wolfSSL | Mbed

Users » sPymbed » Code » wolfSSL

wolfssl/internal.h@17:ff9d1e86ad5f, 2019-11-20 (annotated)

Committer:: sPymbed
Date:: Wed Nov 20 13:27:48 2019 +0000
Revision:: 17:ff9d1e86ad5f
Parent:: 15:117db924cf7c

removed: wolfcrypt

Who changed what in which revision?

User	Revision	Line number	New contents of line
sPymbed	17:ff9d1e86ad5f	1	/* internal.h
sPymbed	17:ff9d1e86ad5f	2	*
sPymbed	17:ff9d1e86ad5f	3	* Copyright (C) 2006-2017 wolfSSL Inc.
sPymbed	17:ff9d1e86ad5f	4	*
sPymbed	17:ff9d1e86ad5f	5	* This file is part of wolfSSL.
sPymbed	17:ff9d1e86ad5f	6	*
sPymbed	17:ff9d1e86ad5f	7	* wolfSSL is free software; you can redistribute it and/or modify
sPymbed	17:ff9d1e86ad5f	8	* it under the terms of the GNU General Public License as published by
sPymbed	17:ff9d1e86ad5f	9	* the Free Software Foundation; either version 2 of the License, or
sPymbed	17:ff9d1e86ad5f	10	* (at your option) any later version.
sPymbed	17:ff9d1e86ad5f	11	*
sPymbed	17:ff9d1e86ad5f	12	* wolfSSL is distributed in the hope that it will be useful,
sPymbed	17:ff9d1e86ad5f	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
sPymbed	17:ff9d1e86ad5f	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
sPymbed	17:ff9d1e86ad5f	15	* GNU General Public License for more details.
sPymbed	17:ff9d1e86ad5f	16	*
sPymbed	17:ff9d1e86ad5f	17	* You should have received a copy of the GNU General Public License
sPymbed	17:ff9d1e86ad5f	18	* along with this program; if not, write to the Free Software
sPymbed	17:ff9d1e86ad5f	19	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
sPymbed	17:ff9d1e86ad5f	20	*/
sPymbed	17:ff9d1e86ad5f	21
sPymbed	17:ff9d1e86ad5f	22
sPymbed	17:ff9d1e86ad5f	23
sPymbed	17:ff9d1e86ad5f	24	#ifndef WOLFSSL_INT_H
sPymbed	17:ff9d1e86ad5f	25	#define WOLFSSL_INT_H
sPymbed	17:ff9d1e86ad5f	26
sPymbed	17:ff9d1e86ad5f	27
sPymbed	17:ff9d1e86ad5f	28	#include <wolfcrypt/types.h>
sPymbed	17:ff9d1e86ad5f	29	#include <wolfssl/ssl.h>
sPymbed	17:ff9d1e86ad5f	30	#ifdef HAVE_CRL
sPymbed	17:ff9d1e86ad5f	31	#include <wolfssl/crl.h>
sPymbed	17:ff9d1e86ad5f	32	#endif
sPymbed	17:ff9d1e86ad5f	33	#include <wolfcrypt/random.h>
sPymbed	17:ff9d1e86ad5f	34	#ifndef NO_DES3
sPymbed	17:ff9d1e86ad5f	35	#include <wolfcrypt/des3.h>
sPymbed	17:ff9d1e86ad5f	36	#endif
sPymbed	17:ff9d1e86ad5f	37	#ifndef NO_HC128
sPymbed	17:ff9d1e86ad5f	38	#include <wolfcrypt/hc128.h>
sPymbed	17:ff9d1e86ad5f	39	#endif
sPymbed	17:ff9d1e86ad5f	40	#ifndef NO_RABBIT
sPymbed	17:ff9d1e86ad5f	41	#include <wolfcrypt/rabbit.h>
sPymbed	17:ff9d1e86ad5f	42	#endif
sPymbed	17:ff9d1e86ad5f	43	#ifdef HAVE_CHACHA
sPymbed	17:ff9d1e86ad5f	44	#include <wolfcrypt/chacha.h>
sPymbed	17:ff9d1e86ad5f	45	#endif
sPymbed	17:ff9d1e86ad5f	46	#ifndef NO_ASN
sPymbed	17:ff9d1e86ad5f	47	#include <wolfcrypt/asn.h>
sPymbed	17:ff9d1e86ad5f	48	#include <wolfcrypt/pkcs12.h>
sPymbed	17:ff9d1e86ad5f	49	#endif
sPymbed	17:ff9d1e86ad5f	50	#ifndef NO_MD5
sPymbed	17:ff9d1e86ad5f	51	#include <wolfcrypt/md5.h>
sPymbed	17:ff9d1e86ad5f	52	#endif
sPymbed	17:ff9d1e86ad5f	53	#ifndef NO_SHA
sPymbed	17:ff9d1e86ad5f	54	#include <wolfcrypt/sha.h>
sPymbed	17:ff9d1e86ad5f	55	#endif
sPymbed	17:ff9d1e86ad5f	56	#ifndef NO_AES
sPymbed	17:ff9d1e86ad5f	57	#include <wolfcrypt/aes.h>
sPymbed	17:ff9d1e86ad5f	58	#endif
sPymbed	17:ff9d1e86ad5f	59	#ifdef HAVE_POLY1305
sPymbed	17:ff9d1e86ad5f	60	#include <wolfcrypt/poly1305.h>
sPymbed	17:ff9d1e86ad5f	61	#endif
sPymbed	17:ff9d1e86ad5f	62	#ifdef HAVE_CAMELLIA
sPymbed	17:ff9d1e86ad5f	63	#include <wolfcrypt/camellia.h>
sPymbed	17:ff9d1e86ad5f	64	#endif
sPymbed	17:ff9d1e86ad5f	65	#include <wolfcrypt/logging.h>
sPymbed	17:ff9d1e86ad5f	66	#ifndef NO_HMAC
sPymbed	17:ff9d1e86ad5f	67	#include <wolfcrypt/hmac.h>
sPymbed	17:ff9d1e86ad5f	68	#endif
sPymbed	17:ff9d1e86ad5f	69	#ifndef NO_RC4
sPymbed	17:ff9d1e86ad5f	70	#include <wolfcrypt/arc4.h>
sPymbed	17:ff9d1e86ad5f	71	#endif
sPymbed	17:ff9d1e86ad5f	72	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	73	#include <wolfcrypt/sha256.h>
sPymbed	17:ff9d1e86ad5f	74	#endif
sPymbed	17:ff9d1e86ad5f	75	#ifdef HAVE_OCSP
sPymbed	17:ff9d1e86ad5f	76	#include <wolfssl/ocsp.h>
sPymbed	17:ff9d1e86ad5f	77	#endif
sPymbed	17:ff9d1e86ad5f	78	#ifdef WOLFSSL_SHA384
sPymbed	17:ff9d1e86ad5f	79	#include <wolfcrypt/sha512.h>
sPymbed	17:ff9d1e86ad5f	80	#endif
sPymbed	17:ff9d1e86ad5f	81	#ifdef WOLFSSL_SHA512
sPymbed	17:ff9d1e86ad5f	82	#include <wolfcrypt/sha512.h>
sPymbed	17:ff9d1e86ad5f	83	#endif
sPymbed	17:ff9d1e86ad5f	84	#ifdef HAVE_AESGCM
sPymbed	17:ff9d1e86ad5f	85	#include <wolfcrypt/sha512.h>
sPymbed	17:ff9d1e86ad5f	86	#endif
sPymbed	17:ff9d1e86ad5f	87	#ifdef WOLFSSL_RIPEMD
sPymbed	17:ff9d1e86ad5f	88	#include <wolfcrypt/ripemd.h>
sPymbed	17:ff9d1e86ad5f	89	#endif
sPymbed	17:ff9d1e86ad5f	90	#ifdef HAVE_IDEA
sPymbed	17:ff9d1e86ad5f	91	#include <wolfcrypt/idea.h>
sPymbed	17:ff9d1e86ad5f	92	#endif
sPymbed	17:ff9d1e86ad5f	93	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	94	#include <wolfcrypt/rsa.h>
sPymbed	17:ff9d1e86ad5f	95	#endif
sPymbed	17:ff9d1e86ad5f	96	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	97	#include <wolfcrypt/ecc.h>
sPymbed	17:ff9d1e86ad5f	98	#endif
sPymbed	17:ff9d1e86ad5f	99	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	100	#include <wolfcrypt/dh.h>
sPymbed	17:ff9d1e86ad5f	101	#endif
sPymbed	17:ff9d1e86ad5f	102	#ifdef HAVE_ED25519
sPymbed	17:ff9d1e86ad5f	103	#include <wolfcrypt/ed25519.h>
sPymbed	17:ff9d1e86ad5f	104	#endif
sPymbed	17:ff9d1e86ad5f	105	#ifdef HAVE_CURVE25519
sPymbed	17:ff9d1e86ad5f	106	#include <wolfcrypt/curve25519.h>
sPymbed	17:ff9d1e86ad5f	107	#endif
sPymbed	17:ff9d1e86ad5f	108
sPymbed	17:ff9d1e86ad5f	109	#include <wolfcrypt/wc_encrypt.h>
sPymbed	17:ff9d1e86ad5f	110	#include <wolfcrypt/hash.h>
sPymbed	17:ff9d1e86ad5f	111
sPymbed	17:ff9d1e86ad5f	112	#if defined(WOLFSSL_CALLBACKS) \|\| defined(OPENSSL_EXTRA)
sPymbed	17:ff9d1e86ad5f	113	#include <wolfssl/callbacks.h>
sPymbed	17:ff9d1e86ad5f	114	#endif
sPymbed	17:ff9d1e86ad5f	115	#ifdef WOLFSSL_CALLBACKS
sPymbed	17:ff9d1e86ad5f	116	#include <signal.h>
sPymbed	17:ff9d1e86ad5f	117	#endif
sPymbed	17:ff9d1e86ad5f	118
sPymbed	17:ff9d1e86ad5f	119	#ifdef USE_WINDOWS_API
sPymbed	17:ff9d1e86ad5f	120	#ifdef WOLFSSL_GAME_BUILD
sPymbed	17:ff9d1e86ad5f	121	#include "system/xtl.h"
sPymbed	17:ff9d1e86ad5f	122	#else
sPymbed	17:ff9d1e86ad5f	123	#if defined(_WIN32_WCE) \|\| defined(WIN32_LEAN_AND_MEAN)
sPymbed	17:ff9d1e86ad5f	124	/* On WinCE winsock2.h must be included before windows.h */
sPymbed	17:ff9d1e86ad5f	125	#include <winsock2.h>
sPymbed	17:ff9d1e86ad5f	126	#endif
sPymbed	17:ff9d1e86ad5f	127	#include <windows.h>
sPymbed	17:ff9d1e86ad5f	128	#endif
sPymbed	17:ff9d1e86ad5f	129	#elif defined(THREADX)
sPymbed	17:ff9d1e86ad5f	130	#ifndef SINGLE_THREADED
sPymbed	17:ff9d1e86ad5f	131	#include "tx_api.h"
sPymbed	17:ff9d1e86ad5f	132	#endif
sPymbed	17:ff9d1e86ad5f	133	#elif defined(MICRIUM)
sPymbed	17:ff9d1e86ad5f	134	/* do nothing, just don't pick Unix */
sPymbed	17:ff9d1e86ad5f	135	#elif defined(FREERTOS) \|\| defined(FREERTOS_TCP) \|\| defined(WOLFSSL_SAFERTOS)
sPymbed	17:ff9d1e86ad5f	136	/* do nothing */
sPymbed	17:ff9d1e86ad5f	137	#elif defined(EBSNET)
sPymbed	17:ff9d1e86ad5f	138	/* do nothing */
sPymbed	17:ff9d1e86ad5f	139	#elif defined(FREESCALE_MQX) \|\| defined(FREESCALE_KSDK_MQX)
sPymbed	17:ff9d1e86ad5f	140	/* do nothing */
sPymbed	17:ff9d1e86ad5f	141	#elif defined(FREESCALE_FREE_RTOS)
sPymbed	17:ff9d1e86ad5f	142	#include "fsl_os_abstraction.h"
sPymbed	17:ff9d1e86ad5f	143	#elif defined(WOLFSSL_uITRON4)
sPymbed	17:ff9d1e86ad5f	144	/* do nothing */
sPymbed	17:ff9d1e86ad5f	145	#elif defined(WOLFSSL_uTKERNEL2)
sPymbed	17:ff9d1e86ad5f	146	/* do nothing */
sPymbed	17:ff9d1e86ad5f	147	#elif defined(WOLFSSL_CMSIS_RTOS)
sPymbed	17:ff9d1e86ad5f	148	#include "cmsis_os.h"
sPymbed	17:ff9d1e86ad5f	149	#elif defined(WOLFSSL_MDK_ARM)
sPymbed	17:ff9d1e86ad5f	150	#if defined(WOLFSSL_MDK5)
sPymbed	17:ff9d1e86ad5f	151	#include "cmsis_os.h"
sPymbed	17:ff9d1e86ad5f	152	#else
sPymbed	17:ff9d1e86ad5f	153	#include <rtl.h>
sPymbed	17:ff9d1e86ad5f	154	#endif
sPymbed	17:ff9d1e86ad5f	155	#elif defined(WOLFSSL_CMSIS_RTOS)
sPymbed	17:ff9d1e86ad5f	156	#include "cmsis_os.h"
sPymbed	17:ff9d1e86ad5f	157	#elif defined(MBED)
sPymbed	17:ff9d1e86ad5f	158	#elif defined(WOLFSSL_TIRTOS)
sPymbed	17:ff9d1e86ad5f	159	/* do nothing */
sPymbed	17:ff9d1e86ad5f	160	#elif defined(INTIME_RTOS)
sPymbed	17:ff9d1e86ad5f	161	#include <rt.h>
sPymbed	17:ff9d1e86ad5f	162	#elif defined(WOLFSSL_NUCLEUS_1_2)
sPymbed	17:ff9d1e86ad5f	163	/* do nothing */
sPymbed	17:ff9d1e86ad5f	164	#else
sPymbed	17:ff9d1e86ad5f	165	#ifndef SINGLE_THREADED
sPymbed	17:ff9d1e86ad5f	166	#define WOLFSSL_PTHREADS
sPymbed	17:ff9d1e86ad5f	167	#include <pthread.h>
sPymbed	17:ff9d1e86ad5f	168	#endif
sPymbed	17:ff9d1e86ad5f	169	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	170	#include <unistd.h> /* for close of BIO */
sPymbed	17:ff9d1e86ad5f	171	#endif
sPymbed	17:ff9d1e86ad5f	172	#endif
sPymbed	17:ff9d1e86ad5f	173
sPymbed	17:ff9d1e86ad5f	174	#ifndef CHAR_BIT
sPymbed	17:ff9d1e86ad5f	175	/* Needed for DTLS without big math */
sPymbed	17:ff9d1e86ad5f	176	#include <limits.h>
sPymbed	17:ff9d1e86ad5f	177	#endif
sPymbed	17:ff9d1e86ad5f	178
sPymbed	17:ff9d1e86ad5f	179
sPymbed	17:ff9d1e86ad5f	180	#ifdef HAVE_LIBZ
sPymbed	17:ff9d1e86ad5f	181	#include "zlib.h"
sPymbed	17:ff9d1e86ad5f	182	#endif
sPymbed	17:ff9d1e86ad5f	183
sPymbed	17:ff9d1e86ad5f	184	#ifdef WOLFSSL_ASYNC_CRYPT
sPymbed	17:ff9d1e86ad5f	185	#include <wolfssl/wolfcrypt/async.h>
sPymbed	17:ff9d1e86ad5f	186	#endif
sPymbed	17:ff9d1e86ad5f	187
sPymbed	17:ff9d1e86ad5f	188	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	189	#ifdef WOLFCRYPT_HAVE_SRP
sPymbed	17:ff9d1e86ad5f	190	#include <wolfssl/wolfcrypt/srp.h>
sPymbed	17:ff9d1e86ad5f	191	#endif
sPymbed	17:ff9d1e86ad5f	192	#endif
sPymbed	17:ff9d1e86ad5f	193
sPymbed	17:ff9d1e86ad5f	194	#ifdef _MSC_VER
sPymbed	17:ff9d1e86ad5f	195	/* 4996 warning to use MS extensions e.g., strcpy_s instead of strncpy */
sPymbed	17:ff9d1e86ad5f	196	#pragma warning(disable: 4996)
sPymbed	17:ff9d1e86ad5f	197	#endif
sPymbed	17:ff9d1e86ad5f	198
sPymbed	17:ff9d1e86ad5f	199	#ifdef NO_SHA
sPymbed	17:ff9d1e86ad5f	200	#define WC_SHA_DIGEST_SIZE 20
sPymbed	17:ff9d1e86ad5f	201	#endif
sPymbed	17:ff9d1e86ad5f	202
sPymbed	17:ff9d1e86ad5f	203	#ifdef NO_SHA256
sPymbed	17:ff9d1e86ad5f	204	#define WC_SHA256_DIGEST_SIZE 32
sPymbed	17:ff9d1e86ad5f	205	#endif
sPymbed	17:ff9d1e86ad5f	206
sPymbed	17:ff9d1e86ad5f	207	#ifdef NO_MD5
sPymbed	17:ff9d1e86ad5f	208	#define WC_MD5_DIGEST_SIZE 16
sPymbed	17:ff9d1e86ad5f	209	#endif
sPymbed	17:ff9d1e86ad5f	210
sPymbed	17:ff9d1e86ad5f	211
sPymbed	17:ff9d1e86ad5f	212	#ifdef __cplusplus
sPymbed	17:ff9d1e86ad5f	213	extern "C" {
sPymbed	17:ff9d1e86ad5f	214	#endif
sPymbed	17:ff9d1e86ad5f	215
sPymbed	17:ff9d1e86ad5f	216	/* Define or comment out the cipher suites you'd like to be compiled in
sPymbed	17:ff9d1e86ad5f	217	make sure to use at least one BUILD_SSL_xxx or BUILD_TLS_xxx is defined
sPymbed	17:ff9d1e86ad5f	218
sPymbed	17:ff9d1e86ad5f	219	When adding cipher suites, add name to cipher_names, idx to cipher_name_idx
sPymbed	17:ff9d1e86ad5f	220
sPymbed	17:ff9d1e86ad5f	221	Now that there is a maximum strength crypto build, the following BUILD_XXX
sPymbed	17:ff9d1e86ad5f	222	flags need to be divided into two groups selected by WOLFSSL_MAX_STRENGTH.
sPymbed	17:ff9d1e86ad5f	223	Those that do not use Perfect Forward Security and do not use AEAD ciphers
sPymbed	17:ff9d1e86ad5f	224	need to be switched off. Allowed suites use (EC)DHE, AES-GCM\|CCM, or
sPymbed	17:ff9d1e86ad5f	225	CHACHA-POLY.
sPymbed	17:ff9d1e86ad5f	226	*/
sPymbed	17:ff9d1e86ad5f	227
sPymbed	17:ff9d1e86ad5f	228	/* Check that if WOLFSSL_MAX_STRENGTH is set that all the required options are
sPymbed	17:ff9d1e86ad5f	229	* not turned off. */
sPymbed	17:ff9d1e86ad5f	230	#if defined(WOLFSSL_MAX_STRENGTH) && \
sPymbed	17:ff9d1e86ad5f	231	((!defined(HAVE_ECC) && (defined(NO_DH) \|\| defined(NO_RSA))) \|\| \
sPymbed	17:ff9d1e86ad5f	232	(!defined(HAVE_AESGCM) && !defined(HAVE_AESCCM) && \
sPymbed	17:ff9d1e86ad5f	233	(!defined(HAVE_POLY1305) \|\| !defined(HAVE_CHACHA))) \|\| \
sPymbed	17:ff9d1e86ad5f	234	(defined(NO_SHA256) && !defined(WOLFSSL_SHA384)) \|\| \
sPymbed	17:ff9d1e86ad5f	235	!defined(NO_OLD_TLS))
sPymbed	17:ff9d1e86ad5f	236
sPymbed	17:ff9d1e86ad5f	237	#error "You are trying to build max strength with requirements disabled."
sPymbed	17:ff9d1e86ad5f	238	#endif
sPymbed	17:ff9d1e86ad5f	239
sPymbed	17:ff9d1e86ad5f	240	/* Have QSH : Quantum-safe Handshake */
sPymbed	17:ff9d1e86ad5f	241	#if defined(HAVE_QSH)
sPymbed	17:ff9d1e86ad5f	242	#define BUILD_TLS_QSH
sPymbed	17:ff9d1e86ad5f	243	#endif
sPymbed	17:ff9d1e86ad5f	244
sPymbed	17:ff9d1e86ad5f	245	#ifndef WOLFSSL_MAX_STRENGTH
sPymbed	17:ff9d1e86ad5f	246
sPymbed	17:ff9d1e86ad5f	247	#if !defined(NO_RSA) && !defined(NO_RC4)
sPymbed	17:ff9d1e86ad5f	248	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	249	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	250	#define BUILD_SSL_RSA_WITH_RC4_128_SHA
sPymbed	17:ff9d1e86ad5f	251	#endif
sPymbed	17:ff9d1e86ad5f	252	#if !defined(NO_MD5)
sPymbed	17:ff9d1e86ad5f	253	#define BUILD_SSL_RSA_WITH_RC4_128_MD5
sPymbed	17:ff9d1e86ad5f	254	#endif
sPymbed	17:ff9d1e86ad5f	255	#endif
sPymbed	17:ff9d1e86ad5f	256	#if !defined(NO_TLS) && defined(HAVE_NTRU) && !defined(NO_SHA) \
sPymbed	17:ff9d1e86ad5f	257	&& defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	258	#define BUILD_TLS_NTRU_RSA_WITH_RC4_128_SHA
sPymbed	17:ff9d1e86ad5f	259	#endif
sPymbed	17:ff9d1e86ad5f	260	#endif
sPymbed	17:ff9d1e86ad5f	261
sPymbed	17:ff9d1e86ad5f	262	#if !defined(NO_RSA) && !defined(NO_DES3)
sPymbed	17:ff9d1e86ad5f	263	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	264	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	265	#define BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	266	#endif
sPymbed	17:ff9d1e86ad5f	267	#if !defined(NO_TLS) && defined(HAVE_NTRU) \
sPymbed	17:ff9d1e86ad5f	268	&& defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	269	#define BUILD_TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	270	#endif
sPymbed	17:ff9d1e86ad5f	271	#endif
sPymbed	17:ff9d1e86ad5f	272	#endif
sPymbed	17:ff9d1e86ad5f	273
sPymbed	17:ff9d1e86ad5f	274	#if !defined(NO_RSA) && defined(HAVE_IDEA)
sPymbed	17:ff9d1e86ad5f	275	#if !defined(NO_SHA) && defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	276	#define BUILD_SSL_RSA_WITH_IDEA_CBC_SHA
sPymbed	17:ff9d1e86ad5f	277	#endif
sPymbed	17:ff9d1e86ad5f	278	#endif
sPymbed	17:ff9d1e86ad5f	279
sPymbed	17:ff9d1e86ad5f	280	#if !defined(NO_RSA) && !defined(NO_AES) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	281	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	282	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	283	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	284	#define BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	285	#endif
sPymbed	17:ff9d1e86ad5f	286	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	287	#define BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	288	#endif
sPymbed	17:ff9d1e86ad5f	289	#endif
sPymbed	17:ff9d1e86ad5f	290	#if defined(HAVE_NTRU) && defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	291	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	292	#define BUILD_TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	293	#endif
sPymbed	17:ff9d1e86ad5f	294	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	295	#define BUILD_TLS_NTRU_RSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	296	#endif
sPymbed	17:ff9d1e86ad5f	297	#endif
sPymbed	17:ff9d1e86ad5f	298	#endif
sPymbed	17:ff9d1e86ad5f	299	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	300	#if !defined (NO_SHA256)
sPymbed	17:ff9d1e86ad5f	301	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	302	#define BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	303	#endif
sPymbed	17:ff9d1e86ad5f	304	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	305	#define BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	306	#endif
sPymbed	17:ff9d1e86ad5f	307	#endif
sPymbed	17:ff9d1e86ad5f	308	#if defined (HAVE_AESGCM)
sPymbed	17:ff9d1e86ad5f	309	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	310	#define BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	311	#endif
sPymbed	17:ff9d1e86ad5f	312	#if defined (WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	313	#define BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	314	#endif
sPymbed	17:ff9d1e86ad5f	315	#endif
sPymbed	17:ff9d1e86ad5f	316	#if defined (HAVE_AESCCM)
sPymbed	17:ff9d1e86ad5f	317	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	318	#define BUILD_TLS_RSA_WITH_AES_128_CCM_8
sPymbed	17:ff9d1e86ad5f	319	#endif
sPymbed	17:ff9d1e86ad5f	320	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	321	#define BUILD_TLS_RSA_WITH_AES_256_CCM_8
sPymbed	17:ff9d1e86ad5f	322	#endif
sPymbed	17:ff9d1e86ad5f	323	#endif
sPymbed	17:ff9d1e86ad5f	324	#if defined(HAVE_BLAKE2)
sPymbed	17:ff9d1e86ad5f	325	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	326	#define BUILD_TLS_RSA_WITH_AES_128_CBC_B2B256
sPymbed	17:ff9d1e86ad5f	327	#endif
sPymbed	17:ff9d1e86ad5f	328	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	329	#define BUILD_TLS_RSA_WITH_AES_256_CBC_B2B256
sPymbed	17:ff9d1e86ad5f	330	#endif
sPymbed	17:ff9d1e86ad5f	331	#endif
sPymbed	17:ff9d1e86ad5f	332	#endif
sPymbed	17:ff9d1e86ad5f	333	#endif
sPymbed	17:ff9d1e86ad5f	334
sPymbed	17:ff9d1e86ad5f	335	#if defined(HAVE_CAMELLIA) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	336	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	337	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	338	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	339	#define BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	340	#define BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	341	#endif
sPymbed	17:ff9d1e86ad5f	342	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	343	#define BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	344	#define BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	345	#endif
sPymbed	17:ff9d1e86ad5f	346	#endif
sPymbed	17:ff9d1e86ad5f	347	#if !defined(NO_DH)
sPymbed	17:ff9d1e86ad5f	348	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	349	#define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	350	#define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	351	#endif
sPymbed	17:ff9d1e86ad5f	352	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	353	#define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	354	#define BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	355	#endif
sPymbed	17:ff9d1e86ad5f	356	#endif
sPymbed	17:ff9d1e86ad5f	357	#endif
sPymbed	17:ff9d1e86ad5f	358	#endif
sPymbed	17:ff9d1e86ad5f	359
sPymbed	17:ff9d1e86ad5f	360	#if defined(WOLFSSL_STATIC_PSK)
sPymbed	17:ff9d1e86ad5f	361	#if !defined(NO_PSK) && !defined(NO_AES) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	362	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	363	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	364	#define BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	365	#endif
sPymbed	17:ff9d1e86ad5f	366	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	367	#define BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	368	#endif
sPymbed	17:ff9d1e86ad5f	369	#endif
sPymbed	17:ff9d1e86ad5f	370	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	371	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	372	#define BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	373	#ifdef HAVE_AESGCM
sPymbed	17:ff9d1e86ad5f	374	#define BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	375	#endif
sPymbed	17:ff9d1e86ad5f	376	#endif /* WOLFSSL_AES_128 */
sPymbed	17:ff9d1e86ad5f	377	#ifdef HAVE_AESCCM
sPymbed	17:ff9d1e86ad5f	378	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	379	#define BUILD_TLS_PSK_WITH_AES_128_CCM_8
sPymbed	17:ff9d1e86ad5f	380	#define BUILD_TLS_PSK_WITH_AES_128_CCM
sPymbed	17:ff9d1e86ad5f	381	#endif
sPymbed	17:ff9d1e86ad5f	382	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	383	#define BUILD_TLS_PSK_WITH_AES_256_CCM_8
sPymbed	17:ff9d1e86ad5f	384	#define BUILD_TLS_PSK_WITH_AES_256_CCM
sPymbed	17:ff9d1e86ad5f	385	#endif
sPymbed	17:ff9d1e86ad5f	386	#endif
sPymbed	17:ff9d1e86ad5f	387	#endif
sPymbed	17:ff9d1e86ad5f	388	#if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	389	#define BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
sPymbed	17:ff9d1e86ad5f	390	#ifdef HAVE_AESGCM
sPymbed	17:ff9d1e86ad5f	391	#define BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	392	#endif
sPymbed	17:ff9d1e86ad5f	393	#endif
sPymbed	17:ff9d1e86ad5f	394	#endif
sPymbed	17:ff9d1e86ad5f	395	#endif
sPymbed	17:ff9d1e86ad5f	396
sPymbed	17:ff9d1e86ad5f	397	#if !defined(NO_TLS) && defined(HAVE_NULL_CIPHER)
sPymbed	17:ff9d1e86ad5f	398	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	399	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	400	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	401	#define BUILD_TLS_RSA_WITH_NULL_SHA
sPymbed	17:ff9d1e86ad5f	402	#endif
sPymbed	17:ff9d1e86ad5f	403	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	404	#define BUILD_TLS_RSA_WITH_NULL_SHA256
sPymbed	17:ff9d1e86ad5f	405	#endif
sPymbed	17:ff9d1e86ad5f	406	#endif
sPymbed	17:ff9d1e86ad5f	407	#endif
sPymbed	17:ff9d1e86ad5f	408	#if !defined(NO_PSK) && defined(WOLFSSL_STATIC_PSK)
sPymbed	17:ff9d1e86ad5f	409	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	410	#define BUILD_TLS_PSK_WITH_NULL_SHA
sPymbed	17:ff9d1e86ad5f	411	#endif
sPymbed	17:ff9d1e86ad5f	412	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	413	#define BUILD_TLS_PSK_WITH_NULL_SHA256
sPymbed	17:ff9d1e86ad5f	414	#endif
sPymbed	17:ff9d1e86ad5f	415	#ifdef WOLFSSL_SHA384
sPymbed	17:ff9d1e86ad5f	416	#define BUILD_TLS_PSK_WITH_NULL_SHA384
sPymbed	17:ff9d1e86ad5f	417	#endif
sPymbed	17:ff9d1e86ad5f	418	#endif
sPymbed	17:ff9d1e86ad5f	419	#endif
sPymbed	17:ff9d1e86ad5f	420
sPymbed	17:ff9d1e86ad5f	421	#if defined(WOLFSSL_STATIC_RSA)
sPymbed	17:ff9d1e86ad5f	422	#if !defined(NO_HC128) && !defined(NO_RSA) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	423	#ifndef NO_MD5
sPymbed	17:ff9d1e86ad5f	424	#define BUILD_TLS_RSA_WITH_HC_128_MD5
sPymbed	17:ff9d1e86ad5f	425	#endif
sPymbed	17:ff9d1e86ad5f	426	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	427	#define BUILD_TLS_RSA_WITH_HC_128_SHA
sPymbed	17:ff9d1e86ad5f	428	#endif
sPymbed	17:ff9d1e86ad5f	429	#if defined(HAVE_BLAKE2)
sPymbed	17:ff9d1e86ad5f	430	#define BUILD_TLS_RSA_WITH_HC_128_B2B256
sPymbed	17:ff9d1e86ad5f	431	#endif
sPymbed	17:ff9d1e86ad5f	432	#endif
sPymbed	17:ff9d1e86ad5f	433
sPymbed	17:ff9d1e86ad5f	434	#if !defined(NO_RABBIT) && !defined(NO_TLS) && !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	435	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	436	#define BUILD_TLS_RSA_WITH_RABBIT_SHA
sPymbed	17:ff9d1e86ad5f	437	#endif
sPymbed	17:ff9d1e86ad5f	438	#endif
sPymbed	17:ff9d1e86ad5f	439	#endif
sPymbed	17:ff9d1e86ad5f	440
sPymbed	17:ff9d1e86ad5f	441	#if !defined(NO_DH) && !defined(NO_AES) && !defined(NO_TLS) && \
sPymbed	17:ff9d1e86ad5f	442	!defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	443
sPymbed	17:ff9d1e86ad5f	444	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	445	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	446	#define BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	447	#endif
sPymbed	17:ff9d1e86ad5f	448	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	449	#define BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	450	#endif
sPymbed	17:ff9d1e86ad5f	451	#if !defined(NO_DES3)
sPymbed	17:ff9d1e86ad5f	452	#define BUILD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	453	#endif
sPymbed	17:ff9d1e86ad5f	454	#endif
sPymbed	17:ff9d1e86ad5f	455	#if !defined(NO_SHA256) && defined(HAVE_AES_CBC)
sPymbed	17:ff9d1e86ad5f	456	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	457	#define BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	458	#endif
sPymbed	17:ff9d1e86ad5f	459	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	460	#define BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	461	#endif
sPymbed	17:ff9d1e86ad5f	462	#endif
sPymbed	17:ff9d1e86ad5f	463	#endif
sPymbed	17:ff9d1e86ad5f	464
sPymbed	17:ff9d1e86ad5f	465	#if defined(HAVE_ANON) && !defined(NO_TLS) && !defined(NO_DH) && \
sPymbed	17:ff9d1e86ad5f	466	!defined(NO_AES) && !defined(NO_SHA) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	467	#define BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	468
sPymbed	17:ff9d1e86ad5f	469	#if defined(WOLFSSL_SHA384) && defined(HAVE_AESGCM)
sPymbed	17:ff9d1e86ad5f	470	#define BUILD_TLS_DH_anon_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	471	#endif
sPymbed	17:ff9d1e86ad5f	472	#endif
sPymbed	17:ff9d1e86ad5f	473
sPymbed	17:ff9d1e86ad5f	474	#if !defined(NO_DH) && !defined(NO_PSK) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	475	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	476	#if !defined(NO_AES) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	477	#define BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	478	#endif
sPymbed	17:ff9d1e86ad5f	479	#ifdef HAVE_NULL_CIPHER
sPymbed	17:ff9d1e86ad5f	480	#define BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
sPymbed	17:ff9d1e86ad5f	481	#endif
sPymbed	17:ff9d1e86ad5f	482	#endif
sPymbed	17:ff9d1e86ad5f	483	#ifdef WOLFSSL_SHA384
sPymbed	17:ff9d1e86ad5f	484	#if !defined(NO_AES) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	485	#define BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
sPymbed	17:ff9d1e86ad5f	486	#endif
sPymbed	17:ff9d1e86ad5f	487	#ifdef HAVE_NULL_CIPHER
sPymbed	17:ff9d1e86ad5f	488	#define BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
sPymbed	17:ff9d1e86ad5f	489	#endif
sPymbed	17:ff9d1e86ad5f	490	#endif
sPymbed	17:ff9d1e86ad5f	491	#endif
sPymbed	17:ff9d1e86ad5f	492
sPymbed	17:ff9d1e86ad5f	493	#if (defined(HAVE_ECC) \|\| defined(HAVE_CURVE25519)) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	494	#if !defined(NO_AES)
sPymbed	17:ff9d1e86ad5f	495	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	496	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	497	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	498	#define BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	499	#endif
sPymbed	17:ff9d1e86ad5f	500	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	501	#define BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	502	#endif
sPymbed	17:ff9d1e86ad5f	503	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	504	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	505	#define BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	506	#endif
sPymbed	17:ff9d1e86ad5f	507	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	508	#define BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	509	#endif
sPymbed	17:ff9d1e86ad5f	510	#endif
sPymbed	17:ff9d1e86ad5f	511	#endif
sPymbed	17:ff9d1e86ad5f	512
sPymbed	17:ff9d1e86ad5f	513	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	514	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	515	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	516	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	517	#endif
sPymbed	17:ff9d1e86ad5f	518	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	519	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	520	#endif
sPymbed	17:ff9d1e86ad5f	521	#endif
sPymbed	17:ff9d1e86ad5f	522
sPymbed	17:ff9d1e86ad5f	523	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	524	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	525	#define BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
sPymbed	17:ff9d1e86ad5f	526	#endif
sPymbed	17:ff9d1e86ad5f	527	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	528	#define BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
sPymbed	17:ff9d1e86ad5f	529	#endif
sPymbed	17:ff9d1e86ad5f	530	#endif
sPymbed	17:ff9d1e86ad5f	531	#endif /* NO_SHA */
sPymbed	17:ff9d1e86ad5f	532	#if !defined(NO_SHA256) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	533	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	534	#define BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	535	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	536	#define BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	537	#endif
sPymbed	17:ff9d1e86ad5f	538	#endif
sPymbed	17:ff9d1e86ad5f	539	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	540	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	541	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	542	#endif
sPymbed	17:ff9d1e86ad5f	543	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	544	#define BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	545	#endif
sPymbed	17:ff9d1e86ad5f	546	#endif
sPymbed	17:ff9d1e86ad5f	547
sPymbed	17:ff9d1e86ad5f	548	#if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	549	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	550	#define BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
sPymbed	17:ff9d1e86ad5f	551	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	552	#define BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
sPymbed	17:ff9d1e86ad5f	553	#endif
sPymbed	17:ff9d1e86ad5f	554	#endif
sPymbed	17:ff9d1e86ad5f	555	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	556	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	557	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
sPymbed	17:ff9d1e86ad5f	558	#endif
sPymbed	17:ff9d1e86ad5f	559	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	560	#define BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
sPymbed	17:ff9d1e86ad5f	561	#endif
sPymbed	17:ff9d1e86ad5f	562	#endif
sPymbed	17:ff9d1e86ad5f	563
sPymbed	17:ff9d1e86ad5f	564	#if defined (HAVE_AESGCM)
sPymbed	17:ff9d1e86ad5f	565	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	566	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	567	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	568	#define BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	569	#endif
sPymbed	17:ff9d1e86ad5f	570	#endif
sPymbed	17:ff9d1e86ad5f	571	#if defined(WOLFSSL_SHA384)
sPymbed	17:ff9d1e86ad5f	572	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	573	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	574	#define BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	575	#endif
sPymbed	17:ff9d1e86ad5f	576	#endif
sPymbed	17:ff9d1e86ad5f	577	#endif
sPymbed	17:ff9d1e86ad5f	578	#endif
sPymbed	17:ff9d1e86ad5f	579
sPymbed	17:ff9d1e86ad5f	580	#if defined(WOLFSSL_STATIC_DH) && defined(WOLFSSL_AES_128) && \
sPymbed	17:ff9d1e86ad5f	581	defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	582	#define BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	583	#endif
sPymbed	17:ff9d1e86ad5f	584
sPymbed	17:ff9d1e86ad5f	585	#if defined(WOLFSSL_SHA384)
sPymbed	17:ff9d1e86ad5f	586	#if defined(WOLFSSL_STATIC_DH) && \
sPymbed	17:ff9d1e86ad5f	587	defined(WOLFSSL_AES_256) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	588	#define BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	589	#endif
sPymbed	17:ff9d1e86ad5f	590	#endif
sPymbed	17:ff9d1e86ad5f	591	#endif
sPymbed	17:ff9d1e86ad5f	592	#endif /* NO_AES */
sPymbed	17:ff9d1e86ad5f	593	#if !defined(NO_RC4)
sPymbed	17:ff9d1e86ad5f	594	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	595	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	596	#define BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
sPymbed	17:ff9d1e86ad5f	597	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	598	#define BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
sPymbed	17:ff9d1e86ad5f	599	#endif
sPymbed	17:ff9d1e86ad5f	600	#endif
sPymbed	17:ff9d1e86ad5f	601
sPymbed	17:ff9d1e86ad5f	602	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	603	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	604	#define BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
sPymbed	17:ff9d1e86ad5f	605	#endif
sPymbed	17:ff9d1e86ad5f	606	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	607	#define BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
sPymbed	17:ff9d1e86ad5f	608	#endif
sPymbed	17:ff9d1e86ad5f	609	#endif
sPymbed	17:ff9d1e86ad5f	610	#endif
sPymbed	17:ff9d1e86ad5f	611	#if !defined(NO_DES3)
sPymbed	17:ff9d1e86ad5f	612	#ifndef NO_SHA
sPymbed	17:ff9d1e86ad5f	613	#if !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	614	#define BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	615	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	616	#define BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	617	#endif
sPymbed	17:ff9d1e86ad5f	618	#endif
sPymbed	17:ff9d1e86ad5f	619
sPymbed	17:ff9d1e86ad5f	620	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	621	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	622	#define BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	623	#endif
