libfilezilla
tls_info.hpp
Go to the documentation of this file.
1 #ifndef LIBFILEZILLA_TLS_INFO_HEADER
2 #define LIBFILEZILLA_TLS_INFO_HEADER
3 
8 #include "time.hpp"
9 #include "tls_params.hpp"
10 
11 namespace fz {
12 class logger_interface;
13 
17 class FZ_PUBLIC_SYMBOL x509_certificate final
18 {
19 public:
21  class subject_name final
22  {
23  public:
24  std::string name;
25  bool is_dns{};
26  };
27 
28  x509_certificate() = default;
29  ~x509_certificate() noexcept = default;
30  x509_certificate(x509_certificate const&) = default;
31  x509_certificate(x509_certificate&&) noexcept = default;
32  x509_certificate& operator=(x509_certificate const&) = default;
33  x509_certificate& operator=(x509_certificate&&) noexcept = default;
34 
36  std::vector<uint8_t> const& rawData,
37  fz::datetime const& activation_time, fz::datetime const& expiration_time,
38  std::string const& serial,
39  std::string const& pkalgoname, unsigned int bits,
40  std::string const& signalgoname,
41  std::string const& fingerprint_sha256,
42  std::string const& fingerprint_sha1,
43  std::string const& issuer,
44  std::string const& subject,
45  std::vector<subject_name> const& alt_subject_names,
46  bool const self_signed);
47 
49  std::vector<uint8_t> && rawdata,
50  fz::datetime const& activation_time, fz::datetime const& expiration_time,
51  std::string const& serial,
52  std::string const& pkalgoname, unsigned int bits,
53  std::string const& signalgoname,
54  std::string const& fingerprint_sha256,
55  std::string const& fingerprint_sha1,
56  std::string const& issuer,
57  std::string const& subject,
58  std::vector<subject_name> && alt_subject_names,
59  bool const self_Signed);
60 
61 
63  std::vector<uint8_t> get_raw_data() const { return raw_cert_; }
64 
65  fz::datetime const& get_activation_time() const { return activation_time_; }
66  fz::datetime const& get_expiration_time() const { return expiration_time_; }
67 
68  std::string const& get_serial() const { return serial_; }
69 
71  std::string const& get_pubkey_algorithm() const { return pkalgoname_; }
72 
74  unsigned int get_pubkey_bits() const { return pkalgobits_; }
75 
77  std::string const& get_signature_algorithm() const { return signalgoname_; }
78 
80  std::string const& get_fingerprint_sha256() const { return fingerprint_sha256_; }
81 
83  std::string const& get_fingerprint_sha1() const { return fingerprint_sha1_; }
84 
89  std::string const& get_subject() const { return subject_; }
90 
92  std::string const& get_issuer() const { return issuer_; }
93 
95  std::vector<subject_name> const& get_alt_subject_names() const { return alt_subject_names_; }
96 
97  explicit operator bool() const { return !raw_cert_.empty(); }
98 
100  bool self_signed() const { return self_signed_; }
101 
102 private:
103  fz::datetime activation_time_;
104  fz::datetime expiration_time_;
105 
106  std::vector<uint8_t> raw_cert_;
107 
108  std::string serial_;
109  std::string pkalgoname_;
110  unsigned int pkalgobits_{};
111 
112  std::string signalgoname_;
113 
114  std::string fingerprint_sha256_;
115  std::string fingerprint_sha1_;
116 
117  std::string issuer_;
118  std::string subject_;
119 
120  std::vector<subject_name> alt_subject_names_;
121 
122  bool self_signed_{};
123 };
124 
132 std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates_file(native_string const& certsfile, bool pem, bool sort, logger_interface * logger = nullptr);
133 std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates(std::string_view const& certdata, bool pem, bool sort, logger_interface * logger = nullptr);
134 std::vector<x509_certificate> FZ_PUBLIC_SYMBOL load_certificates(const_tls_param_ref cert, tls_data_format format, bool sort, logger_interface * logger = nullptr);
135 
144 native_string FZ_PUBLIC_SYMBOL check_certificate_status(std::string_view const& key, std::string_view const& certs, native_string const& password, bool pem = true);
145 
163 
173 class FZ_PUBLIC_SYMBOL tls_session_info final
174 {
175 public:
176  tls_session_info() = default;
177  ~tls_session_info() = default;
178  tls_session_info(tls_session_info const&) = default;
179  tls_session_info(tls_session_info&&) noexcept = default;
180  tls_session_info& operator=(tls_session_info const&) = default;
181  tls_session_info& operator=(tls_session_info&&) noexcept = default;
182 
183  tls_session_info(std::string const& host, unsigned int port,
184  std::string const& protocol,
185  std::string const& key_exchange,
186  std::string const& session_cipher,
187  std::string const& session_mac,
188  int algorithm_warnings,
189  std::vector<x509_certificate>&& peer_certificates,
190  std::vector<x509_certificate>&& system_trust_chain,
191  bool hostname_mismatch);
192 
194  std::string const& get_host() const { return host_; }
195 
197  unsigned int get_port() const { return port_; }
198 
200  std::string const& get_session_cipher() const { return session_cipher_; }
201 
203  std::string const& get_session_mac() const { return session_mac_; }
204 
217  std::vector<fz::x509_certificate> const& get_certificates() const { return system_trust_chain_.empty() ? peer_certificates_ : system_trust_chain_; }
218 
228  std::vector<fz::x509_certificate> const& get_peer_certificates() const { return peer_certificates_; }
229 
231  std::string const& get_protocol() const { return protocol_; }
232 
234  std::string const& get_key_exchange() const { return key_exchange_; }
235 
236  enum algorithm_warnings_t
237  {
238  tlsver = 1,
239  cipher = 2,
240  mac = 4,
241  kex = 8
242  };
243 
245  int get_algorithm_warnings() const { return algorithm_warnings_; }
246 
249  bool system_trust() const { return !system_trust_chain_.empty(); }
250 
252  bool mismatched_hostname() const { return hostname_mismatch_; }
253 
254 private:
255  std::string host_;
256  unsigned int port_{};
257 
258  std::string protocol_;
259  std::string key_exchange_;
260  std::string session_cipher_;
261  std::string session_mac_;
262  int algorithm_warnings_{};
263 
264  std::vector<x509_certificate> peer_certificates_;
265  std::vector<x509_certificate> system_trust_chain_;
266 
267  bool hostname_mismatch_{};
268 };
269 }
270 
271 #endif
Represents all relevant information of a X.509 certificate as used by TLS.
