HTTPClientSSLContext.h

#pragma once
 
#include <xrpl/basics/Log.h>
#include <xrpl/basics/contract.h>
#include <xrpl/beast/utility/Journal.h>
#include <xrpl/net/RegisterSSLCerts.h>
 
#include <boost/asio.hpp>
#include <boost/asio/ip/tcp.hpp>
#include <boost/asio/ssl.hpp>
 
#include <openssl/err.h>
#include <openssl/tls1.h>
 
#include <format>
#include <stdexcept>
#include <string>
#include <type_traits>
 
namespace xrpl {
 
class HTTPClientSSLContext
{
public:
    explicit HTTPClientSSLContext(
        std::string const& sslVerifyDir,
        std::string const& sslVerifyFile,
        bool sslVerify,
        beast::Journal j,
        boost::asio::ssl::context_base::method method = boost::asio::ssl::context::sslv23)
        : sslContext_{method}, j_(j), verify_{sslVerify}
    {
        boost::system::error_code ec;
 
        if (sslVerifyFile.empty())
        {
            registerSSLCerts(sslContext_, ec, j_);
 
            if (ec && sslVerifyDir.empty())
            {
                Throw<std::runtime_error>(
                    std::format("Failed to set_default_verify_paths: {}", ec.message()));
            }
        }
        else
        {
            sslContext_.load_verify_file(sslVerifyFile);
        }
 
        if (!sslVerifyDir.empty())
        {
            sslContext_.add_verify_path(sslVerifyDir, ec);
 
            if (ec)
            {
                Throw<std::runtime_error>(
                    std::format("Failed to add verify path: {}", ec.message()));
            }
        }
    }
 
    boost::asio::ssl::context&
    context()
    {
        return sslContext_;
    }
 
    [[nodiscard]] bool
    sslVerify() const
    {
        return verify_;
    }

    template <class T>
    boost::system::error_code
    preConnectVerify(T& strm, std::string const& host)
        requires(
            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket>> ||
            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket&>>)
    {
        boost::system::error_code ec;
        if (!SSL_set_tlsext_host_name(strm.native_handle(), host.c_str()))
        {
            ec.assign(static_cast<int>(::ERR_get_error()), boost::asio::error::get_ssl_category());
        }
        else if (!sslVerify())
        {
            strm.set_verify_mode(boost::asio::ssl::verify_none, ec);
        }
        return ec;
    }
 
    template <class T>
    boost::system::error_code
    postConnectVerify(T& strm, std::string const& host)
        requires(
            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket>> ||
            std::is_same_v<T, boost::asio::ssl::stream<boost::asio::ip::tcp::socket&>>)
    {
        boost::system::error_code ec;
 
        if (sslVerify())
        {
            strm.set_verify_mode(boost::asio::ssl::verify_peer, ec);
            if (!ec)
            {
                strm.set_verify_callback(
                    [host, j = j_](bool preverified, boost::asio::ssl::verify_context& ctx) {
                        return rfc6125Verify(host, preverified, ctx, j);
                    },
                    ec);
            }
        }
 
        return ec;
    }

    static bool
    rfc6125Verify(
        std::string const& domain,
        bool preverified,
        boost::asio::ssl::verify_context& ctx,
        beast::Journal j)
    {
        if (boost::asio::ssl::host_name_verification(domain)(preverified, ctx))
            return true;
 
        JLOG(j.warn()) << "Outbound SSL connection to " << domain
                       << " fails certificate verification";
        return false;
    }
 
private:
    boost::asio::ssl::context sslContext_;
    beast::Journal const j_;
    bool const verify_;
};
 
}  // namespace xrpl