| cipher.h | | cipher.h | |
|---|
| /** | | /** | |
| * \file cipher.h | | * \file cipher.h | |
| * | | * | |
| * \brief Generic cipher wrapper. | | * \brief Generic cipher wrapper. | |
| * | | * | |
| * \author Adriaan de Jong <dejong@fox-it.com> | | * \author Adriaan de Jong <dejong@fox-it.com> | |
| * | | * | |
|
| * Copyright (C) 2006-2012, Brainspark B.V. | | * Copyright (C) 2006-2013, Brainspark B.V. | |
| * | | * | |
| * This file is part of PolarSSL (http://www.polarssl.org) | | * This file is part of PolarSSL (http://www.polarssl.org) | |
| * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> | | * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> | |
| * | | * | |
| * All rights reserved. | | * All rights reserved. | |
| * | | * | |
| * This program is free software; you can redistribute it and/or modify | | * This program is free software; you can redistribute it and/or modify | |
| * it under the terms of the GNU General Public License as published by | | * it under the terms of the GNU General Public License as published by | |
| * the Free Software Foundation; either version 2 of the License, or | | * the Free Software Foundation; either version 2 of the License, or | |
| * (at your option) any later version. | | * (at your option) any later version. | |
| | | | |
| skipping to change at line 33 | | skipping to change at line 33 | |
|---|
| * GNU General Public License for more details. | | * GNU General Public License for more details. | |
| * | | * | |
| * You should have received a copy of the GNU General Public License along | | * You should have received a copy of the GNU General Public License along | |
| * with this program; if not, write to the Free Software Foundation, Inc., | | * with this program; if not, write to the Free Software Foundation, Inc., | |
| * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
| */ | | */ | |
| | | | |
| #ifndef POLARSSL_CIPHER_H | | #ifndef POLARSSL_CIPHER_H | |
| #define POLARSSL_CIPHER_H | | #define POLARSSL_CIPHER_H | |
| | | | |
|
| | | #include "config.h" | |
| | | | |
| | | #if defined(POLARSSL_GCM_C) | |
| | | #define POLARSSL_CIPHER_MODE_AEAD | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_CIPHER_MODE_CBC) | |
| | | #define POLARSSL_CIPHER_MODE_WITH_PADDING | |
| | | #endif | |
| | | | |
| #include <string.h> | | #include <string.h> | |
| | | | |
| #if defined(_MSC_VER) && !defined(inline) | | #if defined(_MSC_VER) && !defined(inline) | |
| #define inline _inline | | #define inline _inline | |
| #else | | #else | |
| #if defined(__ARMCC_VERSION) && !defined(inline) | | #if defined(__ARMCC_VERSION) && !defined(inline) | |
| #define inline __inline | | #define inline __inline | |
| #endif /* __ARMCC_VERSION */ | | #endif /* __ARMCC_VERSION */ | |
| #endif /*_MSC_VER */ | | #endif /*_MSC_VER */ | |
| | | | |
| #define POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 /**< Th
e selected feature is not available. */ | | #define POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 /**< Th
e selected feature is not available. */ | |
| #define POLARSSL_ERR_CIPHER_BAD_INPUT_DATA -0x6100 /**< Ba
d input parameters to function. */ | | #define POLARSSL_ERR_CIPHER_BAD_INPUT_DATA -0x6100 /**< Ba
d input parameters to function. */ | |
| #define POLARSSL_ERR_CIPHER_ALLOC_FAILED -0x6180 /**< Fa
iled to allocate memory. */ | | #define POLARSSL_ERR_CIPHER_ALLOC_FAILED -0x6180 /**< Fa
iled to allocate memory. */ | |
| #define POLARSSL_ERR_CIPHER_INVALID_PADDING -0x6200 /**< In
put data contains invalid padding and is rejected. */ | | #define POLARSSL_ERR_CIPHER_INVALID_PADDING -0x6200 /**< In
put data contains invalid padding and is rejected. */ | |
| #define POLARSSL_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280 /**< De
cryption of block requires a full block. */ | | #define POLARSSL_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280 /**< De
cryption of block requires a full block. */ | |
|
| | | #define POLARSSL_ERR_CIPHER_AUTH_FAILED -0x6300 /**< Au | |
| | | thentication failed (for AEAD modes). */ | |
| | | | |
| | | #ifdef __cplusplus | |
| | | extern "C" { | |
| | | #endif | |
| | | | |
| typedef enum { | | typedef enum { | |
| POLARSSL_CIPHER_ID_NONE = 0, | | POLARSSL_CIPHER_ID_NONE = 0, | |
| POLARSSL_CIPHER_ID_NULL, | | POLARSSL_CIPHER_ID_NULL, | |
| POLARSSL_CIPHER_ID_AES, | | POLARSSL_CIPHER_ID_AES, | |
| POLARSSL_CIPHER_ID_DES, | | POLARSSL_CIPHER_ID_DES, | |
| POLARSSL_CIPHER_ID_3DES, | | POLARSSL_CIPHER_ID_3DES, | |
| POLARSSL_CIPHER_ID_CAMELLIA, | | POLARSSL_CIPHER_ID_CAMELLIA, | |
| POLARSSL_CIPHER_ID_BLOWFISH, | | POLARSSL_CIPHER_ID_BLOWFISH, | |
|
| | | POLARSSL_CIPHER_ID_ARC4, | |
| } cipher_id_t; | | } cipher_id_t; | |
| | | | |
| typedef enum { | | typedef enum { | |
| POLARSSL_CIPHER_NONE = 0, | | POLARSSL_CIPHER_NONE = 0, | |
| POLARSSL_CIPHER_NULL, | | POLARSSL_CIPHER_NULL, | |
|
| | | POLARSSL_CIPHER_AES_128_ECB, | |
| | | POLARSSL_CIPHER_AES_192_ECB, | |
| | | POLARSSL_CIPHER_AES_256_ECB, | |
| POLARSSL_CIPHER_AES_128_CBC, | | POLARSSL_CIPHER_AES_128_CBC, | |
| POLARSSL_CIPHER_AES_192_CBC, | | POLARSSL_CIPHER_AES_192_CBC, | |
| POLARSSL_CIPHER_AES_256_CBC, | | POLARSSL_CIPHER_AES_256_CBC, | |
| POLARSSL_CIPHER_AES_128_CFB128, | | POLARSSL_CIPHER_AES_128_CFB128, | |
| POLARSSL_CIPHER_AES_192_CFB128, | | POLARSSL_CIPHER_AES_192_CFB128, | |
| POLARSSL_CIPHER_AES_256_CFB128, | | POLARSSL_CIPHER_AES_256_CFB128, | |
| POLARSSL_CIPHER_AES_128_CTR, | | POLARSSL_CIPHER_AES_128_CTR, | |
| POLARSSL_CIPHER_AES_192_CTR, | | POLARSSL_CIPHER_AES_192_CTR, | |
| POLARSSL_CIPHER_AES_256_CTR, | | POLARSSL_CIPHER_AES_256_CTR, | |
|
| | | POLARSSL_CIPHER_AES_128_GCM, | |
| | | POLARSSL_CIPHER_AES_192_GCM, | |
| | | POLARSSL_CIPHER_AES_256_GCM, | |
| | | POLARSSL_CIPHER_CAMELLIA_128_ECB, | |
| | | POLARSSL_CIPHER_CAMELLIA_192_ECB, | |
| | | POLARSSL_CIPHER_CAMELLIA_256_ECB, | |
| POLARSSL_CIPHER_CAMELLIA_128_CBC, | | POLARSSL_CIPHER_CAMELLIA_128_CBC, | |
| POLARSSL_CIPHER_CAMELLIA_192_CBC, | | POLARSSL_CIPHER_CAMELLIA_192_CBC, | |
| POLARSSL_CIPHER_CAMELLIA_256_CBC, | | POLARSSL_CIPHER_CAMELLIA_256_CBC, | |
| POLARSSL_CIPHER_CAMELLIA_128_CFB128, | | POLARSSL_CIPHER_CAMELLIA_128_CFB128, | |
| POLARSSL_CIPHER_CAMELLIA_192_CFB128, | | POLARSSL_CIPHER_CAMELLIA_192_CFB128, | |
| POLARSSL_CIPHER_CAMELLIA_256_CFB128, | | POLARSSL_CIPHER_CAMELLIA_256_CFB128, | |
| POLARSSL_CIPHER_CAMELLIA_128_CTR, | | POLARSSL_CIPHER_CAMELLIA_128_CTR, | |
| POLARSSL_CIPHER_CAMELLIA_192_CTR, | | POLARSSL_CIPHER_CAMELLIA_192_CTR, | |
| POLARSSL_CIPHER_CAMELLIA_256_CTR, | | POLARSSL_CIPHER_CAMELLIA_256_CTR, | |
|
| | | POLARSSL_CIPHER_DES_ECB, | |
| POLARSSL_CIPHER_DES_CBC, | | POLARSSL_CIPHER_DES_CBC, | |
|
| | | POLARSSL_CIPHER_DES_EDE_ECB, | |
| POLARSSL_CIPHER_DES_EDE_CBC, | | POLARSSL_CIPHER_DES_EDE_CBC, | |
|
| | | POLARSSL_CIPHER_DES_EDE3_ECB, | |
| POLARSSL_CIPHER_DES_EDE3_CBC, | | POLARSSL_CIPHER_DES_EDE3_CBC, | |
|
| | | POLARSSL_CIPHER_BLOWFISH_ECB, | |
| POLARSSL_CIPHER_BLOWFISH_CBC, | | POLARSSL_CIPHER_BLOWFISH_CBC, | |
| POLARSSL_CIPHER_BLOWFISH_CFB64, | | POLARSSL_CIPHER_BLOWFISH_CFB64, | |
| POLARSSL_CIPHER_BLOWFISH_CTR, | | POLARSSL_CIPHER_BLOWFISH_CTR, | |
|
| | | POLARSSL_CIPHER_ARC4_128, | |
| } cipher_type_t; | | } cipher_type_t; | |
| | | | |
| typedef enum { | | typedef enum { | |
| POLARSSL_MODE_NONE = 0, | | POLARSSL_MODE_NONE = 0, | |
|
| POLARSSL_MODE_NULL, | | POLARSSL_MODE_ECB, | |
| POLARSSL_MODE_CBC, | | POLARSSL_MODE_CBC, | |
| POLARSSL_MODE_CFB, | | POLARSSL_MODE_CFB, | |
| POLARSSL_MODE_OFB, | | POLARSSL_MODE_OFB, | |
| POLARSSL_MODE_CTR, | | POLARSSL_MODE_CTR, | |
|
| | | POLARSSL_MODE_GCM, | |
| | | POLARSSL_MODE_STREAM, | |
| } cipher_mode_t; | | } cipher_mode_t; | |
| | | | |
| typedef enum { | | typedef enum { | |
|
| | | POLARSSL_PADDING_PKCS7 = 0, /**< PKCS7 padding (default) */ | |
| | | POLARSSL_PADDING_ONE_AND_ZEROS, /**< ISO/IEC 7816-4 padding */ | |
| | | POLARSSL_PADDING_ZEROS_AND_LEN, /**< ANSI X.923 padding */ | |
| | | POLARSSL_PADDING_ZEROS, /**< zero padding (not reversible!) */ | |
| | | POLARSSL_PADDING_NONE, /**< never pad (full blocks only) */ | |
| | | } cipher_padding_t; | |
| | | | |
| | | typedef enum { | |
| POLARSSL_OPERATION_NONE = -1, | | POLARSSL_OPERATION_NONE = -1, | |
| POLARSSL_DECRYPT = 0, | | POLARSSL_DECRYPT = 0, | |
| POLARSSL_ENCRYPT, | | POLARSSL_ENCRYPT, | |
| } operation_t; | | } operation_t; | |
| | | | |
| enum { | | enum { | |
| /** Undefined key length */ | | /** Undefined key length */ | |
| POLARSSL_KEY_LENGTH_NONE = 0, | | POLARSSL_KEY_LENGTH_NONE = 0, | |
| /** Key length, in bits (including parity), for DES keys */ | | /** Key length, in bits (including parity), for DES keys */ | |
| POLARSSL_KEY_LENGTH_DES = 64, | | POLARSSL_KEY_LENGTH_DES = 64, | |
| | | | |
| skipping to change at line 124 | | skipping to change at line 164 | |
|---|
| }; | | }; | |
| | | | |
| /** | | /** | |
| * Base cipher information. The non-mode specific functions and values. | | * Base cipher information. The non-mode specific functions and values. | |
| */ | | */ | |
| typedef struct { | | typedef struct { | |
| | | | |
| /** Base Cipher type (e.g. POLARSSL_CIPHER_ID_AES) */ | | /** Base Cipher type (e.g. POLARSSL_CIPHER_ID_AES) */ | |
| cipher_id_t cipher; | | cipher_id_t cipher; | |
| | | | |
|
| | | /** Encrypt using ECB */ | |
| | | int (*ecb_func)( void *ctx, operation_t mode, | |
| | | const unsigned char *input, unsigned char *output ); | |
| | | | |
| /** Encrypt using CBC */ | | /** Encrypt using CBC */ | |
| int (*cbc_func)( void *ctx, operation_t mode, size_t length, unsigned c
har *iv, | | int (*cbc_func)( void *ctx, operation_t mode, size_t length, unsigned c
har *iv, | |
| const unsigned char *input, unsigned char *output ); | | const unsigned char *input, unsigned char *output ); | |
| | | | |
| /** Encrypt using CFB (Full length) */ | | /** Encrypt using CFB (Full length) */ | |
| int (*cfb_func)( void *ctx, operation_t mode, size_t length, size_t *iv
_off, | | int (*cfb_func)( void *ctx, operation_t mode, size_t length, size_t *iv
_off, | |
| unsigned char *iv, const unsigned char *input, unsigned char *o
utput ); | | unsigned char *iv, const unsigned char *input, unsigned char *o
utput ); | |
| | | | |
| /** Encrypt using CTR */ | | /** Encrypt using CTR */ | |
| int (*ctr_func)( void *ctx, size_t length, size_t *nc_off, unsigned cha
r *nonce_counter, | | int (*ctr_func)( void *ctx, size_t length, size_t *nc_off, unsigned cha
r *nonce_counter, | |
| unsigned char *stream_block, const unsigned char *input, unsign
ed char *output ); | | unsigned char *stream_block, const unsigned char *input, unsign
ed char *output ); | |
| | | | |
|
| | | /** Encrypt using STREAM */ | |
| | | int (*stream_func)( void *ctx, size_t length, | |
| | | const unsigned char *input, unsigned char *output ) | |
| | | ; | |
| | | | |
| /** Set key for encryption purposes */ | | /** Set key for encryption purposes */ | |
| int (*setkey_enc_func)( void *ctx, const unsigned char *key, unsigned i
nt key_length); | | int (*setkey_enc_func)( void *ctx, const unsigned char *key, unsigned i
nt key_length); | |
| | | | |
| /** Set key for decryption purposes */ | | /** Set key for decryption purposes */ | |
| int (*setkey_dec_func)( void *ctx, const unsigned char *key, unsigned i
nt key_length); | | int (*setkey_dec_func)( void *ctx, const unsigned char *key, unsigned i
nt key_length); | |
| | | | |
| /** Allocate a new context */ | | /** Allocate a new context */ | |
| void * (*ctx_alloc_func)( void ); | | void * (*ctx_alloc_func)( void ); | |
| | | | |
| /** Free the given context */ | | /** Free the given context */ | |
| | | | |
| skipping to change at line 167 | | skipping to change at line 215 | |
|---|
| /** Cipher mode (e.g. POLARSSL_MODE_CBC) */ | | /** Cipher mode (e.g. POLARSSL_MODE_CBC) */ | |
| cipher_mode_t mode; | | cipher_mode_t mode; | |
| | | | |
| /** Cipher key length, in bits (default length for variable sized ciphe
rs) | | /** Cipher key length, in bits (default length for variable sized ciphe
rs) | |
| * (Includes parity bits for ciphers like DES) */ | | * (Includes parity bits for ciphers like DES) */ | |
| unsigned int key_length; | | unsigned int key_length; | |
| | | | |
| /** Name of the cipher */ | | /** Name of the cipher */ | |
| const char * name; | | const char * name; | |
| | | | |
|
| /** IV size, in bytes */ | | /** IV/NONCE size, in bytes. | |
| | | * For cipher that accept many sizes: recommended size */ | |
| unsigned int iv_size; | | unsigned int iv_size; | |
| | | | |
|
| | | /** Flag for ciphers that accept many sizes of IV/NONCE */ | |
| | | int accepts_variable_iv_size; | |
| | | | |
| /** block size, in bytes */ | | /** block size, in bytes */ | |
| unsigned int block_size; | | unsigned int block_size; | |
| | | | |
| /** Base cipher information and functions */ | | /** Base cipher information and functions */ | |
| const cipher_base_t *base; | | const cipher_base_t *base; | |
| | | | |
| } cipher_info_t; | | } cipher_info_t; | |
| | | | |
| /** | | /** | |
| * Generic cipher context. | | * Generic cipher context. | |
| | | | |
| skipping to change at line 191 | | skipping to change at line 243 | |
|---|
| typedef struct { | | typedef struct { | |
| /** Information about the associated cipher */ | | /** Information about the associated cipher */ | |
| const cipher_info_t *cipher_info; | | const cipher_info_t *cipher_info; | |
| | | | |
| /** Key length to use */ | | /** Key length to use */ | |
| int key_length; | | int key_length; | |
| | | | |
| /** Operation that the context's key has been initialised for */ | | /** Operation that the context's key has been initialised for */ | |
| operation_t operation; | | operation_t operation; | |
| | | | |
|
| | | /** Padding functions to use, if relevant for cipher mode */ | |
| | | void (*add_padding)( unsigned char *output, size_t olen, size_t data_le | |
| | | n ); | |
| | | int (*get_padding)( unsigned char *input, size_t ilen, size_t *data_len | |
| | | ); | |
| | | | |
| /** Buffer for data that hasn't been encrypted yet */ | | /** Buffer for data that hasn't been encrypted yet */ | |
| unsigned char unprocessed_data[POLARSSL_MAX_IV_LENGTH]; | | unsigned char unprocessed_data[POLARSSL_MAX_IV_LENGTH]; | |
| | | | |
| /** Number of bytes that still need processing */ | | /** Number of bytes that still need processing */ | |
| size_t unprocessed_len; | | size_t unprocessed_len; | |
| | | | |
| /** Current IV or NONCE_COUNTER for CTR-mode */ | | /** Current IV or NONCE_COUNTER for CTR-mode */ | |
| unsigned char iv[POLARSSL_MAX_IV_LENGTH]; | | unsigned char iv[POLARSSL_MAX_IV_LENGTH]; | |
| | | | |
|
| | | /** IV size in bytes (for ciphers with variable-length IVs) */ | |
| | | size_t iv_size; | |
| | | | |
| /** Cipher-specific context */ | | /** Cipher-specific context */ | |
| void *cipher_ctx; | | void *cipher_ctx; | |
| } cipher_context_t; | | } cipher_context_t; | |
| | | | |
|
| #ifdef __cplusplus | | | |
| extern "C" { | | | |
| #endif | | | |
| | | | |
| /** | | /** | |
| * \brief Returns the list of ciphers supported by the generic cipher modul
e. | | * \brief Returns the list of ciphers supported by the generic cipher modul
e. | |
| * | | * | |
| * \return a statically allocated array of ciphers, the last e
ntry | | * \return a statically allocated array of ciphers, the last e
ntry | |
| * is 0. | | * is 0. | |
| */ | | */ | |
| const int *cipher_list( void ); | | const int *cipher_list( void ); | |
| | | | |
| /** | | /** | |
| * \brief Returns the cipher information structure associated | | * \brief Returns the cipher information structure associated | |
| | | | |
| skipping to change at line 239 | | skipping to change at line 294 | |
|---|
| * with the given cipher type. | | * with the given cipher type. | |
| * | | * | |
| * \param cipher_type Type of the cipher to search for. | | * \param cipher_type Type of the cipher to search for. | |
| * | | * | |
| * \return the cipher information structure associated with th
e | | * \return the cipher information structure associated with th
e | |
| * given cipher_type, or NULL if not found. | | * given cipher_type, or NULL if not found. | |
| */ | | */ | |
| const cipher_info_t *cipher_info_from_type( const cipher_type_t cipher_type
); | | const cipher_info_t *cipher_info_from_type( const cipher_type_t cipher_type
); | |
| | | | |
| /** | | /** | |
|
| | | * \brief Returns the cipher information structure associated | |
| | | * with the given cipher id, key size and mode. | |
| | | * | |
| | | * \param cipher_id Id of the cipher to search for | |
| | | * (e.g. POLARSSL_CIPHER_ID_AES) | |
| | | * \param key_length Length of the key in bits | |
| | | * \param mode Cipher mode (e.g. POLARSSL_MODE_CBC) | |
| | | * | |
| | | * \return the cipher information structure associated with th | |
| | | e | |
| | | * given cipher_type, or NULL if not found. | |
| | | */ | |
| | | const cipher_info_t *cipher_info_from_values( const cipher_id_t cipher_id, | |
| | | int key_length, | |
| | | const cipher_mode_t mode ); | |
| | | | |
| | | /** | |
| * \brief Initialises and fills the cipher context structure
with | | * \brief Initialises and fills the cipher context structure
with | |
| * the appropriate values. | | * the appropriate values. | |
| * | | * | |
| * \param ctx context to initialise. May not be NULL. | | * \param ctx context to initialise. May not be NULL. | |
| * \param cipher_info cipher to use. | | * \param cipher_info cipher to use. | |
| * | | * | |
| * \return \c 0 on success, | | * \return \c 0 on success, | |
| * \c POLARSSL_ERR_CIPHER_BAD_INPUT_DATA on parameter
failure, | | * \c POLARSSL_ERR_CIPHER_BAD_INPUT_DATA on parameter
failure, | |
| * \c POLARSSL_ERR_CIPHER_ALLOC_FAILED if allocation o
f the | | * \c POLARSSL_ERR_CIPHER_ALLOC_FAILED if allocation o
f the | |
| * cipher-specific context failed. | | * cipher-specific context failed. | |
| | | | |
| skipping to change at line 297 | | skipping to change at line 368 | |
|---|
| */ | | */ | |
| static inline cipher_mode_t cipher_get_cipher_mode( const cipher_context_t
*ctx ) | | static inline cipher_mode_t cipher_get_cipher_mode( const cipher_context_t
*ctx ) | |
| { | | { | |
| if( NULL == ctx || NULL == ctx->cipher_info ) | | if( NULL == ctx || NULL == ctx->cipher_info ) | |
| return POLARSSL_MODE_NONE; | | return POLARSSL_MODE_NONE; | |
| | | | |
| return ctx->cipher_info->mode; | | return ctx->cipher_info->mode; | |
| } | | } | |
| | | | |
| /** | | /** | |
|
| * \brief Returns the size of the cipher's IV. | | * \brief Returns the size of the cipher's IV/NONCE in bytes. | |
| * | | * | |
| * \param ctx cipher's context. Must have been initialised. | | * \param ctx cipher's context. Must have been initialised. | |
| * | | * | |
|
| * \return size of the cipher's IV, or 0 if ctx has not been | | * \return If IV has not been set yet: (recommended) IV size | |
| * initialised. | | * (0 for ciphers not using IV/NONCE). | |
| | | * If IV has already been set: actual size. | |
| */ | | */ | |
| static inline int cipher_get_iv_size( const cipher_context_t *ctx ) | | static inline int cipher_get_iv_size( const cipher_context_t *ctx ) | |
| { | | { | |
| if( NULL == ctx || NULL == ctx->cipher_info ) | | if( NULL == ctx || NULL == ctx->cipher_info ) | |
| return 0; | | return 0; | |
| | | | |
|
| | | if( ctx->iv_size != 0 ) | |
| | | return ctx->iv_size; | |
| | | | |
| return ctx->cipher_info->iv_size; | | return ctx->cipher_info->iv_size; | |
| } | | } | |
| | | | |
| /** | | /** | |
| * \brief Returns the type of the given cipher. | | * \brief Returns the type of the given cipher. | |
| * | | * | |
| * \param ctx cipher's context. Must have been initialised. | | * \param ctx cipher's context. Must have been initialised. | |
| * | | * | |
| * \return type of the cipher, or POLARSSL_CIPHER_NONE if ctx
has | | * \return type of the cipher, or POLARSSL_CIPHER_NONE if ctx
has | |
| * not been initialised. | | * not been initialised. | |
| | | | |
| skipping to change at line 354 | | skipping to change at line 429 | |
|---|
| * \brief Returns the key length of the cipher. | | * \brief Returns the key length of the cipher. | |
| * | | * | |
| * \param ctx cipher's context. Must have been initialised. | | * \param ctx cipher's context. Must have been initialised. | |
| * | | * | |
| * \return cipher's key length, in bits, or | | * \return cipher's key length, in bits, or | |
| * POLARSSL_KEY_LENGTH_NONE if ctx has not been | | * POLARSSL_KEY_LENGTH_NONE if ctx has not been | |
| * initialised. | | * initialised. | |
| */ | | */ | |
| static inline int cipher_get_key_size ( const cipher_context_t *ctx ) | | static inline int cipher_get_key_size ( const cipher_context_t *ctx ) | |
| { | | { | |
|
| if( NULL == ctx ) | | if( NULL == ctx || NULL == ctx->cipher_info ) | |
| return POLARSSL_KEY_LENGTH_NONE; | | return POLARSSL_KEY_LENGTH_NONE; | |
| | | | |
|
| return ctx->key_length; | | return ctx->cipher_info->key_length; | |
| } | | } | |
| | | | |
| /** | | /** | |
| * \brief Returns the operation of the given cipher. | | * \brief Returns the operation of the given cipher. | |
| * | | * | |
| * \param ctx cipher's context. Must have been initialised. | | * \param ctx cipher's context. Must have been initialised. | |
| * | | * | |
| * \return operation (POLARSSL_ENCRYPT or POLARSSL_DECRYPT), | | * \return operation (POLARSSL_ENCRYPT or POLARSSL_DECRYPT), | |
| * or POLARSSL_OPERATION_NONE if ctx has not been | | * or POLARSSL_OPERATION_NONE if ctx has not been | |
| * initialised. | | * initialised. | |
| | | | |
| skipping to change at line 395 | | skipping to change at line 470 | |
|---|
| * \param operation Operation that the key will be used for, either | | * \param operation Operation that the key will be used for, either | |
| * POLARSSL_ENCRYPT or POLARSSL_DECRYPT. | | * POLARSSL_ENCRYPT or POLARSSL_DECRYPT. | |
| * | | * | |
| * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if | | * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if | |
| * parameter verification fails or a cipher specific | | * parameter verification fails or a cipher specific | |
| * error code. | | * error code. | |
| */ | | */ | |
| int cipher_setkey( cipher_context_t *ctx, const unsigned char *key, int key
_length, | | int cipher_setkey( cipher_context_t *ctx, const unsigned char *key, int key
_length, | |
| const operation_t operation ); | | const operation_t operation ); | |
| | | | |
|
| | | #if defined(POLARSSL_CIPHER_MODE_WITH_PADDING) | |
| /** | | /** | |
|
| * \brief Reset the given context, setting the IV to iv | | * \brief Set padding mode, for cipher modes that use padding | |
| | | . | |
| | | * (Default: PKCS7 padding.) | |
| | | * | |
| | | * \param ctx generic cipher context | |
| | | * \param mode padding mode | |
| | | * | |
| | | * \returns 0 on success, POLARSSL_ERR_CIPHER_FEATURE_UNAVAILAB | |
| | | LE | |
| | | * if selected padding mode is not supported, or | |
| | | * POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if the cipher mo | |
| | | de | |
| | | * does not support padding. | |
| | | */ | |
| | | int cipher_set_padding_mode( cipher_context_t *ctx, cipher_padding_t mode ) | |
| | | ; | |
| | | #endif /* POLARSSL_CIPHER_MODE_WITH_PADDING */ | |
| | | | |
| | | /** | |
| | | * \brief Set the initialization vector (IV) or nonce | |
| | | * | |
| | | * \param ctx generic cipher context | |
| | | * \param iv IV to use (or NONCE_COUNTER for CTR-mode ciphers) | |
| | | * \param iv_len IV length for ciphers with variable-size IV; | |
| | | * discarded by ciphers with fixed-size IV. | |
| | | * | |
| | | * \returns O on success, or POLARSSL_ERR_CIPHER_BAD_INPUT_DATA | |
| | | * | |
| | | * \note Some ciphers don't use IVs nor NONCE. For these | |
| | | * ciphers, this function has no effect. | |
| | | */ | |
| | | int cipher_set_iv( cipher_context_t *ctx, | |
| | | const unsigned char *iv, size_t iv_len ); | |
| | | | |
| | | /** | |
| | | * \brief Finish preparation of the given context | |
| * | | * | |
| * \param ctx generic cipher context | | * \param ctx generic cipher context | |
|
| * \param iv IV to use or NONCE_COUNTER in the case of a CTR-mod
e cipher | | | |
| * | | * | |
| * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA | | * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA | |
| * if parameter verification fails. | | * if parameter verification fails. | |
| */ | | */ | |
|
| int cipher_reset( cipher_context_t *ctx, const unsigned char *iv ); | | int cipher_reset( cipher_context_t *ctx ); | |
| | | | |
| | | #if defined(POLARSSL_CIPHER_MODE_AEAD) | |
| | | /** | |
| | | * \brief Add additional data (for AEAD ciphers). | |
| | | * This function has no effect for non-AEAD ciphers. | |
| | | * For AEAD ciphers, it may or may not be called | |
| | | * repeatedly, and/or interleaved with calls to | |
| | | * cipher_udpate(), depending on the cipher. | |
| | | * E.g. for GCM is must be called exactly once, right | |
| | | * after cipher_reset(). | |
| | | * | |
| | | * \param ctx generic cipher context | |
| | | * \param ad Additional data to use. | |
| | | * \param ad_len Length of ad. | |
| | | * | |
| | | * \returns 0 on success, or a specific error code. | |
| | | */ | |
| | | int cipher_update_ad( cipher_context_t *ctx, | |
| | | const unsigned char *ad, size_t ad_len ); | |
| | | #endif /* POLARSSL_CIPHER_MODE_AEAD */ | |
| | | | |
| /** | | /** | |
| * \brief Generic cipher update function. Encrypts/decrypts | | * \brief Generic cipher update function. Encrypts/decrypts | |
| * using the given cipher context. Writes as many bloc
k | | * using the given cipher context. Writes as many bloc
k | |
| * size'd blocks of data as possible to output. Any da
ta | | * size'd blocks of data as possible to output. Any da
ta | |
| * that cannot be written immediately will either be a
dded | | * that cannot be written immediately will either be a
dded | |
| * to the next block, or flushed when cipher_final is | | * to the next block, or flushed when cipher_final is | |
| * called. | | * called. | |
|
| | | * Exception: for POLARSSL_MODE_ECB, expects single bl | |
| | | ock | |
| | | * in size (e.g. 16 bytes for AES) | |
| * | | * | |
| * \param ctx generic cipher context | | * \param ctx generic cipher context | |
| * \param input buffer holding the input data | | * \param input buffer holding the input data | |
| * \param ilen length of the input data | | * \param ilen length of the input data | |
| * \param output buffer for the output data. Should be able to hold
at | | * \param output buffer for the output data. Should be able to hold
at | |
| * least ilen + block_size. Cannot be the same buffer
as | | * least ilen + block_size. Cannot be the same buffer
as | |
| * input! | | * input! | |
| * \param olen length of the output data, will be filled with the | | * \param olen length of the output data, will be filled with the | |
| * actual number of bytes written. | | * actual number of bytes written. | |
| * | | * | |
| * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if | | * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if | |
| * parameter verification fails, | | * parameter verification fails, | |
| * POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE on an | | * POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE on an | |
| * unsupported mode for a cipher or a cipher specific | | * unsupported mode for a cipher or a cipher specific | |
| * error code. | | * error code. | |
|
| | | * | |
| | | * \note If the underlying cipher is GCM, all calls to this | |
| | | * function, except the last one before cipher_finish( | |
| | | ), | |
| | | * must have ilen a multiple of the block size. | |
| */ | | */ | |
| int cipher_update( cipher_context_t *ctx, const unsigned char *input, size_
t ilen, | | int cipher_update( cipher_context_t *ctx, const unsigned char *input, size_
t ilen, | |
| unsigned char *output, size_t *olen ); | | unsigned char *output, size_t *olen ); | |
| | | | |
| /** | | /** | |
| * \brief Generic cipher finalisation function. If data still | | * \brief Generic cipher finalisation function. If data still | |
| * needs to be flushed from an incomplete block, data | | * needs to be flushed from an incomplete block, data | |
| * contained within it will be padded with the size of | | * contained within it will be padded with the size of | |
| * the last block, and written to the output buffer. | | * the last block, and written to the output buffer. | |
| * | | * | |
| * \param ctx Generic cipher context | | * \param ctx Generic cipher context | |
|
| * \param output buffer to write data to. Needs block_size data avai
lable. | | * \param output buffer to write data to. Needs block_size available
. | |
| * \param olen length of the data written to the output buffer. | | * \param olen length of the data written to the output buffer. | |
| * | | * | |
| * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if | | * \returns 0 on success, POLARSSL_ERR_CIPHER_BAD_INPUT_DATA if | |
| * parameter verification fails, | | * parameter verification fails, | |
| * POLARSSL_ERR_CIPHER_FULL_BLOCK_EXPECTED if decrypti
on | | * POLARSSL_ERR_CIPHER_FULL_BLOCK_EXPECTED if decrypti
on | |
| * expected a full block but was not provided one, | | * expected a full block but was not provided one, | |
| * POLARSSL_ERR_CIPHER_INVALID_PADDING on invalid padd
ing | | * POLARSSL_ERR_CIPHER_INVALID_PADDING on invalid padd
ing | |
| * while decrypting or a cipher specific error code. | | * while decrypting or a cipher specific error code. | |
| */ | | */ | |
|
| int cipher_finish( cipher_context_t *ctx, unsigned char *output, size_t *ol | | int cipher_finish( cipher_context_t *ctx, | |
| en); | | unsigned char *output, size_t *olen ); | |
| | | | |
| | | #if defined(POLARSSL_CIPHER_MODE_AEAD) | |
| | | /** | |
| | | * \brief Write tag for AEAD ciphers. | |
| | | * No effect for other ciphers. | |
| | | * Must be called after cipher_finish(). | |
| | | * | |
| | | * \param ctx Generic cipher context | |
| | | * \param tag buffer to write the tag | |
| | | * \param tag_len Length of the tag to write | |
| | | * | |
| | | * \return 0 on success, or a specific error code. | |
| | | */ | |
| | | int cipher_write_tag( cipher_context_t *ctx, | |
| | | unsigned char *tag, size_t tag_len ); | |
| | | | |
| | | /** | |
| | | * \brief Check tag for AEAD ciphers. | |
| | | * No effect for other ciphers. | |
| | | * Calling time depends on the cipher: | |
| | | * for GCM, must be called after cipher_finish(). | |
| | | * | |
| | | * \param ctx Generic cipher context | |
| | | * \param tag Buffer holding the tag | |
| | | * \param tag_len Length of the tag to check | |
| | | * | |
| | | * \return 0 on success, or a specific error code. | |
| | | */ | |
| | | int cipher_check_tag( cipher_context_t *ctx, | |
| | | const unsigned char *tag, size_t tag_len ); | |
| | | #endif /* POLARSSL_CIPHER_MODE_AEAD */ | |
| | | | |
| /** | | /** | |
| * \brief Checkup routine | | * \brief Checkup routine | |
| * | | * | |
| * \return 0 if successful, or 1 if the test failed | | * \return 0 if successful, or 1 if the test failed | |
| */ | | */ | |
| int cipher_self_test( int verbose ); | | int cipher_self_test( int verbose ); | |
| | | | |
| #ifdef __cplusplus | | #ifdef __cplusplus | |
| } | | } | |
| #endif | | #endif | |
| | | | |
|
| #endif /* POLARSSL_MD_H */ | | #endif /* POLARSSL_CIPHER_H */ | |
| | | | |
| End of changes. 36 change blocks. |
|---|
| 18 lines changed or deleted | | 192 lines changed or added | |
|---|
|
