[READ-ONLY] Mirror of https://github.com/VibeDevelopers/Comet.
MbedTLS 3.x support
+515
-509
+1
-1
README.md
+1
-1
README.md
···
37
37
# building
38
38
39
39
```bash
40
-
sudo apt install build-essential pkg-config meson ninja-build libsqlite3-dev flex bison # or equivalent for your distribution
40
+
sudo apt install build-essential pkg-config meson ninja-build libsqlite3-dev flex bison make libltdl-dev libssl-dev # or equivalent for your distribution
41
41
meson setup build --optimization 2 --prefix=/path/to/installation
42
42
meson compile -C build/
43
43
meson test -C build/
+512
-507
librb/src/mbedtls.c
+512
-507
librb/src/mbedtls.c
···
37
37
38
38
typedef enum
39
39
{
40
-
RB_FD_TLS_DIRECTION_IN = 0,
41
-
RB_FD_TLS_DIRECTION_OUT = 1
40
+
RB_FD_TLS_DIRECTION_IN = 0,
41
+
RB_FD_TLS_DIRECTION_OUT = 1
42
42
} rb_fd_tls_direction;
43
43
44
44
#define RB_MAX_CIPHERSUITES 512
45
45
46
46
typedef struct
47
47
{
48
-
mbedtls_x509_crt crt;
49
-
mbedtls_pk_context key;
50
-
mbedtls_dhm_context dhp;
51
-
mbedtls_ssl_config server_cfg;
52
-
mbedtls_ssl_config client_cfg;
53
-
size_t refcount;
54
-
int suites[RB_MAX_CIPHERSUITES + 1];
48
+
mbedtls_x509_crt crt;
49
+
mbedtls_pk_context key;
50
+
mbedtls_dhm_context dhp;
51
+
mbedtls_ssl_config server_cfg;
52
+
mbedtls_ssl_config client_cfg;
53
+
size_t refcount;
54
+
int suites[RB_MAX_CIPHERSUITES + 1];
55
55
} rb_mbedtls_cfg_context;
56
56
57
57
typedef struct
58
58
{
59
-
rb_mbedtls_cfg_context *cfg;
60
-
mbedtls_ssl_context ssl;
59
+
rb_mbedtls_cfg_context *cfg;
60
+
mbedtls_ssl_context ssl;
61
61
} rb_mbedtls_ssl_context;
62
62
63
63
#define SSL_C(x) ((rb_mbedtls_ssl_context *) (x)->ssl)->cfg
···
73
73
74
74
struct ssl_connect
75
75
{
76
-
CNCB *callback;
77
-
void *data;
78
-
int timeout;
76
+
CNCB *callback;
77
+
void *data;
78
+
int timeout;
79
79
};
80
80
81
81
static const char *rb_ssl_strerror(int);
···
90
90
static void
91
91
rb_mbedtls_cfg_incref(rb_mbedtls_cfg_context *const cfg)
92
92
{
93
-
lrb_assert(cfg->refcount > 0);
93
+
lrb_assert(cfg->refcount > 0);
94
94
95
-
cfg->refcount++;
95
+
cfg->refcount++;
96
96
}
97
97
98
98
static void
99
99
rb_mbedtls_cfg_decref(rb_mbedtls_cfg_context *const cfg)
100
100
{
101
-
if(cfg == NULL)
102
-
return;
101
+
if(cfg == NULL)
102
+
return;
103
103
104
-
lrb_assert(cfg->refcount > 0);
104
+
lrb_assert(cfg->refcount > 0);
105
105
106
-
if((--cfg->refcount) > 0)
107
-
return;
106
+
if((--cfg->refcount) > 0)
107
+
return;
108
108
109
-
mbedtls_ssl_config_free(&cfg->client_cfg);
110
-
mbedtls_ssl_config_free(&cfg->server_cfg);
111
-
mbedtls_dhm_free(&cfg->dhp);
112
-
mbedtls_pk_free(&cfg->key);
113
-
mbedtls_x509_crt_free(&cfg->crt);
109
+
mbedtls_ssl_config_free(&cfg->client_cfg);
110
+
mbedtls_ssl_config_free(&cfg->server_cfg);
111
+
mbedtls_dhm_free(&cfg->dhp);
112
+
mbedtls_pk_free(&cfg->key);
113
+
mbedtls_x509_crt_free(&cfg->crt);
114
114
115
-
rb_free(cfg);
115
+
rb_free(cfg);
116
116
}
117
117
118
118
static int
119
119
rb_sock_net_recv(void *const context_ptr, unsigned char *const buf, const size_t count)
120
120
{
121
-
const int fd = rb_get_fd((rb_fde_t *)context_ptr);
121
+
const int fd = rb_get_fd((rb_fde_t *)context_ptr);
122
122
123
-
const int ret = (int) read(fd, buf, count);
123
+
const int ret = (int) read(fd, buf, count);
124
124
125
-
if(ret < 0 && rb_ignore_errno(errno))
126
-
return MBEDTLS_ERR_SSL_WANT_READ;
125
+
if(ret < 0 && rb_ignore_errno(errno))
126
+
return MBEDTLS_ERR_SSL_WANT_READ;
127
127
128
-
return ret;
128
+
return ret;
129
129
}
130
130
131
131
static int
132
132
rb_sock_net_xmit(void *const context_ptr, const unsigned char *const buf, const size_t count)
133
133
{
134
-
const int fd = rb_get_fd((rb_fde_t *)context_ptr);
134
+
const int fd = rb_get_fd((rb_fde_t *)context_ptr);
135
135
136
-
const int ret = (int) write(fd, buf, count);
136
+
const int ret = (int) write(fd, buf, count);
137
137
138
-
if(ret < 0 && rb_ignore_errno(errno))
139
-
return MBEDTLS_ERR_SSL_WANT_WRITE;
138
+
if(ret < 0 && rb_ignore_errno(errno))
139
+
return MBEDTLS_ERR_SSL_WANT_WRITE;
140
140
141
-
return ret;
141
+
return ret;
142
142
}
143
143
144
144
static void
145
145
rb_ssl_init_fd(rb_fde_t *const F, const rb_fd_tls_direction dir)
146
146
{
147
-
rb_mbedtls_ssl_context *const mbed_ssl_ctx = rb_malloc(sizeof *mbed_ssl_ctx);
147
+
rb_mbedtls_ssl_context *const mbed_ssl_ctx = rb_malloc(sizeof *mbed_ssl_ctx);
148
148
149
-
if(mbed_ssl_ctx == NULL)
150
-
{
151
-
rb_lib_log("%s: rb_malloc: allocation failure", __func__);
152
-
rb_close(F);
153
-
return;
154
-
}
149
+
if(mbed_ssl_ctx == NULL)
150
+
{
151
+
rb_lib_log("%s: rb_malloc: allocation failure", __func__);
152
+
rb_close(F);
153
+
return;
154
+
}
155
155
156
-
mbedtls_ssl_config *mbed_config = NULL;
156
+
mbedtls_ssl_config *mbed_config = NULL;
157
157
158
-
switch(dir)
159
-
{
160
-
case RB_FD_TLS_DIRECTION_IN:
161
-
mbed_config = &rb_mbedtls_cfg->server_cfg;
162
-
break;
163
-
case RB_FD_TLS_DIRECTION_OUT:
164
-
mbed_config = &rb_mbedtls_cfg->client_cfg;
165
-
break;
166
-
}
158
+
switch(dir)
159
+
{
160
+
case RB_FD_TLS_DIRECTION_IN:
161
+
mbed_config = &rb_mbedtls_cfg->server_cfg;
162
+
break;
163
+
case RB_FD_TLS_DIRECTION_OUT:
164
+
mbed_config = &rb_mbedtls_cfg->client_cfg;
165
+
break;
166
+
}
167
167
168
-
mbedtls_ssl_init(&mbed_ssl_ctx->ssl);
168
+
mbedtls_ssl_init(&mbed_ssl_ctx->ssl);
169
169
170
-
int ret;
170
+
int ret;
171
171
172
-
if((ret = mbedtls_ssl_setup(&mbed_ssl_ctx->ssl, mbed_config)) != 0)
173
-
{
174
-
rb_lib_log("%s: ssl_setup: %s", __func__, rb_ssl_strerror(ret));
