1 ebfc5784 2024-01-07 op /* $OpenBSD: tls_internal.h,v 1.83 2023/06/27 18:19:59 tb Exp $ */
  2 f9ab77a8 2023-08-23 op /*
  3 f9ab77a8 2023-08-23 op  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  4 f9ab77a8 2023-08-23 op  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  5 f9ab77a8 2023-08-23 op  *
  6 f9ab77a8 2023-08-23 op  * Permission to use, copy, modify, and distribute this software for any
  7 f9ab77a8 2023-08-23 op  * purpose with or without fee is hereby granted, provided that the above
  8 f9ab77a8 2023-08-23 op  * copyright notice and this permission notice appear in all copies.
  9 f9ab77a8 2023-08-23 op  *
 10 f9ab77a8 2023-08-23 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 11 f9ab77a8 2023-08-23 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 12 f9ab77a8 2023-08-23 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 13 f9ab77a8 2023-08-23 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 14 f9ab77a8 2023-08-23 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 15 f9ab77a8 2023-08-23 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 16 f9ab77a8 2023-08-23 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 17 f9ab77a8 2023-08-23 op  */
 18 f9ab77a8 2023-08-23 op 
 19 f9ab77a8 2023-08-23 op #ifndef HEADER_TLS_INTERNAL_H
 20 f9ab77a8 2023-08-23 op #define HEADER_TLS_INTERNAL_H
 21 f9ab77a8 2023-08-23 op 
 22 f9ab77a8 2023-08-23 op #include <arpa/inet.h>
 23 f9ab77a8 2023-08-23 op #include <netinet/in.h>
 24 f9ab77a8 2023-08-23 op 
 25 f9ab77a8 2023-08-23 op #include <openssl/ssl.h>
 26 f9ab77a8 2023-08-23 op 
 27 f9ab77a8 2023-08-23 op #define TLS_CIPHERS_DEFAULT	TLS_CIPHERS_COMPAT
 28 f9ab77a8 2023-08-23 op #define TLS_CIPHERS_COMPAT	"HIGH:!aNULL"
 29 f9ab77a8 2023-08-23 op #define TLS_CIPHERS_LEGACY	"HIGH:MEDIUM:!aNULL"
 30 f9ab77a8 2023-08-23 op #define TLS_CIPHERS_ALL		"ALL:!aNULL:!eNULL"
 31 f9ab77a8 2023-08-23 op 
 32 f9ab77a8 2023-08-23 op #define TLS_ECDHE_CURVES	"X25519,P-256,P-384"
 33 f9ab77a8 2023-08-23 op 
 34 f9ab77a8 2023-08-23 op union tls_addr {
 35 f9ab77a8 2023-08-23 op 	struct in_addr ip4;
 36 f9ab77a8 2023-08-23 op 	struct in6_addr ip6;
 37 f9ab77a8 2023-08-23 op };
 38 f9ab77a8 2023-08-23 op 
 39 f9ab77a8 2023-08-23 op struct tls_error {
 40 f9ab77a8 2023-08-23 op 	char *msg;
 41 f9ab77a8 2023-08-23 op 	int num;
 42 f9ab77a8 2023-08-23 op 	int tls;
 43 f9ab77a8 2023-08-23 op };
 44 f9ab77a8 2023-08-23 op 
 45 f9ab77a8 2023-08-23 op struct tls_keypair {
 46 f9ab77a8 2023-08-23 op 	struct tls_keypair *next;
 47 f9ab77a8 2023-08-23 op 
 48 f9ab77a8 2023-08-23 op 	char *cert_mem;
 49 f9ab77a8 2023-08-23 op 	size_t cert_len;
 50 f9ab77a8 2023-08-23 op 	char *key_mem;
 51 f9ab77a8 2023-08-23 op 	size_t key_len;
 52 f9ab77a8 2023-08-23 op 	char *ocsp_staple;
 53 f9ab77a8 2023-08-23 op 	size_t ocsp_staple_len;
 54 f9ab77a8 2023-08-23 op 	char *pubkey_hash;
 55 f9ab77a8 2023-08-23 op };
