| OLD | NEW |
|---|
| (Empty) | |
| 1 /* |
| 2 * This file contains prototypes for the public SSL functions. |
| 3 * |
| 4 * ***** BEGIN LICENSE BLOCK ***** |
| 5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
| 6 * |
| 7 * The contents of this file are subject to the Mozilla Public License Version |
| 8 * 1.1 (the "License"); you may not use this file except in compliance with |
| 9 * the License. You may obtain a copy of the License at |
| 10 * http://www.mozilla.org/MPL/ |
| 11 * |
| 12 * Software distributed under the License is distributed on an "AS IS" basis, |
| 13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License |
| 14 * for the specific language governing rights and limitations under the |
| 15 * License. |
| 16 * |
| 17 * The Original Code is the Netscape security libraries. |
| 18 * |
| 19 * The Initial Developer of the Original Code is |
| 20 * Netscape Communications Corporation. |
| 21 * Portions created by the Initial Developer are Copyright (C) 1994-2000 |
| 22 * the Initial Developer. All Rights Reserved. |
| 23 * |
| 24 * Contributor(s): |
| 25 * |
| 26 * Alternatively, the contents of this file may be used under the terms of |
| 27 * either the GNU General Public License Version 2 or later (the "GPL"), or |
| 28 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), |
| 29 * in which case the provisions of the GPL or the LGPL are applicable instead |
| 30 * of those above. If you wish to allow use of your version of this file only |
| 31 * under the terms of either the GPL or the LGPL, and not to allow others to |
| 32 * use your version of this file under the terms of the MPL, indicate your |
| 33 * decision by deleting the provisions above and replace them with the notice |
| 34 * and other provisions required by the GPL or the LGPL. If you do not delete |
| 35 * the provisions above, a recipient may use your version of this file under |
| 36 * the terms of any one of the MPL, the GPL or the LGPL. |
| 37 * |
| 38 * ***** END LICENSE BLOCK ***** */ |
| 39 /* $Id: ssl.h,v 1.30 2009/11/06 20:11:27 nelson%bolyard.com Exp $ */ |
| 40 |
| 41 #ifndef __ssl_h_ |
| 42 #define __ssl_h_ |
| 43 |
| 44 #include "prtypes.h" |
| 45 #include "prerror.h" |
| 46 #include "prio.h" |
| 47 #include "seccomon.h" |
| 48 #include "cert.h" |
| 49 #include "keyt.h" |
| 50 |
| 51 #include "sslt.h" /* public ssl data types */ |
| 52 |
| 53 #if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) |
| 54 #define SSL_IMPORT extern __declspec(dllimport) |
| 55 #else |
| 56 #define SSL_IMPORT extern |
| 57 #endif |
| 58 |
| 59 SEC_BEGIN_PROTOS |
| 60 |
| 61 /* constant table enumerating all implemented SSL 2 and 3 cipher suites. */ |
| 62 SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; |
| 63 |
| 64 /* number of entries in the above table. */ |
| 65 SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; |
| 66 |
| 67 /* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ |
| 68 #define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00) |
| 69 |
| 70 /* |
| 71 ** Imports fd into SSL, returning a new socket. Copies SSL configuration |
| 72 ** from model. |
| 73 */ |
| 74 SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); |
| 75 |
| 76 /* |
| 77 ** Enable/disable an ssl mode |
| 78 ** |
| 79 ** SSL_SECURITY: |
| 80 ** enable/disable use of SSL security protocol before connect |
| 81 ** |
| 82 ** SSL_SOCKS: |
| 83 ** enable/disable use of socks before connect |
| 84 ** (No longer supported). |
| 85 ** |
| 86 ** SSL_REQUEST_CERTIFICATE: |
| 87 ** require a certificate during secure connect |
| 88 */ |
| 89 /* options */ |
| 90 #define SSL_SECURITY 1 /* (on by default) */ |
| 91 #define SSL_SOCKS 2 /* (off by default) */ |
| 92 #define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ |
| 93 #define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ |
| 94 /* (off by default) */ |
| 95 #define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ |
| 96 /* (off by default) */ |
| 97 #define SSL_ENABLE_SSL2 7 /* enable ssl v2 (on by default) */ |
