ssl.h

Go to the documentation of this file.

/*
 * ssl.h
 *
 * SSL Developer API
 *
 * Copyright 2019-2024 DigiCert, Inc. All Rights Reserved.
 * Proprietary and Confidential Material.
 *
 */

/*------------------------------------------------------------------*/

#ifndef __SSL_HEADER__
#define __SSL_HEADER__

#include "../crypto/hw_accel.h"
#include "../common/moc_net.h"
#include "../common/vlong.h"
#include "../common/mtcp.h"

#include "../common/sizedbuffer.h"
#ifdef __ENABLE_MOCANA_OPENSSL_SHIM__
#include "../openssl_wrapper/openssl_shim.h"
#endif

#ifndef __DISABLE_MOCANA_SSL_CERTIFICATE_CALLBACK__
#include "../crypto/pubcrypto.h"
#include "../crypto/ca_mgmt.h"
#include "../crypto/cert_chain.h"
#endif

#ifdef __ENABLE_MOCANA_MBEDTLS_SHIM__
#include "../mbedtls_wrapper/mbedtls_shim.h"
#endif

#ifdef __cplusplus
extern "C" {
#endif

/* NOTE: copyed over from ike_utils.h */
#ifndef __ENABLE_MOCANA_IPV6__

#define ZERO_MOC_IPADDR(a)      a = 0
#define ISZERO_MOC_IPADDR(a)    (0 == a)
#define SAME_MOC_IPADDR(a, b)   (a == b)
#define COPY_MOC_IPADDR(d, s)   d = s
#define REF_MOC_IPADDR(a)       a
#define GET_MOC_IPADDR4(a)      a
#define SET_MOC_IPADDR4(a, v)   a = v;
#define LT_MOC_IPADDR4(a, b)    (a < b)
#define LT_MOC_IPADDR           LT_MOC_IPADDR4
#define TEST_MOC_IPADDR6(a, _c)

#else

#ifndef AF_INET
#define AF_INET     2   /* Internet IP Protocol */
#endif

#ifndef AF_INET6        /* IP version 6 */
#if defined(__LINUX_RTOS__)
#define AF_INET6    10
#elif defined (__WIN32_RTOS__)
#define AF_INET6    23
#else
#error Must define AF_INET6
#endif
#endif

#define ZERO_MOC_IPADDR(s)      (s).family = 0;\
                                (s).uin.addr6[0] = (s).uin.addr6[1] =\
                                (s).uin.addr6[2] = (s).uin.addr6[3] = 0
#define ISZERO_MOC_IPADDR(s)    (0 == (s).family)
#define SAME_MOC_IPADDR(a, s)   ((a) && ((a)->family == (s).family) &&\
                                 (((AF_INET == (a)->family) &&\
                                   ((a)->uin.addr == (s).uin.addr))\
                                  ||\
                                  ((AF_INET6 == (a)->family) &&\
                                   ((a)->uin.addr6[0] == (s).uin.addr6[0]) &&\
                                   ((a)->uin.addr6[1] == (s).uin.addr6[1]) &&\
                                   ((a)->uin.addr6[2] == (s).uin.addr6[2]) &&\
                                   ((a)->uin.addr6[3] == (s).uin.addr6[3]))\
                                  ))
#define COPY_MOC_IPADDR(s, a)   s = *(a)
#define REF_MOC_IPADDR(s)       &(s)
#define GET_MOC_IPADDR4(a)      (a)->uin.addr
#define SET_MOC_IPADDR4(s, v)   (s).family = AF_INET; (s).uin.addr = v
#define LT_MOC_IPADDR4(x, y)    ((x).uin.addr < (y).uin.addr)

#define TEST_MOC_IPADDR6(a, _c) if (AF_INET6 == (a)->family) _c else

#define GET_MOC_IPADDR6(a)      (ubyte *) (a)->uin.addr6
#define SET_MOC_IPADDR6(s, v)   (s).family = AF_INET6;\
                                MOC_MEMCPY((ubyte *) (s).uin.addr6, (ubyte *)(v), 16)
#define LT_MOC_IPADDR6(x, y)    ((GET_NTOHL((x).uin.addr6[0]) < GET_NTOHL((y).uin.addr6[0])) ||\
                                 (((x).uin.addr6[0] == (y).uin.addr6[0]) &&\
                                  ((GET_NTOHL((x).uin.addr6[1]) < GET_NTOHL((y).uin.addr6[1])) ||\
                                   (((x).uin.addr6[1] == (y).uin.addr6[1]) &&\
                                    ((GET_NTOHL((x).uin.addr6[2]) < GET_NTOHL((y).uin.addr6[2])) ||\
                                     (((x).uin.addr6[2] == (y).uin.addr6[2]) &&\
                                      (GET_NTOHL((x).uin.addr6[3]) < GET_NTOHL((y).uin.addr6[3]))))))))
#define LT_MOC_IPADDR(p, q)     (((p).family != (q).family) ||\
                                 ((AF_INET == (p).family) ? LT_MOC_IPADDR4(p, q) : LT_MOC_IPADDR6(p, q)))

#endif /* __ENABLE_MOCANA_IPV6__ */

#if defined(__ENABLE_MOCANA_TAP_OSSL_REMOTE__) || defined(__ENABLE_MOCANA_SSL_SSLCONNECT_RENAME__)
#define SSL_connect MOC_SSL_connect
#endif

#if !defined( __ENABLE_MOCANA_SSL_CLIENT__ ) && defined( __ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__ )
#define __ENABLE_MOCANA_SSL_CLIENT__
#endif

#if !defined( __ENABLE_MOCANA_SSL_SERVER__ ) && defined( __ENABLE_MOCANA_SSL_ASYNC_SERVER_API__ )
#define __ENABLE_MOCANA_SSL_SERVER__
#endif

/* check for possible build configuration errors */
#ifndef __ENABLE_MOCANA_SSL_DUAL_MODE_API__
#if defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__) && defined(__ENABLE_MOCANA_SSL_SERVER__) && !defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__)
#error SSL build configuration error.  Mixing async client w/ sync server prohibited.
#endif

#if defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__) && defined(__ENABLE_MOCANA_SSL_CLIENT__) && !defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__)
#error SSL build configuration error.  Mixing async server w/ sync client prohibited.
#endif
#endif /* __ENABLE_MOCANA_SSL_DUAL_MODE_API__ */

#if defined(__ENABLE_MOCANA_SSL_SERVER__) || defined(__ENABLE_MOCANA_SSL_CLIENT__)

#ifdef _DEBUG
#define TIMEOUT_SSL_RECV                    (0)
#define TIMEOUT_SSL_HELLO                   (0)
#else
/* timeouts in milliseconds  0 means for ever */
#define TIMEOUT_SSL_RECV                    (15000)
#define TIMEOUT_SSL_HELLO                   (15000)
#endif

#define TIMEOUT_DTLS_CONNECT_TIMED_WAIT     (2*60*1000)

#ifndef SSL_WRITE_FAIL_RETRY_TIME
#define SSL_WRITE_FAIL_RETRY_TIME           (5)
#endif

/* for reference */
#define SSL_DEFAULT_TCPIP_PORT              (443)

/* sizes */
#define SSL_SHA512_FINGER_PRINT_SIZE        (64)
#define SSL_SHA_FINGER_PRINT_SIZE           (20)
#define SSL_MD5_FINGER_PRINT_SIZE           (16)
#ifdef __UCOS_DIRECT_RTOS__
#define SSL_SYNC_BUFFER_SIZE                (512)
#else
#define SSL_SYNC_BUFFER_SIZE                (2048)
#endif /* __UCOS_DIRECT_RTOS__ */
#define SSL_MAXSESSIONIDSIZE                (32)

#ifndef SSL_MASTERSECRETSIZE
#define SSL_MASTERSECRETSIZE                (48)
#endif

#define SSL_ALPN_MAX_SIZE                   (64)

#define SSL_PSK_SERVER_IDENTITY_LENGTH      (128)  /* also max for SRP salt size */
#define SSL_PSK_MAX_LENGTH                  (64)
#define SSL_PSK_TLS13_MAX_LENGTH            (64)

#define SSL_PSK_IDENTITY_TLS13_MAX_LENGTH   (32)
#define SSL_SESSION_TICKET_NONCE_SIZE       (64)
#define SSL_PSK_TLS13_MIN_BINDER_LENGTH     (32)
#define SSL_PSK_TLS13_MAX_BINDER_LENGTH     (255)
#define SSL_TLS13_RECV_EARLY_DATA_SIZE      (16384)
#define SSL_MAX_NUM_CIPHERS                 (150)


/* SSL runtime flags */
#define SSL_FLAG_REQUIRE_MUTUAL_AUTH         (0x00000001L)
#define SSL_FLAG_NO_MUTUAL_AUTH_REQUEST      (0x00000002L)       /* for server */
#define SSL_FLAG_NO_MUTUAL_AUTH_REPLY        (0x00000002L)       /* for client */
#define SSL_FLAG_ENABLE_SEND_EMPTY_FRAME     (0x00000004L)
#define SSL_FLAG_ENABLE_SEND_BUFFER          (0x00000008L)
#define SSL_FLAG_ENABLE_RECV_BUFFER          (0x00000010L)
#define SSL_FLAG_ENABLE_POST_HANDSHAKE_AUTH  (0x00000020L)
#define SSL_FLAG_ALLOW_INSECURE_REHANDSHAKE  (0x00000080L)       /* permit legacy renegotiation */

/* DTLS runtime flags */
#define DTLS_FLAG_ENABLE_SRTP_DATA_SEND     (0x00001000L)

/* SSL runtime flags: upper 2 octect for internal use only */
#define SSL_FLAG_INTERNAL_USE                   (0xFF000000L)
#define SSL_FLAG_VERSION_SET                    (0x80000000L)
#define SSL_FLAG_MINIMUM_FALLBACK_VERSION_SET   (0x40000000L)
#define SSL_FLAG_SCSV_FALLBACK_VERSION_SET      (0x20000000L)
#define SSL_PSK_EXCHANGE_MODE_FLAG_SET          (0x10000000L)

