ssl.h
mbedtls/platform_util.h
mbedtls/private_access.h
mbedtls/build_info.h
mbedtls/bignum.h
mbedtls/ecp.h
mbedtls/ssl_ciphersuites.h
mbedtls/x509_crt.h
mbedtls/x509_crl.h
mbedtls/dhm.h
mbedtls/md.h
mbedtls/ecdh.h
mbedtls/platform_time.h
psa/crypto.h
debug.h
net_sockets.h
ssl_cache.h
ssl_cookie.h
ssl_ticket.h
mbedtls/asn1.h
mbedtls/bignum.h
mbedtls/build_info.h
mbedtls/ccm.h
mbedtls/chacha20.h
mbedtls/chachapoly.h
mbedtls/check_config.h
mbedtls/cipher.h
mbedtls/cmac.h
mbedtls/config_adjust_legacy_crypto.h
mbedtls/config_adjust_psa_from_legacy.h
mbedtls/config_adjust_psa_superset_legacy.h
mbedtls/config_adjust_ssl.h
mbedtls/config_adjust_x509.h
mbedtls/config_psa.h
mbedtls/dhm.h
mbedtls/ecdh.h
mbedtls/ecdsa.h
mbedtls/ecjpake.h
mbedtls/ecp.h
mbedtls/gcm.h
mbedtls/mbedtls_config.h
mbedtls/md.h
mbedtls/md5.h
mbedtls/pk.h
mbedtls/platform_time.h
mbedtls/platform_util.h
mbedtls/poly1305.h
mbedtls/private_access.h
mbedtls/ripemd160.h
mbedtls/rsa.h
mbedtls/sha1.h
mbedtls/sha256.h
mbedtls/sha3.h
mbedtls/sha512.h
ssl.h
mbedtls/ssl_ciphersuites.h
mbedtls/threading.h
mbedtls/x509.h
mbedtls/x509_crl.h
mbedtls/x509_crt.h
psa/build_info.h
psa/crypto.h
psa/crypto_adjust_auto_enabled.h
psa/crypto_adjust_config_dependencies.h
psa/crypto_adjust_config_key_pair_types.h
psa/crypto_adjust_config_synonyms.h
psa/crypto_builtin_composites.h
psa/crypto_builtin_key_derivation.h
psa/crypto_builtin_primitives.h
crypto_compat.h
psa/crypto_driver_common.h
psa/crypto_driver_contexts_composites.h
psa/crypto_driver_contexts_key_derivation.h
psa/crypto_driver_contexts_primitives.h
crypto_extra.h
psa/crypto_legacy.h
crypto_platform.h
crypto_sizes.h
crypto_struct.h
crypto_types.h
crypto_values.h
inttypes.h
limits.h
pthread.h
stddef.h
stdint.h
stdio.h
stdlib.h
time.h
debug.h
net_sockets.h
ssl.h
ssl_cache.h
ssl_cookie.h
ssl_ticket.h
mbedtls_ssl_premaster_secret
mbedtls_ssl_tls13_application_secrets
mbedtls_dtls_srtp_info_t
mbedtls_ssl_session
mbedtls_ssl_user_data_t
mbedtls_ssl_config
mbedtls_ssl_context
SECTION: Module settings

The configuration options you can set for this module are in this section. Either change them in mbedtls_config.h or define them on the compiler command line.

MBEDTLS_SSL_IN_CONTENT_LEN
16384

Maximum length (in bytes) of incoming plaintext fragments.

This determines the size of the incoming TLS I/O buffer in such a way that it is capable of holding the specified amount of plaintext data, regardless of the protection mechanism used.

When using a value less than the default of 16KB on the client, it is recommended to use the Maximum Fragment Length (MFL) extension to inform the server about this limitation. On the server, there is no supported, standardized way of informing the client about restriction on the maximum size of incoming messages, and unless the limitation has been communicated by other means, it is recommended to only change the outgoing buffer size MBEDTLS_SSL_OUT_CONTENT_LEN while keeping the default value of 16KB for the incoming buffer.

Uncomment to set the maximum plaintext size of the incoming I/O buffer.
MBEDTLS_SSL_OUT_CONTENT_LEN
16384

Maximum length (in bytes) of outgoing plaintext fragments.

This determines the size of the outgoing TLS I/O buffer in such a way that it is capable of holding the specified amount of plaintext data, regardless of the protection mechanism used.

It is possible to save RAM by setting a smaller outward buffer, while keeping the default inward 16384 byte buffer to conform to the TLS specification.

The minimum required outward buffer size is determined by the handshake protocol's usage. Handshaking will fail if the outward buffer is too small. The specific size requirement depends on the configured ciphers and any certificate data which is sent during the handshake.

Uncomment to set the maximum plaintext size of the outgoing I/O buffer.

MBEDTLS_SSL_DTLS_MAX_BUFFERING
32768

Maximum number of heap-allocated bytes for the purpose of DTLS handshake message reassembly and future message buffering.

This should be at least 9/8 * MBEDTLS_SSL_IN_CONTENT_LEN to account for a reassembled handshake message of maximum size, together with its reassembly bitmap.

A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) should be sufficient for all practical situations as it allows to reassembly a large handshake message (such as a certificate) while buffering multiple smaller handshake messages.

MBEDTLS_SSL_CID_IN_LEN_MAX
32

The maximum length of CIDs used for incoming DTLS messages.

mbedtls_ssl_get_own_cid
MBEDTLS_SSL_CID_OUT_LEN_MAX
32

The maximum length of CIDs used for outgoing DTLS messages.

mbedtls_ssl_get_peer_cid
MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY
16

This option controls the use of record plaintext padding in TLS 1.3 and when using the Connection ID extension in DTLS 1.2.

The padding will always be chosen so that the length of the padded plaintext is a multiple of the value of this option.

Note: A value of `1` means that no padding will be used for outgoing records.

Note: On systems lacking division instructions, a power of two should be preferred.

MBEDTLS_SSL_MAX_EARLY_DATA_SIZE
1024

Complete list of ciphersuites to use, in order of preference.

No dependency checking is done on that field! This option can only be used to restrict the set of available ciphersuites. It is your responsibility to make sure the needed modules are active.

Use this to save a few hundred bytes of ROM (default ordering of all available ciphersuites) and a few to a few hundred bytes of RAM.

The value below is only an example, not the default.

The default maximum amount of 0-RTT data. See the documentation of `mbedtls_ssl_conf_max_early_data_size()` for more information.

It must be positive and smaller than UINT32_MAX.

If MBEDTLS_SSL_EARLY_DATA is not defined, this default value does not have any impact on the build.

MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE
6000

Maximum allowed ticket age difference in milliseconds tolerated between server and client. Default value is 6000. This is not used in TLS 1.2.

- The client ticket age is the time difference between the time when the client proposes to the server to use the ticket and the time the client received the ticket from the server.

- The server ticket age is the time difference between the time when the server receives a proposition from the client to use the ticket and the time when the ticket was created by the server.

The ages might be different due to the client and server clocks not running at the same pace. The typical accuracy of an RTC crystal is ±100 to ±20 parts per million (360 to 72 milliseconds per hour). Default tolerance window is 6s, thus in the worst case clients and servers must sync up their system time every 6000/360/2~=8 hours.

See section 8.3 of the TLS 1.3 specification(RFC 8446) for more information.

MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH
32

Size in bytes of a ticket nonce. This is not used in TLS 1.2.

This must be less than 256.

MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS
1

Default number of NewSessionTicket messages to be sent by a TLS 1.3 server after handshake completion. This is not used in TLS 1.2 and relevant only if the MBEDTLS_SSL_SESSION_TICKETS option is enabled.

MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS
-0x7000

A cryptographic operation is in progress. Try again later.

MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
-0x7080

The requested feature is not available.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA
-0x7100

Bad input parameters to function.

mbedtls_ssl_session_get_ticket_creation_time
MBEDTLS_ERR_SSL_INVALID_MAC
-0x7180

Verification of the message MAC failed.

MBEDTLS_ERR_SSL_INVALID_RECORD
-0x7200

An invalid SSL record was received.

MBEDTLS_ERR_SSL_CONN_EOF
-0x7280

The connection indicated an EOF.

MBEDTLS_ERR_SSL_DECODE_ERROR
-0x7300

A message could not be parsed due to a syntactic error.

MBEDTLS_ERR_SSL_NO_RNG
-0x7400

No RNG was provided to the SSL module.

MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE
-0x7480

No client certification received from the client, but required by the authentication mode.

MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION
-0x7500

Client received an extended server hello containing an unsupported extension

MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL
-0x7580

No ALPN protocols supported that the client advertises

MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED
-0x7600

The own private key or pre-shared key is not set, but needed.

MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED
-0x7680

No CA Chain is set, but required to operate.

MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
-0x7700

An unexpected message was received from our peer.

MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE
-0x7780

A fatal alert message was received from our peer.

MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME
-0x7800

No server could be identified matching the client's SNI.

MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY
-0x7880

The peer notified us that the connection is going to be closed.

MBEDTLS_ERR_SSL_BAD_CERTIFICATE
-0x7A00

Processing of the Certificate handshake message failed.

MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET
-0x7B00

A TLS 1.3 NewSessionTicket message has been received.

MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA
-0x7B80

Not possible to read early data

MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA
-0x7C00

Early data has been received as part of an on-going handshake. This error code can be returned only on server side if and only if early data has been enabled by means of the mbedtls_ssl_conf_early_data() API. This error code can then be returned by mbedtls_ssl_handshake(), mbedtls_ssl_handshake_step(), mbedtls_ssl_read() or mbedtls_ssl_write() if early data has been received as part of the handshake sequence they triggered. To read the early data, call mbedtls_ssl_read_early_data().

MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA
-0x7C80

Not possible to write early data

MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND
-0x7E80

Cache entry not found

MBEDTLS_ERR_SSL_ALLOC_FAILED
-0x7F00

Memory allocation failed

MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
-0x7F80

Hardware acceleration function returned with error

MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH
-0x6F80

Hardware acceleration function skipped / left alone data

MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION
-0x6E80

Handshake protocol not within min/max boundaries

MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE
-0x6E00

The handshake negotiation failed.

MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED
-0x6D80

Session ticket has expired.

MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH
-0x6D00

Public key type mismatch (eg, asked for RSA key exchange and presented EC key)

MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY
-0x6C80

Unknown identity received (eg, PSK identity)

MBEDTLS_ERR_SSL_INTERNAL_ERROR
-0x6C00

Internal error (eg, unexpected failure in lower-level module)

MBEDTLS_ERR_SSL_COUNTER_WRAPPING
-0x6B80

A counter would wrap (eg, too many messages exchanged).

MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO
-0x6B00

Unexpected message at ServerHello in renegotiation.

MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
-0x6A80

DTLS client must retry for hello verification

MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL
-0x6A00

A buffer is too small to receive or write a message

MBEDTLS_ERR_SSL_WANT_READ
-0x6900

No data of requested type currently available on underlying transport.

MBEDTLS_ERR_SSL_WANT_WRITE
-0x6880

Connection requires a write call.

MBEDTLS_ERR_SSL_TIMEOUT
-0x6800

The operation timed out.

MBEDTLS_ERR_SSL_CLIENT_RECONNECT
-0x6780

The client initiated a reconnect from the same port.

MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
-0x6700

Record header looks valid but is not expected.

MBEDTLS_ERR_SSL_NON_FATAL
-0x6680

The alert message received indicates a non-fatal error.

MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER
-0x6600

A field in a message was incorrect or inconsistent with other fields.

MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
-0x6580

Internal-only message signaling that further message-processing should be done

MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS
-0x6500

The asynchronous operation is not completed yet.

MBEDTLS_ERR_SSL_EARLY_MESSAGE
-0x6480

Internal-only message signaling that a message arrived early.

MBEDTLS_ERR_SSL_UNEXPECTED_CID
-0x6000

An encrypted DTLS-frame with an unexpected CID was received.

MBEDTLS_ERR_SSL_VERSION_MISMATCH
-0x5F00

An operation failed due to an unexpected version or configuration.

MBEDTLS_ERR_SSL_BAD_CONFIG
-0x5E80

Invalid value in SSL config

MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
-0x5D80

Attempt to verify a certificate without an expected hostname. This is usually insecure.

In TLS clients, when a client authenticates a server through its certificate, the client normally checks three things:

- the certificate chain must be valid;

- the chain must start from a trusted CA;

- the certificate must cover the server name that is expected by the client.

Omitting any of these checks is generally insecure, and can allow a malicious server to impersonate a legitimate server.

The third check may be safely skipped in some unusual scenarios, such as networks where eavesdropping is a risk but not active attacks, or a private PKI where the client equally trusts all servers that are accredited by the root CA.

You should call mbedtls_ssl_set_hostname() with the expected server name before starting a TLS handshake on a client (unless the client is set up to only use PSK-based authentication, which does not rely on the host name). If you have determined that server name verification is not required for security in your scenario, call mbedtls_ssl_set_hostname() with `NULL` as the server name.

This error is raised if all of the following conditions are met:

- A TLS client is configured with the authentication mode MBEDTLS_SSL_VERIFY_REQUIRED (default).

- Certificate authentication is enabled.

- The client does not call mbedtls_ssl_set_hostname().

- The configuration option #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME is not enabled.

MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE
0 /* Pure PSK-based exchange */
MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE
1 /* PSK+ECDHE-based exchange */
MBEDTLS_SSL_IANA_TLS_GROUP_NONE
0
MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1
0x0012
MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1
0x0013
MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1
0x0014
MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1
0x0015
MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1
0x0016
MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1
0x0017
MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1
0x0018
MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1
0x0019
MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1
0x001A
MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1
0x001B
MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1
0x001C
MBEDTLS_SSL_IANA_TLS_GROUP_X25519
0x001D
MBEDTLS_SSL_IANA_TLS_GROUP_X448
0x001E
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048
0x0100
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072
0x0101
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096
0x0102
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144
0x0103
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192
0x0104
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK
(1u << 0)

Pure-PSK TLS 1.3 key exchange, encompassing both externally agreed PSKs as well as resumption PSKs.

MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL
(1u << 1)

Pure-Ephemeral TLS 1.3 key exchanges, including for example ECDHE and DHE key exchanges.

MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL
(1u << 2)

PSK-Ephemeral TLS 1.3 key exchanges, using both a PSK and an ephemeral key exchange.

MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL
(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK | \ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL | \ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL)

All TLS 1.3 key exchanges

MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL
(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK | \ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)

All PSK-based TLS 1.3 key exchanges

MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL
(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL | \ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)

All ephemeral TLS 1.3 key exchanges

MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE
(0)
MBEDTLS_SSL_MAJOR_VERSION_3
3
MBEDTLS_SSL_MINOR_VERSION_3
3

TLS v1.2

MBEDTLS_SSL_MINOR_VERSION_4
4

TLS v1.3

MBEDTLS_SSL_TRANSPORT_STREAM
0

TLS

MBEDTLS_SSL_TRANSPORT_DATAGRAM
1

DTLS

MBEDTLS_SSL_MAX_HOST_NAME_LEN
255

Maximum host name defined in RFC 1035

MBEDTLS_SSL_MAX_ALPN_NAME_LEN
255

Maximum size in bytes of a protocol name in alpn ext., RFC 7301

MBEDTLS_SSL_MAX_ALPN_LIST_LEN
65535

Maximum size in bytes of list in alpn ext., RFC 7301

MBEDTLS_SSL_MAX_FRAG_LEN_NONE
0

don't use this extension

MBEDTLS_SSL_MAX_FRAG_LEN_512
1

MaxFragmentLength 2^9

MBEDTLS_SSL_MAX_FRAG_LEN_1024
2

MaxFragmentLength 2^10

MBEDTLS_SSL_MAX_FRAG_LEN_2048
3

MaxFragmentLength 2^11

MBEDTLS_SSL_MAX_FRAG_LEN_4096
4

MaxFragmentLength 2^12

MBEDTLS_SSL_MAX_FRAG_LEN_INVALID
5

first invalid value

MBEDTLS_SSL_IS_CLIENT
0
MBEDTLS_SSL_IS_SERVER
1
mbedtls_ssl_session_get_ticket_creation_time
MBEDTLS_SSL_EXTENDED_MS_DISABLED
0
MBEDTLS_SSL_EXTENDED_MS_ENABLED
1
MBEDTLS_SSL_CID_DISABLED
0
MBEDTLS_SSL_CID_ENABLED
1
MBEDTLS_SSL_ETM_DISABLED
0
MBEDTLS_SSL_ETM_ENABLED
1
MBEDTLS_SSL_COMPRESS_NULL
0
MBEDTLS_SSL_VERIFY_NONE
0
MBEDTLS_SSL_VERIFY_OPTIONAL
1
MBEDTLS_SSL_VERIFY_REQUIRED
2
MBEDTLS_SSL_VERIFY_UNSET
3 /* Used only for sni_authmode */
MBEDTLS_SSL_LEGACY_RENEGOTIATION
0
MBEDTLS_SSL_SECURE_RENEGOTIATION
1
MBEDTLS_SSL_RENEGOTIATION_DISABLED
0
MBEDTLS_SSL_RENEGOTIATION_ENABLED
1
MBEDTLS_SSL_ANTI_REPLAY_DISABLED
0
MBEDTLS_SSL_ANTI_REPLAY_ENABLED
1
MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED
-1
MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT
16
MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION
0
MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION
1
MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE
2
MBEDTLS_SSL_TRUNC_HMAC_DISABLED
0
MBEDTLS_SSL_TRUNC_HMAC_ENABLED
1
MBEDTLS_SSL_TRUNCATED_HMAC_LEN
10 /* 80 bits, rfc 6066 section 7 */
MBEDTLS_SSL_SESSION_TICKETS_DISABLED
0
MBEDTLS_SSL_SESSION_TICKETS_ENABLED
1
MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED
0
MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED
1
MBEDTLS_SSL_PRESET_DEFAULT
0
MBEDTLS_SSL_PRESET_SUITEB
2
MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED
1
MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED
0
MBEDTLS_SSL_EARLY_DATA_DISABLED
0
MBEDTLS_SSL_EARLY_DATA_ENABLED
1
MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED
0
MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED
1
MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT
1
MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER
0
MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN
48
MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN
1000
MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX
60000
MBEDTLS_SSL_EARLY_DATA_NO_DISCARD
0
MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD
1
MBEDTLS_SSL_EARLY_DATA_DISCARD
2
MBEDTLS_SSL_VERIFY_DATA_MAX_LEN
12
MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO
0xFF

renegotiation info ext

MBEDTLS_SSL_HASH_NONE
0
MBEDTLS_SSL_HASH_MD5
1
MBEDTLS_SSL_HASH_SHA1
2
MBEDTLS_SSL_HASH_SHA224
3
MBEDTLS_SSL_HASH_SHA256
4
MBEDTLS_SSL_HASH_SHA384
5
MBEDTLS_SSL_HASH_SHA512
6
MBEDTLS_SSL_SIG_ANON
0
MBEDTLS_SSL_SIG_RSA
1
MBEDTLS_SSL_SIG_ECDSA
3
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256
0x0401
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384
0x0501
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512
0x0601
MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256
0x0403
MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384
0x0503
MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512
0x0603
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256
0x0804
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384
0x0805
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512
0x0806
MBEDTLS_TLS1_3_SIG_ED25519
0x0807
MBEDTLS_TLS1_3_SIG_ED448
0x0808
MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256
0x0809
MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384
0x080A
MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512
0x080B
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1
0x0201
MBEDTLS_TLS1_3_SIG_ECDSA_SHA1
0x0203
MBEDTLS_TLS1_3_SIG_NONE
0x0
MBEDTLS_SSL_CERT_TYPE_RSA_SIGN
1
MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN
64
MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
20
MBEDTLS_SSL_MSG_ALERT
21
MBEDTLS_SSL_MSG_HANDSHAKE
22
MBEDTLS_SSL_MSG_APPLICATION_DATA
23
MBEDTLS_SSL_MSG_CID
25
MBEDTLS_SSL_ALERT_LEVEL_WARNING
1
MBEDTLS_SSL_ALERT_LEVEL_FATAL
2
MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY
0 /* 0x00 */
MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE
10 /* 0x0A */
MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC
20 /* 0x14 */
MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED
21 /* 0x15 */
MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW
22 /* 0x16 */
MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE
30 /* 0x1E */
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE
40 /* 0x28 */
MBEDTLS_SSL_ALERT_MSG_NO_CERT
41 /* 0x29 */
MBEDTLS_SSL_ALERT_MSG_BAD_CERT
42 /* 0x2A */
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
43 /* 0x2B */
MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED
44 /* 0x2C */
MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED
45 /* 0x2D */
MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN
46 /* 0x2E */
MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER
47 /* 0x2F */
MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA
48 /* 0x30 */
MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED
49 /* 0x31 */
MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
50 /* 0x32 */
MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR
51 /* 0x33 */
MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION
60 /* 0x3C */
MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION
70 /* 0x46 */
MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY
71 /* 0x47 */
MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR
80 /* 0x50 */
MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK
86 /* 0x56 */
MBEDTLS_SSL_ALERT_MSG_USER_CANCELED
90 /* 0x5A */
MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION
100 /* 0x64 */
MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION
109 /* 0x6d -- new in TLS 1.3 */
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT
110 /* 0x6E */
MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME
112 /* 0x70 */
MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY
115 /* 0x73 */
MBEDTLS_SSL_ALERT_MSG_CERT_REQUIRED
116 /* 0x74 */
MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL
120 /* 0x78 */
MBEDTLS_SSL_HS_HELLO_REQUEST
0
MBEDTLS_SSL_HS_CLIENT_HELLO
1
MBEDTLS_SSL_HS_SERVER_HELLO
2
MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST
3
MBEDTLS_SSL_HS_NEW_SESSION_TICKET
4
MBEDTLS_SSL_HS_END_OF_EARLY_DATA
5
MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS
8
MBEDTLS_SSL_HS_CERTIFICATE
11
MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE
12
MBEDTLS_SSL_HS_CERTIFICATE_REQUEST
13
MBEDTLS_SSL_HS_SERVER_HELLO_DONE
14
MBEDTLS_SSL_HS_CERTIFICATE_VERIFY
15
MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE
16
MBEDTLS_SSL_HS_FINISHED
20
MBEDTLS_SSL_HS_MESSAGE_HASH
254
MBEDTLS_TLS_EXT_SERVERNAME
0
MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME
0
MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH
1
MBEDTLS_TLS_EXT_TRUNCATED_HMAC
4
MBEDTLS_TLS_EXT_STATUS_REQUEST
5 /* RFC 6066 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES
10
MBEDTLS_TLS_EXT_SUPPORTED_GROUPS
10 /* RFC 8422,7919 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS
11
MBEDTLS_TLS_EXT_SIG_ALG
13 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_USE_SRTP
14
MBEDTLS_TLS_EXT_HEARTBEAT
15 /* RFC 6520 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_ALPN
16
MBEDTLS_TLS_EXT_SCT
18 /* RFC 6962 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_CLI_CERT_TYPE
19 /* RFC 7250 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_SERV_CERT_TYPE
20 /* RFC 7250 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_PADDING
21 /* RFC 7685 TLS 1.2 and 1.3 */
MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC
22 /* 0x16 */
MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET
0x0017 /* 23 */
MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT
28 /* RFC 8449 (implemented for TLS 1.3 only) */
MBEDTLS_TLS_EXT_SESSION_TICKET
35
MBEDTLS_TLS_EXT_PRE_SHARED_KEY
41 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_EARLY_DATA
42 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS
43 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_COOKIE
44 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES
45 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_CERT_AUTH
47 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_OID_FILTERS
48 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH
49 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_SIG_ALG_CERT
50 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_KEY_SHARE
51 /* RFC 8446 TLS 1.3 */
MBEDTLS_TLS_EXT_CID
54 /* RFC 9146 DTLS 1.2 CID */
MBEDTLS_TLS_EXT_ECJPAKE_KKPP
256 /* experimental */
MBEDTLS_TLS_EXT_RENEGOTIATION_INFO
0xFF01
MBEDTLS_PSK_MAX_LEN
48 /* 384 bits */
MBEDTLS_PREMASTER_SIZE
sizeof(union mbedtls_ssl_premaster_secret)
MBEDTLS_TLS1_3_MD_MAX_SIZE
PSA_HASH_MAX_SIZE
MBEDTLS_SSL_SEQUENCE_NUMBER_LEN
8
MBEDTLS_SSL_KEEP_RANDBYTES
MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK
/* 1U << 0 */
MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL
/* 1U << 2 */
MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA
(1U << 3)
MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK
(MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION | \ MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION | \ MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA)
MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH
255
MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH
4
MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80
((uint16_t) 0x0001)
mbedtls_ssl_get_srtp_profile_as_string
MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32
((uint16_t) 0x0002)
mbedtls_ssl_get_srtp_profile_as_string
MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80
((uint16_t) 0x0005)
mbedtls_ssl_get_srtp_profile_as_string
MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32
((uint16_t) 0x0006)
mbedtls_ssl_get_srtp_profile_as_string
MBEDTLS_TLS_SRTP_UNSET
((uint16_t) 0x0000)
MBEDTLS_SSL_UNEXPECTED_CID_IGNORE
0
MBEDTLS_SSL_UNEXPECTED_CID_FAIL
1
MBEDTLS_SSL_EXPORT_MAX_KEY_LEN
8160
mbedtls_ssl_states
MBEDTLS_SSL_HELLO_REQUEST
MBEDTLS_SSL_CLIENT_HELLO
MBEDTLS_SSL_SERVER_HELLO
MBEDTLS_SSL_SERVER_CERTIFICATE
MBEDTLS_SSL_SERVER_KEY_EXCHANGE
MBEDTLS_SSL_CERTIFICATE_REQUEST
MBEDTLS_SSL_SERVER_HELLO_DONE
MBEDTLS_SSL_CLIENT_CERTIFICATE
MBEDTLS_SSL_CLIENT_KEY_EXCHANGE
MBEDTLS_SSL_CERTIFICATE_VERIFY
MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC
MBEDTLS_SSL_CLIENT_FINISHED
MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC
MBEDTLS_SSL_SERVER_FINISHED
MBEDTLS_SSL_FLUSH_BUFFERS
MBEDTLS_SSL_HANDSHAKE_WRAPUP
MBEDTLS_SSL_NEW_SESSION_TICKET
MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT
MBEDTLS_SSL_HELLO_RETRY_REQUEST
MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
MBEDTLS_SSL_END_OF_EARLY_DATA
MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY
MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED
MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO
MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO
MBEDTLS_SSL_CLIENT_CCS_AFTER_CLIENT_HELLO
MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST
MBEDTLS_SSL_HANDSHAKE_OVER
MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH
mbedtls_ssl_protocol_version
MBEDTLS_SSL_VERSION_UNKNOWN

Context not in use or version not yet negotiated.

MBEDTLS_SSL_VERSION_TLS1_2
= 0x0303

(D)TLS 1.2

MBEDTLS_SSL_VERSION_TLS1_3
= 0x0304

(D)TLS 1.3

Human-friendly representation of the (D)TLS protocol version.

mbedtls_tls_prf_types
MBEDTLS_SSL_TLS_PRF_NONE
MBEDTLS_SSL_TLS_PRF_SHA384
MBEDTLS_SSL_TLS_PRF_SHA256
MBEDTLS_SSL_HKDF_EXPAND_SHA384
MBEDTLS_SSL_HKDF_EXPAND_SHA256
mbedtls_ssl_key_export_type
MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET
= 0
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_EARLY_EXPORTER_SECRET
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET
int typedef int mbedtls_ssl_send_t(void *ctx, const unsigned char *buf, size_t len) (void *ctx, const unsigned char *buf, size_t len) mbedtls_ssl_send_t

Callback type: send data on the network.

That callback may be either blocking or non-blocking.

ctx

Context for the send callback (typically a file descriptor)

buf

Buffer holding the data to send

len

Length of the data to send

The callback must return the number of bytes sent if any, or a non-zero error code. If performing non-blocking I/O, `MBEDTLS_ERR_SSL_WANT_WRITE` must be returned when the operation would block.

The callback is allowed to send fewer bytes than requested. It must always return the number of bytes actually sent.

int typedef int mbedtls_ssl_recv_t(void *ctx, unsigned char *buf, size_t len) (void *ctx, unsigned char *buf, size_t len) mbedtls_ssl_recv_t

Callback type: receive data from the network.

That callback may be either blocking or non-blocking.

ctx

Context for the receive callback (typically a file descriptor)

buf

Buffer to write the received data to

len

Length of the receive buffer

If data has been received, the positive number of bytes received.