| 98 #define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ |
| 99 #define SSL_NO_CACHE 9 /* don't use the session cache */ |
| 100 /* (off by default) */ |
| 101 #define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ |
| 102 /* by default) */ |
| 103 #define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ |
| 104 /* (off by default) */ |
| 105 #define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ |
| 106 /* (on by default) */ |
| 107 #define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ |
| 108 #define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ |
| 109 #define SSL_NO_STEP_DOWN 15 /* Disable export cipher suites */ |
| 110 /* if step-down keys are needed. */ |
| 111 /* default: off, generate */ |
| 112 /* step-down keys if needed. */ |
| 113 #define SSL_BYPASS_PKCS11 16 /* use PKCS#11 for pub key only */ |
| 114 #define SSL_NO_LOCKS 17 /* Don't use locks for protection */ |
| 115 #define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ |
| 116 /* extension (off by default) */ |
| 117 #define SSL_ENABLE_DEFLATE 19 /* Enable TLS compression with */ |
| 118 /* DEFLATE (off by default) */ |
| 119 #define SSL_ENABLE_RENEGOTIATION 20 /* Values below (default: never) */ |
| 120 #define SSL_REQUIRE_SAFE_NEGOTIATION 21 /* Peer must use renegotiation */ |
| 121 /* extension in ALL handshakes. */ |
| 122 /* default: off */ |
| 123 /* NOT YET IMPLEMENTED in 3.12.5 */ |
| 124 |
| 125 #ifdef SSL_DEPRECATED_FUNCTION |
| 126 /* Old deprecated function names */ |
| 127 SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on); |
| 128 SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on); |
| 129 #endif |
| 130 |
| 131 /* New function names */ |
| 132 SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on); |
| 133 SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on); |
| 134 SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on); |
| 135 SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on); |
| 136 SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHan
dle); |
| 137 |
| 138 /* |
| 139 ** Control ciphers that SSL uses. If on is non-zero then the named cipher |
| 140 ** is enabled, otherwise it is disabled. |
| 141 ** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). |
| 142 ** EnableCipher records user preferences. |
| 143 ** SetPolicy sets the policy according to the policy module. |
| 144 */ |
| 145 #ifdef SSL_DEPRECATED_FUNCTION |
| 146 /* Old deprecated function names */ |
| 147 SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); |
| 148 SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); |
| 149 #endif |
| 150 |
| 151 /* New function names */ |
| 152 SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool en
abled); |
| 153 SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *e
nabled); |
| 154 SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); |
| 155 SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); |
| 156 SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); |
| 157 SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); |
| 158 |
| 159 /* Values for "policy" argument to SSL_PolicySet */ |
| 160 /* Values returned by SSL_CipherPolicyGet. */ |
| 161 #define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ |
| 162 #define SSL_ALLOWED 1 |
| 163 #define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ |
| 164 |
| 165 /* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ |
| 166 #define SSL_REQUIRE_NEVER ((PRBool)0) |
| 167 #define SSL_REQUIRE_ALWAYS ((PRBool)1) |
| 168 #define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) |
| 169 #define SSL_REQUIRE_NO_ERROR ((PRBool)3) |
| 170 |
| 171 /* Values for "on" with SSL_ENABLE_RENEGOTIATION */ |
| 172 /* Never renegotiate at all. */ |
| 173 #define SSL_RENEGOTIATE_NEVER ((PRBool)0) |
| 174 /* Renegotiate without restriction, whether or not the peer's client hello */ |
| 175 /* bears the renegotiation info extension (like we always did in the past).*/ |
