Line data    Source code

       1              : /* SPDX-FileCopyrightText: Copyright 2026 Cozens Software Solutions Limited
       2              :  * SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0 OR LicenseRef-PolyForm-Internal-Use-1.0.0 OR LicenseRef-COSOSO-Commercial
       3              :  */
       4              : 
       5              : #ifndef SOLIDSYSLOGWOLFSSLSTREAMPRIVATE_H
       6              : #define SOLIDSYSLOGWOLFSSLSTREAMPRIVATE_H
       7              : 
       8              : #include "SolidSyslogWolfSslSettings.h"
       9              : 
      10              : #include <stdbool.h>
      11              : #include <stdint.h>
      12              : #include <wolfssl/ssl.h>
      13              : #include <wolfssl/wolfcrypt/asn.h>
      14              : 
      15              : #include "SolidSyslogError.h"
      16              : #include "SolidSyslogPrival.h"
      17              : #include "SolidSyslogStreamDefinition.h"
      18              : #include "SolidSyslogStreamOpenHealth.h"
      19              : #include "SolidSyslogTlsCredentialsInstalled.h"
      20              : #include "SolidSyslogTlsStreamCategories.h"
      21              : #include "SolidSyslogWolfSslStream.h"
      22              : #include "SolidSyslogWolfSslStreamErrors.h"
      23              : 
      24              : struct SolidSyslogWolfSslStream
      25              : {
      26              :     struct SolidSyslogStream Base;
      27              :     struct SolidSyslogWolfSslStreamConfig Config;
      28              :     struct SolidSyslogStreamOpenHealth OpenHealth;
      29              :     /* Both built per connection at Open and freed at Close; NULL in between. */
      30              :     WOLFSSL_CTX* Context;
      31              :     WOLFSSL* Session;
      32              :     /* Set immediately before Install is called, cleared by the Release that
      33              :      * answers it. The contract is one Release per Install call whatever that
      34              :      * call returned, and Close is idempotent, so the flag is what keeps both
      35              :      * true at once. */
      36              :     bool CredentialsInstalled;
      37              :     /* What the last Install reported; valid only while CredentialsInstalled. */
      38              :     struct SolidSyslogTlsCredentialsInstalled Installed;
      39              :     /* Pulled at the start of each Open and read for the rest of it. */
      40              :     struct SolidSyslogWolfSslProfile Profile;
      41              :     /* The checks the verify callback saw the peer fail, as a set: wolfSSL
      42              :      * reports one error per call and may call more than once, and the refusal
      43              :      * names the check the contract puts first, whichever the library raised
      44              :      * last. */
      45              :     uint32_t RefusedChecks;
      46              :     /* Whether the leaf matched a pin, as the verify callback last found it. */
      47              :     bool PeerPinned;
      48              :     /* Where the verify callback parses a certificate the library found no
      49              :      * signer for. Held here rather than on the stack of a callback already
      50              :      * deep inside the handshake; valid only within that one call. */
      51              :     DecodedCert DecodedCertificate;
      52              : };
      53              : 
      54              : void SolidSyslogWolfSslStream_Initialise(
      55              :     struct SolidSyslogStream* base,
      56              :     const struct SolidSyslogWolfSslStreamConfig* config
      57              : );
      58              : void SolidSyslogWolfSslStream_Cleanup(struct SolidSyslogStream* base);
      59              : 
      60              : /* Authorises the peer by the DER of its leaf, recording the verdict; true where
      61              :  * a pin names it. A NULL leaf is one whose digest cannot be taken. */
      62              : bool SolidSyslogWolfSslStream_AuthoriseLeaf(
      63              :     struct SolidSyslogWolfSslStream* self,
      64              :     const unsigned char* der,
      65              :     word32 length
      66              : );
      67              : 
      68              : /* Where a pin beside trust anchors is checked, as the body this build selects
      69              :  * answers it. */
      70              : enum SolidSyslogWolfSslAnchoredPinCheck
      71              : {
      72              :     SOLIDSYSLOG_WOLFSSL_PIN_BESIDE_ANCHORS_IN_CALLBACK,
      73              :     SOLIDSYSLOG_WOLFSSL_PIN_BESIDE_ANCHORS_AFTER_HANDSHAKE,
      74              :     SOLIDSYSLOG_WOLFSSL_PIN_BESIDE_ANCHORS_REFUSED
      75              : };
      76              : 
      77              : /* Defined by whichever body SOLIDSYSLOG_WOLFSSL_ANCHORED_PIN_CHECK selects.
      78              :  * AuthoriseKeptPeer is called once a pinned peer's handshake has completed
      79              :  * without the callback having matched a pin, which is where a build that
      80              :  * cannot check the pin in the callback checks the leaf it kept. */
      81              : enum SolidSyslogWolfSslAnchoredPinCheck SolidSyslogWolfSslStream_AnchoredPinCheck(void);
      82              : void SolidSyslogWolfSslStream_AuthoriseKeptPeer(struct SolidSyslogWolfSslStream* self);
      83              : 
      84           32 : static inline void WolfSslStream_Report(
      85              :     enum SolidSyslogSeverity severity,
      86              :     uint16_t category,
      87              :     enum SolidSyslogTlsStreamErrors code
      88              : )
      89              : {
      90           32 :     SolidSyslog_Error(severity, &SolidSyslogWolfSslStreamErrorSource, category, (int32_t) code);
      91           32 : }
      92              : 
      93              : /* A failure that ends an Open, reported once per run of the same detail as
      94              :  * the Open contract requires: the sender retries every service pass. */
      95          153 : static inline void WolfSslStream_ReportOpenFailure(
      96              :     struct SolidSyslogWolfSslStream* self,
      97              :     enum SolidSyslogSeverity severity,
      98              :     uint16_t category,
      99              :     enum SolidSyslogTlsStreamErrors code
     100              : )
     101              : {
     102          153 :     SolidSyslogStreamOpenHealth_ReportFailure(
     103              :         &self->OpenHealth,
     104              :         &SolidSyslogWolfSslStreamErrorSource,
     105              :         severity,
     106              :         category,
     107              :         (int32_t) code
     108              :     );
     109          153 : }
     110              : 
     111              : #endif /* SOLIDSYSLOGWOLFSSLSTREAMPRIVATE_H */