summaryrefslogtreecommitdiff
path: root/networking/ssl_helper/ssl_helper.c
blob: d840b1b880548b12309d8f9572abb49cb4b821c1 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
/*
 * Copyright (c) 2013 INSIDE Secure Corporation
 * Copyright (c) PeerSec Networks, 2002-2011
 * All Rights Reserved
 *
 * The latest version of this code is available at http://www.matrixssl.org
 *
 * This software is open source; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in WITHOUT ANY WARRANTY; without even the
 * implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 * http://www.gnu.org/copyleft/gpl.html
 */
#include <errno.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdarg.h>
#include <fcntl.h>
#include <stdio.h>
#include <time.h>
#include <poll.h>
#include <sys/socket.h>

#include "matrixssl/matrixsslApi.h"

//#warning "DO NOT USE THESE DEFAULT KEYS IN PRODUCTION ENVIRONMENTS."

/*
 * If supporting client authentication, pick ONE identity to auto select a
 * certificate and private key that support desired algorithms.
 */
#define ID_RSA /* RSA Certificate and Key */

#define USE_HEADER_KEYS

/* If the algorithm type is supported, load a CA for it */
#ifdef USE_HEADER_KEYS
/* CAs */
# include "sampleCerts/RSA/ALL_RSA_CAS.h"
/* Identity Certs and Keys for use with Client Authentication */
# ifdef ID_RSA
#  define EXAMPLE_RSA_KEYS
#  include "sampleCerts/RSA/2048_RSA.h"
#  include "sampleCerts/RSA/2048_RSA_KEY.h"
# endif
#endif

static ssize_t safe_write(int fd, const void *buf, size_t count)
{
	ssize_t n;

	do {
		n = write(fd, buf, count);
	} while (n < 0 && errno == EINTR);

	return n;
}

static ssize_t full_write(int fd, const void *buf, size_t len)
{
	ssize_t cc;
	ssize_t total;

	total = 0;

	while (len) {
		cc = safe_write(fd, buf, len);

		if (cc < 0) {
			if (total) {
				/* we already wrote some! */
				/* user can do another write to know the error code */
				return total;
			}
			return cc;  /* write() returns -1 on failure. */
		}

		total += cc;
		buf = ((const char *)buf) + cc;
		len -= cc;
	}

	return total;
}

static void say(const char *s, ...)
{
	char buf[256];
	va_list p;
	int sz;

	va_start(p, s);
	sz = vsnprintf(buf, sizeof(buf), s, p);
	full_write(STDERR_FILENO, buf, sz >= 0 && sz < sizeof(buf) ? sz : strlen(buf));
	va_end(p);
}

static void die(const char *s, ...)
{
	char buf[256];
	va_list p;
	int sz;

	va_start(p, s);
	sz = vsnprintf(buf, sizeof(buf), s, p);
	full_write(STDERR_FILENO, buf, sz >= 0 && sz < sizeof(buf) ? sz : strlen(buf));
	exit(1);
	va_end(p);
}

#if 0
# define dbg(...) say(__VA_ARGS__)
#else
# define dbg(...) ((void)0)
#endif

static struct pollfd pfd[2] = {
	{ -1, POLLIN|POLLERR|POLLHUP, 0 },
	{ -1, POLLIN|POLLERR|POLLHUP, 0 },
};
#define STDIN           pfd[0]
#define NETWORK         pfd[1]
#define STDIN_READY()   (pfd[0].revents & (POLLIN|POLLERR|POLLHUP))
#define NETWORK_READY() (pfd[1].revents & (POLLIN|POLLERR|POLLHUP))

static int wait_for_input(void)
{
	if (STDIN.fd == NETWORK.fd) /* means both are -1 */
		exit(0);
	dbg("polling\n");
	STDIN.revents = NETWORK.revents = 0;
	return poll(pfd, 2, -1);
}

static int32 certCb(ssl_t *ssl, psX509Cert_t *cert, int32 alert)
{
	/* Example to allow anonymous connections based on a define */
	if (alert > 0) {
		return SSL_ALLOW_ANON_CONNECTION; // = 254
	}
#if 0
	/* Validate the 'not before' and 'not after' dates, etc */
	return PS_FAILURE; /* if we don't like this cert */
#endif
	return PS_SUCCESS;
}

