/gecko_api/include/ssl.h
C++ Header | 512 lines | 157 code | 63 blank | 292 comment | 3 complexity | b0f8ac2a59d8f0b4b2dd93458cf7c0b8 MD5 | raw file
1/* 2 * This file contains prototypes for the public SSL functions. 3 * 4 * ***** BEGIN LICENSE BLOCK ***** 5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 6 * 7 * The contents of this file are subject to the Mozilla Public License Version 8 * 1.1 (the "License"); you may not use this file except in compliance with 9 * the License. You may obtain a copy of the License at 10 * http://www.mozilla.org/MPL/ 11 * 12 * Software distributed under the License is distributed on an "AS IS" basis, 13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 14 * for the specific language governing rights and limitations under the 15 * License. 16 * 17 * The Original Code is the Netscape security libraries. 18 * 19 * The Initial Developer of the Original Code is 20 * Netscape Communications Corporation. 21 * Portions created by the Initial Developer are Copyright (C) 1994-2000 22 * the Initial Developer. All Rights Reserved. 23 * 24 * Contributor(s): 25 * 26 * Alternatively, the contents of this file may be used under the terms of 27 * either the GNU General Public License Version 2 or later (the "GPL"), or 28 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), 29 * in which case the provisions of the GPL or the LGPL are applicable instead 30 * of those above. If you wish to allow use of your version of this file only 31 * under the terms of either the GPL or the LGPL, and not to allow others to 32 * use your version of this file under the terms of the MPL, indicate your 33 * decision by deleting the provisions above and replace them with the notice 34 * and other provisions required by the GPL or the LGPL. If you do not delete 35 * the provisions above, a recipient may use your version of this file under 36 * the terms of any one of the MPL, the GPL or the LGPL. 37 * 38 * ***** END LICENSE BLOCK ***** */ 39/* $Id: ssl.h,v 1.28 2008/03/06 20:16:22 wtc%google.com Exp $ */ 40 41#ifndef __ssl_h_ 42#define __ssl_h_ 43 44#include "prtypes.h" 45#include "prerror.h" 46#include "prio.h" 47#include "seccomon.h" 48#include "cert.h" 49#include "keyt.h" 50 51#include "sslt.h" /* public ssl data types */ 52 53#if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) 54#define SSL_IMPORT extern __declspec(dllimport) 55#else 56#define SSL_IMPORT extern 57#endif 58 59SEC_BEGIN_PROTOS 60 61/* constant table enumerating all implemented SSL 2 and 3 cipher suites. */ 62SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; 63 64/* number of entries in the above table. */ 65SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; 66 67/* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ 68#define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00) 69 70/* 71** Imports fd into SSL, returning a new socket. Copies SSL configuration 72** from model. 73*/ 74SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); 75 76/* 77** Enable/disable an ssl mode 78** 79** SSL_SECURITY: 80** enable/disable use of SSL security protocol before connect 81** 82** SSL_SOCKS: 83** enable/disable use of socks before connect 84** (No longer supported). 85** 86** SSL_REQUEST_CERTIFICATE: 87** require a certificate during secure connect 88*/ 89/* options */ 90#define SSL_SECURITY 1 /* (on by default) */ 91#define SSL_SOCKS 2 /* (off by default) */ 92#define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ 93#define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ 94 /* (off by default) */ 95#define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ 96 /* (off by default) */ 97#define SSL_ENABLE_SSL2 7 /* enable ssl v2 (on by default) */ 98#define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ 99#define SSL_NO_CACHE 9 /* don't use the session cache */ 100 /* (off by default) */ 101#define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ 102 /* by default) */ 103#define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ 104 /* (off by default) */ 105#define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ 106 /* (on by default) */ 107#define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ 108#define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ 109#define SSL_NO_STEP_DOWN 15 /* Disable export cipher suites */ 110 /* if step-down keys are needed. */ 111 /* default: off, generate */ 112 /* step-down keys if needed. */ 113#define SSL_BYPASS_PKCS11 16 /* use PKCS#11 for pub key only */ 114#define SSL_NO_LOCKS 17 /* Don't use locks for protection */ 115#define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ 116 /* extension (off by default) */ 117 118#ifdef SSL_DEPRECATED_FUNCTION 119/* Old deprecated function names */ 120SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on); 121SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on); 122#endif 123 124/* New function names */ 125SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on); 126SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on); 127SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on); 128SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on); 129SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle); 130 131/* 132** Control ciphers that SSL uses. If on is non-zero then the named cipher 133** is enabled, otherwise it is disabled. 134** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). 135** EnableCipher records user preferences. 136** SetPolicy sets the policy according to the policy module. 137*/ 138#ifdef SSL_DEPRECATED_FUNCTION 139/* Old deprecated function names */ 140SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); 141SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); 142#endif 143 144/* New function names */ 145SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled); 146SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled); 147SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); 148SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); 149SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); 150SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); 151 152/* Values for "policy" argument to SSL_PolicySet */ 153/* Values returned by SSL_CipherPolicyGet. */ 154#define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ 155#define SSL_ALLOWED 1 156#define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ 157 158/* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ 159#define SSL_REQUIRE_NEVER ((PRBool)0) 160#define SSL_REQUIRE_ALWAYS ((PRBool)1) 161#define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) 162#define SSL_REQUIRE_NO_ERROR ((PRBool)3) 163 164/* 165** Reset the handshake state for fd. This will make the complete SSL 166** handshake protocol execute from the ground up on the next i/o 167** operation. 168*/ 169SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); 170 171/* 172** Force the handshake for fd to complete immediately. This blocks until 173** the complete SSL handshake protocol is finished. 174*/ 175SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); 176 177/* 178** Same as above, but with an I/O timeout. 179 */ 180SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, 181 PRIntervalTime timeout); 182 183/* 184** Query security status of socket. *on is set to one if security is 185** enabled. *keySize will contain the stream key size used. *issuer will 186** contain the RFC1485 verison of the name of the issuer of the 187** certificate at the other end of the connection. For a client, this is 188** the issuer of the server's certificate; for a server, this is the 189** issuer of the client's certificate (if any). Subject is the subject of 190** the other end's certificate. The pointers can be zero if the desired 191** data is not needed. All strings returned by this function are owned 192** by the caller, and need to be freed with PORT_Free. 193*/ 194SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, 195 int *keySize, int *secretKeySize, 196 char **issuer, char **subject); 197 198/* Values for "on" */ 199#define SSL_SECURITY_STATUS_NOOPT -1 200#define SSL_SECURITY_STATUS_OFF 0 201#define SSL_SECURITY_STATUS_ON_HIGH 1 202#define SSL_SECURITY_STATUS_ON_LOW 2 203#define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ 204 205/* 206** Return the certificate for our SSL peer. If the client calls this 207** it will always return the server's certificate. If the server calls 208** this, it may return NULL if client authentication is not enabled or 209** if the client had no certificate when asked. 210** "fd" the socket "file" descriptor 211*/ 212SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); 213 214/* 215** Authenticate certificate hook. Called when a certificate comes in 216** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the 217** certificate. 218*/ 219typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, 220 PRBool checkSig, 221 PRBool isServer); 222 223SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, 224 SSLAuthCertificate f, 225 void *arg); 226 227/* An implementation of the certificate authentication hook */ 228SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, 229 PRBool checkSig, PRBool isServer); 230 231/* 232 * Prototype for SSL callback to get client auth data from the application. 233 * arg - application passed argument 234 * caNames - pointer to distinguished names of CAs that the server likes 235 * pRetCert - pointer to pointer to cert, for return of cert 236 * pRetKey - pointer to key pointer, for return of key 237 */ 238typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg, 239 PRFileDesc *fd, 240 CERTDistNames *caNames, 241 CERTCertificate **pRetCert,/*return */ 242 SECKEYPrivateKey **pRetKey);/* return */ 243 244/* 245 * Set the client side callback for SSL to retrieve user's private key 246 * and certificate. 247 * fd - the file descriptor for the connection in question 248 * f - the application's callback that delivers the key and cert 249 * a - application specific data 250 */ 251SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, 252 SSLGetClientAuthData f, void *a); 253 254 255/* 256 * Set the client side argument for SSL to retrieve PKCS #11 pin. 257 * fd - the file descriptor for the connection in question 258 * a - pkcs11 application specific data 259 */ 260SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); 261 262/* 263** This is a callback for dealing with server certs that are not authenticated 264** by the client. The client app can decide that it actually likes the 265** cert by some external means and restart the connection. 