Go to the documentation of this file.
36 #define TlsContext struct _TlsContext
40 #define TlsEncryptionEngine struct _TlsEncryptionEngine
45 #include "tls_config.h"
81 #ifndef GPL_LICENSE_TERMS_ACCEPTED
82 #error Before compiling CycloneSSL Open, you must accept the terms of the GPL license
86 #define CYCLONE_SSL_VERSION_STRING "2.3.0"
88 #define CYCLONE_SSL_MAJOR_VERSION 2
90 #define CYCLONE_SSL_MINOR_VERSION 3
92 #define CYCLONE_SSL_REV_NUMBER 0
95 #define SSL_VERSION_3_0 0x0300
96 #define TLS_VERSION_1_0 0x0301
97 #define TLS_VERSION_1_1 0x0302
98 #define TLS_VERSION_1_2 0x0303
99 #define TLS_VERSION_1_3 0x0304
103 #define TLS_SUPPORT ENABLED
104 #elif (TLS_SUPPORT != ENABLED && TLS_SUPPORT != DISABLED)
105 #error TLS_SUPPORT parameter is not valid
109 #ifndef TLS_CLIENT_SUPPORT
110 #define TLS_CLIENT_SUPPORT ENABLED
111 #elif (TLS_CLIENT_SUPPORT != ENABLED && TLS_CLIENT_SUPPORT != DISABLED)
112 #error TLS_CLIENT_SUPPORT parameter is not valid
116 #ifndef TLS_SERVER_SUPPORT
117 #define TLS_SERVER_SUPPORT ENABLED
118 #elif (TLS_SERVER_SUPPORT != ENABLED && TLS_SERVER_SUPPORT != DISABLED)
119 #error TLS_SERVER_SUPPORT parameter is not valid
123 #ifndef TLS_MIN_VERSION
124 #define TLS_MIN_VERSION TLS_VERSION_1_2
125 #elif (TLS_MIN_VERSION < TLS_VERSION_1_0)
126 #error TLS_MIN_VERSION parameter is not valid
130 #ifndef TLS_MAX_VERSION
131 #define TLS_MAX_VERSION TLS_VERSION_1_3
132 #elif (TLS_MAX_VERSION > TLS_VERSION_1_3 || TLS_MAX_VERSION < TLS_MIN_VERSION)
133 #error TLS_MAX_VERSION parameter is not valid
137 #ifndef TLS_SESSION_RESUME_SUPPORT
138 #define TLS_SESSION_RESUME_SUPPORT ENABLED
139 #elif (TLS_SESSION_RESUME_SUPPORT != ENABLED && TLS_SESSION_RESUME_SUPPORT != DISABLED)
140 #error TLS_SESSION_RESUME_SUPPORT parameter is not valid
144 #ifndef TLS_SESSION_CACHE_LIFETIME
145 #define TLS_SESSION_CACHE_LIFETIME 3600000
146 #elif (TLS_SESSION_CACHE_LIFETIME < 1000)
147 #error TLS_SESSION_CACHE_LIFETIME parameter is not valid
151 #ifndef TLS_TICKET_SUPPORT
152 #define TLS_TICKET_SUPPORT DISABLED
153 #elif (TLS_TICKET_SUPPORT != ENABLED && TLS_TICKET_SUPPORT != DISABLED)
154 #error TLS_TICKET_SUPPORT parameter is not valid
158 #ifndef TLS_MAX_TICKET_SIZE
159 #define TLS_MAX_TICKET_SIZE 1024
160 #elif (TLS_MAX_TICKET_SIZE < 32)
161 #error TLS_MAX_TICKET_SIZE parameter is not valid
165 #ifndef TLS_TICKET_LIFETIME
166 #define TLS_TICKET_LIFETIME 3600000
167 #elif (TLS_TICKET_LIFETIME < 0)
168 #error TLS_TICKET_LIFETIME parameter is not valid
172 #ifndef TLS_SNI_SUPPORT
173 #define TLS_SNI_SUPPORT ENABLED
174 #elif (TLS_SNI_SUPPORT != ENABLED && TLS_SNI_SUPPORT != DISABLED)
175 #error TLS_SNI_SUPPORT parameter is not valid
179 #ifndef TLS_MAX_FRAG_LEN_SUPPORT
180 #define TLS_MAX_FRAG_LEN_SUPPORT DISABLED
181 #elif (TLS_MAX_FRAG_LEN_SUPPORT != ENABLED && TLS_MAX_FRAG_LEN_SUPPORT != DISABLED)
182 #error TLS_MAX_FRAG_LEN_SUPPORT parameter is not valid
186 #ifndef TLS_RECORD_SIZE_LIMIT_SUPPORT
187 #define TLS_RECORD_SIZE_LIMIT_SUPPORT ENABLED
188 #elif (TLS_RECORD_SIZE_LIMIT_SUPPORT != ENABLED && TLS_RECORD_SIZE_LIMIT_SUPPORT != DISABLED)
189 #error TLS_RECORD_SIZE_LIMIT_SUPPORT parameter is not valid
193 #ifndef TLS_ALPN_SUPPORT
194 #define TLS_ALPN_SUPPORT DISABLED
195 #elif (TLS_ALPN_SUPPORT != ENABLED && TLS_ALPN_SUPPORT != DISABLED)
196 #error TLS_ALPN_SUPPORT parameter is not valid
200 #ifndef TLS_EXT_MASTER_SECRET_SUPPORT
201 #define TLS_EXT_MASTER_SECRET_SUPPORT ENABLED
202 #elif (TLS_EXT_MASTER_SECRET_SUPPORT != ENABLED && TLS_EXT_MASTER_SECRET_SUPPORT != DISABLED)
203 #error TLS_EXT_MASTER_SECRET_SUPPORT parameter is not valid
207 #ifndef TLS_CLIENT_HELLO_PADDING_SUPPORT
208 #define TLS_CLIENT_HELLO_PADDING_SUPPORT ENABLED
209 #elif (TLS_CLIENT_HELLO_PADDING_SUPPORT != ENABLED && TLS_CLIENT_HELLO_PADDING_SUPPORT != DISABLED)
210 #error TLS_CLIENT_HELLO_PADDING_SUPPORT parameter is not valid
214 #ifndef TLS_CERT_AUTHORITIES_SUPPORT
215 #define TLS_CERT_AUTHORITIES_SUPPORT DISABLED
216 #elif (TLS_CERT_AUTHORITIES_SUPPORT != ENABLED && TLS_CERT_AUTHORITIES_SUPPORT != DISABLED)
217 #error TLS_CERT_AUTHORITIES_SUPPORT parameter is not valid
221 #ifndef TLS_SIGN_ALGOS_CERT_SUPPORT
222 #define TLS_SIGN_ALGOS_CERT_SUPPORT DISABLED
223 #elif (TLS_SIGN_ALGOS_CERT_SUPPORT != ENABLED && TLS_SIGN_ALGOS_CERT_SUPPORT != DISABLED)
224 #error TLS_SIGN_ALGOS_CERT_SUPPORT parameter is not valid
228 #ifndef TLS_RAW_PUBLIC_KEY_SUPPORT
229 #define TLS_RAW_PUBLIC_KEY_SUPPORT DISABLED
230 #elif (TLS_RAW_PUBLIC_KEY_SUPPORT != ENABLED && TLS_RAW_PUBLIC_KEY_SUPPORT != DISABLED)
231 #error TLS_RAW_PUBLIC_KEY_SUPPORT parameter is not valid
235 #ifndef TLS_SECURE_RENEGOTIATION_SUPPORT
236 #define TLS_SECURE_RENEGOTIATION_SUPPORT DISABLED
237 #elif (TLS_SECURE_RENEGOTIATION_SUPPORT != ENABLED && TLS_SECURE_RENEGOTIATION_SUPPORT != DISABLED)
238 #error TLS_SECURE_RENEGOTIATION_SUPPORT parameter is not valid
242 #ifndef TLS_FALLBACK_SCSV_SUPPORT
243 #define TLS_FALLBACK_SCSV_SUPPORT DISABLED
244 #elif (TLS_FALLBACK_SCSV_SUPPORT != ENABLED && TLS_FALLBACK_SCSV_SUPPORT != DISABLED)
245 #error TLS_FALLBACK_SCSV_SUPPORT parameter is not valid
249 #ifndef TLS_ECC_CALLBACK_SUPPORT
250 #define TLS_ECC_CALLBACK_SUPPORT DISABLED
251 #elif (TLS_ECC_CALLBACK_SUPPORT != ENABLED && TLS_ECC_CALLBACK_SUPPORT != DISABLED)
252 #error TLS_ECC_CALLBACK_SUPPORT parameter is not valid
256 #ifndef TLS_MAX_CERTIFICATES
257 #define TLS_MAX_CERTIFICATES 3
258 #elif (TLS_MAX_CERTIFICATES < 1)
259 #error TLS_MAX_CERTIFICATES parameter is not valid
263 #ifndef TLS_RSA_KE_SUPPORT
264 #define TLS_RSA_KE_SUPPORT ENABLED
265 #elif (TLS_RSA_KE_SUPPORT != ENABLED && TLS_RSA_KE_SUPPORT != DISABLED)
266 #error TLS_RSA_KE_SUPPORT parameter is not valid
270 #ifndef TLS_DHE_RSA_KE_SUPPORT
271 #define TLS_DHE_RSA_KE_SUPPORT ENABLED
272 #elif (TLS_DHE_RSA_KE_SUPPORT != ENABLED && TLS_DHE_RSA_KE_SUPPORT != DISABLED)
273 #error TLS_DHE_RSA_KE_SUPPORT parameter is not valid
277 #ifndef TLS_DHE_DSS_KE_SUPPORT
278 #define TLS_DHE_DSS_KE_SUPPORT DISABLED
279 #elif (TLS_DHE_DSS_KE_SUPPORT != ENABLED && TLS_DHE_DSS_KE_SUPPORT != DISABLED)
280 #error TLS_DHE_DSS_KE_SUPPORT parameter is not valid
284 #ifndef TLS_DH_ANON_KE_SUPPORT
285 #define TLS_DH_ANON_KE_SUPPORT DISABLED
286 #elif (TLS_DH_ANON_KE_SUPPORT != ENABLED && TLS_DH_ANON_KE_SUPPORT != DISABLED)
287 #error TLS_DH_ANON_KE_SUPPORT parameter is not valid
291 #ifndef TLS_ECDHE_RSA_KE_SUPPORT
292 #define TLS_ECDHE_RSA_KE_SUPPORT ENABLED
293 #elif (TLS_ECDHE_RSA_KE_SUPPORT != ENABLED && TLS_ECDHE_RSA_KE_SUPPORT != DISABLED)
294 #error TLS_ECDHE_RSA_KE_SUPPORT parameter is not valid
298 #ifndef TLS_ECDHE_ECDSA_KE_SUPPORT
299 #define TLS_ECDHE_ECDSA_KE_SUPPORT ENABLED
300 #elif (TLS_ECDHE_ECDSA_KE_SUPPORT != ENABLED && TLS_ECDHE_ECDSA_KE_SUPPORT != DISABLED)
301 #error TLS_ECDHE_ECDSA_KE_SUPPORT parameter is not valid
305 #ifndef TLS_ECDH_ANON_KE_SUPPORT
306 #define TLS_ECDH_ANON_KE_SUPPORT DISABLED
307 #elif (TLS_ECDH_ANON_KE_SUPPORT != ENABLED && TLS_ECDH_ANON_KE_SUPPORT != DISABLED)
