--- /dev/null
+/**\r
+ * \file ssl.h\r
+ *\r
+ * \brief SSL/TLS functions.\r
+ */\r
+/*\r
+ * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved\r
+ * SPDX-License-Identifier: Apache-2.0\r
+ *\r
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may\r
+ * not use this file except in compliance with the License.\r
+ * You may obtain a copy of the License at\r
+ *\r
+ * http://www.apache.org/licenses/LICENSE-2.0\r
+ *\r
+ * Unless required by applicable law or agreed to in writing, software\r
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\r
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
+ * See the License for the specific language governing permissions and\r
+ * limitations under the License.\r
+ *\r
+ * This file is part of mbed TLS (https://tls.mbed.org)\r
+ */\r
+#ifndef MBEDTLS_SSL_H\r
+#define MBEDTLS_SSL_H\r
+\r
+#if !defined(MBEDTLS_CONFIG_FILE)\r
+#include "config.h"\r
+#else\r
+#include MBEDTLS_CONFIG_FILE\r
+#endif\r
+\r
+#include "bignum.h"\r
+#include "ecp.h"\r
+\r
+#include "ssl_ciphersuites.h"\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+#include "x509_crt.h"\r
+#include "x509_crl.h"\r
+#endif\r
+\r
+#if defined(MBEDTLS_DHM_C)\r
+#include "dhm.h"\r
+#endif\r
+\r
+#if defined(MBEDTLS_ECDH_C)\r
+#include "ecdh.h"\r
+#endif\r
+\r
+#if defined(MBEDTLS_ZLIB_SUPPORT)\r
+\r
+#if defined(MBEDTLS_DEPRECATED_WARNING)\r
+#warning "Record compression support via MBEDTLS_ZLIB_SUPPORT is deprecated and will be removed in the next major revision of the library"\r
+#endif\r
+\r
+#if defined(MBEDTLS_DEPRECATED_REMOVED)\r
+#error "Record compression support via MBEDTLS_ZLIB_SUPPORT is deprecated and cannot be used if MBEDTLS_DEPRECATED_REMOVED is set"\r
+#endif\r
+\r
+#include "zlib.h"\r
+#endif\r
+\r
+#if defined(MBEDTLS_HAVE_TIME)\r
+#include "platform_time.h"\r
+#endif\r
+\r
+#if defined(MBEDTLS_USE_PSA_CRYPTO)\r
+#include "psa/crypto.h"\r
+#endif /* MBEDTLS_USE_PSA_CRYPTO */\r
+\r
+/*\r
+ * SSL Error codes\r
+ */\r
+#define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE -0x7080 /**< The requested feature is not available. */\r
+#define MBEDTLS_ERR_SSL_BAD_INPUT_DATA -0x7100 /**< Bad input parameters to function. */\r
+#define MBEDTLS_ERR_SSL_INVALID_MAC -0x7180 /**< Verification of the message MAC failed. */\r
+#define MBEDTLS_ERR_SSL_INVALID_RECORD -0x7200 /**< An invalid SSL record was received. */\r
+#define MBEDTLS_ERR_SSL_CONN_EOF -0x7280 /**< The connection indicated an EOF. */\r
+#define MBEDTLS_ERR_SSL_UNKNOWN_CIPHER -0x7300 /**< An unknown cipher was received. */\r
+#define MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 /**< The server has no ciphersuites in common with the client. */\r
+#define MBEDTLS_ERR_SSL_NO_RNG -0x7400 /**< No RNG was provided to the SSL module. */\r
+#define MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 /**< No client certification received from the client, but required by the authentication mode. */\r
+#define MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 /**< Our own certificate(s) is/are too large to send in an SSL message. */\r
+#define MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 /**< The own certificate is not set, but needed by the server. */\r
+#define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 /**< The own private key or pre-shared key is not set, but needed. */\r
+#define MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 /**< No CA Chain is set, but required to operate. */\r
+#define MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 /**< An unexpected message was received from our peer. */\r
+#define MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 /**< A fatal alert message was received from our peer. */\r
+#define MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED -0x7800 /**< Verification of our peer failed. */\r
+#define MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 /**< The peer notified us that the connection is going to be closed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 /**< Processing of the ClientHello handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 /**< Processing of the ServerHello handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 /**< Processing of the Certificate handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 /**< Processing of the CertificateRequest handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 /**< Processing of the ServerKeyExchange handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 /**< Processing of the ServerHelloDone handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 /**< Processing of the ClientKeyExchange handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP -0x7C80 /**< Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Read Public. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS -0x7D00 /**< Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Calculate Secret. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 /**< Processing of the CertificateVerify handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 /**< Processing of the ChangeCipherSpec handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_FINISHED -0x7E80 /**< Processing of the Finished handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_ALLOC_FAILED -0x7F00 /**< Memory allocation failed */\r
+#define MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -0x7F80 /**< Hardware acceleration function returned with error */\r
+#define MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 /**< Hardware acceleration function skipped / left alone data */\r
+#define MBEDTLS_ERR_SSL_COMPRESSION_FAILED -0x6F00 /**< Processing of the compression / decompression failed */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 /**< Handshake protocol not within min/max boundaries */\r
+#define MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET -0x6E00 /**< Processing of the NewSessionTicket handshake message failed. */\r
+#define MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 /**< Session ticket has expired. */\r
+#define MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 /**< Public key type mismatch (eg, asked for RSA key exchange and presented EC key) */\r
+#define MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 /**< Unknown identity received (eg, PSK identity) */\r
+#define MBEDTLS_ERR_SSL_INTERNAL_ERROR -0x6C00 /**< Internal error (eg, unexpected failure in lower-level module) */\r
+#define MBEDTLS_ERR_SSL_COUNTER_WRAPPING -0x6B80 /**< A counter would wrap (eg, too many messages exchanged). */\r
+#define MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO -0x6B00 /**< Unexpected message at ServerHello in renegotiation. */\r
+#define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED -0x6A80 /**< DTLS client must retry for hello verification */\r
+#define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL -0x6A00 /**< A buffer is too small to receive or write a message */\r
+#define MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE -0x6980 /**< None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */\r
+#define MBEDTLS_ERR_SSL_WANT_READ -0x6900 /**< No data of requested type currently available on underlying transport. */\r
+#define MBEDTLS_ERR_SSL_WANT_WRITE -0x6880 /**< Connection requires a write call. */\r
+#define MBEDTLS_ERR_SSL_TIMEOUT -0x6800 /**< The operation timed out. */\r
+#define MBEDTLS_ERR_SSL_CLIENT_RECONNECT -0x6780 /**< The client initiated a reconnect from the same port. */\r
+#define MBEDTLS_ERR_SSL_UNEXPECTED_RECORD -0x6700 /**< Record header looks valid but is not expected. */\r
+#define MBEDTLS_ERR_SSL_NON_FATAL -0x6680 /**< The alert message received indicates a non-fatal error. */\r
+#define MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH -0x6600 /**< Couldn't set the hash for verifying CertificateVerify */\r
+#define MBEDTLS_ERR_SSL_CONTINUE_PROCESSING -0x6580 /**< Internal-only message signaling that further message-processing should be done */\r
+#define MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS -0x6500 /**< The asynchronous operation is not completed yet. */\r
+#define MBEDTLS_ERR_SSL_EARLY_MESSAGE -0x6480 /**< Internal-only message signaling that a message arrived early. */\r
+#define MBEDTLS_ERR_SSL_UNEXPECTED_CID -0x6000 /**< An encrypted DTLS-frame with an unexpected CID was received. */\r
+#define MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS -0x7000 /**< A cryptographic operation is in progress. Try again later. */\r
+\r
+/*\r
+ * Various constants\r
+ */\r
+#define MBEDTLS_SSL_MAJOR_VERSION_3 3\r
+#define MBEDTLS_SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */\r
+#define MBEDTLS_SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */\r
+#define MBEDTLS_SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */\r
+#define MBEDTLS_SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */\r
+\r
+#define MBEDTLS_SSL_TRANSPORT_STREAM 0 /*!< TLS */\r
+#define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 /*!< DTLS */\r
+\r
+#define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 /*!< Maximum host name defined in RFC 1035 */\r
+\r
+/* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c\r
+ * NONE must be zero so that memset()ing structure to zero works */\r
+#define MBEDTLS_SSL_MAX_FRAG_LEN_NONE 0 /*!< don't use this extension */\r
+#define MBEDTLS_SSL_MAX_FRAG_LEN_512 1 /*!< MaxFragmentLength 2^9 */\r
+#define MBEDTLS_SSL_MAX_FRAG_LEN_1024 2 /*!< MaxFragmentLength 2^10 */\r
+#define MBEDTLS_SSL_MAX_FRAG_LEN_2048 3 /*!< MaxFragmentLength 2^11 */\r
+#define MBEDTLS_SSL_MAX_FRAG_LEN_4096 4 /*!< MaxFragmentLength 2^12 */\r
+#define MBEDTLS_SSL_MAX_FRAG_LEN_INVALID 5 /*!< first invalid value */\r
+\r
+#define MBEDTLS_SSL_IS_CLIENT 0\r
+#define MBEDTLS_SSL_IS_SERVER 1\r
+\r
+#define MBEDTLS_SSL_IS_NOT_FALLBACK 0\r
+#define MBEDTLS_SSL_IS_FALLBACK 1\r
+\r
+#define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0\r
+#define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_CID_DISABLED 0\r
+#define MBEDTLS_SSL_CID_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_ETM_DISABLED 0\r
+#define MBEDTLS_SSL_ETM_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_COMPRESS_NULL 0\r
+#define MBEDTLS_SSL_COMPRESS_DEFLATE 1\r
+\r
+#define MBEDTLS_SSL_VERIFY_NONE 0\r
+#define MBEDTLS_SSL_VERIFY_OPTIONAL 1\r
+#define MBEDTLS_SSL_VERIFY_REQUIRED 2\r
+#define MBEDTLS_SSL_VERIFY_UNSET 3 /* Used only for sni_authmode */\r
+\r
+#define MBEDTLS_SSL_LEGACY_RENEGOTIATION 0\r
+#define MBEDTLS_SSL_SECURE_RENEGOTIATION 1\r
+\r
+#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0\r
+#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_ANTI_REPLAY_DISABLED 0\r
+#define MBEDTLS_SSL_ANTI_REPLAY_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED -1\r
+#define MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT 16\r
+\r
+#define MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION 0\r
+#define MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION 1\r
+#define MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE 2\r
+\r
+#define MBEDTLS_SSL_TRUNC_HMAC_DISABLED 0\r
+#define MBEDTLS_SSL_TRUNC_HMAC_ENABLED 1\r
+#define MBEDTLS_SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 */\r
+\r
+#define MBEDTLS_SSL_SESSION_TICKETS_DISABLED 0\r
+#define MBEDTLS_SSL_SESSION_TICKETS_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED 0\r
+#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED 1\r
+\r
+#define MBEDTLS_SSL_ARC4_ENABLED 0\r
+#define MBEDTLS_SSL_ARC4_DISABLED 1\r
+\r
+#define MBEDTLS_SSL_PRESET_DEFAULT 0\r
+#define MBEDTLS_SSL_PRESET_SUITEB 2\r
+\r
+#define MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED 1\r
+#define MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED 0\r
+\r
+/*\r
+ * Default range for DTLS retransmission timer value, in milliseconds.\r
+ * RFC 6347 4.2.4.1 says from 1 second to 60 seconds.\r
+ */\r
+#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN 1000\r
+#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX 60000\r
+\r
+/**\r
+ * \name SECTION: Module settings\r
+ *\r
+ * The configuration options you can set for this module are in this section.\r
+ * Either change them in config.h or define them on the compiler command line.\r
+ * \{\r
+ */\r
+\r
+#if !defined(MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME)\r
+#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */\r
+#endif\r
+\r
+/*\r
+ * Maximum fragment length in bytes,\r
+ * determines the size of each of the two internal I/O buffers.\r
+ *\r
+ * Note: the RFC defines the default size of SSL / TLS messages. If you\r
+ * change the value here, other clients / servers may not be able to\r
+ * communicate with you anymore. Only change this value if you control\r
+ * both sides of the connection and have it reduced at both sides, or\r
+ * if you're using the Max Fragment Length extension and you know all your\r
+ * peers are using it too!\r
+ */\r
+#if !defined(MBEDTLS_SSL_MAX_CONTENT_LEN)\r
+#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output buffer */\r
+#endif\r
+\r
+#if !defined(MBEDTLS_SSL_IN_CONTENT_LEN)\r
+#define MBEDTLS_SSL_IN_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN\r
+#endif\r
+\r
+#if !defined(MBEDTLS_SSL_OUT_CONTENT_LEN)\r
+#define MBEDTLS_SSL_OUT_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN\r
+#endif\r
+\r
+/*\r
+ * Maximum number of heap-allocated bytes for the purpose of\r
+ * DTLS handshake message reassembly and future message buffering.\r
+ */\r
+#if !defined(MBEDTLS_SSL_DTLS_MAX_BUFFERING)\r
+#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768\r
+#endif\r
+\r
+/*\r
+ * Maximum length of CIDs for incoming and outgoing messages.\r
+ */\r
+#if !defined(MBEDTLS_SSL_CID_IN_LEN_MAX)\r
+#define MBEDTLS_SSL_CID_IN_LEN_MAX 32\r
+#endif\r
+\r
+#if !defined(MBEDTLS_SSL_CID_OUT_LEN_MAX)\r
+#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32\r
+#endif\r
+\r
+#if !defined(MBEDTLS_SSL_CID_PADDING_GRANULARITY)\r
+#define MBEDTLS_SSL_CID_PADDING_GRANULARITY 16\r
+#endif\r
+\r
+/* \} name SECTION: Module settings */\r
+\r
+/*\r
+ * Length of the verify data for secure renegotiation\r
+ */\r
+#if defined(MBEDTLS_SSL_PROTO_SSL3)\r
+#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 36\r
+#else\r
+#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12\r
+#endif\r
+\r
+/*\r
+ * Signaling ciphersuite values (SCSV)\r
+ */\r
+#define MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext */\r
+#define MBEDTLS_SSL_FALLBACK_SCSV_VALUE 0x5600 /**< RFC 7507 section 2 */\r
+\r
+/*\r
+ * Supported Signature and Hash algorithms (For TLS 1.2)\r
+ * RFC 5246 section 7.4.1.4.1\r
+ */\r
+#define MBEDTLS_SSL_HASH_NONE 0\r
+#define MBEDTLS_SSL_HASH_MD5 1\r
+#define MBEDTLS_SSL_HASH_SHA1 2\r
+#define MBEDTLS_SSL_HASH_SHA224 3\r
+#define MBEDTLS_SSL_HASH_SHA256 4\r
+#define MBEDTLS_SSL_HASH_SHA384 5\r
+#define MBEDTLS_SSL_HASH_SHA512 6\r
+\r
+#define MBEDTLS_SSL_SIG_ANON 0\r
+#define MBEDTLS_SSL_SIG_RSA 1\r
+#define MBEDTLS_SSL_SIG_ECDSA 3\r
+\r
+/*\r
+ * Client Certificate Types\r
+ * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5\r
+ */\r
+#define MBEDTLS_SSL_CERT_TYPE_RSA_SIGN 1\r
+#define MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN 64\r
+\r
+/*\r
+ * Message, alert and handshake types\r
+ */\r
+#define MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC 20\r
+#define MBEDTLS_SSL_MSG_ALERT 21\r
+#define MBEDTLS_SSL_MSG_HANDSHAKE 22\r
+#define MBEDTLS_SSL_MSG_APPLICATION_DATA 23\r
+#define MBEDTLS_SSL_MSG_CID 25\r
+\r
+#define MBEDTLS_SSL_ALERT_LEVEL_WARNING 1\r
+#define MBEDTLS_SSL_ALERT_LEVEL_FATAL 2\r
+\r
+#define MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY 0 /* 0x00 */\r
+#define MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE 10 /* 0x0A */\r
+#define MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC 20 /* 0x14 */\r
+#define MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED 21 /* 0x15 */\r
+#define MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW 22 /* 0x16 */\r
+#define MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30 /* 0x1E */\r
+#define MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE 40 /* 0x28 */\r
+#define MBEDTLS_SSL_ALERT_MSG_NO_CERT 41 /* 0x29 */\r
+#define MBEDTLS_SSL_ALERT_MSG_BAD_CERT 42 /* 0x2A */\r
+#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT 43 /* 0x2B */\r
+#define MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED 44 /* 0x2C */\r
+#define MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED 45 /* 0x2D */\r
+#define MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN 46 /* 0x2E */\r
+#define MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER 47 /* 0x2F */\r
+#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA 48 /* 0x30 */\r
+#define MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED 49 /* 0x31 */\r
+#define MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */\r
+#define MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */\r
+#define MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */\r
+#define MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */\r
+#define MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */\r
+#define MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */\r
+#define MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK 86 /* 0x56 */\r
+#define MBEDTLS_SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */\r
+#define MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */\r
+#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */\r
+#define MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */\r
+#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */\r
+#define MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL 120 /* 0x78 */\r
+\r
+#define MBEDTLS_SSL_HS_HELLO_REQUEST 0\r
+#define MBEDTLS_SSL_HS_CLIENT_HELLO 1\r
+#define MBEDTLS_SSL_HS_SERVER_HELLO 2\r
+#define MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST 3\r
+#define MBEDTLS_SSL_HS_NEW_SESSION_TICKET 4\r
+#define MBEDTLS_SSL_HS_CERTIFICATE 11\r
+#define MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE 12\r
+#define MBEDTLS_SSL_HS_CERTIFICATE_REQUEST 13\r
+#define MBEDTLS_SSL_HS_SERVER_HELLO_DONE 14\r
+#define MBEDTLS_SSL_HS_CERTIFICATE_VERIFY 15\r
+#define MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE 16\r
+#define MBEDTLS_SSL_HS_FINISHED 20\r
+\r
+/*\r
+ * TLS extensions\r
+ */\r
+#define MBEDTLS_TLS_EXT_SERVERNAME 0\r
+#define MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME 0\r
+\r
+#define MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH 1\r
+\r
+#define MBEDTLS_TLS_EXT_TRUNCATED_HMAC 4\r
+\r
+#define MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10\r
+#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS 11\r
+\r
+#define MBEDTLS_TLS_EXT_SIG_ALG 13\r
+\r
+#define MBEDTLS_TLS_EXT_ALPN 16\r
+\r
+#define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC 22 /* 0x16 */\r
+#define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET 0x0017 /* 23 */\r
+\r
+#define MBEDTLS_TLS_EXT_SESSION_TICKET 35\r
+\r
+/* The value of the CID extension is still TBD as of\r
+ * draft-ietf-tls-dtls-connection-id-05\r
+ * (https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05) */\r
+#define MBEDTLS_TLS_EXT_CID 254 /* TBD */\r
+\r
+#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */\r
+\r
+#define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01\r
+\r
+/*\r
+ * Size defines\r
+ */\r
+#if !defined(MBEDTLS_PSK_MAX_LEN)\r
+#define MBEDTLS_PSK_MAX_LEN 32 /* 256 bits */\r
+#endif\r
+\r
+/* Dummy type used only for its size */\r
+union mbedtls_ssl_premaster_secret\r
+{\r
+#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)\r
+ unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)\r
