155714Skris/* ssl/ssl3.h */ 255714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 355714Skris * All rights reserved. 455714Skris * 555714Skris * This package is an SSL implementation written 655714Skris * by Eric Young (eay@cryptsoft.com). 755714Skris * The implementation was written so as to conform with Netscapes SSL. 855714Skris * 955714Skris * This library is free for commercial and non-commercial use as long as 1055714Skris * the following conditions are aheared to. The following conditions 1155714Skris * apply to all code found in this distribution, be it the RC4, RSA, 1255714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 1355714Skris * included with this distribution is covered by the same copyright terms 1455714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 1555714Skris * 1655714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 1755714Skris * the code are not to be removed. 1855714Skris * If this package is used in a product, Eric Young should be given attribution 1955714Skris * as the author of the parts of the library used. 2055714Skris * This can be in the form of a textual message at program startup or 2155714Skris * in documentation (online or textual) provided with the package. 2255714Skris * 2355714Skris * Redistribution and use in source and binary forms, with or without 2455714Skris * modification, are permitted provided that the following conditions 2555714Skris * are met: 2655714Skris * 1. Redistributions of source code must retain the copyright 2755714Skris * notice, this list of conditions and the following disclaimer. 2855714Skris * 2. Redistributions in binary form must reproduce the above copyright 2955714Skris * notice, this list of conditions and the following disclaimer in the 3055714Skris * documentation and/or other materials provided with the distribution. 3155714Skris * 3. All advertising materials mentioning features or use of this software 3255714Skris * must display the following acknowledgement: 3355714Skris * "This product includes cryptographic software written by 3455714Skris * Eric Young (eay@cryptsoft.com)" 3555714Skris * The word 'cryptographic' can be left out if the rouines from the library 3655714Skris * being used are not cryptographic related :-). 3755714Skris * 4. If you include any Windows specific code (or a derivative thereof) from 3855714Skris * the apps directory (application code) you must include an acknowledgement: 3955714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 4055714Skris * 4155714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 4255714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4355714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4455714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 4555714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4655714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4755714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4855714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4955714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 5055714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 5155714Skris * SUCH DAMAGE. 5255714Skris * 5355714Skris * The licence and distribution terms for any publically available version or 5455714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 5555714Skris * copied and put under another distribution licence 5655714Skris * [including the GNU Public Licence.] 5755714Skris */ 58100928Snectar/* ==================================================================== 59100928Snectar * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 60100928Snectar * 61100928Snectar * Redistribution and use in source and binary forms, with or without 62100928Snectar * modification, are permitted provided that the following conditions 63100928Snectar * are met: 64100928Snectar * 65100928Snectar * 1. Redistributions of source code must retain the above copyright 66100928Snectar * notice, this list of conditions and the following disclaimer. 67100928Snectar * 68100928Snectar * 2. Redistributions in binary form must reproduce the above copyright 69100928Snectar * notice, this list of conditions and the following disclaimer in 70100928Snectar * the documentation and/or other materials provided with the 71100928Snectar * distribution. 