William Lallemand | d4632b2 | 2020-05-12 14:46:24 +0200 | [diff] [blame] | 1 | /* |
| 2 | * include/types/ssl_ckch.h |
| 3 | * ckch structures |
| 4 | * |
| 5 | * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com> |
| 6 | * |
| 7 | * This library is free software; you can redistribute it and/or |
| 8 | * modify it under the terms of the GNU Lesser General Public |
| 9 | * License as published by the Free Software Foundation, version 2.1 |
| 10 | * exclusively. |
| 11 | * |
| 12 | * This library is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 15 | * Lesser General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU Lesser General Public |
| 18 | * License along with this library; if not, write to the Free Software |
| 19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
| 20 | */ |
| 21 | |
| 22 | |
| 23 | /* The ckch (cert key and chain) structures are a group of structures used to |
| 24 | * cache and manipulate the certificates files loaded from the configuration |
| 25 | * file and the CLI Every certificate change made in a SSL_CTX should be done |
| 26 | * in these structures before being applied to a SSL_CTX. |
| 27 | * |
| 28 | * The complete architecture is described in doc/internals/ssl_cert.dia |
| 29 | */ |
| 30 | |
| 31 | |
| 32 | #ifndef _TYPES_SSL_CKCH_H |
| 33 | #define _TYPES_SSL_CKCH_H |
| 34 | #ifdef USE_OPENSSL |
| 35 | |
Willy Tarreau | 853b297 | 2020-05-27 18:01:47 +0200 | [diff] [blame] | 36 | #include <haproxy/list-t.h> |
Willy Tarreau | 6019fab | 2020-05-27 16:26:00 +0200 | [diff] [blame] | 37 | #include <haproxy/openssl-compat.h> |
William Lallemand | d4632b2 | 2020-05-12 14:46:24 +0200 | [diff] [blame] | 38 | |
| 39 | /* This is used to preload the certificate, private key |
| 40 | * and Cert Chain of a file passed in via the crt |
| 41 | * argument |
| 42 | * |
| 43 | * This way, we do not have to read the file multiple times |
| 44 | * |
| 45 | * This structure is the base one, in the case of a multi-cert bundle, we |
| 46 | * allocate 1 structure per type. |
| 47 | */ |
| 48 | struct cert_key_and_chain { |
| 49 | X509 *cert; |
| 50 | EVP_PKEY *key; |
| 51 | STACK_OF(X509) *chain; |
| 52 | DH *dh; |
| 53 | struct buffer *sctl; |
| 54 | struct buffer *ocsp_response; |
| 55 | X509 *ocsp_issuer; |
| 56 | }; |
| 57 | |
| 58 | /* |
| 59 | * this is used to store 1 to SSL_SOCK_NUM_KEYTYPES cert_key_and_chain and |
| 60 | * metadata. |
| 61 | * |
| 62 | * XXX: Once we remove the multi-cert bundle support, we could merge this structure |
| 63 | * with the cert_key_and_chain one. |
| 64 | */ |
| 65 | struct ckch_store { |
| 66 | struct cert_key_and_chain *ckch; |
| 67 | unsigned int multi:1; /* is it a multi-cert bundle ? */ |
| 68 | struct list ckch_inst; /* list of ckch_inst which uses this ckch_node */ |
| 69 | struct list crtlist_entry; /* list of entries which use this store */ |
| 70 | struct ebmb_node node; |
| 71 | char path[0]; |
| 72 | }; |
| 73 | |
William Lallemand | 03c331c | 2020-05-13 10:10:01 +0200 | [diff] [blame] | 74 | /* forward declarations for ckch_inst */ |
| 75 | struct ssl_bind_conf; |
| 76 | struct crtlist_entry; |
| 77 | |
William Lallemand | d4632b2 | 2020-05-12 14:46:24 +0200 | [diff] [blame] | 78 | /* |
| 79 | * This structure describe a ckch instance. An instance is generated for each |
| 80 | * bind_conf. The instance contains a linked list of the sni ctx which uses |
| 81 | * the ckch in this bind_conf. |
| 82 | */ |
| 83 | struct ckch_inst { |
| 84 | struct bind_conf *bind_conf; /* pointer to the bind_conf that uses this ckch_inst */ |
| 85 | struct ssl_bind_conf *ssl_conf; /* pointer to the ssl_conf which is used by every sni_ctx of this inst */ |
| 86 | struct ckch_store *ckch_store; /* pointer to the store used to generate this inst */ |
| 87 | struct crtlist_entry *crtlist_entry; /* pointer to the crtlist_entry used, or NULL */ |
| 88 | unsigned int is_default:1; /* This instance is used as the default ctx for this bind_conf */ |
| 89 | /* space for more flag there */ |
| 90 | struct list sni_ctx; /* list of sni_ctx using this ckch_inst */ |
| 91 | struct list by_ckchs; /* chained in ckch_store's list of ckch_inst */ |
| 92 | struct list by_crtlist_entry; /* chained in crtlist_entry list of inst */ |
| 93 | }; |
| 94 | |
| 95 | #endif /* USE_OPENSSL */ |
| 96 | #endif /* _TYPES_SSL_CKCH_H */ |