blob: 101d86810fa6b766658ff66efb0517056709fe0f [file] [log] [blame]
Emeric Brun46591952012-05-18 15:47:34 +02001/*
2 * include/proto/ssl_sock.h
3 * This file contains definition for ssl stream socket operations
4 *
5 * Copyright (C) 2012 EXCELIANCE, Emeric Brun <ebrun@exceliance.fr>
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation, version 2.1
10 * exclusively.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20 */
21
22#ifndef _PROTO_SSL_SOCK_H
23#define _PROTO_SSL_SOCK_H
Willy Tarreauc125cef2019-05-10 09:58:43 +020024#ifdef USE_OPENSSL
25
Willy Tarreau8d164dc2019-05-10 09:35:00 +020026#include <common/openssl-compat.h>
Emeric Brun46591952012-05-18 15:47:34 +020027
Willy Tarreaud1d54542012-09-12 22:58:11 +020028#include <types/connection.h>
29#include <types/listener.h>
30#include <types/proxy.h>
William Lallemandc0cdaff2020-05-15 00:20:53 +020031#include <types/ssl_sock.h>
Emeric Brun46591952012-05-18 15:47:34 +020032#include <types/stream_interface.h>
33
Willy Tarreauc125cef2019-05-10 09:58:43 +020034#include <proto/connection.h>
35
Willy Tarreau71b734c2014-01-28 15:19:44 +010036extern int sslconns;
37extern int totalsslconns;
William Lallemand03c331c2020-05-13 10:10:01 +020038extern struct eb_root ckchs_tree;
William Lallemandc756bbd2020-05-13 17:23:59 +020039extern struct eb_root crtlists_tree;
William Lallemand03c331c2020-05-13 10:10:01 +020040extern int sctl_ex_index;
William Lallemandd4632b22020-05-12 14:46:24 +020041extern struct global_ssl global_ssl;
42extern struct ssl_bind_kw ssl_bind_kws[];
William Lallemandc756bbd2020-05-13 17:23:59 +020043extern struct methodVersions methodVersions[];
44__decl_hathreads(extern HA_SPINLOCK_T ckch_lock);
William Lallemanddad31052020-05-14 17:47:32 +020045extern struct pool_head *pool_head_ssl_capture;
46extern unsigned int openssl_engines_initialized;
47extern int nb_engines;
48extern struct xprt_ops ssl_sock;
William Lallemand15e16942020-05-15 00:25:08 +020049extern int ssl_capture_ptr_index;
Willy Tarreau71b734c2014-01-28 15:19:44 +010050
David Safb76832014-05-08 23:42:08 -040051/* boolean, returns true if connection is over SSL */
52static inline
53int ssl_sock_is_ssl(struct connection *conn)
54{
Willy Tarreaud9f5cca2016-12-22 21:08:52 +010055 if (!conn || conn->xprt != xprt_get(XPRT_SSL) || !conn->xprt_ctx)
David Safb76832014-05-08 23:42:08 -040056 return 0;
57 else
58 return 1;
59}
60
William Lallemand8b453912019-11-21 15:48:10 +010061int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, struct ssl_bind_conf *, SSL_CTX *ctx, char **err);
Willy Tarreau03209342016-12-22 17:08:28 +010062int ssl_sock_prepare_all_ctx(struct bind_conf *bind_conf);
Willy Tarreau55d37912016-12-21 23:38:39 +010063int ssl_sock_prepare_bind_conf(struct bind_conf *bind_conf);
Willy Tarreau03209342016-12-22 17:08:28 +010064int ssl_sock_prepare_srv_ctx(struct server *srv);
Christopher Faulet77fe80c2015-07-29 13:02:40 +020065void ssl_sock_free_srv_ctx(struct server *srv);
Willy Tarreau2a65ff02012-09-13 17:54:29 +020066void ssl_sock_free_all_ctx(struct bind_conf *bind_conf);
Willy Tarreau03209342016-12-22 17:08:28 +010067int ssl_sock_load_ca(struct bind_conf *bind_conf);
Christopher Faulet31af49d2015-06-09 17:29:50 +020068void ssl_sock_free_ca(struct bind_conf *bind_conf);
Emmanuel Hocdet253c3b72018-02-01 18:29:59 +010069const char *ssl_sock_get_sni(struct connection *conn);
Emmanuel Hocdet283e0042017-11-02 14:05:23 +010070const char *ssl_sock_get_cert_sig(struct connection *conn);
Willy Tarreauffc3fcd2012-10-12 20:17:54 +020071const char *ssl_sock_get_cipher_name(struct connection *conn);
72const char *ssl_sock_get_proto_version(struct connection *conn);
Christopher Fauletd75f57e2020-04-20 18:32:29 +020073int ssl_sock_parse_alpn(char *arg, char **alpn_str, int *alpn_len, char **err);
Olivier Houchardab28a322018-12-21 19:45:40 +010074void ssl_sock_set_alpn(struct connection *conn, const unsigned char *, int);
Willy Tarreau63076412015-07-10 11:33:32 +020075void ssl_sock_set_servername(struct connection *conn, const char *hostname);
Olivier Houchardab28a322018-12-21 19:45:40 +010076
Dave McCowan328fb582014-07-30 10:39:13 -040077int ssl_sock_get_cert_used_sess(struct connection *conn);
78int ssl_sock_get_cert_used_conn(struct connection *conn);
Willy Tarreau83061a82018-07-13 11:56:34 +020079int ssl_sock_get_remote_common_name(struct connection *conn,
80 struct buffer *out);
