mhd_tls_internal.h (10493B)
1 /* SPDX-License-Identifier: LGPL-2.1-or-later OR (GPL-2.0-or-later WITH eCos-exception-2.0) */ 2 /* 3 This file is part of GNU libmicrohttpd. 4 Copyright (C) 2024-2025 Evgeny Grin (Karlson2k) 5 6 GNU libmicrohttpd is free software; you can redistribute it and/or 7 modify it under the terms of the GNU Lesser General Public 8 License as published by the Free Software Foundation; either 9 version 2.1 of the License, or (at your option) any later version. 10 11 GNU libmicrohttpd is distributed in the hope that it will be useful, 12 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 Lesser General Public License for more details. 15 16 Alternatively, you can redistribute GNU libmicrohttpd and/or 17 modify it under the terms of the GNU General Public License as 18 published by the Free Software Foundation; either version 2 of 19 the License, or (at your option) any later version, together 20 with the eCos exception, as follows: 21 22 As a special exception, if other files instantiate templates or 23 use macros or inline functions from this file, or you compile this 24 file and link it with other works to produce a work based on this 25 file, this file does not by itself cause the resulting work to be 26 covered by the GNU General Public License. However the source code 27 for this file must still be made available in accordance with 28 section (3) of the GNU General Public License v2. 29 30 This exception does not invalidate any other reasons why a work 31 based on this file might be covered by the GNU General Public 32 License. 33 34 You should have received copies of the GNU Lesser General Public 35 License and the GNU General Public License along with this library; 36 if not, see <https://www.gnu.org/licenses/>. 37 */ 38 39 /** 40 * @file src/mhd2/mhd_tls_internal.h 41 * @brief The TLS handling internal functions and data 42 * @author Karlson2k (Evgeny Grin) 43 */ 44 45 #ifndef MHD_TLS_INTERNAL_H 46 #define MHD_TLS_INTERNAL_H 1 47 48 #include "mhd_sys_options.h" 49 50 #ifndef MHD_SUPPORT_HTTPS 51 # error This header should be used only if HTTPS is enabled 52 #endif 53 54 #ifdef mhd_HAVE_TLS_ACME 55 # include "sys_bool_type.h" 56 # include "sys_null_macro.h" 57 #endif 58 #include "sys_sizet_type.h" 59 60 #include "mhd_str_macros.h" 61 62 #include "mhd_tls_enums.h" 63 64 /** 65 * Registered ALPN value for HTTP/1.0 66 */ 67 #define mhd_ALPN_H1_0 "http/1.0" 68 69 /** 70 * Registered ALPN value for HTTP/1.1 71 */ 72 #define mhd_ALPN_H1_1 "http/1.1" 73 74 /** 75 * Registered ALPN value for HTTP/2 76 */ 77 #define mhd_ALPN_H2 "h2" 78 79 /** 80 * Registered ALPN value for HTTP/3 81 */ 82 #define mhd_ALPN_H3 "h3" 83 84 /** 85 * The length of #mhd_ALPN_H1_0 86 */ 87 #define mhd_ALPN_H1_0_LEN mhd_SSTR_LEN (mhd_ALPN_H1_0) 88 89 /** 90 * The length of #mhd_ALPN_H1_1 91 */ 92 #define mhd_ALPN_H1_1_LEN mhd_SSTR_LEN (mhd_ALPN_H1_1) 93 94 /** 95 * The length of #mhd_ALPN_H2_1 96 */ 97 #define mhd_ALPN_H2_LEN mhd_SSTR_LEN (mhd_ALPN_H2) 98 99 /** 100 * The length of #mhd_ALPN_H2_1 101 */ 102 #define mhd_ALPN_H3_LEN mhd_SSTR_LEN (mhd_ALPN_H3) 103 104 #ifdef mhd_HAVE_TLS_ACME 105 /** 106 * Registered ALPN value for ACME TLS-ALPN-01 challenge 107 */ 108 # define mhd_ALPN_ACME "acme-tls/1" 109 /** 110 * The length of #mhd_ALPN_ACME 111 */ 112 # define mhd_ALPN_ACME_LEN mhd_SSTR_LEN (mhd_ALPN_ACME) 113 #endif /* mhd_HAVE_TLS_ACME */ 114 115 /** 116 * Decode provided ALPN identifier 117 * @param alpn_id_size the size in bytes of the @a alpn_id 118 * @param alpn_id the ALPN identifier, does not need to be zero-terminated, 