The Tcpdump Group git mirrors - libpcap/blob - sslutils.c

   1 /*
   2  * Copyright (c) 2002 - 2003
   3  * NetGroup, Politecnico di Torino (Italy)
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  * notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  * notice, this list of conditions and the following disclaimer in the
  14  * documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the Politecnico di Torino nor the names of its
  16  * contributors may be used to endorse or promote products derived from
  17  * this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  22  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  23  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  24  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  25  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  29  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30  *
  31  */
  32
  33 #ifdef HAVE_CONFIG_H
  34 #include <config.h>
  35 #endif
  36
  37 #ifdef HAVE_OPENSSL
  38 #include <stdlib.h>
  39
  40 #include "portability.h"
  41 #include "sslutils.h"
  42 #include "pcap/pcap.h"
  43
  44 char ssl_keyfile[PATH_MAX]; //!< file containing the private key in PEM format
  45 char ssl_certfile[PATH_MAX];  //!< file containing the server's certificate in PEM format
  46 char ssl_rootfile[PATH_MAX];  //!< file containing the list of CAs trusted by the client
  47 // TODO: a way to set ssl_rootfile from the command line, or an envvar?
  48
  49 // TODO: lock?
  50 static SSL_CTX *ctx;
  51
  52 static int ssl_init_once(int is_server, int enable_compression, char *errbuf, size_t errbuflen)
  53 {
  54         static int inited = 0;
  55         if (inited) return 0;
  56
  57         SSL_library_init();
  58         SSL_load_error_strings();
  59         OpenSSL_add_ssl_algorithms();
  60         if (enable_compression)
  61                 SSL_COMP_get_compression_methods();
  62
  63         SSL_METHOD const *meth =
  64             is_server ? SSLv23_server_method() : SSLv23_client_method();
  65         ctx = SSL_CTX_new(meth);
  66         if (! ctx)
  67         {
  68                 pcap_snprintf(errbuf, errbuflen, "Cannot get a new SSL context: %s", ERR_error_string(ERR_get_error(), NULL));
  69                 goto die;
  70         }
  71
  72         SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
  73
  74         if (is_server)
  75         {
  76                 char const *certfile = ssl_certfile[0] ? ssl_certfile : "cert.pem";
  77                 if (1 != SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM))
  78                 {
  79                         pcap_snprintf(errbuf, errbuflen, "Cannot read certificate file %s: %s", certfile, ERR_error_string(ERR_get_error(), NULL));
  80                         goto die;
  81                 }
  82
  83                 char const *keyfile = ssl_keyfile[0] ? ssl_keyfile : "key.pem";
  84                 if (1 != SSL_CTX_use_PrivateKey_file(ctx, keyfile, SSL_FILETYPE_PEM))
  85                 {
  86                         pcap_snprintf(errbuf, errbuflen, "Cannot read private key file %s: %s", keyfile, ERR_error_string(ERR_get_error(), NULL));
  87                         goto die;
  88                 }
  89         }
  90         else
  91         {
  92                 if (ssl_rootfile[0])
  93                 {
  94                         if (! SSL_CTX_load_verify_locations(ctx, ssl_rootfile, 0))
  95                         {
  96                                 pcap_snprintf(errbuf, errbuflen, "Cannot read CA list from %s", ssl_rootfile);
  97                                 goto die;
  98                         }
  99                 }
 100                 else
 101                 {
 102                         SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
 103                 }
 104         }
 105
 106 #if 0
 107         if (! RAND_load_file(RANDOM, 1024*1024))
 108         {
 109                 pcap_snprintf(errbuf, errbuflen, "Cannot init random");
 110                 goto die;
 111         }
 112
 113         if (is_server)
 114         {
 115                 SSL_CTX_set_session_id_context(ctx, (void *)&s_server_session_id_context, sizeof(s_server_session_id_context));
 116         }
 117 #endif
 118
 119         inited = 1;
 120         return 0;
 121
 122 die:
 123         return -1;
 124 }
 125
 126 void init_ssl_or_die(int is_server, int enable_compression)
 127 {
 128         char errbuf[PCAP_ERRBUF_SIZE];
 129
 130         if (ssl_init_once(is_server, enable_compression, errbuf, sizeof errbuf) < 0)
 131         {
 132                 fprintf(stderr, "%s\n", errbuf);
 133                 exit(3);
 134         }
 135 }
 136
 137 SSL *ssl_promotion_rw(int is_server, SOCKET in, SOCKET out, char *errbuf, size_t errbuflen)
 138 {
 139         if (ssl_init_once(is_server, 1, errbuf, errbuflen) < 0) {
 140                 return NULL;
 141         }
 142
 143         SSL *ssl = SSL_new(ctx); // TODO: also a DTLS context
 144         SSL_set_rfd(ssl, in);
 145         SSL_set_wfd(ssl, out);
 146
 147         if (is_server) {
 148                 if (SSL_accept(ssl) <= 0) {
 149                         pcap_snprintf(errbuf, errbuflen, "SSL_accept(): %s",
 150                                         ERR_error_string(ERR_get_error(), NULL));
 151                         return NULL;
 152                 }
 153         } else {
 154                 if (SSL_connect(ssl) <= 0) {
 155                         pcap_snprintf(errbuf, errbuflen, "SSL_connect(): %s",
 156                                         ERR_error_string(ERR_get_error(), NULL));
 157                         return NULL;
 158                 }
 159         }
 160
 161         return ssl;
 162 }
 163
 164 SSL *ssl_promotion(int is_server, SOCKET s, char *errbuf, size_t errbuflen)
 165 {
 166         return ssl_promotion_rw(is_server, s, s, errbuf, errbuflen);
 167 }
 168
 169 // Same return value as sock_send:
 170 // 0 on OK, -1 on error but closed connection (-2).
 171 int ssl_send(SSL *ssl, char const *buffer, int size, char *errbuf, size_t errbuflen)
 172 {
 173         int status = SSL_write(ssl, buffer, size);
 174         if (status > 0)
 175         {
 176                 // "SSL_write() will only return with success, when the complete contents (...) has been written."
 177                 return 0;
 178         }
 179         else
 180         {
 181                 int ssl_err = SSL_get_error(ssl, status); // TODO: does it pop the error?
 182                 if (ssl_err == SSL_ERROR_ZERO_RETURN)
 183                 {
 184                         return -2;
 185                 }
 186                 else if (ssl_err == SSL_ERROR_SYSCALL)
 187                 {
 188 #ifndef _WIN32
 189                         if (errno == ECONNRESET || errno == EPIPE) return -2;
 190 #endif
 191                 }
 192                 pcap_snprintf(errbuf, errbuflen, "SSL_write(): %s",
 193                     ERR_error_string(ERR_get_error(), NULL));
 194                 return -1;
 195         }
 196 }
 197
 198 // Returns the number of bytes read, or -1 on syserror, or -2 on SSL error.
 199 int ssl_recv(SSL *ssl, char *buffer, int size, char *errbuf, size_t errbuflen)
 200 {
 201         int status = SSL_read(ssl, buffer, size);
 202         if (status <= 0)
 203         {
 204                 int ssl_err = SSL_get_error(ssl, status);
 205                 if (ssl_err == SSL_ERROR_ZERO_RETURN)
 206                 {
 207                         return 0;
 208                 }
 209                 else if (ssl_err == SSL_ERROR_SYSCALL)
 210                 {
 211                         return -1;
 212                 }
 213                 else
 214                 {
 215                         // Should not happen
 216                         pcap_snprintf(errbuf, errbuflen, "SSL_read(): %s",
 217                             ERR_error_string(ERR_get_error(), NULL));
 218                         return -2;
 219                 }
 220         }
 221         else
 222         {
 223                 return status;
 224         }
 225 }
 226
 227 #endif // HAVE_OPENSSL