/*TLS 1.2 SUITE B minimum level of security */
#define SSL_TLS12_MINLOS_128                 (1)
#define SSL_TLS12_MINLOS_192                 (2)

/* SSL ioctl settings */
#define SSL_SET_VERSION                         (1)
#define SSL_SET_MINIMUM_VERSION                 (2)
#define SSL_SET_SCSV_VERSION                    (3)
#define SSL_SET_RECV_TIMEOUT                    (4)
#define SSL_GET_CLIENT_RANDOM                   (5)
#define SSL_GET_SERVER_RANDOM                   (6)

/* SSL_Settings_Ioctl */
#define SSL_SETTINGS_MAX_BYTE_COUNT             (1)
#define SSL_SETTINGS_MAX_TIMER_COUNT            (2)
#define SSL_SETTINGS_GET_RECV_MAX_EARLY_DATA    (3)
#define SSL_SETTINGS_SET_RECV_MAX_EARLY_DATA    (4)

/* DTLS ioctl settings */
#define DTLS_SET_HANDSHAKE_RETRANSMISSION_TIMER (10)
#define DTLS_SET_PMTU                           (11)
#define DTLS_USE_SRTP                           (12)
#define DTLS_SET_HELLO_VERIFIED                 (13)

/* TLS v1.3 Ioctl settings */
#define SSL_REQUEST_SESSION_TICKET              (21)
#define SSL_PSK_KEY_EXCHANGE_MODE               (22)

#define SSL_GET_EARLY_DATA_STATUS               (23)
#define SSL_GET_KEY_UPDATE_DATA_TYPE            (24)

#define SSL_GET_MAX_EARLY_DATA                  (25)
#define SSL_SET_MAX_EARLY_DATA                  (26)

#define SSL_SET_NUM_TICKETS                     (27)
#define SSL_GET_NUM_TICKETS                     (28)
#define SSL_SET_SEND_EARLY_DATA                 (29)

#define SSL_SET_USE_EXTENDED_MASTERSECRET       (30)

/* TLS v1.3 Ioctl setting */
#define SSL_ENABLE_TLS13_SESSION_TICKETS        (31)

#if 0
#define SSL_SET_BLOCK_PADDING                   (32)
#define SSL_SET_MAX_FRAGMENT_LENGTH             (33)
#define SSL_GET_MAX_FRAGMENT_LENGTH             (34)
#endif

/* TLS v1.3 Ioctl setting */
#define SSL_SET_SESSION_TICKET_NONCE_LEN        (35)

/* SSL Record Header type */
#define SSL_CHANGE_CIPHER_SPEC              (20)
#define SSL_ALERT                           (21)
#define SSL_HANDSHAKE                       (22)
#define SSL_APPLICATION_DATA                (23)
#define SSL_INNER_APPLICATION               (24)
/* Enumeration for SSL_INNER_APPLICATION and SSL_HEARTBEAT is same */
#if defined(__ENABLE_MOCANA_SSL_HEARTBEAT_RFC_6520__)
#define SSL_HEARTBEAT                       (24)
#endif
#define SSL_ACK                             (26)

/* SSL Alert level */
#define SSLALERTLEVEL_WARNING               (1)
#define SSLALERTLEVEL_FATAL                 (2)

/* SSL Alert description */
#define SSL_ALERT_CLOSE_NOTIFY                      (0)
#define SSL_ALERT_UNEXPECTED_MESSAGE                (10)
#define SSL_ALERT_BAD_RECORD_MAC                    (20)
#define SSL_ALERT_DECRYPTION_FAILED                 (21)
#define SSL_ALERT_RECORD_OVERFLOW                   (22)
#define SSL_ALERT_DECOMPRESSION_FAILURE             (30)
#define SSL_ALERT_HANDSHAKE_FAILURE                 (40)
#define SSL_ALERT_NO_CERTIFICATE                    (41)
#define SSL_ALERT_BAD_CERTIFICATE                   (42)
#define SSL_ALERT_UNSUPPORTED_CERTIFICATE           (43)
#define SSL_ALERT_CERTIFICATE_REVOKED               (44)
#define SSL_ALERT_CERTIFICATE_EXPIRED               (45)
#define SSL_ALERT_CERTIFICATE_UNKNOWN               (46)
#define SSL_ALERT_ILLEGAL_PARAMETER                 (47)
#define SSL_ALERT_UNKNOWN_CA                        (48)
#define SSL_ALERT_ACCESS_DENIED                     (49)
#define SSL_ALERT_DECODE_ERROR                      (50)
#define SSL_ALERT_DECRYPT_ERROR                     (51)
#define SSL_ALERT_EXPORT_RESTRICTION                (60)
#define SSL_ALERT_PROTOCOL_VERSION                  (70)
#define SSL_ALERT_INSUFFICIENT_SECURITY             (71)
#define SSL_ALERT_INTERNAL_ERROR                    (80)
#define SSL_ALERT_INAPPROPRIATE_FALLBACK            (86)
#define SSL_ALERT_USER_CANCELED                     (90)
#define SSL_ALERT_NO_RENEGOTIATION                  (100)
#define SSL_ALERT_MISSING_EXTENSION                 (109)
#define SSL_ALERT_UNSUPPORTED_EXTENSION             (110)
#define SSL_ALERT_CERTIFICATE_UNOBTAINABLE          (111)
#define SSL_ALERT_UNRECOGNIZED_NAME                 (112)
#define SSL_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE   (113)
#define SSL_ALERT_BAD_CERTIFICATE_HASH_VALUE        (114)
#define SSL_ALERT_UNKNOWN_PSK_IDENTITY              (115)
#define SSL_ALERT_CERTIFICATE_REQUIRED              (116)
#define SSL_ALERT_NO_APPLICATION_PROTOCOL           (120)
#define SSL_ALERT_INNER_APPLICATION_FAILURE         (208)
#define SSL_ALERT_INNER_APPLICATION_VERIFICATION    (209)

#define SSL_ALERT_DIRECTION_BIT             (0x40000000)

#define SSL_CONNECTION_RENEGOTIATE          (4)
#define SSL_CONNECTION_OPEN                 (3)
#define SSL_CONNECTION_NEGOTIATE            (2)

#ifndef MIN_SSL_RSA_SIZE
#define MIN_SSL_RSA_SIZE                (2048)
#endif

#ifndef MIN_SSL_DH_SIZE
#define MIN_SSL_DH_SIZE                 (1024)
#endif

#ifndef MAX_SSL_DH_SIZE
#define MAX_SSL_DH_SIZE                 (8192)
#endif

    /* default DH group size is 2048: the values allowed are defined in
     crypto/dh.h */
#ifndef SSL_DEFAULT_DH_GROUP
#define SSL_DEFAULT_DH_GROUP            DH_GROUP_14
#endif

#define SSL3_MAJORVERSION               (3)
#define SSL3_MINORVERSION               (0)
#define TLS10_MINORVERSION              (1)
#define TLS11_MINORVERSION              (2)
#define TLS12_MINORVERSION              (3)
#define TLS13_MINORVERSION              (4)

#ifdef __ENABLE_MOCANA_TLS12_MIN_VERSION__
#define MIN_SSL_MINORVERSION  (TLS12_MINORVERSION)
#endif
    
    /* define max and min version if not specified
     disable SSLv3 by default */
#ifndef MIN_SSL_MINORVERSION
#define MIN_SSL_MINORVERSION  (TLS10_MINORVERSION)
#endif

#ifndef MAX_SSL_MINORVERSION
#ifdef __ENABLE_MOCANA_TLS13__
#define MAX_SSL_MINORVERSION (TLS13_MINORVERSION)
#else
#define MAX_SSL_MINORVERSION (TLS12_MINORVERSION)
#endif
#endif

#define VERSION_MASK_1  (0x01)
#define VERSION_MASK_2  (0x02)
#define VERSION_MASK_3  (0x03)

#define VALID_SSL_VERSION( major, minor) (( SSL3_MAJORVERSION == major) && (MIN_SSL_MINORVERSION <= minor) && (minor <= MAX_SSL_MINORVERSION))

    /* DTLS: we should use a signed quantity for minor version and use negative numbers
     that would prevent minimum being bigger than maximum ! */
#define DTLS1_MAJORVERSION              (254)
#define DTLS10_MINORVERSION             (255)
#define DTLS12_MINORVERSION             (253)
#define DTLS13_MINORVERSION             (252)

#ifndef MIN_DTLS_MINORVERSION
#define MIN_DTLS_MINORVERSION  (DTLS10_MINORVERSION)
#endif

#ifndef MAX_DTLS_MINORVERSION
#if defined(__ENABLE_MOCANA_TLS13__) && !defined(__ENABLE_MOCANA_OPENSSL_SHIM__)
#define MAX_DTLS_MINORVERSION (DTLS13_MINORVERSION)
#else
#define MAX_DTLS_MINORVERSION (DTLS12_MINORVERSION)
#endif
#endif

    /* careful here since MAX_DTLS_MINORVERSION <= MIN_DTLS_MINORVERSION */
#if MIN_DTLS_MINORVERSION == (255)
#define VALID_DTLS_VERSION( major, minor) (( DTLS1_MAJORVERSION == major) && (minor >= MAX_DTLS_MINORVERSION))
#else
#define VALID_DTLS_VERSION( major, minor) (( DTLS1_MAJORVERSION == major) && ( MIN_DTLS_MINORVERSION >= minor) && (minor >= MAX_DTLS_MINORVERSION))
#endif

#define MAX_PASSWORD_SIZE   (128)

