source: trunk/include/polarssl/ssl.h @ 1270

Revision 1270, 28.6 KB checked in by paul, 10 days ago (diff)
  • Moved out_msg to out_hdr + 32 to support hardware acceleration
Line 
1/**
2 * \file ssl.h
3 *
4 * \brief SSL/TLS functions.
5 *
6 *  Copyright (C) 2006-2012, Brainspark B.V.
7 *
8 *  This file is part of PolarSSL (http://www.polarssl.org)
9 *  Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
10 *
11 *  All rights reserved.
12 *
13 *  This program is free software; you can redistribute it and/or modify
14 *  it under the terms of the GNU General Public License as published by
15 *  the Free Software Foundation; either version 2 of the License, or
16 *  (at your option) any later version.
17 *
18 *  This program is distributed in the hope that it will be useful,
19 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
20 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
21 *  GNU General Public License for more details.
22 *
23 *  You should have received a copy of the GNU General Public License along
24 *  with this program; if not, write to the Free Software Foundation, Inc.,
25 *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 */
27#ifndef POLARSSL_SSL_H
28#define POLARSSL_SSL_H
29
30#include <time.h>
31
32#include "net.h"
33#include "dhm.h"
34#include "rsa.h"
35#include "md5.h"
36#include "sha1.h"
37#include "sha2.h"
38#include "sha4.h"
39#include "x509.h"
40#include "config.h"
41
42#if defined(POLARSSL_PKCS11_C)
43#include "pkcs11.h"
44#endif
45
46#if defined(_MSC_VER) && !defined(inline)
47#define inline _inline
48#else
49#if defined(__ARMCC_VERSION) && !defined(inline)
50#define inline __inline
51#endif /* __ARMCC_VERSION */
52#endif /*_MSC_VER */
53
54/*
55 * SSL Error codes
56 */
57#define POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE               -0x7080  /**< The requested feature is not available. */
58#define POLARSSL_ERR_SSL_BAD_INPUT_DATA                    -0x7100  /**< Bad input parameters to function. */
59#define POLARSSL_ERR_SSL_INVALID_MAC                       -0x7180  /**< Verification of the message MAC failed. */
60#define POLARSSL_ERR_SSL_INVALID_RECORD                    -0x7200  /**< An invalid SSL record was received. */
61#define POLARSSL_ERR_SSL_CONN_EOF                          -0x7280  /**< The connection indicated an EOF. */
62#define POLARSSL_ERR_SSL_UNKNOWN_CIPHER                    -0x7300  /**< An unknown cipher was received. */
63#define POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN                  -0x7380  /**< The server has no ciphersuites in common with the client. */
64#define POLARSSL_ERR_SSL_NO_SESSION_FOUND                  -0x7400  /**< No session to recover was found. */
65#define POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE             -0x7480  /**< No client certification received from the client, but required by the authentication mode. */
66#define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE             -0x7500  /**< Our own certificate(s) is/are too large to send in an SSL message.*/
67#define POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED              -0x7580  /**< The own certificate is not set, but needed by the server. */
68#define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED              -0x7600  /**< The own private key is not set, but needed. */
69#define POLARSSL_ERR_SSL_CA_CHAIN_REQUIRED                 -0x7680  /**< No CA Chain is set, but required to operate. */
70#define POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE                -0x7700  /**< An unexpected message was received from our peer. */
71#define POLARSSL_ERR_SSL_FATAL_ALERT_MESSAGE               -0x7780  /**< A fatal alert message was received from our peer. */
72#define POLARSSL_ERR_SSL_PEER_VERIFY_FAILED                -0x7800  /**< Verification of our peer failed. */
