[MBEDTLS] Update to v2.2.0. By Ismael Ferreras Morezuelas. CORE-10561
[reactos.git] / reactos / include / reactos / libs / mbedtls / ssl.h
1 /**
2 * \file ssl.h
3 *
4 * \brief SSL/TLS functions.
5 *
6 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
7 * SPDX-License-Identifier: Apache-2.0
8 *
9 * Licensed under the Apache License, Version 2.0 (the "License"); you may
10 * not use this file except in compliance with the License.
11 * You may obtain a copy of the License at
12 *
13 * http://www.apache.org/licenses/LICENSE-2.0
14 *
15 * Unless required by applicable law or agreed to in writing, software
16 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
17 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18 * See the License for the specific language governing permissions and
19 * limitations under the License.
20 *
21 * This file is part of mbed TLS (https://tls.mbed.org)
22 */
23 #ifndef MBEDTLS_SSL_H
24 #define MBEDTLS_SSL_H
25
26 #if !defined(MBEDTLS_CONFIG_FILE)
27 #include "config.h"
28 #else
29 #include MBEDTLS_CONFIG_FILE
30 #endif
31
32 #include "bignum.h"
33 #include "ecp.h"
34
35 #include "ssl_ciphersuites.h"
36
37 #if defined(MBEDTLS_X509_CRT_PARSE_C)
38 #include "x509_crt.h"
39 #include "x509_crl.h"
40 #endif
41
42 #if defined(MBEDTLS_DHM_C)
43 #include "dhm.h"
44 #endif
45
46 #if defined(MBEDTLS_ECDH_C)
47 #include "ecdh.h"
48 #endif
49
50 #if defined(MBEDTLS_ZLIB_SUPPORT)
51 #include "zlib.h"
52 #endif
53
54 #if defined(MBEDTLS_HAVE_TIME)
55 #include <time.h>
56 #endif
57
58 /*
59 * SSL Error codes
60 */
61 #define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE -0x7080 /**< The requested feature is not available. */
62 #define MBEDTLS_ERR_SSL_BAD_INPUT_DATA -0x7100 /**< Bad input parameters to function. */
63 #define MBEDTLS_ERR_SSL_INVALID_MAC -0x7180 /**< Verification of the message MAC failed. */
64 #define MBEDTLS_ERR_SSL_INVALID_RECORD -0x7200 /**< An invalid SSL record was received. */
65 #define MBEDTLS_ERR_SSL_CONN_EOF -0x7280 /**< The connection indicated an EOF. */
66 #define MBEDTLS_ERR_SSL_UNKNOWN_CIPHER -0x7300 /**< An unknown cipher was received. */
67 #define MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 /**< The server has no ciphersuites in common with the client. */
68 #define MBEDTLS_ERR_SSL_NO_RNG -0x7400 /**< No RNG was provided to the SSL module. */
69 #define MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 /**< No client certification received from the client, but required by the authentication mode. */
70 #define MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 /**< Our own certificate(s) is/are too large to send in an SSL message. */
71 #define MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 /**< The own certificate is not set, but needed by the server. */
72 #define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 /**< The own private key or pre-shared key is not set, but needed. */
73 #define MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 /**< No CA Chain is set, but required to operate. */
74 #define MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 /**< An unexpected message was received from our peer. */
75 #define MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 /**< A fatal alert message was received from our peer. */
76 #define MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED -0x7800 /**< Verification of our peer failed. */
77 #define MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 /**< The peer notified us that the connection is going to be closed. */
78 #define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 /**< Processing of the ClientHello handshake message failed. */
79 #define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 /**< Processing of the ServerHello handshake message failed. */
80 #define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 /**< Processing of the Certificate handshake message failed. */
81 #define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 /**< Processing of the CertificateRequest handshake message failed. */
82 #define MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 /**< Processing of the ServerKeyExchange handshake message failed. */
83 #define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 /**< Processing of the ServerHelloDone handshake message failed. */
84 #define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 /**< Processing of the ClientKeyExchange handshake message failed. */
85 #define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP -0x7C80 /**< Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Read Public. */
86 #define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS -0x7D00 /**< Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Calculate Secret. */
87 #define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 /**< Processing of the CertificateVerify handshake message failed. */
88 #define MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 /**< Processing of the ChangeCipherSpec handshake message failed. */
89 #define MBEDTLS_ERR_SSL_BAD_HS_FINISHED -0x7E80 /**< Processing of the Finished handshake message failed. */
90 #define MBEDTLS_ERR_SSL_ALLOC_FAILED -0x7F00 /**< Memory allocation failed */
91 #define MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -0x7F80 /**< Hardware acceleration function returned with error */
92 #define MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 /**< Hardware acceleration function skipped / left alone data */
93 #define MBEDTLS_ERR_SSL_COMPRESSION_FAILED -0x6F00 /**< Processing of the compression / decompression failed */
94 #define MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 /**< Handshake protocol not within min/max boundaries */
95 #define MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET -0x6E00 /**< Processing of the NewSessionTicket handshake message failed. */
96 #define MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 /**< Session ticket has expired. */
97 #define MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 /**< Public key type mismatch (eg, asked for RSA key exchange and presented EC key) */
98 #define MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 /**< Unknown identity received (eg, PSK identity) */
99 #define MBEDTLS_ERR_SSL_INTERNAL_ERROR -0x6C00 /**< Internal error (eg, unexpected failure in lower-level module) */
100 #define MBEDTLS_ERR_SSL_COUNTER_WRAPPING -0x6B80 /**< A counter would wrap (eg, too many messages exchanged). */
101 #define MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO -0x6B00 /**< Unexpected message at ServerHello in renegotiation. */
102 #define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED -0x6A80 /**< DTLS client must retry for hello verification */
103 #define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL -0x6A00 /**< A buffer is too small to receive or write a message */
104 #define MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE -0x6980 /**< None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */
105 #define MBEDTLS_ERR_SSL_WANT_READ -0x6900 /**< Connection requires a read call. */
106 #define MBEDTLS_ERR_SSL_WANT_WRITE -0x6880 /**< Connection requires a write call. */
107 #define MBEDTLS_ERR_SSL_TIMEOUT -0x6800 /**< The operation timed out. */
108 #define MBEDTLS_ERR_SSL_CLIENT_RECONNECT -0x6780 /**< The client initiated a reconnect from the same port. */
109
110 /*
111 * Various constants
112 */
113 #define MBEDTLS_SSL_MAJOR_VERSION_3 3
114 #define MBEDTLS_SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */
115 #define MBEDTLS_SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */
116 #define MBEDTLS_SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */
117 #define MBEDTLS_SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */
118
119 #define MBEDTLS_SSL_TRANSPORT_STREAM 0 /*!< TLS */
120 #define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 /*!< DTLS */
121
122 #define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 /*!< Maximum host name defined in RFC 1035 */
123
124 /* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c
125 * NONE must be zero so that memset()ing structure to zero works */
126 #define MBEDTLS_SSL_MAX_FRAG_LEN_NONE 0 /*!< don't use this extension */
127 #define MBEDTLS_SSL_MAX_FRAG_LEN_512 1 /*!< MaxFragmentLength 2^9 */
128 #define MBEDTLS_SSL_MAX_FRAG_LEN_1024 2 /*!< MaxFragmentLength 2^10 */
129 #define MBEDTLS_SSL_MAX_FRAG_LEN_2048 3 /*!< MaxFragmentLength 2^11 */
130 #define MBEDTLS_SSL_MAX_FRAG_LEN_4096 4 /*!< MaxFragmentLength 2^12 */
131 #define MBEDTLS_SSL_MAX_FRAG_LEN_INVALID 5 /*!< first invalid value */
132
133 #define MBEDTLS_SSL_IS_CLIENT 0
134 #define MBEDTLS_SSL_IS_SERVER 1
135
136 #define MBEDTLS_SSL_IS_NOT_FALLBACK 0
137 #define MBEDTLS_SSL_IS_FALLBACK 1
138
139 #define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0
140 #define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1
141
142 #define MBEDTLS_SSL_ETM_DISABLED 0
143 #define MBEDTLS_SSL_ETM_ENABLED 1
144
145 #define MBEDTLS_SSL_COMPRESS_NULL 0
146 #define MBEDTLS_SSL_COMPRESS_DEFLATE 1
147
148 #define MBEDTLS_SSL_VERIFY_NONE 0
149 #define MBEDTLS_SSL_VERIFY_OPTIONAL 1
150 #define MBEDTLS_SSL_VERIFY_REQUIRED 2
151 #define MBEDTLS_SSL_VERIFY_UNSET 3 /* Used only for sni_authmode */
152
153 #define MBEDTLS_SSL_LEGACY_RENEGOTIATION 0
154 #define MBEDTLS_SSL_SECURE_RENEGOTIATION 1
155
156 #define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0
157 #define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1
158
159 #define MBEDTLS_SSL_ANTI_REPLAY_DISABLED 0
160 #define MBEDTLS_SSL_ANTI_REPLAY_ENABLED 1
161
162 #define MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED -1
163 #define MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT 16
164
165 #define MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION 0
166 #define MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION 1
167 #define MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE 2
168
169 #define MBEDTLS_SSL_TRUNC_HMAC_DISABLED 0
170 #define MBEDTLS_SSL_TRUNC_HMAC_ENABLED 1
171 #define MBEDTLS_SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 */
172
173 #define MBEDTLS_SSL_SESSION_TICKETS_DISABLED 0
174 #define MBEDTLS_SSL_SESSION_TICKETS_ENABLED 1
175
176 #define MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED 0
177 #define MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED 1
178
179 #define MBEDTLS_SSL_ARC4_ENABLED 0
180 #define MBEDTLS_SSL_ARC4_DISABLED 1
181
182 #define MBEDTLS_SSL_PRESET_DEFAULT 0
183 #define MBEDTLS_SSL_PRESET_SUITEB 2
184
185 /*
186 * Default range for DTLS retransmission timer value, in milliseconds.
187 * RFC 6347 4.2.4.1 says from 1 second to 60 seconds.
188 */
189 #define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN 1000
190 #define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX 60000
191
192 /**
193 * \name SECTION: Module settings
194 *
195 * The configuration options you can set for this module are in this section.
196 * Either change them in config.h or define them on the compiler command line.
197 * \{
198 */
199
200 #if !defined(MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME)
201 #define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */
202 #endif
203
204 /*
205 * Maxium fragment length in bytes,
206 * determines the size of each of the two internal I/O buffers.
207 *
208 * Note: the RFC defines the default size of SSL / TLS messages. If you
209 * change the value here, other clients / servers may not be able to
210 * communicate with you anymore. Only change this value if you control
211 * both sides of the connection and have it reduced at both sides, or
212 * if you're using the Max Fragment Length extension and you know all your
213 * peers are using it too!