266*/ 267typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); 268SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, 269 void *arg); 270 271/* 272** Configure ssl for running a secure server. Needs the 273** certificate for the server and the servers private key. The arguments 274** are copied. 275*/ 276SSL_IMPORT SECStatus SSL_ConfigSecureServer( 277 PRFileDesc *fd, CERTCertificate *cert, 278 SECKEYPrivateKey *key, SSLKEAType kea); 279 280/* 281** Configure a secure servers session-id cache. Define the maximum number 282** of entries in the cache, the longevity of the entires, and the directory 283** where the cache files will be placed. These values can be zero, and 284** if so, the implementation will choose defaults. 285** This version of the function is for use in applications that have only one 286** process that uses the cache (even if that process has multiple threads). 287*/ 288SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, 289 PRUint32 timeout, 290 PRUint32 ssl3_timeout, 291 const char * directory); 292/* 293** Like SSL_ConfigServerSessionIDCache, with one important difference. 294** If the application will run multiple processes (as opposed to, or in 295** addition to multiple threads), then it must call this function, instead 296** of calling SSL_ConfigServerSessionIDCache(). 297** This has nothing to do with the number of processORs, only processEs. 298** This function sets up a Server Session ID (SID) cache that is safe for 299** access by multiple processes on the same system. 300*/ 301SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, 302 PRUint32 timeout, 303 PRUint32 ssl3_timeout, 304 const char * directory); 305 306/* Get and set the configured maximum number of mutexes used for the 307** server's store of SSL sessions. This value is used by the server 308** session ID cache initialization functions shown above. Note that on 309** some platforms, these mutexes are actually implemented with POSIX 310** semaphores, or with unnamed pipes. The default value varies by platform. 311** An attempt to set a too-low maximum will return an error and the 312** configured value will not be changed. 313*/ 314SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); 315SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); 316 317/* environment variable set by SSL_ConfigMPServerSIDCache, and queried by 318 * SSL_InheritMPServerSIDCache when envString is NULL. 319 */ 320#define SSL_ENV_VAR_NAME "SSL_INHERITANCE" 321 322/* called in child to inherit SID Cache variables. 323 * If envString is NULL, this function will use the value of the environment 324 * variable "SSL_INHERITANCE", otherwise the string value passed in will be 325 * used. 326 */ 327SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString); 328 329/* 330** Set the callback on a particular socket that gets called when we finish 331** performing a handshake. 332*/ 333typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, 334 void *client_data); 335SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 336 SSLHandshakeCallback cb, void *client_data); 337 338/* 339** For the server, request a new handshake. For the client, begin a new 340** handshake. If flushCache is non-zero, the SSL3 cache entry will be 341** flushed first, ensuring that a full SSL handshake will be done. 342** If flushCache is zero, and an SSL connection is established, it will 343** do the much faster session restart handshake. This will change the 344** session keys without doing another private key operation. 345*/ 346SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); 347 348/* 349** Same as above, but with an I/O timeout. 350 */ 351SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, 352 PRBool flushCache, 353 PRIntervalTime timeout); 354 355 356#ifdef SSL_DEPRECATED_FUNCTION 357/* deprecated! 358** For the server, request a new handshake. For the client, begin a new 359** handshake. Flushes SSL3 session cache entry first, ensuring that a 360** full handshake will be done. 361** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) 362*/ 363SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); 364#endif 365 366/* 367 * Allow the application to pass a URL or hostname into the SSL library 368 */ 369SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); 370 371/* 372** Return the number of bytes that SSL has waiting in internal buffers. 373** Return 0 if security is not enabled. 374*/ 375SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); 376 377/* 378** Invalidate the SSL session associated with fd. 379*/ 380SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); 381 382/* 383** Return a SECItem containing the SSL session ID associated with the fd. 384*/ 385SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); 386 387/* 388** Clear out the client's SSL session cache, not the server's session cache. 