mirror of
https://github.com/FreeRTOS/FreeRTOS-Kernel.git
synced 2025-12-15 16:15:08 -05:00
Update wolfSSL to the latest version(v.4.5.0) (#303)
* deleted old version wolfSSL before updating * updated wolfSSL to the latest version(v4.4.0) * updated wolfSSL to the latest version(v4.4.0) * added macros for timing resistance * Add wolfSSL-FIPS-Ready to Demo and Source * Add wolfSSL-FIPS-Ready to Demo and Source * Update README_wolfSSL_FIPS_Ready.md * Remove unused files * Update to wolfSSL-4.5.0-FIPS-Ready * Increase FIPS version number for the default * Update wolfSSL to the latest version(v.4.5.0) * Fix version number * Fix comments from github Co-authored-by: RichardBarry <3073890+RichardBarry@users.noreply.github.com> Co-authored-by: Ming Yue <mingyue86010@gmail.com> Co-authored-by: Aniruddha Kanhere <60444055+AniruddhaKanhere@users.noreply.github.com> Co-authored-by: Cobus van Eeden <35851496+cobusve@users.noreply.github.com> Co-authored-by: Alfred Gedeon <alfred2g@hotmail.com>
This commit is contained in:
TakayukiMatsuo
GitHub
parent
ee588710dd
commit
c44794cd11
471 changed files with 792175 additions and 60158 deletions
|
|
@ -72,6 +72,9 @@
|
|||
#ifndef NO_SHA256
|
||||
#include <wolfssl/wolfcrypt/sha256.h>
|
||||
#endif
|
||||
#if defined(WOLFSSL_SHA384)
|
||||
#include <wolfssl/wolfcrypt/sha512.h>
|
||||
#endif
|
||||
#ifdef HAVE_OCSP
|
||||
#include <wolfssl/ocsp.h>
|
||||
#endif
|
||||
|
|
@ -858,11 +861,13 @@
|
|||
|
||||
#if defined(BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256) || \
|
||||
defined(BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) || \
|
||||
defined(BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) || \
|
||||
defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) || \
|
||||
defined(BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256) || \
|
||||
defined(BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256) || \
|
||||
defined(BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384) || \
|
||||
defined(BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) || \
|
||||
defined(BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) || \
|
||||
defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) || \
|
||||
defined(BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384) || \
|
||||
defined(BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384) || \
|
||||
|
|
@ -1149,7 +1154,7 @@ enum {
|
|||
/* set maximum DH key size allowed */
|
||||
#ifndef WOLFSSL_MAX_DHKEY_BITS
|
||||
#if (defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS >= 16384)
|
||||
#define WOLFSSL_MAX_DHKEY_BITS 8192
|
||||
#define WOLFSSL_MAX_DHKEY_BITS (FP_MAX_BITS / 2)
|
||||
#else
|
||||
#define WOLFSSL_MAX_DHKEY_BITS 4096
|
||||
#endif
|
||||
|
|
@ -1165,7 +1170,8 @@ enum {
|
|||
#ifndef MAX_PSK_ID_LEN
|
||||
/* max psk identity/hint supported */
|
||||
#if defined(WOLFSSL_TLS13)
|
||||
#define MAX_PSK_ID_LEN 256
|
||||
/* OpenSSL has a 1472 byte sessiont ticket */
|
||||
#define MAX_PSK_ID_LEN 1536
|
||||
#else
|
||||
#define MAX_PSK_ID_LEN 128
|
||||
#endif
|
||||
|
|
@ -1176,6 +1182,17 @@ enum {
|
|||
#define MAX_EARLY_DATA_SZ 4096
|
||||
#endif
|
||||
|
||||
#ifndef WOLFSSL_MAX_RSA_BITS
|
||||
#if (defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS >= 16384)
|
||||
#define WOLFSSL_MAX_RSA_BITS (FP_MAX_BITS / 2)
