Data Structures | Macros | Enumerations | Functions | Variables
tls.h File Reference

Transport Layer Security Protocol. More...

#include <stdint.h>
#include <ipxe/refcnt.h>
#include <ipxe/interface.h>
#include <ipxe/process.h>
#include <ipxe/crypto.h>
#include <ipxe/md5.h>
#include <ipxe/sha1.h>
#include <ipxe/x509.h>
#include <ipxe/privkey.h>
#include <ipxe/pending.h>
#include <ipxe/iobuf.h>
#include <ipxe/tables.h>

Go to the source code of this file.

Data Structures

struct  tls_header
 A TLS header. More...
struct  tls_auth_header
 TLS authentication header. More...
struct  tls_verify_data
 TLS verification data. More...
struct  tls_key_exchange_algorithm
 A TLS key exchange algorithm. More...
struct  tls_cipher_suite
 A TLS cipher suite. More...
struct  tls_named_curve
 A TLS named curve. More...
struct  tls_cipherspec
 A TLS cipher specification. More...
struct  tls_signature_hash_id
 A TLS signature and hash algorithm identifier. More...
struct  tls_signature_hash_algorithm
 A TLS signature algorithm. More...
struct  tls_client_random
 TLS client random data. More...
struct  md5_sha1_context
 An MD5+SHA1 context. More...
struct  md5_sha1_digest
 An MD5+SHA1 digest. More...
struct  tls_session
 A TLS session. More...
struct  tls_connection
 A TLS connection. More...


#define TLS_VERSION_TLS_1_1   0x0302
 TLS version 1.1. More...
#define TLS_VERSION_TLS_1_2   0x0303
 TLS version 1.2. More...
 Maximum supported TLS version. More...
 Change cipher content type. More...
 Change cipher spec magic byte. More...
#define TLS_TYPE_ALERT   21
 Alert content type. More...
 Handshake content type. More...
#define TLS_TYPE_DATA   23
 Application data content type. More...
#define TLS_CLIENT_HELLO   1
#define TLS_SERVER_HELLO   2
#define TLS_CERTIFICATE   11
#define TLS_FINISHED   20
#define TLS_ALERT_FATAL   2
#define TLS_RSA_WITH_NULL_MD5   0x0001
#define TLS_RSA_WITH_NULL_SHA   0x0002
#define TLS_RSA_WITH_AES_128_CBC_SHA   0x002f
#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA   0x0033
#define TLS_RSA_WITH_AES_256_CBC_SHA   0x0035
#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA   0x0039
#define TLS_RSA_WITH_AES_128_CBC_SHA256   0x003c
#define TLS_RSA_WITH_AES_256_CBC_SHA256   0x003d
#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256   0x0067
#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256   0x006b
#define TLS_RSA_WITH_AES_128_GCM_SHA256   0x009c
#define TLS_RSA_WITH_AES_256_GCM_SHA384   0x009d
#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256   0x009e
#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384   0x009f
#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   0xc013
#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA   0xc014
#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   0xc027
#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384   0xc028
#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   0xc02f
#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   0xc030
#define TLS_MD5_ALGORITHM   1
#define TLS_SHA1_ALGORITHM   2
#define TLS_SHA224_ALGORITHM   3
#define TLS_SHA256_ALGORITHM   4
#define TLS_SHA384_ALGORITHM   5
#define TLS_SHA512_ALGORITHM   6
#define TLS_SERVER_NAME   0
#define TLS_MAX_FRAGMENT_LENGTH_1024   2
#define TLS_MAX_FRAGMENT_LENGTH_2048   3
#define TLS_MAX_FRAGMENT_LENGTH_4096   4
#define TLS_NAMED_CURVE   10
#define TLS_NAMED_CURVE_X25519   29
#define TLS_CIPHER_SUITES   __table ( struct tls_cipher_suite, "tls_cipher_suites" )
 TLS cipher suite table. More...
#define __tls_cipher_suite(pref)   __table_entry ( TLS_CIPHER_SUITES, pref )
 Declare a TLS cipher suite. More...
 TLS named curved type. More...
#define TLS_NAMED_CURVES   __table ( struct tls_named_curve, "tls_named_curves" )
 TLS named curve table. More...
#define __tls_named_curve(pref)   __table_entry ( TLS_NAMED_CURVES, pref )
 Declare a TLS named curve. More...
 TLS signature hash algorithm table. More...
#define __tls_sig_hash_algorithm   __table_entry ( TLS_SIG_HASH_ALGORITHMS, 01 )
 Declare a TLS signature hash algorithm. More...
#define MD5_SHA1_CTX_SIZE   sizeof ( struct md5_sha1_context )
 MD5+SHA1 context size. More...
#define MD5_SHA1_DIGEST_SIZE   sizeof ( struct md5_sha1_digest )
 MD5+SHA1 digest size. More...
#define TLS_RX_BUFSIZE   4096
 RX I/O buffer size. More...
#define TLS_RX_MIN_BUFSIZE   512
 Minimum RX I/O buffer size. More...
#define TLS_RX_ALIGN   16
 RX I/O buffer alignment. More...


