN_hmac "hmac"\r
#define NID_hmac 855\r
\r
+#define SN_cmac "CMAC"\r
+#define LN_cmac "cmac"\r
+#define NID_cmac 894\r
+\r
+#define SN_rc4_hmac_md5 "RC4-HMAC-MD5"\r
+#define LN_rc4_hmac_md5 "rc4-hmac-md5"\r
+#define NID_rc4_hmac_md5 915\r
+\r
+#define SN_aes_128_cbc_hmac_sha1 "AES-128-CBC-HMAC-SHA1"\r
+#define LN_aes_128_cbc_hmac_sha1 "aes-128-cbc-hmac-sha1"\r
+#define NID_aes_128_cbc_hmac_sha1 916\r
+\r
+#define SN_aes_192_cbc_hmac_sha1 "AES-192-CBC-HMAC-SHA1"\r
+#define LN_aes_192_cbc_hmac_sha1 "aes-192-cbc-hmac-sha1"\r
+#define NID_aes_192_cbc_hmac_sha1 917\r
+\r
+#define SN_aes_256_cbc_hmac_sha1 "AES-256-CBC-HMAC-SHA1"\r
+#define LN_aes_256_cbc_hmac_sha1 "aes-256-cbc-hmac-sha1"\r
+#define NID_aes_256_cbc_hmac_sha1 918\r
+\r
#ifndef OPENSSL_DOING_MAKEDEPEND\r
\r
\r
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128\r
+# define OPENSSL_NO_EC_NISTP_64_GCC_128\r
+#endif\r
#ifndef OPENSSL_NO_GMP\r
# define OPENSSL_NO_GMP\r
#endif\r
#ifndef OPENSSL_NO_RFC3779\r
# define OPENSSL_NO_RFC3779\r
#endif\r
+#ifndef OPENSSL_NO_SCTP\r
+# define OPENSSL_NO_SCTP\r
+#endif\r
#ifndef OPENSSL_NO_STORE\r
# define OPENSSL_NO_STORE\r
#endif\r
who haven't had the time to do the appropriate changes in their\r
applications. */\r
#ifdef OPENSSL_ALGORITHM_DEFINES\r
+# if defined(OPENSSL_NO_EC_NISTP_64_GCC_128) && !defined(NO_EC_NISTP_64_GCC_128)\r
+# define NO_EC_NISTP_64_GCC_128\r
+# endif\r
# if defined(OPENSSL_NO_GMP) && !defined(NO_GMP)\r
# define NO_GMP\r
# endif\r
# if defined(OPENSSL_NO_RFC3779) && !defined(NO_RFC3779)\r
# define NO_RFC3779\r
# endif\r
+# if defined(OPENSSL_NO_SCTP) && !defined(NO_SCTP)\r
+# define NO_SCTP\r
+# endif\r
# if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)\r
# define NO_STORE\r
# endif\r
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for\r
* major minor fix final patch/beta)\r
*/\r
-#define OPENSSL_VERSION_NUMBER 0x1000007fL\r
+#define OPENSSL_VERSION_NUMBER 0x1000102fL\r
#ifdef OPENSSL_FIPS\r
-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.0g-fips 18 Jan 2012"\r
+#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1b-fips 26 Apr 2012"\r
#else\r
-#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.0g 18 Jan 2012"\r
+#define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1b 26 Apr 2012"\r
#endif\r
#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT\r
\r
typedef struct asn1_string_st ASN1_GENERALIZEDTIME;\r
typedef struct asn1_string_st ASN1_VISIBLESTRING;\r
typedef struct asn1_string_st ASN1_UTF8STRING;\r
+typedef struct asn1_string_st ASN1_STRING;\r
typedef int ASN1_BOOLEAN;\r
typedef int ASN1_NULL;\r
#endif\r
\r
+typedef struct ASN1_ITEM_st ASN1_ITEM;\r
typedef struct asn1_pctx_st ASN1_PCTX;\r
\r
#ifdef OPENSSL_SYS_WIN32\r
\r
#endif\r
\r
+#ifdef OPENSSL_FIPS\r
+void RAND_set_fips_drbg_type(int type, int flags);\r
+int RAND_init_fips(void);\r
+#endif\r
+\r
/* BEGIN ERROR CODES */\r
/* The following lines are auto generated by the script mkerr.pl. Any changes\r
* made after this point may be overwritten when the script is next run.\r
\r
/* Function codes. */\r
#define RAND_F_RAND_GET_RAND_METHOD 101\r
+#define RAND_F_RAND_INIT_FIPS 102\r
#define RAND_F_SSLEAY_RAND_BYTES 100\r
\r
/* Reason codes. */\r
+#define RAND_R_ERROR_INITIALISING_DRBG 102\r
+#define RAND_R_ERROR_INSTANTIATING_DRBG 103\r
+#define RAND_R_NO_FIPS_RANDOM_METHOD_SET 101\r
#define RAND_R_PRNG_NOT_SEEDED 100\r
\r
#ifdef __cplusplus\r
RC2_INT data[64];\r
} RC2_KEY;\r
\r
-\r
+#ifdef OPENSSL_FIPS\r
+void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);\r
+#endif\r
void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);\r
void RC2_ecb_encrypt(const unsigned char *in,unsigned char *out,RC2_KEY *key,\r
int enc);\r
\r
const char *RC4_options(void);\r
void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);\r
+void private_RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);\r
void RC4(RC4_KEY *key, size_t len, const unsigned char *indata,\r
unsigned char *outdata);\r
\r
unsigned int num;\r
} RIPEMD160_CTX;\r
\r
+#ifdef OPENSSL_FIPS\r
+int private_RIPEMD160_Init(RIPEMD160_CTX *c);\r
+#endif\r
int RIPEMD160_Init(RIPEMD160_CTX *c);\r
int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len);\r
int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);\r
EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, \\r
pad, NULL)\r
\r
+#define EVP_PKEY_CTX_get_rsa_padding(ctx, ppad) \\r
+ EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, \\r
+ EVP_PKEY_CTRL_GET_RSA_PADDING, 0, ppad)\r
+\r
#define EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, len) \\r
EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, \\r
(EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \\r
EVP_PKEY_CTRL_RSA_PSS_SALTLEN, \\r
len, NULL)\r
\r
+#define EVP_PKEY_CTX_get_rsa_pss_saltlen(ctx, plen) \\r
+ EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, \\r
+ (EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \\r
+ EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN, \\r
+ 0, plen)\r
+\r
#define EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) \\r
EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, \\r
EVP_PKEY_CTRL_RSA_KEYGEN_BITS, bits, NULL)\r
EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, \\r
EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp)\r
\r
+#define EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, md) \\r
+ EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_SIG, \\r
+ EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)md)\r
+\r
+#define EVP_PKEY_CTX_get_rsa_mgf1_md(ctx, pmd) \\r
+ EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_SIG, \\r
+ EVP_PKEY_CTRL_GET_RSA_MGF1_MD, 0, (void *)pmd)\r
+\r
#define EVP_PKEY_CTRL_RSA_PADDING (EVP_PKEY_ALG_CTRL + 1)\r
#define EVP_PKEY_CTRL_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 2)\r
\r
#define EVP_PKEY_CTRL_RSA_KEYGEN_BITS (EVP_PKEY_ALG_CTRL + 3)\r
#define EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP (EVP_PKEY_ALG_CTRL + 4)\r
+#define EVP_PKEY_CTRL_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 5)\r
+\r
+#define EVP_PKEY_CTRL_GET_RSA_PADDING (EVP_PKEY_ALG_CTRL + 6)\r
+#define EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 7)\r
+#define EVP_PKEY_CTRL_GET_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 8)\r
\r
#define RSA_PKCS1_PADDING 1\r
#define RSA_SSLV23_PADDING 2\r
DECLARE_ASN1_ENCODE_FUNCTIONS_const(RSA, RSAPublicKey)\r
DECLARE_ASN1_ENCODE_FUNCTIONS_const(RSA, RSAPrivateKey)\r
\r
+typedef struct rsa_pss_params_st\r
+ {\r
+ X509_ALGOR *hashAlgorithm;\r
+ X509_ALGOR *maskGenAlgorithm;\r
+ ASN1_INTEGER *saltLength;\r
+ ASN1_INTEGER *trailerField;\r
+ } RSA_PSS_PARAMS;\r
+\r
+DECLARE_ASN1_FUNCTIONS(RSA_PSS_PARAMS)\r
+\r
#ifndef OPENSSL_NO_FP_API\r
int RSA_print_fp(FILE *fp, const RSA *r,int offset);\r
#endif\r
const unsigned char *mHash,\r
const EVP_MD *Hash, int sLen);\r
\r
+int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,\r
+ const EVP_MD *Hash, const EVP_MD *mgf1Hash,\r
+ const unsigned char *EM, int sLen);\r
+\r
+int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,\r
+ const unsigned char *mHash,\r
+ const EVP_MD *Hash, const EVP_MD *mgf1Hash, int sLen);\r
+\r
int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,\r
CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);\r
int RSA_set_ex_data(RSA *r,int idx,void *arg);\r
RSA *RSAPublicKey_dup(RSA *rsa);\r
RSA *RSAPrivateKey_dup(RSA *rsa);\r
\r
+/* If this flag is set the RSA method is FIPS compliant and can be used\r
+ * in FIPS mode. This is set in the validated module method. If an\r
+ * application sets this flag in its own methods it is its responsibility\r
+ * to ensure the result is compliant.\r
+ */\r
+\r
+#define RSA_FLAG_FIPS_METHOD 0x0400\r
+\r
+/* If this flag is set the operations normally disabled in FIPS mode are\r
+ * permitted it is then the applications responsibility to ensure that the\r
+ * usage is compliant.\r
+ */\r
+\r
+#define RSA_FLAG_NON_FIPS_ALLOW 0x0400\r
+/* Application has decided PRNG is good enough to generate a key: don't\r
+ * check.\r
+ */\r
+#define RSA_FLAG_CHECKED 0x0800\r
+\r
/* BEGIN ERROR CODES */\r
/* The following lines are auto generated by the script mkerr.pl. Any changes\r
* made after this point may be overwritten when the script is next run.\r
#define RSA_F_PKEY_RSA_CTRL 143\r
#define RSA_F_PKEY_RSA_CTRL_STR 144\r
#define RSA_F_PKEY_RSA_SIGN 142\r
+#define RSA_F_PKEY_RSA_VERIFY 154\r
#define RSA_F_PKEY_RSA_VERIFYRECOVER 141\r
#define RSA_F_RSA_BUILTIN_KEYGEN 129\r
#define RSA_F_RSA_CHECK_KEY 123\r
#define RSA_F_RSA_EAY_PUBLIC_DECRYPT 103\r
#define RSA_F_RSA_EAY_PUBLIC_ENCRYPT 104\r
#define RSA_F_RSA_GENERATE_KEY 105\r
+#define RSA_F_RSA_GENERATE_KEY_EX 155\r
+#define RSA_F_RSA_ITEM_VERIFY 156\r
#define RSA_F_RSA_MEMORY_LOCK 130\r
#define RSA_F_RSA_NEW_METHOD 106\r
#define RSA_F_RSA_NULL 124\r
#define RSA_F_RSA_PADDING_ADD_NONE 107\r
#define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP 121\r
#define RSA_F_RSA_PADDING_ADD_PKCS1_PSS 125\r
+#define RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1 148\r
#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1 108\r
#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2 109\r
#define RSA_F_RSA_PADDING_ADD_SSLV23 110\r
#define RSA_F_RSA_PADDING_CHECK_X931 128\r
#define RSA_F_RSA_PRINT 115\r
#define RSA_F_RSA_PRINT_FP 116\r
+#define RSA_F_RSA_PRIVATE_DECRYPT 150\r
+#define RSA_F_RSA_PRIVATE_ENCRYPT 151\r
#define RSA_F_RSA_PRIV_DECODE 137\r
#define RSA_F_RSA_PRIV_ENCODE 138\r
+#define RSA_F_RSA_PUBLIC_DECRYPT 152\r
+#define RSA_F_RSA_PUBLIC_ENCRYPT 153\r
#define RSA_F_RSA_PUB_DECODE 139\r
#define RSA_F_RSA_SETUP_BLINDING 136\r
#define RSA_F_RSA_SIGN 117\r
#define RSA_F_RSA_VERIFY 119\r
#define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING 120\r
#define RSA_F_RSA_VERIFY_PKCS1_PSS 126\r
+#define RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1 149\r
\r
/* Reason codes. */\r
#define RSA_R_ALGORITHM_MISMATCH 100\r
#define RSA_R_INVALID_HEADER 137\r
#define RSA_R_INVALID_KEYBITS 145\r
#define RSA_R_INVALID_MESSAGE_LENGTH 131\r
+#define RSA_R_INVALID_MGF1_MD 156\r
#define RSA_R_INVALID_PADDING 138\r
#define RSA_R_INVALID_PADDING_MODE 141\r
+#define RSA_R_INVALID_PSS_PARAMETERS 149\r
#define RSA_R_INVALID_PSS_SALTLEN 146\r
+#define RSA_R_INVALID_SALT_LENGTH 150\r
#define RSA_R_INVALID_TRAILER 139\r
#define RSA_R_INVALID_X931_DIGEST 142\r
#define RSA_R_IQMP_NOT_INVERSE_OF_Q 126\r
#define RSA_R_KEY_SIZE_TOO_SMALL 120\r
#define RSA_R_LAST_OCTET_INVALID 134\r
#define RSA_R_MODULUS_TOO_LARGE 105\r
+#define RSA_R_NON_FIPS_RSA_METHOD 157\r
#define RSA_R_NO_PUBLIC_EXPONENT 140\r
#define RSA_R_NULL_BEFORE_BLOCK_MISSING 113\r
#define RSA_R_N_DOES_NOT_EQUAL_P_Q 127\r
#define RSA_R_OAEP_DECODING_ERROR 121\r
+#define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE 158\r
#define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 148\r