175
-
mbedtls_ssl_free(&mbed_ssl_ctx->ssl);
176
-
rb_free(mbed_ssl_ctx);
177
-
rb_close(F);
178
-
return;
179
-
}
172
+
if((ret = mbedtls_ssl_setup(&mbed_ssl_ctx->ssl, mbed_config)) != 0)
173
+
{
174
+
rb_lib_log("%s: ssl_setup: %s", __func__, rb_ssl_strerror(ret));
175
+
mbedtls_ssl_free(&mbed_ssl_ctx->ssl);
176
+
rb_free(mbed_ssl_ctx);
177
+
rb_close(F);
178
+
return;
179
+
}
180
180
181
-
mbedtls_ssl_set_bio(&mbed_ssl_ctx->ssl, F, rb_sock_net_xmit, rb_sock_net_recv, NULL);
181
+
mbedtls_ssl_set_bio(&mbed_ssl_ctx->ssl, F, rb_sock_net_xmit, rb_sock_net_recv, NULL);
182
182
183
-
rb_mbedtls_cfg_incref(rb_mbedtls_cfg);
184
-
mbed_ssl_ctx->cfg = rb_mbedtls_cfg;
183
+
rb_mbedtls_cfg_incref(rb_mbedtls_cfg);
184
+
mbed_ssl_ctx->cfg = rb_mbedtls_cfg;
185
185
186
-
F->ssl = mbed_ssl_ctx;
186
+
F->ssl = mbed_ssl_ctx;
187
187
}
188
188
189
189
static rb_mbedtls_cfg_context *
190
190
rb_mbedtls_cfg_new(void)
191
191
{
192
-
rb_mbedtls_cfg_context *const cfg = rb_malloc(sizeof *cfg);
192
+
rb_mbedtls_cfg_context *const cfg = rb_malloc(sizeof *cfg);
193
193
194
-
if(cfg == NULL)
195
-
return NULL;
194
+
if(cfg == NULL)
195
+
return NULL;
196
196
197
-
mbedtls_x509_crt_init(&cfg->crt);
198
-
mbedtls_pk_init(&cfg->key);
199
-
mbedtls_dhm_init(&cfg->dhp);
200
-
mbedtls_ssl_config_init(&cfg->server_cfg);
201
-
mbedtls_ssl_config_init(&cfg->client_cfg);
197
+
mbedtls_x509_crt_init(&cfg->crt);
198
+
mbedtls_pk_init(&cfg->key);
199
+
mbedtls_dhm_init(&cfg->dhp);
200
+
mbedtls_ssl_config_init(&cfg->server_cfg);
201
+
mbedtls_ssl_config_init(&cfg->client_cfg);
202
202
203
-
(void) memset(cfg->suites, 0x00, sizeof cfg->suites);
203
+
(void) memset(cfg->suites, 0x00, sizeof cfg->suites);
204
204
205
-
cfg->refcount = 1;
205
+
cfg->refcount = 1;
206
206
207
-
int ret;
207
+
int ret;
208
208
209
-
if((ret = mbedtls_ssl_config_defaults(&cfg->server_cfg,
210
-
MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_STREAM,
211
-
MBEDTLS_SSL_PRESET_DEFAULT)) != 0)
212
-
{
213
-
rb_lib_log("%s: ssl_config_defaults (server): %s", __func__, rb_ssl_strerror(ret));
214
-
rb_mbedtls_cfg_decref(cfg);
215
-
return NULL;
216
-
}
209
+
if((ret = mbedtls_ssl_config_defaults(&cfg->server_cfg,
210
+
MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_STREAM,
211
+
MBEDTLS_SSL_PRESET_DEFAULT)) != 0)
212
+
{
213
+
rb_lib_log("%s: ssl_config_defaults (server): %s", __func__, rb_ssl_strerror(ret));
214
+
rb_mbedtls_cfg_decref(cfg);
215
+
return NULL;
216
+
}
217
217
218
-
if((ret = mbedtls_ssl_config_defaults(&cfg->client_cfg,
219
-
MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM,
220
-
MBEDTLS_SSL_PRESET_DEFAULT)) != 0)
221
-
{
222
-
rb_lib_log("%s: ssl_config_defaults (client): %s", __func__, rb_ssl_strerror(ret));
223
-
rb_mbedtls_cfg_decref(cfg);
224
-
return NULL;
225
-
}
218
+
if((ret = mbedtls_ssl_config_defaults(&cfg->client_cfg,
219
+
MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM,
220
+
MBEDTLS_SSL_PRESET_DEFAULT)) != 0)
221
+
{
222
+
rb_lib_log("%s: ssl_config_defaults (client): %s", __func__, rb_ssl_strerror(ret));
223
+
rb_mbedtls_cfg_decref(cfg);
224
+
return NULL;
225
+
}
226
226
227
-
mbedtls_ssl_conf_rng(&cfg->server_cfg, mbedtls_ctr_drbg_random, &ctr_drbg_ctx);
228
-
mbedtls_ssl_conf_rng(&cfg->client_cfg, mbedtls_ctr_drbg_random, &ctr_drbg_ctx);
227
+
mbedtls_ssl_conf_rng(&cfg->server_cfg, mbedtls_ctr_drbg_random, &ctr_drbg_ctx);
228
+
mbedtls_ssl_conf_rng(&cfg->client_cfg, mbedtls_ctr_drbg_random, &ctr_drbg_ctx);
229
229
230
-
mbedtls_ssl_conf_ca_chain(&cfg->server_cfg, &dummy_ca_ctx, NULL);
231
-
mbedtls_ssl_conf_ca_chain(&cfg->client_cfg, &dummy_ca_ctx, NULL);
230
+
mbedtls_ssl_conf_ca_chain(&cfg->server_cfg, &dummy_ca_ctx, NULL);
231
+
mbedtls_ssl_conf_ca_chain(&cfg->client_cfg, &dummy_ca_ctx, NULL);
232
232
233
-
mbedtls_ssl_conf_authmode(&cfg->server_cfg, MBEDTLS_SSL_VERIFY_OPTIONAL);
234
-
mbedtls_ssl_conf_authmode(&cfg->client_cfg, MBEDTLS_SSL_VERIFY_NONE);
233
+
mbedtls_ssl_conf_authmode(&cfg->server_cfg, MBEDTLS_SSL_VERIFY_OPTIONAL);
234
+
mbedtls_ssl_conf_authmode(&cfg->client_cfg, MBEDTLS_SSL_VERIFY_NONE);
235
235
236
-
mbedtls_ssl_conf_min_version(&cfg->server_cfg, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_1);
237
-
mbedtls_ssl_conf_min_version(&cfg->client_cfg, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_1);
236
+
mbedtls_ssl_conf_min_version(&cfg->server_cfg, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_1);
237
+
mbedtls_ssl_conf_min_version(&cfg->client_cfg, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_1);
238
238
239
-
#ifdef MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE
240
-
mbedtls_ssl_conf_legacy_renegotiation(&cfg->client_cfg, MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE);
241
-
#endif
239
+
#ifdef MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE
240
+
mbedtls_ssl_conf_legacy_renegotiation(&cfg->client_cfg, MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE);
241
+
#endif
242
242
243
-
#ifdef MBEDTLS_SSL_SESSION_TICKETS_DISABLED
244
-
mbedtls_ssl_conf_session_tickets(&cfg->client_cfg, MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
245
-
#endif
243
+
#ifdef MBEDTLS_SSL_SESSION_TICKETS_DISABLED
244
+
mbedtls_ssl_conf_session_tickets(&cfg->client_cfg, MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
245
+
#endif
246
246
247
-
return cfg;
247
+
return cfg;
248
248
}
249
249
250
250
static void
251
251
rb_ssl_accept_common(rb_fde_t *const F, void *const data)
252
252
{
253
-
lrb_assert(F != NULL);
254
-
lrb_assert(F->accept != NULL);
255
-
lrb_assert(F->accept->callback != NULL);
