The Tcpdump Group git mirrors - libpcap/blob - sslutils.c

   1 /*
   2  * Copyright (c) 2002 - 2003
   3  * NetGroup, Politecnico di Torino (Italy)
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  * notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  * notice, this list of conditions and the following disclaimer in the
  14  * documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the Politecnico di Torino nor the names of its
  16  * contributors may be used to endorse or promote products derived from
  17  * this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  22  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  23  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  24  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  25  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  29  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30  *
  31  */
  32
  33 #ifdef HAVE_CONFIG_H
  34 #include <config.h>
  35 #endif
  36
  37 #ifdef HAVE_OPENSSL
  38 #include <stdlib.h>
  39
  40 #include "portability.h"
  41
  42 #include "sslutils.h"
  43
  44 static const char *ssl_keyfile = "";   //!< file containing the private key in PEM format
  45 static const char *ssl_certfile = "";  //!< file containing the server's certificate in PEM format
  46 static const char *ssl_rootfile = "";  //!< file containing the list of CAs trusted by the client
  47 // TODO: a way to set ssl_rootfile from the command line, or an envvar?
  48
  49 // TODO: lock?
  50 static SSL_CTX *ctx;
  51
  52 void ssl_set_certfile(const char *certfile)
  53 {
  54         ssl_certfile = certfile;
  55 }
  56
  57 void ssl_set_keyfile(const char *keyfile)
  58 {
  59         ssl_keyfile = keyfile;
  60 }
  61
  62 #ifdef _MSC_VER
  63 #pragma message("OPENSSL_VERSION_MAJOR is " _CRT_STRINGIZE(OPENSSL_VERSION_MAJOR))
  64 #endif
  65 #ifdef _MSC_VER
  66 #pragma message("OPENSSL_VERSION_MINOR is " _CRT_STRINGIZE(OPENSSL_VERSION_MINOR))
  67 #endif
  68 #ifdef _MSC_VER
  69 #pragma message("OPENSSL_VERSION_PATCH is " _CRT_STRINGIZE(OPENSSL_VERSION_PATCH))
  70 #endif
  71 #ifdef _MSC_VER
  72 #pragma message("OPENSSL_VERSION_PRE_RELEASE is " _CRT_STRINGIZE(OPENSSL_VERSION_PRE_RELEASE))
  73 #endif
  74 #ifdef _MSC_VER
  75 #pragma message("OPENSSL_VERSION_NUMBER is " _CRT_STRINGIZE(OPENSSL_VERSION_NUMBER))
  76 #endif
  77
  78 int ssl_init_once(int is_server, int enable_compression, char *errbuf, size_t errbuflen)
  79 {
  80         static int inited = 0;
  81         if (inited) return 0;
  82
  83         /*
  84          * Avoid deprecated routines, even if they're still documented,
  85          * as random versions of OpenSSL might not make them available.
  86          * XXX - what's the minimum OpenSSL version we should support?
  87          * And what about libressl?
  88          */
  89 #if defined(OPENSSL_VERSION_NUMBER) >= 0x10100000L
  90         /* 1.1.0 or later */
  91         OPENSSL_init_ssl(0, NULL);
  92         OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
  93 #else
  94         SSL_library_init();
  95         SSL_load_error_strings();
  96 #endif
  97         OpenSSL_add_ssl_algorithms();
  98         if (enable_compression)
  99                 SSL_COMP_get_compression_methods();
 100
 101 #if defined(OPENSSL_VERSION_NUMBER) >= 0x10100000L
 102         /* 1.1.0 or later */
 103         SSL_METHOD const *meth =
 104             is_server ? TLS_server_method() : TLS_client_method();
 105 #else
 106         SSL_METHOD const *meth =
 107             is_server ? SSLv23_server_method() : SSLv23_client_method();
 108 #endif
 109         ctx = SSL_CTX_new(meth);
 110         if (! ctx)
 111         {
 112                 snprintf(errbuf, errbuflen, "Cannot get a new SSL context: %s", ERR_error_string(ERR_get_error(), NULL));
 113                 goto die;
 114         }
 115
 116         SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
 117
 118         if (is_server)
 119         {
 120                 char const *certfile = ssl_certfile[0] ? ssl_certfile : "cert.pem";
 121                 if (1 != SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM))
 122                 {
 123                         snprintf(errbuf, errbuflen, "Cannot read certificate file %s: %s", certfile, ERR_error_string(ERR_get_error(), NULL));
 124                         goto die;
 125                 }
 126
 127                 char const *keyfile = ssl_keyfile[0] ? ssl_keyfile : "key.pem";
 128                 if (1 != SSL_CTX_use_PrivateKey_file(ctx, keyfile, SSL_FILETYPE_PEM))
 129                 {
 130                         snprintf(errbuf, errbuflen, "Cannot read private key file %s: %s", keyfile, ERR_error_string(ERR_get_error(), NULL));
 131                         goto die;
 132                 }
 133         }
 134         else
 135         {
 136                 if (ssl_rootfile[0])
 137                 {
 138                         if (! SSL_CTX_load_verify_locations(ctx, ssl_rootfile, 0))
 139                         {
 140                                 snprintf(errbuf, errbuflen, "Cannot read CA list from %s", ssl_rootfile);
 141                                 goto die;
 142                         }
 143                 }
 144                 else
 145                 {
 146                         SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
 147                 }
 148         }
 149
 150 #if 0
 151         if (! RAND_load_file(RANDOM, 1024*1024))
 152         {
 153                 snprintf(errbuf, errbuflen, "Cannot init random");
 154                 goto die;
 155         }
 156
 157         if (is_server)
 158         {
 159                 SSL_CTX_set_session_id_context(ctx, (void *)&s_server_session_id_context, sizeof(s_server_session_id_context));
 160         }
 161 #endif
 162
 163         inited = 1;
 164         return 0;
 165
 166 die:
 167         return -1;
 168 }
 169
 170 SSL *ssl_promotion(int is_server, SOCKET s, char *errbuf, size_t errbuflen)
 171 {
 172         if (ssl_init_once(is_server, 1, errbuf, errbuflen) < 0) {
 173                 return NULL;
 174         }
 175
 176         SSL *ssl = SSL_new(ctx); // TODO: also a DTLS context
 177         SSL_set_fd(ssl, (int)s);
 178
 179         if (is_server) {
 180                 if (SSL_accept(ssl) <= 0) {
 181                         snprintf(errbuf, errbuflen, "SSL_accept(): %s",
 182                                         ERR_error_string(ERR_get_error(), NULL));
 183                         return NULL;
 184                 }
 185         } else {
 186                 if (SSL_connect(ssl) <= 0) {
 187                         snprintf(errbuf, errbuflen, "SSL_connect(): %s",
 188                                         ERR_error_string(ERR_get_error(), NULL));
 189                         return NULL;
 190                 }
 191         }
 192
 193         return ssl;
 194 }
 195
 196 // Finish using an SSL handle; shut down the connection and free the
 197 // handle.
 198 void ssl_finish(SSL *ssl)
 199 {
 200         //
 201         // We won't be using this again, so we can just send the
 202         // shutdown alert and free up the handle, and have our
 203         // caller close the socket.
 204         //
 205         // XXX - presumably, if the connection is shut down on
 206         // our side, either our peer won't have a problem sending
 207         // their shutdown alert or will not treat such a problem
 208         // as an error.  If this causes errors to be reported,
 209         // fix that as appropriate.
 210         //
 211         SSL_shutdown(ssl);
 212         SSL_free(ssl);
 213 }
 214
 215 // Same return value as sock_send:
 216 // 0 on OK, -1 on error but closed connection (-2).
 217 int ssl_send(SSL *ssl, char const *buffer, int size, char *errbuf, size_t errbuflen)
 218 {
 219         int status = SSL_write(ssl, buffer, size);
 220         if (status > 0)
 221         {
 222                 // "SSL_write() will only return with success, when the complete contents (...) has been written."
 223                 return 0;
 224         }
 225         else
 226         {
 227                 int ssl_err = SSL_get_error(ssl, status); // TODO: does it pop the error?
 228                 if (ssl_err == SSL_ERROR_ZERO_RETURN)
 229                 {
 230                         return -2;
 231                 }
 232                 else if (ssl_err == SSL_ERROR_SYSCALL)
 233                 {
 234 #ifndef _WIN32
 235                         if (errno == ECONNRESET || errno == EPIPE) return -2;
 236 #endif
 237                 }
 238                 snprintf(errbuf, errbuflen, "SSL_write(): %s",
 239                     ERR_error_string(ERR_get_error(), NULL));
 240                 return -1;
 241         }
 242 }
 243
 244 // Returns the number of bytes read, or -1 on syserror, or -2 on SSL error.
 245 int ssl_recv(SSL *ssl, char *buffer, int size, char *errbuf, size_t errbuflen)
 246 {
 247         int status = SSL_read(ssl, buffer, size);
 248         if (status <= 0)
 249         {
 250                 int ssl_err = SSL_get_error(ssl, status);
 251                 if (ssl_err == SSL_ERROR_ZERO_RETURN)
 252                 {
 253                         return 0;
 254                 }
 255                 else if (ssl_err == SSL_ERROR_SYSCALL)
 256                 {
 257                         return -1;
 258                 }
 259                 else
 260                 {
 261                         // Should not happen
 262                         snprintf(errbuf, errbuflen, "SSL_read(): %s",
 263                             ERR_error_string(ERR_get_error(), NULL));
 264                         return -2;
 265                 }
 266         }
 267         else
 268         {
 269                 return status;
 270         }
 271 }
 272
 273 #endif // HAVE_OPENSSL