+ unsigned char _pms_dhm[MBEDTLS_MPI_MAX_SIZE]; /* RFC 5246 8.1.2 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \\r
+ defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \\r
+ defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \\r
+ defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)\r
+ unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)\r
+ unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)\r
+ unsigned char _pms_dhe_psk[4 + MBEDTLS_MPI_MAX_SIZE\r
+ + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 3 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)\r
+ unsigned char _pms_rsa_psk[52 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 4 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)\r
+ unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES\r
+ + MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */\r
+#endif\r
+#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)\r
+ unsigned char _pms_ecjpake[32]; /* Thread spec: SHA-256 output */\r
+#endif\r
+};\r
+\r
+#define MBEDTLS_PREMASTER_SIZE sizeof( union mbedtls_ssl_premaster_secret )\r
+\r
+#ifdef __cplusplus\r
+extern "C" {\r
+#endif\r
+\r
+/*\r
+ * SSL state machine\r
+ */\r
+typedef enum\r
+{\r
+ MBEDTLS_SSL_HELLO_REQUEST,\r
+ MBEDTLS_SSL_CLIENT_HELLO,\r
+ MBEDTLS_SSL_SERVER_HELLO,\r
+ MBEDTLS_SSL_SERVER_CERTIFICATE,\r
+ MBEDTLS_SSL_SERVER_KEY_EXCHANGE,\r
+ MBEDTLS_SSL_CERTIFICATE_REQUEST,\r
+ MBEDTLS_SSL_SERVER_HELLO_DONE,\r
+ MBEDTLS_SSL_CLIENT_CERTIFICATE,\r
+ MBEDTLS_SSL_CLIENT_KEY_EXCHANGE,\r
+ MBEDTLS_SSL_CERTIFICATE_VERIFY,\r
+ MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC,\r
+ MBEDTLS_SSL_CLIENT_FINISHED,\r
+ MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC,\r
+ MBEDTLS_SSL_SERVER_FINISHED,\r
+ MBEDTLS_SSL_FLUSH_BUFFERS,\r
+ MBEDTLS_SSL_HANDSHAKE_WRAPUP,\r
+ MBEDTLS_SSL_HANDSHAKE_OVER,\r
+ MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET,\r
+ MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT,\r
+}\r
+mbedtls_ssl_states;\r
+\r
+/*\r
+ * The tls_prf function types.\r
+ */\r
+typedef enum\r
+{\r
+ MBEDTLS_SSL_TLS_PRF_NONE,\r
+ MBEDTLS_SSL_TLS_PRF_SSL3,\r
+ MBEDTLS_SSL_TLS_PRF_TLS1,\r
+ MBEDTLS_SSL_TLS_PRF_SHA384,\r
+ MBEDTLS_SSL_TLS_PRF_SHA256\r
+}\r
+mbedtls_tls_prf_types;\r
+/**\r
+ * \brief Callback type: send data on the network.\r
+ *\r
+ * \note That callback may be either blocking or non-blocking.\r
+ *\r
+ * \param ctx Context for the send callback (typically a file descriptor)\r
+ * \param buf Buffer holding the data to send\r
+ * \param len Length of the data to send\r
+ *\r
+ * \return The callback must return the number of bytes sent if any,\r
+ * or a non-zero error code.\r
+ * If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_WRITE\r
+ * must be returned when the operation would block.\r
+ *\r
+ * \note The callback is allowed to send fewer bytes than requested.\r
+ * It must always return the number of bytes actually sent.\r
+ */\r
+typedef int mbedtls_ssl_send_t( void *ctx,\r
+ const unsigned char *buf,\r
+ size_t len );\r
+\r
+/**\r
+ * \brief Callback type: receive data from the network.\r
+ *\r
+ * \note That callback may be either blocking or non-blocking.\r
+ *\r
+ * \param ctx Context for the receive callback (typically a file\r
+ * descriptor)\r
+ * \param buf Buffer to write the received data to\r
+ * \param len Length of the receive buffer\r
+ *\r
+ * \return The callback must return the number of bytes received,\r
+ * or a non-zero error code.\r
+ * If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_READ\r
+ * must be returned when the operation would block.\r
+ *\r
+ * \note The callback may receive fewer bytes than the length of the\r
+ * buffer. It must always return the number of bytes actually\r
+ * received and written to the buffer.\r
+ */\r
+typedef int mbedtls_ssl_recv_t( void *ctx,\r
+ unsigned char *buf,\r
+ size_t len );\r
+\r
+/**\r
+ * \brief Callback type: receive data from the network, with timeout\r
+ *\r
+ * \note That callback must block until data is received, or the\r
+ * timeout delay expires, or the operation is interrupted by a\r
+ * signal.\r
+ *\r
+ * \param ctx Context for the receive callback (typically a file descriptor)\r
+ * \param buf Buffer to write the received data to\r
+ * \param len Length of the receive buffer\r
+ * \param timeout Maximum nomber of millisecondes to wait for data\r
+ * 0 means no timeout (potentially waiting forever)\r
+ *\r
+ * \return The callback must return the number of bytes received,\r
+ * or a non-zero error code:\r
+ * \c MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out,\r
+ * \c MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal.\r
+ *\r
+ * \note The callback may receive fewer bytes than the length of the\r
+ * buffer. It must always return the number of bytes actually\r
+ * received and written to the buffer.\r
+ */\r
+typedef int mbedtls_ssl_recv_timeout_t( void *ctx,\r
+ unsigned char *buf,\r
+ size_t len,\r
+ uint32_t timeout );\r
+/**\r
+ * \brief Callback type: set a pair of timers/delays to watch\r
+ *\r
+ * \param ctx Context pointer\r
+ * \param int_ms Intermediate delay in milliseconds\r
+ * \param fin_ms Final delay in milliseconds\r
+ * 0 cancels the current timer.\r
+ *\r
+ * \note This callback must at least store the necessary information\r
+ * for the associated \c mbedtls_ssl_get_timer_t callback to\r
+ * return correct information.\r
+ *\r
+ * \note If using a event-driven style of programming, an event must\r
+ * be generated when the final delay is passed. The event must\r
+ * cause a call to \c mbedtls_ssl_handshake() with the proper\r
+ * SSL context to be scheduled. Care must be taken to ensure\r
+ * that at most one such call happens at a time.\r
+ *\r
+ * \note Only one timer at a time must be running. Calling this\r
+ * function while a timer is running must cancel it. Cancelled\r
+ * timers must not generate any event.\r
+ */\r
+typedef void mbedtls_ssl_set_timer_t( void * ctx,\r
+ uint32_t int_ms,\r
+ uint32_t fin_ms );\r
+\r
+/**\r
+ * \brief Callback type: get status of timers/delays\r
+ *\r
+ * \param ctx Context pointer\r
+ *\r
+ * \return This callback must return:\r
+ * -1 if cancelled (fin_ms == 0),\r
+ * 0 if none of the delays have passed,\r
+ * 1 if only the intermediate delay has passed,\r
+ * 2 if the final delay has passed.\r
+ */\r
+typedef int mbedtls_ssl_get_timer_t( void * ctx );\r
+\r
+/* Defined below */\r
+typedef struct mbedtls_ssl_session mbedtls_ssl_session;\r
+typedef struct mbedtls_ssl_context mbedtls_ssl_context;\r
+typedef struct mbedtls_ssl_config mbedtls_ssl_config;\r
+\r
+/* Defined in ssl_internal.h */\r
+typedef struct mbedtls_ssl_transform mbedtls_ssl_transform;\r
+typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params;\r
+typedef struct mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t;\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert;\r
+#endif\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item;\r
+#endif\r
+\r
+#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+/**\r
+ * \brief Callback type: start external signature operation.\r
+ *\r
+ * This callback is called during an SSL handshake to start\r
+ * a signature decryption operation using an\r
+ * external processor. The parameter \p cert contains\r
+ * the public key; it is up to the callback function to\r
+ * determine how to access the associated private key.\r
+ *\r
+ * This function typically sends or enqueues a request, and\r
+ * does not wait for the operation to complete. This allows\r
+ * the handshake step to be non-blocking.\r
+ *\r
+ * The parameters \p ssl and \p cert are guaranteed to remain\r
+ * valid throughout the handshake. On the other hand, this\r
+ * function must save the contents of \p hash if the value\r
+ * is needed for later processing, because the \p hash buffer\r
+ * is no longer valid after this function returns.\r
+ *\r
+ * This function may call mbedtls_ssl_set_async_operation_data()\r
+ * to store an operation context for later retrieval\r
+ * by the resume or cancel callback.\r
+ *\r
+ * \note For RSA signatures, this function must produce output\r
+ * that is consistent with PKCS#1 v1.5 in the same way as\r
+ * mbedtls_rsa_pkcs1_sign(). Before the private key operation,\r
+ * apply the padding steps described in RFC 8017, section 9.2\r
+ * "EMSA-PKCS1-v1_5" as follows.\r
+ * - If \p md_alg is #MBEDTLS_MD_NONE, apply the PKCS#1 v1.5\r
+ * encoding, treating \p hash as the DigestInfo to be\r
+ * padded. In other words, apply EMSA-PKCS1-v1_5 starting\r
+ * from step 3, with `T = hash` and `tLen = hash_len`.\r
+ * - If `md_alg != MBEDTLS_MD_NONE`, apply the PKCS#1 v1.5\r
+ * encoding, treating \p hash as the hash to be encoded and\r
+ * padded. In other words, apply EMSA-PKCS1-v1_5 starting\r
+ * from step 2, with `digestAlgorithm` obtained by calling\r
+ * mbedtls_oid_get_oid_by_md() on \p md_alg.\r
+ *\r
+ * \note For ECDSA signatures, the output format is the DER encoding\r
+ * `Ecdsa-Sig-Value` defined in\r
+ * [RFC 4492 section 5.4](https://tools.ietf.org/html/rfc4492#section-5.4).\r
+ *\r
+ * \param ssl The SSL connection instance. It should not be\r
+ * modified other than via\r
+ * mbedtls_ssl_set_async_operation_data().\r
+ * \param cert Certificate containing the public key.\r
+ * In simple cases, this is one of the pointers passed to\r
+ * mbedtls_ssl_conf_own_cert() when configuring the SSL\r
+ * connection. However, if other callbacks are used, this\r
+ * property may not hold. For example, if an SNI callback\r
+ * is registered with mbedtls_ssl_conf_sni(), then\r
+ * this callback determines what certificate is used.\r
+ * \param md_alg Hash algorithm.\r
+ * \param hash Buffer containing the hash. This buffer is\r
+ * no longer valid when the function returns.\r
+ * \param hash_len Size of the \c hash buffer in bytes.\r
+ *\r
+ * \return 0 if the operation was started successfully and the SSL\r
+ * stack should call the resume callback immediately.\r
+ * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation\r
+ * was started successfully and the SSL stack should return\r
+ * immediately without calling the resume callback yet.\r
+ * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external\r
+ * processor does not support this key. The SSL stack will\r
+ * use the private key object instead.\r
+ * \return Any other error indicates a fatal failure and is\r
+ * propagated up the call chain. The callback should\r
+ * use \c MBEDTLS_ERR_PK_xxx error codes, and <b>must not</b>\r
+ * use \c MBEDTLS_ERR_SSL_xxx error codes except as\r
+ * directed in the documentation of this callback.\r
+ */\r
+typedef int mbedtls_ssl_async_sign_t( mbedtls_ssl_context *ssl,\r
+ mbedtls_x509_crt *cert,\r
+ mbedtls_md_type_t md_alg,\r
+ const unsigned char *hash,\r
+ size_t hash_len );\r
+\r
+/**\r
+ * \brief Callback type: start external decryption operation.\r
+ *\r
+ * This callback is called during an SSL handshake to start\r
+ * an RSA decryption operation using an\r
+ * external processor. The parameter \p cert contains\r
+ * the public key; it is up to the callback function to\r
+ * determine how to access the associated private key.\r
+ *\r
+ * This function typically sends or enqueues a request, and\r
+ * does not wait for the operation to complete. This allows\r
+ * the handshake step to be non-blocking.\r
+ *\r
+ * The parameters \p ssl and \p cert are guaranteed to remain\r
+ * valid throughout the handshake. On the other hand, this\r
+ * function must save the contents of \p input if the value\r
+ * is needed for later processing, because the \p input buffer\r
+ * is no longer valid after this function returns.\r
+ *\r
+ * This function may call mbedtls_ssl_set_async_operation_data()\r
+ * to store an operation context for later retrieval\r
+ * by the resume or cancel callback.\r
+ *\r
+ * \warning RSA decryption as used in TLS is subject to a potential\r
+ * timing side channel attack first discovered by Bleichenbacher\r
+ * in 1998. This attack can be remotely exploitable\r
+ * in practice. To avoid this attack, you must ensure that\r
+ * if the callback performs an RSA decryption, the time it\r
+ * takes to execute and return the result does not depend\r
+ * on whether the RSA decryption succeeded or reported\r
+ * invalid padding.\r
+ *\r
+ * \param ssl The SSL connection instance. It should not be\r
+ * modified other than via\r
+ * mbedtls_ssl_set_async_operation_data().\r
+ * \param cert Certificate containing the public key.\r
+ * In simple cases, this is one of the pointers passed to\r
+ * mbedtls_ssl_conf_own_cert() when configuring the SSL\r
+ * connection. However, if other callbacks are used, this\r
+ * property may not hold. For example, if an SNI callback\r
+ * is registered with mbedtls_ssl_conf_sni(), then\r
+ * this callback determines what certificate is used.\r
+ * \param input Buffer containing the input ciphertext. This buffer\r
+ * is no longer valid when the function returns.\r
+ * \param input_len Size of the \p input buffer in bytes.\r
+ *\r
+ * \return 0 if the operation was started successfully and the SSL\r
+ * stack should call the resume callback immediately.\r
+ * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation\r
+ * was started successfully and the SSL stack should return\r
+ * immediately without calling the resume callback yet.\r
+ * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external\r
+ * processor does not support this key. The SSL stack will\r
+ * use the private key object instead.\r
+ * \return Any other error indicates a fatal failure and is\r
+ * propagated up the call chain. The callback should\r
+ * use \c MBEDTLS_ERR_PK_xxx error codes, and <b>must not</b>\r
+ * use \c MBEDTLS_ERR_SSL_xxx error codes except as\r
+ * directed in the documentation of this callback.\r
+ */\r
+typedef int mbedtls_ssl_async_decrypt_t( mbedtls_ssl_context *ssl,\r
+ mbedtls_x509_crt *cert,\r
+ const unsigned char *input,\r
+ size_t input_len );\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+/**\r
+ * \brief Callback type: resume external operation.\r
+ *\r
+ * This callback is called during an SSL handshake to resume\r
+ * an external operation started by the\r
+ * ::mbedtls_ssl_async_sign_t or\r
+ * ::mbedtls_ssl_async_decrypt_t callback.\r
+ *\r
+ * This function typically checks the status of a pending\r
+ * request or causes the request queue to make progress, and\r
+ * does not wait for the operation to complete. This allows\r
+ * the handshake step to be non-blocking.\r
+ *\r
+ * This function may call mbedtls_ssl_get_async_operation_data()\r
+ * to retrieve an operation context set by the start callback.\r
+ * It may call mbedtls_ssl_set_async_operation_data() to modify\r
+ * this context.\r
+ *\r
+ * Note that when this function returns a status other than\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, it must free any\r
+ * resources associated with the operation.\r
+ *\r
+ * \param ssl The SSL connection instance. It should not be\r
+ * modified other than via\r
+ * mbedtls_ssl_set_async_operation_data().\r
+ * \param output Buffer containing the output (signature or decrypted\r
+ * data) on success.\r
+ * \param output_len On success, number of bytes written to \p output.\r
+ * \param output_size Size of the \p output buffer in bytes.\r
+ *\r
+ * \return 0 if output of the operation is available in the\r
+ * \p output buffer.\r
+ * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation\r
+ * is still in progress. Subsequent requests for progress\r
+ * on the SSL connection will call the resume callback\r
+ * again.\r
+ * \return Any other error means that the operation is aborted.\r
+ * The SSL handshake is aborted. The callback should\r
+ * use \c MBEDTLS_ERR_PK_xxx error codes, and <b>must not</b>\r
+ * use \c MBEDTLS_ERR_SSL_xxx error codes except as\r
+ * directed in the documentation of this callback.\r
+ */\r
+typedef int mbedtls_ssl_async_resume_t( mbedtls_ssl_context *ssl,\r
+ unsigned char *output,\r
+ size_t *output_len,\r
+ size_t output_size );\r
+\r
+/**\r
+ * \brief Callback type: cancel external operation.\r
+ *\r
+ * This callback is called if an SSL connection is closed\r
+ * while an asynchronous operation is in progress. Note that\r
+ * this callback is not called if the\r
+ * ::mbedtls_ssl_async_resume_t callback has run and has\r
+ * returned a value other than\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, since in that case\r
+ * the asynchronous operation has already completed.\r
+ *\r
+ * This function may call mbedtls_ssl_get_async_operation_data()\r
+ * to retrieve an operation context set by the start callback.\r
+ *\r
+ * \param ssl The SSL connection instance. It should not be\r
+ * modified.\r
+ */\r
+typedef void mbedtls_ssl_async_cancel_t( mbedtls_ssl_context *ssl );\r
+#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) && \\r
+ !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN 48\r
+#if defined(MBEDTLS_SHA256_C)\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA256\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 32\r
+#elif defined(MBEDTLS_SHA512_C)\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA384\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 48\r
+#elif defined(MBEDTLS_SHA1_C)\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA1\r
+#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 20\r
+#else\r
+/* This is already checked in check_config.h, but be sure. */\r
+#error "Bad configuration - need SHA-1, SHA-256 or SHA-512 enabled to compute digest of peer CRT."\r
+#endif\r
+#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED &&\r
+ !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */\r
+\r
+/*\r
+ * This structure is used for storing current session data.\r
+ */\r
+struct mbedtls_ssl_session\r
+{\r
+#if defined(MBEDTLS_HAVE_TIME)\r
+ mbedtls_time_t start; /*!< starting time */\r
+#endif\r
+ int ciphersuite; /*!< chosen ciphersuite */\r
+ int compression; /*!< chosen compression */\r
+ size_t id_len; /*!< session id length */\r
+ unsigned char id[32]; /*!< session identifier */\r
+ unsigned char master[48]; /*!< the master secret */\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)\r
+ mbedtls_x509_crt *peer_cert; /*!< peer X.509 cert chain */\r
+#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */\r
+ /*! The digest of the peer's end-CRT. This must be kept to detect CRT\r
+ * changes during renegotiation, mitigating the triple handshake attack. */\r
+ unsigned char *peer_cert_digest;\r
+ size_t peer_cert_digest_len;\r
+ mbedtls_md_type_t peer_cert_digest_type;\r
+#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+ uint32_t verify_result; /*!< verification result */\r
+\r
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)\r
+ unsigned char *ticket; /*!< RFC 5077 session ticket */\r
+ size_t ticket_len; /*!< session ticket length */\r
+ uint32_t ticket_lifetime; /*!< ticket lifetime hint */\r
+#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */\r
+\r
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)\r
+ unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer */\r
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */\r
+\r
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)\r
+ int trunc_hmac; /*!< flag for truncated hmac activation */\r
+#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */\r
+\r
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)\r
+ int encrypt_then_mac; /*!< flag for EtM activation */\r
+#endif\r
+};\r
+\r
+/**\r
+ * SSL/TLS configuration to be shared between mbedtls_ssl_context structures.\r
+ */\r
+struct mbedtls_ssl_config\r
+{\r
