|
WOLFSSL_METHOD * | wolfDTLSv1_2_client_method_ex (void *heap) |
| This function initializes the DTLS v1.2 client method. More...
|
|
WOLFSSL_METHOD * | wolfSSLv23_method (void) |
| This function returns a WOLFSSL_METHOD similar to wolfSSLv23_client_method except that it is not determined which side yet (server/client). More...
|
|
WOLFSSL_METHOD * | wolfSSLv3_server_method (void) |
| The wolfSSLv3_server_method() function is used to indicate that the application is a server and will only support the SSL 3.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfSSLv3_client_method (void) |
| The wolfSSLv3_client_method() function is used to indicate that the application is a client and will only support the SSL 3.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_server_method (void) |
| The wolfTLSv1_server_method() function is used to indicate that the application is a server and will only support the TLS 1.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_client_method (void) |
| The wolfTLSv1_client_method() function is used to indicate that the application is a client and will only support the TLS 1.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_1_server_method (void) |
| The wolfTLSv1_1_server_method() function is used to indicate that the application is a server and will only support the TLS 1.1 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_1_client_method (void) |
| The wolfTLSv1_1_client_method() function is used to indicate that the application is a client and will only support the TLS 1.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_2_server_method (void) |
| The wolfTLSv1_2_server_method() function is used to indicate that the application is a server and will only support the TLS 1.2 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_2_client_method (void) |
| The wolfTLSv1_2_client_method() function is used to indicate that the application is a client and will only support the TLS 1.2 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfDTLSv1_client_method (void) |
| The wolfDTLSv1_client_method() function is used to indicate that the application is a client and will only support the DTLS 1.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). This function is only available when wolfSSL has been compiled with DTLS support (–enable-dtls, or by defining wolfSSL_DTLS). More...
|
|
WOLFSSL_METHOD * | wolfDTLSv1_server_method (void) |
| The wolfDTLSv1_server_method() function is used to indicate that the application is a server and will only support the DTLS 1.0 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). This function is only available when wolfSSL has been compiled with DTLS support (–enable-dtls, or by defining wolfSSL_DTLS). More...
|
|
WOLFSSL_METHOD * | wolfDTLSv1_3_server_method (void) |
| The wolfDTLSv1_3_server_method() function is used to indicate that the application is a server and will only support the DTLS 1.3 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). This function is only available when wolfSSL has been compiled with DTLSv1.3 support (–enable-dtls13, or by defining wolfSSL_DTLS13). More...
|
|
WOLFSSL_METHOD * | wolfDTLSv1_3_client_method (void) |
| The wolfDTLSv1_3_client_method() function is used to indicate that the application is a client and will only support the DTLS 1.3 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). This function is only available when wolfSSL has been compiled with DTLSv1.3 support (–enable-dtls13, or by defining wolfSSL_DTLS13). More...
|
|
WOLFSSL_METHOD * | wolfDTLS_server_method (void) |
| The wolfDTLS_server_method() function is used to indicate that the application is a server and will support the highest version of DTLS available and all the version up to the minimum version allowed. The default minimum version allowed is based on the define WOLFSSL_MIN_DTLS_DOWNGRADE and can be changed at runtime using wolfSSL_SetMinVersion(). This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). This function is only available when wolfSSL has been compiled with DTLS support (–enable-dtls, or by defining wolfSSL_DTLS). More...
|
|
WOLFSSL_METHOD * | wolfDTLS_client_method (void) |
| The wolfDTLS_client_method() function is used to indicate that the application is a client and will support the highest version of DTLS available and all the version up to the minimum version allowed. The default minimum version allowed is based on the define WOLFSSL_MIN_DTLS_DOWNGRADE and can be changed at runtime using wolfSSL_SetMinVersion(). This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). This function is only available when wolfSSL has been compiled with DTLS support (–enable-dtls, or by defining wolfSSL_DTLS). More...
|
|
WOLFSSL_METHOD * | wolfDTLSv1_2_server_method (void) |
| This function creates and initializes a WOLFSSL_METHOD for the server side. More...
|
|
int | wolfSSL_use_old_poly (WOLFSSL *ssl, int value) |
| Since there is some differences between the first release and newer versions of chacha-poly AEAD construction we have added an option to communicate with servers/clients using the older version. By default wolfSSL uses the new version. More...
|
|
int | wolfSSL_dtls_import (WOLFSSL *ssl, unsigned char *buf, unsigned int sz) |
| The wolfSSL_dtls_import() function is used to parse in a serialized session state. This allows for picking up the connection after the handshake has been completed. More...
|
|
int | wolfSSL_tls_import (WOLFSSL *ssl, const unsigned char *buf, unsigned int sz) |
| Used to import a serialized TLS session. This function is for importing the state of the connection. WARNING: buf contains sensitive information about the state and is best to be encrypted before storing if stored. Additional debug info can be displayed with the macro WOLFSSL_SESSION_EXPORT_DEBUG defined. More...
|
|
int | wolfSSL_CTX_dtls_set_export (WOLFSSL_CTX *ctx, wc_dtls_export func) |
| The wolfSSL_CTX_dtls_set_export() function is used to set the callback function for exporting a session. It is allowed to pass in NULL as the parameter func to clear the export function previously stored. Used on the server side and is called immediately after handshake is completed. More...
|
|
int | wolfSSL_dtls_set_export (WOLFSSL *ssl, wc_dtls_export func) |
| The wolfSSL_dtls_set_export() function is used to set the callback function for exporting a session. It is allowed to pass in NULL as the parameter func to clear the export function previously stored. Used on the server side and is called immediately after handshake is completed. More...
|
|
int | wolfSSL_dtls_export (WOLFSSL *ssl, unsigned char *buf, unsigned int *sz) |
| The wolfSSL_dtls_export() function is used to serialize a WOLFSSL session into the provided buffer. Allows for less memory overhead than using a function callback for sending a session and choice over when the session is serialized. If buffer is NULL when passed to function then sz will be set to the size of buffer needed for serializing the WOLFSSL session. More...
|
|
int | wolfSSL_tls_export (WOLFSSL *ssl, unsigned char *buf, unsigned int *sz) |
| Used to export a serialized TLS session. This function is for exporting a serialized state of the connection. In most cases wolfSSL_get1_session should be used instead of wolfSSL_tls_export. Additional debug info can be displayed with the macro WOLFSSL_SESSION_EXPORT_DEBUG defined. WARNING: buf contains sensitive information about the state and is best to be encrypted before storing if stored. More...
|
|
int | wolfSSL_CTX_load_static_memory (WOLFSSL_CTX **ctx, wolfSSL_method_func method, unsigned char *buf, unsigned int sz, int flag, int max) |
| This function is used to set aside static memory for a CTX. Memory set aside is then used for the CTX’s lifetime and for any SSL objects created from the CTX. By passing in a NULL ctx pointer and a wolfSSL_method_func function the creation of the CTX itself will also use static memory. wolfSSL_method_func has the function signature of WOLFSSL_METHOD* (wolfSSL_method_func)(void heap);. Passing in 0 for max makes it behave as if not set and no max concurrent use restrictions is in place. The flag value passed in determines how the memory is used and behavior while operating. Available flags are the following: 0 - default general memory, WOLFMEM_IO_POOL - used for input/output buffer when sending receiving messages and overrides general memory, so all memory in buffer passed in is used for IO, WOLFMEM_IO_FIXED - same as WOLFMEM_IO_POOL but each SSL now keeps two buffers to themselves for their lifetime, WOLFMEM_TRACK_STATS - each SSL keeps track of memory stats while running. More...
|
|
int | wolfSSL_CTX_is_static_memory (WOLFSSL_CTX *ctx, WOLFSSL_MEM_STATS *mem_stats) |
| This function does not change any of the connections behavior and is used only for gathering information about the static memory usage. More...
|
|
int | wolfSSL_is_static_memory (WOLFSSL *ssl, WOLFSSL_MEM_CONN_STATS *mem_stats) |
| wolfSSL_is_static_memory is used to gather information about a SSL’s static memory usage. The return value indicates if static memory is being used and WOLFSSL_MEM_CONN_STATS will be filled out if and only if the flag WOLFMEM_TRACK_STATS was passed to the parent CTX when loading in static memory. More...
|
|
int | wolfSSL_CTX_use_certificate_file (WOLFSSL_CTX *ctx, const char *file, int format) |
| This function loads a certificate file into the SSL context (WOLFSSL_CTX). The file is provided by the file argument. The format argument specifies the format type of the file, either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_use_PrivateKey_file (WOLFSSL_CTX *ctx, const char *file, int format) |
| This function loads a private key file into the SSL context (WOLFSSL_CTX). The file is provided by the file argument. The format argument specifies the format type of the file - SSL_FILETYPE_ASN1or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_load_verify_locations (WOLFSSL_CTX *ctx, const char *file, const char *path) |
| This function loads PEM-formatted CA certificate files into the SSL context (WOLFSSL_CTX). These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The path argument is a pointer to the name of a directory that contains certificates of trusted root CAs. If the value of file is not NULL, path may be specified as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was not defined when building the library, wolfSSL will load all CA certificates located in the given directory. This function will attempt to load all files in the directory. This function expects PEM formatted CERT_TYPE file with header “--—BEGIN CERTIFICATE--—”. More...
|
|
int | wolfSSL_CTX_load_verify_locations_ex (WOLFSSL_CTX *ctx, const char *file, const char *path, unsigned int flags) |
| This function loads PEM-formatted CA certificate files into the SSL context (WOLFSSL_CTX). These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The path argument is a pointer to the name of a directory that contains certificates of trusted root CAs. If the value of file is not NULL, path may be specified as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was not defined when building the library, wolfSSL will load all CA certificates located in the given directory. This function will attempt to load all files in the directory based on flags specified. This function expects PEM formatted CERT_TYPE files with header “--—BEGIN CERTIFICATE--—”. More...
|
|
const char ** | wolfSSL_get_system_CA_dirs (word32 *num) |
| This function returns a pointer to an array of strings representing directories wolfSSL will search for system CA certs when wolfSSL_CTX_load_system_CA_certs is called. On systems that don't store certificates in an accessible system directory (such as Apple platforms), this function will always return NULL. More...
|
|
int | wolfSSL_CTX_load_system_CA_certs (WOLFSSL_CTX *ctx) |
| On most platforms (including Linux and Windows), this function attempts to load CA certificates into a WOLFSSL_CTX from an OS-dependent CA certificate store. Loaded certificates will be trusted. More...
|
|
int | wolfSSL_CTX_trust_peer_cert (WOLFSSL_CTX *ctx, const char *file, int type) |
| This function loads a certificate to use for verifying a peer when performing a TLS/SSL handshake. The peer certificate sent during the handshake is compared by using the SKID when available and the signature. If these two things do not match then any loaded CAs are used. Feature is enabled by defining the macro WOLFSSL_TRUST_PEER_CERT. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_use_certificate_chain_file (WOLFSSL_CTX *ctx, const char *file) |
| This function loads a chain of certificates into the SSL context (WOLFSSL_CTX). The file containing the certificate chain is provided by the file argument, and must contain PEM-formatted certificates. This function will process up to MAX_CHAIN_DEPTH (default = 9, defined in internal.h) certificates, plus the subject cert. More...
|
|
int | wolfSSL_CTX_use_RSAPrivateKey_file (WOLFSSL_CTX *ctx, const char *file, int format) |
| This function loads the private RSA key used in the SSL connection into the SSL context (WOLFSSL_CTX). This function is only available when wolfSSL has been compiled with the OpenSSL compatibility layer enabled (–enable-opensslExtra, #define OPENSSL_EXTRA), and is identical to the more-typically used wolfSSL_CTX_use_PrivateKey_file() function. The file argument contains a pointer to the RSA private key file, in the format specified by format. More...
|
|
long | wolfSSL_get_verify_depth (WOLFSSL *ssl) |
| This function returns the maximum chain depth allowed, which is 9 by default, for a valid session i.e. there is a non-null session object (ssl). More...
|
|
long | wolfSSL_CTX_get_verify_depth (WOLFSSL_CTX *ctx) |
| This function gets the certificate chaining depth using the CTX structure. More...
|
|
int | wolfSSL_use_certificate_file (WOLFSSL *ssl, const char *file, int format) |
| This function loads a certificate file into the SSL session (WOLFSSL structure). The certificate file is provided by the file argument. The format argument specifies the format type of the file - either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More...
|
|
int | wolfSSL_use_PrivateKey_file (WOLFSSL *ssl, const char *file, int format) |
| This function loads a private key file into the SSL session (WOLFSSL structure). The key file is provided by the file argument. The format argument specifies the format type of the file - SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More...
|
|
int | wolfSSL_use_certificate_chain_file (WOLFSSL *ssl, const char *file) |
| This function loads a chain of certificates into the SSL session (WOLFSSL structure). The file containing the certificate chain is provided by the file argument, and must contain PEM-formatted certificates. This function will process up to MAX_CHAIN_DEPTH (default = 9, defined in internal.h) certificates, plus the subject certificate. More...
|
|
int | wolfSSL_use_RSAPrivateKey_file (WOLFSSL *ssl, const char *file, int format) |
| This function loads the private RSA key used in the SSL connection into the SSL session (WOLFSSL structure). This function is only available when wolfSSL has been compiled with the OpenSSL compatibility layer enabled (–enable-opensslExtra, #define OPENSSL_EXTRA), and is identical to the more-typically used wolfSSL_use_PrivateKey_file() function. The file argument contains a pointer to the RSA private key file, in the format specified by format. More...
|
|
int | wolfSSL_CTX_der_load_verify_locations (WOLFSSL_CTX *ctx, const char *file, int format) |
| This function is similar to wolfSSL_CTX_load_verify_locations, but allows the loading of DER-formatted CA files into the SSL context (WOLFSSL_CTX). It may still be used to load PEM-formatted CA files as well. These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The format argument specifies the format which the certificates are in either, SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 (DER). Unlike wolfSSL_CTX_load_verify_locations, this function does not allow the loading of CA certificates from a given directory path. Note that this function is only available when the wolfSSL library was compiled with WOLFSSL_DER_LOAD defined. More...
|
|
WOLFSSL_CTX * | wolfSSL_CTX_new (WOLFSSL_METHOD *) |
| This function creates a new SSL context, taking a desired SSL/TLS protocol method for input. More...
|
|
WOLFSSL * | wolfSSL_new (WOLFSSL_CTX *) |
| This function creates a new SSL session, taking an already created SSL context as input. More...
|
|
int | wolfSSL_set_fd (WOLFSSL *ssl, int fd) |
| This function assigns a file descriptor (fd) as the input/output facility for the SSL connection. Typically this will be a socket file descriptor. More...
|
|
int | wolfSSL_set_dtls_fd_connected (WOLFSSL *ssl, int fd) |
| This function assigns a file descriptor (fd) as the input/output facility for the SSL connection. Typically this will be a socket file descriptor. This is a DTLS specific API because it marks that the socket is connected. recvfrom and sendto calls on this fd will have the addr and addr_len parameters set to NULL. More...
|
|
int | wolfDTLS_SetChGoodCb (WOLFSSL *ssl, ClientHelloGoodCb cb, void *user_ctx) |
| Allows setting a callback for a correctly processed and verified DTLS client hello. When using a cookie exchange mechanism (either the HelloVerifyRequest in DTLS 1.2 or the HelloRetryRequest with a cookie extension in DTLS 1.3) this callback is called after the cookie exchange has succeeded. This is useful to use one WOLFSSL object as the listener for new connections and being able to isolate the WOLFSSL object once the ClientHello is verified (either through a cookie exchange or just checking if the ClientHello had the correct format). DTLS 1.2: https://datatracker.ietf.org/doc/html/rfc6347#section-4.2.1 DTLS 1.3: https://www.rfc-editor.org/rfc/rfc8446#section-4.2.2. More...
|
|
char * | wolfSSL_get_cipher_list (int priority) |
| Get the name of cipher at priority level passed in. More...
|
|
int | wolfSSL_get_ciphers (char *buf, int len) |
| This function gets the ciphers enabled in wolfSSL. More...
|
|
const char * | wolfSSL_get_cipher_name (WOLFSSL *ssl) |
| This function gets the cipher name in the format DHE-RSA by passing through argument to wolfSSL_get_cipher_name_internal. More...
|
|
int | wolfSSL_get_fd (const WOLFSSL *) |
| This function returns the file descriptor (fd) used as the input/output facility for the SSL connection. Typically this will be a socket file descriptor. More...
|
|
void | wolfSSL_set_using_nonblock (WOLFSSL *ssl, int nonblock) |
| This function informs the WOLFSSL object that the underlying I/O is non-blocking. After an application creates a WOLFSSL object, if it will be used with a non-blocking socket, call wolfSSL_set_using_nonblock() on it. This lets the WOLFSSL object know that receiving EWOULDBLOCK means that the recvfrom call would block rather than that it timed out. More...
