← Back to branch summary

~ubuntu-branches/ubuntu/raring/nss/raring-security

« back to all changes in this revision

Viewing changes to mozilla/security/nss/lib/ssl/sslimpl.h

  • Committer: Bazaar Package Importer
  • Author(s): Chris Coulson
  • Date: 2010-03-25 13:46:06 UTC
  • mfrom: (1.1.11 upstream)
  • Revision ID: james.westby@ubuntu.com-20100325134606-bl6liuok2w9l7snv
Tags: 3.12.6-0ubuntu1
* New upstream release 3.12.6 RTM (NSS_3_12_6_RTM)
  - fixes CVE-2009-3555 aka US-CERT VU#120541
* Adjust patches to changed upstream code base
  - update debian/patches/38_kbsd.patch
  - update debian/patches/38_mips64_build.patch
  - update debian/patches/85_security_load.patch
* Remove patches that are merged upstream
  - delete debian/patches/91_nonexec_stack.patch
  - update debian/patches/series
* Bump nspr dependency to 4.8
  - update debian/control
* Add new symbols for 3.12.6
  - update debian/libnss3-1d.symbols

Show diffs side-by-side

added added

removed removed

Lines of Context:
mozilla/security/nss/lib/ssl/sslimpl.h
39
39
 * the terms of any one of the MPL, the GPL or the LGPL.
40
40
 *
41
41
 * ***** END LICENSE BLOCK ***** */
42
 
/* $Id: sslimpl.h,v 1.66 2008/12/17 06:09:19 nelson%bolyard.com Exp $ */
 
42
/* $Id: sslimpl.h,v 1.77 2010/02/10 00:33:50 wtc%google.com Exp $ */
43
43
 
44
44
#ifndef __sslimpl_h_
45
45
#define __sslimpl_h_
130
130
#define SSL_DBG(b)
131
131
#endif
132
132
 
133
 
#ifdef macintosh
134
 
#include "pprthred.h"
135
 
#else
136
133
#include "private/pprthred.h"   /* for PR_InMonitor() */
137
 
#endif
138
134
#define ssl_InMonitor(m) PZ_InMonitor(m)
139
135
 
140
 
#define LSB(x) ((unsigned char) (x & 0xff))
 
136
#define LSB(x) ((unsigned char) ((x) & 0xff))
141
137
#define MSB(x) ((unsigned char) (((unsigned)(x)) >> 8))
142
138
 
143
139
/************************************************************************/
334
330
    unsigned int bypassPKCS11           : 1;  /* 16 */
335
331
    unsigned int noLocks                : 1;  /* 17 */
336
332
    unsigned int enableSessionTickets   : 1;  /* 18 */
 
333
    unsigned int enableDeflate          : 1;  /* 19 */
 
334
    unsigned int enableRenegotiation    : 2;  /* 20-21 */
 
335
    unsigned int requireSafeNegotiation : 1;  /* 22 */
337
336
} sslOptions;
338
337
 
339
338
typedef enum { sslHandshakingUndetermined = 0,
448
447
                               int                  maxout, 
449
448
                               const unsigned char *in,
450
449
                               int                  inlen);
 
450
typedef SECStatus (*SSLCompressor)(void *               context,
 
451
                                   unsigned char *      out,
 
452
                                   int *                outlen,
 
453
                                   int                  maxout,
 
454
                                   const unsigned char *in,
 
455
                                   int                  inlen);
451
456
typedef SECStatus (*SSLDestroy)(void *context, PRBool freeit);
452
457
 
453
458
 
523
528
typedef struct {
524
529
    const ssl3BulkCipherDef *cipher_def;
525
530
    const ssl3MACDef * mac_def;
 
531
    SSLCompressionMethod compression_method;
526
532
    int                mac_size;
527
533
    SSLCipher          encode;
528
534
    SSLCipher          decode;
529
535
    SSLDestroy         destroy;
530
536
    void *             encodeContext;
531
537
    void *             decodeContext;
 