73#define POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY                 -0x7880  /**< The peer notified us that the connection is going to be closed. */
74#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO               -0x7900  /**< Processing of the ClientHello handshake message failed. */
75#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO               -0x7980  /**< Processing of the ServerHello handshake message failed. */
76#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE                -0x7A00  /**< Processing of the Certificate handshake message failed. */
77#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST        -0x7A80  /**< Processing of the CertificateRequest handshake message failed. */
78#define POLARSSL_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE        -0x7B00  /**< Processing of the ServerKeyExchange handshake message failed. */
79#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO_DONE          -0x7B80  /**< Processing of the ServerHelloDone handshake message failed. */
80#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE        -0x7C00  /**< Processing of the ClientKeyExchange handshake message failed. */
81#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_DHM_RP -0x7C80  /**< Processing of the ClientKeyExchange handshake message failed in DHM Read Public. */
82#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_DHM_CS -0x7D00  /**< Processing of the ClientKeyExchange handshake message failed in DHM Calculate Secret. */
83#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY         -0x7D80  /**< Processing of the CertificateVerify handshake message failed. */
84#define POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC         -0x7E00  /**< Processing of the ChangeCipherSpec handshake message failed. */
85#define POLARSSL_ERR_SSL_BAD_HS_FINISHED                   -0x7E80  /**< Processing of the Finished handshake message failed. */
86#define POLARSSL_ERR_SSL_MALLOC_FAILED                     -0x7F00  /**< Memory allocation failed */
87#define POLARSSL_ERR_SSL_HW_ACCEL_FAILED                   -0x7F80  /**< Hardware acceleration function returned with error */
88#define POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH              -0x6F80  /**< Hardware acceleration function skipped / left alone data */
89
90/*
91 * Various constants
92 */
93#define SSL_MAJOR_VERSION_3             3
94#define SSL_MINOR_VERSION_0             0   /*!< SSL v3.0 */
95#define SSL_MINOR_VERSION_1             1   /*!< TLS v1.0 */
96#define SSL_MINOR_VERSION_2             2   /*!< TLS v1.1 */
97#define SSL_MINOR_VERSION_3             3   /*!< TLS v1.2 */
98
99#define SSL_IS_CLIENT                   0
100#define SSL_IS_SERVER                   1
101#define SSL_COMPRESS_NULL               0
102
103#define SSL_VERIFY_NONE                 0
104#define SSL_VERIFY_OPTIONAL             1
105#define SSL_VERIFY_REQUIRED             2
106
107#define SSL_MAX_CONTENT_LEN         16384
108
109/*
110 * Allow an extra 512 bytes for the record header
111 * and encryption overhead (counter + MAC + padding).
112 */
113#define SSL_BUFFER_LEN (SSL_MAX_CONTENT_LEN + 512)
114
115/*
116 * Supported ciphersuites
117 */
118#define SSL_RSA_NULL_MD5             0x01   /**< Weak! */
119#define SSL_RSA_NULL_SHA             0x02   /**< Weak! */
120#define SSL_RSA_NULL_SHA256          0x3B   /**< Weak! */
121#define SSL_RSA_DES_SHA              0x09   /**< Weak! Not in TLS 1.2 */
122#define SSL_EDH_RSA_DES_SHA          0x15   /**< Weak! Not in TLS 1.2 */
123
124#define SSL_RSA_RC4_128_MD5          0x04
125#define SSL_RSA_RC4_128_SHA          0x05
126
127#define SSL_RSA_DES_168_SHA          0x0A
128#define SSL_EDH_RSA_DES_168_SHA      0x16
129
130#define SSL_RSA_AES_128_SHA          0x2F
131#define SSL_EDH_RSA_AES_128_SHA      0x33
132#define SSL_RSA_AES_256_SHA          0x35
133#define SSL_EDH_RSA_AES_256_SHA      0x39
