2
* This file contains prototypes for the public SSL functions.
4
* ***** BEGIN LICENSE BLOCK *****
5
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
7
* The contents of this file are subject to the Mozilla Public License Version
8
* 1.1 (the "License"); you may not use this file except in compliance with
9
* the License. You may obtain a copy of the License at
10
* http://www.mozilla.org/MPL/
12
* Software distributed under the License is distributed on an "AS IS" basis,
13
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
14
* for the specific language governing rights and limitations under the
17
* The Original Code is the Netscape security libraries.
19
* The Initial Developer of the Original Code is
20
* Netscape Communications Corporation.
21
* Portions created by the Initial Developer are Copyright (C) 1994-2000
22
* the Initial Developer. All Rights Reserved.
26
* Alternatively, the contents of this file may be used under the terms of
27
* either the GNU General Public License Version 2 or later (the "GPL"), or
28
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
29
* in which case the provisions of the GPL or the LGPL are applicable instead
30
* of those above. If you wish to allow use of your version of this file only
31
* under the terms of either the GPL or the LGPL, and not to allow others to
32
* use your version of this file under the terms of the MPL, indicate your
33
* decision by deleting the provisions above and replace them with the notice
34
* and other provisions required by the GPL or the LGPL. If you do not delete
35
* the provisions above, a recipient may use your version of this file under
36
* the terms of any one of the MPL, the GPL or the LGPL.
38
* ***** END LICENSE BLOCK ***** */
39
/* $Id: ssl.h,v 1.24 2005/09/16 20:33:09 julien.pierre.bugs%sun.com Exp $ */
51
#include "sslt.h" /* public ssl data types */
53
#if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS)
54
#define SSL_IMPORT extern __declspec(dllimport)
56
#define SSL_IMPORT extern
61
/* constant table enumerating all implemented SSL 2 and 3 cipher suites. */
62
SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[];
64
/* number of entries in the above table. */
65
SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers;
67
/* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */
68
#define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00)
71
** Imports fd into SSL, returning a new socket. Copies SSL configuration
74
SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd);
77
** Enable/disable an ssl mode
80
** enable/disable use of SSL security protocol before connect
83
** enable/disable use of socks before connect
84
** (No longer supported).
86
** SSL_REQUEST_CERTIFICATE:
87
** require a certificate during secure connect
90
#define SSL_SECURITY 1 /* (on by default) */
91
#define SSL_SOCKS 2 /* (off by default) */
92
#define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */
93
#define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */
94
/* (off by default) */
95
#define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */
96
/* (off by default) */
97
#define SSL_ENABLE_SSL2 7 /* enable ssl v2 (on by default) */
98
#define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */
99
#define SSL_NO_CACHE 9 /* don't use the session cache */
100
/* (off by default) */
101
#define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */
103
#define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */
104
/* (off by default) */
105
#define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */
106
/* (on by default) */
107
#define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */
108
#define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */
109
#define SSL_NO_STEP_DOWN 15 /* Disable export cipher suites */
110
/* if step-down keys are needed. */
111
/* default: off, generate */
112
/* step-down keys if needed. */
113
#define SSL_BYPASS_PKCS11 16 /* use PKCS#11 for pub key only */
114
#define SSL_NO_LOCKS 17 /* Don't use locks for protection */
116
#ifdef SSL_DEPRECATED_FUNCTION
117
/* Old deprecated function names */
118
SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on);
119
SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on);
122
/* New function names */
123
SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on);
124
SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on);
125
SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on);
126
SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on);
127
SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle);
130
** Control ciphers that SSL uses. If on is non-zero then the named cipher
131
** is enabled, otherwise it is disabled.
132
** The "cipher" values are defined in sslproto.h (the SSL_EN_* values).
133
** EnableCipher records user preferences.
134
** SetPolicy sets the policy according to the policy module.
136
#ifdef SSL_DEPRECATED_FUNCTION
137
/* Old deprecated function names */
138
SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled);
139
SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy);
142
/* New function names */
143
SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled);
144
SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled);
145
SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled);
146
SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled);
147
SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy);
148
SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy);
150
/* Values for "policy" argument to SSL_PolicySet */
151
/* Values returned by SSL_CipherPolicyGet. */
152
#define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */
153
#define SSL_ALLOWED 1
154
#define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */
156
/* Values for "on" with SSL_REQUIRE_CERTIFICATE. */
157
#define SSL_REQUIRE_NEVER ((PRBool)0)
158
#define SSL_REQUIRE_ALWAYS ((PRBool)1)
159
#define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2)
160
#define SSL_REQUIRE_NO_ERROR ((PRBool)3)
163
** Reset the handshake state for fd. This will make the complete SSL
164
** handshake protocol execute from the ground up on the next i/o
167
SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer);
