/gecko_api/include/ssl.h

  1/*
  2 * This file contains prototypes for the public SSL functions.
  3 *
  4 * ***** BEGIN LICENSE BLOCK *****
  5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  6 *
  7 * The contents of this file are subject to the Mozilla Public License Version
  8 * 1.1 (the "License"); you may not use this file except in compliance with
  9 * the License. You may obtain a copy of the License at
 10 * http://www.mozilla.org/MPL/
 11 *
 12 * Software distributed under the License is distributed on an "AS IS" basis,
 13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 14 * for the specific language governing rights and limitations under the
 15 * License.
 16 *
 17 * The Original Code is the Netscape security libraries.
 18 *
 19 * The Initial Developer of the Original Code is
 20 * Netscape Communications Corporation.
 21 * Portions created by the Initial Developer are Copyright (C) 1994-2000
 22 * the Initial Developer. All Rights Reserved.
 23 *
 24 * Contributor(s):
 25 *
 26 * Alternatively, the contents of this file may be used under the terms of
 27 * either the GNU General Public License Version 2 or later (the "GPL"), or
 28 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 29 * in which case the provisions of the GPL or the LGPL are applicable instead
 30 * of those above. If you wish to allow use of your version of this file only
 31 * under the terms of either the GPL or the LGPL, and not to allow others to
 32 * use your version of this file under the terms of the MPL, indicate your
 33 * decision by deleting the provisions above and replace them with the notice
 34 * and other provisions required by the GPL or the LGPL. If you do not delete
 35 * the provisions above, a recipient may use your version of this file under
 36 * the terms of any one of the MPL, the GPL or the LGPL.
 37 *
 38 * ***** END LICENSE BLOCK ***** */
 39/* $Id: ssl.h,v 1.28 2008/03/06 20:16:22 wtc%google.com Exp $ */
 40
 41#ifndef __ssl_h_
 42#define __ssl_h_
 43
 44#include "prtypes.h"
 45#include "prerror.h"
 46#include "prio.h"
 47#include "seccomon.h"
 48#include "cert.h"
 49#include "keyt.h"
 50
 51#include "sslt.h"  /* public ssl data types */
 52
 53#if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS)
 54#define SSL_IMPORT extern __declspec(dllimport)
 55#else
 56#define SSL_IMPORT extern
 57#endif
 58
 59SEC_BEGIN_PROTOS
 60
 61/* constant table enumerating all implemented SSL 2 and 3 cipher suites. */
 62SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[];
 63
 64/* number of entries in the above table. */
 65SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers;
 66
 67/* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */
 68#define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00)
 69
 70/*
 71** Imports fd into SSL, returning a new socket.  Copies SSL configuration
 72** from model.
 73*/
 74SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd);
 75
 76/*
 77** Enable/disable an ssl mode
 78**
 79** 	SSL_SECURITY:
 80** 		enable/disable use of SSL security protocol before connect
 81**
 82** 	SSL_SOCKS:
 83** 		enable/disable use of socks before connect
 84**		(No longer supported).
 85**
 86** 	SSL_REQUEST_CERTIFICATE:
 87** 		require a certificate during secure connect
 88*/
 89/* options */
 90#define SSL_SECURITY			1 /* (on by default) */
 91#define SSL_SOCKS			2 /* (off by default) */
 92#define SSL_REQUEST_CERTIFICATE		3 /* (off by default) */
 93#define SSL_HANDSHAKE_AS_CLIENT		5 /* force accept to hs as client */
 94                               		  /* (off by default) */
 95#define SSL_HANDSHAKE_AS_SERVER		6 /* force connect to hs as server */
 96                               		  /* (off by default) */
 97#define SSL_ENABLE_SSL2			7 /* enable ssl v2 (on by default) */
 98#define SSL_ENABLE_SSL3		        8 /* enable ssl v3 (on by default) */
 99#define SSL_NO_CACHE		        9 /* don't use the session cache */
100                    		          /* (off by default) */
101#define SSL_REQUIRE_CERTIFICATE        10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */
102                                          /* by default) */
103#define SSL_ENABLE_FDX                 11 /* permit simultaneous read/write */
104                                          /* (off by default) */
105#define SSL_V2_COMPATIBLE_HELLO        12 /* send v3 client hello in v2 fmt */
106                                          /* (on by default) */
107#define SSL_ENABLE_TLS		       13 /* enable TLS (on by default) */
108#define SSL_ROLLBACK_DETECTION         14 /* for compatibility, default: on */
109#define SSL_NO_STEP_DOWN               15 /* Disable export cipher suites   */
110                                          /* if step-down keys are needed.  */
111					  /* default: off, generate         */
112					  /* step-down keys if needed.      */
113#define SSL_BYPASS_PKCS11              16 /* use PKCS#11 for pub key only   */
114#define SSL_NO_LOCKS                   17 /* Don't use locks for protection */
115#define SSL_ENABLE_SESSION_TICKETS     18 /* Enable TLS SessionTicket       */
116                                          /* extension (off by default)     */
117
118#ifdef SSL_DEPRECATED_FUNCTION 
119/* Old deprecated function names */
120SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on);
121SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on);
122#endif
123
124/* New function names */
125SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on);
126SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on);
127SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on);
128SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on);
129SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle);
130
131/*
132** Control ciphers that SSL uses. If on is non-zero then the named cipher
133** is enabled, otherwise it is disabled. 
