cSSLSession.h

Go to the documentation of this file.

//
//
 
#ifndef _INC_cSSLSession_H
#define _INC_cSSLSession_H
#ifndef NO_PRAGMA_ONCE
#pragma once
#endif
 
#include "cSSLCipherSuite.h"
#include "../Cert/cX509Crt.h"
#include "GrayCore/include/cTimeInt.h"
 
namespace GrayLib
{
 
#pragma pack(push,1)
 
        class GRAYLIB_LINK CATTR_PACKED cSSLSessionBase1
        {
 
        public:
                BYTE m_Id[32];                  
                BYTE m_nIdSize;                 
 
                // Format Stuff.
                SSL_CipherSuite_TYPE m_eCipherSuite;         
                SSL_COMPRESS_TYPE m_eCompression;            
 
                // Payload stuff.
                BYTE m_MasterSecret[48];                                
                X509_Verify_t m_eVerifyResults;          
 
                TIMESEC_t m_TimeStamp;           
 
        public:
                cSSLSessionBase1() noexcept
                        : m_nIdSize(0)
                        , m_eCipherSuite(TLS_NULL_WITH_NULL_NULL)
                        , m_eCompression(SSL_COMPRESS_NULL)
                        , m_eVerifyResults(X509_VERIFY_INIT)
                        , m_TimeStamp(cTimeInt::GetTimeNow().GetTime())
                {
                        cMem::Zero(m_Id, sizeof(m_Id));
                        cMem::Zero(m_MasterSecret, sizeof(m_MasterSecret));
                }
 
                bool isIdValid() const noexcept
                {
                        return(m_nIdSize >= 16 && m_nIdSize <= sizeof(m_Id));
                }
 
                BYTE get_IdSize() const noexcept
                {
                        return m_nIdSize;
                }
 
                bool isMatchId(BYTE nIdSize, const BYTE* pId) const
                {
                        if (nIdSize != this->m_nIdSize || !isIdValid())
                                return false;
                        if (::memcmp(pId, this->m_Id, this->m_nIdSize) != 0)
                                return false;
                        return true;
                }
 
                bool isMatchId(const cSSLSessionBase1* pSession) const
                {
                        return isMatchId(pSession->m_nIdSize, pSession->m_Id);
                }
 
                bool isMatchHead(const cSSLSessionBase1* pSession) const
                {
                        if (pSession->m_eCipherSuite != this->m_eCipherSuite)
                                return false;
                        if (pSession->m_eCompression != this->m_eCompression)
                                return false;
                        return isMatchId(pSession);
                }
 
                void SetId(BYTE nIdSize, const BYTE* pId)
                {
                        BYTE nIdSizePrev = m_nIdSize;
                        if (nIdSize != 0)
                        {
                                ASSERT(nIdSize >= 16 && nIdSize <= sizeof(m_Id));
                                ::memcpy(m_Id, pId, nIdSize);
                        }
                        m_nIdSize = nIdSize;
                        if (nIdSize < nIdSizePrev)
                        {
                                ASSERT(nIdSizePrev >= 0 && nIdSizePrev <= sizeof(m_Id));
                                cMem::Zero(m_Id + nIdSize, nIdSizePrev - nIdSizePrev);
                        }
                }
 
                HRESULT SetIdRandom(IRandomNoise* pRandom)
                {
                        HRESULT hRes = pRandom->GetNoise(m_Id, sizeof(m_Id));
                        if (FAILED(hRes))
                                return FVE_E_FIPS_RNG_CHECK_FAILED;
                        m_nIdSize = sizeof(m_Id);
                        return S_OK;
                }
 
                void SetPayload1(const cSSLSessionBase1* pSession)
                {
                        // Partial copy.
                        ASSERT(isMatchId(pSession));
                        ::memcpy(m_MasterSecret, pSession->m_MasterSecret, sizeof(m_MasterSecret));
                        m_eVerifyResults = pSession->m_eVerifyResults;
                }
                void SetPayload2(const cSSLSessionBase1* pSession)
                {
                        // Copy all.
                        m_eCipherSuite = pSession->m_eCipherSuite;
                        m_eCompression = pSession->m_eCompression;
                        m_nIdSize = pSession->m_nIdSize;
                        ASSERT(m_nIdSize <= sizeof(m_Id));
                        ::memcpy(m_Id, pSession->m_Id, m_nIdSize);
                        SetPayload1(pSession);
                }
 
                void SetZeroSession()
                {
                        cMem::ZeroSecure(this, sizeof(*this));
                }
        };
 
        class GRAYLIB_LINK CATTR_PACKED cSSLSessionConfig
        {
 
        public:
                SSL_MAX_FRAG_TYPE m_eMaxFragLenCode;    
                bool m_bEncryptThenMac;                                 
                bool m_bTruncatedHMAC;                  
 
        public:
                cSSLSessionConfig() noexcept
                        : m_eMaxFragLenCode(SSL_MAX_FRAG_LEN_NONE)
                        , m_bEncryptThenMac(true)      
                        , m_bTruncatedHMAC(true)        // for server?
                {
                }
        };
 
        class GRAYLIB_LINK CATTR_PACKED cSSLSessionBase2 : public cSSLSessionBase1, public cSSLSessionConfig
        {
 
                typedef cSSLSessionBase1 SUPER_t;
 
                // TODO VERSION Stamp !!
 
        public:
                cSSLSessionBase2() noexcept
                {
                }
                void SetZeroSession() noexcept
                {
                        cMem::ZeroSecure(this, sizeof(*this));
                }
        };
 
#pragma pack(pop)
 
        class GRAYLIB_LINK cSSLSession : public cSSLSessionBase2 // : public cRefBase
        {
 
                typedef cSSLSessionBase2 SUPER_t;
 
        public:
                cRefPtr<cX509Crt> m_pPeerCert;        
                cHeapBlock m_Ticket;                                    
 
        public:
                cSSLSession();
                ~cSSLSession();
 
                void SetZeroSession();
 
                size_t WriteSession(BYTE* buf, size_t buf_len) const;
                HRESULT ReadSession(const BYTE* buf, size_t len);
        };
 
        class cSSLSessionEntry; // store cSSLSessionBase1 with PeerCert cX509Crt
 
        class GRAYLIB_LINK cSSLSessionCache
        {
 
        public:
                cSSLSessionEntry* m_pChain;     
                TIMESECD_t m_nTimeout;          
                int m_nMaxEntries;                              
                cThreadLockMutex m_Mutex;               
 
        public:
                cSSLSessionCache();
                virtual ~cSSLSessionCache();
 
                void put_CacheMaxEntries(int nMaxEntries);
                void put_CacheTimeout(TIMESECD_t nTimeout);
 
                virtual bool RestoreFromCache(cSSLSession* pSession);
                virtual HRESULT AddToCache(const cSSLSession* pSession);
        };
}
#endif