| config.h | | config.h | |
|---|
| | | | |
| skipping to change at line 74 | | skipping to change at line 74 | |
|---|
| * \def POLARSSL_HAVE_LONGLONG | | * \def POLARSSL_HAVE_LONGLONG | |
| * | | * | |
| * The compiler supports the 'long long' type. | | * The compiler supports the 'long long' type. | |
| * (Only used on 32-bit platforms) | | * (Only used on 32-bit platforms) | |
| */ | | */ | |
| #define POLARSSL_HAVE_LONGLONG | | #define POLARSSL_HAVE_LONGLONG | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_HAVE_ASM | | * \def POLARSSL_HAVE_ASM | |
| * | | * | |
|
| * The compiler has support for asm() | | * The compiler has support for asm(). | |
| * | | | |
| * Uncomment to enable the use of assembly code. | | | |
| * | | * | |
| * Requires support for asm() in compiler. | | * Requires support for asm() in compiler. | |
| * | | * | |
| * Used in: | | * Used in: | |
| * library/timing.c | | * library/timing.c | |
| * library/padlock.c | | * library/padlock.c | |
| * include/polarssl/bn_mul.h | | * include/polarssl/bn_mul.h | |
| * | | * | |
|
| | | * Comment to disable the use of assembly code. | |
| */ | | */ | |
| #define POLARSSL_HAVE_ASM | | #define POLARSSL_HAVE_ASM | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_HAVE_SSE2 | | * \def POLARSSL_HAVE_SSE2 | |
| * | | * | |
| * CPU supports SSE2 instruction set. | | * CPU supports SSE2 instruction set. | |
| * | | * | |
| * Uncomment if the CPU supports SSE2 (IA-32 specific). | | * Uncomment if the CPU supports SSE2 (IA-32 specific). | |
|
| * | | | |
| #define POLARSSL_HAVE_SSE2 | | #define POLARSSL_HAVE_SSE2 | |
| */ | | */ | |
|
| /* \} name */ | | | |
| | | /** | |
| | | * \def POLARSSL_HAVE_TIME | |
| | | * | |
| | | * System has time.h and time() / localtime() / gettimeofday(). | |
| | | * | |
| | | * Comment if your system does not support time functions | |
| | | */ | |
| | | #define POLARSSL_HAVE_TIME | |
| | | /* \} name SECTION: System support */ | |
| | | | |
| /** | | /** | |
| * \name SECTION: PolarSSL feature support | | * \name SECTION: PolarSSL feature support | |
| * | | * | |
| * This section sets support for features that are or are not needed | | * This section sets support for features that are or are not needed | |
| * within the modules that are enabled. | | * within the modules that are enabled. | |
| * \{ | | * \{ | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| | | | |
| skipping to change at line 132 | | skipping to change at line 139 | |
|---|
| #define POLARSSL_AES_ALT | | #define POLARSSL_AES_ALT | |
| #define POLARSSL_ARC4_ALT | | #define POLARSSL_ARC4_ALT | |
| #define POLARSSL_BLOWFISH_ALT | | #define POLARSSL_BLOWFISH_ALT | |
| #define POLARSSL_CAMELLIA_ALT | | #define POLARSSL_CAMELLIA_ALT | |
| #define POLARSSL_DES_ALT | | #define POLARSSL_DES_ALT | |
| #define POLARSSL_XTEA_ALT | | #define POLARSSL_XTEA_ALT | |
| #define POLARSSL_MD2_ALT | | #define POLARSSL_MD2_ALT | |
| #define POLARSSL_MD4_ALT | | #define POLARSSL_MD4_ALT | |
| #define POLARSSL_MD5_ALT | | #define POLARSSL_MD5_ALT | |
| #define POLARSSL_SHA1_ALT | | #define POLARSSL_SHA1_ALT | |
|
| #define POLARSSL_SHA2_ALT | | #define POLARSSL_SHA256_ALT | |
| #define POLARSSL_SHA4_ALT | | #define POLARSSL_SHA512_ALT | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_AES_ROM_TABLES | | * \def POLARSSL_AES_ROM_TABLES | |
| * | | * | |
| * Store the AES tables in ROM. | | * Store the AES tables in ROM. | |
| * | | * | |
| * Uncomment this macro to store the AES tables in ROM. | | * Uncomment this macro to store the AES tables in ROM. | |
| * | | * | |
| #define POLARSSL_AES_ROM_TABLES | | #define POLARSSL_AES_ROM_TABLES | |
| */ | | */ | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_CIPHER_MODE_CBC | |
| | | * | |
| | | * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. | |
| | | */ | |
| | | #define POLARSSL_CIPHER_MODE_CBC | |
| | | | |
| | | /** | |
| * \def POLARSSL_CIPHER_MODE_CFB | | * \def POLARSSL_CIPHER_MODE_CFB | |
| * | | * | |
| * Enable Cipher Feedback mode (CFB) for symmetric ciphers. | | * Enable Cipher Feedback mode (CFB) for symmetric ciphers. | |
| */ | | */ | |
| #define POLARSSL_CIPHER_MODE_CFB | | #define POLARSSL_CIPHER_MODE_CFB | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_CIPHER_MODE_CTR | | * \def POLARSSL_CIPHER_MODE_CTR | |
| * | | * | |
| * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. | | * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. | |
| | | | |
| skipping to change at line 172 | | skipping to change at line 186 | |
|---|
| * | | * | |
| * Enable NULL cipher. | | * Enable NULL cipher. | |
| * Warning: Only do so when you know what you are doing. This allows for | | * Warning: Only do so when you know what you are doing. This allows for | |
| * encryption or channels without any security! | | * encryption or channels without any security! | |
| * | | * | |
| * Requires POLARSSL_ENABLE_WEAK_CIPHERSUITES as well to enable | | * Requires POLARSSL_ENABLE_WEAK_CIPHERSUITES as well to enable | |
| * the following ciphersuites: | | * the following ciphersuites: | |
| * TLS_RSA_WITH_NULL_MD5 | | * TLS_RSA_WITH_NULL_MD5 | |
| * TLS_RSA_WITH_NULL_SHA | | * TLS_RSA_WITH_NULL_SHA | |
| * TLS_RSA_WITH_NULL_SHA256 | | * TLS_RSA_WITH_NULL_SHA256 | |
|
| | | * TLS_ECDHE_RSA_WITH_NULL_SHA | |
| | | * TLS_PSK_WITH_NULL | |
| | | * TLS_PSK_WITH_NULL256 | |
| | | * TLS_PSK_WITH_NULL384 | |
| | | * TLS_DHE_PSK_WITH_NULL | |
| | | * TLS_DHE_PSK_WITH_NULL256 | |
| | | * TLS_DHE_PSK_WITH_NULL384 | |
| | | * TLS_RSA_PSK_WITH_NULL | |
| | | * TLS_RSA_PSK_WITH_NULL256 | |
| | | * TLS_RSA_PSK_WITH_NULL384 | |
| * | | * | |
| * Uncomment this macro to enable the NULL cipher and ciphersuites | | * Uncomment this macro to enable the NULL cipher and ciphersuites | |
| #define POLARSSL_CIPHER_NULL_CIPHER | | #define POLARSSL_CIPHER_NULL_CIPHER | |
| */ | | */ | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_CIPHER_PADDING_XXX | |
| | | * | |
| | | * Uncomment or comment macros to add support for specific padding modes | |
| | | * in the cipher layer with cipher modes that support padding (e.g. CBC) | |
| | | * | |
| | | * If you disable all padding modes, only full blocks can be used with CBC. | |
| | | * | |
| | | * Enable padding modes in the cipher layer. | |
| | | */ | |
| | | #define POLARSSL_CIPHER_PADDING_PKCS7 | |
| | | #define POLARSSL_CIPHER_PADDING_ONE_AND_ZEROS | |
| | | #define POLARSSL_CIPHER_PADDING_ZEROS_AND_LEN | |
| | | #define POLARSSL_CIPHER_PADDING_ZEROS | |
| | | | |
| | | /** | |
| * \def POLARSSL_ENABLE_WEAK_CIPHERSUITES | | * \def POLARSSL_ENABLE_WEAK_CIPHERSUITES | |
| * | | * | |
|
| * Enable weak ciphersuites in SSL / TLS | | * Enable weak ciphersuites in SSL / TLS. | |
| * Warning: Only do so when you know what you are doing. This allows for | | * Warning: Only do so when you know what you are doing. This allows for | |
| * channels with virtually no security at all! | | * channels with virtually no security at all! | |
| * | | * | |
| * This enables the following ciphersuites: | | * This enables the following ciphersuites: | |
| * TLS_RSA_WITH_DES_CBC_SHA | | * TLS_RSA_WITH_DES_CBC_SHA | |
| * TLS_DHE_RSA_WITH_DES_CBC_SHA | | * TLS_DHE_RSA_WITH_DES_CBC_SHA | |
| * | | * | |
| * Uncomment this macro to enable weak ciphersuites | | * Uncomment this macro to enable weak ciphersuites | |
| #define POLARSSL_ENABLE_WEAK_CIPHERSUITES | | #define POLARSSL_ENABLE_WEAK_CIPHERSUITES | |
| */ | | */ | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_ECP_XXXX_ENABLED | |
| | | * | |
| | | * Enables specific curves within the Elliptic Curve module. | |
| | | * By default all supported curves are enables. | |
| | | * | |
| | | * Comment macros to disable the curve and functions for it | |
| | | */ | |
| | | #define POLARSSL_ECP_DP_SECP192R1_ENABLED | |
| | | #define POLARSSL_ECP_DP_SECP224R1_ENABLED | |
| | | #define POLARSSL_ECP_DP_SECP256R1_ENABLED | |
| | | #define POLARSSL_ECP_DP_SECP384R1_ENABLED | |
| | | #define POLARSSL_ECP_DP_SECP521R1_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_PSK_ENABLED | |
| | | * | |
| | | * Enable the PSK based ciphersuite modes in SSL / TLS. | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_PSK_WITH_RC4_128_SHA | |
| | | * TLS_PSK_WITH_3DES_EDE_CBC_SHA | |
| | | * TLS_PSK_WITH_AES_128_CBC_SHA | |
| | | * TLS_PSK_WITH_AES_256_CBC_SHA | |
| | | * TLS_PSK_WITH_AES_128_CBC_SHA256 | |
| | | * TLS_PSK_WITH_AES_256_CBC_SHA384 | |
| | | * TLS_PSK_WITH_AES_128_GCM_SHA256 | |
| | | * TLS_PSK_WITH_AES_256_GCM_SHA384 | |
| | | */ | |
| | | #define POLARSSL_KEY_EXCHANGE_PSK_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED | |
| | | * | |
| | | * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. | |
| | | * | |
| | | * Requires: POLARSSL_DHM_C | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_DHE_PSK_WITH_RC4_128_SHA | |
| | | * TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA | |
| | | * TLS_DHE_PSK_WITH_AES_128_CBC_SHA | |
| | | * TLS_DHE_PSK_WITH_AES_256_CBC_SHA | |
| | | * TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 | |
| | | * TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 | |
| | | * TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 | |
| | | * TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 | |
| | | */ | |
| | | #define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED | |
| | | * | |
| | | * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. | |
| | | * (NOT YET IMPLEMENTED) | |
| | | * Requires: POLARSSL_RSA_C, POLARSSL_PKCS1_V15, | |
| | | * POLARSSL_X509_CRT_PARSE_C | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_RSA_PSK_WITH_RC4_128_SHA | |
| | | * TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA | |
| | | * TLS_RSA_PSK_WITH_AES_128_CBC_SHA | |
| | | * TLS_RSA_PSK_WITH_AES_256_CBC_SHA | |
| | | * TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 | |
| | | * TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 | |
| | | * TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 | |
| | | * TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 | |
| | | #define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_RSA_ENABLED | |
| | | * | |
| | | * Enable the RSA-only based ciphersuite modes in SSL / TLS. | |
| | | * | |
| | | * Requires: POLARSSL_RSA_C, POLARSSL_PKCS1_V15, | |
| | | * POLARSSL_X509_CRT_PARSE_C | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_RSA_WITH_AES_128_CBC_SHA | |
| | | * TLS_RSA_WITH_AES_256_CBC_SHA | |
| | | * TLS_RSA_WITH_AES_128_CBC_SHA256 | |
| | | * TLS_RSA_WITH_AES_256_CBC_SHA256 | |
| | | * TLS_RSA_WITH_AES_128_GCM_SHA256 | |
| | | * TLS_RSA_WITH_AES_256_GCM_SHA384 | |
| | | * TLS_RSA_WITH_RC4_128_MD5 | |
| | | * TLS_RSA_WITH_RC4_128_SHA | |
| | | * TLS_RSA_WITH_CAMELLIA_128_CBC_SHA | |
| | | * TLS_RSA_WITH_CAMELLIA_256_CBC_SHA | |
| | | * TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 | |
| | | * TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 | |
| | | * TLS_RSA_WITH_3DES_EDE_CBC_SHA | |
| | | */ | |
| | | #define POLARSSL_KEY_EXCHANGE_RSA_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED | |
| | | * | |
| | | * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. | |
| | | * | |
| | | * Requires: POLARSSL_DHM_C, POLARSSL_RSA_C, POLARSSL_PKCS1_V15, | |
| | | * POLARSSL_X509_CRT_PARSE_C | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_DHE_RSA_WITH_AES_128_CBC_SHA | |
| | | * TLS_DHE_RSA_WITH_AES_256_CBC_SHA | |
| | | * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | |
| | | * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | |
| | | * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA | |
| | | * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA | |
| | | * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 | |
| | | * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 | |
| | | * TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA | |
| | | */ | |
| | | #define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED | |
| | | * | |
| | | * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. | |
| | | * | |
| | | * Requires: POLARSSL_ECDH_C, POLARSSL_RSA_C, POLARSSL_PKCS1_V15, | |
| | | * POLARSSL_X509_CRT_PARSE_C | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | |
| | | * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | |
| | | * TLS_ECDHE_RSA_WITH_RC4_128_SHA | |
| | | * TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | |
| | | * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | |
| | | * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | |
| | | * TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | |
| | | * TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | |
| | | * TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 | |
| | | * TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 | |
| | | */ | |
| | | #define POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED | |
| | | * | |
| | | * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. | |
| | | * | |
| | | * Requires: POLARSSL_ECDH_C, POLARSSL_ECDSA_C, POLARSSL_X509_CRT_PARSE_C, | |
| | | * | |
| | | * This enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, | |
| | | * TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, | |
| | | * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, | |
| | | * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, | |
| | | * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, | |
| | | * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, | |
| | | * TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, | |
| | | * TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, | |
| | | * TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256, | |
| | | * TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384, | |
| | | */ | |
| | | #define POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_ERROR_STRERROR_BC | |
| | | * | |
| | | * Make available the backward compatible error_strerror() next to the | |
| | | * current polarssl_strerror(). | |
| | | * | |
| | | * Disable if you run into name conflicts and want to really remove the | |
| | | * error_strerror() | |
| | | */ | |
| | | #define POLARSSL_ERROR_STRERROR_BC | |
| | | | |
| | | /** | |
| * \def POLARSSL_ERROR_STRERROR_DUMMY | | * \def POLARSSL_ERROR_STRERROR_DUMMY | |
| * | | * | |
|
| * Enable a dummy error function to make use of error_strerror() in | | * Enable a dummy error function to make use of polarssl_strerror() in | |
| * third party libraries easier. | | * third party libraries easier. | |
| * | | * | |
| * Disable if you run into name conflicts and want to really remove the | | * Disable if you run into name conflicts and want to really remove the | |
|
| * error_strerror() | | * polarssl_strerror() | |
| */ | | */ | |
| #define POLARSSL_ERROR_STRERROR_DUMMY | | #define POLARSSL_ERROR_STRERROR_DUMMY | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_GENPRIME | | * \def POLARSSL_GENPRIME | |
| * | | * | |
|
| * Requires: POLARSSL_BIGNUM_C, POLARSSL_RSA_C | | * Enable the prime-number generation code. | |
| * | | * | |
|
| * Enable the RSA prime-number generation code. | | * Requires: POLARSSL_BIGNUM_C | |
| */ | | */ | |
| #define POLARSSL_GENPRIME | | #define POLARSSL_GENPRIME | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_FS_IO | | * \def POLARSSL_FS_IO | |
| * | | * | |
| * Enable functions that use the filesystem. | | * Enable functions that use the filesystem. | |
| */ | | */ | |
| #define POLARSSL_FS_IO | | #define POLARSSL_FS_IO | |
| | | | |
| | | | |
| skipping to change at line 244 | | skipping to change at line 460 | |
|---|
| * | | * | |
| * Do not use built-in platform entropy functions. | | * Do not use built-in platform entropy functions. | |
| * This is useful if your platform does not support | | * This is useful if your platform does not support | |
| * standards like the /dev/urandom or Windows CryptoAPI. | | * standards like the /dev/urandom or Windows CryptoAPI. | |
| * | | * | |
| * Uncomment this macro to disable the built-in platform entropy functions. | | * Uncomment this macro to disable the built-in platform entropy functions. | |
| #define POLARSSL_NO_PLATFORM_ENTROPY | | #define POLARSSL_NO_PLATFORM_ENTROPY | |
| */ | | */ | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_MEMORY_DEBUG | |
| | | * | |
| | | * Enable debugging of buffer allocator memory issues. Automatically prints | |
| | | * (to stderr) all (fatal) messages on memory allocation issues. Enables | |
| | | * function for 'debug output' of allocated memory. | |
| | | * | |
| | | * Requires: POLARSSL_MEMORY_BUFFER_ALLOC_C | |
| | | * fprintf() | |
| | | * | |
| | | * Uncomment this macro to let the buffer allocator print out error message | |
| | | s. | |
| | | #define POLARSSL_MEMORY_DEBUG | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_MEMORY_BACKTRACE | |
| | | * | |
| | | * Include backtrace information with each allocated block. | |
| | | * | |
| | | * Requires: POLARSSL_MEMORY_BUFFER_ALLOC_C | |
| | | * GLIBC-compatible backtrace() an backtrace_symbols() support | |
| | | * | |
| | | * Uncomment this macro to include backtrace information | |
| | | #define POLARSSL_MEMORY_BACKTRACE | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_PKCS1_V15 | |
| | | * | |
| | | * Enable support for PKCS#1 v1.5 encoding. | |
| | | * | |
| | | * Requires: POLARSSL_RSA_C | |
| | | * | |
| | | * This enables support for PKCS#1 v1.5 operations. | |
| | | */ | |
| | | #define POLARSSL_PKCS1_V15 | |
| | | | |
| | | /** | |
| * \def POLARSSL_PKCS1_V21 | | * \def POLARSSL_PKCS1_V21 | |
| * | | * | |
|
| | | * Enable support for PKCS#1 v2.1 encoding. | |
| | | * | |
| * Requires: POLARSSL_MD_C, POLARSSL_RSA_C | | * Requires: POLARSSL_MD_C, POLARSSL_RSA_C | |
| * | | * | |
|
| * Enable support for PKCS#1 v2.1 encoding. | | | |
| * This enables support for RSAES-OAEP and RSASSA-PSS operations. | | * This enables support for RSAES-OAEP and RSASSA-PSS operations. | |
| */ | | */ | |
| #define POLARSSL_PKCS1_V21 | | #define POLARSSL_PKCS1_V21 | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_RSA_NO_CRT | | * \def POLARSSL_RSA_NO_CRT | |
| * | | * | |
| * Do not use the Chinese Remainder Theorem for the RSA private operation. | | * Do not use the Chinese Remainder Theorem for the RSA private operation. | |
| * | | * | |
| * Uncomment this macro to disable the use of CRT in RSA. | | * Uncomment this macro to disable the use of CRT in RSA. | |
| | | | |
| skipping to change at line 314 | | skipping to change at line 568 | |
|---|
| * individual records. | | * individual records. | |
| * | | * | |
| * Uncomment this macro to enable hooking functions. | | * Uncomment this macro to enable hooking functions. | |
| #define POLARSSL_SSL_HW_RECORD_ACCEL | | #define POLARSSL_SSL_HW_RECORD_ACCEL | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO | | * \def POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO | |
| * | | * | |
| * Enable support for receiving and parsing SSLv2 Client Hello messages for
the | | * Enable support for receiving and parsing SSLv2 Client Hello messages for
the | |
|
| * SSL Server module (POLARSSL_SSL_SRV_C) | | * SSL Server module (POLARSSL_SSL_SRV_C). | |
| * | | * | |
| * Comment this macro to disable support for SSLv2 Client Hello messages. | | * Comment this macro to disable support for SSLv2 Client Hello messages. | |
| */ | | */ | |
| #define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO | | #define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_SSL_MAX_FRAGMENT_LENGTH | |
| | | * | |
| | | * Enable support for RFC 6066 max_fragment_length extension in SSL. | |
| | | * | |
| | | * Comment this macro to disable support for the max_fragment_length extens | |
| | | ion | |
| | | */ | |
| | | #define POLARSSL_SSL_MAX_FRAGMENT_LENGTH | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_PROTO_SSL3 | |
| | | * | |
| | | * Enable support for SSL 3.0. | |
| | | * | |
| | | * Requires: POLARSSL_MD5_C | |
| | | * POLARSSL_SHA1_C | |
| | | * | |
| | | * Comment this macro to disable support for SSL 3.0 | |
| | | */ | |
| | | #define POLARSSL_SSL_PROTO_SSL3 | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_PROTO_TLS1 | |
| | | * | |
| | | * Enable support for TLS 1.0. | |
| | | * | |
| | | * Requires: POLARSSL_MD5_C | |
| | | * POLARSSL_SHA1_C | |
| | | * | |
| | | * Comment this macro to disable support for TLS 1.0 | |
| | | */ | |
| | | #define POLARSSL_SSL_PROTO_TLS1 | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_PROTO_TLS1_1 | |
| | | * | |
| | | * Enable support for TLS 1.1. | |
| | | * | |
| | | * Requires: POLARSSL_MD5_C | |
| | | * POLARSSL_SHA1_C | |
| | | * | |
| | | * Comment this macro to disable support for TLS 1.1 | |
| | | */ | |
| | | #define POLARSSL_SSL_PROTO_TLS1_1 | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_PROTO_TLS1_2 | |
| | | * | |
| | | * Enable support for TLS 1.2. | |
| | | * | |
| | | * Requires: POLARSSL_SHA256_C or POLARSSL_SHA512_C | |
| | | * (Depends on ciphersuites) | |
| | | * | |
| | | * Comment this macro to disable support for TLS 1.2 | |
| | | */ | |
| | | #define POLARSSL_SSL_PROTO_TLS1_2 | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_SESSION_TICKETS | |
| | | * | |
| | | * Enable support for RFC 5077 session tickets in SSL. | |
| | | * | |
| | | * Requires: POLARSSL_AES_C | |
| | | * POLARSSL_SHA256_C | |
| | | * POLARSSL_CIPHER_MODE_CBC | |
| | | * | |
| | | * Comment this macro to disable support for SSL session tickets | |
| | | */ | |
| | | #define POLARSSL_SSL_SESSION_TICKETS | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_SERVER_NAME_INDICATION | |
| | | * | |
| | | * Enable support for RFC 6066 server name indication (SNI) in SSL. | |
| | | * | |
| | | * Comment this macro to disable support for server name indication in SSL | |
| | | */ | |
| | | #define POLARSSL_SSL_SERVER_NAME_INDICATION | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_SSL_TRUNCATED_HMAC | |
| | | * | |
| | | * Enable support for RFC 6066 truncated HMAC in SSL. | |
| | | * | |
| | | * Comment this macro to disable support for truncated HMAC in SSL | |
| | | */ | |
| | | #define POLARSSL_SSL_TRUNCATED_HMAC | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_THREADING_ALT | |
| | | * | |
| | | * Provide your own alternate threading implementation. | |
| | | * | |
| | | * Requires: POLARSSL_THREADING_C | |
| | | * | |
| | | * Uncomment this to allow your own alternate threading implementation. | |
| | | #define POLARSSL_THREADING_ALT | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_THREADING_DUMMY | |
| | | * | |
| | | * Provide a dummy threading implementation. | |
| | | * Warning: If you use this, all claims of thread-safety in the documentati | |
| | | on | |
| | | * are void! | |
| | | * | |
| | | * Requires: POLARSSL_THREADING_C | |
| | | * | |
| | | * Uncomment this to enable code to compile like with threading enabled | |
| | | #define POLARSSL_THREADING_DUMMY | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_THREADING_PTHREAD | |
| | | * | |
| | | * Enable the pthread wrapper layer for the threading layer. | |
| | | * | |
| | | * Requires: POLARSSL_THREADING_C | |
| | | * | |
| | | * Uncomment this to enable pthread mutexes. | |
| | | #define POLARSSL_THREADING_PTHREAD | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_X509_ALLOW_EXTENSIONS_NON_V3 | |
| | | * | |
| | | * If set, the X509 parser will not break-off when parsing an X509 certific | |
| | | ate | |
| | | * and encountering an extension in a v1 or v2 certificate. | |
| | | * | |
| | | * Uncomment to prevent an error. | |
| | | * | |
| | | #define POLARSSL_X509_ALLOW_EXTENSIONS_NON_V3 | |
| | | */ | |
| | | | |
| | | /** | |
| * \def POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION | | * \def POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION | |
| * | | * | |
| * If set, the X509 parser will not break-off when parsing an X509 certific
ate | | * If set, the X509 parser will not break-off when parsing an X509 certific
ate | |
| * and encountering an unknown critical extension. | | * and encountering an unknown critical extension. | |
| * | | * | |
| * Uncomment to prevent an error. | | * Uncomment to prevent an error. | |
| * | | * | |
| #define POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION | | #define POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION | |
| */ | | */ | |
| | | | |
| | | | |
| skipping to change at line 346 | | skipping to change at line 734 | |
|---|
| * | | * | |
| * Used in: library/ssl_tls.c | | * Used in: library/ssl_tls.c | |
| * library/ssl_cli.c | | * library/ssl_cli.c | |
| * library/ssl_srv.c | | * library/ssl_srv.c | |
| * | | * | |
| * This feature requires zlib library and headers to be present. | | * This feature requires zlib library and headers to be present. | |
| * | | * | |
| * Uncomment to enable use of ZLIB | | * Uncomment to enable use of ZLIB | |
| #define POLARSSL_ZLIB_SUPPORT | | #define POLARSSL_ZLIB_SUPPORT | |
| */ | | */ | |
|
| /* \} name */ | | /* \} name SECTION: PolarSSL feature support */ | |
| | | | |
| /** | | /** | |
| * \name SECTION: PolarSSL modules | | * \name SECTION: PolarSSL modules | |
| * | | * | |
| * This section enables or disables entire modules in PolarSSL | | * This section enables or disables entire modules in PolarSSL | |
| * \{ | | * \{ | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_AES_C | | * \def POLARSSL_AES_C | |
| | | | |
| skipping to change at line 377 | | skipping to change at line 765 | |
|---|
| * TLS_RSA_WITH_AES_128_CBC_SHA | | * TLS_RSA_WITH_AES_128_CBC_SHA | |
| * TLS_RSA_WITH_AES_256_CBC_SHA | | * TLS_RSA_WITH_AES_256_CBC_SHA | |
| * TLS_DHE_RSA_WITH_AES_128_CBC_SHA | | * TLS_DHE_RSA_WITH_AES_128_CBC_SHA | |
| * TLS_DHE_RSA_WITH_AES_256_CBC_SHA | | * TLS_DHE_RSA_WITH_AES_256_CBC_SHA | |
| * TLS_RSA_WITH_AES_128_CBC_SHA256 | | * TLS_RSA_WITH_AES_128_CBC_SHA256 | |
| * TLS_RSA_WITH_AES_256_CBC_SHA256 | | * TLS_RSA_WITH_AES_256_CBC_SHA256 | |
| * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | | * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | |
| * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | | * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | |
| * TLS_RSA_WITH_AES_128_GCM_SHA256 | | * TLS_RSA_WITH_AES_128_GCM_SHA256 | |
| * TLS_RSA_WITH_AES_256_GCM_SHA384 | | * TLS_RSA_WITH_AES_256_GCM_SHA384 | |
|
| | | * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | |
| | | * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | |
| | | * TLS_PSK_WITH_AES_128_CBC_SHA | |
| | | * TLS_PSK_WITH_AES_256_CBC_SHA | |
| * | | * | |
|
| * PEM uses AES for decrypting encrypted keys. | | * PEM_PARSE uses AES for decrypting encrypted keys. | |
| */ | | */ | |
| #define POLARSSL_AES_C | | #define POLARSSL_AES_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_ARC4_C | | * \def POLARSSL_ARC4_C | |
| * | | * | |
| * Enable the ARCFOUR stream cipher. | | * Enable the ARCFOUR stream cipher. | |
| * | | * | |
| * Module: library/arc4.c | | * Module: library/arc4.c | |
| * Caller: library/ssl_tls.c | | * Caller: library/ssl_tls.c | |
| * | | * | |
|
| * This module enables the following ciphersuites: | | * This module enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| * TLS_RSA_WITH_RC4_128_MD5 | | * TLS_RSA_WITH_RC4_128_MD5 | |
| * TLS_RSA_WITH_RC4_128_SHA | | * TLS_RSA_WITH_RC4_128_SHA | |
|
| | | * TLS_ECDHE_RSA_WITH_RC4_128_SHA | |
| | | * TLS_PSK_WITH_RC4_128_SHA | |
| */ | | */ | |
| #define POLARSSL_ARC4_C | | #define POLARSSL_ARC4_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_ASN1_PARSE_C | | * \def POLARSSL_ASN1_PARSE_C | |
| * | | * | |
| * Enable the generic ASN1 parser. | | * Enable the generic ASN1 parser. | |
| * | | * | |
| * Module: library/asn1.c | | * Module: library/asn1.c | |
|
| * Caller: library/x509parse.c | | * Caller: library/x509.c | |
| | | * library/dhm.c | |
| | | * library/pkcs12.c | |
| | | * library/pkcs5.c | |
| | | * library/pkparse.c | |
| */ | | */ | |
| #define POLARSSL_ASN1_PARSE_C | | #define POLARSSL_ASN1_PARSE_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_ASN1_WRITE_C | | * \def POLARSSL_ASN1_WRITE_C | |
| * | | * | |
| * Enable the generic ASN1 writer. | | * Enable the generic ASN1 writer. | |
| * | | * | |
| * Module: library/asn1write.c | | * Module: library/asn1write.c | |
|
| | | * Caller: library/ecdsa.c | |
| | | * library/pkwrite.c | |
| | | * library/x509_create.c | |
| | | * library/x509write_crt.c | |
| | | * library/x509write_csr.c | |
| */ | | */ | |
| #define POLARSSL_ASN1_WRITE_C | | #define POLARSSL_ASN1_WRITE_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_BASE64_C | | * \def POLARSSL_BASE64_C | |
| * | | * | |
| * Enable the Base64 module. | | * Enable the Base64 module. | |
| * | | * | |
| * Module: library/base64.c | | * Module: library/base64.c | |
| * Caller: library/pem.c | | * Caller: library/pem.c | |
| | | | |
| skipping to change at line 434 | | skipping to change at line 838 | |
|---|
| */ | | */ | |
| #define POLARSSL_BASE64_C | | #define POLARSSL_BASE64_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_BIGNUM_C | | * \def POLARSSL_BIGNUM_C | |
| * | | * | |
| * Enable the multi-precision integer library. | | * Enable the multi-precision integer library. | |
| * | | * | |
| * Module: library/bignum.c | | * Module: library/bignum.c | |
| * Caller: library/dhm.c | | * Caller: library/dhm.c | |
|
| | | * library/ecp.c | |
| * library/rsa.c | | * library/rsa.c | |
| * library/ssl_tls.c | | * library/ssl_tls.c | |
|
| * library/x509parse.c | | | |
| * | | * | |
| * This module is required for RSA and DHM support. | | * This module is required for RSA and DHM support. | |
| */ | | */ | |
| #define POLARSSL_BIGNUM_C | | #define POLARSSL_BIGNUM_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_BLOWFISH_C | | * \def POLARSSL_BLOWFISH_C | |
| * | | * | |
| * Enable the Blowfish block cipher. | | * Enable the Blowfish block cipher. | |
| * | | * | |
| | | | |
| skipping to change at line 490 | | skipping to change at line 894 | |
|---|
| * This module is used for testing (ssl_client/server). | | * This module is used for testing (ssl_client/server). | |
| */ | | */ | |
| #define POLARSSL_CERTS_C | | #define POLARSSL_CERTS_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_CIPHER_C | | * \def POLARSSL_CIPHER_C | |
| * | | * | |
| * Enable the generic cipher layer. | | * Enable the generic cipher layer. | |
| * | | * | |
| * Module: library/cipher.c | | * Module: library/cipher.c | |
|
| * Caller: | | * Caller: library/ssl_tls.c | |
| * | | * | |
| * Uncomment to enable generic cipher wrappers. | | * Uncomment to enable generic cipher wrappers. | |
| */ | | */ | |
| #define POLARSSL_CIPHER_C | | #define POLARSSL_CIPHER_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_CTR_DRBG_C | | * \def POLARSSL_CTR_DRBG_C | |
| * | | * | |
|
| * Enable the CTR_DRBG AES-256-based random generator | | * Enable the CTR_DRBG AES-256-based random generator. | |
| * | | * | |
| * Module: library/ctr_drbg.c | | * Module: library/ctr_drbg.c | |
| * Caller: | | * Caller: | |
| * | | * | |
| * Requires: POLARSSL_AES_C | | * Requires: POLARSSL_AES_C | |
| * | | * | |
| * This module provides the CTR_DRBG AES-256 random number generator. | | * This module provides the CTR_DRBG AES-256 random number generator. | |
| */ | | */ | |
| #define POLARSSL_CTR_DRBG_C | | #define POLARSSL_CTR_DRBG_C | |
| | | | |
| | | | |
| skipping to change at line 537 | | skipping to change at line 941 | |
|---|
| * Enable the DES block cipher. | | * Enable the DES block cipher. | |
| * | | * | |