134#define SSL_RSA_AES_128_SHA256       0x3C   /**< TLS 1.2 */
135#define SSL_RSA_AES_256_SHA256       0x3D   /**< TLS 1.2 */
136#define SSL_EDH_RSA_AES_128_SHA256   0x67   /**< TLS 1.2 */
137#define SSL_EDH_RSA_AES_256_SHA256   0x6B   /**< TLS 1.2 */
138
139#define SSL_RSA_CAMELLIA_128_SHA        0x41
140#define SSL_EDH_RSA_CAMELLIA_128_SHA    0x45
141#define SSL_RSA_CAMELLIA_256_SHA        0x84
142#define SSL_EDH_RSA_CAMELLIA_256_SHA    0x88
143#define SSL_RSA_CAMELLIA_128_SHA256     0xBA   /**< TLS 1.2 */
144#define SSL_EDH_RSA_CAMELLIA_128_SHA256 0xBE   /**< TLS 1.2 */
145#define SSL_RSA_CAMELLIA_256_SHA256     0xC0   /**< TLS 1.2 */
146#define SSL_EDH_RSA_CAMELLIA_256_SHA256 0xC4   /**< TLS 1.2 */
147
148#define SSL_RSA_AES_128_GCM_SHA256      0x9C
149#define SSL_RSA_AES_256_GCM_SHA384      0x9D
150#define SSL_EDH_RSA_AES_128_GCM_SHA256  0x9E
151#define SSL_EDH_RSA_AES_256_GCM_SHA384  0x9F
152
153/*
154 * Supported Signature and Hash algorithms (For TLS 1.2)
155 */
156#define SSL_HASH_NONE                0
157#define SSL_HASH_MD5                 1
158#define SSL_HASH_SHA1                2
159#define SSL_HASH_SHA224              3
160#define SSL_HASH_SHA256              4
161#define SSL_HASH_SHA384              5
162#define SSL_HASH_SHA512              6
163
164#define SSL_SIG_RSA                  1
165
166/*
167 * Message, alert and handshake types
168 */
169#define SSL_MSG_CHANGE_CIPHER_SPEC     20
170#define SSL_MSG_ALERT                  21
171#define SSL_MSG_HANDSHAKE              22
172#define SSL_MSG_APPLICATION_DATA       23
173
174#define SSL_ALERT_LEVEL_WARNING         1
175#define SSL_ALERT_LEVEL_FATAL           2
176
177#define SSL_ALERT_MSG_CLOSE_NOTIFY           0  /* 0x00 */
178#define SSL_ALERT_MSG_UNEXPECTED_MESSAGE    10  /* 0x0A */
179#define SSL_ALERT_MSG_BAD_RECORD_MAC        20  /* 0x14 */
180#define SSL_ALERT_MSG_DECRYPTION_FAILED     21  /* 0x15 */
181#define SSL_ALERT_MSG_RECORD_OVERFLOW       22  /* 0x16 */
182#define SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30  /* 0x1E */
183#define SSL_ALERT_MSG_HANDSHAKE_FAILURE     40  /* 0x28 */
184#define SSL_ALERT_MSG_NO_CERT               41  /* 0x29 */
185#define SSL_ALERT_MSG_BAD_CERT              42  /* 0x2A */
186#define SSL_ALERT_MSG_UNSUPPORTED_CERT      43  /* 0x2B */
187#define SSL_ALERT_MSG_CERT_REVOKED          44  /* 0x2C */
188#define SSL_ALERT_MSG_CERT_EXPIRED          45  /* 0x2D */
189#define SSL_ALERT_MSG_CERT_UNKNOWN          46  /* 0x2E */
190#define SSL_ALERT_MSG_ILLEGAL_PARAMETER     47  /* 0x2F */
191#define SSL_ALERT_MSG_UNKNOWN_CA            48  /* 0x30 */
192#define SSL_ALERT_MSG_ACCESS_DENIED         49  /* 0x31 */
193#define SSL_ALERT_MSG_DECODE_ERROR          50  /* 0x32 */
194#define SSL_ALERT_MSG_DECRYPT_ERROR         51  /* 0x33 */
195#define SSL_ALERT_MSG_EXPORT_RESTRICTION    60  /* 0x3C */
196#define SSL_ALERT_MSG_PROTOCOL_VERSION      70  /* 0x46 */
197#define SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71  /* 0x47 */
198#define SSL_ALERT_MSG_INTERNAL_ERROR        80  /* 0x50 */
199#define SSL_ALERT_MSG_USER_CANCELED         90  /* 0x5A */
200#define SSL_ALERT_MSG_NO_RENEGOTIATION     100  /* 0x64 */
201#define SSL_ALERT_MSG_UNSUPPORTED_EXT      110  /* 0x6E */
202
203#define SSL_HS_HELLO_REQUEST            0
204#define SSL_HS_CLIENT_HELLO             1
205#define SSL_HS_SERVER_HELLO             2
206#define SSL_HS_CERTIFICATE             11
207#define SSL_HS_SERVER_KEY_EXCHANGE     12
208#define SSL_HS_CERTIFICATE_REQUEST     13
209#define SSL_HS_SERVER_HELLO_DONE       14
210#define SSL_HS_CERTIFICATE_VERIFY      15
211#define SSL_HS_CLIENT_KEY_EXCHANGE     16
212#define SSL_HS_FINISHED                20
213
214/*
215 * TLS extensions
216 */
217#define TLS_EXT_SERVERNAME              0
218#define TLS_EXT_SERVERNAME_HOSTNAME     0
219
220#define TLS_EXT_SIG_ALG                13
