aboutsummaryrefslogtreecommitdiff
path: root/deps/openssl/openssl/demos/easy_tls
diff options
context:
space:
mode:
Diffstat (limited to 'deps/openssl/openssl/demos/easy_tls')
-rw-r--r--deps/openssl/openssl/demos/easy_tls/Makefile123
-rw-r--r--deps/openssl/openssl/demos/easy_tls/README65
-rw-r--r--deps/openssl/openssl/demos/easy_tls/cacerts.pem18
-rw-r--r--deps/openssl/openssl/demos/easy_tls/cert.pem31
-rw-r--r--deps/openssl/openssl/demos/easy_tls/easy-tls.c1312
-rw-r--r--deps/openssl/openssl/demos/easy_tls/easy-tls.h60
-rw-r--r--deps/openssl/openssl/demos/easy_tls/test.c248
-rw-r--r--deps/openssl/openssl/demos/easy_tls/test.h10
8 files changed, 0 insertions, 1867 deletions
diff --git a/deps/openssl/openssl/demos/easy_tls/Makefile b/deps/openssl/openssl/demos/easy_tls/Makefile
deleted file mode 100644
index 208070074c..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/Makefile
+++ /dev/null
@@ -1,123 +0,0 @@
-# Makefile for easy-tls example application (rudimentary client and server)
-# $Id: Makefile,v 1.2 2001/09/18 09:15:40 bodo Exp $
-
-SOLARIS_CFLAGS=-Wall -pedantic -g -O2
-SOLARIS_LIBS=-lxnet
-
-LINUX_CFLAGS=-Wall -pedantic -g -O2
-LINUX_LIBS=
-
-
-auto-all:
- case `uname -s` in \
- SunOS) echo Using SunOS configuration; \
- make SYSCFLAGS="$(SOLARIS_CFLAGS)" SYSLIBS="$(SOLARIS_LIBS)" all;; \
- Linux) echo Using Linux configuration; \
- make SYSCFLAGS="$(LINUX_CFLAGS)" SYSLIBS="$(LINUX_LIBS)" all;; \
- *) echo "unknown system"; exit 1;; \
- esac
-
-all: test TAGS
-
-# For adapting this Makefile to a different system, only the following
-# definitions should need customizing:
-
-OPENSSLDIR=../..
-CC=gcc
-
-SYSCFLAGS=whatever
-SYSLIBS=whatever
-
-
-#############################################################################
-#
-# SSLeay/OpenSSL imports
-#
-# OPENSSLDIR (set above) can be either the directory where OpenSSL is
-# installed or the directory where it was compiled.
-
-# We rely on having a new OpenSSL release where include files
-# have names like <openssl/ssl.h> (not just <ssl.h>).
-OPENSSLINCLUDES=-I$(OPENSSLDIR)/include
-
-# libcrypto.a and libssl.a are directly in $(OPENSSLDIR) if this is
-# the compile directory, or in $(OPENSSLDIR)/lib if we use an installed
-# library. With the following definition, we can handle either case.
-OPENSSLLIBS=-L$(OPENSSLDIR) -L$(OPENSSLDIR)/lib -lssl -lcrypto
-
-
-#############################################################################
-#
-# Stuff for handling the source files
-#
-
-SOURCES=easy-tls.c test.c
-HEADERS=easy-tls.h test.h
-DOCSandEXAMPLESetc=Makefile cert.pem cacerts.pem
-EVERYTHING=$(SOURCES) $(HEADERS) $(DOCSandEXAMPLESetc)
-
-ls: ls-l
-ls-l:
- ls -l $(EVERYTHING)
-# For RCS:
-tag:
- -rcs -n_`date +%y%m%d`: $(EVERYTHING)
- rcs -nMYTAG $(EVERYTHING)
- rcs -nMYTAG: $(EVERYTHING)
-diff:
- -rcsdiff -rMYTAG -u $(EVERYTHING)
-today:
- -rcsdiff -r_`date +%y%m%d` -u $(EVERYTHING)
-ident:
- for a in $(EVERYTHING); do ident $$a; done
-
-# Distribution .tar:
-easy-tls.tar.gz: $(EVERYTHING)
- tar cvf - $(EVERYTHING) | \
- gzip -9 > easy-tls.tar.gz
-
-# Working .tar:
-tls.tgz: $(EVERYTHING)
- tar cfv - `find . -type f -a ! -name '*.tgz' -a ! -name '*.tar.gz'` | \
- gzip -9 > tls.tgz
-
-# For emacs:
-etags: TAGS
-TAGS: $(SOURCES) $(HEADERS)
- -etags $(SOURCES) $(HEADERS)
-
-
-#############################################################################
-#
-# Compilation
-#
-# The following definitions are system dependent (and hence defined
-# at the beginning of this Makefile, where they are more easily found):
-
-### CC=gcc
-### SYSCFLAGS=-Wall -pedantic -g -O2
-### SYSLIBS=-lxnet
-
-EXTRACFLAGS=-DTLS_APP=\"test.h\"
-# EXTRACFLAGS=-DTLS_APP=\"test.h\" -DDEBUG_TLS
-
-#
-# The rest shouldn't need to be touched.
-#
-LDFLAGS=$(SYSLIBS) $(OPENSSLLIBS)
-INCLUDES=$(OPENSSLINCLUDES)
-CFLAGS=$(SYSCFLAGS) $(EXTRACFLAGS) $(INCLUDES)
-
-OBJS=easy-tls.o test.o
-
-clean:
- @rm -f test
- @rm -f TAGS
- @rm -f *.o
- @rm -f core
-
-test: $(OBJS)
- $(CC) $(OBJS) $(LDFLAGS) -o test
-
-test.o: $(HEADERS)
-easy-tls.o: $(HEADERS)
diff --git a/deps/openssl/openssl/demos/easy_tls/README b/deps/openssl/openssl/demos/easy_tls/README
deleted file mode 100644
index ee89dfb942..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/README
+++ /dev/null
@@ -1,65 +0,0 @@
-easy_tls - generic SSL/TLS proxy
-========
-
-(... and example for non-blocking SSL/TLS I/O multiplexing.)
-
-
- easy_tls.c, easy_tls.h:
-
- Small generic SSL/TLS proxy library: With a few function calls,
- an application socket will be replaced by a pipe handled by a
- separate SSL/TLS proxy process. This allows easily adding
- SSL/TLS support to many programs not originally designed for it.
-
- [Actually easy_tls.c is not a proper library: Customization
- requires defining preprocessor macros while compiling it.
- This is quite confusing, so I'll probably change it.]
-
- These files may be used under the OpenSSL license.
-
-
-
- test.c, test.h, Makefile, cert.pem, cacerts.pem:
-
- Rudimentary example program using the easy_tls library, and
- example key and certificates for it. Usage examples:
-
- $ ./test 8443 # create server listening at port 8443
- $ ./test 127.0.0.1 8443 # create client, connect to port 8443
- # at IP address 127.0.0.1
-
- 'test' will not automatically do SSL/TLS, or even read or write
- data -- it must be told to do so on input lines starting
- with a command letter. 'W' means write a line, 'R' means
- read a line, 'C' means close the connection, 'T' means
- start an SSL/TLS proxy. E.g. (user input tagged with '*'):
-
- * R
- <<< 220 mail.example.net
- * WSTARTTLS
- >>> STARTTLS
- * R
- <<< 220 Ready to start TLS
- * T
- test_process_init(fd = 3, client_p = 1, apparg = (nil))
- +++ `E:self signed certificate in certificate chain'
- +++ `<... certificate info ...>'
- * WHELO localhost
- >>> HELO localhost
- R
- <<< 250 mail.example.net
-
- You can even do SSL/TLS over SSL/TLS over SSL/TLS ... by using
- 'T' multiple times. I have no idea why you would want to though.