#define RSA_R_PADDING_CHECK_FAILED 114\r
#define RSA_R_P_NOT_PRIME 128\r
#define RSA_R_SSLV3_ROLLBACK_ATTACK 115\r
#define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116\r
#define RSA_R_UNKNOWN_ALGORITHM_TYPE 117\r
+#define RSA_R_UNKNOWN_MASK_DIGEST 151\r
#define RSA_R_UNKNOWN_PADDING_TYPE 118\r
+#define RSA_R_UNKNOWN_PSS_DIGEST 152\r
+#define RSA_R_UNSUPPORTED_MASK_ALGORITHM 153\r
+#define RSA_R_UNSUPPORTED_MASK_PARAMETER 154\r
+#define RSA_R_UNSUPPORTED_SIGNATURE_TYPE 155\r
#define RSA_R_VALUE_MISSING 147\r
#define RSA_R_WRONG_SIGNATURE_LENGTH 119\r
\r
#define sk_POLICY_MAPPING_sort(st) SKM_sk_sort(POLICY_MAPPING, (st))\r
#define sk_POLICY_MAPPING_is_sorted(st) SKM_sk_is_sorted(POLICY_MAPPING, (st))\r
\r
+#define sk_SRP_gN_new(cmp) SKM_sk_new(SRP_gN, (cmp))\r
+#define sk_SRP_gN_new_null() SKM_sk_new_null(SRP_gN)\r
+#define sk_SRP_gN_free(st) SKM_sk_free(SRP_gN, (st))\r
+#define sk_SRP_gN_num(st) SKM_sk_num(SRP_gN, (st))\r
+#define sk_SRP_gN_value(st, i) SKM_sk_value(SRP_gN, (st), (i))\r
+#define sk_SRP_gN_set(st, i, val) SKM_sk_set(SRP_gN, (st), (i), (val))\r
+#define sk_SRP_gN_zero(st) SKM_sk_zero(SRP_gN, (st))\r
+#define sk_SRP_gN_push(st, val) SKM_sk_push(SRP_gN, (st), (val))\r
+#define sk_SRP_gN_unshift(st, val) SKM_sk_unshift(SRP_gN, (st), (val))\r
+#define sk_SRP_gN_find(st, val) SKM_sk_find(SRP_gN, (st), (val))\r
+#define sk_SRP_gN_find_ex(st, val) SKM_sk_find_ex(SRP_gN, (st), (val))\r
+#define sk_SRP_gN_delete(st, i) SKM_sk_delete(SRP_gN, (st), (i))\r
+#define sk_SRP_gN_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRP_gN, (st), (ptr))\r
+#define sk_SRP_gN_insert(st, val, i) SKM_sk_insert(SRP_gN, (st), (val), (i))\r
+#define sk_SRP_gN_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRP_gN, (st), (cmp))\r
+#define sk_SRP_gN_dup(st) SKM_sk_dup(SRP_gN, st)\r
+#define sk_SRP_gN_pop_free(st, free_func) SKM_sk_pop_free(SRP_gN, (st), (free_func))\r
+#define sk_SRP_gN_shift(st) SKM_sk_shift(SRP_gN, (st))\r
+#define sk_SRP_gN_pop(st) SKM_sk_pop(SRP_gN, (st))\r
+#define sk_SRP_gN_sort(st) SKM_sk_sort(SRP_gN, (st))\r
+#define sk_SRP_gN_is_sorted(st) SKM_sk_is_sorted(SRP_gN, (st))\r
+\r
+#define sk_SRP_gN_cache_new(cmp) SKM_sk_new(SRP_gN_cache, (cmp))\r
+#define sk_SRP_gN_cache_new_null() SKM_sk_new_null(SRP_gN_cache)\r
+#define sk_SRP_gN_cache_free(st) SKM_sk_free(SRP_gN_cache, (st))\r
+#define sk_SRP_gN_cache_num(st) SKM_sk_num(SRP_gN_cache, (st))\r
+#define sk_SRP_gN_cache_value(st, i) SKM_sk_value(SRP_gN_cache, (st), (i))\r
+#define sk_SRP_gN_cache_set(st, i, val) SKM_sk_set(SRP_gN_cache, (st), (i), (val))\r
+#define sk_SRP_gN_cache_zero(st) SKM_sk_zero(SRP_gN_cache, (st))\r
+#define sk_SRP_gN_cache_push(st, val) SKM_sk_push(SRP_gN_cache, (st), (val))\r
+#define sk_SRP_gN_cache_unshift(st, val) SKM_sk_unshift(SRP_gN_cache, (st), (val))\r
+#define sk_SRP_gN_cache_find(st, val) SKM_sk_find(SRP_gN_cache, (st), (val))\r
+#define sk_SRP_gN_cache_find_ex(st, val) SKM_sk_find_ex(SRP_gN_cache, (st), (val))\r
+#define sk_SRP_gN_cache_delete(st, i) SKM_sk_delete(SRP_gN_cache, (st), (i))\r
+#define sk_SRP_gN_cache_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRP_gN_cache, (st), (ptr))\r
+#define sk_SRP_gN_cache_insert(st, val, i) SKM_sk_insert(SRP_gN_cache, (st), (val), (i))\r
+#define sk_SRP_gN_cache_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRP_gN_cache, (st), (cmp))\r
+#define sk_SRP_gN_cache_dup(st) SKM_sk_dup(SRP_gN_cache, st)\r
+#define sk_SRP_gN_cache_pop_free(st, free_func) SKM_sk_pop_free(SRP_gN_cache, (st), (free_func))\r
+#define sk_SRP_gN_cache_shift(st) SKM_sk_shift(SRP_gN_cache, (st))\r
+#define sk_SRP_gN_cache_pop(st) SKM_sk_pop(SRP_gN_cache, (st))\r
+#define sk_SRP_gN_cache_sort(st) SKM_sk_sort(SRP_gN_cache, (st))\r
+#define sk_SRP_gN_cache_is_sorted(st) SKM_sk_is_sorted(SRP_gN_cache, (st))\r
+\r
+#define sk_SRP_user_pwd_new(cmp) SKM_sk_new(SRP_user_pwd, (cmp))\r
+#define sk_SRP_user_pwd_new_null() SKM_sk_new_null(SRP_user_pwd)\r
+#define sk_SRP_user_pwd_free(st) SKM_sk_free(SRP_user_pwd, (st))\r
+#define sk_SRP_user_pwd_num(st) SKM_sk_num(SRP_user_pwd, (st))\r
+#define sk_SRP_user_pwd_value(st, i) SKM_sk_value(SRP_user_pwd, (st), (i))\r
+#define sk_SRP_user_pwd_set(st, i, val) SKM_sk_set(SRP_user_pwd, (st), (i), (val))\r
+#define sk_SRP_user_pwd_zero(st) SKM_sk_zero(SRP_user_pwd, (st))\r
+#define sk_SRP_user_pwd_push(st, val) SKM_sk_push(SRP_user_pwd, (st), (val))\r
+#define sk_SRP_user_pwd_unshift(st, val) SKM_sk_unshift(SRP_user_pwd, (st), (val))\r
+#define sk_SRP_user_pwd_find(st, val) SKM_sk_find(SRP_user_pwd, (st), (val))\r
+#define sk_SRP_user_pwd_find_ex(st, val) SKM_sk_find_ex(SRP_user_pwd, (st), (val))\r
+#define sk_SRP_user_pwd_delete(st, i) SKM_sk_delete(SRP_user_pwd, (st), (i))\r
+#define sk_SRP_user_pwd_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRP_user_pwd, (st), (ptr))\r
+#define sk_SRP_user_pwd_insert(st, val, i) SKM_sk_insert(SRP_user_pwd, (st), (val), (i))\r
+#define sk_SRP_user_pwd_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRP_user_pwd, (st), (cmp))\r
+#define sk_SRP_user_pwd_dup(st) SKM_sk_dup(SRP_user_pwd, st)\r
+#define sk_SRP_user_pwd_pop_free(st, free_func) SKM_sk_pop_free(SRP_user_pwd, (st), (free_func))\r
+#define sk_SRP_user_pwd_shift(st) SKM_sk_shift(SRP_user_pwd, (st))\r
+#define sk_SRP_user_pwd_pop(st) SKM_sk_pop(SRP_user_pwd, (st))\r
+#define sk_SRP_user_pwd_sort(st) SKM_sk_sort(SRP_user_pwd, (st))\r
+#define sk_SRP_user_pwd_is_sorted(st) SKM_sk_is_sorted(SRP_user_pwd, (st))\r
+\r
+#define sk_SRTP_PROTECTION_PROFILE_new(cmp) SKM_sk_new(SRTP_PROTECTION_PROFILE, (cmp))\r
+#define sk_SRTP_PROTECTION_PROFILE_new_null() SKM_sk_new_null(SRTP_PROTECTION_PROFILE)\r
+#define sk_SRTP_PROTECTION_PROFILE_free(st) SKM_sk_free(SRTP_PROTECTION_PROFILE, (st))\r
+#define sk_SRTP_PROTECTION_PROFILE_num(st) SKM_sk_num(SRTP_PROTECTION_PROFILE, (st))\r
+#define sk_SRTP_PROTECTION_PROFILE_value(st, i) SKM_sk_value(SRTP_PROTECTION_PROFILE, (st), (i))\r
+#define sk_SRTP_PROTECTION_PROFILE_set(st, i, val) SKM_sk_set(SRTP_PROTECTION_PROFILE, (st), (i), (val))\r
+#define sk_SRTP_PROTECTION_PROFILE_zero(st) SKM_sk_zero(SRTP_PROTECTION_PROFILE, (st))\r
+#define sk_SRTP_PROTECTION_PROFILE_push(st, val) SKM_sk_push(SRTP_PROTECTION_PROFILE, (st), (val))\r
+#define sk_SRTP_PROTECTION_PROFILE_unshift(st, val) SKM_sk_unshift(SRTP_PROTECTION_PROFILE, (st), (val))\r
+#define sk_SRTP_PROTECTION_PROFILE_find(st, val) SKM_sk_find(SRTP_PROTECTION_PROFILE, (st), (val))\r
+#define sk_SRTP_PROTECTION_PROFILE_find_ex(st, val) SKM_sk_find_ex(SRTP_PROTECTION_PROFILE, (st), (val))\r
+#define sk_SRTP_PROTECTION_PROFILE_delete(st, i) SKM_sk_delete(SRTP_PROTECTION_PROFILE, (st), (i))\r
+#define sk_SRTP_PROTECTION_PROFILE_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRTP_PROTECTION_PROFILE, (st), (ptr))\r
+#define sk_SRTP_PROTECTION_PROFILE_insert(st, val, i) SKM_sk_insert(SRTP_PROTECTION_PROFILE, (st), (val), (i))\r
+#define sk_SRTP_PROTECTION_PROFILE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRTP_PROTECTION_PROFILE, (st), (cmp))\r
+#define sk_SRTP_PROTECTION_PROFILE_dup(st) SKM_sk_dup(SRTP_PROTECTION_PROFILE, st)\r
+#define sk_SRTP_PROTECTION_PROFILE_pop_free(st, free_func) SKM_sk_pop_free(SRTP_PROTECTION_PROFILE, (st), (free_func))\r
+#define sk_SRTP_PROTECTION_PROFILE_shift(st) SKM_sk_shift(SRTP_PROTECTION_PROFILE, (st))\r
+#define sk_SRTP_PROTECTION_PROFILE_pop(st) SKM_sk_pop(SRTP_PROTECTION_PROFILE, (st))\r
+#define sk_SRTP_PROTECTION_PROFILE_sort(st) SKM_sk_sort(SRTP_PROTECTION_PROFILE, (st))\r
+#define sk_SRTP_PROTECTION_PROFILE_is_sorted(st) SKM_sk_is_sorted(SRTP_PROTECTION_PROFILE, (st))\r
+\r
#define sk_SSL_CIPHER_new(cmp) SKM_sk_new(SSL_CIPHER, (cmp))\r
#define sk_SSL_CIPHER_new_null() SKM_sk_new_null(SSL_CIPHER)\r
#define sk_SSL_CIPHER_free(st) SKM_sk_free(SSL_CIPHER, (st))\r
#define sk_OPENSSL_STRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_STRING, (st))\r
\r
\r
-#define sk_OPENSSL_PSTRING_new(cmp) ((STACK_OF(OPENSSL_PSTRING) *)sk_new(CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))\r
-#define sk_OPENSSL_PSTRING_new_null() ((STACK_OF(OPENSSL_PSTRING) *)sk_new_null())\r
-#define sk_OPENSSL_PSTRING_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))\r
-#define sk_OPENSSL_PSTRING_find(st, val) sk_find(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))\r
-#define sk_OPENSSL_PSTRING_value(st, i) ((OPENSSL_PSTRING)sk_value(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i))\r
-#define sk_OPENSSL_PSTRING_num(st) SKM_sk_num(OPENSSL_PSTRING, st)\r
-#define sk_OPENSSL_PSTRING_pop_free(st, free_func) sk_pop_free(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_FREE_FUNC2(OPENSSL_PSTRING, free_func))\r
-#define sk_OPENSSL_PSTRING_insert(st, val, i) sk_insert(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val), i)\r
-#define sk_OPENSSL_PSTRING_free(st) SKM_sk_free(OPENSSL_PSTRING, st)\r
-#define sk_OPENSSL_PSTRING_set(st, i, val) sk_set(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i, CHECKED_PTR_OF(OPENSSL_STRING, val))\r
-#define sk_OPENSSL_PSTRING_zero(st) SKM_sk_zero(OPENSSL_PSTRING, (st))\r
-#define sk_OPENSSL_PSTRING_unshift(st, val) sk_unshift(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))\r
-#define sk_OPENSSL_PSTRING_find_ex(st, val) sk_find_ex((_STACK *)CHECKED_CONST_PTR_OF(STACK_OF(OPENSSL_PSTRING), st), CHECKED_CONST_PTR_OF(OPENSSL_STRING, val))\r
-#define sk_OPENSSL_PSTRING_delete(st, i) SKM_sk_delete(OPENSSL_PSTRING, (st), (i))\r
-#define sk_OPENSSL_PSTRING_delete_ptr(st, ptr) (OPENSSL_PSTRING *)sk_delete_ptr(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, ptr))\r
-#define sk_OPENSSL_PSTRING_set_cmp_func(st, cmp) \\r
- ((int (*)(const OPENSSL_STRING * const *,const OPENSSL_STRING * const *)) \\r
- sk_set_cmp_func(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))\r
-#define sk_OPENSSL_PSTRING_dup(st) SKM_sk_dup(OPENSSL_PSTRING, st)\r
-#define sk_OPENSSL_PSTRING_shift(st) SKM_sk_shift(OPENSSL_PSTRING, (st))\r
-#define sk_OPENSSL_PSTRING_pop(st) (OPENSSL_STRING *)sk_pop(CHECKED_STACK_OF(OPENSSL_PSTRING, st))\r
-#define sk_OPENSSL_PSTRING_sort(st) SKM_sk_sort(OPENSSL_PSTRING, (st))\r
-#define sk_OPENSSL_PSTRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_PSTRING, (st))\r
-\r
-\r
#define sk_OPENSSL_BLOCK_new(cmp) ((STACK_OF(OPENSSL_BLOCK) *)sk_new(CHECKED_SK_CMP_FUNC(void, cmp)))\r
#define sk_OPENSSL_BLOCK_new_null() ((STACK_OF(OPENSSL_BLOCK) *)sk_new_null())\r
#define sk_OPENSSL_BLOCK_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_BLOCK, st), CHECKED_PTR_OF(void, val))\r
#define sk_OPENSSL_BLOCK_is_sorted(st) SKM_sk_is_sorted(OPENSSL_BLOCK, (st))\r
\r
\r
+#define sk_OPENSSL_PSTRING_new(cmp) ((STACK_OF(OPENSSL_PSTRING) *)sk_new(CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))\r
+#define sk_OPENSSL_PSTRING_new_null() ((STACK_OF(OPENSSL_PSTRING) *)sk_new_null())\r
+#define sk_OPENSSL_PSTRING_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))\r
