sslt.h (22116B)
1 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ 2 /* 3 * This file contains prototypes for the public SSL functions. 4 * 5 * This Source Code Form is subject to the terms of the Mozilla Public 6 * License, v. 2.0. If a copy of the MPL was not distributed with this 7 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 8 9 #ifndef __sslt_h_ 10 #define __sslt_h_ 11 12 #include "certt.h" 13 #include "keyhi.h" 14 #include "prtypes.h" 15 #include "secitem.h" 16 17 typedef enum { 18 ssl_hs_hello_request = 0, 19 ssl_hs_client_hello = 1, 20 ssl_hs_server_hello = 2, 21 ssl_hs_hello_verify_request = 3, 22 ssl_hs_new_session_ticket = 4, 23 ssl_hs_end_of_early_data = 5, 24 ssl_hs_hello_retry_request = 6, 25 ssl_hs_encrypted_extensions = 8, 26 ssl_hs_certificate = 11, 27 ssl_hs_server_key_exchange = 12, 28 ssl_hs_certificate_request = 13, 29 ssl_hs_server_hello_done = 14, 30 ssl_hs_certificate_verify = 15, 31 ssl_hs_client_key_exchange = 16, 32 ssl_hs_finished = 20, 33 ssl_hs_certificate_status = 22, 34 ssl_hs_key_update = 24, 35 ssl_hs_compressed_certificate = 25, 36 ssl_hs_next_proto = 67, 37 ssl_hs_message_hash = 254, /* Not a real message. */ 38 ssl_hs_ech_outer_client_hello = 257, /* Not a real message. */ 39 } SSLHandshakeType; 40 41 typedef enum { 42 ssl_ct_change_cipher_spec = 20, 43 ssl_ct_alert = 21, 44 ssl_ct_handshake = 22, 45 ssl_ct_application_data = 23, 46 ssl_ct_ack = 26 47 } SSLContentType; 48 49 typedef enum { 50 ssl_secret_read = 1, 51 ssl_secret_write = 2, 52 } SSLSecretDirection; 53 54 typedef struct SSL3StatisticsStr { 55 /* statistics from ssl3_SendClientHello (sch) */ 56 long sch_sid_cache_hits; 57 long sch_sid_cache_misses; 58 long sch_sid_cache_not_ok; 59 60 /* statistics from ssl3_HandleServerHello (hsh) */ 61 long hsh_sid_cache_hits; 62 long hsh_sid_cache_misses; 63 long hsh_sid_cache_not_ok; 64 65 /* statistics from ssl3_HandleClientHello (hch) */ 66 long hch_sid_cache_hits; 67 long hch_sid_cache_misses; 68 long hch_sid_cache_not_ok; 69 70 /* statistics related to stateless resume */ 71 long sch_sid_stateless_resumes; 72 long hsh_sid_stateless_resumes; 73 long hch_sid_stateless_resumes; 74 long hch_sid_ticket_parse_failures; 75 } SSL3Statistics; 76 77 /* Key Exchange algorithm values */ 78 typedef enum { 79 ssl_kea_null = 0, 80 ssl_kea_rsa = 1, 81 ssl_kea_dh = 2, 82 ssl_kea_fortezza = 3, /* deprecated, now unused */ 83 ssl_kea_ecdh = 4, 84 ssl_kea_ecdh_psk = 5, 85 ssl_kea_dh_psk = 6, 86 ssl_kea_tls13_any = 7, 87 ssl_kea_ecdh_hybrid = 8, 88 ssl_kea_ecdh_hybrid_psk = 9, 89 ssl_kea_size /* number of ssl_kea_ algorithms */ 90 } SSLKEAType; 91 92 /* The following defines are for backwards compatibility. 93 ** They will be removed in a forthcoming release to reduce namespace pollution. 