122 lines
4.4 KiB
C
122 lines
4.4 KiB
C
|
/*
|
|||
|
|
* Copyright (c) 2016 The ZLToolKit project authors. All Rights Reserved.
|
|||
|
|
*
|
|||
|
|
* This file is part of ZLToolKit(https://github.com/ZLMediaKit/ZLToolKit).
|
|||
|
|
*
|
|||
|
|
* Use of this source code is governed by MIT license that can be found in the
|
|||
|
|
* LICENSE file in the root of the source tree. All contributing project authors
|
|||
|
|
* may be found in the AUTHORS file in the root of the source tree.
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
#ifndef ZLTOOLKIT_SSLUTIL_H
|
|||
|
|
#define ZLTOOLKIT_SSLUTIL_H
|
|||
|
|
|
|||
|
|
#include <memory>
|
|||
|
|
#include <string>
|
|||
|
|
#include <vector>
|
|||
|
|
|
|||
|
|
typedef struct x509_st X509;
|
|||
|
|
typedef struct evp_pkey_st EVP_PKEY;
|
|||
|
|
typedef struct ssl_ctx_st SSL_CTX;
|
|||
|
|
typedef struct ssl_st SSL;
|
|||
|
|
typedef struct bio_st BIO;
|
|||
|
|
|
|||
|
|
namespace toolkit {
|
|||
|
|
/**
|
|||
|
|
* ssl证书后缀一般分为以下几种
|
|||
|
|
* pem:这个是base64的字符编码串，可能存在公钥、私钥或者两者都存在
|
|||
|
|
* cer:只且只能是公钥，可以与pem的私钥配合使用
|
|||
|
|
* p12:必须包括私钥和公钥
|
|||
|
|
*/
|
|||
|
|
class SSLUtil {
|
|||
|
|
public:
|
|||
|
|
static std::string getLastError();
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 加载公钥证书，支持pem,p12,cer后缀
|
|||
|
|
* 由于openssl加载p12证书时会校验公钥和私钥是否匹对，所以加载p12的公钥时可能需要传入证书密码
|
|||
|
|
* @param file_path_or_data 文件路径或文件内容
|
|||
|
|
* @param isFile 是否为文件
|
|||
|
|
* @return 公钥证书列表
|
|||
|
|
*/
|
|||
|
|
static std::vector<std::shared_ptr<X509> > loadPublicKey(const std::string &file_path_or_data, const std::string &passwd = "", bool isFile = true);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 加载私钥证书，支持pem,p12后缀
|
|||
|
|
* @param file_path_or_data 文件路径或文件内容
|
|||
|
|
* @param passwd 密码
|
|||
|
|
* @param isFile 是否为文件
|
|||
|
|
* @return 私钥证书
|
|||
|
|
*/
|
|||
|
|
static std::shared_ptr<EVP_PKEY> loadPrivateKey(const std::string &file_path_or_data, const std::string &passwd = "", bool isFile = true);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 创建SSL_CTX对象
|
|||
|
|
* @param cer 公钥数组
|
|||
|
|
* @param key 私钥
|
|||
|
|
* @param serverMode 是否为服务器模式或客户端模式
|
|||
|
|
* @return SSL_CTX对象
|
|||
|
|
*/
|
|||
|
|
static std::shared_ptr<SSL_CTX> makeSSLContext(const std::vector<std::shared_ptr<X509> > &cers, const std::shared_ptr<EVP_PKEY> &key, bool serverMode = true, bool checkKey = false);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 创建ssl对象
|
|||
|
|
* @param ctx SSL_CTX对象
|
|||
|
|
*/
|
|||
|
|
static std::shared_ptr<SSL> makeSSL(SSL_CTX *ctx);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* specifies that the default locations from which CA certificates are loaded should be used.
|
|||
|
|
* There is one default directory and one default file.
|
|||
|
|
* The default CA certificates directory is called "certs" in the default OpenSSL directory.
|
|||
|
|
* Alternatively the SSL_CERT_DIR environment variable can be defined to override this location.
|
|||
|
|
* The default CA certificates file is called "cert.pem" in the default OpenSSL directory.
|
|||
|
|
* Alternatively the SSL_CERT_FILE environment variable can be defined to override this location.
|
|||
|
|
* 信任/usr/local/ssl/certs/目录下的所有证书/usr/local/ssl/cert.pem的证书
|
|||
|
|
* 环境变量SSL_CERT_FILE将替换/usr/local/ssl/cert.pem的路径
|
|||
|
|
*/
|
|||
|
|
static bool loadDefaultCAs(SSL_CTX *ctx);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 信任某公钥
|
|||
|
|
*/
|
|||
|
|
static bool trustCertificate(SSL_CTX *ctx, X509 *cer);
|
|||
|
|
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 验证证书合法性
|
|||
|
|
* @param cer 待验证的证书
|
|||
|
|
* @param ... 信任的CA根证书，X509类型，以nullptr结尾
|
|||
|
|
* @return 是否合法
|
|||
|
|
*/
|
|||
|
|
static bool verifyX509(X509 *cer, ...);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 使用公钥加解密数据
|
|||
|
|
* @param cer 公钥，必须为ras的公钥
|
|||
|
|
* @param in_str 加密或解密的原始数据，实测加密最大支持245个字节，加密后数据长度固定为256个字节
|
|||
|
|
* @param enc_or_dec true:加密,false:解密
|
|||
|
|
* @return 加密或解密后的数据
|
|||
|
|
*/
|
|||
|
|
static std::string cryptWithRsaPublicKey(X509 *cer, const std::string &in_str, bool enc_or_dec);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 使用私钥加解密数据
|
|||
|
|
* @param private_key 私钥，必须为ras的私钥
|
|||
|
|
* @param in_str 加密或解密的原始数据，实测加密最大支持245个字节，加密后数据长度固定为256个字节
|
|||
|
|
* @param enc_or_dec true:加密,false:解密
|
|||
|
|
* @return 加密或解密后的数据
|
|||
|
|
*/
|
|||
|
|
static std::string cryptWithRsaPrivateKey(EVP_PKEY *private_key, const std::string &in_str, bool enc_or_dec);
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 获取证书域名
|
|||
|
|
* @param cer 证书公钥
|
|||
|
|
* @return 证书域名
|
|||
|
|
*/
|
|||
|
|
static std::string getServerName(X509 *cer);
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
}//namespace toolkit
|
|||
|
|
#endif //ZLTOOLKIT_SSLUTIL_H
|