|
||||
#else
|
||||
#define WOLFSSL_MAX_RSA_BITS 4096
|
||||
#endif
|
||||
#endif
|
||||
#if (WOLFSSL_MAX_RSA_BITS % 8)
|
||||
#error RSA maximum bit size must be multiple of 8
|
||||
#endif
|
||||
|
||||
enum Misc {
|
||||
CIPHER_BYTE = 0x00, /* Default ciphers */
|
||||
ECC_BYTE = 0xC0, /* ECC first cipher suite byte */
|
||||
|
|
@ -1196,19 +1213,6 @@ enum Misc {
|
|||
TLSv1_2_MINOR = 3, /* TLSv1_2 minor version number */
|
||||
TLSv1_3_MINOR = 4, /* TLSv1_3 minor version number */
|
||||
TLS_DRAFT_MAJOR = 0x7f, /* Draft TLS major version number */
|
||||
#ifdef WOLFSSL_TLS13_DRAFT
|
||||
#ifdef WOLFSSL_TLS13_DRAFT_18
|
||||
TLS_DRAFT_MINOR = 0x12, /* Minor version number of TLS draft */
|
||||
#elif defined(WOLFSSL_TLS13_DRAFT_22)
|
||||
TLS_DRAFT_MINOR = 0x16, /* Minor version number of TLS draft */
|
||||
#elif defined(WOLFSSL_TLS13_DRAFT_23)
|
||||
TLS_DRAFT_MINOR = 0x17, /* Minor version number of TLS draft */
|
||||
#elif defined(WOLFSSL_TLS13_DRAFT_26)
|
||||
TLS_DRAFT_MINOR = 0x1a, /* Minor version number of TLS draft */
|
||||
#else
|
||||
TLS_DRAFT_MINOR = 0x1c, /* Minor version number of TLS draft */
|
||||
#endif
|
||||
#endif
|
||||
OLD_HELLO_ID = 0x01, /* SSLv2 Client Hello Indicator */
|
||||
INVALID_BYTE = 0xff, /* Used to initialize cipher specs values */
|
||||
NO_COMPRESSION = 0,
|
||||
|
|
@ -1218,9 +1222,9 @@ enum Misc {
|
|||
SECRET_LEN = WOLFSSL_MAX_MASTER_KEY_LENGTH,
|
||||
/* pre RSA and all master */
|
||||
#if defined(WOLFSSL_MYSQL_COMPATIBLE) || \
|
||||
(defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS > 8192)
|
||||
(defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS >= 16384)
|
||||
#ifndef NO_PSK
|
||||
ENCRYPT_LEN = 1024 + MAX_PSK_ID_LEN + 2, /* 8192 bit static buffer */
|
||||
ENCRYPT_LEN = (FP_MAX_BITS / 2 / 8) + MAX_PSK_ID_LEN + 2,
|
||||
#else
|
||||
ENCRYPT_LEN = 1024, /* allow 8192 bit static buffer */
|
||||
#endif
|
||||
|
|
@ -1344,10 +1348,21 @@ enum Misc {
|
|||
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))
|
||||
MAX_SYM_KEY_SIZE = AES_256_KEY_SIZE,
|
||||
#else
|
||||
MAX_SYM_KEY_SIZE = WC_MAX_SYM_KEY_SIZE,
|
||||
#if defined(HAVE_NULL_CIPHER) && defined(WOLFSSL_TLS13)
|
||||
#if defined(WOLFSSL_SHA384) && WC_MAX_SYM_KEY_SIZE < 48
|
||||
MAX_SYM_KEY_SIZE = WC_SHA384_DIGEST_SIZE,
|
||||
#elif !defined(NO_SHA256) && WC_MAX_SYM_KEY_SIZE < 32
|
||||
MAX_SYM_KEY_SIZE = WC_SHA256_DIGEST_SIZE,
|
||||
#else
|
||||
MAX_SYM_KEY_SIZE = WC_MAX_SYM_KEY_SIZE,
|
||||
#endif
|
||||
#else
|
||||
MAX_SYM_KEY_SIZE = WC_MAX_SYM_KEY_SIZE,
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_SELFTEST
|
||||
#if defined(HAVE_SELFTEST) && \
|
||||
(!defined(HAVE_SELFTEST_VERSION) || (HAVE_SELFTEST_VERSION < 2))
|
||||
#ifndef WOLFSSL_AES_KEY_SIZE_ENUM
|
||||
#define WOLFSSL_AES_KEY_SIZE_ENUM
|
||||
AES_IV_SIZE = 16,
|
||||
|
|
@ -1418,7 +1433,7 @@ enum Misc {
|
|||
MIN_RSA_SHA384_PSS_BITS = 384 * 2 + 8 * 8, /* Min key size */
|
||||
|
||||
#ifndef NO_RSA
|
||||
MAX_CERT_VERIFY_SZ = 4096 / 8, /* max RSA - default 4096-bits */
|
||||
MAX_CERT_VERIFY_SZ = WOLFSSL_MAX_RSA_BITS / 8, /* max RSA bytes */
|
||||
#elif defined(HAVE_ECC)
|
||||
MAX_CERT_VERIFY_SZ = ECC_MAX_SIG_SIZE, /* max ECC */
|
||||
#elif defined(HAVE_ED448)
|
||||
|
|
@ -1491,7 +1506,7 @@ enum Misc {
|
|||
|
||||