94 ** programs that use the kt_ symbols should convert to the ssl_kt_ symbols 95 ** soon. 96 */ 97 #define kt_null ssl_kea_null 98 #define kt_rsa ssl_kea_rsa 99 #define kt_dh ssl_kea_dh 100 #define kt_fortezza ssl_kea_fortezza /* deprecated, now unused */ 101 #define kt_ecdh ssl_kea_ecdh 102 #define kt_kea_size ssl_kea_size 103 104 /* Values of this enum match the SignatureAlgorithm enum from 105 * https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ 106 typedef enum { 107 ssl_sign_null = 0, /* "anonymous" in TLS */ 108 ssl_sign_rsa = 1, 109 ssl_sign_dsa = 2, 110 ssl_sign_ecdsa = 3 111 } SSLSignType; 112 113 /* Values of this enum match the HashAlgorithm enum from 114 * https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ 115 typedef enum { 116 /* ssl_hash_none is used internally to mean the pre-1.2 combination of MD5 117 * and SHA1. The other values are only used in TLS 1.2. */ 118 ssl_hash_none = 0, 119 ssl_hash_md5 = 1, 120 ssl_hash_sha1 = 2, 121 ssl_hash_sha224 = 3, 122 ssl_hash_sha256 = 4, 123 ssl_hash_sha384 = 5, 124 ssl_hash_sha512 = 6 125 } SSLHashType; 126 127 /* Deprecated */ 128 typedef struct SSLSignatureAndHashAlgStr { 129 SSLHashType hashAlg; 130 SSLSignType sigAlg; 131 } SSLSignatureAndHashAlg; 132 133 typedef enum { 134 ssl_sig_none = 0, 135 ssl_sig_rsa_pkcs1_sha1 = 0x0201, 136 ssl_sig_rsa_pkcs1_sha256 = 0x0401, 137 ssl_sig_rsa_pkcs1_sha384 = 0x0501, 138 ssl_sig_rsa_pkcs1_sha512 = 0x0601, 139 /* For ECDSA, the pairing of the hash with a specific curve is only enforced 140 * in TLS 1.3; in TLS 1.2 any curve can be used with each of these. */ 141 ssl_sig_ecdsa_secp256r1_sha256 = 0x0403, 142 ssl_sig_ecdsa_secp384r1_sha384 = 0x0503, 143 ssl_sig_ecdsa_secp521r1_sha512 = 0x0603, 144 ssl_sig_rsa_pss_rsae_sha256 = 0x0804, 145 ssl_sig_rsa_pss_rsae_sha384 = 0x0805, 146 ssl_sig_rsa_pss_rsae_sha512 = 0x0806, 147 ssl_sig_ed25519 = 0x0807, 148 ssl_sig_ed448 = 0x0808, 149 ssl_sig_rsa_pss_pss_sha256 = 0x0809, 150 ssl_sig_rsa_pss_pss_sha384 = 0x080a, 151 ssl_sig_rsa_pss_pss_sha512 = 0x080b, 152 153 ssl_sig_dsa_sha1 = 0x0202, 154 ssl_sig_dsa_sha256 = 0x0402, 155 ssl_sig_dsa_sha384 = 0x0502, 156 ssl_sig_dsa_sha512 = 0x0602, 157 ssl_sig_ecdsa_sha1 = 0x0203, 158 159 /* The following value (which can't be used in the protocol), represents 160 * the RSA signature using SHA-1 and MD5 that is used in TLS 1.0 and 1.1. 161 * This is reported as a signature scheme when TLS 1.0 or 1.1 is used. 162 * This should not be passed to SSL_SignatureSchemePrefSet(); this 163 * signature scheme is always used and cannot be disabled. */ 164 ssl_sig_rsa_pkcs1_sha1md5 = 0x10101, 165 } SSLSignatureScheme; 166 167 /* Deprecated names maintained only for source compatibility. */ 168 #define ssl_sig_rsa_pss_sha256 ssl_sig_rsa_pss_rsae_sha256 169 #define ssl_sig_rsa_pss_sha384 ssl_sig_rsa_pss_rsae_sha384 170 #define ssl_sig_rsa_pss_sha512 ssl_sig_rsa_pss_rsae_sha512 171 172 /* 173 ** SSLAuthType describes the type of key that is used to authenticate a 174 ** connection. That is, the type of key in the end-entity certificate. 175 */ 176 typedef enum { 177 ssl_auth_null = 0, 178 ssl_auth_rsa_decrypt = 1, /* RSA key exchange. */ 179 ssl_auth_dsa = 2, 180 ssl_auth_kea = 3, /* unused */ 181 ssl_auth_ecdsa = 4, 182 ssl_auth_ecdh_rsa = 5, /* ECDH cert with an RSA signature. */ 183 ssl_auth_ecdh_ecdsa = 6, /* ECDH cert with an ECDSA signature. */ 184 ssl_auth_rsa_sign = 7, /* RSA signing with an rsaEncryption key. */ 185 ssl_auth_rsa_pss = 8, /* RSA signing with a PSS key. */ 186 ssl_auth_psk = 9, 187 ssl_auth_tls13_any = 10, 188 ssl_auth_size /* number of authentication types */ 189 } SSLAuthType; 190 191 typedef enum { 192 