221
222/*
223 * SSL state machine
224 */
225typedef enum
226{
227    SSL_HELLO_REQUEST,
228    SSL_CLIENT_HELLO,
229    SSL_SERVER_HELLO,
230    SSL_SERVER_CERTIFICATE,
231    SSL_SERVER_KEY_EXCHANGE,
232    SSL_CERTIFICATE_REQUEST,
233    SSL_SERVER_HELLO_DONE,
234    SSL_CLIENT_CERTIFICATE,
235    SSL_CLIENT_KEY_EXCHANGE,
236    SSL_CERTIFICATE_VERIFY,
237    SSL_CLIENT_CHANGE_CIPHER_SPEC,
238    SSL_CLIENT_FINISHED,
239    SSL_SERVER_CHANGE_CIPHER_SPEC,
240    SSL_SERVER_FINISHED,
241    SSL_FLUSH_BUFFERS,
242    SSL_HANDSHAKE_OVER
243}
244ssl_states;
245
246typedef struct _ssl_session ssl_session;
247typedef struct _ssl_context ssl_context;
248
249/*
250 * This structure is used for session resuming.
251 */
252struct _ssl_session
253{
254    time_t start;               /*!< starting time      */
255    int ciphersuite;            /*!< chosen ciphersuite */
256    size_t length;              /*!< session id length  */
257    unsigned char id[32];       /*!< session identifier */
258    unsigned char master[48];   /*!< the master secret  */
259    ssl_session *next;          /*!< next session entry */
260};
261
262struct _ssl_context
263{
264    /*
265     * Miscellaneous
266     */
267    int state;                  /*!< SSL handshake: current state     */
268
269    int major_ver;              /*!< equal to  SSL_MAJOR_VERSION_3    */
270    int minor_ver;              /*!< either 0 (SSL3) or 1 (TLS1.0)    */
271
272    int max_major_ver;          /*!< max. major version from client   */
273    int max_minor_ver;          /*!< max. minor version from client   */
274
275    /*
276     * Callbacks (RNG, debug, I/O, verification)
277     */
278    int  (*f_rng)(void *, unsigned char *, size_t);
279    void (*f_dbg)(void *, int, const char *);
280    int (*f_recv)(void *, unsigned char *, size_t);
281    int (*f_send)(void *, const unsigned char *, size_t);
282    int (*f_vrfy)(void *, x509_cert *, int, int);
283
284    void *p_rng;                /*!< context for the RNG function     */
285    void *p_dbg;                /*!< context for the debug function   */
286    void *p_recv;               /*!< context for reading operations   */
287    void *p_send;               /*!< context for writing operations   */
288    void *p_vrfy;               /*!< context for verification */
289
290    /*
291     * Session layer
292     */
293    int resume;                         /*!<  session resuming flag   */
294    int timeout;                        /*!<  sess. expiration time   */
295    ssl_session *session;               /*!<  current session data    */
296    int (*s_get)(ssl_context *);        /*!<  (server) get callback   */
297    int (*s_set)(ssl_context *);        /*!<  (server) set callback   */
298
299    /*
300     * Record layer (incoming data)
301     */
302    unsigned char *in_ctr;      /*!< 64-bit incoming message counter  */
303    unsigned char *in_hdr;      /*!< 5-byte record header (in_ctr+8)  */
304    unsigned char *in_msg;      /*!< the message contents (in_hdr+5)  */
305    unsigned char *in_offt;     /*!< read offset in application data  */
306
307    int in_msgtype;             /*!< record header: message type      */
308    size_t in_msglen;           /*!< record header: message length    */
309    size_t in_left;             /*!< amount of data read so far       */
310
311    size_t in_hslen;            /*!< current handshake message length */
312    int nb_zero;                /*!< # of 0-length encrypted messages */
313
314    /*
315     * Record layer (outgoing data)
316     */
317    unsigned char *out_ctr;     /*!< 64-bit outgoing message counter  */
318    unsigned char *out_hdr;     /*!< 5-byte record header (out_ctr+8) */
319    unsigned char *out_msg;     /*!< the message contents (out_hdr+32)*/
320
321    int out_msgtype;            /*!< record header: message type      */
