2 Defines TLS Library APIs.
4 Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
5 SPDX-License-Identifier: BSD-2-Clause-Patent
13 Initializes the OpenSSL library.
15 This function registers ciphers and digests used directly and indirectly
16 by SSL/TLS, and initializes the readable error messages.
17 This function must be called before any other action takes places.
19 @retval TRUE The OpenSSL library has been initialized.
20 @retval FALSE Failed to initialize the OpenSSL library.
30 Free an allocated SSL_CTX object.
32 @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
42 Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
45 @param[in] MajorVer Major Version of TLS/SSL Protocol.
46 @param[in] MinorVer Minor Version of TLS/SSL Protocol.
48 @return Pointer to an allocated SSL_CTX object.
49 If the creation failed, TlsCtxNew() returns NULL.
60 Free an allocated TLS object.
62 This function removes the TLS object pointed to by Tls and frees up the
63 allocated memory. If Tls is NULL, nothing is done.
65 @param[in] Tls Pointer to the TLS object to be freed.
75 Create a new TLS object for a connection.
77 This function creates a new TLS object for a connection. The new object
78 inherits the setting of the underlying context TlsCtx: connection method,
79 options, verification setting.
81 @param[in] TlsCtx Pointer to the SSL_CTX object.
83 @return Pointer to an allocated SSL object.
84 If the creation failed, TlsNew() returns NULL.
94 Checks if the TLS handshake was done.
96 This function will check if the specified TLS handshake was done.
98 @param[in] Tls Pointer to the TLS object for handshake state checking.
100 @retval TRUE The TLS handshake was done.
101 @retval FALSE The TLS handshake was not done.
111 Perform a TLS/SSL handshake.
113 This function will perform a TLS/SSL handshake.
115 @param[in] Tls Pointer to the TLS object for handshake operation.
116 @param[in] BufferIn Pointer to the most recently received TLS Handshake packet.
117 @param[in] BufferInSize Packet size in bytes for the most recently received TLS
119 @param[out] BufferOut Pointer to the buffer to hold the built packet.
120 @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
121 the buffer size provided by the caller. On output, it
122 is the buffer size in fact needed to contain the
125 @retval EFI_SUCCESS The required TLS packet is built successfully.
126 @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
128 BufferIn is NULL but BufferInSize is NOT 0.
129 BufferInSize is 0 but BufferIn is NOT NULL.
130 BufferOutSize is NULL.
131 BufferOut is NULL if *BufferOutSize is not zero.
132 @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
133 @retval EFI_ABORTED Something wrong during handshake.
140 IN UINT8
*BufferIn OPTIONAL
,
141 IN UINTN BufferInSize OPTIONAL
,
142 OUT UINT8
*BufferOut OPTIONAL
,
143 IN OUT UINTN
*BufferOutSize
147 Handle Alert message recorded in BufferIn. If BufferIn is NULL and BufferInSize is zero,
148 TLS session has errors and the response packet needs to be Alert message based on error type.
150 @param[in] Tls Pointer to the TLS object for state checking.
151 @param[in] BufferIn Pointer to the most recently received TLS Alert packet.
152 @param[in] BufferInSize Packet size in bytes for the most recently received TLS
154 @param[out] BufferOut Pointer to the buffer to hold the built packet.
155 @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
156 the buffer size provided by the caller. On output, it
157 is the buffer size in fact needed to contain the
160 @retval EFI_SUCCESS The required TLS packet is built successfully.
161 @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
163 BufferIn is NULL but BufferInSize is NOT 0.
164 BufferInSize is 0 but BufferIn is NOT NULL.
165 BufferOutSize is NULL.
166 BufferOut is NULL if *BufferOutSize is not zero.
167 @retval EFI_ABORTED An error occurred.
168 @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
175 IN UINT8
*BufferIn OPTIONAL
,
176 IN UINTN BufferInSize OPTIONAL
,
177 OUT UINT8
*BufferOut OPTIONAL
,
178 IN OUT UINTN
*BufferOutSize
182 Build the CloseNotify packet.
184 @param[in] Tls Pointer to the TLS object for state checking.
185 @param[in, out] Buffer Pointer to the buffer to hold the built packet.