#if defined(__ENABLE_MOCANA_SSL_HEARTBEAT_RFC_6520__)
typedef enum
{
    noHeartbeatMessages = 0,
    peerAllowedToSend,
    peerNotAllowedToSend
} E_HeartbeatExtension;
#endif

struct AsymmetricKey;
struct certStore;

enum tlsExtensionTypes
{
    tlsExt_server_name = 0,
    tlsExt_max_fragment_length = 1,
    tlsExt_client_certificate_url = 2,
    tlsExt_trusted_ca_keys = 3,
    tlsExt_truncated_hmac = 4,
    tlsExt_status_request = 5,
    /* In TLS 1.2 and less tlsExt_supportedEllipticCurves = 10, */
    tlsExt_supportedGroups = 10,
    tlsExt_ECPointFormat = 11,
    tlsExt_SRP = 12,
    tlsExt_supportedSignatureAlgorithms = 13,
    dtlsExt_use_srtp = 14, /* RFC 5764 */
    tlsExt_heartbeat = 15,
    tlsExt_applicationLayerProtocolNegotiation = 16,
    tlsExt_signed_certificate_timestamp = 18,
#ifdef __ENABLE_MOCANA_TLS13__
    tlsExt_certificate_type = 19,
    tlsExt_server_certificate_type = 20,
#endif
    tlsExt_encrypt_then_mac = 22,
    tlsExt_extendedMasterSecret = 23,
    tlsExt_ticket = 35,
#ifdef __ENABLE_MOCANA_TLS13__
    tlsExt_pre_shared_key = 41,
    tlsExt_early_data   = 42,
    tlsExt_supported_versions = 43,
    tlsExt_cookie = 44,
    tlsExt_psk_key_exchange_modes = 45,
    tlsExt_certificateAuthorities = 47,
    tlsExt_oidFilters = 48,
    tlsExt_postHandshakeAuth    = 49,
    tlsExt_signatureAlgorithmCerts  = 50,
    tlsExt_key_share = 51,
#endif
    tlsExt_nextProtocolNegotiation = 13172,
    tlsExt_innerApplication = 37703,
    tlsExt_renegotiated_connection = 0xff01
};

#ifdef __ENABLE_MOCANA_TLS13__
enum keyUpdateRequest
{
    keyUpdateRequest_not_requested = 0,
    keyUpdateRequest_requested = 1,
    keyUpdate_none = 255
};
#endif

enum tlsExtNamedCurves
{
    /* Elliptic Curve Groups (ECDHE) */
    tlsExtNamedCurves_secp192r1 = 0x0013,
    tlsExtNamedCurves_secp224r1 = 0x0015,
    tlsExtNamedCurves_secp256r1 = 0x0017,
    tlsExtNamedCurves_secp384r1 = 0x0018,
    tlsExtNamedCurves_secp521r1 = 0x0019,
    tlsExtNamedCurves_x25519    = 0x001D,
    tlsExtNamedCurves_x448      = 0x001E,

    /* Finite Field Groups (DHE) */
    tlsExtNamedCurves_ffdhe2048 = 0x0100,
    tlsExtNamedCurves_ffdhe3072 = 0x0101,
    tlsExtNamedCurves_ffdhe4096 = 0x0102,
    tlsExtNamedCurves_ffdhe6144 = 0x0103,
    tlsExtNamedCurves_ffdhe8192 = 0x0104,

    /* Reserved Code Points
     * ecdhe_private_use(0xFE00..0xFEFF) */
    tlsExtHybrid_p256_kyber512          = 0xFE05,
    tlsExtHybrid_p256_kyber512_90s      = 0xFE06,
    tlsExtHybrid_p256_ntru_hps_2048_677 = 0xFE07,
    tlsExtHybrid_p256_ntru_hrss_701     = 0xFE08,
    tlsExtHybrid_p256_lightsaber        = 0xFE09,

    tlsExtHybrid_p384_kyber512_768      = 0xFE0A,
    tlsExtHybrid_p384_kyber_768_90s     = 0xFE0B,
    tlsExtHybrid_p384_ntru_hps_4096_821 = 0xFE0C,
    tlsExtHybrid_p384_saber             = 0xFE0D,

    tlsExtHybrid_p521_kyber_1024        = 0xFE0E,
    tlsExtHybrid_p521_kyber_1024_90s    = 0xFE0F,
    tlsExtHybrid_p521_firesaber         = 0xFE10
};

#ifdef __ENABLE_MOCANA_INNER_APP__

typedef enum innerAppType
{
    SSL_INNER_APPLICATION_DATA =0,
    SSL_INNER_INTER_FINISHED   =1,
    SSL_INNER_FINAL_FINISHED   =2,
} InnerAppType;
#endif

typedef enum nameTypeSNI
{
    nameTypeHostName = 0
    /* currently only one is supported */

} NameTypeSNI;

/* used by OCSP */
typedef enum certificateStatusType
{
    certStatusType_ocsp = 1
    /* currently only one is supported */
} CertificateStatusType;

/* New for TLS1.2: signature algorithms definitions */
typedef enum TLS_HashAlgorithm
{
    TLS_NONE        = 0,
    TLS_MD5         = 1,
    TLS_SHA1        = 2,
    TLS_SHA224      = 3,
    TLS_SHA256      = 4,
    TLS_SHA384      = 5,
    TLS_SHA512      = 6,
    TLS_INTRINSIC   = 8,
    TLS_PRIVATE     = 254,
    TLS_HASH_MAX    = 255
} TLS_HashAlgorithm;

typedef struct sessionTicketStruct
{
    ubyte2   cipherId;
    ubyte    masterSecret[SSL_MASTERSECRETSIZE];
    ubyte4   lifeTimeHintInSec;
    TimeDate startTime;
    ubyte4   ticketLen;
    ubyte    *pTicket; /* Session ticket sent by the server */
} sessionTicket;

enum tlsExtPskKeyExchangeMode
{
    psk_ke = 0,/* PSK Key establishment */
    psk_dhe_ke = 1 /* PSK with (EC)DHE Key establishment  */
};

typedef enum hashType
{
    sha1 = 0,
    sha224,
    sha256,
    sha384,
    sha512,
    md5,
    intrinsic = 8 /* for eddsa */
} hashType;


/* Below structure is based on mentioned RFC section.
 * TLS 1.3 RFC- 4.6.1.  New Session Ticket Message.
 */

typedef struct tls13PskIdentities
{
    ubyte4 pskIdentityLength;
    sbyte *pskIdentity;
    ubyte4 ticketAge;
} tls13PskIdentities;

typedef struct tls13PSK
{
    ubyte               isExternal;
    ubyte               isPSKavailable;
    ubyte4              pskTLS13LifetimeHint;
    ubyte4              pskTLS13AgeAdd;
    ubyte               ticketNonce[SSL_SESSION_TICKET_NONCE_SIZE];
    ubyte               pskTLS13[SSL_PSK_TLS13_MAX_LENGTH]; /* Max PSK length is (2^16 - 1) */
    ubyte2              pskTLS13Length;
    ubyte*              pskTLS13Identity;
    ubyte4              pskTLS13IdentityLength;
    ubyte4              obfuscatedTicketAge;
    TLS_HashAlgorithm   hashAlgo;
    TimeDate            startTime;
    ubyte4              pskReceivedTimeInMS;
    ubyte4              maxEarlyDataSize;
    ubyte2              pSelectedTlsVersion;
    ubyte               selectedALPN[SSL_ALPN_MAX_SIZE];
    ubyte2              selectedCipherSuiteId;
} tls13PSK;

typedef struct tls13PSKList
{
    tls13PSK             *pPSK;
    struct tls13PSKList  *pNextPSK;
    ubyte                *pPskData;
    ubyte4                pskDataLen;
}tls13PSKList;

typedef enum
{
    earlySecret = 0,
    binderKey,
    clientEarlyTrafficSecret,
    earlyExporterMasterSecret,
    handshakeSecret,
    clientHandshakeTrafficSecret,
    serverHandshakeTrafficSecret,
    masterSecret,
    clientApplicationTrafficSecret0,
    serverApplicationTrafficSecret0,
    exporterMasterSecret,
    resumptionMasterSecret
} tls13KDFKeyType;

/*
 * The following enums indicate the state in which stack Rx/Tx application data
 * clientEarlyData indicates the early_data sent by client as part of 0-RTT
 * serverHandshakeData indicates data sent by Server following Server Finished
 * clientHandshakeData indicates data sent by Client following Client Finished
 */
typedef enum
{
    clientEarlyData = 0,
    serverHandshakeData,
    clientHandshakeData
} dataState;

typedef struct responderID
{
    ubyte responderIDlen;
    void* pResponderID;
} ResponderID;


#if (defined( __ENABLE_MOCANA_SSL_ECDH_SUPPORT__)   || \
        defined(__ENABLE_MOCANA_SSL_ECDHE_SUPPORT__)|| \
        defined(__ENABLE_MOCANA_SSL_ECDH_ANON_SUPPORT__) )
ubyte2 SSL_getNamedCurveOfCurveId( ubyte4 curveId);
ubyte4 SSL_getCurveIdOfNamedCurve( ubyte2 namedCurve);
#endif

/* definition needed by DTLS. however the common interfaces need this definition */
typedef struct peerDescr
{
    void *pUdpDescr;
    ubyte2 srcPort;
    MOC_IP_ADDRESS_S srcAddr;
    ubyte2 peerPort;
    MOC_IP_ADDRESS_S peerAddr;
} peerDescr;

typedef struct SrtpProfileInfo
{
    ubyte2                  profileId;                  /* profile identification */
    ubyte                   supported;                  /* support by this implementation */
    sbyte                   keySize;                    /* size of key */
    sbyte                   saltSize;                   /* size of salt */
} SrtpProfileInfo;

typedef MSTATUS (*funcPtrPasswordCallback)(
    void *pCallbackInfo,
    ubyte *pBuffer,
    ubyte4 bufferLen,
    ubyte4 *pOutLen
    );

typedef struct
{
  funcPtrPasswordCallback pCallback;
  void *pCallbackInfo;
} pemPasswordInfo;

