RADSecurity.h

Go to the documentation of this file.

#ifndef RADSECURITY_H
#define RADSECURITY_H
 
#pragma once
 
#include <RADCore/RADCore.h>
 
#include <cstdint>
#include <string>
#include <vector>
 
namespace RADSecurity {
 
    struct CapabilitySet {
        uint64_t effective = 0;
        uint64_t permitted = 0;
        uint64_t inheritable = 0;
        uint64_t bounding = 0;
 
        bool hasEffective(int capabilityNumber) const;
    };
 
    struct SandboxProfile {
        std::string name;
        std::vector<std::string> readOnlyPaths;
        std::vector<std::string> writablePaths;
        bool allowNetwork = false;
        bool allowDeviceAccess = false;
    };
 
    class Crypto {
    public:
        static std::vector<uint8_t> sha256(const std::vector<uint8_t>& bytes);
        static std::vector<uint8_t> sha256(const std::string& text);
        static RADCore::RADResult<std::vector<uint8_t>> sha256File(const std::string& path);
        static std::string toHex(const std::vector<uint8_t>& bytes);
        static RADCore::RADResult<std::vector<uint8_t>> fromHex(const std::string& hex);
        static RADCore::RADResult<std::vector<uint8_t>> randomBytes(size_t count);
        static RADCore::RADResult<std::string> generateRsaPrivateKeyPem(int bits = 2048);
        static RADCore::RADResult<std::string> publicKeyFromPrivateKeyPem(const std::string& privateKeyPem);
        static RADCore::RADResult<std::vector<uint8_t>> signSha256(
            const std::vector<uint8_t>& bytes, const std::string& privateKeyPem);
        static bool verifySha256(const std::vector<uint8_t>& bytes,
            const std::vector<uint8_t>& signature, const std::string& publicKeyPem);
        static RADCore::RADResult<void> signFileSha256(
            const std::string& filePath, const std::string& signaturePath, const std::string& privateKeyPem);
        static bool verifyFileSha256(
            const std::string& filePath, const std::string& signaturePath, const std::string& publicKeyPem);
        static RADCore::RADResult<std::string> fileFingerprintSha256(const std::string& path);
    };
 
    RADCore::RADResult<CapabilitySet> readCapabilitySet(
        const std::string& procStatusPath = "/proc/self/status");
    RADCore::RADJsonValue sandboxProfileToJson(const SandboxProfile& profile);
    SandboxProfile sandboxProfileFromJson(const RADCore::RADJsonValue& value);
 
    enum class LicenseKind {
        Unknown,
        Community,
        Evaluation,
        Academic,
        SmallBusiness,
        Commercial,
        Partner,
        Internal
    };
 
    enum class LicenseStatus {
        Valid,
        Missing,
        ParseError,
        BadSignature,
        UnknownIssuerKey,
        RevokedIssuerKey,
        NotYetValid,
        Expired,
        ProductMismatch,
        VersionMismatch,
        MachineMismatch,
        LicenseeMismatch,
        FeatureMissing
    };
 
    struct LicensePayload {
        std::string product;
        std::string licenseId;
        std::string licensee;
        std::string email;
        LicenseKind kind = LicenseKind::Unknown;
        std::string issuedAt;
        std::string expiresAt;
        std::string validFrom;
        std::string machineFingerprint;
        std::string licenseePublicKeyFingerprint;
        std::string termsId;
        int maxMajorVersion = 0;
        int seats = 0;
        std::vector<std::string> features;
    };
 
    struct LicenseCheckOptions {
        std::string requiredIssuerKeyId;
        std::string product;
        int appMajorVersion = 0;
        std::string requiredFeature;
        std::string machineFingerprint;
        std::string expectedLicenseePublicKeyFingerprint;
        int64_t nowUnixSeconds = 0;
        bool allowPortableLicense = false;
        std::vector<std::string> revokedIssuerKeyIds;
    };
 
    struct TrustedLicenseKey {
        std::string keyId;
        std::string publicKeyPem;
        bool revoked = false;
    };
 
    struct LicenseCheckResult {
        LicenseStatus status = LicenseStatus::Missing;
        std::string issuerKeyId;
        LicensePayload payload;
        std::string message;
 
        bool valid() const;
    };
 
    class LicenseManager {
    public:
        static RADCore::RADResult<std::string> machineFingerprint();
        static RADCore::RADResult<std::string> publicKeyFingerprint(const std::string& publicKeyPem);
        static std::string licenseKindToString(LicenseKind kind);
        static LicenseKind licenseKindFromString(const std::string& text);
        static std::string licenseStatusToString(LicenseStatus status);
        static RADCore::RADJsonValue payloadToJson(const LicensePayload& payload);
        static RADCore::RADResult<LicensePayload> payloadFromJson(const RADCore::RADJsonValue& value);
        static std::string canonicalPayloadJson(const LicensePayload& payload);
        static RADCore::RADResult<RADCore::RADJsonDocument> createSignedLicense(
            const LicensePayload& payload,
            const std::string& privateKeyPem,
            const std::string& issuerKeyId = {});
        static RADCore::RADResult<RADCore::RADJsonDocument> createNodeLockedLicense(
            LicensePayload payload,
            const std::string& privateKeyPem,
            const std::string& machineFingerprintOverride = {},
            const std::string& issuerKeyId = {});
        static LicenseCheckResult verifySignedLicense(
            const RADCore::RADJsonDocument& document,
            const std::string& publicKeyPem,
            const LicenseCheckOptions& options = {});
        static LicenseCheckResult verifySignedLicense(
            const RADCore::RADJsonDocument& document,
            const std::vector<TrustedLicenseKey>& trustedKeys,
            const LicenseCheckOptions& options = {});
        static LicenseCheckResult verifySignedLicenseFile(
            const std::string& path,
            const std::string& publicKeyPem,
            const LicenseCheckOptions& options = {});
        static LicenseCheckResult verifySignedLicenseFile(
            const std::string& path,
            const std::vector<TrustedLicenseKey>& trustedKeys,
            const LicenseCheckOptions& options = {});
        static RADCore::RADResult<void> writeSignedLicenseFile(
            const std::string& path,
            const LicensePayload& payload,
            const std::string& privateKeyPem,
            const std::string& issuerKeyId = {});
    };
 
} // namespace RADSecurity
 
#endif