libratbox/src/openssl.c

   1 /*
   2  *  libratbox: a library used by ircd-ratbox and other things
   3  *  openssl.c: openssl related code
   4  *
   5  *  Copyright (C) 2007-2008 ircd-ratbox development team
   6  *  Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  21  *  USA
  22  *
  23  *  $Id: commio.c 24808 2008-01-02 08:17:05Z androsyn $
  24  */
  25
  26 #include <libratbox_config.h>
  27 #include <ratbox_lib.h>
  28
  29 #ifdef HAVE_OPENSSL
  30
  31 #include <commio-int.h>
  32 #include <commio-ssl.h>
  33 #include <openssl/ssl.h>
  34 #include <openssl/dh.h>
  35 #include <openssl/err.h>
  36 #include <openssl/rand.h>
  37
  38 static SSL_CTX *ssl_server_ctx;
  39 static SSL_CTX *ssl_client_ctx;
  40 static int libratbox_index = -1;
  41
  42 static unsigned long
  43 get_last_err(void)
  44 {
  45         unsigned long t_err, err = 0;
  46         err = ERR_get_error();
  47         if(err == 0)
  48                 return 0;
  49
  50         while((t_err = ERR_get_error()) > 0)
  51                 err = t_err;
  52
  53         return err;
  54 }
  55
  56 void
  57 rb_ssl_shutdown(rb_fde_t *F)
  58 {
  59         int i;
  60         if(F == NULL || F->ssl == NULL)
  61                 return;
  62         SSL_set_shutdown((SSL *) F->ssl, SSL_RECEIVED_SHUTDOWN);
  63
  64         for(i = 0; i < 4; i++)
  65         {
  66                 if(SSL_shutdown((SSL *) F->ssl))
  67                         break;
  68         }
  69         get_last_err();
  70         SSL_free((SSL *) F->ssl);
  71 }
  72
  73 unsigned int
  74 rb_ssl_handshake_count(rb_fde_t *F)
  75 {
  76         return F->handshake_count;
  77 }
  78
  79 void
  80 rb_ssl_clear_handshake_count(rb_fde_t *F)
  81 {
  82         F->handshake_count = 0;
  83 }
  84
  85 static void
  86 rb_ssl_timeout(rb_fde_t *F, void *notused)
  87 {
  88         lrb_assert(F->accept != NULL);
  89         F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
  90 }
  91
  92
  93 static void
  94 rb_ssl_info_callback(SSL * ssl, int where, int ret)
  95 {
  96         if(where & SSL_CB_HANDSHAKE_START)
  97         {
  98                 rb_fde_t *F = SSL_get_ex_data(ssl, libratbox_index);
  99                 if(F == NULL)
 100                         return;
 101                 F->handshake_count++;
 102         }
 103 }
 104
 105 static void
 106 rb_setup_ssl_cb(rb_fde_t *F)
 107 {
 108         SSL_set_ex_data(F->ssl, libratbox_index, (char *)F);
 109         SSL_set_info_callback((SSL *) F->ssl, (void (*)(const SSL *,int,int))rb_ssl_info_callback);
 110 }
 111
 112 static void
 113 rb_ssl_tryaccept(rb_fde_t *F, void *data)
 114 {
 115         int ssl_err;
 116         lrb_assert(F->accept != NULL);
 117         int flags;
 118         struct acceptdata *ad;
 119
 120         if(!SSL_is_init_finished((SSL *) F->ssl))
 121         {
 122                 if((ssl_err = SSL_accept((SSL *) F->ssl)) <= 0)
 123                 {
 124                         switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 125                         {
 126                         case SSL_ERROR_WANT_READ:
 127                         case SSL_ERROR_WANT_WRITE:
 128                                 if(ssl_err == SSL_ERROR_WANT_WRITE)
 129                                         flags = RB_SELECT_WRITE;
 130                                 else
 131                                         flags = RB_SELECT_READ;
 132                                 F->ssl_errno = get_last_err();
 133                                 rb_setselect(F, flags, rb_ssl_tryaccept, NULL);
 134                                 break;
 135                         case SSL_ERROR_SYSCALL:
 136                                 F->accept->callback(F, RB_ERROR, NULL, 0, F->accept->data);
 137                                 break;
 138                         default:
 139                                 F->ssl_errno = get_last_err();
 140                                 F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
 141                                 break;
 142                         }
 143                         return;
 144                 }
 145         }
 146         rb_settimeout(F, 0, NULL, NULL);
 147         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
 148
 149         ad = F->accept;
 150         F->accept = NULL;
 151         ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
 152         rb_free(ad);
 153
 154 }
 155
 156
 157 static void
 158 rb_ssl_accept_common(rb_fde_t *new_F)
 159 {
 160         int ssl_err;