72100928Snectar * 73100928Snectar * 3. All advertising materials mentioning features or use of this 74100928Snectar * software must display the following acknowledgment: 75100928Snectar * "This product includes software developed by the OpenSSL Project 76100928Snectar * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77100928Snectar * 78100928Snectar * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79100928Snectar * endorse or promote products derived from this software without 80100928Snectar * prior written permission. For written permission, please contact 81100928Snectar * openssl-core@openssl.org. 82100928Snectar * 83100928Snectar * 5. Products derived from this software may not be called "OpenSSL" 84100928Snectar * nor may "OpenSSL" appear in their names without prior written 85100928Snectar * permission of the OpenSSL Project. 86100928Snectar * 87100928Snectar * 6. Redistributions of any form whatsoever must retain the following 88100928Snectar * acknowledgment: 89100928Snectar * "This product includes software developed by the OpenSSL Project 90100928Snectar * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91100928Snectar * 92100928Snectar * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93100928Snectar * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94100928Snectar * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95100928Snectar * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96100928Snectar * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97100928Snectar * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98100928Snectar * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99100928Snectar * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100100928Snectar * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101100928Snectar * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102100928Snectar * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103100928Snectar * OF THE POSSIBILITY OF SUCH DAMAGE. 104100928Snectar * ==================================================================== 105100928Snectar * 106100928Snectar * This product includes cryptographic software written by Eric Young 107100928Snectar * (eay@cryptsoft.com). This product includes software written by Tim 108100928Snectar * Hudson (tjh@cryptsoft.com). 109100928Snectar * 110100928Snectar */ 111160814Ssimon/* ==================================================================== 112160814Ssimon * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 113160814Ssimon * ECC cipher suite support in OpenSSL originally developed by 114160814Ssimon * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. 115160814Ssimon */ 11655714Skris 11755714Skris#ifndef HEADER_SSL3_H 11855714Skris#define HEADER_SSL3_H 11955714Skris 120109998Smarkm#ifndef OPENSSL_NO_COMP 12168651Skris#include <openssl/comp.h> 12268651Skris#endif 12355714Skris#include <openssl/buffer.h> 12455714Skris#include <openssl/evp.h> 12555714Skris#include <openssl/ssl.h> 12655714Skris 12755714Skris#ifdef __cplusplus 12855714Skrisextern "C" { 12955714Skris#endif 13055714Skris 131273415Sdelphij/* Signalling cipher suite value from RFC 5746 132273415Sdelphij * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */ 133205128Ssimon#define SSL3_CK_SCSV 0x030000FF 134205128Ssimon 135273415Sdelphij/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00 136273415Sdelphij * (TLS_FALLBACK_SCSV) */ 137273415Sdelphij#define SSL3_CK_FALLBACK_SCSV 0x03005600 138273415Sdelphij 13955714Skris#define SSL3_CK_RSA_NULL_MD5 0x03000001 14055714Skris#define SSL3_CK_RSA_NULL_SHA 0x03000002 14155714Skris#define SSL3_CK_RSA_RC4_40_MD5 0x03000003 14255714Skris#define SSL3_CK_RSA_RC4_128_MD5 0x03000004 14355714Skris#define SSL3_CK_RSA_RC4_128_SHA 0x03000005 14455714Skris#define SSL3_CK_RSA_RC2_40_MD5 0x03000006 14555714Skris#define SSL3_CK_RSA_IDEA_128_SHA 0x03000007 14655714Skris#define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008 14755714Skris#define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009 14855714Skris#define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A 14955714Skris 15055714Skris#define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B 15155714Skris#define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C 15255714Skris#define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D 15355714Skris#define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E 15455714Skris#define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F 15555714Skris#define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010 15655714Skris 15755714Skris#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011 15855714Skris#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012 15955714Skris#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013 