libfilezilla
Loading...
Searching...
No Matches
tls_layer.hpp
Go to the documentation of this file.
1#ifndef LIBFILEZILLA_TLS_LAYER_HEADER
2#define LIBFILEZILLA_TLS_LAYER_HEADER
3
8#include "socket.hpp"
9#include "tls_params.hpp"
10#include "logger.hpp"
11
12namespace fz {
13class tls_system_trust_store;
14class tls_session_info;
15
16class tls_layer;
17class tls_layer_impl;
18
19struct certificate_verification_event_type;
20
26
27enum class tls_ver
28{
29 v1_0,
30 v1_1,
31 v1_2,
32 v1_3
33};
34
35enum class tls_server_flags : unsigned int
36{
37 none = 0,
38
40 no_auto_ticket = 0x1,
41
44};
45
46inline bool operator&(tls_server_flags lhs, tls_server_flags rhs) {
47 return (static_cast<std::underlying_type_t<tls_server_flags>>(lhs) & static_cast<std::underlying_type_t<tls_server_flags>>(rhs)) != 0;
48}
49inline tls_server_flags operator|(tls_server_flags lhs, tls_server_flags rhs) {
50 return static_cast<tls_server_flags>(static_cast<std::underlying_type_t<tls_server_flags>>(lhs) | static_cast<std::underlying_type_t<tls_server_flags>>(rhs));
51}
52inline tls_server_flags& operator|=(tls_server_flags & lhs, tls_server_flags rhs) {
53 lhs = lhs | rhs;
54 return lhs;
55}
56
57
58enum class tls_client_flags : unsigned int
59{
60 none = 0,
61
64};
65
66inline bool operator&(tls_client_flags lhs, tls_client_flags rhs) {
67 return (static_cast<std::underlying_type_t<tls_client_flags>>(lhs) & static_cast<std::underlying_type_t<tls_client_flags>>(rhs)) != 0;
68}
69inline tls_client_flags operator|(tls_client_flags lhs, tls_client_flags rhs) {
70 return static_cast<tls_client_flags>(static_cast<std::underlying_type_t<tls_client_flags>>(lhs) | static_cast<std::underlying_type_t<tls_client_flags>>(rhs));
71}
72inline tls_client_flags& operator|=(tls_client_flags & lhs, tls_client_flags rhs) {
73 lhs = lhs | rhs;
74 return lhs;
75}
76
89class FZ_PUBLIC_SYMBOL tls_layer final : protected event_handler, public socket_layer
90{
91public:
92 tls_layer(event_loop& event_loop, event_handler* evt_handler, socket_interface& layer, tls_system_trust_store * system_trust_store, logger_interface& logger);
93 virtual ~tls_layer() override;
94
106 bool client_handshake(std::vector<uint8_t> const& required_certificate, std::vector<uint8_t> const& session_to_resume = std::vector<uint8_t>(), native_string const& session_hostname = native_string(), tls_client_flags flags = {});
107
124 bool client_handshake(event_handler *const verification_handler, std::vector<uint8_t> const& session_to_resume = std::vector<uint8_t>(), native_string const& session_hostname = native_string(), tls_client_flags flags = {});
125
141 bool server_handshake(std::vector<uint8_t> const& session_to_resume = {}, std::string_view const& preamble = {}, tls_server_flags flags = {});
142
144 std::vector<uint8_t> get_session_parameters() const;
145
147 std::vector<uint8_t> get_raw_certificate() const;
148
154 void set_verification_result(bool trusted);
155
156 std::string get_protocol() const;
157
158 std::string get_key_exchange() const;
159 std::string get_cipher() const;
160 std::string get_mac() const;
161 int get_algorithm_warnings() const;
162
164 bool resumed_session() const;
165
167 static std::string list_tls_ciphers(std::string const& priority);
168
177 bool set_certificate_file(native_string const& keyfile, native_string const& certsfile, native_string const& password, bool pem = true);
178
187 bool set_certificate(std::string_view const& key, std::string_view const& certs, native_string const& password, bool pem = true);
188
204 bool set_key_and_certs(const_tls_param_ref key, const_tls_param_ref certs, native_string const &password, tls_data_format format = tls_data_format::autodetect);
205
207 static std::string get_gnutls_version();
208
210 enum class cert_type {
211 any,
212 client,
213 server,
214 ca,
215 codesign
216 };
217
226 static std::pair<std::string, std::string> generate_selfsigned_certificate(native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, cert_type type = cert_type::any, bool ecdsa = true, logger_interface &logger = get_null_logger());
227
240 static std::string generate_selfsigned_certificate(const_tls_param_ref key, native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, cert_type type = cert_type::any, logger_interface &logger = get_null_logger());
241
243 static std::pair<std::string, std::string> generate_ca_certificate(native_string const& password, std::string const& distinguished_name, duration const& lifetime = {}, bool ecdsa = true, logger_interface &logger = get_null_logger());
244
246 static std::pair<std::string, std::string> generate_csr(native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, bool csr_as_pem = true, cert_type type = cert_type::any, bool ecdsa = true, logger_interface &logger = get_null_logger());
