pssl.h

Go to the documentation of this file.

/*
 * pssl.h
 *
 * Secure Sockets Layer channel interface class.
 *
 * Portable Windows Library
 *
 * Copyright (c) 1993-2002 Equivalence Pty. Ltd.
 *
 * The contents of this file are subject to the Mozilla Public License
 * Version 1.0 (the "License"); you may not use this file except in
 * compliance with the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS"
 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 * the License for the specific language governing rights and limitations
 * under the License.
 *
 * The Original Code is Portable Windows Library.
 *
 * The Initial Developer of the Original Code is Equivalence Pty. Ltd.
 *
 * Contributor(s): ______________________________________.
 */

#ifndef PTLIB_PSSL_H
#define PTLIB_PSSL_H

#ifdef P_USE_PRAGMA
#pragma interface
#endif

#include <ptlib/sockets.h>


struct ssl_st;
struct ssl_ctx_st;
struct x509_st;
struct X509_name_st;
struct evp_pkey_st;
struct evp_cipher_ctx_st;
struct dh_st;
struct aes_key_st;
struct SHAstate_st;
struct bio_method_st;
struct bio_st;


enum PSSLFileTypes {
  PSSLFileTypePEM,
  PSSLFileTypeASN1,
  PSSLFileTypeDEFAULT
};


typedef PNotifierTemplate<bool> PSSLPasswordNotifier;
#define PDECLARE_SSLPasswordNotifier(cls, fn) PDECLARE_NOTIFIER2(PString, cls, fn, bool)


class PSSLPrivateKey : public PObject
{
  PCLASSINFO(PSSLPrivateKey, PObject);
  public:
    PSSLPrivateKey();

    PSSLPrivateKey(
      unsigned modulus,   
      void (*callback)(int,int,void *) = NULL,  
      void *cb_arg = NULL                       
    );

    PSSLPrivateKey(
      const PFilePath & keyFile,  
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );

    PSSLPrivateKey(
      const BYTE * keyData,   
      PINDEX keySize          
    );

    PSSLPrivateKey(
      const PBYTEArray & keyData  
    );

    PSSLPrivateKey(
      const PSSLPrivateKey & privKey
    );
    PSSLPrivateKey(
      evp_pkey_st * privKey,
      bool duplicate = true
    );

    PSSLPrivateKey & operator=(
      const PSSLPrivateKey & privKay
    );
    PSSLPrivateKey & operator=(
      evp_pkey_st * privKay
    );

    ~PSSLPrivateKey();

    operator evp_pkey_st *() const { return m_pkey; }

    void Attach(evp_pkey_st * key);

    PBoolean Create(
      unsigned modulus,   
      void (*callback)(int,int,void *) = NULL,  
      void *cb_arg = NULL                       
    );

    bool IsValid() const { return m_pkey != NULL; }

    bool SetData(
      const PBYTEArray & data
    );

    PBYTEArray GetData() const;

    PString AsString() const;

    bool Parse(
      const PString & keyStr
    );

    PBoolean Load(
      const PFilePath & keyFile,  
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT,  
      const PSSLPasswordNotifier & notifier = PSSLPasswordNotifier()  
    );

    PBoolean Save(
      const PFilePath & keyFile,  
      PBoolean append = false,        
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );


  protected:
    void FreePrivateKey();
    evp_pkey_st * m_pkey;
};


class PSSLCertificate : public PObject
{
    PCLASSINFO(PSSLCertificate, PObject);
  public:
    PSSLCertificate();

    PSSLCertificate(
      const PFilePath & certFile, 
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );

    PSSLCertificate(
      const BYTE * certData,  
      PINDEX certSize        
    );

    PSSLCertificate(
      const PBYTEArray & certData  
    );

    PSSLCertificate(
      const PString & certString  
    );

    PSSLCertificate(
      const PSSLCertificate & cert
    );
    PSSLCertificate(
      x509_st * cert,
      bool duplicate = true
    );

    PSSLCertificate & operator=(
      const PSSLCertificate & cert
    );
    PSSLCertificate & operator=(
      x509_st * cert
    );

