libfilezilla
Loading...
Searching...
No Matches
tls_info.hpp
Go to the documentation of this file.
1#ifndef LIBFILEZILLA_TLS_INFO_HEADER
2#define LIBFILEZILLA_TLS_INFO_HEADER
3
8#include "time.hpp"
9#include "tls_params.hpp"
10
11namespace fz {
12class logger_interface;
13
17class FZ_PUBLIC_SYMBOL x509_certificate final
18{
19public:
21 class subject_name final
22 {
23 public:
24 std::string name;
25 bool is_dns{};
26 };
27
28 x509_certificate() = default;
29 ~x509_certificate() noexcept = default;
30 x509_certificate(x509_certificate const&) = default;
31 x509_certificate(x509_certificate&&) noexcept = default;
32 x509_certificate& operator=(x509_certificate const&) = default;
33 x509_certificate& operator=(x509_certificate&&) noexcept = default;
34
36 std::vector<uint8_t> const& rawData,
37 fz::datetime const& activation_time, fz::datetime const& expiration_time,
38 std::string const& serial,
39 std::string const& pkalgoname, unsigned int bits,
40 std::string const& signalgoname,
41 std::string const& fingerprint_sha256,
42 std::string const& fingerprint_sha1,
43 std::string const& issuer,
44 std::string const& subject,
45 std::vector<subject_name> const& alt_subject_names,
46 bool const self_signed);
47
49 std::vector<uint8_t> && rawdata,
50 fz::datetime const& activation_time, fz::datetime const& expiration_time,
51 std::string const& serial,
52 std::string const& pkalgoname, unsigned int bits,
53 std::string const& signalgoname,
54 std::string const& fingerprint_sha256,
55 std::string const& fingerprint_sha1,
56 std::string const& issuer,
57 std::string const& subject,
58 std::vector<subject_name> && alt_subject_names,
59 bool const self_Signed);
60
61
63 std::vector<uint8_t> get_raw_data() const { return raw_cert_; }
64
65 fz::datetime const& get_activation_time() const { return activation_time_; }
66 fz::datetime const& get_expiration_time() const { return expiration_time_; }
67
68 std::string const& get_serial() const { return serial_; }
69
71 std::string const& get_pubkey_algorithm() const { return pkalgoname_; }
72
74 unsigned int get_pubkey_bits() const { return pkalgobits_; }
75
77 std::string const& get_signature_algorithm() const { return signalgoname_; }
78
80 std::string const& get_fingerprint_sha256() const { return fingerprint_sha256_; }
81
83 std::string const& get_fingerprint_sha1() const { return fingerprint_sha1_; }
84
89 std::string const& get_subject() const { return subject_; }
90
92 std::string const& get_issuer() const { return issuer_; }
93
95 std::vector<subject_name> const& get_alt_subject_names() const { return alt_subject_names_; }
96
97 explicit operator bool() const { return !raw_cert_.empty(); }
98
100 bool self_signed() const { return self_signed_; }
101
102private:
103 fz::datetime activation_time_;
104 fz::datetime expiration_time_;
105
106 std::vector<uint8_t> raw_cert_;
107
108 std::string serial_;
109 std::string pkalgoname_;
110 unsigned int pkalgobits_{};
111
112 std::string signalgoname_;
113
114 std::string fingerprint_sha256_;
115 std::string fingerprint_sha1_;
116
117 std::string issuer_;
118 std::string subject_;
119
120 std::vector<subject_name> alt_subject_names_;
121
122 bool self_signed_{};
123};
124
132std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates_file(native_string const& certsfile, bool pem, bool sort, logger_interface * logger = nullptr);
133std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates(std::string_view const& certdata, bool pem, bool sort, logger_interface * logger = nullptr);
134std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates(const_tls_param_ref cert, tls_data_format format, bool sort, logger_interface * logger = nullptr);
135
144native_string FZ_PUBLIC_SYMBOL check_certificate_status(std::string_view const& key, std::string_view const& certs, native_string const& password, bool pem = true);
145
163
173class FZ_PUBLIC_SYMBOL tls_session_info final
174{
175public:
176 tls_session_info() = default;
177 ~tls_session_info() = default;
178 tls_session_info(tls_session_info const&) = default;
179 tls_session_info(tls_session_info&&) noexcept = default;
180 tls_session_info& operator=(tls_session_info const&) = default;
181 tls_session_info& operator=(tls_session_info&&) noexcept = default;
182
183 tls_session_info(std::string const& host, unsigned int port,
184 std::string const& protocol,
185 std::string const& key_exchange,
186 std::string const& session_cipher,
187 std::string const& session_mac,
188 int algorithm_warnings,
189 std::vector<x509_certificate>&& peer_certificates,
190 std::vector<x509_certificate>&& system_trust_chain,
191 bool hostname_mismatch);
192
194 std::string const& get_host() const { return host_; }
195
197 unsigned int get_port() const { return port_; }
198
200 std::string const& get_session_cipher() const { return session_cipher_; }
201
203 std::string const& get_session_mac() const { return session_mac_; }
204
217 std::vector<fz::x509_certificate> const& get_certificates() const { return system_trust_chain_.empty() ? peer_certificates_ : system_trust_chain_; }
218
228 std::vector<fz::x509_certificate> const& get_peer_certificates() const { return peer_certificates_; }
229
231 std::string const& get_protocol() const { return protocol_; }
232
234 std::string const& get_key_exchange() const { return key_exchange_; }
235
236 enum algorithm_warnings_t
237 {
238 tlsver = 1,
239 cipher = 2,
240 mac = 4,
241 kex = 8
242 };
243
245 int get_algorithm_warnings() const { return algorithm_warnings_; }
246
249 bool system_trust() const { return !system_trust_chain_.empty(); }
250
252 bool mismatched_hostname() const { return hostname_mismatch_; }
253
254private:
255 std::string host_;
256 unsigned int port_{};
257
258 std::string protocol_;
259 std::string key_exchange_;
260 std::string session_cipher_;
261 std::string session_mac_;
262 int algorithm_warnings_{};
263
264 std::vector<x509_certificate> peer_certificates_;
265 std::vector<x509_certificate> system_trust_chain_;
266
267 bool hostname_mismatch_{};
268};
269}
270
271#endif
Represents a point of time in wallclock, tracking the timestamps accuracy/precision.
Definition time.hpp:41
Abstract interface for logging strings.
Definition logger.hpp:51
Information about a TLS session.
Definition tls_info.hpp:174
std::string const & get_session_cipher() const
The symmetric algorithm used to encrypt all exchanged application data.
Definition tls_info.hpp:200
unsigned int get_port() const
The server's port.
Definition tls_info.hpp:197
bool system_trust() const
Definition tls_info.hpp:249
bool mismatched_hostname() const
True if the hostname in the SANs does not match the requested hostname.
Definition tls_info.hpp:252
std::string const & get_key_exchange() const
Key exchange algorithm.
Definition tls_info.hpp:234
std::string const & get_host() const
The server's hostname used to connect.
Definition tls_info.hpp:194
std::vector< fz::x509_certificate > const & get_peer_certificates() const
The certificate chain sent by the peer.
Definition tls_info.hpp:228
int get_algorithm_warnings() const
Warnings about old algorithms used, which are considered weak.
Definition tls_info.hpp:245
std::vector< fz::x509_certificate > const & get_certificates() const
The server's certificate chain.
Definition tls_info.hpp:217
std::string const & get_session_mac() const
The MAC used for integrity-protect and authenticate the exchanged application data.
Definition tls_info.hpp:203
std::string const & get_protocol() const
TLS version.
Definition tls_info.hpp:231
A subject name, typically a DNS hostname.
Definition tls_info.hpp:22
Represents all relevant information of a X.509 certificate as used by TLS.
Definition tls_info.hpp:18
unsigned int get_pubkey_bits() const
The number of bits of the public key algorithm.
Definition tls_info.hpp:74
std::string const & get_subject() const
Gets the subject of the certificate as RDN as described in RFC4514.
Definition tls_info.hpp:89
bool self_signed() const
Indicates whether the certificate is self-signed.
Definition tls_info.hpp:100
std::string const & get_signature_algorithm() const
The algorithm used for signing, typically the public key algorithm combined with a hash.
Definition tls_info.hpp:77
std::string const & get_pubkey_algorithm() const
The public key algorithm used by the certificate.
Definition tls_info.hpp:71
std::vector< subject_name > const & get_alt_subject_names() const
Gets the alternative subject names (SANSs) of the certificated, usually hostnames.
Definition tls_info.hpp:95
std::string const & get_fingerprint_sha1() const
Gets fingerprint as hex-encoded sha1.
Definition tls_info.hpp:83
std::string const & get_fingerprint_sha256() const
Gets fingerprint as hex-encoded sha256.
Definition tls_info.hpp:80
std::string const & get_issuer() const
Gets the issuer of the certificate as RDN as described in RFC4514.
Definition tls_info.hpp:92
The namespace used by libfilezilla.
Definition apply.hpp:17
std::wstring native_string
A string in the system's native character type and encoding. Note: This typedef changes depending on...
Definition string.hpp:34
std::vector< x509_certificate > load_certificates_file(native_string const &certsfile, bool pem, bool sort, logger_interface *logger=nullptr)
Gets the certificate information for the certificates in the file.
native_string check_certificate_status(std::string_view const &key, std::string_view const &certs, native_string const &password, bool pem=true)
Checks that the key and certificates chain are valid and matching.
basic_tls_param_variant< std::string_view const, native_string const &, std::string const & > const_tls_param_ref
Acts as a const lvalue reference to one of a fz::tls_blob, fz::tls_filepath or fz::tls_pkcs11url.
Definition tls_params.hpp:120
tls_data_format
The encoding type of a fz::tls_blob or the file pointed to by a fz::tls_filepath.
Definition tls_params.hpp:142
@ autodetect
The type will be detected automatically using an heuristic.
@ pem
The provided data is in PEM format.
native_string check_key_and_certs_status(const_tls_param_ref key, const_tls_param_ref certs, native_string const &password, tls_data_format format=tls_data_format::autodetect)
Checks that the key and certificates chain contained in the files are valid and matching.
Assorted classes dealing with time.
Functions and classes to abstract away the type of different parameters to tls-related functions.