`0` if the connection has been closed.

If performing non-blocking I/O, `MBEDTLS_ERR_SSL_WANT_READ` must be returned when the operation would block.

Another negative error code on other kinds of failures.

The callback may receive fewer bytes than the length of the buffer. It must always return the number of bytes actually received and written to the buffer.

int typedef int mbedtls_ssl_recv_timeout_t(void *ctx, unsigned char *buf, size_t len, uint32_t timeout) (void *ctx, unsigned char *buf, size_t len, uint32_t timeout) mbedtls_ssl_recv_timeout_t

Callback type: receive data from the network, with timeout.

That callback must block until data is received, or the timeout delay expires, or the operation is interrupted by a signal.

ctx

Context for the receive callback (typically a file descriptor)

buf

Buffer to write the received data to

len

Length of the receive buffer

timeout

Maximum number of milliseconds to wait for data 0 means no timeout (potentially waiting forever)

The callback must return the number of bytes received, or a non-zero error code: `MBEDTLS_ERR_SSL_TIMEOUT` if the operation timed out, `MBEDTLS_ERR_SSL_WANT_READ` if interrupted by a signal.

The callback may receive fewer bytes than the length of the buffer. It must always return the number of bytes actually received and written to the buffer.

void typedef void mbedtls_ssl_set_timer_t(void *ctx, uint32_t int_ms, uint32_t fin_ms) (void *ctx, uint32_t int_ms, uint32_t fin_ms) mbedtls_ssl_set_timer_t

Callback type: set a pair of timers/delays to watch.

ctx

Context pointer

int_ms

Intermediate delay in milliseconds

fin_ms

Final delay in milliseconds 0 cancels the current timer.

This callback must at least store the necessary information for the associated `mbedtls_ssl_get_timer_t` callback to return correct information.

If using an event-driven style of programming, an event must be generated when the final delay is passed. The event must cause a call to `mbedtls_ssl_handshake()` with the proper SSL context to be scheduled. Care must be taken to ensure that at most one such call happens at a time.

Only one timer at a time must be running. Calling this function while a timer is running must cancel it. Cancelled timers must not generate any event.

int typedef int mbedtls_ssl_get_timer_t(void *ctx) (void *ctx) mbedtls_ssl_get_timer_t

Callback type: get status of timers/delays.

ctx

Context pointer

This callback must return: -1 if cancelled (fin_ms == 0), 0 if none of the delays have passed, 1 if only the intermediate delay has passed, 2 if the final delay has passed.

struct mbedtls_ssl_session typedef struct mbedtls_ssl_session mbedtls_ssl_session mbedtls_ssl_session
struct mbedtls_ssl_context typedef struct mbedtls_ssl_context mbedtls_ssl_context mbedtls_ssl_context
struct mbedtls_ssl_config typedef struct mbedtls_ssl_config mbedtls_ssl_config mbedtls_ssl_config
struct mbedtls_ssl_transform typedef struct mbedtls_ssl_transform mbedtls_ssl_transform mbedtls_ssl_transform
struct mbedtls_ssl_handshake_params typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params
struct mbedtls_ssl_sig_hash_set_t typedef struct mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t
struct mbedtls_ssl_key_cert typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert mbedtls_ssl_key_cert
struct mbedtls_ssl_flight_item typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item mbedtls_ssl_flight_item
int typedef int mbedtls_ssl_cache_get_t(void *data, unsigned char const *session_id, size_t session_id_len, mbedtls_ssl_session *session) (void *data, unsigned char const *session_id, size_t session_id_len, mbedtls_ssl_session *session) mbedtls_ssl_cache_get_t

Callback type: server-side session cache getter.

The session cache is logically a key value store, with keys being session IDs and values being instances of mbedtls_ssl_session. This callback retrieves an entry in this key-value store.

data

The address of the session cache structure to query.

session_id

The buffer holding the session ID to query.

session_id_len

The length of `session_id` in Bytes.

session

The address of the session structure to populate. It is initialized with mbdtls_ssl_session_init(), and the callback must always leave it in a state where it can safely be freed via mbedtls_ssl_session_free() independent of the return code of this function.

`0` on success

A non-zero return value on failure.

int typedef int mbedtls_ssl_cache_set_t(void *data, unsigned char const *session_id, size_t session_id_len, const mbedtls_ssl_session *session) (void *data, unsigned char const *session_id, size_t session_id_len, const mbedtls_ssl_session *session) mbedtls_ssl_cache_set_t

Callback type: server-side session cache setter.

The session cache is logically a key value store, with keys being session IDs and values being instances of mbedtls_ssl_session. This callback sets an entry in this key-value store.

data

The address of the session cache structure to modify.

session_id

The buffer holding the session ID to query.

session_id_len

The length of `session_id` in Bytes.

session

The address of the session to be stored in the session cache.

`0` on success

A non-zero return value on failure.

uint16_t typedef uint16_t mbedtls_ssl_srtp_profile mbedtls_ssl_srtp_profile
struct mbedtls_dtls_srtp_info_t typedef struct mbedtls_dtls_srtp_info_t mbedtls_dtls_srtp_info mbedtls_dtls_srtp_info
void typedef void mbedtls_ssl_export_keys_t(void *p_expkey, mbedtls_ssl_key_export_type type, const unsigned char *secret, size_t secret_len, const unsigned char client_random[32], const unsigned char server_random[32], mbedtls_tls_prf_types tls_prf_type) (void *p_expkey, mbedtls_ssl_key_export_type type, const unsigned char *secret, size_t secret_len, const unsigned char client_random[32], const unsigned char server_random[32], mbedtls_tls_prf_types tls_prf_type) mbedtls_ssl_export_keys_t

Callback type: Export key alongside random values for session identification, and PRF for implementation of TLS key exporters.

p_expkey

Context for the callback.

type

The type of the key that is being exported.

secret

The address of the buffer holding the secret that's being exporterd.

secret_len

The length of `secret` in bytes.

client_random

The client random bytes.

server_random

The server random bytes.

tls_prf_type

The identifier for the PRF used in the handshake to which the key belongs.

int(* typedef int(* mbedtls_ssl_hs_cb_t) (mbedtls_ssl_context *ssl) )(mbedtls_ssl_context *ssl) mbedtls_ssl_hs_cb_t

Callback type: generic handshake callback.

Callbacks may use user_data funcs to set/get app user data. See `mbedtls_ssl_get_user_data_p()` `mbedtls_ssl_get_user_data_n()` `mbedtls_ssl_conf_get_user_data_p()` `mbedtls_ssl_conf_get_user_data_n()`

ssl

`mbedtls_ssl_context` on which the callback is run

The return value of the callback is 0 if successful, or a specific MBEDTLS_ERR_XXX code, which will cause the handshake to be aborted.

int typedef int mbedtls_ssl_ticket_write_t(void *p_ticket, const mbedtls_ssl_session *session, unsigned char *start, const unsigned char *end, size_t *tlen, uint32_t *lifetime) (void *p_ticket, const mbedtls_ssl_session *session, unsigned char *start, const unsigned char *end, size_t *tlen, uint32_t *lifetime) mbedtls_ssl_ticket_write_t

Callback type: generate and write session ticket.

This describes what a callback implementation should do. This callback should generate an encrypted and authenticated ticket for the session and write it to the output buffer. Here, ticket means the opaque ticket part of the NewSessionTicket structure of RFC 5077.

p_ticket

Context for the callback

session

SSL session to be written in the ticket

start

Start of the output buffer

end

End of the output buffer

tlen

On exit, holds the length written

lifetime

On exit, holds the lifetime of the ticket in seconds

0 if successful, or a specific MBEDTLS_ERR_XXX code.

int typedef int mbedtls_ssl_ticket_parse_t(void *p_ticket, mbedtls_ssl_session *session, unsigned char *buf, size_t len) (void *p_ticket, mbedtls_ssl_session *session, unsigned char *buf, size_t len) mbedtls_ssl_ticket_parse_t

Callback type: parse and load session ticket.

This describes what a callback implementation should do. This callback should parse a session ticket as generated by the corresponding mbedtls_ssl_ticket_write_t function, and, if the ticket is authentic and valid, load the session.

The implementation is allowed to modify the first len bytes of the input buffer, eg to use it as a temporary area for the decrypted ticket contents.

p_ticket

Context for the callback

session

SSL session to be loaded

buf

Start of the buffer containing the ticket

len

Length of the ticket.

0 if successful, or MBEDTLS_ERR_SSL_INVALID_MAC if not authentic, or MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED if expired, or any other non-zero code for other failures.

int typedef int mbedtls_ssl_cookie_write_t(void *ctx, unsigned char **p, unsigned char *end, const unsigned char *info, size_t ilen) (void *ctx, unsigned char **p, unsigned char *end, const unsigned char *info, size_t ilen) mbedtls_ssl_cookie_write_t

Callback type: generate a cookie.

ctx

Context for the callback

p

Buffer to write to, must be updated to point right after the cookie

end

Pointer to one past the end of the output buffer

info

Client ID info that was passed to `mbedtls_ssl_set_client_transport_id()`

ilen

Length of info in bytes

The callback must return 0 on success, or a negative error code.

int typedef int mbedtls_ssl_cookie_check_t(void *ctx, const unsigned char *cookie, size_t clen, const unsigned char *info, size_t ilen) (void *ctx, const unsigned char *cookie, size_t clen, const unsigned char *info, size_t ilen) mbedtls_ssl_cookie_check_t

Callback type: verify a cookie.

ctx

Context for the callback

cookie

Cookie to verify

clen

Length of cookie

info

Client ID info that was passed to `mbedtls_ssl_set_client_transport_id()`

ilen

Length of info in bytes

The callback must return 0 if cookie is valid, or a negative error code.

const char * const char * mbedtls_ssl_get_ciphersuite_name (const int ciphersuite_id) mbedtls_ssl_get_ciphersuite_name const int ciphersuite_id

Return the name of the ciphersuite associated with the given ID.

ciphersuite_id

SSL ciphersuite ID

a string containing the ciphersuite name

int int mbedtls_ssl_get_ciphersuite_id (const char *ciphersuite_name) mbedtls_ssl_get_ciphersuite_id const char * ciphersuite_name

Return the ID of the ciphersuite associated with the given name.

ciphersuite_name

SSL ciphersuite name

the ID with the ciphersuite or 0 if not found

void void mbedtls_ssl_init (mbedtls_ssl_context *ssl) mbedtls_ssl_init mbedtls_ssl_context * ssl

Initialize an SSL context Just makes the context ready for mbedtls_ssl_setup() or mbedtls_ssl_free().

ssl

SSL context

int int mbedtls_ssl_setup (mbedtls_ssl_context *ssl, const mbedtls_ssl_config *conf) mbedtls_ssl_setup mbedtls_ssl_context * ssl const mbedtls_ssl_config * conf

Set up an SSL context for use.

No copy of the configuration context is made, it can be shared by many mbedtls_ssl_context structures.

The conf structure will be accessed during the session. It must not be modified or freed as long as the session is active.

This function must be called exactly once per context. Calling mbedtls_ssl_setup again is not supported, even if no session is active.

After setting up a client context, if certificate-based authentication is enabled, you should call mbedtls_ssl_set_hostname() to specifiy the expected name of the server. Without this, in most scenarios, the TLS connection is insecure. See MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME for more information.

If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto subsystem must have been initialized by calling psa_crypto_init() before calling this function.

ssl

SSL context

conf

SSL configuration to use

0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed

int int mbedtls_ssl_session_reset (mbedtls_ssl_context *ssl) mbedtls_ssl_session_reset mbedtls_ssl_context * ssl

Reset an already initialized SSL context for re-use while retaining application-set variables, function pointers and data.

ssl

SSL context

0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED or MBEDTLS_ERR_SSL_HW_ACCEL_FAILED

void void mbedtls_ssl_conf_endpoint (mbedtls_ssl_config *conf, int endpoint) mbedtls_ssl_conf_endpoint mbedtls_ssl_config * conf int endpoint

Set the current endpoint type.

conf

SSL configuration

endpoint

must be MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER

int static int mbedtls_ssl_conf_get_endpoint (const mbedtls_ssl_config *conf) mbedtls_ssl_conf_get_endpoint const mbedtls_ssl_config * conf

Get the current endpoint type.

conf

SSL configuration

Endpoint type, either MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER

void void mbedtls_ssl_conf_transport (mbedtls_ssl_config *conf, int transport) mbedtls_ssl_conf_transport mbedtls_ssl_config * conf int transport

Set the transport type (TLS or DTLS). Default: TLS.

For DTLS, you must either provide a recv callback that doesn't block, or one that handles timeouts, see `mbedtls_ssl_set_bio()`. You also need to provide timer callbacks with `mbedtls_ssl_set_timer_cb()`.

conf

SSL configuration

transport

transport type: MBEDTLS_SSL_TRANSPORT_STREAM for TLS, MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS.

void void mbedtls_ssl_conf_authmode (mbedtls_ssl_config *conf, int authmode) mbedtls_ssl_conf_authmode mbedtls_ssl_config * conf int authmode

Set the certificate verification mode Default: NONE on server, REQUIRED on client.

conf

SSL configuration

authmode

can be:

MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked (default on server) (insecure on client)

MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the handshake continues even if verification failed; mbedtls_ssl_get_verify_result() can be called after the handshake is complete.

MBEDTLS_SSL_VERIFY_REQUIRED: peer must present a valid certificate, handshake is aborted if verification failed. (default on client)

On client, MBEDTLS_SSL_VERIFY_REQUIRED is the recommended mode. With MBEDTLS_SSL_VERIFY_OPTIONAL, the user needs to call mbedtls_ssl_get_verify_result() at the right time(s), which may not be obvious, while REQUIRED always perform the verification as soon as possible. For example, REQUIRED was protecting against the "triple handshake" attack even before it was found.

void void mbedtls_ssl_conf_verify (mbedtls_ssl_config *conf, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy) mbedtls_ssl_conf_verify mbedtls_ssl_config * conf int(*)(void *, mbedtls_x509_crt *, int, uint32_t *) f_vrfy void * p_vrfy

Set the verification callback (Optional).

If set, the provided verify callback is called for each certificate in the peer's CRT chain, including the trusted root. For more information, please see the documentation of \c mbedtls_x509_crt_verify().

For per context callbacks and contexts, please use mbedtls_ssl_set_verify() instead.

conf

The SSL configuration to use.

f_vrfy

The verification callback to use during CRT verification.

p_vrfy

The opaque context to be passed to the callback.

void void mbedtls_ssl_conf_rng (mbedtls_ssl_config *conf, mbedtls_f_rng_t *f_rng, void *p_rng) mbedtls_ssl_conf_rng mbedtls_ssl_config * conf mbedtls_f_rng_t * f_rng void * p_rng

Set the random number generator callback.

The callback with its parameter must remain valid as long as there is an SSL context that uses the SSL configuration.

conf

SSL configuration

f_rng

RNG function (mandatory)

p_rng

RNG parameter

void void mbedtls_ssl_conf_dbg (mbedtls_ssl_config *conf, void(*f_dbg)(void *, int, const char *, int, const char *), void *p_dbg) mbedtls_ssl_conf_dbg mbedtls_ssl_config * conf void(*)(void *, int, const char *, int, const char *) f_dbg void * p_dbg

Set the debug callback.

The callback has the following argument: void * opaque context for the callback int debug level const char * file name int line number const char * message

conf

SSL configuration

f_dbg

debug function

p_dbg

debug parameter

const mbedtls_ssl_config * static const mbedtls_ssl_config * mbedtls_ssl_context_get_config (const mbedtls_ssl_context *ssl) mbedtls_ssl_context_get_config const mbedtls_ssl_context * ssl

Return the SSL configuration structure associated with the given SSL context.

The pointer returned by this function is guaranteed to remain valid until the context is freed.

ssl

The SSL context to query.

Pointer to the SSL configuration associated with `ssl`.

void void mbedtls_ssl_set_bio (mbedtls_ssl_context *ssl, void *p_bio, mbedtls_ssl_send_t *f_send, mbedtls_ssl_recv_t *f_recv, mbedtls_ssl_recv_timeout_t *f_recv_timeout) mbedtls_ssl_set_bio mbedtls_ssl_context * ssl void * p_bio mbedtls_ssl_send_t * f_send mbedtls_ssl_recv_t * f_recv mbedtls_ssl_recv_timeout_t * f_recv_timeout

Set the underlying BIO callbacks for write, read and read-with-timeout.

ssl

SSL context

p_bio

parameter (context) shared by BIO callbacks

f_send

write callback

f_recv

read callback

f_recv_timeout

blocking read callback with timeout.

One of f_recv or f_recv_timeout can be NULL, in which case the other is used. If both are non-NULL, f_recv_timeout is used and f_recv is ignored (as if it were NULL).

The two most common use cases are:

- non-blocking I/O, f_recv != NULL, f_recv_timeout == NULL

- blocking I/O, f_recv == NULL, f_recv_timeout != NULL

For DTLS, you need to provide either a non-NULL f_recv_timeout callback, or a f_recv that doesn't block.

See the documentations of `mbedtls_ssl_send_t`, `mbedtls_ssl_recv_t` and `mbedtls_ssl_recv_timeout_t` for the conventions those callbacks must follow.

On some platforms, net_sockets.c provides `mbedtls_net_send()`, `mbedtls_net_recv()` and `mbedtls_net_recv_timeout()` that are suitable to be used here.

int int mbedtls_ssl_set_cid (mbedtls_ssl_context *ssl, int enable, unsigned char const *own_cid, size_t own_cid_len) mbedtls_ssl_set_cid mbedtls_ssl_context * ssl int enable unsigned char const * own_cid size_t own_cid_len

Configure the use of the Connection ID (CID) extension in the next handshake.

Reference: RFC 9146 (or draft-ietf-tls-dtls-connection-id-05 https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05 for legacy version)

The DTLS CID extension allows the reliable association of DTLS records to DTLS connections across changes in the underlying transport (changed IP and Port metadata) by adding explicit connection identifiers (CIDs) to the headers of encrypted DTLS records. The desired CIDs are configured by the application layer and are exchanged in new `ClientHello` / `ServerHello` extensions during the handshake, where each side indicates the CID it wants the peer to use when writing encrypted messages. The CIDs are put to use once records get encrypted: the stack discards any incoming records that don't include the configured CID in their header, and adds the peer's requested CID to the headers of outgoing messages.

This API enables or disables the use of the CID extension in the next handshake and sets the value of the CID to be used for incoming messages.

ssl

The SSL context to configure. This must be initialized.

enable

This value determines whether the CID extension should be used or not. Possible values are:

- MBEDTLS_SSL_CID_ENABLED to enable the use of the CID.

- MBEDTLS_SSL_CID_DISABLED (default) to disable the use of the CID.

own_cid

The address of the readable buffer holding the CID we want the peer to use when sending encrypted messages to us. This may be `NULL` if `own_cid_len` is `0`. This parameter is unused if `enable` is set to MBEDTLS_SSL_CID_DISABLED.

own_cid_len

The length of `own_cid`. This parameter is unused if `enable` is set to MBEDTLS_SSL_CID_DISABLED.

The value of `own_cid_len` must match the value of the `len` parameter passed to mbedtls_ssl_conf_cid() when configuring the mbedtls_ssl_config that `ssl` is bound to.

This CID configuration applies to subsequent handshakes performed on the SSL context `ssl`, but does not trigger one. You still have to call `mbedtls_ssl_handshake()` (for the initial handshake) or `mbedtls_ssl_renegotiate()` (for a renegotiation handshake) explicitly after a successful call to this function to run the handshake.

This call cannot guarantee that the use of the CID will be successfully negotiated in the next handshake, because the peer might not support it. Specifically:

- On the Client, enabling the use of the CID through this call implies that the `ClientHello` in the next handshake will include the CID extension, thereby offering the use of the CID to the server. Only if the `ServerHello` contains the CID extension, too, the CID extension will actually be put to use.

- On the Server, enabling the use of the CID through this call implies that the server will look for the CID extension in a `ClientHello` from the client, and, if present, reply with a CID extension in its `ServerHello`.

To check whether the use of the CID was negotiated after the subsequent handshake has completed, please use the API mbedtls_ssl_get_peer_cid().

If the use of the CID extension is enabled in this call and the subsequent handshake negotiates its use, Mbed TLS will silently drop every packet whose CID does not match the CID configured in `own_cid`. It is the responsibility of the user to adapt the underlying transport to take care of CID-based demultiplexing before handing datagrams to Mbed TLS.

`0` on success. In this case, the CID configuration applies to the next handshake.

A negative error code on failure.

int int mbedtls_ssl_get_own_cid (mbedtls_ssl_context *ssl, int *enabled, unsigned char own_cid[MBEDTLS_SSL_CID_IN_LEN_MAX], size_t *own_cid_len) mbedtls_ssl_get_own_cid mbedtls_ssl_context * ssl int * enabled unsigned char own_cid [MBEDTLS_SSL_CID_IN_LEN_MAX] size_t * own_cid_len

Get information about our request for usage of the CID extension in the current connection.

ssl

The SSL context to query.

enabled

The address at which to store whether the CID extension is requested to be used or not. If the CID is requested, `*enabled` is set to MBEDTLS_SSL_CID_ENABLED; otherwise, it is set to MBEDTLS_SSL_CID_DISABLED.

own_cid

The address of the buffer in which to store our own CID (if the CID extension is requested). This may be `NULL` in case the value of our CID isn't needed. If it is not `NULL`, `own_cid_len` must not be `NULL`.

own_cid_len

The address at which to store the size of our own CID (if the CID extension is requested). This is also the number of Bytes in `own_cid` that have been written. This may be `NULL` in case the length of our own CID isn't needed. If it is `NULL`, `own_cid` must be `NULL`, too.

If we are requesting an empty CID this function sets `*enabled` to MBEDTLS_SSL_CID_DISABLED (the rationale for this is that the resulting outcome is the same as if the CID extensions wasn't requested).

`0` on success.

A negative error code on failure.

MBEDTLS_SSL_CID_IN_LEN_MAX
int int mbedtls_ssl_get_peer_cid (mbedtls_ssl_context *ssl, int *enabled, unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX], size_t *peer_cid_len) mbedtls_ssl_get_peer_cid mbedtls_ssl_context * ssl int * enabled unsigned char peer_cid [MBEDTLS_SSL_CID_OUT_LEN_MAX] size_t * peer_cid_len

Get information about the use of the CID extension in the current connection.

ssl

The SSL context to query.

enabled

The address at which to store whether the CID extension is currently in use or not. If the CID is in use, `*enabled` is set to MBEDTLS_SSL_CID_ENABLED; otherwise, it is set to MBEDTLS_SSL_CID_DISABLED.

peer_cid

The address of the buffer in which to store the CID chosen by the peer (if the CID extension is used). This may be `NULL` in case the value of peer CID isn't needed. If it is not `NULL`, `peer_cid_len` must not be `NULL`.

peer_cid_len

The address at which to store the size of the CID chosen by the peer (if the CID extension is used). This is also the number of Bytes in `peer_cid` that have been written. This may be `NULL` in case the length of the peer CID isn't needed. If it is `NULL`, `peer_cid` must be `NULL`, too.

This applies to the state of the CID negotiated in the last complete handshake. If a handshake is in progress, this function will attempt to complete the handshake first.

If CID extensions have been exchanged but both client and server chose to use an empty CID, this function sets `*enabled` to MBEDTLS_SSL_CID_DISABLED (the rationale for this is that the resulting communication is the same as if the CID extensions hadn't been used).

`0` on success.

A negative error code on failure.

MBEDTLS_SSL_CID_OUT_LEN_MAX
void void mbedtls_ssl_set_mtu (mbedtls_ssl_context *ssl, uint16_t mtu) mbedtls_ssl_set_mtu mbedtls_ssl_context * ssl uint16_t mtu

Set the Maximum Transport Unit (MTU). Special value: 0 means unset (no limit). This represents the maximum size of a datagram payload handled by the transport layer (usually UDP) as determined by the network link and stack. In practice, this controls the maximum size datagram the DTLS layer will pass to the `f_send()` callback set using `mbedtls_ssl_set_bio()`.

The limit on datagram size is converted to a limit on record payload by subtracting the current overhead of encapsulation and encryption/authentication if any.

This can be called at any point during the connection, for example when a Path Maximum Transfer Unit (PMTU) estimate becomes available from other sources, such as lower (or higher) protocol layers.

This setting only controls the size of the packets we send, and does not restrict the size of the datagrams we're willing to receive. Client-side, you can request the server to use smaller records with `mbedtls_ssl_conf_max_frag_len()`.

If both a MTU and a maximum fragment length have been configured (or negotiated with the peer), the resulting lower limit on record payload (see first note) is used.

This can only be used to decrease the maximum size of datagrams (hence records, see first note) sent. It cannot be used to increase the maximum size of records over the limit set by MBEDTLS_SSL_OUT_CONTENT_LEN.

Values lower than the current record layer expansion will result in an error when trying to send data.

ssl

SSL context

mtu

Value of the path MTU in bytes

void void mbedtls_ssl_set_verify (mbedtls_ssl_context *ssl, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy) mbedtls_ssl_set_verify mbedtls_ssl_context * ssl int(*)(void *, mbedtls_x509_crt *, int, uint32_t *) f_vrfy void * p_vrfy

Set a connection-specific verification callback (optional).

If set, the provided verify callback is called for each certificate in the peer's CRT chain, including the trusted root. For more information, please see the documentation of \c mbedtls_x509_crt_verify().

This call is analogous to mbedtls_ssl_conf_verify() but binds the verification callback and context to an SSL context as opposed to an SSL configuration. If mbedtls_ssl_conf_verify() and mbedtls_ssl_set_verify() are both used, mbedtls_ssl_set_verify() takes precedence.

ssl

The SSL context to use.

f_vrfy

The verification callback to use during CRT verification.

p_vrfy

The opaque context to be passed to the callback.

void void mbedtls_ssl_conf_read_timeout (mbedtls_ssl_config *conf, uint32_t timeout) mbedtls_ssl_conf_read_timeout mbedtls_ssl_config * conf uint32_t timeout

Set the timeout period for mbedtls_ssl_read() (Default: no timeout.).

conf

SSL configuration context

timeout

Timeout value in milliseconds. Use 0 for no timeout (default).

With blocking I/O, this will only work if a non-NULL `f_recv_timeout` was set with `mbedtls_ssl_set_bio()`. With non-blocking I/O, this will only work if timer callbacks were set with `mbedtls_ssl_set_timer_cb()`.

With non-blocking I/O, you may also skip this function altogether and handle timeouts at the application layer.

int int mbedtls_ssl_check_record (mbedtls_ssl_context const *ssl, unsigned char *buf, size_t buflen) mbedtls_ssl_check_record mbedtls_ssl_context const * ssl unsigned char * buf size_t buflen

Check whether a buffer contains a valid and authentic record that has not been seen before. (DTLS only).

This function does not change the user-visible state of the SSL context. Its sole purpose is to provide an indication of the legitimacy of an incoming record.

This can be useful e.g. in distributed server environments using the DTLS Connection ID feature, in which connections might need to be passed between service instances on a change of peer address, but where such disruptive operations should only happen after the validity of incoming records has been confirmed.

ssl

The SSL context to use.

buf

The address of the buffer holding the record to be checked. This must be a read/write buffer of length `buflen` Bytes.

buflen

The length of `buf` in Bytes.

This routine only checks whether the provided buffer begins with a valid and authentic record that has not been seen before, but does not check potential data following the initial record. In particular, it is possible to pass DTLS datagrams containing multiple records, in which case only the first record is checked.

This function modifies the input buffer `buf`. If you need to preserve the original record, you have to maintain a copy.

`0` if the record is valid and authentic and has not been seen before.

MBEDTLS_ERR_SSL_INVALID_MAC if the check completed successfully but the record was found to be not authentic.

MBEDTLS_ERR_SSL_INVALID_RECORD if the check completed successfully but the record was found to be invalid for a reason different from authenticity checking.

MBEDTLS_ERR_SSL_UNEXPECTED_RECORD if the check completed successfully but the record was found to be unexpected in the state of the SSL context, including replayed records.

Another negative error code on different kinds of failure. In this case, the SSL context becomes unusable and needs to be freed or reset before reuse.

void void mbedtls_ssl_set_timer_cb (mbedtls_ssl_context *ssl, void *p_timer, mbedtls_ssl_set_timer_t *f_set_timer, mbedtls_ssl_get_timer_t *f_get_timer) mbedtls_ssl_set_timer_cb mbedtls_ssl_context * ssl void * p_timer mbedtls_ssl_set_timer_t * f_set_timer mbedtls_ssl_get_timer_t * f_get_timer

Set the timer callbacks (Mandatory for DTLS.).

ssl

SSL context

p_timer

parameter (context) shared by timer callbacks

f_set_timer

set timer callback

f_get_timer

get timer callback. Must return:

See the documentation of `mbedtls_ssl_set_timer_t` and `mbedtls_ssl_get_timer_t` for the conventions this pair of callbacks must follow.

