]>
git.ipfire.org Git - thirdparty/squid.git/blob - src/security/cert_generators/file/certificate_db.h
1609e21d34cd26b1fd1dcbc1c3e4059dfaf749cc
2 * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
9 #ifndef SQUID_SSL_CERTIFICATE_DB_H
10 #define SQUID_SSL_CERTIFICATE_DB_H
12 #include "ssl/gadgets.h"
14 #if HAVE_OPENSSL_OPENSSLV_H
15 #include <openssl/opensslv.h>
21 /// maintains an exclusive blocking file-based lock
25 explicit Lock(std::string
const &filename
); ///< creates an unlocked lock
26 ~Lock(); ///< releases the lock if it is locked
27 void lock(); ///< locks the lock, may block
28 void unlock(); ///< unlocks locked lock or throws
29 bool locked() const; ///< whether our lock is locked
30 const char *name() const { return filename
.c_str(); }
34 HANDLE hFile
; ///< Windows file handle.
36 int fd
; ///< Linux file descriptor.
40 /// an exception-safe way to obtain and release a lock
44 /// locks the lock if the lock was unlocked
45 Locker(Lock
&lock
, const char *aFileName
, int lineNo
);
46 /// unlocks the lock if it was locked by us
49 bool weLocked
; ///< whether we locked the lock
50 Lock
&lock
; ///< the lock we are operating on
51 const std::string fileName
; ///< where the lock was needed
52 const int lineNo
; ///< where the lock was needed
55 /// convenience macro to pass source code location to Locker and others
56 #define Here __FILE__, __LINE__
59 * Database class for storing SSL certificates and their private keys.
60 * A database consist by:
61 * - A disk file to store current serial number
62 * - A disk file to store the current database size
63 * - A disk file which is a normal TXT_DB openSSL database
64 * - A directory under which the certificates and their private keys stored.
65 * The database before used must initialized with CertificateDb::create static method.
70 /// Names of db columns.
81 /// A wrapper for OpenSSL database row of TXT_DB database.
85 /// Create row wrapper.
87 ///Create row wrapper for row with width items
88 Row(char **row
, size_t width
);
91 void setValue(size_t number
, char const * value
); ///< Set cell's value in row
92 char ** getRow(); ///< Raw row
93 void reset(); ///< Abandon row and don't free memory
95 char **row
; ///< Raw row
96 size_t width
; ///< Number of cells in the row
99 CertificateDb(std::string
const & db_path
, size_t aMax_db_size
, size_t aFs_block_size
);
100 /// Find certificate and private key for host name
101 bool find(std::string
const & host_name
, Security::CertPointer
& cert
, Ssl::EVP_PKEY_Pointer
& pkey
);
102 /// Delete a certificate from database
103 bool purgeCert(std::string
const & key
);
104 /// Save certificate to disk.
105 bool addCertAndPrivateKey(Security::CertPointer
& cert
, Ssl::EVP_PKEY_Pointer
& pkey
, std::string
const & useName
);
106 /// Create and initialize a database under the db_path
107 static void create(std::string
const & db_path
);
108 /// Check the database stored under the db_path.
109 static void check(std::string
const & db_path
, size_t max_db_size
, size_t fs_block_size
);
110 bool IsEnabledDiskStore() const; ///< Check enabled of dist store.
112 void load(); ///< Load db from disk.
113 void save(); ///< Save db to disk.
114 size_t size(); ///< Get db size on disk in bytes.
115 /// Increase db size by the given file size and update size_file
116 void addSize(std::string
const & filename
);
117 /// Decrease db size by the given file size and update size_file
118 void subSize(std::string
const & filename
);
119 size_t readSize(); ///< Read size from file size_file
120 void writeSize(size_t db_size
); ///< Write size to file size_file.
121 size_t getFileSize(std::string
const & filename
); ///< get file size on disk.
122 size_t rebuildSize(); ///< Rebuild size_file
123 /// Only find certificate in current db and return it.
124 bool pure_find(std::string
const & host_name
, Security::CertPointer
& cert
, Ssl::EVP_PKEY_Pointer
& pkey
);
126 void deleteRow(const char **row
, int rowIndex
); ///< Delete a row from TXT_DB
127 bool deleteInvalidCertificate(); ///< Delete invalid certificate.
128 bool deleteOldestCertificate(); ///< Delete oldest certificate.
129 bool deleteByHostname(std::string
const & host
); ///< Delete using host name.
130 bool hasRows() const; ///< Whether the TXT_DB has stored items.
132 /// Removes the first matching row from TXT_DB. Ignores failures.
133 static void sq_TXT_DB_delete(TXT_DB
*db
, const char **row
);
134 /// Remove the row on position idx from TXT_DB. Ignores failures.
135 static void sq_TXT_DB_delete_row(TXT_DB
*db
, int idx
);
137 /// Callback hash function for serials. Used to create TXT_DB index of serials.
138 static unsigned long index_serial_hash(const char **a
);
139 /// Callback compare function for serials. Used to create TXT_DB index of serials.
140 static int index_serial_cmp(const char **a
, const char **b
);
141 /// Callback hash function for names. Used to create TXT_DB index of names..
142 static unsigned long index_name_hash(const char **a
);
143 /// Callback compare function for names. Used to create TXT_DB index of names..
144 static int index_name_cmp(const char **a
, const char **b
);
146 /// Definitions required by openSSL, to use the index_* functions defined above
147 ///with TXT_DB_create_index.
148 #if SQUID_USE_SSLLHASH_HACK
149 static unsigned long index_serial_hash_LHASH_HASH(const void *a
) {
150 return index_serial_hash((const char **)a
);
152 static int index_serial_cmp_LHASH_COMP(const void *arg1
, const void *arg2
) {
153 return index_serial_cmp((const char **)arg1
, (const char **)arg2
);
155 static unsigned long index_name_hash_LHASH_HASH(const void *a
) {
156 return index_name_hash((const char **)a
);
158 static int index_name_cmp_LHASH_COMP(const void *arg1
, const void *arg2
) {
159 return index_name_cmp((const char **)arg1
, (const char **)arg2
);
162 static IMPLEMENT_LHASH_HASH_FN(index_serial_hash
,const char **)
163 static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp
,const char **)
164 static IMPLEMENT_LHASH_HASH_FN(index_name_hash
,const char **)
165 static IMPLEMENT_LHASH_COMP_FN(index_name_cmp
,const char **)
168 static const std::string db_file
; ///< Base name of the database index file.
169 static const std::string cert_dir
; ///< Base name of the directory to store the certs.
170 static const std::string size_file
; ///< Base name of the file to store db size.
171 /// Min size of disk db. If real size < min_db_size the db will be disabled.
172 static const size_t min_db_size
;
174 const std::string db_path
; ///< The database directory.
175 const std::string db_full
; ///< Full path of the database index file.
176 const std::string cert_full
; ///< Full path of the directory to store the certs.
177 const std::string size_full
; ///< Full path of the file to store the db size.
179 TXT_DB_Pointer db
; ///< Database with certificates info.
180 const size_t max_db_size
; ///< Max size of db.
181 const size_t fs_block_size
; ///< File system block size.
182 mutable Lock dbLock
; ///< protects the database file
184 bool enabled_disk_store
; ///< The storage on the disk is enabled.
188 #endif // SQUID_SSL_CERTIFICATE_DB_H