308 #error TLS_ECDH_ANON_KE_SUPPORT parameter is not valid
312 #ifndef TLS_PSK_KE_SUPPORT
313 #define TLS_PSK_KE_SUPPORT DISABLED
314 #elif (TLS_PSK_KE_SUPPORT != ENABLED && TLS_PSK_KE_SUPPORT != DISABLED)
315 #error TLS_PSK_KE_SUPPORT parameter is not valid
319 #ifndef TLS_RSA_PSK_KE_SUPPORT
320 #define TLS_RSA_PSK_KE_SUPPORT DISABLED
321 #elif (TLS_RSA_PSK_KE_SUPPORT != ENABLED && TLS_RSA_PSK_KE_SUPPORT != DISABLED)
322 #error TLS_RSA_PSK_KE_SUPPORT parameter is not valid
326 #ifndef TLS_DHE_PSK_KE_SUPPORT
327 #define TLS_DHE_PSK_KE_SUPPORT DISABLED
328 #elif (TLS_DHE_PSK_KE_SUPPORT != ENABLED && TLS_DHE_PSK_KE_SUPPORT != DISABLED)
329 #error TLS_DHE_PSK_KE_SUPPORT parameter is not valid
333 #ifndef TLS_ECDHE_PSK_KE_SUPPORT
334 #define TLS_ECDHE_PSK_KE_SUPPORT DISABLED
335 #elif (TLS_ECDHE_PSK_KE_SUPPORT != ENABLED && TLS_ECDHE_PSK_KE_SUPPORT != DISABLED)
336 #error TLS_ECDHE_PSK_KE_SUPPORT parameter is not valid
340 #ifndef TLS_RSA_SIGN_SUPPORT
341 #define TLS_RSA_SIGN_SUPPORT ENABLED
342 #elif (TLS_RSA_SIGN_SUPPORT != ENABLED && TLS_RSA_SIGN_SUPPORT != DISABLED)
343 #error TLS_RSA_SIGN_SUPPORT parameter is not valid
347 #ifndef TLS_RSA_PSS_SIGN_SUPPORT
348 #define TLS_RSA_PSS_SIGN_SUPPORT ENABLED
349 #elif (TLS_RSA_PSS_SIGN_SUPPORT != ENABLED && TLS_RSA_PSS_SIGN_SUPPORT != DISABLED)
350 #error TLS_RSA_PSS_SIGN_SUPPORT parameter is not valid
354 #ifndef TLS_DSA_SIGN_SUPPORT
355 #define TLS_DSA_SIGN_SUPPORT DISABLED
356 #elif (TLS_DSA_SIGN_SUPPORT != ENABLED && TLS_DSA_SIGN_SUPPORT != DISABLED)
357 #error TLS_DSA_SIGN_SUPPORT parameter is not valid
361 #ifndef TLS_ECDSA_SIGN_SUPPORT
362 #define TLS_ECDSA_SIGN_SUPPORT ENABLED
363 #elif (TLS_ECDSA_SIGN_SUPPORT != ENABLED && TLS_ECDSA_SIGN_SUPPORT != DISABLED)
364 #error TLS_ECDSA_SIGN_SUPPORT parameter is not valid
368 #ifndef TLS_EDDSA_SIGN_SUPPORT
369 #define TLS_EDDSA_SIGN_SUPPORT DISABLED
370 #elif (TLS_EDDSA_SIGN_SUPPORT != ENABLED && TLS_EDDSA_SIGN_SUPPORT != DISABLED)
371 #error TLS_EDDSA_SIGN_SUPPORT parameter is not valid
375 #ifndef TLS_NULL_CIPHER_SUPPORT
376 #define TLS_NULL_CIPHER_SUPPORT DISABLED
377 #elif (TLS_NULL_CIPHER_SUPPORT != ENABLED && TLS_NULL_CIPHER_SUPPORT != DISABLED)
378 #error TLS_NULL_CIPHER_SUPPORT parameter is not valid
382 #ifndef TLS_STREAM_CIPHER_SUPPORT
383 #define TLS_STREAM_CIPHER_SUPPORT DISABLED
384 #elif (TLS_STREAM_CIPHER_SUPPORT != ENABLED && TLS_STREAM_CIPHER_SUPPORT != DISABLED)
385 #error TLS_STREAM_CIPHER_SUPPORT parameter is not valid
389 #ifndef TLS_CBC_CIPHER_SUPPORT
390 #define TLS_CBC_CIPHER_SUPPORT ENABLED
391 #elif (TLS_CBC_CIPHER_SUPPORT != ENABLED && TLS_CBC_CIPHER_SUPPORT != DISABLED)
392 #error TLS_CBC_CIPHER_SUPPORT parameter is not valid
396 #ifndef TLS_CCM_CIPHER_SUPPORT
397 #define TLS_CCM_CIPHER_SUPPORT DISABLED
398 #elif (TLS_CCM_CIPHER_SUPPORT != ENABLED && TLS_CCM_CIPHER_SUPPORT != DISABLED)
399 #error TLS_CCM_CIPHER_SUPPORT parameter is not valid
403 #ifndef TLS_CCM_8_CIPHER_SUPPORT
404 #define TLS_CCM_8_CIPHER_SUPPORT DISABLED
405 #elif (TLS_CCM_8_CIPHER_SUPPORT != ENABLED && TLS_CCM_8_CIPHER_SUPPORT != DISABLED)
406 #error TLS_CCM_8_CIPHER_SUPPORT parameter is not valid
410 #ifndef TLS_GCM_CIPHER_SUPPORT
411 #define TLS_GCM_CIPHER_SUPPORT ENABLED
412 #elif (TLS_GCM_CIPHER_SUPPORT != ENABLED && TLS_GCM_CIPHER_SUPPORT != DISABLED)
413 #error TLS_GCM_CIPHER_SUPPORT parameter is not valid
417 #ifndef TLS_CHACHA20_POLY1305_SUPPORT
418 #define TLS_CHACHA20_POLY1305_SUPPORT DISABLED
419 #elif (TLS_CHACHA20_POLY1305_SUPPORT != ENABLED && TLS_CHACHA20_POLY1305_SUPPORT != DISABLED)
420 #error TLS_CHACHA20_POLY1305_SUPPORT parameter is not valid
424 #ifndef TLS_RC4_SUPPORT
425 #define TLS_RC4_SUPPORT DISABLED
426 #elif (TLS_RC4_SUPPORT != ENABLED && TLS_RC4_SUPPORT != DISABLED)
427 #error TLS_RC4_SUPPORT parameter is not valid
431 #ifndef TLS_IDEA_SUPPORT
432 #define TLS_IDEA_SUPPORT DISABLED
433 #elif (TLS_IDEA_SUPPORT != ENABLED && TLS_IDEA_SUPPORT != DISABLED)
434 #error TLS_IDEA_SUPPORT parameter is not valid
438 #ifndef TLS_DES_SUPPORT
439 #define TLS_DES_SUPPORT DISABLED
440 #elif (TLS_DES_SUPPORT != ENABLED && TLS_DES_SUPPORT != DISABLED)
441 #error TLS_DES_SUPPORT parameter is not valid
445 #ifndef TLS_3DES_SUPPORT
446 #define TLS_3DES_SUPPORT DISABLED
447 #elif (TLS_3DES_SUPPORT != ENABLED && TLS_3DES_SUPPORT != DISABLED)
448 #error TLS_3DES_SUPPORT parameter is not valid
452 #ifndef TLS_AES_128_SUPPORT
453 #define TLS_AES_128_SUPPORT ENABLED
454 #elif (TLS_AES_128_SUPPORT != ENABLED && TLS_AES_128_SUPPORT != DISABLED)
455 #error TLS_AES_128_SUPPORT parameter is not valid
459 #ifndef TLS_AES_256_SUPPORT
460 #define TLS_AES_256_SUPPORT ENABLED
461 #elif (TLS_AES_256_SUPPORT != ENABLED && TLS_AES_256_SUPPORT != DISABLED)
462 #error TLS_AES_256_SUPPORT parameter is not valid
466 #ifndef TLS_CAMELLIA_128_SUPPORT
467 #define TLS_CAMELLIA_128_SUPPORT DISABLED
468 #elif (TLS_CAMELLIA_128_SUPPORT != ENABLED && TLS_CAMELLIA_128_SUPPORT != DISABLED)
469 #error TLS_CAMELLIA_128_SUPPORT parameter is not valid
473 #ifndef TLS_CAMELLIA_256_SUPPORT
474 #define TLS_CAMELLIA_256_SUPPORT DISABLED
475 #elif (TLS_CAMELLIA_256_SUPPORT != ENABLED && TLS_CAMELLIA_256_SUPPORT != DISABLED)
476 #error TLS_CAMELLIA_256_SUPPORT parameter is not valid
480 #ifndef TLS_ARIA_128_SUPPORT
481 #define TLS_ARIA_128_SUPPORT DISABLED
482 #elif (TLS_ARIA_128_SUPPORT != ENABLED && TLS_ARIA_128_SUPPORT != DISABLED)
483 #error TLS_ARIA_128_SUPPORT parameter is not valid
487 #ifndef TLS_ARIA_256_SUPPORT
488 #define TLS_ARIA_256_SUPPORT DISABLED
489 #elif (TLS_ARIA_256_SUPPORT != ENABLED && TLS_ARIA_256_SUPPORT != DISABLED)
490 #error TLS_ARIA_256_SUPPORT parameter is not valid
494 #ifndef TLS_SEED_SUPPORT
495 #define TLS_SEED_SUPPORT DISABLED
496 #elif (TLS_SEED_SUPPORT != ENABLED && TLS_SEED_SUPPORT != DISABLED)
497 #error TLS_SEED_SUPPORT parameter is not valid
501 #ifndef TLS_MD5_SUPPORT
502 #define TLS_MD5_SUPPORT DISABLED
503 #elif (TLS_MD5_SUPPORT != ENABLED && TLS_MD5_SUPPORT != DISABLED)
504 #error TLS_MD5_SUPPORT parameter is not valid
508 #ifndef TLS_SHA1_SUPPORT
509 #define TLS_SHA1_SUPPORT ENABLED
510 #elif (TLS_SHA1_SUPPORT != ENABLED && TLS_SHA1_SUPPORT != DISABLED)
511 #error TLS_SHA1_SUPPORT parameter is not valid
515 #ifndef TLS_SHA224_SUPPORT
516 #define TLS_SHA224_SUPPORT DISABLED
517 #elif (TLS_SHA224_SUPPORT != ENABLED && TLS_SHA224_SUPPORT != DISABLED)
518 #error TLS_SHA224_SUPPORT parameter is not valid
522 #ifndef TLS_SHA256_SUPPORT
523 #define TLS_SHA256_SUPPORT ENABLED
524 #elif (TLS_SHA256_SUPPORT != ENABLED && TLS_SHA256_SUPPORT != DISABLED)
525 #error TLS_SHA256_SUPPORT parameter is not valid
529 #ifndef TLS_SHA384_SUPPORT
530 #define TLS_SHA384_SUPPORT ENABLED
531 #elif (TLS_SHA384_SUPPORT != ENABLED && TLS_SHA384_SUPPORT != DISABLED)
532 #error TLS_SHA384_SUPPORT parameter is not valid
536 #ifndef TLS_SHA512_SUPPORT
537 #define TLS_SHA512_SUPPORT DISABLED
538 #elif (TLS_SHA512_SUPPORT != ENABLED && TLS_SHA512_SUPPORT != DISABLED)
