protocol/SecProtocolPriv.h

   1 //
   2 //  SecProtocolPriv.h
   3 //  Security
   4 //
   5
   6 #ifndef SecProtocolPriv_h
   7 #define SecProtocolPriv_h
   8
   9 #include <Security/SecProtocolOptions.h>
  10 #include <Security/SecProtocolMetadata.h>
  11 #include <Security/SecProtocolConfiguration.h>
  12 #include <Security/SecureTransportPriv.h>
  13 #include <Security/SecCertificatePriv.h>
  14
  15 #include <xpc/xpc.h>
  16
  17 __BEGIN_DECLS
  18
  19 /* See: https://tools.ietf.org/html/rfc8446#section-4.2.7 */
  20 typedef CF_ENUM(uint16_t, tls_key_exchange_group_t) {
  21     tls_key_exchange_group_Secp256r1 = 0x0017,
  22     tls_key_exchange_group_Secp384r1 = 0x0018,
  23     tls_key_exchange_group_Secp521r1 = 0x0019,
  24     tls_key_exchange_group_X25519 = 0x001D,
  25     tls_key_exchange_group_X448 = 0x001E,
  26     tls_key_exchange_group_FFDHE2048 = 0x0100,
  27     tls_key_exchange_group_FFDHE3072 = 0x0101,
  28     tls_key_exchange_group_FFDHE4096 = 0x0102,
  29     tls_key_exchange_group_FFDHE6144 = 0x0103,
  30     tls_key_exchange_group_FFDHE8192 = 0x0104,
  31 };
  32
  33 /*
  34  * Convenience key exchange groups that collate group identifiers of
  35  * comparable security into a single alias.
  36  */
  37 typedef CF_ENUM(uint16_t, tls_key_exchange_group_set_t) {
  38     tls_key_exchange_group_set_default,
  39     tls_key_exchange_group_set_compatibility,
  40     tls_key_exchange_group_set_legacy,
  41 };
  42
  43 SEC_ASSUME_NONNULL_BEGIN
  44
  45 #ifndef SEC_OBJECT_IMPL
  46 SEC_OBJECT_DECL(sec_array);
  47 #endif // !SEC_OBJECT_IMPL
  48
  49 struct sec_protocol_options_content;
  50 typedef struct sec_protocol_options_content *sec_protocol_options_content_t;
  51
  52 struct sec_protocol_metadata_content;
  53 typedef struct sec_protocol_metadata_content *sec_protocol_metadata_content_t;
  54
  55 typedef void (^sec_protocol_tls_handshake_message_handler_t)(uint8_t type, dispatch_data_t message);
  56
  57 typedef dispatch_data_t _Nullable (*sec_protocol_metadata_exporter)(void * handle, size_t label_len, const char *label,
  58                                                           size_t context_len, const uint8_t * __nullable context, size_t exporter_len);
  59
  60 typedef dispatch_data_t _Nullable (*sec_protocol_metadata_session_exporter)(void *handle);
  61
  62 typedef bool (^sec_access_block_t)(void *handle);
  63
  64 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
  65 SEC_RETURNS_RETAINED sec_array_t
  66 sec_array_create(void);
  67
  68 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
  69 void
  70 sec_array_append(sec_array_t array, sec_object_t object);
  71
  72 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
  73 size_t
  74 sec_array_get_count(sec_array_t array);
  75
  76 typedef bool (^sec_array_applier_t) (size_t index, sec_object_t object);
  77
  78 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
  79 bool
  80 sec_array_apply(sec_array_t array, sec_array_applier_t applier);
  81
  82 /*!
  83  * @function sec_protocol_options_access_handle
  84  *
  85  * @abstract
  86  *      Access the internal handle of a `sec_protocol_options` object.
  87  *
  88  * @param options
  89  *      A `sec_protocol_options_t` instance.
  90  *
  91  * @param access_block
  92  *      A block to invoke with access to the internal handle.
  93  *
  94  * @return True if the access was successful
  95  */
  96 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
  97 bool
  98 sec_protocol_options_access_handle(sec_protocol_options_t options, sec_access_block_t access_block);
  99
 100 /*!
 101  * @function sec_protocol_options_contents_are_equal
 102  *
 103  * @abstract
 104  *      Compare two `sec_protocol_options_content_t` structs for equality.
 105  *
 106  * @param contentA
 107  *      A `sec_protocol_options_t` instance.
 108  *
 109  * @param contentB
 110  *      A `sec_protocol_options_t` instance.
 111  *
 112  * @return True if equal, and false otherwise.
 113  */
 114 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 115 bool
 116 sec_protocol_options_contents_are_equal(sec_protocol_options_content_t contentA, sec_protocol_options_content_t contentB);
 117
 118 /*!
 119  * @function sec_protocol_options_set_tls_early_data_enabled
 120  *
 121  * @abstract
 122  *      Enable or disable early (0-RTT) data for TLS.
 123  *
 124  * @param options
 125  *      A `sec_protocol_options_t` instance.
 126  *
 127  * @param early_data_enabled
 128  *      Flag to enable or disable early (0-RTT) data.
 129  */
 130 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 131 void
 132 sec_protocol_options_set_tls_early_data_enabled(sec_protocol_options_t options, bool early_data_enabled);
 133
 134 /*!
 135  * @function sec_protocol_options_set_tls_sni_disabled
 136  *
 137  * @abstract
 138  *      Enable or disable the TLS SNI extension. This defaults to `false`.
 139  *
 140  * @param options
 141  *      A `sec_protocol_options_t` instance.
 142  *
 143  * @param sni_disabled
 144  *      Flag to enable or disable use of the TLS SNI extension.
 145  */
 146 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 147 void
 148 sec_protocol_options_set_tls_sni_disabled(sec_protocol_options_t options, bool sni_disabled);
 149
 150 /*!
 151  * @function sec_protocol_options_set_enforce_ev
 152  *
 153  * @abstract
 154  *      Enable or disable EV enforcement.
 155  *
 156  * @param options
 157  *      A `sec_protocol_options_t` instance.