214 */
215 #if !defined(MBEDTLS_SSL_MAX_CONTENT_LEN)
216 #define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output buffer */
217 #endif
218
219 /* \} name SECTION: Module settings */
220
221 /*
222 * Length of the verify data for secure renegotiation
223 */
224 #if defined(MBEDTLS_SSL_PROTO_SSL3)
225 #define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 36
226 #else
227 #define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12
228 #endif
229
230 /*
231 * Signaling ciphersuite values (SCSV)
232 */
233 #define MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext */
234 #define MBEDTLS_SSL_FALLBACK_SCSV_VALUE 0x5600 /**< draft-ietf-tls-downgrade-scsv-00 */
235
236 /*
237 * Supported Signature and Hash algorithms (For TLS 1.2)
238 * RFC 5246 section 7.4.1.4.1
239 */
240 #define MBEDTLS_SSL_HASH_NONE 0
241 #define MBEDTLS_SSL_HASH_MD5 1
242 #define MBEDTLS_SSL_HASH_SHA1 2
243 #define MBEDTLS_SSL_HASH_SHA224 3
244 #define MBEDTLS_SSL_HASH_SHA256 4
245 #define MBEDTLS_SSL_HASH_SHA384 5
246 #define MBEDTLS_SSL_HASH_SHA512 6
247
248 #define MBEDTLS_SSL_SIG_ANON 0
249 #define MBEDTLS_SSL_SIG_RSA 1
250 #define MBEDTLS_SSL_SIG_ECDSA 3
251
252 /*
253 * Client Certificate Types
254 * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5
255 */
256 #define MBEDTLS_SSL_CERT_TYPE_RSA_SIGN 1
257 #define MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN 64
258
259 /*
260 * Message, alert and handshake types
261 */
262 #define MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC 20
263 #define MBEDTLS_SSL_MSG_ALERT 21
264 #define MBEDTLS_SSL_MSG_HANDSHAKE 22
265 #define MBEDTLS_SSL_MSG_APPLICATION_DATA 23
266
267 #define MBEDTLS_SSL_ALERT_LEVEL_WARNING 1
268 #define MBEDTLS_SSL_ALERT_LEVEL_FATAL 2
269
270 #define MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY 0 /* 0x00 */
271 #define MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE 10 /* 0x0A */
272 #define MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC 20 /* 0x14 */
273 #define MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED 21 /* 0x15 */
274 #define MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW 22 /* 0x16 */
275 #define MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30 /* 0x1E */
276 #define MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE 40 /* 0x28 */
277 #define MBEDTLS_SSL_ALERT_MSG_NO_CERT 41 /* 0x29 */
278 #define MBEDTLS_SSL_ALERT_MSG_BAD_CERT 42 /* 0x2A */
279 #define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT 43 /* 0x2B */
280 #define MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED 44 /* 0x2C */
281 #define MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED 45 /* 0x2D */
282 #define MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN 46 /* 0x2E */
283 #define MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER 47 /* 0x2F */
284 #define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA 48 /* 0x30 */
285 #define MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED 49 /* 0x31 */
286 #define MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */
287 #define MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */
288 #define MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */
289 #define MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */
290 #define MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */
291 #define MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */
292 #define MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK 86 /* 0x56 */
293 #define MBEDTLS_SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */
294 #define MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */
295 #define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */
296 #define MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */
297 #define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */
298 #define MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL 120 /* 0x78 */
299
300 #define MBEDTLS_SSL_HS_HELLO_REQUEST 0
301 #define MBEDTLS_SSL_HS_CLIENT_HELLO 1
302 #define MBEDTLS_SSL_HS_SERVER_HELLO 2
303 #define MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST 3
304 #define MBEDTLS_SSL_HS_NEW_SESSION_TICKET 4
305 #define MBEDTLS_SSL_HS_CERTIFICATE 11
306 #define MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE 12
307 #define MBEDTLS_SSL_HS_CERTIFICATE_REQUEST 13
308 #define MBEDTLS_SSL_HS_SERVER_HELLO_DONE 14
309 #define MBEDTLS_SSL_HS_CERTIFICATE_VERIFY 15
310 #define MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE 16
311 #define MBEDTLS_SSL_HS_FINISHED 20
312
313 /*
314 * TLS extensions
315 */
316 #define MBEDTLS_TLS_EXT_SERVERNAME 0
317 #define MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME 0
318
319 #define MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH 1
320
321 #define MBEDTLS_TLS_EXT_TRUNCATED_HMAC 4
322
323 #define MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10
324 #define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS 11
325
326 #define MBEDTLS_TLS_EXT_SIG_ALG 13
327
328 #define MBEDTLS_TLS_EXT_ALPN 16
329
330 #define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC 22 /* 0x16 */
331 #define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET 0x0017 /* 23 */
332
333 #define MBEDTLS_TLS_EXT_SESSION_TICKET 35
334
335 #define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */
336
337 #define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01
338
339 /*
340 * Size defines
341 */
342 #if !defined(MBEDTLS_PSK_MAX_LEN)
343 #define MBEDTLS_PSK_MAX_LEN 32 /* 256 bits */
344 #endif
345
346 /* Dummy type used only for its size */
347 union mbedtls_ssl_premaster_secret
348 {
349 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
350 unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */
351 #endif
352 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
353 unsigned char _pms_dhm[MBEDTLS_MPI_MAX_SIZE]; /* RFC 5246 8.1.2 */
354 #endif
355 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
356 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
357 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
358 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
359 unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */
360 #endif
361 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
362 unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */
363 #endif
364 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
365 unsigned char _pms_dhe_psk[4 + MBEDTLS_MPI_MAX_SIZE
366 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 3 */
367 #endif
368 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
369 unsigned char _pms_rsa_psk[52 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 4 */
370 #endif
371 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
372 unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES
373 + MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */
374 #endif
375 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
376 unsigned char _pms_ecjpake[32]; /* Thread spec: SHA-256 output */
377 #endif
378 };
379
380 #define MBEDTLS_PREMASTER_SIZE sizeof( union mbedtls_ssl_premaster_secret )
381
382 #ifdef __cplusplus
383 extern "C" {
384 #endif
385
386 /*
387 * SSL state machine
388 */
389 typedef enum
390 {
391 MBEDTLS_SSL_HELLO_REQUEST,
392 MBEDTLS_SSL_CLIENT_HELLO,
393 MBEDTLS_SSL_SERVER_HELLO,
394 MBEDTLS_SSL_SERVER_CERTIFICATE,
395 MBEDTLS_SSL_SERVER_KEY_EXCHANGE,
396 MBEDTLS_SSL_CERTIFICATE_REQUEST,
397 MBEDTLS_SSL_SERVER_HELLO_DONE,
398 MBEDTLS_SSL_CLIENT_CERTIFICATE,
399 MBEDTLS_SSL_CLIENT_KEY_EXCHANGE,
400 MBEDTLS_SSL_CERTIFICATE_VERIFY,
401 MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC,
402 MBEDTLS_SSL_CLIENT_FINISHED,
403 MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC,
404 MBEDTLS_SSL_SERVER_FINISHED,
405 MBEDTLS_SSL_FLUSH_BUFFERS,
406 MBEDTLS_SSL_HANDSHAKE_WRAPUP,
407 MBEDTLS_SSL_HANDSHAKE_OVER,
408 MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET,
409 MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT,
410 }
411 mbedtls_ssl_states;
412
413 /* Defined below */
414 typedef struct mbedtls_ssl_session mbedtls_ssl_session;
415 typedef struct mbedtls_ssl_context mbedtls_ssl_context;
416 typedef struct mbedtls_ssl_config mbedtls_ssl_config;
417
418 /* Defined in ssl_internal.h */
419 typedef struct mbedtls_ssl_transform mbedtls_ssl_transform;
420 typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params;
421 #if defined(MBEDTLS_X509_CRT_PARSE_C)
422 typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert;
423 #endif
424 #if defined(MBEDTLS_SSL_PROTO_DTLS)
425 typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item;
426 #endif
427
428 /*
429 * This structure is used for storing current session data.
430 */
431 struct mbedtls_ssl_session
432 {
433 #if defined(MBEDTLS_HAVE_TIME)
434 time_t start; /*!< starting time */
435 #endif
436 int ciphersuite; /*!< chosen ciphersuite */
437 int compression; /*!< chosen compression */
438 size_t id_len; /*!< session id length */
439 unsigned char id[32]; /*!< session identifier */
440 unsigned char master[48]; /*!< the master secret */
441
442 #if defined(MBEDTLS_X509_CRT_PARSE_C)
443 mbedtls_x509_crt *peer_cert; /*!< peer X.509 cert chain */
444 #endif /* MBEDTLS_X509_CRT_PARSE_C */
445 uint32_t verify_result; /*!< verification result */
446
447 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
448 unsigned char *ticket; /*!< RFC 5077 session ticket */
449 size_t ticket_len; /*!< session ticket length */
450 uint32_t ticket_lifetime; /*!< ticket lifetime hint */
451 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
452
453 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
454 unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer */
455 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
456
457 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
458 int trunc_hmac; /*!< flag for truncated hmac activation */
459 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
460
461 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
462 int encrypt_then_mac; /*!< flag for EtM activation */
463 #endif
464 };
465
466 /**
467 * SSL/TLS configuration to be shared between mbedtls_ssl_context structures.
