tlsserver.cxx

现在应用最广泛的一种私网穿透方式

/* 
   This program takes no arguments. It opens the STUN tcp port and rus a tls server
   on it. 
*/

#include <sys/types.h>
#include <string.h>
#include <openssl/e_os2.h>
#include <openssl/evp.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/pkcs7.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/ssl.h>
#ifdef WIN32
#include <errno.h>
#include <winsock2.h>
#include <io.h>
#endif
 
#ifndef WIN32
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#endif

#ifdef WIN32
# include <windows.h>
# include <winbase.h>
# include <errno.h>
# include <winsock2.h>
# include <io.h>
typedef unsigned int u_int32_t;
#endif

#include <cassert>
#include <fcntl.h>

#include <iostream>
#include <cstdlib>
#include <stdio.h>

#ifdef __MACH__
typedef int socklen_t;
#endif

#include "stun.h"

using namespace std;



#define MAX_CONNECTIONS 64


#ifdef WIN32
typedef int socklen_t;
//#define errno WSAGetLastError()
typedef SOCKET Socket;
#else
typedef int Socket;
static const Socket INVALID_SOCKET = -1;
static const int SOCKET_ERROR = -1;
#endif



// TODO - !cj! - need to deal with closing connections 


void 
makeSocketNonBlocking(Socket fd)
{
#if WIN32
   unsigned long noBlock = 1;
   int errNoBlock = ioctlsocket( fd, FIONBIO , &noBlock );
   if ( errNoBlock != 0 )
   {
      assert(0);
   }
#else
   int flags  = fcntl( fd, F_GETFL, 0);
   int errNoBlock = fcntl(fd, F_SETFL, flags | O_NONBLOCK );
   if ( errNoBlock != 0 ) // !cj! I may have messed up this line 
   {
      assert(0);
   }
#endif
}


int 
main()
{
#ifdef WIN32 
   WORD wVersionRequested = MAKEWORD( 2, 2 );
   WSADATA wsaData;
   int err;

   err = WSAStartup( wVersionRequested, &wsaData );
   if ( err != 0 ) 
   {
      // could not find a usable WinSock DLL
      //cerr << "Could not load winsock" << endl;
      assert(0); // is this is failing, try a different version that 2.2, 1.0 or later will likely work 
      exit(1);
   }
#endif

   // contexts for each connection 
   SSL* ssl[MAX_CONNECTIONS];

   // buffers for each connection
   BIO* bio[MAX_CONNECTIONS];

   // file descriptors for each connection
   Socket fd[MAX_CONNECTIONS];

   // ip address of other side of connection 
   int  peerip[MAX_CONNECTIONS];

   // root cert list 
   X509_STORE* certAuthorities;
   // my public cert
   X509* publicCert;
   // my private key 
   EVP_PKEY* privateKey;
   // SSL Context 
   SSL_CTX* ctx;
   
   Socket mFd;
   
   char* password = "password";
   

   for ( int i=0; i<MAX_CONNECTIONS; i++ )
   {
      fd[i]=-1;
      bio[i]=0;
      ssl[i]=0;
   }
   

   // load public cert 
   FILE* fp = fopen("id.pem","rb");
   if ( !fp )
   {
      cerr << "Could not read public cert" <<endl; exit(1);
   }
   publicCert = PEM_read_X509(fp,NULL,NULL,NULL);
   if (!publicCert)
   {
      cerr << "Error reading contents of public cert"<<endl; exit(1);
   }
   cerr << "Loaded public cert"<<endl;


   // load private key 
   fp = fopen("id_key.pem","rb");
   if ( !fp )
   {
      cerr << "Could not read private key"<<endl; exit(1);
   }
   privateKey = PEM_read_PrivateKey(fp,NULL,NULL,password);
   if (!privateKey)
   {
      cerr << "Error reading contents of private key file "<<endl;exit(1);
   }
   cerr << "Loaded private key "<<endl;
   
   // load root certs 
   certAuthorities = X509_STORE_new();
   assert( certAuthorities );
   if ( X509_STORE_load_locations(certAuthorities,"root.pem",NULL) != 1 )
   {  
      cerr << "Error reading contents of root cert file "<<endl;
   }
   cerr << "Loaded public CAs"<<endl;

