lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-30 22:43:08 +03:00
Code Activity

Merge pull request #5454 from gstrauss/cert_cb-user_data

Browse Source 
server certificate selection callback
This commit is contained in:
Manuel Pégourié-Gonnard
2022-03-10 11:51:42 +01:00
committed by GitHub
parent 73e91e13a6 9bff95f051
commit 10e5cdbbbf
8 changed files with 172 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
include/mbedtls/ssl.h
View File

@ -1475,6 +1475,10 @@ struct mbedtls_ssl_config
* access it afterwards.
*/
mbedtls_ssl_user_data_t MBEDTLS_PRIVATE(user_data);
#if defined(MBEDTLS_SSL_SRV_C)
int (*MBEDTLS_PRIVATE(f_cert_cb))(mbedtls_ssl_context *); /*!< certificate selection callback */
#endif /* MBEDTLS_SSL_SRV_C */
};
struct mbedtls_ssl_context
@ -2220,6 +2224,28 @@ void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
mbedtls_ssl_set_timer_t *f_set_timer,
mbedtls_ssl_get_timer_t *f_get_timer );
#if defined(MBEDTLS_SSL_SRV_C)
/**
* \brief Set the certificate selection callback (server-side only).
*
* If set, the callback is always called for each handshake,
* after `ClientHello` processing has finished.
*
* The callback has the following parameters:
* - \c mbedtls_ssl_context*: The SSL context to which
* the operation applies.
* The return value of the callback is 0 if successful,
* or a specific MBEDTLS_ERR_XXX code, which will cause
* the handshake to be aborted.
*
* \param conf The SSL configuration to register the callback with.
* \param f_cert_cb The callback for selecting server certificate after
* `ClientHello` processing has finished.
*/
void mbedtls_ssl_conf_cert_cb( mbedtls_ssl_config *conf,
int (*f_cert_cb)(mbedtls_ssl_context *) );
#endif /* MBEDTLS_SSL_SRV_C */
/**
* \brief Callback type: generate and write session ticket
*
@ -3514,11 +3540,35 @@ int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname );
#endif /* MBEDTLS_X509_CRT_PARSE_C */
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
/**
* \brief Retrieve SNI extension value for the current handshake.
* Available in \p f_cert_cb of \c mbedtls_ssl_conf_cert_cb(),
* this is the same value passed to \p f_sni callback of
* \c mbedtls_ssl_conf_sni() and may be used instead of
* \c mbedtls_ssl_conf_sni().
*
* \param ssl SSL context
* \param name_len pointer into which to store length of returned value.
* 0 if SNI extension is not present or not yet processed.
*
* \return const pointer to SNI extension value.
* - value is valid only when called in \p f_cert_cb
* registered with \c mbedtls_ssl_conf_cert_cb().
* - value is NULL if SNI extension is not present.
* - value is not '\0'-terminated. Use \c name_len for len.
* - value must not be freed.
*/
const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
size_t *name_len );
/**
* \brief Set own certificate and key for the current handshake
*
* \note Same as \c mbedtls_ssl_conf_own_cert() but for use within
* the SNI callback.
* the SNI callback or the certificate selection callback.
*
* \note Passing null \c own_cert clears the certificate list for
* the current handshake.
*
* \param ssl SSL context
* \param own_cert own public certificate chain
@ -3535,7 +3585,7 @@ int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
* current handshake
*
* \note Same as \c mbedtls_ssl_conf_ca_chain() but for use within
* the SNI callback.
* the SNI callback or the certificate selection callback.
*
* \param ssl SSL context
* \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs)
@ -3549,7 +3599,7 @@ void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
* \brief Set authmode for the current handshake.
*
* \note Same as \c mbedtls_ssl_conf_authmode() but for use within
* the SNI callback.
* the SNI callback or the certificate selection callback.
*
* \param ssl SSL context
* \param authmode MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or
@ -3574,8 +3624,7 @@ void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
* mbedtls_ssl_set_hs_ca_chain() as well as the client
* authentication mode with \c mbedtls_ssl_set_hs_authmode(),
* then must return 0. If no matching name is found, the
* callback must either set a default cert, or
* return non-zero to abort the handshake at this point.
* callback may return non-zero to abort the handshake.
*
* \param conf SSL configuration
* \param f_sni verification function