ssl.h

Go to the documentation of this file.

/*NB_REVISION*/
 
/*NB_COPYRIGHT*/
 
#ifndef _SSL_H_
#define _SSL_H_
 
#include <nettypes.h>
#include <predef.h>
#include <nbrtos.h>
#include <tcp.h>
 
#ifndef WOLFSSL_USER_SETTINGS
#define WOLFSSL_USER_SETTINGS // This wasn't getting defined in the project source files in NBEclipse
#endif
 
#if defined(NB_SSL_SUPPORTED) || defined(NB_SSH_SUPPORTED)
#include <crypto/wolfssl/ssl.h>
#endif
 
#ifdef NB_SSL_SUPPORTED
#include <crypto/wolfssl/error-ssl.h>
#include <random.h>
 
 
/*
 * Module: SSL library
 * Implementing SSL in an embedded system will require some knowledge of SSL
 * certificates. Please see the NetBurner SSL overview doc for what you need
 * to know to get started.
 */
/*
 * SSL network functions can return all of the standard TCP errors:
 * TCP_ERR_TIMEOUT
 * TCP_ERR_NOCON
 * TCP_ERR_CLOSING
 * TCP_ERR_NOSUCH_SOCKET
 * TCP_ERR_NONE_AVAIL
 * TCP_ERR_CON_RESET
 * TCP_ERR_CON_ABORT
 */
 
#define SSL_ERROR_FAILED_NEGOTIATION (-256) 
#define SSL_ERROR_CERTIFICATE_UNKNOWN (-258) 
#define SSL_ERROR_CERTIFICATE_NAME_FAILED (-260) 
#define SSL_ERROR_CERTIFICATE_VERIFY_FAILED (-261) 
#define SSL_ERROR_NO_BUFFER (-262) 
#define SSL_ERROR_HANDSHAKE_INCOMPLETE (-265) 
#define SSL_ERROR_NO_SERVER_CERTIFICATE (-257) 
#define SSL_ERROR_NO_SERVER_KEY (-258) 
#define SSL_ERROR_UNABLE_TO_LOAD_CIPHERS (-259) 
#define SSL_ERROR_CERTIFICATE_CHECK (-260) 
#ifndef SSL_LIB_REPLACEMENT
/* Set this to true to see the names being tested in the certificate tests */
extern BOOL bPrintNamesTested;
#endif
 
/*Functions:*/
 
int SSL_accept(int fdListen,
 IPADDR *address,
 uint16_t *port,
 uint16_t timeout,
 bool waitForNegotiation = true,
 bool verifyPeer = false,
 const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM,
 const char *commonName = nullptr);
#endif
extern BOOL (*IsSSLfd)(int fd);
 
/*
 * brief Return the network interface associated with a TCP socket.
 *
 * param fd Socket file descriptor
 *
 * return The network interface number (undefined for listening sockets)
 */
// int SSL_GetSocketInterface(int fd); This appears to be a duplication (see below)
 
inline IPADDR SSL_GetSocketRemoteAddr(int fd) {return GetSocketRemoteAddr(fd); };
 
inline uint16_t SSL_GetSocketRemotePort(int fd){return GetSocketRemotePort(fd);};
 
inline IPADDR SSL_GetSocketLocalAddr(int fd) {return GetSocketLocalAddr(fd); };
 
 
inline uint16_t SSL_GetSocketLocalPort(int fd){return GetSocketLocalPort(fd);};
 
inline int SSL_GetSocketInterface(int fd){return TcpGetSocketInterface(fd);};
 
extern int (*SSL_GetRawSocket)(int sslSocketFd);
 
extern int (*SSL_setsockoption)(int fd, int option);
 
extern int (*SSL_clrsockoption)(int fd, int option);
 
extern int (*SSL_getsockoption)(int fd);
 
#ifdef NB_SSL_SUPPORTED
inline uint16_t SSL_GetTcpRtxCount(int fd) {return GetTcpRtxCount(fd); };
 
inline uint32_t SSL_TcpGetLastRxTime(int fd) {return TcpGetLastRxTime(fd); };
 
inline uint32_t SSL_TcpGetLastRxInterval(int fd) {return TcpGetLastRxInterval(fd);};
 
inline void SSL_TcpSendKeepAlive(int fd){TcpSendKeepAlive(fd);};
 
bool SSLSocketsAvail();
 
int FreeSSLSockets();
inline short SSL_TcpGetSocketState(int fd) {return TcpGetSocketState(fd); };
 
int SSL_getsocketerror(int fd);
 
int SSL_connect(IPADDR ip,
 uint16_t remotePort,
 uint32_t timeout,
 const char *commonName,
 bool verifyPeer = false,
 bool waitForNegotiation = true,
 const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM,
 int intf = -1);
 
