Back to index

lightning-sunbird  0.9+nobinonly
ssl.h
Go to the documentation of this file.
00001 /*
00002  * This file contains prototypes for the public SSL functions.
00003  *
00004  * ***** BEGIN LICENSE BLOCK *****
00005  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
00006  *
00007  * The contents of this file are subject to the Mozilla Public License Version
00008  * 1.1 (the "License"); you may not use this file except in compliance with
00009  * the License. You may obtain a copy of the License at
00010  * http://www.mozilla.org/MPL/
00011  *
00012  * Software distributed under the License is distributed on an "AS IS" basis,
00013  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
00014  * for the specific language governing rights and limitations under the
00015  * License.
00016  *
00017  * The Original Code is the Netscape security libraries.
00018  *
00019  * The Initial Developer of the Original Code is
00020  * Netscape Communications Corporation.
00021  * Portions created by the Initial Developer are Copyright (C) 1994-2000
00022  * the Initial Developer. All Rights Reserved.
00023  *
00024  * Contributor(s):
00025  *
00026  * Alternatively, the contents of this file may be used under the terms of
00027  * either the GNU General Public License Version 2 or later (the "GPL"), or
00028  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
00029  * in which case the provisions of the GPL or the LGPL are applicable instead
00030  * of those above. If you wish to allow use of your version of this file only
00031  * under the terms of either the GPL or the LGPL, and not to allow others to
00032  * use your version of this file under the terms of the MPL, indicate your
00033  * decision by deleting the provisions above and replace them with the notice
00034  * and other provisions required by the GPL or the LGPL. If you do not delete
00035  * the provisions above, a recipient may use your version of this file under
00036  * the terms of any one of the MPL, the GPL or the LGPL.
00037  *
00038  * ***** END LICENSE BLOCK ***** */
00039 /* $Id: ssl.h,v 1.24 2005/09/16 20:33:09 julien.pierre.bugs%sun.com Exp $ */
00040 
00041 #ifndef __ssl_h_
00042 #define __ssl_h_
00043 
00044 #include "prtypes.h"
00045 #include "prerror.h"
00046 #include "prio.h"
00047 #include "seccomon.h"
00048 #include "cert.h"
00049 #include "keyt.h"
00050 
00051 #include "sslt.h"  /* public ssl data types */
00052 
00053 #if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS)
00054 #define SSL_IMPORT extern __declspec(dllimport)
00055 #else
00056 #define SSL_IMPORT extern
00057 #endif
00058 
00059 SEC_BEGIN_PROTOS
00060 
00061 /* constant table enumerating all implemented SSL 2 and 3 cipher suites. */
00062 SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[];
00063 
00064 /* number of entries in the above table. */
00065 SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers;
00066 
00067 /* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */
00068 #define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00)
00069 
00070 /*
00071 ** Imports fd into SSL, returning a new socket.  Copies SSL configuration
00072 ** from model.
00073 */
00074 SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd);
00075 
00076 /*
00077 ** Enable/disable an ssl mode
00078 **
00079 **     SSL_SECURITY:
00080 **            enable/disable use of SSL security protocol before connect
00081 **
00082 **     SSL_SOCKS:
00083 **            enable/disable use of socks before connect
00084 **            (No longer supported).
00085 **
00086 **     SSL_REQUEST_CERTIFICATE:
00087 **            require a certificate during secure connect
00088 */
00089 /* options */
00090 #define SSL_SECURITY               1 /* (on by default) */
00091 #define SSL_SOCKS                  2 /* (off by default) */
00092 #define SSL_REQUEST_CERTIFICATE           3 /* (off by default) */
00093 #define SSL_HANDSHAKE_AS_CLIENT           5 /* force accept to hs as client */
00094                                             /* (off by default) */
00095 #define SSL_HANDSHAKE_AS_SERVER           6 /* force connect to hs as server */
00096                                             /* (off by default) */
00097 #define SSL_ENABLE_SSL2                   7 /* enable ssl v2 (on by default) */
00098 #define SSL_ENABLE_SSL3                    8 /* enable ssl v3 (on by default) */
00099 #define SSL_NO_CACHE                9 /* don't use the session cache */
00100                                       /* (off by default) */
00101 #define SSL_REQUIRE_CERTIFICATE        10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */
00102                                           /* by default) */
00103 #define SSL_ENABLE_FDX                 11 /* permit simultaneous read/write */
00104                                           /* (off by default) */
00105 #define SSL_V2_COMPATIBLE_HELLO        12 /* send v3 client hello in v2 fmt */
00106                                           /* (on by default) */
00107 #define SSL_ENABLE_TLS                    13 /* enable TLS (on by default) */
00108 #define SSL_ROLLBACK_DETECTION         14 /* for compatibility, default: on */
00109 #define SSL_NO_STEP_DOWN               15 /* Disable export cipher suites   */
00110                                           /* if step-down keys are needed.  */
00111                                      /* default: off, generate         */
00112                                      /* step-down keys if needed.      */
00113 #define SSL_BYPASS_PKCS11              16 /* use PKCS#11 for pub key only   */
00114 #define SSL_NO_LOCKS                   17 /* Don't use locks for protection */
00115 
00116 #ifdef SSL_DEPRECATED_FUNCTION 
00117 /* Old deprecated function names */
00118 SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on);
00119 SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on);
00120 #endif
00121 
00122 /* New function names */
00123 SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on);
00124 SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on);
00125 SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on);
00126 SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on);
00127 SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle);
00128 
00129 /*
00130 ** Control ciphers that SSL uses. If on is non-zero then the named cipher
00131 ** is enabled, otherwise it is disabled. 
