tlsserver.h

Go to the documentation of this file.

#ifndef QSC_TLS_SERVER_H
#define QSC_TLS_SERVER_H
 
#include "qsccommon.h"
#include "tlserrors.h"
#include "tlstypes.h"
#include "tlsstate.h"
#include "tlslimits.h"
#include "tlscert.h"
#include "tlsgroups.h"
#include "tlskeyschedule.h"
#include "tlstranscript.h"
 
QSC_CPLUSPLUS_ENABLED_START


typedef enum qsc_tls_server_state_phase
{
    qsc_tls_server_phase_initial = 0,                  
    qsc_tls_server_phase_waiting_client_hello = 1,     
    qsc_tls_server_phase_waiting_client_hello_2 = 2,   
    qsc_tls_server_phase_sending_flight1 = 3,          
    qsc_tls_server_phase_waiting_client_certificate = 4, 
    qsc_tls_server_phase_waiting_client_certificate_verify = 5,
    qsc_tls_server_phase_waiting_client_finished = 6,
    qsc_tls_server_phase_established = 7,
    qsc_tls_server_phase_closed = 8,
    qsc_tls_server_phase_failed = 9,
    qsc_tls_server_phase_waiting_end_of_early_data = 10 
} qsc_tls_server_state_phase;

typedef bool (*qsc_tls_psk_lookup_callback)(const uint8_t* identity, size_t identitylen, uint8_t* psk_out, size_t pskcap, size_t* psk_len_out, qsc_tls_cipher_suite* suite_out, uint32_t* max_early_data_out, void* state);

typedef struct qsc_tls_server_certificate_identity
{
    char hostname[QSC_TLS_MAX_HOSTNAME_SIZE + 1U];       
    qsc_tls_local_certificate_config localcert;          
    bool configured;                                     
} qsc_tls_server_certificate_identity;

typedef struct qsc_tls_server_config
{
    const qsc_tls_cipher_suite* ciphersuitepreference;
    size_t ciphersuitepreferencecount;
    const qsc_tls_named_group* groupspreference;
    size_t groupspreferencecount;
    const qsc_tls_signature_scheme* sigschemepreference;
    size_t sigschemepreferencecount;
    qsc_tls_local_certificate_config localcert;
    qsc_tls_server_certificate_identity identities[QSC_TLS_MAX_SERVER_IDENTITIES]; 
    size_t identitycount;                                
    bool requiresni;                                     
    qsc_tls_certificate_interface clientcertinterface;  
    qsc_tls_client_authorization_callback clientauthcallback; 
    void* clientauthstate;                              
    bool requireclientauthorization;                    
    qsc_tls_alpn_protocols alpn;                        
    bool requestclientauth;                             
    bool requireclientauth;                             
    qsc_tls_psk_lookup_callback psklookup;              
    void* psklookupstate;                               
    bool acceptearlydata;                               
} qsc_tls_server_config;

typedef struct qsc_tls_server_state
{
    qsc_tls_server_config config;
    qsc_tls_server_state_phase phase;
    qsc_tls_cipher_suite negotiatedsuite;
    qsc_tls_hash_algorithm negotiatedhash;
    qsc_tls_named_group negotiatedgroup;
    qsc_tls_signature_scheme negotiatedsigscheme;
    uint8_t clientrandom[32U];
    uint8_t serverrandom[32U];
    uint8_t serverkeyshare[QSC_TLS_MAX_HYBRID_SERVER_KEYSHARE_SIZE];
    size_t serverkeysharelen;
    uint8_t sharedsecret[QSC_TLS_MAX_SHARED_SECRET_SIZE];
    size_t sharedsecretlen;
    qsc_tls_transcript_state transcript;
    qsc_tls_key_schedule_state keyschedule;
    qsc_tls_record_state readrecord;
    qsc_tls_record_state writerecord;
    qsc_tls_peer_capabilities clientcapabilities;
    qsc_tls_alert_description lastalert;
    char servername[QSC_TLS_MAX_HOSTNAME_SIZE + 1U];       
    size_t servernamelen;                                  
    bool servernamereceived;                               
    bool servernameaccepted;                               
    uint8_t clientalpn[QSC_TLS_MAX_ALPN_PROTOCOLS][QSC_TLS_MAX_ALPN_SIZE];
    size_t clientalpnlens[QSC_TLS_MAX_ALPN_PROTOCOLS];
    size_t clientalpncount;
    uint8_t selectedalpn[QSC_TLS_MAX_ALPN_SIZE];
    size_t selectedalpnlen;
    bool alpnselected;
    bool helloretryrequestsent;
    qsc_tls_named_group hrrgroup;                       
    bool clientauthenticated;
    bool changecipherspecreceived;
    bool pskaccepted;                                   
    uint16_t selectedpskidentity;                       
    bool earlydataaccepted;                             
    bool earlydatadone;                                 
    uint8_t stashedserverfinhash[QSC_TLS_HASH_MAX_SIZE]; 
    size_t stashedserverfinhashlen;
    /* TODO: FIELDS ADDED */
    uint8_t legacy_session_id[32U];
    size_t legacy_session_id_len;
} qsc_tls_server_state;
 

QSC_EXPORT_API qsc_tls_status qsc_tls_server_config_set_certificate_interface(qsc_tls_server_config* config,
    const qsc_tls_certificate_interface* iface, bool requestclientauth, bool requireclientauth);

QSC_EXPORT_API qsc_tls_status qsc_tls_server_config_set_client_authorization(qsc_tls_server_config* config,
    qsc_tls_client_authorization_callback callback, void* state, bool required);

QSC_EXPORT_API qsc_tls_status qsc_tls_server_authorize_client_certificate(qsc_tls_server_state* state,
    const qsc_tls_certificate_view* chain, size_t chainlength);

QSC_EXPORT_API qsc_tls_status qsc_tls_server_config_set_local_certificate(qsc_tls_server_config* config,
    const qsc_tls_certificate_view* chain, size_t chainlength, qsc_tls_signature_scheme verifyscheme,
    const uint8_t* privatekeydata, size_t privatekeylen);

QSC_EXPORT_API qsc_tls_status qsc_tls_server_config_add_certificate_identity(qsc_tls_server_config* config,
    const char* hostname, const qsc_tls_local_certificate_config* localcert);

QSC_EXPORT_API qsc_tls_status qsc_tls_server_config_set_sni_required(qsc_tls_server_config* config, bool required);
 
QSC_EXPORT_API qsc_tls_status qsc_tls_server_initialize(qsc_tls_server_state* state, const qsc_tls_server_config* config);
QSC_EXPORT_API void qsc_tls_server_dispose(qsc_tls_server_state* state);

QSC_EXPORT_API qsc_tls_status qsc_tls_server_process_record(qsc_tls_server_state* state, const uint8_t* input, size_t inlen, size_t* consumed,
    uint8_t* output, size_t outlen, size_t* written);
 
QSC_EXPORT_API bool qsc_tls_server_is_handshake_complete(const qsc_tls_server_state* state);
QSC_EXPORT_API qsc_tls_cipher_suite qsc_tls_server_get_negotiated_cipher_suite(const qsc_tls_server_state* state);
 
QSC_CPLUSPLUS_ENABLED_END
 
#endif