Line data    Source code

       1              : /* SPDX-FileCopyrightText: Copyright 2026 Cozens Software Solutions Limited
       2              :  * SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 OR LicenseRef-PolyForm-Internal-Use-1.0.0 OR LicenseRef-COSOSO-Commercial
       3              :  */
       4              : 
       5              : #ifndef SOLIDSYSLOGOPENSSLSTREAMPRIVATE_H
       6              : #define SOLIDSYSLOGOPENSSLSTREAMPRIVATE_H
       7              : 
       8              : #include <stdbool.h>
       9              : #include <stdint.h>
      10              : 
      11              : #include <openssl/bio.h>
      12              : #include <openssl/types.h>
      13              : 
      14              : #include "SolidSyslogError.h"
      15              : #include "SolidSyslogPrival.h"
      16              : #include "SolidSyslogStreamDefinition.h"
      17              : #include "SolidSyslogStreamOpenHealth.h"
      18              : #include "SolidSyslogTlsStreamCategories.h"
      19              : #include "SolidSyslogOpenSslStream.h"
      20              : #include "SolidSyslogOpenSslStreamErrors.h"
      21              : #include "SolidSyslogTlsCredentialsInstalled.h"
      22              : #include "SolidSyslogTlsFingerprint.h"
      23              : 
      24              : struct SolidSyslogOpenSslStream
      25              : {
      26              :     struct SolidSyslogStream Base;
      27              :     struct SolidSyslogOpenSslStreamConfig Config;
      28              :     SSL_CTX* Ctx;
      29              :     SSL* Ssl;
      30              :     BIO_METHOD* BioMethod;
      31              :     struct SolidSyslogStreamOpenHealth OpenHealth;
      32              :     /* Set immediately before Install is called, cleared by the Release that
      33              :      * answers it. The contract is one Release per Install call whatever that
      34              :      * call returned, and Close is idempotent, so the flag is what keeps both
      35              :      * true at once. */
      36              :     bool CredentialsInstalled;
      37              :     /* What the last Install reported. Read after Install returns, by the verify
      38              :      * callback and by the hostname step; valid only while CredentialsInstalled. */
      39              :     struct SolidSyslogTlsCredentialsInstalled Installed;
      40              :     /* Pulled at the start of each Open and read for the rest of it. */
      41              :     struct SolidSyslogOpenSslProfile Profile;
      42              :     /* A chain-trust objection carried past a deeper certificate so the leaf's
      43              :      * pin could still be compared, and X509_V_OK where there was none. OpenSSL
      44              :      * abandons verification on the first refusal, so refusing at depth would
      45              :      * leave the pin uncompared; whether the objection is forgiven is the
      46              :      * leaf's decision, and this is what carries it there. */
      47              :     int ChainObjection;
      48              :     /* A validity objection carried past a deeper certificate for the same
      49              :      * reason, and X509_V_OK where there was none. OpenSSL checks dates from
      50              :      * the top of the chain down, so an issuer outside its period would be
      51              :      * refused before the leaf's pin was compared. */
      52              :     int ValidityObjection;
      53              :     /* A name or address mismatch carried past the call that raised it, and
      54              :      * X509_V_OK where there was none. OpenSSL checks the name before the
      55              :      * dates, and the dates are named first. */
      56              :     int NameObjection;
      57              :     /* What the pin walk decided at the leaf, recorded there. A pin naming a hash
      58              :      * this build cannot compute is the integrator's fault, not the peer's, and
      59              :      * nothing in the library's verdict distinguishes the two. */
      60              :     enum SolidSyslogTlsAuthorisation PinVerdict;
      61              : };
      62              : 
      63              : void SolidSyslogOpenSslStream_Initialise(
      64              :     struct SolidSyslogStream* base,
      65              :     const struct SolidSyslogOpenSslStreamConfig* config
      66              : );
      67              : void SolidSyslogOpenSslStream_Cleanup(struct SolidSyslogStream* base);
      68              : 
      69          159 : static inline void OpenSslStream_Report(
      70              :     enum SolidSyslogSeverity severity,
      71              :     uint16_t category,
      72              :     enum SolidSyslogTlsStreamErrors code
      73              : )
      74              : {
      75          159 :     SolidSyslog_Error(severity, &SolidSyslogOpenSslStreamErrorSource, category, (int32_t) code);
      76          159 : }
      77              : 
      78              : /* A failure that ends an Open, reported once per run of the same detail as
      79              :  * the Open contract requires: the sender retries every service pass. */
      80           91 : static inline void OpenSslStream_ReportOpenFailure(
      81              :     struct SolidSyslogOpenSslStream* self,
      82              :     enum SolidSyslogSeverity severity,
      83              :     uint16_t category,
      84              :     enum SolidSyslogTlsStreamErrors code
      85              : )
      86              : {
      87           91 :     SolidSyslogStreamOpenHealth_ReportFailure(
      88              :         &self->OpenHealth,
      89              :         &SolidSyslogOpenSslStreamErrorSource,
      90              :         severity,
      91              :         category,
      92              :         (int32_t) code
      93              :     );
      94           91 : }
      95              : 
      96              : #endif /* SOLIDSYSLOGOPENSSLSTREAMPRIVATE_H */