/*

 * Copyright (C) 2000-2016 Free Software Foundation, Inc.

 * Copyright (C) 2015-2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <http://www.gnu.org/licenses/>

 *

 */

#ifndef GNUTLS_INT_H

#define GNUTLS_INT_H

#ifdef HAVE_CONFIG_H

#include <config.h>

#endif

#include <stddef.h>

#include <string.h>

#include <stdlib.h>

#include <stdio.h>

#include <ctype.h>

#include <limits.h>

#include <stdint.h>

#include <stdbool.h>

#include <assert.h>

/* For some reason gnulib likes to provide alternatives for

 * functions it doesn't include. Even worse these functions seem

 * to be available on the target systems.

 */

#undef strdup

#ifdef NO_SSIZE_T

#define HAVE_SSIZE_T

typedef int ssize_t;

#endif

#include <sys/types.h>

#include <unistd.h>

#include <sys/stat.h>

#if HAVE_SYS_SOCKET_H

#include <sys/socket.h>

#elif HAVE_WS2TCPIP_H

#include <ws2tcpip.h>

#endif

#include <time.h>

#ifdef HAVE_LIBNETTLE

#include <nettle/memxor.h>

#else

#include <gl/memxor.h>

#define memxor gl_memxor

#endif

#define ENABLE_ALIGN16

#ifdef __GNUC__

#ifndef _GNUTLS_GCC_VERSION

#define _GNUTLS_GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)

#endif

#if _GNUTLS_GCC_VERSION >= 30100

#define likely(x)      __builtin_expect((x), 1)

#define unlikely(x)    __builtin_expect((x), 0)

#endif

#if _GNUTLS_GCC_VERSION >= 70100

#define FALLTHROUGH      __attribute__ ((fallthrough))

#endif

#endif

#ifndef FALLTHROUGH

# define FALLTHROUGH

#endif

#ifndef likely

#define likely

#define unlikely

#endif

/* some systems had problems with long long int, thus,

 * it is not used.

 */

typedef struct {

	unsigned char i[8];

} gnutls_uint64;

#include <gnutls/gnutls.h>

#include <gnutls/dtls.h>

#include <gnutls/abstract.h>

#include <gnutls/socket.h>

#include <system.h>

/* in case we compile with system headers taking priority, we

 * make sure that some new attributes are still available.

 */

#ifndef __GNUTLS_CONST__

# define __GNUTLS_CONST__

#endif

/* The size of a handshake message should not

 * be larger than this value.

 */

#define MAX_HANDSHAKE_PACKET_SIZE 128*1024

/* The maximum digest size of hash algorithms. 

 */

#define MAX_FILENAME 512

#define MAX_HASH_SIZE 64

#define MAX_CIPHER_BLOCK_SIZE 16

#define MAX_CIPHER_KEY_SIZE 32

#define MAX_USERNAME_SIZE 128

#define MAX_SERVER_NAME_SIZE 256

#define AEAD_EXPLICIT_DATA_SIZE 8

#define AEAD_IMPLICIT_DATA_SIZE 4

#define GNUTLS_MASTER_SIZE 48

#define GNUTLS_RANDOM_SIZE 32

/* DTLS */

#define DTLS_RETRANS_TIMEOUT 1000

/* TLS Extensions */

/* we can receive up to MAX_EXT_TYPES extensions.

 */

#define MAX_EXT_TYPES 32

/* TLS-internal extension (will be parsed after a ciphersuite is selected).

 * This amends the gnutls_ext_parse_type_t. Not exported yet to allow more refining

 * prior to finalizing an API. */

#define _GNUTLS_EXT_TLS_POST_CS 177

/* expire time for resuming sessions */

#define DEFAULT_EXPIRE_TIME 3600

#define DEFAULT_HANDSHAKE_TIMEOUT_MS 40*1000

/* The EC group to be used when the extension

 * supported groups/curves is not present */

#define DEFAULT_EC_GROUP GNUTLS_GROUP_SECP256R1

typedef enum transport_t {

	GNUTLS_STREAM,

	GNUTLS_DGRAM

} transport_t;

typedef enum record_flush_t {

	RECORD_FLUSH = 0,

	RECORD_CORKED,

} record_flush_t;

/* the maximum size of encrypted packets */

#define IS_DTLS(session) (session->internals.transport == GNUTLS_DGRAM)

#define DEFAULT_MAX_RECORD_SIZE 16384

#define TLS_RECORD_HEADER_SIZE 5

#define DTLS_RECORD_HEADER_SIZE (TLS_RECORD_HEADER_SIZE+8)

#define RECORD_HEADER_SIZE(session) (IS_DTLS(session) ? DTLS_RECORD_HEADER_SIZE : TLS_RECORD_HEADER_SIZE)

#define MAX_RECORD_HEADER_SIZE DTLS_RECORD_HEADER_SIZE

/* The following macro is used to calculate the overhead when sending.

