1 /* 2 * This file contains prototypes for the public SSL functions. 3 * 4 * This Source Code Form is subject to the terms of the Mozilla Public 5 * License, v. 2.0. If a copy of the MPL was not distributed with this 6 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 7 8 #ifndef __ssl_h_ 9 #define __ssl_h_ 10 11 #include "prtypes.h" 12 #include "prerror.h" 13 #include "prio.h" 14 #include "seccomon.h" 15 #include "cert.h" 16 #include "keythi.h" 17 18 #include "sslt.h" /* public ssl data types */ 19 20 #if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) 21 #define SSL_IMPORT extern __declspec(dllimport) 22 #else 23 #define SSL_IMPORT extern 24 #endif 25 26 SEC_BEGIN_PROTOS 27 28 /* constant table enumerating all implemented cipher suites. */ 29 SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; 30 31 /* the same as the above, but is a function */ 32 SSL_IMPORT const PRUint16 *SSL_GetImplementedCiphers(void); 33 34 /* number of entries in the above table. */ 35 SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; 36 37 /* the same as the above, but is a function */ 38 SSL_IMPORT PRUint16 SSL_GetNumImplementedCiphers(void); 39 40 /* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ 41 #define SSL_IS_SSL2_CIPHER(which) (((which)&0xfff0) == 0xff00) 42 43 /* 44 ** Imports fd into SSL, returning a new socket. Copies SSL configuration 45 ** from model. 46 */ 47 SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); 48 49 /* 50 ** Imports fd into DTLS, returning a new socket. Copies DTLS configuration 51 ** from model. 52 */ 53 SSL_IMPORT PRFileDesc *DTLS_ImportFD(PRFileDesc *model, PRFileDesc *fd); 54 55 /* 56 ** Enable/disable an ssl mode 57 ** 58 ** SSL_SECURITY: 59 ** enable/disable use of SSL security protocol before connect 60 ** 61 ** SSL_SOCKS: 62 ** enable/disable use of socks before connect 63 ** (No longer supported). 64 ** 65 ** SSL_REQUEST_CERTIFICATE: 66 ** require a certificate during secure connect 67 */ 68 /* options */ 69 #define SSL_SECURITY 1 /* (on by default) */ 70 #define SSL_SOCKS 2 /* (off by default) */ 71 #define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ 72 #define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ 73 /* (off by default) */ 74 #define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ 75 /* (off by default) */ 76 77 /* OBSOLETE: SSL v2 is obsolete and may be removed soon. */ 78 #define SSL_ENABLE_SSL2 7 /* enable ssl v2 (off by default) */ 79 80 /* OBSOLETE: See "SSL Version Range API" below for the replacement and a 81 ** description of the non-obvious semantics of using SSL_ENABLE_SSL3. 82 */ 83 #define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ 84 85 #define SSL_NO_CACHE 9 /* don't use the session cache */ 86 /* (off by default) */ 87 #define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ 88 /* by default) */ 89 #define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ 90 /* (off by default) */ 91 92 /* OBSOLETE: SSL v2 compatible hellos are not accepted by some TLS servers 93 ** and cannot negotiate extensions. SSL v2 is obsolete. This option may be 94 ** removed soon. 95 */ 96 #define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ 97 /* (off by default) */ 98 99 /* OBSOLETE: See "SSL Version Range API" below for the replacement and a 100 ** description of the non-obvious semantics of using SSL_ENABLE_TLS. 101 */ 102 #define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ 103 104 #define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ 105 #define SSL_NO_STEP_DOWN 15 /* (unsupported, deprecated, off) */ 106 #define SSL_BYPASS_PKCS11 16 /* (unsupported, deprecated, off) */ 107 #define SSL_NO_LOCKS 17 /* Don't use locks for protection */ 108 #define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ 109 /* extension (off by default) */ 110 #define SSL_ENABLE_DEFLATE 19 /* (unsupported, deprecated, off) */ 111 #define SSL_ENABLE_RENEGOTIATION 20 /* Values below (default: never) */ 112 #define SSL_REQUIRE_SAFE_NEGOTIATION 21 /* Peer must send Signaling */ 113 /* Cipher Suite Value (SCSV) or */ 114 /* Renegotiation Info (RI) */ 115 /* extension in ALL handshakes. */ 116 /* default: off */ 117 #define SSL_ENABLE_FALSE_START 22 /* Enable SSL false start (off by */ 118 /* default, applies only to */ 119 /* clients). False start is a */ 120 /* mode where an SSL client will start sending application data before 121 * verifying the server's Finished message. This means that we could end up 122 * sending data to an imposter. However, the data will be encrypted and 123 * only the true server can derive the session key. Thus, so long as the 124 * cipher isn't broken this is safe. The advantage of false start is that 125 * it saves a round trip for client-speaks-first protocols when performing a 126 * full handshake. 127 * 128 * In addition to enabling this option, the application must register a 129 * callback using the SSL_SetCanFalseStartCallback function. 130 */ 131 132 /* For SSL 3.0 and TLS 1.0, by default we prevent chosen plaintext attacks 133 * on SSL CBC mode cipher suites (see RFC 4346 Section F.3) by splitting 134 * non-empty application_data records into two records; the first record has 135 * only the first byte of plaintext, and the second has the rest. 136 * 137 * This only prevents the attack in the sending direction; the connection may 138 * still be vulnerable to such attacks if the peer does not implement a similar 139 * countermeasure. 140 * 141 * This protection mechanism is on by default; the default can be overridden by 142 * setting NSS_SSL_CBC_RANDOM_IV=0 in the environment prior to execution, 143 * and/or by the application setting the option SSL_CBC_RANDOM_IV to PR_FALSE. 144 * 145 * The per-record IV in TLS 1.1 and later adds one block of overhead per 146 * record, whereas this hack will add at least two blocks of overhead per 147 * record, so TLS 1.1+ will always be more efficient. 148 * 149 * Other implementations (e.g. some versions of OpenSSL, in some 150 * configurations) prevent the same attack by prepending an empty 151 * application_data record to every application_data record they send; we do 152 * not do that because some implementations cannot handle empty 153 * application_data records. Also, we only split application_data records and 154 * not other types of records, because some implementations will not accept 155 * fragmented records of some other types (e.g. some versions of NSS do not 156 * accept fragmented alerts). 157 */ 158 #define SSL_CBC_RANDOM_IV 23 159 #define SSL_ENABLE_OCSP_STAPLING 24 /* Request OCSP stapling (client) */ 160 161 /* SSL_ENABLE_NPN is defunct and defaults to false. 162 * Using this option will not have any effect but won't produce an error. */ 163 #define SSL_ENABLE_NPN 25 164 165 /* SSL_ENABLE_ALPN controls whether the ALPN extension is enabled for the 166 * initial handshake when application layer protocol negotiation is used. 167 * SSL_SetNextProtoNego or SSL_SetNextProtoCallback can be used to control 168 * the application layer protocol negotiation; 169 * ALPN is not negotiated for renegotiation handshakes, even though the ALPN 170 * specification defines a way to use ALPN during renegotiations. 171 * SSL_ENABLE_ALPN is currently enabled by default, but this may change in 172 * future versions. 173 */ 174 #define SSL_ENABLE_ALPN 26 175 176 /* SSL_REUSE_SERVER_ECDHE_KEY controls whether the ECDHE server key is 177 * reused for multiple handshakes or generated each time. 178 * SSL_REUSE_SERVER_ECDHE_KEY is currently enabled by default. 179 * This socket option is for ECDHE, only. It is unrelated to DHE. 180 */ 181 #define SSL_REUSE_SERVER_ECDHE_KEY 27 182 183 #define SSL_ENABLE_FALLBACK_SCSV 28 /* Send fallback SCSV in \ 184 * handshakes. */ 185 186 /* SSL_ENABLE_SERVER_DHE controls whether DHE is enabled for the server socket. 187 */ 188 #define SSL_ENABLE_SERVER_DHE 29 189 190 /* Use draft-ietf-tls-session-hash. Controls whether we offer the 191 * extended_master_secret extension which, when accepted, hashes 192 * the handshake transcript into the master secret. This option is 193 * enabled by default. 194 */ 195 #define SSL_ENABLE_EXTENDED_MASTER_SECRET 30 196 197 /* Request Signed Certificate Timestamps via TLS extension (client) */ 198 #define SSL_ENABLE_SIGNED_CERT_TIMESTAMPS 31 199 200 /* Ordinarily, when negotiating a TLS_DHE_* cipher suite the server picks the 201 * group. draft-ietf-tls-negotiated-ff-dhe changes this to use supported_groups 202 * (formerly supported_curves) to signal which pre-defined groups are OK. 203 * 204 * This option causes an NSS client to use this extension and demand that those 205 * groups be used. A client will signal any enabled DHE groups in the 206 * supported_groups extension and reject groups that don't match what it has 207 * enabled. A server will only negotiate TLS_DHE_* cipher suites if the 208 * client includes the extension. 