 161         if((ssl_err = SSL_accept((SSL *) new_F->ssl)) <= 0)
 162         {
 163                 switch (ssl_err = SSL_get_error((SSL *) new_F->ssl, ssl_err))
 164                 {
 165                 case SSL_ERROR_SYSCALL:
 166                         if(rb_ignore_errno(errno))
 167                 case SSL_ERROR_WANT_READ:
 168                 case SSL_ERROR_WANT_WRITE:
 169                                 {
 170                                         new_F->ssl_errno = get_last_err();
 171                                         rb_setselect(new_F, RB_SELECT_READ | RB_SELECT_WRITE,
 172                                                      rb_ssl_tryaccept, NULL);
 173                                         return;
 174                                 }
 175                 default:
 176                         new_F->ssl_errno = get_last_err();
 177                         new_F->accept->callback(new_F, RB_ERROR_SSL, NULL, 0, new_F->accept->data);
 178                         return;
 179                 }
 180         }
 181         else
 182         {
 183                 rb_ssl_tryaccept(new_F, NULL);
 184         }
 185 }
 186
 187 void
 188 rb_ssl_start_accepted(rb_fde_t *new_F, ACCB * cb, void *data, int timeout)
 189 {
 190         new_F->type |= RB_FD_SSL;
 191         new_F->ssl = SSL_new(ssl_server_ctx);
 192         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 193
 194         new_F->accept->callback = cb;
 195         new_F->accept->data = data;
 196         rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);
 197
 198         new_F->accept->addrlen = 0;
 199         SSL_set_fd((SSL *) new_F->ssl, rb_get_fd(new_F));
 200         rb_setup_ssl_cb(new_F);
 201         rb_ssl_accept_common(new_F);
 202 }
 203
 204
 205
 206
 207 void
 208 rb_ssl_accept_setup(rb_fde_t *F, rb_fde_t *new_F, struct sockaddr *st, int addrlen)
 209 {
 210         new_F->type |= RB_FD_SSL;
 211         new_F->ssl = SSL_new(ssl_server_ctx);
 212         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 213
 214         new_F->accept->callback = F->accept->callback;
 215         new_F->accept->data = F->accept->data;
 216         rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
 217         memcpy(&new_F->accept->S, st, addrlen);
 218         new_F->accept->addrlen = addrlen;
 219
 220         SSL_set_fd((SSL *) new_F->ssl, rb_get_fd(new_F));
 221         rb_setup_ssl_cb(new_F);
 222         rb_ssl_accept_common(new_F);
 223 }
 224
 225 static ssize_t
 226 rb_ssl_read_or_write(int r_or_w, rb_fde_t *F, void *rbuf, const void *wbuf, size_t count)
 227 {
 228         ssize_t ret;
 229         unsigned long err;
 230         SSL *ssl = F->ssl;
 231
 232         if(r_or_w == 0)
 233                 ret = (ssize_t) SSL_read(ssl, rbuf, (int)count);
 234         else
 235                 ret = (ssize_t) SSL_write(ssl, wbuf, (int)count);
 236
 237         if(ret < 0)
 238         {
 239                 switch (SSL_get_error(ssl, ret))
 240                 {
 241                 case SSL_ERROR_WANT_READ:
 242                         errno = EAGAIN;
 243                         return RB_RW_SSL_NEED_READ;
 244                 case SSL_ERROR_WANT_WRITE:
 245                         errno = EAGAIN;
 246                         return RB_RW_SSL_NEED_WRITE;
 247                 case SSL_ERROR_ZERO_RETURN:
 248                         return 0;
 249                 case SSL_ERROR_SYSCALL:
 250                         err = get_last_err();
 251                         if(err == 0)
 252                         {
 253                                 F->ssl_errno = 0;
 254                                 return RB_RW_IO_ERROR;
 255                         }
 256                         break;
 257                 default:
 258                         err = get_last_err();
 259                         break;
 260                 }
 261                 F->ssl_errno = err;
 262                 if(err > 0)
 263                 {
 264                         errno = EIO;    /* not great but... */
 265                         return RB_RW_SSL_ERROR;
 266                 }
 267                 return RB_RW_IO_ERROR;
 268         }
 269         return ret;
 270 }
 271
 272 ssize_t
 273 rb_ssl_read(rb_fde_t *F, void *buf, size_t count)
 274 {
 275         return rb_ssl_read_or_write(0, F, buf, NULL, count);
 276 }
 277
 278 ssize_t
 279 rb_ssl_write(rb_fde_t *F, const void *buf, size_t count)
 280 {
 281         return rb_ssl_read_or_write(1, F, NULL, buf, count);
 282 }
 283
 284 static int
 285 verify_accept_all_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