256
-
lrb_assert(F->ssl != NULL);
253
+
lrb_assert(F != NULL);
254
+
lrb_assert(F->accept != NULL);
255
+
lrb_assert(F->accept->callback != NULL);
256
+
lrb_assert(F->ssl != NULL);
257
257
258
-
(void) data;
258
+
(void) data;
259
259
260
-
const int ret = mbedtls_ssl_handshake(SSL_P(F));
260
+
const int ret = mbedtls_ssl_handshake(SSL_P(F));
261
261
262
-
switch(ret)
263
-
{
264
-
case 0:
265
-
F->handshake_count++;
266
-
break;
267
-
case MBEDTLS_ERR_SSL_WANT_READ:
268
-
rb_setselect(F, RB_SELECT_READ, rb_ssl_accept_common, NULL);
269
-
return;
270
-
case MBEDTLS_ERR_SSL_WANT_WRITE:
271
-
rb_setselect(F, RB_SELECT_WRITE, rb_ssl_accept_common, NULL);
272
-
return;
273
-
default:
274
-
errno = EIO;
275
-
F->ssl_errno = (unsigned long) -ret;
276
-
F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
277
-
return;
278
-
}
262
+
switch(ret)
263
+
{
264
+
case 0:
265
+
F->handshake_count++;
266
+
break;
267
+
case MBEDTLS_ERR_SSL_WANT_READ:
268
+
rb_setselect(F, RB_SELECT_READ, rb_ssl_accept_common, NULL);
269
+
return;
270
+
case MBEDTLS_ERR_SSL_WANT_WRITE:
271
+
rb_setselect(F, RB_SELECT_WRITE, rb_ssl_accept_common, NULL);
272
+
return;
273
+
default:
274
+
errno = EIO;
275
+
F->ssl_errno = (unsigned long) -ret;
276
+
F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
277
+
return;
278
+
}
279
279
280
-
rb_settimeout(F, 0, NULL, NULL);
281
-
rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
280
+
rb_settimeout(F, 0, NULL, NULL);
281
+
rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
282
282
283
-
struct acceptdata *const ad = F->accept;
284
-
F->accept = NULL;
285
-
ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
286
-
rb_free(ad);
283
+
struct acceptdata *const ad = F->accept;
284
+
F->accept = NULL;
285
+
ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
286
+
rb_free(ad);
287
287
}
288
288
289
289
static void
290
290
rb_ssl_connect_common(rb_fde_t *const F, void *const data)
291
291
{
292
-
lrb_assert(F != NULL);
293
-
lrb_assert(F->ssl != NULL);
292
+
lrb_assert(F != NULL);
293
+
lrb_assert(F->ssl != NULL);
294
294
295
-
const int ret = mbedtls_ssl_handshake(SSL_P(F));
295
+
const int ret = mbedtls_ssl_handshake(SSL_P(F));
296
296
297
-
switch(ret)
298
-
{
299
-
case 0:
300
-
F->handshake_count++;
301
-
break;
302
-
case MBEDTLS_ERR_SSL_WANT_READ:
303
-
rb_setselect(F, RB_SELECT_READ, rb_ssl_connect_common, data);
304
-
return;
305
-
case MBEDTLS_ERR_SSL_WANT_WRITE:
306
-
rb_setselect(F, RB_SELECT_WRITE, rb_ssl_connect_common, data);
307
-
return;
308
-
default:
309
-
errno = EIO;
310
-
F->ssl_errno = (unsigned long) -ret;
311
-
rb_ssl_connect_realcb(F, RB_ERROR_SSL, data);
312
-
return;
313
-
}
297
+
switch(ret)
298
+
{
299
+
case 0:
300
+
F->handshake_count++;
301
+
break;
302
+
case MBEDTLS_ERR_SSL_WANT_READ:
303
+
rb_setselect(F, RB_SELECT_READ, rb_ssl_connect_common, data);
304
+
return;
305
+
case MBEDTLS_ERR_SSL_WANT_WRITE:
306
+
rb_setselect(F, RB_SELECT_WRITE, rb_ssl_connect_common, data);
307
+
return;
308
+
default:
309
+
errno = EIO;
310
+
F->ssl_errno = (unsigned long) -ret;
311
+
rb_ssl_connect_realcb(F, RB_ERROR_SSL, data);
312
+
return;
313
+
}
314
314
315
-
rb_ssl_connect_realcb(F, RB_OK, data);
315
+
rb_ssl_connect_realcb(F, RB_OK, data);
316
316
}
317
317
318
318
static const char *
319
319
rb_ssl_strerror(int err)
320
320
{
321
-
static char errbuf[512];
321
+
static char errbuf[512];
322
322
323
-
if (err < 0)
324
-
err = -err;
323
+
if (err < 0)
324
+
err = -err;
325
325
326
326
#ifdef MBEDTLS_ERROR_C
327
-
char mbed_errbuf[512];
328
-
mbedtls_strerror(err, mbed_errbuf, sizeof mbed_errbuf);
329
-
(void) snprintf(errbuf, sizeof errbuf, "-0x%X: %s", (unsigned int) err, mbed_errbuf);
327
+
char mbed_errbuf[512];
328
+
mbedtls_strerror(err, mbed_errbuf, sizeof mbed_errbuf);
329
+
(void) snprintf(errbuf, sizeof errbuf, "-0x%X: %s", (unsigned int) err, mbed_errbuf);
330
330
#else
331
-
(void) snprintf(errbuf, sizeof errbuf, "-0x%X", (unsigned int) err);
331
+
(void) snprintf(errbuf, sizeof errbuf, "-0x%X", (unsigned int) err);
332
332
#endif
333
333
334
-
return errbuf;
334
+
return errbuf;
335
335
}
336
336
337
337
static int
338
338
rb_make_certfp(const mbedtls_x509_crt *const peer_cert, uint8_t certfp[const RB_SSL_CERTFP_LEN], const int method)
339
339
{
340
-
size_t hashlen = 0;
341
-
mbedtls_md_type_t md_type;
342
-
bool spki = false;
340
+
size_t hashlen = 0;
341
+
mbedtls_md_type_t md_type;
342
+
bool spki = false;
343
343
344
-
switch(method)
345
-
{
346
-
case RB_SSL_CERTFP_METH_CERT_SHA1:
347
-
md_type = MBEDTLS_MD_SHA1;
348
-
hashlen = RB_SSL_CERTFP_LEN_SHA1;
349
-
break;
350
-
case RB_SSL_CERTFP_METH_SPKI_SHA256:
351
-
spki = true;
352
-
case RB_SSL_CERTFP_METH_CERT_SHA256:
353
-
md_type = MBEDTLS_MD_SHA256;
354
-
hashlen = RB_SSL_CERTFP_LEN_SHA256;
355
-
break;
356
-
case RB_SSL_CERTFP_METH_SPKI_SHA512:
357
-
spki = true;
358
-
case RB_SSL_CERTFP_METH_CERT_SHA512:
359
-
md_type = MBEDTLS_MD_SHA512;
360
-
hashlen = RB_SSL_CERTFP_LEN_SHA512;
361
-
break;
362
-
default:
363
-
return 0;
364
-
}
344
+
switch(method)
345
+
{
346
+
case RB_SSL_CERTFP_METH_CERT_SHA1:
347
+
md_type = MBEDTLS_MD_SHA1;
348
+
hashlen = RB_SSL_CERTFP_LEN_SHA1;
349
+
break;
350
+
case RB_SSL_CERTFP_METH_SPKI_SHA256:
351
+
spki = true;
352
+
case RB_SSL_CERTFP_METH_CERT_SHA256:
353
+
md_type = MBEDTLS_MD_SHA256;
354
+
hashlen = RB_SSL_CERTFP_LEN_SHA256;
355
+
break;
356
+
case RB_SSL_CERTFP_METH_SPKI_SHA512:
357
+
spki = true;
358
+
case RB_SSL_CERTFP_METH_CERT_SHA512:
359
+
md_type = MBEDTLS_MD_SHA512;
