peer_fingerprint.hpp

//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2012-2021 OpenVPN Inc.
//
//    This program is free software: you can redistribute it and/or modify
//    it under the terms of the GNU Affero General Public License Version 3
//    as published by the Free Software Foundation.
//
//    This program is distributed in the hope that it will be useful,
//    but WITHOUT ANY WARRANTY; without even the implied warranty of
//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
//    GNU Affero General Public License for more details.
//
//    You should have received a copy of the GNU Affero General Public License
//    along with this program in the COPYING file.
//    If not, see <http://www.gnu.org/licenses/>.
//

#pragma once

#include <openvpn/common/options.hpp>

namespace openvpn {

struct PeerFingerprint {
  PeerFingerprint(const std::string& fp, const std::size_t size)
  {
    std::istringstream input(fp);
    input.setf(std::ios_base::hex, std::ios_base::basefield);
    input.unsetf(std::ios_base::skipws);
    fingerprint_.reserve(size);

    unsigned int val;
    if (input >> val && val < 256)
      {
	fingerprint_.emplace_back(val);

	while (input)
	  {
	    char sep;
	    if (input >> sep >> val && sep == ':' && val < 256)
	      fingerprint_.emplace_back(val);
	    else
	      break;
	  }
      }

    if (fingerprint_.size() != fingerprint_.capacity())
      throw option_error("malformed peer-fingerprint: " + fp);
  }

  explicit PeerFingerprint(const std::vector<uint8_t>& fingerprint)
    : fingerprint_(fingerprint)
  {}

  bool operator==(const PeerFingerprint& that) const
  {
    return fingerprint_ == that.fingerprint_;
  }

  std::string str() const
  {
    std::ostringstream output;
    output.setf(std::ios_base::hex, std::ios_base::basefield);
    output.fill('0');
    output.width(2);

    for (const int v : fingerprint_)
      output << v << ':';

    std::string str(output.str());
    if (str.size())
      str.erase(str.size() - 1);

    return str;
  }

protected:
  std::vector<uint8_t> fingerprint_;
};

/**
 *  Parses the --peer-fingerprint configuration option
 *  and provides the logic to validate an X.509 certificate
 *  against such an option.
 */
struct PeerFingerprints {
  PeerFingerprints() = default;

  PeerFingerprints(const OptionList& opt, const std::size_t fp_size)
  {
    const auto indices = opt.get_index_ptr("peer-fingerprint");
    if (indices == nullptr)
      return;

    for (const auto i : *indices)
      {
	std::istringstream fps(opt[i].get(1, Option::MULTILINE));
	std::string fp;

	opt[i].touch();
	while (std::getline(fps, fp))
	  fingerprints_.emplace_back(PeerFingerprint(fp, fp_size));
      }
  }

  bool match(const PeerFingerprint& fp) const
  {
    for (const auto& fingerprint: fingerprints_)
      {
	if (fingerprint == fp)
	  return true;
      }

    return false;
  }

  explicit operator bool() { return !fingerprints_.empty(); }

protected:
  std::vector<PeerFingerprint> fingerprints_;
};

}