 158  *
 159  * @param enforce_ev
 160  *      Flag to determine if EV is enforced.
 161  */
 162 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 163 void
 164 sec_protocol_options_set_enforce_ev(sec_protocol_options_t options, bool enforce_ev);
 165
 166 /*!
 167  * @block sec_protocol_session_update_t
 168  *
 169  * @abstract
 170  *      Block to be invoked when a new session is established and ready.
 171  *
 172  * @param metadata
 173  *      A `sec_protocol_metadata_t` instance.
 174  */
 175 typedef void (^sec_protocol_session_update_t)(sec_protocol_metadata_t metadata);
 176
 177 /*!
 178  * @function sec_protocol_options_set_session_update_block
 179  *
 180  * @abstract
 181  *      Set the session update block. This is fired whenever a new session is
 182  *      created an inserted into the cache.
 183  *
 184  * @param options
 185  *      A `sec_protocol_options_t` instance.
 186  *
 187  * @param update_block
 188  *      A `sec_protocol_session_update_t` instance.
 189  *
 190  * @params update_queue
 191  *      A `dispatch_queue_t` on which the update block should be called.
 192  */
 193 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 194 void
 195 sec_protocol_options_set_session_update_block(sec_protocol_options_t options,
 196                                               sec_protocol_session_update_t update_block,
 197                                               dispatch_queue_t update_queue);
 198
 199 /*!
 200  * @function sec_protocol_options_set_session_state
 201  *
 202  * @abstract
 203  *      Set the session state using a serialized session blob.
 204  *
 205  *      If the session state is invalid or otherwise corrupt, the state is ignored and
 206  *      the connection will proceed as if no state was provided.
 207  *
 208  * @param options
 209  *      A `sec_protocol_options_t` instance.
 210  *
 211  * @param session_state
 212  *      A `dispatch_data_t` carrying serialized session state from a previous.
 213  */
 214 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 215 void
 216 sec_protocol_options_set_session_state(sec_protocol_options_t options, dispatch_data_t session_state);
 217
 218 /*!
 219  * @function sec_protocol_options_set_quic_transport_parameters
 220  *
 221  * @abstract
 222  *      Set the opaque QUIC transport parameters to be used for this connection.
 223  *
 224  * @param options
 225  *      A `sec_protocol_options_t` instance.
 226  *
 227  * @param transport_parameters
 228  *      A `dispatch_data_t` carrying opqaue QUIC transport parameters.
 229  */
 230 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 231 void
 232 sec_protocol_options_set_quic_transport_parameters(sec_protocol_options_t options, dispatch_data_t transport_parameters);
 233
 234 /*!
 235  * @enum sec_protocol_tls_encryption_level_t
 236  *
 237  * @abstract An enumeration of the different TLS encryption levels.
 238  */
 239 typedef enum {
 240     sec_protocol_tls_encryption_level_initial = 0,
 241     sec_protocol_tls_encryption_level_early_data,
 242     sec_protocol_tls_encryption_level_handshake,
 243     sec_protocol_tls_encryption_level_application,
 244 } sec_protocol_tls_encryption_level_t;
 245
 246 /*!
 247  * @block sec_protocol_tls_encryption_secret_update_t
 248  *
 249  * @abstract
 250  *      Block to be invoked when a new session is established and ready.
 251  *
 252  * @param level
 253  *      The `sec_protocol_tls_encryption_level_t` for this secret.
 254  *
 255  * @param is_write
 256  *      True if this secret is for writing, and false if it's for reading.
 257  *
 258  * @param secret
 259  *      Secret wrapped in a `dispatch_data_t`
 260  */
 261 typedef void (^sec_protocol_tls_encryption_secret_update_t)(sec_protocol_tls_encryption_level_t level, bool is_write, dispatch_data_t secret);
 262
 263 /*!
 264  * @function sec_protocol_options_set_tls_encryption_secret_update_block
 265  *
 266  * @abstract
 267  *      Set the TLS secret update block. This is fired whenever a new TLS secret is
 268  *      available.
 269  *
 270  * @param options
 271  *      A `sec_protocol_options_t` instance.
 272  *
 273  * @param update_block
 274  *      A `sec_protocol_tls_encryption_secret_update_t` instance.
 275  *
 276  * @params update_queue
 277  *      A `dispatch_queue_t` on which the update block should be called.
 278  */
 279 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 280 void
 281 sec_protocol_options_set_tls_encryption_secret_update_block(sec_protocol_options_t options,
 282                                                             sec_protocol_tls_encryption_secret_update_t update_block,
 283                                                             dispatch_queue_t update_queue);
 284
 285 /*!
 286  * @block sec_protocol_private_key_complete_t
 287  *
 288  * @abstract
 289  *      Block to be invoked when a private key operation is complete.
 290  *
 291  * @param result
 292  *      A `dispatch_data_t` object containing the private key result.
 293  */
 294 typedef void (^sec_protocol_private_key_complete_t)(dispatch_data_t result);
 295
 296 /*!
 297  * @block sec_protocol_private_key_sign_t
 298  *
 299  * @abstract
 300  *      Block to be invoked when a private key signature operation is required.
 301  *
 302  * @param algorithm
 303  *      The signature algorithm to use for the signature.
 304  *
 305  * @param input
 306  *      The input to be signed.
 307  *
 308  * @param complete
 309  *      The `sec_protocol_private_key_complete_t` block to invoke when the operation is complete.
 310  */
 311 typedef void (^sec_protocol_private_key_sign_t)(uint16_t algorithm, dispatch_data_t input, sec_protocol_private_key_complete_t complete);
 312
 313 /*!
 314  * @block sec_protocol_private_key_decrypt_t
 315  *
 316  * @abstract
 317  *      Block to be invoked when a private key decryption operation is required.
 318  *
 319  * @param input
 320  *      The input to be decrypted.
 321  *
 322  * @param complete
 323  *      The `sec_protocol_private_key_complete_t` block to invoke when the operation is complete.
 324  */
 325 typedef void (^sec_protocol_private_key_decrypt_t)(dispatch_data_t input, sec_protocol_private_key_complete_t complete);
 326
 327 /*!