static void close_conn_and_exit(ssl_t *ssl, int fd)
{
	unsigned char *buf;
	int len;

	fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK);
	/* Quick attempt to send a closure alert, don't worry about failure */
	if (matrixSslEncodeClosureAlert(ssl) >= 0) {
		len = matrixSslGetOutdata(ssl, &buf);
		if (len > 0) {
			len = safe_write(fd, buf, len);
			//if (len > 0) {
			//	matrixSslSentData(ssl, len);
			//}
		}
	}
	//matrixSslDeleteSession(ssl);
	shutdown(fd, SHUT_WR);
	exit(0);
}

static int encode_data(ssl_t *ssl, const void *data, int len)
{
	unsigned char *buf;
	int available;

	available = matrixSslGetWritebuf(ssl, &buf, len);
	if (available < 0)
		die("matrixSslGetWritebuf\n");
	if (len > available)
		die("len > available\n");
	memcpy(buf, data, len);
	if (matrixSslEncodeWritebuf(ssl, len) < 0)
		die("matrixSslEncodeWritebuf\n");
	return len;
}

static void flush_to_net(ssl_t *ssl, int fd)
{
	int rc;
	int len;
	unsigned char *buf;

	while ((len = matrixSslGetOutdata(ssl, &buf)) > 0) {
		dbg("writing net %d bytes\n", len);
		if (full_write(fd, buf, len) != len)
			die("write to network\n");
		rc = matrixSslSentData(ssl, len);
		if (rc < 0)
			die("matrixSslSentData\n");
	}
}

static void do_io_until_eof_and_exit(int fd, sslKeys_t *keys)
{
	int rc;
	int len;
	uint32_t len32u;
	sslSessionId_t *sid;
	ssl_t *ssl;
	unsigned char *buf;

	NETWORK.fd = fd;
	/* Note! STDIN.fd is disabled (-1) until SSL handshake is over:
	 * we do not attempt to feed any user data to MatrixSSL
	 * before it is ready.
	 */

	matrixSslNewSessionId(&sid);
	rc = matrixSslNewClientSession(&ssl, keys, sid, 0, certCb, NULL, NULL, 0);
dbg("matrixSslNewClientSession:rc=%d\n", rc);
	if (rc != MATRIXSSL_REQUEST_SEND)
		die("matrixSslNewClientSession\n");

	len = 0; /* only to suppress compiler warning */
 again:
	switch (rc) {
	case MATRIXSSL_REQUEST_SEND:
		dbg("MATRIXSSL_REQUEST_SEND\n");
		flush_to_net(ssl, fd);
		goto poll_input;

	case 0:
		dbg("rc==0\n");
		flush_to_net(ssl, fd);
		goto poll_input;

	case MATRIXSSL_REQUEST_CLOSE:
		/* what does this mean if we are here? */
		dbg("MATRIXSSL_REQUEST_CLOSE\n");
		close_conn_and_exit(ssl, fd);

	case MATRIXSSL_HANDSHAKE_COMPLETE:
		dbg("MATRIXSSL_HANDSHAKE_COMPLETE\n");
		/* Init complete, can start reading local user's data: */
		STDIN.fd = STDIN_FILENO;
 poll_input:
		wait_for_input();
		if (STDIN_READY()) {
			char ibuf[4 * 1024];
			dbg("reading stdin\n");
			len = read(STDIN_FILENO, ibuf, sizeof(ibuf));
			if (len < 0)
				die("read error on stdin\n");
			if (len == 0)
				STDIN.fd = -1;
			else {
				len = encode_data(ssl, ibuf, len);
				if (len) {
					rc = MATRIXSSL_REQUEST_SEND;
dbg("rc=%d\n", rc);
					goto again;
				}
			}
		}
 read_network:
		if (NETWORK_READY()) {
			dbg("%s%s%s\n",
				(pfd[1].revents & POLLIN)  ? "POLLIN"  : "",
				(pfd[1].revents & POLLERR) ? "|POLLERR" : "",
				(pfd[1].revents & POLLHUP) ? "|POLLHUP" : ""
			);
			len = matrixSslGetReadbuf(ssl, &buf);
			if (len <= 0)
				die("matrixSslGetReadbuf\n");
			dbg("reading net up to %d\n", len);
			len = read(fd, buf, len);
			dbg("reading net:%d\n", len);
			if (len < 0)
				die("read error on network\n");
			if (len == 0) /*eof*/
				NETWORK.fd = -1;
			len32u = len;
			rc = matrixSslReceivedData(ssl, len, &buf, &len32u);
dbg("matrixSslReceivedData:rc=%d\n", rc);
			len = len32u;
			if (rc < 0)
				die("matrixSslReceivedData\n");
		}
		goto again;

	case MATRIXSSL_APP_DATA:
		dbg("MATRIXSSL_APP_DATA: writing stdout\n");
		do {
			if (full_write(STDOUT_FILENO, buf, len) != len)
				die("write to stdout\n");
			len32u = len;
			rc = matrixSslProcessedData(ssl, &buf, &len32u);
//this was seen returning rc=0:
dbg("matrixSslProcessedData:rc=%d\n", rc);
			len = len32u;
		} while (rc == MATRIXSSL_APP_DATA);
		if (pfd[1].fd == -1) {
			/* Already saw EOF on network, and we processed
			 * and wrote out all ssl data. Signal it:
			 */
			close(STDOUT_FILENO);
		}
		goto again;

	case MATRIXSSL_REQUEST_RECV:
		dbg("MATRIXSSL_REQUEST_RECV\n");
		wait_for_input();
		goto read_network;

	case MATRIXSSL_RECEIVED_ALERT:
		dbg("MATRIXSSL_RECEIVED_ALERT\n");
		/* The first byte of the buffer is the level */
		/* The second byte is the description */
		if (buf[0] == SSL_ALERT_LEVEL_FATAL)
			die("Fatal alert\n");
		/* Closure alert is normal (and best) way to close */
		if (buf[1] == SSL_ALERT_CLOSE_NOTIFY)
			close_conn_and_exit(ssl, fd);
		die("Warning alert\n");
		len32u = len;
		rc = matrixSslProcessedData(ssl, &buf, &len32u);
dbg("matrixSslProcessedData:rc=%d\n", rc);
		len = len32u;
		goto again;

	default:
		/* If rc < 0 it is an error */
		die("bad rc:%d\n", rc);
	}
}

static sslKeys_t* make_keys(void)
{
	int rc, CAstreamLen;
	char *CAstream;
	sslKeys_t *keys;

	if (matrixSslNewKeys(&keys) < 0)
		die("matrixSslNewKeys\n");

#ifdef USE_HEADER_KEYS
	/*
	 * In-memory based keys
	 * Build the CA list first for potential client auth usage
	 */
	CAstream = NULL;
	CAstreamLen = sizeof(RSACAS);
	if (CAstreamLen > 0) {
		CAstream = psMalloc(NULL, CAstreamLen);
		memcpy(CAstream, RSACAS, sizeof(RSACAS));
	}

 #ifdef ID_RSA
	rc = matrixSslLoadRsaKeysMem(keys, RSA2048, sizeof(RSA2048),
			RSA2048KEY, sizeof(RSA2048KEY), (unsigned char*)CAstream,
			CAstreamLen);
	if (rc < 0)
		die("matrixSslLoadRsaKeysMem\n");
 #endif

	if (CAstream)
		psFree(CAstream);
#endif /* USE_HEADER_KEYS */
	return keys;
}

int main(int argc, char **argv)
{
	int fd;
	char *fd_str;

	if (!argv[1])
		die("Syntax error\n");
	if (argv[1][0] != '-')
		die("Syntax error\n");
	if (argv[1][1] != 'd')
		die("Syntax error\n");
	fd_str = argv[1] + 2;
	if (!fd_str[0])
		fd_str = argv[2];
	if (!fd_str || fd_str[0] < '0' || fd_str[0] > '9')
		die("Syntax error\n");

	fd = atoi(fd_str);
	if (fd < 3)
		die("Syntax error\n");

	if (matrixSslOpen() < 0)
		die("matrixSslOpen\n");

	do_io_until_eof_and_exit(fd, make_keys());
	/* does not return */

	return 0;
}