Line data Source code
1 : #ifndef HEADER_fd_src_waltz_tls_fd_tls_proto_h
2 : #define HEADER_fd_src_waltz_tls_fd_tls_proto_h
3 :
4 : /* fd_tls_proto.h declares various TLS v1.3 data structures and provides
5 : internal APIs to decode and encode them from/to wire format.
6 :
7 : Most encodings in TLS v1.3 are laid out dynamically and cannot be
8 : represented with packed C structs, such as variable-length lists and
9 : "unions" (fields that may hold one of multiple data types). For this
10 : dynamic kind of data, fd_tls_proto declares custom structs and
11 : provides an encode/decode API.
12 :
13 : A small number of type encodings are laid out statically. For these,
14 : a packed C struct and a "bswap" (endianness conversion) function is
15 : provided. */
16 :
17 : #include "../fd_waltz_base.h"
18 : #include <stddef.h>
19 :
20 : /* TLS Extensions *****************************************************/
21 :
22 : struct __attribute__((packed)) fd_tls_ext_hdr {
23 : ushort type;
24 : ushort sz;
25 : };
26 :
27 : typedef struct fd_tls_ext_hdr fd_tls_ext_hdr_t;
28 :
29 : /* Supported TLS versions (RFC 8446)
30 : Type: FD_TLS_EXT_TYPE_SUPPORTED_VERSIONS */
31 :
32 : struct fd_tls_ext_supported_versions {
33 : uchar tls13 : 1;
34 : };
35 :
36 : typedef struct fd_tls_ext_supported_versions fd_tls_ext_supported_versions_t;
37 :
38 : /* Server name indication (RFC 6066)
39 : Type: FD_TLS_EXT_TYPE_SERVER_NAME (0) */
40 :
41 : struct fd_tls_ext_server_name {
42 : ushort host_name_len; /* Length of name cstr (excluding NUL) */
43 : char host_name[ 254 ]; /* Name cstr */
44 : };
45 :
46 : typedef struct fd_tls_ext_server_name fd_tls_ext_server_name_t;
47 :
48 : /* Supported ECDHE groups (RFC 8422, 7919)
49 : Type: FD_TLS_EXT_TYPE_SUPPORTED_GROUPS */
50 :
51 : struct fd_tls_ext_supported_groups {
52 : uchar x25519 : 1;
53 : };
54 :
55 : typedef struct fd_tls_ext_supported_groups fd_tls_ext_supported_groups_t;
56 :
57 : /* Supported signature schemes (RFC 8446)
58 : Type: FD_TLS_EXT_TYPE_SIGNATURE_ALGORITHMS */
59 :
60 : struct fd_tls_ext_signature_algorithms {
61 : uchar ed25519 : 1;
62 : uchar ecdsa_secp256r1_sha256 : 1;
63 : uchar ecdsa_secp384r1_sha384 : 1;
64 : uchar rsa_pkcs1_sha256 : 1;
65 : uchar rsa_pkcs1_sha384 : 1;
66 : uchar rsa_pkcs1_sha512 : 1;
67 : uchar rsa_pss_rsae_sha256 : 1;
68 : uchar rsa_pss_rsae_sha384 : 1;
69 : uchar rsa_pss_rsae_sha512 : 1;
70 : };
71 :
72 : typedef struct fd_tls_ext_signature_algorithms fd_tls_ext_signature_algorithms_t;
73 :
74 : struct fd_tls_key_share {
75 : uchar has_x25519 : 1;
76 : uchar x25519[ 32 ];
77 : };
78 :
79 : typedef struct fd_tls_key_share fd_tls_key_share_t;
80 :
81 : /* fd_tls_ext_opaque_t holds a pointer to opaque serialized extension
82 : data. Lifetime of buf depends on context -- Look for documentation
83 : in usages of this structure.
84 :
85 : This structure can have 3 subtly different meanings:
86 : (!!buf) & (!!bufsz) Extension present, non-zero sz
87 : (!!buf) & ( !bufsz) Extension present, zero sz
88 : ( !buf) & ( !bufsz) Extension absent
89 :
90 : Notably,
91 : (!buf ) ... implies extension is absent
92 : (!bufsz) ... implies extension is absent or zero sz */
93 :
94 : struct fd_tls_ext_opaque {
95 : uchar const * buf;
96 : ulong bufsz;
97 : };
98 :
99 : typedef struct fd_tls_ext_opaque fd_tls_ext_opaque_t;
100 : typedef struct fd_tls_ext_opaque fd_tls_ext_quic_tp_t;
101 : typedef struct fd_tls_ext_opaque fd_tls_ext_alpn_t;
102 :
103 : /* TLS Messages *******************************************************/
104 :
105 : /* fd_tls_u24_t is a 24-bit / 3 byte big-endian integer.