 328  * @block sec_protocol_options_set_private_key_blocks
 329  *
 330  * @abstract
 331  *      Set the private key operation blocks for this connection.
 332  *
 333  * @param options
 334  *      A `sec_protocol_options_t` instance.
 335  *
 336  * @param sign_block
 337  *      A `sec_protocol_private_key_sign_t` block.
 338  *
 339  * @param decrypt_block
 340  *      A `sec_protocol_private_key_decrypt_t` block.
 341  *
 342  * @param operation_queue
 343  *      The `dispatch_queue_t` queue on which each private key operation is invoked.
 344  */
 345 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 346 void
 347 sec_protocol_options_set_private_key_blocks(sec_protocol_options_t options,
 348                                             sec_protocol_private_key_sign_t sign_block,
 349                                             sec_protocol_private_key_decrypt_t decrypt_block,
 350                                             dispatch_queue_t operation_queue);
 351
 352 /*!
 353  * @block sec_protocol_options_set_local_certificates
 354  *
 355  * @abstract
 356  *      Set the local certificates to be used for this protocol instance.
 357  *
 358  * @param options
 359  *      A `sec_protocol_options_t` instance.
 360  *
 361  * @param certificates
 362  *      A `sec_array_t` instance of `sec_certifiate_t` instances.
 363  */
 364 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 365 void
 366 sec_protocol_options_set_local_certificates(sec_protocol_options_t options, sec_array_t certificates);
 367
 368 /*!
 369  * @block sec_protocol_options_set_tls_certificate_compression_enabled
 370  *
 371  * @abstract
 372  *      Enable or disable TLS 1.3 certificate compression.
 373  *
 374  *      See: https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-04
 375  *
 376  * @param options
 377  *      A `sec_protocol_options_t` instance.
 378  *
 379  * @param certificate_compression_enabled
 380  *      Flag to determine if certificate compression is enabled.
 381  */
 382 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 383 void
 384 sec_protocol_options_set_tls_certificate_compression_enabled(sec_protocol_options_t options, bool certificate_compression_enabled);
 385
 386 /*!
 387  * @block sec_protocol_options_tls_handshake_message_callback
 388  *
 389  * @abstract
 390  *      Set a callback to process each TLS handshake message. This function may be invoked at any point during
 391  *      the TLS handshake, if at all. Clients MUST NOT rely on any behavior aspect of this function as they
 392  *      risk breaking.
 393  *
 394  * @param options
 395  *      A `sec_protocol_options_t` instance.
 396  *
 397  * @param handler
 398  *      A `sec_protocol_tls_handshake_message_handler_t`.
 399  *
 400  * @param queue
 401  *      The queue upon which to invoke the callback.
 402  */
 403 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 404 void
 405 sec_protocol_options_tls_handshake_message_callback(sec_protocol_options_t options, sec_protocol_tls_handshake_message_handler_t handler, dispatch_queue_t queue);
 406
 407 /*!
 408  * @block sec_protocol_options_append_tls_key_exchange_group
 409  *
 410  * @abstract
 411  *      Append a TLS key exchange group to the set of enabled groups.
 412  *
 413  * @param options
 414  *      A `sec_protocol_options_t` instance.
 415  *
 416  * @param group
 417  *      A `tls_key_exchange_group_t` value.
 418  */
 419 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 420 void
 421 sec_protocol_options_append_tls_key_exchange_group(sec_protocol_options_t options, tls_key_exchange_group_t group);
 422
 423 /*!
 424  * @block sec_protocol_options_add_tls_key_exchange_group
 425  *
 426  * @abstract
 427  *      Add a TLS key exchange group to the set of enabled groups.
 428  *
 429  * @param options
 430  *      A `sec_protocol_options_t` instance.
 431  *
 432  * @param group
 433  *      A SSLKeyExchangeGroup value.
 434  */
 435 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 436 void
 437 sec_protocol_options_add_tls_key_exchange_group(sec_protocol_options_t options, SSLKeyExchangeGroup group);
 438
 439 /*!
 440  * @block sec_protocol_options_append_tls_key_exchange_group_set
 441  *
 442  * @abstract
 443  *      Append a TLS key exchange group set to the set of enabled groups.
 444  *
 445  * @param options
 446  *      A `sec_protocol_options_t` instance.
 447  *
 448  * @param set
 449  *      A `tls_key_exchange_group_set_t` value.
 450  */
 451 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 452 void
 453 sec_protocol_options_append_tls_key_exchange_group_set(sec_protocol_options_t options, tls_key_exchange_group_set_t set);
 454
 455 /*!
 456  * @block sec_protocol_options_tls_key_exchange_group_set
 457  *
 458  * @abstract
 459  *      Add a TLS key exchange group set to the set of enabled groups.
 460  *
 461  * @param options
 462  *      A `sec_protocol_options_t` instance.
 463  *
 464  * @param set
 465  *      A SSLKeyExchangeGroupSet value.
 466  */
 467 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 468 void
 469 sec_protocol_options_add_tls_key_exchange_group_set(sec_protocol_options_t options, SSLKeyExchangeGroupSet set);
 470
 471 /*!
 472  * @function sec_protocol_options_set_tls_SIKE503_exchange_enabled
 473  *
 474  * @abstract
 475  *      Enable SIKE using P503 for TLS 1.3 key exchange.
 476  *
 477  *      DO NOT DEPEND ON THIS SPI. IT IS FOR EXPERIMENTAL PURPOSES AND SUBJECT TO REMOVAL WITHOUT ADVANCE NOTICE.
 478  *      BUILD BREAKAGE ISSUES WILL BE SENT TO THE CALLING PROJECT.
 479  *
 480  * @param options
 481  *      A `sec_protocol_options_t` instance.
 482  *
 483  * @param tls_SIKE503_exchange_enabled
 484  *      Flag to enable SIKE with P503.
 485  */
 486 #define SEC_PROTOCOL_HAS_PQ_TLS_HANDLES 1
 487 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 488 void
 489 sec_protocol_options_set_tls_SIKE503_exchange_enabled(sec_protocol_options_t options, bool tls_SIKE503_exchange_enabled);
 490
 491 /*!
