ssl.h

Go to the documentation of this file.

#ifndef MBEDTLS_SSL_H
#define MBEDTLS_SSL_H

#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif

#include "bignum.h"
#include "ecp.h"

#include "ssl_ciphersuites.h"

#if defined(MBEDTLS_X509_CRT_PARSE_C)
#include "x509_crt.h"
#include "x509_crl.h"
#endif

#if defined(MBEDTLS_DHM_C)
#include "dhm.h"
#endif

#if defined(MBEDTLS_ECDH_C)
#include "ecdh.h"
#endif

#if defined(MBEDTLS_ZLIB_SUPPORT)
#include "zlib.h"
#endif

#if defined(MBEDTLS_HAVE_TIME)
#include "platform_time.h"
#endif

/*
 * SSL Error codes
 */
#define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE -0x7080 
#define MBEDTLS_ERR_SSL_BAD_INPUT_DATA -0x7100 
#define MBEDTLS_ERR_SSL_INVALID_MAC -0x7180 
#define MBEDTLS_ERR_SSL_INVALID_RECORD -0x7200 
#define MBEDTLS_ERR_SSL_CONN_EOF -0x7280 
#define MBEDTLS_ERR_SSL_UNKNOWN_CIPHER -0x7300 
#define MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 
#define MBEDTLS_ERR_SSL_NO_RNG -0x7400 
#define MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 
#define MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 
#define MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 
#define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 
#define MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 
#define MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 
#define MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 
#define MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED -0x7800 
#define MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 
#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 
#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 
#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 
#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 
#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 
#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 
#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 
#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP -0x7C80 
#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS -0x7D00 
#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 
#define MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 
#define MBEDTLS_ERR_SSL_BAD_HS_FINISHED -0x7E80 
#define MBEDTLS_ERR_SSL_ALLOC_FAILED -0x7F00 
#define MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -0x7F80 
#define MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 
#define MBEDTLS_ERR_SSL_COMPRESSION_FAILED -0x6F00 
#define MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 
#define MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET -0x6E00 
#define MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 
#define MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 
#define MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 
#define MBEDTLS_ERR_SSL_INTERNAL_ERROR -0x6C00 
#define MBEDTLS_ERR_SSL_COUNTER_WRAPPING -0x6B80 
#define MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO -0x6B00 
#define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED -0x6A80 
#define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL -0x6A00 
#define MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE -0x6980 
#define MBEDTLS_ERR_SSL_WANT_READ -0x6900 
#define MBEDTLS_ERR_SSL_WANT_WRITE -0x6880 
#define MBEDTLS_ERR_SSL_TIMEOUT -0x6800 
#define MBEDTLS_ERR_SSL_CLIENT_RECONNECT -0x6780 
#define MBEDTLS_ERR_SSL_UNEXPECTED_RECORD -0x6700 
#define MBEDTLS_ERR_SSL_NON_FATAL -0x6680 
#define MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH -0x6600 
/*
 * Various constants
 */
#define MBEDTLS_SSL_MAJOR_VERSION_3 3
#define MBEDTLS_SSL_MINOR_VERSION_0 0 
#define MBEDTLS_SSL_MINOR_VERSION_1 1 
#define MBEDTLS_SSL_MINOR_VERSION_2 2 
#define MBEDTLS_SSL_MINOR_VERSION_3 3 
#define MBEDTLS_SSL_TRANSPORT_STREAM 0 
#define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 
#define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 
/* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c
 * NONE must be zero so that memset()ing structure to zero works */
#define MBEDTLS_SSL_MAX_FRAG_LEN_NONE 0 
#define MBEDTLS_SSL_MAX_FRAG_LEN_512 1 
#define MBEDTLS_SSL_MAX_FRAG_LEN_1024 2 
#define MBEDTLS_SSL_MAX_FRAG_LEN_2048 3 
#define MBEDTLS_SSL_MAX_FRAG_LEN_4096 4 
#define MBEDTLS_SSL_MAX_FRAG_LEN_INVALID 5 
#define MBEDTLS_SSL_IS_CLIENT 0
#define MBEDTLS_SSL_IS_SERVER 1

