112 lines
3.9 KiB
C++
112 lines
3.9 KiB
C++
// Copyright 2023 Memgraph Ltd.
|
|
//
|
|
// Use of this software is governed by the Business Source License
|
|
// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
|
|
// License, and you may not use this file except in compliance with the Business Source License.
|
|
//
|
|
// As of the Change Date specified in that file, in accordance with
|
|
// the Business Source License, use of this software will be governed
|
|
// by the Apache License, Version 2.0, included in the file
|
|
// licenses/APL.txt.
|
|
|
|
#pragma once
|
|
|
|
#include <optional>
|
|
#include <string>
|
|
|
|
#include <openssl/ssl.h>
|
|
#include <boost/asio/ssl/context.hpp>
|
|
|
|
// Centos 7 OpenSSL includes libkrb5 which has brings in macros TRUE and FALSE. undef to prevent issues.
|
|
#undef TRUE
|
|
#undef FALSE
|
|
|
|
namespace memgraph::communication {
|
|
|
|
/**
|
|
* This class represents a context that should be used with network clients. One
|
|
* context can be reused between multiple clients (note: this mainly depends on
|
|
* the underlying OpenSSL implementation [see `SSL_new` in
|
|
* `openssl/ssl/ssl_lib.c`]).
|
|
*/
|
|
class ClientContext final {
|
|
public:
|
|
/**
|
|
* This constructor constructs a ClientContext that can either not use SSL
|
|
* (`use_ssl` is `false` by default), or it constructs a ClientContext that
|
|
* doesn't use a client certificate when `use_ssl` is set to `true`.
|
|
*/
|
|
explicit ClientContext(bool use_ssl = false);
|
|
|
|
/**
|
|
* This constructor constructs a ClientContext that uses SSL and uses the
|
|
* specific client private key and certificate combination. If the parameters
|
|
* `key_file` and `cert_file` are equal to "" then the constructor falls back
|
|
* to the above constructor that uses SSL without certificates.
|
|
*/
|
|
ClientContext(const std::string &key_file, const std::string &cert_file);
|
|
|
|
// This object can't be copied because the underlying SSL implementation is
|
|
// messy and ownership can't be handled correctly.
|
|
ClientContext(const ClientContext &) = delete;
|
|
ClientContext &operator=(const ClientContext &) = delete;
|
|
|
|
// Move constructor/assignment that handle ownership change correctly.
|
|
ClientContext(ClientContext &&other) noexcept;
|
|
ClientContext &operator=(ClientContext &&other) noexcept;
|
|
|
|
// Destructor that handles ownership of the SSL object.
|
|
~ClientContext();
|
|
|
|
SSL_CTX *context();
|
|
|
|
bool use_ssl();
|
|
|
|
private:
|
|
bool use_ssl_;
|
|
SSL_CTX *ctx_;
|
|
};
|
|
|
|
/**
|
|
* This class represents a context that should be used with network servers. One
|
|
* context can be reused between multiple servers (note: this mainly depends on
|
|
* the underlying OpenSSL implementation [see `SSL_new` in
|
|
* `openssl/ssl/ssl_lib.c`]).
|
|
*/
|
|
class ServerContext final {
|
|
public:
|
|
ServerContext() = default;
|
|
/**
|
|
* This constructor constructs a ServerContext that uses SSL. The parameters
|
|
* `key_file` and `cert_file` can't be "" because when setting up a server it
|
|
* is mandatory to supply a private key and certificate. The parameter
|
|
* `ca_file` can be "" because SSL doesn't necessarily need to check that the
|
|
* client has a valid certificate. If you specify `verify_peer` to be `true`
|
|
* to check that the client certificate is valid, then you need to supply a
|
|
* valid `ca_file` as well.
|
|
*/
|
|
ServerContext(const std::string &key_file, const std::string &cert_file, const std::string &ca_file = "",
|
|
bool verify_peer = false);
|
|
|
|
// This object can't be copied because the underlying SSL implementation is
|
|
// messy and ownership can't be handled correctly.
|
|
ServerContext(const ServerContext &) = delete;
|
|
ServerContext &operator=(const ServerContext &) = delete;
|
|
|
|
// Move constructor/assignment that handle ownership change correctly.
|
|
ServerContext(ServerContext &&other) noexcept;
|
|
ServerContext &operator=(ServerContext &&other) noexcept;
|
|
|
|
~ServerContext();
|
|
|
|
SSL_CTX *context();
|
|
boost::asio::ssl::context &context_clone();
|
|
|
|
bool use_ssl() const;
|
|
|
|
private:
|
|
std::optional<boost::asio::ssl::context> ctx_;
|
|
};
|
|
|
|
} // namespace memgraph::communication
|