389*/ 390SSL_IMPORT void SSL_ClearSessionCache(void); 391 392/* 393** Close the server's SSL session cache. 394*/ 395SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); 396 397/* 398** Set peer information so we can correctly look up SSL session later. 399** You only have to do this if you're tunneling through a proxy. 400*/ 401SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, char *peerID); 402 403/* 404** Reveal the security information for the peer. 405*/ 406SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket); 407SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket); 408SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket); 409 410 411/* This callback may be passed to the SSL library via a call to 412 * SSL_GetClientAuthDataHook() for each SSL client socket. 413 * It will be invoked when SSL needs to know what certificate and private key 414 * (if any) to use to respond to a request for client authentication. 415 * If arg is non-NULL, it is a pointer to a NULL-terminated string containing 416 * the nickname of the cert/key pair to use. 417 * If arg is NULL, this function will search the cert and key databases for 418 * a suitable match and send it if one is found. 419 */ 420SSL_IMPORT SECStatus 421NSS_GetClientAuthData(void * arg, 422 PRFileDesc * socket, 423 struct CERTDistNamesStr * caNames, 424 struct CERTCertificateStr ** pRetCert, 425 struct SECKEYPrivateKeyStr **pRetKey); 426 427/* 428 * Look to see if any of the signers in the cert chain for "cert" are found 429 * in the list of caNames. 430 * Returns SECSuccess if so, SECFailure if not. 431 * Used by NSS_GetClientAuthData. May be used by other callback functions. 432 */ 433SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, 434 CERTDistNames *caNames); 435 436/* 437 * Returns key exchange type of the keys in an SSL server certificate. 438 */ 439SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert); 440 441/* Set cipher policies to a predefined Domestic (U.S.A.) policy. 442 * This essentially enables all supported ciphers. 443 */ 444SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); 445 446/* Set cipher policies to a predefined Policy that is exportable from the USA 447 * according to present U.S. policies as we understand them. 448 * See documentation for the list. 449 * Note that your particular application program may be able to obtain 450 * an export license with more or fewer capabilities than those allowed 451 * by this function. In that case, you should use SSL_SetPolicy() 452 * to explicitly allow those ciphers you may legally export. 453 */ 454SSL_IMPORT SECStatus NSS_SetExportPolicy(void); 455 456/* Set cipher policies to a predefined Policy that is exportable from the USA 457 * according to present U.S. policies as we understand them, and that the 458 * nation of France will permit to be imported into their country. 459 * See documentation for the list. 460 */ 461SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); 462 463SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void); 464 465/* Report more information than SSL_SecurityStatus. 466** Caller supplies the info struct. Function fills it in. 467*/ 468SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, 469 PRUintn len); 470SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, 471 SSLCipherSuiteInfo *info, PRUintn len); 472 473/* 474** Return a new reference to the certificate that was most recently sent 475** to the peer on this SSL/TLS connection, or NULL if none has been sent. 476*/ 477SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd); 478 479/* Test an SSL configuration to see if SSL_BYPASS_PKCS11 can be turned on. 480** Check the key exchange algorithm for each cipher in the list to see if 481** a master secret key can be extracted after being derived with the mechanism 482** required by the protocolmask argument. If the KEA will use keys from the 483** specified cert make sure the extract operation is attempted from the slot 484** where the private key resides. 485** If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and 486** SECSuccess is returned. In all other cases but one (*pcanbypass) is 487** set to FALSE and SECFailure is returned. 488** In that last case Derive() has been called successfully but the MS is null, 489** CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the 490** arguments were all valid but the slot cannot be bypassed. 491** 492** Note: A TRUE return code from CanBypass means "Your configuration will perform 493** NO WORSE with the bypass enabled than without"; it does NOT mean that every 494** cipher suite listed will work properly with the selected protocols. 495** 496** Caveat: If export cipher suites are included in the argument list Canbypass 497** will return FALSE. 498**/ 499 500/* protocol mask bits */ 501#define SSL_CBP_SSL3 0x0001 /* test SSL v3 mechanisms */ 502#define SSL_CBP_TLS1_0 0x0002 /* test TLS v1.0 mechanisms */ 503 504SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, 505 SECKEYPrivateKey *privKey, 506 PRUint32 protocolmask, 507 PRUint16 *ciphers, int nciphers, 508 PRBool *pcanbypass, void *pwArg); 509 510SEC_END_PROTOS 511 512#endif /* __ssl_h_ */