include/gnutls/gnutls.h

0001 /* -*- c -*-
0002  * Copyright (C) 2000-2016 Free Software Foundation, Inc.
0003  * Copyright (C) 2015-2017 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023
0024 /* This file contains the types and prototypes for all the
0025  * high level functionality of the gnutls main library.
0026  *
0027  * If the optional C++ binding was built, it is available in
0028  * gnutls/gnutlsxx.h.
0029  *
0030  * The openssl compatibility layer (which is under the GNU GPL
0031  * license) is in gnutls/openssl.h.
0032  *
0033  * The low level cipher functionality is in gnutls/crypto.h.
0034  */
0035
0036 #ifndef GNUTLS_GNUTLS_H
0037 #define GNUTLS_GNUTLS_H
0038
0039 /* Get ssize_t. */
0040 #include <sys/types.h>
0041
0042 /* Get size_t. */
0043 #include <stddef.h>
0044
0045 /* Get time_t. */
0046 #include <time.h>
0047
0048 #ifdef __cplusplus
0049 extern "C" {
0050 #endif
0051
0052 #define GNUTLS_VERSION "3.8.3"
0053
0054 /* clang-format off */
0055 #define GNUTLS_VERSION_MAJOR 3
0056 #define GNUTLS_VERSION_MINOR 8
0057 #define GNUTLS_VERSION_PATCH 3
0058
0059 #define GNUTLS_VERSION_NUMBER 0x030803
0060 /* clang-format on */
0061
0062 #define GNUTLS_CIPHER_RIJNDAEL_128_CBC GNUTLS_CIPHER_AES_128_CBC
0063 #define GNUTLS_CIPHER_RIJNDAEL_256_CBC GNUTLS_CIPHER_AES_256_CBC
0064 #define GNUTLS_CIPHER_RIJNDAEL_CBC GNUTLS_CIPHER_AES_128_CBC
0065 #define GNUTLS_CIPHER_ARCFOUR GNUTLS_CIPHER_ARCFOUR_128
0066
0067 #if !defined(GNUTLS_INTERNAL_BUILD) && defined(_WIN32)
0068 #define _SYM_EXPORT __declspec(dllimport)
0069 #else
0070 #define _SYM_EXPORT
0071 #endif
0072
0073 #ifdef __GNUC__
0074 #define __GNUTLS_CONST__ __attribute__((const))
0075 #define __GNUTLS_PURE__ __attribute__((pure))
0076 #else
0077 #define __GNUTLS_CONST__
0078 #define __GNUTLS_PURE__
0079 #endif
0080
0081 /* Use the following definition globally in your program to disable
0082  * implicit initialization of gnutls. */
0083 #define GNUTLS_SKIP_GLOBAL_INIT             \
0084     int _gnutls_global_init_skip(void); \
0085     int _gnutls_global_init_skip(void)  \
0086     {                                   \
0087         return 1;                   \
0088     }
0089
0090 /**
0091  * gnutls_cipher_algorithm_t:
0092  * @GNUTLS_CIPHER_UNKNOWN: Value to identify an unknown/unsupported algorithm.
0093  * @GNUTLS_CIPHER_NULL: The NULL (identity) encryption algorithm.
0094  * @GNUTLS_CIPHER_ARCFOUR_128: ARCFOUR stream cipher with 128-bit keys.
0095  * @GNUTLS_CIPHER_3DES_CBC: 3DES in CBC mode.
0096  * @GNUTLS_CIPHER_AES_128_CBC: AES in CBC mode with 128-bit keys.
0097  * @GNUTLS_CIPHER_AES_192_CBC: AES in CBC mode with 192-bit keys.
0098  * @GNUTLS_CIPHER_AES_256_CBC: AES in CBC mode with 256-bit keys.
0099  * @GNUTLS_CIPHER_AES_128_CFB8: AES in CFB8 mode with 128-bit keys.
0100  * @GNUTLS_CIPHER_AES_192_CFB8: AES in CFB8 mode with 192-bit keys.
0101  * @GNUTLS_CIPHER_AES_256_CFB8: AES in CFB8 mode with 256-bit keys.
0102  * @GNUTLS_CIPHER_ARCFOUR_40: ARCFOUR stream cipher with 40-bit keys.
0103  * @GNUTLS_CIPHER_CAMELLIA_128_CBC: Camellia in CBC mode with 128-bit keys.
0104  * @GNUTLS_CIPHER_CAMELLIA_192_CBC: Camellia in CBC mode with 192-bit keys.
0105  * @GNUTLS_CIPHER_CAMELLIA_256_CBC: Camellia in CBC mode with 256-bit keys.
0106  * @GNUTLS_CIPHER_RC2_40_CBC: RC2 in CBC mode with 40-bit keys.
0107  * @GNUTLS_CIPHER_DES_CBC: DES in CBC mode (56-bit keys).
0108  * @GNUTLS_CIPHER_AES_128_GCM: AES in GCM mode with 128-bit keys (AEAD).
0109  * @GNUTLS_CIPHER_AES_256_GCM: AES in GCM mode with 256-bit keys (AEAD).
0110  * @GNUTLS_CIPHER_AES_128_CCM: AES in CCM mode with 128-bit keys (AEAD).
0111  * @GNUTLS_CIPHER_AES_256_CCM: AES in CCM mode with 256-bit keys (AEAD).
0112  * @GNUTLS_CIPHER_AES_128_CCM_8: AES in CCM mode with 64-bit tag and 128-bit keys (AEAD).
0113  * @GNUTLS_CIPHER_AES_256_CCM_8: AES in CCM mode with 64-bit tag and 256-bit keys (AEAD).
0114  * @GNUTLS_CIPHER_CAMELLIA_128_GCM: CAMELLIA in GCM mode with 128-bit keys (AEAD).
0115  * @GNUTLS_CIPHER_CAMELLIA_256_GCM: CAMELLIA in GCM mode with 256-bit keys (AEAD).
0116  * @GNUTLS_CIPHER_SALSA20_256: Salsa20 with 256-bit keys.
0117  * @GNUTLS_CIPHER_ESTREAM_SALSA20_256: Estream's Salsa20 variant with 256-bit keys.
0118  * @GNUTLS_CIPHER_CHACHA20_32: Chacha20 cipher with 96-bit nonces and 32-bit block counters.
0119  * @GNUTLS_CIPHER_CHACHA20_64: Chacha20 cipher with 64-bit nonces and 64-bit block counters.
0120  * @GNUTLS_CIPHER_CHACHA20_POLY1305: The Chacha20 cipher with the Poly1305 authenticator (AEAD).
0121  * @GNUTLS_CIPHER_GOST28147_TC26Z_CFB: GOST 28147-89 (Magma) cipher in CFB mode with TC26 Z S-box.
0122  * @GNUTLS_CIPHER_GOST28147_CPA_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro A S-box.
0123  * @GNUTLS_CIPHER_GOST28147_CPB_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro B S-box.
0124  * @GNUTLS_CIPHER_GOST28147_CPC_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro C S-box.
0125  * @GNUTLS_CIPHER_GOST28147_CPD_CFB: GOST 28147-89 (Magma) cipher in CFB mode with CryptoPro D S-box.
0126  * @GNUTLS_CIPHER_AES_128_XTS: AES in XTS mode with 128-bit key + 128bit tweak key.
0127  * @GNUTLS_CIPHER_AES_256_XTS: AES in XTS mode with 256-bit key + 256bit tweak key.
0128  *                             Note that the XTS ciphers are message oriented.
0129  *                             The whole message needs to be provided with a single call, because
0130  *                             cipher-stealing requires to know where the message actually terminates
0131  *                             in order to be able to compute where the stealing occurs.
0132  * @GNUTLS_CIPHER_GOST28147_TC26Z_CNT: GOST 28147-89 (Magma) cipher in CNT mode with TC26 Z S-box.
0133  * @GNUTLS_CIPHER_MAGMA_CTR_ACPKM: GOST R 34.12-2015 (Magma) cipher in CTR-ACPKM mode.
0134  * @GNUTLS_CIPHER_KUZNYECHIK_CTR_ACPKM: GOST R 34.12-2015 (Kuznyechik) cipher in CTR-ACPKM mode.
0135  * @GNUTLS_CIPHER_IDEA_PGP_CFB: IDEA in CFB mode (placeholder - unsupported).
0136  * @GNUTLS_CIPHER_3DES_PGP_CFB: 3DES in CFB mode (placeholder - unsupported).
0137  * @GNUTLS_CIPHER_CAST5_PGP_CFB: CAST5 in CFB mode (placeholder - unsupported).
0138  * @GNUTLS_CIPHER_BLOWFISH_PGP_CFB: Blowfish in CFB mode (placeholder - unsupported).
0139  * @GNUTLS_CIPHER_SAFER_SK128_PGP_CFB: Safer-SK in CFB mode with 128-bit keys (placeholder - unsupported).
0140  * @GNUTLS_CIPHER_AES128_PGP_CFB: AES in CFB mode with 128-bit keys (placeholder - unsupported).
0141  * @GNUTLS_CIPHER_AES192_PGP_CFB: AES in CFB mode with 192-bit keys (placeholder - unsupported).
0142  * @GNUTLS_CIPHER_AES256_PGP_CFB: AES in CFB mode with 256-bit keys (placeholder - unsupported).
0143  * @GNUTLS_CIPHER_TWOFISH_PGP_CFB: Twofish in CFB mode (placeholder - unsupported).
0144  * @GNUTLS_CIPHER_AES_128_SIV: AES in SIV mode with 128-bit key.
0145  * @GNUTLS_CIPHER_AES_256_SIV: AES in SIV mode with 256-bit key.
0146  *                             Note that the SIV ciphers can only be used with
0147  *                             the AEAD interface, and the IV plays a role as
0148  *                             the authentication tag while it is prepended to
0149  *                             the cipher text.
0150  * @GNUTLS_CIPHER_AES_192_GCM: AES in GCM mode with 192-bit keys (AEAD).
0151  * @GNUTLS_CIPHER_AES_128_SIV_GCM: AES in SIV-GCM mode with 128-bit key.
0152  * @GNUTLS_CIPHER_AES_256_SIV_GCM: AES in SIV-GCM mode with 256-bit key.
0153  *
0154  * Enumeration of different symmetric encryption algorithms.
0155  */
0156 typedef enum gnutls_cipher_algorithm {
0157     GNUTLS_CIPHER_UNKNOWN = 0,
0158     GNUTLS_CIPHER_NULL = 1,
0159     GNUTLS_CIPHER_ARCFOUR_128 = 2,
0160     GNUTLS_CIPHER_3DES_CBC = 3,
0161     GNUTLS_CIPHER_AES_128_CBC = 4,
0162     GNUTLS_CIPHER_AES_256_CBC = 5,
0163     GNUTLS_CIPHER_ARCFOUR_40 = 6,
0164     GNUTLS_CIPHER_CAMELLIA_128_CBC = 7,
0165     GNUTLS_CIPHER_CAMELLIA_256_CBC = 8,
0166     GNUTLS_CIPHER_AES_192_CBC = 9,
0167     GNUTLS_CIPHER_AES_128_GCM = 10,
0168     GNUTLS_CIPHER_AES_256_GCM = 11,
0169     GNUTLS_CIPHER_CAMELLIA_192_CBC = 12,
0170     GNUTLS_CIPHER_SALSA20_256 = 13,
0171     GNUTLS_CIPHER_ESTREAM_SALSA20_256 = 14,
0172     GNUTLS_CIPHER_CAMELLIA_128_GCM = 15,
0173     GNUTLS_CIPHER_CAMELLIA_256_GCM = 16,
0174     GNUTLS_CIPHER_RC2_40_CBC = 17,
0175     GNUTLS_CIPHER_DES_CBC = 18,
0176     GNUTLS_CIPHER_AES_128_CCM = 19,
0177     GNUTLS_CIPHER_AES_256_CCM = 20,
0178     GNUTLS_CIPHER_AES_128_CCM_8 = 21,
0179     GNUTLS_CIPHER_AES_256_CCM_8 = 22,
0180     GNUTLS_CIPHER_CHACHA20_POLY1305 = 23,
0181     GNUTLS_CIPHER_GOST28147_TC26Z_CFB = 24,
0182     GNUTLS_CIPHER_GOST28147_CPA_CFB = 25,
0183     GNUTLS_CIPHER_GOST28147_CPB_CFB = 26,
0184     GNUTLS_CIPHER_GOST28147_CPC_CFB = 27,
0185     GNUTLS_CIPHER_GOST28147_CPD_CFB = 28,
0186     GNUTLS_CIPHER_AES_128_CFB8 = 29,
0187     GNUTLS_CIPHER_AES_192_CFB8 = 30,
0188     GNUTLS_CIPHER_AES_256_CFB8 = 31,
0189     GNUTLS_CIPHER_AES_128_XTS = 32,
0190     GNUTLS_CIPHER_AES_256_XTS = 33,
0191     GNUTLS_CIPHER_GOST28147_TC26Z_CNT = 34,
0192     GNUTLS_CIPHER_CHACHA20_64 = 35,
0193     GNUTLS_CIPHER_CHACHA20_32 = 36,
0194     GNUTLS_CIPHER_AES_128_SIV = 37,
0195     GNUTLS_CIPHER_AES_256_SIV = 38,
0196     GNUTLS_CIPHER_AES_192_GCM = 39,
0197     GNUTLS_CIPHER_MAGMA_CTR_ACPKM = 40,
0198     GNUTLS_CIPHER_KUZNYECHIK_CTR_ACPKM = 41,
0199     GNUTLS_CIPHER_AES_128_SIV_GCM = 42,
0200     GNUTLS_CIPHER_AES_256_SIV_GCM = 43,
0201
0202     /* used only for PGP internals. Ignored in TLS/SSL
0203      */
0204     GNUTLS_CIPHER_IDEA_PGP_CFB = 200,
0205     GNUTLS_CIPHER_3DES_PGP_CFB = 201,
0206     GNUTLS_CIPHER_CAST5_PGP_CFB = 202,
0207     GNUTLS_CIPHER_BLOWFISH_PGP_CFB = 203,
0208     GNUTLS_CIPHER_SAFER_SK128_PGP_CFB = 204,
0209     GNUTLS_CIPHER_AES128_PGP_CFB = 205,
0210     GNUTLS_CIPHER_AES192_PGP_CFB = 206,
0211     GNUTLS_CIPHER_AES256_PGP_CFB = 207,
0212     GNUTLS_CIPHER_TWOFISH_PGP_CFB = 208
0213 } gnutls_cipher_algorithm_t;
0214
0215 /**
0216  * gnutls_kx_algorithm_t:
0217  * @GNUTLS_KX_UNKNOWN: Unknown key-exchange algorithm.
0218  * @GNUTLS_KX_RSA: RSA key-exchange algorithm.
0219  * @GNUTLS_KX_DHE_DSS: DHE-DSS key-exchange algorithm.
0220  * @GNUTLS_KX_DHE_RSA: DHE-RSA key-exchange algorithm.
0221  * @GNUTLS_KX_ECDHE_RSA: ECDHE-RSA key-exchange algorithm.
0222  * @GNUTLS_KX_ECDHE_ECDSA: ECDHE-ECDSA key-exchange algorithm.
0223  * @GNUTLS_KX_ANON_DH: Anon-DH key-exchange algorithm.
0224  * @GNUTLS_KX_ANON_ECDH: Anon-ECDH key-exchange algorithm.
0225  * @GNUTLS_KX_SRP: SRP key-exchange algorithm.
0226  * @GNUTLS_KX_RSA_EXPORT: RSA-EXPORT key-exchange algorithm (defunc).
0227  * @GNUTLS_KX_SRP_RSA: SRP-RSA key-exchange algorithm.
0228  * @GNUTLS_KX_SRP_DSS: SRP-DSS key-exchange algorithm.
0229  * @GNUTLS_KX_PSK: PSK key-exchange algorithm.
0230  * @GNUTLS_KX_DHE_PSK: DHE-PSK key-exchange algorithm.
0231  * @GNUTLS_KX_ECDHE_PSK: ECDHE-PSK key-exchange algorithm.
0232  * @GNUTLS_KX_RSA_PSK: RSA-PSK key-exchange algorithm.
0233  * @GNUTLS_KX_VKO_GOST_12: VKO GOST R 34.10-2012 key-exchange algorithm.
0234  *
0235  * Enumeration of different key exchange algorithms.
0236  */
0237 typedef enum {
0238     GNUTLS_KX_UNKNOWN = 0,
0239     GNUTLS_KX_RSA = 1,
0240     GNUTLS_KX_DHE_DSS = 2,
0241     GNUTLS_KX_DHE_RSA = 3,
0242     GNUTLS_KX_ANON_DH = 4,
0243     GNUTLS_KX_SRP = 5,
0244     GNUTLS_KX_RSA_EXPORT = 6,
0245     GNUTLS_KX_SRP_RSA = 7,
0246     GNUTLS_KX_SRP_DSS = 8,
0247     GNUTLS_KX_PSK = 9,
0248     GNUTLS_KX_DHE_PSK = 10,
0249     GNUTLS_KX_ANON_ECDH = 11,
0250     GNUTLS_KX_ECDHE_RSA = 12,
0251     GNUTLS_KX_ECDHE_ECDSA = 13,
0252     GNUTLS_KX_ECDHE_PSK = 14,
0253     GNUTLS_KX_RSA_PSK = 15,
0254     GNUTLS_KX_VKO_GOST_12 = 16
0255 } gnutls_kx_algorithm_t;
0256
0257 /**
0258  * gnutls_params_type_t:
0259  * @GNUTLS_PARAMS_RSA_EXPORT: Session RSA-EXPORT parameters (defunc).
0260  * @GNUTLS_PARAMS_DH: Session Diffie-Hellman parameters.
0261  * @GNUTLS_PARAMS_ECDH: Session Elliptic-Curve Diffie-Hellman parameters.
0262  *
0263  * Enumeration of different TLS session parameter types.
0264  */
0265 typedef enum {
0266     GNUTLS_PARAMS_RSA_EXPORT = 1,
0267     GNUTLS_PARAMS_DH = 2,
0268     GNUTLS_PARAMS_ECDH = 3
0269 } gnutls_params_type_t;
0270
0271 /**
0272  * gnutls_credentials_type_t:
0273  * @GNUTLS_CRD_CERTIFICATE: Certificate credential.
0274  * @GNUTLS_CRD_ANON: Anonymous credential.
0275  * @GNUTLS_CRD_SRP: SRP credential.
0276  * @GNUTLS_CRD_PSK: PSK credential.
0277  * @GNUTLS_CRD_IA: IA credential.
0278  *
0279  * Enumeration of different credential types.
0280  */
0281 typedef enum {
0282     GNUTLS_CRD_CERTIFICATE = 1,
0283     GNUTLS_CRD_ANON,
0284     GNUTLS_CRD_SRP,
0285     GNUTLS_CRD_PSK,
0286     GNUTLS_CRD_IA
0287 } gnutls_credentials_type_t;
0288
0289 #define GNUTLS_MAC_SHA GNUTLS_MAC_SHA1
0290 #define GNUTLS_DIG_SHA GNUTLS_DIG_SHA1
0291
0292 /**
0293  * gnutls_mac_algorithm_t:
0294  * @GNUTLS_MAC_UNKNOWN: Unknown MAC algorithm.
0295  * @GNUTLS_MAC_NULL: NULL MAC algorithm (empty output).
0296  * @GNUTLS_MAC_MD5: HMAC-MD5 algorithm.
0297  * @GNUTLS_MAC_SHA1: HMAC-SHA-1 algorithm.
0298  * @GNUTLS_MAC_RMD160: HMAC-RMD160 algorithm.
0299  * @GNUTLS_MAC_MD2: HMAC-MD2 algorithm.
0300  * @GNUTLS_MAC_SHA256: HMAC-SHA-256 algorithm.
0301  * @GNUTLS_MAC_SHA384: HMAC-SHA-384 algorithm.
0302  * @GNUTLS_MAC_SHA512: HMAC-SHA-512 algorithm.
0303  * @GNUTLS_MAC_SHA224: HMAC-SHA-224 algorithm.
0304  * @GNUTLS_MAC_MD5_SHA1: Combined MD5+SHA1 MAC placeholder.
0305  * @GNUTLS_MAC_GOSTR_94: HMAC GOST R 34.11-94 algorithm.
0306  * @GNUTLS_MAC_STREEBOG_256: HMAC GOST R 34.11-2001 (Streebog) algorithm, 256 bit.
0307  * @GNUTLS_MAC_STREEBOG_512: HMAC GOST R 34.11-2001 (Streebog) algorithm, 512 bit.
0308  * @GNUTLS_MAC_AEAD: MAC implicit through AEAD cipher.
0309  * @GNUTLS_MAC_UMAC_96: The UMAC-96 MAC algorithm (requires nonce).
0310  * @GNUTLS_MAC_UMAC_128: The UMAC-128 MAC algorithm (requires nonce).
0311  * @GNUTLS_MAC_AES_CMAC_128: The AES-CMAC-128 MAC algorithm.
0312  * @GNUTLS_MAC_AES_CMAC_256: The AES-CMAC-256 MAC algorithm.
0313  * @GNUTLS_MAC_AES_GMAC_128: The AES-GMAC-128 MAC algorithm (requires nonce).
0314  * @GNUTLS_MAC_AES_GMAC_192: The AES-GMAC-192 MAC algorithm (requires nonce).
0315  * @GNUTLS_MAC_AES_GMAC_256: The AES-GMAC-256 MAC algorithm (requires nonce).
0316  * @GNUTLS_MAC_SHA3_224: Reserved; unimplemented.
0317  * @GNUTLS_MAC_SHA3_256: Reserved; unimplemented.
0318  * @GNUTLS_MAC_SHA3_384: Reserved; unimplemented.
0319  * @GNUTLS_MAC_SHA3_512: Reserved; unimplemented.
0320  * @GNUTLS_MAC_GOST28147_TC26Z_IMIT: The GOST 28147-89 working in IMIT mode with TC26 Z S-box.
0321  * @GNUTLS_MAC_SHAKE_128: Reserved; unimplemented.
0322  * @GNUTLS_MAC_SHAKE_256: Reserved; unimplemented.
0323  * @GNUTLS_MAC_MAGMA_OMAC: GOST R 34.12-2015 (Magma) in OMAC (CMAC) mode.
0324  * @GNUTLS_MAC_KUZNYECHIK_OMAC: GOST R 34.12-2015 (Kuznyechik) in OMAC (CMAC) mode.
0325  *
0326  * Enumeration of different Message Authentication Code (MAC)
0327  * algorithms.
0328  */
0329 typedef enum {
0330     GNUTLS_MAC_UNKNOWN = 0,
0331     GNUTLS_MAC_NULL = 1,
0332     GNUTLS_MAC_MD5 = 2,
0333     GNUTLS_MAC_SHA1 = 3,
0334     GNUTLS_MAC_RMD160 = 4,
0335     GNUTLS_MAC_MD2 = 5,
0336     GNUTLS_MAC_SHA256 = 6,
0337     GNUTLS_MAC_SHA384 = 7,
0338     GNUTLS_MAC_SHA512 = 8,
0339     GNUTLS_MAC_SHA224 = 9,
0340     GNUTLS_MAC_SHA3_224 = 10, /* reserved: no implementation */
0341     GNUTLS_MAC_SHA3_256 = 11, /* reserved: no implementation */
0342     GNUTLS_MAC_SHA3_384 = 12, /* reserved: no implementation */
0343     GNUTLS_MAC_SHA3_512 = 13, /* reserved: no implementation */
0344     GNUTLS_MAC_MD5_SHA1 = 14, /* reserved: no implementation */
0345     GNUTLS_MAC_GOSTR_94 = 15,
0346     GNUTLS_MAC_STREEBOG_256 = 16,
0347     GNUTLS_MAC_STREEBOG_512 = 17,
0348     /* If you add anything here, make sure you align with
0349        gnutls_digest_algorithm_t. */
0350     GNUTLS_MAC_AEAD = 200, /* indicates that MAC is on the cipher */
0351     GNUTLS_MAC_UMAC_96 = 201,
0352     GNUTLS_MAC_UMAC_128 = 202,
0353     GNUTLS_MAC_AES_CMAC_128 = 203,
0354     GNUTLS_MAC_AES_CMAC_256 = 204,
0355     GNUTLS_MAC_AES_GMAC_128 = 205,
0356     GNUTLS_MAC_AES_GMAC_192 = 206,
0357     GNUTLS_MAC_AES_GMAC_256 = 207,
0358     GNUTLS_MAC_GOST28147_TC26Z_IMIT = 208,
0359     GNUTLS_MAC_SHAKE_128 = 209,
0360     GNUTLS_MAC_SHAKE_256 = 210,
0361     GNUTLS_MAC_MAGMA_OMAC = 211,
0362     GNUTLS_MAC_KUZNYECHIK_OMAC = 212
0363 } gnutls_mac_algorithm_t;
0364
0365 /**
0366  * gnutls_digest_algorithm_t:
0367  * @GNUTLS_DIG_UNKNOWN: Unknown hash algorithm.
0368  * @GNUTLS_DIG_NULL: NULL hash algorithm (empty output).
0369  * @GNUTLS_DIG_MD5: MD5 algorithm.
0370  * @GNUTLS_DIG_SHA1: SHA-1 algorithm.
0371  * @GNUTLS_DIG_RMD160: RMD160 algorithm.
0372  * @GNUTLS_DIG_MD2: MD2 algorithm.
0373  * @GNUTLS_DIG_SHA256: SHA-256 algorithm.
0374  * @GNUTLS_DIG_SHA384: SHA-384 algorithm.
0375  * @GNUTLS_DIG_SHA512: SHA-512 algorithm.
0376  * @GNUTLS_DIG_SHA224: SHA-224 algorithm.
0377  * @GNUTLS_DIG_SHA3_224: SHA3-224 algorithm.
0378  * @GNUTLS_DIG_SHA3_256: SHA3-256 algorithm.
0379  * @GNUTLS_DIG_SHA3_384: SHA3-384 algorithm.
0380  * @GNUTLS_DIG_SHA3_512: SHA3-512 algorithm.
0381  * @GNUTLS_DIG_MD5_SHA1: Combined MD5+SHA1 algorithm.
0382  * @GNUTLS_DIG_GOSTR_94: GOST R 34.11-94 algorithm.
0383  * @GNUTLS_DIG_STREEBOG_256: GOST R 34.11-2001 (Streebog) algorithm, 256 bit.
0384  * @GNUTLS_DIG_STREEBOG_512: GOST R 34.11-2001 (Streebog) algorithm, 512 bit.
