Classes | Defines | Typedefs | Enumerations | Functions
tls.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes

struct  tls_config
struct  tls_connection_params
union  tls_event_data
struct  tls_keys

Defines

#define TLS_CAPABILITY_IA   0x0001 /* TLS Inner Application (TLS/IA) */
#define TLS_CONN_ALLOW_SIGN_RSA_MD5   BIT(0)
#define TLS_CONN_DISABLE_TIME_CHECKS   BIT(1)

Typedefs

typedef int(* tls_session_ticket_cb )(void *ctx, const u8 *ticket, size_t len, const u8 *client_random, const u8 *server_random, u8 *master_secret)

Enumerations

enum  { TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED = -3, TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED = -2 }
enum  {
  TLS_CIPHER_NONE, TLS_CIPHER_RC4_SHA, TLS_CIPHER_AES128_SHA, TLS_CIPHER_RSA_DHE_AES128_SHA,
  TLS_CIPHER_ANON_DH_AES128_SHA
}
enum  tls_event { TLS_CERT_CHAIN_FAILURE, TLS_PEER_CERTIFICATE }
enum  tls_fail_reason {
  TLS_FAIL_UNSPECIFIED = 0, TLS_FAIL_UNTRUSTED = 1, TLS_FAIL_REVOKED = 2, TLS_FAIL_NOT_YET_VALID = 3,
  TLS_FAIL_EXPIRED = 4, TLS_FAIL_SUBJECT_MISMATCH = 5, TLS_FAIL_ALTSUBJECT_MISMATCH = 6, TLS_FAIL_BAD_CERTIFICATE = 7,
  TLS_FAIL_SERVER_CHAIN_PROBE = 8
}

Functions

unsigned int tls_capabilities (void *tls_ctx)
int __must_check tls_connection_client_hello_ext (void *tls_ctx, struct tls_connection *conn, int ext_type, const u8 *data, size_t data_len)
struct wpabuftls_connection_decrypt (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data)
void tls_connection_deinit (void *tls_ctx, struct tls_connection *conn)
int __must_check tls_connection_enable_workaround (void *tls_ctx, struct tls_connection *conn)
struct wpabuftls_connection_encrypt (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data)
int tls_connection_established (void *tls_ctx, struct tls_connection *conn)
int tls_connection_get_failed (void *tls_ctx, struct tls_connection *conn)
int tls_connection_get_keyblock_size (void *tls_ctx, struct tls_connection *conn)
int __must_check tls_connection_get_keys (void *tls_ctx, struct tls_connection *conn, struct tls_keys *keys)
int tls_connection_get_read_alerts (void *tls_ctx, struct tls_connection *conn)
int tls_connection_get_write_alerts (void *tls_ctx, struct tls_connection *conn)
struct wpabuftls_connection_handshake (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data, struct wpabuf **appl_data)
int __must_check tls_connection_ia_final_phase_finished (void *tls_ctx, struct tls_connection *conn)
int __must_check tls_connection_ia_permute_inner_secret (void *tls_ctx, struct tls_connection *conn, const u8 *key, size_t key_len)
struct wpabuftls_connection_ia_send_phase_finished (void *tls_ctx, struct tls_connection *conn, int final)
struct tls_connectiontls_connection_init (void *tls_ctx)
int __must_check tls_connection_prf (void *tls_ctx, struct tls_connection *conn, const char *label, int server_random_first, u8 *out, size_t out_len)
int tls_connection_resumed (void *tls_ctx, struct tls_connection *conn)
struct wpabuftls_connection_server_handshake (void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data, struct wpabuf **appl_data)
int __must_check tls_connection_set_cipher_list (void *tls_ctx, struct tls_connection *conn, u8 *ciphers)
int __must_check tls_connection_set_ia (void *tls_ctx, struct tls_connection *conn, int tls_ia)
int __must_check tls_connection_set_params (void *tls_ctx, struct tls_connection *conn, const struct tls_connection_params *params)
int __must_check tls_connection_set_session_ticket_cb (void *tls_ctx, struct tls_connection *conn, tls_session_ticket_cb cb, void *ctx)
int __must_check tls_connection_set_verify (void *tls_ctx, struct tls_connection *conn, int verify_peer)
int tls_connection_shutdown (void *tls_ctx, struct tls_connection *conn)
void tls_deinit (void *tls_ctx)
int __must_check tls_get_cipher (void *tls_ctx, struct tls_connection *conn, char *buf, size_t buflen)
int tls_get_errors (void *tls_ctx)
int __must_check tls_global_set_params (void *tls_ctx, const struct tls_connection_params *params)
int __must_check tls_global_set_verify (void *tls_ctx, int check_crl)
void * tls_init (const struct tls_config *conf)

