tls.hh

/*
 * This file is open source software, licensed to you under the terms
 * of the Apache License, Version 2.0 (the "License").  See the NOTICE file
 * distributed with this work for additional information regarding copyright
 * ownership.  You may not use this file except in compliance with the License.
 *
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
/*
 * Copyright 2015 Cloudius Systems
 */
#pragma once
 
#ifndef SEASTAR_MODULE
#include <functional>
#include <unordered_set>
#include <map>
#include <any>
#include <fmt/format.h>
#endif
 
#include <seastar/core/future.hh>
#include <seastar/core/internal/api-level.hh>
#include <seastar/core/sstring.hh>
#include <seastar/core/shared_ptr.hh>
#include <seastar/net/socket_defs.hh>
#include <seastar/net/inet_address.hh>
#include <seastar/util/std-compat.hh>
#include <seastar/util/modules.hh>
#include <seastar/net/api.hh>
 
namespace seastar {
 
class socket;
 
class server_socket;
class connected_socket;
class socket_address;
 
SEASTAR_MODULE_EXPORT
namespace tls {
 
    enum class x509_crt_format {
        DER,
        PEM,
    };
 
    typedef std::basic_string_view<char> blob;
 
    class session;
    class server_session;
    class server_credentials;
    class certificate_credentials;
    class credentials_builder;
 
    class dh_params {
    public:
        // Key strength
        enum class level {
            LEGACY = 2,
            MEDIUM = 3,
            HIGH = 4,
            ULTRA = 5
        };
        dh_params(level = level::LEGACY);
        // loads a key from data
        dh_params(const blob&, x509_crt_format);
        ~dh_params();
 
        dh_params(dh_params&&) noexcept;
        dh_params& operator=(dh_params&&) noexcept;
 
        dh_params(const dh_params&) = delete;
        dh_params& operator=(const dh_params&) = delete;
 
        static future<dh_params> from_file(const sstring&, x509_crt_format);
    private:
        class impl;
        friend class server_credentials;
        friend class certificate_credentials;
        std::unique_ptr<impl> _impl;
    };
 
    class x509_cert {
        x509_cert(const blob&, x509_crt_format);
 
        static future<x509_cert> from_file(const sstring&, x509_crt_format);
    private:
        class impl;
        x509_cert(shared_ptr<impl>);
        shared_ptr<impl> _impl;
    };
 
    class abstract_credentials {
    protected:
        abstract_credentials() = default;
        abstract_credentials(const abstract_credentials&) = default;
        abstract_credentials& operator=(abstract_credentials&) = default;
        abstract_credentials& operator=(abstract_credentials&&) = default;
        virtual ~abstract_credentials() {};
    public:
        virtual void set_x509_trust(const blob&, x509_crt_format) = 0;
        virtual void set_x509_crl(const blob&, x509_crt_format) = 0;
        virtual void set_x509_key(const blob& cert, const blob& key, x509_crt_format) = 0;
 
        virtual void set_simple_pkcs12(const blob&, x509_crt_format, const sstring& password) = 0;
 
        virtual future<> set_x509_trust_file(const sstring& cafile, x509_crt_format);
        virtual future<> set_x509_crl_file(const sstring& crlfile, x509_crt_format);
        virtual future<> set_x509_key_file(const sstring& cf, const sstring& kf, x509_crt_format);
 
        virtual future<> set_simple_pkcs12_file(const sstring& pkcs12file, x509_crt_format, const sstring& password);
    };
 
    template<typename Base>
    class reloadable_credentials;
 
    enum class session_type {
        CLIENT, SERVER,
    };
 
    using dn_callback = noncopyable_function<void(session_type type, sstring subject, sstring issuer)>;
 
    class certificate_credentials : public abstract_credentials {
    public:
        certificate_credentials();
        ~certificate_credentials();
 
        certificate_credentials(certificate_credentials&&) noexcept;
        certificate_credentials& operator=(certificate_credentials&&) noexcept;
 
        certificate_credentials(const certificate_credentials&) = delete;
        certificate_credentials& operator=(const certificate_credentials&) = delete;
 
        void set_x509_trust(const blob&, x509_crt_format) override;
        void set_x509_crl(const blob&, x509_crt_format) override;
        void set_x509_key(const blob& cert, const blob& key, x509_crt_format) override;
        void set_simple_pkcs12(const blob&, x509_crt_format, const sstring& password) override;
 
        future<> set_system_trust();
 
        // TODO add methods for certificate verification
 
        void set_priority_string(const sstring&);
 
        void set_dn_verification_callback(dn_callback);
 
        void set_enable_certificate_verification(bool enable);
 
    private:
        class impl;
        friend class session;
        friend class server_session;
        friend class server_credentials;
        friend class credentials_builder;
        template<typename Base>
        friend class reloadable_credentials;
        shared_ptr<impl> _impl;
    };
 
    class verification_error : public std::runtime_error {
    public:
        using runtime_error::runtime_error;
    };
 
    enum class client_auth {
        NONE, REQUEST, REQUIRE
    };
 
    enum class session_resume_mode {
        NONE, TLS13_SESSION_TICKET
    };
 
    class server_credentials : public certificate_credentials {
    public:
        server_credentials();
        server_credentials(shared_ptr<dh_params>);
        server_credentials(const dh_params&);
 
        server_credentials(server_credentials&&) noexcept;
        server_credentials& operator=(server_credentials&&) noexcept;
 
        server_credentials(const server_credentials&) = delete;
        server_credentials& operator=(const server_credentials&) = delete;
 
        void set_client_auth(client_auth);
 
        void set_session_resume_mode(session_resume_mode);
    };
 
    class reloadable_credentials_base;
    class credentials_builder;
 
    using reload_callback = std::function<void(const std::unordered_set<sstring>&, std::exception_ptr)>;
    using reload_callback_ex = std::function<future<>(const credentials_builder&, const std::unordered_set<sstring>&, std::exception_ptr)>;
 
    class credentials_builder : public abstract_credentials {
    public:
        void set_dh_level(dh_params::level = dh_params::level::LEGACY);
 
        void set_x509_trust(const blob&, x509_crt_format) override ;
        void set_x509_crl(const blob&, x509_crt_format) override;
        void set_x509_key(const blob& cert, const blob& key, x509_crt_format) override;
        void set_simple_pkcs12(const blob&, x509_crt_format, const sstring& password) override;
 
        future<> set_x509_trust_file(const sstring& cafile, x509_crt_format) override;
        future<> set_x509_crl_file(const sstring& crlfile, x509_crt_format) override;
        future<> set_x509_key_file(const sstring& cf, const sstring& kf, x509_crt_format) override;
        future<> set_simple_pkcs12_file(const sstring& pkcs12file, x509_crt_format, const sstring& password) override;
 
        future<> set_system_trust();
        void set_client_auth(client_auth);
        void set_priority_string(const sstring&);
        void set_session_resume_mode(session_resume_mode);
 
        void apply_to(certificate_credentials&) const;
 
        shared_ptr<certificate_credentials> build_certificate_credentials() const;
        shared_ptr<server_credentials> build_server_credentials() const;
 
        void rebuild(certificate_credentials&) const;
        void rebuild(server_credentials&) const;
 
        // same as above, but any files used for certs/keys etc will be watched
        // for modification and reloaded if changed
        future<shared_ptr<certificate_credentials>> build_reloadable_certificate_credentials(reload_callback_ex = {}, std::optional<std::chrono::milliseconds> tolerance = {}) const;
        future<shared_ptr<server_credentials>> build_reloadable_server_credentials(reload_callback_ex = {}, std::optional<std::chrono::milliseconds> tolerance = {}) const;
 
        future<shared_ptr<certificate_credentials>> build_reloadable_certificate_credentials(reload_callback, std::optional<std::chrono::milliseconds> tolerance = {}) const;
        future<shared_ptr<server_credentials>> build_reloadable_server_credentials(reload_callback, std::optional<std::chrono::milliseconds> tolerance = {}) const;
    private:
        friend class reloadable_credentials_base;
 
        std::multimap<sstring, std::any> _blobs;
        client_auth _client_auth = client_auth::NONE;
        session_resume_mode _session_resume_mode = session_resume_mode::NONE;
        sstring _priority;
    };
 
    using session_data = std::vector<uint8_t>;
 
    struct tls_options {
        bool wait_for_eof_on_shutdown = true;
        sstring server_name = {};
 
        bool verify_certificate = true;
 
        session_data session_resume_data;
    };
 
    [[deprecated("Use overload with tls_options parameter")]]
    future<connected_socket> connect(shared_ptr<certificate_credentials>, socket_address, sstring name);
    [[deprecated("Use overload with tls_options parameter")]]
    future<connected_socket> connect(shared_ptr<certificate_credentials>, socket_address, socket_address local, sstring name);
 
    future<connected_socket> connect(shared_ptr<certificate_credentials>, socket_address, tls_options option = {});
    future<connected_socket> connect(shared_ptr<certificate_credentials>, socket_address, socket_address local, tls_options options = {});
 
    [[deprecated("Use overload with tls_options parameter")]]
    ::seastar::socket socket(shared_ptr<certificate_credentials>, sstring name);
 
    ::seastar::socket socket(shared_ptr<certificate_credentials>, tls_options options = {});
 
    [[deprecated("Use overload with tls_options parameter")]]
    future<connected_socket> wrap_client(shared_ptr<certificate_credentials>, connected_socket&&, sstring name);
    future<connected_socket> wrap_server(shared_ptr<server_credentials>, connected_socket&&);
 
    future<connected_socket> wrap_client(shared_ptr<certificate_credentials>, connected_socket&&, tls_options options = {});
 
    server_socket listen(shared_ptr<server_credentials>, socket_address sa, listen_options opts = listen_options());
    // Wraps an existing server socket in SSL
    server_socket listen(shared_ptr<server_credentials>, server_socket);
 
    future<std::optional<session_dn>> get_dn_information(connected_socket& socket);
 
    enum class subject_alt_name_type {
        dnsname = 1, // string value representing a 'DNS' entry
        rfc822name, // string value representing an 'email' entry
        uri, // string value representing an 'uri' entry
        ipaddress, // inet_address value representing an 'IP' entry
        othername, // string value
        dn, // string value
    };
 
    // Subject alt name entry
    struct subject_alt_name {
        using value_type = std::variant<
            sstring,
            net::inet_address
        >;
        subject_alt_name_type type;
        value_type value;
    };
 
    future<std::vector<subject_alt_name>> get_alt_name_information(connected_socket& socket, std::unordered_set<subject_alt_name_type> types = {});
 
    using certificate_data = std::vector<uint8_t>;
 
    future<std::vector<certificate_data>> get_peer_certificate_chain(connected_socket& socket);
 
    future<bool> check_session_is_resumed(connected_socket& socket);
 
    future<session_data> get_session_resume_data(connected_socket&);
 
    std::ostream& operator<<(std::ostream&, const subject_alt_name::value_type&);
    std::ostream& operator<<(std::ostream&, const subject_alt_name&);
 
    std::string_view format_as(subject_alt_name_type);
    std::ostream& operator<<(std::ostream&, subject_alt_name_type);
 
    const std::error_category& error_category();
 
    extern const int ERROR_UNKNOWN_COMPRESSION_ALGORITHM;
    extern const int ERROR_UNKNOWN_CIPHER_TYPE;
    extern const int ERROR_INVALID_SESSION;
    extern const int ERROR_UNEXPECTED_HANDSHAKE_PACKET;
    extern const int ERROR_UNKNOWN_CIPHER_SUITE;
    extern const int ERROR_UNKNOWN_ALGORITHM;
    extern const int ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM;
    extern const int ERROR_SAFE_RENEGOTIATION_FAILED;
    extern const int ERROR_UNSAFE_RENEGOTIATION_DENIED;
    extern const int ERROR_UNKNOWN_SRP_USERNAME;
    extern const int ERROR_PREMATURE_TERMINATION;
    extern const int ERROR_PUSH;
    extern const int ERROR_PULL;
    extern const int ERROR_UNEXPECTED_PACKET;
    extern const int ERROR_UNSUPPORTED_VERSION;
    extern const int ERROR_NO_CIPHER_SUITES;
    extern const int ERROR_DECRYPTION_FAILED;
    extern const int ERROR_MAC_VERIFY_FAILED;
}
}
 
template <> struct fmt::formatter<seastar::tls::subject_alt_name_type> : fmt::formatter<string_view> {
    template <typename FormatContext>
    auto format(seastar::tls::subject_alt_name_type type, FormatContext& ctx) const {
        return formatter<string_view>::format(format_as(type), ctx);
    }
};
 
template <> struct fmt::formatter<seastar::tls::subject_alt_name::value_type> : fmt::formatter<string_view> {
    template <typename FormatContext>
    auto format(const seastar::tls::subject_alt_name::value_type& value, FormatContext& ctx) const {
        return std::visit([&](const auto& v) {
            return fmt::format_to(ctx.out(), "{}", v);
        }, value);
    }
};
 
template <> struct fmt::formatter<seastar::tls::subject_alt_name> : fmt::formatter<string_view> {
    template <typename FormatContext>
    auto format(const seastar::tls::subject_alt_name& name, FormatContext& ctx) const {
        return fmt::format_to(ctx.out(), "{}={}", name.type, name.value);
    }
};