-
-
-This code is rather old. When I find time I will update anything that
-should be changed, and improve code comments. To compile the sample
-program 'test' on platforms other then Linux or Solaris, you will have
-to edit the Makefile.
-
-As noted above, easy_tls.c will be changed to become a library one
-day, which means that future revisions will not be fully compatible to
-the current version.
-
-Bodo Möller <bodo@openssl.org>
diff --git a/deps/openssl/openssl/demos/easy_tls/cacerts.pem b/deps/openssl/openssl/demos/easy_tls/cacerts.pem
deleted file mode 100644
index acc70baf19..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/cacerts.pem
+++ /dev/null
@@ -1,18 +0,0 @@
-$Id: cacerts.pem,v 1.1 2001/09/17 19:06:57 bodo Exp $
-
-issuer= /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test PCA (1024 bit)
-subject=/C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit)
------BEGIN CERTIFICATE-----
-MIICJjCCAY8CAQAwDQYJKoZIhvcNAQEEBQAwXDELMAkGA1UEBhMCQVUxEzARBgNV
-BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYD
-VQQDExNUZXN0IFBDQSAoMTAyNCBiaXQpMB4XDTk3MDYwOTEzNTc0M1oXDTAxMDYw
-OTEzNTc0M1owWzELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY
-BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRswGQYDVQQDExJUZXN0IENBICgxMDI0
-IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKO7o8t116VP6cgybTsZ
-DCZhr95nYlZuya3aCi1IKoztqwWnjbmDFIriOqGFPrZQ+moMETC9D59iRW/dFXSv
-1F65ka/XY2hLh9exCCo7XuUcDs53Qp3bI3AmMqHjgzE8oO3ajyJAzJkTTOUecQU2
-mw/gI4tMM0LqWMQS7luTy4+xAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAM7achv3v
-hLQJcv/65eGEpBXM40ZDVoFQFFJWaY5p883HTqLB1x4FdzsXHH0QKBTcKpWwqyu4
-YDm3fb8oDugw72bCzfyZK/zVZPR/hVlqI/fvU109Qoc+7oPvIXWky71HfcK6ZBCA
-q30KIqGM/uoM60INq97qjDmCJapagcNBGQs=
------END CERTIFICATE-----
diff --git a/deps/openssl/openssl/demos/easy_tls/cert.pem b/deps/openssl/openssl/demos/easy_tls/cert.pem
deleted file mode 100644
index 364fe10d5b..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/cert.pem
+++ /dev/null
@@ -1,31 +0,0 @@
-$Id: cert.pem,v 1.1 2001/09/17 19:06:57 bodo Exp $
-
-Example certificate and key.
-
------BEGIN CERTIFICATE-----
-MIIB1jCCAT8CAQEwDQYJKoZIhvcNAQEEBQAwRTELMAkGA1UEBhMCQVUxEzARBgNV
-BAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
-ZDAeFw05OTA1MDEwMTI2MzVaFw05OTA1MzEwMTI2MzVaMCIxCzAJBgNVBAYTAkRF
-MRMwEQYDVQQDEwpUZXN0c2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
-gQD6I3oDKiexwwlkzjar69AIFnVUaG85LtCege2R+CtIDlkQYw68/8MbT3ou0pdF
-AcL9IGiYY3Y0SHM9PqF00RO1MCtNpqTnF3ScLpbmggGjKilmWYn2ai7emdjMjXVL
-tzWW2xGgIGATWQN32KgfJng4jXi1UjEiyLhkw0Zf1I/ggwIDAQABMA0GCSqGSIb3
-DQEBBAUAA4GBAMgM+sbAk8DfjSfa+Rf2gcGXmbrvZAzKzC+5RU3kaq/NyxIXAGco
-9dZjozzWfN/xuGup5boFk+KrP+xdgsaqGHsyzlgEoqz4ekqLjQeVbnoj339hVFU9
-MhPi6JULPxjXKumjfX2LLNkikW5puz8Df3UiX0EiaJvd7EwP8J75tiUT
------END CERTIFICATE-----
------BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQD6I3oDKiexwwlkzjar69AIFnVUaG85LtCege2R+CtIDlkQYw68
-/8MbT3ou0pdFAcL9IGiYY3Y0SHM9PqF00RO1MCtNpqTnF3ScLpbmggGjKilmWYn2
-ai7emdjMjXVLtzWW2xGgIGATWQN32KgfJng4jXi1UjEiyLhkw0Zf1I/ggwIDAQAB
-AoGANST8c1etf1MU19oIO5aqaE19OCXIG7oakNLCCtVTPMfvnE+vffBJH7BPIUuU
-4BBzwRv1nQrkvk72TPjVjOAu81B1SStKQueun2flVuYxp9NyupNWCBley4QdohlP
-I92ml2tzTSPmNIoA6jdGyNzFcGchapRRmejsC39F1RUbHQECQQD9KX81Wt8ZOrri
-dWiEXja1L3X8Bkb9vvUjVMQDTJJPxBJjehC6eurgE6PP6SJD5p/f3RHPCcLr8tSM
-D4P/OpKhAkEA/PFNlhIZUDKK6aTvG2mn7qQ5phbadOoyN1Js3ttWG5OMOZ6b/QlC
-Wvp84h44506BIlv+Tg2YAI0AdBUrf7oEowJAM4joAVd/ROaEtqbJ4PBA2L9RmD06
-5FqkEk4mHLnQqvYx/BgUIbH18ClvVlqSBBqFfw/EmU3WZSuogt6Bs0ocIQJBAOxB
-AoPiYcxbeQ5kZIVJOXaX49SzUdaUDNVJYrEBUzsspHQJJo/Avz606kJVkjbSR6Ft
-JWmIHuqcyMikIV4KxFsCQQCU2evoVjVsqkkbHi7W28f73PGBsyu0KIwlK7nu4h08
-Daf7TAI+A6jW/WRUsJ6dFhUYi7/Jvkcdrlnbgm2fxziX
------END RSA PRIVATE KEY-----
diff --git a/deps/openssl/openssl/demos/easy_tls/easy-tls.c b/deps/openssl/openssl/demos/easy_tls/easy-tls.c
deleted file mode 100644
index 717b81aac1..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/easy-tls.c
+++ /dev/null
@@ -1,1312 +0,0 @@
-/* */
-/*-
- * easy-tls.c -- generic TLS proxy.
- * $Id: easy-tls.c,v 1.4 2002/03/05 09:07:16 bodo Exp $
- */
-/*-
- (c) Copyright 1999 Bodo Moeller. All rights reserved.
-
- This is free software; you can redistributed and/or modify it
- unter the terms of either
- - the GNU General Public License as published by the
- Free Software Foundation, version 1, or (at your option)
- any later version,
- or
- - the following license:
-*/
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that each of the following
- * conditions is met:
- *
- * 1. Redistributions qualify as "freeware" or "Open Source Software" under
- * one of the following terms:
- *
- * (a) Redistributions are made at no charge beyond the reasonable cost of
- * materials and delivery.
- *
- * (b) Redistributions are accompanied by a copy of the Source Code
- * or by an irrevocable offer to provide a copy of the Source Code
- * for up to three years at the cost of materials and delivery.
- * Such redistributions must allow further use, modification, and
- * redistribution of the Source Code under substantially the same
- * terms as this license.
- *
- * 2. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 3. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 4. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by Bodo Moeller."
- * (If available, substitute umlauted o for oe.)
- *
- * 5. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by Bodo Moeller."
