intégration des logiciels tier comme NanoMQ ainsi que les fichiers json de score

_software_lib/nanomq-0.22.10/include/nng/supplemental/tls/engine.h

@@ -0,0 +1,222 @@
+//
+// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+//
+// This software is supplied under the terms of the MIT License, a
+// copy of which should be located in the distribution where this
+// file was obtained (LICENSE.txt).  A copy of the license may also be
+// found online at https://opensource.org/licenses/MIT.
+//
+
+// This file is used to enable external TLS "engines", so
+// that third party TLS libraries can be plugged in
+
+#ifndef NNG_SUPPLEMENTAL_TLS_ENGINE_H
+#define NNG_SUPPLEMENTAL_TLS_ENGINE_H
+
+#include <nng/supplemental/tls/tls.h>
+
+// Locking theory statement for TLS engines.  The engine is assumed
+// operate only from the context of threads called by the common
+// framework.  That is to say, the callbacks made by the engine
+// should always be on a thread that has context from the framework
+// calling into the engine.  This means that the lower level send
+// and receive functions can assume that they have lock ownership
+// inherited on the stack.
+
+// nng_tls_engine_conn represents the engine-specific private
+// state for a TLS connection.  It is provided here for type
+// safety.  Engine implementations should provide the structure
+// definition locally.
+typedef struct nng_tls_engine_conn nng_tls_engine_conn;
+
+// nng_tls_engine_config represents the engine-specific private
+// state for the TLS configuration.  It is provided here for type
+// safety.  Engine implementations should provide the structure
+// definition locally.
+typedef struct nng_tls_engine_config nng_tls_engine_config;
+
+typedef struct nng_tls_engine_conn_ops_s {
+	// size is the size of the engine's per-connection state.
+	// The framework will allocate this on behalf of the engine.
+	// Typically this will be sizeof (struct nng_tls_engine_conn).
+	size_t size;
+
+	// init is used to initialize a connection object.
+	// The passed in connection state will be aligned naturally,
+	// and zeroed.  On success this returns 0, else an NNG error code.
+	int (*init)(nng_tls_engine_conn *, void *, nng_tls_engine_config *);
+
+	// fini destroys a connection object.  This will
+	// be called only when no other external use of the connection
+	// object exists, and only on fully initialed connection objects.
+	void (*fini)(nng_tls_engine_conn *);
+
+	// close closes the connection object, but should not
+	// deallocate any memory.  It may also issue a TLS close-notify.
+	void (*close)(nng_tls_engine_conn *);
+
+	// handshake attempts to complete the SSL handshake phase.
+	// It returns zero on success, or an error if one occurred.
+	// The value NNG_EAGAIN should be returned if underlying I/O
+	// is required to be completed first.  The framework will
+	// ensure that the handshake completes before sending any data
+	// down.
+	int (*handshake)(nng_tls_engine_conn *);
+
+	// recv attempts to read data (decrypted) from the connection.
+	// It returns 0 on success, otherwise an error.  The implementation
+	// should return NNG_EAGAIN if I/O to the underlying stream is
+	// required to complete the operation.  On success, the count
+	// is updated to reflect the number of bytes actually received.
+	int (*recv)(nng_tls_engine_conn *, uint8_t *, size_t *);
+
+	// send attempts to write data to the underlying connection.
+	// It returns zero on success, otherwise an error. The implementation
+	// should return NNG_EAGAIN if I/O to the underlying stream is
+	// required to complete the operation.  On success, the count
+	// is updated to reflect the number of bytes actually sent.
+	int (*send)(nng_tls_engine_conn *, const uint8_t *, size_t *);
+
+	// verified returns true if the connection is fully
+	// TLS verified, false otherwise.
+	bool (*verified)(nng_tls_engine_conn *);
+
+	// peer_cn returns the common name of the peer
+	// The return string needs to be freed.
+	char *(*peer_cn)(nng_tls_engine_conn *);
+
+	// peer_alt_names returns the subject alternative names.
+	// The return string list and its strings need to be freed.
+	char **(*peer_alt_names)(nng_tls_engine_conn *);
+} nng_tls_engine_conn_ops;
+
+typedef struct nng_tls_engine_config_ops_s {
+	// size is the size of the engine's configuration object.
+	// The framework will allocate this on behalf of the engine.
+	// Typically this will be sizeof (struct nng_tls_engine_config).
+	size_t size;
+
+	// init prepares the configuration object object.
+	// The mode indicates whether the object should be
+	// initialized for use as a TLS server or client.
+	// The config passed in will be aligned on a 64-bit boundary,
+	// and will be initialized to zero.  On success this returns
+	// 0, else an NNG error code.
+	int (*init)(nng_tls_engine_config *, nng_tls_mode);
+
+	// fini is used to tear down the configuration object.
+	// This will only be called on objects that have been properly
+	// initialized with nte_config_init.
+	void (*fini)(nng_tls_engine_config *);
+
+	// server is used to set the server name.  This can be used in SNI,
+	// and will also be used on the client to validate the identity.
+	// If this is not set, then no verification will be performed.
+	int (*server)(nng_tls_engine_config *, const char *);
+
+	// auth is used to configure the authentication mode.  Values:
+	// NNG_AUTH_MODE_NONE
+	//   No validation of the peer is performed.  Public facing
+	//   servers often use this.
+	// NNG_AUTH_MODE_OPTIONAL
+	//   The peer's identity is validated if a certificate is presented.
+	//   This is typically useful on servers.
+	// NNG_AUTH_MODE_REQUIRED
+	//   The peer's certificate must be present and is verified.
+	//   This is standard for the client, and on servers it is used
+	//   when client (mutual) authentication is needed.
+	int (*auth)(nng_tls_engine_config *, nng_tls_auth_mode);
+
+	// ca_chain sets the configuration authorities that will be
+	// used to validate peers.  An optional CRL is supplied as well.
+	// Both values are C strings (NUL terminated) containing
+	// PEM data.  There may be multiple PEM blocks.  The
+	// CRL may be NULL if not needed.
+	int (*ca_chain)(nng_tls_engine_config *, const char *, const char *);
+
+	// own_cert configures our identity -- the certificate containing
+	// our public key, our private key (which might be encrypted), and
+	// potentially a password used to decrypt the private key.
+	// All of these are C strings.  The cert may actually be a chain
+	// which will be presented to our peer.   This function may be
+	// called multiple times to register different keys with different
+	// parameters on a server.  (For example, once for RSA parameters,
+	// and again later with EC parameters.)  The certificate and the
+	// private key may be presented in the same file.  The implementation
+	// is responsible for parsing out the relevant data.  If the password
+	// is NULL, then the key file should be unencrypted.  The supplied
+	// password may be ignored if the key is not encrypted.  Not all
+	// engine implementations need support encryption of the key.
+	int (*own_cert)(
+	    nng_tls_engine_config *, const char *, const char *, const char *);
+
+	// psk configures a PSK identity and key.  This can be called
+	// once for clients, or multiple times for servers.  However, not all
+	// implementations support multiple PSKs for a server.
+	int (*psk)(
+	    nng_tls_engine_config *, const char *, const uint8_t *, size_t);
+
+	// version configures the minimum and maximum TLS versions.  The
+	// engine should default to supporting TLS1.0 through 1.2, and
+	// optionally 1.3 if it can.  The engine should restrict the
+	// the requested range to what it can support -- if no version
+	// within the range is supported (such as if NNG_TLS_1_3 is
+	// specified for both min and max, and the engine lacks support
+	// for v1.3, then NNG_ENOTSUP should be returned.
+	int (*version)(
+	    nng_tls_engine_config *, nng_tls_version, nng_tls_version);
+} nng_tls_engine_config_ops;
+
+typedef enum nng_tls_engine_version_e {
+	NNG_TLS_ENGINE_V0      = 0,
+	NNG_TLS_ENGINE_V1      = 1, // adds FIPS, TLS 1.3 support
+	NNG_TLS_ENGINE_V2      = 2, // adds PSK support
+	NNG_TLS_ENGINE_VERSION = NNG_TLS_ENGINE_V2,
+} nng_tls_engine_version;
+
+typedef struct nng_tls_engine_s {
+	// _version is the engine version.  This for now must
+	// be NNG_TLS_ENGINE_VERSION.  If the version does not match
+	// then registration of the engine will fail.
+	nng_tls_engine_version version;
+
+	// config_ops is the operations for TLS configuration objects.
+	nng_tls_engine_config_ops *config_ops;
+
+	// conn_ops is the operations for TLS connections (stream-oriented).
+	nng_tls_engine_conn_ops *conn_ops;
+
+	// name contains the name of the engine, for example "wolfSSL".
+	// It is acceptable to append a version number as well.
+	const char *name;
+
+	// description contains a human readable description.  This can
+	// supply information about the backing library, for example
+	// "mbed TLS v2.7"
+	const char *description;
+
+	// fips_mode is true if the engine is in FIPS mode.
+	// It is expected that this will be enabled either at compile
+	// time, or via environment variables at engine initialization.
+	// FIPS mode cannot be changed once the engine is registered.
+	bool fips_mode;
+} nng_tls_engine;
+
+NNG_DECL int nng_tls_engine_register(const nng_tls_engine *);
+
+// nng_tls_engine_send is called by the engine to send data over the
+// underlying connection.  It returns zero on success, NNG_EAGAIN if
+// the operation can't be completed yet (the transport is busy and cannot
+// accept more data yet), or some other error.  On success the count is
+// updated with the number of bytes actually sent.  The first argument
+// is the context structure passed in when starting the engine.
+NNG_DECL int nng_tls_engine_send(void *, const uint8_t *, size_t *);
+
+// nng_tls_engine_recv is called byu the engine to receive data over
+// the underlying connection.  It returns zero on success, NNG_EAGAIN
+// if the operation can't be completed yet (there is no data available
+// for reading), or some other error.  On success the count is updated
+// with the number of bytes actually received.
+NNG_DECL int nng_tls_engine_recv(void *, uint8_t *, size_t *);
+
+#endif // NNG_SUPPLEMENTAL_TLS_ENGINE_H

_software_lib/nanomq-0.22.10/include/nng/supplemental/tls/tls.h

@@ -0,0 +1,152 @@
+//
+// Copyright 2024 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2018 Capitar IT Group BV <info@capitar.com>
+//
+// This software is supplied under the terms of the MIT License, a
+// copy of which should be located in the distribution where this
+// file was obtained (LICENSE.txt).  A copy of the license may also be
+// found online at https://opensource.org/licenses/MIT.
+//
+
+#ifndef NNG_SUPPLEMENTAL_TLS_TLS_H
+#define NNG_SUPPLEMENTAL_TLS_TLS_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <nng/nng.h>
+
+// Note that TLS functions may be stubbed out if TLS is not enabled in
+// the build.
+
+// For some transports, we need TLS configuration, including certificates
+// and so forth.  A TLS configuration cannot be changed once it is in use.
+typedef struct nng_tls_config nng_tls_config;
+
+typedef enum nng_tls_mode {
+	NNG_TLS_MODE_CLIENT = 0,
+	NNG_TLS_MODE_SERVER = 1,
+} nng_tls_mode;
+
+typedef enum nng_tls_auth_mode {
+	NNG_TLS_AUTH_MODE_NONE     = 0, // No verification is performed
+	NNG_TLS_AUTH_MODE_OPTIONAL = 1, // Verify cert if presented
+	NNG_TLS_AUTH_MODE_REQUIRED = 2, // Verify cert, close if invalid
+} nng_tls_auth_mode;
+
+// TLS version numbers.  We encode the major number and minor number
+// as separate byte fields.  No support for SSL 3.0 or earlier -- older
+// versions are known to be insecure and should not be used.
+// When possible applications should restrict themselves to TLS 1.2 or better.
+typedef enum nng_tls_version {
+	NNG_TLS_1_0 = 0x301,
+	NNG_TLS_1_1 = 0x302,
+	NNG_TLS_1_2 = 0x303,
+	NNG_TLS_1_3 = 0x304
+} nng_tls_version;
+
+// nng_tls_config_alloc creates a TLS configuration using
+// reasonable defaults.  This configuration can be shared
+// with multiple pipes or services/servers.
+NNG_DECL int nng_tls_config_alloc(nng_tls_config **, nng_tls_mode);
+
+// nng_tls_config_hold increments the reference count on the TLS
+// configuration object.  The hold can be dropped by calling
+// nng_tls_config_free later.
+NNG_DECL void nng_tls_config_hold(nng_tls_config *);
+
+// nng_tls_config_free drops the reference count on the TLS
+// configuration object, and if zero, deallocates it.
+NNG_DECL void nng_tls_config_free(nng_tls_config *);
+
+// nng_tls_config_server_name sets the server name.  This is
+// called by clients to set the name that the server supplied
+// certificate should be matched against.  This can also cause
+// the SNI to be sent to the server to tell it which cert to
+// use if it supports more than one.
+NNG_DECL int nng_tls_config_server_name(nng_tls_config *, const char *);
+
+// nng_tls_config_ca_cert configures one or more CAs used for validation
+// of peer certificates.  Multiple CAs (and their chains) may be configured
+// by either calling this multiple times, or by specifying a list of
+// certificates as concatenated data.  The final argument is an optional CRL
+// (revocation list) for the CA, also in PEM.  Both PEM strings are ASCIIZ
+// format (except that the CRL may be NULL).
+NNG_DECL int nng_tls_config_ca_chain(
+    nng_tls_config *, const char *, const char *);
+
+// nng_tls_config_own_cert is used to load our own certificate and public
+// key.  For servers, this may be called more than once to configure multiple
+// different keys, for example with different algorithms depending on what
+// the peer supports. On the client, only a single option is available.
+// The first two arguments are the cert (or validation chain) and the
+// key as PEM format ASCIIZ strings.  The final argument is an optional
+// password and may be NULL.
+NNG_DECL int nng_tls_config_own_cert(
+    nng_tls_config *, const char *, const char *, const char *);
+
+// nng_tls_config_key is used to pass our own private key.
+NNG_DECL int nng_tls_config_key(nng_tls_config *, const uint8_t *, size_t);
+
+// nng_tls_config_pass is used to pass a password used to decrypt
+// private keys that are encrypted.
+NNG_DECL int nng_tls_config_pass(nng_tls_config *, const char *);
+
+// nng_tls_config_auth_mode is used to configure the authentication mode use.
+// The default is that servers have this off (i.e. no client authentication)
+// and clients have it on (they verify the server), which matches typical
+// practice.
+NNG_DECL int nng_tls_config_auth_mode(nng_tls_config *, nng_tls_auth_mode);
+
+// nng_tls_config_ca_file is used to pass a CA chain and optional CRL
+// via the filesystem.  If CRL data is present, it must be contained
+// in the file, along with the CA certificate data.  The format is PEM.
+// The path name must be a legal file name.
+NNG_DECL int nng_tls_config_ca_file(nng_tls_config *, const char *);
+
+// nng_tls_config_cert_key_file is used to pass our own certificate and
+// private key data via the filesystem.  Both the key and certificate
+// must be present as PEM blocks in the same file.  A password is used to
+// decrypt the private key if it is encrypted and the password supplied is not
+// NULL. This may be called multiple times on servers, but only once on a
+// client. (Servers can support multiple different certificates and keys for
+// different cryptographic algorithms.  Clients only get one.)
+NNG_DECL int nng_tls_config_cert_key_file(
+    nng_tls_config *, const char *, const char *);
+
+// nng_tls_config_psk_identity is used to pass TLS PSK parameters.  The
+// identity, and an associated key.  Clients can only do this once.
+// Servers can do it multiple times, potentially, to provide for different
+// keys for different client identities.  There is no way to remove these
+// from a configuration.
+NNG_DECL int nng_tls_config_psk(
+    nng_tls_config *, const char *, const uint8_t *, size_t);
+
+// Configure supported TLS version.  By default we usually restrict
+// ourselves to TLS 1.2 and newer.  We do not support older versions.
+// If the implementation cannot support any version (for example if
+// the minimum requested is 1.3 but the TLS implementation lacks support
+// for TLS 1.3) then NNG_ENOTSUP will be returned.
+NNG_DECL int nng_tls_config_version(
+    nng_tls_config *, nng_tls_version, nng_tls_version);
+
+// nng_tls_engine_name returns the "name" of the TLS engine.  If no
+// TLS engine support is enabled, then "none" is returned.
+NNG_DECL const char *nng_tls_engine_name(void);
+
+// nng_tls_engine_description returns the "description" of the TLS engine.
+// If no TLS engine support is enabled, then an empty string is returned.
+NNG_DECL const char *nng_tls_engine_description(void);
+
+// nng_tls_engine_fips_mode returns true if the engine is in FIPS 140-2 mode.
+NNG_DECL bool nng_tls_engine_fips_mode(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // NNG_SUPPLEMENTAL_TLS_TLS_H