libratbox/src/gnutls.c

/*
 *  libratbox: a library used by ircd-ratbox and other things
 *  gnutls.c: gnutls related code
 *
 *  Copyright (C) 2007-2008 ircd-ratbox development team
 *  Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
 *  USA
 *
 *  $Id: gnutls.c 26296 2008-12-13 03:36:00Z androsyn $
 */

#include <libratbox_config.h>
#include <ratbox_lib.h>
#include <commio-int.h>
#include <commio-ssl.h>
#ifdef HAVE_GNUTLS

#include <gnutls/gnutls.h>
#include <gcrypt.h>

static gnutls_certificate_credentials x509;
static gnutls_dh_params dh_params;


#define SSL_P(x) *((gnutls_session_t *)F->ssl)

void
rb_ssl_shutdown(rb_fde_t *F)
{
	int i;
	if(F == NULL || F->ssl == NULL)
		return;
	for(i = 0; i < 4; i++)
	{
		if(gnutls_bye(SSL_P(F), GNUTLS_SHUT_RDWR) == GNUTLS_E_SUCCESS)
			break;
	}
	gnutls_deinit(SSL_P(F));
	rb_free(F->ssl);
}

unsigned int
rb_ssl_handshake_count(rb_fde_t *F)
{
	return F->handshake_count;
}

void
rb_ssl_clear_handshake_count(rb_fde_t *F)
{
	F->handshake_count = 0;
}

static void
rb_ssl_timeout(rb_fde_t *F, void *notused)
{
	lrb_assert(F->accept != NULL);
	F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
}


static int
do_ssl_handshake(rb_fde_t *F, PF * callback)
{
	int ret;
	int flags;

	ret = gnutls_handshake(SSL_P(F));
	if(ret < 0)
	{
		if((ret == GNUTLS_E_INTERRUPTED && rb_ignore_errno(errno)) || ret == GNUTLS_E_AGAIN)
		{
			if(gnutls_record_get_direction(SSL_P(F)) == 0)
				flags = RB_SELECT_READ;
			else
				flags = RB_SELECT_WRITE;
			rb_setselect(F, flags, callback, NULL);
			return 0;
		}
		F->ssl_errno = ret;
		return -1;
	}
	return 1;		/* handshake is finished..go about life */
}

static void
rb_ssl_tryaccept(rb_fde_t *F, void *data)
{
	int ret;
	struct acceptdata *ad;

	lrb_assert(F->accept != NULL);

	ret = do_ssl_handshake(F, rb_ssl_tryaccept);

	/* do_ssl_handshake does the rb_setselect */
	if(ret == 0)
		return;

	ad = F->accept;
	F->accept = NULL;
	rb_settimeout(F, 0, NULL, NULL);
	rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);

	if(ret > 0)
		ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
	else
		ad->callback(F, RB_ERROR_SSL, NULL, 0, ad->data);

	rb_free(ad);
}

void
rb_ssl_start_accepted(rb_fde_t *new_F, ACCB * cb, void *data, int timeout)
{
	gnutls_session_t *ssl;
	new_F->type |= RB_FD_SSL;
	ssl = new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
	new_F->accept = rb_malloc(sizeof(struct acceptdata));

	new_F->accept->callback = cb;
	new_F->accept->data = data;
	rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);

	new_F->accept->addrlen = 0;

	gnutls_init(ssl, GNUTLS_SERVER);
	gnutls_set_default_priority(*ssl);
	gnutls_credentials_set(*ssl, GNUTLS_CRD_CERTIFICATE, x509);
	gnutls_dh_set_prime_bits(*ssl, 1024);
	gnutls_transport_set_ptr(*ssl, (gnutls_transport_ptr_t) (long int)new_F->fd);
	if(do_ssl_handshake(new_F, rb_ssl_tryaccept))
	{
		struct acceptdata *ad = new_F->accept;
		new_F->accept = NULL;
		ad->callback(new_F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
		rb_free(ad);
	}