- *
- * THIS SOFTWARE IS PROVIDED BY BODO MOELLER ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BODO MOELLER OR
- * HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-/*-
- * Attribution for OpenSSL library:
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- * This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.openssl.org/)
- */
-
-static char const rcsid[] =
- "$Id: easy-tls.c,v 1.4 2002/03/05 09:07:16 bodo Exp $";
-
-#include <assert.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <stdarg.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/select.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/utsname.h>
-#include <unistd.h>
-
-#include <openssl/crypto.h>
-#include <openssl/dh.h>
-#include <openssl/dsa.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/opensslv.h>
-#include <openssl/pem.h>
-#include <openssl/rand.h>
-#ifndef NO_RSA
-# include <openssl/rsa.h>
-#endif
-#include <openssl/ssl.h>
-#include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
-
-#if OPENSSL_VERSION_NUMBER < 0x00904000L /* 0.9.4-dev */
-# error "This program needs OpenSSL 0.9.4 or later."
-#endif
-
-#include "easy-tls.h" /* include after <openssl/ssl.h> if both are
- * needed */
-
-#if TLS_INFO_SIZE > PIPE_BUF
-# if PIPE_BUF < 512
-# error "PIPE_BUF < 512" /* non-POSIX */
-# endif
-# error "TLS_INFO_SIZE > PIPE_BUF"
-#endif
-
-/*****************************************************************************/
-
-#ifdef TLS_APP
-# include TLS_APP
-#endif
-
-/*-
- * Applications can define:
- * TLS_APP_PROCESS_INIT -- void ...(int fd, int client_p, void *apparg)
- * TLS_CUMULATE_ERRORS
- * TLS_ERROR_BUFSIZ
- * TLS_APP_ERRFLUSH -- void ...(int child_p, char *, size_t, void *apparg)
- */
-
-#ifndef TLS_APP_PROCESS_INIT
-# define TLS_APP_PROCESS_INIT(fd, client_p, apparg) ((void) 0)
-#endif
-
-#ifndef TLS_ERROR_BUFSIZ
-# define TLS_ERROR_BUFSIZ (10*160)
-#endif
-#if TLS_ERROR_BUFSIZ < 2 /* {'\n',0} */
-# error "TLS_ERROR_BUFSIZE is too small."
-#endif
-
-#ifndef TLS_APP_ERRFLUSH
-# define TLS_APP_ERRFLUSH tls_app_errflush
-static void
-tls_app_errflush(int child_p, char *errbuf, size_t num, void *apparg)
-{
- fputs(errbuf, stderr);
-}
-#endif
-
-/*****************************************************************************/
-
-#ifdef DEBUG_TLS
-# define DEBUG_MSG(x) fprintf(stderr," %s\n",x)
-# define DEBUG_MSG2(x,y) fprintf(stderr, " %s: %d\n",x,y)
-static int tls_loop_count = 0;
-static int tls_select_count = 0;
-#else
-# define DEBUG_MSG(x) (void)0
-# define DEBUG_MSG2(x,y) (void)0
-#endif
-
-static void tls_rand_seed_uniquely(void);
-static void tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx,
- int client_p);
-static int tls_socket_nonblocking(int fd);
-
-static int tls_child_p = 0;
-static void *tls_child_apparg;
-
-struct tls_start_proxy_args tls_start_proxy_defaultargs(void)
-{
- struct tls_start_proxy_args ret;
-
- ret.fd = -1;
- ret.client_p = -1;
- ret.ctx = NULL;
- ret.pid = NULL;
- ret.infofd = NULL;
-
- return ret;
-}
-
-/*-
- * Slice in TLS proxy process at fd.
- * Return value:
- * 0 ok (*pid is set to child's PID if pid != NULL),
- * < 0 look at errno
- * > 0 other error
- * (return value encodes place of error)
- *
- */
-int tls_start_proxy(struct tls_start_proxy_args a, void *apparg)
-{
- int fds[2] = { -1, -1 };
- int infofds[2] = { -1, -1 };
- int r, getfd, getfl;
- int ret;
-
- DEBUG_MSG2("tls_start_proxy fd", a.fd);
- DEBUG_MSG2("tls_start_proxy client_p", a.client_p);
-
- if (a.fd == -1 || a.client_p == -1 || a.ctx == NULL)
- return 1;
-
- if (a.pid != NULL) {
- *a.pid = 0;
- }
- if (a.infofd != NULL) {
- *a.infofd = -1;
- }
-
- r = socketpair(AF_UNIX, SOCK_STREAM, 0, fds);
- if (r == -1)
- return -1;
- if (a.fd >= FD_SETSIZE || fds[0] >= FD_SETSIZE) {
- ret = 2;
- goto err;
- }
- if (a.infofd != NULL) {
- r = pipe(infofds);
- if (r == -1) {
- ret = -3;
- goto err;
- }
- }
-
- r = fork();
- if (r == -1) {
- ret = -4;
- goto err;
- }
- if (r == 0) {
- DEBUG_MSG("fork");
- tls_child_p = 1;
- tls_child_apparg = apparg;
- close(fds[1]);
- if (infofds[0] != -1)
- close(infofds[0]);
- TLS_APP_PROCESS_INIT(a.fd, a.client_p, apparg);
- DEBUG_MSG("TLS_APP_PROCESS_INIT");
- tls_proxy(fds[0], a.fd, infofds[1], a.ctx, a.client_p);
- exit(0);
- }
- if (a.pid != NULL)
- *a.pid = r;
- if (infofds[1] != -1) {
- close(infofds[1]);
- infofds[1] = -1;
- }
- /* install fds[1] in place of fd: */
- close(fds[0]);
- fds[0] = -1;
- getfd = fcntl(a.fd, F_GETFD);
- getfl = fcntl(a.fd, F_GETFL);
- r = dup2(fds[1], a.fd);
- close(fds[1]);
- fds[1] = -1;
- if (r == -1) {
- ret = -5;
- goto err;
- }
- if (getfd != 1)
- fcntl(a.fd, F_SETFD, getfd);
- if (getfl & O_NONBLOCK)
- (void)tls_socket_nonblocking(a.fd);
- if (a.infofd != NULL)
- *a.infofd = infofds[0];
- return 0;
-
- err:
- if (fds[0] != -1)
- close(fds[0]);
- if (fds[1] != -1)
- close(fds[1]);
- if (infofds[0] != -1)
- close(infofds[0]);
- if (infofds[1] != -1)
- close(infofds[1]);
- return ret;
-}
-
-/*****************************************************************************/
-
-static char errbuf[TLS_ERROR_BUFSIZ];
-static size_t errbuf_i = 0;
-
-static void tls_errflush(void *apparg)
-{
- if (errbuf_i == 0)
- return;
-
- assert(errbuf_i < sizeof(errbuf));
- assert(errbuf[errbuf_i] == 0);
- if (errbuf_i == sizeof(errbuf) - 1) {
- /* make sure we have a newline, even if string has been truncated */
- errbuf[errbuf_i - 1] = '\n';
- }
-
- /*
- * TLS_APP_ERRFLUSH may modify the string as needed, e.g. substitute
- * other characters for \n for convenience
- */
- TLS_APP_ERRFLUSH(tls_child_p, errbuf, errbuf_i, apparg);
-
- errbuf_i = 0;
-}
-
-static void tls_errprintf(int flush, void *apparg, const char *fmt, ...)
-{
- va_list args;
- int r;
-
- if (errbuf_i < sizeof(errbuf) - 1) {
- size_t n;
-
- va_start(args, fmt);
- n = (sizeof(errbuf)) - errbuf_i;
- r = vsnprintf(errbuf + errbuf_i, n, fmt, args);
- va_end(args);
- if (r >= n)
- r = n - 1;
- if (r >= 0) {
- errbuf_i += r;
- } else {
- errbuf_i = sizeof(errbuf) - 1;
- errbuf[errbuf_i] = '\0';
- }
- assert(errbuf_i < sizeof(errbuf));
- assert(errbuf[errbuf_i] == 0);
- }
-#ifndef TLS_CUMULATE_ERRORS
- tls_errflush(apparg);
-#else
- if (flush)
- tls_errflush(apparg);
-#endif
-}
-
-/*
- * app_prefix.. are for additional information provided by caller. If OpenSSL
- * error queue is empty, print default_text ("???" if NULL).
