#include <Security.hxx>

Inheritance diagram for resip::Security:

Public Member Functions
	Security (const Data &pathToCerts, const CipherList &=StrongestSuite, const Data &defaultPrivateKeyPassPhrase=Data::Empty, const Data &dHParamsFilename=Data::Empty)

	Security (const CipherList &=StrongestSuite, const Data &defaultPrivateKeyPassPhrase=Data::Empty, const Data &dHParamsFilename=Data::Empty)

void	addCADirectory (const Data &caDirectory)

void	addCAFile (const Data &caFile)

void	loadCADirectory (const Data &directoryName)

void	loadCAFile (const Data &fileName)

virtual void	preload ()

virtual SSL_CTX *	createDomainCtx (const SSL_METHOD *method, const Data &domain, const Data &certificateFilename, const Data &privateKeyFilename, const Data &privateKeyPassPhrase)
	Throws BaseSecurity::Exception if the certificate or private key can't be loaded; nothing is left allocated in that case.

virtual void	updateDomainCtx (SSL_CTX *ctx, const Data &domain, const Data &certificateFilename, const Data &privateKeyFilename, const Data &privateKeyPassPhrase)
	Loads the domain's certificate chain and private key into ctx.

virtual void	onReadPEM (const Data &name, PEMType type, Data &buffer) const

virtual void	onWritePEM (const Data &name, PEMType type, const Data &buffer) const

virtual void	onRemovePEM (const Data &name, PEMType type) const

Public Member Functions inherited from resip::BaseSecurity
	BaseSecurity (const CipherList &cipherSuite=StrongestSuite, const Data &defaultPrivateKeyPassPhrase=Data::Empty, const Data &dHParamsFilename=Data::Empty)

virtual	~BaseSecurity ()

CertificateInfoContainer	getRootCertDescriptions () const

void	addRootCertPEM (const Data &x509PEMEncodedRootCerts)

void	addDomainCertPEM (const Data &domainName, const Data &certPEM)

void	addDomainCertDER (const Data &domainName, const Data &certDER)

bool	hasDomainCert (const Data &domainName, bool logErrors=true) const

void	removeDomainCert (const Data &domainName)

Data	getDomainCertDER (const Data &domainName) const

void	addDomainPrivateKeyPEM (const Data &domainName, const Data &privateKeyPEM, const Data &privateKeyPassPhrase=Data::Empty)

bool	hasDomainPrivateKey (const Data &domainName) const

void	removeDomainPrivateKey (const Data &domainName)

Data	getDomainPrivateKeyPEM (const Data &domainName) const

void	addUserCertPEM (const Data &aor, const Data &certPEM)

void	addUserCertDER (const Data &aor, const Data &certDER)

bool	hasUserCert (const Data &aor) const

void	removeUserCert (const Data &aor)

Data	getUserCertDER (const Data &aor) const

void	setUserPassPhrase (const Data &aor, const Data &passPhrase)

bool	hasUserPassPhrase (const Data &aor) const

void	removeUserPassPhrase (const Data &aor)

Data	getUserPassPhrase (const Data &aor) const

void	addUserPrivateKeyPEM (const Data &aor, const Data &certPEM, const Data &privateKeyPassPhrase=Data::Empty)

void	addUserPrivateKeyDER (const Data &aor, const Data &certDER, const Data &privateKeyPassPhrase=Data::Empty)

bool	hasUserPrivateKey (const Data &aor) const

void	removeUserPrivateKey (const Data &aor)

Data	getUserPrivateKeyPEM (const Data &aor) const

Data	getUserPrivateKeyDER (const Data &aor) const

void	generateUserCert (const Data &aor, int expireDays=365, int keyLen=2048)

MultipartSignedContents *	sign (const Data &senderAor, Contents *)

Pkcs7Contents *	encrypt (Contents *, const Data &recipCertName)

MultipartSignedContents *	signAndEncrypt (const Data &senderAor, Contents *, const Data &recipCertName)

Data	computeIdentity (const Data &signerDomain, const Data &in) const

bool	checkIdentity (const Data &signerDomain, const Data &in, const Data &sig, X509 *cert=NULL) const

void	checkAndSetIdentity (SipMessage &msg, const Data &derCert=Data::Empty) const

