1 #ifndef _TLS_PROXY_H_INCLUDED_ 2 #define _TLS_PROXY_H_INCLUDED_ 3 4 /*++ 5 /* NAME 6 /* tls_proxy_clnt 3h 7 /* SUMMARY 8 /* postscreen TLS proxy support 9 /* SYNOPSIS 10 /* #include <tls_proxy_clnt.h> 11 /* DESCRIPTION 12 /* .nf 13 14 /* 15 * Utility library. 16 */ 17 #include <vstream.h> 18 #include <attr.h> 19 20 /* 21 * TLS library. 22 */ 23 #include <tls.h> 24 25 /* 26 * External interface. 27 */ 28 #define TLS_PROXY_FLAG_ROLE_SERVER (1<<0) /* request server role */ 29 #define TLS_PROXY_FLAG_ROLE_CLIENT (1<<1) /* request client role */ 30 #define TLS_PROXY_FLAG_SEND_CONTEXT (1<<2) /* send TLS context */ 31 32 #ifdef USE_TLS 33 34 /* 35 * TLS_CLIENT_PARAMS structure. If this changes, update all 36 * TLS_CLIENT_PARAMS related functions in tls_proxy_client_*.c. 37 * 38 * In the serialization these attributes are identified by their configuration 39 * parameter names. 40 * 41 * NOTE: this does not include openssl_path. 42 * 43 * TODO: TLS_SERVER_PARAM structure, like TLS_CLIENT_PARAMS plus 44 * VAR_TLS_SERVER_SNI_MAPS. 45 */ 46 typedef struct TLS_CLIENT_PARAMS { 47 char *tls_high_clist; 48 char *tls_medium_clist; 49 char *tls_low_clist; 50 char *tls_export_clist; 51 char *tls_null_clist; 52 char *tls_eecdh_auto; 53 char *tls_eecdh_strong; 54 char *tls_eecdh_ultra; 55 char *tls_bug_tweaks; 56 char *tls_ssl_options; 57 char *tls_dane_digests; 58 char *tls_mgr_service; 59 char *tls_tkt_cipher; 60 int tls_daemon_rand_bytes; 61 int tls_append_def_CA; 62 int tls_bc_pkey_fprint; 63 int tls_preempt_clist; 64 int tls_multi_wildcard; 65 } TLS_CLIENT_PARAMS; 66 67 #define TLS_PROXY_PARAMS(params, a1, a2, a3, a4, a5, a6, a7, a8, \ 68 a9, a10, a11, a12, a13, a14, a15, a16, a17, a18) \ 69 (((params)->a1), ((params)->a2), ((params)->a3), \ 70 ((params)->a4), ((params)->a5), ((params)->a6), ((params)->a7), \ 71 ((params)->a8), ((params)->a9), ((params)->a10), ((params)->a11), \ 72 ((params)->a12), ((params)->a13), ((params)->a14), ((params)->a15), \ 73 ((params)->a16), ((params)->a17), ((params)->a18)) 74 75 /* 76 * tls_proxy_client_param_misc.c, tls_proxy_client_param_print.c, and 77 * tls_proxy_client_param_scan.c. 78 */ 79 extern TLS_CLIENT_PARAMS *tls_proxy_client_param_from_config(TLS_CLIENT_PARAMS *); 80 extern char *tls_proxy_client_param_serialize(ATTR_PRINT_COMMON_FN, VSTRING *, const TLS_CLIENT_PARAMS *); 81 extern int tls_proxy_client_param_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 82 extern void tls_proxy_client_param_free(TLS_CLIENT_PARAMS *); 83 extern int tls_proxy_client_param_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 84 85 /* 86 * Functions that handle TLS_XXX_INIT_PROPS and TLS_XXX_START_PROPS. These 87 * data structures are defined elsewhere, because they are also used in 88 * non-proxied requests. 89 */ 90 #define tls_proxy_legacy_open(service, flags, peer_stream, peer_addr, \ 91 peer_port, timeout, serverid) \ 92 tls_proxy_open((service), (flags), (peer_stream), (peer_addr), \ 93 (peer_port), (timeout), (timeout), (serverid), \ 94 (void *) 0, (void *) 0, (void *) 0) 95 96 extern VSTREAM *tls_proxy_open(const char *, int, VSTREAM *, const char *, 97 const char *, int, int, const char *, 98 void *, void *, void *); 99 100 #define TLS_PROXY_CLIENT_INIT_PROPS(props, a1, a2, a3, a4, a5, a6, a7, a8, \ 101 a9, a10, a11, a12, a13, a14) \ 102 (((props)->a1), ((props)->a2), ((props)->a3), \ 103 ((props)->a4), ((props)->a5), ((props)->a6), ((props)->a7), \ 104 ((props)->a8), ((props)->a9), ((props)->a10), ((props)->a11), \ 105 ((props)->a12), ((props)->a13), ((props)->a14)) 106 107 #define TLS_PROXY_CLIENT_START_PROPS(props, a1, a2, a3, a4, a5, a6, a7, a8, \ 108 a9, a10, a11, a12, a13, a14) \ 109 (((props)->a1), ((props)->a2), ((props)->a3), \ 110 ((props)->a4), ((props)->a5), ((props)->a6), ((props)->a7), \ 111 ((props)->a8), ((props)->a9), ((props)->a10), ((props)->a11), \ 112 ((props)->a12), ((props)->a13), ((props)->a14)) 113 114 extern TLS_SESS_STATE *tls_proxy_context_receive(VSTREAM *); 115 extern void tls_proxy_context_free(TLS_SESS_STATE *); 116 extern int tls_proxy_context_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 117 extern int tls_proxy_context_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 118 119 extern int tls_proxy_client_init_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 120 extern int tls_proxy_client_init_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 121 extern void tls_proxy_client_init_free(TLS_CLIENT_INIT_PROPS *); 122 extern char *tls_proxy_client_init_serialize(ATTR_PRINT_COMMON_FN, VSTRING *, const TLS_CLIENT_INIT_PROPS *); 123 124 extern int tls_proxy_client_start_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 125 extern int tls_proxy_client_start_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 126 extern void tls_proxy_client_start_free(TLS_CLIENT_START_PROPS *); 127 128 extern int tls_proxy_server_init_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 129 extern int tls_proxy_server_init_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 130 extern void tls_proxy_server_init_free(TLS_SERVER_INIT_PROPS *); 131 132 extern int tls_proxy_server_start_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 133 extern int tls_proxy_server_start_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 134 135 extern void tls_proxy_server_start_free(TLS_SERVER_START_PROPS *); 136 137 #endif /* USE_TLS */ 138 139 /* 140 * TLSPROXY attributes, unconditionally exposed. 141 */ 142 #define TLS_ATTR_REMOTE_ENDPT "remote_endpoint" /* name[addr]:port */ 143 #define TLS_ATTR_FLAGS "flags" 144 #define TLS_ATTR_TIMEOUT "timeout" 145 #define TLS_ATTR_SERVERID "serverid" 146 147 #ifdef USE_TLS 148 149 /* 150 * Misc attributes. 151 */ 152 #define TLS_ATTR_COUNT "count" 153 154 /* 155 * TLS_SESS_STATE attributes. 156 */ 157 #define TLS_ATTR_PEER_CN "peer_CN" 158 #define TLS_ATTR_ISSUER_CN "issuer_CN" 159 #define TLS_ATTR_PEER_CERT_FPT "peer_fingerprint" 160 #define TLS_ATTR_PEER_PKEY_FPT "peer_pubkey_fingerprint" 161 #define TLS_ATTR_SEC_LEVEL "level" 162 #define TLS_ATTR_PEER_STATUS "peer_status" 163 #define TLS_ATTR_CIPHER_PROTOCOL "cipher_protocol" 164 #define TLS_ATTR_CIPHER_NAME "cipher_name" 165 #define TLS_ATTR_CIPHER_USEBITS "cipher_usebits" 166 #define TLS_ATTR_CIPHER_ALGBITS "cipher_algbits" 167 #define TLS_ATTR_KEX_NAME "key_exchange" 168 #define TLS_ATTR_KEX_CURVE "key_exchange_curve" 169 #define TLS_ATTR_KEX_BITS "key_exchange_bits" 170 #define TLS_ATTR_CLNT_SIG_NAME "clnt_signature" 171 #define TLS_ATTR_CLNT_SIG_CURVE "clnt_signature_curve" 172 #define TLS_ATTR_CLNT_SIG_BITS "clnt_signature_bits" 173 #define TLS_ATTR_CLNT_SIG_DGST "clnt_signature_digest" 174 #define TLS_ATTR_SRVR_SIG_NAME "srvr_signature" 175 #define TLS_ATTR_SRVR_SIG_CURVE "srvr_signature_curve" 176 #define TLS_ATTR_SRVR_SIG_BITS "srvr_signature_bits" 177 #define TLS_ATTR_SRVR_SIG_DGST "srvr_signature_digest" 178 #define TLS_ATTR_NAMADDR "namaddr" 179 180 /* 181 * TLS_SERVER_INIT_PROPS attributes. 