- */
-static char *tls_openssl_errors(const char *app_prefix_1,
- const char *app_prefix_2,
- const char *default_text, void *apparg)
-{
- static char reasons[255];
- size_t reasons_i;
- unsigned long err;
- const char *file;
- int line;
- const char *data;
- int flags;
- char *errstring;
- int printed_something = 0;
-
- reasons_i = 0;
-
- assert(app_prefix_1 != NULL);
- assert(app_prefix_2 != NULL);
-
- if (default_text == NULL)
- default_text = "?" "?" "?";
-
- while ((err = ERR_get_error_line_data(&file, &line, &data, &flags)) != 0) {
- if (reasons_i < sizeof(reasons)) {
- size_t n;
- int r;
-
- n = (sizeof(reasons)) - reasons_i;
- r = snprintf(reasons + reasons_i, n, "%s%s",
- (reasons_i > 0 ? ", " : ""),
- ERR_reason_error_string(err));
- if (r >= n)
- r = n - 1;
- if (r >= 0) {
- reasons_i += r;
- } else {
- reasons_i = sizeof(reasons);
- }
- assert(reasons_i <= sizeof(reasons));
- }
-
- errstring = ERR_error_string(err, NULL);
- assert(errstring != NULL);
- tls_errprintf(0, apparg, "OpenSSL error%s%s: %s:%s:%d:%s\n",
- app_prefix_1, app_prefix_2, errstring, file, line,
- (flags & ERR_TXT_STRING) ? data : "");
- printed_something = 1;
- }
-
- if (!printed_something) {
- assert(reasons_i == 0);
- snprintf(reasons, sizeof(reasons), "%s", default_text);
- tls_errprintf(0, apparg, "OpenSSL error%s%s: %s\n", app_prefix_1,
- app_prefix_2, default_text);
- }
-#ifdef TLS_CUMULATE_ERRORS
- tls_errflush(apparg);
-#endif
- assert(errbuf_i == 0);
-
- return reasons;
-}
-
-/*****************************************************************************/
-
-static int tls_init_done = 0;
-
-static int tls_init(void *apparg)
-{
- if (tls_init_done)
- return 0;
-
- SSL_load_error_strings();
- if (!SSL_library_init() /* aka SSLeay_add_ssl_algorithms() */ ) {
- tls_errprintf(1, apparg, "SSL_library_init failed.\n");
- return -1;
- }
- tls_init_done = 1;
- tls_rand_seed();
- return 0;
-}
-
-/*****************************************************************************/
-
-static void tls_rand_seed_uniquely(void)
-{
- struct {
- pid_t pid;
- time_t time;
- void *stack;
- } data;
-
- data.pid = getpid();
- data.time = time(NULL);
- data.stack = (void *)&data;
-
- RAND_seed((const void *)&data, sizeof(data));
-}
-
-void tls_rand_seed(void)
-{
- struct {
- struct utsname uname;
- int uname_1;
- int uname_2;
- uid_t uid;
- uid_t euid;
- gid_t gid;
- gid_t egid;
- } data;
-
- data.uname_1 = uname(&data.uname);
- data.uname_2 = errno; /* Let's hope that uname fails randomly :-) */
-
- data.uid = getuid();
- data.euid = geteuid();
- data.gid = getgid();
- data.egid = getegid();
-
- RAND_seed((const void *)&data, sizeof(data));
- tls_rand_seed_uniquely();
-}
-
-static int tls_rand_seeded_p = 0;
-
-#define my_MIN_SEED_BYTES 256 /* struct stat can be larger than 128 */
-int tls_rand_seed_from_file(const char *filename, size_t n, void *apparg)
-{
- /*
- * Seed OpenSSL's random number generator from file. Try to read n bytes
- * if n > 0, whole file if n == 0.
- */
-
- int r;
-
- if (tls_init(apparg) == -1)
- return -1;
- tls_rand_seed();
-
- r = RAND_load_file(filename,
- (n > 0 && n < LONG_MAX) ? (long)n : LONG_MAX);
- /*
- * r is the number of bytes filled into the random number generator,
- * which are taken from "stat(filename, ...)" in addition to the file
- * contents.
- */
- assert(1 < my_MIN_SEED_BYTES);
- /*
- * We need to detect at least those cases when the file does not exist at
- * all. With current versions of OpenSSL, this should do it:
- */
- if (n == 0)
- n = my_MIN_SEED_BYTES;
- if (r < n) {
- tls_errprintf(1, apparg,
- "rand_seed_from_file: could not read %d bytes from %s.\n",
- n, filename);
- return -1;
- } else {
- tls_rand_seeded_p = 1;
- return 0;
- }
-}
-
-void tls_rand_seed_from_memory(const void *buf, size_t n)
-{
- size_t i = 0;
-
- while (i < n) {
- size_t rest = n - i;
- int chunk = rest < INT_MAX ? (int)rest : INT_MAX;
- RAND_seed((const char *)buf + i, chunk);
- i += chunk;
- }
- tls_rand_seeded_p = 1;
-}
-
-/*****************************************************************************/
-
-struct tls_x509_name_string {
- char str[100];
-};
-
-static void
-tls_get_x509_subject_name_oneline(X509 *cert,
- struct tls_x509_name_string *namestring)
-{
- X509_NAME *name;
-
- if (cert == NULL) {
- namestring->str[0] = '\0';
- return;
- }
-
- name = X509_get_subject_name(cert); /* does not increment any reference
- * counter */
-
- assert(sizeof(namestring->str) >= 4); /* "?" or "...", plus 0 */
-
- if (name == NULL) {
- namestring->str[0] = '?';
- namestring->str[1] = 0;
- } else {
- size_t len;
-
- X509_NAME_oneline(name, namestring->str, sizeof(namestring->str));
- len = strlen(namestring->str);
- assert(namestring->str[len] == 0);
- assert(len < sizeof(namestring->str));
-
- if (len + 1 == sizeof(namestring->str)) {
- /*
- * (Probably something was cut off.) Does not really work --
- * X509_NAME_oneline truncates after name components, we cannot
- * tell from the result whether anything is missing.