360
+
hashlen = RB_SSL_CERTFP_LEN_SHA512;
361
+
break;
362
+
default:
363
+
return 0;
364
+
}
365
365
366
-
const mbedtls_md_info_t *const md_info = mbedtls_md_info_from_type(md_type);
367
-
if(md_info == NULL)
368
-
return 0;
366
+
const mbedtls_md_info_t *const md_info = mbedtls_md_info_from_type(md_type);
367
+
if(md_info == NULL)
368
+
return 0;
369
369
370
-
int ret;
371
-
void* data = peer_cert->raw.p;
372
-
size_t datalen = peer_cert->raw.len;
373
-
unsigned char der_pubkey[8192];
370
+
int ret;
371
+
void* data = peer_cert->raw.p;
372
+
size_t datalen = peer_cert->raw.len;
373
+
unsigned char der_pubkey[8192];
374
374
375
-
if(spki)
376
-
{
377
-
// Compiler may complain about dropping const qualifier on the cast below
378
-
// See <https://github.com/ARMmbed/mbedtls/issues/396> -- this is okay
375
+
if(spki)
376
+
{
377
+
// Compiler may complain about dropping const qualifier on the cast below
378
+
// See <https://github.com/ARMmbed/mbedtls/issues/396> -- this is okay
379
379
380
-
if((ret = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)&peer_cert->pk,
381
-
der_pubkey, sizeof der_pubkey)) < 0)
382
-
{
383
-
rb_lib_log("rb_get_ssl_certfp: pk_write_pubkey_der: %s", rb_ssl_strerror(ret));
384
-
return 0;
385
-
}
386
-
data = der_pubkey + (sizeof(der_pubkey) - (size_t)ret);
387
-
datalen = (size_t)ret;
388
-
}
380
+
if((ret = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)&peer_cert->pk,
381
+
der_pubkey, sizeof der_pubkey)) < 0)
382
+
{
383
+
rb_lib_log("rb_get_ssl_certfp: pk_write_pubkey_der: %s", rb_ssl_strerror(ret));
384
+
return 0;
385
+
}
386
+
data = der_pubkey + (sizeof(der_pubkey) - (size_t)ret);
387
+
datalen = (size_t)ret;
388
+
}
389
389
390
-
if((ret = mbedtls_md(md_info, data, datalen, certfp)) != 0)
391
-
{
392
-
rb_lib_log("rb_get_ssl_certfp: mbedtls_md: %s", rb_ssl_strerror(ret));
393
-
return 0;
394
-
}
390
+
if((ret = mbedtls_md(md_info, data, datalen, certfp)) != 0)
391
+
{
392
+
rb_lib_log("rb_get_ssl_certfp: mbedtls_md: %s", rb_ssl_strerror(ret));
393
+
return 0;
394
+
}
395
395
396
-
return (int) hashlen;
396
+
return (int) hashlen;
397
397
}
398
398
399
399
···
405
405
void
406
406
rb_ssl_shutdown(rb_fde_t *const F)
407
407
{
408
-
if(F == NULL || F->ssl == NULL)
409
-
return;
408
+
if(F == NULL || F->ssl == NULL)
409
+
return;
410
410
411
-
for(int i = 0; i < 4; i++)
412
-
{
413
-
int ret = mbedtls_ssl_close_notify(SSL_P(F));
411
+
for(int i = 0; i < 4; i++)
412
+
{
413
+
int ret = mbedtls_ssl_close_notify(SSL_P(F));
414
414
415
-
if(ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE)
416
-
break;
417
-
}
415
+
if(ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE)
416
+
break;
417
+
}
418
418
419
-
mbedtls_ssl_free(SSL_P(F));
420
-
rb_mbedtls_cfg_decref(SSL_C(F));
419
+
mbedtls_ssl_free(SSL_P(F));
420
+
rb_mbedtls_cfg_decref(SSL_C(F));
421
421
422
-
rb_free(F->ssl);
423
-
F->ssl = NULL;
422
+
rb_free(F->ssl);
423
+
F->ssl = NULL;
424
424
}
425
425
426
426
int
427
427
rb_init_ssl(void)
428
428
{
429
-
mbedtls_ctr_drbg_init(&ctr_drbg_ctx);
430
-
mbedtls_entropy_init(&entropy_ctx);
429
+
mbedtls_ctr_drbg_init(&ctr_drbg_ctx);
430
+
mbedtls_entropy_init(&entropy_ctx);
431
431
432
-
int ret;
432
+
int ret;
433
433
434
-
if((ret = mbedtls_ctr_drbg_seed(&ctr_drbg_ctx, mbedtls_entropy_func, &entropy_ctx,
435
-
(const unsigned char *)rb_mbedtls_personal_str, sizeof(rb_mbedtls_personal_str))) != 0)
436
-
{
437
-
rb_lib_log("%s: ctr_drbg_seed: %s", __func__, rb_ssl_strerror(ret));
438
-
return 0;
439
-
}
434
+
if((ret = mbedtls_ctr_drbg_seed(&ctr_drbg_ctx, mbedtls_entropy_func, &entropy_ctx,
435
+
(const unsigned char *)rb_mbedtls_personal_str, sizeof(rb_mbedtls_personal_str))) != 0)
436
+
{
437
+
rb_lib_log("%s: ctr_drbg_seed: %s", __func__, rb_ssl_strerror(ret));
438
+
return 0;
439
+
}
440
+
441
+
/* Dummy CA: initialise and parse DER; failure is non-fatal on MbedTLS 3.x */
442
+
mbedtls_x509_crt_init(&dummy_ca_ctx);
440
443
441
-
if((ret = mbedtls_x509_crt_parse_der(&dummy_ca_ctx, rb_mbedtls_dummy_ca_certificate,
442
-
sizeof(rb_mbedtls_dummy_ca_certificate))) != 0)
443
-
{
444
-
rb_lib_log("%s: x509_crt_parse_der (Dummy CA): %s", __func__, rb_ssl_strerror(ret));
445
-
return 0;
446
-
}
444
+
ret = mbedtls_x509_crt_parse_der(&dummy_ca_ctx,
445
+
rb_mbedtls_dummy_ca_certificate,
446
+
sizeof(rb_mbedtls_dummy_ca_certificate));
447
+
if(ret != 0)
448
+
{
449
+
rb_lib_log("%s: x509_crt_parse_der (Dummy CA): %s", __func__, rb_ssl_strerror(ret));
450
+
/* Continue without dummy CA */
451
+
}
447
452
448
-
rb_lib_log("%s: MbedTLS backend initialised", __func__);
449
-
return 1;
453
+
rb_lib_log("%s: MbedTLS backend initialised", __func__);
454
+
return 1;
450
455
}
451
456
452
457
int
453
458
rb_setup_ssl_server(const char *const certfile, const char *keyfile,
454
459
const char *const dhfile, const char *const cipherlist)
455
460
{
456
-
if(certfile == NULL)
457
-
{
458
-
rb_lib_log("%s: no certificate file specified", __func__);
459
-
return 0;
460
-
}
461
+
if(certfile == NULL)
462
+
{
463
+
rb_lib_log("%s: no certificate file specified", __func__);
464
+
return 0;
465
+
}
461
466
462
-
if(keyfile == NULL)
463
-
keyfile = certfile;
467
+
if(keyfile == NULL)
468
+
keyfile = certfile;
464
469
465
-
rb_mbedtls_cfg_context *const newcfg = rb_mbedtls_cfg_new();
470
+
rb_mbedtls_cfg_context *const newcfg = rb_mbedtls_cfg_new();
466
471
467
-
if(newcfg == NULL)
468
-
{
469
-
rb_lib_log("%s: rb_mbedtls_cfg_new: allocation failed", __func__);
470
-
return 0;
471
-
}
472
+
if(newcfg == NULL)
473
+
{
474
+
