1/*
2 * libjingle
3 * Copyright 2004--2008, Google Inc.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are met:
7 *
8 *  1. Redistributions of source code must retain the above copyright notice,
9 *     this list of conditions and the following disclaimer.
10 *  2. Redistributions in binary form must reproduce the above copyright notice,
11 *     this list of conditions and the following disclaimer in the documentation
12 *     and/or other materials provided with the distribution.
13 *  3. The name of the author may not be used to endorse or promote products
14 *     derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
17 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
18 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
19 * EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
20 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
21 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
22 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
23 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
24 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
25 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#ifndef TALK_BASE_OPENSSLIDENTITY_H_
29#define TALK_BASE_OPENSSLIDENTITY_H_
30
31#include <openssl/evp.h>
32#include <openssl/x509.h>
33
34#include <string>
35
36#include "talk/base/common.h"
37#include "talk/base/scoped_ptr.h"
38#include "talk/base/sslidentity.h"
39
40typedef struct ssl_ctx_st SSL_CTX;
41
42namespace talk_base {
43
44// OpenSSLKeyPair encapsulates an OpenSSL EVP_PKEY* keypair object,
45// which is reference counted inside the OpenSSL library.
46class OpenSSLKeyPair {
47 public:
48  explicit OpenSSLKeyPair(EVP_PKEY* pkey) : pkey_(pkey) {
49    ASSERT(pkey_ != NULL);
50  }
51
52  static OpenSSLKeyPair* Generate();
53
54  virtual ~OpenSSLKeyPair();
55
56  virtual OpenSSLKeyPair* GetReference() {
57    AddReference();
58    return new OpenSSLKeyPair(pkey_);
59  }
60
61  EVP_PKEY* pkey() const { return pkey_; }
62
63 private:
64  void AddReference();
65
66  EVP_PKEY* pkey_;
67
68  DISALLOW_EVIL_CONSTRUCTORS(OpenSSLKeyPair);
69};
70
71// OpenSSLCertificate encapsulates an OpenSSL X509* certificate object,
72// which is also reference counted inside the OpenSSL library.
73class OpenSSLCertificate : public SSLCertificate {
74 public:
75  // Caller retains ownership of the X509 object.
76  explicit OpenSSLCertificate(X509* x509) : x509_(x509) {
77    AddReference();
78  }
79
80  static OpenSSLCertificate* Generate(OpenSSLKeyPair* key_pair,
81                                      const std::string& common_name);
82  static OpenSSLCertificate* FromPEMString(const std::string& pem_string);
83
84  virtual ~OpenSSLCertificate();
85
86  virtual OpenSSLCertificate* GetReference() const {
87    return new OpenSSLCertificate(x509_);
88  }
89
90  X509* x509() const { return x509_; }
91
92  virtual std::string ToPEMString() const;
93
94  virtual void ToDER(Buffer* der_buffer) const;
95
96  // Compute the digest of the certificate given algorithm
97  virtual bool ComputeDigest(const std::string &algorithm,
98                             unsigned char *digest, std::size_t size,
99                             std::size_t *length) const;
100
101  // Compute the digest of a certificate as an X509 *
102  static bool ComputeDigest(const X509 *x509,
103                            const std::string &algorithm,
104                            unsigned char *digest,
105                            std::size_t size,
106                            std::size_t *length);
107
108  virtual bool GetSignatureDigestAlgorithm(std::string* algorithm) const;
109
110  virtual bool GetChain(SSLCertChain** chain) const {
111    // Chains are not yet supported when using OpenSSL.
112    // OpenSSLStreamAdapter::SSLVerifyCallback currently requires the remote
113    // certificate to be self-signed.
114    return false;
115  }
116
117 private:
118  void AddReference() const;
119
120  X509* x509_;
121
122  DISALLOW_EVIL_CONSTRUCTORS(OpenSSLCertificate);
123};
124
125// Holds a keypair and certificate together, and a method to generate
126// them consistently.
127class OpenSSLIdentity : public SSLIdentity {
128 public:
129  static OpenSSLIdentity* Generate(const std::string& common_name);
130  static SSLIdentity* FromPEMStrings(const std::string& private_key,
131                                     const std::string& certificate);
132  virtual ~OpenSSLIdentity() { }
133
134  virtual const OpenSSLCertificate& certificate() const {
135    return *certificate_;
136  }
137
138  virtual OpenSSLIdentity* GetReference() const {
139    return new OpenSSLIdentity(key_pair_->GetReference(),
140                               certificate_->GetReference());
141  }
142
143  // Configure an SSL context object to use our key and certificate.
144  bool ConfigureIdentity(SSL_CTX* ctx);
145
146 private:
147  OpenSSLIdentity(OpenSSLKeyPair* key_pair,
148                  OpenSSLCertificate* certificate)
149      : key_pair_(key_pair), certificate_(certificate) {
150    ASSERT(key_pair != NULL);
151    ASSERT(certificate != NULL);
152  }
153
154  scoped_ptr<OpenSSLKeyPair> key_pair_;
155  scoped_ptr<OpenSSLCertificate> certificate_;
156
157  DISALLOW_EVIL_CONSTRUCTORS(OpenSSLIdentity);
158};
159
160
161}  // namespace talk_base
162
163#endif  // TALK_BASE_OPENSSLIDENTITY_H_
164