Tls.h

Go to the documentation of this file.

#ifndef __KINESIS_VIDEO_WEBRTC_CLIENT_CRYPTO_TLS__
#define __KINESIS_VIDEO_WEBRTC_CLIENT_CRYPTO_TLS__
 
#pragma once
 
#ifdef __cplusplus
extern "C" {
#endif
 
typedef enum {
    TLS_SESSION_STATE_NEW,        /* Tls is just created, but the handshake process has not started */
    TLS_SESSION_STATE_CONNECTING, /* TLS is in the process of negotiating a secure connection and verifying the remote fingerprint. */
    TLS_SESSION_STATE_CONNECTED,  /* TLS has completed negotiation of a secure connection and verified the remote fingerprint. */
    TLS_SESSION_STATE_CLOSED,     /* The transport has been closed intentionally as the result of receipt of a close_notify alert */
} TLS_SESSION_STATE;
 
/* Callback that is fired when Tls session wishes to send packet */
typedef STATUS (*TlsSessionOutboundPacketFunc)(UINT64, PBYTE, UINT32);
 
/*  Callback that is fired when Tls state has changed */
typedef VOID (*TlsSessionOnStateChange)(UINT64, TLS_SESSION_STATE);
 
typedef struct {
    UINT64 outBoundPacketFnCustomData;
    // outBoundPacketFn is a required callback to tell TlsSession how to send outbound packets
    TlsSessionOutboundPacketFunc outboundPacketFn;
    // stateChangeFn is an optional callback to listen to TlsSession state changes
    UINT64 stateChangeFnCustomData;
    TlsSessionOnStateChange stateChangeFn;
} TlsSessionCallbacks, *PTlsSessionCallbacks;
 
typedef struct __TlsSession TlsSession, *PTlsSession;
struct __TlsSession {
    TlsSessionCallbacks callbacks;
    TLS_SESSION_STATE state;
 
#ifdef KVS_USE_OPENSSL
    SSL_CTX* pSslCtx;
    SSL* pSsl;
#elif KVS_USE_MBEDTLS
    IOBuffer* pReadBuffer;
 
    mbedtls_ssl_context sslCtx;
    mbedtls_ssl_config sslCtxConfig;
    mbedtls_entropy_context entropy;
    mbedtls_ctr_drbg_context ctrDrbg;
    mbedtls_x509_crt cacert;
#else
#error "A Crypto implementation is required."
#endif
};
 
STATUS createTlsSession(PTlsSessionCallbacks, PTlsSession*);
 
STATUS freeTlsSession(PTlsSession*);
 
STATUS tlsSessionStartWithHostname(PTlsSession, BOOL, PCHAR);
 
STATUS tlsSessionStart(PTlsSession, BOOL);
 
STATUS tlsSessionProcessPacket(PTlsSession, PBYTE, UINT32, PUINT32);
 
STATUS tlsSessionPutApplicationData(PTlsSession, PBYTE, UINT32);
 
STATUS tlsSessionShutdown(PTlsSession);
 
/* internal functions */
STATUS tlsSessionChangeState(PTlsSession, TLS_SESSION_STATE);
 
#ifdef KVS_USE_OPENSSL
INT32 tlsSessionCertificateVerifyCallback(INT32, X509_STORE_CTX*);
#elif KVS_USE_MBEDTLS
/* mbedTLS 3.0 introduced <mbedtls/build_info.h>; 2.x ships only <mbedtls/version.h>.
 * Nested guard: old preprocessors (GCC < 5) parse the whole #if line even when
 * defined(__has_include) is false, so __has_include(...) must not appear on the
 * same line as the defined() check. */
#ifdef __has_include
#if __has_include(<mbedtls/build_info.h>)
#include <mbedtls/build_info.h>
#else
#include <mbedtls/version.h>
#endif
#else
#include <mbedtls/version.h>
#endif
#if defined(MBEDTLS_VERSION_NUMBER)
#define MBEDTLS_BEFORE_V3   (MBEDTLS_VERSION_NUMBER < 0x03000000)
#define MBEDTLS_V4_OR_LATER (MBEDTLS_VERSION_MAJOR >= 4)
#else
#define MBEDTLS_BEFORE_V3   (1) /* default to before v3 */
#define MBEDTLS_V4_OR_LATER (0)
#endif
// following are required callbacks for mbedtls
// NOTE: const is not a pure C qualifier, they're here because there's no way to type cast
//       a callback signature.
INT32 tlsSessionSendCallback(PVOID, const unsigned char*, ULONG);
INT32 tlsSessionReceiveCallback(PVOID, unsigned char*, ULONG);
 
#else
#error "A Crypto implementation is required."
#endif
 
#ifdef __cplusplus
}
#endif
#endif //__KINESIS_VIDEO_WEBRTC_CLIENT_CRYPTO_TLS__