ssl.h

/*NB_REVISION*/
 
/*NB_COPYRIGHT*/
 
#ifndef _SSL_H_
#define _SSL_H_
 
#include <nettypes.h>
#include <predef.h>
#include <nbrtos.h>
#include <tcp.h>
 
#ifndef WOLFSSL_USER_SETTINGS
#define WOLFSSL_USER_SETTINGS   // This wasn't getting defined in the project source files in NBEclipse
#endif
 
#if defined(NB_SSL_SUPPORTED) || defined(NB_SSH_SUPPORTED)
#include <crypto/wolfssl/ssl.h>
#endif
 
#ifdef NB_SSL_SUPPORTED
#include <crypto/wolfssl/error-ssl.h>
#include <random.h>
 
 
/*
 * Module: SSL library
 *    Implementing SSL in an embedded system will require some knowledge of SSL
 *    certificates. Please see the NetBurner SSL overview doc for what you need
 *    to know to get started.
 */
/*
 * SSL network functions can return all of the standard TCP errors:
 *    TCP_ERR_TIMEOUT
 *    TCP_ERR_NOCON
 *    TCP_ERR_CLOSING
 *    TCP_ERR_NOSUCH_SOCKET
 *    TCP_ERR_NONE_AVAIL
 *    TCP_ERR_CON_RESET
 *    TCP_ERR_CON_ABORT
 */
 
#define SSL_ERROR_FAILED_NEGOTIATION (-256)          
#define SSL_ERROR_CERTIFICATE_UNKNOWN (-258)         
#define SSL_ERROR_CERTIFICATE_NAME_FAILED (-260)     
#define SSL_ERROR_CERTIFICATE_VERIFY_FAILED (-261)   
#define SSL_ERROR_NO_BUFFER (-262)                   
#define SSL_ERROR_HANDSHAKE_INCOMPLETE (-265)        
#define SSL_ERROR_NO_SERVER_CERTIFICATE (-257)       
#define SSL_ERROR_NO_SERVER_KEY (-258)               
#define SSL_ERROR_UNABLE_TO_LOAD_CIPHERS (-259)      
#define SSL_ERROR_CERTIFICATE_CHECK (-260)           
#ifndef SSL_LIB_REPLACEMENT
/* Set this to true to see the names being tested in the certificate tests */
extern BOOL bPrintNamesTested;
#endif
 
/*Functions:*/
 
int SSL_accept(int fdListen,
               IPADDR *address,
               uint16_t *port,
               uint16_t timeout,
               bool waitForNegotiation = true,
               bool verifyPeer = false,
               const unsigned char *certBuff = nullptr,
               uint32_t certBuffSize = 0,
               uint16_t certBuffFormat = SSL_FILETYPE_PEM,
               const char *commonName = nullptr);
#endif
extern BOOL (*IsSSLfd)(int fd);
 
/*
 * brief Return the network interface associated with a TCP socket.
 *
 * param fd Socket file descriptor
 *
 * return The network interface number (undefined for listening sockets)
 */
// int SSL_GetSocketInterface(int fd);  This appears to be a duplication (see below)
 
inline IPADDR SSL_GetSocketRemoteAddr(int fd) {return GetSocketRemoteAddr(fd); };
 
inline uint16_t SSL_GetSocketRemotePort(int fd){return GetSocketRemotePort(fd);};
 
inline IPADDR SSL_GetSocketLocalAddr(int fd) {return GetSocketLocalAddr(fd); };
 
 
inline uint16_t SSL_GetSocketLocalPort(int fd){return GetSocketLocalPort(fd);};
 
inline int SSL_GetSocketInterface(int fd){return TcpGetSocketInterface(fd);};
 
extern int (*SSL_GetRawSocket)(int sslSocketFd);
 
extern int (*SSL_setsockoption)(int fd, int option);
 
extern int (*SSL_clrsockoption)(int fd, int option);
 
extern int (*SSL_getsockoption)(int fd);
 
#ifdef NB_SSL_SUPPORTED
inline uint16_t SSL_GetTcpRtxCount(int fd) {return GetTcpRtxCount(fd); };
 
inline uint32_t SSL_TcpGetLastRxTime(int fd) {return TcpGetLastRxTime(fd); };
 
inline uint32_t SSL_TcpGetLastRxInterval(int fd) {return TcpGetLastRxInterval(fd);};
 
inline void SSL_TcpSendKeepAlive(int fd){TcpSendKeepAlive(fd);};
 
bool SSLSocketsAvail();
 
int FreeSSLSockets();
inline short SSL_TcpGetSocketState(int fd) {return TcpGetSocketState(fd); };
 
int SSL_getsocketerror(int fd);
 
int SSL_connect(IPADDR ip,
                uint16_t remotePort,
                uint32_t timeout,
                const char *commonName,
                bool verifyPeer = false,
                bool waitForNegotiation = true,
                const unsigned char *certBuff = nullptr,
                uint32_t certBuffSize = 0,
                uint16_t certBuffFormat = SSL_FILETYPE_PEM,
                int intf = -1);
 