Contents *	decrypt (const Data &decryptorAor, const Pkcs7Contents *)

Contents *	checkSignature (MultipartSignedContents , Data signedBy, SignatureStatus *sigStat)

SSL_CTX *	getTlsCtx ()

SSL_CTX *	getSslCtx ()

X509 *	getDomainCert (const Data &domain)

EVP_PKEY *	getDomainKey (const Data &domain)

X509 *	getUserCert (const Data &aor)

EVP_PKEY *	getUserPrivateKey (const Data &aor)

Additional Inherited Members
Public Types inherited from resip::BaseSecurity
enum	NameType { SubjectAltName , CommonName }

enum	PEMType { RootCert =1 , DomainCert , DomainPrivateKey , UserCert , UserPrivateKey }

typedef std::vector< CertificateInfo >	CertificateInfoContainer

typedef std::map< Data, X509 * >	X509Map

typedef std::list< X509 * >	X509List

typedef std::map< Data, EVP_PKEY * >	PrivateKeyMap

typedef std::map< Data, Data >	PassPhraseMap

Static Public Member Functions inherited from resip::BaseSecurity
static int	getResipConnectionExDataIdx ()

static void	initialize ()

static Data	getCertName (X509 *cert)

static void	getCertNames (X509 *cert, std::list< PeerName > &peerNames, bool useEmailAsSIP=false)

static bool	isSelfSigned (const X509 *cert)

static int	matchHostName (const Data &certificateName, const Data &domainName)
	Applies the certificate and domain name matching rules.

static void	setAllowWildcardCertificates (bool bEnable)

static bool	allowWildcardCertificates ()

static SecurityTypes::SSLType	parseSSLType (const Data &typeName)
	Converts a string containing an SSL type name to the corresponding enum value.

static long	parseOpenSSLCTXOption (const Data &optionName)
	Converts a string containing an OpenSSL option name (for SSL_CTX_set_options) to the numeric value from ssl.h - see resip::parseOpenSSLCTXOption.

Static Public Attributes inherited from resip::BaseSecurity
static CipherList	ExportableSuite

static CipherList	StrongestSuite

static long	OpenSSLCTXSetOptions = SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_COMPRESSION
	Note:

static long	OpenSSLCTXClearOptions = 0

Protected Member Functions inherited from resip::BaseSecurity
void	addCertPEM (PEMType type, const Data &name, const Data &certPEM, bool write)

void	addCertDER (PEMType type, const Data &name, const Data &certDER, bool write)

bool	hasCert (PEMType type, const Data &name, bool logErrors=true) const

void	removeCert (PEMType type, const Data &name)

Data	getCertDER (PEMType type, const Data &name) const

void	addCertX509 (PEMType type, const Data &name, X509 *cert, bool write)

void	addPrivateKeyPEM (PEMType type, const Data &name, const Data &privateKeyPEM, bool write, const Data &privateKeyPassPhrase=Data::Empty)

void	addPrivateKeyDER (PEMType type, const Data &name, const Data &privateKeyDER, bool write, const Data &privateKeyPassPhrase=Data::Empty)

bool	hasPrivateKey (PEMType type, const Data &name) const

void	removePrivateKey (PEMType type, const Data &name)

Data	getPrivateKeyPEM (PEMType type, const Data &name) const

Data	getPrivateKeyDER (PEMType type, const Data &name) const

void	addPrivateKeyPKEY (PEMType type, const Data &name, EVP_PKEY *pKey, bool write)

void	setDHParams (SSL_CTX *ctx)

Static Protected Member Functions inherited from resip::BaseSecurity
static void	dumpAsn (const char *, Data)

static int	matchHostNameWithWildcards (const Data &certificateName, const Data &domainName)
	Matches a certificate name, which may hold a wildcard, against the domain name we connected to, following RFC 6125 section 6.4.3: the wildcard has to be the whole left-most label ("*.example.com"), it stands for exactly one non-empty label of the domain name, at least two labels have to follow it, and it never matches an IP address.