0385  * @GNUTLS_DIG_SHAKE_128: Reserved; unimplemented.
0386  * @GNUTLS_DIG_SHAKE_256: Reserved; unimplemented.
0387  *
0388  * Enumeration of different digest (hash) algorithms.
0389  */
0390 typedef enum {
0391     GNUTLS_DIG_UNKNOWN = GNUTLS_MAC_UNKNOWN,
0392     GNUTLS_DIG_NULL = GNUTLS_MAC_NULL,
0393     GNUTLS_DIG_MD5 = GNUTLS_MAC_MD5,
0394     GNUTLS_DIG_SHA1 = GNUTLS_MAC_SHA1,
0395     GNUTLS_DIG_RMD160 = GNUTLS_MAC_RMD160,
0396     GNUTLS_DIG_MD2 = GNUTLS_MAC_MD2,
0397     GNUTLS_DIG_SHA256 = GNUTLS_MAC_SHA256,
0398     GNUTLS_DIG_SHA384 = GNUTLS_MAC_SHA384,
0399     GNUTLS_DIG_SHA512 = GNUTLS_MAC_SHA512,
0400     GNUTLS_DIG_SHA224 = GNUTLS_MAC_SHA224,
0401     GNUTLS_DIG_SHA3_224 = GNUTLS_MAC_SHA3_224,
0402     GNUTLS_DIG_SHA3_256 = GNUTLS_MAC_SHA3_256,
0403     GNUTLS_DIG_SHA3_384 = GNUTLS_MAC_SHA3_384,
0404     GNUTLS_DIG_SHA3_512 = GNUTLS_MAC_SHA3_512,
0405     GNUTLS_DIG_MD5_SHA1 = GNUTLS_MAC_MD5_SHA1,
0406     GNUTLS_DIG_GOSTR_94 = GNUTLS_MAC_GOSTR_94,
0407     GNUTLS_DIG_STREEBOG_256 = GNUTLS_MAC_STREEBOG_256,
0408     GNUTLS_DIG_STREEBOG_512 = GNUTLS_MAC_STREEBOG_512,
0409     GNUTLS_DIG_SHAKE_128 = GNUTLS_MAC_SHAKE_128,
0410     GNUTLS_DIG_SHAKE_256 = GNUTLS_MAC_SHAKE_256
0411     /* If you add anything here, make sure you align with
0412            gnutls_mac_algorithm_t. */
0413 } gnutls_digest_algorithm_t;
0414
0415 /* exported for other gnutls headers. This is the maximum number of
0416    * algorithms (ciphers, kx or macs).
0417    */
0418 #define GNUTLS_MAX_ALGORITHM_NUM 128
0419 #define GNUTLS_MAX_SESSION_ID_SIZE 32
0420
0421 /**
0422  * gnutls_compression_method_t:
0423  * @GNUTLS_COMP_UNKNOWN: Unknown compression method.
0424  * @GNUTLS_COMP_NULL: The NULL compression method (no compression).
0425  * @GNUTLS_COMP_DEFLATE: The DEFLATE compression method from zlib.
0426  * @GNUTLS_COMP_ZLIB: Same as %GNUTLS_COMP_DEFLATE.
0427  * @GNUTLS_COMP_BROTLI: Brotli compression method.
0428  * @GNUTLS_COMP_ZSTD: Zstandard compression method.
0429  *
0430  * Enumeration of different TLS compression methods.
0431  */
0432 typedef enum {
0433     GNUTLS_COMP_UNKNOWN = 0,
0434     GNUTLS_COMP_NULL = 1,
0435     GNUTLS_COMP_DEFLATE = 2,
0436     GNUTLS_COMP_ZLIB = GNUTLS_COMP_DEFLATE,
0437     GNUTLS_COMP_BROTLI = 3,
0438     GNUTLS_COMP_ZSTD = 4
0439 } gnutls_compression_method_t;
0440
0441 /**
0442  * gnutls_init_flags_t:
0443  *
0444  * @GNUTLS_SERVER: Connection end is a server.
0445  * @GNUTLS_CLIENT: Connection end is a client.
0446  * @GNUTLS_DATAGRAM: Connection is datagram oriented (DTLS). Since 3.0.0.
0447  * @GNUTLS_NONBLOCK: Connection should not block. Since 3.0.0.
0448  * @GNUTLS_NO_SIGNAL: In systems where SIGPIPE is delivered on send, it will be disabled. That flag has effect in systems which support the MSG_NOSIGNAL sockets flag (since 3.4.2).
0449  * @GNUTLS_NO_DEFAULT_EXTENSIONS: Do not enable any TLS extensions by default such as session tickets and OCSP certificate status request (since 3.1.2). As TLS 1.2 and later require extensions this option is considered obsolete and should not be used.
0450  * @GNUTLS_NO_REPLAY_PROTECTION: Disable any replay protection in DTLS. This must only be used if  replay protection is achieved using other means. Since 3.2.2.
0451  * @GNUTLS_ALLOW_ID_CHANGE: Allow the peer to replace its certificate, or change its ID during a rehandshake. This change is often used in attacks and thus prohibited by default. Since 3.5.0.
0452  * @GNUTLS_ENABLE_FALSE_START: Enable the TLS false start on client side if the negotiated ciphersuites allow it. This will enable sending data prior to the handshake being complete, and may introduce a risk of crypto failure when combined with certain key exchanged; for that GnuTLS may not enable that option in ciphersuites that are known to be not safe for false start. Since 3.5.0.
0453  * @GNUTLS_ENABLE_EARLY_START: Under TLS1.3 allow the server to return earlier than the full handshake
0454  *   finish; similarly to false start the handshake will be completed once data are received by the
0455  *   client, while the server is able to transmit sooner. This is not enabled by default as it could
0456  *   break certain existing server assumptions and use-cases. Since 3.6.4.
0457  * @GNUTLS_ENABLE_EARLY_DATA: Under TLS1.3 allow the server to receive early data sent as part of the initial ClientHello (0-RTT).
0458  *   This can also be used to explicitly indicate that the client will send early data.
0459  *   This is not enabled by default as early data has weaker security properties than other data. Since 3.6.5.
0460  * @GNUTLS_FORCE_CLIENT_CERT: When in client side and only a single cert is specified, send that certificate irrespective of the issuers expected by the server. Since 3.5.0.
0461  * @GNUTLS_NO_TICKETS: Flag to indicate that the session should not use resumption with session tickets.
0462  * @GNUTLS_NO_TICKETS_TLS12: Flag to indicate that the session should not use resumption with session tickets. This flag only has effect if TLS 1.2 is used.
0463  * @GNUTLS_KEY_SHARE_TOP3: Generate key shares for the top-3 different groups which are enabled.
0464  *   That is, as each group is associated with a key type (EC, finite field, x25519), generate
0465  *   three keys using %GNUTLS_PK_DH, %GNUTLS_PK_EC, %GNUTLS_PK_ECDH_X25519 if all of them are enabled.
0466  * @GNUTLS_KEY_SHARE_TOP2: Generate key shares for the top-2 different groups which are enabled.
0467  *   For example (ECDH + x25519). This is the default.
0468  * @GNUTLS_KEY_SHARE_TOP: Generate key share for the first group which is enabled.
0469  *   For example x25519. This option is the most performant for client (less CPU spent
0470  *   generating keys), but if the server doesn't support the advertised option it may
0471  *   result to more roundtrips needed to discover the server's choice.
0472  * @GNUTLS_NO_AUTO_REKEY: Disable auto-rekeying under TLS1.3. If this option is not specified
0473  *   gnutls will force a rekey after 2^24 records have been sent.
0474  * @GNUTLS_POST_HANDSHAKE_AUTH: Enable post handshake authentication for server and client. When set and
0475  *   a server requests authentication after handshake %GNUTLS_E_REAUTH_REQUEST will be returned
0476  *   by gnutls_record_recv(). A client should then call gnutls_reauth() to re-authenticate.
0477  * @GNUTLS_SAFE_PADDING_CHECK: Flag to indicate that the TLS 1.3 padding check will be done in a
0478  *   safe way which doesn't leak the pad size based on GnuTLS processing time. This is of use to
0479  *   applications which hide the length of transferred data via the TLS1.3 padding mechanism and
0480  *   are already taking steps to hide the data processing time. This comes at a performance
0481  *   penalty.
0482  * @GNUTLS_AUTO_REAUTH: Enable transparent re-authentication in client side when the server
0483  *    requests to. That is, reauthentication is handled within gnutls_record_recv(), and
0484  *    the %GNUTLS_E_REHANDSHAKE or %GNUTLS_E_REAUTH_REQUEST are not returned. This must be
0485  *    enabled with %GNUTLS_POST_HANDSHAKE_AUTH for TLS1.3. Enabling this flag requires to restore
0486  *    interrupted calls to gnutls_record_recv() based on the output of gnutls_record_get_direction(),
0487  *    since gnutls_record_recv() could be interrupted when sending when this flag is enabled.
0488  *    Note this flag may not be used if you are using the same session for sending and receiving
0489  *    in different threads.
0490  * @GNUTLS_ENABLE_RAWPK: Allows raw public-keys to be negotiated during the handshake. Since 3.6.6.
0491  * @GNUTLS_NO_AUTO_SEND_TICKET: Under TLS1.3 disable auto-sending of
0492  *    session tickets during the handshake.
0493  * @GNUTLS_NO_END_OF_EARLY_DATA: Under TLS1.3 suppress sending EndOfEarlyData message. Since 3.7.2.
0494  * @GNUTLS_NO_STATUS_REQUEST: Prevents client from including the "status_request" TLS extension
0495  *    in the client hello, thus disabling the receival of certificate status information. Since 3.8.0.
0496  *
0497  * Enumeration of different flags for gnutls_init() function. All the flags
0498  * can be combined except @GNUTLS_SERVER and @GNUTLS_CLIENT which are mutually
0499  * exclusive.
0500  *
0501  * The key share options relate to the TLS 1.3 key share extension
0502  * which is a speculative key generation expecting that the server
0503  * would support the generated key.
0504  */
0505 typedef enum {
0506     GNUTLS_SERVER = 1,
0507     GNUTLS_CLIENT = (1 << 1),
0508     GNUTLS_DATAGRAM = (1 << 2),
0509     GNUTLS_NONBLOCK = (1 << 3),
0510     GNUTLS_NO_DEFAULT_EXTENSIONS = (1 << 4),
0511     GNUTLS_NO_REPLAY_PROTECTION = (1 << 5),
0512     GNUTLS_NO_SIGNAL = (1 << 6),
0513     GNUTLS_ALLOW_ID_CHANGE = (1 << 7),
0514     GNUTLS_ENABLE_FALSE_START = (1 << 8),
0515     GNUTLS_FORCE_CLIENT_CERT = (1 << 9),
0516     GNUTLS_NO_TICKETS = (1 << 10),
0517     GNUTLS_KEY_SHARE_TOP = (1 << 11),
0518     GNUTLS_KEY_SHARE_TOP2 = (1 << 12),
0519     GNUTLS_KEY_SHARE_TOP3 = (1 << 13),
0520     GNUTLS_POST_HANDSHAKE_AUTH = (1 << 14),
0521     GNUTLS_NO_AUTO_REKEY = (1 << 15),
0522     GNUTLS_SAFE_PADDING_CHECK = (1 << 16),
0523     GNUTLS_ENABLE_EARLY_START = (1 << 17),
0524     GNUTLS_ENABLE_RAWPK = (1 << 18),
0525     GNUTLS_AUTO_REAUTH = (1 << 19),
0526     GNUTLS_ENABLE_EARLY_DATA = (1 << 20),
0527     GNUTLS_NO_AUTO_SEND_TICKET = (1 << 21),
0528     GNUTLS_NO_END_OF_EARLY_DATA = (1 << 22),
0529     GNUTLS_NO_TICKETS_TLS12 = (1 << 23),
0530     GNUTLS_NO_STATUS_REQUEST = (1 << 24)
0531 } gnutls_init_flags_t;
0532
0533 /* compatibility defines (previous versions of gnutls
0534  * used defines instead of enumerated values). */
0535 #define GNUTLS_SERVER (1)
0536 #define GNUTLS_CLIENT (1 << 1)
0537 #define GNUTLS_DATAGRAM (1 << 2)
0538 #define GNUTLS_NONBLOCK (1 << 3)
0539 #define GNUTLS_NO_DEFAULT_EXTENSIONS (1 << 4)
0540 #define GNUTLS_NO_REPLAY_PROTECTION (1 << 5)
0541 #define GNUTLS_NO_SIGNAL (1 << 6)
0542 #define GNUTLS_ALLOW_ID_CHANGE (1 << 7)
0543 #define GNUTLS_ENABLE_FALSE_START (1 << 8)
0544 #define GNUTLS_FORCE_CLIENT_CERT (1 << 9)
0545 #define GNUTLS_NO_TICKETS (1 << 10)
0546 #define GNUTLS_ENABLE_CERT_TYPE_NEG 0
0547 // Here for compatibility reasons
0548
0549 /* Keep backward compatibility */
0550 #define GNUTLS_NO_EXTENSIONS GNUTLS_NO_DEFAULT_EXTENSIONS
0551
0552 /**
0553  * gnutls_alert_level_t:
0554  * @GNUTLS_AL_WARNING: Alert of warning severity.
0555  * @GNUTLS_AL_FATAL: Alert of fatal severity.
0556  *
0557  * Enumeration of different TLS alert severities.
0558  */
0559 typedef enum {
0560     GNUTLS_AL_WARNING = 1,
0561     GNUTLS_AL_FATAL
0562 } gnutls_alert_level_t;
0563
0564 /**
0565  * gnutls_alert_description_t:
0566  * @GNUTLS_A_CLOSE_NOTIFY: Close notify.
0567  * @GNUTLS_A_UNEXPECTED_MESSAGE: Unexpected message.
0568  * @GNUTLS_A_BAD_RECORD_MAC: Bad record MAC.
0569  * @GNUTLS_A_DECRYPTION_FAILED: Decryption failed.
0570  * @GNUTLS_A_RECORD_OVERFLOW: Record overflow.
0571  * @GNUTLS_A_DECOMPRESSION_FAILURE: Decompression failed.
0572  * @GNUTLS_A_HANDSHAKE_FAILURE: Handshake failed.
0573  * @GNUTLS_A_SSL3_NO_CERTIFICATE: No certificate.
0574  * @GNUTLS_A_BAD_CERTIFICATE: Certificate is bad.
0575  * @GNUTLS_A_UNSUPPORTED_CERTIFICATE: Certificate is not supported.
0576  * @GNUTLS_A_CERTIFICATE_REVOKED: Certificate was revoked.
0577  * @GNUTLS_A_CERTIFICATE_EXPIRED: Certificate is expired.
0578  * @GNUTLS_A_CERTIFICATE_UNKNOWN: Unknown certificate.
0579  * @GNUTLS_A_ILLEGAL_PARAMETER: Illegal parameter.
0580  * @GNUTLS_A_UNKNOWN_CA: CA is unknown.
0581  * @GNUTLS_A_ACCESS_DENIED: Access was denied.
0582  * @GNUTLS_A_DECODE_ERROR: Decode error.
0583  * @GNUTLS_A_DECRYPT_ERROR: Decrypt error.
0584  * @GNUTLS_A_EXPORT_RESTRICTION: Export restriction.
0585  * @GNUTLS_A_PROTOCOL_VERSION: Error in protocol version.
0586  * @GNUTLS_A_INSUFFICIENT_SECURITY: Insufficient security.
0587  * @GNUTLS_A_INTERNAL_ERROR: Internal error.
0588  * @GNUTLS_A_INAPPROPRIATE_FALLBACK: Inappropriate fallback,
0589  * @GNUTLS_A_USER_CANCELED: User canceled.
0590  * @GNUTLS_A_NO_RENEGOTIATION: No renegotiation is allowed.
0591  * @GNUTLS_A_MISSING_EXTENSION: An extension was expected but was not seen
0592  * @GNUTLS_A_UNSUPPORTED_EXTENSION: An unsupported extension was
0593  *   sent.
0594  * @GNUTLS_A_CERTIFICATE_UNOBTAINABLE: Could not retrieve the
0595  *   specified certificate.
0596  * @GNUTLS_A_UNRECOGNIZED_NAME: The server name sent was not
0597  *   recognized.
0598  * @GNUTLS_A_UNKNOWN_PSK_IDENTITY: The SRP/PSK username is missing
0599  *   or not known.
0600  * @GNUTLS_A_CERTIFICATE_REQUIRED: Certificate is required.
0601  * @GNUTLS_A_NO_APPLICATION_PROTOCOL: The ALPN protocol requested is
0602  *   not supported by the peer.
0603  *
0604  * Enumeration of different TLS alerts.
0605  */
0606 typedef enum {
0607     GNUTLS_A_CLOSE_NOTIFY,
0608     GNUTLS_A_UNEXPECTED_MESSAGE = 10,
0609     GNUTLS_A_BAD_RECORD_MAC = 20,
0610     GNUTLS_A_DECRYPTION_FAILED,
0611     GNUTLS_A_RECORD_OVERFLOW,
0612     GNUTLS_A_DECOMPRESSION_FAILURE = 30,
0613     GNUTLS_A_HANDSHAKE_FAILURE = 40,
0614     GNUTLS_A_SSL3_NO_CERTIFICATE = 41,
0615     GNUTLS_A_BAD_CERTIFICATE = 42,
0616     GNUTLS_A_UNSUPPORTED_CERTIFICATE,
0617     GNUTLS_A_CERTIFICATE_REVOKED,
0618     GNUTLS_A_CERTIFICATE_EXPIRED,
0619     GNUTLS_A_CERTIFICATE_UNKNOWN,
0620     GNUTLS_A_ILLEGAL_PARAMETER,
0621     GNUTLS_A_UNKNOWN_CA,
0622     GNUTLS_A_ACCESS_DENIED,
0623     GNUTLS_A_DECODE_ERROR = 50,
0624     GNUTLS_A_DECRYPT_ERROR,
0625     GNUTLS_A_EXPORT_RESTRICTION = 60,
0626     GNUTLS_A_PROTOCOL_VERSION = 70,
0627     GNUTLS_A_INSUFFICIENT_SECURITY,
0628     GNUTLS_A_INTERNAL_ERROR = 80,
0629     GNUTLS_A_INAPPROPRIATE_FALLBACK = 86,
0630     GNUTLS_A_USER_CANCELED = 90,
0631     GNUTLS_A_NO_RENEGOTIATION = 100,
0632     GNUTLS_A_MISSING_EXTENSION = 109,
0633     GNUTLS_A_UNSUPPORTED_EXTENSION = 110,
0634     GNUTLS_A_CERTIFICATE_UNOBTAINABLE = 111,
0635     GNUTLS_A_UNRECOGNIZED_NAME = 112,
0636     GNUTLS_A_UNKNOWN_PSK_IDENTITY = 115,
0637     GNUTLS_A_CERTIFICATE_REQUIRED = 116,
0638     GNUTLS_A_NO_APPLICATION_PROTOCOL = 120,
0639     GNUTLS_A_MAX = GNUTLS_A_NO_APPLICATION_PROTOCOL
0640 } gnutls_alert_description_t;
0641
0642 /**
0643  * gnutls_handshake_description_t:
0644  * @GNUTLS_HANDSHAKE_HELLO_REQUEST: Hello request.
0645  * @GNUTLS_HANDSHAKE_HELLO_VERIFY_REQUEST: DTLS Hello verify request.
0646  * @GNUTLS_HANDSHAKE_CLIENT_HELLO: Client hello.
0647  * @GNUTLS_HANDSHAKE_SERVER_HELLO: Server hello.
0648  * @GNUTLS_HANDSHAKE_END_OF_EARLY_DATA: End of early data.
0649  * @GNUTLS_HANDSHAKE_HELLO_RETRY_REQUEST: Hello retry request.
0650  * @GNUTLS_HANDSHAKE_NEW_SESSION_TICKET: New session ticket.
0651  * @GNUTLS_HANDSHAKE_CERTIFICATE_PKT: Certificate packet.
0652  * @GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE: Server key exchange.
0653  * @GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST: Certificate request.
0654  * @GNUTLS_HANDSHAKE_SERVER_HELLO_DONE: Server hello done.
0655  * @GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY: Certificate verify.
0656  * @GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE: Client key exchange.
0657  * @GNUTLS_HANDSHAKE_FINISHED: Finished.
0658  * @GNUTLS_HANDSHAKE_CERTIFICATE_STATUS: Certificate status (OCSP).
0659  * @GNUTLS_HANDSHAKE_KEY_UPDATE: TLS1.3 key update message.
0660  * @GNUTLS_HANDSHAKE_COMPRESSED_CERTIFICATE_PKT: Compressed certificate packet.
0661  * @GNUTLS_HANDSHAKE_SUPPLEMENTAL: Supplemental.
0662  * @GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC: Change Cipher Spec.
0663  * @GNUTLS_HANDSHAKE_CLIENT_HELLO_V2: SSLv2 Client Hello.
0664  * @GNUTLS_HANDSHAKE_ENCRYPTED_EXTENSIONS: Encrypted extensions message.
0665  *
0666  * Enumeration of different TLS handshake packets.
0667  */
0668 typedef enum {
0669     GNUTLS_HANDSHAKE_HELLO_REQUEST = 0,
0670     GNUTLS_HANDSHAKE_CLIENT_HELLO = 1,
0671     GNUTLS_HANDSHAKE_SERVER_HELLO = 2,
0672     GNUTLS_HANDSHAKE_HELLO_VERIFY_REQUEST = 3,
0673     GNUTLS_HANDSHAKE_NEW_SESSION_TICKET = 4,
0674     GNUTLS_HANDSHAKE_END_OF_EARLY_DATA = 5,
0675     GNUTLS_HANDSHAKE_ENCRYPTED_EXTENSIONS = 8,
0676     GNUTLS_HANDSHAKE_CERTIFICATE_PKT = 11,
0677     GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE = 12,
0678     GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST = 13,
0679     GNUTLS_HANDSHAKE_SERVER_HELLO_DONE = 14,
0680     GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY = 15,
0681     GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE = 16,
0682     GNUTLS_HANDSHAKE_FINISHED = 20,
0683     GNUTLS_HANDSHAKE_CERTIFICATE_STATUS = 22,
0684     GNUTLS_HANDSHAKE_SUPPLEMENTAL = 23,
0685     GNUTLS_HANDSHAKE_KEY_UPDATE = 24,
0686     GNUTLS_HANDSHAKE_COMPRESSED_CERTIFICATE_PKT = 25,
0687     GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC = 254,
0688     GNUTLS_HANDSHAKE_CLIENT_HELLO_V2 = 1024,
0689     GNUTLS_HANDSHAKE_HELLO_RETRY_REQUEST = 1025,
0690 } gnutls_handshake_description_t;
0691
0692 #define GNUTLS_HANDSHAKE_ANY ((unsigned int)-1)
0693
0694 const char *
0695 gnutls_handshake_description_get_name(gnutls_handshake_description_t type);
0696
0697 /**
0698  * gnutls_certificate_status_t:
0699  * @GNUTLS_CERT_INVALID: The certificate is not signed by one of the
0700  *   known authorities or the signature is invalid (deprecated by the flags
0701  *   %GNUTLS_CERT_SIGNATURE_FAILURE and %GNUTLS_CERT_SIGNER_NOT_FOUND).
0702  * @GNUTLS_CERT_SIGNATURE_FAILURE: The signature verification failed.
0703  * @GNUTLS_CERT_REVOKED: Certificate is revoked by its authority.  In X.509 this will be
0704  *   set only if CRLs are checked.
0705  * @GNUTLS_CERT_SIGNER_NOT_FOUND: The certificate's issuer is not known.
0706  *   This is the case if the issuer is not included in the trusted certificate list.
0707  * @GNUTLS_CERT_SIGNER_NOT_CA: The certificate's signer was not a CA. This
0708  *   may happen if this was a version 1 certificate, which is common with
0709  *   some CAs, or a version 3 certificate without the basic constrains extension.
0710  * @GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: The certificate's signer constraints were
0711  *   violated.
0712  * @GNUTLS_CERT_INSECURE_ALGORITHM:  The certificate was signed using an insecure
0713  *   algorithm such as MD2 or MD5. These algorithms have been broken and
0714  *   should not be trusted.
0715  * @GNUTLS_CERT_NOT_ACTIVATED: The certificate is not yet activated.
0716  * @GNUTLS_CERT_EXPIRED: The certificate has expired.
0717  * @GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: The revocation data are old and have been superseded.
0718  * @GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: The revocation data have a future issue date.
0719  * @GNUTLS_CERT_UNEXPECTED_OWNER: The owner is not the expected one.
0720  * @GNUTLS_CERT_MISMATCH: The certificate presented isn't the expected one (TOFU)
0721  * @GNUTLS_CERT_PURPOSE_MISMATCH: The certificate or an intermediate does not match the intended purpose (extended key usage).
0722  * @GNUTLS_CERT_MISSING_OCSP_STATUS: The certificate requires the server to send the certificate status, but no status was received.
0723  * @GNUTLS_CERT_INVALID_OCSP_STATUS: The received OCSP status response is invalid.
0724  * @GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS: The certificate has extensions marked as critical which are not supported.
0725  *
0726  * Enumeration of certificate status codes.  Note that the status
0727  * bits may have different meanings in OpenPGP keys and X.509
0728  * certificate verification.
0729  */
0730 typedef enum {
0731     GNUTLS_CERT_INVALID = 1 << 1,
0732     GNUTLS_CERT_REVOKED = 1 << 5,
0733     GNUTLS_CERT_SIGNER_NOT_FOUND = 1 << 6,
0734     GNUTLS_CERT_SIGNER_NOT_CA = 1 << 7,
0735     GNUTLS_CERT_INSECURE_ALGORITHM = 1 << 8,
0736     GNUTLS_CERT_NOT_ACTIVATED = 1 << 9,
0737     GNUTLS_CERT_EXPIRED = 1 << 10,
0738     GNUTLS_CERT_SIGNATURE_FAILURE = 1 << 11,
0739     GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED = 1 << 12,
0740     GNUTLS_CERT_UNEXPECTED_OWNER = 1 << 14,
0741     GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE = 1 << 15,
0742     GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE = 1 << 16,
0743     GNUTLS_CERT_MISMATCH = 1 << 17,
0744     GNUTLS_CERT_PURPOSE_MISMATCH = 1 << 18,
0745     GNUTLS_CERT_MISSING_OCSP_STATUS = 1 << 19,
0746     GNUTLS_CERT_INVALID_OCSP_STATUS = 1 << 20,
0747     GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS = 1 << 21
0748 } gnutls_certificate_status_t;
0749
0750 /**
0751  * gnutls_certificate_request_t:
0752  * @GNUTLS_CERT_IGNORE: Ignore certificate.