/* number of items in the signature algo list */
|
||||
#ifndef WOLFSSL_MAX_SIGALGO
|
||||
#define WOLFSSL_MAX_SIGALGO 32
|
||||
#define WOLFSSL_MAX_SIGALGO 36
|
||||
#endif
|
||||
|
||||
|
||||
|
|
@ -1579,6 +1594,7 @@ enum states {
|
|||
SERVER_HELLO_COMPLETE,
|
||||
SERVER_ENCRYPTED_EXTENSIONS_COMPLETE,
|
||||
SERVER_CERT_COMPLETE,
|
||||
SERVER_CERT_VERIFY_COMPLETE,
|
||||
SERVER_KEYEXCHANGE_COMPLETE,
|
||||
SERVER_HELLODONE_COMPLETE,
|
||||
SERVER_CHANGECIPHERSPEC_COMPLETE,
|
||||
|
|
@ -1646,6 +1662,10 @@ WOLFSSL_LOCAL int InitSSL_Side(WOLFSSL* ssl, word16 side);
|
|||
/* for sniffer */
|
||||
WOLFSSL_LOCAL int DoFinished(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
||||
word32 size, word32 totalSz, int sniff);
|
||||
#ifdef WOLFSSL_TLS13
|
||||
WOLFSSL_LOCAL int DoTls13Finished(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
||||
word32 size, word32 totalSz, int sniff);
|
||||
#endif
|
||||
WOLFSSL_LOCAL int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx);
|
||||
/* TLS v1.3 needs these */
|
||||
WOLFSSL_LOCAL int HandleTlsResumption(WOLFSSL* ssl, int bogusID,
|
||||
|
|
@ -1677,16 +1697,15 @@ WOLFSSL_LOCAL void FreeSuites(WOLFSSL* ssl);
|
|||
WOLFSSL_LOCAL int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, word32 size);
|
||||
WOLFSSL_LOCAL int MatchDomainName(const char* pattern, int len, const char* str);
|
||||
#ifndef NO_CERTS
|
||||
WOLFSSL_LOCAL int CheckAltNames(DecodedCert* dCert, char* domain);
|
||||
#ifdef OPENSSL_EXTRA
|
||||
WOLFSSL_LOCAL int CheckIPAddr(DecodedCert* dCert, char* ipasc);
|
||||
#endif
|
||||
WOLFSSL_LOCAL int CheckForAltNames(DecodedCert* dCert, const char* domain, int* checkCN);
|
||||
WOLFSSL_LOCAL int CheckIPAddr(DecodedCert* dCert, const char* ipasc);
|
||||
#endif
|
||||
WOLFSSL_LOCAL int CreateTicket(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int HashOutputRaw(WOLFSSL* ssl, const byte* output, int sz);
|
||||
WOLFSSL_LOCAL int HashRaw(WOLFSSL* ssl, const byte* output, int sz);
|
||||
WOLFSSL_LOCAL int HashOutput(WOLFSSL* ssl, const byte* output, int sz,
|
||||
int ivSz);
|
||||
WOLFSSL_LOCAL int HashInput(WOLFSSL* ssl, const byte* input, int sz);
|
||||
|
||||
#if defined(OPENSSL_ALL) || defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
|
||||
WOLFSSL_LOCAL int SNI_Callback(WOLFSSL* ssl);
|
||||
#endif
|
||||
|
|
@ -1829,11 +1848,10 @@ WOLFSSL_LOCAL int SetCipherList(WOLFSSL_CTX*, Suites*, const char* list);
|
|||
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
||||
#define MAX_DESCRIPTION_SZ 255
|
||||
#endif
|
||||
/* wolfSSL Cipher type just points back to SSL */
|
||||
struct WOLFSSL_CIPHER {
|
||||
byte cipherSuite0;
|
||||
byte cipherSuite;
|
||||
WOLFSSL* ssl;
|
||||
const WOLFSSL* ssl;
|
||||
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
||||
char description[MAX_DESCRIPTION_SZ];
|
||||
unsigned long offset;
|
||||
|
|
@ -2121,8 +2139,10 @@ typedef struct Keys {
|
|||
byte keyUpdateRespond:1; /* KeyUpdate is to be responded to. */
|
||||
#endif
|
||||
#ifdef WOLFSSL_RENESAS_TSIP_TLS
|
||||
byte tsip_client_write_MAC_secret[TSIP_TLS_HMAC_KEY_INDEX_WORDSIZE];
|
||||
byte tsip_server_write_MAC_secret[TSIP_TLS_HMAC_KEY_INDEX_WORDSIZE];
|
||||
|
||||
tsip_hmac_sha_key_index_t tsip_client_write_MAC_secret;
|
||||
tsip_hmac_sha_key_index_t tsip_server_write_MAC_secret;
|
||||