sPymbed	17:ff9d1e86ad5f	624	#if defined(WOLFSSL_STATIC_DH) && defined(HAVE_ECC)
sPymbed	17:ff9d1e86ad5f	625	#define BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
sPymbed	17:ff9d1e86ad5f	626	#endif
sPymbed	17:ff9d1e86ad5f	627	#endif /* NO_SHA */
sPymbed	17:ff9d1e86ad5f	628	#endif
sPymbed	17:ff9d1e86ad5f	629	#if defined(HAVE_NULL_CIPHER)
sPymbed	17:ff9d1e86ad5f	630	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	631	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	632	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	633	#define BUILD_TLS_ECDHE_ECDSA_WITH_NULL_SHA
sPymbed	17:ff9d1e86ad5f	634	#endif
sPymbed	17:ff9d1e86ad5f	635	#endif
sPymbed	17:ff9d1e86ad5f	636	#if !defined(NO_PSK) && !defined(NO_SHA256)
sPymbed	17:ff9d1e86ad5f	637	#define BUILD_TLS_ECDHE_PSK_WITH_NULL_SHA256
sPymbed	17:ff9d1e86ad5f	638	#endif
sPymbed	17:ff9d1e86ad5f	639	#endif
sPymbed	17:ff9d1e86ad5f	640	#if !defined(NO_PSK) && !defined(NO_SHA256) && !defined(NO_AES) && \
sPymbed	17:ff9d1e86ad5f	641	defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	642	#define BUILD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
sPymbed	17:ff9d1e86ad5f	643	#endif
sPymbed	17:ff9d1e86ad5f	644	#endif
sPymbed	17:ff9d1e86ad5f	645	#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && !defined(NO_SHA256)
sPymbed	17:ff9d1e86ad5f	646	#if !defined(NO_OLD_POLY1305)
sPymbed	17:ff9d1e86ad5f	647	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	648	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	649	#define BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	650	#endif
sPymbed	17:ff9d1e86ad5f	651	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	652	#define BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	653	#endif
sPymbed	17:ff9d1e86ad5f	654	#if !defined(NO_DH) && !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	655	#define BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	656	#endif
sPymbed	17:ff9d1e86ad5f	657	#endif /* NO_OLD_POLY1305 */
sPymbed	17:ff9d1e86ad5f	658	#if !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	659	#define BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	660	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	661	#define BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	662	#endif
sPymbed	17:ff9d1e86ad5f	663	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	664	#define BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	665	#endif
sPymbed	17:ff9d1e86ad5f	666	#endif /* !NO_PSK */
sPymbed	17:ff9d1e86ad5f	667	#endif
sPymbed	17:ff9d1e86ad5f	668
sPymbed	17:ff9d1e86ad5f	669	#endif /* !WOLFSSL_MAX_STRENGTH */
sPymbed	17:ff9d1e86ad5f	670
sPymbed	17:ff9d1e86ad5f	671	#if !defined(NO_DH) && !defined(NO_AES) && !defined(NO_TLS) && \
sPymbed	17:ff9d1e86ad5f	672	!defined(NO_RSA) && defined(HAVE_AESGCM)
sPymbed	17:ff9d1e86ad5f	673
sPymbed	17:ff9d1e86ad5f	674	#if !defined(NO_SHA256) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	675	#define BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	676	#endif
sPymbed	17:ff9d1e86ad5f	677
sPymbed	17:ff9d1e86ad5f	678	#if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	679	#define BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	680	#endif
sPymbed	17:ff9d1e86ad5f	681	#endif
sPymbed	17:ff9d1e86ad5f	682
sPymbed	17:ff9d1e86ad5f	683	#if !defined(NO_DH) && !defined(NO_PSK) && !defined(NO_TLS)
sPymbed	17:ff9d1e86ad5f	684	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	685	#if defined(HAVE_AESGCM) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	686	#define BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	687	#endif
sPymbed	17:ff9d1e86ad5f	688	#ifdef HAVE_AESCCM
sPymbed	17:ff9d1e86ad5f	689	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	690	#define BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
sPymbed	17:ff9d1e86ad5f	691	#endif
sPymbed	17:ff9d1e86ad5f	692	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	693	#define BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
sPymbed	17:ff9d1e86ad5f	694	#endif
sPymbed	17:ff9d1e86ad5f	695	#endif
sPymbed	17:ff9d1e86ad5f	696	#endif
sPymbed	17:ff9d1e86ad5f	697	#if defined(WOLFSSL_SHA384) && defined(HAVE_AESGCM) && \
sPymbed	17:ff9d1e86ad5f	698	defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	699	#define BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	700	#endif
sPymbed	17:ff9d1e86ad5f	701	#endif
sPymbed	17:ff9d1e86ad5f	702
sPymbed	17:ff9d1e86ad5f	703	#if (defined(HAVE_ECC) \|\| defined(HAVE_CURVE25519)) && !defined(NO_TLS) && \
sPymbed	17:ff9d1e86ad5f	704	!defined(NO_AES)
sPymbed	17:ff9d1e86ad5f	705	#ifdef HAVE_AESGCM
sPymbed	17:ff9d1e86ad5f	706	#if !defined(NO_SHA256) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	707	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	708	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	709	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	710	#endif
sPymbed	17:ff9d1e86ad5f	711	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	712	#define BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	713	#endif
sPymbed	17:ff9d1e86ad5f	714	#endif
sPymbed	17:ff9d1e86ad5f	715	#if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	716	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	717	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	718	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	719	#endif
sPymbed	17:ff9d1e86ad5f	720	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	721	#define BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	722	#endif
sPymbed	17:ff9d1e86ad5f	723	#endif
sPymbed	17:ff9d1e86ad5f	724	#endif
sPymbed	17:ff9d1e86ad5f	725	#if defined(HAVE_AESCCM) && !defined(NO_SHA256)
sPymbed	17:ff9d1e86ad5f	726	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	727	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	728	#ifdef WOLFSSL_AES_128
sPymbed	17:ff9d1e86ad5f	729	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM
sPymbed	17:ff9d1e86ad5f	730	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
sPymbed	17:ff9d1e86ad5f	731	#endif
sPymbed	17:ff9d1e86ad5f	732	#ifdef WOLFSSL_AES_256
sPymbed	17:ff9d1e86ad5f	733	#define BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
sPymbed	17:ff9d1e86ad5f	734	#endif
sPymbed	17:ff9d1e86ad5f	735	#endif
sPymbed	17:ff9d1e86ad5f	736	#endif
sPymbed	17:ff9d1e86ad5f	737	#endif
sPymbed	17:ff9d1e86ad5f	738
sPymbed	17:ff9d1e86ad5f	739	#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && !defined(NO_SHA256)
sPymbed	17:ff9d1e86ad5f	740	#if defined(HAVE_ECC) \|\| defined(HAVE_CURVE25519)
sPymbed	17:ff9d1e86ad5f	741	#if defined(HAVE_ECC) \|\| (defined(HAVE_CURVE25519) && \
sPymbed	17:ff9d1e86ad5f	742	defined(HAVE_ED25519))
sPymbed	17:ff9d1e86ad5f	743	#define BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	744	#endif
sPymbed	17:ff9d1e86ad5f	745	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	746	#define BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	747	#endif
sPymbed	17:ff9d1e86ad5f	748	#endif
sPymbed	17:ff9d1e86ad5f	749	#if !defined(NO_DH) && !defined(NO_RSA)
sPymbed	17:ff9d1e86ad5f	750	#define BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	751	#endif
sPymbed	17:ff9d1e86ad5f	752	#endif
sPymbed	17:ff9d1e86ad5f	753
sPymbed	17:ff9d1e86ad5f	754	#if defined(WOLFSSL_TLS13)
sPymbed	17:ff9d1e86ad5f	755	#ifdef HAVE_AESGCM
sPymbed	17:ff9d1e86ad5f	756	#if !defined(NO_SHA256) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	757	#define BUILD_TLS_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	758	#endif
sPymbed	17:ff9d1e86ad5f	759	#if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
sPymbed	17:ff9d1e86ad5f	760	#define BUILD_TLS_AES_256_GCM_SHA384
sPymbed	17:ff9d1e86ad5f	761	#endif
sPymbed	17:ff9d1e86ad5f	762	#endif
sPymbed	17:ff9d1e86ad5f	763
sPymbed	17:ff9d1e86ad5f	764	#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
sPymbed	17:ff9d1e86ad5f	765	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	766	#define BUILD_TLS_CHACHA20_POLY1305_SHA256
sPymbed	17:ff9d1e86ad5f	767	#endif
sPymbed	17:ff9d1e86ad5f	768	#endif
sPymbed	17:ff9d1e86ad5f	769
sPymbed	17:ff9d1e86ad5f	770	#ifdef HAVE_AESCCM
sPymbed	17:ff9d1e86ad5f	771	#if !defined(NO_SHA256) && defined(WOLFSSL_AES_128)
sPymbed	17:ff9d1e86ad5f	772	#define BUILD_TLS_AES_128_CCM_SHA256
sPymbed	17:ff9d1e86ad5f	773	#define BUILD_TLS_AES_128_CCM_8_SHA256
sPymbed	17:ff9d1e86ad5f	774	#endif
sPymbed	17:ff9d1e86ad5f	775	#endif
sPymbed	17:ff9d1e86ad5f	776	#endif
sPymbed	17:ff9d1e86ad5f	777
sPymbed	17:ff9d1e86ad5f	778	#ifdef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	779	#if defined(HAVE_NULL_CIPHER) && !defined(NO_SHA256)
sPymbed	17:ff9d1e86ad5f	780	#define BUILD_WDM_WITH_NULL_SHA256
sPymbed	17:ff9d1e86ad5f	781	#endif
sPymbed	17:ff9d1e86ad5f	782	#endif
sPymbed	17:ff9d1e86ad5f	783
sPymbed	17:ff9d1e86ad5f	784	#if defined(BUILD_SSL_RSA_WITH_RC4_128_SHA) \|\| \
sPymbed	17:ff9d1e86ad5f	785	defined(BUILD_SSL_RSA_WITH_RC4_128_MD5)
sPymbed	17:ff9d1e86ad5f	786	#define BUILD_ARC4
sPymbed	17:ff9d1e86ad5f	787	#endif
sPymbed	17:ff9d1e86ad5f	788
sPymbed	17:ff9d1e86ad5f	789	#if defined(BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA)
sPymbed	17:ff9d1e86ad5f	790	#define BUILD_DES3
sPymbed	17:ff9d1e86ad5f	791	#endif
sPymbed	17:ff9d1e86ad5f	792
sPymbed	17:ff9d1e86ad5f	793	#if defined(BUILD_TLS_RSA_WITH_AES_128_CBC_SHA) \|\| \
sPymbed	17:ff9d1e86ad5f	794	defined(BUILD_TLS_RSA_WITH_AES_256_CBC_SHA) \|\| \
sPymbed	17:ff9d1e86ad5f	795	defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	796	defined(BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256)
sPymbed	17:ff9d1e86ad5f	797	#undef BUILD_AES
sPymbed	17:ff9d1e86ad5f	798	#define BUILD_AES
sPymbed	17:ff9d1e86ad5f	799	#endif
sPymbed	17:ff9d1e86ad5f	800
sPymbed	17:ff9d1e86ad5f	801	#if defined(BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	802	defined(BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	803	defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	804	defined(BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	805	defined(BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	806	defined(BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384) \|\| \
sPymbed	17:ff9d1e86ad5f	807	defined(BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) \|\| \
sPymbed	17:ff9d1e86ad5f	808	defined(BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) \|\| \
sPymbed	17:ff9d1e86ad5f	809	defined(BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384) \|\| \
sPymbed	17:ff9d1e86ad5f	810	defined(BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384)
sPymbed	17:ff9d1e86ad5f	811	#define BUILD_AESGCM
sPymbed	17:ff9d1e86ad5f	812	#else
sPymbed	17:ff9d1e86ad5f	813	/* No AES-GCM cipher suites available with build */
sPymbed	17:ff9d1e86ad5f	814	#define NO_AESGCM_AEAD
sPymbed	17:ff9d1e86ad5f	815	#endif
sPymbed	17:ff9d1e86ad5f	816
sPymbed	17:ff9d1e86ad5f	817	#if defined(BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	818	defined(BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	819	defined(BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	820	defined(BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	821	defined(BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	822	defined(BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	823	defined(BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	824	defined(BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	825	defined(BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256) \|\| \
sPymbed	17:ff9d1e86ad5f	826	defined(BUILD_TLS_CHACHA20_POLY1305_SHA256)
sPymbed	17:ff9d1e86ad5f	827	/* Have an available ChaCha Poly cipher suite */
sPymbed	17:ff9d1e86ad5f	828	#else
sPymbed	17:ff9d1e86ad5f	829	/* No ChaCha Poly cipher suites available with build */
sPymbed	17:ff9d1e86ad5f	830	#define NO_CHAPOL_AEAD
sPymbed	17:ff9d1e86ad5f	831	#endif
sPymbed	17:ff9d1e86ad5f	832
sPymbed	17:ff9d1e86ad5f	833	#if defined(BUILD_TLS_RSA_WITH_HC_128_SHA) \|\| \
sPymbed	17:ff9d1e86ad5f	834	defined(BUILD_TLS_RSA_WITH_HC_128_MD5) \|\| \
sPymbed	17:ff9d1e86ad5f	835	defined(BUILD_TLS_RSA_WITH_HC_128_B2B256)
sPymbed	17:ff9d1e86ad5f	836	#define BUILD_HC128
sPymbed	17:ff9d1e86ad5f	837	#endif
sPymbed	17:ff9d1e86ad5f	838
sPymbed	17:ff9d1e86ad5f	839	#if defined(BUILD_TLS_RSA_WITH_RABBIT_SHA)
sPymbed	17:ff9d1e86ad5f	840	#define BUILD_RABBIT
sPymbed	17:ff9d1e86ad5f	841	#endif
sPymbed	17:ff9d1e86ad5f	842
sPymbed	17:ff9d1e86ad5f	843	#ifdef NO_DES3
sPymbed	17:ff9d1e86ad5f	844	#define DES_BLOCK_SIZE 8
sPymbed	17:ff9d1e86ad5f	845	#else
sPymbed	17:ff9d1e86ad5f	846	#undef BUILD_DES3
sPymbed	17:ff9d1e86ad5f	847	#define BUILD_DES3
sPymbed	17:ff9d1e86ad5f	848	#endif
sPymbed	17:ff9d1e86ad5f	849
sPymbed	17:ff9d1e86ad5f	850	#if defined(NO_AES) \|\| defined(NO_AES_DECRYPT)
sPymbed	17:ff9d1e86ad5f	851	#define AES_BLOCK_SIZE 16
sPymbed	17:ff9d1e86ad5f	852	#undef BUILD_AES
sPymbed	17:ff9d1e86ad5f	853	#else
sPymbed	17:ff9d1e86ad5f	854	#undef BUILD_AES
sPymbed	17:ff9d1e86ad5f	855	#define BUILD_AES
sPymbed	17:ff9d1e86ad5f	856	#endif
sPymbed	17:ff9d1e86ad5f	857
sPymbed	17:ff9d1e86ad5f	858	#ifndef NO_RC4
sPymbed	17:ff9d1e86ad5f	859	#undef BUILD_ARC4
sPymbed	17:ff9d1e86ad5f	860	#define BUILD_ARC4
sPymbed	17:ff9d1e86ad5f	861	#endif
sPymbed	17:ff9d1e86ad5f	862
sPymbed	17:ff9d1e86ad5f	863	#ifdef HAVE_CHACHA
sPymbed	17:ff9d1e86ad5f	864	#define CHACHA20_BLOCK_SIZE 16
sPymbed	17:ff9d1e86ad5f	865	#endif
sPymbed	17:ff9d1e86ad5f	866
sPymbed	17:ff9d1e86ad5f	867	#if defined(WOLFSSL_MAX_STRENGTH) \|\| \
sPymbed	17:ff9d1e86ad5f	868	(defined(HAVE_AESGCM) && !defined(NO_AESGCM_AEAD)) \|\| \
sPymbed	17:ff9d1e86ad5f	869	defined(HAVE_AESCCM) \|\| \
sPymbed	17:ff9d1e86ad5f	870	(defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && !defined(NO_CHAPOL_AEAD))
sPymbed	17:ff9d1e86ad5f	871
sPymbed	17:ff9d1e86ad5f	872	#define HAVE_AEAD
sPymbed	17:ff9d1e86ad5f	873	#endif
sPymbed	17:ff9d1e86ad5f	874
sPymbed	17:ff9d1e86ad5f	875	#if defined(WOLFSSL_MAX_STRENGTH) \|\| \
sPymbed	17:ff9d1e86ad5f	876	defined(HAVE_ECC) \|\| !defined(NO_DH)
sPymbed	17:ff9d1e86ad5f	877
sPymbed	17:ff9d1e86ad5f	878	#define HAVE_PFS
sPymbed	17:ff9d1e86ad5f	879	#endif
sPymbed	17:ff9d1e86ad5f	880
sPymbed	17:ff9d1e86ad5f	881	#if defined(BUILD_SSL_RSA_WITH_IDEA_CBC_SHA)
sPymbed	17:ff9d1e86ad5f	882	#define BUILD_IDEA
sPymbed	17:ff9d1e86ad5f	883	#endif
sPymbed	17:ff9d1e86ad5f	884
sPymbed	17:ff9d1e86ad5f	885	/* actual cipher values, 2nd byte */
sPymbed	17:ff9d1e86ad5f	886	enum {
sPymbed	17:ff9d1e86ad5f	887	TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x16,
sPymbed	17:ff9d1e86ad5f	888	TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x39,
sPymbed	17:ff9d1e86ad5f	889	TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x33,
sPymbed	17:ff9d1e86ad5f	890	TLS_DH_anon_WITH_AES_128_CBC_SHA = 0x34,
sPymbed	17:ff9d1e86ad5f	891	TLS_RSA_WITH_AES_256_CBC_SHA = 0x35,
sPymbed	17:ff9d1e86ad5f	892	TLS_RSA_WITH_AES_128_CBC_SHA = 0x2F,
sPymbed	17:ff9d1e86ad5f	893	TLS_RSA_WITH_NULL_SHA = 0x02,
sPymbed	17:ff9d1e86ad5f	894	TLS_PSK_WITH_AES_256_CBC_SHA = 0x8d,
sPymbed	17:ff9d1e86ad5f	895	TLS_PSK_WITH_AES_128_CBC_SHA256 = 0xae,
sPymbed	17:ff9d1e86ad5f	896	TLS_PSK_WITH_AES_256_CBC_SHA384 = 0xaf,
sPymbed	17:ff9d1e86ad5f	897	TLS_PSK_WITH_AES_128_CBC_SHA = 0x8c,
sPymbed	17:ff9d1e86ad5f	898	TLS_PSK_WITH_NULL_SHA256 = 0xb0,
sPymbed	17:ff9d1e86ad5f	899	TLS_PSK_WITH_NULL_SHA384 = 0xb1,
sPymbed	17:ff9d1e86ad5f	900	TLS_PSK_WITH_NULL_SHA = 0x2c,
sPymbed	17:ff9d1e86ad5f	901	SSL_RSA_WITH_RC4_128_SHA = 0x05,
sPymbed	17:ff9d1e86ad5f	902	SSL_RSA_WITH_RC4_128_MD5 = 0x04,
sPymbed	17:ff9d1e86ad5f	903	SSL_RSA_WITH_3DES_EDE_CBC_SHA = 0x0A,
sPymbed	17:ff9d1e86ad5f	904	SSL_RSA_WITH_IDEA_CBC_SHA = 0x07,
sPymbed	17:ff9d1e86ad5f	905
sPymbed	17:ff9d1e86ad5f	906	/* ECC suites, first byte is 0xC0 (ECC_BYTE) */
sPymbed	17:ff9d1e86ad5f	907	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x14,
sPymbed	17:ff9d1e86ad5f	908	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x13,
sPymbed	17:ff9d1e86ad5f	909	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0x0A,
sPymbed	17:ff9d1e86ad5f	910	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0x09,
sPymbed	17:ff9d1e86ad5f	911	TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0x11,
sPymbed	17:ff9d1e86ad5f	912	TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0x07,
sPymbed	17:ff9d1e86ad5f	913	TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x12,
sPymbed	17:ff9d1e86ad5f	914	TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA = 0x08,
sPymbed	17:ff9d1e86ad5f	915	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0x27,
sPymbed	17:ff9d1e86ad5f	916	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0x23,
sPymbed	17:ff9d1e86ad5f	917	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0x28,
sPymbed	17:ff9d1e86ad5f	918	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0x24,
sPymbed	17:ff9d1e86ad5f	919	TLS_ECDHE_ECDSA_WITH_NULL_SHA = 0x06,
sPymbed	17:ff9d1e86ad5f	920	TLS_ECDHE_PSK_WITH_NULL_SHA256 = 0x3a,
sPymbed	17:ff9d1e86ad5f	921	TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 = 0x37,
sPymbed	17:ff9d1e86ad5f	922
sPymbed	17:ff9d1e86ad5f	923	/* static ECDH, first byte is 0xC0 (ECC_BYTE) */
sPymbed	17:ff9d1e86ad5f	924	TLS_ECDH_RSA_WITH_AES_256_CBC_SHA = 0x0F,
sPymbed	17:ff9d1e86ad5f	925	TLS_ECDH_RSA_WITH_AES_128_CBC_SHA = 0x0E,
sPymbed	17:ff9d1e86ad5f	926	TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0x05,
sPymbed	17:ff9d1e86ad5f	927	TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA = 0x04,
sPymbed	17:ff9d1e86ad5f	928	TLS_ECDH_RSA_WITH_RC4_128_SHA = 0x0C,
sPymbed	17:ff9d1e86ad5f	929	TLS_ECDH_ECDSA_WITH_RC4_128_SHA = 0x02,
sPymbed	17:ff9d1e86ad5f	930	TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA = 0x0D,
sPymbed	17:ff9d1e86ad5f	931	TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA = 0x03,
sPymbed	17:ff9d1e86ad5f	932	TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 = 0x29,
sPymbed	17:ff9d1e86ad5f	933	TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 = 0x25,
sPymbed	17:ff9d1e86ad5f	934	TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 = 0x2A,
sPymbed	17:ff9d1e86ad5f	935	TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 = 0x26,
sPymbed	17:ff9d1e86ad5f	936
sPymbed	17:ff9d1e86ad5f	937	/* wolfSSL extension - eSTREAM */
sPymbed	17:ff9d1e86ad5f	938	TLS_RSA_WITH_HC_128_MD5 = 0xFB,
sPymbed	17:ff9d1e86ad5f	939	TLS_RSA_WITH_HC_128_SHA = 0xFC,
sPymbed	17:ff9d1e86ad5f	940	TLS_RSA_WITH_RABBIT_SHA = 0xFD,
sPymbed	17:ff9d1e86ad5f	941	WDM_WITH_NULL_SHA256 = 0xFE, /* wolfSSL DTLS Multicast */
sPymbed	17:ff9d1e86ad5f	942
sPymbed	17:ff9d1e86ad5f	943	/* wolfSSL extension - Blake2b 256 */
sPymbed	17:ff9d1e86ad5f	944	TLS_RSA_WITH_AES_128_CBC_B2B256 = 0xF8,
sPymbed	17:ff9d1e86ad5f	945	TLS_RSA_WITH_AES_256_CBC_B2B256 = 0xF9,
sPymbed	17:ff9d1e86ad5f	946	TLS_RSA_WITH_HC_128_B2B256 = 0xFA, /* eSTREAM too */
sPymbed	17:ff9d1e86ad5f	947
sPymbed	17:ff9d1e86ad5f	948	/* wolfSSL extension - NTRU */
sPymbed	17:ff9d1e86ad5f	949	TLS_NTRU_RSA_WITH_RC4_128_SHA = 0xe5,
sPymbed	17:ff9d1e86ad5f	950	TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA = 0xe6,
sPymbed	17:ff9d1e86ad5f	951	TLS_NTRU_RSA_WITH_AES_128_CBC_SHA = 0xe7, /* clashes w/official SHA-256 */
sPymbed	17:ff9d1e86ad5f	952	TLS_NTRU_RSA_WITH_AES_256_CBC_SHA = 0xe8,
sPymbed	17:ff9d1e86ad5f	953
sPymbed	17:ff9d1e86ad5f	954	/* wolfSSL extension - NTRU , Quantum-safe Handshake
sPymbed	17:ff9d1e86ad5f	955	first byte is 0xD0 (QSH_BYTE) */
sPymbed	17:ff9d1e86ad5f	956	TLS_QSH = 0x01,
sPymbed	17:ff9d1e86ad5f	957
sPymbed	17:ff9d1e86ad5f	958	/* SHA256 */
sPymbed	17:ff9d1e86ad5f	959	TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x6b,
sPymbed	17:ff9d1e86ad5f	960	TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x67,
sPymbed	17:ff9d1e86ad5f	961	TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x3d,
sPymbed	17:ff9d1e86ad5f	962	TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x3c,
sPymbed	17:ff9d1e86ad5f	963	TLS_RSA_WITH_NULL_SHA256 = 0x3b,
sPymbed	17:ff9d1e86ad5f	964	TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = 0xb2,
sPymbed	17:ff9d1e86ad5f	965	TLS_DHE_PSK_WITH_NULL_SHA256 = 0xb4,
sPymbed	17:ff9d1e86ad5f	966
sPymbed	17:ff9d1e86ad5f	967	/* SHA384 */
sPymbed	17:ff9d1e86ad5f	968	TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = 0xb3,
sPymbed	17:ff9d1e86ad5f	969	TLS_DHE_PSK_WITH_NULL_SHA384 = 0xb5,
sPymbed	17:ff9d1e86ad5f	970
sPymbed	17:ff9d1e86ad5f	971	/* AES-GCM */
sPymbed	17:ff9d1e86ad5f	972	TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x9c,
sPymbed	17:ff9d1e86ad5f	973	TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x9d,
sPymbed	17:ff9d1e86ad5f	974	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x9e,
sPymbed	17:ff9d1e86ad5f	975	TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x9f,
sPymbed	17:ff9d1e86ad5f	976	TLS_DH_anon_WITH_AES_256_GCM_SHA384 = 0xa7,
sPymbed	17:ff9d1e86ad5f	977	TLS_PSK_WITH_AES_128_GCM_SHA256 = 0xa8,
sPymbed	17:ff9d1e86ad5f	978	TLS_PSK_WITH_AES_256_GCM_SHA384 = 0xa9,
sPymbed	17:ff9d1e86ad5f	979	TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = 0xaa,
sPymbed	17:ff9d1e86ad5f	980	TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = 0xab,
sPymbed	17:ff9d1e86ad5f	981
sPymbed	17:ff9d1e86ad5f	982	/* ECC AES-GCM, first byte is 0xC0 (ECC_BYTE) */
sPymbed	17:ff9d1e86ad5f	983	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x2b,
sPymbed	17:ff9d1e86ad5f	984	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0x2c,
sPymbed	17:ff9d1e86ad5f	985	TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 = 0x2d,
sPymbed	17:ff9d1e86ad5f	986	TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 = 0x2e,
sPymbed	17:ff9d1e86ad5f	987	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x2f,
sPymbed	17:ff9d1e86ad5f	988	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0x30,
sPymbed	17:ff9d1e86ad5f	989	TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 = 0x31,
sPymbed	17:ff9d1e86ad5f	990	TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 = 0x32,
sPymbed	17:ff9d1e86ad5f	991
sPymbed	17:ff9d1e86ad5f	992	/* AES-CCM, first byte is 0xC0 but isn't ECC,
sPymbed	17:ff9d1e86ad5f	993	* also, in some of the other AES-CCM suites
sPymbed	17:ff9d1e86ad5f	994	* there will be second byte number conflicts
sPymbed	17:ff9d1e86ad5f	995	* with non-ECC AES-GCM */
sPymbed	17:ff9d1e86ad5f	996	TLS_RSA_WITH_AES_128_CCM_8 = 0xa0,
sPymbed	17:ff9d1e86ad5f	997	TLS_RSA_WITH_AES_256_CCM_8 = 0xa1,
sPymbed	17:ff9d1e86ad5f	998	TLS_ECDHE_ECDSA_WITH_AES_128_CCM = 0xac,
sPymbed	17:ff9d1e86ad5f	999	TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 = 0xae,
sPymbed	17:ff9d1e86ad5f	1000	TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 = 0xaf,
sPymbed	17:ff9d1e86ad5f	1001	TLS_PSK_WITH_AES_128_CCM = 0xa4,
sPymbed	17:ff9d1e86ad5f	1002	TLS_PSK_WITH_AES_256_CCM = 0xa5,
sPymbed	17:ff9d1e86ad5f	1003	TLS_PSK_WITH_AES_128_CCM_8 = 0xa8,
sPymbed	17:ff9d1e86ad5f	1004	TLS_PSK_WITH_AES_256_CCM_8 = 0xa9,
sPymbed	17:ff9d1e86ad5f	1005	TLS_DHE_PSK_WITH_AES_128_CCM = 0xa6,
sPymbed	17:ff9d1e86ad5f	1006	TLS_DHE_PSK_WITH_AES_256_CCM = 0xa7,
sPymbed	17:ff9d1e86ad5f	1007
sPymbed	17:ff9d1e86ad5f	1008	/* Camellia */
sPymbed	17:ff9d1e86ad5f	1009	TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x41,
sPymbed	17:ff9d1e86ad5f	1010	TLS_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x84,
sPymbed	17:ff9d1e86ad5f	1011	TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0xba,
sPymbed	17:ff9d1e86ad5f	1012	TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0xc0,
sPymbed	17:ff9d1e86ad5f	1013	TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA = 0x45,
sPymbed	17:ff9d1e86ad5f	1014	TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA = 0x88,
sPymbed	17:ff9d1e86ad5f	1015	TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 = 0xbe,
sPymbed	17:ff9d1e86ad5f	1016	TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 = 0xc4,
sPymbed	17:ff9d1e86ad5f	1017
sPymbed	17:ff9d1e86ad5f	1018	/* chacha20-poly1305 suites first byte is 0xCC (CHACHA_BYTE) */
sPymbed	17:ff9d1e86ad5f	1019	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xa8,
sPymbed	17:ff9d1e86ad5f	1020	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 = 0xa9,
sPymbed	17:ff9d1e86ad5f	1021	TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xaa,
sPymbed	17:ff9d1e86ad5f	1022	TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 = 0xac,
sPymbed	17:ff9d1e86ad5f	1023	TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 = 0xab,
sPymbed	17:ff9d1e86ad5f	1024	TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 = 0xad,
sPymbed	17:ff9d1e86ad5f	1025
sPymbed	17:ff9d1e86ad5f	1026	/* chacha20-poly1305 earlier version of nonce and padding (CHACHA_BYTE) */
sPymbed	17:ff9d1e86ad5f	1027	TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 = 0x13,
sPymbed	17:ff9d1e86ad5f	1028	TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256 = 0x14,
sPymbed	17:ff9d1e86ad5f	1029	TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 = 0x15,
sPymbed	17:ff9d1e86ad5f	1030
sPymbed	17:ff9d1e86ad5f	1031	/* TLS v1.3 cipher suites */
sPymbed	17:ff9d1e86ad5f	1032	TLS_AES_128_GCM_SHA256 = 0x01,
sPymbed	17:ff9d1e86ad5f	1033	TLS_AES_256_GCM_SHA384 = 0x02,
sPymbed	17:ff9d1e86ad5f	1034	TLS_CHACHA20_POLY1305_SHA256 = 0x03,
sPymbed	17:ff9d1e86ad5f	1035	TLS_AES_128_CCM_SHA256 = 0x04,
sPymbed	17:ff9d1e86ad5f	1036	TLS_AES_128_CCM_8_SHA256 = 0x05,
sPymbed	17:ff9d1e86ad5f	1037
sPymbed	17:ff9d1e86ad5f	1038	/* Renegotiation Indication Extension Special Suite */
sPymbed	17:ff9d1e86ad5f	1039	TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0xff
sPymbed	17:ff9d1e86ad5f	1040	};
sPymbed	17:ff9d1e86ad5f	1041
sPymbed	17:ff9d1e86ad5f	1042
sPymbed	17:ff9d1e86ad5f	1043	#ifndef WOLFSSL_SESSION_TIMEOUT
sPymbed	17:ff9d1e86ad5f	1044	#define WOLFSSL_SESSION_TIMEOUT 500
sPymbed	17:ff9d1e86ad5f	1045	/* default session resumption cache timeout in seconds */
sPymbed	17:ff9d1e86ad5f	1046	#endif
sPymbed	17:ff9d1e86ad5f	1047
sPymbed	17:ff9d1e86ad5f	1048
sPymbed	17:ff9d1e86ad5f	1049	#ifndef WOLFSSL_DTLS_WINDOW_WORDS
sPymbed	17:ff9d1e86ad5f	1050	#define WOLFSSL_DTLS_WINDOW_WORDS 2
sPymbed	17:ff9d1e86ad5f	1051	#endif /* WOLFSSL_DTLS_WINDOW_WORDS */
sPymbed	17:ff9d1e86ad5f	1052	#define DTLS_WORD_BITS (sizeof(word32) * CHAR_BIT)
sPymbed	17:ff9d1e86ad5f	1053	#define DTLS_SEQ_BITS (WOLFSSL_DTLS_WINDOW_WORDS * DTLS_WORD_BITS)
sPymbed	17:ff9d1e86ad5f	1054	#define DTLS_SEQ_SZ (sizeof(word32) * WOLFSSL_DTLS_WINDOW_WORDS)
sPymbed	17:ff9d1e86ad5f	1055
sPymbed	17:ff9d1e86ad5f	1056	#ifndef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	1057	#define WOLFSSL_DTLS_PEERSEQ_SZ 1
sPymbed	17:ff9d1e86ad5f	1058	#else
sPymbed	17:ff9d1e86ad5f	1059	#ifndef WOLFSSL_MULTICAST_PEERS
sPymbed	17:ff9d1e86ad5f	1060	/* max allowed multicast group peers */
sPymbed	17:ff9d1e86ad5f	1061	#define WOLFSSL_MULTICAST_PEERS 100
sPymbed	17:ff9d1e86ad5f	1062	#endif
sPymbed	17:ff9d1e86ad5f	1063	#define WOLFSSL_DTLS_PEERSEQ_SZ WOLFSSL_MULTICAST_PEERS
sPymbed	17:ff9d1e86ad5f	1064	#endif /* WOLFSSL_MULTICAST */
sPymbed	17:ff9d1e86ad5f	1065
sPymbed	17:ff9d1e86ad5f	1066	#ifndef WOLFSSL_MAX_MTU
sPymbed	17:ff9d1e86ad5f	1067	#define WOLFSSL_MAX_MTU 1500
sPymbed	17:ff9d1e86ad5f	1068	#endif /* WOLFSSL_MAX_MTU */
sPymbed	17:ff9d1e86ad5f	1069
sPymbed	17:ff9d1e86ad5f	1070
sPymbed	17:ff9d1e86ad5f	1071	/* set minimum DH key size allowed */
sPymbed	17:ff9d1e86ad5f	1072	#ifndef WOLFSSL_MIN_DHKEY_BITS
sPymbed	17:ff9d1e86ad5f	1073	#ifdef WOLFSSL_MAX_STRENGTH
sPymbed	17:ff9d1e86ad5f	1074	#define WOLFSSL_MIN_DHKEY_BITS 2048
sPymbed	17:ff9d1e86ad5f	1075	#else
sPymbed	17:ff9d1e86ad5f	1076	#define WOLFSSL_MIN_DHKEY_BITS 1024
sPymbed	17:ff9d1e86ad5f	1077	#endif
sPymbed	17:ff9d1e86ad5f	1078	#endif
sPymbed	17:ff9d1e86ad5f	1079	#if (WOLFSSL_MIN_DHKEY_BITS % 8)
sPymbed	17:ff9d1e86ad5f	1080	#error DH minimum bit size must be multiple of 8
sPymbed	17:ff9d1e86ad5f	1081	#endif
sPymbed	17:ff9d1e86ad5f	1082	#if (WOLFSSL_MIN_DHKEY_BITS > 16000)
sPymbed	17:ff9d1e86ad5f	1083	#error DH minimum bit size must not be greater than 16000
sPymbed	17:ff9d1e86ad5f	1084	#endif
sPymbed	17:ff9d1e86ad5f	1085	#define MIN_DHKEY_SZ (WOLFSSL_MIN_DHKEY_BITS / 8)
sPymbed	17:ff9d1e86ad5f	1086	/* set maximum DH key size allowed */
sPymbed	17:ff9d1e86ad5f	1087	#ifndef WOLFSSL_MAX_DHKEY_BITS
sPymbed	17:ff9d1e86ad5f	1088	#define WOLFSSL_MAX_DHKEY_BITS 4096
sPymbed	17:ff9d1e86ad5f	1089	#endif
sPymbed	17:ff9d1e86ad5f	1090	#if (WOLFSSL_MAX_DHKEY_BITS % 8)
sPymbed	17:ff9d1e86ad5f	1091	#error DH maximum bit size must be multiple of 8
sPymbed	17:ff9d1e86ad5f	1092	#endif
sPymbed	17:ff9d1e86ad5f	1093	#if (WOLFSSL_MAX_DHKEY_BITS > 16000)
sPymbed	17:ff9d1e86ad5f	1094	#error DH maximum bit size must not be greater than 16000
sPymbed	17:ff9d1e86ad5f	1095	#endif
sPymbed	17:ff9d1e86ad5f	1096	#define MAX_DHKEY_SZ (WOLFSSL_MAX_DHKEY_BITS / 8)
sPymbed	17:ff9d1e86ad5f	1097
sPymbed	17:ff9d1e86ad5f	1098
sPymbed	17:ff9d1e86ad5f	1099
sPymbed	17:ff9d1e86ad5f	1100	enum Misc {
sPymbed	17:ff9d1e86ad5f	1101	CIPHER_BYTE = 0x00, /* Default ciphers */
sPymbed	17:ff9d1e86ad5f	1102	ECC_BYTE = 0xC0, /* ECC first cipher suite byte */
sPymbed	17:ff9d1e86ad5f	1103	QSH_BYTE = 0xD0, /* Quantum-safe Handshake cipher suite */
sPymbed	17:ff9d1e86ad5f	1104	CHACHA_BYTE = 0xCC, /* ChaCha first cipher suite */
sPymbed	17:ff9d1e86ad5f	1105	TLS13_BYTE = 0x13, /* TLS v1.3 first byte of cipher suite */
sPymbed	17:ff9d1e86ad5f	1106
sPymbed	17:ff9d1e86ad5f	1107	SEND_CERT = 1,
sPymbed	17:ff9d1e86ad5f	1108	SEND_BLANK_CERT = 2,
sPymbed	17:ff9d1e86ad5f	1109
sPymbed	17:ff9d1e86ad5f	1110	DTLS_MAJOR = 0xfe, /* DTLS major version number */
sPymbed	17:ff9d1e86ad5f	1111	DTLS_MINOR = 0xff, /* DTLS minor version number */
sPymbed	17:ff9d1e86ad5f	1112	DTLSv1_2_MINOR = 0xfd, /* DTLS minor version number */
sPymbed	17:ff9d1e86ad5f	1113	SSLv3_MAJOR = 3, /* SSLv3 and TLSv1+ major version number */
sPymbed	17:ff9d1e86ad5f	1114	SSLv3_MINOR = 0, /* TLSv1 minor version number */
sPymbed	17:ff9d1e86ad5f	1115	TLSv1_MINOR = 1, /* TLSv1 minor version number */
sPymbed	17:ff9d1e86ad5f	1116	TLSv1_1_MINOR = 2, /* TLSv1_1 minor version number */
sPymbed	17:ff9d1e86ad5f	1117	TLSv1_2_MINOR = 3, /* TLSv1_2 minor version number */
sPymbed	17:ff9d1e86ad5f	1118	TLSv1_3_MINOR = 4, /* TLSv1_3 minor version number */
sPymbed	17:ff9d1e86ad5f	1119	#ifndef WOLFSSL_TLS13_FINAL
sPymbed	17:ff9d1e86ad5f	1120	TLS_DRAFT_MAJOR = 0x7f, /* Draft TLS major version number */
sPymbed	17:ff9d1e86ad5f	1121	#ifdef WOLFSSL_TLS13_DRAFT_18
sPymbed	17:ff9d1e86ad5f	1122	TLS_DRAFT_MINOR = 0x12, /* Minor version number of TLS draft */
sPymbed	17:ff9d1e86ad5f	1123	#elif defined(WOLFSSL_TLS13_DRAFT_22)
sPymbed	17:ff9d1e86ad5f	1124	TLS_DRAFT_MINOR = 0x16, /* Minor version number of TLS draft */
sPymbed	17:ff9d1e86ad5f	1125	#elif defined(WOLFSSL_TLS13_DRAFT_23)
sPymbed	17:ff9d1e86ad5f	1126	TLS_DRAFT_MINOR = 0x17, /* Minor version number of TLS draft */
sPymbed	17:ff9d1e86ad5f	1127	#elif defined(WOLFSSL_TLS13_DRAFT_26)
sPymbed	17:ff9d1e86ad5f	1128	TLS_DRAFT_MINOR = 0x1a, /* Minor version number of TLS draft */
sPymbed	17:ff9d1e86ad5f	1129	#else
sPymbed	17:ff9d1e86ad5f	1130	TLS_DRAFT_MINOR = 0x1c, /* Minor version number of TLS draft */
sPymbed	17:ff9d1e86ad5f	1131	#endif
sPymbed	17:ff9d1e86ad5f	1132	#endif
sPymbed	17:ff9d1e86ad5f	1133	OLD_HELLO_ID = 0x01, /* SSLv2 Client Hello Indicator */
sPymbed	17:ff9d1e86ad5f	1134	INVALID_BYTE = 0xff, /* Used to initialize cipher specs values */
sPymbed	17:ff9d1e86ad5f	1135	NO_COMPRESSION = 0,
sPymbed	17:ff9d1e86ad5f	1136	ZLIB_COMPRESSION = 221, /* wolfSSL zlib compression */
sPymbed	17:ff9d1e86ad5f	1137	HELLO_EXT_SIG_ALGO = 13, /* ID for the sig_algo hello extension */
sPymbed	17:ff9d1e86ad5f	1138	HELLO_EXT_EXTMS = 0x0017, /* ID for the extended master secret ext */
sPymbed	17:ff9d1e86ad5f	1139	SECRET_LEN = WOLFSSL_MAX_MASTER_KEY_LENGTH,
sPymbed	17:ff9d1e86ad5f	1140	/* pre RSA and all master */
sPymbed	17:ff9d1e86ad5f	1141	#if defined(WOLFSSL_MYSQL_COMPATIBLE)
sPymbed	17:ff9d1e86ad5f	1142	ENCRYPT_LEN = 1024, /* allow larger static buffer with mysql */
sPymbed	17:ff9d1e86ad5f	1143	#else
sPymbed	17:ff9d1e86ad5f	1144	ENCRYPT_LEN = 512, /* allow 4096 bit static buffer */
sPymbed	17:ff9d1e86ad5f	1145	#endif
sPymbed	17:ff9d1e86ad5f	1146	SIZEOF_SENDER = 4, /* clnt or srvr */
sPymbed	17:ff9d1e86ad5f	1147	FINISHED_SZ = 36, /* WC_MD5_DIGEST_SIZE + WC_SHA_DIGEST_SIZE */
sPymbed	17:ff9d1e86ad5f	1148	MAX_RECORD_SIZE = 16384, /* 2^14, max size by standard */
sPymbed	17:ff9d1e86ad5f	1149	MAX_MSG_EXTRA = 38 + WC_MAX_DIGEST_SIZE,
sPymbed	17:ff9d1e86ad5f	1150	/* max added to msg, mac + pad from */
sPymbed	17:ff9d1e86ad5f	1151	/* RECORD_HEADER_SZ + BLOCK_SZ (pad) + Max
sPymbed	17:ff9d1e86ad5f	1152	digest sz + BLOC_SZ (iv) + pad byte (1) */
sPymbed	17:ff9d1e86ad5f	1153	MAX_COMP_EXTRA = 1024, /* max compression extra */