Define Documentation

#define TLS_CAPABILITY_IA   0x0001 /* TLS Inner Application (TLS/IA) */

Definition at line 517 of file tls.h.

#define TLS_CONN_ALLOW_SIGN_RSA_MD5   BIT(0)

Definition at line 81 of file tls.h.

#define TLS_CONN_DISABLE_TIME_CHECKS   BIT(1)

Definition at line 82 of file tls.h.


Typedef Documentation

typedef int(* tls_session_ticket_cb)(void *ctx, const u8 *ticket, size_t len, const u8 *client_random, const u8 *server_random, u8 *master_secret)

Definition at line 562 of file tls.h.


Enumeration Type Documentation

anonymous enum
Enumerator:
TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED 
TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED 

Definition at line 231 of file tls.h.

anonymous enum
Enumerator:
TLS_CIPHER_NONE 
TLS_CIPHER_RC4_SHA 
TLS_CIPHER_AES128_SHA 
TLS_CIPHER_RSA_DHE_AES128_SHA 
TLS_CIPHER_ANON_DH_AES128_SHA 

Definition at line 420 of file tls.h.

enum tls_event
Enumerator:
TLS_CERT_CHAIN_FAILURE 
TLS_PEER_CERTIFICATE 

Definition at line 31 of file tls.h.

Enumerator:
TLS_FAIL_UNSPECIFIED 
TLS_FAIL_UNTRUSTED 
TLS_FAIL_REVOKED 
TLS_FAIL_NOT_YET_VALID 
TLS_FAIL_EXPIRED 
TLS_FAIL_SUBJECT_MISMATCH 
TLS_FAIL_ALTSUBJECT_MISMATCH 
TLS_FAIL_BAD_CERTIFICATE 
TLS_FAIL_SERVER_CHAIN_PROBE 

Definition at line 40 of file tls.h.


Function Documentation

unsigned int tls_capabilities ( void *  tls_ctx)

tls_capabilities - Get supported TLS capabilities : TLS context data from tls_init() Returns: Bit field of supported TLS capabilities (TLS_CAPABILITY_*)

Definition at line 1320 of file tls_gnutls.c.

int __must_check tls_connection_client_hello_ext ( void *  tls_ctx,
struct tls_connection conn,
int  ext_type,
const u8 *  data,
size_t  data_len 
)

tls_connection_client_hello_ext - Set TLS extension for ClientHello : TLS context data from tls_init() : Connection context data from tls_connection_init() : Extension type : Extension payload (NULL to remove extension) : Extension payload length Returns: 0 on success, -1 on failure

Definition at line 1279 of file tls_gnutls.c.

struct wpabuf* tls_connection_decrypt ( void *  tls_ctx,
struct tls_connection conn,
const struct wpabuf in_data 
) [read]

tls_connection_decrypt - Decrypt data from TLS tunnel : TLS context data from tls_init() : Connection context data from tls_connection_init() : Encrypted TLS data Returns: Decrypted TLS data or NULL on failure

This function is used after TLS handshake has been completed successfully to receive data from the encrypted tunnel. The caller is responsible for freeing the returned output data.

Definition at line 1145 of file tls_gnutls.c.

void tls_connection_deinit ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_deinit - Free TLS connection data : TLS context data from tls_init() : Connection context data from tls_connection_init()

Release all resources allocated for TLS connection.