322    size_t out_msglen;          /*!< record header: message length    */
323    size_t out_left;            /*!< amount of data not yet written   */
324
325    /*
326     * PKI layer
327     */
328    rsa_context *rsa_key;               /*!<  own RSA private key     */
329#if defined(POLARSSL_PKCS11_C)
330    pkcs11_context *pkcs11_key;         /*!<  own PKCS#11 RSA private key */
331#endif
332    x509_cert *own_cert;                /*!<  own X.509 certificate   */
333    x509_cert *ca_chain;                /*!<  own trusted CA chain    */
334    x509_crl *ca_crl;                   /*!<  trusted CA CRLs         */
335    x509_cert *peer_cert;               /*!<  peer X.509 cert chain   */
336    const char *peer_cn;                /*!<  expected peer CN        */
337
338    int endpoint;                       /*!<  0: client, 1: server    */
339    int authmode;                       /*!<  verification mode       */
340    int client_auth;                    /*!<  flag for client auth.   */
341    int verify_result;                  /*!<  verification result     */
342
343    /*
344     * Crypto layer
345     */
346    dhm_context dhm_ctx;                /*!<  DHM key exchange        */
347    unsigned char ctx_checksum[500];    /*!<  Checksum context(s)     */
348
349    void (*update_checksum)(ssl_context *, unsigned char *, size_t);
350    void (*calc_verify)(ssl_context *, unsigned char *);
351    void (*calc_finished)(ssl_context *, unsigned char *, int);
352    int  (*tls_prf)(unsigned char *, size_t, char *,
353                    unsigned char *, size_t,
354                    unsigned char *, size_t);
355
356    int do_crypt;                       /*!<  en(de)cryption flag     */
357    int *ciphersuites;                  /*!<  allowed ciphersuites    */
358    size_t pmslen;                      /*!<  premaster length        */
359    unsigned int keylen;                /*!<  symmetric key length    */
360    size_t minlen;                      /*!<  min. ciphertext length  */
361    size_t ivlen;                       /*!<  IV length               */
362    size_t fixed_ivlen;                 /*!<  Fixed part of IV (AEAD) */
363    size_t maclen;                      /*!<  MAC length              */
364
365    unsigned char randbytes[64];        /*!<  random bytes            */
366    unsigned char premaster[256];       /*!<  premaster secret        */
367
368    unsigned char iv_enc[16];           /*!<  IV (encryption)         */
369    unsigned char iv_dec[16];           /*!<  IV (decryption)         */
370
371    unsigned char mac_enc[32];          /*!<  MAC (encryption)        */
372    unsigned char mac_dec[32];          /*!<  MAC (decryption)        */
373
374    unsigned long ctx_enc[134];         /*!<  encryption context      */
375    unsigned long ctx_dec[134];         /*!<  decryption context      */
376
377    /*
378     * TLS extensions
379     */
380    unsigned char *hostname;
381    size_t         hostname_len;
382};
383
384#ifdef __cplusplus
385extern "C" {
386#endif
387
388extern int ssl_default_ciphersuites[];
389
390#if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
391extern int (*ssl_hw_record_init)(ssl_context *ssl,
392                const unsigned char *key_enc, const unsigned char *key_dec,
393                const unsigned char *iv_enc,  const unsigned char *iv_dec,
394                const unsigned char *mac_enc, const unsigned char *mac_dec);
395extern int (*ssl_hw_record_reset)(ssl_context *ssl);
396extern int (*ssl_hw_record_write)(ssl_context *ssl);
397extern int (*ssl_hw_record_read)(ssl_context *ssl);
398extern int (*ssl_hw_record_finish)(ssl_context *ssl);
399#endif
400
401/**
402 * \brief Returns the list of ciphersuites supported by the SSL/TLS module.
403 *
404 * \return              a statically allocated array of ciphersuites, the last
405 *                      entry is 0.