468 */
469 struct mbedtls_ssl_config
470 {
471 /* Group items by size (largest first) to minimize padding overhead */
472
473 /*
474 * Pointers
475 */
476
477 const int *ciphersuite_list[4]; /*!< allowed ciphersuites per version */
478
479 /** Callback for printing debug output */
480 void (*f_dbg)(void *, int, const char *, int, const char *);
481 void *p_dbg; /*!< context for the debug function */
482
483 /** Callback for getting (pseudo-)random numbers */
484 int (*f_rng)(void *, unsigned char *, size_t);
485 void *p_rng; /*!< context for the RNG function */
486
487 /** Callback to retrieve a session from the cache */
488 int (*f_get_cache)(void *, mbedtls_ssl_session *);
489 /** Callback to store a session into the cache */
490 int (*f_set_cache)(void *, const mbedtls_ssl_session *);
491 void *p_cache; /*!< context for cache callbacks */
492
493 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
494 /** Callback for setting cert according to SNI extension */
495 int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, size_t);
496 void *p_sni; /*!< context for SNI callback */
497 #endif
498
499 #if defined(MBEDTLS_X509_CRT_PARSE_C)
500 /** Callback to customize X.509 certificate chain verification */
501 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
502 void *p_vrfy; /*!< context for X.509 verify calllback */
503 #endif
504
505 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
506 /** Callback to retrieve PSK key from identity */
507 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, size_t);
508 void *p_psk; /*!< context for PSK callback */
509 #endif
510
511 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
512 /** Callback to create & write a cookie for ClientHello veirifcation */
513 int (*f_cookie_write)( void *, unsigned char **, unsigned char *,
514 const unsigned char *, size_t );
515 /** Callback to verify validity of a ClientHello cookie */
516 int (*f_cookie_check)( void *, const unsigned char *, size_t,
517 const unsigned char *, size_t );
518 void *p_cookie; /*!< context for the cookie callbacks */
519 #endif
520
521 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C)
522 /** Callback to create & write a session ticket */
523 int (*f_ticket_write)( void *, const mbedtls_ssl_session *,
524 unsigned char *, const unsigned char *, size_t *, uint32_t * );
525 /** Callback to parse a session ticket into a session structure */
526 int (*f_ticket_parse)( void *, mbedtls_ssl_session *, unsigned char *, size_t);
527 void *p_ticket; /*!< context for the ticket callbacks */
528 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */
529
530 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
531 /** Callback to export key block and master secret */
532 int (*f_export_keys)( void *, const unsigned char *,
533 const unsigned char *, size_t, size_t, size_t );
534 void *p_export_keys; /*!< context for key export callback */
535 #endif
536
537 #if defined(MBEDTLS_X509_CRT_PARSE_C)
538 const mbedtls_x509_crt_profile *cert_profile; /*!< verification profile */
539 mbedtls_ssl_key_cert *key_cert; /*!< own certificate/key pair(s) */
540 mbedtls_x509_crt *ca_chain; /*!< trusted CAs */
541 mbedtls_x509_crl *ca_crl; /*!< trusted CAs CRLs */
542 #endif /* MBEDTLS_X509_CRT_PARSE_C */
543
544 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
545 const int *sig_hashes; /*!< allowed signature hashes */
546 #endif
547
548 #if defined(MBEDTLS_ECP_C)
549 const mbedtls_ecp_group_id *curve_list; /*!< allowed curves */
550 #endif
551
552 #if defined(MBEDTLS_DHM_C)
553 mbedtls_mpi dhm_P; /*!< prime modulus for DHM */
554 mbedtls_mpi dhm_G; /*!< generator for DHM */
555 #endif
556
557 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
558 unsigned char *psk; /*!< pre-shared key */
559 size_t psk_len; /*!< length of the pre-shared key */
560 unsigned char *psk_identity; /*!< identity for PSK negotiation */
561 size_t psk_identity_len;/*!< length of identity */
562 #endif
563
564 #if defined(MBEDTLS_SSL_ALPN)
565 const char **alpn_list; /*!< ordered list of protocols */
566 #endif
567
568 /*
569 * Numerical settings (int then char)
570 */
571
572 uint32_t read_timeout; /*!< timeout for mbedtls_ssl_read (ms) */
573
574 #if defined(MBEDTLS_SSL_PROTO_DTLS)
575 uint32_t hs_timeout_min; /*!< initial value of the handshake
576 retransmission timeout (ms) */
577 uint32_t hs_timeout_max; /*!< maximum value of the handshake
578 retransmission timeout (ms) */
579 #endif
580
581 #if defined(MBEDTLS_SSL_RENEGOTIATION)
582 int renego_max_records; /*!< grace period for renegotiation */
583 unsigned char renego_period[8]; /*!< value of the record counters
584 that triggers renegotiation */
585 #endif
586
587 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
588 unsigned int badmac_limit; /*!< limit of records with a bad MAC */
589 #endif
590
591 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
592 unsigned int dhm_min_bitlen; /*!< min. bit length of the DHM prime */
593 #endif
594
595 unsigned char max_major_ver; /*!< max. major version used */
596 unsigned char max_minor_ver; /*!< max. minor version used */
597 unsigned char min_major_ver; /*!< min. major version used */
598 unsigned char min_minor_ver; /*!< min. minor version used */
599
600 /*
601 * Flags (bitfields)
602 */
603
604 unsigned int endpoint : 1; /*!< 0: client, 1: server */
605 unsigned int transport : 1; /*!< stream (TLS) or datagram (DTLS) */
606 unsigned int authmode : 2; /*!< MBEDTLS_SSL_VERIFY_XXX */
607 /* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */
608 unsigned int allow_legacy_renegotiation : 2 ; /*!< MBEDTLS_LEGACY_XXX */
609 #if defined(MBEDTLS_ARC4_C)
610 unsigned int arc4_disabled : 1; /*!< blacklist RC4 ciphersuites? */
611 #endif
612 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
613 unsigned int mfl_code : 3; /*!< desired fragment length */
614 #endif
615 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
616 unsigned int encrypt_then_mac : 1 ; /*!< negotiate encrypt-then-mac? */
617 #endif
618 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
619 unsigned int extended_ms : 1; /*!< negotiate extended master secret? */
620 #endif
621 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
622 unsigned int anti_replay : 1; /*!< detect and prevent replay? */
623 #endif
624 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
625 unsigned int cbc_record_splitting : 1; /*!< do cbc record splitting */
626 #endif
627 #if defined(MBEDTLS_SSL_RENEGOTIATION)
628 unsigned int disable_renegotiation : 1; /*!< disable renegotiation? */
629 #endif
630 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
631 unsigned int trunc_hmac : 1; /*!< negotiate truncated hmac? */
632 #endif
633 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
634 unsigned int session_tickets : 1; /*!< use session tickets? */
635 #endif
636 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
637 unsigned int fallback : 1; /*!< is this a fallback? */
638 #endif
639 };
640
641
642 struct mbedtls_ssl_context
643 {
644 const mbedtls_ssl_config *conf; /*!< configuration information */
645
646 /*
647 * Miscellaneous
648 */
649 int state; /*!< SSL handshake: current state */
650 #if defined(MBEDTLS_SSL_RENEGOTIATION)
651 int renego_status; /*!< Initial, in progress, pending? */
652 int renego_records_seen; /*!< Records since renego request, or with DTLS,
653 number of retransmissions of request if
654 renego_max_records is < 0 */
655 #endif
656
657 int major_ver; /*!< equal to MBEDTLS_SSL_MAJOR_VERSION_3 */
658 int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */
659
660 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
661 unsigned badmac_seen; /*!< records with a bad MAC received */
662 #endif
663
664 /*
665 * Callbacks
666 */
667 int (*f_send)(void *, const unsigned char *, size_t);
668 int (*f_recv)(void *, unsigned char *, size_t);
669 int (*f_recv_timeout)(void *, unsigned char *, size_t, uint32_t);
670 void *p_bio; /*!< context for I/O operations */
671
672 /*
673 * Session layer
674 */
675 mbedtls_ssl_session *session_in; /*!< current session data (in) */
676 mbedtls_ssl_session *session_out; /*!< current session data (out) */
677 mbedtls_ssl_session *session; /*!< negotiated session data */
678 mbedtls_ssl_session *session_negotiate; /*!< session data in negotiation */
679
680 mbedtls_ssl_handshake_params *handshake; /*!< params required only during
681 the handshake process */
682
683 /*
684 * Record layer transformations
685 */
686 mbedtls_ssl_transform *transform_in; /*!< current transform params (in) */
687 mbedtls_ssl_transform *transform_out; /*!< current transform params (in) */
688 mbedtls_ssl_transform *transform; /*!< negotiated transform params */
689 mbedtls_ssl_transform *transform_negotiate; /*!< transform params in negotiation */
690
691 /*
692 * Timers
693 */
694 void *p_timer; /*!< context for the timer callbacks */
695 void (*f_set_timer)(void *, uint32_t, uint32_t); /*!< set timer callback */
696 int (*f_get_timer)(void *); /*!< get timer callback */
697
698 /*
699 * Record layer (incoming data)
700 */
701 unsigned char *in_buf; /*!< input buffer */
702 unsigned char *in_ctr; /*!< 64-bit incoming message counter
703 TLS: maintained by us
704 DTLS: read from peer */
705 unsigned char *in_hdr; /*!< start of record header */
706 unsigned char *in_len; /*!< two-bytes message length field */
707 unsigned char *in_iv; /*!< ivlen-byte IV */
708 unsigned char *in_msg; /*!< message contents (in_iv+ivlen) */
709 unsigned char *in_offt; /*!< read offset in application data */
710
711 int in_msgtype; /*!< record header: message type */
712 size_t in_msglen; /*!< record header: message length */
713 size_t in_left; /*!< amount of data read so far */
714 #if defined(MBEDTLS_SSL_PROTO_DTLS)
715 uint16_t in_epoch; /*!< DTLS epoch for incoming records */
716 size_t next_record_offset; /*!< offset of the next record in datagram
717 (equal to in_left if none) */
718 #endif
719 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
720 uint64_t in_window_top; /*!< last validated record seq_num */
721 uint64_t in_window; /*!< bitmask for replay detection */
722 #endif
723
724 size_t in_hslen; /*!< current handshake message length,
725 including the handshake header */
726 int nb_zero; /*!< # of 0-length encrypted messages */
727 int record_read; /*!< record is already present */
728
729 /*
730 * Record layer (outgoing data)
731 */
732 unsigned char *out_buf; /*!< output buffer */
733 unsigned char *out_ctr; /*!< 64-bit outgoing message counter */
734 unsigned char *out_hdr; /*!< start of record header */
735 unsigned char *out_len; /*!< two-bytes message length field */
736 unsigned char *out_iv; /*!< ivlen-byte IV */
737 unsigned char *out_msg; /*!< message contents (out_iv+ivlen) */
738
739 int out_msgtype; /*!< record header: message type */
740 size_t out_msglen; /*!< record header: message length */
741 size_t out_left; /*!< amount of data not yet written */
742
743 #if defined(MBEDTLS_ZLIB_SUPPORT)
744 unsigned char *compress_buf; /*!< zlib data buffer */
745 #endif
746 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
747 signed char split_done; /*!< current record already splitted? */
748 #endif
749
750 /*
751 * PKI layer
752 */
753 int client_auth; /*!< flag for client auth. */
754
755 /*
756 * User settings
757 */
758 #if defined(MBEDTLS_X509_CRT_PARSE_C)
759 char *hostname; /*!< expected peer CN for verification
760 (and SNI if available) */
761 #endif
762
763 #if defined(MBEDTLS_SSL_ALPN)
764 const char *alpn_chosen; /*!< negotiated protocol */
765 #endif
766
767 /*
768 * Information for DTLS hello verify
769 */
770 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
771 unsigned char *cli_id; /*!< transport-level ID of the client */
772 size_t cli_id_len; /*!< length of cli_id */
773 #endif
774
775 /*
776 * Secure renegotiation
777 */
778 /* needed to know when to send extension on server */
779 int secure_renegotiation; /*!< does peer support legacy or
780 secure renegotiation */
781 #if defined(MBEDTLS_SSL_RENEGOTIATION)
782 size_t verify_data_len; /*!< length of verify data stored */
783 char own_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */
784 char peer_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */
785 #endif
786 };
787
788 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
789
790 #define MBEDTLS_SSL_CHANNEL_OUTBOUND 0
791 #define MBEDTLS_SSL_CHANNEL_INBOUND 1
792
793 extern int (*mbedtls_ssl_hw_record_init)(mbedtls_ssl_context *ssl,
794 const unsigned char *key_enc, const unsigned char *key_dec,
795 size_t keylen,
796 const unsigned char *iv_enc, const unsigned char *iv_dec,
797 size_t ivlen,
798 const unsigned char *mac_enc, const unsigned char *mac_dec,
799 size_t maclen);
800 extern int (*mbedtls_ssl_hw_record_activate)(mbedtls_ssl_context *ssl, int direction);
801 extern int (*mbedtls_ssl_hw_record_reset)(mbedtls_ssl_context *ssl);
802 extern int (*mbedtls_ssl_hw_record_write)(mbedtls_ssl_context *ssl);
803 extern int (*mbedtls_ssl_hw_record_read)(mbedtls_ssl_context *ssl);
804 extern int (*mbedtls_ssl_hw_record_finish)(mbedtls_ssl_context *ssl);
805 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
806
807 /**
808 * \brief Returns the list of ciphersuites supported by the SSL/TLS module.
