2014-10-16 02:12:38 +02:00
|
|
|
// OpenVPN -- An application to securely tunnel IP networks
|
|
|
|
// over a single port, with support for SSL/TLS-based
|
|
|
|
// session authentication and key exchange,
|
|
|
|
// packet encryption, packet authentication, and
|
|
|
|
// packet compression.
|
|
|
|
//
|
2017-12-21 22:15:36 +01:00
|
|
|
// Copyright (C) 2012-2017 OpenVPN Inc.
|
2014-10-16 02:12:38 +02:00
|
|
|
//
|
|
|
|
// This program is free software: you can redistribute it and/or modify
|
2017-12-21 21:42:20 +01:00
|
|
|
// it under the terms of the GNU Affero General Public License Version 3
|
2014-10-16 02:12:38 +02:00
|
|
|
// as published by the Free Software Foundation.
|
|
|
|
//
|
|
|
|
// This program is distributed in the hope that it will be useful,
|
|
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
2017-12-21 21:42:20 +01:00
|
|
|
// GNU Affero General Public License for more details.
|
2014-10-16 02:12:38 +02:00
|
|
|
//
|
2017-12-21 21:42:20 +01:00
|
|
|
// You should have received a copy of the GNU Affero General Public License
|
2014-10-16 02:12:38 +02:00
|
|
|
// along with this program in the COPYING file.
|
|
|
|
// If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
|
|
// API for SSL implementations
|
|
|
|
|
|
|
|
#ifndef OPENVPN_SSL_SSLAPI_H
|
|
|
|
#define OPENVPN_SSL_SSLAPI_H
|
|
|
|
|
|
|
|
#include <string>
|
2017-12-06 09:01:33 +01:00
|
|
|
#include <cstdint>
|
2014-10-16 02:12:38 +02:00
|
|
|
|
2015-05-17 21:27:34 +02:00
|
|
|
#include <openvpn/common/size.hpp>
|
2015-02-01 05:51:25 +01:00
|
|
|
#include <openvpn/common/exception.hpp>
|
2014-10-16 02:12:38 +02:00
|
|
|
#include <openvpn/common/rc.hpp>
|
2015-02-01 05:51:25 +01:00
|
|
|
#include <openvpn/common/options.hpp>
|
|
|
|
#include <openvpn/common/mode.hpp>
|
2019-05-22 08:23:06 +02:00
|
|
|
#include <openvpn/common/jsonlib.hpp>
|
2014-10-16 02:12:38 +02:00
|
|
|
#include <openvpn/buffer/buffer.hpp>
|
2015-02-01 05:51:25 +01:00
|
|
|
#include <openvpn/frame/frame.hpp>
|
2015-01-08 23:33:48 +01:00
|
|
|
#include <openvpn/auth/authcert.hpp>
|
2015-02-01 05:51:25 +01:00
|
|
|
#include <openvpn/pki/epkibase.hpp>
|
2019-05-24 06:47:15 +02:00
|
|
|
#include <openvpn/pki/pktype.hpp>
|
2015-02-01 05:51:25 +01:00
|
|
|
#include <openvpn/ssl/kuparse.hpp>
|
|
|
|
#include <openvpn/ssl/nscert.hpp>
|
|
|
|
#include <openvpn/ssl/tlsver.hpp>
|
|
|
|
#include <openvpn/ssl/tls_remote.hpp>
|
2017-02-28 19:50:28 +01:00
|
|
|
#include <openvpn/ssl/tls_cert_profile.hpp>
|
2019-03-16 06:18:19 +01:00
|
|
|
#include <openvpn/ssl/sess_ticket.hpp>
|
2015-02-01 05:51:25 +01:00
|
|
|
#include <openvpn/random/randapi.hpp>
|
2014-10-16 02:12:38 +02:00