Protected Attributes inherited from resip::BaseSecurity
SSL_CTX *	mTlsCtx
	Note:

SSL_CTX *	mSslCtx

CipherList	mCipherList

Data	mDefaultPrivateKeyPassPhrase

Data	mDHParamsFilename

X509List	mRootCerts

X509_STORE *	mRootTlsCerts

X509_STORE *	mRootSslCerts

X509Map	mDomainCerts

PrivateKeyMap	mDomainPrivateKeys

X509Map	mUserCerts

PassPhraseMap	mUserPassPhrases

PrivateKeyMap	mUserPrivateKeys

Static Protected Attributes inherited from resip::BaseSecurity
static bool	mAllowWildcardCertificates = false

Detailed Description

Definition at line 271 of file Security.hxx.

Constructor & Destructor Documentation

◆ Security() [1/2]

Security::Security	(	const Data &	pathToCerts,
		const CipherList &	cipherSuite = `StrongestSuite`,
		const Data &	defaultPrivateKeyPassPhrase = `Data::Empty`,
		const Data &	dHParamsFilename = `Data::Empty`
	)

Definition at line 203 of file Security.cxx.

◆ Security() [2/2]

Security::Security	(	const CipherList &	cipherSuite = `StrongestSuite`,
		const Data &	defaultPrivateKeyPassPhrase = `Data::Empty`,
		const Data &	dHParamsFilename = `Data::Empty`
	)

Definition at line 188 of file Security.cxx.

Member Function Documentation

◆ addCADirectory()

void Security::addCADirectory ( const Data & caDirectory )

Definition at line 215 of file Security.cxx.

◆ addCAFile()

void Security::addCAFile ( const Data & caFile )

Definition at line 226 of file Security.cxx.

◆ createDomainCtx()

SSL_CTX * Security::createDomainCtx	(	const SSL_METHOD *	method,
		const Data &	domain,
		const Data &	certificateFilename,
		const Data &	privateKeyFilename,
		const Data &	privateKeyPassPhrase
	)

virtual

Throws BaseSecurity::Exception if the certificate or private key can't be loaded; nothing is left allocated in that case.

Definition at line 407 of file Security.cxx.

◆ loadCADirectory()

void Security::loadCADirectory ( const Data & directoryName )

Definition at line 232 of file Security.cxx.

◆ loadCAFile()

void Security::loadCAFile ( const Data & fileName )

Definition at line 259 of file Security.cxx.

◆ onReadPEM()

void Security::onReadPEM	(	const Data &	name,
		PEMType	type,
		Data &	buffer
	)		const

virtual

Implements resip::BaseSecurity.

Reimplemented in resip::MacSecurity, and resip::WinSecurity.

Definition at line 511 of file Security.cxx.

◆ onRemovePEM()

void Security::onRemovePEM	(	const Data &	name,
		PEMType	type
	)		const

virtual

Implements resip::BaseSecurity.

Reimplemented in resip::MacSecurity, and resip::WinSecurity.

Definition at line 543 of file Security.cxx.

◆ onWritePEM()

void Security::onWritePEM	(	const Data &	name,
		PEMType	type,
		const Data &	buffer
	)		const

virtual

Implements resip::BaseSecurity.

Reimplemented in resip::MacSecurity, and resip::WinSecurity.

Definition at line 521 of file Security.cxx.

◆ preload()

void Security::preload ( )

virtual

Implements resip::BaseSecurity.

Reimplemented in resip::MacSecurity, and resip::WinSecurity.

Definition at line 277 of file Security.cxx.

◆ updateDomainCtx()

void Security::updateDomainCtx	(	SSL_CTX *	ctx,
		const Data &	domain,
		const Data &	certificateFilename,
		const Data &	privateKeyFilename,
		const Data &	privateKeyPassPhrase
	)

virtual

Loads the domain's certificate chain and private key into ctx.

Throws BaseSecurity::Exception if either can't be loaded. ctx stays owned by the caller, but may hold a partial update after a failure, so a context that is in use should be replaced by one from createDomainCtx() instead.

Definition at line 454 of file Security.cxx.

The documentation for this class was generated from the following files:

resip/stack/ssl/Security.hxx
resip/stack/ssl/Security.cxx

Public Member Functions

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ Security() [1/2]

◆ Security() [2/2]

Member Function Documentation

◆ addCADirectory()

◆ addCAFile()

◆ createDomainCtx()

◆ loadCADirectory()

◆ loadCAFile()

◆ onReadPEM()

◆ onRemovePEM()

◆ onWritePEM()

◆ preload()

◆ updateDomainCtx()