539 #error TLS_SHA512_SUPPORT parameter is not valid
543 #ifndef TLS_FFDHE_SUPPORT
544 #define TLS_FFDHE_SUPPORT DISABLED
545 #elif (TLS_FFDHE_SUPPORT != ENABLED && TLS_FFDHE_SUPPORT != DISABLED)
546 #error TLS_FFDHE_SUPPORT parameter is not valid
550 #ifndef TLS_FFDHE2048_SUPPORT
551 #define TLS_FFDHE2048_SUPPORT ENABLED
552 #elif (TLS_FFDHE2048_SUPPORT != ENABLED && TLS_FFDHE2048_SUPPORT != DISABLED)
553 #error TLS_FFDHE2048_SUPPORT parameter is not valid
557 #ifndef TLS_FFDHE3072_SUPPORT
558 #define TLS_FFDHE3072_SUPPORT DISABLED
559 #elif (TLS_FFDHE3072_SUPPORT != ENABLED && TLS_FFDHE3072_SUPPORT != DISABLED)
560 #error TLS_FFDHE3072_SUPPORT parameter is not valid
564 #ifndef TLS_FFDHE4096_SUPPORT
565 #define TLS_FFDHE4096_SUPPORT DISABLED
566 #elif (TLS_FFDHE4096_SUPPORT != ENABLED && TLS_FFDHE4096_SUPPORT != DISABLED)
567 #error TLS_FFDHE4096_SUPPORT parameter is not valid
571 #ifndef TLS_SECP160K1_SUPPORT
572 #define TLS_SECP160K1_SUPPORT DISABLED
573 #elif (TLS_SECP160K1_SUPPORT != ENABLED && TLS_SECP160K1_SUPPORT != DISABLED)
574 #error TLS_SECP160K1_SUPPORT parameter is not valid
578 #ifndef TLS_SECP160R1_SUPPORT
579 #define TLS_SECP160R1_SUPPORT DISABLED
580 #elif (TLS_SECP160R1_SUPPORT != ENABLED && TLS_SECP160R1_SUPPORT != DISABLED)
581 #error TLS_SECP160R1_SUPPORT parameter is not valid
585 #ifndef TLS_SECP160R2_SUPPORT
586 #define TLS_SECP160R2_SUPPORT DISABLED
587 #elif (TLS_SECP160R2_SUPPORT != ENABLED && TLS_SECP160R2_SUPPORT != DISABLED)
588 #error TLS_SECP160R2_SUPPORT parameter is not valid
592 #ifndef TLS_SECP192K1_SUPPORT
593 #define TLS_SECP192K1_SUPPORT DISABLED
594 #elif (TLS_SECP192K1_SUPPORT != ENABLED && TLS_SECP192K1_SUPPORT != DISABLED)
595 #error TLS_SECP192K1_SUPPORT parameter is not valid
599 #ifndef TLS_SECP192R1_SUPPORT
600 #define TLS_SECP192R1_SUPPORT DISABLED
601 #elif (TLS_SECP192R1_SUPPORT != ENABLED && TLS_SECP192R1_SUPPORT != DISABLED)
602 #error TLS_SECP192R1_SUPPORT parameter is not valid
606 #ifndef TLS_SECP224K1_SUPPORT
607 #define TLS_SECP224K1_SUPPORT DISABLED
608 #elif (TLS_SECP224K1_SUPPORT != ENABLED && TLS_SECP224K1_SUPPORT != DISABLED)
609 #error TLS_SECP224K1_SUPPORT parameter is not valid
613 #ifndef TLS_SECP224R1_SUPPORT
614 #define TLS_SECP224R1_SUPPORT DISABLED
615 #elif (TLS_SECP224R1_SUPPORT != ENABLED && TLS_SECP224R1_SUPPORT != DISABLED)
616 #error TLS_SECP224R1_SUPPORT parameter is not valid
620 #ifndef TLS_SECP256K1_SUPPORT
621 #define TLS_SECP256K1_SUPPORT DISABLED
622 #elif (TLS_SECP256K1_SUPPORT != ENABLED && TLS_SECP256K1_SUPPORT != DISABLED)
623 #error TLS_SECP256K1_SUPPORT parameter is not valid
627 #ifndef TLS_SECP256R1_SUPPORT
628 #define TLS_SECP256R1_SUPPORT ENABLED
629 #elif (TLS_SECP256R1_SUPPORT != ENABLED && TLS_SECP256R1_SUPPORT != DISABLED)
630 #error TLS_SECP256R1_SUPPORT parameter is not valid
634 #ifndef TLS_SECP384R1_SUPPORT
635 #define TLS_SECP384R1_SUPPORT ENABLED
636 #elif (TLS_SECP384R1_SUPPORT != ENABLED && TLS_SECP384R1_SUPPORT != DISABLED)
637 #error TLS_SECP384R1_SUPPORT parameter is not valid
641 #ifndef TLS_SECP521R1_SUPPORT
642 #define TLS_SECP521R1_SUPPORT DISABLED
643 #elif (TLS_SECP521R1_SUPPORT != ENABLED && TLS_SECP521R1_SUPPORT != DISABLED)
644 #error TLS_SECP521R1_SUPPORT parameter is not valid
648 #ifndef TLS_BRAINPOOLP256R1_SUPPORT
649 #define TLS_BRAINPOOLP256R1_SUPPORT DISABLED
650 #elif (TLS_BRAINPOOLP256R1_SUPPORT != ENABLED && TLS_BRAINPOOLP256R1_SUPPORT != DISABLED)
651 #error TLS_BRAINPOOLP256R1_SUPPORT parameter is not valid
655 #ifndef TLS_BRAINPOOLP384R1_SUPPORT
656 #define TLS_BRAINPOOLP384R1_SUPPORT DISABLED
657 #elif (TLS_BRAINPOOLP384R1_SUPPORT != ENABLED && TLS_BRAINPOOLP384R1_SUPPORT != DISABLED)
658 #error TLS_BRAINPOOLP384R1_SUPPORT parameter is not valid
662 #ifndef TLS_BRAINPOOLP512R1_SUPPORT
663 #define TLS_BRAINPOOLP512R1_SUPPORT DISABLED
664 #elif (TLS_BRAINPOOLP512R1_SUPPORT != ENABLED && TLS_BRAINPOOLP512R1_SUPPORT != DISABLED)
665 #error TLS_BRAINPOOLP512R1_SUPPORT parameter is not valid
669 #ifndef TLS_X25519_SUPPORT
670 #define TLS_X25519_SUPPORT DISABLED
671 #elif (TLS_X25519_SUPPORT != ENABLED && TLS_X25519_SUPPORT != DISABLED)
672 #error TLS_X25519_SUPPORT parameter is not valid
676 #ifndef TLS_X448_SUPPORT
677 #define TLS_X448_SUPPORT DISABLED
678 #elif (TLS_X448_SUPPORT != ENABLED && TLS_X448_SUPPORT != DISABLED)
679 #error TLS_X448_SUPPORT parameter is not valid
683 #ifndef TLS_ED25519_SUPPORT
684 #define TLS_ED25519_SUPPORT ENABLED
685 #elif (TLS_ED25519_SUPPORT != ENABLED && TLS_ED25519_SUPPORT != DISABLED)
686 #error TLS_ED25519_SUPPORT parameter is not valid
690 #ifndef TLS_ED448_SUPPORT
691 #define TLS_ED448_SUPPORT DISABLED
692 #elif (TLS_ED448_SUPPORT != ENABLED && TLS_ED448_SUPPORT != DISABLED)
693 #error TLS_ED448_SUPPORT parameter is not valid
697 #ifndef TLS_CERT_KEY_USAGE_SUPPORT
698 #define TLS_CERT_KEY_USAGE_SUPPORT ENABLED
699 #elif (TLS_CERT_KEY_USAGE_SUPPORT != ENABLED && TLS_CERT_KEY_USAGE_SUPPORT != DISABLED)
700 #error TLS_CERT_KEY_USAGE_SUPPORT parameter is not valid
704 #ifndef TLS_KEY_LOG_SUPPORT
705 #define TLS_KEY_LOG_SUPPORT DISABLED
706 #elif (TLS_KEY_LOG_SUPPORT != ENABLED && TLS_KEY_LOG_SUPPORT != DISABLED)
707 #error TLS_KEY_LOG_SUPPORT parameter is not valid
711 #ifndef TLS_MAX_SERVER_NAME_LEN
712 #define TLS_MAX_SERVER_NAME_LEN 255
713 #elif (TLS_MAX_SERVER_NAME_LEN < 1)
714 #error TLS_MAX_SERVER_NAME_LEN parameter is not valid
718 #ifndef TLS_MAX_PASSWORD_LEN
719 #define TLS_MAX_PASSWORD_LEN 32
720 #elif (TLS_MAX_PASSWORD_LEN < 0)
721 #error TLS_MAX_PASSWORD_LEN parameter is not valid
725 #ifndef TLS_MIN_DH_MODULUS_SIZE
726 #define TLS_MIN_DH_MODULUS_SIZE 1024
727 #elif (TLS_MIN_DH_MODULUS_SIZE < 512)
728 #error TLS_MIN_DH_MODULUS_SIZE parameter is not valid
732 #ifndef TLS_MAX_DH_MODULUS_SIZE
733 #define TLS_MAX_DH_MODULUS_SIZE 2048
734 #elif (TLS_MAX_DH_MODULUS_SIZE < TLS_MIN_DH_MODULUS_SIZE)
735 #error TLS_MAX_DH_MODULUS_SIZE parameter is not valid
739 #ifndef TLS_MIN_RSA_MODULUS_SIZE
740 #define TLS_MIN_RSA_MODULUS_SIZE 1024
741 #elif (TLS_MIN_RSA_MODULUS_SIZE < 512)
742 #error TLS_MIN_RSA_MODULUS_SIZE parameter is not valid
746 #ifndef TLS_MAX_RSA_MODULUS_SIZE
747 #define TLS_MAX_RSA_MODULUS_SIZE 4096
748 #elif (TLS_MAX_RSA_MODULUS_SIZE < TLS_MIN_RSA_MODULUS_SIZE)
749 #error TLS_MAX_RSA_MODULUS_SIZE parameter is not valid
753 #ifndef TLS_MIN_DSA_MODULUS_SIZE
754 #define TLS_MIN_DSA_MODULUS_SIZE 1024
755 #elif (TLS_MIN_DSA_MODULUS_SIZE < 512)
756 #error TLS_MIN_DSA_MODULUS_SIZE parameter is not valid
760 #ifndef TLS_MAX_DSA_MODULUS_SIZE
761 #define TLS_MAX_DSA_MODULUS_SIZE 4096
762 #elif (TLS_MAX_DSA_MODULUS_SIZE < TLS_MIN_DSA_MODULUS_SIZE)
763 #error TLS_MAX_DSA_MODULUS_SIZE parameter is not valid
767 #ifndef TLS_MASTER_SECRET_SIZE
768 #define TLS_MASTER_SECRET_SIZE 48
769 #elif (TLS_MASTER_SECRET_SIZE < 48)
770 #error TLS_MASTER_SECRET_SIZE parameter is not valid
774 #ifndef TLS_PREMASTER_SECRET_SIZE
775 #define TLS_PREMASTER_SECRET_SIZE (TLS_MAX_DH_MODULUS_SIZE / 8)