| * Module: library/des.c | | * Module: library/des.c | |
| * Caller: library/pem.c | | * Caller: library/pem.c | |
| * library/ssl_tls.c | | * library/ssl_tls.c | |
| * | | * | |
| * This module enables the following ciphersuites (if other requisites are | | * This module enables the following ciphersuites (if other requisites are | |
| * enabled as well): | | * enabled as well): | |
| * TLS_RSA_WITH_3DES_EDE_CBC_SHA | | * TLS_RSA_WITH_3DES_EDE_CBC_SHA | |
| * TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA | | * TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA | |
|
| | | * TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | |
| | | * TLS_PSK_WITH_3DES_EDE_CBC_SHA | |
| * | | * | |
|
| * PEM uses DES/3DES for decrypting encrypted keys. | | * PEM_PARSE uses DES/3DES for decrypting encrypted keys. | |
| */ | | */ | |
| #define POLARSSL_DES_C | | #define POLARSSL_DES_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_DHM_C | | * \def POLARSSL_DHM_C | |
| * | | * | |
| * Enable the Diffie-Hellman-Merkle key exchange. | | * Enable the Diffie-Hellman-Merkle key exchange. | |
| * | | * | |
| * Module: library/dhm.c | | * Module: library/dhm.c | |
| * Caller: library/ssl_cli.c | | * Caller: library/ssl_cli.c | |
| | | | |
| skipping to change at line 569 | | skipping to change at line 975 | |
|---|
| * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA | | * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA | |
| * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA | | * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA | |
| * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 | | * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 | |
| * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 | | * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 | |
| * TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | | * TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | |
| * TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | | * TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | |
| */ | | */ | |
| #define POLARSSL_DHM_C | | #define POLARSSL_DHM_C | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_ECDH_C | |
| | | * | |
| | | * Enable the elliptic curve Diffie-Hellman library. | |
| | | * | |
| | | * Module: library/ecdh.c | |
| | | * Caller: library/ssl_cli.c | |
| | | * library/ssl_srv.c | |
| | | * | |
| | | * This module enables the following ciphersuites (if other requisites are | |
| | | * enabled as well): | |
| | | * TLS_ECDHE_RSA_WITH_NULL_SHA | |
| | | * TLS_ECDHE_RSA_WITH_RC4_128_SHA | |
| | | * TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | |
| | | * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | |
| | | * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | |
| | | * | |
| | | * Requires: POLARSSL_ECP_C | |
| | | */ | |
| | | #define POLARSSL_ECDH_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_ECDSA_C | |
| | | * | |
| | | * Enable the elliptic curve DSA library. | |
| | | * | |
| | | * Module: library/ecdsa.c | |
| | | * Caller: | |
| | | * | |
| | | * Requires: POLARSSL_ECP_C, POLARSSL_ASN1_WRITE_C, POLARSSL_ASN1_PARSE_C | |
| | | */ | |
| | | #define POLARSSL_ECDSA_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_ECP_C | |
| | | * | |
| | | * Enable the elliptic curve over GF(p) library. | |
| | | * | |
| | | * Module: library/ecp.c | |
| | | * Caller: library/ecdh.c | |
| | | * library/ecdsa.c | |
| | | * | |
| | | * Requires: POLARSSL_BIGNUM_C | |
| | | */ | |
| | | #define POLARSSL_ECP_C | |
| | | | |
| | | /** | |
| * \def POLARSSL_ENTROPY_C | | * \def POLARSSL_ENTROPY_C | |
| * | | * | |
| * Enable the platform-specific entropy code. | | * Enable the platform-specific entropy code. | |
| * | | * | |
| * Module: library/entropy.c | | * Module: library/entropy.c | |
| * Caller: | | * Caller: | |
| * | | * | |
|
| * Requires: POLARSSL_SHA4_C | | * Requires: POLARSSL_SHA512_C | |
| * | | * | |
| * This module provides a generic entropy pool | | * This module provides a generic entropy pool | |
| */ | | */ | |
| #define POLARSSL_ENTROPY_C | | #define POLARSSL_ENTROPY_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_ERROR_C | | * \def POLARSSL_ERROR_C | |
| * | | * | |
| * Enable error code to error string conversion. | | * Enable error code to error string conversion. | |
| * | | * | |
| * Module: library/error.c | | * Module: library/error.c | |
| * Caller: | | * Caller: | |
| * | | * | |
| * This module enables err_strerror(). | | * This module enables err_strerror(). | |
| */ | | */ | |
| #define POLARSSL_ERROR_C | | #define POLARSSL_ERROR_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_GCM_C | | * \def POLARSSL_GCM_C | |
| * | | * | |
|
| * Enable the Galois/Counter Mode (GCM) for AES | | * Enable the Galois/Counter Mode (GCM) for AES. | |
| * | | * | |
| * Module: library/gcm.c | | * Module: library/gcm.c | |
| * | | * | |
| * Requires: POLARSSL_AES_C | | * Requires: POLARSSL_AES_C | |
| * | | * | |
| * This module enables the following ciphersuites (if other requisites are | | * This module enables the following ciphersuites (if other requisites are | |
| * enabled as well): | | * enabled as well): | |
| * TLS_RSA_WITH_AES_128_GCM_SHA256 | | * TLS_RSA_WITH_AES_128_GCM_SHA256 | |
| * TLS_RSA_WITH_AES_256_GCM_SHA384 | | * TLS_RSA_WITH_AES_256_GCM_SHA384 | |
| */ | | */ | |
| | | | |
| skipping to change at line 648 | | skipping to change at line 1100 | |
|---|
| * Module: library/md.c | | * Module: library/md.c | |
| * Caller: | | * Caller: | |
| * | | * | |
| * Uncomment to enable generic message digest wrappers. | | * Uncomment to enable generic message digest wrappers. | |
| */ | | */ | |
| #define POLARSSL_MD_C | | #define POLARSSL_MD_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_MD2_C | | * \def POLARSSL_MD2_C | |
| * | | * | |
|
| * Enable the MD2 hash algorithm | | * Enable the MD2 hash algorithm. | |
| * | | * | |
| * Module: library/md2.c | | * Module: library/md2.c | |
|
| * Caller: library/x509parse.c | | * Caller: | |
| * | | * | |
| * Uncomment to enable support for (rare) MD2-signed X.509 certs. | | * Uncomment to enable support for (rare) MD2-signed X.509 certs. | |
| * | | * | |
| #define POLARSSL_MD2_C | | #define POLARSSL_MD2_C | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_MD4_C | | * \def POLARSSL_MD4_C | |
| * | | * | |
|
| * Enable the MD4 hash algorithm | | * Enable the MD4 hash algorithm. | |
| * | | * | |
| * Module: library/md4.c | | * Module: library/md4.c | |
|
| * Caller: library/x509parse.c | | * Caller: | |
| * | | * | |
| * Uncomment to enable support for (rare) MD4-signed X.509 certs. | | * Uncomment to enable support for (rare) MD4-signed X.509 certs. | |
| * | | * | |
| #define POLARSSL_MD4_C | | #define POLARSSL_MD4_C | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_MD5_C | | * \def POLARSSL_MD5_C | |
| * | | * | |
|
| * Enable the MD5 hash algorithm | | * Enable the MD5 hash algorithm. | |
| * | | * | |
| * Module: library/md5.c | | * Module: library/md5.c | |
|
| * Caller: library/pem.c | | * Caller: library/md.c | |
| | | * library/pem.c | |
| * library/ssl_tls.c | | * library/ssl_tls.c | |
|
| * library/x509parse.c | | | |
| * | | * | |
| * This module is required for SSL/TLS and X.509. | | * This module is required for SSL/TLS and X.509. | |
|
| * PEM uses MD5 for decrypting encrypted keys. | | * PEM_PARSE uses MD5 for decrypting encrypted keys. | |
| */ | | */ | |
| #define POLARSSL_MD5_C | | #define POLARSSL_MD5_C | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_MEMORY_C | |
| | | * | |
| | | * Enable the memory allocation layer. | |
| | | * By default PolarSSL uses the system-provided malloc() and free(). | |
| | | * (As long as POLARSSL_MEMORY_STDMALLOC and POLARSSL_MEMORY_STDFREE | |
| | | * are defined and unmodified) | |
| | | * | |
| | | * This allows different allocators (self-implemented or provided) | |
| | | * | |
| | | * Enable this layer to allow use of alternative memory allocators. | |
| | | #define POLARSSL_MEMORY_C | |
| | | */ | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_MEMORY_BUFFER_ALLOC_C | |
| | | * | |
| | | * Enable the buffer allocator implementation that makes use of a (stack) | |
| | | * based buffer to 'allocate' dynamic memory. (replaces malloc() and free() | |
| | | * calls) | |
| | | * | |
| | | * Module: library/memory_buffer_alloc.c | |
| | | * | |
| | | * Requires: POLARSSL_MEMORY_C | |
| | | * | |
| | | * Enable this module to enable the buffer memory allocator. | |
| | | #define POLARSSL_MEMORY_BUFFER_ALLOC_C | |
| | | */ | |
| | | | |
| | | /** | |
| * \def POLARSSL_NET_C | | * \def POLARSSL_NET_C | |
| * | | * | |
| * Enable the TCP/IP networking routines. | | * Enable the TCP/IP networking routines. | |
| * | | * | |
| * Module: library/net.c | | * Module: library/net.c | |
|
| * Caller: | | | |
| * | | * | |
| * This module provides TCP/IP networking routines. | | * This module provides TCP/IP networking routines. | |
| */ | | */ | |
| #define POLARSSL_NET_C | | #define POLARSSL_NET_C | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_OID_C | |
| | | * | |
| | | * Enable the OID database. | |
| | | * | |
| | | * Module: library/oid.c | |
| | | * Caller: library/asn1write.c | |
| | | * library/pkcs5.c | |
| | | * library/pkparse.c | |
| | | * library/pkwrite.c | |
| | | * library/rsa.c | |
| | | * library/x509.c | |
| | | * library/x509_create.c | |
| | | * library/x509_crl.c | |
| | | * library/x509_crt.c | |
| | | * library/x509_csr.c | |
| | | * library/x509write_crt.c | |
| | | * library/x509write_csr.c | |
| | | * | |
| | | * This modules translates between OIDs and internal values. | |
| | | */ | |
| | | #define POLARSSL_OID_C | |
| | | | |
| | | /** | |
| * \def POLARSSL_PADLOCK_C | | * \def POLARSSL_PADLOCK_C | |
| * | | * | |
| * Enable VIA Padlock support on x86. | | * Enable VIA Padlock support on x86. | |
| * | | * | |
| * Module: library/padlock.c | | * Module: library/padlock.c | |
| * Caller: library/aes.c | | * Caller: library/aes.c | |
| * | | * | |
| * This modules adds support for the VIA PadLock on x86. | | * This modules adds support for the VIA PadLock on x86. | |
| */ | | */ | |
| #define POLARSSL_PADLOCK_C | | #define POLARSSL_PADLOCK_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_PBKDF2_C | | * \def POLARSSL_PBKDF2_C | |
| * | | * | |
|
| * Enable PKCS#5 PBKDF2 key derivation function | | * Enable PKCS#5 PBKDF2 key derivation function. | |
| * DEPRECATED: Use POLARSSL_PKCS5_C instead | | * DEPRECATED: Use POLARSSL_PKCS5_C instead | |
| * | | * | |
| * Module: library/pbkdf2.c | | * Module: library/pbkdf2.c | |
| * | | * | |
| * Requires: POLARSSL_PKCS5_C | | * Requires: POLARSSL_PKCS5_C | |
| * | | * | |
| * This module adds support for the PKCS#5 PBKDF2 key derivation function. | | * This module adds support for the PKCS#5 PBKDF2 key derivation function. | |
|
| | | */ | |
| #define POLARSSL_PBKDF2_C | | #define POLARSSL_PBKDF2_C | |
|
| | | | |
| | | /** | |
| | | * \def POLARSSL_PEM_PARSE_C | |
| | | * | |
| | | * Enable PEM decoding / parsing. | |
| | | * | |
| | | * Module: library/pem.c | |
| | | * Caller: library/dhm.c | |
| | | * library/pkparse.c | |
| | | * library/x509_crl.c | |
| | | * library/x509_crt.c | |
| | | * library/x509_csr.c | |
| | | * | |
| | | * Requires: POLARSSL_BASE64_C | |
| | | * | |
| | | * This modules adds support for decoding / parsing PEM files. | |
| */ | | */ | |
|
| | | #define POLARSSL_PEM_PARSE_C | |
| | | | |
| /** | | /** | |
|
| * \def POLARSSL_PEM_C | | * \def POLARSSL_PEM_WRITE_C | |
| * | | * | |
|
| * Enable PEM decoding | | * Enable PEM encoding / writing. | |
| * | | * | |
| * Module: library/pem.c | | * Module: library/pem.c | |
|
| * Caller: library/x509parse.c | | * Caller: library/pkwrite.c | |
| | | * library/x509write_crt.c | |
| | | * library/x509write_csr.c | |
| * | | * | |
| * Requires: POLARSSL_BASE64_C | | * Requires: POLARSSL_BASE64_C | |
| * | | * | |
|
| * This modules adds support for decoding PEM files. | | * This modules adds support for encoding / writing PEM files. | |
| */ | | */ | |
|
| #define POLARSSL_PEM_C | | #define POLARSSL_PEM_WRITE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_PK_C | |
| | | * | |
| | | * Enable the generic public (asymetric) key layer. | |
| | | * | |
| | | * Module: library/pk.c | |
| | | * Caller: library/ssl_tls.c | |
| | | * library/ssl_cli.c | |
| | | * library/ssl_srv.c | |
| | | * | |
| | | * Requires: POLARSSL_RSA_C or POLARSSL_ECP_C | |
| | | * | |
| | | * Uncomment to enable generic public key wrappers. | |
| | | */ | |
| | | #define POLARSSL_PK_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_PK_PARSE_C | |
| | | * | |
| | | * Enable the generic public (asymetric) key parser. | |
| | | * | |
| | | * Module: library/pkparse.c | |
| | | * Caller: library/x509_crt.c | |
| | | * library/x509_csr.c | |
| | | * | |
| | | * Requires: POLARSSL_PK_C | |
| | | * | |
| | | * Uncomment to enable generic public key parse functions. | |
| | | */ | |
| | | #define POLARSSL_PK_PARSE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_PK_WRITE_C | |
| | | * | |
| | | * Enable the generic public (asymetric) key writer. | |
| | | * | |
| | | * Module: library/pkwrite.c | |
| | | * Caller: library/x509write.c | |
| | | * | |
| | | * Requires: POLARSSL_PK_C | |
| | | * | |
| | | * Uncomment to enable generic public key write functions. | |
| | | */ | |
| | | #define POLARSSL_PK_WRITE_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_PKCS5_C | | * \def POLARSSL_PKCS5_C | |
| * | | * | |
|
| * Enable PKCS#5 functions | | * Enable PKCS#5 functions. | |
| * | | * | |
| * Module: library/pkcs5.c | | * Module: library/pkcs5.c | |
| * | | * | |
| * Requires: POLARSSL_MD_C | | * Requires: POLARSSL_MD_C | |
| * | | * | |
| * This module adds support for the PKCS#5 functions. | | * This module adds support for the PKCS#5 functions. | |
| */ | | */ | |
| #define POLARSSL_PKCS5_C | | #define POLARSSL_PKCS5_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_PKCS11_C | | * \def POLARSSL_PKCS11_C | |
| * | | * | |
| * Enable wrapper for PKCS#11 smartcard support. | | * Enable wrapper for PKCS#11 smartcard support. | |
| * | | * | |
|
| * Module: library/ssl_srv.c | | * Module: library/pkcs11.c | |
| * Caller: library/ssl_cli.c | | * Caller: library/pk.c | |
| * library/ssl_srv.c | | | |
| * | | * | |
|
| * Requires: POLARSSL_SSL_TLS_C | | * Requires: POLARSSL_PK_C | |
| * | | * | |
| * This module enables SSL/TLS PKCS #11 smartcard support. | | * This module enables SSL/TLS PKCS #11 smartcard support. | |
| * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) | | * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) | |
| #define POLARSSL_PKCS11_C | | #define POLARSSL_PKCS11_C | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_PKCS12_C | | * \def POLARSSL_PKCS12_C | |
| * | | * | |
|
| * Enable PKCS#12 PBE functions | | * Enable PKCS#12 PBE functions. | |
| * Adds algorithms for parsing PKCS#8 encrypted private keys | | * Adds algorithms for parsing PKCS#8 encrypted private keys | |
| * | | * | |
| * Module: library/pkcs12.c | | * Module: library/pkcs12.c | |
|
| * Caller: library/x509parse.c | | * Caller: library/pkparse.c | |
| * | | * | |
| * Requires: POLARSSL_ASN1_PARSE_C, POLARSSL_CIPHER_C, POLARSSL_MD_C | | * Requires: POLARSSL_ASN1_PARSE_C, POLARSSL_CIPHER_C, POLARSSL_MD_C | |
| * Can use: POLARSSL_ARC4_C | | * Can use: POLARSSL_ARC4_C | |
| * | | * | |
| * This module enables PKCS#12 functions. | | * This module enables PKCS#12 functions. | |
| */ | | */ | |
| #define POLARSSL_PKCS12_C | | #define POLARSSL_PKCS12_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_RSA_C | | * \def POLARSSL_RSA_C | |
| * | | * | |
| * Enable the RSA public-key cryptosystem. | | * Enable the RSA public-key cryptosystem. | |
| * | | * | |
| * Module: library/rsa.c | | * Module: library/rsa.c | |
| * Caller: library/ssl_cli.c | | * Caller: library/ssl_cli.c | |
| * library/ssl_srv.c | | * library/ssl_srv.c | |
| * library/ssl_tls.c | | * library/ssl_tls.c | |
| * library/x509.c | | * library/x509.c | |
| * | | * | |
|
| * Requires: POLARSSL_BIGNUM_C | | * Requires: POLARSSL_BIGNUM_C, POLARSSL_OID_C | |
| * | | * | |
| * This module is required for SSL/TLS and MD5-signed certificates. | | * This module is required for SSL/TLS and MD5-signed certificates. | |
| */ | | */ | |
| #define POLARSSL_RSA_C | | #define POLARSSL_RSA_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_SHA1_C | | * \def POLARSSL_SHA1_C | |
| * | | * | |
| * Enable the SHA1 cryptographic hash algorithm. | | * Enable the SHA1 cryptographic hash algorithm. | |
| * | | * | |
| * Module: library/sha1.c | | * Module: library/sha1.c | |
|
| * Caller: library/ssl_cli.c | | * Caller: library/md.c | |
| | | * library/ssl_cli.c | |
| * library/ssl_srv.c | | * library/ssl_srv.c | |
| * library/ssl_tls.c | | * library/ssl_tls.c | |
|
| * library/x509parse.c | | * library/x509write_crt.c | |
| * | | * | |
| * This module is required for SSL/TLS and SHA1-signed certificates. | | * This module is required for SSL/TLS and SHA1-signed certificates. | |
| */ | | */ | |
| #define POLARSSL_SHA1_C | | #define POLARSSL_SHA1_C | |
| | | | |
| /** | | /** | |
|
| * \def POLARSSL_SHA2_C | | * \def POLARSSL_SHA256_C | |
| * | | * | |
| * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. | | * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. | |
|
| | | * (Used to be POLARSSL_SHA2_C) | |
| * | | * | |
|
| * Module: library/sha2.c | | * Module: library/sha256.c | |
| * Caller: library/md_wrap.c | | * Caller: library/entropy.c | |
| * library/x509parse.c | | * library/md.c | |
| | | * library/ssl_cli.c | |
| | | * library/ssl_srv.c | |
| | | * library/ssl_tls.c | |
| * | | * | |
| * This module adds support for SHA-224 and SHA-256. | | * This module adds support for SHA-224 and SHA-256. | |
| * This module is required for the SSL/TLS 1.2 PRF function. | | * This module is required for the SSL/TLS 1.2 PRF function. | |
| */ | | */ | |
|
| #define POLARSSL_SHA2_C | | #define POLARSSL_SHA256_C | |
| | | | |
| /** | | /** | |
|
| * \def POLARSSL_SHA4_C | | * \def POLARSSL_SHA512_C | |
| * | | * | |
| * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. | | * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. | |
|
| | | * (Used to be POLARSSL_SHA4_C) | |
| * | | * | |
|
| * Module: library/sha4.c | | * Module: library/sha512.c | |
| * Caller: library/md_wrap.c | | * Caller: library/entropy.c | |
| * library/x509parse.c | | * library/md.c | |
| | | * library/ssl_cli.c | |
| | | * library/ssl_srv.c | |
| * | | * | |
| * This module adds support for SHA-384 and SHA-512. | | * This module adds support for SHA-384 and SHA-512. | |
| */ | | */ | |
|
| #define POLARSSL_SHA4_C | | #define POLARSSL_SHA512_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_SSL_CACHE_C | | * \def POLARSSL_SSL_CACHE_C | |
| * | | * | |
| * Enable simple SSL cache implementation. | | * Enable simple SSL cache implementation. | |
| * | | * | |
| * Module: library/ssl_cache.c | | * Module: library/ssl_cache.c | |
| * Caller: | | * Caller: | |
| * | | * | |
| * Requires: POLARSSL_SSL_CACHE_C | | * Requires: POLARSSL_SSL_CACHE_C | |
| | | | |
| skipping to change at line 891 | | skipping to change at line 1466 | |
|---|
| | | | |
| /** | | /** | |
| * \def POLARSSL_SSL_TLS_C | | * \def POLARSSL_SSL_TLS_C | |
| * | | * | |
| * Enable the generic SSL/TLS code. | | * Enable the generic SSL/TLS code. | |
| * | | * | |
| * Module: library/ssl_tls.c | | * Module: library/ssl_tls.c | |
| * Caller: library/ssl_cli.c | | * Caller: library/ssl_cli.c | |
| * library/ssl_srv.c | | * library/ssl_srv.c | |
| * | | * | |
|
| * Requires: POLARSSL_MD5_C, POLARSSL_SHA1_C, POLARSSL_X509_PARSE_C | | * Requires: POLARSSL_CIPHER_C, POLARSSL_MD_C | |
| | | * and at least one of the POLARSSL_SSL_PROTO_* defines | |
| * | | * | |
| * This module is required for SSL/TLS. | | * This module is required for SSL/TLS. | |
| */ | | */ | |
| #define POLARSSL_SSL_TLS_C | | #define POLARSSL_SSL_TLS_C | |
| | | | |
| /** | | /** | |
|
| | | * \def POLARSSL_THREADING_C | |
| | | * | |
| | | * Enable the threading abstraction layer. | |
| | | * By default PolarSSL assumes it is used in a non-threaded environment or | |
| | | that | |
| | | * contexts are not shared between threads. If you do intend to use context | |
| | | s | |
| | | * between threads, you will need to enable this layer to prevent race | |
| | | * conditions. | |
| | | * | |
| | | * Module: library/threading.c | |
| | | * | |
| | | * This allows different threading implementations (self-implemented or | |
| | | * provided). | |
| | | * | |
| | | * You will have to enable either POLARSSL_THREADING_ALT, | |
| | | * POLARSSL_THREADING_PTHREAD or POLARSSL_THREADING_DUMMY. | |
| | | * | |
| | | * Enable this layer to allow use of mutexes within PolarSSL | |
| | | #define POLARSSL_THREADING_C | |
| | | */ | |
| | | | |
| | | /** | |
| * \def POLARSSL_TIMING_C | | * \def POLARSSL_TIMING_C | |
| * | | * | |
| * Enable the portable timing interface. | | * Enable the portable timing interface. | |
| * | | * | |
| * Module: library/timing.c | | * Module: library/timing.c | |
| * Caller: library/havege.c | | * Caller: library/havege.c | |
| * | | * | |
| * This module is used by the HAVEGE random number generator. | | * This module is used by the HAVEGE random number generator. | |
| */ | | */ | |
| #define POLARSSL_TIMING_C | | #define POLARSSL_TIMING_C | |
| | | | |
| skipping to change at line 921 | | skipping to change at line 1518 | |
|---|
| * | | * | |
| * Enable run-time version information. | | * Enable run-time version information. | |
| * | | * | |
| * Module: library/version.c | | * Module: library/version.c | |
| * | | * | |
| * This module provides run-time version information. | | * This module provides run-time version information. | |
| */ | | */ | |
| #define POLARSSL_VERSION_C | | #define POLARSSL_VERSION_C | |
| | | | |
| /** | | /** | |
|
| * \def POLARSSL_X509_PARSE_C | | * \def POLARSSL_X509_USE_C | |
| | | * | |
| | | * Enable X.509 core for using certificates. | |
| | | * | |
| | | * Module: library/x509.c | |
| | | * Caller: library/x509_crl.c | |
| | | * library/x509_crt.c | |
| | | * library/x509_csr.c | |
| | | * | |
| | | * Requires: POLARSSL_ASN1_PARSE_C, POLARSSL_BIGNUM_C, POLARSSL_OID_C, | |
| | | * POLARSSL_PK_PARSE_C | |
| | | * | |
| | | * This module is required for the X.509 parsing modules. | |
| | | */ | |
| | | #define POLARSSL_X509_USE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_X509_CRT_PARSE_C | |
| * | | * | |
| * Enable X.509 certificate parsing. | | * Enable X.509 certificate parsing. | |
| * | | * | |
|
| * Module: library/x509parse.c | | * Module: library/x509_crt.c | |
| * Caller: library/ssl_cli.c | | * Caller: library/ssl_cli.c | |
| * library/ssl_srv.c | | * library/ssl_srv.c | |
| * library/ssl_tls.c | | * library/ssl_tls.c | |
| * | | * | |
|
| * Requires: POLARSSL_ASN1_PARSE_C, POLARSSL_BIGNUM_C, POLARSSL_RSA_C | | * Requires: POLARSSL_X509_USE_C | |
| * | | * | |
| * This module is required for X.509 certificate parsing. | | * This module is required for X.509 certificate parsing. | |
| */ | | */ | |
|
| #define POLARSSL_X509_PARSE_C | | #define POLARSSL_X509_CRT_PARSE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_X509_CRL_PARSE_C | |
| | | * | |
| | | * Enable X.509 CRL parsing. | |
| | | * | |
| | | * Module: library/x509_crl.c | |
| | | * Caller: library/x509_crt.c | |
| | | * | |
| | | * Requires: POLARSSL_X509_USE_C | |
| | | * | |
| | | * This module is required for X.509 CRL parsing. | |
| | | */ | |
| | | #define POLARSSL_X509_CRL_PARSE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_X509_CSR_PARSE_C | |
| | | * | |
| | | * Enable X.509 Certificate Signing Request (CSR) parsing. | |
| | | * | |
| | | * Module: library/x509_csr.c | |
| | | * Caller: library/x509_crt_write.c | |
| | | * | |
| | | * Requires: POLARSSL_X509_USE_C | |
| | | * | |
| | | * This module is used for reading X.509 certificate request. | |
| | | */ | |
| | | #define POLARSSL_X509_CSR_PARSE_C | |
| | | | |
| /** | | /** | |
|
| * \def POLARSSL_X509_WRITE_C | | * \def POLARSSL_X509_CREATE_C | |
| | | * | |
| | | * Enable X.509 core for creating certificates. | |
| | | * | |
| | | * Module: library/x509_create.c | |
| * | | * | |
|
| * Enable X.509 buffer writing. | | * Requires: POLARSSL_BIGNUM_C, POLARSSL_OID_C, POLARSSL_PK_WRITE_C | |
| * | | * | |
|
| * Module: library/x509write.c | | * This module is the basis for creating X.509 certificates and CSRs. | |
| | | */ | |
| | | #define POLARSSL_X509_CREATE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_X509_CRT_WRITE_C | |
| * | | * | |
|
| * Requires: POLARSSL_BIGNUM_C, POLARSSL_RSA_C | | * Enable creating X.509 certificates. | |
| | | * | |
| | | * Module: library/x509_crt_write.c | |
| | | * | |
| | | * Requires: POLARSSL_CREATE_C | |
| | | * | |
| | | * This module is required for X.509 certificate creation. | |
| | | */ | |
| | | #define POLARSSL_X509_CRT_WRITE_C | |
| | | | |
| | | /** | |
| | | * \def POLARSSL_X509_CSR_WRITE_C | |
| | | * | |
| | | * Enable creating X.509 Certificate Signing Requests (CSR). | |
| | | * | |
| | | * Module: library/x509_csr_write.c | |
| | | * | |
| | | * Requires: POLARSSL_CREATE_C | |
| * | | * | |
| * This module is required for X.509 certificate request writing. | | * This module is required for X.509 certificate request writing. | |
| */ | | */ | |
|
| #define POLARSSL_X509_WRITE_C | | #define POLARSSL_X509_CSR_WRITE_C | |
| | | | |
| /** | | /** | |
| * \def POLARSSL_XTEA_C | | * \def POLARSSL_XTEA_C | |
| * | | * | |
| * Enable the XTEA block cipher. | | * Enable the XTEA block cipher. | |
| * | | * | |
| * Module: library/xtea.c | | * Module: library/xtea.c | |
| * Caller: | | * Caller: | |
| */ | | */ | |
| #define POLARSSL_XTEA_C | | #define POLARSSL_XTEA_C | |
|
| /* \} name */ | | | |
| | | /* \} name SECTION: PolarSSL modules */ | |
| | | | |
| /** | | /** | |
| * \name SECTION: Module configuration options | | * \name SECTION: Module configuration options | |
| * | | * | |
| * This section allows for the setting of module specific sizes and | | * This section allows for the setting of module specific sizes and | |
| * configuration options. The default values are already present in the | | * configuration options. The default values are already present in the | |
| * relevant header files and should suffice for the regular use cases. | | * relevant header files and should suffice for the regular use cases. | |
| * Our advice is to enable POLARSSL_CONFIG_OPTIONS and change values here | | * Our advice is to enable POLARSSL_CONFIG_OPTIONS and change values here | |
| * only if you have a good reason and know the consequences. | | * only if you have a good reason and know the consequences. | |
| * | | * | |
| | | | |
| skipping to change at line 989 | | skipping to change at line 1658 | |
|---|
| | | | |
| #if defined(POLARSSL_CONFIG_OPTIONS) | | #if defined(POLARSSL_CONFIG_OPTIONS) | |
| | | | |
| // MPI / BIGNUM options | | // MPI / BIGNUM options | |
| // | | // | |
| #define POLARSSL_MPI_WINDOW_SIZE 6 /**< Maximum windows size use
d. */ | | #define POLARSSL_MPI_WINDOW_SIZE 6 /**< Maximum windows size use
d. */ | |
| #define POLARSSL_MPI_MAX_SIZE 512 /**< Maximum number of bytes
for usable MPIs. */ | | #define POLARSSL_MPI_MAX_SIZE 512 /**< Maximum number of bytes
for usable MPIs. */ | |
| | | | |
| // CTR_DRBG options | | // CTR_DRBG options | |
| // | | // | |
|
| #define CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used p
er seed by default */ | | #define CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used p
er seed by default (48 with SHA-512, 32 with SHA-256) */ | |
| #define CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed i
s performed by default */ | | #define CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed i
s performed by default */ | |
| #define CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additi
onal input bytes */ | | #define CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additi
onal input bytes */ | |
| #define CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of reques
ted bytes per call */ | | #define CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of reques
ted bytes per call */ | |
| #define CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed
buffer */ | | #define CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed
buffer */ | |
| | | | |
| // Entropy options | | // Entropy options | |
| // | | // | |
| #define ENTROPY_MAX_SOURCES 20 /**< Maximum number of source
s supported */ | | #define ENTROPY_MAX_SOURCES 20 /**< Maximum number of source
s supported */ | |
| #define ENTROPY_MAX_GATHER 128 /**< Maximum amount requested
from entropy sources */ | | #define ENTROPY_MAX_GATHER 128 /**< Maximum amount requested
from entropy sources */ | |
| | | | |
|
| | | // Memory options | |
| | | #define MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of th | |
| | | is value */ | |
| | | #define POLARSSL_MEMORY_STDMALLOC malloc /**< Default allocator to use | |
| | | , can be undefined */ | |
| | | #define POLARSSL_MEMORY_STDFREE free /**< Default free to use, can | |
| | | be undefined */ | |
| | | | |
| // SSL Cache options | | // SSL Cache options | |
| // | | // | |
| #define SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ | | #define SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ | |
| #define SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache
*/ | | #define SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache
*/ | |
| | | | |
| // SSL options | | // SSL options | |
| // | | // | |
| #define SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / outp
ut buffer */ | | #define SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / outp
ut buffer */ | |
|
| | | #define SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tick
ets (if enabled) */ | |
| | | | |
| #endif /* POLARSSL_CONFIG_OPTIONS */ | | #endif /* POLARSSL_CONFIG_OPTIONS */ | |
| | | | |
| /* \} name */ | | /* \} name */ | |
|
| | | | |
| | | /* | |
| | | * Sanity checks on defines and dependencies | |
| | | */ | |
| | | #if defined(POLARSSL_DHM_C) && !defined(POLARSSL_BIGNUM_C) | |
| | | #error "POLARSSL_DHM_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_CTR_DRBG_C) && !defined(POLARSSL_AES_C) | |
| | | #error "POLARSSL_CTR_DRBG_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_ECDH_C) && !defined(POLARSSL_ECP_C) | |
| | | #error "POLARSSL_ECDH_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_ECDSA_C) && \ | |
| | | ( !defined(POLARSSL_ECP_C) || \ | |
| | | !defined(POLARSSL_ASN1_PARSE_C) || \ | |
| | | !defined(POLARSSL_ASN1_WRITE_C) ) | |
| | | #error "POLARSSL_ECDSA_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_ECP_C) && !defined(POLARSSL_BIGNUM_C) | |
| | | #error "POLARSSL_ECP_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_ENTROPY_C) && (!defined(POLARSSL_SHA512_C) && \ | |
| | | !defined(POLARSSL_SHA256_C)) | |
| | | #error "POLARSSL_ENTROPY_C defined, but not all prerequisites" | |
| | | #endif | |
| | | #if defined(POLARSSL_ENTROPY_C) && defined(POLARSSL_SHA512_C) && \ | |
| | | defined(POLARSSL_CONFIG_OPTIONS) && (CTR_DRBG_ENTROPY_LEN > 64) | |
| | | #error "CTR_DRBG_ENTROPY_LEN value too high" | |
| | | #endif | |
| | | #if defined(POLARSSL_ENTROPY_C) && !defined(POLARSSL_SHA512_C) && \ | |
| | | defined(POLARSSL_CONFIG_OPTIONS) && (CTR_DRBG_ENTROPY_LEN > 32) | |
