1 /* $OpenBSD: tls_internal.h,v 1.65 2017/09/20 17:05:17 jsing Exp $ */ 2 /* 3 * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org> 4 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #ifndef HEADER_TLS_INTERNAL_H 20 #define HEADER_TLS_INTERNAL_H 21 22 #include <arpa/inet.h> 23 #include <netinet/in.h> 24 25 #include <openssl/ssl.h> 26 27 __BEGIN_HIDDEN_DECLS 28 29 #define _PATH_SSL_CA_FILE "/etc/ssl/cert.pem" 30 31 #define TLS_CIPHERS_DEFAULT "TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE" 32 #define TLS_CIPHERS_COMPAT "HIGH:!aNULL" 33 #define TLS_CIPHERS_LEGACY "HIGH:MEDIUM:!aNULL" 34 #define TLS_CIPHERS_ALL "ALL:!aNULL:!eNULL" 35 36 #define TLS_ECDHE_CURVES "X25519,P-256,P-384" 37 38 union tls_addr { 39 struct in_addr ip4; 40 struct in6_addr ip6; 41 }; 42 43 struct tls_error { 44 char *msg; 45 int num; 46 int tls; 47 }; 48 49 struct tls_keypair { 50 struct tls_keypair *next; 51 52 char *cert_mem; 53 size_t cert_len; 54 char *key_mem; 55 size_t key_len; 56 char *ocsp_staple; 57 size_t ocsp_staple_len; 58 char *pubkey_hash; 59 }; 60 61 #define TLS_MIN_SESSION_TIMEOUT (4) 62 #define TLS_MAX_SESSION_TIMEOUT (24 * 60 * 60) 63 64 #define TLS_NUM_TICKETS 4 65 #define TLS_TICKET_NAME_SIZE 16 66 #define TLS_TICKET_AES_SIZE 32 67 #define TLS_TICKET_HMAC_SIZE 16 68 69 struct tls_ticket_key { 70 /* The key_name must be 16 bytes according to -lssl */ 71 unsigned char key_name[TLS_TICKET_NAME_SIZE]; 72 unsigned char aes_key[TLS_TICKET_AES_SIZE]; 73 unsigned char hmac_key[TLS_TICKET_HMAC_SIZE]; 74 time_t time; 75 }; 76 77 struct tls_config { 78 struct tls_error error; 79 80 int refcount; 81 82 char *alpn; 83 size_t alpn_len; 84 const char *ca_path; 85 char *ca_mem; 86 size_t ca_len; 87 const char *ciphers; 88 int ciphers_server; 89 char *crl_mem; 90 size_t crl_len; 91 int dheparams; 92 int *ecdhecurves; 93 size_t ecdhecurves_len; 94 struct tls_keypair *keypair; 95 int ocsp_require_stapling; 96 uint32_t protocols; 97 unsigned char session_id[TLS_MAX_SESSION_ID_LENGTH]; 98 int session_lifetime; 99 struct tls_ticket_key ticket_keys[TLS_NUM_TICKETS]; 100 uint32_t ticket_keyrev; 101 int ticket_autorekey; 102 int verify_cert; 103 int verify_client; 104 int verify_depth; 105 int verify_name; 106 int verify_time; 107 int skip_private_key_check; 108 }; 109 110 struct tls_conninfo { 111 char *alpn; 112 char *cipher; 113 char *servername; 114 char *version; 115 116 char *hash; 117 char *issuer; 118 char *subject; 119 120 uint8_t *peer_cert; 121 size_t peer_cert_len; 122 123 time_t notbefore; 124 time_t notafter; 125 }; 126 127 #define TLS_CLIENT (1 << 0) 128 #define TLS_SERVER (1 << 1) 129 #define TLS_SERVER_CONN (1 << 2) 130 131 #define TLS_EOF_NO_CLOSE_NOTIFY (1 << 0) 132 #define TLS_CONNECTED (1 << 1) 133 #define TLS_HANDSHAKE_COMPLETE (1 << 2) 134 #define TLS_SSL_NEEDS_SHUTDOWN (1 << 3) 135 136 struct tls_ocsp_result { 137 const char *result_msg; 138 int response_status; 139 int cert_status; 140 int crl_reason; 141 time_t this_update; 142 time_t next_update; 143 time_t revocation_time; 144 }; 145 146 struct tls_ocsp { 147 /* responder location */ 148 char *ocsp_url; 149 150 /* cert data, this struct does not own these */ 151 X509 *main_cert; 152 STACK_OF(X509) *extra_certs; 153 154 struct tls_ocsp_result *ocsp_result; 155 }; 156 157 struct tls_sni_ctx { 158 struct tls_sni_ctx *next; 159 160 struct tls_keypair *keypair; 161 162 SSL_CTX *ssl_ctx; 163 X509 *ssl_cert; 164 }; 165 166 struct tls { 167 struct tls_config *config; 168 