/*
 * TAP_keyHandle is ubyte8
 * TAP_tokenHandle is ubyte8
 * These datatypes should be updated if TAP_keyHandle or TAP_tokenHandle change
 */
typedef struct tapKeyHandle
{
    ubyte8              keyHandle;
    ubyte8              tokenHandle;
    ubyte               certSubjectHashValue[32];
    struct tapKeyHandle *pNextHandle;
} tapKeyHandle;

typedef struct sslSettings
{
    ubyte                   isFIPSEnabled;

    ubyte4    sslListenPort;
#ifdef __ENABLE_MOCANA_TLS13__
    ubyte                   helloCookieSecret[2][SSL_SHA512_FINGER_PRINT_SIZE];
#else
    ubyte                   helloCookieSecret[2][SSL_SHA_FINGER_PRINT_SIZE];
#endif

    ubyte4                  helloCookieSecretLen[2];
    ubyte4                  helloCookieSecretLastGenTime;
    /* indicate the helloCookieSecret version currently in use.
     * it alternates between 0 and 1 */
    ubyte                   helloCookieVersion;
    hwAccelDescr            hwAccelCookie;          /* hardware accelerator cookie */
    ubyte4                  sslTimeOutConnectTimedWait;

    SizedBuffer             *pClientCANameList;
    ubyte4                  numClientCANames;
    ubyte4                  recvEarlyDataSize; /* The max Early data Size, a server can receive in its lifetime;
                                                * This value should always be greater than or equal to maxEarlyDataSize
                                                * for current and all the previous sessions (since clients may have
                                                * valid session ticket with that maxEarlyDatSize)
                                                */

    ubyte4    sslTimeOutReceive;
    ubyte4    sslTimeOutHello;

    ubyte4      minRSAKeySize;

    ubyte4      minDHKeySize;

    intBoolean  allowSha1SigAlg;

    intBoolean  allowDSASigAlg;

    sbyte4    maxByteCount;

    sbyte4    maxTimerCountForRehandShake;

    sbyte4(*funcPtrClientRehandshakeRequest)(sbyte4 connectionInstance);

    sbyte4(*funcPtrKeyUpdateRequest)(sbyte4 connectionInstance);

    sbyte4(*funcPtrOpenStateUpcall)(sbyte4 connectionInstance, sbyte4 isRehandshake);

    void(*funcPtrReceiveUpcall)  (sbyte4 connectionInstance,
                                  ubyte *pMesg,
                                  ubyte4 mesgLen);

    void(*funcPtrStartTimer)     (sbyte4 connectionInstance,
                                  ubyte4 msTimerExpire,
                                  sbyte4 future);

    sbyte4 (*funcPtrSSLHandleTimeout)    (sbyte4 connectionInstance,
                                          ubyte4 *msAdjustedTime);

    sbyte4(*funcPtrClientOpenStateUpcall)(sbyte4 connectionInstance, sbyte4 isRehandshake);

    void(*funcPtrClientReceiveUpcall)  (sbyte4 connectionInstance,
                                        ubyte *pMesg,
                                        ubyte4 mesgLen);

    void(*funcPtrClientStartTimer)     (sbyte4 connectionInstance,
                                        ubyte4 msTimerExpire,
                                        sbyte4 future);

    sbyte4 (*funcPtrMutualAuthCertificateVerify) (sbyte4 connectionInstance, const ubyte* hash,
                                    ubyte4 hashLen, ubyte* result, ubyte4 resultLength);


    sbyte4 (*funcPtrGetHintPSK)(sbyte4 connectionInstance, ubyte hintPSK[SSL_PSK_SERVER_IDENTITY_LENGTH], ubyte4 *pRetHintLength);

    sbyte4 (*funcPtrServerSavePSK)(sbyte4 connectionInstance, ubyte *pServerName, ubyte4 serverNameLen, ubyte *pIdentityPSK, ubyte4 identityLengthPSK, ubyte *pPsk, ubyte4 pskLen);

    sbyte4 (*funcPtrServerDeletePSK)(sbyte4 connectionInstance, sbyte *pServerName, ubyte4 serverNameLen, ubyte *pIdentityPSK, ubyte4 identityLengthPSK, ubyte *pPskParams);


    sbyte4 (*funcPtrLookupPSK)(sbyte4 connectionInstance, ubyte *pIdentityPSK, ubyte4 identityLengthPSK, ubyte retPSK[SSL_PSK_MAX_LENGTH], ubyte4 *pRetLengthPSK);

    sbyte4 (*funcPtrLookupPSKParams)(sbyte4 connectionInstance, ubyte *pIdentityPSK,
                                     ubyte4 identityLengthPSK, ubyte **pPsk,
                                     ubyte4 *pPskLen, intBoolean *pFreeMemory);

    /* Stack received Application Data; This callback is used to pass the Data to the application.
     * The parameters are connectionInstance, Data received and length of data and an additional state */
    sbyte4 (*funcPtrSSLReceiveApplicationDataCallback)(sbyte4 connectoinInstance,
                                                       ubyte *pData, ubyte4 dataLen,
                                                       dataState state);


    sbyte4 (*funcPtrChoosePSK)(sbyte4 connectionInstance, ubyte *pHintPSK, ubyte4 hintLength, ubyte retPskIdentity[SSL_PSK_SERVER_IDENTITY_LENGTH], ubyte4 *pRetPskIdentity, ubyte retPSK[SSL_PSK_MAX_LENGTH], ubyte4 *pRetLengthPSK);

    sbyte4 (*funcPtrAlertCallback)(sbyte4 connectionInstance, sbyte4 alertId, sbyte4 alertClass);

    sbyte4 (*funcPtrNewHandshakeCallback)(sbyte4 connectionInstance, sbyte4 *pRetDoRehandshake, sbyte4 *pRetDoSessionResumption);

    sbyte4 (*funcPtrExtensionRequestCallback)(sbyte4 connectionInstance, ubyte4 extensionType, ubyte *pExtension, ubyte4 extensionLength);

    sbyte4 (*funcPtrPACOpaqueCallback)(sbyte4 connectionInstance, ubyte* pPACOpaque, ubyte4 pacOpaqueLen, ubyte pacKey[/*PACKEY_SIZE*/]);

    sbyte4 (*funcPtrInnerAppCallback)(sbyte4 connectionInstance, ubyte* data, ubyte4 dataLen);

    sbyte4 (*funcPtrExtensionApprovedCallback)(sbyte4 connectionInstance, ubyte4 extensionType, ubyte *pApproveExt, ubyte4 approveExtLength);


    sbyte4 (*funcPtrSrtpInitCallback)(sbyte4 connectionInstance, peerDescr *pChannelDescr, const SrtpProfileInfo* pProfile, void* keyMaterials, ubyte* mki);

    sbyte4 (*funcPtrSrtpEncodeCallback)(sbyte4 connectionInstance, peerDescr *pChannelDescr,
                                        const sbyte* pData, ubyte4 pDataLength,
                                        ubyte** encodedData, ubyte4* encodedLength);

    sbyte4 (*funcPtrChooseECCCurve)(sbyte4 connectionInstance, ubyte2 cipherSuiteID,
                                    const enum tlsExtNamedCurves* pECCCurvesList,
                                    ubyte4 eccCurvesListLength,
                                    enum tlsExtNamedCurves* selectedCurve);

    sbyte4 (*funcPtrCertStatusCallback)(sbyte4 connectionInstance, intBoolean certStatus);
    sbyte4 (*funcPtrSingleCertStatusCallback)(sbyte4 connectionInstance, const ubyte *pCert, ubyte4 certLen,
                                              ubyte* pOcspResp, ubyte4 ocspRespLen, sbyte4 ocspStatus);

    sbyte4 (*funcPtrSRPCallback)(sbyte4 connectionInstance, const ubyte* identity,
                                 ubyte4 identityLength, sbyte4* numBits,
                                 ubyte salt[SSL_PSK_SERVER_IDENTITY_LENGTH],
                                 ubyte4* saltLength,
                                 ubyte** verifier, ubyte4* verifierLength);

    ubyte  *pDHP;
    ubyte4  pLen;
    ubyte  *pDHG;
    ubyte4  gLen;
    ubyte4 lengthY;

    ubyte4 sslMinProtoVersion;
    ubyte4 sslMaxProtoVersion;

} sslSettings;

typedef sbyte4 (*SSLTransportSend)(sbyte4 sslId, sbyte *pBuffer, ubyte4 bufferLen, ubyte4 *pRetNumBytesSent);
typedef sbyte4 (*SSLTransportRecv)(sbyte4 sslId, sbyte *pRetBuffer, ubyte4 bufferSize, ubyte4 *pNumBytesReceived, ubyte4 timeout);

#if defined(__ENABLE_MOCANA_SSL_FIPS__)

MOC_EXTERN sbyte4 SSL_setFIPSEnabled(ubyte isFIPSEnabled);

MOC_EXTERN sbyte4 SSL_checkFIPS();
#endif /* __ENABLE_MOCANA_SSL_FIPS__ */

/*------------------------------------------------------------------*/

MOC_EXTERN sbyte4  SSL_shutdownStack(void);

MOC_EXTERN sbyte4  SSL_releaseTables(void);

MOC_EXTERN sbyte4 SSL_setMinRSAKeySize(ubyte4 keySize);

#if defined(__ENABLE_MOCANA_TLS12_UNSECURE_HASH__)

MOC_EXTERN sbyte4 SSL_setSha1SigAlg(intBoolean setting);
#endif

#if ((!defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__) && !defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__)) || \
     defined(__ENABLE_MOCANA_SSL_SERVER__) || defined(__ENABLE_MOCANA_SSL_CLIENT__))

MOC_EXTERN sbyte4  SSL_getInstanceFromSocket(TCP_SOCKET socket);
#endif

MOC_EXTERN sbyte4  SSL_getCookie(sbyte4 connectionInstance, void** pCookie);

/*
@brief      Get the TLS unique value for a connection instance.

@details    This function will return the TLS unique value to the caller. This
            function will allocate the buffer and the caller is responsible for
            freeing the buffer.

