tls_policy.h

Go to the documentation of this file.

// BSD 3-Clause License
// Copyright (c) 2021-2025, 🍀☀🌕🌥 🌊
// See the LICENSE file in the project root for full license information.
 
#pragma once
 
#include <cstdint>
#include <optional>
#include <string>
#include <string_view>
#include <vector>
 
namespace kcenon::pacs::security {
 
enum class tls_profile {
    bcp195_basic,
 
    bcp195_non_downgrading,
 
    bcp195_extended
};
 
[[nodiscard]] std::string_view to_string(tls_profile profile) noexcept;
 
[[nodiscard]] std::optional<tls_profile> parse_tls_profile(
    std::string_view str) noexcept;
 
struct cipher_suite_spec {
    std::string tls13_ciphers;
 
    std::string tls12_ciphers;
};
 
struct certificate_constraints {
    uint16_t min_rsa_key_bits{2048};
 
    uint16_t min_ecdsa_curve_bits{256};
 
    uint8_t max_chain_depth{5};
 
    bool require_peer_verification{true};
};
 
class tls_policy {
public:
    [[nodiscard]] static tls_policy bcp195_basic_profile();
 
    [[nodiscard]] static tls_policy bcp195_non_downgrading_profile();
 
    [[nodiscard]] static tls_policy bcp195_extended_profile();
 
    [[nodiscard]] static tls_policy from_profile(tls_profile profile);
 
 
    [[nodiscard]] tls_profile profile() const noexcept;
    [[nodiscard]] std::string_view profile_name() const noexcept;
 
    [[nodiscard]] uint16_t min_protocol_version() const noexcept;
    [[nodiscard]] uint16_t max_protocol_version() const noexcept;
 
    [[nodiscard]] bool non_downgrading() const noexcept;
 
    [[nodiscard]] const cipher_suite_spec& cipher_suites() const noexcept;
    [[nodiscard]] const certificate_constraints& cert_constraints() const noexcept;
 
 
 
    [[nodiscard]] bool is_version_allowed(uint16_t version) const noexcept;
 
    [[nodiscard]] bool is_rsa_key_acceptable(uint16_t bits) const noexcept;
 
    [[nodiscard]] bool is_ecdsa_key_acceptable(uint16_t bits) const noexcept;
 
    [[nodiscard]] std::string_view tls13_ciphersuites() const noexcept;
 
    [[nodiscard]] std::string_view tls12_ciphersuites() const noexcept;
 
 
 
    static constexpr std::string_view kTls13Required =
        "TLS_AES_256_GCM_SHA384:"
        "TLS_AES_128_GCM_SHA256:"
        "TLS_CHACHA20_POLY1305_SHA256";
 
    static constexpr std::string_view kTls13Strict =
        "TLS_AES_256_GCM_SHA384:"
        "TLS_CHACHA20_POLY1305_SHA256";
 
    static constexpr std::string_view kTls12Recommended =
        "ECDHE-ECDSA-AES256-GCM-SHA384:"
        "ECDHE-RSA-AES256-GCM-SHA384:"
        "ECDHE-ECDSA-CHACHA20-POLY1305:"
        "ECDHE-RSA-CHACHA20-POLY1305:"
        "ECDHE-ECDSA-AES128-GCM-SHA256:"
        "ECDHE-RSA-AES128-GCM-SHA256";
 
 
 
    static constexpr uint16_t kTls10Version = 0x0301;
    static constexpr uint16_t kTls11Version = 0x0302;
    static constexpr uint16_t kTls12Version = 0x0303;
    static constexpr uint16_t kTls13Version = 0x0304;
 
 
private:
    tls_policy(tls_profile prof, uint16_t min_ver, uint16_t max_ver,
               bool non_downgrade, cipher_suite_spec ciphers,
               certificate_constraints certs);
 
    tls_profile profile_;
    uint16_t min_version_;
    uint16_t max_version_;
    bool non_downgrading_;
    cipher_suite_spec ciphers_;
    certificate_constraints cert_constraints_;
};
 
[[nodiscard]] std::vector<tls_profile> available_tls_profiles();
 
}  // namespace kcenon::pacs::security