1 /* $NetBSD: tls_proxy.h,v 1.5 2025/02/25 19:15:50 christos Exp $ */ 2 3 #ifndef _TLS_PROXY_H_INCLUDED_ 4 #define _TLS_PROXY_H_INCLUDED_ 5 6 /*++ 7 /* NAME 8 /* tls_proxy_clnt 3h 9 /* SUMMARY 10 /* postscreen TLS proxy support 11 /* SYNOPSIS 12 /* #include <tls_proxy_clnt.h> 13 /* DESCRIPTION 14 /* .nf 15 16 /* 17 * Utility library. 18 */ 19 #include <vstream.h> 20 #include <attr.h> 21 22 /* 23 * TLS library. 24 */ 25 #include <tls.h> 26 27 /* 28 * External interface. 29 */ 30 #define TLS_PROXY_FLAG_ROLE_SERVER (1<<0) /* request server role */ 31 #define TLS_PROXY_FLAG_ROLE_CLIENT (1<<1) /* request client role */ 32 #define TLS_PROXY_FLAG_SEND_CONTEXT (1<<2) /* send TLS context */ 33 34 #ifdef USE_TLS 35 36 /* 37 * TLS_CLIENT_PARAMS structure, to communicate global TLS library settings 38 * that are the same for all TLS client contexts. This information is used 39 * in tlsproxy(8) to detect inconsistencies. If this structure is changed, 40 * update all TLS_CLIENT_PARAMS related functions in tls_proxy_client_*.c. 41 * 42 * In the serialization these attributes are identified by their configuration 43 * parameter names. 44 * 45 * NOTE: this does not include openssl_path. 46 * 47 * TODO: TLS_SERVER_PARAM structure, like TLS_CLIENT_PARAMS plus 48 * VAR_TLS_SERVER_SNI_MAPS. 49 */ 50 typedef struct TLS_CLIENT_PARAMS { 51 char *tls_cnf_file; 52 char *tls_cnf_name; 53 char *tls_high_clist; 54 char *tls_medium_clist; 55 char *tls_null_clist; 56 char *tls_eecdh_auto; 57 char *tls_eecdh_strong; 58 char *tls_eecdh_ultra; 59 char *tls_ffdhe_auto; 60 char *tls_bug_tweaks; 61 char *tls_ssl_options; 62 char *tls_dane_digests; 63 char *tls_mgr_service; 64 char *tls_tkt_cipher; 65 int tls_daemon_rand_bytes; 66 int tls_append_def_CA; 67 int tls_bc_pkey_fprint; 68 int tls_preempt_clist; 69 int tls_multi_wildcard; 70 } TLS_CLIENT_PARAMS; 71 72 #define TLS_PROXY_PARAMS(params, a1, a2, a3, a4, a5, a6, a7, a8, \ 73 a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19) \ 74 (((params)->a1), ((params)->a2), ((params)->a3), \ 75 ((params)->a4), ((params)->a5), ((params)->a6), ((params)->a7), \ 76 ((params)->a8), ((params)->a9), ((params)->a10), ((params)->a11), \ 77 ((params)->a12), ((params)->a13), ((params)->a14), ((params)->a15), \ 78 ((params)->a16), ((params)->a17), ((params)->a18), ((params)->a19)) 79 80 /* 81 * tls_proxy_client_param_misc.c, tls_proxy_client_param_print.c, and 82 * tls_proxy_client_param_scan.c. 83 */ 84 extern TLS_CLIENT_PARAMS *tls_proxy_client_param_from_config(TLS_CLIENT_PARAMS *); 85 extern char *tls_proxy_client_param_serialize(ATTR_PRINT_COMMON_FN, VSTRING *, const TLS_CLIENT_PARAMS *); 86 extern int tls_proxy_client_param_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 87 extern void tls_proxy_client_param_free(TLS_CLIENT_PARAMS *); 88 extern int tls_proxy_client_param_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 89 90 /* 91 * Functions that handle TLS_XXX_INIT_PROPS and TLS_XXX_START_PROPS. These 92 * data structures are defined elsewhere, because they are also used in 93 * non-proxied requests. 94 */ 95 #define tls_proxy_legacy_open(service, flags, peer_stream, peer_addr, \ 96 peer_port, timeout, serverid) \ 97 tls_proxy_open((service), (flags), (peer_stream), (peer_addr), \ 98 (peer_port), (timeout), (timeout), (serverid), \ 99 (void *) 0, (void *) 0, (void *) 0) 100 101 extern VSTREAM *tls_proxy_open(const char *, int, VSTREAM *, const char *, 102 const char *, int, int, const char *, 103 void *, void *, void *); 104 105 #define TLS_PROXY_CLIENT_INIT_PROPS(props, a1, a2, a3, a4, a5, a6, a7, a8, \ 106 a9, a10, a11, a12, a13, a14) \ 107 (((props)->a1), ((props)->a2), ((props)->a3), \ 108 ((props)->a4), ((props)->a5), ((props)->a6), ((props)->a7), \ 109 ((props)->a8), ((props)->a9), ((props)->a10), ((props)->a11), \ 110 ((props)->a12), ((props)->a13), ((props)->a14)) 111 112 #define TLS_PROXY_CLIENT_START_PROPS(props, a1, a2, a3, a4, a5, a6, a7, a8, \ 113 a9, a10, a11, a12, a13, a14, a15, a16, a17) \ 114 (((props)->a1), ((props)->a2), ((props)->a3), \ 115 ((props)->a4), ((props)->a5), ((props)->a6), ((props)->a7), \ 116 ((props)->a8), ((props)->a9), ((props)->a10), ((props)->a11), \ 117 ((props)->a12), ((props)->a13), ((props)->a14), ((props)->a15), \ 118 ((props)->a16), ((props)->a17)) 119 120 extern TLS_SESS_STATE *tls_proxy_context_receive(VSTREAM *); 121 extern void tls_proxy_context_free(TLS_SESS_STATE *); 122 extern int tls_proxy_context_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 123 extern int tls_proxy_context_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 124 125 extern int tls_proxy_client_init_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 126 extern int tls_proxy_client_init_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 127 extern void tls_proxy_client_init_free(TLS_CLIENT_INIT_PROPS *); 128 extern char *tls_proxy_client_init_serialize(ATTR_PRINT_COMMON_FN, VSTRING *, const TLS_CLIENT_INIT_PROPS *); 129 130 extern int tls_proxy_client_start_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 131 extern int tls_proxy_client_start_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 132 extern void tls_proxy_client_start_free(TLS_CLIENT_START_PROPS *); 133 134 extern int tls_proxy_server_init_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 135 extern int tls_proxy_server_init_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 136 extern void tls_proxy_server_init_free(TLS_SERVER_INIT_PROPS *); 137 138 extern int tls_proxy_server_start_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); 139 extern int tls_proxy_server_start_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); 140 141 extern void tls_proxy_server_start_free(TLS_SERVER_START_PROPS *); 142 143 #endif /* USE_TLS */ 144 145 /* 146 * TLSPROXY attributes, unconditionally exposed. 147 */ 148 #define TLS_ATTR_REMOTE_ENDPT "remote_endpoint" /* name[addr]:port */ 149 #define TLS_ATTR_FLAGS "flags" 150 #define TLS_ATTR_TIMEOUT "timeout" 151 #define TLS_ATTR_SERVERID "serverid" 152 153 #ifdef USE_TLS 154 155 /* 156 * Misc attributes. 157 */ 158 #define TLS_ATTR_COUNT "count" 159 160 /* 161 * TLS_SESS_STATE attributes. 162 */ 163 #define TLS_ATTR_PEER_CN "peer_CN" 164 #define TLS_ATTR_ISSUER_CN "issuer_CN" 165 #define TLS_ATTR_PEER_CERT_FPT "peer_fingerprint" 166 #define TLS_ATTR_PEER_PKEY_FPT "peer_pubkey_fingerprint" 167 #define TLS_ATTR_SEC_LEVEL "level" 168 #define TLS_ATTR_PEER_STATUS "peer_status" 169 #define TLS_ATTR_CIPHER_PROTOCOL "cipher_protocol" 170 #define TLS_ATTR_CIPHER_NAME "cipher_name" 171 #define TLS_ATTR_CIPHER_USEBITS "cipher_usebits" 172 #define TLS_ATTR_CIPHER_ALGBITS "cipher_algbits" 173 #define TLS_ATTR_KEX_NAME "key_exchange" 174 #define TLS_ATTR_KEX_CURVE "key_exchange_curve" 175 #define TLS_ATTR_KEX_BITS "key_exchange_bits" 176 #define TLS_ATTR_CTOS_RPK "ctos_rpk" 177 #define TLS_ATTR_STOC_RPK "stoc_rpk" 178 #define TLS_ATTR_CLNT_SIG_NAME "clnt_signature" 179 #define TLS_ATTR_CLNT_SIG_CURVE "clnt_signature_curve" 180 #define TLS_ATTR_CLNT_SIG_BITS "clnt_signature_bits" 181 #define TLS_ATTR_CLNT_SIG_DGST "clnt_signature_digest" 182 #define TLS_ATTR_SRVR_SIG_NAME "srvr_signature" 183 #define TLS_ATTR_SRVR_SIG_CURVE "srvr_signature_curve" 184 #define TLS_ATTR_SRVR_SIG_BITS "srvr_signature_bits" 185 #define TLS_ATTR_SRVR_SIG_DGST "srvr_signature_digest" 186 #define TLS_ATTR_NAMADDR "namaddr" 187 #define TLS_ATTR_RPT_REPORTED "rpt_reported" 188 189 /* 190 * TLS_SERVER_INIT_PROPS attributes. 