@ingroup    func_ssl_core

@inc_file ssl.h

@param connectionInstance   Connection instance returned from SSL_connect().
@param pTlsUniqueLen        On return, the length in bytes of the TLS unique
                              buffer.
@param ppTlsUnique          On return, a buffer which contains the TLS unique
                              value. The caller must free this buffer.
 */
MOC_EXTERN sbyte4  SSL_getTlsUnique(sbyte4 connectionInstance,
                                    ubyte4 *pTlsUniqueLen,
                                    ubyte **ppTlsUnique);

MOC_EXTERN sbyte4  SSL_setCookie(sbyte4 connectionInstance, void* cookie);

MOC_EXTERN sslSettings* SSL_sslSettings(void);

#ifndef __DISABLE_SSL_GET_SOCKET_API__

MOC_EXTERN sbyte4  SSL_getSocketId(sbyte4 connectionInstance, TCP_SOCKET *pRetSocket);
#if (defined(__ENABLE_MOCANA_DTLS_SERVER__) || defined(__ENABLE_MOCANA_DTLS_CLIENT__))

MOC_EXTERN sbyte4  SSL_getPeerDescr(sbyte4 connectionInstance, const peerDescr **ppRetPeerDescr);
#endif /* (defined(__ENABLE_MOCANA_DTLS_SERVER__) || defined(__ENABLE_MOCANA_DTLS_CLIENT__)) */

MOC_EXTERN sbyte4  SSL_isSessionSSL(sbyte4 connectionInstance);
#endif /* __DISABLE_SSL_IS_SESSION_API__ */

#if (defined(__ENABLE_MOCANA_DTLS_SERVER__) || defined(__ENABLE_MOCANA_DTLS_CLIENT__))

MOC_EXTERN sbyte4  SSL_isSessionDTLS(sbyte4 connectionInstance);


#if defined(__ENABLE_MOCANA_DTLS_EXT_API__)

MOC_EXTERN sbyte4 SSL_DTLS_getTimeout(sbyte4 connectionInstance, void *pTime);

MOC_EXTERN sbyte4 DTLS_isTimerExpired(sbyte4 connectionInstance);
#endif /*__ENABLE_MOCANA_DTLS_EXT_API__ */

#endif /* (defined(__ENABLE_MOCANA_DTLS_SERVER__) || defined(__ENABLE_MOCANA_DTLS_CLIENT__)) */

#ifndef __DISABLE_SSL_SESSION_FLAGS_API__

MOC_EXTERN sbyte4  SSL_getSessionFlags(sbyte4 connectionInstance, ubyte4 *pRetFlagsSSL);
#endif /* __DISABLE_SSL_SESSION_FLAGS_API__ */

MOC_EXTERN sbyte4  SSL_getSessionStatus(sbyte4 connectionInstance, ubyte4 *pRetStatusSSL);

#ifndef __DISABLE_SSL_SESSION_FLAGS_API__

MOC_EXTERN sbyte4  SSL_setSessionFlags(sbyte4 connectionInstance, ubyte4 flagsSSL);
#endif /* __DISABLE_SSL_SESSION_FLAGS_API__ */

#ifndef __DISABLE_SSL_IOCTL_API__

MOC_EXTERN sbyte4
SSL_Settings_Ioctl(ubyte4 setting, void *value);

MOC_EXTERN sbyte4  SSL_ioctl(sbyte4 connectionInstance, ubyte4 setting, void *value);
#endif /* __DISABLE_SSL_IOCTL_API__ */

#ifdef __ENABLE_MOCANA_SSL_ALERTS__

MOC_EXTERN sbyte4  SSL_lookupAlert(sbyte4 connectionInstance, sbyte4 lookupError, sbyte4 *pRetAlertId, sbyte4 *pAlertClass);

MOC_EXTERN sbyte4  SSL_sendAlert(sbyte4 connectionInstance, sbyte4 alertId, sbyte4 alertClass);
#endif /* __ENABLE_MOCANA_SSL_ALERTS__ */

#ifdef __ENABLE_MOCANA_SSL_CIPHER_SUITES_SELECT__

MOC_EXTERN sbyte4  SSL_enableCiphers(sbyte4 connectionInstance, const ubyte2 *pCipherSuiteList, ubyte4 listLength);

MOC_EXTERN sbyte4  SSL_getCipherList(sbyte4 connectionInstance, ubyte2 **ppCipherIdList, ubyte4 *pCount);
#if defined(__ENABLE_MOCANA_TLS13__)

MOC_EXTERN MSTATUS
SSL_setCipherAlgorithm(sbyte4 connectionInstance, ubyte2 *pList, ubyte4 listLength, ubyte4 listType);
#endif

MOC_EXTERN sbyte4  SSL_disableCipherHashAlgorithm(sbyte4 connectionInstance, TLS_HashAlgorithm hashId);

#if defined(__ENABLE_MOCANA_SSL_DSA_SUPPORT__)

MOC_EXTERN sbyte4 SSL_setDSACiphers(sbyte4 connectionInstance, ubyte enableDSACiphers);
#endif

#if (defined( __ENABLE_MOCANA_SSL_ECDH_SUPPORT__)   || \
        defined(__ENABLE_MOCANA_SSL_ECDHE_SUPPORT__)|| \
        defined(__ENABLE_MOCANA_SSL_ECDH_ANON_SUPPORT__) )

MOC_EXTERN sbyte4  SSL_enableECCCurves(sbyte4 connectionInstance,
                                       enum tlsExtNamedCurves* pECCCurvesList,
                                       ubyte4 listLength);
#endif /* __ENABLE_MOCANA_SSL_CIPHER_SUITES_SELECT__ */
#endif /* (defined( __ENABLE_MOCANA_SSL_ECDH_SUPPORT__) || defined(__ENABLE_MOCANA_SSL_ECDHE_SUPPORT__) || defined(__ENABLE_MOCANA_SSL_ECDH_ANON_SUPPORT__)) */

MOC_EXTERN sbyte4  SSL_getCipherInfo( sbyte4 connectionInstance, ubyte2* pCipherId, ubyte4* pPeerEcCurves);

MOC_EXTERN sbyte4  SSL_getSSLTLSVersion( sbyte4 connectionInstance, ubyte4* pVersion);

MOC_EXTERN sbyte4  SSL_setApplicationLayerProtocol(sbyte4 connectionInstance,
                                                   sbyte4 numNextProtocols,
                                                   const char** nextProtocols);

#if defined(__ENABLE_MOCANA_SSL_HEARTBEAT_RFC_6520__)
MOC_EXTERN MSTATUS SSL_sendHeartbeatMessage(sbyte4 connectionInstance);

MOC_EXTERN MSTATUS SSL_enableHeartbeatSupport(sbyte4 connectionInstance, E_HeartbeatExtension value,
                                              sbyte4 (*funcPtrHeatbeatMessageCallback)(sbyte4 connectionInstance,
                                                                                       sbyte4 status, ubyte heartbeatType));
#endif

#if defined(__ENABLE_MOCANA_SSL_SERVER__)

MOC_EXTERN MSTATUS SSL_setClientCAList(SizedBuffer *pClientCAList, ubyte4 numClientCANames);
#endif

#if defined(__ENABLE_MOCANA_OCSP_CLIENT__)
MOC_EXTERN sbyte4 SSL_setCertifcateStatusRequestExtensions(sbyte4 connectionInstance,
                                                           char** ppTrustedResponderCertPath,
                                                           ubyte4 trustedResponderCertCount,
                                                           extensions* pExts,
                                                           ubyte4 extCount);
MOC_EXTERN MSTATUS
SSL_setOCSPCallback(sbyte4 (*funcPtrSingleCertStatusCallback)(sbyte4 connectionInstance,
                                                              const ubyte *pCert, ubyte4 certLen,
                                                              ubyte* pOcspResp, ubyte4 oscpRespLen,
                                                              sbyte4 ocspStatus));
#endif

#if (defined(__ENABLE_MOCANA_DTLS_SERVER__) || defined(__ENABLE_MOCANA_DTLS_CLIENT__)) && defined(__ENABLE_MOCANA_DTLS_SRTP__) && defined(__ENABLE_MOCANA_SRTP_PROFILES_SELECT__)
MOC_EXTERN sbyte4 SSL_setSrtpInitCallback(sbyte4(*cb)(sbyte4 connectionInstance, peerDescr *pChannelDescr,
                                                      const SrtpProfileInfo* pProfile, void* keyMaterials, ubyte* mki));
MOC_EXTERN sbyte4 SSL_setSrtpEncodeCallback(sbyte4(*cb)(sbyte4 connectionInstance, peerDescr *pChannelDescr,
                                                        const sbyte* pData, ubyte4 pDataLength,
                                                        ubyte** encodedData, ubyte4* encodedLength));
MOC_EXTERN sbyte4 SSL_enableSrtpProfiles(sbyte4 connectionInstance, ubyte2 *pSrtpProfileList, ubyte4 listLength);
#endif

#if defined(__ENABLE_MOCANA_TLS13__)

MOC_EXTERN MSTATUS SSL_sendKeyUpdateRequest(sbyte4 connectionInstance, ubyte updateRequest);

#if (defined(__ENABLE_MOCANA_SSL_MUTUAL_AUTH_SUPPORT__) && defined(__ENABLE_MOCANA_SSL_CLIENT__)) || \
     defined(__ENABLE_MOCANA_SSL_SERVER__)
MOC_EXTERN MSTATUS SSL_getSignatureAlgo(sbyte4 connectionInstance, ubyte2 *pSigAlg);
#endif

#if defined(__ENABLE_MOCANA_SSL_MUTUAL_AUTH_SUPPORT__) && defined(__ENABLE_MOCANA_SSL_SERVER__)
MOC_EXTERN MSTATUS SSL_sendPosthandshakeAuthCertificateRequest(sbyte4 connectionInstance);
#endif

#if (defined(__ENABLE_MOCANA_TLS13_PSK__) && defined(__ENABLE_MOCANA_TLS13_0RTT__))

MOC_EXTERN sbyte4 SSL_setRecvEarlyDataSize(sbyte4 connectionInstance,
                                           sbyte4 recvEarlyDataSize);

MOC_EXTERN sbyte4 SSL_setMaxEarlyDataSize(sbyte4 connectionInstance,
                                          sbyte4 earlyDataSize);

MOC_EXTERN sbyte4 SSL_setEarlyData(sbyte4 connectionInstance,
                                          ubyte* pEarlyData, ubyte4 earlyDataSize);

#endif
#endif /* __ENABLE_MOCANA_TLS13__ */

MOC_EXTERN sbyte4  SSL_getSelectedApplicationProtocol( sbyte4 connectionInstance,
                                                      const ubyte** selectedApplicationProtocol,
                                                      ubyte4* selectedApplicationProtocolLen);

