Refactor server cert manager

Summary: Adds more flexibility for implementing different cert managers.

Reviewed By: frqiu

Differential Revision: D88404796

fbshipit-source-id: 8c39504c0e49a5933b2a490c7315f89b1a61d924

Author: abakiaydin

third-party/fizz/src/fizz/cmake/FizzSources.cmake

@@ -85,8 +85,8 @@ set(
         record/Types.cpp
         server/AeadCookieCipher.cpp
         server/AeadTokenCipher.cpp
-        server/CertManager.cpp
         server/CookieCipher.cpp
+        server/DefaultCertManager.cpp
         server/FizzServer.cpp
         server/FizzServerContext.cpp
         server/HandshakeLogging.cpp
@@ -247,6 +247,7 @@ set(
         server/CertManager.h
         server/CookieCipher.h
         server/CookieTypes.h
+        server/DefaultCertManager.h
         server/DualTicketCipher.h
         server/FizzServer-inl.h
         server/FizzServer.h

third-party/fizz/src/fizz/experimental/ktls/test/AsyncFizzBaseKTLSTest.cpp

@@ -22,7 +22,7 @@
 #include <fizz/protocol/test/Mocks.h>
 #include <fizz/server/AeadTicketCipher.h>
 #include <fizz/server/AsyncFizzServer.h>
-#include <fizz/server/CertManager.h>
+#include <fizz/server/DefaultCertManager.h>
 #include <fizz/server/FizzServerContext.h>
 #include <fizz/server/TicketCodec.h>
 
@@ -224,13 +224,13 @@ class OneshotRead : public folly::AsyncTransport::ReadCallback {
 
 static std::shared_ptr<fizz::server::FizzServerContext>
 makeTestServerContext() {
-  auto certmanager = std::make_shared<fizz::server::CertManager>();
+  auto certmanager = std::make_shared<fizz::server::DefaultCertManager>();
   certmanager->addCertAndSetDefault(
       openssl::CertUtils::makeSelfCert(
           fizz::test::kP256Certificate.str(), fizz::test::kP256Key.str()));
 
   auto factory = std::make_shared<fizz::test::MockFactory>();
-  auto certManager = std::make_shared<server::CertManager>();
+  auto certManager = std::make_shared<server::DefaultCertManager>();
   auto ticketCipher = std::make_shared<
       Aead128GCMTicketCipher<TicketCodec<CertificateStorage::X509>>>(
       std::move(factory), std::move(certManager));

third-party/fizz/src/fizz/extensions/delegatedcred/DelegatedCredentialCertManager.cpp

@@ -29,14 +29,15 @@ CertMatch DelegatedCredentialCertManager::getCert(
       return dcRes;
     }
   }
-  return CertManager::getCert(sni, supportedSigSchemes, peerSigSchemes, chlo);
+  return DefaultCertManager::getCert(
+      sni, supportedSigSchemes, peerSigSchemes, chlo);
 }
 
 // Falls back to non-delegated if no match.
 std::shared_ptr<SelfCert> DelegatedCredentialCertManager::getCert(
     const std::string& identity) const {
   auto dcRes = dcMgr_.getCert(identity);
-  return dcRes ? dcRes : CertManager::getCert(identity);
+  return dcRes ? dcRes : DefaultCertManager::getCert(identity);
 }
 
 void DelegatedCredentialCertManager::addDelegatedCredentialAndSetDefault(

third-party/fizz/src/fizz/extensions/delegatedcred/DelegatedCredentialCertManager.h