134** The "cipher" values are defined in sslproto.h (the SSL_EN_* values).
135** EnableCipher records user preferences.
136** SetPolicy sets the policy according to the policy module.
137*/
138#ifdef SSL_DEPRECATED_FUNCTION 
139/* Old deprecated function names */
140SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled);
141SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy);
142#endif
143
144/* New function names */
145SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled);
146SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled);
147SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled);
148SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled);
149SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy);
150SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy);
151
152/* Values for "policy" argument to SSL_PolicySet */
153/* Values returned by SSL_CipherPolicyGet. */
154#define SSL_NOT_ALLOWED		 0	      /* or invalid or unimplemented */
155#define SSL_ALLOWED		 1
156#define SSL_RESTRICTED		 2	      /* only with "Step-Up" certs. */
157
158/* Values for "on" with SSL_REQUIRE_CERTIFICATE. */
159#define SSL_REQUIRE_NEVER           ((PRBool)0)
160#define SSL_REQUIRE_ALWAYS          ((PRBool)1)
161#define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2)
162#define SSL_REQUIRE_NO_ERROR        ((PRBool)3)
163
164/*
165** Reset the handshake state for fd. This will make the complete SSL
166** handshake protocol execute from the ground up on the next i/o
167** operation.
168*/
169SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer);
170
171/*
172** Force the handshake for fd to complete immediately.  This blocks until
173** the complete SSL handshake protocol is finished.
174*/
175SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd);
176
177/*
178** Same as above, but with an I/O timeout.
179 */
180SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd,
181                                                   PRIntervalTime timeout);
182
183/*
184** Query security status of socket. *on is set to one if security is
185** enabled. *keySize will contain the stream key size used. *issuer will
186** contain the RFC1485 verison of the name of the issuer of the
187** certificate at the other end of the connection. For a client, this is
188** the issuer of the server's certificate; for a server, this is the
189** issuer of the client's certificate (if any). Subject is the subject of
190** the other end's certificate. The pointers can be zero if the desired
191** data is not needed.  All strings returned by this function are owned
192** by the caller, and need to be freed with PORT_Free.
193*/
194SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher,
195			                int *keySize, int *secretKeySize,
196			                char **issuer, char **subject);
197
198/* Values for "on" */
199#define SSL_SECURITY_STATUS_NOOPT	-1
200#define SSL_SECURITY_STATUS_OFF		0
201#define SSL_SECURITY_STATUS_ON_HIGH	1
202#define SSL_SECURITY_STATUS_ON_LOW	2
203#define SSL_SECURITY_STATUS_FORTEZZA	3 /* NO LONGER SUPPORTED */
204
205/*
206** Return the certificate for our SSL peer. If the client calls this
207** it will always return the server's certificate. If the server calls
208** this, it may return NULL if client authentication is not enabled or
209** if the client had no certificate when asked.
210**	"fd" the socket "file" descriptor
211*/
212SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd);
213
214/*
215** Authenticate certificate hook. Called when a certificate comes in
216** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the
217** certificate.
218*/
219typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, 
220                                                    PRBool checkSig,
221                                                    PRBool isServer);
222
223SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, 
224					     SSLAuthCertificate f,
225				             void *arg);
226
227/* An implementation of the certificate authentication hook */
228SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, 
229					 PRBool checkSig, PRBool isServer);
230
231/*
232 * Prototype for SSL callback to get client auth data from the application.
233 *	arg - application passed argument
234 *	caNames - pointer to distinguished names of CAs that the server likes
235 *	pRetCert - pointer to pointer to cert, for return of cert
236 *	pRetKey - pointer to key pointer, for return of key
237 */
238typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg,
239                                PRFileDesc *fd,
240                                CERTDistNames *caNames,
241                                CERTCertificate **pRetCert,/*return */
242                                SECKEYPrivateKey **pRetKey);/* return */
243
244/*
245 * Set the client side callback for SSL to retrieve user's private key
246 * and certificate.