 492  * @function sec_protocol_options_set_tls_HRSS_exchange_enabled
 493  *
 494  * @abstract
 495  *      Enable HRSS for TLS 1.3 key exchange.
 496  *
 497  *      DO NOT DEPEND ON THIS SPI. IT IS FOR EXPERIMENTAL PURPOSES AND SUBJECT TO REMOVAL WITHOUT ADVANCE NOTICE.
 498  *      BUILD BREAKAGE ISSUES WILL BE SENT TO THE CALLING PROJECT.
 499  *
 500  * @param options
 501  *      A `sec_protocol_options_t` instance.
 502  *
 503  * @param tls_HRSS_exchange_enabled
 504  *      Flag to enable HRSS.
 505  */
 506 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 507 void
 508 sec_protocol_options_set_tls_HRSS_exchange_enabled(sec_protocol_options_t options, bool tls_HRSS_exchange_enabled);
 509
 510 /*!
 511  * @function sec_protocol_options_set_eddsa_enabled
 512  *
 513  * @abstract
 514  *      Enable EDDSA support (for TLS 1.3).
 515  *
 516  * @param options
 517  *      A `sec_protocol_options_t` instance.
 518  *
 519  * @param eddsa_enabled
 520  *      Flag to enable EDDSA.
 521  */
 522 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 523 void
 524 sec_protocol_options_set_eddsa_enabled(sec_protocol_options_t options, bool eddsa_enabled);
 525
 526 /*!
 527  * @function sec_protocol_options_set_tls_delegated_credentials_enabled
 528  *
 529  * @abstract
 530  *      Enable TLS delegated credentials support. See https://tools.ietf.org/html/draft-ietf-tls-subcerts-02.
 531  *
 532  *      DO NOT DEPEND ON THIS SPI. IT IS FOR EXPERIMENTAL PURPOSES AND SUBJECT TO REMOVAL WITHOUT ADVANCE NOTICE.
 533  *      BUILD BREAKAGE ISSUES WILL BE SENT TO THE CALLING PROJECT.
 534  *
 535  * @param options
 536  *      A `sec_protocol_options_t` instance.
 537  *
 538  * @param tls_delegated_credentials_enabled
 539  *      Flag to enable TLS delegated credentials.
 540  */
 541 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 542 void
 543 sec_protocol_options_set_tls_delegated_credentials_enabled(sec_protocol_options_t options, bool tls_delegated_credentials_enabled);
 544
 545 /*!
 546  * @function sec_protocol_options_set_tls_ticket_request_count
 547  *
 548  * @abstract
 549  *      Enable TLS ticket request support, and specify the count of tickets. Ticket support
 550  *      must also be explicitly enabled by `sec_protocol_options_set_tls_tickets_enabled`.
 551  *
 552  *      DO NOT DEPEND ON THIS SPI. IT IS FOR EXPERIMENTAL PURPOSES AND SUBJECT TO REMOVAL WITHOUT ADVANCE NOTICE.
 553  *      BUILD BREAKAGE ISSUES WILL BE SENT TO THE CALLING PROJECT.
 554  *
 555  * @param options
 556  *      A `sec_protocol_options_t` instance.
 557  *
 558  * @param tls_ticket_request_count
 559  *      Set the amount of tickets to request from the server.
 560  */
 561 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 562 void
 563 sec_protocol_options_set_tls_ticket_request_count(sec_protocol_options_t options, uint8_t tls_ticket_request_count);
 564
 565 /*!
 566  * @function sec_protocol_options_set_tls_grease_enabled
 567  *
 568  * @abstract
 569  *      Enable TLS GREASE support. See https://tools.ietf.org/html/draft-ietf-tls-grease-02.
 570  *
 571  *      DO NOT DEPEND ON THIS SPI. IT IS FOR EXPERIMENTAL PURPOSES AND SUBJECT TO REMOVAL WITHOUT ADVANCE NOTICE.
 572  *      BUILD BREAKAGE ISSUES WILL BE SENT TO THE CALLING PROJECT.
 573  *
 574  * @param options
 575  *      A `sec_protocol_options_t` instance.
 576  *
 577  * @param tls_grease_enabled
 578  *      Flag to enable TLS GREASE.
 579  */
 580 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 581 void
 582 sec_protocol_options_set_tls_grease_enabled(sec_protocol_options_t options, bool tls_grease_enabled);
 583
 584 /*!
 585  * @function sec_protocol_options_create_config
 586  *
 587  * @abstract
 588  *      Create a `xpc_object_t` instance carrying a configuration for the given `sec_protocol_options_t` instance.
 589  *
 590  * @param options
 591  *      A `sec_protocol_options_t` instance.
 592  *
 593  * @return A `xpc_object_t` instance carrying a configuration, or nil on failure.
 594  */
 595 #define SEC_PROTOCOL_HAS_EXPERIMENT_HOOKS 1
 596 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 597 SEC_RETURNS_RETAINED __nullable xpc_object_t
 598 sec_protocol_options_create_config(sec_protocol_options_t options);
 599
 600 /*!
 601  * @function sec_protocol_options_matches_config
 602  *
 603  * @abstract
 604  *      Determine if a `sec_protocol_options_t` instance matches a given configuration.
 605  *
 606  * @param options
 607  *      A `sec_protocol_options_t` instance.
 608  *
 609  * @param config
 610  *      A `xpc_object_t` instance carrying a SecExperiment config.
 611  *
 612  * @return True if the parameters in `config` match that of `options`, and false otherwise.
 613  */
 614 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 615 bool
 616 sec_protocol_options_matches_config(sec_protocol_options_t options, xpc_object_t config);
 617
 618 /*!
 619  * @function sec_protocol_options_apply_config
 620  *
 621  * @abstract
 622  *      Transform the given `sec_protocol_options_t` instance using the provided config.
 623  *
 624  * @param options
 625  *      A `sec_protocol_options_t` instance.
