int tls_set_config(mbedtls_ssl_config **tls_config, t_tls_setup *tls_setup) {
if ((*tls_config = (mbedtls_ssl_config*)malloc(sizeof(mbedtls_ssl_config))) == NULL) {
return -1;
}
mbedtls_ssl_config_init(*tls_config);
if (mbedtls_ssl_config_defaults(*tls_config, MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT) != 0) {
return -1;
}
mbedtls_ssl_conf_min_version(*tls_config, MBEDTLS_SSL_MAJOR_VERSION_3, tls_setup->min_tls_version);
mbedtls_ssl_conf_renegotiation(*tls_config, MBEDTLS_SSL_RENEGOTIATION_DISABLED);
mbedtls_ssl_conf_rng(*tls_config, tls_random, &ctr_drbg);
mbedtls_ssl_conf_sni(*tls_config, sni_callback, NULL);
mbedtls_ssl_conf_session_cache(*tls_config, &cache, mbedtls_ssl_cache_get, mbedtls_ssl_cache_set);
#ifdef ENABLE_DEBUG
mbedtls_ssl_conf_dbg(*tls_config, tls_debug, &tls_config);
#endif
mbedtls_ssl_conf_ciphersuites_for_version(*tls_config, ciphersuites_tls10, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_1);
mbedtls_ssl_conf_ciphersuites_for_version(*tls_config, ciphersuites_tls10, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_2);
mbedtls_ssl_conf_ciphersuites_for_version(*tls_config, ciphersuites_tls12, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3);
if (tls_setup->ca_certificate == NULL) {
mbedtls_ssl_conf_authmode(*tls_config, MBEDTLS_SSL_VERIFY_NONE);
} else {
mbedtls_ssl_conf_authmode(*tls_config, MBEDTLS_SSL_VERIFY_REQUIRED);
mbedtls_ssl_conf_ca_chain(*tls_config, tls_setup->ca_certificate, tls_setup->ca_crl);
}
mbedtls_ssl_conf_own_cert(*tls_config, tls_setup->certificate, tls_setup->private_key);
if (tls_setup->dh_size == 2048) {
mbedtls_ssl_conf_dh_param(*tls_config, MBEDTLS_DHM_RFC5114_MODP_2048_P, MBEDTLS_DHM_RFC5114_MODP_2048_G);
} else if (tls_setup->dh_size == 4096) {
mbedtls_ssl_conf_dh_param(*tls_config, dhm_4096_P, dhm_4096_G);
} else if (tls_setup->dh_size == 8192) {
mbedtls_ssl_conf_dh_param(*tls_config, dhm_8192_P, dhm_8192_G);
}
return 0;
}
static value conf_set_servername_callback( value config, value cb ){
val_check_kind(config,k_ssl_conf);
val_check_function(cb,1);
mbedtls_ssl_conf_sni( val_conf(config), sni_callback, (void *)cb );
return val_true;
}