#define MBEDTLS_SSL_IS_NOT_FALLBACK 0
#define MBEDTLS_SSL_IS_FALLBACK 1

#define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0
#define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1

#define MBEDTLS_SSL_ETM_DISABLED 0
#define MBEDTLS_SSL_ETM_ENABLED 1

#define MBEDTLS_SSL_COMPRESS_NULL 0
#define MBEDTLS_SSL_COMPRESS_DEFLATE 1

#define MBEDTLS_SSL_VERIFY_NONE 0
#define MBEDTLS_SSL_VERIFY_OPTIONAL 1
#define MBEDTLS_SSL_VERIFY_REQUIRED 2
#define MBEDTLS_SSL_VERIFY_UNSET 3 /* Used only for sni_authmode */

#define MBEDTLS_SSL_LEGACY_RENEGOTIATION 0
#define MBEDTLS_SSL_SECURE_RENEGOTIATION 1

#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0
#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1

#define MBEDTLS_SSL_ANTI_REPLAY_DISABLED 0
#define MBEDTLS_SSL_ANTI_REPLAY_ENABLED 1

#define MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED -1
#define MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT 16

#define MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION 0
#define MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION 1
#define MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE 2

#define MBEDTLS_SSL_TRUNC_HMAC_DISABLED 0
#define MBEDTLS_SSL_TRUNC_HMAC_ENABLED 1
#define MBEDTLS_SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 */

#define MBEDTLS_SSL_SESSION_TICKETS_DISABLED 0
#define MBEDTLS_SSL_SESSION_TICKETS_ENABLED 1

#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED 0
#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED 1

#define MBEDTLS_SSL_ARC4_ENABLED 0
#define MBEDTLS_SSL_ARC4_DISABLED 1

#define MBEDTLS_SSL_PRESET_DEFAULT 0
#define MBEDTLS_SSL_PRESET_SUITEB 2

#define MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED 1
#define MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED 0

/*
 * Default range for DTLS retransmission timer value, in milliseconds.
 * RFC 6347 4.2.4.1 says from 1 second to 60 seconds.
 */
#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN 1000
#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX 60000

#if !defined(MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME)
#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 
#endif

/*
 * Maxium fragment length in bytes,
 * determines the size of each of the two internal I/O buffers.
 *
 * Note: the RFC defines the default size of SSL / TLS messages. If you
 * change the value here, other clients / servers may not be able to
 * communicate with you anymore. Only change this value if you control
 * both sides of the connection and have it reduced at both sides, or
 * if you're using the Max Fragment Length extension and you know all your
 * peers are using it too!
 */
#if !defined(MBEDTLS_SSL_MAX_CONTENT_LEN)
#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 
#endif

/* \} name SECTION: Module settings */

/*
 * Length of the verify data for secure renegotiation
 */
#if defined(MBEDTLS_SSL_PROTO_SSL3)
#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 36
#else
#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12
#endif

/*
 * Signaling ciphersuite values (SCSV)
 */
#define MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO 0xFF 
#define MBEDTLS_SSL_FALLBACK_SCSV_VALUE 0x5600 
/*
 * Supported Signature and Hash algorithms (For TLS 1.2)
 * RFC 5246 section 7.4.1.4.1
 */
#define MBEDTLS_SSL_HASH_NONE 0
#define MBEDTLS_SSL_HASH_MD5 1
#define MBEDTLS_SSL_HASH_SHA1 2
#define MBEDTLS_SSL_HASH_SHA224 3
#define MBEDTLS_SSL_HASH_SHA256 4
#define MBEDTLS_SSL_HASH_SHA384 5
#define MBEDTLS_SSL_HASH_SHA512 6