}


void
rb_ssl_accept_setup(rb_fde_t *F, rb_fde_t *new_F, struct sockaddr *st, int addrlen)
{
	new_F->type |= RB_FD_SSL;
	new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
	new_F->accept = rb_malloc(sizeof(struct acceptdata));

	new_F->accept->callback = F->accept->callback;
	new_F->accept->data = F->accept->data;
	rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
	memcpy(&new_F->accept->S, st, addrlen);
	new_F->accept->addrlen = addrlen;

	gnutls_init((gnutls_session_t *) new_F->ssl, GNUTLS_SERVER);
	gnutls_set_default_priority(SSL_P(new_F));
	gnutls_credentials_set(SSL_P(new_F), GNUTLS_CRD_CERTIFICATE, x509);
	gnutls_dh_set_prime_bits(SSL_P(new_F), 1024);
	gnutls_transport_set_ptr(SSL_P(new_F), (gnutls_transport_ptr_t) (long int)rb_get_fd(new_F));
	if(do_ssl_handshake(F, rb_ssl_tryaccept))
	{
		struct acceptdata *ad = F->accept;
		F->accept = NULL;
		ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
		rb_free(ad);
	}
}


static ssize_t
rb_ssl_read_or_write(int r_or_w, rb_fde_t *F, void *rbuf, const void *wbuf, size_t count)
{
	ssize_t ret;
	gnutls_session_t *ssl = F->ssl;

	if(r_or_w == 0)
		ret = gnutls_record_recv(*ssl, rbuf, count);
	else
		ret = gnutls_record_send(*ssl, wbuf, count);

	if(ret < 0)
	{
		switch (ret)
		{
		case GNUTLS_E_AGAIN:
		case GNUTLS_E_INTERRUPTED:
			if(rb_ignore_errno(errno))
			{
				if(gnutls_record_get_direction(*ssl) == 0)
					return RB_RW_SSL_NEED_READ;
				else
					return RB_RW_SSL_NEED_WRITE;
				break;
			}
		default:
			F->ssl_errno = ret;
			errno = EIO;
			return RB_RW_IO_ERROR;
		}
	}
	return ret;
}

ssize_t
rb_ssl_read(rb_fde_t *F, void *buf, size_t count)
{
	return rb_ssl_read_or_write(0, F, buf, NULL, count);
}

ssize_t
rb_ssl_write(rb_fde_t *F, const void *buf, size_t count)
{
	return rb_ssl_read_or_write(1, F, NULL, buf, count);
}

static void
rb_gcry_random_seed(void *unused)
{
	gcry_fast_random_poll();
}

int
rb_init_ssl(void)
{
	gnutls_global_init();

	if(gnutls_certificate_allocate_credentials(&x509) != GNUTLS_E_SUCCESS)
	{
		rb_lib_log("rb_init_ssl: Unable to allocate SSL/TLS certificate credentials");
		return 0;
	}
	rb_event_addish("rb_gcry_random_seed", rb_gcry_random_seed, NULL, 300);
	return 1;
}

static void
rb_free_datum_t(gnutls_datum_t * d)
{
	rb_free(d->data);
	rb_free(d);
}

static gnutls_datum_t *
rb_load_file_into_datum_t(const char *file)
{
	FILE *f;
	gnutls_datum_t *datum;
	struct stat fileinfo;
	if((f = fopen(file, "r")) == NULL)
		return NULL;
	if(fstat(fileno(f), &fileinfo))
		return NULL;

	datum = rb_malloc(sizeof(gnutls_datum_t));

	if(fileinfo.st_size > 131072)	/* deal with retards */
		datum->size = 131072;
	else
		datum->size = fileinfo.st_size;

	datum->data = rb_malloc(datum->size + 1);
	fread(datum->data, datum->size, 1, f);
	fclose(f);
	return datum;
}