+ /* Group items by size (largest first) to minimize padding overhead */\r
+\r
+ /*\r
+ * Pointers\r
+ */\r
+\r
+ const int *ciphersuite_list[4]; /*!< allowed ciphersuites per version */\r
+\r
+ /** Callback for printing debug output */\r
+ void (*f_dbg)(void *, int, const char *, int, const char *);\r
+ void *p_dbg; /*!< context for the debug function */\r
+\r
+ /** Callback for getting (pseudo-)random numbers */\r
+ int (*f_rng)(void *, unsigned char *, size_t);\r
+ void *p_rng; /*!< context for the RNG function */\r
+\r
+ /** Callback to retrieve a session from the cache */\r
+ int (*f_get_cache)(void *, mbedtls_ssl_session *);\r
+ /** Callback to store a session into the cache */\r
+ int (*f_set_cache)(void *, const mbedtls_ssl_session *);\r
+ void *p_cache; /*!< context for cache callbacks */\r
+\r
+#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)\r
+ /** Callback for setting cert according to SNI extension */\r
+ int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, size_t);\r
+ void *p_sni; /*!< context for SNI callback */\r
+#endif\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+ /** Callback to customize X.509 certificate chain verification */\r
+ int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);\r
+ void *p_vrfy; /*!< context for X.509 verify calllback */\r
+#endif\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)\r
+ /** Callback to retrieve PSK key from identity */\r
+ int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, size_t);\r
+ void *p_psk; /*!< context for PSK callback */\r
+#endif\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)\r
+ /** Callback to create & write a cookie for ClientHello veirifcation */\r
+ int (*f_cookie_write)( void *, unsigned char **, unsigned char *,\r
+ const unsigned char *, size_t );\r
+ /** Callback to verify validity of a ClientHello cookie */\r
+ int (*f_cookie_check)( void *, const unsigned char *, size_t,\r
+ const unsigned char *, size_t );\r
+ void *p_cookie; /*!< context for the cookie callbacks */\r
+#endif\r
+\r
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C)\r
+ /** Callback to create & write a session ticket */\r
+ int (*f_ticket_write)( void *, const mbedtls_ssl_session *,\r
+ unsigned char *, const unsigned char *, size_t *, uint32_t * );\r
+ /** Callback to parse a session ticket into a session structure */\r
+ int (*f_ticket_parse)( void *, mbedtls_ssl_session *, unsigned char *, size_t);\r
+ void *p_ticket; /*!< context for the ticket callbacks */\r
+#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */\r
+\r
+#if defined(MBEDTLS_SSL_EXPORT_KEYS)\r
+ /** Callback to export key block and master secret */\r
+ int (*f_export_keys)( void *, const unsigned char *,\r
+ const unsigned char *, size_t, size_t, size_t );\r
+ /** Callback to export key block, master secret,\r
+ * tls_prf and random bytes. Should replace f_export_keys */\r
+ int (*f_export_keys_ext)( void *, const unsigned char *,\r
+ const unsigned char *, size_t, size_t, size_t,\r
+ unsigned char[32], unsigned char[32], mbedtls_tls_prf_types );\r
+ void *p_export_keys; /*!< context for key export callback */\r
+#endif\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+ size_t cid_len; /*!< The length of CIDs for incoming DTLS records. */\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+ const mbedtls_x509_crt_profile *cert_profile; /*!< verification profile */\r
+ mbedtls_ssl_key_cert *key_cert; /*!< own certificate/key pair(s) */\r
+ mbedtls_x509_crt *ca_chain; /*!< trusted CAs */\r
+ mbedtls_x509_crl *ca_crl; /*!< trusted CAs CRLs */\r
+#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)\r
+ mbedtls_x509_crt_ca_cb_t f_ca_cb;\r
+ void *p_ca_cb;\r
+#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+ mbedtls_ssl_async_sign_t *f_async_sign_start; /*!< start asynchronous signature operation */\r
+ mbedtls_ssl_async_decrypt_t *f_async_decrypt_start; /*!< start asynchronous decryption operation */\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+ mbedtls_ssl_async_resume_t *f_async_resume; /*!< resume asynchronous operation */\r
+ mbedtls_ssl_async_cancel_t *f_async_cancel; /*!< cancel asynchronous operation */\r
+ void *p_async_config_data; /*!< Configuration data set by mbedtls_ssl_conf_async_private_cb(). */\r
+#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)\r
+ const int *sig_hashes; /*!< allowed signature hashes */\r
+#endif\r
+\r
+#if defined(MBEDTLS_ECP_C)\r
+ const mbedtls_ecp_group_id *curve_list; /*!< allowed curves */\r
+#endif\r
+\r
+#if defined(MBEDTLS_DHM_C)\r
+ mbedtls_mpi dhm_P; /*!< prime modulus for DHM */\r
+ mbedtls_mpi dhm_G; /*!< generator for DHM */\r
+#endif\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)\r
+\r
+#if defined(MBEDTLS_USE_PSA_CRYPTO)\r
+ psa_key_handle_t psk_opaque; /*!< PSA key slot holding opaque PSK.\r
+ * This field should only be set via\r
+ * mbedtls_ssl_conf_psk_opaque().\r
+ * If either no PSK or a raw PSK have\r
+ * been configured, this has value \c 0. */\r
+#endif /* MBEDTLS_USE_PSA_CRYPTO */\r
+\r
+ unsigned char *psk; /*!< The raw pre-shared key. This field should\r
+ * only be set via mbedtls_ssl_conf_psk().\r
+ * If either no PSK or an opaque PSK\r
+ * have been configured, this has value NULL. */\r
+ size_t psk_len; /*!< The length of the raw pre-shared key.\r
+ * This field should only be set via\r
+ * mbedtls_ssl_conf_psk().\r
+ * Its value is non-zero if and only if\r
+ * \c psk is not \c NULL. */\r
+\r
+ unsigned char *psk_identity; /*!< The PSK identity for PSK negotiation.\r
+ * This field should only be set via\r
+ * mbedtls_ssl_conf_psk().\r
+ * This is set if and only if either\r
+ * \c psk or \c psk_opaque are set. */\r
+ size_t psk_identity_len;/*!< The length of PSK identity.\r
+ * This field should only be set via\r
+ * mbedtls_ssl_conf_psk().\r
+ * Its value is non-zero if and only if\r
+ * \c psk is not \c NULL or \c psk_opaque\r
+ * is not \c 0. */\r
+#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */\r
+\r
+#if defined(MBEDTLS_SSL_ALPN)\r
+ const char **alpn_list; /*!< ordered list of protocols */\r
+#endif\r
+\r
+ /*\r
+ * Numerical settings (int then char)\r
+ */\r
+\r
+ uint32_t read_timeout; /*!< timeout for mbedtls_ssl_read (ms) */\r
+\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+ uint32_t hs_timeout_min; /*!< initial value of the handshake\r
+ retransmission timeout (ms) */\r
+ uint32_t hs_timeout_max; /*!< maximum value of the handshake\r
+ retransmission timeout (ms) */\r
+#endif\r
+\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+ int renego_max_records; /*!< grace period for renegotiation */\r
+ unsigned char renego_period[8]; /*!< value of the record counters\r
+ that triggers renegotiation */\r
+#endif\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)\r
+ unsigned int badmac_limit; /*!< limit of records with a bad MAC */\r
+#endif\r
+\r
+#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)\r
+ unsigned int dhm_min_bitlen; /*!< min. bit length of the DHM prime */\r
+#endif\r
+\r
+ unsigned char max_major_ver; /*!< max. major version used */\r
+ unsigned char max_minor_ver; /*!< max. minor version used */\r
+ unsigned char min_major_ver; /*!< min. major version used */\r
+ unsigned char min_minor_ver; /*!< min. minor version used */\r
+\r
+ /*\r
+ * Flags (bitfields)\r
+ */\r
+\r
+ unsigned int endpoint : 1; /*!< 0: client, 1: server */\r
+ unsigned int transport : 1; /*!< stream (TLS) or datagram (DTLS) */\r
+ unsigned int authmode : 2; /*!< MBEDTLS_SSL_VERIFY_XXX */\r
+ /* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */\r
+ unsigned int allow_legacy_renegotiation : 2 ; /*!< MBEDTLS_LEGACY_XXX */\r
+#if defined(MBEDTLS_ARC4_C)\r
+ unsigned int arc4_disabled : 1; /*!< blacklist RC4 ciphersuites? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)\r
+ unsigned int mfl_code : 3; /*!< desired fragment length */\r
+#endif\r
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)\r
+ unsigned int encrypt_then_mac : 1 ; /*!< negotiate encrypt-then-mac? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)\r
+ unsigned int extended_ms : 1; /*!< negotiate extended master secret? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)\r
+ unsigned int anti_replay : 1; /*!< detect and prevent replay? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)\r
+ unsigned int cbc_record_splitting : 1; /*!< do cbc record splitting */\r
+#endif\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+ unsigned int disable_renegotiation : 1; /*!< disable renegotiation? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)\r
+ unsigned int trunc_hmac : 1; /*!< negotiate truncated hmac? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)\r
+ unsigned int session_tickets : 1; /*!< use session tickets? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)\r
+ unsigned int fallback : 1; /*!< is this a fallback? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_SRV_C)\r
+ unsigned int cert_req_ca_list : 1; /*!< enable sending CA list in\r
+ Certificate Request messages? */\r
+#endif\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+ unsigned int ignore_unexpected_cid : 1; /*!< Determines whether DTLS\r
+ * record with unexpected CID\r
+ * should lead to failure. */\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+};\r
+\r
+\r
+struct mbedtls_ssl_context\r
+{\r
+ const mbedtls_ssl_config *conf; /*!< configuration information */\r
+\r
+ /*\r
+ * Miscellaneous\r
+ */\r
+ int state; /*!< SSL handshake: current state */\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+ int renego_status; /*!< Initial, in progress, pending? */\r
+ int renego_records_seen; /*!< Records since renego request, or with DTLS,\r
+ number of retransmissions of request if\r
+ renego_max_records is < 0 */\r
+#endif /* MBEDTLS_SSL_RENEGOTIATION */\r
+\r
+ int major_ver; /*!< equal to MBEDTLS_SSL_MAJOR_VERSION_3 */\r
+ int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)\r
+ unsigned badmac_seen; /*!< records with a bad MAC received */\r
+#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+ /** Callback to customize X.509 certificate chain verification */\r
+ int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);\r
+ void *p_vrfy; /*!< context for X.509 verify callback */\r
+#endif\r
+\r
+ mbedtls_ssl_send_t *f_send; /*!< Callback for network send */\r
+ mbedtls_ssl_recv_t *f_recv; /*!< Callback for network receive */\r
+ mbedtls_ssl_recv_timeout_t *f_recv_timeout;\r
+ /*!< Callback for network receive with timeout */\r
+\r
+ void *p_bio; /*!< context for I/O operations */\r
+\r
+ /*\r
+ * Session layer\r
+ */\r
+ mbedtls_ssl_session *session_in; /*!< current session data (in) */\r
+ mbedtls_ssl_session *session_out; /*!< current session data (out) */\r
+ mbedtls_ssl_session *session; /*!< negotiated session data */\r
+ mbedtls_ssl_session *session_negotiate; /*!< session data in negotiation */\r
+\r
+ mbedtls_ssl_handshake_params *handshake; /*!< params required only during\r
+ the handshake process */\r
+\r
+ /*\r
+ * Record layer transformations\r
+ */\r
+ mbedtls_ssl_transform *transform_in; /*!< current transform params (in) */\r
+ mbedtls_ssl_transform *transform_out; /*!< current transform params (in) */\r
+ mbedtls_ssl_transform *transform; /*!< negotiated transform params */\r
+ mbedtls_ssl_transform *transform_negotiate; /*!< transform params in negotiation */\r
+\r
+ /*\r
+ * Timers\r
+ */\r
+ void *p_timer; /*!< context for the timer callbacks */\r
+\r
+ mbedtls_ssl_set_timer_t *f_set_timer; /*!< set timer callback */\r
+ mbedtls_ssl_get_timer_t *f_get_timer; /*!< get timer callback */\r
+\r
+ /*\r
+ * Record layer (incoming data)\r
+ */\r
+ unsigned char *in_buf; /*!< input buffer */\r
+ unsigned char *in_ctr; /*!< 64-bit incoming message counter\r
+ TLS: maintained by us\r
+ DTLS: read from peer */\r
+ unsigned char *in_hdr; /*!< start of record header */\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+ unsigned char *in_cid; /*!< The start of the CID;\r
+ * (the end is marked by in_len). */\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+ unsigned char *in_len; /*!< two-bytes message length field */\r
+ unsigned char *in_iv; /*!< ivlen-byte IV */\r
+ unsigned char *in_msg; /*!< message contents (in_iv+ivlen) */\r
+ unsigned char *in_offt; /*!< read offset in application data */\r
+\r
+ int in_msgtype; /*!< record header: message type */\r
+ size_t in_msglen; /*!< record header: message length */\r
+ size_t in_left; /*!< amount of data read so far */\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+ uint16_t in_epoch; /*!< DTLS epoch for incoming records */\r
+ size_t next_record_offset; /*!< offset of the next record in datagram\r
+ (equal to in_left if none) */\r
+#endif /* MBEDTLS_SSL_PROTO_DTLS */\r
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)\r
+ uint64_t in_window_top; /*!< last validated record seq_num */\r
+ uint64_t in_window; /*!< bitmask for replay detection */\r
+#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */\r
+\r
+ size_t in_hslen; /*!< current handshake message length,\r
+ including the handshake header */\r
+ int nb_zero; /*!< # of 0-length encrypted messages */\r
+\r
+ int keep_current_message; /*!< drop or reuse current message\r
+ on next call to record layer? */\r
+\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+ uint8_t disable_datagram_packing; /*!< Disable packing multiple records\r
+ * within a single datagram. */\r
+#endif /* MBEDTLS_SSL_PROTO_DTLS */\r
+\r
+ /*\r
+ * Record layer (outgoing data)\r
+ */\r
+ unsigned char *out_buf; /*!< output buffer */\r
+ unsigned char *out_ctr; /*!< 64-bit outgoing message counter */\r
+ unsigned char *out_hdr; /*!< start of record header */\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+ unsigned char *out_cid; /*!< The start of the CID;\r
+ * (the end is marked by in_len). */\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+ unsigned char *out_len; /*!< two-bytes message length field */\r
+ unsigned char *out_iv; /*!< ivlen-byte IV */\r
+ unsigned char *out_msg; /*!< message contents (out_iv+ivlen) */\r
+\r
+ int out_msgtype; /*!< record header: message type */\r
+ size_t out_msglen; /*!< record header: message length */\r
+ size_t out_left; /*!< amount of data not yet written */\r
+\r
+ unsigned char cur_out_ctr[8]; /*!< Outgoing record sequence number. */\r
+\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+ uint16_t mtu; /*!< path mtu, used to fragment outgoing messages */\r
+#endif /* MBEDTLS_SSL_PROTO_DTLS */\r
+\r
+#if defined(MBEDTLS_ZLIB_SUPPORT)\r
+ unsigned char *compress_buf; /*!< zlib data buffer */\r
+#endif /* MBEDTLS_ZLIB_SUPPORT */\r
+#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)\r
+ signed char split_done; /*!< current record already splitted? */\r
+#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */\r
+\r
+ /*\r
+ * PKI layer\r
+ */\r
+ int client_auth; /*!< flag for client auth. */\r
+\r
+ /*\r
+ * User settings\r
+ */\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+ char *hostname; /*!< expected peer CN for verification\r
+ (and SNI if available) */\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+#if defined(MBEDTLS_SSL_ALPN)\r
+ const char *alpn_chosen; /*!< negotiated protocol */\r
+#endif /* MBEDTLS_SSL_ALPN */\r
+\r
+ /*\r
+ * Information for DTLS hello verify\r
+ */\r
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)\r
+ unsigned char *cli_id; /*!< transport-level ID of the client */\r
+ size_t cli_id_len; /*!< length of cli_id */\r
+#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */\r
+\r
+ /*\r
+ * Secure renegotiation\r
+ */\r
+ /* needed to know when to send extension on server */\r
+ int secure_renegotiation; /*!< does peer support legacy or\r
+ secure renegotiation */\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+ size_t verify_data_len; /*!< length of verify data stored */\r
+ char own_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */\r
+ char peer_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */\r
+#endif /* MBEDTLS_SSL_RENEGOTIATION */\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+ /* CID configuration to use in subsequent handshakes. */\r
+\r
+ /*! The next incoming CID, chosen by the user and applying to\r
+ * all subsequent handshakes. This may be different from the\r
+ * CID currently used in case the user has re-configured the CID\r
+ * after an initial handshake. */\r
+ unsigned char own_cid[ MBEDTLS_SSL_CID_IN_LEN_MAX ];\r
+ uint8_t own_cid_len; /*!< The length of \c own_cid. */\r
+ uint8_t negotiate_cid; /*!< This indicates whether the CID extension should\r
+ * be negotiated in the next handshake or not.\r
+ * Possible values are #MBEDTLS_SSL_CID_ENABLED\r
+ * and #MBEDTLS_SSL_CID_DISABLED. */\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+};\r
+\r
+#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)\r
+\r
+#define MBEDTLS_SSL_CHANNEL_OUTBOUND 0\r
+#define MBEDTLS_SSL_CHANNEL_INBOUND 1\r
+\r
+extern int (*mbedtls_ssl_hw_record_init)(mbedtls_ssl_context *ssl,\r
+ const unsigned char *key_enc, const unsigned char *key_dec,\r
+ size_t keylen,\r
+ const unsigned char *iv_enc, const unsigned char *iv_dec,\r
+ size_t ivlen,\r
+ const unsigned char *mac_enc, const unsigned char *mac_dec,\r
+ size_t maclen);\r
+extern int (*mbedtls_ssl_hw_record_activate)(mbedtls_ssl_context *ssl, int direction);\r
+extern int (*mbedtls_ssl_hw_record_reset)(mbedtls_ssl_context *ssl);\r
+extern int (*mbedtls_ssl_hw_record_write)(mbedtls_ssl_context *ssl);\r
+extern int (*mbedtls_ssl_hw_record_read)(mbedtls_ssl_context *ssl);\r
+extern int (*mbedtls_ssl_hw_record_finish)(mbedtls_ssl_context *ssl);\r
+#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */\r
+\r
+/**\r
+ * \brief Return the name of the ciphersuite associated with the\r
+ * given ID\r
+ *\r
+ * \param ciphersuite_id SSL ciphersuite ID\r
+ *\r
+ * \return a string containing the ciphersuite name\r
+ */\r
+const char *mbedtls_ssl_get_ciphersuite_name( const int ciphersuite_id );\r
+\r
+/**\r
+ * \brief Return the ID of the ciphersuite associated with the\r
+ * given name\r
+ *\r
+ * \param ciphersuite_name SSL ciphersuite name\r
+ *\r
+ * \return the ID with the ciphersuite or 0 if not found\r
+ */\r
+int mbedtls_ssl_get_ciphersuite_id( const char *ciphersuite_name );\r
+\r
+/**\r
+ * \brief Initialize an SSL context\r
+ * Just makes the context ready for mbedtls_ssl_setup() or\r
+ * mbedtls_ssl_free()\r
+ *\r
+ * \param ssl SSL context\r
+ */\r
+void mbedtls_ssl_init( mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Set up an SSL context for use\r
+ *\r
+ * \note No copy of the configuration context is made, it can be\r
+ * shared by many mbedtls_ssl_context structures.\r
+ *\r
+ * \warning The conf structure will be accessed during the session.\r
+ * It must not be modified or freed as long as the session\r
+ * is active.\r
+ *\r
+ * \warning This function must be called exactly once per context.\r
+ * Calling mbedtls_ssl_setup again is not supported, even\r
+ * if no session is active.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param conf SSL configuration to use\r
+ *\r
+ * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED if\r
+ * memory allocation failed\r
+ */\r
+int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,\r
+ const mbedtls_ssl_config *conf );\r
+\r
+/**\r
+ * \brief Reset an already initialized SSL context for re-use\r
+ * while retaining application-set variables, function\r
+ * pointers and data.\r
+ *\r
+ * \param ssl SSL context\r
+ * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED,\r
+ MBEDTLS_ERR_SSL_HW_ACCEL_FAILED or\r
+ * MBEDTLS_ERR_SSL_COMPRESSION_FAILED\r
+ */\r
