TlsOptions.h

Go to the documentation of this file.

#pragma once

#include <aws/crt/Types.h>
#include <aws/crt/io/ChannelHandler.h>
#include <aws/io/tls_channel_handler.h>

#include <functional>
#include <memory>

struct aws_tls_ctx_options;

namespace Aws
{
    namespace Crt
    {
        namespace Io
        {
            class Pkcs11Lib;
            class TlsContextPkcs11Options;
            struct TlsConnectionInfo;
            enum class CertificateSource;

            enum class TlsMode
            {
                CLIENT,
                SERVER,
            };

            class AWS_CRT_CPP_API TlsContextOptions
            {
                friend class TlsContext;

              public:
                TlsContextOptions() noexcept;
                virtual ~TlsContextOptions();
                TlsContextOptions(const TlsContextOptions &) noexcept = delete;
                TlsContextOptions &operator=(const TlsContextOptions &) noexcept = delete;
                TlsContextOptions(TlsContextOptions &&) noexcept;
                TlsContextOptions &operator=(TlsContextOptions &&) noexcept;

                explicit operator bool() const noexcept { return m_isInit; }

                int LastError() const noexcept;

                static TlsContextOptions InitDefaultClient(Allocator *allocator = ApiAllocator()) noexcept;

                static TlsContextOptions InitClientWithMtls(
                    const char *cert_path,
                    const char *pkey_path,
                    Allocator *allocator = ApiAllocator()) noexcept;

                static TlsContextOptions InitClientWithMtls(
                    const ByteCursor &cert,
                    const ByteCursor &pkey,
                    Allocator *allocator = ApiAllocator()) noexcept;

                static TlsContextOptions InitClientWithMtlsPkcs11(
                    const TlsContextPkcs11Options &pkcs11Options,
                    Allocator *allocator = ApiAllocator()) noexcept;

                static TlsContextOptions InitClientWithMtlsPkcs12(
                    const char *pkcs12_path,
                    const char *pkcs12_pwd,
                    Allocator *allocator = ApiAllocator()) noexcept;

                bool SetKeychainPath(ByteCursor &keychain_path) noexcept;

                static TlsContextOptions InitClientWithMtlsSystemPath(
                    const char *windowsCertStorePath,
                    Allocator *allocator = ApiAllocator()) noexcept;

                static bool IsAlpnSupported() noexcept;

                bool SetAlpnList(const char *alpnList) noexcept;

                void SetVerifyPeer(bool verifyPeer) noexcept;

                void SetNoCertificateRevocation(bool noCertificateRevocation) noexcept;

                void SetMinimumTlsVersion(aws_tls_versions minimumTlsVersion);

                void SetTlsCipherPreference(aws_tls_cipher_pref cipher_pref);

                bool OverrideDefaultTrustStore(const char *caPath, const char *caFile) noexcept;

                bool OverrideDefaultTrustStore(const ByteCursor &ca) noexcept;

                const aws_tls_ctx_options *GetUnderlyingHandle() const noexcept
                {
                    return m_isInit ? &m_options : nullptr;
                }

              private:
                aws_tls_ctx_options m_options;
                aws_tls_versions m_metricsTlsVersion;
                aws_tls_cipher_pref m_metricsCipherPref;
                // Internal metrics tracking fields, track the certificate source
                CertificateSource m_metricsCertificateSource;

                bool m_isInit = false;
            };

            class AWS_CRT_CPP_API TlsContextPkcs11Options final
            {
              public:
                TlsContextPkcs11Options(
                    const std::shared_ptr<Pkcs11Lib> &pkcs11Lib,
                    Allocator *allocator = ApiAllocator()) noexcept;

                void SetUserPin(const String &pin) noexcept;

                void SetSlotId(const uint64_t id) noexcept;

                void SetTokenLabel(const String &label) noexcept;

                void SetPrivateKeyObjectLabel(const String &label) noexcept;

                void SetCertificateFilePath(const String &path) noexcept;

                void SetCertificateFileContents(const String &contents) noexcept;

                aws_tls_ctx_pkcs11_options GetUnderlyingHandle() const noexcept;

              private:
                std::shared_ptr<Pkcs11Lib> m_pkcs11Lib;
                Optional<uint64_t> m_slotId;
                Optional<String> m_userPin;
                Optional<String> m_tokenLabel;
                Optional<String> m_privateKeyObjectLabel;
                Optional<String> m_certificateFilePath;
                Optional<String> m_certificateFileContents;
            };

            class AWS_CRT_CPP_API TlsConnectionOptions final
            {
              public:
                TlsConnectionOptions() noexcept;
                ~TlsConnectionOptions();
                TlsConnectionOptions(const TlsConnectionOptions &) noexcept;
                TlsConnectionOptions &operator=(const TlsConnectionOptions &) noexcept;
                TlsConnectionOptions(TlsConnectionOptions &&options) noexcept;
                TlsConnectionOptions &operator=(TlsConnectionOptions &&options) noexcept;

                bool SetServerName(ByteCursor &serverName) noexcept;

                bool SetAlpnList(const char *alpnList) noexcept;

                explicit operator bool() const noexcept { return isValid(); }

                int LastError() const noexcept { return m_lastError; }

                const aws_tls_connection_options *GetUnderlyingHandle() const noexcept
                {
                    return m_isInit ? &m_tls_connection_options : nullptr;
                }