0753  * @GNUTLS_CERT_REQUEST: Request certificate.
0754  * @GNUTLS_CERT_REQUIRE: Require certificate.
0755  *
0756  * Enumeration of certificate request types.
0757  */
0758 typedef enum {
0759     GNUTLS_CERT_IGNORE = 0,
0760     GNUTLS_CERT_REQUEST = 1,
0761     GNUTLS_CERT_REQUIRE = 2
0762 } gnutls_certificate_request_t;
0763
0764 /**
0765  * gnutls_openpgp_crt_status_t:
0766  * @GNUTLS_OPENPGP_CERT: Send entire certificate.
0767  * @GNUTLS_OPENPGP_CERT_FINGERPRINT: Send only certificate fingerprint.
0768  *
0769  * Enumeration of ways to send OpenPGP certificate.
0770  */
0771 typedef enum {
0772     GNUTLS_OPENPGP_CERT = 0,
0773     GNUTLS_OPENPGP_CERT_FINGERPRINT = 1
0774 } gnutls_openpgp_crt_status_t;
0775
0776 /**
0777  * gnutls_close_request_t:
0778  * @GNUTLS_SHUT_RDWR: Disallow further receives/sends.
0779  * @GNUTLS_SHUT_WR: Disallow further sends.
0780  *
0781  * Enumeration of how TLS session should be terminated.  See gnutls_bye().
0782  */
0783 typedef enum {
0784     GNUTLS_SHUT_RDWR = 0,
0785     GNUTLS_SHUT_WR = 1
0786 } gnutls_close_request_t;
0787
0788 /**
0789  * gnutls_protocol_t:
0790  * @GNUTLS_SSL3: SSL version 3.0.
0791  * @GNUTLS_TLS1_0: TLS version 1.0.
0792  * @GNUTLS_TLS1: Same as %GNUTLS_TLS1_0.
0793  * @GNUTLS_TLS1_1: TLS version 1.1.
0794  * @GNUTLS_TLS1_2: TLS version 1.2.
0795  * @GNUTLS_TLS1_3: TLS version 1.3.
0796  * @GNUTLS_DTLS1_0: DTLS version 1.0.
0797  * @GNUTLS_DTLS1_2: DTLS version 1.2.
0798  * @GNUTLS_DTLS0_9: DTLS version 0.9 (Cisco AnyConnect / OpenSSL 0.9.8e).
0799  * @GNUTLS_TLS_VERSION_MAX: Maps to the highest supported TLS version.
0800  * @GNUTLS_DTLS_VERSION_MAX: Maps to the highest supported DTLS version.
0801  * @GNUTLS_VERSION_UNKNOWN: Unknown SSL/TLS version.
0802  *
0803  * Enumeration of different SSL/TLS protocol versions.
0804  */
0805 typedef enum {
0806     GNUTLS_SSL3 = 1,
0807     GNUTLS_TLS1_0 = 2,
0808     GNUTLS_TLS1 = GNUTLS_TLS1_0,
0809     GNUTLS_TLS1_1 = 3,
0810     GNUTLS_TLS1_2 = 4,
0811     GNUTLS_TLS1_3 = 5,
0812
0813     GNUTLS_DTLS0_9 = 200,
0814     GNUTLS_DTLS1_0 = 201, /* 201 */
0815     GNUTLS_DTLS1_2 = 202,
0816     GNUTLS_DTLS_VERSION_MIN = GNUTLS_DTLS0_9,
0817     GNUTLS_DTLS_VERSION_MAX = GNUTLS_DTLS1_2,
0818     GNUTLS_TLS_VERSION_MAX = GNUTLS_TLS1_3,
0819     GNUTLS_VERSION_UNKNOWN = 0xff /* change it to 0xffff */
0820 } gnutls_protocol_t;
0821
0822 #define GNUTLS_CRT_RAW GNUTLS_CRT_RAWPK
0823
0824 /**
0825  * gnutls_certificate_type_t:
0826  * @GNUTLS_CRT_UNKNOWN: Unknown certificate type.
0827  * @GNUTLS_CRT_X509: X.509 Certificate.
0828  * @GNUTLS_CRT_OPENPGP: OpenPGP certificate.
0829  * @GNUTLS_CRT_RAWPK: Raw public-key (SubjectPublicKeyInfo)
0830  *
0831  * Enumeration of different certificate types.
0832  */
0833 typedef enum {
0834     GNUTLS_CRT_UNKNOWN = 0,
0835     GNUTLS_CRT_X509 = 1,
0836     GNUTLS_CRT_OPENPGP = 2,
0837     GNUTLS_CRT_RAWPK = 3,
0838     GNUTLS_CRT_MAX = GNUTLS_CRT_RAWPK
0839 } gnutls_certificate_type_t;
0840
0841 /**
0842  * gnutls_x509_crt_fmt_t:
0843  * @GNUTLS_X509_FMT_DER: X.509 certificate in DER format (binary).
0844  * @GNUTLS_X509_FMT_PEM: X.509 certificate in PEM format (text).
0845  *
0846  * Enumeration of different certificate encoding formats.
0847  */
0848 typedef enum {
0849     GNUTLS_X509_FMT_DER = 0,
0850     GNUTLS_X509_FMT_PEM = 1
0851 } gnutls_x509_crt_fmt_t;
0852
0853 /**
0854  * gnutls_certificate_print_formats_t:
0855  * @GNUTLS_CRT_PRINT_FULL: Full information about certificate.
0856  * @GNUTLS_CRT_PRINT_FULL_NUMBERS: Full information about certificate and include easy to parse public key parameters.
0857  * @GNUTLS_CRT_PRINT_COMPACT: Information about certificate name in one line, plus identification of the public key.
0858  * @GNUTLS_CRT_PRINT_ONELINE: Information about certificate in one line.
0859  * @GNUTLS_CRT_PRINT_UNSIGNED_FULL: All info for an unsigned certificate.
0860  *
0861  * Enumeration of different certificate printing variants.
0862  */
0863 typedef enum gnutls_certificate_print_formats {
0864     GNUTLS_CRT_PRINT_FULL = 0,
0865     GNUTLS_CRT_PRINT_ONELINE = 1,
0866     GNUTLS_CRT_PRINT_UNSIGNED_FULL = 2,
0867     GNUTLS_CRT_PRINT_COMPACT = 3,
0868     GNUTLS_CRT_PRINT_FULL_NUMBERS = 4
0869 } gnutls_certificate_print_formats_t;
0870
0871 #define GNUTLS_PK_ECC GNUTLS_PK_ECDSA
0872 #define GNUTLS_PK_EC GNUTLS_PK_ECDSA
0873
0874 #define GNUTLS_PK_ECDHX GNUTLS_PK_ECDH_X25519
0875 /**
0876  * gnutls_pk_algorithm_t:
0877  * @GNUTLS_PK_UNKNOWN: Unknown public-key algorithm.
0878  * @GNUTLS_PK_RSA: RSA public-key algorithm.
0879  * @GNUTLS_PK_RSA_PSS: RSA public-key algorithm, with PSS padding.
0880  * @GNUTLS_PK_DSA: DSA public-key algorithm.
0881  * @GNUTLS_PK_DH: Diffie-Hellman algorithm. Used to generate parameters.
0882  * @GNUTLS_PK_ECDSA: Elliptic curve algorithm. These parameters are compatible with the ECDSA and ECDH algorithm.
0883  * @GNUTLS_PK_ECDH_X25519: Elliptic curve algorithm, restricted to ECDH as per rfc7748.
0884  * @GNUTLS_PK_EDDSA_ED25519: Edwards curve Digital signature algorithm. Used with SHA512 on signatures.
0885  * @GNUTLS_PK_GOST_01: GOST R 34.10-2001 algorithm per rfc5832.
0886  * @GNUTLS_PK_GOST_12_256: GOST R 34.10-2012 algorithm, 256-bit key per rfc7091.
0887  * @GNUTLS_PK_GOST_12_512: GOST R 34.10-2012 algorithm, 512-bit key per rfc7091.
0888  * @GNUTLS_PK_ECDH_X448: Elliptic curve algorithm, restricted to ECDH as per rfc7748.
0889  * @GNUTLS_PK_EDDSA_ED448: Edwards curve Digital signature algorithm. Used with SHAKE256 on signatures.
0890  *
0891  * Enumeration of different public-key algorithms.
0892  */
0893 typedef enum {
0894     GNUTLS_PK_UNKNOWN = 0,
0895     GNUTLS_PK_RSA = 1,
0896     GNUTLS_PK_DSA = 2,
0897     GNUTLS_PK_DH = 3,
0898     GNUTLS_PK_ECDSA = 4,
0899     GNUTLS_PK_ECDH_X25519 = 5,
0900     GNUTLS_PK_RSA_PSS = 6,
0901     GNUTLS_PK_EDDSA_ED25519 = 7,
0902     GNUTLS_PK_GOST_01 = 8,
0903     GNUTLS_PK_GOST_12_256 = 9,
0904     GNUTLS_PK_GOST_12_512 = 10,
0905     GNUTLS_PK_ECDH_X448 = 11,
0906     GNUTLS_PK_EDDSA_ED448 = 12,
0907     GNUTLS_PK_MAX = GNUTLS_PK_EDDSA_ED448
0908 } gnutls_pk_algorithm_t;
0909
0910 const char *gnutls_pk_algorithm_get_name(gnutls_pk_algorithm_t algorithm);
0911
0912 /**
0913  * gnutls_sign_algorithm_t:
0914  * @GNUTLS_SIGN_UNKNOWN: Unknown signature algorithm.
0915  * @GNUTLS_SIGN_RSA_RAW: Digital signature algorithm RSA with DigestInfo formatted data
0916  * @GNUTLS_SIGN_RSA_SHA1: Digital signature algorithm RSA with SHA-1
0917  * @GNUTLS_SIGN_RSA_SHA: Same as %GNUTLS_SIGN_RSA_SHA1.
0918  * @GNUTLS_SIGN_DSA_SHA1: Digital signature algorithm DSA with SHA-1
0919  * @GNUTLS_SIGN_DSA_SHA224: Digital signature algorithm DSA with SHA-224
0920  * @GNUTLS_SIGN_DSA_SHA256: Digital signature algorithm DSA with SHA-256
0921  * @GNUTLS_SIGN_DSA_SHA384: Digital signature algorithm DSA with SHA-384
0922  * @GNUTLS_SIGN_DSA_SHA512: Digital signature algorithm DSA with SHA-512
0923  * @GNUTLS_SIGN_DSA_SHA: Same as %GNUTLS_SIGN_DSA_SHA1.
0924  * @GNUTLS_SIGN_RSA_MD5: Digital signature algorithm RSA with MD5.
0925  * @GNUTLS_SIGN_RSA_MD2: Digital signature algorithm RSA with MD2.
0926  * @GNUTLS_SIGN_RSA_RMD160: Digital signature algorithm RSA with RMD-160.
0927  * @GNUTLS_SIGN_RSA_SHA256: Digital signature algorithm RSA with SHA-256.
0928  * @GNUTLS_SIGN_RSA_SHA384: Digital signature algorithm RSA with SHA-384.
0929  * @GNUTLS_SIGN_RSA_SHA512: Digital signature algorithm RSA with SHA-512.
0930  * @GNUTLS_SIGN_RSA_SHA224: Digital signature algorithm RSA with SHA-224.
0931  * @GNUTLS_SIGN_ECDSA_SHA1: ECDSA with SHA1.
0932  * @GNUTLS_SIGN_ECDSA_SHA224: Digital signature algorithm ECDSA with SHA-224.
0933  * @GNUTLS_SIGN_ECDSA_SHA256: Digital signature algorithm ECDSA with SHA-256.
0934  * @GNUTLS_SIGN_ECDSA_SHA384: Digital signature algorithm ECDSA with SHA-384.
0935  * @GNUTLS_SIGN_ECDSA_SHA512: Digital signature algorithm ECDSA with SHA-512.
0936  * @GNUTLS_SIGN_ECDSA_SECP256R1_SHA256: Digital signature algorithm ECDSA-SECP256R1 with SHA-256 (used in TLS 1.3 but not PKIX).
0937  * @GNUTLS_SIGN_ECDSA_SECP384R1_SHA384: Digital signature algorithm ECDSA-SECP384R1 with SHA-384 (used in TLS 1.3 but not PKIX).
0938  * @GNUTLS_SIGN_ECDSA_SECP521R1_SHA512: Digital signature algorithm ECDSA-SECP521R1 with SHA-512 (used in TLS 1.3 but not PKIX).
0939  * @GNUTLS_SIGN_ECDSA_SHA3_224: Digital signature algorithm ECDSA with SHA3-224.
0940  * @GNUTLS_SIGN_ECDSA_SHA3_256: Digital signature algorithm ECDSA with SHA3-256.
0941  * @GNUTLS_SIGN_ECDSA_SHA3_384: Digital signature algorithm ECDSA with SHA3-384.
0942  * @GNUTLS_SIGN_ECDSA_SHA3_512: Digital signature algorithm ECDSA with SHA3-512.
0943  * @GNUTLS_SIGN_DSA_SHA3_224: Digital signature algorithm DSA with SHA3-224.
0944  * @GNUTLS_SIGN_DSA_SHA3_256: Digital signature algorithm DSA with SHA3-256.
0945  * @GNUTLS_SIGN_DSA_SHA3_384: Digital signature algorithm DSA with SHA3-384.
0946  * @GNUTLS_SIGN_DSA_SHA3_512: Digital signature algorithm DSA with SHA3-512.
0947  * @GNUTLS_SIGN_RSA_SHA3_224: Digital signature algorithm RSA with SHA3-224.
0948  * @GNUTLS_SIGN_RSA_SHA3_256: Digital signature algorithm RSA with SHA3-256.
0949  * @GNUTLS_SIGN_RSA_SHA3_384: Digital signature algorithm RSA with SHA3-384.
0950  * @GNUTLS_SIGN_RSA_SHA3_512: Digital signature algorithm RSA with SHA3-512.
0951  * @GNUTLS_SIGN_RSA_PSS_RSAE_SHA256: Digital signature algorithm RSA with SHA-256,
0952  *      with PSS padding (RSA PKCS#1 1.5 certificate). This signature is identical
0953  *      to #GNUTLS_SIGN_RSA_PSS_SHA256, but they are distinct as the TLS1.3 protocol
0954  *      treats them differently.
0955  * @GNUTLS_SIGN_RSA_PSS_RSAE_SHA384: Digital signature algorithm RSA with SHA-384,
0956  *      with PSS padding (RSA PKCS#1 1.5 certificate). This signature is identical
0957  *      to #GNUTLS_SIGN_RSA_PSS_SHA384, but they are distinct as the TLS1.3 protocol
0958  *      treats them differently.
0959  * @GNUTLS_SIGN_RSA_PSS_RSAE_SHA512: Digital signature algorithm RSA with SHA-512,
0960  *      with PSS padding (RSA PKCS#1 1.5 certificate). This signature is identical
0961  *      to #GNUTLS_SIGN_RSA_PSS_SHA512, but they are distinct as the TLS1.3 protocol
0962  *      treats them differently.
0963  * @GNUTLS_SIGN_RSA_PSS_SHA256: Digital signature algorithm RSA with SHA-256, with PSS padding (RSA-PSS certificate).
0964  * @GNUTLS_SIGN_RSA_PSS_SHA384: Digital signature algorithm RSA with SHA-384, with PSS padding (RSA-PSS certificate).
0965  * @GNUTLS_SIGN_RSA_PSS_SHA512: Digital signature algorithm RSA with SHA-512, with PSS padding (RSA-PSS certificate).
0966  * @GNUTLS_SIGN_EDDSA_ED25519: Digital signature algorithm EdDSA with Ed25519 curve.
0967  * @GNUTLS_SIGN_GOST_94: Digital signature algorithm GOST R 34.10-2001 with GOST R 34.11-94
0968  * @GNUTLS_SIGN_GOST_256: Digital signature algorithm GOST R 34.10-2012 with GOST R 34.11-2012 256 bit
0969  * @GNUTLS_SIGN_GOST_512: Digital signature algorithm GOST R 34.10-2012 with GOST R 34.11-2012 512 bit
0970  * @GNUTLS_SIGN_EDDSA_ED448: Digital signature algorithm EdDSA with Ed448 curve.
0971  *
0972  * Enumeration of different digital signature algorithms.
0973  */
0974 typedef enum {
0975     GNUTLS_SIGN_UNKNOWN = 0,
0976     GNUTLS_SIGN_RSA_SHA1 = 1,
0977     GNUTLS_SIGN_RSA_SHA = GNUTLS_SIGN_RSA_SHA1,
0978     GNUTLS_SIGN_DSA_SHA1 = 2,
0979     GNUTLS_SIGN_DSA_SHA = GNUTLS_SIGN_DSA_SHA1,
0980     GNUTLS_SIGN_RSA_MD5 = 3,
0981     GNUTLS_SIGN_RSA_MD2 = 4,
0982     GNUTLS_SIGN_RSA_RMD160 = 5,
0983     GNUTLS_SIGN_RSA_SHA256 = 6,
0984     GNUTLS_SIGN_RSA_SHA384 = 7,
0985     GNUTLS_SIGN_RSA_SHA512 = 8,
0986     GNUTLS_SIGN_RSA_SHA224 = 9,
0987     GNUTLS_SIGN_DSA_SHA224 = 10,
0988     GNUTLS_SIGN_DSA_SHA256 = 11,
0989     GNUTLS_SIGN_ECDSA_SHA1 = 12,
0990     GNUTLS_SIGN_ECDSA_SHA224 = 13,
0991     GNUTLS_SIGN_ECDSA_SHA256 = 14,
0992     GNUTLS_SIGN_ECDSA_SHA384 = 15,
0993     GNUTLS_SIGN_ECDSA_SHA512 = 16,
0994     GNUTLS_SIGN_DSA_SHA384 = 17,
0995     GNUTLS_SIGN_DSA_SHA512 = 18,
0996     GNUTLS_SIGN_ECDSA_SHA3_224 = 20,
0997     GNUTLS_SIGN_ECDSA_SHA3_256 = 21,
0998     GNUTLS_SIGN_ECDSA_SHA3_384 = 22,
0999     GNUTLS_SIGN_ECDSA_SHA3_512 = 23,
1000
1001     GNUTLS_SIGN_DSA_SHA3_224 = 24,
1002     GNUTLS_SIGN_DSA_SHA3_256 = 25,
1003     GNUTLS_SIGN_DSA_SHA3_384 = 26,
1004     GNUTLS_SIGN_DSA_SHA3_512 = 27,
1005     GNUTLS_SIGN_RSA_SHA3_224 = 28,
1006     GNUTLS_SIGN_RSA_SHA3_256 = 29,
1007     GNUTLS_SIGN_RSA_SHA3_384 = 30,
1008     GNUTLS_SIGN_RSA_SHA3_512 = 31,
1009
1010     GNUTLS_SIGN_RSA_PSS_SHA256 = 32,
1011     GNUTLS_SIGN_RSA_PSS_SHA384 = 33,
1012     GNUTLS_SIGN_RSA_PSS_SHA512 = 34,
1013     GNUTLS_SIGN_EDDSA_ED25519 = 35,
1014     GNUTLS_SIGN_RSA_RAW = 36,
1015
1016     GNUTLS_SIGN_ECDSA_SECP256R1_SHA256 = 37,
1017     GNUTLS_SIGN_ECDSA_SECP384R1_SHA384 = 38,
1018     GNUTLS_SIGN_ECDSA_SECP521R1_SHA512 = 39,
1019
1020     GNUTLS_SIGN_RSA_PSS_RSAE_SHA256 = 40,
1021     GNUTLS_SIGN_RSA_PSS_RSAE_SHA384 = 41,
1022     GNUTLS_SIGN_RSA_PSS_RSAE_SHA512 = 42,
1023
1024     GNUTLS_SIGN_GOST_94 = 43,
1025     GNUTLS_SIGN_GOST_256 = 44,
1026     GNUTLS_SIGN_GOST_512 = 45,
1027     GNUTLS_SIGN_EDDSA_ED448 = 46,
1028     GNUTLS_SIGN_MAX = GNUTLS_SIGN_EDDSA_ED448
1029 } gnutls_sign_algorithm_t;
1030
1031 /**
1032  * gnutls_ecc_curve_t:
1033  * @GNUTLS_ECC_CURVE_INVALID: Cannot be known
1034  * @GNUTLS_ECC_CURVE_SECP192R1: the SECP192R1 curve
1035  * @GNUTLS_ECC_CURVE_SECP224R1: the SECP224R1 curve
1036  * @GNUTLS_ECC_CURVE_SECP256R1: the SECP256R1 curve
1037  * @GNUTLS_ECC_CURVE_SECP384R1: the SECP384R1 curve
1038  * @GNUTLS_ECC_CURVE_SECP521R1: the SECP521R1 curve
1039  * @GNUTLS_ECC_CURVE_X25519: the X25519 curve (ECDH only)
1040  * @GNUTLS_ECC_CURVE_ED25519: the Ed25519 curve
1041  * @GNUTLS_ECC_CURVE_GOST256CPA: GOST R 34.10 CryptoPro 256 A curve
1042  * @GNUTLS_ECC_CURVE_GOST256CPB: GOST R 34.10 CryptoPro 256 B curve
1043  * @GNUTLS_ECC_CURVE_GOST256CPC: GOST R 34.10 CryptoPro 256 C curve
1044  * @GNUTLS_ECC_CURVE_GOST256CPXA: GOST R 34.10 CryptoPro 256 XchA curve
1045  * @GNUTLS_ECC_CURVE_GOST256CPXB: GOST R 34.10 CryptoPro 256 XchB curve
1046  * @GNUTLS_ECC_CURVE_GOST512A: GOST R 34.10 TC26 512 A curve
1047  * @GNUTLS_ECC_CURVE_GOST512B: GOST R 34.10 TC26 512 B curve
1048  * @GNUTLS_ECC_CURVE_GOST512C: GOST R 34.10 TC26 512 C curve
1049  * @GNUTLS_ECC_CURVE_GOST256A: GOST R 34.10 TC26 256 A curve
1050  * @GNUTLS_ECC_CURVE_GOST256B: GOST R 34.10 TC26 256 B curve
1051  * @GNUTLS_ECC_CURVE_GOST256C: GOST R 34.10 TC26 256 C curve
1052  * @GNUTLS_ECC_CURVE_GOST256D: GOST R 34.10 TC26 256 D curve
1053  * @GNUTLS_ECC_CURVE_X448: the X448 curve (ECDH only)
1054  * @GNUTLS_ECC_CURVE_ED448: the Ed448 curve
1055  *
1056  * Enumeration of ECC curves.
1057  */
1058 typedef enum {
1059     GNUTLS_ECC_CURVE_INVALID = 0,
1060     GNUTLS_ECC_CURVE_SECP224R1,
1061     GNUTLS_ECC_CURVE_SECP256R1,
1062     GNUTLS_ECC_CURVE_SECP384R1,
1063     GNUTLS_ECC_CURVE_SECP521R1,
1064     GNUTLS_ECC_CURVE_SECP192R1,
1065     GNUTLS_ECC_CURVE_X25519,
1066     GNUTLS_ECC_CURVE_ED25519,
1067     GNUTLS_ECC_CURVE_GOST256CPA,
1068     GNUTLS_ECC_CURVE_GOST256CPB,
1069     GNUTLS_ECC_CURVE_GOST256CPC,
1070     GNUTLS_ECC_CURVE_GOST256CPXA,
1071     GNUTLS_ECC_CURVE_GOST256CPXB,
1072     GNUTLS_ECC_CURVE_GOST512A,
1073     GNUTLS_ECC_CURVE_GOST512B,
1074     GNUTLS_ECC_CURVE_GOST512C,
1075     GNUTLS_ECC_CURVE_GOST256A,
1076     GNUTLS_ECC_CURVE_GOST256B,
1077     GNUTLS_ECC_CURVE_GOST256C,
1078     GNUTLS_ECC_CURVE_GOST256D,
1079     GNUTLS_ECC_CURVE_X448,
1080     GNUTLS_ECC_CURVE_ED448,
1081     GNUTLS_ECC_CURVE_MAX = GNUTLS_ECC_CURVE_ED448
1082 } gnutls_ecc_curve_t;
1083
1084 /**
1085  * gnutls_group_t:
1086  * @GNUTLS_GROUP_INVALID: Indicates unknown/invalid group
1087  * @GNUTLS_GROUP_SECP192R1: the SECP192R1 curve group (legacy, only for TLS 1.2 compatibility)
1088  * @GNUTLS_GROUP_SECP224R1: the SECP224R1 curve group (legacy, only for TLS 1.2 compatibility)
1089  * @GNUTLS_GROUP_SECP256R1: the SECP256R1 curve group
1090  * @GNUTLS_GROUP_SECP384R1: the SECP384R1 curve group
1091  * @GNUTLS_GROUP_SECP521R1: the SECP521R1 curve group
1092  * @GNUTLS_GROUP_X25519: the X25519 curve group
1093  * @GNUTLS_GROUP_GC256A: the GOST R 34.10 TC26 256 A curve group
1094  * @GNUTLS_GROUP_GC256B: the GOST R 34.10 TC26 256 B curve group
1095  * @GNUTLS_GROUP_GC256C: the GOST R 34.10 TC26 256 C curve group
1096  * @GNUTLS_GROUP_GC256D: the GOST R 34.10 TC26 256 D curve group
1097  * @GNUTLS_GROUP_GC512A: the GOST R 34.10 TC26 512 A curve group
1098  * @GNUTLS_GROUP_GC512B: the GOST R 34.10 TC26 512 B curve group
1099  * @GNUTLS_GROUP_GC512C: the GOST R 34.10 TC26 512 C curve group
1100  * @GNUTLS_GROUP_FFDHE2048: the FFDHE2048 group
1101  * @GNUTLS_GROUP_FFDHE3072: the FFDHE3072 group
1102  * @GNUTLS_GROUP_FFDHE4096: the FFDHE4096 group
1103  * @GNUTLS_GROUP_FFDHE6144: the FFDHE6144 group
1104  * @GNUTLS_GROUP_FFDHE8192: the FFDHE8192 group
1105  * @GNUTLS_GROUP_X448: the X448 curve group
1106  *
1107  * Enumeration of supported groups. It is intended to be backwards
1108  * compatible with the enumerations in %gnutls_ecc_curve_t for the groups
1109  * which are valid elliptic curves.