#ifdef __ENABLE_MOCANA_SSL_REHANDSHAKE__

MOC_EXTERN sbyte4  SSL_initiateRehandshake(sbyte4 connectionInstance);

MOC_EXTERN sbyte4 SSL_isRehandshakeAllowed(sbyte4 connectionInstance, intBoolean *pRehandshake);

MOC_EXTERN sbyte4  SSL_checkRehandshakeTimer(sbyte4 connectionInstance);
#endif /* __ENABLE_MOCANA_SSL_REHANDSHAKE__ */

MOC_EXTERN sbyte4  SSL_getSessionInfo(sbyte4 connectionInstance, ubyte* sessionIdLen, ubyte sessionId[SSL_MAXSESSIONIDSIZE], ubyte masterSecret[SSL_MASTERSECRETSIZE]);

#ifdef __ENABLE_MOCANA_SSL_KEY_EXPANSION__

MOC_EXTERN sbyte4  SSL_generateExpansionKey(sbyte4 connectionInstance, ubyte *pKey,ubyte2 keyLen, ubyte *keyPhrase, ubyte2 keyPhraseLen);
MOC_EXTERN sbyte4  SSL_generateTLSExpansionKey(sbyte4 connectionInstance, ubyte *pKey,ubyte2 keyLen, ubyte *keyPhrase, ubyte2 keyPhraseLen);
#endif

#ifdef __ENABLE_MOCANA_SSL_INTERNAL_STRUCT_ACCESS__

MOC_EXTERN void*   SSL_returnPtrToSSLSocket(sbyte4 connectionInstance);
#endif

/* common client */
#if defined(__ENABLE_MOCANA_SSL_CLIENT__)

MOC_EXTERN sbyte4  SSL_getClientSessionInfo(sbyte4 connectionInstance,
                                            ubyte* sessionIdLen,
                                            ubyte sessionId[SSL_MAXSESSIONIDSIZE],
                                            ubyte masterSecret[SSL_MASTERSECRETSIZE]);


#if defined(__ENABLE_MOCANA_MULTIPLE_COMMON_NAMES__)

MOC_EXTERN sbyte4  SSL_setDNSNames( sbyte4 connectionInstance,
                                   const CNMatchInfo* cnMatchInfo);
#endif /* __ENABLE_MOCANA_MULTIPLE_COMMON_NAMES__ */

MOC_EXTERN sbyte4 SSL_setServerNameIndication(sbyte4 connectionInstance,
                                              const char *serverName);

#if defined(__ENABLE_MOCANA_SSL_SRP__)
MOC_EXTERN sbyte4 SSL_setClientSRPIdentity(sbyte4 connectionInstance,
                                           ubyte* userName,
                                           ubyte userNameLen,
                                           ubyte* password,
                                           ubyte4 passwordLen);
#endif

#endif /* __ENABLE_MOCANA_SSL_CLIENT__ */

#if defined(__ENABLE_MOCANA_EAP_FAST__) && defined(__ENABLE_MOCANA_SSL_CLIENT__)

MOC_EXTERN sbyte4  SSL_setEAPFASTParams(sbyte4 connectionInstance, ubyte* pPacOpaque, ubyte4 pacOpaqueLen, ubyte pPacKey[/*PACKEY_SIZE*/]);
#endif
#if defined(__ENABLE_MOCANA_EAP_FAST__)
MOC_EXTERN sbyte4 SSL_getEAPFAST_CHAPChallenge(sbyte4 connectionInstance, ubyte *challenge , ubyte4 challengeLen);
MOC_EXTERN sbyte4  SSL_getEAPFAST_IntermediateCompoundKey(sbyte4 connectionInstance, ubyte *s_imk, ubyte *msk, ubyte mskLen, ubyte *imk);
MOC_EXTERN sbyte4  SSL_generateEAPFASTSessionKeys(sbyte4 connectionInstance, ubyte* S_IMCK, sbyte4 s_imckLen, ubyte* MSK, sbyte4 mskLen, ubyte* EMSK, sbyte4 emskLen);
#endif

#if (defined(__ENABLE_MOCANA_INNER_APP__))

MOC_EXTERN sbyte4 SSL_setInnerApplicationExt(sbyte4 connectionInstance, ubyte4 innerAppValue);
MOC_EXTERN sbyte4 SSL_sendInnerApp(sbyte4 connectionInstance, InnerAppType innerApp, ubyte* pMsg, ubyte4 msgLen,ubyte4 *retMsgLen);
MOC_EXTERN sbyte4 SSL_updateInnerAppSecret(sbyte4 connectionInstance, ubyte* session_key, ubyte4 sessionKeyLen);
MOC_EXTERN sbyte4 SSL_verifyInnerAppVerifyData(sbyte4 connectionInstance,ubyte *data,InnerAppType appType);
#endif

#if defined(__ENABLE_MOCANA_OCSP_CLIENT__)
MOC_EXTERN sbyte4 SSL_setOcspResponderUrl(sbyte4 connectionInstance, const char* pUrl);
#endif

/* common server */
#if defined(__ENABLE_MOCANA_SSL_SERVER__)

#if defined(__ENABLE_MOCANA_SSL_SRP__)
MOC_EXTERN sbyte4 SSL_getClientSRPIdentity(sbyte4 connectionInstance,
                                           const ubyte** identity,
                                           ubyte4* identityLength);

MOC_EXTERN MSTATUS SSL_setFuncPtrSRPCallback(sbyte4(*funcPtrSRPCallback)
                                             (sbyte4 connectionInstance, const ubyte* identity,
                                              ubyte4 identityLength, sbyte4* numBits,
                                              ubyte salt[SSL_PSK_SERVER_IDENTITY_LENGTH],
                                              ubyte4* saltLength,
                                              ubyte** verifier, ubyte4* verifierLength));
#endif /* __ENABLE_MOCANA_SSL_SRP__ */

#endif

/* common synchronous client/server */
#if defined(__ENABLE_MOCANA_SSL_DUAL_MODE_API__) || ((defined(__ENABLE_MOCANA_SSL_SERVER__)) && (!defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__))) || ((defined(__ENABLE_MOCANA_SSL_CLIENT__)) && (!defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__)))

MOC_EXTERN sbyte4  SSL_init(sbyte4 numServerConnections, sbyte4 numClientConnections);

#if defined(__ENABLE_MOCANA_SSL_CUSTOM_RNG__)
MOC_EXTERN sbyte4  SSL_initEx(sbyte4 numServerConnections, sbyte4 numClientConnections, RNGFun rngFun, void* rngArg);
#endif

MOC_EXTERN sbyte4  SSL_negotiateConnection(sbyte4 connectionInstance);

MOC_EXTERN sbyte4  SSL_send(sbyte4 connectionInstance, sbyte *pBuffer, sbyte4 bufferSize);

MOC_EXTERN sbyte4  SSL_recv(sbyte4 connectionInstance, sbyte *pRetBuffer, sbyte4 bufferSize, sbyte4 *pNumBytesReceived, ubyte4 timeout);

MOC_EXTERN sbyte4  SSL_sendPending(sbyte4 connectionInstance, sbyte4 *pNumBytesPending);

MOC_EXTERN sbyte4  SSL_recvPending(sbyte4 connectionInstance, sbyte4 *pRetBooleanIsPending);

MOC_EXTERN sbyte4  SSL_closeConnection(sbyte4 connectionInstance);
#endif

/* common asynchronous client/server */
#if defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__) || defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__)

MOC_EXTERN sbyte4 SSL_ASYNC_init(sbyte4 numServerConnections, sbyte4 numClientConnections);

#if defined(__ENABLE_MOCANA_SSL_CUSTOM_RNG__)
MOC_EXTERN sbyte4 SSL_ASYNC_initEx(sbyte4 numServerConnections, sbyte4 numClientConnections, RNGFun rngFun, void* rngArg);
#endif

MOC_EXTERN sbyte4 SSL_ASYNC_recvMessage(sbyte4 connectionInstance, ubyte *pBytesReceived, ubyte4 numBytesReceived);

MOC_EXTERN sbyte4 SSL_ASYNC_recvMessage2(sbyte4 connectionInstance, ubyte *pBytesReceived, ubyte4 numBytesReceived, ubyte **ppRetBytesReceived, ubyte4 *pRetNumRxBytesRemaining);

MOC_EXTERN sbyte4 SSL_ASYNC_sendMessage(sbyte4 connectionInstance, sbyte *pBuffer, sbyte4 bufferSize, sbyte4 *pBytesSent);

MOC_EXTERN sbyte4 SSL_ASYNC_sendMessagePending(sbyte4 connectionInstance);

MOC_EXTERN sbyte4 SSL_ASYNC_closeConnection(sbyte4 connectionInstance);

MOC_EXTERN sbyte4 SSL_ASYNC_getSendBuffer(sbyte4 connectionInstance, ubyte *data, ubyte4 *len);

MOC_EXTERN sbyte4 SSL_ASYNC_getRecvBuffer(sbyte4 connectionInstance, ubyte **data, ubyte4 *len, ubyte4 *pRetProtocol);

MOC_EXTERN sbyte4 SSL_ASYNC_getRecvPending(sbyte4 connectionInstance, sbyte4 *len);

MOC_EXTERN sbyte4 SSL_ASYNC_getSendBufferZeroCopy(sbyte4 connectionInstance, ubyte **data, ubyte4 *len);

MOC_EXTERN sbyte4 SSL_ASYNC_freeSendBufferZeroCopy(sbyte4 connectionInstance, ubyte4 numUnusedBytes);

#if (defined(__ENABLE_MOCANA_MBEDTLS_SHIM__))

MOC_EXTERN sbyte4 SSL_bindMbedtlsShimMethods(mssl_methods_t *pMeth);
#endif

#if (defined(__ENABLE_MOCANA_OPENSSL_SHIM__))

MOC_EXTERN sbyte4 SSL_bindShimMethods(nssl_methods_t *pMeth);