00132 ** The "cipher" values are defined in sslproto.h (the SSL_EN_* values).
00133 ** EnableCipher records user preferences.
00134 ** SetPolicy sets the policy according to the policy module.
00135 */
00136 #ifdef SSL_DEPRECATED_FUNCTION 
00137 /* Old deprecated function names */
00138 SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled);
00139 SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy);
00140 #endif
00141 
00142 /* New function names */
00143 SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled);
00144 SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled);
00145 SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled);
00146 SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled);
00147 SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy);
00148 SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy);
00149 
00150 /* Values for "policy" argument to SSL_PolicySet */
00151 /* Values returned by SSL_CipherPolicyGet. */
00152 #define SSL_NOT_ALLOWED             0           /* or invalid or unimplemented */
00153 #define SSL_ALLOWED          1
00154 #define SSL_RESTRICTED              2           /* only with "Step-Up" certs. */
00155 
00156 /* Values for "on" with SSL_REQUIRE_CERTIFICATE. */
00157 #define SSL_REQUIRE_NEVER           ((PRBool)0)
00158 #define SSL_REQUIRE_ALWAYS          ((PRBool)1)
00159 #define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2)
00160 #define SSL_REQUIRE_NO_ERROR        ((PRBool)3)
00161 
00162 /*
00163 ** Reset the handshake state for fd. This will make the complete SSL
00164 ** handshake protocol execute from the ground up on the next i/o
00165 ** operation.
00166 */
00167 SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer);
00168 
00169 /*
00170 ** Force the handshake for fd to complete immediately.  This blocks until
00171 ** the complete SSL handshake protocol is finished.
00172 */
00173 SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd);
00174 
00175 /*
00176 ** Same as above, but with an I/O timeout.
00177  */
00178 SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd,
00179                                                    PRIntervalTime timeout);
00180 
00181 /*
00182 ** Query security status of socket. *on is set to one if security is
00183 ** enabled. *keySize will contain the stream key size used. *issuer will
00184 ** contain the RFC1485 verison of the name of the issuer of the
00185 ** certificate at the other end of the connection. For a client, this is
00186 ** the issuer of the server's certificate; for a server, this is the
00187 ** issuer of the client's certificate (if any). Subject is the subject of
00188 ** the other end's certificate. The pointers can be zero if the desired
00189 ** data is not needed.  All strings returned by this function are owned
00190 ** by SSL, and will be freed when the socket is closed.
00191 */
00192 SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher,
00193                                      int *keySize, int *secretKeySize,
00194                                      char **issuer, char **subject);
00195 
00196 /* Values for "on" */
00197 #define SSL_SECURITY_STATUS_NOOPT  -1
00198 #define SSL_SECURITY_STATUS_OFF           0
00199 #define SSL_SECURITY_STATUS_ON_HIGH       1
00200 #define SSL_SECURITY_STATUS_ON_LOW 2
00201 #define SSL_SECURITY_STATUS_FORTEZZA      3 /* NO LONGER SUPPORTED */
00202 
00203 /*
00204 ** Return the certificate for our SSL peer. If the client calls this
00205 ** it will always return the server's certificate. If the server calls
00206 ** this, it may return NULL if client authentication is not enabled or
00207 ** if the client had no certificate when asked.
00208 **     "fd" the socket "file" descriptor
00209 */
00210 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd);
00211 
00212 /*
00213 ** Authenticate certificate hook. Called when a certificate comes in
00214 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the
00215 ** certificate.
00216 */
00217 typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, 
00218                                                     PRBool checkSig,
00219                                                     PRBool isServer);
00220 
00221 SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, 
00222                                         SSLAuthCertificate f,
00223                                          void *arg);
00224 
00225 /* An implementation of the certificate authentication hook */
00226 SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, 
00227                                     PRBool checkSig, PRBool isServer);
00228 
00229 /*
00230  * Prototype for SSL callback to get client auth data from the application.