776 #elif (TLS_PREMASTER_SECRET_SIZE < 48)
777 #error TLS_PREMASTER_SECRET_SIZE parameter is not valid
781 #ifndef TLS_MAX_WARNING_ALERTS
782 #define TLS_MAX_WARNING_ALERTS 5
783 #elif (TLS_MAX_WARNING_ALERTS < 0)
784 #error TLS_MAX_WARNING_ALERTS parameter is not valid
788 #ifndef TLS_MAX_EMPTY_RECORDS
789 #define TLS_MAX_EMPTY_RECORDS 10
790 #elif (TLS_MAX_EMPTY_RECORDS < 0)
791 #error TLS_MAX_EMPTY_RECORDS parameter is not valid
795 #ifndef TLS_MAX_CHANGE_CIPHER_SPEC_MESSAGES
796 #define TLS_MAX_CHANGE_CIPHER_SPEC_MESSAGES 5
797 #elif (TLS_MAX_CHANGE_CIPHER_SPEC_MESSAGES < 0)
798 #error TLS_MAX_CHANGE_CIPHER_SPEC_MESSAGES parameter is not valid
802 #ifndef TLS_MAX_KEY_UPDATE_MESSAGES
803 #define TLS_MAX_KEY_UPDATE_MESSAGES 5
804 #elif (TLS_MAX_KEY_UPDATE_MESSAGES < 0)
805 #error TLS_MAX_KEY_UPDATE_MESSAGES parameter is not valid
809 #ifndef TLS_PRIVATE_CONTEXT
810 #define TLS_PRIVATE_CONTEXT
814 #ifndef TLS_PRIVATE_ENCRYPTION_ENGINE
815 #define TLS_PRIVATE_ENCRYPTION_ENGINE
820 #define tlsAllocMem(size) osAllocMem(size)
825 #define tlsFreeMem(p) osFreeMem(p)
829 #if ((TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_2) && \
830 (TLS_DH_ANON_KE_SUPPORT == ENABLED || TLS_DHE_RSA_KE_SUPPORT == ENABLED || \
831 TLS_DHE_DSS_KE_SUPPORT == ENABLED || TLS_DHE_PSK_KE_SUPPORT == ENABLED))
832 #define TLS_DH_SUPPORT ENABLED
833 #elif ((TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3) && \
834 (TLS13_DHE_KE_SUPPORT == ENABLED || TLS13_PSK_DHE_KE_SUPPORT == ENABLED))
835 #define TLS_DH_SUPPORT ENABLED
837 #define TLS_DH_SUPPORT DISABLED
841 #if ((TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_2) && \
842 (TLS_ECDH_ANON_KE_SUPPORT == ENABLED || TLS_ECDHE_RSA_KE_SUPPORT == ENABLED || \
843 TLS_ECDHE_ECDSA_KE_SUPPORT == ENABLED || TLS_ECDHE_PSK_KE_SUPPORT == ENABLED))
844 #define TLS_ECDH_SUPPORT ENABLED
845 #elif ((TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3) && \
846 (TLS13_ECDHE_KE_SUPPORT == ENABLED || TLS13_PSK_ECDHE_KE_SUPPORT == ENABLED))
847 #define TLS_ECDH_SUPPORT ENABLED
849 #define TLS_ECDH_SUPPORT DISABLED
853 #if ((TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_2) && \
854 (TLS_RSA_SIGN_SUPPORT == ENABLED || TLS_RSA_PSS_SIGN_SUPPORT == ENABLED || \
855 TLS_RSA_KE_SUPPORT == ENABLED || TLS_DHE_RSA_KE_SUPPORT == ENABLED || \
856 TLS_ECDHE_RSA_KE_SUPPORT == ENABLED || TLS_RSA_PSK_KE_SUPPORT == ENABLED))
857 #define TLS_RSA_SUPPORT ENABLED
858 #elif ((TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3) && \
859 (TLS_RSA_SIGN_SUPPORT == ENABLED || TLS_RSA_PSS_SIGN_SUPPORT == ENABLED))
860 #define TLS_RSA_SUPPORT ENABLED
862 #define TLS_RSA_SUPPORT DISABLED
866 #if ((TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_2) && \
867 (TLS_PSK_KE_SUPPORT == ENABLED || TLS_RSA_PSK_KE_SUPPORT == ENABLED || \
868 TLS_DHE_PSK_KE_SUPPORT == ENABLED || TLS_ECDHE_PSK_KE_SUPPORT == ENABLED))
869 #define TLS_PSK_SUPPORT ENABLED
870 #elif ((TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3) && \
871 (TLS13_PSK_KE_SUPPORT == ENABLED || TLS13_PSK_DHE_KE_SUPPORT == ENABLED || \
872 TLS13_PSK_ECDHE_KE_SUPPORT == ENABLED))
873 #define TLS_PSK_SUPPORT ENABLED
875 #define TLS_PSK_SUPPORT DISABLED
879 #if (TLS_SHA384_SUPPORT == ENABLED)
880 #define TLS_MAX_HKDF_DIGEST_SIZE 48
882 #define TLS_MAX_HKDF_DIGEST_SIZE 32
886 #define tlsSetSocket(context, socket) tlsSetSocketCallbacks(context, \
887 (TlsSocketSendCallback) socketSend, (TlsSocketReceiveCallback) socketReceive, \
888 (TlsSocketHandle) socket)
891 #define TLS_MIN_RECORD_LENGTH 512
893 #define TLS_MAX_RECORD_LENGTH 16384
895 #define TLS_MAX_RECORD_OVERHEAD 512
897 #define TLS_RANDOM_SIZE 32
968 #define TLS_FLAG_BREAK(c) (TLS_FLAG_BREAK_CHAR | LSB(c))
1416 #if defined(__CWCC__) || defined(_WIN32)
1417 #pragma pack(push, 1)
1703 uint16_t clientVersion;
1716 uint16_t serverVersion;
1743 uint8_t certificateTypesLen;
1775 uint32_t ticketLifetimeHint;
1820 #if (TLS_EXT_MASTER_SECRET_SUPPORT == ENABLED)
1827 #if defined(__CWCC__) || defined(_WIN32)
1867 const char_t *selectedProtocol);
1875 const uint8_t *pskIdentity,
size_t pskIdentityLen);
1891 const uint8_t *rawPublicKey,
size_t rawPublicKeyLen);
1899 const uint8_t *plaintext,
size_t plaintextLen, uint8_t *ciphertext,
1900 size_t *ciphertextLen,
void *param);
1908 const uint8_t *ciphertext,
size_t ciphertextLen, uint8_t *plaintext,
1909 size_t *plaintextLen,
void *param);
1974 #if (TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_2)
1981 #if (TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3)
1989 #if (TLS_SNI_SUPPORT == ENABLED)
2038 #if (TLS_MAX_FRAG_LEN_SUPPORT == ENABLED)
2041 #if (TLS_RECORD_SIZE_LIMIT_SUPPORT == ENABLED)
2044 #if (TLS_ALPN_SUPPORT == ENABLED)
2047 #if (TLS_RAW_PUBLIC_KEY_SUPPORT == ENABLED)
2053 #if (TLS_EXT_MASTER_SECRET_SUPPORT == ENABLED)
2056 #if (TLS_TICKET_SUPPORT == ENABLED)
2059 #if (TLS_SECURE_RENEGOTIATION_SUPPORT == ENABLED)
2062 #if (TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3)
2097 #if (TLS_GCM_CIPHER_SUPPORT == ENABLED)
2101 #if (DTLS_SUPPORT == ENABLED)
2105 #if (TLS_RECORD_SIZE_LIMIT_SUPPORT == ENABLED)
2142 #if (TLS_ECC_CALLBACK_SUPPORT == ENABLED)
2219 #if (TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_0)
2220 size_t txLastRecordLen;
2223 #if (TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_1)
2227 #if (TLS_MAX_VERSION >= TLS_VERSION_1_0 && TLS_MIN_VERSION <= TLS_VERSION_1_2)
2234 #if (TLS_MAX_VERSION >= TLS_VERSION_1_2 && TLS_MIN_VERSION <= TLS_VERSION_1_3)
2238 #if (TLS_MAX_VERSION >= TLS_VERSION_1_3 && TLS_MIN_VERSION <= TLS_VERSION_1_3)
2274 #if (TLS_DH_SUPPORT == ENABLED)
2278 #if (TLS_ECDH_SUPPORT == ENABLED)
2283 #if (TLS_RSA_SUPPORT == ENABLED)
2287 #if (TLS_DSA_SIGN_SUPPORT == ENABLED)
2291 #if (TLS_ECDSA_SIGN_SUPPORT == ENABLED || TLS_EDDSA_SIGN_SUPPORT == ENABLED)
2296 #if (TLS_PSK_SUPPORT == ENABLED)
2306 #if (TLS_MAX_FRAG_LEN_SUPPORT == ENABLED)
2311 #if (TLS_RECORD_SIZE_LIMIT_SUPPORT == ENABLED)
2316 #if (TLS_ALPN_SUPPORT == ENABLED)
2323 #if (TLS_EXT_MASTER_SECRET_SUPPORT == ENABLED)
2327 #if (TLS_RAW_PUBLIC_KEY_SUPPORT == ENABLED)
2335 #if (TLS_TICKET_SUPPORT == ENABLED)
2344 #if (TLS_SECURE_RENEGOTIATION_SUPPORT == ENABLED)
2349 #if (TLS_FALLBACK_SCSV_SUPPORT == ENABLED)
2353 #if (TLS_KEY_LOG_SUPPORT == ENABLED)
2357 #if (TLS_MAX_WARNING_ALERTS > 0)
2361 #if (TLS_MAX_EMPTY_RECORDS > 0)
2365 #if (TLS_MAX_CHANGE_CIPHER_SPEC_MESSAGES > 0)
2369 #if (TLS_MAX_KEY_UPDATE_MESSAGES > 0)
2373 #if (DTLS_SUPPORT == ENABLED)
2398 #if (DTLS_SUPPORT == ENABLED && DTLS_REPLAY_DETECTION_SUPPORT == ENABLED)
2419 uint16_t versionMax);
2436 size_t rxBufferSize);
2479 size_t certChainLen,
const char_t *privateKey,
size_t privateKeyLen);
2482 const char_t *certChain,
size_t certChainLen,
const char_t *privateKey,
2483 size_t privateKeyLen,
const char_t *password);
@ TLS_CERT_ECDSA_FIXED_ECDH
error_t tlsSetCertificateVerifyCallback(TlsContext *context, TlsCertVerifyCallback certVerifyCallback, void *param)
Register certificate verification callback function.
