include/gnutls/gnutls.h

0001 /* -*- c -*-
0002  * Copyright (C) 2000-2016 Free Software Foundation, Inc.
0003  * Copyright (C) 2015-2017 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023
0024 /* This file contains the types and prototypes for all the
0025  * high level functionality of the gnutls main library.
0026  *
0027  * If the optional C++ binding was built, it is available in
0028  * gnutls/gnutlsxx.h.
0029  *
0030  * The openssl compatibility layer (which is under the GNU GPL
0031  * license) is in gnutls/openssl.h.
0032  *
0033  * The low level cipher functionality is in gnutls/crypto.h.
0034  */
0035
0036 #ifndef GNUTLS_GNUTLS_H
0037 #define GNUTLS_GNUTLS_H
0038
0039 /* Get ssize_t. */
0040 #include <sys/types.h>
0041
0042 /* Get size_t. */
0043 #include <stddef.h>
0044
0045 /* Get time_t. */
0046 #include <time.h>
0047
0048 #ifdef __cplusplus
0049 extern "C" {
0050 #endif
0051
0052 #define GNUTLS_VERSION "3.8.9"
0053
0054 /* clang-format off */
0055 #define GNUTLS_VERSION_MAJOR 3
0056 #define GNUTLS_VERSION_MINOR 8
0057 #define GNUTLS_VERSION_PATCH 9
0058
0059 #define GNUTLS_VERSION_NUMBER 0x030809
0060 /* clang-format on */
0061
0062 #define GNUTLS_CIPHER_RIJNDAEL_128_CBC GNUTLS_CIPHER_AES_128_CBC
0063 #define GNUTLS_CIPHER_RIJNDAEL_256_CBC GNUTLS_CIPHER_AES_256_CBC
0064 #define GNUTLS_CIPHER_RIJNDAEL_CBC GNUTLS_CIPHER_AES_128_CBC
0065 #define GNUTLS_CIPHER_ARCFOUR GNUTLS_CIPHER_ARCFOUR_128
0066
0067 #if !defined(GNUTLS_INTERNAL_BUILD) && defined(_WIN32)
0068 #define _SYM_EXPORT __declspec(dllimport)
0069 #else
0070 #define _SYM_EXPORT
0071 #endif
0072
0073 #ifdef __GNUC__
0074 #define __GNUTLS_CONST__ __attribute__((const))
0075 #define __GNUTLS_PURE__ __attribute__((pure))
0076 #else
0077 #define __GNUTLS_CONST__
0078 #define __GNUTLS_PURE__
0079 #endif
0080
0081 /* Use the following definition globally in your program to disable
0082  * implicit initialization of gnutls. */
0083 #define GNUTLS_SKIP_GLOBAL_INIT             \
0084     int _gnutls_global_init_skip(void); \
0085     int _gnutls_global_init_skip(void)  \
0086     {                                   \
0087         return 1;                   \
0088     }
0089
0090 /**
0091  * gnutls_cipher_algorithm_t:
0092  * @GNUTLS_CIPHER_UNKNOWN: Value to identify an unknown/unsupported algorithm.
0093  * @GNUTLS_CIPHER_NULL: The NULL (identity) encryption algorithm.
0094  * @GNUTLS_CIPHER_ARCFOUR_128: ARCFOUR stream cipher with 128-bit keys.
0095  * @GNUTLS_CIPHER_3DES_CBC: 3DES in CBC mode.
0096  * @GNUTLS_CIPHER_AES_128_CBC: AES in CBC mode with 128-bit keys.
0097  * @GNUTLS_CIPHER_AES_192_CBC: AES in CBC mode with 192-bit keys.
0098  * @GNUTLS_CIPHER_AES_256_CBC: AES in CBC mode with 256-bit keys.
0099  * @GNUTLS_CIPHER_AES_128_CFB8: AES in CFB8 mode with 128-bit keys.
0100  * @GNUTLS_CIPHER_AES_192_CFB8: AES in CFB8 mode with 192-bit keys.
0101  * @GNUTLS_CIPHER_AES_256_CFB8: AES in CFB8 mode with 256-bit keys.
0102  * @GNUTLS_CIPHER_ARCFOUR_40: ARCFOUR stream cipher with 40-bit keys.
0103  * @GNUTLS_CIPHER_CAMELLIA_128_CBC: Camellia in CBC mode with 128-bit keys.
0104  * @GNUTLS_CIPHER_CAMELLIA_192_CBC: Camellia in CBC mode with 192-bit keys.
0105  * @GNUTLS_CIPHER_CAMELLIA_256_CBC: Camellia in CBC mode with 256-bit keys.
0106  * @GNUTLS_CIPHER_RC2_40_CBC: RC2 in CBC mode with 40-bit keys.
0107  * @GNUTLS_CIPHER_DES_CBC: DES in CBC mode (56-bit keys).
0108  * @GNUTLS_CIPHER_AES_128_GCM: AES in GCM mode with 128-bit keys (AEAD).
0109  * @GNUTLS_CIPHER_AES_256_GCM: AES in GCM mode with 256-bit keys (AEAD).
0110  * @GNUTLS_CIPHER_AES_128_CCM: AES in CCM mode with 128-bit keys (AEAD).
0111  * @GNUTLS_CIPHER_AES_256_CCM: AES in CCM mode with 256-bit keys (AEAD).
0112  * @GNUTLS_CIPHER_AES_128_CCM_8: AES in CCM mode with 64-bit tag and 128-bit keys (AEAD).
0113  * @GNUTLS_CIPHER_AES_256_CCM_8: AES in CCM mode with 64-bit tag and 256-bit keys (AEAD).
0114  * @GNUTLS_CIPHER_CAMELLIA_128_GCM: CAMELLIA in GCM mode with 128-bit keys (AEAD).
0115  * @GNUTLS_CIPHER_CAMELLIA_256_GCM: CAMELLIA in GCM mode with 256-bit keys (AEAD).
0116  * @GNUTLS_CIPHER_SALSA20_256: Salsa20 with 256-bit keys.
0117  * @GNUTLS_CIPHER_ESTREAM_SALSA20_256: Estream's Salsa20 variant with 256-bit keys.
0118  * @GNUTLS_CIPHER_CHACHA20_32: Chacha20 cipher with 96-bit nonces and 32-bit block counters.
0119  * @GNUTLS_CIPHER_CHACHA20_64: Chacha20 cipher with 64-bit nonces and 64-bit block counters.
0120  * @GNUTLS_CIPHER_CHACHA20_POLY1305: The Chacha20 cipher with the Poly1305 authenticator (AEAD).
0121  * @GNUTLS_CIPHER_GOST28147_TC26Z_CFB: GOST 28147-89 (Magma) cipher in CFB mode with TC26 Z S-box.
0122  * @GNUTLS_CIPHER_GOST28147_CPA_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro A S-box.
0123  * @GNUTLS_CIPHER_GOST28147_CPB_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro B S-box.
0124  * @GNUTLS_CIPHER_GOST28147_CPC_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro C S-box.
0125  * @GNUTLS_CIPHER_GOST28147_CPD_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro D S-box.
0126  * @GNUTLS_CIPHER_AES_128_XTS: AES in XTS mode with 128-bit key + 128bit tweak key.
0127  * @GNUTLS_CIPHER_AES_256_XTS: AES in XTS mode with 256-bit key + 256bit tweak key.
0128  *                             Note that the XTS ciphers are message oriented.
0129  *                             The whole message needs to be provided with a single call, because
0130  *                             cipher-stealing requires to know where the message actually terminates
0131  *                             in order to be able to compute where the stealing occurs.
0132  * @GNUTLS_CIPHER_GOST28147_TC26Z_CNT: GOST 28147-89 (Magma) cipher in CNT mode with TC26 Z S-box.
0133  * @GNUTLS_CIPHER_MAGMA_CTR_ACPKM: GOST R 34.12-2015 (Magma) cipher in CTR-ACPKM mode.
0134  * @GNUTLS_CIPHER_KUZNYECHIK_CTR_ACPKM: GOST R 34.12-2015 (Kuznyechik) cipher in CTR-ACPKM mode.
0135  * @GNUTLS_CIPHER_IDEA_PGP_CFB: IDEA in CFB mode (placeholder - unsupported).
0136  * @GNUTLS_CIPHER_3DES_PGP_CFB: 3DES in CFB mode (placeholder - unsupported).
0137  * @GNUTLS_CIPHER_CAST5_PGP_CFB: CAST5 in CFB mode (placeholder - unsupported).
0138  * @GNUTLS_CIPHER_BLOWFISH_PGP_CFB: Blowfish in CFB mode (placeholder - unsupported).
0139  * @GNUTLS_CIPHER_SAFER_SK128_PGP_CFB: Safer-SK in CFB mode with 128-bit keys (placeholder - unsupported).
0140  * @GNUTLS_CIPHER_AES128_PGP_CFB: AES in CFB mode with 128-bit keys (placeholder - unsupported).
0141  * @GNUTLS_CIPHER_AES192_PGP_CFB: AES in CFB mode with 192-bit keys (placeholder - unsupported).
0142  * @GNUTLS_CIPHER_AES256_PGP_CFB: AES in CFB mode with 256-bit keys (placeholder - unsupported).
0143  * @GNUTLS_CIPHER_TWOFISH_PGP_CFB: Twofish in CFB mode (placeholder - unsupported).
0144  * @GNUTLS_CIPHER_AES_128_SIV: AES in SIV mode with 128-bit key.
0145  * @GNUTLS_CIPHER_AES_256_SIV: AES in SIV mode with 256-bit key.
0146  *                             Note that the SIV ciphers can only be used with
0147  *                             the AEAD interface, and the IV plays a role as
0148  *                             the authentication tag while it is prepended to
0149  *                             the cipher text.
0150  * @GNUTLS_CIPHER_AES_192_GCM: AES in GCM mode with 192-bit keys (AEAD).
0151  * @GNUTLS_CIPHER_AES_128_SIV_GCM: AES in SIV-GCM mode with 128-bit key.
0152  * @GNUTLS_CIPHER_AES_256_SIV_GCM: AES in SIV-GCM mode with 256-bit key.
0153  *
0154  * Enumeration of different symmetric encryption algorithms.
0155  */
0156 typedef enum gnutls_cipher_algorithm {
0157     GNUTLS_CIPHER_UNKNOWN = 0,
0158     GNUTLS_CIPHER_NULL = 1,
0159     GNUTLS_CIPHER_ARCFOUR_128 = 2,
0160     GNUTLS_CIPHER_3DES_CBC = 3,
0161     GNUTLS_CIPHER_AES_128_CBC = 4,
0162     GNUTLS_CIPHER_AES_256_CBC = 5,
0163     GNUTLS_CIPHER_ARCFOUR_40 = 6,
0164     GNUTLS_CIPHER_CAMELLIA_128_CBC = 7,
0165     GNUTLS_CIPHER_CAMELLIA_256_CBC = 8,
0166     GNUTLS_CIPHER_AES_192_CBC = 9,
0167     GNUTLS_CIPHER_AES_128_GCM = 10,
0168     GNUTLS_CIPHER_AES_256_GCM = 11,
0169     GNUTLS_CIPHER_CAMELLIA_192_CBC = 12,
0170     GNUTLS_CIPHER_SALSA20_256 = 13,
0171     GNUTLS_CIPHER_ESTREAM_SALSA20_256 = 14,
0172     GNUTLS_CIPHER_CAMELLIA_128_GCM = 15,
0173     GNUTLS_CIPHER_CAMELLIA_256_GCM = 16,
0174     GNUTLS_CIPHER_RC2_40_CBC = 17,
0175     GNUTLS_CIPHER_DES_CBC = 18,
0176     GNUTLS_CIPHER_AES_128_CCM = 19,
0177     GNUTLS_CIPHER_AES_256_CCM = 20,
0178     GNUTLS_CIPHER_AES_128_CCM_8 = 21,
0179     GNUTLS_CIPHER_AES_256_CCM_8 = 22,
0180     GNUTLS_CIPHER_CHACHA20_POLY1305 = 23,
0181     GNUTLS_CIPHER_GOST28147_TC26Z_CFB = 24,
0182     GNUTLS_CIPHER_GOST28147_CPA_CFB = 25,
0183     GNUTLS_CIPHER_GOST28147_CPB_CFB = 26,
0184     GNUTLS_CIPHER_GOST28147_CPC_CFB = 27,
0185     GNUTLS_CIPHER_GOST28147_CPD_CFB = 28,
0186     GNUTLS_CIPHER_AES_128_CFB8 = 29,
0187     GNUTLS_CIPHER_AES_192_CFB8 = 30,
0188     GNUTLS_CIPHER_AES_256_CFB8 = 31,
0189     GNUTLS_CIPHER_AES_128_XTS = 32,
0190     GNUTLS_CIPHER_AES_256_XTS = 33,
0191     GNUTLS_CIPHER_GOST28147_TC26Z_CNT = 34,
0192     GNUTLS_CIPHER_CHACHA20_64 = 35,
0193     GNUTLS_CIPHER_CHACHA20_32 = 36,
0194     GNUTLS_CIPHER_AES_128_SIV = 37,
0195     GNUTLS_CIPHER_AES_256_SIV = 38,
0196     GNUTLS_CIPHER_AES_192_GCM = 39,
0197     GNUTLS_CIPHER_MAGMA_CTR_ACPKM = 40,
0198     GNUTLS_CIPHER_KUZNYECHIK_CTR_ACPKM = 41,
0199     GNUTLS_CIPHER_AES_128_SIV_GCM = 42,
0200     GNUTLS_CIPHER_AES_256_SIV_GCM = 43,
0201
0202     /* used only for PGP internals. Ignored in TLS/SSL
0203      */
0204     GNUTLS_CIPHER_IDEA_PGP_CFB = 200,
0205     GNUTLS_CIPHER_3DES_PGP_CFB = 201,
0206     GNUTLS_CIPHER_CAST5_PGP_CFB = 202,
0207     GNUTLS_CIPHER_BLOWFISH_PGP_CFB = 203,
0208     GNUTLS_CIPHER_SAFER_SK128_PGP_CFB = 204,
0209     GNUTLS_CIPHER_AES128_PGP_CFB = 205,
0210     GNUTLS_CIPHER_AES192_PGP_CFB = 206,
0211     GNUTLS_CIPHER_AES256_PGP_CFB = 207,
0212     GNUTLS_CIPHER_TWOFISH_PGP_CFB = 208
0213 } gnutls_cipher_algorithm_t;
0214
0215 /**
0216  * gnutls_kx_algorithm_t:
0217  * @GNUTLS_KX_UNKNOWN: Unknown key-exchange algorithm.
0218  * @GNUTLS_KX_RSA: RSA key-exchange algorithm.
0219  * @GNUTLS_KX_DHE_DSS: DHE-DSS key-exchange algorithm.
0220  * @GNUTLS_KX_DHE_RSA: DHE-RSA key-exchange algorithm.
0221  * @GNUTLS_KX_ECDHE_RSA: ECDHE-RSA key-exchange algorithm.
0222  * @GNUTLS_KX_ECDHE_ECDSA: ECDHE-ECDSA key-exchange algorithm.
0223  * @GNUTLS_KX_ANON_DH: Anon-DH key-exchange algorithm.
0224  * @GNUTLS_KX_ANON_ECDH: Anon-ECDH key-exchange algorithm.
0225  * @GNUTLS_KX_SRP: SRP key-exchange algorithm.
0226  * @GNUTLS_KX_RSA_EXPORT: RSA-EXPORT key-exchange algorithm (defunc).
0227  * @GNUTLS_KX_SRP_RSA: SRP-RSA key-exchange algorithm.
0228  * @GNUTLS_KX_SRP_DSS: SRP-DSS key-exchange algorithm.
0229  * @GNUTLS_KX_PSK: PSK key-exchange algorithm.
0230  * @GNUTLS_KX_DHE_PSK: DHE-PSK key-exchange algorithm.
0231  * @GNUTLS_KX_ECDHE_PSK: ECDHE-PSK key-exchange algorithm.
0232  * @GNUTLS_KX_RSA_PSK: RSA-PSK key-exchange algorithm.
0233  * @GNUTLS_KX_VKO_GOST_12: VKO GOST R 34.10-2012 key-exchange algorithm.
0234  *
0235  * Enumeration of different key exchange algorithms.
0236  */
0237 typedef enum {
0238     GNUTLS_KX_UNKNOWN = 0,
0239     GNUTLS_KX_RSA = 1,
0240     GNUTLS_KX_DHE_DSS = 2,
0241     GNUTLS_KX_DHE_RSA = 3,
0242     GNUTLS_KX_ANON_DH = 4,
0243     GNUTLS_KX_SRP = 5,
0244     GNUTLS_KX_RSA_EXPORT = 6,
0245     GNUTLS_KX_SRP_RSA = 7,
0246     GNUTLS_KX_SRP_DSS = 8,
0247     GNUTLS_KX_PSK = 9,
0248     GNUTLS_KX_DHE_PSK = 10,
0249     GNUTLS_KX_ANON_ECDH = 11,
0250     GNUTLS_KX_ECDHE_RSA = 12,
0251     GNUTLS_KX_ECDHE_ECDSA = 13,
0252     GNUTLS_KX_ECDHE_PSK = 14,
0253     GNUTLS_KX_RSA_PSK = 15,
0254     GNUTLS_KX_VKO_GOST_12 = 16
0255 } gnutls_kx_algorithm_t;
0256
0257 /**
0258  * gnutls_params_type_t:
0259  * @GNUTLS_PARAMS_RSA_EXPORT: Session RSA-EXPORT parameters (defunc).
0260  * @GNUTLS_PARAMS_DH: Session Diffie-Hellman parameters.
0261  * @GNUTLS_PARAMS_ECDH: Session Elliptic-Curve Diffie-Hellman parameters.
0262  *
0263  * Enumeration of different TLS session parameter types.
0264  */
0265 typedef enum {
0266     GNUTLS_PARAMS_RSA_EXPORT = 1,
0267     GNUTLS_PARAMS_DH = 2,
0268     GNUTLS_PARAMS_ECDH = 3
0269 } gnutls_params_type_t;
0270
0271 /**
0272  * gnutls_credentials_type_t:
0273  * @GNUTLS_CRD_CERTIFICATE: Certificate credential.
0274  * @GNUTLS_CRD_ANON: Anonymous credential.
0275  * @GNUTLS_CRD_SRP: SRP credential.
0276  * @GNUTLS_CRD_PSK: PSK credential.
0277  * @GNUTLS_CRD_IA: IA credential.
0278  *
0279  * Enumeration of different credential types.
0280  */
0281 typedef enum {
0282     GNUTLS_CRD_CERTIFICATE = 1,
0283     GNUTLS_CRD_ANON,
0284     GNUTLS_CRD_SRP,
0285     GNUTLS_CRD_PSK,
0286     GNUTLS_CRD_IA
0287 } gnutls_credentials_type_t;
0288
0289 #define GNUTLS_MAC_SHA GNUTLS_MAC_SHA1
0290 #define GNUTLS_DIG_SHA GNUTLS_DIG_SHA1
0291
0292 /**
0293  * gnutls_mac_algorithm_t:
0294  * @GNUTLS_MAC_UNKNOWN: Unknown MAC algorithm.
0295  * @GNUTLS_MAC_NULL: NULL MAC algorithm (empty output).
0296  * @GNUTLS_MAC_MD5: HMAC-MD5 algorithm.
0297  * @GNUTLS_MAC_SHA1: HMAC-SHA-1 algorithm.
0298  * @GNUTLS_MAC_RMD160: HMAC-RMD160 algorithm.
0299  * @GNUTLS_MAC_MD2: HMAC-MD2 algorithm.
0300  * @GNUTLS_MAC_SHA256: HMAC-SHA-256 algorithm.
0301  * @GNUTLS_MAC_SHA384: HMAC-SHA-384 algorithm.
0302  * @GNUTLS_MAC_SHA512: HMAC-SHA-512 algorithm.
0303  * @GNUTLS_MAC_SHA224: HMAC-SHA-224 algorithm.
0304  * @GNUTLS_MAC_MD5_SHA1: Combined MD5+SHA1 MAC placeholder.
0305  * @GNUTLS_MAC_GOSTR_94: HMAC GOST R 34.11-94 algorithm.
0306  * @GNUTLS_MAC_STREEBOG_256: HMAC GOST R 34.11-2001 (Streebog) algorithm, 256 bit.
0307  * @GNUTLS_MAC_STREEBOG_512: HMAC GOST R 34.11-2001 (Streebog) algorithm, 512 bit.
0308  * @GNUTLS_MAC_AEAD: MAC implicit through AEAD cipher.
0309  * @GNUTLS_MAC_UMAC_96: The UMAC-96 MAC algorithm (requires nonce).
0310  * @GNUTLS_MAC_UMAC_128: The UMAC-128 MAC algorithm (requires nonce).
0311  * @GNUTLS_MAC_AES_CMAC_128: The AES-CMAC-128 MAC algorithm.
0312  * @GNUTLS_MAC_AES_CMAC_256: The AES-CMAC-256 MAC algorithm.
0313  * @GNUTLS_MAC_AES_GMAC_128: The AES-GMAC-128 MAC algorithm (requires nonce).
0314  * @GNUTLS_MAC_AES_GMAC_192: The AES-GMAC-192 MAC algorithm (requires nonce).
0315  * @GNUTLS_MAC_AES_GMAC_256: The AES-GMAC-256 MAC algorithm (requires nonce).
0316  * @GNUTLS_MAC_SHA3_224: Reserved; unimplemented.
0317  * @GNUTLS_MAC_SHA3_256: Reserved; unimplemented.
0318  * @GNUTLS_MAC_SHA3_384: Reserved; unimplemented.
0319  * @GNUTLS_MAC_SHA3_512: Reserved; unimplemented.
0320  * @GNUTLS_MAC_GOST28147_TC26Z_IMIT: The GOST 28147-89 working in IMIT mode with TC26 Z S-box.
0321  * @GNUTLS_MAC_SHAKE_128: The SHAKE128 extendable output function.
0322  * @GNUTLS_MAC_SHAKE_256: The SHAKE256 extendable output function.
0323  * @GNUTLS_MAC_MAGMA_OMAC: GOST R 34.12-2015 (Magma) in OMAC (CMAC) mode.
0324  * @GNUTLS_MAC_KUZNYECHIK_OMAC: GOST R 34.12-2015 (Kuznyechik) in OMAC (CMAC) mode.
0325  *
0326  * Enumeration of different Message Authentication Code (MAC)
0327  * algorithms.
0328  */
0329 typedef enum {
0330     GNUTLS_MAC_UNKNOWN = 0,
0331     GNUTLS_MAC_NULL = 1,
0332     GNUTLS_MAC_MD5 = 2,
0333     GNUTLS_MAC_SHA1 = 3,
0334     GNUTLS_MAC_RMD160 = 4,
0335     GNUTLS_MAC_MD2 = 5,
0336     GNUTLS_MAC_SHA256 = 6,
0337     GNUTLS_MAC_SHA384 = 7,
0338     GNUTLS_MAC_SHA512 = 8,
0339     GNUTLS_MAC_SHA224 = 9,
0340     GNUTLS_MAC_SHA3_224 = 10, /* reserved: no implementation */
0341     GNUTLS_MAC_SHA3_256 = 11, /* reserved: no implementation */
0342     GNUTLS_MAC_SHA3_384 = 12, /* reserved: no implementation */
0343     GNUTLS_MAC_SHA3_512 = 13, /* reserved: no implementation */
0344     GNUTLS_MAC_MD5_SHA1 = 14, /* reserved: no implementation */
0345     GNUTLS_MAC_GOSTR_94 = 15,
0346     GNUTLS_MAC_STREEBOG_256 = 16,
0347     GNUTLS_MAC_STREEBOG_512 = 17,
0348     /* If you add anything here, make sure you align with
0349        gnutls_digest_algorithm_t. */
0350     GNUTLS_MAC_AEAD = 200, /* indicates that MAC is on the cipher */
0351     GNUTLS_MAC_UMAC_96 = 201,
0352     GNUTLS_MAC_UMAC_128 = 202,
0353     GNUTLS_MAC_AES_CMAC_128 = 203,
0354     GNUTLS_MAC_AES_CMAC_256 = 204,
0355     GNUTLS_MAC_AES_GMAC_128 = 205,
0356     GNUTLS_MAC_AES_GMAC_192 = 206,
0357     GNUTLS_MAC_AES_GMAC_256 = 207,
0358     GNUTLS_MAC_GOST28147_TC26Z_IMIT = 208,
0359     GNUTLS_MAC_SHAKE_128 = 209,
0360     GNUTLS_MAC_SHAKE_256 = 210,
0361     GNUTLS_MAC_MAGMA_OMAC = 211,
0362     GNUTLS_MAC_KUZNYECHIK_OMAC = 212,
0363     GNUTLS_MAC_PBMAC1 =
0364         213 /* indicates that PBMAC1 is embedded the PKCS#12 structure */
0365 } gnutls_mac_algorithm_t;
0366
0367 /**
0368  * gnutls_digest_algorithm_t:
0369  * @GNUTLS_DIG_UNKNOWN: Unknown hash algorithm.
0370  * @GNUTLS_DIG_NULL: NULL hash algorithm (empty output).
0371  * @GNUTLS_DIG_MD5: MD5 algorithm.
0372  * @GNUTLS_DIG_SHA1: SHA-1 algorithm.
0373  * @GNUTLS_DIG_RMD160: RMD160 algorithm.
0374  * @GNUTLS_DIG_MD2: MD2 algorithm.
0375  * @GNUTLS_DIG_SHA256: SHA-256 algorithm.
0376  * @GNUTLS_DIG_SHA384: SHA-384 algorithm.
0377  * @GNUTLS_DIG_SHA512: SHA-512 algorithm.
0378  * @GNUTLS_DIG_SHA224: SHA-224 algorithm.
0379  * @GNUTLS_DIG_SHA3_224: SHA3-224 algorithm.
0380  * @GNUTLS_DIG_SHA3_256: SHA3-256 algorithm.
0381  * @GNUTLS_DIG_SHA3_384: SHA3-384 algorithm.
0382  * @GNUTLS_DIG_SHA3_512: SHA3-512 algorithm.
0383  * @GNUTLS_DIG_MD5_SHA1: Combined MD5+SHA1 algorithm.
0384  * @GNUTLS_DIG_GOSTR_94: GOST R 34.11-94 algorithm.
0385  * @GNUTLS_DIG_STREEBOG_256: GOST R 34.11-2001 (Streebog) algorithm, 256 bit.
0386  * @GNUTLS_DIG_STREEBOG_512: GOST R 34.11-2001 (Streebog) algorithm, 512 bit.
0387  * @GNUTLS_DIG_SHAKE_128: The SHAKE128 extendable output function.
0388  * @GNUTLS_DIG_SHAKE_256: The SHAKE256 extendable output function.
