1#![allow(non_upper_case_globals)]
6#![allow(non_camel_case_types)] #![allow(non_snake_case)]
8
9extern crate libc;
10pub mod cert;
11pub mod error;
12pub mod nspr;
13
14use libc::{c_char, c_uchar, c_uint, c_ulong, c_void};
15use nspr::{PRFileDesc, PRBool, PRInt32, PRUint16};
16
17pub use cert::{CERTCertificate, CERTCertList, CERTCertListNode,
18 CERT_DestroyCertificate, CERT_DestroyCertList,
19 CERT_VerifyCertName};
20
21#[derive(Clone, Copy, PartialEq, Eq, Debug)]
22#[repr(C)]
23pub enum SECStatus {
24 SECWouldBlock = -2,
25 SECFailure = -1,
26 SECSuccess = 0,
27}
28pub use self::SECStatus::*;
29
30#[derive(Clone, Copy, PartialEq, Eq, Debug)]
31#[repr(C)]
32pub enum SECItemType {
33 siBuffer = 0,
34 siClearDataBuffer = 1,
35 siCipherDataBuffer = 2,
36 siDERCertBuffer = 3,
37 siEncodedCertBuffer = 4,
38 siDERNameBuffer = 5,
39 siEncodedNameBuffer = 6,
40 siAsciiNameString = 7,
41 siAsciiString = 8,
42 siDEROID = 9,
43 siUnsignedInteger = 10,
44 siUTCTime = 11,
45 siGeneralizedTime = 12,
46 siVisibleString = 13,
47 siUTF8String = 14,
48 siBMPString = 15,
49}
50
51pub type SECItem = SECItemStr;
52pub type SECAlgorithmID = SECAlgorithmIDStr;
53pub type PK11SlotInfo = PK11SlotInfoStr;
54pub type SSLVersionRange = SSLVersionRangeStr;
55
56pub type CK_OBJECT_HANDLE = CK_ULONG;
57pub type CK_ULONG = c_ulong;
58
59pub enum NSSTrustDomainStr { }
60pub enum NSSCertificateStr { }
61pub enum PK11SlotInfoStr { }
62
63#[derive(Debug)]
64#[repr(C)]
65pub struct SECItemStr {
66 pub type_: SECItemType,
67 pub data: *mut c_uchar,
68 pub len: c_uint,
69}
70
71#[derive(Debug)]
72#[repr(C)]
73pub struct SECAlgorithmIDStr {
74 pub algorithm: SECItem,
75 pub parameters: SECItem,
76}
77
78pub type SSLBadCertHandler =
79 Option<unsafe extern "C" fn (arg: *mut c_void, fd: *mut PRFileDesc) -> SECStatus>;
80
81pub type SSLAuthCertificate =
82 Option<unsafe extern "C" fn(arg: *mut c_void, fd: *mut PRFileDesc,
83 checkSig: PRBool, isServer: PRBool) -> SECStatus>;
84
85pub const SSL_SECURITY: PRInt32 = 1;
87pub const SSL_SOCKS: PRInt32 = 2;
88pub const SSL_REQUEST_CERTIFICATE: PRInt32 = 3;
89pub const SSL_HANDSHAKE_AS_CLIENT: PRInt32 = 5;
90pub const SSL_HANDSHAKE_AS_SERVER: PRInt32 = 6;
91pub const SSL_ENABLE_SSL2: PRInt32 = 7;
92pub const SSL_ENABLE_SSL3: PRInt32 = 8;
93pub const SSL_NO_CACHE: PRInt32 = 9;
94pub const SSL_REQUIRE_CERTIFICATE: PRInt32 = 10;
95pub const SSL_ENABLE_FDX: PRInt32 = 11;
96pub const SSL_V2_COMPATIBLE_HELLO: PRInt32 = 12;
97pub const SSL_ENABLE_TLS: PRInt32 = 13;
98pub const SSL_ROLLBACK_DETECTION: PRInt32 = 14;
99pub const SSL_NO_STEP_DOWN: PRInt32 = 15;
100pub const SSL_BYPASS_PKCS11: PRInt32 = 16;
101pub const SSL_NO_LOCKS: PRInt32 = 17;
102pub const SSL_ENABLE_SESSION_TICKETS: PRInt32 = 18;
103pub const SSL_ENABLE_DEFLATE: PRInt32 = 19;
104pub const SSL_ENABLE_RENEGOTIATION: PRInt32 = 20;
105pub const SSL_REQUIRE_SAFE_NEGOTIATION: PRInt32 = 21;
106pub const SSL_ENABLE_FALSE_START: PRInt32 = 22;
107pub const SSL_CBC_RANDOM_IV: PRInt32 = 23;
108pub const SSL_ENABLE_OCSP_STAPLING: PRInt32 = 24;
109pub const SSL_ENABLE_NPN: PRInt32 = 25;
110pub const SSL_ENABLE_ALPN: PRInt32 = 26;
111pub const SSL_REUSE_SERVER_ECDHE_KEY: PRInt32 = 27;