On some platforms, timing.c provides `mbedtls_timing_set_delay()` and `mbedtls_timing_get_delay()` that are suitable for using here, except if using an event-driven style.

See also the "DTLS tutorial" article in our knowledge base. https://mbed-tls.readthedocs.io/en/latest/kb/how-to/dtls-tutorial

void static void mbedtls_ssl_conf_cert_cb (mbedtls_ssl_config *conf, mbedtls_ssl_hs_cb_t f_cert_cb) mbedtls_ssl_conf_cert_cb mbedtls_ssl_config * conf mbedtls_ssl_hs_cb_t f_cert_cb

Set the certificate selection callback (server-side only).

If set, the callback is always called for each handshake, after `ClientHello` processing has finished.

conf

The SSL configuration to register the callback with.

f_cert_cb

The callback for selecting server certificate after `ClientHello` processing has finished.

void void mbedtls_ssl_conf_session_tickets_cb (mbedtls_ssl_config *conf, mbedtls_ssl_ticket_write_t *f_ticket_write, mbedtls_ssl_ticket_parse_t *f_ticket_parse, void *p_ticket) mbedtls_ssl_conf_session_tickets_cb mbedtls_ssl_config * conf mbedtls_ssl_ticket_write_t * f_ticket_write mbedtls_ssl_ticket_parse_t * f_ticket_parse void * p_ticket

Configure SSL session ticket callbacks (server only). (Default: none.).

On server, session tickets are enabled by providing non-NULL callbacks.

On client, use `mbedtls_ssl_conf_session_tickets()`.

conf

SSL configuration context

f_ticket_write

Callback for writing a ticket

f_ticket_parse

Callback for parsing a ticket

p_ticket

Context shared by the two callbacks

int static int mbedtls_ssl_session_get_ticket_creation_time (mbedtls_ssl_session *session, mbedtls_ms_time_t *ticket_creation_time) mbedtls_ssl_session_get_ticket_creation_time mbedtls_ssl_session * session mbedtls_ms_time_t * ticket_creation_time

Get the creation time of a session ticket.

See the documentation of `ticket_creation_time` for information about the intended usage of this function.

session

SSL session

ticket_creation_time

On exit, holds the ticket creation time in milliseconds.

0 on success, MBEDTLS_ERR_SSL_BAD_INPUT_DATA if an input is not valid.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA
MBEDTLS_SSL_IS_SERVER
unsigned const char(* static unsigned const char(* mbedtls_ssl_session_get_id (const mbedtls_ssl_session *session))[32] mbedtls_ssl_session_get_id const mbedtls_ssl_session * session

Get the session-id buffer.

session

SSL session.

The address of the session-id buffer.

size_t static size_t mbedtls_ssl_session_get_id_len (const mbedtls_ssl_session *session) mbedtls_ssl_session_get_id_len const mbedtls_ssl_session * session

Get the size of the session-id.

session

SSL session.

size_t size of session-id buffer.

int static int mbedtls_ssl_session_get_ciphersuite_id (const mbedtls_ssl_session *session) mbedtls_ssl_session_get_ciphersuite_id const mbedtls_ssl_session * session

Get the ciphersuite-id.

session

SSL session.

int represetation for ciphersuite.

void void mbedtls_ssl_set_export_keys_cb (mbedtls_ssl_context *ssl, mbedtls_ssl_export_keys_t *f_export_keys, void *p_export_keys) mbedtls_ssl_set_export_keys_cb mbedtls_ssl_context * ssl mbedtls_ssl_export_keys_t * f_export_keys void * p_export_keys

Configure a key export callback. (Default: none.).

This API can be used for two purposes:

- Debugging: Use this API to e.g. generate an NSSKeylog file and use it to inspect encrypted traffic in tools such as Wireshark.

- Application-specific export: Use this API to implement key exporters, e.g. for EAP-TLS or DTLS-SRTP.

ssl

The SSL context to which the export callback should be attached.

f_export_keys

The callback for the key export.

p_export_keys

The opaque context pointer to be passed to the callback `f_export_keys`.

void static void mbedtls_ssl_conf_set_user_data_p (mbedtls_ssl_config *conf, void *p) mbedtls_ssl_conf_set_user_data_p mbedtls_ssl_config * conf void * p

Set the user data in an SSL configuration to a pointer.

You can retrieve this value later with mbedtls_ssl_conf_get_user_data_p().

The library stores `p` without accessing it. It is the responsibility of the caller to ensure that the pointer remains valid.

conf

The SSL configuration context to modify.

p

The new value of the user data.

void static void mbedtls_ssl_conf_set_user_data_n (mbedtls_ssl_config *conf, uintptr_t n) mbedtls_ssl_conf_set_user_data_n mbedtls_ssl_config * conf uintptr_t n

Set the user data in an SSL configuration to an integer.

You can retrieve this value later with mbedtls_ssl_conf_get_user_data_n().

conf

The SSL configuration context to modify.

n

The new value of the user data.

void * static void * mbedtls_ssl_conf_get_user_data_p (mbedtls_ssl_config *conf) mbedtls_ssl_conf_get_user_data_p mbedtls_ssl_config * conf

Retrieve the user data in an SSL configuration as a pointer.

This is the value last set with mbedtls_ssl_conf_set_user_data_p(), or `NULL` if mbedtls_ssl_conf_set_user_data_p() has not previously been called. The value is undefined if mbedtls_ssl_conf_set_user_data_n() has been called without a subsequent call to mbedtls_ssl_conf_set_user_data_p().

conf

The SSL configuration context to modify.

The current value of the user data.

uintptr_t static uintptr_t mbedtls_ssl_conf_get_user_data_n (mbedtls_ssl_config *conf) mbedtls_ssl_conf_get_user_data_n mbedtls_ssl_config * conf

Retrieve the user data in an SSL configuration as an integer.

This is the value last set with mbedtls_ssl_conf_set_user_data_n(), or `0` if mbedtls_ssl_conf_set_user_data_n() has not previously been called. The value is undefined if mbedtls_ssl_conf_set_user_data_p() has been called without a subsequent call to mbedtls_ssl_conf_set_user_data_n().

conf

The SSL configuration context to modify.

The current value of the user data.

void static void mbedtls_ssl_set_user_data_p (mbedtls_ssl_context *ssl, void *p) mbedtls_ssl_set_user_data_p mbedtls_ssl_context * ssl void * p

Set the user data in an SSL context to a pointer.

You can retrieve this value later with mbedtls_ssl_get_user_data_p().

The library stores `p` without accessing it. It is the responsibility of the caller to ensure that the pointer remains valid.

ssl

The SSL context to modify.

p

The new value of the user data.

void static void mbedtls_ssl_set_user_data_n (mbedtls_ssl_context *ssl, uintptr_t n) mbedtls_ssl_set_user_data_n mbedtls_ssl_context * ssl uintptr_t n

Set the user data in an SSL context to an integer.

You can retrieve this value later with mbedtls_ssl_get_user_data_n().

ssl

The SSL context to modify.

n

The new value of the user data.

void * static void * mbedtls_ssl_get_user_data_p (mbedtls_ssl_context *ssl) mbedtls_ssl_get_user_data_p mbedtls_ssl_context * ssl

Retrieve the user data in an SSL context as a pointer.

This is the value last set with mbedtls_ssl_set_user_data_p(), or `NULL` if mbedtls_ssl_set_user_data_p() has not previously been called. The value is undefined if mbedtls_ssl_set_user_data_n() has been called without a subsequent call to mbedtls_ssl_set_user_data_p().

ssl

The SSL context to modify.

The current value of the user data.

uintptr_t static uintptr_t mbedtls_ssl_get_user_data_n (mbedtls_ssl_context *ssl) mbedtls_ssl_get_user_data_n mbedtls_ssl_context * ssl

Retrieve the user data in an SSL context as an integer.

This is the value last set with mbedtls_ssl_set_user_data_n(), or `0` if mbedtls_ssl_set_user_data_n() has not previously been called. The value is undefined if mbedtls_ssl_set_user_data_p() has been called without a subsequent call to mbedtls_ssl_set_user_data_n().

ssl

The SSL context to modify.

The current value of the user data.

void void mbedtls_ssl_conf_dtls_cookies (mbedtls_ssl_config *conf, mbedtls_ssl_cookie_write_t *f_cookie_write, mbedtls_ssl_cookie_check_t *f_cookie_check, void *p_cookie) mbedtls_ssl_conf_dtls_cookies mbedtls_ssl_config * conf mbedtls_ssl_cookie_write_t * f_cookie_write mbedtls_ssl_cookie_check_t * f_cookie_check void * p_cookie

Register callbacks for DTLS cookies (Server only. DTLS only.).

Default: dummy callbacks that fail, in order to force you to register working callbacks (and initialize their context).

To disable HelloVerifyRequest, register NULL callbacks.

Disabling hello verification allows your server to be used for amplification in DoS attacks against other hosts. Only disable if you known this can't happen in your particular environment.

See comments on `mbedtls_ssl_handshake()` about handling the MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED that is expected on the first handshake attempt when this is enabled.

This is also necessary to handle client reconnection from the same port as described in RFC 6347 section 4.2.8 (only the variant with cookies is supported currently). See comments on `mbedtls_ssl_read()` for details.

conf

SSL configuration

f_cookie_write

Cookie write callback

f_cookie_check

Cookie check callback

p_cookie

Context for both callbacks

int int mbedtls_ssl_set_client_transport_id (mbedtls_ssl_context *ssl, const unsigned char *info, size_t ilen) mbedtls_ssl_set_client_transport_id mbedtls_ssl_context * ssl const unsigned char * info size_t ilen

Set client's transport-level identification info. (Server only. DTLS only.).

This is usually the IP address (and port), but could be anything identify the client depending on the underlying network stack. Used for HelloVerifyRequest with DTLS. This is not used to route the actual packets.

ssl

SSL context

info

Transport-level info identifying the client (eg IP + port)

ilen

Length of info in bytes

An internal copy is made, so the info buffer can be reused.

0 on success, MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used on client, MBEDTLS_ERR_SSL_ALLOC_FAILED if out of memory.

void void mbedtls_ssl_conf_dtls_anti_replay (mbedtls_ssl_config *conf, char mode) mbedtls_ssl_conf_dtls_anti_replay mbedtls_ssl_config * conf char mode

Enable or disable anti-replay protection for DTLS. (DTLS only, no effect on TLS.) Default: enabled.

conf

SSL configuration

mode

MBEDTLS_SSL_ANTI_REPLAY_ENABLED or MBEDTLS_SSL_ANTI_REPLAY_DISABLED.

Disabling this is a security risk unless the application protocol handles duplicated packets in a safe way. You should not disable this without careful consideration. However, if your application already detects duplicated packets and needs information about them to adjust its transmission strategy, then you'll want to disable this.

void void mbedtls_ssl_conf_dtls_badmac_limit (mbedtls_ssl_config *conf, unsigned limit) mbedtls_ssl_conf_dtls_badmac_limit mbedtls_ssl_config * conf unsigned limit

Set a limit on the number of records with a bad MAC before terminating the connection. (DTLS only, no effect on TLS.) Default: 0 (disabled).

conf

SSL configuration

limit

Limit, or 0 to disable.

If the limit is N, then the connection is terminated when the Nth non-authentic record is seen.

Records with an invalid header are not counted, only the ones going through the authentication-decryption phase.

This is a security trade-off related to the fact that it's often relatively easy for an active attacker to inject UDP datagrams. On one hand, setting a low limit here makes it easier for such an attacker to forcibly terminated a connection. On the other hand, a high limit or no limit might make us waste resources checking authentication on many bogus packets.

void void mbedtls_ssl_set_datagram_packing (mbedtls_ssl_context *ssl, unsigned allow_packing) mbedtls_ssl_set_datagram_packing mbedtls_ssl_context * ssl unsigned allow_packing

Allow or disallow packing of multiple handshake records within a single datagram.

ssl

The SSL context to configure.

allow_packing

This determines whether datagram packing may be used or not. A value of `0` means that every record will be sent in a separate datagram; a value of `1` means that, if space permits, multiple handshake messages (including CCS) belonging to a single flight may be packed within a single datagram.

This is enabled by default and should only be disabled for test purposes, or if datagram packing causes interoperability issues with peers that don't support it.

Allowing datagram packing reduces the network load since there's less overhead if multiple messages share the same datagram. Also, it increases the handshake efficiency since messages belonging to a single datagram will not be reordered in transit, and so future message buffering or flight retransmission (if no buffering is used) as means to deal with reordering are needed less frequently.

Application records are not affected by this option and are currently always sent in separate datagrams.

void void mbedtls_ssl_conf_handshake_timeout (mbedtls_ssl_config *conf, uint32_t min, uint32_t max) mbedtls_ssl_conf_handshake_timeout mbedtls_ssl_config * conf uint32_t min uint32_t max

Set retransmit timeout values for the DTLS handshake. (DTLS only, no effect on TLS.).

conf

SSL configuration

min

Initial timeout value in milliseconds. Default: 1000 (1 second).

max

Maximum timeout value in milliseconds. Default: 60000 (60 seconds).

Default values are from RFC 6347 section 4.2.4.1.

The 'min' value should typically be slightly above the expected round-trip time to your peer, plus whatever time it takes for the peer to process the message. For example, if your RTT is about 600ms and you peer needs up to 1s to do the cryptographic operations in the handshake, then you should set 'min' slightly above 1600. Lower values of 'min' might cause spurious resends which waste network resources, while larger value of 'min' will increase overall latency on unreliable network links.

The more unreliable your network connection is, the larger your max / min ratio needs to be in order to achieve reliable handshakes.

Messages are retransmitted up to log2(ceil(max/min)) times. For example, if min = 1s and max = 5s, the retransmit plan goes: send ... 1s -> resend ... 2s -> resend ... 4s -> resend ... 5s -> give up and return a timeout error.

void void mbedtls_ssl_conf_session_cache (mbedtls_ssl_config *conf, void *p_cache, mbedtls_ssl_cache_get_t *f_get_cache, mbedtls_ssl_cache_set_t *f_set_cache) mbedtls_ssl_conf_session_cache mbedtls_ssl_config * conf void * p_cache mbedtls_ssl_cache_get_t * f_get_cache mbedtls_ssl_cache_set_t * f_set_cache

Set the session cache callbacks (server-side only) If not set, no session resuming is done (except if session tickets are enabled too).

The session cache has the responsibility to check for stale entries based on timeout. See RFC 5246 for recommendations.

Warning: session.peer_cert is cleared by the SSL/TLS layer on connection shutdown, so do not cache the pointer! Either set it to NULL or make a full copy of the certificate.

The get callback is called once during the initial handshake to enable session resuming. The get function has the following parameters: (void *parameter, mbedtls_ssl_session *session) If a valid entry is found, it should fill the master of the session object with the cached values and return 0, return 1 otherwise. Optionally peer_cert can be set as well if it is properly present in cache entry.

The set callback is called once during the initial handshake to enable session resuming after the entire handshake has been finished. The set function has the following parameters: (void *parameter, const mbedtls_ssl_session *session). The function should create a cache entry for future retrieval based on the data in the session structure and should keep in mind that the mbedtls_ssl_session object presented (and all its referenced data) is cleared by the SSL/TLS layer when the connection is terminated. It is recommended to add metadata to determine if an entry is still valid in the future. Return 0 if successfully cached, return 1 otherwise.

conf

SSL configuration

p_cache

parameter (context) for both callbacks

f_get_cache

session get callback

f_set_cache

session set callback

int int mbedtls_ssl_set_session (mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session) mbedtls_ssl_set_session mbedtls_ssl_context * ssl const mbedtls_ssl_session * session

Load a session for session resumption.

Sessions loaded through this call will be considered for session resumption in the next handshake.

Even if this call succeeds, it is not guaranteed that the next handshake will indeed be shortened through the use of session resumption: The server is always free to reject any attempt for resumption and fall back to a full handshake.

This function can handle a variety of mechanisms for session resumption: For TLS 1.2, both session ID-based resumption and ticket-based resumption will be considered. For TLS 1.3, sessions equate to tickets, and loading one session by calling this function will lead to its corresponding ticket being advertised as resumption PSK by the client. This depends on session tickets being enabled (see MBEDTLS_SSL_SESSION_TICKETS configuration option) though. If session tickets are disabled, a call to this function with a TLS 1.3 session, will not have any effect on the next handshake for the SSL context `ssl`.

ssl

The SSL context representing the connection which should be attempted to be setup using session resumption. This must be initialized via mbedtls_ssl_init() and bound to an SSL configuration via mbedtls_ssl_setup(), but the handshake must not yet have been started.

session

The session to be considered for session resumption. This must be a session previously exported via mbedtls_ssl_get_session(), and potentially serialized and deserialized through mbedtls_ssl_session_save() and mbedtls_ssl_session_load() in the meantime.

`0` if successful.

`MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE` if the session could not be loaded because one session has already been loaded. This error is non-fatal, and has no observable effect on the SSL context or the session that was attempted to be loaded.

Another negative error code on other kinds of failure.

mbedtls_ssl_get_session()

mbedtls_ssl_session_load()

int int mbedtls_ssl_session_load (mbedtls_ssl_session *session, const unsigned char *buf, size_t len) mbedtls_ssl_session_load mbedtls_ssl_session * session const unsigned char * buf size_t len

Load serialized session data into a session structure. On client, this can be used for loading saved sessions before resuming them with mbedtls_ssl_set_session(). On server, this can be used for alternative implementations of session cache or session tickets.

If a peer certificate chain is associated with the session, the serialized state will only contain the peer's end-entity certificate and the result of the chain verification (unless verification was disabled), but not the rest of the chain.

mbedtls_ssl_session_save()

mbedtls_ssl_set_session()

session

The session structure to be populated. It must have been initialised with mbedtls_ssl_session_init() but not populated yet.

buf

The buffer holding the serialized session data. It must be a readable buffer of at least `len` bytes.

len

The size of the serialized data in bytes.

`0` if successful.

MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid.

MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data was generated in a different version or configuration of Mbed TLS.

Another negative value for other kinds of errors (for example, unsupported features in the embedded certificate).

int int mbedtls_ssl_session_save (const mbedtls_ssl_session *session, unsigned char *buf, size_t buf_len, size_t *olen) mbedtls_ssl_session_save const mbedtls_ssl_session * session unsigned char * buf size_t buf_len size_t * olen

Save session structure as serialized data in a buffer. On client, this can be used for saving session data, potentially in non-volatile storage, for resuming later. On server, this can be used for alternative implementations of session cache or session tickets.

mbedtls_ssl_session_load()

session

The session structure to be saved.

buf

The buffer to write the serialized data to. It must be a writeable buffer of at least `buf_len` bytes, or may be `NULL` if `buf_len` is `0`.

buf_len

The number of bytes available for writing in `buf`.

olen

The size in bytes of the data that has been or would have been written. It must point to a valid `size_t`.

`olen` is updated to the correct value regardless of whether `buf_len` was large enough. This makes it possible to determine the necessary size by calling this function with `buf` set to `NULL` and `buf_len` to `0`.

For TLS 1.3 sessions, this feature is supported only if the MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, as in TLS 1.3 session resumption is possible only with tickets.

`0` if successful.

MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if `buf` is too small.

MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled and the session is a TLS 1.3 session.

void void mbedtls_ssl_conf_ciphersuites (mbedtls_ssl_config *conf, const int *ciphersuites) mbedtls_ssl_conf_ciphersuites mbedtls_ssl_config * conf const int * ciphersuites

Set the list of allowed ciphersuites and the preference order. First in the list has the highest preference.

For TLS 1.2, the notion of ciphersuite determines both the key exchange mechanism and the suite of symmetric algorithms to be used during and after the handshake.

For TLS 1.3 (in development), the notion of ciphersuite only determines the suite of symmetric algorithms to be used during and after the handshake, while key exchange mechanisms are configured separately.

In Mbed TLS, ciphersuites for both TLS 1.2 and TLS 1.3 are configured via this function. For users of TLS 1.3, there will be separate API for the configuration of key exchange mechanisms.

The list of ciphersuites passed to this function may contain a mixture of TLS 1.2 and TLS 1.3 ciphersuite identifiers. This is useful if negotiation of TLS 1.3 should be attempted, but a fallback to TLS 1.2 would be tolerated.

By default, the server chooses its preferred ciphersuite among those that the client supports. If mbedtls_ssl_conf_preference_order() is called to prefer the client's preferences, the server instead chooses the client's preferred ciphersuite among those that the server supports.

The ciphersuites array `ciphersuites` is not copied. It must remain valid for the lifetime of the SSL configuration `conf`.

conf

The SSL configuration to modify.

ciphersuites

A 0-terminated list of IANA identifiers of supported ciphersuites, accessible through `MBEDTLS_TLS_XXX` and `MBEDTLS_TLS1_3_XXX` macros defined in ssl_ciphersuites.h.

void void mbedtls_ssl_conf_tls13_key_exchange_modes (mbedtls_ssl_config *conf, const int kex_modes) mbedtls_ssl_conf_tls13_key_exchange_modes mbedtls_ssl_config * conf const int kex_modes

Set the supported key exchange modes for TLS 1.3 connections.

In contrast to TLS 1.2, the ciphersuite concept in TLS 1.3 does not include the choice of key exchange mechanism. It is therefore not covered by the API mbedtls_ssl_conf_ciphersuites(). See the documentation of mbedtls_ssl_conf_ciphersuites() for more information on the ciphersuite concept in TLS 1.2 and TLS 1.3. The present function is specific to TLS 1.3 and allows users to configure the set of supported key exchange mechanisms in TLS 1.3.

conf

The SSL configuration the change should apply to.

kex_modes

A bitwise combination of one or more of the following:

- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK This flag enables pure-PSK key exchanges.

- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL This flag enables combined PSK-ephemeral key exchanges.

- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL This flag enables pure-ephemeral key exchanges. For convenience, the following pre-defined macros are available for combinations of the above:

- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL Includes all of pure-PSK, PSK-ephemeral and pure-ephemeral.

- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL Includes both pure-PSK and combined PSK-ephemeral key exchanges, but excludes pure-ephemeral key exchanges.

- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL Includes both pure-ephemeral and combined PSK-ephemeral key exchanges.

If a PSK-based key exchange mode shall be supported, applications must also use the APIs mbedtls_ssl_conf_psk() or mbedtls_ssl_conf_psk_cb() or mbedtls_ssl_conf_psk_opaque() to configure the PSKs to be used.

If a pure-ephemeral key exchange mode shall be supported, server-side applications must also provide a certificate via mbedtls_ssl_conf_own_cert().

int int mbedtls_ssl_conf_cid (mbedtls_ssl_config *conf, size_t len, int ignore_other_cids) mbedtls_ssl_conf_cid mbedtls_ssl_config * conf size_t len int ignore_other_cids

Specify the length of Connection IDs for incoming encrypted DTLS records, as well as the behaviour on unexpected CIDs.

By default, the CID length is set to `0`, and unexpected CIDs are silently ignored.

conf

The SSL configuration to modify.

len

The length in Bytes of the CID fields in encrypted DTLS records using the CID mechanism. This must not be larger than MBEDTLS_SSL_CID_OUT_LEN_MAX.

ignore_other_cids

This determines the stack's behaviour when receiving a record with an unexpected CID. Possible values are:

- MBEDTLS_SSL_UNEXPECTED_CID_IGNORE In this case, the record is silently ignored.

- MBEDTLS_SSL_UNEXPECTED_CID_FAIL In this case, the stack fails with the specific error code MBEDTLS_ERR_SSL_UNEXPECTED_CID.

The CID specification allows implementations to either use a common length for all incoming connection IDs or allow variable-length incoming IDs. Mbed TLS currently requires a common length for all connections sharing the same SSL configuration; this allows simpler parsing of record headers.

`0` on success.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA if `len` is too large.

void void mbedtls_ssl_conf_cert_profile (mbedtls_ssl_config *conf, const mbedtls_x509_crt_profile *profile) mbedtls_ssl_conf_cert_profile mbedtls_ssl_config * conf const mbedtls_x509_crt_profile * profile

Set the X.509 security profile used for verification.

The restrictions are enforced for all certificates in the chain. However, signatures in the handshake are not covered by this setting but by mbedtls_ssl_conf_sig_hashes().

conf

SSL configuration

profile

Profile to use

void void mbedtls_ssl_conf_ca_chain (mbedtls_ssl_config *conf, mbedtls_x509_crt *ca_chain, mbedtls_x509_crl *ca_crl) mbedtls_ssl_conf_ca_chain mbedtls_ssl_config * conf mbedtls_x509_crt * ca_chain mbedtls_x509_crl * ca_crl

Set the data required to verify peer certificate.

See `mbedtls_x509_crt_verify()` for notes regarding the parameters ca_chain (maps to trust_ca for that function) and ca_crl.

conf

SSL configuration

ca_chain

trusted CA chain (meaning all fully trusted top-level CAs)

ca_crl

trusted CA CRLs

void static void mbedtls_ssl_conf_dn_hints (mbedtls_ssl_config *conf, const mbedtls_x509_crt *crt) mbedtls_ssl_conf_dn_hints mbedtls_ssl_config * conf const mbedtls_x509_crt * crt

Set DN hints sent to client in CertificateRequest message.

If not set, subject distinguished names (DNs) are taken from `mbedtls_ssl_conf_ca_chain()` or `mbedtls_ssl_set_hs_ca_chain()`)

conf

SSL configuration

crt

crt chain whose subject DNs are issuer DNs of client certs from which the client should select client peer certificate.

int int mbedtls_ssl_conf_own_cert (mbedtls_ssl_config *conf, mbedtls_x509_crt *own_cert, mbedtls_pk_context *pk_key) mbedtls_ssl_conf_own_cert mbedtls_ssl_config * conf mbedtls_x509_crt * own_cert mbedtls_pk_context * pk_key

Set own certificate chain and private key.

own_cert should contain in order from the bottom up your certificate chain. The top certificate (self-signed) can be omitted.

On server, this function can be called multiple times to provision more than one cert/key pair (eg one ECDSA, one RSA with SHA-256, one RSA with SHA-1). An adequate certificate will be selected according to the client's advertised capabilities. In case multiple certificates are adequate, preference is given to the one set by the first call to this function, then second, etc.

On client, only the first call has any effect. That is, only one client certificate can be provisioned. The server's preferences in its CertificateRequest message will be ignored and our only cert will be sent regardless of whether it matches those preferences - the server can then decide what it wants to do with it.

The provided `pk_key` needs to match the public key in the first certificate in `own_cert`, or all handshakes using that certificate will fail. It is your responsibility to ensure that; this function will not perform any check. You may use mbedtls_pk_check_pair() in order to perform this check yourself, but be aware that this function can be computationally expensive on some key types.

conf

SSL configuration

own_cert

own public certificate chain

pk_key

own private key

0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED

int int mbedtls_ssl_conf_psk (mbedtls_ssl_config *conf, const unsigned char *psk, size_t psk_len, const unsigned char *psk_identity, size_t psk_identity_len) mbedtls_ssl_conf_psk mbedtls_ssl_config * conf const unsigned char * psk size_t psk_len const unsigned char * psk_identity size_t psk_identity_len

Configure pre-shared keys (PSKs) and their identities to be used in PSK-based ciphersuites.

Only one PSK can be registered, through either mbedtls_ssl_conf_psk() or mbedtls_ssl_conf_psk_opaque(). If you attempt to register more than one PSK, this function fails, though this may change in future versions, which may add support for multiple PSKs.

This is mainly useful for clients. Servers will usually want to use `mbedtls_ssl_conf_psk_cb()` instead.

A PSK set by `mbedtls_ssl_set_hs_psk()` in the PSK callback takes precedence over a PSK configured by this function.

conf

The SSL configuration to register the PSK with.

psk

The pointer to the pre-shared key to use.

psk_len

The length of the pre-shared key in bytes.

psk_identity

The pointer to the pre-shared key identity.

psk_identity_len

The length of the pre-shared key identity in bytes.

The PSK and its identity are copied internally and hence need not be preserved by the caller for the lifetime of the SSL configuration.

`0` if successful.

MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no more PSKs can be configured. In this case, the old PSK(s) remain intact.

