src/libpttls/pt_tls.h

   1 /*
   2  * Copyright (C) 2012 Martin Willi
   3  *
   4  * Copyright (C) secunet Security Networks AG
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 /**
  18  * @defgroup pt_tls libpttls
  19  *
  20  * @addtogroup pt_tls
  21  * @{
  22  */
  23
  24 #ifndef PT_TLS_H_
  25 #define PT_TLS_H_
  26
  27 #include <bio/bio_reader.h>
  28 #include <bio/bio_writer.h>
  29 #include <tls_socket.h>
  30
  31 /**
  32  * PT-TLS version we support
  33  */
  34 #define PT_TLS_VERSION 1
  35
  36 /**
  37  * Length of a PT-TLS header
  38  */
  39 #define PT_TLS_HEADER_LEN 16
  40
  41 /**
  42  * Maximum size of a PT-TLS message
  43  */
  44 #define PT_TLS_MAX_MESSAGE_LEN  128 * TLS_MAX_FRAGMENT_LEN - PT_TLS_HEADER_LEN
  45
  46 /**
  47  * Default PT-TLS port
  48  */
  49 #define PT_TLS_PORT      271
  50
  51 typedef enum pt_tls_message_type_t pt_tls_message_type_t;
  52 typedef enum pt_tls_sasl_result_t pt_tls_sasl_result_t;
  53 typedef enum pt_tls_auth_t pt_tls_auth_t;
  54
  55 /**
  56  * Message types, as defined by NEA PT-TLS
  57  */
  58 enum pt_tls_message_type_t {
  59         PT_TLS_EXPERIMENTAL = 0,
  60         PT_TLS_VERSION_REQUEST = 1,
  61         PT_TLS_VERSION_RESPONSE = 2,
  62         PT_TLS_SASL_MECHS = 3,
  63         PT_TLS_SASL_MECH_SELECTION = 4,
  64         PT_TLS_SASL_AUTH_DATA = 5,
  65         PT_TLS_SASL_RESULT = 6,
  66         PT_TLS_PB_TNC_BATCH = 7,
  67         PT_TLS_ERROR = 8,
  68 };
  69
  70 extern enum_name_t *pt_tls_message_type_names;
  71
  72 /**
  73  * Result code for a single SASL mechanism, as sent in PT_TLS_SASL_RESULT
  74  */
  75 enum pt_tls_sasl_result_t {
  76         PT_TLS_SASL_RESULT_SUCCESS = 0,
  77         PT_TLS_SASL_RESULT_FAILURE = 1,
  78         PT_TLS_SASL_RESULT_ABORT = 2,
  79         PT_TLS_SASL_RESULT_MECH_FAILURE = 3,
  80 };
  81
  82 extern enum_name_t *pt_tls_sasl_result_names;
  83
  84 /**
  85  * Client authentication to require as PT-TLS server.
  86  */
  87 enum pt_tls_auth_t {
  88         /** don't require TLS client certificate or request SASL authentication */
  89         PT_TLS_AUTH_NONE,
  90         /** require TLS certificate authentication, no SASL */
  91         PT_TLS_AUTH_TLS,
  92         /** do SASL regardless of TLS certificate authentication */
  93         PT_TLS_AUTH_SASL,
  94         /* if client does not authenticate with a TLS certificate, request SASL */
  95         PT_TLS_AUTH_TLS_OR_SASL,
  96         /* require both, TLS certificate authentication and SASL */
  97         PT_TLS_AUTH_TLS_AND_SASL,
  98 };
  99
 100 /**
 101  * Read a PT-TLS message, create reader over Message Value.
 102  *
 103  * @param tls                   TLS socket to read from
 104  * @param vendor                receives Message Type Vendor ID from header
 105  * @param type                  receives Message Type from header
 106  * @param identifier    receives Message Identifier
 107  * @return                              reader over message value, NULL on error
 108  */
 109 bio_reader_t* pt_tls_read(tls_socket_t *tls, uint32_t *vendor,
 110                                                   uint32_t *type, uint32_t *identifier);
 111
 112 /**
 113  * Prepend a PT-TLS header to a writer, send data, destroy writer.
 114  *
 115  * @param tls                   TLS socket to write to
 116  * @param type                  Message Type to write
 117  * @param identifier    Message Identifier to write
 118  * @param data                  Message value to write
 119  * @return                              TRUE if data written successfully
 120  */
 121 bool pt_tls_write(tls_socket_t *tls, pt_tls_message_type_t type,
 122                                   uint32_t identifier, chunk_t data);
 123
 124 /**
 125  * Dummy libpttls initialization function needed for integrity test
 126  */
 127 void libpttls_init(void);
 128
 129 #endif /** PT_TLS_H_ @}*/