    ~PSSLCertificate();

    operator x509_st *() const { return m_certificate; }

    void Attach(x509_st * cert);

    bool IsValid() const { return m_certificate != NULL; }

    
    bool CreateRoot(
      const PString & subject,    
      const PSSLPrivateKey & key, 
      const char * digest = NULL, 
      unsigned version = 0        
    );

    bool SetData(
      const PBYTEArray & data
    );

    PBYTEArray GetData() const;

    PString AsString() const;

    bool Parse(
      const PString & certStr
    );

    PBoolean Load(
      const PFilePath & certFile, 
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );

    PBoolean Save(
      const PFilePath & keyFile,  
      PBoolean append = false,        
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );

    class X509_Name : public PObject {
        PCLASSINFO(X509_Name, PObject);
      public:
        X509_Name(X509_name_st * name = NULL) : m_name(name) { }

        Comparison Compare(const PObject & other) const;
        void PrintOn(ostream & strm) const;

        bool IsValid() const { return m_name != NULL; }

        PString GetCommonName() const;
        PString GetNID(int id) const;
        PString AsString(
          int indent = -1  // Negative means single line
        ) const;

      protected:
        X509_name_st * m_name;
    };

    bool GetIssuerName(X509_Name & name) const;

    bool GetSubjectName(X509_Name & name) const;
    PString GetSubjectName() const;

    PString GetSubjectAltName() const;

    P_DECLARE_BITWISE_ENUM(CheckHostFlags, 5, (
      CheckHostNormalRules,
      CheckHostAlwaysUseSubject,
      CheckHostNoWildcards,
      CheckHostNoPartialWildcards,
      CheckHostMultiLabelWildcards,
      CheckHostSingleLabelDomains
    ));

    bool CheckHostName(
      const PString & hostname,
      CheckHostFlags flags = CheckHostNormalRules
    );

    virtual void PrintOn(ostream & strm) const { strm << GetSubjectName(); }

    typedef std::list<x509_st *> X509_Chain;
    const X509_Chain & GetChain() const { return m_chain; }

  protected:
    void FreeCertificate();
    x509_st * m_certificate;
    X509_Chain m_chain;
};


class PSSLCertificateFingerprint : public PObject
{
    PCLASSINFO(PSSLCertificateFingerprint, PObject);
  public:
    P_DECLARE_ENUM(HashType,
      HashMd5,
      HashSha1,
      HashSha256,
      HashSha512
    );

    PSSLCertificateFingerprint();

    PSSLCertificateFingerprint(
      const PString& inStr    
    );

    PSSLCertificateFingerprint(
      HashType type,                      
      const PSSLCertificate& certificate  
    );

    Comparison Compare(const PObject & other) const;

    bool IsValid() const;

    bool MatchForCertificate(
      const PSSLCertificate& cert
    ) const;

    PString AsString() const;
    bool FromString(const PString & str);

    HashType GetHash() const { return m_hashAlogorithm; }
    void SetHash(HashType hash) { m_hashAlogorithm = hash; }

  private:
    HashType m_hashAlogorithm;
    PString  m_fingerprint;
};


class PSSLDiffieHellman : public PObject
{
  PCLASSINFO(PSSLDiffieHellman, PObject);
  public:
    PSSLDiffieHellman();

    PSSLDiffieHellman(
      const PFilePath & dhFile, 
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );

    PSSLDiffieHellman(
      PINDEX numBits,            
      const BYTE * pData,        
      const BYTE * gData,        
      const BYTE * pubKey = NULL 
    );

    PSSLDiffieHellman(
      const PBYTEArray & pData,   
      const PBYTEArray & gData,   
      const PBYTEArray & pubKey = PBYTEArray() 
    );

    PSSLDiffieHellman(
      const PSSLDiffieHellman & dh
    );

    PSSLDiffieHellman & operator=(
      const PSSLDiffieHellman & dh
    );

    ~PSSLDiffieHellman();

    bool IsValid() const { return m_dh != NULL; }

    operator dh_st *() const { return m_dh; }

    PBoolean Load(
      const PFilePath & dhFile, 
      PSSLFileTypes fileType = PSSLFileTypeDEFAULT  
    );

    PINDEX GetNumBits() const;

    PBYTEArray GetModulus() const;

    PBYTEArray GetGenerator() const;

    PBYTEArray GetHalfKey() const;

    bool ComputeSessionKey(const PBYTEArray & otherHalf);

    const PBYTEArray & GetSessionKey() const { return m_sessionKey; }

  protected:
    bool Construct(const BYTE * pData, PINDEX pSize,
                   const BYTE * gData, PINDEX gSize,
                   const BYTE * kData, PINDEX kSize);

    dh_st    * m_dh;
    PBYTEArray m_sessionKey;
};


#ifdef P_SSL_AES
class PAESContext : public PObject
{
  PCLASSINFO(PAESContext, PObject);
  public:
    PAESContext();
    PAESContext(bool encrypt, const void * key, PINDEX numBits);
    ~PAESContext();

    void SetEncrypt(const void * key, PINDEX numBits);
    void SetDecrypt(const void * key, PINDEX numBits);

    void Encrypt(const void * in, void * out);
    void Decrypt(const void * in, void * out);

  protected:
    aes_key_st * m_key;
};
#endif // P_SSL_AES


class PSSLCipherContext : public PObject
{
    PCLASSINFO(PSSLCipherContext, PObject);
  public:
    PSSLCipherContext(
      bool encrypt
    );
    
    ~PSSLCipherContext();

    operator evp_cipher_ctx_st *() const { return m_context; }

    bool IsEncrypt() const;

    PString GetAlgorithm() const;

    bool SetAlgorithm(
      const PString & name  
    );

    bool SetKey(const PBYTEArray & key) { return SetKey(key, key.GetSize()); }
    bool SetKey(const BYTE * keyPtr, PINDEX keyLen);

    bool SetIV(const PBYTEArray & iv) { return SetIV(iv, iv.GetSize()); }
    bool SetIV(const BYTE * ivPtr, PINDEX ivLen);

    enum PadMode {
      NoPadding,
      PadPKCS,
      PadLoosePKCS,
      PadCipherStealing
    };

    bool SetPadding(PadMode pad);

    PadMode GetPadding() const { return m_padMode; }

    bool Process(
      const PBYTEArray & in,  
      PBYTEArray & out        
    );
    bool Process(
      const BYTE * inPtr,     
      PINDEX inLen,           
      BYTE * outPtr,          
      PINDEX & outLen,        
      bool partial = false    
    );

    PINDEX GetKeyLength() const;

    PINDEX GetIVLength() const;

    PINDEX GetBlockSize() const;

    PINDEX GetBlockedDataSize(PINDEX size) const;

  protected:
    PadMode             m_padMode;
    bool                m_encrypt;
    evp_cipher_ctx_st * m_context;

    // ciphertext stealing code based on a OpenSSL patch by An-Cheng Huang
    unsigned char m_pad_buf[32];        // Saved partial block of input data
    unsigned char m_pad_final_buf[32];  // Last processed block of output data
    int           m_pad_buf_len;        // Number of bytes in m_pad_buf
    bool          m_pad_final_used;     // Indicates whether the final buffer is used
    bool UpdateCTS(unsigned char *out, int *outl, const unsigned char *in, int inl);
    bool EncryptFinalCTS(unsigned char *out, int *outl);
    bool DecryptFinalCTS(unsigned char *out, int *outl);

    // Relaxed decryption that doesn't verify contents of the padding in the last decrypted block
    bool UpdateLoose(unsigned char *out, int *outl, const unsigned char *in, int inl);
    bool DecryptUpdateLoose(unsigned char *out, int *outl, const unsigned char *in, int inl);
    bool DecryptFinalLoose(unsigned char *out, int *outl);

  private:
    PSSLCipherContext(const PSSLCipherContext &) { }
    void operator=(const PSSLCipherContext &) { }
};


class PSHA1Context : public PObject
{
  PCLASSINFO(PSHA1Context, PObject);
  public:
    PSHA1Context();
    ~PSHA1Context();

    enum { BlockSize = 64 };

