vlc_tls.h 11.6 KB
Newer Older
1
/*****************************************************************************
2
 * vlc_tls.h:
3
 *****************************************************************************
4
 * Copyright (C) 2004-2016 Rémi Denis-Courmont
Jean-Baptiste Kempf's avatar
Jean-Baptiste Kempf committed
5
 * Copyright (C) 2005-2006 VLC authors and VideoLAN
6
 *
Jean-Baptiste Kempf's avatar
Jean-Baptiste Kempf committed
7 8 9
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 2.1 of the License, or
10 11 12 13
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
Jean-Baptiste Kempf's avatar
Jean-Baptiste Kempf committed
14 15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Lesser General Public License for more details.
16
 *
Jean-Baptiste Kempf's avatar
Jean-Baptiste Kempf committed
17 18 19
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
20 21
 *****************************************************************************/

22 23
#ifndef VLC_TLS_H
# define VLC_TLS_H
24

25
/**
26 27 28 29 30 31
 * \ingroup net
 * \defgroup transport Transport layer sockets
 * Network stream abstraction
 *
 * Originally intended for the TLS protocol (Transport Layer Security),
 * the Transport Layer Sockets now provides a generic abstraction
32 33
 * for connection-oriented full-duplex I/O byte streams, such as TCP/IP sockets
 * and TLS protocol sessions.
34
 *
35
 * @{
36
 * \file
37
 * Transport layer functions
38 39
 */

40
# include <vlc_network.h>
41

42 43
/** Transport layer socket */
typedef struct vlc_tls
44
{
45
    int (*get_fd)(struct vlc_tls *);
46
    ssize_t (*readv)(struct vlc_tls *, struct iovec *, unsigned);
47
    ssize_t (*writev)(struct vlc_tls *, const struct iovec *, unsigned);
48
    int (*shutdown)(struct vlc_tls *, bool duplex);
49
    void (*close)(struct vlc_tls *);
50

51
    struct vlc_tls *p;
52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68
} vlc_tls_t;

/**
 * \defgroup tls Transport Layer Security
 * @{
 */

/**
 * TLS credentials
 *
 * This structure contains the credentials for establishing TLS sessions.
 * This includes root Certificate Authorities (on client side),
 * trust and cryptographic parameters,
 * public certificates and private keys.
 */
typedef struct vlc_tls_creds
{
69
    struct vlc_common_members obj;
70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115

    module_t *module;
    void *sys;

    vlc_tls_t *(*open)(struct vlc_tls_creds *, vlc_tls_t *sock,
                       const char *host, const char *const *alpn);
    int  (*handshake)(struct vlc_tls_creds *, vlc_tls_t *session,
                      const char *hostname, const char *service,
                      char ** /*restrict*/ alp);
} vlc_tls_creds_t;

/**
 * Allocates TLS credentials for a client.
 * Credentials can be cached and reused across multiple TLS sessions.
 *
 * @return TLS credentials object, or NULL on error.
 **/
VLC_API vlc_tls_creds_t *vlc_tls_ClientCreate(vlc_object_t *);

/**
 * Allocates server TLS credentials.
 *
 * @param cert path to an x509 certificate (required)
 * @param key path to the PKCS private key for the certificate,
 *            or NULL to use cert path
 *
 * @return TLS credentials object, or NULL on error.
 */
VLC_API vlc_tls_creds_t *vlc_tls_ServerCreate(vlc_object_t *, const char *cert,
                                              const char *key);

static inline int vlc_tls_SessionHandshake (vlc_tls_creds_t *crd,
                                            vlc_tls_t *tls)
{
    return crd->handshake(crd, tls, NULL, NULL, NULL);
}

/**
 * Releases TLS credentials.
 *
 * Releases data allocated with vlc_tls_ClientCreate() or
 * vlc_tls_ServerCreate().
 *
 * @param srv object to be destroyed (or NULL)
 */
VLC_API void vlc_tls_Delete(vlc_tls_creds_t *);
116