|
|
int | wolfSSL_get_using_nonblock (WOLFSSL *) |
| This function allows the application to determine if wolfSSL is using non-blocking I/O. If wolfSSL is using non-blocking I/O, this function will return 1, otherwise 0. After an application creates a WOLFSSL object, if it will be used with a non-blocking socket, call wolfSSL_set_using_nonblock() on it. This lets the WOLFSSL object know that receiving EWOULDBLOCK means that the recvfrom call would block rather than that it timed out. More...
|
|
int | wolfSSL_write (WOLFSSL *ssl, const void *data, int sz) |
| This function writes sz bytes from the buffer, data, to the SSL connection, ssl. If necessary, wolfSSL_write() will negotiate an SSL/TLS session if the handshake has not already been performed yet by wolfSSL_connect() or wolfSSL_accept(). When using (D)TLSv1.3 and early data feature is compiled in, this function progresses the handshake only up to the point when it is possible to send data. Next invocations of wolfSSL_Connect()/wolfSSL_Accept()/wolfSSL_read() will complete the handshake. wolfSSL_write() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_write() will return when the underlying I/O could not satisfy the needs of wolfSSL_write() to continue. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_write() when the underlying I/O is ready. If the underlying I/O is blocking, wolfSSL_write() will only return once the buffer data of size sz has been completely written or an error occurred. More...
|
|
int | wolfSSL_read (WOLFSSL *ssl, void *data, int sz) |
| This function reads sz bytes from the SSL session (ssl) internal read buffer into the buffer data. The bytes read are removed from the internal receive buffer. If necessary wolfSSL_read() will negotiate an SSL/TLS session if the handshake has not already been performed yet by wolfSSL_connect() or wolfSSL_accept(). The SSL/TLS protocol uses SSL records which have a maximum size of 16kB (the max record size can be controlled by the MAX_RECORD_SIZE define in <wolfssl_root>/wolfssl/internal.h). As such, wolfSSL needs to read an entire SSL record internally before it is able to process and decrypt the record. Because of this, a call to wolfSSL_read() will only be able to return the maximum buffer size which has been decrypted at the time of calling. There may be additional not-yet-decrypted data waiting in the internal wolfSSL receive buffer which will be retrieved and decrypted with the next call to wolfSSL_read(). If sz is larger than the number of bytes in the internal read buffer, SSL_read() will return the bytes available in the internal read buffer. If no bytes are buffered in the internal read buffer yet, a call to wolfSSL_read() will trigger processing of the next record. More...
|
|
int | wolfSSL_peek (WOLFSSL *ssl, void *data, int sz) |
| This function copies sz bytes from the SSL session (ssl) internal read buffer into the buffer data. This function is identical to wolfSSL_read() except that the data in the internal SSL session receive buffer is not removed or modified. If necessary, like wolfSSL_read(), wolfSSL_peek() will negotiate an SSL/TLS session if the handshake has not already been performed yet by wolfSSL_connect() or wolfSSL_accept(). The SSL/TLS protocol uses SSL records which have a maximum size of 16kB (the max record size can be controlled by the MAX_RECORD_SIZE define in <wolfssl_root>/wolfssl/internal.h). As such, wolfSSL needs to read an entire SSL record internally before it is able to process and decrypt the record. Because of this, a call to wolfSSL_peek() will only be able to return the maximum buffer size which has been decrypted at the time of calling. There may be additional not-yet-decrypted data waiting in the internal wolfSSL receive buffer which will be retrieved and decrypted with the next call to wolfSSL_peek() / wolfSSL_read(). If sz is larger than the number of bytes in the internal read buffer, SSL_peek() will return the bytes available in the internal read buffer. If no bytes are buffered in the internal read buffer yet, a call to wolfSSL_peek() will trigger processing of the next record. More...
|
|
int | wolfSSL_accept (WOLFSSL *) |
| This function is called on the server side and waits for an SSL client to initiate the SSL/TLS handshake. When this function is called, the underlying communication channel has already been set up. wolfSSL_accept() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_accept() will return when the underlying I/O could not satisfy the needs of wolfSSL_accept to continue the handshake. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_accept when data is available to read and wolfSSL will pick up where it left off. When using a non-blocking socket, nothing needs to be done, but select() can be used to check for the required condition. If the underlying I/O is blocking, wolfSSL_accept() will only return once the handshake has been finished or an error occurred. More...
|
|
void | wolfSSL_CTX_free (WOLFSSL_CTX *) |
| This function frees an allocated WOLFSSL_CTX object. This function decrements the CTX reference count and only frees the context when the reference count has reached 0. More...
|
|
void | wolfSSL_free (WOLFSSL *) |
| This function frees an allocated wolfSSL object. More...
|
|
int | wolfSSL_shutdown (WOLFSSL *) |
| This function shuts down an active SSL/TLS connection using the SSL session, ssl. This function will try to send a “close notify” alert to the peer. The calling application can choose to wait for the peer to send its “close notify” alert in response or just go ahead and shut down the underlying connection after directly calling wolfSSL_shutdown (to save resources). Either option is allowed by the TLS specification. If the underlying connection will be used again in the future, the complete two-directional shutdown procedure must be performed to keep synchronization intact between the peers. wolfSSL_shutdown() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_shutdown() will return an error if the underlying I/O could not satisfy the needs of wolfSSL_shutdown() to continue. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_shutdown() when the underlying I/O is ready. More...
|
|
int | wolfSSL_send (WOLFSSL *ssl, const void *data, int sz, int flags) |
| This function writes sz bytes from the buffer, data, to the SSL connection, ssl, using the specified flags for the underlying write operation. If necessary wolfSSL_send() will negotiate an SSL/TLS session if the handshake has not already been performed yet by wolfSSL_connect() or wolfSSL_accept(). wolfSSL_send() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_send() will return when the underlying I/O could not satisfy the needs of wolfSSL_send to continue. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_send() when the underlying I/O is ready. If the underlying I/O is blocking, wolfSSL_send() will only return once the buffer data of size sz has been completely written or an error occurred. More...
|
|
int | wolfSSL_recv (WOLFSSL *ssl, void *data, int sz, int flags) |
| This function reads sz bytes from the SSL session (ssl) internal read buffer into the buffer data using the specified flags for the underlying recv operation. The bytes read are removed from the internal receive buffer. This function is identical to wolfSSL_read() except that it allows the application to set the recv flags for the underlying read operation. If necessary wolfSSL_recv() will negotiate an SSL/TLS session if the handshake has not already been performed yet by wolfSSL_connect() or wolfSSL_accept(). The SSL/TLS protocol uses SSL records which have a maximum size of 16kB (the max record size can be controlled by the MAX_RECORD_SIZE define in <wolfssl_root>/wolfssl/internal.h). As such, wolfSSL needs to read an entire SSL record internally before it is able to process and decrypt the record. Because of this, a call to wolfSSL_recv() will only be able to return the maximum buffer size which has been decrypted at the time of calling. There may be additional not-yet-decrypted data waiting in the internal wolfSSL receive buffer which will be retrieved and decrypted with the next call to wolfSSL_recv(). If sz is larger than the number of bytes in the internal read buffer, SSL_recv() will return the bytes available in the internal read buffer. If no bytes are buffered in the internal read buffer yet, a call to wolfSSL_recv() will trigger processing of the next record. More...
|
|
int | wolfSSL_get_error (WOLFSSL *ssl, int ret) |
| This function returns a unique error code describing why the previous API function call (wolfSSL_connect, wolfSSL_accept, wolfSSL_read, wolfSSL_write, etc.) resulted in an error return code (SSL_FAILURE). The return value of the previous function is passed to wolfSSL_get_error through ret. After wolfSSL_get_error is called and returns the unique error code, wolfSSL_ERR_error_string() may be called to get a human-readable error string. See wolfSSL_ERR_error_string() for more information. More...
|
|
int | wolfSSL_get_alert_history (WOLFSSL *ssl, WOLFSSL_ALERT_HISTORY *h) |
| This function gets the alert history. More...
|
|
int | wolfSSL_set_session (WOLFSSL *ssl, WOLFSSL_SESSION *session) |
| This function sets the session to be used when the SSL object, ssl, is used to establish a SSL/TLS connection. For session resumption, before calling wolfSSL_shutdown() with your session object, an application should save the session ID from the object with a call to wolfSSL_get1_session(), which returns a pointer to the session. Later, the application should create a new WOLFSSL object and assign the saved session with wolfSSL_set_session(). At this point, the application may call wolfSSL_connect() and wolfSSL will try to resume the session. The wolfSSL server code allows session resumption by default. The object returned by wolfSSL_get1_session() needs to be freed after the application is done with it by calling wolfSSL_SESSION_free() on it. More...
|
|
WOLFSSL_SESSION * | wolfSSL_get_session (WOLFSSL *ssl) |
| When NO_SESSION_CACHE_REF is defined this function returns a pointer to the current session (WOLFSSL_SESSION) used in ssl. This function returns a non-persistent pointer to the WOLFSSL_SESSION object. The pointer returned will be freed when wolfSSL_free is called. This call should only be used to inspect or modify the current session. For session resumption it is recommended to use wolfSSL_get1_session(). For backwards compatibility when NO_SESSION_CACHE_REF is not defined this function returns a persistent session object pointer that is stored in the local cache. The cache size is finite and there is a risk that the session object will be overwritten by another ssl connection by the time the application calls wolfSSL_set_session() on it. It is recommended to define NO_SESSION_CACHE_REF in your application and to use wolfSSL_get1_session() for session resumption. More...
|
|
void | wolfSSL_flush_sessions (WOLFSSL_CTX *ctx, long tm) |
| This function flushes session from the session cache which have expired. The time, tm, is used for the time comparison. Note that wolfSSL currently uses a static table for sessions, so no flushing is needed. As such, this function is currently just a stub. This function provides OpenSSL compatibility (SSL_flush_sessions) when wolfSSL is compiled with the OpenSSL compatibility layer. More...
|
|
int | wolfSSL_SetServerID (WOLFSSL *ssl, const unsigned char *id, int len, int newSession) |
| This function associates the client session with the server id. If the newSession flag is on, an existing session won’t be reused. More...
|
|
int | wolfSSL_GetSessionIndex (WOLFSSL *ssl) |
| This function gets the session index of the WOLFSSL structure. More...
|
|
int | wolfSSL_GetSessionAtIndex (int index, WOLFSSL_SESSION *session) |
| This function gets the session at specified index of the session cache and copies it into memory. The WOLFSSL_SESSION structure holds the session information. More...
|
|
WOLFSSL_X509_CHAIN * | wolfSSL_SESSION_get_peer_chain (WOLFSSL_SESSION *session) |
| Returns the peer certificate chain from the WOLFSSL_SESSION struct. More...
|
|
void | wolfSSL_CTX_set_verify (WOLFSSL_CTX *ctx, int mode, VerifyCallback verify_callback) |
| This function sets the verification method for remote peers and also allows a verify callback to be registered with the SSL context. The verify callback will be called only when a verification failure has occurred. If no verify callback is desired, the NULL pointer can be used for verify_callback. The verification mode of peer certificates is a logically OR’d list of flags. The possible flag values include: SSL_VERIFY_NONE Client mode: the client will not verify the certificate received from the server and the handshake will continue as normal. Server mode: the server will not send a certificate request to the client. As such, client verification will not be enabled. SSL_VERIFY_PEER Client mode: the client will verify the certificate received from the server during the handshake. This is turned on by default in wolfSSL, therefore, using this option has no effect. Server mode: the server will send a certificate request to the client and verify the client certificate received. SSL_VERIFY_FAIL_IF_NO_PEER_CERT Client mode: no effect when used on the client side. Server mode: the verification will fail on the server side if the client fails to send a certificate when requested to do so (when using SSL_VERIFY_PEER on the SSL server). SSL_VERIFY_FAIL_EXCEPT_PSK Client mode: no effect when used on the client side. Server mode: the verification is the same as SSL_VERIFY_FAIL_IF_NO_PEER_CERT except in the case of a PSK connection. If a PSK connection is being made then the connection will go through without a peer cert. More...
|
|
void | wolfSSL_set_verify (WOLFSSL *ssl, int mode, VerifyCallback verify_callback) |
| This function sets the verification method for remote peers and also allows a verify callback to be registered with the SSL session. The verify callback will be called only when a verification failure has occurred. If no verify callback is desired, the NULL pointer can be used for verify_callback. The verification mode of peer certificates is a logically OR’d list of flags. The possible flag values include: SSL_VERIFY_NONE Client mode: the client will not verify the certificate received from the server and the handshake will continue as normal. Server mode: the server will not send a certificate request to the client. As such, client verification will not be enabled. SSL_VERIFY_PEER Client mode: the client will verify the certificate received from the server during the handshake. This is turned on by default in wolfSSL, therefore, using this option has no effect. Server mode: the server will send a certificate request to the client and verify the client certificate received. SSL_VERIFY_FAIL_IF_NO_PEER_CERT Client mode: no effect when used on the client side. Server mode: the verification will fail on the server side if the client fails to send a certificate when requested to do so (when using SSL_VERIFY_PEER on the SSL server). SSL_VERIFY_FAIL_EXCEPT_PSK Client mode: no effect when used on the client side. Server mode: the verification is the same as SSL_VERIFY_FAIL_IF_NO_PEER_CERT except in the case of a PSK connection. If a PSK connection is being made then the connection will go through without a peer cert. More...
|
|
void | wolfSSL_SetCertCbCtx (WOLFSSL *ssl, void *ctx) |
| This function stores user CTX object information for verify callback. More...
|
|
void | wolfSSL_CTX_SetCertCbCtx (WOLFSSL_CTX *ctx, void *userCtx) |
| This function stores user CTX object information for verify callback. More...
|
|
int | wolfSSL_pending (WOLFSSL *) |
| This function returns the number of bytes which are buffered and available in the SSL object to be read by wolfSSL_read(). More...
|
|
void | wolfSSL_load_error_strings (void) |
| This function is for OpenSSL compatibility (SSL_load_error_string) only and takes no action. More...
|
|
int | wolfSSL_library_init (void) |
| This function is called internally in wolfSSL_CTX_new(). This function is a wrapper around wolfSSL_Init() and exists for OpenSSL compatibility (SSL_library_init) when wolfSSL has been compiled with OpenSSL compatibility layer. wolfSSL_Init() is the more typically-used wolfSSL initialization function. More...
|
|
int | wolfSSL_SetDevId (WOLFSSL *ssl, int devId) |
| This function sets the Device Id at the WOLFSSL session level. More...
|
|
int | wolfSSL_CTX_SetDevId (WOLFSSL_CTX *ctx, int devId) |
| This function sets the Device Id at the WOLFSSL_CTX context level. More...
|
|
int | wolfSSL_CTX_GetDevId (WOLFSSL_CTX *ctx, WOLFSSL *ssl) |
| This function retrieves the Device Id. More...
|
|
long | wolfSSL_CTX_set_session_cache_mode (WOLFSSL_CTX *ctx, long mode) |
| This function enables or disables SSL session caching. Behavior depends on the value used for mode. The following values for mode are available: SSL_SESS_CACHE_OFF- disable session caching. Session caching is turned on by default. SSL_SESS_CACHE_NO_AUTO_CLEAR - Disable auto-flushing of the session cache. Auto-flushing is turned on by default. More...
|
|
int | wolfSSL_set_session_secret_cb (WOLFSSL *ssl, SessionSecretCb cb, void *ctx) |
| This function sets the session secret callback function. The SessionSecretCb type has the signature: int (SessionSecretCb)(WOLFSSL ssl, void* secret, int* secretSz, void* ctx). The sessionSecretCb member of the WOLFSSL struct is set to the parameter cb. More...
|
|
int | wolfSSL_save_session_cache (const char *fname) |
| This function persists the session cache to file. It doesn’t use memsave because of additional memory use. More...
|
|
int | wolfSSL_restore_session_cache (const char *fname) |
| This function restores the persistent session cache from file. It does not use memstore because of additional memory use. More...
|
|
int | wolfSSL_memsave_session_cache (void *mem, int sz) |
| This function persists session cache to memory. More...
|
|
int | wolfSSL_memrestore_session_cache (const void *mem, int sz) |
| This function restores the persistent session cache from memory. More...
|
|
int | wolfSSL_get_session_cache_memsize (void) |
| This function returns how large the session cache save buffer should be. More...
|
|
int | wolfSSL_CTX_save_cert_cache (WOLFSSL_CTX *ctx, const char *fname) |
| This function writes the cert cache from memory to file. More...