|
||||
#endif
|
||||
} Keys;
|
||||
|
||||
|
|
@ -2140,13 +2160,14 @@ typedef enum {
|
|||
TLSX_SUPPORTED_GROUPS = 0x000a, /* a.k.a. Supported Curves */
|
||||
TLSX_EC_POINT_FORMATS = 0x000b,
|
||||
#if !defined(WOLFSSL_NO_SIGALG)
|
||||
TLSX_SIGNATURE_ALGORITHMS = 0x000d,
|
||||
TLSX_SIGNATURE_ALGORITHMS = 0x000d, /* HELLO_EXT_SIG_ALGO */
|
||||
#endif
|
||||
TLSX_APPLICATION_LAYER_PROTOCOL = 0x0010, /* a.k.a. ALPN */
|
||||
TLSX_STATUS_REQUEST_V2 = 0x0011, /* a.k.a. OCSP stapling v2 */
|
||||
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
||||
TLSX_ENCRYPT_THEN_MAC = 0x0016, /* RFC 7366 */
|
||||
#endif
|
||||
TLSX_EXTENDED_MASTER_SECRET = 0x0017, /* HELLO_EXT_EXTMS */
|
||||
TLSX_QUANTUM_SAFE_HYBRID = 0x0018, /* a.k.a. QSH */
|
||||
TLSX_SESSION_TICKET = 0x0023,
|
||||
#ifdef WOLFSSL_TLS13
|
||||
|
|
@ -2164,12 +2185,8 @@ typedef enum {
|
|||
#ifdef WOLFSSL_POST_HANDSHAKE_AUTH
|
||||
TLSX_POST_HANDSHAKE_AUTH = 0x0031,
|
||||
#endif
|
||||
#if defined(WOLFSSL_TLS13_DRAFT_18) || defined(WOLFSSL_TLS13_DRAFT_22)
|
||||
TLSX_KEY_SHARE = 0x0028,
|
||||
#else
|
||||
TLSX_SIGNATURE_ALGORITHMS_CERT = 0x0032,
|
||||
TLSX_KEY_SHARE = 0x0033,
|
||||
#endif
|
||||
#endif
|
||||
TLSX_RENEGOTIATION_INFO = 0xff01
|
||||
} TLSX_Type;
|
||||
|
|
@ -2511,7 +2528,6 @@ WOLFSSL_LOCAL int TLSX_KeyShare_DeriveSecret(WOLFSSL* ssl);
|
|||
|
||||
|
||||
#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
|
||||
#ifndef WOLFSSL_TLS13_DRAFT_18
|
||||
/* Ticket nonce - for deriving PSK.
|
||||
* Length allowed to be: 1..255. Only support 4 bytes.
|
||||
*/
|
||||
|
|
@ -2519,7 +2535,6 @@ typedef struct TicketNonce {
|
|||
byte len;
|
||||
byte data[MAX_TICKET_NONCE_SZ];
|
||||
} TicketNonce;
|
||||
#endif
|
||||
|
||||
/* The PreSharedKey extension information - entry in a linked list. */
|
||||
typedef struct PreSharedKey {
|
||||
|
|
@ -2575,6 +2590,13 @@ enum DeriveKeyType {
|
|||
update_traffic_key
|
||||
};
|
||||
|
||||
WOLFSSL_LOCAL int DeriveEarlySecret(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int DeriveHandshakeSecret(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int DeriveTls13Keys(WOLFSSL* ssl, int secret, int side, int store);
|
||||
WOLFSSL_LOCAL int DeriveMasterSecret(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int DeriveResumptionPSK(WOLFSSL* ssl, byte* nonce, byte nonceLen, byte* secret);
|
||||
WOLFSSL_LOCAL int DeriveResumptionSecret(WOLFSSL* ssl, byte* key);
|
||||
|
||||
/* The key update request values for KeyUpdate message. */
|
||||
enum KeyUpdateRequest {
|
||||
update_not_requested,
|
||||
|
|
@ -2591,6 +2613,14 @@ enum SetCBIO {
|
|||
};
|
||||
#endif
|
||||
|
||||
#ifdef WOLFSSL_STATIC_EPHEMERAL
|
||||
typedef struct {
|
||||
int keyAlgo;
|
||||
DerBuffer* key;
|
||||
} StaticKeyExchangeInfo_t;
|
||||
#endif
|
||||
|
||||
|
||||
/* wolfSSL context type */
|
||||
struct WOLFSSL_CTX {
|
||||
WOLFSSL_METHOD* method;
|
||||
|
|
@ -2699,9 +2729,7 @@ struct WOLFSSL_CTX {
|
|||
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
|
||||
short minEccKeySz; /* minimum ECC key size */
|
||||
#endif
|
||||
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
|
||||
unsigned long mask; /* store SSL_OP_ flags */
|
||||
#endif
|
||||
#ifdef OPENSSL_EXTRA
|
||||
byte sessionCtx[ID_LEN]; /* app session context ID */
|
||||