247
249 static std::string generate_csr(const_tls_param_ref key, native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, bool csr_as_pem, tls_layer::cert_type type = cert_type::any, logger_interface &logger = get_null_logger());
250
256 static std::string generate_cert_from_csr(std::pair<std::string, std::string> const& issuer, native_string const& password, std::string const& csr, std::string const& distinguished_name = {}, std::vector<std::string> const& hostnames = {}, duration const& lifetime = {}, cert_type type = cert_type::any, logger_interface &logger = get_null_logger());
257
265 static bool add_pkcs11_provider(native_string_view const &path, logger_interface &logger = get_null_logger());
266
279 bool set_alpn(std::string_view const& alpn);
280 bool set_alpn(std::vector<std::string> const& alpns, bool server_priority = false);
281
284 void set_min_tls_ver(tls_ver ver);
285
290 void set_max_tls_ver(tls_ver ver);
291
293 std::string get_alpn() const;
294
297
298 bool is_server() const;
299
309
323 void set_unexpected_eof_cb(std::function<bool()> const& cb);
324 void set_unexpected_eof_cb(std::function<bool()> && cb);
325
326 virtual socket_state get_state() const override;
327
328 virtual int connect(native_string const& host, unsigned int port, address_type family = address_type::unknown) override;
329
330 virtual int read(void *buffer, unsigned int size, int& error) override;
331 virtual int write(void const* buffer, unsigned int size, int& error) override;
332
333 virtual int shutdown() override;
334
335 virtual int shutdown_read() override;
336
337 virtual void set_event_handler(event_handler* pEvtHandler, fz::socket_event_flag retrigger_block = socket_event_flag{}) override;
338
340 static bool supports_pkcs11();
341
342private:
343 virtual void FZ_PRIVATE_SYMBOL operator()(event_base const& ev) override;
344
345 friend class tls_layer_impl;
346 std::unique_ptr<tls_layer_impl> impl_;
347};
348}
349
350#endif
The buffer class is a simple buffer where data can be appended at the end and consumed at the front....
Definition buffer.hpp:27
The duration class represents a time interval in milliseconds.
Definition time.hpp:291
Common base class for all events.
Definition event.hpp:23
Simple handler for asynchronous event processing.
Definition event_handler.hpp:55
A threaded event loop that supports sending events and timers.
Definition event_loop.hpp:34
Abstract interface for logging strings.
Definition logger.hpp:51
This is the recommended event class.
Definition event.hpp:68
Interface for sockets.
Definition socket.hpp:375
A base class for socket layers.
Definition socket.hpp:654
A Transport Layer Security (TLS) layer.
Definition tls_layer.hpp:90
bool resumed_session() const
After a successful handshake, returns whether the session has been resumed.
void set_min_tls_ver(tls_ver ver)
Sets minimum allowed TLS version.
static std::string generate_selfsigned_certificate(const_tls_param_ref key, native_string const &password, std::string const &distinguished_name, std::vector< std::string > const &hostnames, cert_type type=cert_type::any, logger_interface &logger=get_null_logger())
Creates a new a self-signed certificate using the private key in the provided file.
virtual int shutdown() override
Signals peers that we want to close the connections.
bool set_key_and_certs(const_tls_param_ref key, const_tls_param_ref certs, native_string const &password, tls_data_format format=tls_data_format::autodetect)
Sets the certificate (and its chain) and the private key.
static std::pair< std::string, std::string > generate_csr(native_string const &password, std::string const &distinguished_name, std::vector< std::string > const &hostnames, bool csr_as_pem=true, cert_type type=cert_type::any, bool ecdsa=true, logger_interface &logger=get_null_logger())
Creates a CSR.
bool set_certificate(std::string_view const &key, std::string_view const &certs, native_string const &password, bool pem=true)
Sets the certificate (and its chain) and the private key.
std::vector< uint8_t > get_raw_certificate() const
Gets the session's peer certificate in DER.
static std::string generate_csr(const_tls_param_ref key, native_string const &password, std::string const &distinguished_name, std::vector< std::string > const &hostnames, bool csr_as_pem, tls_layer::cert_type type=cert_type::any, logger_interface &logger=get_null_logger())
Creates a CSR with the provided private key.
static std::pair< std::string, std::string > generate_ca_certificate(native_string const &password, std::string const &distinguished_name, duration const &lifetime={}, bool ecdsa=true, logger_interface &logger=get_null_logger())
Creates CA certificate.
virtual void set_event_handler(event_handler *pEvtHandler, fz::socket_event_flag retrigger_block=socket_event_flag{}) override
The handler for any events generated (or forwarded) by this layer.
static std::string get_gnutls_version()
Returns the version of the loaded GnuTLS library, may be different than the version used at compile-t...
static bool supports_pkcs11()
PKCS#11 support depends on how GnuTLS got configured.
void set_unexpected_eof_cb(std::function< bool()> const &cb)
Sets a callback to control whether unexpected eof is seen as error.
std::vector< uint8_t > get_session_parameters() const
Gets session parameters for resumption.
bool server_handshake(std::vector< uint8_t > const &session_to_resume={}, std::string_view const &preamble={}, tls_server_flags flags={})
Starts shaking hand for a new TLS session as server.
void set_max_tls_ver(tls_ver ver)
Sets maximum allowed TLS versions.
int new_session_ticket()
If running as server with TLS1.3, send out a new session ticket before the next data payload.
void set_verification_result(bool trusted)
Must be called after having received certificate_verification_event.
bool client_handshake(std::vector< uint8_t > const &required_certificate, std::vector< uint8_t > const &session_to_resume=std::vector< uint8_t >(), native_string const &session_hostname=native_string(), tls_client_flags flags={})
Starts shaking hands for a new TLS session as client.
std::string get_alpn() const
After a successful handshake, returns which protocol, if any, has been negotiated.
static std::string generate_cert_from_csr(std::pair< std::string, std::string > const &issuer, native_string const &password, std::string const &csr, std::string const &distinguished_name={}, std::vector< std::string > const &hostnames={}, duration const &lifetime={}, cert_type type=cert_type::any, logger_interface &logger=get_null_logger())
Creates a certificate from a CSR.
static std::string list_tls_ciphers(std::string const &priority)
Returns a human-readable list of all TLS ciphers available with the passed priority string.
static std::pair< std::string, std::string > generate_selfsigned_certificate(native_string const &password, std::string const &distinguished_name, std::vector< std::string > const &hostnames, cert_type type=cert_type::any, bool ecdsa=true, logger_interface &logger=get_null_logger())
Creates a new private key and a self-signed certificate.
cert_type
Type of certificate to create.
Definition tls_layer.hpp:210
native_string get_hostname() const
If running as server, get the SNI sent by the client.
bool set_certificate_file(native_string const &keyfile, native_string const &certsfile, native_string const &password, bool pem=true)
Sets the file containing the certificate (and its chain) and the file with the corresponding private ...
bool client_handshake(event_handler *const verification_handler, std::vector< uint8_t > const &session_to_resume=std::vector< uint8_t >(), native_string const &session_hostname=native_string(), tls_client_flags flags={})
Starts shaking hands for a new TLS session as client.
static bool add_pkcs11_provider(native_string_view const &path, logger_interface &logger=get_null_logger())
Add a PKCS#11 provider to the internal list of providers.
virtual int shutdown_read() override
Check that all layers further down also have reached EOF.
bool set_alpn(std::string_view const &alpn)
Negotiate application protocol.
Opaque class to load the system trust store asynchronously.
Definition tls_system_trust_store.hpp:30
Interface for logging.
type
Definition logger.hpp:16
The namespace used by libfilezilla.
Definition apply.hpp:17
tls_server_flags
Definition tls_layer.hpp:36
@ no_auto_ticket
In TLS 1.3, do not automatically send PSKs after finishing handshake. Ignored if not TLS 1....
@ debug_no_tickets
Used in unit tests. Don't use in production.
simple_event< certificate_verification_event_type, tls_layer *, tls_session_info > certificate_verification_event
This event gets sent during the handshake with details about the session and the used certificate.
Definition tls_layer.hpp:25
std::wstring native_string
A string in the system's native character type and encoding. Note: This typedef changes depending on...
Definition string.hpp:34
tls_client_flags
Definition tls_layer.hpp:59
socket_state
State transitions are monotonically increasing.
Definition socket.hpp:343
@ ecdsa
EC key type with P-256 as algorithm.
@ read
Data has become available.
@ write
data can be written.
socket_event_flag
The type of a socket event.
Definition socket.hpp:35
basic_tls_param_variant< std::string_view const, native_string const &, std::string const & > const_tls_param_ref
Acts as a const lvalue reference to one of a fz::tls_blob, fz::tls_filepath or fz::tls_pkcs11url.
Definition tls_params.hpp:120
tls_data_format
The encoding type of a fz::tls_blob or the file pointed to by a fz::tls_filepath.
Definition tls_params.hpp:142
Socket classes for networking.
Functions and classes to abstract away the type of different parameters to tls-related functions.