+#define sk_OPENSSL_PSTRING_find(st, val) sk_find(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))\r
+#define sk_OPENSSL_PSTRING_value(st, i) ((OPENSSL_PSTRING)sk_value(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i))\r
+#define sk_OPENSSL_PSTRING_num(st) SKM_sk_num(OPENSSL_PSTRING, st)\r
+#define sk_OPENSSL_PSTRING_pop_free(st, free_func) sk_pop_free(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_FREE_FUNC2(OPENSSL_PSTRING, free_func))\r
+#define sk_OPENSSL_PSTRING_insert(st, val, i) sk_insert(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val), i)\r
+#define sk_OPENSSL_PSTRING_free(st) SKM_sk_free(OPENSSL_PSTRING, st)\r
+#define sk_OPENSSL_PSTRING_set(st, i, val) sk_set(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i, CHECKED_PTR_OF(OPENSSL_STRING, val))\r
+#define sk_OPENSSL_PSTRING_zero(st) SKM_sk_zero(OPENSSL_PSTRING, (st))\r
+#define sk_OPENSSL_PSTRING_unshift(st, val) sk_unshift(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))\r
+#define sk_OPENSSL_PSTRING_find_ex(st, val) sk_find_ex((_STACK *)CHECKED_CONST_PTR_OF(STACK_OF(OPENSSL_PSTRING), st), CHECKED_CONST_PTR_OF(OPENSSL_STRING, val))\r
+#define sk_OPENSSL_PSTRING_delete(st, i) SKM_sk_delete(OPENSSL_PSTRING, (st), (i))\r
+#define sk_OPENSSL_PSTRING_delete_ptr(st, ptr) (OPENSSL_PSTRING *)sk_delete_ptr(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, ptr))\r
+#define sk_OPENSSL_PSTRING_set_cmp_func(st, cmp) \\r
+ ((int (*)(const OPENSSL_STRING * const *,const OPENSSL_STRING * const *)) \\r
+ sk_set_cmp_func(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))\r
+#define sk_OPENSSL_PSTRING_dup(st) SKM_sk_dup(OPENSSL_PSTRING, st)\r
+#define sk_OPENSSL_PSTRING_shift(st) SKM_sk_shift(OPENSSL_PSTRING, (st))\r
+#define sk_OPENSSL_PSTRING_pop(st) (OPENSSL_STRING *)sk_pop(CHECKED_STACK_OF(OPENSSL_PSTRING, st))\r
+#define sk_OPENSSL_PSTRING_sort(st) SKM_sk_sort(OPENSSL_PSTRING, (st))\r
+#define sk_OPENSSL_PSTRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_PSTRING, (st))\r
+\r
+\r
#define d2i_ASN1_SET_OF_ACCESS_DESCRIPTION(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \\r
SKM_ASN1_SET_OF_d2i(ACCESS_DESCRIPTION, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class))\r
#define i2d_ASN1_SET_OF_ACCESS_DESCRIPTION(st, pp, i2d_func, ex_tag, ex_class, is_set) \\r
#endif\r
} SEED_KEY_SCHEDULE;\r
\r
-\r
+#ifdef OPENSSL_FIPS\r
+void private_SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);\r
+#endif\r
void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);\r
\r
void SEED_encrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks);\r
} SHA_CTX;\r
\r
#ifndef OPENSSL_NO_SHA0\r
+#ifdef OPENSSL_FIPS\r
+int private_SHA_Init(SHA_CTX *c);\r
+#endif\r
int SHA_Init(SHA_CTX *c);\r
int SHA_Update(SHA_CTX *c, const void *data, size_t len);\r
int SHA_Final(unsigned char *md, SHA_CTX *c);\r
void SHA_Transform(SHA_CTX *c, const unsigned char *data);\r
#endif\r
#ifndef OPENSSL_NO_SHA1\r
+#ifdef OPENSSL_FIPS\r
+int private_SHA1_Init(SHA_CTX *c);\r
+#endif\r
int SHA1_Init(SHA_CTX *c);\r
int SHA1_Update(SHA_CTX *c, const void *data, size_t len);\r
int SHA1_Final(unsigned char *md, SHA_CTX *c);\r
} SHA256_CTX;\r
\r
#ifndef OPENSSL_NO_SHA256\r
+#ifdef OPENSSL_FIPS\r
+int private_SHA224_Init(SHA256_CTX *c);\r
+int private_SHA256_Init(SHA256_CTX *c);\r
+#endif\r
int SHA224_Init(SHA256_CTX *c);\r
int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);\r
int SHA224_Final(unsigned char *md, SHA256_CTX *c);\r
#endif\r
\r
#ifndef OPENSSL_NO_SHA512\r
+#ifdef OPENSSL_FIPS\r
+int private_SHA384_Init(SHA512_CTX *c);\r
+int private_SHA512_Init(SHA512_CTX *c);\r
+#endif\r
int SHA384_Init(SHA512_CTX *c);\r
int SHA384_Update(SHA512_CTX *c, const void *data, size_t len);\r
int SHA384_Final(unsigned char *md, SHA512_CTX *c);\r
--- /dev/null
+/* crypto/srp/srp.h */\r
+/* Written by Christophe Renou (christophe.renou@edelweb.fr) with\r
+ * the precious help of Peter Sylvester (peter.sylvester@edelweb.fr)\r
+ * for the EdelKey project and contributed to the OpenSSL project 2004.\r
+ */\r
+/* ====================================================================\r
+ * Copyright (c) 2004 The OpenSSL Project. All rights reserved.\r
+ *\r
+ * Redistribution and use in source and binary forms, with or without\r
+ * modification, are permitted provided that the following conditions\r
+ * are met:\r
+ *\r
+ * 1. Redistributions of source code must retain the above copyright\r
+ * notice, this list of conditions and the following disclaimer.\r
+ *\r
+ * 2. Redistributions in binary form must reproduce the above copyright\r
+ * notice, this list of conditions and the following disclaimer in\r
+ * the documentation and/or other materials provided with the\r
+ * distribution.\r
+ *\r
+ * 3. All advertising materials mentioning features or use of this\r
+ * software must display the following acknowledgment:\r
+ * "This product includes software developed by the OpenSSL Project\r
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"\r
+ *\r
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to\r
+ * endorse or promote products derived from this software without\r
+ * prior written permission. For written permission, please contact\r
+ * licensing@OpenSSL.org.\r
+ *\r
+ * 5. Products derived from this software may not be called "OpenSSL"\r
+ * nor may "OpenSSL" appear in their names without prior written\r
+ * permission of the OpenSSL Project.\r
+ *\r
+ * 6. Redistributions of any form whatsoever must retain the following\r
+ * acknowledgment:\r
+ * "This product includes software developed by the OpenSSL Project\r
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"\r
+ *\r
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY\r
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\r
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\r
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR\r
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT\r
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\r
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\r
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)\r
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\r
+ * OF THE POSSIBILITY OF SUCH DAMAGE.\r
+ * ====================================================================\r
+ *\r
+ * This product includes cryptographic software written by Eric Young\r
+ * (eay@cryptsoft.com). This product includes software written by Tim\r
+ * Hudson (tjh@cryptsoft.com).\r
+ *\r
+ */\r
+#ifndef __SRP_H__\r
+#define __SRP_H__\r
+\r
+#ifndef OPENSSL_NO_SRP\r
+\r
+#include <stdio.h>\r
+#include <string.h>\r
+\r
+#ifdef __cplusplus\r
+extern "C" {\r
+#endif\r
+\r
+#include <openssl/safestack.h>\r
+#include <openssl/bn.h>\r
+#include <openssl/crypto.h>\r
+\r
+typedef struct SRP_gN_cache_st\r
+ {\r
+ char *b64_bn;\r
+ BIGNUM *bn;\r
+ } SRP_gN_cache;\r
+\r
+\r
+DECLARE_STACK_OF(SRP_gN_cache)\r
+\r
+typedef struct SRP_user_pwd_st\r
+ {\r
+ char *id;\r
+ BIGNUM *s;\r
+ BIGNUM *v;\r
+ const BIGNUM *g;\r
+ const BIGNUM *N;\r
+ char *info;\r
+ } SRP_user_pwd;\r
+\r
+DECLARE_STACK_OF(SRP_user_pwd)\r
+\r
+typedef struct SRP_VBASE_st\r
+ {\r
+ STACK_OF(SRP_user_pwd) *users_pwd;\r
+ STACK_OF(SRP_gN_cache) *gN_cache;\r
+/* to simulate a user */\r
+ char *seed_key;\r
+ BIGNUM *default_g;\r
+ BIGNUM *default_N;\r
+ } SRP_VBASE;\r
+\r
+\r
+/*Structure interne pour retenir les couples N et g*/\r
+typedef struct SRP_gN_st\r
+ {\r
+ char *id;\r
+ BIGNUM *g;\r
+ BIGNUM *N;\r
+ } SRP_gN;\r
+\r
+DECLARE_STACK_OF(SRP_gN)\r
+\r
+SRP_VBASE *SRP_VBASE_new(char *seed_key);\r
+int SRP_VBASE_free(SRP_VBASE *vb);\r
+int SRP_VBASE_init(SRP_VBASE *vb, char * verifier_file);\r
+SRP_user_pwd *SRP_VBASE_get_by_user(SRP_VBASE *vb, char *username);\r
+char *SRP_create_verifier(const char *user, const char *pass, char **salt,\r
+ char **verifier, const char *N, const char *g);\r
+int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt, BIGNUM **verifier, BIGNUM *N, BIGNUM *g);\r
+\r
+\r
+#define SRP_NO_ERROR 0\r
+#define SRP_ERR_VBASE_INCOMPLETE_FILE 1\r
+#define SRP_ERR_VBASE_BN_LIB 2\r
+#define SRP_ERR_OPEN_FILE 3\r
+#define SRP_ERR_MEMORY 4\r
+\r
+#define DB_srptype 0\r
+#define DB_srpverifier 1\r
+#define DB_srpsalt 2\r
+#define DB_srpid 3\r
+#define DB_srpgN 4\r
+#define DB_srpinfo 5\r
+#undef DB_NUMBER\r
+#define DB_NUMBER 6\r
+\r
+#define DB_SRP_INDEX 'I'\r
+#define DB_SRP_VALID 'V'\r
+#define DB_SRP_REVOKED 'R'\r
+#define DB_SRP_MODIF 'v'\r
+\r
+\r
+/* see srp.c */\r
+char * SRP_check_known_gN_param(BIGNUM* g, BIGNUM* N);\r
+SRP_gN *SRP_get_default_gN(const char * id) ;\r
+\r
+/* server side .... */\r
+BIGNUM *SRP_Calc_server_key(BIGNUM *A, BIGNUM *v, BIGNUM *u, BIGNUM *b, BIGNUM *N);\r
+BIGNUM *SRP_Calc_B(BIGNUM *b, BIGNUM *N, BIGNUM *g, BIGNUM *v);\r
+int SRP_Verify_A_mod_N(BIGNUM *A, BIGNUM *N);\r
+BIGNUM *SRP_Calc_u(BIGNUM *A, BIGNUM *B, BIGNUM *N) ;\r
+\r
+\r
+\r
+/* client side .... */\r
+BIGNUM *SRP_Calc_x(BIGNUM *s, const char *user, const char *pass);\r
+BIGNUM *SRP_Calc_A(BIGNUM *a, BIGNUM *N, BIGNUM *g);\r
+BIGNUM *SRP_Calc_client_key(BIGNUM *N, BIGNUM *B, BIGNUM *g, BIGNUM *x, BIGNUM *a, BIGNUM *u);\r
+int SRP_Verify_B_mod_N(BIGNUM *B, BIGNUM *N);\r
+\r
+#define SRP_MINIMAL_N 1024\r
+\r
+#ifdef __cplusplus\r
+}\r
+#endif\r
+\r
+#endif\r
+#endif\r
--- /dev/null
+/* ssl/tls1.h */\r
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)\r
+ * All rights reserved.\r
+ *\r
+ * This package is an SSL implementation written\r
+ * by Eric Young (eay@cryptsoft.com).\r
+ * The implementation was written so as to conform with Netscapes SSL.\r
+ *\r
+ * This library is free for commercial and non-commercial use as long as\r
+ * the following conditions are aheared to. The following conditions\r
+ * apply to all code found in this distribution, be it the RC4, RSA,\r
+ * lhash, DES, etc., code; not just the SSL code. The SSL documentation\r
+ * included with this distribution is covered by the same copyright terms\r
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).\r
+ *\r
+ * Copyright remains Eric Young's, and as such any Copyright notices in\r
+ * the code are not to be removed.\r
+ * If this package is used in a product, Eric Young should be given attribution\r
+ * as the author of the parts of the library used.\r
+ * This can be in the form of a textual message at program startup or\r
+ * in documentation (online or textual) provided with the package.\r
+ *\r
+ * Redistribution and use in source and binary forms, with or without\r
+ * modification, are permitted provided that the following conditions\r
+ * are met:\r
+ * 1. Redistributions of source code must retain the copyright\r
+ * notice, this list of conditions and the following disclaimer.\r
+ * 2. Redistributions in binary form must reproduce the above copyright\r
+ * notice, this list of conditions and the following disclaimer in the\r