word32 disabledCurves; /* curves disabled by user */
|
||||
|
|
@ -2744,6 +2772,7 @@ struct WOLFSSL_CTX {
|
|||
wc_psk_client_tls13_callback client_psk_tls13_cb; /* client callback */
|
||||
wc_psk_server_tls13_callback server_psk_tls13_cb; /* server callback */
|
||||
#endif
|
||||
void* psk_ctx;
|
||||
char server_hint[MAX_PSK_ID_LEN + NULL_TERM_LEN];
|
||||
#endif /* HAVE_SESSION_TICKET || !NO_PSK */
|
||||
#ifdef WOLFSSL_TLS13
|
||||
|
|
@ -2760,7 +2789,7 @@ struct WOLFSSL_CTX {
|
|||
pem_password_cb* passwd_cb;
|
||||
void* passwd_userdata;
|
||||
#endif
|
||||
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
|
||||
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL)
|
||||
WOLFSSL_X509_STORE x509_store; /* points to ctx->cm */
|
||||
WOLFSSL_X509_STORE* x509_store_pt; /* take ownership of external store */
|
||||
byte readAhead;
|
||||
|
|
@ -2865,16 +2894,19 @@ struct WOLFSSL_CTX {
|
|||
#endif /* NO_RSA */
|
||||
#endif /* HAVE_PK_CALLBACKS */
|
||||
#ifdef HAVE_WOLF_EVENT
|
||||
WOLF_EVENT_QUEUE event_queue;
|
||||
WOLF_EVENT_QUEUE event_queue;
|
||||
#endif /* HAVE_WOLF_EVENT */
|
||||
#ifdef HAVE_EXT_CACHE
|
||||
WOLFSSL_SESSION*(*get_sess_cb)(WOLFSSL*, unsigned char*, int, int*);
|
||||
int (*new_sess_cb)(WOLFSSL*, WOLFSSL_SESSION*);
|
||||
void (*rem_sess_cb)(WOLFSSL_CTX*, WOLFSSL_SESSION*);
|
||||
WOLFSSL_SESSION*(*get_sess_cb)(WOLFSSL*, unsigned char*, int, int*);
|
||||
int (*new_sess_cb)(WOLFSSL*, WOLFSSL_SESSION*);
|
||||
void (*rem_sess_cb)(WOLFSSL_CTX*, WOLFSSL_SESSION*);
|
||||
#endif
|
||||
#if defined(OPENSSL_EXTRA) && defined(WOLFCRYPT_HAVE_SRP) && !defined(NO_SHA256)
|
||||
Srp* srp; /* TLS Secure Remote Password Protocol*/
|
||||
byte* srp_password;
|
||||
Srp* srp; /* TLS Secure Remote Password Protocol*/
|
||||
byte* srp_password;
|
||||
#endif
|
||||
#ifdef WOLFSSL_STATIC_EPHEMERAL
|
||||
StaticKeyExchangeInfo_t staticKE;
|
||||
#endif
|
||||
};
|
||||
|
||||
|
|
@ -2939,7 +2971,6 @@ enum KeyExchangeAlgorithm {
|
|||
ecc_static_diffie_hellman_kea /* for verify suite only */
|
||||
};
|
||||
|
||||
|
||||
/* Supported Authentication Schemes */
|
||||
enum SignatureAlgorithm {
|
||||
anonymous_sa_algo = 0,
|
||||
|
|
@ -2998,6 +3029,13 @@ enum CipherType { aead };
|
|||
#define CIPHER_NONCE
|
||||
#endif
|
||||
|
||||
#if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION)
|
||||
enum CipherSrc {
|
||||
KEYS_NOT_SET = 0,
|
||||
KEYS, /* keys from ssl->keys are loaded */
|
||||
SCR /* keys from ssl->secure_renegotiation->tmp_keys are loaded */
|
||||
};
|
||||
#endif
|
||||
|
||||
/* cipher for now */
|
||||
typedef struct Ciphers {
|
||||
|
|
@ -3037,6 +3075,10 @@ typedef struct Ciphers {
|
|||
#endif
|
||||
byte state;
|
||||
byte setup; /* have we set it up flag for detection */
|
||||
#if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION)
|
||||
enum CipherSrc src; /* DTLS uses this to determine which keys
|
||||
* are currently loaded */
|
||||
#endif
|
||||
} Ciphers;
|
||||
|
||||
|
||||
|
|
@ -3138,6 +3180,8 @@ struct WOLFSSL_SESSION {
|
|||
#ifdef OPENSSL_EXTRA
|
||||
byte sessionCtxSz; /* sessionCtx length */
|
||||
byte sessionCtx[ID_LEN]; /* app specific context id */
|
||||
wolfSSL_Mutex refMutex; /* ref count mutex */
|
||||
int refCount; /* reference count */
|
||||
#endif
|
||||
#ifdef WOLFSSL_TLS13
|
||||