[[deprecated]]int SSL_connect(IPADDR ip,
                uint16_t localPort,
                uint16_t remotePort,
                uint32_t timeout,
                const char *commonName,
                bool verifyPeer = false,
                bool waitForNegotiation = true,
                const unsigned char *certBuff = nullptr,
                uint32_t certBuffSize = 0,
                uint16_t certBuffFormat = SSL_FILETYPE_PEM,
                int intf = -1);
 
 
int SSL_makeSecure(int tcpFd,
                   const char *commonName,
                   bool verifyPeer = false,
                   bool waitForNegotiation = true,
                   const unsigned char *certBuff = nullptr,
                   uint32_t certBuffSize = 0,
                   uint16_t certBuffFormat = SSL_FILETYPE_PEM,
                   bool bIsClient = true,
                   uint32_t timeout=WAIT_FOREVER);
 
int SSL_negotiate(int tcpFd,
                  const char *common_name,
                  bool reuseSessionPort = true,
                  bool verifyPeer = false,
                  const unsigned char *certBuff = nullptr,
                  uint32_t certBuffSize = 0,
                  uint16_t certBuffFormat = SSL_FILETYPE_PEM,
                  bool bIsClient = true);
 
int SSLReadWithTimeout(int fd, char *cp, int size, uint32_t timeout);
 
uint32_t SetMaxSessionReuseTime(uint32_t newLifetimeTicks);
 
bool IsSSL_CertNKeyValid(const char *keyPEM,
                         ssize_t keylen,
                         const char *certPEM,
                         ssize_t certlen,
                         uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_AddCertToClientCaList(const unsigned char *certBuff = nullptr,
                               uint32_t certBuffSize = 0,
                               uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_AddCertToServerCaList(const unsigned char *certBuff = nullptr,
                               uint32_t certBuffSize = 0,
                               uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_ClearClientCaList();
 
bool SSL_ClearServerCaList();
 
uint16_t SSLGetRxBufferSpaceUsed(int fd);
 
uint16_t SSLGetTxBufferAvailSpace(int fd);
 
void SslInit();
 
void SSL_DumpSSLSockets();
 
void SSL_ClientReadyCert(const unsigned char *cert, const unsigned char *key, uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
void SSL_ServerReadyCert(const unsigned char *cert, const unsigned char *key, uint16_t certBuffFormat = SSL_FILETYPE_PEM);
#endif /* NB_SSL_SUPPORTED */
 
// These functions can also be used with SSH, so needed to be exposed there
#if defined(NB_SSL_SUPPORTED) || defined(NB_SSH_SUPPORTED)
enum class ExpireRetCodes : unsigned char
{
    E_CERT_VALID = 0,             
    E_CERT_EXPIRED = 1,           
    E_BAD_EXPIRATION_VALUE = 2,   
    E_NO_SYSTEM_TIME = 3          
};
 
ExpireRetCodes SSL_IsCertExpired(unsigned char *certBuff, int certLen, uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetIssuerFromCert(unsigned char *certBuff,
                           int certLen,
                           unsigned char *issBuf,
                           int issBufLen,
                           uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetSubjectNameFromCert(unsigned char *certBuff,
                                int certLen,
                                unsigned char *subNamBuf,
                                int subNamBufLen,
                                uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetAltNameFromCert(unsigned char *certBuff,
                            int certLen,
                            unsigned char *altNamBuf,
                            int altNamBufLen,
                            uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetExpirationDate(unsigned char *certBuff,
                           int certLen,
                           unsigned char *expBuf,
                           int expBufLen,
                           uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetTimeToExpire(unsigned char *certBuff, int certLen, uint16_t certBuffFormat, time_t &timeToExp);
 
bool SSL_GetCnFromCert(unsigned char *certBuff,
                       int certLen,
                       unsigned char *comNamBuf,
                       int comNamBufLen,
                       uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetSerialFromCert(unsigned char *certBuff,
                           int certLen,
                           unsigned char *serialBuf,
                           int *serialBufLen,
                           uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
const char *GetCertificatePEM();
 
int GetCertificateLen();
 
const char *GetPrivateKeyPEM();
 
int GetPrivateKeyLen();
 
void SslSetVerifyPeerClient(bool verifyPeer);
 
void SslSetVerifyPeerServer(bool verifyPeer);
 
bool SSL_IsCertAddedToClientCaList();
 
bool SSL_IsCertAddedToServerCaList();
#endif /*defined(NB_SSL_SUPPORT) || defined(NB_SSH_SUPPORT)*/
 
#endif /* #ifndef _SSL_H_  */