Definition: tls_info.hpp:17
std::string const & get_pubkey_algorithm() const
The public key algorithm used by the certificate.
Definition: tls_info.hpp:71
int get_algorithm_warnings() const
Warnings about old algorithms used, which are considered weak.
Definition: tls_info.hpp:245
std::string const & get_session_mac() const
The MAC used for integrity-protect and authenticate the exchanged application data.
Definition: tls_info.hpp:203
native_string check_key_and_certs_status(const_tls_param_ref key, const_tls_param_ref certs, native_string const &password, tls_data_format format=tls_data_format::autodetect)
Checks that the key and certificates chain contained in the files are valid and matching.
std::string const & get_signature_algorithm() const
The algorithm used for signing, typically the public key algorithm combined with a hash...
Definition: tls_info.hpp:77
std::string const & get_session_cipher() const
The symmetric algorithm used to encrypt all exchanged application data.
Definition: tls_info.hpp:200
std::vector< fz::x509_certificate > const & get_certificates() const
The server's certificate chain.
Definition: tls_info.hpp:217
native_string check_certificate_status(std::string_view const &key, std::string_view const &certs, native_string const &password, bool pem=true)
Checks that the key and certificates chain are valid and matching.
Information about a TLS session.
Definition: tls_info.hpp:173
unsigned int get_port() const
The server's port.
Definition: tls_info.hpp:197
Definition: impersonation.hpp:85
std::string const & get_fingerprint_sha256() const
Gets fingerprint as hex-encoded sha256.
Definition: tls_info.hpp:80
std::vector< fz::x509_certificate > const & get_peer_certificates() const
The certificate chain sent by the peer.
Definition: tls_info.hpp:228
tls_data_format
The encoding type of a fz::tls_blob or the file pointed to by a fz::tls_filepath. ...
Definition: tls_params.hpp:141
std::vector< x509_certificate > load_certificates_file(native_string const &certsfile, bool pem, bool sort, logger_interface *logger=nullptr)
Gets the certificate information for the certificates in the file.
unsigned int get_pubkey_bits() const
The number of bits of the public key algorithm.
Definition: tls_info.hpp:74
std::vector< subject_name > const & get_alt_subject_names() const
Gets the alternative subject names (SANSs) of the certificated, usually hostnames.
Definition: tls_info.hpp:95
Represents a point of time in wallclock, tracking the timestamps accuracy/precision.
Definition: time.hpp:40
Assorted classes dealing with time.
A subject name, typically a DNS hostname.
Definition: tls_info.hpp:21
std::string const & get_fingerprint_sha1() const
Gets fingerprint as hex-encoded sha1.
Definition: tls_info.hpp:83
basic_tls_param_variant< std::string_view const, native_string const &, std::string const & > const_tls_param_ref
Acts as a const lvalue reference to one of a fz::tls_blob, fz::tls_filepath or fz::tls_pkcs11url.
Definition: tls_params.hpp:124
bool self_signed() const
Indicates whether the certificate is self-signed.
Definition: tls_info.hpp:100
std::wstring native_string
A string in the system's native character type and encoding. Note: This typedef changes depending on...
Definition: string.hpp:34
The namespace used by libfilezilla.
Definition: apply.hpp:17
std::string const & get_protocol() const
TLS version.
Definition: tls_info.hpp:231
The type will be detected automatically using an heuristic.
bool system_trust() const
Definition: tls_info.hpp:249
bool mismatched_hostname() const
True if the hostname in the SANs does not match the requested hostname.
Definition: tls_info.hpp:252
std::string const & get_issuer() const
Gets the issuer of the certificate as RDN as described in RFC4514.
Definition: tls_info.hpp:92
Functions and classes to abstract away the type of different parameters to tls-related functions...
std::string const & get_key_exchange() const
Key exchange algorithm.
Definition: tls_info.hpp:234
std::string const & get_subject() const
Gets the subject of the certificate as RDN as described in RFC4514.
Definition: tls_info.hpp:89
std::string const & get_host() const
The server's hostname used to connect.
Definition: tls_info.hpp:194