182 */ 183 #define TLS_ATTR_LOG_PARAM "log_param" 184 #define TLS_ATTR_LOG_LEVEL "log_level" 185 #define TLS_ATTR_VERIFYDEPTH "verifydepth" 186 #define TLS_ATTR_CACHE_TYPE "cache_type" 187 #define TLS_ATTR_SET_SESSID "set_sessid" 188 #define TLS_ATTR_CHAIN_FILES "chain_files" 189 #define TLS_ATTR_CERT_FILE "cert_file" 190 #define TLS_ATTR_KEY_FILE "key_file" 191 #define TLS_ATTR_DCERT_FILE "dcert_file" 192 #define TLS_ATTR_DKEY_FILE "dkey_file" 193 #define TLS_ATTR_ECCERT_FILE "eccert_file" 194 #define TLS_ATTR_ECKEY_FILE "eckey_file" 195 #define TLS_ATTR_CAFILE "CAfile" 196 #define TLS_ATTR_CAPATH "CApath" 197 #define TLS_ATTR_PROTOCOLS "protocols" 198 #define TLS_ATTR_EECDH_GRADE "eecdh_grade" 199 #define TLS_ATTR_DH1K_PARAM_FILE "dh1024_param_file" 200 #define TLS_ATTR_DH512_PARAM_FILE "dh512_param_file" 201 #define TLS_ATTR_ASK_CCERT "ask_ccert" 202 #define TLS_ATTR_MDALG "mdalg" 203 204 /* 205 * TLS_SERVER_START_PROPS attributes. 206 */ 207 #define TLS_ATTR_TIMEOUT "timeout" 208 #define TLS_ATTR_REQUIRECERT "requirecert" 209 #define TLS_ATTR_SERVERID "serverid" 210 #define TLS_ATTR_NAMADDR "namaddr" 211 #define TLS_ATTR_CIPHER_GRADE "cipher_grade" 212 #define TLS_ATTR_CIPHER_EXCLUSIONS "cipher_exclusions" 213 #define TLS_ATTR_MDALG "mdalg" 214 215 /* 216 * TLS_CLIENT_INIT_PROPS attributes. 217 */ 218 #define TLS_ATTR_LOG_PARAM "log_param" 219 #define TLS_ATTR_LOG_LEVEL "log_level" 220 #define TLS_ATTR_VERIFYDEPTH "verifydepth" 221 #define TLS_ATTR_CACHE_TYPE "cache_type" 222 #define TLS_ATTR_CHAIN_FILES "chain_files" 223 #define TLS_ATTR_CERT_FILE "cert_file" 224 #define TLS_ATTR_KEY_FILE "key_file" 225 #define TLS_ATTR_DCERT_FILE "dcert_file" 226 #define TLS_ATTR_DKEY_FILE "dkey_file" 227 #define TLS_ATTR_ECCERT_FILE "eccert_file" 228 #define TLS_ATTR_ECKEY_FILE "eckey_file" 229 #define TLS_ATTR_CAFILE "CAfile" 230 #define TLS_ATTR_CAPATH "CApath" 231 #define TLS_ATTR_MDALG "mdalg" 232 233 /* 234 * TLS_CLIENT_START_PROPS attributes. 235 */ 236 #define TLS_ATTR_TIMEOUT "timeout" 237 #define TLS_ATTR_TLS_LEVEL "tls_level" 238 #define TLS_ATTR_NEXTHOP "nexthop" 239 #define TLS_ATTR_HOST "host" 240 #define TLS_ATTR_NAMADDR "namaddr" 241 #define TLS_ATTR_SNI "sni" 242 #define TLS_ATTR_SERVERID "serverid" 243 #define TLS_ATTR_HELO "helo" 244 #define TLS_ATTR_PROTOCOLS "protocols" 245 #define TLS_ATTR_CIPHER_GRADE "cipher_grade" 246 #define TLS_ATTR_CIPHER_EXCLUSIONS "cipher_exclusions" 247 #define TLS_ATTR_MATCHARGV "matchargv" 248 #define TLS_ATTR_MDALG "mdalg" 249 #define TLS_ATTR_DANE "dane" 250 251 /* 252 * TLS_TLSA attributes. 253 */ 254 #define TLS_ATTR_USAGE "usage" 255 #define TLS_ATTR_SELECTOR "selector" 256 #define TLS_ATTR_MTYPE "mtype" 257 #define TLS_ATTR_DATA "data" 258 259 /* 260 * TLS_DANE attributes. 261 */ 262 #define TLS_ATTR_DOMAIN "domain" 263 264 #endif 265 266 /* LICENSE 267 /* .ad 268 /* .fi 269 /* The Secure Mailer license must be distributed with this software. 270 /* AUTHOR(S) 271 /* Wietse Venema 272 /* IBM T.J. Watson Research 273 /* P.O. Box 704 274 /* Yorktown Heights, NY 10598, USA 275 /* 276 /* Wietse Venema 277 /* Google, Inc. 278 /* 111 8th Avenue 279 /* New York, NY 10011, USA 280 /*--*/ 281 282 #endif 283