ssl_psk_none = 0, 193 ssl_psk_resume = 1, 194 ssl_psk_external = 2, 195 } SSLPskType; 196 197 /* This is defined for backward compatibility reasons */ 198 #define ssl_auth_rsa ssl_auth_rsa_decrypt 199 200 typedef enum { 201 ssl_calg_null = 0, 202 ssl_calg_rc4 = 1, 203 ssl_calg_rc2 = 2, 204 ssl_calg_des = 3, 205 ssl_calg_3des = 4, 206 ssl_calg_idea = 5, 207 ssl_calg_fortezza = 6, /* deprecated, now unused */ 208 ssl_calg_aes = 7, 209 ssl_calg_camellia = 8, 210 ssl_calg_seed = 9, 211 ssl_calg_aes_gcm = 10, 212 ssl_calg_chacha20 = 11 213 } SSLCipherAlgorithm; 214 215 typedef enum { 216 ssl_mac_null = 0, 217 ssl_mac_md5 = 1, 218 ssl_mac_sha = 2, 219 ssl_hmac_md5 = 3, /* TLS HMAC version of mac_md5 */ 220 ssl_hmac_sha = 4, /* TLS HMAC version of mac_sha */ 221 ssl_hmac_sha256 = 5, 222 ssl_mac_aead = 6, 223 ssl_hmac_sha384 = 7 224 } SSLMACAlgorithm; 225 226 typedef enum { 227 ssl_compression_null = 0, 228 ssl_compression_deflate = 1 /* RFC 3749 */ 229 } SSLCompressionMethod; 230 231 typedef enum { 232 ssl_grp_ec_sect163k1 = 1, 233 ssl_grp_ec_sect163r1 = 2, 234 ssl_grp_ec_sect163r2 = 3, 235 ssl_grp_ec_sect193r1 = 4, 236 ssl_grp_ec_sect193r2 = 5, 237 ssl_grp_ec_sect233k1 = 6, 238 ssl_grp_ec_sect233r1 = 7, 239 ssl_grp_ec_sect239k1 = 8, 240 ssl_grp_ec_sect283k1 = 9, 241 ssl_grp_ec_sect283r1 = 10, 242 ssl_grp_ec_sect409k1 = 11, 243 ssl_grp_ec_sect409r1 = 12, 244 ssl_grp_ec_sect571k1 = 13, 245 ssl_grp_ec_sect571r1 = 14, 246 ssl_grp_ec_secp160k1 = 15, 247 ssl_grp_ec_secp160r1 = 16, 248 ssl_grp_ec_secp160r2 = 17, 249 ssl_grp_ec_secp192k1 = 18, 250 ssl_grp_ec_secp192r1 = 19, 251 ssl_grp_ec_secp224k1 = 20, 252 ssl_grp_ec_secp224r1 = 21, 253 ssl_grp_ec_secp256k1 = 22, 254 ssl_grp_ec_secp256r1 = 23, 255 ssl_grp_ec_secp384r1 = 24, 256 ssl_grp_ec_secp521r1 = 25, 257 ssl_grp_ec_curve25519 = 29, /* RFC4492 */ 258 ssl_grp_ffdhe_2048 = 256, /* RFC7919 */ 259 ssl_grp_ffdhe_3072 = 257, 260 ssl_grp_ffdhe_4096 = 258, 261 ssl_grp_ffdhe_6144 = 259, 262 ssl_grp_ffdhe_8192 = 260, 263 ssl_grp_kem_secp256r1mlkem768 = 4587, 264 ssl_grp_kem_secp384r1mlkem1024 = 4589, 265 ssl_grp_kem_mlkem768x25519 = 4588, 266 ssl_grp_kem_xyber768d00 = 25497, /* draft-tls-westerbaan-xyber768d00-02 */ 267 ssl_grp_none = 65537, /* special value */ 268 ssl_grp_ffdhe_custom = 65538 /* special value */ 269 } SSLNamedGroup; 270 271 typedef struct SSLExtraServerCertDataStr { 272 /* When this struct is passed to SSL_ConfigServerCert, and authType is set 273 * to a value other than ssl_auth_null, this limits the use of the key to 274 * the type defined; otherwise, the certificate is configured for all 275 * compatible types. */ 276 SSLAuthType authType; 277 /* The remainder of the certificate chain. */ 278 const CERTCertificateList* certChain; 279 /* A set of one or more stapled OCSP responses for the certificate. This is 280 * used to generate the OCSP stapling answer provided by the server. */ 281 const SECItemArray* stapledOCSPResponses; 282 /* A serialized sign_certificate_timestamp extension, used to answer 283 * requests from clients for this data. */ 284 const SECItem* signedCertTimestamps; 285 286 /* Delegated credentials. 