easy-tls.c

Openssl 0.9.8e 最新版OpenSSL

/* -*- Mode: C; c-file-style: "bsd" -*- */
/*
 * easy-tls.c -- generic TLS proxy.
 * $Id: easy-tls.c,v 1.4 2002/03/05 09:07:16 bodo Exp $
 */
/*
 (c) Copyright 1999 Bodo Moeller.  All rights reserved.

 This is free software; you can redistributed and/or modify it
 unter the terms of either
   -  the GNU General Public License as published by the
      Free Software Foundation, version 1, or (at your option)
      any later version,
 or
   -  the following license:
*/
/*
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that each of the following
 * conditions is met:
 *
 * 1. Redistributions qualify as "freeware" or "Open Source Software" under
 *    one of the following terms:
 * 
 *    (a) Redistributions are made at no charge beyond the reasonable cost of
 *        materials and delivery.
 * 
 *    (b) Redistributions are accompanied by a copy of the Source Code
 *        or by an irrevocable offer to provide a copy of the Source Code
 *        for up to three years at the cost of materials and delivery.
 *        Such redistributions must allow further use, modification, and
 *        redistribution of the Source Code under substantially the same
 *        terms as this license.
 *
 * 2. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 3. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 4. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by Bodo Moeller."
 *    (If available, substitute umlauted o for oe.)
 *
 * 5. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by Bodo Moeller."
 *
 * THIS SOFTWARE IS PROVIDED BY BODO MOELLER ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL BODO MOELLER OR
 * HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 */
/*
 * Attribution for OpenSSL library:
 *
 * This product includes cryptographic software written by Eric Young
 * ([e-mail]).  This product includes software written by Tim
 * Hudson ([e-mail]).
 * This product includes software developed by the OpenSSL Project
 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)
 */

static char const rcsid[] =
"$Id: easy-tls.c,v 1.4 2002/03/05 09:07:16 bodo Exp $";

#include <assert.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <sys/select.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/utsname.h>
#include <unistd.h>

#include <openssl/crypto.h>
#include <openssl/dh.h>
#include <openssl/dsa.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/opensslv.h>
#include <openssl/pem.h>
#include <openssl/rand.h>
#ifndef NO_RSA
 #include <openssl/rsa.h>
#endif
#include <openssl/ssl.h>
#include <openssl/x509.h>
#include <openssl/x509_vfy.h>

#if OPENSSL_VERSION_NUMBER < 0x00904000L /* 0.9.4-dev */
# error "This program needs OpenSSL 0.9.4 or later."
#endif

#include "easy-tls.h" /* include after <openssl/ssl.h> if both are needed */

#if TLS_INFO_SIZE > PIPE_BUF
# if PIPE_BUF < 512
#  error "PIPE_BUF < 512" /* non-POSIX */
# endif
# error "TLS_INFO_SIZE > PIPE_BUF"
#endif

/*****************************************************************************/

#ifdef TLS_APP
# include TLS_APP
#endif

/* Applications can define:
 *   TLS_APP_PROCESS_INIT -- void ...(int fd, int client_p, void *apparg)
 *   TLS_CUMULATE_ERRORS 
 *   TLS_ERROR_BUFSIZ
 *   TLS_APP_ERRFLUSH -- void ...(int child_p, char *, size_t, void *apparg)
 */

#ifndef TLS_APP_PROCESS_INIT
# define TLS_APP_PROCESS_INIT(fd, client_p, apparg) ((void) 0)
#endif

#ifndef TLS_ERROR_BUFSIZ
# define TLS_ERROR_BUFSIZ (10*160)
#endif
#if TLS_ERROR_BUFSIZ < 2 /* {'\n',0} */
# error "TLS_ERROR_BUFSIZE is too small."
#endif

#ifndef TLS_APP_ERRFLUSH
# define TLS_APP_ERRFLUSH tls_app_errflush
static void
tls_app_errflush(int child_p, char *errbuf, size_t num, void *apparg)
{
    fputs(errbuf, stderr);
}
#endif