209 * 210 * See SSL_NamedGroupConfig() for how to control which groups are enabled. 211 * 212 * This option cannot be enabled if NSS is not compiled with ECC support. 213 */ 214 #define SSL_REQUIRE_DH_NAMED_GROUPS 32 215 216 /* Allow 0-RTT data (for TLS 1.3). 217 * 218 * When this option is set, the server's session tickets will contain 219 * a flag indicating that it accepts 0-RTT. When resuming such a 220 * session, PR_Write() on the client will be allowed immediately after 221 * starting the handshake and PR_Read() on the server will be allowed 222 * on the server to read that data. Calls to 223 * SSL_GetPreliminaryChannelInfo() and SSL_GetNextProto() 224 * can be made used during this period to learn about the channel 225 * parameters. 226 * 227 * The transition between the 0-RTT and 1-RTT modes is marked by the 228 * handshake callback. However, it is possible to force the completion 229 * of the handshake (and cause the handshake callback to be called) 230 * prior to reading all 0-RTT data using SSL_ForceHandshake(). To 231 * ensure that all early data is read before the handshake callback, any 232 * time that SSL_ForceHandshake() returns a PR_WOULD_BLOCK_ERROR, use 233 * PR_Read() to read all available data. If PR_Read() is called 234 * multiple times, this will result in the handshake completing, but the 235 * handshake callback will occur after early data has all been read. 236 * 237 * WARNING: 0-RTT data has different anti-replay and PFS properties than 238 * the rest of the TLS data. See [draft-ietf-tls-tls13; Section 8] 239 * for more details. 240 * 241 * Note: when DTLS 1.3 is in use, any 0-RTT data received after EndOfEarlyData 242 * (e.g., because of reordering) is discarded. 243 */ 244 #define SSL_ENABLE_0RTT_DATA 33 245 246 /* Sets a limit to the size of encrypted records (see 247 * draft-ietf-tls-record-limit). This is the value that is advertised to peers, 248 * not a limit on the size of records that will be created. Setting this value 249 * reduces the size of records that will be received (not sent). 250 * 251 * This limit applies to the plaintext, but the records that appear on the wire 252 * will be bigger. This doesn't include record headers, IVs, block cipher 253 * padding, and authentication tags or MACs. 254 * 255 * NSS always advertises the record size limit extension. If this option is not 256 * set, the extension will contain the maximum allowed size for the selected TLS 257 * version (currently this is 16384 or 2^14 for TLS 1.2 and lower and 16385 for 258 * TLS 1.3). 259 * 260 * By default, NSS creates records that are the maximum size possible, using all 261 * the data that was written by the application. Writes larger than the maximum 262 * are split into maximum sized records, and any remainder (unless 263 * SSL_CBC_RANDOM_IV is enabled and active). If a peer advertises a record size 264 * limit then that value is used instead. 265 */ 266 #define SSL_RECORD_SIZE_LIMIT 34 267 268 /* Enables TLS 1.3 compatibility mode. In this mode, the client includes a fake 269 * session ID in the handshake and sends a ChangeCipherSpec. A server will 270 * always use the setting chosen by the client, so the value of this option has 271 * no effect for a server. This setting is ignored for DTLS. */ 272 #define SSL_ENABLE_TLS13_COMPAT_MODE 35 273 274 /* Enables the sending of DTLS records using the short (two octet) record 275 * header. Only do this if there are 2^10 or fewer packets in flight at a time; 276 * using this with a larger number of packets in flight could mean that packets 277 * are dropped if there is reordering. 278 * 279 * This applies to TLS 1.3 only. This is not a parameter that is negotiated 280 * during the TLS handshake. Unlike other socket options, this option can be 281 * changed after a handshake is complete. 282 */ 283 #define SSL_ENABLE_DTLS_SHORT_HEADER 36 284 285 /* 286 * Enables the processing of the downgrade sentinel that can be added to the 287 * ServerHello.random by a server that supports Section 4.1.3 of TLS 1.3 288 * [RFC8446]. This sentinel will always be generated by a server that 289 * negotiates a version lower than its maximum, this only controls whether a 290 * client will treat receipt of a value that indicates a downgrade as an error. 291 */ 292 #define SSL_ENABLE_HELLO_DOWNGRADE_CHECK 37 293 294 /* Enables the SSLv2-compatible ClientHello for servers. NSS does not support 295 * SSLv2 and will never send an SSLv2-compatible ClientHello as a client. An 296 * NSS server with this option enabled will accept a ClientHello that is 297 * v2-compatible as defined in Appendix E.1 of RFC 6101. 298 * 299 * This is disabled by default and will be removed in a future version. */ 300 #define SSL_ENABLE_V2_COMPATIBLE_HELLO 38 301 302 /* Enables the post-handshake authentication in TLS 1.3. If it is set 303 * to PR_TRUE, the client will send the "post_handshake_auth" 304 * extension to indicate that it will process CertificateRequest 305 * messages after handshake. 306 * 307 * This option applies only to clients. For a server, the 308 * SSL_SendCertificateRequest can be used to request post-handshake 309 * authentication. 310 */ 311 #define SSL_ENABLE_POST_HANDSHAKE_AUTH 39 312 313 /* Enables the delegated credentials extension (draft-ietf-tls-subcerts). When 314 * enabled, a client that supports TLS 1.3 will indicate willingness to 315 * negotiate a delegated credential (DC). Note that client-delegated credentials 316 * are not currently supported. 317 * 318 * If support is indicated, the peer may use a DC to authenticate itself. The DC 319 * is sent as an extension to the peer's end-entity certificate; the end-entity 320 * certificate is used to verify the DC, which in turn is used to verify the 321 * handshake. DCs effectively extend the certificate chain by one, but only 322 * within the context of TLS. Once issued, DCs can't be revoked; in order to 323 * mitigate the damage in case the secret key is compromised, the DC is only 324 * valid for a short time (days, hours, or even minutes). 325 * 326 * This library implements draft-07 of the protocol spec. 327 */ 328 #define SSL_ENABLE_DELEGATED_CREDENTIALS 40 329 330 /* Causes TLS (>=1.3) to suppress the EndOfEarlyData message in stream mode. 331 * 332 * This is not advisable in general, but the message only exists to delineate 333 * early data in a streamed connection. DTLS does not use this message as a 334 * result. The integration of TLS with QUIC, which uses a record/packet 335 * protection layer that is unreliable, also does not use this message. 336 * 337 * On the server, this requires that SSL_RecordLayerData be used. 338 * EndOfEarlyData is otherwise needed to drive key changes. Additionally, 339 * servers that use this API must check that handshake messages (Certificate, 340 * CertificateVerify, and Finished in particular) are only received in epoch 2 341 * (Handshake). SSL_RecordLayerData will accept these handshake messages if 342 * they are passed as epoch 1 (Early Data) in a single call. 343 * 344 * Using this option will cause connections to fail if early data is attempted 345 * and the peer expects this message. 346 */ 347 #define SSL_SUPPRESS_END_OF_EARLY_DATA 41 348 349 #ifdef SSL_DEPRECATED_FUNCTION 350 /* Old deprecated function names */ 351 SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRIntn on); 352 SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRIntn on); 353 #endif 354 355 /* Set (and get) options for sockets and defaults for newly created sockets. 356 * 357 * While the |val| parameter of these methods is PRIntn, options only support 358 * two values by default: PR_TRUE or PR_FALSE. The documentation of specific 359 * options will explain if other values are permitted. 360 */ 361 SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRIntn val); 362 SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRIntn *val); 363 SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRIntn val); 364 SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRIntn *val); 365 SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle); 366 367 /* SSLNextProtoCallback is called during the handshake for the server, when an 368 * Application-Layer Protocol Negotiation (ALPN) extension has been received 369 * from the client. |protos| and |protosLen| define a buffer which contains the 370 * client's advertisement. 371 * |protoOut| is a buffer provided by the caller, of length 255 (the maximum 372 * allowed by the protocol). On successful return, the protocol to be announced 373 * to the server will be in |protoOut| and its length in |*protoOutLen|. 374 * 375 * The callback must return SECFailure or SECSuccess (not SECWouldBlock). 