1110  */
1111 typedef enum {
1112     GNUTLS_GROUP_INVALID = 0,
1113     GNUTLS_GROUP_SECP192R1 = GNUTLS_ECC_CURVE_SECP192R1,
1114     GNUTLS_GROUP_SECP224R1 = GNUTLS_ECC_CURVE_SECP224R1,
1115     GNUTLS_GROUP_SECP256R1 = GNUTLS_ECC_CURVE_SECP256R1,
1116     GNUTLS_GROUP_SECP384R1 = GNUTLS_ECC_CURVE_SECP384R1,
1117     GNUTLS_GROUP_SECP521R1 = GNUTLS_ECC_CURVE_SECP521R1,
1118     GNUTLS_GROUP_X25519 = GNUTLS_ECC_CURVE_X25519,
1119     GNUTLS_GROUP_X448 = GNUTLS_ECC_CURVE_X448,
1120
1121     GNUTLS_GROUP_GC256A = GNUTLS_ECC_CURVE_GOST256A,
1122     GNUTLS_GROUP_GC256B = GNUTLS_ECC_CURVE_GOST256B,
1123     GNUTLS_GROUP_GC256C = GNUTLS_ECC_CURVE_GOST256C,
1124     GNUTLS_GROUP_GC256D = GNUTLS_ECC_CURVE_GOST256D,
1125     GNUTLS_GROUP_GC512A = GNUTLS_ECC_CURVE_GOST512A,
1126     GNUTLS_GROUP_GC512B = GNUTLS_ECC_CURVE_GOST512B,
1127     GNUTLS_GROUP_GC512C = GNUTLS_ECC_CURVE_GOST512C,
1128
1129     GNUTLS_GROUP_FFDHE2048 = 256,
1130     GNUTLS_GROUP_FFDHE3072,
1131     GNUTLS_GROUP_FFDHE4096,
1132     GNUTLS_GROUP_FFDHE8192,
1133     GNUTLS_GROUP_FFDHE6144,
1134     GNUTLS_GROUP_MAX = GNUTLS_GROUP_FFDHE6144,
1135 } gnutls_group_t;
1136
1137 /* macros to allow specifying a specific curve in gnutls_privkey_generate()
1138  * and gnutls_x509_privkey_generate() */
1139 #define GNUTLS_CURVE_TO_BITS(curve) \
1140     (unsigned int)(((unsigned int)1 << 31) | ((unsigned int)(curve)))
1141 #define GNUTLS_BITS_TO_CURVE(bits) (((unsigned int)(bits)) & 0x7FFFFFFF)
1142 #define GNUTLS_BITS_ARE_CURVE(bits) (((unsigned int)(bits)) & 0x80000000)
1143
1144 /**
1145  * gnutls_sec_param_t:
1146  * @GNUTLS_SEC_PARAM_UNKNOWN: Cannot be known
1147  * @GNUTLS_SEC_PARAM_INSECURE: Less than 42 bits of security
1148  * @GNUTLS_SEC_PARAM_EXPORT: 42 bits of security
1149  * @GNUTLS_SEC_PARAM_VERY_WEAK: 64 bits of security
1150  * @GNUTLS_SEC_PARAM_WEAK: 72 bits of security
1151  * @GNUTLS_SEC_PARAM_LOW: 80 bits of security
1152  * @GNUTLS_SEC_PARAM_LEGACY: 96 bits of security
1153  * @GNUTLS_SEC_PARAM_MEDIUM: 112 bits of security (used to be %GNUTLS_SEC_PARAM_NORMAL)
1154  * @GNUTLS_SEC_PARAM_HIGH: 128 bits of security
1155  * @GNUTLS_SEC_PARAM_ULTRA: 192 bits of security
1156  * @GNUTLS_SEC_PARAM_FUTURE: 256 bits of security
1157  *
1158  * Enumeration of security parameters for passive attacks.
1159  */
1160 typedef enum {
1161     GNUTLS_SEC_PARAM_UNKNOWN = 0,
1162     GNUTLS_SEC_PARAM_INSECURE = 5,
1163     GNUTLS_SEC_PARAM_EXPORT = 10,
1164     GNUTLS_SEC_PARAM_VERY_WEAK = 15,
1165     GNUTLS_SEC_PARAM_WEAK = 20,
1166     GNUTLS_SEC_PARAM_LOW = 25,
1167     GNUTLS_SEC_PARAM_LEGACY = 30,
1168     GNUTLS_SEC_PARAM_MEDIUM = 35,
1169     GNUTLS_SEC_PARAM_HIGH = 40,
1170     GNUTLS_SEC_PARAM_ULTRA = 45,
1171     GNUTLS_SEC_PARAM_FUTURE = 50,
1172     GNUTLS_SEC_PARAM_MAX = GNUTLS_SEC_PARAM_FUTURE
1173 } gnutls_sec_param_t;
1174
1175 /* old name */
1176 #define GNUTLS_SEC_PARAM_NORMAL GNUTLS_SEC_PARAM_MEDIUM
1177
1178 /**
1179  * gnutls_channel_binding_t:
1180  * @GNUTLS_CB_TLS_UNIQUE: "tls-unique" (RFC 5929) channel binding
1181  * @GNUTLS_CB_TLS_SERVER_END_POINT: "tls-server-end-point" (RFC 5929) channel binding
1182  * @GNUTLS_CB_TLS_EXPORTER: "tls-exporter" (RFC 9266) channel binding
1183  *
1184  * Enumeration of supported channel binding types.
1185  */
1186 typedef enum {
1187     GNUTLS_CB_TLS_UNIQUE,
1188     GNUTLS_CB_TLS_SERVER_END_POINT,
1189     GNUTLS_CB_TLS_EXPORTER
1190 } gnutls_channel_binding_t;
1191
1192 /**
1193  * gnutls_gost_paramset_t:
1194  * @GNUTLS_GOST_PARAMSET_UNKNOWN: Unknown/default parameter set
1195  * @GNUTLS_GOST_PARAMSET_TC26_Z: Specified by TC26, see rfc7836
1196  * @GNUTLS_GOST_PARAMSET_CP_A: CryptoPro-A, see rfc4357
1197  * @GNUTLS_GOST_PARAMSET_CP_B: CryptoPro-B, see rfc4357
1198  * @GNUTLS_GOST_PARAMSET_CP_C: CryptoPro-C, see rfc4357
1199  * @GNUTLS_GOST_PARAMSET_CP_D: CryptoPro-D, see rfc4357
1200  *
1201  * Enumeration of different GOST 28147 parameter sets.
1202  */
1203 typedef enum {
1204     GNUTLS_GOST_PARAMSET_UNKNOWN = 0,
1205     GNUTLS_GOST_PARAMSET_TC26_Z,
1206     GNUTLS_GOST_PARAMSET_CP_A,
1207     GNUTLS_GOST_PARAMSET_CP_B,
1208     GNUTLS_GOST_PARAMSET_CP_C,
1209     GNUTLS_GOST_PARAMSET_CP_D
1210 } gnutls_gost_paramset_t;
1211
1212 /**
1213  * gnutls_ctype_target_t:
1214  * @GNUTLS_CTYPE_CLIENT: for requesting client certificate type values.
1215  * @GNUTLS_CTYPE_SERVER: for requesting server certificate type values.
1216  * @GNUTLS_CTYPE_OURS: for requesting our certificate type values.
1217  * @GNUTLS_CTYPE_PEERS: for requesting the peers' certificate type values.
1218  *
1219  * Enumeration of certificate type targets with respect to asymmetric
1220  * certificate types as specified in RFC7250 and P2P connection set up
1221  * as specified in draft-vanrein-tls-symmetry-02.
1222  */
1223 typedef enum {
1224     GNUTLS_CTYPE_CLIENT,
1225     GNUTLS_CTYPE_SERVER,
1226     GNUTLS_CTYPE_OURS,
1227     GNUTLS_CTYPE_PEERS
1228 } gnutls_ctype_target_t;
1229
1230 /* If you want to change this, then also change the define in
1231  * gnutls_int.h, and recompile.
1232  */
1233 typedef void *gnutls_transport_ptr_t;
1234
1235 struct gnutls_session_int;
1236 typedef struct gnutls_session_int *gnutls_session_t;
1237
1238 struct gnutls_dh_params_int;
1239 typedef struct gnutls_dh_params_int *gnutls_dh_params_t;
1240
1241 /* XXX ugly. */
1242 struct gnutls_x509_privkey_int;
1243 typedef struct gnutls_x509_privkey_int *gnutls_rsa_params_t;
1244
1245 struct gnutls_priority_st;
1246 typedef struct gnutls_priority_st *gnutls_priority_t;
1247
1248 typedef struct {
1249     unsigned char *data;
1250     unsigned int size;
1251 } gnutls_datum_t;
1252
1253 typedef struct gnutls_library_config_st {
1254     const char *name;
1255     const char *value;
1256 } gnutls_library_config_st;
1257
1258 typedef struct gnutls_params_st {
1259     gnutls_params_type_t type;
1260     union params {
1261         gnutls_dh_params_t dh;
1262         gnutls_rsa_params_t rsa_export;
1263     } params;
1264     int deinit;
1265 } gnutls_params_st;
1266
1267 typedef int gnutls_params_function(gnutls_session_t, gnutls_params_type_t,
1268                    gnutls_params_st *);
1269
1270 /* internal functions */
1271
1272 int gnutls_init(gnutls_session_t *session, unsigned int flags);
1273 void gnutls_deinit(gnutls_session_t session);
1274 #define _gnutls_deinit(x) gnutls_deinit(x)
1275
1276 int gnutls_bye(gnutls_session_t session, gnutls_close_request_t how);
1277
1278 int gnutls_handshake(gnutls_session_t session);
1279
1280 int gnutls_reauth(gnutls_session_t session, unsigned int flags);
1281
1282 #define GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT ((unsigned int)-1)
1283 #define GNUTLS_INDEFINITE_TIMEOUT ((unsigned int)-2)
1284 void gnutls_handshake_set_timeout(gnutls_session_t session, unsigned int ms);
1285 int gnutls_rehandshake(gnutls_session_t session);
1286
1287 #define GNUTLS_KU_PEER 1
1288 int gnutls_session_key_update(gnutls_session_t session, unsigned flags);
1289
1290 gnutls_alert_description_t gnutls_alert_get(gnutls_session_t session);
1291 int gnutls_alert_send(gnutls_session_t session, gnutls_alert_level_t level,
1292               gnutls_alert_description_t desc);
1293 int gnutls_alert_send_appropriate(gnutls_session_t session, int err);
1294 const char *gnutls_alert_get_name(gnutls_alert_description_t alert);
1295 const char *gnutls_alert_get_strname(gnutls_alert_description_t alert);
1296
1297 gnutls_sec_param_t gnutls_pk_bits_to_sec_param(gnutls_pk_algorithm_t algo,
1298                            unsigned int bits);
1299 const char *gnutls_sec_param_get_name(gnutls_sec_param_t param);
1300 unsigned int gnutls_sec_param_to_pk_bits(gnutls_pk_algorithm_t algo,
1301                      gnutls_sec_param_t param);
1302 unsigned int
1303 gnutls_sec_param_to_symmetric_bits(gnutls_sec_param_t param) __GNUTLS_CONST__;
1304
1305 /* Elliptic curves */
1306 const char *
1307 gnutls_ecc_curve_get_name(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1308 const char *gnutls_ecc_curve_get_oid(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1309
1310 const char *gnutls_group_get_name(gnutls_group_t group) __GNUTLS_CONST__;
1311
1312 int gnutls_ecc_curve_get_size(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1313 gnutls_ecc_curve_t gnutls_ecc_curve_get(gnutls_session_t session);
1314
1315 gnutls_group_t gnutls_group_get(gnutls_session_t session);
1316
1317 /* get information on the current session */
1318 gnutls_cipher_algorithm_t gnutls_cipher_get(gnutls_session_t session);
1319 gnutls_cipher_algorithm_t gnutls_early_cipher_get(gnutls_session_t session);
1320 gnutls_kx_algorithm_t gnutls_kx_get(gnutls_session_t session);
1321 gnutls_mac_algorithm_t gnutls_mac_get(gnutls_session_t session);
1322 gnutls_digest_algorithm_t gnutls_prf_hash_get(const gnutls_session_t session);
1323 gnutls_digest_algorithm_t
1324 gnutls_early_prf_hash_get(const gnutls_session_t session);
1325 gnutls_certificate_type_t gnutls_certificate_type_get(gnutls_session_t session);
1326 gnutls_certificate_type_t
1327 gnutls_certificate_type_get2(gnutls_session_t session,
1328                  gnutls_ctype_target_t target);
1329
1330 int gnutls_sign_algorithm_get(gnutls_session_t session);
1331 int gnutls_sign_algorithm_get_client(gnutls_session_t session);
1332
1333 int gnutls_sign_algorithm_get_requested(gnutls_session_t session, size_t indx,
1334                     gnutls_sign_algorithm_t *algo);
1335
1336 /* the name of the specified algorithms */
1337 const char *
1338 gnutls_cipher_get_name(gnutls_cipher_algorithm_t algorithm) __GNUTLS_CONST__;
1339 const char *
1340 gnutls_mac_get_name(gnutls_mac_algorithm_t algorithm) __GNUTLS_CONST__;
1341
1342 const char *
1343 gnutls_digest_get_name(gnutls_digest_algorithm_t algorithm) __GNUTLS_CONST__;
1344 const char *
1345 gnutls_digest_get_oid(gnutls_digest_algorithm_t algorithm) __GNUTLS_CONST__;
1346
1347 const char *
1348 gnutls_kx_get_name(gnutls_kx_algorithm_t algorithm) __GNUTLS_CONST__;
1349 const char *gnutls_certificate_type_get_name(gnutls_certificate_type_t type)
1350     __GNUTLS_CONST__;
1351 const char *
1352 gnutls_pk_get_name(gnutls_pk_algorithm_t algorithm) __GNUTLS_CONST__;
1353 const char *gnutls_pk_get_oid(gnutls_pk_algorithm_t algorithm) __GNUTLS_CONST__;
1354
1355 const char *
1356 gnutls_sign_get_name(gnutls_sign_algorithm_t algorithm) __GNUTLS_CONST__;
1357
1358 const char *gnutls_sign_get_oid(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;
1359
1360 const char *
1361 gnutls_gost_paramset_get_name(gnutls_gost_paramset_t param) __GNUTLS_CONST__;
1362 const char *
1363 gnutls_gost_paramset_get_oid(gnutls_gost_paramset_t param) __GNUTLS_CONST__;
1364
1365 size_t gnutls_cipher_get_key_size(gnutls_cipher_algorithm_t algorithm)
1366     __GNUTLS_CONST__;
1367 size_t
1368 gnutls_mac_get_key_size(gnutls_mac_algorithm_t algorithm) __GNUTLS_CONST__;
1369
1370 unsigned
1371 gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm) __GNUTLS_CONST__;
1372
1373 /* It is possible that a signature algorithm is ok to use for short-lived
1374  * data (e.g., to sign a TLS session), but not for data that are long-lived
1375  * like certificates. This flag is about checking the security of the algorithm
1376  * for long-lived data. */
1377 #define GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS 1
1378 unsigned gnutls_sign_is_secure2(gnutls_sign_algorithm_t algorithm,
1379                 unsigned int flags) __GNUTLS_CONST__;
1380
1381 gnutls_digest_algorithm_t
1382 gnutls_sign_get_hash_algorithm(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;
1383 gnutls_pk_algorithm_t
1384 gnutls_sign_get_pk_algorithm(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;
1385 gnutls_sign_algorithm_t
1386 gnutls_pk_to_sign(gnutls_pk_algorithm_t pk,
1387           gnutls_digest_algorithm_t hash) __GNUTLS_CONST__;
1388
1389 unsigned
1390 gnutls_sign_supports_pk_algorithm(gnutls_sign_algorithm_t sign,
1391                   gnutls_pk_algorithm_t pk) __GNUTLS_CONST__;
1392
1393 #define gnutls_sign_algorithm_get_name gnutls_sign_get_name
1394
1395 gnutls_mac_algorithm_t gnutls_mac_get_id(const char *name) __GNUTLS_CONST__;
1396 gnutls_digest_algorithm_t
1397 gnutls_digest_get_id(const char *name) __GNUTLS_CONST__;
1398
1399 gnutls_cipher_algorithm_t
1400 gnutls_cipher_get_id(const char *name) __GNUTLS_CONST__;
1401
1402 gnutls_kx_algorithm_t gnutls_kx_get_id(const char *name) __GNUTLS_CONST__;
1403 gnutls_protocol_t gnutls_protocol_get_id(const char *name) __GNUTLS_CONST__;
1404 gnutls_certificate_type_t
1405 gnutls_certificate_type_get_id(const char *name) __GNUTLS_CONST__;
1406 gnutls_pk_algorithm_t gnutls_pk_get_id(const char *name) __GNUTLS_CONST__;
1407 gnutls_sign_algorithm_t gnutls_sign_get_id(const char *name) __GNUTLS_CONST__;
1408 gnutls_ecc_curve_t gnutls_ecc_curve_get_id(const char *name) __GNUTLS_CONST__;
1409 gnutls_pk_algorithm_t
1410 gnutls_ecc_curve_get_pk(gnutls_ecc_curve_t curve) __GNUTLS_CONST__;
1411 gnutls_group_t gnutls_group_get_id(const char *name);
1412
1413 gnutls_digest_algorithm_t
1414 gnutls_oid_to_digest(const char *oid) __GNUTLS_CONST__;
1415 gnutls_mac_algorithm_t gnutls_oid_to_mac(const char *oid) __GNUTLS_CONST__;
1416 gnutls_pk_algorithm_t gnutls_oid_to_pk(const char *oid) __GNUTLS_CONST__;
1417 gnutls_sign_algorithm_t gnutls_oid_to_sign(const char *oid) __GNUTLS_CONST__;
1418 gnutls_ecc_curve_t gnutls_oid_to_ecc_curve(const char *oid) __GNUTLS_CONST__;
1419 gnutls_gost_paramset_t
1420 gnutls_oid_to_gost_paramset(const char *oid) __GNUTLS_CONST__;
1421
1422 /* list supported algorithms */
1423 const gnutls_ecc_curve_t *gnutls_ecc_curve_list(void) __GNUTLS_PURE__;
1424 const gnutls_group_t *gnutls_group_list(void) __GNUTLS_PURE__;
1425 const gnutls_cipher_algorithm_t *gnutls_cipher_list(void) __GNUTLS_PURE__;
1426 const gnutls_mac_algorithm_t *gnutls_mac_list(void) __GNUTLS_PURE__;
1427 const gnutls_digest_algorithm_t *gnutls_digest_list(void) __GNUTLS_PURE__;
1428 const gnutls_protocol_t *gnutls_protocol_list(void) __GNUTLS_PURE__;
1429 const gnutls_certificate_type_t *
1430 gnutls_certificate_type_list(void) __GNUTLS_PURE__;
1431 const gnutls_kx_algorithm_t *gnutls_kx_list(void) __GNUTLS_PURE__;
1432 const gnutls_pk_algorithm_t *gnutls_pk_list(void) __GNUTLS_PURE__;
1433 const gnutls_sign_algorithm_t *gnutls_sign_list(void) __GNUTLS_PURE__;
1434 const char *gnutls_cipher_suite_info(size_t idx, unsigned char *cs_id,
1435                      gnutls_kx_algorithm_t *kx,
1436                      gnutls_cipher_algorithm_t *cipher,
1437                      gnutls_mac_algorithm_t *mac,
1438                      gnutls_protocol_t *min_version);
1439
1440 /* functions for run-time enablement of algorithms */
1441 int gnutls_ecc_curve_set_enabled(gnutls_ecc_curve_t curve,
1442                  unsigned int enabled);
1443 int gnutls_sign_set_secure(gnutls_sign_algorithm_t sign, unsigned int secure);
1444 int gnutls_sign_set_secure_for_certs(gnutls_sign_algorithm_t sign,
1445                      unsigned int secure);
1446 int gnutls_digest_set_secure(gnutls_digest_algorithm_t dig,
1447                  unsigned int secure);
1448 int gnutls_protocol_set_enabled(gnutls_protocol_t version,
1449                 unsigned int enabled);
1450
1451 /* error functions */
1452 int gnutls_error_is_fatal(int error) __GNUTLS_CONST__;
1453 int gnutls_error_to_alert(int err, int *level);
1454
1455 void gnutls_perror(int error);
1456 const char *gnutls_strerror(int error) __GNUTLS_CONST__;
1457 const char *gnutls_strerror_name(int error) __GNUTLS_CONST__;
1458
1459 /* Semi-internal functions.
1460  */
1461 void gnutls_handshake_set_private_extensions(gnutls_session_t session,
1462                          int allow);
1463 int gnutls_handshake_set_random(gnutls_session_t session,
1464                 const gnutls_datum_t *random);
1465
1466 gnutls_handshake_description_t
1467 gnutls_handshake_get_last_out(gnutls_session_t session);
1468 gnutls_handshake_description_t
1469 gnutls_handshake_get_last_in(gnutls_session_t session);
1470
1471 /* Record layer functions.
1472  */
1473 #define GNUTLS_HEARTBEAT_WAIT 1
1474 int gnutls_heartbeat_ping(gnutls_session_t session, size_t data_size,
1475               unsigned int max_tries, unsigned int flags);
1476 int gnutls_heartbeat_pong(gnutls_session_t session, unsigned int flags);
1477
1478 void gnutls_record_set_timeout(gnutls_session_t session, unsigned int ms);
1479 void gnutls_record_disable_padding(gnutls_session_t session);
1480
1481 void gnutls_record_cork(gnutls_session_t session);
1482 #define GNUTLS_RECORD_WAIT 1
1483 int gnutls_record_uncork(gnutls_session_t session, unsigned int flags);
1484 size_t gnutls_record_discard_queued(gnutls_session_t session);
1485
1486 int gnutls_record_get_state(gnutls_session_t session, unsigned read,
1487                 gnutls_datum_t *mac_key, gnutls_datum_t *IV,
1488                 gnutls_datum_t *cipher_key,
1489                 unsigned char seq_number[8]);
1490
1491 int gnutls_record_set_state(gnutls_session_t session, unsigned read,
1492                 const unsigned char seq_number[8]);
1493
1494 typedef struct {
1495     size_t low;
1496     size_t high;
1497 } gnutls_range_st;
1498
1499 int gnutls_range_split(gnutls_session_t session, const gnutls_range_st *orig,
1500                gnutls_range_st *small_range,
1501                gnutls_range_st *rem_range);
1502
1503 ssize_t gnutls_record_send(gnutls_session_t session, const void *data,
1504                size_t data_size);
1505 ssize_t gnutls_record_send2(gnutls_session_t session, const void *data,
1506                 size_t data_size, size_t pad, unsigned flags);
1507 ssize_t gnutls_record_send_range(gnutls_session_t session, const void *data,
1508                  size_t data_size,
1509                  const gnutls_range_st *range);
1510 ssize_t gnutls_record_send_file(gnutls_session_t session, int fd, off_t *offset,
1511                 size_t count);
1512 ssize_t gnutls_record_recv(gnutls_session_t session, void *data,
1513                size_t data_size);
1514
1515 typedef struct mbuffer_st *gnutls_packet_t;
1516
1517 ssize_t gnutls_record_recv_packet(gnutls_session_t session,
1518                   gnutls_packet_t *packet);
1519
1520 void gnutls_packet_get(gnutls_packet_t packet, gnutls_datum_t *data,
1521                unsigned char *sequence);
1522 void gnutls_packet_deinit(gnutls_packet_t packet);
1523
1524 #define gnutls_read gnutls_record_recv
1525 #define gnutls_write gnutls_record_send
1526 ssize_t gnutls_record_recv_seq(gnutls_session_t session, void *data,
1527                    size_t data_size, unsigned char *seq);
1528
1529 size_t gnutls_record_overhead_size(gnutls_session_t session);
1530
1531 size_t gnutls_est_record_overhead_size(gnutls_protocol_t version,
1532                        gnutls_cipher_algorithm_t cipher,
1533                        gnutls_mac_algorithm_t mac,
1534                        gnutls_compression_method_t comp,
1535                        unsigned int flags) __GNUTLS_CONST__;
1536
1537 void gnutls_session_enable_compatibility_mode(gnutls_session_t session);
1538 #define gnutls_record_set_max_empty_records(session, x)
1539
1540 unsigned gnutls_record_can_use_length_hiding(gnutls_session_t session);
1541
1542 int gnutls_record_get_direction(gnutls_session_t session);
1543
1544 size_t gnutls_record_get_max_size(gnutls_session_t session);
1545 ssize_t gnutls_record_set_max_size(gnutls_session_t session, size_t size);
1546 ssize_t gnutls_record_set_max_recv_size(gnutls_session_t session, size_t size);
1547
1548 size_t gnutls_record_check_pending(gnutls_session_t session);
1549 size_t gnutls_record_check_corked(gnutls_session_t session);
1550
1551 size_t gnutls_record_get_max_early_data_size(gnutls_session_t session);
1552 int gnutls_record_set_max_early_data_size(gnutls_session_t session,
1553                       size_t size);
1554 ssize_t gnutls_record_send_early_data(gnutls_session_t session,
1555                       const void *data, size_t length);
1556 ssize_t gnutls_record_recv_early_data(gnutls_session_t session, void *data,
1557                       size_t data_size);
1558
1559 void gnutls_session_force_valid(gnutls_session_t session);
1560
1561 int gnutls_prf(gnutls_session_t session, size_t label_size, const char *label,
1562            int server_random_first, size_t extra_size, const char *extra,
1563            size_t outsize, char *out);
1564 int gnutls_prf_rfc5705(gnutls_session_t session, size_t label_size,
1565                const char *label, size_t context_size,
1566                const char *context, size_t outsize, char *out);
1567 int gnutls_prf_early(gnutls_session_t session, size_t label_size,
1568              const char *label, size_t context_size,
1569              const char *context, size_t outsize, char *out);
1570
1571 int gnutls_prf_raw(gnutls_session_t session, size_t label_size,
1572            const char *label, size_t seed_size, const char *seed,
1573            size_t outsize, char *out);
1574
1575 /**
1576  * gnutls_server_name_type_t:
1577  * @GNUTLS_NAME_DNS: Domain Name System name type.
1578  *
1579  * Enumeration of different server name types.
