RSA BSAFE Micro Edition Suite	Streamlined security for mobile and embedded devices

---

ssl3.h

Go to the documentation of this file.

/* $Id: ssl3.h,v 1.31 2004/09/17 03:44:39 spatel Exp $ */

/*
 * Copyright (C) 1999-2003 RSA Security Inc. All rights reserved. 
 *
 * This work contains proprietary information of RSA Security. 
 * Distribution is limited to authorized licensees of RSA 
 * Security. Any unauthorized reproduction, distribution or 
 * modification of this work is strictly prohibited.
 */
#ifndef HEADER_SSL3_H
#define HEADER_SSL3_H

#ifdef  __cplusplus
extern "C" {
#endif

#define SSL3_CK_RSA_NULL_MD5             0x03000001
#define SSL3_CK_RSA_NULL_SHA             0x03000002

#define SSL3_CK_RSA_RC4_40_MD5           0x03000003
#define SSL3_CK_RSA_RC4_128_MD5          0x03000004
#define SSL3_CK_RSA_RC4_128_SHA          0x03000005

#define SSL3_CK_RSA_RC2_40_MD5           0x03000006
#define SSL3_CK_RSA_IDEA_128_SHA         0x03000007
#define SSL3_CK_RSA_DES_40_CBC_SHA       0x03000008
#define SSL3_CK_RSA_DES_64_CBC_SHA       0x03000009
#define SSL3_CK_RSA_DES_192_CBC3_SHA     0x0300000A

#define SSL3_CK_DH_DSS_DES_40_CBC_SHA    0x0300000B
#define SSL3_CK_DH_DSS_DES_64_CBC_SHA    0x0300000C
#define SSL3_CK_DH_DSS_DES_192_CBC3_SHA  0x0300000D
#define SSL3_CK_DH_RSA_DES_40_CBC_SHA    0x0300000E
#define SSL3_CK_DH_RSA_DES_64_CBC_SHA    0x0300000F
#define SSL3_CK_DH_RSA_DES_192_CBC3_SHA  0x03000010

#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA   0x03000011
#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA   0x03000012
#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013
#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA   0x03000014
#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA   0x03000015
#define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016

#define SSL3_CK_ADH_RC4_40_MD5           0x03000017
#define SSL3_CK_ADH_RC4_128_MD5          0x03000018
#define SSL3_CK_ADH_DES_40_CBC_SHA       0x03000019
#define SSL3_CK_ADH_DES_64_CBC_SHA       0x0300001A
#define SSL3_CK_ADH_DES_192_CBC_SHA      0x0300001B

#define SSL3_CK_FZA_DMS_NULL_SHA         0x0300001C
#define SSL3_CK_FZA_DMS_FZA_SHA          0x0300001D
#define SSL3_CK_FZA_DMS_RC4_SHA          0x0300001E

#define SSL3_CK_RSA_RC4_56_SHA           0x03000064
#define SSL3_TXT_RSA_RC4_56_SHA          "EXP-RC4-56-SHA"

#define SSL3_CK_RSA_DES_56_SHA           0x03000062
#define SSL3_TXT_RSA_DES_56_SHA          "EXP-DES-56-SHA"

#define SSL3_CK_EDH_DSS_DES_56_SHA       0x03000063
#define SSL3_TXT_EDH_DSS_DES_56_SHA      "EXP-EDH-DSS-DES-56-SHA"

#define SSL3_CK_EDH_DSS_RC4_56_SHA       0x03000065
#define SSL3_TXT_EDH_DSS_RC4_56_SHA      "EXP-EDH-DSS-RC4-56-SHA"

#define SSL3_CK_EDH_DSS_RC4_128_SHA      0x03000066
#define SSL3_TXT_EDH_DSS_RC4_128_SHA     "EDH-DSS-RC4-SHA"

#ifndef NO_AES
/* AES cipher suites - from ietf-draft - now in published in RFC3268*/
#define SSL3_CK_RSA_AES_128_SHA          0x0300002F
#define SSL3_TXT_RSA_AES_128_SHA         "AES128-SHA"

#define SSL3_CK_DH_DSS_AES_128_SHA       0x03000030
#define SSL3_TXT_DH_DSS_AES_128_SHA      "DH-DSS-AES128-SHA"

#define SSL3_CK_DH_RSA_AES_128_SHA       0x03000031
#define SSL3_TXT_DH_RSA_AES_128_SHA      "DH-RSA-AES128-SHA"

