Line data    Source code

       1              : /* SPDX-FileCopyrightText: Copyright 2026 Cozens Software Solutions Limited
       2              :  * SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 OR LicenseRef-PolyForm-Internal-Use-1.0.0 OR LicenseRef-COSOSO-Commercial
       3              :  */
       4              : 
       5              : #ifndef SOLIDSYSLOGMBEDTLSSTREAMPRIVATE_H
       6              : #define SOLIDSYSLOGMBEDTLSSTREAMPRIVATE_H
       7              : 
       8              : #include <stdbool.h>
       9              : #include <stdint.h>
      10              : 
      11              : #include <mbedtls/ssl.h>
      12              : 
      13              : #include "SolidSyslogError.h"
      14              : #include "SolidSyslogMbedTlsStream.h"
      15              : #include "SolidSyslogMbedTlsStreamErrors.h"
      16              : #include "SolidSyslogTlsCredentialsInstalled.h"
      17              : #include "SolidSyslogTlsFingerprint.h"
      18              : #include "SolidSyslogPrival.h"
      19              : #include "SolidSyslogStreamDefinition.h"
      20              : #include "SolidSyslogStreamOpenHealth.h"
      21              : #include "SolidSyslogTlsStreamCategories.h"
      22              : 
      23              : struct SolidSyslogMbedTlsStream
      24              : {
      25              :     struct SolidSyslogStream Base;
      26              :     struct SolidSyslogMbedTlsStreamConfig Config;
      27              :     struct SolidSyslogStreamOpenHealth OpenHealth;
      28              :     mbedtls_ssl_config SslConfig;
      29              :     mbedtls_ssl_context SslContext;
      30              :     /* Set immediately before Install is called, cleared by the Release that
      31              :      * answers it. The contract is one Release per Install call whatever that
      32              :      * call returned, and Close is idempotent, so the flag is what keeps both
      33              :      * true at once. */
      34              :     bool CredentialsInstalled;
      35              :     /* What the last Install reported. Read after Install returns, by the verify
      36              :      * callback and by the hostname step; valid only while CredentialsInstalled. */
      37              :     struct SolidSyslogTlsCredentialsInstalled
      38              :         Installed; /* Pulled at the start of each Open and read for the rest of it. */
      39              :     struct SolidSyslogMbedTlsProfile Profile;
      40              :     /* What the verify callback itself refused on, and zero where it did not.
      41              :      * Verifying optionally makes our callback the enforcement point, and a
      42              :      * callback that refuses leaves mbedtls_ssl_get_verify_result answering
      43              :      * 0xFFFFFFFF - so the reason has to be recorded as the decision is taken
      44              :      * rather than deduced afterwards from a verdict that no longer carries it. */
      45              :     uint32_t RefusedVerdict;
      46              :     /* What the pin walk decided at the leaf, recorded there. A pin naming a hash
      47              :      * this build compiled out is the integrator's fault, not the peer's, and
      48              :      * nothing in the library's verdict distinguishes the two. */
      49              :     enum SolidSyslogTlsAuthorisation PinVerdict;
      50              : };
      51              : 
      52              : void SolidSyslogMbedTlsStream_Initialise(
      53              :     struct SolidSyslogStream* base,
      54              :     const struct SolidSyslogMbedTlsStreamConfig* config
      55              : );
      56              : void SolidSyslogMbedTlsStream_Cleanup(struct SolidSyslogStream* base);
      57              : 
      58           79 : static inline void MbedTlsStream_Report(
      59              :     enum SolidSyslogSeverity severity,
      60              :     uint16_t category,
      61              :     enum SolidSyslogTlsStreamErrors code
      62              : )
      63              : {
      64           79 :     SolidSyslog_Error(severity, &SolidSyslogMbedTlsStreamErrorSource, category, (int32_t) code);
      65           79 : }
      66              : 
      67              : /* A failure that ends an Open, reported once per run of the same detail as
      68              :  * the Open contract requires: the sender retries every service pass. */
      69           78 : static inline void MbedTlsStream_ReportOpenFailure(
      70              :     struct SolidSyslogMbedTlsStream* self,
      71              :     enum SolidSyslogSeverity severity,
      72              :     uint16_t category,
      73              :     enum SolidSyslogTlsStreamErrors code
      74              : )
      75              : {
      76           78 :     SolidSyslogStreamOpenHealth_ReportFailure(
      77              :         &self->OpenHealth,
      78              :         &SolidSyslogMbedTlsStreamErrorSource,
      79              :         severity,
      80              :         category,
      81              :         (int32_t) code
      82              :     );
      83           78 : }
      84              : 
      85              : #endif /* SOLIDSYSLOGMBEDTLSSTREAMPRIVATE_H */