TlsRpkVerifyCallback rpkVerifyCallback
Raw public key verification callback function.
@ TLS_EXT_PSK_KEY_EXCHANGE_MODES
@ TLS_GROUP_BRAINPOOLP512R1_TLS13
size_t ticketLen
Length of the session ticket.
@ TLS_EXT_MAX_FRAGMENT_LENGTH
@ TLS_SIGN_ALGO_RSA_PSS_RSAE_SHA256
DTLS (Datagram Transport Layer Security)
uint8_t sessionId[32]
Session identifier.
@ TLS_CERT_FORMAT_RAW_PUBLIC_KEY
X.509 common definitions.
uint8_t masterSecret[TLS_MASTER_SECRET_SIZE]
Master secret.
size_t sessionIdLen
Length of the session identifier.
@ TLS_ALERT_UNEXPECTED_MESSAGE
EcPublicKey peerEcPublicKey
Peer's EC public key.
@ TLS_GROUP_BRAINPOOLP256R1_TLS13
bool_t ecPointFormatsExtReceived
The EcPointFormats extension has been received.
Generic hash algorithm context.
TlsHashAlgo ticketHashAlgo
Hash algorithm associated with the ticket.
uint8_t secret[TLS_MAX_HKDF_DIGEST_SIZE]
@ TLS_STATE_HELLO_RETRY_REQUEST
@ TLS_SIGN_ALGO_ECDSA_BRAINPOOLP512R1_TLS13_SHA512
uint_t numSupportedGroups
Number of named groups in the list.
uint8_t encKey[48]
Encryption key.
uint16_t cipherSuite
Cipher suite identifier.
@ TLS_TYPE_NEW_CONNECTION_ID
@ TLS_ALERT_CERTIFICATE_REQUIRED
error_t(* TlsTicketEncryptCallback)(TlsContext *context, const uint8_t *plaintext, size_t plaintextLen, uint8_t *ciphertext, size_t *ciphertextLen, void *param)
Ticket encryption callback function.
char_t * pskIdentity
PSK identity.
const Tls13PskKeModeList * pskKeModeList
PskKeyExchangeModes extension.
error_t tlsConnect(TlsContext *context)
Initiate the TLS handshake.
@ TLS_ALERT_NO_RENEGOTIATION
@ TLS_SIGN_ALGO_ANONYMOUS
systime_t ticketTimestamp
Timestamp to manage ticket lifetime.
void TlsServerHelloDone
ServerHelloDone message.
bool_t secureRenegoFlag
Secure renegotiation flag.
error_t(* TlsEcdsaVerifyCallback)(TlsContext *context, const uint8_t *digest, size_t digestLen, EcdsaSignature *signature)
ECDSA signature verification callback function.
error_t tlsSetEcdsaSignCallback(TlsContext *context, TlsEcdsaSignCallback ecdsaSignCallback)
Register ECDSA signature generation callback function.
DtlsSequenceNumber dtlsSeqNum
Record sequence number.
#define TLS_MAX_PASSWORD_LEN
@ TLS_CERT_FORMAT_OPENPGP
@ TLS_STATE_SERVER_KEY_EXCHANGE
const TlsExtension * sessionTicket
SessionTicket extension.
@ TLS_TYPE_SERVER_HELLO_DONE
size_t premasterSecretLen
Length of the premaster secret.
@ TLS_COMPRESSION_METHOD_NULL
@ TLS_SIGN_ALGO_GOSTR34102012_256
@ TLS_ALERT_ILLEGAL_PARAMETER
TlsKeyExchMethod keyExchMethod
Key exchange method.
TlsEcPointFormat
EC point formats.
uint8_t * ticket
Session ticket.
@ TLS_EARLY_DATA_REJECTED
uint32_t ticketLifetime
Lifetime of the ticket.
TlsCache * tlsInitCache(uint_t size)
Session cache initialization.
error_t tlsShutdownEx(TlsContext *context, bool_t waitForCloseNotify)
Gracefully close TLS session.
@ TLS_ALERT_UNSUPPORTED_EXTENSION
@ TLS_TYPE_CERTIFICATE_STATUS
const Tls13PskBinderList * binderList
uint8_t clientRandom[TLS_RANDOM_SIZE]
Client random value.
size_t rxBufferSize
RX buffer size.
bool_t closeNotifySent
A closure alert has been sent.
@ TLS_EXT_SUPPORTED_VERSIONS
ECDSA (Elliptic Curve Digital Signature Algorithm)
uint16_t versionMin
Minimum version accepted by the implementation.
bool_t maxFragLenExtReceived
The MaxFragmentLength extension has been received.
TlsState tlsGetState(TlsContext *context)
Retrieve current TLS state.
@ TLS_ALERT_RECORD_OVERFLOW
#define TLS_PRIVATE_CONTEXT
TlsTransportProtocol transportProtocol
Transport protocol (stream or datagram)
size_t txRecordPos
Current position in the TLS record.
@ TLS_EXT_EXTERNAL_ID_HASH
TlsConnectionEnd
TLS connection end.
const TlsExtension * selectedGroup
KeyShare extension (HelloRetryRequest)
systime_t timestamp
Time stamp to manage entry lifetime.
uint8_t * txBuffer
TX buffer.
TlsContext * tlsInit(void)
TLS context initialization.
error_t tlsSetStateChangeCallback(TlsContext *context, TlsStateChangeCallback stateChangeCallback)
Register TLS state change callback.
bool_t fatalAlertSent
A fatal alert message has been sent.
HashContext * transcriptHashContext
Hash context used to compute verify data.
uint8_t clientHsTrafficSecret[TLS_MAX_HKDF_DIGEST_SIZE]
@ TLS_GROUP_EXPLICIT_CHAR2_CURVE
error_t(* DtlsCookieGenerateCallback)(TlsContext *context, const DtlsClientParameters *clientParams, uint8_t *cookie, size_t *length, void *param)
DTLS cookie generation callback function.
TlsConnectionEnd entity
Client or server operation.
@ TLS_SIGN_ALGO_RSA_PSS_PSS_SHA384
TlsCertificateFormat peerCertFormat
Peer's certificate format.
@ TLS_STATE_CERTIFICATE_REQUEST
void * cookieParam
Opaque pointer passed to the cookie callbacks.
@ TLS_TYPE_CHANGE_CIPHER_SPEC
size_t maxFragLen
Maximum plaintext fragment length.
const TlsProtocolNameList * protocolNameList
ALPN extension.
const TlsExtension * earlyDataIndication
EarlyData extension.
error_t tlsRestoreSessionState(TlsContext *context, const TlsSessionState *session)
Restore TLS session.
error_t tlsSetAlpnCallback(TlsContext *context, TlsAlpnCallback alpnCallback)
Register ALPN callback function.
#define TLS_PRIVATE_ENCRYPTION_ENGINE
error_t(* TlsSocketReceiveCallback)(TlsSocketHandle handle, void *data, size_t size, size_t *received, uint_t flags)
Socket receive callback function.
TlsHashAlgo hashAlgo
Hash algorithm used to sign the end entity certificate.
TlsTicketDecryptCallback ticketDecryptCallback
Ticket decryption callback function.
TlsCertificateType type
End entity certificate type.
bool_t clientCertTypeExtReceived
The ClientCertType extension has been received.
@ TLS_TRANSPORT_PROTOCOL_DATAGRAM
TlsSignatureAlgo signAlgo
Signature algorithm to be used.
@ TLS_TYPE_COMPRESSED_CERTIFICATE
@ TLS_ALERT_ACCESS_DENIED
@ TLS_KEY_EXCH_SRP_SHA_RSA
@ TLS_ALERT_INSUFFICIENT_SECURITY
#define DTLS_REPLAY_WINDOW_SIZE
HmacContext * hmacContext
HMAC context.
TlsMessageType
Handshake message type.
@ TLS_GROUP_SECP256R1_KYBER512
TlsSocketHandle socketHandle
Socket handle.