186 @param[in, out] BufferSize Pointer to the buffer size in bytes. On input, it is
187 the buffer size provided by the caller. On output, it
188 is the buffer size in fact needed to contain the
191 @retval EFI_SUCCESS The required TLS packet is built successfully.
192 @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
195 Buffer is NULL if *BufferSize is not zero.
196 @retval EFI_BUFFER_TOO_SMALL BufferSize is too small to hold the response packet.
203 IN OUT UINT8
*Buffer
,
204 IN OUT UINTN
*BufferSize
208 Attempts to read bytes from one TLS object and places the data in Buffer.
210 This function will attempt to read BufferSize bytes from the TLS object
211 and places the data in Buffer.
213 @param[in] Tls Pointer to the TLS object.
214 @param[in,out] Buffer Pointer to the buffer to store the data.
215 @param[in] BufferSize The size of Buffer in bytes.
217 @retval >0 The amount of data successfully read from the TLS object.
218 @retval <=0 No data was successfully read.
230 Attempts to write data from the buffer to TLS object.
232 This function will attempt to write BufferSize bytes data from the Buffer
235 @param[in] Tls Pointer to the TLS object.
236 @param[in] Buffer Pointer to the data buffer.
237 @param[in] BufferSize The size of Buffer in bytes.
239 @retval >0 The amount of data successfully written to the TLS object.
240 @retval <=0 No data was successfully written.
252 Attempts to read bytes from the specified TLS connection into the buffer.
254 This function tries to read BufferSize bytes data from the specified TLS
255 connection into the Buffer.
257 @param[in] Tls Pointer to the TLS connection for data reading.
258 @param[in,out] Buffer Pointer to the data buffer.
259 @param[in] BufferSize The size of Buffer in bytes.
261 @retval >0 The read operation was successful, and return value is the
262 number of bytes actually read from the TLS connection.
263 @retval <=0 The read operation was not successful.
275 Attempts to write data to a TLS connection.
277 This function tries to write BufferSize bytes data from the Buffer into the
278 specified TLS connection.
280 @param[in] Tls Pointer to the TLS connection for data writing.
281 @param[in] Buffer Pointer to the data buffer.
282 @param[in] BufferSize The size of Buffer in bytes.
284 @retval >0 The write operation was successful, and return value is the
285 number of bytes actually written to the TLS connection.
286 @retval <=0 The write operation was not successful.
298 Shutdown a TLS connection.
300 Shutdown the TLS connection without releasing the resources, meaning a new
301 connection can be started without calling TlsNew() and without setting
304 @param[in] Tls Pointer to the TLS object to shutdown.
306 @retval EFI_SUCCESS The TLS is shutdown successfully.
307 @retval EFI_INVALID_PARAMETER Tls is NULL.
308 @retval EFI_PROTOCOL_ERROR Some other error occurred.
317 Set a new TLS/SSL method for a particular TLS object.
319 This function sets a new TLS/SSL method for a particular TLS object.
321 @param[in] Tls Pointer to a TLS object.
322 @param[in] MajorVer Major Version of TLS/SSL Protocol.
323 @param[in] MinorVer Minor Version of TLS/SSL Protocol.
325 @retval EFI_SUCCESS The TLS/SSL method was set successfully.
326 @retval EFI_INVALID_PARAMETER The parameter is invalid.
327 @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
339 Set TLS object to work in client or server mode.
341 This function prepares a TLS object to work in client or server mode.
343 @param[in] Tls Pointer to a TLS object.
344 @param[in] IsServer Work in server mode.
346 @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
347 @retval EFI_INVALID_PARAMETER The parameter is invalid.
348 @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
353 TlsSetConnectionEnd (
359 Set the ciphers list to be used by the TLS object.
361 This function sets the ciphers for use by a specified TLS object.
363 @param[in] Tls Pointer to a TLS object.
364 @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
365 cipher identifier comes from the TLS Cipher Suite
366 Registry of the IANA, interpreting Byte1 and Byte2
367 in network (big endian) byte order.
368 @param[in] CipherNum The number of cipher in the list.
370 @retval EFI_SUCCESS The ciphers list was set successfully.
371 @retval EFI_INVALID_PARAMETER The parameter is invalid.
