X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=citadel%2Fmodules%2Fcrypto%2Fserv_crypto.c;h=249d9960a1720ae468c2bc100bd8c2d5763db099;hb=d3a29d82d6492191ae8208617e8ac1f088bcf14a;hp=f323be662c65c0150ec5ef9744095b581f140a1f;hpb=cb45c6bab6711b3b62ca0ac8ae18a1fdb95fb44a;p=citadel.git diff --git a/citadel/modules/crypto/serv_crypto.c b/citadel/modules/crypto/serv_crypto.c index f323be662..249d9960a 100644 --- a/citadel/modules/crypto/serv_crypto.c +++ b/citadel/modules/crypto/serv_crypto.c @@ -1,20 +1,19 @@ -/* $Id$ - * - * Copyright (c) 1987-2009 by the citadel.org team +/* + * Copyright (c) 1987-2012 by the citadel.org team * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. + * This program is open source software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 3. + * + * * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * + * */ #include @@ -80,7 +79,7 @@ void destruct_ssl(void) void init_ssl(void) { - SSL_METHOD *ssl_method; + const SSL_METHOD *ssl_method; DH *dh; RSA *rsa=NULL; X509_REQ *req = NULL; @@ -94,14 +93,14 @@ void init_ssl(void) RAND_egd(EGD_POOL); if (!RAND_status()) { - CtdlLogPrintf(CTDL_CRIT, + syslog(LOG_CRIT, "PRNG not adequately seeded, won't do SSL/TLS\n"); return; } SSLCritters = malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); if (!SSLCritters) { - CtdlLogPrintf(CTDL_EMERG, "citserver: can't allocate memory!!\n"); + syslog(LOG_EMERG, "citserver: can't allocate memory!!\n"); /* Nothing's been initialized, just die */ exit(1); } else { @@ -110,7 +109,7 @@ void init_ssl(void) for (a = 0; a < CRYPTO_num_locks(); a++) { SSLCritters[a] = malloc(sizeof(pthread_mutex_t)); if (!SSLCritters[a]) { - CtdlLogPrintf(CTDL_EMERG, + syslog(LOG_EMERG, "citserver: can't allocate memory!!\n"); /* Nothing's been initialized, just die */ exit(1); @@ -126,12 +125,12 @@ void init_ssl(void) SSL_load_error_strings(); ssl_method = SSLv23_server_method(); if (!(ssl_ctx = SSL_CTX_new(ssl_method))) { - CtdlLogPrintf(CTDL_CRIT, "SSL_CTX_new failed: %s\n", + syslog(LOG_CRIT, "SSL_CTX_new failed: %s\n", ERR_reason_error_string(ERR_get_error())); return; } if (!(SSL_CTX_set_cipher_list(ssl_ctx, CIT_CIPHERS))) { - CtdlLogPrintf(CTDL_CRIT, "SSL: No ciphers available\n"); + syslog(LOG_CRIT, "SSL: No ciphers available\n"); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; return; @@ -149,21 +148,21 @@ void init_ssl(void) /* Load DH parameters into the context */ dh = DH_new(); if (!dh) { - CtdlLogPrintf(CTDL_CRIT, "init_ssl() can't allocate a DH object: %s\n", + syslog(LOG_CRIT, "init_ssl() can't allocate a DH object: %s\n", ERR_reason_error_string(ERR_get_error())); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; return; } if (!(BN_hex2bn(&(dh->p), DH_P))) { - CtdlLogPrintf(CTDL_CRIT, "init_ssl() can't assign DH_P: %s\n", + syslog(LOG_CRIT, "init_ssl() can't assign DH_P: %s\n", ERR_reason_error_string(ERR_get_error())); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; return; } if (!(BN_hex2bn(&(dh->g), DH_G))) { - CtdlLogPrintf(CTDL_CRIT, "init_ssl() can't assign DH_G: %s\n", + syslog(LOG_CRIT, "init_ssl() can't assign DH_G: %s\n", ERR_reason_error_string(ERR_get_error())); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; @@ -182,13 +181,13 @@ void init_ssl(void) * Generate a key pair if we don't have one. */ if (access(file_crpt_file_key, R_OK) != 0) { - CtdlLogPrintf(CTDL_INFO, "Generating RSA key pair.\n"); + syslog(LOG_INFO, "Generating RSA key pair.