287 * 288 * A serialized delegated credential (DC) to use for authentication to peers 289 * who indicate support for this extension (ietf-drafts-tls-subcerts). DCs 290 * are used opportunistically if (1) the client indicates support, (2) TLS 291 * 1.3 or higher is negotiated, and (3) the selected certificate is 292 * configured with a DC. 293 * 294 * Note that it's the caller's responsibility to ensure that the DC is 295 * well-formed. 296 */ 297 const SECItem* delegCred; 298 299 /* The secret key corresponding to the |delegCred|. 300 * 301 * Note that it's the caller's responsibility to ensure that this matches 302 * the DC public key. 303 */ 304 const SECKEYPrivateKey* delegCredPrivKey; 305 } SSLExtraServerCertData; 306 307 typedef struct SSLChannelInfoStr { 308 /* On return, SSL_GetChannelInfo sets |length| to the smaller of 309 * the |len| argument and the length of the struct used by NSS. 310 * Callers must ensure the application uses a version of NSS that 311 * isn't older than the version used at compile time. */ 312 PRUint32 length; 313 PRUint16 protocolVersion; 314 PRUint16 cipherSuite; 315 316 /* The strength of the key used to authenticate the peer. Before 317 * interpreting this value, check authType, signatureScheme, and 318 * peerDelegCred, to determine the type of the key and how it was used. 319 * 320 * Typically, this is the length of the key from the peer's end-entity 321 * certificate. If delegated credentials are used (i.e., peerDelegCred is 322 * PR_TRUE), then this is the strength of the delegated credential key. */ 323 PRUint32 authKeyBits; 324 325 /* key exchange algorithm info */ 326 PRUint32 keaKeyBits; 327 328 /* session info */ 329 PRUint32 creationTime; /* seconds since Jan 1, 1970 */ 330 PRUint32 lastAccessTime; /* seconds since Jan 1, 1970 */ 331 PRUint32 expirationTime; /* seconds since Jan 1, 1970 */ 332 PRUint32 sessionIDLength; /* up to 32 */ 333 PRUint8 sessionID[32]; 334 335 /* The following fields are added in NSS 3.12.5. */ 336 337 /* compression method info */ 338 const char* compressionMethodName; 339 SSLCompressionMethod compressionMethod; 340 341 /* The following fields are added in NSS 3.21. 342 * This field only has meaning in TLS < 1.3 and will be set to 343 * PR_FALSE in TLS 1.3. 344 */ 345 PRBool extendedMasterSecretUsed; 346 347 /* The following fields were added in NSS 3.25. 348 * This field only has meaning in TLS >= 1.3, and indicates on the 349 * client side that the server accepted early (0-RTT) data. 350 */ 351 PRBool earlyDataAccepted; 352 353 /* The following fields were added in NSS 3.28. */ 354 /* These fields have the same meaning as in SSLCipherSuiteInfo. */ 355 SSLKEAType keaType; 356 SSLNamedGroup keaGroup; 357 SSLCipherAlgorithm symCipher; 358 SSLMACAlgorithm macAlgorithm; 359 SSLAuthType authType; 360 SSLSignatureScheme signatureScheme; 361 362 /* The following fields were added in NSS 3.34. */ 363 /* When the session was resumed this holds the key exchange group of the 364 * original handshake. */ 365 SSLNamedGroup originalKeaGroup; 366 /* This field is PR_TRUE when the session is resumed and PR_FALSE 367 * otherwise. */ 368 PRBool resumed; 369 370 /* Indicates whether the peer used a delegated credential (DC) for 371 * authentication. 