mbedTLS TLS backend: OpenSSL-shaped seam over the CWIST TLS subset. More...
Go to the source code of this file.
Typedefs | |
| typedef struct cwist_mtls_ctx | SSL_CTX |
| typedef struct cwist_mtls_ssl | SSL |
| typedef struct cwist_mtls_method | SSL_METHOD |
Detailed Description
mbedTLS TLS backend: OpenSSL-shaped seam over the CWIST TLS subset.
This header (and its siblings in this directory) is the CWIST TLS backend seam. When the library is built with CWIST_TLS=mbedtls the Makefile puts this directory on the include path instead of lib/boringssl/include, so every call site - public headers, https.c, http2.c, grpc_client.c - keeps its <openssl/ssl.h> include and its SSL_* call shape, but compiles against the declarations below. Each OpenSSL-flavoured name is a macro alias for a cwist_mtls_* function genuinely implemented on mbedTLS (mbedtls_ssl_*) in src/security/tls/backend_mbedtls.c, so the produced archive carries no BoringSSL object or symbol.
Design notes:
- SSL / SSL_CTX / SSL_METHOD are opaque handles; no public struct changes, so the API baseline is untouched.
- SSL_new() takes a reference on the SSL_CTX exactly like BoringSSL: the cwist_https_reload_context() hot-swap contract (old SSL_CTX stays alive until its last connection drains) is preserved by an internal refcount.
- Error codes mirror BoringSSL's SSL_ERROR_* values; SSL_get_error() reports the outcome of the last operation on that connection.
- Only the subset CWIST actually uses is provided. Anything outside it (X509 inspection, PKCS#7, ASN.1, DTLS) stays BoringSSL-only; the modules that need it (AIA chain autoload, ECH, WebRTC, HTTP/3) are compiled out or degraded when CWIST_TLS=mbedtls, as documented in the Makefile and docs/performance/tls-backends.md.
Definition in file ssl.h.
Macro Definition Documentation
◆ EVP_cleanup
◆ OpenSSL_add_ssl_algorithms
◆ OPENSSL_NPN_NEGOTIATED
◆ SSL_accept
| #define SSL_accept cwist_mtls_SSL_accept |
◆ SSL_connect
| #define SSL_connect cwist_mtls_SSL_connect |
◆ SSL_CTX_check_private_key
| #define SSL_CTX_check_private_key cwist_mtls_SSL_CTX_check_private_key |
◆ SSL_CTX_free
| #define SSL_CTX_free cwist_mtls_SSL_CTX_free |
◆ SSL_CTX_get_ex_data
| #define SSL_CTX_get_ex_data cwist_mtls_SSL_CTX_get_ex_data |
◆ SSL_CTX_get_ex_new_index
| #define SSL_CTX_get_ex_new_index cwist_mtls_SSL_CTX_get_ex_new_index |
◆ SSL_CTX_get_min_proto_version
| #define SSL_CTX_get_min_proto_version cwist_mtls_SSL_CTX_get_min_proto_version |
◆ SSL_CTX_new
| #define SSL_CTX_new cwist_mtls_SSL_CTX_new |
◆ SSL_CTX_sess_set_cache_size
| #define SSL_CTX_sess_set_cache_size cwist_mtls_SSL_CTX_sess_set_cache_size |
◆ SSL_CTX_set1_groups_list
| #define SSL_CTX_set1_groups_list cwist_mtls_SSL_CTX_set1_groups_list |
◆ SSL_CTX_set_alpn_protos
| #define SSL_CTX_set_alpn_protos cwist_mtls_SSL_CTX_set_alpn_protos |
◆ SSL_CTX_set_alpn_select_cb
| #define SSL_CTX_set_alpn_select_cb cwist_mtls_SSL_CTX_set_alpn_select_cb |
◆ SSL_CTX_set_cipher_list
| #define SSL_CTX_set_cipher_list cwist_mtls_SSL_CTX_set_cipher_list |
◆ SSL_CTX_set_ciphersuites
| #define SSL_CTX_set_ciphersuites cwist_mtls_SSL_CTX_set_ciphersuites |
◆ SSL_CTX_set_default_verify_paths
| #define SSL_CTX_set_default_verify_paths cwist_mtls_SSL_CTX_set_default_verify_paths |