809 *
810 * \return a statically allocated array of ciphersuites, the last
811 * entry is 0.
812 */
813 const int *mbedtls_ssl_list_ciphersuites( void );
814
815 /**
816 * \brief Return the name of the ciphersuite associated with the
817 * given ID
818 *
819 * \param ciphersuite_id SSL ciphersuite ID
820 *
821 * \return a string containing the ciphersuite name
822 */
823 const char *mbedtls_ssl_get_ciphersuite_name( const int ciphersuite_id );
824
825 /**
826 * \brief Return the ID of the ciphersuite associated with the
827 * given name
828 *
829 * \param ciphersuite_name SSL ciphersuite name
830 *
831 * \return the ID with the ciphersuite or 0 if not found
832 */
833 int mbedtls_ssl_get_ciphersuite_id( const char *ciphersuite_name );
834
835 /**
836 * \brief Initialize an SSL context
837 * Just makes the context ready for mbedtls_ssl_setup() or
838 * mbedtls_ssl_free()
839 *
840 * \param ssl SSL context
841 */
842 void mbedtls_ssl_init( mbedtls_ssl_context *ssl );
843
844 /**
845 * \brief Set up an SSL context for use
846 *
847 * \note No copy of the configuration context is made, it can be
848 * shared by many mbedtls_ssl_context structures.
849 *
850 * \warning Modifying the conf structure after is has been used in this
851 * function is unsupported!
852 *
853 * \param ssl SSL context
854 * \param conf SSL configuration to use
855 *
856 * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED if
857 * memory allocation failed
858 */
859 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
860 const mbedtls_ssl_config *conf );
861
862 /**
863 * \brief Reset an already initialized SSL context for re-use
864 * while retaining application-set variables, function
865 * pointers and data.
866 *
867 * \param ssl SSL context
868 * \return 0 if successful, or POLASSL_ERR_SSL_MALLOC_FAILED,
869 MBEDTLS_ERR_SSL_HW_ACCEL_FAILED or
870 * MBEDTLS_ERR_SSL_COMPRESSION_FAILED
871 */
872 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl );
873
874 /**
875 * \brief Set the current endpoint type
876 *
877 * \param conf SSL configuration
878 * \param endpoint must be MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER
879 */
880 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint );
881
882 /**
883 * \brief Set the transport type (TLS or DTLS).
884 * Default: TLS
885 *
886 * \note For DTLS, you must either provide a recv callback that
887 * doesn't block, or one that handles timeouts, see
888 * \c mbedtls_ssl_set_bio(). You also need to provide timer
889 * callbacks with \c mbedtls_ssl_set_timer_cb().
890 *
891 * \param conf SSL configuration
892 * \param transport transport type:
893 * MBEDTLS_SSL_TRANSPORT_STREAM for TLS,
894 * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS.
895 */
896 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport );
897
898 /**
899 * \brief Set the certificate verification mode
900 * Default: NONE on server, REQUIRED on client
901 *
902 * \param conf SSL configuration
903 * \param authmode can be:
904 *
905 * MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked
906 * (default on server)
907 * (insecure on client)
908 *
909 * MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the
910 * handshake continues even if verification failed;
911 * mbedtls_ssl_get_verify_result() can be called after the
912 * handshake is complete.
913 *
914 * MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate,
915 * handshake is aborted if verification failed.
916 *
917 * \note On client, MBEDTLS_SSL_VERIFY_REQUIRED is the recommended mode.
918 * With MBEDTLS_SSL_VERIFY_OPTIONAL, the user needs to call mbedtls_ssl_get_verify_result() at
919 * the right time(s), which may not be obvious, while REQUIRED always perform
920 * the verification as soon as possible. For example, REQUIRED was protecting
921 * against the "triple handshake" attack even before it was found.
922 */
923 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode );
924
925 #if defined(MBEDTLS_X509_CRT_PARSE_C)
926 /**
927 * \brief Set the verification callback (Optional).
928 *
929 * If set, the verify callback is called for each
930 * certificate in the chain. For implementation
931 * information, please see \c x509parse_verify()
932 *
933 * \param conf SSL configuration
934 * \param f_vrfy verification function
935 * \param p_vrfy verification parameter
936 */
937 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
938 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
939 void *p_vrfy );
940 #endif /* MBEDTLS_X509_CRT_PARSE_C */
941
942 /**
943 * \brief Set the random number generator callback
944 *
945 * \param conf SSL configuration
946 * \param f_rng RNG function
947 * \param p_rng RNG parameter
948 */
949 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
950 int (*f_rng)(void *, unsigned char *, size_t),
951 void *p_rng );
952
953 /**
954 * \brief Set the debug callback
955 *
956 * The callback has the following argument:
957 * void * opaque context for the callback
958 * int debug level
959 * const char * file name
960 * int line number
961 * const char * message
962 *
963 * \param conf SSL configuration
964 * \param f_dbg debug function
965 * \param p_dbg debug parameter
966 */
967 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
968 void (*f_dbg)(void *, int, const char *, int, const char *),
969 void *p_dbg );
970
971 /**
972 * \brief Set the underlying BIO callbacks for write, read and
973 * read-with-timeout.
974 *
975 * \param ssl SSL context
976 * \param p_bio parameter (context) shared by BIO callbacks
977 * \param f_send write callback
978 * \param f_recv read callback
979 * \param f_recv_timeout blocking read callback with timeout.
980 * The last argument is the timeout in milliseconds,
981 * 0 means no timeout (block forever until a message comes)
982 *
983 * \note One of f_recv or f_recv_timeout can be NULL, in which case
984 * the other is used. If both are non-NULL, f_recv_timeout is
985 * used and f_recv is ignored (as if it were NULL).
986 *
987 * \note The two most common use cases are:
988 * - non-blocking I/O, f_recv != NULL, f_recv_timeout == NULL
989 * - blocking I/O, f_recv == NULL, f_recv_timout != NULL
990 *
991 * \note For DTLS, you need to provide either a non-NULL
992 * f_recv_timeout callback, or a f_recv that doesn't block.
993 */
994 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
995 void *p_bio,
996 int (*f_send)(void *, const unsigned char *, size_t),
997 int (*f_recv)(void *, unsigned char *, size_t),
998 int (*f_recv_timeout)(void *, unsigned char *, size_t, uint32_t) );
999
1000 /**
1001 * \brief Set the timeout period for mbedtls_ssl_read()
1002 * (Default: no timeout.)
1003 *
1004 * \param conf SSL configuration context
1005 * \param timeout Timeout value in milliseconds.
1006 * Use 0 for no timeout (default).
1007 *
1008 * \note With blocking I/O, this will only work if a non-NULL
1009 * \c f_recv_timeout was set with \c mbedtls_ssl_set_bio().
1010 * With non-blocking I/O, this will only work if timer
1011 * callbacks were set with \c mbedtls_ssl_set_timer_cb().
1012 *
1013 * \note With non-blocking I/O, you may also skip this function
1014 * altogether and handle timeouts at the application layer.
1015 */
1016 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout );
1017
1018 /**
1019 * \brief Set the timer callbacks
1020 * (Mandatory for DTLS.)
1021 *
1022 * \param ssl SSL context
1023 * \param p_timer parameter (context) shared by timer callback
1024 * \param f_set_timer set timer callback
1025 * Accepts an intermediate and a final delay in milliseconcs
1026 * If the final delay is 0, cancels the running timer.
1027 * \param f_get_timer get timer callback. Must return:
1028 * -1 if cancelled
1029 * 0 if none of the delays is expired
1030 * 1 if the intermediate delay only is expired
1031 * 2 if the final delay is expired
1032 */
1033 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1034 void *p_timer,
1035 void (*f_set_timer)(void *, uint32_t int_ms, uint32_t fin_ms),
1036 int (*f_get_timer)(void *) );
1037
1038 /**
1039 * \brief Callback type: generate and write session ticket
1040 *
1041 * \note This describes what a callback implementation should do.
1042 * This callback should generate and encrypted and
1043 * authenticated ticket for the session and write it to the
1044 * output buffer. Here, ticket means the opaque ticket part
1045 * of the NewSessionTicket structure of RFC 5077.
1046 *
1047 * \param p_ticket Context for the callback
1048 * \param session SSL session to bo written in the ticket
1049 * \param start Start of the outpur buffer
1050 * \param end End of the output buffer
1051 * \param tlen On exit, holds the length written
1052 * \param lifetime On exit, holds the lifetime of the ticket in seconds
1053 *
1054 * \return 0 if successful, or
1055 * a specific MBEDTLS_ERR_XXX code.
1056 */
1057 typedef int mbedtls_ssl_ticket_write_t( void *p_ticket,
1058 const mbedtls_ssl_session *session,
1059 unsigned char *start,
1060 const unsigned char *end,
1061 size_t *tlen,
1062 uint32_t *lifetime );
1063
1064 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
1065 /**
1066 * \brief Callback type: Export key block and master secret
1067 *
1068 * \note This is required for certain uses of TLS, e.g. EAP-TLS
1069 * (RFC 5216) and Thread. The key pointers are ephemeral and
1070 * therefore must not be stored. The master secret and keys
1071 * should not be used directly except as an input to a key
1072 * derivation function.
1073 *
1074 * \param p_expkey Context for the callback
1075 * \param ms Pointer to master secret (fixed length: 48 bytes)
1076 * \param kb Pointer to key block, see RFC 5246 section 6.3
1077 * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen).
1078 * \param maclen MAC length
1079 * \param keylen Key length
1080 * \param ivlen IV length
1081 *
1082 * \return 0 if successful, or
1083 * a specific MBEDTLS_ERR_XXX code.
1084 */
1085 typedef int mbedtls_ssl_export_keys_t( void *p_expkey,
1086 const unsigned char *ms,
1087 const unsigned char *kb,
1088 size_t maclen,
1089 size_t keylen,
1090 size_t ivlen );
1091 #endif /* MBEDTLS_SSL_EXPORT_KEYS */
1092
1093 /**
1094 * \brief Callback type: parse and load session ticket
1095 *
1096 * \note This describes what a callback implementation should do.
1097 * This callback should parse a session ticket as generated
1098 * by the corresponding mbedtls_ssl_ticket_write_t function,
1099 * and, if the ticket is authentic and valid, load the
1100 * session.
1101 *
1102 * \note The implementation is allowed to modify the first len
1103 * bytes of the input buffer, eg to use it as a temporary
1104 * area for the decrypted ticket contents.
1105 *
1106 * \param p_ticket Context for the callback
1107 * \param session SSL session to be loaded
1108 * \param buf Start of the buffer containing the ticket
1109 * \param len Length of the ticket.
1110 *
1111 * \return 0 if successful, or
1112 * MBEDTLS_ERR_SSL_INVALID_MAC if not authentic, or
1113 * MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED if expired, or
1114 * any other non-zero code for other failures.