 286 {
 287         return 1;
 288 }
 289
 290 static const char *
 291 get_ssl_error(unsigned long err)
 292 {
 293         static char buf[512];
 294
 295         ERR_error_string_n(err, buf, sizeof buf);
 296         return buf;
 297 }
 298
 299 int
 300 rb_init_ssl(void)
 301 {
 302         int ret = 1;
 303         char libratbox_data[] = "libratbox data";
 304         SSL_load_error_strings();
 305         SSL_library_init();
 306         libratbox_index = SSL_get_ex_new_index(0, libratbox_data, NULL, NULL, NULL);
 307         ssl_server_ctx = SSL_CTX_new(SSLv23_server_method());
 308         if(ssl_server_ctx == NULL)
 309         {
 310                 rb_lib_log("rb_init_openssl: Unable to initialize OpenSSL server context: %s",
 311                            get_ssl_error(ERR_get_error()));
 312                 ret = 0;
 313         }
 314         /* Disable SSLv2, make the client use our settings */
 315         SSL_CTX_set_options(ssl_server_ctx, SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE);
 316         SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb);
 317
 318         ssl_client_ctx = SSL_CTX_new(TLSv1_client_method());
 319
 320         if(ssl_client_ctx == NULL)
 321         {
 322                 rb_lib_log("rb_init_openssl: Unable to initialize OpenSSL client context: %s",
 323                            get_ssl_error(ERR_get_error()));
 324                 ret = 0;
 325         }
 326         return ret;
 327 }
 328
 329
 330 int
 331 rb_setup_ssl_server(const char *cert, const char *keyfile, const char *dhfile)
 332 {
 333         DH *dh;
 334         unsigned long err;
 335         if(cert == NULL)
 336         {
 337                 rb_lib_log("rb_setup_ssl_server: No certificate file");
 338                 return 0;
 339         }
 340         if(!SSL_CTX_use_certificate_chain_file(ssl_server_ctx, cert) || !SSL_CTX_use_certificate_chain_file(ssl_client_ctx, cert))
 341         {
 342                 err = ERR_get_error();
 343                 rb_lib_log("rb_setup_ssl_server: Error loading certificate file [%s]: %s", cert,
 344                            get_ssl_error(err));
 345                 return 0;
 346         }
 347
 348         if(keyfile == NULL)
 349         {
 350                 rb_lib_log("rb_setup_ssl_server: No key file");
 351                 return 0;
 352         }
 353
 354
 355         if(!SSL_CTX_use_PrivateKey_file(ssl_server_ctx, keyfile, SSL_FILETYPE_PEM) || !SSL_CTX_use_PrivateKey_file(ssl_client_ctx, keyfile, SSL_FILETYPE_PEM))
 356         {
 357                 err = ERR_get_error();
 358                 rb_lib_log("rb_setup_ssl_server: Error loading keyfile [%s]: %s", keyfile,
 359                            get_ssl_error(err));
 360                 return 0;
 361         }
 362
 363         if(dhfile != NULL)
 364         {
 365                 /* DH parameters aren't necessary, but they are nice..if they didn't pass one..that is their problem */
 366                 BIO *bio = BIO_new_file(dhfile, "r");
 367                 if(bio != NULL)
 368                 {
 369                         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
 370                         if(dh == NULL)
 371                         {
 372                                 err = ERR_get_error();
 373                                 rb_lib_log
 374                                         ("rb_setup_ssl_server: Error loading DH params file [%s]: %s",
 375                                          dhfile, get_ssl_error(err));
 376                                 BIO_free(bio);
 377                                 return 0;
 378                         }
 379                         BIO_free(bio);
 380                         SSL_CTX_set_tmp_dh(ssl_server_ctx, dh);
 381                 }
 382                 else
 383                 {
 384                         err = ERR_get_error();
 385                         rb_lib_log("rb_setup_ssl_server: Error loading DH params file [%s]: %s",
 386                                    dhfile, get_ssl_error(err));
 387                 }
 388         }
 389         return 1;
 390 }
 391
 392 int
 393 rb_ssl_listen(rb_fde_t *F, int backlog, int defer_accept)
 394 {
 395         int result;
 396
 397         result = rb_listen(F, backlog, defer_accept);
 398         F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
 399
 400         return result;
 401 }
 402
 403 struct ssl_connect
 404 {
 405         CNCB *callback;
 406         void *data;
 407         int timeout;
 408 };
 409