\n"); rsa = RSA_generate_key(1024, /* modulus size */ 65537, /* exponent */ NULL, /* no callback */ NULL); /* no callback */ if (rsa == NULL) { - CtdlLogPrintf(CTDL_CRIT, "Key generation failed: %s\n", + syslog(LOG_CRIT, "Key generation failed: %s\n", ERR_reason_error_string(ERR_get_error())); } if (rsa != NULL) { @@ -203,7 +202,7 @@ void init_ssl(void) NULL, /* no callbk */ NULL /* no callbk */ ) != 1) { - CtdlLogPrintf(CTDL_CRIT, "Cannot write key: %s\n", + syslog(LOG_CRIT, "Cannot write key: %s\n", ERR_reason_error_string(ERR_get_error())); unlink(file_crpt_file_key); } @@ -219,7 +218,7 @@ void init_ssl(void) * the CSR in this step so that the next step may commence. */ if ( (access(file_crpt_file_cer, R_OK) != 0) && (access(file_crpt_file_csr, R_OK) != 0) ) { - CtdlLogPrintf(CTDL_INFO, "Generating a certificate signing request.\n"); + syslog(LOG_INFO, "Generating a certificate signing request.\n"); /* * Read our key from the file. No, we don't just keep this @@ -282,7 +281,7 @@ void init_ssl(void) /* Sign the CSR */ if (!X509_REQ_sign(req, pk, EVP_md5())) { - CtdlLogPrintf(CTDL_CRIT, "X509_REQ_sign(): error\n"); + syslog(LOG_CRIT, "X509_REQ_sign(): error\n"); } else { /* Write it to disk. */ @@ -302,7 +301,7 @@ void init_ssl(void) } else { - CtdlLogPrintf(CTDL_CRIT, "Unable to read private key.\n"); + syslog(LOG_CRIT, "Unable to read private key.\n"); } } @@ -312,7 +311,7 @@ void init_ssl(void) * Generate a self-signed certificate if we don't have one. */ if (access(file_crpt_file_cer, R_OK) != 0) { - CtdlLogPrintf(CTDL_INFO, "Generating a self-signed certificate.\n"); + syslog(LOG_INFO, "Generating a self-signed certificate.\n"); /* Same deal as before: always read the key from disk because * it may or may not have just been generated. @@ -352,7 +351,7 @@ void init_ssl(void) /* Sign the cert */ if (!X509_sign(cer, pk, EVP_md5())) { - CtdlLogPrintf(CTDL_CRIT, "X509_sign(): error\n"); + syslog(LOG_CRIT, "X509_sign(): error\n"); } else { /* Write it to disk. */ @@ -378,7 +377,7 @@ void init_ssl(void) SSL_CTX_use_certificate_chain_file(ssl_ctx, file_crpt_file_cer); SSL_CTX_use_PrivateKey_file(ssl_ctx, file_crpt_file_key, SSL_FILETYPE_PEM); if ( !SSL_CTX_check_private_key(ssl_ctx) ) { - CtdlLogPrintf(CTDL_CRIT, "Cannot install certificate: %s\n", + syslog(LOG_CRIT, "Cannot install certificate: %s\n", ERR_reason_error_string(ERR_get_error())); } @@ -404,7 +403,7 @@ void client_write_ssl(const char *buf, int nbytes) while (nremain > 0) { if (SSL_want_write(CC->ssl)) { if ((SSL_read(CC->ssl, junk, 0)) < 1) { - CtdlLogPrintf(CTDL_DEBUG, "SSL_read in client_write: %s\n", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_DEBUG, "SSL_read in client_write: %s\n", ERR_reason_error_string(ERR_get_error())); } } retval = @@ -418,9 +417,9 @@ void client_write_ssl(const char *buf, int nbytes) sleep(1); continue; } - CtdlLogPrintf(CTDL_DEBUG, "SSL_write got error %ld, ret %d\n", errval, retval); + syslog(LOG_DEBUG, "SSL_write got error %ld, ret %d\n", errval, retval); if (retval == -1) - CtdlLogPrintf(CTDL_DEBUG, "errno is %d\n", errno); + syslog(LOG_DEBUG, "errno is %d\n", errno); endtls(); client_write(&buf[nbytes - nremain], nremain); return; @@ -445,7 +444,7 @@ int client_read_sslbuffer(StrBuf *buf, int timeout) while (1) { if (SSL_want_read(pssl)) { if ((SSL_write(pssl, junk, 0)) < 1) { - CtdlLogPrintf(CTDL_DEBUG, "SSL_write in client_read\n"); + syslog(LOG_DEBUG, "SSL_write in client_read\n"); } } rlen = SSL_read(pssl, sbuf, sizeof(sbuf)); @@ -457,7 +456,7 @@ int client_read_sslbuffer(StrBuf *buf, int timeout) sleep(1); continue; } - CtdlLogPrintf(CTDL_DEBUG, "SSL_read got error %ld\n", errval); + syslog(LOG_DEBUG, "SSL_read got error %ld\n", errval); endtls(); return (-1); } @@ -467,94 +466,162 @@ int client_read_sslbuffer(StrBuf *buf, int timeout) return (0); } -int client_readline_sslbuffer(StrBuf *Target, StrBuf *Buffer, int timeout) +int client_readline_sslbuffer(StrBuf *Line, StrBuf *IOBuf, const char **Pos, int timeout) { - int ntries = 0; - const char *pch, *pchs; - int rlen, len, retval = 0; CitContext *CCC = CC; + const char *pos = NULL; + const char *pLF; + int len, rlen; + int nSuccessLess = 0; + const char *pch = NULL; + + if ((Line == NULL) || + (Pos == NULL) || + (IOBuf == NULL)) + { + if (Pos != NULL) + *Pos = NULL; +// *Error = ErrRBLF_PreConditionFailed; + return -1; + } - if (StrLength(Target) > 0) { - pchs = ChrPtr(Buffer); - pch = strchr(pchs, '\n'); - if (pch != NULL) { - rlen = 0; - len = pch - pchs; - if (len > 0 && (*(pch - 1) == '\r') ) - rlen ++; - StrBufSub(Target, Buffer, 0, len - rlen); - StrBufCutLeft(Buffer, len + 1); - return len - rlen; + pos = *Pos; + if ((StrLength(IOBuf) > 0) && + (pos != NULL) && + (pos < ChrPtr(IOBuf) + StrLength(IOBuf))) + { + pch = pos; + pch = strchr(pch, '\n'); + + if (pch == NULL) { + StrBufAppendBufPlain(Line, pos, + StrLength(IOBuf) - (pos - ChrPtr(IOBuf)), 0); + FlushStrBuf(IOBuf); + pos = *Pos = NULL; + } + else { + int n = 0; + if ((pch > ChrPtr(IOBuf)) && + (*(pch - 1) == '\r')) { + n = 1; + } + StrBufAppendBufPlain(Line, pos, + (pch - pos - n), 0); + + if (StrLength(IOBuf) <= (pch - ChrPtr(IOBuf) + 1)) { + FlushStrBuf(IOBuf); + pos = *Pos = NULL; + } + else + *Pos = pch + 1; + return StrLength(Line); } } - - while ((retval == 0) && (CCC->ssl != NULL)) { - pch = NULL; - pchs = ChrPtr(Buffer); - if (*pchs != '\0') - pch = strchr(pchs, '\n'); - if (pch == NULL) { - retval = client_read_sslbuffer(Buffer, timeout); - pchs = ChrPtr(Buffer); - pch = strchr(pchs, '\n'); + + pLF = NULL; + while ((nSuccessLess < timeout) && + (pLF == NULL) && + (CCC->ssl != NULL)) { + + rlen = client_read_sslbuffer(IOBuf, timeout); + if (rlen < 1) { +// *Error = strerror(errno); +// close(*fd); +// *fd = -1; + return -1; } - if (retval == 0) { - sleep(1); - ntries ++; + else if (rlen > 0) { + pLF = strchr(ChrPtr(IOBuf), '\n'); } - if (ntries > 10) - return 0; } - if ((retval > 0) && (pch != NULL)) { - rlen = 0; - len = pch - pchs; - if (len > 0 && (*(pch - 1) == '\r') ) - rlen ++; - StrBufSub(Target, Buffer, 0, len - rlen); - StrBufCutLeft(Buffer, len + 1); - return len - rlen; - + *Pos = NULL; + if (pLF != NULL) { + pos = ChrPtr(IOBuf); + len = pLF - pos; + if (len > 0 && (*(pLF - 1) == '\r') ) + len --; + StrBufAppendBufPlain(Line, pos, len, 0); + if (pLF + 1 >= ChrPtr(IOBuf) + StrLength(IOBuf)) + { + FlushStrBuf(IOBuf); + } + else + *Pos = pLF + 1; + return StrLength(Line); } - else - return -1; +// *Error = ErrRBLF_NotEnoughSentFromServer; + return -1; } int client_read_sslblob(StrBuf *Target, long bytes, int timeout) { - long bufremain; long baselen; - int retval; + long RemainRead; + int retval = 0; CitContext *CCC = CC; baselen = StrLength(Target); - if (CCC->Pos == NULL) - CCC->Pos = ChrPtr(CCC->ReadBuf); - bufremain = StrLength(CCC->ReadBuf) - - (CCC->Pos - ChrPtr(CCC->ReadBuf)); + if (StrLength(CCC->RecvBuf.Buf) > 0) + { + long RemainLen; + long TotalLen; + const char *pchs; + + if (CCC->RecvBuf.ReadWritePointer == NULL) + CCC->RecvBuf.ReadWritePointer = ChrPtr(CCC->RecvBuf.Buf); + pchs = ChrPtr(CCC->RecvBuf.Buf); + TotalLen = StrLength(CCC->RecvBuf.Buf); + RemainLen = TotalLen - (pchs - CCC->RecvBuf.ReadWritePointer); + if (RemainLen > bytes) + RemainLen = bytes; + if (RemainLen > 0) + { + StrBufAppendBufPlain(Target, + CCC->RecvBuf.ReadWritePointer, + RemainLen, 0); + CCC->RecvBuf.ReadWritePointer += RemainLen; + } + if ((ChrPtr(CCC->RecvBuf.Buf) + StrLength(CCC->RecvBuf.Buf)) <= CCC->RecvBuf.ReadWritePointer) + { + CCC->RecvBuf.ReadWritePointer = NULL; + FlushStrBuf(CCC->RecvBuf.Buf); + } + } + + if (StrLength(Target) >= bytes + baselen) + return 1; - if (bytes < bufremain) - bufremain = bytes; - StrBufAppendBufPlain(Target, CCC->Pos, bufremain, 0); - StrBufCutLeft(CCC->ReadBuf, bufremain); + CCC->RecvBuf.ReadWritePointer = NULL; - if (bytes > bufremain) + while ((StrLength(Target) < bytes + baselen) && + (retval >= 0)) { - while ((StrLength(CCC->ReadBuf) + StrLength(Target) < bytes + baselen) && - (retval >= 0)) - retval = client_read_sslbuffer(CCC->ReadBuf, timeout); + retval = client_read_sslbuffer(CCC->RecvBuf.Buf, timeout); if (retval >= 0) { - StrBufAppendBuf(Target, CCC->ReadBuf, 0); /* todo: Buf > bytes? */ - return 1; + RemainRead = bytes - (StrLength (Target) - baselen); + if (RemainRead < StrLength(CCC->RecvBuf.Buf)) + { + StrBufAppendBufPlain( + Target, + ChrPtr(CCC->RecvBuf.Buf), + RemainRead, 0); + CCC->RecvBuf.ReadWritePointer = ChrPtr(CCC->RecvBuf.Buf) + RemainRead; + break; + } + StrBufAppendBuf(Target, CCC->RecvBuf.Buf, 0); /* todo: Buf > bytes? */ + FlushStrBuf(CCC->RecvBuf.Buf); } - else { + else + { + FlushStrBuf(CCC->RecvBuf.Buf); return -1; + } } - else - return 1; + return 1; } @@ -569,18 +636,18 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, int retval, bits, alg_bits; if (!ssl_ctx) { - CtdlLogPrintf(CTDL_CRIT, "SSL failed: no ssl_ctx exists?\n"); + syslog(LOG_CRIT, "SSL failed: no ssl_ctx exists?\n"); if (nosup_response != NULL) cprintf("%s", nosup_response); return; } if (!(CC->ssl = SSL_new(ssl_ctx))) { - CtdlLogPrintf(CTDL_CRIT, "SSL_new failed: %s\n", + syslog(LOG_CRIT, "SSL_new failed: %s\n", ERR_reason_error_string(ERR_get_error())); if (error_response != NULL) cprintf("%s", error_response); return; } if (!(SSL_set_fd(CC->ssl, CC->client_socket))) { - CtdlLogPrintf(CTDL_CRIT, "SSL_set_fd failed: %s\n", + syslog(LOG_CRIT, "SSL_set_fd failed: %s\n", ERR_reason_error_string(ERR_get_error())); SSL_free(CC->ssl); CC->ssl = NULL; @@ -599,7 +666,7 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char error_string[128]; errval = SSL_get_error(CC->ssl, retval); - CtdlLogPrintf(CTDL_CRIT, "SSL_accept failed: retval=%d, errval=%ld, err=%s\n", + syslog(LOG_CRIT, "SSL_accept failed: retval=%d, errval=%ld, err=%s\n", retval, errval, ERR_error_string(errval, error_string) @@ -610,7 +677,7 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, } BIO_set_close(CC->ssl->rbio, BIO_NOCLOSE); bits = SSL_CIPHER_get_bits(SSL_get_current_cipher(CC->ssl), &alg_bits); - CtdlLogPrintf(CTDL_INFO, "SSL/TLS using %s on %s (%d of %d bits)\n", + syslog(LOG_INFO, "SSL/TLS using %s on %s (%d of %d bits)\n", SSL_CIPHER_get_name(SSL_get_current_cipher(CC->ssl)), SSL_CIPHER_get_version(SSL_get_current_cipher(CC->ssl)), bits, alg_bits); @@ -677,7 +744,7 @@ void endtls(void) return; } - CtdlLogPrintf(CTDL_INFO, "Ending SSL/TLS\n"); + syslog(LOG_INFO, "Ending SSL/TLS\n"); SSL_shutdown(CC->ssl); SSL_free(CC->ssl); CC->ssl = NULL;