1115 */
1116 typedef int mbedtls_ssl_ticket_parse_t( void *p_ticket,
1117 mbedtls_ssl_session *session,
1118 unsigned char *buf,
1119 size_t len );
1120
1121 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C)
1122 /**
1123 * \brief Configure SSL session ticket callbacks (server only).
1124 * (Default: none.)
1125 *
1126 * \note On server, session tickets are enabled by providing
1127 * non-NULL callbacks.
1128 *
1129 * \note On client, use \c mbedtls_ssl_conf_session_tickets().
1130 *
1131 * \param conf SSL configuration context
1132 * \param f_ticket_write Callback for writing a ticket
1133 * \param f_ticket_parse Callback for parsing a ticket
1134 * \param p_ticket Context shared by the two callbacks
1135 */
1136 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
1137 mbedtls_ssl_ticket_write_t *f_ticket_write,
1138 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
1139 void *p_ticket );
1140 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */
1141
1142 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
1143 /**
1144 * \brief Configure key export callback.
1145 * (Default: none.)
1146 *
1147 * \note See \c mbedtls_ssl_export_keys_t.
1148 *
1149 * \param conf SSL configuration context
1150 * \param f_export_keys Callback for exporting keys
1151 * \param p_export_keys Context for the callback
1152 */
1153 void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
1154 mbedtls_ssl_export_keys_t *f_export_keys,
1155 void *p_export_keys );
1156 #endif /* MBEDTLS_SSL_EXPORT_KEYS */
1157
1158 /**
1159 * \brief Callback type: generate a cookie
1160 *
1161 * \param ctx Context for the callback
1162 * \param p Buffer to write to,
1163 * must be updated to point right after the cookie
1164 * \param end Pointer to one past the end of the output buffer
1165 * \param info Client ID info that was passed to
1166 * \c mbedtls_ssl_set_client_transport_id()
1167 * \param ilen Length of info in bytes
1168 *
1169 * \return The callback must return 0 on success,
1170 * or a negative error code.
1171 */
1172 typedef int mbedtls_ssl_cookie_write_t( void *ctx,
1173 unsigned char **p, unsigned char *end,
1174 const unsigned char *info, size_t ilen );
1175
1176 /**
1177 * \brief Callback type: verify a cookie
1178 *
1179 * \param ctx Context for the callback
1180 * \param cookie Cookie to verify
1181 * \param clen Length of cookie
1182 * \param info Client ID info that was passed to
1183 * \c mbedtls_ssl_set_client_transport_id()
1184 * \param ilen Length of info in bytes
1185 *
1186 * \return The callback must return 0 if cookie is valid,
1187 * or a negative error code.
1188 */
1189 typedef int mbedtls_ssl_cookie_check_t( void *ctx,
1190 const unsigned char *cookie, size_t clen,
1191 const unsigned char *info, size_t ilen );
1192
1193 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
1194 /**
1195 * \brief Register callbacks for DTLS cookies
1196 * (Server only. DTLS only.)
1197 *
1198 * Default: dummy callbacks that fail, in order to force you to
1199 * register working callbacks (and initialize their context).
1200 *
1201 * To disable HelloVerifyRequest, register NULL callbacks.
1202 *
1203 * \warning Disabling hello verification allows your server to be used
1204 * for amplification in DoS attacks against other hosts.
1205 * Only disable if you known this can't happen in your
1206 * particular environment.
1207 *
1208 * \note See comments on \c mbedtls_ssl_handshake() about handling
1209 * the MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED that is expected
1210 * on the first handshake attempt when this is enabled.
1211 *
1212 * \note This is also necessary to handle client reconnection from
1213 * the same port as described in RFC 6347 section 4.2.8 (only
1214 * the variant with cookies is supported currently). See
1215 * comments on \c mbedtls_ssl_read() for details.
1216 *
1217 * \param conf SSL configuration
1218 * \param f_cookie_write Cookie write callback
1219 * \param f_cookie_check Cookie check callback
1220 * \param p_cookie Context for both callbacks
1221 */
1222 void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
1223 mbedtls_ssl_cookie_write_t *f_cookie_write,
1224 mbedtls_ssl_cookie_check_t *f_cookie_check,
1225 void *p_cookie );
1226
1227 /**
1228 * \brief Set client's transport-level identification info.
1229 * (Server only. DTLS only.)
1230 *
1231 * This is usually the IP address (and port), but could be
1232 * anything identify the client depending on the underlying
1233 * network stack. Used for HelloVerifyRequest with DTLS.
1234 * This is *not* used to route the actual packets.
1235 *
1236 * \param ssl SSL context
1237 * \param info Transport-level info identifying the client (eg IP + port)
1238 * \param ilen Length of info in bytes
1239 *
1240 * \note An internal copy is made, so the info buffer can be reused.
1241 *
1242 * \return 0 on success,
1243 * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used on client,
1244 * MBEDTLS_ERR_SSL_ALLOC_FAILED if out of memory.
1245 */
1246 int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
1247 const unsigned char *info,
1248 size_t ilen );
1249
1250 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
1251
1252 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1253 /**
1254 * \brief Enable or disable anti-replay protection for DTLS.
1255 * (DTLS only, no effect on TLS.)
1256 * Default: enabled.
1257 *
1258 * \param conf SSL configuration
1259 * \param mode MBEDTLS_SSL_ANTI_REPLAY_ENABLED or MBEDTLS_SSL_ANTI_REPLAY_DISABLED.
1260 *
1261 * \warning Disabling this is a security risk unless the application
1262 * protocol handles duplicated packets in a safe way. You
1263 * should not disable this without careful consideration.
1264 * However, if your application already detects duplicated
1265 * packets and needs information about them to adjust its
1266 * transmission strategy, then you'll want to disable this.
1267 */
1268 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode );
1269 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
1270
1271 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
1272 /**
1273 * \brief Set a limit on the number of records with a bad MAC
1274 * before terminating the connection.
1275 * (DTLS only, no effect on TLS.)
1276 * Default: 0 (disabled).
1277 *
1278 * \param conf SSL configuration
1279 * \param limit Limit, or 0 to disable.
1280 *
1281 * \note If the limit is N, then the connection is terminated when
1282 * the Nth non-authentic record is seen.
1283 *
1284 * \note Records with an invalid header are not counted, only the
1285 * ones going through the authentication-decryption phase.
1286 *
1287 * \note This is a security trade-off related to the fact that it's
1288 * often relatively easy for an active attacker ot inject UDP
1289 * datagrams. On one hand, setting a low limit here makes it
1290 * easier for such an attacker to forcibly terminated a
1291 * connection. On the other hand, a high limit or no limit
1292 * might make us waste resources checking authentication on
1293 * many bogus packets.
1294 */
1295 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit );
1296 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
1297
1298 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1299 /**
1300 * \brief Set retransmit timeout values for the DTLS handshale.
1301 * (DTLS only, no effect on TLS.)
1302 *
1303 * \param conf SSL configuration
1304 * \param min Initial timeout value in milliseconds.
1305 * Default: 1000 (1 second).
1306 * \param max Maximum timeout value in milliseconds.
1307 * Default: 60000 (60 seconds).
1308 *
1309 * \note Default values are from RFC 6347 section 4.2.4.1.
1310 *
1311 * \note Higher values for initial timeout may increase average
1312 * handshake latency. Lower values may increase the risk of
1313 * network congestion by causing more retransmissions.
1314 */
1315 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max );
1316 #endif /* MBEDTLS_SSL_PROTO_DTLS */
1317
1318 #if defined(MBEDTLS_SSL_SRV_C)
1319 /**
1320 * \brief Set the session cache callbacks (server-side only)
1321 * If not set, no session resuming is done (except if session
1322 * tickets are enabled too).
1323 *
1324 * The session cache has the responsibility to check for stale
1325 * entries based on timeout. See RFC 5246 for recommendations.
1326 *
1327 * Warning: session.peer_cert is cleared by the SSL/TLS layer on
1328 * connection shutdown, so do not cache the pointer! Either set
1329 * it to NULL or make a full copy of the certificate.
1330 *
1331 * The get callback is called once during the initial handshake
1332 * to enable session resuming. The get function has the
1333 * following parameters: (void *parameter, mbedtls_ssl_session *session)
1334 * If a valid entry is found, it should fill the master of
1335 * the session object with the cached values and return 0,
1336 * return 1 otherwise. Optionally peer_cert can be set as well
1337 * if it is properly present in cache entry.
1338 *
1339 * The set callback is called once during the initial handshake
1340 * to enable session resuming after the entire handshake has
1341 * been finished. The set function has the following parameters:
1342 * (void *parameter, const mbedtls_ssl_session *session). The function
1343 * should create a cache entry for future retrieval based on
1344 * the data in the session structure and should keep in mind
1345 * that the mbedtls_ssl_session object presented (and all its referenced
1346 * data) is cleared by the SSL/TLS layer when the connection is
1347 * terminated. It is recommended to add metadata to determine if
1348 * an entry is still valid in the future. Return 0 if
1349 * successfully cached, return 1 otherwise.
1350 *
1351 * \param conf SSL configuration
1352 * \param p_cache parmater (context) for both callbacks
1353 * \param f_get_cache session get callback
1354 * \param f_set_cache session set callback
1355 */
1356 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
1357 void *p_cache,
1358 int (*f_get_cache)(void *, mbedtls_ssl_session *),
1359 int (*f_set_cache)(void *, const mbedtls_ssl_session *) );
1360 #endif /* MBEDTLS_SSL_SRV_C */
1361
1362 #if defined(MBEDTLS_SSL_CLI_C)
1363 /**
1364 * \brief Request resumption of session (client-side only)
1365 * Session data is copied from presented session structure.
1366 *
1367 * \param ssl SSL context
1368 * \param session session context
1369 *
1370 * \return 0 if successful,
1371 * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed,
1372 * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or
1373 * arguments are otherwise invalid
1374 *
1375 * \sa mbedtls_ssl_get_session()
1376 */
1377 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session );
1378 #endif /* MBEDTLS_SSL_CLI_C */
1379
1380 /**
1381 * \brief Set the list of allowed ciphersuites and the preference
1382 * order. First in the list has the highest preference.
1383 * (Overrides all version specific lists)
1384 *
1385 * The ciphersuites array is not copied, and must remain
1386 * valid for the lifetime of the ssl_config.
1387 *
1388 * Note: The server uses its own preferences
1389 * over the preference of the client unless
1390 * MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined!
1391 *
1392 * \param conf SSL configuration
1393 * \param ciphersuites 0-terminated list of allowed ciphersuites
1394 */
1395 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1396 const int *ciphersuites );
1397
1398 /**
1399 * \brief Set the list of allowed ciphersuites and the
1400 * preference order for a specific version of the protocol.
1401 * (Only useful on the server side)
1402 *
1403 * The ciphersuites array is not copied, and must remain
1404 * valid for the lifetime of the ssl_config.