0389  *
0390  * Enumeration of different digest (hash) algorithms.
0391  */
0392 typedef enum {
0393     GNUTLS_DIG_UNKNOWN = GNUTLS_MAC_UNKNOWN,
0394     GNUTLS_DIG_NULL = GNUTLS_MAC_NULL,
0395     GNUTLS_DIG_MD5 = GNUTLS_MAC_MD5,
0396     GNUTLS_DIG_SHA1 = GNUTLS_MAC_SHA1,
0397     GNUTLS_DIG_RMD160 = GNUTLS_MAC_RMD160,
0398     GNUTLS_DIG_MD2 = GNUTLS_MAC_MD2,
0399     GNUTLS_DIG_SHA256 = GNUTLS_MAC_SHA256,
0400     GNUTLS_DIG_SHA384 = GNUTLS_MAC_SHA384,
0401     GNUTLS_DIG_SHA512 = GNUTLS_MAC_SHA512,
0402     GNUTLS_DIG_SHA224 = GNUTLS_MAC_SHA224,
0403     GNUTLS_DIG_SHA3_224 = GNUTLS_MAC_SHA3_224,
0404     GNUTLS_DIG_SHA3_256 = GNUTLS_MAC_SHA3_256,
0405     GNUTLS_DIG_SHA3_384 = GNUTLS_MAC_SHA3_384,
0406     GNUTLS_DIG_SHA3_512 = GNUTLS_MAC_SHA3_512,
0407     GNUTLS_DIG_MD5_SHA1 = GNUTLS_MAC_MD5_SHA1,
0408     GNUTLS_DIG_GOSTR_94 = GNUTLS_MAC_GOSTR_94,
0409     GNUTLS_DIG_STREEBOG_256 = GNUTLS_MAC_STREEBOG_256,
0410     GNUTLS_DIG_STREEBOG_512 = GNUTLS_MAC_STREEBOG_512,
0411     GNUTLS_DIG_SHAKE_128 = GNUTLS_MAC_SHAKE_128,
0412     GNUTLS_DIG_SHAKE_256 = GNUTLS_MAC_SHAKE_256
0413     /* If you add anything here, make sure you align with
0414            gnutls_mac_algorithm_t. */
0415 } gnutls_digest_algorithm_t;
0416
0417 /* exported for other gnutls headers. This is the maximum number of
0418    * algorithms (ciphers, kx or macs).
0419    */
0420 #define GNUTLS_MAX_ALGORITHM_NUM 128
0421 #define GNUTLS_MAX_SESSION_ID_SIZE 32
0422
0423 /**
0424  * gnutls_compression_method_t:
0425  * @GNUTLS_COMP_UNKNOWN: Unknown compression method.
0426  * @GNUTLS_COMP_NULL: The NULL compression method (no compression).
0427  * @GNUTLS_COMP_DEFLATE: The DEFLATE compression method from zlib.
0428  * @GNUTLS_COMP_ZLIB: Same as %GNUTLS_COMP_DEFLATE.
0429  * @GNUTLS_COMP_BROTLI: Brotli compression method.
0430  * @GNUTLS_COMP_ZSTD: Zstandard compression method.
0431  *
0432  * Enumeration of different TLS compression methods.
0433  */
0434 typedef enum {
0435     GNUTLS_COMP_UNKNOWN = 0,
0436     GNUTLS_COMP_NULL = 1,
0437     GNUTLS_COMP_DEFLATE = 2,
0438     GNUTLS_COMP_ZLIB = GNUTLS_COMP_DEFLATE,
0439     GNUTLS_COMP_BROTLI = 3,
0440     GNUTLS_COMP_ZSTD = 4
0441 } gnutls_compression_method_t;
0442
0443 /**
0444  * gnutls_init_flags_t:
0445  *
0446  * @GNUTLS_SERVER: Connection end is a server.
0447  * @GNUTLS_CLIENT: Connection end is a client.
0448  * @GNUTLS_DATAGRAM: Connection is datagram oriented (DTLS). Since 3.0.0.
0449  * @GNUTLS_NONBLOCK: Connection should not block. Since 3.0.0.
0450  * @GNUTLS_NO_SIGNAL: In systems where SIGPIPE is delivered on send, it will be disabled. That flag has effect in systems which support the MSG_NOSIGNAL sockets flag (since 3.4.2).
0451  * @GNUTLS_NO_DEFAULT_EXTENSIONS: Do not enable any TLS extensions by default such as session tickets and OCSP certificate status request (since 3.1.2). As TLS 1.2 and later require extensions this option is considered obsolete and should not be used.
0452  * @GNUTLS_NO_REPLAY_PROTECTION: Disable any replay protection in DTLS. This must only be used if  replay protection is achieved using other means. Since 3.2.2.
0453  * @GNUTLS_ALLOW_ID_CHANGE: Allow the peer to replace its certificate, or change its ID during a rehandshake. This change is often used in attacks and thus prohibited by default. Since 3.5.0.
0454  * @GNUTLS_ENABLE_FALSE_START: Enable the TLS false start on client side if the negotiated ciphersuites allow it. This will enable sending data prior to the handshake being complete, and may introduce a risk of crypto failure when combined with certain key exchanged; for that GnuTLS may not enable that option in ciphersuites that are known to be not safe for false start. Since 3.5.0.
0455  * @GNUTLS_ENABLE_EARLY_START: Under TLS1.3 allow the server to return earlier than the full handshake
0456  *   finish; similarly to false start the handshake will be completed once data are received by the
0457  *   client, while the server is able to transmit sooner. This is not enabled by default as it could
0458  *   break certain existing server assumptions and use-cases. Since 3.6.4.
0459  * @GNUTLS_ENABLE_EARLY_DATA: Under TLS1.3 allow the server to receive early data sent as part of the initial ClientHello (0-RTT).
0460  *   This can also be used to explicitly indicate that the client will send early data.
0461  *   This is not enabled by default as early data has weaker security properties than other data. Since 3.6.5.
0462  * @GNUTLS_FORCE_CLIENT_CERT: When in client side and only a single cert is specified, send that certificate irrespective of the issuers expected by the server. Since 3.5.0.
0463  * @GNUTLS_NO_TICKETS: Flag to indicate that the session should not use resumption with session tickets.
0464  * @GNUTLS_NO_TICKETS_TLS12: Flag to indicate that the session should not use resumption with session tickets. This flag only has effect if TLS 1.2 is used.
0465  * @GNUTLS_KEY_SHARE_TOP3: Generate key shares for the top-3 different groups which are enabled.
0466  *   That is, as each group is associated with a key type (EC, finite field, x25519), generate
0467  *   three keys using %GNUTLS_PK_DH, %GNUTLS_PK_EC, %GNUTLS_PK_ECDH_X25519 if all of them are enabled.
0468  * @GNUTLS_KEY_SHARE_TOP2: Generate key shares for the top-2 different groups which are enabled.
0469  *   For example (ECDH + x25519). This is the default.
0470  * @GNUTLS_KEY_SHARE_TOP: Generate key share for the first group which is enabled.
0471  *   For example x25519. This option is the most performant for client (less CPU spent
0472  *   generating keys), but if the server doesn't support the advertised option it may
0473  *   result to more roundtrips needed to discover the server's choice.
0474  * @GNUTLS_NO_AUTO_REKEY: Disable auto-rekeying under TLS1.3. If this option is not specified
0475  *   gnutls will force a rekey after 2^24 records have been sent.
0476  * @GNUTLS_POST_HANDSHAKE_AUTH: Enable post handshake authentication for server and client. When set and
0477  *   a server requests authentication after handshake %GNUTLS_E_REAUTH_REQUEST will be returned
0478  *   by gnutls_record_recv(). A client should then call gnutls_reauth() to re-authenticate.
0479  * @GNUTLS_SAFE_PADDING_CHECK: Flag to indicate that the TLS 1.3 padding check will be done in a
0480  *   safe way which doesn't leak the pad size based on GnuTLS processing time. This is of use to
0481  *   applications which hide the length of transferred data via the TLS1.3 padding mechanism and
0482  *   are already taking steps to hide the data processing time. This comes at a performance
0483  *   penalty.
0484  * @GNUTLS_AUTO_REAUTH: Enable transparent re-authentication in client side when the server
0485  *    requests to. That is, reauthentication is handled within gnutls_record_recv(), and
0486  *    the %GNUTLS_E_REHANDSHAKE or %GNUTLS_E_REAUTH_REQUEST are not returned. This must be
0487  *    enabled with %GNUTLS_POST_HANDSHAKE_AUTH for TLS1.3. Enabling this flag requires to restore
0488  *    interrupted calls to gnutls_record_recv() based on the output of gnutls_record_get_direction(),
0489  *    since gnutls_record_recv() could be interrupted when sending when this flag is enabled.
0490  *    Note this flag may not be used if you are using the same session for sending and receiving
0491  *    in different threads.
0492  * @GNUTLS_ENABLE_RAWPK: Allows raw public-keys to be negotiated during the handshake. Since 3.6.6.
0493  * @GNUTLS_NO_AUTO_SEND_TICKET: Under TLS1.3 disable auto-sending of
0494  *    session tickets during the handshake.
0495  * @GNUTLS_NO_END_OF_EARLY_DATA: Under TLS1.3 suppress sending EndOfEarlyData message. Since 3.7.2.
0496  * @GNUTLS_NO_STATUS_REQUEST: Prevents client from including the "status_request" TLS extension
0497  *    in the client hello, thus disabling the receival of certificate status information. Since 3.8.0.
0498  *
0499  * Enumeration of different flags for gnutls_init() function. All the flags
0500  * can be combined except @GNUTLS_SERVER and @GNUTLS_CLIENT which are mutually
0501  * exclusive.
0502  *
0503  * The key share options relate to the TLS 1.3 key share extension
0504  * which is a speculative key generation expecting that the server
0505  * would support the generated key.
0506  */
0507 typedef enum {
0508     GNUTLS_SERVER = 1,
0509     GNUTLS_CLIENT = (1 << 1),
0510     GNUTLS_DATAGRAM = (1 << 2),
0511     GNUTLS_NONBLOCK = (1 << 3),
0512     GNUTLS_NO_DEFAULT_EXTENSIONS = (1 << 4),
0513     GNUTLS_NO_REPLAY_PROTECTION = (1 << 5),
0514     GNUTLS_NO_SIGNAL = (1 << 6),
0515     GNUTLS_ALLOW_ID_CHANGE = (1 << 7),
0516     GNUTLS_ENABLE_FALSE_START = (1 << 8),
0517     GNUTLS_FORCE_CLIENT_CERT = (1 << 9),
0518     GNUTLS_NO_TICKETS = (1 << 10),
0519     GNUTLS_KEY_SHARE_TOP = (1 << 11),
0520     GNUTLS_KEY_SHARE_TOP2 = (1 << 12),
0521     GNUTLS_KEY_SHARE_TOP3 = (1 << 13),
0522     GNUTLS_POST_HANDSHAKE_AUTH = (1 << 14),
0523     GNUTLS_NO_AUTO_REKEY = (1 << 15),
0524     GNUTLS_SAFE_PADDING_CHECK = (1 << 16),
0525     GNUTLS_ENABLE_EARLY_START = (1 << 17),
0526     GNUTLS_ENABLE_RAWPK = (1 << 18),
0527     GNUTLS_AUTO_REAUTH = (1 << 19),
0528     GNUTLS_ENABLE_EARLY_DATA = (1 << 20),
0529     GNUTLS_NO_AUTO_SEND_TICKET = (1 << 21),
0530     GNUTLS_NO_END_OF_EARLY_DATA = (1 << 22),
0531     GNUTLS_NO_TICKETS_TLS12 = (1 << 23),
0532     GNUTLS_NO_STATUS_REQUEST = (1 << 24)
0533 } gnutls_init_flags_t;
0534
0535 /* compatibility defines (previous versions of gnutls
0536  * used defines instead of enumerated values). */
0537 #define GNUTLS_SERVER (1)
0538 #define GNUTLS_CLIENT (1 << 1)
0539 #define GNUTLS_DATAGRAM (1 << 2)
0540 #define GNUTLS_NONBLOCK (1 << 3)
0541 #define GNUTLS_NO_DEFAULT_EXTENSIONS (1 << 4)
0542 #define GNUTLS_NO_REPLAY_PROTECTION (1 << 5)
0543 #define GNUTLS_NO_SIGNAL (1 << 6)
0544 #define GNUTLS_ALLOW_ID_CHANGE (1 << 7)
0545 #define GNUTLS_ENABLE_FALSE_START (1 << 8)
0546 #define GNUTLS_FORCE_CLIENT_CERT (1 << 9)
0547 #define GNUTLS_NO_TICKETS (1 << 10)
0548 #define GNUTLS_ENABLE_CERT_TYPE_NEG 0
0549 // Here for compatibility reasons
0550
0551 /* Keep backward compatibility */
0552 #define GNUTLS_NO_EXTENSIONS GNUTLS_NO_DEFAULT_EXTENSIONS
0553
0554 /**
0555  * gnutls_alert_level_t:
0556  * @GNUTLS_AL_WARNING: Alert of warning severity.
0557  * @GNUTLS_AL_FATAL: Alert of fatal severity.
0558  *
0559  * Enumeration of different TLS alert severities.
0560  */
0561 typedef enum {
0562     GNUTLS_AL_WARNING = 1,
0563     GNUTLS_AL_FATAL
0564 } gnutls_alert_level_t;
0565
0566 /**
0567  * gnutls_alert_description_t:
0568  * @GNUTLS_A_CLOSE_NOTIFY: Close notify.
0569  * @GNUTLS_A_UNEXPECTED_MESSAGE: Unexpected message.
0570  * @GNUTLS_A_BAD_RECORD_MAC: Bad record MAC.
0571  * @GNUTLS_A_DECRYPTION_FAILED: Decryption failed.
0572  * @GNUTLS_A_RECORD_OVERFLOW: Record overflow.
0573  * @GNUTLS_A_DECOMPRESSION_FAILURE: Decompression failed.
0574  * @GNUTLS_A_HANDSHAKE_FAILURE: Handshake failed.
0575  * @GNUTLS_A_SSL3_NO_CERTIFICATE: No certificate.
0576  * @GNUTLS_A_BAD_CERTIFICATE: Certificate is bad.
0577  * @GNUTLS_A_UNSUPPORTED_CERTIFICATE: Certificate is not supported.
0578  * @GNUTLS_A_CERTIFICATE_REVOKED: Certificate was revoked.
0579  * @GNUTLS_A_CERTIFICATE_EXPIRED: Certificate is expired.
0580  * @GNUTLS_A_CERTIFICATE_UNKNOWN: Unknown certificate.
0581  * @GNUTLS_A_ILLEGAL_PARAMETER: Illegal parameter.
0582  * @GNUTLS_A_UNKNOWN_CA: CA is unknown.
0583  * @GNUTLS_A_ACCESS_DENIED: Access was denied.
0584  * @GNUTLS_A_DECODE_ERROR: Decode error.
0585  * @GNUTLS_A_DECRYPT_ERROR: Decrypt error.
0586  * @GNUTLS_A_EXPORT_RESTRICTION: Export restriction.
0587  * @GNUTLS_A_PROTOCOL_VERSION: Error in protocol version.
0588  * @GNUTLS_A_INSUFFICIENT_SECURITY: Insufficient security.
0589  * @GNUTLS_A_INTERNAL_ERROR: Internal error.
0590  * @GNUTLS_A_INAPPROPRIATE_FALLBACK: Inappropriate fallback,
0591  * @GNUTLS_A_USER_CANCELED: User canceled.
0592  * @GNUTLS_A_NO_RENEGOTIATION: No renegotiation is allowed.
0593  * @GNUTLS_A_MISSING_EXTENSION: An extension was expected but was not seen
0594  * @GNUTLS_A_UNSUPPORTED_EXTENSION: An unsupported extension was
0595  *   sent.
0596  * @GNUTLS_A_CERTIFICATE_UNOBTAINABLE: Could not retrieve the
0597  *   specified certificate.
0598  * @GNUTLS_A_UNRECOGNIZED_NAME: The server name sent was not
0599  *   recognized.
0600  * @GNUTLS_A_UNKNOWN_PSK_IDENTITY: The SRP/PSK username is missing
0601  *   or not known.
0602  * @GNUTLS_A_CERTIFICATE_REQUIRED: Certificate is required.
0603  * @GNUTLS_A_NO_APPLICATION_PROTOCOL: The ALPN protocol requested is
0604  *   not supported by the peer.
0605  *
0606  * Enumeration of different TLS alerts.
0607  */
0608 typedef enum {
0609     GNUTLS_A_CLOSE_NOTIFY,
0610     GNUTLS_A_UNEXPECTED_MESSAGE = 10,
0611     GNUTLS_A_BAD_RECORD_MAC = 20,
0612     GNUTLS_A_DECRYPTION_FAILED,
0613     GNUTLS_A_RECORD_OVERFLOW,
0614     GNUTLS_A_DECOMPRESSION_FAILURE = 30,
0615     GNUTLS_A_HANDSHAKE_FAILURE = 40,
0616     GNUTLS_A_SSL3_NO_CERTIFICATE = 41,
0617     GNUTLS_A_BAD_CERTIFICATE = 42,
0618     GNUTLS_A_UNSUPPORTED_CERTIFICATE,
0619     GNUTLS_A_CERTIFICATE_REVOKED,
0620     GNUTLS_A_CERTIFICATE_EXPIRED,
0621     GNUTLS_A_CERTIFICATE_UNKNOWN,
0622     GNUTLS_A_ILLEGAL_PARAMETER,
0623     GNUTLS_A_UNKNOWN_CA,
0624     GNUTLS_A_ACCESS_DENIED,
0625     GNUTLS_A_DECODE_ERROR = 50,
0626     GNUTLS_A_DECRYPT_ERROR,
0627     GNUTLS_A_EXPORT_RESTRICTION = 60,
0628     GNUTLS_A_PROTOCOL_VERSION = 70,
0629     GNUTLS_A_INSUFFICIENT_SECURITY,
0630     GNUTLS_A_INTERNAL_ERROR = 80,
0631     GNUTLS_A_INAPPROPRIATE_FALLBACK = 86,
0632     GNUTLS_A_USER_CANCELED = 90,
0633     GNUTLS_A_NO_RENEGOTIATION = 100,
0634     GNUTLS_A_MISSING_EXTENSION = 109,
0635     GNUTLS_A_UNSUPPORTED_EXTENSION = 110,
0636     GNUTLS_A_CERTIFICATE_UNOBTAINABLE = 111,
0637     GNUTLS_A_UNRECOGNIZED_NAME = 112,
0638     GNUTLS_A_UNKNOWN_PSK_IDENTITY = 115,
0639     GNUTLS_A_CERTIFICATE_REQUIRED = 116,
0640     GNUTLS_A_NO_APPLICATION_PROTOCOL = 120,
0641     GNUTLS_A_MAX = GNUTLS_A_NO_APPLICATION_PROTOCOL
0642 } gnutls_alert_description_t;
0643
0644 /**
0645  * gnutls_handshake_description_t:
0646  * @GNUTLS_HANDSHAKE_HELLO_REQUEST: Hello request.
0647  * @GNUTLS_HANDSHAKE_HELLO_VERIFY_REQUEST: DTLS Hello verify request.
0648  * @GNUTLS_HANDSHAKE_CLIENT_HELLO: Client hello.
0649  * @GNUTLS_HANDSHAKE_SERVER_HELLO: Server hello.
0650  * @GNUTLS_HANDSHAKE_END_OF_EARLY_DATA: End of early data.
0651  * @GNUTLS_HANDSHAKE_HELLO_RETRY_REQUEST: Hello retry request.
0652  * @GNUTLS_HANDSHAKE_NEW_SESSION_TICKET: New session ticket.
0653  * @GNUTLS_HANDSHAKE_CERTIFICATE_PKT: Certificate packet.
0654  * @GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE: Server key exchange.
0655  * @GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST: Certificate request.
0656  * @GNUTLS_HANDSHAKE_SERVER_HELLO_DONE: Server hello done.
0657  * @GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY: Certificate verify.
0658  * @GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE: Client key exchange.
0659  * @GNUTLS_HANDSHAKE_FINISHED: Finished.
0660  * @GNUTLS_HANDSHAKE_CERTIFICATE_STATUS: Certificate status (OCSP).
0661  * @GNUTLS_HANDSHAKE_KEY_UPDATE: TLS1.3 key update message.
0662  * @GNUTLS_HANDSHAKE_COMPRESSED_CERTIFICATE_PKT: Compressed certificate packet.
0663  * @GNUTLS_HANDSHAKE_SUPPLEMENTAL: Supplemental.
0664  * @GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC: Change Cipher Spec.
0665  * @GNUTLS_HANDSHAKE_CLIENT_HELLO_V2: SSLv2 Client Hello.
0666  * @GNUTLS_HANDSHAKE_ENCRYPTED_EXTENSIONS: Encrypted extensions message.
0667  *
0668  * Enumeration of different TLS handshake packets.
0669  */
0670 typedef enum {
0671     GNUTLS_HANDSHAKE_HELLO_REQUEST = 0,
0672     GNUTLS_HANDSHAKE_CLIENT_HELLO = 1,
0673     GNUTLS_HANDSHAKE_SERVER_HELLO = 2,
0674     GNUTLS_HANDSHAKE_HELLO_VERIFY_REQUEST = 3,
0675     GNUTLS_HANDSHAKE_NEW_SESSION_TICKET = 4,
0676     GNUTLS_HANDSHAKE_END_OF_EARLY_DATA = 5,
0677     GNUTLS_HANDSHAKE_ENCRYPTED_EXTENSIONS = 8,
0678     GNUTLS_HANDSHAKE_CERTIFICATE_PKT = 11,
0679     GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE = 12,
0680     GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST = 13,
0681     GNUTLS_HANDSHAKE_SERVER_HELLO_DONE = 14,
0682     GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY = 15,
0683     GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE = 16,
0684     GNUTLS_HANDSHAKE_FINISHED = 20,
0685     GNUTLS_HANDSHAKE_CERTIFICATE_STATUS = 22,
0686     GNUTLS_HANDSHAKE_SUPPLEMENTAL = 23,
0687     GNUTLS_HANDSHAKE_KEY_UPDATE = 24,
0688     GNUTLS_HANDSHAKE_COMPRESSED_CERTIFICATE_PKT = 25,
0689     GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC = 254,
0690     GNUTLS_HANDSHAKE_CLIENT_HELLO_V2 = 1024,
0691     GNUTLS_HANDSHAKE_HELLO_RETRY_REQUEST = 1025,
0692 } gnutls_handshake_description_t;
0693
0694 #define GNUTLS_HANDSHAKE_ANY ((unsigned int)-1)
0695
0696 const char *
0697 gnutls_handshake_description_get_name(gnutls_handshake_description_t type);
0698
0699 /**
0700  * gnutls_certificate_status_t:
0701  * @GNUTLS_CERT_INVALID: The certificate is not signed by one of the
0702  *   known authorities or the signature is invalid (deprecated by the flags
0703  *   %GNUTLS_CERT_SIGNATURE_FAILURE and %GNUTLS_CERT_SIGNER_NOT_FOUND).
0704  * @GNUTLS_CERT_SIGNATURE_FAILURE: The signature verification failed.
0705  * @GNUTLS_CERT_REVOKED: Certificate is revoked by its authority.  In X.509 this will be
0706  *   set only if CRLs are checked.
0707  * @GNUTLS_CERT_SIGNER_NOT_FOUND: The certificate's issuer is not known.
0708  *   This is the case if the issuer is not included in the trusted certificate list.
0709  * @GNUTLS_CERT_SIGNER_NOT_CA: The certificate's signer was not a CA. This
0710  *   may happen if this was a version 1 certificate, which is common with
0711  *   some CAs, or a version 3 certificate without the basic constrains extension.
0712  * @GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: The certificate's signer constraints were
0713  *   violated.
0714  * @GNUTLS_CERT_INSECURE_ALGORITHM:  The certificate was signed using an insecure
0715  *   algorithm such as MD2 or MD5. These algorithms have been broken and
0716  *   should not be trusted.
0717  * @GNUTLS_CERT_NOT_ACTIVATED: The certificate is not yet activated.
0718  * @GNUTLS_CERT_EXPIRED: The certificate has expired.
0719  * @GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: The revocation data are old and have been superseded.
0720  * @GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: The revocation data have a future issue date.
0721  * @GNUTLS_CERT_UNEXPECTED_OWNER: The owner is not the expected one.
0722  * @GNUTLS_CERT_MISMATCH: The certificate presented isn't the expected one (TOFU)
0723  * @GNUTLS_CERT_PURPOSE_MISMATCH: The certificate or an intermediate does not match the intended purpose (extended key usage).
0724  * @GNUTLS_CERT_MISSING_OCSP_STATUS: The certificate requires the server to send the certificate status, but no status was received.
0725  * @GNUTLS_CERT_INVALID_OCSP_STATUS: The received OCSP status response is invalid.
0726  * @GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS: The certificate has extensions marked as critical which are not supported.
0727  *
0728  * Enumeration of certificate status codes.  Note that the status
0729  * bits may have different meanings in OpenPGP keys and X.509
0730  * certificate verification.
0731  */
0732 typedef enum {
0733     GNUTLS_CERT_INVALID = 1 << 1,
0734     GNUTLS_CERT_REVOKED = 1 << 5,
0735     GNUTLS_CERT_SIGNER_NOT_FOUND = 1 << 6,
0736     GNUTLS_CERT_SIGNER_NOT_CA = 1 << 7,
0737     GNUTLS_CERT_INSECURE_ALGORITHM = 1 << 8,
0738     GNUTLS_CERT_NOT_ACTIVATED = 1 << 9,
0739     GNUTLS_CERT_EXPIRED = 1 << 10,
0740     GNUTLS_CERT_SIGNATURE_FAILURE = 1 << 11,
0741     GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED = 1 << 12,
0742     GNUTLS_CERT_UNEXPECTED_OWNER = 1 << 14,
0743     GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE = 1 << 15,
0744     GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE = 1 << 16,
0745     GNUTLS_CERT_MISMATCH = 1 << 17,
0746     GNUTLS_CERT_PURPOSE_MISMATCH = 1 << 18,
0747     GNUTLS_CERT_MISSING_OCSP_STATUS = 1 << 19,
0748     GNUTLS_CERT_INVALID_OCSP_STATUS = 1 << 20,
0749     GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS = 1 << 21
0750 } gnutls_certificate_status_t;
0751
0752 /**
0753  * gnutls_certificate_request_t:
0754  * @GNUTLS_CERT_IGNORE: Ignore certificate.
0755  * @GNUTLS_CERT_REQUEST: Request certificate.
0756  * @GNUTLS_CERT_REQUIRE: Require certificate.
0757  *
0758  * Enumeration of certificate request types.