106 : Matches wire representation. */
107 :
108 : struct fd_tls_u24 { uchar v[3]; };
109 : typedef struct fd_tls_u24 fd_tls_u24_t;
110 :
111 : /* fd_tls_msg_hdr_t is the header that all message types share. */
112 :
113 : struct __attribute__((packed)) fd_tls_msg_hdr {
114 : uchar type; /* FD_TLS_MSG_{...} */
115 : fd_tls_u24_t sz; /* Byte size of fields following this header */
116 : };
117 :
118 : typedef struct fd_tls_msg_hdr fd_tls_msg_hdr_t;
119 :
120 : /* fd_tls_client_hello_t describes a TLS v1.3 ClientHello (RFC 8446,
121 : Section 4.1.2). */
122 :
123 : struct fd_tls_client_hello {
124 : uchar random[ 32 ];
125 :
126 : struct {
127 : uchar aes_128_gcm_sha256 : 1;
128 : /* Add more cipher suites here */
129 : } cipher_suites;
130 :
131 : fd_tls_ext_opaque_t session_id;
132 :
133 : /* Presence is independent of whether a supported algorithm was found. */
134 : uchar has_supported_groups : 1;
135 : uchar has_signature_algorithms : 1;
136 : uchar has_key_share : 1;
137 :
138 : fd_tls_ext_supported_versions_t supported_versions;
139 : fd_tls_ext_server_name_t server_name;
140 : fd_tls_ext_supported_groups_t supported_groups;
141 : fd_tls_ext_signature_algorithms_t signature_algorithms;
142 : fd_tls_ext_signature_algorithms_t signature_algorithms_cert;
143 : fd_tls_key_share_t key_share;
144 : fd_tls_ext_quic_tp_t quic_tp;
145 : fd_tls_ext_alpn_t alpn;
146 : };
147 :
148 : typedef struct fd_tls_client_hello fd_tls_client_hello_t;
149 :
150 : /* fd_tls_server_hello_t describes a TLS v1.3 ServerHello (RFC 8446,
151 : Section 4.1.3). */
152 :
153 : struct fd_tls_server_hello {
154 : uchar random[ 32 ];
155 : ushort cipher_suite;
156 :
157 : fd_tls_ext_opaque_t session_id;
158 : fd_tls_key_share_t key_share;
159 : };
160 :
161 : typedef struct fd_tls_server_hello fd_tls_server_hello_t;
162 :
163 : /* fd_tls_enc_ext_t describes a TLS v1.3 EncryptedExtensions message
164 : (RFC 8446, Section 4.3.1). */
165 :
166 : struct fd_tls_enc_ext {
167 : fd_tls_ext_quic_tp_t quic_tp;
168 : fd_tls_ext_alpn_t alpn;
169 : uint server_name:1;
170 : };
171 :
172 : typedef struct fd_tls_enc_ext fd_tls_enc_ext_t;
173 :
174 : /* fd_tls_cert_verify_t describes a CertificateVerify (RFC 8446, Section
175 : 4.4.3). Supports Ed25519 (64 byte sig), ECDSA-P256 (DER encoded,
176 : up to 73 bytes), and RSA-PSS (modulus size, up to 512 bytes). */
177 :
178 : #define FD_TLS_CV_SIG_SZ_MAX (512UL)
179 :
180 : struct fd_tls_cert_verify {
181 : ushort algorithm; /* FD_TLS_SIGNATURE_{...} */
182 : ushort signature_len;
183 : uchar signature[ FD_TLS_CV_SIG_SZ_MAX ];
184 : };
185 :
186 : typedef struct fd_tls_cert_verify fd_tls_cert_verify_t;
187 :
188 : /* fd_tls_finished_t matches the wire representation of Finished (RFC
189 : 8446, Section 4.4.4). Only supports TLS cipher suites with 32 byte
190 : hash output size. */
191 :
192 : struct __attribute__((packed)) fd_tls_finished {
