E-MailRelay

- Main Page
- Namespaces
- Classes
- Files

- File List
- File Members

gssl_mbedtls.h
Go to the documentation of this file.
1 //
2 // Copyright (C) 2001-2018 Graeme Walker <graeme_walker@users.sourceforge.net>
3 //
4 // This program is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
8 //
9 // This program is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
13 //
14 // You should have received a copy of the GNU General Public License
15 // along with this program. If not, see <http://www.gnu.org/licenses/>.
16 // ===
17 ///
18 /// \file gssl_mbedtls.h
19 ///
20
21 #ifndef G_SSL_MBEDTLS__H
22 #define G_SSL_MBEDTLS__H
23
24 #include "gdef.h"
25 #include "gssl.h"
26 #include <mbedtls/ssl.h>
27 #include <mbedtls/ssl_ciphersuites.h>
28 #include <mbedtls/entropy.h>
29 #if GCONFIG_HAVE_MBEDTLS_NET_H
30 #include <mbedtls/net.h>
31 #else
32 #include <mbedtls/net_sockets.h>
33 #endif
34 #include <mbedtls/ctr_drbg.h>
35 #include <mbedtls/certs.h>
36 #include <mbedtls/error.h>
37 #include <mbedtls/version.h>
38 #include <mbedtls/pem.h>
39 #include <mbedtls/base64.h>
40 #include <mbedtls/debug.h>
41 #include <mbedtls/md5.h>
42 #include <mbedtls/sha1.h>
43 #include <mbedtls/sha256.h>
44 #include <mbedtls/sha512.h>
45 #include <vector>
46 #include <map>
47
48 namespace GSsl
49 {
50 namespace MbedTls
51 {
52 class Certificate ;
53 class Rng ;
54 class Key ;
55 class Context ;
56 class Error ;
57 class SecureFile ;
58 class LibraryImp ;
59 class ProfileImp ;
60 class ProtocolImp ;
61 class DigesterImp ;
62 class Config ;
63 }
64 }
65
66 /// \class GSsl::MbedTls::Certificate
67 /// Holds a mbedtls_x509_crt structure.
68 ///
69 class GSsl::MbedTls::Certificate
70 {
71 public:
72 Certificate() ;
73 ~Certificate() ;
74 void load( const std::string & file ) ;
75 bool loaded() const ;
76 mbedtls_x509_crt * ptr() ;
77 mbedtls_x509_crt * ptr() const ;
78
79 private:
80 Certificate( const Certificate & ) ;
81 void operator=( const Certificate & ) ;
82
83 private:
84 bool m_loaded ;
85 mbedtls_x509_crt x ;
86 } ;
87
88 /// \class GSsl::MbedTls::Rng
89 /// Holds a mbedtls_ctr_drbg_context structure.
90 ///
91 class GSsl::MbedTls::Rng
92 {
93 public:
94 Rng() ;
95 ~Rng() ;
96 mbedtls_ctr_drbg_context * ptr() ;
97 mbedtls_ctr_drbg_context * ptr() const ;
98
99 private:
100 Rng( const Rng & ) ;
101 void operator=( const Rng & ) ;
102
103 private:
104 mbedtls_ctr_drbg_context x ; // "counter-mode deterministic random byte generator"
105 mbedtls_entropy_context entropy ;
106 } ;
107
108 /// \class GSsl::MbedTls::Key
109 /// Holds a mbedtls_pk_context structure.
110 ///
111 class GSsl::MbedTls::Key
112 {
113 public:
114 Key() ;
115 ~Key() ;
116 void load( const std::string & file ) ;
117 mbedtls_pk_context * ptr() ;
118 mbedtls_pk_context * ptr() const ;
119
120 private:
121 Key( const Key & ) ;
122 void operator=( const Key & ) ;
123
124 private:
125 mbedtls_pk_context x ;
126 } ;
127
128 /// \class GSsl::MbedTls::Context
129 /// Holds a mbedtls_ssl_context structure.
130 ///
131 class GSsl::MbedTls::Context
132 {
133 public:
134 explicit Context( const mbedtls_ssl_config * ) ;
135 ~Context() ;
136 mbedtls_ssl_context * ptr() ;
137 mbedtls_ssl_context * ptr() const ;
138
139 private:
140 Context( const Context & ) ;
141 void operator=( const Context & ) ;
142
143 private:
144 mbedtls_ssl_context x ;
145 } ;
146
147 /// \class GSsl::MbedTls::Error
148 /// An exception class for GSsl::MbedTls classes.