0759  */
0760 typedef enum {
0761     GNUTLS_CERT_IGNORE = 0,
0762     GNUTLS_CERT_REQUEST = 1,
0763     GNUTLS_CERT_REQUIRE = 2
0764 } gnutls_certificate_request_t;
0765
0766 /**
0767  * gnutls_openpgp_crt_status_t:
0768  * @GNUTLS_OPENPGP_CERT: Send entire certificate.
0769  * @GNUTLS_OPENPGP_CERT_FINGERPRINT: Send only certificate fingerprint.
0770  *
0771  * Enumeration of ways to send OpenPGP certificate.
0772  */
0773 typedef enum {
0774     GNUTLS_OPENPGP_CERT = 0,
0775     GNUTLS_OPENPGP_CERT_FINGERPRINT = 1
0776 } gnutls_openpgp_crt_status_t;
0777
0778 /**
0779  * gnutls_close_request_t:
0780  * @GNUTLS_SHUT_RDWR: Disallow further receives/sends.
0781  * @GNUTLS_SHUT_WR: Disallow further sends.
0782  *
0783  * Enumeration of how TLS session should be terminated.  See gnutls_bye().
0784  */
0785 typedef enum {
0786     GNUTLS_SHUT_RDWR = 0,
0787     GNUTLS_SHUT_WR = 1
0788 } gnutls_close_request_t;
0789
0790 /**
0791  * gnutls_protocol_t:
0792  * @GNUTLS_SSL3: SSL version 3.0.
0793  * @GNUTLS_TLS1_0: TLS version 1.0.
0794  * @GNUTLS_TLS1: Same as %GNUTLS_TLS1_0.
0795  * @GNUTLS_TLS1_1: TLS version 1.1.
0796  * @GNUTLS_TLS1_2: TLS version 1.2.
0797  * @GNUTLS_TLS1_3: TLS version 1.3.
0798  * @GNUTLS_DTLS1_0: DTLS version 1.0.
0799  * @GNUTLS_DTLS1_2: DTLS version 1.2.
0800  * @GNUTLS_DTLS0_9: DTLS version 0.9 (Cisco AnyConnect / OpenSSL 0.9.8e).
0801  * @GNUTLS_TLS_VERSION_MAX: Maps to the highest supported TLS version.
0802  * @GNUTLS_DTLS_VERSION_MAX: Maps to the highest supported DTLS version.
0803  * @GNUTLS_VERSION_UNKNOWN: Unknown SSL/TLS version.
0804  *
0805  * Enumeration of different SSL/TLS protocol versions.
0806  */
0807 typedef enum {
0808     GNUTLS_SSL3 = 1,
0809     GNUTLS_TLS1_0 = 2,
0810     GNUTLS_TLS1 = GNUTLS_TLS1_0,
0811     GNUTLS_TLS1_1 = 3,
0812     GNUTLS_TLS1_2 = 4,
0813     GNUTLS_TLS1_3 = 5,
0814
0815     GNUTLS_DTLS0_9 = 200,
0816     GNUTLS_DTLS1_0 = 201, /* 201 */
0817     GNUTLS_DTLS1_2 = 202,
0818     GNUTLS_DTLS_VERSION_MIN = GNUTLS_DTLS0_9,
0819     GNUTLS_DTLS_VERSION_MAX = GNUTLS_DTLS1_2,
0820     GNUTLS_TLS_VERSION_MAX = GNUTLS_TLS1_3,
0821     GNUTLS_VERSION_UNKNOWN = 0xff /* change it to 0xffff */
0822 } gnutls_protocol_t;
0823
0824 #define GNUTLS_CRT_RAW GNUTLS_CRT_RAWPK
0825
0826 /**
0827  * gnutls_certificate_type_t:
0828  * @GNUTLS_CRT_UNKNOWN: Unknown certificate type.
0829  * @GNUTLS_CRT_X509: X.509 Certificate.
0830  * @GNUTLS_CRT_OPENPGP: OpenPGP certificate.
0831  * @GNUTLS_CRT_RAWPK: Raw public-key (SubjectPublicKeyInfo)
0832  *
0833  * Enumeration of different certificate types.
0834  */
0835 typedef enum {
0836     GNUTLS_CRT_UNKNOWN = 0,
0837     GNUTLS_CRT_X509 = 1,
0838     GNUTLS_CRT_OPENPGP = 2,
0839     GNUTLS_CRT_RAWPK = 3,
0840     GNUTLS_CRT_MAX = GNUTLS_CRT_RAWPK
0841 } gnutls_certificate_type_t;
0842
0843 /**
0844  * gnutls_x509_crt_fmt_t:
0845  * @GNUTLS_X509_FMT_DER: X.509 certificate in DER format (binary).
0846  * @GNUTLS_X509_FMT_PEM: X.509 certificate in PEM format (text).
0847  *
0848  * Enumeration of different certificate encoding formats.
0849  */
0850 typedef enum {
0851     GNUTLS_X509_FMT_DER = 0,
0852     GNUTLS_X509_FMT_PEM = 1
0853 } gnutls_x509_crt_fmt_t;
0854
0855 /**
0856  * gnutls_certificate_print_formats_t:
0857  * @GNUTLS_CRT_PRINT_FULL: Full information about certificate.
0858  * @GNUTLS_CRT_PRINT_FULL_NUMBERS: Full information about certificate and include easy to parse public key parameters.
0859  * @GNUTLS_CRT_PRINT_COMPACT: Information about certificate name in one line, plus identification of the public key.
0860  * @GNUTLS_CRT_PRINT_ONELINE: Information about certificate in one line.
0861  * @GNUTLS_CRT_PRINT_UNSIGNED_FULL: All info for an unsigned certificate.
0862  *
0863  * Enumeration of different certificate printing variants.
0864  */
0865 typedef enum gnutls_certificate_print_formats {
0866     GNUTLS_CRT_PRINT_FULL = 0,
0867     GNUTLS_CRT_PRINT_ONELINE = 1,
0868     GNUTLS_CRT_PRINT_UNSIGNED_FULL = 2,
0869     GNUTLS_CRT_PRINT_COMPACT = 3,
0870     GNUTLS_CRT_PRINT_FULL_NUMBERS = 4
0871 } gnutls_certificate_print_formats_t;
0872
0873 #define GNUTLS_PK_ECC GNUTLS_PK_ECDSA
0874 #define GNUTLS_PK_EC GNUTLS_PK_ECDSA
0875
0876 #define GNUTLS_PK_ECDHX GNUTLS_PK_ECDH_X25519
0877
0878 /**
0879  * gnutls_pk_algorithm_t:
0880  * @GNUTLS_PK_UNKNOWN: Unknown public-key algorithm.
0881  * @GNUTLS_PK_RSA: RSA public-key algorithm.
0882  * @GNUTLS_PK_RSA_OAEP: RSA public-key algorithm, with OAEP padding.
0883  * @GNUTLS_PK_RSA_PSS: RSA public-key algorithm, with PSS padding.
0884  * @GNUTLS_PK_DSA: DSA public-key algorithm.
0885  * @GNUTLS_PK_DH: Diffie-Hellman algorithm. Used to generate parameters.
0886  * @GNUTLS_PK_ECDSA: Elliptic curve algorithm. These parameters are compatible with the ECDSA and ECDH algorithm.
0887  * @GNUTLS_PK_ECDH_X25519: Elliptic curve algorithm, restricted to ECDH as per rfc7748.
0888  * @GNUTLS_PK_EDDSA_ED25519: Edwards curve Digital signature algorithm. Used with SHA512 on signatures.
0889  * @GNUTLS_PK_GOST_01: GOST R 34.10-2001 algorithm per rfc5832.
0890  * @GNUTLS_PK_GOST_12_256: GOST R 34.10-2012 algorithm, 256-bit key per rfc7091.
0891  * @GNUTLS_PK_GOST_12_512: GOST R 34.10-2012 algorithm, 512-bit key per rfc7091.
0892  * @GNUTLS_PK_ECDH_X448: Elliptic curve algorithm, restricted to ECDH as per rfc7748.
0893  * @GNUTLS_PK_EDDSA_ED448: Edwards curve Digital signature algorithm. Used with SHAKE256 on signatures.
0894  * @GNUTLS_PK_MLKEM768: ML-KEM-768 key encapsulation algorithm as per FIPS 203.
0895  * @GNUTLS_PK_MLKEM1024: ML-KEM-1024 key encapsulation algorithm as per FIPS 203.
0896  * @GNUTLS_PK_MLDSA44: ML-DSA-44 digital signature algorithm as per FIPS 204.
0897  * @GNUTLS_PK_MLDSA65: ML-DSA-65 digital signature algorithm as per FIPS 204.
0898  * @GNUTLS_PK_MLDSA87: ML-DSA-87 digital signature algorithm as per FIPS 204.
0899  *
0900  * Enumeration of different public-key algorithms.
0901  */
0902 typedef enum {
0903     GNUTLS_PK_UNKNOWN = 0,
0904     GNUTLS_PK_RSA = 1,
0905     GNUTLS_PK_DSA = 2,
0906     GNUTLS_PK_DH = 3,
0907     GNUTLS_PK_ECDSA = 4,
0908     GNUTLS_PK_ECDH_X25519 = 5,
0909     GNUTLS_PK_RSA_PSS = 6,
0910     GNUTLS_PK_EDDSA_ED25519 = 7,
0911     GNUTLS_PK_GOST_01 = 8,
0912     GNUTLS_PK_GOST_12_256 = 9,
0913     GNUTLS_PK_GOST_12_512 = 10,
0914     GNUTLS_PK_ECDH_X448 = 11,
0915     GNUTLS_PK_EDDSA_ED448 = 12,
0916     GNUTLS_PK_RSA_OAEP = 13,
0917     GNUTLS_PK_MLKEM768 = 14,
0918     GNUTLS_PK_MLDSA44 = 15,
0919     GNUTLS_PK_MLDSA65 = 16,
0920     GNUTLS_PK_MLDSA87 = 17,
0921     GNUTLS_PK_MLKEM1024 = 18,
0922     GNUTLS_PK_MAX = GNUTLS_PK_MLKEM1024,
0923
0924     /* Experimental algorithms */
0925     GNUTLS_PK_EXP_KYBER768 = 256,
0926     GNUTLS_PK_EXP_MAX = GNUTLS_PK_EXP_KYBER768
0927 } gnutls_pk_algorithm_t;
0928
0929 const char *gnutls_pk_algorithm_get_name(gnutls_pk_algorithm_t algorithm);
0930
0931 /**
0932  * gnutls_sign_algorithm_t:
0933  * @GNUTLS_SIGN_UNKNOWN: Unknown signature algorithm.
0934  * @GNUTLS_SIGN_RSA_RAW: Digital signature algorithm RSA with DigestInfo formatted data
0935  * @GNUTLS_SIGN_RSA_SHA1: Digital signature algorithm RSA with SHA-1
0936  * @GNUTLS_SIGN_RSA_SHA: Same as %GNUTLS_SIGN_RSA_SHA1.
0937  * @GNUTLS_SIGN_DSA_SHA1: Digital signature algorithm DSA with SHA-1
0938  * @GNUTLS_SIGN_DSA_SHA224: Digital signature algorithm DSA with SHA-224
0939  * @GNUTLS_SIGN_DSA_SHA256: Digital signature algorithm DSA with SHA-256
0940  * @GNUTLS_SIGN_DSA_SHA384: Digital signature algorithm DSA with SHA-384
0941  * @GNUTLS_SIGN_DSA_SHA512: Digital signature algorithm DSA with SHA-512
0942  * @GNUTLS_SIGN_DSA_SHA: Same as %GNUTLS_SIGN_DSA_SHA1.
0943  * @GNUTLS_SIGN_RSA_MD5: Digital signature algorithm RSA with MD5.
0944  * @GNUTLS_SIGN_RSA_MD2: Digital signature algorithm RSA with MD2.
0945  * @GNUTLS_SIGN_RSA_RMD160: Digital signature algorithm RSA with RMD-160.
0946  * @GNUTLS_SIGN_RSA_SHA256: Digital signature algorithm RSA with SHA-256.
0947  * @GNUTLS_SIGN_RSA_SHA384: Digital signature algorithm RSA with SHA-384.
0948  * @GNUTLS_SIGN_RSA_SHA512: Digital signature algorithm RSA with SHA-512.
0949  * @GNUTLS_SIGN_RSA_SHA224: Digital signature algorithm RSA with SHA-224.
0950  * @GNUTLS_SIGN_ECDSA_SHA1: ECDSA with SHA1.
0951  * @GNUTLS_SIGN_ECDSA_SHA224: Digital signature algorithm ECDSA with SHA-224.
0952  * @GNUTLS_SIGN_ECDSA_SHA256: Digital signature algorithm ECDSA with SHA-256.
0953  * @GNUTLS_SIGN_ECDSA_SHA384: Digital signature algorithm ECDSA with SHA-384.
0954  * @GNUTLS_SIGN_ECDSA_SHA512: Digital signature algorithm ECDSA with SHA-512.
0955  * @GNUTLS_SIGN_ECDSA_SECP256R1_SHA256: Digital signature algorithm ECDSA-SECP256R1 with SHA-256 (used in TLS 1.3 but not PKIX).
0956  * @GNUTLS_SIGN_ECDSA_SECP384R1_SHA384: Digital signature algorithm ECDSA-SECP384R1 with SHA-384 (used in TLS 1.3 but not PKIX).
0957  * @GNUTLS_SIGN_ECDSA_SECP521R1_SHA512: Digital signature algorithm ECDSA-SECP521R1 with SHA-512 (used in TLS 1.3 but not PKIX).
0958  * @GNUTLS_SIGN_ECDSA_SHA3_224: Digital signature algorithm ECDSA with SHA3-224.
0959  * @GNUTLS_SIGN_ECDSA_SHA3_256: Digital signature algorithm ECDSA with SHA3-256.
0960  * @GNUTLS_SIGN_ECDSA_SHA3_384: Digital signature algorithm ECDSA with SHA3-384.
0961  * @GNUTLS_SIGN_ECDSA_SHA3_512: Digital signature algorithm ECDSA with SHA3-512.
0962  * @GNUTLS_SIGN_DSA_SHA3_224: Digital signature algorithm DSA with SHA3-224.
0963  * @GNUTLS_SIGN_DSA_SHA3_256: Digital signature algorithm DSA with SHA3-256.
0964  * @GNUTLS_SIGN_DSA_SHA3_384: Digital signature algorithm DSA with SHA3-384.
0965  * @GNUTLS_SIGN_DSA_SHA3_512: Digital signature algorithm DSA with SHA3-512.
0966  * @GNUTLS_SIGN_RSA_SHA3_224: Digital signature algorithm RSA with SHA3-224.
0967  * @GNUTLS_SIGN_RSA_SHA3_256: Digital signature algorithm RSA with SHA3-256.
0968  * @GNUTLS_SIGN_RSA_SHA3_384: Digital signature algorithm RSA with SHA3-384.
0969  * @GNUTLS_SIGN_RSA_SHA3_512: Digital signature algorithm RSA with SHA3-512.
0970  * @GNUTLS_SIGN_RSA_PSS_RSAE_SHA256: Digital signature algorithm RSA with SHA-256,
0971  *      with PSS padding (RSA PKCS#1 1.5 certificate). This signature is identical
0972  *      to #GNUTLS_SIGN_RSA_PSS_SHA256, but they are distinct as the TLS1.3 protocol
0973  *      treats them differently.
0974  * @GNUTLS_SIGN_RSA_PSS_RSAE_SHA384: Digital signature algorithm RSA with SHA-384,
0975  *      with PSS padding (RSA PKCS#1 1.5 certificate). This signature is identical
0976  *      to #GNUTLS_SIGN_RSA_PSS_SHA384, but they are distinct as the TLS1.3 protocol
0977  *      treats them differently.
0978  * @GNUTLS_SIGN_RSA_PSS_RSAE_SHA512: Digital signature algorithm RSA with SHA-512,
0979  *      with PSS padding (RSA PKCS#1 1.5 certificate). This signature is identical
0980  *      to #GNUTLS_SIGN_RSA_PSS_SHA512, but they are distinct as the TLS1.3 protocol
0981  *      treats them differently.
0982  * @GNUTLS_SIGN_RSA_PSS_SHA256: Digital signature algorithm RSA with SHA-256, with PSS padding (RSA-PSS certificate).
0983  * @GNUTLS_SIGN_RSA_PSS_SHA384: Digital signature algorithm RSA with SHA-384, with PSS padding (RSA-PSS certificate).
0984  * @GNUTLS_SIGN_RSA_PSS_SHA512: Digital signature algorithm RSA with SHA-512, with PSS padding (RSA-PSS certificate).
0985  * @GNUTLS_SIGN_EDDSA_ED25519: Digital signature algorithm EdDSA with Ed25519 curve.
0986  * @GNUTLS_SIGN_GOST_94: Digital signature algorithm GOST R 34.10-2001 with GOST R 34.11-94
0987  * @GNUTLS_SIGN_GOST_256: Digital signature algorithm GOST R 34.10-2012 with GOST R 34.11-2012 256 bit
0988  * @GNUTLS_SIGN_GOST_512: Digital signature algorithm GOST R 34.10-2012 with GOST R 34.11-2012 512 bit
0989  * @GNUTLS_SIGN_EDDSA_ED448: Digital signature algorithm EdDSA with Ed448 curve.
0990  * @GNUTLS_SIGN_MLDSA44: Digital signature algorithm ML-DSA-44.
0991  * @GNUTLS_SIGN_MLDSA65: Digital signature algorithm ML-DSA-65.
0992  * @GNUTLS_SIGN_MLDSA87: Digital signature algorithm ML-DSA-87.
0993  *
0994  * Enumeration of different digital signature algorithms.
0995  */
0996 typedef enum {
0997     GNUTLS_SIGN_UNKNOWN = 0,
0998     GNUTLS_SIGN_RSA_SHA1 = 1,
0999     GNUTLS_SIGN_RSA_SHA = GNUTLS_SIGN_RSA_SHA1,
1000     GNUTLS_SIGN_DSA_SHA1 = 2,
1001     GNUTLS_SIGN_DSA_SHA = GNUTLS_SIGN_DSA_SHA1,
1002     GNUTLS_SIGN_RSA_MD5 = 3,
1003     GNUTLS_SIGN_RSA_MD2 = 4,
1004     GNUTLS_SIGN_RSA_RMD160 = 5,
1005     GNUTLS_SIGN_RSA_SHA256 = 6,
1006     GNUTLS_SIGN_RSA_SHA384 = 7,
1007     GNUTLS_SIGN_RSA_SHA512 = 8,
1008     GNUTLS_SIGN_RSA_SHA224 = 9,
1009     GNUTLS_SIGN_DSA_SHA224 = 10,
1010     GNUTLS_SIGN_DSA_SHA256 = 11,
1011     GNUTLS_SIGN_ECDSA_SHA1 = 12,
1012     GNUTLS_SIGN_ECDSA_SHA224 = 13,
1013     GNUTLS_SIGN_ECDSA_SHA256 = 14,
1014     GNUTLS_SIGN_ECDSA_SHA384 = 15,
1015     GNUTLS_SIGN_ECDSA_SHA512 = 16,
1016     GNUTLS_SIGN_DSA_SHA384 = 17,
1017     GNUTLS_SIGN_DSA_SHA512 = 18,
1018     GNUTLS_SIGN_ECDSA_SHA3_224 = 20,
1019     GNUTLS_SIGN_ECDSA_SHA3_256 = 21,
1020     GNUTLS_SIGN_ECDSA_SHA3_384 = 22,
1021     GNUTLS_SIGN_ECDSA_SHA3_512 = 23,
1022
1023     GNUTLS_SIGN_DSA_SHA3_224 = 24,
1024     GNUTLS_SIGN_DSA_SHA3_256 = 25,
1025     GNUTLS_SIGN_DSA_SHA3_384 = 26,
1026     GNUTLS_SIGN_DSA_SHA3_512 = 27,
1027     GNUTLS_SIGN_RSA_SHA3_224 = 28,
1028     GNUTLS_SIGN_RSA_SHA3_256 = 29,
1029     GNUTLS_SIGN_RSA_SHA3_384 = 30,
1030     GNUTLS_SIGN_RSA_SHA3_512 = 31,
1031
1032     GNUTLS_SIGN_RSA_PSS_SHA256 = 32,
1033     GNUTLS_SIGN_RSA_PSS_SHA384 = 33,
1034     GNUTLS_SIGN_RSA_PSS_SHA512 = 34,
1035     GNUTLS_SIGN_EDDSA_ED25519 = 35,
1036     GNUTLS_SIGN_RSA_RAW = 36,
1037
1038     GNUTLS_SIGN_ECDSA_SECP256R1_SHA256 = 37,
1039     GNUTLS_SIGN_ECDSA_SECP384R1_SHA384 = 38,
1040     GNUTLS_SIGN_ECDSA_SECP521R1_SHA512 = 39,
1041
1042     GNUTLS_SIGN_RSA_PSS_RSAE_SHA256 = 40,
1043     GNUTLS_SIGN_RSA_PSS_RSAE_SHA384 = 41,
1044     GNUTLS_SIGN_RSA_PSS_RSAE_SHA512 = 42,
1045
1046     GNUTLS_SIGN_GOST_94 = 43,
1047     GNUTLS_SIGN_GOST_256 = 44,
1048     GNUTLS_SIGN_GOST_512 = 45,
1049     GNUTLS_SIGN_EDDSA_ED448 = 46,
1050
1051     GNUTLS_SIGN_MLDSA44 = 47,
1052     GNUTLS_SIGN_MLDSA65 = 48,
1053     GNUTLS_SIGN_MLDSA87 = 49,
1054     GNUTLS_SIGN_MAX = GNUTLS_SIGN_MLDSA87
1055 } gnutls_sign_algorithm_t;
1056
1057 /**
1058  * gnutls_ecc_curve_t:
1059  * @GNUTLS_ECC_CURVE_INVALID: Cannot be known
1060  * @GNUTLS_ECC_CURVE_SECP192R1: the SECP192R1 curve
1061  * @GNUTLS_ECC_CURVE_SECP224R1: the SECP224R1 curve
1062  * @GNUTLS_ECC_CURVE_SECP256R1: the SECP256R1 curve
1063  * @GNUTLS_ECC_CURVE_SECP384R1: the SECP384R1 curve
1064  * @GNUTLS_ECC_CURVE_SECP521R1: the SECP521R1 curve
1065  * @GNUTLS_ECC_CURVE_X25519: the X25519 curve (ECDH only)
1066  * @GNUTLS_ECC_CURVE_ED25519: the Ed25519 curve
1067  * @GNUTLS_ECC_CURVE_GOST256CPA: GOST R 34.10 CryptoPro 256 A curve
1068  * @GNUTLS_ECC_CURVE_GOST256CPB: GOST R 34.10 CryptoPro 256 B curve
1069  * @GNUTLS_ECC_CURVE_GOST256CPC: GOST R 34.10 CryptoPro 256 C curve
1070  * @GNUTLS_ECC_CURVE_GOST256CPXA: GOST R 34.10 CryptoPro 256 XchA curve
1071  * @GNUTLS_ECC_CURVE_GOST256CPXB: GOST R 34.10 CryptoPro 256 XchB curve
1072  * @GNUTLS_ECC_CURVE_GOST512A: GOST R 34.10 TC26 512 A curve
1073  * @GNUTLS_ECC_CURVE_GOST512B: GOST R 34.10 TC26 512 B curve
1074  * @GNUTLS_ECC_CURVE_GOST512C: GOST R 34.10 TC26 512 C curve
1075  * @GNUTLS_ECC_CURVE_GOST256A: GOST R 34.10 TC26 256 A curve
1076  * @GNUTLS_ECC_CURVE_GOST256B: GOST R 34.10 TC26 256 B curve
1077  * @GNUTLS_ECC_CURVE_GOST256C: GOST R 34.10 TC26 256 C curve
1078  * @GNUTLS_ECC_CURVE_GOST256D: GOST R 34.10 TC26 256 D curve
1079  * @GNUTLS_ECC_CURVE_X448: the X448 curve (ECDH only)
1080  * @GNUTLS_ECC_CURVE_ED448: the Ed448 curve
1081  *
1082  * Enumeration of ECC curves.
1083  */
1084 typedef enum {
1085     GNUTLS_ECC_CURVE_INVALID = 0,
1086     GNUTLS_ECC_CURVE_SECP224R1,
1087     GNUTLS_ECC_CURVE_SECP256R1,
1088     GNUTLS_ECC_CURVE_SECP384R1,
1089     GNUTLS_ECC_CURVE_SECP521R1,
1090     GNUTLS_ECC_CURVE_SECP192R1,
1091     GNUTLS_ECC_CURVE_X25519,
1092     GNUTLS_ECC_CURVE_ED25519,
1093     GNUTLS_ECC_CURVE_GOST256CPA,
1094     GNUTLS_ECC_CURVE_GOST256CPB,
1095     GNUTLS_ECC_CURVE_GOST256CPC,
1096     GNUTLS_ECC_CURVE_GOST256CPXA,
1097     GNUTLS_ECC_CURVE_GOST256CPXB,
1098     GNUTLS_ECC_CURVE_GOST512A,
1099     GNUTLS_ECC_CURVE_GOST512B,
1100     GNUTLS_ECC_CURVE_GOST512C,
1101     GNUTLS_ECC_CURVE_GOST256A,
1102     GNUTLS_ECC_CURVE_GOST256B,
1103     GNUTLS_ECC_CURVE_GOST256C,
1104     GNUTLS_ECC_CURVE_GOST256D,
1105     GNUTLS_ECC_CURVE_X448,
1106     GNUTLS_ECC_CURVE_ED448,
1107     GNUTLS_ECC_CURVE_MAX = GNUTLS_ECC_CURVE_ED448
1108 } gnutls_ecc_curve_t;
1109
1110 /**
1111  * gnutls_group_t:
1112  * @GNUTLS_GROUP_INVALID: Indicates unknown/invalid group
1113  * @GNUTLS_GROUP_SECP192R1: the SECP192R1 curve group (legacy, only for TLS 1.2 compatibility)
1114  * @GNUTLS_GROUP_SECP224R1: the SECP224R1 curve group (legacy, only for TLS 1.2 compatibility)
1115  * @GNUTLS_GROUP_SECP256R1: the SECP256R1 curve group
1116  * @GNUTLS_GROUP_SECP384R1: the SECP384R1 curve group
1117  * @GNUTLS_GROUP_SECP521R1: the SECP521R1 curve group
1118  * @GNUTLS_GROUP_X25519: the X25519 curve group
1119  * @GNUTLS_GROUP_GC256A: the GOST R 34.10 TC26 256 A curve group
1120  * @GNUTLS_GROUP_GC256B: the GOST R 34.10 TC26 256 B curve group
1121  * @GNUTLS_GROUP_GC256C: the GOST R 34.10 TC26 256 C curve group
1122  * @GNUTLS_GROUP_GC256D: the GOST R 34.10 TC26 256 D curve group
1123  * @GNUTLS_GROUP_GC512A: the GOST R 34.10 TC26 512 A curve group
1124  * @GNUTLS_GROUP_GC512B: the GOST R 34.10 TC26 512 B curve group
1125  * @GNUTLS_GROUP_GC512C: the GOST R 34.10 TC26 512 C curve group
1126  * @GNUTLS_GROUP_FFDHE2048: the FFDHE2048 group
1127  * @GNUTLS_GROUP_FFDHE3072: the FFDHE3072 group
1128  * @GNUTLS_GROUP_FFDHE4096: the FFDHE4096 group
1129  * @GNUTLS_GROUP_FFDHE6144: the FFDHE6144 group
1130  * @GNUTLS_GROUP_FFDHE8192: the FFDHE8192 group
1131  * @GNUTLS_GROUP_X448: the X448 curve group
1132  *
1133  * Enumeration of supported groups. It is intended to be backwards
1134  * compatible with the enumerations in %gnutls_ecc_curve_t for the groups
1135  * which are valid elliptic curves.
