1 /* 2 * This file contains prototypes for the public SSL functions. 3 * 4 * ***** BEGIN LICENSE BLOCK ***** 5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 6 * 7 * The contents of this file are subject to the Mozilla Public License Version 8 * 1.1 (the "License"); you may not use this file except in compliance with 9 * the License. You may obtain a copy of the License at 10 * http://www.mozilla.org/MPL/ 11 * 12 * Software distributed under the License is distributed on an "AS IS" basis, 13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 14 * for the specific language governing rights and limitations under the 15 * License. 16 * 17 * The Original Code is the Netscape security libraries. 18 * 19 * The Initial Developer of the Original Code is 20 * Netscape Communications Corporation. 21 * Portions created by the Initial Developer are Copyright (C) 1994-2000 22 * the Initial Developer. All Rights Reserved. 23 * 24 * Contributor(s): 25 * 26 * Alternatively, the contents of this file may be used under the terms of 27 * either the GNU General Public License Version 2 or later (the "GPL"), or 28 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), 29 * in which case the provisions of the GPL or the LGPL are applicable instead 30 * of those above. If you wish to allow use of your version of this file only 31 * under the terms of either the GPL or the LGPL, and not to allow others to 32 * use your version of this file under the terms of the MPL, indicate your 33 * decision by deleting the provisions above and replace them with the notice 34 * and other provisions required by the GPL or the LGPL. If you do not delete 35 * the provisions above, a recipient may use your version of this file under 36 * the terms of any one of the MPL, the GPL or the LGPL. 37 * 38 * ***** END LICENSE BLOCK ***** */ 39 /* $Id: ssl.h,v 1.31 2009/11/25 05:24:25 wtc%google.com Exp $ */ 40 41 #ifndef __ssl_h_ 42 #define __ssl_h_ 43 44 #include "prtypes.h" 45 #include "prerror.h" 46 #include "prio.h" 47 #include "seccomon.h" 48 #include "cert.h" 49 #include "keyt.h" 50 51 #include "sslt.h" /* public ssl data types */ 52 53 #if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) 54 #define SSL_IMPORT extern __declspec(dllimport) 55 #else 56 #define SSL_IMPORT extern 57 #endif 58 59 SEC_BEGIN_PROTOS 60 61 /* constant table enumerating all implemented SSL 2 and 3 cipher suites. */ 62 SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; 63 64 /* number of entries in the above table. */ 65 SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; 66 67 /* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ 68 #define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00) 69 70 /* 71 ** Imports fd into SSL, returning a new socket. Copies SSL configuration 72 ** from model. 73 */ 74 SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); 75 76 /* 77 ** Enable/disable an ssl mode 78 ** 79 ** SSL_SECURITY: 80 ** enable/disable use of SSL security protocol before connect 81 ** 82 ** SSL_SOCKS: 83 ** enable/disable use of socks before connect 84 ** (No longer supported). 85 ** 86 ** SSL_REQUEST_CERTIFICATE: 87 ** require a certificate during secure connect 88 */ 89 /* options */ 90 #define SSL_SECURITY 1 /* (on by default) */ 91 #define SSL_SOCKS 2 /* (off by default) */ 92 #define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ 93 #define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ 94 /* (off by default) */ 95 #define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ 96 /* (off by default) */ 97 #define SSL_ENABLE_SSL2 7 /* enable ssl v2 (on by default) */ 98 #define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ 99 #define SSL_NO_CACHE 9 /* don't use the session cache */ 100 /* (off by default) */ 101 #define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ 102 /* by default) */ 103 #define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ 104 /* (off by default) */ 105 #define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ 106 /* (on by default) */ 107 #define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ 108 #define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ 109 #define SSL_NO_STEP_DOWN 15 /* Disable export cipher suites */ 110 /* if step-down keys are needed. */ 111 /* default: off, generate */ 112 /* step-down keys if needed. */ 113 #define SSL_BYPASS_PKCS11 16 /* use PKCS#11 for pub key only */ 114 #define SSL_NO_LOCKS 17 /* Don't use