372 */ 373 PRBool peerDelegCred; 374 375 /* The following fields were added in NSS 3.54. */ 376 /* Indicates what type of PSK, if any, was used in a handshake. */ 377 SSLPskType pskType; 378 379 /* The following fields were added in NSS 3.60 */ 380 /* This field is PR_TRUE when the connection is established 381 * with TLS 1.3 Encrypted Client Hello. */ 382 PRBool echAccepted; 383 384 /* The following field was added in NSS 3.66 */ 385 /* This filed is PR_TRUE if the FIPS indicator is true for the 386 * current connection */ 387 PRBool isFIPS; 388 389 /* When adding new fields to this structure, please document the 390 * NSS version in which they were added. */ 391 } SSLChannelInfo; 392 393 /* Preliminary channel info */ 394 #define ssl_preinfo_version (1U << 0) 395 #define ssl_preinfo_cipher_suite (1U << 1) 396 #define ssl_preinfo_0rtt_cipher_suite (1U << 2) 397 /* ssl_preinfo_peer_auth covers peerDelegCred, authKeyBits, 398 * and scheme. Not included in ssl_preinfo_all as it is client-only. */ 399 #define ssl_preinfo_peer_auth (1U << 3) 400 #define ssl_preinfo_ech (1U << 4) 401 /* ssl_preinfo_all doesn't contain ssl_preinfo_0rtt_cipher_suite because that 402 * field is only set if 0-RTT is sent (client) or accepted (server). */ 403 #define ssl_preinfo_all (ssl_preinfo_version | ssl_preinfo_cipher_suite | ssl_preinfo_ech) 404 405 typedef struct SSLPreliminaryChannelInfoStr { 406 /* On return, SSL_GetPreliminaryChannelInfo sets |length| to the smaller of 407 * the |len| argument and the length of the struct used by NSS. 408 * Callers must ensure the application uses a version of NSS that 409 * isn't older than the version used at compile time. */ 410 PRUint32 length; 411 /* A bitfield over SSLPreliminaryValueSet that describes which 412 * preliminary values are set (see ssl_preinfo_*). */ 413 PRUint32 valuesSet; 414 /* Protocol version: test (valuesSet & ssl_preinfo_version) */ 415 PRUint16 protocolVersion; 416 /* Cipher suite: test (valuesSet & ssl_preinfo_cipher_suite) */ 417 PRUint16 cipherSuite; 418 419 /* The following fields were added in NSS 3.29. */ 420 /* |canSendEarlyData| is true when a 0-RTT is enabled. This can only be 421 * true after sending the ClientHello and before the handshake completes. 422 */ 423 PRBool canSendEarlyData; 424 425 /* The following fields were added in NSS 3.31. */ 426 /* The number of early data octets that a client is permitted to send on 427 * this connection. The value will be zero if the connection was not 428 * resumed or early data is not permitted. For a client, this value only 429 * has meaning if |canSendEarlyData| is true. For a server, this indicates 430 * the value that was advertised in the session ticket that was used to 431 * resume this session. */ 432 PRUint32 maxEarlyDataSize; 433 434 /* The following fields were added in NSS 3.43. */ 435 /* This reports the cipher suite used for 0-RTT if it sent or accepted. For 436 * a client, this is set earlier than |cipherSuite|, and will match that 437 * value if 0-RTT is accepted by the server. The server only sets this 438 * after accepting 0-RTT, so this will contain the same value. */ 439 PRUint16 zeroRttCipherSuite; 440 441 /* The following fields were added in NSS 3.48. */ 442 /* These fields contain information about the key