cSSLCompileOptions.h

Go to the documentation of this file.

//
// All consumers of these classes must use the same flags of course. (external consumers)
//
#ifndef _INC_cSSLCompileOptions_H
#define _INC_cSSLCompileOptions_H
#ifndef NO_PRAGMA_ONCE
#pragma once
#endif
 
namespace GrayLib {}
namespace GraySSL { using namespace GrayLib; using namespace Gray; };   // TODO MOVE this to each file.
 
#ifdef _DEBUG
 
// #define USE_SSL_AEAD_RANDOM_IV
#define USE_SSL_DEBUG_WARN                      // Enable the debug messages in SSL module for all issues.
#define USE_SSL_SRV_RESPECT_CLIENT_PREFERENCE
#define USE_SSL_RENEGOTIATION   // for testing.
 
#endif  // _DEBUG
 
#define USE_SSL_DEBUG           // provides debugging functions.
 
#define USE_SSL_VER_SSL_3               // Enable support for SSL 3.0. (NOT SECURE)
#define USE_SSL_VER_TLS_1_0             // Enable support for TLS 1.0.
#define USE_SSL_VER_TLS_1_1             // Enable support for TLS 1.1.
 
// Requires: at least one ECPGroup_XXX_ENABLED
#define USE_Key_EC              // Enable the EC (elliptic curve) keys.
#define USE_Key_RSA             // Enable the RSA public-key cryptosystem. 
 
#define USE_SSL_X509_CRT_PARSE           // Enable X.509 certificate parsing.
#define USE_SSL_CLIENT          // Enable the SSL/TLS client code. 
#define USE_SSL_SERVER          // Enable the SSL/TLS server code.
 
// Standard ECDSA is "fragile" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. 
// This is avoided by the deterministic variant.
#define USE_ECDSA_DETERMINISTIC         // Enable deterministic ECDSA (RFC 6979). 
 
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_PSK_WITH_AES_256_GCM_SHA384
//      TLS_PSK_WITH_AES_256_CBC_SHA384
//      TLS_PSK_WITH_AES_256_CBC_SHA
//      TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_PSK_WITH_AES_128_GCM_SHA256
//      TLS_PSK_WITH_AES_128_CBC_SHA256
//      TLS_PSK_WITH_AES_128_CBC_SHA
//      TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_PSK_WITH_RC4_128_SHA
//
#define USE_SSL_KeyExchange_PSK         // Enable the PSK based ciphersuite modes in SSL / TLS.
 
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
//      TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
//      TLS_DHE_PSK_WITH_AES_256_CBC_SHA
//      TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
//      TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
//      TLS_DHE_PSK_WITH_AES_128_CBC_SHA
//      TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_DHE_PSK_WITH_RC4_128_SHA
//
#define USE_SSL_KeyExchange_DHE_PSK             // Enable the DHE-PSK based ciphersuite modes in SSL / TLS.
 
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
//      TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
//      TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
//      TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
//      TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDHE_PSK_WITH_RC4_128_SHA
#define USE_SSL_KeyExchange_ECDHE_PSK   // Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.
 
//
// Requires: USE_Key_RSA, USE_SSL_X509_CRT_PARSE
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
//      TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
//      TLS_RSA_PSK_WITH_AES_256_CBC_SHA
//      TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
//      TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
//      TLS_RSA_PSK_WITH_AES_128_CBC_SHA
//      TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_RSA_PSK_WITH_RC4_128_SHA
//
#define USE_SSL_KeyExchange_RSA_PSK     // Enable the RSA-PSK based ciphersuite modes in SSL / TLS.
 
//
// Requires: USE_Key_RSA, USE_SSL_X509_CRT_PARSE
//
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_RSA_WITH_AES_256_GCM_SHA384
//      TLS_RSA_WITH_AES_256_CBC_SHA256
//      TLS_RSA_WITH_AES_256_CBC_SHA
//      TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
//      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
//      TLS_RSA_WITH_AES_128_GCM_SHA256
//      TLS_RSA_WITH_AES_128_CBC_SHA256
//      TLS_RSA_WITH_AES_128_CBC_SHA
//      TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
//      TLS_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_RSA_WITH_RC4_128_SHA
//      TLS_RSA_WITH_RC4_128_MD5
//
#define USE_SSL_KeyExchange_RSA // Enable the RSA-only based ciphersuite modes in SSL / TLS.
 
// Requires: USE_SSL_DHM, USE_Key_RSA, USE_SSL_X509_CRT_PARSE
//
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
//      TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
//      TLS_DHE_RSA_WITH_AES_256_CBC_SHA
//      TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
//      TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
//      TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
//      TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
//      TLS_DHE_RSA_WITH_AES_128_CBC_SHA
//      TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
//      TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
//
#define USE_SSL_KeyExchange_DHE_RSA     // Enable the DHE-RSA based ciphersuite modes in SSL / TLS.
 