struct tls_keypair *keypair; 169 170 struct tls_error error; 171 172 uint32_t flags; 173 uint32_t state; 174 175 char *servername; 176 int socket; 177 178 SSL *ssl_conn; 179 SSL_CTX *ssl_ctx; 180 181 struct tls_sni_ctx *sni_ctx; 182 183 X509 *ssl_peer_cert; 184 STACK_OF(X509) *ssl_peer_chain; 185 186 struct tls_conninfo *conninfo; 187 188 struct tls_ocsp *ocsp; 189 190 tls_read_cb read_cb; 191 tls_write_cb write_cb; 192 void *cb_arg; 193 }; 194 195 struct tls_sni_ctx *tls_sni_ctx_new(void); 196 void tls_sni_ctx_free(struct tls_sni_ctx *sni_ctx); 197 198 struct tls *tls_new(void); 199 struct tls *tls_server_conn(struct tls *ctx); 200 201 int tls_check_name(struct tls *ctx, X509 *cert, const char *servername, 202 int *match); 203 int tls_configure_server(struct tls *ctx); 204 205 int tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx); 206 int tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx, 207 struct tls_keypair *keypair, int required); 208 int tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify); 209 210 int tls_handshake_client(struct tls *ctx); 211 int tls_handshake_server(struct tls *ctx); 212 213 int tls_config_load_file(struct tls_error *error, const char *filetype, 214 const char *filename, char **buf, size_t *len); 215 int tls_config_ticket_autorekey(struct tls_config *config); 216 int tls_host_port(const char *hostport, char **host, char **port); 217 218 int tls_set_cbs(struct tls *ctx, 219 tls_read_cb read_cb, tls_write_cb write_cb, void *cb_arg); 220 221 void tls_error_clear(struct tls_error *error); 222 int tls_error_set(struct tls_error *error, const char *fmt, ...) 223 __attribute__((__format__ (printf, 2, 3))) 224 __attribute__((__nonnull__ (2))); 225 int tls_error_setx(struct tls_error *error, const char *fmt, ...) 226 __attribute__((__format__ (printf, 2, 3))) 227 __attribute__((__nonnull__ (2))); 228 int tls_config_set_error(struct tls_config *cfg, const char *fmt, ...) 229 __attribute__((__format__ (printf, 2, 3))) 230 __attribute__((__nonnull__ (2))); 231 int tls_config_set_errorx(struct tls_config *cfg, const char *fmt, ...) 232 __attribute__((__format__ (printf, 2, 3))) 233 __attribute__((__nonnull__ (2))); 234 int tls_set_error(struct tls *ctx, const char *fmt, ...) 235 __attribute__((__format__ (printf, 2, 3))) 236 __attribute__((__nonnull__ (2))); 237 int tls_set_errorx(struct tls *ctx, const char *fmt, ...) 238 __attribute__((__format__ (printf, 2, 3))) 239 __attribute__((__nonnull__ (2))); 240 int tls_set_ssl_errorx(struct tls *ctx, const char *fmt, ...) 241 __attribute__((__format__ (printf, 2, 3))) 242 __attribute__((__nonnull__ (2))); 243 244 int tls_ssl_error(struct tls *ctx, SSL *ssl_conn, int ssl_ret, 245 const char *prefix); 246 247 int tls_conninfo_populate(struct tls *ctx); 248 void tls_conninfo_free(struct tls_conninfo *conninfo); 249 250 int tls_ocsp_verify_cb(SSL *ssl, void *arg); 251 int tls_ocsp_stapling_cb(SSL *ssl, void *arg); 252 void tls_ocsp_free(struct tls_ocsp *ctx); 253 struct tls_ocsp *tls_ocsp_setup_from_peer(struct tls *ctx); 254 int tls_hex_string(const unsigned char *_in, size_t _inlen, char **_out, 255 size_t *_outlen); 256 int tls_cert_hash(X509 *_cert, char **_hash); 257 258 int tls_password_cb(char *_buf, int _size, int _rwflag, void *_u); 259 260 __END_HIDDEN_DECLS 261 262 /* XXX this function is not fully hidden so relayd can use it */ 263 void tls_config_skip_private_key_check(struct tls_config *config); 264 265 #endif /* HEADER_TLS_INTERNAL_H */ 266