 626  *
 627  * @param config
 628  *      A `xpc_object_t` instance carrying a SecExperiment config.
 629  *
 630  * @return True if the options were applied successfully, and false otherwise.
 631  */
 632 bool
 633 sec_protocol_options_apply_config(sec_protocol_options_t options, xpc_object_t config);
 634
 635 /*!
 636  * @function sec_protocol_metadata_get_tls_negotiated_group
 637  *
 638  * @abstract
 639  *      Get a human readable representation of the negotiated key exchange group.
 640  *
 641  * @param metadata
 642  *      A `sec_protocol_metadata_t` instance.
 643  *
 644  * @return A string representation of the negotiated group, or NULL if it does not exist.
 645  */
 646 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 647 const char * __nullable
 648 sec_protocol_metadata_get_tls_negotiated_group(sec_protocol_metadata_t metadata);
 649
 650 /*!
 651  * @function sec_protocol_metadata_get_tls_false_start_used
 652  *
 653  * @abstract
 654  *      Determine if False Start was used.
 655  *
 656  * @param metadata
 657  *      A `sec_protocol_metadata_t` instance.
 658  *
 659  * @return True if False Start was used, and false otherwise.
 660  */
 661 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 662 bool
 663 sec_protocol_metadata_get_tls_false_start_used(sec_protocol_metadata_t metadata);
 664
 665 /*!
 666  * @function sec_protocol_metadata_get_ticket_offered
 667  *
 668  * @abstract
 669  *      Determine if a ticket was offered for session resumption.
 670  *
 671  * @param metadata
 672  *      A `sec_protocol_metadata_t` instance.
 673  *
 674  * @return True if a ticket was offered for resumption, and false otherwise.
 675  */
 676 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 677 bool
 678 sec_protocol_metadata_get_ticket_offered(sec_protocol_metadata_t metadata);
 679
 680 /*!
 681  * @function sec_protocol_metadata_get_ticket_received
 682  *
 683  * @abstract
 684  *      Determine if a ticket was received upon completing the new connection.
 685  *
 686  * @param metadata
 687  *      A `sec_protocol_metadata_t` instance.
 688  *
 689  * @return True if a ticket was received from the peer (server), and false otherwise.
 690  */
 691 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 692 bool
 693 sec_protocol_metadata_get_ticket_received(sec_protocol_metadata_t metadata);
 694
 695 /*!
 696  * @function sec_protocol_metadata_get_session_resumed
 697  *
 698  * @abstract
 699  *      Determine if this new connection was a session resumption.
 700  *
 701  * @param metadata
 702  *      A `sec_protocol_metadata_t` instance.
 703  *
 704  * @return True if this new connection was resumed, and false otherwise.
 705  */
 706 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 707 bool
 708 sec_protocol_metadata_get_session_resumed(sec_protocol_metadata_t metadata);
 709
 710 /*!
 711  * @function sec_protocol_metadata_get_session_renewed
 712  *
 713  * @abstract
 714  *      Determine if this resumed connection was renewed with a new ticket.
 715  *
 716  * @param metadata
 717  *      A `sec_protocol_metadata_t` instance.
 718  *
 719  * @return True if this resumed connection was renewed with a new ticket, and false otherwise.
 720  */
 721 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 722 bool
 723 sec_protocol_metadata_get_session_renewed(sec_protocol_metadata_t metadata);
 724
 725 /*!
 726  * @function sec_protocol_metadata_get_connection_strength
 727  *
 728  * @abstract
 729  *      Determine the TLS connection strength.
 730  *
 731  * @param metadata
 732  *      A `sec_protocol_metadata_t` instance.
 733  *
 734  * @return An `SSLConnectionStrength` enum.
 735  */
 736 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 737 SSLConnectionStrength
 738 sec_protocol_metadata_get_connection_strength(sec_protocol_metadata_t metadata);
 739
 740 /*!
 741  * @function sec_protocol_metadata_copy_serialized_session
 742  *
 743  * @abstract
 744  *      Copy a serialized representation of a session.
 745  *
 746  * @param metadata
 747  *      A `sec_protocol_metadata_t` instance.
 748  *
 749  * @return A `dispatch_data_t` object containing a serialized session.
 750  */
 751 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 752 SEC_RETURNS_RETAINED __nullable dispatch_data_t
 753 sec_protocol_metadata_copy_serialized_session(sec_protocol_metadata_t metadata);
 754
 755 /*!
 756  * @function sec_protocol_metadata_access_handle
 757  *
 758  * @abstract
 759  *      Access the internal handle of a `sec_protocol_metadata` object.
 760  *
 761  * @param metadata
 762  *      A `sec_protocol_metadata_t` instance.
 763  *
 764  * @param access_block
 765  *      A block to invoke with access to the internal handle.
 766  *
 767  * @return True if the access was successful
 768  */
 769 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 770 bool
 771 sec_protocol_metadata_access_handle(sec_protocol_metadata_t metadata, sec_access_block_t access_block);
 772
 773 /*!
 774  * @function sec_protocol_metadata_serialize_with_options
 775  *
 776  * @abstract
 777  *      Serialize a `sec_protocol_metadata_t` to an `xpc_object_t` dictionary using information
 778  *      contained in the `metadata` and `options` objects.
 779  *
 780  * @param metadata
 781  *      A `sec_protocol_metadata_t` instance.
 782  *
 783  * @return A xpc_object_t carrying the serialized metadata.
 784  */
 785 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 786 SEC_RETURNS_RETAINED __nullable xpc_object_t
 787 sec_protocol_metadata_serialize_with_options(sec_protocol_metadata_t metadata, sec_protocol_options_t options);
 788
 789 /*!
 790  * @function sec_protocol_metadata_get_tls_certificate_compression_used
 791  *
 792  * @abstract
 793  *      Determine if certificate compression was used for a given connection.
 794  *
 795  *      See: https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-04
 796  *
 797  * @param metadata
 798  *      A `sec_protocol_metadata_t` instance.
 799  *
 800  * @return True if certificate compression was negotiated and used.