112pub const SSL_ENABLE_FALLBACK_SCSV: PRInt32 = 28;
113pub const SSL_ENABLE_SERVER_DHE: PRInt32 = 29;
114pub const SSL_ENABLE_EXTENDED_MASTER_SECRET: PRInt32 = 30;
115pub const SSL_ENABLE_SIGNED_CERT_TIMESTAMPS: PRInt32 = 31;
116pub const SSL_REQUIRE_DH_NAMED_GROUPS: PRInt32 = 32;
117pub const SSL_ENABLE_0RTT_DATA: PRInt32 = 33;
118
119#[derive(Debug, Clone, Copy, PartialEq, Eq)]
120#[repr(C)]
121pub enum SSLProtocolVariant {
122 ssl_variant_stream = 0,
123 ssl_variant_datagram = 1,
124}
125pub use self::SSLProtocolVariant::*;
126
127#[derive(Debug, Clone, Copy, PartialEq, Eq)]
128#[repr(C)]
129pub struct SSLVersionRangeStr {
130 pub min: PRUint16,
131 pub max: PRUint16,
132}
133
134pub const SSL_LIBRARY_VERSION_2: PRUint16 = 0x0002;
135pub const SSL_LIBRARY_VERSION_3_0: PRUint16 = 0x0300;
136pub const SSL_LIBRARY_VERSION_TLS_1_0: PRUint16 = 0x0301;
137pub const SSL_LIBRARY_VERSION_TLS_1_1: PRUint16 = 0x0302;
138pub const SSL_LIBRARY_VERSION_TLS_1_2: PRUint16 = 0x0303;
139pub const SSL_LIBRARY_VERSION_TLS_1_3: PRUint16 = 0x0304;
140
141pub const TLS_NULL_WITH_NULL_NULL: PRUint16 = 0x0000;
145pub const TLS_RSA_WITH_NULL_MD5: PRUint16 = 0x0001;
146pub const TLS_RSA_WITH_NULL_SHA: PRUint16 = 0x0002;
147pub const TLS_RSA_EXPORT_WITH_RC4_40_MD5: PRUint16 = 0x0003;
148pub const TLS_RSA_WITH_RC4_128_MD5: PRUint16 = 0x0004;
149pub const TLS_RSA_WITH_RC4_128_SHA: PRUint16 = 0x0005;
150pub const TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5: PRUint16 = 0x0006;
151pub const TLS_RSA_WITH_IDEA_CBC_SHA: PRUint16 = 0x0007;
152pub const TLS_RSA_EXPORT_WITH_DES40_CBC_SHA: PRUint16 = 0x0008;
153pub const TLS_RSA_WITH_DES_CBC_SHA: PRUint16 = 0x0009;
154pub const TLS_RSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0x000a;
155pub const TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: PRUint16 = 0x000b;
156pub const TLS_DH_DSS_WITH_DES_CBC_SHA: PRUint16 = 0x000c;
157pub const TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0x000d;
158pub const TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: PRUint16 = 0x000e;
159pub const TLS_DH_RSA_WITH_DES_CBC_SHA: PRUint16 = 0x000f;
160pub const TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0x0010;
161pub const TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: PRUint16 = 0x0011;
162pub const TLS_DHE_DSS_WITH_DES_CBC_SHA: PRUint16 = 0x0012;
163pub const TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0x0013;
164pub const TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: PRUint16 = 0x0014;
165pub const TLS_DHE_RSA_WITH_DES_CBC_SHA: PRUint16 = 0x0015;
166pub const TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0x0016;
167pub const TLS_DH_anon_EXPORT_WITH_RC4_40_MD5: PRUint16 = 0x0017;
168pub const TLS_DH_anon_WITH_RC4_128_MD5: PRUint16 = 0x0018;
169pub const TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA: PRUint16 = 0x0019;
170pub const TLS_DH_anon_WITH_DES_CBC_SHA: PRUint16 = 0x001a;
171pub const TLS_DH_anon_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0x001b;
172pub const SSL_FORTEZZA_DMS_WITH_NULL_SHA: PRUint16 = 0x001c;
173pub const SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: PRUint16 = 0x001d;
174pub const SSL_FORTEZZA_DMS_WITH_RC4_128_SHA: PRUint16 = 0x001e;