Structure describing a cipher suite.
@ TLS_ALERT_BAD_CERTIFICATE_HASH_VALUE
@ TLS_STATE_APPLICATION_DATA
@ TLS_COMPRESSION_METHOD_DEFLATE
size_t txDatagramLen
Length of the outgoing datagram, in bytes.
size_t sessionIdLen
Length of the session identifier.
size_t authTagLen
Length of the authentication tag.
@ TLS_ALERT_DECOMPRESSION_FAILURE
const TlsCertTypeList * clientCertTypeList
ClientCertType extension.
bool_t secureRenegoEnabled
Secure renegotiation enabled.
error_t tlsSetVersion(TlsContext *context, uint16_t versionMin, uint16_t versionMax)
Set minimum and maximum versions permitted.
ECDH (Elliptic Curve Diffie-Hellman) key exchange.
TlsHashAlgo
Hash algorithms.
bool_t closeNotifyReceived
A closure alert has been received from the peer.
error_t tlsSetMaxFragmentLength(TlsContext *context, size_t maxFragLen)
Set maximum fragment length.
@ TLS_ALERT_CERTIFICATE_UNOBTAINABLE
const HashAlgo * hashAlgo
Hash algorithm for MAC operations.
@ TLS_ALERT_NO_CERTIFICATE
TlsEncryptionEngine prevEncryptionEngine
TlsAlpnCallback alpnCallback
ALPN callback function.
TlsStateChangeCallback stateChangeCallback
TLS state change callback function.
@ TLS_STATE_SERVER_APP_TRAFFIC_KEYS
@ TLS_KEY_EXCH_SRP_SHA_DSS
void * prngContext
Pseudo-random number generator context.
TlsAlertDescription
Alert description.
error_t tlsSetAlpnProtocolList(TlsContext *context, const char_t *protocolList)
Set the list of supported ALPN protocols.
OsMutex mutex
Mutex preventing simultaneous access to the cache.
uint8_t clientVerifyData[64]
Client verify data.
@ TLS_SIGN_ALGO_RSA_PSS_PSS_SHA512
DhContext dhContext
Diffie-Hellman context.
@ TLS_ALERT_DECRYPT_ERROR
char_t * ticketAlpn
ALPN protocol associated with the ticket.
TlsContentType txBufferType
Type of data that resides in the TX buffer.
TlsTicketEncryptCallback ticketEncryptCallback
Ticket encryption callback function.
const TlsSignHashAlgos * signAlgoList
SignatureAlgorithms extension.
size_t rxDatagramLen
Length of the incoming datagram, in bytes.
const TlsSupportedVersionList * supportedVersionList
SupportedVersions extension (ClientHello)
systime_t retransmitTimeout
Retransmission timeout.
size_t pskLen
Length of the pre-shared key, in bytes.
uint16_t rxMsgSeq
Next receive sequence number.
uint8_t certificateTypes[]
uint8_t * psk
Pre-shared key.
uint_t emptyRecordCount
Count of consecutive empty records.
size_t earlyDataLen
Total amount of 0-RTT data that have been sent by the client.
@ TLS_GROUP_BRAINPOOLP256R1
@ TLS_EXT_COMPRESS_CERTIFICATE
size_t fixedIvLen
Length of the fixed part of the IV.
@ TLS_TYPE_END_OF_EARLY_DATA
error_t(* TlsSocketSendCallback)(TlsSocketHandle handle, const void *data, size_t length, size_t *written, uint_t flags)
Socket send callback function.
error_t tlsAllowUnknownAlpnProtocols(TlsContext *context, bool_t allowed)
Allow unknown ALPN protocols.
@ TLS_MAX_FRAGMENT_LENGTH_4096
error_t tlsSetTimeout(TlsContext *context, systime_t timeout)
Set timeout for blocking calls (for DTLS only)
uint16_t preferredGroup
Preferred ECDHE or FFDHE named group.
size_t maxEarlyDataSize
Maximum amount of 0-RTT data that the client is allowed to send.
const Tls13Cookie * cookie
Cookie extension.
@ TLS_EXT_QUIC_TRANSPORT_PARAMETERS
TlsKeyExchMethod keyExchMethod
error_t tlsSetCache(TlsContext *context, TlsCache *cache)
Set session cache.
uint8_t serverVerifyData[64]
Server verify data.
bool_t extendedMasterSecret
Extended master secret computation.
@ TLS_ALERT_EXPORT_RESTRICTION
error_t tlsSetPsk(TlsContext *context, const uint8_t *psk, size_t length)
Set the pre-shared key to be used.
uint8_t * rxBuffer
RX buffer.
TLS 1.3 helper functions.
const Tls13KeyShareEntry * serverShare
KeyShare extension (ServerHello)
@ TLS_EXT_SIGNATURE_ALGORITHMS_CERT
const Tls13KeyShareList * keyShareList
KeyShare extension (ClientHello)
uint8_t resumptionMasterSecret[TLS_MAX_HKDF_DIGEST_SIZE]
CipherMode cipherMode
Cipher mode of operation.
error_t(* TlsAlpnCallback)(TlsContext *context, const char_t *selectedProtocol)
ALPN callback function.
@ TLS_EXT_SUPPORTED_EKT_CIPHERS
@ TLS_CERT_RSA_EPHEMERAL_DH
void TlsFinished
Finished message.
@ TLS_STATE_HELLO_VERIFY_REQUEST
@ TLS_EXT_TRUSTED_CA_KEYS
error_t(* TlsRpkVerifyCallback)(TlsContext *context, const uint8_t *rawPublicKey, size_t rawPublicKeyLen)
Raw public key verification callback function.
uint32_t ticketNonce
A per-ticket value that is unique across all tickets issued.
const TlsCertTypeList * serverCertTypeList
ServerCertType extension.
size_t recordSizeLimit
Maximum record size the peer is willing to receive.
@ TLS_ALERT_LEVEL_WARNING
size_t txBufferSize
TX buffer size.
uint16_t cipherSuite
Cipher suite identifier.
@ TLS_ALERT_UNKNOWN_PSK_IDENTITY
const TlsExtension * maxFragLen
MaxFragmentLength extension.
@ TLS_KEY_EXCH_ECDHE_ECDSA
error_t tlsSetSocketCallbacks(TlsContext *context, TlsSocketSendCallback socketSendCallback, TlsSocketReceiveCallback socketReceiveCallback, TlsSocketHandle handle)
Set socket send and receive callbacks.
TlsKeyLogCallback keyLogCallback
Key logging callback (for debugging purpose only)
@ TLS_CERT_FORMAT_1609DOT2
const TlsEcPointFormatList * ecPointFormatList
EcPointFormats extension.
uint16_t version
Negotiated TLS version.
size_t certChainLen
Length of the certificate chain.
uint8_t premasterSecret[TLS_PREMASTER_SECRET_SIZE]
Premaster secret.
Diffie-Hellman key exchange.
size_t rxRecordLen
Length of the TLS record.
HmacContext hmacContext
HMAC context.
uint8_t serverHsTrafficSecret[TLS_MAX_HKDF_DIGEST_SIZE]
const char_t * trustedCaList
Trusted CA list (PEM format)
uint32_t ticketAgeAdd
Random value used to obscure the age of the ticket.
uint8_t * ticket
Session ticket.
size_t clientVerifyDataLen
Length of the client verify data.
TlsCertificateFormat
Certificate formats.
@ TLS_EXT_CLIENT_CERT_TYPE
@ TLS_ALERT_BAD_RECORD_MAC
error_t tlsShutdown(TlsContext *context)
Gracefully close TLS session.
size_t txRecordLen
Length of the TLS record.
@ TLS_EXT_EXTENDED_MASTER_SECRET
@ TLS_GROUP_SECP384R1_KYBER768
@ TLS_CONNECTION_END_SERVER
size_t cookieLen
Length of the cookie.
void tlsFreeSessionState(TlsSessionState *session)
Properly dispose a session state.
void(* TlsStateChangeCallback)(TlsContext *context, TlsState state)
TLS state change callback.
TlsClientAuthMode
Client authentication mode.
TlsKeyExchMethod
Key exchange methods.
@ TLS_EXT_SUPPORTED_GROUPS
bool_t fallbackScsvEnabled
Support for FALLBACK_SCSV.
error_t tlsSetSupportedGroups(TlsContext *context, const uint16_t *groups, uint_t length)
Specify the list of allowed ECDHE and FFDHE groups.
error_t tlsAddCertificate(TlsContext *context, const char_t *certChain, size_t certChainLen, const char_t *privateKey, size_t privateKeyLen)
Add a certificate and the corresponding private key (deprecated)
#define TLS_PREMASTER_SECRET_SIZE
void TlsCertificateVerify
CertificateVerify message.
uint8_t keyBlock[192]
Key material.
error_t(* TlsEcdhCallback)(TlsContext *context)
ECDH key agreement callback function.
const CipherAlgo * cipherAlgo
size_t rxBufferPos
Current position in RX buffer.
@ TLS_EXT_RENEGOTIATION_INFO
@ TLS_GROUP_EXPLICIT_PRIME_CURVE
error_t tlsSetClientAuthMode(TlsContext *context, TlsClientAuthMode mode)
Set client authentication mode (for servers only)
TlsCertificateFormat certFormat
Certificate format.
@ TLS_HASH_ALGO_INTRINSIC
TlsEncryptionEngine decryptionEngine
Decryption engine.
@ TLS_KEY_EXCH_ECDH_ECDSA
const char_t * tlsGetAlpnProtocol(TlsContext *context)
Get the name of the selected ALPN protocol.
@ TLS_EXT_ENCRYPT_THEN_MAC
@ TLS_TYPE_APPLICATION_DATA
@ TLS_STATE_SERVER_FINISHED
error_t tlsEnableReplayDetection(TlsContext *context, bool_t enabled)
Enable anti-replay mechanism (for DTLS only)
error_t tlsSetBufferSize(TlsContext *context, size_t txBufferSize, size_t rxBufferSize)
Set TLS buffer size.
@ TLS_EC_CURVE_TYPE_EXPLICIT_PRIME
@ TLS_ALERT_UNSUPPORTED_CERTIFICATE
size_t serverVerifyDataLen
Length of the server verify data.
error_t tlsSetServerName(TlsContext *context, const char_t *serverName)
Set the server name.
@ TLS_TYPE_REQUEST_CONNECTION_ID
uint16_t epoch
Counter value incremented on every cipher state change.
bool_t fatalAlertReceived
A fatal alert message has been received from the peer.
error_t tlsSetCookieCallbacks(TlsContext *context, DtlsCookieGenerateCallback cookieGenerateCallback, DtlsCookieVerifyCallback cookieVerifyCallback, void *param)
Set cookie generation/verification callbacks (for DTLS only)
size_t txBufferPos
Current position in TX buffer.
