| 1 | #ifndef NETDATA_SECURITY_H |
| 2 | #define NETDATA_SECURITY_H |
| 3 | |
| 4 | typedef enum __attribute__((packed)) { |
| 5 | NETDATA_SSL_STATE_NOT_SSL = 1, // This connection is not SSL |
| 6 | NETDATA_SSL_STATE_INIT, // SSL handshake is initialized |
| 7 | NETDATA_SSL_STATE_FAILED, // SSL handshake failed |
| 8 | NETDATA_SSL_STATE_COMPLETE, // SSL handshake successful |
| 9 | } NETDATA_SSL_STATE; |
| 10 | |
| 11 | #define NETDATA_SSL_WEB_SERVER_CTX 0 |
| 12 | #define NETDATA_SSL_STREAMING_SENDER_CTX 1 |
| 13 | #define NETDATA_SSL_EXPORTING_CTX 2 |
| 14 | |
| 15 | typedef struct netdata_ssl { |
| 16 | SSL *conn; // SSL connection |
| 17 | NETDATA_SSL_STATE state; // The state for SSL connection |
| 18 | unsigned long ssl_errno; // The SSL errno of the last SSL call |
| 19 | } NETDATA_SSL; |
| 20 | |
| 21 | #define NETDATA_SSL_UNSET_CONNECTION (NETDATA_SSL){ .conn = NULL, .state = NETDATA_SSL_STATE_NOT_SSL, .ssl_errno = 0 } |
| 22 | |
| 23 | #define SSL_connection(ssl) ((ssl)->conn && (ssl)->state != NETDATA_SSL_STATE_NOT_SSL) |
| 24 | |
| 25 | extern SSL_CTX *netdata_ssl_exporting_ctx; |
| 26 | extern SSL_CTX *netdata_ssl_streaming_sender_ctx; |
| 27 | extern SSL_CTX *netdata_ssl_web_server_ctx; |
| 28 | extern const char *netdata_ssl_security_key; |
| 29 | extern const char *netdata_ssl_security_cert; |
| 30 | extern const char *tls_version; |
| 31 | extern const char *tls_ciphers; |
| 32 | extern bool netdata_ssl_validate_certificate; |
| 33 | extern bool netdata_ssl_validate_certificate_sender; |
| 34 | int ssl_security_location_for_context(SSL_CTX *ctx, const char *file, const char *path); |
| 35 | |
| 36 | void netdata_ssl_initialize_openssl(); |
| 37 | void netdata_ssl_cleanup(); |
| 38 | void netdata_ssl_initialize_ctx(int selector); |
| 39 | int security_test_certificate(SSL *ssl); |
| 40 | SSL_CTX * netdata_ssl_create_client_ctx(unsigned long mode); |
| 41 | |
| 42 | bool netdata_ssl_connect(NETDATA_SSL *ssl); |
| 43 | bool netdata_ssl_accept(NETDATA_SSL *ssl); |
| 44 | |
| 45 | bool netdata_ssl_open(NETDATA_SSL *ssl, SSL_CTX *ctx, int fd); |
| 46 | bool netdata_ssl_open_ext(NETDATA_SSL *ssl, SSL_CTX *ctx, int fd, const unsigned char *alpn_protos, unsigned int alpn_protos_len); |
| 47 | void netdata_ssl_close(NETDATA_SSL *ssl); |
| 48 | |
| 49 | ssize_t netdata_ssl_read(NETDATA_SSL *ssl, void *buf, size_t num); |
| 50 | ssize_t netdata_ssl_write(NETDATA_SSL *ssl, const void *buf, size_t num); |
| 51 | ssize_t netdata_ssl_peek(NETDATA_SSL *ssl, void *buf, size_t num); |
| 52 | |
| 53 | ssize_t netdata_ssl_pending(NETDATA_SSL *ssl); |
| 54 | bool netdata_ssl_has_pending(NETDATA_SSL *ssl); |
| 55 | |
| 56 | void netdata_ssl_log_verify_error(X509_STORE_CTX *ctx); |
| 57 | |
| 58 | #endif //NETDATA_SECURITY_H |