406 */
407static inline const int *ssl_list_ciphersuites( void )
408{
409    return ssl_default_ciphersuites;
410}
411
412/**
413 * \brief               Return the name of the ciphersuite associated with the given
414 *                      ID
415 *
416 * \param ciphersuite_id SSL ciphersuite ID
417 *
418 * \return              a string containing the ciphersuite name
419 */
420const char *ssl_get_ciphersuite_name( const int ciphersuite_id );
421
422/**
423 * \brief               Return the ID of the ciphersuite associated with the given
424 *                      name
425 *
426 * \param ciphersuite_name SSL ciphersuite name
427 *
428 * \return              the ID with the ciphersuite or 0 if not found
429 */
430int ssl_get_ciphersuite_id( const char *ciphersuite_name );
431
432/**
433 * \brief          Initialize an SSL context
434 *
435 * \param ssl      SSL context
436 *
437 * \return         0 if successful, or POLARSSL_ERR_SSL_MALLOC_FAILED if
438 *                 memory allocation failed
439 */
440int ssl_init( ssl_context *ssl );
441
442/**
443 * \brief          Reset an already initialized SSL context for re-use
444 *                 while retaining application-set variables, function
445 *                 pointers and data.
446 *
447 * \param ssl      SSL context
448 */
449void ssl_session_reset( ssl_context *ssl );
450
451/**
452 * \brief          Set the current endpoint type
453 *
454 * \param ssl      SSL context
455 * \param endpoint must be SSL_IS_CLIENT or SSL_IS_SERVER
456 */
457void ssl_set_endpoint( ssl_context *ssl, int endpoint );
458
459/**
460 * \brief          Set the certificate verification mode
461 *
462 * \param ssl      SSL context
463 * \param authmode can be:
464 *
465 *  SSL_VERIFY_NONE:      peer certificate is not checked (default),
466 *                        this is insecure and SHOULD be avoided.
467 *
468 *  SSL_VERIFY_OPTIONAL:  peer certificate is checked, however the
469 *                        handshake continues even if verification failed;
470 *                        ssl_get_verify_result() can be called after the
471 *                        handshake is complete.
472 *
473 *  SSL_VERIFY_REQUIRED:  peer *must* present a valid certificate,
474 *                        handshake is aborted if verification failed.
475 */
476void ssl_set_authmode( ssl_context *ssl, int authmode );
477
478/**
479 * \brief          Set the verification callback (Optional).
480 *
481 *                 If set, the verification callback is called once for every
482 *                 certificate in the chain. The verification function has the
483 *                 following parameter: (void *parameter, x509_cert certificate,
484 *                 int certifcate_depth, int preverify_ok). It should
485 *                 return 0 on SUCCESS.
486 *
487 * \param ssl      SSL context
488 * \param f_vrfy   verification function
489 * \param p_vrfy   verification parameter
490 */
491void ssl_set_verify( ssl_context *ssl,
492                     int (*f_vrfy)(void *, x509_cert *, int, int),
493                     void *p_vrfy );
494
495/**
496 * \brief          Set the random number generator callback
497 *
498 * \param ssl      SSL context
499 * \param f_rng    RNG function
500 * \param p_rng    RNG parameter
501 */
502void ssl_set_rng( ssl_context *ssl,
503                  int (*f_rng)(void *, unsigned char *, size_t),
504                  void *p_rng );
505
506/**
507 * \brief          Set the debug callback
508 *
509 * \param ssl      SSL context
510 * \param f_dbg    debug function
511 * \param p_dbg    debug parameter
512 */
513void ssl_set_dbg( ssl_context *ssl,
514                  void (*f_dbg)(void *, int, const char *),
515                  void  *p_dbg );
516
517/**
518 * \brief          Set the underlying BIO read and write callbacks
519 *
520 * \param ssl      SSL context
521 * \param f_recv   read callback
522 * \param p_recv   read parameter
523 * \param f_send   write callback
524 * \param p_send   write parameter
525 */
526void ssl_set_bio( ssl_context *ssl,
527        int (*f_recv)(void *, unsigned char *, size_t), void *p_recv,
528        int (*f_send)(void *, const unsigned char *, size_t), void *p_send );
529
530/**
531 * \brief          Set the session callbacks (server-side only)
532 *
533 * \param ssl      SSL context
534 * \param s_get    session get callback
535 * \param s_set    session set callback
536 */
537void ssl_set_scb( ssl_context *ssl,
538                  int (*s_get)(ssl_context *),
539                  int (*s_set)(ssl_context *) );
540
541/**
542 * \brief          Set the session resuming flag, timeout and data
543 *
544 * \param ssl      SSL context
545 * \param resume   if 0 (default), the session will not be resumed