- */
-
- assert(namestring->str[len] == 0);
- namestring->str[--len] = '.';
- namestring->str[--len] = '.';
- namestring->str[--len] = '.';
- }
- }
-}
-
-/*****************************************************************************/
-
-/* to hinder OpenSSL from asking for passphrases */
-static int no_passphrase_callback(char *buf, int num, int w, void *arg)
-{
- return -1;
-}
-
-#if OPENSSL_VERSION_NUMBER >= 0x00907000L
-static int verify_dont_fail_cb(X509_STORE_CTX *c, void *unused_arg)
-#else
-static int verify_dont_fail_cb(X509_STORE_CTX *c)
-#endif
-{
- int i;
-
- i = X509_verify_cert(c); /* sets c->error */
-#if OPENSSL_VERSION_NUMBER >= 0x00905000L /* don't allow unverified
- * certificates -- they could
- * survive session reuse, but
- * OpenSSL < 0.9.5-dev does not
- * preserve their verify_result */
- if (i == 0)
- return 1;
- else
-#endif
- return i;
-}
-
-static DH *tls_dhe1024 = NULL; /* generating these takes a while, so do it
- * just once */
-
-void tls_set_dhe1024(int i, void *apparg)
-{
- DSA *dsaparams;
- DH *dhparams;
- const char *seed[] = { ";-) :-( :-) :-( ",
- ";-) :-( :-) :-( ",
- "Random String no. 12",
- ";-) :-( :-) :-( ",
- "hackers have even mo", /* from jargon file */
- };
- unsigned char seedbuf[20];
-
- tls_init(apparg);
- if (i >= 0) {
- i %= sizeof(seed) / sizeof(seed[0]);
- assert(strlen(seed[i]) == 20);
- memcpy(seedbuf, seed[i], 20);
- dsaparams =
- DSA_generate_parameters(1024, seedbuf, 20, NULL, NULL, 0, NULL);
- } else {
- /* random parameters (may take a while) */
- dsaparams =
- DSA_generate_parameters(1024, NULL, 0, NULL, NULL, 0, NULL);
- }
-
- if (dsaparams == NULL) {
- tls_openssl_errors("", "", NULL, apparg);
- return;
- }
- dhparams = DSA_dup_DH(dsaparams);
- DSA_free(dsaparams);
- if (dhparams == NULL) {
- tls_openssl_errors("", "", NULL, apparg);
- return;
- }
- if (tls_dhe1024 != NULL)
- DH_free(tls_dhe1024);
- tls_dhe1024 = dhparams;
-}
-
-struct tls_create_ctx_args tls_create_ctx_defaultargs(void)
-{
- struct tls_create_ctx_args ret;
-
- ret.client_p = 0;
- ret.certificate_file = NULL;
- ret.key_file = NULL;
- ret.ca_file = NULL;
- ret.verify_depth = -1;
- ret.fail_unless_verified = 0;
- ret.export_p = 0;
-
- return ret;
-}
-
-SSL_CTX *tls_create_ctx(struct tls_create_ctx_args a, void *apparg)
-{
- int r;
- static long context_num = 0;
- SSL_CTX *ret;
- const char *err_pref_1 = "", *err_pref_2 = "";
-
- if (tls_init(apparg) == -1)
- return NULL;
-
- ret =
- SSL_CTX_new((a.client_p ? SSLv23_client_method :
- SSLv23_server_method) ());
-
- if (ret == NULL)
- goto err;
-
- SSL_CTX_set_default_passwd_cb(ret, no_passphrase_callback);
- SSL_CTX_set_mode(ret, SSL_MODE_ENABLE_PARTIAL_WRITE);
-
- if ((a.certificate_file != NULL) || (a.key_file != NULL)) {
- if (a.key_file == NULL) {
- tls_errprintf(1, apparg, "Need a key file.\n");
- goto err_return;
- }
- if (a.certificate_file == NULL) {
- tls_errprintf(1, apparg, "Need a certificate chain file.\n");
- goto err_return;
- }
-
- if (!SSL_CTX_use_PrivateKey_file(ret, a.key_file, SSL_FILETYPE_PEM))
- goto err;
- if (!tls_rand_seeded_p) {
- /*
- * particularly paranoid people may not like this -- so provide
- * your own random seeding before calling this
- */
- if (tls_rand_seed_from_file(a.key_file, 0, apparg) == -1)
- goto err_return;
- }
- if (!SSL_CTX_use_certificate_chain_file(ret, a.certificate_file))
- goto err;
- if (!SSL_CTX_check_private_key(ret)) {
- tls_errprintf(1, apparg,
- "Private key \"%s\" does not match certificate \"%s\".\n",
- a.key_file, a.certificate_file);
- goto err_peek;
- }
- }
-
- if ((a.ca_file != NULL) || (a.verify_depth > 0)) {
- context_num++;
- r = SSL_CTX_set_session_id_context(ret, (const void *)&context_num,
- (unsigned int)sizeof(context_num));
- if (!r)
- goto err;
-
- SSL_CTX_set_verify(ret,
- SSL_VERIFY_PEER | (a.fail_unless_verified ?
- SSL_VERIFY_FAIL_IF_NO_PEER_CERT
- : 0), 0);
- if (!a.fail_unless_verified)
- SSL_CTX_set_cert_verify_callback(ret, verify_dont_fail_cb, NULL);
-
- if (a.verify_depth > 0)
- SSL_CTX_set_verify_depth(ret, a.verify_depth);
-
- if (a.ca_file != NULL) {
- /* does not report failure if file does not exist ... */
- /* NULL argument means no CA-directory */
- r = SSL_CTX_load_verify_locations(ret, a.ca_file, NULL);
- if (!r) {
- err_pref_1 = " while processing certificate file ";
- err_pref_2 = a.ca_file;
- goto err;
- }
-
- if (!a.client_p) {
- /*
- * SSL_load_client_CA_file is a misnomer, it just creates a
- * list of CNs.
- */
- SSL_CTX_set_client_CA_list(ret,
- SSL_load_client_CA_file
- (a.ca_file));
- /*
- * SSL_CTX_set_client_CA_list does not have a return value;
- * it does not really need one, but make sure (we really test
- * if SSL_load_client_CA_file worked)
- */
- if (SSL_CTX_get_client_CA_list(ret) == NULL) {
- tls_errprintf(1, apparg,
- "Could not set client CA list from \"%s\".\n",
- a.ca_file);
- goto err_peek;
- }
- }
- }
- }
-
- if (!a.client_p) {
- if (tls_dhe1024 == NULL) {
- int i;
-
- if (RAND_bytes((unsigned char *)&i, sizeof(i)) <= 0)
- goto err_return;
- /*
- * make sure that i is non-negative -- pick one of the provided
- * seeds
- */
- if (i < 0)
- i = -i;
- if (i < 0)
- i = 0;
- tls_set_dhe1024(i, apparg);
- if (tls_dhe1024 == NULL)
- goto err_return;
- }
-
- if (!SSL_CTX_set_tmp_dh(ret, tls_dhe1024))
- goto err;
-
- /* avoid small subgroup attacks: */
- SSL_CTX_set_options(ret, SSL_OP_SINGLE_DH_USE);
- }
-#ifndef NO_RSA
- if (!a.client_p && a.export_p) {
- RSA *tmpkey;
-
- tmpkey = RSA_generate_key(512, RSA_F4, 0, NULL);
- if (tmpkey == NULL)
- goto err;
- if (!SSL_CTX_set_tmp_rsa(ret, tmpkey)) {
- RSA_free(tmpkey);
- goto err;
- }
- RSA_free(tmpkey); /* SSL_CTX_set_tmp_rsa uses a duplicate. */
- }
-#endif
-
- return ret;
-
- err_peek:
- if (!ERR_peek_error())
- goto err_return;
- err:
- tls_openssl_errors(err_pref_1, err_pref_2, NULL, apparg);
- err_return:
- if (ret != NULL)
- SSL_CTX_free(ret);
- return NULL;
-}
-
-/*****************************************************************************/
-
-static int tls_socket_nonblocking(int fd)
-{
- int v, r;
-
- v = fcntl(fd, F_GETFL, 0);
- if (v == -1) {
- if (errno == EINVAL)
- return 0; /* already shut down -- ignore */
- return -1;
- }
- r = fcntl(fd, F_SETFL, v | O_NONBLOCK);
- if (r == -1) {
- if (errno == EINVAL)
- return 0; /* already shut down -- ignore */
- return -1;
- }
- return 0;
-}
-
-static int max(int a, int b)
-{
- return a > b ? a : b;
-}
-
-/* timeout, -1 means no timeout */
-static void
