szaszm commented on code in PR #1336:
URL: https://github.com/apache/nifi-minifi-cpp/pull/1336#discussion_r877083728
##########
libminifi/include/utils/tls/CertificateUtils.h:
##########
@@ -43,14 +50,53 @@ struct X509_deleter {
};
using X509_unique_ptr = std::unique_ptr<X509, X509_deleter>;
+struct BIO_deleter {
+ void operator()(BIO* bio) const { BIO_free(bio); }
+};
+using BIO_unique_ptr = std::unique_ptr<BIO, BIO_deleter>;
+
+struct PKCS12_deleter {
+ void operator()(PKCS12* cert) const { PKCS12_free(cert); }
+};
+using PKCS12_unique_ptr = std::unique_ptr<PKCS12, PKCS12_deleter>;
+
#ifdef WIN32
+class WindowsCertStore {
+ public:
+ WindowsCertStore(const WindowsCertStoreLocation& loc, const std::string&
cert_store);
+
+ bool isOpen() const;
+
+ PCCERT_CONTEXT nextCert();
+
+ ~WindowsCertStore();
+
+ private:
+ HCERTSTORE store_ptr_;
+ PCCERT_CONTEXT cert_ctx_ptr_ = nullptr;
+};
+
// Returns nullptr on errors
X509_unique_ptr convertWindowsCertificate(PCCERT_CONTEXT certificate);
// Returns nullptr if the certificate has no associated private key, or the
private key could not be extracted
EVP_PKEY_unique_ptr extractPrivateKey(PCCERT_CONTEXT certificate);
#endif // WIN32
+std::string getLatestOpenSSLErrorString();
+
+std::optional<std::chrono::system_clock::time_point>
getCertificateExpiration(const X509_unique_ptr& cert);
+
+struct CertHandler {
+ std::function<std::optional<std::string>(const X509_unique_ptr& cert)>
cert_cb;
+ std::function<std::optional<std::string>(X509_unique_ptr cert)>
chain_cert_cb;
+ std::function<std::optional<std::string>(const EVP_PKEY_unique_ptr&
priv_key)> priv_key_cb;
+};
+
+std::optional<std::string> processP12Certificate(const std::string& cert_file,
const std::string& passphrase, const CertHandler& handler);
+
+std::optional<std::string> processPEMCertificate(const std::string& cert_file,
const std::optional<std::string>& passphrase, const CertHandler& handler);
Review Comment:
I think it's OK to depend on this, since there are platforms where `unsigned
long` and `int` are the same size. I would try `gsl::narrow`, so that it would
fail loudly if it ever doesn't fit.
Asio does the same:
https://github.com/chriskohlhoff/asio/blob/master/asio/include/asio/ssl/error.hpp#L102
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
