libfilezilla
tls_layer.hpp
Go to the documentation of this file.
1 #ifndef LIBFILEZILLA_TLS_LAYER_HEADER
2 #define LIBFILEZILLA_TLS_LAYER_HEADER
3 
8 #include "socket.hpp"
9 #include "tls_params.hpp"
10 #include "logger.hpp"
11 
12 namespace fz {
13 class tls_system_trust_store;
14 class tls_session_info;
15 
16 class tls_layer;
17 class tls_layer_impl;
18 
19 struct certificate_verification_event_type;
20 
26 
27 enum class tls_ver
28 {
29  v1_0,
30  v1_1,
31  v1_2,
32  v1_3
33 };
34 
35 enum class tls_server_flags : unsigned int
36 {
37  none = 0,
38 
40  no_auto_ticket = 0x1,
41 
43  debug_no_tickets = 0x2
44 };
45 
46 inline bool operator&(tls_server_flags lhs, tls_server_flags rhs) {
47  return (static_cast<std::underlying_type_t<tls_server_flags>>(lhs) & static_cast<std::underlying_type_t<tls_server_flags>>(rhs)) != 0;
48 }
49 inline tls_server_flags operator|(tls_server_flags lhs, tls_server_flags rhs) {
50  return static_cast<tls_server_flags>(static_cast<std::underlying_type_t<tls_server_flags>>(lhs) | static_cast<std::underlying_type_t<tls_server_flags>>(rhs));
51 }
52 inline tls_server_flags& operator|=(tls_server_flags & lhs, tls_server_flags rhs) {
53  lhs = lhs | rhs;
54  return lhs;
55 }
56 
57 
58 enum class tls_client_flags : unsigned int
59 {
60  none = 0,
61 
63  debug_no_tickets = 0x1
64 };
65 
66 inline bool operator&(tls_client_flags lhs, tls_client_flags rhs) {
67  return (static_cast<std::underlying_type_t<tls_client_flags>>(lhs) & static_cast<std::underlying_type_t<tls_client_flags>>(rhs)) != 0;
68 }
69 inline tls_client_flags operator|(tls_client_flags lhs, tls_client_flags rhs) {
70  return static_cast<tls_client_flags>(static_cast<std::underlying_type_t<tls_client_flags>>(lhs) | static_cast<std::underlying_type_t<tls_client_flags>>(rhs));
71 }
72 inline tls_client_flags& operator|=(tls_client_flags & lhs, tls_client_flags rhs) {
73  lhs = lhs | rhs;
74  return lhs;
75 }
76 
89 class FZ_PUBLIC_SYMBOL tls_layer final : protected event_handler, public socket_layer
90 {
91 public:
92  tls_layer(event_loop& event_loop, event_handler* evt_handler, socket_interface& layer, tls_system_trust_store * system_trust_store, logger_interface& logger);
93  virtual ~tls_layer() override;
94 
106  bool client_handshake(std::vector<uint8_t> const& required_certificate, std::vector<uint8_t> const& session_to_resume = std::vector<uint8_t>(), native_string const& session_hostname = native_string(), tls_client_flags flags = {});
107 
124  bool client_handshake(event_handler *const verification_handler, std::vector<uint8_t> const& session_to_resume = std::vector<uint8_t>(), native_string const& session_hostname = native_string(), tls_client_flags flags = {});
125 
141  bool server_handshake(std::vector<uint8_t> const& session_to_resume = {}, std::string_view const& preamble = {}, tls_server_flags flags = {});
142 
144  std::vector<uint8_t> get_session_parameters() const;
145 
147  std::vector<uint8_t> get_raw_certificate() const;
148 
154  void set_verification_result(bool trusted);
155 
156  std::string get_protocol() const;
157 
158  std::string get_key_exchange() const;
159  std::string get_cipher() const;
160  std::string get_mac() const;
161  int get_algorithm_warnings() const;
162 
164  bool resumed_session() const;
165 
167  static std::string list_tls_ciphers(std::string const& priority);
168 
177  bool set_certificate_file(native_string const& keyfile, native_string const& certsfile, native_string const& password, bool pem = true);
178 
187  bool set_certificate(std::string_view const& key, std::string_view const& certs, native_string const& password, bool pem = true);
188 
204  bool set_key_and_certs(const_tls_param_ref key, const_tls_param_ref certs, native_string const &password, tls_data_format format = tls_data_format::autodetect);
205 
207  static std::string get_gnutls_version();
208 
210  enum class cert_type {
211  any,
212  client,
213  server,
214  ca,
215  codesign
216  };
217 
226  static std::pair<std::string, std::string> generate_selfsigned_certificate(native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, cert_type type = cert_type::any, bool ecdsa = true, logger_interface &logger = get_null_logger());
227 
240  static std::string generate_selfsigned_certificate(const_tls_param_ref key, native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, cert_type type = cert_type::any, logger_interface &logger = get_null_logger());
241 
243  static std::pair<std::string, std::string> generate_ca_certificate(native_string const& password, std::string const& distinguished_name, duration const& lifetime = {}, bool ecdsa = true, logger_interface &logger = get_null_logger());
244 
246  static std::pair<std::string, std::string> generate_csr(native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, bool csr_as_pem = true, cert_type type = cert_type::any, bool ecdsa = true, logger_interface &logger = get_null_logger());
247 
249  static std::string generate_csr(const_tls_param_ref key, native_string const& password, std::string const& distinguished_name, std::vector<std::string> const& hostnames, bool csr_as_pem, tls_layer::cert_type type = cert_type::any, logger_interface &logger = get_null_logger());
250 
256  static std::string generate_cert_from_csr(std::pair<std::string, std::string> const& issuer, native_string const& password, std::string const& csr, std::string const& distinguished_name = {}, std::vector<std::string> const& hostnames = {}, duration const& lifetime = {}, cert_type type = cert_type::any, logger_interface &logger = get_null_logger());
257 
265  static bool add_pkcs11_provider(native_string_view const &path, logger_interface &logger = get_null_logger());
266 
279  bool set_alpn(std::string_view const& alpn);
280  bool set_alpn(std::vector<std::string> const& alpns, bool server_priority = false);
281 
284  void set_min_tls_ver(tls_ver ver);
285 
290  void set_max_tls_ver(tls_ver ver);
291 
293  std::string get_alpn() const;
294 
296  native_string get_hostname() const;
297 
298  bool is_server() const;
299 
308  int new_session_ticket();
309 
323  void set_unexpected_eof_cb(std::function<bool()> const& cb);
324  void set_unexpected_eof_cb(std::function<bool()> && cb);
325 
326  virtual socket_state get_state() const override;
327 
328  virtual int connect(native_string const& host, unsigned int port, address_type family = address_type::unknown) override;
329 
330  virtual int read(void *buffer, unsigned int size, int& error) override;
331  virtual int write(void const* buffer, unsigned int size, int& error) override;
332 
333  virtual int shutdown() override;
334 
335  virtual int shutdown_read() override;
336 
337  virtual void set_event_handler(event_handler* pEvtHandler, fz::socket_event_flag retrigger_block = socket_event_flag{}) override;
338 
340  static bool supports_pkcs11();
341 
342 private:
343  virtual void FZ_PRIVATE_SYMBOL operator()(event_base const& ev) override;
344 
345  friend class tls_layer_impl;
346  std::unique_ptr<tls_layer_impl> impl_;
347 };
348 }
349 
350 #endif
tls_client_flags
Definition: tls_layer.hpp:58
Data has become available.
tls_server_flags
Definition: tls_layer.hpp:35
A Transport Layer Security (TLS) layer.
Definition: tls_layer.hpp:89
Interface for sockets.
Definition: socket.hpp:374
Used in unit tests. Don't use in production.
Simple handler for asynchronous event processing.
Definition: event_handler.hpp:54
tls_data_format
The encoding type of a fz::tls_blob or the file pointed to by a fz::tls_filepath. ...
Definition: tls_params.hpp:141
The provided data is in PEM format.
Interface for logging.
This is the recommended event class.
Definition: event.hpp:67
Opaque class to load the system trust store asynchronously.
Definition: tls_system_trust_store.hpp:29
cert_type
Type of certificate to create.
Definition: tls_layer.hpp:210
basic_tls_param_variant< std::string_view const, native_string const &, std::string const & > const_tls_param_ref
Acts as a const lvalue reference to one of a fz::tls_blob, fz::tls_filepath or fz::tls_pkcs11url.
Definition: tls_params.hpp:124
simple_event< certificate_verification_event_type, tls_layer *, tls_session_info > certificate_verification_event
This event gets sent during the handshake with details about the session and the used certificate...
Definition: tls_layer.hpp:19
Socket classes for networking.
A threaded event loop that supports sending events and timers.
Definition: event_loop.hpp:33
A base class for socket layers.
Definition: socket.hpp:653
std::wstring native_string
A string in the system's native character type and encoding. Note: This typedef changes depending on...
Definition: string.hpp:34
socket_state
State transitions are monotonically increasing.
Definition: socket.hpp:342
The namespace used by libfilezilla.
Definition: apply.hpp:17
The type will be detected automatically using an heuristic.
The duration class represents a time interval in milliseconds.
Definition: time.hpp:290
EC key type with P-256 as algorithm.
In TLS 1.3, do not automatically send PSKs after finishing handshake. Ignored if not TLS 1...
data can be written.
Abstract interface for logging strings.
Definition: logger.hpp:50
Functions and classes to abstract away the type of different parameters to tls-related functions...
socket_event_flag
The type of a socket event.
Definition: socket.hpp:34
Operationf failed.