1136  */
1137 typedef enum {
1138     GNUTLS_GROUP_INVALID = 0,
1139     GNUTLS_GROUP_SECP192R1 = GNUTLS_ECC_CURVE_SECP192R1,
1140     GNUTLS_GROUP_SECP224R1 = GNUTLS_ECC_CURVE_SECP224R1,
1141     GNUTLS_GROUP_SECP256R1 = GNUTLS_ECC_CURVE_SECP256R1,
1142     GNUTLS_GROUP_SECP384R1 = GNUTLS_ECC_CURVE_SECP384R1,
1143     GNUTLS_GROUP_SECP521R1 = GNUTLS_ECC_CURVE_SECP521R1,
1144     GNUTLS_GROUP_X25519 = GNUTLS_ECC_CURVE_X25519,
1145     GNUTLS_GROUP_X448 = GNUTLS_ECC_CURVE_X448,
1146
1147     GNUTLS_GROUP_GC256A = GNUTLS_ECC_CURVE_GOST256A,
1148     GNUTLS_GROUP_GC256B = GNUTLS_ECC_CURVE_GOST256B,
1149     GNUTLS_GROUP_GC256C = GNUTLS_ECC_CURVE_GOST256C,
1150     GNUTLS_GROUP_GC256D = GNUTLS_ECC_CURVE_GOST256D,
1151     GNUTLS_GROUP_GC512A = GNUTLS_ECC_CURVE_GOST512A,
1152     GNUTLS_GROUP_GC512B = GNUTLS_ECC_CURVE_GOST512B,
1153     GNUTLS_GROUP_GC512C = GNUTLS_ECC_CURVE_GOST512C,
1154
1155     GNUTLS_GROUP_FFDHE2048 = 256,
1156     GNUTLS_GROUP_FFDHE3072,
1157     GNUTLS_GROUP_FFDHE4096,
1158     GNUTLS_GROUP_FFDHE8192,
1159     GNUTLS_GROUP_FFDHE6144,
1160     GNUTLS_GROUP_MAX = GNUTLS_GROUP_FFDHE6144,
1161
1162     /* Experimental algorithms */
1163     GNUTLS_GROUP_EXP_X25519_KYBER768 = 512,
1164     GNUTLS_GROUP_EXP_SECP256R1_MLKEM768 = 513,
1165     GNUTLS_GROUP_EXP_SECP384R1_MLKEM1024 = 518,
1166     GNUTLS_GROUP_EXP_X25519_MLKEM768 = 514,
1167     GNUTLS_GROUP_EXP_KYBER768 = 515,
1168     GNUTLS_GROUP_EXP_MLKEM768 = 516,
1169     GNUTLS_GROUP_EXP_MLKEM1024 = 517,
1170     GNUTLS_GROUP_EXP_MIN = GNUTLS_GROUP_EXP_X25519_KYBER768,
1171     GNUTLS_GROUP_EXP_MAX = GNUTLS_GROUP_EXP_SECP384R1_MLKEM1024
1172 } gnutls_group_t;
1173
1174 /* macros to allow specifying a specific curve in gnutls_privkey_generate()
1175  * and gnutls_x509_privkey_generate() */
1176 #define GNUTLS_CURVE_TO_BITS(curve) \
1177     (unsigned int)(((unsigned int)1 << 31) | ((unsigned int)(curve)))
1178 #define GNUTLS_BITS_TO_CURVE(bits) (((unsigned int)(bits)) & 0x7FFFFFFF)
1179 #define GNUTLS_BITS_ARE_CURVE(bits) (((unsigned int)(bits)) & 0x80000000)
1180
1181 /**
1182  * gnutls_sec_param_t:
1183  * @GNUTLS_SEC_PARAM_UNKNOWN: Cannot be known
1184  * @GNUTLS_SEC_PARAM_INSECURE: Less than 42 bits of security
1185  * @GNUTLS_SEC_PARAM_EXPORT: 42 bits of security
1186  * @GNUTLS_SEC_PARAM_VERY_WEAK: 64 bits of security
1187  * @GNUTLS_SEC_PARAM_WEAK: 72 bits of security
1188  * @GNUTLS_SEC_PARAM_LOW: 80 bits of security
1189  * @GNUTLS_SEC_PARAM_LEGACY: 96 bits of security
1190  * @GNUTLS_SEC_PARAM_MEDIUM: 112 bits of security (used to be %GNUTLS_SEC_PARAM_NORMAL)
1191  * @GNUTLS_SEC_PARAM_HIGH: 128 bits of security
1192  * @GNUTLS_SEC_PARAM_ULTRA: 192 bits of security
1193  * @GNUTLS_SEC_PARAM_FUTURE: 256 bits of security
1194  *
1195  * Enumeration of security parameters for passive attacks.
1196  */
1197 typedef enum {
1198     GNUTLS_SEC_PARAM_UNKNOWN = 0,
1199     GNUTLS_SEC_PARAM_INSECURE = 5,
1200     GNUTLS_SEC_PARAM_EXPORT = 10,
1201     GNUTLS_SEC_PARAM_VERY_WEAK = 15,
1202     GNUTLS_SEC_PARAM_WEAK = 20,
1203     GNUTLS_SEC_PARAM_LOW = 25,
1204     GNUTLS_SEC_PARAM_LEGACY = 30,
1205     GNUTLS_SEC_PARAM_MEDIUM = 35,
1206     GNUTLS_SEC_PARAM_HIGH = 40,
1207     GNUTLS_SEC_PARAM_ULTRA = 45,
1208     GNUTLS_SEC_PARAM_FUTURE = 50,
1209     GNUTLS_SEC_PARAM_MAX = GNUTLS_SEC_PARAM_FUTURE
1210 } gnutls_sec_param_t;
1211
1212 /* old name */
1213 #define GNUTLS_SEC_PARAM_NORMAL GNUTLS_SEC_PARAM_MEDIUM
1214
1215 /**
1216  * gnutls_channel_binding_t:
1217  * @GNUTLS_CB_TLS_UNIQUE: "tls-unique" (RFC 5929) channel binding
1218  * @GNUTLS_CB_TLS_SERVER_END_POINT: "tls-server-end-point" (RFC 5929) channel binding
1219  * @GNUTLS_CB_TLS_EXPORTER: "tls-exporter" (RFC 9266) channel binding
1220  *
1221  * Enumeration of supported channel binding types.
1222  */
1223 typedef enum {
1224     GNUTLS_CB_TLS_UNIQUE,
1225     GNUTLS_CB_TLS_SERVER_END_POINT,
1226     GNUTLS_CB_TLS_EXPORTER
1227 } gnutls_channel_binding_t;
1228
1229 /**
1230  * gnutls_gost_paramset_t:
1231  * @GNUTLS_GOST_PARAMSET_UNKNOWN: Unknown/default parameter set
1232  * @GNUTLS_GOST_PARAMSET_TC26_Z: Specified by TC26, see rfc7836
1233  * @GNUTLS_GOST_PARAMSET_CP_A: CryptoPro-A, see rfc4357
1234  * @GNUTLS_GOST_PARAMSET_CP_B: CryptoPro-B, see rfc4357
1235  * @GNUTLS_GOST_PARAMSET_CP_C: CryptoPro-C, see rfc4357
1236  * @GNUTLS_GOST_PARAMSET_CP_D: CryptoPro-D, see rfc4357
1237  *
1238  * Enumeration of different GOST 28147 parameter sets.
1239  */
1240 typedef enum {
1241     GNUTLS_GOST_PARAMSET_UNKNOWN = 0,
1242     GNUTLS_GOST_PARAMSET_TC26_Z,
1243     GNUTLS_GOST_PARAMSET_CP_A,
1244     GNUTLS_GOST_PARAMSET_CP_B,
1245     GNUTLS_GOST_PARAMSET_CP_C,
1246     GNUTLS_GOST_PARAMSET_CP_D
1247 } gnutls_gost_paramset_t;
1248
1249 /**
1250  * gnutls_ctype_target_t:
1251  * @GNUTLS_CTYPE_CLIENT: for requesting client certificate type values.
1252  * @GNUTLS_CTYPE_SERVER: for requesting server certificate type values.
1253  * @GNUTLS_CTYPE_OURS: for requesting our certificate type values.
1254  * @GNUTLS_CTYPE_PEERS: for requesting the peers' certificate type values.
1255  *
1256  * Enumeration of certificate type targets with respect to asymmetric
1257  * certificate types as specified in RFC7250 and P2P connection set up
1258  * as specified in draft-vanrein-tls-symmetry-02.
1259  */
1260 typedef enum {
1261     GNUTLS_CTYPE_CLIENT,
1262     GNUTLS_CTYPE_SERVER,
1263     GNUTLS_CTYPE_OURS,
1264     GNUTLS_CTYPE_PEERS
1265 } gnutls_ctype_target_t;
1266
1267 /* If you want to change this, then also change the define in
1268  * gnutls_int.h, and recompile.
1269  */
1270 typedef void *gnutls_transport_ptr_t;
1271
1272 struct gnutls_session_int;
1273 typedef struct gnutls_session_int *gnutls_session_t;
1274
1275 struct gnutls_dh_params_int;
1276 typedef struct gnutls_dh_params_int *gnutls_dh_params_t;
1277
1278 /* XXX ugly. */
1279 struct gnutls_x509_privkey_int;
1280 typedef struct gnutls_x509_privkey_int *gnutls_rsa_params_t;
1281
1282 struct gnutls_priority_st;
1283 typedef struct gnutls_priority_st *gnutls_priority_t;
1284
1285 typedef struct {
1286     unsigned char *data;
1287     unsigned int size;
1288 } gnutls_datum_t;
1289
1290 typedef struct gnutls_library_config_st {
1291     const char *name;
1292     const char *value;
1293 } gnutls_library_config_st;
1294
1295 typedef struct gnutls_params_st {
1296     gnutls_params_type_t type;
1297     union params {
1298         gnutls_dh_params_t dh;
1299         gnutls_rsa_params_t rsa_export;
1300     } params;
1301     int deinit;
1302 } gnutls_params_st;
1303
1304 typedef int gnutls_params_function(gnutls_session_t, gnutls_params_type_t,
1305                    gnutls_params_st *);
1306
1307 /* internal functions */
1308
1309 int gnutls_init(gnutls_session_t *session, unsigned int flags);
1310 void gnutls_deinit(gnutls_session_t session);
1311 #define _gnutls_deinit(x) gnutls_deinit(x)
1312
1313 int gnutls_bye(gnutls_session_t session, gnutls_close_request_t how);
1314
1315 int gnutls_handshake(gnutls_session_t session);
1316
1317 int gnutls_reauth(gnutls_session_t session, unsigned int flags);
1318
1319 #define GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT ((unsigned int)-1)
1320 #define GNUTLS_INDEFINITE_TIMEOUT ((unsigned int)-2)
1321 void gnutls_handshake_set_timeout(gnutls_session_t session, unsigned int ms);
1322 int gnutls_rehandshake(gnutls_session_t session);
1323
1324 #define GNUTLS_KU_PEER 1
1325 int gnutls_session_key_update(gnutls_session_t session, unsigned flags);
1326
1327 gnutls_alert_description_t gnutls_alert_get(gnutls_session_t session);
1328 int gnutls_alert_send(gnutls_session_t session, gnutls_alert_level_t level,
1329               gnutls_alert_description_t desc);
1330 int gnutls_alert_send_appropriate(gnutls_session_t session, int err);
1331 const char *gnutls_alert_get_name(gnutls_alert_description_t alert);
1332 const char *gnutls_alert_get_strname(gnutls_alert_description_t alert);
1333
1334 gnutls_sec_param_t gnutls_pk_bits_to_sec_param(gnutls_pk_algorithm_t algo,
1335                            unsigned int bits);
1336 const char *gnutls_sec_param_get_name(gnutls_sec_param_t param);
1337 unsigned int gnutls_sec_param_to_pk_bits(gnutls_pk_algorithm_t algo,
1338                      gnutls_sec_param_t param);
1339 unsigned int
1340 gnutls_sec_param_to_symmetric_bits(gnutls_sec_param_t param) __GNUTLS_CONST__;
1341
1342 /* Elliptic curves */
1343 const char *
1344 gnutls_ecc_curve_get_name(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1345 const char *gnutls_ecc_curve_get_oid(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1346
1347 const char *gnutls_group_get_name(gnutls_group_t group) __GNUTLS_CONST__;
1348
1349 int gnutls_ecc_curve_get_size(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1350 gnutls_ecc_curve_t gnutls_ecc_curve_get(gnutls_session_t session);
1351
1352 gnutls_group_t gnutls_group_get(gnutls_session_t session);
1353
1354 /* get information on the current session */
1355 gnutls_cipher_algorithm_t gnutls_cipher_get(gnutls_session_t session);
1356 gnutls_cipher_algorithm_t gnutls_early_cipher_get(gnutls_session_t session);
1357 gnutls_kx_algorithm_t gnutls_kx_get(gnutls_session_t session);
1358 gnutls_mac_algorithm_t gnutls_mac_get(gnutls_session_t session);
1359 gnutls_digest_algorithm_t gnutls_prf_hash_get(const gnutls_session_t session);
1360 gnutls_digest_algorithm_t
1361 gnutls_early_prf_hash_get(const gnutls_session_t session);
1362 gnutls_certificate_type_t gnutls_certificate_type_get(gnutls_session_t session);
1363 gnutls_certificate_type_t
1364 gnutls_certificate_type_get2(gnutls_session_t session,
1365                  gnutls_ctype_target_t target);
1366
1367 int gnutls_sign_algorithm_get(gnutls_session_t session);
1368 int gnutls_sign_algorithm_get_client(gnutls_session_t session);
1369
1370 int gnutls_sign_algorithm_get_requested(gnutls_session_t session, size_t indx,
1371                     gnutls_sign_algorithm_t *algo);
1372
1373 /* the name of the specified algorithms */
1374 const char *
1375 gnutls_cipher_get_name(gnutls_cipher_algorithm_t algorithm) __GNUTLS_CONST__;
1376 const char *
1377 gnutls_mac_get_name(gnutls_mac_algorithm_t algorithm) __GNUTLS_CONST__;
1378
1379 const char *
1380 gnutls_digest_get_name(gnutls_digest_algorithm_t algorithm) __GNUTLS_CONST__;
1381 const char *
1382 gnutls_digest_get_oid(gnutls_digest_algorithm_t algorithm) __GNUTLS_CONST__;
1383
1384 const char *
1385 gnutls_kx_get_name(gnutls_kx_algorithm_t algorithm) __GNUTLS_CONST__;
1386 const char *gnutls_certificate_type_get_name(gnutls_certificate_type_t type)
1387     __GNUTLS_CONST__;
1388 const char *
1389 gnutls_pk_get_name(gnutls_pk_algorithm_t algorithm) __GNUTLS_CONST__;
1390 const char *gnutls_pk_get_oid(gnutls_pk_algorithm_t algorithm) __GNUTLS_CONST__;
1391
1392 const char *
1393 gnutls_sign_get_name(gnutls_sign_algorithm_t algorithm) __GNUTLS_CONST__;
1394
1395 const char *gnutls_sign_get_oid(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;
1396
1397 const char *
1398 gnutls_gost_paramset_get_name(gnutls_gost_paramset_t param) __GNUTLS_CONST__;
1399 const char *
1400 gnutls_gost_paramset_get_oid(gnutls_gost_paramset_t param) __GNUTLS_CONST__;
1401
1402 size_t gnutls_cipher_get_key_size(gnutls_cipher_algorithm_t algorithm)
1403     __GNUTLS_CONST__;
1404 size_t
1405 gnutls_mac_get_key_size(gnutls_mac_algorithm_t algorithm) __GNUTLS_CONST__;
1406
1407 unsigned
1408 gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm) __GNUTLS_CONST__;
1409
1410 /* It is possible that a signature algorithm is ok to use for short-lived
1411  * data (e.g., to sign a TLS session), but not for data that are long-lived
1412  * like certificates. This flag is about checking the security of the algorithm
1413  * for long-lived data. */
1414 #define GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS 1
1415 unsigned gnutls_sign_is_secure2(gnutls_sign_algorithm_t algorithm,
1416                 unsigned int flags) __GNUTLS_CONST__;
1417
1418 gnutls_digest_algorithm_t
1419 gnutls_sign_get_hash_algorithm(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;
1420 gnutls_pk_algorithm_t
1421 gnutls_sign_get_pk_algorithm(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;
1422 gnutls_sign_algorithm_t
1423 gnutls_pk_to_sign(gnutls_pk_algorithm_t pk,
1424           gnutls_digest_algorithm_t hash) __GNUTLS_CONST__;
1425
1426 unsigned
1427 gnutls_sign_supports_pk_algorithm(gnutls_sign_algorithm_t sign,
1428                   gnutls_pk_algorithm_t pk) __GNUTLS_CONST__;
1429
1430 #define gnutls_sign_algorithm_get_name gnutls_sign_get_name
1431
1432 gnutls_mac_algorithm_t gnutls_mac_get_id(const char *name) __GNUTLS_CONST__;
1433 gnutls_digest_algorithm_t
1434 gnutls_digest_get_id(const char *name) __GNUTLS_CONST__;
1435
1436 gnutls_cipher_algorithm_t
1437 gnutls_cipher_get_id(const char *name) __GNUTLS_CONST__;
1438
1439 gnutls_kx_algorithm_t gnutls_kx_get_id(const char *name) __GNUTLS_CONST__;
1440 gnutls_protocol_t gnutls_protocol_get_id(const char *name) __GNUTLS_CONST__;
1441 gnutls_certificate_type_t
1442 gnutls_certificate_type_get_id(const char *name) __GNUTLS_CONST__;
1443 gnutls_pk_algorithm_t gnutls_pk_get_id(const char *name) __GNUTLS_CONST__;
1444 gnutls_sign_algorithm_t gnutls_sign_get_id(const char *name) __GNUTLS_CONST__;
1445 gnutls_ecc_curve_t gnutls_ecc_curve_get_id(const char *name) __GNUTLS_CONST__;
1446 gnutls_pk_algorithm_t
1447 gnutls_ecc_curve_get_pk(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1448 gnutls_group_t gnutls_group_get_id(const char *name);
1449
1450 gnutls_digest_algorithm_t
1451 gnutls_oid_to_digest(const char *oid) __GNUTLS_CONST__;
1452 gnutls_mac_algorithm_t gnutls_oid_to_mac(const char *oid) __GNUTLS_CONST__;
1453 gnutls_pk_algorithm_t gnutls_oid_to_pk(const char *oid) __GNUTLS_CONST__;
1454 gnutls_sign_algorithm_t gnutls_oid_to_sign(const char *oid) __GNUTLS_CONST__;
1455 gnutls_ecc_curve_t gnutls_oid_to_ecc_curve(const char *oid) __GNUTLS_CONST__;
1456 gnutls_gost_paramset_t
1457 gnutls_oid_to_gost_paramset(const char *oid) __GNUTLS_CONST__;
1458
1459 /* list supported algorithms */
1460 const gnutls_ecc_curve_t *gnutls_ecc_curve_list(void) __GNUTLS_PURE__;
1461 const gnutls_group_t *gnutls_group_list(void) __GNUTLS_PURE__;
1462 const gnutls_cipher_algorithm_t *gnutls_cipher_list(void) __GNUTLS_PURE__;
1463 const gnutls_mac_algorithm_t *gnutls_mac_list(void) __GNUTLS_PURE__;
1464 const gnutls_digest_algorithm_t *gnutls_digest_list(void) __GNUTLS_PURE__;
1465 const gnutls_protocol_t *gnutls_protocol_list(void) __GNUTLS_PURE__;
1466 const gnutls_certificate_type_t *
1467 gnutls_certificate_type_list(void) __GNUTLS_PURE__;
1468 const gnutls_kx_algorithm_t *gnutls_kx_list(void) __GNUTLS_PURE__;
1469 const gnutls_pk_algorithm_t *gnutls_pk_list(void) __GNUTLS_PURE__;
1470 const gnutls_sign_algorithm_t *gnutls_sign_list(void) __GNUTLS_PURE__;
1471 const char *gnutls_cipher_suite_info(size_t idx, unsigned char *cs_id,
1472                      gnutls_kx_algorithm_t *kx,
1473                      gnutls_cipher_algorithm_t *cipher,
1474                      gnutls_mac_algorithm_t *mac,
1475                      gnutls_protocol_t *min_version);
1476
1477 /* functions for run-time enablement of algorithms */
1478 int gnutls_ecc_curve_set_enabled(gnutls_ecc_curve_t curve,
1479                  unsigned int enabled);
1480 int gnutls_sign_set_secure(gnutls_sign_algorithm_t sign, unsigned int secure);
1481 int gnutls_sign_set_secure_for_certs(gnutls_sign_algorithm_t sign,
1482                      unsigned int secure);
1483 int gnutls_digest_set_secure(gnutls_digest_algorithm_t dig,
1484                  unsigned int secure);
1485 int gnutls_protocol_set_enabled(gnutls_protocol_t version,
1486                 unsigned int enabled);
1487
1488 /* error functions */
1489 int gnutls_error_is_fatal(int error) __GNUTLS_CONST__;
1490 int gnutls_error_to_alert(int err, int *level);
1491
1492 void gnutls_perror(int error);
1493 const char *gnutls_strerror(int error) __GNUTLS_CONST__;
1494 const char *gnutls_strerror_name(int error) __GNUTLS_CONST__;
1495
1496 /* Semi-internal functions.
1497  */
1498 void gnutls_handshake_set_private_extensions(gnutls_session_t session,
1499                          int allow);
1500 int gnutls_handshake_set_random(gnutls_session_t session,
1501                 const gnutls_datum_t *random);
1502
1503 gnutls_handshake_description_t
1504 gnutls_handshake_get_last_out(gnutls_session_t session);
1505 gnutls_handshake_description_t
1506 gnutls_handshake_get_last_in(gnutls_session_t session);
1507
1508 /* Record layer functions.
1509  */
1510 #define GNUTLS_HEARTBEAT_WAIT 1
1511 int gnutls_heartbeat_ping(gnutls_session_t session, size_t data_size,
1512               unsigned int max_tries, unsigned int flags);
1513 int gnutls_heartbeat_pong(gnutls_session_t session, unsigned int flags);
1514
1515 void gnutls_record_set_timeout(gnutls_session_t session, unsigned int ms);
1516 void gnutls_record_disable_padding(gnutls_session_t session);
1517
1518 void gnutls_record_cork(gnutls_session_t session);
1519 #define GNUTLS_RECORD_WAIT 1
1520 int gnutls_record_uncork(gnutls_session_t session, unsigned int flags);
1521 size_t gnutls_record_discard_queued(gnutls_session_t session);
1522
1523 int gnutls_record_get_state(gnutls_session_t session, unsigned read,
1524                 gnutls_datum_t *mac_key, gnutls_datum_t *IV,
1525                 gnutls_datum_t *cipher_key,
1526                 unsigned char seq_number[8]);
1527
1528 int gnutls_record_set_state(gnutls_session_t session, unsigned read,
1529                 const unsigned char seq_number[8]);
1530
1531 typedef struct {
1532     size_t low;
1533     size_t high;
1534 } gnutls_range_st;
1535
1536 int gnutls_range_split(gnutls_session_t session, const gnutls_range_st *orig,
1537                gnutls_range_st *small_range,
1538                gnutls_range_st *rem_range);
1539
1540 ssize_t gnutls_record_send(gnutls_session_t session, const void *data,
1541                size_t data_size);
1542 ssize_t gnutls_record_send2(gnutls_session_t session, const void *data,
1543                 size_t data_size, size_t pad, unsigned flags);
1544 ssize_t gnutls_record_send_range(gnutls_session_t session, const void *data,
1545                  size_t data_size,
1546                  const gnutls_range_st *range);
1547 ssize_t gnutls_record_send_file(gnutls_session_t session, int fd, off_t *offset,
1548                 size_t count);
1549 ssize_t gnutls_record_recv(gnutls_session_t session, void *data,
1550                size_t data_size);
1551
1552 typedef struct mbuffer_st *gnutls_packet_t;
1553
1554 ssize_t gnutls_record_recv_packet(gnutls_session_t session,
1555                   gnutls_packet_t *packet);
1556
1557 void gnutls_packet_get(gnutls_packet_t packet, gnutls_datum_t *data,
1558                unsigned char *sequence);
1559 void gnutls_packet_deinit(gnutls_packet_t packet);
1560
1561 #define gnutls_read gnutls_record_recv
1562 #define gnutls_write gnutls_record_send
1563 ssize_t gnutls_record_recv_seq(gnutls_session_t session, void *data,
1564                    size_t data_size, unsigned char *seq);
1565
1566 size_t gnutls_record_overhead_size(gnutls_session_t session);
1567
1568 size_t gnutls_est_record_overhead_size(gnutls_protocol_t version,
1569                        gnutls_cipher_algorithm_t cipher,
1570                        gnutls_mac_algorithm_t mac,
1571                        gnutls_compression_method_t comp,
1572                        unsigned int flags) __GNUTLS_CONST__;
1573
1574 void gnutls_session_enable_compatibility_mode(gnutls_session_t session);
1575 #define gnutls_record_set_max_empty_records(session, x)
1576
1577 unsigned gnutls_record_can_use_length_hiding(gnutls_session_t session);
1578
1579 int gnutls_record_get_direction(gnutls_session_t session);
1580
1581 size_t gnutls_record_get_max_size(gnutls_session_t session);
1582 ssize_t gnutls_record_set_max_size(gnutls_session_t session, size_t size);
1583 ssize_t gnutls_record_set_max_recv_size(gnutls_session_t session, size_t size);
1584
1585 size_t gnutls_record_check_pending(gnutls_session_t session);
1586 size_t gnutls_record_check_corked(gnutls_session_t session);
1587
1588 size_t gnutls_record_get_max_early_data_size(gnutls_session_t session);
1589 int gnutls_record_set_max_early_data_size(gnutls_session_t session,
1590                       size_t size);
1591 ssize_t gnutls_record_send_early_data(gnutls_session_t session,
1592                       const void *data, size_t length);
1593 ssize_t gnutls_record_recv_early_data(gnutls_session_t session, void *data,
1594                       size_t data_size);
1595
1596 void gnutls_session_force_valid(gnutls_session_t session);
1597
1598 int gnutls_prf(gnutls_session_t session, size_t label_size, const char *label,
1599            int server_random_first, size_t extra_size, const char *extra,
1600            size_t outsize, char *out);
1601 int gnutls_prf_rfc5705(gnutls_session_t session, size_t label_size,
1602                const char *label, size_t context_size,
1603                const char *context, size_t outsize, char *out);
1604 int gnutls_prf_early(gnutls_session_t session, size_t label_size,
1605              const char *label, size_t context_size,
1606              const char *context, size_t outsize, char *out);
1607
1608 int gnutls_prf_raw(gnutls_session_t session, size_t label_size,
1609            const char *label, size_t seed_size, const char *seed,
1610            size_t outsize, char *out);
1611
1612 /**
1613  * gnutls_server_name_type_t:
1614  * @GNUTLS_NAME_DNS: Domain Name System name type.