locks for protection */ 115 #define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ 116 /* extension (off by default) */ 117 #define SSL_ENABLE_DEFLATE 19 /* Enable TLS compression with */ 118 /* DEFLATE (off by default) */ 119 #define SSL_ENABLE_RENEGOTIATION 20 /* Values below (default: never) */ 120 #define SSL_REQUIRE_SAFE_NEGOTIATION 21 /* Peer must use renegotiation */ 121 /* extension in ALL handshakes. */ 122 /* default: off */ 123 /* NOT YET IMPLEMENTED in 3.12.5 */ 124 125 #ifdef SSL_DEPRECATED_FUNCTION 126 /* Old deprecated function names */ 127 SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on); 128 SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on); 129 #endif 130 131 /* New function names */ 132 SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on); 133 SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on); 134 SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on); 135 SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on); 136 SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle); 137 138 SSL_IMPORT SECStatus SSL_SetNextProtoNego(PRFileDesc *fd, 139 const unsigned char *data, 140 unsigned short length); 141 SSL_IMPORT SECStatus SSL_GetNextProto(PRFileDesc *fd, 142 int *state, 143 unsigned char *buf, 144 unsigned *length, 145 unsigned buf_len); 146 #define SSL_NEXT_PROTO_NO_SUPPORT 0 /* No peer support */ 147 #define SSL_NEXT_PROTO_NEGOTIATED 1 /* Mutual agreement */ 148 #define SSL_NEXT_PROTO_NO_OVERLAP 2 /* No protocol overlap found */ 149 150 /* 151 ** Control ciphers that SSL uses. If on is non-zero then the named cipher 152 ** is enabled, otherwise it is disabled. 153 ** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). 154 ** EnableCipher records user preferences. 155 ** SetPolicy sets the policy according to the policy module. 156 */ 157 #ifdef SSL_DEPRECATED_FUNCTION 158 /* Old deprecated function names */ 159 SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); 160 SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); 161 #endif 162 163 /* New function names */ 164 SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled); 165 SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled); 166 SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); 167 SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); 168 SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); 169 SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); 170 171 /* Values for "policy" argument to SSL_PolicySet */ 172 /* Values returned by SSL_CipherPolicyGet. */ 173 #define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ 174 #define SSL_ALLOWED 1 175 #define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ 176 177 /* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ 178 #define SSL_REQUIRE_NEVER ((PRBool)0) 179 #define SSL_REQUIRE_ALWAYS ((PRBool)1) 180 #define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) 181 #define SSL_REQUIRE_NO_ERROR ((PRBool)3) 182 183 /* Values for "on" with SSL_ENABLE_RENEGOTIATION */ 184 /* Never renegotiate at all. */ 185 #define SSL_RENEGOTIATE_NEVER ((PRBool)0) 186 /* Renegotiate without restriction, whether or not the peer's client hello */ 187 /* bears the renegotiation info extension (like we always did in the past).*/ 188 #define SSL_RENEGOTIATE_UNRESTRICTED ((PRBool)1) 189 /* Only renegotiate if the peer's hello bears the TLS renegotiation_info */ 190 /* extension. Cannot renegotiate in SSL 3.0 sessions. */ 191 #define SSL_RENEGOTIATE_REQUIRES_XTN ((PRBool)2) /* (NOT YET IMPLEMENTED) */ 192 193 /* 194 ** Reset the handshake state for fd. This will make the complete SSL 195 ** handshake protocol execute from the ground up on the next i/o 196 ** operation. 197 */ 198 SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); 199 200 /* 201 ** Force the handshake for fd to complete immediately. This blocks until 202 ** the complete SSL handshake protocol is finished. 203 */ 204 SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); 205 206 /* 207 ** Same as above, but with an I/O timeout. 