SSLconfig.h

Go to the documentation of this file.

// -*- C++ -*-
//  Copyright (c) 2006-2010,2012 Isode Limited, London, England.
//  All rights reserved.
//                                                                       
//  Acquisition and use of this software and related materials for any      
//  purpose requires a written licence agreement from Isode Limited,
//  or a written licence from an organisation licenced by Isode Limited
//  to grant such a licence.
 
 
// 
//
//
//
// Based largely on the DSA's version.
//
// @VERSION@
 
#ifndef _SSL_CONFIG_H_
#define _SSL_CONFIG_H_
 
#include <set>
#include <list>
#include <string>
#include <vector>
 
#include <isode/base/compat.h>
#include <isode/base/messages.h>
#include <isode/crypto/cipher_suites.h>
#include <crypto/icrypto/include/icrypto.hpp>
#include "cdecl.h"
 
// Version of TLS implementation (currently used by DsaCSSLConfig).
// This is the version of the Isode implementation, not necessarily
// corresponding to any specific TLS/SSL version.
 
#define IC_TLS_IMPLEMENTATION_VERSION 3
 
namespace SSLTLS {
 
    typedef std::set<TLS_CipherSuite>  cipher_suites_t;
 
    EVENTSVC_DLL const char* suite_name(TLS_CipherSuite);
 
    typedef enum {
        tls_verify_none,
        tls_verify_optional,
        tls_verify_require
    } tls_verify_client_choice;
 
 
    // Just holds the configuration: the constructor creates some
    // default values, and users should change some of them based on
    // configuration.  Cipher suites can be set by setting with set of
    // integers.  Most likely we'll also want to permit a string
    // (which'll be passed directly to OpenSSL) and/or change the set
    // to a list to allow ordering.
    class Config {
    public:
        // Connection specific items
        const char* IDcontext;          
        unsigned long supportFlags;          
        long sessionCacheTimeout;     
        tls_verify_client_choice verify_choice; 
        // Config items when have permanent DB
        ICrypto::Environment::ptr_t  envptr;
        std::string                  confset;
 
        // Config items for ephemeral DB
        cipher_suites_t suites;       
        std::string     suitesstr;    
 
        std::string defaultFileDirectory; 
 
        std::string randomSeedFile;   
        std::string DHparametersFile; 
        bool disable_rsa_blinding;    
        std::string identity_p12Bytes; 
        std::string identity_passphrase; 
        std::string identity;          
        int verify_depth;            
        std::string trustedCA_File;        
        std::list<std::string> trustedCA_Files; 
        std::list<std::string> untrusted_Files; 
        std::string LDAPhost;            
        int LDAPport;                
        int checkRevocation;                
        bool dontTrustIdentities;        
        bool OCSPnonce;                
        std::string OCSPuri;            
        std::string OCSPresponder;        
        int lookup_flags;            
 
        std::string pkcs11_module_path; 
            std::string pkcs11_module_init; 
            std::string pkcs11_user_pphr;   
            std::string pkcs11_uri;         
        std::string pkcs11_cert;        
 
        EVENTSVC_DLL std::string path(const std::string& file);
 
        EVENTSVC_DLL Config(const char*context);
 
    private:
        EVENTSVC_DLL Config ();
    };
 
    // This can be reused for many actual connections
    // It is configured using information from the SSL::Config object
    // passed to the factory method.
    // This is an abstract class to hide the actual SSL implementation
 
    class Context {
    protected:
        Context () {}
 
    public:
        static EVENTSVC_DLL Context *Factory (Config *confobj, MSGstruct *msp);
 
        virtual ~Context() {}
 
        virtual int Configure (Config *confobj, MSGstruct *msp) = 0;
    
        virtual const cipher_suites_t & AvailableSuites () = 0;
 
        virtual const cipher_suites_t & DefaultSuites () = 0;
 
        virtual bool HaveTLSIdentity () = 0;
 
        virtual bool IsUsable () = 0;
 
        virtual std::list<X509*> ServerCertificates(void) = 0;
 
        virtual std::list<X509*> GetTrustAnchors () const = 0;
 
        virtual int GetTlsInfo (const ICryptoKeyType keyType, 
                                EVP_PKEY** key, 
                                std::vector<std::string>& san,
                                std::vector<std::vector<unsigned char>>& cert_chain) const = 0;
 
        virtual size_t GetNbIdentities() const = 0;
    };
 
 
}
 
#endif /* __SSL_CONFIG_H_ */