117 118 119
/**
 * Initiates a client TLS session.
 *
120 121
 * Initiates a Transport Layer Security (TLS) session as the client side, using
 * trusted root CAs previously loaded with vlc_tls_ClientCreate().
122
 *
123 124 125 126 127
 * This is a blocking network operation and may be a thread cancellation point.
 *
 * @param creds X.509 credentials, i.e. set of root certificates of trusted
 *              certificate authorities
 * @param sock socket through which to establish the secure channel
128
 * @param hostname expected server name, used both as Server Name Indication
129
 *                 and as expected Common Name of the peer certificate [IN]
130
 * @param service unique identifier for the service to connect to
131
 *                (only used locally for certificates database) [IN]
132
 * @param alpn NULL-terminated list of Application Layer Protocols
133
 *             to negotiate, or NULL to not negotiate protocols [IN]
134
 * @param alp storage space for the negotiated Application Layer
135 136 137
 *            Protocol or NULL if negotiation was not performed [OUT]
 *
 * @note The credentials must remain valid until the session is finished.
138 139 140
 *
 * @return TLS session, or NULL on error.
 **/
141 142 143 144 145 146
VLC_API vlc_tls_t *vlc_tls_ClientSessionCreate(vlc_tls_creds_t *creds,
                                               vlc_tls_t *sock,
                                               const char *host,
                                               const char *service,
                                               const char *const *alpn,
                                               char **alp);
147

148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166
/**
 * Creates a TLS server session.
 *
 * Allocates a Transport Layer Security (TLS) session as the server side, using
 * cryptographic keys pair and X.509 certificates chain already loaded with
 * vlc_tls_ServerCreate().
 *
 * Unlike vlc_tls_ClientSessionCreate(), this function does not perform any
 * actual network I/O. vlc_tls_SessionHandshake() must be used to perform the
 * TLS handshake before sending and receiving data through the TLS session.
 *
 * This function is non-blocking and is not a cancellation point.
 *
 * @param creds server credentials, i.e. keys pair and X.509 certificates chain
 * @param alpn NULL-terminated list of Application Layer Protocols
 *             to negotiate, or NULL to not negotiate protocols
 *
 * @return TLS session, or NULL on error.
 */
167 168
VLC_API vlc_tls_t *vlc_tls_ServerSessionCreate(vlc_tls_creds_t *creds,
                                               vlc_tls_t *sock,
169
                                               const char *const *alpn);
170

171 172
/** @} */

173
/**
174
 * Destroys a TLS session down.
175
 *
176 177
 * All resources associated with the TLS session are released.
 *
178
 * If the session was established successfully, then shutdown cleanly, the
179 180 181
 * underlying socket can be reused. Otherwise, it must be closed. Either way,
 * this function does not close the underlying socket: Use vlc_tls_Close()
 * instead to close it at the same.
182 183 184
 *
 * This function is non-blocking and is not a cancellation point.
 */
185
VLC_API void vlc_tls_SessionDelete (vlc_tls_t *);
186

187 188 189 190 191
static inline int vlc_tls_GetFD(vlc_tls_t *tls)
{
    return tls->get_fd(tls);
}

192
/**
193 194 195 196 197 198 199 200 201 202 203 204 205
 * Receives data through a socket.
 *
 * This dequeues incoming data from a transport layer socket.
 *
 * @param buf received buffer start address [OUT]
 * @param len buffer length (in bytes)
 * @param waitall whether to wait for the exact buffer length (true),
 *                or for any amount of data (false)
 *
 * @note At end of stream, the number of bytes returned may be shorter than
 * requested regardless of the "waitall" flag.
 *
 * @return the number of bytes actually dequeued, or -1 on error.
206
 */
207
VLC_API ssize_t vlc_tls_Read(vlc_tls_t *, void *buf, size_t len, bool waitall);
208 209 210 211 212 213 214

/**
 * Receives a text line through a socket.
 *
 * This dequeues one line of text from a transport layer socket.
 * @return a heap-allocated nul-terminated string, or NULL on error
 */
215
VLC_API char *vlc_tls_GetLine(vlc_tls_t *);
216 217

/**
218
 * Sends data through a socket.
219
 */
220
VLC_API ssize_t vlc_tls_Write(vlc_tls_t *, const void *buf, size_t len);
221