+int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Set the current endpoint type\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param endpoint must be MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER\r
+ */\r
+void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint );\r
+\r
+/**\r
+ * \brief Set the transport type (TLS or DTLS).\r
+ * Default: TLS\r
+ *\r
+ * \note For DTLS, you must either provide a recv callback that\r
+ * doesn't block, or one that handles timeouts, see\r
+ * \c mbedtls_ssl_set_bio(). You also need to provide timer\r
+ * callbacks with \c mbedtls_ssl_set_timer_cb().\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param transport transport type:\r
+ * MBEDTLS_SSL_TRANSPORT_STREAM for TLS,\r
+ * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS.\r
+ */\r
+void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport );\r
+\r
+/**\r
+ * \brief Set the certificate verification mode\r
+ * Default: NONE on server, REQUIRED on client\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param authmode can be:\r
+ *\r
+ * MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked\r
+ * (default on server)\r
+ * (insecure on client)\r
+ *\r
+ * MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the\r
+ * handshake continues even if verification failed;\r
+ * mbedtls_ssl_get_verify_result() can be called after the\r
+ * handshake is complete.\r
+ *\r
+ * MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate,\r
+ * handshake is aborted if verification failed.\r
+ * (default on client)\r
+ *\r
+ * \note On client, MBEDTLS_SSL_VERIFY_REQUIRED is the recommended mode.\r
+ * With MBEDTLS_SSL_VERIFY_OPTIONAL, the user needs to call mbedtls_ssl_get_verify_result() at\r
+ * the right time(s), which may not be obvious, while REQUIRED always perform\r
+ * the verification as soon as possible. For example, REQUIRED was protecting\r
+ * against the "triple handshake" attack even before it was found.\r
+ */\r
+void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode );\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+/**\r
+ * \brief Set the verification callback (Optional).\r
+ *\r
+ * If set, the provided verify callback is called for each\r
+ * certificate in the peer's CRT chain, including the trusted\r
+ * root. For more information, please see the documentation of\r
+ * \c mbedtls_x509_crt_verify().\r
+ *\r
+ * \note For per context callbacks and contexts, please use\r
+ * mbedtls_ssl_set_verify() instead.\r
+ *\r
+ * \param conf The SSL configuration to use.\r
+ * \param f_vrfy The verification callback to use during CRT verification.\r
+ * \param p_vrfy The opaque context to be passed to the callback.\r
+ */\r
+void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,\r
+ int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),\r
+ void *p_vrfy );\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+/**\r
+ * \brief Set the random number generator callback\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param f_rng RNG function\r
+ * \param p_rng RNG parameter\r
+ */\r
+void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,\r
+ int (*f_rng)(void *, unsigned char *, size_t),\r
+ void *p_rng );\r
+\r
+/**\r
+ * \brief Set the debug callback\r
+ *\r
+ * The callback has the following argument:\r
+ * void * opaque context for the callback\r
+ * int debug level\r
+ * const char * file name\r
+ * int line number\r
+ * const char * message\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param f_dbg debug function\r
+ * \param p_dbg debug parameter\r
+ */\r
+void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,\r
+ void (*f_dbg)(void *, int, const char *, int, const char *),\r
+ void *p_dbg );\r
+\r
+/**\r
+ * \brief Set the underlying BIO callbacks for write, read and\r
+ * read-with-timeout.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param p_bio parameter (context) shared by BIO callbacks\r
+ * \param f_send write callback\r
+ * \param f_recv read callback\r
+ * \param f_recv_timeout blocking read callback with timeout.\r
+ *\r
+ * \note One of f_recv or f_recv_timeout can be NULL, in which case\r
+ * the other is used. If both are non-NULL, f_recv_timeout is\r
+ * used and f_recv is ignored (as if it were NULL).\r
+ *\r
+ * \note The two most common use cases are:\r
+ * - non-blocking I/O, f_recv != NULL, f_recv_timeout == NULL\r
+ * - blocking I/O, f_recv == NULL, f_recv_timout != NULL\r
+ *\r
+ * \note For DTLS, you need to provide either a non-NULL\r
+ * f_recv_timeout callback, or a f_recv that doesn't block.\r
+ *\r
+ * \note See the documentations of \c mbedtls_ssl_sent_t,\r
+ * \c mbedtls_ssl_recv_t and \c mbedtls_ssl_recv_timeout_t for\r
+ * the conventions those callbacks must follow.\r
+ *\r
+ * \note On some platforms, net_sockets.c provides\r
+ * \c mbedtls_net_send(), \c mbedtls_net_recv() and\r
+ * \c mbedtls_net_recv_timeout() that are suitable to be used\r
+ * here.\r
+ */\r
+void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,\r
+ void *p_bio,\r
+ mbedtls_ssl_send_t *f_send,\r
+ mbedtls_ssl_recv_t *f_recv,\r
+ mbedtls_ssl_recv_timeout_t *f_recv_timeout );\r
+\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+\r
+\r
+/**\r
+ * \brief Configure the use of the Connection ID (CID)\r
+ * extension in the next handshake.\r
+ *\r
+ * Reference: draft-ietf-tls-dtls-connection-id-05\r
+ * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05\r
+ *\r
+ * The DTLS CID extension allows the reliable association of\r
+ * DTLS records to DTLS connections across changes in the\r
+ * underlying transport (changed IP and Port metadata) by\r
+ * adding explicit connection identifiers (CIDs) to the\r
+ * headers of encrypted DTLS records. The desired CIDs are\r
+ * configured by the application layer and are exchanged in\r
+ * new `ClientHello` / `ServerHello` extensions during the\r
+ * handshake, where each side indicates the CID it wants the\r
+ * peer to use when writing encrypted messages. The CIDs are\r
+ * put to use once records get encrypted: the stack discards\r
+ * any incoming records that don't include the configured CID\r
+ * in their header, and adds the peer's requested CID to the\r
+ * headers of outgoing messages.\r
+ *\r
+ * This API enables or disables the use of the CID extension\r
+ * in the next handshake and sets the value of the CID to\r
+ * be used for incoming messages.\r
+ *\r
+ * \param ssl The SSL context to configure. This must be initialized.\r
+ * \param enable This value determines whether the CID extension should\r
+ * be used or not. Possible values are:\r
+ * - MBEDTLS_SSL_CID_ENABLED to enable the use of the CID.\r
+ * - MBEDTLS_SSL_CID_DISABLED (default) to disable the use\r
+ * of the CID.\r
+ * \param own_cid The address of the readable buffer holding the CID we want\r
+ * the peer to use when sending encrypted messages to us.\r
+ * This may be \c NULL if \p own_cid_len is \c 0.\r
+ * This parameter is unused if \p enabled is set to\r
+ * MBEDTLS_SSL_CID_DISABLED.\r
+ * \param own_cid_len The length of \p own_cid.\r
+ * This parameter is unused if \p enabled is set to\r
+ * MBEDTLS_SSL_CID_DISABLED.\r
+ *\r
+ * \note The value of \p own_cid_len must match the value of the\r
+ * \c len parameter passed to mbedtls_ssl_conf_cid()\r
+ * when configuring the ::mbedtls_ssl_config that \p ssl\r
+ * is bound to.\r
+ *\r
+ * \note This CID configuration applies to subsequent handshakes\r
+ * performed on the SSL context \p ssl, but does not trigger\r
+ * one. You still have to call `mbedtls_ssl_handshake()`\r
+ * (for the initial handshake) or `mbedtls_ssl_renegotiate()`\r
+ * (for a renegotiation handshake) explicitly after a\r
+ * successful call to this function to run the handshake.\r
+ *\r
+ * \note This call cannot guarantee that the use of the CID\r
+ * will be successfully negotiated in the next handshake,\r
+ * because the peer might not support it. Specifically:\r
+ * - On the Client, enabling the use of the CID through\r
+ * this call implies that the `ClientHello` in the next\r
+ * handshake will include the CID extension, thereby\r
+ * offering the use of the CID to the server. Only if\r
+ * the `ServerHello` contains the CID extension, too,\r
+ * the CID extension will actually be put to use.\r
+ * - On the Server, enabling the use of the CID through\r
+ * this call implies that that the server will look for\r
+ * the CID extension in a `ClientHello` from the client,\r
+ * and, if present, reply with a CID extension in its\r
+ * `ServerHello`.\r
+ *\r
+ * \note To check whether the use of the CID was negotiated\r
+ * after the subsequent handshake has completed, please\r
+ * use the API mbedtls_ssl_get_peer_cid().\r
+ *\r
+ * \warning If the use of the CID extension is enabled in this call\r
+ * and the subsequent handshake negotiates its use, Mbed TLS\r
+ * will silently drop every packet whose CID does not match\r
+ * the CID configured in \p own_cid. It is the responsibility\r
+ * of the user to adapt the underlying transport to take care\r
+ * of CID-based demultiplexing before handing datagrams to\r
+ * Mbed TLS.\r
+ *\r
+ * \return \c 0 on success. In this case, the CID configuration\r
+ * applies to the next handshake.\r
+ * \return A negative error code on failure.\r
+ */\r
+int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,\r
+ int enable,\r
+ unsigned char const *own_cid,\r
+ size_t own_cid_len );\r
+\r
+/**\r
+ * \brief Get information about the use of the CID extension\r
+ * in the current connection.\r
+ *\r
+ * \param ssl The SSL context to query.\r
+ * \param enabled The address at which to store whether the CID extension\r
+ * is currently in use or not. If the CID is in use,\r
+ * `*enabled` is set to MBEDTLS_SSL_CID_ENABLED;\r
+ * otherwise, it is set to MBEDTLS_SSL_CID_DISABLED.\r
+ * \param peer_cid The address of the buffer in which to store the CID\r
+ * chosen by the peer (if the CID extension is used).\r
+ * This may be \c NULL in case the value of peer CID\r
+ * isn't needed. If it is not \c NULL, \p peer_cid_len\r
+ * must not be \c NULL.\r
+ * \param peer_cid_len The address at which to store the size of the CID\r
+ * chosen by the peer (if the CID extension is used).\r
+ * This is also the number of Bytes in \p peer_cid that\r
+ * have been written.\r
+ * This may be \c NULL in case the length of the peer CID\r
+ * isn't needed. If it is \c NULL, \p peer_cid must be\r
+ * \c NULL, too.\r
+ *\r
+ * \note This applies to the state of the CID negotiated in\r
+ * the last complete handshake. If a handshake is in\r
+ * progress, this function will attempt to complete\r
+ * the handshake first.\r
+ *\r
+ * \note If CID extensions have been exchanged but both client\r
+ * and server chose to use an empty CID, this function\r
+ * sets `*enabled` to #MBEDTLS_SSL_CID_DISABLED\r
+ * (the rationale for this is that the resulting\r
+ * communication is the same as if the CID extensions\r
+ * hadn't been used).\r
+ *\r
+ * \return \c 0 on success.\r
+ * \return A negative error code on failure.\r
+ */\r
+int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,\r
+ int *enabled,\r
+ unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],\r
+ size_t *peer_cid_len );\r
+\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+\r
+/**\r
+ * \brief Set the Maximum Tranport Unit (MTU).\r
+ * Special value: 0 means unset (no limit).\r
+ * This represents the maximum size of a datagram payload\r
+ * handled by the transport layer (usually UDP) as determined\r
+ * by the network link and stack. In practice, this controls\r
+ * the maximum size datagram the DTLS layer will pass to the\r
+ * \c f_send() callback set using \c mbedtls_ssl_set_bio().\r
+ *\r
+ * \note The limit on datagram size is converted to a limit on\r
+ * record payload by subtracting the current overhead of\r
+ * encapsulation and encryption/authentication if any.\r
+ *\r
+ * \note This can be called at any point during the connection, for\r
+ * example when a Path Maximum Transfer Unit (PMTU)\r
+ * estimate becomes available from other sources,\r
+ * such as lower (or higher) protocol layers.\r
+ *\r
+ * \note This setting only controls the size of the packets we send,\r
+ * and does not restrict the size of the datagrams we're\r
+ * willing to receive. Client-side, you can request the\r
+ * server to use smaller records with \c\r
+ * mbedtls_ssl_conf_max_frag_len().\r
+ *\r
+ * \note If both a MTU and a maximum fragment length have been\r
+ * configured (or negotiated with the peer), the resulting\r
+ * lower limit on record payload (see first note) is used.\r
+ *\r
+ * \note This can only be used to decrease the maximum size\r
+ * of datagrams (hence records, see first note) sent. It\r
+ * cannot be used to increase the maximum size of records over\r
+ * the limit set by #MBEDTLS_SSL_OUT_CONTENT_LEN.\r
+ *\r
+ * \note Values lower than the current record layer expansion will\r
+ * result in an error when trying to send data.\r
+ *\r
+ * \note Using record compression together with a non-zero MTU value\r
+ * will result in an error when trying to send data.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param mtu Value of the path MTU in bytes\r
+ */\r
+void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu );\r
+#endif /* MBEDTLS_SSL_PROTO_DTLS */\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+/**\r
+ * \brief Set a connection-specific verification callback (optional).\r
+ *\r
+ * If set, the provided verify callback is called for each\r
+ * certificate in the peer's CRT chain, including the trusted\r
+ * root. For more information, please see the documentation of\r
+ * \c mbedtls_x509_crt_verify().\r
+ *\r
+ * \note This call is analogous to mbedtls_ssl_conf_verify() but\r
+ * binds the verification callback and context to an SSL context\r
+ * as opposed to an SSL configuration.\r
+ * If mbedtls_ssl_conf_verify() and mbedtls_ssl_set_verify()\r
+ * are both used, mbedtls_ssl_set_verify() takes precedence.\r
+ *\r
+ * \param ssl The SSL context to use.\r
+ * \param f_vrfy The verification callback to use during CRT verification.\r
+ * \param p_vrfy The opaque context to be passed to the callback.\r
+ */\r
+void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,\r
+ int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),\r
+ void *p_vrfy );\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+/**\r
+ * \brief Set the timeout period for mbedtls_ssl_read()\r
+ * (Default: no timeout.)\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \param timeout Timeout value in milliseconds.\r
+ * Use 0 for no timeout (default).\r
+ *\r
+ * \note With blocking I/O, this will only work if a non-NULL\r
+ * \c f_recv_timeout was set with \c mbedtls_ssl_set_bio().\r
+ * With non-blocking I/O, this will only work if timer\r
+ * callbacks were set with \c mbedtls_ssl_set_timer_cb().\r
+ *\r
+ * \note With non-blocking I/O, you may also skip this function\r
+ * altogether and handle timeouts at the application layer.\r
+ */\r
+void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout );\r
+\r
+/**\r
+ * \brief Set the timer callbacks (Mandatory for DTLS.)\r
+ *\r
+ * \param ssl SSL context\r
+ * \param p_timer parameter (context) shared by timer callbacks\r
+ * \param f_set_timer set timer callback\r
+ * \param f_get_timer get timer callback. Must return:\r
+ *\r
+ * \note See the documentation of \c mbedtls_ssl_set_timer_t and\r
+ * \c mbedtls_ssl_get_timer_t for the conventions this pair of\r
+ * callbacks must follow.\r
+ *\r
+ * \note On some platforms, timing.c provides\r
+ * \c mbedtls_timing_set_delay() and\r
+ * \c mbedtls_timing_get_delay() that are suitable for using\r
+ * here, except if using an event-driven style.\r
+ *\r
+ * \note See also the "DTLS tutorial" article in our knowledge base.\r
+ * https://tls.mbed.org/kb/how-to/dtls-tutorial\r
+ */\r
+void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,\r
+ void *p_timer,\r
+ mbedtls_ssl_set_timer_t *f_set_timer,\r
+ mbedtls_ssl_get_timer_t *f_get_timer );\r
+\r
+/**\r
+ * \brief Callback type: generate and write session ticket\r
+ *\r
+ * \note This describes what a callback implementation should do.\r
+ * This callback should generate an encrypted and\r
+ * authenticated ticket for the session and write it to the\r
+ * output buffer. Here, ticket means the opaque ticket part\r
+ * of the NewSessionTicket structure of RFC 5077.\r
+ *\r
+ * \param p_ticket Context for the callback\r
+ * \param session SSL session to be written in the ticket\r
+ * \param start Start of the output buffer\r
+ * \param end End of the output buffer\r
+ * \param tlen On exit, holds the length written\r
+ * \param lifetime On exit, holds the lifetime of the ticket in seconds\r
+ *\r
+ * \return 0 if successful, or\r
+ * a specific MBEDTLS_ERR_XXX code.\r
+ */\r
+typedef int mbedtls_ssl_ticket_write_t( void *p_ticket,\r
+ const mbedtls_ssl_session *session,\r
+ unsigned char *start,\r
+ const unsigned char *end,\r
+ size_t *tlen,\r
+ uint32_t *lifetime );\r
+\r
+#if defined(MBEDTLS_SSL_EXPORT_KEYS)\r
+/**\r
+ * \brief Callback type: Export key block and master secret\r
+ *\r
+ * \note This is required for certain uses of TLS, e.g. EAP-TLS\r
+ * (RFC 5216) and Thread. The key pointers are ephemeral and\r
+ * therefore must not be stored. The master secret and keys\r
+ * should not be used directly except as an input to a key\r
+ * derivation function.\r
+ *\r
+ * \param p_expkey Context for the callback\r
+ * \param ms Pointer to master secret (fixed length: 48 bytes)\r
+ * \param kb Pointer to key block, see RFC 5246 section 6.3\r
+ * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen).\r
+ * \param maclen MAC length\r
+ * \param keylen Key length\r
+ * \param ivlen IV length\r
+ *\r
+ * \return 0 if successful, or\r
+ * a specific MBEDTLS_ERR_XXX code.\r
+ */\r
+typedef int mbedtls_ssl_export_keys_t( void *p_expkey,\r
+ const unsigned char *ms,\r
+ const unsigned char *kb,\r
+ size_t maclen,\r
+ size_t keylen,\r
+ size_t ivlen );\r
+\r
+/**\r
+ * \brief Callback type: Export key block, master secret,\r
+ * handshake randbytes and the tls_prf function\r
+ * used to derive keys.\r
+ *\r
+ * \note This is required for certain uses of TLS, e.g. EAP-TLS\r
+ * (RFC 5216) and Thread. The key pointers are ephemeral and\r
+ * therefore must not be stored. The master secret and keys\r
+ * should not be used directly except as an input to a key\r
+ * derivation function.\r
+ *\r
+ * \param p_expkey Context for the callback.\r
+ * \param ms Pointer to master secret (fixed length: 48 bytes).\r
+ * \param kb Pointer to key block, see RFC 5246 section 6.3.\r
+ * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen).\r
+ * \param maclen MAC length.\r
+ * \param keylen Key length.\r
+ * \param ivlen IV length.\r
+ * \param client_random The client random bytes.\r
+ * \param server_random The server random bytes.\r
+ * \param tls_prf_type The tls_prf enum type.\r
+ *\r
+ * \return 0 if successful, or\r
+ * a specific MBEDTLS_ERR_XXX code.\r
+ */\r
+typedef int mbedtls_ssl_export_keys_ext_t( void *p_expkey,\r
+ const unsigned char *ms,\r
+ const unsigned char *kb,\r
+ size_t maclen,\r
+ size_t keylen,\r
+ size_t ivlen,\r
+ unsigned char client_random[32],\r
+ unsigned char server_random[32],\r
+ mbedtls_tls_prf_types tls_prf_type );\r
+#endif /* MBEDTLS_SSL_EXPORT_KEYS */\r
+\r
+/**\r
+ * \brief Callback type: parse and load session ticket\r
+ *\r
+ * \note This describes what a callback implementation should do.\r
+ * This callback should parse a session ticket as generated\r
+ * by the corresponding mbedtls_ssl_ticket_write_t function,\r
+ * and, if the ticket is authentic and valid, load the\r
+ * session.\r
+ *\r
+ * \note The implementation is allowed to modify the first len\r