16055714Skris#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014 16155714Skris#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015 16255714Skris#define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016 16355714Skris 16455714Skris#define SSL3_CK_ADH_RC4_40_MD5 0x03000017 16555714Skris#define SSL3_CK_ADH_RC4_128_MD5 0x03000018 16655714Skris#define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019 16755714Skris#define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A 16855714Skris#define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B 16955714Skris 170238405Sjkim#if 0 171238405Sjkim #define SSL3_CK_FZA_DMS_NULL_SHA 0x0300001C 172238405Sjkim #define SSL3_CK_FZA_DMS_FZA_SHA 0x0300001D 173238405Sjkim #if 0 /* Because it clashes with KRB5, is never used any more, and is safe 174238405Sjkim to remove according to David Hopwood <david.hopwood@zetnet.co.uk> 175238405Sjkim of the ietf-tls list */ 176238405Sjkim #define SSL3_CK_FZA_DMS_RC4_SHA 0x0300001E 177238405Sjkim #endif 178109998Smarkm#endif 17955714Skris 180109998Smarkm/* VRS Additional Kerberos5 entries 181109998Smarkm */ 182109998Smarkm#define SSL3_CK_KRB5_DES_64_CBC_SHA 0x0300001E 183109998Smarkm#define SSL3_CK_KRB5_DES_192_CBC3_SHA 0x0300001F 184109998Smarkm#define SSL3_CK_KRB5_RC4_128_SHA 0x03000020 185109998Smarkm#define SSL3_CK_KRB5_IDEA_128_CBC_SHA 0x03000021 186109998Smarkm#define SSL3_CK_KRB5_DES_64_CBC_MD5 0x03000022 187109998Smarkm#define SSL3_CK_KRB5_DES_192_CBC3_MD5 0x03000023 188109998Smarkm#define SSL3_CK_KRB5_RC4_128_MD5 0x03000024 189109998Smarkm#define SSL3_CK_KRB5_IDEA_128_CBC_MD5 0x03000025 190109998Smarkm 191109998Smarkm#define SSL3_CK_KRB5_DES_40_CBC_SHA 0x03000026 192109998Smarkm#define SSL3_CK_KRB5_RC2_40_CBC_SHA 0x03000027 193109998Smarkm#define SSL3_CK_KRB5_RC4_40_SHA 0x03000028 194109998Smarkm#define SSL3_CK_KRB5_DES_40_CBC_MD5 0x03000029 195109998Smarkm#define SSL3_CK_KRB5_RC2_40_CBC_MD5 0x0300002A 196109998Smarkm#define SSL3_CK_KRB5_RC4_40_MD5 0x0300002B 197109998Smarkm 19855714Skris#define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5" 19955714Skris#define SSL3_TXT_RSA_NULL_SHA "NULL-SHA" 20055714Skris#define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5" 20155714Skris#define SSL3_TXT_RSA_RC4_128_MD5 "RC4-MD5" 20255714Skris#define SSL3_TXT_RSA_RC4_128_SHA "RC4-SHA" 20355714Skris#define SSL3_TXT_RSA_RC2_40_MD5 "EXP-RC2-CBC-MD5" 20455714Skris#define SSL3_TXT_RSA_IDEA_128_SHA "IDEA-CBC-SHA" 20555714Skris#define SSL3_TXT_RSA_DES_40_CBC_SHA "EXP-DES-CBC-SHA" 20655714Skris#define SSL3_TXT_RSA_DES_64_CBC_SHA "DES-CBC-SHA" 20755714Skris#define SSL3_TXT_RSA_DES_192_CBC3_SHA "DES-CBC3-SHA" 20855714Skris 20955714Skris#define SSL3_TXT_DH_DSS_DES_40_CBC_SHA "EXP-DH-DSS-DES-CBC-SHA" 21055714Skris#define SSL3_TXT_DH_DSS_DES_64_CBC_SHA "DH-DSS-DES-CBC-SHA" 21155714Skris#define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA" 21255714Skris#define SSL3_TXT_DH_RSA_DES_40_CBC_SHA "EXP-DH-RSA-DES-CBC-SHA" 21355714Skris#define SSL3_TXT_DH_RSA_DES_64_CBC_SHA "DH-RSA-DES-CBC-SHA" 21455714Skris#define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA" 21555714Skris 21655714Skris#define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA "EXP-EDH-DSS-DES-CBC-SHA" 21755714Skris#define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA "EDH-DSS-DES-CBC-SHA" 21855714Skris#define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA" 21955714Skris#define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA "EXP-EDH-RSA-DES-CBC-SHA" 22055714Skris#define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA "EDH-RSA-DES-CBC-SHA" 22155714Skris#define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA" 22255714Skris 22355714Skris#define SSL3_TXT_ADH_RC4_40_MD5 "EXP-ADH-RC4-MD5" 22455714Skris#define SSL3_TXT_ADH_RC4_128_MD5 "ADH-RC4-MD5" 22555714Skris#define SSL3_TXT_ADH_DES_40_CBC_SHA "EXP-ADH-DES-CBC-SHA" 22655714Skris#define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA" 22755714Skris#define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA" 22855714Skris 229238405Sjkim#if 0 230238405Sjkim #define SSL3_TXT_FZA_DMS_NULL_SHA "FZA-NULL-SHA" 231238405Sjkim #define SSL3_TXT_FZA_DMS_FZA_SHA "FZA-FZA-CBC-SHA" 232238405Sjkim #define SSL3_TXT_FZA_DMS_RC4_SHA "FZA-RC4-SHA" 233238405Sjkim#endif 23455714Skris 235109998Smarkm#define SSL3_TXT_KRB5_DES_64_CBC_SHA "KRB5-DES-CBC-SHA" 236109998Smarkm#define SSL3_TXT_KRB5_DES_192_CBC3_SHA "KRB5-DES-CBC3-SHA" 237109998Smarkm#define SSL3_TXT_KRB5_RC4_128_SHA "KRB5-RC4-SHA" 238109998Smarkm#define SSL3_TXT_KRB5_IDEA_128_CBC_SHA "KRB5-IDEA-CBC-SHA" 