enum  tls_rx_state { TLS_RX_HEADER = 0, TLS_RX_DATA }
 TLS RX state machine state. More...
enum  tls_tx_pending {
 TLS TX pending flags. More...


int add_tls (struct interface *xfer, const char *name, struct x509_root *root, struct private_key *key)
 Add TLS on an interface. More...


struct tls_key_exchange_algorithm tls_pubkey_exchange_algorithm
 Public key exchange algorithm. More...
struct tls_key_exchange_algorithm tls_dhe_exchange_algorithm
 Ephemeral Diffie-Hellman key exchange algorithm. More...
struct tls_key_exchange_algorithm tls_ecdhe_exchange_algorithm
 Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm. More...

Detailed Description

Transport Layer Security Protocol.

Definition in file tls.h.

Macro Definition Documentation


#define TLS_VERSION_TLS_1_1   0x0302

TLS version 1.1.

Definition at line 44 of file tls.h.


#define TLS_VERSION_TLS_1_2   0x0303

TLS version 1.2.

Definition at line 47 of file tls.h.



Maximum supported TLS version.

Definition at line 50 of file tls.h.



Change cipher content type.

Definition at line 53 of file tls.h.



Change cipher spec magic byte.

Definition at line 56 of file tls.h.


#define TLS_TYPE_ALERT   21

Alert content type.

Definition at line 59 of file tls.h.



Handshake content type.

Definition at line 62 of file tls.h.


#define TLS_TYPE_DATA   23

Application data content type.

Definition at line 65 of file tls.h.



Definition at line 68 of file tls.h.


#define TLS_CLIENT_HELLO   1

Definition at line 69 of file tls.h.


#define TLS_SERVER_HELLO   2

Definition at line 70 of file tls.h.



Definition at line 71 of file tls.h.


#define TLS_CERTIFICATE   11

Definition at line 72 of file tls.h.



Definition at line 73 of file tls.h.



Definition at line 74 of file tls.h.



Definition at line 75 of file tls.h.



Definition at line 76 of file tls.h.



Definition at line 77 of file tls.h.


#define TLS_FINISHED   20

Definition at line 78 of file tls.h.



Definition at line 81 of file tls.h.


#define TLS_ALERT_FATAL   2

Definition at line 82 of file tls.h.


#define TLS_RSA_WITH_NULL_MD5   0x0001

Definition at line 85 of file tls.h.


#define TLS_RSA_WITH_NULL_SHA   0x0002

Definition at line 86 of file tls.h.


#define TLS_RSA_WITH_AES_128_CBC_SHA   0x002f

Definition at line 87 of file tls.h.


#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA   0x0033

Definition at line 88 of file tls.h.


#define TLS_RSA_WITH_AES_256_CBC_SHA   0x0035

Definition at line 89 of file tls.h.


#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA   0x0039

Definition at line 90 of file tls.h.


#define TLS_RSA_WITH_AES_128_CBC_SHA256   0x003c

Definition at line 91 of file tls.h.


#define TLS_RSA_WITH_AES_256_CBC_SHA256   0x003d

Definition at line 92 of file tls.h.


#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256   0x0067

Definition at line 93 of file tls.h.


#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256   0x006b

Definition at line 94 of file tls.h.


#define TLS_RSA_WITH_AES_128_GCM_SHA256   0x009c

Definition at line 95 of file tls.h.


#define TLS_RSA_WITH_AES_256_GCM_SHA384   0x009d

Definition at line 96 of file tls.h.


#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256   0x009e

Definition at line 97 of file tls.h.


#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384   0x009f

Definition at line 98 of file tls.h.


#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   0xc013

Definition at line 99 of file tls.h.


#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA   0xc014

Definition at line 100 of file tls.h.


#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   0xc027

Definition at line 101 of file tls.h.


#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384   0xc028

Definition at line 102 of file tls.h.


#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   0xc02f

Definition at line 103 of file tls.h.


#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   0xc030

Definition at line 104 of file tls.h.