Definition at line 362 of file tls_gnutls.c.

int __must_check tls_connection_enable_workaround ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_enable_workaround - Enable TLS workaround options : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 0 on success, -1 on failure

This function is used to enable connection-specific workaround options for buffer SSL/TLS implementations.

Definition at line 1271 of file tls_gnutls.c.

struct wpabuf* tls_connection_encrypt ( void *  tls_ctx,
struct tls_connection conn,
const struct wpabuf in_data 
) [read]

tls_connection_encrypt - Encrypt data into TLS tunnel : TLS context data from tls_init() : Connection context data from tls_connection_init() : Plaintext data to be encrypted Returns: Encrypted TLS data or NULL on failure

This function is used after TLS handshake has been completed successfully to send data in the encrypted tunnel. The caller is responsible for freeing the returned output data.

Definition at line 1118 of file tls_gnutls.c.

int tls_connection_established ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_established - Has the TLS connection been completed? : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 1 if TLS connection has been completed, 0 if not.

Definition at line 389 of file tls_gnutls.c.

int tls_connection_get_failed ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_get_failed - Get connection failure status : TLS context data from tls_init() : Connection context data from tls_connection_init()

Returns >0 if connection has failed, 0 if not.

Definition at line 1288 of file tls_gnutls.c.

int tls_connection_get_keyblock_size ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_get_keyblock_size - Get TLS key_block size : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: Size of the key_block for the negotiated cipher suite or -1 on failure

Definition at line 1312 of file tls_gnutls.c.

int __must_check tls_connection_get_keys ( void *  tls_ctx,
struct tls_connection conn,
struct tls_keys keys 
)

tls_connection_get_keys - Get master key and random data from TLS connection : TLS context data from tls_init() : Connection context data from tls_connection_init() : Structure of key/random data (filled on success) Returns: 0 on success, -1 on failure

Definition at line 813 of file tls_gnutls.c.

int tls_connection_get_read_alerts ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_get_read_alerts - Get connection read alert status : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: Number of times a fatal read (remote end reported error) has happened during this connection.

Definition at line 1296 of file tls_gnutls.c.

int tls_connection_get_write_alerts ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_get_write_alerts - Get connection write alert status : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: Number of times a fatal write (locally detected error) has happened during this connection.

Definition at line 1304 of file tls_gnutls.c.

struct wpabuf* tls_connection_handshake ( void *  tls_ctx,
struct tls_connection conn,
const struct wpabuf in_data,
struct wpabuf **  appl_data 
) [read]

tls_connection_handshake - Process TLS handshake (client side) : TLS context data from tls_init() : Connection context data from tls_connection_init() : Input data from TLS server : Pointer to application data pointer, or NULL if dropped Returns: Output data, NULL on failure

The caller is responsible for freeing the returned output data. If the final handshake message includes application data, this is decrypted and appl_data (if not NULL) is set to point this data. The caller is responsible for freeing appl_data.

This function is used during TLS handshake. The first call is done with in_data == NULL and the library is expected to return ClientHello packet. This packet is then send to the server and a response from server is given to TLS library by calling this function again with in_data pointing to the TLS message from the server.

If the TLS handshake fails, this function may return NULL. However, if the TLS library has a TLS alert to send out, that should be returned as the output data. In this case, tls_connection_get_failed() must return failure (> 0).

tls_connection_established() should return 1 once the TLS handshake has been completed successfully.