170
** Force the handshake for fd to complete immediately. This blocks until
171
** the complete SSL handshake protocol is finished.
173
SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd);
176
** Same as above, but with an I/O timeout.
178
SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd,
179
PRIntervalTime timeout);
182
** Query security status of socket. *on is set to one if security is
183
** enabled. *keySize will contain the stream key size used. *issuer will
184
** contain the RFC1485 verison of the name of the issuer of the
185
** certificate at the other end of the connection. For a client, this is
186
** the issuer of the server's certificate; for a server, this is the
187
** issuer of the client's certificate (if any). Subject is the subject of
188
** the other end's certificate. The pointers can be zero if the desired
189
** data is not needed. All strings returned by this function are owned
190
** by SSL, and will be freed when the socket is closed.
192
SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher,
193
int *keySize, int *secretKeySize,
194
char **issuer, char **subject);
196
/* Values for "on" */
197
#define SSL_SECURITY_STATUS_NOOPT -1
198
#define SSL_SECURITY_STATUS_OFF 0
199
#define SSL_SECURITY_STATUS_ON_HIGH 1
200
#define SSL_SECURITY_STATUS_ON_LOW 2
201
#define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */
204
** Return the certificate for our SSL peer. If the client calls this
205
** it will always return the server's certificate. If the server calls
206
** this, it may return NULL if client authentication is not enabled or
207
** if the client had no certificate when asked.
208
** "fd" the socket "file" descriptor
210
SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd);
213
** Authenticate certificate hook. Called when a certificate comes in
214
** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the
217
typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd,
221
SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd,
222
SSLAuthCertificate f,
225
/* An implementation of the certificate authentication hook */
226
SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd,
227
PRBool checkSig, PRBool isServer);
230
* Prototype for SSL callback to get client auth data from the application.
231
* arg - application passed argument
232
* caNames - pointer to distinguished names of CAs that the server likes
233
* pRetCert - pointer to pointer to cert, for return of cert
234
* pRetKey - pointer to key pointer, for return of key
236
typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg,
238
CERTDistNames *caNames,
239
CERTCertificate **pRetCert,/*return */
240
SECKEYPrivateKey **pRetKey);/* return */
243
* Set the client side callback for SSL to retrieve user's private key
245
* fd - the file descriptor for the connection in question
246
* f - the application's callback that delivers the key and cert
247
* a - application specific data
249
SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd,
250
SSLGetClientAuthData f, void *a);
254
* Set the client side argument for SSL to retrieve PKCS #11 pin.
255
* fd - the file descriptor for the connection in question
256
* a - pkcs11 application specific data
258
SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a);
261
** This is a callback for dealing with server certs that are not authenticated
262
** by the client. The client app can decide that it actually likes the
263
** cert by some external means and restart the connection.
265
typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd);
266
SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f,
270
** Configure ssl for running a secure server. Needs the
271
** certificate for the server and the servers private key. The arguments
274
SSL_IMPORT SECStatus SSL_ConfigSecureServer(
275
PRFileDesc *fd, CERTCertificate *cert,
276
SECKEYPrivateKey *key, SSLKEAType kea);
279
** Configure a secure servers session-id cache. Define the maximum number
280
** of entries in the cache, the longevity of the entires, and the directory
281
** where the cache files will be placed. These values can be zero, and
282
** if so, the implementation will choose defaults.
283
** This version of the function is for use in applications that have only one
284
** process that uses the cache (even if that process has multiple threads).
286
SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries,
288
PRUint32 ssl3_timeout,
289
const char * directory);
291
** Like SSL_ConfigServerSessionIDCache, with one important difference.
292
** If the application will run multiple processes (as opposed to, or in
293
** addition to multiple threads), then it must call this function, instead
294
** of calling SSL_ConfigServerSessionIDCache().
295
** This has nothing to do with the number of processORs, only processEs.
296
** This function sets up a Server Session ID (SID) cache that is safe for
297
** access by multiple processes on the same system.
299
SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries,
301
PRUint32 ssl3_timeout,
302
const char * directory);
304
/* Get and set the configured maximum number of mutexes used for the
305
** server's store of SSL sessions. This value is used by the server
306
** session ID cache initialization functions shown above. Note that on
307
** some platforms, these mutexes are actually implemented with POSIX
308
** semaphores, or with unnamed pipes. The default value varies by platform.
309
** An attempt to set a too-low maximum will return an error and the
310
** configured value will not be changed.
312
SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void);
313
SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks);
315
/* environment variable set by SSL_ConfigMPServerSIDCache, and queried by
316
* SSL_InheritMPServerSIDCache when envString is NULL.