1405 *
1406 * \param conf SSL configuration
1407 * \param ciphersuites 0-terminated list of allowed ciphersuites
1408 * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3
1409 * supported)
1410 * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,
1411 * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
1412 * MBEDTLS_SSL_MINOR_VERSION_3 supported)
1413 *
1414 * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0
1415 * and MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2
1416 */
1417 void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
1418 const int *ciphersuites,
1419 int major, int minor );
1420
1421 #if defined(MBEDTLS_X509_CRT_PARSE_C)
1422 /**
1423 * \brief Set the X.509 security profile used for verification
1424 *
1425 * \note The restrictions are enforced for all certificates in the
1426 * chain. However, signatures in the handshake are not covered
1427 * by this setting but by \b mbedtls_ssl_conf_sig_hashes().
1428 *
1429 * \param conf SSL configuration
1430 * \param profile Profile to use
1431 */
1432 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
1433 const mbedtls_x509_crt_profile *profile );
1434
1435 /**
1436 * \brief Set the data required to verify peer certificate
1437 *
1438 * \param conf SSL configuration
1439 * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs)
1440 * \param ca_crl trusted CA CRLs
1441 */
1442 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
1443 mbedtls_x509_crt *ca_chain,
1444 mbedtls_x509_crl *ca_crl );
1445
1446 /**
1447 * \brief Set own certificate chain and private key
1448 *
1449 * \note own_cert should contain in order from the bottom up your
1450 * certificate chain. The top certificate (self-signed)
1451 * can be omitted.
1452 *
1453 * \note On server, this function can be called multiple times to
1454 * provision more than one cert/key pair (eg one ECDSA, one
1455 * RSA with SHA-256, one RSA with SHA-1). An adequate
1456 * certificate will be selected according to the client's
1457 * advertised capabilities. In case mutliple certificates are
1458 * adequate, preference is given to the one set by the first
1459 * call to this function, then second, etc.
1460 *
1461 * \note On client, only the first call has any effect.
1462 *
1463 * \param conf SSL configuration
1464 * \param own_cert own public certificate chain
1465 * \param pk_key own private key
1466 *
1467 * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED
1468 */
1469 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
1470 mbedtls_x509_crt *own_cert,
1471 mbedtls_pk_context *pk_key );
1472 #endif /* MBEDTLS_X509_CRT_PARSE_C */
1473
1474 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1475 /**
1476 * \brief Set the Pre Shared Key (PSK) and the expected identity name
1477 *
1478 * \note This is mainly useful for clients. Servers will usually
1479 * want to use \c mbedtls_ssl_conf_psk_cb() instead.
1480 *
1481 * \param conf SSL configuration
1482 * \param psk pointer to the pre-shared key
1483 * \param psk_len pre-shared key length
1484 * \param psk_identity pointer to the pre-shared key identity
1485 * \param psk_identity_len identity key length
1486 *
1487 * \return 0 if successful or MBEDTLS_ERR_SSL_ALLOC_FAILED
1488 */
1489 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
1490 const unsigned char *psk, size_t psk_len,
1491 const unsigned char *psk_identity, size_t psk_identity_len );
1492
1493
1494 /**
1495 * \brief Set the Pre Shared Key (PSK) for the current handshake
1496 *
1497 * \note This should only be called inside the PSK callback,
1498 * ie the function passed to \c mbedtls_ssl_conf_psk_cb().
1499 *
1500 * \param ssl SSL context
1501 * \param psk pointer to the pre-shared key
1502 * \param psk_len pre-shared key length
1503 *
1504 * \return 0 if successful or MBEDTLS_ERR_SSL_ALLOC_FAILED
1505 */
1506 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
1507 const unsigned char *psk, size_t psk_len );
1508
1509 /**
1510 * \brief Set the PSK callback (server-side only).
1511 *
1512 * If set, the PSK callback is called for each
1513 * handshake where a PSK ciphersuite was negotiated.
1514 * The caller provides the identity received and wants to
1515 * receive the actual PSK data and length.
1516 *
1517 * The callback has the following parameters: (void *parameter,
1518 * mbedtls_ssl_context *ssl, const unsigned char *psk_identity,
1519 * size_t identity_len)
1520 * If a valid PSK identity is found, the callback should use
1521 * \c mbedtls_ssl_set_hs_psk() on the ssl context to set the
1522 * correct PSK and return 0.
1523 * Any other return value will result in a denied PSK identity.
1524 *
1525 * \note If you set a PSK callback using this function, then you
1526 * don't need to set a PSK key and identity using
1527 * \c mbedtls_ssl_conf_psk().
1528 *
1529 * \param conf SSL configuration
1530 * \param f_psk PSK identity function
1531 * \param p_psk PSK identity parameter
1532 */
1533 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
1534 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
1535 size_t),
1536 void *p_psk );
1537 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
1538
1539 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
1540 /**
1541 * \brief Set the Diffie-Hellman public P and G values,
1542 * read as hexadecimal strings (server-side only)
1543 * (Default: MBEDTLS_DHM_RFC5114_MODP_2048_[PG])
1544 *
1545 * \param conf SSL configuration
1546 * \param dhm_P Diffie-Hellman-Merkle modulus
1547 * \param dhm_G Diffie-Hellman-Merkle generator
1548 *
1549 * \return 0 if successful
1550 */
1551 int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G );
1552
1553 /**
1554 * \brief Set the Diffie-Hellman public P and G values,
1555 * read from existing context (server-side only)
1556 *
1557 * \param conf SSL configuration
1558 * \param dhm_ctx Diffie-Hellman-Merkle context
1559 *
1560 * \return 0 if successful
1561 */
1562 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx );
1563 #endif /* MBEDTLS_DHM_C && defined(MBEDTLS_SSL_SRV_C) */
1564
1565 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
1566 /**
1567 * \brief Set the minimum length for Diffie-Hellman parameters.
1568 * (Client-side only.)
1569 * (Default: 1024 bits.)
1570 *
1571 * \param conf SSL configuration
1572 * \param bitlen Minimum bit length of the DHM prime
1573 */
1574 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
1575 unsigned int bitlen );
1576 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
1577
1578 #if defined(MBEDTLS_ECP_C)
1579 /**
1580 * \brief Set the allowed curves in order of preference.
1581 * (Default: all defined curves.)
1582 *
1583 * On server: this only affects selection of the ECDHE curve;
1584 * the curves used for ECDH and ECDSA are determined by the
1585 * list of available certificates instead.
1586 *
1587 * On client: this affects the list of curves offered for any
1588 * use. The server can override our preference order.
1589 *
1590 * Both sides: limits the set of curves accepted for use in
1591 * ECDHE and in the peer's end-entity certificate.
1592 *
1593 * \note This has no influence on which curves are allowed inside the
1594 * certificate chains, see \c mbedtls_ssl_conf_cert_profile()
1595 * for that. For the end-entity certificate however, the key
1596 * will be accepted only if it is allowed both by this list
1597 * and by the cert profile.
1598 *
1599 * \note This list should be ordered by decreasing preference
1600 * (preferred curve first).
1601 *
1602 * \param conf SSL configuration
1603 * \param curves Ordered list of allowed curves,
1604 * terminated by MBEDTLS_ECP_DP_NONE.
1605 */
1606 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
1607 const mbedtls_ecp_group_id *curves );
1608 #endif /* MBEDTLS_ECP_C */
1609
1610 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1611 /**
1612 * \brief Set the allowed hashes for signatures during the handshake.
1613 * (Default: all available hashes.)
1614 *
1615 * \note This only affects which hashes are offered and can be used
1616 * for signatures during the handshake. Hashes for message
1617 * authentication and the TLS PRF are controlled by the
1618 * ciphersuite, see \c mbedtls_ssl_conf_ciphersuites(). Hashes
1619 * used for certificate signature are controlled by the
1620 * verification profile, see \c mbedtls_ssl_conf_cert_profile().
1621 *
1622 * \note This list should be ordered by decreasing preference
1623 * (preferred hash first).
1624 *
1625 * \param conf SSL configuration
1626 * \param hashes Ordered list of allowed signature hashes,
1627 * terminated by \c MBEDTLS_MD_NONE.
1628 */
1629 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
1630 const int *hashes );
1631 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1632
1633 #if defined(MBEDTLS_X509_CRT_PARSE_C)
1634 /**
1635 * \brief Set hostname for ServerName TLS extension
1636 * (client-side only)
1637 *
1638 *
1639 * \param ssl SSL context
1640 * \param hostname the server hostname
1641 *
1642 * \return 0 if successful or MBEDTLS_ERR_SSL_ALLOC_FAILED
1643 */
1644 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname );
1645 #endif /* MBEDTLS_X509_CRT_PARSE_C */
1646
1647 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1648 /**
1649 * \brief Set own certificate and key for the current handshake
1650 *
1651 * \note Same as \c mbedtls_ssl_conf_own_cert() but for use within
1652 * the SNI callback.
1653 *
1654 * \param ssl SSL context
1655 * \param own_cert own public certificate chain
1656 * \param pk_key own private key
1657 *
1658 * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED
1659 */
1660 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1661 mbedtls_x509_crt *own_cert,
1662 mbedtls_pk_context *pk_key );
1663
1664 /**
1665 * \brief Set the data required to verify peer certificate for the
1666 * current handshake
1667 *
1668 * \note Same as \c mbedtls_ssl_conf_ca_chain() but for use within
1669 * the SNI callback.
1670 *
1671 * \param ssl SSL context
1672 * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs)
1673 * \param ca_crl trusted CA CRLs
1674 */
1675 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1676 mbedtls_x509_crt *ca_chain,
1677 mbedtls_x509_crl *ca_crl );
1678
1679 /**
1680 * \brief Set authmode for the current handshake.
1681 *
1682 * \note Same as \c mbedtls_ssl_conf_authmode() but for use within
1683 * the SNI callback.
1684 *
1685 * \param ssl SSL context
1686 * \param authmode MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or
1687 * MBEDTLS_SSL_VERIFY_REQUIRED
1688 */
1689 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1690 int authmode );
1691
1692 /**
1693 * \brief Set server side ServerName TLS extension callback
1694 * (optional, server-side only).
1695 *
1696 * If set, the ServerName callback is called whenever the
1697 * server receives a ServerName TLS extension from the client
1698 * during a handshake. The ServerName callback has the
1699 * following parameters: (void *parameter, mbedtls_ssl_context *ssl,
1700 * const unsigned char *hostname, size_t len). If a suitable
1701 * certificate is found, the callback must set the
1702 * certificate(s) and key(s) to use with \c
1703 * mbedtls_ssl_set_hs_own_cert() (can be called repeatedly),
1704 * and may optionally adjust the CA and associated CRL with \c
1705 * mbedtls_ssl_set_hs_ca_chain() as well as the client
1706 * authentication mode with \c mbedtls_ssl_set_hs_authmode(),
1707 * then must return 0. If no matching name is found, the
1708 * callback must either set a default cert, or
1709 * return non-zero to abort the handshake at this point.
1710 *
1711 * \param conf SSL configuration
1712 * \param f_sni verification function
1713 * \param p_sni verification parameter
1714 */
1715 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
1716 int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *,
1717 size_t),
1718 void *p_sni );
1719 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1720
1721 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1722 /**
1723 * \brief Set the EC J-PAKE password for current handshake.
1724 *
1725 * \note An internal copy is made, and destroyed as soon as the
1726 * handshake is completed, or when the SSL context is reset or
1727 * freed.