 56 f9ab77a8 2023-08-23 op 
 57 f9ab77a8 2023-08-23 op #define TLS_MIN_SESSION_TIMEOUT (4)
 58 f9ab77a8 2023-08-23 op #define TLS_MAX_SESSION_TIMEOUT (24 * 60 * 60)
 59 f9ab77a8 2023-08-23 op 
 60 f9ab77a8 2023-08-23 op #define TLS_NUM_TICKETS				4
 61 f9ab77a8 2023-08-23 op #define TLS_TICKET_NAME_SIZE			16
 62 f9ab77a8 2023-08-23 op #define TLS_TICKET_AES_SIZE			32
 63 f9ab77a8 2023-08-23 op #define TLS_TICKET_HMAC_SIZE			16
 64 f9ab77a8 2023-08-23 op 
 65 f9ab77a8 2023-08-23 op struct tls_ticket_key {
 66 f9ab77a8 2023-08-23 op 	/* The key_name must be 16 bytes according to -lssl */
 67 f9ab77a8 2023-08-23 op 	unsigned char	key_name[TLS_TICKET_NAME_SIZE];
 68 f9ab77a8 2023-08-23 op 	unsigned char	aes_key[TLS_TICKET_AES_SIZE];
 69 f9ab77a8 2023-08-23 op 	unsigned char	hmac_key[TLS_TICKET_HMAC_SIZE];
 70 f9ab77a8 2023-08-23 op 	time_t		time;
 71 f9ab77a8 2023-08-23 op };
 72 f9ab77a8 2023-08-23 op 
 73 ebfc5784 2024-01-07 op typedef int (*tls_sign_cb)(void *_cb_arg, const char *_pubkey_hash,
 74 ebfc5784 2024-01-07 op     const uint8_t *_input, size_t _input_len, int _padding_type,
 75 ebfc5784 2024-01-07 op     uint8_t **_out_signature, size_t *_out_signature_len);
 76 ebfc5784 2024-01-07 op 
 77 f9ab77a8 2023-08-23 op struct tls_config {
 78 f9ab77a8 2023-08-23 op 	struct tls_error error;
 79 f9ab77a8 2023-08-23 op 
 80 f9ab77a8 2023-08-23 op 	int refcount;
 81 f9ab77a8 2023-08-23 op 
 82 f9ab77a8 2023-08-23 op 	char *alpn;
 83 f9ab77a8 2023-08-23 op 	size_t alpn_len;
 84 f9ab77a8 2023-08-23 op 	const char *ca_path;
 85 f9ab77a8 2023-08-23 op 	char *ca_mem;
 86 f9ab77a8 2023-08-23 op 	size_t ca_len;
 87 f9ab77a8 2023-08-23 op 	const char *ciphers;
 88 f9ab77a8 2023-08-23 op 	int ciphers_server;
 89 f9ab77a8 2023-08-23 op 	char *crl_mem;
 90 f9ab77a8 2023-08-23 op 	size_t crl_len;
 91 f9ab77a8 2023-08-23 op 	int dheparams;
 92 f9ab77a8 2023-08-23 op 	int *ecdhecurves;
 93 f9ab77a8 2023-08-23 op 	size_t ecdhecurves_len;
 94 f9ab77a8 2023-08-23 op 	struct tls_keypair *keypair;
 95 f9ab77a8 2023-08-23 op 	int ocsp_require_stapling;
 96 f9ab77a8 2023-08-23 op 	uint32_t protocols;
 97 f9ab77a8 2023-08-23 op 	unsigned char session_id[TLS_MAX_SESSION_ID_LENGTH];
 98 f9ab77a8 2023-08-23 op 	int session_fd;
 99 f9ab77a8 2023-08-23 op 	int session_lifetime;
100 f9ab77a8 2023-08-23 op 	struct tls_ticket_key ticket_keys[TLS_NUM_TICKETS];
101 f9ab77a8 2023-08-23 op 	uint32_t ticket_keyrev;
102 f9ab77a8 2023-08-23 op 	int ticket_autorekey;
103 f9ab77a8 2023-08-23 op 	int verify_cert;
104 f9ab77a8 2023-08-23 op 	int verify_client;
105 f9ab77a8 2023-08-23 op 	int verify_depth;
106 f9ab77a8 2023-08-23 op 	int verify_name;
107 f9ab77a8 2023-08-23 op 	int verify_time;
108 f9ab77a8 2023-08-23 op 	int skip_private_key_check;
109 f9ab77a8 2023-08-23 op 	int use_fake_private_key;
110 ebfc5784 2024-01-07 op 	tls_sign_cb sign_cb;
111 ebfc5784 2024-01-07 op 	void *sign_cb_arg;