1580  */
1581 typedef enum {
1582     GNUTLS_NAME_DNS = 1
1583 } gnutls_server_name_type_t;
1584
1585 int gnutls_server_name_set(gnutls_session_t session,
1586                gnutls_server_name_type_t type, const void *name,
1587                size_t name_length);
1588
1589 int gnutls_server_name_get(gnutls_session_t session, void *data,
1590                size_t *data_length, unsigned int *type,
1591                unsigned int indx);
1592
1593 unsigned int gnutls_heartbeat_get_timeout(gnutls_session_t session);
1594 void gnutls_heartbeat_set_timeouts(gnutls_session_t session,
1595                    unsigned int retrans_timeout,
1596                    unsigned int total_timeout);
1597
1598 #define GNUTLS_HB_PEER_ALLOWED_TO_SEND (1)
1599 #define GNUTLS_HB_PEER_NOT_ALLOWED_TO_SEND (1 << 1)
1600
1601 /* Heartbeat */
1602 void gnutls_heartbeat_enable(gnutls_session_t session, unsigned int type);
1603
1604 #define GNUTLS_HB_LOCAL_ALLOWED_TO_SEND (1 << 2)
1605 unsigned gnutls_heartbeat_allowed(gnutls_session_t session, unsigned int type);
1606
1607 /* Safe renegotiation */
1608 unsigned gnutls_safe_renegotiation_status(gnutls_session_t session);
1609 unsigned gnutls_session_ext_master_secret_status(gnutls_session_t session);
1610 unsigned gnutls_session_etm_status(gnutls_session_t session);
1611
1612 /**
1613  * gnutls_session_flags_t:
1614  * @GNUTLS_SFLAGS_SAFE_RENEGOTIATION: Safe renegotiation (RFC5746) was used
1615  * @GNUTLS_SFLAGS_EXT_MASTER_SECRET: The extended master secret (RFC7627) extension was used
1616  * @GNUTLS_SFLAGS_ETM: The encrypt then MAC (RFC7366) extension was used
1617  * @GNUTLS_SFLAGS_RFC7919: The RFC7919 Diffie-Hellman parameters were negotiated
1618  * @GNUTLS_SFLAGS_HB_LOCAL_SEND: The heartbeat negotiation allows the local side to send heartbeat messages
1619  * @GNUTLS_SFLAGS_HB_PEER_SEND: The heartbeat negotiation allows the peer to send heartbeat messages
1620  * @GNUTLS_SFLAGS_FALSE_START: False start was used in this client session.
1621  * @GNUTLS_SFLAGS_SESSION_TICKET: A session ticket has been received by the server.
1622  * @GNUTLS_SFLAGS_POST_HANDSHAKE_AUTH: Indicates client capability for post-handshake auth; set only on server side.
1623  * @GNUTLS_SFLAGS_EARLY_START: The TLS1.3 server session returned early.
1624  * @GNUTLS_SFLAGS_EARLY_DATA: The TLS1.3 early data has been received by the server.
1625  * @GNUTLS_SFLAGS_CLI_REQUESTED_OCSP: Set when the client has requested OCSP staple during handshake.
1626  * @GNUTLS_SFLAGS_SERV_REQUESTED_OCSP: Set when the server has requested OCSP staple during handshake.
1627  *
1628  * Enumeration of different session parameters.
1629  */
1630 typedef enum {
1631     GNUTLS_SFLAGS_SAFE_RENEGOTIATION = 1,
1632     GNUTLS_SFLAGS_EXT_MASTER_SECRET = 1 << 1,
1633     GNUTLS_SFLAGS_ETM = 1 << 2,
1634     GNUTLS_SFLAGS_HB_LOCAL_SEND = 1 << 3,
1635     GNUTLS_SFLAGS_HB_PEER_SEND = 1 << 4,
1636     GNUTLS_SFLAGS_FALSE_START = 1 << 5,
1637     GNUTLS_SFLAGS_RFC7919 = 1 << 6,
1638     GNUTLS_SFLAGS_SESSION_TICKET = 1 << 7,
1639     GNUTLS_SFLAGS_POST_HANDSHAKE_AUTH = 1 << 8,
1640     GNUTLS_SFLAGS_EARLY_START = 1 << 9,
1641     GNUTLS_SFLAGS_EARLY_DATA = 1 << 10,
1642     GNUTLS_SFLAGS_CLI_REQUESTED_OCSP = 1 << 11,
1643     GNUTLS_SFLAGS_SERV_REQUESTED_OCSP = 1 << 12
1644 } gnutls_session_flags_t;
1645
1646 unsigned gnutls_session_get_flags(gnutls_session_t session);
1647
1648 /**
1649  * gnutls_supplemental_data_format_type_t:
1650  * @GNUTLS_SUPPLEMENTAL_UNKNOWN: Unknown data format
1651  *
1652  * Enumeration of different supplemental data types (RFC 4680).
1653  */
1654 typedef enum {
1655     GNUTLS_SUPPLEMENTAL_UNKNOWN = 0,
1656 } gnutls_supplemental_data_format_type_t;
1657
1658 const char *
1659 gnutls_supplemental_get_name(gnutls_supplemental_data_format_type_t type);
1660
1661 /* SessionTicket, RFC 5077. */
1662 int gnutls_session_ticket_key_generate(gnutls_datum_t *key);
1663 int gnutls_session_ticket_enable_client(gnutls_session_t session);
1664 int gnutls_session_ticket_enable_server(gnutls_session_t session,
1665                     const gnutls_datum_t *key);
1666
1667 int gnutls_session_ticket_send(gnutls_session_t session, unsigned nr,
1668                    unsigned flags);
1669
1670 /* SRTP, RFC 5764 */
1671
1672 /**
1673  * gnutls_srtp_profile_t:
1674  * @GNUTLS_SRTP_AES128_CM_HMAC_SHA1_80: 128 bit AES with a 80 bit HMAC-SHA1
1675  * @GNUTLS_SRTP_AES128_CM_HMAC_SHA1_32: 128 bit AES with a 32 bit HMAC-SHA1
1676  * @GNUTLS_SRTP_NULL_HMAC_SHA1_80: NULL cipher with a 80 bit HMAC-SHA1
1677  * @GNUTLS_SRTP_NULL_HMAC_SHA1_32: NULL cipher with a 32 bit HMAC-SHA1
1678  * @GNUTLS_SRTP_AEAD_AES_128_GCM: 128 bit AES with GCM
1679  * @GNUTLS_SRTP_AEAD_AES_256_GCM: 256 bit AES with GCM
1680  *
1681  * Enumeration of different SRTP protection profiles.
1682  */
1683 typedef enum {
1684     GNUTLS_SRTP_AES128_CM_HMAC_SHA1_80 = 0x0001,
1685     GNUTLS_SRTP_AES128_CM_HMAC_SHA1_32 = 0x0002,
1686     GNUTLS_SRTP_NULL_HMAC_SHA1_80 = 0x0005,
1687     GNUTLS_SRTP_NULL_HMAC_SHA1_32 = 0x0006,
1688     GNUTLS_SRTP_AEAD_AES_128_GCM = 0x0007,
1689     GNUTLS_SRTP_AEAD_AES_256_GCM = 0x0008
1690 } gnutls_srtp_profile_t;
1691
1692 int gnutls_srtp_set_profile(gnutls_session_t session,
1693                 gnutls_srtp_profile_t profile);
1694 int gnutls_srtp_set_profile_direct(gnutls_session_t session,
1695                    const char *profiles, const char **err_pos);
1696 int gnutls_srtp_get_selected_profile(gnutls_session_t session,
1697                      gnutls_srtp_profile_t *profile);
1698
1699 const char *gnutls_srtp_get_profile_name(gnutls_srtp_profile_t profile);
1700 int gnutls_srtp_get_profile_id(const char *name,
1701                    gnutls_srtp_profile_t *profile);
1702 int gnutls_srtp_get_keys(gnutls_session_t session, void *key_material,
1703              unsigned int key_material_size,
1704              gnutls_datum_t *client_key,
1705              gnutls_datum_t *client_salt,
1706              gnutls_datum_t *server_key,
1707              gnutls_datum_t *server_salt);
1708
1709 int gnutls_srtp_set_mki(gnutls_session_t session, const gnutls_datum_t *mki);
1710 int gnutls_srtp_get_mki(gnutls_session_t session, gnutls_datum_t *mki);
1711
1712 /* COMPRESS_CERTIFICATE extension, RFC8879 */
1713 gnutls_compression_method_t
1714 gnutls_compress_certificate_get_selected_method(gnutls_session_t session);
1715 int gnutls_compress_certificate_set_methods(
1716     gnutls_session_t session, const gnutls_compression_method_t *methods,
1717     size_t methods_len);
1718
1719 /* ALPN TLS extension */
1720
1721 /**
1722  * gnutls_alpn_flags_t:
1723  * @GNUTLS_ALPN_MANDATORY: Require ALPN negotiation. The connection will be
1724  *   aborted if no matching ALPN protocol is found.
1725  * @GNUTLS_ALPN_SERVER_PRECEDENCE: The choices set by the server
1726  *   will take precedence over the client's.
1727  *
1728  * Enumeration of different ALPN flags. These are used by gnutls_alpn_set_protocols().
1729  */
1730 typedef enum {
1731     GNUTLS_ALPN_MANDATORY = 1,
1732     GNUTLS_ALPN_SERVER_PRECEDENCE = (1 << 1)
1733 } gnutls_alpn_flags_t;
1734
1735 #define GNUTLS_ALPN_MAND GNUTLS_ALPN_MANDATORY
1736 int gnutls_alpn_get_selected_protocol(gnutls_session_t session,
1737                       gnutls_datum_t *protocol);
1738 int gnutls_alpn_set_protocols(gnutls_session_t session,
1739                   const gnutls_datum_t *protocols,
1740                   unsigned protocols_size, unsigned flags);
1741
1742 int gnutls_key_generate(gnutls_datum_t *key, unsigned int key_size);
1743
1744 #define GNUTLS_PRIORITY_INIT_DEF_APPEND 1
1745 int gnutls_priority_init(gnutls_priority_t *priority_cache,
1746              const char *priorities, const char **err_pos);
1747 int gnutls_priority_init2(gnutls_priority_t *priority_cache,
1748               const char *priorities, const char **err_pos,
1749               unsigned flags);
1750 void gnutls_priority_deinit(gnutls_priority_t priority_cache);
1751 int gnutls_priority_get_cipher_suite_index(gnutls_priority_t pcache,
1752                        unsigned int idx,
1753                        unsigned int *sidx);
1754
1755 #define GNUTLS_PRIORITY_LIST_INIT_KEYWORDS 1
1756 #define GNUTLS_PRIORITY_LIST_SPECIAL 2
1757 const char *gnutls_priority_string_list(unsigned iter, unsigned int flags);
1758
1759 int gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority);
1760
1761 int gnutls_priority_set_direct(gnutls_session_t session, const char *priorities,
1762                    const char **err_pos);
1763
1764 int gnutls_priority_certificate_type_list(gnutls_priority_t pcache,
1765                       const unsigned int **list);
1766 int gnutls_priority_certificate_type_list2(gnutls_priority_t pcache,
1767                        const unsigned int **list,
1768                        gnutls_ctype_target_t target);
1769 int gnutls_priority_sign_list(gnutls_priority_t pcache,
1770                   const unsigned int **list);
1771 int gnutls_priority_protocol_list(gnutls_priority_t pcache,
1772                   const unsigned int **list);
1773 int gnutls_priority_ecc_curve_list(gnutls_priority_t pcache,
1774                    const unsigned int **list);
1775 int gnutls_priority_group_list(gnutls_priority_t pcache,
1776                    const unsigned int **list);
1777
1778 int gnutls_priority_kx_list(gnutls_priority_t pcache,
1779                 const unsigned int **list);
1780 int gnutls_priority_cipher_list(gnutls_priority_t pcache,
1781                 const unsigned int **list);
1782 int gnutls_priority_mac_list(gnutls_priority_t pcache,
1783                  const unsigned int **list);
1784
1785 const char *gnutls_get_system_config_file(void);
1786
1787 int gnutls_set_default_priority(gnutls_session_t session);
1788 int gnutls_set_default_priority_append(gnutls_session_t session,
1789                        const char *add_prio,
1790                        const char **err_pos, unsigned flags);
1791
1792 /* Returns the name of a cipher suite */
1793 const char *gnutls_cipher_suite_get_name(
1794     gnutls_kx_algorithm_t kx_algorithm,
1795     gnutls_cipher_algorithm_t cipher_algorithm,
1796     gnutls_mac_algorithm_t mac_algorithm) __GNUTLS_CONST__;
1797
1798 const char *gnutls_ciphersuite_get(gnutls_session_t session) __GNUTLS_CONST__;
1799
1800 /* get the currently used protocol version */
1801 gnutls_protocol_t gnutls_protocol_get_version(gnutls_session_t session);
1802
1803 const char *
1804 gnutls_protocol_get_name(gnutls_protocol_t version) __GNUTLS_CONST__;
1805
1806 /* get/set session
1807  */
1808 int gnutls_session_set_data(gnutls_session_t session, const void *session_data,
1809                 size_t session_data_size);
1810 int gnutls_session_get_data(gnutls_session_t session, void *session_data,
1811                 size_t *session_data_size);
1812 int gnutls_session_get_data2(gnutls_session_t session, gnutls_datum_t *data);
1813 void gnutls_session_get_random(gnutls_session_t session, gnutls_datum_t *client,
1814                    gnutls_datum_t *server);
1815
1816 void gnutls_session_get_master_secret(gnutls_session_t session,
1817                       gnutls_datum_t *secret);
1818
1819 char *gnutls_session_get_desc(gnutls_session_t session);
1820
1821 typedef int gnutls_certificate_verify_function(gnutls_session_t);
1822 void gnutls_session_set_verify_function(
1823     gnutls_session_t session, gnutls_certificate_verify_function *func);
1824
1825 /**
1826  * gnutls_vdata_types_t:
1827  * @GNUTLS_DT_UNKNOWN: Unknown data type.
1828  * @GNUTLS_DT_DNS_HOSTNAME: The data contain a null-terminated DNS hostname; the hostname will be
1829  *   matched using the RFC6125 rules. If the data contain a textual IP (v4 or v6) address it will
1830  *   be marched against the IPAddress Alternative name, unless the verification flag %GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES
1831  *   is specified.
1832  * @GNUTLS_DT_IP_ADDRESS: The data contain a raw IP address (4 or 16 bytes). If will be matched
1833  *   against the IPAddress Alternative name; option available since 3.6.0.
1834  * @GNUTLS_DT_RFC822NAME: The data contain a null-terminated email address; the email will be
1835  *   matched against the RFC822Name Alternative name of the certificate, or the EMAIL DN component if the
1836  *   former isn't available. Prior to matching the email address will be converted to ACE
1837  *   (ASCII-compatible-encoding).
1838  * @GNUTLS_DT_KEY_PURPOSE_OID: The data contain a null-terminated key purpose OID. It will be matched
1839  *   against the certificate's Extended Key Usage extension.
1840  *
1841  * Enumeration of different typed-data options. They are used as input to certificate
1842  * verification functions to provide information about the name and purpose of the
1843  * certificate. Only a single option of a type can be provided to the relevant functions
1844  * (i.e., options %GNUTLS_DT_DNS_HOSTNAME, %GNUTLS_DT_IP_ADDRESS and
1845  * %GNUTLS_DT_RFC822NAME cannot be combined).
1846  */
1847 typedef enum {
1848     GNUTLS_DT_UNKNOWN = 0,
1849     GNUTLS_DT_DNS_HOSTNAME = 1,
1850     GNUTLS_DT_KEY_PURPOSE_OID = 2,
1851     GNUTLS_DT_RFC822NAME = 3,
1852     GNUTLS_DT_IP_ADDRESS = 4
1853 } gnutls_vdata_types_t;
1854
1855 typedef struct {
1856     gnutls_vdata_types_t type;
1857     unsigned char *data;
1858     unsigned int size;
1859 } gnutls_typed_vdata_st;
1860
1861 void gnutls_session_set_verify_cert(gnutls_session_t session,
1862                     const char *hostname, unsigned flags);
1863
1864 void gnutls_session_set_verify_cert2(gnutls_session_t session,
1865                      gnutls_typed_vdata_st *data,
1866                      unsigned elements, unsigned flags);
1867
1868 unsigned int gnutls_session_get_verify_cert_status(gnutls_session_t);
1869
1870 int gnutls_session_set_premaster(gnutls_session_t session, unsigned int entity,
1871                  gnutls_protocol_t version,
1872                  gnutls_kx_algorithm_t kx,
1873                  gnutls_cipher_algorithm_t cipher,
1874                  gnutls_mac_algorithm_t mac,
1875                  gnutls_compression_method_t comp,
1876                  const gnutls_datum_t *master,
1877                  const gnutls_datum_t *session_id);
1878
1879 /* returns the session ID */
1880 #define GNUTLS_MAX_SESSION_ID 32
1881 int gnutls_session_get_id(gnutls_session_t session, void *session_id,
1882               size_t *session_id_size);
1883 int gnutls_session_get_id2(gnutls_session_t session,
1884                gnutls_datum_t *session_id);
1885
1886 int gnutls_session_set_id(gnutls_session_t session, const gnutls_datum_t *sid);
1887
1888 int gnutls_session_channel_binding(gnutls_session_t session,
1889                    gnutls_channel_binding_t cbtype,
1890                    gnutls_datum_t *cb);
1891
1892 /* checks if this session is a resumed one
1893  */
1894 int gnutls_session_is_resumed(gnutls_session_t session);
1895 int gnutls_session_resumption_requested(gnutls_session_t session);
1896
1897 typedef int (*gnutls_db_store_func)(void *, gnutls_datum_t key,
1898                     gnutls_datum_t data);
1899 typedef int (*gnutls_db_remove_func)(void *, gnutls_datum_t key);
1900 typedef gnutls_datum_t (*gnutls_db_retr_func)(void *, gnutls_datum_t key);
1901
1902 void gnutls_db_set_cache_expiration(gnutls_session_t session, int seconds);
1903 unsigned gnutls_db_get_default_cache_expiration(void);
1904
1905 void gnutls_db_remove_session(gnutls_session_t session);
1906 void gnutls_db_set_retrieve_function(gnutls_session_t session,
1907                      gnutls_db_retr_func retr_func);
1908 void gnutls_db_set_remove_function(gnutls_session_t session,
1909                    gnutls_db_remove_func rem_func);
1910 void gnutls_db_set_store_function(gnutls_session_t session,
1911                   gnutls_db_store_func store_func);
1912 void gnutls_db_set_ptr(gnutls_session_t session, void *ptr);
1913 void *gnutls_db_get_ptr(gnutls_session_t session);
1914 int gnutls_db_check_entry(gnutls_session_t session,
1915               gnutls_datum_t session_entry);
1916 time_t gnutls_db_check_entry_time(gnutls_datum_t *entry);
1917 time_t gnutls_db_check_entry_expire_time(gnutls_datum_t *entry);
1918
1919 #define GNUTLS_HOOK_POST (1)
1920 #define GNUTLS_HOOK_PRE (0)
1921 #define GNUTLS_HOOK_BOTH (-1)
1922
1923 /**
1924  * gnutls_handshake_hook_func:
1925  * @session: the current session
1926  * @htype: the type of the handshake message (%gnutls_handshake_description_t)
1927  * @when: non zero if this is a post-process/generation call and zero otherwise
1928  * @incoming: non zero if this is an incoming message and zero if this is an outgoing message
1929  * @msg: the (const) data of the handshake message without the handshake headers.
1930  *
1931  * Function prototype for handshake hooks. It is set using
1932  * gnutls_handshake_set_hook_function().
1933  *
1934  * Returns: Non zero on error.
1935  */
1936 typedef int (*gnutls_handshake_hook_func)(gnutls_session_t, unsigned int htype,
1937                       unsigned when, unsigned int incoming,
1938                       const gnutls_datum_t *msg);
1939 void gnutls_handshake_set_hook_function(gnutls_session_t session,
1940                     unsigned int htype, int when,
1941                     gnutls_handshake_hook_func func);
1942
1943 #define gnutls_handshake_post_client_hello_func \
1944     gnutls_handshake_simple_hook_func
1945 typedef int (*gnutls_handshake_simple_hook_func)(gnutls_session_t);
1946 void gnutls_handshake_set_post_client_hello_function(
1947     gnutls_session_t session, gnutls_handshake_simple_hook_func func);
1948
1949 void gnutls_handshake_set_max_packet_length(gnutls_session_t session,
1950                         size_t max);
1951
1952 /* returns libgnutls version (call it with a NULL argument)
1953  */
1954 const char *gnutls_check_version(const char *req_version) __GNUTLS_CONST__;
1955
1956 /* A macro which will allow optimizing out calls to gnutls_check_version()
1957  * when the version being compiled with is sufficient.
1958  * Used as:
1959  *   if (gnutls_check_version_numerc(3,3,16)) {
1960  */
1961 #define gnutls_check_version_numeric(a, b, c)                            \
1962     ((GNUTLS_VERSION_MAJOR >= (a)) &&                                \
1963      ((GNUTLS_VERSION_NUMBER >= (((a) << 16) + ((b) << 8) + (c))) || \
1964       gnutls_check_version(#a "." #b "." #c)))
1965
1966 /* Functions for setting/clearing credentials
1967  */
1968 void gnutls_credentials_clear(gnutls_session_t session);
1969
1970 /* cred is a structure defined by the kx algorithm
1971  */
1972 int gnutls_credentials_set(gnutls_session_t session,
1973                gnutls_credentials_type_t type, void *cred);
1974 int gnutls_credentials_get(gnutls_session_t session,
1975                gnutls_credentials_type_t type, void **cred);
1976 #define gnutls_cred_set gnutls_credentials_set
1977
1978 /* x.509 types */
1979
1980 struct gnutls_pubkey_st;
1981 typedef struct gnutls_pubkey_st *gnutls_pubkey_t;
1982
1983 struct gnutls_privkey_st;
1984 typedef struct gnutls_privkey_st *gnutls_privkey_t;
1985
1986 struct gnutls_x509_privkey_int;
1987 typedef struct gnutls_x509_privkey_int *gnutls_x509_privkey_t;
1988
1989 struct gnutls_x509_crl_int;
1990 typedef struct gnutls_x509_crl_int *gnutls_x509_crl_t;
1991
1992 struct gnutls_x509_crt_int;
1993 typedef struct gnutls_x509_crt_int *gnutls_x509_crt_t;
1994
1995 struct gnutls_x509_crq_int;
1996 typedef struct gnutls_x509_crq_int *gnutls_x509_crq_t;
1997
1998 struct gnutls_openpgp_keyring_int;
1999 typedef struct gnutls_openpgp_keyring_int *gnutls_openpgp_keyring_t;
2000
2001 /* Credential structures - used in gnutls_credentials_set(); */
2002
2003 struct gnutls_certificate_credentials_st;
2004 typedef struct gnutls_certificate_credentials_st
2005     *gnutls_certificate_credentials_t;
2006 typedef gnutls_certificate_credentials_t gnutls_certificate_server_credentials;
2007 typedef gnutls_certificate_credentials_t gnutls_certificate_client_credentials;
2008
2009 typedef struct gnutls_anon_server_credentials_st
2010     *gnutls_anon_server_credentials_t;
2011 typedef struct gnutls_anon_client_credentials_st
2012     *gnutls_anon_client_credentials_t;
2013
2014 void gnutls_anon_free_server_credentials(gnutls_anon_server_credentials_t sc);
2015 int gnutls_anon_allocate_server_credentials(
2016     gnutls_anon_server_credentials_t *sc);
2017
2018 void gnutls_anon_set_server_dh_params(gnutls_anon_server_credentials_t res,
2019                       gnutls_dh_params_t dh_params);
2020
2021 int gnutls_anon_set_server_known_dh_params(gnutls_anon_server_credentials_t res,
2022                        gnutls_sec_param_t sec_param);
2023
2024 void gnutls_anon_set_server_params_function(
2025     gnutls_anon_server_credentials_t res, gnutls_params_function *func);
2026
2027 void gnutls_anon_free_client_credentials(gnutls_anon_client_credentials_t sc);
2028 int gnutls_anon_allocate_client_credentials(
2029     gnutls_anon_client_credentials_t *sc);
2030
2031 /* CERTFILE is an x509 certificate in PEM form.
2032  * KEYFILE is a pkcs-1 private key in PEM form (for RSA keys).
2033  */
2034 void gnutls_certificate_free_credentials(gnutls_certificate_credentials_t sc);
2035 int gnutls_certificate_allocate_credentials(
2036     gnutls_certificate_credentials_t *res);
2037
2038 int gnutls_certificate_get_issuer(gnutls_certificate_credentials_t sc,
2039                   gnutls_x509_crt_t cert,
2040                   gnutls_x509_crt_t *issuer,
2041                   unsigned int flags);
2042
2043 int gnutls_certificate_get_crt_raw(gnutls_certificate_credentials_t sc,
2044                    unsigned idx1, unsigned idx2,
2045                    gnutls_datum_t *cert);
2046
2047 void gnutls_certificate_free_keys(gnutls_certificate_credentials_t sc);
2048 void gnutls_certificate_free_cas(gnutls_certificate_credentials_t sc);
2049 void gnutls_certificate_free_ca_names(gnutls_certificate_credentials_t sc);
2050 void gnutls_certificate_free_crls(gnutls_certificate_credentials_t sc);
2051
2052 void gnutls_certificate_set_dh_params(gnutls_certificate_credentials_t res,
2053                       gnutls_dh_params_t dh_params);
2054
2055 int gnutls_certificate_set_known_dh_params(gnutls_certificate_credentials_t res,
2056                        gnutls_sec_param_t sec_param);
2057 void gnutls_certificate_set_verify_flags(gnutls_certificate_credentials_t res,
2058                      unsigned int flags);
2059 unsigned int
2060 gnutls_certificate_get_verify_flags(gnutls_certificate_credentials_t res);
2061
2062 /**
2063  * gnutls_certificate_flags:
2064  * @GNUTLS_CERTIFICATE_SKIP_KEY_CERT_MATCH: Skip the key and certificate matching check.
2065  * @GNUTLS_CERTIFICATE_API_V2: If set the gnutls_certificate_set_*key* functions will return an index of the added key pair instead of zero.
2066  * @GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK: If set, the gnutls_certificate_set_ocsp_status_request_file
2067  *    function, will not check whether the response set matches any of the certificates.
2068  * @GNUTLS_CERTIFICATE_VERIFY_CRLS: This will enable CRL verification when added in the certificate structure.
2069  *    When used, it requires CAs to be added before CRLs.
