OLD | NEW |
| (Empty) |
1 /* | |
2 * This file contains prototypes for the public SSL functions. | |
3 * | |
4 * This Source Code Form is subject to the terms of the Mozilla Public | |
5 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
7 | |
8 #ifndef __ssl_h_ | |
9 #define __ssl_h_ | |
10 | |
11 #include "prtypes.h" | |
12 #include "prerror.h" | |
13 #include "prio.h" | |
14 #include "seccomon.h" | |
15 #include "cert.h" | |
16 #include "keyt.h" | |
17 | |
18 #include "sslt.h" /* public ssl data types */ | |
19 | |
20 #if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) | |
21 #define SSL_IMPORT extern __declspec(dllimport) | |
22 #else | |
23 #define SSL_IMPORT extern | |
24 #endif | |
25 | |
26 SEC_BEGIN_PROTOS | |
27 | |
28 /* constant table enumerating all implemented SSL 2 and 3 cipher suites. */ | |
29 SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; | |
30 | |
31 /* the same as the above, but is a function */ | |
32 SSL_IMPORT const PRUint16 *SSL_GetImplementedCiphers(void); | |
33 | |
34 /* number of entries in the above table. */ | |
35 SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; | |
36 | |
37 /* the same as the above, but is a function */ | |
38 SSL_IMPORT PRUint16 SSL_GetNumImplementedCiphers(void); | |
39 | |
40 /* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ | |
41 #define SSL_IS_SSL2_CIPHER(which) (((which)&0xfff0) == 0xff00) | |
42 | |
43 /* | |
44 ** Imports fd into SSL, returning a new socket. Copies SSL configuration | |
45 ** from model. | |
46 */ | |
47 SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); | |
48 | |
49 /* | |
50 ** Imports fd into DTLS, returning a new socket. Copies DTLS configuration | |
51 ** from model. | |
52 */ | |
53 SSL_IMPORT PRFileDesc *DTLS_ImportFD(PRFileDesc *model, PRFileDesc *fd); | |
54 | |
55 /* | |
56 ** Enable/disable an ssl mode | |
57 ** | |
58 ** SSL_SECURITY: | |
59 ** enable/disable use of SSL security protocol before connect | |
60 ** | |
61 ** SSL_SOCKS: | |
62 ** enable/disable use of socks before connect | |
63 ** (No longer supported). | |
64 ** | |
65 ** SSL_REQUEST_CERTIFICATE: | |
66 ** require a certificate during secure connect | |
67 */ | |
68 /* options */ | |
69 #define SSL_SECURITY 1 /* (on by default) */ | |
70 #define SSL_SOCKS 2 /* (off by default) */ | |
71 #define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ | |
72 #define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ | |
73 /* (off by default) */ | |
74 #define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ | |
75 /* (off by default) */ | |
76 | |
77 /* OBSOLETE: SSL v2 is obsolete and may be removed soon. */ | |
78 #define SSL_ENABLE_SSL2 7 /* enable ssl v2 (off by default) */ | |
79 | |
80 /* OBSOLETE: See "SSL Version Range API" below for the replacement and a | |
81 ** description of the non-obvious semantics of using SSL_ENABLE_SSL3. | |
82 */ | |
83 #define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ | |
84 | |
85 #define SSL_NO_CACHE 9 /* don't use the session cache */ | |
86 /* (off by default) */ | |
87 #define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ | |
88 /* by default) */ | |
89 #define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ | |
90 /* (off by default) */ | |
91 | |
92 /* OBSOLETE: SSL v2 compatible hellos are not accepted by some TLS servers | |
93 ** and cannot negotiate extensions. SSL v2 is obsolete. This option may be | |
94 ** removed soon. | |
95 */ | |
96 #define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ | |
97 /* (off by default) */ | |
98 | |
99 /* OBSOLETE: See "SSL Version Range API" below for the replacement and a | |
100 ** description of the non-obvious semantics of using SSL_ENABLE_TLS. | |
101 */ | |
102 #define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ | |
103 | |
104 #define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ | |
105 #define SSL_NO_STEP_DOWN 15 /* Disable export cipher suites */ | |
106 /* if step-down keys are needed. */ | |
107 /* default: off, generate */ | |
108 /* step-down keys if needed. */ | |
109 #define SSL_BYPASS_PKCS11 16 /* use PKCS#11 for pub key only */ | |
110 #define SSL_NO_LOCKS 17 /* Don't use locks for protection */ | |
111 #define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ | |
112 /* extension (off by default) */ | |
113 #define SSL_ENABLE_DEFLATE 19 /* Enable TLS compression with */ | |
114 /* DEFLATE (off by default) */ | |
115 #define SSL_ENABLE_RENEGOTIATION 20 /* Values below (default: never) */ | |
116 #define SSL_REQUIRE_SAFE_NEGOTIATION 21 /* Peer must send Signaling */ | |
117 /* Cipher Suite Value (SCSV) or */ | |
118 /* Renegotiation Info (RI) */ | |
119 /* extension in ALL handshakes. */ | |
120 /* default: off */ | |
121 #define SSL_ENABLE_FALSE_START 22 /* Enable SSL false start (off by */ | |
122 /* default, applies only to */ | |
123 /* clients). False start is a */ | |
124 /* mode where an SSL client will start sending application data before | |
125 * verifying the server's Finished message. This means that we could end up | |
126 * sending data to an imposter. However, the data will be encrypted and | |
127 * only the true server can derive the session key. Thus, so long as the | |
128 * cipher isn't broken this is safe. The advantage of false start is that | |
129 * it saves a round trip for client-speaks-first protocols when performing a | |
130 * full handshake. | |
131 * | |
132 * In addition to enabling this option, the application must register a | |
133 * callback using the SSL_SetCanFalseStartCallback function. | |
134 */ | |
135 | |
136 /* For SSL 3.0 and TLS 1.0, by default we prevent chosen plaintext attacks | |
137 * on SSL CBC mode cipher suites (see RFC 4346 Section F.3) by splitting | |
138 * non-empty application_data records into two records; the first record has | |
139 * only the first byte of plaintext, and the second has the rest. | |
140 * | |
141 * This only prevents the attack in the sending direction; the connection may | |
142 * still be vulnerable to such attacks if the peer does not implement a similar | |
143 * countermeasure. | |
144 * | |
145 * This protection mechanism is on by default; the default can be overridden by | |
146 * setting NSS_SSL_CBC_RANDOM_IV=0 in the environment prior to execution, | |
147 * and/or by the application setting the option SSL_CBC_RANDOM_IV to PR_FALSE. | |
148 * | |
149 * The per-record IV in TLS 1.1 and later adds one block of overhead per | |
150 * record, whereas this hack will add at least two blocks of overhead per | |
151 * record, so TLS 1.1+ will always be more efficient. | |
152 * | |
153 * Other implementations (e.g. some versions of OpenSSL, in some | |
154 * configurations) prevent the same attack by prepending an empty | |
155 * application_data record to every application_data record they send; we do | |
156 * not do that because some implementations cannot handle empty | |
157 * application_data records. Also, we only split application_data records and | |
158 * not other types of records, because some implementations will not accept | |
159 * fragmented records of some other types (e.g. some versions of NSS do not | |
160 * accept fragmented alerts). | |
161 */ | |
162 #define SSL_CBC_RANDOM_IV 23 | |
163 #define SSL_ENABLE_OCSP_STAPLING 24 /* Request OCSP stapling (client) */ | |
164 | |
165 /* SSL_ENABLE_NPN controls whether the NPN extension is enabled for the initial | |
166 * handshake when application layer protocol negotiation is used. | |
167 * SSL_SetNextProtoCallback or SSL_SetNextProtoNego must be used to control the | |
168 * application layer protocol negotiation; otherwise, the NPN extension will | |
169 * not be negotiated. SSL_ENABLE_NPN is currently enabled by default but this | |
170 * may change in future versions. | |
171 */ | |
172 #define SSL_ENABLE_NPN 25 | |
173 | |
174 /* SSL_ENABLE_ALPN controls whether the ALPN extension is enabled for the | |
175 * initial handshake when application layer protocol negotiation is used. | |
176 * SSL_SetNextProtoNego (not SSL_SetNextProtoCallback) must be used to control | |
177 * the application layer protocol negotiation; otherwise, the ALPN extension | |