rb_lib_log("%s: rb_mbedtls_cfg_new: allocation failed", __func__);
475
+
return 0;
476
+
}
472
477
473
-
int ret;
478
+
int ret;
474
479
475
-
if((ret = mbedtls_x509_crt_parse_file(&newcfg->crt, certfile)) != 0)
476
-
{
477
-
rb_lib_log("%s: x509_crt_parse_file ('%s'): %s", __func__, certfile, rb_ssl_strerror(ret));
478
-
rb_mbedtls_cfg_decref(newcfg);
479
-
return 0;
480
-
}
481
-
if((ret = mbedtls_pk_parse_keyfile(&newcfg->key, keyfile, NULL)) != 0)
482
-
{
483
-
rb_lib_log("%s: pk_parse_keyfile ('%s'): %s", __func__, keyfile, rb_ssl_strerror(ret));
484
-
rb_mbedtls_cfg_decref(newcfg);
485
-
return 0;
486
-
}
487
-
if((ret = mbedtls_pk_check_pair(&newcfg->crt.pk, &newcfg->key)) != 0)
488
-
{
489
-
rb_lib_log("%s: pk_check_pair: public/private key mismatch", __func__);
490
-
rb_mbedtls_cfg_decref(newcfg);
491
-
return 0;
492
-
}
493
-
if((ret = mbedtls_ssl_conf_own_cert(&newcfg->server_cfg, &newcfg->crt, &newcfg->key)) != 0)
494
-
{
495
-
rb_lib_log("%s: ssl_conf_own_cert (server): %s", __func__, rb_ssl_strerror(ret));
496
-
rb_mbedtls_cfg_decref(newcfg);
497
-
return 0;
498
-
}
499
-
if((ret = mbedtls_ssl_conf_own_cert(&newcfg->client_cfg, &newcfg->crt, &newcfg->key)) != 0)
500
-
{
501
-
rb_lib_log("%s: ssl_conf_own_cert (client): %s", __func__, rb_ssl_strerror(ret));
502
-
rb_mbedtls_cfg_decref(newcfg);
503
-
return 0;
504
-
}
480
+
if((ret = mbedtls_x509_crt_parse_file(&newcfg->crt, certfile)) != 0)
481
+
{
482
+
rb_lib_log("%s: x509_crt_parse_file ('%s'): %s", __func__, certfile, rb_ssl_strerror(ret));
483
+
rb_mbedtls_cfg_decref(newcfg);
484
+
return 0;
485
+
}
486
+
if((ret = mbedtls_pk_parse_keyfile(&newcfg->key, keyfile, NULL)) != 0)
487
+
{
488
+
rb_lib_log("%s: pk_parse_keyfile ('%s'): %s", __func__, keyfile, rb_ssl_strerror(ret));
489
+
rb_mbedtls_cfg_decref(newcfg);
490
+
return 0;
491
+
}
492
+
if((ret = mbedtls_pk_check_pair(&newcfg->crt.pk, &newcfg->key)) != 0)
493
+
{
494
+
rb_lib_log("%s: pk_check_pair: public/private key mismatch", __func__);
495
+
rb_mbedtls_cfg_decref(newcfg);
496
+
return 0;
497
+
}
498
+
if((ret = mbedtls_ssl_conf_own_cert(&newcfg->server_cfg, &newcfg->crt, &newcfg->key)) != 0)
499
+
{
500
+
rb_lib_log("%s: ssl_conf_own_cert (server): %s", __func__, rb_ssl_strerror(ret));
501
+
rb_mbedtls_cfg_decref(newcfg);
502
+
return 0;
503
+
}
504
+
if((ret = mbedtls_ssl_conf_own_cert(&newcfg->client_cfg, &newcfg->crt, &newcfg->key)) != 0)
505
+
{
506
+
rb_lib_log("%s: ssl_conf_own_cert (client): %s", __func__, rb_ssl_strerror(ret));
507
+
rb_mbedtls_cfg_decref(newcfg);
508
+
return 0;
509
+
}
505
510
506
511
507
-
/* Absense of DH parameters does not matter with mbedTLS, as it comes with its own defaults
508
-
Thus, clients can still use DHE- ciphersuites, just over a weaker, common DH group
509
-
So, we do not consider failure to parse DH parameters as fatal */
510
-
if(dhfile == NULL)
511
-
{
512
-
rb_lib_log("%s: no DH parameters file specified", __func__);
513
-
}
514
-
else
515
-
{
516
-
if((ret = mbedtls_dhm_parse_dhmfile(&newcfg->dhp, dhfile)) != 0)
517
-
{
518
-
rb_lib_log("%s: dhm_parse_dhmfile ('%s'): %s", __func__, dhfile, rb_ssl_strerror(ret));
519
-
}
520
-
else if((ret = mbedtls_ssl_conf_dh_param_ctx(&newcfg->server_cfg, &newcfg->dhp)) != 0)
521
-
{
522
-
rb_lib_log("%s: ssl_conf_dh_param_ctx: %s", __func__, rb_ssl_strerror(ret));
523
-
}
524
-
}
512
+
/* Absense of DH parameters does not matter with mbedTLS, as it comes with its own defaults
513
+
Thus, clients can still use DHE- ciphersuites, just over a weaker, common DH group
514
+
So, we do not consider failure to parse DH parameters as fatal */
515
+
if(dhfile == NULL)
516
+
{
517
+
rb_lib_log("%s: no DH parameters file specified", __func__);
518
+
}
519
+
else
520
+
{
521
+
if((ret = mbedtls_dhm_parse_dhmfile(&newcfg->dhp, dhfile)) != 0)
522
+
{
523
+
rb_lib_log("%s: dhm_parse_dhmfile ('%s'): %s", __func__, dhfile, rb_ssl_strerror(ret));
524
+
}
525
+
else if((ret = mbedtls_ssl_conf_dh_param_ctx(&newcfg->server_cfg, &newcfg->dhp)) != 0)
526
+
{
527
+
rb_lib_log("%s: ssl_conf_dh_param_ctx: %s", __func__, rb_ssl_strerror(ret));
528
+
}
529
+
}
525
530
526
531
527
-
const int *rb_ciphersuites = newcfg->suites;
528
-
size_t suites_count = 0;
532
+
const int *rb_ciphersuites = newcfg->suites;
533
+
size_t suites_count = 0;
529
534
530
-
if(cipherlist != NULL)
531
-
{
532
-
// The cipherlist is (const char *) -- we should not modify it
533
-
char *const cipherlist_dup = strdup(cipherlist);
535
+
if(cipherlist != NULL)
536
+
{
537
+
// The cipherlist is (const char *) -- we should not modify it
538
+
char *const cipherlist_dup = strdup(cipherlist);
534
539
535
-
if(cipherlist_dup != NULL)
536
-
{
537
-
char *cipher_str = cipherlist_dup;
538
-
char *cipher_idx;
540
+
if(cipherlist_dup != NULL)
541
+
{
542
+
char *cipher_str = cipherlist_dup;
543
+
char *cipher_idx;
539
544
540
-
do
541
-
{
542
-
// Arbitrary, but the same separator as OpenSSL uses
543
-
cipher_idx = strchr(cipher_str, ':');
545
+
do
546
+
{
547
+
// Arbitrary, but the same separator as OpenSSL uses
548
+
cipher_idx = strchr(cipher_str, ':');
544
549
545
-
// This could legitimately be NULL (last ciphersuite in the list)
546
-
if(cipher_idx != NULL)
547
-
*cipher_idx = '\0';
550
+
// This could legitimately be NULL (last ciphersuite in the list)
551
+
if(cipher_idx != NULL)
552
+
*cipher_idx = '\0';
548
553
549
-
size_t cipher_len = strlen(cipher_str);
550
-
int cipher_idn = 0;
554
+
size_t cipher_len = strlen(cipher_str);
555
+
int cipher_idn = 0;
551
556
552
-
// All MbedTLS ciphersuite names begin with these 4 characters