2070  *
2071  * Enumeration of different certificate credentials flags.
2072  */
2073 typedef enum gnutls_certificate_flags {
2074     GNUTLS_CERTIFICATE_SKIP_KEY_CERT_MATCH = 1,
2075     GNUTLS_CERTIFICATE_API_V2 = (1 << 1),
2076     GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK = (1 << 2),
2077     GNUTLS_CERTIFICATE_VERIFY_CRLS = (1 << 3)
2078 } gnutls_certificate_flags;
2079
2080 void gnutls_certificate_set_flags(gnutls_certificate_credentials_t,
2081                   unsigned flags);
2082
2083 void gnutls_certificate_set_verify_limits(gnutls_certificate_credentials_t res,
2084                       unsigned int max_bits,
2085                       unsigned int max_depth);
2086
2087 int gnutls_certificate_set_x509_system_trust(
2088     gnutls_certificate_credentials_t cred);
2089
2090 int gnutls_certificate_set_x509_trust_file(gnutls_certificate_credentials_t cred,
2091                        const char *cafile,
2092                        gnutls_x509_crt_fmt_t type);
2093 int gnutls_certificate_set_x509_trust_dir(gnutls_certificate_credentials_t cred,
2094                       const char *ca_dir,
2095                       gnutls_x509_crt_fmt_t type);
2096
2097 int gnutls_certificate_set_x509_trust_mem(gnutls_certificate_credentials_t res,
2098                       const gnutls_datum_t *ca,
2099                       gnutls_x509_crt_fmt_t type);
2100
2101 int gnutls_certificate_set_x509_crl_file(gnutls_certificate_credentials_t res,
2102                      const char *crlfile,
2103                      gnutls_x509_crt_fmt_t type);
2104 int gnutls_certificate_set_x509_crl_mem(gnutls_certificate_credentials_t res,
2105                     const gnutls_datum_t *CRL,
2106                     gnutls_x509_crt_fmt_t type);
2107
2108 int gnutls_certificate_set_x509_key_file(gnutls_certificate_credentials_t res,
2109                      const char *certfile,
2110                      const char *keyfile,
2111                      gnutls_x509_crt_fmt_t type);
2112
2113 int gnutls_certificate_set_x509_key_file2(gnutls_certificate_credentials_t res,
2114                       const char *certfile,
2115                       const char *keyfile,
2116                       gnutls_x509_crt_fmt_t type,
2117                       const char *pass, unsigned int flags);
2118
2119 int gnutls_certificate_set_x509_key_mem(gnutls_certificate_credentials_t res,
2120                     const gnutls_datum_t *cert,
2121                     const gnutls_datum_t *key,
2122                     gnutls_x509_crt_fmt_t type);
2123
2124 int gnutls_certificate_set_x509_key_mem2(gnutls_certificate_credentials_t res,
2125                      const gnutls_datum_t *cert,
2126                      const gnutls_datum_t *key,
2127                      gnutls_x509_crt_fmt_t type,
2128                      const char *pass, unsigned int flags);
2129
2130 void gnutls_certificate_send_x509_rdn_sequence(gnutls_session_t session,
2131                            int status);
2132
2133 int gnutls_certificate_set_x509_simple_pkcs12_file(
2134     gnutls_certificate_credentials_t res, const char *pkcs12file,
2135     gnutls_x509_crt_fmt_t type, const char *password);
2136 int gnutls_certificate_set_x509_simple_pkcs12_mem(
2137     gnutls_certificate_credentials_t res, const gnutls_datum_t *p12blob,
2138     gnutls_x509_crt_fmt_t type, const char *password);
2139
2140 /* New functions to allow setting already parsed X.509 stuff.
2141  */
2142
2143 int gnutls_certificate_set_x509_key(gnutls_certificate_credentials_t res,
2144                     gnutls_x509_crt_t *cert_list,
2145                     int cert_list_size,
2146                     gnutls_x509_privkey_t key);
2147 int gnutls_certificate_set_x509_trust(gnutls_certificate_credentials_t res,
2148                       gnutls_x509_crt_t *ca_list,
2149                       int ca_list_size);
2150 int gnutls_certificate_set_x509_crl(gnutls_certificate_credentials_t res,
2151                     gnutls_x509_crl_t *crl_list,
2152                     int crl_list_size);
2153
2154 int gnutls_certificate_get_x509_key(gnutls_certificate_credentials_t res,
2155                     unsigned index, gnutls_x509_privkey_t *key);
2156 int gnutls_certificate_get_x509_crt(gnutls_certificate_credentials_t res,
2157                     unsigned index,
2158                     gnutls_x509_crt_t **crt_list,
2159                     unsigned *crt_list_size);
2160
2161 /* OCSP status request extension, RFC 6066 */
2162 typedef int (*gnutls_status_request_ocsp_func)(gnutls_session_t session,
2163                            void *ptr,
2164                            gnutls_datum_t *ocsp_response);
2165
2166 void gnutls_certificate_set_ocsp_status_request_function(
2167     gnutls_certificate_credentials_t res,
2168     gnutls_status_request_ocsp_func ocsp_func, void *ptr);
2169
2170 int gnutls_certificate_set_ocsp_status_request_function2(
2171     gnutls_certificate_credentials_t res, unsigned idx,
2172     gnutls_status_request_ocsp_func ocsp_func, void *ptr);
2173
2174 int gnutls_certificate_set_ocsp_status_request_file(
2175     gnutls_certificate_credentials_t res, const char *response_file,
2176     unsigned idx);
2177
2178 int gnutls_certificate_set_ocsp_status_request_file2(
2179     gnutls_certificate_credentials_t res, const char *response_file,
2180     unsigned idx, gnutls_x509_crt_fmt_t fmt);
2181
2182 int gnutls_certificate_set_ocsp_status_request_mem(
2183     gnutls_certificate_credentials_t res, const gnutls_datum_t *resp,
2184     unsigned idx, gnutls_x509_crt_fmt_t fmt);
2185
2186 typedef struct gnutls_ocsp_data_st {
2187     unsigned int version; /* must be zero */
2188     gnutls_datum_t response;
2189     time_t exptime;
2190     unsigned char padding[32];
2191 } gnutls_ocsp_data_st;
2192
2193 time_t
2194 gnutls_certificate_get_ocsp_expiration(gnutls_certificate_credentials_t sc,
2195                        unsigned idx, int oidx, unsigned flags);
2196
2197 int gnutls_ocsp_status_request_enable_client(
2198     gnutls_session_t session, gnutls_datum_t *responder_id,
2199     size_t responder_id_size, gnutls_datum_t *request_extensions);
2200
2201 int gnutls_ocsp_status_request_get(gnutls_session_t session,
2202                    gnutls_datum_t *response);
2203
2204 #define GNUTLS_OCSP_SR_IS_AVAIL 1
2205 unsigned gnutls_ocsp_status_request_is_checked(gnutls_session_t session,
2206                            unsigned int flags);
2207
2208 int gnutls_ocsp_status_request_get2(gnutls_session_t session, unsigned idx,
2209                     gnutls_datum_t *response);
2210
2211 /* RAW public key functions (RFC7250) */
2212 int gnutls_certificate_set_rawpk_key_mem(
2213     gnutls_certificate_credentials_t cred, const gnutls_datum_t *spki,
2214     const gnutls_datum_t *pkey, gnutls_x509_crt_fmt_t format,
2215     const char *pass, unsigned int key_usage, const char **names,
2216     unsigned int names_length, unsigned int flags);
2217
2218 int gnutls_certificate_set_rawpk_key_file(
2219     gnutls_certificate_credentials_t cred, const char *rawpkfile,
2220     const char *privkeyfile, gnutls_x509_crt_fmt_t format, const char *pass,
2221     unsigned int key_usage, const char **names, unsigned int names_length,
2222     unsigned int privkey_flags, unsigned int pkcs11_flags);
2223
2224 /* global state functions
2225  */
2226 int gnutls_global_init(void);
2227 void gnutls_global_deinit(void);
2228
2229 const gnutls_library_config_st *gnutls_get_library_config(void);
2230
2231 /**
2232  * gnutls_time_func:
2233  * @t: where to store time.
2234  *
2235  * Function prototype for time()-like function.  Set with
2236  * gnutls_global_set_time_function().
2237  *
2238  * Returns: Number of seconds since the epoch, or (time_t)-1 on errors.
2239  */
2240 typedef time_t (*gnutls_time_func)(time_t *t);
2241
2242 typedef int (*mutex_init_func)(void **mutex);
2243 typedef int (*mutex_lock_func)(void **mutex);
2244 typedef int (*mutex_unlock_func)(void **mutex);
2245 typedef int (*mutex_deinit_func)(void **mutex);
2246
2247 void gnutls_global_set_mutex(mutex_init_func init, mutex_deinit_func deinit,
2248                  mutex_lock_func lock, mutex_unlock_func unlock);
2249
2250 typedef void *(*gnutls_alloc_function)(size_t);
2251 typedef void *(*gnutls_calloc_function)(size_t, size_t);
2252 typedef int (*gnutls_is_secure_function)(const void *);
2253 typedef void (*gnutls_free_function)(void *);
2254 typedef void *(*gnutls_realloc_function)(void *, size_t);
2255
2256 void gnutls_global_set_time_function(gnutls_time_func time_func);
2257
2258 /* For use in callbacks */
2259 extern _SYM_EXPORT gnutls_alloc_function gnutls_malloc;
2260 extern _SYM_EXPORT gnutls_realloc_function gnutls_realloc;
2261 extern _SYM_EXPORT gnutls_calloc_function gnutls_calloc;
2262 extern _SYM_EXPORT gnutls_free_function gnutls_free;
2263
2264 #ifdef GNUTLS_INTERNAL_BUILD
2265 #define gnutls_free(a) gnutls_free((void *)(a)), a = NULL
2266 #endif
2267
2268 extern _SYM_EXPORT char *(*gnutls_strdup)(const char *);
2269
2270 /* a variant of memset that doesn't get optimized out */
2271 void gnutls_memset(void *data, int c, size_t size);
2272
2273 /* constant time memcmp */
2274 int gnutls_memcmp(const void *s1, const void *s2, size_t n);
2275
2276 typedef void (*gnutls_log_func)(int, const char *);
2277 typedef void (*gnutls_audit_log_func)(gnutls_session_t, const char *);
2278 void gnutls_global_set_log_function(gnutls_log_func log_func);
2279 void gnutls_global_set_audit_log_function(gnutls_audit_log_func log_func);
2280 void gnutls_global_set_log_level(int level);
2281
2282 /**
2283  * gnutls_keylog_func:
2284  * @session: the current session
2285  * @label: the keylog label
2286  * @secret: the (const) data of the derived secret.
2287  *
2288  * Function prototype for keylog hooks. It is set using
2289  * gnutls_session_set_keylog_function().
2290  *
2291  * Returns: Non zero on error.
2292  * Since: 3.6.13
2293  */
2294 typedef int (*gnutls_keylog_func)(gnutls_session_t session, const char *label,
2295                   const gnutls_datum_t *secret);
2296 gnutls_keylog_func
2297 gnutls_session_get_keylog_function(const gnutls_session_t session);
2298 void gnutls_session_set_keylog_function(gnutls_session_t session,
2299                     gnutls_keylog_func func);
2300
2301 /* Diffie-Hellman parameter handling.
2302  */
2303 int gnutls_dh_params_init(gnutls_dh_params_t *dh_params);
2304 void gnutls_dh_params_deinit(gnutls_dh_params_t dh_params);
2305 int gnutls_dh_params_import_raw(gnutls_dh_params_t dh_params,
2306                 const gnutls_datum_t *prime,
2307                 const gnutls_datum_t *generator);
2308 int gnutls_dh_params_import_dsa(gnutls_dh_params_t dh_params,
2309                 gnutls_x509_privkey_t key);
2310 int gnutls_dh_params_import_raw2(gnutls_dh_params_t dh_params,
2311                  const gnutls_datum_t *prime,
2312                  const gnutls_datum_t *generator,
2313                  unsigned key_bits);
2314 int gnutls_dh_params_import_raw3(gnutls_dh_params_t dh_params,
2315                  const gnutls_datum_t *prime,
2316                  const gnutls_datum_t *q,
2317                  const gnutls_datum_t *generator);
2318 int gnutls_dh_params_import_pkcs3(gnutls_dh_params_t params,
2319                   const gnutls_datum_t *pkcs3_params,
2320                   gnutls_x509_crt_fmt_t format);
2321 int gnutls_dh_params_generate2(gnutls_dh_params_t params, unsigned int bits);
2322 int gnutls_dh_params_export_pkcs3(gnutls_dh_params_t params,
2323                   gnutls_x509_crt_fmt_t format,
2324                   unsigned char *params_data,
2325                   size_t *params_data_size);
2326 int gnutls_dh_params_export2_pkcs3(gnutls_dh_params_t params,
2327                    gnutls_x509_crt_fmt_t format,
2328                    gnutls_datum_t *out);
2329 int gnutls_dh_params_export_raw(gnutls_dh_params_t params,
2330                 gnutls_datum_t *prime,
2331                 gnutls_datum_t *generator, unsigned int *bits);
2332 int gnutls_dh_params_cpy(gnutls_dh_params_t dst, gnutls_dh_params_t src);
2333
2334 /* Session stuff
2335  */
2336 /* clang-format off */
2337 #include <sys/uio.h>
2338 typedef struct iovec giovec_t;
2339     /* clang-format on */
2340
2341     typedef ssize_t (*gnutls_pull_func)(gnutls_transport_ptr_t, void *,
2342                         size_t);
2343 typedef ssize_t (*gnutls_push_func)(gnutls_transport_ptr_t, const void *,
2344                     size_t);
2345
2346 int gnutls_system_recv_timeout(gnutls_transport_ptr_t ptr, unsigned int ms);
2347 typedef int (*gnutls_pull_timeout_func)(gnutls_transport_ptr_t,
2348                     unsigned int ms);
2349
2350 typedef ssize_t (*gnutls_vec_push_func)(gnutls_transport_ptr_t,
2351                     const giovec_t *iov, int iovcnt);
2352
2353 typedef int (*gnutls_errno_func)(gnutls_transport_ptr_t);
2354
2355 #if 0
2356  /* This will be defined as macro. */
2357 void gnutls_transport_set_int(gnutls_session_t session, int r);
2358 #endif
2359
2360 void gnutls_transport_set_int2(gnutls_session_t session, int r, int s);
2361 #define gnutls_transport_set_int(s, i) gnutls_transport_set_int2(s, i, i)
2362
2363 void gnutls_transport_get_int2(gnutls_session_t session, int *r, int *s);
2364 int gnutls_transport_get_int(gnutls_session_t session);
2365
2366 void gnutls_transport_set_ptr(gnutls_session_t session,
2367                   gnutls_transport_ptr_t ptr);
2368 void gnutls_transport_set_ptr2(gnutls_session_t session,
2369                    gnutls_transport_ptr_t recv_ptr,
2370                    gnutls_transport_ptr_t send_ptr);
2371
2372 gnutls_transport_ptr_t gnutls_transport_get_ptr(gnutls_session_t session);
2373 void gnutls_transport_get_ptr2(gnutls_session_t session,
2374                    gnutls_transport_ptr_t *recv_ptr,
2375                    gnutls_transport_ptr_t *send_ptr);
2376
2377 void gnutls_transport_set_vec_push_function(gnutls_session_t session,
2378                         gnutls_vec_push_func vec_func);
2379 void gnutls_transport_set_push_function(gnutls_session_t session,
2380                     gnutls_push_func push_func);
2381 void gnutls_transport_set_pull_function(gnutls_session_t session,
2382                     gnutls_pull_func pull_func);
2383
2384 void gnutls_transport_set_pull_timeout_function(gnutls_session_t session,
2385                         gnutls_pull_timeout_func func);
2386
2387 void gnutls_transport_set_errno_function(gnutls_session_t session,
2388                      gnutls_errno_func errno_func);
2389
2390 void gnutls_transport_set_errno(gnutls_session_t session, int err);
2391
2392 /* session specific
2393  */
2394 void gnutls_session_set_ptr(gnutls_session_t session, void *ptr);
2395 void *gnutls_session_get_ptr(gnutls_session_t session);
2396
2397 void gnutls_openpgp_send_cert(gnutls_session_t session,
2398                   gnutls_openpgp_crt_status_t status);
2399
2400 /* This function returns the hash of the given data.
2401  */
2402 int gnutls_fingerprint(gnutls_digest_algorithm_t algo,
2403                const gnutls_datum_t *data, void *result,
2404                size_t *result_size);
2405
2406 /**
2407  * gnutls_random_art_t:
2408  * @GNUTLS_RANDOM_ART_OPENSSH: OpenSSH-style random art.
2409  *
2410  * Enumeration of different random art types.
2411  */
2412 typedef enum gnutls_random_art {
2413     GNUTLS_RANDOM_ART_OPENSSH = 1
2414 } gnutls_random_art_t;
2415
2416 int gnutls_random_art(gnutls_random_art_t type, const char *key_type,
2417               unsigned int key_size, void *fpr, size_t fpr_size,
2418               gnutls_datum_t *art);
2419
2420 /* IDNA */
2421 #define GNUTLS_IDNA_FORCE_2008 (1 << 1)
2422 int gnutls_idna_map(const char *input, unsigned ilen, gnutls_datum_t *out,
2423             unsigned flags);
2424 int gnutls_idna_reverse_map(const char *input, unsigned ilen,
2425                 gnutls_datum_t *out, unsigned flags);
2426
2427 /* SRP
2428  */
2429
2430 typedef struct gnutls_srp_server_credentials_st *gnutls_srp_server_credentials_t;
2431 typedef struct gnutls_srp_client_credentials_st *gnutls_srp_client_credentials_t;
2432
2433 void gnutls_srp_free_client_credentials(gnutls_srp_client_credentials_t sc);
2434 int gnutls_srp_allocate_client_credentials(gnutls_srp_client_credentials_t *sc);
2435 int gnutls_srp_set_client_credentials(gnutls_srp_client_credentials_t res,
2436                       const char *username,
2437                       const char *password);
2438
2439 void gnutls_srp_free_server_credentials(gnutls_srp_server_credentials_t sc);
2440 int gnutls_srp_allocate_server_credentials(gnutls_srp_server_credentials_t *sc);
2441 int gnutls_srp_set_server_credentials_file(gnutls_srp_server_credentials_t res,
2442                        const char *password_file,
2443                        const char *password_conf_file);
2444
2445 const char *gnutls_srp_server_get_username(gnutls_session_t session);
2446
2447 void gnutls_srp_set_prime_bits(gnutls_session_t session, unsigned int bits);
2448
2449 int gnutls_srp_verifier(const char *username, const char *password,
2450             const gnutls_datum_t *salt,
2451             const gnutls_datum_t *generator,
2452             const gnutls_datum_t *prime, gnutls_datum_t *res);
2453
2454 /* The static parameters defined in draft-ietf-tls-srp-05
2455  * Those should be used as input to gnutls_srp_verifier().
2456  */
2457 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_8192_group_prime;
2458 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_8192_group_generator;
2459
2460 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_4096_group_prime;
2461 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_4096_group_generator;
2462
2463 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_3072_group_prime;
2464 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_3072_group_generator;
2465
2466 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_2048_group_prime;
2467 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_2048_group_generator;
2468
2469 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1536_group_prime;
2470 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1536_group_generator;
2471
2472 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1024_group_prime;
2473 extern _SYM_EXPORT const gnutls_datum_t gnutls_srp_1024_group_generator;
2474
2475 /* The static parameters defined in rfc7919
2476  */
2477
2478 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_8192_group_prime;
2479 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_8192_group_q;
2480 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_8192_group_generator;
2481 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_8192_key_bits;
2482
2483 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_6144_group_prime;
2484 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_6144_group_q;
2485 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_6144_group_generator;
2486 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_6144_key_bits;
2487
2488 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_4096_group_prime;
2489 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_4096_group_q;
2490 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_4096_group_generator;
2491 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_4096_key_bits;
2492
2493 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_3072_group_prime;
2494 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_3072_group_q;
2495 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_3072_group_generator;
2496 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_3072_key_bits;
2497
2498 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_2048_group_prime;
2499 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_2048_group_q;
2500 extern _SYM_EXPORT const gnutls_datum_t gnutls_ffdhe_2048_group_generator;
2501 extern _SYM_EXPORT const unsigned int gnutls_ffdhe_2048_key_bits;
2502
2503 typedef int gnutls_srp_server_credentials_function(gnutls_session_t,
2504                            const char *username,
2505                            gnutls_datum_t *salt,
2506                            gnutls_datum_t *verifier,
2507                            gnutls_datum_t *generator,
2508                            gnutls_datum_t *prime);
2509 void gnutls_srp_set_server_credentials_function(
2510     gnutls_srp_server_credentials_t cred,
2511     gnutls_srp_server_credentials_function *func);
2512
2513 typedef int gnutls_srp_client_credentials_function(gnutls_session_t, char **,
2514                            char **);
2515 void gnutls_srp_set_client_credentials_function(
2516     gnutls_srp_client_credentials_t cred,
2517     gnutls_srp_client_credentials_function *func);
2518
2519 int gnutls_srp_base64_encode(const gnutls_datum_t *data, char *result,
2520                  size_t *result_size);
2521 int gnutls_srp_base64_encode2(const gnutls_datum_t *data,
2522                   gnutls_datum_t *result);
2523
2524 int gnutls_srp_base64_decode(const gnutls_datum_t *b64_data, char *result,
2525                  size_t *result_size);
2526 int gnutls_srp_base64_decode2(const gnutls_datum_t *b64_data,
2527                   gnutls_datum_t *result);
2528
2529 #define gnutls_srp_base64_encode_alloc gnutls_srp_base64_encode2
2530 #define gnutls_srp_base64_decode_alloc gnutls_srp_base64_decode2
2531
2532 void gnutls_srp_set_server_fake_salt_seed(gnutls_srp_server_credentials_t sc,
2533                       const gnutls_datum_t *seed,
2534                       unsigned int salt_length);
2535
2536 /* PSK stuff */
2537 typedef struct gnutls_psk_server_credentials_st *gnutls_psk_server_credentials_t;
2538 typedef struct gnutls_psk_client_credentials_st *gnutls_psk_client_credentials_t;
2539
2540 /**
2541  * gnutls_psk_key_flags:
2542  * @GNUTLS_PSK_KEY_RAW: PSK-key in raw format.
2543  * @GNUTLS_PSK_KEY_HEX: PSK-key in hex format.
2544  * @GNUTLS_PSK_KEY_EXT: PSK-key is external and to be imported.
2545  *
2546  * Enumeration of different PSK key flags.
2547  */
2548 typedef enum gnutls_psk_key_flags {
2549     GNUTLS_PSK_KEY_RAW = 0,
2550     GNUTLS_PSK_KEY_HEX = 1 << 0,
2551     GNUTLS_PSK_KEY_EXT = 1 << 1
2552 } gnutls_psk_key_flags;
2553
2554 void gnutls_psk_free_client_credentials(gnutls_psk_client_credentials_t sc);
2555 int gnutls_psk_allocate_client_credentials(gnutls_psk_client_credentials_t *sc);
2556 int gnutls_psk_set_client_credentials(gnutls_psk_client_credentials_t res,
2557                       const char *username,
2558                       const gnutls_datum_t *key,
2559                       gnutls_psk_key_flags flags);
2560 int gnutls_psk_set_client_credentials2(gnutls_psk_client_credentials_t res,
2561                        const gnutls_datum_t *username,
2562                        const gnutls_datum_t *key,
2563                        gnutls_psk_key_flags flags);
2564
2565 void gnutls_psk_free_server_credentials(gnutls_psk_server_credentials_t sc);
2566 int gnutls_psk_allocate_server_credentials(gnutls_psk_server_credentials_t *sc);
2567 int gnutls_psk_set_server_credentials_file(gnutls_psk_server_credentials_t res,
2568                        const char *password_file);
2569
2570 int gnutls_psk_set_server_credentials_hint(gnutls_psk_server_credentials_t res,
2571                        const char *hint);
2572
2573 const char *gnutls_psk_server_get_username(gnutls_session_t session);
2574 int gnutls_psk_server_get_username2(gnutls_session_t session,
2575                     gnutls_datum_t *out);
2576 const char *gnutls_psk_client_get_hint(gnutls_session_t session);
2577
2578 typedef int gnutls_psk_server_credentials_function(gnutls_session_t,
2579                            const char *username,
2580                            gnutls_datum_t *key);
2581 typedef int gnutls_psk_server_credentials_function2(
2582     gnutls_session_t, const gnutls_datum_t *username, gnutls_datum_t *key);
2583 typedef int gnutls_psk_server_credentials_function3(
2584     gnutls_session_t, const gnutls_datum_t *username, gnutls_datum_t *key,
2585     gnutls_psk_key_flags *flags);
2586 void gnutls_psk_set_server_credentials_function(
2587     gnutls_psk_server_credentials_t cred,
2588     gnutls_psk_server_credentials_function *func);
2589 void gnutls_psk_set_server_credentials_function2(
2590     gnutls_psk_server_credentials_t cred,
2591     gnutls_psk_server_credentials_function2 *func);
2592 void gnutls_psk_set_server_credentials_function3(
2593     gnutls_psk_server_credentials_t cred,
2594     gnutls_psk_server_credentials_function3 *func);
2595
2596 int gnutls_psk_format_imported_identity(const gnutls_datum_t *identity,
2597                     const gnutls_datum_t *context,
2598                     gnutls_protocol_t version,
2599                     gnutls_digest_algorithm_t hash,
2600                     gnutls_datum_t *imported_identity);
2601
2602 typedef int gnutls_psk_client_credentials_function(gnutls_session_t,
2603                            char **username,
2604                            gnutls_datum_t *key);
2605 typedef int gnutls_psk_client_credentials_function2(gnutls_session_t,
2606                             gnutls_datum_t *username,
2607                             gnutls_datum_t *key);
2608 typedef int gnutls_psk_client_credentials_function3(
2609     gnutls_session_t, gnutls_datum_t *username, gnutls_datum_t *key,
2610     gnutls_psk_key_flags *flags);
2611 void gnutls_psk_set_client_credentials_function(
2612     gnutls_psk_client_credentials_t cred,
2613     gnutls_psk_client_credentials_function *func);
2614 void gnutls_psk_set_client_credentials_function2(
2615     gnutls_psk_client_credentials_t cred,
2616     gnutls_psk_client_credentials_function2 *func);
2617 void gnutls_psk_set_client_credentials_function3(
2618     gnutls_psk_client_credentials_t cred,
2619     gnutls_psk_client_credentials_function3 *func);
2620
2621 int gnutls_hex_encode(const gnutls_datum_t *data, char *result,
2622               size_t *result_size);
2623 int gnutls_hex_decode(const gnutls_datum_t *hex_data, void *result,
2624               size_t *result_size);
2625
2626 int gnutls_hex_encode2(const gnutls_datum_t *data, gnutls_datum_t *result);
2627 int gnutls_hex_decode2(const gnutls_datum_t *data, gnutls_datum_t *result);
2628
2629 void gnutls_psk_set_server_dh_params(gnutls_psk_server_credentials_t res,
2630                      gnutls_dh_params_t dh_params);
2631
2632 int gnutls_psk_set_server_known_dh_params(gnutls_psk_server_credentials_t res,
2633                       gnutls_sec_param_t sec_param);
2634
2635 void gnutls_psk_set_server_params_function(gnutls_psk_server_credentials_t res,
2636                        gnutls_params_function *func);
2637
2638 /**
2639  * gnutls_x509_subject_alt_name_t:
2640  * @GNUTLS_SAN_DNSNAME: DNS-name SAN.