#define TLS_MD5_ALGORITHM   1

Definition at line 107 of file tls.h.


#define TLS_SHA1_ALGORITHM   2

Definition at line 108 of file tls.h.


#define TLS_SHA224_ALGORITHM   3

Definition at line 109 of file tls.h.


#define TLS_SHA256_ALGORITHM   4

Definition at line 110 of file tls.h.


#define TLS_SHA384_ALGORITHM   5

Definition at line 111 of file tls.h.


#define TLS_SHA512_ALGORITHM   6

Definition at line 112 of file tls.h.



Definition at line 115 of file tls.h.


#define TLS_SERVER_NAME   0

Definition at line 118 of file tls.h.



Definition at line 119 of file tls.h.



Definition at line 122 of file tls.h.



Definition at line 123 of file tls.h.


#define TLS_MAX_FRAGMENT_LENGTH_1024   2

Definition at line 124 of file tls.h.


#define TLS_MAX_FRAGMENT_LENGTH_2048   3

Definition at line 125 of file tls.h.


#define TLS_MAX_FRAGMENT_LENGTH_4096   4

Definition at line 126 of file tls.h.


#define TLS_NAMED_CURVE   10

Definition at line 129 of file tls.h.


#define TLS_NAMED_CURVE_X25519   29

Definition at line 130 of file tls.h.



Definition at line 133 of file tls.h.



Definition at line 136 of file tls.h.



Definition at line 139 of file tls.h.


#define TLS_CIPHER_SUITES   __table ( struct tls_cipher_suite, "tls_cipher_suites" )

TLS cipher suite table.

Definition at line 211 of file tls.h.

◆ __tls_cipher_suite

#define __tls_cipher_suite (   pref)    __table_entry ( TLS_CIPHER_SUITES, pref )

Declare a TLS cipher suite.

Definition at line 215 of file tls.h.



TLS named curved type.

Definition at line 219 of file tls.h.


#define TLS_NAMED_CURVES   __table ( struct tls_named_curve, "tls_named_curves" )

TLS named curve table.

Definition at line 230 of file tls.h.

◆ __tls_named_curve

#define __tls_named_curve (   pref)    __table_entry ( TLS_NAMED_CURVES, pref )

Declare a TLS named curve.

Definition at line 234 of file tls.h.


"tls_sig_hash_algorithms" )
#define __table(type, name)
Declare a linker table.
Definition: tables.h:179
A TLS signature algorithm.
Definition: tls.h:262

TLS signature hash algorithm table.

Note that the default (TLSv1.1 and earlier) algorithm using MD5+SHA1 is never explicitly specified.

Definition at line 276 of file tls.h.

◆ __tls_sig_hash_algorithm

#define __tls_sig_hash_algorithm   __table_entry ( TLS_SIG_HASH_ALGORITHMS, 01 )

Declare a TLS signature hash algorithm.

Definition at line 281 of file tls.h.


#define MD5_SHA1_CTX_SIZE   sizeof ( struct md5_sha1_context )

MD5+SHA1 context size.

Definition at line 301 of file tls.h.


#define MD5_SHA1_DIGEST_SIZE   sizeof ( struct md5_sha1_digest )

MD5+SHA1 digest size.

Definition at line 312 of file tls.h.


#define TLS_RX_BUFSIZE   4096

RX I/O buffer size.

The maximum fragment length extension is optional, and many common implementations (including OpenSSL) do not support it. We must therefore be prepared to receive records of up to 16kB in length. The chance of an allocation of this size failing is non-negligible, so we must split received data into smaller allocations.

Definition at line 442 of file tls.h.


#define TLS_RX_MIN_BUFSIZE   512

Minimum RX I/O buffer size.

To simplify manipulations, we ensure that no RX I/O buffer is smaller than this size. This allows us to assume that the MAC and padding are entirely contained within the final I/O buffer.

Definition at line 450 of file tls.h.


#define TLS_RX_ALIGN   16

RX I/O buffer alignment.

Definition at line 453 of file tls.h.

Enumeration Type Documentation

◆ tls_rx_state

TLS RX state machine state.


Definition at line 158 of file tls.h.

158  {
159  TLS_RX_HEADER = 0,
161 };

◆ tls_tx_pending

TLS TX pending flags.


Definition at line 164 of file tls.h.

Function Documentation



◆ add_tls()

int add_tls ( struct interface xfer,
const char *  name,
struct x509_root root,
struct private_key key 

Add TLS on an interface.

xferData transfer interface
nameHost name
rootRoot of trust (or NULL to use default)
keyPrivate key (or NULL to use default)
Return values
rcReturn status code

Definition at line 3816 of file tls.c.

