DCMTK
Version 3.6.3
OFFIS DICOM Toolkit
|
factory class which creates secure TLS transport layer connections and maintains the parameters common to all TLS transport connections in one application (e.g. More...
Public Types | |
typedef SSL_CTX * | native_handle_type |
a type alias for the type of the underlying OpenSSL context handle to be used in conjunction with the getNativeHandle() member function. | |
Public Member Functions | |
DcmTLSTransportLayer () | |
constructor. More... | |
DcmTLSTransportLayer (int networkRole, const char *randFile, OFBool initializeOpenSSL=OFTrue) | |
constructor. More... | |
DcmTLSTransportLayer (OFrvalue_ref(DcmTLSTransportLayer) rhs) | |
move constructor. More... | |
DcmTLSTransportLayer & | operator= (OFrvalue_ref(DcmTLSTransportLayer) rhs) |
move assignment. More... | |
virtual | ~DcmTLSTransportLayer () |
destructor | |
void | clear () |
Free resources, e.g. More... | |
operator OFBool () const | |
Query whether this object has been initialized successfully, i.e. More... | |
OFBool | operator! () const |
Query whether this object has not been initialized, e.g. More... | |
virtual DcmTransportConnection * | createConnection (DcmNativeSocketType openSocket, OFBool useSecureLayer) |
factory method that returns a new transport connection for the given socket. More... | |
DcmTransportLayerStatus | setPrivateKeyFile (const char *fileName, int fileType) |
loads the private key used for authentication of this application from a file. More... | |
DcmTransportLayerStatus | setCertificateFile (const char *fileName, int fileType) |
loads the certificate (public key) used for authentication of this application from a file. More... | |
OFBool | checkPrivateKeyMatchesCertificate () |
checks if the private key and the certificate set using setPrivateKeyFile() and setCertificateFile() match, i.e. More... | |
DcmTransportLayerStatus | addTrustedCertificateFile (const char *fileName, int fileType) |
loads a certificate from a file and adds it to the pool of trusted certificates. More... | |
DcmTransportLayerStatus | addTrustedCertificateDir (const char *pathName, int fileType) |
loads all files as certificates from the specified directory and adds them to the pool of trusted certificates. More... | |
DcmTransportLayerStatus | addTrustedClientCertificateFile (const char *fileName) |
loads certificates from a file and adds them to the pool of trusted client certificates. More... | |
DcmTransportLayerStatus | addVerificationFlags (unsigned long flags) |
appends the given verification flags to the existing ones in this OpenSSL context (using binary or). More... | |
DcmTransportLayerStatus | setCipherSuites (const char *suites) |
sets the list of ciphersuites to negotiate. More... | |
OFBool | canWriteRandomSeed () |
checks if enough entropy data is available to write back a modified random seed file. More... | |
OFBool | writeRandomSeed (const char *randFile) |
writes a modified random seed to file. More... | |
void | seedPRNG (const char *randFile) |
adds the contents of a file to the seed for the cryptographic pseudo-random number generator. More... | |
void | addPRNGseed (void *buf, size_t bufSize) |
modifies the PRNG by adding random data from the given buffer to the PRNG state. More... | |
void | setCertificateVerification (DcmCertificateVerification vtype) |
defines how peer certificates should be treated when negotiating a TLS connection. More... | |
void | setPrivateKeyPasswd (const char *thePasswd) |
sets the password string to be used when loading an encrypted private key file. More... | |
void | setPrivateKeyPasswdFromConsole () |
sets the password string to be used when loading an encrypted private key file to be read from the console stdin. | |
OFBool | setTempDHParameters (const char *filename) |
loads a set of Diffie-Hellman parameters from file. More... | |
native_handle_type | getNativeHandle () |
provides access to the underlying OpenSSL context handle for implementing custom functionality not accessible by the existing member functions of DcmTLSTransportLayer. More... | |
![]() | |
DcmTransportLayer () | |
constructor. | |
DcmTransportLayer (int) | |
constructor. More... | |
DcmTransportLayer (OFrvalue_ref(DcmTransportLayer) rhs) | |
move constructor. More... | |
DcmTransportLayer & | operator= (OFrvalue_ref(DcmTransportLayer) rhs) |
move assignment. More... | |
virtual | ~DcmTransportLayer () |
destructor | |
Static Public Member Functions | |
static unsigned long | getNumberOfCipherSuites () |
returns the number of known ciphersuites. More... | |
static const char * | getTLSCipherSuiteName (unsigned long idx) |
returns a ciphersuite name in RFC 2246 (TLS) form More... | |
static const char * | getOpenSSLCipherSuiteName (unsigned long idx) |
returns a ciphersuite name in OpenSSL form More... | |
static const char * | findOpenSSLCipherSuiteName (const char *tlsCipherSuiteName) |
finds the OpenSSL ciphersuite name for a given RFC 2246 ciphersuite name. More... | |
static OFString | dumpX509Certificate (X509 *peerCertificate) |
gets the most important attributes of the given X.509 certificate. More... | |
Private Member Functions | |
DcmTLSTransportLayer (const DcmTLSTransportLayer &) | |
private undefined copy constructor | |
DcmTLSTransportLayer & | operator= (const DcmTLSTransportLayer &) |
private undefined assignment operator | |
Private Attributes | |
SSL_CTX * | transportLayerContext |
OpenSSL context data, needed only once per application. | |
OFBool | canWriteRandseed |
true if there is enough random data to write a new random seed file | |
OFString | privateKeyPasswd |
contains the password for the private key if set on command line | |
factory class which creates secure TLS transport layer connections and maintains the parameters common to all TLS transport connections in one application (e.g.
the pool of trusted certificates, the key and certificate to be used for authentication and the list of ciphersuite to be used for association negotiation.
DcmTLSTransportLayer::DcmTLSTransportLayer | ( | ) |
constructor.
Constructs a DcmTLSTransportLayer object without initializing it, e.g. as a placeholder that may or may not be used later depending on user input.
DcmTLSTransportLayer::DcmTLSTransportLayer | ( | int | networkRole, |
const char * | randFile, | ||
OFBool | initializeOpenSSL = OFTrue |
||
) |
constructor.
networkRole | network role to be used by the application, influences the choice of the secure transport layer code. |
randFile | path to file used to feed the random generator |
initializeOpenSSL | Determines if OpenSSL library should be initialized. Some setups (e.g. multi-threaded environments) may be interested in using more than one TLS transport layer at a time and thus must make sure the library is only initialized once. |
DcmTLSTransportLayer::DcmTLSTransportLayer | ( | OFrvalue_ref(DcmTLSTransportLayer) | rhs | ) |
move constructor.
Transfer ownership from another DcmTLSTransportLayer object to the newly constructed object (*this).
rhs | an rvalue reference to another DcmTLSTransportLayer object. |
void DcmTLSTransportLayer::addPRNGseed | ( | void * | buf, |
size_t | bufSize | ||
) |
modifies the PRNG by adding random data from the given buffer to the PRNG state.
buf | pointer to buffer containing random data number of bytes in buffer |
DcmTransportLayerStatus DcmTLSTransportLayer::addTrustedCertificateDir | ( | const char * | pathName, |
int | fileType | ||
) |
loads all files as certificates from the specified directory and adds them to the pool of trusted certificates.
fileName | path to the directory containing certificate files |
fileType,must | be SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 |
DcmTransportLayerStatus DcmTLSTransportLayer::addTrustedCertificateFile | ( | const char * | fileName, |
int | fileType | ||
) |
loads a certificate from a file and adds it to the pool of trusted certificates.
fileName | path to the certificate file |
fileType,must | be SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 |
DcmTransportLayerStatus DcmTLSTransportLayer::addTrustedClientCertificateFile | ( | const char * | fileName | ) |
loads certificates from a file and adds them to the pool of trusted client certificates.
fileName | path to the certificate file |
DcmTransportLayerStatus DcmTLSTransportLayer::addVerificationFlags | ( | unsigned long | flags | ) |
appends the given verification flags to the existing ones in this OpenSSL context (using binary or).
flags | the verification flags to append, e. g. X509_V_FLAG_CRL_CHECK. |
|
inline |
checks if enough entropy data is available to write back a modified random seed file.
OFBool DcmTLSTransportLayer::checkPrivateKeyMatchesCertificate | ( | ) |
checks if the private key and the certificate set using setPrivateKeyFile() and setCertificateFile() match, i.e.
if they establish a private/public key pair.
void DcmTLSTransportLayer::clear | ( | ) |
Free resources, e.g.
the OpenSSL context used by this object and reset all members to the default values. Will do nothing if this object has not been initialized, e.g. by using the default constructor.
|
virtual |
factory method that returns a new transport connection for the given socket.
Depending on the second parameter, either a transparent or a secure connection is established. If the object cannot be created (e. g. because no secure layer is available), returns NULL.
openSocket | TCP/IP socket to be used for the transport connection. the connection must already be establised on socket level. If a non-null pointer is returned, the new connection object takes over control of the socket. |
useSecureLayer | if true, a secure layer is used. If false, a transparent layer is used. |
Reimplemented from DcmTransportLayer.
|
static |
gets the most important attributes of the given X.509 certificate.
peerCertificate | X.509 certificate, may be NULL |
|
static |
finds the OpenSSL ciphersuite name for a given RFC 2246 ciphersuite name.
tlsCipherSuiteName | ciphersuite name in RFC 2246 form |
native_handle_type DcmTLSTransportLayer::getNativeHandle | ( | ) |
provides access to the underlying OpenSSL context handle for implementing custom functionality not accessible by the existing member functions of DcmTLSTransportLayer.
|
static |
returns the number of known ciphersuites.
|
static |
returns a ciphersuite name in OpenSSL form
idx | index, must be < getNumberOfCipherSuites() |
|
static |
returns a ciphersuite name in RFC 2246 (TLS) form
idx | index, must be < getNumberOfCipherSuites() |
DcmTLSTransportLayer::operator OFBool | ( | ) | const |
Query whether this object has been initialized successfully, i.e.
whether it owns a successfully created OpenSSL context.
explicit
, which prevents *this to be interpreted as a boolean value in an inappropriate context. You should use this operator with caution when C++11 support is unavailable, as *this might be converted to a boolean value automatically where it shouldn't. OFBool DcmTLSTransportLayer::operator! | ( | ) | const |
Query whether this object has not been initialized, e.g.
has been constructed using the default constructor or the initialization failed.
DcmTLSTransportLayer& DcmTLSTransportLayer::operator= | ( | OFrvalue_ref(DcmTLSTransportLayer) | rhs | ) |
move assignment.
Assign ownership from another DcmTLSTransportLayer object to *this, freeing the existing object first (if any).
rhs | an rvalue reference to another DcmTLSTransportLayer object. |
void DcmTLSTransportLayer::seedPRNG | ( | const char * | randFile | ) |
adds the contents of a file to the seed for the cryptographic pseudo-random number generator.
The file should contain real random entropy data gathered from keystrokes, system events, /dev/random (on Linux) or something similar. If the TLS layer object is not initialized with sufficient random data, negotiation of TLS connections may fail.
randFile | path of the file containing random data |
DcmTransportLayerStatus DcmTLSTransportLayer::setCertificateFile | ( | const char * | fileName, |
int | fileType | ||
) |
loads the certificate (public key) used for authentication of this application from a file.
fileName | path to the certificate file |
fileType,must | be SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 |
void DcmTLSTransportLayer::setCertificateVerification | ( | DcmCertificateVerification | vtype | ) |
defines how peer certificates should be treated when negotiating a TLS connection.
vtype | certificate verification mode |
DcmTransportLayerStatus DcmTLSTransportLayer::setCipherSuites | ( | const char * | suites | ) |
sets the list of ciphersuites to negotiate.
suites | string containing the list of ciphersuites. The list must be in OpenSSL syntax (use findOpenSSLCipherSuiteName to convert from RFC 2246 ciphersuite names to OpenSSL names), with ciphersuites separated by ':' characters. |
DcmTransportLayerStatus DcmTLSTransportLayer::setPrivateKeyFile | ( | const char * | fileName, |
int | fileType | ||
) |
loads the private key used for authentication of this application from a file.
fileName | path to the private key file |
fileType,must | be SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 |
void DcmTLSTransportLayer::setPrivateKeyPasswd | ( | const char * | thePasswd | ) |
sets the password string to be used when loading an encrypted private key file.
Must be called prior to setPrivateKeyFile() in order to be effective.
thePasswd | password string, may be "" or NULL in which case an empty password is assumed. |
OFBool DcmTLSTransportLayer::setTempDHParameters | ( | const char * | filename | ) |
loads a set of Diffie-Hellman parameters from file.
These parameters are required for DH, DHE or DSS ciphersuites.
filename | path to the DH parameter file |
OFBool DcmTLSTransportLayer::writeRandomSeed | ( | const char * | randFile | ) |
writes a modified random seed to file.
randFile | path of file to write |