193 : uchar verify[ 32 ];
194 : };
195 :
196 : typedef struct fd_tls_finished fd_tls_finished_t;
197 :
198 : /* Enums **************************************************************/
199 :
200 : /* TLS Legacy Version field */
201 :
202 16902 : #define FD_TLS_VERSION_TLS12 ((ushort)0x0303)
203 : #define FD_TLS_VERSION_TLS13 ((ushort)0x0304)
204 :
205 : /* TLS cipher suite IDs */
206 :
207 31215 : #define FD_TLS_CIPHER_SUITE_AES_128_GCM_SHA256 ((ushort)0x1301)
208 :
209 : /* TLS extension IDs */
210 :
211 4086 : #define FD_TLS_EXT_SERVER_NAME ((ushort) 0)
212 24303 : #define FD_TLS_EXT_SUPPORTED_GROUPS ((ushort)10)
213 27003 : #define FD_TLS_EXT_SIGNATURE_ALGORITHMS ((ushort)13)
214 28131 : #define FD_TLS_EXT_ALPN ((ushort)16)
215 21 : #define FD_TLS_EXT_CLIENT_CERT_TYPE ((ushort)19)
216 24 : #define FD_TLS_EXT_SERVER_CERT_TYPE ((ushort)20)
217 33585 : #define FD_TLS_EXT_SUPPORTED_VERSIONS ((ushort)43)
218 3882 : #define FD_TLS_EXT_SIGNATURE_ALGORITHMS_CERT ((ushort)50)
219 40854 : #define FD_TLS_EXT_KEY_SHARE ((ushort)51)
220 24414 : #define FD_TLS_EXT_QUIC_TRANSPORT_PARAMS ((ushort)57)
221 :
222 : /* TLS Alert Protocol */
223 :
224 273 : #define FD_TLS_ALERT_CLOSE_NOTIFY ((uchar) 0)
225 273 : #define FD_TLS_ALERT_UNEXPECTED_MESSAGE ((uchar) 10)
226 48 : #define FD_TLS_ALERT_BAD_RECORD_MAC ((uchar) 20)
227 39 : #define FD_TLS_ALERT_RECORD_OVERFLOW ((uchar) 22)
228 216 : #define FD_TLS_ALERT_HANDSHAKE_FAILURE ((uchar) 40)
229 219 : #define FD_TLS_ALERT_BAD_CERTIFICATE ((uchar) 42)
230 6 : #define FD_TLS_ALERT_UNSUPPORTED_CERTIFICATE ((uchar) 43)
231 0 : #define FD_TLS_ALERT_CERTIFICATE_REVOKED ((uchar) 44)
232 0 : #define FD_TLS_ALERT_CERTIFICATE_EXPIRED ((uchar) 45)
233 0 : #define FD_TLS_ALERT_CERTIFICATE_UNKNOWN ((uchar) 46)
234 96 : #define FD_TLS_ALERT_ILLEGAL_PARAMETER ((uchar) 47)
235 24 : #define FD_TLS_ALERT_UNKNOWN_CA ((uchar) 48)
236 0 : #define FD_TLS_ALERT_ACCESS_DENIED ((uchar) 49)
237 1044 : #define FD_TLS_ALERT_DECODE_ERROR ((uchar) 50)
238 45 : #define FD_TLS_ALERT_DECRYPT_ERROR ((uchar) 51)
239 60 : #define FD_TLS_ALERT_PROTOCOL_VERSION ((uchar) 70)
240 0 : #define FD_TLS_ALERT_INSUFFICIENT_SECURITY ((uchar) 71)
241 3 : #define FD_TLS_ALERT_INTERNAL_ERROR ((uchar) 80)
242 0 : #define FD_TLS_ALERT_INAPPROPRIATE_FALLBACK ((uchar) 86)
243 228 : #define FD_TLS_ALERT_USER_CANCELED ((uchar) 90)
244 18 : #define FD_TLS_ALERT_MISSING_EXTENSION ((uchar)109)
245 24 : #define FD_TLS_ALERT_UNSUPPORTED_EXTENSION ((uchar)110)
246 0 : #define FD_TLS_ALERT_UNRECOGNIZED_NAME ((uchar)112)
247 0 : #define FD_TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE ((uchar)113)
248 0 : #define FD_TLS_ALERT_UNKNOWN_PSK_IDENTITY ((uchar)115)
249 12 : #define FD_TLS_ALERT_CERTIFICATE_REQUIRED ((uchar)116)
250 51 : #define FD_TLS_ALERT_NO_APPLICATION_PROTOCOL ((uchar)120)
251 :
252 : /* TLS server_name extension */