372 @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
373 @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
385 Set the compression method for TLS/SSL operations.
387 This function handles TLS/SSL integrated compression methods.
389 @param[in] CompMethod The compression method ID.
391 @retval EFI_SUCCESS The compression method for the communication was
393 @retval EFI_UNSUPPORTED Unsupported compression method.
398 TlsSetCompressionMethod (
403 Set peer certificate verification mode for the TLS connection.
405 This function sets the verification mode flags for the TLS connection.
407 @param[in] Tls Pointer to the TLS object.
408 @param[in] VerifyMode A set of logically or'ed verification mode flags.
419 Set the specified host name to be verified.
421 @param[in] Tls Pointer to the TLS object.
422 @param[in] Flags The setting flags during the validation.
423 @param[in] HostName The specified host name to be verified.
425 @retval EFI_SUCCESS The HostName setting was set successfully.
426 @retval EFI_INVALID_PARAMETER The parameter is invalid.
427 @retval EFI_ABORTED Invalid HostName setting.
439 Sets a TLS/SSL session ID to be used during TLS/SSL connect.
441 This function sets a session ID to be used when the TLS/SSL connection is
444 @param[in] Tls Pointer to the TLS object.
445 @param[in] SessionId Session ID data used for session resumption.
446 @param[in] SessionIdLen Length of Session ID in bytes.
448 @retval EFI_SUCCESS Session ID was set successfully.
449 @retval EFI_INVALID_PARAMETER The parameter is invalid.
450 @retval EFI_UNSUPPORTED No available session for ID setting.
458 IN UINT16 SessionIdLen
462 Adds the CA to the cert store when requesting Server or Client authentication.
464 This function adds the CA certificate to the list of CAs when requesting
465 Server or Client authentication for the chosen TLS connection.
467 @param[in] Tls Pointer to the TLS object.
468 @param[in] Data Pointer to the data buffer of a DER-encoded binary
469 X.509 certificate or PEM-encoded X.509 certificate.
470 @param[in] DataSize The size of data buffer in bytes.
472 @retval EFI_SUCCESS The operation succeeded.
473 @retval EFI_INVALID_PARAMETER The parameter is invalid.
474 @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
475 @retval EFI_ABORTED Invalid X.509 certificate.
480 TlsSetCaCertificate (
487 Loads the local public certificate into the specified TLS object.
489 This function loads the X.509 certificate into the specified TLS object
492 @param[in] Tls Pointer to the TLS object.
493 @param[in] Data Pointer to the data buffer of a DER-encoded binary
494 X.509 certificate or PEM-encoded X.509 certificate.
495 @param[in] DataSize The size of data buffer in bytes.
497 @retval EFI_SUCCESS The operation succeeded.
498 @retval EFI_INVALID_PARAMETER The parameter is invalid.
499 @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
500 @retval EFI_ABORTED Invalid X.509 certificate.
505 TlsSetHostPublicCert (
512 Adds the local private key to the specified TLS object.
514 This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
515 key) into the specified TLS object for TLS negotiation.
517 @param[in] Tls Pointer to the TLS object.
518 @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
519 or PKCS#8 private key.
520 @param[in] DataSize The size of data buffer in bytes.
521 @param[in] Password Pointer to NULL-terminated private key password, set it to NULL
522 if private key not encrypted.
524 @retval EFI_SUCCESS The operation succeeded.
525 @retval EFI_UNSUPPORTED This function is not supported.
526 @retval EFI_ABORTED Invalid private key data.
531 TlsSetHostPrivateKeyEx (
535 IN VOID
*Password OPTIONAL
539 Adds the local private key to the specified TLS object.
541 This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
542 key) into the specified TLS object for TLS negotiation.
544 @param[in] Tls Pointer to the TLS object.
545 @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
546 or PKCS#8 private key.
547 @param[in] DataSize The size of data buffer in bytes.
549 @retval EFI_SUCCESS The operation succeeded.
550 @retval EFI_UNSUPPORTED This function is not supported.
551 @retval EFI_ABORTED Invalid private key data.
556 TlsSetHostPrivateKey (
563 Adds the CA-supplied certificate revocation list for certificate validation.
565 This function adds the CA-supplied certificate revocation list data for
566 certificate validity checking.