2641  * @GNUTLS_SAN_RFC822NAME: E-mail address SAN.
2642  * @GNUTLS_SAN_URI: URI SAN.
2643  * @GNUTLS_SAN_IPADDRESS: IP address SAN.
2644  * @GNUTLS_SAN_OTHERNAME: OtherName SAN.
2645  * @GNUTLS_SAN_DN: DN SAN.
2646  * @GNUTLS_SAN_REGISTERED_ID: RegisteredID.
2647  * @GNUTLS_SAN_OTHERNAME_XMPP: Virtual SAN, used by certain functions for convenience.
2648  * @GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL: Virtual SAN, used by certain functions for convenience.
2649  * @GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: Virtual SAN, used by certain functions for convenience.
2650  *
2651  * Enumeration of different subject alternative names types.
2652  */
2653 typedef enum gnutls_x509_subject_alt_name_t {
2654     GNUTLS_SAN_DNSNAME = 1,
2655     GNUTLS_SAN_RFC822NAME = 2,
2656     GNUTLS_SAN_URI = 3,
2657     GNUTLS_SAN_IPADDRESS = 4,
2658     GNUTLS_SAN_OTHERNAME = 5,
2659     GNUTLS_SAN_DN = 6,
2660     GNUTLS_SAN_REGISTERED_ID = 7,
2661     GNUTLS_SAN_MAX = GNUTLS_SAN_REGISTERED_ID,
2662     /* The following are "virtual" subject alternative name types, in
2663        that they are represented by an otherName value and an OID.
2664        Used by gnutls_x509_crt_get_subject_alt_othername_oid.  */
2665     GNUTLS_SAN_OTHERNAME_XMPP = 1000,
2666     GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL,
2667     GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL
2668 } gnutls_x509_subject_alt_name_t;
2669
2670 struct gnutls_openpgp_crt_int;
2671 typedef struct gnutls_openpgp_crt_int *gnutls_openpgp_crt_t;
2672
2673 struct gnutls_openpgp_privkey_int;
2674 typedef struct gnutls_openpgp_privkey_int *gnutls_openpgp_privkey_t;
2675
2676 struct gnutls_pkcs11_privkey_st;
2677 typedef struct gnutls_pkcs11_privkey_st *gnutls_pkcs11_privkey_t;
2678
2679 /**
2680  * gnutls_privkey_type_t:
2681  * @GNUTLS_PRIVKEY_X509: X.509 private key, #gnutls_x509_privkey_t.
2682  * @GNUTLS_PRIVKEY_OPENPGP: OpenPGP private key, #gnutls_openpgp_privkey_t.
2683  * @GNUTLS_PRIVKEY_PKCS11: PKCS11 private key, #gnutls_pkcs11_privkey_t.
2684  * @GNUTLS_PRIVKEY_EXT: External private key, operating using callbacks.
2685  *
2686  * Enumeration of different private key types.
2687  */
2688 typedef enum {
2689     GNUTLS_PRIVKEY_X509,
2690     GNUTLS_PRIVKEY_OPENPGP,
2691     GNUTLS_PRIVKEY_PKCS11,
2692     GNUTLS_PRIVKEY_EXT
2693 } gnutls_privkey_type_t;
2694
2695 typedef struct gnutls_retr2_st {
2696     gnutls_certificate_type_t cert_type;
2697     gnutls_privkey_type_t key_type;
2698
2699     union {
2700         gnutls_x509_crt_t *x509;
2701         gnutls_openpgp_crt_t pgp;
2702     } cert;
2703     unsigned int ncerts; /* one for pgp keys */
2704
2705     union {
2706         gnutls_x509_privkey_t x509;
2707         gnutls_openpgp_privkey_t pgp;
2708         gnutls_pkcs11_privkey_t pkcs11;
2709     } key;
2710
2711     unsigned int deinit_all; /* if non zero all keys will be deinited */
2712 } gnutls_retr2_st;
2713
2714 /* Functions that allow auth_info_t structures handling
2715    */
2716
2717 gnutls_credentials_type_t gnutls_auth_get_type(gnutls_session_t session);
2718 gnutls_credentials_type_t gnutls_auth_server_get_type(gnutls_session_t session);
2719 gnutls_credentials_type_t gnutls_auth_client_get_type(gnutls_session_t session);
2720
2721 /* DH */
2722
2723 void gnutls_dh_set_prime_bits(gnutls_session_t session, unsigned int bits);
2724 int gnutls_dh_get_secret_bits(gnutls_session_t session);
2725 int gnutls_dh_get_peers_public_bits(gnutls_session_t session);
2726 int gnutls_dh_get_prime_bits(gnutls_session_t session);
2727
2728 int gnutls_dh_get_group(gnutls_session_t session, gnutls_datum_t *raw_gen,
2729             gnutls_datum_t *raw_prime);
2730 int gnutls_dh_get_pubkey(gnutls_session_t session, gnutls_datum_t *raw_key);
2731
2732 /* X509PKI */
2733
2734 /* These are set on the credentials structure.
2735    */
2736
2737 /* use gnutls_certificate_set_retrieve_function2() in abstract.h
2738    * instead. It's much more efficient.
2739    */
2740
2741 typedef int gnutls_certificate_retrieve_function(
2742     gnutls_session_t, const gnutls_datum_t *req_ca_rdn, int nreqs,
2743     const gnutls_pk_algorithm_t *pk_algos, int pk_algos_length,
2744     gnutls_retr2_st *);
2745
2746 void gnutls_certificate_set_retrieve_function(
2747     gnutls_certificate_credentials_t cred,
2748     gnutls_certificate_retrieve_function *func);
2749
2750 void gnutls_certificate_set_verify_function(
2751     gnutls_certificate_credentials_t cred,
2752     gnutls_certificate_verify_function *func);
2753
2754 void gnutls_certificate_server_set_request(gnutls_session_t session,
2755                        gnutls_certificate_request_t req);
2756
2757 /* get data from the session
2758    */
2759 const gnutls_datum_t *gnutls_certificate_get_peers(gnutls_session_t session,
2760                            unsigned int *list_size);
2761 const gnutls_datum_t *gnutls_certificate_get_ours(gnutls_session_t session);
2762
2763 int gnutls_certificate_get_peers_subkey_id(gnutls_session_t session,
2764                        gnutls_datum_t *id);
2765
2766 time_t gnutls_certificate_activation_time_peers(gnutls_session_t session);
2767 time_t gnutls_certificate_expiration_time_peers(gnutls_session_t session);
2768
2769 unsigned gnutls_certificate_client_get_request_status(gnutls_session_t session);
2770 int gnutls_certificate_verify_peers2(gnutls_session_t session,
2771                      unsigned int *status);
2772 int gnutls_certificate_verify_peers3(gnutls_session_t session,
2773                      const char *hostname,
2774                      unsigned int *status);
2775
2776 int gnutls_certificate_verify_peers(gnutls_session_t session,
2777                     gnutls_typed_vdata_st *data,
2778                     unsigned int elements,
2779                     unsigned int *status);
2780
2781 int gnutls_certificate_verification_status_print(unsigned int status,
2782                          gnutls_certificate_type_t type,
2783                          gnutls_datum_t *out,
2784                          unsigned int flags);
2785
2786 int gnutls_pem_base64_encode(const char *msg, const gnutls_datum_t *data,
2787                  char *result, size_t *result_size);
2788 int gnutls_pem_base64_decode(const char *header, const gnutls_datum_t *b64_data,
2789                  unsigned char *result, size_t *result_size);
2790
2791 int gnutls_pem_base64_encode2(const char *msg, const gnutls_datum_t *data,
2792                   gnutls_datum_t *result);
2793 int gnutls_pem_base64_decode2(const char *header,
2794                   const gnutls_datum_t *b64_data,
2795                   gnutls_datum_t *result);
2796
2797 int gnutls_base64_encode2(const gnutls_datum_t *data, gnutls_datum_t *result);
2798 int gnutls_base64_decode2(const gnutls_datum_t *b64_data,
2799               gnutls_datum_t *result);
2800
2801 #define gnutls_pem_base64_encode_alloc gnutls_pem_base64_encode2
2802 #define gnutls_pem_base64_decode_alloc gnutls_pem_base64_decode2
2803
2804 /* key_usage will be an OR of the following values:
2805    */
2806
2807 /* when the key is to be used for signing: */
2808 #define GNUTLS_KEY_DIGITAL_SIGNATURE 128
2809 #define GNUTLS_KEY_NON_REPUDIATION 64
2810 /* when the key is to be used for encryption: */
2811 #define GNUTLS_KEY_KEY_ENCIPHERMENT 32
2812 #define GNUTLS_KEY_DATA_ENCIPHERMENT 16
2813 #define GNUTLS_KEY_KEY_AGREEMENT 8
2814 #define GNUTLS_KEY_KEY_CERT_SIGN 4
2815 #define GNUTLS_KEY_CRL_SIGN 2
2816 #define GNUTLS_KEY_ENCIPHER_ONLY 1
2817 #define GNUTLS_KEY_DECIPHER_ONLY 32768
2818
2819 void gnutls_certificate_set_params_function(
2820     gnutls_certificate_credentials_t res, gnutls_params_function *func);
2821 void gnutls_anon_set_params_function(gnutls_anon_server_credentials_t res,
2822                      gnutls_params_function *func);
2823 void gnutls_psk_set_params_function(gnutls_psk_server_credentials_t res,
2824                     gnutls_params_function *func);
2825
2826 int gnutls_hex2bin(const char *hex_data, size_t hex_size, void *bin_data,
2827            size_t *bin_size);
2828
2829 /* Trust on first use (or ssh like) functions */
2830
2831 /* stores the provided information to a database
2832    */
2833 typedef int (*gnutls_tdb_store_func)(const char *db_name, const char *host,
2834                      const char *service, time_t expiration,
2835                      const gnutls_datum_t *pubkey);
2836
2837 typedef int (*gnutls_tdb_store_commitment_func)(
2838     const char *db_name, const char *host, const char *service,
2839     time_t expiration, gnutls_digest_algorithm_t hash_algo,
2840     const gnutls_datum_t *hash);
2841
2842 /* searches for the provided host/service pair that match the
2843    * provided public key in the database. */
2844 typedef int (*gnutls_tdb_verify_func)(const char *db_name, const char *host,
2845                       const char *service,
2846                       const gnutls_datum_t *pubkey);
2847
2848 struct gnutls_tdb_int;
2849 typedef struct gnutls_tdb_int *gnutls_tdb_t;
2850
2851 int gnutls_tdb_init(gnutls_tdb_t *tdb);
2852 void gnutls_tdb_set_store_func(gnutls_tdb_t tdb, gnutls_tdb_store_func store);
2853 void gnutls_tdb_set_store_commitment_func(
2854     gnutls_tdb_t tdb, gnutls_tdb_store_commitment_func cstore);
2855 void gnutls_tdb_set_verify_func(gnutls_tdb_t tdb,
2856                 gnutls_tdb_verify_func verify);
2857 void gnutls_tdb_deinit(gnutls_tdb_t tdb);
2858
2859 int gnutls_verify_stored_pubkey(const char *db_name, gnutls_tdb_t tdb,
2860                 const char *host, const char *service,
2861                 gnutls_certificate_type_t cert_type,
2862                 const gnutls_datum_t *cert, unsigned int flags);
2863
2864 #define GNUTLS_SCOMMIT_FLAG_ALLOW_BROKEN 1
2865 int gnutls_store_commitment(const char *db_name, gnutls_tdb_t tdb,
2866                 const char *host, const char *service,
2867                 gnutls_digest_algorithm_t hash_algo,
2868                 const gnutls_datum_t *hash, time_t expiration,
2869                 unsigned int flags);
2870
2871 int gnutls_store_pubkey(const char *db_name, gnutls_tdb_t tdb, const char *host,
2872             const char *service,
2873             gnutls_certificate_type_t cert_type,
2874             const gnutls_datum_t *cert, time_t expiration,
2875             unsigned int flags);
2876
2877 /* Other helper functions */
2878 int gnutls_load_file(const char *filename, gnutls_datum_t *data);
2879
2880 unsigned gnutls_url_is_supported(const char *url);
2881
2882 /* PIN callback */
2883
2884 /**
2885  * gnutls_pin_flag_t:
2886  * @GNUTLS_PIN_USER: The PIN for the user.
2887  * @GNUTLS_PIN_SO: The PIN for the security officer (admin).
2888  * @GNUTLS_PIN_CONTEXT_SPECIFIC: The PIN is for a specific action and key like signing.
2889  * @GNUTLS_PIN_FINAL_TRY: This is the final try before blocking.
2890  * @GNUTLS_PIN_COUNT_LOW: Few tries remain before token blocks.
2891  * @GNUTLS_PIN_WRONG: Last given PIN was not correct.
2892  *
2893  * Enumeration of different flags that are input to the PIN function.
2894  */
2895 typedef enum {
2896     GNUTLS_PIN_USER = (1 << 0),
2897     GNUTLS_PIN_SO = (1 << 1),
2898     GNUTLS_PIN_FINAL_TRY = (1 << 2),
2899     GNUTLS_PIN_COUNT_LOW = (1 << 3),
2900     GNUTLS_PIN_CONTEXT_SPECIFIC = (1 << 4),
2901     GNUTLS_PIN_WRONG = (1 << 5)
2902 } gnutls_pin_flag_t;
2903
2904 #define GNUTLS_PKCS11_PIN_USER GNUTLS_PIN_USER
2905 #define GNUTLS_PKCS11_PIN_SO GNUTLS_PIN_SO
2906 #define GNUTLS_PKCS11_PIN_FINAL_TRY GNUTLS_PIN_FINAL_TRY
2907 #define GNUTLS_PKCS11_PIN_COUNT_LOW GNUTLS_PIN_COUNT_LOW
2908 #define GNUTLS_PKCS11_PIN_CONTEXT_SPECIFIC GNUTLS_PIN_CONTEXT_SPECIFIC
2909 #define GNUTLS_PKCS11_PIN_WRONG GNUTLS_PIN_WRONG
2910
2911 /**
2912  * gnutls_pin_callback_t:
2913  * @userdata: user-controlled data from gnutls_pkcs11_set_pin_function().
2914  * @attempt: pin-attempt counter, initially 0.
2915  * @token_url: URL of token.
2916  * @token_label: label of token.
2917  * @flags: a #gnutls_pin_flag_t flag.
2918  * @pin: buffer to hold PIN, of size @pin_max.
2919  * @pin_max: size of @pin buffer.
2920  *
2921  * Callback function type for PKCS#11 or TPM PIN entry.  It is set by
2922  * functions like gnutls_pkcs11_set_pin_function().
2923  *
2924  * The callback should provides the PIN code to unlock the token with
2925  * label @token_label, specified by the URL @token_url.
2926  *
2927  * The PIN code, as a NUL-terminated ASCII string, should be copied
2928  * into the @pin buffer (of maximum size @pin_max), and return 0 to
2929  * indicate success.  Alternatively, the callback may return a
2930  * negative gnutls error code to indicate failure and cancel PIN entry
2931  * (in which case, the contents of the @pin parameter are ignored).
2932  *
2933  * When a PIN is required, the callback will be invoked repeatedly
2934  * (and indefinitely) until either the returned PIN code is correct,
2935  * the callback returns failure, or the token refuses login (e.g. when
2936  * the token is locked due to too many incorrect PINs!).  For the
2937  * first such invocation, the @attempt counter will have value zero;
2938  * it will increase by one for each subsequent attempt.
2939  *
2940  * Returns: %GNUTLS_E_SUCCESS (0) on success or a negative error code on error.
2941  *
2942  * Since: 2.12.0
2943  **/
2944 typedef int (*gnutls_pin_callback_t)(void *userdata, int attempt,
2945                      const char *token_url,
2946                      const char *token_label,
2947                      unsigned int flags, char *pin,
2948                      size_t pin_max);
2949
2950 void gnutls_certificate_set_pin_function(gnutls_certificate_credentials_t,
2951                      gnutls_pin_callback_t fn,
2952                      void *userdata);
2953
2954 /* Public string related functions */
2955 typedef struct gnutls_buffer_st *gnutls_buffer_t;
2956
2957 int gnutls_buffer_append_data(gnutls_buffer_t, const void *data,
2958                   size_t data_size);
2959
2960 #define GNUTLS_UTF8_IGNORE_ERRS 1
2961 int gnutls_utf8_password_normalize(const unsigned char *password,
2962                    unsigned password_len, gnutls_datum_t *out,
2963                    unsigned flags);
2964
2965 /* Public extensions related functions */
2966
2967 typedef void *gnutls_ext_priv_data_t;
2968
2969 void gnutls_ext_set_data(gnutls_session_t session, unsigned type,
2970              gnutls_ext_priv_data_t);
2971 int gnutls_ext_get_data(gnutls_session_t session, unsigned type,
2972             gnutls_ext_priv_data_t *);
2973
2974 unsigned gnutls_ext_get_current_msg(gnutls_session_t session);
2975
2976 typedef int (*gnutls_ext_recv_func)(gnutls_session_t session,
2977                     const unsigned char *data, size_t len);
2978
2979 typedef int (*gnutls_ext_send_func)(gnutls_session_t session,
2980                     gnutls_buffer_t extdata);
2981
2982 typedef void (*gnutls_ext_deinit_data_func)(gnutls_ext_priv_data_t data);
2983
2984 typedef int (*gnutls_ext_pack_func)(gnutls_ext_priv_data_t data,
2985                     gnutls_buffer_t packed_data);
2986
2987 typedef int (*gnutls_ext_unpack_func)(gnutls_buffer_t packed_data,
2988                       gnutls_ext_priv_data_t *data);
2989
2990 #define GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO 1
2991 #define GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO (1 << 1)
2992 typedef int (*gnutls_ext_raw_process_func)(void *ctx, unsigned tls_id,
2993                        const unsigned char *data,
2994                        unsigned data_size);
2995 int gnutls_ext_raw_parse(void *ctx, gnutls_ext_raw_process_func cb,
2996              const gnutls_datum_t *data, unsigned int flags);
2997
2998 /**
2999  * gnutls_ext_parse_type_t:
3000  * @GNUTLS_EXT_NONE: Never to be parsed
3001  * @GNUTLS_EXT_ANY: Any extension type (should not be used as it is used only internally).
3002  * @GNUTLS_EXT_VERSION_NEG: Extensions to be parsed first for TLS version negotiation.
3003  * @GNUTLS_EXT_MANDATORY: Parsed after @GNUTLS_EXT_VERSION_NEG and even when resuming.
3004  * @GNUTLS_EXT_APPLICATION: Parsed after @GNUTLS_EXT_MANDATORY
3005  * @GNUTLS_EXT_TLS: TLS-internal extensions, parsed after @GNUTLS_EXT_APPLICATION.
3006  *
3007  * Enumeration of different TLS extension parsing phases.  The @gnutls_ext_parse_type_t
3008  * indicates the time/phase an extension is parsed during Client or Server hello parsing.
3009  *
3010  */
3011 typedef enum {
3012     GNUTLS_EXT_ANY = 0,
3013     GNUTLS_EXT_APPLICATION = 1,
3014     GNUTLS_EXT_TLS = 2,
3015     GNUTLS_EXT_MANDATORY = 3,
3016     GNUTLS_EXT_NONE = 4,
3017     GNUTLS_EXT_VERSION_NEG = 5
3018 } gnutls_ext_parse_type_t;
3019
3020 /**
3021  * gnutls_ext_flags_t:
3022  * @GNUTLS_EXT_FLAG_OVERRIDE_INTERNAL: If specified the extension registered will override the internal; this does not work with extensions existing prior to 3.6.0.
3023  * @GNUTLS_EXT_FLAG_CLIENT_HELLO: This extension can be present in a client hello
3024  * @GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO: This extension can be present in a TLS1.2 or earlier server hello
3025  * @GNUTLS_EXT_FLAG_TLS13_SERVER_HELLO: This extension can be present in a TLS1.3 server hello
3026  * @GNUTLS_EXT_FLAG_EE: This extension can be present in encrypted extensions message
3027  * @GNUTLS_EXT_FLAG_HRR: This extension can be present in hello retry request message
3028  * @GNUTLS_EXT_FLAG_IGNORE_CLIENT_REQUEST: When flag is present, this extension will be send even if the client didn't advertise it. An extension of this type is the Cookie TLS1.3 extension.
3029  * @GNUTLS_EXT_FLAG_DTLS: This extension can be present under DTLS; otherwise ignored.
3030  * @GNUTLS_EXT_FLAG_TLS: This extension can be present under TLS; otherwise ignored.
3031  *
3032  * Enumeration of different TLS extension registration flags.
3033  */
3034 typedef enum {
3035     GNUTLS_EXT_FLAG_OVERRIDE_INTERNAL = 1,
3036     GNUTLS_EXT_FLAG_CLIENT_HELLO = (1 << 1),
3037     GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO = (1 << 2),
3038     GNUTLS_EXT_FLAG_TLS13_SERVER_HELLO = (1 << 3),
3039     GNUTLS_EXT_FLAG_EE = (1 << 4), /* ENCRYPTED */
3040     GNUTLS_EXT_FLAG_HRR = (1 << 5),
3041     GNUTLS_EXT_FLAG_IGNORE_CLIENT_REQUEST = (1 << 6),
3042     GNUTLS_EXT_FLAG_TLS = (1 << 7),
3043     GNUTLS_EXT_FLAG_DTLS = (1 << 8)
3044 } gnutls_ext_flags_t;
3045
3046 /* Register a custom tls extension
3047  */
3048 int gnutls_ext_register(const char *name, int type,
3049             gnutls_ext_parse_type_t parse_point,
3050             gnutls_ext_recv_func recv_func,
3051             gnutls_ext_send_func send_func,
3052             gnutls_ext_deinit_data_func deinit_func,
3053             gnutls_ext_pack_func pack_func,
3054             gnutls_ext_unpack_func unpack_func);
3055
3056 int gnutls_session_ext_register(gnutls_session_t, const char *name, int type,
3057                 gnutls_ext_parse_type_t parse_point,
3058                 gnutls_ext_recv_func recv_func,
3059                 gnutls_ext_send_func send_func,
3060                 gnutls_ext_deinit_data_func deinit_func,
3061                 gnutls_ext_pack_func pack_func,
3062                 gnutls_ext_unpack_func unpack_func,
3063                 unsigned flags);
3064
3065 const char *gnutls_ext_get_name(unsigned int ext);
3066 const char *gnutls_ext_get_name2(gnutls_session_t session, unsigned int tls_id,
3067                  gnutls_ext_parse_type_t parse_point);
3068
3069 /* Public supplemental data related functions */
3070
3071 typedef int (*gnutls_supp_recv_func)(gnutls_session_t session,
3072                      const unsigned char *data,
3073                      size_t data_size);
3074 typedef int (*gnutls_supp_send_func)(gnutls_session_t session,
3075                      gnutls_buffer_t buf);
3076
3077 int gnutls_supplemental_register(const char *name,
3078                  gnutls_supplemental_data_format_type_t type,
3079                  gnutls_supp_recv_func supp_recv_func,
3080                  gnutls_supp_send_func supp_send_func);
3081
3082 int gnutls_session_supplemental_register(
3083     gnutls_session_t session, const char *name,
3084     gnutls_supplemental_data_format_type_t type,
3085     gnutls_supp_recv_func supp_recv_func,
3086     gnutls_supp_send_func supp_send_func, unsigned int flags);
3087
3088 void gnutls_supplemental_recv(gnutls_session_t session,
3089                   unsigned do_recv_supplemental);
3090
3091 void gnutls_supplemental_send(gnutls_session_t session,
3092                   unsigned do_send_supplemental);
3093
3094 /* Anti-replay related functions */
3095
3096 typedef struct gnutls_anti_replay_st *gnutls_anti_replay_t;
3097
3098 int gnutls_anti_replay_init(gnutls_anti_replay_t *anti_replay);
3099 void gnutls_anti_replay_deinit(gnutls_anti_replay_t anti_replay);
3100 void gnutls_anti_replay_set_window(gnutls_anti_replay_t anti_replay,
3101                    unsigned int window);
3102 void gnutls_anti_replay_enable(gnutls_session_t session,
3103                    gnutls_anti_replay_t anti_replay);
3104
3105 typedef int (*gnutls_db_add_func)(void *, time_t exp_time,
3106                   const gnutls_datum_t *key,
3107                   const gnutls_datum_t *data);
3108
3109 void gnutls_anti_replay_set_add_function(gnutls_anti_replay_t,
3110                      gnutls_db_add_func add_func);
3111
3112 void gnutls_anti_replay_set_ptr(gnutls_anti_replay_t, void *ptr);
3113
3114 /**
3115  * gnutls_record_encryption_level_t:
3116  * @GNUTLS_ENCRYPTION_LEVEL_INITIAL: initial level that doesn't involve any
3117  *    encryption
3118  * @GNUTLS_ENCRYPTION_LEVEL_EARLY: early traffic secret is installed
3119  * @GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE: handshake traffic secret is installed
3120  * @GNUTLS_ENCRYPTION_LEVEL_APPLICATION: application traffic secret is installed
3121  *
3122  * Enumeration of different levels of record encryption currently in place.
3123  * This is used by gnutls_handshake_set_read_function() and
3124  * gnutls_handshake_write().