175pub const TLS_RSA_WITH_AES_128_CBC_SHA: PRUint16 = 0x002F;
176pub const TLS_DH_DSS_WITH_AES_128_CBC_SHA: PRUint16 = 0x0030;
177pub const TLS_DH_RSA_WITH_AES_128_CBC_SHA: PRUint16 = 0x0031;
178pub const TLS_DHE_DSS_WITH_AES_128_CBC_SHA: PRUint16 = 0x0032;
179pub const TLS_DHE_RSA_WITH_AES_128_CBC_SHA: PRUint16 = 0x0033;
180pub const TLS_DH_anon_WITH_AES_128_CBC_SHA: PRUint16 = 0x0034;
181pub const TLS_RSA_WITH_AES_256_CBC_SHA: PRUint16 = 0x0035;
182pub const TLS_DH_DSS_WITH_AES_256_CBC_SHA: PRUint16 = 0x0036;
183pub const TLS_DH_RSA_WITH_AES_256_CBC_SHA: PRUint16 = 0x0037;
184pub const TLS_DHE_DSS_WITH_AES_256_CBC_SHA: PRUint16 = 0x0038;
185pub const TLS_DHE_RSA_WITH_AES_256_CBC_SHA: PRUint16 = 0x0039;
186pub const TLS_DH_anon_WITH_AES_256_CBC_SHA: PRUint16 = 0x003A;
187pub const TLS_RSA_WITH_NULL_SHA256: PRUint16 = 0x003B;
188pub const TLS_RSA_WITH_AES_128_CBC_SHA256: PRUint16 = 0x003C;
189pub const TLS_RSA_WITH_AES_256_CBC_SHA256: PRUint16 = 0x003D;
190pub const TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: PRUint16 = 0x0040;
191pub const TLS_RSA_WITH_CAMELLIA_128_CBC_SHA: PRUint16 = 0x0041;
192pub const TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA: PRUint16 = 0x0042;
193pub const TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA: PRUint16 = 0x0043;
194pub const TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA: PRUint16 = 0x0044;
195pub const TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA: PRUint16 = 0x0045;
196pub const TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA: PRUint16 = 0x0046;
197pub const TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA: PRUint16 = 0x0062;
198pub const TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA: PRUint16 = 0x0063;
199pub const TLS_RSA_EXPORT1024_WITH_RC4_56_SHA: PRUint16 = 0x0064;
200pub const TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA: PRUint16 = 0x0065;
201pub const TLS_DHE_DSS_WITH_RC4_128_SHA: PRUint16 = 0x0066;
202pub const TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: PRUint16 = 0x0067;
203pub const TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: PRUint16 = 0x006A;
204pub const TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: PRUint16 = 0x006B;
205pub const TLS_RSA_WITH_CAMELLIA_256_CBC_SHA: PRUint16 = 0x0084;
206pub const TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA: PRUint16 = 0x0085;
207pub const TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA: PRUint16 = 0x0086;
208pub const TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA: PRUint16 = 0x0087;
209pub const TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA: PRUint16 = 0x0088;
210pub const TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA: PRUint16 = 0x0089;
211pub const TLS_RSA_WITH_SEED_CBC_SHA: PRUint16 = 0x0096;
212pub const TLS_RSA_WITH_AES_128_GCM_SHA256: PRUint16 = 0x009C;
213pub const TLS_RSA_WITH_AES_256_GCM_SHA384: PRUint16 = 0x009D;
214pub const TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: PRUint16 = 0x009E;
215pub const TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: PRUint16 = 0x009F;
216pub const TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: PRUint16 = 0x00A2;