| | | #error "CTR_DRBG_ENTROPY_LEN value too high" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_GCM_C) && !defined(POLARSSL_AES_C) | |
| | | #error "POLARSSL_GCM_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_HAVEGE_C) && !defined(POLARSSL_TIMING_C) | |
| | | #error "POLARSSL_HAVEGE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) && !defined(POLARSSL_DHM | |
| | | _C) | |
| | | #error "POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequi | |
| | | sites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ | |
| | | ( !defined(POLARSSL_DHM_C) || !defined(POLARSSL_RSA_C) || \ | |
| | | !defined(POLARSSL_X509_CRT_PARSE_C) || !defined(POLARSSL_PKCS1_V15) ) | |
| | | #error "POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequi | |
| | | sites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ | |
| | | ( !defined(POLARSSL_ECDH_C) || !defined(POLARSSL_RSA_C) || \ | |
| | | !defined(POLARSSL_X509_CRT_PARSE_C) || !defined(POLARSSL_PKCS1_V15) ) | |
| | | #error "POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prereq | |
| | | uisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ | |
| | | ( !defined(POLARSSL_ECDH_C) || !defined(POLARSSL_ECDSA_C) || \ | |
| | | !defined(POLARSSL_X509_CRT_PARSE_C) ) | |
| | | #error "POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prer | |
| | | equisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ | |
| | | ( !defined(POLARSSL_RSA_C) || !defined(POLARSSL_X509_CRT_PARSE_C) ||\ | |
| | | !defined(POLARSSL_PKCS1_V15) ) | |
| | | #error "POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED defined, but not all prerequi | |
| | | sites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \ | |
| | | ( !defined(POLARSSL_RSA_C) || !defined(POLARSSL_X509_CRT_PARSE_C) ||\ | |
| | | !defined(POLARSSL_PKCS1_V15) ) | |
| | | #error "POLARSSL_KEY_EXCHANGE_RSA_ENABLED defined, but not all prerequisite | |
| | | s" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) && !defined(POLARSSL_MEMORY_C) | |
| | | #error "POLARSSL_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_PBKDF2_C) && !defined(POLARSSL_MD_C) | |
| | | #error "POLARSSL_PBKDF2_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_PEM_PARSE_C) && !defined(POLARSSL_BASE64_C) | |
| | | #error "POLARSSL_PEM_PARSE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_PEM_WRITE_C) && !defined(POLARSSL_BASE64_C) | |
| | | #error "POLARSSL_PEM_WRITE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_PK_PARSE_C) && !defined(POLARSSL_PK_C) | |
| | | #error "POLARSSL_PK_PARSE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_PK_WRITE_C) && !defined(POLARSSL_PK_C) | |
| | | #error "POLARSSL_PK_WRITE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_PKCS11_C) && !defined(POLARSSL_PK_C) | |
| | | #error "POLARSSL_PKCS11_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_RSA_C) && ( !defined(POLARSSL_BIGNUM_C) || \ | |
| | | !defined(POLARSSL_OID_C) ) | |
| | | #error "POLARSSL_RSA_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_CLI_C) && !defined(POLARSSL_SSL_TLS_C) | |
| | | #error "POLARSSL_SSL_CLI_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_TLS_C) && ( !defined(POLARSSL_CIPHER_C) || \ | |
| | | !defined(POLARSSL_MD_C) ) | |
| | | #error "POLARSSL_SSL_TLS_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_SRV_C) && !defined(POLARSSL_SSL_TLS_C) | |
| | | #error "POLARSSL_SSL_SRV_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_TLS_C) && (!defined(POLARSSL_SSL_PROTO_SSL3) && \ | |
| | | !defined(POLARSSL_SSL_PROTO_TLS1) && !defined(POLARSSL_SSL_PROTO_TLS1_1 | |
| | | ) && \ | |
| | | !defined(POLARSSL_SSL_PROTO_TLS1_2)) | |
| | | #error "POLARSSL_SSL_TLS_C defined, but no protocols are active" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_TLS_C) && (defined(POLARSSL_SSL_PROTO_SSL3) && \ | |
| | | defined(POLARSSL_SSL_PROTO_TLS1_1) && !defined(POLARSSL_SSL_PROTO_TLS1) | |
| | | ) | |
| | | #error "Illegal protocol selection" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_TLS_C) && (defined(POLARSSL_SSL_PROTO_TLS1) && \ | |
| | | defined(POLARSSL_SSL_PROTO_TLS1_2) && !defined(POLARSSL_SSL_PROTO_TLS1_ | |
| | | 1)) | |
| | | #error "Illegal protocol selection" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_TLS_C) && (defined(POLARSSL_SSL_PROTO_SSL3) && \ | |
| | | defined(POLARSSL_SSL_PROTO_TLS1_2) && (!defined(POLARSSL_SSL_PROTO_TLS1 | |
| | | ) || \ | |
| | | !defined(POLARSSL_SSL_PROTO_TLS1_1))) | |
| | | #error "Illegal protocol selection" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) && defined(POLARSSL_SSL_TLS_C) && | |
| | | \ | |
| | | ( !defined(POLARSSL_AES_C) || !defined(POLARSSL_SHA256_C) || | |
| | | \ | |
| | | !defined(POLARSSL_CIPHER_MODE_CBC) ) | |
| | | #error "POLARSSL_SSL_SESSION_TICKETS_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_THREADING_DUMMY) | |
| | | #if !defined(POLARSSL_THREADING_C) || defined(POLARSSL_THREADING_IMPL) | |
| | | #error "POLARSSL_THREADING_DUMMY defined, but not all prerequisites" | |
| | | #endif | |
| | | #define POLARSSL_THREADING_IMPL | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_THREADING_PTHREAD) | |
| | | #if !defined(POLARSSL_THREADING_C) || defined(POLARSSL_THREADING_IMPL) | |
| | | #error "POLARSSL_THREADING_PTHREAD defined, but not all prerequisites" | |
| | | #endif | |
| | | #define POLARSSL_THREADING_IMPL | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_THREADING_ALT) | |
| | | #if !defined(POLARSSL_THREADING_C) || defined(POLARSSL_THREADING_IMPL) | |
| | | #error "POLARSSL_THREADING_ALT defined, but not all prerequisites" | |
| | | #endif | |
| | | #define POLARSSL_THREADING_IMPL | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_THREADING_C) && !defined(POLARSSL_THREADING_IMPL) | |
| | | #error "POLARSSL_THREADING_C defined, single threading implementation requi | |
| | | red" | |
| | | #endif | |
| | | #undef POLARSSL_THREADING_IMPL | |
| | | | |
| | | #if defined(POLARSSL_X509_USE_C) && ( !defined(POLARSSL_BIGNUM_C) || \ | |
| | | !defined(POLARSSL_OID_C) || !defined(POLARSSL_ASN1_PARSE_C) || \ | |
| | | !defined(POLARSSL_PK_PARSE_C) ) | |
| | | #error "POLARSSL_X509_USE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CREATE_C) && ( !defined(POLARSSL_BIGNUM_C) || \ | |
| | | !defined(POLARSSL_OID_C) || !defined(POLARSSL_ASN1_WRITE_C) || \ | |
| | | !defined(POLARSSL_PK_WRITE_C) ) | |
| | | #error "POLARSSL_X509_CREATE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) && ( !defined(POLARSSL_X509_USE_C) ) | |
| | | #error "POLARSSL_X509_CRT_PARSE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CRL_PARSE_C) && ( !defined(POLARSSL_X509_USE_C) ) | |
| | | #error "POLARSSL_X509_CRL_PARSE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CSR_PARSE_C) && ( !defined(POLARSSL_X509_USE_C) ) | |
| | | #error "POLARSSL_X509_CSR_PARSE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CRT_WRITE_C) && ( !defined(POLARSSL_X509_CREATE_C | |
| | | ) ) | |
| | | #error "POLARSSL_X509_CRT_WRITE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CSR_WRITE_C) && ( !defined(POLARSSL_X509_CREATE_C | |
| | | ) ) | |
| | | #error "POLARSSL_X509_CSR_WRITE_C defined, but not all prerequisites" | |
| | | #endif | |
| | | | |
| #endif /* config.h */ | | #endif /* config.h */ | |
| | | | |
| End of changes. 87 change blocks. |
|---|
| 71 lines changed or deleted | | 985 lines changed or added | |
|---|
|
| rsa.h | | rsa.h | |
|---|
| /** | | /** | |
| * \file rsa.h | | * \file rsa.h | |
| * | | * | |
| * \brief The RSA public-key cryptosystem | | * \brief The RSA public-key cryptosystem | |
| * | | * | |
|
| * Copyright (C) 2006-2010, Brainspark B.V. | | * Copyright (C) 2006-2013, Brainspark B.V. | |
| * | | * | |
| * This file is part of PolarSSL (http://www.polarssl.org) | | * This file is part of PolarSSL (http://www.polarssl.org) | |
| * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> | | * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> | |
| * | | * | |
| * All rights reserved. | | * All rights reserved. | |
| * | | * | |
| * This program is free software; you can redistribute it and/or modify | | * This program is free software; you can redistribute it and/or modify | |
| * it under the terms of the GNU General Public License as published by | | * it under the terms of the GNU General Public License as published by | |
| * the Free Software Foundation; either version 2 of the License, or | | * the Free Software Foundation; either version 2 of the License, or | |
| * (at your option) any later version. | | * (at your option) any later version. | |
| | | | |
| skipping to change at line 30 | | skipping to change at line 30 | |
|---|
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
| * GNU General Public License for more details. | | * GNU General Public License for more details. | |
| * | | * | |
| * You should have received a copy of the GNU General Public License along | | * You should have received a copy of the GNU General Public License along | |
| * with this program; if not, write to the Free Software Foundation, Inc., | | * with this program; if not, write to the Free Software Foundation, Inc., | |
| * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
| */ | | */ | |
| #ifndef POLARSSL_RSA_H | | #ifndef POLARSSL_RSA_H | |
| #define POLARSSL_RSA_H | | #define POLARSSL_RSA_H | |
| | | | |
|
| | | #include "config.h" | |
| | | | |
| #include "bignum.h" | | #include "bignum.h" | |
|
| | | #include "md.h" | |
| | | | |
| | | #if defined(POLARSSL_THREADING_C) | |
| | | #include "threading.h" | |
| | | #endif | |
| | | | |
| /* | | /* | |
| * RSA Error codes | | * RSA Error codes | |
| */ | | */ | |
| #define POLARSSL_ERR_RSA_BAD_INPUT_DATA -0x4080 /**< Ba
d input parameters to function. */ | | #define POLARSSL_ERR_RSA_BAD_INPUT_DATA -0x4080 /**< Ba
d input parameters to function. */ | |
| #define POLARSSL_ERR_RSA_INVALID_PADDING -0x4100 /**< In
put data contains invalid padding and is rejected. */ | | #define POLARSSL_ERR_RSA_INVALID_PADDING -0x4100 /**< In
put data contains invalid padding and is rejected. */ | |
| #define POLARSSL_ERR_RSA_KEY_GEN_FAILED -0x4180 /**< So
mething failed during generation of a key. */ | | #define POLARSSL_ERR_RSA_KEY_GEN_FAILED -0x4180 /**< So
mething failed during generation of a key. */ | |
| #define POLARSSL_ERR_RSA_KEY_CHECK_FAILED -0x4200 /**< Ke
y failed to pass the libraries validity check. */ | | #define POLARSSL_ERR_RSA_KEY_CHECK_FAILED -0x4200 /**< Ke
y failed to pass the libraries validity check. */ | |
| #define POLARSSL_ERR_RSA_PUBLIC_FAILED -0x4280 /**< Th
e public key operation failed. */ | | #define POLARSSL_ERR_RSA_PUBLIC_FAILED -0x4280 /**< Th
e public key operation failed. */ | |
| #define POLARSSL_ERR_RSA_PRIVATE_FAILED -0x4300 /**< Th
e private key operation failed. */ | | #define POLARSSL_ERR_RSA_PRIVATE_FAILED -0x4300 /**< Th
e private key operation failed. */ | |
| #define POLARSSL_ERR_RSA_VERIFY_FAILED -0x4380 /**< Th
e PKCS#1 verification failed. */ | | #define POLARSSL_ERR_RSA_VERIFY_FAILED -0x4380 /**< Th
e PKCS#1 verification failed. */ | |
| #define POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 /**< Th
e output buffer for decryption is not large enough. */ | | #define POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 /**< Th
e output buffer for decryption is not large enough. */ | |
| #define POLARSSL_ERR_RSA_RNG_FAILED -0x4480 /**< Th
e random generator failed to generate non-zeros. */ | | #define POLARSSL_ERR_RSA_RNG_FAILED -0x4480 /**< Th
e random generator failed to generate non-zeros. */ | |
| | | | |
| /* | | /* | |
|
| * PKCS#1 constants | | * RSA constants | |
| */ | | */ | |
|
| #define SIG_RSA_RAW 0 | | | |
| #define SIG_RSA_MD2 2 | | | |
| #define SIG_RSA_MD4 3 | | | |
| #define SIG_RSA_MD5 4 | | | |
| #define SIG_RSA_SHA1 5 | | | |
| #define SIG_RSA_SHA224 14 | | | |
| #define SIG_RSA_SHA256 11 | | | |
| #define SIG_RSA_SHA384 12 | | | |
| #define SIG_RSA_SHA512 13 | | | |
| | | | |
| #define RSA_PUBLIC 0 | | #define RSA_PUBLIC 0 | |
| #define RSA_PRIVATE 1 | | #define RSA_PRIVATE 1 | |
| | | | |
| #define RSA_PKCS_V15 0 | | #define RSA_PKCS_V15 0 | |
| #define RSA_PKCS_V21 1 | | #define RSA_PKCS_V21 1 | |
| | | | |
| #define RSA_SIGN 1 | | #define RSA_SIGN 1 | |
| #define RSA_CRYPT 2 | | #define RSA_CRYPT 2 | |
| | | | |
|
| #define ASN1_STR_CONSTRUCTED_SEQUENCE "\x30" | | | |
| #define ASN1_STR_NULL "\x05" | | | |
| #define ASN1_STR_OID "\x06" | | | |
| #define ASN1_STR_OCTET_STRING "\x04" | | | |
| | | | |
| #define OID_DIGEST_ALG_MDX "\x2A\x86\x48\x86\xF7\x0D\x02\x00" | | | |
| #define OID_HASH_ALG_SHA1 "\x2b\x0e\x03\x02\x1a" | | | |
| #define OID_HASH_ALG_SHA2X "\x60\x86\x48\x01\x65\x03\x04\x02\x | | | |
| 00" | | | |
| | | | |
| #define OID_ISO_MEMBER_BODIES "\x2a" | | | |
| #define OID_ISO_IDENTIFIED_ORG "\x2b" | | | |
| | | | |
| /* | | | |
| * ISO Member bodies OID parts | | | |
| */ | | | |
| #define OID_COUNTRY_US "\x86\x48" | | | |
| #define OID_RSA_DATA_SECURITY "\x86\xf7\x0d" | | | |
| | | | |
| /* | | /* | |
|
| * ISO Identified organization OID parts | | * The above constants may be used even if the RSA module is compile out, | |
| | | * eg for alternative (PKCS#11) RSA implemenations in the PK layers. | |
| */ | | */ | |
|
| #define OID_OIW_SECSIG_SHA1 "\x0e\x03\x02\x1a" | | #if defined(POLARSSL_RSA_C) | |
| | | | |
|
| /* | | #ifdef __cplusplus | |
| * DigestInfo ::= SEQUENCE { | | extern "C" { | |
| * digestAlgorithm DigestAlgorithmIdentifier, | | #endif | |
| * digest Digest } | | | |
| * | | | |
| * DigestAlgorithmIdentifier ::= AlgorithmIdentifier | | | |
| * | | | |
| * Digest ::= OCTET STRING | | | |
| */ | | | |
| #define ASN1_HASH_MDX \ | | | |
| ( \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x20" \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x0C" \ | | | |
| ASN1_STR_OID "\x08" \ | | | |
| OID_DIGEST_ALG_MDX \ | | | |
| ASN1_STR_NULL "\x00" \ | | | |
| ASN1_STR_OCTET_STRING "\x10" \ | | | |
| ) | | | |
| | | | |
| #define ASN1_HASH_SHA1 \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x21" \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x09" \ | | | |
| ASN1_STR_OID "\x05" \ | | | |
| OID_HASH_ALG_SHA1 \ | | | |
| ASN1_STR_NULL "\x00" \ | | | |
| ASN1_STR_OCTET_STRING "\x14" | | | |
| | | | |
| #define ASN1_HASH_SHA1_ALT \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x1F" \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x07" \ | | | |
| ASN1_STR_OID "\x05" \ | | | |
| OID_HASH_ALG_SHA1 \ | | | |
| ASN1_STR_OCTET_STRING "\x14" | | | |
| | | | |
| #define ASN1_HASH_SHA2X \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x11" \ | | | |
| ASN1_STR_CONSTRUCTED_SEQUENCE "\x0d" \ | | | |
| ASN1_STR_OID "\x09" \ | | | |
| OID_HASH_ALG_SHA2X \ | | | |
| ASN1_STR_NULL "\x00" \ | | | |
| ASN1_STR_OCTET_STRING "\x00" | | | |
| | | | |
| /** | | /** | |
| * \brief RSA context structure | | * \brief RSA context structure | |
| */ | | */ | |
| typedef struct | | typedef struct | |
| { | | { | |
| int ver; /*!< always 0 */ | | int ver; /*!< always 0 */ | |
| size_t len; /*!< size(N) in chars */ | | size_t len; /*!< size(N) in chars */ | |
| | | | |
| mpi N; /*!< public modulus */ | | mpi N; /*!< public modulus */ | |
| | | | |
| skipping to change at line 154 | | skipping to change at line 96 | |
|---|
| mpi P; /*!< 1st prime factor */ | | mpi P; /*!< 1st prime factor */ | |
| mpi Q; /*!< 2nd prime factor */ | | mpi Q; /*!< 2nd prime factor */ | |
| mpi DP; /*!< D % (P - 1) */ | | mpi DP; /*!< D % (P - 1) */ | |
| mpi DQ; /*!< D % (Q - 1) */ | | mpi DQ; /*!< D % (Q - 1) */ | |
| mpi QP; /*!< 1 / (Q % P) */ | | mpi QP; /*!< 1 / (Q % P) */ | |
| | | | |
| mpi RN; /*!< cached R^2 mod N */ | | mpi RN; /*!< cached R^2 mod N */ | |
| mpi RP; /*!< cached R^2 mod P */ | | mpi RP; /*!< cached R^2 mod P */ | |
| mpi RQ; /*!< cached R^2 mod Q */ | | mpi RQ; /*!< cached R^2 mod Q */ | |
| | | | |
|
| | | #if !defined(POLARSSL_RSA_NO_CRT) | |
| | | mpi Vi; /*!< cached blinding value */ | |
| | | mpi Vf; /*!< cached un-blinding value */ | |
| | | #endif | |
| | | | |
| int padding; /*!< RSA_PKCS_V15 for 1.5 padding and | | int padding; /*!< RSA_PKCS_V15 for 1.5 padding and | |
| RSA_PKCS_v21 for OAEP/PSS */ | | RSA_PKCS_v21 for OAEP/PSS */ | |
| int hash_id; /*!< Hash identifier of md_type_t as | | int hash_id; /*!< Hash identifier of md_type_t as | |
| specified in the md.h header file | | specified in the md.h header file | |
| for the EME-OAEP and EMSA-PSS | | for the EME-OAEP and EMSA-PSS | |
| encoding */ | | encoding */ | |
|
| | | #if defined(POLARSSL_THREADING_C) | |
| | | threading_mutex_t mutex; /*!< Thread-safety mutex */ | |
| | | #endif | |
| } | | } | |
| rsa_context; | | rsa_context; | |
| | | | |
|
| #ifdef __cplusplus | | | |
| extern "C" { | | | |
| #endif | | | |
| | | | |
| /** | | /** | |
| * \brief Initialize an RSA context | | * \brief Initialize an RSA context | |
| * | | * | |
| * Note: Set padding to RSA_PKCS_V21 for the RSAES-OAEP | | * Note: Set padding to RSA_PKCS_V21 for the RSAES-OAEP | |
| * encryption scheme and the RSASSA-PSS signature scheme. | | * encryption scheme and the RSASSA-PSS signature scheme. | |
| * | | * | |
| * \param ctx RSA context to be initialized | | * \param ctx RSA context to be initialized | |
| * \param padding RSA_PKCS_V15 or RSA_PKCS_V21 | | * \param padding RSA_PKCS_V15 or RSA_PKCS_V21 | |
| * \param hash_id RSA_PKCS_V21 hash identifier | | * \param hash_id RSA_PKCS_V21 hash identifier | |
| * | | * | |
| | | | |
| skipping to change at line 429 | | skipping to change at line 375 | |
|---|
| unsigned char *output, | | unsigned char *output, | |
| size_t output_max_len ); | | size_t output_max_len ); | |
| | | | |
| /** | | /** | |
| * \brief Generic wrapper to perform a PKCS#1 signature using the | | * \brief Generic wrapper to perform a PKCS#1 signature using the | |
| * mode from the context. Do a private RSA operation to sig
n | | * mode from the context. Do a private RSA operation to sig
n | |
| * a message digest | | * a message digest | |
| * | | * | |
| * \param ctx RSA context | | * \param ctx RSA context | |
| * \param f_rng RNG function (Needed for PKCS#1 v2.1 encoding and for | | * \param f_rng RNG function (Needed for PKCS#1 v2.1 encoding and for | |
|
| * RSA_PRIVATE) | | * RSA_PRIVATE) | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| * \param mode RSA_PUBLIC or RSA_PRIVATE | | * \param mode RSA_PUBLIC or RSA_PRIVATE | |
|
| * \param hash_id SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256, | | * \param md_alg a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw da | |
| 384,512} | | ta) | |
| * \param hashlen message digest length (for SIG_RSA_RAW only) | | * \param hashlen message digest length (for POLARSSL_MD_NONE only) | |
| * \param hash buffer holding the message digest | | * \param hash buffer holding the message digest | |
| * \param sig buffer that will hold the ciphertext | | * \param sig buffer that will hold the ciphertext | |
| * | | * | |
| * \return 0 if the signing operation was successful, | | * \return 0 if the signing operation was successful, | |
| * or an POLARSSL_ERR_RSA_XXX error code | | * or an POLARSSL_ERR_RSA_XXX error code | |
| * | | * | |
| * \note The "sig" buffer must be as large as the size | | * \note The "sig" buffer must be as large as the size | |
| * of ctx->N (eg. 128 bytes if RSA-1024 is used). | | * of ctx->N (eg. 128 bytes if RSA-1024 is used). | |
| * | | * | |
| * \note In case of PKCS#1 v2.1 encoding keep in mind that | | * \note In case of PKCS#1 v2.1 encoding keep in mind that | |
| * the hash_id in the RSA context is the one used for the | | * the hash_id in the RSA context is the one used for the | |
| * encoding. hash_id in the function call is the type of ha
sh | | * encoding. hash_id in the function call is the type of ha
sh | |
| * that is encoded. According to RFC 3447 it is advised to | | * that is encoded. According to RFC 3447 it is advised to | |
| * keep both hashes the same. | | * keep both hashes the same. | |
| */ | | */ | |
| int rsa_pkcs1_sign( rsa_context *ctx, | | int rsa_pkcs1_sign( rsa_context *ctx, | |
| int (*f_rng)(void *, unsigned char *, size_t), | | int (*f_rng)(void *, unsigned char *, size_t), | |
| void *p_rng, | | void *p_rng, | |
| int mode, | | int mode, | |
|
| int hash_id, | | md_type_t md_alg, | |
| unsigned int hashlen, | | unsigned int hashlen, | |
| const unsigned char *hash, | | const unsigned char *hash, | |
| unsigned char *sig ); | | unsigned char *sig ); | |
| | | | |
| /** | | /** | |
| * \brief Perform a PKCS#1 v1.5 signature (RSASSA-PKCS1-v1_5-SIGN) | | * \brief Perform a PKCS#1 v1.5 signature (RSASSA-PKCS1-v1_5-SIGN) | |
| * | | * | |
| * \param ctx RSA context | | * \param ctx RSA context | |
| * \param f_rng RNG function (Only needed for RSA_PRIVATE) | | * \param f_rng RNG function (Only needed for RSA_PRIVATE) | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| * \param mode RSA_PUBLIC or RSA_PRIVATE | | * \param mode RSA_PUBLIC or RSA_PRIVATE | |
|
| * \param hash_id SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256, | | * \param md_alg a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw da | |
| 384,512} | | ta) | |
| * \param hashlen message digest length (for SIG_RSA_RAW only) | | * \param hashlen message digest length (for POLARSSL_MD_NONE only) | |
| * \param hash buffer holding the message digest | | * \param hash buffer holding the message digest | |
| * \param sig buffer that will hold the ciphertext | | * \param sig buffer that will hold the ciphertext | |
| * | | * | |
| * \return 0 if the signing operation was successful, | | * \return 0 if the signing operation was successful, | |
| * or an POLARSSL_ERR_RSA_XXX error code | | * or an POLARSSL_ERR_RSA_XXX error code | |
| * | | * | |
| * \note The "sig" buffer must be as large as the size | | * \note The "sig" buffer must be as large as the size | |
| * of ctx->N (eg. 128 bytes if RSA-1024 is used). | | * of ctx->N (eg. 128 bytes if RSA-1024 is used). | |
| */ | | */ | |
| int rsa_rsassa_pkcs1_v15_sign( rsa_context *ctx, | | int rsa_rsassa_pkcs1_v15_sign( rsa_context *ctx, | |
| int (*f_rng)(void *, unsigned char *, size_t
), | | int (*f_rng)(void *, unsigned char *, size_t
), | |
| void *p_rng, | | void *p_rng, | |
| int mode, | | int mode, | |
|
| int hash_id, | | md_type_t md_alg, | |
| unsigned int hashlen, | | unsigned int hashlen, | |
| const unsigned char *hash, | | const unsigned char *hash, | |
| unsigned char *sig ); | | unsigned char *sig ); | |
| | | | |
| /** | | /** | |
| * \brief Perform a PKCS#1 v2.1 PSS signature (RSASSA-PSS-SIGN) | | * \brief Perform a PKCS#1 v2.1 PSS signature (RSASSA-PSS-SIGN) | |
| * | | * | |
| * \param ctx RSA context | | * \param ctx RSA context | |
| * \param f_rng RNG function (Needed for PKCS#1 v2.1 encoding and for | | * \param f_rng RNG function (Needed for PKCS#1 v2.1 encoding and for | |
| * RSA_PRIVATE) | | * RSA_PRIVATE) | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| * \param mode RSA_PUBLIC or RSA_PRIVATE | | * \param mode RSA_PUBLIC or RSA_PRIVATE | |
|
| * \param hash_id SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256, | | * \param md_alg a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw da | |
| 384,512} | | ta) | |
| * \param hashlen message digest length (for SIG_RSA_RAW only) | | * \param hashlen message digest length (for POLARSSL_MD_NONE only) | |
| * \param hash buffer holding the message digest | | * \param hash buffer holding the message digest | |
| * \param sig buffer that will hold the ciphertext | | * \param sig buffer that will hold the ciphertext | |
| * | | * | |
| * \return 0 if the signing operation was successful, | | * \return 0 if the signing operation was successful, | |
| * or an POLARSSL_ERR_RSA_XXX error code | | * or an POLARSSL_ERR_RSA_XXX error code | |
| * | | * | |
| * \note The "sig" buffer must be as large as the size | | * \note The "sig" buffer must be as large as the size | |
| * of ctx->N (eg. 128 bytes if RSA-1024 is used). | | * of ctx->N (eg. 128 bytes if RSA-1024 is used). | |
| * | | * | |
| * \note In case of PKCS#1 v2.1 encoding keep in mind that | | * \note In case of PKCS#1 v2.1 encoding keep in mind that | |
| * the hash_id in the RSA context is the one used for the | | * the hash_id in the RSA context is the one used for the | |
| * encoding. hash_id in the function call is the type of ha
sh | | * encoding. hash_id in the function call is the type of ha
sh | |
| * that is encoded. According to RFC 3447 it is advised to | | * that is encoded. According to RFC 3447 it is advised to | |
| * keep both hashes the same. | | * keep both hashes the same. | |
| */ | | */ | |
| int rsa_rsassa_pss_sign( rsa_context *ctx, | | int rsa_rsassa_pss_sign( rsa_context *ctx, | |
| int (*f_rng)(void *, unsigned char *, size_t), | | int (*f_rng)(void *, unsigned char *, size_t), | |
| void *p_rng, | | void *p_rng, | |
| int mode, | | int mode, | |
|
| int hash_id, | | md_type_t md_alg, | |
| unsigned int hashlen, | | unsigned int hashlen, | |
| const unsigned char *hash, | | const unsigned char *hash, | |
| unsigned char *sig ); | | unsigned char *sig ); | |
| | | | |
| /** | | /** | |
| * \brief Generic wrapper to perform a PKCS#1 verification using t
he | | * \brief Generic wrapper to perform a PKCS#1 verification using t
he | |
| * mode from the context. Do a public RSA operation and che
ck | | * mode from the context. Do a public RSA operation and che
ck | |
| * the message digest | | * the message digest | |
| * | | * | |
| * \param ctx points to an RSA public key | | * \param ctx points to an RSA public key | |
| * \param f_rng RNG function (Only needed for RSA_PRIVATE) | | * \param f_rng RNG function (Only needed for RSA_PRIVATE) | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| * \param mode RSA_PUBLIC or RSA_PRIVATE | | * \param mode RSA_PUBLIC or RSA_PRIVATE | |
|
| * \param hash_id SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256, | | * \param md_alg a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw da | |
| 384,512} | | ta) | |
| * \param hashlen message digest length (for SIG_RSA_RAW only) | | * \param hashlen message digest length (for POLARSSL_MD_NONE only) | |
| * \param hash buffer holding the message digest | | * \param hash buffer holding the message digest | |
| * \param sig buffer holding the ciphertext | | * \param sig buffer holding the ciphertext | |
| * | | * | |
| * \return 0 if the verify operation was successful, | | * \return 0 if the verify operation was successful, | |
| * or an POLARSSL_ERR_RSA_XXX error code | | * or an POLARSSL_ERR_RSA_XXX error code | |
| * | | * | |
| * \note The "sig" buffer must be as large as the size | | * \note The "sig" buffer must be as large as the size | |
| * of ctx->N (eg. 128 bytes if RSA-1024 is used). | | * of ctx->N (eg. 128 bytes if RSA-1024 is used). | |
| * | | * | |
| * \note In case of PKCS#1 v2.1 encoding keep in mind that | | * \note In case of PKCS#1 v2.1 encoding keep in mind that | |
| * the hash_id in the RSA context is the one used for the | | * the hash_id in the RSA context is the one used for the | |
| * verification. hash_id in the function call is the type o
f hash | | * verification. hash_id in the function call is the type o
f hash | |
| * that is verified. According to RFC 3447 it is advised to | | * that is verified. According to RFC 3447 it is advised to | |
| * keep both hashes the same. | | * keep both hashes the same. | |
| */ | | */ | |
| int rsa_pkcs1_verify( rsa_context *ctx, | | int rsa_pkcs1_verify( rsa_context *ctx, | |
| int (*f_rng)(void *, unsigned char *, size_t), | | int (*f_rng)(void *, unsigned char *, size_t), | |
| void *p_rng, | | void *p_rng, | |
| int mode, | | int mode, | |
|
| int hash_id, | | md_type_t md_alg, | |
| unsigned int hashlen, | | unsigned int hashlen, | |
| const unsigned char *hash, | | const unsigned char *hash, | |
|
| unsigned char *sig ); | | const unsigned char *sig ); | |
| | | | |
| /** | | /** | |
| * \brief Perform a PKCS#1 v1.5 verification (RSASSA-PKCS1-v1_5-VE
RIFY) | | * \brief Perform a PKCS#1 v1.5 verification (RSASSA-PKCS1-v1_5-VE
RIFY) | |
| * | | * | |
| * \param ctx points to an RSA public key | | * \param ctx points to an RSA public key | |
| * \param f_rng RNG function (Only needed for RSA_PRIVATE) | | * \param f_rng RNG function (Only needed for RSA_PRIVATE) | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| * \param mode RSA_PUBLIC or RSA_PRIVATE | | * \param mode RSA_PUBLIC or RSA_PRIVATE | |
|
| * \param hash_id SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256, | | * \param md_alg a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw da | |
| 384,512} | | ta) | |
| * \param hashlen message digest length (for SIG_RSA_RAW only) | | * \param hashlen message digest length (for POLARSSL_MD_NONE only) | |
| * \param hash buffer holding the message digest | | * \param hash buffer holding the message digest | |
| * \param sig buffer holding the ciphertext | | * \param sig buffer holding the ciphertext | |
| * | | * | |
| * \return 0 if the verify operation was successful, | | * \return 0 if the verify operation was successful, | |
| * or an POLARSSL_ERR_RSA_XXX error code | | * or an POLARSSL_ERR_RSA_XXX error code | |
| * | | * | |
| * \note The "sig" buffer must be as large as the size | | * \note The "sig" buffer must be as large as the size | |
| * of ctx->N (eg. 128 bytes if RSA-1024 is used). | | * of ctx->N (eg. 128 bytes if RSA-1024 is used). | |
| */ | | */ | |
| int rsa_rsassa_pkcs1_v15_verify( rsa_context *ctx, | | int rsa_rsassa_pkcs1_v15_verify( rsa_context *ctx, | |
| int (*f_rng)(void *, unsigned char *, size
_t), | | int (*f_rng)(void *, unsigned char *, size
_t), | |
| void *p_rng, | | void *p_rng, | |
| int mode, | | int mode, | |
|
| int hash_id, | | md_type_t md_alg, | |
| unsigned int hashlen, | | unsigned int hashlen, | |
| const unsigned char *hash, | | const unsigned char *hash, | |
|
| unsigned char *sig ); | | const unsigned char *sig ); | |
| | | | |
| /** | | /** | |
| * \brief Perform a PKCS#1 v2.1 PSS verification (RSASSA-PSS-VERIF
Y) | | * \brief Perform a PKCS#1 v2.1 PSS verification (RSASSA-PSS-VERIF
Y) | |
| * \brief Do a public RSA and check the message digest | | * \brief Do a public RSA and check the message digest | |
| * | | * | |
| * \param ctx points to an RSA public key | | * \param ctx points to an RSA public key | |
| * \param f_rng RNG function (Only needed for RSA_PRIVATE) | | * \param f_rng RNG function (Only needed for RSA_PRIVATE) | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| * \param mode RSA_PUBLIC or RSA_PRIVATE | | * \param mode RSA_PUBLIC or RSA_PRIVATE | |
|
| * \param hash_id SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256, | | * \param md_alg a POLARSSL_MD_* (use POLARSSL_MD_NONE for signing raw da | |
| 384,512} | | ta) | |
| * \param hashlen message digest length (for SIG_RSA_RAW only) | | * \param hashlen message digest length (for POLARSSL_MD_NONE only) | |
| * \param hash buffer holding the message digest | | * \param hash buffer holding the message digest | |
| * \param sig buffer holding the ciphertext | | * \param sig buffer holding the ciphertext | |
| * | | * | |
| * \return 0 if the verify operation was successful, | | * \return 0 if the verify operation was successful, | |
| * or an POLARSSL_ERR_RSA_XXX error code | | * or an POLARSSL_ERR_RSA_XXX error code | |
| * | | * | |
| * \note The "sig" buffer must be as large as the size | | * \note The "sig" buffer must be as large as the size | |