 * when receiving we use a different way as there are implementations that

 * store more data than allowed.

 */

#define MAX_RECORD_SEND_OVERHEAD(session) (MAX_CIPHER_BLOCK_SIZE/*iv*/+MAX_PAD_SIZE+MAX_HASH_SIZE/*MAC*/)

#define MAX_RECORD_SEND_SIZE(session) (IS_DTLS(session)? \

	(MIN((size_t)gnutls_dtls_get_mtu(session), (size_t)session->security_parameters.max_record_send_size+MAX_RECORD_SEND_OVERHEAD(session))): \

	((size_t)session->security_parameters.max_record_send_size+MAX_RECORD_SEND_OVERHEAD(session)))

#define MAX_PAD_SIZE 255

#define EXTRA_COMP_SIZE 2048

#define TLS_HANDSHAKE_HEADER_SIZE 4

#define DTLS_HANDSHAKE_HEADER_SIZE (TLS_HANDSHAKE_HEADER_SIZE+8)

#define HANDSHAKE_HEADER_SIZE(session) (IS_DTLS(session) ? DTLS_HANDSHAKE_HEADER_SIZE : TLS_HANDSHAKE_HEADER_SIZE)

#define MAX_HANDSHAKE_HEADER_SIZE DTLS_HANDSHAKE_HEADER_SIZE

/* Maximum seed size for provable parameters */

#define MAX_PVP_SEED_SIZE 256

/* This is the maximum handshake message size we send without

   fragmentation. This currently ignores record layer overhead. */

#define DTLS_DEFAULT_MTU 1200

/* the maximum size of the DTLS cookie */

#define DTLS_MAX_COOKIE_SIZE 32

/* The maximum number of HELLO_VERIFY_REQUEST messages the client

   processes before aborting. */

#define MAX_HANDSHAKE_HELLO_VERIFY_REQUESTS 5

#define MAX_PK_PARAM_SIZE 2048

/* defaults for verification functions

 */

#define DEFAULT_MAX_VERIFY_DEPTH 16

#define DEFAULT_MAX_VERIFY_BITS (MAX_PK_PARAM_SIZE*8)

#define MAX_VERIFY_DEPTH 4096

#include <mem.h>

#define MEMSUB(x,y) ((ssize_t)((ptrdiff_t)x-(ptrdiff_t)y))

#define DECR_LEN(len, x) do { len-=x; if (len<0) {gnutls_assert(); return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;} } while (0)

#define DECR_LEN_FINAL(len, x) do { \

	len-=x; \

	if (len != 0) \

		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH); \

	} while (0)

#define DECR_LENGTH_RET(len, x, RET) do { len-=x; if (len<0) {gnutls_assert(); return RET;} } while (0)

#define DECR_LENGTH_COM(len, x, COM) do { len-=x; if (len<0) {gnutls_assert(); COM;} } while (0)

#define GNUTLS_POINTER_TO_INT(_) ((int) GNUTLS_POINTER_TO_INT_CAST (_))

#define GNUTLS_INT_TO_POINTER(_) ((void*) GNUTLS_POINTER_TO_INT_CAST (_))

#define GNUTLS_KX_INVALID (-1)

typedef struct {

	uint8_t pint[3];

} uint24;

#include <mpi.h>

typedef enum handshake_state_t { STATE0 = 0, STATE1, STATE2,

	STATE3, STATE4, STATE5, STATE6, STATE7, STATE8,

	STATE9, STATE10, STATE11, STATE12, STATE13, STATE14,

	STATE15, STATE16, STATE17, STATE18, STATE19,

	STATE20 = 20, STATE21, STATE22,

	STATE30 = 30, STATE31, STATE40 = 40, STATE41, STATE50 = 50

} handshake_state_t;

typedef enum bye_state_t {

	BYE_STATE0 = 0, BYE_STATE1, BYE_STATE2

} bye_state_t;