217pub const TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: PRUint16 = 0x00A3;
218pub const TLS_ECDH_ECDSA_WITH_NULL_SHA: PRUint16 = 0xC001;
219pub const TLS_ECDH_ECDSA_WITH_RC4_128_SHA: PRUint16 = 0xC002;
220pub const TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xC003;
221pub const TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: PRUint16 = 0xC004;
222pub const TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: PRUint16 = 0xC005;
223pub const TLS_ECDHE_ECDSA_WITH_NULL_SHA: PRUint16 = 0xC006;
224pub const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: PRUint16 = 0xC007;
225pub const TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xC008;
226pub const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: PRUint16 = 0xC009;
227pub const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: PRUint16 = 0xC00A;
228pub const TLS_ECDH_RSA_WITH_NULL_SHA: PRUint16 = 0xC00B;
229pub const TLS_ECDH_RSA_WITH_RC4_128_SHA: PRUint16 = 0xC00C;
230pub const TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xC00D;
231pub const TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: PRUint16 = 0xC00E;
232pub const TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: PRUint16 = 0xC00F;
233pub const TLS_ECDHE_RSA_WITH_NULL_SHA: PRUint16 = 0xC010;
234pub const TLS_ECDHE_RSA_WITH_RC4_128_SHA: PRUint16 = 0xC011;
235pub const TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xC012;
236pub const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: PRUint16 = 0xC013;
237pub const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: PRUint16 = 0xC014;
238pub const TLS_ECDH_anon_WITH_NULL_SHA: PRUint16 = 0xC015;
239pub const TLS_ECDH_anon_WITH_RC4_128_SHA: PRUint16 = 0xC016;
240pub const TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xC017;
241pub const TLS_ECDH_anon_WITH_AES_128_CBC_SHA: PRUint16 = 0xC018;
242pub const TLS_ECDH_anon_WITH_AES_256_CBC_SHA: PRUint16 = 0xC019;
243pub const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: PRUint16 = 0xC023;
244pub const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: PRUint16 = 0xC024;
245pub const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: PRUint16 = 0xC027;
246pub const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: PRUint16 = 0xC028;
247pub const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: PRUint16 = 0xC02B;
248pub const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: PRUint16 = 0xC02C;
249pub const TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256: PRUint16 = 0xC02D;
250pub const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: PRUint16 = 0xC02F;
251pub const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: PRUint16 = 0xC030;
252pub const TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256: PRUint16 = 0xC031;
253pub const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: PRUint16 = 0xCCA8;
254pub const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: PRUint16 = 0xCCA9;
255pub const TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: PRUint16 = 0xCCAA;
256pub const SSL_RSA_FIPS_WITH_DES_CBC_SHA: PRUint16 = 0xfefe;
257pub const SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xfeff;
258pub const SSL_EN_RC4_128_WITH_MD5: PRUint16 = 0xFF01;