int
rb_setup_ssl_server(const char *cert, const char *keyfile, const char *dhfile)
{
	int ret;
	gnutls_datum_t *d_cert, *d_key;
	if(cert == NULL)
	{
		rb_lib_log("rb_setup_ssl_server: No certificate file");
		return 0;
	}

	if((d_cert = rb_load_file_into_datum_t(cert)) == NULL)
	{
		rb_lib_log("rb_setup_ssl_server: Error loading certificate: %s", strerror(errno));
		return 0;
	}

	if((d_key = rb_load_file_into_datum_t(keyfile)) == NULL)
	{
		rb_lib_log("rb_setup_ssl_server: Error loading key: %s", strerror(errno));
		return 0;
	}


	if((ret =
	    gnutls_certificate_set_x509_key_mem(x509, d_cert, d_key,
						GNUTLS_X509_FMT_PEM)) != GNUTLS_E_SUCCESS)
	{
		rb_lib_log("rb_setup_ssl_server: Error loading certificate or key file: %s",
			   gnutls_strerror(ret));
		return 0;
	}
	rb_free_datum_t(d_cert);
	rb_free_datum_t(d_key);

	if(dhfile != NULL)
	{
		if(gnutls_dh_params_init(&dh_params) == GNUTLS_E_SUCCESS)
		{
			gnutls_datum_t *data;
			int xret;
			data = rb_load_file_into_datum_t(dhfile);
			if(data != NULL)
			{
				xret = gnutls_dh_params_import_pkcs3(dh_params, data,
								     GNUTLS_X509_FMT_PEM);
				if(xret < 0)
					rb_lib_log
						("rb_setup_ssl_server: Error parsing DH file: %s\n",
						 gnutls_strerror(xret));
				rb_free_datum_t(data);
			}
			gnutls_certificate_set_dh_params(x509, dh_params);
		}
		else
			rb_lib_log("rb_setup_ssl_server: Unable to setup DH parameters");
	}
	return 1;
}

int
rb_ssl_listen(rb_fde_t *F, int backlog)
{
	F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
	return listen(F->fd, backlog);
}

struct ssl_connect
{
	CNCB *callback;
	void *data;
	int timeout;
};

static void
rb_ssl_connect_realcb(rb_fde_t *F, int status, struct ssl_connect *sconn)
{
	F->connect->callback = sconn->callback;
	F->connect->data = sconn->data;
	rb_free(sconn);
	rb_connect_callback(F, status);
}

static void
rb_ssl_tryconn_timeout_cb(rb_fde_t *F, void *data)
{
	rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
}

static void
rb_ssl_tryconn_cb(rb_fde_t *F, void *data)
{
	struct ssl_connect *sconn = data;
	int ret;

	ret = do_ssl_handshake(F, rb_ssl_tryconn_cb);

	switch (ret)
	{
	case -1:
		rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
		break;
	case 0:
		/* do_ssl_handshake does the rb_setselect stuff */
		return;
	default:
		break;


	}
	rb_ssl_connect_realcb(F, RB_OK, sconn);
}

static void
rb_ssl_tryconn(rb_fde_t *F, int status, void *data)
{
	struct ssl_connect *sconn = data;
	if(status != RB_OK)
	{
		rb_ssl_connect_realcb(F, status, sconn);
		return;
	}

	F->type |= RB_FD_SSL;


	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
	F->ssl = rb_malloc(sizeof(gnutls_session_t));
	gnutls_init(F->ssl, GNUTLS_CLIENT);
	gnutls_set_default_priority(SSL_P(F));
	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);

	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
	{
		rb_ssl_connect_realcb(F, RB_OK, sconn);
	}
}

void
rb_connect_tcp_ssl(rb_fde_t *F, struct sockaddr *dest,
		   struct sockaddr *clocal, int socklen, CNCB * callback, void *data, int timeout)
{
	struct ssl_connect *sconn;
	if(F == NULL)
		return;

	sconn = rb_malloc(sizeof(struct ssl_connect));
	sconn->data = data;
	sconn->callback = callback;
	sconn->timeout = timeout;
	rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);