 801  */
 802 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 803 bool
 804 sec_protocol_metadata_get_tls_certificate_compression_used(sec_protocol_metadata_t metadata);
 805
 806 /*!
 807  * @function sec_protocol_metadata_get_tls_certificate_compression_algorithm
 808  *
 809  * @abstract
 810  *      Return the certificate compression algorithm used. This will return 0
 811  *      if `sec_protocol_metadata_get_tls_certificate_compression_used` is false.
 812  *
 813  *      See: https://tools.ietf.org/html/draft-ietf-tls-certificate-compression-04
 814  *
 815  * @param metadata
 816  *      A `sec_protocol_metadata_t` instance.
 817  *
 818  * @return IANA codepoint for the certificate compression algorithm.
 819  */
 820 API_AVAILABLE(macos(10.14), ios(12.0), watchos(5.0), tvos(12.0))
 821 uint16_t
 822 sec_protocol_metadata_get_tls_certificate_compression_algorithm(sec_protocol_metadata_t metadata);
 823
 824 /*!
 825  * @function sec_protocol_metadata_copy_quic_transport_parameters
 826  *
 827  * @abstract
 828  *      Copy the peer's QUIC transport parameters.
 829  *
 830  * @param metadata
 831  *      A `sec_protocol_metadata_t` instance.
 832  *
 833  * @return A dispatch_data_t carrying the connection peer's opaque QUIC tranport parameters.
 834  */
 835 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 836 SEC_RETURNS_RETAINED __nullable dispatch_data_t
 837 sec_protocol_metadata_copy_quic_transport_parameters(sec_protocol_metadata_t metadata);
 838
 839 /*!
 840  * @function sec_protocol_metadata_get_handshake_time_ms
 841  *
 842  * @abstract
 843  *      Get the TLS handshake time in miliseconds. The result is undefined
 844  *      for connections not yet connected.
 845  *
 846  * @param metadata
 847  *      A `sec_protocol_metadata_t` instance.
 848  *
 849  * @return A millisecond measurement of the TLS handshake time from start to finish.
 850  */
 851 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 852 #define SEC_PROTOCOL_HAS_METRIC_SPI_V1
 853 uint64_t
 854 sec_protocol_metadata_get_handshake_time_ms(sec_protocol_metadata_t metadata);
 855
 856 /*!
 857  * @function sec_protocol_metadata_get_handshake_rtt
 858  *
 859  * @abstract
 860  *      Get the observed TLS handshake RTT. This function must only be
 861  *      called after the connection is established. Calling this before
 862  *      the connection completes will yields an undefined result.
 863  *
 864  *      This is computed as the average RTT across all 1-RTT exchanges.
 865  *      For TLS 1.3, this will be the time for the normal exchange. For prior
 866  *      versions, or TLS 1.3 with HRR, this will be the average RTT across
 867  *      multiple message flights.
 868  *
 869  * @param metadata
 870  *      A `sec_protocol_metadata_t` instance.
 871  *
 872  * @return A millisecond measurement of the TLS handshake RTT.
 873  */
 874 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 875 uint64_t
 876 sec_protocol_metadata_get_handshake_rtt(sec_protocol_metadata_t metadata);
 877
 878 /*!
 879  * @function sec_protocol_metadata_get_handshake_byte_count
 880  *
 881  * @abstract
 882  *      Get the total number of bytes sent and received for the handshake.
 883  *
 884  * @param metadata
 885  *      A `sec_protocol_metadata_t` instance.
 886  *
 887  * @return Number of bytes sent and received for the handshake.
 888  */
 889 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 890 uint64_t
 891 sec_protocol_metadata_get_handshake_byte_count(sec_protocol_metadata_t metadata);
 892
 893 /*!
 894  * @function sec_protocol_metadata_get_handshake_sent_byte_count
 895  *
 896  * @abstract
 897  *      Get the total number of bytes sent for the handshake.
 898  *
 899  * @param metadata
 900  *      A `sec_protocol_metadata_t` instance.
 901  *
 902  * @return Number of bytes sent for the handshake.
 903  */
 904 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 905 uint64_t
 906 sec_protocol_metadata_get_handshake_sent_byte_count(sec_protocol_metadata_t metadata);
 907
 908 /*!
 909  * @function sec_protocol_metadata_get_handshake_received_byte_count
 910  *
 911  * @abstract
 912  *      Get the total number of bytes received for the handshake.
 913  *
 914  * @param metadata
 915  *      A `sec_protocol_metadata_t` instance.
 916  *
 917  * @return Number of bytes received for the handshake.
 918  */
 919 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 920 uint64_t
 921 sec_protocol_metadata_get_handshake_received_byte_count(sec_protocol_metadata_t metadata);
 922
 923 /*!
 924  * @function sec_protocol_metadata_get_handshake_read_stall_count
 925  *
 926  * @abstract
 927  *      Get the total number of read stalls during the handshake.
 928  *
 929  * @param metadata
 930  *      A `sec_protocol_metadata_t` instance.
 931  *
 932  * @return Number of read stalls.
 933  */
 934 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 935 size_t
 936 sec_protocol_metadata_get_handshake_read_stall_count(sec_protocol_metadata_t metadata);
 937
 938 /*!
 939  * @function sec_protocol_metadata_get_handshake_write_stall_count
 940  *
 941  * @abstract
 942  *      Get the total number of write stalls during the handshake.
 943  *
 944  * @param metadata
 945  *      A `sec_protocol_metadata_t` instance.
 946  *
 947  * @return Number of write stalls.
 948  */
 949 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 950 size_t
 951 sec_protocol_metadata_get_handshake_write_stall_count(sec_protocol_metadata_t metadata);
 952
 953 /*!
 954  * @function sec_protocol_metadata_get_handshake_async_call_count
 955  *
 956  * @abstract
 957  *      Get the total number of asynchronous callbacks invoked during the handshake.
 958  *
 959  * @param metadata
 960  *      A `sec_protocol_metadata_t` instance.
 961  *
 962  * @return Number of asynchronous callbacks.
 963  */
 964 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 965 size_t
 966 sec_protocol_metadata_get_handshake_async_call_count(sec_protocol_metadata_t metadata);
 967
 968 /*!
