ustream-polarssl.c

   1 /*
   2  * ustream-ssl - library for SSL over ustream
   3  *
   4  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <sys/types.h>
  20 #include <fcntl.h>
  21 #include <unistd.h>
  22 #include <stdlib.h>
  23
  24 #include "ustream-ssl.h"
  25 #include "ustream-internal.h"
  26
  27 static int urandom_fd = -1;
  28
  29 static int s_ustream_read(void *ctx, unsigned char *buf, size_t len)
  30 {
  31         struct ustream *s = ctx;
  32         char *sbuf;
  33         int slen;
  34
  35         if (s->eof)
  36                 return 0;
  37
  38         sbuf = ustream_get_read_buf(s, &slen);
  39         if (slen > len)
  40                 slen = len;
  41
  42         if (!slen)
  43                 return POLARSSL_ERR_NET_WANT_READ;
  44
  45         memcpy(buf, sbuf, slen);
  46         ustream_consume(s, slen);
  47
  48         return slen;
  49 }
  50
  51 static int s_ustream_write(void *ctx, const unsigned char *buf, size_t len)
  52 {
  53         struct ustream *s = ctx;
  54
  55         len = ustream_write(s, (const char *) buf, len, false);
  56         if (len < 0 || s->write_error)
  57                 return POLARSSL_ERR_NET_SEND_FAILED;
  58
  59         return len;
  60 }
  61
  62 __hidden void ustream_set_io(void *ctx, void *ssl, struct ustream *conn)
  63 {
  64         ssl_set_bio(ssl, s_ustream_read, conn, s_ustream_write, conn);
  65 }
  66
  67 static bool urandom_init(void)
  68 {
  69         if (urandom_fd > -1)
  70                 return true;
  71
  72         urandom_fd = open("/dev/urandom", O_RDONLY);
  73         if (urandom_fd < 0)
  74                 return false;
  75
  76         return true;
  77 }
  78
  79 static int _urandom(void *ctx, unsigned char *out, size_t len)
  80 {
  81         read(urandom_fd, out, len);
  82         return 0;
  83 }
  84
  85 __hidden void * __ustream_ssl_context_new(bool server)
  86 {
  87         struct ustream_polarssl_ctx *uctx;
  88
  89         if (!urandom_init())
  90                 return NULL;
  91
  92         uctx = calloc(1, sizeof(*uctx));
  93         if (!uctx)
  94                 return NULL;
  95
  96         uctx->server = server;
  97 #ifdef USE_VERSION_1_3
  98         pk_init(&uctx->key);
  99 #else
 100         rsa_init(&uctx->key, RSA_PKCS_V15, 0);
 101 #endif
 102
 103         return uctx;
 104 }
 105
 106 __hidden int __ustream_ssl_set_crt_file(void *ctx, const char *file)
 107 {
 108         struct ustream_polarssl_ctx *uctx = ctx;
 109         int ret;
 110
 111 #ifdef USE_VERSION_1_3
 112         ret = x509_crt_parse_file(&uctx->cert, file);
 113 #else
 114         ret = x509parse_crtfile(&uctx->cert, file);
 115 #endif
 116         if (ret)
 117                 return -1;
 118
 119         return 0;
 120 }
 121
 122 __hidden int __ustream_ssl_set_key_file(void *ctx, const char *file)
 123 {
 124         struct ustream_polarssl_ctx *uctx = ctx;
 125         int ret;
 126
 127 #ifdef USE_VERSION_1_3
 128         ret = pk_parse_keyfile(&uctx->key, file, NULL);
 129 #else
 130         ret = x509parse_keyfile(&uctx->key, file, NULL);
 131 #endif
 132         if (ret)
 133                 return -1;
 134
 135         return 0;
 136 }
 137
 138 __hidden void __ustream_ssl_context_free(void *ctx)
 139 {
 140         struct ustream_polarssl_ctx *uctx = ctx;
 141
 142 #ifdef USE_VERSION_1_3
 143         pk_free(&uctx->key);
 144         x509_crt_free(&uctx->cert);
 145 #else
 146         rsa_free(&uctx->key);
 147         x509_free(&uctx->cert);
 148 #endif
 149         free(ctx);
 150 }
 151
 152 static void ustream_ssl_error(struct ustream_ssl *us, int ret)
 153 {
 154         us->error = ret;
 155         uloop_timeout_set(&us->error_timer, 0);
 156 }
 157
 158 static bool ssl_do_wait(int ret)
 159 {
 160         switch(ret) {
 161         case POLARSSL_ERR_NET_WANT_READ:
 162         case POLARSSL_ERR_NET_WANT_WRITE:
 163                 return true;
 164         default:
 165                 return false;
 166         }
 167 }
 168
 169 __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 170 {
 171         void *ssl = us->ssl;
 172         int r;
 173
 174         r = ssl_handshake(ssl);
 175         if (r == 0)
 176                 return U_SSL_OK;
 177
 178         if (ssl_do_wait(r))
 179                 return U_SSL_PENDING;
 180
 181         ustream_ssl_error(us, r);
 182         return U_SSL_ERROR;
 183 }
 184
 185 __hidden int __ustream_ssl_write(struct ustream_ssl *us, const char *buf, int len)
 186 {
 187         void *ssl = us->ssl;
 188         int ret = ssl_write(ssl, (const unsigned char *) buf, len);
 189
 190         if (ret < 0) {
 191                 if (ssl_do_wait(ret))
 192                         return 0;
 193
 194                 ustream_ssl_error(us, ret);
 195                 return -1;
 196         }
 197
 198         return ret;
 199 }
 200
 201 __hidden int __ustream_ssl_read(struct ustream_ssl *us, char *buf, int len)
 202 {
 203         int ret = ssl_read(us->ssl, (unsigned char *) buf, len);
 204
 205         if (ret < 0) {
 206                 if (ssl_do_wait(ret))
 207                         return U_SSL_PENDING;
 208
 209                 ustream_ssl_error(us, ret);
 210                 return U_SSL_ERROR;
 211         }
 212
 213         return ret;
 214 }
 215
 216 static const int default_ciphersuites[] =
 217 {
 218 #if defined(POLARSSL_AES_C)
 219 #if defined(POLARSSL_SHA2_C)
 220     TLS_RSA_WITH_AES_256_CBC_SHA256,
 221 #endif /* POLARSSL_SHA2_C */
 222 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C)
 223     TLS_RSA_WITH_AES_256_GCM_SHA384,
 224 #endif /* POLARSSL_SHA2_C */
 225     TLS_RSA_WITH_AES_256_CBC_SHA,
 226 #endif
 227 #if defined(POLARSSL_CAMELLIA_C)
 228 #if defined(POLARSSL_SHA2_C)
 229     TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
 230 #endif /* POLARSSL_SHA2_C */
 231     TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
 232 #endif
 233 #if defined(POLARSSL_AES_C)
 234 #if defined(POLARSSL_SHA2_C)
 235     TLS_RSA_WITH_AES_128_CBC_SHA256,
 236 #endif /* POLARSSL_SHA2_C */
 237 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
 238     TLS_RSA_WITH_AES_128_GCM_SHA256,
 239 #endif /* POLARSSL_SHA2_C */
 240     TLS_RSA_WITH_AES_128_CBC_SHA,
 241 #endif
 242 #if defined(POLARSSL_CAMELLIA_C)
 243 #if defined(POLARSSL_SHA2_C)
 244     TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
 245 #endif /* POLARSSL_SHA2_C */
 246     TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
 247 #endif
 248 #if defined(POLARSSL_DES_C)
 249     TLS_RSA_WITH_3DES_EDE_CBC_SHA,
 250 #endif
 251 #if defined(POLARSSL_ARC4_C)
 252     TLS_RSA_WITH_RC4_128_SHA,
 253     TLS_RSA_WITH_RC4_128_MD5,
 254 #endif
 255     0
 256 };
 257
 258 __hidden void *__ustream_ssl_session_new(void *ctx)
 259 {
 260         struct ustream_polarssl_ctx *uctx = ctx;
 261         ssl_context *ssl;
 262         int ep, auth;
 263
 264         ssl = calloc(1, sizeof(ssl_context));
 265         if (!ssl)
 266                 return NULL;
 267
 268         if (ssl_init(ssl)) {
 269                 free(ssl);
 270                 return NULL;
 271         }
 272
 273         if (uctx->server) {
 274                 ep = SSL_IS_SERVER;
 275                 auth = SSL_VERIFY_NONE;
 276         } else {
 277                 ep = SSL_IS_CLIENT;
 278                 auth = SSL_VERIFY_OPTIONAL;
 279         }
 280
 281         ssl_set_ciphersuites(ssl, default_ciphersuites);
 282         ssl_set_endpoint(ssl, ep);
 283         ssl_set_authmode(ssl, auth);
 284         ssl_set_rng(ssl, _urandom, NULL);
 285
 286         if (uctx->server) {
 287                 if (uctx->cert.next)
 288                         ssl_set_ca_chain(ssl, uctx->cert.next, NULL, NULL);
 289                 ssl_set_own_cert(ssl, &uctx->cert, &uctx->key);
 290         }
 291
 292         ssl_session_reset(ssl);
 293
 294         return ssl;
 295 }
 296
 297 __hidden void __ustream_ssl_session_free(void *ssl)
 298 {
 299         ssl_free(ssl);
 300         free(ssl);
 301 }