word16 namedGroup;
|
||||
|
|
@ -3146,9 +3190,7 @@ struct WOLFSSL_SESSION {
|
|||
#ifdef WOLFSSL_TLS13
|
||||
word32 ticketSeen; /* Time ticket seen (ms) */
|
||||
word32 ticketAdd; /* Added by client */
|
||||
#ifndef WOLFSSL_TLS13_DRAFT_18
|
||||
TicketNonce ticketNonce; /* Nonce used to derive PSK */
|
||||
#endif
|
||||
#endif
|
||||
#ifdef WOLFSSL_EARLY_DATA
|
||||
word32 maxEarlyDataSz;
|
||||
|
|
@ -3160,7 +3202,7 @@ struct WOLFSSL_SESSION {
|
|||
byte staticTicket[SESSION_TICKET_LEN];
|
||||
byte isDynamic;
|
||||
#endif
|
||||
#ifdef HAVE_EXT_CACHE
|
||||
#if defined(HAVE_EXT_CACHE) || defined(OPENSSL_EXTRA)
|
||||
byte isAlloced;
|
||||
#endif
|
||||
#ifdef HAVE_EX_DATA
|
||||
|
|
@ -3174,7 +3216,7 @@ WOLFSSL_SESSION* GetSession(WOLFSSL*, byte*, byte);
|
|||
WOLFSSL_LOCAL
|
||||
int SetSession(WOLFSSL*, WOLFSSL_SESSION*);
|
||||
|
||||
typedef int (*hmacfp) (WOLFSSL*, byte*, const byte*, word32, int, int, int);
|
||||
typedef int (*hmacfp) (WOLFSSL*, byte*, const byte*, word32, int, int, int, int);
|
||||
|
||||
#ifndef NO_CLIENT_CACHE
|
||||
WOLFSSL_SESSION* GetSessionClient(WOLFSSL*, const byte*, int);
|
||||
|
|
@ -3335,8 +3377,9 @@ typedef struct Options {
|
|||
wc_psk_client_tls13_callback client_psk_tls13_cb; /* client callback */
|
||||
wc_psk_server_tls13_callback server_psk_tls13_cb; /* server callback */
|
||||
#endif
|
||||
void* psk_ctx;
|
||||
#endif /* NO_PSK */
|
||||
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
|
||||
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL)
|
||||
unsigned long mask; /* store SSL_OP_ flags */
|
||||
#endif
|
||||
|
||||
|
|
@ -3576,15 +3619,15 @@ struct WOLFSSL_X509_NAME {
|
|||
char staticName[ASN_NAME_MAX];
|
||||
#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) && \
|
||||
!defined(NO_ASN)
|
||||
DecodedName fullName;
|
||||
WOLFSSL_X509_NAME_ENTRY cnEntry;
|
||||
WOLFSSL_X509_NAME_ENTRY extra[MAX_NAME_ENTRIES]; /* extra entries added */
|
||||
int entrySz; /* number of entries */
|
||||
WOLFSSL_X509_NAME_ENTRY entry[MAX_NAME_ENTRIES]; /* all entries i.e. CN */
|
||||
WOLFSSL_X509* x509; /* x509 that struct belongs to */
|
||||
#endif /* OPENSSL_EXTRA */
|
||||
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX)
|
||||
byte raw[ASN_NAME_MAX];
|
||||
int rawLen;
|
||||
#endif
|
||||
void* heap;
|
||||
};
|
||||
|
||||
#ifndef EXTERNAL_SERIAL_SIZE
|
||||
|
|
@ -3730,6 +3773,7 @@ typedef struct DtlsMsg {
|
|||
byte* msg;
|
||||
DtlsFrag* fragList;
|
||||
word32 fragSz; /* Length of fragments received */
|
||||
word16 epoch; /* Epoch that this message belongs to */
|
||||
word32 seq; /* Handshake sequence number */
|
||||
word32 sz; /* Length of whole message */
|
||||
byte type;
|
||||
|
|
@ -3799,6 +3843,20 @@ typedef struct HS_Hashes {
|
|||
} HS_Hashes;
|
||||
|
||||
|
||||
#ifndef WOLFSSL_NO_TLS12
|
||||
/* Persistable BuildMessage arguments */
|
||||
typedef struct BuildMsgArgs {
|
||||
word32 digestSz;
|
||||
word32 sz;
|
||||
word32 pad;
|
||||
word32 idx;
|
||||
word32 headerSz;
|
||||
word16 size;
|
||||
word32 ivSz; /* TLSv1.1 IV */
|
||||
byte* iv;
|
||||
} BuildMsgArgs;
|
||||
#endif
|
||||
|
||||
#ifdef WOLFSSL_ASYNC_CRYPT
|
||||
#define MAX_ASYNC_ARGS 18
|
||||
typedef void (*FreeArgsCb)(struct WOLFSSL* ssl, void* pArgs);
|
||||
|
|
@ -3807,6 +3865,7 @@ typedef struct HS_Hashes {