TlsClientAuthMode clientAuthMode
Client authentication mode.
uint32_t ticketLifetime
Lifetime of the ticket.
uint8_t ticketPsk[TLS_MAX_HKDF_DIGEST_SIZE]
PSK associated with the ticket.
error_t tlsSetPrng(TlsContext *context, const PrngAlgo *prngAlgo, void *prngContext)
Set the pseudo-random number generator to be used.
const char_t * tlsGetServerName(TlsContext *context)
Get the server name.
@ TLS_TYPE_ENCRYPTED_EXTENSIONS
TlsSequenceNumber earlyDataSeqNum
Early data sequence number.
@ TLS_MAX_FRAGMENT_LENGTH_2048
error_t tlsSetPmtu(TlsContext *context, size_t pmtu)
Set PMTU value (for DTLS only)
@ TLS_CERT_DSS_EPHEMERAL_DH
size_t ticketLen
Length of the session ticket.
General definitions for cryptographic algorithms.
uint8_t exporterMasterSecret[TLS_MAX_HKDF_DIGEST_SIZE]
RSA public-key cryptography standard.
size_t rxBufferMaxLen
Maximum number of plaintext data the RX buffer can hold.
uint16_t clientVersion
Latest version supported by the client.
@ TLS_ALERT_UNRECOGNIZED_NAME
error_t tlsSaveSessionState(const TlsContext *context, TlsSessionState *session)
Save TLS session.
@ TLS_STATE_CLIENT_CERTIFICATE_VERIFY
@ TLS_TYPE_CERTIFICATE_VERIFY
@ TLS_STATE_SERVER_CHANGE_CIPHER_SPEC
EcdhContext ecdhContext
ECDH context.
const TlsRenegoInfo * renegoInfo
RenegotiationInfo extension.
@ TLS_EXT_CLIENT_CERTIFICATE_URL
@ TLS_ALERT_MISSING_EXTENSION
@ TLS_GROUP_X25519_KYBER512
#define TLS_MAX_CERTIFICATES
EcDomainParameters peerEcParams
Peer's EC domain parameters.
DsaPublicKey peerDsaPublicKey
Peer's DSA public key.
size_t recordSizeLimit
Maximum size of record in octets.
typedef __packed_struct
Sequence number.
DSA (Digital Signature Algorithm)
uint_t numCipherSuites
Number of cipher suites in the list.
@ TLS_STATE_SERVER_HELLO_3
TlsExtensionType
TLS extension types.
@ TLS_ALERT_USER_CANCELED
systime_t ticketTimestamp
Timestamp to manage ticket lifetime.
@ TLS_EXT_CERTIFICATE_AUTHORITIES
@ TLS_STATE_END_OF_EARLY_DATA
error_t tlsSetEcdhCallback(TlsContext *context, TlsEcdhCallback ecdhCallback)
Register ECDH key agreement callback function.
bool_t pskKeModeSupported
PSK key establishment supported by the client.
@ TLS_EC_CURVE_TYPE_EXPLICIT_CHAR2
@ TLS_EC_POINT_FORMAT_UNCOMPRESSED
error_t tlsSetTicketCallbacks(TlsContext *context, TlsTicketEncryptCallback ticketEncryptCallback, TlsTicketDecryptCallback ticketDecryptCallback, void *param)
Set ticket encryption/decryption callbacks.
uint_t numCerts
Number of certificates available.
@ TLS_GROUP_BRAINPOOLP512R1
TlsSocketReceiveCallback socketReceiveCallback
Socket receive callback function.
error_t tlsWrite(TlsContext *context, const void *data, size_t length, size_t *written, uint_t flags)
Send application data to the remote host using TLS.
@ TLS_STATE_CLIENT_APP_TRAFFIC_KEYS
bool_t sessionTicketEnabled
Session ticket mechanism enabled.
const TlsExtension * extendedMasterSecret
ExtendedMasterSecret extension.
@ TLS_TYPE_HELLO_VERIFY_REQUEST
@ TLS_TYPE_CLIENT_KEY_EXCHANGE
uint_t keyUpdateCount
Count of consecutive KeyUpdate messages.
@ TLS_STATE_NEW_SESSION_TICKET
bool_t resume
The connection is established by resuming a session.
uint32_t ticketAgeAdd
Random value used to obscure the age of the ticket.
CipherMode
Cipher operation modes.
systime_t ticketTimestamp
Timestamp to manage ticket lifetime.
@ TLS_EXT_TRANSPARENCY_INFO
@ TLS_EXT_STATUS_REQUEST_V2
size_t txBufferMaxLen
Maximum number of plaintext data the TX buffer can hold.
TlsMaxFragmentLength
Maximum fragment length.
@ TLS_STATE_CLIENT_CHANGE_CIPHER_SPEC
error_t(* TlsCertVerifyCallback)(TlsContext *context, const X509CertInfo *certInfo, uint_t pathLen, void *param)
Certificate verification callback function.
@ TLS_ALERT_TOO_MANY_CIDS_REQUESTED
@ TLS_EXT_EC_POINT_FORMATS
TlsCompressMethod
Compression methods.
void * ticketParam
Opaque pointer passed to the ticket callbacks.
@ TLS_EXT_TLS_CERT_WITH_EXTERN_PSK
@ TLS_SIGN_ALGO_GOSTR34102012_512
@ TLS_ALERT_PROTOCOL_VERSION
@ TLS_ALERT_DECRYPTION_FAILED
TlsCertificateType
Certificate types.
TlsCertDesc * cert
Pointer to the currently selected certificate.
size_t encKeyLen
Length of the encryption key.
TlsEncryptionEngine encryptionEngine
Encryption engine.
#define TLS_MASTER_SECRET_SIZE
size_t privateKeyLen
Length of the private key.
@ TLS_GROUP_BRAINPOOLP384R1_TLS13
uint8_t secret[TLS_MASTER_SECRET_SIZE]
Master secret.
uint_t size
Maximum number of entries.
TlsHashAlgo pskHashAlgo
Hash algorithm associated with the PSK.
const TlsSignHashAlgos * certSignAlgoList
SignatureAlgorithmsCert extension.
@ TLS_STATE_HANDSHAKE_TRAFFIC_KEYS
Sha1Context * transcriptSha1Context
SHA-1 context used to compute verify data.
char_t * serverName
ServerName extension.
error_t tlsSetConnectionEnd(TlsContext *context, TlsConnectionEnd entity)
Set operation mode (client or server)
uint32_t systime_t
System time.
@ TLS_CLIENT_AUTH_OPTIONAL
error_t tlsSetMaxEarlyDataSize(TlsContext *context, size_t maxEarlyDataSize)
Send the maximum amount of 0-RTT data the server can accept.
size_t ticketPskLen
Length of the PSK associated with the ticket.
@ TLS_TYPE_SERVER_KEY_EXCHANGE
DtlsCookieGenerateCallback cookieGenerateCallback
Cookie generation callback function.
TlsPskCallback pskCallback
PSK callback function.
@ TLS_EC_CURVE_TYPE_NAMED_CURVE
uint32_t maxEarlyDataSize
Maximum amount of 0-RTT data that the client is allowed to send.
const TlsExtension * selectedIdentity
PreSharedKey extension (ServerHello)
uint16_t namedGroup
ECDHE or FFDHE named group.
error_t(* TlsEcdsaSignCallback)(TlsContext *context, const uint8_t *digest, size_t digestLen, EcdsaSignature *signature)
ECDSA signature generation callback function.
TlsSignatureAlgo signAlgo
Signature algorithm used to sign the end entity certificate.
const uint16_t * cipherSuites
List of supported cipher suites.
uint16_t ticketCipherSuite
Cipher suite associated with the ticket.
uint16_t txMsgSeq
Send sequence number.
uint8_t iv[16]
Initialization vector.
const TlsExtension * clientCertType
@ TLS13_KEY_EXCH_PSK_ECDHE
@ TLS_STATE_CLIENT_HELLO_2
@ TLS_ALERT_BAD_CERTIFICATE
bool_t replayDetectionEnabled
Anti-replay mechanism enabled.
const HashAlgo * hashAlgo
TlsContentType
Content type.
@ TLS_STATE_SERVER_CERTIFICATE_VERIFY
size_t rxBufferLen
Number of bytes available for reading.
@ TLS_EXT_EXTERNAL_SESSION_ID
@ TLS_ALERT_INAPPROPRIATE_FALLBACK
@ TLS_EARLY_DATA_ACCEPTED
error_t tlsSetRpkVerifyCallback(TlsContext *context, TlsRpkVerifyCallback rpkVerifyCallback)
Register the raw public key verification callback function.
uint8_t macKey[48]
MAC key.
void TlsClientKeyExchange
ClientKeyExchange message.
@ TLS_STATE_SERVER_CERTIFICATE
TlsEcCurveType
EC curve types.
@ TLS_CLIENT_AUTH_REQUIRED
error_t tlsInitSessionState(TlsSessionState *session)
Initialize session state.
size_t rxFragQueueLen
Length of the reassembly queue.
uint16_t versionMax
Maximum version accepted by the implementation.
uint32_t replayWindow[(DTLS_REPLAY_WINDOW_SIZE+31)/32]
@ TLS_STATE_CLIENT_KEY_EXCHANGE
const CipherAlgo * cipherAlgo
Cipher algorithm.
error_t tlsSetCipherSuites(TlsContext *context, const uint16_t *cipherSuites, uint_t length)
Specify the list of allowed cipher suites.
TlsTransportProtocol
TLS transport protocols.
error_t(* DtlsCookieVerifyCallback)(TlsContext *context, const DtlsClientParameters *clientParams, const uint8_t *cookie, size_t length, void *param)
DTLS cookie verification callback function.
void TlsHelloRequest
HelloRequest message.
@ TLS_SIGN_ALGO_RSA_PSS_RSAE_SHA512
bool_t serverCertTypeExtReceived
The ServerCertType extension has been received.
@ TLS_STATE_CLIENT_CERTIFICATE
TlsCertVerifyCallback certVerifyCallback
Certificate verification callback function.
void * certVerifyParam
Opaque pointer passed to the certificate verification callback.
@ TLS_SIGN_ALGO_RSA_PSS_PSS_SHA256
error_t tlsWriteEarlyData(TlsContext *context, const void *data, size_t length, size_t *written, uint_t flags)
Send early data to the remote TLS server.