| 176 #define SSL_RENEGOTIATE_UNRESTRICTED ((PRBool)1) |
| 177 /* Only renegotiate if the peer's hello bears the TLS renegotiation_info */ |
| 178 /* extension. Cannot renegotiate in SSL 3.0 sessions. */ |
| 179 #define SSL_RENEGOTIATE_REQUIRES_XTN ((PRBool)2) /* (NOT YET IMPLEMENTED) */ |
| 180 |
| 181 /* |
| 182 ** Reset the handshake state for fd. This will make the complete SSL |
| 183 ** handshake protocol execute from the ground up on the next i/o |
| 184 ** operation. |
| 185 */ |
| 186 SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); |
| 187 |
| 188 /* |
| 189 ** Force the handshake for fd to complete immediately. This blocks until |
| 190 ** the complete SSL handshake protocol is finished. |
| 191 */ |
| 192 SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); |
| 193 |
| 194 /* |
| 195 ** Same as above, but with an I/O timeout. |
| 196 */ |
| 197 SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, |
| 198 PRIntervalTime timeout); |
| 199 |
| 200 /* |
| 201 ** Query security status of socket. *on is set to one if security is |
| 202 ** enabled. *keySize will contain the stream key size used. *issuer will |
| 203 ** contain the RFC1485 verison of the name of the issuer of the |
| 204 ** certificate at the other end of the connection. For a client, this is |
| 205 ** the issuer of the server's certificate; for a server, this is the |
| 206 ** issuer of the client's certificate (if any). Subject is the subject of |
| 207 ** the other end's certificate. The pointers can be zero if the desired |
| 208 ** data is not needed. All strings returned by this function are owned |
| 209 ** by the caller, and need to be freed with PORT_Free. |
| 210 */ |
| 211 SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, |
| 212 int *keySize, int *secretKeySize, |
| 213 char **issuer, char **subject); |
| 214 |
| 215 /* Values for "on" */ |
| 216 #define SSL_SECURITY_STATUS_NOOPT -1 |
| 217 #define SSL_SECURITY_STATUS_OFF 0 |
| 218 #define SSL_SECURITY_STATUS_ON_HIGH 1 |
| 219 #define SSL_SECURITY_STATUS_ON_LOW 2 |
| 220 #define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ |
| 221 |
| 222 /* |
| 223 ** Return the certificate for our SSL peer. If the client calls this |
| 224 ** it will always return the server's certificate. If the server calls |
| 225 ** this, it may return NULL if client authentication is not enabled or |
| 226 ** if the client had no certificate when asked. |
| 227 ** "fd" the socket "file" descriptor |
| 228 */ |
| 229 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); |
| 230 |
| 231 /* |
| 232 ** Authenticate certificate hook. Called when a certificate comes in |
| 233 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the |
| 234 ** certificate. |
| 235 */ |
| 236 typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, |
| 237 PRBool checkSig, |
| 238 PRBool isServer); |
| 239 |
| 240 SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, |
| 241 SSLAuthCertificate f, |
| 242 void *arg); |
| 243 |
| 244 /* An implementation of the certificate authentication hook */ |
| 245 SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, |
| 246 PRBool checkSig, PRBool isServer); |
| 247 |
| 248 /* |
| 249 * Prototype for SSL callback to get client auth data from the application. |
| 250 * arg - application passed argument |
| 251 * caNames - pointer to distinguished names of CAs that the server likes |
| 252 * pRetCert - pointer to pointer to cert, for return of cert |
| 253 * pRetKey - pointer to key pointer, for return of key |
| 254 */ |
| 255 typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg, |
| 256 PRFileDesc *fd, |
| 257 CERTDistNames *caNames, |
| 258 CERTCertificate **pRetCert,/*return */ |
| 259 SECKEYPrivateKey **pRetKey);/* return */ |
| 260 |
| 261 /* |
| 262 * Set the client side callback for SSL to retrieve user's private key |
| 263 * and certificate. |
| 264 * fd - the file descriptor for the connection in question |
| 265 * f - the application's callback that delivers the key and cert |