568 @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
569 @param[in] DataSize The size of data buffer in bytes.
571 @retval EFI_SUCCESS The operation succeeded.
572 @retval EFI_UNSUPPORTED This function is not supported.
573 @retval EFI_ABORTED Invalid CRL data.
578 TlsSetCertRevocationList (
584 Set the signature algorithm list to used by the TLS object.
586 This function sets the signature algorithms for use by a specified TLS object.
588 @param[in] Tls Pointer to a TLS object.
589 @param[in] Data Array of UINT8 of signature algorithms. The array consists of
590 pairs of the hash algorithm and the signature algorithm as defined
592 @param[in] DataSize The length the SignatureAlgoList. Must be divisible by 2.
594 @retval EFI_SUCCESS The signature algorithm list was set successfully.
595 @retval EFI_INVALID_PARAMETER The parameters are invalid.
596 @retval EFI_UNSUPPORTED No supported TLS signature algorithm was found in SignatureAlgoList
597 @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
602 TlsSetSignatureAlgoList (
609 Set the EC curve to be used for TLS flows
611 This function sets the EC curve to be used for TLS flows.
613 @param[in] Tls Pointer to a TLS object.
614 @param[in] Data An EC named curve as defined in section 5.1.1 of RFC 4492.
615 @param[in] DataSize Size of Data, it should be sizeof (UINT32)
617 @retval EFI_SUCCESS The EC curve was set successfully.
618 @retval EFI_INVALID_PARAMETER The parameters are invalid.
619 @retval EFI_UNSUPPORTED The requested TLS EC curve is not supported
631 Gets the protocol version used by the specified TLS connection.
633 This function returns the protocol version used by the specified TLS
636 If Tls is NULL, then ASSERT().
638 @param[in] Tls Pointer to the TLS object.
640 @return The protocol version of the specified TLS connection.
650 Gets the connection end of the specified TLS connection.
652 This function returns the connection end (as client or as server) used by
653 the specified TLS connection.
655 If Tls is NULL, then ASSERT().
657 @param[in] Tls Pointer to the TLS object.
659 @return The connection end used by the specified TLS connection.
664 TlsGetConnectionEnd (
669 Gets the cipher suite used by the specified TLS connection.
671 This function returns current cipher suite used by the specified
674 @param[in] Tls Pointer to the TLS object.
675 @param[in,out] CipherId The cipher suite used by the TLS object.
677 @retval EFI_SUCCESS The cipher suite was returned successfully.
678 @retval EFI_INVALID_PARAMETER The parameter is invalid.
679 @retval EFI_UNSUPPORTED Unsupported cipher suite.
684 TlsGetCurrentCipher (
686 IN OUT UINT16
*CipherId
690 Gets the compression methods used by the specified TLS connection.
692 This function returns current integrated compression methods used by
693 the specified TLS connection.
695 @param[in] Tls Pointer to the TLS object.
696 @param[in,out] CompressionId The current compression method used by
699 @retval EFI_SUCCESS The compression method was returned successfully.
700 @retval EFI_INVALID_PARAMETER The parameter is invalid.
701 @retval EFI_ABORTED Invalid Compression method.
702 @retval EFI_UNSUPPORTED This function is not supported.
707 TlsGetCurrentCompressionId (
709 IN OUT UINT8
*CompressionId
713 Gets the verification mode currently set in the TLS connection.
715 This function returns the peer verification mode currently set in the
716 specified TLS connection.
718 If Tls is NULL, then ASSERT().
720 @param[in] Tls Pointer to the TLS object.
722 @return The verification mode set in the specified TLS connection.
732 Gets the session ID used by the specified TLS connection.
734 This function returns the TLS/SSL session ID currently used by the
735 specified TLS connection.
737 @param[in] Tls Pointer to the TLS object.
738 @param[in,out] SessionId Buffer to contain the returned session ID.
739 @param[in,out] SessionIdLen The length of Session ID in bytes.
741 @retval EFI_SUCCESS The Session ID was returned successfully.
742 @retval EFI_INVALID_PARAMETER The parameter is invalid.