253 :
254 4071 : #define FD_TLS_SERVER_NAME_TYPE_DNS ((uchar)0) /* RFC 6066 */
255 :
256 : /* TLS signature scheme IDs */
257 :
258 6372 : #define FD_TLS_SIGNATURE_RSA_PKCS1_SHA256 ((ushort)0x0401)
259 12825 : #define FD_TLS_SIGNATURE_ECDSA_SECP256R1_SHA256 ((ushort)0x0403)
260 6372 : #define FD_TLS_SIGNATURE_RSA_PKCS1_SHA384 ((ushort)0x0501)
261 6372 : #define FD_TLS_SIGNATURE_ECDSA_SECP384R1_SHA384 ((ushort)0x0503)
262 6372 : #define FD_TLS_SIGNATURE_RSA_PKCS1_SHA512 ((ushort)0x0601)
263 7806 : #define FD_TLS_SIGNATURE_RSA_PSS_RSAE_SHA256 ((ushort)0x0804)
264 7404 : #define FD_TLS_SIGNATURE_RSA_PSS_RSAE_SHA384 ((ushort)0x0805)
265 7413 : #define FD_TLS_SIGNATURE_RSA_PSS_RSAE_SHA512 ((ushort)0x0806)
266 47163 : #define FD_TLS_SIGNATURE_ED25519 ((ushort)0x0807)
267 :
268 : /* TLS supported_groups extension */
269 :
270 : #define FD_TLS_GROUP_SECP256R1 ((ushort)23)
271 50391 : #define FD_TLS_GROUP_X25519 ((ushort)29)
272 :
273 : /* TLS supported_versions extension */
274 :
275 24132 : #define FD_TLS_VERSION_TLS13 ((ushort)0x0304)
276 :
277 : /* TLS key_share extension */
278 :
279 : #define FD_TLS_KEY_SHARE_TYPE_X25519 ((ushort)29)
280 :
281 : /* TLS v1.3 message types */
282 :
283 9819 : #define FD_TLS_MSG_CLIENT_HELLO ((uchar) 1)
284 7104 : #define FD_TLS_MSG_SERVER_HELLO ((uchar) 2)
285 6048 : #define FD_TLS_MSG_NEW_SESSION_TICKET ((uchar) 4)
286 6918 : #define FD_TLS_MSG_ENCRYPTED_EXT ((uchar) 8)
287 16341 : #define FD_TLS_MSG_CERT ((uchar) 11)
288 2691 : #define FD_TLS_MSG_CERT_REQ ((uchar) 13)
289 7953 : #define FD_TLS_MSG_CERT_VERIFY ((uchar) 15)
290 16218 : #define FD_TLS_MSG_FINISHED ((uchar) 20)
291 14673 : #define FD_TLS_MSG_KEY_UPDATE ((uchar) 24)
292 :
293 : /* Serialization related **********************************************/
294 :
295 : /* ### Decode functions
296 :
297 : Most deserializers follow the same prototype:
298 :
299 : long
300 : fd_tls_decode_TYPE( TYPE_t * out,
301 : void const * wire,
302 : ulong wire_sz );
303 :
304 : Reads bytes from wire and populates the data structure pointed to
305 : by out. out must be zero-initialized, as the decoder does not
306 : promise to fill in all fields. wire points to the first byte of the
307 : encoded payload that may span up to wire_sz bytes. Returns number of
308 : bytes read from wire on success. On failure, returns a negated TLS
309 : error code. (Typically DECODE_ERROR alert)
310 :
311 : wire is read-only. Output fields may reference its bytes; retain
312 : the input while those references are in use.
313 :
314 : ### Encode functions
315 :
316 : Most serializers follow the same prototype:
317 :
318 : long
319 : fd_tls_encode_TYPE( TYPE_t const * in,
320 : void * wire,
321 : ulong wire_sz );
322 :
323 : Writes bytes containing serialized version of data structure pointed
324 : to by in. wire points to the first byte of the buffer to fill.