112 f9ab77a8 2023-08-23 op };
113 f9ab77a8 2023-08-23 op 
114 f9ab77a8 2023-08-23 op struct tls_conninfo {
115 f9ab77a8 2023-08-23 op 	char *alpn;
116 f9ab77a8 2023-08-23 op 	char *cipher;
117 f9ab77a8 2023-08-23 op 	int cipher_strength;
118 f9ab77a8 2023-08-23 op 	char *servername;
119 f9ab77a8 2023-08-23 op 	int session_resumed;
120 f9ab77a8 2023-08-23 op 	char *version;
121 f9ab77a8 2023-08-23 op 
122 f9ab77a8 2023-08-23 op 	char *hash;
123 f9ab77a8 2023-08-23 op 	char *issuer;
124 f9ab77a8 2023-08-23 op 	char *subject;
125 f9ab77a8 2023-08-23 op 
126 f9ab77a8 2023-08-23 op 	uint8_t *peer_cert;
127 f9ab77a8 2023-08-23 op 	size_t peer_cert_len;
128 f9ab77a8 2023-08-23 op 
129 f9ab77a8 2023-08-23 op 	time_t notbefore;
130 f9ab77a8 2023-08-23 op 	time_t notafter;
131 f9ab77a8 2023-08-23 op };
132 f9ab77a8 2023-08-23 op 
133 f9ab77a8 2023-08-23 op #define TLS_CLIENT		(1 << 0)
134 f9ab77a8 2023-08-23 op #define TLS_SERVER		(1 << 1)
135 f9ab77a8 2023-08-23 op #define TLS_SERVER_CONN		(1 << 2)
136 f9ab77a8 2023-08-23 op 
137 f9ab77a8 2023-08-23 op #define TLS_EOF_NO_CLOSE_NOTIFY	(1 << 0)
138 f9ab77a8 2023-08-23 op #define TLS_CONNECTED		(1 << 1)
139 f9ab77a8 2023-08-23 op #define TLS_HANDSHAKE_COMPLETE	(1 << 2)
140 f9ab77a8 2023-08-23 op #define TLS_SSL_NEEDS_SHUTDOWN	(1 << 3)
141 f9ab77a8 2023-08-23 op 
142 f9ab77a8 2023-08-23 op struct tls_ocsp_result {
143 f9ab77a8 2023-08-23 op 	const char *result_msg;
144 f9ab77a8 2023-08-23 op 	int response_status;
145 f9ab77a8 2023-08-23 op 	int cert_status;
146 f9ab77a8 2023-08-23 op 	int crl_reason;
147 f9ab77a8 2023-08-23 op 	time_t this_update;
148 f9ab77a8 2023-08-23 op 	time_t next_update;
149 f9ab77a8 2023-08-23 op 	time_t revocation_time;
150 f9ab77a8 2023-08-23 op };
151 f9ab77a8 2023-08-23 op 
152 f9ab77a8 2023-08-23 op struct tls_ocsp {
153 f9ab77a8 2023-08-23 op 	/* responder location */
154 f9ab77a8 2023-08-23 op 	char *ocsp_url;
155 f9ab77a8 2023-08-23 op 
156 f9ab77a8 2023-08-23 op 	/* cert data, this struct does not own these */
157 f9ab77a8 2023-08-23 op 	X509 *main_cert;
158 f9ab77a8 2023-08-23 op 	STACK_OF(X509) *extra_certs;
159 f9ab77a8 2023-08-23 op 
160 f9ab77a8 2023-08-23 op 	struct tls_ocsp_result *ocsp_result;
161 f9ab77a8 2023-08-23 op };
162 f9ab77a8 2023-08-23 op 
163 f9ab77a8 2023-08-23 op struct tls_sni_ctx {
164 f9ab77a8 2023-08-23 op 	struct tls_sni_ctx *next;
165 f9ab77a8 2023-08-23 op 
166 f9ab77a8 2023-08-23 op 	struct tls_keypair *keypair;
167 f9ab77a8 2023-08-23 op 
168 f9ab77a8 2023-08-23 op 	SSL_CTX *ssl_ctx;
169 f9ab77a8 2023-08-23 op 	X509 *ssl_cert;
170 f9ab77a8 2023-08-23 op };
171 f9ab77a8 2023-08-23 op 
172 f9ab77a8 2023-08-23 op struct tls {
173 f9ab77a8 2023-08-23 op 	struct tls_config *config;
174 f9ab77a8 2023-08-23 op 	struct tls_keypair *keypair;
175 f9ab77a8 2023-08-23 op 
176 f9ab77a8 2023-08-23 op 	struct tls_error error;
177 f9ab77a8 2023-08-23 op 
178 f9ab77a8 2023-08-23 op 	uint32_t flags;