546 * \param timeout  session timeout in seconds, or 0 (no timeout)
547 * \param session  session context
548 */
549void ssl_set_session( ssl_context *ssl, int resume, int timeout,
550                      ssl_session *session );
551
552/**
553 * \brief               Set the list of allowed ciphersuites
554 *
555 * \param ssl           SSL context
556 * \param ciphersuites  0-terminated list of allowed ciphersuites
557 */
558void ssl_set_ciphersuites( ssl_context *ssl, int *ciphersuites );
559
560/**
561 * \brief          Set the data required to verify peer certificate
562 *
563 * \param ssl      SSL context
564 * \param ca_chain trusted CA chain
565 * \param ca_crl   trusted CA CRLs
566 * \param peer_cn  expected peer CommonName (or NULL)
567 *
568 * \note           TODO: add two more parameters: depth and crl
569 */
570void ssl_set_ca_chain( ssl_context *ssl, x509_cert *ca_chain,
571                       x509_crl *ca_crl, const char *peer_cn );
572
573/**
574 * \brief          Set own certificate and private key
575 *
576 * \param ssl      SSL context
577 * \param own_cert own public certificate
578 * \param rsa_key  own private RSA key
579 */
580void ssl_set_own_cert( ssl_context *ssl, x509_cert *own_cert,
581                       rsa_context *rsa_key );
582
583#if defined(POLARSSL_PKCS11_C)
584/**
585 * \brief          Set own certificate and PKCS#11 private key
586 *
587 * \param ssl      SSL context
588 * \param own_cert own public certificate
589 * \param pkcs11_key    own PKCS#11 RSA key
590 */
591void ssl_set_own_cert_pkcs11( ssl_context *ssl, x509_cert *own_cert,
592                       pkcs11_context *pkcs11_key );
593#endif
594
595/**
596 * \brief          Set the Diffie-Hellman public P and G values,
597 *                 read as hexadecimal strings (server-side only)
598 *
599 * \param ssl      SSL context
600 * \param dhm_P    Diffie-Hellman-Merkle modulus
601 * \param dhm_G    Diffie-Hellman-Merkle generator
602 *
603 * \return         0 if successful
604 */
605int ssl_set_dh_param( ssl_context *ssl, const char *dhm_P, const char *dhm_G );
606
607/**
608 * \brief          Set the Diffie-Hellman public P and G values,
609 *                 read from existing context (server-side only)
610 *
611 * \param ssl      SSL context
612 * \param dhm_ctx  Diffie-Hellman-Merkle context
613 *
614 * \return         0 if successful
615 */
616int ssl_set_dh_param_ctx( ssl_context *ssl, dhm_context *dhm_ctx );
617
618/**
619 * \brief          Set hostname for ServerName TLS Extension
620 *                 
621 *
622 * \param ssl      SSL context
623 * \param hostname the server hostname
624 *
625 * \return         0 if successful or POLARSSL_ERR_SSL_MALLOC_FAILED
626 */
627int ssl_set_hostname( ssl_context *ssl, const char *hostname );
628
629/**
630 * \brief          Set the maximum supported version sent from the client side
631 *
632 * \param ssl      SSL context
633 * \param major    Major version number (only SSL_MAJOR_VERSION_3 supported)
634 * \param minor    Minor version number (SSL_MINOR_VERSION_0,
635 *                 SSL_MINOR_VERSION_1 and SSL_MINOR_VERSION_2,
636 *                 SSL_MINOR_VERSION_3 supported)
637 */
638void ssl_set_max_version( ssl_context *ssl, int major, int minor );
639
640/**
641 * \brief          Return the number of data bytes available to read
642 *
643 * \param ssl      SSL context
644 *
645 * \return         how many bytes are available in the read buffer
646 */
647size_t ssl_get_bytes_avail( const ssl_context *ssl );
648
649/**
650 * \brief          Return the result of the certificate verification
651 *
652 * \param ssl      SSL context
653 *
654 * \return         0 if successful, or a combination of:
655 *                      BADCERT_EXPIRED
656 *                      BADCERT_REVOKED
657 *                      BADCERT_CN_MISMATCH
658 *                      BADCERT_NOT_TRUSTED
659 */
660int ssl_get_verify_result( const ssl_context *ssl );
661
662/**
663 * \brief          Return the name of the current ciphersuite
664 *
665 * \param ssl      SSL context
666 *
667 * \return         a string containing the ciphersuite name
668 */
669const char *ssl_get_ciphersuite( const ssl_context *ssl );
670
671/**
672 * \brief          Return the current SSL version (SSLv3/TLSv1/etc)
673 *
674 * \param ssl      SSL context
675 *
676 * \return         a string containing the SSL version
677 */
678const char *ssl_get_version( const ssl_context *ssl );
679
680/**
681 * \brief          Perform the SSL handshake
682 *
683 * \param ssl      SSL context
684 *
685 * \return         0 if successful, POLARSSL_ERR_NET_WANT_READ,
686 *                 POLARSSL_ERR_NET_WANT_WRITE, or a specific SSL error code.