Definition at line 1005 of file tls_gnutls.c.

int __must_check tls_connection_ia_final_phase_finished ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_ia_final_phase_finished - Has final phase been completed : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 1 if valid FinalPhaseFinished has been received, 0 if not, or -1 on failure

Definition at line 1410 of file tls_gnutls.c.

int __must_check tls_connection_ia_permute_inner_secret ( void *  tls_ctx,
struct tls_connection conn,
const u8 *  key,
size_t  key_len 
)

tls_connection_ia_permute_inner_secret - Permute TLS/IA inner secret : TLS context data from tls_init() : Connection context data from tls_connection_init() : Session key material (session_key vectors with 2-octet length), or NULL if no session key was generating in the current phase : Length of session key material Returns: 0 on success, -1 on failure

Definition at line 1420 of file tls_gnutls.c.

struct wpabuf* tls_connection_ia_send_phase_finished ( void *  tls_ctx,
struct tls_connection conn,
int  final 
) [read]

tls_connection_ia_send_phase_finished - Send a TLS/IA PhaseFinished message : TLS context data from tls_init() : Connection context data from tls_connection_init() : 1 = FinalPhaseFinished, 0 = IntermediatePhaseFinished Returns: Encrypted TLS/IA data, NULL on failure

This function is used to send the TLS/IA end phase message, e.g., when the EAP server completes EAP-TTLSv1.

Definition at line 1369 of file tls_gnutls.c.

struct tls_connection* tls_connection_init ( void *  tls_ctx) [read]

tls_connection_init - Initialize a new TLS connection : TLS context data from tls_init() Returns: Connection context data, conn for other function calls

Definition at line 326 of file tls_gnutls.c.

int __must_check tls_connection_prf ( void *  tls_ctx,
struct tls_connection conn,
const char *  label,
int  server_random_first,
u8 *  out,
size_t  out_len 
)

tls_connection_prf - Use TLS-PRF to derive keying material : TLS context data from tls_init() : Connection context data from tls_connection_init() : Label (e.g., description of the key) for PRF : seed is 0 = client_random|server_random, 1 = server_random|client_random : Buffer for output data from TLS-PRF : Length of the output buffer Returns: 0 on success, -1 on failure

This function is optional to implement if tls_connection_get_keys() provides access to master secret and server/client random values. If these values are not exported from the TLS library, tls_connection_prf() is required so that further keying material can be derived from the master secret. If not implemented, the function will still need to be defined, but it can just return -1. Example implementation of this function is in tls_prf() function when it is called with seed set to client_random|server_random (or server_random|client_random).

Definition at line 853 of file tls_gnutls.c.

int tls_connection_resumed ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_resumed - Was session resumption used : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 1 if current session used session resumption, 0 if not

Definition at line 1246 of file tls_gnutls.c.

struct wpabuf* tls_connection_server_handshake ( void *  tls_ctx,
struct tls_connection conn,
const struct wpabuf in_data,
struct wpabuf **  appl_data 
) [read]

tls_connection_server_handshake - Process TLS handshake (server side) : TLS context data from tls_init() : Connection context data from tls_connection_init() : Input data from TLS peer : Pointer to application data pointer, or NULL if dropped Returns: Output data, NULL on failure

The caller is responsible for freeing the returned output data.

Definition at line 1109 of file tls_gnutls.c.

int __must_check tls_connection_set_cipher_list ( void *  tls_ctx,
struct tls_connection conn,
u8 *  ciphers 
)

tls_connection_set_cipher_list - Configure acceptable cipher suites : TLS context data from tls_init() : Connection context data from tls_connection_init() : Zero (TLS_CIPHER_NONE) terminated list of allowed ciphers (TLS_CIPHER_*). Returns: 0 on success, -1 on failure

Definition at line 1254 of file tls_gnutls.c.

int __must_check tls_connection_set_ia ( void *  tls_ctx,
struct tls_connection conn,
int  tls_ia 
)

tls_connection_set_ia - Set TLS/IA parameters : TLS context data from tls_init() : Connection context data from tls_connection_init() : 1 = enable TLS/IA Returns: 0 on success, -1 on failure

This function is used to configure TLS/IA in server mode where tls_connection_set_params() is not used.