| * of ctx->N (eg. 128 bytes if RSA-1024 is used). | | * of ctx->N (eg. 128 bytes if RSA-1024 is used). | |
| * | | * | |
| * \note In case of PKCS#1 v2.1 encoding keep in mind that | | * \note In case of PKCS#1 v2.1 encoding keep in mind that | |
| * the hash_id in the RSA context is the one used for the | | * the hash_id in the RSA context is the one used for the | |
| * verification. hash_id in the function call is the type o
f hash | | * verification. hash_id in the function call is the type o
f hash | |
| * that is verified. According to RFC 3447 it is advised to | | * that is verified. According to RFC 3447 it is advised to | |
| * keep both hashes the same. | | * keep both hashes the same. | |
| */ | | */ | |
| int rsa_rsassa_pss_verify( rsa_context *ctx, | | int rsa_rsassa_pss_verify( rsa_context *ctx, | |
| int (*f_rng)(void *, unsigned char *, size_t), | | int (*f_rng)(void *, unsigned char *, size_t), | |
| void *p_rng, | | void *p_rng, | |
| int mode, | | int mode, | |
|
| int hash_id, | | md_type_t md_alg, | |
| unsigned int hashlen, | | unsigned int hashlen, | |
| const unsigned char *hash, | | const unsigned char *hash, | |
|
| unsigned char *sig ); | | const unsigned char *sig ); | |
| | | | |
| | | /** | |
| | | * \brief Copy the components of an RSA context | |
| | | * | |
| | | * \param dst Destination context | |
| | | * \param src Source context | |
| | | * | |
| | | * \return O on success, | |
| | | * POLARSSL_ERR_MPI_MALLOC_FAILED on memory allocation fail | |
| | | ure | |
| | | */ | |
| | | int rsa_copy( rsa_context *dst, const rsa_context *src ); | |
| | | | |
| /** | | /** | |
| * \brief Free the components of an RSA key | | * \brief Free the components of an RSA key | |
| * | | * | |
| * \param ctx RSA Context to free | | * \param ctx RSA Context to free | |
| */ | | */ | |
| void rsa_free( rsa_context *ctx ); | | void rsa_free( rsa_context *ctx ); | |
| | | | |
| /** | | /** | |
| * \brief Checkup routine | | * \brief Checkup routine | |
| * | | * | |
| * \return 0 if successful, or 1 if the test failed | | * \return 0 if successful, or 1 if the test failed | |
| */ | | */ | |
| int rsa_self_test( int verbose ); | | int rsa_self_test( int verbose ); | |
| | | | |
| #ifdef __cplusplus | | #ifdef __cplusplus | |
| } | | } | |
| #endif | | #endif | |
| | | | |
|
| | | #endif /* POLARSSL_RSA_C */ | |
| | | | |
| #endif /* rsa.h */ | | #endif /* rsa.h */ | |
| | | | |
| End of changes. 29 change blocks. |
|---|
| 106 lines changed or deleted | | 65 lines changed or added | |
|---|
|
| ssl.h | | ssl.h | |
|---|
| | | | |
| skipping to change at line 30 | | skipping to change at line 30 | |
|---|
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
| * GNU General Public License for more details. | | * GNU General Public License for more details. | |
| * | | * | |
| * You should have received a copy of the GNU General Public License along | | * You should have received a copy of the GNU General Public License along | |
| * with this program; if not, write to the Free Software Foundation, Inc., | | * with this program; if not, write to the Free Software Foundation, Inc., | |
| * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
| */ | | */ | |
| #ifndef POLARSSL_SSL_H | | #ifndef POLARSSL_SSL_H | |
| #define POLARSSL_SSL_H | | #define POLARSSL_SSL_H | |
| | | | |
|
| #include <time.h> | | #include "config.h" | |
| | | | |
| #include "net.h" | | #include "net.h" | |
|
| #include "rsa.h" | | #include "bignum.h" | |
| | | | |
| | | #include "ssl_ciphersuites.h" | |
| | | | |
| | | #if defined(POLARSSL_MD5_C) | |
| #include "md5.h" | | #include "md5.h" | |
|
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SHA1_C) | |
| #include "sha1.h" | | #include "sha1.h" | |
|
| #include "sha2.h" | | #endif | |
| #include "sha4.h" | | | |
| #include "x509.h" | | #if defined(POLARSSL_SHA256_C) | |
| #include "config.h" | | #include "sha256.h" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SHA512_C) | |
| | | #include "sha512.h" | |
| | | #endif | |
| | | | |
| | | // for session tickets | |
| | | #if defined(POLARSSL_AES_C) | |
| | | #include "aes.h" | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | #include "x509_crt.h" | |
| | | #include "x509_crl.h" | |
| | | #endif | |
| | | | |
| #if defined(POLARSSL_DHM_C) | | #if defined(POLARSSL_DHM_C) | |
| #include "dhm.h" | | #include "dhm.h" | |
| #endif | | #endif | |
| | | | |
|
| | | #if defined(POLARSSL_ECDH_C) | |
| | | #include "ecdh.h" | |
| | | #endif | |
| | | | |
| #if defined(POLARSSL_ZLIB_SUPPORT) | | #if defined(POLARSSL_ZLIB_SUPPORT) | |
| #include "zlib.h" | | #include "zlib.h" | |
| #endif | | #endif | |
| | | | |
|
| | | #if defined(POLARSSL_HAVE_TIME) | |
| | | #include <time.h> | |
| | | #endif | |
| | | | |
| #if defined(_MSC_VER) && !defined(inline) | | #if defined(_MSC_VER) && !defined(inline) | |
| #define inline _inline | | #define inline _inline | |
| #else | | #else | |
| #if defined(__ARMCC_VERSION) && !defined(inline) | | #if defined(__ARMCC_VERSION) && !defined(inline) | |
| #define inline __inline | | #define inline __inline | |
| #endif /* __ARMCC_VERSION */ | | #endif /* __ARMCC_VERSION */ | |
| #endif /*_MSC_VER */ | | #endif /*_MSC_VER */ | |
| | | | |
| /* | | /* | |
| * SSL Error codes | | * SSL Error codes | |
| | | | |
| skipping to change at line 71 | | skipping to change at line 100 | |
|---|
| #define POLARSSL_ERR_SSL_BAD_INPUT_DATA -0x7100 /**< Ba
d input parameters to function. */ | | #define POLARSSL_ERR_SSL_BAD_INPUT_DATA -0x7100 /**< Ba
d input parameters to function. */ | |
| #define POLARSSL_ERR_SSL_INVALID_MAC -0x7180 /**< Ve
rification of the message MAC failed. */ | | #define POLARSSL_ERR_SSL_INVALID_MAC -0x7180 /**< Ve
rification of the message MAC failed. */ | |
| #define POLARSSL_ERR_SSL_INVALID_RECORD -0x7200 /**< An
invalid SSL record was received. */ | | #define POLARSSL_ERR_SSL_INVALID_RECORD -0x7200 /**< An
invalid SSL record was received. */ | |
| #define POLARSSL_ERR_SSL_CONN_EOF -0x7280 /**< Th
e connection indicated an EOF. */ | | #define POLARSSL_ERR_SSL_CONN_EOF -0x7280 /**< Th
e connection indicated an EOF. */ | |
| #define POLARSSL_ERR_SSL_UNKNOWN_CIPHER -0x7300 /**< An
unknown cipher was received. */ | | #define POLARSSL_ERR_SSL_UNKNOWN_CIPHER -0x7300 /**< An
unknown cipher was received. */ | |
| #define POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 /**< Th
e server has no ciphersuites in common with the client. */ | | #define POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 /**< Th
e server has no ciphersuites in common with the client. */ | |
| #define POLARSSL_ERR_SSL_NO_SESSION_FOUND -0x7400 /**< No
session to recover was found. */ | | #define POLARSSL_ERR_SSL_NO_SESSION_FOUND -0x7400 /**< No
session to recover was found. */ | |
| #define POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 /**< No
client certification received from the client, but required by the authent
ication mode. */ | | #define POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 /**< No
client certification received from the client, but required by the authent
ication mode. */ | |
| #define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 /**< Ou
r own certificate(s) is/are too large to send in an SSL message.*/ | | #define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 /**< Ou
r own certificate(s) is/are too large to send in an SSL message.*/ | |
| #define POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 /**< Th
e own certificate is not set, but needed by the server. */ | | #define POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 /**< Th
e own certificate is not set, but needed by the server. */ | |
|
| #define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 /**< Th
e own private key is not set, but needed. */ | | #define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 /**< Th
e own private key or pre-shared key is not set, but needed. */ | |
| #define POLARSSL_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 /**< No
CA Chain is set, but required to operate. */ | | #define POLARSSL_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 /**< No
CA Chain is set, but required to operate. */ | |
| #define POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 /**< An
unexpected message was received from our peer. */ | | #define POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 /**< An
unexpected message was received from our peer. */ | |
| #define POLARSSL_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 /**< A
fatal alert message was received from our peer. */ | | #define POLARSSL_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 /**< A
fatal alert message was received from our peer. */ | |
| #define POLARSSL_ERR_SSL_PEER_VERIFY_FAILED -0x7800 /**< Ve
rification of our peer failed. */ | | #define POLARSSL_ERR_SSL_PEER_VERIFY_FAILED -0x7800 /**< Ve
rification of our peer failed. */ | |
| #define POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 /**< Th
e peer notified us that the connection is going to be closed. */ | | #define POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 /**< Th
e peer notified us that the connection is going to be closed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 /**< Pr
ocessing of the ClientHello handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 /**< Pr
ocessing of the ClientHello handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 /**< Pr
ocessing of the ServerHello handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 /**< Pr
ocessing of the ServerHello handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 /**< Pr
ocessing of the Certificate handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 /**< Pr
ocessing of the Certificate handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 /**< Pr
ocessing of the CertificateRequest handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 /**< Pr
ocessing of the CertificateRequest handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 /**< Pr
ocessing of the ServerKeyExchange handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 /**< Pr
ocessing of the ServerKeyExchange handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 /**< Pr
ocessing of the ServerHelloDone handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 /**< Pr
ocessing of the ServerHelloDone handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 /**< Pr
ocessing of the ClientKeyExchange handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 /**< Pr
ocessing of the ClientKeyExchange handshake message failed. */ | |
|
| #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_DHM_RP -0x7C80 /**< Pr | | #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP -0x7C80 /**< Pr | |
| ocessing of the ClientKeyExchange handshake message failed in DHM Read Publ | | ocessing of the ClientKeyExchange handshake message failed in DHM / ECDH Re | |
| ic. */ | | ad Public. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_DHM_CS -0x7D00 /**< Pr | | #define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS -0x7D00 /**< Pr | |
| ocessing of the ClientKeyExchange handshake message failed in DHM Calculate | | ocessing of the ClientKeyExchange handshake message failed in DHM / ECDH Ca | |
| Secret. */ | | lculate Secret. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 /**< Pr
ocessing of the CertificateVerify handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 /**< Pr
ocessing of the CertificateVerify handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 /**< Pr
ocessing of the ChangeCipherSpec handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 /**< Pr
ocessing of the ChangeCipherSpec handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_FINISHED -0x7E80 /**< Pr
ocessing of the Finished handshake message failed. */ | | #define POLARSSL_ERR_SSL_BAD_HS_FINISHED -0x7E80 /**< Pr
ocessing of the Finished handshake message failed. */ | |
| #define POLARSSL_ERR_SSL_MALLOC_FAILED -0x7F00 /**< Me
mory allocation failed */ | | #define POLARSSL_ERR_SSL_MALLOC_FAILED -0x7F00 /**< Me
mory allocation failed */ | |
| #define POLARSSL_ERR_SSL_HW_ACCEL_FAILED -0x7F80 /**< Ha
rdware acceleration function returned with error */ | | #define POLARSSL_ERR_SSL_HW_ACCEL_FAILED -0x7F80 /**< Ha
rdware acceleration function returned with error */ | |
| #define POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 /**< Ha
rdware acceleration function skipped / left alone data */ | | #define POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 /**< Ha
rdware acceleration function skipped / left alone data */ | |
| #define POLARSSL_ERR_SSL_COMPRESSION_FAILED -0x6F00 /**< Pr
ocessing of the compression / decompression failed */ | | #define POLARSSL_ERR_SSL_COMPRESSION_FAILED -0x6F00 /**< Pr
ocessing of the compression / decompression failed */ | |
| #define POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 /**< Ha
ndshake protocol not within min/max boundaries */ | | #define POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 /**< Ha
ndshake protocol not within min/max boundaries */ | |
|
| | | #define POLARSSL_ERR_SSL_BAD_HS_NEW_SESSION_TICKET -0x6E00 /**< Pr | |
| | | ocessing of the NewSessionTicket handshake message failed. */ | |
| | | #define POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 /**< Se | |
| | | ssion ticket has expired. */ | |
| | | #define POLARSSL_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 /**< Pu | |
| | | blic key type mismatch (eg, asked for RSA key exchange and presented EC key | |
| | | ) */ | |
| | | #define POLARSSL_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 /**< Un | |
| | | kown identity received (eg, PSK identity) */ | |
| | | | |
| /* | | /* | |
| * Various constants | | * Various constants | |
| */ | | */ | |
| #define SSL_MAJOR_VERSION_3 3 | | #define SSL_MAJOR_VERSION_3 3 | |
| #define SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */ | | #define SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */ | |
| #define SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */ | | #define SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */ | |
| #define SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */ | | #define SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */ | |
| #define SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */ | | #define SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */ | |
| | | | |
|
| | | /* Determine minimum supported version */ | |
| | | #define SSL_MIN_MAJOR_VERSION SSL_MAJOR_VERSION_3 | |
| | | | |
| | | #if defined(POLARSSL_SSL_PROTO_SSL3) | |
| | | #define SSL_MIN_MINOR_VERSION SSL_MINOR_VERSION_0 | |
| | | #else | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1) | |
| | | #define SSL_MIN_MINOR_VERSION SSL_MINOR_VERSION_1 | |
| | | #else | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1_1) | |
| | | #define SSL_MIN_MINOR_VERSION SSL_MINOR_VERSION_2 | |
| | | #else | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1_2) | |
| | | #define SSL_MIN_MINOR_VERSION SSL_MINOR_VERSION_3 | |
| | | #endif | |
| | | #endif | |
| | | #endif | |
| | | #endif | |
| | | | |
| | | /* Determine maximum supported version */ | |
| | | #define SSL_MAX_MAJOR_VERSION SSL_MAJOR_VERSION_3 | |
| | | | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1_2) | |
| | | #define SSL_MAX_MINOR_VERSION SSL_MINOR_VERSION_3 | |
| | | #else | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1_1) | |
| | | #define SSL_MAX_MINOR_VERSION SSL_MINOR_VERSION_2 | |
| | | #else | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1) | |
| | | #define SSL_MAX_MINOR_VERSION SSL_MINOR_VERSION_1 | |
| | | #else | |
| | | #if defined(POLARSSL_SSL_PROTO_SSL3) | |
| | | #define SSL_MAX_MINOR_VERSION SSL_MINOR_VERSION_0 | |
| | | #endif | |
| | | #endif | |
| | | #endif | |
| | | #endif | |
| | | | |
| | | /* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c | |
| | | * NONE must be zero so that memset()ing structure to zero works */ | |
| | | #define SSL_MAX_FRAG_LEN_NONE 0 /*!< don't use this extension | |
| | | */ | |
| | | #define SSL_MAX_FRAG_LEN_512 1 /*!< MaxFragmentLength 2^9 | |
| | | */ | |
| | | #define SSL_MAX_FRAG_LEN_1024 2 /*!< MaxFragmentLength 2^10 | |
| | | */ | |
| | | #define SSL_MAX_FRAG_LEN_2048 3 /*!< MaxFragmentLength 2^11 | |
| | | */ | |
| | | #define SSL_MAX_FRAG_LEN_4096 4 /*!< MaxFragmentLength 2^12 | |
| | | */ | |
| | | #define SSL_MAX_FRAG_LEN_INVALID 5 /*!< first invalid value | |
| | | */ | |
| | | | |
| #define SSL_IS_CLIENT 0 | | #define SSL_IS_CLIENT 0 | |
| #define SSL_IS_SERVER 1 | | #define SSL_IS_SERVER 1 | |
| #define SSL_COMPRESS_NULL 0 | | #define SSL_COMPRESS_NULL 0 | |
| #define SSL_COMPRESS_DEFLATE 1 | | #define SSL_COMPRESS_DEFLATE 1 | |
| | | | |
| #define SSL_VERIFY_NONE 0 | | #define SSL_VERIFY_NONE 0 | |
| #define SSL_VERIFY_OPTIONAL 1 | | #define SSL_VERIFY_OPTIONAL 1 | |
| #define SSL_VERIFY_REQUIRED 2 | | #define SSL_VERIFY_REQUIRED 2 | |
| | | | |
| #define SSL_INITIAL_HANDSHAKE 0 | | #define SSL_INITIAL_HANDSHAKE 0 | |
| | | | |
| skipping to change at line 126 | | skipping to change at line 206 | |
|---|
| #define SSL_LEGACY_RENEGOTIATION 0 | | #define SSL_LEGACY_RENEGOTIATION 0 | |
| #define SSL_SECURE_RENEGOTIATION 1 | | #define SSL_SECURE_RENEGOTIATION 1 | |
| | | | |
| #define SSL_RENEGOTIATION_DISABLED 0 | | #define SSL_RENEGOTIATION_DISABLED 0 | |
| #define SSL_RENEGOTIATION_ENABLED 1 | | #define SSL_RENEGOTIATION_ENABLED 1 | |
| | | | |
| #define SSL_LEGACY_NO_RENEGOTIATION 0 | | #define SSL_LEGACY_NO_RENEGOTIATION 0 | |
| #define SSL_LEGACY_ALLOW_RENEGOTIATION 1 | | #define SSL_LEGACY_ALLOW_RENEGOTIATION 1 | |
| #define SSL_LEGACY_BREAK_HANDSHAKE 2 | | #define SSL_LEGACY_BREAK_HANDSHAKE 2 | |
| | | | |
|
| | | #define SSL_TRUNC_HMAC_DISABLED 0 | |
| | | #define SSL_TRUNC_HMAC_ENABLED 1 | |
| | | #define SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 | |
| | | */ | |
| | | | |
| | | #define SSL_SESSION_TICKETS_DISABLED 0 | |
| | | #define SSL_SESSION_TICKETS_ENABLED 1 | |
| | | | |
| | | #if !defined(POLARSSL_CONFIG_OPTIONS) | |
| | | #define SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tick | |
| | | ets (if enabled) */ | |
| | | #endif /* !POLARSSL_CONFIG_OPTIONS */ | |
| | | | |
| /* | | /* | |
| * Size of the input / output buffer. | | * Size of the input / output buffer. | |
| * Note: the RFC defines the default size of SSL / TLS messages. If you | | * Note: the RFC defines the default size of SSL / TLS messages. If you | |
| * change the value here, other clients / servers may not be able to | | * change the value here, other clients / servers may not be able to | |
| * communicate with you anymore. Only change this value if you control | | * communicate with you anymore. Only change this value if you control | |
| * both sides of the connection and have it reduced at both sides! | | * both sides of the connection and have it reduced at both sides! | |
| */ | | */ | |
| #if !defined(POLARSSL_CONFIG_OPTIONS) | | #if !defined(POLARSSL_CONFIG_OPTIONS) | |
| #define SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output
buffer */ | | #define SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output
buffer */ | |
| #endif /* !POLARSSL_CONFIG_OPTIONS */ | | #endif /* !POLARSSL_CONFIG_OPTIONS */ | |
| | | | |
| skipping to change at line 151 | | skipping to change at line 242 | |
|---|
| * enabled. | | * enabled. | |
| */ | | */ | |
| #if defined(POLARSSL_ZLIB_SUPPORT) | | #if defined(POLARSSL_ZLIB_SUPPORT) | |
| #define SSL_COMPRESSION_ADD 1024 | | #define SSL_COMPRESSION_ADD 1024 | |
| #else | | #else | |
| #define SSL_COMPRESSION_ADD 0 | | #define SSL_COMPRESSION_ADD 0 | |
| #endif | | #endif | |
| | | | |
| #define SSL_BUFFER_LEN (SSL_MAX_CONTENT_LEN + SSL_COMPRESSION_ADD + 512) | | #define SSL_BUFFER_LEN (SSL_MAX_CONTENT_LEN + SSL_COMPRESSION_ADD + 512) | |
| | | | |
|
| /* | | | |
| * Supported ciphersuites (Official IANA names) | | | |
| */ | | | |
| #define TLS_RSA_WITH_NULL_MD5 0x01 /**< Weak! */ | | | |
| #define TLS_RSA_WITH_NULL_SHA 0x02 /**< Weak! */ | | | |
| #define TLS_RSA_WITH_NULL_SHA256 0x3B /**< Weak! */ | | | |
| #define TLS_RSA_WITH_DES_CBC_SHA 0x09 /**< Weak! Not in T | | | |
| LS 1.2 */ | | | |
| #define TLS_DHE_RSA_WITH_DES_CBC_SHA 0x15 /**< Weak! Not in T | | | |
| LS 1.2 */ | | | |
| | | | |
| #define TLS_RSA_WITH_RC4_128_MD5 0x04 | | | |
| #define TLS_RSA_WITH_RC4_128_SHA 0x05 | | | |
| | | | |
| #define TLS_RSA_WITH_3DES_EDE_CBC_SHA 0x0A | | | |
| #define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x16 | | | |
| | | | |
| #define TLS_RSA_WITH_AES_128_CBC_SHA 0x2F | | | |
| #define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x33 | | | |
| #define TLS_RSA_WITH_AES_256_CBC_SHA 0x35 | | | |
| #define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x39 | | | |
| #define TLS_RSA_WITH_AES_128_CBC_SHA256 0x3C /**< TLS 1.2 */ | | | |
| #define TLS_RSA_WITH_AES_256_CBC_SHA256 0x3D /**< TLS 1.2 */ | | | |
| #define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x67 /**< TLS 1.2 */ | | | |
| #define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x6B /**< TLS 1.2 */ | | | |
| | | | |
| #define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x41 | | | |
| #define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x45 | | | |
| #define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x84 | | | |
| #define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x88 | | | |
| #define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBA /**< TLS 1.2 */ | | | |
| #define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE /**< TLS 1.2 */ | | | |
| #define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC0 /**< TLS 1.2 */ | | | |
| #define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */ | | | |
| | | | |
| #define TLS_RSA_WITH_AES_128_GCM_SHA256 0x9C | | | |
| #define TLS_RSA_WITH_AES_256_GCM_SHA384 0x9D | | | |
| #define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x9E | | | |
| #define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x9F | | | |
| | | | |
| #define SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext
*/ | | #define SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext
*/ | |
| | | | |
| /* | | /* | |
| * Supported Signature and Hash algorithms (For TLS 1.2) | | * Supported Signature and Hash algorithms (For TLS 1.2) | |
|
| | | * RFC 5246 section 7.4.1.4.1 | |
| */ | | */ | |
| #define SSL_HASH_NONE 0 | | #define SSL_HASH_NONE 0 | |
| #define SSL_HASH_MD5 1 | | #define SSL_HASH_MD5 1 | |
| #define SSL_HASH_SHA1 2 | | #define SSL_HASH_SHA1 2 | |
| #define SSL_HASH_SHA224 3 | | #define SSL_HASH_SHA224 3 | |
| #define SSL_HASH_SHA256 4 | | #define SSL_HASH_SHA256 4 | |
| #define SSL_HASH_SHA384 5 | | #define SSL_HASH_SHA384 5 | |
| #define SSL_HASH_SHA512 6 | | #define SSL_HASH_SHA512 6 | |
| | | | |
|
| | | #define SSL_SIG_ANON 0 | |
| #define SSL_SIG_RSA 1 | | #define SSL_SIG_RSA 1 | |
|
| | | #define SSL_SIG_ECDSA 3 | |
| | | | |
| /* | | /* | |
| * Client Certificate Types | | * Client Certificate Types | |
|
| | | * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5 | |
| */ | | */ | |
| #define SSL_CERT_TYPE_RSA_SIGN 1 | | #define SSL_CERT_TYPE_RSA_SIGN 1 | |
|
| | | #define SSL_CERT_TYPE_ECDSA_SIGN 64 | |
| | | | |
| /* | | /* | |
| * Message, alert and handshake types | | * Message, alert and handshake types | |
| */ | | */ | |
| #define SSL_MSG_CHANGE_CIPHER_SPEC 20 | | #define SSL_MSG_CHANGE_CIPHER_SPEC 20 | |
| #define SSL_MSG_ALERT 21 | | #define SSL_MSG_ALERT 21 | |
| #define SSL_MSG_HANDSHAKE 22 | | #define SSL_MSG_HANDSHAKE 22 | |
| #define SSL_MSG_APPLICATION_DATA 23 | | #define SSL_MSG_APPLICATION_DATA 23 | |
| | | | |
| #define SSL_ALERT_LEVEL_WARNING 1 | | #define SSL_ALERT_LEVEL_WARNING 1 | |
| | | | |
| skipping to change at line 246 | | skipping to change at line 304 | |
|---|
| #define SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */ | | #define SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */ | |
| #define SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */ | | #define SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */ | |
| #define SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */ | | #define SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */ | |
| #define SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */ | | #define SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */ | |
| #define SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */ | | #define SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */ | |
| #define SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */ | | #define SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */ | |
| #define SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */ | | #define SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */ | |
| #define SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */ | | #define SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */ | |
| #define SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */ | | #define SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */ | |
| #define SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */ | | #define SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */ | |
|
| | | #define SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */ | |
| | | | |
| #define SSL_HS_HELLO_REQUEST 0 | | #define SSL_HS_HELLO_REQUEST 0 | |
| #define SSL_HS_CLIENT_HELLO 1 | | #define SSL_HS_CLIENT_HELLO 1 | |
| #define SSL_HS_SERVER_HELLO 2 | | #define SSL_HS_SERVER_HELLO 2 | |
|
| | | #define SSL_HS_NEW_SESSION_TICKET 4 | |
| #define SSL_HS_CERTIFICATE 11 | | #define SSL_HS_CERTIFICATE 11 | |
| #define SSL_HS_SERVER_KEY_EXCHANGE 12 | | #define SSL_HS_SERVER_KEY_EXCHANGE 12 | |
| #define SSL_HS_CERTIFICATE_REQUEST 13 | | #define SSL_HS_CERTIFICATE_REQUEST 13 | |
| #define SSL_HS_SERVER_HELLO_DONE 14 | | #define SSL_HS_SERVER_HELLO_DONE 14 | |
| #define SSL_HS_CERTIFICATE_VERIFY 15 | | #define SSL_HS_CERTIFICATE_VERIFY 15 | |
| #define SSL_HS_CLIENT_KEY_EXCHANGE 16 | | #define SSL_HS_CLIENT_KEY_EXCHANGE 16 | |
| #define SSL_HS_FINISHED 20 | | #define SSL_HS_FINISHED 20 | |
| | | | |
| /* | | /* | |
| * TLS extensions | | * TLS extensions | |
| */ | | */ | |
|
| #define TLS_EXT_SERVERNAME 0 | | #define TLS_EXT_SERVERNAME 0 | |
| #define TLS_EXT_SERVERNAME_HOSTNAME 0 | | #define TLS_EXT_SERVERNAME_HOSTNAME 0 | |
| | | | |
| | | #define TLS_EXT_MAX_FRAGMENT_LENGTH 1 | |
| | | | |
| | | #define TLS_EXT_TRUNCATED_HMAC 4 | |
| | | | |
| | | #define TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10 | |
| | | #define TLS_EXT_SUPPORTED_POINT_FORMATS 11 | |
| | | | |
| | | #define TLS_EXT_SIG_ALG 13 | |
| | | | |
| | | #define TLS_EXT_SESSION_TICKET 35 | |
| | | | |
|
| #define TLS_EXT_SIG_ALG 13 | | #define TLS_EXT_RENEGOTIATION_INFO 0xFF01 | |
| | | | |
|
| #define TLS_EXT_RENEGOTIATION_INFO 0xFF01 | | /* | |
| | | * Size defines | |
| | | */ | |
| | | #if !defined(POLARSSL_MPI_MAX_SIZE) | |
| | | #define POLARSSL_PREMASTER_SIZE 512 | |
| | | #else | |
| | | #define POLARSSL_PREMASTER_SIZE POLARSSL_MPI_MAX_SIZE | |
| | | #endif | |
| | | | |
| | | #ifdef __cplusplus | |
| | | extern "C" { | |
| | | #endif | |
| | | | |
| /* | | /* | |
| * Generic function pointers for allowing external RSA private key | | * Generic function pointers for allowing external RSA private key | |
| * implementations. | | * implementations. | |
| */ | | */ | |
|
| typedef int (*rsa_decrypt_func)( void *ctx, | | typedef int (*rsa_decrypt_func)( void *ctx, int mode, size_t *olen, | |
| int (*f_rng)(void *, unsigned char *, size_t), | | | |
| void *p_rng, int mode, size_t *olen, | | | |
| const unsigned char *input, unsigned char *output, | | const unsigned char *input, unsigned char *output, | |
| size_t output_max_len ); | | size_t output_max_len ); | |
| typedef int (*rsa_sign_func)( void *ctx, | | typedef int (*rsa_sign_func)( void *ctx, | |
| int (*f_rng)(void *, unsigned char *, size_t), void *p
_rng, | | int (*f_rng)(void *, unsigned char *, size_t), void *p
_rng, | |
| int mode, int hash_id, unsigned int hashlen, | | int mode, int hash_id, unsigned int hashlen, | |
| const unsigned char *hash, unsigned char *sig ); | | const unsigned char *hash, unsigned char *sig ); | |
| typedef size_t (*rsa_key_len_func)( void *ctx ); | | typedef size_t (*rsa_key_len_func)( void *ctx ); | |
| | | | |
| /* | | /* | |
| * SSL state machine | | * SSL state machine | |
| | | | |
| skipping to change at line 304 | | skipping to change at line 384 | |
|---|
| SSL_SERVER_HELLO_DONE, | | SSL_SERVER_HELLO_DONE, | |
| SSL_CLIENT_CERTIFICATE, | | SSL_CLIENT_CERTIFICATE, | |
| SSL_CLIENT_KEY_EXCHANGE, | | SSL_CLIENT_KEY_EXCHANGE, | |
| SSL_CERTIFICATE_VERIFY, | | SSL_CERTIFICATE_VERIFY, | |
| SSL_CLIENT_CHANGE_CIPHER_SPEC, | | SSL_CLIENT_CHANGE_CIPHER_SPEC, | |
| SSL_CLIENT_FINISHED, | | SSL_CLIENT_FINISHED, | |
| SSL_SERVER_CHANGE_CIPHER_SPEC, | | SSL_SERVER_CHANGE_CIPHER_SPEC, | |
| SSL_SERVER_FINISHED, | | SSL_SERVER_FINISHED, | |
| SSL_FLUSH_BUFFERS, | | SSL_FLUSH_BUFFERS, | |
| SSL_HANDSHAKE_WRAPUP, | | SSL_HANDSHAKE_WRAPUP, | |
|
| SSL_HANDSHAKE_OVER | | SSL_HANDSHAKE_OVER, | |
| | | SSL_SERVER_NEW_SESSION_TICKET, | |
| } | | } | |
| ssl_states; | | ssl_states; | |
| | | | |
| typedef struct _ssl_session ssl_session; | | typedef struct _ssl_session ssl_session; | |
| typedef struct _ssl_context ssl_context; | | typedef struct _ssl_context ssl_context; | |
| typedef struct _ssl_transform ssl_transform; | | typedef struct _ssl_transform ssl_transform; | |
| typedef struct _ssl_handshake_params ssl_handshake_params; | | typedef struct _ssl_handshake_params ssl_handshake_params; | |
|
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | typedef struct _ssl_ticket_keys ssl_ticket_keys; | |
| | | #endif | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | typedef struct _ssl_key_cert ssl_key_cert; | |
| | | #endif | |
| | | | |
| /* | | /* | |
| * This structure is used for storing current session data. | | * This structure is used for storing current session data. | |
| */ | | */ | |
| struct _ssl_session | | struct _ssl_session | |
| { | | { | |
|
| | | #if defined(POLARSSL_HAVE_TIME) | |
| time_t start; /*!< starting time */ | | time_t start; /*!< starting time */ | |
|
| | | #endif | |
| int ciphersuite; /*!< chosen ciphersuite */ | | int ciphersuite; /*!< chosen ciphersuite */ | |
| int compression; /*!< chosen compression */ | | int compression; /*!< chosen compression */ | |
| size_t length; /*!< session id length */ | | size_t length; /*!< session id length */ | |
| unsigned char id[32]; /*!< session identifier */ | | unsigned char id[32]; /*!< session identifier */ | |
| unsigned char master[48]; /*!< the master secret */ | | unsigned char master[48]; /*!< the master secret */ | |
|
| x509_cert *peer_cert; /*!< peer X.509 cert chain */ | | | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | x509_crt *peer_cert; /*!< peer X.509 cert chain */ | |
| | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| | | int verify_result; /*!< verification result */ | |
| | | | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | unsigned char *ticket; /*!< RFC 5077 session ticket */ | |
| | | size_t ticket_len; /*!< session ticket length */ | |
| | | uint32_t ticket_lifetime; /*!< ticket lifetime hint */ | |
| | | #endif /* POLARSSL_SSL_SESSION_TICKETS */ | |
| | | | |
| | | #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) | |
| | | unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer * | |
| | | / | |