-tls_sockets_select(int read_select_1, int read_select_2, int write_select_1,
- int write_select_2, int seconds)
-{
- int maxfd, n;
- fd_set reads, writes;
- struct timeval timeout;
- struct timeval *timeout_p;
-
- assert(read_select_1 >= -1 && read_select_2 >= -1 && write_select_1 >= -1
- && write_select_2 >= -1);
- assert(read_select_1 < FD_SETSIZE && read_select_2 < FD_SETSIZE - 1
- && write_select_1 < FD_SETSIZE - 1
- && write_select_2 < FD_SETSIZE - 1);
-
- maxfd =
- max(max(read_select_1, read_select_2),
- max(write_select_1, write_select_2));
- assert(maxfd >= 0);
-
- FD_ZERO(&reads);
- FD_ZERO(&writes);
-
- for (n = 0; n < 4; ++n) {
- int i = n % 2;
- int w = n >= 2;
- /* loop over all (i, w) in {0,1}x{0,1} */
- int fd;
-
- if (i == 0 && w == 0)
- fd = read_select_1;
- else if (i == 1 && w == 0)
- fd = read_select_2;
- else if (i == 0 && w == 1)
- fd = write_select_1;
- else {
- assert(i == 1 && w == 1);
- fd = write_select_2;
- }
-
- if (fd >= 0) {
- if (w == 0)
- FD_SET(fd, &reads);
- else /* w == 1 */
- FD_SET(fd, &writes);
- }
- }
-
- if (seconds >= 0) {
- timeout.tv_sec = seconds;
- timeout.tv_usec = 0;
- timeout_p = &timeout;
- } else
- timeout_p = NULL;
-
- DEBUG_MSG2("select no.", ++tls_select_count);
- select(maxfd + 1, &reads, &writes, (fd_set *) NULL, timeout_p);
- DEBUG_MSG("cont.");
-}
-
-/*****************************************************************************/
-
-#define TUNNELBUFSIZE (16*1024)
-struct tunnelbuf {
- char buf[TUNNELBUFSIZE];
- size_t len;
- size_t offset;
-};
-
-static int tls_connect_attempt(SSL *, int *write_select, int *read_select,
- int *closed, int *progress,
- const char **err_pref);
-
-static int tls_accept_attempt(SSL *, int *write_select, int *read_select,
- int *closed, int *progress,
- const char **err_pref);
-
-static int tls_write_attempt(SSL *, struct tunnelbuf *, int *write_select,
- int *read_select, int *closed, int *progress,
- const char **err_pref);
-
-static int tls_read_attempt(SSL *, struct tunnelbuf *, int *write_select,
- int *read_select, int *closed, int *progress,
- const char **err_pref);
-
-static int write_attempt(int fd, struct tunnelbuf *, int *select, int *closed,
- int *progress);
-
-static int read_attempt(int fd, struct tunnelbuf *, int *select, int *closed,
- int *progress);
-
-static void write_info(SSL *ssl, int *info_fd)
-{
- if (*info_fd != -1) {
- long v;
- int v_ok;
- struct tls_x509_name_string peer;
- char infobuf[TLS_INFO_SIZE];
- int r;
-
- DEBUG_MSG("write_info");
- v = SSL_get_verify_result(ssl);
- v_ok = (v == X509_V_OK) ? 'A' : 'E'; /* Auth./Error */
- {
- X509 *peercert;
-
- peercert = SSL_get_peer_certificate(ssl);
- tls_get_x509_subject_name_oneline(peercert, &peer);
- if (peercert != NULL)
- X509_free(peercert);
- }
- if (peer.str[0] == '\0')
- v_ok = '0'; /* no cert at all */
- else if (strchr(peer.str, '\n')) {
- /* should not happen, but make sure */
- *strchr(peer.str, '\n') = '\0';
- }
- r = snprintf(infobuf, sizeof(infobuf), "%c:%s\n%s\n", v_ok,
- X509_verify_cert_error_string(v), peer.str);
- DEBUG_MSG2("snprintf", r);
- if (r == -1 || r >= sizeof(infobuf))
- r = sizeof(infobuf) - 1;
- write(*info_fd, infobuf, r);
- close(*info_fd);
- *info_fd = -1;
- }
-}
-
-/* tls_proxy expects that all fds are closed after return */
-static void
-tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, int client_p)
-{
- struct tunnelbuf clear_to_tls, tls_to_clear;
- SSL *ssl;
- BIO *rbio, *wbio;
- int closed, in_handshake;
- const char *err_pref_1 = "", *err_pref_2 = "";
- const char *err_def = NULL;
-
- assert(clear_fd != -1);
- assert(tls_fd != -1);
- assert(clear_fd < FD_SETSIZE);
- assert(tls_fd < FD_SETSIZE);
- /* info_fd may be -1 */
- assert(ctx != NULL);
-
- tls_rand_seed_uniquely();
-
- tls_socket_nonblocking(clear_fd);
- DEBUG_MSG2("clear_fd", clear_fd);
- tls_socket_nonblocking(tls_fd);
- DEBUG_MSG2("tls_fd", tls_fd);
-
- ssl = SSL_new(ctx);
- if (ssl == NULL)
- goto err;
- DEBUG_MSG("SSL_new");
- if (!SSL_set_fd(ssl, tls_fd))
- goto err;
- rbio = SSL_get_rbio(ssl);
- wbio = SSL_get_wbio(ssl); /* should be the same, but who cares */
- assert(rbio != NULL);
- assert(wbio != NULL);
- if (client_p)
- SSL_set_connect_state(ssl);
- else
- SSL_set_accept_state(ssl);
-
- closed = 0;
- in_handshake = 1;
- tls_to_clear.len = 0;
- tls_to_clear.offset = 0;
- clear_to_tls.len = 0;
- clear_to_tls.offset = 0;
-
- err_def = "I/O error";
-
- /*
- * loop finishes as soon as we detect that one side closed; when all
- * (program and OS) buffers have enough space, the data from the last
- * succesful read in each direction is transferred before close
- */
- do {
- int clear_read_select = 0, clear_write_select = 0,
- tls_read_select = 0, tls_write_select = 0, progress = 0;
- int r;
- unsigned long num_read = BIO_number_read(rbio),
- num_written = BIO_number_written(wbio);
-
- DEBUG_MSG2("loop iteration", ++tls_loop_count);
-
- if (in_handshake) {
- DEBUG_MSG("in_handshake");
- if (client_p)
- r = tls_connect_attempt(ssl, &tls_write_select,
- &tls_read_select, &closed, &progress,
- &err_pref_1);
- else
- r = tls_accept_attempt(ssl, &tls_write_select,
- &tls_read_select, &closed, &progress,
- &err_pref_1);
- if (r != 0) {
- write_info(ssl, &info_fd);
- goto err;
- }
- if (closed)
- goto err_return;
- if (!SSL_in_init(ssl)) {
- in_handshake = 0;
- write_info(ssl, &info_fd);
- }
- }
-
- if (clear_to_tls.len != 0 && !in_handshake) {
- assert(!closed);
-
- r = tls_write_attempt(ssl, &clear_to_tls, &tls_write_select,
- &tls_read_select, &closed, &progress,
- &err_pref_1);
- if (r != 0)
- goto err;
- if (closed) {
- assert(progress);
- tls_to_clear.offset = 0;
- tls_to_clear.len = 0;
- }
- }
-
- if (tls_to_clear.len != 0) {
- assert(!closed);
-
- r = write_attempt(clear_fd, &tls_to_clear, &clear_write_select,
- &closed, &progress);
- if (r != 0)
- goto err_return;
- if (closed) {
- assert(progress);
- clear_to_tls.offset = 0;
- clear_to_tls.len = 0;
- }
- }
-
- if (!closed) {
- if (clear_to_tls.offset + clear_to_tls.len <
- sizeof(clear_to_tls.buf)) {
- r = read_attempt(clear_fd, &clear_to_tls, &clear_read_select,
- &closed, &progress);
- if (r != 0)
- goto err_return;
- if (closed) {
- r = SSL_shutdown(ssl);
- DEBUG_MSG2("SSL_shutdown", r);
- }
- }
- }
-
- if (!closed && !in_handshake) {
- if (tls_to_clear.offset + tls_to_clear.len <
- sizeof(tls_to_clear.buf)) {
- r = tls_read_attempt(ssl, &tls_to_clear, &tls_write_select,
- &tls_read_select, &closed, &progress,
