1 /* Tunala ("Tunneler with a New Zealand accent")
3 * Written by Geoff Thorpe, but endorsed/supported by noone. Please use this is
4 * if it's useful or informative to you, but it's only here as a scratchpad for
5 * ideas about how you might (or might not) program with OpenSSL. If you deploy
6 * this is in a mission-critical environment, and have not read, understood,
7 * audited, and modified this code to your satisfaction, and the result is that
8 * all hell breaks loose and you are looking for a new employer, then it proves
9 * nothing except perhaps that Darwinism is alive and well. Let's just say, *I*
10 * don't use this in a mission-critical environment, so it would be stupid for
11 * anyone to assume that it is solid and/or tested enough when even its author
12 * doesn't place that much trust in it. You have been warned.
14 * With thanks to Cryptographic Appliances, Inc.
26 #include <sys/socket.h>
27 #include <netinet/in.h>
28 #endif /* !defined(NO_SYSTEM_H) */
31 #include <openssl/err.h>
32 #include <openssl/engine.h>
33 #include <openssl/ssl.h>
34 #endif /* !defined(NO_OPENSSL) */
37 /* This is the generic "buffer" type that is used when feeding the
38 * state-machine. It's basically a FIFO with respect to the "adddata" &
39 * "takedata" type functions that operate on it. */
40 #define MAX_DATA_SIZE 16384
41 typedef struct _buffer_t {
42 unsigned char data[MAX_DATA_SIZE];
44 /* Statistical values - counts the total number of bytes read in and
45 * read out (respectively) since "buffer_init()" */
46 unsigned long total_in, total_out;
49 /* Initialise a buffer structure before use */
50 void buffer_init(buffer_t *buf);
51 /* Cleanup a buffer structure - presently not needed, but if buffer_t is
52 * converted to using dynamic allocation, this would be required - so should be
53 * called to protect against an explosion of memory leaks later if the change is
55 void buffer_close(buffer_t *buf);
57 /* Basic functions to manipulate buffers */
59 unsigned int buffer_used(buffer_t *buf); /* How much data in the buffer */
60 unsigned int buffer_unused(buffer_t *buf); /* How much space in the buffer */
61 int buffer_full(buffer_t *buf); /* Boolean, is it full? */
62 int buffer_notfull(buffer_t *buf); /* Boolean, is it not full? */
63 int buffer_empty(buffer_t *buf); /* Boolean, is it empty? */
64 int buffer_notempty(buffer_t *buf); /* Boolean, is it not empty? */
65 unsigned long buffer_total_in(buffer_t *buf); /* Total bytes written to buffer */
66 unsigned long buffer_total_out(buffer_t *buf); /* Total bytes read from buffer */
68 #if 0 /* Currently used only within buffer.c - better to expose only
69 * higher-level functions anyway */
70 /* Add data to the tail of the buffer, returns the amount that was actually
71 * added (so, you need to check if return value is less than size) */
72 unsigned int buffer_adddata(buffer_t *buf, const unsigned char *ptr,
75 /* Take data from the front of the buffer (and scroll the rest forward). If
76 * "ptr" is NULL, this just removes data off the front of the buffer. Return
77 * value is the amount actually removed (can be less than size if the buffer has
78 * too little data). */
79 unsigned int buffer_takedata(buffer_t *buf, unsigned char *ptr,
82 /* Flushes as much data as possible out of the "from" buffer into the "to"
83 * buffer. Return value is the amount moved. The amount moved can be restricted
84 * to a maximum by specifying "cap" - setting it to -1 means no limit. */
85 unsigned int buffer_tobuffer(buffer_t *to, buffer_t *from, int cap);
89 /* Read or write between a file-descriptor and a buffer */
90 int buffer_from_fd(buffer_t *buf, int fd);
91 int buffer_to_fd(buffer_t *buf, int fd);
92 #endif /* !defined(NO_IP) */
95 /* Read or write between an SSL or BIO and a buffer */
96 void buffer_from_SSL(buffer_t *buf, SSL *ssl);
97 void buffer_to_SSL(buffer_t *buf, SSL *ssl);
98 void buffer_from_BIO(buffer_t *buf, BIO *bio);
99 void buffer_to_BIO(buffer_t *buf, BIO *bio);
102 void cb_ssl_info(SSL *s, int where, int ret);
103 void cb_ssl_info_set_output(FILE *fp); /* Called if output should be sent too */
104 int cb_ssl_verify(int ok, X509_STORE_CTX *ctx);
105 void cb_ssl_verify_set_output(FILE *fp);
106 void cb_ssl_verify_set_depth(unsigned int verify_depth);
107 void cb_ssl_verify_set_level(unsigned int level);
108 #endif /* !defined(NO_OPENSSL) */
109 #endif /* !defined(NO_BUFFER) */
113 #error "TUNALA section of tunala.h requires BUFFER support"
115 typedef struct _state_machine_t {
119 buffer_t clean_in, clean_out;
120 buffer_t dirty_in, dirty_out;
123 SM_CLEAN_IN, SM_CLEAN_OUT,
124 SM_DIRTY_IN, SM_DIRTY_OUT
126 void state_machine_init(state_machine_t *machine);
127 void state_machine_close(state_machine_t *machine);
128 buffer_t *state_machine_get_buffer(state_machine_t *machine, sm_buffer_t type);
129 SSL *state_machine_get_SSL(state_machine_t *machine);
130 int state_machine_set_SSL(state_machine_t *machine, SSL *ssl, int is_server);
131 /* Performs the data-IO loop and returns zero if the machine should close */
132 int state_machine_churn(state_machine_t *machine);
133 /* Is used to handle closing conditions - namely when one side of the tunnel has
134 * closed but the other should finish flushing. */
135 int state_machine_close_clean(state_machine_t *machine);
136 int state_machine_close_dirty(state_machine_t *machine);
137 #endif /* !defined(NO_TUNALA) */
140 /* Initialise anything related to the networking. This includes blocking pesky
141 * SIGPIPE signals. */
142 int ip_initialise(void);
143 /* ip is the 4-byte ip address (eg. 127.0.0.1 is {0x7F,0x00,0x00,0x01}), port is
144 * the port to listen on (host byte order), and the return value is the
145 * file-descriptor or -1 on error. */
146 int ip_create_listener_split(const unsigned char *ip, unsigned short port);
147 /* Same semantics as above. */
148 int ip_create_connection_split(const unsigned char *ip, unsigned short port);
149 /* Converts a string into the ip/port before calling the above */
150 int ip_create_listener(const char *address);
151 int ip_create_connection(const char *address);
152 /* Just does a string conversion on its own. NB: If accept_all_ip is non-zero,
153 * then the address string could be just a port. Ie. it's suitable for a
154 * listening address but not a connecting address. */
155 int ip_parse_address(const char *address, unsigned char **parsed_ip,
156 unsigned short *port, int accept_all_ip);
157 /* Accepts an incoming connection through the listener. Assumes selects and
158 * what-not have deemed it an appropriate thing to do. */
159 int ip_accept_connection(int listen_fd);
160 #endif /* !defined(NO_IP) */
162 #endif /* !defined(_TUNALA_H) */