| | | #endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */ | |
| | | | |
| | | #if defined(POLARSSL_SSL_TRUNCATED_HMAC) | |
| | | int trunc_hmac; /*!< flag for truncated hmac activation * | |
| | | / | |
| | | #endif /* POLARSSL_SSL_TRUNCATED_HMAC */ | |
| }; | | }; | |
| | | | |
| /* | | /* | |
| * This structure contains a full set of runtime transform parameters | | * This structure contains a full set of runtime transform parameters | |
| * either in negotiation or active. | | * either in negotiation or active. | |
| */ | | */ | |
| struct _ssl_transform | | struct _ssl_transform | |
| { | | { | |
| /* | | /* | |
| * Session specific crypto layer | | * Session specific crypto layer | |
| */ | | */ | |
|
| | | const ssl_ciphersuite_t *ciphersuite_info; | |
| | | /*!< Chosen cipersuite_info */ | |
| unsigned int keylen; /*!< symmetric key length */ | | unsigned int keylen; /*!< symmetric key length */ | |
| size_t minlen; /*!< min. ciphertext length */ | | size_t minlen; /*!< min. ciphertext length */ | |
| size_t ivlen; /*!< IV length */ | | size_t ivlen; /*!< IV length */ | |
| size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */ | | size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */ | |
| size_t maclen; /*!< MAC length */ | | size_t maclen; /*!< MAC length */ | |
| | | | |
| unsigned char iv_enc[16]; /*!< IV (encryption) */ | | unsigned char iv_enc[16]; /*!< IV (encryption) */ | |
| unsigned char iv_dec[16]; /*!< IV (decryption) */ | | unsigned char iv_dec[16]; /*!< IV (decryption) */ | |
| | | | |
|
| unsigned char mac_enc[32]; /*!< MAC (encryption) */ | | #if defined(POLARSSL_SSL_PROTO_SSL3) | |
| unsigned char mac_dec[32]; /*!< MAC (decryption) */ | | /* Needed only for SSL v3.0 secret */ | |
| | | unsigned char mac_enc[32]; /*!< SSL v3.0 secret (enc) */ | |
| | | unsigned char mac_dec[32]; /*!< SSL v3.0 secret (dec) */ | |
| | | #endif /* POLARSSL_SSL_PROTO_SSL3 */ | |
| | | | |
|
| uint32_t ctx_enc[136]; /*!< encryption context */ | | md_context_t md_ctx_enc; /*!< MAC (encryption) */ | |
| uint32_t ctx_dec[136]; /*!< decryption context */ | | md_context_t md_ctx_dec; /*!< MAC (decryption) */ | |
| | | | |
| | | cipher_context_t cipher_ctx_enc; /*!< encryption context */ | |
| | | cipher_context_t cipher_ctx_dec; /*!< decryption context */ | |
| | | | |
| /* | | /* | |
| * Session specific compression layer | | * Session specific compression layer | |
| */ | | */ | |
| #if defined(POLARSSL_ZLIB_SUPPORT) | | #if defined(POLARSSL_ZLIB_SUPPORT) | |
| z_stream ctx_deflate; /*!< compression context */ | | z_stream ctx_deflate; /*!< compression context */ | |
| z_stream ctx_inflate; /*!< decompression context */ | | z_stream ctx_inflate; /*!< decompression context */ | |
| #endif | | #endif | |
| }; | | }; | |
| | | | |
| | | | |
| skipping to change at line 374 | | skipping to change at line 489 | |
|---|
| { | | { | |
| /* | | /* | |
| * Handshake specific crypto variables | | * Handshake specific crypto variables | |
| */ | | */ | |
| int sig_alg; /*!< Signature algorithm */ | | int sig_alg; /*!< Signature algorithm */ | |
| int cert_type; /*!< Requested cert type */ | | int cert_type; /*!< Requested cert type */ | |
| int verify_sig_alg; /*!< Signature algorithm for verif
y */ | | int verify_sig_alg; /*!< Signature algorithm for verif
y */ | |
| #if defined(POLARSSL_DHM_C) | | #if defined(POLARSSL_DHM_C) | |
| dhm_context dhm_ctx; /*!< DHM key exchange */ | | dhm_context dhm_ctx; /*!< DHM key exchange */ | |
| #endif | | #endif | |
|
| | | #if defined(POLARSSL_ECDH_C) | |
| | | ecdh_context ecdh_ctx; /*!< ECDH key exchange */ | |
| | | #endif | |
| | | #if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C) | |
| | | const ecp_curve_info **curves; /*!< Supported elliptic curves */ | |
| | | #endif | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | /** | |
| | | * Current key/cert or key/cert list. | |
| | | * On client: pointer to ssl->key_cert, only the first entry used. | |
| | | * On server: starts as a pointer to ssl->key_cert, then becomes | |
| | | * a pointer to the chosen key from this list or the SNI list. | |
| | | */ | |
| | | ssl_key_cert *key_cert; | |
| | | #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) | |
| | | ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI */ | |
| | | #endif | |
| | | #endif | |
| | | | |
| /* | | /* | |
| * Checksum contexts | | * Checksum contexts | |
| */ | | */ | |
|
| md5_context fin_md5; | | #if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || | |
| sha1_context fin_sha1; | | \ | |
| sha2_context fin_sha2; | | defined(POLARSSL_SSL_PROTO_TLS1_1) | |
| sha4_context fin_sha4; | | md5_context fin_md5; | |
| | | sha1_context fin_sha1; | |
| | | #endif | |
| | | #if defined(POLARSSL_SSL_PROTO_TLS1_2) | |
| | | #if defined(POLARSSL_SHA256_C) | |
| | | sha256_context fin_sha256; | |
| | | #endif | |
| | | #if defined(POLARSSL_SHA512_C) | |
| | | sha512_context fin_sha512; | |
| | | #endif | |
| | | #endif /* POLARSSL_SSL_PROTO_TLS1_2 */ | |
| | | | |
|
| void (*update_checksum)(ssl_context *, unsigned char *, size_t); | | void (*update_checksum)(ssl_context *, const unsigned char *, size_t); | |
| void (*calc_verify)(ssl_context *, unsigned char *); | | void (*calc_verify)(ssl_context *, unsigned char *); | |
| void (*calc_finished)(ssl_context *, unsigned char *, int); | | void (*calc_finished)(ssl_context *, unsigned char *, int); | |
|
| int (*tls_prf)(unsigned char *, size_t, char *, | | int (*tls_prf)(const unsigned char *, size_t, const char *, | |
| unsigned char *, size_t, | | const unsigned char *, size_t, | |
| unsigned char *, size_t); | | unsigned char *, size_t); | |
| | | | |
| size_t pmslen; /*!< premaster length */ | | size_t pmslen; /*!< premaster length */ | |
| | | | |
| unsigned char randbytes[64]; /*!< random bytes */ | | unsigned char randbytes[64]; /*!< random bytes */ | |
|
| unsigned char premaster[POLARSSL_MPI_MAX_SIZE]; | | unsigned char premaster[POLARSSL_PREMASTER_SIZE]; | |
| /*!< premaster secret */ | | /*!< premaster secret */ | |
| | | | |
| int resume; /*!< session resume indicator*/ | | int resume; /*!< session resume indicator*/ | |
|
| | | int max_major_ver; /*!< max. major version client*/ | |
| | | int max_minor_ver; /*!< max. minor version client*/ | |
| | | | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | int new_session_ticket; /*!< use NewSessionTicket? */ | |
| | | #endif /* POLARSSL_SSL_SESSION_TICKETS */ | |
| | | }; | |
| | | | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | /* | |
| | | * Parameters needed to secure session tickets | |
| | | */ | |
| | | struct _ssl_ticket_keys | |
| | | { | |
| | | unsigned char key_name[16]; /*!< name to quickly discard bad ticket | |
| | | s */ | |
| | | aes_context enc; /*!< encryption context | |
| | | */ | |
| | | aes_context dec; /*!< decryption context | |
| | | */ | |
| | | unsigned char mac_key[16]; /*!< authentication key | |
| | | */ | |
| }; | | }; | |
|
| | | #endif /* POLARSSL_SSL_SESSION_TICKETS */ | |
| | | | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | /* | |
| | | * List of certificate + private key pairs | |
| | | */ | |
| | | struct _ssl_key_cert | |
| | | { | |
| | | x509_crt *cert; /*!< cert */ | |
| | | pk_context *key; /*!< private key */ | |
| | | int key_own_alloc; /*!< did we allocate key? */ | |
| | | ssl_key_cert *next; /*!< next key/cert pair */ | |
| | | }; | |
| | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| | | | |
| struct _ssl_context | | struct _ssl_context | |
| { | | { | |
| /* | | /* | |
| * Miscellaneous | | * Miscellaneous | |
| */ | | */ | |
| int state; /*!< SSL handshake: current state */ | | int state; /*!< SSL handshake: current state */ | |
| int renegotiation; /*!< Initial or renegotiation */ | | int renegotiation; /*!< Initial or renegotiation */ | |
| | | | |
| int major_ver; /*!< equal to SSL_MAJOR_VERSION_3 */ | | int major_ver; /*!< equal to SSL_MAJOR_VERSION_3 */ | |
| int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */ | | int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */ | |
| | | | |
|
| int max_major_ver; /*!< max. major version from client */ | | int max_major_ver; /*!< max. major version used */ | |
| int max_minor_ver; /*!< max. minor version from client */ | | int max_minor_ver; /*!< max. minor version used */ | |
| int min_major_ver; /*!< min. major version accepted */ | | int min_major_ver; /*!< min. major version used */ | |
| int min_minor_ver; /*!< min. minor version accepted */ | | int min_minor_ver; /*!< min. minor version used */ | |
| | | | |
| /* | | /* | |
| * Callbacks (RNG, debug, I/O, verification) | | * Callbacks (RNG, debug, I/O, verification) | |
| */ | | */ | |
| int (*f_rng)(void *, unsigned char *, size_t); | | int (*f_rng)(void *, unsigned char *, size_t); | |
| void (*f_dbg)(void *, int, const char *); | | void (*f_dbg)(void *, int, const char *); | |
| int (*f_recv)(void *, unsigned char *, size_t); | | int (*f_recv)(void *, unsigned char *, size_t); | |
| int (*f_send)(void *, const unsigned char *, size_t); | | int (*f_send)(void *, const unsigned char *, size_t); | |
|
| int (*f_vrfy)(void *, x509_cert *, int, int *); | | | |
| int (*f_get_cache)(void *, ssl_session *); | | int (*f_get_cache)(void *, ssl_session *); | |
| int (*f_set_cache)(void *, const ssl_session *); | | int (*f_set_cache)(void *, const ssl_session *); | |
|
| int (*f_sni)(void *, ssl_context *, const unsigned char *, size_t); | | | |
| | | | |
| void *p_rng; /*!< context for the RNG function */ | | void *p_rng; /*!< context for the RNG function */ | |
| void *p_dbg; /*!< context for the debug function */ | | void *p_dbg; /*!< context for the debug function */ | |
| void *p_recv; /*!< context for reading operations */ | | void *p_recv; /*!< context for reading operations */ | |
| void *p_send; /*!< context for writing operations */ | | void *p_send; /*!< context for writing operations */ | |
|
| void *p_vrfy; /*!< context for verification */ | | | |
| void *p_get_cache; /*!< context for cache retrieval */ | | void *p_get_cache; /*!< context for cache retrieval */ | |
| void *p_set_cache; /*!< context for cache store */ | | void *p_set_cache; /*!< context for cache store */ | |
|
| void *p_sni; /*!< context for SNI extension */ | | | |
| void *p_hw_data; /*!< context for HW acceleration */ | | void *p_hw_data; /*!< context for HW acceleration */ | |
| | | | |
|
| | | #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) | |
| | | int (*f_sni)(void *, ssl_context *, const unsigned char *, size_t); | |
| | | void *p_sni; /*!< context for SNI extension */ | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | int (*f_vrfy)(void *, x509_crt *, int, int *); | |
| | | void *p_vrfy; /*!< context for verification */ | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) | |
| | | int (*f_psk)(void *, ssl_context *, const unsigned char *, size_t); | |
| | | void *p_psk; /*!< context for PSK retrieval */ | |
| | | #endif | |
| | | | |
| /* | | /* | |
| * Session layer | | * Session layer | |
| */ | | */ | |
| ssl_session *session_in; /*!< current session data (in) *
/ | | ssl_session *session_in; /*!< current session data (in) *
/ | |
| ssl_session *session_out; /*!< current session data (out) *
/ | | ssl_session *session_out; /*!< current session data (out) *
/ | |
| ssl_session *session; /*!< negotiated session data *
/ | | ssl_session *session; /*!< negotiated session data *
/ | |
| ssl_session *session_negotiate; /*!< session data in negotiation *
/ | | ssl_session *session_negotiate; /*!< session data in negotiation *
/ | |
| | | | |
| ssl_handshake_params *handshake; /*!< params required only during | | ssl_handshake_params *handshake; /*!< params required only during | |
| the handshake process
*/ | | the handshake process
*/ | |
| | | | |
| skipping to change at line 461 | | skipping to change at line 646 | |
|---|
| ssl_transform *transform_in; /*!< current transform params (in)
*/ | | ssl_transform *transform_in; /*!< current transform params (in)
*/ | |
| ssl_transform *transform_out; /*!< current transform params (in)
*/ | | ssl_transform *transform_out; /*!< current transform params (in)
*/ | |
| ssl_transform *transform; /*!< negotiated transform params
*/ | | ssl_transform *transform; /*!< negotiated transform params
*/ | |
| ssl_transform *transform_negotiate; /*!< transform params in negotiati
on */ | | ssl_transform *transform_negotiate; /*!< transform params in negotiati
on */ | |
| | | | |
| /* | | /* | |
| * Record layer (incoming data) | | * Record layer (incoming data) | |
| */ | | */ | |
| unsigned char *in_ctr; /*!< 64-bit incoming message counter */ | | unsigned char *in_ctr; /*!< 64-bit incoming message counter */ | |
| unsigned char *in_hdr; /*!< 5-byte record header (in_ctr+8) */ | | unsigned char *in_hdr; /*!< 5-byte record header (in_ctr+8) */ | |
|
| unsigned char *in_msg; /*!< the message contents (in_hdr+5) */ | | unsigned char *in_iv; /*!< ivlen-byte IV (in_hdr+5) */ | |
| | | unsigned char *in_msg; /*!< message contents (in_iv+ivlen) */ | |
| unsigned char *in_offt; /*!< read offset in application data */ | | unsigned char *in_offt; /*!< read offset in application data */ | |
| | | | |
| int in_msgtype; /*!< record header: message type */ | | int in_msgtype; /*!< record header: message type */ | |
| size_t in_msglen; /*!< record header: message length */ | | size_t in_msglen; /*!< record header: message length */ | |
| size_t in_left; /*!< amount of data read so far */ | | size_t in_left; /*!< amount of data read so far */ | |
| | | | |
| size_t in_hslen; /*!< current handshake message length */ | | size_t in_hslen; /*!< current handshake message length */ | |
| int nb_zero; /*!< # of 0-length encrypted messages */ | | int nb_zero; /*!< # of 0-length encrypted messages */ | |
|
| | | int record_read; /*!< record is already present */ | |
| | | | |
| /* | | /* | |
| * Record layer (outgoing data) | | * Record layer (outgoing data) | |
| */ | | */ | |
| unsigned char *out_ctr; /*!< 64-bit outgoing message counter */ | | unsigned char *out_ctr; /*!< 64-bit outgoing message counter */ | |
| unsigned char *out_hdr; /*!< 5-byte record header (out_ctr+8) */ | | unsigned char *out_hdr; /*!< 5-byte record header (out_ctr+8) */ | |
|
| unsigned char *out_msg; /*!< the message contents (out_hdr+32)*/ | | unsigned char *out_iv; /*!< ivlen-byte IV (out_hdr+5) */ | |
| | | unsigned char *out_msg; /*!< message contents (out_iv+ivlen) */ | |
| | | | |
| int out_msgtype; /*!< record header: message type */ | | int out_msgtype; /*!< record header: message type */ | |
| size_t out_msglen; /*!< record header: message length */ | | size_t out_msglen; /*!< record header: message length */ | |
| size_t out_left; /*!< amount of data not yet written */ | | size_t out_left; /*!< amount of data not yet written */ | |
| | | | |
|
| | | #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) | |
| | | unsigned char mfl_code; /*!< MaxFragmentLength chosen by us */ | |
| | | #endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */ | |
| | | | |
| /* | | /* | |
| * PKI layer | | * PKI layer | |
| */ | | */ | |
|
| void *rsa_key; /*!< own RSA private key */ | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| rsa_decrypt_func rsa_decrypt; /*!< function for RSA decrypt*/ | | ssl_key_cert *key_cert; /*!< own certificate(s)/key(s) */ | |
| rsa_sign_func rsa_sign; /*!< function for RSA sign */ | | | |
| rsa_key_len_func rsa_key_len; /*!< function for RSA key len*/ | | x509_crt *ca_chain; /*!< own trusted CA chain */ | |
| | | x509_crl *ca_crl; /*!< trusted CA CRLs */ | |
| x509_cert *own_cert; /*!< own X.509 certificate */ | | const char *peer_cn; /*!< expected peer CN */ | |
| x509_cert *ca_chain; /*!< own trusted CA chain */ | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| x509_crl *ca_crl; /*!< trusted CA CRLs */ | | | |
| const char *peer_cn; /*!< expected peer CN */ | | /* | |
| | | * Support for generating and checking session tickets | |
| | | */ | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | ssl_ticket_keys *ticket_keys; /*!< keys for ticket encryption */ | |
| | | #endif /* POLARSSL_SSL_SESSION_TICKETS */ | |
| | | | |
| /* | | /* | |
| * User settings | | * User settings | |
| */ | | */ | |
| int endpoint; /*!< 0: client, 1: server */ | | int endpoint; /*!< 0: client, 1: server */ | |
| int authmode; /*!< verification mode */ | | int authmode; /*!< verification mode */ | |
| int client_auth; /*!< flag for client auth. */ | | int client_auth; /*!< flag for client auth. */ | |
| int verify_result; /*!< verification result */ | | int verify_result; /*!< verification result */ | |
| int disable_renegotiation; /*!< enable/disable renegotiation
*/ | | int disable_renegotiation; /*!< enable/disable renegotiation
*/ | |
| int allow_legacy_renegotiation; /*!< allow legacy renegotiation
*/ | | int allow_legacy_renegotiation; /*!< allow legacy renegotiation
*/ | |
|
| const int **ciphersuites; /*!< allowed ciphersuites / versio | | const int *ciphersuite_list[4]; /*!< allowed ciphersuites / versio | |
| n */ | | n */ | |
| | | #if defined(POLARSSL_SSL_TRUNCATED_HMAC) | |
| | | int trunc_hmac; /*!< negotiate truncated hmac? | |
| | | */ | |
| | | #endif | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | int session_tickets; /*!< use session tickets? */ | |
| | | int ticket_lifetime; /*!< session ticket lifetime */ | |
| | | #endif | |
| | | | |
| #if defined(POLARSSL_DHM_C) | | #if defined(POLARSSL_DHM_C) | |
| mpi dhm_P; /*!< prime modulus for DHM */ | | mpi dhm_P; /*!< prime modulus for DHM */ | |
| mpi dhm_G; /*!< generator for DHM */ | | mpi dhm_G; /*!< generator for DHM */ | |
| #endif | | #endif | |
| | | | |
|
| | | #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) | |
| | | /* | |
| | | * PSK values | |
| | | */ | |
| | | unsigned char *psk; | |
| | | size_t psk_len; | |
| | | unsigned char *psk_identity; | |
| | | size_t psk_identity_len; | |
| | | #endif | |
| | | | |
| | | #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) | |
| /* | | /* | |
|
| * TLS extensions | | * SNI extension | |
| */ | | */ | |
| unsigned char *hostname; | | unsigned char *hostname; | |
| size_t hostname_len; | | size_t hostname_len; | |
|
| | | #endif | |
| | | | |
| /* | | /* | |
| * Secure renegotiation | | * Secure renegotiation | |
| */ | | */ | |
| int secure_renegotiation; /*!< does peer support legacy or | | int secure_renegotiation; /*!< does peer support legacy or | |
| secure renegotiation
*/ | | secure renegotiation
*/ | |
| size_t verify_data_len; /*!< length of verify data stored
*/ | | size_t verify_data_len; /*!< length of verify data stored
*/ | |
| char own_verify_data[36]; /*!< previous handshake verify dat
a */ | | char own_verify_data[36]; /*!< previous handshake verify dat
a */ | |
| char peer_verify_data[36]; /*!< previous handshake verify dat
a */ | | char peer_verify_data[36]; /*!< previous handshake verify dat
a */ | |
| }; | | }; | |
| | | | |
|
| #ifdef __cplusplus | | #if defined(POLARSSL_SSL_HW_RECORD_ACCEL) | |
| extern "C" { | | | |
| #endif | | | |
| | | | |
|
| extern const int ssl_default_ciphersuites[]; | | #define SSL_CHANNEL_OUTBOUND 0 | |
| | | #define SSL_CHANNEL_INBOUND 1 | |
| | | | |
|
| #if defined(POLARSSL_SSL_HW_RECORD_ACCEL) | | | |
| extern int (*ssl_hw_record_init)(ssl_context *ssl, | | extern int (*ssl_hw_record_init)(ssl_context *ssl, | |
| const unsigned char *key_enc, const unsigned char *key_dec, | | const unsigned char *key_enc, const unsigned char *key_dec, | |
|
| | | size_t keylen, | |
| const unsigned char *iv_enc, const unsigned char *iv_dec, | | const unsigned char *iv_enc, const unsigned char *iv_dec, | |
|
| const unsigned char *mac_enc, const unsigned char *mac_dec) | | size_t ivlen, | |
| ; | | const unsigned char *mac_enc, const unsigned char *mac_dec, | |
| | | size_t maclen); | |
| | | extern int (*ssl_hw_record_activate)(ssl_context *ssl, int direction); | |
| extern int (*ssl_hw_record_reset)(ssl_context *ssl); | | extern int (*ssl_hw_record_reset)(ssl_context *ssl); | |
| extern int (*ssl_hw_record_write)(ssl_context *ssl); | | extern int (*ssl_hw_record_write)(ssl_context *ssl); | |
| extern int (*ssl_hw_record_read)(ssl_context *ssl); | | extern int (*ssl_hw_record_read)(ssl_context *ssl); | |
| extern int (*ssl_hw_record_finish)(ssl_context *ssl); | | extern int (*ssl_hw_record_finish)(ssl_context *ssl); | |
| #endif | | #endif | |
| | | | |
| /** | | /** | |
| * \brief Returns the list of ciphersuites supported by the SSL/TLS module. | | * \brief Returns the list of ciphersuites supported by the SSL/TLS module. | |
| * | | * | |
| * \return a statically allocated array of ciphersuites, the l
ast | | * \return a statically allocated array of ciphersuites, the l
ast | |
| * entry is 0. | | * entry is 0. | |
| */ | | */ | |
|
| static inline const int *ssl_list_ciphersuites( void ) | | const int *ssl_list_ciphersuites( void ); | |
| { | | | |
| return ssl_default_ciphersuites; | | | |
| } | | | |
| | | | |
| /** | | /** | |
| * \brief Return the name of the ciphersuite associated with
the given | | * \brief Return the name of the ciphersuite associated with
the given | |
| * ID | | * ID | |
| * | | * | |
| * \param ciphersuite_id SSL ciphersuite ID | | * \param ciphersuite_id SSL ciphersuite ID | |
| * | | * | |
| * \return a string containing the ciphersuite name | | * \return a string containing the ciphersuite name | |
| */ | | */ | |
| const char *ssl_get_ciphersuite_name( const int ciphersuite_id ); | | const char *ssl_get_ciphersuite_name( const int ciphersuite_id ); | |
| | | | |
| skipping to change at line 577 | | skipping to change at line 792 | |
|---|
| * name | | * name | |
| * | | * | |
| * \param ciphersuite_name SSL ciphersuite name | | * \param ciphersuite_name SSL ciphersuite name | |
| * | | * | |
| * \return the ID with the ciphersuite or 0 if not found | | * \return the ID with the ciphersuite or 0 if not found | |
| */ | | */ | |
| int ssl_get_ciphersuite_id( const char *ciphersuite_name ); | | int ssl_get_ciphersuite_id( const char *ciphersuite_name ); | |
| | | | |
| /** | | /** | |
| * \brief Initialize an SSL context | | * \brief Initialize an SSL context | |
|
| | | * (An individual SSL context is not thread-safe) | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * | | * | |
| * \return 0 if successful, or POLARSSL_ERR_SSL_MALLOC_FAILED if | | * \return 0 if successful, or POLARSSL_ERR_SSL_MALLOC_FAILED if | |
| * memory allocation failed | | * memory allocation failed | |
| */ | | */ | |
| int ssl_init( ssl_context *ssl ); | | int ssl_init( ssl_context *ssl ); | |
| | | | |
| /** | | /** | |
| * \brief Reset an already initialized SSL context for re-use | | * \brief Reset an already initialized SSL context for re-use | |
| | | | |
| skipping to change at line 602 | | skipping to change at line 818 | |
|---|
| POLARSSL_ERR_SSL_HW_ACCEL_FAILED or | | POLARSSL_ERR_SSL_HW_ACCEL_FAILED or | |
| * POLARSSL_ERR_SSL_COMPRESSION_FAILED | | * POLARSSL_ERR_SSL_COMPRESSION_FAILED | |
| */ | | */ | |
| int ssl_session_reset( ssl_context *ssl ); | | int ssl_session_reset( ssl_context *ssl ); | |
| | | | |
| /** | | /** | |
| * \brief Set the current endpoint type | | * \brief Set the current endpoint type | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param endpoint must be SSL_IS_CLIENT or SSL_IS_SERVER | | * \param endpoint must be SSL_IS_CLIENT or SSL_IS_SERVER | |
|
| | | * | |
| | | * \note This function should be called right after ssl_init() si | |
| | | nce | |
| | | * some other ssl_set_foo() functions depend on it. | |
| */ | | */ | |
| void ssl_set_endpoint( ssl_context *ssl, int endpoint ); | | void ssl_set_endpoint( ssl_context *ssl, int endpoint ); | |
| | | | |
| /** | | /** | |
| * \brief Set the certificate verification mode | | * \brief Set the certificate verification mode | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param authmode can be: | | * \param authmode can be: | |
| * | | * | |
| * SSL_VERIFY_NONE: peer certificate is not checked (default), | | * SSL_VERIFY_NONE: peer certificate is not checked (default), | |
| | | | |
| skipping to change at line 624 | | skipping to change at line 843 | |
|---|
| * SSL_VERIFY_OPTIONAL: peer certificate is checked, however the | | * SSL_VERIFY_OPTIONAL: peer certificate is checked, however the | |
| * handshake continues even if verification failed; | | * handshake continues even if verification failed; | |
| * ssl_get_verify_result() can be called after the | | * ssl_get_verify_result() can be called after the | |
| * handshake is complete. | | * handshake is complete. | |
| * | | * | |
| * SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, | | * SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, | |
| * handshake is aborted if verification failed. | | * handshake is aborted if verification failed. | |
| */ | | */ | |
| void ssl_set_authmode( ssl_context *ssl, int authmode ); | | void ssl_set_authmode( ssl_context *ssl, int authmode ); | |
| | | | |
|
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| /** | | /** | |
| * \brief Set the verification callback (Optional). | | * \brief Set the verification callback (Optional). | |
| * | | * | |
| * If set, the verify callback is called for each | | * If set, the verify callback is called for each | |
| * certificate in the chain. For implementation | | * certificate in the chain. For implementation | |
| * information, please see \c x509parse_verify() | | * information, please see \c x509parse_verify() | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param f_vrfy verification function | | * \param f_vrfy verification function | |
| * \param p_vrfy verification parameter | | * \param p_vrfy verification parameter | |
| */ | | */ | |
| void ssl_set_verify( ssl_context *ssl, | | void ssl_set_verify( ssl_context *ssl, | |
|
| int (*f_vrfy)(void *, x509_cert *, int, int *), | | int (*f_vrfy)(void *, x509_crt *, int, int *), | |
| void *p_vrfy ); | | void *p_vrfy ); | |
|
| | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| | | | |
| /** | | /** | |
| * \brief Set the random number generator callback | | * \brief Set the random number generator callback | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param f_rng RNG function | | * \param f_rng RNG function | |
| * \param p_rng RNG parameter | | * \param p_rng RNG parameter | |
| */ | | */ | |
| void ssl_set_rng( ssl_context *ssl, | | void ssl_set_rng( ssl_context *ssl, | |
| int (*f_rng)(void *, unsigned char *, size_t), | | int (*f_rng)(void *, unsigned char *, size_t), | |
| | | | |
| skipping to change at line 719 | | skipping to change at line 940 | |
|---|
| * \param p_set_cache session set parameter | | * \param p_set_cache session set parameter | |
| */ | | */ | |
| void ssl_set_session_cache( ssl_context *ssl, | | void ssl_set_session_cache( ssl_context *ssl, | |
| int (*f_get_cache)(void *, ssl_session *), void *p_get_cache, | | int (*f_get_cache)(void *, ssl_session *), void *p_get_cache, | |
| int (*f_set_cache)(void *, const ssl_session *), void *p_set_cache
); | | int (*f_set_cache)(void *, const ssl_session *), void *p_set_cache
); | |
| | | | |
| /** | | /** | |
| * \brief Request resumption of session (client-side only) | | * \brief Request resumption of session (client-side only) | |
| * Session data is copied from presented session structure. | | * Session data is copied from presented session structure. | |
| * | | * | |
|
| * Warning: session.peer_cert is cleared by the SSL/TLS lay | | | |
| er on | | | |
| * connection shutdown, so do not cache the pointer! Either | | | |
| set | | | |
| * it to NULL or make a full copy of the certificate when | | | |
| * storing the session for use in this function. | | | |
| * | | | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param session session context | | * \param session session context | |
|
| | | * | |
| | | * \return 0 if successful, | |
| | | * POLARSSL_ERR_SSL_MALLOC_FAILED if memory allocation fail | |
| | | ed, | |
| | | * POLARSSL_ERR_SSL_BAD_INPUT_DATA if used server-side or | |
| | | * arguments are otherwise invalid | |
| | | * | |
| | | * \sa ssl_get_session() | |
| */ | | */ | |
|
| void ssl_set_session( ssl_context *ssl, const ssl_session *session ); | | int ssl_set_session( ssl_context *ssl, const ssl_session *session ); | |
| | | | |
| /** | | /** | |
| * \brief Set the list of allowed ciphersuites | | * \brief Set the list of allowed ciphersuites | |
|
| * (Default: ssl_default_ciphersuites) | | | |
| * (Overrides all version specific lists) | | * (Overrides all version specific lists) | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param ciphersuites 0-terminated list of allowed ciphersuites | | * \param ciphersuites 0-terminated list of allowed ciphersuites | |
| */ | | */ | |
| void ssl_set_ciphersuites( ssl_context *ssl, const int *ciphersuites ); | | void ssl_set_ciphersuites( ssl_context *ssl, const int *ciphersuites ); | |
| | | | |
| /** | | /** | |
| * \brief Set the list of allowed ciphersuites for a specific | | * \brief Set the list of allowed ciphersuites for a specific | |
| * version of the protocol. | | * version of the protocol. | |
|
| * (Default: ssl_default_ciphersuites) | | | |
| * (Only useful on the server side) | | * (Only useful on the server side) | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param ciphersuites 0-terminated list of allowed ciphersuites | | * \param ciphersuites 0-terminated list of allowed ciphersuites | |
| * \param major Major version number (only SSL_MAJOR_VERSION_3 | | * \param major Major version number (only SSL_MAJOR_VERSION_3 | |
| * supported) | | * supported) | |
| * \param minor Minor version number (SSL_MINOR_VERSION_0, | | * \param minor Minor version number (SSL_MINOR_VERSION_0, | |
| * SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2, | | * SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2, | |
| * SSL_MINOR_VERSION_3 supported) | | * SSL_MINOR_VERSION_3 supported) | |
| */ | | */ | |
| void ssl_set_ciphersuites_for_version( ssl_context *ssl, | | void ssl_set_ciphersuites_for_version( ssl_context *ssl, | |
| const int *ciphersuites, | | const int *ciphersuites, | |
| int major, int minor ); | | int major, int minor ); | |
| | | | |
|
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| /** | | /** | |
| * \brief Set the data required to verify peer certificate | | * \brief Set the data required to verify peer certificate | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param ca_chain trusted CA chain (meaning all fully trusted top-level CA
s) | | * \param ca_chain trusted CA chain (meaning all fully trusted top-level CA
s) | |
| * \param ca_crl trusted CA CRLs | | * \param ca_crl trusted CA CRLs | |
| * \param peer_cn expected peer CommonName (or NULL) | | * \param peer_cn expected peer CommonName (or NULL) | |
| */ | | */ | |
|
| void ssl_set_ca_chain( ssl_context *ssl, x509_cert *ca_chain, | | void ssl_set_ca_chain( ssl_context *ssl, x509_crt *ca_chain, | |
| x509_crl *ca_crl, const char *peer_cn ); | | x509_crl *ca_crl, const char *peer_cn ); | |
| | | | |
| /** | | /** | |
| * \brief Set own certificate chain and private key | | * \brief Set own certificate chain and private key | |
| * | | * | |
|
| | | * \note own_cert should contain in order from the bottom up your | |
| | | * certificate chain. The top certificate (self-signed) | |
| | | * can be omitted. | |
| | | * | |
| | | * \note This function may be called more than once if you want t | |
| | | o | |
