257                              struct mbed_ssl_backend_data *backend,  in mbed_set_ssl_version_min_max()  argument
331   mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,  in mbed_set_ssl_version_min_max()
333   mbedtls_ssl_conf_max_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,  in mbed_set_ssl_version_min_max()
336   mbedtls_ssl_conf_min_tls_version(&backend->config, ver_min);  in mbed_set_ssl_version_min_max()
337   mbedtls_ssl_conf_max_tls_version(&backend->config, ver_max);  in mbed_set_ssl_version_min_max()
380                           struct mbed_ssl_backend_data *backend,  in mbed_set_selected_ciphers()  argument
479   backend->ciphersuites = selected;  in mbed_set_selected_ciphers()
480   mbedtls_ssl_conf_ciphersuites(&backend->config, backend->ciphersuites);  in mbed_set_selected_ciphers()
562   struct mbed_ssl_backend_data *backend =  local
563     (struct mbed_ssl_backend_data *)connssl->backend;
579   DEBUGASSERT(backend);
580   DEBUGASSERT(!backend->initialized);
599   mbedtls_ctr_drbg_init(&backend->ctr_drbg);
601   ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, entropy_func_mutex,
610   mbedtls_entropy_init(&backend->entropy);
611   mbedtls_ctr_drbg_init(&backend->ctr_drbg);
613   ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, mbedtls_entropy_func,
614                               &backend->entropy, NULL, 0);
624   mbedtls_x509_crt_init(&backend->cacert);
634     ret = mbedtls_x509_crt_parse(&backend->cacert, newblob,
647     ret = mbedtls_x509_crt_parse_file(&backend->cacert, ssl_cafile);
663     ret = mbedtls_x509_crt_parse_path(&backend->cacert, ssl_capath);
680   mbedtls_x509_crt_init(&backend->clicert);
684     ret = mbedtls_x509_crt_parse_file(&backend->clicert, ssl_cert);
707     ret = mbedtls_x509_crt_parse(&backend->clicert, newblob,
720   mbedtls_pk_init(&backend->pk);
726       ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
729                                      &backend->ctr_drbg);
731       ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
752       ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
756                                  &backend->ctr_drbg);
758       ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
771     if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
772                      mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
778   mbedtls_x509_crl_init(&backend->crl);
782     ret = mbedtls_x509_crl_parse_file(&backend->crl, ssl_crlfile);
805   mbedtls_ssl_config_init(&backend->config);
806   ret = mbedtls_ssl_config_defaults(&backend->config,
817   mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(&backend->config,
824   mbedtls_ssl_conf_verify(&backend->config, mbed_verify_cb, cf);
825   mbedtls_ssl_conf_authmode(&backend->config, MBEDTLS_SSL_VERIFY_REQUIRED);
827   mbedtls_ssl_init(&backend->ssl);
828   backend->initialized = TRUE;
831   mbedtls_ssl_conf_cert_profile(&backend->config,
834   ret = mbed_set_ssl_version_min_max(data, backend, conn_config);
838   mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
839                        &backend->ctr_drbg);
841   ret = mbedtls_ssl_setup(&backend->ssl, &backend->config);
849   mbedtls_ssl_set_bio(&backend->ssl, cf,
856     CURLcode result = mbed_set_selected_ciphers(data, backend,
861     CURLcode result = mbed_set_selected_ciphers(data, backend,
871     mbedtls_ssl_conf_ciphersuites(&backend->config,
877   mbedtls_ssl_conf_renegotiation(&backend->config,
882   mbedtls_ssl_conf_session_tickets(&backend->config,
902         ret = mbedtls_ssl_set_session(&backend->ssl, &session);
913   mbedtls_ssl_conf_ca_chain(&backend->config,
914                             &backend->cacert,
916                             &backend->crl);
922     mbedtls_ssl_conf_own_cert(&backend->config,
923                               &backend->clicert, &backend->pk);
926   if(mbedtls_ssl_set_hostname(&backend->ssl, connssl->peer.sni ?
941       backend->protocols[i] = connssl->alpn->entries[i];
945     if(mbedtls_ssl_conf_alpn_protocols(&backend->config,
946                                        &backend->protocols[0])) {
957   mbedtls_ssl_conf_dbg(&backend->config, mbed_debug, data);
969     CURLcode result = (*data->set.ssl.fsslctx)(data, &backend->config,
987   struct mbed_ssl_backend_data *backend =  local
988     (struct mbed_ssl_backend_data *)connssl->backend;
997   DEBUGASSERT(backend);
999   ret = mbedtls_ssl_handshake(&backend->ssl);
1017                 mbedtls_ssl_get_version_number(&backend->ssl));
1030                 mbedtls_ssl_get_ciphersuite_id_from_ssl(&backend->ssl);
1033           mbedtls_ssl_get_version(&backend->ssl), cipher_str);
1037         mbedtls_ssl_get_version(&backend->ssl));
1047     peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
1115     const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);
1138   struct mbed_ssl_backend_data *backend =  local
1139     (struct mbed_ssl_backend_data *)connssl->backend;
1143   DEBUGASSERT(backend);
1151     ret = mbedtls_ssl_get_session(&backend->ssl, &session);
1191   struct mbed_ssl_backend_data *backend =  local
1192     (struct mbed_ssl_backend_data *)connssl->backend;
1196   DEBUGASSERT(backend);
1197   ret = mbedtls_ssl_write(&backend->ssl, (unsigned char *)mem, len);
1223   struct mbed_ssl_backend_data *backend =  local
1224     (struct mbed_ssl_backend_data *)connssl->backend;
1230   DEBUGASSERT(backend);
1232   if(!backend->initialized || cf->shutdown) {
1240   if(!backend->sent_shutdown) {
1242     backend->sent_shutdown = TRUE;
1244       ret = mbedtls_ssl_close_notify(&backend->ssl);
1268     ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
1272       ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
1311   struct mbed_ssl_backend_data *backend =  local
1312     (struct mbed_ssl_backend_data *)connssl->backend;
1315   DEBUGASSERT(backend);
1316   if(backend->initialized) {
1317     mbedtls_pk_free(&backend->pk);
1318     mbedtls_x509_crt_free(&backend->clicert);
1319     mbedtls_x509_crt_free(&backend->cacert);
1321     mbedtls_x509_crl_free(&backend->crl);
1323     Curl_safefree(backend->ciphersuites);
1324     mbedtls_ssl_config_free(&backend->config);
1325     mbedtls_ssl_free(&backend->ssl);
1326     mbedtls_ctr_drbg_free(&backend->ctr_drbg);
1328     mbedtls_entropy_free(&backend->entropy);
1330     backend->initialized = FALSE;
1339   struct mbed_ssl_backend_data *backend =  local
1340     (struct mbed_ssl_backend_data *)connssl->backend;
1344   DEBUGASSERT(backend);
1346   ret = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf,
1512     struct mbed_ssl_backend_data *backend =  local
1513       (struct mbed_ssl_backend_data *)ctx->backend;
1515     if(mbedtls_ssl_get_version_number(&backend->ssl) <=
1589   struct mbed_ssl_backend_data *backend;  local
1592   DEBUGASSERT(ctx && ctx->backend);
1593   backend = (struct mbed_ssl_backend_data *)ctx->backend;
1594   return mbedtls_ssl_get_bytes_avail(&backend->ssl) != 0;
1621   struct mbed_ssl_backend_data *backend =  local
1622     (struct mbed_ssl_backend_data *)connssl->backend;
1624   DEBUGASSERT(backend);
1625   return &backend->ssl;