- &err_pref_1);
- if (r != 0)
- goto err;
- if (closed) {
- r = SSL_shutdown(ssl);
- DEBUG_MSG2("SSL_shutdown", r);
- }
- }
- }
-
- if (!progress) {
- DEBUG_MSG("!progress?");
- if (num_read != BIO_number_read(rbio)
- || num_written != BIO_number_written(wbio))
- progress = 1;
-
- if (!progress) {
- DEBUG_MSG("!progress");
- assert(clear_read_select || tls_read_select
- || clear_write_select || tls_write_select);
- tls_sockets_select(clear_read_select ? clear_fd : -1,
- tls_read_select ? tls_fd : -1,
- clear_write_select ? clear_fd : -1,
- tls_write_select ? tls_fd : -1, -1);
- }
- }
- } while (!closed);
- return;
-
- err:
- tls_openssl_errors(err_pref_1, err_pref_2, err_def, tls_child_apparg);
- err_return:
- return;
-}
-
-static int
-tls_get_error(SSL *ssl, int r, int *write_select, int *read_select,
- int *closed, int *progress)
-{
- int err = SSL_get_error(ssl, r);
-
- if (err == SSL_ERROR_NONE) {
- assert(r > 0);
- *progress = 1;
- return 0;
- }
-
- assert(r <= 0);
-
- switch (err) {
- case SSL_ERROR_ZERO_RETURN:
- assert(r == 0);
- *closed = 1;
- *progress = 1;
- return 0;
-
- case SSL_ERROR_WANT_WRITE:
- *write_select = 1;
- return 0;
-
- case SSL_ERROR_WANT_READ:
- *read_select = 1;
- return 0;
- }
-
- return -1;
-}
-
-static int
-tls_connect_attempt(SSL *ssl, int *write_select, int *read_select,
- int *closed, int *progress, const char **err_pref)
-{
- int n, r;
-
- DEBUG_MSG("tls_connect_attempt");
- n = SSL_connect(ssl);
- DEBUG_MSG2("SSL_connect", n);
- r = tls_get_error(ssl, n, write_select, read_select, closed, progress);
- if (r == -1)
- *err_pref = " during SSL_connect";
- return r;
-}
-
-static int
-tls_accept_attempt(SSL *ssl, int *write_select, int *read_select, int *closed,
- int *progress, const char **err_pref)
-{
- int n, r;
-
- DEBUG_MSG("tls_accept_attempt");
- n = SSL_accept(ssl);
- DEBUG_MSG2("SSL_accept", n);
- r = tls_get_error(ssl, n, write_select, read_select, closed, progress);
- if (r == -1)
- *err_pref = " during SSL_accept";
- return r;
-}
-
-static int
-tls_write_attempt(SSL *ssl, struct tunnelbuf *buf, int *write_select,
- int *read_select, int *closed, int *progress,
- const char **err_pref)
-{
- int n, r;
-
- DEBUG_MSG("tls_write_attempt");
- n = SSL_write(ssl, buf->buf + buf->offset, buf->len);
- DEBUG_MSG2("SSL_write", n);
- r = tls_get_error(ssl, n, write_select, read_select, closed, progress);
- if (n > 0) {
- buf->len -= n;
- assert(buf->len >= 0);
- if (buf->len == 0)
- buf->offset = 0;
- else
- buf->offset += n;
- }
- if (r == -1)
- *err_pref = " during SSL_write";
- return r;
-}
-
-static int
-tls_read_attempt(SSL *ssl, struct tunnelbuf *buf, int *write_select,
- int *read_select, int *closed, int *progress,
- const char **err_pref)
-{
- int n, r;
- size_t total;
-
- DEBUG_MSG("tls_read_attempt");
- total = buf->offset + buf->len;
- assert(total < sizeof(buf->buf));
- n = SSL_read(ssl, buf->buf + total, sizeof(buf->buf) - total);
- DEBUG_MSG2("SSL_read", n);
- r = tls_get_error(ssl, n, write_select, read_select, closed, progress);
- if (n > 0) {
- buf->len += n;
- assert(buf->offset + buf->len <= sizeof(buf->buf));
- }
- if (r == -1)
- *err_pref = " during SSL_read";
- return r;
-}
-
-static int get_error(int r, int *select, int *closed, int *progress)
-{
- if (r >= 0) {
- *progress = 1;
- if (r == 0)
- *closed = 1;
- return 0;
- } else {
- assert(r == -1);
- if (errno == EAGAIN || errno == EWOULDBLOCK) {
- *select = 1;
- return 0;
- } else if (errno == EPIPE) {
- *progress = 1;
- *closed = 1;
- return 0;
- } else
- return -1;
- }
-}
-
-static int write_attempt(int fd, struct tunnelbuf *buf, int *select,
- int *closed, int *progress)
-{
- int n, r;
-
- DEBUG_MSG("write_attempt");
- n = write(fd, buf->buf + buf->offset, buf->len);
- DEBUG_MSG2("write", n);
- r = get_error(n, select, closed, progress);
- if (n > 0) {
- buf->len -= n;
- assert(buf->len >= 0);
- if (buf->len == 0)
- buf->offset = 0;
- else
- buf->offset += n;
- }
- if (r == -1)
- tls_errprintf(1, tls_child_apparg, "write error: %s\n",
- strerror(errno));
- return r;
-}
-
-static int
-read_attempt(int fd, struct tunnelbuf *buf, int *select, int *closed,
- int *progress)
-{
- int n, r;
- size_t total;
-
- DEBUG_MSG("read_attempt");
- total = buf->offset + buf->len;
- assert(total < sizeof(buf->buf));
- n = read(fd, buf->buf + total, sizeof(buf->buf) - total);
- DEBUG_MSG2("read", n);
- r = get_error(n, select, closed, progress);
- if (n > 0) {
- buf->len += n;
- assert(buf->offset + buf->len <= sizeof(buf->buf));
- }
- if (r == -1)
- tls_errprintf(1, tls_child_apparg, "read error: %s\n",
- strerror(errno));
- return r;
-}
diff --git a/deps/openssl/openssl/demos/easy_tls/easy-tls.h b/deps/openssl/openssl/demos/easy_tls/easy-tls.h
deleted file mode 100644
index b88d21c57b..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/easy-tls.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* */
-/*-
- * easy-tls.h -- generic TLS proxy.
- * $Id: easy-tls.h,v 1.1 2001/09/17 19:06:59 bodo Exp $
- */
-/*
- * (c) Copyright 1999 Bodo Moeller. All rights reserved.
- */
-
-#ifndef HEADER_TLS_H
-# define HEADER_TLS_H
-
-# ifndef HEADER_SSL_H
-typedef struct ssl_ctx_st SSL_CTX;
-# endif
-
-# define TLS_INFO_SIZE 512 /* max. # of bytes written to infofd */
-
-void tls_set_dhe1024(int i, void *apparg);
-/*
- * Generate DHE parameters: i >= 0 deterministic (i selects seed), i < 0
- * random (may take a while). tls_create_ctx calls this with random
- * non-negative i if the application has never called it.
- */
-
-void tls_rand_seed(void);
-int tls_rand_seed_from_file(const char *filename, size_t n, void *apparg);
-void tls_rand_seed_from_memory(const void *buf, size_t n);
-
-struct tls_create_ctx_args {
- int client_p;
- const char *certificate_file;
- const char *key_file;
- const char *ca_file;
- int verify_depth;
- int fail_unless_verified;
- int export_p;
-};
-struct tls_create_ctx_args tls_create_ctx_defaultargs(void);
-/*
- * struct tls_create_ctx_args is similar to a conventional argument list, but
- * it can provide default values and allows for future extension.
- */
-SSL_CTX *tls_create_ctx(struct tls_create_ctx_args, void *apparg);
-
-struct tls_start_proxy_args {
- int fd;
- int client_p;
- SSL_CTX *ctx;
- pid_t *pid;
- int *infofd;
-};
-struct tls_start_proxy_args tls_start_proxy_defaultargs(void);
-/*
- * tls_start_proxy return value *MUST* be checked! 0 means ok, otherwise
- * we've probably run out of some resources.