208 */ 209 SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, 210 PRIntervalTime timeout); 211 212 /* 213 ** Query security status of socket. *on is set to one if security is 214 ** enabled. *keySize will contain the stream key size used. *issuer will 215 ** contain the RFC1485 verison of the name of the issuer of the 216 ** certificate at the other end of the connection. For a client, this is 217 ** the issuer of the server's certificate; for a server, this is the 218 ** issuer of the client's certificate (if any). Subject is the subject of 219 ** the other end's certificate. The pointers can be zero if the desired 220 ** data is not needed. All strings returned by this function are owned 221 ** by the caller, and need to be freed with PORT_Free. 222 */ 223 SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, 224 int *keySize, int *secretKeySize, 225 char **issuer, char **subject); 226 227 /* Values for "on" */ 228 #define SSL_SECURITY_STATUS_NOOPT -1 229 #define SSL_SECURITY_STATUS_OFF 0 230 #define SSL_SECURITY_STATUS_ON_HIGH 1 231 #define SSL_SECURITY_STATUS_ON_LOW 2 232 #define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ 233 234 /* 235 ** Return the certificate for our SSL peer. If the client calls this 236 ** it will always return the server's certificate. If the server calls 237 ** this, it may return NULL if client authentication is not enabled or 238 ** if the client had no certificate when asked. 239 ** "fd" the socket "file" descriptor 240 */ 241 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); 242 243 /* 244 ** Authenticate certificate hook. Called when a certificate comes in 245 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the 246 ** certificate. 247 */ 248 typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, 249 PRBool checkSig, 250 PRBool isServer); 251 252 SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, 253 SSLAuthCertificate f, 254 void *arg); 255 256 /* An implementation of the certificate authentication hook */ 257 SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, 258 PRBool checkSig, PRBool isServer); 259 260 /* 261 * Prototype for SSL callback to get client auth data from the application. 262 * arg - application passed argument 263 * caNames - pointer to distinguished names of CAs that the server likes 264 * pRetCert - pointer to pointer to cert, for return of cert 265 * pRetKey - pointer to key pointer, for return of key 266 */ 267 typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg, 268 PRFileDesc *fd, 269 CERTDistNames *caNames, 270 CERTCertificate **pRetCert,/*return */ 271 SECKEYPrivateKey **pRetKey);/* return */ 272 273 /* 274 * Set the client side callback for SSL to retrieve user's private key 275 * and certificate. 276 * fd - the file descriptor for the connection in question 277 * f - the application's callback that delivers the key and cert 278 * a - application specific data 279 */ 280 SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, 281 SSLGetClientAuthData f, void *a); 282 283 284 /* 285 * Set the client side argument for SSL to retrieve PKCS #11 pin. 286 * fd - the file descriptor for the connection in question 287 * a - pkcs11 application specific data 288 */ 289 SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); 290 291 /* 292 ** This is a callback for dealing with server certs that are not authenticated 293 ** by the client. The client app can decide that it actually likes the 294 ** cert by some external means and restart the connection. 295 */ 296 typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); 297 SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, 298 void *arg); 299 300 /* 301 ** Configure ssl for running a secure server. Needs the 302 ** certificate for the server and the servers private key. The arguments 303 ** are copied. 304 */ 305 SSL_IMPORT SECStatus SSL_ConfigSecureServer( 306 PRFileDesc *fd, CERTCertificate *cert, 307 SECKEYPrivateKey *key, SSLKEAType kea); 308 309 /* 310 ** Configure a secure servers session-id cache. Define the maximum number 311 ** of entries in the cache, the longevity of the entires, and the directory 312 ** where the cache files will be placed. These values can be zero, and 313 ** if so, the implementation will choose defaults. 314 ** This version of the function is for use in applications that have only one 315 ** process that uses the cache (even if that process has multiple threads). 316 */ 317 SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, 318 PRUint32 timeout, 319 PRUint32 ssl3_timeout, 320 const char * directory); 321 /* 322 ** Like SSL_ConfigServerSessionIDCache, with one important difference. 323 ** If the application will run multiple processes (as opposed to, or in 324 ** addition to multiple threads), then it must call this function, instead 325 ** of calling SSL_ConfigServerSessionIDCache(). 326 ** This has nothing to do with the number of processORs, only processEs. 327 ** This function sets up a Server Session ID (SID) cache that is safe for 328 ** access by multiple processes on the same system. 329 */ 330 SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, 331 PRUint32 timeout, 332 PRUint32 ssl3_timeout, 333 const char * directory); 334 335 /* Get and set the configured maximum number of mutexes used for the 336 ** server's store of SSL sessions. This value is used by the server 337 ** session ID cache initialization functions shown above. Note that on 338 ** some platforms, these mutexes are actually implemented with POSIX 339 ** semaphores, or with unnamed pipes. The default value varies by platform. 340 ** An attempt to set a too-low maximum will return an error and the 341 ** configured value will not be changed. 342 */ 343 SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); 344 SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); 345 346 /* environment variable set by SSL_ConfigMPServerSIDCache, and queried by 347 * SSL_InheritMPServerSIDCache when envString is NULL. 348 */ 349 #define SSL_ENV_VAR_NAME "SSL_INHERITANCE" 350 351 /* called in child to inherit SID Cache variables. 352 * If envString is NULL, this function will use the value of the environment 353 * variable "SSL_INHERITANCE", otherwise the string value passed in will be 354 * used. 355 */ 356 SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString); 357 358 /* 359 ** Set the callback on a particular socket that gets called when we finish 360 ** performing a handshake. 361 */ 362 typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, 363 void *client_data); 364 SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 365 SSLHandshakeCallback cb, void *client_data); 366 367 /* 368 ** For the server, request a new handshake. For the client, begin a new 369 ** handshake. If flushCache is non-zero, the SSL3 cache entry will be 370 ** flushed first, ensuring that a full SSL handshake will be done. 371 ** If flushCache is zero, and an SSL connection is established, it will 372 ** do the much faster session restart handshake. This will change the 373 ** session keys without doing another private key operation. 374 */ 375 SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); 376 377 /* 378 ** Same as above, but with an I/O timeout. 379 */ 380 SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, 381 PRBool flushCache, 382 PRIntervalTime timeout); 383 384 385 #ifdef SSL_DEPRECATED_FUNCTION 386 /* deprecated! 387 ** For the server, request a new handshake. For the client, begin a new 388 ** handshake. Flushes SSL3 session cache entry first, ensuring that a 389 ** full handshake will be done. 390 ** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) 391 */ 392 SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); 393 #endif 394 395 /* 396 * Allow the application to pass a URL or hostname into the SSL library 397 */ 398 SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); 399 400 /* 401 ** Return the number of bytes that SSL has waiting in internal buffers. 402 ** Return 0 if security is not enabled. 403 */ 404 SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); 405 406 /* 407 ** Invalidate the SSL session associated with fd. 408 */ 409 SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); 410 411 /* 412 ** Return a SECItem containing the SSL session ID associated with the fd. 413 */ 414 SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); 415 416 /* 417 ** Clear out the client's SSL session cache, not the server's session cache. 418 */ 419 SSL_IMPORT void SSL_ClearSessionCache(void); 420 421 /* 422 ** Close the server's SSL session cache. 423 */ 424 SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); 425 426 /* 427 ** Set peer information so we can correctly look up SSL session later. 428 ** You only have to do this if you're tunneling through a proxy. 429 */ 430 SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, const char *peerID); 431 432 /* 433 ** Reveal the security information for the peer. 434 */ 435 SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket); 436 SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket); 437 SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket); 438 439 440 /* This callback may be passed to the SSL library via a call to 441 * SSL_GetClientAuthDataHook() for each SSL client socket. 