/*****************************************************************************/

#ifdef DEBUG_TLS
# define DEBUG_MSG(x) fprintf(stderr,"  %s\n",x)
# define DEBUG_MSG2(x,y) fprintf(stderr, "  %s: %d\n",x,y)
static int tls_loop_count = 0;
static int tls_select_count = 0;
#else
# define DEBUG_MSG(x) (void)0
# define DEBUG_MSG2(x,y) (void)0
#endif

static void tls_rand_seed_uniquely(void);
static void tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, int client_p);
static int tls_socket_nonblocking(int fd);

static int tls_child_p = 0;
static void *tls_child_apparg;


struct tls_start_proxy_args
tls_start_proxy_defaultargs(void)
{
    struct tls_start_proxy_args ret;

    ret.fd = -1;
    ret.client_p = -1;
    ret.ctx = NULL;
    ret.pid = NULL;
    ret.infofd = NULL;
    
    return ret;
}

/* Slice in TLS proxy process at fd.
 * Return value:
 *   0    ok  (*pid is set to child's PID if pid != NULL),
 *   < 0  look at errno
 *   > 0  other error
 *   (return value encodes place of error)
 *
 */
int
tls_start_proxy(struct tls_start_proxy_args a, void *apparg)
{
    int fds[2] = {-1, -1};
    int infofds[2] = {-1, -1};
    int r, getfd, getfl;
    int ret;

    DEBUG_MSG2("tls_start_proxy fd", a.fd);
    DEBUG_MSG2("tls_start_proxy client_p", a.client_p);

    if (a.fd == -1 || a.client_p == -1 || a.ctx == NULL)
	return 1;

    if (a.pid != NULL) {
	*a.pid = 0;
    }
    if (a.infofd != NULL) {
	*a.infofd = -1;
    }

    r = socketpair(AF_UNIX, SOCK_STREAM, 0, fds);
    if (r == -1)
	return -1;
    if (a.fd >= FD_SETSIZE || fds[0] >= FD_SETSIZE) {
	ret = 2;
	goto err;
    }
    if (a.infofd != NULL) {
	r = pipe(infofds);
	if (r == -1) {
	    ret = -3;
	    goto err;
	}
    }

    r = fork();
    if (r == -1) {
	ret = -4;
	goto err;
    }
    if (r == 0) {
	DEBUG_MSG("fork");
	tls_child_p = 1;
	tls_child_apparg = apparg;
	close(fds[1]);
	if (infofds[0] != -1)
	    close(infofds[0]);
	TLS_APP_PROCESS_INIT(a.fd, a.client_p, apparg);
	DEBUG_MSG("TLS_APP_PROCESS_INIT");
	tls_proxy(fds[0], a.fd, infofds[1], a.ctx, a.client_p);
	exit(0);
    }
    if (a.pid != NULL)
	*a.pid = r;
    if (infofds[1] != -1) {
	close(infofds[1]);
	infofds[1] = -1;
    }
    /* install fds[1] in place of fd: */
    close(fds[0]);
    fds[0] = -1;
    getfd = fcntl(a.fd, F_GETFD);
    getfl = fcntl(a.fd, F_GETFL);
    r = dup2(fds[1], a.fd);
    close(fds[1]);
    fds[1] = -1;
    if (r == -1) {
	ret = -5;
	goto err;
    }
    if (getfd != 1)
	fcntl(a.fd, F_SETFD, getfd);
    if (getfl & O_NONBLOCK)
	(void)tls_socket_nonblocking(a.fd);
    if (a.infofd != NULL)
	*a.infofd = infofds[0];
    return 0;
    
  err:
    if (fds[0] != -1)
	close(fds[0]);
    if (fds[1] != -1)
	close(fds[1]);
    if (infofds[0] != -1)
	close(infofds[0]);
    if (infofds[1] != -1)
	close(infofds[1]);
    return ret;
}

/*****************************************************************************/

static char errbuf[TLS_ERROR_BUFSIZ];
static size_t errbuf_i = 0;

static void
tls_errflush(void *apparg)
{
    if (errbuf_i == 0)
	return;
    
    assert(errbuf_i < sizeof errbuf);
    assert(errbuf[errbuf_i] == 0);
    if (errbuf_i == sizeof errbuf - 1) {
	/* make sure we have a newline, even if string has been truncated */
	errbuf[errbuf_i - 1] = '\n';
    }

    /* TLS_APP_ERRFLUSH may modify the string as needed,
     * e.g. substitute other characters for \n for convenience */
    TLS_APP_ERRFLUSH(tls_child_p, errbuf, errbuf_i, apparg);

    errbuf_i = 0;
}

static void
tls_errprintf(int flush, void *apparg, const char *fmt, ...)
{
    va_list args;
    int r;
    
    if (errbuf_i < sizeof errbuf - 1) {
	size_t n;

	va_start(args, fmt);
	n = (sizeof errbuf) - errbuf_i;
	r = vsnprintf(errbuf + errbuf_i, n, fmt, args);
	if (r >= n)
	    r = n - 1;
	if (r >= 0) {
	    errbuf_i += r;
	} else {
	    errbuf_i = sizeof errbuf - 1;
	    errbuf[errbuf_i] = '\0';
	}
	assert(errbuf_i < sizeof errbuf);
	assert(errbuf[errbuf_i] == 0);
    }
#ifndef TLS_CUMULATE_ERRORS
    tls_errflush(apparg);
#else
    if (flush)
	tls_errflush(apparg);
#endif
}

/* app_prefix.. are for additional information provided by caller.
 * If OpenSSL error queue is empty, print default_text ("???" if NULL).
 */
static char *
tls_openssl_errors(const char *app_prefix_1, const char *app_prefix_2, const char *default_text, void *apparg)
{
    static char reasons[255];
    size_t reasons_i;
    unsigned long err;
    const char *file;
    int line;
    const char *data;
    int flags;
    char *errstring;
    int printed_something = 0;
    
    reasons_i = 0;

    assert(app_prefix_1 != NULL);
    assert(app_prefix_2 != NULL);

    if (default_text == NULL)
	default_text = "?""?""?";
    
    while ((err = ERR_get_error_line_data(&file,&line,&data,&flags)) != 0) {
	if (reasons_i < sizeof reasons) {
	    size_t n;
	    int r;

	    n = (sizeof reasons) - reasons_i;
	    r = snprintf(reasons + reasons_i, n, "%s%s", (reasons_i > 0 ? ", " : ""), ERR_reason_error_string(err));
	    if (r >= n)
		r = n - 1;
	    if (r >= 0) {
		reasons_i += r;
	    } else {
		reasons_i = sizeof reasons;
	    }
	    assert(reasons_i <= sizeof reasons);
	}
	
	errstring = ERR_error_string(err, NULL);
	assert(errstring != NULL);
	tls_errprintf(0, apparg, "OpenSSL error%s%s: %s:%s:%d:%s\n", app_prefix_1, app_prefix_2, errstring, file, line, (flags & ERR_TXT_STRING) ? data : "");
	printed_something = 1;
    }

    if (!printed_something) {
	assert(reasons_i == 0);
	snprintf(reasons, sizeof reasons, "%s", default_text);
	tls_errprintf(0, apparg, "OpenSSL error%s%s: %s\n", app_prefix_1, app_prefix_2, default_text);
    }

#ifdef TLS_CUMULATE_ERRORS    
    tls_errflush(apparg);
#endif
    assert(errbuf_i == 0);

    return reasons;
}

/*****************************************************************************/

static int tls_init_done = 0;

static int
tls_init(void *apparg)
{
    if (tls_init_done)
	return 0;
    
    SSL_load_error_strings();