Another negative error code on other kinds of failure.

int int mbedtls_ssl_set_hs_psk (mbedtls_ssl_context *ssl, const unsigned char *psk, size_t psk_len) mbedtls_ssl_set_hs_psk mbedtls_ssl_context * ssl const unsigned char * psk size_t psk_len

Set the pre-shared Key (PSK) for the current handshake.

This should only be called inside the PSK callback, i.e. the function passed to `mbedtls_ssl_conf_psk_cb()`.

A PSK set by this function takes precedence over a PSK configured by `mbedtls_ssl_conf_psk()`.

ssl

The SSL context to configure a PSK for.

psk

The pointer to the pre-shared key.

psk_len

The length of the pre-shared key in bytes.

`0` if successful.

An `MBEDTLS_ERR_SSL_XXX` error code on failure.

void void mbedtls_ssl_conf_psk_cb (mbedtls_ssl_config *conf, int(*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, size_t), void *p_psk) mbedtls_ssl_conf_psk_cb mbedtls_ssl_config * conf int(*)(void *, mbedtls_ssl_context *, const unsigned char *, size_t) f_psk void * p_psk

Set the PSK callback (server-side only).

If set, the PSK callback is called for each handshake where a PSK-based ciphersuite was negotiated. The caller provides the identity received and wants to receive the actual PSK data and length. The callback has the following parameters: - \c void*: The opaque pointer \p p_psk. - \c mbedtls_ssl_context*: The SSL context to which the operation applies. - \c const unsigned char*: The PSK identity selected by the client. - \c size_t: The length of the PSK identity selected by the client. If a valid PSK identity is found, the callback should use \c mbedtls_ssl_set_hs_psk() or \c mbedtls_ssl_set_hs_psk_opaque() on the SSL context to set the correct PSK and return \c 0. Any other return value will result in a denied PSK identity.

A dynamic PSK (i.e. set by the PSK callback) takes precedence over a static PSK (i.e. set by `mbedtls_ssl_conf_psk()` or `mbedtls_ssl_conf_psk_opaque()`). This means that if you set a PSK callback using this function, you don't need to set a PSK using `mbedtls_ssl_conf_psk()` or `mbedtls_ssl_conf_psk_opaque()`).

conf

The SSL configuration to register the callback with.

f_psk

The callback for selecting and setting the PSK based in the PSK identity chosen by the client.

p_psk

A pointer to an opaque structure to be passed to the callback, for example a PSK store.

int int mbedtls_ssl_conf_dh_param_bin (mbedtls_ssl_config *conf, const unsigned char *dhm_P, size_t P_len, const unsigned char *dhm_G, size_t G_len) mbedtls_ssl_conf_dh_param_bin mbedtls_ssl_config * conf const unsigned char * dhm_P size_t P_len const unsigned char * dhm_G size_t G_len

Set the Diffie-Hellman public P and G values from big-endian binary presentations. (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]_BIN).

conf

SSL configuration

dhm_P

Diffie-Hellman-Merkle modulus in big-endian binary form

P_len

Length of DHM modulus

dhm_G

Diffie-Hellman-Merkle generator in big-endian binary form

G_len

Length of DHM generator

0 if successful

int int mbedtls_ssl_conf_dh_param_ctx (mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx) mbedtls_ssl_conf_dh_param_ctx mbedtls_ssl_config * conf mbedtls_dhm_context * dhm_ctx

Set the Diffie-Hellman public P and G values, read from existing context (server-side only).

conf

SSL configuration

dhm_ctx

Diffie-Hellman-Merkle context

0 if successful

void void mbedtls_ssl_conf_dhm_min_bitlen (mbedtls_ssl_config *conf, unsigned int bitlen) mbedtls_ssl_conf_dhm_min_bitlen mbedtls_ssl_config * conf unsigned int bitlen

Set the minimum length for Diffie-Hellman parameters. (Client-side only.) (Default: 1024 bits.).

conf

SSL configuration

bitlen

Minimum bit length of the DHM prime

void MBEDTLS_DEPRECATED void MBEDTLS_DEPRECATED mbedtls_ssl_conf_curves (mbedtls_ssl_config *conf, const mbedtls_ecp_group_id *curves) mbedtls_ssl_conf_curves mbedtls_ssl_config * conf const mbedtls_ecp_group_id * curves

Set the allowed curves in order of preference.

On server: this only affects selection of the ECDHE curve; the curves used for ECDH and ECDSA are determined by the list of available certificates instead. On client: this affects the list of curves offered for any use. The server can override our preference order. Both sides: limits the set of curves accepted for use in ECDHE and in the peer's end-entity certificate.

Deprecated

Superseded by mbedtls_ssl_conf_groups().

This has no influence on which curves are allowed inside the certificate chains, see `mbedtls_ssl_conf_cert_profile()` for that. For the end-entity certificate however, the key will be accepted only if it is allowed both by this list and by the cert profile.

This list should be ordered by decreasing preference (preferred curve first).

The default list is the same set of curves that mbedtls_x509_crt_profile_default allows, plus ECDHE-only curves selected according to the same criteria. The order favors curves with the lowest resource usage.

New minor versions of Mbed TLS may extend this list, for example if new curves are added to the library. New minor versions of Mbed TLS will not remove items from this list unless serious security concerns require it. New minor versions of Mbed TLS may change the order in keeping with the general principle of favoring the lowest resource usage.

conf

SSL configuration

curves

Ordered list of allowed curves, terminated by MBEDTLS_ECP_DP_NONE.

MBEDTLS_DEPRECATED
void void mbedtls_ssl_conf_groups (mbedtls_ssl_config *conf, const uint16_t *groups) mbedtls_ssl_conf_groups mbedtls_ssl_config * conf const uint16_t * groups

Set the allowed groups in order of preference.

On server: This only affects the choice of key agreement mechanism On client: this affects the list of groups offered for any use. The server can override our preference order. Both sides: limits the set of groups accepted for use in key sharing.

This function replaces the deprecated mbedtls_ssl_conf_curves(), which only allows ECP curves to be configured.

The most recent invocation of either mbedtls_ssl_conf_curves() or mbedtls_ssl_conf_groups() nullifies all previous invocations of both.

This list should be ordered by decreasing preference (preferred group first).

When this function is not called, a default list is used, consisting of all supported curves at 255 bits and above, and all supported finite fields at 2048 bits and above. The order favors groups with the lowest resource usage.

New minor versions of Mbed TLS will not remove items from the default list unless serious security concerns require it. New minor versions of Mbed TLS may change the order in keeping with the general principle of favoring the lowest resource usage.

conf

SSL configuration

groups

List of allowed groups ordered by preference, terminated by 0. Must contain valid IANA NamedGroup IDs (provided via either an integer or using MBEDTLS_TLS1_3_NAMED_GROUP_XXX macros).

void MBEDTLS_DEPRECATED void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes (mbedtls_ssl_config *conf, const int *hashes) mbedtls_ssl_conf_sig_hashes mbedtls_ssl_config * conf const int * hashes

Set the allowed hashes for signatures during the handshake.

This only affects which hashes are offered and can be used for signatures during the handshake. Hashes for message authentication and the TLS PRF are controlled by the ciphersuite, see `mbedtls_ssl_conf_ciphersuites()`. Hashes used for certificate signature are controlled by the verification profile, see `mbedtls_ssl_conf_cert_profile()`.

Deprecated

Superseded by mbedtls_ssl_conf_sig_algs().

This list should be ordered by decreasing preference (preferred hash first).

By default, all supported hashes whose length is at least 256 bits are allowed. This is the same set as the default for certificate verification (mbedtls_x509_crt_profile_default). The preference order is currently unspecified and may change in future versions.

New minor versions of Mbed TLS may extend this list, for example if new curves are added to the library. New minor versions of Mbed TLS will not remove items from this list unless serious security concerns require it.

conf

SSL configuration

hashes

Ordered list of allowed signature hashes, terminated by `MBEDTLS_MD_NONE`.

MBEDTLS_DEPRECATED
void void mbedtls_ssl_conf_sig_algs (mbedtls_ssl_config *conf, const uint16_t *sig_algs) mbedtls_ssl_conf_sig_algs mbedtls_ssl_config * conf const uint16_t * sig_algs

Configure allowed signature algorithms for use in TLS.

conf

The SSL configuration to use.

sig_algs

List of allowed IANA values for TLS 1.3 signature algorithms, terminated by MBEDTLS_TLS1_3_SIG_NONE. The list must remain available throughout the lifetime of the conf object.

- For TLS 1.3, values of `MBEDTLS_TLS1_3_SIG_XXXX` should be used.

- For TLS 1.2, values should be given as "(HashAlgorithm << 8) | SignatureAlgorithm".

int int mbedtls_ssl_set_hostname (mbedtls_ssl_context *ssl, const char *hostname) mbedtls_ssl_set_hostname mbedtls_ssl_context * ssl const char * hostname

Set or reset the hostname to check against the received peer certificate. On a client, this also sets the ServerName TLS extension, if that extension is enabled. On a TLS 1.3 client, this also sets the server name in the session resumption ticket, if that feature is enabled.

ssl

SSL context

hostname

The server hostname. This may be `NULL` to clear the hostname.

Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN.

If the hostname is `NULL` on a client, then the server is not authenticated: it only needs to have a valid certificate, not a certificate matching its name. Therefore you should always call this function on a client, unless the connection is set up to only allow pre-shared keys, or in scenarios where server impersonation is not a concern. See the documentation of MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME for more details.

0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on too long input hostname.

Hostname set to the one provided on success (cleared when NULL). On allocation failure hostname is cleared. On too long input failure, old hostname is unchanged.
const char * static const char * mbedtls_ssl_get_hostname (mbedtls_ssl_context *ssl) mbedtls_ssl_get_hostname mbedtls_ssl_context * ssl

Get the hostname that checked against the received server certificate. It is used to set the ServerName TLS extension, too, if that extension is enabled. (client-side only).

ssl

SSL context

const pointer to the hostname value

const unsigned char * const unsigned char * mbedtls_ssl_get_hs_sni (mbedtls_ssl_context *ssl, size_t *name_len) mbedtls_ssl_get_hs_sni mbedtls_ssl_context * ssl size_t * name_len

Retrieve SNI extension value for the current handshake. Available in `f_cert_cb` of `mbedtls_ssl_conf_cert_cb()`, this is the same value passed to `f_sni` callback of `mbedtls_ssl_conf_sni()` and may be used instead of `mbedtls_ssl_conf_sni()`.

ssl

SSL context

name_len

pointer into which to store length of returned value. 0 if SNI extension is not present or not yet processed.

const pointer to SNI extension value.

- value is valid only when called in `f_cert_cb` registered with `mbedtls_ssl_conf_cert_cb()`.

- value is NULL if SNI extension is not present.

- value is not '\0'-terminated. Use `name_len` for len.

- value must not be freed.

int int mbedtls_ssl_set_hs_own_cert (mbedtls_ssl_context *ssl, mbedtls_x509_crt *own_cert, mbedtls_pk_context *pk_key) mbedtls_ssl_set_hs_own_cert mbedtls_ssl_context * ssl mbedtls_x509_crt * own_cert mbedtls_pk_context * pk_key

Set own certificate and key for the current handshake.

Same as `mbedtls_ssl_conf_own_cert()` but for use within the SNI callback or the certificate selection callback.

Passing null `own_cert` clears the certificate list for the current handshake.

ssl

SSL context

own_cert

own public certificate chain

pk_key

own private key

0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED

void void mbedtls_ssl_set_hs_ca_chain (mbedtls_ssl_context *ssl, mbedtls_x509_crt *ca_chain, mbedtls_x509_crl *ca_crl) mbedtls_ssl_set_hs_ca_chain mbedtls_ssl_context * ssl mbedtls_x509_crt * ca_chain mbedtls_x509_crl * ca_crl

Set the data required to verify peer certificate for the current handshake.

Same as `mbedtls_ssl_conf_ca_chain()` but for use within the SNI callback or the certificate selection callback.

ssl

SSL context

ca_chain

trusted CA chain (meaning all fully trusted top-level CAs)

ca_crl

trusted CA CRLs

void void mbedtls_ssl_set_hs_dn_hints (mbedtls_ssl_context *ssl, const mbedtls_x509_crt *crt) mbedtls_ssl_set_hs_dn_hints mbedtls_ssl_context * ssl const mbedtls_x509_crt * crt

Set DN hints sent to client in CertificateRequest message.

Same as `mbedtls_ssl_conf_dn_hints()` but for use within the SNI callback or the certificate selection callback.

ssl

SSL context

crt

crt chain whose subject DNs are issuer DNs of client certs from which the client should select client peer certificate.

void void mbedtls_ssl_set_hs_authmode (mbedtls_ssl_context *ssl, int authmode) mbedtls_ssl_set_hs_authmode mbedtls_ssl_context * ssl int authmode

Set authmode for the current handshake.

Same as `mbedtls_ssl_conf_authmode()` but for use within the SNI callback or the certificate selection callback.

ssl

SSL context

authmode

MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or MBEDTLS_SSL_VERIFY_REQUIRED

void void mbedtls_ssl_conf_sni (mbedtls_ssl_config *conf, int(*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, size_t), void *p_sni) mbedtls_ssl_conf_sni mbedtls_ssl_config * conf int(*)(void *, mbedtls_ssl_context *, const unsigned char *, size_t) f_sni void * p_sni

Set server side ServerName TLS extension callback (optional, server-side only).

If set, the ServerName callback is called whenever the server receives a ServerName TLS extension from the client during a handshake. The ServerName callback has the following parameters: (void *parameter, mbedtls_ssl_context *ssl, const unsigned char *hostname, size_t len). If a suitable certificate is found, the callback must set the certificate(s) and key(s) to use with `mbedtls_ssl_set_hs_own_cert()` (can be called repeatedly), and may optionally adjust the CA and associated CRL with `mbedtls_ssl_set_hs_ca_chain()` as well as the client authentication mode with `mbedtls_ssl_set_hs_authmode()`, then must return 0. If no matching name is found, the callback may return non-zero to abort the handshake.

conf

SSL configuration

f_sni

verification function

p_sni

verification parameter

int int mbedtls_ssl_conf_alpn_protocols (mbedtls_ssl_config *conf, const char **protos) mbedtls_ssl_conf_alpn_protocols mbedtls_ssl_config * conf const char ** protos

Set the supported Application Layer Protocols.

conf

SSL configuration

protos

Pointer to a NULL-terminated list of supported protocols, in decreasing preference order. The pointer to the list is recorded by the library for later reference as required, so the lifetime of the table must be at least as long as the lifetime of the SSL configuration structure.

0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA.

const char * const char * mbedtls_ssl_get_alpn_protocol (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_alpn_protocol const mbedtls_ssl_context * ssl

Get the name of the negotiated Application Layer Protocol. This function should be called after the handshake is completed.

ssl

SSL context

Protocol name, or NULL if no protocol was negotiated.

const char * static const char * mbedtls_ssl_get_srtp_profile_as_string (mbedtls_ssl_srtp_profile profile) mbedtls_ssl_get_srtp_profile_as_string mbedtls_ssl_srtp_profile profile MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32 MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80 MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32 MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80
void void mbedtls_ssl_conf_srtp_mki_value_supported (mbedtls_ssl_config *conf, int support_mki_value) mbedtls_ssl_conf_srtp_mki_value_supported mbedtls_ssl_config * conf int support_mki_value

Manage support for mki(master key id) value in use_srtp extension. MKI is an optional part of SRTP used for key management and re-keying. See RFC3711 section 3.1 for details. The default value is MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED.

conf

The SSL configuration to manage mki support.

support_mki_value

Enable or disable mki usage. Values are MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED or MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED.

int int mbedtls_ssl_conf_dtls_srtp_protection_profiles (mbedtls_ssl_config *conf, const mbedtls_ssl_srtp_profile *profiles) mbedtls_ssl_conf_dtls_srtp_protection_profiles mbedtls_ssl_config * conf const mbedtls_ssl_srtp_profile * profiles

Set the supported DTLS-SRTP protection profiles.

conf

SSL configuration

profiles

Pointer to a List of MBEDTLS_TLS_SRTP_UNSET terminated supported protection profiles in decreasing preference order. The pointer to the list is recorded by the library for later reference as required, so the lifetime of the table must be at least as long as the lifetime of the SSL configuration structure. The list must not hold more than MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH elements (excluding the terminating MBEDTLS_TLS_SRTP_UNSET).

0 on success

MBEDTLS_ERR_SSL_BAD_INPUT_DATA when the list of protection profiles is incorrect.

int int mbedtls_ssl_dtls_srtp_set_mki_value (mbedtls_ssl_context *ssl, unsigned char *mki_value, uint16_t mki_len) mbedtls_ssl_dtls_srtp_set_mki_value mbedtls_ssl_context * ssl unsigned char * mki_value uint16_t mki_len

Set the mki_value for the current DTLS-SRTP session.

ssl

SSL context to use.

mki_value

The MKI value to set.

mki_len

The length of the MKI value.

This function is relevant on client side only. The server discovers the mki value during handshake. A mki value set on server side using this function is ignored.

0 on success

MBEDTLS_ERR_SSL_BAD_INPUT_DATA

MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE

void void mbedtls_ssl_get_dtls_srtp_negotiation_result (const mbedtls_ssl_context *ssl, mbedtls_dtls_srtp_info *dtls_srtp_info) mbedtls_ssl_get_dtls_srtp_negotiation_result const mbedtls_ssl_context * ssl mbedtls_dtls_srtp_info * dtls_srtp_info

Get the negotiated DTLS-SRTP information: Protection profile and MKI value.

This function must be called after the handshake is completed. The value returned by this function must not be trusted or acted upon before the handshake completes.

ssl

The SSL context to query.

dtls_srtp_info

The negotiated DTLS-SRTP information:

- Protection profile in use. A direct mapping of the iana defined value for protection profile on an uint16_t. http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml MBEDTLS_TLS_SRTP_UNSET if the use of SRTP was not negotiated or peer's Hello packet was not parsed yet.

- mki size and value( if size is > 0 ).

void MBEDTLS_DEPRECATED void MBEDTLS_DEPRECATED mbedtls_ssl_conf_max_version (mbedtls_ssl_config *conf, int major, int minor) mbedtls_ssl_conf_max_version mbedtls_ssl_config * conf int major int minor

Set the maximum supported version sent from the client side and/or accepted at the server side.

See also the documentation of mbedtls_ssl_conf_min_version().

This ignores ciphersuites from higher versions.

This function is deprecated and has been replaced by `mbedtls_ssl_conf_max_tls_version()`.

conf

SSL configuration

major

Major version number (MBEDTLS_SSL_MAJOR_VERSION_3)

minor

Minor version number (MBEDTLS_SSL_MINOR_VERSION_3 for (D)TLS 1.2, MBEDTLS_SSL_MINOR_VERSION_4 for TLS 1.3)

MBEDTLS_DEPRECATED
void static void mbedtls_ssl_conf_max_tls_version (mbedtls_ssl_config *conf, mbedtls_ssl_protocol_version tls_version) mbedtls_ssl_conf_max_tls_version mbedtls_ssl_config * conf mbedtls_ssl_protocol_version tls_version

Set the maximum supported version sent from the client side and/or accepted at the server side.

After the handshake, you can call mbedtls_ssl_get_version_number() to see what version was negotiated.

conf

SSL configuration

tls_version

TLS protocol version number (`mbedtls_ssl_protocol_version`) (MBEDTLS_SSL_VERSION_UNKNOWN is not valid)

void MBEDTLS_DEPRECATED void MBEDTLS_DEPRECATED mbedtls_ssl_conf_min_version (mbedtls_ssl_config *conf, int major, int minor) mbedtls_ssl_conf_min_version mbedtls_ssl_config * conf int major int minor

Set the minimum accepted SSL/TLS protocol version.

By default, all supported versions are accepted. Future versions of the library may disable older protocol versions by default if they become deprecated.

The following versions are supported (if enabled at compile time):

- (D)TLS 1.2: `major` = MBEDTLS_SSL_MAJOR_VERSION_3, `minor` = MBEDTLS_SSL_MINOR_VERSION_3

- TLS 1.3: `major` = MBEDTLS_SSL_MAJOR_VERSION_3, `minor` = MBEDTLS_SSL_MINOR_VERSION_4

Note that the numbers in the constant names are the TLS internal protocol numbers, and the minor versions differ by one from the human-readable versions!

Input outside of the SSL_MAX_XXXXX_VERSION and SSL_MIN_XXXXX_VERSION range is ignored.

After the handshake, you can call mbedtls_ssl_get_version_number() to see what version was negotiated.

This function is deprecated and has been replaced by `mbedtls_ssl_conf_min_tls_version()`.

conf

SSL configuration

major

Major version number (MBEDTLS_SSL_MAJOR_VERSION_3)

minor

Minor version number (MBEDTLS_SSL_MINOR_VERSION_3 for (D)TLS 1.2, MBEDTLS_SSL_MINOR_VERSION_4 for TLS 1.3)

MBEDTLS_DEPRECATED
void static void mbedtls_ssl_conf_min_tls_version (mbedtls_ssl_config *conf, mbedtls_ssl_protocol_version tls_version) mbedtls_ssl_conf_min_tls_version mbedtls_ssl_config * conf mbedtls_ssl_protocol_version tls_version

Set the minimum supported version sent from the client side and/or accepted at the server side.

After the handshake, you can call mbedtls_ssl_get_version_number() to see what version was negotiated.

conf

SSL configuration

tls_version

TLS protocol version number (`mbedtls_ssl_protocol_version`) (MBEDTLS_SSL_VERSION_UNKNOWN is not valid)

void void mbedtls_ssl_conf_encrypt_then_mac (mbedtls_ssl_config *conf, char etm) mbedtls_ssl_conf_encrypt_then_mac mbedtls_ssl_config * conf char etm

Enable or disable Encrypt-then-MAC (Default: MBEDTLS_SSL_ETM_ENABLED).

This should always be enabled, it is a security improvement, and should not cause any interoperability issue (used only if the peer supports it too).

conf

SSL configuration

etm

MBEDTLS_SSL_ETM_ENABLED or MBEDTLS_SSL_ETM_DISABLED

void void mbedtls_ssl_conf_extended_master_secret (mbedtls_ssl_config *conf, char ems) mbedtls_ssl_conf_extended_master_secret mbedtls_ssl_config * conf char ems

Enable or disable Extended Master Secret negotiation. (Default: MBEDTLS_SSL_EXTENDED_MS_ENABLED).

This should always be enabled, it is a security fix to the protocol, and should not cause any interoperability issue (used only if the peer supports it too).

conf

SSL configuration

ems

MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED

void void mbedtls_ssl_conf_cert_req_ca_list (mbedtls_ssl_config *conf, char cert_req_ca_list) mbedtls_ssl_conf_cert_req_ca_list mbedtls_ssl_config * conf char cert_req_ca_list

Whether to send a list of acceptable CAs in CertificateRequest messages. (Default: do send).

conf

SSL configuration

cert_req_ca_list

MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED or MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED

int int mbedtls_ssl_conf_max_frag_len (mbedtls_ssl_config *conf, unsigned char mfl_code) mbedtls_ssl_conf_max_frag_len mbedtls_ssl_config * conf unsigned char mfl_code

Set the maximum fragment length to emit and/or negotiate. (Typical: the smaller of MBEDTLS_SSL_IN_CONTENT_LEN and MBEDTLS_SSL_OUT_CONTENT_LEN, usually `2^14` bytes) (Server: set maximum fragment length to emit, usually negotiated by the client during handshake) (Client: set maximum fragment length to emit and negotiate with the server during handshake) (Default: MBEDTLS_SSL_MAX_FRAG_LEN_NONE).

On the client side, the maximum fragment length extension will not be used, unless the maximum fragment length has been set via this function to a value different than MBEDTLS_SSL_MAX_FRAG_LEN_NONE.

With TLS, this currently only affects ApplicationData (sent with `mbedtls_ssl_read()`), not handshake messages. With DTLS, this affects both ApplicationData and handshake.

Defragmentation of TLS handshake messages is supported with some limitations. See the documentation of mbedtls_ssl_handshake() for details.

This sets the maximum length for a record's payload, excluding record overhead that will be added to it, see `mbedtls_ssl_get_record_expansion()`.

For DTLS, it is also possible to set a limit for the total size of datagrams passed to the transport layer, including record overhead, see `mbedtls_ssl_set_mtu()`.

conf

SSL configuration

mfl_code

Code for maximum fragment length (allowed values: MBEDTLS_SSL_MAX_FRAG_LEN_512, MBEDTLS_SSL_MAX_FRAG_LEN_1024, MBEDTLS_SSL_MAX_FRAG_LEN_2048, MBEDTLS_SSL_MAX_FRAG_LEN_4096)

0 if successful or MBEDTLS_ERR_SSL_BAD_INPUT_DATA

void void mbedtls_ssl_conf_preference_order (mbedtls_ssl_config *conf, int order) mbedtls_ssl_conf_preference_order mbedtls_ssl_config * conf int order

Pick the ciphersuites order according to the second parameter in the SSL Server module (MBEDTLS_SSL_SRV_C). (Default, if never called: MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER).

conf

SSL configuration

order

Server or client (MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER or MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT)

void void mbedtls_ssl_conf_session_tickets (mbedtls_ssl_config *conf, int use_tickets) mbedtls_ssl_conf_session_tickets mbedtls_ssl_config * conf int use_tickets

Enable / Disable TLS 1.2 session tickets (client only, TLS 1.2 only). Enabled by default.

On server, use `mbedtls_ssl_conf_session_tickets_cb()`.

conf

SSL configuration

use_tickets

Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or MBEDTLS_SSL_SESSION_TICKETS_DISABLED)

void void mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets (mbedtls_ssl_config *conf, int signal_new_session_tickets) mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets mbedtls_ssl_config * conf int signal_new_session_tickets

Enable / Disable handling of TLS 1.3 NewSessionTicket messages (client only, TLS 1.3 only).

The handling of TLS 1.3 NewSessionTicket messages is disabled by default.

In TLS 1.3, servers may send a NewSessionTicket message at any time, and may send multiple NewSessionTicket messages. By default, TLS 1.3 clients ignore NewSessionTicket messages.

To support session tickets in TLS 1.3 clients, call this function with MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When this is enabled, when a client receives a NewSessionTicket message, the next call to a message processing functions (notably mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then call mbedtls_ssl_get_session() to retrieve the session ticket before calling the same message processing function again.

conf

SSL configuration

signal_new_session_tickets

Enable or disable (MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED)

void void mbedtls_ssl_conf_new_session_tickets (mbedtls_ssl_config *conf, uint16_t num_tickets) mbedtls_ssl_conf_new_session_tickets mbedtls_ssl_config * conf uint16_t num_tickets

Number of NewSessionTicket messages for the server to send after handshake completion.

The default value is `MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS`.

In case of a session resumption, this setting only partially apply. At most one ticket is sent in that case to just renew the pool of tickets of the client. The rationale is to avoid the number of tickets on the server to become rapidly out of control when the server has the same configuration for all its connection instances.

conf

SSL configuration

num_tickets

Number of NewSessionTicket.

void void mbedtls_ssl_conf_renegotiation (mbedtls_ssl_config *conf, int renegotiation) mbedtls_ssl_conf_renegotiation mbedtls_ssl_config * conf int renegotiation

Enable / Disable renegotiation support for connection when initiated by peer (Default: MBEDTLS_SSL_RENEGOTIATION_DISABLED).

It is recommended to always disable renegotiation unless you know you need it and you know what you're doing. In the past, there have been several issues associated with renegotiation or a poor understanding of its properties.

Server-side, enabling renegotiation also makes the server susceptible to a resource DoS by a malicious client.

conf

SSL configuration

renegotiation

Enable or disable (MBEDTLS_SSL_RENEGOTIATION_ENABLED or MBEDTLS_SSL_RENEGOTIATION_DISABLED)

void void mbedtls_ssl_conf_legacy_renegotiation (mbedtls_ssl_config *conf, int allow_legacy) mbedtls_ssl_conf_legacy_renegotiation mbedtls_ssl_config * conf int allow_legacy

Prevent or allow legacy renegotiation. (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION).

MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to be established even if the peer does not support secure renegotiation, but does not allow renegotiation to take place if not secure. (Interoperable and secure option)

MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations with non-upgraded peers. Allowing legacy renegotiation makes the connection vulnerable to specific man in the middle attacks. (See RFC 5746) (Most interoperable and least secure option)

MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections if peer does not support secure renegotiation. Results in interoperability issues with non-upgraded peers that do not support renegotiation altogether. (Most secure option, interoperability issues)

conf

SSL configuration

allow_legacy

Prevent or allow (SSL_NO_LEGACY_RENEGOTIATION, SSL_ALLOW_LEGACY_RENEGOTIATION or MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE)

void void mbedtls_ssl_conf_renegotiation_enforced (mbedtls_ssl_config *conf, int max_records) mbedtls_ssl_conf_renegotiation_enforced mbedtls_ssl_config * conf int max_records

Enforce renegotiation requests. (Default: enforced, max_records = 16).