553
-
if(cipher_len > 4 && strncmp(cipher_str, "TLS-", 4) == 0)
554
-
cipher_idn = mbedtls_ssl_get_ciphersuite_id(cipher_str);
557
+
// All MbedTLS ciphersuite names begin with these 4 characters
558
+
if(cipher_len > 4 && strncmp(cipher_str, "TLS-", 4) == 0)
559
+
cipher_idn = mbedtls_ssl_get_ciphersuite_id(cipher_str);
555
560
556
-
// Prevent the same ciphersuite being added multiple times
557
-
for(size_t x = 0; cipher_idn != 0 && newcfg->suites[x] != 0; x++)
558
-
if(newcfg->suites[x] == cipher_idn)
559
-
cipher_idn = 0;
561
+
// Prevent the same ciphersuite being added multiple times
562
+
for(size_t x = 0; cipher_idn != 0 && newcfg->suites[x] != 0; x++)
563
+
if(newcfg->suites[x] == cipher_idn)
564
+
cipher_idn = 0;
560
565
561
-
// Add the suite to the list
562
-
if(cipher_idn != 0)
563
-
newcfg->suites[suites_count++] = cipher_idn;
566
+
// Add the suite to the list
567
+
if(cipher_idn != 0)
568
+
newcfg->suites[suites_count++] = cipher_idn;
564
569
565
-
// Advance the string to the next entry
566
-
if(cipher_idx)
567
-
cipher_str = cipher_idx + 1;
570
+
// Advance the string to the next entry
571
+
if(cipher_idx)
572
+
cipher_str = cipher_idx + 1;
568
573
569
-
} while(cipher_idx && suites_count < RB_MAX_CIPHERSUITES);
574
+
} while(cipher_idx && suites_count < RB_MAX_CIPHERSUITES);
570
575
571
-
if(suites_count == 0)
572
-
rb_lib_log("%s: Ciphersuites provided, but could not parse any", __func__);
576
+
if(suites_count == 0)
577
+
rb_lib_log("%s: Ciphersuites provided, but could not parse any", __func__);
573
578
574
-
free(cipherlist_dup);
575
-
}
576
-
else
577
-
{
578
-
rb_lib_log("%s: strdup: %s", __func__, strerror(errno));
579
-
}
580
-
}
581
-
else
582
-
{
583
-
rb_lib_log("%s: No ciphersuite list provided", __func__);
584
-
}
579
+
free(cipherlist_dup);
580
+
}
581
+
else
582
+
{
583
+
rb_lib_log("%s: strdup: %s", __func__, strerror(errno));
584
+
}
585
+
}
586
+
else
587
+
{
588
+
rb_lib_log("%s: No ciphersuite list provided", __func__);
589
+
}
585
590
586
-
if(suites_count == 0)
587
-
{
588
-
rb_lib_log("%s: Using default ciphersuites", __func__);
591
+
if(suites_count == 0)
592
+
{
593
+
rb_lib_log("%s: Using default ciphersuites", __func__);
589
594
590
-
rb_ciphersuites = rb_mbedtls_ciphersuites;
591
-
suites_count = (sizeof(rb_mbedtls_ciphersuites) / sizeof(rb_mbedtls_ciphersuites[0])) - 1;
592
-
}
595
+
rb_ciphersuites = rb_mbedtls_ciphersuites;
596
+
suites_count = (sizeof(rb_mbedtls_ciphersuites) / sizeof(rb_mbedtls_ciphersuites[0])) - 1;
597
+
}
593
598
594
-
mbedtls_ssl_conf_ciphersuites(&newcfg->server_cfg, rb_ciphersuites);
595
-
mbedtls_ssl_conf_ciphersuites(&newcfg->client_cfg, rb_ciphersuites);
596
-
rb_lib_log("%s: Configured %zu ciphersuites", __func__, suites_count);
599
+
mbedtls_ssl_conf_ciphersuites(&newcfg->server_cfg, rb_ciphersuites);
600
+
mbedtls_ssl_conf_ciphersuites(&newcfg->client_cfg, rb_ciphersuites);
601
+
rb_lib_log("%s: Configured %zu ciphersuites", __func__, suites_count);
597
602
598
603
599
-
rb_mbedtls_cfg_decref(rb_mbedtls_cfg);
600
-
rb_mbedtls_cfg = newcfg;
604
+
rb_mbedtls_cfg_decref(rb_mbedtls_cfg);
605
+
rb_mbedtls_cfg = newcfg;
601
606
602
-
rb_lib_log("%s: TLS configuration successful", __func__);
603
-
return 1;
607
+
rb_lib_log("%s: TLS configuration successful", __func__);
608
+
return 1;
604
609
}
605
610
606
611
int
607
612
rb_init_prng(const char *const path, prng_seed_t seed_type)
608
613
{
609
-
(void) path;
610
-
(void) seed_type;
614
+
(void) path;
615
+
(void) seed_type;
611
616
612
-
rb_lib_log("%s: Skipping PRNG initialisation; not required by MbedTLS backend", __func__);
613
-
return 1;
617
+
rb_lib_log("%s: Skipping PRNG initialisation; not required by MbedTLS backend", __func__);
618
+
return 1;
614
619
}
615
620
616
621
int
617
622
rb_get_random(void *const buf, const size_t length)
618
623
{
619
-
int ret;
624
+
int ret;
620
625
621
-
if((ret = mbedtls_ctr_drbg_random(&ctr_drbg_ctx, buf, length)) != 0)
622
-
{
623
-
rb_lib_log("%s: ctr_drbg_random: %s", __func__, rb_ssl_strerror(ret));
624
-
return 0;
625
-
}
626
+
if((ret = mbedtls_ctr_drbg_random(&ctr_drbg_ctx, buf, length)) != 0)
627
+
{
628
+
rb_lib_log("%s: ctr_drbg_random: %s", __func__, rb_ssl_strerror(ret));
629
+
return 0;
630
+
}
626
631
627
-
return 1;
632
+
return 1;
628
633
}
629
634
630
635
const char *
631
636
rb_get_ssl_strerror(rb_fde_t *const F)
632
637
{
633
-
const int err = (int) F->ssl_errno;
634
-
return rb_ssl_strerror(err);
638
+
const int err = (int) F->ssl_errno;
639
+
return rb_ssl_strerror(err);
635
640
}
636
641
637
642
int
638
643
rb_get_ssl_certfp(rb_fde_t *const F, uint8_t certfp[const RB_SSL_CERTFP_LEN], const int method)
639
644
{
640
-
const mbedtls_x509_crt *const peer_cert = mbedtls_ssl_get_peer_cert(SSL_P(F));
645
+
const mbedtls_x509_crt *const peer_cert = mbedtls_ssl_get_peer_cert(SSL_P(F));
641
646
642
-
if(peer_cert == NULL)
643
-
return 0;
647
+
if(peer_cert == NULL)
648
+
return 0;
644
649
645
-
return rb_make_certfp(peer_cert, certfp, method);
650
+
return rb_make_certfp(peer_cert, certfp, method);
646
651
}
647
652
648
653
int
649
654
rb_get_ssl_certfp_file(const char *const filename, uint8_t certfp[const RB_SSL_CERTFP_LEN], const int method)
650
655
{
651
-
mbedtls_x509_crt cert;
656
+
mbedtls_x509_crt cert;
652
657
653
-
mbedtls_x509_crt_init(&cert);
658
+
mbedtls_x509_crt_init(&cert);
654
659
655
-
const int ret = mbedtls_x509_crt_parse_file(&cert, filename);
660
+
const int ret = mbedtls_x509_crt_parse_file(&cert, filename);
656
661
657
-
if(ret != 0)
