Struct SolidSyslogMbedTlsProfile¶

ClassList > SolidSyslogMbedTlsProfile

#include <SolidSyslogMbedTlsStream.h>

struct SolidSyslogMbedTlsProfile
{
    const char* ServerName;
    const int* CipherSuites;
    const struct mbedtls_x509_crt_profile* CertProfile;
};

Detailed Description¶

What one connection is made with, supplied by the integrator at each Open.

The stream zeroes this before asking, so a field left alone is one the integrator has no policy on and the library's own default stands. Anything supplied must stay valid until the connection closes.

Public Attributes Documentation¶

CertProfile¶

Optional: X.509 profile every certificate in the peer's chain is held to: which signature hashes it may carry, which public-key algorithms and curves, and the minimum RSA key size.

const struct mbedtls_x509_crt_profile* SolidSyslogMbedTlsProfile::CertProfile;

That is the part of the BCP 195 section 4.5 cryptographic floor this stream does not pin for itself. NULL leaves whatever profile the Mbed TLS being linked names as its default, so the floor is inherited; supplying one states it instead. Applied before the credentials source installs, so a backend that sets a profile of its own has the last word - as it does over every other pin on the ssl_config. Start from mbedtls_x509_crt_profile_default and tighten. Certificates only - the signature algorithms offered in the handshake itself are not covered. Mbed TLS does not copy the profile.

CipherSuites¶

Ciphersuite policy: a 0-terminated array of IANA identifiers, the MBEDTLS_TLS_* and MBEDTLS_TLS1_3_* macros of ssl_ciphersuites.h.

const int* SolidSyslogMbedTlsProfile::CipherSuites;

One list covers both TLS versions here. NULL leaves every ciphersuite the build enables, which on a trimmed mbedtls_config.h is whatever was compiled in rather than a curated set. Mbed TLS does not copy the array. The element type is int, rather than a fixed-width type, because Mbed TLS takes the array as it stands.

ServerName¶

SNI + peer-identity check.

const char* SolidSyslogMbedTlsProfile::ServerName;

A name beginning with a dot is refused rather than left to match nothing. A non-empty name is verified against the peer cert (SAN/CN); one that parses as an address literal is verified as an address where the cert carries an iPAddress SAN - but Mbed TLS also accepts a DNS entry or Common Name spelling the same digits, and offers no way to refuse that. NULL asks for neither, and what that means depends on the Credentials: a usable pinned fingerprint names the peer instead, so nothing is reported; without one the peer is only chain-authenticated and a WARNING says so (MITM-class). "" is the no-name-check opt-out (closed network / private CA): the peer must still satisfy whatever the credentials installed, but the endpoint identity is not checked; no diagnostic.

The documentation for this class was generated from the following file Platform/MbedTls/Interface/SolidSyslogMbedTlsStream.h