Updated to hostap_2_6

[mech_eap.git] / libeap / src / crypto / tls.h

diff --git a/libeap/src/crypto/tls.h b/libeap/src/crypto/tls.h
index d02158e..33262da 100644 (file)
--- a/libeap/src/crypto/tls.h
+++ b/libeap/src/crypto/tls.h
@@ -97,6 +97,8 @@ struct tls_config {
 #define TLS_CONN_DISABLE_TLSv1_2 BIT(6)
 #define TLS_CONN_EAP_FAST BIT(7)
 #define TLS_CONN_DISABLE_TLSv1_0 BIT(8)
+#define TLS_CONN_EXT_CERT_CHECK BIT(9)
+#define TLS_CONN_REQUIRE_OCSP_ALL BIT(10)
 
 struct X509; /* from OpenSSL */
 
@@ -143,6 +145,9 @@ struct X509; /* from OpenSSL */
  * @flags: Parameter options (TLS_CONN_*)
  * @ocsp_stapling_response: DER encoded file with cached OCSP stapling response
  *     or %NULL if OCSP is not enabled
+ * @ocsp_stapling_response_multi: DER encoded file with cached OCSP stapling
+ *     response list (OCSPResponseList for ocsp_multi in RFC 6961) or %NULL if
+ *     ocsp_multi is not enabled
  * @server_cert_cb: Optional callback to be used to validate server certificate
  *  when no CA or path was specified. 
  * @server_cert_ctx: Optional context arg for server_cert_cb.
@@ -186,11 +191,7 @@ struct tls_connection_params {
 
        unsigned int flags;
        const char *ocsp_stapling_response;
-
-    /**
-     * If non-null, specifies a callback method that can be used to
-     * confirm the validity of a peer certificate.
-     */
+       const char *ocsp_stapling_response_multi;
     int (*server_cert_cb)(int ok_so_far, X509* cert, void *ca_ctx);
     void *server_cert_ctx;
 };
@@ -344,29 +345,36 @@ int __must_check tls_connection_get_random(void *tls_ctx,
                                         struct tls_random *data);
 
 /**
- * tls_connection_prf - Use TLS-PRF to derive keying material
+ * tls_connection_export_key - Derive keying material from a TLS connection
  * @tls_ctx: TLS context data from tls_init()
  * @conn: Connection context data from tls_connection_init()
  * @label: Label (e.g., description of the key) for PRF
- * @server_random_first: seed is 0 = client_random|server_random,
- * 1 = server_random|client_random
- * @skip_keyblock: Skip TLS key block from the beginning of PRF output
  * @out: Buffer for output data from TLS-PRF
  * @out_len: Length of the output buffer
  * Returns: 0 on success, -1 on failure
  *
- * tls_connection_prf() is required so that further keying material can be
- * derived from the master secret. Example implementation of this function is in
- * tls_prf_sha1_md5() when it is called with seed set to
- * client_random|server_random (or server_random|client_random). For TLSv1.2 and
- * newer, a different PRF is needed, though.
+ * Exports keying material using the mechanism described in RFC 5705.
+ */
+int __must_check tls_connection_export_key(void *tls_ctx,
+                                          struct tls_connection *conn,
+                                          const char *label,
+                                          u8 *out, size_t out_len);
+
+/**
+ * tls_connection_get_eap_fast_key - Derive key material for EAP-FAST
+ * @tls_ctx: TLS context data from tls_init()
+ * @conn: Connection context data from tls_connection_init()
+ * @out: Buffer for output data from TLS-PRF
+ * @out_len: Length of the output buffer
+ * Returns: 0 on success, -1 on failure
+ *
+ * Exports key material after the normal TLS key block for use with
+ * EAP-FAST. Most callers will want tls_connection_export_key(), but EAP-FAST
+ * uses a different legacy mechanism.
  */
-int __must_check  tls_connection_prf(void *tls_ctx,
-                                    struct tls_connection *conn,
-                                    const char *label,
-                                    int server_random_first,
-                                    int skip_keyblock,
-                                    u8 *out, size_t out_len);
+int __must_check tls_connection_get_eap_fast_key(void *tls_ctx,
+                                                struct tls_connection *conn,
+                                                u8 *out, size_t out_len);
 
 /**
  * tls_connection_handshake - Process TLS handshake (client side)
@@ -469,7 +477,9 @@ enum {
        TLS_CIPHER_RC4_SHA /* 0x0005 */,
        TLS_CIPHER_AES128_SHA /* 0x002f */,
        TLS_CIPHER_RSA_DHE_AES128_SHA /* 0x0031 */,
-       TLS_CIPHER_ANON_DH_AES128_SHA /* 0x0034 */
+       TLS_CIPHER_ANON_DH_AES128_SHA /* 0x0034 */,
+       TLS_CIPHER_RSA_DHE_AES256_SHA /* 0x0039 */,
+       TLS_CIPHER_AES256_SHA /* 0x0035 */,
 };
 
 /**