 410 static void
 411 rb_ssl_connect_realcb(rb_fde_t *F, int status, struct ssl_connect *sconn)
 412 {
 413         F->connect->callback = sconn->callback;
 414         F->connect->data = sconn->data;
 415         rb_free(sconn);
 416         rb_connect_callback(F, status);
 417 }
 418
 419 static void
 420 rb_ssl_tryconn_timeout_cb(rb_fde_t *F, void *data)
 421 {
 422         rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
 423 }
 424
 425 static void
 426 rb_ssl_tryconn_cb(rb_fde_t *F, void *data)
 427 {
 428         struct ssl_connect *sconn = data;
 429         int ssl_err;
 430         if(!SSL_is_init_finished((SSL *) F->ssl))
 431         {
 432                 if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 433                 {
 434                         switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 435                         {
 436                         case SSL_ERROR_SYSCALL:
 437                                 if(rb_ignore_errno(errno))
 438                         case SSL_ERROR_WANT_READ:
 439                         case SSL_ERROR_WANT_WRITE:
 440                                         {
 441                                                 F->ssl_errno = get_last_err();
 442                                                 rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 443                                                              rb_ssl_tryconn_cb, sconn);
 444                                                 return;
 445                                         }
 446                         default:
 447                                 F->ssl_errno = get_last_err();
 448                                 rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 449                                 return;
 450                         }
 451                 }
 452                 else
 453                 {
 454                         rb_ssl_connect_realcb(F, RB_OK, sconn);
 455                 }
 456         }
 457 }
 458
 459 static void
 460 rb_ssl_tryconn(rb_fde_t *F, int status, void *data)
 461 {
 462         struct ssl_connect *sconn = data;
 463         int ssl_err;
 464         if(status != RB_OK)
 465         {
 466                 rb_ssl_connect_realcb(F, status, sconn);
 467                 return;
 468         }
 469
 470         F->type |= RB_FD_SSL;
 471         F->ssl = SSL_new(ssl_client_ctx);
 472         SSL_set_fd((SSL *) F->ssl, F->fd);
 473         rb_setup_ssl_cb(F);
 474         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 475         if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 476         {
 477                 switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 478                 {
 479                 case SSL_ERROR_SYSCALL:
 480                         if(rb_ignore_errno(errno))
 481                 case SSL_ERROR_WANT_READ:
 482                 case SSL_ERROR_WANT_WRITE:
 483                                 {
 484                                         F->ssl_errno = get_last_err();
 485                                         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 486                                                      rb_ssl_tryconn_cb, sconn);
 487                                         return;
 488                                 }
 489                 default:
 490                         F->ssl_errno = get_last_err();
 491                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 492                         return;
 493                 }
 494         }
 495         else
 496         {
 497                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 498         }
 499 }
 500
 501 void
 502 rb_connect_tcp_ssl(rb_fde_t *F, struct sockaddr *dest,
 503                    struct sockaddr *clocal, int socklen, CNCB * callback, void *data, int timeout)
 504 {
 505         struct ssl_connect *sconn;
 506         if(F == NULL)
 507                 return;
 508
 509         sconn = rb_malloc(sizeof(struct ssl_connect));
 510         sconn->data = data;
 511         sconn->callback = callback;
 512         sconn->timeout = timeout;
 513         rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);
 514
 515 }
 516
 517 void
 518 rb_ssl_start_connected(rb_fde_t *F, CNCB * callback, void *data, int timeout)
 519 {
 520         struct ssl_connect *sconn;
 521         int ssl_err;
 522         if(F == NULL)
 523                 return;
 524
 525         sconn = rb_malloc(sizeof(struct ssl_connect));
 526         sconn->data = data;
 527         sconn->callback = callback;
