From 5294dd705d0f16e740b0f153d3fa1a985665412e Mon Sep 17 00:00:00 2001 From: =?utf8?q?Bodo=20M=C3=B6ller?= Date: Mon, 17 Sep 2001 19:07:00 +0000 Subject: [PATCH] Another demo. --- demos/easy_tls/Makefile | 123 ++++ demos/easy_tls/README | 64 ++ demos/easy_tls/cacerts.pem | 18 + demos/easy_tls/cert.pem | 31 + demos/easy_tls/easy-tls.c | 1235 ++++++++++++++++++++++++++++++++++++ demos/easy_tls/easy-tls.h | 57 ++ demos/easy_tls/test.c | 244 +++++++ demos/easy_tls/test.h | 11 + 8 files changed, 1783 insertions(+) create mode 100644 demos/easy_tls/Makefile create mode 100644 demos/easy_tls/README create mode 100644 demos/easy_tls/cacerts.pem create mode 100644 demos/easy_tls/cert.pem create mode 100644 demos/easy_tls/easy-tls.c create mode 100644 demos/easy_tls/easy-tls.h create mode 100644 demos/easy_tls/test.c create mode 100644 demos/easy_tls/test.h diff --git a/demos/easy_tls/Makefile b/demos/easy_tls/Makefile new file mode 100644 index 0000000000..0d407eda22 --- /dev/null +++ b/demos/easy_tls/Makefile @@ -0,0 +1,123 @@ +# Makefile for easy-tls example application (rudimentary client and server) +# $Id: Makefile,v 1.1 2001/09/17 19:06:56 bodo Exp $ + +SOLARIS_CFLAGS=-Wall -pedantic -g -O2 +SOLARIS_LIBS=-lxnet + +LINUX_CFLAGS=-Wall -pedantic -g -O2 +LINUX_LIBS= + + +auto-all: + case `uname -s` in \ + SunOS) echo Using SunOS configuration; \ + make SYSCFLAGS="$(SOLARIS_CFLAGS)" SYSLIBS="$(SOLARIS_LIBS)" all;; \ + Linux) echo Using Linux configuration; \ + make SYSCFLAGS="$(LINUX_CFLAGS)" SYSLIBS="$(LINUX_LIBS)" all;; \ + *) echo "unknown system"; exit 1;; \ + esac + +all: test TAGS + +# For adapting this Makefile to a different system, only the following +# definitions should need customizing: + +OPENSSLDIR=$(HOME)/openssl/openssl +CC=gcc + +SYSCFLAGS=whatever +SYSLIBS=whatever + + +############################################################################# +# +# SSLeay/OpenSSL imports +# +# OPENSSLDIR (set above) can be either the directory where OpenSSL is +# installed or the directory where it was compiled. + +# We rely on having a new OpenSSL release where include files +# have names like (not just ). +OPENSSLINCLUDES=-I$(OPENSSLDIR)/include + +# libcrypto.a and libssl.a are directly in $(OPENSSLDIR) if this is +# the compile directory, or in $(OPENSSLDIR)/lib if we use an installed +# library. With the following definition, we can handle either case. +OPENSSLLIBS=-L$(OPENSSLDIR) -L$(OPENSSLDIR)/lib -lssl -lcrypto + + +############################################################################# +# +# Stuff for handling the source files +# + +SOURCES=easy-tls.c test.c +HEADERS=easy-tls.h test.h +DOCSandEXAMPLESetc=Makefile cert.pem cacerts.pem +EVERYTHING=$(SOURCES) $(HEADERS) $(DOCSandEXAMPLESetc) + +ls: ls-l +ls-l: + ls -l $(EVERYTHING) +# For RCS: +tag: + -rcs -n_`date +%y%m%d`: $(EVERYTHING) + rcs -nMYTAG $(EVERYTHING) + rcs -nMYTAG: $(EVERYTHING) +diff: + -rcsdiff -rMYTAG -u $(EVERYTHING) +today: + -rcsdiff -r_`date +%y%m%d` -u $(EVERYTHING) +ident: + for a in $(EVERYTHING); do ident $$a; done + +# Distribution .tar: +easy-tls.tar.gz: $(EVERYTHING) + tar cvf - $(EVERYTHING) | \ + gzip -9 > easy-tls.tar.gz + +# Working .tar: +tls.tgz: $(EVERYTHING) + tar cfv - `find . -type f -a ! -name '*.tgz' -a ! -name '*.tar.gz'` | \ + gzip -9 > tls.tgz + +# For emacs: +etags: TAGS +TAGS: $(SOURCES) $(HEADERS) + -etags $(SOURCES) $(HEADERS) + + +############################################################################# +# +# Compilation +# +# The following definitions are system dependent (and hence defined +# at the beginning of this Makefile, where they are more easily found): + +### CC=gcc +### SYSCFLAGS=-Wall -pedantic -g -O2 +### SYSLIBS=-lxnet + +EXTRACFLAGS=-DTLS_APP=\"test.h\" +# EXTRACFLAGS=-DTLS_APP=\"test.h\" -DDEBUG_TLS + +# +# The rest shouldn't need to be touched. +# +LDFLAGS=$(SYSLIBS) $(OPENSSLLIBS) +INCLUDES=$(OPENSSLINCLUDES) +CFLAGS=$(SYSCFLAGS) $(EXTRACFLAGS) $(INCLUDES) + +OBJS=easy-tls.o test.o + +clean: + @rm -f test + @rm -f TAGS + @rm -f *.o + @rm -f core + +test: $(OBJS) + $(CC) $(OBJS) $(LDFLAGS) -o test + +test.o: $(HEADERS) +easy-tls.o: $(HEADERS) diff --git a/demos/easy_tls/README b/demos/easy_tls/README new file mode 100644 index 0000000000..bf5eeca4e6 --- /dev/null +++ b/demos/easy_tls/README @@ -0,0 +1,64 @@ +easy_tls - generic SSL/TLS proxy +======== + +(... and example for non-blocking SSL/TLS I/O multiplexing.) + + + easy_tls.c, easy_tls.h: + + Small generic SSL/TLS proxy library: With a few function calls, + an application socket will be replaced by a pipe handled by a + separate SSL/TLS proxy process. This allows easily adding + SSL/TLS support to many programs not originally designed for it. + + [Actually easy_tls.c is not a proper library: Customization + requires defining preprocessor macros while compiling it. + This is quite confusing, so I'll probably change it.] + + These files may be used under the OpenSSL license. + + + + test.c, test.h, Makefile, cert.pem, cacerts.pem: + + Rudimentary example program using the easy_tls library, and + example key and certificates for it. Usage examples: + + $ ./test 8443 # create server listening at port 8443 + $ ./test 127.0.0.1 8443 # create client, connect to port 8443 + # at IP address 127.0.0.1 + + 'test' will not automatically do SSL/TLS, or even read or write + data -- it must be told to do so on input lines starting + with a command letter. 'W' means write a line, 'R' means + read a line, 'C' means close the connection, 'T' means + start an SSL/TLS proxy. E.g. (user input tagged with '*'): + + * R + <<< 220 mail.example.net + * WSTARTTLS + >>> STARTTLS + * R + <<< 220 Ready to start TLS + * T + test_process_init(fd = 3, client_p = 1, apparg = (nil)) + +++ `E:self signed certificate in certificate chain' + +++ `<... certificate info ...