119 * could be NULL 120 * @return the decoded protocol, 121 * #mhd_TLS_ALPN_PROT_NOT_SELECTED if @a alpn_id is NULL, 122 * #mhd_TLS_ALPN_PROT_ERROR if @a alpn_id does not match any known 123 * string identifier, 124 */ 125 MHD_INTERNAL enum mhd_TlsAlpnProt 126 mhd_tls_alpn_decode_n (size_t alpn_id_size, 127 const unsigned char *alpn_id) 128 MHD_FN_PAR_NONNULL_IF_NONZERO_ (2, 1) 129 MHD_FN_PAR_IN_SIZE_ (2, 1); 130 131 132 #ifdef mhd_HAVE_TLS_ACME 133 134 # if defined(_MSC_FULL_VER) 135 # pragma warning(push) 136 /* Disable C4505 "unreferenced local function has been removed" */ 137 # pragma warning(disable:4505) 138 # endif /* _MSC_FULL_VER */ 139 140 struct mhd_TlsCertsList; /* Forward declaration */ 141 union mhd_TlsCredDataPtr; /* Forward declaration */ 142 143 /** 144 * State of an incremental ACME TLS-ALPN-01 ClientHello check. 145 * 146 * Initialise with #mhd_tls_acme_check_ext_init() before checking the first 147 * extension, update with #mhd_tls_acme_check_ext() for each extension, and 148 * finalise with #mhd_tls_acme_check_ext_finish(). 149 */ 150 struct mhd_TlsClientHelloAcmeCheckData 151 { 152 /** 153 * 'true' if the ClientHello cannot be an ACME TLS-ALPN-01 challenge 154 */ 155 bool is_rejected; 156 /** 157 * 'true' if the ClientHello has an ALPN extension containing only 158 * #mhd_ALPN_ACME 159 */ 160 bool alpn_match; 161 162 /** 163 * The credentials selected by the SNI extension, or NULL if none are 164 * selected. 165 * @warning While this pointer is non-NULL, the ACME certificate list remains 166 * read-locked. 167 */ 168 const union mhd_TlsCredDataPtr *acme_cred; 169 170 /** 171 * The list of ACME certificates to check against 172 */ 173 struct mhd_TlsCertsList *certs_list; 174 }; 175 176 /** 177 * Check whether the provided ALPN extension data contains only the 178 * ACME TLS-ALPN-01 protocol, as required by RFC 8737, section 3. 179 * 180 * @param ext_alpn_data_size the size in bytes of the @p ext_alpn_data 181 * @param ext_alpn_data the complete ALPN extension data 182 * @return 'true' if the provided ALPN extension data is the ACME TLS-ALPN-01 183 * challenge, 184 * 'false' otherwise 185 */ 186 MHD_INTERNAL bool 187 mhd_tls_acme_check_ext_alpn (size_t ext_alpn_data_size, 188 const unsigned char *ext_alpn_data) 189 MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (2, 1); 190 191 /** 192 * Check whether the provided SNI extension data has exactly one host name, 193 * which is in the list of the expected host names for the ACME TLS-ALPN-01 194 * challenge. 195 * 196 * @param ext_sni_data_size the size in bytes of the @p ext_sni_data 197 * @param ext_sni_data the complete SNI extension data 198 * @param acme_certs the list of ACME certificates to check against 199 * @return NULL if the provided SNI extension data does not match, 200 * a non-NULL pointer to the matching ACME credentials otherwise 201 * @warning If a non-NULL pointer is returned, the daemon's ACME certificate 202 * list remains read-locked and must be unlocked with 203 * #mhd_daemon_acme_cert_r_unlock(). 204 */ 205 MHD_INTERNAL const union mhd_TlsCredDataPtr * 206 mhd_tls_acme_check_ext_sni (size_t ext_sni_data_size, 207 const unsigned char *ext_sni_data, 208 struct mhd_TlsCertsList *acme_certs) 209 MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (2, 1); 210 211 /** 212 * Initialise the state of an ACME TLS-ALPN-01 ClientHello check. 