743 @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
750 IN OUT UINT8
*SessionId
,
751 IN OUT UINT16
*SessionIdLen
755 Gets the client random data used in the specified TLS connection.
757 This function returns the TLS/SSL client random data currently used in
758 the specified TLS connection.
760 @param[in] Tls Pointer to the TLS object.
761 @param[in,out] ClientRandom Buffer to contain the returned client
762 random data (32 bytes).
769 IN OUT UINT8
*ClientRandom
773 Gets the server random data used in the specified TLS connection.
775 This function returns the TLS/SSL server random data currently used in
776 the specified TLS connection.
778 @param[in] Tls Pointer to the TLS object.
779 @param[in,out] ServerRandom Buffer to contain the returned server
780 random data (32 bytes).
787 IN OUT UINT8
*ServerRandom
791 Gets the master key data used in the specified TLS connection.
793 This function returns the TLS/SSL master key material currently used in
794 the specified TLS connection.
796 @param[in] Tls Pointer to the TLS object.
797 @param[in,out] KeyMaterial Buffer to contain the returned key material.
799 @retval EFI_SUCCESS Key material was returned successfully.
800 @retval EFI_INVALID_PARAMETER The parameter is invalid.
801 @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
808 IN OUT UINT8
*KeyMaterial
812 Gets the CA Certificate from the cert store.
814 This function returns the CA certificate for the chosen
817 @param[in] Tls Pointer to the TLS object.
818 @param[out] Data Pointer to the data buffer to receive the CA
819 certificate data sent to the client.
820 @param[in,out] DataSize The size of data buffer in bytes.
822 @retval EFI_SUCCESS The operation succeeded.
823 @retval EFI_UNSUPPORTED This function is not supported.
824 @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
829 TlsGetCaCertificate (
832 IN OUT UINTN
*DataSize
836 Gets the local public Certificate set in the specified TLS object.
838 This function returns the local public certificate which was currently set
839 in the specified TLS object.
841 @param[in] Tls Pointer to the TLS object.
842 @param[out] Data Pointer to the data buffer to receive the local
844 @param[in,out] DataSize The size of data buffer in bytes.
846 @retval EFI_SUCCESS The operation succeeded.
847 @retval EFI_INVALID_PARAMETER The parameter is invalid.
848 @retval EFI_NOT_FOUND The certificate is not found.
849 @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
854 TlsGetHostPublicCert (
857 IN OUT UINTN
*DataSize
861 Gets the local private key set in the specified TLS object.
863 This function returns the local private key data which was currently set
864 in the specified TLS object.
866 @param[in] Tls Pointer to the TLS object.
867 @param[out] Data Pointer to the data buffer to receive the local
869 @param[in,out] DataSize The size of data buffer in bytes.
871 @retval EFI_SUCCESS The operation succeeded.
872 @retval EFI_UNSUPPORTED This function is not supported.
873 @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
878 TlsGetHostPrivateKey (
881 IN OUT UINTN
*DataSize
885 Gets the CA-supplied certificate revocation list data set in the specified
888 This function returns the CA-supplied certificate revocation list data which
889 was currently set in the specified TLS object.
891 @param[out] Data Pointer to the data buffer to receive the CRL data.
892 @param[in,out] DataSize The size of data buffer in bytes.
894 @retval EFI_SUCCESS The operation succeeded.
895 @retval EFI_UNSUPPORTED This function is not supported.
896 @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
901 TlsGetCertRevocationList (
903 IN OUT UINTN
*DataSize
907 Derive keying material from a TLS connection.
909 This function exports keying material using the mechanism described in RFC
912 @param[in] Tls Pointer to the TLS object
913 @param[in] Label Description of the key for the PRF function
914 @param[in] Context Optional context
915 @param[in] ContextLen The length of the context value in bytes
916 @param[out] KeyBuffer Buffer to hold the output of the TLS-PRF
917 @param[in] KeyBufferLen The length of the KeyBuffer
919 @retval EFI_SUCCESS The operation succeeded.
920 @retval EFI_INVALID_PARAMETER The TLS object is invalid.
921 @retval EFI_PROTOCOL_ERROR Some other error occurred.
928 IN CONST VOID
*Label
,
929 IN CONST VOID
*Context
,
932 IN UINTN KeyBufferLen
935 #endif // __TLS_LIB_H__