cSSLCommon.h

Go to the documentation of this file.

//
//
#ifndef _INC_cSSLCommon_H
#define _INC_cSSLCommon_H
#ifndef NO_PRAGMA_ONCE
#pragma once
#endif
#include "cSSLConfig.h"
#include "cSSLHandshake.h"
#include "cSSLTransform.h"
#include "cSSLDebug.h"
 
#include "GrayLib/include/Cert/cX509Crl.h"
#include "GrayLib/include/Cipher/cCipherAES.h"  // for session tickets
#include "GrayLib/include/Math/cBigInteger.h"
#if defined(USE_Key_EC)
#include "GrayLib/include/Key/cKeyECPPair.h"
#endif
#include "GrayCore/include/cLogLevel.h"
#include "GrayCore/include/cMem.h"
 
// aggregate config for convenience 
#if defined(USE_SSL_KeyExchange_PSK) ||      \
        defined(USE_SSL_KeyExchange_RSA_PSK) ||  \
        defined(USE_SSL_KeyExchange_DHE_PSK) ||  \
        defined(USE_SSL_KeyExchange_ECDHE_PSK)
#define USE_SSL_KeyExchange_PSK_SOME
#endif
 
#if defined(USE_SSL_KeyExchange_ECDHE_RSA) ||         \
        defined(USE_SSL_KeyExchange_ECDHE_ECDSA) ||       \
        defined(USE_SSL_KeyExchange_ECDHE_PSK)
#define USE_SSL_KeyExchange_ECDHE_SOME
#endif
 
#if defined(USE_SSL_KeyExchange_RSA)          || \
        defined(USE_SSL_KeyExchange_DHE_RSA)      || \
        defined(USE_SSL_KeyExchange_ECDHE_RSA)    || \
        defined(USE_SSL_KeyExchange_ECDHE_ECDSA)  || \
        defined(USE_SSL_KeyExchange_RSA_PSK)      || \
        defined(USE_SSL_KeyExchange_ECDHE_PSK)    || \
        defined(USE_SSL_KeyExchange_ECDH_RSA)     || \
        defined(USE_SSL_KeyExchange_ECDH_ECDSA)
#define USE_SSL_KeyExchange_Cert_SOME           // NOT SSL_KeyExchange_PSK or SSL_KeyExchange_DHE_PSK
#endif
 
namespace GraySSL
{
        enum SSL_RENEGOTIATION_TYPE
        {
                SSL_INITIAL_HANDSHAKE = 0,      // Normal first handshake.
                SSL_RENEGOTIATION = 1,   // In progress
                SSL_RENEGOTIATION_DONE = 2,   // Done
                SSL_RENEGOTIATION_PENDING = 3,   // Requested (server only)
        };
 
        class GRAYSSL_LINK cSSLCommon : public cStream, public cSSL
        {
 
        public:
                const cObjectSignature<> m_SigCommon;   
                const bool m_bThisIsServer;                             
                const cSSLConfig& m_Cfg;                                
 
        private:
                SSL_STATE_TYPE m_eState;                                
 
        public:
                SSL_VERSION_TYPE m_nVer;                                
 
                cStreamInput* m_pReader;                                
                cStreamOutput* m_pWriter;                               
 
                bool m_bRenegotiationSupported;                 
#if defined(USE_SSL_RENEGOTIATION)
                SSL_RENEGOTIATION_TYPE m_eRenegotiation;                
                int m_nRenegoRecordsSeen;                               
#endif
 
                cSSLHandshake* m_pHandshake;                    
 
                // Session layer
                cSSLSession* m_pSessionNegotiate;     
                cSSLSession* m_pSessionCur;           
                cSSLSession* m_pSessionIn;            
                cSSLSession* m_pSessionOut;           
 
                // Record layer transformations
                cSSLTransform* m_pTransformNegotiate; 
                cSSLTransform* m_pTransformCur;       
                cSSLTransform* m_pTransformIn;        
                cSSLTransform* m_pTransformOut;       
 
                // Record layer (incoming data)
                cSSLMsgBuilder m_in;            //  (in_iv+ivlen)
                size_t m_nInReadPos;            
 
                // Record layer (outgoing data)
                cSSLMsgBuilder m_out;                                   
 
                int m_nEmptyMessages;                                   
 
                // User settings
                bool m_bClientAuth;                                             
                X509_Verify_t m_eVerifyResults;         
 
                const char* m_pszAlpnChosen;                    
 
#if defined(USE_SSL_KeyExchange_PSK_SOME)
                // PSK values
                cHeapBlock m_PSK;               // k_PSK_Size_Max
                cHeapBlock m_PSKIdentity;
#endif
 
#if defined(USE_SSL_VER_SSL_3)
                static const int k_VERIFY_DATA_MAX_LEN = 36;            
#else
                static const int k_VERIFY_DATA_MAX_LEN = 12;            
#endif
 
#if defined(USE_SSL_RENEGOTIATION)
                BYTE m_VerifyDataOwn[k_VERIFY_DATA_MAX_LEN]; 
#endif
 
                size_t m_nVerifyDataSize;             
                BYTE m_VerifyDataPeer[k_VERIFY_DATA_MAX_LEN]; 
 
#if defined(USE_SSL_CBC_RECORD_SPLITTING)
                BITOP_TYPE m_nCBCRecordSplitOp;                 
#endif
 
#if defined(USE_SSL_X509_CRT_PARSE)
                cX509KeyCrtPair* m_pKeyCrtPair;            
                const char* m_pszPeerCN;                                
#endif // USE_SSL_X509_CRT_PARSE
 
        protected:
                cSSLCommon(bool bEndpointIsServer, const cSSLConfig& rOpts) noexcept;
                virtual ~cSSLCommon();
 
                HRESULT ReturnError(HRESULT hRes, const char* pszMsg) const;
 
                SSL_STATE_TYPE get_State() const noexcept
                {
                        return m_eState;
                }
                void put_State(SSL_STATE_TYPE e) noexcept
                {
                        m_eState = e;;
                }
                void IncState1(SSL_STATE_TYPE e) 
                {
                        m_eState = (SSL_STATE_TYPE)(m_eState + 1);
                        ASSERT(m_eState == e);
                }
 
        public:
                HRESULT InitSSL();
                void state_SSL_HANDSHAKE_WRAPUP();
 
                void AttachStreams(cStreamInput* pReader, cStreamOutput* pWriter) noexcept
                {
                        this->m_pReader = pReader;
                        this->m_pWriter = pWriter;
                }
 
                virtual void SetSessionClear();
 
                HRESULT write_SSL_MSG_ALERT(SSL_ALERT_LEVEL_TYPE level, SSL_ALERT_TYPE message);
 
                const char* get_AlpnChosen() const noexcept
                {
                        return this->m_pszAlpnChosen;
                }
 
                bool isStateHandshake() const noexcept
                {
                        return m_eState < SSL_HANDSHAKE_COMPLETE;
                }
 
                HRESULT Handshake(bool bWait = false);
 
 
                virtual HRESULT ProcessStreamPacket() = 0;      // virtual entry point.
 
                HRESULT WriteMsgApp(const BYTE* buf, size_t len);
 
        protected:
                HRESULT WriteFlush(bool bWait = false);
                HRESULT WriteMsg(SSL_MSG_TYPE eMsg, size_t nContLength);
 
                HRESULT ReadFill(size_t nSizeExpect);
                HRESULT ReadCheckHandshake();
                HRESULT ReadMessage();
                HRESULT ReadProcessCompleteMsg();
 
                HRESULT PrepareKeys();
 
        public:
#if defined(USE_SSL_CBC_RECORD_SPLITTING)
                void put_CBCRecordSplitOp(BITOP_TYPE split);
#endif // USE_SSL_CBC_RECORD_SPLITTING
 
                X509_Verify_t get_VerifyResults() const;
 
                const char* get_CipherSuiteStr() const;
 
                const char* get_VersionStr() const;
 
#if defined(USE_SSL_X509_CRT_PARSE)
                cRefPtr<cX509Crt> get_PeerCert() const;
#endif // USE_SSL_X509_CRT_PARSE
 
                bool isRenegotiation() const noexcept
                {
#if defined(USE_SSL_RENEGOTIATION)
                        return m_eRenegotiation != SSL_INITIAL_HANDSHAKE;
#else
                        return false;
#endif
                }
 
#if defined(USE_SSL_RENEGOTIATION)
                HRESULT RenegotiationHandshake();
 
                //
                HRESULT RenegotiationStart();
                HRESULT RenegotiationTest();
 
#endif // USE_SSL_RENEGOTIATION
 
                //
                virtual STREAM_POS_t GetLength() const override;
 
                //
                virtual HRESULT ReadX(OUT void* pData, size_t nDataSize) override;
 
                virtual size_t SetSeekSizeMin(size_t nSizeMin = k_FILE_BLOCK_SIZE) override;
                virtual STREAM_SEEKRET_t Seek(STREAM_OFFSET_t iOffset, SEEK_ORIGIN_TYPE eSeekOrigin = SEEK_Set) override;
 
                //
                //
                //
                //
                virtual HRESULT WriteX(const void* pData, size_t nDataSize) override;
 
                HRESULT write_SSL_ALERT_SSL3_CLOSE_NOTIFY();
 
                HRESULT write_SSL_ALERT_SSL3_HANDSHAKE_FAILURE();
 
                size_t build_TLS_EXT_MaxFragmentLength(cSSLMsgHandExt* pExt, SSL_MAX_FRAG_TYPE eMaxFrag);
 
                HRESULT state_SSL_XXX_CERTIFICATE_r();
                HRESULT state_SSL_XXX_CERTIFICATE_w();
 
                HRESULT state_SSL_XXX_CHANGE_CIPHER_SPEC_r();
                HRESULT state_SSL_XXX_CHANGE_CIPHER_SPEC_w();
 
                HRESULT state_SSL_XXX_FINISHED_r();
                HRESULT state_SSL_XXX_FINISHED_w();
 
                HRESULT InitHandshakeParams();
 
#if defined(USE_SSL_KeyExchange_PSK_SOME)
                HRESULT BuildKeyExPremasterPSK(SSL_KeyExchange_TYPE key_ex);
#endif
 
#if defined(USE_SSL_X509_CRT_PARSE)
                inline cKeyWrap* get_OwnKeyPriv() const noexcept
                {
                        return this->m_pHandshake->m_pKeyCrtHand == nullptr ? nullptr : &(this->m_pHandshake->m_pKeyCrtHand->m_KeyPriv) ;
                }
                inline cX509Crt* get_OwnCert() const noexcept
                {
                        return this->m_pHandshake->m_pKeyCrtHand == nullptr ? nullptr : this->m_pHandshake->m_pKeyCrtHand->m_pCert ;
                }
#endif
 
#if defined(USE_SSL_RENEGOTIATION) && defined(USE_SSL_SERVER)
                HRESULT write_SSL_HS_HELLO_REQUEST();
#endif
 
        };
}
#endif // _INC_SSL_H