178 * will not be negotiated. ALPN is not negotiated for renegotiation handshakes, | |
179 * even though the ALPN specification defines a way to use ALPN during | |
180 * renegotiations. SSL_ENABLE_ALPN is currently disabled by default, but this | |
181 * may change in future versions. | |
182 */ | |
183 #define SSL_ENABLE_ALPN 26 | |
184 | |
185 /* SSL_REUSE_SERVER_ECDHE_KEY controls whether the ECDHE server key is | |
186 * reused for multiple handshakes or generated each time. | |
187 * SSL_REUSE_SERVER_ECDHE_KEY is currently enabled by default. | |
188 * This socket option is for ECDHE, only. It is unrelated to DHE. | |
189 */ | |
190 #define SSL_REUSE_SERVER_ECDHE_KEY 27 | |
191 | |
192 #define SSL_ENABLE_FALLBACK_SCSV 28 /* Send fallback SCSV in \ | |
193 * handshakes. */ | |
194 | |
195 /* SSL_ENABLE_SERVER_DHE controls whether DHE is enabled for the server socket. | |
196 */ | |
197 #define SSL_ENABLE_SERVER_DHE 29 | |
198 | |
199 /* Use draft-ietf-tls-session-hash. Controls whether we offer the | |
200 * extended_master_secret extension which, when accepted, hashes | |
201 * the handshake transcript into the master secret. This option is | |
202 * disabled by default. | |
203 */ | |
204 #define SSL_ENABLE_EXTENDED_MASTER_SECRET 30 | |
205 | |
206 /* Request Signed Certificate Timestamps via TLS extension (client) */ | |
207 #define SSL_ENABLE_SIGNED_CERT_TIMESTAMPS 31 | |
208 | |
209 #ifdef SSL_DEPRECATED_FUNCTION | |
210 /* Old deprecated function names */ | |
211 SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on); | |
212 SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on); | |
213 #endif | |
214 | |
215 /* New function names */ | |
216 SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on); | |
217 SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on); | |
218 SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on); | |
219 SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on); | |
220 SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHan
dle); | |
221 | |
222 /* SSLNextProtoCallback is called during the handshake for the client, when a | |
223 * Next Protocol Negotiation (NPN) extension has been received from the server. | |
224 * |protos| and |protosLen| define a buffer which contains the server's | |
225 * advertisement. This data is guaranteed to be well formed per the NPN spec. | |
226 * |protoOut| is a buffer provided by the caller, of length 255 (the maximum | |
227 * allowed by the protocol). On successful return, the protocol to be announced | |
228 * to the server will be in |protoOut| and its length in |*protoOutLen|. | |
229 * | |
230 * The callback must return SECFailure or SECSuccess (not SECWouldBlock). | |
231 */ | |
232 typedef SECStatus(PR_CALLBACK *SSLNextProtoCallback)( | |
233 void *arg, | |
234 PRFileDesc *fd, | |
235 const unsigned char *protos, | |
236 unsigned int protosLen, | |
237 unsigned char *protoOut, | |
238 unsigned int *protoOutLen, | |
239 unsigned int protoMaxOut); | |
240 | |
241 /* SSL_SetNextProtoCallback sets a callback function to handle Next Protocol | |
242 * Negotiation. It causes a client to advertise NPN. */ | |
243 SSL_IMPORT SECStatus SSL_SetNextProtoCallback(PRFileDesc *fd, | |
244 SSLNextProtoCallback callback, | |
245 void *arg); | |
246 | |
247 /* SSL_SetNextProtoNego can be used as an alternative to | |
248 * SSL_SetNextProtoCallback. It also causes a client to advertise NPN and | |
249 * installs a default callback function which selects the first supported | |
250 * protocol in server-preference order. If no matching protocol is found it | |
251 * selects the first supported protocol. | |
252 * | |
253 * Using this function also allows the client to transparently support ALPN. | |
254 * The same set of protocols will be advertised via ALPN and, if the server | |
255 * uses ALPN to select a protocol, SSL_GetNextProto will return | |
256 * SSL_NEXT_PROTO_SELECTED as the state. | |
257 * | |
258 * Since NPN uses the first protocol as the fallback protocol, when sending an | |
259 * ALPN extension, the first protocol is moved to the end of the list. This | |
260 * indicates that the fallback protocol is the least preferred. The other | |
261 * protocols should be in preference order. | |
262 * | |
263 * The supported protocols are specified in |data| in wire-format (8-bit | |
264 * length-prefixed). For example: "\010http/1.1\006spdy/2". */ | |
265 SSL_IMPORT SECStatus SSL_SetNextProtoNego(PRFileDesc *fd, | |
266 const unsigned char *data, | |
267 unsigned int length); | |
268 | |
269 typedef enum SSLNextProtoState { | |
270 SSL_NEXT_PROTO_NO_SUPPORT = 0, /* No peer support */ | |
271 SSL_NEXT_PROTO_NEGOTIATED = 1, /* Mutual agreement */ | |
272 SSL_NEXT_PROTO_NO_OVERLAP = 2, /* No protocol overlap found */ | |
273 SSL_NEXT_PROTO_SELECTED = 3 /* Server selected proto (ALPN) */ | |
274 } SSLNextProtoState; | |
275 | |
276 /* SSL_GetNextProto can be used in the HandshakeCallback or any time after | |
277 * a handshake to retrieve the result of the Next Protocol negotiation. | |
278 * | |
279 * The length of the negotiated protocol, if any, is written into *bufLen. | |
280 * If the negotiated protocol is longer than bufLenMax, then SECFailure is | |
281 * returned. Otherwise, the negotiated protocol, if any, is written into buf, | |
282 * and SECSuccess is returned. */ | |
283 SSL_IMPORT SECStatus SSL_GetNextProto(PRFileDesc *fd, | |
284 SSLNextProtoState *state, | |
285 unsigned char *buf, | |
286 unsigned int *bufLen, | |
287 unsigned int bufLenMax); | |
288 | |
289 /* | |
290 ** Control ciphers that SSL uses. If on is non-zero then the named cipher | |
291 ** is enabled, otherwise it is disabled. | |
292 ** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). | |
293 ** EnableCipher records user preferences. | |
294 ** SetPolicy sets the policy according to the policy module. | |
295 */ | |
296 #ifdef SSL_DEPRECATED_FUNCTION | |
297 /* Old deprecated function names */ | |
298 SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); | |
299 SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); | |
300 #endif | |
301 | |
302 /* New function names */ | |
303 SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool en
abled); | |
304 SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *e
nabled); | |
305 SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); | |
306 SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); | |
307 SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); | |
308 SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); | |
309 | |
310 /* | |
311 ** Control for TLS signature algorithms for TLS 1.2 only. | |
312 ** | |
313 ** This governs what signature algorithms are sent by a client in the | |
314 ** signature_algorithms extension. A client will not accept a signature from a | |
315 ** server unless it uses an enabled algorithm. | |
316 ** | |
317 ** This also governs what the server sends in the supported_signature_algorithms | |
318 ** field of a CertificateRequest. It also changes what the server uses to sign | |
319 ** ServerKeyExchange: a server uses the first entry from this list that is | |
320 ** compatible with the client's advertised signature_algorithms extension and | |
321 ** the selected server certificate. | |
322 ** | |
323 ** Omitting SHA-256 from this list might be foolish. Support is mandatory in | |
324 ** TLS 1.2 and there might be interoperability issues. For a server, NSS only | |
325 ** supports SHA-256 for verifying a TLS 1.2 CertificateVerify. This list needs | |
326 ** to include SHA-256 if client authentication is requested or required, or | |
327 ** creating a CertificateRequest will fail. | |
328 */ | |
329 SSL_IMPORT SECStatus SSL_SignaturePrefSet( | |
330 PRFileDesc *fd, const SSLSignatureAndHashAlg *algorithms, | |
331 unsigned int count); | |
332 | |
333 /* | |
334 ** Get the currently configured signature algorithms. | |
335 ** | |
336 ** The algorithms are written to |algorithms| but not if there are more than | |
337 ** |maxCount| values configured. The number of algorithms that are in use are | |
338 ** written to |count|. This fails if |maxCount| is insufficiently large. | |
339 */ | |
340 SSL_IMPORT SECStatus SSL_SignaturePrefGet( | |