247 *	fd - the file descriptor for the connection in question
248 *	f - the application's callback that delivers the key and cert
249 *	a - application specific data
250 */
251SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, 
252			                       SSLGetClientAuthData f, void *a);
253
254
255/*
256 * Set the client side argument for SSL to retrieve PKCS #11 pin.
257 *	fd - the file descriptor for the connection in question
258 *	a - pkcs11 application specific data
259 */
260SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a);
261
262/*
263** This is a callback for dealing with server certs that are not authenticated
264** by the client.  The client app can decide that it actually likes the
265** cert by some external means and restart the connection.
266*/
267typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd);
268SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, 
269				     void *arg);
270
271/*
272** Configure ssl for running a secure server. Needs the
273** certificate for the server and the servers private key. The arguments
274** are copied.
275*/
276SSL_IMPORT SECStatus SSL_ConfigSecureServer(
277				PRFileDesc *fd, CERTCertificate *cert,
278				SECKEYPrivateKey *key, SSLKEAType kea);
279
280/*
281** Configure a secure servers session-id cache. Define the maximum number
282** of entries in the cache, the longevity of the entires, and the directory
283** where the cache files will be placed.  These values can be zero, and 
284** if so, the implementation will choose defaults.
285** This version of the function is for use in applications that have only one 
286** process that uses the cache (even if that process has multiple threads).
287*/
288SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int      maxCacheEntries,
289					            PRUint32 timeout,
290					            PRUint32 ssl3_timeout,
291				              const char *   directory);
292/*
293** Like SSL_ConfigServerSessionIDCache, with one important difference.
294** If the application will run multiple processes (as opposed to, or in 
295** addition to multiple threads), then it must call this function, instead
296** of calling SSL_ConfigServerSessionIDCache().
297** This has nothing to do with the number of processORs, only processEs.
298** This function sets up a Server Session ID (SID) cache that is safe for
299** access by multiple processes on the same system.
300*/
301SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int      maxCacheEntries, 
302				                PRUint32 timeout,
303			       	                PRUint32 ssl3_timeout, 
304		                          const char *   directory);
305
306/* Get and set the configured maximum number of mutexes used for the 
307** server's store of SSL sessions.  This value is used by the server 
308** session ID cache initialization functions shown above.  Note that on 
309** some platforms, these mutexes are actually implemented with POSIX 
310** semaphores, or with unnamed pipes.  The default value varies by platform.
311** An attempt to set a too-low maximum will return an error and the 
312** configured value will not be changed.
313*/
314SSL_IMPORT PRUint32  SSL_GetMaxServerCacheLocks(void);
315SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks);
316
317/* environment variable set by SSL_ConfigMPServerSIDCache, and queried by
318 * SSL_InheritMPServerSIDCache when envString is NULL.
319 */
320#define SSL_ENV_VAR_NAME            "SSL_INHERITANCE"
321
322/* called in child to inherit SID Cache variables. 
323 * If envString is NULL, this function will use the value of the environment
324 * variable "SSL_INHERITANCE", otherwise the string value passed in will be 
325 * used.
326 */
327SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString);
328
329/*
330** Set the callback on a particular socket that gets called when we finish
331** performing a handshake.
332*/
333typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd,
334                                                 void *client_data);
335SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 
336			          SSLHandshakeCallback cb, void *client_data);
337
338/*
339** For the server, request a new handshake.  For the client, begin a new
340** handshake.  If flushCache is non-zero, the SSL3 cache entry will be 
341** flushed first, ensuring that a full SSL handshake will be done.
342** If flushCache is zero, and an SSL connection is established, it will 
343** do the much faster session restart handshake.  This will change the 
344** session keys without doing another private key operation.
345*/
346SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache);
347
348/*
349** Same as above, but with an I/O timeout.
350 */
351SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd,
352                                                PRBool flushCache,
353                                                PRIntervalTime timeout);
354
355
356#ifdef SSL_DEPRECATED_FUNCTION 
357/* deprecated!
358** For the server, request a new handshake.  For the client, begin a new
359** handshake.  Flushes SSL3 session cache entry first, ensuring that a 
360** full handshake will be done.  
361** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE)
362*/
363SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd);
364#endif
365
366/*
367 * Allow the application to pass a URL or hostname into the SSL library
368 */
369SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url);
370
371/*
372** Return the number of bytes that SSL has waiting in internal buffers.
373** Return 0 if security is not enabled.
374*/
375SSL_IMPORT int SSL_DataPending(PRFileDesc *fd);
376
377/*
378** Invalidate the SSL session associated with fd.
379*/
380SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd);
381
382/*
383** Return a SECItem containing the SSL session ID associated with the fd.