>' + * WHELO localhost + >>> HELO localhost + R + <<< 250 mail.example.net + + You can even do SSL/TLS over SSL/TLS over SSL/TLS ... by using + 'T' multiple times. I have no idea why you would want to though. + + +This code is rather old. When I find time I will look if it still +compiles, and update code comments. The least you will have to do to +use the sample program 'test' is change the Makefile. + +As noted above, easy_tls.c will be changed to become a library one +day, which means that future revisions will not be fully compatible to +the current version. + +Bodo Möller diff --git a/demos/easy_tls/cacerts.pem b/demos/easy_tls/cacerts.pem new file mode 100644 index 0000000000..acc70baf19 --- /dev/null +++ b/demos/easy_tls/cacerts.pem @@ -0,0 +1,18 @@ +$Id: cacerts.pem,v 1.1 2001/09/17 19:06:57 bodo Exp $ + +issuer= /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test PCA (1024 bit) +subject=/C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit) +-----BEGIN CERTIFICATE----- +MIICJjCCAY8CAQAwDQYJKoZIhvcNAQEEBQAwXDELMAkGA1UEBhMCQVUxEzARBgNV +BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYD +VQQDExNUZXN0IFBDQSAoMTAyNCBiaXQpMB4XDTk3MDYwOTEzNTc0M1oXDTAxMDYw +OTEzNTc0M1owWzELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY +BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRswGQYDVQQDExJUZXN0IENBICgxMDI0 +IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKO7o8t116VP6cgybTsZ +DCZhr95nYlZuya3aCi1IKoztqwWnjbmDFIriOqGFPrZQ+moMETC9D59iRW/dFXSv +1F65ka/XY2hLh9exCCo7XuUcDs53Qp3bI3AmMqHjgzE8oO3ajyJAzJkTTOUecQU2 +mw/gI4tMM0LqWMQS7luTy4+xAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAM7achv3v +hLQJcv/65eGEpBXM40ZDVoFQFFJWaY5p883HTqLB1x4FdzsXHH0QKBTcKpWwqyu4 +YDm3fb8oDugw72bCzfyZK/zVZPR/hVlqI/fvU109Qoc+7oPvIXWky71HfcK6ZBCA +q30KIqGM/uoM60INq97qjDmCJapagcNBGQs= +-----END CERTIFICATE----- diff --git a/demos/easy_tls/cert.pem b/demos/easy_tls/cert.pem new file mode 100644 index 0000000000..364fe10d5b --- /dev/null +++ b/demos/easy_tls/cert.pem @@ -0,0 +1,31 @@ +$Id: cert.pem,v 1.1 2001/09/17 19:06:57 bodo Exp $ + +Example certificate and key. + +-----BEGIN CERTIFICATE----- +MIIB1jCCAT8CAQEwDQYJKoZIhvcNAQEEBQAwRTELMAkGA1UEBhMCQVUxEzARBgNV +BAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0 +ZDAeFw05OTA1MDEwMTI2MzVaFw05OTA1MzEwMTI2MzVaMCIxCzAJBgNVBAYTAkRF +MRMwEQYDVQQDEwpUZXN0c2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB +gQD6I3oDKiexwwlkzjar69AIFnVUaG85LtCege2R+CtIDlkQYw68/8MbT3ou0pdF +AcL9IGiYY3Y0SHM9PqF00RO1MCtNpqTnF3ScLpbmggGjKilmWYn2ai7emdjMjXVL +tzWW2xGgIGATWQN32KgfJng4jXi1UjEiyLhkw0Zf1I/ggwIDAQABMA0GCSqGSIb3 +DQEBBAUAA4GBAMgM+sbAk8DfjSfa+Rf2gcGXmbrvZAzKzC+5RU3kaq/NyxIXAGco +9dZjozzWfN/xuGup5boFk+KrP+xdgsaqGHsyzlgEoqz4ekqLjQeVbnoj339hVFU9 +MhPi6JULPxjXKumjfX2LLNkikW5puz8Df3UiX0EiaJvd7EwP8J75tiUT +-----END CERTIFICATE----- +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQD6I3oDKiexwwlkzjar69AIFnVUaG85LtCege2R+CtIDlkQYw68 +/8MbT3ou0pdFAcL9IGiYY3Y0SHM9PqF00RO1MCtNpqTnF3ScLpbmggGjKilmWYn2 +ai7emdjMjXVLtzWW2xGgIGATWQN32KgfJng4jXi1UjEiyLhkw0Zf1I/ggwIDAQAB +AoGANST8c1etf1MU19oIO5aqaE19OCXIG7oakNLCCtVTPMfvnE+vffBJH7BPIUuU +4BBzwRv1nQrkvk72TPjVjOAu81B1SStKQueun2flVuYxp9NyupNWCBley4QdohlP +I92ml2tzTSPmNIoA6jdGyNzFcGchapRRmejsC39F1RUbHQECQQD9KX81Wt8ZOrri +dWiEXja1L3X8Bkb9vvUjVMQDTJJPxBJjehC6eurgE6PP6SJD5p/f3RHPCcLr8tSM +D4P/OpKhAkEA/PFNlhIZUDKK6aTvG2mn7qQ5phbadOoyN1Js3ttWG5OMOZ6b/QlC +Wvp84h44506BIlv+Tg2YAI0AdBUrf7oEowJAM4joAVd/ROaEtqbJ4PBA2L9RmD06 +5FqkEk4mHLnQqvYx/BgUIbH18ClvVlqSBBqFfw/EmU3WZSuogt6Bs0ocIQJBAOxB +AoPiYcxbeQ5kZIVJOXaX49SzUdaUDNVJYrEBUzsspHQJJo/Avz606kJVkjbSR6Ft +JWmIHuqcyMikIV4KxFsCQQCU2evoVjVsqkkbHi7W28f73PGBsyu0KIwlK7nu4h08 +Daf7TAI+A6jW/WRUsJ6dFhUYi7/Jvkcdrlnbgm2fxziX +-----END RSA PRIVATE KEY----- diff --git a/demos/easy_tls/easy-tls.c b/demos/easy_tls/easy-tls.c new file mode 100644 index 0000000000..88d7a8a1ec --- /dev/null +++ b/demos/easy_tls/easy-tls.c @@ -0,0 +1,1235 @@ +/* -*- Mode: C; c-file-style: "bsd" -*- */ +/* + * easy-tls.c -- generic TLS proxy. + * $Id: easy-tls.c,v 1.1 2001/09/17 19:06:57 bodo Exp $ + */ +/* + (c) Copyright 1999 Bodo Moeller. All rights reserved. + + This is free software; you can redistributed and/or modify it + unter the terms of either + - the GNU General Public License as published by the + Free Software Foundation, version 1, or (at your option) + any later version, + or + - the following license: +*/ +/* + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that each of the following + * conditions is met: + * + * 1. Redistributions qualify as "freeware" or "Open Source Software" under + * one of the following terms: + * + * (a) Redistributions are made at no charge beyond the reasonable cost of + * materials and delivery. + * + * (b) Redistributions are accompanied by a copy of the Source Code + * or by an irrevocable offer to provide a copy of the Source Code + * for up to three years at the cost of materials and delivery. + * Such redistributions must allow further use, modification, and + * redistribution of the Source Code under substantially the same + * terms as this license. + * + * 2. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 3. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 4. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by Bodo Moeller." + * (If available, substitute umlauted o for oe.) + * + * 5. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by Bodo Moeller." + * + * THIS SOFTWARE IS PROVIDED BY BODO MOELLER ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BODO MOELLER OR + * HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ +/* + * Attribution for OpenSSL library: + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/) + */ + +static char const rcsid[] = +"$Id: easy-tls.c,v 1.1 2001/09/17 19:06:57 bodo Exp $"; + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#ifndef NO_RSA + #include +#endif +#include +#include +#include + +#if OPENSSL_VERSION_NUMBER < 0x00904000L /* 0.9.4-dev */ +# error "This program needs OpenSSL 0.9.4 or later." +#endif + +#include "easy-tls.h" /* include after if both are needed */ + +#if TLS_INFO_SIZE > PIPE_BUF +# if PIPE_BUF < 512 +# error "PIPE_BUF < 512" /* non-POSIX */ +# endif +# error "TLS_INFO_SIZE > PIPE_BUF" +#endif + +/*****************************************************************************/ + +#ifdef TLS_APP +# include TLS_APP +#endif + +/* Applications can define: + * TLS_APP_PROCESS_INIT -- void ...(int fd, int client_p, void *apparg) + * TLS_CUMULATE_ERRORS + * TLS_ERROR_BUFSIZ + * TLS_APP_ERRFLUSH -- void ...(int child_p, char *, size_t, void *apparg) + */ + +#ifndef TLS_APP_PROCESS_INIT +# define TLS_APP_PROCESS_INIT(fd, client_p, apparg) ((void) 0) +#endif + +#ifndef TLS_ERROR_BUFSIZ +# define TLS_ERROR_BUFSIZ (10*160) +#endif +#if TLS_ERROR_BUFSIZ < 2 /* {'\n',0} */ +# error "TLS_ERROR_BUFSIZE is too small." +#endif + +#ifndef TLS_APP_ERRFLUSH +# define TLS_APP_ERRFLUSH tls_app_errflush +static void +tls_app_errflush(int child_p, char *errbuf, size_t num, void *apparg) +{ + fputs(errbuf, stderr); +} +#endif + +/*****************************************************************************/ + +#ifdef DEBUG_TLS +# define DEBUG_MSG(x) fprintf(stderr," %s\n",x) +# define DEBUG_MSG2(x,y) fprintf(stderr, " %s: %d\n",x,y) +static int tls_loop_count = 0; +static int tls_select_count = 0; +#else +# define DEBUG_MSG(x) (void)0 +# define DEBUG_MSG2(x,y) (void)0 +#endif + +static void tls_rand_seed_uniquely(void); +static void tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, int client_p); +static int tls_socket_nonblocking(int fd); + +static int tls_child_p = 0; +static void *tls_child_apparg; + + +struct tls_start_proxy_args +tls_start_proxy_defaultargs(void) +{ + struct tls_start_proxy_args ret; + + ret.fd = -1; + ret.client_p = -1; + ret.ctx = NULL; + ret.pid = NULL; + ret.infofd = NULL; + + return ret; +} + +/* Slice in TLS proxy process at fd. + * Return value: + * 0 ok (*pid is set to child's PID if pid != NULL), + * < 0 look at errno + * > 0 other error + * (return value encodes place of error) + * + */ +int +tls_start_proxy(struct tls_start_proxy_args a, void *apparg) +{ + int fds[2] = {-1, -1}; + int infofds[2] = {-1, -1}; + int r, getfd, getfl; + int ret; + + DEBUG_MSG2("tls_start_proxy fd", a.fd); + DEBUG_MSG2("tls_start_proxy client_p", a.client_p); + + if (a.fd == -1 || a.client_p == -1 || a.ctx == NULL) + return 1; + + if (a.pid != NULL) { + *a.pid = 0; + } + if (a.infofd != NULL) { + *a.infofd = -1; + } + + r = socketpair(AF_UNIX, SOCK_STREAM, 0, fds); + if (r == -1) + return -1; + if (a.fd >= FD_SETSIZE || fds[0] >= FD_SETSIZE) { + ret = 2; + goto err; + } + if (a.infofd != NULL) { + r = pipe(infofds); + if (r == -1) { + ret = -3; + goto err; + } + } + + r = fork(); + if (r == -1) { + ret = -4; + goto err; + } + if (r == 0) { + DEBUG_MSG("fork"); + tls_child_p = 1; + tls_child_apparg = apparg; + close(fds[1]); + if (infofds[0] != -1) + close(infofds[0]); + TLS_APP_PROCESS_INIT(a.fd, a.client_p, apparg); + DEBUG_MSG("TLS_APP_PROCESS_INIT"); + tls_proxy(fds[0], a.fd, infofds[1], a.ctx, a.client_p); + exit(0); + } + if (a.pid != NULL) + *a.pid = r; + if (infofds[1] != -1) { + close(infofds[1]); + infofds[1] = -1; + } + /* install fds[1] in place of fd: */ + close(fds[0]); + fds[0] = -1; + getfd = fcntl(a.fd, F_GETFD); + getfl = fcntl(a.fd, F_GETFL); + r = dup2(fds[1], a.fd); + close(fds[1]); + fds[1] = -1; + if (r == -1) { + ret = -5; + goto err; + } + if (getfd != 1) + fcntl(a.fd, F_SETFD, getfd); + if (getfl & O_NONBLOCK) + (void)tls_socket_nonblocking(a.fd); + if (a.infofd != NULL) + *a.infofd = infofds[0]; + return 0; + + err: + if (fds[0] != -1) + close(fds[0]); + if (fds[1] != -1) + close(fds[1]); + if (infofds[0] != -1) + close(infofds[0]); + if (infofds[1] != -1) + close(infofds[1]); + return ret; +} + +/*****************************************************************************/ + +static char errbuf[TLS_ERROR_BUFSIZ]; +static size_t errbuf_i = 0; + +static void +tls_errflush(void *apparg) +{ + if (errbuf_i == 0) + return; + + assert(errbuf_i < sizeof errbuf); + assert(errbuf[errbuf_i] == 0); + if (errbuf_i == sizeof errbuf - 1) { + /* make sure we have a newline, even if string has been truncated */ + errbuf[errbuf_i - 1] = '\n'; + } + + /* TLS_APP_ERRFLUSH may modify the string as needed, + * e.g. substitute other characters for \n for convenience */ + TLS_APP_ERRFLUSH(tls_child_p, errbuf, errbuf_i, apparg); + + errbuf_i = 0; +} + +static void +tls_errprintf(int flush, void *apparg, const char *fmt, ...) +{ + va_list args; + int r; + + if (errbuf_i < sizeof errbuf - 1) { + size_t n; + + va_start(args, fmt); + n = (sizeof errbuf) - errbuf_i; + r = vsnprintf(errbuf + errbuf_i, n, fmt, args); + if (r >= n) + r = n - 1; + if (r >= 0) { + errbuf_i += r; + } else { + errbuf_i = sizeof errbuf - 1; + errbuf[errbuf_i] = '\0'; + } + assert(errbuf_i < sizeof errbuf); + assert(errbuf[errbuf_i] == 0); + } +#ifndef TLS_CUMULATE_ERRORS + tls_errflush(apparg); +#else + if (flush) + tls_errflush(apparg); +#endif +} + +/* app_prefix.. are for additional information provided by caller. + * If OpenSSL error queue is empty, print default_text ("???" if NULL). + */ +static char * +tls_openssl_errors(const char *app_prefix_1, const char *app_prefix_2, const char *default_text, void *apparg) +{ + static char reasons[255]; + size_t reasons_i; + unsigned long err; + const char *file; + int line; + const char *data; + int flags; + char *errstring; + int printed_something = 0; + + reasons_i = 0; + + assert(app_prefix_1 != NULL); + assert(app_prefix_2 != NULL); + + if (default_text == NULL) + default_text = "???"; + + while ((err = ERR_get_error_line_data(&file,&line,&data,&flags)) != 0) { + if (reasons_i < sizeof reasons) { + size_t n; + int r; + + n = (sizeof reasons) - reasons_i; + r = snprintf(reasons + reasons_i, n, "%s%s", (reasons_i > 0 ? ", " : ""), ERR_reason_error_string(err)); + if (r >= n) + r = n - 1; + if (r >= 0) { + reasons_i += r; + } else { + reasons_i = sizeof reasons; + } + assert(reasons_i <= sizeof reasons); + } + + errstring = ERR_error_string(err, NULL); + assert(errstring != NULL); + tls_errprintf(0, apparg, "OpenSSL error%s%s: %s:%s:%d:%s\n", app_prefix_1, app_prefix_2, errstring, file, line, (flags & ERR_TXT_STRING) ? data : ""); + printed_something = 1; + } + + if (!printed_something) { + assert(reasons_i == 0); + snprintf(reasons, sizeof reasons, "%s", default_text); + tls_errprintf(0, apparg, "OpenSSL error%s%s: %s\n", app_prefix_1, app_prefix_2, default_text); + } + +#ifdef TLS_CUMULATE_ERRORS + tls_errflush(apparg); +#endif + assert(errbuf_i == 0); + + return reasons; +} + +/*****************************************************************************/ + +static int tls_init_done = 0; + +static int +tls_init(void *apparg) +{ + if (tls_init_done) + return 0; + + SSL_load_error_strings(); + if (!SSL_library_init() /* aka SSLeay_add_ssl_algorithms() */ ) { + tls_errprintf(1, apparg, "SSL_library_init failed.\n"); + return -1; + } + tls_init_done = 1; + tls_rand_seed(); + return 0; +} + +/*****************************************************************************/ + +static void +tls_rand_seed_uniquely(void) +{ + struct { + pid_t pid; + time_t time; + void *stack; + } data; + + data.pid = getpid(); + data.time = time(NULL); + data.stack = (void *)&data; + + RAND_seed((const void *)&data, sizeof data); +} + +void +tls_rand_seed(void) +{ + struct { + struct utsname uname; + int uname_1; + int uname_2; + uid_t uid; + uid_t euid; + gid_t gid; + gid_t egid; + } data; + + data.uname_1 = uname(&data.uname); + data.uname_2 = errno; /* Let's hope that uname fails randomly :-) */ + + data.uid = getuid(); + data.euid = geteuid(); + data.gid = getgid(); + data.egid = getegid(); + + RAND_seed((const void *)&data, sizeof data); + tls_rand_seed_uniquely(); +} + +static int tls_rand_seeded_p = 0; + +#define my_MIN_SEED_BYTES 256 /* struct stat can be larger than 128 */ +int +tls_rand_seed_from_file(const char *filename, size_t n, void *apparg) +{ + /* Seed OpenSSL's random number generator from file. + Try to read n bytes if n > 0, whole file if n == 0. */ + + int r; + + if (tls_init(apparg) == -1) + return -1; + tls_rand_seed(); + + r = RAND_load_file(filename, (n > 0 && n < LONG_MAX) ? (long)n : LONG_MAX); + /* r is the number of bytes filled into the random number generator, + * which are taken from "stat(filename, ...)" in addition to the + * file contents. + */ + assert(1 < my_MIN_SEED_BYTES); + /* We need to detect at least those cases when the file does not exist + * at all. With current versions of OpenSSL, this should do it: */ + if (n == 0) + n = my_MIN_SEED_BYTES; + if (r < n) { + tls_errprintf(1, apparg, "rand_seed_from_file: could not read %d bytes from %s.\n", n, filename); + return -1; + } else { + tls_rand_seeded_p = 1; + return 0; + } +} + +void +tls_rand_seed_from_memory(const void *buf, size_t n) +{ + size_t i = 0; + + while (i < n) { + size_t rest = n - i; + int chunk = rest < INT_MAX ? (int)rest : INT_MAX; + RAND_seed((const char *)buf + i, chunk); + i += chunk; + } + tls_rand_seeded_p = 1; +} + + +/*****************************************************************************/ + +struct tls_x509_name_string { + char str[100]; +}; + +static void +tls_get_x509_subject_name_oneline(X509 *cert, struct tls_x509_name_string *namestring) +{ + X509_NAME *name; + + if (cert == NULL) { + namestring->str[0] = '\0'; + return; + } + + name = X509_get_subject_name(cert); /* does not increment any reference counter */ + + assert(sizeof namestring->str >= 4); /* "?" or "...", plus 0 */ + + if (name == NULL) { + namestring->str[0] = '?'; + namestring->str[1] = 0; + } else { + size_t len; + + X509_NAME_oneline(name, namestring->str, sizeof namestring->str); + len = strlen(namestring->str); + assert(namestring->str[len] == 0); + assert(len < sizeof namestring->str); + + if (len+1 == sizeof namestring->str) { + /* (Probably something was cut off.) + * Does not really work -- X509_NAME_oneline truncates after + * name components, we cannot tell from the result whether + * anything is missing. */ + + assert(namestring->str[len] == 0); + namestring->str[--len] = '.'; + namestring->str[--len] = '.'; + namestring->str[--len] = '.'; + } + } +} + +/*****************************************************************************/ + +/* to hinder OpenSSL from asking for passphrases */ +static int +no_passphrase_callback(char *buf, int num, int w, void *arg) +{ + return -1; +} + +static int +verify_dont_fail_cb(X509_STORE_CTX *c) +{ + int i; + + i = X509_verify_cert(c); /* sets c->error */ +#if OPENSSL_VERSION_NUMBER >= 0x00905000L /* don't allow unverified + * certificates -- they could + * survive session reuse, but + * OpenSSL < 0.9.5-dev does not + * preserve their verify_result */ + if (i == 0) + return 1; + else +#endif + return i; +} + +static DH *tls_dhe1024 = NULL; /* generating these takes a while, so do it just once */ + +void +tls_set_dhe1024(int i, void *apparg) +{ + DSA *dsaparams; + DH *dhparams; + const char *seed[] = { ";-) :-( :-) :-( ", + ";-) :-( :-) :-( ", + "Random String no. 12", + ";-) :-( :-) :-( ", + "hackers have even mo", /* from jargon file */ + }; + unsigned char seedbuf[20]; + + tls_init(apparg); + if (i >= 0) { + i %= sizeof seed / sizeof seed[0]; + assert(strlen(seed[i]) == 20); + memcpy(seedbuf, seed[i], 20); + dsaparams = DSA_generate_parameters(1024, seedbuf, 20, NULL, NULL, 0, NULL); + } else { + /* random parameters (may take a while) */ + dsaparams = DSA_generate_parameters(1024, NULL, 0, NULL, NULL, 0, NULL); + } + + if (dsaparams == NULL) { + tls_openssl_errors("", "", NULL, apparg); + return; + } + dhparams = DSA_dup_DH(dsaparams); + DSA_free(dsaparams); + if (dhparams == NULL) { + tls_openssl_errors("", "", NULL, apparg); + return; + } + if (tls_dhe1024 != NULL) + DH_free(tls_dhe1024); + tls_dhe1024 = dhparams; +} + +struct tls_create_ctx_args +tls_create_ctx_defaultargs(void) +{ + struct tls_create_ctx_args ret; + + ret.client_p = 0; + ret.certificate_file = NULL; + ret.key_file = NULL; + ret.ca_file = NULL; + ret.verify_depth = -1; + ret.fail_unless_verified = 0; + ret.export_p = 0; + + return ret; +} + +SSL_CTX * +tls_create_ctx(struct tls_create_ctx_args a, void *apparg) +{ + int r; + static long context_num = 0; + SSL_CTX *ret; + const char *err_pref_1 = "", *err_pref_2 = ""; + + if (tls_init(apparg) == -1) + return NULL; + + ret = SSL_CTX_new((a.client_p? SSLv23_client_method:SSLv23_server_method)()); + + if (ret == NULL) + goto err; + + SSL_CTX_set_default_passwd_cb(ret, no_passphrase_callback); + SSL_CTX_set_mode(ret, SSL_MODE_ENABLE_PARTIAL_WRITE); + + if ((a.certificate_file != NULL) || (a.key_file != NULL)) { + if (a.key_file == NULL) { + tls_errprintf(1, apparg, "Need a key file.\n"); + goto err_return; + } + if (a.certificate_file == NULL) { + tls_errprintf(1, apparg, "Need a certificate chain file.\n"); + goto err_return; + } + + if (!SSL_CTX_use_PrivateKey_file(ret, a.key_file, SSL_FILETYPE_PEM)) + goto err; + if (!tls_rand_seeded_p) { + /* particularly paranoid people may not like this -- + * so provide your own random seeding before calling this */ + if (tls_rand_seed_from_file(a.key_file, 0, apparg) == -1) + goto err_return; + } + if (!SSL_CTX_use_certificate_chain_file(ret, a.certificate_file)) + goto err; + if (!SSL_CTX_check_private_key(ret)) { + tls_errprintf(1, apparg, "Private key \"%s\" does not match certificate \"%s\".\n", a.key_file, a.certificate_file); + goto err_peek; + } + } + + if ((a.ca_file != NULL) || (a.verify_depth > 0)) { + context_num++; + r = SSL_CTX_set_session_id_context(ret, (const void *)&context_num, (unsigned int)sizeof context_num); + if (!r) + goto err; + + SSL_CTX_set_verify(ret, SSL_VERIFY_PEER | (a.fail_unless_verified ? SSL_VERIFY_FAIL_IF_NO_PEER_CERT : 0), 0); + if (!a.fail_unless_verified) + SSL_CTX_set_cert_verify_callback(ret, verify_dont_fail_cb, NULL); + + if (a.verify_depth > 0) + SSL_CTX_set_verify_depth(ret, a.verify_depth); + + if (a.ca_file != NULL) { + r = SSL_CTX_load_verify_locations(ret, a.ca_file, NULL /* no CA-directory */); /* does not report failure if file does not exist ... */ + if (!r) { + err_pref_1 = " while processing certificate file "; + err_pref_2 = a.ca_file; + goto err; + } + + if (!a.client_p) { + /* SSL_load_client_CA_file is a misnomer, it just creates a list of CNs. */ + SSL_CTX_set_client_CA_list(ret, SSL_load_client_CA_file(a.ca_file)); + /* SSL_CTX_set_client_CA_list does not have a return value; + * it does not really need one, but make sure + * (we really test if SSL_load_client_CA_file worked) */ + if (SSL_CTX_get_client_CA_list(ret) == NULL) { + tls_errprintf(1, apparg, "Could not set client CA list from \"%s\".\n", a.ca_file); + goto err_peek; + } + } + } + } + + if (!a.client_p) { + if (tls_dhe1024 == NULL) { + int i; + + RAND_bytes((unsigned char *) &i, sizeof i); + /* make sure that i is non-negative -- pick one of the provided + * seeds */ + if (i < 0) + i = -i; + if (i < 0) + i = 0; + tls_set_dhe1024(i, apparg); + if (tls_dhe1024 == NULL) + goto err_return; + } + + if (!SSL_CTX_set_tmp_dh(ret, tls_dhe1024)) + goto err; + + /* avoid small subgroup attacks: */ + SSL_CTX_set_options(ret, SSL_OP_SINGLE_DH_USE); + } + +#ifndef NO_RSA + if (!a.client_p && a.export_p) { + RSA *tmpkey; + + tmpkey = RSA_generate_key(512, RSA_F4, 0, NULL); + if (tmpkey == NULL) + goto err; + if (!SSL_CTX_set_tmp_rsa(ret, tmpkey)) { + RSA_free(tmpkey); + goto err; + } + RSA_free(tmpkey); /* SSL_CTX_set_tmp_rsa uses a duplicate. */ + } +#endif + + return ret; + + err_peek: + if (!ERR_peek_error()) + goto err_return; + err: + tls_openssl_errors(err_pref_1, err_pref_2, NULL, apparg); + err_return: + if (ret != NULL) + SSL_CTX_free(ret); + return NULL; +} + + +/*****************************************************************************/ + +static int +tls_socket_nonblocking(int fd) +{ + int v, r; + + v = fcntl(fd, F_GETFL, 0); + if (v == -1) { + if (errno == EINVAL) + return 0; /* already shut down -- ignore */ + return -1; + } + r = fcntl(fd, F_SETFL, v | O_NONBLOCK); + if (r == -1) { + if (errno == EINVAL) + return 0; /* already shut down -- ignore */ + return -1; + } + return 0; +} + +static int +max(int a, int b) +{ + return a > b ? a : b; +} + +static void +tls_sockets_select(int read_select_1, int read_select_2, int write_select_1, int write_select_2, int seconds /* timeout, -1 means no timeout */) +{ + int maxfd, n; + fd_set reads, writes; + struct timeval timeout; + struct timeval *timeout_p; + + assert(read_select_1 >= -1 && read_select_2 >= -1 && write_select_1 >= -1 && write_select_2 >= -1); + assert(read_select_1 < FD_SETSIZE && read_select_2 < FD_SETSIZE -1 && write_select_1 < FD_SETSIZE -1 && write_select_2 < FD_SETSIZE -1); + + maxfd = max(max(read_select_1, read_select_2), max(write_select_1, write_select_2)); + assert(maxfd >= 0); + + FD_ZERO(&reads); + FD_ZERO(&writes); + + for(n = 0; n < 4; ++n) { + int i = n % 2; + int w = n >= 2; + /* loop over all (i, w) in {0,1}x{0,1} */ + int fd; + + if (i == 0 && w == 0) + fd = read_select_1; + else if (i == 1 && w == 0) + fd = read_select_2; + else if (i == 0 && w == 1) + fd = write_select_1; + else { + assert(i == 1 && w == 1); + fd = write_select_2; + } + + if (fd >= 0) { + if (w == 0) + FD_SET(fd, &reads); + else /* w == 1 */ + FD_SET(fd, &writes); + } + } + + if (seconds >= 0) { + timeout.tv_sec = seconds; + timeout.tv_usec = 0; + timeout_p = &timeout; + } else + timeout_p = NULL; + + DEBUG_MSG2("select no.", ++tls_select_count); + select(maxfd + 1, &reads, &writes, (fd_set *) NULL, timeout_p); + DEBUG_MSG("cont."); +} + +/*****************************************************************************/ + +#define TUNNELBUFSIZE (16*1024) +struct tunnelbuf { + char buf[TUNNELBUFSIZE]; + size_t len; + size_t offset; +}; + +static int tls_connect_attempt(SSL *, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref); + +static int tls_accept_attempt(SSL *, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref); + +static int tls_write_attempt(SSL *, struct tunnelbuf *, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref); + +static int tls_read_attempt(SSL *, struct tunnelbuf *, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref); + +static int write_attempt(int fd, struct tunnelbuf *, int *select, int *closed, int *progress); + +static int read_attempt(int fd, struct tunnelbuf *, int *select, int *closed, int *progress); + +static void write_info(SSL *ssl, int *info_fd) +{ + if (*info_fd != -1) { + long v; + int v_ok; + struct tls_x509_name_string peer; + char infobuf[TLS_INFO_SIZE]; + int r; + + DEBUG_MSG("write_info"); + v = SSL_get_verify_result(ssl); + v_ok = (v == X509_V_OK) ? 'A' : 'E'; /* Auth./Error */ + { + X509 *peercert; + + peercert = SSL_get_peer_certificate(ssl); + tls_get_x509_subject_name_oneline(peercert, &peer); + if (peercert != NULL) + X509_free(peercert); + } + if (peer.str[0] == '\0') + v_ok = '0'; /* no cert at all */ + else + if (strchr(peer.str, '\n')) { + /* should not happen, but make sure */ + *strchr(peer.str, '\n') = '\0'; + } + r = snprintf(infobuf, sizeof infobuf, "%c:%s\n%s\n", v_ok, X509_verify_cert_error_string(v), peer.str); + DEBUG_MSG2("snprintf", r); + if (r == -1 || r >= sizeof infobuf) + r = sizeof infobuf - 1; + write(*info_fd, infobuf, r); + close (*info_fd); + *info_fd = -1; + } +} + + +/* tls_proxy expects that all fds are closed after return */ +static void +tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, int client_p) +{ + struct tunnelbuf clear_to_tls, tls_to_clear; + SSL *ssl; + BIO *rbio, *wbio; + int closed, in_handshake; + const char *err_pref_1 = "", *err_pref_2 = ""; + const char *err_def = NULL; + + assert(clear_fd != -1); + assert(tls_fd != -1); + assert(clear_fd < FD_SETSIZE); + assert(tls_fd < FD_SETSIZE); + /* info_fd may be -1 */ + assert(ctx != NULL); + + tls_rand_seed_uniquely(); + + tls_socket_nonblocking(clear_fd); + DEBUG_MSG2("clear_fd", clear_fd); + tls_socket_nonblocking(tls_fd); + DEBUG_MSG2("tls_fd", tls_fd); + + ssl = SSL_new(ctx); + if (ssl == NULL) + goto err; + DEBUG_MSG("SSL_new"); + if (!SSL_set_fd(ssl, tls_fd)) + goto err; + rbio = SSL_get_rbio(ssl); + wbio = SSL_get_wbio(ssl); /* should be the same, but who cares */ + assert(rbio != NULL); + assert(wbio != NULL); + if (client_p) + SSL_set_connect_state(ssl); + else + SSL_set_accept_state(ssl); + + closed = 0; + in_handshake = 1; + tls_to_clear.len = 0; + tls_to_clear.offset = 0; + clear_to_tls.len = 0; + clear_to_tls.offset = 0; + + err_def = "I/O error"; + + /* loop finishes as soon as we detect that one side closed; + * when all (program and OS) buffers have enough space, + * the data from the last succesful read in each direction is transferred + * before close */ + do { + int clear_read_select = 0, clear_write_select = 0, + tls_read_select = 0, tls_write_select = 0, + progress = 0; + int r; + unsigned long num_read = BIO_number_read(rbio), + num_written = BIO_number_written(wbio); + + DEBUG_MSG2("loop iteration", ++tls_loop_count); + + if (in_handshake) { + DEBUG_MSG("in_handshake"); + if (client_p) + r = tls_connect_attempt(ssl, &tls_write_select, &tls_read_select, &closed, &progress, &err_pref_1); + else + r = tls_accept_attempt(ssl, &tls_write_select, &tls_read_select, &closed, &progress, &err_pref_1); + if (r != 0) { + write_info(ssl, &info_fd); + goto err; + } + if (closed) + goto err_return; + if (!SSL_in_init(ssl)) { + in_handshake = 0; + write_info(ssl, &info_fd); + } + } + + if (clear_to_tls.len != 0 && !in_handshake) { + assert(!closed); + + r = tls_write_attempt(ssl, &clear_to_tls, &tls_write_select, &tls_read_select, &closed, &progress, &err_pref_1); + if (r != 0) + goto err; + if (closed) { + assert(progress); + tls_to_clear.offset = 0; + tls_to_clear.len = 0; + } + } + + if (tls_to_clear.len != 0) { + assert(!closed); + + r = write_attempt(clear_fd, &tls_to_clear, &clear_write_select, &closed, &progress); + if (r != 0) + goto err_return; + if (closed) { + assert(progress); + clear_to_tls.offset = 0; + clear_to_tls.len = 0; + } + } + + if (!closed) { + if (clear_to_tls.offset + clear_to_tls.len < sizeof clear_to_tls.buf) { + r = read_attempt(clear_fd, &clear_to_tls, &clear_read_select, &closed, &progress); + if (r != 0) + goto err_return; + if (closed) { + r = SSL_shutdown(ssl); + DEBUG_MSG2("SSL_shutdown", r); + } + } + } + + if (!closed && !in_handshake) { + if (tls_to_clear.offset + tls_to_clear.len < sizeof tls_to_clear.buf) { + r = tls_read_attempt(ssl, &tls_to_clear, &tls_write_select, &tls_read_select, &closed, &progress, &err_pref_1); + if (r != 0) + goto err; + if (closed) { + r = SSL_shutdown(ssl); + DEBUG_MSG2("SSL_shutdown", r); + } + } + } + + if (!progress) { + DEBUG_MSG("!progress?"); + if (num_read != BIO_number_read(rbio) || num_written != BIO_number_written(wbio)) + progress = 1; + + if (!progress) { + DEBUG_MSG("!progress"); + assert(clear_read_select || tls_read_select || clear_write_select || tls_write_select); + tls_sockets_select(clear_read_select ? clear_fd : -1, tls_read_select ? tls_fd : -1, clear_write_select ? clear_fd : -1, tls_write_select ? tls_fd : -1, -1); + } + } + } while (!closed); + return; + + err: + tls_openssl_errors(err_pref_1, err_pref_2, err_def, tls_child_apparg); + err_return: + return; +} + + +static int +tls_get_error(SSL *ssl, int r, int *write_select, int *read_select, int *closed, int *progress) +{ + int err = SSL_get_error(ssl, r); + + if (err == SSL_ERROR_NONE) { + assert(r > 0); + *progress = 1; + return 0; + } + + assert(r <= 0); + + switch (err) { + case SSL_ERROR_ZERO_RETURN: + assert(r == 0); + *closed = 1; + *progress = 1; + return 0; + + case SSL_ERROR_WANT_WRITE: + *write_select = 1; + return 0; + + case SSL_ERROR_WANT_READ: + *read_select = 1; + return 0; + } + + return -1; +} + +static int +tls_connect_attempt(SSL *ssl, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref) +{ + int n, r; + + DEBUG_MSG("tls_connect_attempt"); + n = SSL_connect(ssl); + DEBUG_MSG2("SSL_connect",n); + r = tls_get_error(ssl, n, write_select, read_select, closed, progress); + if (r == -1) + *err_pref = " during SSL_connect"; + return r; +} + +static int +tls_accept_attempt(SSL *ssl, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref) +{ + int n, r; + + DEBUG_MSG("tls_accept_attempt"); + n = SSL_accept(ssl); + DEBUG_MSG2("SSL_accept",n); + r = tls_get_error(ssl, n, write_select, read_select, closed, progress); + if (r == -1) + *err_pref = " during SSL_accept"; + return r; +} + +static int +tls_write_attempt(SSL *ssl, struct tunnelbuf *buf, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref) +{ + int n, r; + + DEBUG_MSG("tls_write_attempt"); + n = SSL_write(ssl, buf->buf + buf->offset, buf->len); + DEBUG_MSG2("SSL_write",n); + r = tls_get_error(ssl, n, write_select, read_select, closed, progress); + if (n > 0) { + buf->len -= n; + assert(buf->len >= 0); + if (buf->len == 0) + buf->offset = 0; + else + buf->offset += n; + } + if (r == -1) + *err_pref = " during SSL_write"; + return r; +} + +static int +tls_read_attempt(SSL *ssl, struct tunnelbuf *buf, int *write_select, int *read_select, int *closed, int *progress, const char **err_pref) +{ + int n, r; + size_t total; + + DEBUG_MSG("tls_read_attempt"); + total = buf->offset + buf->len; + assert(total < sizeof buf->buf); + n = SSL_read(ssl, buf->buf + total, (sizeof buf->buf) - total); + DEBUG_MSG2("SSL_read",n); + r = tls_get_error(ssl, n, write_select, read_select, closed, progress); + if (n > 0) { + buf->len += n; + assert(buf->offset + buf->len <= sizeof buf->buf); + } + if (r == -1) + *err_pref = " during SSL_read"; + return r; +} + +static int +get_error(int r, int *select, int *closed, int *progress) +{ + if (r >= 0) { + *progress = 1; + if (r == 0) + *closed = 1; + return 0; + } else { + assert(r == -1); + if (errno == EAGAIN || errno == EWOULDBLOCK) { + *select = 1; + return 0; + } else if (errno == EPIPE) { + *progress = 1; + *closed = 1; + return 0; + } else + return -1; + } +} + +static int write_attempt(int fd, struct tunnelbuf *buf, int *select, int *closed, int *progress) +{ + int n, r; + + DEBUG_MSG("write_attempt"); + n = write(fd, buf->buf + buf->offset, buf->len); + DEBUG_MSG2("write",n); + r = get_error(n, select, closed, progress); + if (n > 0) { + buf->len -= n; + assert(buf->len >= 0); + if (buf->len == 0) + buf->offset = 0; + else + buf->offset += n; + } + if (r == -1) + tls_errprintf(1, tls_child_apparg, "write error: %s\n", strerror(errno)); + return r; +} + +static int +read_attempt(int fd, struct tunnelbuf *buf, int *select, int *closed, int *progress) +{ + int n, r; + size_t total; + + DEBUG_MSG("read_attempt"); + total = buf->offset + buf->len; + assert(total < sizeof buf->buf); + n = read(fd, buf->buf + total, (sizeof buf->buf) - total); + DEBUG_MSG2("read",n); + r = get_error(n, select, closed, progress); + if (n > 0) { + buf->len += n; + assert(buf->offset + buf->len <= sizeof buf->buf); + } + if (r == -1) + tls_errprintf(1, tls_child_apparg, "read error: %s\n", strerror(errno)); + return r; +} diff --git a/demos/easy_tls/easy-tls.h b/demos/easy_tls/easy-tls.h new file mode 100644 index 0000000000..52b298e654 --- /dev/null +++ b/demos/easy_tls/easy-tls.h @@ -0,0 +1,57 @@ +/* -*- Mode: C; c-file-style: "bsd" -*- */ +/* + * easy-tls.h -- generic TLS proxy. + * $Id: easy-tls.h,v 1.1 2001/09/17 19:06:59 bodo Exp $ + */ +/* + * (c) Copyright 1999 Bodo Moeller. All rights reserved. + */ + +#ifndef HEADER_TLS_H +#define HEADER_TLS_H + +#ifndef HEADER_SSL_H +typedef struct ssl_ctx_st SSL_CTX; +#endif + +#define TLS_INFO_SIZE 512 /* max. # of bytes written to infofd */ + +void tls_set_dhe1024(int i, void* apparg); +/* Generate DHE parameters: + * i >= 0 deterministic (i selects seed), i < 0 random (may take a while). + * tls_create_ctx calls this with random non-negative i if the application + * has never called it.*/ + +void tls_rand_seed(void); +int tls_rand_seed_from_file(const char *filename, size_t n, void *apparg); +void tls_rand_seed_from_memory(const void *buf, size_t n); + +struct tls_create_ctx_args +{ + int client_p; + const char *certificate_file; + const char *key_file; + const char *ca_file; + int verify_depth; + int fail_unless_verified; + int export_p; +}; +struct tls_create_ctx_args tls_create_ctx_defaultargs(void); +/* struct tls_create_ctx_args is similar to a conventional argument list, + * but it can provide default values and allows for future extension. */ +SSL_CTX *tls_create_ctx(struct tls_create_ctx_args, void *apparg); + +struct tls_start_proxy_args +{ + int fd; + int client_p; + SSL_CTX *ctx; + pid_t *pid; + int *infofd; +}; +struct tls_start_proxy_args tls_start_proxy_defaultargs(void); +/* tls_start_proxy return value *MUST* be checked! + * 0 means ok, otherwise we've probably run out of some resources. */ +int tls_start_proxy(struct tls_start_proxy_args, void *apparg); + +#endif diff --git a/demos/easy_tls/test.c b/demos/easy_tls/test.c new file mode 100644 index 0000000000..21f679afd1 --- /dev/null +++ b/demos/easy_tls/test.c @@ -0,0 +1,244 @@ +/* test.c */ +/* $Id: test.c,v 1.1 2001/09/17 19:06:59 bodo Exp $ */ + +#define L_PORT 9999 +#define C_PORT 443 + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "test.h" +#include "easy-tls.h" + +void +test_process_init(int fd, int client_p, void *apparg) +{ + fprintf(stderr, "test_process_init(fd = %d, client_p = %d, apparg = %p)\n", fd, client_p, apparg); +} + +void +test_errflush(int child_p, char *errbuf, size_t num, void *apparg) +{ + fputs(errbuf, stderr); +} + + +int +main(int argc, char *argv[]) +{ + int s, fd, r; + FILE *conn_in; + FILE *conn_out; + char buf[256]; + SSL_CTX *ctx; + int client_p = 0; + int port; + int tls = 0; + char infobuf[TLS_INFO_SIZE + 1]; + + if (argc > 1 && argv[1][0] == '-') { + fputs("Usage: test [port] -- server\n" + " test num.num.num.num [port] -- client\n", + stderr); + exit(1); + } + + if (argc > 1) { + if (strchr(argv[1], '.')) { + client_p = 1; + } + } + + fputs(client_p ? "Client\n" : "Server\n", stderr); + + { + struct tls_create_ctx_args a = tls_create_ctx_defaultargs(); + a.client_p = client_p; + a.certificate_file = "cert.pem"; + a.key_file = "cert.pem"; + a.ca_file = "cacerts.pem"; + + ctx = tls_create_ctx(a, NULL); + if (ctx == NULL) + exit(1); + } + + s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (s == -1) { + perror("socket"); + exit(1); + } + + if (client_p) { + struct sockaddr_in addr; + size_t addr_len = sizeof addr; + + addr.sin_family = AF_INET; + assert(argc > 1); + if (argc > 2) + sscanf(argv[2], "%d", &port); + else + port = C_PORT; + addr.sin_port = htons(port); + addr.sin_addr.s_addr = inet_addr(argv[1]); + + r = connect(s, &addr, addr_len); + if (r != 0) { + perror("connect"); + exit(1); + } + fd = s; + fprintf(stderr, "Connect (fd = %d).\n", fd); + } else { + /* server */ + { + int i = 1; + + r = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *) &i, sizeof i); + if (r == -1) { + perror("setsockopt"); + exit(1); + } + } + + { + struct sockaddr_in addr; + size_t addr_len = sizeof addr; + + if (argc > 1) + sscanf(argv[1], "%d", &port); + else + port = L_PORT; + addr.sin_family = AF_INET; + addr.sin_port = htons(port); + addr.sin_addr.s_addr = INADDR_ANY; + + r = bind(s, &addr, addr_len); + if (r != 0) { + perror("bind"); + exit(1); + } + } + + r = listen(s, 1); + if (r == -1) { + perror("listen"); + exit(1); + } + + fprintf(stderr, "Listening at port %i.\n", port); + + fd = accept(s, NULL, 0); + if (fd == -1) { + perror("accept"); + exit(1); + } + + fprintf(stderr, "Accept (fd = %d).\n", fd); + } + + conn_in = fdopen(fd, "r"); + if (conn_in == NULL) { + perror("fdopen"); + exit(1); + } + conn_out = fdopen(fd, "w"); + if (conn_out == NULL) { + perror("fdopen"); + exit(1); + } + + setvbuf(conn_in, NULL, _IOLBF, 256); + setvbuf(conn_out, NULL, _IOLBF, 256); + + while (fgets(buf, sizeof buf, stdin) != NULL) { + if (buf[0] == 'W') { + fprintf(conn_out, "%.*s\r\n", (int)(strlen(buf + 1) - 1), buf + 1); + fprintf(stderr, ">>> %.*s\n", (int)(strlen(buf + 1) - 1), buf + 1); + } else if (buf[0] == 'C') { + fprintf(stderr, "Closing.\n"); + fclose(conn_in); + fclose(conn_out); + exit(0); + } else if (buf[0] == 'R') { + int lines = 0; + + sscanf(buf + 1, "%d", &lines); + do { + if (fgets(buf, sizeof buf, conn_in) == NULL) { + if (ferror(conn_in)) { + fprintf(stderr, "ERROR\n"); + exit(1); + } + fprintf(stderr, "CLOSED\n"); + return 0; + } + fprintf(stderr, "<<< %s", buf); + } while (--lines > 0); + } else if (buf[0] == 'T') { + int infofd; + + tls++; + { + struct tls_start_proxy_args a = tls_start_proxy_defaultargs(); + a.fd = fd; + a.client_p = client_p; + a.ctx = ctx; + a.infofd = &infofd; + r = tls_start_proxy(a, NULL); + } + assert(r != 1); + if (r != 0) { + fprintf(stderr, "tls_start_proxy failed: %d\n", r); + switch (r) { + case -1: + fputs("socketpair", stderr); break; + case 2: + fputs("FD_SETSIZE exceeded", stderr); break; + case -3: + fputs("pipe", stderr); break; + case -4: + fputs("fork", stderr); break; + case -5: + fputs("dup2", stderr); break; + default: + fputs("?", stderr); + } + if (r < 0) + perror(""); + else + fputc('\n', stderr); + exit(1); + } + + r = read(infofd, infobuf, sizeof infobuf - 1); + if (r > 0) { + const char *info = infobuf; + const char *eol; + + infobuf[r] = '\0'; + while ((eol = strchr(info, '\n')) != NULL) { + fprintf(stderr, "+++ `%.*s'\n", eol - info, info); + info = eol+1; + } + close (infofd); + } + } else { + fprintf(stderr, "W... write line to network\n" + "R[n] read line (n lines) from network\n" + "C close\n" + "T start %sTLS proxy\n", tls ? "another " : ""); + } + } + return 0; +} diff --git a/demos/easy_tls/test.h b/demos/easy_tls/test.h new file mode 100644 index 0000000000..dda667843f --- /dev/null +++ b/demos/easy_tls/test.h @@ -0,0 +1,11 @@ +/* test.h */ +/* $Id: test.h,v 1.1 2001/09/17 19:07:00 bodo Exp $ */ + + +void test_process_init(int fd, int client_p, void *apparg); +#define TLS_APP_PROCESS_INIT test_process_init + +#undef TLS_CUMULATE_ERRORS + +void test_errflush(int child_p, char *errbuf, size_t num, void *apparg); +#define TLS_APP_ERRFLUSH test_errflush -- 2.34.1