239109998Smarkm#define SSL3_TXT_KRB5_DES_64_CBC_MD5 "KRB5-DES-CBC-MD5" 240109998Smarkm#define SSL3_TXT_KRB5_DES_192_CBC3_MD5 "KRB5-DES-CBC3-MD5" 241109998Smarkm#define SSL3_TXT_KRB5_RC4_128_MD5 "KRB5-RC4-MD5" 242109998Smarkm#define SSL3_TXT_KRB5_IDEA_128_CBC_MD5 "KRB5-IDEA-CBC-MD5" 243109998Smarkm 244109998Smarkm#define SSL3_TXT_KRB5_DES_40_CBC_SHA "EXP-KRB5-DES-CBC-SHA" 245109998Smarkm#define SSL3_TXT_KRB5_RC2_40_CBC_SHA "EXP-KRB5-RC2-CBC-SHA" 246109998Smarkm#define SSL3_TXT_KRB5_RC4_40_SHA "EXP-KRB5-RC4-SHA" 247109998Smarkm#define SSL3_TXT_KRB5_DES_40_CBC_MD5 "EXP-KRB5-DES-CBC-MD5" 248109998Smarkm#define SSL3_TXT_KRB5_RC2_40_CBC_MD5 "EXP-KRB5-RC2-CBC-MD5" 249109998Smarkm#define SSL3_TXT_KRB5_RC4_40_MD5 "EXP-KRB5-RC4-MD5" 250109998Smarkm 25155714Skris#define SSL3_SSL_SESSION_ID_LENGTH 32 25255714Skris#define SSL3_MAX_SSL_SESSION_ID_LENGTH 32 25355714Skris 25455714Skris#define SSL3_MASTER_SECRET_SIZE 48 25555714Skris#define SSL3_RANDOM_SIZE 32 25655714Skris#define SSL3_SESSION_ID_SIZE 32 25755714Skris#define SSL3_RT_HEADER_LENGTH 5 25855714Skris 259238405Sjkim#ifndef SSL3_ALIGN_PAYLOAD 260238405Sjkim /* Some will argue that this increases memory footprint, but it's 261238405Sjkim * not actually true. Point is that malloc has to return at least 262238405Sjkim * 64-bit aligned pointers, meaning that allocating 5 bytes wastes 263238405Sjkim * 3 bytes in either case. Suggested pre-gaping simply moves these 264238405Sjkim * wasted bytes from the end of allocated region to its front, 265238405Sjkim * but makes data payload aligned, which improves performance:-) */ 266238405Sjkim# define SSL3_ALIGN_PAYLOAD 8 26755714Skris#else 268238405Sjkim# if (SSL3_ALIGN_PAYLOAD&(SSL3_ALIGN_PAYLOAD-1))!=0 269238405Sjkim# error "insane SSL3_ALIGN_PAYLOAD" 270238405Sjkim# undef SSL3_ALIGN_PAYLOAD 271238405Sjkim# endif 27255714Skris#endif 27355714Skris 274238405Sjkim/* This is the maximum MAC (digest) size used by the SSL library. 275238405Sjkim * Currently maximum of 20 is used by SHA1, but we reserve for 276238405Sjkim * future extension for 512-bit hashes. 277238405Sjkim */ 278238405Sjkim 279238405Sjkim#define SSL3_RT_MAX_MD_SIZE 64 280238405Sjkim 281238405Sjkim/* Maximum block size used in all ciphersuites. Currently 16 for AES. 282238405Sjkim */ 283238405Sjkim 284238405Sjkim#define SSL_RT_MAX_CIPHER_BLOCK_SIZE 16 285238405Sjkim 286238405Sjkim#define SSL3_RT_MAX_EXTRA (16384) 287238405Sjkim 288238405Sjkim/* Maximum plaintext length: defined by SSL/TLS standards */ 28955714Skris#define SSL3_RT_MAX_PLAIN_LENGTH 16384 290238405Sjkim/* Maximum compression overhead: defined by SSL/TLS standards */ 291238405Sjkim#define SSL3_RT_MAX_COMPRESSED_OVERHEAD 1024 292238405Sjkim 293238405Sjkim/* The standards give a maximum encryption overhead of 1024 bytes. 294238405Sjkim * In practice the value is lower than this. The overhead is the maximum 295238405Sjkim * number of padding bytes (256) plus the mac size. 296238405Sjkim */ 297238405Sjkim#define SSL3_RT_MAX_ENCRYPTED_OVERHEAD (256 + SSL3_RT_MAX_MD_SIZE) 298238405Sjkim 299238405Sjkim/* OpenSSL currently only uses a padding length of at most one block so 300238405Sjkim * the send overhead is smaller. 301238405Sjkim */ 302238405Sjkim 303238405Sjkim#define SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD \ 304238405Sjkim (SSL_RT_MAX_CIPHER_BLOCK_SIZE + SSL3_RT_MAX_MD_SIZE) 305238405Sjkim 306238405Sjkim/* If compression isn't used don't include the compression overhead */ 307238405Sjkim 308160814Ssimon#ifdef OPENSSL_NO_COMP 309238405Sjkim#define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH 310160814Ssimon#else 311238405Sjkim#define SSL3_RT_MAX_COMPRESSED_LENGTH \ 312238405Sjkim (SSL3_RT_MAX_PLAIN_LENGTH+SSL3_RT_MAX_COMPRESSED_OVERHEAD) 313160814Ssimon#endif 314238405Sjkim#define SSL3_RT_MAX_ENCRYPTED_LENGTH \ 315238405Sjkim (SSL3_RT_MAX_ENCRYPTED_OVERHEAD+SSL3_RT_MAX_COMPRESSED_LENGTH) 316238405Sjkim#define SSL3_RT_MAX_PACKET_SIZE \ 317238405Sjkim (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH) 31855714Skris 31959191Skris#define SSL3_MD_CLIENT_FINISHED_CONST "\x43\x4C\x4E\x54" 32059191Skris#define SSL3_MD_SERVER_FINISHED_CONST "\x53\x52\x56\x52" 32155714Skris 32255714Skris#define SSL3_VERSION 0x0300 32355714Skris#define SSL3_VERSION_MAJOR 0x03 32455714Skris#define SSL3_VERSION_MINOR 0x00 32555714Skris 32655714Skris#define SSL3_RT_CHANGE_CIPHER_SPEC 20 32755714Skris#define SSL3_RT_ALERT 21 32855714Skris#define SSL3_RT_HANDSHAKE 22 32955714Skris#define SSL3_RT_APPLICATION_DATA 23 330238405Sjkim#define TLS1_RT_HEARTBEAT 24 33155714Skris 