538
    SSLCompressor      compressor;    /* Don't name these fields compress */
 
539
    SSLCompressor      decompressor;  /* and uncompress because zconf.h   */
 
540
                                      /* may define them as macros.       */ 
 
541
    SSLDestroy         destroyCompressContext;
 
542
    void *             compressContext;
 
543
    SSLDestroy         destroyDecompressContext;
 
544
    void *             decompressContext;
532
545
    PRBool             bypassCiphers;   /* did double bypass (at least) */
533
546
    PK11SymKey *       master_secret;
534
547
    SSL3SequenceNumber write_seq_num;
539
552
    SECItem            msItem;
540
553
    unsigned char      key_block[NUM_MIXERS * MD5_LENGTH];
541
554
    unsigned char      raw_master_secret[56];
 
555
    SECItem            srvVirtName;    /* for server: name that was negotiated
 
556
                                        * with a client. For client - is
 
557
                                        * always set to NULL.*/
542
558
} ssl3CipherSpec;
543
559
 
544
560
typedef enum {  never_cached, 
589
605
            SSL3Opaque            sessionID[SSL3_SESSIONID_BYTES];
590
606
 
591
607
            ssl3CipherSuite       cipherSuite;
592
 
            SSL3CompressionMethod compression;
 
608
            SSLCompressionMethod  compression;
593
609
            int                   policy;
594
610
            ssl3SidKeys           keys;
595
611
            CK_MECHANISM_TYPE     masterWrapMech;
634
650
             * ClientHello message.  This field is used by clients.
635
651
             */
636
652
            NewSessionTicket  sessionTicket;
 
653
            SECItem           srvName;
637
654
        } ssl3;
638
655
    } u;
639
656
};
708
725
 
709
726
struct TLSExtensionDataStr {
710
727
    /* registered callbacks that send server hello extensions */
711
 
    ssl3HelloExtensionSender serverSenders[MAX_EXTENSIONS];
 
728
    ssl3HelloExtensionSender serverSenders[SSL_MAX_EXTENSIONS];
712
729
    /* Keep track of the extensions that are negotiated. */
713
730
    PRUint16 numAdvertised;
714
731
    PRUint16 numNegotiated;
715
 
    PRUint16 advertised[MAX_EXTENSIONS];
716
 
    PRUint16 negotiated[MAX_EXTENSIONS];
 
732
    PRUint16 advertised[SSL_MAX_EXTENSIONS];
 
733
    PRUint16 negotiated[SSL_MAX_EXTENSIONS];
717
734
 
718
735
    /* SessionTicket Extension related data. */
719
736
    PRBool ticketTimestampVerified;
720
737
    PRBool emptySessionTicket;
 
738
 
 
739
    /* SNI Extension related data
 
740
     * Names data is not coppied from the input buffer. It can not be
 
741
     * used outside the scope where input buffer is defined and that
 
742
     * is beyond ssl3_HandleClientHello function. */
 
743
    SECItem *sniNameArr;
 
744
    PRUint32 sniNameArrSize;
721
745
};
722
746
 
723
747
/*
735
759
const ssl3KEADef *        kea_def;
736
760
    ssl3CipherSuite       cipher_suite;
737
761
const ssl3CipherSuiteDef *suite_def;
738
 
    SSL3CompressionMethod compression;
 
762
    SSLCompressionMethod  compression;
739
763
    sslBuffer             msg_body;    /* protected by recvBufLock */
740
764
                               /* partial handshake message from record layer */
741
765
    unsigned int          header_bytes; 
748
772
    PRBool                rehandshake; /* immediately start another handshake 
749
773
                                        * when this one finishes */
750
774
    PRBool                usedStepDownKey;  /* we did a server key exchange. */
 
775
    PRBool                sendingSCSV; /* instead of empty RI */
751
776
    sslBuffer             msgState;    /* current state for handshake messages*/
752
777
                                       /* protected by recvBufLock */
753
778
    sslBuffer             messages;    /* Accumulated handshake messages */
 