#define MBEDTLS_SSL_SIG_ANON 0
#define MBEDTLS_SSL_SIG_RSA 1
#define MBEDTLS_SSL_SIG_ECDSA 3

/*
 * Client Certificate Types
 * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5
 */
#define MBEDTLS_SSL_CERT_TYPE_RSA_SIGN 1
#define MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN 64

/*
 * Message, alert and handshake types
 */
#define MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC 20
#define MBEDTLS_SSL_MSG_ALERT 21
#define MBEDTLS_SSL_MSG_HANDSHAKE 22
#define MBEDTLS_SSL_MSG_APPLICATION_DATA 23

#define MBEDTLS_SSL_ALERT_LEVEL_WARNING 1
#define MBEDTLS_SSL_ALERT_LEVEL_FATAL 2

#define MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY 0 /* 0x00 */
#define MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE 10 /* 0x0A */
#define MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC 20 /* 0x14 */
#define MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED 21 /* 0x15 */
#define MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW 22 /* 0x16 */
#define MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30 /* 0x1E */
#define MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE 40 /* 0x28 */
#define MBEDTLS_SSL_ALERT_MSG_NO_CERT 41 /* 0x29 */
#define MBEDTLS_SSL_ALERT_MSG_BAD_CERT 42 /* 0x2A */
#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT 43 /* 0x2B */
#define MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED 44 /* 0x2C */
#define MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED 45 /* 0x2D */
#define MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN 46 /* 0x2E */
#define MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER 47 /* 0x2F */
#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA 48 /* 0x30 */
#define MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED 49 /* 0x31 */
#define MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */
#define MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */
#define MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */
#define MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */
#define MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */
#define MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */
#define MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK 86 /* 0x56 */
#define MBEDTLS_SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */
#define MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */
#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */
#define MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */
#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */
#define MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL 120 /* 0x78 */

#define MBEDTLS_SSL_HS_HELLO_REQUEST 0
#define MBEDTLS_SSL_HS_CLIENT_HELLO 1
#define MBEDTLS_SSL_HS_SERVER_HELLO 2
#define MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST 3
#define MBEDTLS_SSL_HS_NEW_SESSION_TICKET 4
#define MBEDTLS_SSL_HS_CERTIFICATE 11
#define MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE 12
#define MBEDTLS_SSL_HS_CERTIFICATE_REQUEST 13
#define MBEDTLS_SSL_HS_SERVER_HELLO_DONE 14
#define MBEDTLS_SSL_HS_CERTIFICATE_VERIFY 15
#define MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE 16
#define MBEDTLS_SSL_HS_FINISHED 20

/*
 * TLS extensions
 */
#define MBEDTLS_TLS_EXT_SERVERNAME 0
#define MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME 0

#define MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH 1

#define MBEDTLS_TLS_EXT_TRUNCATED_HMAC 4

#define MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10
#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS 11

#define MBEDTLS_TLS_EXT_SIG_ALG 13

#define MBEDTLS_TLS_EXT_ALPN 16

#define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC 22 /* 0x16 */
#define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET 0x0017 /* 23 */

#define MBEDTLS_TLS_EXT_SESSION_TICKET 35

#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */

#define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01

/*
 * Size defines
 */
#if !defined(MBEDTLS_PSK_MAX_LEN)
#define MBEDTLS_PSK_MAX_LEN 32 /* 256 bits */
#endif

/* Dummy type used only for its size */
union mbedtls_ssl_premaster_secret
{
#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
 unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
 unsigned char _pms_dhm[MBEDTLS_MPI_MAX_SIZE]; /* RFC 5246 8.1.2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
 unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
 unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
 unsigned char _pms_dhe_psk[4 + MBEDTLS_MPI_MAX_SIZE
 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 3 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
 unsigned char _pms_rsa_psk[52 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 4 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
 unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES
 + MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
 unsigned char _pms_ecjpake[32]; /* Thread spec: SHA-256 output */
#endif
};

