SecureTCPSocket.h

/*
** libutil++
** $Id: SecureTCPSocket.h 1653 2016-02-28 19:54:59Z sella $
** Copyright (c) 2011-2016 Digital Genesis, LLC. All Rights Reserved.
** Released under the LGPL Version 2.1 License.
** http://www.digitalgenesis.com
*/

#ifndef __libutilxx__sella__net__SecureTCPSocket_H__
#define __libutilxx__sella__net__SecureTCPSocket_H__

#include "../../common.h"
#include "TCPSocket.h"

#include <openssl/crypto.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

#include <set>
#include <mutex>
#include <vector>
#include <memory>
#include <string>

namespace sella {
        namespace net {
                class SecureTCPSocket;
        }
}

class sella::net::SecureTCPSocket : public TCPSocket {
        public:
                typedef std::shared_ptr<SecureTCPSocket> shared;
                typedef SecureTCPSocket *ptr;

                enum Protocol : int8_t { SSLv3, TLSv1_0, TLSv1_1, TLSv1_2 };

                static const std::set<Protocol> DefaultProtocols; /* { SSLv3, TLSv1_0, TLSv1_1, TLSv1_2 } */
                static const std::string DefaultCiphers; /* ALL:!aNULL:!eNULL */
                static const std::string PerformanceCiphers; /* AES128-SHA:RC4-MD5:RC4-SHA:AES256-SHA:HIGH:!DSS:!aNULL:!eNULL */

                /* Cipher Performance: http://zombe.es/post/4078724716/openssl-cipher-selection */

        public:
                SecureTCPSocket(int family) throw (SocketException);
                SecureTCPSocket(int family, const IPAddressPort &addressport) throw (SocketException);
                SecureTCPSocket(int family, const IPAddress &address, const Port &port) throw (SocketException);
                SecureTCPSocket(int family, const std::string &address, unsigned short port) throw (SocketException);
                SecureTCPSocket(const IPAddressPort &addressport) throw (SocketException);
                SecureTCPSocket(const IPAddress &address, const Port &port) throw (SocketException);
                SecureTCPSocket(const SecureTCPSocket &sock) = delete;
                virtual ~SecureTCPSocket();
                void operator=(const SecureTCPSocket &sock) = delete;

                /* Server-side Options */
                void setCertificateFile(const std::string &certificateFile) throw ();
                void setPrivateKeyFile(const std::string &privateKeyFile) throw ();
                void setPasswordFile(const std::string &passwordFile) throw (); /* Preferred over configured password */
                void setPassword(const std::string &password) throw ();
                void setCertificateChainFile(const std::string &certificateChainFile) throw ();
                void setCACertificateFile(const std::string &caCertificateFile) throw (); /* Set to perform certificate verification */

                void setProtocols(const std::set<Protocol> &protocols = DefaultProtocols) throw ();
                void setProtocol(Protocol protocol, bool on = true) throw ();
                void setCiphers(const std::string &ciphers = PerformanceCiphers) throw (); /* To see chosen ciphers run: openssl ciphers -v 'AES128-SHA:RC4-MD5' */
                void setPreferServerCiphers(bool on = true) throw (); /* Prefer the server's ciphers and ordering. */

                virtual bool isSecure(void) const throw ();

                virtual TCPSocket::shared accept(void) throw (SocketException);

                const char* getSSLLibraryVersion(void) const throw ();
                const char* getActiveProtocol(void) const throw (SocketException);
                const char* getActiveCipher(void) const throw (SocketException);

                virtual ssize_t send(const void *data, size_t len, int flags) throw (SocketException);
                using TCPSocket::send;
                virtual ssize_t recv(void *data, size_t len, int flags) throw (SocketException);
                using TCPSocket::recv;

                static const SecureTCPSocket::shared shared_ptr(int family) throw (SocketException);
                static const SecureTCPSocket::shared shared_ptr(int family, const IPAddressPort &addressport) throw (SocketException);
                static const SecureTCPSocket::shared shared_ptr(int family, const IPAddress &address, const Port &port) throw (SocketException);
                static const SecureTCPSocket::shared shared_ptr(int family, const std::string &address, unsigned short port) throw (SocketException);
                static const SecureTCPSocket::shared shared_ptr(const IPAddressPort &addressport) throw (SocketException);
                static const SecureTCPSocket::shared shared_ptr(const IPAddress &address, const Port &port) throw (SocketException);

        protected:
                SSL_CTX *ctx;
                SSL *ssl;
                bool server;

                std::string certificateFile;
                std::string privateKeyFile;
                std::string passwordFile;
                std::string password;
                std::string certificateChainFile;
                std::string caCertificateFile;

                std::set<Protocol> protocols;
                std::string ciphers;
                bool preferServerCiphers;

                std::mutex mutex;

                SecureTCPSocket(int s, bool unused __attribute__((unused))) throw (SocketException);

                void init(void) throw (SocketException);
                void server_init(void) throw (SocketException);
                void client_init(void) throw (SocketException);
                void shutdown(void) throw ();
                virtual void close(void) throw (SocketException);
                std::vector<std::string> getErrors(void) throw (SocketException);

                static int SSL_password_callback(char *buf, int num, int rwflag, void *userdata);
};

#endif

/*
** vim: noet ts=3 sw=3
*/