1615  *
1616  * Enumeration of different server name types.
1617  */
1618 typedef enum {
1619     GNUTLS_NAME_DNS = 1
1620 } gnutls_server_name_type_t;
1621
1622 int gnutls_server_name_set(gnutls_session_t session,
1623                gnutls_server_name_type_t type, const void *name,
1624                size_t name_length);
1625
1626 int gnutls_server_name_get(gnutls_session_t session, void *data,
1627                size_t *data_length, unsigned int *type,
1628                unsigned int indx);
1629
1630 unsigned int gnutls_heartbeat_get_timeout(gnutls_session_t session);
1631 void gnutls_heartbeat_set_timeouts(gnutls_session_t session,
1632                    unsigned int retrans_timeout,
1633                    unsigned int total_timeout);
1634
1635 #define GNUTLS_HB_PEER_ALLOWED_TO_SEND (1)
1636 #define GNUTLS_HB_PEER_NOT_ALLOWED_TO_SEND (1 << 1)
1637
1638 /* Heartbeat */
1639 void gnutls_heartbeat_enable(gnutls_session_t session, unsigned int type);
1640
1641 #define GNUTLS_HB_LOCAL_ALLOWED_TO_SEND (1 << 2)
1642 unsigned gnutls_heartbeat_allowed(gnutls_session_t session, unsigned int type);
1643
1644 /* Safe renegotiation */
1645 unsigned gnutls_safe_renegotiation_status(gnutls_session_t session);
1646 unsigned gnutls_session_ext_master_secret_status(gnutls_session_t session);
1647 unsigned gnutls_session_etm_status(gnutls_session_t session);
1648
1649 /**
1650  * gnutls_session_flags_t:
1651  * @GNUTLS_SFLAGS_SAFE_RENEGOTIATION: Safe renegotiation (RFC5746) was used
1652  * @GNUTLS_SFLAGS_EXT_MASTER_SECRET: The extended master secret (RFC7627) extension was used
1653  * @GNUTLS_SFLAGS_ETM: The encrypt then MAC (RFC7366) extension was used
1654  * @GNUTLS_SFLAGS_RFC7919: The RFC7919 Diffie-Hellman parameters were negotiated
1655  * @GNUTLS_SFLAGS_HB_LOCAL_SEND: The heartbeat negotiation allows the local side to send heartbeat messages
1656  * @GNUTLS_SFLAGS_HB_PEER_SEND: The heartbeat negotiation allows the peer to send heartbeat messages
1657  * @GNUTLS_SFLAGS_FALSE_START: False start was used in this client session.
1658  * @GNUTLS_SFLAGS_SESSION_TICKET: A session ticket has been received by the server.
1659  * @GNUTLS_SFLAGS_POST_HANDSHAKE_AUTH: Indicates client capability for post-handshake auth; set only on server side.
1660  * @GNUTLS_SFLAGS_EARLY_START: The TLS1.3 server session returned early.
1661  * @GNUTLS_SFLAGS_EARLY_DATA: The TLS1.3 early data has been received by the server.
1662  * @GNUTLS_SFLAGS_CLI_REQUESTED_OCSP: Set when the client has requested OCSP staple during handshake.
1663  * @GNUTLS_SFLAGS_SERV_REQUESTED_OCSP: Set when the server has requested OCSP staple during handshake.
1664  *
1665  * Enumeration of different session parameters.
1666  */
1667 typedef enum {
1668     GNUTLS_SFLAGS_SAFE_RENEGOTIATION = 1,
1669     GNUTLS_SFLAGS_EXT_MASTER_SECRET = 1 << 1,
1670     GNUTLS_SFLAGS_ETM = 1 << 2,
1671     GNUTLS_SFLAGS_HB_LOCAL_SEND = 1 << 3,
1672     GNUTLS_SFLAGS_HB_PEER_SEND = 1 << 4,
1673     GNUTLS_SFLAGS_FALSE_START = 1 << 5,
1674     GNUTLS_SFLAGS_RFC7919 = 1 << 6,
1675     GNUTLS_SFLAGS_SESSION_TICKET = 1 << 7,
1676     GNUTLS_SFLAGS_POST_HANDSHAKE_AUTH = 1 << 8,
1677     GNUTLS_SFLAGS_EARLY_START = 1 << 9,
1678     GNUTLS_SFLAGS_EARLY_DATA = 1 << 10,
1679     GNUTLS_SFLAGS_CLI_REQUESTED_OCSP = 1 << 11,
1680     GNUTLS_SFLAGS_SERV_REQUESTED_OCSP = 1 << 12
1681 } gnutls_session_flags_t;
1682
1683 unsigned gnutls_session_get_flags(gnutls_session_t session);
1684
1685 /**
1686  * gnutls_supplemental_data_format_type_t:
1687  * @GNUTLS_SUPPLEMENTAL_UNKNOWN: Unknown data format
1688  *
1689  * Enumeration of different supplemental data types (RFC 4680).
1690  */
1691 typedef enum {
1692     GNUTLS_SUPPLEMENTAL_UNKNOWN = 0,
1693 } gnutls_supplemental_data_format_type_t;
1694
1695 const char *
1696 gnutls_supplemental_get_name(gnutls_supplemental_data_format_type_t type);
1697
1698 /* SessionTicket, RFC 5077. */
1699 int gnutls_session_ticket_key_generate(gnutls_datum_t *key);
1700 int gnutls_session_ticket_enable_client(gnutls_session_t session);
1701 int gnutls_session_ticket_enable_server(gnutls_session_t session,
1702                     const gnutls_datum_t *key);
1703
1704 int gnutls_session_ticket_send(gnutls_session_t session, unsigned nr,
1705                    unsigned flags);
1706
1707 /* SRTP, RFC 5764 */
1708
1709 /**
1710  * gnutls_srtp_profile_t:
1711  * @GNUTLS_SRTP_AES128_CM_HMAC_SHA1_80: 128 bit AES with a 80 bit HMAC-SHA1
1712  * @GNUTLS_SRTP_AES128_CM_HMAC_SHA1_32: 128 bit AES with a 32 bit HMAC-SHA1
1713  * @GNUTLS_SRTP_NULL_HMAC_SHA1_80: NULL cipher with a 80 bit HMAC-SHA1
1714  * @GNUTLS_SRTP_NULL_HMAC_SHA1_32: NULL cipher with a 32 bit HMAC-SHA1
1715  * @GNUTLS_SRTP_AEAD_AES_128_GCM: 128 bit AES with GCM
1716  * @GNUTLS_SRTP_AEAD_AES_256_GCM: 256 bit AES with GCM
1717  *
1718  * Enumeration of different SRTP protection profiles.
1719  */
1720 typedef enum {
1721     GNUTLS_SRTP_AES128_CM_HMAC_SHA1_80 = 0x0001,
1722     GNUTLS_SRTP_AES128_CM_HMAC_SHA1_32 = 0x0002,
1723     GNUTLS_SRTP_NULL_HMAC_SHA1_80 = 0x0005,
1724     GNUTLS_SRTP_NULL_HMAC_SHA1_32 = 0x0006,
1725     GNUTLS_SRTP_AEAD_AES_128_GCM = 0x0007,
1726     GNUTLS_SRTP_AEAD_AES_256_GCM = 0x0008
1727 } gnutls_srtp_profile_t;
1728
1729 int gnutls_srtp_set_profile(gnutls_session_t session,
1730                 gnutls_srtp_profile_t profile);
1731 int gnutls_srtp_set_profile_direct(gnutls_session_t session,
1732                    const char *profiles, const char **err_pos);
1733 int gnutls_srtp_get_selected_profile(gnutls_session_t session,
1734                      gnutls_srtp_profile_t *profile);
1735
1736 const char *gnutls_srtp_get_profile_name(gnutls_srtp_profile_t profile);
1737 int gnutls_srtp_get_profile_id(const char *name,
1738                    gnutls_srtp_profile_t *profile);
1739 int gnutls_srtp_get_keys(gnutls_session_t session, void *key_material,
1740              unsigned int key_material_size,
1741              gnutls_datum_t *client_key,
1742              gnutls_datum_t *client_salt,
1743              gnutls_datum_t *server_key,
1744              gnutls_datum_t *server_salt);
1745
1746 int gnutls_srtp_set_mki(gnutls_session_t session, const gnutls_datum_t *mki);
1747 int gnutls_srtp_get_mki(gnutls_session_t session, gnutls_datum_t *mki);
1748
1749 /* COMPRESS_CERTIFICATE extension, RFC8879 */
1750 gnutls_compression_method_t
1751 gnutls_compress_certificate_get_selected_method(gnutls_session_t session);
1752 int gnutls_compress_certificate_set_methods(
1753     gnutls_session_t session, const gnutls_compression_method_t *methods,
1754     size_t methods_len);
1755
1756 /* ALPN TLS extension */
1757
1758 /**
1759  * gnutls_alpn_flags_t:
1760  * @GNUTLS_ALPN_MANDATORY: Require ALPN negotiation. The connection will be
1761  *   aborted if no matching ALPN protocol is found.
1762  * @GNUTLS_ALPN_SERVER_PRECEDENCE: The choices set by the server
1763  *   will take precedence over the client's.
1764  *
1765  * Enumeration of different ALPN flags. These are used by gnutls_alpn_set_protocols().
1766  */
1767 typedef enum {
1768     GNUTLS_ALPN_MANDATORY = 1,
1769     GNUTLS_ALPN_SERVER_PRECEDENCE = (1 << 1)
1770 } gnutls_alpn_flags_t;
1771
1772 #define GNUTLS_ALPN_MAND GNUTLS_ALPN_MANDATORY
1773 int gnutls_alpn_get_selected_protocol(gnutls_session_t session,
1774                       gnutls_datum_t *protocol);
1775 int gnutls_alpn_set_protocols(gnutls_session_t session,
1776                   const gnutls_datum_t *protocols,
1777                   unsigned protocols_size, unsigned flags);
1778
1779 int gnutls_key_generate(gnutls_datum_t *key, unsigned int key_size);
1780
1781 #define GNUTLS_PRIORITY_INIT_DEF_APPEND 1
1782 int gnutls_priority_init(gnutls_priority_t *priority_cache,
1783              const char *priorities, const char **err_pos);
1784 int gnutls_priority_init2(gnutls_priority_t *priority_cache,
1785               const char *priorities, const char **err_pos,
1786               unsigned flags);
1787 void gnutls_priority_deinit(gnutls_priority_t priority_cache);
1788 int gnutls_priority_get_cipher_suite_index(gnutls_priority_t pcache,
1789                        unsigned int idx,
1790                        unsigned int *sidx);
1791
1792 #define GNUTLS_PRIORITY_LIST_INIT_KEYWORDS 1
1793 #define GNUTLS_PRIORITY_LIST_SPECIAL 2
1794 const char *gnutls_priority_string_list(unsigned iter, unsigned int flags);
1795
1796 int gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority);
1797
1798 int gnutls_priority_set_direct(gnutls_session_t session, const char *priorities,
1799                    const char **err_pos);
1800
1801 int gnutls_priority_certificate_type_list(gnutls_priority_t pcache,
1802                       const unsigned int **list);
1803 int gnutls_priority_certificate_type_list2(gnutls_priority_t pcache,
1804                        const unsigned int **list,
1805                        gnutls_ctype_target_t target);
1806 int gnutls_priority_sign_list(gnutls_priority_t pcache,
1807                   const unsigned int **list);
1808 int gnutls_priority_protocol_list(gnutls_priority_t pcache,
1809                   const unsigned int **list);
1810 int gnutls_priority_ecc_curve_list(gnutls_priority_t pcache,
1811                    const unsigned int **list);
1812 int gnutls_priority_group_list(gnutls_priority_t pcache,
1813                    const unsigned int **list);
1814
1815 int gnutls_priority_kx_list(gnutls_priority_t pcache,
1816                 const unsigned int **list);
1817 int gnutls_priority_cipher_list(gnutls_priority_t pcache,
1818                 const unsigned int **list);
1819 int gnutls_priority_mac_list(gnutls_priority_t pcache,
1820                  const unsigned int **list);
1821
1822 const char *gnutls_get_system_config_file(void);
1823
1824 int gnutls_set_default_priority(gnutls_session_t session);
1825 int gnutls_set_default_priority_append(gnutls_session_t session,
1826                        const char *add_prio,
1827                        const char **err_pos, unsigned flags);
1828
1829 /* Returns the name of a cipher suite */
1830 const char *gnutls_cipher_suite_get_name(
1831     gnutls_kx_algorithm_t kx_algorithm,
1832     gnutls_cipher_algorithm_t cipher_algorithm,
1833     gnutls_mac_algorithm_t mac_algorithm) __GNUTLS_CONST__;
1834
1835 const char *gnutls_ciphersuite_get(gnutls_session_t session) __GNUTLS_CONST__;
1836
1837 /* get the currently used protocol version */
1838 gnutls_protocol_t gnutls_protocol_get_version(gnutls_session_t session);
1839
1840 const char *
1841 gnutls_protocol_get_name(gnutls_protocol_t version) __GNUTLS_CONST__;
1842
1843 /* get/set session
1844  */
1845 int gnutls_session_set_data(gnutls_session_t session, const void *session_data,
1846                 size_t session_data_size);
1847 int gnutls_session_get_data(gnutls_session_t session, void *session_data,
1848                 size_t *session_data_size);
1849 int gnutls_session_get_data2(gnutls_session_t session, gnutls_datum_t *data);
1850 void gnutls_session_get_random(gnutls_session_t session, gnutls_datum_t *client,
1851                    gnutls_datum_t *server);
1852
1853 void gnutls_session_get_master_secret(gnutls_session_t session,
1854                       gnutls_datum_t *secret);
1855
1856 char *gnutls_session_get_desc(gnutls_session_t session);
1857
1858 typedef int gnutls_certificate_verify_function(gnutls_session_t);
1859 void gnutls_session_set_verify_function(
1860     gnutls_session_t session, gnutls_certificate_verify_function *func);
1861
1862 /**
1863  * gnutls_vdata_types_t:
1864  * @GNUTLS_DT_UNKNOWN: Unknown data type.
1865  * @GNUTLS_DT_DNS_HOSTNAME: The data contain a null-terminated DNS hostname; the hostname will be
1866  *   matched using the RFC6125 rules. If the data contain a textual IP (v4 or v6) address it will
1867  *   be marched against the IPAddress Alternative name, unless the verification flag %GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES
1868  *   is specified.
1869  * @GNUTLS_DT_IP_ADDRESS: The data contain a raw IP address (4 or 16 bytes). If will be matched
1870  *   against the IPAddress Alternative name; option available since 3.6.0.
1871  * @GNUTLS_DT_RFC822NAME: The data contain a null-terminated email address; the email will be
1872  *   matched against the RFC822Name Alternative name of the certificate, or the EMAIL DN component if the
1873  *   former isn't available. Prior to matching the email address will be converted to ACE
1874  *   (ASCII-compatible-encoding).
1875  * @GNUTLS_DT_KEY_PURPOSE_OID: The data contain a null-terminated key purpose OID. It will be matched
1876  *   against the certificate's Extended Key Usage extension.
1877  *
1878  * Enumeration of different typed-data options. They are used as input to certificate
1879  * verification functions to provide information about the name and purpose of the
1880  * certificate. Only a single option of a type can be provided to the relevant functions
1881  * (i.e., options %GNUTLS_DT_DNS_HOSTNAME, %GNUTLS_DT_IP_ADDRESS and
1882  * %GNUTLS_DT_RFC822NAME cannot be combined).
1883  */
1884 typedef enum {
1885     GNUTLS_DT_UNKNOWN = 0,
1886     GNUTLS_DT_DNS_HOSTNAME = 1,
1887     GNUTLS_DT_KEY_PURPOSE_OID = 2,
1888     GNUTLS_DT_RFC822NAME = 3,
1889     GNUTLS_DT_IP_ADDRESS = 4
1890 } gnutls_vdata_types_t;
1891
1892 typedef struct {
1893     gnutls_vdata_types_t type;
1894     unsigned char *data;
1895     unsigned int size;
1896 } gnutls_typed_vdata_st;
1897
1898 void gnutls_session_set_verify_cert(gnutls_session_t session,
1899                     const char *hostname, unsigned flags);
1900
1901 void gnutls_session_set_verify_cert2(gnutls_session_t session,
1902                      gnutls_typed_vdata_st *data,
1903                      unsigned elements, unsigned flags);
1904
1905 unsigned int gnutls_session_get_verify_cert_status(gnutls_session_t);
1906
1907 int gnutls_session_set_premaster(gnutls_session_t session, unsigned int entity,
1908                  gnutls_protocol_t version,
1909                  gnutls_kx_algorithm_t kx,
1910                  gnutls_cipher_algorithm_t cipher,
1911                  gnutls_mac_algorithm_t mac,
1912                  gnutls_compression_method_t comp,
1913                  const gnutls_datum_t *master,
1914                  const gnutls_datum_t *session_id);
1915
1916 /* returns the session ID */
1917 #define GNUTLS_MAX_SESSION_ID 32
1918 int gnutls_session_get_id(gnutls_session_t session, void *session_id,
1919               size_t *session_id_size);
1920 int gnutls_session_get_id2(gnutls_session_t session,
1921                gnutls_datum_t *session_id);
1922
1923 int gnutls_session_set_id(gnutls_session_t session, const gnutls_datum_t *sid);
1924
1925 int gnutls_session_channel_binding(gnutls_session_t session,
1926                    gnutls_channel_binding_t cbtype,
1927                    gnutls_datum_t *cb);
1928
1929 /* checks if this session is a resumed one
1930  */
1931 int gnutls_session_is_resumed(gnutls_session_t session);
1932 int gnutls_session_resumption_requested(gnutls_session_t session);
1933
1934 typedef int (*gnutls_db_store_func)(void *, gnutls_datum_t key,
1935                     gnutls_datum_t data);
1936 typedef int (*gnutls_db_remove_func)(void *, gnutls_datum_t key);
1937 typedef gnutls_datum_t (*gnutls_db_retr_func)(void *, gnutls_datum_t key);
1938
1939 void gnutls_db_set_cache_expiration(gnutls_session_t session, int seconds);
1940 unsigned gnutls_db_get_default_cache_expiration(void);
1941
1942 void gnutls_db_remove_session(gnutls_session_t session);
1943 void gnutls_db_set_retrieve_function(gnutls_session_t session,
1944                      gnutls_db_retr_func retr_func);
1945 void gnutls_db_set_remove_function(gnutls_session_t session,
1946                    gnutls_db_remove_func rem_func);
1947 void gnutls_db_set_store_function(gnutls_session_t session,
1948                   gnutls_db_store_func store_func);
1949 void gnutls_db_set_ptr(gnutls_session_t session, void *ptr);
1950 void *gnutls_db_get_ptr(gnutls_session_t session);
1951 int gnutls_db_check_entry(gnutls_session_t session,
1952               gnutls_datum_t session_entry);
1953 time_t gnutls_db_check_entry_time(gnutls_datum_t *entry);
1954 time_t gnutls_db_check_entry_expire_time(gnutls_datum_t *entry);
1955
1956 #define GNUTLS_HOOK_POST (1)
1957 #define GNUTLS_HOOK_PRE (0)
1958 #define GNUTLS_HOOK_BOTH (-1)
1959
1960 /**
1961  * gnutls_handshake_hook_func:
1962  * @session: the current session
1963  * @htype: the type of the handshake message (%gnutls_handshake_description_t)
1964  * @when: non zero if this is a post-process/generation call and zero otherwise
1965  * @incoming: non zero if this is an incoming message and zero if this is an outgoing message
1966  * @msg: the (const) data of the handshake message without the handshake headers.
1967  *
1968  * Function prototype for handshake hooks. It is set using
1969  * gnutls_handshake_set_hook_function().
1970  *
1971  * Returns: Non zero on error.
1972  */
1973 typedef int (*gnutls_handshake_hook_func)(gnutls_session_t, unsigned int htype,
1974                       unsigned when, unsigned int incoming,
1975                       const gnutls_datum_t *msg);
1976 void gnutls_handshake_set_hook_function(gnutls_session_t session,
1977                     unsigned int htype, int when,
1978                     gnutls_handshake_hook_func func);
1979
1980 #define gnutls_handshake_post_client_hello_func \
1981     gnutls_handshake_simple_hook_func
1982 typedef int (*gnutls_handshake_simple_hook_func)(gnutls_session_t);
1983 void gnutls_handshake_set_post_client_hello_function(
1984     gnutls_session_t session, gnutls_handshake_simple_hook_func func);
1985
1986 void gnutls_handshake_set_max_packet_length(gnutls_session_t session,
1987                         size_t max);
1988
1989 /* returns libgnutls version (call it with a NULL argument)
1990  */
1991 const char *gnutls_check_version(const char *req_version) __GNUTLS_CONST__;
1992
1993 /* A macro which will allow optimizing out calls to gnutls_check_version()
1994  * when the version being compiled with is sufficient.
1995  * Used as:
1996  *   if (gnutls_check_version_numerc(3,3,16)) {
1997  */
1998 #define gnutls_check_version_numeric(a, b, c)                            \
1999     ((GNUTLS_VERSION_MAJOR >= (a)) &&                                \
2000      ((GNUTLS_VERSION_NUMBER >= (((a) << 16) + ((b) << 8) + (c))) || \
2001       gnutls_check_version(#a "." #b "." #c)))
2002
2003 /* Functions for setting/clearing credentials
2004  */
2005 void gnutls_credentials_clear(gnutls_session_t session);
2006
2007 /* cred is a structure defined by the kx algorithm
2008  */
2009 int gnutls_credentials_set(gnutls_session_t session,
2010                gnutls_credentials_type_t type, void *cred);
2011 int gnutls_credentials_get(gnutls_session_t session,
2012                gnutls_credentials_type_t type, void **cred);
2013 #define gnutls_cred_set gnutls_credentials_set
2014
2015 /* x.509 types */
2016
2017 struct gnutls_pubkey_st;
2018 typedef struct gnutls_pubkey_st *gnutls_pubkey_t;
2019
2020 struct gnutls_privkey_st;
2021 typedef struct gnutls_privkey_st *gnutls_privkey_t;
2022
2023 struct gnutls_x509_privkey_int;
2024 typedef struct gnutls_x509_privkey_int *gnutls_x509_privkey_t;
2025
2026 struct gnutls_x509_crl_int;
2027 typedef struct gnutls_x509_crl_int *gnutls_x509_crl_t;
2028
2029 struct gnutls_x509_crt_int;
2030 typedef struct gnutls_x509_crt_int *gnutls_x509_crt_t;
2031
2032 struct gnutls_x509_crq_int;
2033 typedef struct gnutls_x509_crq_int *gnutls_x509_crq_t;
2034
2035 struct gnutls_openpgp_keyring_int;
2036 typedef struct gnutls_openpgp_keyring_int *gnutls_openpgp_keyring_t;
2037
2038 /* Credential structures - used in gnutls_credentials_set(); */
2039
2040 struct gnutls_certificate_credentials_st;
2041 typedef struct gnutls_certificate_credentials_st
2042     *gnutls_certificate_credentials_t;
2043 typedef gnutls_certificate_credentials_t gnutls_certificate_server_credentials;
2044 typedef gnutls_certificate_credentials_t gnutls_certificate_client_credentials;
2045
2046 typedef struct gnutls_anon_server_credentials_st
2047     *gnutls_anon_server_credentials_t;
2048 typedef struct gnutls_anon_client_credentials_st
2049     *gnutls_anon_client_credentials_t;
2050
2051 void gnutls_anon_free_server_credentials(gnutls_anon_server_credentials_t sc);
2052 int gnutls_anon_allocate_server_credentials(
2053     gnutls_anon_server_credentials_t *sc);
2054
2055 void gnutls_anon_set_server_dh_params(gnutls_anon_server_credentials_t res,
2056                       gnutls_dh_params_t dh_params);
2057
2058 int gnutls_anon_set_server_known_dh_params(gnutls_anon_server_credentials_t res,
2059                        gnutls_sec_param_t sec_param);
2060
2061 void gnutls_anon_set_server_params_function(
2062     gnutls_anon_server_credentials_t res, gnutls_params_function *func);
2063
2064 void gnutls_anon_free_client_credentials(gnutls_anon_client_credentials_t sc);
2065 int gnutls_anon_allocate_client_credentials(
2066     gnutls_anon_client_credentials_t *sc);
2067
2068 /* CERTFILE is an x509 certificate in PEM form.
2069  * KEYFILE is a pkcs-1 private key in PEM form (for RSA keys).
2070  */
2071 void gnutls_certificate_free_credentials(gnutls_certificate_credentials_t sc);
2072 int gnutls_certificate_allocate_credentials(
2073     gnutls_certificate_credentials_t *res);
2074
2075 int gnutls_certificate_get_issuer(gnutls_certificate_credentials_t sc,
2076                   gnutls_x509_crt_t cert,
2077                   gnutls_x509_crt_t *issuer,
2078                   unsigned int flags);
2079
2080 int gnutls_certificate_get_crt_raw(gnutls_certificate_credentials_t sc,
2081                    unsigned idx1, unsigned idx2,
2082                    gnutls_datum_t *cert);
2083
2084 void gnutls_certificate_free_keys(gnutls_certificate_credentials_t sc);
2085 void gnutls_certificate_free_cas(gnutls_certificate_credentials_t sc);
2086 void gnutls_certificate_free_ca_names(gnutls_certificate_credentials_t sc);
2087 void gnutls_certificate_free_crls(gnutls_certificate_credentials_t sc);
2088
2089 void gnutls_certificate_set_dh_params(gnutls_certificate_credentials_t res,
2090                       gnutls_dh_params_t dh_params);
2091
2092 int gnutls_certificate_set_known_dh_params(gnutls_certificate_credentials_t res,
2093                        gnutls_sec_param_t sec_param);
2094 void gnutls_certificate_set_verify_flags(gnutls_certificate_credentials_t res,
2095                      unsigned int flags);
2096 unsigned int
2097 gnutls_certificate_get_verify_flags(gnutls_certificate_credentials_t res);
2098
2099 /**
2100  * gnutls_certificate_flags:
2101  * @GNUTLS_CERTIFICATE_SKIP_KEY_CERT_MATCH: Skip the key and certificate matching check.