sPymbed	17:ff9d1e86ad5f	1154	MAX_MTU = WOLFSSL_MAX_MTU, /* max expected MTU */
sPymbed	17:ff9d1e86ad5f	1155	MAX_UDP_SIZE = 8192 - 100, /* was MAX_MTU - 100 */
sPymbed	17:ff9d1e86ad5f	1156	MAX_DH_SZ = (MAX_DHKEY_SZ * 2) + 12,
sPymbed	17:ff9d1e86ad5f	1157	/* 4096 p, pub, g + 2 byte size for each */
sPymbed	17:ff9d1e86ad5f	1158	MAX_STR_VERSION = 8, /* string rep of protocol version */
sPymbed	17:ff9d1e86ad5f	1159
sPymbed	17:ff9d1e86ad5f	1160	PAD_MD5 = 48, /* pad length for finished */
sPymbed	17:ff9d1e86ad5f	1161	PAD_SHA = 40, /* pad length for finished */
sPymbed	17:ff9d1e86ad5f	1162	MAX_PAD_SIZE = 256, /* maximum length of padding */
sPymbed	17:ff9d1e86ad5f	1163
sPymbed	17:ff9d1e86ad5f	1164	LENGTH_SZ = 2, /* length field for HMAC, data only */
sPymbed	17:ff9d1e86ad5f	1165	VERSION_SZ = 2, /* length of proctocol version */
sPymbed	17:ff9d1e86ad5f	1166	SEQ_SZ = 8, /* 64 bit sequence number */
sPymbed	17:ff9d1e86ad5f	1167	ALERT_SIZE = 2, /* level + description */
sPymbed	17:ff9d1e86ad5f	1168	VERIFY_HEADER = 2, /* always use 2 bytes */
sPymbed	17:ff9d1e86ad5f	1169	EXTS_SZ = 2, /* always use 2 bytes */
sPymbed	17:ff9d1e86ad5f	1170	EXT_ID_SZ = 2, /* always use 2 bytes */
sPymbed	17:ff9d1e86ad5f	1171	MAX_DH_SIZE = MAX_DHKEY_SZ+1,
sPymbed	17:ff9d1e86ad5f	1172	/* Max size plus possible leading 0 */
sPymbed	17:ff9d1e86ad5f	1173	NAMED_DH_MASK = 0x100, /* Named group mask for DH parameters */
sPymbed	17:ff9d1e86ad5f	1174	SESSION_HINT_SZ = 4, /* session timeout hint */
sPymbed	17:ff9d1e86ad5f	1175	SESSION_ADD_SZ = 4, /* session age add */
sPymbed	17:ff9d1e86ad5f	1176	TICKET_NONCE_LEN_SZ = 1, /* Ticket nonce length size */
sPymbed	17:ff9d1e86ad5f	1177	DEF_TICKET_NONCE_SZ = 1, /* Default ticket nonce size */
sPymbed	17:ff9d1e86ad5f	1178	MAX_TICKET_NONCE_SZ = 4, /* maximum ticket nonce size */
sPymbed	17:ff9d1e86ad5f	1179	MAX_LIFETIME = 604800, /* maximum ticket lifetime */
sPymbed	17:ff9d1e86ad5f	1180	MAX_EARLY_DATA_SZ = 4096, /* maximum early data size */
sPymbed	17:ff9d1e86ad5f	1181
sPymbed	17:ff9d1e86ad5f	1182	RAN_LEN = 32, /* random length */
sPymbed	17:ff9d1e86ad5f	1183	SEED_LEN = RAN_LEN * 2, /* tls prf seed length */
sPymbed	17:ff9d1e86ad5f	1184	ID_LEN = 32, /* session id length */
sPymbed	17:ff9d1e86ad5f	1185	COOKIE_SECRET_SZ = 14, /* dtls cookie secret size */
sPymbed	17:ff9d1e86ad5f	1186	MAX_COOKIE_LEN = 32, /* max dtls cookie size */
sPymbed	17:ff9d1e86ad5f	1187	COOKIE_SZ = 20, /* use a 20 byte cookie */
sPymbed	17:ff9d1e86ad5f	1188	SUITE_LEN = 2, /* cipher suite sz length */
sPymbed	17:ff9d1e86ad5f	1189	ENUM_LEN = 1, /* always a byte */
sPymbed	17:ff9d1e86ad5f	1190	OPAQUE8_LEN = 1, /* 1 byte */
sPymbed	17:ff9d1e86ad5f	1191	OPAQUE16_LEN = 2, /* 2 bytes */
sPymbed	17:ff9d1e86ad5f	1192	OPAQUE24_LEN = 3, /* 3 bytes */
sPymbed	17:ff9d1e86ad5f	1193	OPAQUE32_LEN = 4, /* 4 bytes */
sPymbed	17:ff9d1e86ad5f	1194	OPAQUE64_LEN = 8, /* 8 bytes */
sPymbed	17:ff9d1e86ad5f	1195	COMP_LEN = 1, /* compression length */
sPymbed	17:ff9d1e86ad5f	1196	CURVE_LEN = 2, /* ecc named curve length */
sPymbed	17:ff9d1e86ad5f	1197	KE_GROUP_LEN = 2, /* key exchange group length */
sPymbed	17:ff9d1e86ad5f	1198	SERVER_ID_LEN = 20, /* server session id length */
sPymbed	17:ff9d1e86ad5f	1199
sPymbed	17:ff9d1e86ad5f	1200	HANDSHAKE_HEADER_SZ = 4, /* type + length(3) */
sPymbed	17:ff9d1e86ad5f	1201	RECORD_HEADER_SZ = 5, /* type + version + len(2) */
sPymbed	17:ff9d1e86ad5f	1202	CERT_HEADER_SZ = 3, /* always 3 bytes */
sPymbed	17:ff9d1e86ad5f	1203	REQ_HEADER_SZ = 2, /* cert request header sz */
sPymbed	17:ff9d1e86ad5f	1204	HINT_LEN_SZ = 2, /* length of hint size field */
sPymbed	17:ff9d1e86ad5f	1205	TRUNCATED_HMAC_SZ = 10, /* length of hmac w/ truncated hmac extension */
sPymbed	17:ff9d1e86ad5f	1206	HELLO_EXT_SZ = 4, /* base length of a hello extension */
sPymbed	17:ff9d1e86ad5f	1207	HELLO_EXT_TYPE_SZ = 2, /* length of a hello extension type */
sPymbed	17:ff9d1e86ad5f	1208	HELLO_EXT_SZ_SZ = 2, /* length of a hello extension size */
sPymbed	17:ff9d1e86ad5f	1209	HELLO_EXT_SIGALGO_SZ = 2, /* length of number of items in sigalgo list */
sPymbed	17:ff9d1e86ad5f	1210
sPymbed	17:ff9d1e86ad5f	1211	DTLS_HANDSHAKE_HEADER_SZ = 12, /* normal + seq(2) + offset(3) + length(3) */
sPymbed	17:ff9d1e86ad5f	1212	DTLS_RECORD_HEADER_SZ = 13, /* normal + epoch(2) + seq_num(6) */
sPymbed	17:ff9d1e86ad5f	1213	DTLS_HANDSHAKE_EXTRA = 8, /* diff from normal */
sPymbed	17:ff9d1e86ad5f	1214	DTLS_RECORD_EXTRA = 8, /* diff from normal */
sPymbed	17:ff9d1e86ad5f	1215	DTLS_HANDSHAKE_SEQ_SZ = 2, /* handshake header sequence number */
sPymbed	17:ff9d1e86ad5f	1216	DTLS_HANDSHAKE_FRAG_SZ = 3, /* fragment offset and length are 24 bit */
sPymbed	17:ff9d1e86ad5f	1217	DTLS_POOL_SZ = 255,/* allowed number of list items in TX pool */
sPymbed	17:ff9d1e86ad5f	1218	DTLS_EXPORT_PRO = 165,/* wolfSSL protocol for serialized session */
sPymbed	17:ff9d1e86ad5f	1219	DTLS_EXPORT_VERSION = 4, /* wolfSSL version for serialized session */
sPymbed	17:ff9d1e86ad5f	1220	DTLS_EXPORT_OPT_SZ = 60, /* amount of bytes used from Options */
sPymbed	17:ff9d1e86ad5f	1221	DTLS_EXPORT_VERSION_3 = 3, /* wolfSSL version before TLS 1.3 addition */
sPymbed	17:ff9d1e86ad5f	1222	DTLS_EXPORT_OPT_SZ_3 = 59, /* amount of bytes used from Options */
sPymbed	17:ff9d1e86ad5f	1223	DTLS_EXPORT_KEY_SZ = 325 + (DTLS_SEQ_SZ * 2),
sPymbed	17:ff9d1e86ad5f	1224	/* max amount of bytes used from Keys */
sPymbed	17:ff9d1e86ad5f	1225	DTLS_EXPORT_MIN_KEY_SZ = 78 + (DTLS_SEQ_SZ * 2),
sPymbed	17:ff9d1e86ad5f	1226	/* min amount of bytes used from Keys */
sPymbed	17:ff9d1e86ad5f	1227	DTLS_EXPORT_SPC_SZ = 16, /* amount of bytes used from CipherSpecs */
sPymbed	17:ff9d1e86ad5f	1228	DTLS_EXPORT_LEN = 2, /* 2 bytes for length and protocol */
sPymbed	17:ff9d1e86ad5f	1229	DTLS_EXPORT_IP = 46, /* max ip size IPv4 mapped IPv6 */
sPymbed	17:ff9d1e86ad5f	1230	MAX_EXPORT_BUFFER = 514, /* max size of buffer for exporting */
sPymbed	17:ff9d1e86ad5f	1231	FINISHED_LABEL_SZ = 15, /* TLS finished label size */
sPymbed	17:ff9d1e86ad5f	1232	TLS_FINISHED_SZ = 12, /* TLS has a shorter size */
sPymbed	17:ff9d1e86ad5f	1233	EXT_MASTER_LABEL_SZ = 22, /* TLS extended master secret label sz */
sPymbed	17:ff9d1e86ad5f	1234	MASTER_LABEL_SZ = 13, /* TLS master secret label sz */
sPymbed	17:ff9d1e86ad5f	1235	KEY_LABEL_SZ = 13, /* TLS key block expansion sz */
sPymbed	17:ff9d1e86ad5f	1236	MAX_PRF_HALF = 256, /* Maximum half secret len */
sPymbed	17:ff9d1e86ad5f	1237	MAX_PRF_LABSEED = 128, /* Maximum label + seed len */
sPymbed	17:ff9d1e86ad5f	1238	MAX_PRF_DIG = 224, /* Maximum digest len */
sPymbed	17:ff9d1e86ad5f	1239	PROTOCOL_LABEL_SZ = 9, /* Length of the protocol label */
sPymbed	17:ff9d1e86ad5f	1240	MAX_LABEL_SZ = 34, /* Maximum length of a label */
sPymbed	17:ff9d1e86ad5f	1241	MAX_HKDF_LABEL_SZ = OPAQUE16_LEN +
sPymbed	17:ff9d1e86ad5f	1242	OPAQUE8_LEN + PROTOCOL_LABEL_SZ + MAX_LABEL_SZ +
sPymbed	17:ff9d1e86ad5f	1243	OPAQUE8_LEN + WC_MAX_DIGEST_SIZE,
sPymbed	17:ff9d1e86ad5f	1244	MAX_REQUEST_SZ = 256, /* Maximum cert req len (no auth yet */
sPymbed	17:ff9d1e86ad5f	1245	SESSION_FLUSH_COUNT = 256, /* Flush session cache unless user turns off */
sPymbed	17:ff9d1e86ad5f	1246	TLS_MAX_PAD_SZ = 255, /* Max padding in TLS */
sPymbed	17:ff9d1e86ad5f	1247
sPymbed	17:ff9d1e86ad5f	1248	#if defined(HAVE_FIPS) && \
sPymbed	17:ff9d1e86ad5f	1249	(!defined(HAVE_FIPS_VERSION) \|\| (HAVE_FIPS_VERSION < 2))
sPymbed	17:ff9d1e86ad5f	1250	MAX_SYM_KEY_SIZE = AES_256_KEY_SIZE,
sPymbed	17:ff9d1e86ad5f	1251	#else
sPymbed	17:ff9d1e86ad5f	1252	MAX_SYM_KEY_SIZE = WC_MAX_SYM_KEY_SIZE,
sPymbed	17:ff9d1e86ad5f	1253	#endif
sPymbed	17:ff9d1e86ad5f	1254
sPymbed	17:ff9d1e86ad5f	1255	#ifdef HAVE_SELFTEST
sPymbed	17:ff9d1e86ad5f	1256	AES_256_KEY_SIZE = 32,
sPymbed	17:ff9d1e86ad5f	1257	AES_IV_SIZE = 16,
sPymbed	17:ff9d1e86ad5f	1258	AES_128_KEY_SIZE = 16,
sPymbed	17:ff9d1e86ad5f	1259	#endif
sPymbed	17:ff9d1e86ad5f	1260
sPymbed	17:ff9d1e86ad5f	1261	MAX_IV_SZ = AES_BLOCK_SIZE,
sPymbed	17:ff9d1e86ad5f	1262
sPymbed	17:ff9d1e86ad5f	1263	AEAD_SEQ_OFFSET = 4, /* Auth Data: Sequence number */
sPymbed	17:ff9d1e86ad5f	1264	AEAD_TYPE_OFFSET = 8, /* Auth Data: Type */
sPymbed	17:ff9d1e86ad5f	1265	AEAD_VMAJ_OFFSET = 9, /* Auth Data: Major Version */
sPymbed	17:ff9d1e86ad5f	1266	AEAD_VMIN_OFFSET = 10, /* Auth Data: Minor Version */
sPymbed	17:ff9d1e86ad5f	1267	AEAD_LEN_OFFSET = 11, /* Auth Data: Length */
sPymbed	17:ff9d1e86ad5f	1268	AEAD_AUTH_DATA_SZ = 13, /* Size of the data to authenticate */
sPymbed	17:ff9d1e86ad5f	1269	AEAD_NONCE_SZ = 12,
sPymbed	17:ff9d1e86ad5f	1270	AESGCM_IMP_IV_SZ = 4, /* Size of GCM/CCM AEAD implicit IV */
sPymbed	17:ff9d1e86ad5f	1271	AESGCM_EXP_IV_SZ = 8, /* Size of GCM/CCM AEAD explicit IV */
sPymbed	17:ff9d1e86ad5f	1272	AESGCM_NONCE_SZ = AESGCM_EXP_IV_SZ + AESGCM_IMP_IV_SZ,
sPymbed	17:ff9d1e86ad5f	1273
sPymbed	17:ff9d1e86ad5f	1274	CHACHA20_IMP_IV_SZ = 12, /* Size of ChaCha20 AEAD implicit IV */
sPymbed	17:ff9d1e86ad5f	1275	CHACHA20_NONCE_SZ = 12, /* Size of ChacCha20 nonce */
sPymbed	17:ff9d1e86ad5f	1276	CHACHA20_OLD_OFFSET = 4, /* Offset for seq # in old poly1305 */
sPymbed	17:ff9d1e86ad5f	1277
sPymbed	17:ff9d1e86ad5f	1278	/* For any new implicit/explicit IV size adjust AEAD_MAX_**_SZ /
sPymbed	17:ff9d1e86ad5f	1279
sPymbed	17:ff9d1e86ad5f	1280	AES_GCM_AUTH_SZ = 16, /* AES-GCM Auth Tag length */
sPymbed	17:ff9d1e86ad5f	1281	AES_CCM_16_AUTH_SZ = 16, /* AES-CCM-16 Auth Tag length */
sPymbed	17:ff9d1e86ad5f	1282	AES_CCM_8_AUTH_SZ = 8, /* AES-CCM-8 Auth Tag Length */
sPymbed	17:ff9d1e86ad5f	1283	AESCCM_NONCE_SZ = 12,
sPymbed	17:ff9d1e86ad5f	1284
sPymbed	17:ff9d1e86ad5f	1285	CAMELLIA_128_KEY_SIZE = 16, /* for 128 bit */
sPymbed	17:ff9d1e86ad5f	1286	CAMELLIA_192_KEY_SIZE = 24, /* for 192 bit */
sPymbed	17:ff9d1e86ad5f	1287	CAMELLIA_256_KEY_SIZE = 32, /* for 256 bit */
sPymbed	17:ff9d1e86ad5f	1288	CAMELLIA_IV_SIZE = 16, /* always block size */
sPymbed	17:ff9d1e86ad5f	1289
sPymbed	17:ff9d1e86ad5f	1290	CHACHA20_256_KEY_SIZE = 32, /* for 256 bit */
sPymbed	17:ff9d1e86ad5f	1291	CHACHA20_128_KEY_SIZE = 16, /* for 128 bit */
sPymbed	17:ff9d1e86ad5f	1292	CHACHA20_IV_SIZE = 12, /* 96 bits for iv */
sPymbed	17:ff9d1e86ad5f	1293
sPymbed	17:ff9d1e86ad5f	1294	POLY1305_AUTH_SZ = 16, /* 128 bits */
sPymbed	17:ff9d1e86ad5f	1295
sPymbed	17:ff9d1e86ad5f	1296	HC_128_KEY_SIZE = 16, /* 128 bits */
sPymbed	17:ff9d1e86ad5f	1297	HC_128_IV_SIZE = 16, /* also 128 bits */
sPymbed	17:ff9d1e86ad5f	1298
sPymbed	17:ff9d1e86ad5f	1299	RABBIT_KEY_SIZE = 16, /* 128 bits */
sPymbed	17:ff9d1e86ad5f	1300	RABBIT_IV_SIZE = 8, /* 64 bits for iv */
sPymbed	17:ff9d1e86ad5f	1301
sPymbed	17:ff9d1e86ad5f	1302	EVP_SALT_SIZE = 8, /* evp salt size 64 bits */
sPymbed	17:ff9d1e86ad5f	1303
sPymbed	17:ff9d1e86ad5f	1304	ECDHE_SIZE = 32, /* ECHDE server size defaults to 256 bit */
sPymbed	17:ff9d1e86ad5f	1305	MAX_EXPORT_ECC_SZ = 256, /* Export ANS X9.62 max future size */
sPymbed	17:ff9d1e86ad5f	1306	MAX_CURVE_NAME_SZ = 16, /* Maximum size of curve name string */
sPymbed	17:ff9d1e86ad5f	1307
sPymbed	17:ff9d1e86ad5f	1308	NEW_SA_MAJOR = 8, /* Most signicant byte used with new sig algos */
sPymbed	17:ff9d1e86ad5f	1309	ED25519_SA_MAJOR = 8, /* Most significant byte for ED25519 */
sPymbed	17:ff9d1e86ad5f	1310	ED25519_SA_MINOR = 7, /* Least significant byte for ED25519 */
sPymbed	17:ff9d1e86ad5f	1311	ED448_SA_MAJOR = 8, /* Most significant byte for ED448 */
sPymbed	17:ff9d1e86ad5f	1312	ED448_SA_MINOR = 8, /* Least significant byte for ED448 */
sPymbed	17:ff9d1e86ad5f	1313
sPymbed	17:ff9d1e86ad5f	1314	MIN_RSA_SHA512_PSS_BITS = 512 * 2 + 8 * 8, /* Min key size */
sPymbed	17:ff9d1e86ad5f	1315	MIN_RSA_SHA384_PSS_BITS = 384 * 2 + 8 * 8, /* Min key size */
sPymbed	17:ff9d1e86ad5f	1316
sPymbed	17:ff9d1e86ad5f	1317	MAX_CERT_VERIFY_SZ = 1024, /* max */
sPymbed	17:ff9d1e86ad5f	1318	CLIENT_HELLO_FIRST = 35, /* Protocol + RAN_LEN + sizeof(id_len) */
sPymbed	17:ff9d1e86ad5f	1319	MAX_SUITE_NAME = 48, /* maximum length of cipher suite string */
sPymbed	17:ff9d1e86ad5f	1320
sPymbed	17:ff9d1e86ad5f	1321	DTLS_TIMEOUT_INIT = 1, /* default timeout init for DTLS receive */
sPymbed	17:ff9d1e86ad5f	1322	DTLS_TIMEOUT_MAX = 64, /* default max timeout for DTLS receive */
sPymbed	17:ff9d1e86ad5f	1323	DTLS_TIMEOUT_MULTIPLIER = 2, /* default timeout multiplier for DTLS recv */
sPymbed	17:ff9d1e86ad5f	1324
sPymbed	17:ff9d1e86ad5f	1325	MAX_PSK_ID_LEN = 128, /* max psk identity/hint supported */
sPymbed	17:ff9d1e86ad5f	1326	NULL_TERM_LEN = 1, /* length of null '\0' termination character */
sPymbed	17:ff9d1e86ad5f	1327	MAX_PSK_KEY_LEN = 64, /* max psk key supported */
sPymbed	17:ff9d1e86ad5f	1328	MIN_PSK_ID_LEN = 6, /* min length of identities */
sPymbed	17:ff9d1e86ad5f	1329	MIN_PSK_BINDERS_LEN= 33, /* min length of binders */
sPymbed	17:ff9d1e86ad5f	1330	MAX_TICKET_AGE_SECS= 10, /* maximum ticket age in seconds */
sPymbed	17:ff9d1e86ad5f	1331
sPymbed	17:ff9d1e86ad5f	1332	MAX_WOLFSSL_FILE_SIZE = 1024 * 1024 * 4, /* 4 mb file size alloc limit */
sPymbed	17:ff9d1e86ad5f	1333
sPymbed	17:ff9d1e86ad5f	1334	#if defined(HAVE_EX_DATA) \|\| defined(FORTRESS)
sPymbed	17:ff9d1e86ad5f	1335	MAX_EX_DATA = 5, /* allow for five items of ex_data */
sPymbed	17:ff9d1e86ad5f	1336	#endif
sPymbed	17:ff9d1e86ad5f	1337
sPymbed	17:ff9d1e86ad5f	1338	MAX_X509_SIZE = 2048, /* max static x509 buffer size */
sPymbed	17:ff9d1e86ad5f	1339	CERT_MIN_SIZE = 256, /* min PEM cert size with header/footer */
sPymbed	17:ff9d1e86ad5f	1340
sPymbed	17:ff9d1e86ad5f	1341	MAX_NTRU_PUB_KEY_SZ = 1027, /* NTRU max for now */
sPymbed	17:ff9d1e86ad5f	1342	MAX_NTRU_ENCRYPT_SZ = 1027, /* NTRU max for now */
sPymbed	17:ff9d1e86ad5f	1343	MAX_NTRU_BITS = 256, /* max symmetric bit strength */
sPymbed	17:ff9d1e86ad5f	1344	NO_SNIFF = 0, /* not sniffing */
sPymbed	17:ff9d1e86ad5f	1345	SNIFF = 1, /* currently sniffing */
sPymbed	17:ff9d1e86ad5f	1346
sPymbed	17:ff9d1e86ad5f	1347	HASH_SIG_SIZE = 2, /* default SHA1 RSA */
sPymbed	17:ff9d1e86ad5f	1348
sPymbed	17:ff9d1e86ad5f	1349	NO_COPY = 0, /* should we copy static buffer for write */
sPymbed	17:ff9d1e86ad5f	1350	COPY = 1, /* should we copy static buffer for write */
sPymbed	17:ff9d1e86ad5f	1351
sPymbed	17:ff9d1e86ad5f	1352	INVALID_PEER_ID = 0xFFFF, /* Initialize value for peer ID. */
sPymbed	17:ff9d1e86ad5f	1353
sPymbed	17:ff9d1e86ad5f	1354	PREV_ORDER = -1, /* Sequence number is in previous epoch. */
sPymbed	17:ff9d1e86ad5f	1355	PEER_ORDER = 1, /* Peer sequence number for verify. */
sPymbed	17:ff9d1e86ad5f	1356	CUR_ORDER = 0, /* Current sequence number. */
sPymbed	17:ff9d1e86ad5f	1357	WRITE_PROTO = 1, /* writing a protocol message */
sPymbed	17:ff9d1e86ad5f	1358	READ_PROTO = 0 /* reading a protocol message */
sPymbed	17:ff9d1e86ad5f	1359	};
sPymbed	17:ff9d1e86ad5f	1360
sPymbed	17:ff9d1e86ad5f	1361	/* minimum Downgrade Minor version */
sPymbed	17:ff9d1e86ad5f	1362	#ifndef WOLFSSL_MIN_DOWNGRADE
sPymbed	17:ff9d1e86ad5f	1363	#ifndef NO_OLD_TLS
sPymbed	17:ff9d1e86ad5f	1364	#define WOLFSSL_MIN_DOWNGRADE TLSv1_MINOR
sPymbed	17:ff9d1e86ad5f	1365	#else
sPymbed	17:ff9d1e86ad5f	1366	#define WOLFSSL_MIN_DOWNGRADE TLSv1_2_MINOR
sPymbed	17:ff9d1e86ad5f	1367	#endif
sPymbed	17:ff9d1e86ad5f	1368	#endif
sPymbed	17:ff9d1e86ad5f	1369
sPymbed	17:ff9d1e86ad5f	1370	/* Set max implicit IV size for AEAD cipher suites */
sPymbed	17:ff9d1e86ad5f	1371	#define AEAD_MAX_IMP_SZ 12
sPymbed	17:ff9d1e86ad5f	1372
sPymbed	17:ff9d1e86ad5f	1373	/* Set max explicit IV size for AEAD cipher suites */
sPymbed	17:ff9d1e86ad5f	1374	#define AEAD_MAX_EXP_SZ 8
sPymbed	17:ff9d1e86ad5f	1375
sPymbed	17:ff9d1e86ad5f	1376
sPymbed	17:ff9d1e86ad5f	1377	#ifndef WOLFSSL_MAX_SUITE_SZ
sPymbed	17:ff9d1e86ad5f	1378	#define WOLFSSL_MAX_SUITE_SZ 300
sPymbed	17:ff9d1e86ad5f	1379	/* 150 suites for now! */
sPymbed	17:ff9d1e86ad5f	1380	#endif
sPymbed	17:ff9d1e86ad5f	1381
sPymbed	17:ff9d1e86ad5f	1382	/* number of items in the signature algo list */
sPymbed	17:ff9d1e86ad5f	1383	#ifndef WOLFSSL_MAX_SIGALGO
sPymbed	17:ff9d1e86ad5f	1384	#define WOLFSSL_MAX_SIGALGO 32
sPymbed	17:ff9d1e86ad5f	1385	#endif
sPymbed	17:ff9d1e86ad5f	1386
sPymbed	17:ff9d1e86ad5f	1387
sPymbed	17:ff9d1e86ad5f	1388	/* set minimum ECC key size allowed */
sPymbed	17:ff9d1e86ad5f	1389	#ifndef WOLFSSL_MIN_ECC_BITS
sPymbed	17:ff9d1e86ad5f	1390	#ifdef WOLFSSL_MAX_STRENGTH
sPymbed	17:ff9d1e86ad5f	1391	#define WOLFSSL_MIN_ECC_BITS 256
sPymbed	17:ff9d1e86ad5f	1392	#else
sPymbed	17:ff9d1e86ad5f	1393	#define WOLFSSL_MIN_ECC_BITS 224
sPymbed	17:ff9d1e86ad5f	1394	#endif
sPymbed	17:ff9d1e86ad5f	1395	#endif /* WOLFSSL_MIN_ECC_BITS */
sPymbed	17:ff9d1e86ad5f	1396	#if (WOLFSSL_MIN_ECC_BITS % 8)
sPymbed	17:ff9d1e86ad5f	1397	/* Some ECC keys are not divisable by 8 such as prime239v1 or sect131r1.
sPymbed	17:ff9d1e86ad5f	1398	In these cases round down to the nearest value divisable by 8. The
sPymbed	17:ff9d1e86ad5f	1399	restriction of being divisable by 8 is in place to match wc_ecc_size
sPymbed	17:ff9d1e86ad5f	1400	function from wolfSSL.
sPymbed	17:ff9d1e86ad5f	1401	*/
sPymbed	17:ff9d1e86ad5f	1402	#error ECC minimum bit size must be a multiple of 8
sPymbed	17:ff9d1e86ad5f	1403	#endif
sPymbed	17:ff9d1e86ad5f	1404	#define MIN_ECCKEY_SZ (WOLFSSL_MIN_ECC_BITS / 8)
sPymbed	17:ff9d1e86ad5f	1405
sPymbed	17:ff9d1e86ad5f	1406	/* set minimum RSA key size allowed */
sPymbed	17:ff9d1e86ad5f	1407	#ifndef WOLFSSL_MIN_RSA_BITS
sPymbed	17:ff9d1e86ad5f	1408	#ifdef WOLFSSL_MAX_STRENGTH
sPymbed	17:ff9d1e86ad5f	1409	#define WOLFSSL_MIN_RSA_BITS 2048
sPymbed	17:ff9d1e86ad5f	1410	#else
sPymbed	17:ff9d1e86ad5f	1411	#define WOLFSSL_MIN_RSA_BITS 1024
sPymbed	17:ff9d1e86ad5f	1412	#endif
sPymbed	17:ff9d1e86ad5f	1413	#endif /* WOLFSSL_MIN_RSA_BITS */
sPymbed	17:ff9d1e86ad5f	1414	#if (WOLFSSL_MIN_RSA_BITS % 8)
sPymbed	17:ff9d1e86ad5f	1415	/* This is to account for the example case of a min size of 2050 bits but
sPymbed	17:ff9d1e86ad5f	1416	still allows 2049 bit key. So we need the measurment to be in bytes. */
sPymbed	17:ff9d1e86ad5f	1417	#error RSA minimum bit size must be a multiple of 8
sPymbed	17:ff9d1e86ad5f	1418	#endif
sPymbed	17:ff9d1e86ad5f	1419	#define MIN_RSAKEY_SZ (WOLFSSL_MIN_RSA_BITS / 8)
sPymbed	17:ff9d1e86ad5f	1420
sPymbed	17:ff9d1e86ad5f	1421	#ifdef SESSION_INDEX
sPymbed	17:ff9d1e86ad5f	1422	/* Shift values for making a session index */
sPymbed	17:ff9d1e86ad5f	1423	#define SESSIDX_ROW_SHIFT 4
sPymbed	17:ff9d1e86ad5f	1424	#define SESSIDX_IDX_MASK 0x0F
sPymbed	17:ff9d1e86ad5f	1425	#endif
sPymbed	17:ff9d1e86ad5f	1426
sPymbed	17:ff9d1e86ad5f	1427
sPymbed	17:ff9d1e86ad5f	1428	/* max cert chain peer depth */
sPymbed	17:ff9d1e86ad5f	1429	#ifndef MAX_CHAIN_DEPTH
sPymbed	17:ff9d1e86ad5f	1430	#define MAX_CHAIN_DEPTH 9
sPymbed	17:ff9d1e86ad5f	1431	#endif
sPymbed	17:ff9d1e86ad5f	1432
sPymbed	17:ff9d1e86ad5f	1433	/* max size of a certificate message payload */
sPymbed	17:ff9d1e86ad5f	1434	/* assumes MAX_CHAIN_DEPTH number of certificates at 2kb per certificate */
sPymbed	17:ff9d1e86ad5f	1435	#ifndef MAX_CERTIFICATE_SZ
sPymbed	17:ff9d1e86ad5f	1436	#define MAX_CERTIFICATE_SZ \
sPymbed	17:ff9d1e86ad5f	1437	CERT_HEADER_SZ + \
sPymbed	17:ff9d1e86ad5f	1438	(MAX_X509_SIZE + CERT_HEADER_SZ) * MAX_CHAIN_DEPTH
sPymbed	17:ff9d1e86ad5f	1439	#endif
sPymbed	17:ff9d1e86ad5f	1440
sPymbed	17:ff9d1e86ad5f	1441	/* max size of a handshake message, currently set to the certificate */
sPymbed	17:ff9d1e86ad5f	1442	#ifndef MAX_HANDSHAKE_SZ
sPymbed	17:ff9d1e86ad5f	1443	#define MAX_HANDSHAKE_SZ MAX_CERTIFICATE_SZ
sPymbed	17:ff9d1e86ad5f	1444	#endif
sPymbed	17:ff9d1e86ad5f	1445
sPymbed	17:ff9d1e86ad5f	1446	#ifndef SESSION_TICKET_LEN
sPymbed	17:ff9d1e86ad5f	1447	#define SESSION_TICKET_LEN 256
sPymbed	17:ff9d1e86ad5f	1448	#endif
sPymbed	17:ff9d1e86ad5f	1449
sPymbed	17:ff9d1e86ad5f	1450	#ifndef SESSION_TICKET_HINT_DEFAULT
sPymbed	17:ff9d1e86ad5f	1451	#define SESSION_TICKET_HINT_DEFAULT 300
sPymbed	17:ff9d1e86ad5f	1452	#endif
sPymbed	17:ff9d1e86ad5f	1453
sPymbed	17:ff9d1e86ad5f	1454
sPymbed	17:ff9d1e86ad5f	1455	/* don't use extra 3/4k stack space unless need to */
sPymbed	17:ff9d1e86ad5f	1456	#ifdef HAVE_NTRU
sPymbed	17:ff9d1e86ad5f	1457	#define MAX_ENCRYPT_SZ MAX_NTRU_ENCRYPT_SZ
sPymbed	17:ff9d1e86ad5f	1458	#else
sPymbed	17:ff9d1e86ad5f	1459	#define MAX_ENCRYPT_SZ ENCRYPT_LEN
sPymbed	17:ff9d1e86ad5f	1460	#endif
sPymbed	17:ff9d1e86ad5f	1461
sPymbed	17:ff9d1e86ad5f	1462
sPymbed	17:ff9d1e86ad5f	1463	/* states */
sPymbed	17:ff9d1e86ad5f	1464	enum states {
sPymbed	17:ff9d1e86ad5f	1465	NULL_STATE = 0,
sPymbed	17:ff9d1e86ad5f	1466
sPymbed	17:ff9d1e86ad5f	1467	SERVER_HELLOVERIFYREQUEST_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1468	SERVER_HELLO_RETRY_REQUEST_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1469	SERVER_HELLO_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1470	SERVER_ENCRYPTED_EXTENSIONS_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1471	SERVER_CERT_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1472	SERVER_KEYEXCHANGE_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1473	SERVER_HELLODONE_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1474	SERVER_CHANGECIPHERSPEC_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1475	SERVER_FINISHED_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1476
sPymbed	17:ff9d1e86ad5f	1477	CLIENT_HELLO_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1478	CLIENT_KEYEXCHANGE_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1479	CLIENT_CHANGECIPHERSPEC_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1480	CLIENT_FINISHED_COMPLETE,
sPymbed	17:ff9d1e86ad5f	1481
sPymbed	17:ff9d1e86ad5f	1482	HANDSHAKE_DONE
sPymbed	17:ff9d1e86ad5f	1483	};
sPymbed	17:ff9d1e86ad5f	1484
sPymbed	17:ff9d1e86ad5f	1485	/* SSL Version */
sPymbed	17:ff9d1e86ad5f	1486	typedef struct ProtocolVersion {
sPymbed	17:ff9d1e86ad5f	1487	byte major;
sPymbed	17:ff9d1e86ad5f	1488	byte minor;
sPymbed	17:ff9d1e86ad5f	1489	} WOLFSSL_PACK ProtocolVersion;
sPymbed	17:ff9d1e86ad5f	1490
sPymbed	17:ff9d1e86ad5f	1491
sPymbed	17:ff9d1e86ad5f	1492	WOLFSSL_LOCAL ProtocolVersion MakeSSLv3(void);
sPymbed	17:ff9d1e86ad5f	1493	WOLFSSL_LOCAL ProtocolVersion MakeTLSv1(void);
sPymbed	17:ff9d1e86ad5f	1494	WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_1(void);
sPymbed	17:ff9d1e86ad5f	1495	WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_2(void);
sPymbed	17:ff9d1e86ad5f	1496	WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_3(void);
sPymbed	17:ff9d1e86ad5f	1497
sPymbed	17:ff9d1e86ad5f	1498	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	1499	WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1(void);
sPymbed	17:ff9d1e86ad5f	1500	WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1_2(void);
sPymbed	17:ff9d1e86ad5f	1501
sPymbed	17:ff9d1e86ad5f	1502	#ifdef WOLFSSL_SESSION_EXPORT
sPymbed	17:ff9d1e86ad5f	1503	WOLFSSL_LOCAL int wolfSSL_dtls_import_internal(WOLFSSL* ssl, byte* buf,
sPymbed	17:ff9d1e86ad5f	1504	word32 sz);
sPymbed	17:ff9d1e86ad5f	1505	WOLFSSL_LOCAL int wolfSSL_dtls_export_internal(WOLFSSL* ssl, byte* buf,
sPymbed	17:ff9d1e86ad5f	1506	word32 sz);
sPymbed	17:ff9d1e86ad5f	1507	WOLFSSL_LOCAL int wolfSSL_send_session(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	1508	#endif
sPymbed	17:ff9d1e86ad5f	1509	#endif
sPymbed	17:ff9d1e86ad5f	1510
sPymbed	17:ff9d1e86ad5f	1511
sPymbed	17:ff9d1e86ad5f	1512	/* wolfSSL BIO_METHOD type */
sPymbed	17:ff9d1e86ad5f	1513	struct WOLFSSL_BIO_METHOD {
sPymbed	17:ff9d1e86ad5f	1514	byte type; /* method type */
sPymbed	17:ff9d1e86ad5f	1515	};
sPymbed	17:ff9d1e86ad5f	1516
sPymbed	17:ff9d1e86ad5f	1517
sPymbed	17:ff9d1e86ad5f	1518	/* wolfSSL BIO type */
sPymbed	17:ff9d1e86ad5f	1519	struct WOLFSSL_BIO {
sPymbed	17:ff9d1e86ad5f	1520	WOLFSSL_BUF_MEM* mem_buf;
sPymbed	17:ff9d1e86ad5f	1521	WOLFSSL* ssl; /* possible associated ssl */
sPymbed	17:ff9d1e86ad5f	1522	#ifndef NO_FILESYSTEM
sPymbed	17:ff9d1e86ad5f	1523	XFILE file;
sPymbed	17:ff9d1e86ad5f	1524	#endif
sPymbed	17:ff9d1e86ad5f	1525	WOLFSSL_BIO* prev; /* previous in chain */
sPymbed	17:ff9d1e86ad5f	1526	WOLFSSL_BIO* next; /* next in chain */
sPymbed	17:ff9d1e86ad5f	1527	WOLFSSL_BIO* pair; /* BIO paired with */
sPymbed	17:ff9d1e86ad5f	1528	void* heap; /* user heap hint */
sPymbed	17:ff9d1e86ad5f	1529	byte* mem; /* memory buffer */
sPymbed	17:ff9d1e86ad5f	1530	int wrSz; /* write buffer size (mem) */
sPymbed	17:ff9d1e86ad5f	1531	int wrIdx; /* current index for write buffer */
sPymbed	17:ff9d1e86ad5f	1532	int rdIdx; /* current read index */
sPymbed	17:ff9d1e86ad5f	1533	int readRq; /* read request */
sPymbed	17:ff9d1e86ad5f	1534	int memLen; /* memory buffer length */
sPymbed	17:ff9d1e86ad5f	1535	int fd; /* possible file descriptor */
sPymbed	17:ff9d1e86ad5f	1536	int eof; /* eof flag */
sPymbed	17:ff9d1e86ad5f	1537	int flags;
sPymbed	17:ff9d1e86ad5f	1538	byte type; /* method type */
sPymbed	17:ff9d1e86ad5f	1539	byte close; /* close flag */
sPymbed	17:ff9d1e86ad5f	1540	};
sPymbed	17:ff9d1e86ad5f	1541
sPymbed	17:ff9d1e86ad5f	1542
sPymbed	17:ff9d1e86ad5f	1543	/* wolfSSL method type */
sPymbed	17:ff9d1e86ad5f	1544	struct WOLFSSL_METHOD {
sPymbed	17:ff9d1e86ad5f	1545	ProtocolVersion version;
sPymbed	17:ff9d1e86ad5f	1546	byte side; /* connection side, server or client */
sPymbed	17:ff9d1e86ad5f	1547	byte downgrade; /* whether to downgrade version, default no */
sPymbed	17:ff9d1e86ad5f	1548	};
sPymbed	17:ff9d1e86ad5f	1549
sPymbed	17:ff9d1e86ad5f	1550	/* wolfSSL buffer type - internal uses "buffer" type */
sPymbed	17:ff9d1e86ad5f	1551	typedef WOLFSSL_BUFFER_INFO buffer;
sPymbed	17:ff9d1e86ad5f	1552
sPymbed	17:ff9d1e86ad5f	1553	typedef struct Suites Suites;
sPymbed	17:ff9d1e86ad5f	1554
sPymbed	17:ff9d1e86ad5f	1555
sPymbed	17:ff9d1e86ad5f	1556	/* defaults to client */
sPymbed	17:ff9d1e86ad5f	1557	WOLFSSL_LOCAL void InitSSL_Method(WOLFSSL_METHOD*, ProtocolVersion);
sPymbed	17:ff9d1e86ad5f	1558
sPymbed	17:ff9d1e86ad5f	1559	/* for sniffer */
sPymbed	17:ff9d1e86ad5f	1560	WOLFSSL_LOCAL int DoFinished(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
sPymbed	17:ff9d1e86ad5f	1561	word32 size, word32 totalSz, int sniff);
sPymbed	17:ff9d1e86ad5f	1562	WOLFSSL_LOCAL int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx);
sPymbed	17:ff9d1e86ad5f	1563	/* TLS v1.3 needs these */
sPymbed	17:ff9d1e86ad5f	1564	WOLFSSL_LOCAL int HandleTlsResumption(WOLFSSL* ssl, int bogusID,
sPymbed	17:ff9d1e86ad5f	1565	Suites* clSuites);
sPymbed	17:ff9d1e86ad5f	1566	WOLFSSL_LOCAL int DoClientHello(WOLFSSL* ssl, const byte* input, word32*,
sPymbed	17:ff9d1e86ad5f	1567	word32);
sPymbed	17:ff9d1e86ad5f	1568	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	1569	WOLFSSL_LOCAL int DoTls13ClientHello(WOLFSSL* ssl, const byte* input,
sPymbed	17:ff9d1e86ad5f	1570	word32* inOutIdx, word32 helloSz);
sPymbed	17:ff9d1e86ad5f	1571	#endif
sPymbed	17:ff9d1e86ad5f	1572	WOLFSSL_LOCAL int DoServerHello(WOLFSSL* ssl, const byte* input, word32*,
sPymbed	17:ff9d1e86ad5f	1573	word32);
sPymbed	17:ff9d1e86ad5f	1574	WOLFSSL_LOCAL int CompleteServerHello(WOLFSSL *ssl);
sPymbed	17:ff9d1e86ad5f	1575	WOLFSSL_LOCAL int CheckVersion(WOLFSSL *ssl, ProtocolVersion pv);
sPymbed	17:ff9d1e86ad5f	1576	WOLFSSL_LOCAL void PickHashSigAlgo(WOLFSSL* ssl, const byte* hashSigAlgo,
sPymbed	17:ff9d1e86ad5f	1577	word32 hashSigAlgoSz);
sPymbed	17:ff9d1e86ad5f	1578	WOLFSSL_LOCAL int DecodePrivateKey(WOLFSSL ssl, word16 length);
sPymbed	17:ff9d1e86ad5f	1579	#ifdef HAVE_PK_CALLBACKS
sPymbed	17:ff9d1e86ad5f	1580	WOLFSSL_LOCAL int GetPrivateKeySigSize(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	1581	#ifndef NO_ASN
sPymbed	17:ff9d1e86ad5f	1582	WOLFSSL_LOCAL int InitSigPkCb(WOLFSSL* ssl, SignatureCtx* sigCtx);
sPymbed	17:ff9d1e86ad5f	1583	#endif
sPymbed	17:ff9d1e86ad5f	1584	#endif
sPymbed	17:ff9d1e86ad5f	1585	WOLFSSL_LOCAL void FreeKeyExchange(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	1586	WOLFSSL_LOCAL int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, word32 size);
sPymbed	17:ff9d1e86ad5f	1587	WOLFSSL_LOCAL int MatchDomainName(const char* pattern, int len, const char* str);
sPymbed	17:ff9d1e86ad5f	1588	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	1589	WOLFSSL_LOCAL int CheckAltNames(DecodedCert* dCert, char* domain);
sPymbed	17:ff9d1e86ad5f	1590	#endif
sPymbed	17:ff9d1e86ad5f	1591	WOLFSSL_LOCAL int CreateTicket(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	1592	WOLFSSL_LOCAL int HashOutputRaw(WOLFSSL* ssl, const byte* output, int sz);
sPymbed	17:ff9d1e86ad5f	1593	WOLFSSL_LOCAL int HashOutput(WOLFSSL* ssl, const byte* output, int sz,
sPymbed	17:ff9d1e86ad5f	1594	int ivSz);
sPymbed	17:ff9d1e86ad5f	1595	WOLFSSL_LOCAL int HashInput(WOLFSSL* ssl, const byte* input, int sz);
sPymbed	17:ff9d1e86ad5f	1596	#if defined(OPENSSL_ALL) \|\| defined(HAVE_STUNNEL) \|\| defined(WOLFSSL_NGINX) \|\| defined(WOLFSSL_HAPROXY)
sPymbed	17:ff9d1e86ad5f	1597	WOLFSSL_LOCAL int SNI_Callback(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	1598	#endif
sPymbed	17:ff9d1e86ad5f	1599	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	1600	WOLFSSL_LOCAL int DecryptTls13(WOLFSSL* ssl, byte* output, const byte* input,
sPymbed	17:ff9d1e86ad5f	1601	word16 sz, const byte* aad, word16 aadSz);
sPymbed	17:ff9d1e86ad5f	1602	WOLFSSL_LOCAL int DoTls13HandShakeMsgType(WOLFSSL* ssl, byte* input,
sPymbed	17:ff9d1e86ad5f	1603	word32* inOutIdx, byte type,
sPymbed	17:ff9d1e86ad5f	1604	word32 size, word32 totalSz);
sPymbed	17:ff9d1e86ad5f	1605	WOLFSSL_LOCAL int DoTls13HandShakeMsg(WOLFSSL* ssl, byte* input,
sPymbed	17:ff9d1e86ad5f	1606	word32* inOutIdx, word32 totalSz);
sPymbed	17:ff9d1e86ad5f	1607	WOLFSSL_LOCAL int DoTls13ServerHello(WOLFSSL* ssl, const byte* input,
sPymbed	17:ff9d1e86ad5f	1608	word32* inOutIdx, word32 helloSz,
sPymbed	17:ff9d1e86ad5f	1609	byte* extMsgType);
sPymbed	17:ff9d1e86ad5f	1610	#endif
sPymbed	17:ff9d1e86ad5f	1611	int TimingPadVerify(WOLFSSL* ssl, const byte* input, int padLen, int t,
sPymbed	17:ff9d1e86ad5f	1612	int pLen, int content);
sPymbed	17:ff9d1e86ad5f	1613
sPymbed	17:ff9d1e86ad5f	1614
sPymbed	17:ff9d1e86ad5f	1615	enum {
sPymbed	17:ff9d1e86ad5f	1616	FORCED_FREE = 1,
sPymbed	17:ff9d1e86ad5f	1617	NO_FORCED_FREE = 0
sPymbed	17:ff9d1e86ad5f	1618	};
sPymbed	17:ff9d1e86ad5f	1619
sPymbed	17:ff9d1e86ad5f	1620
sPymbed	17:ff9d1e86ad5f	1621	/* only use compression extra if using compression */
sPymbed	17:ff9d1e86ad5f	1622	#ifdef HAVE_LIBZ
sPymbed	17:ff9d1e86ad5f	1623	#define COMP_EXTRA MAX_COMP_EXTRA
sPymbed	17:ff9d1e86ad5f	1624	#else
sPymbed	17:ff9d1e86ad5f	1625	#define COMP_EXTRA 0
sPymbed	17:ff9d1e86ad5f	1626	#endif
sPymbed	17:ff9d1e86ad5f	1627
sPymbed	17:ff9d1e86ad5f	1628	/* only the sniffer needs space in the buffer for extra MTU record(s) */
sPymbed	17:ff9d1e86ad5f	1629	#ifdef WOLFSSL_SNIFFER
sPymbed	17:ff9d1e86ad5f	1630	#define MTU_EXTRA MAX_MTU * 3
sPymbed	17:ff9d1e86ad5f	1631	#else
sPymbed	17:ff9d1e86ad5f	1632	#define MTU_EXTRA 0
sPymbed	17:ff9d1e86ad5f	1633	#endif
sPymbed	17:ff9d1e86ad5f	1634
sPymbed	17:ff9d1e86ad5f	1635
sPymbed	17:ff9d1e86ad5f	1636	/* embedded callbacks require large static buffers, make sure on */
sPymbed	17:ff9d1e86ad5f	1637	#ifdef WOLFSSL_CALLBACKS
sPymbed	17:ff9d1e86ad5f	1638	#undef LARGE_STATIC_BUFFERS
sPymbed	17:ff9d1e86ad5f	1639	#define LARGE_STATIC_BUFFERS
sPymbed	17:ff9d1e86ad5f	1640	#endif
sPymbed	17:ff9d1e86ad5f	1641
sPymbed	17:ff9d1e86ad5f	1642
sPymbed	17:ff9d1e86ad5f	1643	/* give user option to use 16K static buffers */
sPymbed	17:ff9d1e86ad5f	1644	#if defined(LARGE_STATIC_BUFFERS)
sPymbed	17:ff9d1e86ad5f	1645	#define RECORD_SIZE MAX_RECORD_SIZE
sPymbed	17:ff9d1e86ad5f	1646	#else
sPymbed	17:ff9d1e86ad5f	1647	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	1648	#define RECORD_SIZE MAX_MTU
sPymbed	17:ff9d1e86ad5f	1649	#else
sPymbed	17:ff9d1e86ad5f	1650	#define RECORD_SIZE 128
sPymbed	17:ff9d1e86ad5f	1651	#endif
sPymbed	17:ff9d1e86ad5f	1652	#endif
sPymbed	17:ff9d1e86ad5f	1653
sPymbed	17:ff9d1e86ad5f	1654
sPymbed	17:ff9d1e86ad5f	1655	/* user option to turn off 16K output option */
sPymbed	17:ff9d1e86ad5f	1656	/* if using small static buffers (default) and SSL_write tries to write data
sPymbed	17:ff9d1e86ad5f	1657	larger than the record we have, dynamically get it, unless user says only
sPymbed	17:ff9d1e86ad5f	1658	write in static buffer chunks */
sPymbed	17:ff9d1e86ad5f	1659	#ifndef STATIC_CHUNKS_ONLY
sPymbed	17:ff9d1e86ad5f	1660	#define OUTPUT_RECORD_SIZE MAX_RECORD_SIZE
sPymbed	17:ff9d1e86ad5f	1661	#else
sPymbed	17:ff9d1e86ad5f	1662	#define OUTPUT_RECORD_SIZE RECORD_SIZE
sPymbed	17:ff9d1e86ad5f	1663	#endif
sPymbed	17:ff9d1e86ad5f	1664
sPymbed	17:ff9d1e86ad5f	1665	/* wolfSSL input buffer
sPymbed	17:ff9d1e86ad5f	1666
sPymbed	17:ff9d1e86ad5f	1667	RFC 2246:
sPymbed	17:ff9d1e86ad5f	1668
sPymbed	17:ff9d1e86ad5f	1669	length
sPymbed	17:ff9d1e86ad5f	1670	The length (in bytes) of the following TLSPlaintext.fragment.
sPymbed	17:ff9d1e86ad5f	1671	The length should not exceed 2^14.