that will be used in 443 * the CertificateVerify message. If Delegated Credentials are being used, 444 * this is the DC-contained SPKI, else the EE-cert SPKI. These fields are 445 * valid only after the Certificate message is handled. This can be determined 446 * by checking the valuesSet field against |ssl_preinfo_peer_auth|. */ 447 PRBool peerDelegCred; 448 PRUint32 authKeyBits; 449 SSLSignatureScheme signatureScheme; 450 451 /* The following fields were added in NSS 3.60. */ 452 PRBool echAccepted; 453 /* If the application configured ECH but |!echAccepted|, authCertificate 454 * should use the following hostname extracted from the ECHConfig. */ 455 const char* echPublicName; 456 457 /* The following field was added in NSS 3.88. */ 458 PRBool ticketSupportsEarlyData; 459 460 /* When adding new fields to this structure, please document the 461 * NSS version in which they were added. */ 462 } SSLPreliminaryChannelInfo; 463 464 typedef struct SSLCipherSuiteInfoStr { 465 /* On return, SSL_GetCipherSuitelInfo sets |length| to the smaller of 466 * the |len| argument and the length of the struct used by NSS. 467 * Callers must ensure the application uses a version of NSS that 468 * isn't older than the version used at compile time. */ 469 PRUint16 length; 470 PRUint16 cipherSuite; 471 472 /* Cipher Suite Name */ 473 const char* cipherSuiteName; 474 475 /* server authentication info */ 476 const char* authAlgorithmName; 477 SSLAuthType authAlgorithm; /* deprecated, use |authType| */ 478 479 /* key exchange algorithm info */ 480 const char* keaTypeName; 481 SSLKEAType keaType; 482 483 /* symmetric encryption info */ 484 const char* symCipherName; 485 SSLCipherAlgorithm symCipher; 486 PRUint16 symKeyBits; 487 PRUint16 symKeySpace; 488 PRUint16 effectiveKeyBits; 489 490 /* MAC info */ 491 /* AEAD ciphers don't have a MAC. For an AEAD cipher, macAlgorithmName 492 * is "AEAD", macAlgorithm is ssl_mac_aead, and macBits is the length in 493 * bits of the authentication tag. */ 494 const char* macAlgorithmName; 495 SSLMACAlgorithm macAlgorithm; 496 PRUint16 macBits; 497 498 PRUintn isFIPS : 1; 499 PRUintn isExportable : 1; /* deprecated, don't use */ 500 PRUintn nonStandard : 1; 501 PRUintn reservedBits : 29; 502 503 /* The following fields were added in NSS 3.24. */ 504 /* This reports the correct authentication type for the cipher suite, use 505 * this instead of |authAlgorithm|. */ 506 SSLAuthType authType; 507 508 /* The following fields were added in NSS 3.43. */ 509 /* This reports the hash function used in the TLS KDF, or HKDF for TLS 1.3. 510 * For suites defined for versions of TLS earlier than TLS 1.2, this reports 511 * ssl_hash_none. */ 512 SSLHashType kdfHash; 513 514 /* When adding new fields to this structure, please document the 515 * NSS version in which they were added. */ 516 } SSLCipherSuiteInfo; 517 518 typedef enum { 519 ssl_variant_stream = 0, 520 ssl_variant_datagram = 1 521 } SSLProtocolVariant; 522 523 typedef struct SSLVersionRangeStr { 524 PRUint16 min; 525 PRUint16 max; 526 } SSLVersionRange; 527 528 typedef enum { 529 SSL_sni_host_name = 0, 530 SSL_sni_type_total 531 } SSLSniNameType; 532 533 /* Supported extensions. */ 534 /* Update SSL_MAX_EXTENSIONS