Gitiles
Code Review Sign In
gerrit.omnirom.org / android_external_wpa_supplicant_8 / 8d520ff1dc2da35cdca849e982051b86468016d8 / . / src / tls / tlsv1_common.h
blob: 763a4af3d5611ff43af307f4205ce05de1d721fa [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700[diff] [blame^]1/*
2 * TLSv1 common definitions
3 * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#ifndef TLSV1_COMMON_H
16#define TLSV1_COMMON_H
17
18#include "crypto/crypto.h"
19
20#define TLS_VERSION 0x0301 /* TLSv1 */
21#define TLS_RANDOM_LEN 32
22#define TLS_PRE_MASTER_SECRET_LEN 48
23#define TLS_MASTER_SECRET_LEN 48
24#define TLS_SESSION_ID_MAX_LEN 32
25#define TLS_VERIFY_DATA_LEN 12
26
27/* HandshakeType */
28enum {
29 TLS_HANDSHAKE_TYPE_HELLO_REQUEST = 0,
30 TLS_HANDSHAKE_TYPE_CLIENT_HELLO = 1,
31 TLS_HANDSHAKE_TYPE_SERVER_HELLO = 2,
32 TLS_HANDSHAKE_TYPE_NEW_SESSION_TICKET = 4 /* RFC 4507 */,
33 TLS_HANDSHAKE_TYPE_CERTIFICATE = 11,
34 TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE = 12,
35 TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST = 13,
36 TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE = 14,
37 TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY = 15,
38 TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE = 16,
39 TLS_HANDSHAKE_TYPE_FINISHED = 20,
40 TLS_HANDSHAKE_TYPE_CERTIFICATE_URL = 21 /* RFC 4366 */,
41 TLS_HANDSHAKE_TYPE_CERTIFICATE_STATUS = 22 /* RFC 4366 */
42};
43
44/* CipherSuite */
45#define TLS_NULL_WITH_NULL_NULL 0x0000 /* RFC 2246 */
46#define TLS_RSA_WITH_NULL_MD5 0x0001 /* RFC 2246 */
47#define TLS_RSA_WITH_NULL_SHA 0x0002 /* RFC 2246 */
48#define TLS_RSA_EXPORT_WITH_RC4_40_MD5 0x0003 /* RFC 2246 */
49#define TLS_RSA_WITH_RC4_128_MD5 0x0004 /* RFC 2246 */
50#define TLS_RSA_WITH_RC4_128_SHA 0x0005 /* RFC 2246 */
51#define TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 0x0006 /* RFC 2246 */
52#define TLS_RSA_WITH_IDEA_CBC_SHA 0x0007 /* RFC 2246 */
53#define TLS_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0008 /* RFC 2246 */
54#define TLS_RSA_WITH_DES_CBC_SHA 0x0009 /* RFC 2246 */
55#define TLS_RSA_WITH_3DES_EDE_CBC_SHA 0x000A /* RFC 2246 */
56#define TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA 0x000B /* RFC 2246 */
57#define TLS_DH_DSS_WITH_DES_CBC_SHA 0x000C /* RFC 2246 */
58#define TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA 0x000D /* RFC 2246 */
59#define TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA 0x000E /* RFC 2246 */
60#define TLS_DH_RSA_WITH_DES_CBC_SHA 0x000F /* RFC 2246 */
61#define TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA 0x0010 /* RFC 2246 */
62#define TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA 0x0011 /* RFC 2246 */
63#define TLS_DHE_DSS_WITH_DES_CBC_SHA 0x0012 /* RFC 2246 */
64#define TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA 0x0013 /* RFC 2246 */
65#define TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0014 /* RFC 2246 */
66#define TLS_DHE_RSA_WITH_DES_CBC_SHA 0x0015 /* RFC 2246 */
67#define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x0016 /* RFC 2246 */
68#define TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 0x0017 /* RFC 2246 */
69#define TLS_DH_anon_WITH_RC4_128_MD5 0x0018 /* RFC 2246 */
70#define TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA 0x0019 /* RFC 2246 */
71#define TLS_DH_anon_WITH_DES_CBC_SHA 0x001A /* RFC 2246 */
72#define TLS_DH_anon_WITH_3DES_EDE_CBC_SHA 0x001B /* RFC 2246 */
73#define TLS_RSA_WITH_AES_128_CBC_SHA 0x002F /* RFC 3268 */
74#define TLS_DH_DSS_WITH_AES_128_CBC_SHA 0x0030 /* RFC 3268 */
75#define TLS_DH_RSA_WITH_AES_128_CBC_SHA 0x0031 /* RFC 3268 */
76#define TLS_DHE_DSS_WITH_AES_128_CBC_SHA 0x0032 /* RFC 3268 */
77#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x0033 /* RFC 3268 */
78#define TLS_DH_anon_WITH_AES_128_CBC_SHA 0x0034 /* RFC 3268 */
79#define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035 /* RFC 3268 */
80#define TLS_DH_DSS_WITH_AES_256_CBC_SHA 0x0036 /* RFC 3268 */
81#define TLS_DH_RSA_WITH_AES_256_CBC_SHA 0x0037 /* RFC 3268 */
82#define TLS_DHE_DSS_WITH_AES_256_CBC_SHA 0x0038 /* RFC 3268 */
83#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x0039 /* RFC 3268 */
84#define TLS_DH_anon_WITH_AES_256_CBC_SHA 0x003A /* RFC 3268 */
85
86/* CompressionMethod */
87#define TLS_COMPRESSION_NULL 0
88
89/* AlertLevel */
90#define TLS_ALERT_LEVEL_WARNING 1
91#define TLS_ALERT_LEVEL_FATAL 2
92
93/* AlertDescription */
94#define TLS_ALERT_CLOSE_NOTIFY 0
95#define TLS_ALERT_UNEXPECTED_MESSAGE 10
96#define TLS_ALERT_BAD_RECORD_MAC 20
97#define TLS_ALERT_DECRYPTION_FAILED 21
98#define TLS_ALERT_RECORD_OVERFLOW 22
99#define TLS_ALERT_DECOMPRESSION_FAILURE 30
100#define TLS_ALERT_HANDSHAKE_FAILURE 40
101#define TLS_ALERT_BAD_CERTIFICATE 42
102#define TLS_ALERT_UNSUPPORTED_CERTIFICATE 43
103#define TLS_ALERT_CERTIFICATE_REVOKED 44
104#define TLS_ALERT_CERTIFICATE_EXPIRED 45
105#define TLS_ALERT_CERTIFICATE_UNKNOWN 46
106#define TLS_ALERT_ILLEGAL_PARAMETER 47
107#define TLS_ALERT_UNKNOWN_CA 48
108#define TLS_ALERT_ACCESS_DENIED 49
109#define TLS_ALERT_DECODE_ERROR 50
110#define TLS_ALERT_DECRYPT_ERROR 51
111#define TLS_ALERT_EXPORT_RESTRICTION 60
112#define TLS_ALERT_PROTOCOL_VERSION 70
113#define TLS_ALERT_INSUFFICIENT_SECURITY 71
114#define TLS_ALERT_INTERNAL_ERROR 80
115#define TLS_ALERT_USER_CANCELED 90
116#define TLS_ALERT_NO_RENEGOTIATION 100
117#define TLS_ALERT_UNSUPPORTED_EXTENSION 110 /* RFC 4366 */
118#define TLS_ALERT_CERTIFICATE_UNOBTAINABLE 111 /* RFC 4366 */
119#define TLS_ALERT_UNRECOGNIZED_NAME 112 /* RFC 4366 */
120#define TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE 113 /* RFC 4366 */
121#define TLS_ALERT_BAD_CERTIFICATE_HASH_VALUE 114 /* RFC 4366 */
122
123/* ChangeCipherSpec */
124enum {
125 TLS_CHANGE_CIPHER_SPEC = 1
126};
127
128/* TLS Extensions */
129#define TLS_EXT_SERVER_NAME 0 /* RFC 4366 */
130#define TLS_EXT_MAX_FRAGMENT_LENGTH 1 /* RFC 4366 */
131#define TLS_EXT_CLIENT_CERTIFICATE_URL 2 /* RFC 4366 */
132#define TLS_EXT_TRUSTED_CA_KEYS 3 /* RFC 4366 */
133#define TLS_EXT_TRUNCATED_HMAC 4 /* RFC 4366 */
134#define TLS_EXT_STATUS_REQUEST 5 /* RFC 4366 */
135#define TLS_EXT_SESSION_TICKET 35 /* RFC 4507 */
136
137#define TLS_EXT_PAC_OPAQUE TLS_EXT_SESSION_TICKET /* EAP-FAST terminology */
138
139
140typedef enum {
141 TLS_KEY_X_NULL,
142 TLS_KEY_X_RSA,
143 TLS_KEY_X_RSA_EXPORT,
144 TLS_KEY_X_DH_DSS_EXPORT,
145 TLS_KEY_X_DH_DSS,
146 TLS_KEY_X_DH_RSA_EXPORT,
147 TLS_KEY_X_DH_RSA,
148 TLS_KEY_X_DHE_DSS_EXPORT,
149 TLS_KEY_X_DHE_DSS,
150 TLS_KEY_X_DHE_RSA_EXPORT,
151 TLS_KEY_X_DHE_RSA,
152 TLS_KEY_X_DH_anon_EXPORT,
153 TLS_KEY_X_DH_anon
154} tls_key_exchange;
155
156typedef enum {
157 TLS_CIPHER_NULL,
158 TLS_CIPHER_RC4_40,
159 TLS_CIPHER_RC4_128,
160 TLS_CIPHER_RC2_CBC_40,
161 TLS_CIPHER_IDEA_CBC,
162 TLS_CIPHER_DES40_CBC,
163 TLS_CIPHER_DES_CBC,
164 TLS_CIPHER_3DES_EDE_CBC,
165 TLS_CIPHER_AES_128_CBC,
166 TLS_CIPHER_AES_256_CBC
167} tls_cipher;
168
169typedef enum {
170 TLS_HASH_NULL,
171 TLS_HASH_MD5,
172 TLS_HASH_SHA
173} tls_hash;
174
175struct tls_cipher_suite {
176 u16 suite;
177 tls_key_exchange key_exchange;
178 tls_cipher cipher;
179 tls_hash hash;
180};
181
182typedef enum {
183 TLS_CIPHER_STREAM,
184 TLS_CIPHER_BLOCK
185} tls_cipher_type;
186
187struct tls_cipher_data {
188 tls_cipher cipher;
189 tls_cipher_type type;
190 size_t key_material;
191 size_t expanded_key_material;
192 size_t block_size; /* also iv_size */
193 enum crypto_cipher_alg alg;
194};
195
196
197struct tls_verify_hash {
198 struct crypto_hash *md5_client;
199 struct crypto_hash *sha1_client;
200 struct crypto_hash *md5_server;
201 struct crypto_hash *sha1_server;
202 struct crypto_hash *md5_cert;
203 struct crypto_hash *sha1_cert;
204};
205
206
207const struct tls_cipher_suite * tls_get_cipher_suite(u16 suite);
208const struct tls_cipher_data * tls_get_cipher_data(tls_cipher cipher);
209int tls_server_key_exchange_allowed(tls_cipher cipher);
210int tls_parse_cert(const u8 *buf, size_t len, struct crypto_public_key **pk);
211int tls_verify_hash_init(struct tls_verify_hash *verify);
212void tls_verify_hash_add(struct tls_verify_hash *verify, const u8 *buf,
213 size_t len);
214void tls_verify_hash_free(struct tls_verify_hash *verify);
215
216#endif /* TLSV1_COMMON_H */