341 PRFileDesc *fd, SSLSignatureAndHashAlg *algorithms, unsigned int *count, | |
342 unsigned int maxCount); | |
343 | |
344 /* | |
345 ** Returns the maximum number of signature algorithms that are supported and | |
346 ** can be set or retrieved using SSL_SignaturePrefSet or SSL_SignaturePrefGet. | |
347 */ | |
348 SSL_IMPORT unsigned int SSL_SignatureMaxCount(); | |
349 | |
350 /* SSL_DHEGroupPrefSet is used to configure the set of allowed/enabled DHE group | |
351 ** parameters that can be used by NSS for the given server socket. | |
352 ** The first item in the array is used as the default group, if no other | |
353 ** selection criteria can be used by NSS. | |
354 ** The set is provided as an array of identifiers as defined by SSLDHEGroupType. | |
355 ** If more than one group identifier is provided, NSS will select the one to use
. | |
356 ** For example, a TLS extension sent by the client might indicate a preference. | |
357 */ | |
358 SSL_IMPORT SECStatus SSL_DHEGroupPrefSet(PRFileDesc *fd, | |
359 SSLDHEGroupType *groups, | |
360 PRUint16 num_groups); | |
361 | |
362 /* Enable the use of a DHE group that's smaller than the library default, | |
363 ** for backwards compatibility reasons. The DH parameters will be created | |
364 ** at the time this function is called, which might take a very long time. | |
365 ** The function will block until generation is completed. | |
366 ** The intention is to enforce that fresh and safe parameters are generated | |
367 ** each time a process is started. | |
368 ** At the time this API was initially implemented, the API will enable the | |
369 ** use of 1024 bit DHE parameters. This value might get increased in future | |
370 ** versions of NSS. | |
371 ** | |
372 ** It is allowed to call this API will a NULL value for parameter fd, | |
373 ** which will prepare the global parameters that NSS will reuse for the remainde
r | |
374 ** of the process lifetime. This can be used early after startup of a process, | |
375 ** to avoid a delay when handling incoming client connections. | |
376 ** This preparation with a NULL for parameter fd will NOT enable the weak group | |
377 ** on sockets. The function needs to be called again for every socket that | |
378 ** should use the weak group. | |
379 ** | |
380 ** It is allowed to use this API in combination with the SSL_DHEGroupPrefSet API
. | |
381 ** If both APIs have been called, the weakest group will be used, | |
382 ** unless it is certain that the client supports larger group parameters. | |
383 ** The weak group will be used as the default group, overriding the preference | |
384 ** for the first group potentially set with a call to SSL_DHEGroupPrefSet | |
385 ** (The first group set using SSL_DHEGroupPrefSet will still be enabled, but | |
386 ** it's no longer the default group.) | |
387 */ | |
388 SSL_IMPORT SECStatus SSL_EnableWeakDHEPrimeGroup(PRFileDesc *fd, PRBool enabled)
; | |
389 | |
390 /* SSL_CipherOrderSet sets the cipher suite preference order from |ciphers|, | |
391 * which must be an array of cipher suite ids of length |len|. All the given | |
392 * cipher suite ids must appear in the array that is returned by | |
393 * |SSL_GetImplementedCiphers| and may only appear once, at most. */ | |
394 SSL_IMPORT SECStatus SSL_CipherOrderSet(PRFileDesc *fd, const PRUint16 *ciphers, | |
395 unsigned int len); | |
396 | |
397 /* SSLChannelBindingType enumerates the types of supported channel binding | |
398 * values. See RFC 5929. */ | |
399 typedef enum SSLChannelBindingType { | |
400 SSL_CHANNEL_BINDING_TLS_UNIQUE = 1, | |
401 } SSLChannelBindingType; | |
402 | |
403 /* SSL_GetChannelBinding copies the requested channel binding value, as defined | |
404 * in RFC 5929, into |out|. The full length of the binding value is written | |
405 * into |*outLen|. | |
406 * | |
407 * At most |outLenMax| bytes of data are copied. If |outLenMax| is | |
408 * insufficient then the function returns SECFailure and sets the error to | |
409 * SEC_ERROR_OUTPUT_LEN, but |*outLen| is still set. | |
410 * | |
411 * This call will fail if made during a renegotiation. */ | |
412 SSL_IMPORT SECStatus SSL_GetChannelBinding(PRFileDesc *fd, | |
413 SSLChannelBindingType binding_type, | |
414 unsigned char *out, | |
415 unsigned int *outLen, | |
416 unsigned int outLenMax); | |
417 | |
418 /* SSL Version Range API | |
419 ** | |
420 ** This API should be used to control SSL 3.0 & TLS support instead of the | |
421 ** older SSL_Option* API; however, the SSL_Option* API MUST still be used to | |
422 ** control SSL 2.0 support. In this version of libssl, SSL 3.0 and TLS 1.0 are | |
423 ** enabled by default. Future versions of libssl may change which versions of | |
424 ** the protocol are enabled by default. | |
425 ** | |
426 ** The SSLProtocolVariant enum indicates whether the protocol is of type | |
427 ** stream or datagram. This must be provided to the functions that do not | |
428 ** take an fd. Functions which take an fd will get the variant from the fd, | |
429 ** which is typed. | |
430 ** | |
431 ** Using the new version range API in conjunction with the older | |
432 ** SSL_OptionSet-based API for controlling the enabled protocol versions may | |
433 ** cause unexpected results. Going forward, we guarantee only the following: | |
434 ** | |
435 ** SSL_OptionGet(SSL_ENABLE_TLS) will return PR_TRUE if *ANY* versions of TLS | |
436 ** are enabled. | |
437 ** | |
438 ** SSL_OptionSet(SSL_ENABLE_TLS, PR_FALSE) will disable *ALL* versions of TLS, | |
439 ** including TLS 1.0 and later. | |
440 ** | |
441 ** The above two properties provide compatibility for applications that use | |
442 ** SSL_OptionSet to implement the insecure fallback from TLS 1.x to SSL 3.0. | |
443 ** | |
444 ** SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) will enable TLS 1.0, and may also | |
445 ** enable some later versions of TLS, if it is necessary to do so in order to | |
446 ** keep the set of enabled versions contiguous. For example, if TLS 1.2 is | |
447 ** enabled, then after SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE), TLS 1.0, | |
448 ** TLS 1.1, and TLS 1.2 will be enabled, and the call will have no effect on | |
449 ** whether SSL 3.0 is enabled. If no later versions of TLS are enabled at the | |
450 ** time SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) is called, then no later | |
451 ** versions of TLS will be enabled by the call. | |
452 ** | |
453 ** SSL_OptionSet(SSL_ENABLE_SSL3, PR_FALSE) will disable SSL 3.0, and will not | |
454 ** change the set of TLS versions that are enabled. | |
455 ** | |
456 ** SSL_OptionSet(SSL_ENABLE_SSL3, PR_TRUE) will enable SSL 3.0, and may also | |
457 ** enable some versions of TLS if TLS 1.1 or later is enabled at the time of | |
458 ** the call, the same way SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) works, in | |
459 ** order to keep the set of enabled versions contiguous. | |
460 */ | |
461 | |
462 /* Returns, in |*vrange|, the range of SSL3/TLS versions supported for the | |
463 ** given protocol variant by the version of libssl linked-to at runtime. | |
464 */ | |
465 SSL_IMPORT SECStatus SSL_VersionRangeGetSupported( | |
466 SSLProtocolVariant protocolVariant, SSLVersionRange *vrange); | |
467 | |
468 /* Returns, in |*vrange|, the range of SSL3/TLS versions enabled by default | |
469 ** for the given protocol variant. | |
470 */ | |
471 SSL_IMPORT SECStatus SSL_VersionRangeGetDefault( | |
472 SSLProtocolVariant protocolVariant, SSLVersionRange *vrange); | |
473 | |
474 /* Sets the range of enabled-by-default SSL3/TLS versions for the given | |
475 ** protocol variant to |*vrange|. | |
476 */ | |
477 SSL_IMPORT SECStatus SSL_VersionRangeSetDefault( | |
478 SSLProtocolVariant protocolVariant, const SSLVersionRange *vrange); | |
479 | |
480 /* Returns, in |*vrange|, the range of enabled SSL3/TLS versions for |fd|. */ | |
481 SSL_IMPORT SECStatus SSL_VersionRangeGet(PRFileDesc *fd, | |
482 SSLVersionRange *vrange); | |
483 | |
484 /* Sets the range of enabled SSL3/TLS versions for |fd| to |*vrange|. */ | |
485 SSL_IMPORT SECStatus SSL_VersionRangeSet(PRFileDesc *fd, | |
486 const SSLVersionRange *vrange); | |
487 | |