// Requires: USE_SSL_ECDH, USE_Key_RSA, USE_SSL_X509_CRT_PARSE
//
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
//      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
//      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
//      TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
//      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
//      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
//      TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDHE_RSA_WITH_RC4_128_SHA
//
#define USE_SSL_KeyExchange_ECDHE_RSA   // Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.
 
// Requires: USE_SSL_ECDH, USE_Key_ECDSA, USE_SSL_X509_CRT_PARSE,
//
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
//      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
//      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
//      TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
//      TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
//      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
//      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
//      TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
//
#define USE_SSL_KeyExchange_ECDHE_ECDSA // Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.
 
// Requires: USE_SSL_ECDH, USE_SSL_X509_CRT_PARSE
//
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_ECDH_ECDSA_WITH_RC4_128_SHA
//      TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
//      TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
//      TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
//      TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
//      TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
//      TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
//      TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
//
#define USE_SSL_KeyExchange_ECDH_ECDSA  // Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
 
// Requires: USE_SSL_ECDH, USE_SSL_X509_CRT_PARSE
//
// This enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_ECDH_RSA_WITH_RC4_128_SHA
//      TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
//      TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
//      TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
//      TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
//      TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
//      TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
//      TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
//      TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
//      TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
//      TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
//
#define USE_SSL_KeyExchange_ECDH_RSA            // Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
 
// Requires: USE_Key_RSA
#define USE_PKCS1_VER_21        // Enable support for PKCS#1 v2.1 encoding. // This enables support for RSAES-OAEP and RSASSA-PSS operations.
 
// Generate a random IV rather than using the record sequence number as a nonce for ciphersuites using and AEAD algorithm (GCM or CCM).
// Using the sequence number is generally recommended.
// Uncomment this macro to always use random IVs with AEAD ciphersuites.
//
//#define USE_SSL_AEAD_RANDOM_IV
 
// This is a countermeasure to the BEAST attack, which also minimizes the risk
// of interoperability issues compared to sending 0-length records.
// Comment this macro to disable 1/n-1 record splitting.
//
#define USE_SSL_CBC_RECORD_SPLITTING            // Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
 
// SSL Server module (USE_SSL_SERVER).
// Comment this macro to disable support for SSLv2 Client Hello messages.
#define USE_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO  // Enable support for receiving and parsing SSLv2 Client Hello messages 
 
// Pick the ciphersuite according to the client's preferences rather than ours
// in the SSL Server module (USE_SSL_SERVER).
// Uncomment this macro to respect client's ciphersuite order
 
//#define USE_SSL_SRV_RESPECT_CLIENT_PREFERENCE
 
#define USE_SSL_SESSION_TICKETS                 // Enable support for RFC 5077 session tickets in SSL. // Comment this macro to disable support for SSL session tickets
#define USE_SSL_SERVER_NAME_INDICATION          // Enable support for RFC 6066 server name indication (SNI) in SSL.
 
// This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other requisites are enabled as well.
#define USE_CIPHER_BLOCK_GCM            // Enable the Galois/Counter Mode (GCM) for AES.
 
// Disabling this avoids problems with mis-issued and/or misused (intermediate) CA and leaf certificates.
// Comment to skip keyUsage checking for both CA and leaf certificates.
#define USE_SSL_X509_CHECK_KEY_USAGE            // Enable verification of the keyUsage extension (CA and leaf certificates).
 
// This module is used by the following key exchanges: ECDHE-ECDSA
// Requires: USE_Key_EC 
#define USE_Key_ECDSA           // Enable the elliptic curve DSA library.
 
// This module enables the AES-CCM ciphersuites, if other requisites are enabled as well.
#define USE_CIPHER_BLOCK_CCM    // Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
 
// This module is used by the following key exchanges: ECDHE-ECDSA, ECDHE-RSA, DHE-PSK
// Requires: USE_Key_EC
#define USE_SSL_ECDH            // Enable the elliptic curve Diffie-Hellman library.
 
// This module enables the following ciphersuites (if other requisites are enabled as well):
//      TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_RSA_WITH_3DES_EDE_CBC_SHA
//      TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
//      TLS_PSK_WITH_3DES_EDE_CBC_SHA
//
// PEM_PARSE uses DES/3DES for decrypting encrypted keys.
//
#define USE_CIPHER_DES  // Enable the DES block cipher.
 
// This module is used by the following key exchanges:  DHE-RSA, DHE-PSK
#define USE_SSL_DHM             // Enable the Diffie-Hellman-Merkle module.
 
#endif