libfilezilla
Loading...
Searching...
No Matches
tls_info.hpp
Go to the documentation of this file.
1#ifndef LIBFILEZILLA_TLS_INFO_HEADER
2#define LIBFILEZILLA_TLS_INFO_HEADER
3
8#include "time.hpp"
9#include "tls_params.hpp"
10
11namespace fz {
12class logger_interface;
13
17class FZ_PUBLIC_SYMBOL x509_certificate final
18{
19public:
21 class subject_name final
22 {
23 public:
24 std::string name;
25 bool is_dns{};
26 };
27
28 x509_certificate() = default;
29 ~x509_certificate() noexcept = default;
30 x509_certificate(x509_certificate const&) = default;
31 x509_certificate(x509_certificate&&) noexcept = default;
32 x509_certificate& operator=(x509_certificate const&) = default;
33 x509_certificate& operator=(x509_certificate&&) noexcept = default;
34
36 std::vector<uint8_t> const& rawData,
37 fz::datetime const& activation_time, fz::datetime const& expiration_time,
38 std::string const& serial,
39 std::string const& pkalgoname, unsigned int bits,
40 std::string const& signalgoname,
41 std::string const& fingerprint_sha256,
42 std::string const& fingerprint_sha1,
43 std::string const& issuer,
44 std::string const& subject,
45 std::vector<subject_name> const& alt_subject_names,
46 bool const self_signed);
47
49 std::vector<uint8_t> && rawdata,
50 fz::datetime const& activation_time, fz::datetime const& expiration_time,
51 std::string const& serial,
52 std::string const& pkalgoname, unsigned int bits,
53 std::string const& signalgoname,
54 std::string const& fingerprint_sha256,
55 std::string const& fingerprint_sha1,
56 std::string const& issuer,
57 std::string const& subject,
58 std::vector<subject_name> && alt_subject_names,
59 bool const self_Signed);
60
61
63 std::vector<uint8_t> get_raw_data() const { return raw_cert_; }
64
65 fz::datetime const& get_activation_time() const { return activation_time_; }
66 fz::datetime const& get_expiration_time() const { return expiration_time_; }
67
68 std::string const& get_serial() const { return serial_; }
69
71 std::string const& get_pubkey_algorithm() const { return pkalgoname_; }
72
74 unsigned int get_pubkey_bits() const { return pkalgobits_; }
75
77 std::string const& get_signature_algorithm() const { return signalgoname_; }
78
80 std::string const& get_fingerprint_sha256() const { return fingerprint_sha256_; }
81
83 std::string const& get_fingerprint_sha1() const { return fingerprint_sha1_; }
84
89 std::string const& get_subject() const { return subject_; }
90
92 std::string const& get_issuer() const { return issuer_; }
93
95 std::vector<subject_name> const& get_alt_subject_names() const { return alt_subject_names_; }
96
97 explicit operator bool() const { return !raw_cert_.empty(); }
98
100 bool self_signed() const { return self_signed_; }
101
102private:
103 fz::datetime activation_time_;
104 fz::datetime expiration_time_;
105
106 std::vector<uint8_t> raw_cert_;
107
108 std::string serial_;
109 std::string pkalgoname_;
110 unsigned int pkalgobits_{};
111
112 std::string signalgoname_;
113
114 std::string fingerprint_sha256_;
115 std::string fingerprint_sha1_;
116
117 std::string issuer_;
118 std::string subject_;
119
120 std::vector<subject_name> alt_subject_names_;
121
122 bool self_signed_{};
123};
124
132std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates_file(native_string const& certsfile, bool pem, bool sort, logger_interface * logger = nullptr);
133std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates(std::string_view const& certdata, bool pem, bool sort, logger_interface * logger = nullptr);
134std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates(const_tls_param_ref cert, tls_data_format format, bool sort, logger_interface * logger = nullptr);
135
144native_string FZ_PUBLIC_SYMBOL check_certificate_status(std::string_view const& key, std::string_view const& certs, native_string const& password, bool pem = true);
145
163
173class FZ_PUBLIC_SYMBOL tls_session_info final
174{
175public:
176 tls_session_info() = default;
177 ~tls_session_info() = default;
178 tls_session_info(tls_session_info const&) = default;
179 tls_session_info(tls_session_info&&) noexcept = default;
180 tls_session_info& operator=(tls_session_info const&) = default;
181 tls_session_info& operator=(tls_session_info&&) noexcept = default;
182
183 tls_session_info(std::string const& host, unsigned int port,
184 std::string const& protocol,
185 std::string const& key_exchange,
186 std::string const& session_cipher,
187 std::string const& session_mac,
188 int algorithm_warnings,
189 std::vector<x509_certificate>&& peer_certificates,
190 std::vector<x509_certificate>&& system_trust_chain,
191 bool hostname_mismatch);
192
194 std::string const& get_host() const { return host_; }
195
197 unsigned int get_port() const { return port_; }
198
200 std::string const& get_session_cipher() const { return session_cipher_; }
201
203 std::string const& get_session_mac() const { return session_mac_; }
204
217 std::vector<fz::x509_certificate> const& get_certificates() const { return system_trust_chain_.empty() ? peer_certificates_ : system_trust_chain_; }
218
228 std::vector<fz::x509_certificate> const& get_peer_certificates() const { return peer_certificates_; }
229
231 std::string const& get_protocol() const { return protocol_; }
232
234 std::string const& get_key_exchange() const { return key_exchange_; }
235
236 enum algorithm_warnings_t
237 {
238 tlsver = 1,
239 cipher = 2,
240 mac = 4,
241 kex = 8
242 };
243
245 int get_algorithm_warnings() const { return algorithm_warnings_; }
246
249 bool system_trust() const { return !system_trust_chain_.empty(); }
250
252 bool mismatched_hostname() const { return hostname_mismatch_; }
253
254private:
255 std::string host_;
256 unsigned int port_{};
257
258 std::string protocol_;
259 std::string key_exchange_;
260 std::string session_cipher_;
261 std::string session_mac_;
262 int algorithm_warnings_{};
263
264 std::vector<x509_certificate> peer_certificates_;
265 std::vector<x509_certificate> system_trust_chain_;
266
267 bool hostname_mismatch_{};
268};
269}
270
271#endif
Represents a point of time in wallclock, tracking the timestamps accuracy/precision.