318
#define SSL_ENV_VAR_NAME "SSL_INHERITANCE"
320
/* called in child to inherit SID Cache variables.
321
* If envString is NULL, this function will use the value of the environment
322
* variable "SSL_INHERITANCE", otherwise the string value passed in will be
325
SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString);
328
** Set the callback on a particular socket that gets called when we finish
329
** performing a handshake.
331
typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd,
333
SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd,
334
SSLHandshakeCallback cb, void *client_data);
337
** For the server, request a new handshake. For the client, begin a new
338
** handshake. If flushCache is non-zero, the SSL3 cache entry will be
339
** flushed first, ensuring that a full SSL handshake will be done.
340
** If flushCache is zero, and an SSL connection is established, it will
341
** do the much faster session restart handshake. This will change the
342
** session keys without doing another private key operation.
344
SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache);
347
** Same as above, but with an I/O timeout.
349
SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd,
351
PRIntervalTime timeout);
354
#ifdef SSL_DEPRECATED_FUNCTION
356
** For the server, request a new handshake. For the client, begin a new
357
** handshake. Flushes SSL3 session cache entry first, ensuring that a
358
** full handshake will be done.
359
** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE)
361
SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd);
365
* Allow the application to pass a URL or hostname into the SSL library
367
SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url);
370
** Return the number of bytes that SSL has waiting in internal buffers.
371
** Return 0 if security is not enabled.
373
SSL_IMPORT int SSL_DataPending(PRFileDesc *fd);
376
** Invalidate the SSL session associated with fd.
378
SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd);
381
** Return a SECItem containing the SSL session ID associated with the fd.
383
SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd);
386
** Clear out the client's SSL session cache, not the server's session cache.
388
SSL_IMPORT void SSL_ClearSessionCache(void);
391
** Close the server's SSL session cache.
393
SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void);
396
** Set peer information so we can correctly look up SSL session later.
397
** You only have to do this if you're tunneling through a proxy.
399
SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, char *peerID);
402
** Reveal the security information for the peer.
404
SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket);
405
SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket);
406
SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket);
409
/* This callback may be passed to the SSL library via a call to
410
* SSL_GetClientAuthDataHook() for each SSL client socket.
411
* It will be invoked when SSL needs to know what certificate and private key
412
* (if any) to use to respond to a request for client authentication.
413
* If arg is non-NULL, it is a pointer to a NULL-terminated string containing
414
* the nickname of the cert/key pair to use.
415
* If arg is NULL, this function will search the cert and key databases for
416
* a suitable match and send it if one is found.
419
NSS_GetClientAuthData(void * arg,
421
struct CERTDistNamesStr * caNames,
422
struct CERTCertificateStr ** pRetCert,
423
struct SECKEYPrivateKeyStr **pRetKey);
426
* Look to see if any of the signers in the cert chain for "cert" are found
427
* in the list of caNames.
428
* Returns SECSuccess if so, SECFailure if not.
429
* Used by NSS_GetClientAuthData. May be used by other callback functions.
431
SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert,
432
CERTDistNames *caNames);
435
* Returns key exchange type of the keys in an SSL server certificate.
437
SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert);
439
/* Set cipher policies to a predefined Domestic (U.S.A.) policy.
440
* This essentially enables all supported ciphers.
442
SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void);
444
/* Set cipher policies to a predefined Policy that is exportable from the USA
445
* according to present U.S. policies as we understand them.
446
* See documentation for the list.
447
* Note that your particular application program may be able to obtain
448
* an export license with more or fewer capabilities than those allowed
449
* by this function. In that case, you should use SSL_SetPolicy()
450
* to explicitly allow those ciphers you may legally export.
452
SSL_IMPORT SECStatus NSS_SetExportPolicy(void);
454
/* Set cipher policies to a predefined Policy that is exportable from the USA
455
* according to present U.S. policies as we understand them, and that the
456
* nation of France will permit to be imported into their country.
457
* See documentation for the list.
459
SSL_IMPORT SECStatus NSS_SetFrancePolicy(void);
461
SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void);
463
/* Report more information than SSL_SecurityStatus.
464
** Caller supplies the info struct. Function fills it in.
466
SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info,
468
SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite,
469
SSLCipherSuiteInfo *info, PRUintn len);
472
** Return a new reference to the certificate that was most recently sent
473
** to the peer on this SSL/TLS connection, or NULL if none has been sent.
475
SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd);
479
#endif /* __ssl_h_ */
added
removed
security/nss-fips/lib/ssl/ssl.h