When we request a renegotiation, the peer can comply or ignore the request. This function allows us to decide whether to enforce our renegotiation requests by closing the connection if the peer doesn't comply.

However, records could already be in transit from the peer when the request is emitted. In order to increase reliability, we can accept a number of records before the expected handshake records.

The optimal value is highly dependent on the specific usage scenario.

With DTLS and server-initiated renegotiation, the HelloRequest is retransmitted every time mbedtls_ssl_read() times out or receives Application Data, until:

- max_records records have beens seen, if it is >= 0, or

- the number of retransmits that would happen during an actual handshake has been reached. Please remember the request might be lost a few times if you consider setting max_records to a really low value.

On client, the grace period can only happen during mbedtls_ssl_read(), as opposed to mbedtls_ssl_write() and mbedtls_ssl_renegotiate() which always behave as if max_record was 0. The reason is, if we receive application data from the server, we need a place to write it, which only happens during mbedtls_ssl_read().

conf

SSL configuration

max_records

Use MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED if you don't want to enforce renegotiation, or a non-negative value to enforce it but allow for a grace period of max_records records.

void void mbedtls_ssl_conf_renegotiation_period (mbedtls_ssl_config *conf, const unsigned char period[8]) mbedtls_ssl_conf_renegotiation_period mbedtls_ssl_config * conf const unsigned char period [8]

Set record counter threshold for periodic renegotiation. (Default: 2^48 - 1).

Renegotiation is automatically triggered when a record counter (outgoing or incoming) crosses the defined threshold. The default value is meant to prevent the connection from being closed when the counter is about to reached its maximal value (it is not allowed to wrap).

Lower values can be used to enforce policies such as "keys must be refreshed every N packets with cipher X".

The renegotiation period can be disabled by setting conf->disable_renegotiation to MBEDTLS_SSL_RENEGOTIATION_DISABLED.

When the configured transport is MBEDTLS_SSL_TRANSPORT_DATAGRAM the maximum renegotiation period is 2^48 - 1, and for MBEDTLS_SSL_TRANSPORT_STREAM, the maximum renegotiation period is 2^64 - 1.

conf

SSL configuration

period

The threshold value: a big-endian 64-bit number.

int int mbedtls_ssl_check_pending (const mbedtls_ssl_context *ssl) mbedtls_ssl_check_pending const mbedtls_ssl_context * ssl

Check if there is data already read from the underlying transport but not yet processed.

ssl

SSL context

0 if nothing's pending, 1 otherwise.

This is different in purpose and behaviour from `mbedtls_ssl_get_bytes_avail` in that it considers any kind of unprocessed data, not only unread application data. If `mbedtls_ssl_get_bytes` returns a non-zero value, this function will also signal pending data, but the converse does not hold. For example, in DTLS there might be further records waiting to be processed from the current underlying transport's datagram.

If this function returns 1 (data pending), this does not imply that a subsequent call to `mbedtls_ssl_read` will provide any data; e.g., the unprocessed data might turn out to be an alert or a handshake message.

This function is useful in the following situation: If the SSL/TLS module successfully returns from an operation - e.g. a handshake or an application record read - and you're awaiting incoming data next, you must not immediately idle on the underlying transport to have data ready, but you need to check the value of this function first. The reason is that the desired data might already be read but not yet processed. If, in contrast, a previous call to the SSL/TLS module returned MBEDTLS_ERR_SSL_WANT_READ, it is not necessary to call this function, as the latter error code entails that all internal data has been processed.

size_t size_t mbedtls_ssl_get_bytes_avail (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_bytes_avail const mbedtls_ssl_context * ssl

Return the number of application data bytes remaining to be read from the current record.

ssl

SSL context

How many bytes are available in the application data record read buffer.

When working over a datagram transport, this is useful to detect the current datagram's boundary in case `mbedtls_ssl_read` has written the maximal amount of data fitting into the input buffer.

uint32_t uint32_t mbedtls_ssl_get_verify_result (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_verify_result const mbedtls_ssl_context * ssl

Return the result of the certificate verification.

ssl

The SSL context to use.

`0` if the certificate verification was successful.

`-1u` if the result is not available. This may happen e.g. if the handshake aborts early, or a verification callback returned a fatal error.

A bitwise combination of `MBEDTLS_X509_BADCERT_XXX` and `MBEDTLS_X509_BADCRL_XXX` failure flags; see x509.h.

int int mbedtls_ssl_get_ciphersuite_id_from_ssl (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_ciphersuite_id_from_ssl const mbedtls_ssl_context * ssl

Return the id of the current ciphersuite.

ssl

SSL context

a ciphersuite id

const char * const char * mbedtls_ssl_get_ciphersuite (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_ciphersuite const mbedtls_ssl_context * ssl

Return the name of the current ciphersuite.

ssl

SSL context

a string containing the ciphersuite name

mbedtls_ssl_protocol_version static mbedtls_ssl_protocol_version mbedtls_ssl_get_version_number (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_version_number const mbedtls_ssl_context * ssl

Return the (D)TLS protocol version negotiated in the given connection.

If you call this function too early during the initial handshake, before the two sides have agreed on a version, this function returns MBEDTLS_SSL_VERSION_UNKNOWN.

ssl

The SSL context to query.

The negotiated protocol version.

const char * const char * mbedtls_ssl_get_version (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_version const mbedtls_ssl_context * ssl

Return the current TLS version.

ssl

SSL context

a string containing the TLS version

int int mbedtls_ssl_get_record_expansion (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_record_expansion const mbedtls_ssl_context * ssl

Return the (maximum) number of bytes added by the record layer: header + encryption/MAC overhead (inc. padding).

ssl

SSL context

Current maximum record expansion in bytes

int int mbedtls_ssl_get_max_out_record_payload (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_max_out_record_payload const mbedtls_ssl_context * ssl

Return the current maximum outgoing record payload in bytes.

The logic to determine the maximum outgoing record payload is version-specific. It takes into account various factors, such as the mbedtls_config.h setting `MBEDTLS_SSL_OUT_CONTENT_LEN`, extensions such as the max fragment length or record size limit extension if used, and for DTLS the path MTU as configured and current record expansion.

With DTLS, `mbedtls_ssl_write()` will return an error if called with a larger length value. With TLS, `mbedtls_ssl_write()` will fragment the input if necessary and return the number of bytes written; it is up to the caller to call `mbedtls_ssl_write()` again in order to send the remaining bytes if any.

mbedtls_ssl_get_max_out_record_payload()

mbedtls_ssl_get_record_expansion()

ssl

SSL context

Current maximum payload for an outgoing record, or a negative error code.

int int mbedtls_ssl_get_max_in_record_payload (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_max_in_record_payload const mbedtls_ssl_context * ssl

Return the current maximum incoming record payload in bytes.

The logic to determine the maximum incoming record payload is version-specific. It takes into account various factors, such as the mbedtls_config.h setting `MBEDTLS_SSL_IN_CONTENT_LEN`, extensions such as the max fragment length extension or record size limit extension if used, and the current record expansion.

mbedtls_ssl_set_mtu()

mbedtls_ssl_get_max_in_record_payload()

mbedtls_ssl_get_record_expansion()

ssl

SSL context

Current maximum payload for an incoming record, or a negative error code.

const mbedtls_x509_crt * const mbedtls_x509_crt * mbedtls_ssl_get_peer_cert (const mbedtls_ssl_context *ssl) mbedtls_ssl_get_peer_cert const mbedtls_ssl_context * ssl

Return the peer certificate from the current connection.

ssl

The SSL context to use. This must be initialized and setup.

The current peer certificate, if available. The returned certificate is owned by the SSL context and is valid only until the next call to the SSL API.

`NULL` if no peer certificate is available. This might be because the chosen ciphersuite doesn't use CRTs (PSK-based ciphersuites, for example), or because MBEDTLS_SSL_KEEP_PEER_CERTIFICATE has been disabled, allowing the stack to free the peer's CRT to save memory.

For one-time inspection of the peer's certificate during the handshake, consider registering an X.509 CRT verification callback through mbedtls_ssl_conf_verify() instead of calling this function. Using mbedtls_ssl_conf_verify() also comes at the benefit of allowing you to influence the verification process, for example by masking expected and tolerated verification failures.

You must not use the pointer returned by this function after any further call to the SSL API, including mbedtls_ssl_read() and mbedtls_ssl_write(); this is because the pointer might change during renegotiation, which happens transparently to the user. If you want to use the certificate across API calls, you must make a copy.

int int mbedtls_ssl_get_session (const mbedtls_ssl_context *ssl, mbedtls_ssl_session *session) mbedtls_ssl_get_session const mbedtls_ssl_context * ssl mbedtls_ssl_session * session

Export a session in order to resume it later.

ssl

The SSL context representing the connection for which to to export a session structure for later resumption.

session

The target structure in which to store the exported session. This must have been initialized with mbedtls_ssl_session_init() but otherwise be unused.

This function can handle a variety of mechanisms for session resumption: For TLS 1.2, both session ID-based resumption and ticket-based resumption will be considered. For TLS 1.3, sessions equate to tickets, and if session tickets are enabled (see MBEDTLS_SSL_SESSION_TICKETS configuration option), this function exports the last received ticket and the exported session may be used to resume the TLS 1.3 session. If session tickets are disabled, exported sessions cannot be used to resume a TLS 1.3 session.

`0` if successful. In this case, `session` can be used for session resumption by passing it to mbedtls_ssl_set_session(), and serialized for storage via mbedtls_ssl_session_save().

Another negative error code on other kinds of failure.

mbedtls_ssl_set_session()

mbedtls_ssl_session_save()

int int mbedtls_ssl_handshake (mbedtls_ssl_context *ssl) mbedtls_ssl_handshake mbedtls_ssl_context * ssl

Perform the SSL handshake.

ssl

SSL context

`0` if successful.

MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE if the handshake is incomplete and waiting for data to be available for reading from or writing to the underlying transport - in this case you must call this function again when the underlying transport is ready for the operation.

MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous operation is in progress (see mbedtls_ssl_conf_async_private_cb()) - in this case you must call this function again when the operation is ready.

MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic operation is in progress (see mbedtls_ecp_set_max_ops()) - in this case you must call this function again to complete the handshake when you're done attending other tasks.

MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use and the client did not demonstrate reachability yet - in this case you must stop using the context (see below).

MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 NewSessionTicket message has been received. See the documentation of mbedtls_ssl_read() for more information about this error code.

MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as defined in RFC 8446 (TLS 1.3 specification), has been received as part of the handshake. This is server specific and may occur only if the early data feature has been enabled on server (see mbedtls_ssl_conf_early_data() documentation). You must call mbedtls_ssl_read_early_data() to read the early data before resuming the handshake.

Another SSL error code - in this case you must stop using the context (see below).

If this function returns something other than `0`, MBEDTLS_ERR_SSL_WANT_READ, MBEDTLS_ERR_SSL_WANT_WRITE, MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

If DTLS is in use, then you may choose to handle MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging purposes, as it is an expected return value rather than an actual error, but you still need to reset/free the context.

Remarks regarding event-driven DTLS: If the function returns MBEDTLS_ERR_SSL_WANT_READ, no datagram from the underlying transport layer is currently being processed, and it is safe to idle until the timer or the underlying transport signal a new event. This is not true for a successful handshake, in which case the datagram of the underlying transport that is currently being processed might or might not contain further DTLS records.

If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto subsystem must have been initialized by calling psa_crypto_init() before calling this function. Otherwise, the handshake may call psa_crypto_init() if a negotiation involving TLS 1.3 takes place (this may be the case even if TLS 1.3 is offered but eventually not selected).

In TLS, reception of fragmented handshake messages is supported with some limitations (those limitations do not apply to DTLS, where defragmentation is fully supported):

- On an Mbed TLS server that only accepts TLS 1.2, the initial ClientHello message must not be fragmented. A TLS 1.2 ClientHello may be fragmented if the server also accepts TLS 1.3 connections (meaning that MBEDTLS_SSL_PROTO_TLS1_3 enabled, and the accepted versions have not been restricted with mbedtls_ssl_conf_max_tls_version() or the like).

- The first fragment of a handshake message must be at least 4 bytes long.

- Non-handshake records must not be interleaved between the fragments of a handshake message. (This is permitted in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it even in TLS 1.2.)

int static int mbedtls_ssl_is_handshake_over (mbedtls_ssl_context *ssl) mbedtls_ssl_is_handshake_over mbedtls_ssl_context * ssl

After calling mbedtls_ssl_handshake() to start the SSL handshake you can call this function to check whether the handshake is over for a given SSL context. This function should be also used to determine when to stop calling mbedtls_handshake_step() for that context.

ssl

SSL context

`1` if handshake is over, `0` if it is still ongoing.

MBEDTLS_SSL_HANDSHAKE_OVER
int int mbedtls_ssl_handshake_step (mbedtls_ssl_context *ssl) mbedtls_ssl_handshake_step mbedtls_ssl_context * ssl

Perform a single step of the SSL handshake.

The state of the context (ssl->state) will be at the next state after this function returns `0`. Do not call this function if mbedtls_ssl_is_handshake_over() returns `1`.

Whilst in the past you may have used direct access to the context state (ssl->state) in order to ascertain when to stop calling this function and although you can still do so with something like ssl->MBEDTLS_PRIVATE(state) or by defining MBEDTLS_ALLOW_PRIVATE_ACCESS, this is now considered deprecated and could be broken in any future release. If you still find you have good reason for such direct access, then please do contact the team to explain this (raise an issue or post to the mailing list), so that we can add a solution to your problem that will be guaranteed to work in the future.

ssl

SSL context

See mbedtls_ssl_handshake().

If this function returns something other than `0`, MBEDTLS_ERR_SSL_WANT_READ, MBEDTLS_ERR_SSL_WANT_WRITE, MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

int int mbedtls_ssl_renegotiate (mbedtls_ssl_context *ssl) mbedtls_ssl_renegotiate mbedtls_ssl_context * ssl

Initiate an SSL renegotiation on the running connection. Client: perform the renegotiation right now. Server: request renegotiation, which will be performed during the next call to mbedtls_ssl_read() if honored by client.

ssl

SSL context

0 if successful, or any mbedtls_ssl_handshake() return value except MBEDTLS_ERR_SSL_CLIENT_RECONNECT that can't happen during a renegotiation.

If this function returns something other than `0`, MBEDTLS_ERR_SSL_WANT_READ, MBEDTLS_ERR_SSL_WANT_WRITE, MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

int int mbedtls_ssl_read (mbedtls_ssl_context *ssl, unsigned char *buf, size_t len) mbedtls_ssl_read mbedtls_ssl_context * ssl unsigned char * buf size_t len

Read at most 'len' application data bytes.

ssl

SSL context

buf

buffer that will hold the data

len

maximum number of bytes to read

The (positive) number of bytes read if successful.

`0` if the read end of the underlying transport was closed without sending a CloseNotify beforehand, which might happen because of various reasons (internal error of an underlying stack, non-conformant peer not sending a CloseNotify and such) - in this case you must stop using the context (see below).

MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY if the underlying transport is still functional, but the peer has acknowledged to not send anything anymore.

MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE if the handshake is incomplete and waiting for data to be available for reading from or writing to the underlying transport - in this case you must call this function again when the underlying transport is ready for the operation.

MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous operation is in progress (see mbedtls_ssl_conf_async_private_cb()) - in this case you must call this function again when the operation is ready.

MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic operation is in progress (see mbedtls_ecp_set_max_ops()) - in this case you must call this function again to complete the handshake when you're done attending other tasks.

MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server side of a DTLS connection and the client is initiating a new connection using the same source port. See below.

MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 NewSessionTicket message has been received. This error code is only returned on the client side. It is only returned if handling of TLS 1.3 NewSessionTicket messages has been enabled through mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). This error code indicates that a TLS 1.3 NewSessionTicket message has been received and parsed successfully by the client. The ticket data can be retrieved from the SSL context by calling mbedtls_ssl_get_session(). It remains available until the next call to mbedtls_ssl_read().

MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as defined in RFC 8446 (TLS 1.3 specification), has been received as part of the handshake. This is server specific and may occur only if the early data feature has been enabled on server (see mbedtls_ssl_conf_early_data() documentation). You must call mbedtls_ssl_read_early_data() to read the early data before resuming the handshake.

Another SSL error code - in this case you must stop using the context (see below).

If this function returns something other than a positive value, MBEDTLS_ERR_SSL_WANT_READ, MBEDTLS_ERR_SSL_WANT_WRITE, MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, MBEDTLS_ERR_SSL_CLIENT_RECONNECT or MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

When this function returns MBEDTLS_ERR_SSL_CLIENT_RECONNECT (which can only happen server-side), it means that a client is initiating a new connection using the same source port. You can either treat that as a connection close and wait for the client to resend a ClientHello, or directly continue with `mbedtls_ssl_handshake()` with the same context (as it has been reset internally). Either way, you must make sure this is seen by the application as a new connection: application state, if any, should be reset, and most importantly the identity of the client must be checked again. WARNING: not validating the identity of the client again, or not transmitting the new identity to the application layer, would allow authentication bypass!

Remarks regarding event-driven DTLS:

- If the function returns MBEDTLS_ERR_SSL_WANT_READ, no datagram from the underlying transport layer is currently being processed, and it is safe to idle until the timer or the underlying transport signal a new event.

- This function may return MBEDTLS_ERR_SSL_WANT_READ even if data was initially available on the underlying transport, as this data may have been only e.g. duplicated messages or a renegotiation request. Therefore, you must be prepared to receive MBEDTLS_ERR_SSL_WANT_READ even when reacting to an incoming-data event from the underlying transport.

- On success, the datagram of the underlying transport that is currently being processed may contain further DTLS records. You should call `mbedtls_ssl_check_pending` to check for remaining records.

int int mbedtls_ssl_write (mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len) mbedtls_ssl_write mbedtls_ssl_context * ssl const unsigned char * buf size_t len

Try to write exactly 'len' application data bytes.

This function will do partial writes in some cases. If the return value is non-negative but less than length, the function must be called again with updated arguments: buf + ret, len - ret (if ret is the return value) until it returns a value equal to the last 'len' argument.

ssl

SSL context

buf

buffer holding the data

len

how many bytes must be written

The (non-negative) number of bytes actually written if successful (may be less than `len`).

MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE if the handshake is incomplete and waiting for data to be available for reading from or writing to the underlying transport - in this case you must call this function again when the underlying transport is ready for the operation.

MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous operation is in progress (see mbedtls_ssl_conf_async_private_cb()) - in this case you must call this function again when the operation is ready.

MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic operation is in progress (see mbedtls_ecp_set_max_ops()) - in this case you must call this function again to complete the handshake when you're done attending other tasks.

MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 NewSessionTicket message has been received. See the documentation of mbedtls_ssl_read() for more information about this error code.

MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as defined in RFC 8446 (TLS 1.3 specification), has been received as part of the handshake. This is server specific and may occur only if the early data feature has been enabled on server (see mbedtls_ssl_conf_early_data() documentation). You must call mbedtls_ssl_read_early_data() to read the early data before resuming the handshake.

Another SSL error code - in this case you must stop using the context (see below).

If this function returns something other than a non-negative value, MBEDTLS_ERR_SSL_WANT_READ, MBEDTLS_ERR_SSL_WANT_WRITE, MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

When this function returns MBEDTLS_ERR_SSL_WANT_WRITE/READ, it must be called later with the same arguments, until it returns a value greater than or equal to 0. When the function returns MBEDTLS_ERR_SSL_WANT_WRITE there may be some partial data in the output buffer, however this is not yet sent.

If the requested length is greater than the maximum fragment length (either the built-in limit or the one set or negotiated with the peer), then:

- with TLS, less bytes than requested are written.

- with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned. `mbedtls_ssl_get_max_out_record_payload()` may be used to query the active maximum fragment length.

Attempting to write 0 bytes will result in an empty TLS application record being sent.

int int mbedtls_ssl_send_alert_message (mbedtls_ssl_context *ssl, unsigned char level, unsigned char message) mbedtls_ssl_send_alert_message mbedtls_ssl_context * ssl unsigned char level unsigned char message

Send an alert message.

ssl

SSL context

level

The alert level of the message (MBEDTLS_SSL_ALERT_LEVEL_WARNING or MBEDTLS_SSL_ALERT_LEVEL_FATAL)

message

The alert message (SSL_ALERT_MSG_*)

0 if successful, or a specific SSL error code.

If this function returns something other than 0 or MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

int int mbedtls_ssl_close_notify (mbedtls_ssl_context *ssl) mbedtls_ssl_close_notify mbedtls_ssl_context * ssl

Notify the peer that the connection is being closed.

ssl

SSL context

0 if successful, or a specific SSL error code.

If this function returns something other than 0 or MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using the SSL context for reading or writing, and either free it or call `mbedtls_ssl_session_reset()` on it before re-using it for a new connection; the current connection must be closed.

void void mbedtls_ssl_free (mbedtls_ssl_context *ssl) mbedtls_ssl_free mbedtls_ssl_context * ssl

Free referenced items in an SSL context and clear memory.

ssl

SSL context

int int mbedtls_ssl_context_save (mbedtls_ssl_context *ssl, unsigned char *buf, size_t buf_len, size_t *olen) mbedtls_ssl_context_save mbedtls_ssl_context * ssl unsigned char * buf size_t buf_len size_t * olen

Save an active connection as serialized data in a buffer. This allows the freeing or re-using of the SSL context while still picking up the connection later in a way that it entirely transparent to the peer.

mbedtls_ssl_context_load()

The serialized data only contains the data that is necessary to resume the connection: negotiated protocol options, session identifier, keys, etc. Loading a saved SSL context does not restore settings and state related to how the application accesses the context, such as configured callback functions, user data, pending incoming or outgoing data, etc.

This feature is currently only available under certain conditions, see the documentation of the return value MBEDTLS_ERR_SSL_BAD_INPUT_DATA for details.

When this function succeeds, it calls mbedtls_ssl_session_reset() on `ssl` which as a result is no longer associated with the connection that has been serialized. This avoids creating copies of the connection state. You're then free to either re-use the context structure for a different connection, or call mbedtls_ssl_free() on it. See the documentation of mbedtls_ssl_session_reset() for more details.

ssl

The SSL context to save. On success, it is no longer associated with the connection that has been serialized.

buf

The buffer to write the serialized data to. It must be a writeable buffer of at least `buf_len` bytes, or may be `NULL` if `buf_len` is `0`.

buf_len

The number of bytes available for writing in `buf`.

olen

The size in bytes of the data that has been or would have been written. It must point to a valid `size_t`.

`olen` is updated to the correct value regardless of whether `buf_len` was large enough. This makes it possible to determine the necessary size by calling this function with `buf` set to `NULL` and `buf_len` to `0`. However, the value of `olen` is only guaranteed to be correct when the function returns MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL or `0`. If the return value is different, then the value of `olen` is undefined.

`0` if successful.

MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if `buf` is too small.

MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed while resetting the context.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA if a handshake is in progress, or there is pending data for reading or sending, or the connection does not use DTLS 1.2 with an AEAD ciphersuite, or renegotiation is enabled.

int int mbedtls_ssl_context_load (mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len) mbedtls_ssl_context_load mbedtls_ssl_context * ssl const unsigned char * buf size_t len

Load serialized connection data to an SSL context.

mbedtls_ssl_context_save()

The same serialized data must never be loaded into more that one context. In order to ensure that, after successfully loading serialized data to an SSL context, you should immediately destroy or invalidate all copies of the serialized data that was loaded. Loading the same data in more than one context would cause severe security failures including but not limited to loss of confidentiality.

Before calling this function, the SSL context must be prepared in one of the two following ways. The first way is to take a context freshly initialised with mbedtls_ssl_init() and call mbedtls_ssl_setup() on it with the same mbedtls_ssl_config structure that was used in the original connection. The second way is to call mbedtls_ssl_session_reset() on a context that was previously prepared as above but used in the meantime. Either way, you must not use the context to perform a handshake between calling mbedtls_ssl_setup() or mbedtls_ssl_session_reset() and calling this function. You may however call other setter functions in that time frame as indicated in the note below.

Before or after calling this function successfully, you also need to configure some connection-specific callbacks and settings before you can use the connection again (unless they were already set before calling mbedtls_ssl_session_reset() and the values are suitable for the present connection). Specifically, you want to call at least mbedtls_ssl_set_bio(), mbedtls_ssl_set_timer_cb(), and mbedtls_ssl_set_user_data_n() or mbedtls_ssl_set_user_data_p() if they were set originally. All other SSL setter functions are not necessary to call, either because they're only used in handshakes, or because the setting is already saved. You might choose to call them anyway, for example in order to share code between the cases of establishing a new connection and the case of loading an already-established connection.

If you have new information about the path MTU, you want to call mbedtls_ssl_set_mtu() after calling this function, as otherwise this function would overwrite your newly-configured value with the value that was active when the context was saved.

When this function returns an error code, it calls mbedtls_ssl_free() on `ssl`. In this case, you need to prepare the context with the usual sequence starting with a call to mbedtls_ssl_init() if you want to use it again.

ssl

The SSL context structure to be populated. It must have been prepared as described in the note above.

buf

The buffer holding the serialized connection data. It must be a readable buffer of at least `len` bytes.

len

The size of the serialized data in bytes.

`0` if successful.

MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed.

MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data comes from a different Mbed TLS version or build.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid.

void void mbedtls_ssl_config_init (mbedtls_ssl_config *conf) mbedtls_ssl_config_init mbedtls_ssl_config * conf

Initialize an SSL configuration context Just makes the context ready for mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free().

You need to call mbedtls_ssl_config_defaults() unless you manually set all of the relevant fields yourself.

conf

SSL configuration context

int int mbedtls_ssl_config_defaults (mbedtls_ssl_config *conf, int endpoint, int transport, int preset) mbedtls_ssl_config_defaults mbedtls_ssl_config * conf int endpoint int transport int preset

Load reasonable default SSL configuration values. (You need to call mbedtls_ssl_config_init() first.).

conf

SSL configuration context

endpoint

MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER

transport

MBEDTLS_SSL_TRANSPORT_STREAM for TLS, or MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS

preset

a MBEDTLS_SSL_PRESET_XXX value

See `mbedtls_ssl_conf_transport()` for notes on DTLS.

0 if successful, or MBEDTLS_ERR_XXX_ALLOC_FAILED on memory allocation error.

void void mbedtls_ssl_config_free (mbedtls_ssl_config *conf) mbedtls_ssl_config_free mbedtls_ssl_config * conf

Free an SSL configuration context.

conf

SSL configuration context

void void mbedtls_ssl_session_init (mbedtls_ssl_session *session) mbedtls_ssl_session_init mbedtls_ssl_session * session

Initialize SSL session structure.

session

SSL session

void void mbedtls_ssl_session_free (mbedtls_ssl_session *session) mbedtls_ssl_session_free mbedtls_ssl_session * session

Free referenced items in an SSL session including the peer certificate and clear memory.

A session object can be freed even if the SSL context that was used to retrieve the session is still in use.

session

SSL session

int int mbedtls_ssl_tls_prf (const mbedtls_tls_prf_types prf, const unsigned char *secret, size_t slen, const char *label, const unsigned char *random, size_t rlen, unsigned char *dstbuf, size_t dlen) mbedtls_ssl_tls_prf const mbedtls_tls_prf_types prf const unsigned char * secret size_t slen const char * label const unsigned char * random size_t rlen unsigned char * dstbuf size_t dlen

TLS-PRF function for key derivation.

prf

The tls_prf type function type to be used.

secret

Secret for the key derivation function.

slen

Length of the secret.

label

String label for the key derivation function, terminated with null character.

random

Random bytes.

rlen

Length of the random bytes buffer.

dstbuf

The buffer holding the derived key.

dlen

Length of the output buffer.

