ustream-ssl: add support for using a fd instead of ustream as backing

[project/ustream-ssl.git] / ustream-openssl.c

diff --git a/ustream-openssl.c b/ustream-openssl.c
index 9b4ac6c8089449e63ded2cd1410c1cfef15616a7..b080081c172ffc14786ef61b8e5c1e197b4e3003 100644 (file)
--- a/ustream-openssl.c
+++ b/ustream-openssl.c
@@ -25,6 +25,10 @@
 #include <openssl/x509v3.h>
 #endif
 
+#if defined(HAVE_WOLFSSL) && defined(DEBUG)
+#include <wolfssl/test.h>
+#endif
+
 /* Ciphersuite preference:
  * - for server, no weak ciphers are used if you use an ECDSA key.
  * - forward-secret (pfs), authenticated (AEAD) ciphers are at the top:
@@ -102,6 +106,7 @@
 __hidden struct ustream_ssl_ctx *
 __ustream_ssl_context_new(bool server)
 {
+       struct ustream_ssl_ctx *ctx;
        const void *m;
        SSL_CTX *c;
 
@@ -130,6 +135,9 @@ __ustream_ssl_context_new(bool server)
        if (!c)
                return NULL;
 
+       ctx = calloc(1, sizeof(*ctx));
+       ctx->ssl = c;
+
 #if defined(HAVE_WOLFSSL)
        if (server)
                SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
@@ -153,20 +161,26 @@ __ustream_ssl_context_new(bool server)
                SSL_CTX_set_options(c, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 |
                                       SSL_OP_NO_TLSv1_1);
 #endif
+#if defined(HAVE_WOLFSSL)
+               SSL_CTX_set_options(c, SSL_AD_NO_RENEGOTIATION);
+#else
+               SSL_CTX_set_options(c, SSL_OP_NO_RENEGOTIATION);
+#endif
+
                SSL_CTX_set_cipher_list(c, server_cipher_list);
        } else {
                SSL_CTX_set_cipher_list(c, client_cipher_list);
        }
        SSL_CTX_set_quiet_shutdown(c, 1);
 
-       return (void *) c;
+       return ctx;
 }
 
 __hidden int __ustream_ssl_add_ca_crt_file(struct ustream_ssl_ctx *ctx, const char *file)
 {
        int ret;
 
-       ret = SSL_CTX_load_verify_locations((void *) ctx, file, NULL);
+       ret = SSL_CTX_load_verify_locations(ctx->ssl, file, NULL);
        if (ret < 1)
                return -1;
 
@@ -177,9 +191,9 @@ __hidden int __ustream_ssl_set_crt_file(struct ustream_ssl_ctx *ctx, const char
 {
        int ret;
 
-       ret = SSL_CTX_use_certificate_chain_file((void *) ctx, file);
+       ret = SSL_CTX_use_certificate_chain_file(ctx->ssl, file);
        if (ret < 1)
-               ret = SSL_CTX_use_certificate_file((void *) ctx, file, SSL_FILETYPE_ASN1);
+               ret = SSL_CTX_use_certificate_file(ctx->ssl, file, SSL_FILETYPE_ASN1);
 
        if (ret < 1)
                return -1;
@@ -191,9 +205,9 @@ __hidden int __ustream_ssl_set_key_file(struct ustream_ssl_ctx *ctx, const char
 {
        int ret;
 
-       ret = SSL_CTX_use_PrivateKey_file((void *) ctx, file, SSL_FILETYPE_PEM);
+       ret = SSL_CTX_use_PrivateKey_file(ctx->ssl, file, SSL_FILETYPE_PEM);
        if (ret < 1)
-               ret = SSL_CTX_use_PrivateKey_file((void *) ctx, file, SSL_FILETYPE_ASN1);
+               ret = SSL_CTX_use_PrivateKey_file(ctx->ssl, file, SSL_FILETYPE_ASN1);
 
        if (ret < 1)
                return -1;
@@ -203,7 +217,7 @@ __hidden int __ustream_ssl_set_key_file(struct ustream_ssl_ctx *ctx, const char
 
 __hidden int __ustream_ssl_set_ciphers(struct ustream_ssl_ctx *ctx, const char *ciphers)
 {
-       int ret = SSL_CTX_set_cipher_list((void *) ctx, ciphers);
+       int ret = SSL_CTX_set_cipher_list(ctx->ssl, ciphers);
 
        if (ret == 0)
                return -1;
@@ -218,23 +232,31 @@ __hidden int __ustream_ssl_set_require_validation(struct ustream_ssl_ctx *ctx, b
        if (!require)
                mode = SSL_VERIFY_NONE;
 
-       SSL_CTX_set_verify((void *) ctx, mode, NULL);
+       SSL_CTX_set_verify(ctx->ssl, mode, NULL);
 
        return 0;
 }
 
 __hidden void __ustream_ssl_context_free(struct ustream_ssl_ctx *ctx)
 {
-       SSL_CTX_free((void *) ctx);
+       SSL_CTX_free(ctx->ssl);
+       if (ctx->debug_bio)
+               BIO_free(ctx->debug_bio);
+       free(ctx);
 }
 
-void __ustream_ssl_session_free(void *ssl)
+__hidden void __ustream_ssl_session_free(struct ustream_ssl *us)
 {
-       BIO *bio = SSL_get_wbio(ssl);
-       struct bio_ctx *ctx = BIO_get_data(bio);
+       BIO *bio = SSL_get_wbio(us->ssl);
+       struct bio_ctx *ctx;
+
+       SSL_shutdown(us->ssl);
+       SSL_free(us->ssl);
 
-       SSL_shutdown(ssl);
-       SSL_free(ssl);
+       if (!us->conn)
+               return;
+
+       ctx = BIO_get_data(bio);
        if (ctx) {
                BIO_meth_free(ctx->meth);
                free(ctx);
@@ -247,8 +269,6 @@ static void ustream_ssl_error(struct ustream_ssl *us, int ret)
        uloop_timeout_set(&us->error_timer, 0);
 }
 
-#ifndef NO_X509_CHECK_HOST
-
 static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 {
        int ret;
@@ -264,14 +284,16 @@ static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
        return ret == 1;
 }
 
-#endif
-
 static void ustream_ssl_verify_cert(struct ustream_ssl *us)
 {
        void *ssl = us->ssl;
        X509 *cert;
        int res;
 
+#if defined(HAVE_WOLFSSL) && defined(DEBUG)
+       showPeer(ssl);
+#endif
+
        res = SSL_get_verify_result(ssl);
        if (res != X509_V_OK) {
                if (us->notify_verify_error)
@@ -284,9 +306,8 @@ static void ustream_ssl_verify_cert(struct ustream_ssl *us)
                return;
 
        us->valid_cert = true;
-#ifndef NO_X509_CHECK_HOST
        us->valid_cn = ustream_ssl_verify_cn(us, cert);
-#endif
+
        X509_free(cert);
 }
 
@@ -313,7 +334,9 @@ static bool handle_wolfssl_asn_error(struct ustream_ssl *us, int r)
        case ASN_SIG_HASH_E:
        case ASN_SIG_KEY_E:
        case ASN_DH_KEY_E:
+#if LIBWOLFSSL_VERSION_HEX < 0x05000000
        case ASN_NTRU_KEY_E:
+#endif
        case ASN_CRIT_EXT_E:
        case ASN_ALT_NAME_E:
        case ASN_NO_PEM_HEADER:
@@ -409,3 +432,61 @@ __hidden int __ustream_ssl_read(struct ustream_ssl *us, char *buf, int len)
 
        return ret;
 }
+
+#ifndef WOLFSSL_SSL_H
+static long
+debug_cb(BIO *bio, int cmd, const char *argp, size_t len, int argi, long argl,
+        int ret, size_t *processed)
+{
+       struct ustream_ssl_ctx *ctx = (void *)BIO_get_callback_arg(bio);
+       char buf[256];
+       char *str, *sep;
+       ssize_t cur_len;
+
+       if (cmd != (BIO_CB_WRITE|BIO_CB_RETURN))
+           goto out;
+
+       while (1) {
+               cur_len = BIO_get_mem_data(bio, (void *)&str);
+               if (!cur_len)
+                       break;
+
+               sep = memchr(str, '\n', cur_len);
+               if (!sep)
+                       break;
+
+               cur_len = sep + 1 - str;
+               if (cur_len >= (ssize_t)sizeof(buf))
+                       cur_len = sizeof(buf) - 1;
+
+               cur_len = BIO_read(bio, buf, cur_len);
+               if (cur_len <= 1)
+                       break;
+
+               cur_len--;
+               buf[cur_len] = 0;
+               if (ctx->debug_cb)
+                       ctx->debug_cb(ctx->debug_cb_priv, 1, buf);
+       }
+
+out:
+       return ret;
+}
+#endif
+
+__hidden void __ustream_ssl_set_debug(struct ustream_ssl_ctx *ctx, int level,
+                                     ustream_ssl_debug_cb cb, void *cb_priv)
+{
+#ifndef WOLFSSL_SSL_H
+       if (!ctx->debug_bio)
+               ctx->debug_bio = BIO_new(BIO_s_mem());
+
+       ctx->debug_cb = cb;
+       ctx->debug_cb_priv = cb_priv;
+       SSL_CTX_set_msg_callback(ctx->ssl, SSL_trace);
+       SSL_CTX_set_msg_callback_arg(ctx->ssl, ctx->debug_bio);
+
+       BIO_set_callback_ex(ctx->debug_bio, debug_cb);
+       BIO_set_callback_arg(ctx->debug_bio, (void *)ctx);
+#endif
+}