376 */ 377 typedef SECStatus(PR_CALLBACK *SSLNextProtoCallback)( 378 void *arg, 379 PRFileDesc *fd, 380 const unsigned char *protos, 381 unsigned int protosLen, 382 unsigned char *protoOut, 383 unsigned int *protoOutLen, 384 unsigned int protoMaxOut); 385 386 /* SSL_SetNextProtoCallback sets a callback function to handle ALPN Negotiation. 387 * It causes a client to advertise ALPN. */ 388 SSL_IMPORT SECStatus SSL_SetNextProtoCallback(PRFileDesc *fd, 389 SSLNextProtoCallback callback, 390 void *arg); 391 392 /* SSL_SetNextProtoNego can be used as an alternative to 393 * SSL_SetNextProtoCallback. 394 * 395 * Using this function allows client and server to transparently support ALPN. 396 * The same set of protocols will be advertised via ALPN and, if the server 397 * uses ALPN to select a protocol, SSL_GetNextProto will return 398 * SSL_NEXT_PROTO_SELECTED as the state. 399 * 400 * Because the predecessor to ALPN, NPN, used the first protocol as the fallback 401 * protocol, when sending an ALPN extension, the first protocol is moved to the 402 * end of the list. This indicates that the fallback protocol is the least 403 * preferred. The other protocols should be in preference order. 404 * 405 * The supported protocols are specified in |data| in wire-format (8-bit 406 * length-prefixed). For example: "\010http/1.1\006spdy/2". 407 * 408 * An empty value (i.e., where |length| is 0 and |data| is any value, 409 * including NULL) forcibly disables ALPN. In this mode, the server will 410 * reject any ClientHello that includes the ALPN extension. 411 * 412 * Calling this function overrides the callback previously set by 413 * SSL_SetNextProtoCallback. */ 414 SSL_IMPORT SECStatus SSL_SetNextProtoNego(PRFileDesc *fd, 415 const unsigned char *data, 416 unsigned int length); 417 418 typedef enum SSLNextProtoState { 419 SSL_NEXT_PROTO_NO_SUPPORT = 0, /* No peer support */ 420 SSL_NEXT_PROTO_NEGOTIATED = 1, /* Mutual agreement */ 421 SSL_NEXT_PROTO_NO_OVERLAP = 2, /* No protocol overlap found */ 422 SSL_NEXT_PROTO_SELECTED = 3, /* Server selected proto (ALPN) */ 423 SSL_NEXT_PROTO_EARLY_VALUE = 4 /* We are in 0-RTT using this value. */ 424 } SSLNextProtoState; 425 426 /* SSL_GetNextProto can be used in the HandshakeCallback or any time after 427 * a handshake to retrieve the result of the Next Protocol negotiation. 428 * 429 * The length of the negotiated protocol, if any, is written into *bufLen. 430 * If the negotiated protocol is longer than bufLenMax, then SECFailure is 431 * returned. Otherwise, the negotiated protocol, if any, is written into buf, 432 * and SECSuccess is returned. */ 433 SSL_IMPORT SECStatus SSL_GetNextProto(PRFileDesc *fd, 434 SSLNextProtoState *state, 435 unsigned char *buf, 436 unsigned int *bufLen, 437 unsigned int bufLenMax); 438 439 /* 440 ** Control ciphers that SSL uses. If on is non-zero then the named cipher 441 ** is enabled, otherwise it is disabled. 442 ** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). 443 ** EnableCipher records user preferences. 444 ** SetPolicy sets the policy according to the policy module. 445 */ 446 #ifdef SSL_DEPRECATED_FUNCTION 447 /* Old deprecated function names */ 448 SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); 449 SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); 450 #endif 451 452 /* New function names */ 453 SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled); 454 SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled); 455 SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); 456 SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); 457 SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); 458 SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); 459 460 /* 461 ** Control for TLS signature schemes for TLS 1.2 and 1.3. 462 ** 463 ** This governs what signature schemes (or algorithms) are sent by a client in 464 ** the signature_algorithms extension. A client will not accept a signature 465 ** from a server unless it uses an enabled algorithm. 466 ** 467 ** This also governs what the server sends in the supported_signature_algorithms 468 ** field of a CertificateRequest. 469 ** 470 ** This changes what the server uses to sign ServerKeyExchange and 471 ** CertificateVerify messages. An endpoint uses the first entry from this list 472 ** that is compatible with both its certificate and its peer's supported 473 ** values. 474 ** 475 ** This configuration affects TLS 1.2, but the combination of EC group and hash 476 ** algorithm is interpreted loosely to be compatible with other implementations. 477 ** For TLS 1.2, NSS will ignore the curve group when generating or verifying 478 ** ECDSA signatures. For example, a P-384 ECDSA certificate is used with 479 ** SHA-256 if ssl_sig_ecdsa_secp256r1_sha256 is enabled. 480 ** 481 ** Omitting SHA-256 schemes from this list might be foolish. Support is 482 ** mandatory in TLS 1.2 and 1.3 and there might be interoperability issues. 483 */ 484 SSL_IMPORT SECStatus SSL_SignatureSchemePrefSet( 485 PRFileDesc *fd, const SSLSignatureScheme *schemes, unsigned int count); 486 487 /* Deprecated, use SSL_SignatureSchemePrefSet() instead. */ 488 SSL_IMPORT SECStatus SSL_SignaturePrefSet( 489 PRFileDesc *fd, const SSLSignatureAndHashAlg *algorithms, 490 unsigned int count); 491 492 /* 493 ** Get the currently configured signature schemes. 494 ** 495 ** The schemes are written to |schemes| but not if there are more than 496 ** |maxCount| values configured. The number of schemes that are in use are 497 ** written to |count|. This fails if |maxCount| is insufficiently large. 498 */ 499 SSL_IMPORT SECStatus SSL_SignatureSchemePrefGet( 500 PRFileDesc *fd, SSLSignatureScheme *algorithms, unsigned int *count, 501 unsigned int maxCount); 502 503 /* Deprecated, use SSL_SignatureSchemePrefGet() instead. */ 504 SSL_IMPORT SECStatus SSL_SignaturePrefGet( 505 PRFileDesc *fd, SSLSignatureAndHashAlg *algorithms, unsigned int *count, 506 unsigned int maxCount); 507 508 /* 509 ** Returns the maximum number of signature algorithms that are supported and 510 ** can be set or retrieved using SSL_SignatureSchemePrefSet or 511 ** SSL_SignatureSchemePrefGet. 512 */ 513 SSL_IMPORT unsigned int SSL_SignatureMaxCount(void); 514 515 /* 516 ** Define custom priorities for EC and FF groups used in DH key exchange and EC 517 ** groups for ECDSA. This only changes the order of enabled lists (and thus 518 ** their priorities) and enables all groups in |groups| while disabling all other 519 ** groups. 520 */ 521 SSL_IMPORT SECStatus SSL_NamedGroupConfig(PRFileDesc *fd, 522 const SSLNamedGroup *groups, 523 unsigned int num_groups); 524 525 /* 526 ** Configure the socket to configure additional key shares. Normally when a TLS 527 ** 1.3 ClientHello is sent, just one key share is included using the first 528 ** preference group (as set by SSL_NamedGroupConfig). If the server decides to 529 ** pick a different group for key exchange, it is forced to send a 530 ** HelloRetryRequest, which adds an entire round trip of latency. 531 ** 532 ** This function can be used to configure libssl to generate additional key 533 ** shares when sending a TLS 1.3 ClientHello. If |count| is set to a non-zero 534 ** value, then additional key shares are generated. Shares are added in the 535 ** preference order set in SSL_NamedGroupConfig. |count| can be set to any 536 ** value; NSS limits the number of shares to the number of supported groups. 537 */ 538 SSL_IMPORT SECStatus SSL_SendAdditionalKeyShares(PRFileDesc *fd, 539 unsigned int count); 540 541 /* Deprecated: use SSL_NamedGroupConfig() instead. 542 ** SSL_DHEGroupPrefSet is used to configure the set of allowed/enabled DHE group 543 ** parameters that can be used by NSS for the given server socket. 544 ** The first item in the array is used as the default group, if no other 545 ** selection criteria can be used by NSS. 546 ** The set is provided as an array of identifiers as defined by SSLDHEGroupType. 547 ** If more than one group identifier is provided, NSS will select the one to use. 548 ** For example, a TLS extension sent by the client might indicate a preference. 549 */ 550 SSL_IMPORT SECStatus SSL_DHEGroupPrefSet(PRFileDesc *fd, 551 const SSLDHEGroupType *groups, 552 PRUint16 num_groups); 553 554 /* Enable the use of a DHE group that's smaller than the library default, 555 ** for backwards compatibility reasons. The DH parameters will be created 556 ** at the time this function is called, which might take a very long time. 557 ** The function will block until generation is completed. 558 ** The intention is to enforce that fresh and safe parameters are generated 559 ** each time a process is started. 560 ** At the time this API was initially implemented, the API will enable the 561 ** use of 1024 bit DHE parameters. This value might get increased in future 562 ** versions of NSS. 563 ** 564 ** It is allowed to call this API will a NULL value for parameter fd, 565 ** which will prepare the global parameters that NSS will reuse for the remainder 566 ** of the process lifetime. This can be used early after startup of a process, 567 ** to avoid a delay when handling incoming client connections. 