}

void
rb_ssl_start_connected(rb_fde_t *F, CNCB * callback, void *data, int timeout)
{
	struct ssl_connect *sconn;
	if(F == NULL)
		return;

	sconn = rb_malloc(sizeof(struct ssl_connect));
	sconn->data = data;
	sconn->callback = callback;
	sconn->timeout = timeout;
	F->connect = rb_malloc(sizeof(struct conndata));
	F->connect->callback = callback;
	F->connect->data = data;
	F->type |= RB_FD_SSL;
	F->ssl = rb_malloc(sizeof(gnutls_session_t));

	gnutls_init(F->ssl, GNUTLS_CLIENT);
	gnutls_set_default_priority(SSL_P(F));
	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);

	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);

	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
	{
		rb_ssl_connect_realcb(F, RB_OK, sconn);
	}
}

int
rb_init_prng(const char *path, prng_seed_t seed_type)
{
	gcry_fast_random_poll();
	return 1;
}

int
rb_get_random(void *buf, size_t length)
{
	gcry_randomize(buf, length, GCRY_STRONG_RANDOM);
	return 1;
}

int
rb_get_pseudo_random(void *buf, size_t length)
{
	gcry_randomize(buf, length, GCRY_WEAK_RANDOM);
	return 1;
}

const char *
rb_get_ssl_strerror(rb_fde_t *F)
{
	return gnutls_strerror(F->ssl_errno);
}

int
rb_get_ssl_certfp(rb_fde_t *F, uint8_t certfp[RB_SSL_CERTFP_LEN])
{
	/* XXX implement this for gnutls */
	return 0;
}

int
rb_supports_ssl(void)
{
	return 1;
}

void
rb_get_ssl_info(char *buf, size_t len)
{
	rb_snprintf(buf, len, "GNUTLS: compiled (%s), library(%s)",
		    LIBGNUTLS_VERSION, gnutls_check_version(NULL));
}