- */
-int tls_start_proxy(struct tls_start_proxy_args, void *apparg);
-
-#endif
diff --git a/deps/openssl/openssl/demos/easy_tls/test.c b/deps/openssl/openssl/demos/easy_tls/test.c
deleted file mode 100644
index 3877370f5e..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/test.c
+++ /dev/null
@@ -1,248 +0,0 @@
-/* test.c */
-/* $Id: test.c,v 1.1 2001/09/17 19:06:59 bodo Exp $ */
-
-#define L_PORT 9999
-#define C_PORT 443
-
-#include <arpa/inet.h>
-#include <assert.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <netinet/in.h>
-#include <netinet/tcp.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/select.h>
-#include <sys/socket.h>
-#include <unistd.h>
-
-#include "test.h"
-#include "easy-tls.h"
-
-void test_process_init(int fd, int client_p, void *apparg)
-{
- fprintf(stderr,
- "test_process_init(fd = %d, client_p = %d, apparg = %p)\n", fd,
- client_p, apparg);
-}
-
-void test_errflush(int child_p, char *errbuf, size_t num, void *apparg)
-{
- fputs(errbuf, stderr);
-}
-
-int main(int argc, char *argv[])
-{
- int s, fd, r;
- FILE *conn_in;
- FILE *conn_out;
- char buf[256];
- SSL_CTX *ctx;
- int client_p = 0;
- int port;
- int tls = 0;
- char infobuf[TLS_INFO_SIZE + 1];
-
- if (argc > 1 && argv[1][0] == '-') {
- fputs("Usage: test [port] -- server\n"
- " test num.num.num.num [port] -- client\n", stderr);
- exit(1);
- }
-
- if (argc > 1) {
- if (strchr(argv[1], '.')) {
- client_p = 1;
- }
- }
-
- fputs(client_p ? "Client\n" : "Server\n", stderr);
-
- {
- struct tls_create_ctx_args a = tls_create_ctx_defaultargs();
- a.client_p = client_p;
- a.certificate_file = "cert.pem";
- a.key_file = "cert.pem";
- a.ca_file = "cacerts.pem";
-
- ctx = tls_create_ctx(a, NULL);
- if (ctx == NULL)
- exit(1);
- }
-
- s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
- if (s == -1) {
- perror("socket");
- exit(1);
- }
-
- if (client_p) {
- struct sockaddr_in addr;
- size_t addr_len = sizeof(addr);
-
- addr.sin_family = AF_INET;
- assert(argc > 1);
- if (argc > 2)
- sscanf(argv[2], "%d", &port);
- else
- port = C_PORT;
- addr.sin_port = htons(port);
- addr.sin_addr.s_addr = inet_addr(argv[1]);
-
- r = connect(s, &addr, addr_len);
- if (r != 0) {
- perror("connect");
- exit(1);
- }
- fd = s;
- fprintf(stderr, "Connect (fd = %d).\n", fd);
- } else {
- /* server */
- {
- int i = 1;
-
- r = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *)&i, sizeof(i));
- if (r == -1) {
- perror("setsockopt");
- exit(1);
- }
- }
-
- {
- struct sockaddr_in addr;
- size_t addr_len = sizeof(addr);
-
- if (argc > 1)
- sscanf(argv[1], "%d", &port);
- else
- port = L_PORT;
- addr.sin_family = AF_INET;
- addr.sin_port = htons(port);
- addr.sin_addr.s_addr = INADDR_ANY;
-
- r = bind(s, &addr, addr_len);
- if (r != 0) {
- perror("bind");
- exit(1);
- }
- }
-
- r = listen(s, 1);
- if (r == -1) {
- perror("listen");
- exit(1);
- }
-
- fprintf(stderr, "Listening at port %i.\n", port);
-
- fd = accept(s, NULL, 0);
- if (fd == -1) {
- perror("accept");
- exit(1);
- }
-
- fprintf(stderr, "Accept (fd = %d).\n", fd);
- }
-
- conn_in = fdopen(fd, "r");
- if (conn_in == NULL) {
- perror("fdopen");
- exit(1);
- }
- conn_out = fdopen(fd, "w");
- if (conn_out == NULL) {
- perror("fdopen");
- exit(1);
- }
-
- setvbuf(conn_in, NULL, _IOLBF, 256);
- setvbuf(conn_out, NULL, _IOLBF, 256);
-
- while (fgets(buf, sizeof(buf), stdin) != NULL) {
- if (buf[0] == 'W') {
- fprintf(conn_out, "%.*s\r\n", (int)(strlen(buf + 1) - 1),
- buf + 1);
- fprintf(stderr, ">>> %.*s\n", (int)(strlen(buf + 1) - 1),
- buf + 1);
- } else if (buf[0] == 'C') {
- fprintf(stderr, "Closing.\n");
- fclose(conn_in);
- fclose(conn_out);
- exit(0);
- } else if (buf[0] == 'R') {
- int lines = 0;
-
- sscanf(buf + 1, "%d", &lines);
- do {
- if (fgets(buf, sizeof(buf), conn_in) == NULL) {
- if (ferror(conn_in)) {
- fprintf(stderr, "ERROR\n");
- exit(1);
- }
- fprintf(stderr, "CLOSED\n");
- return 0;
- }
- fprintf(stderr, "<<< %s", buf);
- } while (--lines > 0);
- } else if (buf[0] == 'T') {
- int infofd;
-
- tls++;
- {
- struct tls_start_proxy_args a = tls_start_proxy_defaultargs();
- a.fd = fd;
- a.client_p = client_p;
- a.ctx = ctx;
- a.infofd = &infofd;
- r = tls_start_proxy(a, NULL);
- }
- assert(r != 1);
- if (r != 0) {
- fprintf(stderr, "tls_start_proxy failed: %d\n", r);
- switch (r) {
- case -1:
- fputs("socketpair", stderr);
- break;
- case 2:
- fputs("FD_SETSIZE exceeded", stderr);
- break;
- case -3:
- fputs("pipe", stderr);
- break;
- case -4:
- fputs("fork", stderr);
- break;
- case -5:
- fputs("dup2", stderr);
- break;
- default:
- fputs("?", stderr);
- }
- if (r < 0)
- perror("");
- else
- fputc('\n', stderr);
- exit(1);
- }
-
- r = read(infofd, infobuf, sizeof(infobuf) - 1);
- if (r > 0) {
- const char *info = infobuf;
- const char *eol;
-
- infobuf[r] = '\0';
- while ((eol = strchr(info, '\n')) != NULL) {
- fprintf(stderr, "+++ `%.*s'\n", eol - info, info);
- info = eol + 1;
- }
- close(infofd);
- }
- } else {
- fprintf(stderr, "W... write line to network\n"
- "R[n] read line (n lines) from network\n"
- "C close\n"
- "T start %sTLS proxy\n", tls ? "another " : "");
- }
- }
- return 0;
-}
diff --git a/deps/openssl/openssl/demos/easy_tls/test.h b/deps/openssl/openssl/demos/easy_tls/test.h
deleted file mode 100644
index a7d0130e2f..0000000000
--- a/deps/openssl/openssl/demos/easy_tls/test.h
+++ /dev/null
@@ -1,10 +0,0 @@
-/* test.h */
-/* $Id: test.h,v 1.1 2001/09/17 19:07:00 bodo Exp $ */
-
-void test_process_init(int fd, int client_p, void *apparg);
-#define TLS_APP_PROCESS_INIT test_process_init
-
-#undef TLS_CUMULATE_ERRORS
-
-void test_errflush(int child_p, char *errbuf, size_t num, void *apparg);
-#define TLS_APP_ERRFLUSH test_errflush
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-12 19:29:08 +0000