568 ** This preparation with a NULL for parameter fd will NOT enable the weak group 569 ** on sockets. The function needs to be called again for every socket that 570 ** should use the weak group. 571 ** 572 ** It is allowed to use this API in combination with the SSL_NamedGroupConfig API. 573 ** If both APIs have been called, the weakest group will be used, unless it is 574 ** certain that the client supports larger group parameters. The weak group will 575 ** be used as the default group for TLS <= 1.2, overriding the preference for 576 ** the first group potentially set with a call to SSL_NamedGroupConfig. 577 */ 578 SSL_IMPORT SECStatus SSL_EnableWeakDHEPrimeGroup(PRFileDesc *fd, PRBool enabled); 579 580 /* SSL Version Range API 581 ** 582 ** This API should be used to control SSL 3.0 & TLS support instead of the 583 ** older SSL_Option* API; however, the SSL_Option* API MUST still be used to 584 ** control SSL 2.0 support. In this version of libssl, SSL 3.0 and TLS 1.0 are 585 ** enabled by default. Future versions of libssl may change which versions of 586 ** the protocol are enabled by default. 587 ** 588 ** The SSLProtocolVariant enum indicates whether the protocol is of type 589 ** stream or datagram. This must be provided to the functions that do not 590 ** take an fd. Functions which take an fd will get the variant from the fd, 591 ** which is typed. 592 ** 593 ** Using the new version range API in conjunction with the older 594 ** SSL_OptionSet-based API for controlling the enabled protocol versions may 595 ** cause unexpected results. Going forward, we guarantee only the following: 596 ** 597 ** SSL_OptionGet(SSL_ENABLE_TLS) will return PR_TRUE if *ANY* versions of TLS 598 ** are enabled. 599 ** 600 ** SSL_OptionSet(SSL_ENABLE_TLS, PR_FALSE) will disable *ALL* versions of TLS, 601 ** including TLS 1.0 and later. 602 ** 603 ** The above two properties provide compatibility for applications that use 604 ** SSL_OptionSet to implement the insecure fallback from TLS 1.x to SSL 3.0. 605 ** 606 ** SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) will enable TLS 1.0, and may also 607 ** enable some later versions of TLS, if it is necessary to do so in order to 608 ** keep the set of enabled versions contiguous. For example, if TLS 1.2 is 609 ** enabled, then after SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE), TLS 1.0, 610 ** TLS 1.1, and TLS 1.2 will be enabled, and the call will have no effect on 611 ** whether SSL 3.0 is enabled. If no later versions of TLS are enabled at the 612 ** time SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) is called, then no later 613 ** versions of TLS will be enabled by the call. 614 ** 615 ** SSL_OptionSet(SSL_ENABLE_SSL3, PR_FALSE) will disable SSL 3.0, and will not 616 ** change the set of TLS versions that are enabled. 617 ** 618 ** SSL_OptionSet(SSL_ENABLE_SSL3, PR_TRUE) will enable SSL 3.0, and may also 619 ** enable some versions of TLS if TLS 1.1 or later is enabled at the time of 620 ** the call, the same way SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) works, in 621 ** order to keep the set of enabled versions contiguous. 622 */ 623 624 /* Returns, in |*vrange|, the range of SSL3/TLS versions supported for the 625 ** given protocol variant by the version of libssl linked-to at runtime. 626 */ 627 SSL_IMPORT SECStatus SSL_VersionRangeGetSupported( 628 SSLProtocolVariant protocolVariant, SSLVersionRange *vrange); 629 630 /* Returns, in |*vrange|, the range of SSL3/TLS versions enabled by default 631 ** for the given protocol variant. 632 */ 633 SSL_IMPORT SECStatus SSL_VersionRangeGetDefault( 634 SSLProtocolVariant protocolVariant, SSLVersionRange *vrange); 635 636 /* Sets the range of enabled-by-default SSL3/TLS versions for the given 637 ** protocol variant to |*vrange|. 638 */ 639 SSL_IMPORT SECStatus SSL_VersionRangeSetDefault( 640 SSLProtocolVariant protocolVariant, const SSLVersionRange *vrange); 641 642 /* Returns, in |*vrange|, the range of enabled SSL3/TLS versions for |fd|. */ 643 SSL_IMPORT SECStatus SSL_VersionRangeGet(PRFileDesc *fd, 644 SSLVersionRange *vrange); 645 646 /* Sets the range of enabled SSL3/TLS versions for |fd| to |*vrange|. */ 647 SSL_IMPORT SECStatus SSL_VersionRangeSet(PRFileDesc *fd, 648 const SSLVersionRange *vrange); 649 650 /* Sets the version to check the server random against for the 651 * fallback check defined in [draft-ietf-tls-tls13-11 Section 6.3.1.1]. 652 * This function is provided to allow for detection of forced downgrade 653 * attacks against client-side reconnect-and-fallback outside of TLS 654 * by setting |version| to be that of the original connection, rather 655 * than that of the new connection. 656 * 657 * The default, which can also be enabled by setting |version| to 658 * zero, is just to check against the max version in the 659 * version range (see SSL_VersionRangeSet). */ 660 SSL_IMPORT SECStatus SSL_SetDowngradeCheckVersion(PRFileDesc *fd, 661 PRUint16 version); 662 663 /* Values for "policy" argument to SSL_CipherPolicySet */ 664 /* Values returned by SSL_CipherPolicyGet. */ 665 #define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ 666 #define SSL_ALLOWED 1 667 #define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ 668 669 /* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ 670 #define SSL_REQUIRE_NEVER ((PRBool)0) 671 #define SSL_REQUIRE_ALWAYS ((PRBool)1) 672 #define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) 673 #define SSL_REQUIRE_NO_ERROR ((PRBool)3) 674 675 /* Values for "on" with SSL_ENABLE_RENEGOTIATION */ 676 /* Never renegotiate at all. */ 677 #define SSL_RENEGOTIATE_NEVER ((PRBool)0) 678 /* Renegotiate without restriction, whether or not the peer's client hello */ 679 /* bears the renegotiation info extension. Vulnerable, as in the past. */ 680 #define SSL_RENEGOTIATE_UNRESTRICTED ((PRBool)1) 681 /* Only renegotiate if the peer's hello bears the TLS renegotiation_info */ 682 /* extension. This is safe renegotiation. */ 683 #define SSL_RENEGOTIATE_REQUIRES_XTN ((PRBool)2) 684 /* Disallow unsafe renegotiation in server sockets only, but allow clients */ 685 /* to continue to renegotiate with vulnerable servers. */ 686 /* This value should only be used during the transition period when few */ 687 /* servers have been upgraded. */ 688 #define SSL_RENEGOTIATE_TRANSITIONAL ((PRBool)3) 689 690 /* 691 ** Reset the handshake state for fd. This will make the complete SSL 692 ** handshake protocol execute from the ground up on the next i/o 693 ** operation. 694 */ 695 SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); 696 697 /* 698 ** Force the handshake for fd to complete immediately. This blocks until 699 ** the complete SSL handshake protocol is finished. 700 */ 701 SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); 702 703 /* 704 ** Same as above, but with an I/O timeout. 705 */ 706 SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, 707 PRIntervalTime timeout); 708 709 /* 710 ** Query security status of socket. *on is set to one if security is 711 ** enabled. *keySize will contain the stream key size used. *issuer will 712 ** contain the RFC1485 verison of the name of the issuer of the 713 ** certificate at the other end of the connection. For a client, this is 714 ** the issuer of the server's certificate; for a server, this is the 715 ** issuer of the client's certificate (if any). Subject is the subject of 716 ** the other end's certificate. The pointers can be zero if the desired 717 ** data is not needed. All strings returned by this function are owned 718 ** by the caller, and need to be freed with PORT_Free. 719 */ 720 SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, 721 int *keySize, int *secretKeySize, 722 char **issuer, char **subject); 723 724 /* Values for "on" */ 725 #define SSL_SECURITY_STATUS_NOOPT -1 726 #define SSL_SECURITY_STATUS_OFF 0 727 #define SSL_SECURITY_STATUS_ON_HIGH 1 728 #define SSL_SECURITY_STATUS_ON_LOW 2 729 #define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ 730 731 /* 732 ** Return the certificate for our SSL peer. If the client calls this 733 ** it will always return the server's certificate. If the server calls 734 ** this, it may return NULL if client authentication is not enabled or 735 ** if the client had no certificate when asked. 736 ** "fd" the socket "file" descriptor 737 */ 738 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); 739 740 /* 741 ** Return the certificates presented by the SSL peer. If the SSL peer 742 ** did not present certificates, return NULL with the 743 ** SSL_ERROR_NO_CERTIFICATE error. On failure, return NULL with an error 744 ** code other than SSL_ERROR_NO_CERTIFICATE. 