Struct SolidSyslogMbedTlsProfile¶

ClassList > SolidSyslogMbedTlsProfile

#include <SolidSyslogMbedTlsStream.h>

struct SolidSyslogMbedTlsProfile
{
    const char* ServerName;
    const int* CipherSuites;
};

Detailed Description¶

What one connection is made with, supplied by the integrator at each Open.

The stream zeroes this before asking, so a field left alone is one the integrator has no policy on and the library's own default stands. Anything supplied must stay valid until the connection closes.

Public Attributes Documentation¶

CipherSuites¶

Ciphersuite policy: a 0-terminated array of IANA identifiers, the MBEDTLS_TLS_* and MBEDTLS_TLS1_3_* macros of ssl_ciphersuites.h.

const int* SolidSyslogMbedTlsProfile::CipherSuites;

One list covers both TLS versions here. NULL leaves every ciphersuite the build enables, which on a trimmed mbedtls_config.h is whatever was compiled in rather than a curated set. Mbed TLS does not copy the array.

ServerName¶

SNI + peer-identity check.

const char* SolidSyslogMbedTlsProfile::ServerName;

A name beginning with a dot is refused rather than left to match nothing. A non-empty name is verified against the peer cert (SAN/CN); one that parses as an address literal is verified as an address where the cert carries an iPAddress SAN - but Mbed TLS also accepts a DNS entry or Common Name spelling the same digits, and offers no way to refuse that. NULL asks for neither, and what that means depends on the Credentials: a usable pinned fingerprint names the peer instead, so nothing is reported; without one the peer is only chain-authenticated and a WARNING says so (MITM-class). "" is the no-name-check opt-out (closed network / private CA): the peer must still satisfy whatever the credentials installed, but the endpoint identity is not checked; no diagnostic.

The documentation for this class was generated from the following file Platform/MbedTls/Interface/SolidSyslogMbedTlsStream.h