|
|
int | wolfSSL_CTX_restore_cert_cache (WOLFSSL_CTX *ctx, const char *fname) |
| This function persistes certificate cache from a file. More...
|
|
int | wolfSSL_CTX_memsave_cert_cache (WOLFSSL_CTX *ctx, void *mem, int sz, int *used) |
| This function persists the certificate cache to memory. More...
|
|
int | wolfSSL_CTX_memrestore_cert_cache (WOLFSSL_CTX *ctx, const void *mem, int sz) |
| This function restores the certificate cache from memory. More...
|
|
int | wolfSSL_CTX_get_cert_cache_memsize (WOLFSSL_CTX *ctx) |
| Returns the size the certificate cache save buffer needs to be. More...
|
|
int | wolfSSL_CTX_set_cipher_list (WOLFSSL_CTX *ctx, const char *list) |
| This function sets cipher suite list for a given WOLFSSL_CTX. This cipher suite list becomes the default list for any new SSL sessions (WOLFSSL) created using this context. The ciphers in the list should be sorted in order of preference from highest to lowest. Each call to wolfSSL_CTX_set_cipher_list() resets the cipher suite list for the specific SSL context to the provided list each time the function is called. The cipher suite list, list, is a null-terminated text string, and a colon-delimited list. For example, one value for list may be "DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:AES256-SHA256" Valid cipher values are the full name values from the cipher_names[] array in src/internal.c (for a definite list of valid cipher values check src/internal.c) More...
|
|
int | wolfSSL_set_cipher_list (WOLFSSL *ssl, const char *list) |
| This function sets cipher suite list for a given WOLFSSL object (SSL session). The ciphers in the list should be sorted in order of preference from highest to lowest. Each call to wolfSSL_set_cipher_list() resets the cipher suite list for the specific SSL session to the provided list each time the function is called. The cipher suite list, list, is a null-terminated text string, and a colon-delimited list. For example, one value for list may be "DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:AES256-SHA256". Valid cipher values are the full name values from the cipher_names[] array in src/internal.c (for a definite list of valid cipher values check src/internal.c) More...
|
|
void | wolfSSL_dtls_set_using_nonblock (WOLFSSL *ssl, int nonblock) |
| This function informs the WOLFSSL DTLS object that the underlying UDP I/O is non-blocking. After an application creates a WOLFSSL object, if it will be used with a non-blocking UDP socket, call wolfSSL_dtls_set_using_nonblock() on it. This lets the WOLFSSL object know that receiving EWOULDBLOCK means that the recvfrom call would block rather than that it timed out. More...
|
|
int | wolfSSL_dtls_get_using_nonblock (WOLFSSL *ssl) |
| This function allows the application to determine if wolfSSL is using non-blocking I/O with UDP. If wolfSSL is using non-blocking I/O, this function will return 1, otherwise 0. After an application creates a WOLFSSL object, if it will be used with a non-blocking UDP socket, call wolfSSL_dtls_set_using_nonblock() on it. This lets the WOLFSSL object know that receiving EWOULDBLOCK means that the recvfrom call would block rather than that it timed out. This function is only meaningful to DTLS sessions. More...
|
|
int | wolfSSL_dtls_get_current_timeout (WOLFSSL *ssl) |
| This function returns the current timeout value in seconds for the WOLFSSL object. When using non-blocking sockets, something in the user code needs to decide when to check for available recv data and how long it has been waiting. The value returned by this function indicates how long the application should wait. More...
|
|
int | wolfSSL_dtls13_use_quick_timeout (WOLFSSL *ssl) |
| This function returns true if the application should setup a quicker timeout. When using non-blocking sockets, something in the user code needs to decide when to check for available data and how long it needs to wait. If this function returns true, it means that the library already detected some disruption in the communication, but it wants to wait for a little longer in case some messages from the other peers are still in flight. Is up to the application to fine tune the value of this timer, a good one may be dtls_get_current_timeout() / 4. More...
|
|
void | wolfSSL_dtls13_set_send_more_acks (WOLFSSL *ssl, int value) |
| This function sets whether the library should send ACKs to the other peer immediately when detecting disruption or not. Sending ACKs immediately assures minimum latency but it may consume more bandwidth than necessary. If the application manages the timer by itself and this option is set to 0 then application code can use wolfSSL_dtls13_use_quick_timeout() to determine if it should setup a quicker timeout to send those delayed ACKs. More...
|
|
int | wolfSSL_dtls_set_timeout_init (WOLFSSL *ssl, int) |
| This function sets the dtls timeout. More...
|
|
int | wolfSSL_dtls_set_timeout_max (WOLFSSL *ssl, int) |
| This function sets the maximum dtls timeout. More...
|
|
int | wolfSSL_dtls_got_timeout (WOLFSSL *ssl) |
| When using non-blocking sockets with DTLS, this function should be called on the WOLFSSL object when the controlling code thinks the transmission has timed out. It performs the actions needed to retry the last transmit, including adjusting the timeout value. If it has been too long, this will return a failure. More...
|
|
int | wolfSSL_dtls_retransmit (WOLFSSL *ssl) |
| When using non-blocking sockets with DTLS, this function retransmits the last handshake flight ignoring the expected timeout value and retransmit count. It is useful for applications that are using DTLS and need to manage even the timeout and retry count. More...
|
|
int | wolfSSL_dtls (WOLFSSL *ssl) |
| This function is used to determine if the SSL session has been configured to use DTLS. More...
|
|
int | wolfSSL_dtls_set_peer (WOLFSSL *ssl, void *peer, unsigned int peerSz) |
| This function sets the DTLS peer, peer (sockaddr_in) with size of peerSz. More...
|
|
int | wolfSSL_dtls_get_peer (WOLFSSL *ssl, void *peer, unsigned int *peerSz) |
| This function gets the sockaddr_in (of size peerSz) of the current DTLS peer. The function will compare peerSz to the actual DTLS peer size stored in the SSL session. If the peer will fit into peer, the peer’s sockaddr_in will be copied into peer, with peerSz set to the size of peer. More...
|
|
char * | wolfSSL_ERR_error_string (unsigned long errNumber, char *data) |
| This function converts an error code returned by wolfSSL_get_error() into a more human-readable error string. errNumber is the error code returned by wolfSSL_get_error() and data is the storage buffer which the error string will be placed in. The maximum length of data is 80 characters by default, as defined by MAX_ERROR_SZ is wolfssl/wolfcrypt/error.h. More...
|
|
void | wolfSSL_ERR_error_string_n (unsigned long e, char *buf, unsigned long sz) |
| This function is a version of wolfSSL_ERR_error_string() where len specifies the maximum number of characters that may be written to buf. Like wolfSSL_ERR_error_string(), this function converts an error code returned from wolfSSL_get_error() into a more human-readable error string. The human-readable string is placed in buf. More...
|
|
int | wolfSSL_get_shutdown (const WOLFSSL *ssl) |
| This function checks the shutdown conditions in closeNotify or connReset or sentNotify members of the Options structure. The Options structure is within the WOLFSSL structure. More...
|
|
int | wolfSSL_session_reused (WOLFSSL *ssl) |
| This function returns the resuming member of the options struct. The flag indicates whether or not to reuse a session. If not, a new session must be established. More...
|
|
int | wolfSSL_is_init_finished (WOLFSSL *ssl) |
| This function checks to see if the connection is established. More...
|
|
const char * | wolfSSL_get_version (WOLFSSL *ssl) |
| Returns the SSL version being used as a string. More...
|
|
int | wolfSSL_get_current_cipher_suite (WOLFSSL *ssl) |
| Returns the current cipher suit an ssl session is using. More...
|
|
WOLFSSL_CIPHER * | wolfSSL_get_current_cipher (WOLFSSL *ssl) |
| This function returns a pointer to the current cipher in the ssl session. More...
|
|
const char * | wolfSSL_CIPHER_get_name (const WOLFSSL_CIPHER *cipher) |
| This function matches the cipher suite in the SSL object with the available suites and returns the string representation. More...
|
|
const char * | wolfSSL_get_cipher (WOLFSSL *) |
| This function matches the cipher suite in the SSL object with the available suites. More...
|
|
WOLFSSL_SESSION * | wolfSSL_get1_session (WOLFSSL *ssl) |
| This function returns the WOLFSSL_SESSION from the WOLFSSL structure as a reference type. This requires calling wolfSSL_SESSION_free to release the session reference. The WOLFSSL_SESSION pointed to contains all the necessary information required to perform a session resumption and reestablish the connection without a new handshake. For session resumption, before calling wolfSSL_shutdown() with your session object, an application should save the session ID from the object with a call to wolfSSL_get1_session(), which returns a pointer to the session. Later, the application should create a new WOLFSSL object and assign the saved session with wolfSSL_set_session(). At this point, the application may call wolfSSL_connect() and wolfSSL will try to resume the session. The wolfSSL server code allows session resumption by default. The object returned by wolfSSL_get1_session() needs to be freed after the application is done with it by calling wolfSSL_SESSION_free() on it. More...
|
|
WOLFSSL_METHOD * | wolfSSLv23_client_method (void) |
| The wolfSSLv23_client_method() function is used to indicate that the application is a client and will support the highest protocol version supported by the server between SSL 3.0 - TLS 1.3. This function allocates memory for and initializes a new WOLFSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). Both wolfSSL clients and servers have robust version downgrade capability. If a specific protocol version method is used on either side, then only that version will be negotiated or an error will be returned. For example, a client that uses TLSv1 and tries to connect to a SSLv3 only server will fail, likewise connecting to a TLSv1.1 will fail as well. To resolve this issue, a client that uses the wolfSSLv23_client_method() function will use the highest protocol version supported by the server and downgrade to SSLv3 if needed. In this case, the client will be able to connect to a server running SSLv3 - TLSv1.3. More...
|
|
int | wolfSSL_BIO_get_mem_data (WOLFSSL_BIO *bio, void *p) |
| This is used to set a byte pointer to the start of the internal memory buffer. More...
|
|
long | wolfSSL_BIO_set_fd (WOLFSSL_BIO *b, int fd, int flag) |
| Sets the file descriptor for bio to use. More...
|
|
int | wolfSSL_BIO_set_close (WOLFSSL_BIO *b, long flag) |
| Sets the close flag, used to indicate that the i/o stream should be closed when the BIO is freed. More...
|
|
WOLFSSL_BIO_METHOD * | wolfSSL_BIO_s_socket (void) |
| This is used to get a BIO_SOCKET type WOLFSSL_BIO_METHOD. More...
|
|
int | wolfSSL_BIO_set_write_buf_size (WOLFSSL_BIO *b, long size) |
| This is used to set the size of write buffer for a WOLFSSL_BIO. If write buffer has been previously set this function will free it when resetting the size. It is similar to wolfSSL_BIO_reset in that it resets read and write indexes to 0. More...
|
|
int | wolfSSL_BIO_make_bio_pair (WOLFSSL_BIO *b1, WOLFSSL_BIO *b2) |
| This is used to pair two bios together. A pair of bios acts similar to a two way pipe writing to one can be read by the other and vice versa. It is expected that both bios be in the same thread, this function is not thread safe. Freeing one of the two bios removes both from being paired. If a write buffer size was not previously set for either of the bios it is set to a default size of 17000 (WOLFSSL_BIO_SIZE) before being paired. More...
|
|
int | wolfSSL_BIO_ctrl_reset_read_request (WOLFSSL_BIO *bio) |
| This is used to set the read request flag back to 0. More...
|
|
int | wolfSSL_BIO_nread0 (WOLFSSL_BIO *bio, char **buf) |
| This is used to get a buffer pointer for reading from. Unlike wolfSSL_BIO_nread the internal read index is not advanced by the number returned from the function call. Reading past the value returned can result in reading out of array bounds. More...
|
|
int | wolfSSL_BIO_nread (WOLFSSL_BIO *bio, char **buf, int num) |
| This is used to get a buffer pointer for reading from. The internal read index is advanced by the number returned from the function call with buf being pointed to the beginning of the buffer to read from. In the case that less bytes are in the read buffer than the value requested with num the lesser value is returned. Reading past the value returned can result in reading out of array bounds. More...
|
|
int | wolfSSL_BIO_nwrite (WOLFSSL_BIO *bio, char **buf, int num) |
| Gets a pointer to the buffer for writing as many bytes as returned by the function. Writing more bytes to the pointer returned then the value returned can result in writing out of bounds. More...
|
|
int | wolfSSL_BIO_reset (WOLFSSL_BIO *bio) |
| Resets bio to an initial state. As an example for type BIO_BIO this resets the read and write index. More...
|
|
int | wolfSSL_BIO_seek (WOLFSSL_BIO *bio, int ofs) |
| This function adjusts the file pointer to the offset given. This is the offset from the head of the file. More...
|
|
int | wolfSSL_BIO_write_filename (WOLFSSL_BIO *bio, char *name) |
| This is used to set and write to a file. WIll overwrite any data currently in the file and is set to close the file when the bio is freed. More...
|
|
long | wolfSSL_BIO_set_mem_eof_return (WOLFSSL_BIO *bio, int v) |
| This is used to set the end of file value. Common value is -1 so as not to get confused with expected positive values. More...
|
|
long | wolfSSL_BIO_get_mem_ptr (WOLFSSL_BIO *bio, WOLFSSL_BUF_MEM **m) |
| This is a getter function for WOLFSSL_BIO memory pointer. More...
|
|
char * | wolfSSL_X509_NAME_oneline (WOLFSSL_X509_NAME *name, char *in, int sz) |
| This function copies the name of the x509 into a buffer. More...
|
|
WOLFSSL_X509_NAME * | wolfSSL_X509_get_issuer_name (WOLFSSL_X509 *cert) |
| This function returns the name of the certificate issuer. More...
|
|
WOLFSSL_X509_NAME * | wolfSSL_X509_get_subject_name (WOLFSSL_X509 *cert) |
| This function returns the subject member of the WOLFSSL_X509 structure. More...
|
|
int | wolfSSL_X509_get_isCA (WOLFSSL_X509 *cert) |
| Checks the isCa member of the WOLFSSL_X509 structure and returns the value. More...
|
|
int | wolfSSL_X509_NAME_get_text_by_NID (WOLFSSL_X509_NAME *name, int nid, char *buf, int len) |
| This function gets the text related to the passed in NID value. More...
|
|
int | wolfSSL_X509_get_signature_type (WOLFSSL_X509 *cert) |
| This function returns the value stored in the sigOID member of the WOLFSSL_X509 structure. More...
|
|
void | wolfSSL_X509_free (WOLFSSL_X509 *x509) |
| This function frees a WOLFSSL_X509 structure. More...
|
|
int | wolfSSL_X509_get_signature (WOLFSSL_X509 *x509, unsigned char *buf, int *bufSz) |
| Gets the X509 signature and stores it in the buffer. More...
|
|
int | wolfSSL_X509_STORE_add_cert (WOLFSSL_X509_STORE *store, WOLFSSL_X509 *x509) |
| This function adds a certificate to the WOLFSSL_X509_STRE structure. More...
|
|
WOLFSSL_STACK * | wolfSSL_X509_STORE_CTX_get_chain (WOLFSSL_X509_STORE_CTX *ctx) |
| This function is a getter function for chain variable in WOLFSSL_X509_STORE_CTX structure. Currently chain is not populated. More...
|
|
int | wolfSSL_X509_STORE_set_flags (WOLFSSL_X509_STORE *store, unsigned long flag) |
| This function takes in a flag to change the behavior of the WOLFSSL_X509_STORE structure passed in. An example of a flag used is WOLFSSL_CRL_CHECK. More...
|
|
const byte * | wolfSSL_X509_notBefore (WOLFSSL_X509 *x509) |
| This function the certificate "not before" validity encoded as a byte array. More...
|
|
const byte * | wolfSSL_X509_notAfter (WOLFSSL_X509 *x509) |
| This function the certificate "not after" validity encoded as a byte array. More...
|
|
WOLFSSL_BIGNUM * | wolfSSL_ASN1_INTEGER_to_BN (const WOLFSSL_ASN1_INTEGER *ai, WOLFSSL_BIGNUM *bn) |
| This function is used to copy a WOLFSSL_ASN1_INTEGER value to a WOLFSSL_BIGNUM structure. More...
|
|
long | wolfSSL_CTX_add_extra_chain_cert (WOLFSSL_CTX *ctx, WOLFSSL_X509 *x509) |
| This function adds the certificate to the internal chain being built in the WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_CTX_get_read_ahead (WOLFSSL_CTX *ctx) |
| This function returns the get read ahead flag from a WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_CTX_set_read_ahead (WOLFSSL_CTX *ctx, int v) |
| This function sets the read ahead flag in the WOLFSSL_CTX structure. More...