745 ** "fd" the socket "file" descriptor 746 */ 747 SSL_IMPORT CERTCertList *SSL_PeerCertificateChain(PRFileDesc *fd); 748 749 /* SSL_PeerStapledOCSPResponses returns the OCSP responses that were provided 750 * by the TLS server. The return value is a pointer to an internal SECItemArray 751 * that contains the returned OCSP responses; it is only valid until the 752 * callback function that calls SSL_PeerStapledOCSPResponses returns. 753 * 754 * If no OCSP responses were given by the server then the result will be empty. 755 * If there was an error, then the result will be NULL. 756 * 757 * You must set the SSL_ENABLE_OCSP_STAPLING option to enable OCSP stapling. 758 * to be provided by a server. 759 * 760 * libssl does not do any validation of the OCSP response itself; the 761 * authenticate certificate hook is responsible for doing so. The default 762 * authenticate certificate hook, SSL_AuthCertificate, does not implement 763 * any OCSP stapling funtionality, but this may change in future versions. 764 */ 765 SSL_IMPORT const SECItemArray *SSL_PeerStapledOCSPResponses(PRFileDesc *fd); 766 767 /* SSL_PeerSignedCertTimestamps returns the signed_certificate_timestamp 768 * extension data provided by the TLS server. The return value is a pointer 769 * to an internal SECItem that contains the returned response (as a serialized 770 * SignedCertificateTimestampList, see RFC 6962). The returned pointer is only 771 * valid until the callback function that calls SSL_PeerSignedCertTimestamps 772 * (e.g. the authenticate certificate hook, or the handshake callback) returns. 773 * 774 * If no Signed Certificate Timestamps were given by the server then the result 775 * will be empty. If there was an error, then the result will be NULL. 776 * 777 * You must set the SSL_ENABLE_SIGNED_CERT_TIMESTAMPS option to indicate support 778 * for Signed Certificate Timestamps to a server. 779 * 780 * libssl does not do any parsing or validation of the response itself. 781 */ 782 SSL_IMPORT const SECItem *SSL_PeerSignedCertTimestamps(PRFileDesc *fd); 783 784 /* SSL_SetStapledOCSPResponses stores an array of one or multiple OCSP responses 785 * in the fd's data, which may be sent as part of a server side cert_status 786 * handshake message. Parameter |responses| is for the server certificate of 787 * the key exchange type |kea|. 788 * The function will duplicate the responses array. 789 * 790 * Deprecated: see SSL_ConfigSecureServer for details. 791 */ 792 SSL_IMPORT SECStatus 793 SSL_SetStapledOCSPResponses(PRFileDesc *fd, const SECItemArray *responses, 794 SSLKEAType kea); 795 796 /* 797 * SSL_SetSignedCertTimestamps stores serialized signed_certificate_timestamp 798 * extension data in the fd. The signed_certificate_timestamp data is sent 799 * during the handshake (if requested by the client). Parameter |scts| 800 * is for the server certificate of the key exchange type |kea|. 801 * The function will duplicate the provided data item. To clear previously 802 * set data for a given key exchange type |kea|, pass NULL to |scts|. 803 * 804 * Deprecated: see SSL_ConfigSecureServer for details. 805 */ 806 SSL_IMPORT SECStatus 807 SSL_SetSignedCertTimestamps(PRFileDesc *fd, const SECItem *scts, 808 SSLKEAType kea); 809 810 /* 811 ** Authenticate certificate hook. Called when a certificate comes in 812 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the 813 ** certificate. 814 ** 815 ** The authenticate certificate hook must return SECSuccess to indicate the 816 ** certificate is valid, SECFailure to indicate the certificate is invalid, 817 ** or SECWouldBlock if the application will authenticate the certificate 818 ** asynchronously. SECWouldBlock is only supported for non-blocking sockets. 819 ** 820 ** If the authenticate certificate hook returns SECFailure, then the bad cert 821 ** hook will be called. The bad cert handler is NEVER called if the 822 ** authenticate certificate hook returns SECWouldBlock. If the application 823 ** needs to handle and/or override a bad cert, it should do so before it 824 ** calls SSL_AuthCertificateComplete (modifying the error it passes to 825 ** SSL_AuthCertificateComplete as needed). 826 ** 827 ** See the documentation for SSL_AuthCertificateComplete for more information 828 ** about the asynchronous behavior that occurs when the authenticate 829 ** certificate hook returns SECWouldBlock. 830 ** 831 ** RFC 6066 says that clients should send the bad_certificate_status_response 832 ** alert when they encounter an error processing the stapled OCSP response. 833 ** libssl does not provide a way for the authenticate certificate hook to 834 ** indicate that an OCSP error (SEC_ERROR_OCSP_*) that it returns is an error 835 ** in the stapled OCSP response or an error in some other OCSP response. 836 ** Further, NSS does not provide a convenient way to control or determine 837 ** which OCSP response(s) were used to validate a certificate chain. 838 ** Consequently, the current version of libssl does not ever send the 839 ** bad_certificate_status_response alert. This may change in future releases. 840 */ 841 typedef SECStatus(PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, 842 PRBool checkSig, 843 PRBool isServer); 844 845 SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, 846 SSLAuthCertificate f, 847 void *arg); 848 849 /* An implementation of the certificate authentication hook */ 850 SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, 851 PRBool checkSig, PRBool isServer); 852 853 /* 854 * Prototype for SSL callback to get client auth data from the application. 855 * arg - application passed argument 856 * caNames - pointer to distinguished names of CAs that the server likes 857 * pRetCert - pointer to pointer to cert, for return of cert 858 * pRetKey - pointer to key pointer, for return of key 859 */ 860 typedef SECStatus(PR_CALLBACK *SSLGetClientAuthData)(void *arg, 861 PRFileDesc *fd, 862 CERTDistNames *caNames, 863 CERTCertificate **pRetCert, /*return */ 864 SECKEYPrivateKey **pRetKey); /* return */ 865 866 /* 867 * Set the client side callback for SSL to retrieve user's private key 868 * and certificate. 869 * fd - the file descriptor for the connection in question 870 * f - the application's callback that delivers the key and cert 871 * a - application specific data 872 */ 873 SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, 874 SSLGetClientAuthData f, void *a); 875 876 /* 877 ** SNI extension processing callback function. 878 ** It is called when SSL socket receives SNI extension in ClientHello message. 879 ** Upon this callback invocation, application is responsible to reconfigure the 880 ** socket with the data for a particular server name. 881 ** There are three potential outcomes of this function invocation: 882 ** * application does not recognize the name or the type and wants the 883 ** "unrecognized_name" alert be sent to the client. In this case the callback 884 ** function must return SSL_SNI_SEND_ALERT status. 885 ** * application does not recognize the name, but wants to continue with 886 ** the handshake using the current socket configuration. In this case, 887 ** no socket reconfiguration is needed and the function should return 888 ** SSL_SNI_CURRENT_CONFIG_IS_USED. 889 ** * application recognizes the name and reconfigures the socket with 890 ** appropriate certs, key, etc. There are many ways to reconfigure. NSS 891 ** provides SSL_ReconfigFD function that can be used to update the socket 892 ** data from model socket. To continue with the rest of the handshake, the 893 ** implementation function should return an index of a name it has chosen. 894 ** LibSSL will ignore any SNI extension received in a ClientHello message 895 ** if application does not register a SSLSNISocketConfig callback. 896 ** Each type field of SECItem indicates the name type. 897 ** NOTE: currently RFC3546 defines only one name type: sni_host_name. 898 ** Client is allowed to send only one name per known type. LibSSL will 899 ** send an "unrecognized_name" alert if SNI extension name list contains more 900 ** then one name of a type. 901 */ 902 typedef PRInt32(PR_CALLBACK *SSLSNISocketConfig)(PRFileDesc *fd, 903 const SECItem *srvNameArr, 904 PRUint32 srvNameArrSize, 905 void *arg); 906 907 /* 908 ** SSLSNISocketConfig should return an index within 0 and srvNameArrSize-1 909 ** when it has reconfigured the socket fd to use certs and keys, etc 910 ** for a specific name. There are two other allowed return values. One 911 ** tells libSSL to use the default cert and key. The other tells libSSL 912 ** to send the "unrecognized_name" alert. These values are: 913 **/ 914 #define SSL_SNI_CURRENT_CONFIG_IS_USED -1 915 #define SSL_SNI_SEND_ALERT -2 916 917 /* 918 ** Set application implemented SNISocketConfig callback. 