sPymbed	17:ff9d1e86ad5f	1672	*/
sPymbed	17:ff9d1e86ad5f	1673	#if defined(LARGE_STATIC_BUFFERS)
sPymbed	17:ff9d1e86ad5f	1674	#define STATIC_BUFFER_LEN RECORD_HEADER_SZ + RECORD_SIZE + COMP_EXTRA + \
sPymbed	17:ff9d1e86ad5f	1675	MTU_EXTRA + MAX_MSG_EXTRA
sPymbed	17:ff9d1e86ad5f	1676	#else
sPymbed	17:ff9d1e86ad5f	1677	/* don't fragment memory from the record header */
sPymbed	17:ff9d1e86ad5f	1678	#define STATIC_BUFFER_LEN RECORD_HEADER_SZ
sPymbed	17:ff9d1e86ad5f	1679	#endif
sPymbed	17:ff9d1e86ad5f	1680
sPymbed	17:ff9d1e86ad5f	1681	typedef struct {
sPymbed	17:ff9d1e86ad5f	1682	ALIGN16 byte staticBuffer[STATIC_BUFFER_LEN];
sPymbed	17:ff9d1e86ad5f	1683	byte* buffer; /* place holder for static or dynamic buffer */
sPymbed	17:ff9d1e86ad5f	1684	word32 length; /* total buffer length used */
sPymbed	17:ff9d1e86ad5f	1685	word32 idx; /* idx to part of length already consumed */
sPymbed	17:ff9d1e86ad5f	1686	word32 bufferSize; /* current buffer size */
sPymbed	17:ff9d1e86ad5f	1687	byte dynamicFlag; /* dynamic memory currently in use */
sPymbed	17:ff9d1e86ad5f	1688	byte offset; /* alignment offset attempt */
sPymbed	17:ff9d1e86ad5f	1689	} bufferStatic;
sPymbed	17:ff9d1e86ad5f	1690
sPymbed	17:ff9d1e86ad5f	1691	/* Cipher Suites holder */
sPymbed	17:ff9d1e86ad5f	1692	struct Suites {
sPymbed	17:ff9d1e86ad5f	1693	word16 suiteSz; /* suite length in bytes */
sPymbed	17:ff9d1e86ad5f	1694	word16 hashSigAlgoSz; /* SigAlgo extension length in bytes */
sPymbed	17:ff9d1e86ad5f	1695	byte suites[WOLFSSL_MAX_SUITE_SZ];
sPymbed	17:ff9d1e86ad5f	1696	byte hashSigAlgo[WOLFSSL_MAX_SIGALGO]; /* sig/algo to offer */
sPymbed	17:ff9d1e86ad5f	1697	byte setSuites; /* user set suites from default */
sPymbed	17:ff9d1e86ad5f	1698	byte hashAlgo; /* selected hash algorithm */
sPymbed	17:ff9d1e86ad5f	1699	byte sigAlgo; /* selected sig algorithm */
sPymbed	17:ff9d1e86ad5f	1700	};
sPymbed	17:ff9d1e86ad5f	1701
sPymbed	17:ff9d1e86ad5f	1702
sPymbed	17:ff9d1e86ad5f	1703	WOLFSSL_LOCAL void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig,
sPymbed	17:ff9d1e86ad5f	1704	int haveRSAsig, int haveAnon,
sPymbed	17:ff9d1e86ad5f	1705	int tls1_2, int keySz);
sPymbed	17:ff9d1e86ad5f	1706	WOLFSSL_LOCAL void InitSuites(Suites*, ProtocolVersion, int, word16, word16,
sPymbed	17:ff9d1e86ad5f	1707	word16, word16, word16, word16, word16, int);
sPymbed	17:ff9d1e86ad5f	1708	WOLFSSL_LOCAL int MatchSuite(WOLFSSL* ssl, Suites* peerSuites);
sPymbed	17:ff9d1e86ad5f	1709	WOLFSSL_LOCAL int SetCipherList(WOLFSSL_CTX, Suites, const char* list);
sPymbed	17:ff9d1e86ad5f	1710
sPymbed	17:ff9d1e86ad5f	1711	#ifndef PSK_TYPES_DEFINED
sPymbed	17:ff9d1e86ad5f	1712	typedef unsigned int (wc_psk_client_callback)(WOLFSSL, const char, char,
sPymbed	17:ff9d1e86ad5f	1713	unsigned int, unsigned char*, unsigned int);
sPymbed	17:ff9d1e86ad5f	1714	typedef unsigned int (wc_psk_server_callback)(WOLFSSL, const char*,
sPymbed	17:ff9d1e86ad5f	1715	unsigned char*, unsigned int);
sPymbed	17:ff9d1e86ad5f	1716	#endif /* PSK_TYPES_DEFINED */
sPymbed	17:ff9d1e86ad5f	1717	#if defined(WOLFSSL_DTLS) && defined(WOLFSSL_SESSION_EXPORT) && \
sPymbed	17:ff9d1e86ad5f	1718	!defined(WOLFSSL_DTLS_EXPORT_TYPES)
sPymbed	17:ff9d1e86ad5f	1719	typedef int (wc_dtls_export)(WOLFSSL ssl,
sPymbed	17:ff9d1e86ad5f	1720	unsigned char* exportBuffer, unsigned int sz, void* userCtx);
sPymbed	17:ff9d1e86ad5f	1721	#define WOLFSSL_DTLS_EXPORT_TYPES
sPymbed	17:ff9d1e86ad5f	1722	#endif /* WOLFSSL_DTLS_EXPORT_TYPES */
sPymbed	17:ff9d1e86ad5f	1723
sPymbed	17:ff9d1e86ad5f	1724
sPymbed	17:ff9d1e86ad5f	1725	/* wolfSSL Cipher type just points back to SSL */
sPymbed	17:ff9d1e86ad5f	1726	struct WOLFSSL_CIPHER {
sPymbed	17:ff9d1e86ad5f	1727	WOLFSSL* ssl;
sPymbed	17:ff9d1e86ad5f	1728	};
sPymbed	17:ff9d1e86ad5f	1729
sPymbed	17:ff9d1e86ad5f	1730
sPymbed	17:ff9d1e86ad5f	1731	typedef struct OcspEntry OcspEntry;
sPymbed	17:ff9d1e86ad5f	1732
sPymbed	17:ff9d1e86ad5f	1733	#ifdef NO_SHA
sPymbed	17:ff9d1e86ad5f	1734	#define OCSP_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
sPymbed	17:ff9d1e86ad5f	1735	#else
sPymbed	17:ff9d1e86ad5f	1736	#define OCSP_DIGEST_SIZE WC_SHA_DIGEST_SIZE
sPymbed	17:ff9d1e86ad5f	1737	#endif
sPymbed	17:ff9d1e86ad5f	1738
sPymbed	17:ff9d1e86ad5f	1739	#ifdef NO_ASN
sPymbed	17:ff9d1e86ad5f	1740	/* no_asn won't have */
sPymbed	17:ff9d1e86ad5f	1741	typedef struct CertStatus CertStatus;
sPymbed	17:ff9d1e86ad5f	1742	#endif
sPymbed	17:ff9d1e86ad5f	1743
sPymbed	17:ff9d1e86ad5f	1744	struct OcspEntry {
sPymbed	17:ff9d1e86ad5f	1745	OcspEntry* next; /* next entry */
sPymbed	17:ff9d1e86ad5f	1746	byte issuerHash[OCSP_DIGEST_SIZE]; /* issuer hash */
sPymbed	17:ff9d1e86ad5f	1747	byte issuerKeyHash[OCSP_DIGEST_SIZE]; /* issuer public key hash */
sPymbed	17:ff9d1e86ad5f	1748	CertStatus* status; /* OCSP response list */
sPymbed	17:ff9d1e86ad5f	1749	int totalStatus; /* number on list */
sPymbed	17:ff9d1e86ad5f	1750	};
sPymbed	17:ff9d1e86ad5f	1751
sPymbed	17:ff9d1e86ad5f	1752
sPymbed	17:ff9d1e86ad5f	1753	#ifndef HAVE_OCSP
sPymbed	17:ff9d1e86ad5f	1754	typedef struct WOLFSSL_OCSP WOLFSSL_OCSP;
sPymbed	17:ff9d1e86ad5f	1755	#endif
sPymbed	17:ff9d1e86ad5f	1756
sPymbed	17:ff9d1e86ad5f	1757	/* wolfSSL OCSP controller */
sPymbed	17:ff9d1e86ad5f	1758	struct WOLFSSL_OCSP {
sPymbed	17:ff9d1e86ad5f	1759	WOLFSSL_CERT_MANAGER* cm; /* pointer back to cert manager */
sPymbed	17:ff9d1e86ad5f	1760	OcspEntry* ocspList; /* OCSP response list */
sPymbed	17:ff9d1e86ad5f	1761	wolfSSL_Mutex ocspLock; /* OCSP list lock */
sPymbed	17:ff9d1e86ad5f	1762	#if defined(OPENSSL_ALL) \|\| defined(OPENSSL_EXTRA) \|\| \
sPymbed	17:ff9d1e86ad5f	1763	defined(WOLFSSL_NGINX) \|\| defined(WOLFSSL_HAPROXY)
sPymbed	17:ff9d1e86ad5f	1764	int(statusCb)(WOLFSSL, void*);
sPymbed	17:ff9d1e86ad5f	1765	#endif
sPymbed	17:ff9d1e86ad5f	1766	};
sPymbed	17:ff9d1e86ad5f	1767
sPymbed	17:ff9d1e86ad5f	1768	#ifndef MAX_DATE_SIZE
sPymbed	17:ff9d1e86ad5f	1769	#define MAX_DATE_SIZE 32
sPymbed	17:ff9d1e86ad5f	1770	#endif
sPymbed	17:ff9d1e86ad5f	1771
sPymbed	17:ff9d1e86ad5f	1772	typedef struct CRL_Entry CRL_Entry;
sPymbed	17:ff9d1e86ad5f	1773
sPymbed	17:ff9d1e86ad5f	1774	#ifdef NO_SHA
sPymbed	17:ff9d1e86ad5f	1775	#define CRL_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
sPymbed	17:ff9d1e86ad5f	1776	#else
sPymbed	17:ff9d1e86ad5f	1777	#define CRL_DIGEST_SIZE WC_SHA_DIGEST_SIZE
sPymbed	17:ff9d1e86ad5f	1778	#endif
sPymbed	17:ff9d1e86ad5f	1779
sPymbed	17:ff9d1e86ad5f	1780	#ifdef NO_ASN
sPymbed	17:ff9d1e86ad5f	1781	typedef struct RevokedCert RevokedCert;
sPymbed	17:ff9d1e86ad5f	1782	#endif
sPymbed	17:ff9d1e86ad5f	1783
sPymbed	17:ff9d1e86ad5f	1784	/* Complete CRL */
sPymbed	17:ff9d1e86ad5f	1785	struct CRL_Entry {
sPymbed	17:ff9d1e86ad5f	1786	CRL_Entry* next; /* next entry */
sPymbed	17:ff9d1e86ad5f	1787	byte issuerHash[CRL_DIGEST_SIZE]; /* issuer hash */
sPymbed	17:ff9d1e86ad5f	1788	/* byte crlHash[CRL_DIGEST_SIZE]; raw crl data hash */
sPymbed	17:ff9d1e86ad5f	1789	/* restore the hash here if needed for optimized comparisons */
sPymbed	17:ff9d1e86ad5f	1790	byte lastDate[MAX_DATE_SIZE]; /* last date updated */
sPymbed	17:ff9d1e86ad5f	1791	byte nextDate[MAX_DATE_SIZE]; /* next update date */
sPymbed	17:ff9d1e86ad5f	1792	byte lastDateFormat; /* last date format */
sPymbed	17:ff9d1e86ad5f	1793	byte nextDateFormat; /* next date format */
sPymbed	17:ff9d1e86ad5f	1794	RevokedCert* certs; /* revoked cert list */
sPymbed	17:ff9d1e86ad5f	1795	int totalCerts; /* number on list */
sPymbed	17:ff9d1e86ad5f	1796	int verified;
sPymbed	17:ff9d1e86ad5f	1797	byte* toBeSigned;
sPymbed	17:ff9d1e86ad5f	1798	word32 tbsSz;
sPymbed	17:ff9d1e86ad5f	1799	byte* signature;
sPymbed	17:ff9d1e86ad5f	1800	word32 signatureSz;
sPymbed	17:ff9d1e86ad5f	1801	word32 signatureOID;
sPymbed	17:ff9d1e86ad5f	1802	#if !defined(NO_SKID) && defined(CRL_SKID_READY)
sPymbed	17:ff9d1e86ad5f	1803	byte extAuthKeyIdSet;
sPymbed	17:ff9d1e86ad5f	1804	byte extAuthKeyId[KEYID_SIZE];
sPymbed	17:ff9d1e86ad5f	1805	#endif
sPymbed	17:ff9d1e86ad5f	1806	};
sPymbed	17:ff9d1e86ad5f	1807
sPymbed	17:ff9d1e86ad5f	1808
sPymbed	17:ff9d1e86ad5f	1809	typedef struct CRL_Monitor CRL_Monitor;
sPymbed	17:ff9d1e86ad5f	1810
sPymbed	17:ff9d1e86ad5f	1811	/* CRL directory monitor */
sPymbed	17:ff9d1e86ad5f	1812	struct CRL_Monitor {
sPymbed	17:ff9d1e86ad5f	1813	char* path; /* full dir path, if valid pointer we're using */
sPymbed	17:ff9d1e86ad5f	1814	int type; /* PEM or ASN1 type */
sPymbed	17:ff9d1e86ad5f	1815	};
sPymbed	17:ff9d1e86ad5f	1816
sPymbed	17:ff9d1e86ad5f	1817
sPymbed	17:ff9d1e86ad5f	1818	#if defined(HAVE_CRL) && defined(NO_FILESYSTEM)
sPymbed	17:ff9d1e86ad5f	1819	#undef HAVE_CRL_MONITOR
sPymbed	17:ff9d1e86ad5f	1820	#endif
sPymbed	17:ff9d1e86ad5f	1821
sPymbed	17:ff9d1e86ad5f	1822	/* wolfSSL CRL controller */
sPymbed	17:ff9d1e86ad5f	1823	struct WOLFSSL_CRL {
sPymbed	17:ff9d1e86ad5f	1824	WOLFSSL_CERT_MANAGER* cm; /* pointer back to cert manager */
sPymbed	17:ff9d1e86ad5f	1825	CRL_Entry* crlList; /* our CRL list */
sPymbed	17:ff9d1e86ad5f	1826	#ifdef HAVE_CRL_IO
sPymbed	17:ff9d1e86ad5f	1827	CbCrlIO crlIOCb;
sPymbed	17:ff9d1e86ad5f	1828	#endif
sPymbed	17:ff9d1e86ad5f	1829	wolfSSL_Mutex crlLock; /* CRL list lock */
sPymbed	17:ff9d1e86ad5f	1830	CRL_Monitor monitors[2]; /* PEM and DER possible */
sPymbed	17:ff9d1e86ad5f	1831	#ifdef HAVE_CRL_MONITOR
sPymbed	17:ff9d1e86ad5f	1832	pthread_cond_t cond; /* condition to signal setup */
sPymbed	17:ff9d1e86ad5f	1833	pthread_t tid; /* monitoring thread */
sPymbed	17:ff9d1e86ad5f	1834	int mfd; /* monitor fd, -1 if no init yet */
sPymbed	17:ff9d1e86ad5f	1835	int setup; /* thread is setup predicate */
sPymbed	17:ff9d1e86ad5f	1836	#endif
sPymbed	17:ff9d1e86ad5f	1837	void* heap; /* heap hint for dynamic memory */
sPymbed	17:ff9d1e86ad5f	1838	};
sPymbed	17:ff9d1e86ad5f	1839
sPymbed	17:ff9d1e86ad5f	1840
sPymbed	17:ff9d1e86ad5f	1841	#ifdef NO_ASN
sPymbed	17:ff9d1e86ad5f	1842	typedef struct Signer Signer;
sPymbed	17:ff9d1e86ad5f	1843	#ifdef WOLFSSL_TRUST_PEER_CERT
sPymbed	17:ff9d1e86ad5f	1844	typedef struct TrustedPeerCert TrustedPeerCert;
sPymbed	17:ff9d1e86ad5f	1845	#endif
sPymbed	17:ff9d1e86ad5f	1846	#endif
sPymbed	17:ff9d1e86ad5f	1847
sPymbed	17:ff9d1e86ad5f	1848
sPymbed	17:ff9d1e86ad5f	1849	#ifndef CA_TABLE_SIZE
sPymbed	17:ff9d1e86ad5f	1850	#define CA_TABLE_SIZE 11
sPymbed	17:ff9d1e86ad5f	1851	#endif
sPymbed	17:ff9d1e86ad5f	1852	#ifdef WOLFSSL_TRUST_PEER_CERT
sPymbed	17:ff9d1e86ad5f	1853	#define TP_TABLE_SIZE 11
sPymbed	17:ff9d1e86ad5f	1854	#endif
sPymbed	17:ff9d1e86ad5f	1855
sPymbed	17:ff9d1e86ad5f	1856	/* wolfSSL Certificate Manager */
sPymbed	17:ff9d1e86ad5f	1857	struct WOLFSSL_CERT_MANAGER {
sPymbed	17:ff9d1e86ad5f	1858	Signer* caTable[CA_TABLE_SIZE]; /* the CA signer table */
sPymbed	17:ff9d1e86ad5f	1859	void* heap; /* heap helper */
sPymbed	17:ff9d1e86ad5f	1860	#ifdef WOLFSSL_TRUST_PEER_CERT
sPymbed	17:ff9d1e86ad5f	1861	TrustedPeerCert* tpTable[TP_TABLE_SIZE]; /* table of trusted peer certs */
sPymbed	17:ff9d1e86ad5f	1862	wolfSSL_Mutex tpLock; /* trusted peer list lock */
sPymbed	17:ff9d1e86ad5f	1863	#endif
sPymbed	17:ff9d1e86ad5f	1864	WOLFSSL_CRL* crl; /* CRL checker */
sPymbed	17:ff9d1e86ad5f	1865	WOLFSSL_OCSP* ocsp; /* OCSP checker */
sPymbed	17:ff9d1e86ad5f	1866	#if !defined(NO_WOLFSSL_SERVER) && (defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
sPymbed	17:ff9d1e86ad5f	1867	\|\| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2))
sPymbed	17:ff9d1e86ad5f	1868	WOLFSSL_OCSP* ocsp_stapling; /* OCSP checker for OCSP stapling */
sPymbed	17:ff9d1e86ad5f	1869	#endif
sPymbed	17:ff9d1e86ad5f	1870	char* ocspOverrideURL; /* use this responder */
sPymbed	17:ff9d1e86ad5f	1871	void* ocspIOCtx; /* I/O callback CTX */
sPymbed	17:ff9d1e86ad5f	1872	CallbackCACache caCacheCallback; /* CA cache addition callback */
sPymbed	17:ff9d1e86ad5f	1873	CbMissingCRL cbMissingCRL; /* notify through cb of missing crl */
sPymbed	17:ff9d1e86ad5f	1874	CbOCSPIO ocspIOCb; /* I/O callback for OCSP lookup */
sPymbed	17:ff9d1e86ad5f	1875	CbOCSPRespFree ocspRespFreeCb; /* Frees OCSP Response from IO Cb */
sPymbed	17:ff9d1e86ad5f	1876	wolfSSL_Mutex caLock; /* CA list lock */
sPymbed	17:ff9d1e86ad5f	1877	byte crlEnabled; /* is CRL on ? */
sPymbed	17:ff9d1e86ad5f	1878	byte crlCheckAll; /* always leaf, but all ? */
sPymbed	17:ff9d1e86ad5f	1879	byte ocspEnabled; /* is OCSP on ? */
sPymbed	17:ff9d1e86ad5f	1880	byte ocspCheckAll; /* always leaf, but all ? */
sPymbed	17:ff9d1e86ad5f	1881	byte ocspSendNonce; /* send the OCSP nonce ? */
sPymbed	17:ff9d1e86ad5f	1882	byte ocspUseOverrideURL; /* ignore cert's responder, override */
sPymbed	17:ff9d1e86ad5f	1883	byte ocspStaplingEnabled; /* is OCSP Stapling on ? */
sPymbed	17:ff9d1e86ad5f	1884
sPymbed	17:ff9d1e86ad5f	1885	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	1886	short minRsaKeySz; /* minimum allowed RSA key size */
sPymbed	17:ff9d1e86ad5f	1887	#endif
sPymbed	17:ff9d1e86ad5f	1888	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	1889	short minEccKeySz; /* minimum allowed ECC key size */
sPymbed	17:ff9d1e86ad5f	1890	#endif
sPymbed	17:ff9d1e86ad5f	1891	};
sPymbed	17:ff9d1e86ad5f	1892
sPymbed	17:ff9d1e86ad5f	1893	WOLFSSL_LOCAL int CM_SaveCertCache(WOLFSSL_CERT_MANAGER, const char);
sPymbed	17:ff9d1e86ad5f	1894	WOLFSSL_LOCAL int CM_RestoreCertCache(WOLFSSL_CERT_MANAGER, const char);
sPymbed	17:ff9d1e86ad5f	1895	WOLFSSL_LOCAL int CM_MemSaveCertCache(WOLFSSL_CERT_MANAGER, void, int, int*);
sPymbed	17:ff9d1e86ad5f	1896	WOLFSSL_LOCAL int CM_MemRestoreCertCache(WOLFSSL_CERT_MANAGER, const void, int);
sPymbed	17:ff9d1e86ad5f	1897	WOLFSSL_LOCAL int CM_GetCertCacheMemSize(WOLFSSL_CERT_MANAGER*);
sPymbed	17:ff9d1e86ad5f	1898
sPymbed	17:ff9d1e86ad5f	1899	/* wolfSSL Sock Addr */
sPymbed	17:ff9d1e86ad5f	1900	struct WOLFSSL_SOCKADDR {
sPymbed	17:ff9d1e86ad5f	1901	unsigned int sz; /* sockaddr size */
sPymbed	17:ff9d1e86ad5f	1902	void* sa; /* pointer to the sockaddr_in or sockaddr_in6 */
sPymbed	17:ff9d1e86ad5f	1903	};
sPymbed	17:ff9d1e86ad5f	1904
sPymbed	17:ff9d1e86ad5f	1905	typedef struct WOLFSSL_DTLS_CTX {
sPymbed	17:ff9d1e86ad5f	1906	WOLFSSL_SOCKADDR peer;
sPymbed	17:ff9d1e86ad5f	1907	int rfd;
sPymbed	17:ff9d1e86ad5f	1908	int wfd;
sPymbed	17:ff9d1e86ad5f	1909	} WOLFSSL_DTLS_CTX;
sPymbed	17:ff9d1e86ad5f	1910
sPymbed	17:ff9d1e86ad5f	1911
sPymbed	17:ff9d1e86ad5f	1912	typedef struct WOLFSSL_DTLS_PEERSEQ {
sPymbed	17:ff9d1e86ad5f	1913	word32 window[WOLFSSL_DTLS_WINDOW_WORDS];
sPymbed	17:ff9d1e86ad5f	1914	/* Sliding window for current epoch */
sPymbed	17:ff9d1e86ad5f	1915	word16 nextEpoch; /* Expected epoch in next record */
sPymbed	17:ff9d1e86ad5f	1916	word16 nextSeq_hi; /* Expected sequence in next record */
sPymbed	17:ff9d1e86ad5f	1917	word32 nextSeq_lo;
sPymbed	17:ff9d1e86ad5f	1918
sPymbed	17:ff9d1e86ad5f	1919	word32 prevWindow[WOLFSSL_DTLS_WINDOW_WORDS];
sPymbed	17:ff9d1e86ad5f	1920	/* Sliding window for old epoch */
sPymbed	17:ff9d1e86ad5f	1921	word32 prevSeq_lo;
sPymbed	17:ff9d1e86ad5f	1922	word16 prevSeq_hi; /* Next sequence in allowed old epoch */
sPymbed	17:ff9d1e86ad5f	1923
sPymbed	17:ff9d1e86ad5f	1924	#ifdef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	1925	word16 peerId;
sPymbed	17:ff9d1e86ad5f	1926	word32 highwaterMark;
sPymbed	17:ff9d1e86ad5f	1927	#endif
sPymbed	17:ff9d1e86ad5f	1928	} WOLFSSL_DTLS_PEERSEQ;
sPymbed	17:ff9d1e86ad5f	1929
sPymbed	17:ff9d1e86ad5f	1930
sPymbed	17:ff9d1e86ad5f	1931	#define MAX_WRITE_IV_SZ 16 /* max size of client/server write_IV */
sPymbed	17:ff9d1e86ad5f	1932
sPymbed	17:ff9d1e86ad5f	1933	/* keys and secrets
sPymbed	17:ff9d1e86ad5f	1934	* keep as a constant size (no additional ifdefs) for session export */
sPymbed	17:ff9d1e86ad5f	1935	typedef struct Keys {
sPymbed	17:ff9d1e86ad5f	1936	byte client_write_MAC_secret[WC_MAX_DIGEST_SIZE]; /* max sizes */
sPymbed	17:ff9d1e86ad5f	1937	byte server_write_MAC_secret[WC_MAX_DIGEST_SIZE];
sPymbed	17:ff9d1e86ad5f	1938	byte client_write_key[MAX_SYM_KEY_SIZE]; /* max sizes */
sPymbed	17:ff9d1e86ad5f	1939	byte server_write_key[MAX_SYM_KEY_SIZE];
sPymbed	17:ff9d1e86ad5f	1940	byte client_write_IV[MAX_WRITE_IV_SZ]; /* max sizes */
sPymbed	17:ff9d1e86ad5f	1941	byte server_write_IV[MAX_WRITE_IV_SZ];
sPymbed	17:ff9d1e86ad5f	1942	#if defined(HAVE_AEAD) \|\| defined(WOLFSSL_SESSION_EXPORT)
sPymbed	17:ff9d1e86ad5f	1943	byte aead_exp_IV[AEAD_MAX_EXP_SZ];
sPymbed	17:ff9d1e86ad5f	1944	byte aead_enc_imp_IV[AEAD_MAX_IMP_SZ];
sPymbed	17:ff9d1e86ad5f	1945	byte aead_dec_imp_IV[AEAD_MAX_IMP_SZ];
sPymbed	17:ff9d1e86ad5f	1946	#endif
sPymbed	17:ff9d1e86ad5f	1947
sPymbed	17:ff9d1e86ad5f	1948	word32 peer_sequence_number_hi;
sPymbed	17:ff9d1e86ad5f	1949	word32 peer_sequence_number_lo;
sPymbed	17:ff9d1e86ad5f	1950	word32 sequence_number_hi;
sPymbed	17:ff9d1e86ad5f	1951	word32 sequence_number_lo;
sPymbed	17:ff9d1e86ad5f	1952
sPymbed	17:ff9d1e86ad5f	1953	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	1954	word16 curEpoch; /* Received epoch in current record */
sPymbed	17:ff9d1e86ad5f	1955	word16 curSeq_hi; /* Received sequence in current record */
sPymbed	17:ff9d1e86ad5f	1956	word32 curSeq_lo;
sPymbed	17:ff9d1e86ad5f	1957	#ifdef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	1958	byte curPeerId; /* Received peer group ID in current record */
sPymbed	17:ff9d1e86ad5f	1959	#endif
sPymbed	17:ff9d1e86ad5f	1960	WOLFSSL_DTLS_PEERSEQ peerSeq[WOLFSSL_DTLS_PEERSEQ_SZ];
sPymbed	17:ff9d1e86ad5f	1961
sPymbed	17:ff9d1e86ad5f	1962	word16 dtls_peer_handshake_number;
sPymbed	17:ff9d1e86ad5f	1963	word16 dtls_expected_peer_handshake_number;
sPymbed	17:ff9d1e86ad5f	1964
sPymbed	17:ff9d1e86ad5f	1965	word16 dtls_epoch; /* Current epoch */
sPymbed	17:ff9d1e86ad5f	1966	word16 dtls_sequence_number_hi; /* Current epoch */
sPymbed	17:ff9d1e86ad5f	1967	word32 dtls_sequence_number_lo;
sPymbed	17:ff9d1e86ad5f	1968	word16 dtls_prev_sequence_number_hi; /* Previous epoch */
sPymbed	17:ff9d1e86ad5f	1969	word32 dtls_prev_sequence_number_lo;
sPymbed	17:ff9d1e86ad5f	1970	word16 dtls_handshake_number; /* Current tx handshake seq */
sPymbed	17:ff9d1e86ad5f	1971	#endif
sPymbed	17:ff9d1e86ad5f	1972
sPymbed	17:ff9d1e86ad5f	1973	word32 encryptSz; /* last size of encrypted data */
sPymbed	17:ff9d1e86ad5f	1974	word32 padSz; /* how much to advance after decrypt part */
sPymbed	17:ff9d1e86ad5f	1975	byte encryptionOn; /* true after change cipher spec */
sPymbed	17:ff9d1e86ad5f	1976	byte decryptedCur; /* only decrypt current record once */
sPymbed	17:ff9d1e86ad5f	1977	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	1978	byte updateResponseReq:1; /* KeyUpdate response from peer required. */
sPymbed	17:ff9d1e86ad5f	1979	byte keyUpdateRespond:1; /* KeyUpdate is to be responded to. */
sPymbed	17:ff9d1e86ad5f	1980	#endif
sPymbed	17:ff9d1e86ad5f	1981	} Keys;
sPymbed	17:ff9d1e86ad5f	1982
sPymbed	17:ff9d1e86ad5f	1983
sPymbed	17:ff9d1e86ad5f	1984
sPymbed	17:ff9d1e86ad5f	1985	/** TLS Extensions - RFC 6066 */
sPymbed	17:ff9d1e86ad5f	1986	#ifdef HAVE_TLS_EXTENSIONS
sPymbed	17:ff9d1e86ad5f	1987
sPymbed	17:ff9d1e86ad5f	1988	typedef enum {
sPymbed	17:ff9d1e86ad5f	1989	TLSX_SERVER_NAME = 0x0000, /* a.k.a. SNI */
sPymbed	17:ff9d1e86ad5f	1990	TLSX_MAX_FRAGMENT_LENGTH = 0x0001,
sPymbed	17:ff9d1e86ad5f	1991	TLSX_TRUNCATED_HMAC = 0x0004,
sPymbed	17:ff9d1e86ad5f	1992	TLSX_STATUS_REQUEST = 0x0005, /* a.k.a. OCSP stapling */
sPymbed	17:ff9d1e86ad5f	1993	TLSX_SUPPORTED_GROUPS = 0x000a, /* a.k.a. Supported Curves */
sPymbed	17:ff9d1e86ad5f	1994	TLSX_EC_POINT_FORMATS = 0x000b,
sPymbed	17:ff9d1e86ad5f	1995	TLSX_SIGNATURE_ALGORITHMS = 0x000d,
sPymbed	17:ff9d1e86ad5f	1996	TLSX_APPLICATION_LAYER_PROTOCOL = 0x0010, /* a.k.a. ALPN */
sPymbed	17:ff9d1e86ad5f	1997	TLSX_STATUS_REQUEST_V2 = 0x0011, /* a.k.a. OCSP stapling v2 */
sPymbed	17:ff9d1e86ad5f	1998	TLSX_QUANTUM_SAFE_HYBRID = 0x0018, /* a.k.a. QSH */
sPymbed	17:ff9d1e86ad5f	1999	TLSX_SESSION_TICKET = 0x0023,
sPymbed	17:ff9d1e86ad5f	2000	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2001	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	2002	TLSX_PRE_SHARED_KEY = 0x0029,
sPymbed	17:ff9d1e86ad5f	2003	#endif
sPymbed	17:ff9d1e86ad5f	2004	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	2005	TLSX_EARLY_DATA = 0x002a,
sPymbed	17:ff9d1e86ad5f	2006	#endif
sPymbed	17:ff9d1e86ad5f	2007	TLSX_SUPPORTED_VERSIONS = 0x002b,
sPymbed	17:ff9d1e86ad5f	2008	TLSX_COOKIE = 0x002c,
sPymbed	17:ff9d1e86ad5f	2009	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	2010	TLSX_PSK_KEY_EXCHANGE_MODES = 0x002d,
sPymbed	17:ff9d1e86ad5f	2011	#endif
sPymbed	17:ff9d1e86ad5f	2012	#ifdef WOLFSSL_POST_HANDSHAKE_AUTH
sPymbed	17:ff9d1e86ad5f	2013	TLSX_POST_HANDSHAKE_AUTH = 0x0031,
sPymbed	17:ff9d1e86ad5f	2014	#endif
sPymbed	17:ff9d1e86ad5f	2015	#if defined(WOLFSSL_TLS13_DRAFT_18) \|\| defined(WOLFSSL_TLS13_DRAFT_22)
sPymbed	17:ff9d1e86ad5f	2016	TLSX_KEY_SHARE = 0x0028,
sPymbed	17:ff9d1e86ad5f	2017	#else
sPymbed	17:ff9d1e86ad5f	2018	TLSX_SIGNATURE_ALGORITHMS_CERT = 0x0032,
sPymbed	17:ff9d1e86ad5f	2019	TLSX_KEY_SHARE = 0x0033,
sPymbed	17:ff9d1e86ad5f	2020	#endif
sPymbed	17:ff9d1e86ad5f	2021	#endif
sPymbed	17:ff9d1e86ad5f	2022	TLSX_RENEGOTIATION_INFO = 0xff01
sPymbed	17:ff9d1e86ad5f	2023	} TLSX_Type;
sPymbed	17:ff9d1e86ad5f	2024
sPymbed	17:ff9d1e86ad5f	2025	typedef struct TLSX {
sPymbed	17:ff9d1e86ad5f	2026	TLSX_Type type; /* Extension Type */
sPymbed	17:ff9d1e86ad5f	2027	void* data; /* Extension Data */
sPymbed	17:ff9d1e86ad5f	2028	word32 val; /* Extension Value */
sPymbed	17:ff9d1e86ad5f	2029	byte resp; /* IsResponse Flag */
sPymbed	17:ff9d1e86ad5f	2030	struct TLSX* next; /* List Behavior */
sPymbed	17:ff9d1e86ad5f	2031	} TLSX;
sPymbed	17:ff9d1e86ad5f	2032
sPymbed	17:ff9d1e86ad5f	2033	WOLFSSL_LOCAL TLSX* TLSX_Find(TLSX* list, TLSX_Type type);
sPymbed	17:ff9d1e86ad5f	2034	WOLFSSL_LOCAL void TLSX_Remove(TLSX** list, TLSX_Type type, void* heap);
sPymbed	17:ff9d1e86ad5f	2035	WOLFSSL_LOCAL void TLSX_FreeAll(TLSX* list, void* heap);
sPymbed	17:ff9d1e86ad5f	2036	WOLFSSL_LOCAL int TLSX_SupportExtensions(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2037	WOLFSSL_LOCAL int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isRequest);
sPymbed	17:ff9d1e86ad5f	2038
sPymbed	17:ff9d1e86ad5f	2039	#if defined(WOLFSSL_TLS13) \|\| !defined(NO_WOLFSSL_CLIENT)
sPymbed	17:ff9d1e86ad5f	2040	WOLFSSL_LOCAL int TLSX_GetRequestSize(WOLFSSL* ssl, byte msgType,
sPymbed	17:ff9d1e86ad5f	2041	word16* pLength);
sPymbed	17:ff9d1e86ad5f	2042	WOLFSSL_LOCAL int TLSX_WriteRequest(WOLFSSL* ssl, byte* output,
sPymbed	17:ff9d1e86ad5f	2043	byte msgType, word16* pOffset);
sPymbed	17:ff9d1e86ad5f	2044	#endif
sPymbed	17:ff9d1e86ad5f	2045
sPymbed	17:ff9d1e86ad5f	2046	#if defined(WOLFSSL_TLS13) \|\| !defined(NO_WOLFSSL_SERVER)
sPymbed	17:ff9d1e86ad5f	2047	/* TLS 1.3 Certificate messages have extensions. */
sPymbed	17:ff9d1e86ad5f	2048	WOLFSSL_LOCAL int TLSX_GetResponseSize(WOLFSSL* ssl, byte msgType,
sPymbed	17:ff9d1e86ad5f	2049	word16* pLength);
sPymbed	17:ff9d1e86ad5f	2050	WOLFSSL_LOCAL int TLSX_WriteResponse(WOLFSSL ssl, byte output, byte msgType,
sPymbed	17:ff9d1e86ad5f	2051	word16* pOffset);
sPymbed	17:ff9d1e86ad5f	2052	#endif
sPymbed	17:ff9d1e86ad5f	2053
sPymbed	17:ff9d1e86ad5f	2054	WOLFSSL_LOCAL int TLSX_Parse(WOLFSSL* ssl, byte* input, word16 length,
sPymbed	17:ff9d1e86ad5f	2055	byte msgType, Suites *suites);
sPymbed	17:ff9d1e86ad5f	2056
sPymbed	17:ff9d1e86ad5f	2057	#elif defined(HAVE_SNI) \
sPymbed	17:ff9d1e86ad5f	2058	\|\| defined(HAVE_MAX_FRAGMENT) \
sPymbed	17:ff9d1e86ad5f	2059	\|\| defined(HAVE_TRUNCATED_HMAC) \
sPymbed	17:ff9d1e86ad5f	2060	\|\| defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
sPymbed	17:ff9d1e86ad5f	2061	\|\| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) \
sPymbed	17:ff9d1e86ad5f	2062	\|\| defined(HAVE_SUPPORTED_CURVES) \
sPymbed	17:ff9d1e86ad5f	2063	\|\| defined(HAVE_ALPN) \
sPymbed	17:ff9d1e86ad5f	2064	\|\| defined(HAVE_QSH) \
sPymbed	17:ff9d1e86ad5f	2065	\|\| defined(HAVE_SESSION_TICKET) \
sPymbed	17:ff9d1e86ad5f	2066	\|\| defined(HAVE_SECURE_RENEGOTIATION) \
sPymbed	17:ff9d1e86ad5f	2067	\|\| defined(HAVE_SERVER_RENEGOTIATION_INFO)
sPymbed	17:ff9d1e86ad5f	2068
sPymbed	17:ff9d1e86ad5f	2069	#error Using TLS extensions requires HAVE_TLS_EXTENSIONS to be defined.