|
|
|
|
|
|
|
namespace openvpn {
|
|
|
|
|
2019-05-22 08:23:06 +02:00
|
|
|
class SNIHandlerBase;
|
|
|
|
|
2014-10-16 02:12:38 +02:00
|
|
|
class SSLAPI : public RC<thread_unsafe_refcount>
|
|
|
|
{
|
|
|
|
public:
|
2017-12-06 09:01:33 +01:00
|
|
|
|
|
|
|
enum TLSWarnings {
|
|
|
|
TLS_WARN_SIG_MD5 = (1 << 0),
|
2018-02-28 10:07:43 +01:00
|
|
|
TLS_WARN_NAME_CONSTRAINTS = (1 << 1)
|
2017-12-06 09:01:33 +01:00
|
|
|
};
|
|
|
|
|
2015-05-18 05:26:53 +02:00
|
|
|
typedef RCPtr<SSLAPI> Ptr;
|
2014-10-16 02:12:38 +02:00
|
|
|
|
|
|
|
virtual void start_handshake() = 0;
|
|
|
|
virtual ssize_t write_cleartext_unbuffered(const void *data, const size_t size) = 0;
|
|
|
|
virtual ssize_t read_cleartext(void *data, const size_t capacity) = 0;
|
|
|
|
virtual bool read_cleartext_ready() const = 0;
|
|
|
|
virtual void write_ciphertext(const BufferPtr& buf) = 0;
|
2018-02-08 04:08:31 +01:00
|
|
|
virtual void write_ciphertext_unbuffered(const unsigned char *data, const size_t size) = 0;
|
2014-10-16 02:12:38 +02:00
|
|
|
virtual bool read_ciphertext_ready() const = 0;
|
|
|
|
virtual BufferPtr read_ciphertext() = 0;
|
|
|
|
virtual std::string ssl_handshake_details() const = 0;
|
2019-05-03 15:48:13 +02:00
|
|
|
virtual bool did_full_handshake() = 0;
|
2019-05-29 07:25:33 +02:00
|
|
|
virtual const AuthCert::Ptr& auth_cert() const = 0;
|
2019-03-16 06:18:19 +01:00
|
|
|
virtual void mark_no_cache() = 0; // prevent caching of client-side session (only meaningful when client_session_tickets is enabled)
|
2017-12-06 09:01:33 +01:00
|
|
|
uint32_t get_tls_warnings() const
|
|
|
|
{
|
|
|
|
return tls_warnings;
|
|
|
|
}
|
|
|
|
protected:
|
|
|
|
uint32_t tls_warnings = 0; // bitfield of SSLAPI::TLSWarnings
|
2014-10-16 02:12:38 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
class SSLFactoryAPI : public RC<thread_unsafe_refcount>
|
|
|
|
{
|
|
|
|
public:
|
2015-02-01 05:51:25 +01:00
|
|
|
OPENVPN_EXCEPTION(ssl_options_error);
|
|
|
|
OPENVPN_EXCEPTION(ssl_context_error);
|
|
|
|
OPENVPN_EXCEPTION(ssl_external_pki);
|
|
|
|
OPENVPN_SIMPLE_EXCEPTION(ssl_ciphertext_in_overflow);
|
|
|
|
|
2015-05-18 05:26:53 +02:00
|
|
|
typedef RCPtr<SSLFactoryAPI> Ptr;
|
2014-10-16 02:12:38 +02:00
|
|
|
|
|
|
|
// create a new SSLAPI instance
|
|
|
|
virtual SSLAPI::Ptr ssl() = 0;
|
|
|
|
|
2019-03-16 06:18:19 +01:00
|
|
|
// like ssl() above but optionally verify hostname against cert CommonName and/or
|
|
|
|
// SubjectAltName, and optionally set/lookup a cache key for this session.
|
|
|
|
virtual SSLAPI::Ptr ssl(const std::string* hostname, const std::string* cache_key) = 0;
|
2014-10-16 02:12:38 +02:00
|
|
|
|
|
|
|
// client or server?
|
|
|
|
virtual const Mode& mode() const = 0;
|
|
|
|
};
|
2015-02-01 05:51:25 +01:00
|
|
|
|
|
|
|
class SSLConfigAPI : public RC<thread_unsafe_refcount>
|
|
|
|
{
|
|
|
|
public:
|
2015-05-18 05:26:53 +02:00
|
|
|
typedef RCPtr<SSLConfigAPI> Ptr;
|
2015-02-01 05:51:25 +01:00
|
|
|
|
2015-02-10 23:50:25 +01:00
|
|
|
enum LoadFlags {
|
2018-02-28 10:07:43 +01:00
|
|
|
LF_PARSE_MODE = (1<<0),
|
2015-05-01 19:40:57 +02:00
|
|
|
LF_ALLOW_CLIENT_CERT_NOT_REQUIRED = (1<<1),
|
2018-02-28 10:07:43 +01:00
|
|
|
LF_RELAY_MODE = (1<<2), // look for "relay-ca" instead of "ca" directive
|
|
|
|
LF_ALLOW_NAME_CONSTRAINTS = (1<<3) // do not fail on Name Constraints ext and drop a warning to UI
|
2015-02-10 23:50:25 +01:00
|
|
|
};
|
|
|
|
|
2017-10-25 07:19:07 +02:00
|
|
|
std::string private_key_type_string() const
|
|
|
|
{
|
2019-05-24 06:47:15 +02:00
|
|
|
PKType::Type type = private_key_type();
|
2017-10-25 07:19:07 +02:00
|
|
|
|
|
|
|
switch (type)
|
|
|
|
{
|
2019-05-24 06:47:15 +02:00
|
|
|
case PKType::PK_NONE:
|
2017-10-25 07:19:07 +02:00
|
|
|
return "None";
|
2019-05-24 06:47:15 +02:00
|
|
|
case PKType::PK_DSA:
|
2018-06-25 12:37:17 +02:00
|
|
|
return "DSA";
|
2019-05-24 06:47:15 +02:00
|
|
|
case PKType::PK_RSA:
|
2017-10-25 07:19:07 +02:00
|
|
|
return "RSA";
|
2019-05-24 06:47:15 +02:00
|
|
|
case PKType::PK_EC:
|
2017-10-25 07:19:07 +02:00
|
|
|
return "EC";
|
2019-05-24 06:47:15 +02:00
|
|
|
case PKType::PK_ECDSA:
|
2017-10-25 07:19:07 +02:00
|
|
|
return "ECDSA";
|
2019-05-24 06:47:15 +02:00
|
|
|
case PKType::PK_UNKNOWN:
|
2017-10-25 07:19:07 +02:00
|
|
|
default:
|
|
|
|
return "Unknown";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-02-01 05:51:25 +01:00
|
|
|
virtual void set_mode(const Mode& mode_arg) = 0;
|
|
|
|
virtual const Mode& get_mode() const = 0;
|
|
|
|
virtual void set_external_pki_callback(ExternalPKIBase* external_pki_arg) = 0; // private key alternative
|
2019-03-16 06:18:19 +01:00
|
|
|
virtual void set_session_ticket_handler(TLSSessionTicketBase* session_ticket_handler) = 0; // server side
|
|
|
|
virtual void set_client_session_tickets(const bool v) = 0; // client side
|
2019-05-22 08:23:06 +02:00
|
|
|
virtual void set_sni_handler(SNIHandlerBase* sni_handler) = 0; // server side
|
2015-02-01 05:51:25 +01:00
|
|
|
virtual void set_private_key_password(const std::string& pwd) = 0;
|
|
|
|
virtual void load_ca(const std::string& ca_txt, bool strict) = 0;
|
|
|
|
virtual void load_crl(const std::string& crl_txt) = 0;
|
|
|
|
virtual void load_cert(const std::string& cert_txt) = 0;
|
|
|
|
virtual void load_cert(const std::string& cert_txt, const std::string& extra_certs_txt) = 0;
|
|
|
|
virtual void load_private_key(const std::string& key_txt) = 0;
|
|
|
|
virtual void load_dh(const std::string& dh_txt) = 0;
|
2017-10-08 05:32:44 +02:00
|
|
|
virtual std::string extract_ca() const = 0;
|
|
|
|
virtual std::string extract_crl() const = 0;
|
|
|
|
virtual std::string extract_cert() const = 0;
|
|
|
|
virtual std::vector<std::string> extract_extra_certs() const = 0;
|
|
|
|
virtual std::string extract_private_key() const = 0;
|
|
|
|
virtual std::string extract_dh() const = 0;
|
2019-05-24 06:47:15 +02:00
|
|
|
virtual PKType::Type private_key_type() const = 0;
|
2017-10-25 07:19:07 +02:00
|
|
|
virtual size_t private_key_length() const = 0;
|
2015-02-01 05:51:25 +01:00
|
|
|
virtual void set_frame(const Frame::Ptr& frame_arg) = 0;
|
|
|
|
virtual void set_debug_level(const int debug_level) = 0;
|
|
|
|
virtual void set_flags(const unsigned int flags_arg) = 0;
|
|
|
|
virtual void set_ns_cert_type(const NSCert::Type ns_cert_type_arg) = 0;
|
|
|
|
virtual void set_remote_cert_tls(const KUParse::TLSWebType wt) = 0;
|
|
|
|
virtual void set_tls_remote(const std::string& tls_remote_arg) = 0;
|
|
|
|
virtual void set_tls_version_min(const TLSVersion::Type tvm) = 0;
|
2015-02-05 04:29:43 +01:00
|
|
|
virtual void set_tls_version_min_override(const std::string& override) = 0;
|
2017-02-28 19:50:28 +01:00
|
|
|
virtual void set_tls_cert_profile(const TLSCertProfile::Type type) = 0;
|
|
|
|
virtual void set_tls_cert_profile_override(const std::string& override) = 0;
|
2015-02-01 05:51:25 +01:00
|
|
|
virtual void set_local_cert_enabled(const bool v) = 0;
|
|
|
|
virtual void set_force_aes_cbc_ciphersuites(const bool v) = 0;
|
2016-05-05 08:18:42 +02:00
|
|
|
virtual void set_x509_track(X509Track::ConfigSet x509_track_config_arg) = 0;
|
2015-02-01 05:51:25 +01:00
|
|
|
virtual void set_rng(const RandomAPI::Ptr& rng_arg) = 0;
|
2015-02-10 23:50:25 +01:00
|
|
|
virtual void load(const OptionList& opt, const unsigned int lflags) = 0;
|
2015-02-01 05:51:25 +01:00
|
|
|
|
2019-05-22 08:23:06 +02:00
|
|
|
#ifdef HAVE_JSON
|
2019-05-24 20:35:56 +02:00
|
|
|
virtual SSLConfigAPI::Ptr json_override(const Json::Value& root, const bool load_cert_key) const = 0;
|
2019-05-22 08:23:06 +02:00
|
|
|
#endif
|
|
|
|
|
2015-09-18 19:25:20 +02:00
|
|
|
virtual std::string validate_cert(const std::string& cert_txt) const = 0;
|
|
|
|
virtual std::string validate_cert_list(const std::string& certs_txt) const = 0;
|
|
|
|
virtual std::string validate_crl(const std::string& crl_txt) const = 0;
|
|
|
|
virtual std::string validate_private_key(const std::string& key_txt) const = 0;
|
|
|
|
virtual std::string validate_dh(const std::string& dh_txt) const = 0;
|
|
|
|
|
2015-02-01 05:51:25 +01:00
|
|
|
virtual SSLFactoryAPI::Ptr new_factory() = 0;
|
|
|
|
};
|
2014-10-16 02:12:38 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|