488 /* Sets the version to check the server random against for the | |
489 * fallback check defined in [draft-ietf-tls-tls13-11 Section 6.3.1.1]. | |
490 * This function is provided to allow for detection of forced downgrade | |
491 * attacks against client-side reconnect-and-fallback outside of TLS | |
492 * by setting |version| to be that of the original connection, rather | |
493 * than that of the new connection. | |
494 * | |
495 * The default, which can also be enabled by setting |version| to | |
496 * zero, is just to check against the max version in the | |
497 * version range (see SSL_VersionRangeSet). */ | |
498 SSL_IMPORT SECStatus SSL_SetDowngradeCheckVersion(PRFileDesc *fd, | |
499 PRUint16 version); | |
500 | |
501 /* Values for "policy" argument to SSL_CipherPolicySet */ | |
502 /* Values returned by SSL_CipherPolicyGet. */ | |
503 #define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ | |
504 #define SSL_ALLOWED 1 | |
505 #define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ | |
506 | |
507 /* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ | |
508 #define SSL_REQUIRE_NEVER ((PRBool)0) | |
509 #define SSL_REQUIRE_ALWAYS ((PRBool)1) | |
510 #define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) | |
511 #define SSL_REQUIRE_NO_ERROR ((PRBool)3) | |
512 | |
513 /* Values for "on" with SSL_ENABLE_RENEGOTIATION */ | |
514 /* Never renegotiate at all. */ | |
515 #define SSL_RENEGOTIATE_NEVER ((PRBool)0) | |
516 /* Renegotiate without restriction, whether or not the peer's client hello */ | |
517 /* bears the renegotiation info extension. Vulnerable, as in the past. */ | |
518 #define SSL_RENEGOTIATE_UNRESTRICTED ((PRBool)1) | |
519 /* Only renegotiate if the peer's hello bears the TLS renegotiation_info */ | |
520 /* extension. This is safe renegotiation. */ | |
521 #define SSL_RENEGOTIATE_REQUIRES_XTN ((PRBool)2) | |
522 /* Disallow unsafe renegotiation in server sockets only, but allow clients */ | |
523 /* to continue to renegotiate with vulnerable servers. */ | |
524 /* This value should only be used during the transition period when few */ | |
525 /* servers have been upgraded. */ | |
526 #define SSL_RENEGOTIATE_TRANSITIONAL ((PRBool)3) | |
527 | |
528 /* | |
529 ** Reset the handshake state for fd. This will make the complete SSL | |
530 ** handshake protocol execute from the ground up on the next i/o | |
531 ** operation. | |
532 */ | |
533 SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); | |
534 | |
535 /* | |
536 ** Force the handshake for fd to complete immediately. This blocks until | |
537 ** the complete SSL handshake protocol is finished. | |
538 */ | |
539 SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); | |
540 | |
541 /* | |
542 ** Same as above, but with an I/O timeout. | |
543 */ | |
544 SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, | |
545 PRIntervalTime timeout); | |
546 | |
547 SSL_IMPORT SECStatus SSL_RestartHandshakeAfterCertReq(PRFileDesc *fd, | |
548 CERTCertificate *cert, | |
549 SECKEYPrivateKey *key, | |
550 CERTCertificateList *certC
hain); | |
551 | |
552 /* | |
553 ** Query security status of socket. *on is set to one if security is | |
554 ** enabled. *keySize will contain the stream key size used. *issuer will | |
555 ** contain the RFC1485 verison of the name of the issuer of the | |
556 ** certificate at the other end of the connection. For a client, this is | |
557 ** the issuer of the server's certificate; for a server, this is the | |
558 ** issuer of the client's certificate (if any). Subject is the subject of | |
559 ** the other end's certificate. The pointers can be zero if the desired | |
560 ** data is not needed. All strings returned by this function are owned | |
561 ** by the caller, and need to be freed with PORT_Free. | |
562 */ | |
563 SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, | |
564 int *keySize, int *secretKeySize, | |
565 char **issuer, char **subject); | |
566 | |
567 /* Values for "on" */ | |
568 #define SSL_SECURITY_STATUS_NOOPT -1 | |
569 #define SSL_SECURITY_STATUS_OFF 0 | |
570 #define SSL_SECURITY_STATUS_ON_HIGH 1 | |
571 #define SSL_SECURITY_STATUS_ON_LOW 2 | |
572 #define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ | |
573 | |
574 /* | |
575 ** Return the certificate for our SSL peer. If the client calls this | |
576 ** it will always return the server's certificate. If the server calls | |
577 ** this, it may return NULL if client authentication is not enabled or | |
578 ** if the client had no certificate when asked. | |
579 ** "fd" the socket "file" descriptor | |
580 */ | |
581 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); | |
582 | |
583 /* | |
584 ** Return the certificates presented by the SSL peer. If the SSL peer | |
585 ** did not present certificates, return NULL with the | |
586 ** SSL_ERROR_NO_CERTIFICATE error. On failure, return NULL with an error | |
587 ** code other than SSL_ERROR_NO_CERTIFICATE. | |
588 ** "fd" the socket "file" descriptor | |
589 */ | |
590 SSL_IMPORT CERTCertList *SSL_PeerCertificateChain(PRFileDesc *fd); | |
591 | |
592 /* SSL_PeerStapledOCSPResponses returns the OCSP responses that were provided | |
593 * by the TLS server. The return value is a pointer to an internal SECItemArray | |
594 * that contains the returned OCSP responses; it is only valid until the | |
595 * callback function that calls SSL_PeerStapledOCSPResponses returns. | |
596 * | |
597 * If no OCSP responses were given by the server then the result will be empty. | |
598 * If there was an error, then the result will be NULL. | |
599 * | |
600 * You must set the SSL_ENABLE_OCSP_STAPLING option to enable OCSP stapling. | |
601 * to be provided by a server. | |
602 * | |
603 * libssl does not do any validation of the OCSP response itself; the | |
604 * authenticate certificate hook is responsible for doing so. The default | |
605 * authenticate certificate hook, SSL_AuthCertificate, does not implement | |
606 * any OCSP stapling funtionality, but this may change in future versions. | |
607 */ | |
608 SSL_IMPORT const SECItemArray *SSL_PeerStapledOCSPResponses(PRFileDesc *fd); | |
609 | |
610 /* SSL_PeerSignedCertTimestamps returns the signed_certificate_timestamp | |
611 * extension data provided by the TLS server. The return value is a pointer | |
612 * to an internal SECItem that contains the returned response (as a serialized | |
613 * SignedCertificateTimestampList, see RFC 6962). The returned pointer is only | |
614 * valid until the callback function that calls SSL_PeerSignedCertTimestamps | |
615 * (e.g. the authenticate certificate hook, or the handshake callback) returns. | |
616 * | |
617 * If no Signed Certificate Timestamps were given by the server then the result | |
618 * will be empty. If there was an error, then the result will be NULL. | |
619 * | |
620 * You must set the SSL_ENABLE_SIGNED_CERT_TIMESTAMPS option to indicate support | |
621 * for Signed Certificate Timestamps to a server. | |
622 * | |
623 * libssl does not do any parsing or validation of the response itself. | |
624 */ | |
625 SSL_IMPORT const SECItem *SSL_PeerSignedCertTimestamps(PRFileDesc *fd); | |
626 | |
627 /* SSL_SetStapledOCSPResponses stores an array of one or multiple OCSP responses | |
628 * in the fd's data, which may be sent as part of a server side cert_status | |
629 * handshake message. Parameter |responses| is for the server certificate of | |
630 * the key exchange type |kea|. | |
631 * The function will duplicate the responses array. | |
632 */ | |
633 SSL_IMPORT SECStatus | |
634 SSL_SetStapledOCSPResponses(PRFileDesc *fd, const SECItemArray *responses, | |
635 SSLKEAType kea); | |
636 | |
637 /* | |
638 * SSL_SetSignedCertTimestamps stores serialized signed_certificate_timestamp | |
639 * extension data in the fd. The signed_certificate_timestamp data is sent | |
640 * during the handshake (if requested by the client). Parameter |scts| | |
641 * is for the server certificate of the key exchange type |kea|. | |
642 * The function will duplicate the provided data item. To clear previously | |
643 * set data for a given key exchange type |kea|, pass NULL to |scts|. | |
644 */ | |
645 SSL_IMPORT SECStatus | |
