src/ssl/certificate_db.h

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 #ifndef SQUID_SSL_CERTIFICATE_DB_H
  10 #define SQUID_SSL_CERTIFICATE_DB_H
  11
  12 #include "ssl/gadgets.h"
  13
  14 #if HAVE_OPENSSL_OPENSSLV_H
  15 #include <openssl/opensslv.h>
  16 #endif
  17 #include <string>
  18
  19 namespace Ssl
  20 {
  21 /// maintains an exclusive blocking file-based lock
  22 class Lock
  23 {
  24 public:
  25     explicit Lock(std::string const &filename); ///<  creates an unlocked lock
  26     ~Lock(); ///<  releases the lock if it is locked
  27     void lock(); ///<  locks the lock, may block
  28     void unlock(); ///<  unlocks locked lock or throws
  29     bool locked() const; ///<  whether our lock is locked
  30     const char *name() const { return filename.c_str(); }
  31 private:
  32     std::string filename;
  33 #if _SQUID_WINDOWS_
  34     HANDLE hFile; ///< Windows file handle.
  35 #else
  36     int fd; ///< Linux file descriptor.
  37 #endif
  38 };
  39
  40 /// an exception-safe way to obtain and release a lock
  41 class Locker
  42 {
  43 public:
  44     /// locks the lock if the lock was unlocked
  45     Locker(Lock &lock, const char  *aFileName, int lineNo);
  46     /// unlocks the lock if it was locked by us
  47     ~Locker();
  48 private:
  49     bool weLocked; ///<  whether we locked the lock
  50     Lock &lock; ///<  the lock we are operating on
  51     const std::string fileName; ///<  where the lock was needed
  52     const int lineNo; ///<  where the lock was needed
  53 };
  54
  55 /// convenience macro to pass source code location to Locker and others
  56 #define Here __FILE__, __LINE__
  57
  58 /**
  59  * Database class for storing SSL certificates and their private keys.
  60  * A database consist by:
  61  *     - A disk file to store current serial number
  62  *     - A disk file to store the current database size
  63  *     - A disk file which is a normal TXT_DB openSSL database
  64  *     - A directory under which the certificates and their private keys stored.
  65  *  The database before used must initialized with CertificateDb::create static method.
  66  */
  67 class CertificateDb
  68 {
  69 public:
  70     /// Names of db columns.
  71     enum Columns {
  72         cnlType = 0,
  73         cnlExp_date,
  74         cnlRev_date,
  75         cnlSerial,
  76         cnlFile,
  77         cnlName,
  78         cnlNumber
  79     };
  80
  81     /// A wrapper for OpenSSL database row of TXT_DB database.
  82     class Row
  83     {
  84     public:
  85         /// Create row wrapper.
  86         Row();
  87         ///Create row wrapper for row with width items
  88         Row(char **row, size_t width);
  89         /// Delete all row.
  90         ~Row();
  91         void setValue(size_t number, char const * value); ///< Set cell's value in row
  92         char ** getRow(); ///< Raw row
  93         void reset(); ///< Abandon row and don't free memory
  94     private:
  95         char **row; ///< Raw row
  96         size_t width; ///< Number of cells in the row
  97     };
  98
  99     CertificateDb(std::string const & db_path, size_t aMax_db_size, size_t aFs_block_size);
 100     /// Find certificate and private key for host name
 101     bool find(std::string const & host_name, Ssl::X509_Pointer & cert, Ssl::EVP_PKEY_Pointer & pkey);
 102     /// Delete a certificate from database
 103     bool purgeCert(std::string const & key);
 104     /// Save certificate to disk.
 105     bool addCertAndPrivateKey(Ssl::X509_Pointer & cert, Ssl::EVP_PKEY_Pointer & pkey, std::string const & useName);
 106     /// Create and initialize a database  under the  db_path
 107     static void create(std::string const & db_path);
 108     /// Check the database stored under the db_path.
 109     static void check(std::string const & db_path, size_t max_db_size, size_t fs_block_size);
 110     bool IsEnabledDiskStore() const; ///< Check enabled of dist store.