                TlsConnectionInfo GetTlsConnectionInfo() const noexcept;

              private:
                bool isValid() const noexcept { return m_isInit; }

                // Create TlsConnectionOptions from aws_tls_ctx. The metricsCertificateSource, metricsTlsVersion, and
                // metricsCipherPref are used for metrics tracking. It might not directly reflect the real options.
                TlsConnectionOptions(
                    aws_tls_ctx *ctx,
                    Allocator *allocator,
                    CertificateSource metricsCertificateSource,
                    aws_tls_versions metricsTlsVersion = AWS_IO_TLS_VER_SYS_DEFAULTS,
                    aws_tls_cipher_pref metricsCipherPref = AWS_IO_TLS_CIPHER_PREF_SYSTEM_DEFAULT) noexcept;
                aws_tls_connection_options m_tls_connection_options;
                aws_allocator *m_allocator = nullptr;
                int m_lastError = AWS_ERROR_SUCCESS;
                bool m_isInit = false;

                // Internal metrics tracking fields
                CertificateSource m_metricsCertificateSource;
                aws_tls_versions m_metricsTlsVersion;
                aws_tls_cipher_pref m_metricsCipherPref;

                friend class TlsContext;
            };

            class AWS_CRT_CPP_API TlsContext final
            {
              public:
                TlsContext() noexcept;
                TlsContext(TlsContextOptions &options, TlsMode mode, Allocator *allocator = ApiAllocator()) noexcept;
                ~TlsContext() = default;
                TlsContext(const TlsContext &) noexcept = default;
                TlsContext &operator=(const TlsContext &) noexcept = default;
                TlsContext(TlsContext &&) noexcept = default;
                TlsContext &operator=(TlsContext &&) noexcept = default;

                TlsConnectionOptions NewConnectionOptions() const noexcept;

                explicit operator bool() const noexcept { return isValid(); }

                int GetInitializationError() const noexcept { return m_initializationError; }

                aws_tls_ctx *GetUnderlyingHandle() const noexcept { return m_ctx.get(); }

              private:
                bool isValid() const noexcept { return m_ctx && m_initializationError == AWS_ERROR_SUCCESS; }

                std::shared_ptr<aws_tls_ctx> m_ctx;
                int m_initializationError;
                // Internal metrics tracking fields, track the certificate source
                CertificateSource m_metricsCertificateSource;
                aws_tls_versions m_metricsTlsVersion;
                aws_tls_cipher_pref m_metricsCipherPref;
            };

            using NewTlsContextImplCallback = std::function<void *(TlsContextOptions &, TlsMode, Allocator *)>;
            using DeleteTlsContextImplCallback = std::function<void(void *)>;
            using IsTlsAlpnSupportedCallback = std::function<bool()>;

            class AWS_CRT_CPP_API TlsChannelHandler : public ChannelHandler
            {
              public:
                virtual ~TlsChannelHandler();

                virtual String GetProtocol() const = 0;

              protected:
                TlsChannelHandler(
                    struct aws_channel_slot *slot,
                    const struct aws_tls_connection_options &options,
                    Allocator *allocator = ApiAllocator());

                void CompleteTlsNegotiation(int errorCode);

              private:
                aws_tls_on_negotiation_result_fn *m_OnNegotiationResult;
                void *m_userData;

                aws_byte_buf m_protocolByteBuf;
                friend aws_byte_buf(::aws_tls_handler_protocol)(aws_channel_handler *);
            };

            class AWS_CRT_CPP_API ClientTlsChannelHandler : public TlsChannelHandler
            {
              public:
                virtual void StartNegotiation() = 0;

              protected:
                ClientTlsChannelHandler(
                    struct aws_channel_slot *slot,
                    const struct aws_tls_connection_options &options,
                    Allocator *allocator = ApiAllocator());
            };

            using NewClientTlsHandlerCallback = std::function<std::shared_ptr<ClientTlsChannelHandler>(
                struct aws_channel_slot *slot,
                const struct aws_tls_connection_options &options,
                Allocator *allocator)>;

        } // namespace Io
    } // namespace Crt
} // namespace Aws