+ * bytes of the input buffer, eg to use it as a temporary\r
+ * area for the decrypted ticket contents.\r
+ *\r
+ * \param p_ticket Context for the callback\r
+ * \param session SSL session to be loaded\r
+ * \param buf Start of the buffer containing the ticket\r
+ * \param len Length of the ticket.\r
+ *\r
+ * \return 0 if successful, or\r
+ * MBEDTLS_ERR_SSL_INVALID_MAC if not authentic, or\r
+ * MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED if expired, or\r
+ * any other non-zero code for other failures.\r
+ */\r
+typedef int mbedtls_ssl_ticket_parse_t( void *p_ticket,\r
+ mbedtls_ssl_session *session,\r
+ unsigned char *buf,\r
+ size_t len );\r
+\r
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C)\r
+/**\r
+ * \brief Configure SSL session ticket callbacks (server only).\r
+ * (Default: none.)\r
+ *\r
+ * \note On server, session tickets are enabled by providing\r
+ * non-NULL callbacks.\r
+ *\r
+ * \note On client, use \c mbedtls_ssl_conf_session_tickets().\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \param f_ticket_write Callback for writing a ticket\r
+ * \param f_ticket_parse Callback for parsing a ticket\r
+ * \param p_ticket Context shared by the two callbacks\r
+ */\r
+void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,\r
+ mbedtls_ssl_ticket_write_t *f_ticket_write,\r
+ mbedtls_ssl_ticket_parse_t *f_ticket_parse,\r
+ void *p_ticket );\r
+#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */\r
+\r
+#if defined(MBEDTLS_SSL_EXPORT_KEYS)\r
+/**\r
+ * \brief Configure key export callback.\r
+ * (Default: none.)\r
+ *\r
+ * \note See \c mbedtls_ssl_export_keys_t.\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \param f_export_keys Callback for exporting keys\r
+ * \param p_export_keys Context for the callback\r
+ */\r
+void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,\r
+ mbedtls_ssl_export_keys_t *f_export_keys,\r
+ void *p_export_keys );\r
+\r
+/**\r
+ * \brief Configure extended key export callback.\r
+ * (Default: none.)\r
+ *\r
+ * \note See \c mbedtls_ssl_export_keys_ext_t.\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \param f_export_keys_ext Callback for exporting keys\r
+ * \param p_export_keys Context for the callback\r
+ */\r
+void mbedtls_ssl_conf_export_keys_ext_cb( mbedtls_ssl_config *conf,\r
+ mbedtls_ssl_export_keys_ext_t *f_export_keys_ext,\r
+ void *p_export_keys );\r
+#endif /* MBEDTLS_SSL_EXPORT_KEYS */\r
+\r
+#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)\r
+/**\r
+ * \brief Configure asynchronous private key operation callbacks.\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \param f_async_sign Callback to start a signature operation. See\r
+ * the description of ::mbedtls_ssl_async_sign_t\r
+ * for more information. This may be \c NULL if the\r
+ * external processor does not support any signature\r
+ * operation; in this case the private key object\r
+ * associated with the certificate will be used.\r
+ * \param f_async_decrypt Callback to start a decryption operation. See\r
+ * the description of ::mbedtls_ssl_async_decrypt_t\r
+ * for more information. This may be \c NULL if the\r
+ * external processor does not support any decryption\r
+ * operation; in this case the private key object\r
+ * associated with the certificate will be used.\r
+ * \param f_async_resume Callback to resume an asynchronous operation. See\r
+ * the description of ::mbedtls_ssl_async_resume_t\r
+ * for more information. This may not be \c NULL unless\r
+ * \p f_async_sign and \p f_async_decrypt are both\r
+ * \c NULL.\r
+ * \param f_async_cancel Callback to cancel an asynchronous operation. See\r
+ * the description of ::mbedtls_ssl_async_cancel_t\r
+ * for more information. This may be \c NULL if\r
+ * no cleanup is needed.\r
+ * \param config_data A pointer to configuration data which can be\r
+ * retrieved with\r
+ * mbedtls_ssl_conf_get_async_config_data(). The\r
+ * library stores this value without dereferencing it.\r
+ */\r
+void mbedtls_ssl_conf_async_private_cb( mbedtls_ssl_config *conf,\r
+ mbedtls_ssl_async_sign_t *f_async_sign,\r
+ mbedtls_ssl_async_decrypt_t *f_async_decrypt,\r
+ mbedtls_ssl_async_resume_t *f_async_resume,\r
+ mbedtls_ssl_async_cancel_t *f_async_cancel,\r
+ void *config_data );\r
+\r
+/**\r
+ * \brief Retrieve the configuration data set by\r
+ * mbedtls_ssl_conf_async_private_cb().\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \return The configuration data set by\r
+ * mbedtls_ssl_conf_async_private_cb().\r
+ */\r
+void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf );\r
+\r
+/**\r
+ * \brief Retrieve the asynchronous operation user context.\r
+ *\r
+ * \note This function may only be called while a handshake\r
+ * is in progress.\r
+ *\r
+ * \param ssl The SSL context to access.\r
+ *\r
+ * \return The asynchronous operation user context that was last\r
+ * set during the current handshake. If\r
+ * mbedtls_ssl_set_async_operation_data() has not yet been\r
+ * called during the current handshake, this function returns\r
+ * \c NULL.\r
+ */\r
+void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Retrieve the asynchronous operation user context.\r
+ *\r
+ * \note This function may only be called while a handshake\r
+ * is in progress.\r
+ *\r
+ * \param ssl The SSL context to access.\r
+ * \param ctx The new value of the asynchronous operation user context.\r
+ * Call mbedtls_ssl_get_async_operation_data() later during the\r
+ * same handshake to retrieve this value.\r
+ */\r
+void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,\r
+ void *ctx );\r
+#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */\r
+\r
+/**\r
+ * \brief Callback type: generate a cookie\r
+ *\r
+ * \param ctx Context for the callback\r
+ * \param p Buffer to write to,\r
+ * must be updated to point right after the cookie\r
+ * \param end Pointer to one past the end of the output buffer\r
+ * \param info Client ID info that was passed to\r
+ * \c mbedtls_ssl_set_client_transport_id()\r
+ * \param ilen Length of info in bytes\r
+ *\r
+ * \return The callback must return 0 on success,\r
+ * or a negative error code.\r
+ */\r
+typedef int mbedtls_ssl_cookie_write_t( void *ctx,\r
+ unsigned char **p, unsigned char *end,\r
+ const unsigned char *info, size_t ilen );\r
+\r
+/**\r
+ * \brief Callback type: verify a cookie\r
+ *\r
+ * \param ctx Context for the callback\r
+ * \param cookie Cookie to verify\r
+ * \param clen Length of cookie\r
+ * \param info Client ID info that was passed to\r
+ * \c mbedtls_ssl_set_client_transport_id()\r
+ * \param ilen Length of info in bytes\r
+ *\r
+ * \return The callback must return 0 if cookie is valid,\r
+ * or a negative error code.\r
+ */\r
+typedef int mbedtls_ssl_cookie_check_t( void *ctx,\r
+ const unsigned char *cookie, size_t clen,\r
+ const unsigned char *info, size_t ilen );\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)\r
+/**\r
+ * \brief Register callbacks for DTLS cookies\r
+ * (Server only. DTLS only.)\r
+ *\r
+ * Default: dummy callbacks that fail, in order to force you to\r
+ * register working callbacks (and initialize their context).\r
+ *\r
+ * To disable HelloVerifyRequest, register NULL callbacks.\r
+ *\r
+ * \warning Disabling hello verification allows your server to be used\r
+ * for amplification in DoS attacks against other hosts.\r
+ * Only disable if you known this can't happen in your\r
+ * particular environment.\r
+ *\r
+ * \note See comments on \c mbedtls_ssl_handshake() about handling\r
+ * the MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED that is expected\r
+ * on the first handshake attempt when this is enabled.\r
+ *\r
+ * \note This is also necessary to handle client reconnection from\r
+ * the same port as described in RFC 6347 section 4.2.8 (only\r
+ * the variant with cookies is supported currently). See\r
+ * comments on \c mbedtls_ssl_read() for details.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param f_cookie_write Cookie write callback\r
+ * \param f_cookie_check Cookie check callback\r
+ * \param p_cookie Context for both callbacks\r
+ */\r
+void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,\r
+ mbedtls_ssl_cookie_write_t *f_cookie_write,\r
+ mbedtls_ssl_cookie_check_t *f_cookie_check,\r
+ void *p_cookie );\r
+\r
+/**\r
+ * \brief Set client's transport-level identification info.\r
+ * (Server only. DTLS only.)\r
+ *\r
+ * This is usually the IP address (and port), but could be\r
+ * anything identify the client depending on the underlying\r
+ * network stack. Used for HelloVerifyRequest with DTLS.\r
+ * This is *not* used to route the actual packets.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param info Transport-level info identifying the client (eg IP + port)\r
+ * \param ilen Length of info in bytes\r
+ *\r
+ * \note An internal copy is made, so the info buffer can be reused.\r
+ *\r
+ * \return 0 on success,\r
+ * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used on client,\r
+ * MBEDTLS_ERR_SSL_ALLOC_FAILED if out of memory.\r
+ */\r
+int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,\r
+ const unsigned char *info,\r
+ size_t ilen );\r
+\r
+#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)\r
+/**\r
+ * \brief Enable or disable anti-replay protection for DTLS.\r
+ * (DTLS only, no effect on TLS.)\r
+ * Default: enabled.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param mode MBEDTLS_SSL_ANTI_REPLAY_ENABLED or MBEDTLS_SSL_ANTI_REPLAY_DISABLED.\r
+ *\r
+ * \warning Disabling this is a security risk unless the application\r
+ * protocol handles duplicated packets in a safe way. You\r
+ * should not disable this without careful consideration.\r
+ * However, if your application already detects duplicated\r
+ * packets and needs information about them to adjust its\r
+ * transmission strategy, then you'll want to disable this.\r
+ */\r
+void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode );\r
+#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)\r
+/**\r
+ * \brief Set a limit on the number of records with a bad MAC\r
+ * before terminating the connection.\r
+ * (DTLS only, no effect on TLS.)\r
+ * Default: 0 (disabled).\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param limit Limit, or 0 to disable.\r
+ *\r
+ * \note If the limit is N, then the connection is terminated when\r
+ * the Nth non-authentic record is seen.\r
+ *\r
+ * \note Records with an invalid header are not counted, only the\r
+ * ones going through the authentication-decryption phase.\r
+ *\r
+ * \note This is a security trade-off related to the fact that it's\r
+ * often relatively easy for an active attacker ot inject UDP\r
+ * datagrams. On one hand, setting a low limit here makes it\r
+ * easier for such an attacker to forcibly terminated a\r
+ * connection. On the other hand, a high limit or no limit\r
+ * might make us waste resources checking authentication on\r
+ * many bogus packets.\r
+ */\r
+void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit );\r
+#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */\r
+\r
+#if defined(MBEDTLS_SSL_PROTO_DTLS)\r
+\r
+/**\r
+ * \brief Allow or disallow packing of multiple handshake records\r
+ * within a single datagram.\r
+ *\r
+ * \param ssl The SSL context to configure.\r
+ * \param allow_packing This determines whether datagram packing may\r
+ * be used or not. A value of \c 0 means that every\r
+ * record will be sent in a separate datagram; a\r
+ * value of \c 1 means that, if space permits,\r
+ * multiple handshake messages (including CCS) belonging to\r
+ * a single flight may be packed within a single datagram.\r
+ *\r
+ * \note This is enabled by default and should only be disabled\r
+ * for test purposes, or if datagram packing causes\r
+ * interoperability issues with peers that don't support it.\r
+ *\r
+ * \note Allowing datagram packing reduces the network load since\r
+ * there's less overhead if multiple messages share the same\r
+ * datagram. Also, it increases the handshake efficiency\r
+ * since messages belonging to a single datagram will not\r
+ * be reordered in transit, and so future message buffering\r
+ * or flight retransmission (if no buffering is used) as\r
+ * means to deal with reordering are needed less frequently.\r
+ *\r
+ * \note Application records are not affected by this option and\r
+ * are currently always sent in separate datagrams.\r
+ *\r
+ */\r
+void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,\r
+ unsigned allow_packing );\r
+\r
+/**\r
+ * \brief Set retransmit timeout values for the DTLS handshake.\r
+ * (DTLS only, no effect on TLS.)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param min Initial timeout value in milliseconds.\r
+ * Default: 1000 (1 second).\r
+ * \param max Maximum timeout value in milliseconds.\r
+ * Default: 60000 (60 seconds).\r
+ *\r
+ * \note Default values are from RFC 6347 section 4.2.4.1.\r
+ *\r
+ * \note The 'min' value should typically be slightly above the\r
+ * expected round-trip time to your peer, plus whatever time\r
+ * it takes for the peer to process the message. For example,\r
+ * if your RTT is about 600ms and you peer needs up to 1s to\r
+ * do the cryptographic operations in the handshake, then you\r
+ * should set 'min' slightly above 1600. Lower values of 'min'\r
+ * might cause spurious resends which waste network resources,\r
+ * while larger value of 'min' will increase overall latency\r
+ * on unreliable network links.\r
+ *\r
+ * \note The more unreliable your network connection is, the larger\r
+ * your max / min ratio needs to be in order to achieve\r
+ * reliable handshakes.\r
+ *\r
+ * \note Messages are retransmitted up to log2(ceil(max/min)) times.\r
+ * For example, if min = 1s and max = 5s, the retransmit plan\r
+ * goes: send ... 1s -> resend ... 2s -> resend ... 4s ->\r
+ * resend ... 5s -> give up and return a timeout error.\r
+ */\r
+void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max );\r
+#endif /* MBEDTLS_SSL_PROTO_DTLS */\r
+\r
+#if defined(MBEDTLS_SSL_SRV_C)\r
+/**\r
+ * \brief Set the session cache callbacks (server-side only)\r
+ * If not set, no session resuming is done (except if session\r
+ * tickets are enabled too).\r
+ *\r
+ * The session cache has the responsibility to check for stale\r
+ * entries based on timeout. See RFC 5246 for recommendations.\r
+ *\r
+ * Warning: session.peer_cert is cleared by the SSL/TLS layer on\r
+ * connection shutdown, so do not cache the pointer! Either set\r
+ * it to NULL or make a full copy of the certificate.\r
+ *\r
+ * The get callback is called once during the initial handshake\r
+ * to enable session resuming. The get function has the\r
+ * following parameters: (void *parameter, mbedtls_ssl_session *session)\r
+ * If a valid entry is found, it should fill the master of\r
+ * the session object with the cached values and return 0,\r
+ * return 1 otherwise. Optionally peer_cert can be set as well\r
+ * if it is properly present in cache entry.\r
+ *\r
+ * The set callback is called once during the initial handshake\r
+ * to enable session resuming after the entire handshake has\r
+ * been finished. The set function has the following parameters:\r
+ * (void *parameter, const mbedtls_ssl_session *session). The function\r
+ * should create a cache entry for future retrieval based on\r
+ * the data in the session structure and should keep in mind\r
+ * that the mbedtls_ssl_session object presented (and all its referenced\r
+ * data) is cleared by the SSL/TLS layer when the connection is\r
+ * terminated. It is recommended to add metadata to determine if\r
+ * an entry is still valid in the future. Return 0 if\r
+ * successfully cached, return 1 otherwise.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param p_cache parmater (context) for both callbacks\r
+ * \param f_get_cache session get callback\r
+ * \param f_set_cache session set callback\r
+ */\r
+void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,\r
+ void *p_cache,\r
+ int (*f_get_cache)(void *, mbedtls_ssl_session *),\r
+ int (*f_set_cache)(void *, const mbedtls_ssl_session *) );\r
+#endif /* MBEDTLS_SSL_SRV_C */\r
+\r
+#if defined(MBEDTLS_SSL_CLI_C)\r
+/**\r
+ * \brief Request resumption of session (client-side only)\r
+ * Session data is copied from presented session structure.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param session session context\r
+ *\r
+ * \return 0 if successful,\r
+ * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed,\r
+ * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or\r
+ * arguments are otherwise invalid\r
+ *\r
+ * \sa mbedtls_ssl_get_session()\r
+ */\r
+int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session );\r
+#endif /* MBEDTLS_SSL_CLI_C */\r
+\r
+/**\r
+ * \brief Set the list of allowed ciphersuites and the preference\r
+ * order. First in the list has the highest preference.\r
+ * (Overrides all version-specific lists)\r
+ *\r
+ * The ciphersuites array is not copied, and must remain\r
+ * valid for the lifetime of the ssl_config.\r
+ *\r
+ * Note: The server uses its own preferences\r
+ * over the preference of the client unless\r
+ * MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined!\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param ciphersuites 0-terminated list of allowed ciphersuites\r
+ */\r
+void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,\r
+ const int *ciphersuites );\r
+\r
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)\r
+#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 0\r
+#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL 1\r
+/**\r
+ * \brief Specify the length of Connection IDs for incoming\r
+ * encrypted DTLS records, as well as the behaviour\r
+ * on unexpected CIDs.\r
+ *\r
+ * By default, the CID length is set to \c 0,\r
+ * and unexpected CIDs are silently ignored.\r
+ *\r
+ * \param conf The SSL configuration to modify.\r
+ * \param len The length in Bytes of the CID fields in encrypted\r
+ * DTLS records using the CID mechanism. This must\r
+ * not be larger than #MBEDTLS_SSL_CID_OUT_LEN_MAX.\r
+ * \param ignore_other_cids This determines the stack's behaviour when\r
+ * receiving a record with an unexpected CID.\r
+ * Possible values are:\r
+ * - #MBEDTLS_SSL_UNEXPECTED_CID_IGNORE\r
+ * In this case, the record is silently ignored.\r
+ * - #MBEDTLS_SSL_UNEXPECTED_CID_FAIL\r
+ * In this case, the stack fails with the specific\r
+ * error code #MBEDTLS_ERR_SSL_UNEXPECTED_CID.\r
+ *\r
+ * \note The CID specification allows implementations to either\r
+ * use a common length for all incoming connection IDs or\r
+ * allow variable-length incoming IDs. Mbed TLS currently\r
+ * requires a common length for all connections sharing the\r
+ * same SSL configuration; this allows simpler parsing of\r
+ * record headers.\r
+ *\r
+ * \return \c 0 on success.\r
+ * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len\r
+ * is too large.\r
+ */\r
+int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf, size_t len,\r
+ int ignore_other_cids );\r
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */\r
+\r
+/**\r
+ * \brief Set the list of allowed ciphersuites and the\r
+ * preference order for a specific version of the protocol.\r
+ * (Only useful on the server side)\r
+ *\r
+ * The ciphersuites array is not copied, and must remain\r
+ * valid for the lifetime of the ssl_config.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param ciphersuites 0-terminated list of allowed ciphersuites\r
+ * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3\r
+ * supported)\r
+ * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,\r
+ * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,\r