#endif /* HAVE_GNUTLS */
Commit	Line	Data
	1	/*
	2	* libratbox: a library used by ircd-ratbox and other things
	3	* gnutls.c: gnutls related code
	4	*
	5	* Copyright (C) 2007-2008 ircd-ratbox development team
	6	* Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation; either version 2 of the License, or
	11	* (at your option) any later version.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	* You should have received a copy of the GNU General Public License
	19	* along with this program; if not, write to the Free Software
	20	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
	21	* USA
	22	*
	23	* $Id: gnutls.c 26296 2008-12-13 03:36:00Z androsyn $
	24	*/
	25
	26	#include <libratbox_config.h>
	27	#include <ratbox_lib.h>
	28	#include <commio-int.h>
	29	#include <commio-ssl.h>
	30	#ifdef HAVE_GNUTLS
	31
	32	#include <gnutls/gnutls.h>
	33	#include <gcrypt.h>
	34
	35	static gnutls_certificate_credentials x509;
	36	static gnutls_dh_params dh_params;
	37
	38
	39
	40	#define SSL_P(x) ((gnutls_session_t )F->ssl)
	41
	42	void
	43	rb_ssl_shutdown(rb_fde_t *F)
	44	{
	45	int i;
	46	if(F == NULL \|\| F->ssl == NULL)
	47	return;
	48	for(i = 0; i < 4; i++)
	49	{
	50	if(gnutls_bye(SSL_P(F), GNUTLS_SHUT_RDWR) == GNUTLS_E_SUCCESS)
	51	break;
	52	}
	53	gnutls_deinit(SSL_P(F));
	54	rb_free(F->ssl);
	55	}
	56
	57	unsigned int
	58	rb_ssl_handshake_count(rb_fde_t *F)
	59	{
	60	return F->handshake_count;
	61	}
	62
	63	void
	64	rb_ssl_clear_handshake_count(rb_fde_t *F)
	65	{
	66	F->handshake_count = 0;
	67	}
	68
	69	static void
	70	rb_ssl_timeout(rb_fde_t F, void notused)
	71	{
	72	lrb_assert(F->accept != NULL);
	73	F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
	74	}
	75
	76
	77	static int
	78	do_ssl_handshake(rb_fde_t F, PF callback)
	79	{
	80	int ret;
	81	int flags;
	82
	83	ret = gnutls_handshake(SSL_P(F));
	84	if(ret < 0)
	85	{
	86	if((ret == GNUTLS_E_INTERRUPTED && rb_ignore_errno(errno)) \|\| ret == GNUTLS_E_AGAIN)
	87	{
	88	if(gnutls_record_get_direction(SSL_P(F)) == 0)
	89	flags = RB_SELECT_READ;
	90	else
	91	flags = RB_SELECT_WRITE;
	92	rb_setselect(F, flags, callback, NULL);
	93	return 0;
	94	}
	95	F->ssl_errno = ret;
	96	return -1;
	97	}
	98	return 1; /* handshake is finished..go about life */
	99	}
	100
	101	static void
	102	rb_ssl_tryaccept(rb_fde_t F, void data)
	103	{
	104	int ret;
	105	struct acceptdata *ad;
	106
	107	lrb_assert(F->accept != NULL);
	108
	109	ret = do_ssl_handshake(F, rb_ssl_tryaccept);
	110
	111	/* do_ssl_handshake does the rb_setselect */
	112	if(ret == 0)
	113	return;
	114
	115	ad = F->accept;
	116	F->accept = NULL;
	117	rb_settimeout(F, 0, NULL, NULL);
	118	rb_setselect(F, RB_SELECT_READ \| RB_SELECT_WRITE, NULL, NULL);
	119
	120	if(ret > 0)
	121	ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
	122	else
	123	ad->callback(F, RB_ERROR_SSL, NULL, 0, ad->data);
	124
	125	rb_free(ad);
	126	}
	127
	128	void
	129	rb_ssl_start_accepted(rb_fde_t new_F, ACCB cb, void *data, int timeout)
	130	{
	131	gnutls_session_t *ssl;
	132	new_F->type \|= RB_FD_SSL;
	133	ssl = new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
	134	new_F->accept = rb_malloc(sizeof(struct acceptdata));
	135
	136	new_F->accept->callback = cb;
	137	new_F->accept->data = data;