whenever a new extension type is added. */ 535 typedef enum { 536 ssl_server_name_xtn = 0, 537 ssl_cert_status_xtn = 5, 538 ssl_supported_groups_xtn = 10, 539 ssl_ec_point_formats_xtn = 11, 540 ssl_signature_algorithms_xtn = 13, 541 ssl_use_srtp_xtn = 14, 542 ssl_app_layer_protocol_xtn = 16, 543 /* signed_certificate_timestamp extension, RFC 6962 */ 544 ssl_signed_cert_timestamp_xtn = 18, 545 ssl_padding_xtn = 21, 546 ssl_extended_master_secret_xtn = 23, 547 ssl_certificate_compression_xtn = 27, 548 ssl_record_size_limit_xtn = 28, 549 ssl_delegated_credentials_xtn = 34, 550 ssl_session_ticket_xtn = 35, 551 /* 40 was used in draft versions of TLS 1.3; it is now reserved. */ 552 ssl_tls13_pre_shared_key_xtn = 41, 553 ssl_tls13_early_data_xtn = 42, 554 ssl_tls13_supported_versions_xtn = 43, 555 ssl_tls13_cookie_xtn = 44, 556 ssl_tls13_psk_key_exchange_modes_xtn = 45, 557 ssl_tls13_ticket_early_data_info_xtn = 46, /* Deprecated. */ 558 ssl_tls13_certificate_authorities_xtn = 47, 559 ssl_tls13_post_handshake_auth_xtn = 49, 560 ssl_signature_algorithms_cert_xtn = 50, 561 ssl_tls13_key_share_xtn = 51, 562 /* TLS 1.3 GREASE extension dummy type for builders. */ 563 ssl_tls13_grease_xtn = 0x0a0a, 564 ssl_next_proto_nego_xtn = 13172, /* Deprecated. */ 565 ssl_renegotiation_info_xtn = 0xff01, 566 ssl_tls13_short_header_xtn = 0xff03, /* Deprecated. */ 567 ssl_tls13_outer_extensions_xtn = 0xfd00, 568 ssl_tls13_encrypted_client_hello_xtn = 0xfe0d, 569 ssl_tls13_encrypted_sni_xtn = 0xffce, /* Deprecated. */ 570 } SSLExtensionType; 571 572 /* This is the old name for the supported_groups extensions. */ 573 #define ssl_elliptic_curves_xtn ssl_supported_groups_xtn 574 575 /* SSL_MAX_EXTENSIONS includes the maximum number of extensions that are 576 * supported for any single message type. That is, a ClientHello; ServerHello 577 * and TLS 1.3 NewSessionTicket and HelloRetryRequest extensions have fewer. */ 578 #define SSL_MAX_EXTENSIONS 22 579 580 /* Deprecated */ 581 typedef enum { 582 ssl_dhe_group_none = 0, 583 ssl_ff_dhe_2048_group = 1, 584 ssl_ff_dhe_3072_group = 2, 585 ssl_ff_dhe_4096_group = 3, 586 ssl_ff_dhe_6144_group = 4, 587 ssl_ff_dhe_8192_group = 5, 588 ssl_dhe_group_max 589 } SSLDHEGroupType; 590 591 /* RFC 8879: TLS Certificate Compression - 3. Negotiating Certificate Compression 592 ** enum { 593 ** zlib(1), 594 ** brotli(2), 595 ** zstd(3), 596 ** (65535) 597 ** } CertificateCompressionAlgorithm; 598 */ 599 typedef PRUint16 SSLCertificateCompressionAlgorithmID; 600 601 typedef struct SSLCertificateCompressionAlgorithmStr { 602 SSLCertificateCompressionAlgorithmID id; 603 const char* name; 604 SECStatus (*encode)(const SECItem* input, SECItem* output); 605 /* outputLen is the length of the output buffer passed by NSS to the decode function. 606 * Decode should return an error code if the decoding fails or the output buffer is not big enough. 607 * usedLen is an outparam which indicates the number of bytes the decoder consumed from output. 608 * Note: usedLen is always <= outputLen. */ 609 SECStatus (*decode)(const SECItem* input, unsigned char* output, size_t outputLen, size_t* usedLen); 610 } SSLCertificateCompressionAlgorithm; 611 612 #endif /* __sslt_h_ */