213 * 214 * @param[out] check the state structure to initialise 215 * @param certs_list the list of ACME certificates 216 */ 217 mhd_static_inline MHD_FN_PAR_OUT_ (1) void 218 mhd_tls_acme_check_ext_init ( 219 struct mhd_TlsClientHelloAcmeCheckData *restrict check, 220 struct mhd_TlsCertsList *restrict certs_list) 221 { 222 check->is_rejected = false; 223 check->alpn_match = false; 224 check->acme_cred = (const union mhd_TlsCredDataPtr *)NULL; 225 check->certs_list = certs_list; 226 } 227 228 229 /** 230 * Process one TLS ClientHello extension while checking for an 231 * ACME TLS-ALPN-01 challenge. 232 * 233 * Call this function in extension order for every extension in the ClientHello 234 * message. 235 * 236 * @param ext_id the extension identifier 237 * @param ext_data_size the size in bytes of the @p ext_data 238 * @param ext_data the complete extension data 239 * @param[in,out] check the structure to keep the state of the check 240 * @return 'true' if the extension matches the required form and checking 241 * should continue, 242 * 'false' if the ClientHello cannot be an ACME TLS-ALPN-01 challenge 243 */ 244 MHD_INTERNAL bool 245 mhd_tls_acme_check_ext (unsigned int ext_id, 246 size_t ext_data_size, 247 const unsigned char *ext_data, 248 struct mhd_TlsClientHelloAcmeCheckData *restrict check) 249 MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (3, 2) MHD_FN_PAR_INOUT_ (4); 250 251 /** 252 * Finalise the check of the TLS ClientHello extensions for 253 * the ACME TLS-ALPN-01 challenge. 254 * 255 * This function must be called after all extensions in the ClientHello message 256 * have been processed or when checking stopped after a rejection. 257 * 258 * @param check the structure that keeps the state of the check 259 * @param parse_succeeded set to 'true' if the ClientHello was successfully 260 * parsed, 261 * set to 'false' if parsing of the ClientHello failed 262 * @return non-NULL if the ClientHello message is recognised as a TLS-ALPN-01 263 * challenge and the ACME credentials are selected, 264 * NULL otherwise 265 * @warning If a non-NULL pointer is returned, the daemon's ACME certificate 266 * list remains read-locked and must be unlocked with 267 * #mhd_daemon_acme_cert_r_unlock(). 268 */ 269 MHD_INTERNAL const union mhd_TlsCredDataPtr * 270 mhd_tls_acme_check_ext_finish ( 271 struct mhd_TlsClientHelloAcmeCheckData *restrict check, 272 bool parse_succeeded) 273 MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_INOUT_ (1); 274 275 276 # ifdef mhd_HAVE_TLS_MHD_CLIENTHELLO_BODY_PARSE 277 /** 278 * Parse the entire TLS ClientHello message body and check whether it is the 279 * ACME TLS-ALPN-01 challenge. 280 * 281 * @param body_size the size in bytes of the @p body 282 * @param body the TLS ClientHello message body, not including the handshake 283 * header 284 * @param acme_certs the list of ACME certificates to check against 285 * @return non-NULL if the ClientHello message is recognised as a TLS-ALPN-01 286 * challenge and the ACME credentials are selected, 287 * NULL otherwise 288 * @warning If a non-NULL pointer is returned, the daemon's ACME certificate 289 * list remains read-locked and must be unlocked with 290 * #mhd_daemon_acme_cert_r_unlock(). 291 */ 292 MHD_INTERNAL const union mhd_TlsCredDataPtr * 293 mhd_tls_acme_check_clienthello_body ( 294 size_t body_size, 295 const unsigned char *restrict body, 296 struct mhd_TlsCertsList *restrict acme_certs) 297 MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_ MHD_FN_PAR_IN_SIZE_ (2, 1); 298 # endif /* mhd_HAVE_TLS_MHD_CLIENTHELLO_BODY_PARSE */ 299 300 # if defined(_MSC_FULL_VER) 301 /* Restore warnings */ 302 # pragma warning(pop) 303 # endif /* _MSC_FULL_VER */ 304 305 #endif /* mhd_HAVE_TLS_ACME */ 306 307 #endif /* ! MHD_TLS_INTERNAL_H */