33255714Skris#define SSL3_AL_WARNING 1 33355714Skris#define SSL3_AL_FATAL 2 33455714Skris 33555714Skris#define SSL3_AD_CLOSE_NOTIFY 0 33655714Skris#define SSL3_AD_UNEXPECTED_MESSAGE 10 /* fatal */ 33755714Skris#define SSL3_AD_BAD_RECORD_MAC 20 /* fatal */ 33855714Skris#define SSL3_AD_DECOMPRESSION_FAILURE 30 /* fatal */ 33955714Skris#define SSL3_AD_HANDSHAKE_FAILURE 40 /* fatal */ 34055714Skris#define SSL3_AD_NO_CERTIFICATE 41 34155714Skris#define SSL3_AD_BAD_CERTIFICATE 42 34255714Skris#define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 34355714Skris#define SSL3_AD_CERTIFICATE_REVOKED 44 34455714Skris#define SSL3_AD_CERTIFICATE_EXPIRED 45 34555714Skris#define SSL3_AD_CERTIFICATE_UNKNOWN 46 34655714Skris#define SSL3_AD_ILLEGAL_PARAMETER 47 /* fatal */ 34755714Skris 348238405Sjkim#define TLS1_HB_REQUEST 1 349238405Sjkim#define TLS1_HB_RESPONSE 2 350238405Sjkim 351238405Sjkim#ifndef OPENSSL_NO_SSL_INTERN 352238405Sjkim 35355714Skristypedef struct ssl3_record_st 35455714Skris { 35559191Skris/*r */ int type; /* type of record */ 35659191Skris/*rw*/ unsigned int length; /* How many bytes available */ 35759191Skris/*r */ unsigned int off; /* read/write offset into 'buf' */ 35859191Skris/*rw*/ unsigned char *data; /* pointer to the record data */ 35959191Skris/*rw*/ unsigned char *input; /* where the decode bytes are */ 36059191Skris/*r */ unsigned char *comp; /* only used with decompression - malloc()ed */ 361160814Ssimon/*r */ unsigned long epoch; /* epoch number, needed by DTLS1 */ 362238405Sjkim/*r */ unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */ 36355714Skris } SSL3_RECORD; 36455714Skris 36555714Skristypedef struct ssl3_buffer_st 36655714Skris { 367100928Snectar unsigned char *buf; /* at least SSL3_RT_MAX_PACKET_SIZE bytes, 368100928Snectar * see ssl3_setup_buffers() */ 369100928Snectar size_t len; /* buffer size */ 370100928Snectar int offset; /* where to 'copy from' */ 371100928Snectar int left; /* how many bytes left */ 37255714Skris } SSL3_BUFFER; 37355714Skris 374238405Sjkim#endif 375238405Sjkim 37655714Skris#define SSL3_CT_RSA_SIGN 1 37755714Skris#define SSL3_CT_DSS_SIGN 2 37855714Skris#define SSL3_CT_RSA_FIXED_DH 3 37955714Skris#define SSL3_CT_DSS_FIXED_DH 4 38055714Skris#define SSL3_CT_RSA_EPHEMERAL_DH 5 38155714Skris#define SSL3_CT_DSS_EPHEMERAL_DH 6 38255714Skris#define SSL3_CT_FORTEZZA_DMS 20 383160814Ssimon/* SSL3_CT_NUMBER is used to size arrays and it must be large 384160814Ssimon * enough to contain all of the cert types defined either for 385160814Ssimon * SSLv3 and TLSv1. 386160814Ssimon */ 387238405Sjkim#define SSL3_CT_NUMBER 9 38855714Skris 389160814Ssimon 39055714Skris#define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS 0x0001 39155714Skris#define SSL3_FLAGS_DELAY_CLIENT_FINISHED 0x0002 39255714Skris#define SSL3_FLAGS_POP_BUFFER 0x0004 39355714Skris#define TLS1_FLAGS_TLS_PADDING_BUG 0x0008 394238405Sjkim#define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010 395238405Sjkim#define TLS1_FLAGS_KEEP_HANDSHAKE 0x0020 396279264Sdelphij/* 397279264Sdelphij * Set when the handshake is ready to process peer's ChangeCipherSpec message. 398279264Sdelphij * Cleared after the message has been processed. 399279264Sdelphij */ 400279264Sdelphij#define SSL3_FLAGS_CCS_OK 0x0080 401279264Sdelphij 402234954Sbz/* SSL3_FLAGS_SGC_RESTART_DONE is set when we 403234954Sbz * restart a handshake because of MS SGC and so prevents us 404234954Sbz * from restarting the handshake in a loop. It's reset on a 405234954Sbz * renegotiation, so effectively limits the client to one restart 406234954Sbz * per negotiation. This limits the possibility of a DDoS 407234954Sbz * attack where the client handshakes in a loop using SGC to 408234954Sbz * restart. Servers which permit renegotiation can still be 409234954Sbz * effected, but we can't prevent that. 410234954Sbz */ 411234954Sbz#define SSL3_FLAGS_SGC_RESTART_DONE 0x0040 41255714Skris 413238405Sjkim#ifndef OPENSSL_NO_SSL_INTERN 414238405Sjkim 41559191Skristypedef struct ssl3_state_st 41655714Skris { 41755714Skris long flags; 41855714Skris int delay_buf_pop_ret; 41955714Skris 42055714Skris unsigned char read_sequence[8]; 421238405Sjkim int read_mac_secret_size; 42255714Skris unsigned char read_mac_secret[EVP_MAX_MD_SIZE]; 42355714Skris unsigned char write_sequence[8]; 424238405Sjkim int write_mac_secret_size; 42555714Skris unsigned char write_mac_secret[EVP_MAX_MD_SIZE]; 42655714Skris 42755714Skris unsigned char server_random[SSL3_RANDOM_SIZE]; 42855714Skris unsigned char client_random[SSL3_RANDOM_SIZE]; 42955714Skris 