919 */ 920 SSL_IMPORT SECStatus SSL_SNISocketConfigHook(PRFileDesc *fd, 921 SSLSNISocketConfig f, 922 void *arg); 923 924 /* 925 ** Reconfigure fd SSL socket with model socket parameters. Sets 926 ** server certs and keys, list of trust anchor, socket options 927 ** and all SSL socket call backs and parameters. 928 */ 929 SSL_IMPORT PRFileDesc *SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd); 930 931 /* 932 * Set the client side argument for SSL to retrieve PKCS #11 pin. 933 * fd - the file descriptor for the connection in question 934 * a - pkcs11 application specific data 935 */ 936 SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); 937 938 /* 939 ** These are callbacks for dealing with SSL alerts. 940 */ 941 942 typedef PRUint8 SSLAlertLevel; 943 typedef PRUint8 SSLAlertDescription; 944 945 typedef struct { 946 SSLAlertLevel level; 947 SSLAlertDescription description; 948 } SSLAlert; 949 950 typedef void(PR_CALLBACK *SSLAlertCallback)(const PRFileDesc *fd, void *arg, 951 const SSLAlert *alert); 952 953 SSL_IMPORT SECStatus SSL_AlertReceivedCallback(PRFileDesc *fd, SSLAlertCallback cb, 954 void *arg); 955 SSL_IMPORT SECStatus SSL_AlertSentCallback(PRFileDesc *fd, SSLAlertCallback cb, 956 void *arg); 957 /* 958 ** This is a callback for dealing with server certs that are not authenticated 959 ** by the client. The client app can decide that it actually likes the 960 ** cert by some external means and restart the connection. 961 ** 962 ** The bad cert hook must return SECSuccess to override the result of the 963 ** authenticate certificate hook, SECFailure if the certificate should still be 964 ** considered invalid, or SECWouldBlock if the application will authenticate 965 ** the certificate asynchronously. SECWouldBlock is only supported for 966 ** non-blocking sockets. 967 ** 968 ** See the documentation for SSL_AuthCertificateComplete for more information 969 ** about the asynchronous behavior that occurs when the bad cert hook returns 970 ** SECWouldBlock. 971 */ 972 typedef SECStatus(PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); 973 SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, 974 void *arg); 975 976 /* 977 ** Configure SSL socket for running a secure server. Needs the 978 ** certificate for the server and the servers private key. The arguments 979 ** are copied. 980 ** 981 ** This method should be used in preference to SSL_ConfigSecureServer, 982 ** SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses, and 983 ** SSL_SetSignedCertTimestamps. 984 ** 985 ** The authentication method is determined from the certificate and private key 986 ** based on how libssl authenticates peers. Primarily, this uses the value of 987 ** the SSLAuthType enum and is derived from the type of public key in the 988 ** certificate. For example, different RSA certificates might be saved for 989 ** signing (ssl_auth_rsa_sign) and key encipherment 990 ** (ssl_auth_rsa_decrypt). Unique to RSA, the same certificate can be used for 991 ** both usages. Additional information about the authentication method is also 992 ** used: EC keys with different curves are separately stored. 993 ** 994 ** Only one certificate is stored for each authentication method. 995 ** 996 ** The optional |data| argument contains additional information about the 997 ** certificate: 998 ** 999 ** - |authType| (with a value other than ssl_auth_null) limits the 1000 ** authentication method; this is primarily useful in limiting the use of an 1001 ** RSA certificate to one particular key usage (either signing or key 1002 ** encipherment) when its key usages indicate support for both. 1003 ** 1004 ** - |certChain| provides an explicit certificate chain, rather than relying on 1005 ** NSS functions for finding a certificate chain. 1006 ** 1007 ** - |stapledOCSPResponses| provides a response for OCSP stapling. 1008 ** 1009 ** - |signedCertTimestamps| provides a value for the 1010 ** signed_certificate_timestamp extension used in certificate transparency. 1011 ** 1012 ** The |data_len| argument provides the length of the data. This should be set 1013 ** to |sizeof(data)|. 1014 ** 1015 ** This function allows an application to provide certificates with narrow key 1016 ** usages attached to them. For instance, RSA keys can be provided that are 1017 ** limited to signing or decryption only. Multiple EC certificates with keys on 1018 ** different named curves can be provided. 1019 ** 1020 ** Unlike SSL_ConfigSecureServer(WithCertChain), this function does not accept 1021 ** NULL for the |cert| and |key| arguments. It will replace certificates that 1022 ** have the same type, but it cannot be used to remove certificates that have 1023 ** already been configured. 1024 */ 1025 SSL_IMPORT SECStatus SSL_ConfigServerCert( 1026 PRFileDesc *fd, CERTCertificate *cert, SECKEYPrivateKey *key, 1027 const SSLExtraServerCertData *data, unsigned int data_len); 1028 1029 /* 1030 ** Deprecated variant of SSL_ConfigServerCert. 1031 ** 1032 ** This uses values from the SSLKEAType to identify the type of |key| that the 1033 ** |cert| contains. This is incorrect, since key exchange and authentication 1034 ** are separated in some cipher suites (in particular, ECDHE_RSA_* suites). 1035 ** 1036 ** Providing a |kea| parameter of ssl_kea_ecdh (or kt_ecdh) is interpreted as 1037 ** providing both ECDH and ECDSA certificates. 1038 */ 1039 SSL_IMPORT SECStatus SSL_ConfigSecureServer( 1040 PRFileDesc *fd, CERTCertificate *cert, 1041 SECKEYPrivateKey *key, SSLKEAType kea); 1042 1043 /* 1044 ** Deprecated variant of SSL_ConfigSecureServerCert. The |data| argument to 1045 ** SSL_ConfigSecureServerCert can be used to pass a certificate chain. 1046 */ 1047 SSL_IMPORT SECStatus 1048 SSL_ConfigSecureServerWithCertChain(PRFileDesc *fd, CERTCertificate *cert, 1049 const CERTCertificateList *certChainOpt, 1050 SECKEYPrivateKey *key, SSLKEAType kea); 1051 1052 /* 1053 ** SSL_SetSessionTicketKeyPair configures an asymmetric key pair for use in 1054 ** wrapping session ticket keys, used by the server. This function currently 1055 ** only accepts an RSA public/private key pair. 1056 ** 1057 ** Prior to the existence of this function, NSS used an RSA private key 1058 ** associated with a configured certificate to perform session ticket 1059 ** encryption. If this function isn't used, the keys provided with a configured 1060 ** RSA certificate are used for wrapping session ticket keys. 1061 ** 1062 ** NOTE: This key is used for all self-encryption but is named for 1063 ** session tickets for historical reasons. 1064 */ 1065 SSL_IMPORT SECStatus 1066 SSL_SetSessionTicketKeyPair(SECKEYPublicKey *pubKey, SECKEYPrivateKey *privKey); 1067 1068 /* 1069 ** Configure a secure server's session-id cache. Define the maximum number 1070 ** of entries in the cache, the longevity of the entires, and the directory 1071 ** where the cache files will be placed. These values can be zero, and 1072 ** if so, the implementation will choose defaults. 1073 ** This version of the function is for use in applications that have only one 1074 ** process that uses the cache (even if that process has multiple threads). 1075 */ 1076 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, 1077 PRUint32 timeout, 1078 PRUint32 ssl3_timeout, 1079 const char *directory); 1080 1081 /* Configure a secure server's session-id cache. Depends on value of 1082 * enableMPCache, configures malti-proc or single proc cache. */ 1083 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCacheWithOpt( 1084 PRUint32 timeout, 1085 PRUint32 ssl3_timeout, 1086 const char *directory, 1087 int maxCacheEntries, 1088 int maxCertCacheEntries, 1089 int maxSrvNameCacheEntries, 1090 PRBool enableMPCache); 1091 1092 /* 1093 ** Like SSL_ConfigServerSessionIDCache, with one important difference. 1094 ** If the application will run multiple processes (as opposed to, or in 1095 ** addition to multiple threads), then it must call this function, instead 1096 ** of calling SSL_ConfigServerSessionIDCache(). 1097 ** This has nothing to do with the number of processORs, only processEs. 1098 ** This function sets up a Server Session ID (SID) cache that is safe for 1099 ** access by multiple processes on the same system. 1100 */ 1101 SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, 1102 PRUint32 timeout, 1103 PRUint32 ssl3_timeout, 1104 const char *directory); 1105 1106 /* Get and set the configured maximum number of mutexes used for the 1107 ** server's store of SSL sessions. This value is used by the server 1108 ** session ID cache initialization functions shown above. Note that on 1109 ** some platforms, these mutexes are actually implemented with POSIX 1110 ** semaphores, or with unnamed pipes. The default value varies by platform. 