◆ SSL_CTX_set_ex_data
| #define SSL_CTX_set_ex_data cwist_mtls_SSL_CTX_set_ex_data |
◆ SSL_CTX_set_min_proto_version
| #define SSL_CTX_set_min_proto_version cwist_mtls_SSL_CTX_set_min_proto_version |
◆ SSL_CTX_set_mode
| #define SSL_CTX_set_mode cwist_mtls_SSL_CTX_set_mode |
◆ SSL_CTX_set_options
| #define SSL_CTX_set_options cwist_mtls_SSL_CTX_set_options |
◆ SSL_CTX_set_session_cache_mode
| #define SSL_CTX_set_session_cache_mode cwist_mtls_SSL_CTX_set_session_cache_mode |
◆ SSL_CTX_set_session_id_context
| #define SSL_CTX_set_session_id_context cwist_mtls_SSL_CTX_set_session_id_context |
◆ SSL_CTX_set_timeout
| #define SSL_CTX_set_timeout cwist_mtls_SSL_CTX_set_timeout |
◆ SSL_CTX_set_tlsext_ticket_key_cb
| #define SSL_CTX_set_tlsext_ticket_key_cb cwist_mtls_SSL_CTX_set_tlsext_ticket_key_cb |
◆ SSL_CTX_set_verify
| #define SSL_CTX_set_verify cwist_mtls_SSL_CTX_set_verify |
◆ SSL_CTX_use_certificate_chain_file
| #define SSL_CTX_use_certificate_chain_file cwist_mtls_SSL_CTX_use_certificate_chain_file |
◆ SSL_CTX_use_certificate_file
| #define SSL_CTX_use_certificate_file cwist_mtls_SSL_CTX_use_certificate_file |
◆ SSL_CTX_use_PrivateKey_file
| #define SSL_CTX_use_PrivateKey_file cwist_mtls_SSL_CTX_use_PrivateKey_file |
◆ SSL_ERROR_NONE
◆ SSL_ERROR_SSL
◆ SSL_ERROR_SYSCALL
◆ SSL_ERROR_WANT_READ
◆ SSL_ERROR_WANT_WRITE
◆ SSL_ERROR_ZERO_RETURN
◆ SSL_FILETYPE_PEM
◆ SSL_free
| #define SSL_free cwist_mtls_SSL_free |
◆ SSL_get0_alpn_selected
| #define SSL_get0_alpn_selected cwist_mtls_SSL_get0_alpn_selected |
◆ SSL_get_cipher_name
| #define SSL_get_cipher_name cwist_mtls_SSL_get_cipher_name |
◆ SSL_get_error
| #define SSL_get_error cwist_mtls_SSL_get_error |
◆ SSL_get_SSL_CTX
| #define SSL_get_SSL_CTX cwist_mtls_SSL_get_SSL_CTX |
◆ SSL_load_error_strings
◆ SSL_MODE_AUTO_RETRY
◆ SSL_new
| #define SSL_new cwist_mtls_SSL_new |
◆ SSL_OP_CIPHER_SERVER_PREFERENCE
◆ SSL_OP_NO_COMPRESSION
◆ SSL_OP_NO_RENEGOTIATION
◆ SSL_OP_NO_TICKET
◆ SSL_OP_NO_TLSv1
◆ SSL_OP_NO_TLSv1_1
◆ SSL_OP_NO_TLSv1_2
◆ SSL_pending
| #define SSL_pending cwist_mtls_SSL_pending |
◆ SSL_read
| #define SSL_read cwist_mtls_SSL_read |
◆ SSL_select_next_proto
| #define SSL_select_next_proto cwist_mtls_SSL_select_next_proto |
◆ SSL_SESS_CACHE_SERVER
◆ SSL_session_reused
| #define SSL_session_reused cwist_mtls_SSL_session_reused |
◆ SSL_set_alpn_protos
| #define SSL_set_alpn_protos cwist_mtls_SSL_set_alpn_protos |
◆ SSL_set_fd
| #define SSL_set_fd cwist_mtls_SSL_set_fd |
◆ SSL_set_tlsext_host_name
| #define SSL_set_tlsext_host_name cwist_mtls_SSL_set_tlsext_host_name |
◆ SSL_shutdown
| #define SSL_shutdown cwist_mtls_SSL_shutdown |
◆ SSL_TLSEXT_ERR_NOACK
◆ SSL_TLSEXT_ERR_OK
◆ SSL_VERIFY_NONE
◆ SSL_VERIFY_PEER
◆ SSL_version
| #define SSL_version cwist_mtls_SSL_version |
◆ SSL_write
| #define SSL_write cwist_mtls_SSL_write |
◆ TLS1_2_VERSION
◆ TLS1_3_VERSION
◆ TLS_client_method
| #define TLS_client_method cwist_mtls_TLS_client_method |
◆ TLS_server_method
| #define TLS_server_method cwist_mtls_TLS_server_method |
Typedef Documentation
◆ SSL
◆ SSL_CTX
◆ SSL_METHOD
| typedef struct cwist_mtls_method SSL_METHOD |
Function Documentation
◆ cwist_mtls_SSL_accept()
Definition at line 935 of file backend_mbedtls.c.