|
|
long | wolfSSL_CTX_set_tlsext_status_arg (WOLFSSL_CTX *ctx, void *arg) |
| This function sets the options argument to use with OCSP. More...
|
|
long | wolfSSL_CTX_set_tlsext_opaque_prf_input_callback_arg (WOLFSSL_CTX *ctx, void *arg) |
| This function sets the optional argument to be passed to the PRF callback. More...
|
|
long | wolfSSL_set_options (WOLFSSL *s, long op) |
| This function sets the options mask in the ssl. Some valid options are, SSL_OP_ALL, SSL_OP_COOKIE_EXCHANGE, SSL_OP_NO_SSLv2, SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1, SSL_OP_NO_TLSv1_2, SSL_OP_NO_COMPRESSION. More...
|
|
long | wolfSSL_get_options (const WOLFSSL *ssl) |
| This function returns the current options mask. More...
|
|
long | wolfSSL_set_tlsext_debug_arg (WOLFSSL *ssl, void *arg) |
| This is used to set the debug argument passed around. More...
|
|
long | wolfSSL_set_tlsext_status_type (WOLFSSL *s, int type) |
| This function is called when the client application request that a server send back an OCSP status response (also known as OCSP stapling).Currently, the only supported type is TLSEXT_STATUSTYPE_ocsp. More...
|
|
long | wolfSSL_get_verify_result (const WOLFSSL *ssl) |
| This is used to get the results after trying to verify the peer's certificate. More...
|
|
void | wolfSSL_ERR_print_errors_fp (XFILE fp, int err) |
| This function converts an error code returned by wolfSSL_get_error() into a more human-readable error string and prints that string to the output file - fp. err is the error code returned by wolfSSL_get_error() and fp is the file which the error string will be placed in. More...
|
|
void | wolfSSL_ERR_print_errors_cb (int(*cb)(const char *str, size_t len, void *u), void *u) |
| This function uses the provided callback to handle error reporting. The callback function is executed for each error line. The string, length, and userdata are passed into the callback parameters. More...
|
|
void | wolfSSL_CTX_set_psk_client_callback (WOLFSSL_CTX *ctx, wc_psk_client_callback cb) |
| The function sets the client_psk_cb member of the WOLFSSL_CTX structure. More...
|
|
void | wolfSSL_set_psk_client_callback (WOLFSSL *ssl, wc_psk_client_callback) |
| Sets the PSK client side callback. More...
|
|
const char * | wolfSSL_get_psk_identity_hint (const WOLFSSL *) |
| This function returns the psk identity hint. More...
|
|
const char * | wolfSSL_get_psk_identity (const WOLFSSL *) |
| The function returns a constant pointer to the client_identity member of the Arrays structure. More...
|
|
int | wolfSSL_CTX_use_psk_identity_hint (WOLFSSL_CTX *ctx, const char *hint) |
| This function stores the hint argument in the server_hint member of the WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_use_psk_identity_hint (WOLFSSL *ssl, const char *hint) |
| This function stores the hint argument in the server_hint member of the Arrays structure within the WOLFSSL structure. More...
|
|
void | wolfSSL_CTX_set_psk_server_callback (WOLFSSL_CTX *ctx, wc_psk_server_callback cb) |
| This function sets the psk callback for the server side in the WOLFSSL_CTX structure. More...
|
|
void | wolfSSL_set_psk_server_callback (WOLFSSL *ssl, wc_psk_server_callback cb) |
| Sets the psk callback for the server side by setting the WOLFSSL structure options members. More...
|
|
int | wolfSSL_set_psk_callback_ctx (WOLFSSL *ssl, void *psk_ctx) |
| Sets a PSK user context in the WOLFSSL structure options member. More...
|
|
int | wolfSSL_CTX_set_psk_callback_ctx (WOLFSSL_CTX *ctx, void *psk_ctx) |
| Sets a PSK user context in the WOLFSSL_CTX structure. More...
|
|
void * | wolfSSL_get_psk_callback_ctx (WOLFSSL *ssl) |
| Get a PSK user context in the WOLFSSL structure options member. More...
|
|
void * | wolfSSL_CTX_get_psk_callback_ctx (WOLFSSL_CTX *ctx) |
| Get a PSK user context in the WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_CTX_allow_anon_cipher (WOLFSSL_CTX *) |
| This function enables the havAnon member of the CTX structure if HAVE_ANON is defined during compilation. More...
|
|
WOLFSSL_METHOD * | wolfSSLv23_server_method (void) |
| The wolfSSLv23_server_method() function is used to indicate that the application is a server and will support clients connecting with protocol version from SSL 3.0 - TLS 1.3. This function allocates memory for and initializes a new WOLFSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
int | wolfSSL_state (WOLFSSL *ssl) |
| This is used to get the internal error state of the WOLFSSL structure. More...
|
|
WOLFSSL_X509 * | wolfSSL_get_peer_certificate (WOLFSSL *ssl) |
| This function gets the peer’s certificate. More...
|
|
int | wolfSSL_want_read (WOLFSSL *) |
| This function is similar to calling wolfSSL_get_error() and getting SSL_ERROR_WANT_READ in return. If the underlying error state is SSL_ERROR_WANT_READ, this function will return 1, otherwise, 0. More...
|
|
int | wolfSSL_want_write (WOLFSSL *) |
| This function is similar to calling wolfSSL_get_error() and getting SSL_ERROR_WANT_WRITE in return. If the underlying error state is SSL_ERROR_WANT_WRITE, this function will return 1, otherwise, 0. More...
|
|
int | wolfSSL_check_domain_name (WOLFSSL *ssl, const char *dn) |
| wolfSSL by default checks the peer certificate for a valid date range and a verified signature. Calling this function before wolfSSL_connect() or wolfSSL_accept() will add a domain name check to the list of checks to perform. dn holds the domain name to check against the peer certificate when it’s received. More...
|
|
int | wolfSSL_Init (void) |
| Initializes the wolfSSL library for use. Must be called once per application and before any other call to the library. More...
|
|
int | wolfSSL_Cleanup (void) |
| Un-initializes the wolfSSL library from further use. Doesn’t have to be called, though it will free any resources used by the library. More...
|
|
const char * | wolfSSL_lib_version (void) |
| This function returns the current library version. More...
|
|
word32 | wolfSSL_lib_version_hex (void) |
| This function returns the current library version in hexadecimal notation. More...
|
|
int | wolfSSL_negotiate (WOLFSSL *ssl) |
| Performs the actual connect or accept based on the side of the SSL method. If called from the client side then an wolfSSL_connect() is done while a wolfSSL_accept() is performed if called from the server side. More...
|
|
int | wolfSSL_set_compression (WOLFSSL *ssl) |
| Turns on the ability to use compression for the SSL connection. Both sides must have compression turned on otherwise compression will not be used. The zlib library performs the actual data compression. To compile into the library use –with-libz for the configure system and define HAVE_LIBZ otherwise. Keep in mind that while compressing data before sending decreases the actual size of the messages being sent and received, the amount of data saved by compression usually takes longer in time to analyze than it does to send it raw on all but the slowest of networks. More...
|
|
int | wolfSSL_set_timeout (WOLFSSL *ssl, unsigned int to) |
| This function sets the SSL session timeout value in seconds. More...
|
|
int | wolfSSL_CTX_set_timeout (WOLFSSL_CTX *ctx, unsigned int to) |
| This function sets the timeout value for SSL sessions, in seconds, for the specified SSL context. More...
|
|
WOLFSSL_X509_CHAIN * | wolfSSL_get_peer_chain (WOLFSSL *ssl) |
| Retrieves the peer’s certificate chain. More...
|
|
int | wolfSSL_get_chain_count (WOLFSSL_X509_CHAIN *chain) |
| Retrieve's the peers certificate chain count. More...
|
|
int | wolfSSL_get_chain_length (WOLFSSL_X509_CHAIN *chain, int idx) |
| Retrieves the peer’s ASN1.DER certificate length in bytes at index (idx). More...
|
|
unsigned char * | wolfSSL_get_chain_cert (WOLFSSL_X509_CHAIN *chain, int idx) |
| Retrieves the peer’s ASN1.DER certificate at index (idx). More...
|
|
WOLFSSL_X509 * | wolfSSL_get_chain_X509 (WOLFSSL_X509_CHAIN *chain, int idx) |
| This function gets the peer’s wolfSSL_X509_certificate at index (idx) from the chain of certificates. More...
|
|
int | wolfSSL_get_chain_cert_pem (WOLFSSL_X509_CHAIN *chain, int idx, unsigned char *buf, int inLen, int *outLen) |
| Retrieves the peer’s PEM certificate at index (idx). More...
|
|
const unsigned char * | wolfSSL_get_sessionID (const WOLFSSL_SESSION *s) |
| Retrieves the session’s ID. The session ID is always 32 bytes long. More...
|
|
int | wolfSSL_X509_get_serial_number (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz) |
| Retrieves the peer’s certificate serial number. The serial number buffer (in) should be at least 32 bytes long and be provided as the *inOutSz argument as input. After calling the function *inOutSz will hold the actual length in bytes written to the in buffer. More...
|
|
char * | wolfSSL_X509_get_subjectCN (WOLFSSL_X509 *) |
| Returns the common name of the subject from the certificate. More...
|
|
const unsigned char * | wolfSSL_X509_get_der (WOLFSSL_X509 *x509, int *outSz) |
| This function gets the DER encoded certificate in the WOLFSSL_X509 struct. More...
|
|
WOLFSSL_ASN1_TIME * | wolfSSL_X509_get_notAfter (WOLFSSL_X509 *) |
| This function checks to see if x509 is NULL and if it’s not, it returns the notAfter member of the x509 struct. More...
|
|
int | wolfSSL_X509_version (WOLFSSL_X509 *) |
| This function retrieves the version of the X509 certificate. More...
|
|
WOLFSSL_X509 * | wolfSSL_X509_d2i_fp (WOLFSSL_X509 **x509, FILE *file) |
| If NO_STDIO_FILESYSTEM is defined this function will allocate heap memory, initialize a WOLFSSL_X509 structure and return a pointer to it. More...
|
|
WOLFSSL_X509 * | wolfSSL_X509_load_certificate_file (const char *fname, int format) |
| The function loads the x509 certificate into memory. More...
|
|
unsigned char * | wolfSSL_X509_get_device_type (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz) |
| This function copies the device type from the x509 structure to the buffer. More...
|
|
unsigned char * | wolfSSL_X509_get_hw_type (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz) |
| The function copies the hwType member of the WOLFSSL_X509 structure to the buffer. More...
|
|
unsigned char * | wolfSSL_X509_get_hw_serial_number (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz) |
| This function returns the hwSerialNum member of the x509 object. More...
|
|
int | wolfSSL_connect_cert (WOLFSSL *ssl) |
| This function is called on the client side and initiates an SSL/TLS handshake with a server only long enough to get the peer’s certificate chain. When this function is called, the underlying communication channel has already been set up. wolfSSL_connect_cert() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_connect_cert() will return when the underlying I/O could not satisfy the needs of wolfSSL_connect_cert() to continue the handshake. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_connect_cert() when the underlying I/O is ready and wolfSSL will pick up where it left off. When using a non-blocking socket, nothing needs to be done, but select() can be used to check for the required condition. If the underlying I/O is blocking, wolfSSL_connect_cert() will only return once the peer’s certificate chain has been received. More...
|
|
WC_PKCS12 * | wolfSSL_d2i_PKCS12_bio (WOLFSSL_BIO *bio, WC_PKCS12 **pkcs12) |
| wolfSSL_d2i_PKCS12_bio (d2i_PKCS12_bio) copies in the PKCS12 information from WOLFSSL_BIO to the structure WC_PKCS12. The information is divided up in the structure as a list of Content Infos along with a structure to hold optional MAC information. After the information has been divided into chunks (but not decrypted) in the structure WC_PKCS12, it can then be parsed and decrypted by calling. More...
|
|
WC_PKCS12 * | wolfSSL_i2d_PKCS12_bio (WOLFSSL_BIO *bio, WC_PKCS12 *pkcs12) |
| wolfSSL_i2d_PKCS12_bio (i2d_PKCS12_bio) copies in the cert information from the structure WC_PKCS12 to WOLFSSL_BIO. More...
|
|
int | wolfSSL_PKCS12_parse (WC_PKCS12 *pkcs12, const char *psw, WOLFSSL_EVP_PKEY **pkey, WOLFSSL_X509 **cert, WOLF_STACK_OF(WOLFSSL_X509) **ca) |
| PKCS12 can be enabled with adding –enable-opensslextra to the configure command. It can use triple DES and RC4 for decryption so would recommend also enabling these features when enabling opensslextra (–enable-des3 –enable-arc4). wolfSSL does not currently support RC2 so decryption with RC2 is currently not available. This may be noticeable with default encryption schemes used by OpenSSL command line to create .p12 files. wolfSSL_PKCS12_parse (PKCS12_parse). The first thing this function does is check the MAC is correct if present. If the MAC fails then the function returns and does not try to decrypt any of the stored Content Infos. This function then parses through each Content Info looking for a bag type, if the bag type is known it is decrypted as needed and either stored in the list of certificates being built or as a key found. After parsing through all bags the key found is then compared with the certificate list until a matching pair is found. This matching pair is then returned as the key and certificate, optionally the certificate list found is returned as a STACK_OF certificates. At the moment a CRL, Secret or SafeContents bag will be skipped over and not parsed. It can be seen if these or other “Unknown” bags are skipped over by viewing the debug print out. Additional attributes such as friendly name are skipped over when parsing a PKCS12 file. More...
|
|
int | wolfSSL_SetTmpDH (WOLFSSL *ssl, const unsigned char *p, int pSz, const unsigned char *g, int gSz) |
| Server Diffie-Hellman Ephemeral parameters setting. This function sets up the group parameters to be used if the server negotiates a cipher suite that uses DHE. More...
|
|
int | wolfSSL_SetTmpDH_buffer (WOLFSSL *ssl, const unsigned char *b, long sz, int format) |
| The function calls the wolfSSL_SetTMpDH_buffer_wrapper, which is a wrapper for Diffie-Hellman parameters. More...
|
|
int | wolfSSL_SetTmpDH_file (WOLFSSL *ssl, const char *f, int format) |
| This function calls wolfSSL_SetTmpDH_file_wrapper to set server Diffie-Hellman parameters. More...
|
|
int | wolfSSL_CTX_SetTmpDH (WOLFSSL_CTX *ctx, const unsigned char *p, int pSz, const unsigned char *g, int gSz) |
| Sets the parameters for the server CTX Diffie-Hellman. More...
|
|
int | wolfSSL_CTX_SetTmpDH_buffer (WOLFSSL_CTX *ctx, const unsigned char *b, long sz, int format) |
| A wrapper function that calls wolfSSL_SetTmpDH_buffer_wrapper. More...
|
|
int | wolfSSL_CTX_SetTmpDH_file (WOLFSSL_CTX *ctx, const char *f, int format) |
| The function calls wolfSSL_SetTmpDH_file_wrapper to set the server Diffie-Hellman parameters. More...
|
|
int | wolfSSL_CTX_SetMinDhKey_Sz (WOLFSSL_CTX *ctx, word16) |
| This function sets the minimum size (in bits) of the Diffie Hellman key size by accessing the minDhKeySz member in the WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_SetMinDhKey_Sz (WOLFSSL *ssl, word16 keySz_bits) |
| Sets the minimum size (in bits) for a Diffie-Hellman key in the WOLFSSL structure. More...
|
|
int | wolfSSL_CTX_SetMaxDhKey_Sz (WOLFSSL_CTX *ctx, word16 keySz_bits) |
| This function sets the maximum size (in bits) of the Diffie Hellman key size by accessing the maxDhKeySz member in the WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_SetMaxDhKey_Sz (WOLFSSL *ssl, word16 keySz_bits) |
| Sets the maximum size (in bits) for a Diffie-Hellman key in the WOLFSSL structure. More...
|
|
int | wolfSSL_GetDhKey_Sz (WOLFSSL *) |
| Returns the value of dhKeySz (in bits) that is a member of the options structure. This value represents the Diffie-Hellman key size in bytes. More...
|
|
int | wolfSSL_CTX_SetMinRsaKey_Sz (WOLFSSL_CTX *ctx, short keySz) |
| Sets the minimum RSA key size in both the WOLFSSL_CTX structure and the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_SetMinRsaKey_Sz (WOLFSSL *ssl, short keySz) |
| Sets the minimum allowable key size in bits for RSA located in the WOLFSSL structure. More...
|
|
int | wolfSSL_CTX_SetMinEccKey_Sz (WOLFSSL_CTX *ssl, short keySz) |
| Sets the minimum size in bits for the ECC key in the WOLF_CTX structure and the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_SetMinEccKey_Sz (WOLFSSL *ssl, short keySz) |
| Sets the value of the minEccKeySz member of the options structure. The options struct is a member of the WOLFSSL structure and is accessed through the ssl parameter. More...
|
|
int | wolfSSL_make_eap_keys (WOLFSSL *ssl, void *key, unsigned int len, const char *label) |
| This function is used by EAP_TLS and EAP-TTLS to derive keying material from the master secret. More...
|
|
int | wolfSSL_writev (WOLFSSL *ssl, const struct iovec *iov, int iovcnt) |
| Simulates writev semantics but doesn’t actually do block at a time because of SSL_write() behavior and because front adds may be small. Makes porting into software that uses writev easier. More...
|
|
int | wolfSSL_CTX_UnloadCAs (WOLFSSL_CTX *) |
| This function unloads the CA signer list and frees the whole signer table. More...
|
|
int | wolfSSL_CTX_UnloadIntermediateCerts (WOLFSSL_CTX *ctx) |
| This function unloads intermediate certificates added to the CA signer list and frees them. More...
|
|
int | wolfSSL_CTX_Unload_trust_peers (WOLFSSL_CTX *) |
| This function is used to unload all previously loaded trusted peer certificates. Feature is enabled by defining the macro WOLFSSL_TRUST_PEER_CERT. More...
|
|
int | wolfSSL_CTX_trust_peer_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format) |
| This function loads a certificate to use for verifying a peer when performing a TLS/SSL handshake. The peer certificate sent during the handshake is compared by using the SKID when available and the signature. If these two things do not match then any loaded CAs are used. Is the same functionality as wolfSSL_CTX_trust_peer_cert except is from a buffer instead of a file. Feature is enabled by defining the macro WOLFSSL_TRUST_PEER_CERT Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_load_verify_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format) |
| This function loads a CA certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_load_verify_buffer_ex (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format, int userChain, word32 flags) |
| This function loads a CA certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. The _ex version was added in PR 2413 and supports additional arguments for userChain and flags. More...
|
|
int | wolfSSL_CTX_load_verify_chain_buffer_format (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format) |
| This function loads a CA certificate chain buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_use_certificate_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format) |
| This function loads a certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_use_PrivateKey_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format) |
| This function loads a private key buffer into the SSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_CTX_use_certificate_chain_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz) |
| This function loads a certificate chain buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. The buffer must be in PEM format and start with the subject’s certificate, ending with the root certificate. Please see the examples for proper usage. More...
|
|
int | wolfSSL_use_certificate_buffer (WOLFSSL *ssl, const unsigned char *in, long sz, int format) |
| This function loads a certificate buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_use_PrivateKey_buffer (WOLFSSL *ssl, const unsigned char *in, long sz, int format) |
| This function loads a private key buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
|
|
int | wolfSSL_use_certificate_chain_buffer (WOLFSSL *ssl, const unsigned char *in, long sz) |
| This function loads a certificate chain buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. The buffer must be in PEM format and start with the subject’s certificate, ending with the root certificate. Please see the examples for proper usage. More...
|
|
int | wolfSSL_UnloadCertsKeys (WOLFSSL *) |
| This function unloads any certificates or keys that SSL owns. More...
|
|
int | wolfSSL_CTX_set_group_messages (WOLFSSL_CTX *) |
| This function turns on grouping of handshake messages where possible. More...
|
|
int | wolfSSL_set_group_messages (WOLFSSL *) |
| This function turns on grouping of handshake messages where possible. More...
|
|
void | wolfSSL_SetFuzzerCb (WOLFSSL *ssl, CallbackFuzzer cbf, void *fCtx) |
| This function sets the fuzzer callback. More...
|
|
int | wolfSSL_DTLS_SetCookieSecret (WOLFSSL *ssl, const unsigned char *secret, unsigned int secretSz) |
| This function sets a new dtls cookie secret. More...
|
|
WC_RNG * | wolfSSL_GetRNG (WOLFSSL *ssl) |
| This function retrieves the random number. More...
|
|
int | wolfSSL_CTX_SetMinVersion (WOLFSSL_CTX *ctx, int version) |
| This function sets the minimum downgrade version allowed. Applicable only when the connection allows downgrade using (wolfSSLv23_client_method or wolfSSLv23_server_method). More...
|
|
int | wolfSSL_SetMinVersion (WOLFSSL *ssl, int version) |
| This function sets the minimum downgrade version allowed. Applicable only when the connection allows downgrade using (wolfSSLv23_client_method or wolfSSLv23_server_method). More...
|
|
int | wolfSSL_GetObjectSize (void) |
| This function returns the size of the WOLFSSL object and will be dependent on build options and settings. If SHOW_SIZES has been defined when building wolfSSL, this function will also print the sizes of individual objects within the WOLFSSL object (Suites, Ciphers, etc.) to stdout. More...
|
|
int | wolfSSL_GetOutputSize (WOLFSSL *ssl, int inSz) |
| Returns the record layer size of the plaintext input. This is helpful when an application wants to know how many bytes will be sent across the Transport layer, given a specified plaintext input size. This function must be called after the SSL/TLS handshake has been completed. More...
|
|
int | wolfSSL_GetMaxOutputSize (WOLFSSL *) |
| Returns the maximum record layer size for plaintext data. This will correspond to either the maximum SSL/TLS record size as specified by the protocol standard, the maximum TLS fragment size as set by the TLS Max Fragment Length extension. This function is helpful when the application has called wolfSSL_GetOutputSize() and received a INPUT_SIZE_E error. This function must be called after the SSL/TLS handshake has been completed. More...
|
|
int | wolfSSL_SetVersion (WOLFSSL *ssl, int version) |
| This function sets the SSL/TLS protocol version for the specified SSL session (WOLFSSL object) using the version as specified by version. This will override the protocol setting for the SSL session (ssl) - originally defined and set by the SSL context (wolfSSL_CTX_new()) method type. More...
|
|
void | wolfSSL_CTX_SetMacEncryptCb (WOLFSSL_CTX *ctx, CallbackMacEncrypti cb) |
| Allows caller to set the Atomic User Record Processing Mac/Encrypt Callback. The callback should return 0 for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. macOut is the output buffer where the result of the mac should be stored. macIn is the mac input buffer and macInSz notes the size of the buffer. macContent and macVerify are needed for wolfSSL_SetTlsHmacInner() and be passed along as is. encOut is the output buffer where the result on the encryption should be stored. encIn is the input buffer to encrypt while encSz is the size of the input. An example callback can be found wolfssl/test.h myMacEncryptCb(). More...
|
|
void | wolfSSL_SetMacEncryptCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Atomic User Record Processing Mac/Encrypt Callback Context to ctx. More...
|
|
void * | wolfSSL_GetMacEncryptCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Atomic User Record Processing Mac/Encrypt Callback Context previously stored with wolfSSL_SetMacEncryptCtx(). More...
|
|
void | wolfSSL_CTX_SetDecryptVerifyCb (WOLFSSL_CTX *ctx, CallbackDecryptVerify cb) |
| Allows caller to set the Atomic User Record Processing Decrypt/Verify Callback. The callback should return 0 for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. decOut is the output buffer where the result of the decryption should be stored. decIn is the encrypted input buffer and decInSz notes the size of the buffer. content and verify are needed for wolfSSL_SetTlsHmacInner() and be passed along as is. padSz is an output variable that should be set with the total value of the padding. That is, the mac size plus any padding and pad bytes. An example callback can be found wolfssl/test.h myDecryptVerifyCb(). More...
|
|
void | wolfSSL_SetDecryptVerifyCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Atomic User Record Processing Decrypt/Verify Callback Context to ctx. More...
|
|
void * | wolfSSL_GetDecryptVerifyCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Atomic User Record Processing Decrypt/Verify Callback Context previously stored with wolfSSL_SetDecryptVerifyCtx(). More...
|
|
const unsigned char * | wolfSSL_GetMacSecret (WOLFSSL *ssl, int verify) |
| Allows retrieval of the Hmac/Mac secret from the handshake process. The verify parameter specifies whether this is for verification of a peer message. More...
|
|
const unsigned char * | wolfSSL_GetClientWriteKey (WOLFSSL *) |
| Allows retrieval of the client write key from the handshake process. More...
|
|
const unsigned char * | wolfSSL_GetClientWriteIV (WOLFSSL *) |
| Allows retrieval of the client write IV (initialization vector) from the handshake process. More...
|
|
const unsigned char * | wolfSSL_GetServerWriteKey (WOLFSSL *) |
| Allows retrieval of the server write key from the handshake process. More...
|
|
const unsigned char * | wolfSSL_GetServerWriteIV (WOLFSSL *) |
| Allows retrieval of the server write IV (initialization vector) from the handshake process. More...
|
|
int | wolfSSL_GetKeySize (WOLFSSL *) |
| Allows retrieval of the key size from the handshake process. More...
|
|
int | wolfSSL_GetIVSize (WOLFSSL *) |
| Returns the iv_size member of the specs structure held in the WOLFSSL struct. More...
|
|
int | wolfSSL_GetSide (WOLFSSL *) |
| Allows retrieval of the side of this WOLFSSL connection. More...
|
|
int | wolfSSL_IsTLSv1_1 (WOLFSSL *) |
| Allows caller to determine if the negotiated protocol version is at least TLS version 1.1 or greater. More...
|
|
int | wolfSSL_GetBulkCipher (WOLFSSL *) |
| Allows caller to determine the negotiated bulk cipher algorithm from the handshake. More...
|
|
int | wolfSSL_GetCipherBlockSize (WOLFSSL *) |
| Allows caller to determine the negotiated cipher block size from the handshake. More...
|
|
int | wolfSSL_GetAeadMacSize (WOLFSSL *) |
| Allows caller to determine the negotiated aead mac size from the handshake. For cipher type WOLFSSL_AEAD_TYPE. More...
|
|
int | wolfSSL_GetHmacSize (WOLFSSL *) |
| Allows caller to determine the negotiated (h)mac size from the handshake. For cipher types except WOLFSSL_AEAD_TYPE. More...
|
|
int | wolfSSL_GetHmacType (WOLFSSL *) |
| Allows caller to determine the negotiated (h)mac type from the handshake. For cipher types except WOLFSSL_AEAD_TYPE. More...
|
|
int | wolfSSL_GetCipherType (WOLFSSL *) |
| Allows caller to determine the negotiated cipher type from the handshake. More...
|
|
int | wolfSSL_SetTlsHmacInner (WOLFSSL *ssl, byte *inner, word32 sz, int content, int verify) |
| Allows caller to set the Hmac Inner vector for message sending/receiving. The result is written to inner which should be at least wolfSSL_GetHmacSize() bytes. The size of the message is specified by sz, content is the type of message, and verify specifies whether this is a verification of a peer message. Valid for cipher types excluding WOLFSSL_AEAD_TYPE. More...
|
|
void | wolfSSL_CTX_SetEccSignCb (WOLFSSL_CTX *ctx, CallbackEccSign cb) |
| Allows caller to set the Public Key Callback for ECC Signing. The callback should return 0 for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. in is the input buffer to sign while inSz denotes the length of the input. out is the output buffer where the result of the signature should be stored. outSz is an input/output variable that specifies the size of the output buffer upon invocation and the actual size of the signature should be stored there before returning. keyDer is the ECC Private key in ASN1 format and keySz is the length of the key in bytes. An example callback can be found wolfssl/test.h myEccSign(). More...
|
|
void | wolfSSL_SetEccSignCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Public Key Ecc Signing Callback Context to ctx. More...
|
|
void * | wolfSSL_GetEccSignCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Public Key Ecc Signing Callback Context previously stored with wolfSSL_SetEccSignCtx(). More...
|
|
void | wolfSSL_CTX_SetEccSignCtx (WOLFSSL_CTX *ctx, void *userCtx) |
| Allows caller to set the Public Key Ecc Signing Callback Context to ctx. More...
|
|
void * | wolfSSL_CTX_GetEccSignCtx (WOLFSSL_CTX *ctx) |
| Allows caller to retrieve the Public Key Ecc Signing Callback Context previously stored with wolfSSL_SetEccSignCtx(). More...
|
|
void | wolfSSL_CTX_SetEccVerifyCb (WOLFSSL_CTX *ctx, CallbackEccVerify cb) |
| Allows caller to set the Public Key Callback for ECC Verification. The callback should return 0 for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. sig is the signature to verify and sigSz denotes the length of the signature. hash is an input buffer containing the digest of the message and hashSz denotes the length in bytes of the hash. result is an output variable where the result of the verification should be stored, 1 for success and 0 for failure. keyDer is the ECC Private key in ASN1 format and keySz is the length of the key in bytes. An example callback can be found wolfssl/test.h myEccVerify(). More...
|
|
void | wolfSSL_SetEccVerifyCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Public Key Ecc Verification Callback Context to ctx. More...
|
|
void * | wolfSSL_GetEccVerifyCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Public Key Ecc Verification Callback Context previously stored with wolfSSL_SetEccVerifyCtx(). More...
|
|
void | wolfSSL_CTX_SetRsaSignCb (WOLFSSL_CTX *ctx, CallbackRsaSign cb) |
| Allows caller to set the Public Key Callback for RSA Signing. The callback should return 0 for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. in is the input buffer to sign while inSz denotes the length of the input. out is the output buffer where the result of the signature should be stored. outSz is an input/output variable that specifies the size of the output buffer upon invocation and the actual size of the signature should be stored there before returning. keyDer is the RSA Private key in ASN1 format and keySz is the length of the key in bytes. An example callback can be found wolfssl/test.h myRsaSign(). More...
|
|
void | wolfSSL_SetRsaSignCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Public Key RSA Signing Callback Context to ctx. More...
|
|
void * | wolfSSL_GetRsaSignCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Public Key RSA Signing Callback Context previously stored with wolfSSL_SetRsaSignCtx(). More...
|
|
void | wolfSSL_CTX_SetRsaVerifyCb (WOLFSSL_CTX *ctx, CallbackRsaVerify cb) |
| Allows caller to set the Public Key Callback for RSA Verification. The callback should return the number of plaintext bytes for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. sig is the signature to verify and sigSz denotes the length of the signature. out should be set to the beginning of the verification buffer after the decryption process and any padding. keyDer is the RSA Public key in ASN1 format and keySz is the length of the key in bytes. An example callback can be found wolfssl/test.h myRsaVerify(). More...
|
|
void | wolfSSL_SetRsaVerifyCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Public Key RSA Verification Callback Context to ctx. More...
|
|
void * | wolfSSL_GetRsaVerifyCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Public Key RSA Verification Callback Context previously stored with wolfSSL_SetRsaVerifyCtx(). More...
|
|
void | wolfSSL_CTX_SetRsaEncCb (WOLFSSL_CTX *ctx, CallbackRsaEnc cb) |
| Allows caller to set the Public Key Callback for RSA Public Encrypt. The callback should return 0 for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. in is the input buffer to encrypt while inSz denotes the length of the input. out is the output buffer where the result of the encryption should be stored. outSz is an input/output variable that specifies the size of the output buffer upon invocation and the actual size of the encryption should be stored there before returning. keyDer is the RSA Public key in ASN1 format and keySz is the length of the key in bytes. An example callback can be found wolfssl/test.h myRsaEnc(). More...
|
|
void | wolfSSL_SetRsaEncCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Public Key RSA Public Encrypt Callback Context to ctx. More...
|
|
void * | wolfSSL_GetRsaEncCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Public Key RSA Public Encrypt Callback Context previously stored with wolfSSL_SetRsaEncCtx(). More...
|
|
void | wolfSSL_CTX_SetRsaDecCb (WOLFSSL_CTX *ctx, CallbackRsaDec cb) |
| Allows caller to set the Public Key Callback for RSA Private Decrypt. The callback should return the number of plaintext bytes for success or < 0 for an error. The ssl and ctx pointers are available for the user’s convenience. in is the input buffer to decrypt and inSz denotes the length of the input. out should be set to the beginning of the decryption buffer after the decryption process and any padding. keyDer is the RSA Private key in ASN1 format and keySz is the length of the key in bytes. An example callback can be found wolfssl/test.h myRsaDec(). More...
|
|
void | wolfSSL_SetRsaDecCtx (WOLFSSL *ssl, void *ctx) |
| Allows caller to set the Public Key RSA Private Decrypt Callback Context to ctx. More...
|
|
void * | wolfSSL_GetRsaDecCtx (WOLFSSL *ssl) |
| Allows caller to retrieve the Public Key RSA Private Decrypt Callback Context previously stored with wolfSSL_SetRsaDecCtx(). More...
|
|
void | wolfSSL_CTX_SetCACb (WOLFSSL_CTX *ctx, CallbackCACache cb) |
| This function registers a callback with the SSL context (WOLFSSL_CTX) to be called when a new CA certificate is loaded into wolfSSL. The callback is given a buffer with the DER-encoded certificate. More...
|
|
WOLFSSL_CERT_MANAGER * | wolfSSL_CertManagerNew_ex (void *heap) |
| Allocates and initializes a new Certificate Manager context. This context may be used independent of SSL needs. It may be used to load certificates, verify certificates, and check the revocation status. More...
|
|
WOLFSSL_CERT_MANAGER * | wolfSSL_CertManagerNew (void) |
| Allocates and initializes a new Certificate Manager context. This context may be used independent of SSL needs. It may be used to load certificates, verify certificates, and check the revocation status. More...
|
|
void | wolfSSL_CertManagerFree (WOLFSSL_CERT_MANAGER *) |
| Frees all resources associated with the Certificate Manager context. Call this when you no longer need to use the Certificate Manager. More...
|
|
int | wolfSSL_CertManagerLoadCA (WOLFSSL_CERT_MANAGER *cm, const char *f, const char *d) |
| Specifies the locations for CA certificate loading into the manager context. The PEM certificate CAfile may contain several trusted CA certificates. If CApath is not NULL it specifies a directory containing CA certificates in PEM format. More...
|
|
int | wolfSSL_CertManagerLoadCABuffer (WOLFSSL_CERT_MANAGER *cm, const unsigned char *in, long sz, int format) |
| Loads the CA Buffer by calling wolfSSL_CTX_load_verify_buffer and returning that result using a temporary cm so as not to lose the information in the cm passed into the function. More...
|
|
int | wolfSSL_CertManagerUnloadCAs (WOLFSSL_CERT_MANAGER *cm) |
| This function unloads the CA signer list. More...
|
|
int | wolfSSL_CertManagerUnloadIntermediateCerts (WOLFSSL_CERT_MANAGER *cm) |
| This function unloads intermediate certificates add to the CA signer list. More...
|
|
int | wolfSSL_CertManagerUnload_trust_peers (WOLFSSL_CERT_MANAGER *cm) |
| The function will free the Trusted Peer linked list and unlocks the trusted peer list. More...
|
|
int | wolfSSL_CertManagerVerify (WOLFSSL_CERT_MANAGER *cm, const char *f, int format) |
| Specifies the certificate to verify with the Certificate Manager context. The format can be SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1. More...
|
|
int | wolfSSL_CertManagerVerifyBuffer (WOLFSSL_CERT_MANAGER *cm, const unsigned char *buff, long sz, int format) |
| Specifies the certificate buffer to verify with the Certificate Manager context. The format can be SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1. More...
|
|
void | wolfSSL_CertManagerSetVerify (WOLFSSL_CERT_MANAGER *cm, VerifyCallback vc) |
| The function sets the verifyCallback function in the Certificate Manager. If present, it will be called for each cert loaded. If there is a verification error, the verify callback can be used to over-ride the error. More...
|
|
int | wolfSSL_CertManagerCheckCRL (WOLFSSL_CERT_MANAGER *cm, unsigned char *der, int sz) |
| Check CRL if the option is enabled and compares the cert to the CRL list. More...
|
|
int | wolfSSL_CertManagerEnableCRL (WOLFSSL_CERT_MANAGER *cm, int options) |
| Turns on Certificate Revocation List checking when verifying certificates with the Certificate Manager. By default, CRL checking is off. options include WOLFSSL_CRL_CHECKALL which performs CRL checking on each certificate in the chain versus the Leaf certificate only which is the default. More...
|
|
int | wolfSSL_CertManagerDisableCRL (WOLFSSL_CERT_MANAGER *) |
| Turns off Certificate Revocation List checking when verifying certificates with the Certificate Manager. By default, CRL checking is off. You can use this function to temporarily or permanently disable CRL checking with this Certificate Manager context that previously had CRL checking enabled. More...
|
|
int | wolfSSL_CertManagerLoadCRL (WOLFSSL_CERT_MANAGER *cm, const char *path, int type, int monitor) |
| Error checks and passes through to LoadCRL() in order to load the cert into the CRL for revocation checking. An updated CRL can be loaded by first calling wolfSSL_CertManagerFreeCRL, then loading the new CRL. More...
|
|
int | wolfSSL_CertManagerLoadCRLBuffer (WOLFSSL_CERT_MANAGER *cm, const unsigned char *buff, long sz, int type) |
| The function loads the CRL file by calling BufferLoadCRL. More...
|
|
int | wolfSSL_CertManagerSetCRL_Cb (WOLFSSL_CERT_MANAGER *cm, CbMissingCRL cb) |
| This function sets the CRL Certificate Manager callback. If HAVE_CRL is defined and a matching CRL record is not found then the cbMissingCRL is called (set via wolfSSL_CertManagerSetCRL_Cb). This allows you to externally retrieve the CRL and load it. More...
|
|
int | wolfSSL_CertManagerSetCRLUpdate_Cb (WOLFSSL_CERT_MANAGER *cm, CbUpdateCRL cb) |
| This function sets the CRL Update callback. If HAVE_CRL and HAVE_CRL_UPDATE_CB is defined , and an entry with the same issuer and a lower CRL number exists when a CRL is added, then the CbUpdateCRL is called with the details of the existing entry and the new one replacing it. More...
|
|
int | wolfSSL_CertManagerGetCRLInfo (WOLFSSL_CERT_MANAGER *cm, CrlInfo *info, const byte *buff, long sz, int type) int wolfSSL_CertManagerFreeCRL(WOLFSSL_CERT_MANAGER *cm) |
| This function yields a structure with parsed CRL information from an encoded CRL buffer. More...
|
|
int | wolfSSL_CertManagerCheckOCSP (WOLFSSL_CERT_MANAGER *cm, unsigned char *der, int sz) |
| The function enables the WOLFSSL_CERT_MANAGER’s member, ocspEnabled to signify that the OCSP check option is enabled. More...
|
|
int | wolfSSL_CertManagerEnableOCSP (WOLFSSL_CERT_MANAGER *cm, int options) |
| Turns on OCSP if it’s turned off and if compiled with the set option available. More...
|
|
int | wolfSSL_CertManagerDisableOCSP (WOLFSSL_CERT_MANAGER *) |
| Disables OCSP certificate revocation. More...
|
|
int | wolfSSL_CertManagerSetOCSPOverrideURL (WOLFSSL_CERT_MANAGER *cm, const char *url) |
| The function copies the url to the ocspOverrideURL member of the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_CertManagerSetOCSP_Cb (WOLFSSL_CERT_MANAGER *cm, CbOCSPIO ioCb, CbOCSPRespFree respFreeCb, void *ioCbCtx) |
| The function sets the OCSP callback in the WOLFSSL_CERT_MANAGER. More...
|
|
int | wolfSSL_CertManagerEnableOCSPStapling (WOLFSSL_CERT_MANAGER *cm) |
| This function turns on OCSP stapling if it is not turned on as well as set the options. More...
|
|
int | wolfSSL_EnableCRL (WOLFSSL *ssl, int options) |
| Enables CRL certificate revocation. More...
|
|
int | wolfSSL_DisableCRL (WOLFSSL *ssl) |
| Disables CRL certificate revocation. More...
|
|
int | wolfSSL_LoadCRL (WOLFSSL *ssl, const char *path, int type, int monitor) |
| A wrapper function that ends up calling LoadCRL to load the certificate for revocation checking. More...
|
|
int | wolfSSL_SetCRL_Cb (WOLFSSL *ssl, CbMissingCRL cb) |
| Sets the CRL callback in the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_EnableOCSP (WOLFSSL *ssl, int options) |
| This function enables OCSP certificate verification. The value of options if formed by or’ing one or more of the following options: WOLFSSL_OCSP_URL_OVERRIDE - use the override URL instead of the URL in certificates. The override URL is specified using the wolfSSL_CTX_SetOCSP_OverrideURL() function. WOLFSSL_OCSP_CHECKALL - Set all OCSP checks on WOLFSSL_OCSP_NO_NONCE - Set nonce option for creating OCSP requests. More...
|
|
int | wolfSSL_DisableOCSP (WOLFSSL *) |
| Disables the OCSP certificate revocation option. More...
|
|
int | wolfSSL_SetOCSP_OverrideURL (WOLFSSL *ssl, const char *url) |
| This function sets the ocspOverrideURL member in the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_SetOCSP_Cb (WOLFSSL *ssl, CbOCSPIO ioCb, CbOCSPRespFree respFreeCb, void *ioCbCtx) |
| This function sets the OCSP callback in the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_CTX_EnableCRL (WOLFSSL_CTX *ctx, int options) |
| Enables CRL certificate verification through the CTX. More...
|
|
int | wolfSSL_CTX_DisableCRL (WOLFSSL_CTX *ctx) |
| This function disables CRL verification in the CTX structure. More...
|
|
int | wolfSSL_CTX_LoadCRL (WOLFSSL_CTX *ctx, const char *path, int type, int monitor) |
| This function loads CRL into the WOLFSSL_CTX structure through wolfSSL_CertManagerLoadCRL(). More...
|
|
int | wolfSSL_CTX_SetCRL_Cb (WOLFSSL_CTX *ctx, CbMissingCRL cb) |
| This function will set the callback argument to the cbMissingCRL member of the WOLFSSL_CERT_MANAGER structure by calling wolfSSL_CertManagerSetCRL_Cb. More...
|
|
int | wolfSSL_CTX_EnableOCSP (WOLFSSL_CTX *ctx, int options) |
| This function sets options to configure behavior of OCSP functionality in wolfSSL. The value of options if formed by or’ing one or more of the following options: WOLFSSL_OCSP_URL_OVERRIDE - use the override URL instead of the URL in certificates. The override URL is specified using the wolfSSL_CTX_SetOCSP_OverrideURL() function. WOLFSSL_OCSP_CHECKALL - Set all OCSP checks on WOLFSSL_OCSP_NO_NONCE - Set nonce option for creating OCSP requests. More...
|
|
int | wolfSSL_CTX_DisableOCSP (WOLFSSL_CTX *) |
| This function disables OCSP certificate revocation checking by affecting the ocspEnabled member of the WOLFSSL_CERT_MANAGER structure. More...
|
|
int | wolfSSL_CTX_SetOCSP_OverrideURL (WOLFSSL_CTX *ctx, const char *url) |
| This function manually sets the URL for OCSP to use. By default, OCSP will use the URL found in the individual certificate unless the WOLFSSL_OCSP_URL_OVERRIDE option is set using the wolfSSL_CTX_EnableOCSP. More...
|
|
int | wolfSSL_CTX_SetOCSP_Cb (WOLFSSL_CTX *ctx, CbOCSPIO ioCb, CbOCSPRespFree respFreeCb, void *ioCbCtx) |
| Sets the callback for the OCSP in the WOLFSSL_CTX structure. More...
|
|
int | wolfSSL_CTX_EnableOCSPStapling (WOLFSSL_CTX *) |
| This function enables OCSP stapling by calling wolfSSL_CertManagerEnableOCSPStapling(). More...
|
|
void | wolfSSL_KeepArrays (WOLFSSL *) |
| Normally, at the end of the SSL handshake, wolfSSL frees temporary arrays. Calling this function before the handshake begins will prevent wolfSSL from freeing temporary arrays. Temporary arrays may be needed for things such as wolfSSL_get_keys() or PSK hints. When the user is done with temporary arrays, either wolfSSL_FreeArrays() may be called to free the resources immediately, or alternatively the resources will be freed when the associated SSL object is freed. More...
|
|
void | wolfSSL_FreeArrays (WOLFSSL *) |
| Normally, at the end of the SSL handshake, wolfSSL frees temporary arrays. If wolfSSL_KeepArrays() has been called before the handshake, wolfSSL will not free temporary arrays. This function explicitly frees temporary arrays and should be called when the user is done with temporary arrays and does not want to wait for the SSL object to be freed to free these resources. More...
|
|
int | wolfSSL_UseSNI (WOLFSSL *ssl, unsigned char type, const void *data, unsigned short size) |
| This function enables the use of Server Name Indication in the SSL object passed in the 'ssl' parameter. It means that the SNI extension will be sent on ClientHello by wolfSSL client and wolfSSL server will respond ClientHello + SNI with either ServerHello + blank SNI or alert fatal in case of SNI mismatch. More...
|
|
int | wolfSSL_CTX_UseSNI (WOLFSSL_CTX *ctx, unsigned char type, const void *data, unsigned short size) |
| This function enables the use of Server Name Indication for SSL objects created from the SSL context passed in the 'ctx' parameter. It means that the SNI extension will be sent on ClientHello by wolfSSL clients and wolfSSL servers will respond ClientHello + SNI with either ServerHello + blank SNI or alert fatal in case of SNI mismatch. More...
|
|
void | wolfSSL_SNI_SetOptions (WOLFSSL *ssl, unsigned char type, unsigned char options) |
| This function is called on the server side to configure the behavior of the SSL session using Server Name Indication in the SSL object passed in the 'ssl' parameter. The options are explained below. More...
|
|
void | wolfSSL_CTX_SNI_SetOptions (WOLFSSL_CTX *ctx, unsigned char type, unsigned char options) |
| This function is called on the server side to configure the behavior of the SSL sessions using Server Name Indication for SSL objects created from the SSL context passed in the 'ctx' parameter. The options are explained below. More...
|
|
int | wolfSSL_SNI_GetFromBuffer (const unsigned char *clientHello, unsigned int helloSz, unsigned char type, unsigned char *sni, unsigned int *inOutSz) |
| This function is called on the server side to retrieve the Server Name Indication provided by the client from the Client Hello message sent by the client to start a session. It does not requires context or session setup to retrieve the SNI. More...
|
|
unsigned char | wolfSSL_SNI_Status (WOLFSSL *ssl, unsigned char type) |
| This function gets the status of an SNI object. More...
|
|
unsigned short | wolfSSL_SNI_GetRequest (WOLFSSL *ssl, unsigned char type, void **data) |
| This function is called on the server side to retrieve the Server Name Indication provided by the client in a SSL session. More...
|
|
int | wolfSSL_UseALPN (WOLFSSL *ssl, char *protocol_name_list, unsigned int protocol_name_listSz, unsigned char options) |
| Setup ALPN use for a wolfSSL session. More...
|
|
int | wolfSSL_ALPN_GetProtocol (WOLFSSL *ssl, char **protocol_name, unsigned short *size) |
| This function gets the protocol name set by the server. More...
|
|
int | wolfSSL_ALPN_GetPeerProtocol (WOLFSSL *ssl, char **list, unsigned short *listSz) |
| This function copies the alpn_client_list data from the SSL object to the buffer. More...
|
|
int | wolfSSL_UseMaxFragment (WOLFSSL *ssl, unsigned char mfl) |
| This function is called on the client side to enable the use of Maximum Fragment Length in the SSL object passed in the 'ssl' parameter. It means that the Maximum Fragment Length extension will be sent on ClientHello by wolfSSL clients. More...
|
|
int | wolfSSL_CTX_UseMaxFragment (WOLFSSL_CTX *ctx, unsigned char mfl) |
| This function is called on the client side to enable the use of Maximum Fragment Length for SSL objects created from the SSL context passed in the 'ctx' parameter. It means that the Maximum Fragment Length extension will be sent on ClientHello by wolfSSL clients. More...
|
|
int | wolfSSL_UseTruncatedHMAC (WOLFSSL *ssl) |
| This function is called on the client side to enable the use of Truncated HMAC in the SSL object passed in the 'ssl' parameter. It means that the Truncated HMAC extension will be sent on ClientHello by wolfSSL clients. More...
|
|
int | wolfSSL_CTX_UseTruncatedHMAC (WOLFSSL_CTX *ctx) |
| This function is called on the client side to enable the use of Truncated HMAC for SSL objects created from the SSL context passed in the 'ctx' parameter. It means that the Truncated HMAC extension will be sent on ClientHello by wolfSSL clients. More...
|
|
int | wolfSSL_UseOCSPStapling (WOLFSSL *ssl, unsigned char status_type, unsigned char options) |
| Stapling eliminates the need to contact the CA. Stapling lowers the cost of certificate revocation check presented in OCSP. More...
|
|
int | wolfSSL_CTX_UseOCSPStapling (WOLFSSL_CTX *ctx, unsigned char status_type, unsigned char options) |
| This function requests the certificate status during the handshake. More...
|
|
int | wolfSSL_UseOCSPStaplingV2 (WOLFSSL *ssl, unsigned char status_type, unsigned char options) |
| The function sets the status type and options for OCSP. More...
|
|
int | wolfSSL_CTX_UseOCSPStaplingV2 (WOLFSSL_CTX *ctx, unsigned char status_type, unsigned char options) |
| Creates and initializes the certificate status request for OCSP Stapling. More...
|
|
int | wolfSSL_UseSupportedCurve (WOLFSSL *ssl, word16 name) |
| This function is called on the client side to enable the use of Supported Elliptic Curves Extension in the SSL object passed in the 'ssl' parameter. It means that the supported curves enabled will be sent on ClientHello by wolfSSL clients. This function can be called more than one time to enable multiple curves. More...
|
|
int | wolfSSL_CTX_UseSupportedCurve (WOLFSSL_CTX *ctx, word16 name) |
| This function is called on the client side to enable the use of Supported Elliptic Curves Extension for SSL objects created from the SSL context passed in the 'ctx' parameter. It means that the supported curves enabled will be sent on ClientHello by wolfSSL clients. This function can be called more than one time to enable multiple curves. More...
|
|
int | wolfSSL_UseSecureRenegotiation (WOLFSSL *ssl) |
| This function forces secure renegotiation for the supplied WOLFSSL structure. This is not recommended. More...
|
|
int | wolfSSL_Rehandshake (WOLFSSL *ssl) |
| This function executes a secure renegotiation handshake; this is user forced as wolfSSL discourages this functionality. More...
|
|
int | wolfSSL_UseSessionTicket (WOLFSSL *ssl) |
| Force provided WOLFSSL structure to use session ticket. The constant HAVE_SESSION_TICKET should be defined and the constant NO_WOLFSSL_CLIENT should not be defined to use this function. More...
|
|
int | wolfSSL_CTX_UseSessionTicket (WOLFSSL_CTX *ctx) |
| This function sets wolfSSL context to use a session ticket. More...
|
|
int | wolfSSL_get_SessionTicket (WOLFSSL *ssl, unsigned char *buf, word32 *bufSz) |
| This function copies the ticket member of the Session structure to the buffer. More...
|
|
int | wolfSSL_set_SessionTicket (WOLFSSL *ssl, const unsigned char *buf, word32 bufSz) |
| This function sets the ticket member of the WOLFSSL_SESSION structure within the WOLFSSL struct. The buffer passed into the function is copied to memory. More...
|
|
int | wolfSSL_set_SessionTicket_cb (WOLFSSL *ssl, CallbackSessionTicket cb, void *ctx) |
| This function sets the session ticket callback. The type CallbackSessionTicket is a function pointer with the signature of: int (CallbackSessionTicket)(WOLFSSL, const unsigned char*, int, void*) More...
|
|
int | wolfSSL_send_SessionTicket (WOLFSSL *ssl) |
| This function sends a session ticket to the client after a TLS v1.3 handhsake has been established. More...
|
|
int | wolfSSL_CTX_set_TicketEncCb (WOLFSSL_CTX *ctx, SessionTicketEncCb) |
| This function sets the session ticket key encrypt callback function for a server to support session tickets as specified in RFC 5077. More...
|
|
int | wolfSSL_CTX_set_TicketHint (WOLFSSL_CTX *ctx, int) |
| This function sets the session ticket hint relayed to the client. For server side use. More...
|
|
int | wolfSSL_CTX_set_TicketEncCtx (WOLFSSL_CTX *ctx, void *) |
| This function sets the session ticket encrypt user context for the callback. For server side use. More...
|
|
void * | wolfSSL_CTX_get_TicketEncCtx (WOLFSSL_CTX *ctx) |
| This function gets the session ticket encrypt user context for the callback. For server side use. More...
|
|
int | wolfSSL_SetHsDoneCb (WOLFSSL *ssl, HandShakeDoneCb cb, void *user_ctx) |
| This function sets the handshake done callback. The hsDoneCb and hsDoneCtx members of the WOLFSSL structure are set in this function. More...
|
|
int | wolfSSL_PrintSessionStats (void) |
| This function prints the statistics from the session. More...
|
|
int | wolfSSL_get_session_stats (unsigned int *active, unsigned int *total, unsigned int *peak, unsigned int *maxSessions) |
| This function gets the statistics for the session. More...
|
|
int | wolfSSL_MakeTlsMasterSecret (unsigned char *ms, word32 msLen, const unsigned char *pms, word32 pmsLen, const unsigned char *cr, const unsigned char *sr, int tls1_2, int hash_type) |
| This function copies the values of cr and sr then passes through to wc_PRF (pseudo random function) and returns that value. More...
|
|
int | wolfSSL_DeriveTlsKeys (unsigned char *key_data, word32 keyLen, const unsigned char *ms, word32 msLen, const unsigned char *sr, const unsigned char *cr, int tls1_2, int hash_type) |
| An external facing wrapper to derive TLS Keys. More...
|
|
int | wolfSSL_connect_ex (WOLFSSL *ssl, HandShakeCallBack hsCb, TimeoutCallBack toCb, WOLFSSL_TIMEVAL timeout) |
| wolfSSL_connect_ex() is an extension that allows a HandShake Callback to be set. This can be useful in embedded systems for debugging support when a debugger isn’t available and sniffing is impractical. The HandShake Callback will be called whether or not a handshake error occurred. No dynamic memory is used since the maximum number of SSL packets is known. Packet names can be accessed through packetNames[]. The connect extension also allows a Timeout Callback to be set along with a timeout value. This is useful if the user doesn’t want to wait for the TCP stack to timeout. This extension can be called with either, both, or neither callbacks. More...
|
|
int | wolfSSL_accept_ex (WOLFSSL *ssl, HandShakeCallBacki hsCb, TimeoutCallBack toCb, WOLFSSL_TIMEVAL timeout) |
| wolfSSL_accept_ex() is an extension that allows a HandShake Callback to be set. This can be useful in embedded systems for debugging support when a debugger isn’t available and sniffing is impractical. The HandShake Callback will be called whether or not a handshake error occurred. No dynamic memory is used since the maximum number of SSL packets is known. Packet names can be accessed through packetNames[]. The connect extension also allows a Timeout Callback to be set along with a timeout value. This is useful if the user doesn’t want to wait for the TCP stack to timeout. This extension can be called with either, both, or neither callbacks. More...
|
|
long | wolfSSL_BIO_set_fp (WOLFSSL_BIO *bio, XFILE fp, int c) |
| This is used to set the internal file pointer for a BIO. More...
|
|
long | wolfSSL_BIO_get_fp (WOLFSSL_BIO *bio, XFILE *fp) |
| This is used to get the internal file pointer for a BIO. More...
|
|
int | wolfSSL_check_private_key (const WOLFSSL *ssl) |
| This function checks that the private key is a match with the certificate being used. More...
|
|
int | wolfSSL_X509_get_ext_by_NID (const WOLFSSL_X509 *x509, int nid, int lastPos) |
| This function looks for and returns the extension index matching the passed in NID value. More...
|
|
void * | wolfSSL_X509_get_ext_d2i (const WOLFSSL_X509 *x509, int nid, int *c, int *idx) |
| This function looks for and returns the extension matching the passed in NID value. More...
|
|
int | wolfSSL_X509_digest (const WOLFSSL_X509 *x509, const WOLFSSL_EVP_MD *digest, unsigned char *buf, unsigned int *len) |
| This function returns the hash of the DER certificate. More...
|
|
int | wolfSSL_use_certificate (WOLFSSL *ssl, WOLFSSL_X509 *x509) |
| his is used to set the certificate for WOLFSSL structure to use during a handshake. More...
|
|
int | wolfSSL_use_certificate_ASN1 (WOLFSSL *ssl, unsigned char *der, int derSz) |
| This is used to set the certificate for WOLFSSL structure to use during a handshake. A DER formatted buffer is expected. More...
|
|
int | wolfSSL_use_PrivateKey (WOLFSSL *ssl, WOLFSSL_EVP_PKEY *pkey) |
| This is used to set the private key for the WOLFSSL structure. More...
|
|
int | wolfSSL_use_PrivateKey_ASN1 (int pri, WOLFSSL *ssl, unsigned char *der, long derSz) |
| This is used to set the private key for the WOLFSSL structure. A DER formatted key buffer is expected. More...
|
|
int | wolfSSL_use_RSAPrivateKey_ASN1 (WOLFSSL *ssl, unsigned char *der, long derSz) |
| This is used to set the private key for the WOLFSSL structure. A DER formatted RSA key buffer is expected. More...
|
|
WOLFSSL_DH * | wolfSSL_DSA_dup_DH (const WOLFSSL_DSA *r) |
| This function duplicates the parameters in dsa to a newly created WOLFSSL_DH structure. More...
|
|
int | wolfSSL_SESSION_get_master_key (const WOLFSSL_SESSION *ses, unsigned char *out, int outSz) |
| This is used to get the master key after completing a handshake. More...
|
|
int | wolfSSL_SESSION_get_master_key_length (const WOLFSSL_SESSION *ses) |
| This is used to get the master secret key length. More...
|
|
void | wolfSSL_CTX_set_cert_store (WOLFSSL_CTX *ctx, WOLFSSL_X509_STORE *str) |
| This is a setter function for the WOLFSSL_X509_STORE structure in ctx. More...
|
|
WOLFSSL_X509 * | wolfSSL_d2i_X509_bio (WOLFSSL_BIO *bio, WOLFSSL_X509 **x509) |
| This function get the DER buffer from bio and converts it to a WOLFSSL_X509 structure. More...
|
|
WOLFSSL_X509_STORE * | wolfSSL_CTX_get_cert_store (WOLFSSL_CTX *ctx) |
| This is a getter function for the WOLFSSL_X509_STORE structure in ctx. More...
|
|
size_t | wolfSSL_BIO_ctrl_pending (WOLFSSL_BIO *b) |
| Gets the number of pending bytes to read. If BIO type is BIO_BIO then is the number to read from pair. If BIO contains an SSL object then is pending data from SSL object (wolfSSL_pending(ssl)). If is BIO_MEMORY type then returns the size of memory buffer. More...
|
|
size_t | wolfSSL_get_server_random (const WOLFSSL *ssl, unsigned char *out, size_t outlen) |
| This is used to get the random data sent by the server during the handshake. More...
|
|
size_t | wolfSSL_get_client_random (const WOLFSSL *ssl, unsigned char *out, size_t outSz) |
| This is used to get the random data sent by the client during the handshake. More...
|
|
wc_pem_password_cb * | wolfSSL_CTX_get_default_passwd_cb (WOLFSSL_CTX *ctx) |
| This is a getter function for the password callback set in ctx. More...
|
|
void * | wolfSSL_CTX_get_default_passwd_cb_userdata (WOLFSSL_CTX *ctx) |
| This is a getter function for the password callback user data set in ctx. More...
|
|
WOLFSSL_X509 * | wolfSSL_PEM_read_bio_X509_AUX (WOLFSSL_BIO *bp, WOLFSSL_X509 **x, wc_pem_password_cb *cb, void *u) |
| This function behaves the same as wolfSSL_PEM_read_bio_X509. AUX signifies containing extra information such as trusted/rejected use cases and friendly name for human readability. More...
|
|
long | wolfSSL_CTX_set_tmp_dh (WOLFSSL_CTX *ctx, WOLFSSL_DH *dh) |
| Initializes the WOLFSSL_CTX structure’s dh member with the Diffie-Hellman parameters. More...
|
|
WOLFSSL_DSA * | wolfSSL_PEM_read_bio_DSAparams (WOLFSSL_BIO *bp, WOLFSSL_DSA **x, wc_pem_password_cb *cb, void *u) |
| This function get the DSA parameters from a PEM buffer in bio. More...
|
|
unsigned long | wolfSSL_ERR_peek_last_error (void) |
| This function returns the absolute value of the last error from WOLFSSL_ERROR encountered. More...
|
|
| WOLF_STACK_OF (WOLFSSL_X509) *wolfSSL_get_peer_cert_chain(const WOLFSSL *) |
| This function gets the peer’s certificate chain. More...
|
|
long | wolfSSL_CTX_clear_options (WOLFSSL_CTX *ctx, long opt) |
| This function resets option bits of WOLFSSL_CTX object. More...
|
|
int | wolfSSL_set_jobject (WOLFSSL *ssl, void *objPtr) |
| This function sets the jObjectRef member of the WOLFSSL structure. More...
|
|
void * | wolfSSL_get_jobject (WOLFSSL *ssl) |
| This function returns the jObjectRef member of the WOLFSSL structure. More...
|
|
int | wolfSSL_set_msg_callback (WOLFSSL *ssl, SSL_Msg_Cb cb) |
| This function sets a callback in the ssl. The callback is to observe handshake messages. NULL value of cb resets the callback. More...
|
|
int | wolfSSL_set_msg_callback_arg (WOLFSSL *ssl, void *arg) |
| This function sets associated callback context value in the ssl. The value is handed over to the callback argument. More...
|
|
char * | wolfSSL_X509_get_next_altname (WOLFSSL_X509 *) |
| This function returns the next, if any, altname from the peer certificate. More...
|
|
WOLFSSL_ASN1_TIME * | wolfSSL_X509_get_notBefore (WOLFSSL_X509 *) |
| The function checks to see if x509 is NULL and if it’s not, it returns the notBefore member of the x509 struct. More...
|
|
int | wolfSSL_connect (WOLFSSL *ssl) |
| This function is called on the client side and initiates an SSL/TLS handshake with a server. When this function is called, the underlying communication channel has already been set up. wolfSSL_connect() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_connect() will return when the underlying I/O could not satisfy the needs of wolfSSL_connect to continue the handshake. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_connect() when the underlying I/O is ready and wolfSSL will pick up where it left off. When using a non-blocking socket, nothing needs to be done, but select() can be used to check for the required condition. If the underlying I/O is blocking, wolfSSL_connect() will only return once the handshake has been finished or an error occurred. wolfSSL takes a different approach to certificate verification than OpenSSL does. The default policy for the client is to verify the server, this means that if you don't load CAs to verify the server you'll get a connect error, unable to verify (-155). It you want to mimic OpenSSL behavior of having SSL_connect succeed even if verifying the server fails and reducing security you can do this by calling: SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0); before calling SSL_new(); Though it's not recommended. More...
|
|
int | wolfSSL_send_hrr_cookie (WOLFSSL *ssl, const unsigned char *secret, unsigned int secretSz) |
| This function is called on the server side to indicate that a HelloRetryRequest message must contain a Cookie and, in case of using protocol DTLS v1.3, that the handshake will always include a cookie exchange. Please note that when using protocol DTLS v1.3, the cookie exchange is enabled by default. The Cookie holds a hash of the current transcript so that another server process can handle the ClientHello in reply. The secret is used when generating the integrity check on the Cookie data. More...
|
|
int | wolfSSL_disable_hrr_cookie (WOLFSSL *ssl) |
| This function is called on the server side to indicate that a HelloRetryRequest message must NOT contain a Cookie and that, if using protocol DTLS v1.3, a cookie exchange will not be included in the handshake. Please note that not doing a cookie exchange when using protocol DTLS v1.3 can make the server susceptible to DoS/Amplification attacks. More...
|
|
int | wolfSSL_CTX_no_ticket_TLSv13 (WOLFSSL_CTX *ctx) |
| This function is called on the server to stop it from sending a resumption session ticket once the handshake is complete. More...
|
|
int | wolfSSL_no_ticket_TLSv13 (WOLFSSL *ssl) |
| This function is called on the server to stop it from sending a resumption session ticket once the handshake is complete. More...
|
|
int | wolfSSL_CTX_no_dhe_psk (WOLFSSL_CTX *ctx) |
| This function is called on a TLS v1.3 wolfSSL context to disallow Diffie-Hellman (DH) style key exchanges when handshakes are using pre-shared keys for authentication. More...
|
|
int | wolfSSL_no_dhe_psk (WOLFSSL *ssl) |
| This function is called on a TLS v1.3 client or server wolfSSL to disallow Diffie-Hellman (DH) style key exchanges when handshakes are using pre-shared keys for authentication. More...
|
|
int | wolfSSL_update_keys (WOLFSSL *ssl) |
| This function is called on a TLS v1.3 client or server wolfSSL to force the rollover of keys. A KeyUpdate message is sent to the peer and new keys are calculated for encryption. The peer will send back a KeyUpdate message and the new decryption keys will then be calculated. This function can only be called after a handshake has been completed. More...
|
|
int | wolfSSL_key_update_response (WOLFSSL *ssl, int *required) |
| This function is called on a TLS v1.3 client or server wolfSSL to determine whether a rollover of keys is in progress. When wolfSSL_update_keys() is called, a KeyUpdate message is sent and the encryption key is updated. The decryption key is updated when the response is received. More...
|
|
int | wolfSSL_CTX_allow_post_handshake_auth (WOLFSSL_CTX *ctx) |
| This function is called on a TLS v1.3 client wolfSSL context to allow a client certificate to be sent post handshake upon request from server. This is useful when connecting to a web server that has some pages that require client authentication and others that don't. More...