3817  {
3818  struct tls_connection *tls;
3819  int rc;
3821  /* Allocate and initialise TLS structure */
3822  tls = malloc ( sizeof ( *tls ) );
3823  if ( ! tls ) {
3824  rc = -ENOMEM;
3825  goto err_alloc;
3826  }
3827  memset ( tls, 0, sizeof ( *tls ) );
3828  ref_init ( &tls->refcnt, free_tls );
3829  INIT_LIST_HEAD ( &tls->list );
3830  intf_init ( &tls->plainstream, &tls_plainstream_desc, &tls->refcnt );
3832  intf_init ( &tls->validator, &tls_validator_desc, &tls->refcnt );
3834  &tls->refcnt );
3835  tls->key = privkey_get ( key ? key : &private_key );
3836  tls->root = x509_root_get ( root ? root : &root_certificates );
3837  tls->version = TLS_VERSION_MAX;
3838  tls_clear_cipher ( tls, &tls->tx_cipherspec );
3839  tls_clear_cipher ( tls, &tls->tx_cipherspec_pending );
3840  tls_clear_cipher ( tls, &tls->rx_cipherspec );
3841  tls_clear_cipher ( tls, &tls->rx_cipherspec_pending );
3842  tls_clear_handshake ( tls );
3843  tls->client_random.gmt_unix_time = time ( NULL );
3844  iob_populate ( &tls->rx_header_iobuf, &tls->rx_header, 0,
3845  sizeof ( tls->rx_header ) );
3846  INIT_LIST_HEAD ( &tls->rx_data );
3847  if ( ( rc = tls_generate_random ( tls, &tls->client_random.random,
3848  ( sizeof ( tls->client_random.random ) ) ) ) != 0 ) {
3849  goto err_random;
3850  }
3851  if ( ( rc = tls_session ( tls, name ) ) != 0 )
3852  goto err_session;
3853  list_add_tail ( &tls->list, &tls->session->conn );
3855  /* Start negotiation */
3856  tls_restart ( tls );
3858  /* Attach to parent interface, mortalise self, and return */
3859  intf_insert ( xfer, &tls->plainstream, &tls->cipherstream );
3860  ref_put ( &tls->refcnt );
3861  return 0;
3863  err_session:
3864  err_random:
3865  ref_put ( &tls->refcnt );
3866  err_alloc:
3867  return rc;
3868 }
static void free_tls(struct refcnt *refcnt)
Free TLS connection.
Definition: tls.c:376
struct arbelprm_rc_send_wqe rc
Definition: arbel.h:14
const char * name
Definition: ath9k_hw.c:1984
struct process process
TX process.
Definition: tls.h:418
struct tls_session * session
Definition: tls.h:349
struct io_buffer rx_header_iobuf
Current received record header (static I/O buffer)
Definition: tls.h:427
static void tls_restart(struct tls_connection *tls)
Restart negotiation.
Definition: tls.c:1111
struct stp_switch root
Root switch.
Definition: stp.h:26
#define ref_init(refcnt, free)
Initialise a reference counter.
Definition: refcnt.h:64
struct refcnt refcnt
Reference counter.
Definition: tls.h:346
struct x509_root root_certificates
Root certificates.
Definition: rootcert.c:73
static struct private_key * privkey_get(struct private_key *key)
Get reference to private key.
Definition: privkey.h:30
struct tls_header rx_header
Current received record header.
Definition: tls.h:425
struct x509_root * root
Root of trust.
Definition: tls.h:400
static void iob_populate(struct io_buffer *iobuf, void *data, size_t len, size_t max_len)
Create a temporary I/O buffer.
Definition: iobuf.h:190
static struct interface_descriptor tls_cipherstream_desc
TLS ciphertext stream interface descriptor.
Definition: tls.c:3534
static struct interface_descriptor tls_validator_desc
TLS certificate validator interface descriptor.
Definition: tls.c:3614
#define ENOMEM
Not enough space.
Definition: errno.h:534
struct tls_cipherspec tx_cipherspec
Current TX cipher specification.
Definition: tls.h:369
#define list_add_tail(new, head)
Add a new entry to the tail of a list.
Definition: list.h:93
struct list_head list
List of connections within the same session.
Definition: tls.h:351
uint32_t gmt_unix_time
GMT Unix time.
Definition: tls.h:287
static struct x509_root * x509_root_get(struct x509_root *root)
Get reference to X.509 root certificate list.
Definition: x509.h:384
struct tls_client_random client_random
Client random bytes.
Definition: tls.h:381
struct interface cipherstream
Ciphertext stream.
Definition: tls.h:364
struct private_key * key
Private key.
Definition: tls.h:391
static void process_init_stopped(struct process *process, struct process_descriptor *desc, struct refcnt *refcnt)
Initialise process without adding to process list.
Definition: process.h:145
struct tls_cipherspec rx_cipherspec
Current RX cipher specification.
Definition: tls.h:373
void * malloc(size_t size)
Allocate memory.
Definition: malloc.c:583
struct tls_cipherspec tx_cipherspec_pending
Next TX cipher specification.
Definition: tls.h:371
Maximum supported TLS version.
Definition: tls.h:50
struct list_head rx_data
List of received data buffers.
Definition: tls.h:429
static struct interface_descriptor tls_plainstream_desc
TLS plaintext stream interface descriptor.
Definition: tls.c:3319
void intf_insert(struct interface *intf, struct interface *upper, struct interface *lower)
Insert a filter interface.
Definition: interface.c:401
#define INIT_LIST_HEAD(list)
Initialise a list head.
Definition: list.h:45
uint8_t random[28]
Random data.
Definition: tls.h:289
struct interface validator
Certificate validator.
Definition: tls.h:404
A TLS session.
Definition: tls.h:315
static struct process_descriptor tls_process_desc
TLS TX process descriptor.
Definition: tls.c:3739
struct tls_cipherspec rx_cipherspec_pending
Next RX cipher specification.
Definition: tls.h:375
uint16_t version
Protocol version.
Definition: tls.h:367
static void tls_clear_handshake(struct tls_connection *tls)
Clear handshake digest algorithm.
Definition: tls.c:749
A private key.
Definition: privkey.h:16
A TLS connection.
Definition: tls.h:344
static void tls_clear_cipher(struct tls_connection *tls, struct tls_cipherspec *cipherspec)
struct list_head conn
List of connections.
Definition: tls.h:340
static int tls_generate_random(struct tls_connection *tls, void *data, size_t len)
Generate random data.
Definition: tls.c:453
static void intf_init(struct interface *intf, struct interface_descriptor *desc, struct refcnt *refcnt)
Initialise an object interface.
Definition: interface.h:203
struct interface plainstream
Plaintext stream.
Definition: tls.h:362
uint64_t time
Current time.
Definition: ntlm.h:20
#define NULL
NULL pointer (VOID *)
Definition: Base.h:321
union @382 key
Sense key.
Definition: crypto.h:284
#define ref_put(refcnt)
Drop reference to object.
Definition: refcnt.h:106
void * memset(void *dest, int character, size_t len) __nonnull