|
|||
WC_ASYNC_DEV* dev;
|
||||
FreeArgsCb freeArgs; /* function pointer to cleanup args */
|
||||
word32 args[MAX_ASYNC_ARGS]; /* holder for current args */
|
||||
BuildMsgArgs buildArgs; /* holder for current BuildMessage args */
|
||||
};
|
||||
#endif
|
||||
|
||||
|
|
@ -3960,11 +4019,9 @@ struct WOLFSSL {
|
|||
#endif
|
||||
word16 pssAlgo;
|
||||
#ifdef WOLFSSL_TLS13
|
||||
#if !defined(WOLFSSL_TLS13_DRAFT_18) && !defined(WOLFSSL_TLS13_DRAFT_22)
|
||||
word16 certHashSigAlgoSz; /* SigAlgoCert ext length in bytes */
|
||||
byte certHashSigAlgo[WOLFSSL_MAX_SIGALGO]; /* cert sig/algo to
|
||||
* offer */
|
||||
#endif /* !WOLFSSL_TLS13_DRAFT_18 && !WOLFSSL_TLS13_DRAFT_22 */
|
||||
#endif
|
||||
#ifdef HAVE_NTRU
|
||||
word16 peerNtruKeyLen;
|
||||
|
|
@ -4191,6 +4248,9 @@ struct WOLFSSL {
|
|||
WOLFSSL_STACK* supportedCiphers; /* Used in wolfSSL_get_ciphers_compat */
|
||||
WOLFSSL_STACK* peerCertChain; /* Used in wolfSSL_get_peer_cert_chain */
|
||||
#endif
|
||||
#ifdef WOLFSSL_STATIC_EPHEMERAL
|
||||
StaticKeyExchangeInfo_t staticKE;
|
||||
#endif
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -4210,10 +4270,8 @@ WOLFSSL_API void SSL_ResourceFree(WOLFSSL*); /* Micrium uses */
|
|||
int type, WOLFSSL* ssl, int userChain,
|
||||
WOLFSSL_CRL* crl, int verify);
|
||||
|
||||
#ifdef OPENSSL_EXTRA
|
||||
WOLFSSL_LOCAL int CheckHostName(DecodedCert* dCert, char *domainName,
|
||||
WOLFSSL_LOCAL int CheckHostName(DecodedCert* dCert, const char *domainName,
|
||||
size_t domainNameLen);
|
||||
#endif
|
||||
#endif
|
||||
|
||||
|
||||
|
|
@ -4298,8 +4356,8 @@ enum ProvisionSide {
|
|||
};
|
||||
|
||||
|
||||
static const byte client[SIZEOF_SENDER] = { 0x43, 0x4C, 0x4E, 0x54 };
|
||||
static const byte server[SIZEOF_SENDER] = { 0x53, 0x52, 0x56, 0x52 };
|
||||
static const byte client[SIZEOF_SENDER+1] = { 0x43, 0x4C, 0x4E, 0x54, 0x00 }; /* CLNT */
|
||||
static const byte server[SIZEOF_SENDER+1] = { 0x53, 0x52, 0x56, 0x52, 0x00 }; /* SRVR */
|
||||
|
||||
static const byte tls_client[FINISHED_LABEL_SZ + 1] = "client finished";
|
||||
static const byte tls_server[FINISHED_LABEL_SZ + 1] = "server finished";
|
||||
|
|
@ -4322,12 +4380,8 @@ WOLFSSL_LOCAL int SendTicket(WOLFSSL*);
|
|||
WOLFSSL_LOCAL int DoClientTicket(WOLFSSL*, const byte*, word32);
|
||||
WOLFSSL_LOCAL int SendData(WOLFSSL*, const void*, int);
|
||||
#ifdef WOLFSSL_TLS13
|
||||
#ifdef WOLFSSL_TLS13_DRAFT_18
|
||||
WOLFSSL_LOCAL int SendTls13HelloRetryRequest(WOLFSSL*);
|
||||
#else
|
||||
WOLFSSL_LOCAL int SendTls13ServerHello(WOLFSSL*, byte);
|
||||
#endif
|
||||
#endif
|
||||
WOLFSSL_LOCAL int SendCertificate(WOLFSSL*);
|
||||
WOLFSSL_LOCAL int SendCertificateRequest(WOLFSSL*);
|
||||
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
||||
|
|
@ -4453,7 +4507,7 @@ WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength);
|
|||
WOLFSSL_LOCAL int MakeTlsMasterSecret(WOLFSSL*);
|
||||
#ifndef WOLFSSL_AEAD_ONLY
|
||||
WOLFSSL_LOCAL int TLS_hmac(WOLFSSL* ssl, byte* digest, const byte* in,
|
||||
word32 sz, int padSz, int content, int verify);
|
||||
word32 sz, int padSz, int content, int verify, int epochOrder);
|
||||
#endif
|
||||
#endif
|
||||
|
||||
|
|
@ -4475,24 +4529,30 @@ WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength);
|
|||
WOLFSSL_LOCAL DtlsMsg* DtlsMsgNew(word32, void*);