[[deprecated]]int SSL_connect(IPADDR ip,
 uint16_t localPort,
 uint16_t remotePort,
 uint32_t timeout,
 const char *commonName,
 bool verifyPeer = false,
 bool waitForNegotiation = true,
 const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM,
 int intf = -1);
 
 
int SSL_makeSecure(int tcpFd,
 const char *commonName,
 bool verifyPeer = false,
 bool waitForNegotiation = true,
 const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM,
 bool bIsClient = true,
 uint32_t timeout=WAIT_FOREVER);
 
int SSL_negotiate(int tcpFd,
 const char *common_name,
 bool reuseSessionPort = true,
 bool verifyPeer = false,
 const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM,
 bool bIsClient = true);
 
int SSLReadWithTimeout(int fd, char *cp, int size, uint32_t timeout);
 
uint32_t SetMaxSessionReuseTime(uint32_t newLifetimeTicks);
 
bool IsSSL_CertNKeyValid(const char *keyPEM,
 ssize_t keylen,
 const char *certPEM,
 ssize_t certlen,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_AddCertToClientCaList(const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_AddCertToServerCaList(const unsigned char *certBuff = nullptr,
 uint32_t certBuffSize = 0,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_ClearClientCaList();
 
bool SSL_ClearServerCaList();
 
uint16_t SSLGetRxBufferSpaceUsed(int fd);
 
uint16_t SSLGetTxBufferAvailSpace(int fd);
 
void SslInit();
 
void SSL_DumpSSLSockets();
 
void SSL_ClientReadyCert(const unsigned char *cert, const unsigned char *key, uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
void SSL_ServerReadyCert(const unsigned char *cert, const unsigned char *key, uint16_t certBuffFormat = SSL_FILETYPE_PEM);
#endif /* NB_SSL_SUPPORTED */
 
// These functions can also be used with SSH, so needed to be exposed there
#if defined(NB_SSL_SUPPORTED) || defined(NB_SSH_SUPPORTED)
enum class ExpireRetCodes : unsigned char
{
 E_CERT_VALID = 0, 
 E_CERT_EXPIRED = 1, 
 E_BAD_EXPIRATION_VALUE = 2, 
 E_NO_SYSTEM_TIME = 3 
};
 
ExpireRetCodes SSL_IsCertExpired(unsigned char *certBuff, int certLen, uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetIssuerFromCert(unsigned char *certBuff,
 int certLen,
 unsigned char *issBuf,
 int issBufLen,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetSubjectNameFromCert(unsigned char *certBuff,
 int certLen,
 unsigned char *subNamBuf,
 int subNamBufLen,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetAltNameFromCert(unsigned char *certBuff,
 int certLen,
 unsigned char *altNamBuf,
 int altNamBufLen,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetExpirationDate(unsigned char *certBuff,
 int certLen,
 unsigned char *expBuf,
 int expBufLen,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
bool SSL_GetTimeToExpire(unsigned char *certBuff, int certLen, uint16_t certBuffFormat, time_t &timeToExp);
 
bool SSL_GetCnFromCert(unsigned char *certBuff,
 int certLen,
 unsigned char *comNamBuf,
 int comNamBufLen,
 uint16_t certBuffFormat = SSL_FILETYPE_PEM);
 
const char *GetCertificatePEM();
 
int GetCertificateLen();
 
const char *GetPrivateKeyPEM();
 
int GetPrivateKeyLen();
 
void SslSetVerifyPeerClient(bool verifyPeer);
 
void SslSetVerifyPeerServer(bool verifyPeer);
 
bool SSL_IsCertAddedToClientCaList();
 
bool SSL_IsCertAddedToServerCaList();
#endif /*defined(NB_SSL_SUPPORT) || defined(NB_SSH_SUPPORT)*/
 
#endif /* #ifndef _SSL_H_ */