325 : wire_sz is the size of that buffer. Returns number of bytes written
326 : on success (can be 0). On failure, returns a negated TLS error code. */
327 :
328 : FD_PROTOTYPES_BEGIN
329 :
330 : /* Methods for static layout types */
331 :
332 : /* Macro STATIC_SERDE defines decode/encode implementations for structs
333 : that match their wire encoding */
334 :
335 : #define STATIC_SERDE( NAME, TYPE_T ) \
336 : static inline long \
337 : fd_tls_decode_##NAME( TYPE_T * out, \
338 : uchar const * wire, \
339 80325 : ulong wire_sz ) { \
340 80325 : if( FD_UNLIKELY( wire_sz < sizeof(TYPE_T) ) ) \
341 80325 : return -(long)FD_TLS_ALERT_DECODE_ERROR; \
342 80325 : memcpy( out, wire, sizeof(TYPE_T) ); \
343 80301 : fd_tls_##NAME##_bswap( out ); \
344 80301 : return (long)sizeof(TYPE_T); \
345 80325 : } \
346 : static inline long \
347 : fd_tls_encode_##NAME ( TYPE_T const * in, \
348 : void * wire, \
349 45750 : ulong wire_sz ) { \
350 45750 : if( FD_UNLIKELY( wire_sz < sizeof(TYPE_T) ) ) \
351 45750 : return -(long)FD_TLS_ALERT_DECODE_ERROR; \
352 45750 : TYPE_T * out = (TYPE_T *)wire; \
353 45750 : memcpy( out, in, sizeof(TYPE_T) ); \
354 45750 : fd_tls_##NAME##_bswap( out ); \
355 45750 : return (long)sizeof(TYPE_T); \
356 45750 : }
357 :
358 : /* End of STATIC_SERDE macro */
359 :
360 : /* Static serialization methods for fd_tls_u24_t */
361 :
362 : static inline fd_tls_u24_t
363 193737 : fd_tls_u24_bswap( fd_tls_u24_t x ) {
364 193737 : fd_tls_u24_t ret = {{ x.v[2], x.v[1], x.v[0] }};
365 193737 : return ret;
366 193737 : }
367 :
368 : static inline uint
369 119124 : fd_tls_u24_to_uint( fd_tls_u24_t x ) {
370 119124 : return fd_uint_load_3( x.v );
371 119124 : }
372 :
373 : static inline fd_tls_u24_t
374 74607 : fd_uint_to_tls_u24( uint x ) {
375 74607 : fd_tls_u24_t ret = {{ (uchar)( x &0xffU),
376 74607 : (uchar)((x>> 8)&0xffU),
377 74607 : (uchar)((x>>16)&0xffU) }};
378 74607 : return ret;
379 74607 : }
380 :
381 : /* Static serde methods for fd_tls_ext_hdr_t */
382 :
383 : static inline void
384 14031 : fd_tls_ext_hdr_bswap( fd_tls_ext_hdr_t * x ) {
385 14031 : x->type = fd_ushort_bswap( x->type );
386 14031 : x->sz = fd_ushort_bswap( x->sz );
387 14031 : }
388 :
389 : STATIC_SERDE( ext_hdr, fd_tls_ext_hdr_t )
390 :
391 : /* Static serde methods for fd_tls_msg_hdr_t */
392 :
393 : static inline void
394 146508 : fd_tls_msg_hdr_bswap( fd_tls_msg_hdr_t * x ) {
395 146508 : x->sz = fd_tls_u24_bswap( x->sz );
396 146508 : }
397 :
398 : STATIC_SERDE( msg_hdr, fd_tls_msg_hdr_t )
399 :
400 : /* Static serde methods for fd_tls_finished_t */
401 :
402 23019 : static inline void fd_tls_finished_bswap( fd_tls_finished_t * x FD_FN_UNUSED ) {}
403 :
404 : STATIC_SERDE( finished, fd_tls_finished_t )
405 :
406 : /* Methods for dynamic layout types */
407 :
408 : long
409 : fd_tls_decode_client_hello( fd_tls_client_hello_t * out,
410 : uchar const * wire,
411 : ulong wire_sz );
412 :
413 : long
414 : fd_tls_encode_client_hello( fd_tls_client_hello_t const * in,
415 : uchar * wire,
416 : ulong wire_sz );
417 :
418 : long
419 : fd_tls_decode_server_hello( fd_tls_server_hello_t * out,
420 : uchar const * wire,
421 : ulong wire_sz );
422 :
423 : long
424 : fd_tls_encode_server_hello( fd_tls_server_hello_t const * in,
425 : uchar * wire,
426 : ulong wire_sz );
427 :
428 : long
429 : fd_tls_encode_hello_retry_request( fd_tls_server_hello_t const * in,
430 : uchar * wire,
431 : ulong wire_sz );
432 :
433 : long