+ * MBEDTLS_SSL_MINOR_VERSION_3 supported)\r
+ *\r
+ * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0\r
+ * and MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2\r
+ */\r
+void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,\r
+ const int *ciphersuites,\r
+ int major, int minor );\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+/**\r
+ * \brief Set the X.509 security profile used for verification\r
+ *\r
+ * \note The restrictions are enforced for all certificates in the\r
+ * chain. However, signatures in the handshake are not covered\r
+ * by this setting but by \b mbedtls_ssl_conf_sig_hashes().\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param profile Profile to use\r
+ */\r
+void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,\r
+ const mbedtls_x509_crt_profile *profile );\r
+\r
+/**\r
+ * \brief Set the data required to verify peer certificate\r
+ *\r
+ * \note See \c mbedtls_x509_crt_verify() for notes regarding the\r
+ * parameters ca_chain (maps to trust_ca for that function)\r
+ * and ca_crl.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs)\r
+ * \param ca_crl trusted CA CRLs\r
+ */\r
+void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,\r
+ mbedtls_x509_crt *ca_chain,\r
+ mbedtls_x509_crl *ca_crl );\r
+\r
+#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)\r
+/**\r
+ * \brief Set the trusted certificate callback.\r
+ *\r
+ * This API allows to register the set of trusted certificates\r
+ * through a callback, instead of a linked list as configured\r
+ * by mbedtls_ssl_conf_ca_chain().\r
+ *\r
+ * This is useful for example in contexts where a large number\r
+ * of CAs are used, and the inefficiency of maintaining them\r
+ * in a linked list cannot be tolerated. It is also useful when\r
+ * the set of trusted CAs needs to be modified frequently.\r
+ *\r
+ * See the documentation of `mbedtls_x509_crt_ca_cb_t` for\r
+ * more information.\r
+ *\r
+ * \param conf The SSL configuration to register the callback with.\r
+ * \param f_ca_cb The trusted certificate callback to use when verifying\r
+ * certificate chains.\r
+ * \param p_ca_cb The context to be passed to \p f_ca_cb (for example,\r
+ * a reference to a trusted CA database).\r
+ *\r
+ * \note This API is incompatible with mbedtls_ssl_conf_ca_chain():\r
+ * Any call to this function overwrites the values set through\r
+ * earlier calls to mbedtls_ssl_conf_ca_chain() or\r
+ * mbedtls_ssl_conf_ca_cb().\r
+ *\r
+ * \note This API is incompatible with CA indication in\r
+ * CertificateRequest messages: A server-side SSL context which\r
+ * is bound to an SSL configuration that uses a CA callback\r
+ * configured via mbedtls_ssl_conf_ca_cb(), and which requires\r
+ * client authentication, will send an empty CA list in the\r
+ * corresponding CertificateRequest message.\r
+ *\r
+ * \note This API is incompatible with mbedtls_ssl_set_hs_ca_chain():\r
+ * If an SSL context is bound to an SSL configuration which uses\r
+ * CA callbacks configured via mbedtls_ssl_conf_ca_cb(), then\r
+ * calls to mbedtls_ssl_set_hs_ca_chain() have no effect.\r
+ *\r
+ * \note The use of this API disables the use of restartable ECC\r
+ * during X.509 CRT signature verification (but doesn't affect\r
+ * other uses).\r
+ *\r
+ * \warning This API is incompatible with the use of CRLs. Any call to\r
+ * mbedtls_ssl_conf_ca_cb() unsets CRLs configured through\r
+ * earlier calls to mbedtls_ssl_conf_ca_chain().\r
+ *\r
+ * \warning In multi-threaded environments, the callback \p f_ca_cb\r
+ * must be thread-safe, and it is the user's responsibility\r
+ * to guarantee this (for example through a mutex\r
+ * contained in the callback context pointed to by \p p_ca_cb).\r
+ */\r
+void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,\r
+ mbedtls_x509_crt_ca_cb_t f_ca_cb,\r
+ void *p_ca_cb );\r
+#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */\r
+\r
+/**\r
+ * \brief Set own certificate chain and private key\r
+ *\r
+ * \note own_cert should contain in order from the bottom up your\r
+ * certificate chain. The top certificate (self-signed)\r
+ * can be omitted.\r
+ *\r
+ * \note On server, this function can be called multiple times to\r
+ * provision more than one cert/key pair (eg one ECDSA, one\r
+ * RSA with SHA-256, one RSA with SHA-1). An adequate\r
+ * certificate will be selected according to the client's\r
+ * advertised capabilities. In case multiple certificates are\r
+ * adequate, preference is given to the one set by the first\r
+ * call to this function, then second, etc.\r
+ *\r
+ * \note On client, only the first call has any effect. That is,\r
+ * only one client certificate can be provisioned. The\r
+ * server's preferences in its CertficateRequest message will\r
+ * be ignored and our only cert will be sent regardless of\r
+ * whether it matches those preferences - the server can then\r
+ * decide what it wants to do with it.\r
+ *\r
+ * \note The provided \p pk_key needs to match the public key in the\r
+ * first certificate in \p own_cert, or all handshakes using\r
+ * that certificate will fail. It is your responsibility\r
+ * to ensure that; this function will not perform any check.\r
+ * You may use mbedtls_pk_check_pair() in order to perform\r
+ * this check yourself, but be aware that this function can\r
+ * be computationally expensive on some key types.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param own_cert own public certificate chain\r
+ * \param pk_key own private key\r
+ *\r
+ * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED\r
+ */\r
+int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,\r
+ mbedtls_x509_crt *own_cert,\r
+ mbedtls_pk_context *pk_key );\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)\r
+/**\r
+ * \brief Configure a pre-shared key (PSK) and identity\r
+ * to be used in PSK-based ciphersuites.\r
+ *\r
+ * \note This is mainly useful for clients. Servers will usually\r
+ * want to use \c mbedtls_ssl_conf_psk_cb() instead.\r
+ *\r
+ * \warning Currently, clients can only register a single pre-shared key.\r
+ * Calling this function or mbedtls_ssl_conf_psk_opaque() more\r
+ * than once will overwrite values configured in previous calls.\r
+ * Support for setting multiple PSKs on clients and selecting\r
+ * one based on the identity hint is not a planned feature,\r
+ * but feedback is welcomed.\r
+ *\r
+ * \param conf The SSL configuration to register the PSK with.\r
+ * \param psk The pointer to the pre-shared key to use.\r
+ * \param psk_len The length of the pre-shared key in bytes.\r
+ * \param psk_identity The pointer to the pre-shared key identity.\r
+ * \param psk_identity_len The length of the pre-shared key identity\r
+ * in bytes.\r
+ *\r
+ * \note The PSK and its identity are copied internally and\r
+ * hence need not be preserved by the caller for the lifetime\r
+ * of the SSL configuration.\r
+ *\r
+ * \return \c 0 if successful.\r
+ * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.\r
+ */\r
+int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,\r
+ const unsigned char *psk, size_t psk_len,\r
+ const unsigned char *psk_identity, size_t psk_identity_len );\r
+\r
+#if defined(MBEDTLS_USE_PSA_CRYPTO)\r
+/**\r
+ * \brief Configure an opaque pre-shared key (PSK) and identity\r
+ * to be used in PSK-based ciphersuites.\r
+ *\r
+ * \note This is mainly useful for clients. Servers will usually\r
+ * want to use \c mbedtls_ssl_conf_psk_cb() instead.\r
+ *\r
+ * \warning Currently, clients can only register a single pre-shared key.\r
+ * Calling this function or mbedtls_ssl_conf_psk() more than\r
+ * once will overwrite values configured in previous calls.\r
+ * Support for setting multiple PSKs on clients and selecting\r
+ * one based on the identity hint is not a planned feature,\r
+ * but feedback is welcomed.\r
+ *\r
+ * \param conf The SSL configuration to register the PSK with.\r
+ * \param psk The identifier of the key slot holding the PSK.\r
+ * Until \p conf is destroyed or this function is successfully\r
+ * called again, the key slot \p psk must be populated with a\r
+ * key of type PSA_ALG_CATEGORY_KEY_DERIVATION whose policy\r
+ * allows its use for the key derivation algorithm applied\r
+ * in the handshake.\r
+ * \param psk_identity The pointer to the pre-shared key identity.\r
+ * \param psk_identity_len The length of the pre-shared key identity\r
+ * in bytes.\r
+ *\r
+ * \note The PSK identity hint is copied internally and hence need\r
+ * not be preserved by the caller for the lifetime of the\r
+ * SSL configuration.\r
+ *\r
+ * \return \c 0 if successful.\r
+ * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.\r
+ */\r
+int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,\r
+ psa_key_handle_t psk,\r
+ const unsigned char *psk_identity,\r
+ size_t psk_identity_len );\r
+#endif /* MBEDTLS_USE_PSA_CRYPTO */\r
+\r
+/**\r
+ * \brief Set the pre-shared Key (PSK) for the current handshake.\r
+ *\r
+ * \note This should only be called inside the PSK callback,\r
+ * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb().\r
+ *\r
+ * \param ssl The SSL context to configure a PSK for.\r
+ * \param psk The pointer to the pre-shared key.\r
+ * \param psk_len The length of the pre-shared key in bytes.\r
+ *\r
+ * \return \c 0 if successful.\r
+ * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.\r
+ */\r
+int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,\r
+ const unsigned char *psk, size_t psk_len );\r
+\r
+#if defined(MBEDTLS_USE_PSA_CRYPTO)\r
+/**\r
+ * \brief Set an opaque pre-shared Key (PSK) for the current handshake.\r
+ *\r
+ * \note This should only be called inside the PSK callback,\r
+ * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb().\r
+ *\r
+ * \param ssl The SSL context to configure a PSK for.\r
+ * \param psk The identifier of the key slot holding the PSK.\r
+ * For the duration of the current handshake, the key slot\r
+ * must be populated with a key of type\r
+ * PSA_ALG_CATEGORY_KEY_DERIVATION whose policy allows its\r
+ * use for the key derivation algorithm\r
+ * applied in the handshake.\r
+ *\r
+ * \return \c 0 if successful.\r
+ * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.\r
+ */\r
+int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,\r
+ psa_key_handle_t psk );\r
+#endif /* MBEDTLS_USE_PSA_CRYPTO */\r
+\r
+/**\r
+ * \brief Set the PSK callback (server-side only).\r
+ *\r
+ * If set, the PSK callback is called for each\r
+ * handshake where a PSK-based ciphersuite was negotiated.\r
+ * The caller provides the identity received and wants to\r
+ * receive the actual PSK data and length.\r
+ *\r
+ * The callback has the following parameters:\r
+ * - \c void*: The opaque pointer \p p_psk.\r
+ * - \c mbedtls_ssl_context*: The SSL context to which\r
+ * the operation applies.\r
+ * - \c const unsigned char*: The PSK identity\r
+ * selected by the client.\r
+ * - \c size_t: The length of the PSK identity\r
+ * selected by the client.\r
+ *\r
+ * If a valid PSK identity is found, the callback should use\r
+ * \c mbedtls_ssl_set_hs_psk() or\r
+ * \c mbedtls_ssl_set_hs_psk_opaque()\r
+ * on the SSL context to set the correct PSK and return \c 0.\r
+ * Any other return value will result in a denied PSK identity.\r
+ *\r
+ * \note If you set a PSK callback using this function, then you\r
+ * don't need to set a PSK key and identity using\r
+ * \c mbedtls_ssl_conf_psk().\r
+ *\r
+ * \param conf The SSL configuration to register the callback with.\r
+ * \param f_psk The callback for selecting and setting the PSK based\r
+ * in the PSK identity chosen by the client.\r
+ * \param p_psk A pointer to an opaque structure to be passed to\r
+ * the callback, for example a PSK store.\r
+ */\r
+void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,\r
+ int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,\r
+ size_t),\r
+ void *p_psk );\r
+#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */\r
+\r
+#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)\r
+\r
+#if !defined(MBEDTLS_DEPRECATED_REMOVED)\r
+\r
+#if defined(MBEDTLS_DEPRECATED_WARNING)\r
+#define MBEDTLS_DEPRECATED __attribute__((deprecated))\r
+#else\r
+#define MBEDTLS_DEPRECATED\r
+#endif\r
+\r
+/**\r
+ * \brief Set the Diffie-Hellman public P and G values,\r
+ * read as hexadecimal strings (server-side only)\r
+ * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG])\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param dhm_P Diffie-Hellman-Merkle modulus\r
+ * \param dhm_G Diffie-Hellman-Merkle generator\r
+ *\r
+ * \deprecated Superseded by \c mbedtls_ssl_conf_dh_param_bin.\r
+ *\r
+ * \return 0 if successful\r
+ */\r
+MBEDTLS_DEPRECATED int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf,\r
+ const char *dhm_P,\r
+ const char *dhm_G );\r
+\r
+#endif /* MBEDTLS_DEPRECATED_REMOVED */\r
+\r
+/**\r
+ * \brief Set the Diffie-Hellman public P and G values\r
+ * from big-endian binary presentations.\r
+ * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]_BIN)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param dhm_P Diffie-Hellman-Merkle modulus in big-endian binary form\r
+ * \param P_len Length of DHM modulus\r
+ * \param dhm_G Diffie-Hellman-Merkle generator in big-endian binary form\r
+ * \param G_len Length of DHM generator\r
+ *\r
+ * \return 0 if successful\r
+ */\r
+int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,\r
+ const unsigned char *dhm_P, size_t P_len,\r
+ const unsigned char *dhm_G, size_t G_len );\r
+\r
+/**\r
+ * \brief Set the Diffie-Hellman public P and G values,\r
+ * read from existing context (server-side only)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param dhm_ctx Diffie-Hellman-Merkle context\r
+ *\r
+ * \return 0 if successful\r
+ */\r
+int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx );\r
+#endif /* MBEDTLS_DHM_C && defined(MBEDTLS_SSL_SRV_C) */\r
+\r
+#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)\r
+/**\r
+ * \brief Set the minimum length for Diffie-Hellman parameters.\r
+ * (Client-side only.)\r
+ * (Default: 1024 bits.)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param bitlen Minimum bit length of the DHM prime\r
+ */\r
+void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,\r
+ unsigned int bitlen );\r
+#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */\r
+\r
+#if defined(MBEDTLS_ECP_C)\r
+/**\r
+ * \brief Set the allowed curves in order of preference.\r
+ * (Default: all defined curves.)\r
+ *\r
+ * On server: this only affects selection of the ECDHE curve;\r
+ * the curves used for ECDH and ECDSA are determined by the\r
+ * list of available certificates instead.\r
+ *\r
+ * On client: this affects the list of curves offered for any\r
+ * use. The server can override our preference order.\r
+ *\r
+ * Both sides: limits the set of curves accepted for use in\r
+ * ECDHE and in the peer's end-entity certificate.\r
+ *\r
+ * \note This has no influence on which curves are allowed inside the\r
+ * certificate chains, see \c mbedtls_ssl_conf_cert_profile()\r
+ * for that. For the end-entity certificate however, the key\r
+ * will be accepted only if it is allowed both by this list\r
+ * and by the cert profile.\r
+ *\r
+ * \note This list should be ordered by decreasing preference\r
+ * (preferred curve first).\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param curves Ordered list of allowed curves,\r
+ * terminated by MBEDTLS_ECP_DP_NONE.\r
+ */\r
+void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,\r
+ const mbedtls_ecp_group_id *curves );\r
+#endif /* MBEDTLS_ECP_C */\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)\r
+/**\r
+ * \brief Set the allowed hashes for signatures during the handshake.\r
+ * (Default: all available hashes except MD5.)\r
+ *\r
+ * \note This only affects which hashes are offered and can be used\r
+ * for signatures during the handshake. Hashes for message\r
+ * authentication and the TLS PRF are controlled by the\r
+ * ciphersuite, see \c mbedtls_ssl_conf_ciphersuites(). Hashes\r
+ * used for certificate signature are controlled by the\r
+ * verification profile, see \c mbedtls_ssl_conf_cert_profile().\r
+ *\r
+ * \note This list should be ordered by decreasing preference\r
+ * (preferred hash first).\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param hashes Ordered list of allowed signature hashes,\r
+ * terminated by \c MBEDTLS_MD_NONE.\r
+ */\r
+void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,\r
+ const int *hashes );\r
+#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+/**\r
+ * \brief Set or reset the hostname to check against the received\r
+ * server certificate. It sets the ServerName TLS extension,\r
+ * too, if that extension is enabled. (client-side only)\r
+ *\r
+ * \param ssl SSL context\r
+ * \param hostname the server hostname, may be NULL to clear hostname\r
+\r
+ * \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN.\r
+ *\r
+ * \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on\r
+ * allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on\r
+ * too long input hostname.\r
+ *\r
+ * Hostname set to the one provided on success (cleared\r
+ * when NULL). On allocation failure hostname is cleared.\r
+ * On too long input failure, old hostname is unchanged.\r
+ */\r
+int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname );\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)\r
+/**\r
+ * \brief Set own certificate and key for the current handshake\r
+ *\r
+ * \note Same as \c mbedtls_ssl_conf_own_cert() but for use within\r
+ * the SNI callback.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param own_cert own public certificate chain\r
+ * \param pk_key own private key\r
+ *\r
+ * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED\r
+ */\r
+int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,\r
+ mbedtls_x509_crt *own_cert,\r
+ mbedtls_pk_context *pk_key );\r
+\r
+/**\r
+ * \brief Set the data required to verify peer certificate for the\r
+ * current handshake\r
+ *\r
+ * \note Same as \c mbedtls_ssl_conf_ca_chain() but for use within\r
+ * the SNI callback.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs)\r
+ * \param ca_crl trusted CA CRLs\r
+ */\r
+void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,\r
+ mbedtls_x509_crt *ca_chain,\r
+ mbedtls_x509_crl *ca_crl );\r
+\r
+/**\r
+ * \brief Set authmode for the current handshake.\r
+ *\r
+ * \note Same as \c mbedtls_ssl_conf_authmode() but for use within\r
+ * the SNI callback.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param authmode MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or\r
+ * MBEDTLS_SSL_VERIFY_REQUIRED\r
+ */\r
+void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,\r
+ int authmode );\r
+\r
+/**\r
+ * \brief Set server side ServerName TLS extension callback\r
+ * (optional, server-side only).\r
+ *\r
+ * If set, the ServerName callback is called whenever the\r
+ * server receives a ServerName TLS extension from the client\r
+ * during a handshake. The ServerName callback has the\r
+ * following parameters: (void *parameter, mbedtls_ssl_context *ssl,\r
+ * const unsigned char *hostname, size_t len). If a suitable\r
+ * certificate is found, the callback must set the\r
+ * certificate(s) and key(s) to use with \c\r
+ * mbedtls_ssl_set_hs_own_cert() (can be called repeatedly),\r
+ * and may optionally adjust the CA and associated CRL with \c\r
+ * mbedtls_ssl_set_hs_ca_chain() as well as the client\r
+ * authentication mode with \c mbedtls_ssl_set_hs_authmode(),\r
+ * then must return 0. If no matching name is found, the\r
+ * callback must either set a default cert, or\r