430109998Smarkm /* flags for countermeasure against known-IV weakness */ 431109998Smarkm int need_empty_fragments; 432109998Smarkm int empty_fragment_done; 433109998Smarkm 434238405Sjkim /* The value of 'extra' when the buffers were initialized */ 435238405Sjkim int init_extra; 436238405Sjkim 43755714Skris SSL3_BUFFER rbuf; /* read IO goes into here */ 43855714Skris SSL3_BUFFER wbuf; /* write IO goes into here */ 43959191Skris 44055714Skris SSL3_RECORD rrec; /* each decoded record goes in here */ 44155714Skris SSL3_RECORD wrec; /* goes out from here */ 44255714Skris 44359191Skris /* storage for Alert/Handshake protocol data received but not 44459191Skris * yet processed by ssl3_read_bytes: */ 44559191Skris unsigned char alert_fragment[2]; 44659191Skris unsigned int alert_fragment_len; 44759191Skris unsigned char handshake_fragment[4]; 44859191Skris unsigned int handshake_fragment_len; 44959191Skris 45055714Skris /* partial write - check the numbers match */ 45155714Skris unsigned int wnum; /* number of bytes sent so far */ 45255714Skris int wpend_tot; /* number bytes written */ 45355714Skris int wpend_type; 45455714Skris int wpend_ret; /* number of bytes submitted */ 45555714Skris const unsigned char *wpend_buf; 45655714Skris 45755714Skris /* used during startup, digest all incoming/outgoing packets */ 458238405Sjkim BIO *handshake_buffer; 459238405Sjkim /* When set of handshake digests is determined, buffer is hashed 460238405Sjkim * and freed and MD_CTX-es for all required digests are stored in 461238405Sjkim * this array */ 462238405Sjkim EVP_MD_CTX **handshake_dgst; 463279264Sdelphij /* 464279264Sdelphij * Set whenever an expected ChangeCipherSpec message is processed. 465279264Sdelphij * Unset when the peer's Finished message is received. 466279264Sdelphij * Unexpected ChangeCipherSpec messages trigger a fatal alert. 467279264Sdelphij */ 46855714Skris int change_cipher_spec; 46955714Skris 47055714Skris int warn_alert; 47155714Skris int fatal_alert; 47259191Skris /* we allow one fatal and one warning alert to be outstanding, 47355714Skris * send close alert via the warning alert */ 47455714Skris int alert_dispatch; 47555714Skris unsigned char send_alert[2]; 47655714Skris 47755714Skris /* This flag is set when we should renegotiate ASAP, basically when 47855714Skris * there is no more data in the read or write buffers */ 47955714Skris int renegotiate; 48055714Skris int total_renegotiations; 48155714Skris int num_renegotiations; 48255714Skris 48355714Skris int in_read_app_data; 48455714Skris 485238405Sjkim /* Opaque PRF input as used for the current handshake. 486238405Sjkim * These fields are used only if TLSEXT_TYPE_opaque_prf_input is defined 487238405Sjkim * (otherwise, they are merely present to improve binary compatibility) */ 488238405Sjkim void *client_opaque_prf_input; 489238405Sjkim size_t client_opaque_prf_input_len; 490238405Sjkim void *server_opaque_prf_input; 491238405Sjkim size_t server_opaque_prf_input_len; 492238405Sjkim 49355714Skris struct { 49459191Skris /* actually only needs to be 16+20 */ 49559191Skris unsigned char cert_verify_md[EVP_MAX_MD_SIZE*2]; 49659191Skris 49759191Skris /* actually only need to be 16+20 for SSLv3 and 12 for TLS */ 49855714Skris unsigned char finish_md[EVP_MAX_MD_SIZE*2]; 49959191Skris int finish_md_len; 50059191Skris unsigned char peer_finish_md[EVP_MAX_MD_SIZE*2]; 50159191Skris int peer_finish_md_len; 502238405Sjkim 50355714Skris unsigned long message_size; 50455714Skris int message_type; 50555714Skris 50655714Skris /* used to hold the new cipher we are going to use */ 507238405Sjkim const SSL_CIPHER *new_cipher; 508109998Smarkm#ifndef OPENSSL_NO_DH 50955714Skris DH *dh; 51055714Skris#endif 511160814Ssimon 512160814Ssimon#ifndef OPENSSL_NO_ECDH 513160814Ssimon EC_KEY *ecdh; /* holds short lived ECDH key */ 514160814Ssimon#endif 515160814Ssimon 51655714Skris /* used when SSL_ST_FLUSH_DATA is entered */ 51755714Skris int next_state; 51855714Skris 51955714Skris int reuse_message; 52055714Skris 52155714Skris /* used for certificate requests */ 52255714Skris int cert_req; 52355714Skris int ctype_num; 52455714Skris char ctype[SSL3_CT_NUMBER]; 52555714Skris STACK_OF(X509_NAME) *ca_names; 52655714Skris 52755714Skris int use_rsa_tmp; 52855714Skris 52955714Skris int key_block_length; 53055714Skris unsigned char *key_block; 53155714Skris 53255714Skris const EVP_CIPHER *new_sym_enc; 53355714Skris const EVP_MD *new_hash; 534238405Sjkim int new_mac_pkey_type; 535238405Sjkim int new_mac_secret_size; 536109998Smarkm#ifndef OPENSSL_NO_COMP 