00231  *     arg - application passed argument
00232  *     caNames - pointer to distinguished names of CAs that the server likes
00233  *     pRetCert - pointer to pointer to cert, for return of cert
00234  *     pRetKey - pointer to key pointer, for return of key
00235  */
00236 typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg,
00237                                 PRFileDesc *fd,
00238                                 CERTDistNames *caNames,
00239                                 CERTCertificate **pRetCert,/*return */
00240                                 SECKEYPrivateKey **pRetKey);/* return */
00241 
00242 /*
00243  * Set the client side callback for SSL to retrieve user's private key
00244  * and certificate.
00245  *     fd - the file descriptor for the connection in question
00246  *     f - the application's callback that delivers the key and cert
00247  *     a - application specific data
00248  */
00249 SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, 
00250                                             SSLGetClientAuthData f, void *a);
00251 
00252 
00253 /*
00254  * Set the client side argument for SSL to retrieve PKCS #11 pin.
00255  *     fd - the file descriptor for the connection in question
00256  *     a - pkcs11 application specific data
00257  */
00258 SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a);
00259 
00260 /*
00261 ** This is a callback for dealing with server certs that are not authenticated
00262 ** by the client.  The client app can decide that it actually likes the
00263 ** cert by some external means and restart the connection.
00264 */
00265 typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd);
00266 SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, 
00267                                  void *arg);
00268 
00269 /*
00270 ** Configure ssl for running a secure server. Needs the
00271 ** certificate for the server and the servers private key. The arguments
00272 ** are copied.
00273 */
00274 SSL_IMPORT SECStatus SSL_ConfigSecureServer(
00275                             PRFileDesc *fd, CERTCertificate *cert,
00276                             SECKEYPrivateKey *key, SSLKEAType kea);
00277 
00278 /*
00279 ** Configure a secure servers session-id cache. Define the maximum number
00280 ** of entries in the cache, the longevity of the entires, and the directory
00281 ** where the cache files will be placed.  These values can be zero, and 
00282 ** if so, the implementation will choose defaults.
00283 ** This version of the function is for use in applications that have only one 
00284 ** process that uses the cache (even if that process has multiple threads).
00285 */
00286 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int      maxCacheEntries,
00287                                                PRUint32 timeout,
00288                                                PRUint32 ssl3_timeout,
00289                                           const char *   directory);
00290 /*
00291 ** Like SSL_ConfigServerSessionIDCache, with one important difference.
00292 ** If the application will run multiple processes (as opposed to, or in 
00293 ** addition to multiple threads), then it must call this function, instead
00294 ** of calling SSL_ConfigServerSessionIDCache().
00295 ** This has nothing to do with the number of processORs, only processEs.
00296 ** This function sets up a Server Session ID (SID) cache that is safe for
00297 ** access by multiple processes on the same system.
00298 */
00299 SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int      maxCacheEntries, 
00300                                             PRUint32 timeout,
00301                                                    PRUint32 ssl3_timeout, 
00302                                         const char *   directory);
00303 
00304 /* Get and set the configured maximum number of mutexes used for the 
00305 ** server's store of SSL sessions.  This value is used by the server 
00306 ** session ID cache initialization functions shown above.  Note that on 
00307 ** some platforms, these mutexes are actually implemented with POSIX 
00308 ** semaphores, or with unnamed pipes.  The default value varies by platform.
00309 ** An attempt to set a too-low maximum will return an error and the 
00310 ** configured value will not be changed.
00311 */
00312 SSL_IMPORT PRUint32  SSL_GetMaxServerCacheLocks(void);
00313 SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks);
00314 
00315 /* environment variable set by SSL_ConfigMPServerSIDCache, and queried by
00316  * SSL_InheritMPServerSIDCache when envString is NULL.
00317  */
00318 #define SSL_ENV_VAR_NAME            "SSL_INHERITANCE"
00319 
00320 /* called in child to inherit SID Cache variables. 
00321  * If envString is NULL, this function will use the value of the environment
00322  * variable "SSL_INHERITANCE", otherwise the string value passed in will be 
00323  * used.
00324  */
00325 SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString);
00326 
00327 /*
00328 ** Set the callback on a particular socket that gets called when we finish
00329 ** performing a handshake.
00330 */
00331 typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd,
00332                                                  void *client_data);
00333 SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 
00334                                SSLHandshakeCallback cb, void *client_data);
00335 
00336 /*
00337 ** For the server, request a new handshake.  For the client, begin a new
00338 ** handshake.  If flushCache is non-zero, the SSL3 cache entry will be 
00339 ** flushed first, ensuring that a full SSL handshake will be done.
00340 ** If flushCache is zero, and an SSL connection is established, it will 
00341 ** do the much faster session restart handshake.  This will change the 
00342 ** session keys without doing another private key operation.