Definition time.hpp:41
Abstract interface for logging strings.
Definition logger.hpp:51
Information about a TLS session.
Definition tls_info.hpp:174
std::string const & get_session_cipher() const
The symmetric algorithm used to encrypt all exchanged application data.
Definition tls_info.hpp:200
unsigned int get_port() const
The server's port.
Definition tls_info.hpp:197
bool system_trust() const
Definition tls_info.hpp:249
bool mismatched_hostname() const
True if the hostname in the SANs does not match the requested hostname.
Definition tls_info.hpp:252
std::string const & get_key_exchange() const
Key exchange algorithm.
Definition tls_info.hpp:234
std::string const & get_host() const
The server's hostname used to connect.
Definition tls_info.hpp:194
std::vector< fz::x509_certificate > const & get_peer_certificates() const
The certificate chain sent by the peer.
Definition tls_info.hpp:228
int get_algorithm_warnings() const
Warnings about old algorithms used, which are considered weak.
Definition tls_info.hpp:245
std::vector< fz::x509_certificate > const & get_certificates() const
The server's certificate chain.
Definition tls_info.hpp:217
std::string const & get_session_mac() const
The MAC used for integrity-protect and authenticate the exchanged application data.
Definition tls_info.hpp:203
std::string const & get_protocol() const
TLS version.
Definition tls_info.hpp:231
A subject name, typically a DNS hostname.
Definition tls_info.hpp:22
Represents all relevant information of a X.509 certificate as used by TLS.
Definition tls_info.hpp:18
unsigned int get_pubkey_bits() const
The number of bits of the public key algorithm.
Definition tls_info.hpp:74
std::string const & get_subject() const
Gets the subject of the certificate as RDN as described in RFC4514.
Definition tls_info.hpp:89
bool self_signed() const
Indicates whether the certificate is self-signed.
Definition tls_info.hpp:100
std::string const & get_signature_algorithm() const
The algorithm used for signing, typically the public key algorithm combined with a hash.
Definition tls_info.hpp:77
std::string const & get_pubkey_algorithm() const
The public key algorithm used by the certificate.
Definition tls_info.hpp:71
std::vector< subject_name > const & get_alt_subject_names() const
Gets the alternative subject names (SANSs) of the certificated, usually hostnames.
Definition tls_info.hpp:95
std::string const & get_fingerprint_sha1() const
Gets fingerprint as hex-encoded sha1.
Definition tls_info.hpp:83
std::string const & get_fingerprint_sha256() const
Gets fingerprint as hex-encoded sha256.
Definition tls_info.hpp:80
std::string const & get_issuer() const
Gets the issuer of the certificate as RDN as described in RFC4514.
Definition tls_info.hpp:92
The namespace used by libfilezilla.
Definition apply.hpp:17
std::wstring native_string
A string in the system's native character type and encoding. Note: This typedef changes depending on...
Definition string.hpp:34
std::vector< x509_certificate > load_certificates_file(native_string const &certsfile, bool pem, bool sort, logger_interface *logger=nullptr)
Gets the certificate information for the certificates in the file.
native_string check_certificate_status(std::string_view const &key, std::string_view const &certs, native_string const &password, bool pem=true)
Checks that the key and certificates chain are valid and matching.
tls_data_format
The encoding type of a fz::tls_blob or the file pointed to by a fz::tls_filepath.
Definition tls_params.hpp:142
@ autodetect
The type will be detected automatically using an heuristic.
@ pem
The provided data is in PEM format.
native_string check_key_and_certs_status(const_tls_param_ref key, const_tls_param_ref certs, native_string const &password, tls_data_format format=tls_data_format::autodetect)
Checks that the key and certificates chain contained in the files are valid and matching.
basic_tls_param_variant< std::string_view const, native_string const &, std::string const & > const_tls_param_ref
Acts as a const lvalue reference to one of a fz::tls_blob, fz::tls_filepath or fz::tls_pkcs11url.
Definition tls_params.hpp:124
Assorted classes dealing with time.
Functions and classes to abstract away the type of different parameters to tls-related functions.