 528         sconn->timeout = timeout;
 529         F->connect = rb_malloc(sizeof(struct conndata));
 530         F->connect->callback = callback;
 531         F->connect->data = data;
 532         F->type |= RB_FD_SSL;
 533         F->ssl = SSL_new(ssl_client_ctx);
 534
 535         SSL_set_fd((SSL *) F->ssl, F->fd);
 536         rb_setup_ssl_cb(F);
 537         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 538         if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 539         {
 540                 switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 541                 {
 542                 case SSL_ERROR_SYSCALL:
 543                         if(rb_ignore_errno(errno))
 544                 case SSL_ERROR_WANT_READ:
 545                 case SSL_ERROR_WANT_WRITE:
 546                                 {
 547                                         F->ssl_errno = get_last_err();
 548                                         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 549                                                      rb_ssl_tryconn_cb, sconn);
 550                                         return;
 551                                 }
 552                 default:
 553                         F->ssl_errno = get_last_err();
 554                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 555                         return;
 556                 }
 557         }
 558         else
 559         {
 560                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 561         }
 562 }
 563
 564 int
 565 rb_init_prng(const char *path, prng_seed_t seed_type)
 566 {
 567         if(seed_type == RB_PRNG_DEFAULT)
 568         {
 569 #ifdef _WIN32
 570                 RAND_screen();
 571 #endif
 572                 return RAND_status();
 573         }
 574         if(path == NULL)
 575                 return RAND_status();
 576
 577         switch (seed_type)
 578         {
 579         case RB_PRNG_EGD:
 580                 if(RAND_egd(path) == -1)
 581                         return -1;
 582                 break;
 583         case RB_PRNG_FILE:
 584                 if(RAND_load_file(path, -1) == -1)
 585                         return -1;
 586                 break;
 587 #ifdef _WIN32
 588         case RB_PRNGWIN32:
 589                 RAND_screen();
 590                 break;
 591 #endif
 592         default:
 593                 return -1;
 594         }
 595
 596         return RAND_status();
 597 }
 598
 599 int
 600 rb_get_random(void *buf, size_t length)
 601 {
 602         int ret;
 603
 604         if((ret = RAND_bytes(buf, length)) == 0)
 605         {
 606                 /* remove the error from the queue */
 607                 ERR_get_error();
 608         }
 609         return ret;
 610 }
 611
 612 int
 613 rb_get_pseudo_random(void *buf, size_t length)
 614 {
 615         int ret;
 616         ret = RAND_pseudo_bytes(buf, length);
 617         if(ret < 0)
 618                 return 0;
 619         return 1;
 620 }
 621
 622 const char *
 623 rb_get_ssl_strerror(rb_fde_t *F)
 624 {
 625         return get_ssl_error(F->ssl_errno);
 626 }
 627
 628 int
 629 rb_get_ssl_certfp(rb_fde_t *F, uint8_t certfp[RB_SSL_CERTFP_LEN])
 630 {
 631         X509 *cert;
 632         int res;
 633
 634         if (F->ssl == NULL)
 635                 return 0;
 636
 637         cert = SSL_get_peer_certificate((SSL *) F->ssl);
 638         if(cert != NULL)
 639         {
 640                 res = SSL_get_verify_result((SSL *) F->ssl);
 641                 if(res == X509_V_OK ||
 642                                 res == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN ||
 643                                 res == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE ||
 644                                 res == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
 645                 {
 646                         memcpy(certfp, cert->sha1_hash, RB_SSL_CERTFP_LEN);
 647                         X509_free(cert);
 648                         return 1;
 649                 }
 650                 X509_free(cert);
 651         }
 652
 653         return 0;
 654 }
 655
 656 int
 657 rb_supports_ssl(void)
 658 {
 659         return 1;
 660 }
 661
 662 void
 663 rb_get_ssl_info(char *buf, size_t len)
 664 {
 665         rb_snprintf(buf, len, "Using SSL: %s compiled: 0x%lx, library 0x%lx",
 666                     SSLeay_version(SSLEAY_VERSION),
 667                     (long)OPENSSL_VERSION_NUMBER, SSLeay());
 668 }
 669
 670
 671 #endif /* HAVE_OPESSL */