658
-
return -1;
662
+
if(ret != 0)
663
+
return -1;
659
664
660
-
const int len = rb_make_certfp(&cert, certfp, method);
665
+
const int len = rb_make_certfp(&cert, certfp, method);
661
666
662
-
mbedtls_x509_crt_free(&cert);
667
+
mbedtls_x509_crt_free(&cert);
663
668
664
-
return len;
669
+
return len;
665
670
}
666
671
void
667
672
rb_get_ssl_info(char *const buf, const size_t len)
668
673
{
669
-
char version_str[512];
674
+
char version_str[512];
670
675
671
-
mbedtls_version_get_string(version_str);
676
+
mbedtls_version_get_string(version_str);
672
677
673
-
(void) snprintf(buf, len, "ARM mbedTLS: compiled (v%s), library (v%s)",
674
-
MBEDTLS_VERSION_STRING, version_str);
678
+
(void) snprintf(buf, len, "ARM mbedTLS: compiled (v%s), library (v%s)",
679
+
MBEDTLS_VERSION_STRING, version_str);
675
680
}
676
681
677
682
const char *
678
683
rb_ssl_get_cipher(rb_fde_t *const F)
679
684
{
680
-
if(F == NULL || F->ssl == NULL)
681
-
return NULL;
685
+
if(F == NULL || F->ssl == NULL)
686
+
return NULL;
682
687
683
-
static char buf[512];
688
+
static char buf[512];
684
689
685
-
const char *const version = mbedtls_ssl_get_version(SSL_P(F));
686
-
const char *const cipher = mbedtls_ssl_get_ciphersuite(SSL_P(F));
690
+
const char *const version = mbedtls_ssl_get_version(SSL_P(F));
691
+
const char *const cipher = mbedtls_ssl_get_ciphersuite(SSL_P(F));
687
692
688
-
(void) snprintf(buf, sizeof buf, "%s, %s", version, cipher);
693
+
(void) snprintf(buf, sizeof buf, "%s, %s", version, cipher);
689
694
690
-
return buf;
695
+
return buf;
691
696
}
692
697
693
698
ssize_t
694
699
rb_ssl_read(rb_fde_t *const F, void *const buf, const size_t count)
695
700
{
696
-
lrb_assert(F != NULL);
697
-
lrb_assert(F->ssl != NULL);
701
+
lrb_assert(F != NULL);
702
+
lrb_assert(F->ssl != NULL);
698
703
699
-
const int ret = mbedtls_ssl_read(SSL_P(F), buf, count);
704
+
const int ret = mbedtls_ssl_read(SSL_P(F), buf, count);
700
705
701
-
if(ret >= 0)
702
-
return (ssize_t) ret;
706
+
if(ret >= 0)
707
+
return (ssize_t) ret;
703
708
704
-
switch(ret)
705
-
{
706
-
case MBEDTLS_ERR_SSL_WANT_READ:
707
-
errno = EAGAIN;
708
-
return RB_RW_SSL_NEED_READ;
709
-
case MBEDTLS_ERR_SSL_WANT_WRITE:
710
-
errno = EAGAIN;
711
-
return RB_RW_SSL_NEED_WRITE;
712
-
default:
713
-
errno = EIO;
714
-
F->ssl_errno = (unsigned long) -ret;
715
-
return RB_RW_SSL_ERROR;
716
-
}
709
+
switch(ret)
710
+
{
711
+
case MBEDTLS_ERR_SSL_WANT_READ:
712
+
errno = EAGAIN;
713
+
return RB_RW_SSL_NEED_READ;
714
+
case MBEDTLS_ERR_SSL_WANT_WRITE:
715
+
errno = EAGAIN;
716
+
return RB_RW_SSL_NEED_WRITE;
717
+
default:
718
+
errno = EIO;
719
+
F->ssl_errno = (unsigned long) -ret;
720
+
return RB_RW_SSL_ERROR;
721
+
}
717
722
}
718
723
719
724
ssize_t
720
725
rb_ssl_write(rb_fde_t *const F, const void *const buf, const size_t count)
721
726
{
722
-
lrb_assert(F != NULL);
723
-
lrb_assert(F->ssl != NULL);
727
+
lrb_assert(F != NULL);
728
+
lrb_assert(F->ssl != NULL);
724
729
725
-
const int ret = mbedtls_ssl_write(SSL_P(F), buf, count);
730
+
const int ret = mbedtls_ssl_write(SSL_P(F), buf, count);
726
731
727
-
if(ret >= 0)
728
-
return (ssize_t) ret;
732
+
if(ret >= 0)
733
+
return (ssize_t) ret;
729
734
730
-
switch(ret)
731
-
{
732
-
case MBEDTLS_ERR_SSL_WANT_READ:
733
-
errno = EAGAIN;
734
-
return RB_RW_SSL_NEED_READ;
735
-
case MBEDTLS_ERR_SSL_WANT_WRITE:
736
-
errno = EAGAIN;
737
-
return RB_RW_SSL_NEED_WRITE;
738
-
default:
739
-
errno = EIO;
740
-
F->ssl_errno = (unsigned long) -ret;
741
-
return RB_RW_SSL_ERROR;
742
-
}
735
+
switch(ret)
736
+
{
737
+
case MBEDTLS_ERR_SSL_WANT_READ:
738
+
errno = EAGAIN;
739
+
return RB_RW_SSL_NEED_READ;
740
+
case MBEDTLS_ERR_SSL_WANT_WRITE:
741
+
errno = EAGAIN;
742
+
return RB_RW_SSL_NEED_WRITE;
743
+
default:
744
+
errno = EIO;
745
+
F->ssl_errno = (unsigned long) -ret;
746
+
return RB_RW_SSL_ERROR;
747
+
}
743
748
}
744
749
745
750
···
751
756
static void
752
757
rb_ssl_connect_realcb(rb_fde_t *const F, const int status, struct ssl_connect *const sconn)
753
758
{
754
-
lrb_assert(F != NULL);
755
-
lrb_assert(F->connect != NULL);
759
+
lrb_assert(F != NULL);
760
+
lrb_assert(F->connect != NULL);
756
761
757
-
F->connect->callback = sconn->callback;
758
-
F->connect->data = sconn->data;
762
+
F->connect->callback = sconn->callback;
763
+
F->connect->data = sconn->data;
759
764
760
-
rb_connect_callback(F, status);
761
-
rb_free(sconn);
765
+
rb_connect_callback(F, status);
766
+
rb_free(sconn);
762
767
}
763
768
764
769
static void
765
770
rb_ssl_timeout_cb(rb_fde_t *const F, void *const data)
766
771
{
767
-
(void) data;
772
+
(void) data;
768
773
769
-
lrb_assert(F->accept != NULL);
770
-
lrb_assert(F->accept->callback != NULL);
774
+
lrb_assert(F->accept != NULL);
775
+
lrb_assert(F->accept->callback != NULL);
771
776
772
-
F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
777
+
F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
773
778
}
774
779
775
780
static void
776
781
rb_ssl_tryconn_timeout_cb(rb_fde_t *const F, void *const data)
777
782
{
778
-
rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
783
+
rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
779
784
}
780
785
781
786
static void
782
787
rb_ssl_tryconn(rb_fde_t *const F, const int status, void *const data)
783
788
{
784
-
lrb_assert(F != NULL);
789
+
lrb_assert(F != NULL);
785
790
786
-
struct ssl_connect *const sconn = data;
791
+
struct ssl_connect *const sconn = data;
787
792
788
-
if(status != RB_OK)
789
-
{
790
-
rb_ssl_connect_realcb(F, status, sconn);
791
-
return;