#define BYE_STATE session->internals.bye_state

typedef enum heartbeat_state_t {

	SHB_SEND1 = 0,

	SHB_SEND2,

	SHB_RECV

} heartbeat_state_t;

typedef enum recv_state_t {

	RECV_STATE_0 = 0,

	RECV_STATE_DTLS_RETRANSMIT,

	RECV_STATE_FALSE_START_HANDLING, /* we are calling gnutls_handshake() within record_recv() */

	RECV_STATE_FALSE_START /* gnutls_record_recv() should complete the handshake */

} recv_state_t;

#include "str.h"

/* This is the maximum number of algorithms (ciphers or macs etc).

 * keep it synced with GNUTLS_MAX_ALGORITHM_NUM in gnutls.h

 */

#define MAX_ALGOS GNUTLS_MAX_ALGORITHM_NUM

/* http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml

 */

typedef enum extensions_t {

	GNUTLS_EXTENSION_SERVER_NAME = 0,

	GNUTLS_EXTENSION_MAX_RECORD_SIZE = 1,

	GNUTLS_EXTENSION_STATUS_REQUEST = 5,

	GNUTLS_EXTENSION_CERT_TYPE = 9,

	GNUTLS_EXTENSION_SUPPORTED_ECC = 10,

	GNUTLS_EXTENSION_SUPPORTED_ECC_PF = 11,

	GNUTLS_EXTENSION_SRP = 12,

	GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS = 13,

	GNUTLS_EXTENSION_SRTP = 14,

	GNUTLS_EXTENSION_HEARTBEAT = 15,

	GNUTLS_EXTENSION_ALPN = 16,

	GNUTLS_EXTENSION_DUMBFW = 21,

	GNUTLS_EXTENSION_ETM = 22,

	GNUTLS_EXTENSION_EXT_MASTER_SECRET = 23,

	GNUTLS_EXTENSION_SESSION_TICKET = 35,

	GNUTLS_EXTENSION_SAFE_RENEGOTIATION = 65281	/* aka: 0xff01 */

} extensions_t;

typedef enum { CIPHER_STREAM, CIPHER_BLOCK, CIPHER_AEAD } cipher_type_t;

#define RESUME_TRUE 1

#define RESUME_FALSE 0

/* Record Protocol */

typedef enum content_type_t {

	GNUTLS_CHANGE_CIPHER_SPEC = 20, GNUTLS_ALERT,

	GNUTLS_HANDSHAKE, GNUTLS_APPLICATION_DATA,

	GNUTLS_HEARTBEAT

} content_type_t;

#define GNUTLS_PK_ANY (gnutls_pk_algorithm_t)-1

#define GNUTLS_PK_NONE (gnutls_pk_algorithm_t)-2

#define GNUTLS_PK_IS_RSA(pk) ((pk) == GNUTLS_PK_RSA || (pk) == GNUTLS_PK_RSA_PSS)

/* Message buffers (mbuffers) structures */

/* this is actually the maximum number of distinct handshake

 * messages that can arrive in a single flight

 */

#define MAX_HANDSHAKE_MSGS 6

typedef struct {

	/* Handshake layer type and sequence of message */

	gnutls_handshake_description_t htype;

	uint32_t length;

	/* valid in DTLS */

	uint16_t sequence;

	/* indicate whether that message is complete.

	 * complete means start_offset == 0 and end_offset == length

	 */

	uint32_t start_offset;

	uint32_t end_offset;

	uint8_t header[MAX_HANDSHAKE_HEADER_SIZE];

	int header_size;

	gnutls_buffer_st data;

} handshake_buffer_st;

typedef struct mbuffer_st {

	/* when used in mbuffer_head_st */

	struct mbuffer_st *next;

	struct mbuffer_st *prev;

	/* msg->size - mark = number of bytes left to process in this

	   message. Mark should only be non-zero when this buffer is the

	   head of the queue. */

	size_t mark;

	/* the data */

	gnutls_datum_t msg;

	size_t maximum_size;

	/* used during fill in, to separate header from data

	 * body. */

	unsigned int uhead_mark;

	/* Filled in by record layer on recv:

	 * type, record_sequence

	 */

	/* record layer content type */

	content_type_t type;

	/* record layer sequence */

	gnutls_uint64 record_sequence;

	/* Filled in by handshake layer on send:

	 * type, epoch, htype, handshake_sequence

	 */

	/* Record layer epoch of message */

	uint16_t epoch;

	/* Handshake layer type and sequence of message */

	gnutls_handshake_description_t htype;

	uint16_t handshake_sequence;

} mbuffer_st;

typedef struct mbuffer_head_st {

	mbuffer_st *head;

	mbuffer_st *tail;

	unsigned int length;

	size_t byte_length;

} mbuffer_head_st;

/* Store & Retrieve functions defines: 

 */

typedef struct auth_cred_st {

	gnutls_credentials_type_t algorithm;

	/* the type of credentials depends on algorithm 

	 */

	void *credentials;

	struct auth_cred_st *next;

} auth_cred_st;

struct gnutls_key_st {

	/* For ECDH KX */

	gnutls_pk_params_st ecdh_params; /* private part */

	/* public part */

	bigint_t ecdh_x;

	bigint_t ecdh_y;

	gnutls_datum_t ecdhx; /* public key used in ECDHX (point) */

	/* For DH KX */

	gnutls_datum_t key;

	/* For DH KX */

	gnutls_pk_params_st dh_params;

	bigint_t client_Y;

	/* for SRP */

	bigint_t srp_key;

	bigint_t srp_g;

	bigint_t srp_p;

	bigint_t A;

	bigint_t B;

	bigint_t u;

	bigint_t b;

	bigint_t a;

	bigint_t x;

	/* this is used to hold the peers authentication data 

	 */

	/* auth_info_t structures SHOULD NOT contain malloced 

	 * elements. Check gnutls_session_pack.c, and gnutls_auth.c.

	 * Remember that this should be calloced!

	 */

	void *auth_info;

	gnutls_credentials_type_t auth_info_type;

	int auth_info_size;	/* needed in order to store to db for restoring 

				 */

	uint8_t crypt_algo;

	auth_cred_st *cred;	/* used to specify keys/certificates etc */

};

typedef struct gnutls_key_st gnutls_key_st;

struct pin_info_st {

	gnutls_pin_callback_t cb;

	void *data;

};

struct record_state_st;

typedef struct record_state_st record_state_st;

struct record_parameters_st;

typedef struct record_parameters_st record_parameters_st;

/* cipher and mac parameters */

typedef struct cipher_entry_st {

	const char *name;

	gnutls_cipher_algorithm_t id;

	uint16_t blocksize;

	uint16_t keysize;

	cipher_type_t type;

	uint16_t implicit_iv;	/* the size of implicit IV - the IV generated but not sent */

	uint16_t explicit_iv;	/* the size of explicit IV - the IV stored in record */

	uint16_t cipher_iv;	/* the size of IV needed by the cipher */

	uint16_t tagsize;

	bool xor_nonce;	/* In this TLS AEAD cipher xor the implicit_iv with the nonce */

	bool only_aead; /* When set, this cipher is only available through the new AEAD API */

} cipher_entry_st;

typedef struct gnutls_cipher_suite_entry_st {

	const char *name;

	const uint8_t id[2];

	gnutls_cipher_algorithm_t block_algorithm;

	gnutls_kx_algorithm_t kx_algorithm;

	gnutls_mac_algorithm_t mac_algorithm;

	gnutls_protocol_t min_version;	/* this cipher suite is supported

					 * from 'version' and above;

					 */

	gnutls_protocol_t min_dtls_version;	/* DTLS min version */

	gnutls_mac_algorithm_t prf;

} gnutls_cipher_suite_entry_st;

typedef struct gnutls_group_entry_st {

	const char *name;

	gnutls_group_t id;

	const gnutls_datum_t *prime;

	const gnutls_datum_t *generator;

	const unsigned *q_bits;

	gnutls_ecc_curve_t curve;

	gnutls_pk_algorithm_t pk;

	unsigned tls_id;		/* The RFC4492 namedCurve ID or TLS 1.3 group ID */

} gnutls_group_entry_st;