◆ cwist_mtls_SSL_connect()
Definition at line 940 of file backend_mbedtls.c.
◆ cwist_mtls_SSL_CTX_check_private_key()
Definition at line 619 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_free()
Definition at line 455 of file backend_mbedtls.c.
References cap.
Referenced by cwist_mtls_SSL_free().
◆ cwist_mtls_SSL_CTX_get_ex_data()
Definition at line 820 of file backend_mbedtls.c.
References cap, and CWIST_MTLS_EX_DATA_MAX.
◆ cwist_mtls_SSL_CTX_get_ex_new_index()
| int cwist_mtls_SSL_CTX_get_ex_new_index | ( | long | argl, |
| void * | argp, | ||
| void * | new_func, | ||
| void * | dup_func, | ||
| void * | free_func | ||
| ) |
Definition at line 803 of file backend_mbedtls.c.
References cap, and CWIST_MTLS_EX_DATA_MAX.
◆ cwist_mtls_SSL_CTX_get_min_proto_version()
Definition at line 614 of file backend_mbedtls.c.
References cap, TLS1_2_VERSION, and TLS1_3_VERSION.
◆ cwist_mtls_SSL_CTX_new()
| SSL_CTX * cwist_mtls_SSL_CTX_new | ( | const SSL_METHOD * | method | ) |
Definition at line 394 of file backend_mbedtls.c.
References cap, cwist_free(), and cwist_malloc().
◆ cwist_mtls_SSL_CTX_sess_set_cache_size()
Definition at line 630 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set1_groups_list()
Definition at line 846 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_alpn_protos()
| int cwist_mtls_SSL_CTX_set_alpn_protos | ( | SSL_CTX * | ctx, |
| const unsigned char * | protos, | ||
| unsigned int | protos_len | ||
| ) |
Definition at line 692 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_alpn_select_cb()
| void cwist_mtls_SSL_CTX_set_alpn_select_cb | ( | SSL_CTX * | ctx, |
| int(*)(SSL *ssl, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg) | cb, | ||
| void * | arg | ||
| ) |
Definition at line 653 of file backend_mbedtls.c.
References cap, and SSL_TLSEXT_ERR_OK.
◆ cwist_mtls_SSL_CTX_set_cipher_list()
Definition at line 564 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_ciphersuites()
Definition at line 568 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_default_verify_paths()
Definition at line 832 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_ex_data()
Definition at line 814 of file backend_mbedtls.c.
References cap, and CWIST_MTLS_EX_DATA_MAX.
◆ cwist_mtls_SSL_CTX_set_min_proto_version()
Definition at line 462 of file backend_mbedtls.c.
References cap, TLS1_2_VERSION, and TLS1_3_VERSION.
◆ cwist_mtls_SSL_CTX_set_mode()
Definition at line 491 of file backend_mbedtls.c.
References cap, and SSL_MODE_AUTO_RETRY.
◆ cwist_mtls_SSL_CTX_set_options()
Definition at line 475 of file backend_mbedtls.c.
References cap, SSL_OP_NO_TICKET, and SSL_OP_NO_TLSv1_2.
◆ cwist_mtls_SSL_CTX_set_session_cache_mode()
Definition at line 624 of file backend_mbedtls.c.
References cap, and SSL_SESS_CACHE_SERVER.