384*/
385SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd);
386
387/*
388** Clear out the client's SSL session cache, not the server's session cache.
389*/
390SSL_IMPORT void SSL_ClearSessionCache(void);
391
392/*
393** Close the server's SSL session cache.
394*/
395SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void);
396
397/*
398** Set peer information so we can correctly look up SSL session later.
399** You only have to do this if you're tunneling through a proxy.
400*/
401SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, char *peerID);
402
403/*
404** Reveal the security information for the peer. 
405*/
406SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket);
407SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket);
408SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket);
409
410
411/* This callback may be passed to the SSL library via a call to
412 * SSL_GetClientAuthDataHook() for each SSL client socket.
413 * It will be invoked when SSL needs to know what certificate and private key
414 * (if any) to use to respond to a request for client authentication.
415 * If arg is non-NULL, it is a pointer to a NULL-terminated string containing
416 * the nickname of the cert/key pair to use.
417 * If arg is NULL, this function will search the cert and key databases for 
418 * a suitable match and send it if one is found.
419 */
420SSL_IMPORT SECStatus
421NSS_GetClientAuthData(void *                       arg,
422                      PRFileDesc *                 socket,
423                      struct CERTDistNamesStr *    caNames,
424                      struct CERTCertificateStr ** pRetCert,
425                      struct SECKEYPrivateKeyStr **pRetKey);
426
427/*
428 * Look to see if any of the signers in the cert chain for "cert" are found
429 * in the list of caNames.  
430 * Returns SECSuccess if so, SECFailure if not.
431 * Used by NSS_GetClientAuthData.  May be used by other callback functions.
432 */
433SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, 
434                                          CERTDistNames *caNames);
435
436/* 
437 * Returns key exchange type of the keys in an SSL server certificate.
438 */
439SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert);
440
441/* Set cipher policies to a predefined Domestic (U.S.A.) policy.
442 * This essentially enables all supported ciphers.
443 */
444SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void);
445
446/* Set cipher policies to a predefined Policy that is exportable from the USA
447 *   according to present U.S. policies as we understand them.
448 * See documentation for the list.
449 * Note that your particular application program may be able to obtain
450 *   an export license with more or fewer capabilities than those allowed
451 *   by this function.  In that case, you should use SSL_SetPolicy()
452 *   to explicitly allow those ciphers you may legally export.
453 */
454SSL_IMPORT SECStatus NSS_SetExportPolicy(void);
455
456/* Set cipher policies to a predefined Policy that is exportable from the USA
457 *   according to present U.S. policies as we understand them, and that the 
458 *   nation of France will permit to be imported into their country.
459 * See documentation for the list.
460 */
461SSL_IMPORT SECStatus NSS_SetFrancePolicy(void);
462
463SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void);
464
465/* Report more information than SSL_SecurityStatus.
466** Caller supplies the info struct.  Function fills it in.
467*/
468SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info,
469                                        PRUintn len);
470SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, 
471                                        SSLCipherSuiteInfo *info, PRUintn len);
472
473/*
474** Return a new reference to the certificate that was most recently sent
475** to the peer on this SSL/TLS connection, or NULL if none has been sent.
476*/
477SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd);
478
479/* Test an SSL configuration to see if  SSL_BYPASS_PKCS11 can be turned on.
480** Check the key exchange algorithm for each cipher in the list to see if
481** a master secret key can be extracted after being derived with the mechanism
482** required by the protocolmask argument. If the KEA will use keys from the
483** specified cert make sure the extract operation is attempted from the slot
484** where the private key resides.
485** If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and
486** SECSuccess is returned. In all other cases but one (*pcanbypass) is
487** set to FALSE and SECFailure is returned.
488** In that last case Derive() has been called successfully but the MS is null,
489** CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the
490** arguments were all valid but the slot cannot be bypassed.
491**
492** Note: A TRUE return code from CanBypass means "Your configuration will perform
493** NO WORSE with the bypass enabled than without"; it does NOT mean that every
494** cipher suite listed will work properly with the selected protocols.
495**
496** Caveat: If export cipher suites are included in the argument list Canbypass
497** will return FALSE.
498**/
499
500/* protocol mask bits */
501#define SSL_CBP_SSL3	0x0001	        /* test SSL v3 mechanisms */
502#define SSL_CBP_TLS1_0	0x0002		/* test TLS v1.0 mechanisms */
503
504SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert,
505                                   SECKEYPrivateKey *privKey,
506				   PRUint32 protocolmask,
507				   PRUint16 *ciphers, int nciphers,
508                                   PRBool *pcanbypass, void *pwArg);
509
510SEC_END_PROTOS
511
512#endif /* __ssl_h_ */