687 */
688int ssl_handshake( ssl_context *ssl );
689
690/**
691 * \brief          Read at most 'len' application data bytes
692 *
693 * \param ssl      SSL context
694 * \param buf      buffer that will hold the data
695 * \param len      how many bytes must be read
696 *
697 * \return         This function returns the number of bytes read, 0 for EOF,
698 *                 or a negative error code.
699 */
700int ssl_read( ssl_context *ssl, unsigned char *buf, size_t len );
701
702/**
703 * \brief          Write exactly 'len' application data bytes
704 *
705 * \param ssl      SSL context
706 * \param buf      buffer holding the data
707 * \param len      how many bytes must be written
708 *
709 * \return         This function returns the number of bytes written,
710 *                 or a negative error code.
711 *
712 * \note           When this function returns POLARSSL_ERR_NET_WANT_WRITE,
713 *                 it must be called later with the *same* arguments,
714 *                 until it returns a positive value.
715 */
716int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len );
717
718/**
719 * \brief           Send an alert message
720 *
721 * \param ssl       SSL context
722 * \param level     The alert level of the message
723 *                  (SSL_ALERT_LEVEL_WARNING or SSL_ALERT_LEVEL_FATAL)
724 * \param message   The alert message (SSL_ALERT_MSG_*)
725 *
726 * \return          1 if successful, or a specific SSL error code.
727 */
728int ssl_send_alert_message( ssl_context *ssl,
729                            unsigned char level,
730                            unsigned char message );
731/**
732 * \brief          Notify the peer that the connection is being closed
733 *
734 * \param ssl      SSL context
735 */
736int ssl_close_notify( ssl_context *ssl );
737
738/**
739 * \brief          Free an SSL context
740 *
741 * \param ssl      SSL context
742 */
743void ssl_free( ssl_context *ssl );
744
745/*
746 * Internal functions (do not call directly)
747 */
748int ssl_handshake_client( ssl_context *ssl );
749int ssl_handshake_server( ssl_context *ssl );
750
751int ssl_derive_keys( ssl_context *ssl );
752
753int ssl_read_record( ssl_context *ssl );
754/**
755 * \return         0 if successful, POLARSSL_ERR_SSL_CONN_EOF on EOF or
756 *                 another negative error code.
757 */
758int ssl_fetch_input( ssl_context *ssl, size_t nb_want );
759
760int ssl_write_record( ssl_context *ssl );
761int ssl_flush_output( ssl_context *ssl );
762
763int ssl_parse_certificate( ssl_context *ssl );
764int ssl_write_certificate( ssl_context *ssl );
765
766int ssl_parse_change_cipher_spec( ssl_context *ssl );
767int ssl_write_change_cipher_spec( ssl_context *ssl );
768
769int ssl_parse_finished( ssl_context *ssl );
770int ssl_write_finished( ssl_context *ssl );
771
772void ssl_kickstart_checksum( ssl_context *ssl, int ciphersuite,
773                             unsigned char *input_buf, size_t len );
774
775#ifdef __cplusplus
776}
777#endif
778
779#endif /* ssl.h */
Note: See TracBrowser for help on using the repository browser.

What are you looking for?