0 on success. An SSL specific error on failure.

int int mbedtls_ssl_export_keying_material (mbedtls_ssl_context *ssl, uint8_t *out, const size_t key_len, const char *label, const size_t label_len, const unsigned char *context, const size_t context_len, const int use_context) mbedtls_ssl_export_keying_material mbedtls_ssl_context * ssl uint8_t * out const size_t key_len const char * label const size_t label_len const unsigned char * context const size_t context_len const int use_context

TLS-Exporter to derive shared symmetric keys between server and client.

ssl

SSL context from which to export keys. Must have finished the handshake.

out

Output buffer of length at least key_len bytes.

key_len

Length of the key to generate in bytes, must be at most MBEDTLS_SSL_EXPORT_MAX_KEY_LEN (8160).

label

Label for which to generate the key of length label_len.

label_len

Length of label in bytes. Must be at most 249 in TLS 1.3.

context

Context of the key. Can be NULL if context_len or use_context is 0.

context_len

Length of context. Must be < 2^16 in TLS 1.2.

use_context

Indicates if a context should be used in deriving the key.

TLS 1.2 makes a distinction between a 0-length context and no context. This is why the use_context argument exists. TLS 1.3 does not make this distinction. If use_context is 0 and TLS 1.3 is used, context and context_len are ignored and a 0-length context is used.

0 on success.

MBEDTLS_ERR_SSL_BAD_INPUT_DATA if the handshake is not yet completed.

An SSL-specific error on failure.

SSL/TLS functions.

    /*
    *CopyrightTheMbedTLSContributors
    *SPDX-License-Identifier:Apache-2.0ORGPL-2.0-or-later
    */
    #ifndefMBEDTLS_SSL_H
    #defineMBEDTLS_SSL_H
    #include"mbedtls/platform_util.h"
    #include"mbedtls/private_access.h"

    #include"mbedtls/build_info.h"

    #include"mbedtls/bignum.h"
    #include"mbedtls/ecp.h"

    #include"mbedtls/ssl_ciphersuites.h"

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    #include"mbedtls/x509_crt.h"
    #include"mbedtls/x509_crl.h"
    #endif

    #ifdefined(MBEDTLS_DHM_C)
    #include"mbedtls/dhm.h"
    #endif

    #include"mbedtls/md.h"

    #ifdefined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED)
    #include"mbedtls/ecdh.h"
    #endif

    #ifdefined(MBEDTLS_HAVE_TIME)
    #include"mbedtls/platform_time.h"
    #endif

    #include"psa/crypto.h"

    /*
    *SSLErrorcodes
    */
    #defineMBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS-0x7000
    #defineMBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE-0x7080
    #defineMBEDTLS_ERR_SSL_BAD_INPUT_DATA-0x7100
    #defineMBEDTLS_ERR_SSL_INVALID_MAC-0x7180
    #defineMBEDTLS_ERR_SSL_INVALID_RECORD-0x7200
    #defineMBEDTLS_ERR_SSL_CONN_EOF-0x7280
    #defineMBEDTLS_ERR_SSL_DECODE_ERROR-0x7300
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_NO_RNG-0x7400
    #defineMBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE-0x7480
    #defineMBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION-0x7500
    #defineMBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL-0x7580
    #defineMBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED-0x7600
    #defineMBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED-0x7680
    #defineMBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE-0x7700
    #defineMBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE-0x7780
    #defineMBEDTLS_ERR_SSL_UNRECOGNIZED_NAME-0x7800
    #defineMBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY-0x7880
    /*Errorspacegap*/
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_BAD_CERTIFICATE-0x7A00
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET-0x7B00
    #defineMBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA-0x7B80
    #defineMBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA-0x7C00
    #defineMBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA-0x7C80
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND-0x7E80
    #defineMBEDTLS_ERR_SSL_ALLOC_FAILED-0x7F00
    #defineMBEDTLS_ERR_SSL_HW_ACCEL_FAILED-0x7F80
    #defineMBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH-0x6F80
    #defineMBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION-0x6E80
    #defineMBEDTLS_ERR_SSL_HANDSHAKE_FAILURE-0x6E00
    #defineMBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED-0x6D80
    #defineMBEDTLS_ERR_SSL_PK_TYPE_MISMATCH-0x6D00
    #defineMBEDTLS_ERR_SSL_UNKNOWN_IDENTITY-0x6C80
    #defineMBEDTLS_ERR_SSL_INTERNAL_ERROR-0x6C00
    #defineMBEDTLS_ERR_SSL_COUNTER_WRAPPING-0x6B80
    #defineMBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO-0x6B00
    #defineMBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED-0x6A80
    #defineMBEDTLS_ERR_SSL_BUFFER_TOO_SMALL-0x6A00
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_WANT_READ-0x6900
    #defineMBEDTLS_ERR_SSL_WANT_WRITE-0x6880
    #defineMBEDTLS_ERR_SSL_TIMEOUT-0x6800
    #defineMBEDTLS_ERR_SSL_CLIENT_RECONNECT-0x6780
    #defineMBEDTLS_ERR_SSL_UNEXPECTED_RECORD-0x6700
    #defineMBEDTLS_ERR_SSL_NON_FATAL-0x6680
    #defineMBEDTLS_ERR_SSL_ILLEGAL_PARAMETER-0x6600
    #defineMBEDTLS_ERR_SSL_CONTINUE_PROCESSING-0x6580
    #defineMBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS-0x6500
    #defineMBEDTLS_ERR_SSL_EARLY_MESSAGE-0x6480
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_UNEXPECTED_CID-0x6000
    #defineMBEDTLS_ERR_SSL_VERSION_MISMATCH-0x5F00
    #defineMBEDTLS_ERR_SSL_BAD_CONFIG-0x5E80
    /*Errorspacegap*/
    #defineMBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME-0x5D80

    /*
    *ConstantsfromRFC8446forTLS1.3PSKmodes
    *
    *ThoseareusedinthePre-SharedKeyExchangeModesextension.
    *SeeSection4.2.9inRFC8446.
    */
    #defineMBEDTLS_SSL_TLS1_3_PSK_MODE_PURE0/*PurePSK-basedexchange*/
    #defineMBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE1/*PSK+ECDHE-basedexchange*/

    /*
    *TLS1.3NamedGroupvalues
    *
    *FromRF8446
    *enum{
    *//EllipticCurveGroups(ECDHE)
    *secp256r1(0x0017),secp384r1(0x0018),secp521r1(0x0019),
    *x25519(0x001D),x448(0x001E),
    *//FiniteFieldGroups(DHE)
    *ffdhe2048(0x0100),ffdhe3072(0x0101),ffdhe4096(0x0102),
    *ffdhe6144(0x0103),ffdhe8192(0x0104),
    *//ReservedCodePoints
    *ffdhe_private_use(0x01FC..0x01FF),
    *ecdhe_private_use(0xFE00..0xFEFF),
    *(0xFFFF)
    *}NamedGroup;
    *
    */

    /*EllipticCurveGroups(ECDHE)*/
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_NONE0
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP192K10x0012
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP192R10x0013
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP224K10x0014
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP224R10x0015
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP256K10x0016
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP256R10x0017
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP384R10x0018
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_SECP521R10x0019
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_BP256R10x001A
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_BP384R10x001B
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_BP512R10x001C
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_X255190x001D
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_X4480x001E
    /*FiniteFieldGroups(DHE)*/
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_FFDHE20480x0100
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_FFDHE30720x0101
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_FFDHE40960x0102
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_FFDHE61440x0103
    #defineMBEDTLS_SSL_IANA_TLS_GROUP_FFDHE81920x0104

    /*
    *TLS1.3KeyExchangeModes
    *
    *MbedTLSinternalidentifiersforusewiththeSSLconfigurationAPI
    *mbedtls_ssl_conf_tls13_key_exchange_modes().
    */

    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK(1u<<0)
    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL(1u<<1)
    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL(1u<<2)

    /*Conveniencemacrosforsetsofkeyexchanges.*/
    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL\
    (MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK|\
    MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL|\
    MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL)
    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL\
    (MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK|\
    MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)
    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL\
    (MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL|\
    MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)

    #defineMBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE(0)

    /*
    *Variousconstants
    */

    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    /*ThesearethehighandlowbytesofProtocolVersionasdefinedby:
    *-RFC5246:ProtocolVersionversion={3,3};//TLSv1.2
    *-RFC8446:seesection4.2.1
    */
    #defineMBEDTLS_SSL_MAJOR_VERSION_33
    #defineMBEDTLS_SSL_MINOR_VERSION_33
    #defineMBEDTLS_SSL_MINOR_VERSION_44
    #endif/*MBEDTLS_DEPRECATED_REMOVED*/

    #defineMBEDTLS_SSL_TRANSPORT_STREAM0
    #defineMBEDTLS_SSL_TRANSPORT_DATAGRAM1

    #defineMBEDTLS_SSL_MAX_HOST_NAME_LEN255
    #defineMBEDTLS_SSL_MAX_ALPN_NAME_LEN255

    #defineMBEDTLS_SSL_MAX_ALPN_LIST_LEN65535

    /*RFC6066section4,seealsomfl_code_to_lengthinssl_tls.c
    *NONEmustbezerosothatmemset()ingstructuretozeroworks*/
    #defineMBEDTLS_SSL_MAX_FRAG_LEN_NONE0
    #defineMBEDTLS_SSL_MAX_FRAG_LEN_5121
    #defineMBEDTLS_SSL_MAX_FRAG_LEN_10242
    #defineMBEDTLS_SSL_MAX_FRAG_LEN_20483
    #defineMBEDTLS_SSL_MAX_FRAG_LEN_40964
    #defineMBEDTLS_SSL_MAX_FRAG_LEN_INVALID5

    #defineMBEDTLS_SSL_IS_CLIENT0
    #defineMBEDTLS_SSL_IS_SERVER1

    #defineMBEDTLS_SSL_EXTENDED_MS_DISABLED0
    #defineMBEDTLS_SSL_EXTENDED_MS_ENABLED1

    #defineMBEDTLS_SSL_CID_DISABLED0
    #defineMBEDTLS_SSL_CID_ENABLED1

    #defineMBEDTLS_SSL_ETM_DISABLED0
    #defineMBEDTLS_SSL_ETM_ENABLED1

    #defineMBEDTLS_SSL_COMPRESS_NULL0

    #defineMBEDTLS_SSL_VERIFY_NONE0
    #defineMBEDTLS_SSL_VERIFY_OPTIONAL1
    #defineMBEDTLS_SSL_VERIFY_REQUIRED2
    #defineMBEDTLS_SSL_VERIFY_UNSET3/*Usedonlyforsni_authmode*/

    #defineMBEDTLS_SSL_LEGACY_RENEGOTIATION0
    #defineMBEDTLS_SSL_SECURE_RENEGOTIATION1

    #defineMBEDTLS_SSL_RENEGOTIATION_DISABLED0
    #defineMBEDTLS_SSL_RENEGOTIATION_ENABLED1

    #defineMBEDTLS_SSL_ANTI_REPLAY_DISABLED0
    #defineMBEDTLS_SSL_ANTI_REPLAY_ENABLED1

    #defineMBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED-1
    #defineMBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT16

    #defineMBEDTLS_SSL_LEGACY_NO_RENEGOTIATION0
    #defineMBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION1
    #defineMBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE2

    #defineMBEDTLS_SSL_TRUNC_HMAC_DISABLED0
    #defineMBEDTLS_SSL_TRUNC_HMAC_ENABLED1
    #defineMBEDTLS_SSL_TRUNCATED_HMAC_LEN10/*80bits,rfc6066section7*/

    #defineMBEDTLS_SSL_SESSION_TICKETS_DISABLED0
    #defineMBEDTLS_SSL_SESSION_TICKETS_ENABLED1

    #defineMBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED0
    #defineMBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED1

    #defineMBEDTLS_SSL_PRESET_DEFAULT0
    #defineMBEDTLS_SSL_PRESET_SUITEB2

    #defineMBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED1
    #defineMBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED0

    #defineMBEDTLS_SSL_EARLY_DATA_DISABLED0
    #defineMBEDTLS_SSL_EARLY_DATA_ENABLED1

    #defineMBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED0
    #defineMBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED1

    #defineMBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT1
    #defineMBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER0

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)&&defined(MBEDTLS_SSL_SESSION_TICKETS)
    #ifdefined(PSA_WANT_ALG_SHA_384)
    #defineMBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN48
    #elifdefined(PSA_WANT_ALG_SHA_256)
    #defineMBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN32
    #endif
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3&&MBEDTLS_SSL_SESSION_TICKETS*/
    /*
    *DefaultrangeforDTLSretransmissiontimervalue,inmilliseconds.
    *RFC63474.2.4.1saysfrom1secondto60seconds.
    */
    #defineMBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN1000
    #defineMBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX60000

    /*
    *Whetherearlydatarecordshouldbediscardedornotandhow.
    *
    *Theclienthasindicatedearlydataandtheserverhasrejectedthem.
    *Theserverhasthentoskippastearlydatabyeither:
    *-attemptingtodeprotectreceivedrecordsusingthehandshaketraffic
    *key,discardingrecordswhichfaildeprotection(uptotheconfigured
    *max_early_data_size).Oncearecordisdeprotectedsuccessfully,
    *itistreatedasthestartoftheclient'ssecondflightandthe
    *serverproceedsaswithanordinary1-RTThandshake.
    *-skippingallrecordswithanexternalcontenttypeof
    *"application_data"(indicatingthattheyareencrypted),uptothe
    *configuredmax_early_data_size.Thisistheexpectedbehaviorifthe
    *serverhassentanHelloRetryRequestmessage.Theserverignores
    *applicationdatamessagebefore2ndClientHello.
    */
    #defineMBEDTLS_SSL_EARLY_DATA_NO_DISCARD0
    #defineMBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD1
    #defineMBEDTLS_SSL_EARLY_DATA_DISCARD2

    /*
    *Maximumfragmentlengthinbytes,
    *determinesthesizeofeachofthetwointernalI/Obuffers.
    *
    *Note:theRFCdefinesthedefaultsizeofSSL/TLSmessages.Ifyou
    *changethevaluehere,otherclients/serversmaynotbeableto
    *communicatewithyouanymore.Onlychangethisvalueifyoucontrol
    *bothsidesoftheconnectionandhaveitreducedatbothsides,or
    *ifyou'reusingtheMaxFragmentLengthextensionandyouknowallyour
    *peersareusingittoo!
    */
    #if!defined(MBEDTLS_SSL_IN_CONTENT_LEN)
    #defineMBEDTLS_SSL_IN_CONTENT_LEN16384
    #endif

    #if!defined(MBEDTLS_SSL_OUT_CONTENT_LEN)
    #defineMBEDTLS_SSL_OUT_CONTENT_LEN16384
    #endif

    /*
    *Maximumnumberofheap-allocatedbytesforthepurposeof
    *DTLShandshakemessagereassemblyandfuturemessagebuffering.
    */
    #if!defined(MBEDTLS_SSL_DTLS_MAX_BUFFERING)
    #defineMBEDTLS_SSL_DTLS_MAX_BUFFERING32768
    #endif

    /*
    *MaximumlengthofCIDsforincomingandoutgoingmessages.
    */
    #if!defined(MBEDTLS_SSL_CID_IN_LEN_MAX)
    #defineMBEDTLS_SSL_CID_IN_LEN_MAX32
    #endif

    #if!defined(MBEDTLS_SSL_CID_OUT_LEN_MAX)
    #defineMBEDTLS_SSL_CID_OUT_LEN_MAX32
    #endif

    #if!defined(MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY)
    #defineMBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY16
    #endif

    #if!defined(MBEDTLS_SSL_MAX_EARLY_DATA_SIZE)
    #defineMBEDTLS_SSL_MAX_EARLY_DATA_SIZE1024
    #endif

    #if!defined(MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE)
    #defineMBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE6000
    #endif

    #if!defined(MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH)
    #defineMBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH32
    #endif

    #if!defined(MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS)
    #defineMBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS1
    #endif

    /*
    *DefaulttostandardCIDmode
    */
    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)&&\
    !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT)
    #defineMBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT0
    #endif

    /*
    *Lengthoftheverifydataforsecurerenegotiation
    */
    #defineMBEDTLS_SSL_VERIFY_DATA_MAX_LEN12

    /*
    *Signalingciphersuitevalues(SCSV)
    */
    #defineMBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO0xFF

    /*
    *SupportedSignatureandHashalgorithms(ForTLS1.2)
    *RFC5246section7.4.1.4.1
    */
    #defineMBEDTLS_SSL_HASH_NONE0
    #defineMBEDTLS_SSL_HASH_MD51
    #defineMBEDTLS_SSL_HASH_SHA12
    #defineMBEDTLS_SSL_HASH_SHA2243
    #defineMBEDTLS_SSL_HASH_SHA2564
    #defineMBEDTLS_SSL_HASH_SHA3845
    #defineMBEDTLS_SSL_HASH_SHA5126

    #defineMBEDTLS_SSL_SIG_ANON0
    #defineMBEDTLS_SSL_SIG_RSA1
    #defineMBEDTLS_SSL_SIG_ECDSA3

    /*
    *TLS1.3signaturealgorithms
    *RFC8446,Section4.2.3
    */

    /*RSASSA-PKCS1-v1_5algorithms*/
    #defineMBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA2560x0401
    #defineMBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA3840x0501
    #defineMBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA5120x0601

    /*ECDSAalgorithms*/
    #defineMBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA2560x0403
    #defineMBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA3840x0503
    #defineMBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA5120x0603

    /*RSASSA-PSSalgorithmswithpublickeyOIDrsaEncryption*/
    #defineMBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA2560x0804
    #defineMBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA3840x0805
    #defineMBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA5120x0806

    /*EdDSAalgorithms*/
    #defineMBEDTLS_TLS1_3_SIG_ED255190x0807
    #defineMBEDTLS_TLS1_3_SIG_ED4480x0808

    /*RSASSA-PSSalgorithmswithpublickeyOIDRSASSA-PSS*/
    #defineMBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA2560x0809
    #defineMBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA3840x080A
    #defineMBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA5120x080B

    /*LEGACYALGORITHMS*/
    #defineMBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA10x0201
    #defineMBEDTLS_TLS1_3_SIG_ECDSA_SHA10x0203

    #defineMBEDTLS_TLS1_3_SIG_NONE0x0

    /*
    *ClientCertificateTypes
    *RFC5246section7.4.4plusRFC4492section5.5
    */
    #defineMBEDTLS_SSL_CERT_TYPE_RSA_SIGN1
    #defineMBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN64

    /*
    *Message,alertandhandshaketypes
    */
    #defineMBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC20
    #defineMBEDTLS_SSL_MSG_ALERT21
    #defineMBEDTLS_SSL_MSG_HANDSHAKE22
    #defineMBEDTLS_SSL_MSG_APPLICATION_DATA23
    #defineMBEDTLS_SSL_MSG_CID25

    #defineMBEDTLS_SSL_ALERT_LEVEL_WARNING1
    #defineMBEDTLS_SSL_ALERT_LEVEL_FATAL2

    #defineMBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY0/*0x00*/
    #defineMBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE10/*0x0A*/
    #defineMBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC20/*0x14*/
    #defineMBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED21/*0x15*/
    #defineMBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW22/*0x16*/
    #defineMBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE30/*0x1E*/
    #defineMBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE40/*0x28*/
    #defineMBEDTLS_SSL_ALERT_MSG_NO_CERT41/*0x29*/
    #defineMBEDTLS_SSL_ALERT_MSG_BAD_CERT42/*0x2A*/
    #defineMBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT43/*0x2B*/
    #defineMBEDTLS_SSL_ALERT_MSG_CERT_REVOKED44/*0x2C*/
    #defineMBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED45/*0x2D*/
    #defineMBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN46/*0x2E*/
    #defineMBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER47/*0x2F*/
    #defineMBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA48/*0x30*/
    #defineMBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED49/*0x31*/
    #defineMBEDTLS_SSL_ALERT_MSG_DECODE_ERROR50/*0x32*/
    #defineMBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR51/*0x33*/
    #defineMBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION60/*0x3C*/
    #defineMBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION70/*0x46*/
    #defineMBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY71/*0x47*/
    #defineMBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR80/*0x50*/
    #defineMBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK86/*0x56*/
    #defineMBEDTLS_SSL_ALERT_MSG_USER_CANCELED90/*0x5A*/
    #defineMBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION100/*0x64*/
    #defineMBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION109/*0x6d--newinTLS1.3*/
    #defineMBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT110/*0x6E*/
    #defineMBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME112/*0x70*/
    #defineMBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY115/*0x73*/
    #defineMBEDTLS_SSL_ALERT_MSG_CERT_REQUIRED116/*0x74*/
    #defineMBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL120/*0x78*/

    #defineMBEDTLS_SSL_HS_HELLO_REQUEST0
    #defineMBEDTLS_SSL_HS_CLIENT_HELLO1
    #defineMBEDTLS_SSL_HS_SERVER_HELLO2
    #defineMBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST3
    #defineMBEDTLS_SSL_HS_NEW_SESSION_TICKET4
    #defineMBEDTLS_SSL_HS_END_OF_EARLY_DATA5
    #defineMBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS8
    #defineMBEDTLS_SSL_HS_CERTIFICATE11
    #defineMBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE12
    #defineMBEDTLS_SSL_HS_CERTIFICATE_REQUEST13
    #defineMBEDTLS_SSL_HS_SERVER_HELLO_DONE14
    #defineMBEDTLS_SSL_HS_CERTIFICATE_VERIFY15
    #defineMBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE16
    #defineMBEDTLS_SSL_HS_FINISHED20
    #defineMBEDTLS_SSL_HS_MESSAGE_HASH254

    /*
    *TLSextensions
    */
    #defineMBEDTLS_TLS_EXT_SERVERNAME0
    #defineMBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME0

    #defineMBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH1

    #defineMBEDTLS_TLS_EXT_TRUNCATED_HMAC4
    #defineMBEDTLS_TLS_EXT_STATUS_REQUEST5/*RFC6066TLS1.2and1.3*/

    #defineMBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES10
    #defineMBEDTLS_TLS_EXT_SUPPORTED_GROUPS10/*RFC8422,7919TLS1.2and1.3*/
    #defineMBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS11

    #defineMBEDTLS_TLS_EXT_SIG_ALG13/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_USE_SRTP14
    #defineMBEDTLS_TLS_EXT_HEARTBEAT15/*RFC6520TLS1.2and1.3*/
    #defineMBEDTLS_TLS_EXT_ALPN16

    #defineMBEDTLS_TLS_EXT_SCT18/*RFC6962TLS1.2and1.3*/
    #defineMBEDTLS_TLS_EXT_CLI_CERT_TYPE19/*RFC7250TLS1.2and1.3*/
    #defineMBEDTLS_TLS_EXT_SERV_CERT_TYPE20/*RFC7250TLS1.2and1.3*/
    #defineMBEDTLS_TLS_EXT_PADDING21/*RFC7685TLS1.2and1.3*/
    #defineMBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC22/*0x16*/
    #defineMBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET0x0017/*23*/

    #defineMBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT28/*RFC8449(implementedforTLS1.3only)*/

    #defineMBEDTLS_TLS_EXT_SESSION_TICKET35

    #defineMBEDTLS_TLS_EXT_PRE_SHARED_KEY41/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_EARLY_DATA42/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_SUPPORTED_VERSIONS43/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_COOKIE44/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES45/*RFC8446TLS1.3*/

    #defineMBEDTLS_TLS_EXT_CERT_AUTH47/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_OID_FILTERS48/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH49/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_SIG_ALG_CERT50/*RFC8446TLS1.3*/
    #defineMBEDTLS_TLS_EXT_KEY_SHARE51/*RFC8446TLS1.3*/

    #ifMBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT==0
    #defineMBEDTLS_TLS_EXT_CID54/*RFC9146DTLS1.2CID*/
    #else
    #defineMBEDTLS_TLS_EXT_CID254/*Pre-RFC9146DTLS1.2CID*/
    #endif

    #defineMBEDTLS_TLS_EXT_ECJPAKE_KKPP256/*experimental*/

    #defineMBEDTLS_TLS_EXT_RENEGOTIATION_INFO0xFF01

    /*
    *Sizedefines
    */
    #if!defined(MBEDTLS_PSK_MAX_LEN)
    /*
    *IfthelibrarysupportsTLS1.3ticketsandtheciphersuite
    *TLS1-3-AES-256-GCM-SHA384,setthePSKmaximumlengthto48insteadof32.
    *Thatway,theTLS1.3clientandserverareabletoresumesessionswhere
    *theciphersuiteisTLS1-3-AES-256-GCM-SHA384(pre-sharedkeysare48
    *byteslonginthatcase).
    */
    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)&&\
    defined(MBEDTLS_SSL_SESSION_TICKETS)&&\
    defined(MBEDTLS_SSL_HAVE_AES)&&defined(MBEDTLS_SSL_HAVE_GCM)&&\
    defined(MBEDTLS_MD_CAN_SHA384)
    #defineMBEDTLS_PSK_MAX_LEN48/*384bits*/
    #else
    #defineMBEDTLS_PSK_MAX_LEN32/*256bits*/
    #endif
    #endif/*!MBEDTLS_PSK_MAX_LEN*/

    /*Dummytypeusedonlyforitssize*/
    unionmbedtls_ssl_premaster_secret{
    unsignedchardummy;/*Maketheunionnon-emptyevenwithSSLdisabled*/
    #ifdefined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
    unsignedchar_pms_rsa[48];/*RFC52468.1.1*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
    unsignedchar_pms_dhm[MBEDTLS_MPI_MAX_SIZE];/*RFC52468.1.2*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)||\
    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)||\
    defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED)||\
    defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
    unsignedchar_pms_ecdh[MBEDTLS_ECP_MAX_BYTES];/*RFC44925.10*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
    unsignedchar_pms_psk[4+2*MBEDTLS_PSK_MAX_LEN];/*RFC42792*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
    unsignedchar_pms_dhe_psk[4+MBEDTLS_MPI_MAX_SIZE
    +MBEDTLS_PSK_MAX_LEN];/*RFC42793*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
    unsignedchar_pms_rsa_psk[52+MBEDTLS_PSK_MAX_LEN];/*RFC42794*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
    unsignedchar_pms_ecdhe_psk[4+MBEDTLS_ECP_MAX_BYTES
    +MBEDTLS_PSK_MAX_LEN];/*RFC54892*/
    #endif
    #ifdefined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
    unsignedchar_pms_ecjpake[32];/*Threadspec:SHA-256output*/
    #endif
    };

    #defineMBEDTLS_PREMASTER_SIZEsizeof(unionmbedtls_ssl_premaster_secret)

    #defineMBEDTLS_TLS1_3_MD_MAX_SIZEPSA_HASH_MAX_SIZE

    /*LengthinnumberofbytesoftheTLSsequencenumber*/
    #defineMBEDTLS_SSL_SEQUENCE_NUMBER_LEN8

    /*Helpertostatethatclient_randomandserver_randomneedtobestored
    *afterthehandshakeiscomplete.Thisisrequiredforcontextserialization
    *andforthekeyingmaterialexporterinTLS1.2.*/
    #ifdefined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)||\
    (defined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT)&&defined(MBEDTLS_SSL_PROTO_TLS1_2))
    #defineMBEDTLS_SSL_KEEP_RANDBYTES
    #endif

    #ifdef__cplusplus
    extern"C"{
    #endif

    /*
    *SSLstatemachine
    */
    typedefenum{
    MBEDTLS_SSL_HELLO_REQUEST,
    MBEDTLS_SSL_CLIENT_HELLO,
    MBEDTLS_SSL_SERVER_HELLO,
    MBEDTLS_SSL_SERVER_CERTIFICATE,
    MBEDTLS_SSL_SERVER_KEY_EXCHANGE,
    MBEDTLS_SSL_CERTIFICATE_REQUEST,
    MBEDTLS_SSL_SERVER_HELLO_DONE,
    MBEDTLS_SSL_CLIENT_CERTIFICATE,
    MBEDTLS_SSL_CLIENT_KEY_EXCHANGE,
    MBEDTLS_SSL_CERTIFICATE_VERIFY,
    MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC,
    MBEDTLS_SSL_CLIENT_FINISHED,
    MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC,
    MBEDTLS_SSL_SERVER_FINISHED,
    MBEDTLS_SSL_FLUSH_BUFFERS,
    MBEDTLS_SSL_HANDSHAKE_WRAPUP,
    MBEDTLS_SSL_NEW_SESSION_TICKET,
    MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT,
    MBEDTLS_SSL_HELLO_RETRY_REQUEST,
    MBEDTLS_SSL_ENCRYPTED_EXTENSIONS,
    MBEDTLS_SSL_END_OF_EARLY_DATA,
    MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY,
    MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED,
    MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO,
    MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO,
    MBEDTLS_SSL_CLIENT_CCS_AFTER_CLIENT_HELLO,
    MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST,
    MBEDTLS_SSL_HANDSHAKE_OVER,
    MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET,
    MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH,
    }
    mbedtls_ssl_states;