179 f9ab77a8 2023-08-23 op 	uint32_t state;
180 f9ab77a8 2023-08-23 op 
181 f9ab77a8 2023-08-23 op 	char *servername;
182 f9ab77a8 2023-08-23 op 	int socket;
183 f9ab77a8 2023-08-23 op 
184 f9ab77a8 2023-08-23 op 	SSL *ssl_conn;
185 f9ab77a8 2023-08-23 op 	SSL_CTX *ssl_ctx;
186 f9ab77a8 2023-08-23 op 
187 f9ab77a8 2023-08-23 op 	struct tls_sni_ctx *sni_ctx;
188 f9ab77a8 2023-08-23 op 
189 f9ab77a8 2023-08-23 op 	X509 *ssl_peer_cert;
190 f9ab77a8 2023-08-23 op 	STACK_OF(X509) *ssl_peer_chain;
191 f9ab77a8 2023-08-23 op 
192 f9ab77a8 2023-08-23 op 	struct tls_conninfo *conninfo;
193 f9ab77a8 2023-08-23 op 
194 f9ab77a8 2023-08-23 op 	struct tls_ocsp *ocsp;
195 f9ab77a8 2023-08-23 op 
196 f9ab77a8 2023-08-23 op 	tls_read_cb read_cb;
197 f9ab77a8 2023-08-23 op 	tls_write_cb write_cb;
198 f9ab77a8 2023-08-23 op 	void *cb_arg;
199 f9ab77a8 2023-08-23 op };
200 f9ab77a8 2023-08-23 op 
201 f9ab77a8 2023-08-23 op int tls_set_mem(char **_dest, size_t *_destlen, const void *_src,
202 f9ab77a8 2023-08-23 op     size_t _srclen);
203 f9ab77a8 2023-08-23 op int tls_set_string(const char **_dest, const char *_src);
204 f9ab77a8 2023-08-23 op 
205 f9ab77a8 2023-08-23 op struct tls_keypair *tls_keypair_new(void);
206 f9ab77a8 2023-08-23 op void tls_keypair_clear_key(struct tls_keypair *_keypair);
207 f9ab77a8 2023-08-23 op void tls_keypair_free(struct tls_keypair *_keypair);
208 f9ab77a8 2023-08-23 op int tls_keypair_set_cert_file(struct tls_keypair *_keypair,
209 f9ab77a8 2023-08-23 op     struct tls_error *_error, const char *_cert_file);
210 f9ab77a8 2023-08-23 op int tls_keypair_set_cert_mem(struct tls_keypair *_keypair,
211 f9ab77a8 2023-08-23 op     struct tls_error *_error, const uint8_t *_cert, size_t _len);
212 f9ab77a8 2023-08-23 op int tls_keypair_set_key_file(struct tls_keypair *_keypair,
213 f9ab77a8 2023-08-23 op     struct tls_error *_error, const char *_key_file);
214 f9ab77a8 2023-08-23 op int tls_keypair_set_key_mem(struct tls_keypair *_keypair,
215 f9ab77a8 2023-08-23 op     struct tls_error *_error, const uint8_t *_key, size_t _len);
216 f9ab77a8 2023-08-23 op int tls_keypair_set_ocsp_staple_file(struct tls_keypair *_keypair,
217 f9ab77a8 2023-08-23 op     struct tls_error *_error, const char *_ocsp_file);
218 f9ab77a8 2023-08-23 op int tls_keypair_set_ocsp_staple_mem(struct tls_keypair *_keypair,
219 f9ab77a8 2023-08-23 op     struct tls_error *_error, const uint8_t *_staple, size_t _len);
220 f9ab77a8 2023-08-23 op int tls_keypair_load_cert(struct tls_keypair *_keypair,
221 f9ab77a8 2023-08-23 op     struct tls_error *_error, X509 **_cert);
222 f9ab77a8 2023-08-23 op 
223 f9ab77a8 2023-08-23 op struct tls_sni_ctx *tls_sni_ctx_new(void);
224 f9ab77a8 2023-08-23 op void tls_sni_ctx_free(struct tls_sni_ctx *sni_ctx);
225 f9ab77a8 2023-08-23 op 
226 f9ab77a8 2023-08-23 op struct tls_config *tls_config_new_internal(void);
227 f9ab77a8 2023-08-23 op 
