gadgets.h

Go to the documentation of this file.

/*
 * Copyright (C) 1996-2025 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
 */
 
#ifndef SQUID_SRC_SSL_GADGETS_H
#define SQUID_SRC_SSL_GADGETS_H
 
#if USE_OPENSSL
 
#include "anyp/forward.h"
#include "base/HardFun.h"
#include "compat/openssl.h"
#include "sbuf/forward.h"
#include "security/forward.h"
#include "ssl/crtd_message.h"
 
#include <optional>
#include <string>
 
#if HAVE_OPENSSL_ASN1_H
#include <openssl/asn1.h>
#endif
#if HAVE_OPENSSL_PEM_H
#include <openssl/pem.h>
#endif
#if HAVE_OPENSSL_TXT_DB_H
#include <openssl/txt_db.h>
#endif
#if HAVE_OPENSSL_X509V3_H
#include <openssl/x509v3.h>
#endif
 
namespace Ssl
{
#if !defined(SQUID_SSL_SIGN_HASH_IF_NONE)
#define SQUID_SSL_SIGN_HASH_IF_NONE "sha256"
#endif
 
sk_dtor_wrapper(sk_X509, STACK_OF(X509) *, X509_free);
typedef std::unique_ptr<STACK_OF(X509), sk_X509_free_wrapper> X509_STACK_Pointer;
 
typedef std::unique_ptr<BIGNUM, HardFun<void, BIGNUM*, &BN_free>> BIGNUM_Pointer;
 
typedef std::unique_ptr<BIO, HardFun<void, BIO*, &BIO_vfree>> BIO_Pointer;
 
typedef std::unique_ptr<ASN1_INTEGER, HardFun<void, ASN1_INTEGER*, &ASN1_INTEGER_free>> ASN1_INT_Pointer;
 
typedef std::unique_ptr<ASN1_OCTET_STRING, HardFun<void, ASN1_OCTET_STRING*, &ASN1_OCTET_STRING_free>> ASN1_OCTET_STRING_Pointer;
 
typedef std::unique_ptr<TXT_DB, HardFun<void, TXT_DB*, &TXT_DB_free>> TXT_DB_Pointer;
 
typedef std::unique_ptr<X509_NAME, HardFun<void, X509_NAME*, &X509_NAME_free>> X509_NAME_Pointer;
 
using EVP_PKEY_CTX_Pointer = std::unique_ptr<EVP_PKEY_CTX, HardFun<void, EVP_PKEY_CTX*, &EVP_PKEY_CTX_free>>;
 
typedef std::unique_ptr<X509_REQ, HardFun<void, X509_REQ*, &X509_REQ_free>> X509_REQ_Pointer;
 
typedef std::unique_ptr<AUTHORITY_KEYID, HardFun<void, AUTHORITY_KEYID*, &AUTHORITY_KEYID_free>> AUTHORITY_KEYID_Pointer;
 
sk_dtor_wrapper(sk_GENERAL_NAME, STACK_OF(GENERAL_NAME) *, GENERAL_NAME_free);
typedef std::unique_ptr<STACK_OF(GENERAL_NAME), sk_GENERAL_NAME_free_wrapper> GENERAL_NAME_STACK_Pointer;
 
typedef std::unique_ptr<GENERAL_NAME, HardFun<void, GENERAL_NAME*, &GENERAL_NAME_free>> GENERAL_NAME_Pointer;
 
typedef std::unique_ptr<X509_EXTENSION, HardFun<void, X509_EXTENSION*, &X509_EXTENSION_free>> X509_EXTENSION_Pointer;
 
typedef std::unique_ptr<X509_STORE_CTX, HardFun<void, X509_STORE_CTX *, &X509_STORE_CTX_free>> X509_STORE_CTX_Pointer;
 
// not using CtoCpp1() here because OpenSSL_free() takes void* rather than char*
inline void OPENSSL_free_for_c_strings(char * const string) { OPENSSL_free(string); }
using UniqueCString = std::unique_ptr<char, HardFun<void, char *, &OPENSSL_free_for_c_strings> >;
 
void ForgetErrors();
 
std::ostream &ReportAndForgetErrors(std::ostream &);
 
bool writeCertAndPrivateKeyToMemory(Security::CertPointer const & cert, Security::PrivateKeyPointer const & pkey, std::string & bufferToWrite);
 
bool appendCertToMemory(Security::CertPointer const & cert, std::string & bufferToWrite);
 
bool readCertAndPrivateKeyFromMemory(Security::CertPointer & cert, Security::PrivateKeyPointer & pkey, char const * bufferToRead);
 
BIO_Pointer ReadOnlyBioTiedTo(const char *);
 
void ReadPrivateKeyFromFile(char const * keyFilename, Security::PrivateKeyPointer &pkey, pem_password_cb *passwd_callback);
 
bool OpenCertsFileForReading(BIO_Pointer &bio, const char *filename);
 
Security::CertPointer ReadCertificate(const BIO_Pointer &);
 
Security::CertPointer ReadOptionalCertificate(const BIO_Pointer &);
 
bool ReadPrivateKey(BIO_Pointer &bio, Security::PrivateKeyPointer &pkey, pem_password_cb *passwd_callback);
 
bool OpenCertsFileForWriting(BIO_Pointer &bio, const char *filename);
 
bool WriteX509Certificate(BIO_Pointer &bio, const Security::CertPointer & cert);
 
bool WritePrivateKey(BIO_Pointer &bio, const Security::PrivateKeyPointer &pkey);
 
UniqueCString OneLineSummary(X509_NAME &);
 
enum CertSignAlgorithm {algSignTrusted = 0, algSignUntrusted, algSignSelf, algSignEnd};
 
extern const char *CertSignAlgorithmStr[];
 
inline const char *certSignAlgorithm(int sg)
{
    if (sg >=0 && sg < Ssl::algSignEnd)
        return Ssl::CertSignAlgorithmStr[sg];
 
    return nullptr;
}
 
inline CertSignAlgorithm certSignAlgorithmId(const char *sg)
{
    for (int i = 0; i < algSignEnd && Ssl::CertSignAlgorithmStr[i] != nullptr; i++)
        if (strcmp(Ssl::CertSignAlgorithmStr[i], sg) == 0)
            return (CertSignAlgorithm)i;
 
    return algSignEnd;
}
 
enum CertAdaptAlgorithm {algSetValidAfter = 0, algSetValidBefore, algSetCommonName, algSetEnd};
 
extern const char *CertAdaptAlgorithmStr[];
 
inline const char *sslCertAdaptAlgoritm(int alg)
{
    if (alg >=0 && alg < Ssl::algSetEnd)
        return Ssl::CertAdaptAlgorithmStr[alg];
 
    return nullptr;
}
 
class CertificateProperties
{
public:
    CertificateProperties();
    Security::CertPointer mimicCert; 
    Security::CertPointer signWithX509; 
    Security::PrivateKeyPointer signWithPkey; 
    bool setValidAfter; 
    bool setValidBefore; 
    bool setCommonName; 
    std::string commonName; 
    CertSignAlgorithm signAlgorithm; 
    const EVP_MD *signHash; 
private:
    CertificateProperties(CertificateProperties &);
    CertificateProperties &operator =(CertificateProperties const &);
};
 
std::string & OnDiskCertificateDbKey(const CertificateProperties &);
 
bool generateSslCertificate(Security::CertPointer & cert, Security::PrivateKeyPointer & pkey, CertificateProperties const &properties);
 
bool sslDateIsInTheFuture(char const * date);
 
bool certificateMatchesProperties(X509 *peer_cert, CertificateProperties const &properties);
 
const char *CommonHostName(X509 *x509);
 
SBuf AsnToSBuf(const ASN1_STRING &);
 
std::optional<AnyP::Host> ParseCommonNameAt(X509_NAME &, int);
 
std::optional<AnyP::Host> ParseAsSimpleDomainNameOrIp(const SBuf &);
 
const char *getOrganization(X509 *x509);
 
bool CertificatesCmp(const Security::CertPointer &cert1, const Security::CertPointer &cert2);
 
const ASN1_BIT_STRING *X509_get_signature(const Security::CertPointer &);
 
} // namespace Ssl
 
#endif // USE_OPENSSL
#endif /* SQUID_SRC_SSL_GADGETS_H */