1111 ** An attempt to set a too-low maximum will return an error and the 1112 ** configured value will not be changed. 1113 */ 1114 SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); 1115 SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); 1116 1117 /* environment variable set by SSL_ConfigMPServerSIDCache, and queried by 1118 * SSL_InheritMPServerSIDCache when envString is NULL. 1119 */ 1120 #define SSL_ENV_VAR_NAME "SSL_INHERITANCE" 1121 1122 /* called in child to inherit SID Cache variables. 1123 * If envString is NULL, this function will use the value of the environment 1124 * variable "SSL_INHERITANCE", otherwise the string value passed in will be 1125 * used. 1126 */ 1127 SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char *envString); 1128 1129 /* 1130 ** Set the callback that gets called when a TLS handshake is complete. The 1131 ** handshake callback is called after verifying the peer's Finished message and 1132 ** before processing incoming application data. 1133 ** 1134 ** For the initial handshake: If the handshake false started (see 1135 ** SSL_ENABLE_FALSE_START), then application data may already have been sent 1136 ** before the handshake callback is called. If we did not false start then the 1137 ** callback will get called before any application data is sent. 1138 */ 1139 typedef void(PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, 1140 void *client_data); 1141 SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 1142 SSLHandshakeCallback cb, void *client_data); 1143 1144 /* Applications that wish to enable TLS false start must set this callback 1145 ** function. NSS will invoke the functon to determine if a particular 1146 ** connection should use false start or not. SECSuccess indicates that the 1147 ** callback completed successfully, and if so *canFalseStart indicates if false 1148 ** start can be used. If the callback does not return SECSuccess then the 1149 ** handshake will be canceled. NSS's recommended criteria can be evaluated by 1150 ** calling SSL_RecommendedCanFalseStart. 1151 ** 1152 ** If no false start callback is registered then false start will never be 1153 ** done, even if the SSL_ENABLE_FALSE_START option is enabled. 1154 **/ 1155 typedef SECStatus(PR_CALLBACK *SSLCanFalseStartCallback)( 1156 PRFileDesc *fd, void *arg, PRBool *canFalseStart); 1157 1158 SSL_IMPORT SECStatus SSL_SetCanFalseStartCallback( 1159 PRFileDesc *fd, SSLCanFalseStartCallback callback, void *arg); 1160 1161 /* This function sets *canFalseStart according to the recommended criteria for 1162 ** false start. These criteria may change from release to release and may depend 1163 ** on which handshake features have been negotiated and/or properties of the 1164 ** certifciates/keys used on the connection. 1165 */ 1166 SSL_IMPORT SECStatus SSL_RecommendedCanFalseStart(PRFileDesc *fd, 1167 PRBool *canFalseStart); 1168 1169 /* 1170 ** For the server, request a new handshake. For the client, begin a new 1171 ** handshake. If flushCache is non-zero, the SSL3 cache entry will be 1172 ** flushed first, ensuring that a full SSL handshake will be done. 1173 ** If flushCache is zero, and an SSL connection is established, it will 1174 ** do the much faster session restart handshake. This will change the 1175 ** session keys without doing another private key operation. 1176 */ 1177 SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); 1178 1179 /* 1180 ** Same as above, but with an I/O timeout. 1181 */ 1182 SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, 1183 PRBool flushCache, 1184 PRIntervalTime timeout); 1185 1186 #ifdef SSL_DEPRECATED_FUNCTION 1187 /* deprecated! 1188 ** For the server, request a new handshake. For the client, begin a new 1189 ** handshake. Flushes SSL3 session cache entry first, ensuring that a 1190 ** full handshake will be done. 1191 ** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) 1192 */ 1193 SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); 1194 #endif 1195 1196 /* 1197 * Allow the application to pass a URL or hostname into the SSL library. 1198 */ 1199 SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); 1200 1201 /* 1202 * Allow an application to define a set of trust anchors for peer 1203 * cert validation. 1204 */ 1205 SSL_IMPORT SECStatus SSL_SetTrustAnchors(PRFileDesc *fd, CERTCertList *list); 1206 1207 /* 1208 ** Return the number of bytes that SSL has waiting in internal buffers. 1209 ** Return 0 if security is not enabled. 1210 */ 1211 SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); 1212 1213 /* 1214 ** Invalidate the SSL session associated with fd. 1215 */ 1216 SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); 1217 1218 /* 1219 ** Return a SECItem containing the SSL session ID associated with the fd. 1220 */ 1221 SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); 1222 1223 /* 1224 ** Clear out the client's SSL session cache, not the server's session cache. 1225 */ 1226 SSL_IMPORT void SSL_ClearSessionCache(void); 1227 1228 /* 1229 ** Close the server's SSL session cache. 1230 */ 1231 SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); 1232 1233 /* 1234 ** Set peer information so we can correctly look up SSL session later. 1235 ** You only have to do this if you're tunneling through a proxy. 1236 */ 1237 SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, const char *peerID); 1238 1239 /* 1240 ** Reveal the security information for the peer. 1241 */ 1242 SSL_IMPORT CERTCertificate *SSL_RevealCert(PRFileDesc *socket); 1243 SSL_IMPORT void *SSL_RevealPinArg(PRFileDesc *socket); 1244 SSL_IMPORT char *SSL_RevealURL(PRFileDesc *socket); 1245 1246 /* This callback may be passed to the SSL library via a call to 1247 * SSL_GetClientAuthDataHook() for each SSL client socket. 1248 * It will be invoked when SSL needs to know what certificate and private key 1249 * (if any) to use to respond to a request for client authentication. 1250 * If arg is non-NULL, it is a pointer to a NULL-terminated string containing 1251 * the nickname of the cert/key pair to use. 1252 * If arg is NULL, this function will search the cert and key databases for 1253 * a suitable match and send it if one is found. 1254 */ 1255 SSL_IMPORT SECStatus 1256 NSS_GetClientAuthData(void *arg, 1257 PRFileDesc *socket, 1258 struct CERTDistNamesStr *caNames, 1259 struct CERTCertificateStr **pRetCert, 1260 struct SECKEYPrivateKeyStr **pRetKey); 1261 1262 /* 1263 ** Configure DTLS-SRTP (RFC 5764) cipher suite preferences. 1264 ** Input is a list of ciphers in descending preference order and a length 1265 ** of the list. As a side effect, this causes the use_srtp extension to be 1266 ** negotiated. 1267 ** 1268 ** Invalid or unimplemented cipher suites in |ciphers| are ignored. If at 1269 ** least one cipher suite in |ciphers| is implemented, returns SECSuccess. 1270 ** Otherwise returns SECFailure. 1271 */ 1272 SSL_IMPORT SECStatus SSL_SetSRTPCiphers(PRFileDesc *fd, 1273 const PRUint16 *ciphers, 1274 unsigned int numCiphers); 1275 1276 /* 1277 ** Get the selected DTLS-SRTP cipher suite (if any). 1278 ** To be called after the handshake completes. 1279 ** Returns SECFailure if not negotiated. 1280 */ 1281 SSL_IMPORT SECStatus SSL_GetSRTPCipher(PRFileDesc *fd, 1282 PRUint16 *cipher); 1283 1284 /* 1285 * Look to see if any of the signers in the cert chain for "cert" are found 1286 * in the list of caNames. 1287 * Returns SECSuccess if so, SECFailure if not. 1288 * Used by NSS_GetClientAuthData. May be used by other callback functions. 1289 */ 1290 SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, 1291 CERTDistNames *caNames); 1292 1293 /* Deprecated. This reports a misleading value for certificates that might 1294 * be used for signing rather than key exchange. 1295 * Returns key exchange type of the keys in an SSL server certificate. 1296 */ 1297 SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate *cert); 1298 1299 /* Set cipher policies to a predefined Domestic (U.S.A.) policy. 1300 * This essentially allows all supported ciphers. 1301 */ 1302 SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); 1303 1304 /* Set cipher policies to a predefined Policy that is exportable from the USA 1305 * according to present U.S. policies as we understand them. 1306 * It is the same as NSS_SetDomesticPolicy now. 1307 */ 1308 SSL_IMPORT SECStatus NSS_SetExportPolicy(void); 1309 1310 /* Set cipher policies to a predefined Policy that is exportable from the USA 1311 * according to present U.S. policies as we understand them, and that the 1312 * nation of France will permit to be imported into their country. 1313 * It is the same as NSS_SetDomesticPolicy now. 1314 */ 1315 SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); 1316 1317 SSL_IMPORT SSL3Statistics *SSL_GetStatistics(void); 1318 1319 /* Report more information than SSL_SecurityStatus. 