MpLive/ZLMediaKit/3rdpart/ZLToolKit/src/Util/SSLUtil.h

/*
 * Copyright (c) 2016 The ZLToolKit project authors. All Rights Reserved.
 *
 * This file is part of ZLToolKit(https://github.com/ZLMediaKit/ZLToolKit).
 *
 * Use of this source code is governed by MIT license that can be found in the
 * LICENSE file in the root of the source tree. All contributing project authors
 * may be found in the AUTHORS file in the root of the source tree.
 */

#ifndef ZLTOOLKIT_SSLUTIL_H
#define ZLTOOLKIT_SSLUTIL_H

#include <memory>
#include <string>
#include <vector>

typedef struct x509_st X509;
typedef struct evp_pkey_st EVP_PKEY;
typedef struct ssl_ctx_st SSL_CTX;
typedef struct ssl_st SSL;
typedef struct bio_st BIO;

namespace toolkit {
/**
 * ssl证书后缀一般分为以下几种
 * pem:这个是base64的字符编码串，可能存在公钥、私钥或者两者都存在
 * cer:只且只能是公钥，可以与pem的私钥配合使用
 * p12:必须包括私钥和公钥
 * SSL certificate suffixes are generally divided into the following types
 * pem: This is a base64 character encoded string, which may contain a public key, private key, or both
 * cer: Only and must be a public key, can be used with pem private key
 * p12: Must include both private key and public key
 
 * [AUTO-TRANSLATED:1cae2cfa]
 */
class SSLUtil {
public:
    static std::string getLastError();

    /**
     * 加载公钥证书，支持pem,p12,cer后缀
     * 由于openssl加载p12证书时会校验公钥和私钥是否匹对，所以加载p12的公钥时可能需要传入证书密码
     * @param file_path_or_data 文件路径或文件内容
     * @param isFile 是否为文件
     * @return 公钥证书列表
     * Load public key certificate, support pem, p12, cer suffixes
     * When openssl loads p12 certificate, it will verify whether the public key and private key match,
     * so when loading p12 public key, you may need to pass in the certificate password
     * @param file_path_or_data File path or file content
     * @param isFile Whether it is a file
     * @return Public key certificate list
     
     * [AUTO-TRANSLATED:d9dbac61]
     */
    static std::vector<std::shared_ptr<X509> > loadPublicKey(const std::string &file_path_or_data, const std::string &passwd = "", bool isFile = true);

    /**
     * 加载私钥证书，支持pem,p12后缀
     * @param file_path_or_data 文件路径或文件内容
     * @param passwd 密码
     * @param isFile 是否为文件
     * @return 私钥证书
     * Load private key certificate, support pem, p12 suffixes
     * @param file_path_or_data File path or file content
     * @param passwd Password
     * @param isFile Whether it is a file
     * @return Private key certificate
     
     * [AUTO-TRANSLATED:73c495c8]
     */
    static std::shared_ptr<EVP_PKEY> loadPrivateKey(const std::string &file_path_or_data, const std::string &passwd = "", bool isFile = true);

    /**
     * 创建SSL_CTX对象
     * @param cer 公钥数组
     * @param key 私钥
     * @param serverMode 是否为服务器模式或客户端模式
     * @return SSL_CTX对象
     * Create SSL_CTX object
     * @param cer Public key array
     * @param key Private key
     * @param serverMode Whether it is server mode or client mode
     * @return SSL_CTX object
     
     * [AUTO-TRANSLATED:d0faa6a4]
     */
    static std::shared_ptr<SSL_CTX> makeSSLContext(const std::vector<std::shared_ptr<X509> > &cers, const std::shared_ptr<EVP_PKEY> &key, bool serverMode = true, bool checkKey = false);

    /**
     * 创建ssl对象
     * @param ctx SSL_CTX对象
     * Create ssl object
     * @param ctx SSL_CTX object
     
     * [AUTO-TRANSLATED:2e3eb193]
     */
    static std::shared_ptr<SSL> makeSSL(SSL_CTX *ctx);

    /**
     * specifies that the default locations from which CA certificates are loaded should be used.
     * There is one default directory and one default file.
     * The default CA certificates directory is called "certs" in the default OpenSSL directory.
     * Alternatively the SSL_CERT_DIR environment variable can be defined to override this location.
     * The default CA certificates file is called "cert.pem" in the default OpenSSL directory.
     *  Alternatively the SSL_CERT_FILE environment variable can be defined to override this location.
     * 信任/usr/local/ssl/certs/目录下的所有证书/usr/local/ssl/cert.pem的证书
     * 环境变量SSL_CERT_FILE将替换/usr/local/ssl/cert.pem的路径
     * specifies that the default locations from which CA certificates are loaded should be used.
     * There is one default directory and one default file.
     * The default CA certificates directory is called "certs" in the default OpenSSL directory.
     * Alternatively the SSL_CERT_DIR environment variable can be defined to override this location.
     * The default CA certificates file is called "cert.pem" in the default OpenSSL directory.
     *  Alternatively the SSL_CERT_FILE environment variable can be defined to override this location.
     * Trust all certificates in the /usr/local/ssl/certs/ directory and /usr/local/ssl/cert.pem
     * The environment variable SSL_CERT_FILE will replace the path of /usr/local/ssl/cert.pem
     
     * [AUTO-TRANSLATED:f13fc4c5]
     */
    static bool loadDefaultCAs(SSL_CTX *ctx);

    /**
     * 信任某公钥
     * Trust a public key
     
     * [AUTO-TRANSLATED:08987c7e]
     */
    static bool trustCertificate(SSL_CTX *ctx, X509 *cer);


    /**
     * 验证证书合法性
     * @param cer 待验证的证书
     * @param ... 信任的CA根证书，X509类型，以nullptr结尾
     * @return 是否合法
     * Verify the validity of the certificate
     * @param cer Certificate to be verified
     * @param ... Trusted CA root certificates, X509 type, ending with nullptr
     * @return Whether it is valid
     
     * [AUTO-TRANSLATED:1b026a8f]
     */
    static bool verifyX509(X509 *cer, ...);

    /**
     * 使用公钥加解密数据
     * @param cer 公钥，必须为ras的公钥
     * @param in_str 加密或解密的原始数据，实测加密最大支持245个字节，加密后数据长度固定为256个字节
     * @param enc_or_dec true:加密,false:解密
     * @return 加密或解密后的数据
     * Use public key to encrypt and decrypt data
     * @param cer Public key, must be ras public key
     * @param in_str Original data to be encrypted or decrypted, tested to support up to 245 bytes,
     *                encrypted data length is fixed at 256 bytes
     * @param enc_or_dec true: Encrypt, false: Decrypt
     * @return Encrypted or decrypted data
     
     * [AUTO-TRANSLATED:77bc2939]
     */
    static std::string cryptWithRsaPublicKey(X509 *cer, const std::string &in_str, bool enc_or_dec);

    /**
     * 使用私钥加解密数据
     * @param private_key 私钥，必须为ras的私钥
     * @param in_str 加密或解密的原始数据，实测加密最大支持245个字节，加密后数据长度固定为256个字节
     * @param enc_or_dec true:加密,false:解密
     * @return 加密或解密后的数据
     * Use private key to encrypt and decrypt data
     * @param private_key Private key, must be ras private key
     * @param in_str Original data to be encrypted or decrypted, tested to support up to 245 bytes,
     *                encrypted data length is fixed at 256 bytes
     * @param enc_or_dec true: Encrypt, false: Decrypt
     * @return Encrypted or decrypted data
     
     * [AUTO-TRANSLATED:a6e4aeb0]
     */
    static std::string cryptWithRsaPrivateKey(EVP_PKEY *private_key, const std::string &in_str, bool enc_or_dec);

    /**
     * 获取证书域名
     * @param cer 证书公钥
     * @return 证书域名
     * Get certificate domain name
     * @param cer Certificate public key
     * @return Certificate domain name
     
     * [AUTO-TRANSLATED:b3806b53]
     */
    static std::string getServerName(X509 *cer);
};

}//namespace toolkit
#endif //ZLTOOLKIT_SSLUTIL_H