MOC_EXTERN sbyte4 SSL_OSSL_RSAParamsToKeyBlob(OSSL_RSAParams *pR, void **ppKeyBlob, unsigned int *pBlobLen);
MOC_EXTERN sbyte4 SSL_getSessionStatusEx(sbyte4 connectionInstance, ubyte4 *pRetStatusSSL);
MOC_EXTERN MSTATUS SSL_decryptPKCS8PemKey(ubyte *pContent, ubyte4 contentLength, AsymmetricKey** pKey,
                                          void *pPwInfo, intBoolean base64);
MOC_EXTERN sbyte4 SSL_InitAsymmetricKey(AsymmetricKey* pAsymKey);
MOC_EXTERN sbyte4 SSL_UninitAsymmetricKey(AsymmetricKey* pAsymKey);
MOC_EXTERN sbyte4 SSL_initializeVersion();
#if defined(__ENABLE_MOCANA_DTLS_CLIENT__)
MOC_EXTERN sbyte4 SSL_DTLS_start(sbyte4 connectionInstance);
#endif

#if (defined(__ENABLE_MOCANA_DSA__))

MOC_EXTERN sbyte4 SSL_OSSL_DSAParamsToKeyBlob(OSSL_DSAParams *pD, void **ppKeyBlob, unsigned int *pBlobLen);
#endif /* __ENABLE_MOCANA_DSA__ */
#if (defined(__ENABLE_MOCANA_ECC__))

MOC_EXTERN sbyte4 SSL_OSSL_ECCParamsToKeyBlob(OSSL_ECCParams *pEParams, void *ppKeyBlob, unsigned int *pBlobLen);
#endif /* __ENABLE_MOCANA_ECC__ */

MOC_EXTERN sbyte4 SSL_OSSL_AddTrustPoint(void *pCertStore, u_int8_t *pDerBuf, int derLen);

MOC_EXTERN sbyte4 SSL_OSSL_AddIdenCertChain(void *pCertStore, OSSL_SizedBuffer *certs, unsigned numCerts,
                        const u_int8_t *pKeyBlob, unsigned keyBlobLength, ubyte *pAlias, ubyte4 aliasLen);

MOC_EXTERN sbyte4 SSL_OSSL_AddIdenCertChainExtData(void *pCertStore, OSSL_SizedBuffer *certs, unsigned numCerts,
                        const u_int8_t *pKeyBlob, unsigned keyBlobLength, ubyte *pAlias, ubyte4 aliasLen,
                        ExtendedDataCallback extDataFunc, sbyte4 extDataIdentifier);

MOC_EXTERN sbyte4 SSL_ASYNC_acceptConnectionAlt(TCP_SOCKET tempSocket, void* pCertStore);

MOC_EXTERN sbyte4
SSL_ASYNC_connectAlt(TCP_SOCKET tempSocket, ubyte sessionIdLen, ubyte * sessionId, ubyte * masterSecret,
             const sbyte* dnsName, void *certStore);

MOC_EXTERN sbyte4 CERT_STORE_createStoreAlt(void **ppNewStore);

MOC_EXTERN MSTATUS CERT_STORE_releaseStoreAlt(void **ppReleaseStore);
#endif /* __ENABLE_MOCANA_OPENSSL_SHIM__  || __ENABLE_MOCANA_MBEDTLS_SHIM__*/
#endif /* defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__) || defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__) */

MOC_EXTERN sbyte4 SSL_isSecureConnectionEstablished(sbyte4 connectionInstance);

MOC_EXTERN sbyte4 SSL_getLocalState(sbyte4 connectionInstance, sbyte4 *pState);

MOC_EXTERN sbyte4 SSL_getState(sbyte4 connectionInstance, sbyte4 *pState);

MOC_EXTERN sbyte4 SSL_in_connect_init_moc(sbyte4 connectionInstance);

MOC_EXTERN sbyte4 SSL_in_accept_init_moc(sbyte4 connectionInstance);

MOC_EXTERN MSTATUS SSL_SOCK_getPeerCertificateBytes(sbyte4 connectionInstance, ubyte **ppCertBytes, ubyte4 *pCertLen);

/* sync server */
#if defined(__ENABLE_MOCANA_SSL_DUAL_MODE_API__) || ((defined(__ENABLE_MOCANA_SSL_SERVER__)) && (!defined(__ENABLE_MOCANA_SSL_ASYNC_SERVER_API__)))

MOC_EXTERN sbyte4  SSL_acceptConnection(TCP_SOCKET tempSocket,
                                        struct certStore* pCertStore);
#endif

/* sync client */
#if (!defined(__ENABLE_MOCANA_OPENSSL_SHIM__) || defined(ENABLE_MOCANA_TAP_OSSL_REMOTE__)) && (defined(__ENABLE_MOCANA_SSL_DUAL_MODE_API__) || ((defined(__ENABLE_MOCANA_SSL_CLIENT__)) && (!defined(__ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__))))

MOC_EXTERN sbyte4  SSL_connect(TCP_SOCKET tempSocket,
                               ubyte sessionIdLen, ubyte * sessionId,
                               ubyte * masterSecret, const sbyte* dnsName,
                               struct certStore* certStore);

MOC_EXTERN sbyte4
SSL_PROXY_connect(TCP_SOCKET sslSocket, sbyte4 sslId, SSLTransportSend transportSend, SSLTransportRecv transportRecv, 
                  TCP_SOCKET tempSocket, ubyte sessionIdLen, ubyte* sessionId, ubyte* masterSecret,
                  const sbyte* dnsName, struct certStore* certStore);

#endif

/* async server */
#ifdef __ENABLE_MOCANA_SSL_ASYNC_SERVER_API__

MOC_EXTERN sbyte4  SSL_ASYNC_acceptConnection(TCP_SOCKET tempSocket,
                                              struct certStore* pCertStore);
#endif

/* async client */
#ifdef __ENABLE_MOCANA_SSL_ASYNC_CLIENT_API__

MOC_EXTERN sbyte4  SSL_ASYNC_connect(TCP_SOCKET tempSocket, ubyte sessionIdLen,
                                     ubyte * sessionId, ubyte * masterSecret,
                                     const sbyte* dnsName,
                                     struct certStore* pCertStore);
MOC_EXTERN sbyte4  SSL_ASYNC_start(sbyte4 connectionInstance);
#endif

#ifndef __DISABLE_MOCANA_ALPN_CALLBACK__

MOC_EXTERN MSTATUS SSL_setAlpnCallback(sbyte4 connectionInstance,
                                      sbyte4 (*funcPtrAlpnCallback) (sbyte4 connectionInstance,
                                                                     ubyte** out[],
                                                                     sbyte4* outlen,
                                                                     ubyte* in,
                                                                     sbyte4 inlen));



#endif /* __DISABLE_MOCANA_ALPN_CALLBACK__ */

#if defined( __ENABLE_MOCANA_SSL_ALERTS__ )

MOC_EXTERN MSTATUS SSL_setAlertCallback(sbyte4 connectionInstance,
                                      sbyte4 (*funcPtrAlertCallback) (sbyte4 connectionInstance,
                                                                       sbyte4 alertId,
                                                                       sbyte4 alertClass));
#endif

#ifndef __DISABLE_MOCANA_SSL_CERTIFICATE_CALLBACK__

MOC_EXTERN MSTATUS
SSL_setCertAndStatusCallback(sbyte4 connectionInstance,
    MSTATUS (*funcPtrGetCertAndStatusCallback) (sbyte4 connectionInstance,
                                                struct certChain* pCertChain,
                                                MSTATUS validationstatus));

MOC_EXTERN MSTATUS
SSL_setClientCertAuthorityCallback(sbyte4 connectionInstance,
    MSTATUS (*funcPtrClientCertAuthorityCallback) (sbyte4 connectionInstance,
                                             SizedBuffer *pCertAuthorities,
                                             ubyte4 certAuthorityCount));

#endif /* __DISABLE_MOCANA_SSL_CERTIFICATE_CALLBACK__ */

MOC_EXTERN MSTATUS
SSL_setClientCertCallback(sbyte4 connInstance,
        MSTATUS (*funcPtrClientCertCallback)(sbyte4 connInstance,
                                            SizedBuffer **ppRetCert, ubyte4 *pRetNumCerts,
                                            ubyte **ppRetKeyBlob, ubyte4 *pRetKeyBlobLen,
                                            ubyte **ppRetCACert, ubyte4 *pRetNumCACerts));
MOC_EXTERN MSTATUS
SSL_setCertVerifySignCallback(sbyte4 (*funcPtrMutualAuthCertificateVerify)
                                     (sbyte4 connectionInstance,
                                      const ubyte* pHash, ubyte4 hashLen,
                                      ubyte* pResult, ubyte4 resultLength));


MOC_EXTERN MSTATUS SSL_populateMutualAuthCertStore(sbyte4 connectionInstance,
                                                   const SizedBuffer *pCerts, ubyte4 numCerts,
                                                   ubyte *pKey, ubyte4 keyLen,
                                                   const ubyte *pCACert, ubyte4 caCertLength);

#ifdef __ENABLE_MOCANA_SSL_INVALID_CERTIFICATE_CALLBACK__

MOC_EXTERN MSTATUS
SSL_setInvalidCertCallback(sbyte4 connectionInstance,
    MSTATUS (*funcPtrInvalidCertCallback) (sbyte4 connectionInstance,
                                           MSTATUS validationstatus));


#endif /* __ENABLE_MOCANA_SSL_INVALID_CERTIFICATE_CALLBACK__ */

MOC_EXTERN MSTATUS
SSL_setVersionCallback(
    sbyte4 connectionInstance,
    MSTATUS (*funcPtrVersionCallback)(ubyte4 serverVersion,
                                      ubyte4 clientVersion,
                                      MSTATUS sslStatus));

MOC_EXTERN sbyte4 SSL_setDHParameters(ubyte *pP, ubyte4 pLen, ubyte *pG, ubyte4 gLen, ubyte4 lengthY);