1320 * Caller supplies the info struct. This function fills it in. Caller should 1321 * pass sizeof(SSLChannelInfo) as the |len| argument. 1322 * 1323 * The information here will be zeroed prior to details being confirmed. The 1324 * details are confirmed either when a Finished message is received, or - for a 1325 * client - when the second flight of messages have been sent. This function 1326 * therefore produces unreliable results prior to receiving the 1327 * SSLHandshakeCallback or the SSLCanFalseStartCallback. 1328 */ 1329 SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, 1330 PRUintn len); 1331 /* Get preliminary information about a channel. 1332 * Caller supplies the info struct. This function fills it in. Caller should 1333 * pass sizeof(SSLPreliminaryChannelInfo) as the |len| argument. 1334 * 1335 * This function can be called prior to handshake details being confirmed (see 1336 * SSL_GetChannelInfo above for what that means). Thus, information provided by 1337 * this function is available to SSLAuthCertificate, SSLGetClientAuthData, 1338 * SSLSNISocketConfig, and other callbacks that might be called during the 1339 * processing of the first flight of client of server handshake messages. 1340 * Values are marked as being unavailable when renegotiation is initiated. 1341 */ 1342 SSL_IMPORT SECStatus 1343 SSL_GetPreliminaryChannelInfo(PRFileDesc *fd, 1344 SSLPreliminaryChannelInfo *info, 1345 PRUintn len); 1346 /* Get information about cipher suite with id of |cipherSuite|. 1347 * Caller supplies the info struct. This function fills it in. Caller should 1348 * pass sizeof(SSLCipherSuiteInfo) as the |len| argument. 1349 */ 1350 SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, 1351 SSLCipherSuiteInfo *info, PRUintn len); 1352 1353 /* Returnes negotiated through SNI host info. */ 1354 SSL_IMPORT SECItem *SSL_GetNegotiatedHostInfo(PRFileDesc *fd); 1355 1356 /* Export keying material according to RFC 5705. 1357 ** fd must correspond to a TLS 1.0 or higher socket and out must 1358 ** already be allocated. If hasContext is false, it uses the no-context 1359 ** construction from the RFC and ignores the context and contextLen 1360 ** arguments. 1361 */ 1362 SSL_IMPORT SECStatus SSL_ExportKeyingMaterial(PRFileDesc *fd, 1363 const char *label, 1364 unsigned int labelLen, 1365 PRBool hasContext, 1366 const unsigned char *context, 1367 unsigned int contextLen, 1368 unsigned char *out, 1369 unsigned int outLen); 1370 1371 /* Early exporters are used if 0-RTT is enabled. This is TLS 1.3 only. Note 1372 * that in TLS 1.3, an empty context is equivalent to an absent context. */ 1373 SSL_IMPORT SECStatus SSL_ExportEarlyKeyingMaterial(PRFileDesc *fd, 1374 const char *label, 1375 unsigned int labelLen, 1376 const unsigned char *context, 1377 unsigned int contextLen, 1378 unsigned char *out, 1379 unsigned int outLen); 1380 1381 /* 1382 ** Return a new reference to the certificate that was most recently sent 1383 ** to the peer on this SSL/TLS connection, or NULL if none has been sent. 1384 */ 1385 SSL_IMPORT CERTCertificate *SSL_LocalCertificate(PRFileDesc *fd); 1386 1387 #define SSL_CBP_SSL3 0x0001 /* (deprecated) */ 1388 #define SSL_CBP_TLS1_0 0x0002 /* (deprecated) */ 1389 1390 /* DEPRECATED: The PKCS#11 bypass has been removed. 1391 ** This function will now always return false. */ 1392 SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, 1393 SECKEYPrivateKey *privKey, 1394 PRUint32 protocolmask, 1395 PRUint16 *ciphers, int nciphers, 1396 PRBool *pcanbypass, void *pwArg); 1397 1398 /* 1399 ** Did the handshake with the peer negotiate the given extension? 1400 ** Output parameter valid only if function returns SECSuccess 1401 */ 1402 SSL_IMPORT SECStatus SSL_HandshakeNegotiatedExtension(PRFileDesc *socket, 1403 SSLExtensionType extId, 1404 PRBool *yes); 1405 1406 /* 1407 ** How long should we wait before retransmitting the next flight of 1408 ** the DTLS handshake? Returns SECFailure if not DTLS or not in a 1409 ** handshake. 1410 */ 1411 SSL_IMPORT SECStatus DTLS_GetHandshakeTimeout(PRFileDesc *socket, 1412 PRIntervalTime *timeout); 1413 1414 /* 1415 * Return a boolean that indicates whether the underlying library 1416 * will perform as the caller expects. 1417 * 1418 * The only argument is a string, which should be the version 1419 * identifier of the NSS library. That string will be compared 1420 * against a string that represents the actual build version of 1421 * the SSL library. 1422 */ 1423 extern PRBool NSSSSL_VersionCheck(const char *importedVersion); 1424 1425 /* 1426 * Returns a const string of the SSL library version. 1427 */ 1428 extern const char *NSSSSL_GetVersion(void); 1429 1430 /* Restart an SSL connection that was paused to do asynchronous certificate 1431 * chain validation (when the auth certificate hook or bad cert handler 1432 * returned SECWouldBlock). 1433 * 1434 * This function only works for non-blocking sockets; Do not use it for 1435 * blocking sockets. Currently, this function works only for the client role of 1436 * a connection; it does not work for the server role. 1437 * 1438 * The application must call SSL_AuthCertificateComplete with 0 as the value of 1439 * the error parameter after it has successfully validated the peer's 1440 * certificate, in order to continue the SSL handshake. 1441 * 1442 * The application may call SSL_AuthCertificateComplete with a non-zero value 1443 * for error (e.g. SEC_ERROR_REVOKED_CERTIFICATE) when certificate validation 1444 * fails, before it closes the connection. If the application does so, an 1445 * alert corresponding to the error (e.g. certificate_revoked) will be sent to 1446 * the peer. See the source code of the internal function 1447 * ssl3_SendAlertForCertError for the current mapping of error to alert. This 1448 * mapping may change in future versions of libssl. 1449 * 1450 * This function will not complete the entire handshake. The application must 1451 * call SSL_ForceHandshake, PR_Recv, PR_Send, etc. after calling this function 1452 * to force the handshake to complete. 1453 * 1454 * On the first handshake of a connection, libssl will wait for the peer's 1455 * certificate to be authenticated before calling the handshake callback, 1456 * sending a client certificate, sending any application data, or returning 1457 * any application data to the application. On subsequent (renegotiation) 1458 * handshakes, libssl will block the handshake unconditionally while the 1459 * certificate is being validated. 1460 * 1461 * libssl may send and receive handshake messages while waiting for the 1462 * application to call SSL_AuthCertificateComplete, and it may call other 1463 * callbacks (e.g, the client auth data hook) before 1464 * SSL_AuthCertificateComplete has been called. 1465 * 1466 * An application that uses this asynchronous mechanism will usually have lower 1467 * handshake latency if it has to do public key operations on the certificate 1468 * chain and/or CRL/OCSP/cert fetching during the authentication, especially if 1469 * it does so in parallel on another thread. However, if the application can 1470 * authenticate the peer's certificate quickly then it may be more efficient 1471 * to use the synchronous mechanism (i.e. returning SECFailure/SECSuccess 1472 * instead of SECWouldBlock from the authenticate certificate hook). 1473 * 1474 * Be careful about converting an application from synchronous cert validation 1475 * to asynchronous certificate validation. A naive conversion is likely to 1476 * result in deadlocks; e.g. the application will wait in PR_Poll for network 1477 * I/O on the connection while all network I/O on the connection is blocked 1478 * waiting for this function to be called. 1479 * 1480 * Returns SECFailure on failure, SECSuccess on success. Never returns 1481 * SECWouldBlock. Note that SSL_AuthCertificateComplete will (usually) return 1482 * SECSuccess; do not interpret the return value of SSL_AuthCertificateComplete 1483 * as an indicator of whether it is OK to continue using the connection. For 1484 * example, SSL_AuthCertificateComplete(fd, SEC_ERROR_REVOKED_CERTIFICATE) will 1485 * return SECSuccess (normally), but that does not mean that the application 1486 * should continue using the connection. If the application passes a non-zero 1487 * value for second argument (error), or if SSL_AuthCertificateComplete returns 1488 * anything other than SECSuccess, then the application should close the 1489 * connection. 1490 */ 1491 SSL_IMPORT SECStatus SSL_AuthCertificateComplete(PRFileDesc *fd, 1492 PRErrorCode error); 1493 1494 /* 1495 * This is used to access experimental APIs. Don't call this directly. This is 1496 * used to enable the experimental APIs that are defined in "sslexp.h". 1497 */ 1498 SSL_IMPORT void *SSL_GetExperimentalAPI(const char *name); 1499 1500 SEC_END_PROTOS 1501 1502 #endif /* __ssl_h_ */ 1503