2102  * @GNUTLS_CERTIFICATE_API_V2: If set the gnutls_certificate_set_*key* functions will return an index of the added key pair instead of zero.
2103  * @GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK: If set, the gnutls_certificate_set_ocsp_status_request_file
2104  *    function, will not check whether the response set matches any of the certificates.
2105  * @GNUTLS_CERTIFICATE_VERIFY_CRLS: This will enable CRL verification when added in the certificate structure.
2106  *    When used, it requires CAs to be added before CRLs.
2107  *
2108  * Enumeration of different certificate credentials flags.
2109  */
2110 typedef enum gnutls_certificate_flags {
2111     GNUTLS_CERTIFICATE_SKIP_KEY_CERT_MATCH = 1,
2112     GNUTLS_CERTIFICATE_API_V2 = (1 << 1),
2113     GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK = (1 << 2),
2114     GNUTLS_CERTIFICATE_VERIFY_CRLS = (1 << 3)
2115 } gnutls_certificate_flags;
2116
2117 void gnutls_certificate_set_flags(gnutls_certificate_credentials_t,
2118                   unsigned flags);
2119
2120 void gnutls_certificate_set_verify_limits(gnutls_certificate_credentials_t res,
2121                       unsigned int max_bits,
2122                       unsigned int max_depth);
2123
2124 int gnutls_certificate_set_x509_system_trust(
2125     gnutls_certificate_credentials_t cred);
2126
2127 int gnutls_certificate_set_x509_trust_file(gnutls_certificate_credentials_t cred,
2128                        const char *cafile,
2129                        gnutls_x509_crt_fmt_t type);
2130 int gnutls_certificate_set_x509_trust_dir(gnutls_certificate_credentials_t cred,
2131                       const char *ca_dir,
2132                       gnutls_x509_crt_fmt_t type);
2133
2134 int gnutls_certificate_set_x509_trust_mem(gnutls_certificate_credentials_t res,
2135                       const gnutls_datum_t *ca,
2136                       gnutls_x509_crt_fmt_t type);
2137
2138 int gnutls_certificate_set_x509_crl_file(gnutls_certificate_credentials_t res,
2139                      const char *crlfile,
2140                      gnutls_x509_crt_fmt_t type);
2141 int gnutls_certificate_set_x509_crl_mem(gnutls_certificate_credentials_t res,
2142                     const gnutls_datum_t *CRL,
2143                     gnutls_x509_crt_fmt_t type);
2144
2145 int gnutls_certificate_set_x509_key_file(gnutls_certificate_credentials_t res,
2146                      const char *certfile,
2147                      const char *keyfile,
2148                      gnutls_x509_crt_fmt_t type);
2149
2150 int gnutls_certificate_set_x509_key_file2(gnutls_certificate_credentials_t res,
2151                       const char *certfile,
2152                       const char *keyfile,
2153                       gnutls_x509_crt_fmt_t type,
2154                       const char *pass, unsigned int flags);
2155
2156 int gnutls_certificate_set_x509_key_mem(gnutls_certificate_credentials_t res,
2157                     const gnutls_datum_t *cert,
2158                     const gnutls_datum_t *key,
2159                     gnutls_x509_crt_fmt_t type);
2160
2161 int gnutls_certificate_set_x509_key_mem2(gnutls_certificate_credentials_t res,
2162                      const gnutls_datum_t *cert,
2163                      const gnutls_datum_t *key,
2164                      gnutls_x509_crt_fmt_t type,
2165                      const char *pass, unsigned int flags);
2166
2167 void gnutls_certificate_send_x509_rdn_sequence(gnutls_session_t session,
2168                            int status);
2169
2170 int gnutls_certificate_set_x509_simple_pkcs12_file(
2171     gnutls_certificate_credentials_t res, const char *pkcs12file,
2172     gnutls_x509_crt_fmt_t type, const char *password);
2173 int gnutls_certificate_set_x509_simple_pkcs12_mem(
2174     gnutls_certificate_credentials_t res, const gnutls_datum_t *p12blob,
2175     gnutls_x509_crt_fmt_t type, const char *password);
2176
2177 /* New functions to allow setting already parsed X.509 stuff.
2178  */
2179
2180 int gnutls_certificate_set_x509_key(gnutls_certificate_credentials_t res,
2181                     gnutls_x509_crt_t *cert_list,
2182                     int cert_list_size,
2183                     gnutls_x509_privkey_t key);
2184 int gnutls_certificate_set_x509_trust(gnutls_certificate_credentials_t res,
2185                       gnutls_x509_crt_t *ca_list,
2186                       int ca_list_size);
2187 int gnutls_certificate_set_x509_crl(gnutls_certificate_credentials_t res,
2188                     gnutls_x509_crl_t *crl_list,
2189                     int crl_list_size);
2190
2191 int gnutls_certificate_get_x509_key(gnutls_certificate_credentials_t res,
2192                     unsigned index, gnutls_x509_privkey_t *key);
2193 int gnutls_certificate_get_x509_crt(gnutls_certificate_credentials_t res,
2194                     unsigned index,
2195                     gnutls_x509_crt_t **crt_list,
2196                     unsigned *crt_list_size);
2197
2198 /* OCSP status request extension, RFC 6066 */
2199 typedef int (*gnutls_status_request_ocsp_func)(gnutls_session_t session,
2200                            void *ptr,
2201                            gnutls_datum_t *ocsp_response);
2202
2203 void gnutls_certificate_set_ocsp_status_request_function(
2204     gnutls_certificate_credentials_t res,
2205     gnutls_status_request_ocsp_func ocsp_func, void *ptr);
2206
2207 int gnutls_certificate_set_ocsp_status_request_function2(
2208     gnutls_certificate_credentials_t res, unsigned idx,
2209     gnutls_status_request_ocsp_func ocsp_func, void *ptr);
2210
2211 int gnutls_certificate_set_ocsp_status_request_file(
2212     gnutls_certificate_credentials_t res, const char *response_file,
2213     unsigned idx);
2214
2215 int gnutls_certificate_set_ocsp_status_request_file2(
2216     gnutls_certificate_credentials_t res, const char *response_file,
2217     unsigned idx, gnutls_x509_crt_fmt_t fmt);
2218
2219 int gnutls_certificate_set_ocsp_status_request_mem(
2220     gnutls_certificate_credentials_t res, const gnutls_datum_t *resp,
2221     unsigned idx, gnutls_x509_crt_fmt_t fmt);
2222
2223 typedef struct gnutls_ocsp_data_st {
2224     unsigned int version; /* must be zero */
2225     gnutls_datum_t response;
2226     time_t exptime;
2227     unsigned char padding[32];
2228 } gnutls_ocsp_data_st;
2229
2230 time_t
2231 gnutls_certificate_get_ocsp_expiration(gnutls_certificate_credentials_t sc,
2232                        unsigned idx, int oidx, unsigned flags);
2233
2234 int gnutls_ocsp_status_request_enable_client(
2235     gnutls_session_t session, gnutls_datum_t *responder_id,
2236     size_t responder_id_size, gnutls_datum_t *request_extensions);
2237
2238 int gnutls_ocsp_status_request_get(gnutls_session_t session,
2239                    gnutls_datum_t *response);
2240
2241 #define GNUTLS_OCSP_SR_IS_AVAIL 1
2242 unsigned gnutls_ocsp_status_request_is_checked(gnutls_session_t session,
2243                            unsigned int flags);
2244
2245 int gnutls_ocsp_status_request_get2(gnutls_session_t session, unsigned idx,
2246                     gnutls_datum_t *response);
2247
2248 /* RAW public key functions (RFC7250) */
2249 int gnutls_certificate_set_rawpk_key_mem(
2250     gnutls_certificate_credentials_t cred, const gnutls_datum_t *spki,
2251     const gnutls_datum_t *pkey, gnutls_x509_crt_fmt_t format,
2252     const char *pass, unsigned int key_usage, const char **names,
2253     unsigned int names_length, unsigned int flags);
2254
2255 int gnutls_certificate_set_rawpk_key_file(
2256     gnutls_certificate_credentials_t cred, const char *rawpkfile,
2257     const char *privkeyfile, gnutls_x509_crt_fmt_t format, const char *pass,
2258     unsigned int key_usage, const char **names, unsigned int names_length,
2259     unsigned int privkey_flags, unsigned int pkcs11_flags);
2260
2261 /* global state functions
2262  */
2263 int gnutls_global_init(void);
2264 void gnutls_global_deinit(void);
2265
2266 const gnutls_library_config_st *gnutls_get_library_config(void);
2267
2268 /**
2269  * gnutls_time_func:
2270  * @t: where to store time.
2271  *
2272  * Function prototype for time()-like function.  Set with
2273  * gnutls_global_set_time_function().
2274  *
2275  * Returns: Number of seconds since the epoch, or (time_t)-1 on errors.
2276  */
2277 typedef time_t (*gnutls_time_func)(time_t *t);
2278
2279 typedef int (*mutex_init_func)(void **mutex);
2280 typedef int (*mutex_lock_func)(void **mutex);
2281 typedef int (*mutex_unlock_func)(void **mutex);
2282 typedef int (*mutex_deinit_func)(void **mutex);
2283
2284 void gnutls_global_set_mutex(mutex_init_func init, mutex_deinit_func deinit,
2285                  mutex_lock_func lock, mutex_unlock_func unlock);
2286
2287 typedef void *(*gnutls_alloc_function)(size_t);
2288 typedef void *(*gnutls_calloc_function)(size_t, size_t);
2289 typedef int (*gnutls_is_secure_function)(const void *);
2290 typedef void (*gnutls_free_function)(void *);
2291 typedef void *(*gnutls_realloc_function)(void *, size_t);
2292
2293 void gnutls_global_set_time_function(gnutls_time_func time_func);
2294
2295 /* For use in callbacks */
2296 extern _SYM_EXPORT gnutls_alloc_function gnutls_malloc;
2297 extern _SYM_EXPORT gnutls_realloc_function gnutls_realloc;
2298 extern _SYM_EXPORT gnutls_calloc_function gnutls_calloc;
2299 extern _SYM_EXPORT gnutls_free_function gnutls_free;
2300
2301 #ifdef GNUTLS_INTERNAL_BUILD
2302 #define gnutls_free(a) gnutls_free((void *)(a)), a = NULL
2303 #endif
2304
2305 extern _SYM_EXPORT char *(*gnutls_strdup)(const char *);
2306
2307 /* a variant of memset that doesn't get optimized out */
2308 void gnutls_memset(void *data, int c, size_t size);
2309
2310 /* constant time memcmp */
2311 int gnutls_memcmp(const void *s1, const void *s2, size_t n);
2312
2313 typedef void (*gnutls_log_func)(int, const char *);
2314 typedef void (*gnutls_audit_log_func)(gnutls_session_t, const char *);
2315 void gnutls_global_set_log_function(gnutls_log_func log_func);
2316 void gnutls_global_set_audit_log_function(gnutls_audit_log_func log_func);
2317 void gnutls_global_set_log_level(int level);
2318
2319 /**
2320  * gnutls_keylog_func:
2321  * @session: the current session
2322  * @label: the keylog label
2323  * @secret: the (const) data of the derived secret.
2324  *
2325  * Function prototype for keylog hooks. It is set using
2326  * gnutls_session_set_keylog_function().
2327  *
2328  * Returns: Non zero on error.
2329  * Since: 3.6.13
2330  */
2331 typedef int (*gnutls_keylog_func)(gnutls_session_t session, const char *label,
2332                   const gnutls_datum_t *secret);
2333 gnutls_keylog_func
2334 gnutls_session_get_keylog_function(const gnutls_session_t session);
2335 void gnutls_session_set_keylog_function(gnutls_session_t session,
2336                     gnutls_keylog_func func);
2337
2338 /* Diffie-Hellman parameter handling.
2339  */
2340 int gnutls_dh_params_init(gnutls_dh_params_t *dh_params);
2341 void gnutls_dh_params_deinit(gnutls_dh_params_t dh_params);
2342 int gnutls_dh_params_import_raw(gnutls_dh_params_t dh_params,
2343                 const gnutls_datum_t *prime,
2344                 const gnutls_datum_t *generator);
2345 int gnutls_dh_params_import_dsa(gnutls_dh_params_t dh_params,
2346                 gnutls_x509_privkey_t key);
2347 int gnutls_dh_params_import_raw2(gnutls_dh_params_t dh_params,
2348                  const gnutls_datum_t *prime,
2349                  const gnutls_datum_t *generator,
2350                  unsigned key_bits);
2351 int gnutls_dh_params_import_raw3(gnutls_dh_params_t dh_params,
2352                  const gnutls_datum_t *prime,
2353                  const gnutls_datum_t *q,
2354                  const gnutls_datum_t *generator);
2355 int gnutls_dh_params_import_pkcs3(gnutls_dh_params_t params,
2356                   const gnutls_datum_t *pkcs3_params,
2357                   gnutls_x509_crt_fmt_t format);
2358 int gnutls_dh_params_generate2(gnutls_dh_params_t params, unsigned int bits);
2359 int gnutls_dh_params_export_pkcs3(gnutls_dh_params_t params,
2360                   gnutls_x509_crt_fmt_t format,
2361                   unsigned char *params_data,
2362                   size_t *params_data_size);
2363 int gnutls_dh_params_export2_pkcs3(gnutls_dh_params_t params,
2364                    gnutls_x509_crt_fmt_t format,
2365                    gnutls_datum_t *out);
2366 int gnutls_dh_params_export_raw(gnutls_dh_params_t params,
2367                 gnutls_datum_t *prime,
2368                 gnutls_datum_t *generator, unsigned int *bits);
2369 int gnutls_dh_params_cpy(gnutls_dh_params_t dst, gnutls_dh_params_t src);
2370
2371 /* Session stuff
2372  */
2373 /* clang-format off */
2374 #include <sys/uio.h>
2375 typedef struct iovec giovec_t;
2376     /* clang-format on */
2377
2378     typedef ssize_t (*gnutls_pull_func)(gnutls_transport_ptr_t, void *,
2379                         size_t);
2380 typedef ssize_t (*gnutls_push_func)(gnutls_transport_ptr_t, const void *,
2381                     size_t);
2382
2383 int gnutls_system_recv_timeout(gnutls_transport_ptr_t ptr, unsigned int ms);
2384 typedef int (*gnutls_pull_timeout_func)(gnutls_transport_ptr_t,
2385                     unsigned int ms);
2386
2387 typedef ssize_t (*gnutls_vec_push_func)(gnutls_transport_ptr_t,
2388                     const giovec_t *iov, int iovcnt);
2389
2390 typedef int (*gnutls_errno_func)(gnutls_transport_ptr_t);
2391
2392 #if 0
2393  /* This will be defined as macro. */
2394 void gnutls_transport_set_int(gnutls_session_t session, int r);
2395 #endif
2396
2397 void gnutls_transport_set_int2(gnutls_session_t session, int r, int s);
2398 #define gnutls_transport_set_int(s, i) gnutls_transport_set_int2(s, i, i)
2399
2400 void gnutls_transport_get_int2(gnutls_session_t session, int *r, int *s);
2401 int gnutls_transport_get_int(gnutls_session_t session);
2402
2403 void gnutls_transport_set_ptr(gnutls_session_t session,
2404                   gnutls_transport_ptr_t ptr);
2405 void gnutls_transport_set_ptr2(gnutls_session_t session,
2406                    gnutls_transport_ptr_t recv_ptr,
2407                    gnutls_transport_ptr_t send_ptr);
2408
2409 gnutls_transport_ptr_t gnutls_transport_get_ptr(gnutls_session_t session);
2410 void gnutls_transport_get_ptr2(gnutls_session_t session,
2411                    gnutls_transport_ptr_t *recv_ptr,
2412                    gnutls_transport_ptr_t *send_ptr);
2413
2414 void gnutls_transport_set_vec_push_function(gnutls_session_t session,
2415                         gnutls_vec_push_func vec_func);
2416 void gnutls_transport_set_push_function(gnutls_session_t session,
2417                     gnutls_push_func push_func);
2418 void gnutls_transport_set_pull_function(gnutls_session_t session,
2419                     gnutls_pull_func pull_func);
2420
2421 void gnutls_transport_set_pull_timeout_function(gnutls_session_t session,
2422                         gnutls_pull_timeout_func func);
2423
2424 void gnutls_transport_set_errno_function(gnutls_session_t session,
2425                      gnutls_errno_func errno_func);
2426
2427 void gnutls_transport_set_errno(gnutls_session_t session, int err);
2428
2429 /* session specific
2430  */
2431 void gnutls_session_set_ptr(gnutls_session_t session, void *ptr);
2432 void *gnutls_session_get_ptr(gnutls_session_t session);
2433
2434 void gnutls_openpgp_send_cert(gnutls_session_t session,
2435                   gnutls_openpgp_crt_status_t status);
2436
2437 /* This function returns the hash of the given data.
2438  */
2439 int gnutls_fingerprint(gnutls_digest_algorithm_t algo,
2440                const gnutls_datum_t *data, void *result,
2441                size_t *result_size);
2442
2443 /**
2444  * gnutls_random_art_t:
2445  * @GNUTLS_RANDOM_ART_OPENSSH: OpenSSH-style random art.
2446  *
2447  * Enumeration of different random art types.
2448  */
2449 typedef enum gnutls_random_art {
2450     GNUTLS_RANDOM_ART_OPENSSH = 1
2451 } gnutls_random_art_t;
2452
2453 int gnutls_random_art(gnutls_random_art_t type, const char *key_type,
2454               unsigned int key_size, void *fpr, size_t fpr_size,
2455               gnutls_datum_t *art);
2456
2457 /* IDNA */
2458 #define GNUTLS_IDNA_FORCE_2008 (1 << 1)
2459 int gnutls_idna_map(const char *input, unsigned ilen, gnutls_datum_t *out,
2460             unsigned flags);
2461 int gnutls_idna_reverse_map(const char *input, unsigned ilen,
2462                 gnutls_datum_t *out, unsigned flags);
2463
2464 /* SRP
2465  */
2466
2467 typedef struct gnutls_srp_server_credentials_st *gnutls_srp_server_credentials_t;
2468 typedef struct gnutls_srp_client_credentials_st *gnutls_srp_client_credentials_t;
2469
2470 void gnutls_srp_free_client_credentials(gnutls_srp_client_credentials_t sc);
2471 int gnutls_srp_allocate_client_credentials(gnutls_srp_client_credentials_t *sc);
2472 int gnutls_srp_set_client_credentials(gnutls_srp_client_credentials_t res,
2473                       const char *username,
2474                       const char *password);
2475
2476 void gnutls_srp_free_server_credentials(gnutls_srp_server_credentials_t sc);
2477 int gnutls_srp_allocate_server_credentials(gnutls_srp_server_credentials_t *sc);
2478 int gnutls_srp_set_server_credentials_file(gnutls_srp_server_credentials_t res,
2479                        const char *password_file,
2480                        const char *password_conf_file);
2481
2482 const char *gnutls_srp_server_get_username(gnutls_session_t session);
2483
2484 void gnutls_srp_set_prime_bits(gnutls_session_t session, unsigned int bits);
2485
2486 int gnutls_srp_verifier(const char *username, const char *password,
2487             const gnutls_datum_t *salt,
2488             const gnutls_datum_t *generator,
2489             const gnutls_datum_t *prime, gnutls_datum_t *res);
2490
2491 /* The static parameters defined in draft-ietf-tls-srp-05
2492  * Those should be used as input to gnutls_srp_verifier().
2493  */
2494 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_8192_group_prime;
2495 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_8192_group_generator;
2496
2497 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_4096_group_prime;
2498 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_4096_group_generator;
2499
2500 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_3072_group_prime;
2501 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_3072_group_generator;
2502
2503 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_2048_group_prime;
2504 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_2048_group_generator;
2505
2506 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1536_group_prime;
2507 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1536_group_generator;
2508
2509 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1024_group_prime;
2510 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1024_group_generator;
2511
2512 /* The static parameters defined in rfc7919
2513  */
2514
2515 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_8192_group_prime;
2516 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_8192_group_q;
2517 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_8192_group_generator;
2518 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_8192_key_bits;
2519
2520 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_6144_group_prime;
2521 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_6144_group_q;
2522 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_6144_group_generator;
2523 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_6144_key_bits;
2524
2525 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_4096_group_prime;
2526 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_4096_group_q;
2527 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_4096_group_generator;
2528 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_4096_key_bits;
2529
2530 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_3072_group_prime;
2531 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_3072_group_q;
2532 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_3072_group_generator;
2533 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_3072_key_bits;
2534
2535 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_2048_group_prime;
2536 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_2048_group_q;
2537 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_2048_group_generator;
2538 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_2048_key_bits;
2539
2540 typedef int gnutls_srp_server_credentials_function(gnutls_session_t,
2541                            const char *username,
2542                            gnutls_datum_t *salt,
2543                            gnutls_datum_t *verifier,
2544                            gnutls_datum_t *generator,
2545                            gnutls_datum_t *prime);
2546 void gnutls_srp_set_server_credentials_function(
2547     gnutls_srp_server_credentials_t cred,
2548     gnutls_srp_server_credentials_function *func);
2549
2550 typedef int gnutls_srp_client_credentials_function(gnutls_session_t, char **,
2551                            char **);
2552 void gnutls_srp_set_client_credentials_function(
2553     gnutls_srp_client_credentials_t cred,
2554     gnutls_srp_client_credentials_function *func);
2555
2556 int gnutls_srp_base64_encode(const gnutls_datum_t *data, char *result,
2557                  size_t *result_size);
2558 int gnutls_srp_base64_encode2(const gnutls_datum_t *data,
2559                   gnutls_datum_t *result);
2560
2561 int gnutls_srp_base64_decode(const gnutls_datum_t *b64_data, char *result,
2562                  size_t *result_size);
2563 int gnutls_srp_base64_decode2(const gnutls_datum_t *b64_data,
2564                   gnutls_datum_t *result);
2565
2566 #define gnutls_srp_base64_encode_alloc gnutls_srp_base64_encode2
2567 #define gnutls_srp_base64_decode_alloc gnutls_srp_base64_decode2
2568
2569 void gnutls_srp_set_server_fake_salt_seed(gnutls_srp_server_credentials_t sc,
2570                       const gnutls_datum_t *seed,
2571                       unsigned int salt_length);
2572
2573 /* PSK stuff */
2574 typedef struct gnutls_psk_server_credentials_st *gnutls_psk_server_credentials_t;
2575 typedef struct gnutls_psk_client_credentials_st *gnutls_psk_client_credentials_t;
2576
2577 /**
2578  * gnutls_psk_key_flags:
2579  * @GNUTLS_PSK_KEY_RAW: PSK-key in raw format.
2580  * @GNUTLS_PSK_KEY_HEX: PSK-key in hex format.
2581  * @GNUTLS_PSK_KEY_EXT: PSK-key is external and to be imported.
2582  *
2583  * Enumeration of different PSK key flags.
2584  */
2585 typedef enum gnutls_psk_key_flags {
2586     GNUTLS_PSK_KEY_RAW = 0,
2587     GNUTLS_PSK_KEY_HEX = 1 << 0,
2588     GNUTLS_PSK_KEY_EXT = 1 << 1
2589 } gnutls_psk_key_flags;
2590
2591 void gnutls_psk_free_client_credentials(gnutls_psk_client_credentials_t sc);
2592 int gnutls_psk_allocate_client_credentials(gnutls_psk_client_credentials_t *sc);
2593 int gnutls_psk_set_client_credentials(gnutls_psk_client_credentials_t res,
2594                       const char *username,
2595                       const gnutls_datum_t *key,
2596                       gnutls_psk_key_flags flags);
2597 int gnutls_psk_set_client_credentials2(gnutls_psk_client_credentials_t res,
2598                        const gnutls_datum_t *username,
2599                        const gnutls_datum_t *key,
2600                        gnutls_psk_key_flags flags);
2601
2602 void gnutls_psk_free_server_credentials(gnutls_psk_server_credentials_t sc);
2603 int gnutls_psk_allocate_server_credentials(gnutls_psk_server_credentials_t *sc);
2604 int gnutls_psk_set_server_credentials_file(gnutls_psk_server_credentials_t res,
2605                        const char *password_file);
2606
2607 int gnutls_psk_set_server_credentials_hint(gnutls_psk_server_credentials_t res,
2608                        const char *hint);
2609
2610 const char *gnutls_psk_server_get_username(gnutls_session_t session);
2611 int gnutls_psk_server_get_username2(gnutls_session_t session,
2612                     gnutls_datum_t *out);
2613 const char *gnutls_psk_client_get_hint(gnutls_session_t session);
2614
2615 typedef int gnutls_psk_server_credentials_function(gnutls_session_t,
2616                            const char *username,
2617                            gnutls_datum_t *key);
2618 typedef int gnutls_psk_server_credentials_function2(
2619     gnutls_session_t, const gnutls_datum_t *username, gnutls_datum_t *key);
2620 typedef int gnutls_psk_server_credentials_function3(
2621     gnutls_session_t, const gnutls_datum_t *username, gnutls_datum_t *key,
2622     gnutls_psk_key_flags *flags);
2623 void gnutls_psk_set_server_credentials_function(
2624     gnutls_psk_server_credentials_t cred,
2625     gnutls_psk_server_credentials_function *func);
2626 void gnutls_psk_set_server_credentials_function2(
2627     gnutls_psk_server_credentials_t cred,
2628     gnutls_psk_server_credentials_function2 *func);
2629 void gnutls_psk_set_server_credentials_function3(
2630     gnutls_psk_server_credentials_t cred,
2631     gnutls_psk_server_credentials_function3 *func);
2632
2633 int gnutls_psk_format_imported_identity(const gnutls_datum_t *identity,
2634                     const gnutls_datum_t *context,
2635                     gnutls_protocol_t version,
2636                     gnutls_digest_algorithm_t hash,
2637                     gnutls_datum_t *imported_identity);
2638
2639 typedef int gnutls_psk_client_credentials_function(gnutls_session_t,
2640                            char **username,
2641                            gnutls_datum_t *key);
2642 typedef int gnutls_psk_client_credentials_function2(gnutls_session_t,
2643                             gnutls_datum_t *username,
2644                             gnutls_datum_t *key);
2645 typedef int gnutls_psk_client_credentials_function3(
2646     gnutls_session_t, gnutls_datum_t *username, gnutls_datum_t *key,
2647     gnutls_psk_key_flags *flags);
2648 void gnutls_psk_set_client_credentials_function(
2649     gnutls_psk_client_credentials_t cred,
2650     gnutls_psk_client_credentials_function *func);
2651 void gnutls_psk_set_client_credentials_function2(
2652     gnutls_psk_client_credentials_t cred,
2653     gnutls_psk_client_credentials_function2 *func);
2654 void gnutls_psk_set_client_credentials_function3(
2655     gnutls_psk_client_credentials_t cred,
2656     gnutls_psk_client_credentials_function3 *func);
2657
2658 int gnutls_hex_encode(const gnutls_datum_t *data, char *result,
2659               size_t *result_size);
2660 int gnutls_hex_decode(const gnutls_datum_t *hex_data, void *result,
2661               size_t *result_size);
2662
2663 int gnutls_hex_encode2(const gnutls_datum_t *data, gnutls_datum_t *result);
2664 int gnutls_hex_decode2(const gnutls_datum_t *data, gnutls_datum_t *result);
2665
2666 void gnutls_psk_set_server_dh_params(gnutls_psk_server_credentials_t res,
2667                      gnutls_dh_params_t dh_params);
2668
2669 int gnutls_psk_set_server_known_dh_params(gnutls_psk_server_credentials_t res,
2670                       gnutls_sec_param_t sec_param);
2671
2672 void gnutls_psk_set_server_params_function(gnutls_psk_server_credentials_t res,
2673                        gnutls_params_function *func);
2674
2675 /**
2676  * gnutls_x509_subject_alt_name_t:
2677  * @GNUTLS_SAN_DNSNAME: DNS-name SAN.
2678  * @GNUTLS_SAN_RFC822NAME: E-mail address SAN.
2679  * @GNUTLS_SAN_URI: URI SAN.
2680  * @GNUTLS_SAN_IPADDRESS: IP address SAN.
2681  * @GNUTLS_SAN_OTHERNAME: OtherName SAN.
2682  * @GNUTLS_SAN_DN: DN SAN.
2683  * @GNUTLS_SAN_REGISTERED_ID: RegisteredID.
2684  * @GNUTLS_SAN_OTHERNAME_XMPP: Virtual SAN, used by certain functions for convenience.
2685  * @GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL: Virtual SAN, used by certain functions for convenience.
2686  * @GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: Virtual SAN, used by certain functions for convenience.
2687  *
2688  * Enumeration of different subject alternative names types.
2689  */
2690 typedef enum gnutls_x509_subject_alt_name_t {
2691     GNUTLS_SAN_DNSNAME = 1,
2692     GNUTLS_SAN_RFC822NAME = 2,
2693     GNUTLS_SAN_URI = 3,
2694     GNUTLS_SAN_IPADDRESS = 4,
2695     GNUTLS_SAN_OTHERNAME = 5,
2696     GNUTLS_SAN_DN = 6,
2697     GNUTLS_SAN_REGISTERED_ID = 7,
2698     GNUTLS_SAN_MAX = GNUTLS_SAN_REGISTERED_ID,
2699     /* The following are "virtual" subject alternative name types, in
2700        that they are represented by an otherName value and an OID.
2701        Used by gnutls_x509_crt_get_subject_alt_othername_oid.  */
2702     GNUTLS_SAN_OTHERNAME_XMPP = 1000,
2703     GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL,
2704     GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL
2705 } gnutls_x509_subject_alt_name_t;
2706
2707 struct gnutls_openpgp_crt_int;
2708 typedef struct gnutls_openpgp_crt_int *gnutls_openpgp_crt_t;
2709
2710 struct gnutls_openpgp_privkey_int;
2711 typedef struct gnutls_openpgp_privkey_int *gnutls_openpgp_privkey_t;
2712
2713 struct gnutls_pkcs11_privkey_st;
2714 typedef struct gnutls_pkcs11_privkey_st *gnutls_pkcs11_privkey_t;
2715
2716 /**
2717  * gnutls_privkey_type_t:
2718  * @GNUTLS_PRIVKEY_X509: X.509 private key, #gnutls_x509_privkey_t.
2719  * @GNUTLS_PRIVKEY_OPENPGP: OpenPGP private key, #gnutls_openpgp_privkey_t.
2720  * @GNUTLS_PRIVKEY_PKCS11: PKCS11 private key, #gnutls_pkcs11_privkey_t.
2721  * @GNUTLS_PRIVKEY_EXT: External private key, operating using callbacks.
2722  *
2723  * Enumeration of different private key types.
2724  */
2725 typedef enum {
2726     GNUTLS_PRIVKEY_X509,
2727     GNUTLS_PRIVKEY_OPENPGP,
2728     GNUTLS_PRIVKEY_PKCS11,
2729     GNUTLS_PRIVKEY_EXT
2730 } gnutls_privkey_type_t;
2731
2732 typedef struct gnutls_retr2_st {
2733     gnutls_certificate_type_t cert_type;
2734     gnutls_privkey_type_t key_type;
2735
2736     union {
2737         gnutls_x509_crt_t *x509;
2738         gnutls_openpgp_crt_t pgp;
2739     } cert;
2740     unsigned int ncerts; /* one for pgp keys */
2741
2742     union {
2743         gnutls_x509_privkey_t x509;
2744         gnutls_openpgp_privkey_t pgp;
2745         gnutls_pkcs11_privkey_t pkcs11;
2746     } key;
2747
2748     unsigned int deinit_all; /* if non zero all keys will be deinited */
2749 } gnutls_retr2_st;
2750
2751 /* Functions that allow auth_info_t structures handling
2752    */
2753
2754 gnutls_credentials_type_t gnutls_auth_get_type(gnutls_session_t session);
2755 gnutls_credentials_type_t gnutls_auth_server_get_type(gnutls_session_t session);
2756 gnutls_credentials_type_t gnutls_auth_client_get_type(gnutls_session_t session);
2757
2758 /* DH */
2759
2760 void gnutls_dh_set_prime_bits(gnutls_session_t session, unsigned int bits);
2761 int gnutls_dh_get_secret_bits(gnutls_session_t session);
2762 int gnutls_dh_get_peers_public_bits(gnutls_session_t session);
2763 int gnutls_dh_get_prime_bits(gnutls_session_t session);
2764
2765 int gnutls_dh_get_group(gnutls_session_t session, gnutls_datum_t *raw_gen,
2766             gnutls_datum_t *raw_prime);
2767 int gnutls_dh_get_pubkey(gnutls_session_t session, gnutls_datum_t *raw_key);
2768
2769 /* X509PKI */
2770
2771 /* These are set on the credentials structure.
2772    */
2773
2774 /* use gnutls_certificate_set_retrieve_function2() in abstract.h
2775    * instead. It's much more efficient.
2776    */
2777
2778 typedef int gnutls_certificate_retrieve_function(
2779     gnutls_session_t, const gnutls_datum_t *req_ca_rdn, int nreqs,
2780     const gnutls_pk_algorithm_t *pk_algos, int pk_algos_length,
2781     gnutls_retr2_st *);
2782
2783 void gnutls_certificate_set_retrieve_function(
2784     gnutls_certificate_credentials_t cred,
2785     gnutls_certificate_retrieve_function *func);
2786
2787 void gnutls_certificate_set_verify_function(
2788     gnutls_certificate_credentials_t cred,
2789     gnutls_certificate_verify_function *func);
2790
2791 void gnutls_certificate_server_set_request(gnutls_session_t session,
2792                        gnutls_certificate_request_t req);
2793
2794 /* get data from the session
2795    */
2796 const gnutls_datum_t *gnutls_certificate_get_peers(gnutls_session_t session,
2797                            unsigned int *list_size);
2798 const gnutls_datum_t *gnutls_certificate_get_ours(gnutls_session_t session);
2799
2800 int gnutls_certificate_get_peers_subkey_id(gnutls_session_t session,
2801                        gnutls_datum_t *id);
2802
2803 time_t gnutls_certificate_activation_time_peers(gnutls_session_t session);
2804 time_t gnutls_certificate_expiration_time_peers(gnutls_session_t session);
2805
2806 unsigned gnutls_certificate_client_get_request_status(gnutls_session_t session);
2807 int gnutls_certificate_verify_peers2(gnutls_session_t session,
2808                      unsigned int *status);
2809 int gnutls_certificate_verify_peers3(gnutls_session_t session,
2810                      const char *hostname,
2811                      unsigned int *status);
2812
2813 int gnutls_certificate_verify_peers(gnutls_session_t session,
2814                     gnutls_typed_vdata_st *data,
2815                     unsigned int elements,
2816                     unsigned int *status);
2817
2818 int gnutls_certificate_verification_status_print(unsigned int status,
2819                          gnutls_certificate_type_t type,
2820                          gnutls_datum_t *out,
2821                          unsigned int flags);
2822
2823 int gnutls_pem_base64_encode(const char *msg, const gnutls_datum_t *data,
2824                  char *result, size_t *result_size);
2825 int gnutls_pem_base64_decode(const char *header, const gnutls_datum_t *b64_data,
2826                  unsigned char *result, size_t *result_size);
2827
2828 int gnutls_pem_base64_encode2(const char *msg, const gnutls_datum_t *data,
2829                   gnutls_datum_t *result);
2830 int gnutls_pem_base64_decode2(const char *header,
2831                   const gnutls_datum_t *b64_data,
2832                   gnutls_datum_t *result);
2833
2834 int gnutls_base64_encode2(const gnutls_datum_t *data, gnutls_datum_t *result);
2835 int gnutls_base64_decode2(const gnutls_datum_t *b64_data,
2836               gnutls_datum_t *result);
2837
2838 #define gnutls_pem_base64_encode_alloc gnutls_pem_base64_encode2
2839 #define gnutls_pem_base64_decode_alloc gnutls_pem_base64_decode2
2840
2841 /* key_usage will be an OR of the following values:
2842    */
2843
2844 /* when the key is to be used for signing: */
2845 #define GNUTLS_KEY_DIGITAL_SIGNATURE 128
2846 #define GNUTLS_KEY_NON_REPUDIATION 64
2847 /* when the key is to be used for encryption: */
2848 #define GNUTLS_KEY_KEY_ENCIPHERMENT 32
2849 #define GNUTLS_KEY_DATA_ENCIPHERMENT 16
2850 #define GNUTLS_KEY_KEY_AGREEMENT 8
2851 #define GNUTLS_KEY_KEY_CERT_SIGN 4
2852 #define GNUTLS_KEY_CRL_SIGN 2
2853 #define GNUTLS_KEY_ENCIPHER_ONLY 1
2854 #define GNUTLS_KEY_DECIPHER_ONLY 32768
2855
2856 void gnutls_certificate_set_params_function(
2857     gnutls_certificate_credentials_t res, gnutls_params_function *func);
2858 void gnutls_anon_set_params_function(gnutls_anon_server_credentials_t res,
2859                      gnutls_params_function *func);
2860 void gnutls_psk_set_params_function(gnutls_psk_server_credentials_t res,
2861                     gnutls_params_function *func);
2862
2863 int gnutls_hex2bin(const char *hex_data, size_t hex_size, void *bin_data,
2864            size_t *bin_size);
2865
2866 /* Trust on first use (or ssh like) functions */
2867
2868 /* stores the provided information to a database
2869    */
2870 typedef int (*gnutls_tdb_store_func)(const char *db_name, const char *host,
2871                      const char *service, time_t expiration,
2872                      const gnutls_datum_t *pubkey);
2873
2874 typedef int (*gnutls_tdb_store_commitment_func)(
2875     const char *db_name, const char *host, const char *service,
2876     time_t expiration, gnutls_digest_algorithm_t hash_algo,
2877     const gnutls_datum_t *hash);
2878
2879 /* searches for the provided host/service pair that match the
2880    * provided public key in the database. */
2881 typedef int (*gnutls_tdb_verify_func)(const char *db_name, const char *host,
2882                       const char *service,
2883                       const gnutls_datum_t *pubkey);
2884
2885 struct gnutls_tdb_int;
2886 typedef struct gnutls_tdb_int *gnutls_tdb_t;
2887
2888 int gnutls_tdb_init(gnutls_tdb_t *tdb);
2889 void gnutls_tdb_set_store_func(gnutls_tdb_t tdb, gnutls_tdb_store_func store);
2890 void gnutls_tdb_set_store_commitment_func(
2891     gnutls_tdb_t tdb, gnutls_tdb_store_commitment_func cstore);
2892 void gnutls_tdb_set_verify_func(gnutls_tdb_t tdb,
2893                 gnutls_tdb_verify_func verify);
2894 void gnutls_tdb_deinit(gnutls_tdb_t tdb);
2895
2896 int gnutls_verify_stored_pubkey(const char *db_name, gnutls_tdb_t tdb,
2897                 const char *host, const char *service,
2898                 gnutls_certificate_type_t cert_type,
2899                 const gnutls_datum_t *cert, unsigned int flags);
2900
2901 #define GNUTLS_SCOMMIT_FLAG_ALLOW_BROKEN 1
2902 int gnutls_store_commitment(const char *db_name, gnutls_tdb_t tdb,
2903                 const char *host, const char *service,
2904                 gnutls_digest_algorithm_t hash_algo,
2905                 const gnutls_datum_t *hash, time_t expiration,
2906                 unsigned int flags);
2907
2908 int gnutls_store_pubkey(const char *db_name, gnutls_tdb_t tdb, const char *host,
2909             const char *service,
2910             gnutls_certificate_type_t cert_type,
2911             const gnutls_datum_t *cert, time_t expiration,
2912             unsigned int flags);
2913
2914 /* Other helper functions */
2915 int gnutls_load_file(const char *filename, gnutls_datum_t *data);
2916
2917 unsigned gnutls_url_is_supported(const char *url);
2918
2919 /* PIN callback */
2920
2921 /**
2922  * gnutls_pin_flag_t:
2923  * @GNUTLS_PIN_USER: The PIN for the user.
2924  * @GNUTLS_PIN_SO: The PIN for the security officer (admin).
2925  * @GNUTLS_PIN_CONTEXT_SPECIFIC: The PIN is for a specific action and key like signing.
2926  * @GNUTLS_PIN_FINAL_TRY: This is the final try before blocking.
2927  * @GNUTLS_PIN_COUNT_LOW: Few tries remain before token blocks.
2928  * @GNUTLS_PIN_WRONG: Last given PIN was not correct.
2929  *
2930  * Enumeration of different flags that are input to the PIN function.
2931  */
2932 typedef enum {
2933     GNUTLS_PIN_USER = (1 << 0),
2934     GNUTLS_PIN_SO = (1 << 1),
2935     GNUTLS_PIN_FINAL_TRY = (1 << 2),
2936     GNUTLS_PIN_COUNT_LOW = (1 << 3),
2937     GNUTLS_PIN_CONTEXT_SPECIFIC = (1 << 4),
2938     GNUTLS_PIN_WRONG = (1 << 5)
2939 } gnutls_pin_flag_t;
2940
2941 #define GNUTLS_PKCS11_PIN_USER GNUTLS_PIN_USER
2942 #define GNUTLS_PKCS11_PIN_SO GNUTLS_PIN_SO
2943 #define GNUTLS_PKCS11_PIN_FINAL_TRY GNUTLS_PIN_FINAL_TRY
2944 #define GNUTLS_PKCS11_PIN_COUNT_LOW GNUTLS_PIN_COUNT_LOW
2945 #define GNUTLS_PKCS11_PIN_CONTEXT_SPECIFIC GNUTLS_PIN_CONTEXT_SPECIFIC
2946 #define GNUTLS_PKCS11_PIN_WRONG GNUTLS_PIN_WRONG
2947
2948 /**
2949  * gnutls_pin_callback_t:
2950  * @userdata: user-controlled data from gnutls_pkcs11_set_pin_function().
2951  * @attempt: pin-attempt counter, initially 0.
2952  * @token_url: URL of token.
2953  * @token_label: label of token.
2954  * @flags: a #gnutls_pin_flag_t flag.
2955  * @pin: buffer to hold PIN, of size @pin_max.
2956  * @pin_max: size of @pin buffer.
2957  *
2958  * Callback function type for PKCS#11 or TPM PIN entry.  It is set by
2959  * functions like gnutls_pkcs11_set_pin_function().
2960  *
2961  * The callback should provides the PIN code to unlock the token with
2962  * label @token_label, specified by the URL @token_url.
2963  *
2964  * The PIN code, as a NUL-terminated ASCII string, should be copied
2965  * into the @pin buffer (of maximum size @pin_max), and return 0 to
2966  * indicate success.  Alternatively, the callback may return a
2967  * negative gnutls error code to indicate failure and cancel PIN entry
2968  * (in which case, the contents of the @pin parameter are ignored).
2969  *
2970  * When a PIN is required, the callback will be invoked repeatedly
2971  * (and indefinitely) until either the returned PIN code is correct,
2972  * the callback returns failure, or the token refuses login (e.g. when
2973  * the token is locked due to too many incorrect PINs!).  For the
2974  * first such invocation, the @attempt counter will have value zero;
2975  * it will increase by one for each subsequent attempt.
2976  *
2977  * Returns: %GNUTLS_E_SUCCESS (0) on success or a negative error code on error.
2978  *
2979  * Since: 2.12.0
2980  **/
2981 typedef int (*gnutls_pin_callback_t)(void *userdata, int attempt,
2982                      const char *token_url,
2983                      const char *token_label,
2984                      unsigned int flags, char *pin,
2985                      size_t pin_max);
2986
2987 void gnutls_certificate_set_pin_function(gnutls_certificate_credentials_t,
2988                      gnutls_pin_callback_t fn,
2989                      void *userdata);
2990
2991 /* Public string related functions */
2992 typedef struct gnutls_buffer_st *gnutls_buffer_t;
2993
2994 int gnutls_buffer_append_data(gnutls_buffer_t, const void *data,
2995                   size_t data_size);
2996
2997 #define GNUTLS_UTF8_IGNORE_ERRS 1
2998 int gnutls_utf8_password_normalize(const unsigned char *password,
2999                    unsigned password_len, gnutls_datum_t *out,
3000                    unsigned flags);
3001
3002 /* Public extensions related functions */
3003
3004 typedef void *gnutls_ext_priv_data_t;
3005
3006 void gnutls_ext_set_data(gnutls_session_t session, unsigned type,
3007              gnutls_ext_priv_data_t);
3008 int gnutls_ext_get_data(gnutls_session_t session, unsigned type,
3009             gnutls_ext_priv_data_t *);
3010
3011 unsigned gnutls_ext_get_current_msg(gnutls_session_t session);
3012
3013 typedef int (*gnutls_ext_recv_func)(gnutls_session_t session,
3014                     const unsigned char *data, size_t len);
3015
3016 typedef int (*gnutls_ext_send_func)(gnutls_session_t session,
3017                     gnutls_buffer_t extdata);
3018
3019 typedef void (*gnutls_ext_deinit_data_func)(gnutls_ext_priv_data_t data);
3020
3021 typedef int (*gnutls_ext_pack_func)(gnutls_ext_priv_data_t data,
3022                     gnutls_buffer_t packed_data);
3023
3024 typedef int (*gnutls_ext_unpack_func)(gnutls_buffer_t packed_data,
3025                       gnutls_ext_priv_data_t *data);
3026
3027 #define GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO 1
3028 #define GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO (1 << 1)
3029 typedef int (*gnutls_ext_raw_process_func)(void *ctx, unsigned tls_id,
3030                        const unsigned char *data,
3031                        unsigned data_size);
3032 int gnutls_ext_raw_parse(void *ctx, gnutls_ext_raw_process_func cb,
3033              const gnutls_datum_t *data, unsigned int flags);
3034
3035 /**
3036  * gnutls_ext_parse_type_t:
3037  * @GNUTLS_EXT_NONE: Never to be parsed
3038  * @GNUTLS_EXT_ANY: Any extension type (should not be used as it is used only internally).
3039  * @GNUTLS_EXT_VERSION_NEG: Extensions to be parsed first for TLS version negotiation.
3040  * @GNUTLS_EXT_MANDATORY: Parsed after @GNUTLS_EXT_VERSION_NEG and even when resuming.
3041  * @GNUTLS_EXT_APPLICATION: Parsed after @GNUTLS_EXT_MANDATORY
3042  * @GNUTLS_EXT_TLS: TLS-internal extensions, parsed after @GNUTLS_EXT_APPLICATION.
3043  *
3044  * Enumeration of different TLS extension parsing phases.  The @gnutls_ext_parse_type_t
3045  * indicates the time/phase an extension is parsed during Client or Server hello parsing.
3046  *
3047  */
3048 typedef enum {
3049     GNUTLS_EXT_ANY = 0,
3050     GNUTLS_EXT_APPLICATION = 1,
3051     GNUTLS_EXT_TLS = 2,
3052     GNUTLS_EXT_MANDATORY = 3,
3053     GNUTLS_EXT_NONE = 4,
3054     GNUTLS_EXT_VERSION_NEG = 5
3055 } gnutls_ext_parse_type_t;
3056
3057 /**
3058  * gnutls_ext_flags_t:
3059  * @GNUTLS_EXT_FLAG_OVERRIDE_INTERNAL: If specified the extension registered will override the internal; this does not work with extensions existing prior to 3.6.0.
3060  * @GNUTLS_EXT_FLAG_CLIENT_HELLO: This extension can be present in a client hello
3061  * @GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO: This extension can be present in a TLS1.2 or earlier server hello
3062  * @GNUTLS_EXT_FLAG_TLS13_SERVER_HELLO: This extension can be present in a TLS1.3 server hello
3063  * @GNUTLS_EXT_FLAG_EE: This extension can be present in encrypted extensions message
3064  * @GNUTLS_EXT_FLAG_HRR: This extension can be present in hello retry request message
3065  * @GNUTLS_EXT_FLAG_IGNORE_CLIENT_REQUEST: When flag is present, this extension will be send even if the client didn't advertise it. An extension of this type is the Cookie TLS1.3 extension.
3066  * @GNUTLS_EXT_FLAG_DTLS: This extension can be present under DTLS; otherwise ignored.
3067  * @GNUTLS_EXT_FLAG_TLS: This extension can be present under TLS; otherwise ignored.
3068  *
3069  * Enumeration of different TLS extension registration flags.
3070  */
3071 typedef enum {
3072     GNUTLS_EXT_FLAG_OVERRIDE_INTERNAL = 1,
3073     GNUTLS_EXT_FLAG_CLIENT_HELLO = (1 << 1),
3074     GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO = (1 << 2),
3075     GNUTLS_EXT_FLAG_TLS13_SERVER_HELLO = (1 << 3),
3076     GNUTLS_EXT_FLAG_EE = (1 << 4), /* ENCRYPTED */
3077     GNUTLS_EXT_FLAG_HRR = (1 << 5),
3078     GNUTLS_EXT_FLAG_IGNORE_CLIENT_REQUEST = (1 << 6),
3079     GNUTLS_EXT_FLAG_TLS = (1 << 7),
3080     GNUTLS_EXT_FLAG_DTLS = (1 << 8)
3081 } gnutls_ext_flags_t;
3082
3083 /* Register a custom tls extension
3084  */
3085 int gnutls_ext_register(const char *name, int type,
3086             gnutls_ext_parse_type_t parse_point,
3087             gnutls_ext_recv_func recv_func,
3088             gnutls_ext_send_func send_func,
3089             gnutls_ext_deinit_data_func deinit_func,
3090             gnutls_ext_pack_func pack_func,
3091             gnutls_ext_unpack_func unpack_func);
3092
3093 int gnutls_session_ext_register(gnutls_session_t, const char *name, int type,
3094                 gnutls_ext_parse_type_t parse_point,
3095                 gnutls_ext_recv_func recv_func,
3096                 gnutls_ext_send_func send_func,
3097                 gnutls_ext_deinit_data_func deinit_func,
3098                 gnutls_ext_pack_func pack_func,
3099                 gnutls_ext_unpack_func unpack_func,
3100                 unsigned flags);
3101
3102 const char *gnutls_ext_get_name(unsigned int ext);
3103 const char *gnutls_ext_get_name2(gnutls_session_t session, unsigned int tls_id,
3104                  gnutls_ext_parse_type_t parse_point);
3105
3106 /* Public supplemental data related functions */
3107
3108 typedef int (*gnutls_supp_recv_func)(gnutls_session_t session,
3109                      const unsigned char *data,
3110                      size_t data_size);
3111 typedef int (*gnutls_supp_send_func)(gnutls_session_t session,
3112                      gnutls_buffer_t buf);
3113
3114 int gnutls_supplemental_register(const char *name,
3115                  gnutls_supplemental_data_format_type_t type,
3116                  gnutls_supp_recv_func supp_recv_func,
3117                  gnutls_supp_send_func supp_send_func);
3118
3119 int gnutls_session_supplemental_register(
3120     gnutls_session_t session, const char *name,
3121     gnutls_supplemental_data_format_type_t type,
3122     gnutls_supp_recv_func supp_recv_func,
3123     gnutls_supp_send_func supp_send_func, unsigned int flags);
3124
3125 void gnutls_supplemental_recv(gnutls_session_t session,
3126                   unsigned do_recv_supplemental);
3127
3128 void gnutls_supplemental_send(gnutls_session_t session,
3129                   unsigned do_send_supplemental);
3130
3131 /* Anti-replay related functions */
3132
3133 typedef struct gnutls_anti_replay_st *gnutls_anti_replay_t;
3134
3135 int gnutls_anti_replay_init(gnutls_anti_replay_t *anti_replay);
3136 void gnutls_anti_replay_deinit(gnutls_anti_replay_t anti_replay);
3137 void gnutls_anti_replay_set_window(gnutls_anti_replay_t anti_replay,
3138                    unsigned int window);
3139 void gnutls_anti_replay_enable(gnutls_session_t session,
3140                    gnutls_anti_replay_t anti_replay);
3141
3142 typedef int (*gnutls_db_add_func)(void *, time_t exp_time,
3143                   const gnutls_datum_t *key,
3144                   const gnutls_datum_t *data);
3145
3146 void gnutls_anti_replay_set_add_function(gnutls_anti_replay_t,
3147                      gnutls_db_add_func add_func);
3148
3149 void gnutls_anti_replay_set_ptr(gnutls_anti_replay_t, void *ptr);
3150
3151 /**
3152  * gnutls_record_encryption_level_t:
3153  * @GNUTLS_ENCRYPTION_LEVEL_INITIAL: initial level that doesn't involve any
3154  *    encryption
3155  * @GNUTLS_ENCRYPTION_LEVEL_EARLY: early traffic secret is installed
3156  * @GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE: handshake traffic secret is installed
3157  * @GNUTLS_ENCRYPTION_LEVEL_APPLICATION: application traffic secret is installed
3158  *
3159  * Enumeration of different levels of record encryption currently in place.
3160  * This is used by gnutls_handshake_set_read_function() and
3161  * gnutls_handshake_write().