|
||||
WOLFSSL_LOCAL void DtlsMsgDelete(DtlsMsg*, void*);
|
||||
WOLFSSL_LOCAL void DtlsMsgListDelete(DtlsMsg*, void*);
|
||||
WOLFSSL_LOCAL int DtlsMsgSet(DtlsMsg*, word32, const byte*, byte,
|
||||
WOLFSSL_LOCAL void DtlsTxMsgListClean(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int DtlsMsgSet(DtlsMsg*, word32, word16, const byte*, byte,
|
||||
word32, word32, void*);
|
||||
WOLFSSL_LOCAL DtlsMsg* DtlsMsgFind(DtlsMsg*, word32);
|
||||
WOLFSSL_LOCAL void DtlsMsgStore(WOLFSSL*, word32, const byte*, word32,
|
||||
WOLFSSL_LOCAL DtlsMsg* DtlsMsgFind(DtlsMsg*, word32, word32);
|
||||
WOLFSSL_LOCAL void DtlsMsgStore(WOLFSSL*, word32, word32, const byte*, word32,
|
||||
byte, word32, word32, void*);
|
||||
WOLFSSL_LOCAL DtlsMsg* DtlsMsgInsert(DtlsMsg*, DtlsMsg*);
|
||||
|
||||
WOLFSSL_LOCAL int DtlsMsgPoolSave(WOLFSSL*, const byte*, word32);
|
||||
WOLFSSL_LOCAL int DtlsMsgPoolSave(WOLFSSL*, const byte*, word32, enum HandShakeType);
|
||||
WOLFSSL_LOCAL int DtlsMsgPoolTimeout(WOLFSSL*);
|
||||
WOLFSSL_LOCAL int VerifyForDtlsMsgPoolSend(WOLFSSL*, byte, word32);
|
||||
WOLFSSL_LOCAL int VerifyForTxDtlsMsgDelete(WOLFSSL* ssl, DtlsMsg* head);
|
||||
WOLFSSL_LOCAL void DtlsMsgPoolReset(WOLFSSL*);
|
||||
WOLFSSL_LOCAL int DtlsMsgPoolSend(WOLFSSL*, int);
|
||||
#endif /* WOLFSSL_DTLS */
|
||||
|
||||
#ifndef NO_TLS
|
||||
#if defined(HAVE_SECURE_RENEGOTIATION) && defined(WOLFSSL_DTLS)
|
||||
WOLFSSL_LOCAL int DtlsSCRKeysSet(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int IsDtlsMsgSCRKeys(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int DtlsUseSCRKeys(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL int DtlsCheckOrder(WOLFSSL* ssl, int order);
|
||||
#endif
|
||||
|
||||
|
||||
#endif /* NO_TLS */
|
||||
WOLFSSL_LOCAL void WriteSEQ(WOLFSSL* ssl, int verifyOrder, byte* out);
|
||||
|
||||
#if defined(WOLFSSL_TLS13) && (defined(HAVE_SESSION_TICKET) || !defined(NO_PSK))
|
||||
WOLFSSL_LOCAL word32 TimeNowInMilliseconds(void);
|
||||
|
|
@ -4500,8 +4560,8 @@ WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength);
|
|||
WOLFSSL_LOCAL word32 LowResTimer(void);
|
||||
|
||||
#ifndef NO_CERTS
|
||||
WOLFSSL_LOCAL void InitX509Name(WOLFSSL_X509_NAME*, int);
|
||||
WOLFSSL_LOCAL void FreeX509Name(WOLFSSL_X509_NAME* name, void* heap);
|
||||
WOLFSSL_LOCAL void InitX509Name(WOLFSSL_X509_NAME*, int, void*);
|
||||
WOLFSSL_LOCAL void FreeX509Name(WOLFSSL_X509_NAME* name);
|
||||
WOLFSSL_LOCAL void InitX509(WOLFSSL_X509*, int, void* heap);
|
||||
WOLFSSL_LOCAL void FreeX509(WOLFSSL_X509*);
|
||||
WOLFSSL_LOCAL int CopyDecodedToX509(WOLFSSL_X509*, DecodedCert*);
|
||||
|
|
@ -4587,9 +4647,13 @@ WOLFSSL_LOCAL int SetDhExternal(WOLFSSL_DH *dh);
|
|||
WOLFSSL_LOCAL int InitHandshakeHashes(WOLFSSL* ssl);
|
||||
WOLFSSL_LOCAL void FreeHandshakeHashes(WOLFSSL* ssl);
|
||||
|
||||
|
||||
#ifndef WOLFSSL_NO_TLS12
|
||||
WOLFSSL_LOCAL void FreeBuildMsgArgs(WOLFSSL* ssl, BuildMsgArgs* args);
|
||||
#endif
|
||||
WOLFSSL_LOCAL int BuildMessage(WOLFSSL* ssl, byte* output, int outSz,
|
||||
const byte* input, int inSz, int type, int hashOutput,
|
||||
int sizeOnly, int asyncOkay);
|
||||
int sizeOnly, int asyncOkay, int epochOrder);
|
||||
|
||||
#ifdef WOLFSSL_TLS13
|
||||
int BuildTls13Message(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue