cSSLConfig.h

Go to the documentation of this file.

//
//
#ifndef _INC_cSSLConfig_H
#define _INC_cSSLConfig_H
#ifndef NO_PRAGMA_ONCE
#pragma once
#endif
 
#include "GraySSLInt.h"
#include "GrayLib/include/SSL/cSSLSession.h"
#include "GrayLib/include/SSL/cSSL.h"
#include "GrayLib/include/Key/cECPGroupPrefs.h"
#include "GrayLib/include/KeyEx/cKeyExDHM.h"
#include "GrayLib/include/Cert/cX509Crl.h"
#include "GrayLib/include/Cert/cX509Crt.h"
 
namespace GraySSL
{
        enum SSL_AUTHMODE_TYPE
        {
 
                SSL_AUTHMODE_NONE = 0,                  
                SSL_AUTHMODE_OPTIONAL = 1,              
                SSL_AUTHMODE_REQUIRED = 2,              
        };
 
        enum SSL_RENO_LEGACY_TYPE
        {
 
                SSL_RENO_LEGACY_NO_RENEGOTIATION = 0,
                SSL_RENO_LEGACY_ALLOW_RENEGOTIATION = 1,
                SSL_RENO_LEGACY_BREAK_HANDSHAKE = 2,
        };
 
        class GRAYSSL_LINK cSSLConfig : public cSSLSessionConfig, public cSSL
        {
 
        public:
 
                cRangeT<SSL_VERSION_TYPE> m_VerRange;           
 
                bool m_bExtendedMasterSecret;           
 
                IRandomNoise* m_pRandom;                                
 
                bool m_bAllowRC4;                                               
                const SSL_CipherSuite_t* m_pCipherSuiteList[SSL_VERSION_QTY];     
 
                cECPGroupPrefs m_ECPGroupsAllowed;              
 
                // extension RFC 7301 Application Layer Protocol Negotiation. 
                const char** m_ppAlpnList;                              
 
                bool m_bFallbackSCSV;              
 
                SSL_RENO_LEGACY_TYPE m_eRenoLegacyType; 
 
#if defined(USE_SSL_RENEGOTIATION)
                bool m_bRenegotiationEnable;                    
                int m_nRenegotiationMaxRecords;                 
                cSSLCtr m_renego_period;                                
#endif
 
#if defined(USE_SSL_SESSION_TICKETS)
                bool m_bUseSessionTickets;                
                TIMESECD_t m_nTicketLifeSeconds;          
#endif
 
                SSL_AUTHMODE_TYPE m_eAuthMode;                  
 
                // TODO Replace Cert validation scheme!
                IX509VerifyCert* m_pVerifyCert;                 
 
#if defined(USE_SSL_X509_CRT_PARSE)
                cRefPtr<cX509Crt> m_pCaChain;         
                cRefPtr<cX509Crl> m_pCaCrl;           
#endif
 
#if defined(USE_SSL_DHM)
                cBigUnsigned m_dhm_P;                   
                cBigInteger m_dhm_G;                    
#endif
 
        public:
                cSSLConfig();
                ~cSSLConfig();
 
                bool CheckOpts();
 
                void SetCipherSuiteList(const SSL_CipherSuite_t* ciphersuites, SSL_VERSION_TYPE v);
                void put_AllowRC4(bool bAllowRC4);
 
                bool IsECPGroupAllowed(const cECPGroup& grp) const;
 
                void put_AuthMode(SSL_AUTHMODE_TYPE eAuthMode)
                {
                        this->m_eAuthMode = eAuthMode;
                }
 
                void put_VerifyCert(IX509VerifyCert* pVerifyCert)
                {
                        m_pVerifyCert = pVerifyCert;
                }
 
                HRESULT VerifyCrt(cX509Crt* pCrt, const char* pszPeerCN, OUT X509_Verify_t& eVerifyResults) const;
 
                void put_RandomNoise(IRandomNoise* pRandom)
                {
                        this->m_pRandom = pRandom;
                }
 
                void put_EncryptThenMac(bool etm);
 
                void put_UseExtendedMasterSecret(bool ems);
 
                void put_VersionMin(SSL_VERSION_TYPE v);
                void put_VersionMax(SSL_VERSION_TYPE v);
 
                HRESULT put_MaxFragLenCode(SSL_MAX_FRAG_TYPE eMaxFragLenCode);
 
                void put_UseTruncatedHMAC(bool bTruncatedHMAC)
                {
                        m_bTruncatedHMAC = bTruncatedHMAC;
                }
 
                void put_RenoLegacyType(SSL_RENO_LEGACY_TYPE allow_legacy)
                {
                        //
                        //
                        //
 
                        this->m_eRenoLegacyType = allow_legacy;
                }
 
                void put_FallbackSCSV(bool fallback)
                {
                        this->m_bFallbackSCSV = fallback;
                }
 
                HRESULT put_AlpnProtocols(const char** ppAlpnList);
 
                const char* FindAlpn(const BYTE* pFind, StrLen_t nLenFind) const;
 
#if defined(USE_SSL_RENEGOTIATION)
                void put_RenegotiationEnable(bool enable_renegotiation)
                {
                        this->m_bRenegotiationEnable = enable_renegotiation;
                }
 
                void put_RenegotiationMaxRecords(int max_records)
                {
                        //
                        this->m_nRenegotiationMaxRecords = max_records;
                }
 
                void put_RenegotiationPeriod(cSSLCtr c)
                {
 
                        this->m_renego_period = c;
                }
#endif // USE_SSL_RENEGOTIATION
 
#if defined(USE_SSL_SESSION_TICKETS)
                void put_UseSessionTickets(bool bUseTickets)
                {
                        //
                        this->m_bUseSessionTickets = bUseTickets;
                }
 
                void put_SessionTicketLifetime(TIMESECD_t lifetime)
                {
                        this->m_nTicketLifeSeconds = lifetime;  // Seconds
                }
#endif // USE_SSL_SESSION_TICKETS
 
#if defined(USE_SSL_X509_CRT_PARSE)
                void SetCAChain(cX509Crt* pCaChain, cX509Crl* pCaCrl)
                {
                        this->m_pCaChain = pCaChain;
                        this->m_pCaCrl = pCaCrl;
                }
#endif // USE_SSL_X509_CRT_PARSE
 
#if defined(USE_SSL_DHM)
                HRESULT SetKeyExDHMParams(const char* dhm_P, const char* dhm_G);
                HRESULT SetKeyExDHMParams(cKeyExDHM* dhm_ctx);
#endif // USE_SSL_DHM
 
        };
}
 
#endif