1 /* $OpenBSD: tls_internal.h,v 1.12 2015/03/31 12:21:27 jsing Exp $ */ 2 /* 3 * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org> 4 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #ifndef HEADER_TLS_INTERNAL_H 20 #define HEADER_TLS_INTERNAL_H 21 22 #include <openssl/ssl.h> 23 24 #define HTTPS_PORT "443" 25 26 #define _PATH_SSL_CA_FILE "/etc/ssl/cert.pem" 27 28 #define TLS_CIPHERS_COMPAT "ALL:!aNULL:!eNULL" 29 #define TLS_CIPHERS_DEFAULT "TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE" 30 31 struct tls_config { 32 const char *ca_file; 33 const char *ca_path; 34 char *ca_mem; 35 size_t ca_len; 36 const char *cert_file; 37 char *cert_mem; 38 size_t cert_len; 39 const char *ciphers; 40 int dheparams; 41 int ecdhecurve; 42 const char *key_file; 43 char *key_mem; 44 size_t key_len; 45 uint32_t protocols; 46 int verify_cert; 47 int verify_depth; 48 int verify_name; 49 }; 50 51 #define TLS_CLIENT (1 << 0) 52 #define TLS_SERVER (1 << 1) 53 #define TLS_SERVER_CONN (1 << 2) 54 #define TLS_CONNECTING (1 << 3) 55 56 struct tls { 57 struct tls_config *config; 58 uint64_t flags; 59 60 int err; 61 char *errmsg; 62 63 int socket; 64 65 SSL *ssl_conn; 66 SSL_CTX *ssl_ctx; 67 }; 68 69 struct tls *tls_new(void); 70 struct tls *tls_server_conn(struct tls *ctx); 71 72 int tls_check_servername(struct tls *ctx, X509 *cert, const char *servername); 73 int tls_configure_keypair(struct tls *ctx); 74 int tls_configure_server(struct tls *ctx); 75 int tls_configure_ssl(struct tls *ctx); 76 int tls_host_port(const char *hostport, char **host, char **port); 77 int tls_set_error(struct tls *ctx, char *fmt, ...) 78 __attribute__((__format__ (printf, 2, 3))) 79 __attribute__((__nonnull__ (2))); 80 int tls_ssl_error(struct tls *ctx, SSL *ssl_conn, int ssl_ret, 81 const char *prefix); 82 83 #endif /* HEADER_TLS_INTERNAL_H */ 84