/* This structure is used both for MACs and digests

 */

typedef struct mac_entry_st {

	const char *name;

	const char *oid;	/* OID of the hash - if it is a hash */

	const char *mac_oid;    /* OID of the MAC algorithm - if it is a MAC */

	gnutls_mac_algorithm_t id;

	unsigned output_size;

	unsigned key_size;

	unsigned nonce_size;

	unsigned placeholder;	/* if set, then not a real MAC */

	unsigned block_size;	/* internal block size for HMAC */

	unsigned preimage_insecure; /* if this algorithm should not be trusted for pre-image attacks */

} mac_entry_st;

typedef struct {

	const char *name;

	gnutls_protocol_t id;	/* gnutls internal version number */

	unsigned age;		/* internal ordering by protocol age */

	uint8_t major;		/* defined by the protocol */

	uint8_t minor;		/* defined by the protocol */

	transport_t transport;	/* Type of transport, stream or datagram */

	bool supported;	/* 0 not supported, > 0 is supported */

	bool explicit_iv;

	bool extensions;	/* whether it supports extensions */

	bool selectable_sighash;	/* whether signatures can be selected */

	bool selectable_prf;	/* whether the PRF is ciphersuite-defined */

	/* if SSL3 is disabled this flag indicates that this protocol is a placeholder,

	 * otherwise it prevents this protocol from being set as record version */

	bool obsolete;

	bool false_start;	/* That version can be used with false start */

} version_entry_st;

/* STATE (cont) */

#include <hash_int.h>

#include <cipher_int.h>

typedef struct {

	uint8_t id[2]; /* used to be (in TLS 1.2) hash algorithm , PK algorithm */

} sign_algorithm_st;

/* This structure holds parameters got from TLS extension

 * mechanism. (some extensions may hold parameters in auth_info_t

 * structures also - see SRP).

 */

#define MAX_VERIFY_DATA_SIZE 36	/* in SSL 3.0, 12 in TLS 1.0 */

/* auth_info_t structures now MAY contain malloced 

 * elements.

 */

/* This structure and auth_info_t, are stored in the resume database,

 * and are restored, in case of resume.

 * Holds all the required parameters to resume the current 

 * session.

 */

/* Note that the security parameters structure is set up after the

 * handshake has finished. The only value you may depend on while

 * the handshake is in progress is the cipher suite value.

 */

typedef struct {

	unsigned int entity;	/* GNUTLS_SERVER or GNUTLS_CLIENT */

	/* The epoch used to read and write */

	uint16_t epoch_read;

	uint16_t epoch_write;

	/* The epoch that the next handshake will initialize. */

	uint16_t epoch_next;

	/* The epoch at index 0 of record_parameters. */

	uint16_t epoch_min;

	/* this is the ciphersuite we are going to use 

	 * moved here from internals in order to be restored

	 * on resume;

	 */

	const struct gnutls_cipher_suite_entry_st *cs;

	/* This is kept outside the ciphersuite entry as on certain

	 * TLS versions we need a separate PRF MAC, i.e., MD5_SHA1. */

	gnutls_mac_algorithm_t prf_mac;

	uint8_t master_secret[GNUTLS_MASTER_SIZE];

	uint8_t client_random[GNUTLS_RANDOM_SIZE];

	uint8_t server_random[GNUTLS_RANDOM_SIZE];

	uint8_t session_id[GNUTLS_MAX_SESSION_ID_SIZE];

	uint8_t session_id_size;

	time_t timestamp;

	/* The send size is the one requested by the programmer.

	 * The recv size is the one negotiated with the peer.

	 */

	uint16_t max_record_send_size;

	uint16_t max_record_recv_size;

	/* holds the negotiated certificate type */

	gnutls_certificate_type_t cert_type;

	/* The selected (after server hello EC or DH group */

	const gnutls_group_entry_st *grp;

	/* Holds the signature algorithm that will be used in this session,

	 * selected by the server at the time of Ciphersuite/certificate

	 * selection - see select_sign_algorithm() */

	gnutls_sign_algorithm_t server_sign_algo;

	/* Holds the signature algorithm used in this session - If any */

	gnutls_sign_algorithm_t client_sign_algo;

	/* Whether the master secret negotiation will be according to

	 * draft-ietf-tls-session-hash-01

	 */

	uint8_t ext_master_secret;

	/* encrypt-then-mac -> rfc7366 */

	uint8_t etm;

	/* Note: if you add anything in Security_Parameters struct, then

	 * also modify CPY_COMMON in gnutls_constate.c, and gnutls_session_pack.c,

	 * in order to save it in the session storage.