#define MBEDTLS_PREMASTER_SIZE sizeof( union mbedtls_ssl_premaster_secret )

#ifdef __cplusplus
extern "C" {
#endif

/*
 * SSL state machine
 */
typedef enum
{
 MBEDTLS_SSL_HELLO_REQUEST,
 MBEDTLS_SSL_CLIENT_HELLO,
 MBEDTLS_SSL_SERVER_HELLO,
 MBEDTLS_SSL_SERVER_CERTIFICATE,
 MBEDTLS_SSL_SERVER_KEY_EXCHANGE,
 MBEDTLS_SSL_CERTIFICATE_REQUEST,
 MBEDTLS_SSL_SERVER_HELLO_DONE,
 MBEDTLS_SSL_CLIENT_CERTIFICATE,
 MBEDTLS_SSL_CLIENT_KEY_EXCHANGE,
 MBEDTLS_SSL_CERTIFICATE_VERIFY,
 MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC,
 MBEDTLS_SSL_CLIENT_FINISHED,
 MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC,
 MBEDTLS_SSL_SERVER_FINISHED,
 MBEDTLS_SSL_FLUSH_BUFFERS,
 MBEDTLS_SSL_HANDSHAKE_WRAPUP,
 MBEDTLS_SSL_HANDSHAKE_OVER,
 MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET,
 MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT
}
mbedtls_ssl_states;

typedef int mbedtls_ssl_send_t( void *ctx,
 const unsigned char *buf,
 size_t len );

typedef int mbedtls_ssl_recv_t( void *ctx,
 unsigned char *buf,
 size_t len );

typedef int mbedtls_ssl_recv_timeout_t( void *ctx,
 unsigned char *buf,
 size_t len,
 uint32_t timeout );
typedef void mbedtls_ssl_set_timer_t( void * ctx,
 uint32_t int_ms,
 uint32_t fin_ms );

typedef int mbedtls_ssl_get_timer_t( void * ctx );


/* Defined below */
typedef struct mbedtls_ssl_session mbedtls_ssl_session;
typedef struct mbedtls_ssl_context mbedtls_ssl_context;
typedef struct mbedtls_ssl_config mbedtls_ssl_config;

/* Defined in ssl_internal.h */
typedef struct mbedtls_ssl_transform mbedtls_ssl_transform;
typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params;
typedef struct mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t;
#if defined(MBEDTLS_X509_CRT_PARSE_C)
typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert;
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS)
typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item;
#endif

/*
 * This structure is used for storing current session data.
 */
struct mbedtls_ssl_session
{
#if defined(MBEDTLS_HAVE_TIME)
 mbedtls_time_t start; 
#endif
 int ciphersuite; 
 int compression; 
 size_t id_len; 
 unsigned char id[32]; 
 unsigned char master[48]; 
#if defined(MBEDTLS_X509_CRT_PARSE_C)
 mbedtls_x509_crt *peer_cert; 
#endif /* MBEDTLS_X509_CRT_PARSE_C */
 uint32_t verify_result; 
#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
 unsigned char *ticket; 
 size_t ticket_len; 
 uint32_t ticket_lifetime; 
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */

#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
 unsigned char mfl_code; 
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */

#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
 int trunc_hmac; 
#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */

#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
 int encrypt_then_mac; 
#endif
};

struct mbedtls_ssl_config
{
 /* Group items by size (largest first) to minimize padding overhead */

 /*
 * Pointers
 */

 const int *ciphersuite_list[4]; 
 void (*f_dbg)(void *, int, const char *, int, const char *);
 void *p_dbg; 
 int (*f_rng)(void *, unsigned char *, size_t);
 void *p_rng; 
 int (*f_get_cache)(void *, mbedtls_ssl_session *);
 int (*f_set_cache)(void *, const mbedtls_ssl_session *);
 void *p_cache; 
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)

 int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, size_t);
 void *p_sni; 
#endif