646 SSL_SetSignedCertTimestamps(PRFileDesc *fd, const SECItem *scts, | |
647 SSLKEAType kea); | |
648 | |
649 /* | |
650 ** Authenticate certificate hook. Called when a certificate comes in | |
651 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the | |
652 ** certificate. | |
653 ** | |
654 ** The authenticate certificate hook must return SECSuccess to indicate the | |
655 ** certificate is valid, SECFailure to indicate the certificate is invalid, | |
656 ** or SECWouldBlock if the application will authenticate the certificate | |
657 ** asynchronously. SECWouldBlock is only supported for non-blocking sockets. | |
658 ** | |
659 ** If the authenticate certificate hook returns SECFailure, then the bad cert | |
660 ** hook will be called. The bad cert handler is NEVER called if the | |
661 ** authenticate certificate hook returns SECWouldBlock. If the application | |
662 ** needs to handle and/or override a bad cert, it should do so before it | |
663 ** calls SSL_AuthCertificateComplete (modifying the error it passes to | |
664 ** SSL_AuthCertificateComplete as needed). | |
665 ** | |
666 ** See the documentation for SSL_AuthCertificateComplete for more information | |
667 ** about the asynchronous behavior that occurs when the authenticate | |
668 ** certificate hook returns SECWouldBlock. | |
669 ** | |
670 ** RFC 6066 says that clients should send the bad_certificate_status_response | |
671 ** alert when they encounter an error processing the stapled OCSP response. | |
672 ** libssl does not provide a way for the authenticate certificate hook to | |
673 ** indicate that an OCSP error (SEC_ERROR_OCSP_*) that it returns is an error | |
674 ** in the stapled OCSP response or an error in some other OCSP response. | |
675 ** Further, NSS does not provide a convenient way to control or determine | |
676 ** which OCSP response(s) were used to validate a certificate chain. | |
677 ** Consequently, the current version of libssl does not ever send the | |
678 ** bad_certificate_status_response alert. This may change in future releases. | |
679 */ | |
680 typedef SECStatus(PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, | |
681 PRBool checkSig, | |
682 PRBool isServer); | |
683 | |
684 SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, | |
685 SSLAuthCertificate f, | |
686 void *arg); | |
687 | |
688 /* An implementation of the certificate authentication hook */ | |
689 SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, | |
690 PRBool checkSig, PRBool isServer); | |
691 | |
692 /* | |
693 * Prototype for SSL callback to get client auth data from the application. | |
694 * arg - application passed argument | |
695 * caNames - pointer to distinguished names of CAs that the server likes | |
696 * pRetCert - pointer to pointer to cert, for return of cert | |
697 * pRetKey - pointer to key pointer, for return of key | |
698 */ | |
699 typedef SECStatus(PR_CALLBACK *SSLGetClientAuthData)(void *arg, | |
700 PRFileDesc *fd, | |
701 CERTDistNames *caNames, | |
702 CERTCertificate **pRetCert,
/*return */ | |
703 SECKEYPrivateKey **pRetKey)
; /* return */ | |
704 | |
705 /* | |
706 * Set the client side callback for SSL to retrieve user's private key | |
707 * and certificate. | |
708 * fd - the file descriptor for the connection in question | |
709 * f - the application's callback that delivers the key and cert | |
710 * a - application specific data | |
711 */ | |
712 SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, | |
713 SSLGetClientAuthData f, void *a); | |
714 | |
715 /* | |
716 ** SNI extension processing callback function. | |
717 ** It is called when SSL socket receives SNI extension in ClientHello message. | |
718 ** Upon this callback invocation, application is responsible to reconfigure the | |
719 ** socket with the data for a particular server name. | |
720 ** There are three potential outcomes of this function invocation: | |
721 ** * application does not recognize the name or the type and wants the | |
722 ** "unrecognized_name" alert be sent to the client. In this case the callback | |
723 ** function must return SSL_SNI_SEND_ALERT status. | |
724 ** * application does not recognize the name, but wants to continue with | |
725 ** the handshake using the current socket configuration. In this case, | |
726 ** no socket reconfiguration is needed and the function should return | |
727 ** SSL_SNI_CURRENT_CONFIG_IS_USED. | |
728 ** * application recognizes the name and reconfigures the socket with | |
729 ** appropriate certs, key, etc. There are many ways to reconfigure. NSS | |
730 ** provides SSL_ReconfigFD function that can be used to update the socket | |
731 ** data from model socket. To continue with the rest of the handshake, the | |
732 ** implementation function should return an index of a name it has chosen. | |
733 ** LibSSL will ignore any SNI extension received in a ClientHello message | |
734 ** if application does not register a SSLSNISocketConfig callback. | |
735 ** Each type field of SECItem indicates the name type. | |
736 ** NOTE: currently RFC3546 defines only one name type: sni_host_name. | |
737 ** Client is allowed to send only one name per known type. LibSSL will | |
738 ** send an "unrecognized_name" alert if SNI extension name list contains more | |
739 ** then one name of a type. | |
740 */ | |
741 typedef PRInt32(PR_CALLBACK *SSLSNISocketConfig)(PRFileDesc *fd, | |
742 const SECItem *srvNameArr, | |
743 PRUint32 srvNameArrSize, | |
744 void *arg); | |
745 | |
746 /* | |
747 ** SSLSNISocketConfig should return an index within 0 and srvNameArrSize-1 | |
748 ** when it has reconfigured the socket fd to use certs and keys, etc | |
749 ** for a specific name. There are two other allowed return values. One | |
750 ** tells libSSL to use the default cert and key. The other tells libSSL | |
751 ** to send the "unrecognized_name" alert. These values are: | |
752 **/ | |
753 #define SSL_SNI_CURRENT_CONFIG_IS_USED -1 | |
754 #define SSL_SNI_SEND_ALERT -2 | |
755 | |
756 /* | |
757 ** Set application implemented SNISocketConfig callback. | |
758 */ | |
759 SSL_IMPORT SECStatus SSL_SNISocketConfigHook(PRFileDesc *fd, | |
760 SSLSNISocketConfig f, | |
761 void *arg); | |
762 | |
763 /* | |
764 ** Reconfigure fd SSL socket with model socket parameters. Sets | |
765 ** server certs and keys, list of trust anchor, socket options | |
766 ** and all SSL socket call backs and parameters. | |
767 */ | |
768 SSL_IMPORT PRFileDesc *SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd); | |
769 | |
770 /* | |
771 * Set the client side argument for SSL to retrieve PKCS #11 pin. | |
772 * fd - the file descriptor for the connection in question | |
773 * a - pkcs11 application specific data | |
774 */ | |
775 SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); | |
776 | |
777 /* | |
778 ** This is a callback for dealing with server certs that are not authenticated | |
779 ** by the client. The client app can decide that it actually likes the | |
780 ** cert by some external means and restart the connection. | |
781 ** | |
782 ** The bad cert hook must return SECSuccess to override the result of the | |
783 ** authenticate certificate hook, SECFailure if the certificate should still be | |
784 ** considered invalid, or SECWouldBlock if the application will authenticate | |
785 ** the certificate asynchronously. SECWouldBlock is only supported for | |
786 ** non-blocking sockets. | |
787 ** | |
788 ** See the documentation for SSL_AuthCertificateComplete for more information | |
789 ** about the asynchronous behavior that occurs when the bad cert hook returns | |
790 ** SECWouldBlock. | |
791 */ | |
792 typedef SECStatus(PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); | |
793 SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, | |
794 void *arg); | |
795 | |
796 /* | |
797 ** Configure SSL socket for running a secure server. Needs the | |
798 ** certificate for the server and the servers private key. The arguments | |
799 ** are copied. | |
800 */ | |
801 SSL_IMPORT SECStatus SSL_ConfigSecureServer( | |
802 PRFileDesc *fd, CERTCertificate *cert, | |
803 SECKEYPrivateKey *key, SSLKEAType kea); | |
804 | |
805 /* | |