259pub const SSL_EN_RC4_128_EXPORT40_WITH_MD5: PRUint16 = 0xFF02;
260pub const SSL_EN_RC2_128_CBC_WITH_MD5: PRUint16 = 0xFF03;
261pub const SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5: PRUint16 = 0xFF04;
262pub const SSL_EN_IDEA_128_CBC_WITH_MD5: PRUint16 = 0xFF05;
263pub const SSL_EN_DES_64_CBC_WITH_MD5: PRUint16 = 0xFF06;
264pub const SSL_EN_DES_192_EDE3_CBC_WITH_MD5: PRUint16 = 0xFF07;
265pub const SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA: PRUint16 = 0xffe0;
266pub const SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA: PRUint16 = 0xffe1;
267
268pub const TLS_AES_128_GCM_SHA256: PRUint16 = 0x1301;
270pub const TLS_AES_256_GCM_SHA384: PRUint16 = 0x1302;
271pub const TLS_CHACHA20_POLY1305_SHA256: PRUint16 = 0x1303;
272
273extern "C" {
274 pub fn NSS_NoDB_Init(_configdir: *const c_char) -> SECStatus;
275 pub fn NSS_SetDomesticPolicy() -> SECStatus;
276 pub fn SSL_ImportFD(model: *mut PRFileDesc, fd: *mut PRFileDesc) -> *mut PRFileDesc;
277 pub fn SSL_PeerCertificate(fd: *mut PRFileDesc) -> *mut CERTCertificate;
278 pub fn SSL_PeerCertificateChain(fd: *mut PRFileDesc) -> *mut CERTCertList;
279 pub fn SSL_AuthCertificateHook(fd: *mut PRFileDesc, f: SSLAuthCertificate, arg: *mut c_void)
280 -> SECStatus;
281 pub fn SSL_BadCertHook(fd: *mut PRFileDesc, f: SSLBadCertHandler, arg: *mut c_void)
282 -> SECStatus;
283 pub fn SSL_SetURL(fd: *mut PRFileDesc, url: *const c_char) -> SECStatus;
284 pub fn SSL_OptionSet(fd: *mut PRFileDesc, option: PRInt32, on: PRBool) -> SECStatus;
285 pub fn SSL_OptionGet(fd: *mut PRFileDesc, option: PRInt32, on: *mut PRBool) -> SECStatus;
286 pub fn SSL_OptionSetDefault(option: PRInt32, on: PRBool) -> SECStatus;
287 pub fn SSL_OptionGetDefault(option: PRInt32, on: *mut PRBool) -> SECStatus;
288 pub fn SSL_VersionRangeSet(fd: *mut PRFileDesc, vrange: *const SSLVersionRange) -> SECStatus;
289 pub fn SSL_VersionRangeGet(fd: *mut PRFileDesc, vrange: *mut SSLVersionRange) -> SECStatus;
290 pub fn SSL_VersionRangeSetDefault(protocolVariant: SSLProtocolVariant,
291 vrange: *const SSLVersionRange) -> SECStatus;
292 pub fn SSL_VersionRangeGetDefault(protocolVariant: SSLProtocolVariant,
293 vrange: *mut SSLVersionRange) -> SECStatus;
294 pub fn SSL_VersionRangeGetSupported(protocolVariant: SSLProtocolVariant,
295 vrange: *mut SSLVersionRange) -> SECStatus;
296 pub fn SSL_GetImplementedCiphers() -> *const PRUint16;
297 pub fn SSL_GetNumImplementedCiphers() -> PRUint16;
298 pub fn SSL_CipherPrefSet(fd: *mut PRFileDesc, cipher: PRInt32, enabled: PRBool) -> SECStatus;
299 pub fn SSL_CipherPrefGet(fd: *mut PRFileDesc, cipher: PRInt32, enabled: *mut PRBool)
300 -> SECStatus;
301 pub fn SSL_CipherPrefSetDefault(cipher: PRInt32, enabled: PRBool) -> SECStatus;
302 pub fn SSL_CipherPrefGetDefault(cipher: PRInt32, enabled: *mut PRBool) -> SECStatus;
303}
304
305#[cfg(test)]
306mod tests {
307 use super::*;
308 use std::ptr;
309
310 macro_rules! assert_ok {
311 ($e:expr) => { assert_eq!(unsafe { $e }, SECSuccess) }
312 }
313
314 #[test]
315 fn init() {
316 assert_ok!(NSS_NoDB_Init(ptr::null()));
317 }
318
319 #[test]
320 fn set_domestic() {
321 init();
322 assert_ok!(NSS_SetDomesticPolicy());
323 }
324}