	138	rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);
	139
	140	new_F->accept->addrlen = 0;
	141
	142	gnutls_init(ssl, GNUTLS_SERVER);
	143	gnutls_set_default_priority(*ssl);
	144	gnutls_credentials_set(*ssl, GNUTLS_CRD_CERTIFICATE, x509);
	145	gnutls_dh_set_prime_bits(*ssl, 1024);
	146	gnutls_transport_set_ptr(*ssl, (gnutls_transport_ptr_t) (long int)new_F->fd);
	147	if(do_ssl_handshake(new_F, rb_ssl_tryaccept))
	148	{
	149	struct acceptdata *ad = new_F->accept;
	150	new_F->accept = NULL;
	151	ad->callback(new_F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
	152	rb_free(ad);
	153	}
	154
	155	}
	156
	157
	158
	159
	160	void
	161	rb_ssl_accept_setup(rb_fde_t F, rb_fde_t new_F, struct sockaddr *st, int addrlen)
	162	{
	163	new_F->type \|= RB_FD_SSL;
	164	new_F->ssl = rb_malloc(sizeof(gnutls_session_t));
	165	new_F->accept = rb_malloc(sizeof(struct acceptdata));
	166
	167	new_F->accept->callback = F->accept->callback;
	168	new_F->accept->data = F->accept->data;
	169	rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
	170	memcpy(&new_F->accept->S, st, addrlen);
	171	new_F->accept->addrlen = addrlen;
	172
	173	gnutls_init((gnutls_session_t *) new_F->ssl, GNUTLS_SERVER);
	174	gnutls_set_default_priority(SSL_P(new_F));
	175	gnutls_credentials_set(SSL_P(new_F), GNUTLS_CRD_CERTIFICATE, x509);
	176	gnutls_dh_set_prime_bits(SSL_P(new_F), 1024);
	177	gnutls_transport_set_ptr(SSL_P(new_F), (gnutls_transport_ptr_t) (long int)rb_get_fd(new_F));
	178	if(do_ssl_handshake(F, rb_ssl_tryaccept))
	179	{
	180	struct acceptdata *ad = F->accept;
	181	F->accept = NULL;
	182	ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
	183	rb_free(ad);
	184	}
	185	}
	186
	187
	188
	189
	190	static ssize_t
	191	rb_ssl_read_or_write(int r_or_w, rb_fde_t F, void rbuf, const void *wbuf, size_t count)
	192	{
	193	ssize_t ret;
	194	gnutls_session_t *ssl = F->ssl;
	195
	196	if(r_or_w == 0)
	197	ret = gnutls_record_recv(*ssl, rbuf, count);
	198	else
	199	ret = gnutls_record_send(*ssl, wbuf, count);
	200
	201	if(ret < 0)
	202	{
	203	switch (ret)
	204	{
	205	case GNUTLS_E_AGAIN:
	206	case GNUTLS_E_INTERRUPTED:
	207	if(rb_ignore_errno(errno))
	208	{
	209	if(gnutls_record_get_direction(*ssl) == 0)
	210	return RB_RW_SSL_NEED_READ;
	211	else
	212	return RB_RW_SSL_NEED_WRITE;
	213	break;
	214	}
	215	default:
	216	F->ssl_errno = ret;
	217	errno = EIO;
	218	return RB_RW_IO_ERROR;
	219	}
	220	}
	221	return ret;
	222	}
	223
	224	ssize_t
	225	rb_ssl_read(rb_fde_t F, void buf, size_t count)
	226	{
	227	return rb_ssl_read_or_write(0, F, buf, NULL, count);
	228	}
	229
	230	ssize_t
	231	rb_ssl_write(rb_fde_t F, const void buf, size_t count)
	232	{
	233	return rb_ssl_read_or_write(1, F, NULL, buf, count);
	234	}
	235
	236	static void
	237	rb_gcry_random_seed(void *unused)
	238	{
	239	gcry_fast_random_poll();
	240	}
	241
	242	int
	243	rb_init_ssl(void)
	244	{
	245	gnutls_global_init();
	246
	247	if(gnutls_certificate_allocate_credentials(&x509) != GNUTLS_E_SUCCESS)
	248	{
	249	rb_lib_log("rb_init_ssl: Unable to allocate SSL/TLS certificate credentials");
	250	return 0;
	251	}
	252	rb_event_addish("rb_gcry_random_seed", rb_gcry_random_seed, NULL, 300);
	253	return 1;
	254	}
	255
	256	static void
	257	rb_free_datum_t(gnutls_datum_t * d)