#if defined(MBEDTLS_X509_CRT_PARSE_C)

 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
 void *p_vrfy; 
#endif

#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)

 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, size_t);
 void *p_psk; 
#endif

#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)

 int (*f_cookie_write)( void *, unsigned char **, unsigned char *,
 const unsigned char *, size_t );
 int (*f_cookie_check)( void *, const unsigned char *, size_t,
 const unsigned char *, size_t );
 void *p_cookie; 
#endif

#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C)

 int (*f_ticket_write)( void *, const mbedtls_ssl_session *,
 unsigned char *, const unsigned char *, size_t *, uint32_t * );
 int (*f_ticket_parse)( void *, mbedtls_ssl_session *, unsigned char *, size_t);
 void *p_ticket; 
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */

#if defined(MBEDTLS_SSL_EXPORT_KEYS)

 int (*f_export_keys)( void *, const unsigned char *,
 const unsigned char *, size_t, size_t, size_t );
 void *p_export_keys; 
#endif

#if defined(MBEDTLS_X509_CRT_PARSE_C)
 const mbedtls_x509_crt_profile *cert_profile; 
 mbedtls_ssl_key_cert *key_cert; 
 mbedtls_x509_crt *ca_chain; 
 mbedtls_x509_crl *ca_crl; 
#endif /* MBEDTLS_X509_CRT_PARSE_C */

#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
 const int *sig_hashes; 
#endif

#if defined(MBEDTLS_ECP_C)
 const mbedtls_ecp_group_id *curve_list; 
#endif

#if defined(MBEDTLS_DHM_C)
 mbedtls_mpi dhm_P; 
 mbedtls_mpi dhm_G; 
#endif

#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
 unsigned char *psk; 
 size_t psk_len; 
 unsigned char *psk_identity; 
 size_t psk_identity_len;
#endif

#if defined(MBEDTLS_SSL_ALPN)
 const char **alpn_list; 
#endif

 /*
 * Numerical settings (int then char)
 */

 uint32_t read_timeout; 
#if defined(MBEDTLS_SSL_PROTO_DTLS)
 uint32_t hs_timeout_min; 
 uint32_t hs_timeout_max; 
#endif

#if defined(MBEDTLS_SSL_RENEGOTIATION)
 int renego_max_records; 
 unsigned char renego_period[8]; 
#endif

#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
 unsigned int badmac_limit; 
#endif

#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
 unsigned int dhm_min_bitlen; 
#endif

 unsigned char max_major_ver; 
 unsigned char max_minor_ver; 
 unsigned char min_major_ver; 
 unsigned char min_minor_ver; 
 /*
 * Flags (bitfields)
 */

 unsigned int endpoint : 1; 
 unsigned int transport : 1; 
 unsigned int authmode : 2; 
 /* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */
 unsigned int allow_legacy_renegotiation : 2 ; 
#if defined(MBEDTLS_ARC4_C)
 unsigned int arc4_disabled : 1; 
#endif
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
 unsigned int mfl_code : 3; 
#endif
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
 unsigned int encrypt_then_mac : 1 ; 
#endif
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
 unsigned int extended_ms : 1; 
#endif
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
 unsigned int anti_replay : 1; 
#endif
#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
 unsigned int cbc_record_splitting : 1; 
#endif
#if defined(MBEDTLS_SSL_RENEGOTIATION)
 unsigned int disable_renegotiation : 1; 
#endif
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
 unsigned int trunc_hmac : 1; 
#endif
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
 unsigned int session_tickets : 1; 
#endif
#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
 unsigned int fallback : 1; 
#endif
#if defined(MBEDTLS_SSL_SRV_C)
 unsigned int cert_req_ca_list : 1; 
#endif
};


struct mbedtls_ssl_context
{
 const mbedtls_ssl_config *conf; 
 /*
 * Miscellaneous
 */
 int state; 
#if defined(MBEDTLS_SSL_RENEGOTIATION)
 int renego_status; 
 int renego_records_seen; 
#endif