792
-
}
793
+
if(status != RB_OK)
794
+
{
795
+
rb_ssl_connect_realcb(F, status, sconn);
796
+
return;
797
+
}
793
798
794
-
F->type |= RB_FD_SSL;
799
+
F->type |= RB_FD_SSL;
795
800
796
-
rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
797
-
rb_ssl_init_fd(F, RB_FD_TLS_DIRECTION_OUT);
798
-
rb_ssl_connect_common(F, sconn);
801
+
rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
802
+
rb_ssl_init_fd(F, RB_FD_TLS_DIRECTION_OUT);
803
+
rb_ssl_connect_common(F, sconn);
799
804
}
800
805
801
806
···
807
812
int
808
813
rb_supports_ssl(void)
809
814
{
810
-
return 1;
815
+
return 1;
811
816
}
812
817
813
818
unsigned int
814
819
rb_ssl_handshake_count(rb_fde_t *const F)
815
820
{
816
-
return F->handshake_count;
821
+
return F->handshake_count;
817
822
}
818
823
819
824
void
820
825
rb_ssl_clear_handshake_count(rb_fde_t *const F)
821
826
{
822
-
F->handshake_count = 0;
827
+
F->handshake_count = 0;
823
828
}
824
829
825
830
void
826
831
rb_ssl_start_accepted(rb_fde_t *const F, ACCB *const cb, void *const data, const int timeout)
827
832
{
828
-
F->type |= RB_FD_SSL;
833
+
F->type |= RB_FD_SSL;
829
834
830
-
F->accept = rb_malloc(sizeof(struct acceptdata));
831
-
F->accept->callback = cb;
832
-
F->accept->data = data;
833
-
F->accept->addrlen = 0;
834
-
(void) memset(&F->accept->S, 0x00, sizeof F->accept->S);
835
+
F->accept = rb_malloc(sizeof(struct acceptdata));
836
+
F->accept->callback = cb;
837
+
F->accept->data = data;
838
+
F->accept->addrlen = 0;
839
+
(void) memset(&F->accept->S, 0x00, sizeof F->accept->S);
835
840
836
-
rb_settimeout(F, timeout, rb_ssl_timeout_cb, NULL);
837
-
rb_ssl_init_fd(F, RB_FD_TLS_DIRECTION_IN);
838
-
rb_ssl_accept_common(F, NULL);
841
+
rb_settimeout(F, timeout, rb_ssl_timeout_cb, NULL);
842
+
rb_ssl_init_fd(F, RB_FD_TLS_DIRECTION_IN);
843
+
rb_ssl_accept_common(F, NULL);
839
844
}
840
845
841
846
void
842
847
rb_ssl_accept_setup(rb_fde_t *const srv_F, rb_fde_t *const cli_F, struct sockaddr *const st, const int addrlen)
843
848
{
844
-
cli_F->type |= RB_FD_SSL;
849
+
cli_F->type |= RB_FD_SSL;
845
850
846
-
cli_F->accept = rb_malloc(sizeof(struct acceptdata));
847
-
cli_F->accept->callback = srv_F->accept->callback;
848
-
cli_F->accept->data = srv_F->accept->data;
849
-
cli_F->accept->addrlen = (rb_socklen_t) addrlen;
850
-
(void) memset(&cli_F->accept->S, 0x00, sizeof cli_F->accept->S);
851
-
(void) memcpy(&cli_F->accept->S, st, (size_t) addrlen);
851
+
cli_F->accept = rb_malloc(sizeof(struct acceptdata));
852
+
cli_F->accept->callback = srv_F->accept->callback;
853
+
cli_F->accept->data = srv_F->accept->data;
854
+
cli_F->accept->addrlen = (rb_socklen_t) addrlen;
855
+
(void) memset(&cli_F->accept->S, 0x00, sizeof cli_F->accept->S);
856
+
(void) memcpy(&cli_F->accept->S, st, (size_t) addrlen);
852
857
853
-
rb_settimeout(cli_F, 10, rb_ssl_timeout_cb, NULL);
854
-
rb_ssl_init_fd(cli_F, RB_FD_TLS_DIRECTION_IN);
855
-
rb_ssl_accept_common(cli_F, NULL);
858
+
rb_settimeout(cli_F, 10, rb_ssl_timeout_cb, NULL);
859
+
rb_ssl_init_fd(cli_F, RB_FD_TLS_DIRECTION_IN);
860
+
rb_ssl_accept_common(cli_F, NULL);
856
861
}
857
862
858
863
int
859
864
rb_ssl_listen(rb_fde_t *const F, const int backlog, const int defer_accept)
860
865
{
861
-
int result = rb_listen(F, backlog, defer_accept);
866
+
int result = rb_listen(F, backlog, defer_accept);
862
867
863
-
F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
868
+
F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
864
869
865
-
return result;
870
+
return result;
866
871
}
867
872
868
873
void
869
874
rb_connect_tcp_ssl(rb_fde_t *const F, struct sockaddr *const dest, struct sockaddr *const clocal,
870
875
CNCB *const callback, void *const data, const int timeout)
871
876
{
872
-
if(F == NULL)
873
-
return;
877
+
if(F == NULL)
878
+
return;
874
879
875
-
struct ssl_connect *const sconn = rb_malloc(sizeof *sconn);
876
-
sconn->data = data;
877
-
sconn->callback = callback;
878
-
sconn->timeout = timeout;
880
+
struct ssl_connect *const sconn = rb_malloc(sizeof *sconn);
881
+
sconn->data = data;
882
+
sconn->callback = callback;
883
+
sconn->timeout = timeout;
879
884
880
-
rb_connect_tcp(F, dest, clocal, rb_ssl_tryconn, sconn, timeout);
885
+
rb_connect_tcp(F, dest, clocal, rb_ssl_tryconn, sconn, timeout);
881
886
}
882
887
883
888
void
884
889
rb_ssl_start_connected(rb_fde_t *const F, CNCB *const callback, void *const data, const int timeout)
885
890
{
886
-
if(F == NULL)
887
-
return;
891
+
if(F == NULL)
892
+
return;
888
893
889
-
struct ssl_connect *const sconn = rb_malloc(sizeof *sconn);
890
-
sconn->data = data;
891
-
sconn->callback = callback;
892
-
sconn->timeout = timeout;
894
+
struct ssl_connect *const sconn = rb_malloc(sizeof *sconn);
895
+
sconn->data = data;
896
+
sconn->callback = callback;
897
+
sconn->timeout = timeout;
893
898
894
-
F->connect = rb_malloc(sizeof(struct conndata));
895
-
F->connect->callback = callback;
896
-
F->connect->data = data;
899
+
F->connect = rb_malloc(sizeof(struct conndata));
900
+
F->connect->callback = callback;
901
+
F->connect->data = data;
897
902
898
-
F->type |= RB_FD_SSL;
903
+
F->type |= RB_FD_SSL;
899
904
900
-
rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
901
-
rb_ssl_init_fd(F, RB_FD_TLS_DIRECTION_OUT);
902
-
rb_ssl_connect_common(F, sconn);
905
+
rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
906
+
rb_ssl_init_fd(F, RB_FD_TLS_DIRECTION_OUT);
907
+
rb_ssl_connect_common(F, sconn);
903
908
}
904
909
905
910
#endif /* HAVE_MBEDTLS */
+2
-1
librb/src/mbedtls_ratbox.h
+2
-1
librb/src/mbedtls_ratbox.h