@@ -8,7 +8,7 @@
 #pragma once
 #include <fizz/extensions/delegatedcred/SelfDelegatedCredential.h>
 #include <fizz/extensions/delegatedcred/Types.h>
-#include <fizz/server/CertManager.h>
+#include <fizz/server/DefaultCertManager.h>
 
 namespace fizz {
 namespace extensions {
@@ -17,7 +17,7 @@ namespace extensions {
 // delegated credential extensions and one without. Certs are selected based
 // on the usual rules with the addition of the split between delegated and
 // non-delegated certs.
-class DelegatedCredentialCertManager : public server::CertManager {
+class DelegatedCredentialCertManager : public server::DefaultCertManager {
  public:
   CertMatch getCert(
       const folly::Optional<std::string>& sni,
@@ -35,7 +35,7 @@ class DelegatedCredentialCertManager : public server::CertManager {
   bool hasDelegatedCredential() const;
 
  protected:
-  server::CertManager dcMgr_;
+  server::DefaultCertManager dcMgr_;
 };
 } // namespace extensions
 } // namespace fizz

third-party/fizz/src/fizz/server/CertManager.h

@@ -8,9 +8,6 @@
 
 #pragma once
 
-#include <map>
-#include <unordered_map>
-
 #include <fizz/protocol/CertMatch.h>
 
 namespace fizz {
@@ -29,41 +26,14 @@ class CertManager {
       const folly::Optional<std::string>& sni,
       const std::vector<SignatureScheme>& supportedSigSchemes,
       const std::vector<SignatureScheme>& peerSigSchemes,
-      const ClientHello& chlo) const;
+      const ClientHello& chlo) const = 0;
 
   /**
    * Return a certificate with the a primary identity exactly matching identity.
    * Will return nullptr if no matching cert is found.
    */
-  virtual std::shared_ptr<SelfCert> getCert(const std::string& identity) const;
-
-  void addCertAndSetDefault(std::shared_ptr<SelfCert> cert);
-
-  void addCert(std::shared_ptr<SelfCert> cert);
-
-  bool hasCerts() const;
-
-  using SigSchemeMap = std::map<SignatureScheme, std::shared_ptr<SelfCert>>;
-  const std::unordered_map<std::string, SigSchemeMap>&
-  getCertificatesByIdentity() const;
-
- protected:
-  CertMatch findCert(
-      const std::string& key,
-      const std::vector<SignatureScheme>& supportedSigSchemes,
-      const std::vector<SignatureScheme>& peerSigSchemes) const;
-
-  void addCertIdentity(
-      std::shared_ptr<SelfCert> cert,
-      const std::string& ident);
-
-  void addCert(std::shared_ptr<SelfCert> cert, bool defaultCert);
-
-  static std::string getKeyFromIdent(const std::string& ident);
-
-  std::unordered_map<std::string, SigSchemeMap> certs_;
-  std::unordered_map<std::string, std::shared_ptr<SelfCert>> identMap_;
-  std::string default_;
+  virtual std::shared_ptr<SelfCert> getCert(
+      const std::string& identity) const = 0;
 };
 } // namespace server
 } // namespace fizz

…rty/fizz/src/fizz/server/CertManager.cpp …z/src/fizz/server/DefaultCertManager.cppthird-party/fizz/src/fizz/server/CertManager.cpp renamed to third-party/fizz/src/fizz/server/DefaultCertManager.cpp third-party/fizz/src/fizz/server/CertManager.cpp renamed to third-party/fizz/src/fizz/server/DefaultCertManager.cpp

@@ -6,7 +6,7 @@
  *  LICENSE file in the root directory of this source tree.
  */
 
-#include <fizz/server/CertManager.h>
+#include <fizz/server/DefaultCertManager.h>
 
 #include <folly/String.h>
 
@@ -16,7 +16,7 @@ namespace fizz {
 namespace server {
 
 // Find a matching cert given a key.
-CertMatch CertManager::findCert(
+CertMatch DefaultCertManager::findCert(
     const std::string& key,
     const std::vector<SignatureScheme>& supportedSigSchemes,
     const std::vector<SignatureScheme>& peerSigSchemes) const {
@@ -37,7 +37,7 @@ CertMatch CertManager::findCert(
   return none;
 }
 
-CertMatch CertManager::getCert(
+CertMatch DefaultCertManager::getCert(
     const Optional<std::string>& sni,
     const std::vector<SignatureScheme>& supportedSigSchemes,
     const std::vector<SignatureScheme>& peerSigSchemes,
@@ -75,7 +75,7 @@ CertMatch CertManager::getCert(
   return folly::none;
 }
 
-std::shared_ptr<SelfCert> CertManager::getCert(
+std::shared_ptr<SelfCert> DefaultCertManager::getCert(
     const std::string& identity) const {
   auto it = identMap_.find(identity);
   if (it == identMap_.end()) {
@@ -84,7 +84,7 @@ std::shared_ptr<SelfCert> CertManager::getCert(
   return it->second;
 }
 
-std::string CertManager::getKeyFromIdent(const std::string& ident) {
+std::string DefaultCertManager::getKeyFromIdent(const std::string& ident) {
   if (ident.empty()) {
     throw std::runtime_error("empty identity");
   }
@@ -100,7 +100,7 @@ std::string CertManager::getKeyFromIdent(const std::string& ident) {
   return key;
 }
 
-void CertManager::addCertIdentity(
+void DefaultCertManager::addCertIdentity(
     std::shared_ptr<SelfCert> cert,
     const std::string& ident) {
   auto key = getKeyFromIdent(ident);
@@ -120,15 +120,17 @@ void CertManager::addCertIdentity(
   }
 }
 
-void CertManager::addCert(std::shared_ptr<SelfCert> cert) {
+void DefaultCertManager::addCert(std::shared_ptr<SelfCert> cert) {
   addCert(std::move(cert), false);
 }
 
-void CertManager::addCertAndSetDefault(std::shared_ptr<SelfCert> cert) {
+void DefaultCertManager::addCertAndSetDefault(std::shared_ptr<SelfCert> cert) {
   addCert(std::move(cert), true);
 }
 
-void CertManager::addCert(std::shared_ptr<SelfCert> cert, bool defaultCert) {
+void DefaultCertManager::addCert(
+    std::shared_ptr<SelfCert> cert,
+    bool defaultCert) {
   auto primaryIdent = cert->getIdentity();
   addCertIdentity(cert, primaryIdent);
 
@@ -148,12 +150,12 @@ void CertManager::addCert(std::shared_ptr<SelfCert> cert, bool defaultCert) {
   }
 }
 
-bool CertManager::hasCerts() const {
+bool DefaultCertManager::hasCerts() const {
   return !certs_.empty();
 }
 
-const std::unordered_map<std::string, CertManager::SigSchemeMap>&
-CertManager::getCertificatesByIdentity() const {
+const std::unordered_map<std::string, DefaultCertManager::SigSchemeMap>&
+DefaultCertManager::getCertificatesByIdentity() const {
   return certs_;
 }
 } // namespace server

third-party/fizz/src/fizz/server/DefaultCertManager.h

@@ -0,0 +1,61 @@
+/*
+ *  Copyright (c) 2018-present, Facebook, Inc.
+ *  All rights reserved.
+ *
+ *  This source code is licensed under the BSD-style license found in the
+ *  LICENSE file in the root directory of this source tree.
+ */
+
+#pragma once
+
+#include <map>
+#include <unordered_map>
+
+#include "fizz/server/CertManager.h"
+
+#include <fizz/protocol/CertMatch.h>
+
+namespace fizz {
+namespace server {
+
+class DefaultCertManager : public CertManager {
+ public:
+  virtual CertMatch getCert(
+      const folly::Optional<std::string>& sni,
+      const std::vector<SignatureScheme>& supportedSigSchemes,
+      const std::vector<SignatureScheme>& peerSigSchemes,
+      const ClientHello& chlo) const override;
+
+  virtual std::shared_ptr<SelfCert> getCert(
+      const std::string& identity) const override;
+
+  void addCertAndSetDefault(std::shared_ptr<SelfCert> cert);
+
+  void addCert(std::shared_ptr<SelfCert> cert);
+
+  bool hasCerts() const;
+
+  using SigSchemeMap = std::map<SignatureScheme, std::shared_ptr<SelfCert>>;
+  const std::unordered_map<std::string, SigSchemeMap>&
+  getCertificatesByIdentity() const;
+
+ protected:
+  CertMatch findCert(
+      const std::string& key,
+      const std::vector<SignatureScheme>& supportedSigSchemes,
+      const std::vector<SignatureScheme>& peerSigSchemes) const;
+
+  void addCertIdentity(
+      std::shared_ptr<SelfCert> cert,
+      const std::string& ident);
+
+  void addCert(std::shared_ptr<SelfCert> cert, bool defaultCert);
+
+  static std::string getKeyFromIdent(const std::string& ident);
+
+  std::unordered_map<std::string, SigSchemeMap> certs_;
+  std::unordered_map<std::string, std::shared_ptr<SelfCert>> identMap_;
+  std::string default_;
+};
+} // namespace server
+} // namespace fizz

third-party/fizz/src/fizz/server/test/AeadTicketCipherTest.cpp

@@ -16,6 +16,7 @@
 #include <fizz/crypto/test/TestUtil.h>
 #include <fizz/protocol/clock/test/Mocks.h>
 #include <fizz/protocol/test/Mocks.h>
+#include <fizz/server/DefaultCertManager.h>
 
 using namespace fizz::test;
 using namespace testing;
@@ -80,7 +81,7 @@ class AeadTicketCipherTest : public Test {
   AeadTicketCipherTest()
       : cipher_(
             std::make_shared<MockFactory>(),
-            std::make_shared<CertManager>()) {}
+            std::make_shared<DefaultCertManager>()) {}
 
   ~AeadTicketCipherTest() override = default;
   void SetUp() override {
@@ -102,11 +103,12 @@ class AeadTicketCipherTest : public Test {
     if (!pskContext.empty()) {
       cipher_ = TestAeadTicketCipher(
           std::make_shared<MockFactory>(),
-          std::make_shared<CertManager>(),
+          std::make_shared<DefaultCertManager>(),
           pskContext);
     } else {
       cipher_ = TestAeadTicketCipher(
-          std::make_shared<MockFactory>(), std::make_shared<CertManager>());
+          std::make_shared<MockFactory>(),
+          std::make_shared<DefaultCertManager>());
     }
     cipher_.setPolicy(policy_);
     auto s1 = toIOBuf(ticketSecret1);

third-party/fizz/src/fizz/server/test/CertManagerTest.cpp

@@ -9,7 +9,7 @@
 #include <folly/portability/GMock.h>
 #include <folly/portability/GTest.h>
 
-#include <fizz/server/CertManager.h>
+#include <fizz/server/DefaultCertManager.h>
 
 #include <fizz/protocol/test/Mocks.h>
 
@@ -43,7 +43,7 @@ class CertManagerTest : public Test {
     return chlo;
   }
 
-  CertManager manager_;
+  DefaultCertManager manager_;
 };
 
 TEST_F(CertManagerTest, TestNoMatchDefault) {

third-party/fizz/src/fizz/server/test/TicketCodecTest.cpp

@@ -15,6 +15,7 @@
 #include <fizz/crypto/test/TestUtil.h>
 #include <fizz/protocol/DefaultFactory.h>
 #include <fizz/protocol/test/Mocks.h>
+#include <fizz/server/DefaultCertManager.h>
 #include <fizz/server/test/Mocks.h>
 
 static constexpr folly::StringPiece ticket{
@@ -56,7 +57,7 @@ static ResumptionState getTestResumptionState(
 
 static ResumptionState x509Decode(Buf encoded) {
   fizz::DefaultFactory factory;
-  CertManager certManager;
+  DefaultCertManager certManager;
   return TicketCodec<CertificateStorage::X509>::decode(
       std::move(encoded), factory, certManager);
 }