|
|
int | wolfSSL_allow_post_handshake_auth (WOLFSSL *ssl) |
| This function is called on a TLS v1.3 client wolfSSL to allow a client certificate to be sent post handshake upon request from server. A Post-Handshake Client Authentication extension is sent in the ClientHello. This is useful when connecting to a web server that has some pages that require client authentication and others that don't. More...
|
|
int | wolfSSL_request_certificate (WOLFSSL *ssl) |
| This function requests a client certificate from the TLS v1.3 client. This is useful when a web server is serving some pages that require client authentication and others that don't. A maximum of 256 requests can be sent on a connection. More...
|
|
int | wolfSSL_CTX_set1_groups_list (WOLFSSL_CTX *ctx, char *list) |
| This function sets the list of elliptic curve groups to allow on a wolfSSL context in order of preference. The list is a null-terminated text string, and a colon-delimited list. Call this function to set the key exchange elliptic curve parameters to use with the TLS v1.3 connections. More...
|
|
int | wolfSSL_set1_groups_list (WOLFSSL *ssl, char *list) |
| This function sets the list of elliptic curve groups to allow on a wolfSSL in order of preference. The list is a null-terminated text string, and a colon-delimited list. Call this function to set the key exchange elliptic curve parameters to use with the TLS v1.3 connections. More...
|
|
int | wolfSSL_preferred_group (WOLFSSL *ssl) |
| This function returns the key exchange group the client prefers to use in the TLS v1.3 handshake. Call this function to after a handshake is complete to determine which group the server prefers so that this information can be used in future connections to pre-generate a key pair for key exchange. More...
|
|
int | wolfSSL_CTX_set_groups (WOLFSSL_CTX *ctx, int *groups, int count) |
| This function sets the list of elliptic curve groups to allow on a wolfSSL context in order of preference. The list is an array of group identifiers with the number of identifiers specified in count. Call this function to set the key exchange elliptic curve parameters to use with the TLS v1.3 connections. More...
|
|
int | wolfSSL_set_groups (WOLFSSL *ssl, int *groups, int count) |
| This function sets the list of elliptic curve groups to allow on a wolfSSL. The list is an array of group identifiers with the number of identifiers specified in count. Call this function to set the key exchange elliptic curve parameters to use with the TLS v1.3 connections. More...
|
|
int | wolfSSL_connect_TLSv13 (WOLFSSL *) |
| This function is called on the client side and initiates a TLS v1.3 handshake with a server. When this function is called, the underlying communication channel has already been set up. wolfSSL_connect() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_connect() will return when the underlying I/O could not satisfy the needs of wolfSSL_connect to continue the handshake. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_connect() when the underlying I/O is ready and wolfSSL will pick up where it left off. When using a non-blocking socket, nothing needs to be done, but select() can be used to check for the required condition. If the underlying I/O is blocking, wolfSSL_connect() will only return once the handshake has been finished or an error occurred. wolfSSL takes a different approach to certificate verification than OpenSSL does. The default policy for the client is to verify the server, this means that if you don't load CAs to verify the server you'll get a connect error, unable to verify (-155). It you want to mimic OpenSSL behavior of having SSL_connect succeed even if verifying the server fails and reducing security you can do this by calling: SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0); before calling SSL_new(); Though it's not recommended. More...
|
|
| wolfSSL_accept_TLSv13 (WOLFSSL *ssl) |
| This function is called on the server side and waits for a SSL/TLS client to initiate the SSL/TLS handshake. When this function is called, the underlying communication channel has already been set up. wolfSSL_accept() works with both blocking and non-blocking I/O. When the underlying I/O is non-blocking, wolfSSL_accept() will return when the underlying I/O could not satisfy the needs of wolfSSL_accept to continue the handshake. In this case, a call to wolfSSL_get_error() will yield either SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. The calling process must then repeat the call to wolfSSL_accept when data is available to read and wolfSSL will pick up where it left off. When using a non-blocking socket, nothing needs to be done, but select() can be used to check for the required condition. If the underlying I/O is blocking, wolfSSL_accept() will only return once the handshake has been finished or an error occurred. Call this function when expecting a TLS v1.3 connection though older version ClientHello messages are supported. More...
|
|
int | wolfSSL_CTX_set_max_early_data (WOLFSSL_CTX *ctx, unsigned int sz) |
| This function sets the maximum amount of early data that a TLS v1.3 client or server is willing to exchange using the wolfSSL context. Call this function to limit the amount of early data to process to mitigate replay attacks. Early data is protected by keys derived from those of the connection that the session ticket was sent and therefore will be the same every time a session ticket is used in resumption. The value is included in the session ticket for resumption. A server value of zero indicates no early data is to be sent by client using session tickets. A client value of zero indicates that the client will not send any early data. It is recommended that the number of early data bytes be kept as low as practically possible in the application. More...
|
|
int | wolfSSL_set_max_early_data (WOLFSSL *ssl, unsigned int sz) |
| This function sets the maximum amount of early data that a TLS v1.3 client or server is willing to exchange. Call this function to limit the amount of early data to process to mitigate replay attacks. Early data is protected by keys derived from those of the connection that the session ticket was sent and therefore will be the same every time a session ticket is used in resumption. The value is included in the session ticket for resumption. A server value of zero indicates no early data is to be sent by client using session tickets. A client value of zero indicates that the client will not send any early data. It is recommended that the number of early data bytes be kept as low as practically possible in the application. More...
|
|
int | wolfSSL_write_early_data (WOLFSSL *ssl, const void *data, int sz, int *outSz) |
| This function writes early data to the server on resumption. Call this function instead of wolfSSL_connect() or wolfSSL_connect_TLSv13() to connect to the server and send the data in the handshake. This function is only used with clients. More...
|
|
int | wolfSSL_read_early_data (WOLFSSL *ssl, void *data, int sz, int *outSz) |
| This function reads any early data from a client on resumption. Call this function instead of wolfSSL_accept() or wolfSSL_accept_TLSv13() to accept a client and read any early data in the handshake. The function should be invoked until wolfSSL_is_init_finished() returns true. Early data may be sent by the client in multiple messages. If there is no early data then the handshake will be processed as normal. This function is only used with servers. More...
|
|
void | wolfSSL_CTX_set_psk_client_tls13_callback (WOLFSSL_CTX *ctx, wc_psk_client_tls13_callback cb) |
| This function sets the Pre-Shared Key (PSK) client side callback for TLS v1.3 connections. The callback is used to find a PSK identity and return its key and the name of the cipher to use for the handshake. The function sets the client_psk_tls13_cb member of the WOLFSSL_CTX structure. More...
|
|
void | wolfSSL_set_psk_client_tls13_callback (WOLFSSL *ssl, wc_psk_client_tls13_callback cb) |
| This function sets the Pre-Shared Key (PSK) client side callback for TLS v1.3 connections. The callback is used to find a PSK identity and return its key and the name of the cipher to use for the handshake. The function sets the client_psk_tls13_cb member of the options field in WOLFSSL structure. More...
|
|
void | wolfSSL_CTX_set_psk_server_tls13_callback (WOLFSSL_CTX *ctx, wc_psk_server_tls13_callback cb) |
| This function sets the Pre-Shared Key (PSK) server side callback for TLS v1.3 connections. The callback is used to find a PSK identity and return its key and the name of the cipher to use for the handshake. The function sets the server_psk_tls13_cb member of the WOLFSSL_CTX structure. More...
|
|
void | wolfSSL_set_psk_server_tls13_callback (WOLFSSL *ssl, wc_psk_server_tls13_callback cb) |
| This function sets the Pre-Shared Key (PSK) server side callback for TLS v1.3 connections. The callback is used to find a PSK identity and return its key and the name of the cipher to use for the handshake. The function sets the server_psk_tls13_cb member of the options field in WOLFSSL structure. More...
|
|
int | wolfSSL_UseKeyShare (WOLFSSL *ssl, word16 group) |
| This function creates a key share entry from the group including generating a key pair. The KeyShare extension contains all the generated public keys for key exchange. If this function is called, then only the groups specified will be included. Call this function when a preferred group has been previously established for the server. More...
|
|
int | wolfSSL_NoKeyShares (WOLFSSL *ssl) |
| This function is called to ensure no key shares are sent in the ClientHello. This will force the server to respond with a HelloRetryRequest if a key exchange is required in the handshake. Call this function when the expected key exchange group is not known and to avoid the generation of keys unnecessarily. Note that an extra round-trip will be required to complete the handshake when a key exchange is required. More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_3_server_method_ex (void *heap) |
| This function is used to indicate that the application is a server and will only support the TLS 1.3 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_3_client_method_ex (void *heap) |
| This function is used to indicate that the application is a client and will only support the TLS 1.3 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_3_server_method (void) |
| This function is used to indicate that the application is a server and will only support the TLS 1.3 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_3_client_method (void) |
| This function is used to indicate that the application is a client and will only support the TLS 1.3 protocol. This function allocates memory for and initializes a new wolfSSL_METHOD structure to be used when creating the SSL/TLS context with wolfSSL_CTX_new(). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_3_method_ex (void *heap) |
| This function returns a WOLFSSL_METHOD similar to wolfTLSv1_3_client_method except that it is not determined which side yet (server/client). More...
|
|
WOLFSSL_METHOD * | wolfTLSv1_3_method (void) |
| This function returns a WOLFSSL_METHOD similar to wolfTLSv1_3_client_method except that it is not determined which side yet (server/client). More...
|
|
int | wolfSSL_CTX_set_ephemeral_key (WOLFSSL_CTX *ctx, int keyAlgo, const char *key, unsigned int keySz, int format) |
| This function sets a fixed / static ephemeral key for testing only. More...
|
|
int | wolfSSL_set_ephemeral_key (WOLFSSL *ssl, int keyAlgo, const char *key, unsigned int keySz, int format) |
| This function sets a fixed / static ephemeral key for testing only. More...
|
|
int | wolfSSL_CTX_get_ephemeral_key (WOLFSSL_CTX *ctx, int keyAlgo, const unsigned char **key, unsigned int *keySz) |
| This function returns pointer to loaded key as ASN.1/DER. More...
|
|
int | wolfSSL_get_ephemeral_key (WOLFSSL *ssl, int keyAlgo, const unsigned char **key, unsigned int *keySz) |
| This function returns pointer to loaded key as ASN.1/DER. More...
|
|
int | wolfSSL_RSA_sign_generic_padding (int type, const unsigned char *m, unsigned int mLen, unsigned char *sigRet, unsigned int *sigLen, WOLFSSL_RSA *rsa, int flag, int padding) |
| Sign a message with the chosen message digest, padding, and RSA key. More...
|
|
int | wolfSSL_dtls13_has_pending_msg (WOLFSSL *ssl) |
| checks if DTLSv1.3 stack has some messages sent but not yet acknowledged by the other peer More...
|
|
unsigned int | wolfSSL_SESSION_get_max_early_data (const WOLFSSL_SESSION *s) |
| Get the maximum size of Early Data from a session. More...
|
|
int | wolfSSL_CRYPTO_get_ex_new_index (int, void *, void *, void *, void *) |
| Get a new index for external data. This entry applies also for the following API: More...
|
|
int | wolfSSL_CTX_set_client_cert_type (WOLFSSL_CTX *ctx, const char *buf, int len) |
| In case this function is called in a client side, set certificate types that can be sent to its peer. In case called in a server side, set certificate types that can be acceptable from its peer. Put cert types in the buffer with prioritised order. To reset the settings to default, pass NULL for the buffer or pass zero for len. By default, certificate type is only X509. In case both side intend to send or accept "Raw public key" cert, WOLFSSL_CERT_TYPE_RPK should be included in the buffer to set. More...
|
|
int | wolfSSL_CTX_set_server_cert_type (WOLFSSL_CTX *ctx, const char *buf, int len) |
| In case this function is called in a server side, set certificate types that can be sent to its peer. In case called in a client side, set certificate types that can be acceptable from its peer. Put cert types in the buffer with prioritised order. To reset the settings to default, pass NULL for the buffer or pass zero for len. By default, certificate type is only X509. In case both side intend to send or accept "Raw public key" cert, WOLFSSL_CERT_TYPE_RPK should be included in the buffer to set. More...
|
|
int | wolfSSL_set_client_cert_type (WOLFSSL *ssl, const char *buf, int len) |
| In case this function is called in a client side, set certificate types that can be sent to its peer. In case called in a server side, set certificate types that can be acceptable from its peer. Put cert types in the buffer with prioritised order. To reset the settings to default, pass NULL for the buffer or pass zero for len. By default, certificate type is only X509. In case both side intend to send or accept "Raw public key" cert, WOLFSSL_CERT_TYPE_RPK should be included in the buffer to set. More...
|
|
int | wolfSSL_set_server_cert_type (WOLFSSL *ssl, const char *buf, int len) |
| In case this function is called in a server side, set certificate types that can be sent to its peer. In case called in a client side, set certificate types that can be acceptable from its peer. Put cert types in the buffer with prioritised order. To reset the settings to default, pass NULL for the buffer or pass zero for len. By default, certificate type is only X509. In case both side intend to send or accept "Raw public key" cert, WOLFSSL_CERT_TYPE_RPK should be included in the buffer to set. More...
|
|
int | wolfSSL_get_negotiated_client_cert_type (WOLFSSL *ssl, int *tp) |
| This function returns the result of the client certificate type negotiation done in ClientHello and ServerHello. WOLFSSL_SUCCESS is returned as a return value if no negotiation occurs and WOLFSSL_CERT_TYPE_UNKNOWN is returned as the certificate type. More...
|
|
int | wolfSSL_get_negotiated_server_cert_type (WOLFSSL *ssl, int *tp) |
| This function returns the result of the server certificate type negotiation done in ClientHello and ServerHello. WOLFSSL_SUCCESS is returned as a return value if no negotiation occurs and WOLFSSL_CERT_TYPE_UNKNOWN is returned as the certificate type. More...
|
|
int | wolfSSL_dtls_cid_use (WOLFSSL *ssl) |
| Enable use of ConnectionID extensions for the SSL object. See RFC 9146 and RFC 9147. More...
|
|
int | wolfSSL_dtls_cid_is_enabled (WOLFSSL *ssl) |
| If invoked after the handshake is complete it checks if ConnectionID was successfully negotiated for the SSL object. See RFC 9146 and RFC 9147. More...
|
|
int | wolfSSL_dtls_cid_set (WOLFSSL *ssl, unsigned char *cid, unsigned int size) |
| Set the ConnectionID used by the other peer to send records in this connection. See RFC 9146 and RFC 9147. The ConnectionID must be at maximum DTLS_CID_MAX_SIZE, that is an tunable compile time define, and it can't never be bigger than 255 bytes. More...
|
|
int | wolfSSL_dtls_cid_get_rx_size (WOLFSSL *ssl, unsigned int *size) |
| Get the size of the ConnectionID used by the other peer to send records in this connection. See RFC 9146 and RFC 9147. The size is stored in the parameter size. More...
|
|
int | wolfSSL_dtls_cid_get_rx (WOLFSSL *ssl, unsigned char *buffer, unsigned int bufferSz) |
| Copy the ConnectionID used by the other peer to send records in this connection into the buffer pointed by the parameter buffer. See RFC 9146 and RFC. More...
|
|
int | wolfSSL_dtls_cid_get_tx_size (WOLFSSL *ssl, unsigned int *size) |
| Get the size of the ConnectionID used to send records in this connection. See RFC 9146 and RFC 9147. The size is stored in the parameter size. More...
|
|
int | wolfSSL_dtls_cid_get_tx (WOLFSSL *ssl, unsigned char *buffer, unsigned int bufferSz) |
| Copy the ConnectionID used when sending records in this connection into the buffer pointer by the parameter buffer. See RFC 9146 and RFC 9147. The available size need to be provided in bufferSz. More...
|
|
int | wolfSSL_get_client_suites_sigalgs (const WOLFSSL *ssl, const byte **suites, word16 *suiteSz, const byte **hashSigAlgo, word16 *hashSigAlgoSz) |
| This function returns the raw list of ciphersuites and signature algorithms offered by the client. The lists are only stored and returned inside a callback setup with wolfSSL_CTX_set_cert_cb(). This is useful to be able to dynamically load certificates and keys based on the available ciphersuites and signature algorithms. More...
|
|
WOLFSSL_CIPHERSUITE_INFO | wolfSSL_get_ciphersuite_info (byte first, byte second) |
| This returns information about the ciphersuite directly from the raw ciphersuite bytes. More...
|
|
int | wolfSSL_get_sigalg_info (byte first, byte second, int *hashAlgo, int *sigAlgo) |
| This returns information about the hash and signature algorithm directly from the raw ciphersuite bytes. More...
|
|