53755714Skris const SSL_COMP *new_compression; 53855714Skris#else 53955714Skris char *new_compression; 54055714Skris#endif 54155714Skris int cert_request; 54255714Skris } tmp; 54355714Skris 544205128Ssimon /* Connection binding to prevent renegotiation attacks */ 545205128Ssimon unsigned char previous_client_finished[EVP_MAX_MD_SIZE]; 546205128Ssimon unsigned char previous_client_finished_len; 547205128Ssimon unsigned char previous_server_finished[EVP_MAX_MD_SIZE]; 548205128Ssimon unsigned char previous_server_finished_len; 549205128Ssimon int send_connection_binding; /* TODOEKR */ 550238405Sjkim 551238405Sjkim#ifndef OPENSSL_NO_NEXTPROTONEG 552238405Sjkim /* Set if we saw the Next Protocol Negotiation extension from our peer. */ 553238405Sjkim int next_proto_neg_seen; 554238405Sjkim#endif 555279264Sdelphij 556279264Sdelphij#ifndef OPENSSL_NO_TLSEXT 557279264Sdelphij#ifndef OPENSSL_NO_EC 558279264Sdelphij /* This is set to true if we believe that this is a version of Safari 559279264Sdelphij * running on OS X 10.6 or newer. We wish to know this because Safari 560279264Sdelphij * on 10.8 .. 10.8.3 has broken ECDHE-ECDSA support. */ 561279264Sdelphij char is_probably_safari; 562279264Sdelphij#endif /* !OPENSSL_NO_EC */ 563279264Sdelphij#endif /* !OPENSSL_NO_TLSEXT */ 56459191Skris } SSL3_STATE; 56555714Skris 566238405Sjkim#endif 567160814Ssimon 56855714Skris/* SSLv3 */ 56955714Skris/*client */ 57055714Skris/* extra state */ 57155714Skris#define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT) 572238405Sjkim#ifndef OPENSSL_NO_SCTP 573238405Sjkim#define DTLS1_SCTP_ST_CW_WRITE_SOCK (0x310|SSL_ST_CONNECT) 574238405Sjkim#define DTLS1_SCTP_ST_CR_READ_SOCK (0x320|SSL_ST_CONNECT) 575238405Sjkim#endif 57655714Skris/* write to server */ 57755714Skris#define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT) 57855714Skris#define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT) 57955714Skris/* read from server */ 58055714Skris#define SSL3_ST_CR_SRVR_HELLO_A (0x120|SSL_ST_CONNECT) 58155714Skris#define SSL3_ST_CR_SRVR_HELLO_B (0x121|SSL_ST_CONNECT) 582160814Ssimon#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT) 583160814Ssimon#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT) 58455714Skris#define SSL3_ST_CR_CERT_A (0x130|SSL_ST_CONNECT) 58555714Skris#define SSL3_ST_CR_CERT_B (0x131|SSL_ST_CONNECT) 58655714Skris#define SSL3_ST_CR_KEY_EXCH_A (0x140|SSL_ST_CONNECT) 58755714Skris#define SSL3_ST_CR_KEY_EXCH_B (0x141|SSL_ST_CONNECT) 58855714Skris#define SSL3_ST_CR_CERT_REQ_A (0x150|SSL_ST_CONNECT) 58955714Skris#define SSL3_ST_CR_CERT_REQ_B (0x151|SSL_ST_CONNECT) 59055714Skris#define SSL3_ST_CR_SRVR_DONE_A (0x160|SSL_ST_CONNECT) 59155714Skris#define SSL3_ST_CR_SRVR_DONE_B (0x161|SSL_ST_CONNECT) 59255714Skris/* write to server */ 59355714Skris#define SSL3_ST_CW_CERT_A (0x170|SSL_ST_CONNECT) 59455714Skris#define SSL3_ST_CW_CERT_B (0x171|SSL_ST_CONNECT) 59555714Skris#define SSL3_ST_CW_CERT_C (0x172|SSL_ST_CONNECT) 59655714Skris#define SSL3_ST_CW_CERT_D (0x173|SSL_ST_CONNECT) 59755714Skris#define SSL3_ST_CW_KEY_EXCH_A (0x180|SSL_ST_CONNECT) 59855714Skris#define SSL3_ST_CW_KEY_EXCH_B (0x181|SSL_ST_CONNECT) 59955714Skris#define SSL3_ST_CW_CERT_VRFY_A (0x190|SSL_ST_CONNECT) 60055714Skris#define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT) 60155714Skris#define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT) 60255714Skris#define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT) 603246772Sjkim#ifndef OPENSSL_NO_NEXTPROTONEG 604238405Sjkim#define SSL3_ST_CW_NEXT_PROTO_A (0x200|SSL_ST_CONNECT) 605238405Sjkim#define SSL3_ST_CW_NEXT_PROTO_B (0x201|SSL_ST_CONNECT) 606246772Sjkim#endif 60755714Skris#define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT) 60855714Skris#define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT) 60955714Skris/* read from server */ 61055714Skris#define SSL3_ST_CR_CHANGE_A (0x1C0|SSL_ST_CONNECT) 61155714Skris#define SSL3_ST_CR_CHANGE_B (0x1C1|SSL_ST_CONNECT) 61255714Skris#define SSL3_ST_CR_FINISHED_A (0x1D0|SSL_ST_CONNECT) 61355714Skris#define SSL3_ST_CR_FINISHED_B (0x1D1|SSL_ST_CONNECT) 614194206Ssimon#define SSL3_ST_CR_SESSION_TICKET_A (0x1E0|SSL_ST_CONNECT) 615194206Ssimon#define SSL3_ST_CR_SESSION_TICKET_B (0x1E1|SSL_ST_CONNECT) 616194206Ssimon#define SSL3_ST_CR_CERT_STATUS_A (0x1F0|SSL_ST_CONNECT) 617194206Ssimon#define SSL3_ST_CR_CERT_STATUS_B (0x1F1|SSL_ST_CONNECT) 61855714Skris 61955714Skris/* server */ 62055714Skris/* extra state */ 62155714Skris#define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT) 