1728 *
1729 * \note The SSL context needs to be already set up. The right place
1730 * to call this function is between \c mbedtls_ssl_setup() or
1731 * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake().
1732 *
1733 * \param ssl SSL context
1734 * \param pw EC J-PAKE password (pre-shared secret)
1735 * \param pw_len length of pw in bytes
1736 *
1737 * \return 0 on success, or a negative error code.
1738 */
1739 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1740 const unsigned char *pw,
1741 size_t pw_len );
1742 #endif /*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1743
1744 #if defined(MBEDTLS_SSL_ALPN)
1745 /**
1746 * \brief Set the supported Application Layer Protocols.
1747 *
1748 * \param conf SSL configuration
1749 * \param protos NULL-terminated list of supported protocols,
1750 * in decreasing preference order.
1751 *
1752 * \return 0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA.
1753 */
1754 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos );
1755
1756 /**
1757 * \brief Get the name of the negotiated Application Layer Protocol.
1758 * This function should be called after the handshake is
1759 * completed.
1760 *
1761 * \param ssl SSL context
1762 *
1763 * \return Protcol name, or NULL if no protocol was negotiated.
1764 */
1765 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl );
1766 #endif /* MBEDTLS_SSL_ALPN */
1767
1768 /**
1769 * \brief Set the maximum supported version sent from the client side
1770 * and/or accepted at the server side
1771 * (Default: MBEDTLS_SSL_MAX_MAJOR_VERSION, MBEDTLS_SSL_MAX_MINOR_VERSION)
1772 *
1773 * \note This ignores ciphersuites from higher versions.
1774 *
1775 * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and
1776 * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2
1777 *
1778 * \param conf SSL configuration
1779 * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported)
1780 * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,
1781 * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
1782 * MBEDTLS_SSL_MINOR_VERSION_3 supported)
1783 */
1784 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor );
1785
1786 /**
1787 * \brief Set the minimum accepted SSL/TLS protocol version
1788 * (Default: TLS 1.0)
1789 *
1790 * \note Input outside of the SSL_MAX_XXXXX_VERSION and
1791 * SSL_MIN_XXXXX_VERSION range is ignored.
1792 *
1793 * \note MBEDTLS_SSL_MINOR_VERSION_0 (SSL v3) should be avoided.
1794 *
1795 * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and
1796 * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2
1797 *
1798 * \param conf SSL configuration
1799 * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported)
1800 * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,
1801 * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
1802 * MBEDTLS_SSL_MINOR_VERSION_3 supported)
1803 */
1804 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor );
1805
1806 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
1807 /**
1808 * \brief Set the fallback flag (client-side only).
1809 * (Default: MBEDTLS_SSL_IS_NOT_FALLBACK).
1810 *
1811 * \note Set to MBEDTLS_SSL_IS_FALLBACK when preparing a fallback
1812 * connection, that is a connection with max_version set to a
1813 * lower value than the value you're willing to use. Such
1814 * fallback connections are not recommended but are sometimes
1815 * necessary to interoperate with buggy (version-intolerant)
1816 * servers.
1817 *
1818 * \warning You should NOT set this to MBEDTLS_SSL_IS_FALLBACK for
1819 * non-fallback connections! This would appear to work for a
1820 * while, then cause failures when the server is upgraded to
1821 * support a newer TLS version.
1822 *
1823 * \param conf SSL configuration
1824 * \param fallback MBEDTLS_SSL_IS_NOT_FALLBACK or MBEDTLS_SSL_IS_FALLBACK
1825 */
1826 void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback );
1827 #endif /* MBEDTLS_SSL_FALLBACK_SCSV && MBEDTLS_SSL_CLI_C */
1828
1829 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1830 /**
1831 * \brief Enable or disable Encrypt-then-MAC
1832 * (Default: MBEDTLS_SSL_ETM_ENABLED)
1833 *
1834 * \note This should always be enabled, it is a security
1835 * improvement, and should not cause any interoperability
1836 * issue (used only if the peer supports it too).
1837 *
1838 * \param conf SSL configuration
1839 * \param etm MBEDTLS_SSL_ETM_ENABLED or MBEDTLS_SSL_ETM_DISABLED
1840 */
1841 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm );
1842 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1843
1844 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1845 /**
1846 * \brief Enable or disable Extended Master Secret negotiation.
1847 * (Default: MBEDTLS_SSL_EXTENDED_MS_ENABLED)
1848 *
1849 * \note This should always be enabled, it is a security fix to the
1850 * protocol, and should not cause any interoperability issue
1851 * (used only if the peer supports it too).
1852 *
1853 * \param conf SSL configuration
1854 * \param ems MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED
1855 */
1856 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems );
1857 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1858
1859 #if defined(MBEDTLS_ARC4_C)
1860 /**
1861 * \brief Disable or enable support for RC4
1862 * (Default: MBEDTLS_SSL_ARC4_DISABLED)
1863 *
1864 * \warning Use of RC4 in (D)TLS has been prohibited by RFC ????
1865 * for security reasons. Use at your own risks.
1866 *
1867 * \note This function will likely be removed in future versions as
1868 * RC4 will then be disabled by default at compile time.
1869 *
1870 * \param conf SSL configuration
1871 * \param arc4 MBEDTLS_SSL_ARC4_ENABLED or MBEDTLS_SSL_ARC4_DISABLED
1872 */
1873 void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 );
1874 #endif /* MBEDTLS_ARC4_C */
1875
1876 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1877 /**
1878 * \brief Set the maximum fragment length to emit and/or negotiate
1879 * (Default: MBEDTLS_SSL_MAX_CONTENT_LEN, usually 2^14 bytes)
1880 * (Server: set maximum fragment length to emit,
1881 * usually negotiated by the client during handshake
1882 * (Client: set maximum fragment length to emit *and*
1883 * negotiate with the server during handshake)
1884 *
1885 * \param conf SSL configuration
1886 * \param mfl_code Code for maximum fragment length (allowed values:
1887 * MBEDTLS_SSL_MAX_FRAG_LEN_512, MBEDTLS_SSL_MAX_FRAG_LEN_1024,
1888 * MBEDTLS_SSL_MAX_FRAG_LEN_2048, MBEDTLS_SSL_MAX_FRAG_LEN_4096)
1889 *
1890 * \return 0 if successful or MBEDTLS_ERR_SSL_BAD_INPUT_DATA
1891 */
1892 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code );
1893 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1894
1895 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1896 /**
1897 * \brief Activate negotiation of truncated HMAC
1898 * (Default: MBEDTLS_SSL_TRUNC_HMAC_DISABLED)
1899 *
1900 * \param conf SSL configuration
1901 * \param truncate Enable or disable (MBEDTLS_SSL_TRUNC_HMAC_ENABLED or
1902 * MBEDTLS_SSL_TRUNC_HMAC_DISABLED)
1903 */
1904 void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate );
1905 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1906
1907 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
1908 /**
1909 * \brief Enable / Disable 1/n-1 record splitting
1910 * (Default: MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED)
1911 *
1912 * \note Only affects SSLv3 and TLS 1.0, not higher versions.
1913 * Does not affect non-CBC ciphersuites in any version.
1914 *
1915 * \param conf SSL configuration
1916 * \param split MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED or
1917 * MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED
1918 */
1919 void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split );
1920 #endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
1921
1922 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
1923 /**
1924 * \brief Enable / Disable session tickets (client only).
1925 * (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.)
1926 *
1927 * \note On server, use \c mbedtls_ssl_conf_session_tickets_cb().
1928 *
1929 * \param conf SSL configuration
1930 * \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or
1931 * MBEDTLS_SSL_SESSION_TICKETS_DISABLED)
1932 */
1933 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets );
1934 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
1935
1936 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1937 /**
1938 * \brief Enable / Disable renegotiation support for connection when
1939 * initiated by peer
1940 * (Default: MBEDTLS_SSL_RENEGOTIATION_DISABLED)
1941 *
1942 * \warning It is recommended to always disable renegotation unless you
1943 * know you need it and you know what you're doing. In the
1944 * past, there has been several issues associated with
1945 * renegotiation or a poor understanding of its properties.
1946 *
1947 * \note Server-side, enabling renegotiation also makes the server
1948 * susceptible to a resource DoS by a malicious client.
1949 *
1950 * \param conf SSL configuration
1951 * \param renegotiation Enable or disable (MBEDTLS_SSL_RENEGOTIATION_ENABLED or
1952 * MBEDTLS_SSL_RENEGOTIATION_DISABLED)
1953 */
1954 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation );
1955 #endif /* MBEDTLS_SSL_RENEGOTIATION */
1956
1957 /**
1958 * \brief Prevent or allow legacy renegotiation.
1959 * (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION)
1960 *
1961 * MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to
1962 * be established even if the peer does not support
1963 * secure renegotiation, but does not allow renegotiation
1964 * to take place if not secure.
1965 * (Interoperable and secure option)
1966 *
1967 * MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations
1968 * with non-upgraded peers. Allowing legacy renegotiation
1969 * makes the connection vulnerable to specific man in the
1970 * middle attacks. (See RFC 5746)
1971 * (Most interoperable and least secure option)
1972 *
1973 * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections
1974 * if peer does not support secure renegotiation. Results
1975 * in interoperability issues with non-upgraded peers
1976 * that do not support renegotiation altogether.
1977 * (Most secure option, interoperability issues)
1978 *
1979 * \param conf SSL configuration
1980 * \param allow_legacy Prevent or allow (SSL_NO_LEGACY_RENEGOTIATION,
1981 * SSL_ALLOW_LEGACY_RENEGOTIATION or
1982 * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE)
1983 */
1984 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy );
1985
1986 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1987 /**
1988 * \brief Enforce renegotiation requests.
1989 * (Default: enforced, max_records = 16)
1990 *
1991 * When we request a renegotiation, the peer can comply or
1992 * ignore the request. This function allows us to decide
1993 * whether to enforce our renegotiation requests by closing
1994 * the connection if the peer doesn't comply.
1995 *
1996 * However, records could already be in transit from the peer
1997 * when the request is emitted. In order to increase
1998 * reliability, we can accept a number of records before the
1999 * expected handshake records.
2000 *
2001 * The optimal value is highly dependent on the specific usage
2002 * scenario.
2003 *
2004 * \note With DTLS and server-initiated renegotiation, the
2005 * HelloRequest is retransmited every time mbedtls_ssl_read() times
2006 * out or receives Application Data, until:
2007 * - max_records records have beens seen, if it is >= 0, or
2008 * - the number of retransmits that would happen during an
2009 * actual handshake has been reached.
2010 * Please remember the request might be lost a few times
2011 * if you consider setting max_records to a really low value.
2012 *
2013 * \warning On client, the grace period can only happen during
2014 * mbedtls_ssl_read(), as opposed to mbedtls_ssl_write() and mbedtls_ssl_renegotiate()
2015 * which always behave as if max_record was 0. The reason is,
2016 * if we receive application data from the server, we need a
2017 * place to write it, which only happens during mbedtls_ssl_read().
2018 *
2019 * \param conf SSL configuration
2020 * \param max_records Use MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED if you don't want to
2021 * enforce renegotiation, or a non-negative value to enforce
2022 * it but allow for a grace period of max_records records.