| 266 * a - application specific data |
| 267 */ |
| 268 SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, |
| 269 SSLGetClientAuthData f, void *a); |
| 270 |
| 271 |
| 272 /* |
| 273 * Set the client side argument for SSL to retrieve PKCS #11 pin. |
| 274 * fd - the file descriptor for the connection in question |
| 275 * a - pkcs11 application specific data |
| 276 */ |
| 277 SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); |
| 278 |
| 279 /* |
| 280 ** This is a callback for dealing with server certs that are not authenticated |
| 281 ** by the client. The client app can decide that it actually likes the |
| 282 ** cert by some external means and restart the connection. |
| 283 */ |
| 284 typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); |
| 285 SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, |
| 286 void *arg); |
| 287 |
| 288 /* |
| 289 ** Configure ssl for running a secure server. Needs the |
| 290 ** certificate for the server and the servers private key. The arguments |
| 291 ** are copied. |
| 292 */ |
| 293 SSL_IMPORT SECStatus SSL_ConfigSecureServer( |
| 294 PRFileDesc *fd, CERTCertificate *cert, |
| 295 SECKEYPrivateKey *key, SSLKEAType kea); |
| 296 |
| 297 /* |
| 298 ** Configure a secure servers session-id cache. Define the maximum number |
| 299 ** of entries in the cache, the longevity of the entires, and the directory |
| 300 ** where the cache files will be placed. These values can be zero, and |
| 301 ** if so, the implementation will choose defaults. |
| 302 ** This version of the function is for use in applications that have only one |
| 303 ** process that uses the cache (even if that process has multiple threads). |
| 304 */ |
| 305 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, |
| 306 PRUint32 timeout, |
| 307 PRUint32 ssl3_timeout, |
| 308 const char * directory); |
| 309 /* |
| 310 ** Like SSL_ConfigServerSessionIDCache, with one important difference. |
| 311 ** If the application will run multiple processes (as opposed to, or in |
| 312 ** addition to multiple threads), then it must call this function, instead |
| 313 ** of calling SSL_ConfigServerSessionIDCache(). |
| 314 ** This has nothing to do with the number of processORs, only processEs. |
| 315 ** This function sets up a Server Session ID (SID) cache that is safe for |
| 316 ** access by multiple processes on the same system. |
| 317 */ |
| 318 SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, |
| 319 PRUint32 timeout, |
| 320 PRUint32 ssl3_timeout, |
| 321 const char * directory); |
| 322 |
| 323 /* Get and set the configured maximum number of mutexes used for the |
| 324 ** server's store of SSL sessions. This value is used by the server |
| 325 ** session ID cache initialization functions shown above. Note that on |
| 326 ** some platforms, these mutexes are actually implemented with POSIX |
| 327 ** semaphores, or with unnamed pipes. The default value varies by platform. |
| 328 ** An attempt to set a too-low maximum will return an error and the |
| 329 ** configured value will not be changed. |
| 330 */ |
| 331 SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); |
| 332 SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); |
| 333 |
| 334 /* environment variable set by SSL_ConfigMPServerSIDCache, and queried by |
| 335 * SSL_InheritMPServerSIDCache when envString is NULL. |
| 336 */ |
| 337 #define SSL_ENV_VAR_NAME "SSL_INHERITANCE" |
| 338 |
| 339 /* called in child to inherit SID Cache variables. |
| 340 * If envString is NULL, this function will use the value of the environment |
| 341 * variable "SSL_INHERITANCE", otherwise the string value passed in will be |
| 342 * used. |
| 343 */ |
| 344 SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString); |
| 345 |
| 346 /* |
| 347 ** Set the callback on a particular socket that gets called when we finish |
| 348 ** performing a handshake. |
| 349 */ |
| 350 typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, |
| 351 void *client_data); |
| 352 SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, |
| 353 SSLHandshakeCallback cb, void *client_data); |
| 354 |
| 355 /* |
| 356 ** For the server, request a new handshake. For the client, begin a new |
| 357 ** handshake. If flushCache is non-zero, the SSL3 cache entry will be |
| 358 ** flushed first, ensuring that a full SSL handshake will be done. |
| 359 ** If flushCache is zero, and an SSL connection is established, it will |
| 360 ** do the much faster session restart handshake. This will change the |
| 361 ** session keys without doing another private key operation. |
| 362 */ |
| 363 SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); |
| 364 |
| 365 /* |
| 366 ** Same as above, but with an I/O timeout. |
| 367 */ |
| 368 SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, |
| 369 PRBool flushCache, |
| 370 PRIntervalTime timeout); |
| 371 |
| 372 |
| 373 #ifdef SSL_DEPRECATED_FUNCTION |
| 374 /* deprecated! |
| 375 ** For the server, request a new handshake. For the client, begin a new |
| 376 ** handshake. Flushes SSL3 session cache entry first, ensuring that a |
| 377 ** full handshake will be done. |
| 378 ** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) |
| 379 */ |
| 380 SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); |
| 381 #endif |
| 382 |
| 383 /* |
| 384 * Allow the application to pass a URL or hostname into the SSL library |
| 385 */ |
| 386 SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); |
| 387 |
| 388 /* |
| 389 ** Return the number of bytes that SSL has waiting in internal buffers. |
| 390 ** Return 0 if security is not enabled. |
| 391 */ |
| 392 SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); |
| 393 |
| 394 /* |
| 395 ** Invalidate the SSL session associated with fd. |
| 396 */ |
| 397 SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); |
| 398 |
| 399 /* |
| 400 ** Return a SECItem containing the SSL session ID associated with the fd. |
| 401 */ |
| 402 SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); |
| 403 |
| 404 /* |
| 405 ** Clear out the client's SSL session cache, not the server's session cache. |
| 406 */ |
| 407 SSL_IMPORT void SSL_ClearSessionCache(void); |
| 408 |
| 409 /* |
| 410 ** Close the server's SSL session cache. |
| 411 */ |
| 412 SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); |
| 413 |
| 414 /* |
| 415 ** Set peer information so we can correctly look up SSL session later. |
| 416 ** You only have to do this if you're tunneling through a proxy. |
| 417 */ |
| 418 SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, char *peerID); |
| 419 |
| 420 /* |
| 421 ** Reveal the security information for the peer. |
| 422 */ |
| 423 SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket); |
| 424 SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket); |
| 425 SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket); |
| 426 |
| 427 |
| 428 /* This callback may be passed to the SSL library via a call to |
| 429 * SSL_GetClientAuthDataHook() for each SSL client socket. |
| 430 * It will be invoked when SSL needs to know what certificate and private key |
| 431 * (if any) to use to respond to a request for client authentication. |
| 432 * If arg is non-NULL, it is a pointer to a NULL-terminated string containing |
| 433 * the nickname of the cert/key pair to use. |
| 434 * If arg is NULL, this function will search the cert and key databases for |
| 435 * a suitable match and send it if one is found. |
| 436 */ |
| 437 SSL_IMPORT SECStatus |
| 438 NSS_GetClientAuthData(void * arg, |
| 439 PRFileDesc * socket, |
| 440 struct CERTDistNamesStr * caNames, |
| 441 struct CERTCertificateStr ** pRetCert, |
| 442 struct SECKEYPrivateKeyStr **pRetKey); |
| 443 |
| 444 /* |
| 445 * Look to see if any of the signers in the cert chain for "cert" are found |
| 446 * in the list of caNames. |
| 447 * Returns SECSuccess if so, SECFailure if not. |
| 448 * Used by NSS_GetClientAuthData. May be used by other callback functions. |
| 449 */ |
| 450 SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, |
| 451 CERTDistNames *caNames); |
| 452 |
| 453 /* |
| 454 * Returns key exchange type of the keys in an SSL server certificate. |
| 455 */ |
| 456 SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert); |
| 457 |
| 458 /* Set cipher policies to a predefined Domestic (U.S.A.) policy. |
| 459 * This essentially enables all supported ciphers. |
| 460 */ |
| 461 SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); |
| 462 |
| 463 /* Set cipher policies to a predefined Policy that is exportable from the USA |
| 464 * according to present U.S. policies as we understand them. |
| 465 * See documentation for the list. |
| 466 * Note that your particular application program may be able to obtain |
| 467 * an export license with more or fewer capabilities than those allowed |
| 468 * by this function. In that case, you should use SSL_SetPolicy() |
| 469 * to explicitly allow those ciphers you may legally export. |
| 470 */ |
| 471 SSL_IMPORT SECStatus NSS_SetExportPolicy(void); |
| 472 |
| 473 /* Set cipher policies to a predefined Policy that is exportable from the USA |
| 474 * according to present U.S. policies as we understand them, and that the |
| 475 * nation of France will permit to be imported into their country. |
| 476 * See documentation for the list. |
| 477 */ |
| 478 SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); |
| 479 |
| 480 SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void); |
| 481 |
| 482 /* Report more information than SSL_SecurityStatus. |
| 483 ** Caller supplies the info struct. Function fills it in. |
| 484 */ |
| 485 SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, |
| 486 PRUintn len); |
| 487 SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, |
| 488 SSLCipherSuiteInfo *info, PRUintn len); |
| 489 |
| 490 /* |
| 491 ** Return a new reference to the certificate that was most recently sent |
| 492 ** to the peer on this SSL/TLS connection, or NULL if none has been sent. |
| 493 */ |
| 494 SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd); |
| 495 |
| 496 /* Test an SSL configuration to see if SSL_BYPASS_PKCS11 can be turned on. |
| 497 ** Check the key exchange algorithm for each cipher in the list to see if |
| 498 ** a master secret key can be extracted after being derived with the mechanism |
| 499 ** required by the protocolmask argument. If the KEA will use keys from the |
| 500 ** specified cert make sure the extract operation is attempted from the slot |
| 501 ** where the private key resides. |
| 502 ** If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and |
| 503 ** SECSuccess is returned. In all other cases but one (*pcanbypass) is |
| 504 ** set to FALSE and SECFailure is returned. |
| 505 ** In that last case Derive() has been called successfully but the MS is null, |
| 506 ** CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the |
| 507 ** arguments were all valid but the slot cannot be bypassed. |
| 508 ** |
| 509 ** Note: A TRUE return code from CanBypass means "Your configuration will perfor
m |
| 510 ** NO WORSE with the bypass enabled than without"; it does NOT mean that every |
| 511 ** cipher suite listed will work properly with the selected protocols. |
| 512 ** |
| 513 ** Caveat: If export cipher suites are included in the argument list Canbypass |
| 514 ** will return FALSE. |
| 515 **/ |
| 516 |
| 517 /* protocol mask bits */ |
| 518 #define SSL_CBP_SSL3 0x0001 /* test SSL v3 mechanisms */ |
| 519 #define SSL_CBP_TLS1_0 0x0002 /* test TLS v1.0 mechanisms */ |
| 520 |
| 521 SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, |
| 522 SECKEYPrivateKey *privKey, |
| 523 PRUint32 protocolmask, |
| 524 PRUint16 *ciphers, int nciphers, |
| 525 PRBool *pcanbypass, void *pwArg); |
| 526 |
| 527 SEC_END_PROTOS |
| 528 |
| 529 #endif /* __ssl_h_ */ |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 394003:
Linux: enable building with a local version of libssl. (Closed)
