fizz::server::CertManager Class Reference

#include <CertManager.h>

Inheritance diagram for fizz::server::CertManager:

Public Types
using	CertMatch = folly::Optional< std::pair< std::shared_ptr< SelfCert >, SignatureScheme >>

Public Member Functions
virtual	~CertManager ()=default
virtual CertMatch	getCert (const folly::Optional< std::string > &sni, const std::vector< SignatureScheme > &supportedSigSchemes, const std::vector< SignatureScheme > &peerSigSchemes) const
virtual std::shared_ptr< SelfCert >	getCert (const std::string &identity) const
void	addCert (std::shared_ptr< SelfCert > cert, bool defaultCert=false)

Private Types
using	SigSchemeMap = std::map< SignatureScheme, std::shared_ptr< SelfCert >>

Private Member Functions
CertMatch	findCert (const std::string &key, const std::vector< SignatureScheme > &supportedSigSchemes, const std::vector< SignatureScheme > &peerSigSchemes, CertMatch &lastResort) const
void	addCertIdentity (std::shared_ptr< SelfCert > cert, const std::string &ident)

Private Attributes
std::unordered_map< std::string, SigSchemeMap >	certs_
std::unordered_map< std::string, std::shared_ptr< SelfCert > >	identMap_
std::string	default_

Detailed Description

Definition at line 19 of file CertManager.h.

Member Typedef Documentation

using fizz::server::CertManager::CertMatch = folly::Optional<std::pair<std::shared_ptr<SelfCert>, SignatureScheme>>

Definition at line 22 of file CertManager.h.

using fizz::server::CertManager::SigSchemeMap = std::map<SignatureScheme, std::shared_ptr<SelfCert>>

private

Definition at line 56 of file CertManager.h.

Constructor & Destructor Documentation

virtual fizz::server::CertManager::~CertManager ( )

virtualdefault

Member Function Documentation

void fizz::server::CertManager::addCert	(	std::shared_ptr< SelfCert >	cert,
		bool	defaultCert = false
	)

Definition at line 129 of file CertManager.cpp.

References fizz::server::getKeyFromIdent().

                                                                        {
  auto primaryIdent = cert->getIdentity();
  addCertIdentity(cert, primaryIdent);

  auto altIdents = cert->getAltIdentities();
  for (const auto& ident : altIdents) {
    if (ident != primaryIdent) {
      addCertIdentity(cert, ident);
    }
  }

  if (defaultCert) {
    default_ = getKeyFromIdent(primaryIdent);
  }

  if (identMap_.find(primaryIdent) == identMap_.end()) {
    identMap_[primaryIdent] = cert;
  }
}

void fizz::server::CertManager::addCertIdentity ( std::shared_ptr< SelfCert >  cert, const std::string &  ident  )

private

Definition at line 109 of file CertManager.cpp.

References fizz::server::getKeyFromIdent(), and folly::INFO.

                            {
  auto key = getKeyFromIdent(ident);

  if (key.empty() || key == "." || key.find('*') != std::string::npos) {
    throw std::runtime_error(to<std::string>("invalid identity: ", ident));
  }

  auto sigSchemes = cert->getSigSchemes();
  auto& schemeMap = certs_[key];
  for (auto sigScheme : sigSchemes) {
    if (schemeMap.find(sigScheme) != schemeMap.end()) {
      LOG(INFO) << "Skipping duplicate certificate for " << key;
    } else {
      schemeMap[sigScheme] = cert;
    }
  }
}

CertManager::CertMatch fizz::server::CertManager::findCert ( const std::string &  key, const std::vector< SignatureScheme > &  supportedSigSchemes, const std::vector< SignatureScheme > &  peerSigSchemes, CertMatch &  lastResort  ) const

private

Definition at line 21 of file CertManager.cpp.

References folly::none.

                                 {
  auto it = certs_.find(key);
  if (it == certs_.end()) {
    return none;
  }
  for (auto scheme : supportedSigSchemes) {
    auto cert = it->second.find(scheme);
    if (cert == it->second.end()) {
      continue;
    }
    if (std::find(peerSigSchemes.begin(), peerSigSchemes.end(), scheme) !=
        peerSigSchemes.end()) {
      return std::make_pair(cert->second, scheme);
    } else if (!lastResort) {
      lastResort = std::make_pair(cert->second, scheme);
    }
  }
  return none;
}

CertManager::CertMatch fizz::server::CertManager::getCert ( const folly::Optional< std::string > &  sni, const std::vector< SignatureScheme > &  supportedSigSchemes, const std::vector< SignatureScheme > &  peerSigSchemes  ) const

virtual

Select a cert given a client supplied SNI value, server supportedSigSchemes, and client peerSigSchemes.

Will ignore peerSigSchemes if no matching certificate is found.

Definition at line 45 of file CertManager.cpp.

References GCC61971::dot, sni, string, and folly::toLowerAscii().

                                                            {
  CertMatch lastResort;
  if (sni) {
    auto key = *sni;
    toLowerAscii(key);

    auto ret = findCert(key, supportedSigSchemes, peerSigSchemes, lastResort);
    if (ret) {
      VLOG(8) << "Found exact SNI match for: " << key;
      return ret;
    }

    auto dot = key.find_first_of('.');
    if (dot != std::string::npos) {
      std::string wildcardKey(key, dot);
      ret = findCert(
          wildcardKey, supportedSigSchemes, peerSigSchemes, lastResort);
      if (ret) {
        VLOG(8) << "Found wildcard SNI match for: " << key;
        return ret;
      }
    }

    VLOG(8) << "Did not find match for SNI: " << key;
  }

  auto ret =
      findCert(default_, supportedSigSchemes, peerSigSchemes, lastResort);
  if (ret) {
    return ret;
  }

  VLOG(8) << "No matching cert for client sig schemes found";
  return lastResort;
}

std::shared_ptr< SelfCert > fizz::server::CertManager::getCert ( const std::string &  identity ) const

virtual

Return a certificate with the a primary identity exactly matching identity. Will return nullptr if no matching cert is found.

Definition at line 84 of file CertManager.cpp.

                                     {
  auto it = identMap_.find(identity);
  if (it == identMap_.end()) {
    return nullptr;
  }
  return it->second;
}

Member Data Documentation

std::unordered_map<std::string, SigSchemeMap> fizz::server::CertManager::certs_

private

Definition at line 57 of file CertManager.h.

std::string fizz::server::CertManager::default_

private

Definition at line 59 of file CertManager.h.

std::unordered_map<std::string, std::shared_ptr<SelfCert> > fizz::server::CertManager::identMap_

private

Definition at line 58 of file CertManager.h.

---

The documentation for this class was generated from the following files:

• proxygen/fizz/fizz/server/CertManager.h
• proxygen/fizz/fizz/server/CertManager.cpp