 int major_ver; 
 int minor_ver; 
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
 unsigned badmac_seen; 
#endif

 mbedtls_ssl_send_t *f_send; 
 mbedtls_ssl_recv_t *f_recv; 
 mbedtls_ssl_recv_timeout_t *f_recv_timeout;
 void *p_bio; 
 /*
 * Session layer
 */
 mbedtls_ssl_session *session_in; 
 mbedtls_ssl_session *session_out; 
 mbedtls_ssl_session *session; 
 mbedtls_ssl_session *session_negotiate; 
 mbedtls_ssl_handshake_params *handshake; 
 /*
 * Record layer transformations
 */
 mbedtls_ssl_transform *transform_in; 
 mbedtls_ssl_transform *transform_out; 
 mbedtls_ssl_transform *transform; 
 mbedtls_ssl_transform *transform_negotiate; 
 /*
 * Timers
 */
 void *p_timer; 
 mbedtls_ssl_set_timer_t *f_set_timer; 
 mbedtls_ssl_get_timer_t *f_get_timer; 
 /*
 * Record layer (incoming data)
 */
 unsigned char *in_buf; 
 unsigned char *in_ctr; 
 unsigned char *in_hdr; 
 unsigned char *in_len; 
 unsigned char *in_iv; 
 unsigned char *in_msg; 
 unsigned char *in_offt; 
 int in_msgtype; 
 size_t in_msglen; 
 size_t in_left; 
#if defined(MBEDTLS_SSL_PROTO_DTLS)
 uint16_t in_epoch; 
 size_t next_record_offset; 
#endif
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
 uint64_t in_window_top; 
 uint64_t in_window; 
#endif

 size_t in_hslen; 
 int nb_zero; 
 int keep_current_message; 
 /*
 * Record layer (outgoing data)
 */
 unsigned char *out_buf; 
 unsigned char *out_ctr; 
 unsigned char *out_hdr; 
 unsigned char *out_len; 
 unsigned char *out_iv; 
 unsigned char *out_msg; 
 int out_msgtype; 
 size_t out_msglen; 
 size_t out_left; 
#if defined(MBEDTLS_ZLIB_SUPPORT)
 unsigned char *compress_buf; 
#endif
#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
 signed char split_done; 
#endif

 /*
 * PKI layer
 */
 int client_auth; 
 /*
 * User settings
 */
#if defined(MBEDTLS_X509_CRT_PARSE_C)
 char *hostname; 
#endif

#if defined(MBEDTLS_SSL_ALPN)
 const char *alpn_chosen; 
#endif

 /*
 * Information for DTLS hello verify
 */
#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
 unsigned char *cli_id; 
 size_t cli_id_len; 
#endif

 /*
 * Secure renegotiation
 */
 /* needed to know when to send extension on server */
 int secure_renegotiation; 
#if defined(MBEDTLS_SSL_RENEGOTIATION)
 size_t verify_data_len; 
 char own_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; 
 char peer_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; 
#endif
};

#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)

#define MBEDTLS_SSL_CHANNEL_OUTBOUND 0
#define MBEDTLS_SSL_CHANNEL_INBOUND 1

extern int (*mbedtls_ssl_hw_record_init)(mbedtls_ssl_context *ssl,
 const unsigned char *key_enc, const unsigned char *key_dec,
 size_t keylen,
 const unsigned char *iv_enc, const unsigned char *iv_dec,
 size_t ivlen,
 const unsigned char *mac_enc, const unsigned char *mac_dec,
 size_t maclen);
extern int (*mbedtls_ssl_hw_record_activate)(mbedtls_ssl_context *ssl, int direction);
extern int (*mbedtls_ssl_hw_record_reset)(mbedtls_ssl_context *ssl);
extern int (*mbedtls_ssl_hw_record_write)(mbedtls_ssl_context *ssl);
extern int (*mbedtls_ssl_hw_record_read)(mbedtls_ssl_context *ssl);
extern int (*mbedtls_ssl_hw_record_finish)(mbedtls_ssl_context *ssl);
#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */

const int *mbedtls_ssl_list_ciphersuites( void );

const char *mbedtls_ssl_get_ciphersuite_name( const int ciphersuite_id );

int mbedtls_ssl_get_ciphersuite_id( const char *ciphersuite_name );

void mbedtls_ssl_init( mbedtls_ssl_context *ssl );

int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
 const mbedtls_ssl_config *conf );

int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl );

void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint );

void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport );

void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode );

#if defined(MBEDTLS_X509_CRT_PARSE_C)

void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
 void *p_vrfy );
#endif /* MBEDTLS_X509_CRT_PARSE_C */

void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
 int (*f_rng)(void *, unsigned char *, size_t),
 void *p_rng );

void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
 void (*f_dbg)(void *, int, const char *, int, const char *),
 void *p_dbg );

void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
 void *p_bio,
 mbedtls_ssl_send_t *f_send,
 mbedtls_ssl_recv_t *f_recv,
 mbedtls_ssl_recv_timeout_t *f_recv_timeout );

void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout );

void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
 void *p_timer,
 mbedtls_ssl_set_timer_t *f_set_timer,
 mbedtls_ssl_get_timer_t *f_get_timer );

typedef int mbedtls_ssl_ticket_write_t( void *p_ticket,
 const mbedtls_ssl_session *session,
 unsigned char *start,
 const unsigned char *end,
 size_t *tlen,
 uint32_t *lifetime );

#if defined(MBEDTLS_SSL_EXPORT_KEYS)

typedef int mbedtls_ssl_export_keys_t( void *p_expkey,
 const unsigned char *ms,
 const unsigned char *kb,
 size_t maclen,
 size_t keylen,
 size_t ivlen );
#endif /* MBEDTLS_SSL_EXPORT_KEYS */

typedef int mbedtls_ssl_ticket_parse_t( void *p_ticket,
 mbedtls_ssl_session *session,
 unsigned char *buf,
 size_t len );

#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C)

void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
 mbedtls_ssl_ticket_write_t *f_ticket_write,
 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
 void *p_ticket );
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */

#if defined(MBEDTLS_SSL_EXPORT_KEYS)

void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
 mbedtls_ssl_export_keys_t *f_export_keys,
 void *p_export_keys );
#endif /* MBEDTLS_SSL_EXPORT_KEYS */

typedef int mbedtls_ssl_cookie_write_t( void *ctx,
 unsigned char **p, unsigned char *end,
 const unsigned char *info, size_t ilen );

typedef int mbedtls_ssl_cookie_check_t( void *ctx,
 const unsigned char *cookie, size_t clen,
 const unsigned char *info, size_t ilen );

#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)

void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
 mbedtls_ssl_cookie_write_t *f_cookie_write,
 mbedtls_ssl_cookie_check_t *f_cookie_check,
 void *p_cookie );

int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
 const unsigned char *info,
 size_t ilen );

#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */

#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)

void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode );
#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */

#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)

void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit );
#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */

#if defined(MBEDTLS_SSL_PROTO_DTLS)

void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max );
#endif /* MBEDTLS_SSL_PROTO_DTLS */

#if defined(MBEDTLS_SSL_SRV_C)

void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
 void *p_cache,
 int (*f_get_cache)(void *, mbedtls_ssl_session *),
 int (*f_set_cache)(void *, const mbedtls_ssl_session *) );
#endif /* MBEDTLS_SSL_SRV_C */

#if defined(MBEDTLS_SSL_CLI_C)

int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session );
#endif /* MBEDTLS_SSL_CLI_C */

void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
 const int *ciphersuites );

void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
 const int *ciphersuites,
 int major, int minor );

