[irc/rqf/shadowircd.git] / libratbox / src / gnutls.c

/*
 *  libratbox: a library used by ircd-ratbox and other things
 *  gnutls.c: gnutls related code
 *
 *  Copyright (C) 2007-2008 ircd-ratbox development team
 *  Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *  
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
 *  USA
 *
 *  $Id: gnutls.c 25568 2008-06-20 18:46:08Z androsyn $
 */

#include <libratbox_config.h>
#include <ratbox_lib.h>
#include <commio-int.h>
#include <commio-ssl.h>
#ifdef HAVE_GNUTLS

#include <gnutls/gnutls.h>
#include <gcrypt.h>

static gnutls_certificate_credentials x509;
static gnutls_dh_params dh_params;


#define SSL_P(x) *((gnutls_session_t *)F->ssl)

void
rb_ssl_shutdown(rb_fde_t * F)
{
	int i;
	if(F == NULL || F->ssl == NULL)
		return;
	for (i = 0; i < 4; i++)
	{
		if(gnutls_bye(SSL_P(F), GNUTLS_SHUT_RDWR) == GNUTLS_E_SUCCESS)
			break;
	}
	gnutls_deinit(SSL_P(F));
	rb_free(F->ssl);
}

unsigned int
rb_ssl_handshake_count(rb_fde_t *F)
{
	return F->handshake_count;
}

void
rb_ssl_clear_handshake_count(rb_fde_t *F)
{
	F->handshake_count = 0;
}

static void
rb_ssl_timeout(rb_fde_t * F, void *notused)
{
	lrb_assert(F->accept != NULL);
	F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
}


static int do_ssl_handshake(rb_fde_t *F, PF *callback)
{
	int ret;
	int flags;	

	ret = gnutls_handshake(SSL_P(F));
	if(ret < 0)
	{
		if((ret == GNUTLS_E_INTERRUPTED && rb_ignore_errno(errno)) || ret == GNUTLS_E_AGAIN)
		{
			if(gnutls_record_get_direction(SSL_P(F)) == 0)
				flags = RB_SELECT_READ;
			else
				flags = RB_SELECT_WRITE;
			rb_setselect(F, flags, callback, NULL);	
			return 0;
		}
		F->ssl_errno = ret;
		return -1;
	} 
	return 1; /* handshake is finished..go about life */
}

static void
rb_ssl_tryaccept(rb_fde_t * F, void *data)
{
	int ret;
	struct acceptdata *ad;

	lrb_assert(F->accept != NULL);

	ret = do_ssl_handshake(F, rb_ssl_tryaccept);
	
	switch(ret)
	{
		case -1:
			F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
			break;
		case 0:
			/* do_ssl_handshake does the rb_setselect stuff */
			return;
		default:
			break;			
			
	
	}
	rb_settimeout(F, 0, NULL, NULL);
	rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
	
	ad = F->accept;
	F->accept = NULL;
	ad->callback(F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen,
			    ad->data);
	rb_free(ad);

}

void
rb_ssl_start_accepted(rb_fde_t * new_F, ACCB * cb, void *data, int timeout)
{
	gnutls_session_t *ssl;
	new_F->type |= RB_FD_SSL;
	ssl = new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
	new_F->accept = rb_malloc(sizeof(struct acceptdata));
	
	new_F->accept->callback = cb;
	new_F->accept->data = data;
	rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);

	new_F->accept->addrlen = 0;

	gnutls_init(ssl, GNUTLS_SERVER);	
	gnutls_set_default_priority(*ssl);
	gnutls_credentials_set(*ssl, GNUTLS_CRD_CERTIFICATE, x509);
	gnutls_dh_set_prime_bits(*ssl, 1024);
	gnutls_transport_set_ptr(*ssl, (gnutls_transport_ptr_t) (long int)new_F->fd);
	if(do_ssl_handshake(new_F, rb_ssl_tryaccept))
	{
		struct acceptdata *ad = new_F->accept;
		new_F->accept = NULL;
		ad->callback(new_F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen, ad->data);
		rb_free(ad);	
	}

}


void
rb_ssl_accept_setup(rb_fde_t * F, int new_fd, struct sockaddr *st, int addrlen)
{
	rb_fde_t *new_F;

	new_F = rb_find_fd(new_fd);
	new_F->type |= RB_FD_SSL;
	new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
	new_F->accept = rb_malloc(sizeof(struct acceptdata));

	new_F->accept->callback = F->accept->callback;
	new_F->accept->data = F->accept->data;
	rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
	memcpy(&new_F->accept->S, st, addrlen);
	new_F->accept->addrlen = addrlen;

	gnutls_init((gnutls_session_t *)new_F->ssl, GNUTLS_SERVER);	
	gnutls_set_default_priority(SSL_P(new_F));
	gnutls_credentials_set(SSL_P(new_F), GNUTLS_CRD_CERTIFICATE, x509);
	gnutls_dh_set_prime_bits(SSL_P(new_F), 1024);
	gnutls_transport_set_ptr(SSL_P(new_F), (gnutls_transport_ptr_t) (long int)new_fd);
	if(do_ssl_handshake(F, rb_ssl_tryaccept))
	{
		struct acceptdata *ad = F->accept;
		F->accept = NULL;
		ad->callback(F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen, ad->data);
		rb_free(ad);	
	}
}


static ssize_t
rb_ssl_read_or_write(int r_or_w, rb_fde_t * F, void *rbuf, const void *wbuf, size_t count)
{
	ssize_t ret;
	gnutls_session_t *ssl = F->ssl;

	if(r_or_w == 0)
		ret = gnutls_record_recv(*ssl, rbuf, count);
	else
		ret = gnutls_record_send(*ssl, wbuf, count);

	if(ret < 0)
	{
		switch(ret)
		{
		case GNUTLS_E_AGAIN:
		case GNUTLS_E_INTERRUPTED:
			if(rb_ignore_errno(errno))
			{
				if(gnutls_record_get_direction(*ssl) == 0)
					return RB_RW_SSL_NEED_READ;
				else
					return RB_RW_SSL_NEED_WRITE;
				break;
			}
		default:
			F->ssl_errno = ret;
			errno = EIO;
			return RB_RW_IO_ERROR;
		}
	}
	return ret;
}

ssize_t
rb_ssl_read(rb_fde_t * F, void *buf, size_t count)
{
	return rb_ssl_read_or_write(0, F, buf, NULL, count);
}

ssize_t
rb_ssl_write(rb_fde_t * F, const void *buf, size_t count)
{
	return rb_ssl_read_or_write(1, F, NULL, buf, count);
}

static void
rb_gcry_random_seed(void *unused)
{
	gcry_fast_random_poll();
}

int
rb_init_ssl(void)
{
	gnutls_global_init();
	
	if(gnutls_certificate_allocate_credentials(&x509) != GNUTLS_E_SUCCESS)
	{
		rb_lib_log("rb_init_ssl: Unable to allocate SSL/TLS certificate credentials");
		return 0;
	}
	rb_event_addish("rb_gcry_random_seed", rb_gcry_random_seed, NULL, 300);
	return 1;
}

static void
rb_free_datum_t(gnutls_datum_t *d)
{
	rb_free(d->data);
	rb_free(d);
}

static gnutls_datum_t *
rb_load_file_into_datum_t(const char *file)
{
	FILE *f;
	gnutls_datum_t *datum;
	struct stat fileinfo;
	if((f = fopen(file, "r")) == NULL)
		return NULL;
	if(fstat(fileno(f), &fileinfo))
		return NULL;

	datum = rb_malloc(sizeof(gnutls_datum_t));

	if(fileinfo.st_size > 131072) /* deal with retards */
		datum->size = 131072;
	else
		datum->size = fileinfo.st_size;	
	
	datum->data = rb_malloc(datum->size + 1);
	fread(datum->data, datum->size, 1, f);
	fclose(f);
	return datum;	
}

int
rb_setup_ssl_server(const char *cert, const char *keyfile, const char *dhfile)
{
	int ret;
	gnutls_datum_t *d_cert, *d_key;
	if(cert == NULL)
	{
		rb_lib_log("rb_setup_ssl_server: No certificate file");
		return 0;
	}

	if((d_cert = rb_load_file_into_datum_t(cert)) == NULL)
	{
		rb_lib_log("rb_setup_ssl_server: Error loading certificate: %s", strerror(errno));
		return 0;
	}

	if((d_key = rb_load_file_into_datum_t(keyfile)) == NULL)
	{
		rb_lib_log("rb_setup_ssl_server: Error loading key: %s", strerror(errno));
		return 0;
	}
	
	
	if((ret = gnutls_certificate_set_x509_key_mem(x509, d_cert, d_key, GNUTLS_X509_FMT_PEM)) != GNUTLS_E_SUCCESS)
	{
		rb_lib_log("rb_setup_ssl_server: Error loading certificate or key file: %s", gnutls_strerror(ret));
		return 0;
	}
	rb_free_datum_t(d_cert);
	rb_free_datum_t(d_key);
			
	if(dhfile != NULL)
	{
		if(gnutls_dh_params_init(&dh_params) == GNUTLS_E_SUCCESS)
		{
			gnutls_datum_t *data;
			int xret;
			data = rb_load_file_into_datum_t(dhfile);
			if(data != NULL)
			{
				xret = gnutls_dh_params_import_pkcs3(dh_params, data, GNUTLS_X509_FMT_PEM);
				if(xret < 0)
					rb_lib_log("rb_setup_ssl_server: Error parsing DH file: %s\n", gnutls_strerror(xret));
				rb_free_datum_t(data);
			}
			gnutls_certificate_set_dh_params(x509, dh_params);
		} else 
			rb_lib_log("rb_setup_ssl_server: Unable to setup DH parameters");
	}
	return 1;
}

int
rb_ssl_listen(rb_fde_t * F, int backlog)
{
	F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
	return listen(F->fd, backlog);
}

struct ssl_connect
{
	CNCB *callback;
	void *data;
	int timeout;
};

static void
rb_ssl_connect_realcb(rb_fde_t * F, int status, struct ssl_connect *sconn)
{
	F->connect->callback = sconn->callback;
	F->connect->data = sconn->data;
	rb_free(sconn);
	rb_connect_callback(F, status);
}

static void
rb_ssl_tryconn_timeout_cb(rb_fde_t * F, void *data)
{
	rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
}

static void
rb_ssl_tryconn_cb(rb_fde_t * F, void *data)
{
	struct ssl_connect *sconn = data;
	int ret;

        ret = do_ssl_handshake(F, rb_ssl_tryconn_cb);
 
        switch(ret)
        {
                case -1:
              		rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn); 
                        break;
                case 0:
                        /* do_ssl_handshake does the rb_setselect stuff */
                        return;
                default:
                        break;
                        
    
        }
	rb_ssl_connect_realcb(F, RB_OK, sconn);
}

static void
rb_ssl_tryconn(rb_fde_t * F, int status, void *data)
{
	struct ssl_connect *sconn = data;
	if(status != RB_OK)
	{
		rb_ssl_connect_realcb(F, status, sconn);
		return;
	}

	F->type |= RB_FD_SSL;

                                        
	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
	F->ssl = rb_malloc(sizeof(gnutls_session_t));
        gnutls_init(F->ssl, GNUTLS_CLIENT);
        gnutls_set_default_priority(SSL_P(F));
	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);

	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
	{
		rb_ssl_connect_realcb(F, RB_OK, sconn);
	}
}

void
rb_connect_tcp_ssl(rb_fde_t * F, struct sockaddr *dest,
		   struct sockaddr *clocal, int socklen, CNCB * callback, void *data, int timeout)
{
	struct ssl_connect *sconn;
	if(F == NULL)
		return;

	sconn = rb_malloc(sizeof(struct ssl_connect));
	sconn->data = data;
	sconn->callback = callback;
	sconn->timeout = timeout;
	rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);

}

void
rb_ssl_start_connected(rb_fde_t * F, CNCB * callback, void *data, int timeout)
{
	struct ssl_connect *sconn;
	if(F == NULL)
		return;

	sconn = rb_malloc(sizeof(struct ssl_connect));
	sconn->data = data;
	sconn->callback = callback;
	sconn->timeout = timeout;
	F->connect = rb_malloc(sizeof(struct conndata));
	F->connect->callback = callback;
	F->connect->data = data;
	F->type |= RB_FD_SSL;
	F->ssl = rb_malloc(sizeof(gnutls_session_t));
        
        gnutls_init(F->ssl, GNUTLS_CLIENT);
        gnutls_set_default_priority(SSL_P(F));
	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
	
	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);

	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
	{
		rb_ssl_connect_realcb(F, RB_OK, sconn);
	}
}

int
rb_init_prng(const char *path, prng_seed_t seed_type)
{
	gcry_fast_random_poll();
	return 1;
}

int
rb_get_random(void *buf, size_t length)
{
	gcry_randomize(buf, length, GCRY_STRONG_RANDOM);
	return 1;
}


const char *
rb_get_ssl_strerror(rb_fde_t * F)
{
	return gnutls_strerror(F->ssl_errno);
}

int
rb_supports_ssl(void)
{
	return 1;
}

#endif /* HAVE_GNUTLS */
Commit	Line	Data
af6f5d47 WP	1	/*
	2	* libratbox: a library used by ircd-ratbox and other things
	3	* gnutls.c: gnutls related code
	4	*
	5	* Copyright (C) 2007-2008 ircd-ratbox development team
	6	* Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
af6f5d47 WP	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation; either version 2 of the License, or
	11	* (at your option) any later version.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	* You should have received a copy of the GNU General Public License
	19	* along with this program; if not, write to the Free Software
	20	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
	21	* USA
	22	*
033be687	23	* $Id: gnutls.c 25568 2008-06-20 18:46:08Z androsyn $
af6f5d47 WP	24	*/
	25
	26	#include <libratbox_config.h>
	27	#include <ratbox_lib.h>
af6f5d47 WP	28	#include <commio-int.h>
af6f5d47 WP	29	#include <commio-ssl.h>
033be687 VY	30	#ifdef HAVE_GNUTLS
033be687 VY	31
af6f5d47	32	#include <gnutls/gnutls.h>
033be687 VY	33	#include <gcrypt.h>
	34
	35	static gnutls_certificate_credentials x509;
	36	static gnutls_dh_params dh_params;
af6f5d47	37
033be687 VY	38
	39
	40	#define SSL_P(x) ((gnutls_session_t )F->ssl)
af6f5d47 WP	41
	42	void
	43	rb_ssl_shutdown(rb_fde_t * F)
	44	{
033be687	45	int i;
af6f5d47 WP	46	if(F == NULL \|\| F->ssl == NULL)
af6f5d47 WP	47	return;
033be687 VY	48	for (i = 0; i < 4; i++)
	49	{
	50	if(gnutls_bye(SSL_P(F), GNUTLS_SHUT_RDWR) == GNUTLS_E_SUCCESS)
	51	break;
	52	}
	53	gnutls_deinit(SSL_P(F));
	54	rb_free(F->ssl);
	55	}
af6f5d47	56
033be687 VY	57	unsigned int
	58	rb_ssl_handshake_count(rb_fde_t *F)
	59	{
	60	return F->handshake_count;
	61	}
	62
	63	void
	64	rb_ssl_clear_handshake_count(rb_fde_t *F)
	65	{
	66	F->handshake_count = 0;
af6f5d47 WP	67	}
	68
	69	static void
	70	rb_ssl_timeout(rb_fde_t * F, void *notused)
	71	{
	72	lrb_assert(F->accept != NULL);
	73	F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
	74	}
	75
033be687 VY	76
	77	static int do_ssl_handshake(rb_fde_t F, PF callback)
	78	{
	79	int ret;
	80	int flags;
	81
	82	ret = gnutls_handshake(SSL_P(F));
	83	if(ret < 0)
	84	{
	85	if((ret == GNUTLS_E_INTERRUPTED && rb_ignore_errno(errno)) \|\| ret == GNUTLS_E_AGAIN)
	86	{
	87	if(gnutls_record_get_direction(SSL_P(F)) == 0)
	88	flags = RB_SELECT_READ;
	89	else
	90	flags = RB_SELECT_WRITE;
	91	rb_setselect(F, flags, callback, NULL);
	92	return 0;
	93	}
	94	F->ssl_errno = ret;
	95	return -1;
	96	}
	97	return 1; /* handshake is finished..go about life */
	98	}
	99
af6f5d47 WP	100	static void
	101	rb_ssl_tryaccept(rb_fde_t * F, void *data)
	102	{
033be687	103	int ret;
af6f5d47 WP	104	struct acceptdata *ad;
af6f5d47 WP	105
033be687	106	lrb_assert(F->accept != NULL);
af6f5d47	107
033be687 VY	108	ret = do_ssl_handshake(F, rb_ssl_tryaccept);
	109
	110	switch(ret)
	111	{
	112	case -1:
af6f5d47 WP	113	F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
af6f5d47 WP	114	break;
033be687 VY	115	case 0:
	116	/* do_ssl_handshake does the rb_setselect stuff */
	117	return;
	118	default:
	119	break;
	120
	121
af6f5d47 WP	122	}
	123	rb_settimeout(F, 0, NULL, NULL);
	124	rb_setselect(F, RB_SELECT_READ \| RB_SELECT_WRITE, NULL, NULL);
	125
	126	ad = F->accept;
	127	F->accept = NULL;
	128	ad->callback(F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen,
	129	ad->data);
	130	rb_free(ad);
033be687	131
af6f5d47 WP	132	}
	133
	134	void
	135	rb_ssl_start_accepted(rb_fde_t * new_F, ACCB * cb, void *data, int timeout)
	136	{
033be687	137	gnutls_session_t *ssl;
af6f5d47	138	new_F->type \|= RB_FD_SSL;
033be687	139	ssl = new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
af6f5d47	140	new_F->accept = rb_malloc(sizeof(struct acceptdata));
033be687	141
af6f5d47 WP	142	new_F->accept->callback = cb;
	143	new_F->accept->data = data;
	144	rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);
	145
	146	new_F->accept->addrlen = 0;
	147
033be687 VY	148	gnutls_init(ssl, GNUTLS_SERVER);
	149	gnutls_set_default_priority(*ssl);
	150	gnutls_credentials_set(*ssl, GNUTLS_CRD_CERTIFICATE, x509);
	151	gnutls_dh_set_prime_bits(*ssl, 1024);
	152	gnutls_transport_set_ptr(*ssl, (gnutls_transport_ptr_t) (long int)new_F->fd);
	153	if(do_ssl_handshake(new_F, rb_ssl_tryaccept))
af6f5d47	154	{
033be687	155	struct acceptdata *ad = new_F->accept;
af6f5d47	156	new_F->accept = NULL;
033be687 VY	157	ad->callback(new_F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen, ad->data);
033be687 VY	158	rb_free(ad);
af6f5d47	159	}
033be687	160
af6f5d47 WP	161	}
af6f5d47 WP	162
033be687 VY	163
	164
	165
af6f5d47 WP	166	void
	167	rb_ssl_accept_setup(rb_fde_t * F, int new_fd, struct sockaddr *st, int addrlen)
	168	{
af6f5d47	169	rb_fde_t *new_F;
af6f5d47 WP	170
af6f5d47 WP	171	new_F = rb_find_fd(new_fd);
af6f5d47	172	new_F->type \|= RB_FD_SSL;
033be687	173	new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
af6f5d47 WP	174	new_F->accept = rb_malloc(sizeof(struct acceptdata));
	175
	176	new_F->accept->callback = F->accept->callback;
	177	new_F->accept->data = F->accept->data;
	178	rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
	179	memcpy(&new_F->accept->S, st, addrlen);
	180	new_F->accept->addrlen = addrlen;
	181
033be687 VY	182	gnutls_init((gnutls_session_t *)new_F->ssl, GNUTLS_SERVER);
	183	gnutls_set_default_priority(SSL_P(new_F));
	184	gnutls_credentials_set(SSL_P(new_F), GNUTLS_CRD_CERTIFICATE, x509);
	185	gnutls_dh_set_prime_bits(SSL_P(new_F), 1024);
	186	gnutls_transport_set_ptr(SSL_P(new_F), (gnutls_transport_ptr_t) (long int)new_fd);
	187	if(do_ssl_handshake(F, rb_ssl_tryaccept))
af6f5d47	188	{
033be687 VY	189	struct acceptdata *ad = F->accept;
	190	F->accept = NULL;
	191	ad->callback(F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen, ad->data);
	192	rb_free(ad);
	193	}
	194	}
af6f5d47	195
af6f5d47	196
af6f5d47	197
af6f5d47 WP	198
	199	static ssize_t
	200	rb_ssl_read_or_write(int r_or_w, rb_fde_t * F, void rbuf, const void wbuf, size_t count)
	201	{
	202	ssize_t ret;
033be687	203	gnutls_session_t *ssl = F->ssl;
af6f5d47 WP	204
af6f5d47 WP	205	if(r_or_w == 0)
033be687	206	ret = gnutls_record_recv(*ssl, rbuf, count);
af6f5d47	207	else
033be687	208	ret = gnutls_record_send(*ssl, wbuf, count);
af6f5d47 WP	209
	210	if(ret < 0)
	211	{
033be687	212	switch(ret)
af6f5d47 WP	213	{
af6f5d47 WP	214	case GNUTLS_E_AGAIN:
af6f5d47	215	case GNUTLS_E_INTERRUPTED:
033be687	216	if(rb_ignore_errno(errno))
af6f5d47	217	{
033be687 VY	218	if(gnutls_record_get_direction(*ssl) == 0)
	219	return RB_RW_SSL_NEED_READ;
	220	else
	221	return RB_RW_SSL_NEED_WRITE;
	222	break;
af6f5d47	223	}
af6f5d47	224	default:
033be687 VY	225	F->ssl_errno = ret;
	226	errno = EIO;
	227	return RB_RW_IO_ERROR;
af6f5d47	228	}
af6f5d47 WP	229	}
	230	return ret;
	231	}
	232
	233	ssize_t
	234	rb_ssl_read(rb_fde_t * F, void *buf, size_t count)
	235	{
	236	return rb_ssl_read_or_write(0, F, buf, NULL, count);
	237	}
	238
	239	ssize_t
	240	rb_ssl_write(rb_fde_t * F, const void *buf, size_t count)
	241	{
	242	return rb_ssl_read_or_write(1, F, NULL, buf, count);
	243	}
	244
033be687 VY	245	static void
	246	rb_gcry_random_seed(void *unused)
	247	{
	248	gcry_fast_random_poll();
	249	}
	250
af6f5d47 WP	251	int
	252	rb_init_ssl(void)
	253	{
af6f5d47	254	gnutls_global_init();
033be687 VY	255
033be687 VY	256	if(gnutls_certificate_allocate_credentials(&x509) != GNUTLS_E_SUCCESS)
af6f5d47	257	{
033be687 VY	258	rb_lib_log("rb_init_ssl: Unable to allocate SSL/TLS certificate credentials");
033be687 VY	259	return 0;
af6f5d47	260	}
033be687 VY	261	rb_event_addish("rb_gcry_random_seed", rb_gcry_random_seed, NULL, 300);
	262	return 1;
	263	}
af6f5d47	264
033be687 VY	265	static void
	266	rb_free_datum_t(gnutls_datum_t *d)
	267	{
	268	rb_free(d->data);
	269	rb_free(d);
	270	}
af6f5d47	271
033be687 VY	272	static gnutls_datum_t *
	273	rb_load_file_into_datum_t(const char *file)
	274	{
	275	FILE *f;
	276	gnutls_datum_t *datum;
	277	struct stat fileinfo;
	278	if((f = fopen(file, "r")) == NULL)
	279	return NULL;
	280	if(fstat(fileno(f), &fileinfo))
	281	return NULL;
	282
	283	datum = rb_malloc(sizeof(gnutls_datum_t));
	284
	285	if(fileinfo.st_size > 131072) /* deal with retards */
	286	datum->size = 131072;
	287	else
	288	datum->size = fileinfo.st_size;
	289
	290	datum->data = rb_malloc(datum->size + 1);
	291	fread(datum->data, datum->size, 1, f);
	292	fclose(f);
	293	return datum;
af6f5d47 WP	294	}
	295
	296	int
	297	rb_setup_ssl_server(const char cert, const char keyfile, const char *dhfile)
	298	{
033be687 VY	299	int ret;
	300	gnutls_datum_t d_cert, d_key;
	301	if(cert == NULL)
	302	{
	303	rb_lib_log("rb_setup_ssl_server: No certificate file");
	304	return 0;
	305	}
af6f5d47	306
033be687	307	if((d_cert = rb_load_file_into_datum_t(cert)) == NULL)
af6f5d47	308	{
033be687	309	rb_lib_log("rb_setup_ssl_server: Error loading certificate: %s", strerror(errno));
af6f5d47 WP	310	return 0;
	311	}
	312
033be687 VY	313	if((d_key = rb_load_file_into_datum_t(keyfile)) == NULL)
	314	{
	315	rb_lib_log("rb_setup_ssl_server: Error loading key: %s", strerror(errno));
	316	return 0;
	317	}
	318
	319
	320	if((ret = gnutls_certificate_set_x509_key_mem(x509, d_cert, d_key, GNUTLS_X509_FMT_PEM)) != GNUTLS_E_SUCCESS)
	321	{
	322	rb_lib_log("rb_setup_ssl_server: Error loading certificate or key file: %s", gnutls_strerror(ret));
	323	return 0;
	324	}
	325	rb_free_datum_t(d_cert);
	326	rb_free_datum_t(d_key);
	327
	328	if(dhfile != NULL)
	329	{
	330	if(gnutls_dh_params_init(&dh_params) == GNUTLS_E_SUCCESS)
	331	{
	332	gnutls_datum_t *data;
	333	int xret;
	334	data = rb_load_file_into_datum_t(dhfile);
	335	if(data != NULL)
	336	{
	337	xret = gnutls_dh_params_import_pkcs3(dh_params, data, GNUTLS_X509_FMT_PEM);
	338	if(xret < 0)
	339	rb_lib_log("rb_setup_ssl_server: Error parsing DH file: %s\n", gnutls_strerror(xret));
	340	rb_free_datum_t(data);
	341	}
	342	gnutls_certificate_set_dh_params(x509, dh_params);
	343	} else
	344	rb_lib_log("rb_setup_ssl_server: Unable to setup DH parameters");
	345	}
af6f5d47 WP	346	return 1;
	347	}
	348
	349	int
	350	rb_ssl_listen(rb_fde_t * F, int backlog)
	351	{
	352	F->type = RB_FD_SOCKET \| RB_FD_LISTEN \| RB_FD_SSL;
	353	return listen(F->fd, backlog);
	354	}
	355
	356	struct ssl_connect
	357	{
	358	CNCB *callback;
	359	void *data;
	360	int timeout;
	361	};
	362
	363	static void
	364	rb_ssl_connect_realcb(rb_fde_t * F, int status, struct ssl_connect *sconn)
	365	{
	366	F->connect->callback = sconn->callback;
	367	F->connect->data = sconn->data;
	368	rb_free(sconn);
	369	rb_connect_callback(F, status);
	370	}
	371
	372	static void
	373	rb_ssl_tryconn_timeout_cb(rb_fde_t * F, void *data)
	374	{
	375	rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
	376	}
	377
	378	static void
	379	rb_ssl_tryconn_cb(rb_fde_t * F, void *data)
	380	{
	381	struct ssl_connect *sconn = data;
033be687 VY	382	int ret;
	383
	384	ret = do_ssl_handshake(F, rb_ssl_tryconn_cb);
	385
	386	switch(ret)
	387	{
	388	case -1:
	389	rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
	390	break;
	391	case 0:
	392	/* do_ssl_handshake does the rb_setselect stuff */
	393	return;
	394	default:
	395	break;
	396
	397
	398	}
	399	rb_ssl_connect_realcb(F, RB_OK, sconn);
af6f5d47 WP	400	}
	401
	402	static void
	403	rb_ssl_tryconn(rb_fde_t * F, int status, void *data)
	404	{
af6f5d47	405	struct ssl_connect *sconn = data;
af6f5d47 WP	406	if(status != RB_OK)
	407	{
	408	rb_ssl_connect_realcb(F, status, sconn);
	409	return;
	410	}
	411
	412	F->type \|= RB_FD_SSL;
	413
033be687	414
af6f5d47	415	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
033be687 VY	416	F->ssl = rb_malloc(sizeof(gnutls_session_t));
	417	gnutls_init(F->ssl, GNUTLS_CLIENT);
	418	gnutls_set_default_priority(SSL_P(F));
	419	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	420	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
	421
	422	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
af6f5d47 WP	423	{
	424	rb_ssl_connect_realcb(F, RB_OK, sconn);
	425	}
	426	}
	427
	428	void
	429	rb_connect_tcp_ssl(rb_fde_t * F, struct sockaddr *dest,
	430	struct sockaddr clocal, int socklen, CNCB callback, void *data, int timeout)
	431	{
	432	struct ssl_connect *sconn;
	433	if(F == NULL)
	434	return;
	435
	436	sconn = rb_malloc(sizeof(struct ssl_connect));
	437	sconn->data = data;
	438	sconn->callback = callback;
	439	sconn->timeout = timeout;
	440	rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);
033be687	441
af6f5d47 WP	442	}
	443
	444	void
	445	rb_ssl_start_connected(rb_fde_t * F, CNCB * callback, void *data, int timeout)
	446	{
af6f5d47	447	struct ssl_connect *sconn;
af6f5d47 WP	448	if(F == NULL)
	449	return;
	450
	451	sconn = rb_malloc(sizeof(struct ssl_connect));
	452	sconn->data = data;
	453	sconn->callback = callback;
	454	sconn->timeout = timeout;
	455	F->connect = rb_malloc(sizeof(struct conndata));
	456	F->connect->callback = callback;
	457	F->connect->data = data;
	458	F->type \|= RB_FD_SSL;
033be687	459	F->ssl = rb_malloc(sizeof(gnutls_session_t));
af6f5d47	460
033be687 VY	461	gnutls_init(F->ssl, GNUTLS_CLIENT);
	462	gnutls_set_default_priority(SSL_P(F));
	463	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	464	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
	465
af6f5d47	466	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
033be687 VY	467
033be687 VY	468	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
af6f5d47 WP	469	{
	470	rb_ssl_connect_realcb(F, RB_OK, sconn);
	471	}
	472	}
	473
af6f5d47 WP	474	int
	475	rb_init_prng(const char *path, prng_seed_t seed_type)
	476	{
033be687 VY	477	gcry_fast_random_poll();
033be687 VY	478	return 1;
af6f5d47 WP	479	}
	480
	481	int
	482	rb_get_random(void *buf, size_t length)
	483	{
033be687 VY	484	gcry_randomize(buf, length, GCRY_STRONG_RANDOM);
033be687 VY	485	return 1;
af6f5d47 WP	486	}
	487
	488
	489	const char *
	490	rb_get_ssl_strerror(rb_fde_t * F)
	491	{
	492	return gnutls_strerror(F->ssl_errno);
	493	}
	494
	495	int
	496	rb_supports_ssl(void)
	497	{
	498	return 1;
	499	}
	500
	501	#endif /* HAVE_GNUTLS */