| | | * support multiple certificates (eg, one using RSA and one | |
| | | * using ECDSA). However, on client, currently only the fir | |
| | | st | |
| | | * certificate is used (subsequent calls have no effect). | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param own_cert own public certificate chain | |
| | | * \param pk_key own private key | |
| | | * | |
| | | * \return 0 on success or POLARSSL_ERR_SSL_MALLOC_FAILED | |
| | | */ | |
| | | int ssl_set_own_cert( ssl_context *ssl, x509_crt *own_cert, | |
| | | pk_context *pk_key ); | |
| | | | |
| | | #if defined(POLARSSL_RSA_C) | |
| | | /** | |
| | | * \brief Set own certificate chain and private RSA key | |
| | | * | |
| * Note: own_cert should contain IN order from the bottom | | * Note: own_cert should contain IN order from the bottom | |
| * up your certificate chain. The top certificate (self-sig
ned) | | * up your certificate chain. The top certificate (self-sig
ned) | |
| * can be omitted. | | * can be omitted. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param own_cert own public certificate chain | | * \param own_cert own public certificate chain | |
| * \param rsa_key own private RSA key | | * \param rsa_key own private RSA key | |
|
| | | * | |
| | | * \return 0 on success, or a specific error code. | |
| */ | | */ | |
|
| void ssl_set_own_cert( ssl_context *ssl, x509_cert *own_cert, | | int ssl_set_own_cert_rsa( ssl_context *ssl, x509_crt *own_cert, | |
| rsa_context *rsa_key ); | | rsa_context *rsa_key ); | |
| | | #endif /* POLARSSL_RSA_C */ | |
| | | | |
| /** | | /** | |
|
| * \brief Set own certificate and alternate non-PolarSSL private | | * \brief Set own certificate and alternate non-PolarSSL RSA priva
te | |
| * key and handling callbacks, such as the PKCS#11 wrappers | | * key and handling callbacks, such as the PKCS#11 wrappers | |
| * or any other external private key handler. | | * or any other external private key handler. | |
| * (see the respective RSA functions in rsa.h for documenta
tion | | * (see the respective RSA functions in rsa.h for documenta
tion | |
| * of the callback parameters, with the only change being | | * of the callback parameters, with the only change being | |
| * that the rsa_context * is a void * in the callbacks) | | * that the rsa_context * is a void * in the callbacks) | |
| * | | * | |
| * Note: own_cert should contain IN order from the bottom | | * Note: own_cert should contain IN order from the bottom | |
| * up your certificate chain. The top certificate (self-sig
ned) | | * up your certificate chain. The top certificate (self-sig
ned) | |
| * can be omitted. | | * can be omitted. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param own_cert own public certificate chain | | * \param own_cert own public certificate chain | |
| * \param rsa_key alternate implementation private RSA key | | * \param rsa_key alternate implementation private RSA key | |
|
| * \param rsa_decrypt_func alternate implementation of \c rsa_pkcs1_decryp | | * \param rsa_decrypt alternate implementation of \c rsa_pkcs1_decrypt() | |
| t() | | * \param rsa_sign alternate implementation of \c rsa_pkcs1_sign() | |
| * \param rsa_sign_func alternate implementation of \c rsa_pkcs1_sign() | | * \param rsa_key_len function returning length of RSA key in bytes | |
| * \param rsa_key_len_func function returning length of RSA key in bytes | | * | |
| */ | | * \return 0 on success, or a specific error code. | |
| void ssl_set_own_cert_alt( ssl_context *ssl, x509_cert *own_cert, | | */ | |
| void *rsa_key, | | int ssl_set_own_cert_alt( ssl_context *ssl, x509_crt *own_cert, | |
| rsa_decrypt_func rsa_decrypt, | | void *rsa_key, | |
| rsa_sign_func rsa_sign, | | rsa_decrypt_func rsa_decrypt, | |
| rsa_key_len_func rsa_key_len ); | | rsa_sign_func rsa_sign, | |
| | | rsa_key_len_func rsa_key_len ); | |
| | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| | | | |
| | | #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) | |
| | | /** | |
| | | * \brief Set the Pre Shared Key (PSK) and the identity name conne | |
| | | cted | |
| | | * to it. | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param psk pointer to the pre-shared key | |
| | | * \param psk_len pre-shared key length | |
| | | * \param psk_identity pointer to the pre-shared key identity | |
| | | * \param psk_identity_len identity key length | |
| | | * | |
| | | * \return 0 if successful or POLARSSL_ERR_SSL_MALLOC_FAILED | |
| | | */ | |
| | | int ssl_set_psk( ssl_context *ssl, const unsigned char *psk, size_t psk_len | |
| | | , | |
| | | const unsigned char *psk_identity, size_t psk_identity_len | |
| | | ); | |
| | | | |
| | | /** | |
| | | * \brief Set the PSK callback (server-side only) (Optional). | |
| | | * | |
| | | * If set, the PSK callback is called for each | |
| | | * handshake where a PSK ciphersuite was negotiated. | |
| | | * The callback provides the identity received and wants to | |
| | | * receive the actual PSK data and length. | |
| | | * | |
| | | * The callback has the following parameters: (void *parame | |
| | | ter, | |
| | | * ssl_context *ssl, const unsigned char *psk_identity, | |
| | | * size_t identity_len) | |
| | | * If a valid PSK identity is found, the callback should us | |
| | | e | |
| | | * ssl_set_psk() on the ssl context to set the correct PSK | |
| | | and | |
| | | * identity and return 0. | |
| | | * Any other return value will result in a denied PSK ident | |
| | | ity. | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param f_psk PSK identity function | |
| | | * \param p_psk PSK identity parameter | |
| | | */ | |
| | | void ssl_set_psk_cb( ssl_context *ssl, | |
| | | int (*f_psk)(void *, ssl_context *, const unsigned cha | |
| | | r *, | |
| | | size_t), | |
| | | void *p_psk ); | |
| | | #endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */ | |
| | | | |
| #if defined(POLARSSL_DHM_C) | | #if defined(POLARSSL_DHM_C) | |
| /** | | /** | |
| * \brief Set the Diffie-Hellman public P and G values, | | * \brief Set the Diffie-Hellman public P and G values, | |
| * read as hexadecimal strings (server-side only) | | * read as hexadecimal strings (server-side only) | |
| * (Default: POLARSSL_DHM_RFC5114_MODP_1024_[PG]) | | * (Default: POLARSSL_DHM_RFC5114_MODP_1024_[PG]) | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param dhm_P Diffie-Hellman-Merkle modulus | | * \param dhm_P Diffie-Hellman-Merkle modulus | |
| * \param dhm_G Diffie-Hellman-Merkle generator | | * \param dhm_G Diffie-Hellman-Merkle generator | |
| | | | |
| skipping to change at line 833 | | skipping to change at line 1125 | |
|---|
| * read from existing context (server-side only) | | * read from existing context (server-side only) | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param dhm_ctx Diffie-Hellman-Merkle context | | * \param dhm_ctx Diffie-Hellman-Merkle context | |
| * | | * | |
| * \return 0 if successful | | * \return 0 if successful | |
| */ | | */ | |
| int ssl_set_dh_param_ctx( ssl_context *ssl, dhm_context *dhm_ctx ); | | int ssl_set_dh_param_ctx( ssl_context *ssl, dhm_context *dhm_ctx ); | |
| #endif | | #endif | |
| | | | |
|
| | | #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) | |
| /** | | /** | |
| * \brief Set hostname for ServerName TLS extension | | * \brief Set hostname for ServerName TLS extension | |
| * (client-side only) | | * (client-side only) | |
| * | | * | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param hostname the server hostname | | * \param hostname the server hostname | |
| * | | * | |
| * \return 0 if successful or POLARSSL_ERR_SSL_MALLOC_FAILED | | * \return 0 if successful or POLARSSL_ERR_SSL_MALLOC_FAILED | |
| */ | | */ | |
| | | | |
| skipping to change at line 868 | | skipping to change at line 1161 | |
|---|
| * point. | | * point. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param f_sni verification function | | * \param f_sni verification function | |
| * \param p_sni verification parameter | | * \param p_sni verification parameter | |
| */ | | */ | |
| void ssl_set_sni( ssl_context *ssl, | | void ssl_set_sni( ssl_context *ssl, | |
| int (*f_sni)(void *, ssl_context *, const unsigned char *
, | | int (*f_sni)(void *, ssl_context *, const unsigned char *
, | |
| size_t), | | size_t), | |
| void *p_sni ); | | void *p_sni ); | |
|
| | | #endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */ | |
| | | | |
| /** | | /** | |
| * \brief Set the maximum supported version sent from the client s
ide | | * \brief Set the maximum supported version sent from the client s
ide | |
|
| | | * and/or accepted at the server side | |
| | | * (Default: SSL_MAX_MAJOR_VERSION, SSL_MAX_MINOR_VERSION) | |
| | | * | |
| | | * Note: This ignores ciphersuites from 'higher' versions. | |
| | | * Note: Input outside of the SSL_MAX_XXXXX_VERSION and | |
| | | * SSL_MIN_XXXXX_VERSION range is ignored. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param major Major version number (only SSL_MAJOR_VERSION_3 supported
) | | * \param major Major version number (only SSL_MAJOR_VERSION_3 supported
) | |
| * \param minor Minor version number (SSL_MINOR_VERSION_0, | | * \param minor Minor version number (SSL_MINOR_VERSION_0, | |
| * SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2, | | * SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2, | |
| * SSL_MINOR_VERSION_3 supported) | | * SSL_MINOR_VERSION_3 supported) | |
| */ | | */ | |
| void ssl_set_max_version( ssl_context *ssl, int major, int minor ); | | void ssl_set_max_version( ssl_context *ssl, int major, int minor ); | |
| | | | |
| /** | | /** | |
| * \brief Set the minimum accepted SSL/TLS protocol version | | * \brief Set the minimum accepted SSL/TLS protocol version | |
|
| * (Default: SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0) | | * (Default: SSL_MIN_MAJOR_VERSION, SSL_MIN_MINOR_VERSION) | |
| | | * | |
| | | * Note: Input outside of the SSL_MAX_XXXXX_VERSION and | |
| | | * SSL_MIN_XXXXX_VERSION range is ignored. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * \param major Major version number (only SSL_MAJOR_VERSION_3 supported
) | | * \param major Major version number (only SSL_MAJOR_VERSION_3 supported
) | |
| * \param minor Minor version number (SSL_MINOR_VERSION_0, | | * \param minor Minor version number (SSL_MINOR_VERSION_0, | |
| * SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2, | | * SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2, | |
| * SSL_MINOR_VERSION_3 supported) | | * SSL_MINOR_VERSION_3 supported) | |
| */ | | */ | |
| void ssl_set_min_version( ssl_context *ssl, int major, int minor ); | | void ssl_set_min_version( ssl_context *ssl, int major, int minor ); | |
| | | | |
|
| | | #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) | |
| | | /** | |
| | | * \brief Set the maximum fragment length to emit and/or negotiate | |
| | | * (Default: SSL_MAX_CONTENT_LEN, usually 2^14 bytes) | |
| | | * (Server: set maximum fragment length to emit, | |
| | | * usually negotiated by the client during handshake | |
| | | * (Client: set maximum fragment length to emit *and* | |
| | | * negotiate with the server during handshake) | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param mfl_code Code for maximum fragment length (allowed values: | |
| | | * SSL_MAX_FRAG_LEN_512, SSL_MAX_FRAG_LEN_1024, | |
| | | * SSL_MAX_FRAG_LEN_2048, SSL_MAX_FRAG_LEN_4096) | |
| | | * | |
| | | * \return O if successful or POLARSSL_ERR_SSL_BAD_INPUT_DATA | |
| | | */ | |
| | | int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code ); | |
| | | #endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */ | |
| | | | |
| | | #if defined(POLARSSL_SSL_TRUNCATED_HMAC) | |
| | | /** | |
| | | * \brief Activate negotiation of truncated HMAC (Client only) | |
| | | * (Default: SSL_TRUNC_HMAC_ENABLED) | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param truncate Enable or disable (SSL_TRUNC_HMAC_ENABLED or | |
| | | * SSL_TRUNC_HMAC_DISABLED) | |
| | | * | |
| | | * \return O if successful, | |
| | | * POLARSSL_ERR_SSL_BAD_INPUT_DATA if used server-side | |
| | | */ | |
| | | int ssl_set_truncated_hmac( ssl_context *ssl, int truncate ); | |
| | | #endif /* POLARSSL_SSL_TRUNCATED_HMAC */ | |
| | | | |
| | | #if defined(POLARSSL_SSL_SESSION_TICKETS) | |
| | | /** | |
| | | * \brief Enable / Disable session tickets | |
| | | * (Default: SSL_SESSION_TICKETS_ENABLED on client, | |
| | | * SSL_SESSION_TICKETS_DISABLED on server) | |
| | | * | |
| | | * \note On server, ssl_set_rng() must be called before this func | |
| | | tion | |
| | | * to allow generating the ticket encryption and | |
| | | * authentication keys. | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param use_tickets Enable or disable (SSL_SESSION_TICKETS_ENABLED or | |
| | | * SSL_SESSION_TICKETS_DISABLED) | |
| | | * | |
| | | * \return O if successful, | |
| | | * or a specific error code (server only). | |
| | | */ | |
| | | int ssl_set_session_tickets( ssl_context *ssl, int use_tickets ); | |
| | | | |
| | | /** | |
| | | * \brief Set session ticket lifetime (server only) | |
| | | * (Default: SSL_DEFAULT_TICKET_LIFETIME (86400 secs / 1 da | |
| | | y)) | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param lifetime session ticket lifetime | |
| | | */ | |
| | | void ssl_set_session_ticket_lifetime( ssl_context *ssl, int lifetime ); | |
| | | #endif /* POLARSSL_SSL_SESSION_TICKETS */ | |
| | | | |
| /** | | /** | |
| * \brief Enable / Disable renegotiation support for connection wh
en | | * \brief Enable / Disable renegotiation support for connection wh
en | |
| * initiated by peer | | * initiated by peer | |
| * (Default: SSL_RENEGOTIATION_DISABLED) | | * (Default: SSL_RENEGOTIATION_DISABLED) | |
| * | | * | |
| * Note: A server with support enabled is more vulnerable f
or a | | * Note: A server with support enabled is more vulnerable f
or a | |
| * resource DoS by a malicious client. You should enable th
is on | | * resource DoS by a malicious client. You should enable th
is on | |
| * a client to enable server-initiated renegotiation. | | * a client to enable server-initiated renegotiation. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| | | | |
| skipping to change at line 976 | | skipping to change at line 1342 | |
|---|
| | | | |
| /** | | /** | |
| * \brief Return the current SSL version (SSLv3/TLSv1/etc) | | * \brief Return the current SSL version (SSLv3/TLSv1/etc) | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * | | * | |
| * \return a string containing the SSL version | | * \return a string containing the SSL version | |
| */ | | */ | |
| const char *ssl_get_version( const ssl_context *ssl ); | | const char *ssl_get_version( const ssl_context *ssl ); | |
| | | | |
|
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| /** | | /** | |
| * \brief Return the peer certificate from the current connection | | * \brief Return the peer certificate from the current connection | |
| * | | * | |
| * Note: Can be NULL in case no certificate was sent during | | * Note: Can be NULL in case no certificate was sent during | |
| * the handshake. Different calls for the same connection c
an | | * the handshake. Different calls for the same connection c
an | |
| * return the same or different pointers for the same | | * return the same or different pointers for the same | |
| * certificate and even a different certificate altogether. | | * certificate and even a different certificate altogether. | |
| * The peer cert CAN change in a single connection if | | * The peer cert CAN change in a single connection if | |
| * renegotiation is performed. | | * renegotiation is performed. | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * | | * | |
| * \return the current peer certificate | | * \return the current peer certificate | |
| */ | | */ | |
|
| const x509_cert *ssl_get_peer_cert( const ssl_context *ssl ); | | const x509_crt *ssl_get_peer_cert( const ssl_context *ssl ); | |
| | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| | | | |
| | | /** | |
| | | * \brief Save session in order to resume it later (client-side on | |
| | | ly) | |
| | | * Session data is copied to presented session structure. | |
| | | * | |
| | | * \warning Currently, peer certificate is lost in the operation. | |
| | | * | |
| | | * \param ssl SSL context | |
| | | * \param session session context | |
| | | * | |
| | | * \return 0 if successful, | |
| | | * POLARSSL_ERR_SSL_MALLOC_FAILED if memory allocation fail | |
| | | ed, | |
| | | * POLARSSL_ERR_SSL_BAD_INPUT_DATA if used server-side or | |
| | | * arguments are otherwise invalid | |
| | | * | |
| | | * \sa ssl_set_session() | |
| | | */ | |
| | | int ssl_get_session( const ssl_context *ssl, ssl_session *session ); | |
| | | | |
| /** | | /** | |
| * \brief Perform the SSL handshake | | * \brief Perform the SSL handshake | |
| * | | * | |
| * \param ssl SSL context | | * \param ssl SSL context | |
| * | | * | |
| * \return 0 if successful, POLARSSL_ERR_NET_WANT_READ, | | * \return 0 if successful, POLARSSL_ERR_NET_WANT_READ, | |
| * POLARSSL_ERR_NET_WANT_WRITE, or a specific SSL error cod
e. | | * POLARSSL_ERR_NET_WANT_WRITE, or a specific SSL error cod
e. | |
| */ | | */ | |
| int ssl_handshake( ssl_context *ssl ); | | int ssl_handshake( ssl_context *ssl ); | |
| | | | |
| skipping to change at line 1134 | | skipping to change at line 1520 | |
|---|
| | | | |
| int ssl_parse_certificate( ssl_context *ssl ); | | int ssl_parse_certificate( ssl_context *ssl ); | |
| int ssl_write_certificate( ssl_context *ssl ); | | int ssl_write_certificate( ssl_context *ssl ); | |
| | | | |
| int ssl_parse_change_cipher_spec( ssl_context *ssl ); | | int ssl_parse_change_cipher_spec( ssl_context *ssl ); | |
| int ssl_write_change_cipher_spec( ssl_context *ssl ); | | int ssl_write_change_cipher_spec( ssl_context *ssl ); | |
| | | | |
| int ssl_parse_finished( ssl_context *ssl ); | | int ssl_parse_finished( ssl_context *ssl ); | |
| int ssl_write_finished( ssl_context *ssl ); | | int ssl_write_finished( ssl_context *ssl ); | |
| | | | |
|
| void ssl_optimize_checksum( ssl_context *ssl, int ciphersuite ); | | void ssl_optimize_checksum( ssl_context *ssl, const ssl_ciphersuite_t *ciph | |
| int ssl_get_ciphersuite_min_version( const int ciphersuite_id ); | | ersuite_info ); | |
| | | | |
| | | #if defined(POLARSSL_PK_C) | |
| | | unsigned char ssl_sig_from_pk( pk_context *pk ); | |
| | | pk_type_t ssl_pk_alg_from_sig( unsigned char sig ); | |
| | | #endif | |
| | | | |
| | | md_type_t ssl_md_alg_from_hash( unsigned char hash ); | |
| | | | |
| | | #if defined(POLARSSL_X509_CRT_PARSE_C) | |
| | | static inline pk_context *ssl_own_key( ssl_context *ssl ) | |
| | | { | |
| | | return( ssl->handshake->key_cert == NULL ? NULL | |
| | | : ssl->handshake->key_cert->key ); | |
| | | } | |
| | | | |
| | | static inline x509_crt *ssl_own_cert( ssl_context *ssl ) | |
| | | { | |
| | | return( ssl->handshake->key_cert == NULL ? NULL | |
| | | : ssl->handshake->key_cert->cert ); | |
| | | } | |
| | | #endif /* POLARSSL_X509_CRT_PARSE_C */ | |
| | | | |
| #ifdef __cplusplus | | #ifdef __cplusplus | |
| } | | } | |
| #endif | | #endif | |
| | | | |
| #endif /* ssl.h */ | | #endif /* ssl.h */ | |
| | | | |
| End of changes. 84 change blocks. |
|---|
| 137 lines changed or deleted | | 575 lines changed or added | |
|---|
|
| x509.h | | x509.h | |
|---|
| /** | | /** | |
| * \file x509.h | | * \file x509.h | |
| * | | * | |
|
| * \brief X.509 certificate and private key decoding | | * \brief X.509 generic defines and structures | |
| * | | * | |
|
| * Copyright (C) 2006-2011, Brainspark B.V. | | * Copyright (C) 2006-2013, Brainspark B.V. | |
| * | | * | |
| * This file is part of PolarSSL (http://www.polarssl.org) | | * This file is part of PolarSSL (http://www.polarssl.org) | |
| * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> | | * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org> | |
| * | | * | |
| * All rights reserved. | | * All rights reserved. | |
| * | | * | |
| * This program is free software; you can redistribute it and/or modify | | * This program is free software; you can redistribute it and/or modify | |
| * it under the terms of the GNU General Public License as published by | | * it under the terms of the GNU General Public License as published by | |
| * the Free Software Foundation; either version 2 of the License, or | | * the Free Software Foundation; either version 2 of the License, or | |
| * (at your option) any later version. | | * (at your option) any later version. | |
| | | | |
| skipping to change at line 30 | | skipping to change at line 30 | |
|---|
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
| * GNU General Public License for more details. | | * GNU General Public License for more details. | |
| * | | * | |
| * You should have received a copy of the GNU General Public License along | | * You should have received a copy of the GNU General Public License along | |
| * with this program; if not, write to the Free Software Foundation, Inc., | | * with this program; if not, write to the Free Software Foundation, Inc., | |
| * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
| */ | | */ | |
| #ifndef POLARSSL_X509_H | | #ifndef POLARSSL_X509_H | |
| #define POLARSSL_X509_H | | #define POLARSSL_X509_H | |
| | | | |
|
| | | #include "config.h" | |
| | | | |
| #include "asn1.h" | | #include "asn1.h" | |
|
| | | #include "pk.h" | |
| | | | |
| | | #if defined(POLARSSL_RSA_C) | |
| #include "rsa.h" | | #include "rsa.h" | |
|
| #include "dhm.h" | | #endif | |
| | | | |
| /** | | /** | |
| * \addtogroup x509_module | | * \addtogroup x509_module | |
| * \{ | | * \{ | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * \name X509 Error codes | | * \name X509 Error codes | |
| * \{ | | * \{ | |
| */ | | */ | |
| #define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE -0x2080 /**< Un
available feature, e.g. RSA hashing/encryption combination. */ | | #define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE -0x2080 /**< Un
available feature, e.g. RSA hashing/encryption combination. */ | |
|
| #define POLARSSL_ERR_X509_CERT_INVALID_PEM -0x2100 /**< Th | | #define POLARSSL_ERR_X509_UNKNOWN_OID -0x2100 /**< Re | |
| e PEM-encoded certificate contains invalid elements, e.g. invalid character | | quested OID is unknown. */ | |
| . */ | | #define POLARSSL_ERR_X509_INVALID_FORMAT -0x2180 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_FORMAT -0x2180 /**< Th | | e CRT/CRL/CSR format is invalid, e.g. different type expected. */ | |
| e certificate format is invalid, e.g. different type expected. */ | | #define POLARSSL_ERR_X509_INVALID_VERSION -0x2200 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_VERSION -0x2200 /**< Th | | e CRT/CRL/CSR version element is invalid. */ | |
| e certificate version element is invalid. */ | | #define POLARSSL_ERR_X509_INVALID_SERIAL -0x2280 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_SERIAL -0x2280 /**< Th | | e serial tag or value is invalid. */ | |
| e serial tag or value is invalid. */ | | #define POLARSSL_ERR_X509_INVALID_ALG -0x2300 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_ALG -0x2300 /**< Th | | e algorithm tag or value is invalid. */ | |
| e algorithm tag or value is invalid. */ | | #define POLARSSL_ERR_X509_INVALID_NAME -0x2380 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_NAME -0x2380 /**< Th | | e name tag or value is invalid. */ | |
| e name tag or value is invalid. */ | | #define POLARSSL_ERR_X509_INVALID_DATE -0x2400 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_DATE -0x2400 /**< Th | | e date tag or value is invalid. */ | |
| e date tag or value is invalid. */ | | #define POLARSSL_ERR_X509_INVALID_SIGNATURE -0x2480 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_PUBKEY -0x2480 /**< Th | | e signature tag or value invalid. */ | |
| e pubkey tag or value is invalid (only RSA is supported). */ | | #define POLARSSL_ERR_X509_INVALID_EXTENSIONS -0x2500 /**< Th | |
| #define POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE -0x2500 /**< Th | | e extension tag or value is invalid. */ | |
| e signature tag or value invalid. */ | | #define POLARSSL_ERR_X509_UNKNOWN_VERSION -0x2580 /**< CR | |
| #define POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS -0x2580 /**< Th | | T/CRL/CSR has an unsupported version number. */ | |
| e extension tag or value is invalid. */ | | #define POLARSSL_ERR_X509_UNKNOWN_SIG_ALG -0x2600 /**< Si | |
| #define POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION -0x2600 /**< Ce | | gnature algorithm (oid) is unsupported. */ | |
| rtificate or CRL has an unsupported version number. */ | | #define POLARSSL_ERR_X509_SIG_MISMATCH -0x2680 /**< Si | |
| #define POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG -0x2680 /**< Si | | gnature algorithms do not match. (see \c ::x509_crt sig_oid) */ | |
| gnature algorithm (oid) is unsupported. */ | | #define POLARSSL_ERR_X509_CERT_VERIFY_FAILED -0x2700 /**< Ce | |
| #define POLARSSL_ERR_X509_UNKNOWN_PK_ALG -0x2700 /**< Ke | | rtificate verification failed, e.g. CRL, CA or signature check failed. */ | |
| y algorithm is unsupported (only RSA is supported). */ | | #define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780 /**< Fo | |
| #define POLARSSL_ERR_X509_CERT_SIG_MISMATCH -0x2780 /**< Ce | | rmat not recognized as DER or PEM. */ | |
| rtificate signature algorithms do not match. (see \c ::x509_cert sig_oid) * | | #define POLARSSL_ERR_X509_BAD_INPUT_DATA -0x2800 /**< In | |
| / | | put invalid. */ | |
| #define POLARSSL_ERR_X509_CERT_VERIFY_FAILED -0x2800 /**< Ce | | #define POLARSSL_ERR_X509_MALLOC_FAILED -0x2880 /**< Al | |
| rtificate verification failed, e.g. CRL, CA or signature check failed. */ | | location of memory failed. */ | |
| #define POLARSSL_ERR_X509_KEY_INVALID_VERSION -0x2880 /**< Un | | #define POLARSSL_ERR_X509_FILE_IO_ERROR -0x2900 /**< Re | |
| supported RSA key version */ | | ad/write of file failed. */ | |
| #define POLARSSL_ERR_X509_KEY_INVALID_FORMAT -0x2900 /**< In | | | |
| valid RSA key tag or value. */ | | | |
| #define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT -0x2980 /**< Fo | | | |
| rmat not recognized as DER or PEM. */ | | | |
| #define POLARSSL_ERR_X509_INVALID_INPUT -0x2A00 /**< In | | | |
| put invalid. */ | | | |
| #define POLARSSL_ERR_X509_MALLOC_FAILED -0x2A80 /**< Al | | | |
| location of memory failed. */ | | | |
| #define POLARSSL_ERR_X509_FILE_IO_ERROR -0x2B00 /**< Re | | | |
| ad/write of file failed. */ | | | |
| #define POLARSSL_ERR_X509_PASSWORD_REQUIRED -0x2B80 /**< Pr | | | |
| ivate key password can't be empty. */ | | | |
| #define POLARSSL_ERR_X509_PASSWORD_MISMATCH -0x2C00 /**< Gi | | | |
| ven private key password does not allow for correct decryption. */ | | | |
| /* \} name */ | | /* \} name */ | |
| | | | |
| /** | | /** | |
| * \name X509 Verify codes | | * \name X509 Verify codes | |
| * \{ | | * \{ | |
| */ | | */ | |
| #define BADCERT_EXPIRED 0x01 /**< The certificate validity has
expired. */ | | #define BADCERT_EXPIRED 0x01 /**< The certificate validity has
expired. */ | |
| #define BADCERT_REVOKED 0x02 /**< The certificate has been rev
oked (is on a CRL). */ | | #define BADCERT_REVOKED 0x02 /**< The certificate has been rev
oked (is on a CRL). */ | |
| #define BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name
(CN) does not match with the expected CN. */ | | #define BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name
(CN) does not match with the expected CN. */ | |
| #define BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not corre
ctly signed by the trusted CA. */ | | #define BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not corre
ctly signed by the trusted CA. */ | |
| #define BADCRL_NOT_TRUSTED 0x10 /**< CRL is not correctly signed
by the trusted CA. */ | | #define BADCRL_NOT_TRUSTED 0x10 /**< CRL is not correctly signed
by the trusted CA. */ | |
| #define BADCRL_EXPIRED 0x20 /**< CRL is expired. */ | | #define BADCRL_EXPIRED 0x20 /**< CRL is expired. */ | |
| #define BADCERT_MISSING 0x40 /**< Certificate was missing. */ | | #define BADCERT_MISSING 0x40 /**< Certificate was missing. */ | |
| #define BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was
skipped. */ | | #define BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was
skipped. */ | |
| #define BADCERT_OTHER 0x0100 /**< Other reason (can be used by
verify callback) */ | | #define BADCERT_OTHER 0x0100 /**< Other reason (can be used by
verify callback) */ | |
| /* \} name */ | | /* \} name */ | |
| /* \} addtogroup x509_module */ | | /* \} addtogroup x509_module */ | |
| | | | |
| /* | | /* | |
|
| * various object identifiers | | | |
| */ | | | |
| #define X520_COMMON_NAME 3 | | | |
| #define X520_COUNTRY 6 | | | |
| #define X520_LOCALITY 7 | | | |
| #define X520_STATE 8 | | | |
| #define X520_ORGANIZATION 10 | | | |
| #define X520_ORG_UNIT 11 | | | |
| #define PKCS9_EMAIL 1 | | | |
| | | | |
| #define X509_OUTPUT_DER 0x01 | | | |
| #define X509_OUTPUT_PEM 0x02 | | | |
| #define PEM_LINE_LENGTH 72 | | | |
| #define X509_ISSUER 0x01 | | | |
| #define X509_SUBJECT 0x02 | | | |
| | | | |
| #define OID_X520 "\x55\x04" | | | |
| #define OID_CN OID_X520 "\x03" | | | |
| #define OID_COUNTRY OID_X520 "\x06" | | | |
| #define OID_LOCALITY OID_X520 "\x07" | | | |
| #define OID_STATE OID_X520 "\x08" | | | |
| #define OID_ORGANIZATION OID_X520 "\x0A" | | | |
| #define OID_ORG_UNIT OID_X520 "\x0B" | | | |
| | | | |
| #define OID_PKCS1 "\x2A\x86\x48\x86\xF7\x0D\x01\x01" | | | |
| #define OID_PKCS1_RSA OID_PKCS1 "\x01" | | | |
| #define OID_PKCS1_SHA1 OID_PKCS1 "\x05" | | | |
| | | | |
| #define OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D" | | | |
| | | | |
| #define OID_PKCS9 "\x2A\x86\x48\x86\xF7\x0D\x01\x09" | | | |
| #define OID_PKCS9_EMAIL OID_PKCS9 "\x01" | | | |
| | | | |
| /** ISO arc for standard certificate and CRL extensions */ | | | |
| #define OID_ID_CE "\x55\x1D" /**< id-ce OBJECT IDENTIFIER :: | | | |
| = {joint-iso-ccitt(2) ds(5) 29} */ | | | |
| | | | |
| /** | | | |
| * Private Internet Extensions | | | |
| * { iso(1) identified-organization(3) dod(6) internet(1) | | | |
| * security(5) mechanisms(5) pkix(7) } | | | |
| */ | | | |
| #define OID_PKIX "\x2B\x06\x01\x05\x05\x07" | | | |
| | | | |
| /* | | | |
| * OIDs for standard certificate extensions | | | |
| */ | | | |
| #define OID_AUTHORITY_KEY_IDENTIFIER OID_ID_CE "\x23" /**< id-ce-authori | | | |
| tyKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 } */ | | | |
| #define OID_SUBJECT_KEY_IDENTIFIER OID_ID_CE "\x0E" /**< id-ce-subject | | | |
| KeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 } */ | | | |
| #define OID_KEY_USAGE OID_ID_CE "\x0F" /**< id-ce-keyUsag | | | |
| e OBJECT IDENTIFIER ::= { id-ce 15 } */ | | | |
| #define OID_CERTIFICATE_POLICIES OID_ID_CE "\x20" /**< id-ce-certifi | | | |
| catePolicies OBJECT IDENTIFIER ::= { id-ce 32 } */ | | | |
| #define OID_POLICY_MAPPINGS OID_ID_CE "\x21" /**< id-ce-policyM | | | |
| appings OBJECT IDENTIFIER ::= { id-ce 33 } */ | | | |
| #define OID_SUBJECT_ALT_NAME OID_ID_CE "\x11" /**< id-ce-subject | | | |
| AltName OBJECT IDENTIFIER ::= { id-ce 17 } */ | | | |
| #define OID_ISSUER_ALT_NAME OID_ID_CE "\x12" /**< id-ce-issuerA | | | |
| ltName OBJECT IDENTIFIER ::= { id-ce 18 } */ | | | |
| #define OID_SUBJECT_DIRECTORY_ATTRS OID_ID_CE "\x09" /**< id-ce-subject | | | |
| DirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 } */ | | | |
| #define OID_BASIC_CONSTRAINTS OID_ID_CE "\x13" /**< id-ce-basicCo | | | |