	 */

	/* Used by extensions that enable supplemental data: Which ones

	 * do that? Do they belong in security parameters?

	 */

	int do_recv_supplemental, do_send_supplemental;

	const version_entry_st *pversion;

} security_parameters_st;

struct record_state_st {

	gnutls_datum_t mac_secret;

	gnutls_datum_t IV;

	gnutls_datum_t key;

	auth_cipher_hd_st cipher_state;

	gnutls_uint64 sequence_number;

};

/* These are used to resolve relative epochs. These values are just

   outside the 16 bit range to prevent off-by-one errors. An absolute

   epoch may be referred to by its numeric id in the range

   0x0000-0xffff. */

#define EPOCH_READ_CURRENT  70000

#define EPOCH_WRITE_CURRENT 70001

#define EPOCH_NEXT	  70002

struct record_parameters_st {

	uint16_t epoch;

	int initialized;

	const cipher_entry_st *cipher;

	bool etm;

	const mac_entry_st *mac;

	/* for DTLS sliding window */

	uint64_t dtls_sw_next; /* The end point (next expected packet) of the sliding window without epoch */

	uint64_t dtls_sw_bits;

	unsigned dtls_sw_have_recv; /* whether at least a packet has been received */

	record_state_st read;

	record_state_st write;

	/* Whether this state is in use, i.e., if there is

	   a pending handshake message waiting to be encrypted

	   under this epoch's parameters.

	 */

	int usage_cnt;

};

typedef struct {

	unsigned int priority[MAX_ALGOS];

	unsigned int algorithms;

} priority_st;

typedef enum {

	SR_DISABLED,

	SR_UNSAFE,

	SR_PARTIAL,

	SR_SAFE

} safe_renegotiation_t;

#define MAX_CIPHERSUITE_SIZE 256

typedef struct ciphersuite_list_st {

	const gnutls_cipher_suite_entry_st *entry[MAX_CIPHERSUITE_SIZE];

	unsigned int size;

} ciphersuite_list_st;

typedef struct group_list_st {

	const gnutls_group_entry_st *entry[MAX_ALGOS];

	unsigned int size;

	bool have_ffdhe;

} group_list_st;

typedef struct sign_algo_list_st {

	const struct gnutls_sign_entry_st *entry[MAX_ALGOS];

	unsigned int size;

} sign_algo_list_st;

#include "atomic.h"

/* For the external api */

struct gnutls_priority_st {

	priority_st protocol;

	priority_st cert_type;

	/* The following are not necessary to be stored in

	 * the structure; however they are required by the

	 * external APIs: gnutls_priority_*_list() */

	priority_st _cipher;

	priority_st _mac;

	priority_st _kx;

	priority_st _sign_algo;

	priority_st _supported_ecc;

	/* the supported groups */

	group_list_st groups;

	/* the supported signature algorithms */

	sign_algo_list_st sigalg;

	/* the supported ciphersuites */

	ciphersuite_list_st cs;

	/* to disable record padding */

	bool no_extensions;

	safe_renegotiation_t sr;

	bool min_record_version;

	bool server_precedence;

	bool allow_server_key_usage_violation; /* for test suite purposes only */

	bool no_tickets;

	bool have_cbc;

	unsigned int additional_verify_flags;

	/* TLS_FALLBACK_SCSV */

	bool fallback;

	/* The session's expected security level.

	 * Will be used to determine the minimum DH bits,

	 * (or the acceptable certificate security level).

	 */

	gnutls_sec_param_t level;

	/* these should be accessed from

	 * session->internals.VAR names */

	bool _allow_large_records;

	bool _no_etm;

	bool _no_ext_master_secret;

	bool _allow_key_usage_violation;

	bool _allow_wrong_pms;

	bool _dumbfw;

	unsigned int _dh_prime_bits;	/* old (deprecated) variable */

	DEF_ATOMIC_INT(usage_cnt);

};