149 ///
150 class GSsl::MbedTls::Error : public std::exception
151 {
152 public:
153 explicit Error( const std::string & ) ;
154 Error( const std::string & , int rc , const std::string & more = std::string() ) ;
155 virtual ~Error() g__noexcept ;
156 virtual const char * what() const g__noexcept override ;
157
158 private:
159 std::string m_what ;
160 } ;
161
162 /// \class GSsl::MbedTls::SecureFile
163 /// An interface for reading a sensitive file and then overwriting
164 /// its contents in memory.
165 ///
166 class GSsl::MbedTls::SecureFile
167 {
168 public:
169 SecureFile( const std::string & path , bool with_nul ) ;
170 ~SecureFile() ;
171 const char * p() const ;
172 const unsigned char * pu() const ;
173 unsigned char * pu() ;
174 size_t size() const ;
175 bool empty() const ;
176
177 private:
178 SecureFile( const SecureFile & ) ;
179 void operator=( const SecureFile & ) ;
180
181 private:
182 std::vector<char> m_buffer ;
183 } ;
184
185 /// \class GSsl::MbedTls::Config
186 /// Holds protocol version information, etc.
187 ///
188 class GSsl::MbedTls::Config
189 {
190 public:
191 explicit Config( G::StringArray & config ) ;
192 int min_() const ;
193 int max_() const ;
194 bool noverify() const ;
195
196 private:
197 static bool consume( G::StringArray & , const std::string & ) ;
198
199 private:
200 bool m_noverify ;
201 int m_min ;
202 int m_max ;
203 } ;
204
205 /// \class GSsl::MbedTls::LibraryImp
206 /// An implementation of the GSsl::LibraryImpBase interface for mbedtls.
207 ///
208 class GSsl::MbedTls::LibraryImp : public LibraryImpBase
209 {
210 public:
211 typedef MbedTls::Rng Rng ;
212
213 LibraryImp( G::StringArray & , Library::LogFn , bool verbose ) ;
214 virtual ~LibraryImp() ;
215 virtual void addProfile( const std::string & profile_name , bool is_server_profile ,
216 const std::string & key_file , const std::string & cert_file , const std::string & ca_file ,
217 const std::string & default_peer_certificate_name , const std::string & default_peer_host_name ,
218 const std::string & profile_config ) override ;
219 virtual bool hasProfile( const std::string & profile_name ) const override ;
220 virtual const Profile & profile( const std::string & profile_name ) const override ;
221 virtual std::string id() const override ;
222 virtual G::StringArray digesters( bool ) const override ;
223 virtual Digester digester( const std::string & , const std::string & ) const override ;
224 const Rng & rng() const ;
225 Library::LogFn log() const ;
226 Config config() const ;
227 static std::string credit( const std::string & , const std::string & , const std::string & ) ;
228 static std::string sid() ;
229
230 private:
231 LibraryImp( const LibraryImp & ) ;
232 void operator=( const LibraryImp & ) ;
233 static int minVersionFrom( G::StringArray & ) ;
234 static int maxVersionFrom( G::StringArray & ) ;
235
236 private:
237 typedef std::map<std::string,shared_ptr<ProfileImp> > Map ;
238 Library::LogFn m_log_fn ;
239 Config m_config ;
240 Map m_profile_map ;
241 Rng m_rng ;
242 bool m_verbose ;
243 } ;
244
245 /// \class GSsl::MbedTls::ProfileImp
246 /// An implementation of the GSsl::Profile interface for mbedtls.
247 ///
248 class GSsl::MbedTls::ProfileImp : public Profile
249 {
250 public:
251 typedef MbedTls::Key Key ;
252 typedef MbedTls::Error Error ;
253 typedef MbedTls::Certificate Certificate ;
254
255 ProfileImp( const LibraryImp & library_imp , bool is_server , const std::string & key_file ,
256 const std::string & cert_file , const std::string & ca_file ,
257 const std::string & default_peer_certificate_name , const std::string & default_peer_host_name ,
258 const std::string & profile_config ) ;
259 virtual ~ProfileImp() ;
260 virtual ProtocolImpBase * newProtocol( const std::string & , const std::string & ) const override ;
261 const mbedtls_ssl_config * config() const ;
262 mbedtls_x509_crl * crl() const ;
263 void logAt( int level_out , std::string ) const ;
264 const std::string & defaultPeerCertificateName() const ;
265 const std::string & defaultPeerHostName() const ;
266
267 private:
268 ProfileImp( const ProfileImp & ) ;
269 void operator=( const ProfileImp & ) ;
270 static void onDebug( void * , int , const char * , int , const char * ) ;
271 void doDebug( int , const char * , int , const char * ) ;
272
273 private:
274 const LibraryImp & m_library_imp ;
275 const std::string m_default_peer_certificate_name ;
276 const std::string m_default_peer_host_name ;
277 mbedtls_ssl_config m_config ;
278 Key m_pk ;
279 Certificate m_certificate ;
280 Certificate m_ca_list ;
281 } ;
282
283 /// \class GSsl::MbedTls::ProtocolImp
284 /// An implementation of the GSsl::ProtocolImpBase interface for mbedtls.
285 ///
286 class GSsl::MbedTls::ProtocolImp : public ProtocolImpBase
287 {
288 public:
289 typedef Protocol::Result Result ;
290 typedef MbedTls::Context Context ;
291 typedef MbedTls::Error Error ;
292
293 ProtocolImp( const ProfileImp & , const std::string & , const std::string & ) ;
294 virtual ~ProtocolImp() ;
295
296 virtual Result connect( G::ReadWrite & ) override ;
297 virtual Result accept( G::ReadWrite & ) override ;
298 virtual Result read( char * buffer , size_t buffer_size_in , ssize_t & data_size_out ) override ;
299 virtual Result write( const char * buffer , size_t data_size_in , ssize_t & data_size_out ) override ;
300 virtual Result stop() override ;
301 virtual std::string peerCertificate() const override ;
302 virtual std::string peerCertificateChain() const override ;
303 virtual bool verified() const override ;
304
305 static int doSend( void * , const unsigned char * , size_t ) ;
306 static int doRecv( void * , unsigned char * , size_t ) ;
307 static int doRecvTimeout( void * , unsigned char * , size_t , uint32_t ) ;
308 std::string protocol() const ;
309 std::string cipher() const ;
310 const Profile & profile() const ;
311
312 private:
313 ProtocolImp( const ProtocolImp & ) ;
314 void operator=( const ProtocolImp & ) ;
315 Result convert( const char * , int , bool more = false ) ;
316 Result handshake() ;
317 std::string getPeerCertificate() ;
318 std::string verifyResultString( int ) ;
319
320 private:
321 const ProfileImp & m_profile ;
322 G::ReadWrite * m_io ;
323 Context m_ssl ;
324 std::string m_peer_certificate ;
325 std::string m_peer_certificate_chain ;
326 bool m_verified ;
327 } ;
328
329 /// \class GSsl::MbedTls::DigesterImp
330 /// An implementation of the GSsl::DigesterImpBase interface for MbedTls.
331 ///
332 class GSsl::MbedTls::DigesterImp : public GSsl::DigesterImpBase
333 {
334 public:
335 DigesterImp( const std::string & , const std::string & ) ;
336 virtual ~DigesterImp() ;
337 virtual void add( const std::string & ) override ;
338 virtual std::string value() override ;
339 virtual std::string state() override ;
340 virtual size_t blocksize() const override ;
341 virtual size_t valuesize() const override ;
342 virtual size_t statesize() const override ;
343
344 private:
345 DigesterImp( const DigesterImp & ) ;
346 void operator=( const DigesterImp & ) ;
347
348 private:
349 std::string m_hash_type ;
350 mbedtls_md5_context m_md5 ;
351 mbedtls_sha1_context m_sha1 ;
352 mbedtls_sha256_context m_sha256 ;
353 } ;
354
355 #endif
GSsl::Profile
A base interface for profile classes that work with concrete classes derived from GSsl::LibraryImpBas...
Definition: gssl.h:392
gssl.h
An interface to an underlying TLS library.
G::ReadWrite
An abstract interface for reading and writing from a non-blocking i/o channel.
Definition: greadwrite.h:49
GSsl::ProtocolImpBase
A base interface for GSsl::Protocol pimple classes.
Definition: gssl.h:405
GSsl::MbedTls::LibraryImp::id
virtual std::string id() const override
Implements Library::id().
Definition: gssl_mbedtls.cpp:115
GSsl::MbedTls::Config
Holds protocol version information, etc.
Definition: gssl_mbedtls.h:188
GSsl::MbedTls::Context
Holds a mbedtls_ssl_context structure.
Definition: gssl_mbedtls.h:131
GSsl::MbedTls::LibraryImp
An implementation of the GSsl::LibraryImpBase interface for mbedtls.
Definition: gssl_mbedtls.h:208
GSsl::MbedTls::Error
An exception class for GSsl::MbedTls classes.
Definition: gssl_mbedtls.h:150
GSsl::MbedTls::ProfileImp::newProtocol
virtual ProtocolImpBase * newProtocol(const std::string &, const std::string &) const override
Factory method for a new Protocol object on the heap.
Definition: gssl_mbedtls.cpp:414
G::StringArray
std::vector< std::string > StringArray
A std::vector of std::strings.
Definition: gstrings.h:33
GSsl::MbedTls::LibraryImp::profile
virtual const Profile & profile(const std::string &profile_name) const override
Implements Library::profile().
Definition: gssl_mbedtls.cpp:94
GSsl::MbedTls::DigesterImp::blocksize
virtual size_t blocksize() const override
Implements Digester::blocksize().
Definition: gssl_mbedtls.cpp:285
GSsl::MbedTls::ProtocolImp::connect
virtual Result connect(G::ReadWrite &) override
Implements Protocol::connect().
Definition: gssl_mbedtls.cpp:610
GSsl::MbedTls::Rng
Holds a mbedtls_ctr_drbg_context structure.
Definition: gssl_mbedtls.h:91
GSsl::MbedTls::DigesterImp::add
virtual void add(const std::string &) override
Implements Digester::add().
Definition: gssl_mbedtls.cpp:237
GSsl::MbedTls::DigesterImp
An implementation of the GSsl::DigesterImpBase interface for MbedTls.
Definition: gssl_mbedtls.h:332
GSsl::DigesterImpBase
A base interface for GSsl::Digester pimple classes.
Definition: gssl.h:439
GSsl::MbedTls::ProtocolImp
An implementation of the GSsl::ProtocolImpBase interface for mbedtls.
Definition: gssl_mbedtls.h:286
GSsl::MbedTls::ProtocolImp::read
virtual Result read(char *buffer, size_t buffer_size_in, ssize_t &data_size_out) override
Implements Protocol::read().
Definition: gssl_mbedtls.cpp:515
GSsl::MbedTls::Key
Holds a mbedtls_pk_context structure.
Definition: gssl_mbedtls.h:111
GSsl::MbedTls::ProtocolImp::verified
virtual bool verified() const override
Implements Protocol::verified().
Definition: gssl_mbedtls.cpp:715
GSsl::MbedTls::LibraryImp::hasProfile
virtual bool hasProfile(const std::string &profile_name) const override
Implements Library::hasProfile().
Definition: gssl_mbedtls.cpp:88
GSsl::Digester
Returns an object that can perform a cryptographic hash.
Definition: gssl.h:194
GSsl::MbedTls::ProtocolImp::peerCertificate
virtual std::string peerCertificate() const override
Implements Protocol::peerCertificate().
Definition: gssl_mbedtls.cpp:705
GSsl::MbedTls::ProfileImp
An implementation of the GSsl::Profile interface for mbedtls.
Definition: gssl_mbedtls.h:248
GSsl::LibraryImpBase
A base interface for GSsl::Library pimple classes.
Definition: gssl.h:358
GSsl::MbedTls::ProtocolImp::accept
virtual Result accept(G::ReadWrite &) override
Implements Protocol::accept().
Definition: gssl_mbedtls.cpp:616
GSsl::MbedTls::DigesterImp::statesize
virtual size_t statesize() const override
Implements Digester::statesize().
Definition: gssl_mbedtls.cpp:302
GSsl::MbedTls::ProtocolImp::write
virtual Result write(const char *buffer, size_t data_size_in, ssize_t &data_size_out) override
Implements Protocol::write().
Definition: gssl_mbedtls.cpp:524
GSsl::MbedTls::DigesterImp::state
virtual std::string state() override
Implements Digester::state().
Definition: gssl_mbedtls.cpp:273
GSsl::MbedTls::ProtocolImp::peerCertificateChain
virtual std::string peerCertificateChain() const override
Implements Protocol::peerCertificateChain().
Definition: gssl_mbedtls.cpp:710
GSsl::MbedTls::DigesterImp::value
virtual std::string value() override
Implements Digester::value().
Definition: gssl_mbedtls.cpp:247
GSsl::MbedTls::ProtocolImp::stop
virtual Result stop() override
Implements Protocol::stop().
Definition: gssl_mbedtls.cpp:549
GSsl::MbedTls::DigesterImp::valuesize
virtual size_t valuesize() const override
Implements Digester::valuesize().
Definition: gssl_mbedtls.cpp:290
GSsl
TLS/SSL transport layer security classes.
Definition: gssl.h:32
GSsl::MbedTls::LibraryImp::digesters
virtual G::StringArray digesters(bool) const override
Implements Library::digesters().
Definition: gssl_mbedtls.cpp:134
GSsl::MbedTls::Certificate
Holds a mbedtls_x509_crt structure.
Definition: gssl_mbedtls.h:69
GSsl::MbedTls::LibraryImp::digester
virtual Digester digester(const std::string &, const std::string &) const override
Implements Library::digester().
Definition: gssl_mbedtls.cpp:143
GSsl::MbedTls::SecureFile
An interface for reading a sensitive file and then overwriting its contents in memory.
Definition: gssl_mbedtls.h:166
GSsl::MbedTls::LibraryImp::addProfile
virtual void addProfile(const std::string &profile_name, bool is_server_profile, const std::string &key_file, const std::string &cert_file, const std::string &ca_file, const std::string &default_peer_certificate_name, const std::string &default_peer_host_name, const std::string &profile_config) override
Implements Library::addProfile().
Definition: gssl_mbedtls.cpp:77