author | Tero Marttila <terom@fixme.fi> |
Thu, 21 May 2009 16:57:56 +0300 | |
changeset 213 | f0e52e026197 |
parent 180 | 22967b165692 |
permissions | -rw-r--r-- |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
1 |
#ifndef SSL_H |
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
2 |
#define SSL_H |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
3 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
4 |
/** |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
5 |
* @file |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
6 |
* |
155
c59d3eaff0fb
most of the new transport/sock code compiles, but things are still missing
Tero Marttila <terom@fixme.fi>
parents:
140
diff
changeset
|
7 |
* SSL transport implementation. |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
8 |
*/ |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
9 |
#include "transport.h" |
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
10 |
#include <stdbool.h> |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
11 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
12 |
/** |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
13 |
* SSL client credentials for use with ssl_client_credentials/sock_ssl_connect |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
14 |
*/ |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
15 |
struct ssl_client_cred; |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
16 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
17 |
/** |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
18 |
* Set up SSL client credentials for use with sock_ssl_connect. This includes information both required to identify |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
19 |
* ourselves to the server, as well as to verify the server. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
20 |
* |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
21 |
* To verify the server's certificate, pass in a path to a file containing the CA certificate(s) that should be used to |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
22 |
* verify the server's certificate, and then either give `verify` as true to force verification, or false to simply |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
23 |
* warn. XXX: not entirely true |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
24 |
* |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
25 |
* To supply a client certificate to the server, pass in the paths to the cert/pkey files. If given as NULL, an |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
26 |
* anonymous client certificate will be used. Both must be supplied if given. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
27 |
* |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
28 |
* The newly created SSL client credential will initially have a refcount of one, and can then be used with sock_ssl_connect. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
29 |
* |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
30 |
* @param ctx_cred the newly created client credentials are returned via this |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
31 |
* @param cafile_path given as non-NULL to load trusted certs for verification from the given path |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
32 |
* @param verify force verification of the peer cert |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
33 |
* @param cert_path path to the client certificate file, or NULL |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
34 |
* @param pkey_path path to the client private key, or NULL |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
35 |
* @param err returned error info |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
36 |
*/ |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
37 |
err_t ssl_client_cred_create (struct ssl_client_cred **ctx_cred, |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
38 |
const char *cafile_path, bool verify, |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
39 |
const char *cert_path, const char *pkey_path, |
155
c59d3eaff0fb
most of the new transport/sock code compiles, but things are still missing
Tero Marttila <terom@fixme.fi>
parents:
140
diff
changeset
|
40 |
error_t *err |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
41 |
); |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
42 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
43 |
/** |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
44 |
* Aquire a referenec for the given cred. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
45 |
*/ |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
46 |
void ssl_client_cred_get (struct ssl_client_cred *cred); |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
47 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
48 |
/** |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
49 |
* Release a reference allocated for the given cred. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
50 |
*/ |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
51 |
void ssl_client_cred_put (struct ssl_client_cred *cred); |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
52 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
53 |
/** |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
54 |
* Start a non-blocking SSL connect/handshake to the given host/service. The socket will not yet be connected when the |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
55 |
* function returns, but rather, the eventual redyness/failure of the connect/handshake will be indicated later using |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
56 |
* the given \a cb_func. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
57 |
* |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
58 |
* The given ssl_client_cred should either be NULL to use an anonymous client cert and not verify the server cert, |
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
59 |
* or a ssl_client_cred allocated using ssl_client_cred_create(). The contexts are reference-counted, so once |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
60 |
* a cred context has been released, it will be destroyed once the last connection using it is destroyed. |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
61 |
* |
155
c59d3eaff0fb
most of the new transport/sock code compiles, but things are still missing
Tero Marttila <terom@fixme.fi>
parents:
140
diff
changeset
|
62 |
* @param info the transport setup info |
c59d3eaff0fb
most of the new transport/sock code compiles, but things are still missing
Tero Marttila <terom@fixme.fi>
parents:
140
diff
changeset
|
63 |
* @param transport_ptr returned transport |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
64 |
* @param hostname the hostname to connect to |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
65 |
* @param service the TCP service name (i.e. port) to connect to |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
66 |
* @param cred the SSL client credentials to use, if not NULL |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
67 |
* @param err returned error info |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
68 |
*/ |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
69 |
err_t ssl_connect (const struct transport_info *info, transport_t **transport_ptr, |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
70 |
const char *hostname, const char *service, |
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
71 |
struct ssl_client_cred *cred, |
155
c59d3eaff0fb
most of the new transport/sock code compiles, but things are still missing
Tero Marttila <terom@fixme.fi>
parents:
140
diff
changeset
|
72 |
error_t *err |
140
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
73 |
); |
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
74 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
75 |
|
aa390e52eda8
implement ssl_cafile/verify/cert/pkey for x509 credentials
Tero Marttila <terom@fixme.fi>
parents:
diff
changeset
|
76 |
|
180
22967b165692
rename sock_ssl/sock_gnutls -> ssl/ssl_client
Tero Marttila <terom@fixme.fi>
parents:
155
diff
changeset
|
77 |
#endif /* SSL_H */ |