MOC_EXTERN sbyte4 SSL_setMinProtoVersion(ubyte4 version);
MOC_EXTERN ubyte4 SSL_getMinProtoVersion();
MOC_EXTERN sbyte4 SSL_setMaxProtoVersion(ubyte4 version);
MOC_EXTERN ubyte4 SSL_getMaxProtoVersion();
MOC_EXTERN sbyte4 SSL_getProtoVersion(sbyte4 connectionInstance);


#ifdef __ENABLE_MOCANA_SSL_KEY_EXPANSION__

MOC_EXTERN sbyte4 SSL_generateExportKeyMaterial(sbyte4 connectionInstance, ubyte *pKey, ubyte2 keyLen,
                                                ubyte *pKeyphrase, ubyte2 keyPhrase,
                                                ubyte *pContext, ubyte2 contextLen, int useContext);

MOC_EXTERN sbyte4 SSL_generateEarlyExportKeyMaterial(sbyte4 connectionInstance,
                                                     ubyte *pKey, ubyte2 keyLen,
                                                     ubyte *pLabel, ubyte2 labelLen,
                                                     ubyte *pContext, ubyte4 contextLen);
#endif /* __ENABLE_MOCANA_SSL_KEY_EXPANSION__ */

#if (defined(__ENABLE_MOCANA_TLS13__) && defined(__ENABLE_MOCANA_TLS13_0RTT__))

MOC_EXTERN sbyte4
SSL_setReceiveApplicationDataCallback(sbyte4 (*funcPtrTLS13ApplicationDataCallback)(sbyte4 connectionInstance,
                                                                                   ubyte *pData, ubyte4 dataLen,
                                                                                   dataState state));

#endif /* (defined(__ENABLE_MOCANA_TLS13__) && defined(__ENABLE_MOCANA_TLS13_0RTT__)) */

#if (defined(__ENABLE_MOCANA_SSL_CLIENT__) && defined(__ENABLE_MOCANA_SSL_MUTUAL_AUTH_SUPPORT__))

MOC_EXTERN MSTATUS
SSL_setMutualAuthCertificateAlias(sbyte4 connectionInstance, ubyte *pAlias, ubyte4 aliasLen);
#endif

#endif /* (defined(__ENABLE_MOCANA_SSL_SERVER__) || defined(__ENABLE_MOCANA_SSL_CLIENT__)) */

#ifdef __cplusplus
}
#endif

MOC_EXTERN MSTATUS SSL_setMaxTimerCountForRehandshake(ubyte4 timerCount);
MOC_EXTERN MSTATUS SSL_setmaxByteCount(ubyte4 byteCount);

#ifdef __ENABLE_MOCANA_SSL_REHANDSHAKE__
MOC_EXTERN MSTATUS SSL_setFuncPtrClientRehandshakeRequest(sbyte4(*funcPtrClientRehandshakeRequest)
                                                                (sbyte4 connectionInstance));
#endif

#ifdef __ENABLE_MOCANA_SSL_ALERTS__
MOC_EXTERN MSTATUS SSL_setFuncPtrAlertCallback(sbyte4 (*funcPtrAlertCallback)
                                                      (sbyte4 connectionInstance,
                                                       sbyte4 alertId, sbyte4 alertClass));
#endif

#if defined(__ENABLE_MOCANA_SSL_CLIENT__) && defined(__ENABLE_MOCANA_SSL_SESSION_TICKET_RFC_5077__)
MOC_EXTERN MSTATUS
SSL_setClientSaveTicketCallback(sbyte4 connectionInstance,
                                sbyte4 (*cb)(sbyte4 connectionInstance,
                                             sbyte *serverInfo, ubyte4 serverInfoLen,
                                             void *userData, ubyte *pTicket, ubyte4 ticketLen));

MOC_EXTERN MSTATUS
SSL_setClientRetrieveTicketCallback(sbyte4 connectionInstance,
                                    sbyte4 (*cb)(sbyte4 connectionInstance,
                                                 sbyte *serverInfo, ubyte4 serverInfoLen,
                                                 void *userData, ubyte **ppTicket, ubyte4 *pTicketLen,
                                                 intBoolean *pFreememory));
#endif

#if (defined(__ENABLE_MOCANA_SSL_PSK_SUPPORT__) || defined(__ENABLE_MOCANA_TLS13_PSK__))
MOC_EXTERN MSTATUS SSL_setFuncPtrLookupPSK(sbyte4 (*funcPtrLookupPSK)
                                                  (sbyte4, ubyte*, ubyte4,
                                                   ubyte[SSL_PSK_MAX_LENGTH],
                                                   ubyte4*));

MOC_EXTERN MSTATUS SSL_setFuncPtrGetHintPSK(sbyte4 (*funcPtrGetHintPSK)
                                                   (sbyte4, ubyte hintPSK[SSL_PSK_SERVER_IDENTITY_LENGTH],
                                                    ubyte4 *));

#if defined(__ENABLE_MOCANA_TLS13_PSK__)

MOC_EXTERN MSTATUS SSL_deserializePSK(ubyte *pPsk, ubyte4 pskLen, tls13PSK **ppRetPsk);

MOC_EXTERN MSTATUS SSL_serializePSK(tls13PSK *pPsk, ubyte **ppPsk, ubyte4 *pPskLen);

MOC_EXTERN MSTATUS SSL_freePSK(tls13PSK **ppPsk);

#endif /* __ENABLE_MOCANA_TLS13_PSK__ */

#if defined(__ENABLE_MOCANA_SSL_CLIENT__)
MOC_EXTERN MSTATUS SSL_setFuncPtrChoosePSK(sbyte4 (*funcPtrChoosePSK)
                                                  (sbyte4, ubyte *, ubyte4,
                                                   ubyte retPskIdentity[SSL_PSK_SERVER_IDENTITY_LENGTH],
                                                   ubyte4 *, ubyte retPSK[SSL_PSK_MAX_LENGTH], ubyte4 *));

#if defined(__ENABLE_MOCANA_TLS13_PSK__)
MOC_EXTERN MSTATUS
SSL_setClientSavePSKCallback(sbyte4 connectionInstance,
                             sbyte4 (*cb)(sbyte4 connectionInstance,
                                          sbyte* ServerInfo, ubyte4 serverInfoLen,
                                          void *userData, ubyte *pPsk, ubyte4 pskLen));

MOC_EXTERN MSTATUS
SSL_CLIENT_setRetrievePSKCallback(sbyte4 connectionInstance,
                                  sbyte4 (*cb)(sbyte4 connectionInstance,
                                       sbyte* ServerInfo, ubyte4 serverInfoLen,
                                       void *userData, void **ppPSKs,
                                       ubyte2 *pNumPSKs,ubyte* selectedIndex,
                                       intBoolean *pFreeMemory));
#endif /* __ENABLE_MOCANA_TLS13_PSK__ */
#endif /*__ENABLE_MOCANA_SSL_CLIENT__ */
#endif /* __ENABLE_MOCANA_SSL_PSK_SUPPORT__  || __ENABLE_MOCANA_TLS13_PSK__ */

#if defined(__ENABLE_MOCANA_TLS13__)

MOC_EXTERN MSTATUS SSL_setFuncPtrKeyUpdateRequest(sbyte4 (*funcPtrKeyUpdate)
                                                         (sbyte4 connectionInstance));
#if defined(__ENABLE_MOCANA_TLS13_PSK__)
#if defined(__ENABLE_MOCANA_SSL_SERVER__)
MOC_EXTERN MSTATUS
SSL_setServerSavePSKCallback(sbyte4 (*cb)(sbyte4 connectionInstance,
                                          ubyte* ServerInfo, ubyte4 serverInfoLen,
                                          ubyte* pIdentityPSK, ubyte4 identityLengthPSK,
                                          ubyte* pPsk, ubyte4 pskLen));

MOC_EXTERN MSTATUS
SSL_setServerLookupPSKCallback(sbyte4 (*cb)(sbyte4 connectionInstance,
                                            ubyte* pIdentityPSK, ubyte4 identityLengthPSK,
                                            ubyte** ppPsk, ubyte4 *pPskLen, intBoolean *pFreeMemory));

MOC_EXTERN MSTATUS
SSL_setServerDeletePSKCallback(sbyte4 (*cb)(sbyte4 connectionInstance,
                                          sbyte* ServerInfo, ubyte4 serverInfoLen,
                                          ubyte* pIdentityPSK, ubyte4 identityLengthPSK,
                                          ubyte* pPsk));
#endif /* __ENABLE_MOCANA_SSL_SERVER__ */

#endif /* __ENABLE_MOCANA_TLS13_PSK__ */
#endif /* __ENABLE_MOCANA_TLS13__ */

#if (defined(__ENABLE_MOCANA_SSL_CLIENT__) && defined(__ENABLE_MOCANA_SSL_SESSION_TICKET_RFC_5077__))
MOC_EXTERN MSTATUS
SSL_setClientSaveTicketCallback(sbyte4 connectionInstance,
                                sbyte4 (*cb)(sbyte4 connectionInstance,
                                             sbyte *serverInfo, ubyte4 serverInfoLen,
                                             void *userData, ubyte *pTicket, ubyte4 ticketLen));

MOC_EXTERN MSTATUS
SSL_setClientRetrieveTicketCallback(sbyte4 connectionInstance,
                                    sbyte4 (*cb)(sbyte4 connectionInstance,
                                                 sbyte *serverInfo, ubyte4 serverInfoLen,
                                                 void *userData, ubyte **ppTicket, ubyte4 *pTicketLen,
                                                 intBoolean *pFreememory));
#endif

MOC_EXTERN MSTATUS SSL_getSharedSignatureAlgorithm(sbyte4 connectionInstance, ubyte4 algoListIndex,
                                                   ubyte2 *pSigAlgo, ubyte isPeer);
MOC_EXTERN MSTATUS SSL_INTERNAL_setConnectionState(sbyte4 connectionInstance, sbyte4 connectionState);

#if defined(__ENABLE_MOCANA_TAP__) && defined(__ENABLE_MOCANA_TAP_DEFER_UNLOADKEY__)

MOC_EXTERN MSTATUS SSL_TAP_clearKeyAndToken();
#endif
#endif /* __SSL_HEADER__ */