2023 */
2024 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records );
2025
2026 /**
2027 * \brief Set record counter threshold for periodic renegotiation.
2028 * (Default: 2^64 - 256.)
2029 *
2030 * Renegotiation is automatically triggered when a record
2031 * counter (outgoing or ingoing) crosses the defined
2032 * threshold. The default value is meant to prevent the
2033 * connection from being closed when the counter is about to
2034 * reached its maximal value (it is not allowed to wrap).
2035 *
2036 * Lower values can be used to enforce policies such as "keys
2037 * must be refreshed every N packets with cipher X".
2038 *
2039 * \param conf SSL configuration
2040 * \param period The threshold value: a big-endian 64-bit number.
2041 * Set to 2^64 - 1 to disable periodic renegotiation
2042 */
2043 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
2044 const unsigned char period[8] );
2045 #endif /* MBEDTLS_SSL_RENEGOTIATION */
2046
2047 /**
2048 * \brief Return the number of data bytes available to read
2049 *
2050 * \param ssl SSL context
2051 *
2052 * \return how many bytes are available in the read buffer
2053 */
2054 size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl );
2055
2056 /**
2057 * \brief Return the result of the certificate verification
2058 *
2059 * \param ssl SSL context
2060 *
2061 * \return 0 if successful,
2062 * -1 if result is not available (eg because the handshake was
2063 * aborted too early), or
2064 * a combination of BADCERT_xxx and BADCRL_xxx flags, see
2065 * x509.h
2066 */
2067 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl );
2068
2069 /**
2070 * \brief Return the name of the current ciphersuite
2071 *
2072 * \param ssl SSL context
2073 *
2074 * \return a string containing the ciphersuite name
2075 */
2076 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl );
2077
2078 /**
2079 * \brief Return the current SSL version (SSLv3/TLSv1/etc)
2080 *
2081 * \param ssl SSL context
2082 *
2083 * \return a string containing the SSL version
2084 */
2085 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl );
2086
2087 /**
2088 * \brief Return the (maximum) number of bytes added by the record
2089 * layer: header + encryption/MAC overhead (inc. padding)
2090 *
2091 * \param ssl SSL context
2092 *
2093 * \return Current maximum record expansion in bytes, or
2094 * MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if compression is
2095 * enabled, which makes expansion much less predictable
2096 */
2097 int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl );
2098
2099 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2100 /**
2101 * \brief Return the maximum fragment length (payload, in bytes).
2102 * This is the value negotiated with peer if any,
2103 * or the locally configured value.
2104 *
2105 * \note With DTLS, \c mbedtls_ssl_write() will return an error if
2106 * called with a larger length value.
2107 * With TLS, \c mbedtls_ssl_write() will fragment the input if
2108 * necessary and return the number of bytes written; it is up
2109 * to the caller to call \c mbedtls_ssl_write() again in
2110 * order to send the remaining bytes if any.
2111 *
2112 * \param ssl SSL context
2113 *
2114 * \return Current maximum fragment length.
2115 */
2116 size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl );
2117 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2118
2119 #if defined(MBEDTLS_X509_CRT_PARSE_C)
2120 /**
2121 * \brief Return the peer certificate from the current connection
2122 *
2123 * Note: Can be NULL in case no certificate was sent during
2124 * the handshake. Different calls for the same connection can
2125 * return the same or different pointers for the same
2126 * certificate and even a different certificate altogether.
2127 * The peer cert CAN change in a single connection if
2128 * renegotiation is performed.
2129 *
2130 * \param ssl SSL context
2131 *
2132 * \return the current peer certificate
2133 */
2134 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl );
2135 #endif /* MBEDTLS_X509_CRT_PARSE_C */
2136
2137 #if defined(MBEDTLS_SSL_CLI_C)
2138 /**
2139 * \brief Save session in order to resume it later (client-side only)
2140 * Session data is copied to presented session structure.
2141 *
2142 * \warning Currently, peer certificate is lost in the operation.
2143 *
2144 * \param ssl SSL context
2145 * \param session session context
2146 *
2147 * \return 0 if successful,
2148 * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed,
2149 * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or
2150 * arguments are otherwise invalid
2151 *
2152 * \sa mbedtls_ssl_set_session()
2153 */
2154 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *session );
2155 #endif /* MBEDTLS_SSL_CLI_C */
2156
2157 /**
2158 * \brief Perform the SSL handshake
2159 *
2160 * \param ssl SSL context
2161 *
2162 * \return 0 if successful, or
2163 * MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE, or
2164 * MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED (see below), or
2165 * a specific SSL error code.
2166 *
2167 * \note If this function returns something other than 0 or
2168 * MBEDTLS_ERR_SSL_WANT_READ/WRITE, then the ssl context
2169 * becomes unusable, and you should either free it or call
2170 * \c mbedtls_ssl_session_reset() on it before re-using it.
2171 *
2172 * \note If DTLS is in use, then you may choose to handle
2173 * MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging
2174 * purposes, as it is an expected return value rather than an
2175 * actual error, but you still need to reset/free the context.
2176 */
2177 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl );
2178
2179 /**
2180 * \brief Perform a single step of the SSL handshake
2181 *
2182 * \note The state of the context (ssl->state) will be at
2183 * the following state after execution of this function.
2184 * Do not call this function if state is MBEDTLS_SSL_HANDSHAKE_OVER.
2185 *
2186 * \param ssl SSL context
2187 *
2188 * \return 0 if successful, or
2189 * MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE, or
2190 * a specific SSL error code.
2191 */
2192 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl );
2193
2194 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2195 /**
2196 * \brief Initiate an SSL renegotiation on the running connection.
2197 * Client: perform the renegotiation right now.
2198 * Server: request renegotiation, which will be performed
2199 * during the next call to mbedtls_ssl_read() if honored by client.
2200 *
2201 * \param ssl SSL context
2202 *
2203 * \return 0 if successful, or any mbedtls_ssl_handshake() return value.
2204 */
2205 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl );
2206 #endif /* MBEDTLS_SSL_RENEGOTIATION */
2207
2208 /**
2209 * \brief Read at most 'len' application data bytes
2210 *
2211 * \param ssl SSL context
2212 * \param buf buffer that will hold the data
2213 * \param len maximum number of bytes to read
2214 *
2215 * \return the number of bytes read, or
2216 * 0 for EOF, or
2217 * MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE, or
2218 * MBEDTLS_ERR_SSL_CLIENT_RECONNECT (see below), or
2219 * another negative error code.
2220 *
2221 * \note When this function return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
2222 * (which can only happen server-side), it means that a client
2223 * is initiating a new connection using the same source port.
2224 * You can either treat that as a connection close and wait
2225 * for the client to resend a ClientHello, or directly
2226 * continue with \c mbedtls_ssl_handshake() with the same
2227 * context (as it has beeen reset internally). Either way, you
2228 * should make sure this is seen by the application as a new
2229 * connection: application state, if any, should be reset, and
2230 * most importantly the identity of the client must be checked
2231 * again. WARNING: not validating the identity of the client
2232 * again, or not transmitting the new identity to the
2233 * application layer, would allow authentication bypass!
2234 */
2235 int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len );
2236
2237 /**
2238 * \brief Try to write exactly 'len' application data bytes
2239 *
2240 * \warning This function will do partial writes in some cases. If the
2241 * return value is non-negative but less than length, the
2242 * function must be called again with updated arguments:
2243 * buf + ret, len - ret (if ret is the return value) until
2244 * it returns a value equal to the last 'len' argument.
2245 *
2246 * \param ssl SSL context
2247 * \param buf buffer holding the data
2248 * \param len how many bytes must be written
2249 *
2250 * \return the number of bytes actually written (may be less than len),
2251 * or MBEDTLS_ERR_SSL_WANT_WRITE of MBEDTLS_ERR_SSL_WANT_READ,
2252 * or another negative error code.
2253 *
2254 * \note When this function returns MBEDTLS_ERR_SSL_WANT_WRITE/READ,
2255 * it must be called later with the *same* arguments,
2256 * until it returns a positive value.
2257 *
2258 * \note If the requested length is greater than the maximum
2259 * fragment length (either the built-in limit or the one set
2260 * or negotiated with the peer), then:
2261 * - with TLS, less bytes than requested are written.
2262 * - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned.
2263 * \c mbedtls_ssl_get_max_frag_len() may be used to query the
2264 * active maximum fragment length.
2265 */
2266 int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len );
2267
2268 /**
2269 * \brief Send an alert message
2270 *
2271 * \param ssl SSL context
2272 * \param level The alert level of the message
2273 * (MBEDTLS_SSL_ALERT_LEVEL_WARNING or MBEDTLS_SSL_ALERT_LEVEL_FATAL)
2274 * \param message The alert message (SSL_ALERT_MSG_*)
2275 *
2276 * \return 0 if successful, or a specific SSL error code.
2277 */
2278 int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
2279 unsigned char level,
2280 unsigned char message );
2281 /**
2282 * \brief Notify the peer that the connection is being closed
2283 *
2284 * \param ssl SSL context
2285 */
2286 int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl );
2287
2288 /**
2289 * \brief Free referenced items in an SSL context and clear memory
2290 *
2291 * \param ssl SSL context
2292 */
2293 void mbedtls_ssl_free( mbedtls_ssl_context *ssl );
2294
2295 /**
2296 * \brief Initialize an SSL configuration context
2297 * Just makes the context ready for
2298 * mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free().
2299 *
2300 * \note You need to call mbedtls_ssl_config_defaults() unless you
2301 * manually set all of the relevent fields yourself.
2302 *
2303 * \param conf SSL configuration context
2304 */
2305 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf );
2306
2307 /**
2308 * \brief Load reasonnable default SSL configuration values.
2309 * (You need to call mbedtls_ssl_config_init() first.)
2310 *
2311 * \param conf SSL configuration context
2312 * \param endpoint MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER
2313 * \param transport MBEDTLS_SSL_TRANSPORT_STREAM for TLS, or
2314 * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS
2315 * \param preset a MBEDTLS_SSL_PRESET_XXX value
2316 * (currently unused).
2317 *
2318 * \note See \c mbedtls_ssl_conf_transport() for notes on DTLS.
2319 *
2320 * \return 0 if successful, or
2321 * MBEDTLS_ERR_XXX_ALLOC_FAILED on memory allocation error.
2322 */
2323 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
2324 int endpoint, int transport, int preset );
2325
2326 /**
2327 * \brief Free an SSL configuration context
2328 *
2329 * \param conf SSL configuration context
2330 */
2331 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf );
2332
2333 /**
2334 * \brief Initialize SSL session structure
2335 *
2336 * \param session SSL session
2337 */
2338 void mbedtls_ssl_session_init( mbedtls_ssl_session *session );
2339
2340 /**
2341 * \brief Free referenced items in an SSL session including the
2342 * peer certificate and clear memory
2343 *
2344 * \param session SSL session
2345 */
2346 void mbedtls_ssl_session_free( mbedtls_ssl_session *session );
2347
2348 #ifdef __cplusplus
2349 }
2350 #endif
2351
2352 #endif /* ssl.h */