| nstraints OBJECT IDENTIFIER ::= { id-ce 19 } */ | | | |
| #define OID_NAME_CONSTRAINTS OID_ID_CE "\x1E" /**< id-ce-nameCon | | | |
| straints OBJECT IDENTIFIER ::= { id-ce 30 } */ | | | |
| #define OID_POLICY_CONSTRAINTS OID_ID_CE "\x24" /**< id-ce-policyC | | | |
| onstraints OBJECT IDENTIFIER ::= { id-ce 36 } */ | | | |
| #define OID_EXTENDED_KEY_USAGE OID_ID_CE "\x25" /**< id-ce-extKeyU | | | |
| sage OBJECT IDENTIFIER ::= { id-ce 37 } */ | | | |
| #define OID_CRL_DISTRIBUTION_POINTS OID_ID_CE "\x1F" /**< id-ce-cRLDist | | | |
| ributionPoints OBJECT IDENTIFIER ::= { id-ce 31 } */ | | | |
| #define OID_INIHIBIT_ANYPOLICY OID_ID_CE "\x36" /**< id-ce-inhibit | | | |
| AnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 } */ | | | |
| #define OID_FRESHEST_CRL OID_ID_CE "\x2E" /**< id-ce-freshes | | | |
| tCRL OBJECT IDENTIFIER ::= { id-ce 46 } */ | | | |
| | | | |
| /* | | | |
| * X.509 v3 Key Usage Extension flags | | * X.509 v3 Key Usage Extension flags | |
| */ | | */ | |
| #define KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ | | #define KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ | |
| #define KU_NON_REPUDIATION (0x40) /* bit 1 */ | | #define KU_NON_REPUDIATION (0x40) /* bit 1 */ | |
| #define KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ | | #define KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ | |
| #define KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ | | #define KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ | |
| #define KU_KEY_AGREEMENT (0x08) /* bit 4 */ | | #define KU_KEY_AGREEMENT (0x08) /* bit 4 */ | |
| #define KU_KEY_CERT_SIGN (0x04) /* bit 5 */ | | #define KU_KEY_CERT_SIGN (0x04) /* bit 5 */ | |
| #define KU_CRL_SIGN (0x02) /* bit 6 */ | | #define KU_CRL_SIGN (0x02) /* bit 6 */ | |
| | | | |
| /* | | /* | |
|
| * X.509 v3 Extended key usage OIDs | | | |
| */ | | | |
| #define OID_ANY_EXTENDED_KEY_USAGE OID_EXTENDED_KEY_USAGE "\x00" /**< | | | |
| anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 } */ | | | |
| | | | |
| #define OID_KP OID_PKIX "\x03" /**< id-kp OBJECT I | | | |
| DENTIFIER ::= { id-pkix 3 } */ | | | |
| #define OID_SERVER_AUTH OID_KP "\x01" /**< id-kp-serverAuth | | | |
| OBJECT IDENTIFIER ::= { id-kp 1 } */ | | | |
| #define OID_CLIENT_AUTH OID_KP "\x02" /**< id-kp-clientAuth | | | |
| OBJECT IDENTIFIER ::= { id-kp 2 } */ | | | |
| #define OID_CODE_SIGNING OID_KP "\x03" /**< id-kp-codeSignin | | | |
| g OBJECT IDENTIFIER ::= { id-kp 3 } */ | | | |
| #define OID_EMAIL_PROTECTION OID_KP "\x04" /**< id-kp-emailProte | | | |
| ction OBJECT IDENTIFIER ::= { id-kp 4 } */ | | | |
| #define OID_TIME_STAMPING OID_KP "\x08" /**< id-kp-timeStampi | | | |
| ng OBJECT IDENTIFIER ::= { id-kp 8 } */ | | | |
| #define OID_OCSP_SIGNING OID_KP "\x09" /**< id-kp-OCSPSignin | | | |
| g OBJECT IDENTIFIER ::= { id-kp 9 } */ | | | |
| | | | |
| #define STRING_SERVER_AUTH "TLS Web Server Authentication" | | | |
| #define STRING_CLIENT_AUTH "TLS Web Client Authentication" | | | |
| #define STRING_CODE_SIGNING "Code Signing" | | | |
| #define STRING_EMAIL_PROTECTION "E-mail Protection" | | | |
| #define STRING_TIME_STAMPING "Time Stamping" | | | |
| #define STRING_OCSP_SIGNING "OCSP Signing" | | | |
| | | | |
| /* | | | |
| * OIDs for CRL extensions | | | |
| */ | | | |
| #define OID_PRIVATE_KEY_USAGE_PERIOD OID_ID_CE "\x10" | | | |
| #define OID_CRL_NUMBER OID_ID_CE "\x14" /**< id-ce-cRLNumb | | | |
| er OBJECT IDENTIFIER ::= { id-ce 20 } */ | | | |
| | | | |
| /* | | | |
| * Netscape certificate extensions | | | |
| */ | | | |
| #define OID_NETSCAPE "\x60\x86\x48\x01\x86\xF8\x42" /**< Net | | | |
| scape OID */ | | | |
| #define OID_NS_CERT OID_NETSCAPE "\x01" | | | |
| #define OID_NS_CERT_TYPE OID_NS_CERT "\x01" | | | |
| #define OID_NS_BASE_URL OID_NS_CERT "\x02" | | | |
| #define OID_NS_REVOCATION_URL OID_NS_CERT "\x03" | | | |
| #define OID_NS_CA_REVOCATION_URL OID_NS_CERT "\x04" | | | |
| #define OID_NS_RENEWAL_URL OID_NS_CERT "\x07" | | | |
| #define OID_NS_CA_POLICY_URL OID_NS_CERT "\x08" | | | |
| #define OID_NS_SSL_SERVER_NAME OID_NS_CERT "\x0C" | | | |
| #define OID_NS_COMMENT OID_NS_CERT "\x0D" | | | |
| #define OID_NS_DATA_TYPE OID_NETSCAPE "\x02" | | | |
| #define OID_NS_CERT_SEQUENCE OID_NS_DATA_TYPE "\x05" | | | |
| | | | |
| /* | | | |
| * Netscape certificate types | | * Netscape certificate types | |
| * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html) | | * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html) | |
| */ | | */ | |
| | | | |
| #define NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ | | #define NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ | |
| #define NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ | | #define NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ | |
| #define NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ | | #define NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ | |
| #define NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ | | #define NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ | |
| #define NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ | | #define NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ | |
| #define NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ | | #define NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ | |
| #define NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ | | #define NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ | |
| #define NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ | | #define NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ | |
| | | | |
|
| | | /* | |
| | | * X.509 extension types | |
| | | */ | |
| #define EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0) | | #define EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0) | |
| #define EXT_SUBJECT_KEY_IDENTIFIER (1 << 1) | | #define EXT_SUBJECT_KEY_IDENTIFIER (1 << 1) | |
| #define EXT_KEY_USAGE (1 << 2) | | #define EXT_KEY_USAGE (1 << 2) | |
| #define EXT_CERTIFICATE_POLICIES (1 << 3) | | #define EXT_CERTIFICATE_POLICIES (1 << 3) | |
| #define EXT_POLICY_MAPPINGS (1 << 4) | | #define EXT_POLICY_MAPPINGS (1 << 4) | |
| #define EXT_SUBJECT_ALT_NAME (1 << 5) | | #define EXT_SUBJECT_ALT_NAME (1 << 5) | |
| #define EXT_ISSUER_ALT_NAME (1 << 6) | | #define EXT_ISSUER_ALT_NAME (1 << 6) | |
| #define EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7) | | #define EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7) | |
| #define EXT_BASIC_CONSTRAINTS (1 << 8) | | #define EXT_BASIC_CONSTRAINTS (1 << 8) | |
| #define EXT_NAME_CONSTRAINTS (1 << 9) | | #define EXT_NAME_CONSTRAINTS (1 << 9) | |
| | | | |
| skipping to change at line 240 | | skipping to change at line 137 | |
|---|
| | | | |
| #define EXT_NS_CERT_TYPE (1 << 16) | | #define EXT_NS_CERT_TYPE (1 << 16) | |
| | | | |
| /* | | /* | |
| * Storage format identifiers | | * Storage format identifiers | |
| * Recognized formats: PEM and DER | | * Recognized formats: PEM and DER | |
| */ | | */ | |
| #define X509_FORMAT_DER 1 | | #define X509_FORMAT_DER 1 | |
| #define X509_FORMAT_PEM 2 | | #define X509_FORMAT_PEM 2 | |
| | | | |
|
| | | #ifdef __cplusplus | |
| | | extern "C" { | |
| | | #endif | |
| | | | |
| /** | | /** | |
| * \addtogroup x509_module | | * \addtogroup x509_module | |
| * \{ */ | | * \{ */ | |
| | | | |
| /** | | /** | |
|
| * \name Structures for parsing X.509 certificates and CRLs | | * \name Structures for parsing X.509 certificates, CRLs and CSRs | |
| * \{ | | * \{ | |
| */ | | */ | |
| | | | |
| /** | | /** | |
| * Type-length-value structure that allows for ASN1 using DER. | | * Type-length-value structure that allows for ASN1 using DER. | |
| */ | | */ | |
| typedef asn1_buf x509_buf; | | typedef asn1_buf x509_buf; | |
| | | | |
| /** | | /** | |
| * Container for ASN1 bit strings. | | * Container for ASN1 bit strings. | |
| */ | | */ | |
| typedef asn1_bitstring x509_bitstring; | | typedef asn1_bitstring x509_bitstring; | |
| | | | |
| /** | | /** | |
| * Container for ASN1 named information objects. | | * Container for ASN1 named information objects. | |
| * It allows for Relative Distinguished Names (e.g. cn=polarssl,ou=code,etc
.). | | * It allows for Relative Distinguished Names (e.g. cn=polarssl,ou=code,etc
.). | |
| */ | | */ | |
|
| typedef struct _x509_name | | typedef asn1_named_data x509_name; | |
| { | | | |
| x509_buf oid; /**< The object identifier. */ | | | |
| x509_buf val; /**< The named value. */ | | | |
| struct _x509_name *next; /**< The next named information object. */ | | | |
| } | | | |
| x509_name; | | | |
| | | | |
| /** | | /** | |
| * Container for a sequence of ASN.1 items | | * Container for a sequence of ASN.1 items | |
| */ | | */ | |
| typedef asn1_sequence x509_sequence; | | typedef asn1_sequence x509_sequence; | |
| | | | |
| /** Container for date and time (precision in seconds). */ | | /** Container for date and time (precision in seconds). */ | |
| typedef struct _x509_time | | typedef struct _x509_time | |
| { | | { | |
| int year, mon, day; /**< Date. */ | | int year, mon, day; /**< Date. */ | |
| int hour, min, sec; /**< Time. */ | | int hour, min, sec; /**< Time. */ | |
| } | | } | |
| x509_time; | | x509_time; | |
| | | | |
|
| /** | | /** \} name Structures for parsing X.509 certificates, CRLs and CSRs */ | |
| * Container for an X.509 certificate. The certificate may be chained. | | | |
| */ | | | |
| typedef struct _x509_cert | | | |
| { | | | |
| x509_buf raw; /**< The raw certificate data (DER). */ | | | |
| x509_buf tbs; /**< The raw certificate body (DER). The pa | | | |
| rt that is To Be Signed. */ | | | |
| | | | |
| int version; /**< The X.509 version. (0=v1, 1=v2, 2=v3) | | | |
| */ | | | |
| x509_buf serial; /**< Unique id for certificate issued by a | | | |
| specific CA. */ | | | |
| x509_buf sig_oid1; /**< Signature algorithm, e.g. sha1RSA */ | | | |
| | | | |
| x509_buf issuer_raw; /**< The raw issuer data (DER). Used for qu | | | |
| ick comparison. */ | | | |
| x509_buf subject_raw; /**< The raw subject data (DER). Used for q | | | |
| uick comparison. */ | | | |
| | | | |
| x509_name issuer; /**< The parsed issuer data (named informat | | | |
| ion object). */ | | | |
| x509_name subject; /**< The parsed subject data (named informa | | | |
| tion object). */ | | | |
| | | | |
| x509_time valid_from; /**< Start time of certificate validity. */ | | | |
| x509_time valid_to; /**< End time of certificate validity. */ | | | |
| | | | |
| x509_buf pk_oid; /**< Subject public key info. Includes the | | | |
| public key algorithm and the key itself. */ | | | |
| rsa_context rsa; /**< Container for the RSA context. Only RS | | | |
| A is supported for public keys at this time. */ | | | |
| | | | |
| x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique ide | | | |
| ntifier. */ | | | |
| x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique id | | | |
| entifier. */ | | | |
| x509_buf v3_ext; /**< Optional X.509 v3 extensions. Only Bas | | | |
| ic Contraints are supported at this time. */ | | | |
| x509_sequence subject_alt_names; /**< Optional list of Subject Alter | | | |
| native Names (Only dNSName supported). */ | | | |
| | | | |
| int ext_types; /**< Bit string containing detected and par | | | |
| sed extensions */ | | | |
| int ca_istrue; /**< Optional Basic Constraint extension va | | | |
| lue: 1 if this certificate belongs to a CA, 0 otherwise. */ | | | |
| int max_pathlen; /**< Optional Basic Constraint extension va | | | |
| lue: The maximum path length to the root certificate. Path length is 1 high | | | |
| er than RFC 5280 'meaning', so 1+ */ | | | |
| | | | |
| unsigned char key_usage; /**< Optional key usage extension value: Se | | | |
| e the values below */ | | | |
| | | | |
| x509_sequence ext_key_usage; /**< Optional list of extended key usage O | | | |
| IDs. */ | | | |
| | | | |
| unsigned char ns_cert_type; /**< Optional Netscape certificate type ext | | | |
| ension value: See the values below */ | | | |
| | | | |
| x509_buf sig_oid2; /**< Signature algorithm. Must match sig_oi | | | |
| d1. */ | | | |
| x509_buf sig; /**< Signature: hash of the tbs part signed | | | |
| with the private key. */ | | | |
| int sig_alg; /**< Internal representation of the signatu | | | |
| re algorithm, e.g. SIG_RSA_MD2 */ | | | |
| | | | |
| struct _x509_cert *next; /**< Next certificate in the CA-chain. */ | | | |
| } | | | |
| x509_cert; | | | |
| | | | |
| /** | | | |
| * Certificate revocation list entry. | | | |
| * Contains the CA-specific serial numbers and revocation dates. | | | |
| */ | | | |
| typedef struct _x509_crl_entry | | | |
| { | | | |
| x509_buf raw; | | | |
| | | | |
| x509_buf serial; | | | |
| | | | |
| x509_time revocation_date; | | | |
| | | | |
| x509_buf entry_ext; | | | |
| | | | |
| struct _x509_crl_entry *next; | | | |
| } | | | |
| x509_crl_entry; | | | |
| | | | |
| /** | | | |
| * Certificate revocation list structure. | | | |
| * Every CRL may have multiple entries. | | | |
| */ | | | |
| typedef struct _x509_crl | | | |
| { | | | |
| x509_buf raw; /**< The raw certificate data (DER). */ | | | |
| x509_buf tbs; /**< The raw certificate body (DER). The part t | | | |
| hat is To Be Signed. */ | | | |
| | | | |
| int version; | | | |
| x509_buf sig_oid1; | | | |
| | | | |
| x509_buf issuer_raw; /**< The raw issuer data (DER). */ | | | |
| | | | |
| x509_name issuer; /**< The parsed issuer data (named information | | | |
| object). */ | | | |
| | | | |
| x509_time this_update; | | | |
| x509_time next_update; | | | |
| | | | |
| x509_crl_entry entry; /**< The CRL entries containing the certificate | | | |
| revocation times for this CA. */ | | | |
| | | | |
| x509_buf crl_ext; | | | |
| | | | |
| x509_buf sig_oid2; | | | |
| x509_buf sig; | | | |
| int sig_alg; | | | |
| | | | |
| struct _x509_crl *next; | | | |
| } | | | |
| x509_crl; | | | |
| /** \} name Structures for parsing X.509 certificates and CRLs */ | | | |
| /** \} addtogroup x509_module */ | | /** \} addtogroup x509_module */ | |
| | | | |
| /** | | /** | |
|
| * \name Structures for writing X.509 certificates. | | | |
| * XvP: commented out as they are not used. | | | |
| * - <tt>typedef struct _x509_node x509_node;</tt> | | | |
| * - <tt>typedef struct _x509_raw x509_raw;</tt> | | | |
| */ | | | |
| /* | | | |
| typedef struct _x509_node | | | |
| { | | | |
| unsigned char *data; | | | |
| unsigned char *p; | | | |
| unsigned char *end; | | | |
| | | | |
| size_t len; | | | |
| } | | | |
| x509_node; | | | |
| | | | |
| typedef struct _x509_raw | | | |
| { | | | |
| x509_node raw; | | | |
| x509_node tbs; | | | |
| | | | |
| x509_node version; | | | |
| x509_node serial; | | | |
| x509_node tbs_signalg; | | | |
| x509_node issuer; | | | |
| x509_node validity; | | | |
| x509_node subject; | | | |
| x509_node subpubkey; | | | |
| | | | |
| x509_node signalg; | | | |
| x509_node sign; | | | |
| } | | | |
| x509_raw; | | | |
| */ | | | |
| | | | |
| #ifdef __cplusplus | | | |
| extern "C" { | | | |
| #endif | | | |
| | | | |
| /** | | | |
| * \name Functions to read in DHM parameters, a certificate, CRL or private | | | |
| RSA key | | | |
| * \{ | | | |
| */ | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Parse a single DER formatted certificate and add it | | | |
| * to the chained list. | | | |
| * | | | |
| * \param chain points to the start of the chain | | | |
| * \param buf buffer holding the certificate DER data | | | |
| * \param buflen size of the buffer | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_crt_der( x509_cert *chain, const unsigned char *buf, size_t b | | | |
| uflen ); | | | |
| | | | |
| /** | | | |
| * \brief Parse one or more certificates and add them | | | |
| * to the chained list. Parses permissively. If some | | | |
| * certificates can be parsed, the result is the number | | | |
| * of failed certificates it encountered. If none complete | | | |
| * correctly, the first error is returned. | | | |
| * | | | |
| * \param chain points to the start of the chain | | | |
| * \param buf buffer holding the certificate data | | | |
| * \param buflen size of the buffer | | | |
| * | | | |
| * \return 0 if all certificates parsed successfully, a positive nu | | | |
| mber | | | |
| * if partly successful or a specific X509 or PEM error cod | | | |
| e | | | |
| */ | | | |
| int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t bufle | | | |
| n ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Load one or more certificates and add them | | | |
| * to the chained list. Parses permissively. If some | | | |
| * certificates can be parsed, the result is the number | | | |
| * of failed certificates it encountered. If none complete | | | |
| * correctly, the first error is returned. | | | |
| * | | | |
| * \param chain points to the start of the chain | | | |
| * \param path filename to read the certificates from | | | |
| * | | | |
| * \return 0 if all certificates parsed successfully, a positive nu | | | |
| mber | | | |
| * if partly successful or a specific X509 or PEM error cod | | | |
| e | | | |
| */ | | | |
| int x509parse_crtfile( x509_cert *chain, const char *path ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Load one or more certificate files from a path and add t | | | |
| hem | | | |
| * to the chained list. Parses permissively. If some | | | |
| * certificates can be parsed, the result is the number | | | |
| * of failed certificates it encountered. If none complete | | | |
| * correctly, the first error is returned. | | | |
| * | | | |
| * \param chain points to the start of the chain | | | |
| * \param path directory / folder to read the certificate files from | | | |
| * | | | |
| * \return 0 if all certificates parsed successfully, a positive nu | | | |
| mber | | | |
| * if partly successful or a specific X509 or PEM error cod | | | |
| e | | | |
| */ | | | |
| int x509parse_crtpath( x509_cert *chain, const char *path ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Parse one or more CRLs and add them | | | |
| * to the chained list | | | |
| * | | | |
| * \param chain points to the start of the chain | | | |
| * \param buf buffer holding the CRL data | | | |
| * \param buflen size of the buffer | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_crl( x509_crl *chain, const unsigned char *buf, size_t buflen | | | |
| ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Load one or more CRLs and add them | | | |
| * to the chained list | | | |
| * | | | |
| * \param chain points to the start of the chain | | | |
| * \param path filename to read the CRLs from | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_crlfile( x509_crl *chain, const char *path ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Parse a private RSA key | | | |
| * | | | |
| * \param rsa RSA context to be initialized | | | |
| * \param key input buffer | | | |
| * \param keylen size of the buffer | | | |
| * \param pwd password for decryption (optional) | | | |
| * \param pwdlen size of the password | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_key( rsa_context *rsa, | | | |
| const unsigned char *key, size_t keylen, | | | |
| const unsigned char *pwd, size_t pwdlen ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Load and parse a private RSA key | | | |
| * | | | |
| * \param rsa RSA context to be initialized | | | |
| * \param path filename to read the private key from | | | |
| * \param password password to decrypt the file (can be NULL) | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_keyfile( rsa_context *rsa, const char *path, | | | |
| const char *password ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Parse a public RSA key | | | |
| * | | | |
| * \param rsa RSA context to be initialized | | | |
| * \param key input buffer | | | |
| * \param keylen size of the buffer | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_public_key( rsa_context *rsa, | | | |
| const unsigned char *key, size_t keylen ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Load and parse a public RSA key | | | |
| * | | | |
| * \param rsa RSA context to be initialized | | | |
| * \param path filename to read the private key from | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_public_keyfile( rsa_context *rsa, const char *path ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Parse DHM parameters | | | |
| * | | | |
| * \param dhm DHM context to be initialized | | | |
| * \param dhmin input buffer | | | |
| * \param dhminlen size of the buffer | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_dhm( dhm_context *dhm, const unsigned char *dhmin, size_t dhm | | | |
| inlen ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Load and parse DHM parameters | | | |
| * | | | |
| * \param dhm DHM context to be initialized | | | |
| * \param path filename to read the DHM Parameters from | | | |
| * | | | |
| * \return 0 if successful, or a specific X509 or PEM error code | | | |
| */ | | | |
| int x509parse_dhmfile( dhm_context *dhm, const char *path ); | | | |
| | | | |
| /** \} name Functions to read in DHM parameters, a certificate, CRL or priv | | | |
| ate RSA key */ | | | |
| | | | |
| /** | | | |
| * \brief Store the certificate DN in printable form into buf; | | * \brief Store the certificate DN in printable form into buf; | |
| * no more than size characters will be written. | | * no more than size characters will be written. | |
| * | | * | |
| * \param buf Buffer to write to | | * \param buf Buffer to write to | |
| * \param size Maximum size of buffer | | * \param size Maximum size of buffer | |
| * \param dn The X509 name to represent | | * \param dn The X509 name to represent | |
| * | | * | |
| * \return The amount of data written to the buffer, or -1 in | | * \return The amount of data written to the buffer, or -1 in | |
| * case of an error. | | * case of an error. | |
| */ | | */ | |
|
| int x509parse_dn_gets( char *buf, size_t size, const x509_name *dn ); | | int x509_dn_gets( char *buf, size_t size, const x509_name *dn ); | |
| | | | |
| /** | | /** | |
| * \brief Store the certificate serial in printable form into buf; | | * \brief Store the certificate serial in printable form into buf; | |
| * no more than size characters will be written. | | * no more than size characters will be written. | |
| * | | * | |
| * \param buf Buffer to write to | | * \param buf Buffer to write to | |
| * \param size Maximum size of buffer | | * \param size Maximum size of buffer | |
| * \param serial The X509 serial to represent | | * \param serial The X509 serial to represent | |
| * | | * | |
| * \return The amount of data written to the buffer, or -1 in | | * \return The amount of data written to the buffer, or -1 in | |
| * case of an error. | | * case of an error. | |
| */ | | */ | |
|
| int x509parse_serial_gets( char *buf, size_t size, const x509_buf *serial ) | | int x509_serial_gets( char *buf, size_t size, const x509_buf *serial ); | |
| ; | | | |
| | | | |
| /** | | | |
| * \brief Returns an informational string about the | | | |
| * certificate. | | | |
| * | | | |
| * \param buf Buffer to write to | | | |
| * \param size Maximum size of buffer | | | |
| * \param prefix A line prefix | | | |
| * \param crt The X509 certificate to represent | | | |
| * | | | |
| * \return The amount of data written to the buffer, or -1 in | | | |
| * case of an error. | | | |
| */ | | | |
| int x509parse_cert_info( char *buf, size_t size, const char *prefix, | | | |
| const x509_cert *crt ); | | | |
| | | | |
| /** | | | |
| * \brief Returns an informational string about the | | | |
| * CRL. | | | |
| * | | | |
| * \param buf Buffer to write to | | | |
| * \param size Maximum size of buffer | | | |
| * \param prefix A line prefix | | | |
| * \param crl The X509 CRL to represent | | | |
| * | | | |
| * \return The amount of data written to the buffer, or -1 in | | | |
| * case of an error. | | | |
| */ | | | |
| int x509parse_crl_info( char *buf, size_t size, const char *prefix, | | | |
| const x509_crl *crl ); | | | |
| | | | |
| /** | | /** | |
| * \brief Give an known OID, return its descriptive string. | | * \brief Give an known OID, return its descriptive string. | |
| * | | * | |
| * \param oid buffer containing the oid | | * \param oid buffer containing the oid | |
| * | | * | |
| * \return Return a string if the OID is known, | | * \return Return a string if the OID is known, | |
| * or NULL otherwise. | | * or NULL otherwise. | |
| */ | | */ | |
| const char *x509_oid_get_description( x509_buf *oid ); | | const char *x509_oid_get_description( x509_buf *oid ); | |
| | | | |
| /** | | /** | |
| * \brief Give an OID, return a string version of its OID number. | | * \brief Give an OID, return a string version of its OID number. | |
|
| | | * (Deprecated. Use oid_get_numeric_string() instead) | |
| * | | * | |
| * \param buf Buffer to write to | | * \param buf Buffer to write to | |
| * \param size Maximum size of buffer | | * \param size Maximum size of buffer | |
| * \param oid Buffer containing the OID | | * \param oid Buffer containing the OID | |
| * | | * | |
| * \return The amount of data written to the buffer, or -1 in | | * \return The amount of data written to the buffer, or -1 in | |
| * case of an error. | | * case of an error. | |
| */ | | */ | |
| int x509_oid_get_numeric_string( char *buf, size_t size, x509_buf *oid ); | | int x509_oid_get_numeric_string( char *buf, size_t size, x509_buf *oid ); | |
| | | | |
| /** | | /** | |
| * \brief Check a given x509_time against the system time and chec
k | | * \brief Check a given x509_time against the system time and chec
k | |
| * if it is valid. | | * if it is valid. | |
| * | | * | |
| * \param time x509_time to check | | * \param time x509_time to check | |
| * | | * | |
| * \return Return 0 if the x509_time is still valid, | | * \return Return 0 if the x509_time is still valid, | |
| * or 1 otherwise. | | * or 1 otherwise. | |
| */ | | */ | |
|
| int x509parse_time_expired( const x509_time *time ); | | int x509_time_expired( const x509_time *time ); | |
| | | | |
| /** | | | |
| * \name Functions to verify a certificate | | | |
| * \{ | | | |
| */ | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Verify the certificate signature | | | |
| * | | | |
| * The verify callback is a user-supplied callback that | | | |
| * can clear / modify / add flags for a certificate. If set | | | |
| , | | | |
| * the verification callback is called for each | | | |
| * certificate in the chain (from the trust-ca down to the | | | |
| * presented crt). The parameters for the callback are: | | | |
| * (void *parameter, x509_cert *crt, int certificate_depth, | | | |
| * int *flags). With the flags representing current flags f | | | |
| or | | | |
| * that specific certificate and the certificate depth from | | | |
| * the bottom (Peer cert depth = 0). | | | |
| * | | | |
| * All flags left after returning from the callback | | | |
| * are also returned to the application. The function shoul | | | |
| d | | | |
| * return 0 for anything but a fatal error. | | | |
| * | | | |
| * \param crt a certificate to be verified | | | |
| * \param trust_ca the trusted CA chain | | | |
| * \param ca_crl the CRL chain for trusted CA's | | | |
| * \param cn expected Common Name (can be set to | | | |
| * NULL if the CN must not be verified) | | | |
| * \param flags result of the verification | | | |
| * \param f_vrfy verification function | | | |
| * \param p_vrfy verification parameter | | | |
| * | | | |
| * \return 0 if successful or POLARSSL_ERR_X509_SIG_VERIFY_FAILED, | | | |
| * in which case *flags will have one or more of | | | |
| * the following values set: | | | |
| * BADCERT_EXPIRED -- | | | |
| * BADCERT_REVOKED -- | | | |
| * BADCERT_CN_MISMATCH -- | | | |
| * BADCERT_NOT_TRUSTED | | | |
| * or another error in case of a fatal error encountered | | | |
| * during the verification process. | | | |
| */ | | | |
| int x509parse_verify( x509_cert *crt, | | | |
| x509_cert *trust_ca, | | | |
| x509_crl *ca_crl, | | | |
| const char *cn, int *flags, | | | |
| int (*f_vrfy)(void *, x509_cert *, int, int *), | | | |
| void *p_vrfy ); | | | |
| | | | |
| /** | | | |
| * \brief Verify the certificate signature | | | |
| * | | | |
| * \param crt a certificate to be verified | | | |
| * \param crl the CRL to verify against | | | |
| * | | | |
| * \return 1 if the certificate is revoked, 0 otherwise | | | |
| * | | | |
| */ | | | |
| int x509parse_revoked( const x509_cert *crt, const x509_crl *crl ); | | | |
| | | | |
| /** \} name Functions to verify a certificate */ | | | |
| | | | |
| /** | | | |
| * \name Functions to clear a certificate, CRL or private RSA key | | | |
| * \{ | | | |
| */ | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Unallocate all certificate data | | | |
| * | | | |
| * \param crt Certificate chain to free | | | |
| */ | | | |
| void x509_free( x509_cert *crt ); | | | |
| | | | |
| /** \ingroup x509_module */ | | | |
| /** | | | |
| * \brief Unallocate all CRL data | | | |
| * | | | |
| * \param crl CRL chain to free | | | |
| */ | | | |
| void x509_crl_free( x509_crl *crl ); | | | |
| | | | |
| /** \} name Functions to clear a certificate, CRL or private RSA key */ | | | |
| | | | |
| /** | | /** | |
| * \brief Checkup routine | | * \brief Checkup routine | |
| * | | * | |
| * \return 0 if successful, or 1 if the test failed | | * \return 0 if successful, or 1 if the test failed | |
| */ | | */ | |
| int x509_self_test( int verbose ); | | int x509_self_test( int verbose ); | |
| | | | |
|
| | | /* | |
| | | * Internal module functions. You probably do not want to use these unless | |
| | | you | |
| | | * know you do. | |
| | | */ | |
| | | int x509_get_name( unsigned char **p, const unsigned char *end, | |
| | | x509_name *cur ); | |
| | | int x509_get_alg_null( unsigned char **p, const unsigned char *end, | |
| | | x509_buf *alg ); | |
| | | int x509_get_sig( unsigned char **p, const unsigned char *end, x509_buf *si | |
| | | g ); | |
| | | int x509_get_sig_alg( const x509_buf *sig_oid, md_type_t *md_alg, | |
| | | pk_type_t *pk_alg ); | |
| | | int x509_get_time( unsigned char **p, const unsigned char *end, | |
| | | x509_time *time ); | |
| | | int x509_get_serial( unsigned char **p, const unsigned char *end, | |
| | | x509_buf *serial ); | |
| | | int x509_get_ext( unsigned char **p, const unsigned char *end, | |
| | | x509_buf *ext, int tag ); | |
| | | int x509_load_file( const char *path, unsigned char **buf, size_t *n ); | |
| | | int x509_key_size_helper( char *buf, size_t size, const char *name ); | |
| | | int x509_string_to_names( asn1_named_data **head, char *name ); | |
| | | int x509_set_extension( asn1_named_data **head, const char *oid, size_t oid | |
| | | _len, int critical, const unsigned char *val, size_t | |
| | | val_len ); | |
| | | int x509_write_extensions( unsigned char **p, unsigned char *start, | |
| | | asn1_named_data *first ); | |
| | | int x509_write_names( unsigned char **p, unsigned char *start, | |
| | | asn1_named_data *first ); | |
| | | int x509_write_sig( unsigned char **p, unsigned char *start, | |
| | | const char *oid, size_t oid_len, | |
| | | unsigned char *sig, size_t size ); | |
| | | | |
| #ifdef __cplusplus | | #ifdef __cplusplus | |
| } | | } | |
| #endif | | #endif | |
| | | | |
| #endif /* x509.h */ | | #endif /* x509.h */ | |
| | | | |
| End of changes. 19 change blocks. |
|---|
| 654 lines changed or deleted | | 89 lines changed or added | |
|---|
|