+ * return non-zero to abort the handshake at this point.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param f_sni verification function\r
+ * \param p_sni verification parameter\r
+ */\r
+void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,\r
+ int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *,\r
+ size_t),\r
+ void *p_sni );\r
+#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */\r
+\r
+#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)\r
+/**\r
+ * \brief Set the EC J-PAKE password for current handshake.\r
+ *\r
+ * \note An internal copy is made, and destroyed as soon as the\r
+ * handshake is completed, or when the SSL context is reset or\r
+ * freed.\r
+ *\r
+ * \note The SSL context needs to be already set up. The right place\r
+ * to call this function is between \c mbedtls_ssl_setup() or\r
+ * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake().\r
+ *\r
+ * \param ssl SSL context\r
+ * \param pw EC J-PAKE password (pre-shared secret)\r
+ * \param pw_len length of pw in bytes\r
+ *\r
+ * \return 0 on success, or a negative error code.\r
+ */\r
+int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,\r
+ const unsigned char *pw,\r
+ size_t pw_len );\r
+#endif /*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */\r
+\r
+#if defined(MBEDTLS_SSL_ALPN)\r
+/**\r
+ * \brief Set the supported Application Layer Protocols.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param protos Pointer to a NULL-terminated list of supported protocols,\r
+ * in decreasing preference order. The pointer to the list is\r
+ * recorded by the library for later reference as required, so\r
+ * the lifetime of the table must be atleast as long as the\r
+ * lifetime of the SSL configuration structure.\r
+ *\r
+ * \return 0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA.\r
+ */\r
+int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos );\r
+\r
+/**\r
+ * \brief Get the name of the negotiated Application Layer Protocol.\r
+ * This function should be called after the handshake is\r
+ * completed.\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return Protcol name, or NULL if no protocol was negotiated.\r
+ */\r
+const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl );\r
+#endif /* MBEDTLS_SSL_ALPN */\r
+\r
+/**\r
+ * \brief Set the maximum supported version sent from the client side\r
+ * and/or accepted at the server side\r
+ * (Default: MBEDTLS_SSL_MAX_MAJOR_VERSION, MBEDTLS_SSL_MAX_MINOR_VERSION)\r
+ *\r
+ * \note This ignores ciphersuites from higher versions.\r
+ *\r
+ * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and\r
+ * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported)\r
+ * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,\r
+ * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,\r
+ * MBEDTLS_SSL_MINOR_VERSION_3 supported)\r
+ */\r
+void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor );\r
+\r
+/**\r
+ * \brief Set the minimum accepted SSL/TLS protocol version\r
+ * (Default: TLS 1.0)\r
+ *\r
+ * \note Input outside of the SSL_MAX_XXXXX_VERSION and\r
+ * SSL_MIN_XXXXX_VERSION range is ignored.\r
+ *\r
+ * \note MBEDTLS_SSL_MINOR_VERSION_0 (SSL v3) should be avoided.\r
+ *\r
+ * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and\r
+ * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported)\r
+ * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,\r
+ * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,\r
+ * MBEDTLS_SSL_MINOR_VERSION_3 supported)\r
+ */\r
+void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor );\r
+\r
+#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)\r
+/**\r
+ * \brief Set the fallback flag (client-side only).\r
+ * (Default: MBEDTLS_SSL_IS_NOT_FALLBACK).\r
+ *\r
+ * \note Set to MBEDTLS_SSL_IS_FALLBACK when preparing a fallback\r
+ * connection, that is a connection with max_version set to a\r
+ * lower value than the value you're willing to use. Such\r
+ * fallback connections are not recommended but are sometimes\r
+ * necessary to interoperate with buggy (version-intolerant)\r
+ * servers.\r
+ *\r
+ * \warning You should NOT set this to MBEDTLS_SSL_IS_FALLBACK for\r
+ * non-fallback connections! This would appear to work for a\r
+ * while, then cause failures when the server is upgraded to\r
+ * support a newer TLS version.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param fallback MBEDTLS_SSL_IS_NOT_FALLBACK or MBEDTLS_SSL_IS_FALLBACK\r
+ */\r
+void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback );\r
+#endif /* MBEDTLS_SSL_FALLBACK_SCSV && MBEDTLS_SSL_CLI_C */\r
+\r
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)\r
+/**\r
+ * \brief Enable or disable Encrypt-then-MAC\r
+ * (Default: MBEDTLS_SSL_ETM_ENABLED)\r
+ *\r
+ * \note This should always be enabled, it is a security\r
+ * improvement, and should not cause any interoperability\r
+ * issue (used only if the peer supports it too).\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param etm MBEDTLS_SSL_ETM_ENABLED or MBEDTLS_SSL_ETM_DISABLED\r
+ */\r
+void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm );\r
+#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */\r
+\r
+#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)\r
+/**\r
+ * \brief Enable or disable Extended Master Secret negotiation.\r
+ * (Default: MBEDTLS_SSL_EXTENDED_MS_ENABLED)\r
+ *\r
+ * \note This should always be enabled, it is a security fix to the\r
+ * protocol, and should not cause any interoperability issue\r
+ * (used only if the peer supports it too).\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param ems MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED\r
+ */\r
+void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems );\r
+#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */\r
+\r
+#if defined(MBEDTLS_ARC4_C)\r
+/**\r
+ * \brief Disable or enable support for RC4\r
+ * (Default: MBEDTLS_SSL_ARC4_DISABLED)\r
+ *\r
+ * \warning Use of RC4 in DTLS/TLS has been prohibited by RFC 7465\r
+ * for security reasons. Use at your own risk.\r
+ *\r
+ * \note This function is deprecated and will likely be removed in\r
+ * a future version of the library.\r
+ * RC4 is disabled by default at compile time and needs to be\r
+ * actively enabled for use with legacy systems.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param arc4 MBEDTLS_SSL_ARC4_ENABLED or MBEDTLS_SSL_ARC4_DISABLED\r
+ */\r
+void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 );\r
+#endif /* MBEDTLS_ARC4_C */\r
+\r
+#if defined(MBEDTLS_SSL_SRV_C)\r
+/**\r
+ * \brief Whether to send a list of acceptable CAs in\r
+ * CertificateRequest messages.\r
+ * (Default: do send)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param cert_req_ca_list MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED or\r
+ * MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED\r
+ */\r
+void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,\r
+ char cert_req_ca_list );\r
+#endif /* MBEDTLS_SSL_SRV_C */\r
+\r
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)\r
+/**\r
+ * \brief Set the maximum fragment length to emit and/or negotiate.\r
+ * (Typical: the smaller of #MBEDTLS_SSL_IN_CONTENT_LEN and\r
+ * #MBEDTLS_SSL_OUT_CONTENT_LEN, usually `2^14` bytes)\r
+ * (Server: set maximum fragment length to emit,\r
+ * usually negotiated by the client during handshake)\r
+ * (Client: set maximum fragment length to emit *and*\r
+ * negotiate with the server during handshake)\r
+ * (Default: #MBEDTLS_SSL_MAX_FRAG_LEN_NONE)\r
+ *\r
+ * \note On the client side, the maximum fragment length extension\r
+ * *will not* be used, unless the maximum fragment length has\r
+ * been set via this function to a value different than\r
+ * #MBEDTLS_SSL_MAX_FRAG_LEN_NONE.\r
+ *\r
+ * \note With TLS, this currently only affects ApplicationData (sent\r
+ * with \c mbedtls_ssl_read()), not handshake messages.\r
+ * With DTLS, this affects both ApplicationData and handshake.\r
+ *\r
+ * \note This sets the maximum length for a record's payload,\r
+ * excluding record overhead that will be added to it, see\r
+ * \c mbedtls_ssl_get_record_expansion().\r
+ *\r
+ * \note For DTLS, it is also possible to set a limit for the total\r
+ * size of daragrams passed to the transport layer, including\r
+ * record overhead, see \c mbedtls_ssl_set_mtu().\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param mfl_code Code for maximum fragment length (allowed values:\r
+ * MBEDTLS_SSL_MAX_FRAG_LEN_512, MBEDTLS_SSL_MAX_FRAG_LEN_1024,\r
+ * MBEDTLS_SSL_MAX_FRAG_LEN_2048, MBEDTLS_SSL_MAX_FRAG_LEN_4096)\r
+ *\r
+ * \return 0 if successful or MBEDTLS_ERR_SSL_BAD_INPUT_DATA\r
+ */\r
+int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code );\r
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */\r
+\r
+#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)\r
+/**\r
+ * \brief Activate negotiation of truncated HMAC\r
+ * (Default: MBEDTLS_SSL_TRUNC_HMAC_DISABLED)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param truncate Enable or disable (MBEDTLS_SSL_TRUNC_HMAC_ENABLED or\r
+ * MBEDTLS_SSL_TRUNC_HMAC_DISABLED)\r
+ */\r
+void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate );\r
+#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */\r
+\r
+#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)\r
+/**\r
+ * \brief Enable / Disable 1/n-1 record splitting\r
+ * (Default: MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED)\r
+ *\r
+ * \note Only affects SSLv3 and TLS 1.0, not higher versions.\r
+ * Does not affect non-CBC ciphersuites in any version.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param split MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED or\r
+ * MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED\r
+ */\r
+void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split );\r
+#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */\r
+\r
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)\r
+/**\r
+ * \brief Enable / Disable session tickets (client only).\r
+ * (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.)\r
+ *\r
+ * \note On server, use \c mbedtls_ssl_conf_session_tickets_cb().\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or\r
+ * MBEDTLS_SSL_SESSION_TICKETS_DISABLED)\r
+ */\r
+void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets );\r
+#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */\r
+\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+/**\r
+ * \brief Enable / Disable renegotiation support for connection when\r
+ * initiated by peer\r
+ * (Default: MBEDTLS_SSL_RENEGOTIATION_DISABLED)\r
+ *\r
+ * \warning It is recommended to always disable renegotation unless you\r
+ * know you need it and you know what you're doing. In the\r
+ * past, there have been several issues associated with\r
+ * renegotiation or a poor understanding of its properties.\r
+ *\r
+ * \note Server-side, enabling renegotiation also makes the server\r
+ * susceptible to a resource DoS by a malicious client.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param renegotiation Enable or disable (MBEDTLS_SSL_RENEGOTIATION_ENABLED or\r
+ * MBEDTLS_SSL_RENEGOTIATION_DISABLED)\r
+ */\r
+void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation );\r
+#endif /* MBEDTLS_SSL_RENEGOTIATION */\r
+\r
+/**\r
+ * \brief Prevent or allow legacy renegotiation.\r
+ * (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION)\r
+ *\r
+ * MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to\r
+ * be established even if the peer does not support\r
+ * secure renegotiation, but does not allow renegotiation\r
+ * to take place if not secure.\r
+ * (Interoperable and secure option)\r
+ *\r
+ * MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations\r
+ * with non-upgraded peers. Allowing legacy renegotiation\r
+ * makes the connection vulnerable to specific man in the\r
+ * middle attacks. (See RFC 5746)\r
+ * (Most interoperable and least secure option)\r
+ *\r
+ * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections\r
+ * if peer does not support secure renegotiation. Results\r
+ * in interoperability issues with non-upgraded peers\r
+ * that do not support renegotiation altogether.\r
+ * (Most secure option, interoperability issues)\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param allow_legacy Prevent or allow (SSL_NO_LEGACY_RENEGOTIATION,\r
+ * SSL_ALLOW_LEGACY_RENEGOTIATION or\r
+ * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE)\r
+ */\r
+void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy );\r
+\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+/**\r
+ * \brief Enforce renegotiation requests.\r
+ * (Default: enforced, max_records = 16)\r
+ *\r
+ * When we request a renegotiation, the peer can comply or\r
+ * ignore the request. This function allows us to decide\r
+ * whether to enforce our renegotiation requests by closing\r
+ * the connection if the peer doesn't comply.\r
+ *\r
+ * However, records could already be in transit from the peer\r
+ * when the request is emitted. In order to increase\r
+ * reliability, we can accept a number of records before the\r
+ * expected handshake records.\r
+ *\r
+ * The optimal value is highly dependent on the specific usage\r
+ * scenario.\r
+ *\r
+ * \note With DTLS and server-initiated renegotiation, the\r
+ * HelloRequest is retransmited every time mbedtls_ssl_read() times\r
+ * out or receives Application Data, until:\r
+ * - max_records records have beens seen, if it is >= 0, or\r
+ * - the number of retransmits that would happen during an\r
+ * actual handshake has been reached.\r
+ * Please remember the request might be lost a few times\r
+ * if you consider setting max_records to a really low value.\r
+ *\r
+ * \warning On client, the grace period can only happen during\r
+ * mbedtls_ssl_read(), as opposed to mbedtls_ssl_write() and mbedtls_ssl_renegotiate()\r
+ * which always behave as if max_record was 0. The reason is,\r
+ * if we receive application data from the server, we need a\r
+ * place to write it, which only happens during mbedtls_ssl_read().\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param max_records Use MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED if you don't want to\r
+ * enforce renegotiation, or a non-negative value to enforce\r
+ * it but allow for a grace period of max_records records.\r
+ */\r
+void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records );\r
+\r
+/**\r
+ * \brief Set record counter threshold for periodic renegotiation.\r
+ * (Default: 2^48 - 1)\r
+ *\r
+ * Renegotiation is automatically triggered when a record\r
+ * counter (outgoing or incoming) crosses the defined\r
+ * threshold. The default value is meant to prevent the\r
+ * connection from being closed when the counter is about to\r
+ * reached its maximal value (it is not allowed to wrap).\r
+ *\r
+ * Lower values can be used to enforce policies such as "keys\r
+ * must be refreshed every N packets with cipher X".\r
+ *\r
+ * The renegotiation period can be disabled by setting\r
+ * conf->disable_renegotiation to\r
+ * MBEDTLS_SSL_RENEGOTIATION_DISABLED.\r
+ *\r
+ * \note When the configured transport is\r
+ * MBEDTLS_SSL_TRANSPORT_DATAGRAM the maximum renegotiation\r
+ * period is 2^48 - 1, and for MBEDTLS_SSL_TRANSPORT_STREAM,\r
+ * the maximum renegotiation period is 2^64 - 1.\r
+ *\r
+ * \param conf SSL configuration\r
+ * \param period The threshold value: a big-endian 64-bit number.\r
+ */\r
+void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,\r
+ const unsigned char period[8] );\r
+#endif /* MBEDTLS_SSL_RENEGOTIATION */\r
+\r
+/**\r
+ * \brief Check if there is data already read from the\r
+ * underlying transport but not yet processed.\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return 0 if nothing's pending, 1 otherwise.\r
+ *\r
+ * \note This is different in purpose and behaviour from\r
+ * \c mbedtls_ssl_get_bytes_avail in that it considers\r
+ * any kind of unprocessed data, not only unread\r
+ * application data. If \c mbedtls_ssl_get_bytes\r
+ * returns a non-zero value, this function will\r
+ * also signal pending data, but the converse does\r
+ * not hold. For example, in DTLS there might be\r
+ * further records waiting to be processed from\r
+ * the current underlying transport's datagram.\r
+ *\r
+ * \note If this function returns 1 (data pending), this\r
+ * does not imply that a subsequent call to\r
+ * \c mbedtls_ssl_read will provide any data;\r
+ * e.g., the unprocessed data might turn out\r
+ * to be an alert or a handshake message.\r
+ *\r
+ * \note This function is useful in the following situation:\r
+ * If the SSL/TLS module successfully returns from an\r
+ * operation - e.g. a handshake or an application record\r
+ * read - and you're awaiting incoming data next, you\r
+ * must not immediately idle on the underlying transport\r
+ * to have data ready, but you need to check the value\r
+ * of this function first. The reason is that the desired\r
+ * data might already be read but not yet processed.\r
+ * If, in contrast, a previous call to the SSL/TLS module\r
+ * returned MBEDTLS_ERR_SSL_WANT_READ, it is not necessary\r
+ * to call this function, as the latter error code entails\r
+ * that all internal data has been processed.\r
+ *\r
+ */\r
+int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Return the number of application data bytes\r
+ * remaining to be read from the current record.\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return How many bytes are available in the application\r
+ * data record read buffer.\r
+ *\r
+ * \note When working over a datagram transport, this is\r
+ * useful to detect the current datagram's boundary\r
+ * in case \c mbedtls_ssl_read has written the maximal\r
+ * amount of data fitting into the input buffer.\r
+ *\r
+ */\r
+size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Return the result of the certificate verification\r
+ *\r
+ * \param ssl The SSL context to use.\r
+ *\r
+ * \return \c 0 if the certificate verification was successful.\r
+ * \return \c -1u if the result is not available. This may happen\r
+ * e.g. if the handshake aborts early, or a verification\r
+ * callback returned a fatal error.\r
+ * \return A bitwise combination of \c MBEDTLS_X509_BADCERT_XXX\r
+ * and \c MBEDTLS_X509_BADCRL_XXX failure flags; see x509.h.\r
+ */\r
+uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Return the name of the current ciphersuite\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return a string containing the ciphersuite name\r
+ */\r
+const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Return the current SSL version (SSLv3/TLSv1/etc)\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return a string containing the SSL version\r
+ */\r
+const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Return the (maximum) number of bytes added by the record\r
+ * layer: header + encryption/MAC overhead (inc. padding)\r
+ *\r
+ * \note This function is not available (always returns an error)\r
+ * when record compression is enabled.\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return Current maximum record expansion in bytes, or\r
+ * MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if compression is\r
+ * enabled, which makes expansion much less predictable\r
+ */\r
+int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl );\r
+\r
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)\r
+/**\r
+ * \brief Return the maximum fragment length (payload, in bytes).\r
+ * This is the value negotiated with peer if any,\r
+ * or the locally configured value.\r
+ *\r
+ * \sa mbedtls_ssl_conf_max_frag_len()\r
+ * \sa mbedtls_ssl_get_max_record_payload()\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return Current maximum fragment length.\r