#define SSL3_CK_EDH_DSS_AES_128_SHA      0x03000032
#define SSL3_TXT_EDH_DSS_AES_128_SHA     "EDH-DSS-AES128-SHA"

#define SSL3_CK_EDH_RSA_AES_128_SHA      0x03000033
#define SSL3_TXT_EDH_RSA_AES_128_SHA     "EDH-RSA-AES128-SHA"

#define SSL3_CK_ADH_AES_128_SHA          0x03000034
#define SSL3_TXT_ADH_AES_128_SHA         "ADH-AES128-SHA"

#define SSL3_CK_RSA_AES_256_SHA          0x03000035
#define SSL3_TXT_RSA_AES_256_SHA         "AES256-SHA"

#define SSL3_CK_DH_DSS_AES_256_SHA       0x03000036
#define SSL3_TXT_DH_DSS_AES_256_SHA      "DH-DSS-AES256-SHA"

#define SSL3_CK_DH_RSA_AES_256_SHA       0x03000037
#define SSL3_TXT_DH_RSA_AES_256_SHA      "DH-RSA-AES256-SHA"

#define SSL3_CK_EDH_DSS_AES_256_SHA      0x03000038
#define SSL3_TXT_EDH_DSS_AES_256_SHA     "EDH-DSS-AES256-SHA"

#define SSL3_CK_EDH_RSA_AES_256_SHA      0x03000039
#define SSL3_TXT_EDH_RSA_AES_256_SHA     "EDH-RSA-AES256-SHA"

#define SSL3_CK_ADH_AES_256_SHA          0x0300003A
#define SSL3_TXT_ADH_AES_256_SHA         "ADH-AES256-SHA"
#endif /* NO_AES */

#define SSL3_TXT_RSA_NULL_MD5            "NULL-MD5"
#define SSL3_TXT_RSA_NULL_SHA            "NULL-SHA"

#define SSL3_TXT_RSA_RC4_40_MD5          "EXP-RC4-MD5"
#define SSL3_TXT_RSA_RC4_128_MD5         "RC4-MD5"
#define SSL3_TXT_RSA_RC4_128_SHA         "RC4-SHA"

#define SSL3_TXT_RSA_RC2_40_MD5          "EXP-RC2-CBC-MD5"
#define SSL3_TXT_RSA_IDEA_128_SHA        "IDEA-CBC-SHA"
#define SSL3_TXT_RSA_DES_40_CBC_SHA      "EXP-DES-CBC-SHA"
#define SSL3_TXT_RSA_DES_64_CBC_SHA      "DES-CBC-SHA"
#define SSL3_TXT_RSA_DES_192_CBC3_SHA    "DES-CBC3-SHA"

#define SSL3_TXT_DH_DSS_DES_40_CBC_SHA   "EXP-DH-DSS-DES-CBC-SHA"
#define SSL3_TXT_DH_DSS_DES_64_CBC_SHA   "DH-DSS-DES-CBC-SHA"
#define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA"
#define SSL3_TXT_DH_RSA_DES_40_CBC_SHA   "EXP-DH-RSA-DES-CBC-SHA"
#define SSL3_TXT_DH_RSA_DES_64_CBC_SHA   "DH-RSA-DES-CBC-SHA"
#define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA"

#define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA   "EXP-EDH-DSS-DES-CBC-SHA"
#define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA   "EDH-DSS-DES-CBC-SHA"
#define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA"
#define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA   "EXP-EDH-RSA-DES-CBC-SHA"
#define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA   "EDH-RSA-DES-CBC-SHA"
#define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA"

#define SSL3_TXT_ADH_RC4_40_MD5           "EXP-ADH-RC4-MD5"
#define SSL3_TXT_ADH_RC4_128_MD5          "ADH-RC4-MD5"
#define SSL3_TXT_ADH_DES_40_CBC_SHA       "EXP-ADH-DES-CBC-SHA"
#define SSL3_TXT_ADH_DES_64_CBC_SHA       "ADH-DES-CBC-SHA"
#define SSL3_TXT_ADH_DES_192_CBC_SHA      "ADH-DES-CBC3-SHA"

#define SSL3_TXT_FZA_DMS_NULL_SHA         "FZA-NULL-SHA"
#define SSL3_TXT_FZA_DMS_FZA_SHA          "FZA-FZA-CBC-SHA"
#define SSL3_TXT_FZA_DMS_RC4_SHA          "FZA-RC4-SHA"

#define SSL3_SSL_SESSION_ID_LENGTH        32
#define SSL3_MAX_SSL_SESSION_ID_LENGTH    32

#define SSL3_MASTER_SECRET_SIZE           48
#define SSL3_RANDOM_SIZE                  32
#define SSL3_SESSION_ID_SIZE              32
#define SSL3_RT_HEADER_LENGTH             5

/* Due to MS, this can change.... */
#if defined(WIN16) || (defined(MSDOS) && !defined(WIN32))
#define SSL3_RT_MAX_EXTRA                 (14000)
#else
#define SSL3_RT_MAX_EXTRA                 (16384)
#endif

#define SSL3_RT_MAX_PLAIN_LENGTH          16384
#define SSL3_RT_MAX_COMPRESSED_LENGTH     (1024+SSL3_RT_MAX_PLAIN_LENGTH)
#define SSL3_RT_MAX_ENCRYPTED_LENGTH      (1024+SSL3_RT_MAX_COMPRESSED_LENGTH)
#define SSL3_RT_MAX_PACKET_SIZE        \
                         (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
#define SSL3_RT_EXTRA_TRAILER             (1024+1024+SSL3_RT_HEADER_LENGTH)
#define SSL3_RT_MAX_DATA_SIZE             (1024*1024)

/* the state that in_read_app_data flag can be in
 *
 * 0 -> not reading application data
 * 1 -> reading application data
 * 2 -> reading application data while expecting renegotiation
 *      handshake message
 */
#define SSL3_NOT_READ_APP_DATA            0
#define SSL3_READ_APP_DATA                1
#define SSL3_READ_APP_DATA_IN_HANDSHAKE   2

/* the states that a SSL3_RECORD can be in
 * For SSL_read it goes
 * rbuf->ENCODED   -> read
 * ENCODED         -> we need to decode everything - call decode_record
 * 
 * NOTE : NONE OF THESE VALUES ARE USED IN THE CODE BASE
 */

#define SSL3_RS_BLANK                     1
#define SSL3_RS_DATA

#define SSL3_RS_ENCODED                   2
#define SSL3_RS_READ_MORE                 3
#define SSL3_RS_WRITE_MORE
#define SSL3_RS_PLAIN                     3
#define SSL3_RS_PART_READ                 4
#define SSL3_RS_PART_WRITE                5

#define SSL3_MD_CLIENT_FINISHED_CONST     {0x43,0x4C,0x4E,0x54}
#define SSL3_MD_SERVER_FINISHED_CONST     {0x53,0x52,0x56,0x52}

/* SSLv3 protocol version numbers */
#define SSL3_VERSION                      0x0300
#define SSL3_VERSION_MAJOR                0x03
#define SSL3_VERSION_MINOR                0x00

/* SSLv3/TLSv1 alert levels */
#define SSL3_AL_WARNING                   1
#define SSL3_AL_FATAL                     2

/* SSLv3 specific alert descriptions */
#define SSL3_AD_CLOSE_NOTIFY               0
#define SSL3_AD_UNEXPECTED_MESSAGE        10        /* fatal */
#define SSL3_AD_BAD_RECORD_MAC            20        /* fatal */
#define SSL3_AD_DECOMPRESSION_FAILURE     30        /* fatal */
#define SSL3_AD_HANDSHAKE_FAILURE         40        /* fatal */
#define SSL3_AD_NO_CERTIFICATE            41
#define SSL3_AD_BAD_CERTIFICATE           42
#define SSL3_AD_UNSUPPORTED_CERTIFICATE   43
#define SSL3_AD_CERTIFICATE_REVOKED       44
#define SSL3_AD_CERTIFICATE_EXPIRED       45
#define SSL3_AD_CERTIFICATE_UNKNOWN       46
#define SSL3_AD_ILLEGAL_PARAMETER         47        /* fatal */

/* SSLv3 supported certificate types */
#define SSL3_CT_RSA_SIGN                   1
#define SSL3_CT_DSS_SIGN                   2
#define SSL3_CT_RSA_FIXED_DH               3
#define SSL3_CT_DSS_FIXED_DH               4
#define SSL3_CT_RSA_EPHEMERAL_DH           5
#define SSL3_CT_DSS_EPHEMERAL_DH           6
#define SSL3_CT_FORTEZZA_DMS              20
#define SSL3_CT_NUMBER                     7

/* Flags for SSLv3/TLSv1 protocol variations */
#define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS     0x0001
#define SSL3_FLAGS_DELAY_CLIENT_FINISHED      0x0002 /* UNUSED */
#define SSL3_FLAGS_POP_BUFFER                 0x0004 /* Client only */
#define TLS1_FLAGS_TLS_PADDING_BUG            0x0008
#define SSL3_FLAGS_DELAY_READ_SERVER_FINISHED 0x0010 /* Client only */
#define SSL3_FLAGS_EXPECT_CCS                 0x0020 /* on if a ccs message is acceptable */

#define ssl3_set_flag(s,f)      ((s)->s3->flags|=(f))
#define ssl3_clear_flag(s,f)    ((s)->s3->flags&= ~(f))
#define ssl3_get_flag(s,f)      ((s)->s3->flags & (f))

/* SSLv3 */
/* client */
#define SSL3_ST_CW_FLUSH                (0x100|SSL_ST_CONNECT)

#define SSL3_ST_CR_HELLO_REQ_A          (0x101|SSL_ST_CONNECT)

#define SSL3_ST_CW_CLNT_HELLO_A         (0x110|SSL_ST_CONNECT)

#define SSL3_ST_CW_CLNT_HELLO_B         (0x111|SSL_ST_CONNECT)
/* read from server */
#define SSL3_ST_CR_SRVR_HELLO_A         (0x120|SSL_ST_CONNECT)

#define SSL3_ST_CR_SRVR_HELLO_B         (0x121|SSL_ST_CONNECT)

#define SSL3_ST_CR_CERT_A               (0x130|SSL_ST_CONNECT)

#define SSL3_ST_CR_CERT_B               (0x131|SSL_ST_CONNECT)

#define SSL3_ST_CR_KEY_EXCH_A           (0x140|SSL_ST_CONNECT)

#define SSL3_ST_CR_KEY_EXCH_B           (0x141|SSL_ST_CONNECT)

#define SSL3_ST_CR_CERT_REQ_A           (0x150|SSL_ST_CONNECT)

#define SSL3_ST_CR_CERT_REQ_B           (0x151|SSL_ST_CONNECT)

#define SSL3_ST_CR_SRVR_DONE_A          (0x160|SSL_ST_CONNECT)

#define SSL3_ST_CR_SRVR_DONE_B          (0x161|SSL_ST_CONNECT)
/* write to server */
#define SSL3_ST_CW_CERT_A               (0x170|SSL_ST_CONNECT)

#define SSL3_ST_CW_CERT_B               (0x171|SSL_ST_CONNECT)

#define SSL3_ST_CW_CERT_C               (0x172|SSL_ST_CONNECT)

#define SSL3_ST_CW_CERT_D               (0x173|SSL_ST_CONNECT)

#define SSL3_ST_CW_KEY_EXCH_A           (0x180|SSL_ST_CONNECT)

#define SSL3_ST_CW_KEY_EXCH_B           (0x181|SSL_ST_CONNECT)

#define SSL3_ST_CW_CERT_VRFY_A          (0x190|SSL_ST_CONNECT)

#define SSL3_ST_CW_CERT_VRFY_B          (0x191|SSL_ST_CONNECT)

#define SSL3_ST_CW_CHANGE_A             (0x1A0|SSL_ST_CONNECT)

#define SSL3_ST_CW_CHANGE_B             (0x1A1|SSL_ST_CONNECT)

#define SSL3_ST_CW_FINISHED_A           (0x1B0|SSL_ST_CONNECT)

#define SSL3_ST_CW_FINISHED_B           (0x1B1|SSL_ST_CONNECT)
/* read from server */
#define SSL3_ST_CR_CHANGE_A             (0x1C0|SSL_ST_CONNECT)

#define SSL3_ST_CR_CHANGE_B             (0x1C1|SSL_ST_CONNECT)

#define SSL3_ST_CR_FINISHED_A           (0x1D0|SSL_ST_CONNECT)

#define SSL3_ST_CR_FINISHED_B           (0x1D1|SSL_ST_CONNECT)

/* server */
/* extra state */
#define SSL3_ST_SW_FLUSH                (0x100|SSL_ST_ACCEPT)
/* read from client */
/* Do not change the number values, they do matter */
#define SSL3_ST_SR_CLNT_HELLO_A         (0x110|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CLNT_HELLO_B         (0x111|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CLNT_HELLO_C         (0x112|SSL_ST_ACCEPT)
/* write to client */
#define SSL3_ST_SW_HELLO_REQ_A          (0x120|SSL_ST_ACCEPT)