	258	{
	259	rb_free(d->data);
	260	rb_free(d);
	261	}
	262
	263	static gnutls_datum_t *
	264	rb_load_file_into_datum_t(const char *file)
	265	{
	266	FILE *f;
	267	gnutls_datum_t *datum;
	268	struct stat fileinfo;
	269	if((f = fopen(file, "r")) == NULL)
	270	return NULL;
	271	if(fstat(fileno(f), &fileinfo))
	272	return NULL;
	273
	274	datum = rb_malloc(sizeof(gnutls_datum_t));
	275
	276	if(fileinfo.st_size > 131072) /* deal with retards */
	277	datum->size = 131072;
	278	else
	279	datum->size = fileinfo.st_size;
	280
	281	datum->data = rb_malloc(datum->size + 1);
	282	fread(datum->data, datum->size, 1, f);
	283	fclose(f);
	284	return datum;
	285	}
	286
	287	int
	288	rb_setup_ssl_server(const char cert, const char keyfile, const char *dhfile)
	289	{
	290	int ret;
	291	gnutls_datum_t d_cert, d_key;
	292	if(cert == NULL)
	293	{
	294	rb_lib_log("rb_setup_ssl_server: No certificate file");
	295	return 0;
	296	}
	297
	298	if((d_cert = rb_load_file_into_datum_t(cert)) == NULL)
	299	{
	300	rb_lib_log("rb_setup_ssl_server: Error loading certificate: %s", strerror(errno));
	301	return 0;
	302	}
	303
	304	if((d_key = rb_load_file_into_datum_t(keyfile)) == NULL)
	305	{
	306	rb_lib_log("rb_setup_ssl_server: Error loading key: %s", strerror(errno));
	307	return 0;
	308	}
	309
	310
	311	if((ret =
	312	gnutls_certificate_set_x509_key_mem(x509, d_cert, d_key,
	313	GNUTLS_X509_FMT_PEM)) != GNUTLS_E_SUCCESS)
	314	{
	315	rb_lib_log("rb_setup_ssl_server: Error loading certificate or key file: %s",
	316	gnutls_strerror(ret));
	317	return 0;
	318	}
	319	rb_free_datum_t(d_cert);
	320	rb_free_datum_t(d_key);
	321
	322	if(dhfile != NULL)
	323	{
	324	if(gnutls_dh_params_init(&dh_params) == GNUTLS_E_SUCCESS)
	325	{
	326	gnutls_datum_t *data;
	327	int xret;
	328	data = rb_load_file_into_datum_t(dhfile);
	329	if(data != NULL)
	330	{
	331	xret = gnutls_dh_params_import_pkcs3(dh_params, data,
	332	GNUTLS_X509_FMT_PEM);
	333	if(xret < 0)
	334	rb_lib_log
	335	("rb_setup_ssl_server: Error parsing DH file: %s\n",
	336	gnutls_strerror(xret));
	337	rb_free_datum_t(data);
	338	}
	339	gnutls_certificate_set_dh_params(x509, dh_params);
	340	}
	341	else
	342	rb_lib_log("rb_setup_ssl_server: Unable to setup DH parameters");
	343	}
	344	return 1;
	345	}
	346
	347	int
	348	rb_ssl_listen(rb_fde_t *F, int backlog)
	349	{
	350	F->type = RB_FD_SOCKET \| RB_FD_LISTEN \| RB_FD_SSL;
	351	return listen(F->fd, backlog);
	352	}
	353
	354	struct ssl_connect
	355	{
	356	CNCB *callback;
	357	void *data;
	358	int timeout;
	359	};
	360
	361	static void
	362	rb_ssl_connect_realcb(rb_fde_t F, int status, struct ssl_connect sconn)
	363	{
	364	F->connect->callback = sconn->callback;
	365	F->connect->data = sconn->data;
	366	rb_free(sconn);
	367	rb_connect_callback(F, status);
	368	}
	369
	370	static void
	371	rb_ssl_tryconn_timeout_cb(rb_fde_t F, void data)
	372	{
	373	rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
	374	}
	375
	376	static void
	377	rb_ssl_tryconn_cb(rb_fde_t F, void data)
	378	{
	379	struct ssl_connect *sconn = data;
	380	int ret;
	381
	382	ret = do_ssl_handshake(F, rb_ssl_tryconn_cb);
	383
	384	switch (ret)
	385	{
	386	case -1:
	387	rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
	388	break;