622238405Sjkim#ifndef OPENSSL_NO_SCTP 623238405Sjkim#define DTLS1_SCTP_ST_SW_WRITE_SOCK (0x310|SSL_ST_ACCEPT) 624238405Sjkim#define DTLS1_SCTP_ST_SR_READ_SOCK (0x320|SSL_ST_ACCEPT) 625238405Sjkim#endif 62655714Skris/* read from client */ 62755714Skris/* Do not change the number values, they do matter */ 62855714Skris#define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT) 62955714Skris#define SSL3_ST_SR_CLNT_HELLO_B (0x111|SSL_ST_ACCEPT) 63055714Skris#define SSL3_ST_SR_CLNT_HELLO_C (0x112|SSL_ST_ACCEPT) 63155714Skris/* write to client */ 632160814Ssimon#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT) 633160814Ssimon#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT) 63455714Skris#define SSL3_ST_SW_HELLO_REQ_A (0x120|SSL_ST_ACCEPT) 63555714Skris#define SSL3_ST_SW_HELLO_REQ_B (0x121|SSL_ST_ACCEPT) 63655714Skris#define SSL3_ST_SW_HELLO_REQ_C (0x122|SSL_ST_ACCEPT) 63755714Skris#define SSL3_ST_SW_SRVR_HELLO_A (0x130|SSL_ST_ACCEPT) 63855714Skris#define SSL3_ST_SW_SRVR_HELLO_B (0x131|SSL_ST_ACCEPT) 63955714Skris#define SSL3_ST_SW_CERT_A (0x140|SSL_ST_ACCEPT) 64055714Skris#define SSL3_ST_SW_CERT_B (0x141|SSL_ST_ACCEPT) 64155714Skris#define SSL3_ST_SW_KEY_EXCH_A (0x150|SSL_ST_ACCEPT) 64255714Skris#define SSL3_ST_SW_KEY_EXCH_B (0x151|SSL_ST_ACCEPT) 64355714Skris#define SSL3_ST_SW_CERT_REQ_A (0x160|SSL_ST_ACCEPT) 64455714Skris#define SSL3_ST_SW_CERT_REQ_B (0x161|SSL_ST_ACCEPT) 64555714Skris#define SSL3_ST_SW_SRVR_DONE_A (0x170|SSL_ST_ACCEPT) 64655714Skris#define SSL3_ST_SW_SRVR_DONE_B (0x171|SSL_ST_ACCEPT) 64755714Skris/* read from client */ 64855714Skris#define SSL3_ST_SR_CERT_A (0x180|SSL_ST_ACCEPT) 64955714Skris#define SSL3_ST_SR_CERT_B (0x181|SSL_ST_ACCEPT) 65055714Skris#define SSL3_ST_SR_KEY_EXCH_A (0x190|SSL_ST_ACCEPT) 65155714Skris#define SSL3_ST_SR_KEY_EXCH_B (0x191|SSL_ST_ACCEPT) 65255714Skris#define SSL3_ST_SR_CERT_VRFY_A (0x1A0|SSL_ST_ACCEPT) 65355714Skris#define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT) 65455714Skris#define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT) 65555714Skris#define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT) 656246772Sjkim#ifndef OPENSSL_NO_NEXTPROTONEG 657238405Sjkim#define SSL3_ST_SR_NEXT_PROTO_A (0x210|SSL_ST_ACCEPT) 658238405Sjkim#define SSL3_ST_SR_NEXT_PROTO_B (0x211|SSL_ST_ACCEPT) 659246772Sjkim#endif 66055714Skris#define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT) 66155714Skris#define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT) 66255714Skris/* write to client */ 66355714Skris#define SSL3_ST_SW_CHANGE_A (0x1D0|SSL_ST_ACCEPT) 66455714Skris#define SSL3_ST_SW_CHANGE_B (0x1D1|SSL_ST_ACCEPT) 66555714Skris#define SSL3_ST_SW_FINISHED_A (0x1E0|SSL_ST_ACCEPT) 66655714Skris#define SSL3_ST_SW_FINISHED_B (0x1E1|SSL_ST_ACCEPT) 667194206Ssimon#define SSL3_ST_SW_SESSION_TICKET_A (0x1F0|SSL_ST_ACCEPT) 668194206Ssimon#define SSL3_ST_SW_SESSION_TICKET_B (0x1F1|SSL_ST_ACCEPT) 669194206Ssimon#define SSL3_ST_SW_CERT_STATUS_A (0x200|SSL_ST_ACCEPT) 670194206Ssimon#define SSL3_ST_SW_CERT_STATUS_B (0x201|SSL_ST_ACCEPT) 67155714Skris 67259191Skris#define SSL3_MT_HELLO_REQUEST 0 67355714Skris#define SSL3_MT_CLIENT_HELLO 1 67455714Skris#define SSL3_MT_SERVER_HELLO 2 675194206Ssimon#define SSL3_MT_NEWSESSION_TICKET 4 67655714Skris#define SSL3_MT_CERTIFICATE 11 67755714Skris#define SSL3_MT_SERVER_KEY_EXCHANGE 12 67855714Skris#define SSL3_MT_CERTIFICATE_REQUEST 13 67955714Skris#define SSL3_MT_SERVER_DONE 14 68055714Skris#define SSL3_MT_CERTIFICATE_VERIFY 15 68155714Skris#define SSL3_MT_CLIENT_KEY_EXCHANGE 16 68255714Skris#define SSL3_MT_FINISHED 20 683194206Ssimon#define SSL3_MT_CERTIFICATE_STATUS 22 684246772Sjkim#ifndef OPENSSL_NO_NEXTPROTONEG 685238405Sjkim#define SSL3_MT_NEXT_PROTO 67 686246772Sjkim#endif 687160814Ssimon#define DTLS1_MT_HELLO_VERIFY_REQUEST 3 68855714Skris 689160814Ssimon 69055714Skris#define SSL3_MT_CCS 1 69155714Skris 69255714Skris/* These are used when changing over to a new cipher */ 69355714Skris#define SSL3_CC_READ 0x01 69455714Skris#define SSL3_CC_WRITE 0x02 69555714Skris#define SSL3_CC_CLIENT 0x10 69655714Skris#define SSL3_CC_SERVER 0x20 69755714Skris#define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE) 69855714Skris#define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER|SSL3_CC_READ) 69955714Skris#define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT|SSL3_CC_READ) 70055714Skris#define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE) 70155714Skris 70255714Skris#ifdef __cplusplus 70355714Skris} 70455714Skris#endif 70555714Skris#endif 70655714Skris 707