#define SSL3_ST_SW_HELLO_REQ_B          (0x121|SSL_ST_ACCEPT)

#define SSL3_ST_SW_HELLO_REQ_C          (0x122|SSL_ST_ACCEPT)

#define SSL3_ST_SW_SRVR_HELLO_A         (0x130|SSL_ST_ACCEPT)

#define SSL3_ST_SW_SRVR_HELLO_B         (0x131|SSL_ST_ACCEPT)

#define SSL3_ST_SW_CERT_A               (0x140|SSL_ST_ACCEPT)

#define SSL3_ST_SW_CERT_B               (0x141|SSL_ST_ACCEPT)

#define SSL3_ST_SW_KEY_EXCH_A           (0x150|SSL_ST_ACCEPT)

#define SSL3_ST_SW_KEY_EXCH_B           (0x151|SSL_ST_ACCEPT)

#define SSL3_ST_SW_CERT_REQ_A           (0x160|SSL_ST_ACCEPT)

#define SSL3_ST_SW_CERT_REQ_B           (0x161|SSL_ST_ACCEPT)

#define SSL3_ST_SW_SRVR_DONE_A          (0x170|SSL_ST_ACCEPT)

#define SSL3_ST_SW_SRVR_DONE_B          (0x171|SSL_ST_ACCEPT)
/* read from client */
#define SSL3_ST_SR_CERT_A               (0x180|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CERT_B               (0x181|SSL_ST_ACCEPT)

#define SSL3_ST_SR_KEY_EXCH_A           (0x190|SSL_ST_ACCEPT)

#define SSL3_ST_SR_KEY_EXCH_B           (0x191|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CERT_VRFY_A          (0x1A0|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CERT_VRFY_B          (0x1A1|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CHANGE_A             (0x1B0|SSL_ST_ACCEPT)

#define SSL3_ST_SR_CHANGE_B             (0x1B1|SSL_ST_ACCEPT)

#define SSL3_ST_SR_FINISHED_A           (0x1C0|SSL_ST_ACCEPT)

#define SSL3_ST_SR_FINISHED_B           (0x1C1|SSL_ST_ACCEPT)
/* write to client */
#define SSL3_ST_SW_CHANGE_A             (0x1D0|SSL_ST_ACCEPT)

#define SSL3_ST_SW_CHANGE_B             (0x1D1|SSL_ST_ACCEPT)

#define SSL3_ST_SW_FINISHED_A           (0x1E0|SSL_ST_ACCEPT)

#define SSL3_ST_SW_FINISHED_B           (0x1E1|SSL_ST_ACCEPT)

/* Handshake record message types */
#define SSL3_MT_CLIENT_REQUEST       0
#define SSL3_MT_CLIENT_HELLO         1
#define SSL3_MT_SERVER_HELLO         2
#define SSL3_MT_CERTIFICATE         11
#define SSL3_MT_SERVER_KEY_EXCHANGE 12
#define SSL3_MT_CERTIFICATE_REQUEST 13
#define SSL3_MT_SERVER_DONE         14
#define SSL3_MT_CERTIFICATE_VERIFY  15
#define SSL3_MT_CLIENT_KEY_EXCHANGE 16
#define SSL3_MT_FINISHED            20

/* Change cipher spec message types */
#define SSL3_MT_CCS                  1

/* These are used when changing over to a new cipher */
#define SSL3_CC_READ                     0x01
#define SSL3_CC_WRITE                    0x02
#define SSL3_CC_CLIENT                   0x10
#define SSL3_CC_SERVER                   0x20
#define SSL3_CHANGE_CIPHER_CLIENT_WRITE  (SSL3_CC_CLIENT|SSL3_CC_WRITE)
#define SSL3_CHANGE_CIPHER_SERVER_READ   (SSL3_CC_SERVER|SSL3_CC_READ)
#define SSL3_CHANGE_CIPHER_CLIENT_READ   (SSL3_CC_CLIENT|SSL3_CC_READ)
#define SSL3_CHANGE_CIPHER_SERVER_WRITE  (SSL3_CC_SERVER|SSL3_CC_WRITE)

#ifdef  __cplusplus
}
#endif
#endif

---

Copyright (c) 1999-2005 RSA Security Inc. All rights reserved. 072-001001-2100-001-000 - 2.1