--- /dev/null
+/**\r
+ * \file ssl_ticket.h\r
+ *\r
+ * \brief TLS server ticket callbacks implementation\r
+ */\r
+/*\r
+ * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved\r
+ * SPDX-License-Identifier: Apache-2.0\r
+ *\r
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may\r
+ * not use this file except in compliance with the License.\r
+ * You may obtain a copy of the License at\r
+ *\r
+ * http://www.apache.org/licenses/LICENSE-2.0\r
+ *\r
+ * Unless required by applicable law or agreed to in writing, software\r
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\r
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
+ * See the License for the specific language governing permissions and\r
+ * limitations under the License.\r
+ *\r
+ * This file is part of mbed TLS (https://tls.mbed.org)\r
+ */\r
+#ifndef MBEDTLS_SSL_TICKET_H\r
+#define MBEDTLS_SSL_TICKET_H\r
+\r
+#if !defined(MBEDTLS_CONFIG_FILE)\r
+#include "config.h"\r
+#else\r
+#include MBEDTLS_CONFIG_FILE\r
+#endif\r
+\r
+/*\r
+ * This implementation of the session ticket callbacks includes key\r
+ * management, rotating the keys periodically in order to preserve forward\r
+ * secrecy, when MBEDTLS_HAVE_TIME is defined.\r
+ */\r
+\r
+#include "ssl.h"\r
+#include "cipher.h"\r
+\r
+#if defined(MBEDTLS_THREADING_C)\r
+#include "threading.h"\r
+#endif\r
+\r
+#ifdef __cplusplus\r
+extern "C" {\r
+#endif\r
+\r
+/**\r
+ * \brief Information for session ticket protection\r
+ */\r
+typedef struct mbedtls_ssl_ticket_key\r
+{\r
+ unsigned char name[4]; /*!< random key identifier */\r
+ uint32_t generation_time; /*!< key generation timestamp (seconds) */\r
+ mbedtls_cipher_context_t ctx; /*!< context for auth enc/decryption */\r
+}\r
+mbedtls_ssl_ticket_key;\r
+\r
+/**\r
+ * \brief Context for session ticket handling functions\r
+ */\r
+typedef struct mbedtls_ssl_ticket_context\r
+{\r
+ mbedtls_ssl_ticket_key keys[2]; /*!< ticket protection keys */\r
+ unsigned char active; /*!< index of the currently active key */\r
+\r
+ uint32_t ticket_lifetime; /*!< lifetime of tickets in seconds */\r
+\r
+ /** Callback for getting (pseudo-)random numbers */\r
+ int (*f_rng)(void *, unsigned char *, size_t);\r
+ void *p_rng; /*!< context for the RNG function */\r
+\r
+#if defined(MBEDTLS_THREADING_C)\r
+ mbedtls_threading_mutex_t mutex;\r
+#endif\r
+}\r
+mbedtls_ssl_ticket_context;\r
+\r
+/**\r
+ * \brief Initialize a ticket context.\r
+ * (Just make it ready for mbedtls_ssl_ticket_setup()\r
+ * or mbedtls_ssl_ticket_free().)\r
+ *\r
+ * \param ctx Context to be initialized\r
+ */\r
+void mbedtls_ssl_ticket_init( mbedtls_ssl_ticket_context *ctx );\r
+\r
+/**\r
+ * \brief Prepare context to be actually used\r
+ *\r
+ * \param ctx Context to be set up\r
+ * \param f_rng RNG callback function\r
+ * \param p_rng RNG callback context\r
+ * \param cipher AEAD cipher to use for ticket protection.\r
+ * Recommended value: MBEDTLS_CIPHER_AES_256_GCM.\r
+ * \param lifetime Tickets lifetime in seconds\r
+ * Recommended value: 86400 (one day).\r
+ *\r
+ * \note It is highly recommended to select a cipher that is at\r
+ * least as strong as the the strongest ciphersuite\r
+ * supported. Usually that means a 256-bit key.\r
+ *\r
+ * \note The lifetime of the keys is twice the lifetime of tickets.\r
+ * It is recommended to pick a reasonnable lifetime so as not\r
+ * to negate the benefits of forward secrecy.\r
+ *\r
+ * \return 0 if successful,\r
+ * or a specific MBEDTLS_ERR_XXX error code\r
+ */\r
+int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx,\r
+ int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,\r
+ mbedtls_cipher_type_t cipher,\r
+ uint32_t lifetime );\r
+\r
+/**\r
+ * \brief Implementation of the ticket write callback\r
+ *\r
+ * \note See \c mbedtls_ssl_ticket_write_t for description\r
+ */\r
+mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write;\r
+\r
+/**\r
+ * \brief Implementation of the ticket parse callback\r
+ *\r
+ * \note See \c mbedtls_ssl_ticket_parse_t for description\r
+ */\r
+mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse;\r
+\r
+/**\r
+ * \brief Free a context's content and zeroize it.\r
+ *\r
+ * \param ctx Context to be cleaned up\r
+ */\r
+void mbedtls_ssl_ticket_free( mbedtls_ssl_ticket_context *ctx );\r
+\r
+#ifdef __cplusplus\r
+}\r
+#endif\r
+\r
+#endif /* ssl_ticket.h */\r
projects / freertos / blobdiff