   
   // set up main security context    
   SSL_library_init();
   
   SSL_load_error_strings();
   
   OpenSSL_add_all_ciphers();
   OpenSSL_add_all_digests();
   
   ERR_load_crypto_strings();
   
   ctx=SSL_CTX_new( TLSv1_method() );
   assert( ctx );
   
   int ok;
   ok = SSL_CTX_use_certificate(ctx, publicCert);
   assert( ok == 1);
   
   ok = SSL_CTX_use_PrivateKey(ctx,privateKey);
   assert( ok == 1);
   
   assert( certAuthorities );
   SSL_CTX_set_cert_store(ctx, certAuthorities);
   
   
   // open a socket to listen for requests on 
   mFd = socket(PF_INET, SOCK_STREAM, 0);

   sockaddr_in addr;
   addr.sin_family = AF_INET;
   addr.sin_addr.s_addr = htonl(INADDR_ANY); 
   addr.sin_port = htons(STUN_PORT);
   
   if ( bind( mFd, (struct sockaddr*) &addr, sizeof(addr)) == SOCKET_ERROR )
   {
      int err = errno;
      if ( err == EADDRINUSE )
      {
         cerr << "Port already in use"<<endl;
      }
      else
      {
         cerr << "Could not bind to port"<<endl;
      }
      
      exit(0);
   }

   makeSocketNonBlocking(mFd);

   int e = listen(mFd,64 );
   if (e != 0 )
   {
      assert(0);
   }


   cerr << "Ready for requests" << endl;
   
   while ( true ) 
   {
      // set up the read fd set for select 
      fd_set read;
      FD_ZERO(&read);
      int size=0;

      FD_SET(mFd, &read);
      size = mFd+1;

      for ( int i=0; i<MAX_CONNECTIONS; i++ )
      {
         if ( fd[i] > 0 )
         {
            FD_SET(fd[i], &read); 
            size = ( int(fd[i]+1) > size) ? int(fd[i]+1) : size;
         }
         
      }


      // do a select 
      unsigned long ms = 500;
      struct timeval tv;
      tv.tv_sec = (ms/1000);
      tv.tv_usec = (ms%1000)*1000;
      int e = select(size, &read, NULL, NULL, &tv);
      
      cerr << "." ;
      
      // process any new connections 
      if ( FD_ISSET(mFd, &read))
      {
         cerr << "Got a new connection" << endl;
         
         // find an unused connection 
         int i=0;
         for ( ; i<MAX_CONNECTIONS; i++ )
         {
            if ( fd[i] == -1 ) 
            {
               break;
            }
         }
         
         if ( i >= MAX_CONNECTIONS )
         {
            cerr << "Ran out of connections to use "<<endl;
            break;
         }
         
         struct sockaddr_in peer;
         int peerLen=sizeof(peer);
         fd[i] = accept( mFd, (struct sockaddr*)&peer,(socklen_t*)&peerLen);
         if ( fd[i] == -1 )
         {
            int err = errno;
            cerr << "Error on accept: " << strerror(err)<<endl;
            break;
         }
         
         int* ptr =  (int*)( &peer.sin_addr );
         peerip[i] = *ptr;
         
         ssl[i] = NULL;
         
         ssl[i] = SSL_new(ctx);
         assert(ssl[i]);
         
         bio[i] = BIO_new_socket(fd[i],0/*close flag*/);
         assert( bio[i] );
         
         SSL_set_bio( ssl[i], bio[i], bio[i] );
         
         int ok=0;
         ok = SSL_accept(ssl[i]);
         
         if ( ok != 1 )
         {
            int err = SSL_get_error(ssl[i],ok);
            char buf[256];
            ERR_error_string_n(err,buf,sizeof(buf));
            
            cerr << "ssl connection failed "<<endl;
            
            bio[i] = NULL;
         }
         
         makeSocketNonBlocking(fd[i]);
      }
      

      // process reads and writes 
      for (int i=0; i<MAX_CONNECTIONS; i++) 
      {
         if ( ssl[i] )
            if (  FD_ISSET( fd[i], &read) ||  SSL_pending(ssl[i])  )
            {
               cerr << "got a message on connection " << i << endl;
            
               char buf[STUN_MAX_MESSAGE_SIZE];
                   
               int ret = SSL_read(ssl[i],buf,sizeof(buf));
               if (ret < 0 )
               {
                  int err = SSL_get_error(ssl[i],ret);
                  switch (err)
                  {
                     case SSL_ERROR_WANT_READ:
                     case SSL_ERROR_WANT_WRITE:
                     case SSL_ERROR_NONE:
                     {
                        cerr << "Got TLS read got condition of " << err  <<endl;
                     }
                     break;
                     default:
                     {
                        char buf[256];
                        ERR_error_string_n(err,buf,sizeof(buf));
                        cerr << "Got TLS read error " << err  << " " << buf  <<endl;
                     }
                     break;
                  }
                  // !cj! - big mem leak here - need to close and cleanup 
                  closesocket( fd[i] );
                  fd[i] = -1;
                  ssl[i]=0;
               }
            
               cerr << "Received message with " << ret << " bytes"<<endl;
            
               StunAddress4 from;
               StunAddress4 myAddr;
               StunAddress4 altAddr;
               StunMessage resp;
               StunAddress4 destination;
               StunAtrString hmacPassword;
               bool changePort;
               bool changeIp;
            
               from.addr = peerip[i];
            
               bool ok = stunServerProcessMsg( buf,ret, 
                                               from, 
                                               myAddr,
                                               altAddr, 
                                               &resp,
                                               &destination,
                                               &hmacPassword,
                                               &changePort,
                                               &changeIp,
                                               true /*verbose*/ );

               if (!ok )
               { 
                  cerr << "Message did not parse - closeing conneciton " << i  <<endl;
                  closesocket( fd[i] );
                  fd[i] = -1;
                  ssl[i]=0;
               }
            
               if (ok)
               {
                  int len = stunEncodeMessage( resp, buf, sizeof(buf), hmacPassword );
           
                  ret = SSL_write(ssl[i],(const char*)buf,len);

                  if (ret < 0 )
                  {
                     int err = SSL_get_error(ssl[i],ret);
                     switch (err)
                     {
                        case SSL_ERROR_WANT_READ:
                        case SSL_ERROR_WANT_WRITE:
                        case SSL_ERROR_NONE:
                        {
                           cerr << "Got TLS write got codition of " << err  <<endl;
                        }
                        break;
                        default:
                        {
                           cerr << "Got TLS write error " << err  <<endl;
                        }
                        break;
                     }
                     // !cj! big mem leak - need to cleanup 
                     closesocket( fd[i] );
                     fd[i] = -1;
                     ssl[i]=0;
                  }
               }
            }
      }
   }
   
   return 0;
}


/* ====================================================================
 * The Vovida Software License, Version 1.0 
 * 
 * Copyright (c) 2000 Vovida Networks, Inc.  All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 
 * 3. The names "VOCAL", "Vovida Open Communication Application Library",
 *    and "Vovida Open Communication Application Library (VOCAL)" must
 *    not be used to endorse or promote products derived from this
 *    software without prior written permission. For written
 *    permission, please contact [e-mail].
 *
 * 4. Products derived from this software may not be called "VOCAL", nor
 *    may "VOCAL" appear in their name, without prior written
 *    permission of Vovida Networks, Inc.
 * 
 * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND
 * NON-INFRINGEMENT ARE DISCLAIMED.  IN NO EVENT SHALL VOVIDA
 * NETWORKS, INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT DAMAGES
 * IN EXCESS OF $1,000, NOR FOR ANY INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 * 
 * ====================================================================
 * 
 * This software consists of voluntary contributions made by Vovida
 * Networks, Inc. and many individuals on behalf of Vovida Networks,
 * Inc.  For more information on Vovida Networks, Inc., please see
 * <http://www.vovida.org/>.
 *
 */

// Local Variables:
// mode:c++
// c-file-style:"ellemtel"
// c-file-offsets:((case-label . +))
// indent-tabs-mode:nil
// End: