feat: an Mbed TLS credentials backend that parses PEM per connection

Core/Interface/SolidSyslogTunablesDefaults.h

@@ -593,15 +593,11 @@
 
 /**
  * Role pool: TLS credentials. Number of credentials instances the library's
- * internal static pool can simultaneously hold, across whichever backend is
- * compiled in - a PEM-file source, caller-built vendor handles, or an
- * integrator's own class reaching a secure element or key store. Each
- * instance carries only where its material comes from, never the material.
- *
- * Default 1 - one source per TLS stream is the ordinary wiring, and the
- * stream pool defaults to one. Bump it alongside
- * SOLIDSYSLOG_TLS_STREAM_POOL_SIZE where several streams draw on separate
- * sources.
+ * internal static pool can simultaneously hold.
+ *
+ * Default 1 - one source per TLS stream is the ordinary wiring. Bump it
+ * alongside SOLIDSYSLOG_TLS_STREAM_POOL_SIZE where several streams draw on
+ * separate sources.
  *
  * Floor: 1. Sub-floor values rejected at compile time.
  */

Platform/MbedTls/CMakeLists.txt

@@ -13,6 +13,8 @@ add_library(SolidSyslogMbedTls INTERFACE)
 target_sources(SolidSyslogMbedTls INTERFACE
     ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsNullCredentials.c
     ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsHandleCredentials.c
+    ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsPemBufferCredentials.c
+    ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsPemBufferCredentialsStatic.c
     ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsHandleCredentialsStatic.c
     ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsStream.c
     ${CMAKE_CURRENT_SOURCE_DIR}/Source/SolidSyslogMbedTlsStreamStatic.c

Platform/MbedTls/Interface/SolidSyslogMbedTlsPemBufferCredentials.h

@@ -0,0 +1,82 @@
+/* SPDX-FileCopyrightText: Copyright 2026 Cozens Software Solutions Limited
+ * SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 OR LicenseRef-PolyForm-Internal-Use-1.0.0 OR LicenseRef-COSOSO-Commercial
+ */
+
+/** @file
+ *  An Mbed TLS credentials backend that parses PEM held in memory, for the
+ *  duration of one connection.
+ *
+ *  Where the handle backend asks the integrator to keep parsed material alive,
+ *  this one parses on Install and releases on Close, so between connections
+ *  nothing but the integrator's own PEM is in memory. The PEM may live in
+ *  read-only flash, or be fetched into a buffer the integrator wipes itself;
+ *  this library copies none of it.
+ *
+ *  What Release frees, Mbed TLS wipes: mbedtls_pk_free zeroises the key context
+ *  and every limb of the private key, and mbedtls_x509_crt_free zeroises the
+ *  DER it decoded. */
+#ifndef SOLIDSYSLOGMBEDTLSPEMBUFFERCREDENTIALS_H
+#define SOLIDSYSLOGMBEDTLSPEMBUFFERCREDENTIALS_H
+
+#include <stddef.h>
+
+#include "SolidSyslogExternC.h"
+
+/* Forward declarations keep the header free of any mbedTLS include, as the
+ * stream header does. Integrators include the relevant mbedTLS headers
+ * themselves before this one to bring the types into scope. */
+struct mbedtls_ctr_drbg_context;
+
+SOLIDSYSLOG_EXTERN_C_BEGIN
+
+    struct SolidSyslogMbedTlsCredentials;
+
+    /** PEM text and its extent. Borrowed - the caller owns the bytes and must
+     *  keep them valid for the lifetime of the credentials. */
+    struct SolidSyslogMbedTlsPemBuffer
+    {
+        /** PEM text; NULL means this piece of material is not supplied. */
+        const unsigned char* Bytes;
+        /** Length of Bytes **including** the terminating NUL, which is the
+         *  length Mbed TLS's own parsers require of PEM - so
+         *  `strlen(pem) + 1`. Getting this wrong is reported rather than left
+         *  to surface as a parse failure: Mbed TLS reads a certificate buffer
+         *  whose last byte is not NUL as DER instead, which fails as "not a
+         *  certificate" and says nothing about the length. */
+        size_t Length;
+    };
+
+    /** Where this backend's material lives. */
+    struct SolidSyslogMbedTlsPemBufferCredentialsConfig
+    {
+        /** Trust anchors the peer certificate must chain to; an unsupplied
+         *  buffer installs none, which leaves the peer authorised only if the
+         *  stream has another means to do it. */
+        struct SolidSyslogMbedTlsPemBuffer CaPem;
+        /** Leaf certificate (plus intermediates) for mutual TLS. Certificate
+         *  and key are all-or-nothing - supplying one without the other is
+         *  reported. */
+        struct SolidSyslogMbedTlsPemBuffer ClientCertPem;
+        /** Private key matching ClientCertPem. Must not be encrypted: no
+         *  password can be supplied. */
+        struct SolidSyslogMbedTlsPemBuffer ClientKeyPem;
+        /** Seeded CTR-DRBG. Mbed TLS requires one to parse a private key, and
+         *  it also checks the key against its certificate; required - a NULL is
+         *  reported at SolidSyslogMbedTlsPemBufferCredentials_Create. The
+         *  stream takes its own handshake RNG separately, and the same one
+         *  serves both. */
+        struct mbedtls_ctr_drbg_context* Rng;
+    };
+
+    /** Draw a credentials instance from the pool. A NULL config or a NULL Rng is
+     *  reported and falls back to the shared Null credentials, as does an
+     *  exhausted pool. */
+    struct SolidSyslogMbedTlsCredentials* SolidSyslogMbedTlsPemBufferCredentials_Create(
+        const struct SolidSyslogMbedTlsPemBufferCredentialsConfig* config
+    );
+    /** Release the pool slot, freeing any material still parsed into it. */
+    void SolidSyslogMbedTlsPemBufferCredentials_Destroy(struct SolidSyslogMbedTlsCredentials * base);
+
+SOLIDSYSLOG_EXTERN_C_END
+
+#endif /* SOLIDSYSLOGMBEDTLSPEMBUFFERCREDENTIALS_H */

Platform/MbedTls/Interface/SolidSyslogMbedTlsPemBufferCredentialsErrors.h

@@ -0,0 +1,43 @@
+/* SPDX-FileCopyrightText: Copyright 2026 Cozens Software Solutions Limited
+ * SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 OR LicenseRef-PolyForm-Internal-Use-1.0.0 OR LicenseRef-COSOSO-Commercial
+ */
+
+/** @file
+ *  Error codes and Source identity for the MbedTlsPemBufferCredentials backend. */
+#ifndef SOLIDSYSLOGMBEDTLSPEMBUFFERCREDENTIALSERRORS_H
+#define SOLIDSYSLOGMBEDTLSPEMBUFFERCREDENTIALSERRORS_H
+
+#include "SolidSyslogExternC.h"
+
+SOLIDSYSLOG_EXTERN_C_BEGIN
+
+    struct SolidSyslogErrorSource;
+
+    /** Detail codes for events whose Source is SolidSyslogMbedTlsPemBufferCredentialsErrorSource.
+     *  A handler reads these off event->Detail after matching event->Source; the
+     *  members name their own fault. */
+    enum SolidSyslogMbedTlsPemBufferCredentialsErrors
+    {
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_POOL_EXHAUSTED,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_UNKNOWN_DESTROY,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_NULL_CONFIG,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_NULL_RNG,
+        /** A buffer's Length does not include a terminating NUL. */
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_PEM_NOT_TERMINATED,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_TRUST_ANCHORS_NOT_PARSED,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_CLIENT_CREDENTIAL_INCOMPLETE,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_CLIENT_CREDENTIAL_NOT_PARSED,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_CLIENT_CREDENTIAL_MISMATCHED,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_CLIENT_CREDENTIAL_NOT_INSTALLED,
+        SOLIDSYSLOG_MBEDTLS_PEM_BUFFER_CREDENTIALS_ERROR_MAX /**< One past the last code; never emitted. Bounds the range for iteration. */
+    };
+
+    /** Identity for events raised by an MbedTlsPemBufferCredentials. A handler
+     *  matches by address (event->Source == &SolidSyslogMbedTlsPemBufferCredentialsErrorSource),
+     *  then reads event->Detail as an enum
+     *  SolidSyslogMbedTlsPemBufferCredentialsErrors. */
+    extern const struct SolidSyslogErrorSource SolidSyslogMbedTlsPemBufferCredentialsErrorSource;
+
+SOLIDSYSLOG_EXTERN_C_END
+
+#endif /* SOLIDSYSLOGMBEDTLSPEMBUFFERCREDENTIALSERRORS_H */