442 * It will be invoked when SSL needs to know what certificate and private key 443 * (if any) to use to respond to a request for client authentication. 444 * If arg is non-NULL, it is a pointer to a NULL-terminated string containing 445 * the nickname of the cert/key pair to use. 446 * If arg is NULL, this function will search the cert and key databases for 447 * a suitable match and send it if one is found. 448 */ 449 SSL_IMPORT SECStatus 450 NSS_GetClientAuthData(void * arg, 451 PRFileDesc * socket, 452 struct CERTDistNamesStr * caNames, 453 struct CERTCertificateStr ** pRetCert, 454 struct SECKEYPrivateKeyStr **pRetKey); 455 456 /* 457 * Look to see if any of the signers in the cert chain for "cert" are found 458 * in the list of caNames. 459 * Returns SECSuccess if so, SECFailure if not. 460 * Used by NSS_GetClientAuthData. May be used by other callback functions. 461 */ 462 SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, 463 CERTDistNames *caNames); 464 465 /* 466 * Returns key exchange type of the keys in an SSL server certificate. 467 */ 468 SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert); 469 470 /* Set cipher policies to a predefined Domestic (U.S.A.) policy. 471 * This essentially enables all supported ciphers. 472 */ 473 SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); 474 475 /* Set cipher policies to a predefined Policy that is exportable from the USA 476 * according to present U.S. policies as we understand them. 477 * See documentation for the list. 478 * Note that your particular application program may be able to obtain 479 * an export license with more or fewer capabilities than those allowed 480 * by this function. In that case, you should use SSL_SetPolicy() 481 * to explicitly allow those ciphers you may legally export. 482 */ 483 SSL_IMPORT SECStatus NSS_SetExportPolicy(void); 484 485 /* Set cipher policies to a predefined Policy that is exportable from the USA 486 * according to present U.S. policies as we understand them, and that the 487 * nation of France will permit to be imported into their country. 488 * See documentation for the list. 489 */ 490 SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); 491 492 SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void); 493 494 /* Report more information than SSL_SecurityStatus. 495 ** Caller supplies the info struct. Function fills it in. 496 */ 497 SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, 498 PRUintn len); 499 SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, 500 SSLCipherSuiteInfo *info, PRUintn len); 501 502 /* 503 ** Return a new reference to the certificate that was most recently sent 504 ** to the peer on this SSL/TLS connection, or NULL if none has been sent. 505 */ 506 SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd); 507 508 /* Test an SSL configuration to see if SSL_BYPASS_PKCS11 can be turned on. 509 ** Check the key exchange algorithm for each cipher in the list to see if 510 ** a master secret key can be extracted after being derived with the mechanism 511 ** required by the protocolmask argument. If the KEA will use keys from the 512 ** specified cert make sure the extract operation is attempted from the slot 513 ** where the private key resides. 514 ** If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and 515 ** SECSuccess is returned. In all other cases but one (*pcanbypass) is 516 ** set to FALSE and SECFailure is returned. 517 ** In that last case Derive() has been called successfully but the MS is null, 518 ** CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the 519 ** arguments were all valid but the slot cannot be bypassed. 520 ** 521 ** Note: A TRUE return code from CanBypass means "Your configuration will perform 522 ** NO WORSE with the bypass enabled than without"; it does NOT mean that every 523 ** cipher suite listed will work properly with the selected protocols. 524 ** 525 ** Caveat: If export cipher suites are included in the argument list Canbypass 526 ** will return FALSE. 527 **/ 528 529 /* protocol mask bits */ 530 #define SSL_CBP_SSL3 0x0001 /* test SSL v3 mechanisms */ 531 #define SSL_CBP_TLS1_0 0x0002 /* test TLS v1.0 mechanisms */ 532 533 SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, 534 SECKEYPrivateKey *privKey, 535 PRUint32 protocolmask, 536 PRUint16 *ciphers, int nciphers, 537 PRBool *pcanbypass, void *pwArg); 538 539 SEC_END_PROTOS 540 541 #endif /* __ssl_h_ */ 542