+ * documentation and/or other materials provided with the distribution.\r
+ * 3. All advertising materials mentioning features or use of this software\r
+ * must display the following acknowledgement:\r
+ * "This product includes cryptographic software written by\r
+ * Eric Young (eay@cryptsoft.com)"\r
+ * The word 'cryptographic' can be left out if the rouines from the library\r
+ * being used are not cryptographic related :-).\r
+ * 4. If you include any Windows specific code (or a derivative thereof) from\r
+ * the apps directory (application code) you must include an acknowledgement:\r
+ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"\r
+ *\r
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND\r
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\r
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\r
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE\r
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\r
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS\r
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\r
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\r
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\r
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF\r
+ * SUCH DAMAGE.\r
+ *\r
+ * The licence and distribution terms for any publically available version or\r
+ * derivative of this code cannot be changed. i.e. this code cannot simply be\r
+ * copied and put under another distribution licence\r
+ * [including the GNU Public Licence.]\r
+ */\r
+/* ====================================================================\r
+ * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.\r
+ *\r
+ * Redistribution and use in source and binary forms, with or without\r
+ * modification, are permitted provided that the following conditions\r
+ * are met:\r
+ *\r
+ * 1. Redistributions of source code must retain the above copyright\r
+ * notice, this list of conditions and the following disclaimer.\r
+ *\r
+ * 2. Redistributions in binary form must reproduce the above copyright\r
+ * notice, this list of conditions and the following disclaimer in\r
+ * the documentation and/or other materials provided with the\r
+ * distribution.\r
+ *\r
+ * 3. All advertising materials mentioning features or use of this\r
+ * software must display the following acknowledgment:\r
+ * "This product includes software developed by the OpenSSL Project\r
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"\r
+ *\r
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to\r
+ * endorse or promote products derived from this software without\r
+ * prior written permission. For written permission, please contact\r
+ * openssl-core@openssl.org.\r
+ *\r
+ * 5. Products derived from this software may not be called "OpenSSL"\r
+ * nor may "OpenSSL" appear in their names without prior written\r
+ * permission of the OpenSSL Project.\r
+ *\r
+ * 6. Redistributions of any form whatsoever must retain the following\r
+ * acknowledgment:\r
+ * "This product includes software developed by the OpenSSL Project\r
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"\r
+ *\r
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY\r
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\r
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\r
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR\r
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT\r
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\r
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\r
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)\r
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\r
+ * OF THE POSSIBILITY OF SUCH DAMAGE.\r
+ * ====================================================================\r
+ *\r
+ * This product includes cryptographic software written by Eric Young\r
+ * (eay@cryptsoft.com). This product includes software written by Tim\r
+ * Hudson (tjh@cryptsoft.com).\r
+ *\r
+ */\r
+/*\r
+ DTLS code by Eric Rescorla <ekr@rtfm.com>\r
+\r
+ Copyright (C) 2006, Network Resonance, Inc.\r
+ Copyright (C) 2011, RTFM, Inc.\r
+*/\r
+\r
+#ifndef HEADER_D1_SRTP_H\r
+#define HEADER_D1_SRTP_H\r
+\r
+#ifdef __cplusplus\r
+extern "C" {\r
+#endif\r
+\r
+\r
+#define SRTP_AES128_CM_SHA1_80 0x0001\r
+#define SRTP_AES128_CM_SHA1_32 0x0002\r
+#define SRTP_AES128_F8_SHA1_80 0x0003\r
+#define SRTP_AES128_F8_SHA1_32 0x0004\r
+#define SRTP_NULL_SHA1_80 0x0005\r
+#define SRTP_NULL_SHA1_32 0x0006\r
+\r
+int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles);\r
+int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles);\r
+SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s);\r
+\r
+STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl);\r
+SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s);\r
+\r
+#ifdef __cplusplus\r
+}\r
+#endif\r
+\r
+#endif\r
+\r
#define SSL_TXT_kEECDH "kEECDH"\r
#define SSL_TXT_kPSK "kPSK"\r
#define SSL_TXT_kGOST "kGOST"\r
+#define SSL_TXT_kSRP "kSRP"\r
\r
#define SSL_TXT_aRSA "aRSA"\r
#define SSL_TXT_aDSS "aDSS"\r
#define SSL_TXT_ECDSA "ECDSA"\r
#define SSL_TXT_KRB5 "KRB5"\r
#define SSL_TXT_PSK "PSK"\r
+#define SSL_TXT_SRP "SRP"\r
\r
#define SSL_TXT_DES "DES"\r
#define SSL_TXT_3DES "3DES"\r
#define SSL_TXT_AES128 "AES128"\r
#define SSL_TXT_AES256 "AES256"\r
#define SSL_TXT_AES "AES"\r
+#define SSL_TXT_AES_GCM "AESGCM"\r
#define SSL_TXT_CAMELLIA128 "CAMELLIA128"\r
#define SSL_TXT_CAMELLIA256 "CAMELLIA256"\r
#define SSL_TXT_CAMELLIA "CAMELLIA"\r
#define SSL_TXT_SHA "SHA" /* same as "SHA1" */\r
#define SSL_TXT_GOST94 "GOST94"\r
#define SSL_TXT_GOST89MAC "GOST89MAC"\r
+#define SSL_TXT_SHA256 "SHA256"\r
+#define SSL_TXT_SHA384 "SHA384"\r
\r
#define SSL_TXT_SSLV2 "SSLv2"\r
#define SSL_TXT_SSLV3 "SSLv3"\r
#define SSL_TXT_TLSV1 "TLSv1"\r
+#define SSL_TXT_TLSV1_1 "TLSv1.1"\r
+#define SSL_TXT_TLSV1_2 "TLSv1.2"\r
\r
#define SSL_TXT_EXP "EXP"\r
#define SSL_TXT_EXPORT "EXPORT"\r
* in SSL_CTX. */\r
typedef struct ssl_st *ssl_crock_st;\r
typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;\r
+typedef struct ssl_method_st SSL_METHOD;\r
+typedef struct ssl_cipher_st SSL_CIPHER;\r
+typedef struct ssl_session_st SSL_SESSION;\r
+\r
+DECLARE_STACK_OF(SSL_CIPHER)\r
+\r
+/* SRTP protection profiles for use with the use_srtp extension (RFC 5764)*/\r
+typedef struct srtp_protection_profile_st\r
+ {\r
+ const char *name;\r
+ unsigned long id;\r
+ } SRTP_PROTECTION_PROFILE;\r
+\r
+DECLARE_STACK_OF(SRTP_PROTECTION_PROFILE)\r
+\r
+typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, int len, void *arg);\r
+typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);\r
+\r
+\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
\r
/* used to hold info on the particular ciphers used */\r
-typedef struct ssl_cipher_st\r
+struct ssl_cipher_st\r
{\r
int valid;\r
const char *name; /* text name */\r
unsigned long algorithm2; /* Extra flags */\r
int strength_bits; /* Number of bits really used */\r
int alg_bits; /* Number of bits for algorithm */\r
- } SSL_CIPHER;\r
-\r
-DECLARE_STACK_OF(SSL_CIPHER)\r
+ };\r
\r
-typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, int len, void *arg);\r
-typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);\r
\r
/* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */\r
-typedef struct ssl_method_st\r
+struct ssl_method_st\r
{\r
int version;\r
int (*ssl_new)(SSL *s);\r
int (*ssl_version)(void);\r
long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)(void));\r
long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)(void));\r
- } SSL_METHOD;\r
+ };\r
\r
/* Lets make this into an ASN.1 type structure as follows\r
* SSL_SESSION_ID ::= SEQUENCE {\r
* Session_ID_context [ 4 ] EXPLICIT OCTET STRING, -- the Session ID context\r
* Verify_result [ 5 ] EXPLICIT INTEGER, -- X509_V_... code for `Peer'\r
* HostName [ 6 ] EXPLICIT OCTET STRING, -- optional HostName from servername TLS extension\r
- * ECPointFormatList [ 7 ] OCTET STRING, -- optional EC point format list from TLS extension\r
- * PSK_identity_hint [ 8 ] EXPLICIT OCTET STRING, -- optional PSK identity hint\r
- * PSK_identity [ 9 ] EXPLICIT OCTET STRING -- optional PSK identity\r
+ * PSK_identity_hint [ 7 ] EXPLICIT OCTET STRING, -- optional PSK identity hint\r
+ * PSK_identity [ 8 ] EXPLICIT OCTET STRING, -- optional PSK identity\r
+ * Ticket_lifetime_hint [9] EXPLICIT INTEGER, -- server's lifetime hint for session ticket\r
+ * Ticket [10] EXPLICIT OCTET STRING, -- session ticket (clients only)\r
+ * Compression_meth [11] EXPLICIT OCTET STRING, -- optional compression method\r
+ * SRP_username [ 12 ] EXPLICIT OCTET STRING -- optional SRP username\r
* }\r
* Look in ssl/ssl_asn1.c for more details\r
* I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).\r
*/\r
-typedef struct ssl_session_st\r
+struct ssl_session_st\r
{\r
int ssl_version; /* what ssl version session info is\r
* being kept in here? */\r
size_t tlsext_ticklen; /* Session ticket length */\r
long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */\r
#endif\r
- } SSL_SESSION;\r
+#ifndef OPENSSL_NO_SRP\r
+ char *srp_username;\r
+#endif\r
+ };\r
\r
+#endif\r
\r
#define SSL_OP_MICROSOFT_SESS_ID_BUG 0x00000001L\r
#define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x00000002L\r
\r
/* SSL_OP_ALL: various bug workarounds that should be rather harmless.\r
* This used to be 0x000FFFFFL before 0.9.7. */\r
-#define SSL_OP_ALL 0x80000FFFL\r
+#define SSL_OP_ALL 0x80000BFFL\r
\r
/* DTLS options */\r
#define SSL_OP_NO_QUERY_MTU 0x00001000L\r
#define SSL_OP_NO_SSLv2 0x01000000L\r
#define SSL_OP_NO_SSLv3 0x02000000L\r
#define SSL_OP_NO_TLSv1 0x04000000L\r
+#define SSL_OP_NO_TLSv1_2 0x08000000L\r
+#define SSL_OP_NO_TLSv1_1 0x10000000L\r
\r
+/* These next two were never actually used for anything since SSLeay\r
+ * zap so we have some more flags.\r
+ */\r
/* The next flag deliberately changes the ciphertest, this is a check\r
* for the PKCS#1 attack */\r
-#define SSL_OP_PKCS1_CHECK_1 0x08000000L\r
-#define SSL_OP_PKCS1_CHECK_2 0x10000000L\r
+#define SSL_OP_PKCS1_CHECK_1 0x0\r
+#define SSL_OP_PKCS1_CHECK_2 0x0\r
+\r
#define SSL_OP_NETSCAPE_CA_DN_BUG 0x20000000L\r
#define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG 0x40000000L\r
/* Make server add server-hello extension from early version of\r
#define SSL_get_secure_renegotiation_support(ssl) \\r
SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL)\r
\r
+#ifndef OPENSSL_NO_HEARTBEATS\r
+#define SSL_heartbeat(ssl) \\r
+ SSL_ctrl((ssl),SSL_CTRL_TLS_EXT_SEND_HEARTBEAT,0,NULL)\r
+#endif\r
+\r
void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));\r
void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));\r
#define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))\r
#define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg))\r
\r
+#ifndef OPENSSL_NO_SRP\r
\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
+typedef struct srp_ctx_st\r
+ {\r
+ /* param for all the callbacks */\r
