mhd_tls_internal.h (10455B)
1 /* SPDX-License-Identifier: LGPL-2.1-or-later OR (GPL-2.0-or-later WITH eCos-exception-2.0) */ 2 /* 3 This file is part of GNU libmicrohttpd. 4 Copyright (C) 2024-2025 Evgeny Grin (Karlson2k) 5 6 GNU libmicrohttpd is free software; you can redistribute it and/or 7 modify it under the terms of the GNU Lesser General Public 8 License as published by the Free Software Foundation; either 9 version 2.1 of the License, or (at your option) any later version. 10 11 GNU libmicrohttpd is distributed in the hope that it will be useful, 12 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 Lesser General Public License for more details. 15 16 Alternatively, you can redistribute GNU libmicrohttpd and/or 17 modify it under the terms of the GNU General Public License as 18 published by the Free Software Foundation; either version 2 of 19 the License, or (at your option) any later version, together 20 with the eCos exception, as follows: 21 22 As a special exception, if other files instantiate templates or 23 use macros or inline functions from this file, or you compile this 24 file and link it with other works to produce a work based on this 25 file, this file does not by itself cause the resulting work to be 26 covered by the GNU General Public License. However the source code 27 for this file must still be made available in accordance with 28 section (3) of the GNU General Public License v2. 29 30 This exception does not invalidate any other reasons why a work 31 based on this file might be covered by the GNU General Public 32 License. 33 34 You should have received copies of the GNU Lesser General Public 35 License and the GNU General Public License along with this library; 36 if not, see <https://www.gnu.org/licenses/>. 37 */ 38 39 /** 40 * @file src/mhd2/mhd_tls_internal.h 41 * @brief The TLS handling internal functions and data 42 * @author Karlson2k (Evgeny Grin) 43 */ 44 45 #ifndef MHD_TLS_INTERNAL_H 46 #define MHD_TLS_INTERNAL_H 1 47 48 #include "mhd_sys_options.h" 49 50 #ifndef MHD_SUPPORT_HTTPS 51 # error This header should be used only if HTTPS is enabled 52 #endif 53 54 #ifdef mhd_HAVE_TLS_ACME 55 # include "sys_bool_type.h" 56 # include "sys_null_macro.h" 57 #endif 58 #include "sys_sizet_type.h" 59 60 #include "mhd_str_macros.h" 61 62 #include "mhd_tls_enums.h" 63 64 /** 65 * Registered ALPN value for HTTP/1.0 66 */ 67 #define mhd_ALPN_H1_0 "http/1.0" 68 69 /** 70 * Registered ALPN value for HTTP/1.1 71 */ 72 #define mhd_ALPN_H1_1 "http/1.1" 73 74 /** 75 * Registered ALPN value for HTTP/2 76 */ 77 #define mhd_ALPN_H2 "h2" 78 79 /** 80 * Registered ALPN value for HTTP/3 81 */ 82 #define mhd_ALPN_H3 "h3" 83 84 /** 85 * The length of #mhd_ALPN_H1_0 86 */ 87 #define mhd_ALPN_H1_0_LEN mhd_SSTR_LEN (mhd_ALPN_H1_0) 88 89 /** 90 * The length of #mhd_ALPN_H1_1 91 */ 92 #define mhd_ALPN_H1_1_LEN mhd_SSTR_LEN (mhd_ALPN_H1_1) 93 94 /** 95 * The length of #mhd_ALPN_H2_1 96 */ 97 #define mhd_ALPN_H2_LEN mhd_SSTR_LEN (mhd_ALPN_H2) 98 99 /** 100 * The length of #mhd_ALPN_H2_1 101 */ 102 #define mhd_ALPN_H3_LEN mhd_SSTR_LEN (mhd_ALPN_H3) 103 104 #ifdef mhd_HAVE_TLS_ACME 105 /** 106 * Registered ALPN value for ACME TLS-ALPN-01 challenge 107 */ 108 # define mhd_ALPN_ACME "acme-tls/1" 109 /** 110 * The length of #mhd_ALPN_ACME 111 */ 112 # define mhd_ALPN_ACME_LEN mhd_SSTR_LEN (mhd_ALPN_ACME) 113 #endif /* mhd_HAVE_TLS_ACME */ 114 115 /** 116 * Decode provided ALPN identifier 117 * @param alpn_id_size the size in bytes of the @a alpn_id 118 * @param alpn_id the ALPN identifier, does not need to be zero-terminated, 119 * could be NULL 120 * @return the decoded protocol, 121 * #mhd_TLS_ALPN_PROT_NOT_SELECTED if @a alpn_id is NULL, 122 * #mhd_TLS_ALPN_PROT_ERROR if @a alpn_id does not match any known 123 * string identifier, 124 */ 125 MHD_INTERNAL enum mhd_TlsAlpnProt 126 mhd_tls_alpn_decode_n (size_t alpn_id_size, 127 const unsigned char *alpn_id) 128 MHD_FN_PAR_IN_SIZE_ (2, 1); 129 130 131 #ifdef mhd_HAVE_TLS_ACME 132 133 # if defined(_MSC_FULL_VER) 134 # pragma warning(push) 135 /* Disable C4505 "unreferenced local function has been removed" */ 136 # pragma warning(disable:4505) 137 # endif /* _MSC_FULL_VER */ 138 139 struct mhd_TlsCertsList; /* Forward declaration */ 140 union mhd_TlsCredDataPtr; /* Forward declaration */ 141 142 /** 143 * State of an incremental ACME TLS-ALPN-01 ClientHello check. 144 * 145 * Initialise with #mhd_tls_acme_check_ext_init() before checking the first 146 * extension, update with #mhd_tls_acme_check_ext() for each extension, and 147 * finalise with #mhd_tls_acme_check_ext_finish(). 148 */ 149 struct mhd_TlsClientHelloAcmeCheckData 150 { 151 /** 152 * 'true' if the ClientHello cannot be an ACME TLS-ALPN-01 challenge 153 */ 154 bool is_rejected; 155 /** 156 * 'true' if the ClientHello has an ALPN extension containing only 157 * #mhd_ALPN_ACME 158 */ 159 bool alpn_match; 160 161 /** 162 * The credentials selected by the SNI extension, or NULL if none are 163 * selected. 164 * @warning While this pointer is non-NULL, the ACME certificate list remains 165 * read-locked. 166 */ 167 const union mhd_TlsCredDataPtr *acme_cred; 168 169 /** 170 * The list of ACME certificates to check against 171 */ 172 struct mhd_TlsCertsList *certs_list; 173 }; 174 175 /** 176 * Check whether the provided ALPN extension data contains only the 177 * ACME TLS-ALPN-01 protocol, as required by RFC 8737, section 3. 178 * 179 * @param ext_alpn_data_size the size in bytes of the @p ext_alpn_data 180 * @param ext_alpn_data the complete ALPN extension data 181 * @return 'true' if the provided ALPN extension data is the ACME TLS-ALPN-01 182 * challenge, 183 * 'false' otherwise 184 */ 185 MHD_INTERNAL bool 186 mhd_tls_acme_check_ext_alpn (size_t ext_alpn_data_size, 187 const unsigned char *ext_alpn_data) 188 MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (2, 1); 189 190 /** 191 * Check whether the provided SNI extension data has exactly one host name, 192 * which is in the list of the expected host names for the ACME TLS-ALPN-01 193 * challenge. 194 * 195 * @param ext_sni_data_size the size in bytes of the @p ext_sni_data 196 * @param ext_sni_data the complete SNI extension data 197 * @param acme_certs the list of ACME certificates to check against 198 * @return NULL if the provided SNI extension data does not match, 199 * a non-NULL pointer to the matching ACME credentials otherwise 200 * @warning If a non-NULL pointer is returned, the daemon's ACME certificate 201 * list remains read-locked and must be unlocked with 202 * #mhd_daemon_acme_cert_r_unlock(). 203 */ 204 MHD_INTERNAL const union mhd_TlsCredDataPtr * 205 mhd_tls_acme_check_ext_sni (size_t ext_sni_data_size, 206 const unsigned char *ext_sni_data, 207 struct mhd_TlsCertsList *acme_certs) 208 MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (2, 1); 209 210 /** 211 * Initialise the state of an ACME TLS-ALPN-01 ClientHello check. 212 * 213 * @param[out] check the state structure to initialise 214 * @param certs_list the list of ACME certificates 215 */ 216 mhd_static_inline MHD_FN_PAR_OUT_ (1) void 217 mhd_tls_acme_check_ext_init ( 218 struct mhd_TlsClientHelloAcmeCheckData *restrict check, 219 struct mhd_TlsCertsList *restrict certs_list) 220 { 221 check->is_rejected = false; 222 check->alpn_match = false; 223 check->acme_cred = (const union mhd_TlsCredDataPtr *)NULL; 224 check->certs_list = certs_list; 225 } 226 227 228 /** 229 * Process one TLS ClientHello extension while checking for an 230 * ACME TLS-ALPN-01 challenge. 231 * 232 * Call this function in extension order for every extension in the ClientHello 233 * message. 234 * 235 * @param ext_id the extension identifier 236 * @param ext_data_size the size in bytes of the @p ext_data 237 * @param ext_data the complete extension data 238 * @param[in,out] check the structure to keep the state of the check 239 * @return 'true' if the extension matches the required form and checking 240 * should continue, 241 * 'false' if the ClientHello cannot be an ACME TLS-ALPN-01 challenge 242 */ 243 MHD_INTERNAL bool 244 mhd_tls_acme_check_ext (unsigned int ext_id, 245 size_t ext_data_size, 246 const unsigned char *ext_data, 247 struct mhd_TlsClientHelloAcmeCheckData *restrict check) 248 MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (3, 2) MHD_FN_PAR_INOUT_ (4); 249 250 /** 251 * Finalise the check of the TLS ClientHello extensions for 252 * the ACME TLS-ALPN-01 challenge. 253 * 254 * This function must be called after all extensions in the ClientHello message 255 * have been processed or when checking stopped after a rejection. 256 * 257 * @param check the structure that keeps the state of the check 258 * @param parse_succeeded set to 'true' if the ClientHello was successfully 259 * parsed, 260 * set to 'false' if parsing of the ClientHello failed 261 * @return non-NULL if the ClientHello message is recognised as a TLS-ALPN-01 262 * challenge and the ACME credentials are selected, 263 * NULL otherwise 264 * @warning If a non-NULL pointer is returned, the daemon's ACME certificate 265 * list remains read-locked and must be unlocked with 266 * #mhd_daemon_acme_cert_r_unlock(). 267 */ 268 MHD_INTERNAL const union mhd_TlsCredDataPtr * 269 mhd_tls_acme_check_ext_finish ( 270 struct mhd_TlsClientHelloAcmeCheckData *restrict check, 271 bool parse_succeeded) 272 MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_INOUT_ (1); 273 274 275 # ifdef mhd_HAVE_TLS_MHD_CLIENTHELLO_BODY_PARSE 276 /** 277 * Parse the entire TLS ClientHello message body and check whether it is the 278 * ACME TLS-ALPN-01 challenge. 279 * 280 * @param body_size the size in bytes of the @p body 281 * @param body the TLS ClientHello message body, not including the handshake 282 * header 283 * @param acme_certs the list of ACME certificates to check against 284 * @return non-NULL if the ClientHello message is recognised as a TLS-ALPN-01 285 * challenge and the ACME credentials are selected, 286 * NULL otherwise 287 * @warning If a non-NULL pointer is returned, the daemon's ACME certificate 288 * list remains read-locked and must be unlocked with 289 * #mhd_daemon_acme_cert_r_unlock(). 290 */ 291 MHD_INTERNAL const union mhd_TlsCredDataPtr * 292 mhd_tls_acme_check_clienthello_body ( 293 size_t body_size, 294 const unsigned char *restrict body, 295 struct mhd_TlsCertsList *restrict acme_certs) 296 MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (2, 1); 297 # endif /* mhd_HAVE_TLS_MHD_CLIENTHELLO_BODY_PARSE */ 298 299 # if defined(_MSC_FULL_VER) 300 /* Restore warnings */ 301 # pragma warning(pop) 302 # endif /* _MSC_FULL_VER */ 303 304 #endif /* mhd_HAVE_TLS_ACME */ 305 306 #endif /* ! MHD_TLS_INTERNAL_H */