191 */ 192 #define TLS_ATTR_LOG_PARAM "log_param" 193 #define TLS_ATTR_LOG_LEVEL "log_level" 194 #define TLS_ATTR_VERIFYDEPTH "verifydepth" 195 #define TLS_ATTR_CACHE_TYPE "cache_type" 196 #define TLS_ATTR_SET_SESSID "set_sessid" 197 #define TLS_ATTR_CHAIN_FILES "chain_files" 198 #define TLS_ATTR_CERT_FILE "cert_file" 199 #define TLS_ATTR_KEY_FILE "key_file" 200 #define TLS_ATTR_DCERT_FILE "dcert_file" 201 #define TLS_ATTR_DKEY_FILE "dkey_file" 202 #define TLS_ATTR_ECCERT_FILE "eccert_file" 203 #define TLS_ATTR_ECKEY_FILE "eckey_file" 204 #define TLS_ATTR_CAFILE "CAfile" 205 #define TLS_ATTR_CAPATH "CApath" 206 #define TLS_ATTR_PROTOCOLS "protocols" 207 #define TLS_ATTR_EECDH_GRADE "eecdh_grade" 208 #define TLS_ATTR_DH1K_PARAM_FILE "dh1024_param_file" 209 #define TLS_ATTR_DH512_PARAM_FILE "dh512_param_file" 210 #define TLS_ATTR_ASK_CCERT "ask_ccert" 211 #define TLS_ATTR_MDALG "mdalg" 212 213 /* 214 * TLS_SERVER_START_PROPS attributes. 215 */ 216 #define TLS_ATTR_TIMEOUT "timeout" 217 #define TLS_ATTR_REQUIRECERT "requirecert" 218 #define TLS_ATTR_SERVERID "serverid" 219 #define TLS_ATTR_NAMADDR "namaddr" 220 #define TLS_ATTR_CIPHER_GRADE "cipher_grade" 221 #define TLS_ATTR_CIPHER_EXCLUSIONS "cipher_exclusions" 222 #define TLS_ATTR_MDALG "mdalg" 223 224 /* 225 * TLS_CLIENT_INIT_PROPS attributes. 226 */ 227 #define TLS_ATTR_CNF_FILE "config_file" 228 #define TLS_ATTR_CNF_NAME "config_name" 229 #define TLS_ATTR_LOG_PARAM "log_param" 230 #define TLS_ATTR_LOG_LEVEL "log_level" 231 #define TLS_ATTR_VERIFYDEPTH "verifydepth" 232 #define TLS_ATTR_CACHE_TYPE "cache_type" 233 #define TLS_ATTR_CHAIN_FILES "chain_files" 234 #define TLS_ATTR_CERT_FILE "cert_file" 235 #define TLS_ATTR_KEY_FILE "key_file" 236 #define TLS_ATTR_DCERT_FILE "dcert_file" 237 #define TLS_ATTR_DKEY_FILE "dkey_file" 238 #define TLS_ATTR_ECCERT_FILE "eccert_file" 239 #define TLS_ATTR_ECKEY_FILE "eckey_file" 240 #define TLS_ATTR_CAFILE "CAfile" 241 #define TLS_ATTR_CAPATH "CApath" 242 #define TLS_ATTR_MDALG "mdalg" 243 244 /* 245 * TLS_CLIENT_START_PROPS attributes. 246 */ 247 #define TLS_ATTR_TIMEOUT "timeout" 248 #define TLS_ATTR_ENABLE_RPK "enable_rpk" 249 #define TLS_ATTR_TLS_LEVEL "tls_level" 250 #define TLS_ATTR_NEXTHOP "nexthop" 251 #define TLS_ATTR_HOST "host" 252 #define TLS_ATTR_NAMADDR "namaddr" 253 #define TLS_ATTR_SNI "sni" 254 #define TLS_ATTR_SERVERID "serverid" 255 #define TLS_ATTR_HELO "helo" 256 #define TLS_ATTR_PROTOCOLS "protocols" 257 #define TLS_ATTR_CIPHER_GRADE "cipher_grade" 258 #define TLS_ATTR_CIPHER_EXCLUSIONS "cipher_exclusions" 259 #define TLS_ATTR_MATCHARGV "matchargv" 260 #define TLS_ATTR_MDALG "mdalg" 261 #define TLS_ATTR_DANE "dane" 262 #define TLS_ATTR_TLSRPT "tlsrpt" 263 #define TLS_ATTR_FFAIL_TYPE "forced_failure_type" 264 265 /* 266 * TLS_TLSA attributes. 267 */ 268 #define TLS_ATTR_USAGE "usage" 269 #define TLS_ATTR_SELECTOR "selector" 270 #define TLS_ATTR_MTYPE "mtype" 271 #define TLS_ATTR_DATA "data" 272 273 /* 274 * TLS_DANE attributes. 275 */ 276 #define TLS_ATTR_DOMAIN "domain" 277 278 #endif 279 280 /* LICENSE 281 /* .ad 282 /* .fi 283 /* The Secure Mailer license must be distributed with this software. 284 /* AUTHOR(S) 285 /* Wietse Venema 286 /* IBM T.J. Watson Research 287 /* P.O. Box 704 288 /* Yorktown Heights, NY 10598, USA 289 /* 290 /* Wietse Venema 291 /* Google, Inc. 292 /* 111 8th Avenue 293 /* New York, NY 10011, USA 294 /*--*/ 295 296 #endif 297