806 ** Allows SSL socket configuration with caller-supplied certificate chain. | |
807 ** If certChainOpt is NULL, tries to find one. | |
808 */ | |
809 SSL_IMPORT SECStatus | |
810 SSL_ConfigSecureServerWithCertChain(PRFileDesc *fd, CERTCertificate *cert, | |
811 const CERTCertificateList *certChainOpt, | |
812 SECKEYPrivateKey *key, SSLKEAType kea); | |
813 | |
814 /* | |
815 ** Configure a secure server's session-id cache. Define the maximum number | |
816 ** of entries in the cache, the longevity of the entires, and the directory | |
817 ** where the cache files will be placed. These values can be zero, and | |
818 ** if so, the implementation will choose defaults. | |
819 ** This version of the function is for use in applications that have only one | |
820 ** process that uses the cache (even if that process has multiple threads). | |
821 */ | |
822 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, | |
823 PRUint32 timeout, | |
824 PRUint32 ssl3_timeout, | |
825 const char *directory); | |
826 | |
827 /* Configure a secure server's session-id cache. Depends on value of | |
828 * enableMPCache, configures malti-proc or single proc cache. */ | |
829 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCacheWithOpt( | |
830 PRUint32 timeout, | |
831 PRUint32 ssl3_timeout, | |
832 const char *directory, | |
833 int maxCacheEntries, | |
834 int maxCertCacheEntries, | |
835 int maxSrvNameCacheEntries, | |
836 PRBool enableMPCache); | |
837 | |
838 /* | |
839 ** Like SSL_ConfigServerSessionIDCache, with one important difference. | |
840 ** If the application will run multiple processes (as opposed to, or in | |
841 ** addition to multiple threads), then it must call this function, instead | |
842 ** of calling SSL_ConfigServerSessionIDCache(). | |
843 ** This has nothing to do with the number of processORs, only processEs. | |
844 ** This function sets up a Server Session ID (SID) cache that is safe for | |
845 ** access by multiple processes on the same system. | |
846 */ | |
847 SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, | |
848 PRUint32 timeout, | |
849 PRUint32 ssl3_timeout, | |
850 const char *directory); | |
851 | |
852 /* Get and set the configured maximum number of mutexes used for the | |
853 ** server's store of SSL sessions. This value is used by the server | |
854 ** session ID cache initialization functions shown above. Note that on | |
855 ** some platforms, these mutexes are actually implemented with POSIX | |
856 ** semaphores, or with unnamed pipes. The default value varies by platform. | |
857 ** An attempt to set a too-low maximum will return an error and the | |
858 ** configured value will not be changed. | |
859 */ | |
860 SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); | |
861 SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); | |
862 | |
863 /* environment variable set by SSL_ConfigMPServerSIDCache, and queried by | |
864 * SSL_InheritMPServerSIDCache when envString is NULL. | |
865 */ | |
866 #define SSL_ENV_VAR_NAME "SSL_INHERITANCE" | |
867 | |
868 /* called in child to inherit SID Cache variables. | |
869 * If envString is NULL, this function will use the value of the environment | |
870 * variable "SSL_INHERITANCE", otherwise the string value passed in will be | |
871 * used. | |
872 */ | |
873 SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char *envString); | |
874 | |
875 /* | |
876 ** Set the callback that gets called when a TLS handshake is complete. The | |
877 ** handshake callback is called after verifying the peer's Finished message and | |
878 ** before processing incoming application data. | |
879 ** | |
880 ** For the initial handshake: If the handshake false started (see | |
881 ** SSL_ENABLE_FALSE_START), then application data may already have been sent | |
882 ** before the handshake callback is called. If we did not false start then the | |
883 ** callback will get called before any application data is sent. | |
884 */ | |
885 typedef void(PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, | |
886 void *client_data); | |
887 SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, | |
888 SSLHandshakeCallback cb, void *client
_data); | |
889 | |
890 /* Applications that wish to enable TLS false start must set this callback | |
891 ** function. NSS will invoke the functon to determine if a particular | |
892 ** connection should use false start or not. SECSuccess indicates that the | |
893 ** callback completed successfully, and if so *canFalseStart indicates if false | |
894 ** start can be used. If the callback does not return SECSuccess then the | |
895 ** handshake will be canceled. NSS's recommended criteria can be evaluated by | |
896 ** calling SSL_RecommendedCanFalseStart. | |
897 ** | |
898 ** If no false start callback is registered then false start will never be | |
899 ** done, even if the SSL_ENABLE_FALSE_START option is enabled. | |
900 **/ | |
901 typedef SECStatus(PR_CALLBACK *SSLCanFalseStartCallback)( | |
902 PRFileDesc *fd, void *arg, PRBool *canFalseStart); | |
903 | |
904 SSL_IMPORT SECStatus SSL_SetCanFalseStartCallback( | |
905 PRFileDesc *fd, SSLCanFalseStartCallback callback, void *arg); | |
906 | |
907 /* This function sets *canFalseStart according to the recommended criteria for | |
908 ** false start. These criteria may change from release to release and may depend | |
909 ** on which handshake features have been negotiated and/or properties of the | |
910 ** certifciates/keys used on the connection. | |
911 */ | |
912 SSL_IMPORT SECStatus SSL_RecommendedCanFalseStart(PRFileDesc *fd, | |
913 PRBool *canFalseStart); | |
914 | |
915 /* | |
916 ** For the server, request a new handshake. For the client, begin a new | |
917 ** handshake. If flushCache is non-zero, the SSL3 cache entry will be | |
918 ** flushed first, ensuring that a full SSL handshake will be done. | |
919 ** If flushCache is zero, and an SSL connection is established, it will | |
920 ** do the much faster session restart handshake. This will change the | |
921 ** session keys without doing another private key operation. | |
922 */ | |
923 SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); | |
924 | |
925 /* | |
926 ** Same as above, but with an I/O timeout. | |
927 */ | |
928 SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, | |
929 PRBool flushCache, | |
930 PRIntervalTime timeout); | |
931 | |
932 /* Returns a SECItem containing the certificate_types field of the | |
933 ** CertificateRequest message. Each byte of the data is a TLS | |
934 ** ClientCertificateType value, and they are ordered from most preferred to | |
935 ** least. This function should only be called from the | |
936 ** SSL_GetClientAuthDataHook callback, and will return NULL if called at any | |
937 ** other time. The returned value is valid only until the callback returns, and | |
938 ** should not be freed. | |
939 */ | |
940 SSL_IMPORT const SECItem * | |
941 SSL_GetRequestedClientCertificateTypes(PRFileDesc *fd); | |
942 | |
943 #ifdef SSL_DEPRECATED_FUNCTION | |
944 /* deprecated! | |
945 ** For the server, request a new handshake. For the client, begin a new | |
946 ** handshake. Flushes SSL3 session cache entry first, ensuring that a | |
947 ** full handshake will be done. | |
948 ** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) | |
949 */ | |
950 SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); | |
951 #endif | |
952 | |
953 /* | |
954 * Allow the application to pass a URL or hostname into the SSL library. | |
955 */ | |
956 SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); | |
957 | |
958 /* | |
959 * Allow an application to define a set of trust anchors for peer | |
960 * cert validation. | |
961 */ | |
962 SSL_IMPORT SECStatus SSL_SetTrustAnchors(PRFileDesc *fd, CERTCertList *list); | |
963 | |
964 /* | |
965 ** Return the number of bytes that SSL has waiting in internal buffers. | |
966 ** Return 0 if security is not enabled. | |
967 */ | |
968 SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); | |
969 | |
970 /* | |
971 ** Invalidate the SSL session associated with fd. | |
972 */ | |
973 SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); | |
974 | |
975 /* | |
976 ** Cache the SSL session associated with fd, if it has not already been cached. | |
977 */ | |
978 SSL_IMPORT SECStatus SSL_CacheSession(PRFileDesc *fd); | |
979 | |
980 /* | |
981 ** Cache the SSL session associated with fd, if it has not already been cached. | |
982 ** This function may only be called when processing within a callback assigned | |
983 ** via SSL_HandshakeCallback | |
984 */ | |
985 SSL_IMPORT SECStatus SSL_CacheSessionUnlocked(PRFileDesc *fd); | |
986 | |
987 /* | |
988 ** Return a SECItem containing the SSL session ID associated with the fd. | |
989 */ | |
990 SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); | |
991 | |
992 /* | |
993 ** Clear out the client's SSL session cache, not the server's session cache. | |
994 */ | |
995 SSL_IMPORT void SSL_ClearSessionCache(void); | |
996 | |
997 /* | |
998 ** Close the server's SSL session cache. | |
999 */ | |
1000 SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); | |
1001 | |
1002 /* | |
1003 ** Set peer information so we can correctly look up SSL session later. | |
1004 ** You only have to do this if you're tunneling through a proxy. | |
1005 */ | |
1006 SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, const char *peerID); | |
1007 | |
1008 /* | |
1009 ** Reveal the security information for the peer. | |
1010 */ | |
1011 SSL_IMPORT CERTCertificate *SSL_RevealCert(PRFileDesc *socket); | |
1012 SSL_IMPORT void *SSL_RevealPinArg(PRFileDesc *socket); | |
1013 SSL_IMPORT char *SSL_RevealURL(PRFileDesc *socket); | |
1014 | |
1015 /* This callback may be passed to the SSL library via a call to | |
1016 * SSL_GetClientAuthDataHook() for each SSL client socket. | |
1017 * It will be invoked when SSL needs to know what certificate and private key | |
1018 * (if any) to use to respond to a request for client authentication. | |
1019 * If arg is non-NULL, it is a pointer to a NULL-terminated string containing | |
1020 * the nickname of the cert/key pair to use. | |
1021 * If arg is NULL, this function will search the cert and key databases for | |
1022 * a suitable match and send it if one is found. | |
1023 */ | |
1024 SSL_IMPORT SECStatus | |
1025 NSS_GetClientAuthData(void *arg, | |
1026 PRFileDesc *socket, | |
1027 struct CERTDistNamesStr *caNames, | |
1028 struct CERTCertificateStr **pRetCert, | |
1029 struct SECKEYPrivateKeyStr **pRetKey); | |
1030 | |
1031 /* | |
1032 ** Configure DTLS-SRTP (RFC 5764) cipher suite preferences. | |
1033 ** Input is a list of ciphers in descending preference order and a length | |
1034 ** of the list. As a side effect, this causes the use_srtp extension to be | |
1035 ** negotiated. | |
1036 ** | |
1037 ** Invalid or unimplemented cipher suites in |ciphers| are ignored. If at | |
1038 ** least one cipher suite in |ciphers| is implemented, returns SECSuccess. | |
1039 ** Otherwise returns SECFailure. | |
1040 */ | |
1041 SSL_IMPORT SECStatus SSL_SetSRTPCiphers(PRFileDesc *fd, | |
1042 const PRUint16 *ciphers, | |
1043 unsigned int numCiphers); | |
1044 | |
1045 /* | |
1046 ** Get the selected DTLS-SRTP cipher suite (if any). | |
1047 ** To be called after the handshake completes. | |
1048 ** Returns SECFailure if not negotiated. | |
1049 */ | |
1050 SSL_IMPORT SECStatus SSL_GetSRTPCipher(PRFileDesc *fd, | |
1051 PRUint16 *cipher); | |
1052 | |
1053 /* | |
1054 * Look to see if any of the signers in the cert chain for "cert" are found | |
1055 * in the list of caNames. | |
1056 * Returns SECSuccess if so, SECFailure if not. | |
1057 * Used by NSS_GetClientAuthData. May be used by other callback functions. | |
1058 */ | |
1059 SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, | |
1060 CERTDistNames *caNames); | |
1061 | |
1062 /* | |
1063 * Returns key exchange type of the keys in an SSL server certificate. | |
1064 */ | |
1065 SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate *cert); | |
1066 | |
1067 /* Set cipher policies to a predefined Domestic (U.S.A.) policy. | |
1068 * This essentially allows all supported ciphers. | |
1069 */ | |
1070 SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); | |
1071 | |
1072 /* Set cipher policies to a predefined Policy that is exportable from the USA | |
1073 * according to present U.S. policies as we understand them. | |
1074 * It is the same as NSS_SetDomesticPolicy now. | |
1075 */ | |
1076 SSL_IMPORT SECStatus NSS_SetExportPolicy(void); | |
1077 | |
1078 /* Set cipher policies to a predefined Policy that is exportable from the USA | |
1079 * according to present U.S. policies as we understand them, and that the | |
1080 * nation of France will permit to be imported into their country. | |
1081 * It is the same as NSS_SetDomesticPolicy now. | |
1082 */ | |
1083 SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); | |
1084 | |
1085 SSL_IMPORT SSL3Statistics *SSL_GetStatistics(void); | |
1086 | |
1087 /* Report more information than SSL_SecurityStatus. | |
1088 * Caller supplies the info struct. This function fills it in. Caller should | |
1089 * pass sizeof(SSLChannelInfo) as the |len| argument. | |
1090 * | |
1091 * The information here will be zeroed prior to details being confirmed. The | |
1092 * details are confirmed either when a Finished message is received, or - for a | |
1093 * client - when the second flight of messages have been sent. This function | |
1094 * therefore produces unreliable results prior to receiving the | |
1095 * SSLHandshakeCallback or the SSLCanFalseStartCallback. | |
1096 */ | |
1097 SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, | |
1098 PRUintn len); | |
1099 /* Get preliminary information about a channel. | |
1100 * Caller supplies the info struct. This function fills it in. Caller should | |
1101 * pass sizeof(SSLPreliminaryChannelInfo) as the |len| argument. | |
1102 * | |
1103 * this function is available to SSLAuthCertificate, SSLGetClientAuthData, | |
1104 * SSLSNISocketConfig, and other callbacks that might be called during the | |
1105 * processing of the first flight of client of server handshake messages. | |
1106 * Values are marked as being unavailable when renegotiation is initiated. | |
1107 */ | |
1108 SSL_IMPORT SECStatus | |
1109 SSL_GetPreliminaryChannelInfo(PRFileDesc *fd, | |
1110 SSLPreliminaryChannelInfo *info, | |
1111 PRUintn len); | |
1112 /* Get information about cipher suite with id of |cipherSuite|. | |
1113 * Caller supplies the info struct. This function fills it in. Caller should | |
1114 * pass sizeof(SSLCipherSuiteInfo) as the |len| argument. | |
1115 */ | |
1116 SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, | |
1117 SSLCipherSuiteInfo *info, PRUintn le
n); | |
1118 | |
1119 /* Returnes negotiated through SNI host info. */ | |
1120 SSL_IMPORT SECItem *SSL_GetNegotiatedHostInfo(PRFileDesc *fd); | |
1121 | |
1122 /* Export keying material according to RFC 5705. | |
1123 ** fd must correspond to a TLS 1.0 or higher socket and out must | |
1124 ** already be allocated. If hasContext is false, it uses the no-context | |
1125 ** construction from the RFC and ignores the context and contextLen | |
1126 ** arguments. | |
1127 */ | |
1128 SSL_IMPORT SECStatus SSL_ExportKeyingMaterial(PRFileDesc *fd, | |
1129 const char *label, | |
1130 unsigned int labelLen, | |
1131 PRBool hasContext, | |
1132 const unsigned char *context, | |
1133 unsigned int contextLen, | |
1134 unsigned char *out, | |
1135 unsigned int outLen); | |
1136 | |
1137 /* | |
1138 ** Return a new reference to the certificate that was most recently sent | |
1139 ** to the peer on this SSL/TLS connection, or NULL if none has been sent. | |
1140 */ | |
1141 SSL_IMPORT CERTCertificate *SSL_LocalCertificate(PRFileDesc *fd); | |
1142 | |
1143 /* Test an SSL configuration to see if SSL_BYPASS_PKCS11 can be turned on. | |
1144 ** Check the key exchange algorithm for each cipher in the list to see if | |
1145 ** a master secret key can be extracted after being derived with the mechanism | |
1146 ** required by the protocolmask argument. If the KEA will use keys from the | |
1147 ** specified cert make sure the extract operation is attempted from the slot | |
1148 ** where the private key resides. | |
1149 ** If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and | |