@ TLS_STATE_CLIENT_CHANGE_CIPHER_SPEC_2
TlsHashAlgo ticketHashAlgo
Hash algorithm associated with the ticket.
uint_t alertCount
Count of consecutive warning alerts.
error_t tlsSetDhParameters(TlsContext *context, const char_t *params, size_t length)
Import Diffie-Hellman parameters.
@ TLS_ALERT_CERTIFICATE_EXPIRED
@ TLS_STATE_ENCRYPTED_EXTENSIONS
@ TLS_EXT_SERVER_CERT_TYPE
uint8_t * certRequestContext
Certificate request context.
TlsSocketSendCallback socketSendCallback
Socket send callback function.
@ TLS_ALERT_NO_APPLICATION_PROTOCOL
const PrngAlgo * prngAlgo
Pseudo-random number generator to be used.
@ TLS_CERT_RSA_FIXED_ECDH
#define TLS_MAX_HKDF_DIGEST_SIZE
systime_t clientHelloTimestamp
Time at which the ClientHello message was sent.
TlsSignatureAlgo
Signature algorithms.
uint8_t serverRandom[TLS_RANDOM_SIZE]
Server random value.
size_t certRequestContextLen
Length of the certificate request context.
error_t tlsSetEcdsaVerifyCallback(TlsContext *context, TlsEcdsaVerifyCallback ecdsaVerifyCallback)
Register ECDSA signature verification callback function.
@ TLS_CONNECTION_END_CLIENT
char_t * pskIdentityHint
PSK identity hint.
TlsCipherSuiteInfo cipherSuite
Negotiated cipher suite.
bool_t tlsIsRxReady(TlsContext *context)
Check whether some data is available in the receive buffer.
uint8_t clientAppTrafficSecret[TLS_MAX_HKDF_DIGEST_SIZE]
@ TLS_MAX_FRAGMENT_LENGTH_1024
TlsAlertLevel
Alert level.
uint_t changeCipherSpecCount
Count of consecutive ChangeCipherSpec messages.
Common interface for encryption algorithms.
@ TLS_TYPE_CERTIFICATE_REQUEST
@ TLS_EC_POINT_FORMAT_ANSI_X962_COMPRESSED_PRIME
void tlsFree(TlsContext *context)
Release TLS context.
error_t tlsRead(TlsContext *context, void *data, size_t size, size_t *received, uint_t flags)
Receive application data from a the remote host using TLS.
TlsCache * cache
TLS session cache.
TlsState state
TLS handshake finite state machine.
TlsContentType rxBufferType
Type of data that resides in the RX buffer.
char_t * serverName
Fully qualified DNS hostname of the server.
size_t rxRecordPos
Current position in the TLS record.
error_t tlsSetPskIdentity(TlsContext *context, const char_t *pskIdentity)
Set the PSK identity to be used by the client.
uint16_t version
TLS protocol version.
@ TLS_TYPE_SUPPLEMENTAL_DATA
bool_t sessionTicketExtSent
The SessionTicket extension has been sent.
@ TLS_GROUP_SECP521R1_KYBER1024
@ TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE
const TlsExtension * recordSizeLimit
RecordSizeLimit extension.
bool_t clientCertRequested
This flag tells whether the client certificate is requested.
@ TLS_TRANSPORT_PROTOCOL_STREAM
uint16_t version
Negotiated TLS version.
uint_t newSessionTicketCount
Number of NewSessionTicket messages that have been sent.
error_t tlsSetTransportProtocol(TlsContext *context, TlsTransportProtocol transportProtocol)
Set the transport protocol to be used.
TlsEcdhCallback ecdhCallback
bool_t earlyDataEnabled
EarlyData is enabled.
const char_t * certChain
End entity certificate chain (PEM format)
bool_t recordSizeLimitExtReceived
The RecordSizeLimit extension has been received.
RsaPublicKey peerRsaPublicKey
Peer's RSA public key.
bool_t unknownProtocolsAllowed
Unknown ALPN protocols allowed.
@ TLS_EXT_SIGNATURE_ALGORITHMS
uint32_t ticketLifetime
Lifetime of the ticket.
Common interface for hash algorithms.
char_t * selectedProtocol
Selected ALPN protocol.
error_t(* TlsPskCallback)(TlsContext *context, const uint8_t *pskIdentity, size_t pskIdentityLen)
Pre-shared key callback function.
const TlsServerNameList * serverNameList
ServerName extension.
TlsEarlyDataStatus tlsGetEarlyDataStatus(TlsContext *context)
Check whether the server has accepted or rejected the early data.
size_t trustedCaListLen
Total length of the trusted CA list.
systime_t retransmitTimestamp
Time at which the datagram was sent.
const TlsExtension * selectedVersion
SupportedVersions extension (ServerHello)
@ TLS_EXT_POST_HANDSHAKE_AUTH
TlsSequenceNumber seqNum
TLS sequence number.
error_t tlsLoadCertificate(TlsContext *context, uint_t index, const char_t *certChain, size_t certChainLen, const char_t *privateKey, size_t privateKeyLen, const char_t *password)
Load entity's certificate.
uint8_t clientEarlyTrafficSecret[TLS_MAX_HKDF_DIGEST_SIZE]
@ TLS_STATE_SERVER_CHANGE_CIPHER_SPEC_2
void * cipherContext
Cipher context.
@ TLS_TYPE_NEW_SESSION_TICKET
TlsEcdsaSignCallback ecdsaSignCallback
TlsNamedGroup
Named groups.
bool_t earlyDataRejected
The 0-RTT data have been rejected by the server.
const char_t * privateKey
Private key (PEM format)
error_t tlsSetPskIdentityHint(TlsContext *context, const char_t *pskIdentityHint)
Set the PSK identity hint to be used by the server.
void(* TlsKeyLogCallback)(TlsContext *context, const char_t *key)
Key logging callback function (for debugging purpose only)
size_t macKeyLen
Length of the MAC key.
@ TLS_TYPE_HELLO_RETRY_REQUEST
bool_t updatedClientHelloReceived
An updated ClientHello message has been received.
bool_t tlsIsTxReady(TlsContext *context)
Check whether some data is ready for transmission.
GcmContext * gcmContext
GCM context.
error_t tlsSetPreferredGroup(TlsContext *context, uint16_t group)
Specify the preferred ECDHE or FFDHE group.
TlsFlags
Flags used by read and write functions.
TlsHashAlgo signHashAlgo
Hash algorithm used for signing.
@ TLS_ALERT_CERTIFICATE_REVOKED
error_t tlsEnableSecureRenegotiation(TlsContext *context, bool_t enabled)
Enable secure renegotiation.
size_t txBufferLen
Number of bytes that are pending to be sent.
uint_t retransmitCount
Retransmission counter.
uint16_t rxRecordVersion
Version of the incoming record.
@ TLS_STATE_SERVER_HELLO_DONE
size_t recordIvLen
Length of the IV.
@ TLS_STATE_SERVER_HELLO_2
@ TLS_ALERT_HANDSHAKE_FAILURE
@ TLS_STATE_CLIENT_FINISHED
int_t selectedIdentity
Selected PSK identity.
@ TLS_SIGN_ALGO_ECDSA_BRAINPOOLP384R1_TLS13_SHA384
DtlsCookieVerifyCallback cookieVerifyCallback
Cookie verification callback function.
@ TLS_ALERT_INTERNAL_ERROR
const uint16_t * supportedGroups
List of supported named groups.
error_t tlsEnableFallbackScsv(TlsContext *context, bool_t enabled)
Perform fallback retry (for clients only)
@ TLS_SIGN_ALGO_ECDSA_BRAINPOOLP256R1_TLS13_SHA256
TlsCertDesc certs[TLS_MAX_CERTIFICATES]
End entity certificates (PEM format)
error_t(* TlsTicketDecryptCallback)(TlsContext *context, const uint8_t *ciphertext, size_t ciphertextLen, uint8_t *plaintext, size_t *plaintextLen, void *param)
Ticket decryption callback function.
error_t tlsEnableSessionTickets(TlsContext *context, bool_t enabled)
Enable session ticket mechanism.
#define TlsEncryptionEngine
uint16_t pskCipherSuite
Cipher suite associated with the PSK.
bool_t extendedMasterSecret
Extended master secret computation.
error_t tlsSetTrustedCaList(TlsContext *context, const char_t *trustedCaList, size_t length)
Import a trusted CA list.
void TlsServerKeyExchange
ServerKeyExchange message.
@ TLS_SIGN_ALGO_RSA_PSS_RSAE_SHA384
bool_t earlyDataExtReceived
The EarlyData extension has been received.
const HashAlgo * prfHashAlgo
uint8_t serverAppTrafficSecret[TLS_MAX_HKDF_DIGEST_SIZE]
const TlsSupportedGroupList * supportedGroupList
SupportedGroups extension.
TlsNamedGroup namedCurve
Named curve used to generate the EC public key.
systime_t timeout
Timeout for blocking calls.
TlsEcdsaVerifyCallback ecdsaVerifyCallback
const TlsExtension * serverCertType
TlsCertificateType peerCertType
Peer's certificate type.
@ TLS_EXT_RECORD_SIZE_LIMIT
HMAC (Keyed-Hashing for Message Authentication)
error_t tlsSetPskCallback(TlsContext *context, TlsPskCallback pskCallback)
Register PSK callback function.
bool_t sessionTicketExtReceived
The SessionTicket extension has been received.
void * TlsSocketHandle
Socket handle.
TlsEarlyDataStatus
Early data status.
@ TLS_GROUP_BRAINPOOLP384R1
@ TLS_EXT_SIGNED_CERT_TIMESTAMP
char_t * ticketAlpn
ALPN protocol associated with the ticket.
@ TLS_MAX_FRAGMENT_LENGTH_512
error_t tlsSetKeyLogCallback(TlsContext *context, TlsKeyLogCallback keyLogCallback)
Register key logging callback function (for debugging purpose only)
@ TLS_ALERT_CERTIFICATE_UNKNOWN
bool_t emsExtReceived
The ExtendedMasterSecret extension has been received.
void TlsCertificate
Certificate message.
@ TLS_EC_POINT_FORMAT_ANSI_X962_COMPRESSED_CHAR2
const TlsCertAuthorities * certAuthorities
CertificateAuthorities extension.
const Tls13PskIdentityList * identityList
PreSharedKey extension (ClientHello)
char_t * protocolList
List of supported ALPN protocols.
@ TLS_TYPE_CERTIFICATE_URL
void tlsFreeCache(TlsCache *cache)
Properly dispose a session cache.