	389	case 0:
	390	/* do_ssl_handshake does the rb_setselect stuff */
	391	return;
	392	default:
	393	break;
	394
	395
	396	}
	397	rb_ssl_connect_realcb(F, RB_OK, sconn);
	398	}
	399
	400	static void
	401	rb_ssl_tryconn(rb_fde_t F, int status, void data)
	402	{
	403	struct ssl_connect *sconn = data;
	404	if(status != RB_OK)
	405	{
	406	rb_ssl_connect_realcb(F, status, sconn);
	407	return;
	408	}
	409
	410	F->type \|= RB_FD_SSL;
	411
	412
	413	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
	414	F->ssl = rb_malloc(sizeof(gnutls_session_t));
	415	gnutls_init(F->ssl, GNUTLS_CLIENT);
	416	gnutls_set_default_priority(SSL_P(F));
	417	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	418	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
	419
	420	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
	421	{
	422	rb_ssl_connect_realcb(F, RB_OK, sconn);
	423	}
	424	}
	425
	426	void
	427	rb_connect_tcp_ssl(rb_fde_t F, struct sockaddr dest,
	428	struct sockaddr clocal, int socklen, CNCB callback, void *data, int timeout)
	429	{
	430	struct ssl_connect *sconn;
	431	if(F == NULL)
	432	return;
	433
	434	sconn = rb_malloc(sizeof(struct ssl_connect));
	435	sconn->data = data;
	436	sconn->callback = callback;
	437	sconn->timeout = timeout;
	438	rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);
	439
	440	}
	441
	442	void
	443	rb_ssl_start_connected(rb_fde_t F, CNCB callback, void *data, int timeout)
	444	{
	445	struct ssl_connect *sconn;
	446	if(F == NULL)
	447	return;
	448
	449	sconn = rb_malloc(sizeof(struct ssl_connect));
	450	sconn->data = data;
	451	sconn->callback = callback;
	452	sconn->timeout = timeout;
	453	F->connect = rb_malloc(sizeof(struct conndata));
	454	F->connect->callback = callback;
	455	F->connect->data = data;
	456	F->type \|= RB_FD_SSL;
	457	F->ssl = rb_malloc(sizeof(gnutls_session_t));
	458
	459	gnutls_init(F->ssl, GNUTLS_CLIENT);
	460	gnutls_set_default_priority(SSL_P(F));
	461	gnutls_dh_set_prime_bits(SSL_P(F), 1024);
	462	gnutls_transport_set_ptr(SSL_P(F), (gnutls_transport_ptr_t) (long int)F->fd);
	463
	464	rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
	465
	466	if(do_ssl_handshake(F, rb_ssl_tryconn_cb))
	467	{
	468	rb_ssl_connect_realcb(F, RB_OK, sconn);
	469	}
	470	}
	471
	472	int
	473	rb_init_prng(const char *path, prng_seed_t seed_type)
	474	{
	475	gcry_fast_random_poll();
	476	return 1;
	477	}
	478
	479	int
	480	rb_get_random(void *buf, size_t length)
	481	{
	482	gcry_randomize(buf, length, GCRY_STRONG_RANDOM);
	483	return 1;
	484	}
	485
	486	int
	487	rb_get_pseudo_random(void *buf, size_t length)
	488	{
	489	gcry_randomize(buf, length, GCRY_WEAK_RANDOM);
	490	return 1;
	491	}
	492
	493	const char *
	494	rb_get_ssl_strerror(rb_fde_t *F)
	495	{
	496	return gnutls_strerror(F->ssl_errno);
	497	}
	498
	499	int
	500	rb_get_ssl_certfp(rb_fde_t *F, uint8_t certfp[RB_SSL_CERTFP_LEN])
	501	{
	502	/* XXX implement this for gnutls */
	503	return 0;
	504	}
	505
	506	int
	507	rb_supports_ssl(void)
	508	{
	509	return 1;
	510	}
	511
	512	void
	513	rb_get_ssl_info(char *buf, size_t len)
	514	{
	515	rb_snprintf(buf, len, "GNUTLS: compiled (%s), library(%s)",
	516	LIBGNUTLS_VERSION, gnutls_check_version(NULL));
	517	}
	518
	519
	520	#endif /* HAVE_GNUTLS */