◆ cwist_mtls_SSL_CTX_set_session_id_context()
| int cwist_mtls_SSL_CTX_set_session_id_context | ( | SSL_CTX * | ctx, |
| const unsigned char * | sid_ctx, | ||
| unsigned int | sid_ctx_len | ||
| ) |
Definition at line 637 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_timeout()
Definition at line 646 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_CTX_set_tlsext_ticket_key_cb()
| void cwist_mtls_SSL_CTX_set_tlsext_ticket_key_cb | ( | SSL_CTX * | ctx, |
| int(*)(SSL *ssl, unsigned char *key_name, unsigned char *iv, EVP_CIPHER_CTX *ectx, HMAC_CTX *hctx, int enc) | cb | ||
| ) |
Definition at line 733 of file backend_mbedtls.c.
References cap, cwist_free(), cwist_malloc(), CWIST_MTLS_EX_DATA_MAX, and SSL_OP_NO_TICKET.
◆ cwist_mtls_SSL_CTX_set_verify()
Definition at line 825 of file backend_mbedtls.c.
References cap, and SSL_VERIFY_PEER.
◆ cwist_mtls_SSL_CTX_use_certificate_chain_file()
Definition at line 583 of file backend_mbedtls.c.
References cap.
Referenced by cwist_mtls_SSL_CTX_use_certificate_file().
◆ cwist_mtls_SSL_CTX_use_certificate_file()
Definition at line 609 of file backend_mbedtls.c.
References cap, and cwist_mtls_SSL_CTX_use_certificate_chain_file().
◆ cwist_mtls_SSL_CTX_use_PrivateKey_file()
Definition at line 596 of file backend_mbedtls.c.
References cap, and SSL_FILETYPE_PEM.
◆ cwist_mtls_SSL_free()
Definition at line 894 of file backend_mbedtls.c.
References cap, cwist_free(), and cwist_mtls_SSL_CTX_free().
◆ cwist_mtls_SSL_get0_alpn_selected()
| void cwist_mtls_SSL_get0_alpn_selected | ( | const SSL * | ssl, |
| const unsigned char ** | data, | ||
| unsigned int * | len | ||
| ) |
Definition at line 1054 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_get_cipher_name()
Definition at line 1031 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_get_error()
Definition at line 1006 of file backend_mbedtls.c.
References cap, and SSL_ERROR_SSL.
◆ cwist_mtls_SSL_get_SSL_CTX()
Definition at line 1012 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_new()
Definition at line 873 of file backend_mbedtls.c.
References cap, cwist_free(), cwist_malloc(), and SSL_ERROR_NONE.
◆ cwist_mtls_SSL_pending()
Definition at line 994 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_read()
Definition at line 945 of file backend_mbedtls.c.
References cap, SSL_ERROR_NONE, SSL_ERROR_SSL, SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE, and SSL_ERROR_ZERO_RETURN.
◆ cwist_mtls_SSL_select_next_proto()
| int cwist_mtls_SSL_select_next_proto | ( | unsigned char ** | out, |
| unsigned char * | outlen, | ||
| const unsigned char * | server, | ||
| unsigned int | server_len, | ||
| const unsigned char * | client, | ||
| unsigned int | client_len | ||
| ) |
Definition at line 320 of file backend_mbedtls.c.
References cap, and OPENSSL_NPN_NEGOTIATED.
◆ cwist_mtls_SSL_session_reused()
Definition at line 1016 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_set_alpn_protos()
| int cwist_mtls_SSL_set_alpn_protos | ( | SSL * | ssl, |
| const unsigned char * | protos, | ||
| unsigned int | protos_len | ||
| ) |
Definition at line 1066 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_set_fd()
Definition at line 903 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_set_tlsext_host_name()
Definition at line 1061 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_shutdown()
Definition at line 999 of file backend_mbedtls.c.
References cap.
◆ cwist_mtls_SSL_version()
Definition at line 1023 of file backend_mbedtls.c.
References cap, TLS1_2_VERSION, and TLS1_3_VERSION.
◆ cwist_mtls_SSL_write()
Definition at line 974 of file backend_mbedtls.c.
References cap, SSL_ERROR_NONE, SSL_ERROR_SSL, SSL_ERROR_WANT_READ, and SSL_ERROR_WANT_WRITE.
◆ cwist_mtls_TLS_client_method()
| const SSL_METHOD * cwist_mtls_TLS_client_method | ( | void | ) |
Definition at line 355 of file backend_mbedtls.c.
◆ cwist_mtls_TLS_server_method()
| const SSL_METHOD * cwist_mtls_TLS_server_method | ( | void | ) |
Definition at line 351 of file backend_mbedtls.c.