434 : fd_tls_decode_enc_ext( fd_tls_enc_ext_t * out,
435 : uchar const * wire,
436 : ulong wire_sz );
437 :
438 : long
439 : fd_tls_encode_enc_ext( fd_tls_enc_ext_t const * in,
440 : uchar * wire,
441 : ulong wire_sz );
442 :
443 : long
444 : fd_tls_encode_cert_x509( uchar const * x509,
445 : ulong x509_sz,
446 : uchar * wire,
447 : ulong wire_sz );
448 :
449 : long
450 : fd_tls_decode_cert_req( fd_tls_ext_signature_algorithms_t * out,
451 : uchar const * wire,
452 : ulong wire_sz );
453 :
454 : long
455 : fd_tls_decode_cert_verify( fd_tls_cert_verify_t * out,
456 : uchar const * wire,
457 : ulong wire_sz );
458 :
459 : long
460 : fd_tls_encode_cert_verify( fd_tls_cert_verify_t const * in,
461 : uchar * wire,
462 : ulong wire_sz );
463 :
464 : static inline void
465 0 : fd_tls_cert_verify_bswap( fd_tls_cert_verify_t * x ) {
466 0 : x->algorithm = fd_ushort_bswap( x->algorithm );
467 0 : }
468 :
469 : long
470 : fd_tls_decode_ext_server_name( fd_tls_ext_server_name_t * out,
471 : uchar const * wire,
472 : ulong wire_sz );
473 :
474 : long
475 : fd_tls_decode_ext_supported_groups( fd_tls_ext_supported_groups_t * out,
476 : uchar const * wire,
477 : ulong wire_sz );
478 :
479 : long
480 : fd_tls_decode_ext_supported_versions( fd_tls_ext_supported_versions_t * out,
481 : uchar const * wire,
482 : ulong wire_sz );
483 :
484 : long
485 : fd_tls_decode_ext_signature_algorithms( fd_tls_ext_signature_algorithms_t * out,
486 : uchar const * wire,
487 : ulong wire_sz );
488 :
489 : long
490 : fd_tls_decode_key_share( fd_tls_key_share_t * out,
491 : uchar const * wire,
492 : ulong wire_sz );
493 :
494 : long
495 : fd_tls_decode_key_share_list( fd_tls_key_share_t * out,
496 : uchar const * wire,
497 : ulong wire_sz );
498 :
499 : /* fd_tls_decode_ext_opaque is special:
500 : out->{buf,buf_sz} will be set to {wire,wire_sz}.
501 : i.e. lifetime of out->quic_tp is that of wire. */
502 :
503 : long
504 : fd_tls_decode_ext_opaque( fd_tls_ext_opaque_t * const out,
505 : uchar const * const wire,
506 : ulong wire_sz );
507 :
508 : static inline long
509 : fd_tls_decode_ext_quic_tp( fd_tls_ext_quic_tp_t * const out,
510 : uchar const * const wire,
511 6084 : ulong wire_sz ) {
512 6084 : return fd_tls_decode_ext_opaque( out, wire, wire_sz );
513 6084 : }
514 :
515 : long
516 : fd_tls_decode_ext_alpn( fd_tls_ext_alpn_t * const out,
517 : uchar const * const wire,
518 : ulong wire_sz );
519 :
520 : long
521 : fd_tls_encode_ext_alpn( fd_tls_ext_alpn_t const * in,
522 : uchar * wire,
523 : ulong wire_sz );
524 :
525 : /* fd_tls_extract_cert_pubkey validates the initial-handshake Certificate
526 : envelope and extracts its leaf public key. Requires an empty request
527 : context and a nonempty, exactly framed certificate_list. Rejects
528 : CertificateEntry extensions, which our CH and CR do not solicit.
529 : Does not authenticate the X.509 chain or establish trust. */
530 :
531 : struct fd_tls_extract_cert_pubkey_res {
532 : uchar const * pubkey; /* see fd_x509_cert_info_t.pubkey */
533 : ulong pubkey_len;
534 : uchar key_type; /* FD_TLS_KEY_{...} */
535 : uint alert;
536 : ushort reason;
537 : };
538 :
539 : typedef struct fd_tls_extract_cert_pubkey_res fd_tls_extract_cert_pubkey_res_t;
540 :
541 : fd_tls_extract_cert_pubkey_res_t
542 : fd_tls_extract_cert_pubkey( uchar const * cert,
543 : ulong cert_sz );
544 :
545 : FD_PROTOTYPES_END
546 :
547 : #undef STATIC_SERDE
548 :
549 : #endif /* HEADER_fd_src_waltz_tls_fd_tls_proto_h */
|