779
    PRUint16              finishedBytes; /* size of single finished below */
 
780
    union {
 
781
        TLSFinished       tFinished[2]; /* client, then server */
 
782
        SSL3Hashes        sFinished[2];
 
783
        SSL3Opaque        data[72];
 
784
    }                     finishedMsgs;
754
785
#ifdef NSS_ENABLE_ECC
755
786
    PRUint32              negotiatedECCurves; /* bit mask */
756
787
#endif /* NSS_ENABLE_ECC */
827
858
    uint16                ticket_version;
828
859
    SSL3ProtocolVersion   ssl_version;
829
860
    ssl3CipherSuite       cipher_suite;
830
 
    SSL3CompressionMethod compression_method;
 
861
    SSLCompressionMethod  compression_method;
831
862
    SSLSignType           authAlgorithm;
832
863
    uint32                authKeyBits;
833
864
    SSLKEAType            keaType;
844
875
    ClientIdentity        client_identity;
845
876
    SECItem               peer_cert;
846
877
    uint32                timestamp;
 
878
    SECItem               srvName; /* negotiated server name */
847
879
}  SessionTicket;
848
880
 
849
881
/*
989
1021
    unsigned long    recvdCloseNotify;    /* received SSL EOF. */
990
1022
    unsigned long    TCPconnected;       
991
1023
    unsigned long    appDataBuffered;
 
1024
    unsigned long    peerRequestedProtection; /* from old renegotiation */
992
1025
 
993
1026
    /* version of the protocol to use */
994
1027
    SSL3ProtocolVersion version;
1017
1050
    void                     *authCertificateArg;
1018
1051
    SSLGetClientAuthData      getClientAuthData;
1019
1052
    void                     *getClientAuthDataArg;
 
1053
    SSLSNISocketConfig        sniSocketConfig;
 
1054
    void                     *sniSocketConfigArg;
1020
1055
    SSLBadCertHandler         handleBadCert;
1021
1056
    void                     *badCertArg;
1022
1057
    SSLHandshakeCallback      handshakeCallback;
1097
1132
extern char                    ssl_debug;
1098
1133
extern char                    ssl_trace;
1099
1134
extern FILE *                  ssl_trace_iob;
 
1135
extern FILE *                  ssl_keylog_iob;
1100
1136
extern CERTDistNames *         ssl3_server_ca_list;
1101
1137
extern PRUint32                ssl_sid_timeout;
1102
1138
extern PRUint32                ssl3_sid_timeout;
1464
1500
 */
1465
1501
extern PRInt32 ssl3_SendSessionTicketXtn(sslSocket *ss, PRBool append,
1466
1502
                        PRUint32 maxBytes);
 
1503
 
 
1504
/* ClientHello and ServerHello extension senders.
 
1505
 * The code is in ssl3ext.c.
 
1506
 */
 
1507
extern PRInt32 ssl3_SendServerNameXtn(sslSocket *ss, PRBool append,
 
1508
                     PRUint32 maxBytes);
 
1509
 
 
1510
/* Assigns new cert, cert chain and keys to ss->serverCerts
 
1511
 * struct. If certChain is NULL, tries to find one. Aborts if
 
1512
 * fails to do so. If cert and keyPair are NULL - unconfigures
 
1513
 * sslSocket of kea type.*/
 
1514
extern SECStatus ssl_ConfigSecureServer(sslSocket *ss, CERTCertificate *cert,
 
1515
                                        CERTCertificateList *certChain,
 
1516
                                        ssl3KeyPair *keyPair, SSLKEAType kea);
 
1517
/* Return key type for the cert */
 
1518
extern SSLKEAType ssl_FindCertKEAType(CERTCertificate * cert);
 
1519
 
1467
1520
#ifdef NSS_ENABLE_ECC
1468
1521
extern PRInt32 ssl3_SendSupportedCurvesXtn(sslSocket *ss,
1469
1522
                        PRBool append, PRUint32 maxBytes);