sPymbed	17:ff9d1e86ad5f	2070
sPymbed	17:ff9d1e86ad5f	2071	#endif /* HAVE_TLS_EXTENSIONS */
sPymbed	17:ff9d1e86ad5f	2072
sPymbed	17:ff9d1e86ad5f	2073	/** Server Name Indication - RFC 6066 (session 3) */
sPymbed	17:ff9d1e86ad5f	2074	#ifdef HAVE_SNI
sPymbed	17:ff9d1e86ad5f	2075
sPymbed	17:ff9d1e86ad5f	2076	typedef struct SNI {
sPymbed	17:ff9d1e86ad5f	2077	byte type; /* SNI Type */
sPymbed	17:ff9d1e86ad5f	2078	union { char* host_name; } data; /* SNI Data */
sPymbed	17:ff9d1e86ad5f	2079	struct SNI* next; /* List Behavior */
sPymbed	17:ff9d1e86ad5f	2080	byte status; /* Matching result */
sPymbed	17:ff9d1e86ad5f	2081	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	2082	byte options; /* Behavior options */
sPymbed	17:ff9d1e86ad5f	2083	#endif
sPymbed	17:ff9d1e86ad5f	2084	} SNI;
sPymbed	17:ff9d1e86ad5f	2085
sPymbed	17:ff9d1e86ad5f	2086	WOLFSSL_LOCAL int TLSX_UseSNI(TLSX** extensions, byte type, const void* data,
sPymbed	17:ff9d1e86ad5f	2087	word16 size, void* heap);
sPymbed	17:ff9d1e86ad5f	2088	WOLFSSL_LOCAL byte TLSX_SNI_Status(TLSX* extensions, byte type);
sPymbed	17:ff9d1e86ad5f	2089	WOLFSSL_LOCAL word16 TLSX_SNI_GetRequest(TLSX* extensions, byte type,
sPymbed	17:ff9d1e86ad5f	2090	void** data);
sPymbed	17:ff9d1e86ad5f	2091
sPymbed	17:ff9d1e86ad5f	2092	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	2093	WOLFSSL_LOCAL void TLSX_SNI_SetOptions(TLSX* extensions, byte type,
sPymbed	17:ff9d1e86ad5f	2094	byte options);
sPymbed	17:ff9d1e86ad5f	2095	WOLFSSL_LOCAL int TLSX_SNI_GetFromBuffer(const byte* buffer, word32 bufferSz,
sPymbed	17:ff9d1e86ad5f	2096	byte type, byte* sni, word32* inOutSz);
sPymbed	17:ff9d1e86ad5f	2097	#endif
sPymbed	17:ff9d1e86ad5f	2098
sPymbed	17:ff9d1e86ad5f	2099	#endif /* HAVE_SNI */
sPymbed	17:ff9d1e86ad5f	2100
sPymbed	17:ff9d1e86ad5f	2101	/* Application-Layer Protocol Negotiation - RFC 7301 */
sPymbed	17:ff9d1e86ad5f	2102	#ifdef HAVE_ALPN
sPymbed	17:ff9d1e86ad5f	2103	typedef struct ALPN {
sPymbed	17:ff9d1e86ad5f	2104	char* protocol_name; /* ALPN protocol name */
sPymbed	17:ff9d1e86ad5f	2105	struct ALPN* next; /* List Behavior */
sPymbed	17:ff9d1e86ad5f	2106	byte options; /* Behavior options */
sPymbed	17:ff9d1e86ad5f	2107	byte negotiated; /* ALPN protocol negotiated or not */
sPymbed	17:ff9d1e86ad5f	2108	} ALPN;
sPymbed	17:ff9d1e86ad5f	2109
sPymbed	17:ff9d1e86ad5f	2110	WOLFSSL_LOCAL int TLSX_ALPN_GetRequest(TLSX* extensions,
sPymbed	17:ff9d1e86ad5f	2111	void** data, word16 *dataSz);
sPymbed	17:ff9d1e86ad5f	2112
sPymbed	17:ff9d1e86ad5f	2113	WOLFSSL_LOCAL int TLSX_UseALPN(TLSX** extensions, const void* data,
sPymbed	17:ff9d1e86ad5f	2114	word16 size, byte options, void* heap);
sPymbed	17:ff9d1e86ad5f	2115
sPymbed	17:ff9d1e86ad5f	2116	WOLFSSL_LOCAL int TLSX_ALPN_SetOptions(TLSX** extensions, const byte option);
sPymbed	17:ff9d1e86ad5f	2117
sPymbed	17:ff9d1e86ad5f	2118	#endif /* HAVE_ALPN */
sPymbed	17:ff9d1e86ad5f	2119
sPymbed	17:ff9d1e86ad5f	2120	/** Maximum Fragment Length Negotiation - RFC 6066 (session 4) */
sPymbed	17:ff9d1e86ad5f	2121	#ifdef HAVE_MAX_FRAGMENT
sPymbed	17:ff9d1e86ad5f	2122
sPymbed	17:ff9d1e86ad5f	2123	WOLFSSL_LOCAL int TLSX_UseMaxFragment(TLSX** extensions, byte mfl, void* heap);
sPymbed	17:ff9d1e86ad5f	2124
sPymbed	17:ff9d1e86ad5f	2125	#endif /* HAVE_MAX_FRAGMENT */
sPymbed	17:ff9d1e86ad5f	2126
sPymbed	17:ff9d1e86ad5f	2127	/** Truncated HMAC - RFC 6066 (session 7) */
sPymbed	17:ff9d1e86ad5f	2128	#ifdef HAVE_TRUNCATED_HMAC
sPymbed	17:ff9d1e86ad5f	2129
sPymbed	17:ff9d1e86ad5f	2130	WOLFSSL_LOCAL int TLSX_UseTruncatedHMAC(TLSX** extensions, void* heap);
sPymbed	17:ff9d1e86ad5f	2131
sPymbed	17:ff9d1e86ad5f	2132	#endif /* HAVE_TRUNCATED_HMAC */
sPymbed	17:ff9d1e86ad5f	2133
sPymbed	17:ff9d1e86ad5f	2134	/** Certificate Status Request - RFC 6066 (session 8) */
sPymbed	17:ff9d1e86ad5f	2135	#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
sPymbed	17:ff9d1e86ad5f	2136
sPymbed	17:ff9d1e86ad5f	2137	typedef struct {
sPymbed	17:ff9d1e86ad5f	2138	byte status_type;
sPymbed	17:ff9d1e86ad5f	2139	byte options;
sPymbed	17:ff9d1e86ad5f	2140	WOLFSSL* ssl;
sPymbed	17:ff9d1e86ad5f	2141	union {
sPymbed	17:ff9d1e86ad5f	2142	OcspRequest ocsp;
sPymbed	17:ff9d1e86ad5f	2143	} request;
sPymbed	17:ff9d1e86ad5f	2144	#if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_SERVER)
sPymbed	17:ff9d1e86ad5f	2145	buffer response;
sPymbed	17:ff9d1e86ad5f	2146	#endif
sPymbed	17:ff9d1e86ad5f	2147	} CertificateStatusRequest;
sPymbed	17:ff9d1e86ad5f	2148
sPymbed	17:ff9d1e86ad5f	2149	WOLFSSL_LOCAL int TLSX_UseCertificateStatusRequest(TLSX** extensions,
sPymbed	17:ff9d1e86ad5f	2150	byte status_type, byte options, WOLFSSL* ssl, void* heap, int devId);
sPymbed	17:ff9d1e86ad5f	2151	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	2152	WOLFSSL_LOCAL int TLSX_CSR_InitRequest(TLSX* extensions, DecodedCert* cert,
sPymbed	17:ff9d1e86ad5f	2153	void* heap);
sPymbed	17:ff9d1e86ad5f	2154	#endif
sPymbed	17:ff9d1e86ad5f	2155	WOLFSSL_LOCAL void* TLSX_CSR_GetRequest(TLSX* extensions);
sPymbed	17:ff9d1e86ad5f	2156	WOLFSSL_LOCAL int TLSX_CSR_ForceRequest(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2157
sPymbed	17:ff9d1e86ad5f	2158	#endif
sPymbed	17:ff9d1e86ad5f	2159
sPymbed	17:ff9d1e86ad5f	2160	/** Certificate Status Request v2 - RFC 6961 */
sPymbed	17:ff9d1e86ad5f	2161	#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
sPymbed	17:ff9d1e86ad5f	2162
sPymbed	17:ff9d1e86ad5f	2163	typedef struct CSRIv2 {
sPymbed	17:ff9d1e86ad5f	2164	byte status_type;
sPymbed	17:ff9d1e86ad5f	2165	byte options;
sPymbed	17:ff9d1e86ad5f	2166	word16 requests;
sPymbed	17:ff9d1e86ad5f	2167	union {
sPymbed	17:ff9d1e86ad5f	2168	OcspRequest ocsp[1 + MAX_CHAIN_DEPTH];
sPymbed	17:ff9d1e86ad5f	2169	} request;
sPymbed	17:ff9d1e86ad5f	2170	struct CSRIv2* next;
sPymbed	17:ff9d1e86ad5f	2171	} CertificateStatusRequestItemV2;
sPymbed	17:ff9d1e86ad5f	2172
sPymbed	17:ff9d1e86ad5f	2173	WOLFSSL_LOCAL int TLSX_UseCertificateStatusRequestV2(TLSX** extensions,
sPymbed	17:ff9d1e86ad5f	2174	byte status_type, byte options, void* heap, int devId);
sPymbed	17:ff9d1e86ad5f	2175	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	2176	WOLFSSL_LOCAL int TLSX_CSR2_InitRequests(TLSX* extensions, DecodedCert* cert,
sPymbed	17:ff9d1e86ad5f	2177	byte isPeer, void* heap);
sPymbed	17:ff9d1e86ad5f	2178	#endif
sPymbed	17:ff9d1e86ad5f	2179	WOLFSSL_LOCAL void* TLSX_CSR2_GetRequest(TLSX* extensions, byte status_type,
sPymbed	17:ff9d1e86ad5f	2180	byte index);
sPymbed	17:ff9d1e86ad5f	2181	WOLFSSL_LOCAL int TLSX_CSR2_ForceRequest(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2182
sPymbed	17:ff9d1e86ad5f	2183	#endif
sPymbed	17:ff9d1e86ad5f	2184
sPymbed	17:ff9d1e86ad5f	2185	/** Supported Elliptic Curves - RFC 4492 (session 4) */
sPymbed	17:ff9d1e86ad5f	2186	#ifdef HAVE_SUPPORTED_CURVES
sPymbed	17:ff9d1e86ad5f	2187
sPymbed	17:ff9d1e86ad5f	2188	typedef struct SupportedCurve {
sPymbed	17:ff9d1e86ad5f	2189	word16 name; /* Curve Names */
sPymbed	17:ff9d1e86ad5f	2190	struct SupportedCurve* next; /* List Behavior */
sPymbed	17:ff9d1e86ad5f	2191	} SupportedCurve;
sPymbed	17:ff9d1e86ad5f	2192
sPymbed	17:ff9d1e86ad5f	2193	typedef struct PointFormat {
sPymbed	17:ff9d1e86ad5f	2194	byte format; /* PointFormat */
sPymbed	17:ff9d1e86ad5f	2195	struct PointFormat* next; /* List Behavior */
sPymbed	17:ff9d1e86ad5f	2196	} PointFormat;
sPymbed	17:ff9d1e86ad5f	2197
sPymbed	17:ff9d1e86ad5f	2198	WOLFSSL_LOCAL int TLSX_UseSupportedCurve(TLSX** extensions, word16 name,
sPymbed	17:ff9d1e86ad5f	2199	void* heap);
sPymbed	17:ff9d1e86ad5f	2200
sPymbed	17:ff9d1e86ad5f	2201	WOLFSSL_LOCAL int TLSX_UsePointFormat(TLSX** extensions, byte point,
sPymbed	17:ff9d1e86ad5f	2202	void* heap);
sPymbed	17:ff9d1e86ad5f	2203
sPymbed	17:ff9d1e86ad5f	2204	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	2205	WOLFSSL_LOCAL int TLSX_ValidateSupportedCurves(WOLFSSL* ssl, byte first,
sPymbed	17:ff9d1e86ad5f	2206	byte second);
sPymbed	17:ff9d1e86ad5f	2207	WOLFSSL_LOCAL int TLSX_SupportedCurve_CheckPriority(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2208	#endif
sPymbed	17:ff9d1e86ad5f	2209	WOLFSSL_LOCAL int TLSX_SupportedCurve_Preferred(WOLFSSL* ssl,
sPymbed	17:ff9d1e86ad5f	2210	int checkSupported);
sPymbed	17:ff9d1e86ad5f	2211
sPymbed	17:ff9d1e86ad5f	2212	#endif /* HAVE_SUPPORTED_CURVES */
sPymbed	17:ff9d1e86ad5f	2213
sPymbed	17:ff9d1e86ad5f	2214	/** Renegotiation Indication - RFC 5746 */
sPymbed	17:ff9d1e86ad5f	2215	#if defined(HAVE_SECURE_RENEGOTIATION) \
sPymbed	17:ff9d1e86ad5f	2216	\|\| defined(HAVE_SERVER_RENEGOTIATION_INFO)
sPymbed	17:ff9d1e86ad5f	2217
sPymbed	17:ff9d1e86ad5f	2218	enum key_cache_state {
sPymbed	17:ff9d1e86ad5f	2219	SCR_CACHE_NULL = 0, /* empty / begin state */
sPymbed	17:ff9d1e86ad5f	2220	SCR_CACHE_NEEDED, /* need to cache keys */
sPymbed	17:ff9d1e86ad5f	2221	SCR_CACHE_COPY, /* we have a cached copy */
sPymbed	17:ff9d1e86ad5f	2222	SCR_CACHE_PARTIAL, /* partial restore to real keys */
sPymbed	17:ff9d1e86ad5f	2223	SCR_CACHE_COMPLETE /* complete restore to real keys */
sPymbed	17:ff9d1e86ad5f	2224	};
sPymbed	17:ff9d1e86ad5f	2225
sPymbed	17:ff9d1e86ad5f	2226	/* Additional Connection State according to rfc5746 section 3.1 */
sPymbed	17:ff9d1e86ad5f	2227	typedef struct SecureRenegotiation {
sPymbed	17:ff9d1e86ad5f	2228	byte enabled; /* secure_renegotiation flag in rfc */
sPymbed	17:ff9d1e86ad5f	2229	byte startScr; /* server requested client to start scr */
sPymbed	17:ff9d1e86ad5f	2230	enum key_cache_state cache_status; /* track key cache state */
sPymbed	17:ff9d1e86ad5f	2231	byte client_verify_data[TLS_FINISHED_SZ]; /* cached */
sPymbed	17:ff9d1e86ad5f	2232	byte server_verify_data[TLS_FINISHED_SZ]; /* cached */
sPymbed	17:ff9d1e86ad5f	2233	byte subject_hash[WC_SHA_DIGEST_SIZE]; /* peer cert hash */
sPymbed	17:ff9d1e86ad5f	2234	Keys tmp_keys; /* can't overwrite real keys yet */
sPymbed	17:ff9d1e86ad5f	2235	} SecureRenegotiation;
sPymbed	17:ff9d1e86ad5f	2236
sPymbed	17:ff9d1e86ad5f	2237	WOLFSSL_LOCAL int TLSX_UseSecureRenegotiation(TLSX** extensions, void* heap);
sPymbed	17:ff9d1e86ad5f	2238
sPymbed	17:ff9d1e86ad5f	2239	#ifdef HAVE_SERVER_RENEGOTIATION_INFO
sPymbed	17:ff9d1e86ad5f	2240	WOLFSSL_LOCAL int TLSX_AddEmptyRenegotiationInfo(TLSX** extensions, void* heap);
sPymbed	17:ff9d1e86ad5f	2241	#endif
sPymbed	17:ff9d1e86ad5f	2242
sPymbed	17:ff9d1e86ad5f	2243	#endif /* HAVE_SECURE_RENEGOTIATION */
sPymbed	17:ff9d1e86ad5f	2244
sPymbed	17:ff9d1e86ad5f	2245	/** Session Ticket - RFC 5077 (session 3.2) */
sPymbed	17:ff9d1e86ad5f	2246	#ifdef HAVE_SESSION_TICKET
sPymbed	17:ff9d1e86ad5f	2247
sPymbed	17:ff9d1e86ad5f	2248	typedef struct SessionTicket {
sPymbed	17:ff9d1e86ad5f	2249	word32 lifetime;
sPymbed	17:ff9d1e86ad5f	2250	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2251	word64 seen;
sPymbed	17:ff9d1e86ad5f	2252	word32 ageAdd;
sPymbed	17:ff9d1e86ad5f	2253	#endif
sPymbed	17:ff9d1e86ad5f	2254	byte* data;
sPymbed	17:ff9d1e86ad5f	2255	word16 size;
sPymbed	17:ff9d1e86ad5f	2256	} SessionTicket;
sPymbed	17:ff9d1e86ad5f	2257
sPymbed	17:ff9d1e86ad5f	2258	WOLFSSL_LOCAL int TLSX_UseSessionTicket(TLSX** extensions,
sPymbed	17:ff9d1e86ad5f	2259	SessionTicket* ticket, void* heap);
sPymbed	17:ff9d1e86ad5f	2260	WOLFSSL_LOCAL SessionTicket* TLSX_SessionTicket_Create(word32 lifetime,
sPymbed	17:ff9d1e86ad5f	2261	byte* data, word16 size, void* heap);
sPymbed	17:ff9d1e86ad5f	2262	WOLFSSL_LOCAL void TLSX_SessionTicket_Free(SessionTicket* ticket, void* heap);
sPymbed	17:ff9d1e86ad5f	2263
sPymbed	17:ff9d1e86ad5f	2264	#endif /* HAVE_SESSION_TICKET */
sPymbed	17:ff9d1e86ad5f	2265
sPymbed	17:ff9d1e86ad5f	2266	/** Quantum-Safe-Hybrid - draft-whyte-qsh-tls12-00 */
sPymbed	17:ff9d1e86ad5f	2267	#ifdef HAVE_QSH
sPymbed	17:ff9d1e86ad5f	2268
sPymbed	17:ff9d1e86ad5f	2269	typedef struct QSHScheme {
sPymbed	17:ff9d1e86ad5f	2270	struct QSHScheme* next; /* List Behavior */
sPymbed	17:ff9d1e86ad5f	2271	byte* PK;
sPymbed	17:ff9d1e86ad5f	2272	word16 name; /* QSHScheme Names */
sPymbed	17:ff9d1e86ad5f	2273	word16 PKLen;
sPymbed	17:ff9d1e86ad5f	2274	} QSHScheme;
sPymbed	17:ff9d1e86ad5f	2275
sPymbed	17:ff9d1e86ad5f	2276	typedef struct QSHkey {
sPymbed	17:ff9d1e86ad5f	2277	struct QSHKey* next;
sPymbed	17:ff9d1e86ad5f	2278	word16 name;
sPymbed	17:ff9d1e86ad5f	2279	buffer pub;
sPymbed	17:ff9d1e86ad5f	2280	buffer pri;
sPymbed	17:ff9d1e86ad5f	2281	} QSHKey;
sPymbed	17:ff9d1e86ad5f	2282
sPymbed	17:ff9d1e86ad5f	2283	typedef struct QSHSecret {
sPymbed	17:ff9d1e86ad5f	2284	QSHScheme* list;
sPymbed	17:ff9d1e86ad5f	2285	buffer* SerSi;
sPymbed	17:ff9d1e86ad5f	2286	buffer* CliSi;
sPymbed	17:ff9d1e86ad5f	2287	} QSHSecret;
sPymbed	17:ff9d1e86ad5f	2288
sPymbed	17:ff9d1e86ad5f	2289	/* used in key exchange during handshake */
sPymbed	17:ff9d1e86ad5f	2290	WOLFSSL_LOCAL int TLSX_QSHCipher_Parse(WOLFSSL* ssl, const byte* input,
sPymbed	17:ff9d1e86ad5f	2291	word16 length, byte isServer);
sPymbed	17:ff9d1e86ad5f	2292	WOLFSSL_LOCAL word16 TLSX_QSHPK_Write(QSHScheme* list, byte* output);
sPymbed	17:ff9d1e86ad5f	2293	WOLFSSL_LOCAL word16 TLSX_QSH_GetSize(QSHScheme* list, byte isRequest);
sPymbed	17:ff9d1e86ad5f	2294
sPymbed	17:ff9d1e86ad5f	2295	/* used by api for setting a specific QSH scheme */
sPymbed	17:ff9d1e86ad5f	2296	WOLFSSL_LOCAL int TLSX_UseQSHScheme(TLSX** extensions, word16 name,
sPymbed	17:ff9d1e86ad5f	2297	byte* pKey, word16 pKeySz, void* heap);
sPymbed	17:ff9d1e86ad5f	2298
sPymbed	17:ff9d1e86ad5f	2299	/* used when parsing in QSHCipher structs */
sPymbed	17:ff9d1e86ad5f	2300	WOLFSSL_LOCAL int QSH_Decrypt(QSHKey* key, byte* in, word32 szIn,
sPymbed	17:ff9d1e86ad5f	2301	byte* out, word16* szOut);
sPymbed	17:ff9d1e86ad5f	2302	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	2303	WOLFSSL_LOCAL int TLSX_ValidateQSHScheme(TLSX** extensions, word16 name);
sPymbed	17:ff9d1e86ad5f	2304	#endif
sPymbed	17:ff9d1e86ad5f	2305
sPymbed	17:ff9d1e86ad5f	2306	#endif /* HAVE_QSH */
sPymbed	17:ff9d1e86ad5f	2307
sPymbed	17:ff9d1e86ad5f	2308	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2309	/* Cookie extension information - cookie data. */
sPymbed	17:ff9d1e86ad5f	2310	typedef struct Cookie {
sPymbed	17:ff9d1e86ad5f	2311	word16 len;
sPymbed	17:ff9d1e86ad5f	2312	byte data;
sPymbed	17:ff9d1e86ad5f	2313	} Cookie;
sPymbed	17:ff9d1e86ad5f	2314
sPymbed	17:ff9d1e86ad5f	2315	WOLFSSL_LOCAL int TLSX_Cookie_Use(WOLFSSL* ssl, byte* data, word16 len,
sPymbed	17:ff9d1e86ad5f	2316	byte* mac, byte macSz, int resp);
sPymbed	17:ff9d1e86ad5f	2317
sPymbed	17:ff9d1e86ad5f	2318
sPymbed	17:ff9d1e86ad5f	2319	/* Key Share - TLS v1.3 Specification */
sPymbed	17:ff9d1e86ad5f	2320
sPymbed	17:ff9d1e86ad5f	2321	/* The KeyShare extension information - entry in a linked list. */
sPymbed	17:ff9d1e86ad5f	2322	typedef struct KeyShareEntry {
sPymbed	17:ff9d1e86ad5f	2323	word16 group; /* NamedGroup */
sPymbed	17:ff9d1e86ad5f	2324	byte* ke; /* Key exchange data */
sPymbed	17:ff9d1e86ad5f	2325	word32 keLen; /* Key exchange data length */
sPymbed	17:ff9d1e86ad5f	2326	void* key; /* Private key */
sPymbed	17:ff9d1e86ad5f	2327	word32 keyLen; /* Private key length */
sPymbed	17:ff9d1e86ad5f	2328	byte* pubKey; /* Public key */
sPymbed	17:ff9d1e86ad5f	2329	word32 pubKeyLen; /* Public key length */
sPymbed	17:ff9d1e86ad5f	2330	struct KeyShareEntry* next; /* List pointer */
sPymbed	17:ff9d1e86ad5f	2331	} KeyShareEntry;
sPymbed	17:ff9d1e86ad5f	2332
sPymbed	17:ff9d1e86ad5f	2333	WOLFSSL_LOCAL int TLSX_KeyShare_Use(WOLFSSL* ssl, word16 group, word16 len,
sPymbed	17:ff9d1e86ad5f	2334	byte* data, KeyShareEntry **kse);
sPymbed	17:ff9d1e86ad5f	2335	WOLFSSL_LOCAL int TLSX_KeyShare_Empty(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2336	WOLFSSL_LOCAL int TLSX_KeyShare_Establish(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2337	WOLFSSL_LOCAL int TLSX_KeyShare_DeriveSecret(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2338
sPymbed	17:ff9d1e86ad5f	2339
sPymbed	17:ff9d1e86ad5f	2340	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	2341	#ifndef WOLFSSL_TLS13_DRAFT_18
sPymbed	17:ff9d1e86ad5f	2342	/* Ticket nonce - for deriving PSK.
sPymbed	17:ff9d1e86ad5f	2343	* Length allowed to be: 1..255. Only support 4 bytes.
sPymbed	17:ff9d1e86ad5f	2344	*/
sPymbed	17:ff9d1e86ad5f	2345	typedef struct TicketNonce {
sPymbed	17:ff9d1e86ad5f	2346	byte len;
sPymbed	17:ff9d1e86ad5f	2347	byte data[MAX_TICKET_NONCE_SZ];
sPymbed	17:ff9d1e86ad5f	2348	} TicketNonce;
sPymbed	17:ff9d1e86ad5f	2349	#endif
sPymbed	17:ff9d1e86ad5f	2350
sPymbed	17:ff9d1e86ad5f	2351	/* The PreSharedKey extension information - entry in a linked list. */
sPymbed	17:ff9d1e86ad5f	2352	typedef struct PreSharedKey {
sPymbed	17:ff9d1e86ad5f	2353	word16 identityLen; /* Length of identity */
sPymbed	17:ff9d1e86ad5f	2354	byte* identity; /* PSK identity */
sPymbed	17:ff9d1e86ad5f	2355	word32 ticketAge; /* Age of the ticket */
sPymbed	17:ff9d1e86ad5f	2356	byte cipherSuite0; /* Cipher Suite */
sPymbed	17:ff9d1e86ad5f	2357	byte cipherSuite; /* Cipher Suite */
sPymbed	17:ff9d1e86ad5f	2358	word32 binderLen; /* Length of HMAC */
sPymbed	17:ff9d1e86ad5f	2359	byte binder[WC_MAX_DIGEST_SIZE]; /* HMAC of hanshake */
sPymbed	17:ff9d1e86ad5f	2360	byte hmac; /* HMAC algorithm */
sPymbed	17:ff9d1e86ad5f	2361	byte resumption:1; /* Resumption PSK */
sPymbed	17:ff9d1e86ad5f	2362	byte chosen:1; /* Server's choice */
sPymbed	17:ff9d1e86ad5f	2363	struct PreSharedKey* next; /* List pointer */
sPymbed	17:ff9d1e86ad5f	2364	} PreSharedKey;
sPymbed	17:ff9d1e86ad5f	2365
sPymbed	17:ff9d1e86ad5f	2366	WOLFSSL_LOCAL word16 TLSX_PreSharedKey_WriteBinders(PreSharedKey* list,
sPymbed	17:ff9d1e86ad5f	2367	byte* output, byte msgType);
sPymbed	17:ff9d1e86ad5f	2368	WOLFSSL_LOCAL word16 TLSX_PreSharedKey_GetSizeBinders(PreSharedKey* list,
sPymbed	17:ff9d1e86ad5f	2369	byte msgType);
sPymbed	17:ff9d1e86ad5f	2370	WOLFSSL_LOCAL int TLSX_PreSharedKey_Use(WOLFSSL* ssl, byte* identity,
sPymbed	17:ff9d1e86ad5f	2371	word16 len, word32 age, byte hmac,
sPymbed	17:ff9d1e86ad5f	2372	byte cipherSuite0, byte cipherSuite,
sPymbed	17:ff9d1e86ad5f	2373	byte resumption,
sPymbed	17:ff9d1e86ad5f	2374	PreSharedKey **preSharedKey);
sPymbed	17:ff9d1e86ad5f	2375
sPymbed	17:ff9d1e86ad5f	2376	/* The possible Pre-Shared Key key exchange modes. */
sPymbed	17:ff9d1e86ad5f	2377	enum PskKeyExchangeMode {
sPymbed	17:ff9d1e86ad5f	2378	PSK_KE,
sPymbed	17:ff9d1e86ad5f	2379	PSK_DHE_KE
sPymbed	17:ff9d1e86ad5f	2380	};
sPymbed	17:ff9d1e86ad5f	2381
sPymbed	17:ff9d1e86ad5f	2382	/* User can define this. */
sPymbed	17:ff9d1e86ad5f	2383	#ifndef WOLFSSL_DEF_PSK_CIPHER
sPymbed	17:ff9d1e86ad5f	2384	#define WOLFSSL_DEF_PSK_CIPHER TLS_AES_128_GCM_SHA256
sPymbed	17:ff9d1e86ad5f	2385	#endif
sPymbed	17:ff9d1e86ad5f	2386
sPymbed	17:ff9d1e86ad5f	2387	WOLFSSL_LOCAL int TLSX_PskKeModes_Use(WOLFSSL* ssl, byte modes);
sPymbed	17:ff9d1e86ad5f	2388
sPymbed	17:ff9d1e86ad5f	2389	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	2390	WOLFSSL_LOCAL int TLSX_EarlyData_Use(WOLFSSL* ssl, word32 max);
sPymbed	17:ff9d1e86ad5f	2391	#endif
sPymbed	17:ff9d1e86ad5f	2392	#endif /* HAVE_SESSION_TICKET \|\| !NO_PSK */
sPymbed	17:ff9d1e86ad5f	2393
sPymbed	17:ff9d1e86ad5f	2394
sPymbed	17:ff9d1e86ad5f	2395	/* The types of keys to derive for. */
sPymbed	17:ff9d1e86ad5f	2396	enum DeriveKeyType {
sPymbed	17:ff9d1e86ad5f	2397	no_key,
sPymbed	17:ff9d1e86ad5f	2398	early_data_key,
sPymbed	17:ff9d1e86ad5f	2399	handshake_key,
sPymbed	17:ff9d1e86ad5f	2400	traffic_key,
sPymbed	17:ff9d1e86ad5f	2401	update_traffic_key
sPymbed	17:ff9d1e86ad5f	2402	};
sPymbed	17:ff9d1e86ad5f	2403
sPymbed	17:ff9d1e86ad5f	2404	/* The key update request values for KeyUpdate message. */
sPymbed	17:ff9d1e86ad5f	2405	enum KeyUpdateRequest {
sPymbed	17:ff9d1e86ad5f	2406	update_not_requested,
sPymbed	17:ff9d1e86ad5f	2407	update_requested
sPymbed	17:ff9d1e86ad5f	2408	};
sPymbed	17:ff9d1e86ad5f	2409	#endif /* WOLFSSL_TLS13 */
sPymbed	17:ff9d1e86ad5f	2410
sPymbed	17:ff9d1e86ad5f	2411
sPymbed	17:ff9d1e86ad5f	2412	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	2413	enum SetCBIO {
sPymbed	17:ff9d1e86ad5f	2414	WOLFSSL_CBIO_NONE = 0,
sPymbed	17:ff9d1e86ad5f	2415	WOLFSSL_CBIO_RECV = 0x1,
sPymbed	17:ff9d1e86ad5f	2416	WOLFSSL_CBIO_SEND = 0x2,
sPymbed	17:ff9d1e86ad5f	2417	};
sPymbed	17:ff9d1e86ad5f	2418	#endif
sPymbed	17:ff9d1e86ad5f	2419
sPymbed	17:ff9d1e86ad5f	2420	/* wolfSSL context type */
sPymbed	17:ff9d1e86ad5f	2421	struct WOLFSSL_CTX {
sPymbed	17:ff9d1e86ad5f	2422	WOLFSSL_METHOD* method;
sPymbed	17:ff9d1e86ad5f	2423	#ifdef SINGLE_THREADED
sPymbed	17:ff9d1e86ad5f	2424	WC_RNG* rng; /* to be shared with WOLFSSL w/o locking */
sPymbed	17:ff9d1e86ad5f	2425	#endif
sPymbed	17:ff9d1e86ad5f	2426	wolfSSL_Mutex countMutex; /* reference count mutex */
sPymbed	17:ff9d1e86ad5f	2427	int refCount; /* reference count */
sPymbed	17:ff9d1e86ad5f	2428	int err; /* error code in case of mutex not created */
sPymbed	17:ff9d1e86ad5f	2429	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	2430	buffer serverDH_P;
sPymbed	17:ff9d1e86ad5f	2431	buffer serverDH_G;
sPymbed	17:ff9d1e86ad5f	2432	#endif
sPymbed	17:ff9d1e86ad5f	2433	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	2434	DerBuffer* certificate;
sPymbed	17:ff9d1e86ad5f	2435	DerBuffer* certChain;
sPymbed	17:ff9d1e86ad5f	2436	/* chain after self, in DER, with leading size for each cert */
sPymbed	17:ff9d1e86ad5f	2437	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	2438	WOLF_STACK_OF(WOLFSSL_X509_NAME)* ca_names;
sPymbed	17:ff9d1e86ad5f	2439	#endif
sPymbed	17:ff9d1e86ad5f	2440	#if defined(OPENSSL_ALL) \|\| defined(OPENSSL_EXTRA) \|\| \
sPymbed	17:ff9d1e86ad5f	2441	defined(WOLFSSL_NGINX) \|\| defined (WOLFSSL_HAPROXY)
sPymbed	17:ff9d1e86ad5f	2442	WOLF_STACK_OF(WOLFSSL_X509)* x509Chain;
sPymbed	17:ff9d1e86ad5f	2443	#endif
sPymbed	17:ff9d1e86ad5f	2444	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2445	int certChainCnt;
sPymbed	17:ff9d1e86ad5f	2446	#endif
sPymbed	17:ff9d1e86ad5f	2447	DerBuffer* privateKey;
sPymbed	17:ff9d1e86ad5f	2448	byte privateKeyType;
sPymbed	17:ff9d1e86ad5f	2449	int privateKeySz;
sPymbed	17:ff9d1e86ad5f	2450	WOLFSSL_CERT_MANAGER* cm; /* our cert manager, ctx owns SSL will use */
sPymbed	17:ff9d1e86ad5f	2451	#endif
sPymbed	17:ff9d1e86ad5f	2452	#ifdef KEEP_OUR_CERT
sPymbed	17:ff9d1e86ad5f	2453	WOLFSSL_X509* ourCert; /* keep alive a X509 struct of cert */
sPymbed	17:ff9d1e86ad5f	2454	int ownOurCert; /* Dispose of certificate if we own */
sPymbed	17:ff9d1e86ad5f	2455	#endif
sPymbed	17:ff9d1e86ad5f	2456	Suites* suites; /* make dynamic, user may not need/set */
sPymbed	17:ff9d1e86ad5f	2457	void* heap; /* for user memory overrides */
sPymbed	17:ff9d1e86ad5f	2458	byte verifyDepth;
sPymbed	17:ff9d1e86ad5f	2459	byte verifyPeer:1;
sPymbed	17:ff9d1e86ad5f	2460	byte verifyNone:1;
sPymbed	17:ff9d1e86ad5f	2461	byte failNoCert:1;
sPymbed	17:ff9d1e86ad5f	2462	byte failNoCertxPSK:1; /* fail if no cert with the exception of PSK*/
sPymbed	17:ff9d1e86ad5f	2463	byte sessionCacheOff:1;
sPymbed	17:ff9d1e86ad5f	2464	byte sessionCacheFlushOff:1;
sPymbed	17:ff9d1e86ad5f	2465	#ifdef HAVE_EXT_CACHE
sPymbed	17:ff9d1e86ad5f	2466	byte internalCacheOff:1;
sPymbed	17:ff9d1e86ad5f	2467	#endif
sPymbed	17:ff9d1e86ad5f	2468	byte sendVerify; /* for client side (can not be single bit) */
sPymbed	17:ff9d1e86ad5f	2469	byte haveRSA:1; /* RSA available */
sPymbed	17:ff9d1e86ad5f	2470	byte haveECC:1; /* ECC available */
sPymbed	17:ff9d1e86ad5f	2471	byte haveDH:1; /* server DH parms set by user */
sPymbed	17:ff9d1e86ad5f	2472	byte haveNTRU:1; /* server private NTRU key loaded */
sPymbed	17:ff9d1e86ad5f	2473	byte haveECDSAsig:1; /* server cert signed w/ ECDSA */
sPymbed	17:ff9d1e86ad5f	2474	byte haveStaticECC:1; /* static server ECC private key */
sPymbed	17:ff9d1e86ad5f	2475	byte partialWrite:1; /* only one msg per write call */
sPymbed	17:ff9d1e86ad5f	2476	byte quietShutdown:1; /* don't send close notify */
sPymbed	17:ff9d1e86ad5f	2477	byte groupMessages:1; /* group handshake messages before sending */
sPymbed	17:ff9d1e86ad5f	2478	byte minDowngrade; /* minimum downgrade version */
sPymbed	17:ff9d1e86ad5f	2479	byte haveEMS:1; /* have extended master secret extension */
sPymbed	17:ff9d1e86ad5f	2480	byte useClientOrder:1; /* Use client's cipher preference order */
sPymbed	17:ff9d1e86ad5f	2481	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2482	byte noTicketTls13:1; /* Server won't create new Ticket */
sPymbed	17:ff9d1e86ad5f	2483	byte noPskDheKe:1; /* Don't use (EC)DHE with PSK */
sPymbed	17:ff9d1e86ad5f	2484	#endif
sPymbed	17:ff9d1e86ad5f	2485	#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
sPymbed	17:ff9d1e86ad5f	2486	byte postHandshakeAuth:1; /* Post-handshake auth supported. */
sPymbed	17:ff9d1e86ad5f	2487	#endif
sPymbed	17:ff9d1e86ad5f	2488	#ifdef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	2489	byte haveMcast; /* multicast requested */
sPymbed	17:ff9d1e86ad5f	2490	byte mcastID; /* multicast group ID */
sPymbed	17:ff9d1e86ad5f	2491	#endif
sPymbed	17:ff9d1e86ad5f	2492	#if defined(WOLFSSL_SCTP) && defined(WOLFSSL_DTLS)
sPymbed	17:ff9d1e86ad5f	2493	byte dtlsSctp; /* DTLS-over-SCTP mode */
sPymbed	17:ff9d1e86ad5f	2494	word16 dtlsMtuSz; /* DTLS MTU size */
sPymbed	17:ff9d1e86ad5f	2495	#endif
sPymbed	17:ff9d1e86ad5f	2496	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	2497	word16 minDhKeySz; /* minimum DH key size */
sPymbed	17:ff9d1e86ad5f	2498	word16 maxDhKeySz; /* maximum DH key size */
sPymbed	17:ff9d1e86ad5f	2499	#endif
sPymbed	17:ff9d1e86ad5f	2500	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	2501	short minRsaKeySz; /* minimum RSA key size */
sPymbed	17:ff9d1e86ad5f	2502	#endif
sPymbed	17:ff9d1e86ad5f	2503	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	2504	short minEccKeySz; /* minimum ECC key size */
sPymbed	17:ff9d1e86ad5f	2505	#endif
sPymbed	17:ff9d1e86ad5f	2506	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	2507	byte sessionCtx[ID_LEN]; /* app session context ID */
sPymbed	17:ff9d1e86ad5f	2508	word32 disabledCurves; /* curves disabled by user */
sPymbed	17:ff9d1e86ad5f	2509	unsigned long mask; /* store SSL_OP_ flags */
sPymbed	17:ff9d1e86ad5f	2510	const unsigned char alpn_cli_protos;/ ALPN client protocol list */
sPymbed	17:ff9d1e86ad5f	2511	unsigned int alpn_cli_protos_len;
sPymbed	17:ff9d1e86ad5f	2512	byte sessionCtxSz;
sPymbed	17:ff9d1e86ad5f	2513	byte cbioFlag; /* WOLFSSL_CBIO_RECV/SEND: CBIORecv/Send is set */
sPymbed	17:ff9d1e86ad5f	2514	CallbackInfoState* CBIS; /* used to get info about SSL state */
sPymbed	17:ff9d1e86ad5f	2515	#endif
sPymbed	17:ff9d1e86ad5f	2516	CallbackIORecv CBIORecv;
sPymbed	17:ff9d1e86ad5f	2517	CallbackIOSend CBIOSend;
sPymbed	17:ff9d1e86ad5f	2518	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	2519	CallbackGenCookie CBIOCookie; /* gen cookie callback */
sPymbed	17:ff9d1e86ad5f	2520	#ifdef WOLFSSL_SESSION_EXPORT
sPymbed	17:ff9d1e86ad5f	2521	wc_dtls_export dtls_export; /* export function for DTLS session */
sPymbed	17:ff9d1e86ad5f	2522	CallbackGetPeer CBGetPeer;
sPymbed	17:ff9d1e86ad5f	2523	CallbackSetPeer CBSetPeer;
sPymbed	17:ff9d1e86ad5f	2524	#endif
sPymbed	17:ff9d1e86ad5f	2525	#endif /* WOLFSSL_DTLS */
sPymbed	17:ff9d1e86ad5f	2526	VerifyCallback verifyCallback; /* cert verification callback */
sPymbed	17:ff9d1e86ad5f	2527	word32 timeout; /* session timeout */
sPymbed	17:ff9d1e86ad5f	2528	#if defined(HAVE_ECC) \|\| defined(HAVE_CURVE25519)
sPymbed	17:ff9d1e86ad5f	2529	word32 ecdhCurveOID; /* curve Ecc_Sum */
sPymbed	17:ff9d1e86ad5f	2530	#endif
sPymbed	17:ff9d1e86ad5f	2531	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	2532	word16 eccTempKeySz; /* in octets 20 - 66 */
sPymbed	17:ff9d1e86ad5f	2533	#endif
sPymbed	17:ff9d1e86ad5f	2534	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	2535	word32 pkCurveOID; /* curve Ecc_Sum */
sPymbed	17:ff9d1e86ad5f	2536	#endif
sPymbed	17:ff9d1e86ad5f	2537	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	2538	byte havePSK; /* psk key set by user */
sPymbed	17:ff9d1e86ad5f	2539	wc_psk_client_callback client_psk_cb; /* client callback */
sPymbed	17:ff9d1e86ad5f	2540	wc_psk_server_callback server_psk_cb; /* server callback */
sPymbed	17:ff9d1e86ad5f	2541	char server_hint[MAX_PSK_ID_LEN + NULL_TERM_LEN];
sPymbed	17:ff9d1e86ad5f	2542	#endif /* HAVE_SESSION_TICKET \|\| !NO_PSK */
sPymbed	17:ff9d1e86ad5f	2543	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2544	word16 group[WOLFSSL_MAX_GROUP_COUNT];
sPymbed	17:ff9d1e86ad5f	2545	byte numGroups;
sPymbed	17:ff9d1e86ad5f	2546	#endif
sPymbed	17:ff9d1e86ad5f	2547	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	2548	word32 maxEarlyDataSz;
sPymbed	17:ff9d1e86ad5f	2549	#endif
sPymbed	17:ff9d1e86ad5f	2550	#ifdef HAVE_ANON
sPymbed	17:ff9d1e86ad5f	2551	byte haveAnon; /* User wants to allow Anon suites */
sPymbed	17:ff9d1e86ad5f	2552	#endif /* HAVE_ANON */
sPymbed	17:ff9d1e86ad5f	2553	#ifdef WOLFSSL_ENCRYPTED_KEYS
sPymbed	17:ff9d1e86ad5f	2554	pem_password_cb* passwd_cb;
sPymbed	17:ff9d1e86ad5f	2555	void* passwd_userdata;
sPymbed	17:ff9d1e86ad5f	2556	#endif
sPymbed	17:ff9d1e86ad5f	2557	#if defined(OPENSSL_EXTRA) \|\| defined(HAVE_WEBSERVER)
sPymbed	17:ff9d1e86ad5f	2558	WOLFSSL_X509_STORE x509_store; /* points to ctx->cm */
sPymbed	17:ff9d1e86ad5f	2559	WOLFSSL_X509_STORE* x509_store_pt; /* take ownership of external store */
sPymbed	17:ff9d1e86ad5f	2560	byte readAhead;
sPymbed	17:ff9d1e86ad5f	2561	void* userPRFArg; /* passed to prf callback */
sPymbed	17:ff9d1e86ad5f	2562	#endif
sPymbed	17:ff9d1e86ad5f	2563	#ifdef HAVE_EX_DATA
sPymbed	17:ff9d1e86ad5f	2564	void* ex_data[MAX_EX_DATA];
sPymbed	17:ff9d1e86ad5f	2565	#endif
sPymbed	17:ff9d1e86ad5f	2566	#if defined(HAVE_ALPN) && (defined(OPENSSL_ALL) \|\| defined(WOLFSSL_NGINX) \|\| defined(WOLFSSL_HAPROXY))
sPymbed	17:ff9d1e86ad5f	2567	CallbackALPNSelect alpnSelect;
sPymbed	17:ff9d1e86ad5f	2568	void* alpnSelectArg;
sPymbed	17:ff9d1e86ad5f	2569	#endif
sPymbed	17:ff9d1e86ad5f	2570	#if defined(OPENSSL_ALL) \|\| (defined(OPENSSL_EXTRA) && (defined(HAVE_STUNNEL) \|\| defined(WOLFSSL_NGINX) \|\| defined(HAVE_LIGHTY)))
sPymbed	17:ff9d1e86ad5f	2571	CallbackSniRecv sniRecvCb;
sPymbed	17:ff9d1e86ad5f	2572	void* sniRecvCbArg;
sPymbed	17:ff9d1e86ad5f	2573	#endif
sPymbed	17:ff9d1e86ad5f	2574	#if defined(WOLFSSL_MULTICAST) && defined(WOLFSSL_DTLS)
sPymbed	17:ff9d1e86ad5f	2575	CallbackMcastHighwater mcastHwCb; /* Sequence number highwater callback */
sPymbed	17:ff9d1e86ad5f	2576	word32 mcastFirstSeq; /* first trigger level */
sPymbed	17:ff9d1e86ad5f	2577	word32 mcastSecondSeq; /* second tigger level */
sPymbed	17:ff9d1e86ad5f	2578	word32 mcastMaxSeq; /* max level */
sPymbed	17:ff9d1e86ad5f	2579	#endif
sPymbed	17:ff9d1e86ad5f	2580	#ifdef HAVE_OCSP
sPymbed	17:ff9d1e86ad5f	2581	WOLFSSL_OCSP ocsp;
sPymbed	17:ff9d1e86ad5f	2582	#endif
sPymbed	17:ff9d1e86ad5f	2583	int devId; /* async device id to use */
sPymbed	17:ff9d1e86ad5f	2584	#ifdef HAVE_TLS_EXTENSIONS
sPymbed	17:ff9d1e86ad5f	2585	TLSX* extensions; /* RFC 6066 TLS Extensions data */
sPymbed	17:ff9d1e86ad5f	2586	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	2587	#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
sPymbed	17:ff9d1e86ad5f	2588	\|\| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
sPymbed	17:ff9d1e86ad5f	2589	OcspRequest* certOcspRequest;
sPymbed	17:ff9d1e86ad5f	2590	#endif
sPymbed	17:ff9d1e86ad5f	2591	#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
sPymbed	17:ff9d1e86ad5f	2592	OcspRequest* chainOcspRequest[MAX_CHAIN_DEPTH];
sPymbed	17:ff9d1e86ad5f	2593	#endif
sPymbed	17:ff9d1e86ad5f	2594	#endif
sPymbed	17:ff9d1e86ad5f	2595	#if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER)
sPymbed	17:ff9d1e86ad5f	2596	SessionTicketEncCb ticketEncCb; /* enc/dec session ticket Cb */
sPymbed	17:ff9d1e86ad5f	2597	void* ticketEncCtx; /* session encrypt context */
sPymbed	17:ff9d1e86ad5f	2598	int ticketHint; /* ticket hint in seconds */
sPymbed	17:ff9d1e86ad5f	2599	#endif
sPymbed	17:ff9d1e86ad5f	2600	#ifdef HAVE_SUPPORTED_CURVES
sPymbed	17:ff9d1e86ad5f	2601	byte userCurves; /* indicates user called wolfSSL_CTX_UseSupportedCurve */
sPymbed	17:ff9d1e86ad5f	2602	#endif
sPymbed	17:ff9d1e86ad5f	2603	#endif
sPymbed	17:ff9d1e86ad5f	2604	#ifdef ATOMIC_USER
sPymbed	17:ff9d1e86ad5f	2605	CallbackMacEncrypt MacEncryptCb; /* Atomic User Mac/Encrypt Cb */
sPymbed	17:ff9d1e86ad5f	2606	CallbackDecryptVerify DecryptVerifyCb; /* Atomic User Decrypt/Verify Cb */
sPymbed	17:ff9d1e86ad5f	2607	#endif
sPymbed	17:ff9d1e86ad5f	2608	#ifdef HAVE_PK_CALLBACKS
sPymbed	17:ff9d1e86ad5f	2609	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	2610	CallbackEccKeyGen EccKeyGenCb; /* User EccKeyGen Callback Handler */
sPymbed	17:ff9d1e86ad5f	2611	CallbackEccSign EccSignCb; /* User EccSign Callback handler */
sPymbed	17:ff9d1e86ad5f	2612	CallbackEccVerify EccVerifyCb; /* User EccVerify Callback handler */
sPymbed	17:ff9d1e86ad5f	2613	CallbackEccSharedSecret EccSharedSecretCb; /* User EccVerify Callback handler */
sPymbed	17:ff9d1e86ad5f	2614	#ifdef HAVE_ED25519
sPymbed	17:ff9d1e86ad5f	2615	/* User Ed25519Sign Callback handler */
sPymbed	17:ff9d1e86ad5f	2616	CallbackEd25519Sign Ed25519SignCb;
sPymbed	17:ff9d1e86ad5f	2617	/* User Ed25519Verify Callback handler */
sPymbed	17:ff9d1e86ad5f	2618	CallbackEd25519Verify Ed25519VerifyCb;
sPymbed	17:ff9d1e86ad5f	2619	#endif
sPymbed	17:ff9d1e86ad5f	2620	#ifdef HAVE_CURVE25519
sPymbed	17:ff9d1e86ad5f	2621	/* User X25519 KeyGen Callback Handler */
sPymbed	17:ff9d1e86ad5f	2622	CallbackX25519KeyGen X25519KeyGenCb;
sPymbed	17:ff9d1e86ad5f	2623	/* User X25519 SharedSecret Callback handler */
sPymbed	17:ff9d1e86ad5f	2624	CallbackX25519SharedSecret X25519SharedSecretCb;
sPymbed	17:ff9d1e86ad5f	2625	#endif
sPymbed	17:ff9d1e86ad5f	2626	#endif /* HAVE_ECC */
sPymbed	17:ff9d1e86ad5f	2627	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	2628	CallbackDhAgree DhAgreeCb; /* User DH Agree Callback handler */
sPymbed	17:ff9d1e86ad5f	2629	#endif
sPymbed	17:ff9d1e86ad5f	2630	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	2631	CallbackRsaSign RsaSignCb; /* User RsaSign Callback handler (priv key) */
sPymbed	17:ff9d1e86ad5f	2632	CallbackRsaVerify RsaVerifyCb; /* User RsaVerify Callback handler (pub key) */
sPymbed	17:ff9d1e86ad5f	2633	CallbackRsaVerify RsaSignCheckCb; /* User VerifyRsaSign Callback handler (priv key) */
sPymbed	17:ff9d1e86ad5f	2634	#ifdef WC_RSA_PSS
sPymbed	17:ff9d1e86ad5f	2635	CallbackRsaPssSign RsaPssSignCb; /* User RsaSign (priv key) */
sPymbed	17:ff9d1e86ad5f	2636	CallbackRsaPssVerify RsaPssVerifyCb; /* User RsaVerify (pub key) */
sPymbed	17:ff9d1e86ad5f	2637	CallbackRsaPssVerify RsaPssSignCheckCb; /* User VerifyRsaSign (priv key) */
sPymbed	17:ff9d1e86ad5f	2638	#endif
sPymbed	17:ff9d1e86ad5f	2639	CallbackRsaEnc RsaEncCb; /* User Rsa Public Encrypt handler */
sPymbed	17:ff9d1e86ad5f	2640	CallbackRsaDec RsaDecCb; /* User Rsa Private Decrypt handler */
sPymbed	17:ff9d1e86ad5f	2641	#endif /* NO_RSA */
sPymbed	17:ff9d1e86ad5f	2642	#endif /* HAVE_PK_CALLBACKS */
sPymbed	17:ff9d1e86ad5f	2643	#ifdef HAVE_WOLF_EVENT
sPymbed	17:ff9d1e86ad5f	2644	WOLF_EVENT_QUEUE event_queue;
sPymbed	17:ff9d1e86ad5f	2645	#endif /* HAVE_WOLF_EVENT */
sPymbed	17:ff9d1e86ad5f	2646	#ifdef HAVE_EXT_CACHE
sPymbed	17:ff9d1e86ad5f	2647	WOLFSSL_SESSION(get_sess_cb)(WOLFSSL, unsigned char, int, int*);
sPymbed	17:ff9d1e86ad5f	2648	int (new_sess_cb)(WOLFSSL, WOLFSSL_SESSION*);
sPymbed	17:ff9d1e86ad5f	2649	void (rem_sess_cb)(WOLFSSL_CTX, WOLFSSL_SESSION*);
sPymbed	17:ff9d1e86ad5f	2650	#endif
sPymbed	17:ff9d1e86ad5f	2651	#if defined(OPENSSL_EXTRA) && defined(WOLFCRYPT_HAVE_SRP) && !defined(NO_SHA256)
sPymbed	17:ff9d1e86ad5f	2652	Srp* srp; /* TLS Secure Remote Password Protocol*/
sPymbed	17:ff9d1e86ad5f	2653	byte* srp_password;
sPymbed	17:ff9d1e86ad5f	2654	#endif
sPymbed	17:ff9d1e86ad5f	2655	};
sPymbed	17:ff9d1e86ad5f	2656
sPymbed	17:ff9d1e86ad5f	2657	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2658	WOLFSSL_CTX* wolfSSL_CTX_new_ex(WOLFSSL_METHOD* method, void* heap);
sPymbed	17:ff9d1e86ad5f	2659	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2660	int InitSSL_Ctx(WOLFSSL_CTX, WOLFSSL_METHOD, void* heap);
sPymbed	17:ff9d1e86ad5f	2661	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2662	void FreeSSL_Ctx(WOLFSSL_CTX*);
sPymbed	17:ff9d1e86ad5f	2663	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2664	void SSL_CtxResourceFree(WOLFSSL_CTX*);
sPymbed	17:ff9d1e86ad5f	2665
sPymbed	17:ff9d1e86ad5f	2666	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2667	int DeriveTlsKeys(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2668	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2669	int ProcessOldClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
sPymbed	17:ff9d1e86ad5f	2670	word32 inSz, word16 sz);
sPymbed	17:ff9d1e86ad5f	2671
sPymbed	17:ff9d1e86ad5f	2672	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	2673	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2674	int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify);
sPymbed	17:ff9d1e86ad5f	2675	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2676	int AlreadySigner(WOLFSSL_CERT_MANAGER* cm, byte* hash);
sPymbed	17:ff9d1e86ad5f	2677	#ifdef WOLFSSL_TRUST_PEER_CERT
sPymbed	17:ff9d1e86ad5f	2678	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2679	int AddTrustedPeer(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int verify);
sPymbed	17:ff9d1e86ad5f	2680	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2681	int AlreadyTrustedPeer(WOLFSSL_CERT_MANAGER* cm, byte* hash);
sPymbed	17:ff9d1e86ad5f	2682	#endif
sPymbed	17:ff9d1e86ad5f	2683	#endif
sPymbed	17:ff9d1e86ad5f	2684
sPymbed	17:ff9d1e86ad5f	2685	/* All cipher suite related info
sPymbed	17:ff9d1e86ad5f	2686	* Keep as a constant size (no ifdefs) for session export */
sPymbed	17:ff9d1e86ad5f	2687	typedef struct CipherSpecs {
sPymbed	17:ff9d1e86ad5f	2688	word16 key_size;
sPymbed	17:ff9d1e86ad5f	2689	word16 iv_size;
sPymbed	17:ff9d1e86ad5f	2690	word16 block_size;
sPymbed	17:ff9d1e86ad5f	2691	word16 aead_mac_size;
sPymbed	17:ff9d1e86ad5f	2692	byte bulk_cipher_algorithm;
sPymbed	17:ff9d1e86ad5f	2693	byte cipher_type; /* block, stream, or aead */
sPymbed	17:ff9d1e86ad5f	2694	byte mac_algorithm;
sPymbed	17:ff9d1e86ad5f	2695	byte kea; /* key exchange algo */
sPymbed	17:ff9d1e86ad5f	2696	byte sig_algo;
sPymbed	17:ff9d1e86ad5f	2697	byte hash_size;
sPymbed	17:ff9d1e86ad5f	2698	byte pad_size;
sPymbed	17:ff9d1e86ad5f	2699	byte static_ecdh;
sPymbed	17:ff9d1e86ad5f	2700	} CipherSpecs;
sPymbed	17:ff9d1e86ad5f	2701
sPymbed	17:ff9d1e86ad5f	2702
sPymbed	17:ff9d1e86ad5f	2703	void InitCipherSpecs(CipherSpecs* cs);
sPymbed	17:ff9d1e86ad5f	2704
sPymbed	17:ff9d1e86ad5f	2705
sPymbed	17:ff9d1e86ad5f	2706	/* Supported Message Authentication Codes from page 43 */
sPymbed	17:ff9d1e86ad5f	2707	enum MACAlgorithm {
sPymbed	17:ff9d1e86ad5f	2708	no_mac,
sPymbed	17:ff9d1e86ad5f	2709	md5_mac,
sPymbed	17:ff9d1e86ad5f	2710	sha_mac,
sPymbed	17:ff9d1e86ad5f	2711	sha224_mac,
sPymbed	17:ff9d1e86ad5f	2712	sha256_mac, /* needs to match external KDF_MacAlgorithm */
sPymbed	17:ff9d1e86ad5f	2713	sha384_mac,
sPymbed	17:ff9d1e86ad5f	2714	sha512_mac,
sPymbed	17:ff9d1e86ad5f	2715	rmd_mac,
sPymbed	17:ff9d1e86ad5f	2716	blake2b_mac
sPymbed	17:ff9d1e86ad5f	2717	};
sPymbed	17:ff9d1e86ad5f	2718
sPymbed	17:ff9d1e86ad5f	2719
sPymbed	17:ff9d1e86ad5f	2720	/* Supported Key Exchange Protocols */
sPymbed	17:ff9d1e86ad5f	2721	enum KeyExchangeAlgorithm {
sPymbed	17:ff9d1e86ad5f	2722	no_kea,
sPymbed	17:ff9d1e86ad5f	2723	rsa_kea,
sPymbed	17:ff9d1e86ad5f	2724	diffie_hellman_kea,
sPymbed	17:ff9d1e86ad5f	2725	fortezza_kea,
sPymbed	17:ff9d1e86ad5f	2726	psk_kea,
sPymbed	17:ff9d1e86ad5f	2727	dhe_psk_kea,
sPymbed	17:ff9d1e86ad5f	2728	ecdhe_psk_kea,
sPymbed	17:ff9d1e86ad5f	2729	ntru_kea,
sPymbed	17:ff9d1e86ad5f	2730	ecc_diffie_hellman_kea,
sPymbed	17:ff9d1e86ad5f	2731	ecc_static_diffie_hellman_kea /* for verify suite only */
sPymbed	17:ff9d1e86ad5f	2732	};
sPymbed	17:ff9d1e86ad5f	2733
sPymbed	17:ff9d1e86ad5f	2734
sPymbed	17:ff9d1e86ad5f	2735	/* Supported Authentication Schemes */
sPymbed	17:ff9d1e86ad5f	2736	enum SignatureAlgorithm {
sPymbed	17:ff9d1e86ad5f	2737	anonymous_sa_algo = 0,
sPymbed	17:ff9d1e86ad5f	2738	rsa_sa_algo = 1,
sPymbed	17:ff9d1e86ad5f	2739	dsa_sa_algo = 2,
sPymbed	17:ff9d1e86ad5f	2740	ecc_dsa_sa_algo = 3,
sPymbed	17:ff9d1e86ad5f	2741	rsa_pss_sa_algo = 8,
sPymbed	17:ff9d1e86ad5f	2742	ed25519_sa_algo = 9
sPymbed	17:ff9d1e86ad5f	2743	};
sPymbed	17:ff9d1e86ad5f	2744
sPymbed	17:ff9d1e86ad5f	2745
sPymbed	17:ff9d1e86ad5f	2746	/* Supprted ECC Curve Types */
sPymbed	17:ff9d1e86ad5f	2747	enum EccCurves {
sPymbed	17:ff9d1e86ad5f	2748	named_curve = 3
sPymbed	17:ff9d1e86ad5f	2749	};
sPymbed	17:ff9d1e86ad5f	2750
sPymbed	17:ff9d1e86ad5f	2751
sPymbed	17:ff9d1e86ad5f	2752	/* Valid client certificate request types from page 27 */
sPymbed	17:ff9d1e86ad5f	2753	enum ClientCertificateType {
sPymbed	17:ff9d1e86ad5f	2754	rsa_sign = 1,
sPymbed	17:ff9d1e86ad5f	2755	dss_sign = 2,
sPymbed	17:ff9d1e86ad5f	2756	rsa_fixed_dh = 3,
sPymbed	17:ff9d1e86ad5f	2757	dss_fixed_dh = 4,
sPymbed	17:ff9d1e86ad5f	2758	rsa_ephemeral_dh = 5,
sPymbed	17:ff9d1e86ad5f	2759	dss_ephemeral_dh = 6,
sPymbed	17:ff9d1e86ad5f	2760	fortezza_kea_cert = 20,
sPymbed	17:ff9d1e86ad5f	2761	ecdsa_sign = 64,
sPymbed	17:ff9d1e86ad5f	2762	rsa_fixed_ecdh = 65,
sPymbed	17:ff9d1e86ad5f	2763	ecdsa_fixed_ecdh = 66
sPymbed	17:ff9d1e86ad5f	2764	};
sPymbed	17:ff9d1e86ad5f	2765
sPymbed	17:ff9d1e86ad5f	2766
sPymbed	17:ff9d1e86ad5f	2767	enum CipherType { stream, block, aead };
sPymbed	17:ff9d1e86ad5f	2768
sPymbed	17:ff9d1e86ad5f	2769
sPymbed	17:ff9d1e86ad5f	2770
sPymbed	17:ff9d1e86ad5f	2771
sPymbed	17:ff9d1e86ad5f	2772
sPymbed	17:ff9d1e86ad5f	2773
sPymbed	17:ff9d1e86ad5f	2774	/* cipher for now */
sPymbed	17:ff9d1e86ad5f	2775	typedef struct Ciphers {
sPymbed	17:ff9d1e86ad5f	2776	#ifdef BUILD_ARC4
sPymbed	17:ff9d1e86ad5f	2777	Arc4* arc4;
sPymbed	17:ff9d1e86ad5f	2778	#endif
sPymbed	17:ff9d1e86ad5f	2779	#ifdef BUILD_DES3
sPymbed	17:ff9d1e86ad5f	2780	Des3* des3;
sPymbed	17:ff9d1e86ad5f	2781	#endif
sPymbed	17:ff9d1e86ad5f	2782	#if defined(BUILD_AES) \|\| defined(BUILD_AESGCM)
sPymbed	17:ff9d1e86ad5f	2783	Aes* aes;
sPymbed	17:ff9d1e86ad5f	2784	#if defined(BUILD_AESGCM) \|\| defined(HAVE_AESCCM) \|\| defined(WOLFSSL_TLS13)
sPymbed	17:ff9d1e86ad5f	2785	byte* additional;
sPymbed	17:ff9d1e86ad5f	2786	byte* nonce;
sPymbed	17:ff9d1e86ad5f	2787	#endif
sPymbed	17:ff9d1e86ad5f	2788	#endif
sPymbed	17:ff9d1e86ad5f	2789	#ifdef HAVE_CAMELLIA
sPymbed	17:ff9d1e86ad5f	2790	Camellia* cam;
sPymbed	17:ff9d1e86ad5f	2791	#endif
sPymbed	17:ff9d1e86ad5f	2792	#ifdef HAVE_CHACHA
sPymbed	17:ff9d1e86ad5f	2793	ChaCha* chacha;
sPymbed	17:ff9d1e86ad5f	2794	#endif
sPymbed	17:ff9d1e86ad5f	2795	#ifdef HAVE_HC128
sPymbed	17:ff9d1e86ad5f	2796	HC128* hc128;
sPymbed	17:ff9d1e86ad5f	2797	#endif
sPymbed	17:ff9d1e86ad5f	2798	#ifdef BUILD_RABBIT
sPymbed	17:ff9d1e86ad5f	2799	Rabbit* rabbit;
sPymbed	17:ff9d1e86ad5f	2800	#endif
sPymbed	17:ff9d1e86ad5f	2801	#ifdef HAVE_IDEA
sPymbed	17:ff9d1e86ad5f	2802	Idea* idea;
sPymbed	17:ff9d1e86ad5f	2803	#endif
sPymbed	17:ff9d1e86ad5f	2804	byte state;
sPymbed	17:ff9d1e86ad5f	2805	byte setup; /* have we set it up flag for detection */
sPymbed	17:ff9d1e86ad5f	2806	} Ciphers;
sPymbed	17:ff9d1e86ad5f	2807
sPymbed	17:ff9d1e86ad5f	2808
sPymbed	17:ff9d1e86ad5f	2809	#ifdef HAVE_ONE_TIME_AUTH
sPymbed	17:ff9d1e86ad5f	2810	/* Ciphers for one time authentication such as poly1305 */
sPymbed	17:ff9d1e86ad5f	2811	typedef struct OneTimeAuth {
sPymbed	17:ff9d1e86ad5f	2812	#ifdef HAVE_POLY1305
sPymbed	17:ff9d1e86ad5f	2813	Poly1305* poly1305;
sPymbed	17:ff9d1e86ad5f	2814	#endif
sPymbed	17:ff9d1e86ad5f	2815	byte setup; /* flag for if a cipher has been set */
sPymbed	17:ff9d1e86ad5f	2816
sPymbed	17:ff9d1e86ad5f	2817	} OneTimeAuth;
sPymbed	17:ff9d1e86ad5f	2818	#endif
sPymbed	17:ff9d1e86ad5f	2819
sPymbed	17:ff9d1e86ad5f	2820
sPymbed	17:ff9d1e86ad5f	2821	WOLFSSL_LOCAL void InitCiphers(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2822	WOLFSSL_LOCAL void FreeCiphers(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	2823
sPymbed	17:ff9d1e86ad5f	2824
sPymbed	17:ff9d1e86ad5f	2825	/* hashes type */
sPymbed	17:ff9d1e86ad5f	2826	typedef struct Hashes {
sPymbed	17:ff9d1e86ad5f	2827	#if !defined(NO_MD5) && !defined(NO_OLD_TLS)
sPymbed	17:ff9d1e86ad5f	2828	byte md5[WC_MD5_DIGEST_SIZE];
sPymbed	17:ff9d1e86ad5f	2829	#endif
sPymbed	17:ff9d1e86ad5f	2830	#if !defined(NO_SHA)
sPymbed	17:ff9d1e86ad5f	2831	byte sha[WC_SHA_DIGEST_SIZE];
sPymbed	17:ff9d1e86ad5f	2832	#endif
sPymbed	17:ff9d1e86ad5f	2833	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	2834	byte sha256[WC_SHA256_DIGEST_SIZE];
sPymbed	17:ff9d1e86ad5f	2835	#endif
sPymbed	17:ff9d1e86ad5f	2836	#ifdef WOLFSSL_SHA384
sPymbed	17:ff9d1e86ad5f	2837	byte sha384[WC_SHA384_DIGEST_SIZE];
sPymbed	17:ff9d1e86ad5f	2838	#endif
sPymbed	17:ff9d1e86ad5f	2839	#ifdef WOLFSSL_SHA512
sPymbed	17:ff9d1e86ad5f	2840	byte sha512[WC_SHA512_DIGEST_SIZE];
sPymbed	17:ff9d1e86ad5f	2841	#endif
sPymbed	17:ff9d1e86ad5f	2842	} Hashes;
sPymbed	17:ff9d1e86ad5f	2843
sPymbed	17:ff9d1e86ad5f	2844	WOLFSSL_LOCAL int BuildCertHashes(WOLFSSL* ssl, Hashes* hashes);
sPymbed	17:ff9d1e86ad5f	2845
sPymbed	17:ff9d1e86ad5f	2846	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2847	typedef union Digest {
sPymbed	17:ff9d1e86ad5f	2848	#ifndef NO_WOLFSSL_SHA256
sPymbed	17:ff9d1e86ad5f	2849	wc_Sha256 sha256;
sPymbed	17:ff9d1e86ad5f	2850	#endif
sPymbed	17:ff9d1e86ad5f	2851	#ifdef WOLFSSL_SHA384
sPymbed	17:ff9d1e86ad5f	2852	wc_Sha384 sha384;
sPymbed	17:ff9d1e86ad5f	2853	#endif
sPymbed	17:ff9d1e86ad5f	2854	#ifdef WOLFSSL_SHA512
sPymbed	17:ff9d1e86ad5f	2855	wc_Sha512 sha512;
sPymbed	17:ff9d1e86ad5f	2856	#endif
sPymbed	17:ff9d1e86ad5f	2857	} Digest;
sPymbed	17:ff9d1e86ad5f	2858	#endif
sPymbed	17:ff9d1e86ad5f	2859
sPymbed	17:ff9d1e86ad5f	2860	/* Static x509 buffer */
sPymbed	17:ff9d1e86ad5f	2861	typedef struct x509_buffer {
sPymbed	17:ff9d1e86ad5f	2862	int length; /* actual size */
sPymbed	17:ff9d1e86ad5f	2863	byte buffer[MAX_X509_SIZE]; /* max static cert size */
sPymbed	17:ff9d1e86ad5f	2864	} x509_buffer;
sPymbed	17:ff9d1e86ad5f	2865
sPymbed	17:ff9d1e86ad5f	2866
sPymbed	17:ff9d1e86ad5f	2867	/* wolfSSL X509_CHAIN, for no dynamic memory SESSION_CACHE */
sPymbed	17:ff9d1e86ad5f	2868	struct WOLFSSL_X509_CHAIN {
sPymbed	17:ff9d1e86ad5f	2869	int count; /* total number in chain */
sPymbed	17:ff9d1e86ad5f	2870	x509_buffer certs[MAX_CHAIN_DEPTH]; /* only allow max depth 4 for now */
sPymbed	17:ff9d1e86ad5f	2871	};
sPymbed	17:ff9d1e86ad5f	2872
sPymbed	17:ff9d1e86ad5f	2873
sPymbed	17:ff9d1e86ad5f	2874	/* wolfSSL session type */
sPymbed	17:ff9d1e86ad5f	2875	struct WOLFSSL_SESSION {
sPymbed	17:ff9d1e86ad5f	2876	word32 bornOn; /* create time in seconds */
sPymbed	17:ff9d1e86ad5f	2877	word32 timeout; /* timeout in seconds */
sPymbed	17:ff9d1e86ad5f	2878	byte sessionID[ID_LEN]; /* id for protocol */
sPymbed	17:ff9d1e86ad5f	2879	byte sessionIDSz;
sPymbed	17:ff9d1e86ad5f	2880	byte masterSecret[SECRET_LEN]; /* stored secret */
sPymbed	17:ff9d1e86ad5f	2881	word16 haveEMS; /* ext master secret flag */
sPymbed	17:ff9d1e86ad5f	2882	#ifdef SESSION_CERTS
sPymbed	17:ff9d1e86ad5f	2883	WOLFSSL_X509_CHAIN chain; /* peer cert chain, static */
sPymbed	17:ff9d1e86ad5f	2884	#ifdef WOLFSSL_ALT_CERT_CHAINS
sPymbed	17:ff9d1e86ad5f	2885	WOLFSSL_X509_CHAIN altChain; /* peer alt cert chain, static */
sPymbed	17:ff9d1e86ad5f	2886	#endif
sPymbed	17:ff9d1e86ad5f	2887	#endif
sPymbed	17:ff9d1e86ad5f	2888	#if defined(SESSION_CERTS) \|\| (defined(WOLFSSL_TLS13) && \
sPymbed	17:ff9d1e86ad5f	2889	defined(HAVE_SESSION_TICKET))
sPymbed	17:ff9d1e86ad5f	2890	ProtocolVersion version; /* which version was used */
sPymbed	17:ff9d1e86ad5f	2891	byte cipherSuite0; /* first byte, normally 0 */
sPymbed	17:ff9d1e86ad5f	2892	byte cipherSuite; /* 2nd byte, actual suite */
sPymbed	17:ff9d1e86ad5f	2893	#endif
sPymbed	17:ff9d1e86ad5f	2894	#ifndef NO_CLIENT_CACHE
sPymbed	17:ff9d1e86ad5f	2895	word16 idLen; /* serverID length */
sPymbed	17:ff9d1e86ad5f	2896	byte serverID[SERVER_ID_LEN]; /* for easier client lookup */
sPymbed	17:ff9d1e86ad5f	2897	#endif
sPymbed	17:ff9d1e86ad5f	2898	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	2899	byte sessionCtxSz; /* sessionCtx length */
sPymbed	17:ff9d1e86ad5f	2900	byte sessionCtx[ID_LEN]; /* app specific context id */
sPymbed	17:ff9d1e86ad5f	2901	#endif
sPymbed	17:ff9d1e86ad5f	2902	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2903	word16 namedGroup;
sPymbed	17:ff9d1e86ad5f	2904	#endif
sPymbed	17:ff9d1e86ad5f	2905	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	2906	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	2907	word32 ticketSeen; /* Time ticket seen (ms) */
sPymbed	17:ff9d1e86ad5f	2908	word32 ticketAdd; /* Added by client */
sPymbed	17:ff9d1e86ad5f	2909	#ifndef WOLFSSL_TLS13_DRAFT_18
sPymbed	17:ff9d1e86ad5f	2910	TicketNonce ticketNonce; /* Nonce used to derive PSK */
sPymbed	17:ff9d1e86ad5f	2911	#endif
sPymbed	17:ff9d1e86ad5f	2912	#endif
sPymbed	17:ff9d1e86ad5f	2913	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	2914	word32 maxEarlyDataSz;
sPymbed	17:ff9d1e86ad5f	2915	#endif
sPymbed	17:ff9d1e86ad5f	2916	#endif
sPymbed	17:ff9d1e86ad5f	2917	#ifdef HAVE_SESSION_TICKET
sPymbed	17:ff9d1e86ad5f	2918	byte* ticket;
sPymbed	17:ff9d1e86ad5f	2919	word16 ticketLen;
sPymbed	17:ff9d1e86ad5f	2920	byte staticTicket[SESSION_TICKET_LEN];
sPymbed	17:ff9d1e86ad5f	2921	byte isDynamic;
sPymbed	17:ff9d1e86ad5f	2922	#endif
sPymbed	17:ff9d1e86ad5f	2923	#ifdef HAVE_EXT_CACHE
sPymbed	17:ff9d1e86ad5f	2924	byte isAlloced;
sPymbed	17:ff9d1e86ad5f	2925	#endif
sPymbed	17:ff9d1e86ad5f	2926	#ifdef HAVE_EX_DATA
sPymbed	17:ff9d1e86ad5f	2927	void* ex_data[MAX_EX_DATA];
sPymbed	17:ff9d1e86ad5f	2928	#endif
sPymbed	17:ff9d1e86ad5f	2929	};
sPymbed	17:ff9d1e86ad5f	2930
sPymbed	17:ff9d1e86ad5f	2931
sPymbed	17:ff9d1e86ad5f	2932	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2933	WOLFSSL_SESSION* GetSession(WOLFSSL, byte, byte);
sPymbed	17:ff9d1e86ad5f	2934	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	2935	int SetSession(WOLFSSL, WOLFSSL_SESSION);
sPymbed	17:ff9d1e86ad5f	2936
sPymbed	17:ff9d1e86ad5f	2937	typedef int (hmacfp) (WOLFSSL, byte, const byte, word32, int, int, int);
sPymbed	17:ff9d1e86ad5f	2938
sPymbed	17:ff9d1e86ad5f	2939	#ifndef NO_CLIENT_CACHE
sPymbed	17:ff9d1e86ad5f	2940	WOLFSSL_SESSION* GetSessionClient(WOLFSSL, const byte, int);
sPymbed	17:ff9d1e86ad5f	2941	#endif
sPymbed	17:ff9d1e86ad5f	2942
sPymbed	17:ff9d1e86ad5f	2943	/* client connect state for nonblocking restart */
sPymbed	17:ff9d1e86ad5f	2944	enum ConnectState {
sPymbed	17:ff9d1e86ad5f	2945	CONNECT_BEGIN = 0,
sPymbed	17:ff9d1e86ad5f	2946	CLIENT_HELLO_SENT,
sPymbed	17:ff9d1e86ad5f	2947	HELLO_AGAIN, /* HELLO_AGAIN s for DTLS case */
sPymbed	17:ff9d1e86ad5f	2948	HELLO_AGAIN_REPLY,
sPymbed	17:ff9d1e86ad5f	2949	FIRST_REPLY_DONE,
sPymbed	17:ff9d1e86ad5f	2950	FIRST_REPLY_FIRST,
sPymbed	17:ff9d1e86ad5f	2951	FIRST_REPLY_SECOND,
sPymbed	17:ff9d1e86ad5f	2952	FIRST_REPLY_THIRD,
sPymbed	17:ff9d1e86ad5f	2953	FIRST_REPLY_FOURTH,
sPymbed	17:ff9d1e86ad5f	2954	FINISHED_DONE,
sPymbed	17:ff9d1e86ad5f	2955	SECOND_REPLY_DONE
sPymbed	17:ff9d1e86ad5f	2956	};
sPymbed	17:ff9d1e86ad5f	2957
sPymbed	17:ff9d1e86ad5f	2958
sPymbed	17:ff9d1e86ad5f	2959	/* server accept state for nonblocking restart */
sPymbed	17:ff9d1e86ad5f	2960	enum AcceptState {
sPymbed	17:ff9d1e86ad5f	2961	ACCEPT_BEGIN = 0,
sPymbed	17:ff9d1e86ad5f	2962	ACCEPT_CLIENT_HELLO_DONE,
sPymbed	17:ff9d1e86ad5f	2963	ACCEPT_HELLO_RETRY_REQUEST_DONE,
sPymbed	17:ff9d1e86ad5f	2964	ACCEPT_FIRST_REPLY_DONE,
sPymbed	17:ff9d1e86ad5f	2965	SERVER_HELLO_SENT,
sPymbed	17:ff9d1e86ad5f	2966	SERVER_EXTENSIONS_SENT,
sPymbed	17:ff9d1e86ad5f	2967	CERT_SENT,
sPymbed	17:ff9d1e86ad5f	2968	CERT_VERIFY_SENT,
sPymbed	17:ff9d1e86ad5f	2969	CERT_STATUS_SENT,
sPymbed	17:ff9d1e86ad5f	2970	KEY_EXCHANGE_SENT,
sPymbed	17:ff9d1e86ad5f	2971	CERT_REQ_SENT,
sPymbed	17:ff9d1e86ad5f	2972	SERVER_HELLO_DONE,
sPymbed	17:ff9d1e86ad5f	2973	ACCEPT_SECOND_REPLY_DONE,
sPymbed	17:ff9d1e86ad5f	2974	TICKET_SENT,
sPymbed	17:ff9d1e86ad5f	2975	CHANGE_CIPHER_SENT,
sPymbed	17:ff9d1e86ad5f	2976	ACCEPT_FINISHED_DONE,
sPymbed	17:ff9d1e86ad5f	2977	ACCEPT_THIRD_REPLY_DONE
sPymbed	17:ff9d1e86ad5f	2978	};
sPymbed	17:ff9d1e86ad5f	2979
sPymbed	17:ff9d1e86ad5f	2980	/* TLS 1.3 server accept state for nonblocking restart */
sPymbed	17:ff9d1e86ad5f	2981	enum AcceptStateTls13 {
sPymbed	17:ff9d1e86ad5f	2982	TLS13_ACCEPT_BEGIN = 0,
sPymbed	17:ff9d1e86ad5f	2983	TLS13_ACCEPT_CLIENT_HELLO_DONE,
sPymbed	17:ff9d1e86ad5f	2984	TLS13_ACCEPT_HELLO_RETRY_REQUEST_DONE,
sPymbed	17:ff9d1e86ad5f	2985	TLS13_ACCEPT_FIRST_REPLY_DONE,
sPymbed	17:ff9d1e86ad5f	2986	TLS13_ACCEPT_SECOND_REPLY_DONE,
sPymbed	17:ff9d1e86ad5f	2987	TLS13_SERVER_HELLO_SENT,
sPymbed	17:ff9d1e86ad5f	2988	TLS13_ACCEPT_THIRD_REPLY_DONE,
sPymbed	17:ff9d1e86ad5f	2989	TLS13_SERVER_EXTENSIONS_SENT,
sPymbed	17:ff9d1e86ad5f	2990	TLS13_CERT_REQ_SENT,
sPymbed	17:ff9d1e86ad5f	2991	TLS13_CERT_SENT,
sPymbed	17:ff9d1e86ad5f	2992	TLS13_CERT_VERIFY_SENT,
sPymbed	17:ff9d1e86ad5f	2993	TLS13_ACCEPT_FINISHED_SENT,
sPymbed	17:ff9d1e86ad5f	2994	TLS13_PRE_TICKET_SENT,
sPymbed	17:ff9d1e86ad5f	2995	TLS13_ACCEPT_FINISHED_DONE,
sPymbed	17:ff9d1e86ad5f	2996	TLS13_TICKET_SENT
sPymbed	17:ff9d1e86ad5f	2997	};
sPymbed	17:ff9d1e86ad5f	2998
sPymbed	17:ff9d1e86ad5f	2999	/* buffers for struct WOLFSSL */
sPymbed	17:ff9d1e86ad5f	3000	typedef struct Buffers {
sPymbed	17:ff9d1e86ad5f	3001	bufferStatic inputBuffer;
sPymbed	17:ff9d1e86ad5f	3002	bufferStatic outputBuffer;
sPymbed	17:ff9d1e86ad5f	3003	buffer domainName; /* for client check */
sPymbed	17:ff9d1e86ad5f	3004	buffer clearOutputBuffer;
sPymbed	17:ff9d1e86ad5f	3005	buffer sig; /* signature data */
sPymbed	17:ff9d1e86ad5f	3006	buffer digest; /* digest data */
sPymbed	17:ff9d1e86ad5f	3007	int prevSent; /* previous plain text bytes sent
sPymbed	17:ff9d1e86ad5f	3008	when got WANT_WRITE */
sPymbed	17:ff9d1e86ad5f	3009	int plainSz; /* plain text bytes in buffer to send
sPymbed	17:ff9d1e86ad5f	3010	when got WANT_WRITE */
sPymbed	17:ff9d1e86ad5f	3011	byte weOwnCert; /* SSL own cert flag */
sPymbed	17:ff9d1e86ad5f	3012	byte weOwnCertChain; /* SSL own cert chain flag */
sPymbed	17:ff9d1e86ad5f	3013	byte weOwnKey; /* SSL own key flag */
sPymbed	17:ff9d1e86ad5f	3014	byte weOwnDH; /* SSL own dh (p,g) flag */
sPymbed	17:ff9d1e86ad5f	3015	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	3016	buffer serverDH_P; /* WOLFSSL_CTX owns, unless we own */
sPymbed	17:ff9d1e86ad5f	3017	buffer serverDH_G; /* WOLFSSL_CTX owns, unless we own */
sPymbed	17:ff9d1e86ad5f	3018	buffer serverDH_Pub;
sPymbed	17:ff9d1e86ad5f	3019	buffer serverDH_Priv;
sPymbed	17:ff9d1e86ad5f	3020	DhKey* serverDH_Key;
sPymbed	17:ff9d1e86ad5f	3021	#endif
sPymbed	17:ff9d1e86ad5f	3022	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	3023	DerBuffer* certificate; /* WOLFSSL_CTX owns, unless we own */
sPymbed	17:ff9d1e86ad5f	3024	DerBuffer* key; /* WOLFSSL_CTX owns, unless we own */
sPymbed	17:ff9d1e86ad5f	3025	byte keyType; /* Type of key: RSA, ECC, Ed25519 */
sPymbed	17:ff9d1e86ad5f	3026	int keySz; /* Size of RSA key */
sPymbed	17:ff9d1e86ad5f	3027	DerBuffer* certChain; /* WOLFSSL_CTX owns, unless we own */
sPymbed	17:ff9d1e86ad5f	3028	/* chain after self, in DER, with leading size for each cert */
sPymbed	17:ff9d1e86ad5f	3029	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3030	int certChainCnt;
sPymbed	17:ff9d1e86ad5f	3031	DerBuffer* certExts;
sPymbed	17:ff9d1e86ad5f	3032	#endif
sPymbed	17:ff9d1e86ad5f	3033	#endif
sPymbed	17:ff9d1e86ad5f	3034	#ifdef WOLFSSL_SEND_HRR_COOKIE
sPymbed	17:ff9d1e86ad5f	3035	buffer tls13CookieSecret; /* HRR cookie secret */
sPymbed	17:ff9d1e86ad5f	3036	#endif
sPymbed	17:ff9d1e86ad5f	3037	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	3038	WOLFSSL_DTLS_CTX dtlsCtx; /* DTLS connection context */
sPymbed	17:ff9d1e86ad5f	3039	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	3040	buffer dtlsCookieSecret; /* DTLS cookie secret */
sPymbed	17:ff9d1e86ad5f	3041	#endif /* NO_WOLFSSL_SERVER */
sPymbed	17:ff9d1e86ad5f	3042	#endif
sPymbed	17:ff9d1e86ad5f	3043	#ifdef HAVE_PK_CALLBACKS
sPymbed	17:ff9d1e86ad5f	3044	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	3045	buffer peerEccDsaKey; /* we own for Ecc Verify Callbacks */
sPymbed	17:ff9d1e86ad5f	3046	#endif /* HAVE_ECC */
sPymbed	17:ff9d1e86ad5f	3047	#ifdef HAVE_ED25519
sPymbed	17:ff9d1e86ad5f	3048	buffer peerEd25519Key; /* for Ed25519 Verify Callbacks */
sPymbed	17:ff9d1e86ad5f	3049	#endif /* HAVE_ED25519 */
sPymbed	17:ff9d1e86ad5f	3050	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	3051	buffer peerRsaKey; /* we own for Rsa Verify Callbacks */
sPymbed	17:ff9d1e86ad5f	3052	#endif /* NO_RSA */
sPymbed	17:ff9d1e86ad5f	3053	#endif /* HAVE_PK_CALLBACKS */
sPymbed	17:ff9d1e86ad5f	3054	} Buffers;
sPymbed	17:ff9d1e86ad5f	3055
sPymbed	17:ff9d1e86ad5f	3056	/* sub-states for send/do key share (key exchange) */
sPymbed	17:ff9d1e86ad5f	3057	enum asyncState {
sPymbed	17:ff9d1e86ad5f	3058	TLS_ASYNC_BEGIN = 0,
sPymbed	17:ff9d1e86ad5f	3059	TLS_ASYNC_BUILD,
sPymbed	17:ff9d1e86ad5f	3060	TLS_ASYNC_DO,
sPymbed	17:ff9d1e86ad5f	3061	TLS_ASYNC_VERIFY,
sPymbed	17:ff9d1e86ad5f	3062	TLS_ASYNC_FINALIZE,
sPymbed	17:ff9d1e86ad5f	3063	TLS_ASYNC_END
sPymbed	17:ff9d1e86ad5f	3064	};
sPymbed	17:ff9d1e86ad5f	3065
sPymbed	17:ff9d1e86ad5f	3066	/* sub-states for build message */
sPymbed	17:ff9d1e86ad5f	3067	enum buildMsgState {
sPymbed	17:ff9d1e86ad5f	3068	BUILD_MSG_BEGIN = 0,
sPymbed	17:ff9d1e86ad5f	3069	BUILD_MSG_SIZE,
sPymbed	17:ff9d1e86ad5f	3070	BUILD_MSG_HASH,
sPymbed	17:ff9d1e86ad5f	3071	BUILD_MSG_VERIFY_MAC,
sPymbed	17:ff9d1e86ad5f	3072	BUILD_MSG_ENCRYPT,
sPymbed	17:ff9d1e86ad5f	3073	};
sPymbed	17:ff9d1e86ad5f	3074
sPymbed	17:ff9d1e86ad5f	3075	/* sub-states for cipher operations */
sPymbed	17:ff9d1e86ad5f	3076	enum cipherState {
sPymbed	17:ff9d1e86ad5f	3077	CIPHER_STATE_BEGIN = 0,
sPymbed	17:ff9d1e86ad5f	3078	CIPHER_STATE_DO,
sPymbed	17:ff9d1e86ad5f	3079	CIPHER_STATE_END,
sPymbed	17:ff9d1e86ad5f	3080	};
sPymbed	17:ff9d1e86ad5f	3081
sPymbed	17:ff9d1e86ad5f	3082	typedef struct Options {
sPymbed	17:ff9d1e86ad5f	3083	#ifndef NO_PSK
sPymbed	17:ff9d1e86ad5f	3084	wc_psk_client_callback client_psk_cb;
sPymbed	17:ff9d1e86ad5f	3085	wc_psk_server_callback server_psk_cb;
sPymbed	17:ff9d1e86ad5f	3086	#endif /* NO_PSK */
sPymbed	17:ff9d1e86ad5f	3087	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3088	unsigned long mask; /* store SSL_OP_ flags */
sPymbed	17:ff9d1e86ad5f	3089	#endif
sPymbed	17:ff9d1e86ad5f	3090
sPymbed	17:ff9d1e86ad5f	3091	/* on/off or small bit flags, optimize layout */
sPymbed	17:ff9d1e86ad5f	3092	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	3093	word16 havePSK:1; /* psk key set by user */
sPymbed	17:ff9d1e86ad5f	3094	#endif /* HAVE_SESSION_TICKET \|\| !NO_PSK */
sPymbed	17:ff9d1e86ad5f	3095	word16 sendVerify:2; /* false = 0, true = 1, sendBlank = 2 */
sPymbed	17:ff9d1e86ad5f	3096	word16 sessionCacheOff:1;
sPymbed	17:ff9d1e86ad5f	3097	word16 sessionCacheFlushOff:1;
sPymbed	17:ff9d1e86ad5f	3098	#ifdef HAVE_EXT_CACHE
sPymbed	17:ff9d1e86ad5f	3099	word16 internalCacheOff:1;
sPymbed	17:ff9d1e86ad5f	3100	#endif
sPymbed	17:ff9d1e86ad5f	3101	word16 side:1; /* client or server end */
sPymbed	17:ff9d1e86ad5f	3102	word16 verifyPeer:1;
sPymbed	17:ff9d1e86ad5f	3103	word16 verifyNone:1;
sPymbed	17:ff9d1e86ad5f	3104	word16 failNoCert:1;
sPymbed	17:ff9d1e86ad5f	3105	word16 failNoCertxPSK:1; /* fail for no cert except with PSK */
sPymbed	17:ff9d1e86ad5f	3106	word16 downgrade:1; /* allow downgrade of versions */
sPymbed	17:ff9d1e86ad5f	3107	word16 resuming:1;
sPymbed	17:ff9d1e86ad5f	3108	word16 haveSessionId:1; /* server may not send */
sPymbed	17:ff9d1e86ad5f	3109	word16 tls:1; /* using TLS ? */
sPymbed	17:ff9d1e86ad5f	3110	word16 tls1_1:1; /* using TLSv1.1+ ? */
sPymbed	17:ff9d1e86ad5f	3111	word16 tls1_3:1; /* using TLSv1.3+ ? */
sPymbed	17:ff9d1e86ad5f	3112	word16 dtls:1; /* using datagrams ? */
sPymbed	17:ff9d1e86ad5f	3113	word16 connReset:1; /* has the peer reset */
sPymbed	17:ff9d1e86ad5f	3114	word16 isClosed:1; /* if we consider conn closed */
sPymbed	17:ff9d1e86ad5f	3115	word16 closeNotify:1; /* we've received a close notify */
sPymbed	17:ff9d1e86ad5f	3116	word16 sentNotify:1; /* we've sent a close notify */
sPymbed	17:ff9d1e86ad5f	3117	word16 usingCompression:1; /* are we using compression */
sPymbed	17:ff9d1e86ad5f	3118	word16 haveRSA:1; /* RSA available */
sPymbed	17:ff9d1e86ad5f	3119	word16 haveECC:1; /* ECC available */
sPymbed	17:ff9d1e86ad5f	3120	word16 haveDH:1; /* server DH parms set by user */
sPymbed	17:ff9d1e86ad5f	3121	word16 haveNTRU:1; /* server NTRU private key loaded */
sPymbed	17:ff9d1e86ad5f	3122	word16 haveQSH:1; /* have QSH ability */
sPymbed	17:ff9d1e86ad5f	3123	word16 haveECDSAsig:1; /* server ECDSA signed cert */
sPymbed	17:ff9d1e86ad5f	3124	word16 haveStaticECC:1; /* static server ECC private key */
sPymbed	17:ff9d1e86ad5f	3125	word16 havePeerCert:1; /* do we have peer's cert */
sPymbed	17:ff9d1e86ad5f	3126	word16 havePeerVerify:1; /* and peer's cert verify */
sPymbed	17:ff9d1e86ad5f	3127	word16 usingPSK_cipher:1; /* are using psk as cipher */
sPymbed	17:ff9d1e86ad5f	3128	word16 usingAnon_cipher:1; /* are we using an anon cipher */
sPymbed	17:ff9d1e86ad5f	3129	word16 noPskDheKe:1; /* Don't use (EC)DHE with PSK */
sPymbed	17:ff9d1e86ad5f	3130	word16 sendAlertState:1; /* nonblocking resume */
sPymbed	17:ff9d1e86ad5f	3131	word16 partialWrite:1; /* only one msg per write call */
sPymbed	17:ff9d1e86ad5f	3132	word16 quietShutdown:1; /* don't send close notify */
sPymbed	17:ff9d1e86ad5f	3133	word16 certOnly:1; /* stop once we get cert */
sPymbed	17:ff9d1e86ad5f	3134	word16 groupMessages:1; /* group handshake messages */
sPymbed	17:ff9d1e86ad5f	3135	word16 saveArrays:1; /* save array Memory for user get keys
sPymbed	17:ff9d1e86ad5f	3136	or psk */
sPymbed	17:ff9d1e86ad5f	3137	word16 weOwnRng:1; /* will be true unless CTX owns */
sPymbed	17:ff9d1e86ad5f	3138	word16 haveEMS:1; /* using extended master secret */
sPymbed	17:ff9d1e86ad5f	3139	#ifdef HAVE_POLY1305
sPymbed	17:ff9d1e86ad5f	3140	word16 oldPoly:1; /* set when to use old rfc way of poly*/
sPymbed	17:ff9d1e86ad5f	3141	#endif
sPymbed	17:ff9d1e86ad5f	3142	#ifdef HAVE_ANON
sPymbed	17:ff9d1e86ad5f	3143	word16 haveAnon:1; /* User wants to allow Anon suites */
sPymbed	17:ff9d1e86ad5f	3144	#endif
sPymbed	17:ff9d1e86ad5f	3145	#ifdef HAVE_SESSION_TICKET
sPymbed	17:ff9d1e86ad5f	3146	word16 createTicket:1; /* Server to create new Ticket */
sPymbed	17:ff9d1e86ad5f	3147	word16 useTicket:1; /* Use Ticket not session cache */
sPymbed	17:ff9d1e86ad5f	3148	word16 rejectTicket:1; /* Callback rejected ticket */
sPymbed	17:ff9d1e86ad5f	3149	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3150	word16 noTicketTls13:1; /* Server won't create new Ticket */
sPymbed	17:ff9d1e86ad5f	3151	#endif
sPymbed	17:ff9d1e86ad5f	3152	#endif
sPymbed	17:ff9d1e86ad5f	3153	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	3154	word16 dtlsUseNonblock:1; /* are we using nonblocking socket */
sPymbed	17:ff9d1e86ad5f	3155	word16 dtlsHsRetain:1; /* DTLS retaining HS data */
sPymbed	17:ff9d1e86ad5f	3156	word16 haveMcast:1; /* using multicast ? */
sPymbed	17:ff9d1e86ad5f	3157	#ifdef WOLFSSL_SCTP
sPymbed	17:ff9d1e86ad5f	3158	word16 dtlsSctp:1; /* DTLS-over-SCTP mode */
sPymbed	17:ff9d1e86ad5f	3159	#endif
sPymbed	17:ff9d1e86ad5f	3160	#endif
