RSA BSAFE Micro Edition Suite	Streamlined security for mobile and embedded devices

---

sslctx_st.h

Go to the documentation of this file.

/* $Id: sslctx_st.h,v 1.64 2005/06/23 03:15:19 itaylor Exp $ */
/*
 * Copyright (C) 1999-2003 RSA Security Inc. All rights reserved.
 *
 * This work contains proprietary information of RSA Security.
 * Distribution is limited to authorized licensees of RSA
 * Security. Any unauthorized reproduction, distribution or
 * modification of this work is strictly prohibited.
 */

#ifndef HEADER_SSLCTX_ST_H
#define HEADER_SSLCTX_ST_H

#include "hmac.h"
#ifndef NO_EX_DATA
#include "ex_data.h"
#endif /* NO_EX_DATA */
#include "cert.h"

#ifndef NO_PEM
#include "pem.h"
#endif /* NO_PEM */

/*
 * ssl.h is included here so that the structure definitions are visible
 * as typedefs to doxygen so it will format the output in a clearer manner.
 *
 */
#include "ssl.h"

struct ssl_cipher_st
{
    int valid;

    char *name;

    unsigned long id;

    unsigned long algorithms;

    unsigned long algorithm2;

    unsigned long mask;
};

struct ssl_method_st
{
    int version;
    int (*ssl_new)(SSL *ssl);
    void (*ssl_clear)(SSL *ssl);
    void (*ssl_free)(SSL *ssl);
    int (*ssl_accept)(SSL *ssl);
    int (*ssl_connect)(SSL *ssl);
    int (*ssl_read)(SSL *ssl, char *buf, int len);
    int (*ssl_peek)(SSL *ssl, char *buf, int len);
    int (*ssl_write)(SSL *ssl, char *buf, int len);
    int (*ssl_shutdown)(SSL *ssl);
    int (*ssl_renegotiate)(SSL *ssl);
    int (*ssl_renegotiate_check)(SSL *ssl);
    long (*ssl_ctrl)(SSL *ssl, int cmd, long larg, char *parg);
    long (*ssl_ctx_ctrl)(SSL_CTX *ctx, int cmd, long larg, char *parg);
    SSL_CIPHER *(*get_cipher_by_char)(unsigned char *p);
    int (*put_cipher_by_char)(SSL_CIPHER *c, unsigned char *p);
    int (*ssl_pending)(SSL *s);
    int (*num_ciphers)(void);
    SSL_CIPHER *(*get_cipher)(unsigned int u);
    SSL_METHOD *(*get_ssl_method)(int ver);
    long (*get_timeout)(void);
    struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
#if 0
    int (*ssl_version)();
#endif
};

struct ssl_session_st
{
    int ssl_version;

    unsigned int key_arg_length;

    unsigned char key_arg[SSL_MAX_KEY_ARG_LENGTH];

    int master_key_length;

    unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];

    unsigned int session_id_length;

    unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];

    unsigned int sid_ctx_length;

    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

    int not_resumable;

    struct cert_st *cert;

    SSLCERT *peer;

    int references;

    long timeout;

    R_TIME_T *time;

#ifndef NO_COMP
    COMP_CTX *compress_meth;
#endif

    SSL_CIPHER *cipher;

    unsigned long cipher_id;

    STACK *ciphers; /* SSL_CIPHER shared ciphers? */

#ifndef SSLC_SMALL_CODE
    /* Small code builds do not support ex_data */

    CRYPTO_EX_DATA ex_data; /* Application-specific data */
#endif /* !SSLC_SMALL_CODE */

#if (!defined(SSLC_SMALL_CODE) && !defined(NO_SESSION_CACHE))
    /* Small code builds do not support linked lists of sessions that
     * are used by the traditional session caching code only
     */

    /*
     * These are used to make removal of session ids more
     * efficient and to implement a maximum cache size.
     */
    struct ssl_session_st *prev,*next;
#endif /* !SSLC_SMALL_CODE && !NO_SESSION_CACHE */
};

struct ssl_ctx_st
{
    SSL_METHOD *method;
    unsigned long options;
    unsigned long user_options;

    STACK *cipher_list;       /* SSL_CIPHER */
    STACK *cipher_list_by_id; /* SSL_CIPHER same as <tt>cipher_list</tt>
                               * but sorted for lookup
                               */

    SSLCERT_STORE *cert_store; /* X509_STORE */

#ifndef NO_SESSION_CACHE
#ifdef SSLC_SMALL_CODE
    /* SSL-C small code builds support a modified session cache */

    int (*session_cache_cb)(SSL_CTX *ctx,int cmd,SSL_SESSION **sess,void *arg);

    void *session_cache_cb_arg;

