src/security/PeerOptions.h

   1 /*
   2  * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 #ifndef SQUID_SRC_SECURITY_PEEROPTIONS_H
  10 #define SQUID_SRC_SECURITY_PEEROPTIONS_H
  11
  12 #include "base/YesNoNone.h"
  13 #include "ConfigParser.h"
  14 #include "security/KeyData.h"
  15
  16 class Packable;
  17
  18 namespace Security
  19 {
  20
  21 /// TLS squid.conf settings for a remote server peer
  22 class PeerOptions
  23 {
  24 public:
  25     PeerOptions() = default;
  26     PeerOptions(const PeerOptions &);
  27     PeerOptions &operator =(const PeerOptions &);
  28     virtual ~PeerOptions() {}
  29
  30     /// parse a TLS squid.conf option
  31     virtual void parse(const char *);
  32
  33     /// reset the configuration details to default
  34     virtual void clear() {*this = PeerOptions();}
  35
  36     /// generate an unset security context object
  37     virtual Security::ContextPointer createBlankContext() const;
  38
  39     /// generate a security client-context from these configured options
  40     Security::ContextPointer createClientContext(bool setOptions);
  41
  42     /// sync the context options with tls-min-version=N configuration
  43     void updateTlsVersionLimits();
  44
  45     /// setup the NPN extension details for the given context
  46     void updateContextNpn(Security::ContextPointer &);
  47
  48     /// setup the CA details for the given context
  49     void updateContextCa(Security::ContextPointer &);
  50
  51     /// setup the CRL details for the given context
  52     void updateContextCrl(Security::ContextPointer &);
  53
  54     /// setup any library-specific options that can be set for the given session
  55     void updateSessionOptions(Security::SessionPointer &);
  56
  57     /// output squid.conf syntax with 'pfx' prefix on parameters for the stored settings
  58     virtual void dumpCfg(Packable *, const char *pfx) const;
  59
  60 private:
  61     void parseOptions(Security::ParsedOptionsPointer &); ///< parsed value of sslOptions
  62     long parseFlags();
  63     void loadCrlFile();
  64
  65 public:
  66     SBuf sslOptions;     ///< library-specific options string
  67     SBuf caDir;          ///< path of directory containing a set of trusted Certificate Authorities
  68     SBuf crlFile;        ///< path of file containing Certificate Revoke List
  69
  70     SBuf sslCipher;
  71     SBuf sslFlags;       ///< flags defining what TLS operations Squid performs
  72     SBuf sslDomain;
  73
  74     SBuf tlsMinVersion;  ///< version label for minimum TLS version to permit
  75
  76     Security::ParsedOptionsPointer parsedOptions; ///< parsed value of sslOptions
  77     long parsedFlags = 0;   ///< parsed value of sslFlags
  78
  79     std::list<Security::KeyData> certs; ///< details from the cert= and file= config parameters
  80     std::list<SBuf> caFiles;  ///< paths of files containing trusted Certificate Authority
  81     Security::CertRevokeList parsedCrl; ///< CRL to use when verifying the remote end certificate
  82
  83 protected:
  84     int sslVersion = 0;
  85
  86     /// flags governing Squid internal TLS operations
  87     struct flags_ {
  88         flags_() : tlsDefaultCa(true), tlsNpn(true) {}
  89
  90         /// whether to use the system default Trusted CA when verifying the remote end certificate
  91         YesNoNone tlsDefaultCa;
  92
  93         /// whether to use the TLS NPN extension on these connections
  94         bool tlsNpn;
  95     } flags;
  96
  97 public:
  98     /// whether transport encryption (TLS/SSL) is to be used on connections to the peer
  99     bool encryptTransport = false;
 100 };
 101
 102 /// configuration options for DIRECT server access
 103 extern PeerOptions ProxyOutgoingConfig;
 104
 105 } // namespace Security
 106
 107 // parse the tls_outgoing_options directive
 108 void parse_securePeerOptions(Security::PeerOptions *);
 109 #define free_securePeerOptions(x) Security::ProxyOutgoingConfig.clear()
 110 #define dump_securePeerOptions(e,n,x) do { (e)->appendf(n); (x).dumpCfg((e),""); (e)->append("\n",1); } while(false)
 111
 112 #endif /* SQUID_SRC_SECURITY_PEEROPTIONS_H */
 113