 969  * @function sec_protocol_metadata_copy_sec_trust
 970  *
 971  * @abstract
 972  *      Copy the `sec_trust_t` associated with a connection.
 973  *
 974  * @param metadata
 975  *      A `sec_protocol_metadata_t` instance.
 976  *
 977  * @return A `sec_trust_t` instance.
 978  */
 979 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 980 SEC_RETURNS_RETAINED __nullable sec_trust_t
 981 sec_protocol_metadata_copy_sec_trust(sec_protocol_metadata_t metadata);
 982
 983 /*!
 984  * @function sec_protocol_metadata_copy_sec_identity
 985  *
 986  * @abstract
 987  *      Copy the `sec_identity_t` associated with a connection.
 988  *
 989  * @param metadata
 990  *      A `sec_protocol_metadata_t` instance.
 991  *
 992  * @return A `sec_identity_t` instance.
 993  */
 994 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
 995 SEC_RETURNS_RETAINED __nullable sec_identity_t
 996 sec_protocol_metadata_copy_sec_identity(sec_protocol_metadata_t metadata);
 997
 998 /*!
 999  * @function sec_protocol_metadata_access_sent_certificates
1000  *
1001  * @abstract
1002  *      Access the certificates which were sent to the peer on this connection.
1003  *
1004  * @param metadata
1005  *      A `sec_protocol_metadata_t` instance.
1006  *
1007  * @param handler
1008  *      A block to invoke one or more times with `sec_certificate_t` instances.
1009  *
1010  * @return Returns true if the peer certificates were accessible, false otherwise.
1011  */
1012 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1013 bool
1014 sec_protocol_metadata_access_sent_certificates(sec_protocol_metadata_t metadata,
1015                                                void (^handler)(sec_certificate_t certificate));
1016
1017 /*!
1018  * @function sec_protocol_metadata_get_tls_negotiated_group
1019  *
1020  * @abstract
1021  *      Get a human readable representation of the negotiated key exchange group.
1022  *
1023  * @param metadata
1024  *      A `sec_protocol_metadata_t` instance.
1025  *
1026  * @return A string representation of the negotiated group, or NULL if it does not exist.
1027  */
1028 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1029 const char * __nullable
1030 sec_protocol_metadata_get_tls_negotiated_group(sec_protocol_metadata_t metadata);
1031
1032 /*!
1033  * @function sec_protocol_configuration_copy_singleton
1034  *
1035  * @abstract
1036  *      Copy the per-process `sec_protocol_configuration_t` object.
1037  *
1038  * @return A non-nil `sec_protocol_configuration_t` instance.
1039  */
1040 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1041 SEC_RETURNS_RETAINED sec_protocol_configuration_t
1042 sec_protocol_configuration_copy_singleton(void);
1043
1044 #ifndef SEC_OBJECT_IMPL
1045 SEC_OBJECT_DECL(sec_protocol_configuration_builder);
1046 #endif // !SEC_OBJECT_IMPL
1047
1048 /*!
1049  * @function sec_protocol_configuration_builder_create
1050  *
1051  * @abstract
1052  *      This function is exposed for testing purposes only. It MUST NOT be called by clients.
1053  */
1054 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1055 SEC_RETURNS_RETAINED sec_protocol_configuration_builder_t
1056 sec_protocol_configuration_builder_create(CFDictionaryRef dictionary, bool is_apple);
1057
1058 /*!
1059  * @function sec_protocol_configuration_create_with_builder
1060  *
1061  * @abstract
1062  *      This function is exposed for testing purposes only. It MUST NOT be called by clients.
1063  */
1064 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1065 SEC_RETURNS_RETAINED __nullable sec_protocol_configuration_t
1066 sec_protocol_configuration_create_with_builder(sec_protocol_configuration_builder_t builder);
1067
1068 /*!
1069  * @block sec_protocol_output_handler_access_block_t
1070  *
1071  * @abstract
1072  *      Block to be invoked to obtain the output handler for a given encryption level.
1073  */
1074 typedef void *_Nullable(^sec_protocol_output_handler_access_block_t)(sec_protocol_tls_encryption_level_t level);
1075
1076 /*!
1077  * @function sec_protocol_options_set_output_handler_access_block
1078  *
1079  * @abstract
1080  *      Set a block used to access output handler instances identified by encryption level.
1081  */
1082 #define SEC_PROTOCOL_HAS_QUIC_OUTPUT_HANDLER_ACCESS_BLOCK 1
1083 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1084 void
1085 sec_protocol_options_set_output_handler_access_block(sec_protocol_options_t options,
1086                                                      sec_protocol_output_handler_access_block_t access_block);
1087
1088 /*!
1089  * @function sec_protocol_helper_ciphersuite_group_to_ciphersuite_list
1090  *
1091  * @abstract
1092  *      Return a pointer to a statically allocated list of ciphersuites corresponding to `group`.
1093  *
1094  * @param group
1095  *      A `tls_ciphersuite_group_t` instance.
1096  *
1097  * @param list_count
1098  *      Pointer to storage for the ciphersuite list length.
1099  *
1100  * @return Pointer to a statically allocated list, or NULL if an error occurred.