3162  *
3163  * Since: 3.7.0
3164  */
3165 typedef enum {
3166     GNUTLS_ENCRYPTION_LEVEL_INITIAL,
3167     GNUTLS_ENCRYPTION_LEVEL_EARLY,
3168     GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE,
3169     GNUTLS_ENCRYPTION_LEVEL_APPLICATION
3170 } gnutls_record_encryption_level_t;
3171
3172 /**
3173  * gnutls_handshake_read_func:
3174  * @session: the current session
3175  * @htype: the type of the handshake message (#gnutls_handshake_description_t)
3176  * @level: #gnutls_record_encryption_level_t
3177  * @data: the (const) data that was being sent
3178  * @data_size: the size of data
3179  *
3180  * Function prototype for handshake intercepting hooks. It is set using
3181  * gnutls_handshake_set_read_function().
3182  *
3183  * Returns: Non zero on error.
3184  * Since: 3.7.0
3185  */
3186 typedef int (*gnutls_handshake_read_func)(gnutls_session_t session,
3187                       gnutls_record_encryption_level_t level,
3188                       gnutls_handshake_description_t htype,
3189                       const void *data, size_t data_size);
3190
3191 void gnutls_handshake_set_read_function(gnutls_session_t session,
3192                     gnutls_handshake_read_func func);
3193
3194 int gnutls_handshake_write(gnutls_session_t session,
3195                gnutls_record_encryption_level_t level,
3196                const void *data, size_t data_size);
3197
3198 /**
3199  * gnutls_handshake_secret_func:
3200  * @session: the current session
3201  * @level: the encryption level
3202  * @secret_read: the secret used for reading, can be %NULL if not set
3203  * @secret_write: the secret used for writing, can be %NULL if not set
3204  * @secret_size: the size of the secrets
3205  *
3206  * Function prototype for secret hooks. It is set using
3207  * gnutls_handshake_set_secret_function().
3208  *
3209  * Returns: Non zero on error.
3210  * Since: 3.7.0
3211  */
3212 typedef int (*gnutls_handshake_secret_func)(
3213     gnutls_session_t session, gnutls_record_encryption_level_t level,
3214     const void *secret_read, const void *secret_write, size_t secret_size);
3215
3216 void gnutls_handshake_set_secret_function(gnutls_session_t session,
3217                       gnutls_handshake_secret_func func);
3218
3219 /**
3220  * gnutls_alert_read_func:
3221  * @session: the current session
3222  * @level: #gnutls_record_encryption_level_t
3223  * @alert_level: the level of the alert
3224  * @alert_desc: the alert description
3225  *
3226  * Function prototype for alert intercepting hooks. It is set using
3227  * gnutls_alert_set_read_function().
3228  *
3229  * Returns: Non zero on error.
3230  * Since: 3.7.0
3231  */
3232 typedef int (*gnutls_alert_read_func)(gnutls_session_t session,
3233                       gnutls_record_encryption_level_t level,
3234                       gnutls_alert_level_t alert_level,
3235                       gnutls_alert_description_t alert_desc);
3236
3237 void gnutls_alert_set_read_function(gnutls_session_t session,
3238                     gnutls_alert_read_func func);
3239
3240 /* FIPS140-2 related functions */
3241 unsigned gnutls_fips140_mode_enabled(void);
3242
3243 /**
3244  * gnutls_fips_mode_t:
3245  * @GNUTLS_FIPS140_DISABLED: The FIPS140-2 mode is disabled.
3246  * @GNUTLS_FIPS140_STRICT: The default mode; all forbidden operations will cause an
3247  *                         operation failure via error code.
3248  * @GNUTLS_FIPS140_LAX: The library still uses the FIPS140-2 relevant algorithms but all
3249  *                      forbidden by FIPS140-2 operations are allowed; this is useful when the
3250  *                      application is aware of the followed security policy, and needs
3251  *                      to utilize disallowed operations for other reasons (e.g., compatibility).
3252  * @GNUTLS_FIPS140_LOG: Similarly to %GNUTLS_FIPS140_LAX, it allows forbidden operations; any use of them results
3253  *                      to a message to the audit callback functions.
3254  * @GNUTLS_FIPS140_SELFTESTS: A transient state during library initialization. That state
3255  *          cannot be set or seen by applications.
3256  *
3257  * Enumeration of different operational modes under FIPS140-2.
3258  */
3259 typedef enum gnutls_fips_mode_t {
3260     GNUTLS_FIPS140_DISABLED = 0,
3261     GNUTLS_FIPS140_STRICT = 1,
3262     GNUTLS_FIPS140_SELFTESTS = 2,
3263     GNUTLS_FIPS140_LAX = 3,
3264     GNUTLS_FIPS140_LOG = 4
3265 } gnutls_fips_mode_t;
3266
3267 #define GNUTLS_FIPS140_SET_MODE_THREAD 1
3268
3269 void gnutls_fips140_set_mode(gnutls_fips_mode_t mode, unsigned flags);
3270
3271 #define GNUTLS_FIPS140_SET_LAX_MODE()                            \
3272     do {                                                     \
3273         if (gnutls_fips140_mode_enabled())               \
3274             gnutls_fips140_set_mode(                 \
3275                 GNUTLS_FIPS140_LAX,              \
3276                 GNUTLS_FIPS140_SET_MODE_THREAD); \
3277     } while (0)
3278
3279 #define GNUTLS_FIPS140_SET_STRICT_MODE()                         \
3280     do {                                                     \
3281         if (gnutls_fips140_mode_enabled())               \
3282             gnutls_fips140_set_mode(                 \
3283                 GNUTLS_FIPS140_STRICT,           \
3284                 GNUTLS_FIPS140_SET_MODE_THREAD); \
3285     } while (0)
3286
3287 typedef struct gnutls_fips140_context_st *gnutls_fips140_context_t;
3288
3289 int gnutls_fips140_context_init(gnutls_fips140_context_t *context);
3290 void gnutls_fips140_context_deinit(gnutls_fips140_context_t context);
3291
3292 /**
3293  * gnutls_fips140_operation_state_t:
3294  * @GNUTLS_FIPS140_OP_INITIAL: no previous operation has done
3295  * @GNUTLS_FIPS140_OP_APPROVED: the previous operation was FIPS approved
3296  * @GNUTLS_FIPS140_OP_NOT_APPROVED: the previous operation was not FIPS approved
3297  * @GNUTLS_FIPS140_OP_ERROR: the previous operation caused an error regardless of FIPS
3298  *
3299  * The FIPS operation state set by the preceding operation.
3300  *
3301  * There are state transition rules among the enum values:
3302  * - When the context is attached to a thread, it will be set to reset
3303  *   to the %GNUTLS_FIPS140_OP_INITIAL state
3304  * - From the %GNUTLS_FIPS140_OP_INITIAL state, the context can
3305  *   transition to either %GNUTLS_FIPS140_OP_APPROVED,
3306  *   %GNUTLS_FIPS140_OP_NOT_APPROVED, or %GNUTLS_FIPS140_OP_ERROR
3307  * - From the %GNUTLS_FIPS140_OP_APPROVED state, the context can
3308  *   transition to %GNUTLS_FIPS140_OP_NOT_APPROVED
3309  * - All other transitions are prohibited.
3310  *
3311  * Since: 3.7.3
3312  */
3313 typedef enum {
3314     GNUTLS_FIPS140_OP_INITIAL,
3315     GNUTLS_FIPS140_OP_APPROVED,
3316     GNUTLS_FIPS140_OP_NOT_APPROVED,
3317     GNUTLS_FIPS140_OP_ERROR
3318 } gnutls_fips140_operation_state_t;
3319
3320 gnutls_fips140_operation_state_t
3321 gnutls_fips140_get_operation_state(gnutls_fips140_context_t context);
3322
3323 int gnutls_fips140_push_context(gnutls_fips140_context_t context);
3324 int gnutls_fips140_pop_context(void);
3325
3326 int gnutls_fips140_run_self_tests(void);
3327
3328 /**
3329  * gnutls_transport_ktls_enable_flags_t:
3330  * @GNUTLS_KTLS_RECV: ktls enabled for recv function.
3331  * @GNUTLS_KTLS_SEND: ktls enabled for send function.
3332  * @GNUTLS_KTLS_DUPLEX: ktls enabled for both recv and send functions.
3333  *
3334  * Flag enumeration of ktls enable status for recv and send functions.
3335  * This is used by gnutls_transport_is_ktls_enabled().
3336  *
3337  * Since: 3.7.3
3338  */
3339 typedef enum {
3340     GNUTLS_KTLS_RECV = 1 << 0,
3341     GNUTLS_KTLS_SEND = 1 << 1,
3342     GNUTLS_KTLS_DUPLEX = GNUTLS_KTLS_RECV | GNUTLS_KTLS_SEND,
3343 } gnutls_transport_ktls_enable_flags_t;
3344
3345 gnutls_transport_ktls_enable_flags_t
3346 gnutls_transport_is_ktls_enabled(gnutls_session_t session);
3347
3348 /* Gnutls error codes. The mapping to a TLS alert is also shown in
3349    * comments.
3350    */
3351
3352 #define GNUTLS_E_SUCCESS 0
3353 #define GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM -3
3354 #define GNUTLS_E_UNKNOWN_CIPHER_TYPE -6
3355 #define GNUTLS_E_LARGE_PACKET -7
3356 #define GNUTLS_E_UNSUPPORTED_VERSION_PACKET -8 /* GNUTLS_A_PROTOCOL_VERSION */
3357 #define GNUTLS_E_TLS_PACKET_DECODING_ERROR GNUTLS_E_UNEXPECTED_PACKET_LENGTH
3358 #define GNUTLS_E_UNEXPECTED_PACKET_LENGTH -9 /* GNUTLS_A_DECODE_ERROR */
3359 #define GNUTLS_E_INVALID_SESSION -10
3360 #define GNUTLS_E_FATAL_ALERT_RECEIVED -12
3361 #define GNUTLS_E_UNEXPECTED_PACKET -15 /* GNUTLS_A_UNEXPECTED_MESSAGE */
3362 #define GNUTLS_E_WARNING_ALERT_RECEIVED -16
3363 #define GNUTLS_E_ERROR_IN_FINISHED_PACKET -18
3364 #define GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET -19
3365 #define GNUTLS_E_UNKNOWN_CIPHER_SUITE -21
3366 /* GNUTLS_A_HANDSHAKE_FAILURE */
3367 #define GNUTLS_E_UNWANTED_ALGORITHM -22
3368 #define GNUTLS_E_MPI_SCAN_FAILED -23
3369 #define GNUTLS_E_DECRYPTION_FAILED \
3370     -24 /* GNUTLS_A_DECRYPTION_FAILED, GNUTLS_A_BAD_RECORD_MAC */
3371 #define GNUTLS_E_MEMORY_ERROR -25
3372 #define GNUTLS_E_DECOMPRESSION_FAILED -26 /* GNUTLS_A_DECOMPRESSION_FAILURE */
3373 #define GNUTLS_E_COMPRESSION_FAILED -27
3374 #define GNUTLS_E_AGAIN -28
3375 #define GNUTLS_E_EXPIRED -29
3376 #define GNUTLS_E_DB_ERROR -30
3377 #define GNUTLS_E_SRP_PWD_ERROR GNUTLS_E_KEYFILE_ERROR
3378 #define GNUTLS_E_KEYFILE_ERROR -31
3379 #define GNUTLS_E_INSUFFICIENT_CREDENTIALS -32
3380 #define GNUTLS_E_INSUFICIENT_CREDENTIALS \
3381     GNUTLS_E_INSUFFICIENT_CREDENTIALS /* for backwards compatibility only */
3382 #define GNUTLS_E_INSUFFICIENT_CRED GNUTLS_E_INSUFFICIENT_CREDENTIALS
3383 #define GNUTLS_E_INSUFICIENT_CRED \
3384     GNUTLS_E_INSUFFICIENT_CREDENTIALS /* for backwards compatibility only */
3385
3386 #define GNUTLS_E_HASH_FAILED -33
3387 #define GNUTLS_E_BASE64_DECODING_ERROR -34
3388
3389 #define GNUTLS_E_MPI_PRINT_FAILED -35
3390 #define GNUTLS_E_REHANDSHAKE -37 /* GNUTLS_A_NO_RENEGOTIATION */
3391 #define GNUTLS_E_GOT_APPLICATION_DATA -38
3392 #define GNUTLS_E_RECORD_LIMIT_REACHED -39
3393 #define GNUTLS_E_ENCRYPTION_FAILED -40
3394
3395 #define GNUTLS_E_PK_ENCRYPTION_FAILED -44
3396 #define GNUTLS_E_PK_DECRYPTION_FAILED -45
3397 #define GNUTLS_E_PK_SIGN_FAILED -46
3398 #define GNUTLS_E_X509_UNSUPPORTED_CRITICAL_EXTENSION -47
3399 #define GNUTLS_E_KEY_USAGE_VIOLATION -48
3400 #define GNUTLS_E_NO_CERTIFICATE_FOUND -49 /* GNUTLS_A_BAD_CERTIFICATE */
3401 #define GNUTLS_E_INVALID_REQUEST -50
3402 #define GNUTLS_E_SHORT_MEMORY_BUFFER -51
3403 #define GNUTLS_E_INTERRUPTED -52
3404 #define GNUTLS_E_PUSH_ERROR -53
3405 #define GNUTLS_E_PULL_ERROR -54
3406 #define GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER -55 /* GNUTLS_A_ILLEGAL_PARAMETER */
3407 #define GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE -56
3408 #define GNUTLS_E_PKCS1_WRONG_PAD -57
3409 #define GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION -58
3410 #define GNUTLS_E_INTERNAL_ERROR -59
3411 #define GNUTLS_E_DH_PRIME_UNACCEPTABLE -63
3412 #define GNUTLS_E_FILE_ERROR -64
3413 #define GNUTLS_E_TOO_MANY_EMPTY_PACKETS -78
3414 #define GNUTLS_E_UNKNOWN_PK_ALGORITHM -80
3415 #define GNUTLS_E_TOO_MANY_HANDSHAKE_PACKETS -81
3416 #define GNUTLS_E_RECEIVED_DISALLOWED_NAME -82 /* GNUTLS_A_ILLEGAL_PARAMETER */
3417 #define GNUTLS_E_CERTIFICATE_REQUIRED -112 /* GNUTLS_A_CERTIFICATE_REQUIRED */
3418 #define GNUTLS_E_UNSUPPORTED_ENCRYPTION_ALGORITHM -113
3419
3420 /* returned if you need to generate temporary RSA
3421    * parameters. These are needed for export cipher suites.
3422    */
3423 #define GNUTLS_E_NO_TEMPORARY_RSA_PARAMS -84
3424
3425 #define GNUTLS_E_NO_COMPRESSION_ALGORITHMS -86
3426 #define GNUTLS_E_NO_CIPHER_SUITES -87
3427
3428 #define GNUTLS_E_OPENPGP_GETKEY_FAILED -88
3429 #define GNUTLS_E_PK_SIG_VERIFY_FAILED -89
3430
3431 #define GNUTLS_E_ILLEGAL_SRP_USERNAME -90
3432 #define GNUTLS_E_SRP_PWD_PARSING_ERROR GNUTLS_E_KEYFILE_PARSING_ERROR
3433 #define GNUTLS_E_KEYFILE_PARSING_ERROR -91
3434 #define GNUTLS_E_NO_TEMPORARY_DH_PARAMS -93
3435
3436 /* For certificate and key stuff
3437    */
3438 #define GNUTLS_E_ASN1_ELEMENT_NOT_FOUND -67
3439 #define GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND -68
3440 #define GNUTLS_E_ASN1_DER_ERROR -69
3441 #define GNUTLS_E_ASN1_VALUE_NOT_FOUND -70
3442 #define GNUTLS_E_ASN1_GENERIC_ERROR -71
3443 #define GNUTLS_E_ASN1_VALUE_NOT_VALID -72
3444 #define GNUTLS_E_ASN1_TAG_ERROR -73
3445 #define GNUTLS_E_ASN1_TAG_IMPLICIT -74
3446 #define GNUTLS_E_ASN1_TYPE_ANY_ERROR -75
3447 #define GNUTLS_E_ASN1_SYNTAX_ERROR -76
3448 #define GNUTLS_E_ASN1_DER_OVERFLOW -77
3449 #define GNUTLS_E_OPENPGP_UID_REVOKED -79
3450 #define GNUTLS_E_CERTIFICATE_ERROR -43
3451 #define GNUTLS_E_X509_CERTIFICATE_ERROR GNUTLS_E_CERTIFICATE_ERROR
3452 #define GNUTLS_E_CERTIFICATE_KEY_MISMATCH -60
3453 #define GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE \
3454     -61 /* GNUTLS_A_UNSUPPORTED_CERTIFICATE */
3455 #define GNUTLS_E_X509_UNKNOWN_SAN -62
3456 #define GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED -94
3457 #define GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE -95
3458 #define GNUTLS_E_UNKNOWN_HASH_ALGORITHM -96
3459 #define GNUTLS_E_UNKNOWN_PKCS_CONTENT_TYPE -97
3460 #define GNUTLS_E_UNKNOWN_PKCS_BAG_TYPE -98
3461 #define GNUTLS_E_INVALID_PASSWORD -99
3462 #define GNUTLS_E_MAC_VERIFY_FAILED -100 /* for PKCS #12 MAC */
3463 #define GNUTLS_E_CONSTRAINT_ERROR -101
3464
3465 #define GNUTLS_E_WARNING_IA_IPHF_RECEIVED -102
3466 #define GNUTLS_E_WARNING_IA_FPHF_RECEIVED -103
3467
3468 #define GNUTLS_E_IA_VERIFY_FAILED -104
3469 #define GNUTLS_E_UNKNOWN_ALGORITHM -105
3470 #define GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM -106
3471 #define GNUTLS_E_SAFE_RENEGOTIATION_FAILED -107
3472 #define GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED -108
3473 #define GNUTLS_E_UNKNOWN_SRP_USERNAME -109
3474 #define GNUTLS_E_PREMATURE_TERMINATION -110
3475
3476 #define GNUTLS_E_MALFORMED_CIDR -111
3477
3478 #define GNUTLS_E_BASE64_ENCODING_ERROR -201
3479 #define GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY -202 /* obsolete */
3480 #define GNUTLS_E_INCOMPATIBLE_CRYPTO_LIBRARY -202
3481 #define GNUTLS_E_INCOMPATIBLE_LIBTASN1_LIBRARY -203
3482
3483 #define GNUTLS_E_OPENPGP_KEYRING_ERROR -204
3484 #define GNUTLS_E_X509_UNSUPPORTED_OID -205
3485
3486 #define GNUTLS_E_RANDOM_FAILED -206
3487 #define GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR -207
3488
3489 #define GNUTLS_E_OPENPGP_SUBKEY_ERROR -208
3490
3491 #define GNUTLS_E_CRYPTO_ALREADY_REGISTERED GNUTLS_E_ALREADY_REGISTERED
3492 #define GNUTLS_E_ALREADY_REGISTERED -209
3493
3494 #define GNUTLS_E_HANDSHAKE_TOO_LARGE -210
3495
3496 #define GNUTLS_E_CRYPTODEV_IOCTL_ERROR -211
3497 #define GNUTLS_E_CRYPTODEV_DEVICE_ERROR -212
3498
3499 #define GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE -213
3500 #define GNUTLS_E_BAD_COOKIE -214
3501 #define GNUTLS_E_OPENPGP_PREFERRED_KEY_ERROR -215
3502 #define GNUTLS_E_INCOMPAT_DSA_KEY_WITH_TLS_PROTOCOL -216
3503 #define GNUTLS_E_INSUFFICIENT_SECURITY -217
3504
3505 #define GNUTLS_E_HEARTBEAT_PONG_RECEIVED -292
3506 #define GNUTLS_E_HEARTBEAT_PING_RECEIVED -293
3507
3508 #define GNUTLS_E_UNRECOGNIZED_NAME -294
3509
3510 /* PKCS11 related */
3511 #define GNUTLS_E_PKCS11_ERROR -300
3512 #define GNUTLS_E_PKCS11_LOAD_ERROR -301
3513 #define GNUTLS_E_PARSING_ERROR -302
3514 #define GNUTLS_E_PKCS11_PIN_ERROR -303
3515
3516 #define GNUTLS_E_PKCS11_SLOT_ERROR -305
3517 #define GNUTLS_E_LOCKING_ERROR -306
3518 #define GNUTLS_E_PKCS11_ATTRIBUTE_ERROR -307
3519 #define GNUTLS_E_PKCS11_DEVICE_ERROR -308
3520 #define GNUTLS_E_PKCS11_DATA_ERROR -309
3521 #define GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR -310
3522 #define GNUTLS_E_PKCS11_KEY_ERROR -311
3523 #define GNUTLS_E_PKCS11_PIN_EXPIRED -312
3524 #define GNUTLS_E_PKCS11_PIN_LOCKED -313
3525 #define GNUTLS_E_PKCS11_SESSION_ERROR -314
3526 #define GNUTLS_E_PKCS11_SIGNATURE_ERROR -315
3527 #define GNUTLS_E_PKCS11_TOKEN_ERROR -316
3528 #define GNUTLS_E_PKCS11_USER_ERROR -317
3529
3530 #define GNUTLS_E_CRYPTO_INIT_FAILED -318
3531 #define GNUTLS_E_TIMEDOUT -319
3532 #define GNUTLS_E_USER_ERROR -320
3533 #define GNUTLS_E_ECC_NO_SUPPORTED_CURVES -321
3534 #define GNUTLS_E_ECC_UNSUPPORTED_CURVE -322
3535 #define GNUTLS_E_PKCS11_REQUESTED_OBJECT_NOT_AVAILBLE -323
3536 #define GNUTLS_E_CERTIFICATE_LIST_UNSORTED -324
3537 #define GNUTLS_E_ILLEGAL_PARAMETER -325 /* GNUTLS_A_ILLEGAL_PARAMETER */
3538 #define GNUTLS_E_NO_PRIORITIES_WERE_SET -326
3539 #define GNUTLS_E_X509_UNSUPPORTED_EXTENSION -327
3540 #define GNUTLS_E_SESSION_EOF -328
3541
3542 #define GNUTLS_E_TPM_ERROR -329
3543 #define GNUTLS_E_TPM_KEY_PASSWORD_ERROR -330
3544 #define GNUTLS_E_TPM_SRK_PASSWORD_ERROR -331
3545 #define GNUTLS_E_TPM_SESSION_ERROR -332
3546 #define GNUTLS_E_TPM_KEY_NOT_FOUND -333
3547 #define GNUTLS_E_TPM_UNINITIALIZED -334
3548 #define GNUTLS_E_TPM_NO_LIB -335
3549
3550 #define GNUTLS_E_NO_CERTIFICATE_STATUS -340
3551 #define GNUTLS_E_OCSP_RESPONSE_ERROR -341
3552 #define GNUTLS_E_RANDOM_DEVICE_ERROR -342
3553 #define GNUTLS_E_AUTH_ERROR -343
3554 #define GNUTLS_E_NO_APPLICATION_PROTOCOL -344
3555 #define GNUTLS_E_SOCKETS_INIT_ERROR -345
3556 #define GNUTLS_E_KEY_IMPORT_FAILED -346
3557 #define GNUTLS_E_INAPPROPRIATE_FALLBACK \
3558     -347 /*GNUTLS_A_INAPPROPRIATE_FALLBACK */
3559 #define GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR -348
3560 #define GNUTLS_E_PRIVKEY_VERIFICATION_ERROR -349
3561 #define GNUTLS_E_UNEXPECTED_EXTENSIONS_LENGTH -350 /*GNUTLS_A_DECODE_ERROR */
3562 #define GNUTLS_E_ASN1_EMBEDDED_NULL_IN_STRING -351
3563
3564 #define GNUTLS_E_SELF_TEST_ERROR -400
3565 #define GNUTLS_E_NO_SELF_TEST -401
3566 #define GNUTLS_E_LIB_IN_ERROR_STATE -402
3567 #define GNUTLS_E_PK_GENERATION_ERROR -403
3568 #define GNUTLS_E_IDNA_ERROR -404
3569
3570 #define GNUTLS_E_NEED_FALLBACK -405
3571 #define GNUTLS_E_SESSION_USER_ID_CHANGED -406
3572 #define GNUTLS_E_HANDSHAKE_DURING_FALSE_START -407
3573 #define GNUTLS_E_UNAVAILABLE_DURING_HANDSHAKE -408
3574 #define GNUTLS_E_PK_INVALID_PUBKEY -409
3575 #define GNUTLS_E_PK_INVALID_PRIVKEY -410
3576 #define GNUTLS_E_NOT_YET_ACTIVATED -411
3577 #define GNUTLS_E_INVALID_UTF8_STRING -412
3578 #define GNUTLS_E_NO_EMBEDDED_DATA -413
3579 #define GNUTLS_E_INVALID_UTF8_EMAIL -414
3580 #define GNUTLS_E_INVALID_PASSWORD_STRING -415
3581 #define GNUTLS_E_CERTIFICATE_TIME_ERROR -416
3582 #define GNUTLS_E_RECORD_OVERFLOW -417 /* GNUTLS_A_RECORD_OVERFLOW */
3583 #define GNUTLS_E_ASN1_TIME_ERROR -418
3584 #define GNUTLS_E_INCOMPATIBLE_SIG_WITH_KEY -419
3585 #define GNUTLS_E_PK_INVALID_PUBKEY_PARAMS -420
3586 #define GNUTLS_E_PK_NO_VALIDATION_PARAMS -421
3587 #define GNUTLS_E_OCSP_MISMATCH_WITH_CERTS -422
3588
3589 #define GNUTLS_E_NO_COMMON_KEY_SHARE -423
3590 #define GNUTLS_E_REAUTH_REQUEST -424
3591 #define GNUTLS_E_TOO_MANY_MATCHES -425
3592 #define GNUTLS_E_CRL_VERIFICATION_ERROR -426
3593 #define GNUTLS_E_MISSING_EXTENSION -427
3594 #define GNUTLS_E_DB_ENTRY_EXISTS -428
3595 #define GNUTLS_E_EARLY_DATA_REJECTED -429
3596 #define GNUTLS_E_X509_DUPLICATE_EXTENSION -430
3597
3598 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -1250
3599
3600 /* Internal errors of the library; will never be returned
3601  * to a calling application */
3602 #define GNUTLS_E_INT_RET_0 -1251
3603 #define GNUTLS_E_INT_CHECK_AGAIN -1252
3604
3605 #define GNUTLS_E_APPLICATION_ERROR_MAX -65000
3606 #define GNUTLS_E_APPLICATION_ERROR_MIN -65500
3607
3608 #ifdef __cplusplus
3609 }
3610 #endif
3611
3612 #include <gnutls/compat.h>
3613
3614 #endif /* GNUTLS_GNUTLS_H */