#if defined(MBEDTLS_X509_CRT_PARSE_C)

void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
 const mbedtls_x509_crt_profile *profile );

void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
 mbedtls_x509_crt *ca_chain,
 mbedtls_x509_crl *ca_crl );

int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
 mbedtls_x509_crt *own_cert,
 mbedtls_pk_context *pk_key );
#endif /* MBEDTLS_X509_CRT_PARSE_C */

#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)

int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
 const unsigned char *psk, size_t psk_len,
 const unsigned char *psk_identity, size_t psk_identity_len );


int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
 const unsigned char *psk, size_t psk_len );

void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
 size_t),
 void *p_psk );
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */

#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)

int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G );

int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx );
#endif /* MBEDTLS_DHM_C && defined(MBEDTLS_SSL_SRV_C) */

#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)

void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
 unsigned int bitlen );
#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */

#if defined(MBEDTLS_ECP_C)

void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
 const mbedtls_ecp_group_id *curves );
#endif /* MBEDTLS_ECP_C */

#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)

void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
 const int *hashes );
#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */

#if defined(MBEDTLS_X509_CRT_PARSE_C)

int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname );
#endif /* MBEDTLS_X509_CRT_PARSE_C */

#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)

int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
 mbedtls_x509_crt *own_cert,
 mbedtls_pk_context *pk_key );

void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
 mbedtls_x509_crt *ca_chain,
 mbedtls_x509_crl *ca_crl );

void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
 int authmode );

void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
 int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *,
 size_t),
 void *p_sni );
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */

#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)

int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
 const unsigned char *pw,
 size_t pw_len );
#endif /*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */

#if defined(MBEDTLS_SSL_ALPN)

int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos );

const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl );
#endif /* MBEDTLS_SSL_ALPN */

void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor );

void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor );

#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)

void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback );
#endif /* MBEDTLS_SSL_FALLBACK_SCSV && MBEDTLS_SSL_CLI_C */

#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)

void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm );
#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */

#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)

void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems );
#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */

#if defined(MBEDTLS_ARC4_C)

void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 );
#endif /* MBEDTLS_ARC4_C */

#if defined(MBEDTLS_SSL_SRV_C)

void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
 char cert_req_ca_list );
#endif /* MBEDTLS_SSL_SRV_C */

#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)

int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code );
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */

#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)

void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate );
#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */

#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)

void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split );
#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */

#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)

void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets );
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */

#if defined(MBEDTLS_SSL_RENEGOTIATION)

void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation );
#endif /* MBEDTLS_SSL_RENEGOTIATION */

void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy );

#if defined(MBEDTLS_SSL_RENEGOTIATION)

void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records );

void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
 const unsigned char period[8] );
#endif /* MBEDTLS_SSL_RENEGOTIATION */

size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl );

uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl );

const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl );

const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl );

int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl );

#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)

size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl );
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */

#if defined(MBEDTLS_X509_CRT_PARSE_C)

const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl );
#endif /* MBEDTLS_X509_CRT_PARSE_C */

#if defined(MBEDTLS_SSL_CLI_C)

int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *session );
#endif /* MBEDTLS_SSL_CLI_C */

int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl );

int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl );

#if defined(MBEDTLS_SSL_RENEGOTIATION)

int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl );
#endif /* MBEDTLS_SSL_RENEGOTIATION */

int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len );

int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len );

int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
 unsigned char level,
 unsigned char message );
int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl );

void mbedtls_ssl_free( mbedtls_ssl_context *ssl );

void mbedtls_ssl_config_init( mbedtls_ssl_config *conf );

int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
 int endpoint, int transport, int preset );

void mbedtls_ssl_config_free( mbedtls_ssl_config *conf );

void mbedtls_ssl_session_init( mbedtls_ssl_session *session );

void mbedtls_ssl_session_free( mbedtls_ssl_session *session );

#ifdef __cplusplus
}
#endif

#endif /* ssl.h */