+ void *SRP_cb_arg;\r
+ /* set client Hello login callback */\r
+ int (*TLS_ext_srp_username_callback)(SSL *, int *, void *);\r
+ /* set SRP N/g param callback for verification */\r
+ int (*SRP_verify_param_callback)(SSL *, void *);\r
+ /* set SRP client passwd callback */\r
+ char *(*SRP_give_srp_client_pwd_callback)(SSL *, void *);\r
+\r
+ char *login;\r
+ BIGNUM *N,*g,*s,*B,*A;\r
+ BIGNUM *a,*b,*v;\r
+ char *info;\r
+ int strength;\r
+\r
+ unsigned long srp_Mask;\r
+ } SRP_CTX;\r
+\r
+#endif\r
+\r
+/* see tls_srp.c */\r
+int SSL_SRP_CTX_init(SSL *s);\r
+int SSL_CTX_SRP_CTX_init(SSL_CTX *ctx);\r
+int SSL_SRP_CTX_free(SSL *ctx);\r
+int SSL_CTX_SRP_CTX_free(SSL_CTX *ctx);\r
+int SSL_srp_server_param_with_username(SSL *s, int *ad);\r
+int SRP_generate_server_master_secret(SSL *s,unsigned char *master_key);\r
+int SRP_Calc_A_param(SSL *s);\r
+int SRP_generate_client_master_secret(SSL *s,unsigned char *master_key);\r
+\r
+#endif\r
\r
#if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32)\r
#define SSL_MAX_CERT_LIST_DEFAULT 1024*30 /* 30k max cert list :-) */\r
typedef int (*GEN_SESSION_CB)(const SSL *ssl, unsigned char *id,\r
unsigned int *id_len);\r
\r
-typedef struct ssl_comp_st\r
+typedef struct ssl_comp_st SSL_COMP;\r
+\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
+struct ssl_comp_st\r
{\r
int id;\r
const char *name;\r
#else\r
char *method;\r
#endif\r
- } SSL_COMP;\r
+ };\r
\r
DECLARE_STACK_OF(SSL_COMP)\r
DECLARE_LHASH_OF(SSL_SESSION);\r
/* Callback for status request */\r
int (*tlsext_status_cb)(SSL *ssl, void *arg);\r
void *tlsext_status_arg;\r
-\r
/* draft-rescorla-tls-opaque-prf-input-00.txt information */\r
int (*tlsext_opaque_prf_input_callback)(SSL *, void *peerinput, size_t len, void *arg);\r
void *tlsext_opaque_prf_input_callback_arg;\r
struct ssl3_buf_freelist_st *wbuf_freelist;\r
struct ssl3_buf_freelist_st *rbuf_freelist;\r
#endif\r
+#ifndef OPENSSL_NO_SRP\r
+ SRP_CTX srp_ctx; /* ctx for SRP authentication */\r
+#endif\r
+\r
+#ifndef OPENSSL_NO_TLSEXT\r
+# ifndef OPENSSL_NO_NEXTPROTONEG\r
+ /* Next protocol negotiation information */\r
+ /* (for experimental NPN extension). */\r
+\r
+ /* For a server, this contains a callback function by which the set of\r
+ * advertised protocols can be provided. */\r
+ int (*next_protos_advertised_cb)(SSL *s, const unsigned char **buf,\r
+ unsigned int *len, void *arg);\r
+ void *next_protos_advertised_cb_arg;\r
+ /* For a client, this contains a callback function that selects the\r
+ * next protocol from the list provided by the server. */\r
+ int (*next_proto_select_cb)(SSL *s, unsigned char **out,\r
+ unsigned char *outlen,\r
+ const unsigned char *in,\r
+ unsigned int inlen,\r
+ void *arg);\r
+ void *next_proto_select_cb_arg;\r
+# endif\r
+ /* SRTP profiles we are willing to do from RFC 5764 */\r
+ STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;\r
+#endif\r
};\r
\r
+#endif\r
+\r
#define SSL_SESS_CACHE_OFF 0x0000\r
#define SSL_SESS_CACHE_CLIENT 0x0001\r
#define SSL_SESS_CACHE_SERVER 0x0002\r
#endif\r
void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len));\r
void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len));\r
+#ifndef OPENSSL_NO_NEXTPROTONEG\r
+void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *s,\r
+ int (*cb) (SSL *ssl,\r
+ const unsigned char **out,\r
+ unsigned int *outlen,\r
+ void *arg),\r
+ void *arg);\r
+void SSL_CTX_set_next_proto_select_cb(SSL_CTX *s,\r
+ int (*cb) (SSL *ssl,\r
+ unsigned char **out,\r
+ unsigned char *outlen,\r
+ const unsigned char *in,\r
+ unsigned int inlen,\r
+ void *arg),\r
+ void *arg);\r
+\r
+int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,\r
+ const unsigned char *in, unsigned int inlen,\r
+ const unsigned char *client, unsigned int client_len);\r
+void SSL_get0_next_proto_negotiated(const SSL *s,\r
+ const unsigned char **data, unsigned *len);\r
+\r
+#define OPENSSL_NPN_UNSUPPORTED 0\r
+#define OPENSSL_NPN_NEGOTIATED 1\r
+#define OPENSSL_NPN_NO_OVERLAP 2\r
+#endif\r
\r
#ifndef OPENSSL_NO_PSK\r
/* the maximum length of the buffer given to callbacks containing the\r
#define SSL_MAC_FLAG_READ_MAC_STREAM 1\r
#define SSL_MAC_FLAG_WRITE_MAC_STREAM 2\r
\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
struct ssl_st\r
{\r
/* protocol version\r
\r
int server; /* are we the server side? - mostly used by SSL_clear*/\r
\r
- int new_session;/* 1 if we are to use a new session.\r
- * 2 if we are a server and are inside a handshake\r
- * (i.e. not just sending a HelloRequest)\r
+ int new_session;/* Generate a new session or reuse an old one.\r
* NB: For servers, the 'new' session may actually be a previously\r
* cached session or even the previous session unless\r
* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */\r
void *tls_session_secret_cb_arg;\r
\r
SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */\r
+\r
+#ifndef OPENSSL_NO_NEXTPROTONEG\r
+ /* Next protocol negotiation. For the client, this is the protocol that\r
+ * we sent in NextProtocol and is set when handling ServerHello\r
+ * extensions.\r
+ *\r
+ * For a server, this is the client's selected_protocol from\r
+ * NextProtocol and is set when handling the NextProtocol message,\r
+ * before the Finished message. */\r
+ unsigned char *next_proto_negotiated;\r
+ unsigned char next_proto_negotiated_len;\r
+#endif\r
+\r
#define session_ctx initial_ctx\r
+\r
+ STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles; /* What we'll do */\r
+ SRTP_PROTECTION_PROFILE *srtp_profile; /* What's been chosen */\r
+\r
+ unsigned int tlsext_heartbeat; /* Is use of the Heartbeat extension negotiated?\r
+ 0: disabled\r
+ 1: enabled\r
+ 2: enabled, but not allowed to send Requests\r
+ */\r
+ unsigned int tlsext_hb_pending; /* Indicates if a HeartbeatRequest is in flight */\r
+ unsigned int tlsext_hb_seq; /* HeartbeatRequest sequence number */\r
#else\r
#define session_ctx ctx\r
#endif /* OPENSSL_NO_TLSEXT */\r
+\r
+ int renegotiate;/* 1 if we are renegotiating.\r
+ * 2 if we are a server and are inside a handshake\r
+ * (i.e. not just sending a HelloRequest) */\r
+\r
+#ifndef OPENSSL_NO_SRP\r
+ SRP_CTX srp_ctx; /* ctx for SRP authentication */\r
+#endif\r
};\r
\r
+#endif\r
+\r
#ifdef __cplusplus\r
}\r
#endif\r
#include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */\r
#include <openssl/dtls1.h> /* Datagram TLS */\r
#include <openssl/ssl23.h>\r
+#include <openssl/srtp.h> /* Support for the use_srtp extension */\r
\r
#ifdef __cplusplus\r
extern "C" {\r
#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP 71\r
\r
#define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB 72\r
+\r
+#define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB 75\r
+#define SSL_CTRL_SET_SRP_VERIFY_PARAM_CB 76\r
+#define SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB 77\r
+\r
+#define SSL_CTRL_SET_SRP_ARG 78\r
+#define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME 79\r
+#define SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH 80\r
+#define SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD 81\r
+#ifndef OPENSSL_NO_HEARTBEATS\r
+#define SSL_CTRL_TLS_EXT_SEND_HEARTBEAT 85\r
+#define SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING 86\r
+#define SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS 87\r
+#endif\r
#endif\r
\r
#define DTLS_CTRL_GET_TIMEOUT 73\r
#define SSL_CTRL_CLEAR_OPTIONS 77\r
#define SSL_CTRL_CLEAR_MODE 78\r
\r
+#define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82\r
+#define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83\r
+\r
#define DTLSv1_get_timeout(ssl, arg) \\r
SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)\r
#define DTLSv1_handle_timeout(ssl) \\r
\r
#define SSL_CTX_add_extra_chain_cert(ctx,x509) \\r
SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509)\r
+#define SSL_CTX_get_extra_chain_certs(ctx,px509) \\r
+ SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,0,px509)\r
+#define SSL_CTX_clear_extra_chain_certs(ctx) \\r
+ SSL_CTX_ctrl(ctx,SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS,0,NULL)\r
\r
#ifndef OPENSSL_NO_BIO\r
BIO_METHOD *BIO_f_ssl(void);\r
int SSL_CIPHER_get_bits(const SSL_CIPHER *c,int *alg_bits);\r
char * SSL_CIPHER_get_version(const SSL_CIPHER *c);\r
const char * SSL_CIPHER_get_name(const SSL_CIPHER *c);\r
+unsigned long SSL_CIPHER_get_id(const SSL_CIPHER *c);\r
\r
int SSL_get_fd(const SSL *s);\r
int SSL_get_rfd(const SSL *s);\r
long SSL_SESSION_get_timeout(const SSL_SESSION *s);\r
long SSL_SESSION_set_timeout(SSL_SESSION *s, long t);\r
void SSL_copy_session_id(SSL *to,const SSL *from);\r
+X509 *SSL_SESSION_get0_peer(SSL_SESSION *s);\r
+int SSL_SESSION_set1_id_context(SSL_SESSION *s,const unsigned char *sid_ctx,\r
+ unsigned int sid_ctx_len);\r
\r
SSL_SESSION *SSL_SESSION_new(void);\r
const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,\r
unsigned int *len);\r
+unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s);\r
#ifndef OPENSSL_NO_FP_API\r
int SSL_SESSION_print_fp(FILE *fp,const SSL_SESSION *ses);\r
#endif\r
int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm);\r
int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm);\r
\r
+#ifndef OPENSSL_NO_SRP\r
+int SSL_CTX_set_srp_username(SSL_CTX *ctx,char *name);\r
+int SSL_CTX_set_srp_password(SSL_CTX *ctx,char *password);\r
+int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength);\r
+int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,\r
+ char *(*cb)(SSL *,void *));\r
+int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,\r
+ int (*cb)(SSL *,void *));\r
+int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,\r
+ int (*cb)(SSL *,int *,void *));\r
+int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg);\r
+\r
+int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,\r
+ BIGNUM *sa, BIGNUM *v, char *info);\r
+int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,\r
+ const char *grp);\r
+\r
+BIGNUM *SSL_get_srp_g(SSL *s);\r
+BIGNUM *SSL_get_srp_N(SSL *s);\r
+\r
+char *SSL_get_srp_username(SSL *s);\r
+char *SSL_get_srp_userinfo(SSL *s);\r
+#endif\r
+\r
void SSL_free(SSL *ssl);\r
int SSL_accept(SSL *ssl);\r
int SSL_connect(SSL *ssl);\r
const SSL_METHOD *TLSv1_server_method(void); /* TLSv1.0 */\r
const SSL_METHOD *TLSv1_client_method(void); /* TLSv1.0 */\r
\r
+const SSL_METHOD *TLSv1_1_method(void); /* TLSv1.1 */\r
+const SSL_METHOD *TLSv1_1_server_method(void); /* TLSv1.1 */\r
+const SSL_METHOD *TLSv1_1_client_method(void); /* TLSv1.1 */\r
+\r
+const SSL_METHOD *TLSv1_2_method(void); /* TLSv1.2 */\r
+const SSL_METHOD *TLSv1_2_server_method(void); /* TLSv1.2 */\r
+const SSL_METHOD *TLSv1_2_client_method(void); /* TLSv1.2 */\r
+\r
+\r
const SSL_METHOD *DTLSv1_method(void); /* DTLSv1.0 */\r
const SSL_METHOD *DTLSv1_server_method(void); /* DTLSv1.0 */\r
const SSL_METHOD *DTLSv1_client_method(void); /* DTLSv1.0 */\r
\r
int SSL_do_handshake(SSL *s);\r
int SSL_renegotiate(SSL *s);\r