 111 private:
 112     void load(); ///< Load db from disk.
 113     void save(); ///< Save db to disk.
 114     size_t size(); ///< Get db size on disk in bytes.
 115     /// Increase db size by the given file size and update size_file
 116     void addSize(std::string const & filename);
 117     /// Decrease db size by the given file size and update size_file
 118     void subSize(std::string const & filename);
 119     size_t readSize(); ///< Read size from file size_file
 120     void writeSize(size_t db_size); ///< Write size to file size_file.
 121     size_t getFileSize(std::string const & filename); ///< get file size on disk.
 122     size_t rebuildSize(); ///< Rebuild size_file
 123     /// Only find certificate in current db and return it.
 124     bool pure_find(std::string const & host_name, Ssl::X509_Pointer & cert, Ssl::EVP_PKEY_Pointer & pkey);
 125
 126     void deleteRow(const char **row, int rowIndex); ///< Delete a row from TXT_DB
 127     bool deleteInvalidCertificate(); ///< Delete invalid certificate.
 128     bool deleteOldestCertificate(); ///< Delete oldest certificate.
 129     bool deleteByHostname(std::string const & host); ///< Delete using host name.
 130
 131     /// Removes the first matching row from TXT_DB. Ignores failures.
 132     static void sq_TXT_DB_delete(TXT_DB *db, const char **row);
 133     /// Remove the row on position idx from TXT_DB. Ignores failures.
 134     static void sq_TXT_DB_delete_row(TXT_DB *db, int idx);
 135
 136     /// Callback hash function for serials. Used to create TXT_DB index of serials.
 137     static unsigned long index_serial_hash(const char **a);
 138     /// Callback compare function for serials. Used to create TXT_DB index of serials.
 139     static int index_serial_cmp(const char **a, const char **b);
 140     /// Callback hash function for names. Used to create TXT_DB index of names..
 141     static unsigned long index_name_hash(const char **a);
 142     /// Callback compare function for  names. Used to create TXT_DB index of names..
 143     static int index_name_cmp(const char **a, const char **b);
 144
 145     /// Definitions required by openSSL, to use the index_* functions defined above
 146     ///with TXT_DB_create_index.
 147 #if SQUID_USE_SSLLHASH_HACK
 148     static unsigned long index_serial_hash_LHASH_HASH(const void *a) {
 149         return index_serial_hash((const char **)a);
 150     }
 151     static int index_serial_cmp_LHASH_COMP(const void *arg1, const void *arg2) {
 152         return index_serial_cmp((const char **)arg1, (const char **)arg2);
 153     }
 154     static unsigned long index_name_hash_LHASH_HASH(const void *a) {
 155         return index_name_hash((const char **)a);
 156     }
 157     static int index_name_cmp_LHASH_COMP(const void *arg1, const void *arg2) {
 158         return index_name_cmp((const char **)arg1, (const char **)arg2);
 159     }
 160 #else
 161     static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
 162     static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
 163     static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
 164     static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
 165 #endif
 166
 167     static const std::string db_file; ///< Base name of the database index file.
 168     static const std::string cert_dir; ///< Base name of the directory to store the certs.
 169     static const std::string size_file; ///< Base name of the file to store db size.
 170     /// Min size of disk db. If real size < min_db_size the  db will be disabled.
 171     static const size_t min_db_size;
 172
 173     const std::string db_path; ///< The database directory.
 174     const std::string db_full; ///< Full path of the database index file.
 175     const std::string cert_full; ///< Full path of the directory to store the certs.
 176     const std::string size_full; ///< Full path of the file to store the db size.
 177
 178     TXT_DB_Pointer db; ///< Database with certificates info.
 179     const size_t max_db_size; ///< Max size of db.
 180     const size_t fs_block_size; ///< File system block size.
 181     mutable Lock dbLock;  ///< protects the database file
 182
 183     bool enabled_disk_store; ///< The storage on the disk is enabled.
 184 };
 185
 186 } // namespace Ssl
 187 #endif // SQUID_SSL_CERTIFICATE_DB_H
 188