    /*
    *Earlydatastatus,clientsideonly.
    */

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)&&defined(MBEDTLS_SSL_CLI_C)
    typedefenum{
    /*
    *Seedocumentationofmbedtls_ssl_get_early_data_status().
    */
    MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_INDICATED,
    MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED,
    MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED,
    }mbedtls_ssl_early_data_status;
    #endif/*MBEDTLS_SSL_EARLY_DATA&&MBEDTLS_SSL_CLI_C*/

    typedefintmbedtls_ssl_send_t(void*ctx,
    constunsignedchar*buf,
    size_tlen);

    typedefintmbedtls_ssl_recv_t(void*ctx,
    unsignedchar*buf,
    size_tlen);

    typedefintmbedtls_ssl_recv_timeout_t(void*ctx,
    unsignedchar*buf,
    size_tlen,
    uint32_ttimeout);
    typedefvoidmbedtls_ssl_set_timer_t(void*ctx,
    uint32_tint_ms,
    uint32_tfin_ms);

    typedefintmbedtls_ssl_get_timer_t(void*ctx);

    /*Definedbelow*/
    typedefstructmbedtls_ssl_sessionmbedtls_ssl_session;
    typedefstructmbedtls_ssl_contextmbedtls_ssl_context;
    typedefstructmbedtls_ssl_configmbedtls_ssl_config;

    /*Definedinlibrary/ssl_misc.h*/
    typedefstructmbedtls_ssl_transformmbedtls_ssl_transform;
    typedefstructmbedtls_ssl_handshake_paramsmbedtls_ssl_handshake_params;
    typedefstructmbedtls_ssl_sig_hash_set_tmbedtls_ssl_sig_hash_set_t;
    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    typedefstructmbedtls_ssl_key_certmbedtls_ssl_key_cert;
    #endif
    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)
    typedefstructmbedtls_ssl_flight_itemmbedtls_ssl_flight_item;
    #endif

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)&&defined(MBEDTLS_SSL_SESSION_TICKETS)
    #defineMBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION\
    MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK/*1U<<0*/
    #defineMBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION\
    MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL/*1U<<2*/
    #defineMBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA(1U<<3)

    #defineMBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK\
    (MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION|\
    MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION|\
    MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA)
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3&&MBEDTLS_SSL_SESSION_TICKETS*/

    typedefintmbedtls_ssl_cache_get_t(void*data,
    unsignedcharconst*session_id,
    size_tsession_id_len,
    mbedtls_ssl_session*session);
    typedefintmbedtls_ssl_cache_set_t(void*data,
    unsignedcharconst*session_id,
    size_tsession_id_len,
    constmbedtls_ssl_session*session);

    #ifdefined(MBEDTLS_SSL_ASYNC_PRIVATE)
    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    typedefintmbedtls_ssl_async_sign_t(mbedtls_ssl_context*ssl,
    mbedtls_x509_crt*cert,
    mbedtls_md_type_tmd_alg,
    constunsignedchar*hash,
    size_thash_len);

    typedefintmbedtls_ssl_async_decrypt_t(mbedtls_ssl_context*ssl,
    mbedtls_x509_crt*cert,
    constunsignedchar*input,
    size_tinput_len);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    typedefintmbedtls_ssl_async_resume_t(mbedtls_ssl_context*ssl,
    unsignedchar*output,
    size_t*output_len,
    size_toutput_size);

    typedefvoidmbedtls_ssl_async_cancel_t(mbedtls_ssl_context*ssl);
    #endif/*MBEDTLS_SSL_ASYNC_PRIVATE*/

    #ifdefined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)&&\
    !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN48
    #ifdefined(MBEDTLS_MD_CAN_SHA256)
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPEMBEDTLS_MD_SHA256
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN32
    #elifdefined(MBEDTLS_MD_CAN_SHA384)
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPEMBEDTLS_MD_SHA384
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN48
    #elifdefined(MBEDTLS_MD_CAN_SHA1)
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPEMBEDTLS_MD_SHA1
    #defineMBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN20
    #else
    /*Thisisalreadycheckedincheck_config.h,butbesure.*/
    #error"Badconfiguration-needSHA-1,SHA-256orSHA-512enabledtocomputedigestofpeerCRT."
    #endif
    #endif/*MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED&&
    !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE*/

    typedefstruct{
    unsignedcharclient_application_traffic_secret_N[MBEDTLS_TLS1_3_MD_MAX_SIZE];
    unsignedcharserver_application_traffic_secret_N[MBEDTLS_TLS1_3_MD_MAX_SIZE];
    unsignedcharexporter_master_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE];
    unsignedcharresumption_master_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE];
    }mbedtls_ssl_tls13_application_secrets;

    #ifdefined(MBEDTLS_SSL_DTLS_SRTP)

    #defineMBEDTLS_TLS_SRTP_MAX_MKI_LENGTH255
    #defineMBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH4
    /*
    *ForcodereadabilityuseatypedefforDTLS-SRTPprofiles
    *
    *Use_srtpextensionprotectionprofilesvaluesasdefinedin
    *http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml
    *
    *Reminder:ifthislistisexpandedmbedtls_ssl_check_srtp_profile_value
    *mustbeupdatedtoo.
    */
    #defineMBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80((uint16_t)0x0001)
    #defineMBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32((uint16_t)0x0002)
    #defineMBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80((uint16_t)0x0005)
    #defineMBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32((uint16_t)0x0006)
    /*Thisoneisnotianadefined,butforcodereadability.*/
    #defineMBEDTLS_TLS_SRTP_UNSET((uint16_t)0x0000)

    typedefuint16_tmbedtls_ssl_srtp_profile;

    typedefstructmbedtls_dtls_srtp_info_t{
    mbedtls_ssl_srtp_profileMBEDTLS_PRIVATE(chosen_dtls_srtp_profile);
    uint16_tMBEDTLS_PRIVATE(mki_len);
    unsignedcharMBEDTLS_PRIVATE(mki_value)[MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH];
    }
    mbedtls_dtls_srtp_info;

    #endif/*MBEDTLS_SSL_DTLS_SRTP*/

    typedefenum{
    MBEDTLS_SSL_VERSION_UNKNOWN,
    MBEDTLS_SSL_VERSION_TLS1_2=0x0303,
    MBEDTLS_SSL_VERSION_TLS1_3=0x0304,
    }mbedtls_ssl_protocol_version;

    /*
    *Thisstructureisusedforstoringcurrentsessiondata.
    *
    *Note:whenchangingthisdefinition,weneedtocheckandupdate:
    *-intests/suites/test_suite_ssl.function:
    *ssl_populate_session()andssl_serialize_session_save_load()
    *-inlibrary/ssl_tls.c:
    *mbedtls_ssl_session_init()andmbedtls_ssl_session_free()
    *mbedtls_ssl_session_save()andssl_session_load()
    *ssl_session_copy()
    */
    structmbedtls_ssl_session{
    #ifdefined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
    unsignedcharMBEDTLS_PRIVATE(mfl_code);
    #endif/*MBEDTLS_SSL_MAX_FRAGMENT_LENGTH*/

    #ifdefined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
    uint16_tMBEDTLS_PRIVATE(record_size_limit);
    #endif/*MBEDTLS_SSL_RECORD_SIZE_LIMIT*/

    unsignedcharMBEDTLS_PRIVATE(exported);
    uint8_tMBEDTLS_PRIVATE(endpoint);

    mbedtls_ssl_protocol_versionMBEDTLS_PRIVATE(tls_version);

    #ifdefined(MBEDTLS_HAVE_TIME)
    mbedtls_time_tMBEDTLS_PRIVATE(start);
    #endif
    intMBEDTLS_PRIVATE(ciphersuite);
    size_tMBEDTLS_PRIVATE(id_len);
    unsignedcharMBEDTLS_PRIVATE(id)[32];
    unsignedcharMBEDTLS_PRIVATE(master)[48];

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    #ifdefined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
    mbedtls_x509_crt*MBEDTLS_PRIVATE(peer_cert);
    #else/*MBEDTLS_SSL_KEEP_PEER_CERTIFICATE*/
    unsignedchar*MBEDTLS_PRIVATE(peer_cert_digest);
    size_tMBEDTLS_PRIVATE(peer_cert_digest_len);
    mbedtls_md_type_tMBEDTLS_PRIVATE(peer_cert_digest_type);
    #endif/*!MBEDTLS_SSL_KEEP_PEER_CERTIFICATE*/
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/
    uint32_tMBEDTLS_PRIVATE(verify_result);

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&defined(MBEDTLS_SSL_CLI_C)
    unsignedchar*MBEDTLS_PRIVATE(ticket);
    size_tMBEDTLS_PRIVATE(ticket_len);
    uint32_tMBEDTLS_PRIVATE(ticket_lifetime);
    #endif/*MBEDTLS_SSL_SESSION_TICKETS&&MBEDTLS_SSL_CLI_C*/

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&defined(MBEDTLS_SSL_SRV_C)&&\
    defined(MBEDTLS_HAVE_TIME)
    mbedtls_ms_time_tMBEDTLS_PRIVATE(ticket_creation_time);
    #endif

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)&&defined(MBEDTLS_SSL_SESSION_TICKETS)
    uint32_tMBEDTLS_PRIVATE(ticket_age_add);
    uint8_tMBEDTLS_PRIVATE(ticket_flags);
    uint8_tMBEDTLS_PRIVATE(resumption_key_len);
    unsignedcharMBEDTLS_PRIVATE(resumption_key)[MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN];

    #ifdefined(MBEDTLS_SSL_SERVER_NAME_INDICATION)&&defined(MBEDTLS_SSL_CLI_C)
    char*MBEDTLS_PRIVATE(hostname);
    #endif/*MBEDTLS_SSL_SERVER_NAME_INDICATION&&MBEDTLS_SSL_CLI_C*/

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)&&defined(MBEDTLS_SSL_ALPN)&&defined(MBEDTLS_SSL_SRV_C)
    char*ticket_alpn;
    #endif

    #ifdefined(MBEDTLS_HAVE_TIME)&&defined(MBEDTLS_SSL_CLI_C)
    mbedtls_ms_time_tMBEDTLS_PRIVATE(ticket_reception_time);
    #endif
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3&&MBEDTLS_SSL_SESSION_TICKETS*/

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)
    uint32_tMBEDTLS_PRIVATE(max_early_data_size);
    #endif

    #ifdefined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
    intMBEDTLS_PRIVATE(encrypt_then_mac);
    #endif

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)
    mbedtls_ssl_tls13_application_secretsMBEDTLS_PRIVATE(app_secrets);
    #endif
    };

    /*
    *IdentifiersforPRFsusedinvariousversionsofTLS.
    */
    typedefenum{
    MBEDTLS_SSL_TLS_PRF_NONE,
    MBEDTLS_SSL_TLS_PRF_SHA384,
    MBEDTLS_SSL_TLS_PRF_SHA256,
    MBEDTLS_SSL_HKDF_EXPAND_SHA384,
    MBEDTLS_SSL_HKDF_EXPAND_SHA256
    }
    mbedtls_tls_prf_types;

    typedefenum{
    MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET=0,
    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)
    MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET,
    MBEDTLS_SSL_KEY_EXPORT_TLS1_3_EARLY_EXPORTER_SECRET,
    MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET,
    MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET,
    MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET,
    MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET,
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3*/
    }mbedtls_ssl_key_export_type;

    typedefvoidmbedtls_ssl_export_keys_t(void*p_expkey,
    mbedtls_ssl_key_export_typetype,
    constunsignedchar*secret,
    size_tsecret_len,
    constunsignedcharclient_random[32],
    constunsignedcharserver_random[32],
    mbedtls_tls_prf_typestls_prf_type);

    #ifdefined(MBEDTLS_SSL_SRV_C)
    typedefint(*mbedtls_ssl_hs_cb_t)(mbedtls_ssl_context*ssl);
    #endif

    /*Atypeforstoringuserdatainalibrarystructure.
    *
    *Therepresentationoftypemaychangeinfutureversionsofthelibrary.
    *Onlythebehaviorsguaranteedbydocumentedaccessorfunctionsare
    *guaranteedtoremainstable.
    */
    typedefunion{
    uintptr_tn;/*typicallyahandletoanassociatedobject*/
    void*p;/*typicallyapointertoextradata*/
    }mbedtls_ssl_user_data_t;

    structmbedtls_ssl_config{
    /*Groupitemsmostlybysize.Thishelpstoreducememorywastedto
    *padding.Italsohelpstokeepsmallerfieldsearlyinthestructure,
    *sothatelementstendtobeinthe128-elementdirectaccesswindow
    *onArmThumb,whichreducesthecodesize.*/

    mbedtls_ssl_protocol_versionMBEDTLS_PRIVATE(max_tls_version);
    mbedtls_ssl_protocol_versionMBEDTLS_PRIVATE(min_tls_version);

    /*
    *Flags(couldbebit-fieldstosaveRAM,butseparatebytesmake
    *thecodesmalleronarchitectureswithaninstructionfordirect
    *byteaccess).
    */

    uint8_tMBEDTLS_PRIVATE(endpoint);
    uint8_tMBEDTLS_PRIVATE(transport);
    uint8_tMBEDTLS_PRIVATE(authmode);
    /*neededevenwithrenegodisabledforLEGACY_BREAK_HANDSHAKE*/
    uint8_tMBEDTLS_PRIVATE(allow_legacy_renegotiation);
    #ifdefined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
    uint8_tMBEDTLS_PRIVATE(mfl_code);
    #endif
    #ifdefined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
    uint8_tMBEDTLS_PRIVATE(encrypt_then_mac);
    #endif
    #ifdefined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
    uint8_tMBEDTLS_PRIVATE(extended_ms);
    #endif
    #ifdefined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
    uint8_tMBEDTLS_PRIVATE(anti_replay);
    #endif
    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    uint8_tMBEDTLS_PRIVATE(disable_renegotiation);
    #endif
    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&\
    defined(MBEDTLS_SSL_CLI_C)
    uint8_tMBEDTLS_PRIVATE(session_tickets);
    #endif

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&\
    defined(MBEDTLS_SSL_SRV_C)&&\
    defined(MBEDTLS_SSL_PROTO_TLS1_3)
    uint16_tMBEDTLS_PRIVATE(new_session_tickets_count);
    #endif

    #ifdefined(MBEDTLS_SSL_SRV_C)
    uint8_tMBEDTLS_PRIVATE(cert_req_ca_list);
    uint8_tMBEDTLS_PRIVATE(respect_cli_pref);
    #endif
    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    uint8_tMBEDTLS_PRIVATE(ignore_unexpected_cid);
    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/
    #ifdefined(MBEDTLS_SSL_DTLS_SRTP)
    uint8_tMBEDTLS_PRIVATE(dtls_srtp_mki_support);/*supporthavingmki_value
    intheuse_srtpextension?*/
    #endif

    /*
    *Pointers
    */

    constint*MBEDTLS_PRIVATE(ciphersuite_list);

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)
    intMBEDTLS_PRIVATE(tls13_kex_modes);
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3*/

    void(*MBEDTLS_PRIVATE(f_dbg))(void*,int,constchar*,int,constchar*);
    void*MBEDTLS_PRIVATE(p_dbg);

    int(*MBEDTLS_PRIVATE(f_rng))(void*,unsignedchar*,size_t);
    void*MBEDTLS_PRIVATE(p_rng);

    mbedtls_ssl_cache_get_t*MBEDTLS_PRIVATE(f_get_cache);
    mbedtls_ssl_cache_set_t*MBEDTLS_PRIVATE(f_set_cache);
    void*MBEDTLS_PRIVATE(p_cache);

    #ifdefined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
    int(*MBEDTLS_PRIVATE(f_sni))(void*,mbedtls_ssl_context*,constunsignedchar*,size_t);
    void*MBEDTLS_PRIVATE(p_sni);
    #endif

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    int(*MBEDTLS_PRIVATE(f_vrfy))(void*,mbedtls_x509_crt*,int,uint32_t*);
    void*MBEDTLS_PRIVATE(p_vrfy);
    #endif

    #ifdefined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
    #ifdefined(MBEDTLS_SSL_SRV_C)
    int(*MBEDTLS_PRIVATE(f_psk))(void*,mbedtls_ssl_context*,constunsignedchar*,size_t);
    void*MBEDTLS_PRIVATE(p_psk);
    #endif
    #endif

    #ifdefined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)&&defined(MBEDTLS_SSL_SRV_C)
    int(*MBEDTLS_PRIVATE(f_cookie_write))(void*,unsignedchar**,unsignedchar*,
    constunsignedchar*,size_t);
    int(*MBEDTLS_PRIVATE(f_cookie_check))(void*,constunsignedchar*,size_t,
    constunsignedchar*,size_t);
    void*MBEDTLS_PRIVATE(p_cookie);
    #endif

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&defined(MBEDTLS_SSL_SRV_C)
    int(*MBEDTLS_PRIVATE(f_ticket_write))(void*,constmbedtls_ssl_session*,
    unsignedchar*,constunsignedchar*,size_t*,
    uint32_t*);
    int(*MBEDTLS_PRIVATE(f_ticket_parse))(void*,mbedtls_ssl_session*,unsignedchar*,size_t);
    void*MBEDTLS_PRIVATE(p_ticket);
    #endif/*MBEDTLS_SSL_SESSION_TICKETS&&MBEDTLS_SSL_SRV_C*/
    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    size_tMBEDTLS_PRIVATE(cid_len);
    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    constmbedtls_x509_crt_profile*MBEDTLS_PRIVATE(cert_profile);
    mbedtls_ssl_key_cert*MBEDTLS_PRIVATE(key_cert);
    mbedtls_x509_crt*MBEDTLS_PRIVATE(ca_chain);
    mbedtls_x509_crl*MBEDTLS_PRIVATE(ca_crl);
    #ifdefined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
    mbedtls_x509_crt_ca_cb_tMBEDTLS_PRIVATE(f_ca_cb);
    void*MBEDTLS_PRIVATE(p_ca_cb);
    #endif/*MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK*/
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    #ifdefined(MBEDTLS_SSL_ASYNC_PRIVATE)
    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    mbedtls_ssl_async_sign_t*MBEDTLS_PRIVATE(f_async_sign_start);
    mbedtls_ssl_async_decrypt_t*MBEDTLS_PRIVATE(f_async_decrypt_start);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/
    mbedtls_ssl_async_resume_t*MBEDTLS_PRIVATE(f_async_resume);
    mbedtls_ssl_async_cancel_t*MBEDTLS_PRIVATE(f_async_cancel);
    void*MBEDTLS_PRIVATE(p_async_config_data);
    #endif/*MBEDTLS_SSL_ASYNC_PRIVATE*/

    #ifdefined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)

    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    constint*MBEDTLS_PRIVATE(sig_hashes);
    #endif
    constuint16_t*MBEDTLS_PRIVATE(sig_algs);
    #endif/*MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED*/

    #ifdefined(MBEDTLS_ECP_C)&&!defined(MBEDTLS_DEPRECATED_REMOVED)
    constmbedtls_ecp_group_id*MBEDTLS_PRIVATE(curve_list);
    #endif

    constuint16_t*MBEDTLS_PRIVATE(group_list);

    #ifdefined(MBEDTLS_DHM_C)
    mbedtls_mpiMBEDTLS_PRIVATE(dhm_P);
    mbedtls_mpiMBEDTLS_PRIVATE(dhm_G);
    #endif

    #ifdefined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)

    #ifdefined(MBEDTLS_USE_PSA_CRYPTO)
    mbedtls_svc_key_id_tMBEDTLS_PRIVATE(psk_opaque);
    #endif/*MBEDTLS_USE_PSA_CRYPTO*/
    unsignedchar*MBEDTLS_PRIVATE(psk);
    size_tMBEDTLS_PRIVATE(psk_len);

    unsignedchar*MBEDTLS_PRIVATE(psk_identity);
    size_tMBEDTLS_PRIVATE(psk_identity_len);
    #endif/*MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED*/

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)
    intMBEDTLS_PRIVATE(early_data_enabled);

    #ifdefined(MBEDTLS_SSL_SRV_C)
    /*Themaximumamountof0-RTTdata.RFC8446section4.6.1*/
    uint32_tMBEDTLS_PRIVATE(max_early_data_size);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #endif/*MBEDTLS_SSL_EARLY_DATA*/

    #ifdefined(MBEDTLS_SSL_ALPN)
    constchar**MBEDTLS_PRIVATE(alpn_list);
    #endif

    #ifdefined(MBEDTLS_SSL_DTLS_SRTP)
    constmbedtls_ssl_srtp_profile*MBEDTLS_PRIVATE(dtls_srtp_profile_list);
    size_tMBEDTLS_PRIVATE(dtls_srtp_profile_list_len);
    #endif/*MBEDTLS_SSL_DTLS_SRTP*/

    /*
    *Numericalsettings(int)
    */

    uint32_tMBEDTLS_PRIVATE(read_timeout);

    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)
    uint32_tMBEDTLS_PRIVATE(hs_timeout_min);
    uint32_tMBEDTLS_PRIVATE(hs_timeout_max);
    #endif

    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    intMBEDTLS_PRIVATE(renego_max_records);
    unsignedcharMBEDTLS_PRIVATE(renego_period)[8];
    #endif

    unsignedintMBEDTLS_PRIVATE(badmac_limit);

    #ifdefined(MBEDTLS_DHM_C)&&defined(MBEDTLS_SSL_CLI_C)
    unsignedintMBEDTLS_PRIVATE(dhm_min_bitlen);
    #endif

    mbedtls_ssl_user_data_tMBEDTLS_PRIVATE(user_data);

    #ifdefined(MBEDTLS_SSL_SRV_C)
    mbedtls_ssl_hs_cb_tMBEDTLS_PRIVATE(f_cert_cb);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #ifdefined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
    constmbedtls_x509_crt*MBEDTLS_PRIVATE(dn_hints);
    #endif
    };

    structmbedtls_ssl_context{
    constmbedtls_ssl_config*MBEDTLS_PRIVATE(conf);

    /*
    *Miscellaneous
    */
    intMBEDTLS_PRIVATE(state);
    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    intMBEDTLS_PRIVATE(renego_status);
    intMBEDTLS_PRIVATE(renego_records_seen);
    #endif/*MBEDTLS_SSL_RENEGOTIATION*/

    mbedtls_ssl_protocol_versionMBEDTLS_PRIVATE(tls_version);

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)&&defined(MBEDTLS_SSL_CLI_C)
    intMBEDTLS_PRIVATE(early_data_state);
    #endif

    unsignedMBEDTLS_PRIVATE(badmac_seen_or_in_hsfraglen);

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    int(*MBEDTLS_PRIVATE(f_vrfy))(void*,mbedtls_x509_crt*,int,uint32_t*);
    void*MBEDTLS_PRIVATE(p_vrfy);
    #endif

    mbedtls_ssl_send_t*MBEDTLS_PRIVATE(f_send);
    mbedtls_ssl_recv_t*MBEDTLS_PRIVATE(f_recv);
    mbedtls_ssl_recv_timeout_t*MBEDTLS_PRIVATE(f_recv_timeout);

    void*MBEDTLS_PRIVATE(p_bio);

    /*
    *Sessionlayer
    */
    mbedtls_ssl_session*MBEDTLS_PRIVATE(session_in);
    mbedtls_ssl_session*MBEDTLS_PRIVATE(session_out);
    mbedtls_ssl_session*MBEDTLS_PRIVATE(session);
    mbedtls_ssl_session*MBEDTLS_PRIVATE(session_negotiate);

    mbedtls_ssl_handshake_params*MBEDTLS_PRIVATE(handshake);

    /*
    *Recordlayertransformations
    */
    mbedtls_ssl_transform*MBEDTLS_PRIVATE(transform_in);
    mbedtls_ssl_transform*MBEDTLS_PRIVATE(transform_out);
    mbedtls_ssl_transform*MBEDTLS_PRIVATE(transform);
    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_2)
    mbedtls_ssl_transform*MBEDTLS_PRIVATE(transform_negotiate);
    #endif/*MBEDTLS_SSL_PROTO_TLS1_2*/

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)
    mbedtls_ssl_transform*MBEDTLS_PRIVATE(transform_application);
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3*/

    /*
    *Timers
    */
    void*MBEDTLS_PRIVATE(p_timer);

    mbedtls_ssl_set_timer_t*MBEDTLS_PRIVATE(f_set_timer);
    mbedtls_ssl_get_timer_t*MBEDTLS_PRIVATE(f_get_timer);

    /*
    *Recordlayer(incomingdata)
    */
    unsignedchar*MBEDTLS_PRIVATE(in_buf);
    unsignedchar*MBEDTLS_PRIVATE(in_ctr);
    unsignedchar*MBEDTLS_PRIVATE(in_hdr);
    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    unsignedchar*MBEDTLS_PRIVATE(in_cid);
    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/
    unsignedchar*MBEDTLS_PRIVATE(in_len);
    unsignedchar*MBEDTLS_PRIVATE(in_iv);
    unsignedchar*MBEDTLS_PRIVATE(in_msg);
    unsignedchar*MBEDTLS_PRIVATE(in_offt);

    intMBEDTLS_PRIVATE(in_msgtype);
    size_tMBEDTLS_PRIVATE(in_msglen);
    size_tMBEDTLS_PRIVATE(in_left);
    #ifdefined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
    size_tMBEDTLS_PRIVATE(in_buf_len);
    #endif
    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)
    uint16_tMBEDTLS_PRIVATE(in_epoch);
    size_tMBEDTLS_PRIVATE(next_record_offset);
    #endif/*MBEDTLS_SSL_PROTO_DTLS*/
    #ifdefined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
    uint64_tMBEDTLS_PRIVATE(in_window_top);
    uint64_tMBEDTLS_PRIVATE(in_window);
    #endif/*MBEDTLS_SSL_DTLS_ANTI_REPLAY*/

    size_tMBEDTLS_PRIVATE(in_hslen);
    intMBEDTLS_PRIVATE(nb_zero);

    intMBEDTLS_PRIVATE(keep_current_message);

    /*Thefollowingthreevariablesindicateifand,ifyes,
    *whatkindofalertispendingtobesent.
    */
    unsignedcharMBEDTLS_PRIVATE(send_alert);
    unsignedcharMBEDTLS_PRIVATE(alert_type);
    intMBEDTLS_PRIVATE(alert_reason);

    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)
    uint8_tMBEDTLS_PRIVATE(disable_datagram_packing);
    #endif/*MBEDTLS_SSL_PROTO_DTLS*/

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)
    #ifdefined(MBEDTLS_SSL_SRV_C)
    /*
    *Oneof:
    *MBEDTLS_SSL_EARLY_DATA_NO_DISCARD
    *MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD
    *MBEDTLS_SSL_EARLY_DATA_DISCARD
    */
    uint8_tMBEDTLS_PRIVATE(discard_early_data_record);
    #endif
    uint32_tMBEDTLS_PRIVATE(total_early_data_size);
    #endif/*MBEDTLS_SSL_EARLY_DATA*/

    /*
    *Recordlayer(outgoingdata)
    */
    unsignedchar*MBEDTLS_PRIVATE(out_buf);
    unsignedchar*MBEDTLS_PRIVATE(out_ctr);
    unsignedchar*MBEDTLS_PRIVATE(out_hdr);
    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    unsignedchar*MBEDTLS_PRIVATE(out_cid);
    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/
    unsignedchar*MBEDTLS_PRIVATE(out_len);
    unsignedchar*MBEDTLS_PRIVATE(out_iv);
    unsignedchar*MBEDTLS_PRIVATE(out_msg);

    intMBEDTLS_PRIVATE(out_msgtype);
    size_tMBEDTLS_PRIVATE(out_msglen);
    size_tMBEDTLS_PRIVATE(out_left);
    #ifdefined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
    size_tMBEDTLS_PRIVATE(out_buf_len);
    #endif

    unsignedcharMBEDTLS_PRIVATE(cur_out_ctr)[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN];

    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)
    uint16_tMBEDTLS_PRIVATE(mtu);
    #endif/*MBEDTLS_SSL_PROTO_DTLS*/

    /*
    *Usersettings
    */
    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    char*MBEDTLS_PRIVATE(hostname);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    #ifdefined(MBEDTLS_SSL_ALPN)
    constchar*MBEDTLS_PRIVATE(alpn_chosen);
    #endif/*MBEDTLS_SSL_ALPN*/

    #ifdefined(MBEDTLS_SSL_DTLS_SRTP)
    /*
    *use_srtpextension
    */
    mbedtls_dtls_srtp_infoMBEDTLS_PRIVATE(dtls_srtp_info);
    #endif/*MBEDTLS_SSL_DTLS_SRTP*/

    /*
    *InformationforDTLShelloverify
    */
    #ifdefined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)&&defined(MBEDTLS_SSL_SRV_C)
    unsignedchar*MBEDTLS_PRIVATE(cli_id);
    size_tMBEDTLS_PRIVATE(cli_id_len);
    #endif/*MBEDTLS_SSL_DTLS_HELLO_VERIFY&&MBEDTLS_SSL_SRV_C*/

    /*
    *Securerenegotiation
    */
    /*neededtoknowwhentosendextensiononserver*/
    intMBEDTLS_PRIVATE(secure_renegotiation);
    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    size_tMBEDTLS_PRIVATE(verify_data_len);
    charMBEDTLS_PRIVATE(own_verify_data)[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN];
    charMBEDTLS_PRIVATE(peer_verify_data)[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN];
    #endif/*MBEDTLS_SSL_RENEGOTIATION*/

    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    /*CIDconfigurationtouseinsubsequenthandshakes.*/

    unsignedcharMBEDTLS_PRIVATE(own_cid)[MBEDTLS_SSL_CID_IN_LEN_MAX];
    uint8_tMBEDTLS_PRIVATE(own_cid_len);
    uint8_tMBEDTLS_PRIVATE(negotiate_cid);
    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/

    mbedtls_ssl_export_keys_t*MBEDTLS_PRIVATE(f_export_keys);
    void*MBEDTLS_PRIVATE(p_export_keys);

    mbedtls_ssl_user_data_tMBEDTLS_PRIVATE(user_data);
    };

    constchar*mbedtls_ssl_get_ciphersuite_name(constintciphersuite_id);

    intmbedtls_ssl_get_ciphersuite_id(constchar*ciphersuite_name);

    voidmbedtls_ssl_init(mbedtls_ssl_context*ssl);

    intmbedtls_ssl_setup(mbedtls_ssl_context*ssl,
    constmbedtls_ssl_config*conf);

    intmbedtls_ssl_session_reset(mbedtls_ssl_context*ssl);

    voidmbedtls_ssl_conf_endpoint(mbedtls_ssl_config*conf,intendpoint);

    staticinlineintmbedtls_ssl_conf_get_endpoint(constmbedtls_ssl_config*conf)
    {
    returnconf->MBEDTLS_PRIVATE(endpoint);
    }

    voidmbedtls_ssl_conf_transport(mbedtls_ssl_config*conf,inttransport);

    voidmbedtls_ssl_conf_authmode(mbedtls_ssl_config*conf,intauthmode);

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)
    voidmbedtls_ssl_conf_early_data(mbedtls_ssl_config*conf,
    intearly_data_enabled);

    #ifdefined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_max_early_data_size(
    mbedtls_ssl_config*conf,uint32_tmax_early_data_size);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #endif/*MBEDTLS_SSL_EARLY_DATA*/

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    voidmbedtls_ssl_conf_verify(mbedtls_ssl_config*conf,
    int(*f_vrfy)(void*,mbedtls_x509_crt*,int,uint32_t*),
    void*p_vrfy);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    voidmbedtls_ssl_conf_rng(mbedtls_ssl_config*conf,
    mbedtls_f_rng_t*f_rng,
    void*p_rng);

    voidmbedtls_ssl_conf_dbg(mbedtls_ssl_config*conf,
    void(*f_dbg)(void*,int,constchar*,int,constchar*),
    void*p_dbg);

    staticinlineconstmbedtls_ssl_config*mbedtls_ssl_context_get_config(
    constmbedtls_ssl_context*ssl)
    {
    returnssl->MBEDTLS_PRIVATE(conf);
    }

    voidmbedtls_ssl_set_bio(mbedtls_ssl_context*ssl,
    void*p_bio,
    mbedtls_ssl_send_t*f_send,
    mbedtls_ssl_recv_t*f_recv,
    mbedtls_ssl_recv_timeout_t*f_recv_timeout);

    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)

    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)

    intmbedtls_ssl_set_cid(mbedtls_ssl_context*ssl,
    intenable,
    unsignedcharconst*own_cid,
    size_town_cid_len);

    intmbedtls_ssl_get_own_cid(mbedtls_ssl_context*ssl,
    int*enabled,
    unsignedcharown_cid[MBEDTLS_SSL_CID_IN_LEN_MAX],
    size_t*own_cid_len);

    intmbedtls_ssl_get_peer_cid(mbedtls_ssl_context*ssl,
    int*enabled,
    unsignedcharpeer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
    size_t*peer_cid_len);

    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/

    voidmbedtls_ssl_set_mtu(mbedtls_ssl_context*ssl,uint16_tmtu);
    #endif/*MBEDTLS_SSL_PROTO_DTLS*/

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    voidmbedtls_ssl_set_verify(mbedtls_ssl_context*ssl,
    int(*f_vrfy)(void*,mbedtls_x509_crt*,int,uint32_t*),
    void*p_vrfy);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    voidmbedtls_ssl_conf_read_timeout(mbedtls_ssl_config*conf,uint32_ttimeout);

    intmbedtls_ssl_check_record(mbedtls_ssl_contextconst*ssl,
    unsignedchar*buf,
    size_tbuflen);

    voidmbedtls_ssl_set_timer_cb(mbedtls_ssl_context*ssl,
    void*p_timer,
    mbedtls_ssl_set_timer_t*f_set_timer,
    mbedtls_ssl_get_timer_t*f_get_timer);

    #ifdefined(MBEDTLS_SSL_SRV_C)
    staticinlinevoidmbedtls_ssl_conf_cert_cb(mbedtls_ssl_config*conf,
    mbedtls_ssl_hs_cb_tf_cert_cb)
    {
    conf->MBEDTLS_PRIVATE(f_cert_cb)=f_cert_cb;
    }
    #endif/*MBEDTLS_SSL_SRV_C*/

    typedefintmbedtls_ssl_ticket_write_t(void*p_ticket,
    constmbedtls_ssl_session*session,
    unsignedchar*start,
    constunsignedchar*end,
    size_t*tlen,
    uint32_t*lifetime);

    typedefintmbedtls_ssl_ticket_parse_t(void*p_ticket,
    mbedtls_ssl_session*session,
    unsignedchar*buf,
    size_tlen);

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&defined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config*conf,
    mbedtls_ssl_ticket_write_t*f_ticket_write,
    mbedtls_ssl_ticket_parse_t*f_ticket_parse,
    void*p_ticket);

    #ifdefined(MBEDTLS_HAVE_TIME)
    staticinlineintmbedtls_ssl_session_get_ticket_creation_time(
    mbedtls_ssl_session*session,mbedtls_ms_time_t*ticket_creation_time)
    {
    if(session==NULL||ticket_creation_time==NULL||
    session->MBEDTLS_PRIVATE(endpoint)!=MBEDTLS_SSL_IS_SERVER){
    returnMBEDTLS_ERR_SSL_BAD_INPUT_DATA;
    }

    *ticket_creation_time=session->MBEDTLS_PRIVATE(ticket_creation_time);

    return0;
    }
    #endif/*MBEDTLS_HAVE_TIME*/
    #endif/*MBEDTLS_SSL_SESSION_TICKETS&&MBEDTLS_SSL_SRV_C*/

    staticinlineunsignedconstchar(*mbedtls_ssl_session_get_id(constmbedtls_ssl_session*
    session))[32]
    {
    return&session->MBEDTLS_PRIVATE(id);
    }

    staticinlinesize_tmbedtls_ssl_session_get_id_len(constmbedtls_ssl_session*session)
    {
    returnsession->MBEDTLS_PRIVATE(id_len);
    }

    staticinlineintmbedtls_ssl_session_get_ciphersuite_id(constmbedtls_ssl_session*session)
    {
    returnsession->MBEDTLS_PRIVATE(ciphersuite);
    }

    voidmbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context*ssl,
    mbedtls_ssl_export_keys_t*f_export_keys,
    void*p_export_keys);

    staticinlinevoidmbedtls_ssl_conf_set_user_data_p(
    mbedtls_ssl_config*conf,
    void*p)
    {
    conf->MBEDTLS_PRIVATE(user_data).p=p;
    }

    staticinlinevoidmbedtls_ssl_conf_set_user_data_n(
    mbedtls_ssl_config*conf,
    uintptr_tn)
    {
    conf->MBEDTLS_PRIVATE(user_data).n=n;
    }

    staticinlinevoid*mbedtls_ssl_conf_get_user_data_p(
    mbedtls_ssl_config*conf)
    {
    returnconf->MBEDTLS_PRIVATE(user_data).p;
    }

    staticinlineuintptr_tmbedtls_ssl_conf_get_user_data_n(
    mbedtls_ssl_config*conf)
    {
    returnconf->MBEDTLS_PRIVATE(user_data).n;
    }

    staticinlinevoidmbedtls_ssl_set_user_data_p(
    mbedtls_ssl_context*ssl,
    void*p)
    {
    ssl->MBEDTLS_PRIVATE(user_data).p=p;
    }

    staticinlinevoidmbedtls_ssl_set_user_data_n(
    mbedtls_ssl_context*ssl,
    uintptr_tn)
    {
    ssl->MBEDTLS_PRIVATE(user_data).n=n;
    }

    staticinlinevoid*mbedtls_ssl_get_user_data_p(
    mbedtls_ssl_context*ssl)
    {
    returnssl->MBEDTLS_PRIVATE(user_data).p;
    }

    staticinlineuintptr_tmbedtls_ssl_get_user_data_n(
    mbedtls_ssl_context*ssl)
    {
    returnssl->MBEDTLS_PRIVATE(user_data).n;
    }

    #ifdefined(MBEDTLS_SSL_ASYNC_PRIVATE)
    voidmbedtls_ssl_conf_async_private_cb(mbedtls_ssl_config*conf,
    mbedtls_ssl_async_sign_t*f_async_sign,
    mbedtls_ssl_async_decrypt_t*f_async_decrypt,
    mbedtls_ssl_async_resume_t*f_async_resume,
    mbedtls_ssl_async_cancel_t*f_async_cancel,
    void*config_data);

    void*mbedtls_ssl_conf_get_async_config_data(constmbedtls_ssl_config*conf);

    void*mbedtls_ssl_get_async_operation_data(constmbedtls_ssl_context*ssl);

    voidmbedtls_ssl_set_async_operation_data(mbedtls_ssl_context*ssl,
    void*ctx);
    #endif/*MBEDTLS_SSL_ASYNC_PRIVATE*/

    typedefintmbedtls_ssl_cookie_write_t(void*ctx,
    unsignedchar**p,unsignedchar*end,
    constunsignedchar*info,size_tilen);

    typedefintmbedtls_ssl_cookie_check_t(void*ctx,
    constunsignedchar*cookie,size_tclen,
    constunsignedchar*info,size_tilen);

    #ifdefined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)&&defined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config*conf,
    mbedtls_ssl_cookie_write_t*f_cookie_write,
    mbedtls_ssl_cookie_check_t*f_cookie_check,
    void*p_cookie);

    intmbedtls_ssl_set_client_transport_id(mbedtls_ssl_context*ssl,
    constunsignedchar*info,
    size_tilen);

    #endif/*MBEDTLS_SSL_DTLS_HELLO_VERIFY&&MBEDTLS_SSL_SRV_C*/

    #ifdefined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
    voidmbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config*conf,charmode);
    #endif/*MBEDTLS_SSL_DTLS_ANTI_REPLAY*/

    voidmbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config*conf,unsignedlimit);

    #ifdefined(MBEDTLS_SSL_PROTO_DTLS)

    voidmbedtls_ssl_set_datagram_packing(mbedtls_ssl_context*ssl,
    unsignedallow_packing);

    voidmbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config*conf,uint32_tmin,uint32_tmax);
    #endif/*MBEDTLS_SSL_PROTO_DTLS*/

    #ifdefined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_session_cache(mbedtls_ssl_config*conf,
    void*p_cache,
    mbedtls_ssl_cache_get_t*f_get_cache,
    mbedtls_ssl_cache_set_t*f_set_cache);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #ifdefined(MBEDTLS_SSL_CLI_C)
    intmbedtls_ssl_set_session(mbedtls_ssl_context*ssl,constmbedtls_ssl_session*session);
    #endif/*MBEDTLS_SSL_CLI_C*/

    intmbedtls_ssl_session_load(mbedtls_ssl_session*session,
    constunsignedchar*buf,
    size_tlen);

    intmbedtls_ssl_session_save(constmbedtls_ssl_session*session,
    unsignedchar*buf,
    size_tbuf_len,
    size_t*olen);

    voidmbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config*conf,
    constint*ciphersuites);

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)

    voidmbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config*conf,
    constintkex_modes);
    #endif/*MBEDTLS_SSL_PROTO_TLS1_3*/

    #ifdefined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    #defineMBEDTLS_SSL_UNEXPECTED_CID_IGNORE0
    #defineMBEDTLS_SSL_UNEXPECTED_CID_FAIL1
    intmbedtls_ssl_conf_cid(mbedtls_ssl_config*conf,size_tlen,
    intignore_other_cids);
    #endif/*MBEDTLS_SSL_DTLS_CONNECTION_ID*/

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    voidmbedtls_ssl_conf_cert_profile(mbedtls_ssl_config*conf,
    constmbedtls_x509_crt_profile*profile);

    voidmbedtls_ssl_conf_ca_chain(mbedtls_ssl_config*conf,
    mbedtls_x509_crt*ca_chain,
    mbedtls_x509_crl*ca_crl);

    #ifdefined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
    staticinline
    voidmbedtls_ssl_conf_dn_hints(mbedtls_ssl_config*conf,
    constmbedtls_x509_crt*crt)
    {
    conf->MBEDTLS_PRIVATE(dn_hints)=crt;
    }
    #endif/*MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED*/

    #ifdefined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
    voidmbedtls_ssl_conf_ca_cb(mbedtls_ssl_config*conf,
    mbedtls_x509_crt_ca_cb_tf_ca_cb,
    void*p_ca_cb);
    #endif/*MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK*/

    intmbedtls_ssl_conf_own_cert(mbedtls_ssl_config*conf,
    mbedtls_x509_crt*own_cert,
    mbedtls_pk_context*pk_key);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    #ifdefined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
    intmbedtls_ssl_conf_psk(mbedtls_ssl_config*conf,
    constunsignedchar*psk,size_tpsk_len,
    constunsignedchar*psk_identity,size_tpsk_identity_len);

    #ifdefined(MBEDTLS_USE_PSA_CRYPTO)
    intmbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config*conf,
    mbedtls_svc_key_id_tpsk,
    constunsignedchar*psk_identity,
    size_tpsk_identity_len);
    #endif/*MBEDTLS_USE_PSA_CRYPTO*/

    intmbedtls_ssl_set_hs_psk(mbedtls_ssl_context*ssl,
    constunsignedchar*psk,size_tpsk_len);

    #ifdefined(MBEDTLS_USE_PSA_CRYPTO)
    intmbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context*ssl,
    mbedtls_svc_key_id_tpsk);
    #endif/*MBEDTLS_USE_PSA_CRYPTO*/

    #ifdefined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_psk_cb(mbedtls_ssl_config*conf,
    int(*f_psk)(void*,mbedtls_ssl_context*,constunsignedchar*,
    size_t),
    void*p_psk);
    #endif/*MBEDTLS_SSL_SRV_C*/
    #endif/*MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED*/

    #ifdefined(MBEDTLS_DHM_C)&&defined(MBEDTLS_SSL_SRV_C)
    intmbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config*conf,
    constunsignedchar*dhm_P,size_tP_len,
    constunsignedchar*dhm_G,size_tG_len);

    intmbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config*conf,mbedtls_dhm_context*dhm_ctx);
    #endif/*MBEDTLS_DHM_C&&defined(MBEDTLS_SSL_SRV_C)*/

    #ifdefined(MBEDTLS_DHM_C)&&defined(MBEDTLS_SSL_CLI_C)
    voidmbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config*conf,
    unsignedintbitlen);
    #endif/*MBEDTLS_DHM_C&&MBEDTLS_SSL_CLI_C*/

    #ifdefined(MBEDTLS_ECP_C)
    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    voidMBEDTLS_DEPRECATEDmbedtls_ssl_conf_curves(mbedtls_ssl_config*conf,
    constmbedtls_ecp_group_id*curves);
    #endif/*MBEDTLS_DEPRECATED_REMOVED*/
    #endif/*MBEDTLS_ECP_C*/

    voidmbedtls_ssl_conf_groups(mbedtls_ssl_config*conf,
    constuint16_t*groups);

    #ifdefined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
    #if!defined(MBEDTLS_DEPRECATED_REMOVED)&&defined(MBEDTLS_SSL_PROTO_TLS1_2)
    voidMBEDTLS_DEPRECATEDmbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config*conf,
    constint*hashes);
    #endif/*!MBEDTLS_DEPRECATED_REMOVED&&MBEDTLS_SSL_PROTO_TLS1_2*/

    voidmbedtls_ssl_conf_sig_algs(mbedtls_ssl_config*conf,
    constuint16_t*sig_algs);
    #endif/*MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED*/

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    intmbedtls_ssl_set_hostname(mbedtls_ssl_context*ssl,constchar*hostname);

    staticinlineconstchar*mbedtls_ssl_get_hostname(mbedtls_ssl_context*ssl)
    {
    returnssl->MBEDTLS_PRIVATE(hostname);
    }
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    #ifdefined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
    constunsignedchar*mbedtls_ssl_get_hs_sni(mbedtls_ssl_context*ssl,
    size_t*name_len);

    intmbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context*ssl,
    mbedtls_x509_crt*own_cert,
    mbedtls_pk_context*pk_key);

    voidmbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context*ssl,
    mbedtls_x509_crt*ca_chain,
    mbedtls_x509_crl*ca_crl);

    #ifdefined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
    voidmbedtls_ssl_set_hs_dn_hints(mbedtls_ssl_context*ssl,
    constmbedtls_x509_crt*crt);
    #endif/*MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED*/

    voidmbedtls_ssl_set_hs_authmode(mbedtls_ssl_context*ssl,
    intauthmode);

    voidmbedtls_ssl_conf_sni(mbedtls_ssl_config*conf,
    int(*f_sni)(void*,mbedtls_ssl_context*,constunsignedchar*,
    size_t),
    void*p_sni);
    #endif/*MBEDTLS_SSL_SERVER_NAME_INDICATION*/

    #ifdefined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
    intmbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context*ssl,
    constunsignedchar*pw,
    size_tpw_len);

    intmbedtls_ssl_set_hs_ecjpake_password_opaque(mbedtls_ssl_context*ssl,
    mbedtls_svc_key_id_tpwd);
    #endif/*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED*/

    #ifdefined(MBEDTLS_SSL_ALPN)
    intmbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config*conf,constchar**protos);

    constchar*mbedtls_ssl_get_alpn_protocol(constmbedtls_ssl_context*ssl);
    #endif/*MBEDTLS_SSL_ALPN*/

    #ifdefined(MBEDTLS_SSL_DTLS_SRTP)
    #ifdefined(MBEDTLS_DEBUG_C)
    staticinlineconstchar*mbedtls_ssl_get_srtp_profile_as_string(mbedtls_ssl_srtp_profileprofile)
    {
    switch(profile){
    caseMBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80:
    return"MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80";
    caseMBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32:
    return"MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32";
    caseMBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80:
    return"MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80";
    caseMBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32:
    return"MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32";
    default:break;
    }
    return"";
    }
    #endif/*MBEDTLS_DEBUG_C*/
    voidmbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config*conf,
    intsupport_mki_value);

    intmbedtls_ssl_conf_dtls_srtp_protection_profiles
    (mbedtls_ssl_config*conf,
    constmbedtls_ssl_srtp_profile*profiles);

    intmbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context*ssl,
    unsignedchar*mki_value,
    uint16_tmki_len);
    voidmbedtls_ssl_get_dtls_srtp_negotiation_result(constmbedtls_ssl_context*ssl,
    mbedtls_dtls_srtp_info*dtls_srtp_info);
    #endif/*MBEDTLS_SSL_DTLS_SRTP*/

    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    voidMBEDTLS_DEPRECATEDmbedtls_ssl_conf_max_version(mbedtls_ssl_config*conf,intmajor,
    intminor);
    #endif/*MBEDTLS_DEPRECATED_REMOVED*/

    staticinlinevoidmbedtls_ssl_conf_max_tls_version(mbedtls_ssl_config*conf,
    mbedtls_ssl_protocol_versiontls_version)
    {
    conf->MBEDTLS_PRIVATE(max_tls_version)=tls_version;
    }

    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    voidMBEDTLS_DEPRECATEDmbedtls_ssl_conf_min_version(mbedtls_ssl_config*conf,intmajor,
    intminor);
    #endif/*MBEDTLS_DEPRECATED_REMOVED*/

    staticinlinevoidmbedtls_ssl_conf_min_tls_version(mbedtls_ssl_config*conf,
    mbedtls_ssl_protocol_versiontls_version)
    {
    conf->MBEDTLS_PRIVATE(min_tls_version)=tls_version;
    }

    #ifdefined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
    voidmbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config*conf,charetm);
    #endif/*MBEDTLS_SSL_ENCRYPT_THEN_MAC*/

    #ifdefined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
    voidmbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config*conf,charems);
    #endif/*MBEDTLS_SSL_EXTENDED_MASTER_SECRET*/

    #ifdefined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config*conf,
    charcert_req_ca_list);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #ifdefined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
    intmbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config*conf,unsignedcharmfl_code);
    #endif/*MBEDTLS_SSL_MAX_FRAGMENT_LENGTH*/

    #ifdefined(MBEDTLS_SSL_SRV_C)
    voidmbedtls_ssl_conf_preference_order(mbedtls_ssl_config*conf,intorder);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&defined(MBEDTLS_SSL_CLI_C)
    voidmbedtls_ssl_conf_session_tickets(mbedtls_ssl_config*conf,intuse_tickets);

    #ifdefined(MBEDTLS_SSL_PROTO_TLS1_3)
    voidmbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(
    mbedtls_ssl_config*conf,intsignal_new_session_tickets);

    #endif/*MBEDTLS_SSL_PROTO_TLS1_3*/
    #endif/*MBEDTLS_SSL_SESSION_TICKETS&&MBEDTLS_SSL_CLI_C*/

    #ifdefined(MBEDTLS_SSL_SESSION_TICKETS)&&\
    defined(MBEDTLS_SSL_SRV_C)&&\
    defined(MBEDTLS_SSL_PROTO_TLS1_3)
    voidmbedtls_ssl_conf_new_session_tickets(mbedtls_ssl_config*conf,
    uint16_tnum_tickets);
    #endif/*MBEDTLS_SSL_SESSION_TICKETS&&
    MBEDTLS_SSL_SRV_C&&
    MBEDTLS_SSL_PROTO_TLS1_3*/

    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    voidmbedtls_ssl_conf_renegotiation(mbedtls_ssl_config*conf,intrenegotiation);
    #endif/*MBEDTLS_SSL_RENEGOTIATION*/

    voidmbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config*conf,intallow_legacy);

    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    voidmbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config*conf,intmax_records);

    voidmbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config*conf,
    constunsignedcharperiod[8]);
    #endif/*MBEDTLS_SSL_RENEGOTIATION*/

    intmbedtls_ssl_check_pending(constmbedtls_ssl_context*ssl);

    size_tmbedtls_ssl_get_bytes_avail(constmbedtls_ssl_context*ssl);

    uint32_tmbedtls_ssl_get_verify_result(constmbedtls_ssl_context*ssl);

    intmbedtls_ssl_get_ciphersuite_id_from_ssl(constmbedtls_ssl_context*ssl);

    constchar*mbedtls_ssl_get_ciphersuite(constmbedtls_ssl_context*ssl);

    staticinlinembedtls_ssl_protocol_versionmbedtls_ssl_get_version_number(
    constmbedtls_ssl_context*ssl)
    {
    returnssl->MBEDTLS_PRIVATE(tls_version);
    }

    constchar*mbedtls_ssl_get_version(constmbedtls_ssl_context*ssl);

    intmbedtls_ssl_get_record_expansion(constmbedtls_ssl_context*ssl);

    intmbedtls_ssl_get_max_out_record_payload(constmbedtls_ssl_context*ssl);

    intmbedtls_ssl_get_max_in_record_payload(constmbedtls_ssl_context*ssl);

    #ifdefined(MBEDTLS_X509_CRT_PARSE_C)
    constmbedtls_x509_crt*mbedtls_ssl_get_peer_cert(constmbedtls_ssl_context*ssl);
    #endif/*MBEDTLS_X509_CRT_PARSE_C*/

    #ifdefined(MBEDTLS_SSL_CLI_C)
    intmbedtls_ssl_get_session(constmbedtls_ssl_context*ssl,
    mbedtls_ssl_session*session);
    #endif/*MBEDTLS_SSL_CLI_C*/

    intmbedtls_ssl_handshake(mbedtls_ssl_context*ssl);

    staticinlineintmbedtls_ssl_is_handshake_over(mbedtls_ssl_context*ssl)
    {
    returnssl->MBEDTLS_PRIVATE(state)>=MBEDTLS_SSL_HANDSHAKE_OVER;
    }

    intmbedtls_ssl_handshake_step(mbedtls_ssl_context*ssl);

    #ifdefined(MBEDTLS_SSL_RENEGOTIATION)
    intmbedtls_ssl_renegotiate(mbedtls_ssl_context*ssl);
    #endif/*MBEDTLS_SSL_RENEGOTIATION*/

    intmbedtls_ssl_read(mbedtls_ssl_context*ssl,unsignedchar*buf,size_tlen);

    intmbedtls_ssl_write(mbedtls_ssl_context*ssl,constunsignedchar*buf,size_tlen);

    intmbedtls_ssl_send_alert_message(mbedtls_ssl_context*ssl,
    unsignedcharlevel,
    unsignedcharmessage);
    intmbedtls_ssl_close_notify(mbedtls_ssl_context*ssl);

    #ifdefined(MBEDTLS_SSL_EARLY_DATA)

    #ifdefined(MBEDTLS_SSL_SRV_C)
    intmbedtls_ssl_read_early_data(mbedtls_ssl_context*ssl,
    unsignedchar*buf,size_tlen);
    #endif/*MBEDTLS_SSL_SRV_C*/

    #ifdefined(MBEDTLS_SSL_CLI_C)
    intmbedtls_ssl_write_early_data(mbedtls_ssl_context*ssl,
    constunsignedchar*buf,size_tlen);

    intmbedtls_ssl_get_early_data_status(mbedtls_ssl_context*ssl);
    #endif/*MBEDTLS_SSL_CLI_C*/

    #endif/*MBEDTLS_SSL_EARLY_DATA*/

    voidmbedtls_ssl_free(mbedtls_ssl_context*ssl);

    #ifdefined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
    intmbedtls_ssl_context_save(mbedtls_ssl_context*ssl,
    unsignedchar*buf,
    size_tbuf_len,
    size_t*olen);

    intmbedtls_ssl_context_load(mbedtls_ssl_context*ssl,
    constunsignedchar*buf,
    size_tlen);
    #endif/*MBEDTLS_SSL_CONTEXT_SERIALIZATION*/

    voidmbedtls_ssl_config_init(mbedtls_ssl_config*conf);

    intmbedtls_ssl_config_defaults(mbedtls_ssl_config*conf,
    intendpoint,inttransport,intpreset);

    voidmbedtls_ssl_config_free(mbedtls_ssl_config*conf);

    voidmbedtls_ssl_session_init(mbedtls_ssl_session*session);

    voidmbedtls_ssl_session_free(mbedtls_ssl_session*session);

    intmbedtls_ssl_tls_prf(constmbedtls_tls_prf_typesprf,
    constunsignedchar*secret,size_tslen,
    constchar*label,
    constunsignedchar*random,size_trlen,
    unsignedchar*dstbuf,size_tdlen);

    #ifdefined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT)
    /*Maximumvalueforkey_leninmbedtls_ssl_export_keyingmaterial.DependingontheTLS
    *versionandthenegotiatedciphersuite,largerkeyscouldinprinciplebeexported,
    *butforsimplicity,wedefineonelimitthatworksinallcases.TLS1.3withSHA256
    *hasthestrictestlimit:255blocksofSHA256output,or8160bytes.*/
    #defineMBEDTLS_SSL_EXPORT_MAX_KEY_LEN8160

    intmbedtls_ssl_export_keying_material(mbedtls_ssl_context*ssl,
    uint8_t*out,constsize_tkey_len,
    constchar*label,constsize_tlabel_len,
    constunsignedchar*context,constsize_tcontext_len,
    constintuse_context);
    #endif
    #ifdef__cplusplus
    }
    #endif

    #endif/*ssl.h*/