    void Update(const void * data, PINDEX length);
    void Update(const PString & str) { Update((const char *)str, str.GetLength()); }

    typedef BYTE Digest[20];
    void Finalise(Digest result);

    static void Process(const void * data, PINDEX length, Digest result);
    static void Process(const PString & str, Digest result) { Process((const char *)str, str.GetLength(), result); }

  protected:
    SHAstate_st * m_context;

  private:
    PSHA1Context(const PSHA1Context &) { }
    void operator=(const PSHA1Context &) { }
};


class PSSLContext : public PObject
{
    PCLASSINFO(PSSLContext, PObject);
  public:
    P_DECLARE_TRACED_ENUM(Method,
      SSLv23,
      SSLv3,
      TLSv1,
      TLSv1_1,
      TLSv1_2,
      DTLSv1,
      DTLSv1_2,
      DTLSv1_2_v1_0
    );

    static const Method HighestTLS = TLSv1_2;
    static const Method HighestDTLS = DTLSv1_2_v1_0;

    PSSLContext(
      const void * sessionId = NULL,  
      PINDEX idSize = 0               
    );
    PSSLContext(
      Method method,                  
      const void * sessionId = NULL,  
      PINDEX idSize = 0               
    );

    ~PSSLContext();

    operator ssl_ctx_st *() const { return m_context; }

    bool SetVerifyLocations(
      const PFilePath & caFile, 
      const PDirectory & caDir  
    );

    bool SetVerifyDirectory(
      const PDirectory & caDir  
    );

    bool SetVerifyFile(
      const PFilePath & caFile  
    );

    bool SetVerifySystemDefault();

    bool SetVerifyCertificate(
      const PSSLCertificate & cert
    );

    P_DECLARE_ENUM(VerifyMode,
      VerifyNone,
      VerifyPeer,
      VerifyPeerMandatory
    );

    void SetVerifyMode(
      VerifyMode mode,    
      unsigned depth = 9  
    );

    VerifyMode GetVerifyMode() const;

    bool AddClientCA(
      const PSSLCertificate & certificate
    );
    bool AddClientCA(
      const PList<PSSLCertificate> & certificates
    );

    bool UseCertificate(
      const PSSLCertificate & certificate
    );

    bool UsePrivateKey(
      const PSSLPrivateKey & key
    );

    bool UseDiffieHellman(
      const PSSLDiffieHellman & dh
    );

    bool SetCipherList(
      const PString & ciphers   
    );

    bool SetCredentials(
      const PString & authority,    
      const PString & certificate,  
      const PString & privateKey,   
      bool create = false           
    );

    void SetPasswordNotifier(
      const PSSLPasswordNotifier & notifier   
    );

    bool SetExtension(
      const char * extension
    );

    Method GetMethod() const { return m_method; }

  protected:
    void Construct(const void * sessionId, PINDEX idSize);

    Method       m_method;
    ssl_ctx_st * m_context;
    PSSLPasswordNotifier m_passwordNotifier;

  private:
    PSSLContext(const PSSLContext &) { }
    void operator=(const PSSLContext &) { }
};


class PSSLChannel : public PIndirectChannel
{
  PCLASSINFO(PSSLChannel, PIndirectChannel)
  public:
    PSSLChannel(
      PSSLContext * context = NULL,   
      PBoolean autoDeleteContext = false  
    );
    PSSLChannel(
      PSSLContext & context           
    );

    ~PSSLChannel();

    // Overrides from PChannel
    virtual PBoolean Read(void * buf, PINDEX len);
    virtual PBoolean Write(const void * buf, PINDEX len);
    virtual PBoolean Close();
    virtual PBoolean Shutdown(ShutdownValue);
    virtual PString GetErrorText(ErrorGroup group = NumErrorGroups) const;
    virtual PBoolean ConvertOSError(P_INT_PTR libcReturnValue, ErrorGroup group = LastGeneralError);

    // New functions
    PBoolean Accept();

    PBoolean Accept(
      PChannel & channel  
    );

    PBoolean Accept(
      PChannel * channel,     
      PBoolean autoDelete = true  
    );


    PBoolean Connect();

    PBoolean Connect(
      PChannel & channel  
    );

    PBoolean Connect(
      PChannel * channel,     
      PBoolean autoDelete = true  
    );

    bool AddClientCA(
      const PSSLCertificate & certificate
    );
    bool AddClientCA(
      const PList<PSSLCertificate> & certificates
    );

    PBoolean UseCertificate(
      const PSSLCertificate & certificate
    );

    PBoolean UsePrivateKey(
      const PSSLPrivateKey & key
    );

    PString GetCipherList() const;

    typedef PSSLContext::VerifyMode VerifyMode;

    struct VerifyInfo
    {
      VerifyInfo(bool ok, const PSSLCertificate & cert, int err) : m_ok(ok), m_peerCertificate(cert), m_errorCode(err) { }
      bool m_ok;
      PSSLCertificate m_peerCertificate;
      int m_errorCode;
    };
    typedef PNotifierTemplate<VerifyInfo &> VerifyNotifier;
    #define PDECLARE_SSLVerifyNotifier(cls, fn) PDECLARE_NOTIFIER2(PSSLChannel, cls, fn, PSSLChannel::VerifyInfo &)
    #define PCREATE_SSLVerifyNotifier(fn) PCREATE_NOTIFIER2(fn, PSSLChannel::VerifyInfo &)

    void SetVerifyMode(
      VerifyMode mode,
      const VerifyNotifier & notifier = VerifyNotifier()
    );

    virtual void OnVerify(
      VerifyInfo & info
    );

    bool GetPeerCertificate(
      PSSLCertificate & certificate,
      PString * error = NULL
    );

    bool SetServerNameIndication(
      const PString & name   
    );

    bool CheckHostName(
      const PString & hostname,
      PSSLCertificate::CheckHostFlags flags = PSSLCertificate::CheckHostNormalRules
    );

    PSSLContext * GetContext() const { return m_context; }

    operator ssl_st *() const { return m_ssl; }


  protected:
    void Construct(PSSLContext * ctx, PBoolean autoDel);
    virtual bool InternalAccept();
    virtual bool InternalConnect();

  protected:
    static int  BioRead(bio_st * bio, char * buf, int len);
    static int  BioWrite(bio_st * bio, const char * buf, int len);
    static long BioControl(bio_st * bio, int cmd, long num, void * ptr);
    static int  BioClose(bio_st * bio);

    virtual int  BioRead(char * buf, int len);
    virtual int  BioWrite(const char * buf, int len);
    virtual long BioControl(int cmd, long num, void * ptr);
    virtual int  BioClose();

    PSSLContext  * m_context;
    bool           m_autoDeleteContext;
    ssl_st       * m_ssl;
    bio_method_st* m_bioMethod;
    bio_st       * m_bio;
    VerifyNotifier m_verifyNotifier;
    PDECLARE_MUTEX(m_writeMutex);

    P_REMOVE_VIRTUAL(PBoolean,RawSSLRead(void *, PINDEX &),false);
    P_REMOVE_VIRTUAL(bool,OnVerify(bool,const PSSLCertificate&),false);
};


class PSSLChannelDTLS : public PSSLChannel
{
    PCLASSINFO(PSSLChannelDTLS, PSSLChannel)
  public:
    PSSLChannelDTLS(
      PSSLContext * context = NULL,   
      bool autoDeleteContext = false  
    );
    PSSLChannelDTLS(
      PSSLContext & context           
    );

    ~PSSLChannelDTLS();

    // Overrides from PChannel
    virtual PBoolean Read(void * buf, PINDEX len);
    virtual PBoolean Write(const void * buf, PINDEX len);

    bool SetMTU(
      unsigned bytes
    );

    bool ExecuteHandshake();

    bool IsServer() const;

    PCaselessString GetSelectedProfile() const;

    PBYTEArray GetKeyMaterial(
      PINDEX materialSize,
      const char * name
    ) const;

  protected:
    virtual bool InternalAccept();
    virtual bool InternalConnect();
};


#endif // PTLIB_PSSL_H


// End Of File ///////////////////////////////////////////////////////////////