3125  *
3126  * Since: 3.7.0
3127  */
3128 typedef enum {
3129     GNUTLS_ENCRYPTION_LEVEL_INITIAL,
3130     GNUTLS_ENCRYPTION_LEVEL_EARLY,
3131     GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE,
3132     GNUTLS_ENCRYPTION_LEVEL_APPLICATION
3133 } gnutls_record_encryption_level_t;
3134
3135 /**
3136  * gnutls_handshake_read_func:
3137  * @session: the current session
3138  * @htype: the type of the handshake message (#gnutls_handshake_description_t)
3139  * @level: #gnutls_record_encryption_level_t
3140  * @data: the (const) data that was being sent
3141  * @data_size: the size of data
3142  *
3143  * Function prototype for handshake intercepting hooks. It is set using
3144  * gnutls_handshake_set_read_function().
3145  *
3146  * Returns: Non zero on error.
3147  * Since: 3.7.0
3148  */
3149 typedef int (*gnutls_handshake_read_func)(gnutls_session_t session,
3150                       gnutls_record_encryption_level_t level,
3151                       gnutls_handshake_description_t htype,
3152                       const void *data, size_t data_size);
3153
3154 void gnutls_handshake_set_read_function(gnutls_session_t session,
3155                     gnutls_handshake_read_func func);
3156
3157 int gnutls_handshake_write(gnutls_session_t session,
3158                gnutls_record_encryption_level_t level,
3159                const void *data, size_t data_size);
3160
3161 /**
3162  * gnutls_handshake_secret_func:
3163  * @session: the current session
3164  * @level: the encryption level
3165  * @secret_read: the secret used for reading, can be %NULL if not set
3166  * @secret_write: the secret used for writing, can be %NULL if not set
3167  * @secret_size: the size of the secrets
3168  *
3169  * Function prototype for secret hooks. It is set using
3170  * gnutls_handshake_set_secret_function().
3171  *
3172  * Returns: Non zero on error.
3173  * Since: 3.7.0
3174  */
3175 typedef int (*gnutls_handshake_secret_func)(
3176     gnutls_session_t session, gnutls_record_encryption_level_t level,
3177     const void *secret_read, const void *secret_write, size_t secret_size);
3178
3179 void gnutls_handshake_set_secret_function(gnutls_session_t session,
3180                       gnutls_handshake_secret_func func);
3181
3182 /**
3183  * gnutls_alert_read_func:
3184  * @session: the current session
3185  * @level: #gnutls_record_encryption_level_t
3186  * @alert_level: the level of the alert
3187  * @alert_desc: the alert description
3188  *
3189  * Function prototype for alert intercepting hooks. It is set using
3190  * gnutls_alert_set_read_function().
3191  *
3192  * Returns: Non zero on error.
3193  * Since: 3.7.0
3194  */
3195 typedef int (*gnutls_alert_read_func)(gnutls_session_t session,
3196                       gnutls_record_encryption_level_t level,
3197                       gnutls_alert_level_t alert_level,
3198                       gnutls_alert_description_t alert_desc);
3199
3200 void gnutls_alert_set_read_function(gnutls_session_t session,
3201                     gnutls_alert_read_func func);
3202
3203 /* FIPS140-2 related functions */
3204 unsigned gnutls_fips140_mode_enabled(void);
3205
3206 /**
3207  * gnutls_fips_mode_t:
3208  * @GNUTLS_FIPS140_DISABLED: The FIPS140-2 mode is disabled.
3209  * @GNUTLS_FIPS140_STRICT: The default mode; all forbidden operations will cause an
3210  *                         operation failure via error code.
3211  * @GNUTLS_FIPS140_LAX: The library still uses the FIPS140-2 relevant algorithms but all
3212  *                      forbidden by FIPS140-2 operations are allowed; this is useful when the
3213  *                      application is aware of the followed security policy, and needs
3214  *                      to utilize disallowed operations for other reasons (e.g., compatibility).
3215  * @GNUTLS_FIPS140_LOG: Similarly to %GNUTLS_FIPS140_LAX, it allows forbidden operations; any use of them results
3216  *                      to a message to the audit callback functions.
3217  * @GNUTLS_FIPS140_SELFTESTS: A transient state during library initialization. That state
3218  *          cannot be set or seen by applications.
3219  *
3220  * Enumeration of different operational modes under FIPS140-2.
3221  */
3222 typedef enum gnutls_fips_mode_t {
3223     GNUTLS_FIPS140_DISABLED = 0,
3224     GNUTLS_FIPS140_STRICT = 1,
3225     GNUTLS_FIPS140_SELFTESTS = 2,
3226     GNUTLS_FIPS140_LAX = 3,
3227     GNUTLS_FIPS140_LOG = 4
3228 } gnutls_fips_mode_t;
3229
3230 #define GNUTLS_FIPS140_SET_MODE_THREAD 1
3231
3232 void gnutls_fips140_set_mode(gnutls_fips_mode_t mode, unsigned flags);
3233
3234 #define GNUTLS_FIPS140_SET_LAX_MODE()                            \
3235     do {                                                     \
3236         if (gnutls_fips140_mode_enabled())               \
3237             gnutls_fips140_set_mode(                 \
3238                 GNUTLS_FIPS140_LAX,              \
3239                 GNUTLS_FIPS140_SET_MODE_THREAD); \
3240     } while (0)
3241
3242 #define GNUTLS_FIPS140_SET_STRICT_MODE()                         \
3243     do {                                                     \
3244         if (gnutls_fips140_mode_enabled())               \
3245             gnutls_fips140_set_mode(                 \
3246                 GNUTLS_FIPS140_STRICT,           \
3247                 GNUTLS_FIPS140_SET_MODE_THREAD); \
3248     } while (0)
3249
3250 typedef struct gnutls_fips140_context_st *gnutls_fips140_context_t;
3251
3252 int gnutls_fips140_context_init(gnutls_fips140_context_t *context);
3253 void gnutls_fips140_context_deinit(gnutls_fips140_context_t context);
3254
3255 /**
3256  * gnutls_fips140_operation_state_t:
3257  * @GNUTLS_FIPS140_OP_INITIAL: no previous operation has done
3258  * @GNUTLS_FIPS140_OP_APPROVED: the previous operation was FIPS approved
3259  * @GNUTLS_FIPS140_OP_NOT_APPROVED: the previous operation was not FIPS approved
3260  * @GNUTLS_FIPS140_OP_ERROR: the previous operation caused an error regardless of FIPS
3261  *
3262  * The FIPS operation state set by the preceding operation.
3263  *
3264  * There are state transition rules among the enum values:
3265  * - When the context is attached to a thread, it will be set to reset
3266  *   to the %GNUTLS_FIPS140_OP_INITIAL state
3267  * - From the %GNUTLS_FIPS140_OP_INITIAL state, the context can
3268  *   transition to either %GNUTLS_FIPS140_OP_APPROVED,
3269  *   %GNUTLS_FIPS140_OP_NOT_APPROVED, or %GNUTLS_FIPS140_OP_ERROR
3270  * - From the %GNUTLS_FIPS140_OP_APPROVED state, the context can
3271  *   transition to %GNUTLS_FIPS140_OP_NOT_APPROVED
3272  * - All other transitions are prohibited.
3273  *
3274  * Since: 3.7.3
3275  */
3276 typedef enum {
3277     GNUTLS_FIPS140_OP_INITIAL,
3278     GNUTLS_FIPS140_OP_APPROVED,
3279     GNUTLS_FIPS140_OP_NOT_APPROVED,
3280     GNUTLS_FIPS140_OP_ERROR
3281 } gnutls_fips140_operation_state_t;
3282
3283 gnutls_fips140_operation_state_t
3284 gnutls_fips140_get_operation_state(gnutls_fips140_context_t context);
3285
3286 int gnutls_fips140_push_context(gnutls_fips140_context_t context);
3287 int gnutls_fips140_pop_context(void);
3288
3289 int gnutls_fips140_run_self_tests(void);
3290
3291 /**
3292  * gnutls_transport_ktls_enable_flags_t:
3293  * @GNUTLS_KTLS_RECV: ktls enabled for recv function.
3294  * @GNUTLS_KTLS_SEND: ktls enabled for send function.
3295  * @GNUTLS_KTLS_DUPLEX: ktls enabled for both recv and send functions.
3296  *
3297  * Flag enumeration of ktls enable status for recv and send functions.
3298  * This is used by gnutls_transport_is_ktls_enabled().
3299  *
3300  * Since: 3.7.3
3301  */
3302 typedef enum {
3303     GNUTLS_KTLS_RECV = 1 << 0,
3304     GNUTLS_KTLS_SEND = 1 << 1,
3305     GNUTLS_KTLS_DUPLEX = GNUTLS_KTLS_RECV | GNUTLS_KTLS_SEND,
3306 } gnutls_transport_ktls_enable_flags_t;
3307
3308 gnutls_transport_ktls_enable_flags_t
3309 gnutls_transport_is_ktls_enabled(gnutls_session_t session);
3310
3311 /* Gnutls error codes. The mapping to a TLS alert is also shown in
3312    * comments.
3313    */
3314
3315 #define GNUTLS_E_SUCCESS 0
3316 #define GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM -3
3317 #define GNUTLS_E_UNKNOWN_CIPHER_TYPE -6
3318 #define GNUTLS_E_LARGE_PACKET -7
3319 #define GNUTLS_E_UNSUPPORTED_VERSION_PACKET -8 /* GNUTLS_A_PROTOCOL_VERSION */
3320 #define GNUTLS_E_TLS_PACKET_DECODING_ERROR GNUTLS_E_UNEXPECTED_PACKET_LENGTH
3321 #define GNUTLS_E_UNEXPECTED_PACKET_LENGTH -9 /* GNUTLS_A_DECODE_ERROR */
3322 #define GNUTLS_E_INVALID_SESSION -10
3323 #define GNUTLS_E_FATAL_ALERT_RECEIVED -12
3324 #define GNUTLS_E_UNEXPECTED_PACKET -15 /* GNUTLS_A_UNEXPECTED_MESSAGE */
3325 #define GNUTLS_E_WARNING_ALERT_RECEIVED -16
3326 #define GNUTLS_E_ERROR_IN_FINISHED_PACKET -18
3327 #define GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET -19
3328 #define GNUTLS_E_UNKNOWN_CIPHER_SUITE -21
3329 /* GNUTLS_A_HANDSHAKE_FAILURE */
3330 #define GNUTLS_E_UNWANTED_ALGORITHM -22
3331 #define GNUTLS_E_MPI_SCAN_FAILED -23
3332 #define GNUTLS_E_DECRYPTION_FAILED \
3333     -24 /* GNUTLS_A_DECRYPTION_FAILED, GNUTLS_A_BAD_RECORD_MAC */
3334 #define GNUTLS_E_MEMORY_ERROR -25
3335 #define GNUTLS_E_DECOMPRESSION_FAILED -26 /* GNUTLS_A_DECOMPRESSION_FAILURE */
3336 #define GNUTLS_E_COMPRESSION_FAILED -27
3337 #define GNUTLS_E_AGAIN -28
3338 #define GNUTLS_E_EXPIRED -29
3339 #define GNUTLS_E_DB_ERROR -30
3340 #define GNUTLS_E_SRP_PWD_ERROR GNUTLS_E_KEYFILE_ERROR
3341 #define GNUTLS_E_KEYFILE_ERROR -31
3342 #define GNUTLS_E_INSUFFICIENT_CREDENTIALS -32
3343 #define GNUTLS_E_INSUFICIENT_CREDENTIALS \
3344     GNUTLS_E_INSUFFICIENT_CREDENTIALS /* for backwards compatibility only */
3345 #define GNUTLS_E_INSUFFICIENT_CRED GNUTLS_E_INSUFFICIENT_CREDENTIALS
3346 #define GNUTLS_E_INSUFICIENT_CRED \
3347     GNUTLS_E_INSUFFICIENT_CREDENTIALS /* for backwards compatibility only */
3348
3349 #define GNUTLS_E_HASH_FAILED -33
3350 #define GNUTLS_E_BASE64_DECODING_ERROR -34
3351
3352 #define GNUTLS_E_MPI_PRINT_FAILED -35
3353 #define GNUTLS_E_REHANDSHAKE -37 /* GNUTLS_A_NO_RENEGOTIATION */
3354 #define GNUTLS_E_GOT_APPLICATION_DATA -38
3355 #define GNUTLS_E_RECORD_LIMIT_REACHED -39
3356 #define GNUTLS_E_ENCRYPTION_FAILED -40
3357
3358 #define GNUTLS_E_PK_ENCRYPTION_FAILED -44
3359 #define GNUTLS_E_PK_DECRYPTION_FAILED -45
3360 #define GNUTLS_E_PK_SIGN_FAILED -46
3361 #define GNUTLS_E_X509_UNSUPPORTED_CRITICAL_EXTENSION -47
3362 #define GNUTLS_E_KEY_USAGE_VIOLATION -48
3363 #define GNUTLS_E_NO_CERTIFICATE_FOUND -49 /* GNUTLS_A_BAD_CERTIFICATE */
3364 #define GNUTLS_E_INVALID_REQUEST -50
3365 #define GNUTLS_E_SHORT_MEMORY_BUFFER -51
3366 #define GNUTLS_E_INTERRUPTED -52
3367 #define GNUTLS_E_PUSH_ERROR -53
3368 #define GNUTLS_E_PULL_ERROR -54
3369 #define GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER -55 /* GNUTLS_A_ILLEGAL_PARAMETER */
3370 #define GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE -56
3371 #define GNUTLS_E_PKCS1_WRONG_PAD -57
3372 #define GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION -58
3373 #define GNUTLS_E_INTERNAL_ERROR -59
3374 #define GNUTLS_E_DH_PRIME_UNACCEPTABLE -63
3375 #define GNUTLS_E_FILE_ERROR -64
3376 #define GNUTLS_E_TOO_MANY_EMPTY_PACKETS -78
3377 #define GNUTLS_E_UNKNOWN_PK_ALGORITHM -80
3378 #define GNUTLS_E_TOO_MANY_HANDSHAKE_PACKETS -81
3379 #define GNUTLS_E_RECEIVED_DISALLOWED_NAME -82 /* GNUTLS_A_ILLEGAL_PARAMETER */
3380 #define GNUTLS_E_CERTIFICATE_REQUIRED -112 /* GNUTLS_A_CERTIFICATE_REQUIRED */
3381
3382 /* returned if you need to generate temporary RSA
3383    * parameters. These are needed for export cipher suites.
3384    */
3385 #define GNUTLS_E_NO_TEMPORARY_RSA_PARAMS -84
3386
3387 #define GNUTLS_E_NO_COMPRESSION_ALGORITHMS -86
3388 #define GNUTLS_E_NO_CIPHER_SUITES -87
3389
3390 #define GNUTLS_E_OPENPGP_GETKEY_FAILED -88
3391 #define GNUTLS_E_PK_SIG_VERIFY_FAILED -89
3392
3393 #define GNUTLS_E_ILLEGAL_SRP_USERNAME -90
3394 #define GNUTLS_E_SRP_PWD_PARSING_ERROR GNUTLS_E_KEYFILE_PARSING_ERROR
3395 #define GNUTLS_E_KEYFILE_PARSING_ERROR -91
3396 #define GNUTLS_E_NO_TEMPORARY_DH_PARAMS -93
3397
3398 /* For certificate and key stuff
3399    */
3400 #define GNUTLS_E_ASN1_ELEMENT_NOT_FOUND -67
3401 #define GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND -68
3402 #define GNUTLS_E_ASN1_DER_ERROR -69
3403 #define GNUTLS_E_ASN1_VALUE_NOT_FOUND -70
3404 #define GNUTLS_E_ASN1_GENERIC_ERROR -71
3405 #define GNUTLS_E_ASN1_VALUE_NOT_VALID -72
3406 #define GNUTLS_E_ASN1_TAG_ERROR -73
3407 #define GNUTLS_E_ASN1_TAG_IMPLICIT -74
3408 #define GNUTLS_E_ASN1_TYPE_ANY_ERROR -75
3409 #define GNUTLS_E_ASN1_SYNTAX_ERROR -76
3410 #define GNUTLS_E_ASN1_DER_OVERFLOW -77
3411 #define GNUTLS_E_OPENPGP_UID_REVOKED -79
3412 #define GNUTLS_E_CERTIFICATE_ERROR -43
3413 #define GNUTLS_E_X509_CERTIFICATE_ERROR GNUTLS_E_CERTIFICATE_ERROR
3414 #define GNUTLS_E_CERTIFICATE_KEY_MISMATCH -60
3415 #define GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE \
3416     -61 /* GNUTLS_A_UNSUPPORTED_CERTIFICATE */
3417 #define GNUTLS_E_X509_UNKNOWN_SAN -62
3418 #define GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED -94
3419 #define GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE -95
3420 #define GNUTLS_E_UNKNOWN_HASH_ALGORITHM -96
3421 #define GNUTLS_E_UNKNOWN_PKCS_CONTENT_TYPE -97
3422 #define GNUTLS_E_UNKNOWN_PKCS_BAG_TYPE -98
3423 #define GNUTLS_E_INVALID_PASSWORD -99
3424 #define GNUTLS_E_MAC_VERIFY_FAILED -100 /* for PKCS #12 MAC */
3425 #define GNUTLS_E_CONSTRAINT_ERROR -101
3426
3427 #define GNUTLS_E_WARNING_IA_IPHF_RECEIVED -102
3428 #define GNUTLS_E_WARNING_IA_FPHF_RECEIVED -103
3429
3430 #define GNUTLS_E_IA_VERIFY_FAILED -104
3431 #define GNUTLS_E_UNKNOWN_ALGORITHM -105
3432 #define GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM -106
3433 #define GNUTLS_E_SAFE_RENEGOTIATION_FAILED -107
3434 #define GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED -108
3435 #define GNUTLS_E_UNKNOWN_SRP_USERNAME -109
3436 #define GNUTLS_E_PREMATURE_TERMINATION -110
3437
3438 #define GNUTLS_E_MALFORMED_CIDR -111
3439
3440 #define GNUTLS_E_BASE64_ENCODING_ERROR -201
3441 #define GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY -202 /* obsolete */
3442 #define GNUTLS_E_INCOMPATIBLE_CRYPTO_LIBRARY -202
3443 #define GNUTLS_E_INCOMPATIBLE_LIBTASN1_LIBRARY -203
3444
3445 #define GNUTLS_E_OPENPGP_KEYRING_ERROR -204
3446 #define GNUTLS_E_X509_UNSUPPORTED_OID -205
3447
3448 #define GNUTLS_E_RANDOM_FAILED -206
3449 #define GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR -207
3450
3451 #define GNUTLS_E_OPENPGP_SUBKEY_ERROR -208
3452
3453 #define GNUTLS_E_CRYPTO_ALREADY_REGISTERED GNUTLS_E_ALREADY_REGISTERED
3454 #define GNUTLS_E_ALREADY_REGISTERED -209
3455
3456 #define GNUTLS_E_HANDSHAKE_TOO_LARGE -210
3457
3458 #define GNUTLS_E_CRYPTODEV_IOCTL_ERROR -211
3459 #define GNUTLS_E_CRYPTODEV_DEVICE_ERROR -212
3460
3461 #define GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE -213
3462 #define GNUTLS_E_BAD_COOKIE -214
3463 #define GNUTLS_E_OPENPGP_PREFERRED_KEY_ERROR -215
3464 #define GNUTLS_E_INCOMPAT_DSA_KEY_WITH_TLS_PROTOCOL -216
3465 #define GNUTLS_E_INSUFFICIENT_SECURITY -217
3466
3467 #define GNUTLS_E_HEARTBEAT_PONG_RECEIVED -292
3468 #define GNUTLS_E_HEARTBEAT_PING_RECEIVED -293
3469
3470 #define GNUTLS_E_UNRECOGNIZED_NAME -294
3471
3472 /* PKCS11 related */
3473 #define GNUTLS_E_PKCS11_ERROR -300
3474 #define GNUTLS_E_PKCS11_LOAD_ERROR -301
3475 #define GNUTLS_E_PARSING_ERROR -302
3476 #define GNUTLS_E_PKCS11_PIN_ERROR -303
3477
3478 #define GNUTLS_E_PKCS11_SLOT_ERROR -305
3479 #define GNUTLS_E_LOCKING_ERROR -306
3480 #define GNUTLS_E_PKCS11_ATTRIBUTE_ERROR -307
3481 #define GNUTLS_E_PKCS11_DEVICE_ERROR -308
3482 #define GNUTLS_E_PKCS11_DATA_ERROR -309
3483 #define GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR -310
3484 #define GNUTLS_E_PKCS11_KEY_ERROR -311
3485 #define GNUTLS_E_PKCS11_PIN_EXPIRED -312
3486 #define GNUTLS_E_PKCS11_PIN_LOCKED -313
3487 #define GNUTLS_E_PKCS11_SESSION_ERROR -314
3488 #define GNUTLS_E_PKCS11_SIGNATURE_ERROR -315
3489 #define GNUTLS_E_PKCS11_TOKEN_ERROR -316
3490 #define GNUTLS_E_PKCS11_USER_ERROR -317
3491
3492 #define GNUTLS_E_CRYPTO_INIT_FAILED -318
3493 #define GNUTLS_E_TIMEDOUT -319
3494 #define GNUTLS_E_USER_ERROR -320
3495 #define GNUTLS_E_ECC_NO_SUPPORTED_CURVES -321
3496 #define GNUTLS_E_ECC_UNSUPPORTED_CURVE -322
3497 #define GNUTLS_E_PKCS11_REQUESTED_OBJECT_NOT_AVAILBLE -323
3498 #define GNUTLS_E_CERTIFICATE_LIST_UNSORTED -324
3499 #define GNUTLS_E_ILLEGAL_PARAMETER -325 /* GNUTLS_A_ILLEGAL_PARAMETER */
3500 #define GNUTLS_E_NO_PRIORITIES_WERE_SET -326
3501 #define GNUTLS_E_X509_UNSUPPORTED_EXTENSION -327
3502 #define GNUTLS_E_SESSION_EOF -328
3503
3504 #define GNUTLS_E_TPM_ERROR -329
3505 #define GNUTLS_E_TPM_KEY_PASSWORD_ERROR -330
3506 #define GNUTLS_E_TPM_SRK_PASSWORD_ERROR -331
3507 #define GNUTLS_E_TPM_SESSION_ERROR -332
3508 #define GNUTLS_E_TPM_KEY_NOT_FOUND -333
3509 #define GNUTLS_E_TPM_UNINITIALIZED -334
3510 #define GNUTLS_E_TPM_NO_LIB -335
3511
3512 #define GNUTLS_E_NO_CERTIFICATE_STATUS -340
3513 #define GNUTLS_E_OCSP_RESPONSE_ERROR -341
3514 #define GNUTLS_E_RANDOM_DEVICE_ERROR -342
3515 #define GNUTLS_E_AUTH_ERROR -343
3516 #define GNUTLS_E_NO_APPLICATION_PROTOCOL -344
3517 #define GNUTLS_E_SOCKETS_INIT_ERROR -345
3518 #define GNUTLS_E_KEY_IMPORT_FAILED -346
3519 #define GNUTLS_E_INAPPROPRIATE_FALLBACK \
3520     -347 /*GNUTLS_A_INAPPROPRIATE_FALLBACK */
3521 #define GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR -348
3522 #define GNUTLS_E_PRIVKEY_VERIFICATION_ERROR -349
3523 #define GNUTLS_E_UNEXPECTED_EXTENSIONS_LENGTH -350 /*GNUTLS_A_DECODE_ERROR */
3524 #define GNUTLS_E_ASN1_EMBEDDED_NULL_IN_STRING -351
3525
3526 #define GNUTLS_E_SELF_TEST_ERROR -400
3527 #define GNUTLS_E_NO_SELF_TEST -401
3528 #define GNUTLS_E_LIB_IN_ERROR_STATE -402
3529 #define GNUTLS_E_PK_GENERATION_ERROR -403
3530 #define GNUTLS_E_IDNA_ERROR -404
3531
3532 #define GNUTLS_E_NEED_FALLBACK -405
3533 #define GNUTLS_E_SESSION_USER_ID_CHANGED -406
3534 #define GNUTLS_E_HANDSHAKE_DURING_FALSE_START -407
3535 #define GNUTLS_E_UNAVAILABLE_DURING_HANDSHAKE -408
3536 #define GNUTLS_E_PK_INVALID_PUBKEY -409
3537 #define GNUTLS_E_PK_INVALID_PRIVKEY -410
3538 #define GNUTLS_E_NOT_YET_ACTIVATED -411
3539 #define GNUTLS_E_INVALID_UTF8_STRING -412
3540 #define GNUTLS_E_NO_EMBEDDED_DATA -413
3541 #define GNUTLS_E_INVALID_UTF8_EMAIL -414
3542 #define GNUTLS_E_INVALID_PASSWORD_STRING -415
3543 #define GNUTLS_E_CERTIFICATE_TIME_ERROR -416
3544 #define GNUTLS_E_RECORD_OVERFLOW -417 /* GNUTLS_A_RECORD_OVERFLOW */
3545 #define GNUTLS_E_ASN1_TIME_ERROR -418
3546 #define GNUTLS_E_INCOMPATIBLE_SIG_WITH_KEY -419
3547 #define GNUTLS_E_PK_INVALID_PUBKEY_PARAMS -420
3548 #define GNUTLS_E_PK_NO_VALIDATION_PARAMS -421
3549 #define GNUTLS_E_OCSP_MISMATCH_WITH_CERTS -422
3550
3551 #define GNUTLS_E_NO_COMMON_KEY_SHARE -423
3552 #define GNUTLS_E_REAUTH_REQUEST -424
3553 #define GNUTLS_E_TOO_MANY_MATCHES -425
3554 #define GNUTLS_E_CRL_VERIFICATION_ERROR -426
3555 #define GNUTLS_E_MISSING_EXTENSION -427
3556 #define GNUTLS_E_DB_ENTRY_EXISTS -428
3557 #define GNUTLS_E_EARLY_DATA_REJECTED -429
3558 #define GNUTLS_E_X509_DUPLICATE_EXTENSION -430
3559
3560 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -1250
3561
3562 /* Internal errors of the library; will never be returned
3563  * to a calling application */
3564 #define GNUTLS_E_INT_RET_0 -1251
3565 #define GNUTLS_E_INT_CHECK_AGAIN -1252
3566
3567 #define GNUTLS_E_APPLICATION_ERROR_MAX -65000
3568 #define GNUTLS_E_APPLICATION_ERROR_MIN -65500
3569
3570 #ifdef __cplusplus
3571 }
3572 #endif
3573
3574 #include <gnutls/compat.h>
3575
3576 #endif /* GNUTLS_GNUTLS_H */