sPymbed	17:ff9d1e86ad5f	3161	#if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_SUPPORTED_CURVES)
sPymbed	17:ff9d1e86ad5f	3162	word16 userCurves:1; /* indicates user called wolfSSL_UseSupportedCurve */
sPymbed	17:ff9d1e86ad5f	3163	#endif
sPymbed	17:ff9d1e86ad5f	3164	word16 keepResources:1; /* Keep resources after handshake */
sPymbed	17:ff9d1e86ad5f	3165	word16 useClientOrder:1; /* Use client's cipher order */
sPymbed	17:ff9d1e86ad5f	3166	#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
sPymbed	17:ff9d1e86ad5f	3167	word16 postHandshakeAuth:1;/* Client send post_handshake_auth
sPymbed	17:ff9d1e86ad5f	3168	* extendion. */
sPymbed	17:ff9d1e86ad5f	3169	#endif
sPymbed	17:ff9d1e86ad5f	3170	#if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_SERVER)
sPymbed	17:ff9d1e86ad5f	3171	word16 sendCookie:1; /* Server creates a Cookie in HRR */
sPymbed	17:ff9d1e86ad5f	3172	#endif
sPymbed	17:ff9d1e86ad5f	3173	#ifdef WOLFSSL_ALT_CERT_CHAINS
sPymbed	17:ff9d1e86ad5f	3174	word16 usingAltCertChain:1;/* Alternate cert chain was used */
sPymbed	17:ff9d1e86ad5f	3175	#endif
sPymbed	17:ff9d1e86ad5f	3176	#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_TLS13_MIDDLEBOX_COMPAT)
sPymbed	17:ff9d1e86ad5f	3177	word16 sentChangeCipher:1; /* Change Cipher Spec sent */
sPymbed	17:ff9d1e86ad5f	3178	#endif
sPymbed	17:ff9d1e86ad5f	3179	#if !defined(WOLFSSL_NO_CLIENT_AUTH) && defined(HAVE_ED25519) && \
sPymbed	17:ff9d1e86ad5f	3180	!defined(NO_ED25519_CLIENT_AUTH)
sPymbed	17:ff9d1e86ad5f	3181	word16 cacheMessages:1; /* Cache messages for sign/verify */
sPymbed	17:ff9d1e86ad5f	3182	#endif
sPymbed	17:ff9d1e86ad5f	3183
sPymbed	17:ff9d1e86ad5f	3184	/* need full byte values for this section */
sPymbed	17:ff9d1e86ad5f	3185	byte processReply; /* nonblocking resume */
sPymbed	17:ff9d1e86ad5f	3186	byte cipherSuite0; /* first byte, normally 0 */
sPymbed	17:ff9d1e86ad5f	3187	byte cipherSuite; /* second byte, actual suite */
sPymbed	17:ff9d1e86ad5f	3188	byte serverState;
sPymbed	17:ff9d1e86ad5f	3189	byte clientState;
sPymbed	17:ff9d1e86ad5f	3190	byte handShakeState;
sPymbed	17:ff9d1e86ad5f	3191	byte handShakeDone; /* at least one handshake complete */
sPymbed	17:ff9d1e86ad5f	3192	byte minDowngrade; /* minimum downgrade version */
sPymbed	17:ff9d1e86ad5f	3193	byte connectState; /* nonblocking resume */
sPymbed	17:ff9d1e86ad5f	3194	byte acceptState; /* nonblocking resume */
sPymbed	17:ff9d1e86ad5f	3195	byte asyncState; /* sub-state for enum asyncState */
sPymbed	17:ff9d1e86ad5f	3196	byte buildMsgState; /* sub-state for enum buildMsgState */
sPymbed	17:ff9d1e86ad5f	3197	byte alertCount; /* detect warning dos attempt */
sPymbed	17:ff9d1e86ad5f	3198	#ifdef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	3199	word16 mcastID; /* Multicast group ID */
sPymbed	17:ff9d1e86ad5f	3200	#endif
sPymbed	17:ff9d1e86ad5f	3201	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	3202	word16 minDhKeySz; /* minimum DH key size */
sPymbed	17:ff9d1e86ad5f	3203	word16 maxDhKeySz; /* minimum DH key size */
sPymbed	17:ff9d1e86ad5f	3204	word16 dhKeySz; /* actual DH key size */
sPymbed	17:ff9d1e86ad5f	3205	#endif
sPymbed	17:ff9d1e86ad5f	3206	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	3207	short minRsaKeySz; /* minimum RSA key size */
sPymbed	17:ff9d1e86ad5f	3208	#endif
sPymbed	17:ff9d1e86ad5f	3209	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	3210	short minEccKeySz; /* minimum ECC key size */
sPymbed	17:ff9d1e86ad5f	3211	#endif
sPymbed	17:ff9d1e86ad5f	3212	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3213	byte verifyDepth; /* maximum verification depth */
sPymbed	17:ff9d1e86ad5f	3214	#endif
sPymbed	17:ff9d1e86ad5f	3215	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	3216	word16 pskIdIndex;
sPymbed	17:ff9d1e86ad5f	3217	word32 maxEarlyDataSz;
sPymbed	17:ff9d1e86ad5f	3218	#endif
sPymbed	17:ff9d1e86ad5f	3219	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3220	byte oldMinor; /* client preferred version < TLS 1.3 */
sPymbed	17:ff9d1e86ad5f	3221	#endif
sPymbed	17:ff9d1e86ad5f	3222	} Options;
sPymbed	17:ff9d1e86ad5f	3223
sPymbed	17:ff9d1e86ad5f	3224	typedef struct Arrays {
sPymbed	17:ff9d1e86ad5f	3225	byte* pendingMsg; /* defrag buffer */
sPymbed	17:ff9d1e86ad5f	3226	byte* preMasterSecret;
sPymbed	17:ff9d1e86ad5f	3227	word32 preMasterSz; /* differs for DH, actual size */
sPymbed	17:ff9d1e86ad5f	3228	word32 pendingMsgSz; /* defrag buffer size */
sPymbed	17:ff9d1e86ad5f	3229	word32 pendingMsgOffset; /* current offset into defrag buffer */
sPymbed	17:ff9d1e86ad5f	3230	#if defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK)
sPymbed	17:ff9d1e86ad5f	3231	word32 psk_keySz; /* actual size */
sPymbed	17:ff9d1e86ad5f	3232	char client_identity[MAX_PSK_ID_LEN + NULL_TERM_LEN];
sPymbed	17:ff9d1e86ad5f	3233	char server_hint[MAX_PSK_ID_LEN + NULL_TERM_LEN];
sPymbed	17:ff9d1e86ad5f	3234	byte psk_key[MAX_PSK_KEY_LEN];
sPymbed	17:ff9d1e86ad5f	3235	#endif
sPymbed	17:ff9d1e86ad5f	3236	byte clientRandom[RAN_LEN];
sPymbed	17:ff9d1e86ad5f	3237	byte serverRandom[RAN_LEN];
sPymbed	17:ff9d1e86ad5f	3238	byte sessionID[ID_LEN];
sPymbed	17:ff9d1e86ad5f	3239	byte sessionIDSz;
sPymbed	17:ff9d1e86ad5f	3240	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3241	byte clientSecret[SECRET_LEN];
sPymbed	17:ff9d1e86ad5f	3242	byte serverSecret[SECRET_LEN];
sPymbed	17:ff9d1e86ad5f	3243	byte secret[SECRET_LEN];
sPymbed	17:ff9d1e86ad5f	3244	#endif
sPymbed	17:ff9d1e86ad5f	3245	byte masterSecret[SECRET_LEN];
sPymbed	17:ff9d1e86ad5f	3246	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	3247	byte cookie[MAX_COOKIE_LEN];
sPymbed	17:ff9d1e86ad5f	3248	byte cookieSz;
sPymbed	17:ff9d1e86ad5f	3249	#endif
sPymbed	17:ff9d1e86ad5f	3250	byte pendingMsgType; /* defrag buffer message type */
sPymbed	17:ff9d1e86ad5f	3251	} Arrays;
sPymbed	17:ff9d1e86ad5f	3252
sPymbed	17:ff9d1e86ad5f	3253	#ifndef ASN_NAME_MAX
sPymbed	17:ff9d1e86ad5f	3254	#define ASN_NAME_MAX 256
sPymbed	17:ff9d1e86ad5f	3255	#endif
sPymbed	17:ff9d1e86ad5f	3256
sPymbed	17:ff9d1e86ad5f	3257	#ifndef MAX_DATE_SZ
sPymbed	17:ff9d1e86ad5f	3258	#define MAX_DATE_SZ 32
sPymbed	17:ff9d1e86ad5f	3259	#endif
sPymbed	17:ff9d1e86ad5f	3260
sPymbed	17:ff9d1e86ad5f	3261	struct WOLFSSL_STACK {
sPymbed	17:ff9d1e86ad5f	3262	unsigned long num; /* number of nodes in stack
sPymbed	17:ff9d1e86ad5f	3263	* (saftey measure for freeing and shortcut for count) */
sPymbed	17:ff9d1e86ad5f	3264	union {
sPymbed	17:ff9d1e86ad5f	3265	WOLFSSL_X509* x509;
sPymbed	17:ff9d1e86ad5f	3266	WOLFSSL_X509_NAME* name;
sPymbed	17:ff9d1e86ad5f	3267	WOLFSSL_BIO* bio;
sPymbed	17:ff9d1e86ad5f	3268	WOLFSSL_ASN1_OBJECT* obj;
sPymbed	17:ff9d1e86ad5f	3269	char* string;
sPymbed	17:ff9d1e86ad5f	3270	} data;
sPymbed	17:ff9d1e86ad5f	3271	WOLFSSL_STACK* next;
sPymbed	17:ff9d1e86ad5f	3272	};
sPymbed	17:ff9d1e86ad5f	3273
sPymbed	17:ff9d1e86ad5f	3274
sPymbed	17:ff9d1e86ad5f	3275	struct WOLFSSL_X509_NAME {
sPymbed	17:ff9d1e86ad5f	3276	char *name;
sPymbed	17:ff9d1e86ad5f	3277	int dynamicName;
sPymbed	17:ff9d1e86ad5f	3278	int sz;
sPymbed	17:ff9d1e86ad5f	3279	char staticName[ASN_NAME_MAX];
sPymbed	17:ff9d1e86ad5f	3280	#if (defined(OPENSSL_EXTRA) \|\| defined(OPENSSL_EXTRA_X509_SMALL)) && \
sPymbed	17:ff9d1e86ad5f	3281	!defined(NO_ASN)
sPymbed	17:ff9d1e86ad5f	3282	DecodedName fullName;
sPymbed	17:ff9d1e86ad5f	3283	WOLFSSL_X509_NAME_ENTRY cnEntry;
sPymbed	17:ff9d1e86ad5f	3284	WOLFSSL_X509_NAME_ENTRY extra[MAX_NAME_ENTRIES]; /* extra entries added */
sPymbed	17:ff9d1e86ad5f	3285	WOLFSSL_X509* x509; /* x509 that struct belongs to */
sPymbed	17:ff9d1e86ad5f	3286	#endif /* OPENSSL_EXTRA */
sPymbed	17:ff9d1e86ad5f	3287	#if defined(OPENSSL_ALL) \|\| defined(WOLFSSL_NGINX)
sPymbed	17:ff9d1e86ad5f	3288	byte raw[ASN_NAME_MAX];
sPymbed	17:ff9d1e86ad5f	3289	int rawLen;
sPymbed	17:ff9d1e86ad5f	3290	#endif
sPymbed	17:ff9d1e86ad5f	3291	};
sPymbed	17:ff9d1e86ad5f	3292
sPymbed	17:ff9d1e86ad5f	3293	#ifndef EXTERNAL_SERIAL_SIZE
sPymbed	17:ff9d1e86ad5f	3294	#define EXTERNAL_SERIAL_SIZE 32
sPymbed	17:ff9d1e86ad5f	3295	#endif
sPymbed	17:ff9d1e86ad5f	3296
sPymbed	17:ff9d1e86ad5f	3297	#ifdef NO_ASN
sPymbed	17:ff9d1e86ad5f	3298	typedef struct DNS_entry DNS_entry;
sPymbed	17:ff9d1e86ad5f	3299	#endif
sPymbed	17:ff9d1e86ad5f	3300
sPymbed	17:ff9d1e86ad5f	3301	struct WOLFSSL_X509 {
sPymbed	17:ff9d1e86ad5f	3302	int version;
sPymbed	17:ff9d1e86ad5f	3303	int serialSz;
sPymbed	17:ff9d1e86ad5f	3304	#ifdef WOLFSSL_SEP
sPymbed	17:ff9d1e86ad5f	3305	int deviceTypeSz;
sPymbed	17:ff9d1e86ad5f	3306	int hwTypeSz;
sPymbed	17:ff9d1e86ad5f	3307	byte deviceType[EXTERNAL_SERIAL_SIZE];
sPymbed	17:ff9d1e86ad5f	3308	byte hwType[EXTERNAL_SERIAL_SIZE];
sPymbed	17:ff9d1e86ad5f	3309	int hwSerialNumSz;
sPymbed	17:ff9d1e86ad5f	3310	byte hwSerialNum[EXTERNAL_SERIAL_SIZE];
sPymbed	17:ff9d1e86ad5f	3311	#if defined(OPENSSL_EXTRA) \|\| defined(OPENSSL_EXTRA_X509_SMALL)
sPymbed	17:ff9d1e86ad5f	3312	byte certPolicySet;
sPymbed	17:ff9d1e86ad5f	3313	byte certPolicyCrit;
sPymbed	17:ff9d1e86ad5f	3314	#endif /* OPENSSL_EXTRA */
sPymbed	17:ff9d1e86ad5f	3315	#endif
sPymbed	17:ff9d1e86ad5f	3316	int notBeforeSz;
sPymbed	17:ff9d1e86ad5f	3317	int notAfterSz;
sPymbed	17:ff9d1e86ad5f	3318	byte notBefore[MAX_DATE_SZ];
sPymbed	17:ff9d1e86ad5f	3319	byte notAfter[MAX_DATE_SZ];
sPymbed	17:ff9d1e86ad5f	3320	buffer sig;
sPymbed	17:ff9d1e86ad5f	3321	int sigOID;
sPymbed	17:ff9d1e86ad5f	3322	DNS_entry* altNames; /* alt names list */
sPymbed	17:ff9d1e86ad5f	3323	buffer pubKey;
sPymbed	17:ff9d1e86ad5f	3324	int pubKeyOID;
sPymbed	17:ff9d1e86ad5f	3325	DNS_entry* altNamesNext; /* hint for retrieval */
sPymbed	17:ff9d1e86ad5f	3326	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	3327	word32 pkCurveOID;
sPymbed	17:ff9d1e86ad5f	3328	#endif /* HAVE_ECC */
sPymbed	17:ff9d1e86ad5f	3329	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	3330	DerBuffer* derCert; /* may need */
sPymbed	17:ff9d1e86ad5f	3331	#endif
sPymbed	17:ff9d1e86ad5f	3332	void* heap; /* heap hint */
sPymbed	17:ff9d1e86ad5f	3333	byte dynamicMemory; /* dynamic memory flag */
sPymbed	17:ff9d1e86ad5f	3334	byte isCa:1;
sPymbed	17:ff9d1e86ad5f	3335	#ifdef WOLFSSL_CERT_EXT
sPymbed	17:ff9d1e86ad5f	3336	char certPolicies[MAX_CERTPOL_NB][MAX_CERTPOL_SZ];
sPymbed	17:ff9d1e86ad5f	3337	int certPoliciesNb;
sPymbed	17:ff9d1e86ad5f	3338	#endif /* WOLFSSL_CERT_EXT */
sPymbed	17:ff9d1e86ad5f	3339	#if defined(OPENSSL_EXTRA) \|\| defined(OPENSSL_EXTRA_X509_SMALL)
sPymbed	17:ff9d1e86ad5f	3340	#ifdef HAVE_EX_DATA
sPymbed	17:ff9d1e86ad5f	3341	void* ex_data[MAX_EX_DATA];
sPymbed	17:ff9d1e86ad5f	3342	#endif
sPymbed	17:ff9d1e86ad5f	3343	byte* authKeyId;
sPymbed	17:ff9d1e86ad5f	3344	byte* subjKeyId;
sPymbed	17:ff9d1e86ad5f	3345	byte* extKeyUsageSrc;
sPymbed	17:ff9d1e86ad5f	3346	byte* CRLInfo;
sPymbed	17:ff9d1e86ad5f	3347	byte* authInfo;
sPymbed	17:ff9d1e86ad5f	3348	word32 pathLength;
sPymbed	17:ff9d1e86ad5f	3349	word16 keyUsage;
sPymbed	17:ff9d1e86ad5f	3350	int CRLInfoSz;
sPymbed	17:ff9d1e86ad5f	3351	int authInfoSz;
sPymbed	17:ff9d1e86ad5f	3352	word32 authKeyIdSz;
sPymbed	17:ff9d1e86ad5f	3353	word32 subjKeyIdSz;
sPymbed	17:ff9d1e86ad5f	3354	word32 extKeyUsageSz;
sPymbed	17:ff9d1e86ad5f	3355	word32 extKeyUsageCount;
sPymbed	17:ff9d1e86ad5f	3356
sPymbed	17:ff9d1e86ad5f	3357	byte CRLdistSet:1;
sPymbed	17:ff9d1e86ad5f	3358	byte CRLdistCrit:1;
sPymbed	17:ff9d1e86ad5f	3359	byte authInfoSet:1;
sPymbed	17:ff9d1e86ad5f	3360	byte authInfoCrit:1;
sPymbed	17:ff9d1e86ad5f	3361	byte keyUsageSet:1;
sPymbed	17:ff9d1e86ad5f	3362	byte keyUsageCrit:1;
sPymbed	17:ff9d1e86ad5f	3363	byte extKeyUsageCrit:1;
sPymbed	17:ff9d1e86ad5f	3364	byte subjKeyIdSet:1;
sPymbed	17:ff9d1e86ad5f	3365
sPymbed	17:ff9d1e86ad5f	3366	byte subjKeyIdCrit:1;
sPymbed	17:ff9d1e86ad5f	3367	byte basicConstSet:1;
sPymbed	17:ff9d1e86ad5f	3368	byte basicConstCrit:1;
sPymbed	17:ff9d1e86ad5f	3369	byte basicConstPlSet:1;
sPymbed	17:ff9d1e86ad5f	3370	byte subjAltNameSet:1;
sPymbed	17:ff9d1e86ad5f	3371	byte subjAltNameCrit:1;
sPymbed	17:ff9d1e86ad5f	3372	byte authKeyIdSet:1;
sPymbed	17:ff9d1e86ad5f	3373	byte authKeyIdCrit:1;
sPymbed	17:ff9d1e86ad5f	3374	#endif /* OPENSSL_EXTRA \|\| OPENSSL_EXTRA_X509_SMALL */
sPymbed	17:ff9d1e86ad5f	3375	byte serial[EXTERNAL_SERIAL_SIZE];
sPymbed	17:ff9d1e86ad5f	3376	char subjectCN[ASN_NAME_MAX]; /* common name short cut */
sPymbed	17:ff9d1e86ad5f	3377	#ifdef WOLFSSL_CERT_REQ
sPymbed	17:ff9d1e86ad5f	3378	char challengePw[CTC_NAME_SIZE]; /* for REQ certs */
sPymbed	17:ff9d1e86ad5f	3379	#endif
sPymbed	17:ff9d1e86ad5f	3380	WOLFSSL_X509_NAME issuer;
sPymbed	17:ff9d1e86ad5f	3381	WOLFSSL_X509_NAME subject;
sPymbed	17:ff9d1e86ad5f	3382	};
sPymbed	17:ff9d1e86ad5f	3383
sPymbed	17:ff9d1e86ad5f	3384
sPymbed	17:ff9d1e86ad5f	3385	/* record layer header for PlainText, Compressed, and CipherText */
sPymbed	17:ff9d1e86ad5f	3386	typedef struct RecordLayerHeader {
sPymbed	17:ff9d1e86ad5f	3387	byte type;
sPymbed	17:ff9d1e86ad5f	3388	byte pvMajor;
sPymbed	17:ff9d1e86ad5f	3389	byte pvMinor;
sPymbed	17:ff9d1e86ad5f	3390	byte length[2];
sPymbed	17:ff9d1e86ad5f	3391	} RecordLayerHeader;
sPymbed	17:ff9d1e86ad5f	3392
sPymbed	17:ff9d1e86ad5f	3393
sPymbed	17:ff9d1e86ad5f	3394	/* record layer header for DTLS PlainText, Compressed, and CipherText */
sPymbed	17:ff9d1e86ad5f	3395	typedef struct DtlsRecordLayerHeader {
sPymbed	17:ff9d1e86ad5f	3396	byte type;
sPymbed	17:ff9d1e86ad5f	3397	byte pvMajor;
sPymbed	17:ff9d1e86ad5f	3398	byte pvMinor;
sPymbed	17:ff9d1e86ad5f	3399	byte sequence_number[8]; /* per record */
sPymbed	17:ff9d1e86ad5f	3400	byte length[2];
sPymbed	17:ff9d1e86ad5f	3401	} DtlsRecordLayerHeader;
sPymbed	17:ff9d1e86ad5f	3402
sPymbed	17:ff9d1e86ad5f	3403
sPymbed	17:ff9d1e86ad5f	3404	typedef struct DtlsFrag {
sPymbed	17:ff9d1e86ad5f	3405	word32 begin;
sPymbed	17:ff9d1e86ad5f	3406	word32 end;
sPymbed	17:ff9d1e86ad5f	3407	struct DtlsFrag* next;
sPymbed	17:ff9d1e86ad5f	3408	} DtlsFrag;
sPymbed	17:ff9d1e86ad5f	3409
sPymbed	17:ff9d1e86ad5f	3410
sPymbed	17:ff9d1e86ad5f	3411	typedef struct DtlsMsg {
sPymbed	17:ff9d1e86ad5f	3412	struct DtlsMsg* next;
sPymbed	17:ff9d1e86ad5f	3413	byte* buf;
sPymbed	17:ff9d1e86ad5f	3414	byte* msg;
sPymbed	17:ff9d1e86ad5f	3415	DtlsFrag* fragList;
sPymbed	17:ff9d1e86ad5f	3416	word32 fragSz; /* Length of fragments received */
sPymbed	17:ff9d1e86ad5f	3417	word32 seq; /* Handshake sequence number */
sPymbed	17:ff9d1e86ad5f	3418	word32 sz; /* Length of whole mesage */
sPymbed	17:ff9d1e86ad5f	3419	byte type;
sPymbed	17:ff9d1e86ad5f	3420	} DtlsMsg;
sPymbed	17:ff9d1e86ad5f	3421
sPymbed	17:ff9d1e86ad5f	3422
sPymbed	17:ff9d1e86ad5f	3423	#ifdef HAVE_NETX
sPymbed	17:ff9d1e86ad5f	3424
sPymbed	17:ff9d1e86ad5f	3425	/* NETX I/O Callback default */
sPymbed	17:ff9d1e86ad5f	3426	typedef struct NetX_Ctx {
sPymbed	17:ff9d1e86ad5f	3427	NX_TCP_SOCKET* nxSocket; /* send/recv socket handle */
sPymbed	17:ff9d1e86ad5f	3428	NX_PACKET* nxPacket; /* incoming packet handle for short reads */
sPymbed	17:ff9d1e86ad5f	3429	ULONG nxOffset; /* offset already read from nxPacket */
sPymbed	17:ff9d1e86ad5f	3430	ULONG nxWait; /* wait option flag */
sPymbed	17:ff9d1e86ad5f	3431	} NetX_Ctx;
sPymbed	17:ff9d1e86ad5f	3432
sPymbed	17:ff9d1e86ad5f	3433	#endif
sPymbed	17:ff9d1e86ad5f	3434
sPymbed	17:ff9d1e86ad5f	3435
sPymbed	17:ff9d1e86ad5f	3436	/* Handshake messages received from peer (plus change cipher */
sPymbed	17:ff9d1e86ad5f	3437	typedef struct MsgsReceived {
sPymbed	17:ff9d1e86ad5f	3438	word16 got_hello_request:1;
sPymbed	17:ff9d1e86ad5f	3439	word16 got_client_hello:2;
sPymbed	17:ff9d1e86ad5f	3440	word16 got_server_hello:2;
sPymbed	17:ff9d1e86ad5f	3441	word16 got_hello_verify_request:1;
sPymbed	17:ff9d1e86ad5f	3442	word16 got_session_ticket:1;
sPymbed	17:ff9d1e86ad5f	3443	word16 got_end_of_early_data:1;
sPymbed	17:ff9d1e86ad5f	3444	word16 got_hello_retry_request:1;
sPymbed	17:ff9d1e86ad5f	3445	word16 got_encrypted_extensions:1;
sPymbed	17:ff9d1e86ad5f	3446	word16 got_certificate:1;
sPymbed	17:ff9d1e86ad5f	3447	word16 got_certificate_status:1;
sPymbed	17:ff9d1e86ad5f	3448	word16 got_server_key_exchange:1;
sPymbed	17:ff9d1e86ad5f	3449	word16 got_certificate_request:1;
sPymbed	17:ff9d1e86ad5f	3450	word16 got_server_hello_done:1;
sPymbed	17:ff9d1e86ad5f	3451	word16 got_certificate_verify:1;
sPymbed	17:ff9d1e86ad5f	3452	word16 got_client_key_exchange:1;
sPymbed	17:ff9d1e86ad5f	3453	word16 got_finished:1;
sPymbed	17:ff9d1e86ad5f	3454	word16 got_key_update:1;
sPymbed	17:ff9d1e86ad5f	3455	word16 got_change_cipher:1;
sPymbed	17:ff9d1e86ad5f	3456	} MsgsReceived;
sPymbed	17:ff9d1e86ad5f	3457
sPymbed	17:ff9d1e86ad5f	3458
sPymbed	17:ff9d1e86ad5f	3459	/* Handshake hashes */
sPymbed	17:ff9d1e86ad5f	3460	typedef struct HS_Hashes {
sPymbed	17:ff9d1e86ad5f	3461	Hashes verifyHashes;
sPymbed	17:ff9d1e86ad5f	3462	Hashes certHashes; /* for cert verify */
sPymbed	17:ff9d1e86ad5f	3463	#ifndef NO_SHA
sPymbed	17:ff9d1e86ad5f	3464	wc_Sha hashSha; /* sha hash of handshake msgs */
sPymbed	17:ff9d1e86ad5f	3465	#endif
sPymbed	17:ff9d1e86ad5f	3466	#if !defined(NO_MD5) && !defined(NO_OLD_TLS)
sPymbed	17:ff9d1e86ad5f	3467	wc_Md5 hashMd5; /* md5 hash of handshake msgs */
sPymbed	17:ff9d1e86ad5f	3468	#endif
sPymbed	17:ff9d1e86ad5f	3469	#ifndef NO_SHA256
sPymbed	17:ff9d1e86ad5f	3470	wc_Sha256 hashSha256; /* sha256 hash of handshake msgs */
sPymbed	17:ff9d1e86ad5f	3471	#endif
sPymbed	17:ff9d1e86ad5f	3472	#ifdef WOLFSSL_SHA384
sPymbed	17:ff9d1e86ad5f	3473	wc_Sha384 hashSha384; /* sha384 hash of handshake msgs */
sPymbed	17:ff9d1e86ad5f	3474	#endif
sPymbed	17:ff9d1e86ad5f	3475	#ifdef WOLFSSL_SHA512
sPymbed	17:ff9d1e86ad5f	3476	wc_Sha512 hashSha512; /* sha512 hash of handshake msgs */
sPymbed	17:ff9d1e86ad5f	3477	#endif
sPymbed	17:ff9d1e86ad5f	3478	#if defined(HAVE_ED25519) && !defined(WOLFSSL_NO_CLIENT_AUTH)
sPymbed	17:ff9d1e86ad5f	3479	byte* messages; /* handshake messages */
sPymbed	17:ff9d1e86ad5f	3480	int length; /* length of handhsake messages' data */
sPymbed	17:ff9d1e86ad5f	3481	int prevLen; /* length of messages but last */
sPymbed	17:ff9d1e86ad5f	3482	#endif
sPymbed	17:ff9d1e86ad5f	3483	} HS_Hashes;
sPymbed	17:ff9d1e86ad5f	3484
sPymbed	17:ff9d1e86ad5f	3485
sPymbed	17:ff9d1e86ad5f	3486	#ifdef WOLFSSL_ASYNC_CRYPT
sPymbed	17:ff9d1e86ad5f	3487	#define MAX_ASYNC_ARGS 18
sPymbed	17:ff9d1e86ad5f	3488	typedef void (FreeArgsCb)(struct WOLFSSL ssl, void* pArgs);
sPymbed	17:ff9d1e86ad5f	3489
sPymbed	17:ff9d1e86ad5f	3490	struct WOLFSSL_ASYNC {
sPymbed	17:ff9d1e86ad5f	3491	WC_ASYNC_DEV* dev;
sPymbed	17:ff9d1e86ad5f	3492	FreeArgsCb freeArgs; /* function pointer to cleanup args */
sPymbed	17:ff9d1e86ad5f	3493	word32 args[MAX_ASYNC_ARGS]; /* holder for current args */
sPymbed	17:ff9d1e86ad5f	3494	};
sPymbed	17:ff9d1e86ad5f	3495	#endif
sPymbed	17:ff9d1e86ad5f	3496
sPymbed	17:ff9d1e86ad5f	3497	#ifdef HAVE_WRITE_DUP
sPymbed	17:ff9d1e86ad5f	3498
sPymbed	17:ff9d1e86ad5f	3499	#define WRITE_DUP_SIDE 1
sPymbed	17:ff9d1e86ad5f	3500	#define READ_DUP_SIDE 2
sPymbed	17:ff9d1e86ad5f	3501
sPymbed	17:ff9d1e86ad5f	3502	typedef struct WriteDup {
sPymbed	17:ff9d1e86ad5f	3503	wolfSSL_Mutex dupMutex; /* reference count mutex */
sPymbed	17:ff9d1e86ad5f	3504	int dupCount; /* reference count */
sPymbed	17:ff9d1e86ad5f	3505	int dupErr; /* under dupMutex, pass to other side */
sPymbed	17:ff9d1e86ad5f	3506	} WriteDup;
sPymbed	17:ff9d1e86ad5f	3507
sPymbed	17:ff9d1e86ad5f	3508	WOLFSSL_LOCAL void FreeWriteDup(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3509	WOLFSSL_LOCAL int NotifyWriteSide(WOLFSSL* ssl, int err);
sPymbed	17:ff9d1e86ad5f	3510	#endif /* HAVE_WRITE_DUP */
sPymbed	17:ff9d1e86ad5f	3511
sPymbed	17:ff9d1e86ad5f	3512	#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
sPymbed	17:ff9d1e86ad5f	3513	typedef struct CertReqCtx CertReqCtx;
sPymbed	17:ff9d1e86ad5f	3514
sPymbed	17:ff9d1e86ad5f	3515	struct CertReqCtx {
sPymbed	17:ff9d1e86ad5f	3516	CertReqCtx* next;
sPymbed	17:ff9d1e86ad5f	3517	byte len;
sPymbed	17:ff9d1e86ad5f	3518	byte ctx;
sPymbed	17:ff9d1e86ad5f	3519	};
sPymbed	17:ff9d1e86ad5f	3520	#endif
sPymbed	17:ff9d1e86ad5f	3521
sPymbed	17:ff9d1e86ad5f	3522	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	3523	typedef enum EarlyDataState {
sPymbed	17:ff9d1e86ad5f	3524	no_early_data,
sPymbed	17:ff9d1e86ad5f	3525	expecting_early_data,
sPymbed	17:ff9d1e86ad5f	3526	process_early_data,
sPymbed	17:ff9d1e86ad5f	3527	done_early_data
sPymbed	17:ff9d1e86ad5f	3528	} EarlyDataState;
sPymbed	17:ff9d1e86ad5f	3529	#endif
sPymbed	17:ff9d1e86ad5f	3530
sPymbed	17:ff9d1e86ad5f	3531	/* wolfSSL ssl type */
sPymbed	17:ff9d1e86ad5f	3532	struct WOLFSSL {
sPymbed	17:ff9d1e86ad5f	3533	WOLFSSL_CTX* ctx;
sPymbed	17:ff9d1e86ad5f	3534	Suites* suites; /* only need during handshake */
sPymbed	17:ff9d1e86ad5f	3535	Arrays* arrays;
sPymbed	17:ff9d1e86ad5f	3536	HS_Hashes* hsHashes;
sPymbed	17:ff9d1e86ad5f	3537	void* IOCB_ReadCtx;
sPymbed	17:ff9d1e86ad5f	3538	void* IOCB_WriteCtx;
sPymbed	17:ff9d1e86ad5f	3539	WC_RNG* rng;
sPymbed	17:ff9d1e86ad5f	3540	void* verifyCbCtx; /* cert verify callback user ctx*/
sPymbed	17:ff9d1e86ad5f	3541	VerifyCallback verifyCallback; /* cert verification callback */
sPymbed	17:ff9d1e86ad5f	3542	void* heap; /* for user overrides */
sPymbed	17:ff9d1e86ad5f	3543	#ifdef HAVE_WRITE_DUP
sPymbed	17:ff9d1e86ad5f	3544	WriteDup* dupWrite; /* valid pointer indicates ON */
sPymbed	17:ff9d1e86ad5f	3545	/* side that decrements dupCount to zero frees overall structure */
sPymbed	17:ff9d1e86ad5f	3546	byte dupSide; /* write side or read side */
sPymbed	17:ff9d1e86ad5f	3547	#endif
sPymbed	17:ff9d1e86ad5f	3548	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3549	byte cbioFlag; /* WOLFSSL_CBIO_RECV/SEND: CBIORecv/Send is set */
sPymbed	17:ff9d1e86ad5f	3550	#endif
sPymbed	17:ff9d1e86ad5f	3551	CallbackIORecv CBIORecv;
sPymbed	17:ff9d1e86ad5f	3552	CallbackIOSend CBIOSend;
sPymbed	17:ff9d1e86ad5f	3553	#ifdef WOLFSSL_STATIC_MEMORY
sPymbed	17:ff9d1e86ad5f	3554	WOLFSSL_HEAP_HINT heap_hint;
sPymbed	17:ff9d1e86ad5f	3555	#endif
sPymbed	17:ff9d1e86ad5f	3556	#ifndef NO_HANDSHAKE_DONE_CB
sPymbed	17:ff9d1e86ad5f	3557	HandShakeDoneCb hsDoneCb; /* notify user handshake done */
sPymbed	17:ff9d1e86ad5f	3558	void* hsDoneCtx; /* user handshake cb context */
sPymbed	17:ff9d1e86ad5f	3559	#endif
sPymbed	17:ff9d1e86ad5f	3560	#ifdef WOLFSSL_ASYNC_CRYPT
sPymbed	17:ff9d1e86ad5f	3561	struct WOLFSSL_ASYNC async;
sPymbed	17:ff9d1e86ad5f	3562	#elif defined(WOLFSSL_NONBLOCK_OCSP)
sPymbed	17:ff9d1e86ad5f	3563	void* nonblockarg; /* dynamic arg for handling non-block resume */
sPymbed	17:ff9d1e86ad5f	3564	#endif
sPymbed	17:ff9d1e86ad5f	3565	void* hsKey; /* Handshake key (RsaKey or ecc_key) allocated from heap */
sPymbed	17:ff9d1e86ad5f	3566	word32 hsType; /* Type of Handshake key (hsKey) */
sPymbed	17:ff9d1e86ad5f	3567	WOLFSSL_CIPHER cipher;
sPymbed	17:ff9d1e86ad5f	3568	hmacfp hmac;
sPymbed	17:ff9d1e86ad5f	3569	Ciphers encrypt;
sPymbed	17:ff9d1e86ad5f	3570	Ciphers decrypt;
sPymbed	17:ff9d1e86ad5f	3571	Buffers buffers;
sPymbed	17:ff9d1e86ad5f	3572	WOLFSSL_SESSION session;
sPymbed	17:ff9d1e86ad5f	3573	#ifdef HAVE_EXT_CACHE
sPymbed	17:ff9d1e86ad5f	3574	WOLFSSL_SESSION* extSession;
sPymbed	17:ff9d1e86ad5f	3575	#endif
sPymbed	17:ff9d1e86ad5f	3576	WOLFSSL_ALERT_HISTORY alert_history;
sPymbed	17:ff9d1e86ad5f	3577	int error;
sPymbed	17:ff9d1e86ad5f	3578	int rfd; /* read file descriptor */
sPymbed	17:ff9d1e86ad5f	3579	int wfd; /* write file descriptor */
sPymbed	17:ff9d1e86ad5f	3580	int rflags; /* user read flags */
sPymbed	17:ff9d1e86ad5f	3581	int wflags; /* user write flags */
sPymbed	17:ff9d1e86ad5f	3582	word32 timeout; /* session timeout */
sPymbed	17:ff9d1e86ad5f	3583	word32 fragOffset; /* fragment offset */
sPymbed	17:ff9d1e86ad5f	3584	word16 curSize;
sPymbed	17:ff9d1e86ad5f	3585	byte verifyDepth;
sPymbed	17:ff9d1e86ad5f	3586	RecordLayerHeader curRL;
sPymbed	17:ff9d1e86ad5f	3587	MsgsReceived msgsReceived; /* peer messages received */
sPymbed	17:ff9d1e86ad5f	3588	ProtocolVersion version; /* negotiated version */
sPymbed	17:ff9d1e86ad5f	3589	ProtocolVersion chVersion; /* client hello version */
sPymbed	17:ff9d1e86ad5f	3590	CipherSpecs specs;
sPymbed	17:ff9d1e86ad5f	3591	Keys keys;
sPymbed	17:ff9d1e86ad5f	3592	Options options;
sPymbed	17:ff9d1e86ad5f	3593	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3594	CallbackInfoState* CBIS; /* used to get info about SSL state */
sPymbed	17:ff9d1e86ad5f	3595	int cbmode; /* read or write on info callback */
sPymbed	17:ff9d1e86ad5f	3596	int cbtype; /* event type in info callback */
sPymbed	17:ff9d1e86ad5f	3597	WOLFSSL_BIO* biord; /* socket bio read to free/close */
sPymbed	17:ff9d1e86ad5f	3598	WOLFSSL_BIO* biowr; /* socket bio write to free/close */
sPymbed	17:ff9d1e86ad5f	3599	byte sessionCtx[ID_LEN]; /* app session context ID */
sPymbed	17:ff9d1e86ad5f	3600	unsigned long peerVerifyRet;
sPymbed	17:ff9d1e86ad5f	3601	byte readAhead;
sPymbed	17:ff9d1e86ad5f	3602	byte sessionCtxSz; /* size of sessionCtx stored */
sPymbed	17:ff9d1e86ad5f	3603	#ifdef HAVE_PK_CALLBACKS
sPymbed	17:ff9d1e86ad5f	3604	void* loggingCtx; /* logging callback argument */
sPymbed	17:ff9d1e86ad5f	3605	#endif
sPymbed	17:ff9d1e86ad5f	3606	#endif /* OPENSSL_EXTRA */
sPymbed	17:ff9d1e86ad5f	3607	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	3608	RsaKey* peerRsaKey;
sPymbed	17:ff9d1e86ad5f	3609	byte peerRsaKeyPresent;
sPymbed	17:ff9d1e86ad5f	3610	#endif
sPymbed	17:ff9d1e86ad5f	3611	#ifdef HAVE_QSH
sPymbed	17:ff9d1e86ad5f	3612	QSHKey* QSH_Key;
sPymbed	17:ff9d1e86ad5f	3613	QSHKey* peerQSHKey;
sPymbed	17:ff9d1e86ad5f	3614	QSHSecret* QSH_secret;
sPymbed	17:ff9d1e86ad5f	3615	byte isQSH; /* is the handshake a QSH? */
sPymbed	17:ff9d1e86ad5f	3616	byte sendQSHKeys; /* flag for if the client should sen
sPymbed	17:ff9d1e86ad5f	3617	public keys */
sPymbed	17:ff9d1e86ad5f	3618	byte peerQSHKeyPresent;
sPymbed	17:ff9d1e86ad5f	3619	byte minRequest;
sPymbed	17:ff9d1e86ad5f	3620	byte maxRequest;
sPymbed	17:ff9d1e86ad5f	3621	byte user_set_QSHSchemes;
sPymbed	17:ff9d1e86ad5f	3622	#endif
sPymbed	17:ff9d1e86ad5f	3623	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3624	word16 namedGroup;
sPymbed	17:ff9d1e86ad5f	3625	word16 group[WOLFSSL_MAX_GROUP_COUNT];
sPymbed	17:ff9d1e86ad5f	3626	byte numGroups;
sPymbed	17:ff9d1e86ad5f	3627	#endif
sPymbed	17:ff9d1e86ad5f	3628	byte pssAlgo;
sPymbed	17:ff9d1e86ad5f	3629	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3630	#if !defined(WOLFSSL_TLS13_DRAFT_18) && !defined(WOLFSSL_TLS13_DRAFT_22)
sPymbed	17:ff9d1e86ad5f	3631	word16 certHashSigAlgoSz; /* SigAlgoCert ext length in bytes */
sPymbed	17:ff9d1e86ad5f	3632	byte certHashSigAlgo[WOLFSSL_MAX_SIGALGO]; /* cert sig/algo to
sPymbed	17:ff9d1e86ad5f	3633	* offer */
sPymbed	17:ff9d1e86ad5f	3634	#endif /* !WOLFSSL_TLS13_DRAFT_18 && !WOLFSSL_TLS13_DRAFT_22 */
sPymbed	17:ff9d1e86ad5f	3635	#endif
sPymbed	17:ff9d1e86ad5f	3636	#ifdef HAVE_NTRU
sPymbed	17:ff9d1e86ad5f	3637	word16 peerNtruKeyLen;
sPymbed	17:ff9d1e86ad5f	3638	byte peerNtruKey[MAX_NTRU_PUB_KEY_SZ];
sPymbed	17:ff9d1e86ad5f	3639	byte peerNtruKeyPresent;
sPymbed	17:ff9d1e86ad5f	3640	#endif
sPymbed	17:ff9d1e86ad5f	3641	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	3642	int eccVerifyRes;
sPymbed	17:ff9d1e86ad5f	3643	#endif
sPymbed	17:ff9d1e86ad5f	3644	#if defined(HAVE_ECC) \|\| defined(HAVE_CURVE25519)
sPymbed	17:ff9d1e86ad5f	3645	word32 ecdhCurveOID; /* curve Ecc_Sum */
sPymbed	17:ff9d1e86ad5f	3646	ecc_key* eccTempKey; /* private ECDHE key */
sPymbed	17:ff9d1e86ad5f	3647	byte eccTempKeyPresent; /* also holds type */
sPymbed	17:ff9d1e86ad5f	3648	byte peerEccKeyPresent;
sPymbed	17:ff9d1e86ad5f	3649	#endif
sPymbed	17:ff9d1e86ad5f	3650	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	3651	ecc_key* peerEccKey; /* peer's ECDHE key */
sPymbed	17:ff9d1e86ad5f	3652	ecc_key* peerEccDsaKey; /* peer's ECDSA key */
sPymbed	17:ff9d1e86ad5f	3653	word16 eccTempKeySz; /* in octets 20 - 66 */
sPymbed	17:ff9d1e86ad5f	3654	byte peerEccDsaKeyPresent;
sPymbed	17:ff9d1e86ad5f	3655	#endif
sPymbed	17:ff9d1e86ad5f	3656	#if defined(HAVE_ECC) \|\| defined(HAVE_ED25519)
sPymbed	17:ff9d1e86ad5f	3657	word32 pkCurveOID; /* curve Ecc_Sum */
sPymbed	17:ff9d1e86ad5f	3658	#endif
sPymbed	17:ff9d1e86ad5f	3659	#ifdef HAVE_ED25519
sPymbed	17:ff9d1e86ad5f	3660	ed25519_key* peerEd25519Key;
sPymbed	17:ff9d1e86ad5f	3661	byte peerEd25519KeyPresent;
sPymbed	17:ff9d1e86ad5f	3662	#endif
sPymbed	17:ff9d1e86ad5f	3663	#ifdef HAVE_CURVE25519
sPymbed	17:ff9d1e86ad5f	3664	curve25519_key* peerX25519Key;
sPymbed	17:ff9d1e86ad5f	3665	byte peerX25519KeyPresent;
sPymbed	17:ff9d1e86ad5f	3666	#endif
sPymbed	17:ff9d1e86ad5f	3667	#ifdef HAVE_LIBZ
sPymbed	17:ff9d1e86ad5f	3668	z_stream c_stream; /* compression stream */
sPymbed	17:ff9d1e86ad5f	3669	z_stream d_stream; /* decompression stream */
sPymbed	17:ff9d1e86ad5f	3670	byte didStreamInit; /* for stream init and end */
sPymbed	17:ff9d1e86ad5f	3671	#endif
sPymbed	17:ff9d1e86ad5f	3672	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	3673	int dtls_timeout_init; /* starting timeout value */
sPymbed	17:ff9d1e86ad5f	3674	int dtls_timeout_max; /* maximum timeout value */
sPymbed	17:ff9d1e86ad5f	3675	int dtls_timeout; /* current timeout value, changes */
sPymbed	17:ff9d1e86ad5f	3676	word32 dtls_tx_msg_list_sz;
sPymbed	17:ff9d1e86ad5f	3677	word32 dtls_rx_msg_list_sz;
sPymbed	17:ff9d1e86ad5f	3678	DtlsMsg* dtls_tx_msg_list;
sPymbed	17:ff9d1e86ad5f	3679	DtlsMsg* dtls_rx_msg_list;
sPymbed	17:ff9d1e86ad5f	3680	void* IOCB_CookieCtx; /* gen cookie ctx */
sPymbed	17:ff9d1e86ad5f	3681	word32 dtls_expected_rx;
sPymbed	17:ff9d1e86ad5f	3682	#ifdef WOLFSSL_SESSION_EXPORT
sPymbed	17:ff9d1e86ad5f	3683	wc_dtls_export dtls_export; /* export function for session */
sPymbed	17:ff9d1e86ad5f	3684	#endif
sPymbed	17:ff9d1e86ad5f	3685	#ifdef WOLFSSL_SCTP
sPymbed	17:ff9d1e86ad5f	3686	word16 dtlsMtuSz;
sPymbed	17:ff9d1e86ad5f	3687	#endif /* WOLFSSL_SCTP */
sPymbed	17:ff9d1e86ad5f	3688	#ifdef WOLFSSL_MULTICAST
sPymbed	17:ff9d1e86ad5f	3689	void* mcastHwCbCtx; /* Multicast highwater callback ctx */
sPymbed	17:ff9d1e86ad5f	3690	#endif /* WOLFSSL_MULTICAST */
sPymbed	17:ff9d1e86ad5f	3691	#ifdef WOLFSSL_DTLS_DROP_STATS
sPymbed	17:ff9d1e86ad5f	3692	word32 macDropCount;
sPymbed	17:ff9d1e86ad5f	3693	word32 replayDropCount;
sPymbed	17:ff9d1e86ad5f	3694	#endif /* WOLFSSL_DTLS_DROP_STATS */
sPymbed	17:ff9d1e86ad5f	3695	#endif /* WOLFSSL_DTLS */
sPymbed	17:ff9d1e86ad5f	3696	#ifdef WOLFSSL_CALLBACKS
sPymbed	17:ff9d1e86ad5f	3697	TimeoutInfo timeoutInfo; /* info saved during handshake */
sPymbed	17:ff9d1e86ad5f	3698	HandShakeInfo handShakeInfo; /* info saved during handshake */
sPymbed	17:ff9d1e86ad5f	3699	#endif
sPymbed	17:ff9d1e86ad5f	3700	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3701	SSL_Msg_Cb protoMsgCb; /* inspect protocol message callback */
sPymbed	17:ff9d1e86ad5f	3702	void* protoMsgCtx; /* user set context with msg callback */
sPymbed	17:ff9d1e86ad5f	3703	#endif
sPymbed	17:ff9d1e86ad5f	3704	#if defined(WOLFSSL_CALLBACKS) \|\| defined(OPENSSL_EXTRA)
sPymbed	17:ff9d1e86ad5f	3705	byte hsInfoOn; /* track handshake info */
sPymbed	17:ff9d1e86ad5f	3706	byte toInfoOn; /* track timeout info */
sPymbed	17:ff9d1e86ad5f	3707	#endif
sPymbed	17:ff9d1e86ad5f	3708	#ifdef HAVE_FUZZER
sPymbed	17:ff9d1e86ad5f	3709	CallbackFuzzer fuzzerCb; /* for testing with using fuzzer */
sPymbed	17:ff9d1e86ad5f	3710	void* fuzzerCtx; /* user defined pointer */
sPymbed	17:ff9d1e86ad5f	3711	#endif
sPymbed	17:ff9d1e86ad5f	3712	#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
sPymbed	17:ff9d1e86ad5f	3713	CertReqCtx* certReqCtx;
sPymbed	17:ff9d1e86ad5f	3714	#endif
sPymbed	17:ff9d1e86ad5f	3715	#ifdef KEEP_PEER_CERT
sPymbed	17:ff9d1e86ad5f	3716	WOLFSSL_X509 peerCert; /* X509 peer cert */
sPymbed	17:ff9d1e86ad5f	3717	#endif
sPymbed	17:ff9d1e86ad5f	3718	#ifdef KEEP_OUR_CERT
sPymbed	17:ff9d1e86ad5f	3719	WOLFSSL_X509* ourCert; /* keep alive a X509 struct of cert.