Definition at line 1332 of file tls_gnutls.c.

int __must_check tls_connection_set_params ( void *  tls_ctx,
struct tls_connection conn,
const struct tls_connection_params params 
)

tls_connection_set_params - Set TLS connection parameters : TLS context data from tls_init() : Connection context data from tls_connection_init() : Connection parameters Returns: 0 on success, -1 on failure, TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED (-2) on possible PIN error causing PKCS#11 engine failure, or TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED (-3) on failure to verify the PKCS#11 engine private key.

Definition at line 548 of file tls_gnutls.c.

int __must_check tls_connection_set_session_ticket_cb ( void *  tls_ctx,
struct tls_connection conn,
tls_session_ticket_cb  cb,
void *  ctx 
)

Definition at line 1452 of file tls_gnutls.c.

int __must_check tls_connection_set_verify ( void *  tls_ctx,
struct tls_connection conn,
int  verify_peer 
)

tls_connection_set_verify - Set certificate verification options : TLS context data from tls_init() : Connection context data from tls_connection_init() : 1 = verify peer certificate Returns: 0 on success, -1 on failure

Definition at line 798 of file tls_gnutls.c.

int tls_connection_shutdown ( void *  tls_ctx,
struct tls_connection conn 
)

tls_connection_shutdown - Shutdown TLS connection : TLS context data from tls_init() : Connection context data from tls_connection_init() Returns: 0 on success, -1 on failure

Shutdown current TLS connection without releasing all resources. New connection can be started by using the same conn without having to call tls_connection_init() or setting certificates etc. again. The new connection should try to use session resumption.

Definition at line 395 of file tls_gnutls.c.

void tls_deinit ( void *  tls_ctx)

tls_deinit - Deinitialize TLS library : TLS context data from tls_init()

Called once during program shutdown and once for each RSN pre-authentication session. If global library deinitialization is needed (i.e., one that is shared between both authentication types), the TLS library wrapper should maintain a reference counter and do global deinitialization only when moving from 1 to 0 references.

Definition at line 219 of file tls_gnutls.c.

int __must_check tls_get_cipher ( void *  tls_ctx,
struct tls_connection conn,
char *  buf,
size_t  buflen 
)

tls_get_cipher - Get current cipher name : TLS context data from tls_init() : Connection context data from tls_connection_init() : Buffer for the cipher name : buf size Returns: 0 on success, -1 on failure

Get the name of the currently used cipher.

Definition at line 1262 of file tls_gnutls.c.

int tls_get_errors ( void *  tls_ctx)

tls_get_errors - Process pending errors : TLS context data from tls_init() Returns: Number of found error, 0 if no errors detected.

Process all pending TLS errors.

Definition at line 235 of file tls_gnutls.c.

int __must_check tls_global_set_params ( void *  tls_ctx,
const struct tls_connection_params params 
)

tls_global_set_params - Set TLS parameters for all TLS connection : TLS context data from tls_init() : Global TLS parameters Returns: 0 on success, -1 on failure, TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED (-2) on possible PIN error causing PKCS#11 engine failure, or TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED (-3) on failure to verify the PKCS#11 engine private key.

Definition at line 685 of file tls_gnutls.c.

int __must_check tls_global_set_verify ( void *  tls_ctx,
int  check_crl 
)

tls_global_set_verify - Set global certificate verification options : TLS context data from tls_init() : 0 = do not verify CRLs, 1 = verify CRL for the user certificate, 2 = verify CRL for all certificates Returns: 0 on success, -1 on failure

Definition at line 791 of file tls_gnutls.c.

void* tls_init ( const struct tls_config conf)

tls_init - Initialize TLS library : Configuration data for TLS library Returns: Context data to be used as tls_ctx in calls to other functions, or NULL on failure.

Called once during program startup and once for each RSN pre-authentication session. In other words, there can be two concurrent TLS contexts. If global library initialization is needed (i.e., one that is shared between both authentication types), the TLS library wrapper should maintain a reference counter and do global initialization only when moving from 0 to 1 reference.

Definition at line 167 of file tls_gnutls.c.



wpa_supplicant_node
Author(s): Package maintained by Blaise Gassend
autogenerated on Thu Apr 24 2014 15:33:24