References tls_connection::cipherstream, tls_connection::client_random, tls_session::conn, ENOMEM, free_tls(), tls_client_random::gmt_unix_time, INIT_LIST_HEAD, intf_init(), intf_insert(), iob_populate(), key, tls_connection::key, tls_connection::list, list_add_tail, malloc(), memset(), name, NULL, tls_connection::plainstream, privkey_get(), tls_connection::process, process_init_stopped(), tls_client_random::random, rc, ref_init, ref_put, tls_connection::refcnt, root, tls_connection::root, root_certificates, tls_connection::rx_cipherspec, tls_connection::rx_cipherspec_pending, tls_connection::rx_data, tls_connection::rx_header, tls_connection::rx_header_iobuf, tls_connection::session, time, tls_cipherstream_desc, tls_clear_cipher(), tls_clear_handshake(), tls_generate_random(), tls_plainstream_desc, tls_process_desc, tls_restart(), tls_validator_desc, TLS_VERSION_MAX, tls_connection::tx_cipherspec, tls_connection::tx_cipherspec_pending, tls_connection::validator, tls_connection::version, and x509_root_get().

Referenced by apply_syslogs_settings(), https_filter(), and ipair_rx_session().

Variable Documentation

◆ tls_pubkey_exchange_algorithm

struct tls_key_exchange_algorithm tls_pubkey_exchange_algorithm

Public key exchange algorithm.

Definition at line 1447 of file tls.c.

◆ tls_dhe_exchange_algorithm

struct tls_key_exchange_algorithm tls_dhe_exchange_algorithm

Ephemeral Diffie-Hellman key exchange algorithm.

Definition at line 1661 of file tls.c.

◆ tls_ecdhe_exchange_algorithm

struct tls_key_exchange_algorithm tls_ecdhe_exchange_algorithm

Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm.

Definition at line 1774 of file tls.c.