Line data    Source code

       1              : #ifndef THINGER_ASIO_SSL_TLS_SESSION_HPP
       2              : #define THINGER_ASIO_SSL_TLS_SESSION_HPP
       3              : 
       4              : #include <cstddef>
       5              : #include <cstdint>
       6              : #include <string>
       7              : #include <vector>
       8              : 
       9              : namespace thinger::asio {
      10              : 
      11              : // Client certificates on a TLS server
      12              : enum class client_verify : std::uint8_t {
      13              :     none,       // no CertificateRequest
      14              :     optional,   // CertificateRequest; a client without a certificate goes on
      15              :     required,   // CertificateRequest; the handshake fails without one (TLS 1.3: certificate_required)
      16              : };
      17              : 
      18              : // What a TLS listener asks of its clients' certificates (see listener_options::client_verify)
      19              : struct client_verify_options {
      20              :     client_verify mode = client_verify::none;
      21              :     // CAs (PEM, one or more certificates) OpenSSL validates the chain of the client against
      22              :     // during the handshake: a certificate presented that does not validate fails the handshake,
      23              :     // in optional mode too. Empty: deferred validation, TLS accepts any well-formed chain (the
      24              :     // client still proves it holds the key of the leaf) and the application validates it from
      25              :     // tls_session::peer_chain_der (or ssl_socket::peer_certificate() and peer_chain())
      26              :     std::string trusted_cas;
      27              :     // Intermediate CAs allowed between the leaf and a trusted CA, as OpenSSL counts them
      28              :     // (SSL_set_verify_depth): only with trusted_cas
      29              :     int max_depth = 4;
      30              :     // Bytes of the certificate chain a client may send (SSL_set_max_cert_list): the memory a
      31              :     // client may use before it is authenticated
      32              :     std::size_t max_cert_list = std::size_t{16} * 1024;
      33              : };
      34              : 
      35              : // The TLS session cache of the contexts of a certificate_manager (see
      36              : // listener_options::session_cache): resumption of earlier sessions, by session id and by ticket
      37              : struct session_cache_options {
      38          350 :     bool enabled = true;            // false: no resumption (no server cache, no tickets)
      39          338 :     std::size_t size = 20480;       // sessions in the server cache: OpenSSL's default
      40              : 
      41          350 :     bool operator==(const session_cache_options&) const = default;
      42              : };
      43              : 
      44              : // What the application may read of a TLS connection once its handshake is done (see
      45              : // socket::tls())
      46              : struct tls_session {
      47              :     std::string version;        // e.g. "TLSv1.3"
      48              :     std::string cipher;         // e.g. "TLS_AES_128_GCM_SHA256"
      49              :     std::string server_name;    // the name the client sent (SNI), "" if none
      50              :     bool resumed = false;       // an earlier session resumed (no certificate exchanged then)
      51              :     // Certificates of the peer (DER), its leaf first; empty when it sent none. A resumed
      52              :     // session keeps the leaf only: OpenSSL does not keep the rest of the chain in a ticket
      53              :     std::vector<std::string> peer_chain_der;
      54              :     // Result of the validation of the peer's chain (X509_V_OK, 0, if valid): meaningful only
      55              :     // when OpenSSL validated it (with trusted CAs), as with deferred validation it was
      56              :     // validated against no CA at all
      57              :     long verify_result = 0;
      58              : };
      59              : 
      60              : } // namespace thinger::asio
      61              : 
      62              : #endif // THINGER_ASIO_SSL_TLS_SESSION_HPP