sPymbed	17:ff9d1e86ad5f	3720	points to ctx if not owned (owned
sPymbed	17:ff9d1e86ad5f	3721	flag found in buffers.weOwnCert) */
sPymbed	17:ff9d1e86ad5f	3722	#endif
sPymbed	17:ff9d1e86ad5f	3723	byte keepCert; /* keep certificate after handshake */
sPymbed	17:ff9d1e86ad5f	3724	#if defined(HAVE_EX_DATA) \|\| defined(FORTRESS)
sPymbed	17:ff9d1e86ad5f	3725	void* ex_data[MAX_EX_DATA]; /* external data, for Fortress */
sPymbed	17:ff9d1e86ad5f	3726	#endif
sPymbed	17:ff9d1e86ad5f	3727	int devId; /* async device id to use */
sPymbed	17:ff9d1e86ad5f	3728	#ifdef HAVE_ONE_TIME_AUTH
sPymbed	17:ff9d1e86ad5f	3729	OneTimeAuth auth;
sPymbed	17:ff9d1e86ad5f	3730	#endif
sPymbed	17:ff9d1e86ad5f	3731	#ifdef HAVE_TLS_EXTENSIONS
sPymbed	17:ff9d1e86ad5f	3732	TLSX* extensions; /* RFC 6066 TLS Extensions data */
sPymbed	17:ff9d1e86ad5f	3733	#ifdef HAVE_MAX_FRAGMENT
sPymbed	17:ff9d1e86ad5f	3734	word16 max_fragment;
sPymbed	17:ff9d1e86ad5f	3735	#endif
sPymbed	17:ff9d1e86ad5f	3736	#ifdef HAVE_TRUNCATED_HMAC
sPymbed	17:ff9d1e86ad5f	3737	byte truncated_hmac;
sPymbed	17:ff9d1e86ad5f	3738	#endif
sPymbed	17:ff9d1e86ad5f	3739	#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
sPymbed	17:ff9d1e86ad5f	3740	byte status_request;
sPymbed	17:ff9d1e86ad5f	3741	#endif
sPymbed	17:ff9d1e86ad5f	3742	#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
sPymbed	17:ff9d1e86ad5f	3743	byte status_request_v2;
sPymbed	17:ff9d1e86ad5f	3744	#endif
sPymbed	17:ff9d1e86ad5f	3745	#if defined(HAVE_SECURE_RENEGOTIATION) \
sPymbed	17:ff9d1e86ad5f	3746	\|\| defined(HAVE_SERVER_RENEGOTIATION_INFO)
sPymbed	17:ff9d1e86ad5f	3747	SecureRenegotiation* secure_renegotiation; /* valid pointer indicates */
sPymbed	17:ff9d1e86ad5f	3748	#endif /* user turned on */
sPymbed	17:ff9d1e86ad5f	3749	#ifdef HAVE_ALPN
sPymbed	17:ff9d1e86ad5f	3750	char* alpn_client_list; /* keep the client's list */
sPymbed	17:ff9d1e86ad5f	3751	#if defined(OPENSSL_ALL) \|\| defined(WOLFSSL_NGINX) \|\| defined(WOLFSSL_HAPROXY)
sPymbed	17:ff9d1e86ad5f	3752	CallbackALPNSelect alpnSelect;
sPymbed	17:ff9d1e86ad5f	3753	void* alpnSelectArg;
sPymbed	17:ff9d1e86ad5f	3754	#endif
sPymbed	17:ff9d1e86ad5f	3755	#endif /* of accepted protocols */
sPymbed	17:ff9d1e86ad5f	3756	#if !defined(NO_WOLFSSL_CLIENT) && defined(HAVE_SESSION_TICKET)
sPymbed	17:ff9d1e86ad5f	3757	CallbackSessionTicket session_ticket_cb;
sPymbed	17:ff9d1e86ad5f	3758	void* session_ticket_ctx;
sPymbed	17:ff9d1e86ad5f	3759	byte expect_session_ticket;
sPymbed	17:ff9d1e86ad5f	3760	#endif
sPymbed	17:ff9d1e86ad5f	3761	#endif /* HAVE_TLS_EXTENSIONS */
sPymbed	17:ff9d1e86ad5f	3762	#ifdef HAVE_OCSP
sPymbed	17:ff9d1e86ad5f	3763	void* ocspIOCtx;
sPymbed	17:ff9d1e86ad5f	3764	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3765	byte* ocspResp;
sPymbed	17:ff9d1e86ad5f	3766	int ocspRespSz;
sPymbed	17:ff9d1e86ad5f	3767	#if defined(OPENSSL_ALL) \|\| defined(WOLFSSL_NGINX) \|\| defined(WOLFSSL_HAPROXY)
sPymbed	17:ff9d1e86ad5f	3768	char* url;
sPymbed	17:ff9d1e86ad5f	3769	#endif
sPymbed	17:ff9d1e86ad5f	3770	#endif
sPymbed	17:ff9d1e86ad5f	3771	#endif
sPymbed	17:ff9d1e86ad5f	3772	#ifdef HAVE_NETX
sPymbed	17:ff9d1e86ad5f	3773	NetX_Ctx nxCtx; /* NetX IO Context */
sPymbed	17:ff9d1e86ad5f	3774	#endif
sPymbed	17:ff9d1e86ad5f	3775	#ifdef SESSION_INDEX
sPymbed	17:ff9d1e86ad5f	3776	int sessionIndex; /* Session's location in the cache. */
sPymbed	17:ff9d1e86ad5f	3777	#endif
sPymbed	17:ff9d1e86ad5f	3778	#ifdef ATOMIC_USER
sPymbed	17:ff9d1e86ad5f	3779	void* MacEncryptCtx; /* Atomic User Mac/Encrypt Callback Context */
sPymbed	17:ff9d1e86ad5f	3780	void* DecryptVerifyCtx; /* Atomic User Decrypt/Verify Callback Context */
sPymbed	17:ff9d1e86ad5f	3781	#endif
sPymbed	17:ff9d1e86ad5f	3782	#ifdef HAVE_PK_CALLBACKS
sPymbed	17:ff9d1e86ad5f	3783	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	3784	void* EccKeyGenCtx; /* EccKeyGen Callback Context */
sPymbed	17:ff9d1e86ad5f	3785	void* EccSignCtx; /* Ecc Sign Callback Context */
sPymbed	17:ff9d1e86ad5f	3786	void* EccVerifyCtx; /* Ecc Verify Callback Context */
sPymbed	17:ff9d1e86ad5f	3787	void* EccSharedSecretCtx; /* Ecc Pms Callback Context */
sPymbed	17:ff9d1e86ad5f	3788	#ifdef HAVE_ED25519
sPymbed	17:ff9d1e86ad5f	3789	void* Ed25519SignCtx; /* ED25519 Sign Callback Context */
sPymbed	17:ff9d1e86ad5f	3790	void* Ed25519VerifyCtx; /* ED25519 Verify Callback Context */
sPymbed	17:ff9d1e86ad5f	3791	#endif
sPymbed	17:ff9d1e86ad5f	3792	#ifdef HAVE_CURVE25519
sPymbed	17:ff9d1e86ad5f	3793	void* X25519KeyGenCtx; /* X25519 KeyGen Callback Context */
sPymbed	17:ff9d1e86ad5f	3794	void* X25519SharedSecretCtx; /* X25519 Pms Callback Context */
sPymbed	17:ff9d1e86ad5f	3795	#endif
sPymbed	17:ff9d1e86ad5f	3796	#endif /* HAVE_ECC */
sPymbed	17:ff9d1e86ad5f	3797	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	3798	void* DhAgreeCtx; /* DH Pms Callback Context */
sPymbed	17:ff9d1e86ad5f	3799	#endif /* !NO_DH */
sPymbed	17:ff9d1e86ad5f	3800	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	3801	void* RsaSignCtx; /* Rsa Sign Callback Context */
sPymbed	17:ff9d1e86ad5f	3802	void* RsaVerifyCtx; /* Rsa Verify Callback Context */
sPymbed	17:ff9d1e86ad5f	3803	#ifdef WC_RSA_PSS
sPymbed	17:ff9d1e86ad5f	3804	void* RsaPssSignCtx; /* Rsa PSS Sign Callback Context */
sPymbed	17:ff9d1e86ad5f	3805	void* RsaPssVerifyCtx; /* Rsa PSS Verify Callback Context */
sPymbed	17:ff9d1e86ad5f	3806	#endif
sPymbed	17:ff9d1e86ad5f	3807	void* RsaEncCtx; /* Rsa Public Encrypt Callback Context */
sPymbed	17:ff9d1e86ad5f	3808	void* RsaDecCtx; /* Rsa Private Decrypt Callback Context */
sPymbed	17:ff9d1e86ad5f	3809	#endif /* NO_RSA */
sPymbed	17:ff9d1e86ad5f	3810	#endif /* HAVE_PK_CALLBACKS */
sPymbed	17:ff9d1e86ad5f	3811	#ifdef HAVE_SECRET_CALLBACK
sPymbed	17:ff9d1e86ad5f	3812	SessionSecretCb sessionSecretCb;
sPymbed	17:ff9d1e86ad5f	3813	void* sessionSecretCtx;
sPymbed	17:ff9d1e86ad5f	3814	#endif /* HAVE_SECRET_CALLBACK */
sPymbed	17:ff9d1e86ad5f	3815	#ifdef WOLFSSL_JNI
sPymbed	17:ff9d1e86ad5f	3816	void* jObjectRef; /* reference to WolfSSLSession in JNI wrapper */
sPymbed	17:ff9d1e86ad5f	3817	#endif /* WOLFSSL_JNI */
sPymbed	17:ff9d1e86ad5f	3818	#ifdef WOLFSSL_EARLY_DATA
sPymbed	17:ff9d1e86ad5f	3819	EarlyDataState earlyData;
sPymbed	17:ff9d1e86ad5f	3820	word32 earlyDataSz;
sPymbed	17:ff9d1e86ad5f	3821	#endif
sPymbed	17:ff9d1e86ad5f	3822	};
sPymbed	17:ff9d1e86ad5f	3823
sPymbed	17:ff9d1e86ad5f	3824
sPymbed	17:ff9d1e86ad5f	3825	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3826	int SetSSL_CTX(WOLFSSL, WOLFSSL_CTX, int);
sPymbed	17:ff9d1e86ad5f	3827	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3828	int InitSSL(WOLFSSL, WOLFSSL_CTX, int);
sPymbed	17:ff9d1e86ad5f	3829	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3830	void FreeSSL(WOLFSSL, void heap);
sPymbed	17:ff9d1e86ad5f	3831	WOLFSSL_API void SSL_ResourceFree(WOLFSSL); / Micrium uses */
sPymbed	17:ff9d1e86ad5f	3832
sPymbed	17:ff9d1e86ad5f	3833
sPymbed	17:ff9d1e86ad5f	3834
sPymbed	17:ff9d1e86ad5f	3835	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	3836
sPymbed	17:ff9d1e86ad5f	3837	WOLFSSL_LOCAL int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff,
sPymbed	17:ff9d1e86ad5f	3838	long sz, int format, int type, WOLFSSL* ssl,
sPymbed	17:ff9d1e86ad5f	3839	long* used, int userChain);
sPymbed	17:ff9d1e86ad5f	3840	WOLFSSL_LOCAL int ProcessFile(WOLFSSL_CTX* ctx, const char* fname, int format,
sPymbed	17:ff9d1e86ad5f	3841	int type, WOLFSSL* ssl, int userChain,
sPymbed	17:ff9d1e86ad5f	3842	WOLFSSL_CRL* crl);
sPymbed	17:ff9d1e86ad5f	3843
sPymbed	17:ff9d1e86ad5f	3844	#ifdef OPENSSL_EXTRA
sPymbed	17:ff9d1e86ad5f	3845	WOLFSSL_LOCAL int CheckHostName(DecodedCert* dCert, char *domainName,
sPymbed	17:ff9d1e86ad5f	3846	size_t domainNameLen);
sPymbed	17:ff9d1e86ad5f	3847	#endif
sPymbed	17:ff9d1e86ad5f	3848	#endif
sPymbed	17:ff9d1e86ad5f	3849
sPymbed	17:ff9d1e86ad5f	3850
sPymbed	17:ff9d1e86ad5f	3851	#if defined(WOLFSSL_CALLBACKS) \|\| defined(OPENSSL_EXTRA)
sPymbed	17:ff9d1e86ad5f	3852	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3853	void InitHandShakeInfo(HandShakeInfo, WOLFSSL);
sPymbed	17:ff9d1e86ad5f	3854	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3855	void FinishHandShakeInfo(HandShakeInfo*);
sPymbed	17:ff9d1e86ad5f	3856	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3857	void AddPacketName(WOLFSSL* ssl, const char* name);
sPymbed	17:ff9d1e86ad5f	3858
sPymbed	17:ff9d1e86ad5f	3859	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3860	void InitTimeoutInfo(TimeoutInfo*);
sPymbed	17:ff9d1e86ad5f	3861	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3862	void FreeTimeoutInfo(TimeoutInfo, void);
sPymbed	17:ff9d1e86ad5f	3863	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3864	void AddPacketInfo(WOLFSSL* ssl, const char* name, int type,
sPymbed	17:ff9d1e86ad5f	3865	const byte* data, int sz, int write, void* heap);
sPymbed	17:ff9d1e86ad5f	3866	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3867	void AddLateName(const char, TimeoutInfo);
sPymbed	17:ff9d1e86ad5f	3868	WOLFSSL_LOCAL
sPymbed	17:ff9d1e86ad5f	3869	void AddLateRecordHeader(const RecordLayerHeader* rl, TimeoutInfo* info);
sPymbed	17:ff9d1e86ad5f	3870	#endif
sPymbed	17:ff9d1e86ad5f	3871
sPymbed	17:ff9d1e86ad5f	3872
sPymbed	17:ff9d1e86ad5f	3873	/* Record Layer Header identifier from page 12 */
sPymbed	17:ff9d1e86ad5f	3874	enum ContentType {
sPymbed	17:ff9d1e86ad5f	3875	no_type = 0,
sPymbed	17:ff9d1e86ad5f	3876	change_cipher_spec = 20,
sPymbed	17:ff9d1e86ad5f	3877	alert = 21,
sPymbed	17:ff9d1e86ad5f	3878	handshake = 22,
sPymbed	17:ff9d1e86ad5f	3879	application_data = 23
sPymbed	17:ff9d1e86ad5f	3880	};
sPymbed	17:ff9d1e86ad5f	3881
sPymbed	17:ff9d1e86ad5f	3882
sPymbed	17:ff9d1e86ad5f	3883	/* handshake header, same for each message type, pgs 20/21 */
sPymbed	17:ff9d1e86ad5f	3884	typedef struct HandShakeHeader {
sPymbed	17:ff9d1e86ad5f	3885	byte type;
sPymbed	17:ff9d1e86ad5f	3886	word24 length;
sPymbed	17:ff9d1e86ad5f	3887	} HandShakeHeader;
sPymbed	17:ff9d1e86ad5f	3888
sPymbed	17:ff9d1e86ad5f	3889
sPymbed	17:ff9d1e86ad5f	3890	/* DTLS handshake header, same for each message type */
sPymbed	17:ff9d1e86ad5f	3891	typedef struct DtlsHandShakeHeader {
sPymbed	17:ff9d1e86ad5f	3892	byte type;
sPymbed	17:ff9d1e86ad5f	3893	word24 length;
sPymbed	17:ff9d1e86ad5f	3894	byte message_seq[2]; /* start at 0, retransmit gets same # */
sPymbed	17:ff9d1e86ad5f	3895	word24 fragment_offset; /* bytes in previous fragments */
sPymbed	17:ff9d1e86ad5f	3896	word24 fragment_length; /* length of this fragment */
sPymbed	17:ff9d1e86ad5f	3897	} DtlsHandShakeHeader;
sPymbed	17:ff9d1e86ad5f	3898
sPymbed	17:ff9d1e86ad5f	3899
sPymbed	17:ff9d1e86ad5f	3900	enum HandShakeType {
sPymbed	17:ff9d1e86ad5f	3901	hello_request = 0,
sPymbed	17:ff9d1e86ad5f	3902	client_hello = 1,
sPymbed	17:ff9d1e86ad5f	3903	server_hello = 2,
sPymbed	17:ff9d1e86ad5f	3904	hello_verify_request = 3, /* DTLS addition */
sPymbed	17:ff9d1e86ad5f	3905	session_ticket = 4,
sPymbed	17:ff9d1e86ad5f	3906	end_of_early_data = 5,
sPymbed	17:ff9d1e86ad5f	3907	hello_retry_request = 6,
sPymbed	17:ff9d1e86ad5f	3908	encrypted_extensions = 8,
sPymbed	17:ff9d1e86ad5f	3909	certificate = 11,
sPymbed	17:ff9d1e86ad5f	3910	server_key_exchange = 12,
sPymbed	17:ff9d1e86ad5f	3911	certificate_request = 13,
sPymbed	17:ff9d1e86ad5f	3912	server_hello_done = 14,
sPymbed	17:ff9d1e86ad5f	3913	certificate_verify = 15,
sPymbed	17:ff9d1e86ad5f	3914	client_key_exchange = 16,
sPymbed	17:ff9d1e86ad5f	3915	finished = 20,
sPymbed	17:ff9d1e86ad5f	3916	certificate_status = 22,
sPymbed	17:ff9d1e86ad5f	3917	key_update = 24,
sPymbed	17:ff9d1e86ad5f	3918	change_cipher_hs = 55, /* simulate unique handshake type for sanity
sPymbed	17:ff9d1e86ad5f	3919	checks. record layer change_cipher
sPymbed	17:ff9d1e86ad5f	3920	conflicts with handshake finished */
sPymbed	17:ff9d1e86ad5f	3921	message_hash = 254, /* synthetic message type for TLS v1.3 */
sPymbed	17:ff9d1e86ad5f	3922	no_shake = 255 /* used to initialize the DtlsMsg record */
sPymbed	17:ff9d1e86ad5f	3923	};
sPymbed	17:ff9d1e86ad5f	3924
sPymbed	17:ff9d1e86ad5f	3925	enum ProvisionSide {
sPymbed	17:ff9d1e86ad5f	3926	PROVISION_CLIENT = 1,
sPymbed	17:ff9d1e86ad5f	3927	PROVISION_SERVER = 2,
sPymbed	17:ff9d1e86ad5f	3928	PROVISION_CLIENT_SERVER = 3
sPymbed	17:ff9d1e86ad5f	3929	};
sPymbed	17:ff9d1e86ad5f	3930
sPymbed	17:ff9d1e86ad5f	3931
sPymbed	17:ff9d1e86ad5f	3932	static const byte client[SIZEOF_SENDER] = { 0x43, 0x4C, 0x4E, 0x54 };
sPymbed	17:ff9d1e86ad5f	3933	static const byte server[SIZEOF_SENDER] = { 0x53, 0x52, 0x56, 0x52 };
sPymbed	17:ff9d1e86ad5f	3934
sPymbed	17:ff9d1e86ad5f	3935	static const byte tls_client[FINISHED_LABEL_SZ + 1] = "client finished";
sPymbed	17:ff9d1e86ad5f	3936	static const byte tls_server[FINISHED_LABEL_SZ + 1] = "server finished";
sPymbed	17:ff9d1e86ad5f	3937
sPymbed	17:ff9d1e86ad5f	3938
sPymbed	17:ff9d1e86ad5f	3939	/* internal functions */
sPymbed	17:ff9d1e86ad5f	3940	WOLFSSL_LOCAL int SendChangeCipher(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3941	WOLFSSL_LOCAL int SendTicket(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3942	WOLFSSL_LOCAL int DoClientTicket(WOLFSSL, const byte, word32);
sPymbed	17:ff9d1e86ad5f	3943	WOLFSSL_LOCAL int SendData(WOLFSSL, const void, int);
sPymbed	17:ff9d1e86ad5f	3944	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	3945	#ifdef WOLFSSL_TLS13_DRAFT_18
sPymbed	17:ff9d1e86ad5f	3946	WOLFSSL_LOCAL int SendTls13HelloRetryRequest(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3947	#else
sPymbed	17:ff9d1e86ad5f	3948	WOLFSSL_LOCAL int SendTls13ServerHello(WOLFSSL*, byte);
sPymbed	17:ff9d1e86ad5f	3949	#endif
sPymbed	17:ff9d1e86ad5f	3950	#endif
sPymbed	17:ff9d1e86ad5f	3951	WOLFSSL_LOCAL int SendCertificate(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3952	WOLFSSL_LOCAL int SendCertificateRequest(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3953	#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
sPymbed	17:ff9d1e86ad5f	3954	\|\| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
sPymbed	17:ff9d1e86ad5f	3955	WOLFSSL_LOCAL int CreateOcspResponse(WOLFSSL, OcspRequest, buffer);
sPymbed	17:ff9d1e86ad5f	3956	#endif
sPymbed	17:ff9d1e86ad5f	3957	WOLFSSL_LOCAL int SendCertificateStatus(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3958	WOLFSSL_LOCAL int SendServerKeyExchange(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3959	WOLFSSL_LOCAL int SendBuffered(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3960	WOLFSSL_LOCAL int ReceiveData(WOLFSSL, byte, int, int);
sPymbed	17:ff9d1e86ad5f	3961	WOLFSSL_LOCAL int SendFinished(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3962	WOLFSSL_LOCAL int SendAlert(WOLFSSL*, int, int);
sPymbed	17:ff9d1e86ad5f	3963	WOLFSSL_LOCAL int ProcessReply(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3964
sPymbed	17:ff9d1e86ad5f	3965	WOLFSSL_LOCAL int SetCipherSpecs(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3966	WOLFSSL_LOCAL int MakeMasterSecret(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3967
sPymbed	17:ff9d1e86ad5f	3968	WOLFSSL_LOCAL int AddSession(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	3969	WOLFSSL_LOCAL int DeriveKeys(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3970	WOLFSSL_LOCAL int StoreKeys(WOLFSSL* ssl, const byte* keyData, int side);
sPymbed	17:ff9d1e86ad5f	3971
sPymbed	17:ff9d1e86ad5f	3972	WOLFSSL_LOCAL int IsTLS(const WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3973	WOLFSSL_LOCAL int IsAtLeastTLSv1_2(const WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3974	WOLFSSL_LOCAL int IsAtLeastTLSv1_3(const ProtocolVersion pv);
sPymbed	17:ff9d1e86ad5f	3975
sPymbed	17:ff9d1e86ad5f	3976	WOLFSSL_LOCAL void FreeHandshakeResources(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3977	WOLFSSL_LOCAL void ShrinkInputBuffer(WOLFSSL* ssl, int forcedFree);
sPymbed	17:ff9d1e86ad5f	3978	WOLFSSL_LOCAL void ShrinkOutputBuffer(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3979
sPymbed	17:ff9d1e86ad5f	3980	WOLFSSL_LOCAL int VerifyClientSuite(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	3981
sPymbed	17:ff9d1e86ad5f	3982	WOLFSSL_LOCAL int SetTicket(WOLFSSL, const byte, word32);
sPymbed	17:ff9d1e86ad5f	3983	WOLFSSL_LOCAL int wolfSSL_GetMaxRecordSize(WOLFSSL* ssl, int maxFragment);
sPymbed	17:ff9d1e86ad5f	3984
sPymbed	17:ff9d1e86ad5f	3985	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	3986	#ifndef NO_RSA
sPymbed	17:ff9d1e86ad5f	3987	#ifdef WC_RSA_PSS
sPymbed	17:ff9d1e86ad5f	3988	WOLFSSL_LOCAL int CheckRsaPssPadding(const byte* plain, word32 plainSz,
sPymbed	17:ff9d1e86ad5f	3989	byte* out, word32 sigSz, enum wc_HashType hashType);
sPymbed	17:ff9d1e86ad5f	3990	WOLFSSL_LOCAL int ConvertHashPss(int hashAlgo,
sPymbed	17:ff9d1e86ad5f	3991	enum wc_HashType* hashType, int* mgf);
sPymbed	17:ff9d1e86ad5f	3992	#endif
sPymbed	17:ff9d1e86ad5f	3993	WOLFSSL_LOCAL int VerifyRsaSign(WOLFSSL* ssl, byte* verifySig,
sPymbed	17:ff9d1e86ad5f	3994	word32 sigSz, const byte* plain, word32 plainSz, int sigAlgo,
sPymbed	17:ff9d1e86ad5f	3995	int hashAlgo, RsaKey* key, DerBuffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	3996	WOLFSSL_LOCAL int RsaSign(WOLFSSL* ssl, const byte* in, word32 inSz,
sPymbed	17:ff9d1e86ad5f	3997	byte* out, word32* outSz, int sigAlgo, int hashAlgo, RsaKey* key,
sPymbed	17:ff9d1e86ad5f	3998	DerBuffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	3999	WOLFSSL_LOCAL int RsaVerify(WOLFSSL* ssl, byte* in, word32 inSz,
sPymbed	17:ff9d1e86ad5f	4000	byte** out, int sigAlgo, int hashAlgo, RsaKey* key,
sPymbed	17:ff9d1e86ad5f	4001	buffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4002	WOLFSSL_LOCAL int RsaDec(WOLFSSL* ssl, byte* in, word32 inSz, byte** out,
sPymbed	17:ff9d1e86ad5f	4003	word32* outSz, RsaKey* key, DerBuffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4004	WOLFSSL_LOCAL int RsaEnc(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out,
sPymbed	17:ff9d1e86ad5f	4005	word32* outSz, RsaKey* key, buffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4006	#endif /* !NO_RSA */
sPymbed	17:ff9d1e86ad5f	4007
sPymbed	17:ff9d1e86ad5f	4008	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	4009	WOLFSSL_LOCAL int EccSign(WOLFSSL* ssl, const byte* in, word32 inSz,
sPymbed	17:ff9d1e86ad5f	4010	byte* out, word32* outSz, ecc_key* key, DerBuffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4011	WOLFSSL_LOCAL int EccVerify(WOLFSSL* ssl, const byte* in, word32 inSz,
sPymbed	17:ff9d1e86ad5f	4012	const byte* out, word32 outSz, ecc_key* key, buffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4013	WOLFSSL_LOCAL int EccSharedSecret(WOLFSSL* ssl, ecc_key* priv_key,
sPymbed	17:ff9d1e86ad5f	4014	ecc_key* pub_key, byte* pubKeyDer, word32* pubKeySz, byte* out,
sPymbed	17:ff9d1e86ad5f	4015	word32* outlen, int side);
sPymbed	17:ff9d1e86ad5f	4016	#endif /* HAVE_ECC */
sPymbed	17:ff9d1e86ad5f	4017	#ifdef HAVE_ED25519
sPymbed	17:ff9d1e86ad5f	4018	WOLFSSL_LOCAL int Ed25519CheckPubKey(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	4019	WOLFSSL_LOCAL int Ed25519Sign(WOLFSSL* ssl, const byte* in, word32 inSz,
sPymbed	17:ff9d1e86ad5f	4020	byte* out, word32* outSz, ed25519_key* key, DerBuffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4021	WOLFSSL_LOCAL int Ed25519Verify(WOLFSSL* ssl, const byte* in,
sPymbed	17:ff9d1e86ad5f	4022	word32 inSz, const byte* msg, word32 msgSz, ed25519_key* key,
sPymbed	17:ff9d1e86ad5f	4023	buffer* keyBufInfo);
sPymbed	17:ff9d1e86ad5f	4024	#endif /* HAVE_ED25519 */
sPymbed	17:ff9d1e86ad5f	4025
sPymbed	17:ff9d1e86ad5f	4026
sPymbed	17:ff9d1e86ad5f	4027	#ifdef WOLFSSL_TRUST_PEER_CERT
sPymbed	17:ff9d1e86ad5f	4028
sPymbed	17:ff9d1e86ad5f	4029	/* options for searching hash table for a matching trusted peer cert */
sPymbed	17:ff9d1e86ad5f	4030	#define WC_MATCH_SKID 0
sPymbed	17:ff9d1e86ad5f	4031	#define WC_MATCH_NAME 1
sPymbed	17:ff9d1e86ad5f	4032
sPymbed	17:ff9d1e86ad5f	4033	WOLFSSL_LOCAL TrustedPeerCert* GetTrustedPeer(void* vp, byte* hash,
sPymbed	17:ff9d1e86ad5f	4034	int type);
sPymbed	17:ff9d1e86ad5f	4035	WOLFSSL_LOCAL int MatchTrustedPeer(TrustedPeerCert* tp,
sPymbed	17:ff9d1e86ad5f	4036	DecodedCert* cert);
sPymbed	17:ff9d1e86ad5f	4037	#endif
sPymbed	17:ff9d1e86ad5f	4038
sPymbed	17:ff9d1e86ad5f	4039	WOLFSSL_LOCAL Signer* GetCA(void* cm, byte* hash);
sPymbed	17:ff9d1e86ad5f	4040	#ifndef NO_SKID
sPymbed	17:ff9d1e86ad5f	4041	WOLFSSL_LOCAL Signer* GetCAByName(void* cm, byte* hash);
sPymbed	17:ff9d1e86ad5f	4042	#endif
sPymbed	17:ff9d1e86ad5f	4043	#endif /* !NO_CERTS */
sPymbed	17:ff9d1e86ad5f	4044	WOLFSSL_LOCAL int BuildTlsHandshakeHash(WOLFSSL* ssl, byte* hash,
sPymbed	17:ff9d1e86ad5f	4045	word32* hashLen);
sPymbed	17:ff9d1e86ad5f	4046	WOLFSSL_LOCAL int BuildTlsFinished(WOLFSSL* ssl, Hashes* hashes,
sPymbed	17:ff9d1e86ad5f	4047	const byte* sender);
sPymbed	17:ff9d1e86ad5f	4048	WOLFSSL_LOCAL void FreeArrays(WOLFSSL* ssl, int keep);
sPymbed	17:ff9d1e86ad5f	4049	WOLFSSL_LOCAL int CheckAvailableSize(WOLFSSL *ssl, int size);
sPymbed	17:ff9d1e86ad5f	4050	WOLFSSL_LOCAL int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength);
sPymbed	17:ff9d1e86ad5f	4051
sPymbed	17:ff9d1e86ad5f	4052	#ifndef NO_TLS
sPymbed	17:ff9d1e86ad5f	4053	WOLFSSL_LOCAL int MakeTlsMasterSecret(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4054	WOLFSSL_LOCAL int TLS_hmac(WOLFSSL* ssl, byte* digest, const byte* in,
sPymbed	17:ff9d1e86ad5f	4055	word32 sz, int padSz, int content, int verify);
sPymbed	17:ff9d1e86ad5f	4056	#endif
sPymbed	17:ff9d1e86ad5f	4057
sPymbed	17:ff9d1e86ad5f	4058	#ifndef NO_WOLFSSL_CLIENT
sPymbed	17:ff9d1e86ad5f	4059	WOLFSSL_LOCAL int SendClientHello(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4060	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	4061	WOLFSSL_LOCAL int SendTls13ClientHello(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4062	#endif
sPymbed	17:ff9d1e86ad5f	4063	WOLFSSL_LOCAL int SendClientKeyExchange(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4064	WOLFSSL_LOCAL int SendCertificateVerify(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4065	#endif /* NO_WOLFSSL_CLIENT */
sPymbed	17:ff9d1e86ad5f	4066
sPymbed	17:ff9d1e86ad5f	4067	#ifndef NO_WOLFSSL_SERVER
sPymbed	17:ff9d1e86ad5f	4068	WOLFSSL_LOCAL int SendServerHello(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4069	WOLFSSL_LOCAL int SendServerHelloDone(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4070	#endif /* NO_WOLFSSL_SERVER */
sPymbed	17:ff9d1e86ad5f	4071
sPymbed	17:ff9d1e86ad5f	4072	#ifdef WOLFSSL_DTLS
sPymbed	17:ff9d1e86ad5f	4073	WOLFSSL_LOCAL DtlsMsg* DtlsMsgNew(word32, void*);
sPymbed	17:ff9d1e86ad5f	4074	WOLFSSL_LOCAL void DtlsMsgDelete(DtlsMsg, void);
sPymbed	17:ff9d1e86ad5f	4075	WOLFSSL_LOCAL void DtlsMsgListDelete(DtlsMsg, void);
sPymbed	17:ff9d1e86ad5f	4076	WOLFSSL_LOCAL int DtlsMsgSet(DtlsMsg, word32, const byte, byte,
sPymbed	17:ff9d1e86ad5f	4077	word32, word32, void*);
sPymbed	17:ff9d1e86ad5f	4078	WOLFSSL_LOCAL DtlsMsg* DtlsMsgFind(DtlsMsg*, word32);
sPymbed	17:ff9d1e86ad5f	4079	WOLFSSL_LOCAL void DtlsMsgStore(WOLFSSL, word32, const byte, word32,
sPymbed	17:ff9d1e86ad5f	4080	byte, word32, word32, void*);
sPymbed	17:ff9d1e86ad5f	4081	WOLFSSL_LOCAL DtlsMsg* DtlsMsgInsert(DtlsMsg, DtlsMsg);
sPymbed	17:ff9d1e86ad5f	4082
sPymbed	17:ff9d1e86ad5f	4083	WOLFSSL_LOCAL int DtlsMsgPoolSave(WOLFSSL, const byte, word32);
sPymbed	17:ff9d1e86ad5f	4084	WOLFSSL_LOCAL int DtlsMsgPoolTimeout(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4085	WOLFSSL_LOCAL int VerifyForDtlsMsgPoolSend(WOLFSSL*, byte, word32);
sPymbed	17:ff9d1e86ad5f	4086	WOLFSSL_LOCAL void DtlsMsgPoolReset(WOLFSSL*);
sPymbed	17:ff9d1e86ad5f	4087	WOLFSSL_LOCAL int DtlsMsgPoolSend(WOLFSSL*, int);
sPymbed	17:ff9d1e86ad5f	4088	#endif /* WOLFSSL_DTLS */
sPymbed	17:ff9d1e86ad5f	4089
sPymbed	17:ff9d1e86ad5f	4090	#ifndef NO_TLS
sPymbed	17:ff9d1e86ad5f	4091
sPymbed	17:ff9d1e86ad5f	4092
sPymbed	17:ff9d1e86ad5f	4093	#endif /* NO_TLS */
sPymbed	17:ff9d1e86ad5f	4094
sPymbed	17:ff9d1e86ad5f	4095	#if defined(WOLFSSL_TLS13) && (defined(HAVE_SESSION_TICKET) \|\| !defined(NO_PSK))
sPymbed	17:ff9d1e86ad5f	4096	WOLFSSL_LOCAL word32 TimeNowInMilliseconds(void);
sPymbed	17:ff9d1e86ad5f	4097	#endif
sPymbed	17:ff9d1e86ad5f	4098	WOLFSSL_LOCAL word32 LowResTimer(void);
sPymbed	17:ff9d1e86ad5f	4099
sPymbed	17:ff9d1e86ad5f	4100	#ifndef NO_CERTS
sPymbed	17:ff9d1e86ad5f	4101	WOLFSSL_LOCAL void InitX509Name(WOLFSSL_X509_NAME*, int);
sPymbed	17:ff9d1e86ad5f	4102	WOLFSSL_LOCAL void FreeX509Name(WOLFSSL_X509_NAME* name, void* heap);
sPymbed	17:ff9d1e86ad5f	4103	WOLFSSL_LOCAL void InitX509(WOLFSSL_X509, int, void heap);
sPymbed	17:ff9d1e86ad5f	4104	WOLFSSL_LOCAL void FreeX509(WOLFSSL_X509*);
sPymbed	17:ff9d1e86ad5f	4105	WOLFSSL_LOCAL int CopyDecodedToX509(WOLFSSL_X509, DecodedCert);
sPymbed	17:ff9d1e86ad5f	4106	#endif
sPymbed	17:ff9d1e86ad5f	4107
sPymbed	17:ff9d1e86ad5f	4108	typedef struct CipherSuiteInfo {
sPymbed	17:ff9d1e86ad5f	4109	const char* name;
sPymbed	17:ff9d1e86ad5f	4110	#ifndef NO_ERROR_STRINGS
sPymbed	17:ff9d1e86ad5f	4111	const char* name_iana;
sPymbed	17:ff9d1e86ad5f	4112	#endif
sPymbed	17:ff9d1e86ad5f	4113	byte cipherSuite0;
sPymbed	17:ff9d1e86ad5f	4114	byte cipherSuite;
sPymbed	17:ff9d1e86ad5f	4115	} CipherSuiteInfo;
sPymbed	17:ff9d1e86ad5f	4116
sPymbed	17:ff9d1e86ad5f	4117	WOLFSSL_LOCAL const CipherSuiteInfo* GetCipherNames(void);
sPymbed	17:ff9d1e86ad5f	4118	WOLFSSL_LOCAL int GetCipherNamesSize(void);
sPymbed	17:ff9d1e86ad5f	4119	WOLFSSL_LOCAL const char* GetCipherNameInternal(const byte cipherSuite0, const byte cipherSuite);
sPymbed	17:ff9d1e86ad5f	4120	WOLFSSL_LOCAL const char* GetCipherNameIana(const byte cipherSuite0, const byte cipherSuite);
sPymbed	17:ff9d1e86ad5f	4121	WOLFSSL_LOCAL const char* wolfSSL_get_cipher_name_internal(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	4122	WOLFSSL_LOCAL const char* wolfSSL_get_cipher_name_iana(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	4123
sPymbed	17:ff9d1e86ad5f	4124	enum encrypt_side {
sPymbed	17:ff9d1e86ad5f	4125	ENCRYPT_SIDE_ONLY = 1,
sPymbed	17:ff9d1e86ad5f	4126	DECRYPT_SIDE_ONLY,
sPymbed	17:ff9d1e86ad5f	4127	ENCRYPT_AND_DECRYPT_SIDE
sPymbed	17:ff9d1e86ad5f	4128	};
sPymbed	17:ff9d1e86ad5f	4129
sPymbed	17:ff9d1e86ad5f	4130	WOLFSSL_LOCAL int SetKeysSide(WOLFSSL*, enum encrypt_side);
sPymbed	17:ff9d1e86ad5f	4131
sPymbed	17:ff9d1e86ad5f	4132
sPymbed	17:ff9d1e86ad5f	4133	#ifndef NO_DH
sPymbed	17:ff9d1e86ad5f	4134	WOLFSSL_LOCAL int DhGenKeyPair(WOLFSSL* ssl, DhKey* dhKey,
sPymbed	17:ff9d1e86ad5f	4135	byte* priv, word32* privSz,
sPymbed	17:ff9d1e86ad5f	4136	byte* pub, word32* pubSz);
sPymbed	17:ff9d1e86ad5f	4137	WOLFSSL_LOCAL int DhAgree(WOLFSSL* ssl, DhKey* dhKey,
sPymbed	17:ff9d1e86ad5f	4138	const byte* priv, word32 privSz,
sPymbed	17:ff9d1e86ad5f	4139	const byte* otherPub, word32 otherPubSz,
sPymbed	17:ff9d1e86ad5f	4140	byte* agree, word32* agreeSz);
sPymbed	17:ff9d1e86ad5f	4141	#endif /* !NO_DH */
sPymbed	17:ff9d1e86ad5f	4142
sPymbed	17:ff9d1e86ad5f	4143	#ifdef HAVE_ECC
sPymbed	17:ff9d1e86ad5f	4144	WOLFSSL_LOCAL int EccMakeKey(WOLFSSL* ssl, ecc_key* key, ecc_key* peer);
sPymbed	17:ff9d1e86ad5f	4145	#endif
sPymbed	17:ff9d1e86ad5f	4146
sPymbed	17:ff9d1e86ad5f	4147	WOLFSSL_LOCAL int InitHandshakeHashes(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	4148	WOLFSSL_LOCAL void FreeHandshakeHashes(WOLFSSL* ssl);
sPymbed	17:ff9d1e86ad5f	4149
sPymbed	17:ff9d1e86ad5f	4150	WOLFSSL_LOCAL int BuildMessage(WOLFSSL* ssl, byte* output, int outSz,
sPymbed	17:ff9d1e86ad5f	4151	const byte* input, int inSz, int type, int hashOutput,
sPymbed	17:ff9d1e86ad5f	4152	int sizeOnly, int asyncOkay);
sPymbed	17:ff9d1e86ad5f	4153
sPymbed	17:ff9d1e86ad5f	4154	#ifdef WOLFSSL_TLS13
sPymbed	17:ff9d1e86ad5f	4155	int BuildTls13Message(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
sPymbed	17:ff9d1e86ad5f	4156	int inSz, int type, int hashOutput, int sizeOnly, int asyncOkay);
sPymbed	17:ff9d1e86ad5f	4157	#endif
sPymbed	17:ff9d1e86ad5f	4158
sPymbed	17:ff9d1e86ad5f	4159	WOLFSSL_LOCAL int AllocKey(WOLFSSL* ssl, int type, void** pKey);
sPymbed	17:ff9d1e86ad5f	4160	WOLFSSL_LOCAL void FreeKey(WOLFSSL* ssl, int type, void** pKey);
sPymbed	17:ff9d1e86ad5f	4161
sPymbed	17:ff9d1e86ad5f	4162	#ifdef WOLFSSL_ASYNC_CRYPT
sPymbed	17:ff9d1e86ad5f	4163	WOLFSSL_LOCAL int wolfSSL_AsyncInit(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev, word32 flags);
sPymbed	17:ff9d1e86ad5f	4164	WOLFSSL_LOCAL int wolfSSL_AsyncPop(WOLFSSL* ssl, byte* state);
sPymbed	17:ff9d1e86ad5f	4165	WOLFSSL_LOCAL int wolfSSL_AsyncPush(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev);
sPymbed	17:ff9d1e86ad5f	4166	#endif
sPymbed	17:ff9d1e86ad5f	4167
sPymbed	17:ff9d1e86ad5f	4168
sPymbed	17:ff9d1e86ad5f	4169	#ifdef __cplusplus
sPymbed	17:ff9d1e86ad5f	4170	} /* extern "C" */
sPymbed	17:ff9d1e86ad5f	4171	#endif
sPymbed	17:ff9d1e86ad5f	4172
sPymbed	17:ff9d1e86ad5f	4173	#endif /* wolfSSL_INT_H */
sPymbed	17:ff9d1e86ad5f	4174

Repository toolbox

Repository details

Type:	Library
Created:	19 Nov 2019
Imports:	7
Forks:	0
Commits:	18
Dependents:	1
Dependencies:	0
Followers:	1

Important changes to repositories hosted on mbed.com

wolfssl/internal.h@17:ff9d1e86ad5f, 2019-11-20 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Important changes to repositories hosted on mbed.com

wolfssl/internal.h@17:ff9d1e86ad5f, 2019-11-20 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning