libratbox/src/gnutls.c

   1 /*
   2  *  libratbox: a library used by ircd-ratbox and other things
   3  *  gnutls.c: gnutls related code
   4  *
   5  *  Copyright (C) 2007-2008 ircd-ratbox development team
   6  *  Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  21  *  USA
  22  *
  23  *  $Id: gnutls.c 25793 2008-07-29 14:47:48Z androsyn $
  24  */
  25
  26 #include <libratbox_config.h>
  27 #include <ratbox_lib.h>
  28 #include <commio-int.h>
  29 #include <commio-ssl.h>
  30 #ifdef HAVE_GNUTLS
  31
  32 #include <gnutls/gnutls.h>
  33 #include <gcrypt.h>
  34
  35 static gnutls_certificate_credentials x509;
  36 static gnutls_dh_params dh_params;
  37
  38
  39
  40 #define SSL_P(x) *((gnutls_session_t *)F->ssl)
  41
  42 void
  43 rb_ssl_shutdown(rb_fde_t * F)
  44 {
  45         int i;
  46         if(F == NULL || F->ssl == NULL)
  47                 return;
  48         for (i = 0; i < 4; i++)
  49         {
  50                 if(gnutls_bye(SSL_P(F), GNUTLS_SHUT_RDWR) == GNUTLS_E_SUCCESS)
  51                         break;
  52         }
  53         gnutls_deinit(SSL_P(F));
  54         rb_free(F->ssl);
  55 }
  56
  57 unsigned int
  58 rb_ssl_handshake_count(rb_fde_t *F)
  59 {
  60         return F->handshake_count;
  61 }
  62
  63 void
  64 rb_ssl_clear_handshake_count(rb_fde_t *F)
  65 {
  66         F->handshake_count = 0;
  67 }
  68
  69 static void
  70 rb_ssl_timeout(rb_fde_t * F, void *notused)
  71 {
  72         lrb_assert(F->accept != NULL);
  73         F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
  74 }
  75
  76
  77 static int do_ssl_handshake(rb_fde_t *F, PF *callback)
  78 {
  79         int ret;
  80         int flags;
  81
  82         ret = gnutls_handshake(SSL_P(F));
  83         if(ret < 0)
  84         {
  85                 if((ret == GNUTLS_E_INTERRUPTED && rb_ignore_errno(errno)) || ret == GNUTLS_E_AGAIN)
  86                 {
  87                         if(gnutls_record_get_direction(SSL_P(F)) == 0)
  88                                 flags = RB_SELECT_READ;
  89                         else
  90                                 flags = RB_SELECT_WRITE;
  91                         rb_setselect(F, flags, callback, NULL);
  92                         return 0;
  93                 }
  94                 F->ssl_errno = ret;
  95                 return -1;
  96         }
  97         return 1; /* handshake is finished..go about life */
  98 }
  99
 100 static void
 101 rb_ssl_tryaccept(rb_fde_t * F, void *data)
 102 {
 103         int ret;
 104         struct acceptdata *ad;
 105
 106         lrb_assert(F->accept != NULL);
 107
 108         ret = do_ssl_handshake(F, rb_ssl_tryaccept);
 109
 110         switch(ret)
 111         {
 112                 case -1:
 113                         F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
 114                         break;
 115                 case 0:
 116                         /* do_ssl_handshake does the rb_setselect stuff */
 117                         return;
 118                 default:
 119                         break;
 120
 121
 122         }
 123         rb_settimeout(F, 0, NULL, NULL);
 124         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
 125
 126         ad = F->accept;
 127         F->accept = NULL;
 128         ad->callback(F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen,
 129                             ad->data);
 130         rb_free(ad);
 131
 132 }
 133
 134 void
 135 rb_ssl_start_accepted(rb_fde_t * new_F, ACCB * cb, void *data, int timeout)
 136 {
 137         gnutls_session_t *ssl;
 138         new_F->type |= RB_FD_SSL;
 139         ssl = new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
 140         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 141
 142         new_F->accept->callback = cb;
 143         new_F->accept->data = data;
 144         rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);
 145
 146         new_F->accept->addrlen = 0;
 147
 148         gnutls_init(ssl, GNUTLS_SERVER);
 149         gnutls_set_default_priority(*ssl);
 150         gnutls_credentials_set(*ssl, GNUTLS_CRD_CERTIFICATE, x509);
 151         gnutls_dh_set_prime_bits(*ssl, 1024);
 152         gnutls_transport_set_ptr(*ssl, (gnutls_transport_ptr_t) (long int)new_F->fd);
 153         if(do_ssl_handshake(new_F, rb_ssl_tryaccept))
 154         {
 155                 struct acceptdata *ad = new_F->accept;
 156                 new_F->accept = NULL;
 157                 ad->callback(new_F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen, ad->data);
 158                 rb_free(ad);
 159         }
 160
 161 }
 162
 163
 164
 165
 166 void
 167 rb_ssl_accept_setup(rb_fde_t * F, rb_fde_t *new_F, struct sockaddr *st, int addrlen)
 168 {
 169         new_F->type |= RB_FD_SSL;
 170         new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
 171         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 172
 173         new_F->accept->callback = F->accept->callback;
 174         new_F->accept->data = F->accept->data;
 175         rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
 176         memcpy(&new_F->accept->S, st, addrlen);
 177         new_F->accept->addrlen = addrlen;
 178
 179         gnutls_init((gnutls_session_t *)new_F->ssl, GNUTLS_SERVER);
 180         gnutls_set_default_priority(SSL_P(new_F));
 181         gnutls_credentials_set(SSL_P(new_F), GNUTLS_CRD_CERTIFICATE, x509);
 182         gnutls_dh_set_prime_bits(SSL_P(new_F), 1024);
 183         gnutls_transport_set_ptr(SSL_P(new_F), (gnutls_transport_ptr_t) (long int)rb_get_fd(new_F));
 184         if(do_ssl_handshake(F, rb_ssl_tryaccept))
 185         {
 186                 struct acceptdata *ad = F->accept;
 187                 F->accept = NULL;
 188                 ad->callback(F, RB_OK, (struct sockaddr *) &ad->S, ad->addrlen, ad->data);
 189                 rb_free(ad);
 190         }
 191 }
 192
 193
 194
 195
 196 static ssize_t
 197 rb_ssl_read_or_write(int r_or_w, rb_fde_t * F, void *rbuf, const void *wbuf, size_t count)
 198 {
 199         ssize_t ret;
 200         gnutls_session_t *ssl = F->ssl;
 201
 202         if(r_or_w == 0)
 203                 ret = gnutls_record_recv(*ssl, rbuf, count);
 204         else
 205                 ret = gnutls_record_send(*ssl, wbuf, count);
 206
 207         if(ret < 0)
 208         {
 209                 switch(ret)
 210                 {
 211                 case GNUTLS_E_AGAIN:
 212                 case GNUTLS_E_INTERRUPTED:
 213                         if(rb_ignore_errno(errno))
 214                         {
 215                                 if(gnutls_record_get_direction(*ssl) == 0)
 216                                         return RB_RW_SSL_NEED_READ;
 217                                 else
 218                                         return RB_RW_SSL_NEED_WRITE;
 219                                 break;
 220                         }
 221                 default:
 222                         F->ssl_errno = ret;
 223                         errno = EIO;
 224                         return RB_RW_IO_ERROR;
 225                 }
 226         }
 227         return ret;
 228 }
 229
 230 ssize_t
 231 rb_ssl_read(rb_fde_t * F, void *buf, size_t count)
 232 {
 233         return rb_ssl_read_or_write(0, F, buf, NULL, count);
 234 }
 235
 236 ssize_t
 237 rb_ssl_write(rb_fde_t * F, const void *buf, size_t count)
 238 {
 239         return rb_ssl_read_or_write(1, F, NULL, buf, count);
 240 }
 241
 242 static void
 243 rb_gcry_random_seed(void *unused)
 244 {
 245         gcry_fast_random_poll();
 246 }
 247
 248 int
 249 rb_init_ssl(void)
 250 {
 251         gnutls_global_init();
 252
 253         if(gnutls_certificate_allocate_credentials(&x509) != GNUTLS_E_SUCCESS)
 254         {
 255                 rb_lib_log("rb_init_ssl: Unable to allocate SSL/TLS certificate credentials");
 256                 return 0;
 257         }
 258         rb_event_addish("rb_gcry_random_seed", rb_gcry_random_seed, NULL, 300);
 259         return 1;
 260 }
 261
 262 static void
 263 rb_free_datum_t(gnutls_datum_t *d)
 264 {
 265         rb_free(d->data);
 266         rb_free(d);
 267 }
 268
 269 static gnutls_datum_t *
 270 rb_load_file_into_datum_t(const char *file)
 271 {
 272         FILE *f;
 273         gnutls_datum_t *datum;
 274         struct stat fileinfo;
 275         if((f = fopen(file, "r")) == NULL)
 276                 return NULL;
 277         if(fstat(fileno(f), &fileinfo))
 278                 return NULL;
 279
 280         datum = rb_malloc(sizeof(gnutls_datum_t));
 281
 282         if(fileinfo.st_size > 131072) /* deal with retards */
 283                 datum->size = 131072;
 284         else
 285                 datum->size = fileinfo.st_size;
 286
 287         datum->data = rb_malloc(datum->size + 1);
 288         fread(datum->data, datum->size, 1, f);
 289         fclose(f);
 290         return datum;
 291 }
 292
 293 int
 294 rb_setup_ssl_server(const char *cert, const char *keyfile, const char *dhfile)
 295 {
 296         int ret;
 297         gnutls_datum_t *d_cert, *d_key;
 298         if(cert == NULL)
 299         {
 300                 rb_lib_log("rb_setup_ssl_server: No certificate file");
 301                 return 0;
 302         }
 303
 304         if((d_cert = rb_load_file_into_datum_t(cert)) == NULL)
 305         {
 306                 rb_lib_log("rb_setup_ssl_server: Error loading certificate: %s", strerror(errno));
 307                 return 0;
 308         }
 309
 310         if((d_key = rb_load_file_into_datum_t(keyfile)) == NULL)
 311         {
 312                 rb_lib_log("rb_setup_ssl_server: Error loading key: %s", strerror(errno));
 313                 return 0;
 314         }
 315
 316
 317         if((ret = gnutls_certificate_set_x509_key_mem(x509, d_cert, d_key, GNUTLS_X509_FMT_PEM)) != GNUTLS_E_SUCCESS)
 318         {
 319                 rb_lib_log("rb_setup_ssl_server: Error loading certificate or key file: %s", gnutls_strerror(ret));
 320                 return 0;
 321         }
 322         rb_free_datum_t(d_cert);
 323         rb_free_datum_t(d_key);
 324
 325         if(dhfile != NULL)
 326         {
 327                 if(gnutls_dh_params_init(&dh_params) == GNUTLS_E_SUCCESS)
 328                 {
 329                         gnutls_datum_t *data;
 330                         int xret;
 331                         data = rb_load_file_into_datum_t(dhfile);
 332                         if(data != NULL)
 333                         {
 334                                 xret = gnutls_dh_params_import_pkcs3(dh_params, data, GNUTLS_X509_FMT_PEM);
 335                                 if(xret < 0)
 336                                         rb_lib_log("rb_setup_ssl_server: Error parsing DH file: %s\n", gnutls_strerror(xret));
 337                                 rb_free_datum_t(data);
 338                         }
 339                         gnutls_certificate_set_dh_params(x509, dh_params);
 340                 } else
 341                         rb_lib_log("rb_setup_ssl_server: Unable to setup DH parameters");
 342         }
 343         return 1;
 344 }
 345
 346 int
 347 rb_ssl_listen(rb_fde_t * F, int backlog)
 348 {
 349         F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
 350         return listen(F->fd, backlog);
 351 }
 352
 353 struct ssl_connect
 354 {
 355         CNCB *callback;
 356         void *data;
 357         int timeout;
 358 };
 359
 360 static void
 361 rb_ssl_connect_realcb(rb_fde_t * F, int status, struct ssl_connect *sconn)
 362 {
 363         F->connect->callback = sconn->callback;
 364         F->connect->data = sconn->data;
 365         rb_free(sconn);
 366         rb_connect_callback(F, status);
 367 }
 368
 369 static void
 370 rb_ssl_tryconn_timeout_cb(rb_fde_t * F, void *data)
 371 {
 372         rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
 373 }
 374
 375 static void
 376 rb_ssl_tryconn_cb(rb_fde_t * F, void *data)
 377 {
 378         struct ssl_connect *sconn = data;
 379         int ret;
 380
 381         ret = do_ssl_handshake(F, rb_ssl_tryconn_cb);
 382
 383         switch(ret)
 384         {
 385                 case -1:
 386                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 387                         break;
 388                 case 0:
 389                         /* do_ssl_handshake does the rb_setselect stuff */
 390                         return;
 391                 default:
 392                         break;
 393
 394
 395         }
 396         rb_ssl_connect_realcb(F, RB_OK, sconn);
 397 }
 398
 399 static void
 400 rb_ssl_tryconn(rb_fde_t * F, int status, void *data)
 401 {
 402         struct ssl_connect *sconn = data;
 403         if(status != RB_OK)
 404         {
 405                 rb_ssl_connect_realcb(F, status, sconn);
 406                 return;
 407         }
 408
 409         F->type |= RB_FD_SSL;
 410
 411
 412         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 413         F->ssl = rb_malloc(sizeof(gnutls_session_t));
 414         gnutls_init(F->ssl, GNUTLS_CLIENT);
 415         gnutls_set_default_priority(SSL_P(F));
 416         gnutls_dh_set_prime_bits(SSL_P(F), 1024);
 417         gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
 418
 419         if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
 420         {
 421                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 422         }
 423 }
 424
 425 void
 426 rb_connect_tcp_ssl(rb_fde_t * F, struct sockaddr *dest,
 427                    struct sockaddr *clocal, int socklen, CNCB * callback, void *data, int timeout)
 428 {
 429         struct ssl_connect *sconn;
 430         if(F == NULL)
 431                 return;
 432
 433         sconn = rb_malloc(sizeof(struct ssl_connect));
 434         sconn->data = data;
 435         sconn->callback = callback;
 436         sconn->timeout = timeout;
 437         rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);
 438
 439 }
 440
 441 void
 442 rb_ssl_start_connected(rb_fde_t * F, CNCB * callback, void *data, int timeout)
 443 {
 444         struct ssl_connect *sconn;
 445         if(F == NULL)
 446                 return;
 447
 448         sconn = rb_malloc(sizeof(struct ssl_connect));
 449         sconn->data = data;
 450         sconn->callback = callback;
 451         sconn->timeout = timeout;
 452         F->connect = rb_malloc(sizeof(struct conndata));
 453         F->connect->callback = callback;
 454         F->connect->data = data;
 455         F->type |= RB_FD_SSL;
 456         F->ssl = rb_malloc(sizeof(gnutls_session_t));
 457
 458         gnutls_init(F->ssl, GNUTLS_CLIENT);
 459         gnutls_set_default_priority(SSL_P(F));
 460         gnutls_dh_set_prime_bits(SSL_P(F), 1024);
 461         gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
 462
 463         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 464
 465         if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
 466         {
 467                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 468         }
 469 }
 470
 471 int
 472 rb_init_prng(const char *path, prng_seed_t seed_type)
 473 {
 474         gcry_fast_random_poll();
 475         return 1;
 476 }
 477
 478 int
 479 rb_get_random(void *buf, size_t length)
 480 {
 481         gcry_randomize(buf, length, GCRY_STRONG_RANDOM);
 482         return 1;
 483 }
 484
 485 int
 486 rb_get_pseudo_random(void *buf, size_t length)
 487 {
 488         gcry_randomize(buf, length, GCRY_WEAK_RANDOM);
 489         return 1;
 490 }
 491
 492 const char *
 493 rb_get_ssl_strerror(rb_fde_t * F)
 494 {
 495         return gnutls_strerror(F->ssl_errno);
 496 }
 497
 498 int
 499 rb_supports_ssl(void)
 500 {
 501         return 1;
 502 }
 503
 504 #endif /* HAVE_GNUTLS */