+int SSL_renegotiate_abbreviated(SSL *s);\r
int SSL_renegotiate_pending(SSL *s);\r
int SSL_shutdown(SSL *s);\r
\r
void (*cb)(const SSL *ssl,int type,int val));\r
void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val);\r
int SSL_state(const SSL *ssl);\r
+void SSL_set_state(SSL *ssl, int state);\r
\r
void SSL_set_verify_result(SSL *ssl,long v);\r
long SSL_get_verify_result(const SSL *ssl);\r
/* Pre-shared secret session resumption functions */\r
int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg);\r
\r
+void SSL_set_debug(SSL *s, int debug);\r
+int SSL_cache_hit(SSL *s);\r
+\r
/* BEGIN ERROR CODES */\r
/* The following lines are auto generated by the script mkerr.pl. Any changes\r
* made after this point may be overwritten when the script is next run.\r
#define SSL_F_DTLS1_ACCEPT 246\r
#define SSL_F_DTLS1_ADD_CERT_TO_BUF 295\r
#define SSL_F_DTLS1_BUFFER_RECORD 247\r
+#define SSL_F_DTLS1_CHECK_TIMEOUT_NUM 316\r
#define SSL_F_DTLS1_CLIENT_HELLO 248\r
#define SSL_F_DTLS1_CONNECT 249\r
#define SSL_F_DTLS1_ENC 250\r
#define SSL_F_DTLS1_GET_MESSAGE_FRAGMENT 253\r
#define SSL_F_DTLS1_GET_RECORD 254\r
#define SSL_F_DTLS1_HANDLE_TIMEOUT 297\r
+#define SSL_F_DTLS1_HEARTBEAT 305\r
#define SSL_F_DTLS1_OUTPUT_CERT_CHAIN 255\r
#define SSL_F_DTLS1_PREPROCESS_FRAGMENT 288\r
#define SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE 256\r
#define SSL_F_SSL3_GET_KEY_EXCHANGE 141\r
#define SSL_F_SSL3_GET_MESSAGE 142\r
#define SSL_F_SSL3_GET_NEW_SESSION_TICKET 283\r
+#define SSL_F_SSL3_GET_NEXT_PROTO 306\r
#define SSL_F_SSL3_GET_RECORD 143\r
#define SSL_F_SSL3_GET_SERVER_CERTIFICATE 144\r
#define SSL_F_SSL3_GET_SERVER_DONE 145\r
#define SSL_F_SSL3_WRITE_PENDING 159\r
#define SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT 298\r
#define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT 277\r
+#define SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT 307\r
#define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK 215\r
#define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK 216\r
#define SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT 299\r
#define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT 278\r
+#define SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT 308\r
#define SSL_F_SSL_BAD_METHOD 160\r
#define SSL_F_SSL_BYTES_TO_CIPHER_LIST 161\r
#define SSL_F_SSL_CERT_DUP 221\r
#define SSL_F_SSL_CREATE_CIPHER_LIST 166\r
#define SSL_F_SSL_CTRL 232\r
#define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY 168\r
+#define SSL_F_SSL_CTX_MAKE_PROFILES 309\r
#define SSL_F_SSL_CTX_NEW 169\r
#define SSL_F_SSL_CTX_SET_CIPHER_LIST 269\r
#define SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE 290\r
#define SSL_F_SSL_NEW 186\r
#define SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT 300\r
#define SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT 302\r
+#define SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT 310\r
#define SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT 301\r
#define SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT 303\r
+#define SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT 311\r
#define SSL_F_SSL_PEEK 270\r
#define SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT 281\r
#define SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT 282\r
#define SSL_F_SSL_RSA_PUBLIC_ENCRYPT 188\r
#define SSL_F_SSL_SESSION_NEW 189\r
#define SSL_F_SSL_SESSION_PRINT_FP 190\r
+#define SSL_F_SSL_SESSION_SET1_ID_CONTEXT 312\r
#define SSL_F_SSL_SESS_CERT_NEW 225\r
#define SSL_F_SSL_SET_CERT 191\r
#define SSL_F_SSL_SET_CIPHER_LIST 271\r
#define SSL_F_SSL_SET_TRUST 228\r
#define SSL_F_SSL_SET_WFD 196\r
#define SSL_F_SSL_SHUTDOWN 224\r
+#define SSL_F_SSL_SRP_CTX_INIT 313\r
#define SSL_F_SSL_UNDEFINED_CONST_FUNCTION 243\r
#define SSL_F_SSL_UNDEFINED_FUNCTION 197\r
#define SSL_F_SSL_UNDEFINED_VOID_FUNCTION 244\r
#define SSL_F_TLS1_CHANGE_CIPHER_STATE 209\r
#define SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT 274\r
#define SSL_F_TLS1_ENC 210\r
+#define SSL_F_TLS1_EXPORT_KEYING_MATERIAL 314\r
+#define SSL_F_TLS1_HEARTBEAT 315\r
#define SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT 275\r
#define SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT 276\r
#define SSL_F_TLS1_PRF 284\r
#define SSL_R_BAD_RSA_MODULUS_LENGTH 121\r
#define SSL_R_BAD_RSA_SIGNATURE 122\r
#define SSL_R_BAD_SIGNATURE 123\r
+#define SSL_R_BAD_SRP_A_LENGTH 347\r
+#define SSL_R_BAD_SRP_B_LENGTH 348\r
+#define SSL_R_BAD_SRP_G_LENGTH 349\r
+#define SSL_R_BAD_SRP_N_LENGTH 350\r
+#define SSL_R_BAD_SRP_S_LENGTH 351\r
+#define SSL_R_BAD_SRTP_MKI_VALUE 352\r
+#define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST 353\r
#define SSL_R_BAD_SSL_FILETYPE 124\r
#define SSL_R_BAD_SSL_SESSION_ID_LENGTH 125\r
#define SSL_R_BAD_STATE 126\r
#define SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE 322\r
#define SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE 323\r
#define SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER 310\r
+#define SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST 354\r
#define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 150\r
#define SSL_R_ERROR_GENERATING_TMP_RSA_KEY 282\r
#define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 151\r
#define SSL_R_EXCESSIVE_MESSAGE_SIZE 152\r
#define SSL_R_EXTRA_DATA_IN_MESSAGE 153\r
#define SSL_R_GOT_A_FIN_BEFORE_A_CCS 154\r
+#define SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS 355\r
+#define SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION 356\r
#define SSL_R_HTTPS_PROXY_REQUEST 155\r
#define SSL_R_HTTP_REQUEST 156\r
#define SSL_R_ILLEGAL_PADDING 283\r
#define SSL_R_INVALID_COMMAND 280\r
#define SSL_R_INVALID_COMPRESSION_ALGORITHM 341\r
#define SSL_R_INVALID_PURPOSE 278\r
+#define SSL_R_INVALID_SRP_USERNAME 357\r
#define SSL_R_INVALID_STATUS_RESPONSE 328\r
#define SSL_R_INVALID_TICKET_KEYS_LENGTH 325\r
#define SSL_R_INVALID_TRUST 279\r
#define SSL_R_MISSING_RSA_CERTIFICATE 168\r
#define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169\r
#define SSL_R_MISSING_RSA_SIGNING_CERT 170\r
+#define SSL_R_MISSING_SRP_PARAM 358\r
#define SSL_R_MISSING_TMP_DH_KEY 171\r
#define SSL_R_MISSING_TMP_ECDH_KEY 311\r
#define SSL_R_MISSING_TMP_RSA_KEY 172\r
#define SSL_R_NO_RENEGOTIATION 339\r
#define SSL_R_NO_REQUIRED_DIGEST 324\r
#define SSL_R_NO_SHARED_CIPHER 193\r
+#define SSL_R_NO_SRTP_PROFILES 359\r
#define SSL_R_NO_VERIFY_CALLBACK 194\r
#define SSL_R_NULL_SSL_CTX 195\r
#define SSL_R_NULL_SSL_METHOD_PASSED 196\r
#define SSL_R_SERVERHELLO_TLSEXT 275\r
#define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277\r
#define SSL_R_SHORT_READ 219\r
+#define SSL_R_SIGNATURE_ALGORITHMS_ERROR 360\r
#define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220\r
+#define SSL_R_SRP_A_CALC 361\r
+#define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362\r
+#define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363\r
+#define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364\r
#define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221\r
#define SSL_R_SSL2_CONNECTION_ID_TOO_LONG 299\r
#define SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT 321\r
#define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112\r
#define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110\r
#define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER 232\r
+#define SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT 365\r
+#define SSL_R_TLS_HEARTBEAT_PENDING 366\r
+#define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367\r
#define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157\r
#define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233\r
#define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG 234\r
#define SSL_R_UNKNOWN_CERTIFICATE_TYPE 247\r
#define SSL_R_UNKNOWN_CIPHER_RETURNED 248\r
#define SSL_R_UNKNOWN_CIPHER_TYPE 249\r
+#define SSL_R_UNKNOWN_DIGEST 368\r
#define SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE 250\r
#define SSL_R_UNKNOWN_PKEY_TYPE 251\r
#define SSL_R_UNKNOWN_PROTOCOL 252\r
#define SSL_R_UNSUPPORTED_PROTOCOL 258\r
#define SSL_R_UNSUPPORTED_SSL_VERSION 259\r
#define SSL_R_UNSUPPORTED_STATUS_TYPE 329\r
+#define SSL_R_USE_SRTP_NOT_NEGOTIATED 369\r
#define SSL_R_WRITE_BIO_NOT_SET 260\r
#define SSL_R_WRONG_CIPHER_RETURNED 261\r
#define SSL_R_WRONG_MESSAGE_TYPE 262\r
#define SSL_R_WRONG_NUMBER_OF_KEY_BITS 263\r
#define SSL_R_WRONG_SIGNATURE_LENGTH 264\r
#define SSL_R_WRONG_SIGNATURE_SIZE 265\r
+#define SSL_R_WRONG_SIGNATURE_TYPE 370\r
#define SSL_R_WRONG_SSL_VERSION 266\r
#define SSL_R_WRONG_VERSION_NUMBER 267\r
#define SSL_R_X509_LIB 268\r
#define CERT char\r
#endif\r
\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
typedef struct ssl2_state_st\r
{\r
int three_byte_header;\r
} tmp;\r
} SSL2_STATE;\r
\r
+#endif\r
+\r
/* SSLv2 */\r
/* client */\r
#define SSL2_ST_SEND_CLIENT_HELLO_A (0x10|SSL_ST_CONNECT)\r
#define SSL3_RT_ALERT 21\r
#define SSL3_RT_HANDSHAKE 22\r
#define SSL3_RT_APPLICATION_DATA 23\r
+#define TLS1_RT_HEARTBEAT 24\r
\r
#define SSL3_AL_WARNING 1\r
#define SSL3_AL_FATAL 2\r
#define SSL3_AD_CERTIFICATE_UNKNOWN 46\r
#define SSL3_AD_ILLEGAL_PARAMETER 47 /* fatal */\r
\r
+#define TLS1_HB_REQUEST 1\r
+#define TLS1_HB_RESPONSE 2\r
+\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
typedef struct ssl3_record_st\r
{\r
/*r */ int type; /* type of record */\r
int left; /* how many bytes left */\r
} SSL3_BUFFER;\r
\r
+#endif\r
+\r
#define SSL3_CT_RSA_SIGN 1\r
#define SSL3_CT_DSS_SIGN 2\r
#define SSL3_CT_RSA_FIXED_DH 3\r
#define SSL3_FLAGS_POP_BUFFER 0x0004\r
#define TLS1_FLAGS_TLS_PADDING_BUG 0x0008\r
#define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010\r
+#define TLS1_FLAGS_KEEP_HANDSHAKE 0x0020\r
\r
/* SSL3_FLAGS_SGC_RESTART_DONE is set when we\r
* restart a handshake because of MS SGC and so prevents us\r
*/\r
#define SSL3_FLAGS_SGC_RESTART_DONE 0x0040\r
\r
+#ifndef OPENSSL_NO_SSL_INTERN\r
+\r
typedef struct ssl3_state_st\r
{\r
long flags;\r
unsigned char previous_server_finished[EVP_MAX_MD_SIZE];\r
unsigned char previous_server_finished_len;\r
int send_connection_binding; /* TODOEKR */\r
+\r
+#ifndef OPENSSL_NO_NEXTPROTONEG\r
+ /* Set if we saw the Next Protocol Negotiation extension from our peer. */\r
+ int next_proto_neg_seen;\r
+#endif\r
} SSL3_STATE;\r
\r
+#endif\r
\r
/* SSLv3 */\r
/*client */\r
/* extra state */\r
#define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT)\r
+#ifndef OPENSSL_NO_SCTP\r
+#define DTLS1_SCTP_ST_CW_WRITE_SOCK (0x310|SSL_ST_CONNECT)\r
+#define DTLS1_SCTP_ST_CR_READ_SOCK (0x320|SSL_ST_CONNECT)\r
+#endif\r
/* write to server */\r
#define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT)\r
#define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT)\r
#define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT)\r
#define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT)\r
#define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT)\r
+#define SSL3_ST_CW_NEXT_PROTO_A (0x200|SSL_ST_CONNECT)\r
+#define SSL3_ST_CW_NEXT_PROTO_B (0x201|SSL_ST_CONNECT)\r
#define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT)\r
#define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT)\r
/* read from server */\r
/* server */\r
/* extra state */\r
#define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT)\r
+#ifndef OPENSSL_NO_SCTP\r
+#define DTLS1_SCTP_ST_SW_WRITE_SOCK (0x310|SSL_ST_ACCEPT)\r
+#define DTLS1_SCTP_ST_SR_READ_SOCK (0x320|SSL_ST_ACCEPT)\r
+#endif\r
/* read from client */\r
/* Do not change the number values, they do matter */\r
#define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT)\r
#define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT)\r
#define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT)\r
#define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT)\r
+#define SSL3_ST_SR_NEXT_PROTO_A (0x210|SSL_ST_ACCEPT)\r
+#define SSL3_ST_SR_NEXT_PROTO_B (0x211|SSL_ST_ACCEPT)\r
#define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT)\r
#define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT)\r
/* write to client */\r
#define SSL3_MT_CLIENT_KEY_EXCHANGE 16\r
#define SSL3_MT_FINISHED 20\r
#define SSL3_MT_CERTIFICATE_STATUS 22\r
+#define SSL3_MT_NEXT_PROTO 67\r
#define DTLS1_MT_HELLO_VERIFY_REQUEST 3\r
\r
\r
#define SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_def_passwd_cb_ud\r
#undef SSL_COMP_get_compression_methods\r
#define SSL_COMP_get_compression_methods SSL_COMP_get_compress_methods\r
-\r
#undef ssl_add_clienthello_renegotiate_ext\r
#define ssl_add_clienthello_renegotiate_ext ssl_add_clienthello_reneg_ext\r
#undef ssl_add_serverhello_renegotiate_ext\r
#define ssl_parse_clienthello_renegotiate_ext ssl_parse_clienthello_reneg_ext\r
#undef ssl_parse_serverhello_renegotiate_ext\r
#define ssl_parse_serverhello_renegotiate_ext ssl_parse_serverhello_reneg_ext\r
+#undef SSL_srp_server_param_with_username\r
+#define SSL_srp_server_param_with_username SSL_srp_server_param_with_un\r
+#undef SSL_CTX_set_srp_client_pwd_callback\r
+#define SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_client_pwd_cb\r
+#undef SSL_CTX_set_srp_verify_param_callback\r
+#define SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_srp_vfy_param_cb\r
+#undef SSL_CTX_set_srp_username_callback\r
+#define SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_un_cb\r
+#undef ssl_add_clienthello_use_srtp_ext\r
+#define ssl_add_clienthello_use_srtp_ext ssl_add_clihello_use_srtp_ext\r
+#undef ssl_add_serverhello_use_srtp_ext\r
+#define ssl_add_serverhello_use_srtp_ext ssl_add_serhello_use_srtp_ext\r
+#undef ssl_parse_clienthello_use_srtp_ext\r
+#define ssl_parse_clienthello_use_srtp_ext ssl_parse_clihello_use_srtp_ext\r
+#undef ssl_parse_serverhello_use_srtp_ext\r
+#define ssl_parse_serverhello_use_srtp_ext ssl_parse_serhello_use_srtp_ext\r
+#undef SSL_CTX_set_next_protos_advertised_cb\r
+#define SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_next_protos_adv_cb\r
+#undef SSL_CTX_set_next_proto_select_cb\r
+#define SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_proto_sel_cb\r
\r
/* Hack some long ENGINE names */\r
#undef ENGINE_get_default_BN_mod_exp_crt\r
#define EC_GROUP_get_point_conversion_form EC_GROUP_get_point_conv_form\r
#undef EC_GROUP_clear_free_all_extra_data\r
#define EC_GROUP_clear_free_all_extra_data EC_GROUP_clr_free_all_xtra_data\r
+#undef EC_KEY_set_public_key_affine_coordinates\r
+#define EC_KEY_set_public_key_affine_coordinates \\r
+ EC_KEY_set_pub_key_aff_coords\r
#undef EC_POINT_set_Jprojective_coordinates_GFp\r
#define EC_POINT_set_Jprojective_coordinates_GFp \\r
EC_POINT_set_Jproj_coords_GFp\r
#undef dtls1_retransmit_buffered_messages\r
#define dtls1_retransmit_buffered_messages dtls1_retransmit_buffered_msgs\r
\r
+/* Hack some long SRP names */\r
+#undef SRP_generate_server_master_secret\r
+#define SRP_generate_server_master_secret SRP_gen_server_master_secret\r
+#undef SRP_generate_client_master_secret\r
+#define SRP_generate_client_master_secret SRP_gen_client_master_secret\r
+\r
/* Hack some long UI names */\r
#undef UI_method_get_prompt_constructor\r
#define UI_method_get_prompt_constructor UI_method_get_prompt_constructr\r
\r
#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0\r
\r
+#define TLS1_2_VERSION 0x0303\r
+#define TLS1_2_VERSION_MAJOR 0x03\r
+#define TLS1_2_VERSION_MINOR 0x03\r
+\r
+#define TLS1_1_VERSION 0x0302\r
+#define TLS1_1_VERSION_MAJOR 0x03\r
+#define TLS1_1_VERSION_MINOR 0x02\r
+\r
#define TLS1_VERSION 0x0301\r
#define TLS1_VERSION_MAJOR 0x03\r
#define TLS1_VERSION_MINOR 0x01\r
\r
+#define TLS1_get_version(s) \\r
+ ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)\r
+\r
+#define TLS1_get_client_version(s) \\r
+ ((s->client_version >> 8) == TLS1_VERSION_MAJOR ? s->client_version : 0)\r
+\r
#define TLS1_AD_DECRYPTION_FAILED 21\r
#define TLS1_AD_RECORD_OVERFLOW 22\r
#define TLS1_AD_UNKNOWN_CA 48 /* fatal */\r
#define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114\r
#define TLS1_AD_UNKNOWN_PSK_IDENTITY 115 /* fatal */\r
\r
-/* ExtensionType values from RFC3546 / RFC4366 */\r
+/* ExtensionType values from RFC3546 / RFC4366 / RFC6066 */\r
#define TLSEXT_TYPE_server_name 0\r
#define TLSEXT_TYPE_max_fragment_length 1\r
#define TLSEXT_TYPE_client_certificate_url 2\r
#define TLSEXT_TYPE_trusted_ca_keys 3\r
#define TLSEXT_TYPE_truncated_hmac 4\r
#define TLSEXT_TYPE_status_request 5\r
+/* ExtensionType values from RFC4681 */\r
+#define TLSEXT_TYPE_user_mapping 6\r
+\r
+/* ExtensionType values from RFC5878 */\r
+#define TLSEXT_TYPE_client_authz 7\r
+#define TLSEXT_TYPE_server_authz 8\r
+\r
+/* ExtensionType values from RFC6091 */\r
+#define TLSEXT_TYPE_cert_type 9\r
+\r
/* ExtensionType values from RFC4492 */\r
#define TLSEXT_TYPE_elliptic_curves 10\r
#define TLSEXT_TYPE_ec_point_formats 11\r
+\r
+/* ExtensionType value from RFC5054 */\r
+#define TLSEXT_TYPE_srp 12\r
+\r
+/* ExtensionType values from RFC5246 */\r
+#define TLSEXT_TYPE_signature_algorithms 13\r
+\r
+/* ExtensionType value from RFC5764 */\r
+#define TLSEXT_TYPE_use_srtp 14\r
+\r
+/* ExtensionType value from RFC5620 */\r
+#define TLSEXT_TYPE_heartbeat 15\r
+\r
+/* ExtensionType value from RFC4507 */\r
#define TLSEXT_TYPE_session_ticket 35\r
+\r
/* ExtensionType value from draft-rescorla-tls-opaque-prf-input-00.txt */\r
#if 0 /* will have to be provided externally for now ,\r
* i.e. build with -DTLSEXT_TYPE_opaque_prf_input=38183\r
/* Temporary extension type */\r
#define TLSEXT_TYPE_renegotiate 0xff01\r
\r
+#ifndef OPENSSL_NO_NEXTPROTONEG\r
+/* This is not an IANA defined extension number */\r
+#define TLSEXT_TYPE_next_proto_neg 13172\r
+#endif\r
+\r
/* NameType value from RFC 3546 */\r
#define TLSEXT_NAMETYPE_host_name 0\r
/* status request value from RFC 3546 */\r
#define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2 2\r
#define TLSEXT_ECPOINTFORMAT_last 2\r
\r
+/* Signature and hash algorithms from RFC 5246 */\r
+\r
+#define TLSEXT_signature_anonymous 0\r
+#define TLSEXT_signature_rsa 1\r
+#define TLSEXT_signature_dsa 2\r
+#define TLSEXT_signature_ecdsa 3\r
+\r
+#define TLSEXT_hash_none 0\r
+#define TLSEXT_hash_md5 1\r
+#define TLSEXT_hash_sha1 2\r
+#define TLSEXT_hash_sha224 3\r
+#define TLSEXT_hash_sha256 4\r
+#define TLSEXT_hash_sha384 5\r
+#define TLSEXT_hash_sha512 6\r
+\r
#ifndef OPENSSL_NO_TLSEXT\r
\r
#define TLSEXT_MAXLEN_host_name 255\r
\r
-const char *SSL_get_servername(const SSL *s, const int type) ;\r
-int SSL_get_servername_type(const SSL *s) ;\r
+const char *SSL_get_servername(const SSL *s, const int type);\r
+int SSL_get_servername_type(const SSL *s);\r
+/* SSL_export_keying_material exports a value derived from the master secret,\r
+ * as specified in RFC 5705. It writes |olen| bytes to |out| given a label and\r
+ * optional context. (Since a zero length context is allowed, the |use_context|\r
+ * flag controls whether a context is included.)\r
+ *\r
+ * It returns 1 on success and zero otherwise.\r
+ */\r
+int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,\r
+ const char *label, size_t llen, const unsigned char *p, size_t plen,\r
+ int use_context);\r
\r
#define SSL_set_tlsext_host_name(s,name) \\r
SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,(char *)name)\r
#define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \\r
SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)\r
\r
+#ifndef OPENSSL_NO_HEARTBEATS\r
+#define SSL_TLSEXT_HB_ENABLED 0x01\r
+#define SSL_TLSEXT_HB_DONT_SEND_REQUESTS 0x02\r
+#define SSL_TLSEXT_HB_DONT_RECV_REQUESTS 0x04\r
+\r
+#define SSL_get_tlsext_heartbeat_pending(ssl) \\r
+ SSL_ctrl((ssl),SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING,0,NULL)\r
+#define SSL_set_tlsext_heartbeat_no_requests(ssl, arg) \\r
+ SSL_ctrl((ssl),SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS,arg,NULL)\r
+#endif\r
#endif\r
\r
/* PSK ciphersuites from 4279 */\r
#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039\r
#define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A\r
\r
+/* TLS v1.2 ciphersuites */\r
+#define TLS1_CK_RSA_WITH_NULL_SHA256 0x0300003B\r
+#define TLS1_CK_RSA_WITH_AES_128_SHA256 0x0300003C\r
+#define TLS1_CK_RSA_WITH_AES_256_SHA256 0x0300003D\r
+#define TLS1_CK_DH_DSS_WITH_AES_128_SHA256 0x0300003E\r
+#define TLS1_CK_DH_RSA_WITH_AES_128_SHA256 0x0300003F\r
+#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA256 0x03000040\r
+\r
/* Camellia ciphersuites from RFC4132 */\r
#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000041\r
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000042\r
#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000045\r
#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA 0x03000046\r
\r
+/* TLS v1.2 ciphersuites */\r
+#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA256 0x03000067\r
+#define TLS1_CK_DH_DSS_WITH_AES_256_SHA256 0x03000068\r
+#define TLS1_CK_DH_RSA_WITH_AES_256_SHA256 0x03000069\r
+#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA256 0x0300006A\r
+#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA256 0x0300006B\r
+#define TLS1_CK_ADH_WITH_AES_128_SHA256 0x0300006C\r
+#define TLS1_CK_ADH_WITH_AES_256_SHA256 0x0300006D\r
+\r
+/* Camellia ciphersuites from RFC4132 */\r
#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000084\r
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000085\r
#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000086\r
#define TLS1_CK_DHE_RSA_WITH_SEED_SHA 0x0300009A\r
#define TLS1_CK_ADH_WITH_SEED_SHA 0x0300009B\r
\r
+/* TLS v1.2 GCM ciphersuites from RFC5288 */\r
+#define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 0x0300009C\r
+#define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 0x0300009D\r
+#define TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 0x0300009E\r