81int ssl_sock_get_pkey_algo(struct connection *conn, struct buffer *out);
David Safb76832014-05-08 23:42:08 -040082unsigned int ssl_sock_get_verify_result(struct connection *conn);
Lukas Tribuse4e30f72014-12-09 16:32:51 +010083#if (defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP)
Willy Tarreau83061a82018-07-13 11:56:34 +020084int ssl_sock_update_ocsp_response(struct buffer *ocsp_response, char **err);
Emeric Brun4147b2e2014-06-16 18:36:30 +020085#endif
Nenad Merdanovic200b0fa2015-05-09 08:46:01 +020086#if (defined SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB && TLS_TICKETS_NO > 0)
Emeric Brun9e754772019-01-10 17:51:55 +010087int ssl_sock_update_tlskey_ref(struct tls_keys_ref *ref,
Willy Tarreau83061a82018-07-13 11:56:34 +020088 struct buffer *tlskey);
89int ssl_sock_update_tlskey(char *filename, struct buffer *tlskey, char **err);
Nenad Merdanovic200b0fa2015-05-09 08:46:01 +020090struct tls_keys_ref *tlskeys_ref_lookup(const char *filename);
91struct tls_keys_ref *tlskeys_ref_lookupid(int unique_id);
Nenad Merdanovic200b0fa2015-05-09 08:46:01 +020092#endif
Remi Gacogne47783ef2015-05-29 15:53:22 +020093#ifndef OPENSSL_NO_DH
94int ssl_sock_load_global_dh_param_from_file(const char *filename);
Grant Zhang872f9c22017-01-21 01:10:18 +000095void ssl_free_dh(void);
Remi Gacogne47783ef2015-05-29 15:53:22 +020096#endif
Grant Zhang872f9c22017-01-21 01:10:18 +000097void ssl_free_engines(void);
Emeric Brun46591952012-05-18 15:47:34 +020098
Christopher Faulet635c0ad2015-11-12 11:35:51 +010099SSL_CTX *ssl_sock_create_cert(struct connection *conn, const char *servername, unsigned int key);
Emeric Brun821bb9b2017-06-15 16:37:39 +0200100SSL_CTX *ssl_sock_assign_generated_cert(unsigned int key, struct bind_conf *bind_conf, SSL *ssl);
Christopher Faulet635c0ad2015-11-12 11:35:51 +0100101SSL_CTX *ssl_sock_get_generated_cert(unsigned int key, struct bind_conf *bind_conf);
102int ssl_sock_set_generated_cert(SSL_CTX *ctx, unsigned int key, struct bind_conf *bind_conf);
103unsigned int ssl_sock_generated_cert_key(const void *data, size_t len);
William Lallemandc756bbd2020-05-13 17:23:59 +0200104void ssl_sock_load_cert_sni(struct ckch_inst *ckch_inst, struct bind_conf *bind_conf);
Willy Tarreau9a1ab082019-05-09 13:26:41 +0200105#if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL) && !defined(OPENSSL_NO_ASYNC) && !defined(LIBRESSL_VERSION_NUMBER)
Emeric Brund0e095c2019-04-19 17:15:28 +0200106void ssl_async_fd_handler(int fd);
107void ssl_async_fd_free(int fd);
108#endif
William Lallemandda8584c2020-05-14 10:14:37 +0200109struct issuer_chain* ssl_get0_issuer_chain(X509 *cert);
William Lallemanddad31052020-05-14 17:47:32 +0200110int ssl_load_global_issuer_from_BIO(BIO *in, char *fp, char **err);
111int ssl_sock_load_cert(char *path, struct bind_conf *bind_conf, char **err);
112void ssl_free_global_issuers(void);
113int ssl_sock_load_cert_list_file(char *file, int dir, struct bind_conf *bind_conf, struct proxy *curproxy, char **err);
114int ssl_init_single_engine(const char *engine_id, const char *def_algorithms);
115int ssl_store_load_locations_file(char *path);
William Lallemandef761072020-05-15 09:52:16 +0200116
William Lallemanded0b5ad2017-10-30 19:36:36 +0100117/* ssl shctx macro */
118
William Lallemand4f45bb92017-10-30 20:08:51 +0100119#define sh_ssl_sess_tree_delete(s) ebmb_delete(&(s)->key);
William Lallemanded0b5ad2017-10-30 19:36:36 +0100120
William Lallemand4f45bb92017-10-30 20:08:51 +0100121#define sh_ssl_sess_tree_insert(s) (struct sh_ssl_sess_hdr *)ebmb_insert(sh_ssl_sess_tree, \
122 &(s)->key, SSL_MAX_SSL_SESSION_ID_LENGTH);
William Lallemanded0b5ad2017-10-30 19:36:36 +0100123
William Lallemand4f45bb92017-10-30 20:08:51 +0100124#define sh_ssl_sess_tree_lookup(k) (struct sh_ssl_sess_hdr *)ebmb_lookup(sh_ssl_sess_tree, \
125 (k), SSL_MAX_SSL_SESSION_ID_LENGTH);
Dragan Dosen1e7ed042020-05-08 18:30:00 +0200126
127/* Registers the function <func> in order to be called on SSL/TLS protocol
128 * message processing.
129 */
130int ssl_sock_register_msg_callback(ssl_sock_msg_callback_func func);
131
Dragan Doseneb607fe2020-05-11 17:17:06 +0200132SSL *ssl_sock_get_ssl_object(struct connection *conn);
133
Willy Tarreauc125cef2019-05-10 09:58:43 +0200134#endif /* USE_OPENSSL */
Emeric Brun46591952012-05-18 15:47:34 +0200135#endif /* _PROTO_SSL_SOCK_H */
136
137/*
138 * Local variables:
139 * c-indent-level: 8
140 * c-basic-offset: 8
141 * End:
142 */