/* Allow around 50KB of length-hiding padding

 * when using legacy padding,

 * or around 3.2MB when using new padding. */

#define DEFAULT_MAX_EMPTY_RECORDS 200

#define ENABLE_COMPAT(x) \

	      (x)->allow_large_records = 1; \

	      (x)->no_etm = 1; \

	      (x)->no_ext_master_secret = 1; \

	      (x)->allow_key_usage_violation = 1; \

	      (x)->allow_wrong_pms = 1; \

	      (x)->dumbfw = 1

#define ENABLE_PRIO_COMPAT(x) \

	      (x)->_allow_large_records = 1; \

	      (x)->_no_etm = 1; \

	      (x)->_no_ext_master_secret = 1; \

	      (x)->_allow_key_usage_violation = 1; \

	      (x)->_allow_wrong_pms = 1; \

	      (x)->_dumbfw = 1

/* DH and RSA parameters types.

 */

typedef struct gnutls_dh_params_int {

	/* [0] is the prime, [1] is the generator.

	 */

	bigint_t params[2];

	int q_bits;		/* length of q in bits. If zero then length is unknown.

				 */

} dh_params_st;

/* DTLS session state

 */

typedef struct {

	/* HelloVerifyRequest DOS prevention cookie */

	uint8_t cookie[DTLS_MAX_COOKIE_SIZE];

	uint8_t cookie_len;

	/* For DTLS handshake fragmentation and reassembly. */

	uint16_t hsk_write_seq;

	/* the sequence number of the expected packet */

	unsigned int hsk_read_seq;

	uint16_t mtu;

	/* a flight transmission is in process */

	bool flight_init;

	/* whether this is the last flight in the protocol  */

	bool last_flight;

	/* the retransmission timeout in milliseconds */

	unsigned int retrans_timeout_ms;

	unsigned int hsk_hello_verify_requests;

	/* The actual retrans_timeout for the next message (e.g. doubled or so) 

	 */

	unsigned int actual_retrans_timeout_ms;

	/* timers to handle async handshake after gnutls_handshake()

	 * has terminated. Required to handle retransmissions.

	 */

	time_t async_term;

	/* last retransmission triggered by record layer */

	struct timespec last_retransmit;

	unsigned int packets_dropped;

} dtls_st;

typedef struct tfo_st {

	int fd;

	int flags;

	bool connect_only; /* a previous sendmsg() failed, attempting connect() */

	struct sockaddr_storage connect_addr;

	socklen_t connect_addrlen;

} tfo_st;

typedef struct {

	/* holds all the parsed data received by the record layer */

	mbuffer_head_st record_buffer;

	int handshake_hash_buffer_prev_len;	/* keeps the length of handshake_hash_buffer, excluding

						 * the last received message */

	unsigned handshake_hash_buffer_client_kx_len;/* if non-zero it is the length of data until the

						 * the client key exchange message */

	gnutls_buffer_st handshake_hash_buffer;	/* used to keep the last received handshake 

						 * message */

	bool resumable;	/* TRUE or FALSE - if we can resume that session */

	bool ticket_sent;	/* whether a session ticket was sent */

	bye_state_t bye_state; /* used by gnutls_bye() */

	handshake_state_t handshake_final_state;

	handshake_state_t handshake_state;	/* holds

						 * a number which indicates where

						 * the handshake procedure has been

						 * interrupted. If it is 0 then

						 * no interruption has happened.

						 */

	bool invalid_connection;	/* true or FALSE - if this session is valid */

	bool may_not_read;	/* if it's 0 then we can read/write, otherwise it's forbiden to read/write

				 */

	bool may_not_write;

	bool read_eof;		/* non-zero if we have received a closure alert. */

	int last_alert;		/* last alert received */

	/* The last handshake messages sent or received.

	 */

	int last_handshake_in;

	int last_handshake_out;

	/* priorities */

	struct gnutls_priority_st *priorities;

	/* variables directly set when setting the priorities above, or

	 * when overriding them */

	bool allow_large_records;

	bool no_etm;

	bool no_ext_master_secret;

	bool allow_key_usage_violation;

	bool allow_wrong_pms;

	bool dumbfw;

	unsigned int dh_prime_bits;	/* old (deprecated) variable */

	/* resumed session */

	bool resumed;	/* RESUME_TRUE or FALSE - if we are resuming a session */

	bool resumption_requested;	/* non-zero if resumption was requested by client */

	security_parameters_st resumed_security_parameters;

	gnutls_datum_t resumption_data; /* copy of input to gnutls_session_set_data() */