#else /* !SSLC_SMALL_CODE */

    struct lhash_st *sessions;        /* A set of SSL sessions */
    /*
     * Maximum number of session-ids that will be cached, default is
     * SSL_SESSION_CACHE_SIZE_DEFAULT. 0 is unlimited.
     */
    unsigned long session_cache_size;
    struct ssl_session_st *session_cache_head;
    struct ssl_session_st *session_cache_tail;

    /*
     * If this callback is not null, it will be called each
     * time a session id is added to the cache.  If this function
     * returns 1, it means that the callback will do a
     * SSL_SESSION_free() when it has finished using it.  Otherwise,
     * on 0, it means the callback has finished with it.
     * If remove_session_cb is not null, it will be called when
     * a session-id is removed from the cache.  Again, a return
     * of 0 means that we should not SSL_SESSION_free() since
     * the application is doing something with it.
     */
    SSL_SESS_NEW_CB_T *new_session_cb;
    SSL_SESS_REMOVE_CB_T *remove_session_cb;
    SSL_SESS_GET_CB_T *get_session_cb;

    struct
    {
        int sess_connect;              /* SSL new conn - started */
        int sess_connect_renegotiate;  /* SSL reneg - requested */
        int sess_connect_good;         /* SSL new conne/reneg - finished */
        int sess_accept;               /* SSL new accept - started */
        int sess_accept_renegotiate;   /* SSL reneg - requested */
        int sess_accept_good;          /* SSL accept/reneg - finished */
        int sess_miss;                 /* Session lookup misses  */
        int sess_timeout;              /* Reuse attempt on time outed session */
        int sess_cache_full;           /* Session removed due to full cache */
        int sess_hit;                  /* Session reuse actually done */
        /*
         * This
         * indicates that the application is supplying
         * session-ids from other processes
         */
        int sess_cb_hit;  /* session id not in the cache passed back via
                           * the callback
                           */
    } stats;

    /* Session id context is a grouping index for sessions */
    unsigned int sid_ctx_length;
    unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

#endif /* !SSLC_SMALL_CODE */

    int session_cache_mode;
#endif /* NO_SESSION_CACHE */

    long session_timeout;

    int references;

    SSL_INFO_CB_T *info_cb;

#if (!defined(SSLC_SMALL_CODE) && !defined(SSL_INFO_CB_ONLY))
    SSL_ALERT_INFO_CB_T *alert_info_cb;
    char *alert_info_arg;

    SSL_APP_DATA_CB_T *app_data_cb;
    char *app_data_arg;
#endif /* (!defined(SSLC_SMALL_CODE) && !defined(SSL_INFO_CB_ONLY)) */

    /*
     * There are two different mechanisms for application replacement
     * of certificate verification routines - one that the library does
     * most of the work for the user and one where the application gets
     * to handle everything.
     */
    SSL_CTX_CERT_VERIFY_CB_T *app_verify_cb;
    char *app_verify_arg;

    SSL_CTX_APP_VERIFY_CB_T *application_verify_cb;
    char *application_verify_arg;


    /* Default values to use in SSL structures when they are created */

    struct cert_st *default_cert;
    int read_ahead;
    int verify_depth; /* For mod_ssl */
    int verify_mode;
#ifndef SSLC_SMALL_CODE
    SSL_VERIFY_CB_T *default_verify_cb;
#endif /* SSLC_SMALL_CODE */

    /* Default password callback */
#ifndef NO_PEM
    PEM_PASSWORD_CB_T *default_passwd_cb;
#endif /* NO_PEM */

    /* Retrieve client cert callback */
    SSL_CTX_CLIENT_CERT_CB_T *client_cert_cb;

#ifndef NO_CA_LIST
    STACK *client_CA; /* Used for client requests */
#endif /* !NO_CA_LIST */

    long client_cert_sz;
    long server_cert_sz;

#ifndef SSLC_SMALL_CODE
    CRYPTO_EX_DATA ex_data;
#endif /* SSLC_SMALL_CODE */

    EVP_MD *rsa_md5; /* For SSLv2 - name is 'ssl2-md5' */
    EVP_MD *md5;     /* For SSLv3/TLSv1 'ssl3-md5' */
    EVP_MD *sha1;    /* For SSLv3/TLSv1 'ssl3->sha1' */
    EVP_MD *dss1;    /* Name is 'DSA-SHA1' */

    STACK *extra_certs;

    int write_buf_size;

    int read_buf_size;
    int blinding;
    int (*ocsi_server_callback)();
    char *ocsi_server_callback_arg;

    R_LIB_CTX *lib_ctx;
    void *r_cr_switch;

    unsigned long max_rsa_n;
    unsigned long max_rsa_e;
};

#endif /* HEADER_SSLCTX_ST_H */

---

Copyright (c) 1999-2005 RSA Security Inc. All rights reserved. 072-001001-2100-001-000 - 2.1