00343 */
00344 SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache);
00345 
00346 /*
00347 ** Same as above, but with an I/O timeout.
00348  */
00349 SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd,
00350                                                 PRBool flushCache,
00351                                                 PRIntervalTime timeout);
00352 
00353 
00354 #ifdef SSL_DEPRECATED_FUNCTION 
00355 /* deprecated!
00356 ** For the server, request a new handshake.  For the client, begin a new
00357 ** handshake.  Flushes SSL3 session cache entry first, ensuring that a 
00358 ** full handshake will be done.  
00359 ** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE)
00360 */
00361 SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd);
00362 #endif
00363 
00364 /*
00365  * Allow the application to pass a URL or hostname into the SSL library
00366  */
00367 SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url);
00368 
00369 /*
00370 ** Return the number of bytes that SSL has waiting in internal buffers.
00371 ** Return 0 if security is not enabled.
00372 */
00373 SSL_IMPORT int SSL_DataPending(PRFileDesc *fd);
00374 
00375 /*
00376 ** Invalidate the SSL session associated with fd.
00377 */
00378 SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd);
00379 
00380 /*
00381 ** Return a SECItem containing the SSL session ID associated with the fd.
00382 */
00383 SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd);
00384 
00385 /*
00386 ** Clear out the client's SSL session cache, not the server's session cache.
00387 */
00388 SSL_IMPORT void SSL_ClearSessionCache(void);
00389 
00390 /*
00391 ** Close the server's SSL session cache.
00392 */
00393 SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void);
00394 
00395 /*
00396 ** Set peer information so we can correctly look up SSL session later.
00397 ** You only have to do this if you're tunneling through a proxy.
00398 */
00399 SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, char *peerID);
00400 
00401 /*
00402 ** Reveal the security information for the peer. 
00403 */
00404 SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket);
00405 SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket);
00406 SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket);
00407 
00408 
00409 /* This callback may be passed to the SSL library via a call to
00410  * SSL_GetClientAuthDataHook() for each SSL client socket.
00411  * It will be invoked when SSL needs to know what certificate and private key
00412  * (if any) to use to respond to a request for client authentication.
00413  * If arg is non-NULL, it is a pointer to a NULL-terminated string containing
00414  * the nickname of the cert/key pair to use.
00415  * If arg is NULL, this function will search the cert and key databases for 
00416  * a suitable match and send it if one is found.
00417  */
00418 SSL_IMPORT SECStatus
00419 NSS_GetClientAuthData(void *                       arg,
00420                       PRFileDesc *                 socket,
00421                       struct CERTDistNamesStr *    caNames,
00422                       struct CERTCertificateStr ** pRetCert,
00423                       struct SECKEYPrivateKeyStr **pRetKey);
00424 
00425 /*
00426  * Look to see if any of the signers in the cert chain for "cert" are found
00427  * in the list of caNames.  
00428  * Returns SECSuccess if so, SECFailure if not.
00429  * Used by NSS_GetClientAuthData.  May be used by other callback functions.
00430  */
00431 SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, 
00432                                           CERTDistNames *caNames);
00433 
00434 /* 
00435  * Returns key exchange type of the keys in an SSL server certificate.
00436  */
00437 SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert);
00438 
00439 /* Set cipher policies to a predefined Domestic (U.S.A.) policy.
00440  * This essentially enables all supported ciphers.
00441  */
00442 SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void);
00443 
00444 /* Set cipher policies to a predefined Policy that is exportable from the USA
00445  *   according to present U.S. policies as we understand them.
00446  * See documentation for the list.
00447  * Note that your particular application program may be able to obtain
00448  *   an export license with more or fewer capabilities than those allowed
00449  *   by this function.  In that case, you should use SSL_SetPolicy()
00450  *   to explicitly allow those ciphers you may legally export.
00451  */
00452 SSL_IMPORT SECStatus NSS_SetExportPolicy(void);
00453 
00454 /* Set cipher policies to a predefined Policy that is exportable from the USA
00455  *   according to present U.S. policies as we understand them, and that the 
00456  *   nation of France will permit to be imported into their country.
00457  * See documentation for the list.
00458  */
00459 SSL_IMPORT SECStatus NSS_SetFrancePolicy(void);
00460 
00461 SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void);
00462 
00463 /* Report more information than SSL_SecurityStatus.
00464 ** Caller supplies the info struct.  Function fills it in.
00465 */
00466 SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info,
00467                                         PRUintn len);
00468 SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, 
00469                                         SSLCipherSuiteInfo *info, PRUintn len);
00470 
00471 /*
00472 ** Return a new reference to the certificate that was most recently sent
00473 ** to the peer on this SSL/TLS connection, or NULL if none has been sent.
00474 */
00475 SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd);
00476 
00477 SEC_END_PROTOS
00478 
00479 #endif /* __ssl_h_ */