222
/**
223
 * Shuts a connection down.
224
 *
225 226 227 228 229 230 231 232
 * This sends the connection close notification.
 *
 * If the TLS protocol is used, this provides a secure indication to the other
 * end that no further data will be sent. If using plain TCP/IP, this sets the
 * FIN flag.
 *
 * Data can still be received until a close notification is received from the
 * other end.
233 234 235 236 237 238 239 240 241 242 243 244 245
 *
 * @param duplex whether to stop receiving data as well
 * @retval 0 the session was terminated securely and cleanly
 *           (the underlying socket can be reused for other purposes)
 * @return -1 the session was terminated locally, but either a notification
 *            could not be sent or received (the underlying socket cannot be
 *            reused and must be closed)
 */
static inline int vlc_tls_Shutdown(vlc_tls_t *tls, bool duplex)
{
    return tls->shutdown(tls, duplex);
}

246
/**
247
 * Closes a connection and its underlying resources.
248
 *
249 250 251 252 253 254 255
 * This function closes the transport layer socket, and terminates any
 * underlying connection. For instance, if the TLS protocol is used over a TCP
 * stream, this function terminates both the TLS session, and then underlying
 * TCP/IP connection.
 *
 * To close a connection but retain any underlying resources, use
 * vlc_tls_SessionDelete() instead.
256 257 258
 */
static inline void vlc_tls_Close(vlc_tls_t *session)
{
259 260 261 262 263 264 265 266
    do
    {
        vlc_tls_t *p = session->p;

        vlc_tls_SessionDelete(session);
        session = p;
    }
    while (session != NULL);
267 268
}

269
/**
270
 * Creates a transport-layer stream from a socket.
271
 *
272 273
 * Creates a transport-layer I/O stream from a socket file descriptor.
 * Data will be sent and received directly through the socket. This can be used
274 275
 * either to share common code between non-TLS and TLS cases, or for testing
 * purposes.
276 277
 *
 * This function is not a cancellation point.
278 279
 *
 * @deprecated This function is transitional. Do not use it directly.
280
 */
281
VLC_API vlc_tls_t *vlc_tls_SocketOpen(int fd);
282

283 284 285 286 287
/**
 * Creates a connected pair of transport-layer sockets.
 */
VLC_API int vlc_tls_SocketPair(int family, int protocol, vlc_tls_t *[2]);

288 289 290 291
struct addrinfo;

/**
 * Creates a transport-layer stream from a struct addrinfo.
292 293 294 295 296 297 298 299 300 301 302
 *
 * This function tries to allocate a socket using the specified addrinfo
 * structure. Normally, the vlc_tls_SocketOpenTCP() function takes care of
 * this. But in some cases, it cannot be used, notably:
 * - if the remote destination is not resolved (directly) from getaddrinfo(),
 * - if the socket type is not SOCK_STREAM,
 * - if the transport protocol is not TCP (IPPROTO_TCP), or
 * - if TCP Fast Open should be attempted.
 *
 * @param ai a filled addrinfo structure (the ai_next member is ignored)
 * @param defer_connect whether to attempt a TCP Fast Open connection or not
303
 */
304 305
VLC_API vlc_tls_t *vlc_tls_SocketOpenAddrInfo(const struct addrinfo *ai,
                                              bool defer_connect);
306 307 308 309

/**
 * Creates a transport-layer TCP stream from a name and port.
 *
310 311 312
 * This function resolves a hostname, and attempts to establish a TCP/IP
 * connection to the specified host and port number.
 *
313 314 315
 * @note The function currently iterates through the addrinfo linked list.
 * Future versions may implement different behaviour (e.g. RFC6555).
 *
316
 * @return a transport layer socket on success or NULL on error
317 318 319 320
 */
VLC_API vlc_tls_t *vlc_tls_SocketOpenTCP(vlc_object_t *obj,
                                         const char *hostname, unsigned port);

321 322
/**
 * Initiates a TLS session over TCP.
323 324 325 326 327 328
 *
 * This function resolves a hostname, attempts to establish a TCP/IP
 * connection to the specified host and port number, and finally attempts to
 * establish a TLS session over the TCP/IP stream.
 *
 * See also vlc_tls_SocketOpenTCP() and vlc_tls_SessionCreate().
329 330 331 332 333 334
 */
VLC_API vlc_tls_t *vlc_tls_SocketOpenTLS(vlc_tls_creds_t *crd,
                                         const char *hostname, unsigned port,
                                         const char *service,
                                         const char *const *alpn, char **alp);

335 336
/** @} */

337
#endif