Line data    Source code

       1              : #ifndef THINGER_ASIO_SSL_CLIENT_VERIFY_HPP
       2              : #define THINGER_ASIO_SSL_CLIENT_VERIFY_HPP
       3              : 
       4              : #include "tls_session.hpp"
       5              : #include <array>
       6              : #include <memory>
       7              : #include <openssl/ssl.h>
       8              : 
       9              : namespace thinger::asio {
      10              : 
      11              : // The client certificate policy of a TLS listener (see client_verify_options), set on the SSL
      12              : // of each of its connections before the handshake, never on the context it listens with: that
      13              : // context may be shared with other listeners (e.g. the default certificate of a
      14              : // certificate_manager), which keep their own policies.
      15              : //
      16              : // Each connection gets a session id context of its own policy (a digest of its options), so a
      17              : // session is only resumed on a listener with the same policy: a session of a listener without
      18              : // trusted CAs is never resumed on one validating against them. The certificate_manager reads it
      19              : // from the SSL to keep it once the SNI callback switches the context (see sni_callback()).
      20              : class client_verify_policy {
      21              : public:
      22              :     // The policy of `options`: none (logged) if its trusted CAs cannot be read, or none
      23              :     // given in them
      24              :     static std::shared_ptr<const client_verify_policy> create(const client_verify_options& options);
      25              : 
      26              :     // What a listener without a policy uses for the hosts that ask for client certificates
      27              :     // (see certificate_manager::set_client_verify()): deferred validation, default limits
      28              :     static const client_verify_policy& deferred();
      29              : 
      30              :     ~client_verify_policy();
      31              :     client_verify_policy(const client_verify_policy&) = delete;
      32              :     client_verify_policy& operator=(const client_verify_policy&) = delete;
      33              : 
      34          573 :     const client_verify_options& options() const { return options_; }
      35              : 
      36              :     // Set the policy on the SSL of a connection before its handshake (nothing for mode none).
      37              :     // The SSL refers to it: it must outlive the handshake
      38              :     void apply(SSL* ssl) const;
      39              : 
      40              :     // Ask for a certificate in `mode` with this policy's CAs and limits: on the SSL being
      41              :     // set up, or from the SNI callback, once the context was switched (which drops the CAs the
      42              :     // SSL validated against)
      43              :     void set_mode(SSL* ssl, client_verify mode) const;
      44              : 
      45              :     // The policy set on an SSL with apply(), if any
      46              :     static const client_verify_policy* of(const SSL* ssl);
      47              : 
      48              : private:
      49              :     explicit client_verify_policy(client_verify_options options);
      50              : 
      51              :     client_verify_options options_;
      52              :     // The trusted CAs; none for deferred validation
      53              :     X509_STORE* store_ = nullptr;
      54              :     std::array<unsigned char, SSL_MAX_SID_CTX_LENGTH> session_id_context_{};
      55              : };
      56              : 
      57              : } // namespace thinger::asio
      58              : 
      59              : #endif // THINGER_ASIO_SSL_CLIENT_VERIFY_HPP