+#define TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384 0x0300009F\r
+#define TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256 0x030000A0\r
+#define TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384 0x030000A1\r
+#define TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256 0x030000A2\r
+#define TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384 0x030000A3\r
+#define TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256 0x030000A4\r
+#define TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384 0x030000A5\r
+#define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256 0x030000A6\r
+#define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384 0x030000A7\r
+\r
/* ECC ciphersuites from draft-ietf-tls-ecc-12.txt with changes soon to be in draft 13 */\r
#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA 0x0300C001\r
#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA 0x0300C002\r
#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA 0x0300C018\r
#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA 0x0300C019\r
\r
+/* SRP ciphersuites from RFC 5054 */\r
+#define TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA 0x0300C01A\r
+#define TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA 0x0300C01B\r
+#define TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA 0x0300C01C\r
+#define TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA 0x0300C01D\r
+#define TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA 0x0300C01E\r
+#define TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA 0x0300C01F\r
+#define TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA 0x0300C020\r
+#define TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA 0x0300C021\r
+#define TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA 0x0300C022\r
+\r
+/* ECDH HMAC based ciphersuites from RFC5289 */\r
+\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 0x0300C023\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384 0x0300C024\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256 0x0300C025\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384 0x0300C026\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 0x0300C027\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384 0x0300C028\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256 0x0300C029\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384 0x0300C02A\r
+\r
+/* ECDH GCM based ciphersuites from RFC5289 */\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02B\r
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02C\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02D\r
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02E\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0x0300C02F\r
+#define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0x0300C030\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031\r
+#define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032\r
+\r
/* XXX\r
* Inconsistency alert:\r
* The OpenSSL names of ciphers with ephemeral DH here include the string\r
#define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA "PSK-AES128-CBC-SHA"\r
#define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA "PSK-AES256-CBC-SHA"\r
\r
+/* SRP ciphersuite from RFC 5054 */\r
+#define TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA "SRP-3DES-EDE-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA "SRP-RSA-3DES-EDE-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA "SRP-DSS-3DES-EDE-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA "SRP-AES-128-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA "SRP-RSA-AES-128-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA "SRP-DSS-AES-128-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA "SRP-AES-256-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA "SRP-RSA-AES-256-CBC-SHA"\r
+#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA "SRP-DSS-AES-256-CBC-SHA"\r
+\r
/* Camellia ciphersuites from RFC4132 */\r
#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA "CAMELLIA128-SHA"\r
#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA "DH-DSS-CAMELLIA128-SHA"\r
#define TLS1_TXT_DHE_RSA_WITH_SEED_SHA "DHE-RSA-SEED-SHA"\r
#define TLS1_TXT_ADH_WITH_SEED_SHA "ADH-SEED-SHA"\r
\r
+/* TLS v1.2 ciphersuites */\r
+#define TLS1_TXT_RSA_WITH_NULL_SHA256 "NULL-SHA256"\r
+#define TLS1_TXT_RSA_WITH_AES_128_SHA256 "AES128-SHA256"\r
+#define TLS1_TXT_RSA_WITH_AES_256_SHA256 "AES256-SHA256"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA256 "DH-DSS-AES128-SHA256"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA256 "DH-RSA-AES128-SHA256"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256 "DHE-DSS-AES128-SHA256"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256 "DHE-RSA-AES128-SHA256"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA256 "DH-DSS-AES256-SHA256"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA256 "DH-RSA-AES256-SHA256"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256 "DHE-DSS-AES256-SHA256"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256 "DHE-RSA-AES256-SHA256"\r
+#define TLS1_TXT_ADH_WITH_AES_128_SHA256 "ADH-AES128-SHA256"\r
+#define TLS1_TXT_ADH_WITH_AES_256_SHA256 "ADH-AES256-SHA256"\r
+\r
+/* TLS v1.2 GCM ciphersuites from RFC5288 */\r
+#define TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256 "AES128-GCM-SHA256"\r
+#define TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384 "AES256-GCM-SHA384"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256 "DHE-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384 "DHE-RSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256 "DH-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384 "DH-RSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256 "DHE-DSS-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384 "DHE-DSS-AES256-GCM-SHA384"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256 "DH-DSS-AES128-GCM-SHA256"\r
+#define TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384 "DH-DSS-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256 "ADH-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384 "ADH-AES256-GCM-SHA384"\r
+\r
+/* ECDH HMAC based ciphersuites from RFC5289 */\r
+\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256 "ECDHE-ECDSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384 "ECDHE-ECDSA-AES256-SHA384"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256 "ECDH-ECDSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384 "ECDH-ECDSA-AES256-SHA384"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 "ECDHE-RSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384 "ECDHE-RSA-AES256-SHA384"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256 "ECDH-RSA-AES128-SHA256"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384 "ECDH-RSA-AES256-SHA384"\r
+\r
+/* ECDH GCM based ciphersuites from RFC5289 */\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 "ECDHE-ECDSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 "ECDHE-ECDSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 "ECDH-ECDSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 "ECDH-ECDSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 "ECDHE-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384 "ECDHE-RSA-AES256-GCM-SHA384"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256"\r
+#define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384"\r
\r
#define TLS_CT_RSA_SIGN 1\r
#define TLS_CT_DSS_SIGN 2\r
#include <openssl/dh.h>\r
#endif\r
\r
-#include <openssl/evp.h>\r
-\r
-\r
#ifdef __cplusplus\r
extern "C" {\r
#endif\r
int (*UI_method_get_flusher(UI_METHOD *method))(UI*);\r
int (*UI_method_get_reader(UI_METHOD *method))(UI*,UI_STRING*);\r
int (*UI_method_get_closer(UI_METHOD *method))(UI*);\r
-char* (*UI_method_get_prompt_constructor(UI_METHOD *method))(UI*, const char*, const char*);\r
+char * (*UI_method_get_prompt_constructor(UI_METHOD *method))(UI*, const char*, const char*);\r
\r
/* The following functions are helpers for method writers to access relevant\r
data from a UI_STRING. */\r
} WHIRLPOOL_CTX;\r
\r
#ifndef OPENSSL_NO_WHIRLPOOL\r
+#ifdef OPENSSL_FIPS\r
+int private_WHIRLPOOL_Init(WHIRLPOOL_CTX *c);\r
+#endif\r
int WHIRLPOOL_Init (WHIRLPOOL_CTX *c);\r
int WHIRLPOOL_Update (WHIRLPOOL_CTX *c,const void *inp,size_t bytes);\r
void WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX *c,const void *inp,size_t bits);\r
\r
int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki);\r
\r
+int X509_signature_dump(BIO *bp,const ASN1_STRING *sig, int indent);\r
int X509_signature_print(BIO *bp,X509_ALGOR *alg, ASN1_STRING *sig);\r
\r
int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);\r
+int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);\r
int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);\r
+int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);\r
int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);\r
+int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);\r
int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);\r
\r
int X509_pubkey_digest(const X509 *data,const EVP_MD *type,\r
int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval);\r
void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,\r
X509_ALGOR *algor);\r
+void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md);\r
\r
X509_NAME *X509_NAME_dup(X509_NAME *xn);\r
X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);\r
int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,\r
ASN1_BIT_STRING *signature,\r
void *data, EVP_PKEY *pkey, const EVP_MD *type);\r
+int ASN1_item_sign_ctx(const ASN1_ITEM *it,\r
+ X509_ALGOR *algor1, X509_ALGOR *algor2,\r
+ ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx);\r
#endif\r
\r
int X509_set_version(X509 *x,long version);\r
unsigned char *salt, int saltlen,\r
unsigned char *aiv, int prf_nid);\r
\r
+X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen,\r
+ int prf_nid, int keylen);\r
+\r
/* PKCS#8 utilities */\r
\r
DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)\r
return FALSE;\r
#ifdef ENABLE_PROCESS_PROTECTION\r
// 同梱するOpenSSLのバージョンに合わせてSHA1ハッシュ値を変更すること\r
- // ssleay32.dll 1.0.0g\r
- // libssl32.dll 1.0.0g\r
- RegisterTrustedModuleSHA1Hash("\x42\x32\x3E\x44\x35\xBC\x98\x6C\x45\xC9\xA2\xB8\x41\xE7\xDA\x7B\x6A\x98\xB2\x28");\r
- // libeay32.dll 1.0.0g\r
- RegisterTrustedModuleSHA1Hash("\x3F\xC8\x07\x84\xB3\xF0\x71\x4A\x18\x59\x52\x1F\x99\x09\x65\xB9\x49\xA7\x15\x36");\r
+ // ssleay32.dll 1.0.1b\r
+ RegisterTrustedModuleSHA1Hash("\x08\xF5\x8B\x24\x0A\xC0\xE9\x12\x80\x43\x46\xFF\xAE\x77\x30\xD9\xEB\x90\x9F\xB5");\r
+ // libeay32.dll 1.0.1b\r
+ RegisterTrustedModuleSHA1Hash("\x8E\x4B\x7D\x8A\x11\xE4\xDB\xE7\xE8\xC8\x32\xBE\x20\xC9\xDF\x50\x94\x8D\x36\xDD");\r
#endif\r
g_hOpenSSL = LoadLibrary("ssleay32.dll");\r
// バージョン固定のためlibssl32.dllの読み込みは脆弱性の原因になり得るので廃止\r
OSDN Git Service