+ */\r
+size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl );\r
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */\r
+\r
+/**\r
+ * \brief Return the current maximum outgoing record payload in bytes.\r
+ * This takes into account the config.h setting \c\r
+ * MBEDTLS_SSL_OUT_CONTENT_LEN, the configured and negotiated\r
+ * max fragment length extension if used, and for DTLS the\r
+ * path MTU as configured and current record expansion.\r
+ *\r
+ * \note With DTLS, \c mbedtls_ssl_write() will return an error if\r
+ * called with a larger length value.\r
+ * With TLS, \c mbedtls_ssl_write() will fragment the input if\r
+ * necessary and return the number of bytes written; it is up\r
+ * to the caller to call \c mbedtls_ssl_write() again in\r
+ * order to send the remaining bytes if any.\r
+ *\r
+ * \note This function is not available (always returns an error)\r
+ * when record compression is enabled.\r
+ *\r
+ * \sa mbedtls_ssl_set_mtu()\r
+ * \sa mbedtls_ssl_get_max_frag_len()\r
+ * \sa mbedtls_ssl_get_record_expansion()\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return Current maximum payload for an outgoing record,\r
+ * or a negative error code.\r
+ */\r
+int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl );\r
+\r
+#if defined(MBEDTLS_X509_CRT_PARSE_C)\r
+/**\r
+ * \brief Return the peer certificate from the current connection.\r
+ *\r
+ * \param ssl The SSL context to use. This must be initialized and setup.\r
+ *\r
+ * \return The current peer certificate, if available.\r
+ * The returned certificate is owned by the SSL context and\r
+ * is valid only until the next call to the SSL API.\r
+ * \return \c NULL if no peer certificate is available. This might\r
+ * be because the chosen ciphersuite doesn't use CRTs\r
+ * (PSK-based ciphersuites, for example), or because\r
+ * #MBEDTLS_SSL_KEEP_PEER_CERTIFICATE has been disabled,\r
+ * allowing the stack to free the peer's CRT to save memory.\r
+ *\r
+ * \note For one-time inspection of the peer's certificate during\r
+ * the handshake, consider registering an X.509 CRT verification\r
+ * callback through mbedtls_ssl_conf_verify() instead of calling\r
+ * this function. Using mbedtls_ssl_conf_verify() also comes at\r
+ * the benefit of allowing you to influence the verification\r
+ * process, for example by masking expected and tolerated\r
+ * verification failures.\r
+ *\r
+ * \warning You must not use the pointer returned by this function\r
+ * after any further call to the SSL API, including\r
+ * mbedtls_ssl_read() and mbedtls_ssl_write(); this is\r
+ * because the pointer might change during renegotiation,\r
+ * which happens transparently to the user.\r
+ * If you want to use the certificate across API calls,\r
+ * you must make a copy.\r
+ */\r
+const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl );\r
+#endif /* MBEDTLS_X509_CRT_PARSE_C */\r
+\r
+#if defined(MBEDTLS_SSL_CLI_C)\r
+/**\r
+ * \brief Save session in order to resume it later (client-side only)\r
+ * Session data is copied to presented session structure.\r
+ *\r
+ *\r
+ * \param ssl SSL context\r
+ * \param session session context\r
+ *\r
+ * \return 0 if successful,\r
+ * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed,\r
+ * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or\r
+ * arguments are otherwise invalid.\r
+ *\r
+ * \note Only the server certificate is copied, and not the full chain,\r
+ * so you should not attempt to validate the certificate again\r
+ * by calling \c mbedtls_x509_crt_verify() on it.\r
+ * Instead, you should use the results from the verification\r
+ * in the original handshake by calling \c mbedtls_ssl_get_verify_result()\r
+ * after loading the session again into a new SSL context\r
+ * using \c mbedtls_ssl_set_session().\r
+ *\r
+ * \note Once the session object is not needed anymore, you should\r
+ * free it by calling \c mbedtls_ssl_session_free().\r
+ *\r
+ * \sa mbedtls_ssl_set_session()\r
+ */\r
+int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *session );\r
+#endif /* MBEDTLS_SSL_CLI_C */\r
+\r
+/**\r
+ * \brief Perform the SSL handshake\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return \c 0 if successful.\r
+ * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE\r
+ * if the handshake is incomplete and waiting for data to\r
+ * be available for reading from or writing to the underlying\r
+ * transport - in this case you must call this function again\r
+ * when the underlying transport is ready for the operation.\r
+ * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous\r
+ * operation is in progress (see\r
+ * mbedtls_ssl_conf_async_private_cb()) - in this case you\r
+ * must call this function again when the operation is ready.\r
+ * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic\r
+ * operation is in progress (see mbedtls_ecp_set_max_ops()) -\r
+ * in this case you must call this function again to complete\r
+ * the handshake when you're done attending other tasks.\r
+ * \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use\r
+ * and the client did not demonstrate reachability yet - in\r
+ * this case you must stop using the context (see below).\r
+ * \return Another SSL error code - in this case you must stop using\r
+ * the context (see below).\r
+ *\r
+ * \warning If this function returns something other than\r
+ * \c 0,\r
+ * #MBEDTLS_ERR_SSL_WANT_READ,\r
+ * #MBEDTLS_ERR_SSL_WANT_WRITE,\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or\r
+ * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS,\r
+ * you must stop using the SSL context for reading or writing,\r
+ * and either free it or call \c mbedtls_ssl_session_reset()\r
+ * on it before re-using it for a new connection; the current\r
+ * connection must be closed.\r
+ *\r
+ * \note If DTLS is in use, then you may choose to handle\r
+ * #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging\r
+ * purposes, as it is an expected return value rather than an\r
+ * actual error, but you still need to reset/free the context.\r
+ *\r
+ * \note Remarks regarding event-driven DTLS:\r
+ * If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram\r
+ * from the underlying transport layer is currently being processed,\r
+ * and it is safe to idle until the timer or the underlying transport\r
+ * signal a new event. This is not true for a successful handshake,\r
+ * in which case the datagram of the underlying transport that is\r
+ * currently being processed might or might not contain further\r
+ * DTLS records.\r
+ */\r
+int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Perform a single step of the SSL handshake\r
+ *\r
+ * \note The state of the context (ssl->state) will be at\r
+ * the next state after this function returns \c 0. Do not\r
+ * call this function if state is MBEDTLS_SSL_HANDSHAKE_OVER.\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return See mbedtls_ssl_handshake().\r
+ *\r
+ * \warning If this function returns something other than \c 0,\r
+ * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE,\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or\r
+ * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using\r
+ * the SSL context for reading or writing, and either free it\r
+ * or call \c mbedtls_ssl_session_reset() on it before\r
+ * re-using it for a new connection; the current connection\r
+ * must be closed.\r
+ */\r
+int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl );\r
+\r
+#if defined(MBEDTLS_SSL_RENEGOTIATION)\r
+/**\r
+ * \brief Initiate an SSL renegotiation on the running connection.\r
+ * Client: perform the renegotiation right now.\r
+ * Server: request renegotiation, which will be performed\r
+ * during the next call to mbedtls_ssl_read() if honored by\r
+ * client.\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return 0 if successful, or any mbedtls_ssl_handshake() return\r
+ * value except #MBEDTLS_ERR_SSL_CLIENT_RECONNECT that can't\r
+ * happen during a renegotiation.\r
+ *\r
+ * \warning If this function returns something other than \c 0,\r
+ * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE,\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or\r
+ * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using\r
+ * the SSL context for reading or writing, and either free it\r
+ * or call \c mbedtls_ssl_session_reset() on it before\r
+ * re-using it for a new connection; the current connection\r
+ * must be closed.\r
+ *\r
+ */\r
+int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl );\r
+#endif /* MBEDTLS_SSL_RENEGOTIATION */\r
+\r
+/**\r
+ * \brief Read at most 'len' application data bytes\r
+ *\r
+ * \param ssl SSL context\r
+ * \param buf buffer that will hold the data\r
+ * \param len maximum number of bytes to read\r
+ *\r
+ * \return The (positive) number of bytes read if successful.\r
+ * \return \c 0 if the read end of the underlying transport was closed\r
+ * - in this case you must stop using the context (see below).\r
+ * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE\r
+ * if the handshake is incomplete and waiting for data to\r
+ * be available for reading from or writing to the underlying\r
+ * transport - in this case you must call this function again\r
+ * when the underlying transport is ready for the operation.\r
+ * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous\r
+ * operation is in progress (see\r
+ * mbedtls_ssl_conf_async_private_cb()) - in this case you\r
+ * must call this function again when the operation is ready.\r
+ * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic\r
+ * operation is in progress (see mbedtls_ecp_set_max_ops()) -\r
+ * in this case you must call this function again to complete\r
+ * the handshake when you're done attending other tasks.\r
+ * \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server\r
+ * side of a DTLS connection and the client is initiating a\r
+ * new connection using the same source port. See below.\r
+ * \return Another SSL error code - in this case you must stop using\r
+ * the context (see below).\r
+ *\r
+ * \warning If this function returns something other than\r
+ * a positive value,\r
+ * #MBEDTLS_ERR_SSL_WANT_READ,\r
+ * #MBEDTLS_ERR_SSL_WANT_WRITE,\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS,\r
+ * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or\r
+ * #MBEDTLS_ERR_SSL_CLIENT_RECONNECT,\r
+ * you must stop using the SSL context for reading or writing,\r
+ * and either free it or call \c mbedtls_ssl_session_reset()\r
+ * on it before re-using it for a new connection; the current\r
+ * connection must be closed.\r
+ *\r
+ * \note When this function returns #MBEDTLS_ERR_SSL_CLIENT_RECONNECT\r
+ * (which can only happen server-side), it means that a client\r
+ * is initiating a new connection using the same source port.\r
+ * You can either treat that as a connection close and wait\r
+ * for the client to resend a ClientHello, or directly\r
+ * continue with \c mbedtls_ssl_handshake() with the same\r
+ * context (as it has been reset internally). Either way, you\r
+ * must make sure this is seen by the application as a new\r
+ * connection: application state, if any, should be reset, and\r
+ * most importantly the identity of the client must be checked\r
+ * again. WARNING: not validating the identity of the client\r
+ * again, or not transmitting the new identity to the\r
+ * application layer, would allow authentication bypass!\r
+ *\r
+ * \note Remarks regarding event-driven DTLS:\r
+ * - If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram\r
+ * from the underlying transport layer is currently being processed,\r
+ * and it is safe to idle until the timer or the underlying transport\r
+ * signal a new event.\r
+ * - This function may return MBEDTLS_ERR_SSL_WANT_READ even if data was\r
+ * initially available on the underlying transport, as this data may have\r
+ * been only e.g. duplicated messages or a renegotiation request.\r
+ * Therefore, you must be prepared to receive MBEDTLS_ERR_SSL_WANT_READ even\r
+ * when reacting to an incoming-data event from the underlying transport.\r
+ * - On success, the datagram of the underlying transport that is currently\r
+ * being processed may contain further DTLS records. You should call\r
+ * \c mbedtls_ssl_check_pending to check for remaining records.\r
+ *\r
+ */\r
+int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len );\r
+\r
+/**\r
+ * \brief Try to write exactly 'len' application data bytes\r
+ *\r
+ * \warning This function will do partial writes in some cases. If the\r
+ * return value is non-negative but less than length, the\r
+ * function must be called again with updated arguments:\r
+ * buf + ret, len - ret (if ret is the return value) until\r
+ * it returns a value equal to the last 'len' argument.\r
+ *\r
+ * \param ssl SSL context\r
+ * \param buf buffer holding the data\r
+ * \param len how many bytes must be written\r
+ *\r
+ * \return The (non-negative) number of bytes actually written if\r
+ * successful (may be less than \p len).\r
+ * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE\r
+ * if the handshake is incomplete and waiting for data to\r
+ * be available for reading from or writing to the underlying\r
+ * transport - in this case you must call this function again\r
+ * when the underlying transport is ready for the operation.\r
+ * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous\r
+ * operation is in progress (see\r
+ * mbedtls_ssl_conf_async_private_cb()) - in this case you\r
+ * must call this function again when the operation is ready.\r
+ * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic\r
+ * operation is in progress (see mbedtls_ecp_set_max_ops()) -\r
+ * in this case you must call this function again to complete\r
+ * the handshake when you're done attending other tasks.\r
+ * \return Another SSL error code - in this case you must stop using\r
+ * the context (see below).\r
+ *\r
+ * \warning If this function returns something other than\r
+ * a non-negative value,\r
+ * #MBEDTLS_ERR_SSL_WANT_READ,\r
+ * #MBEDTLS_ERR_SSL_WANT_WRITE,\r
+ * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or\r
+ * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS,\r
+ * you must stop using the SSL context for reading or writing,\r
+ * and either free it or call \c mbedtls_ssl_session_reset()\r
+ * on it before re-using it for a new connection; the current\r
+ * connection must be closed.\r
+ *\r
+ * \note When this function returns #MBEDTLS_ERR_SSL_WANT_WRITE/READ,\r
+ * it must be called later with the *same* arguments,\r
+ * until it returns a value greater that or equal to 0. When\r
+ * the function returns #MBEDTLS_ERR_SSL_WANT_WRITE there may be\r
+ * some partial data in the output buffer, however this is not\r
+ * yet sent.\r
+ *\r
+ * \note If the requested length is greater than the maximum\r
+ * fragment length (either the built-in limit or the one set\r
+ * or negotiated with the peer), then:\r
+ * - with TLS, less bytes than requested are written.\r
+ * - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned.\r
+ * \c mbedtls_ssl_get_max_frag_len() may be used to query the\r
+ * active maximum fragment length.\r
+ *\r
+ * \note Attempting to write 0 bytes will result in an empty TLS\r
+ * application record being sent.\r
+ */\r
+int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len );\r
+\r
+/**\r
+ * \brief Send an alert message\r
+ *\r
+ * \param ssl SSL context\r
+ * \param level The alert level of the message\r
+ * (MBEDTLS_SSL_ALERT_LEVEL_WARNING or MBEDTLS_SSL_ALERT_LEVEL_FATAL)\r
+ * \param message The alert message (SSL_ALERT_MSG_*)\r
+ *\r
+ * \return 0 if successful, or a specific SSL error code.\r
+ *\r
+ * \note If this function returns something other than 0 or\r
+ * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using\r
+ * the SSL context for reading or writing, and either free it or\r
+ * call \c mbedtls_ssl_session_reset() on it before re-using it\r
+ * for a new connection; the current connection must be closed.\r
+ */\r
+int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,\r
+ unsigned char level,\r
+ unsigned char message );\r
+/**\r
+ * \brief Notify the peer that the connection is being closed\r
+ *\r
+ * \param ssl SSL context\r
+ *\r
+ * \return 0 if successful, or a specific SSL error code.\r
+ *\r
+ * \note If this function returns something other than 0 or\r
+ * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using\r
+ * the SSL context for reading or writing, and either free it or\r
+ * call \c mbedtls_ssl_session_reset() on it before re-using it\r
+ * for a new connection; the current connection must be closed.\r
+ */\r
+int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Free referenced items in an SSL context and clear memory\r
+ *\r
+ * \param ssl SSL context\r
+ */\r
+void mbedtls_ssl_free( mbedtls_ssl_context *ssl );\r
+\r
+/**\r
+ * \brief Initialize an SSL configuration context\r
+ * Just makes the context ready for\r
+ * mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free().\r
+ *\r
+ * \note You need to call mbedtls_ssl_config_defaults() unless you\r
+ * manually set all of the relevant fields yourself.\r
+ *\r
+ * \param conf SSL configuration context\r
+ */\r
+void mbedtls_ssl_config_init( mbedtls_ssl_config *conf );\r
+\r
+/**\r
+ * \brief Load reasonnable default SSL configuration values.\r
+ * (You need to call mbedtls_ssl_config_init() first.)\r
+ *\r
+ * \param conf SSL configuration context\r
+ * \param endpoint MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER\r
+ * \param transport MBEDTLS_SSL_TRANSPORT_STREAM for TLS, or\r
+ * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS\r
+ * \param preset a MBEDTLS_SSL_PRESET_XXX value\r
+ *\r
+ * \note See \c mbedtls_ssl_conf_transport() for notes on DTLS.\r
+ *\r
+ * \return 0 if successful, or\r
+ * MBEDTLS_ERR_XXX_ALLOC_FAILED on memory allocation error.\r
+ */\r
+int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,\r
+ int endpoint, int transport, int preset );\r
+\r
+/**\r
+ * \brief Free an SSL configuration context\r
+ *\r
+ * \param conf SSL configuration context\r
+ */\r
+void mbedtls_ssl_config_free( mbedtls_ssl_config *conf );\r
+\r
+/**\r
+ * \brief Initialize SSL session structure\r
+ *\r
+ * \param session SSL session\r
+ */\r
+void mbedtls_ssl_session_init( mbedtls_ssl_session *session );\r
+\r
+/**\r
+ * \brief Free referenced items in an SSL session including the\r
+ * peer certificate and clear memory\r
+ *\r
+ * \note A session object can be freed even if the SSL context\r
+ * that was used to retrieve the session is still in use.\r
+ *\r
+ * \param session SSL session\r
+ */\r
+void mbedtls_ssl_session_free( mbedtls_ssl_session *session );\r
+\r
+/**\r
+ * \brief TLS-PRF function for key derivation.\r
+ *\r
+ * \param prf The tls_prf type funtion type to be used.\r
+ * \param secret Secret for the key derivation function.\r
+ * \param slen Length of the secret.\r
+ * \param label String label for the key derivation function,\r
+ * terminated with null character.\r
+ * \param random Random bytes.\r
+ * \param rlen Length of the random bytes buffer.\r
+ * \param dstbuf The buffer holding the derived key.\r
+ * \param dlen Length of the output buffer.\r
+ *\r
+ * \return 0 on sucess. An SSL specific error on failure.\r
+ */\r
+int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,\r
+ const unsigned char *secret, size_t slen,\r
+ const char *label,\r
+ const unsigned char *random, size_t rlen,\r
+ unsigned char *dstbuf, size_t dlen );\r
+\r
+#ifdef __cplusplus\r
+}\r
+#endif\r
+\r
+#endif /* ssl.h */\r
projects / freertos / blobdiff