1101  */
1102 API_AVAILABLE(macos(10.15), ios(13.0), watchos(6.0), tvos(13.0))
1103 const tls_ciphersuite_t * __nullable
1104 sec_protocol_helper_ciphersuite_group_to_ciphersuite_list(tls_ciphersuite_group_t group, size_t *list_count);
1105
1106 #define SEC_PROTOCOL_HAS_MULTI_PSK_SUPPORT 1
1107
1108 struct sec_protocol_options_content {
1109     SSLProtocol min_version;
1110     SSLProtocol max_version;
1111
1112     // Reference-counted types
1113     char *server_name;
1114     __nullable xpc_object_t ciphersuites;
1115     xpc_object_t application_protocols;
1116     sec_identity_t identity;
1117     sec_array_t certificates;
1118     xpc_object_t pre_shared_keys;
1119     dispatch_data_t psk_identity_hint;
1120     sec_protocol_key_update_t key_update_block;
1121     dispatch_queue_t key_update_queue;
1122     sec_protocol_challenge_t challenge_block;
1123     dispatch_queue_t challenge_queue;
1124     sec_protocol_verify_t verify_block;
1125     dispatch_queue_t verify_queue;
1126     dispatch_data_t quic_transport_parameters;
1127     sec_protocol_tls_encryption_secret_update_t tls_secret_update_block;
1128     dispatch_queue_t tls_secret_update_queue;
1129     sec_protocol_session_update_t session_update_block;
1130     dispatch_queue_t session_update_queue;
1131     dispatch_data_t session_state;
1132     sec_protocol_private_key_sign_t private_key_sign_block;
1133     sec_protocol_private_key_decrypt_t private_key_decrypt_block;
1134     dispatch_queue_t private_key_queue;
1135     dispatch_data_t dh_params;
1136     xpc_object_t key_exchange_groups;
1137     sec_protocol_tls_handshake_message_handler_t handshake_message_callback;
1138     dispatch_queue_t handshake_message_callback_queue;
1139     sec_protocol_pre_shared_key_selection_t psk_selection_block;
1140     dispatch_queue_t psk_selection_queue;
1141
1142     // ATS minimums
1143     size_t minimum_rsa_key_size;
1144     size_t minimum_ecdsa_key_size;
1145     SecSignatureHashAlgorithm minimum_signature_algorithm;
1146
1147     // Non-boolean options
1148     uint8_t tls_ticket_request_count;
1149
1150     // QUIC-specific access block
1151     sec_protocol_output_handler_access_block_t output_handler_access_block;
1152
1153     // Boolean flags
1154     unsigned ats_required : 1;
1155     unsigned ats_minimum_tls_version_allowed : 1;
1156     unsigned ats_non_pfs_ciphersuite_allowed : 1;
1157     unsigned trusted_peer_certificate : 1;
1158     unsigned trusted_peer_certificate_override : 1;
1159     unsigned disable_sni : 1;
1160     unsigned disable_sni_override : 1;
1161     unsigned enable_fallback_attempt : 1;
1162     unsigned enable_fallback_attempt_override : 1;
1163     unsigned enable_false_start : 1;
1164     unsigned enable_false_start_override : 1;
1165     unsigned enable_tickets : 1;
1166     unsigned enable_tickets_override : 1;
1167     unsigned enable_sct : 1;
1168     unsigned enable_sct_override : 1;
1169     unsigned enable_ocsp : 1;
1170     unsigned enable_ocsp_override : 1;
1171     unsigned enforce_ev : 1;
1172     unsigned enforce_ev_override : 1;
1173     unsigned enable_resumption : 1;
1174     unsigned enable_resumption_override : 1;
1175     unsigned enable_renegotiation : 1;
1176     unsigned enable_renegotiation_override : 1;
1177     unsigned enable_early_data : 1;
1178     unsigned enable_early_data_override : 1;
1179     unsigned peer_authentication_required : 1;
1180     unsigned peer_authentication_override : 1;
1181     unsigned certificate_compression_enabled : 1;
1182     unsigned tls_SIKE503_exchange_enabled : 1;
1183     unsigned tls_HRSS_exchange_enabled : 1;
1184     unsigned eddsa_enabled : 1;
1185     unsigned tls_delegated_credentials_enabled : 1;
1186     unsigned tls_grease_enabled : 1;
1187 };
1188
1189 struct sec_protocol_metadata_content {
1190     void *exporter_context; // Opaque context for the exporter function
1191     sec_protocol_metadata_exporter exporter_function; // Exporter function pointer. This MUST be set by the metadata allocator.
1192     void *session_exporter_context; // Opaque context for the session exporter function
1193     sec_protocol_metadata_session_exporter session_exporter_function;
1194
1195     SSLProtocol negotiated_protocol_version;
1196     SSLCipherSuite negotiated_ciphersuite;
1197     const char *negotiated_protocol;
1198     const char *server_name;
1199
1200     sec_array_t sent_certificate_chain;
1201     sec_array_t peer_certificate_chain;
1202     xpc_object_t pre_shared_keys;
1203     dispatch_data_t peer_public_key;
1204     xpc_object_t supported_signature_algorithms;
1205     dispatch_data_t request_certificate_types;
1206     sec_array_t signed_certificate_timestamps;
1207     sec_array_t ocsp_response;
1208     sec_array_t distinguished_names;
1209     dispatch_data_t quic_transport_parameters;
1210     sec_identity_t identity;
1211     sec_trust_t trust_ref;
1212     const char *negotiated_curve;
1213     const char *peer_public_key_type;
1214     const char *certificate_request_type;
1215     uint64_t ticket_lifetime;
1216     uint64_t max_early_data_supported;
1217     uint64_t alert_type;
1218     uint64_t alert_code;
1219     uint64_t handshake_state;
1220     uint64_t stack_error;
1221     uint64_t handshake_rtt;
1222     uint16_t certificate_compression_algorithm;
1223     uint64_t handshake_time;
1224     uint64_t total_byte_count;
1225     uint64_t sent_byte_count;
1226     uint64_t received_byte_count;
1227     size_t read_stall_count;
1228     size_t write_stall_count;
1229     size_t async_call_count;
1230
1231     unsigned failure : 1;
1232     unsigned sct_enabled : 1;
1233     unsigned ocsp_enabled : 1;
1234     unsigned early_data_accepted : 1;
1235     unsigned false_start_used : 1;
1236     unsigned ticket_offered : 1;
1237     unsigned ticket_received : 1;
1238     unsigned session_resumed : 1;
1239     unsigned session_renewed : 1;
1240     unsigned resumption_attempted : 1;
1241     unsigned alpn_used : 1;
1242     unsigned npn_used : 1;
1243     unsigned early_data_sent : 1;
1244     unsigned certificate_compression_used : 1;
1245 };
1246
1247 SEC_ASSUME_NONNULL_END
1248
1249 __END_DECLS
1250
1251 #endif /* SecProtocolPriv_h */