ssl_sock.h

Go to the documentation of this file.

/* 
 * Copyright (C) 2009-2011 Teluu Inc. (http://www.teluu.com)
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
 */
#ifndef __PJ_SSL_SOCK_H__
#define __PJ_SSL_SOCK_H__
 
#include <pj/ioqueue.h>
#include <pj/sock.h>
#include <pj/sock_qos.h>
 
 
PJ_BEGIN_DECL
 
typedef struct pj_ssl_sock_t pj_ssl_sock_t;
 
 
typedef struct pj_ssl_cert_t pj_ssl_cert_t;
 
 
typedef enum pj_ssl_cert_verify_flag_t
{
    PJ_SSL_CERT_ESUCCESS                                = 0,
 
    PJ_SSL_CERT_EISSUER_NOT_FOUND                       = (1 << 0),
 
    PJ_SSL_CERT_EUNTRUSTED                              = (1 << 1),
 
    PJ_SSL_CERT_EVALIDITY_PERIOD                        = (1 << 2),
 
    PJ_SSL_CERT_EINVALID_FORMAT                         = (1 << 3),
 
    PJ_SSL_CERT_EINVALID_PURPOSE                        = (1 << 4),
 
    PJ_SSL_CERT_EISSUER_MISMATCH                        = (1 << 5),
 
    PJ_SSL_CERT_ECRL_FAILURE                            = (1 << 6),
 
    PJ_SSL_CERT_EREVOKED                                = (1 << 7),
 
    PJ_SSL_CERT_ECHAIN_TOO_LONG                         = (1 << 8),
 
    PJ_SSL_CERT_EIDENTITY_NOT_MATCH                     = (1 << 30),
 
    PJ_SSL_CERT_EUNKNOWN                                = (1 << 31)
 
} pj_ssl_cert_verify_flag_t;
 
 
typedef enum pj_ssl_cert_name_type
{
    PJ_SSL_CERT_NAME_UNKNOWN = 0,
    PJ_SSL_CERT_NAME_RFC822,
    PJ_SSL_CERT_NAME_DNS,
    PJ_SSL_CERT_NAME_URI,
    PJ_SSL_CERT_NAME_IP
} pj_ssl_cert_name_type;
 
typedef struct pj_ssl_cert_info {
 
    unsigned    version;            
    pj_uint8_t  serial_no[20];      
    struct {
        pj_str_t        cn;         
        pj_str_t        info;       
    } subject;                      
    struct {
        pj_str_t        cn;         
        pj_str_t        info;       
    } issuer;                       
    struct {
        pj_time_val     start;      
        pj_time_val     end;        
        pj_bool_t       gmt;        
    } validity;                     
    struct {
        unsigned        cnt;        
        struct {
            pj_ssl_cert_name_type type;
            pj_str_t    name;       
        } *entry;                   
    } subj_alt_name;                
    pj_str_t raw;                   
    struct {
        unsigned        cnt;        
        pj_str_t       *cert_raw;
    } raw_chain;
 
} pj_ssl_cert_info;
 
typedef pj_str_t pj_ssl_cert_buffer;
 
PJ_DECL(pj_status_t) pj_ssl_cert_load_from_files(pj_pool_t *pool,
                                                 const pj_str_t *CA_file,
                                                 const pj_str_t *cert_file,
                                                 const pj_str_t *privkey_file,
                                                 const pj_str_t *privkey_pass,
                                                 pj_ssl_cert_t **p_cert);
 
PJ_DECL(pj_status_t) pj_ssl_cert_load_from_files2(
                                                pj_pool_t *pool,
                                                const pj_str_t *CA_file,
                                                const pj_str_t *CA_path,
                                                const pj_str_t *cert_file,
                                                const pj_str_t *privkey_file,
                                                const pj_str_t *privkey_pass,
                                                pj_ssl_cert_t **p_cert);
 
 
PJ_DECL(pj_status_t) pj_ssl_cert_load_from_buffer(pj_pool_t *pool,
                                        const pj_ssl_cert_buffer *CA_buf,
                                        const pj_ssl_cert_buffer *cert_buf,
                                        const pj_ssl_cert_buffer *privkey_buf,
                                        const pj_str_t *privkey_pass,
                                        pj_ssl_cert_t **p_cert);
 
PJ_DECL(pj_ssize_t) pj_ssl_cert_info_dump(const pj_ssl_cert_info *ci,
                                          const char *indent,
                                          char *buf,
                                          pj_size_t buf_size);
 
 
PJ_DECL(pj_status_t) pj_ssl_cert_get_verify_status_strings(
                                                 pj_uint32_t verify_status, 
                                                 const char *error_strings[],
                                                 unsigned *count);
 
PJ_DECL(void) pj_ssl_cert_wipe_keys(pj_ssl_cert_t *cert);
 
 
typedef enum pj_ssl_cipher {
 
    /* Unsupported cipher */
    PJ_TLS_UNKNOWN_CIPHER                       = -1,
 
    /* NULL */
    PJ_TLS_NULL_WITH_NULL_NULL                  = 0x00000000,
 
    /* TLS/SSLv3 */
    PJ_TLS_RSA_WITH_NULL_MD5                    = 0x00000001,
    PJ_TLS_RSA_WITH_NULL_SHA                    = 0x00000002,
    PJ_TLS_RSA_WITH_NULL_SHA256                 = 0x0000003B,
    PJ_TLS_RSA_WITH_RC4_128_MD5                 = 0x00000004,
    PJ_TLS_RSA_WITH_RC4_128_SHA                 = 0x00000005,
    PJ_TLS_RSA_WITH_3DES_EDE_CBC_SHA            = 0x0000000A,
    PJ_TLS_RSA_WITH_AES_128_CBC_SHA             = 0x0000002F,
    PJ_TLS_RSA_WITH_AES_256_CBC_SHA             = 0x00000035,
    PJ_TLS_RSA_WITH_AES_128_CBC_SHA256          = 0x0000003C,
    PJ_TLS_RSA_WITH_AES_256_CBC_SHA256          = 0x0000003D,
    PJ_TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA         = 0x0000000D,
    PJ_TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA         = 0x00000010,
    PJ_TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA        = 0x00000013,
    PJ_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        = 0x00000016,
    PJ_TLS_DH_DSS_WITH_AES_128_CBC_SHA          = 0x00000030,
    PJ_TLS_DH_RSA_WITH_AES_128_CBC_SHA          = 0x00000031,
    PJ_TLS_DHE_DSS_WITH_AES_128_CBC_SHA         = 0x00000032,
    PJ_TLS_DHE_RSA_WITH_AES_128_CBC_SHA         = 0x00000033,
    PJ_TLS_DH_DSS_WITH_AES_256_CBC_SHA          = 0x00000036,
    PJ_TLS_DH_RSA_WITH_AES_256_CBC_SHA          = 0x00000037,
    PJ_TLS_DHE_DSS_WITH_AES_256_CBC_SHA         = 0x00000038,
    PJ_TLS_DHE_RSA_WITH_AES_256_CBC_SHA         = 0x00000039,
    PJ_TLS_DH_DSS_WITH_AES_128_CBC_SHA256       = 0x0000003E,
    PJ_TLS_DH_RSA_WITH_AES_128_CBC_SHA256       = 0x0000003F,
    PJ_TLS_DHE_DSS_WITH_AES_128_CBC_SHA256      = 0x00000040,
    PJ_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256      = 0x00000067,
    PJ_TLS_DH_DSS_WITH_AES_256_CBC_SHA256       = 0x00000068,
    PJ_TLS_DH_RSA_WITH_AES_256_CBC_SHA256       = 0x00000069,
    PJ_TLS_DHE_DSS_WITH_AES_256_CBC_SHA256      = 0x0000006A,
    PJ_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256      = 0x0000006B,
    PJ_TLS_DH_anon_WITH_RC4_128_MD5             = 0x00000018,
    PJ_TLS_DH_anon_WITH_3DES_EDE_CBC_SHA        = 0x0000001B,
    PJ_TLS_DH_anon_WITH_AES_128_CBC_SHA         = 0x00000034,
    PJ_TLS_DH_anon_WITH_AES_256_CBC_SHA         = 0x0000003A,
    PJ_TLS_DH_anon_WITH_AES_128_CBC_SHA256      = 0x0000006C,
    PJ_TLS_DH_anon_WITH_AES_256_CBC_SHA256      = 0x0000006D,
 
    /* TLS (deprecated) */
    PJ_TLS_RSA_EXPORT_WITH_RC4_40_MD5           = 0x00000003,
    PJ_TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5       = 0x00000006,
    PJ_TLS_RSA_WITH_IDEA_CBC_SHA                = 0x00000007,
    PJ_TLS_RSA_EXPORT_WITH_DES40_CBC_SHA        = 0x00000008,
    PJ_TLS_RSA_WITH_DES_CBC_SHA                 = 0x00000009,
    PJ_TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA     = 0x0000000B,
    PJ_TLS_DH_DSS_WITH_DES_CBC_SHA              = 0x0000000C,
    PJ_TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA     = 0x0000000E,
    PJ_TLS_DH_RSA_WITH_DES_CBC_SHA              = 0x0000000F,
    PJ_TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA    = 0x00000011,
    PJ_TLS_DHE_DSS_WITH_DES_CBC_SHA             = 0x00000012,
    PJ_TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA    = 0x00000014,
    PJ_TLS_DHE_RSA_WITH_DES_CBC_SHA             = 0x00000015,
    PJ_TLS_DH_anon_EXPORT_WITH_RC4_40_MD5       = 0x00000017,
    PJ_TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA    = 0x00000019,
    PJ_TLS_DH_anon_WITH_DES_CBC_SHA             = 0x0000001A,
 
    /* SSLv3 */
    PJ_SSL_FORTEZZA_KEA_WITH_NULL_SHA           = 0x0000001C,
    PJ_SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA   = 0x0000001D,
    PJ_SSL_FORTEZZA_KEA_WITH_RC4_128_SHA        = 0x0000001E,
    
    /* SSLv2 */
    PJ_SSL_CK_RC4_128_WITH_MD5                  = 0x00010080,
    PJ_SSL_CK_RC4_128_EXPORT40_WITH_MD5         = 0x00020080,
    PJ_SSL_CK_RC2_128_CBC_WITH_MD5              = 0x00030080,
    PJ_SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5     = 0x00040080,
    PJ_SSL_CK_IDEA_128_CBC_WITH_MD5             = 0x00050080,
    PJ_SSL_CK_DES_64_CBC_WITH_MD5               = 0x00060040,
    PJ_SSL_CK_DES_192_EDE3_CBC_WITH_MD5         = 0x000700C0
 
} pj_ssl_cipher;
 
 
PJ_DECL(pj_status_t) pj_ssl_cipher_get_availables(pj_ssl_cipher ciphers[],
                                                  unsigned *cipher_num);
 
 
PJ_DECL(pj_bool_t) pj_ssl_cipher_is_supported(pj_ssl_cipher cipher);
 
 
PJ_DECL(const char*) pj_ssl_cipher_name(pj_ssl_cipher cipher);
 
 
PJ_DECL(pj_ssl_cipher) pj_ssl_cipher_id(const char *cipher_name);
 
typedef enum pj_ssl_curve
{
        PJ_TLS_UNKNOWN_CURVE            = 0,
        PJ_TLS_CURVE_SECT163K1          = 1,
        PJ_TLS_CURVE_SECT163R1          = 2,
        PJ_TLS_CURVE_SECT163R2          = 3,
        PJ_TLS_CURVE_SECT193R1          = 4,
        PJ_TLS_CURVE_SECT193R2          = 5,
        PJ_TLS_CURVE_SECT233K1          = 6,
        PJ_TLS_CURVE_SECT233R1          = 7,
        PJ_TLS_CURVE_SECT239K1          = 8,
        PJ_TLS_CURVE_SECT283K1          = 9,
        PJ_TLS_CURVE_SECT283R1          = 10,
        PJ_TLS_CURVE_SECT409K1          = 11,
        PJ_TLS_CURVE_SECT409R1          = 12,
        PJ_TLS_CURVE_SECT571K1          = 13,
        PJ_TLS_CURVE_SECT571R1          = 14,
        PJ_TLS_CURVE_SECP160K1          = 15,
        PJ_TLS_CURVE_SECP160R1          = 16,
        PJ_TLS_CURVE_SECP160R2          = 17,
        PJ_TLS_CURVE_SECP192K1          = 18,
        PJ_TLS_CURVE_SECP192R1          = 19,
        PJ_TLS_CURVE_SECP224K1          = 20,
        PJ_TLS_CURVE_SECP224R1          = 21,
        PJ_TLS_CURVE_SECP256K1          = 22,
        PJ_TLS_CURVE_SECP256R1          = 23,
        PJ_TLS_CURVE_SECP384R1          = 24,
        PJ_TLS_CURVE_SECP521R1          = 25,
        PJ_TLS_CURVE_BRAINPOOLP256R1    = 26,
        PJ_TLS_CURVE_BRAINPOOLP384R1    = 27,
        PJ_TLS_CURVE_BRAINPOOLP512R1    = 28,
        PJ_TLS_CURVE_ARBITRARY_EXPLICIT_PRIME_CURVES    = 0XFF01,
        PJ_TLS_CURVE_ARBITRARY_EXPLICIT_CHAR2_CURVES    = 0XFF02
} pj_ssl_curve;
 
PJ_DECL(pj_status_t) pj_ssl_curve_get_availables(pj_ssl_curve curves[],
                                                 unsigned *curve_num);
 
PJ_DECL(pj_bool_t) pj_ssl_curve_is_supported(pj_ssl_curve curve);
 
 
PJ_DECL(const char*) pj_ssl_curve_name(pj_ssl_curve curve);
 
PJ_DECL(pj_ssl_curve) pj_ssl_curve_id(const char *curve_name);
 
typedef enum pj_ssl_entropy
{
        PJ_SSL_ENTROPY_NONE     = 0,    
        PJ_SSL_ENTROPY_EGD      = 1,    
        PJ_SSL_ENTROPY_RANDOM   = 2,    
        PJ_SSL_ENTROPY_URANDOM  = 3,    
        PJ_SSL_ENTROPY_FILE     = 4,    
        PJ_SSL_ENTROPY_UNKNOWN  = 0x0F  
} pj_ssl_entropy_t;
 
typedef struct pj_ssl_sock_cb
{
    pj_bool_t (*on_data_read)(pj_ssl_sock_t *ssock,
                              void *data,
                              pj_size_t size,
                              pj_status_t status,
                              pj_size_t *remainder);
    pj_bool_t (*on_data_recvfrom)(pj_ssl_sock_t *ssock,
                                  void *data,
                                  pj_size_t size,
                                  const pj_sockaddr_t *src_addr,
                                  int addr_len,
                                  pj_status_t status);
 
    pj_bool_t (*on_data_sent)(pj_ssl_sock_t *ssock,
                              pj_ioqueue_op_key_t *send_key,
                              pj_ssize_t sent);
 
    pj_bool_t (*on_accept_complete)(pj_ssl_sock_t *ssock,
                                    pj_ssl_sock_t *newsock,
                                    const pj_sockaddr_t *src_addr,
                                    int src_addr_len);
    pj_bool_t (*on_accept_complete2)(pj_ssl_sock_t *ssock,
                                     pj_ssl_sock_t *newsock,
                                     const pj_sockaddr_t *src_addr,
                                     int src_addr_len, 
                                     pj_status_t status);
 
    pj_bool_t (*on_connect_complete)(pj_ssl_sock_t *ssock,
                                     pj_status_t status);
    
    pj_bool_t (*on_verify_cb)(pj_ssl_sock_t *ssock, pj_bool_t is_server);
 
} pj_ssl_sock_cb;
 
 
typedef enum pj_ssl_sock_proto
{
    PJ_SSL_SOCK_PROTO_DEFAULT = 0,
 
    PJ_SSL_SOCK_PROTO_SSL2    = (1 << 0),
 
    PJ_SSL_SOCK_PROTO_SSL3    = (1 << 1),
 
    PJ_SSL_SOCK_PROTO_TLS1    = (1 << 2),
 
    PJ_SSL_SOCK_PROTO_TLS1_1  = (1 << 3),
 
    PJ_SSL_SOCK_PROTO_TLS1_2  = (1 << 4),
 
    PJ_SSL_SOCK_PROTO_TLS1_3  = (1 << 5),
 
    PJ_SSL_SOCK_PROTO_SSL23   = (1 << 16) - 1,
    PJ_SSL_SOCK_PROTO_ALL = PJ_SSL_SOCK_PROTO_SSL23,
 
    PJ_SSL_SOCK_PROTO_DTLS1   = (1 << 16),
 
} pj_ssl_sock_proto;
 
 
typedef struct pj_ssl_sock_info 
{
    pj_bool_t established;
 
    pj_uint32_t proto;
 
    pj_ssl_cipher cipher;
 
    pj_sockaddr local_addr;
 
    pj_sockaddr remote_addr;
   
    pj_ssl_cert_info *local_cert_info;
   
    pj_ssl_cert_info *remote_cert_info;
 
    pj_uint32_t         verify_status;
 
    unsigned long       last_native_err;
 
    pj_grp_lock_t *grp_lock;
 
} pj_ssl_sock_info;
 
 
typedef struct pj_ssl_sock_param
{
    pj_grp_lock_t *grp_lock;
 
    int sock_af;
 
    int sock_type;
 
    pj_ioqueue_t *ioqueue;
 
    pj_timer_heap_t *timer_heap;
 
    pj_ssl_sock_cb cb;
 
    void *user_data;
 
    pj_uint32_t proto;
 
    unsigned async_cnt;
 
    int concurrency;
 
    pj_bool_t whole_data;
 
    pj_size_t send_buffer_size;
 
    pj_size_t read_buffer_size;
 
    unsigned ciphers_num;
 
    pj_ssl_cipher *ciphers;
 
    unsigned curves_num;
 
    pj_ssl_curve *curves;
 
    pj_str_t    sigalgs;
 
    pj_ssl_entropy_t    entropy_type;
 
    pj_str_t            entropy_path;
 
    pj_time_val timeout;
 
    pj_bool_t verify_peer;
    
    pj_bool_t require_client_cert;
 
    pj_str_t server_name;
 
    pj_bool_t reuse_addr;
 
    pj_qos_type qos_type;
 
    pj_qos_params qos_params;
 
    pj_bool_t qos_ignore_error;
 
    pj_sockopt_params sockopt_params;
 
    pj_bool_t sockopt_ignore_error;
 
} pj_ssl_sock_param;
 
 
typedef struct pj_ssl_start_connect_param {
    pj_pool_t *pool;
 
    const pj_sockaddr_t *localaddr;
 
    pj_uint16_t local_port_range;
 
    const pj_sockaddr_t *remaddr;
 
    int addr_len;
 
} pj_ssl_start_connect_param;
 
 
PJ_DECL(void) pj_ssl_sock_param_default(pj_ssl_sock_param *param);
 
 
PJ_DECL(void) pj_ssl_sock_param_copy(pj_pool_t *pool, 
                                     pj_ssl_sock_param *dst,
                                     const pj_ssl_sock_param *src);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_create(pj_pool_t *pool,
                                        const pj_ssl_sock_param *param,
                                        pj_ssl_sock_t **p_ssock);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_set_certificate(
                                            pj_ssl_sock_t *ssock,
                                            pj_pool_t *pool,
                                            const pj_ssl_cert_t *cert);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_close(pj_ssl_sock_t *ssock);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_set_user_data(pj_ssl_sock_t *ssock,
                                               void *user_data);
 
PJ_DECL(void*) pj_ssl_sock_get_user_data(pj_ssl_sock_t *ssock);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_get_info(pj_ssl_sock_t *ssock,
                                          pj_ssl_sock_info *info);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_read(pj_ssl_sock_t *ssock,
                                            pj_pool_t *pool,
                                            unsigned buff_size,
                                            pj_uint32_t flags);
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_read2(pj_ssl_sock_t *ssock,
                                             pj_pool_t *pool,
                                             unsigned buff_size,
                                             void *readbuf[],
                                             pj_uint32_t flags);
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_recvfrom(pj_ssl_sock_t *ssock,
                                                pj_pool_t *pool,
                                                unsigned buff_size,
                                                pj_uint32_t flags);
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_recvfrom2(pj_ssl_sock_t *ssock,
                                                 pj_pool_t *pool,
                                                 unsigned buff_size,
                                                 void *readbuf[],
                                                 pj_uint32_t flags);
 
PJ_DECL(pj_status_t) pj_ssl_sock_send(pj_ssl_sock_t *ssock,
                                      pj_ioqueue_op_key_t *send_key,
                                      const void *data,
                                      pj_ssize_t *size,
                                      unsigned flags);
 
PJ_DECL(pj_status_t) pj_ssl_sock_sendto(pj_ssl_sock_t *ssock,
                                        pj_ioqueue_op_key_t *send_key,
                                        const void *data,
                                        pj_ssize_t *size,
                                        unsigned flags,
                                        const pj_sockaddr_t *addr,
                                        int addr_len);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_accept(pj_ssl_sock_t *ssock,
                                              pj_pool_t *pool,
                                              const pj_sockaddr_t *local_addr,
                                              int addr_len);
 
 
PJ_DECL(pj_status_t)
pj_ssl_sock_start_accept2(pj_ssl_sock_t *ssock,
                          pj_pool_t *pool,
                          const pj_sockaddr_t *local_addr,
                          int addr_len,
                          const pj_ssl_sock_param *newsock_param);
 
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_connect(pj_ssl_sock_t *ssock,
                                               pj_pool_t *pool,
                                               const pj_sockaddr_t *localaddr,
                                               const pj_sockaddr_t *remaddr,
                                               int addr_len);
 
PJ_DECL(pj_status_t) pj_ssl_sock_start_connect2(
                              pj_ssl_sock_t *ssock,
                              pj_ssl_start_connect_param *connect_param);
 
PJ_DECL(pj_status_t) pj_ssl_sock_renegotiate(pj_ssl_sock_t *ssock);
 
PJ_END_DECL
 
#endif  /* __PJ_SSL_SOCK_H__ */