1150 ** SECSuccess is returned. In all other cases but one (*pcanbypass) is | |
1151 ** set to FALSE and SECFailure is returned. | |
1152 ** In that last case Derive() has been called successfully but the MS is null, | |
1153 ** CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the | |
1154 ** arguments were all valid but the slot cannot be bypassed. | |
1155 ** | |
1156 ** Note: A TRUE return code from CanBypass means "Your configuration will perfor
m | |
1157 ** NO WORSE with the bypass enabled than without"; it does NOT mean that every | |
1158 ** cipher suite listed will work properly with the selected protocols. | |
1159 ** | |
1160 ** Caveat: If export cipher suites are included in the argument list Canbypass | |
1161 ** will return FALSE. | |
1162 **/ | |
1163 | |
1164 /* protocol mask bits */ | |
1165 #define SSL_CBP_SSL3 0x0001 /* test SSL v3 mechanisms */ | |
1166 #define SSL_CBP_TLS1_0 0x0002 /* test TLS v1.0 mechanisms */ | |
1167 | |
1168 SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, | |
1169 SECKEYPrivateKey *privKey, | |
1170 PRUint32 protocolmask, | |
1171 PRUint16 *ciphers, int nciphers, | |
1172 PRBool *pcanbypass, void *pwArg); | |
1173 | |
1174 /* | |
1175 ** Did the handshake with the peer negotiate the given extension? | |
1176 ** Output parameter valid only if function returns SECSuccess | |
1177 */ | |
1178 SSL_IMPORT SECStatus SSL_HandshakeNegotiatedExtension(PRFileDesc *socket, | |
1179 SSLExtensionType extId, | |
1180 PRBool *yes); | |
1181 | |
1182 SSL_IMPORT SECStatus SSL_HandshakeResumedSession(PRFileDesc *fd, | |
1183 PRBool *last_handshake_resumed)
; | |
1184 | |
1185 /* See SSL_SetClientChannelIDCallback for usage. If the callback returns | |
1186 * SECWouldBlock then SSL_RestartHandshakeAfterChannelIDReq should be called in | |
1187 * the future to restart the handshake. On SECSuccess, the callback must have | |
1188 * written a P-256, EC key pair to |*out_public_key| and |*out_private_key|. */ | |
1189 typedef SECStatus(PR_CALLBACK *SSLClientChannelIDCallback)( | |
1190 void *arg, | |
1191 PRFileDesc *fd, | |
1192 SECKEYPublicKey **out_public_key, | |
1193 SECKEYPrivateKey **out_private_key); | |
1194 | |
1195 /* SSL_RestartHandshakeAfterChannelIDReq attempts to restart the handshake | |
1196 * after a ChannelID callback returned SECWouldBlock. | |
1197 * | |
1198 * This function takes ownership of |channelIDPub| and |channelID|. */ | |
1199 SSL_IMPORT SECStatus SSL_RestartHandshakeAfterChannelIDReq( | |
1200 PRFileDesc *fd, | |
1201 SECKEYPublicKey *channelIDPub, | |
1202 SECKEYPrivateKey *channelID); | |
1203 | |
1204 /* SSL_SetClientChannelIDCallback sets a callback function that will be called | |
1205 * once the server's ServerHello has been processed. This is only applicable to | |
1206 * a client socket and setting this callback causes the TLS Channel ID | |
1207 * extension to be advertised. */ | |
1208 SSL_IMPORT SECStatus SSL_SetClientChannelIDCallback( | |
1209 PRFileDesc *fd, | |
1210 SSLClientChannelIDCallback callback, | |
1211 void *arg); | |
1212 | |
1213 /* | |
1214 ** How long should we wait before retransmitting the next flight of | |
1215 ** the DTLS handshake? Returns SECFailure if not DTLS or not in a | |
1216 ** handshake. | |
1217 */ | |
1218 SSL_IMPORT SECStatus DTLS_GetHandshakeTimeout(PRFileDesc *socket, | |
1219 PRIntervalTime *timeout); | |
1220 | |
1221 /* | |
1222 * Return a boolean that indicates whether the underlying library | |
1223 * will perform as the caller expects. | |
1224 * | |
1225 * The only argument is a string, which should be the version | |
1226 * identifier of the NSS library. That string will be compared | |
1227 * against a string that represents the actual build version of | |
1228 * the SSL library. | |
1229 */ | |
1230 extern PRBool NSSSSL_VersionCheck(const char *importedVersion); | |
1231 | |
1232 /* | |
1233 * Returns a const string of the SSL library version. | |
1234 */ | |
1235 extern const char *NSSSSL_GetVersion(void); | |
1236 | |
1237 /* Restart an SSL connection that was paused to do asynchronous certificate | |
1238 * chain validation (when the auth certificate hook or bad cert handler | |
1239 * returned SECWouldBlock). | |
1240 * | |
1241 * This function only works for non-blocking sockets; Do not use it for | |
1242 * blocking sockets. Currently, this function works only for the client role of | |
1243 * a connection; it does not work for the server role. | |
1244 * | |
1245 * The application must call SSL_AuthCertificateComplete with 0 as the value of | |
1246 * the error parameter after it has successfully validated the peer's | |
1247 * certificate, in order to continue the SSL handshake. | |
1248 * | |
1249 * The application may call SSL_AuthCertificateComplete with a non-zero value | |
1250 * for error (e.g. SEC_ERROR_REVOKED_CERTIFICATE) when certificate validation | |
1251 * fails, before it closes the connection. If the application does so, an | |
1252 * alert corresponding to the error (e.g. certificate_revoked) will be sent to | |
1253 * the peer. See the source code of the internal function | |
1254 * ssl3_SendAlertForCertError for the current mapping of error to alert. This | |
1255 * mapping may change in future versions of libssl. | |
1256 * | |
1257 * This function will not complete the entire handshake. The application must | |
1258 * call SSL_ForceHandshake, PR_Recv, PR_Send, etc. after calling this function | |
1259 * to force the handshake to complete. | |
1260 * | |
1261 * On the first handshake of a connection, libssl will wait for the peer's | |
1262 * certificate to be authenticated before calling the handshake callback, | |
1263 * sending a client certificate, sending any application data, or returning | |
1264 * any application data to the application. On subsequent (renegotiation) | |
1265 * handshakes, libssl will block the handshake unconditionally while the | |
1266 * certificate is being validated. | |
1267 * | |
1268 * libssl may send and receive handshake messages while waiting for the | |
1269 * application to call SSL_AuthCertificateComplete, and it may call other | |
1270 * callbacks (e.g, the client auth data hook) before | |
1271 * SSL_AuthCertificateComplete has been called. | |
1272 * | |
1273 * An application that uses this asynchronous mechanism will usually have lower | |
1274 * handshake latency if it has to do public key operations on the certificate | |
1275 * chain and/or CRL/OCSP/cert fetching during the authentication, especially if | |
1276 * it does so in parallel on another thread. However, if the application can | |
1277 * authenticate the peer's certificate quickly then it may be more efficient | |
1278 * to use the synchronous mechanism (i.e. returning SECFailure/SECSuccess | |
1279 * instead of SECWouldBlock from the authenticate certificate hook). | |
1280 * | |
1281 * Be careful about converting an application from synchronous cert validation | |
1282 * to asynchronous certificate validation. A naive conversion is likely to | |
1283 * result in deadlocks; e.g. the application will wait in PR_Poll for network | |
1284 * I/O on the connection while all network I/O on the connection is blocked | |
1285 * waiting for this function to be called. | |
1286 * | |
1287 * Returns SECFailure on failure, SECSuccess on success. Never returns | |
1288 * SECWouldBlock. Note that SSL_AuthCertificateComplete will (usually) return | |
1289 * SECSuccess; do not interpret the return value of SSL_AuthCertificateComplete | |
1290 * as an indicator of whether it is OK to continue using the connection. For | |
1291 * example, SSL_AuthCertificateComplete(fd, SEC_ERROR_REVOKED_CERTIFICATE) will | |
1292 * return SECSuccess (normally), but that does not mean that the application | |
1293 * should continue using the connection. If the application passes a non-zero | |
1294 * value for second argument (error), or if SSL_AuthCertificateComplete returns | |
1295 * anything other than SECSuccess, then the application should close the | |
1296 * connection. | |
1297 */ | |
1298 SSL_IMPORT SECStatus SSL_AuthCertificateComplete(PRFileDesc *fd, | |
1299 PRErrorCode error); | |
1300 SEC_END_PROTOS | |
1301 | |
1302 #endif /* __ssl_h_ */ | |
OLD | NEW |