228 f9ab77a8 2023-08-23 op struct tls *tls_new(void);
229 f9ab77a8 2023-08-23 op struct tls *tls_server_conn(struct tls *ctx);
230 f9ab77a8 2023-08-23 op 
231 f9ab77a8 2023-08-23 op int tls_check_name(struct tls *ctx, X509 *cert, const char *servername,
232 f9ab77a8 2023-08-23 op     int *match);
233 f9ab77a8 2023-08-23 op int tls_configure_server(struct tls *ctx);
234 f9ab77a8 2023-08-23 op 
235 f9ab77a8 2023-08-23 op int tls_configure_ssl(struct tls *ctx, SSL_CTX *ssl_ctx);
236 f9ab77a8 2023-08-23 op int tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
237 f9ab77a8 2023-08-23 op     struct tls_keypair *keypair, int required);
238 f9ab77a8 2023-08-23 op int tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify);
239 f9ab77a8 2023-08-23 op 
240 f9ab77a8 2023-08-23 op int tls_handshake_client(struct tls *ctx);
241 f9ab77a8 2023-08-23 op int tls_handshake_server(struct tls *ctx);
242 f9ab77a8 2023-08-23 op 
243 f9ab77a8 2023-08-23 op int tls_config_load_file(struct tls_error *error, const char *filetype,
244 f9ab77a8 2023-08-23 op     const char *filename, char **buf, size_t *len);
245 f9ab77a8 2023-08-23 op int tls_config_ticket_autorekey(struct tls_config *config);
246 f9ab77a8 2023-08-23 op int tls_host_port(const char *hostport, char **host, char **port);
247 f9ab77a8 2023-08-23 op 
248 f9ab77a8 2023-08-23 op int tls_set_cbs(struct tls *ctx,
249 f9ab77a8 2023-08-23 op     tls_read_cb read_cb, tls_write_cb write_cb, void *cb_arg);
250 f9ab77a8 2023-08-23 op 
251 f9ab77a8 2023-08-23 op void tls_error_clear(struct tls_error *error);
252 f9ab77a8 2023-08-23 op int tls_error_set(struct tls_error *error, const char *fmt, ...)
253 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
254 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
255 f9ab77a8 2023-08-23 op int tls_error_setx(struct tls_error *error, const char *fmt, ...)
256 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
257 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
258 f9ab77a8 2023-08-23 op int tls_config_set_error(struct tls_config *cfg, const char *fmt, ...)
259 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
260 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
261 f9ab77a8 2023-08-23 op int tls_config_set_errorx(struct tls_config *cfg, const char *fmt, ...)
262 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
263 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
264 f9ab77a8 2023-08-23 op int tls_set_error(struct tls *ctx, const char *fmt, ...)
265 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
266 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
267 f9ab77a8 2023-08-23 op int tls_set_errorx(struct tls *ctx, const char *fmt, ...)
268 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
269 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
270 f9ab77a8 2023-08-23 op int tls_set_ssl_errorx(struct tls *ctx, const char *fmt, ...)
271 f9ab77a8 2023-08-23 op     __attribute__((__format__ (printf, 2, 3)))
272 f9ab77a8 2023-08-23 op     __attribute__((__nonnull__ (2)));
273 f9ab77a8 2023-08-23 op 
274 f9ab77a8 2023-08-23 op int tls_ssl_error(struct tls *ctx, SSL *ssl_conn, int ssl_ret,
275 f9ab77a8 2023-08-23 op     const char *prefix);
276 f9ab77a8 2023-08-23 op 
277 f9ab77a8 2023-08-23 op int tls_conninfo_populate(struct tls *ctx);
278 f9ab77a8 2023-08-23 op void tls_conninfo_free(struct tls_conninfo *conninfo);
279 f9ab77a8 2023-08-23 op 
280 f9ab77a8 2023-08-23 op int tls_ocsp_verify_cb(SSL *ssl, void *arg);
281 f9ab77a8 2023-08-23 op int tls_ocsp_stapling_cb(SSL *ssl, void *arg);
282 f9ab77a8 2023-08-23 op void tls_ocsp_free(struct tls_ocsp *ctx);
283 f9ab77a8 2023-08-23 op struct tls_ocsp *tls_ocsp_setup_from_peer(struct tls *ctx);
284 f9ab77a8 2023-08-23 op int tls_hex_string(const unsigned char *_in, size_t _inlen, char **_out,
285 f9ab77a8 2023-08-23 op     size_t *_outlen);
286 f9ab77a8 2023-08-23 op int tls_cert_hash(X509 *_cert, char **_hash);
287 f9ab77a8 2023-08-23 op int tls_cert_pubkey_hash(X509 *_cert, char **_hash);
288 f9ab77a8 2023-08-23 op 
289 f9ab77a8 2023-08-23 op int tls_password_cb(char *_buf, int _size, int _rwflag, void *_u);
290 f9ab77a8 2023-08-23 op 
291 ebfc5784 2024-01-07 op RSA_METHOD *tls_signer_rsa_method(void);
292 ebfc5784 2024-01-07 op EC_KEY_METHOD *tls_signer_ecdsa_method(void);
293 ebfc5784 2024-01-07 op 
294 ebfc5784 2024-01-07 op #define TLS_PADDING_NONE			0
295 ebfc5784 2024-01-07 op #define TLS_PADDING_RSA_PKCS1			1
296 ebfc5784 2024-01-07 op 
297 ebfc5784 2024-01-07 op int tls_config_set_sign_cb(struct tls_config *_config, tls_sign_cb _cb,
298 ebfc5784 2024-01-07 op     void *_cb_arg);
299 ebfc5784 2024-01-07 op 
300 ebfc5784 2024-01-07 op struct tls_signer* tls_signer_new(void);
301 ebfc5784 2024-01-07 op void tls_signer_free(struct tls_signer * _signer);
302 ebfc5784 2024-01-07 op const char *tls_signer_error(struct tls_signer * _signer);
303 ebfc5784 2024-01-07 op int tls_signer_add_keypair_file(struct tls_signer *_signer,
304 ebfc5784 2024-01-07 op     const char *_cert_file, const char *_key_file);
305 ebfc5784 2024-01-07 op int tls_signer_add_keypair_mem(struct tls_signer *_signer, const uint8_t *_cert,
306 ebfc5784 2024-01-07 op     size_t _cert_len, const uint8_t *_key, size_t _key_len);
307 ebfc5784 2024-01-07 op int tls_signer_sign(struct tls_signer *_signer, const char *_pubkey_hash,
308 ebfc5784 2024-01-07 op     const uint8_t *_input, size_t _input_len, int _padding_type,
309 ebfc5784 2024-01-07 op     uint8_t **_out_signature, size_t *_out_signature_len);
310 ebfc5784 2024-01-07 op 
311 f9ab77a8 2023-08-23 op /* XXX this function is not fully hidden so relayd can use it */
312 f9ab77a8 2023-08-23 op void tls_config_skip_private_key_check(struct tls_config *config);
313 f9ab77a8 2023-08-23 op void tls_config_use_fake_private_key(struct tls_config *config);
314 f9ab77a8 2023-08-23 op 
315 f9ab77a8 2023-08-23 op #ifndef HAVE_SSL_CTX_USE_CERTIFICATE_CHAIN_MEM
316 f9ab77a8 2023-08-23 op int SSL_CTX_use_certificate_chain_mem(SSL_CTX *, void *, int);
317 f9ab77a8 2023-08-23 op #endif
318 f9ab77a8 2023-08-23 op 
319 f9ab77a8 2023-08-23 op #ifndef HAVE_SSL_CTX_LOAD_VERIFY_MEM
320 f9ab77a8 2023-08-23 op int SSL_CTX_load_verify_mem(SSL_CTX *, void *, int);
321 f9ab77a8 2023-08-23 op #endif
322 f9ab77a8 2023-08-23 op 
323 f9ab77a8 2023-08-23 op #endif /* HEADER_TLS_INTERNAL_H */