S3FC project page

S3FC home page

---

               

---

s3_socket_tcp_ssl.cc

Go to the documentation of this file.

/*
 * Stone Three Foundation Class (s3fc) provides a number of utility classes.
 * Copyright (C) 2001 by Stone Three Signal Processing (Pty) Ltd.
 *
 * Authored by Stone Three Signal Processing (Pty) Ltd.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 * 
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 * 
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 * 
 * Please see the file 'COPYING' in the source root directory.
 */

#include <s3fc/s3_socket_tcp_ssl.h>
#include <s3fc/s3_thread_base.h>
#include <s3fc/s3_macros.h>
#include <sstream>
#ifndef _WIN32
#include <sys/time.h>
#endif

bool s3_socket_tcp_ssl::ssl_init_done = false;

static const unsigned long ERROR_CERT_IN_HASH = ERR_PACK(
   ERR_LIB_X509,X509_F_X509_STORE_ADD_CERT,X509_R_CERT_ALREADY_IN_HASH_TABLE);

s3_socket_tcp_ssl::s3_socket_tcp_ssl(int newsock, bool new_set_reuseaddr) :
   s3_socket_tcp(newsock, new_set_reuseaddr), ssl_error(ERR_LIB_NONE),
   ctx(0), ssl(0), keyfile(""), password(""), CAfile(""), CApath("")
{
   if( !ssl_init_done )
   {
      SSL_load_error_strings(); // readable error messages
      SSL_library_init(); // initialize library
      //NOTE: if /dev/urandom exists, PRNG is seeded transparently
#ifdef _WIN32
      RAND_screen(); //Windows implementation must seed PRNG
#endif
      ssl_init_done = true;
   }
}

s3_socket_tcp_ssl::s3_socket_tcp_ssl(const s3_socket_tcp_ssl& template_sock) :
   s3_socket_tcp(template_sock), ssl_error(ERR_LIB_NONE), ctx(0), ssl(0),
   keyfile(template_sock.keyfile), password(template_sock.password),
   CAfile(template_sock.CAfile), CApath(template_sock.CApath)
{
}

s3_socket_tcp_ssl::~s3_socket_tcp_ssl()
{
   close(false); //don't reinitialize
   if(ssl != 0)
   {
      SSL_free(ssl); //also frees bio
      ssl = 0;
   }
   if(ctx != 0)
   {
      SSL_CTX_free(ctx);
      ctx = 0;
   }
}

bool s3_socket_tcp_ssl::set_keyfile_password(std::string newkey,
                    std::string newpass)
{
   keyfile = newkey;
   password = newpass;
   return true;
}

bool s3_socket_tcp_ssl::set_verify_locations_file(std::string new_CAfile)
{
   CAfile = new_CAfile;
   return true;
}

bool s3_socket_tcp_ssl::set_verify_locations_path(std::string new_CApath)
{
   CApath = new_CApath;
   return true;
}

bool s3_socket_tcp_ssl::setup_ssl()
{
   S3FC_DBG2_("s3_socket_tcp_ssl::setup_ssl()", "sock=" << sock);

   set_errnos();
   //setup SSL/TLS framework iff pointers are null
   if( ctx == 0 && (ctx = SSL_CTX_new(SSLv3_method())) == 0 )
   {
      S3FC_DBG2_("s3_socket_tcp_ssl::setup_ssl()", "SSL_CTX_new failed");
      set_errnos(ERR_get_error());
      return false;
   }
   /* Load our keys and certificates*/
   if ( !(SSL_CTX_use_certificate_chain_file(ctx, keyfile.c_str())) )
   {
      unsigned long temperr = ERR_get_error();
      if ( temperr != ERROR_CERT_IN_HASH )
      {
         set_errnos(temperr);
         return false;
      }
   }
   SSL_CTX_set_default_passwd_cb_userdata(ctx, &password);
   SSL_CTX_set_default_passwd_cb(ctx, s3_socket_tcp_ssl::password_cb);
   if ( !(SSL_CTX_use_PrivateKey_file(
        ctx, keyfile.c_str(), SSL_FILETYPE_PEM)) )
   {
      S3FC_DBG_("Can't read key file: " << keyfile);
      set_errnos(ERR_get_error());
      return false;
   }
   /* Load the CAs we trust */
   const char* CAfile_c = CAfile.size() > 0 ? CAfile.c_str() : 0;
   const char* CApath_c = CApath.size() > 0 ? CApath.c_str() : 0;
   if ( !(SSL_CTX_load_verify_locations(ctx, CAfile_c, CApath_c)) )
   {
      S3FC_DBG_("Can't read CA list");      
      set_errnos(ERR_get_error());
      return false;
   }
#if (OPENSSL_VERSION_NUMBER < 0x00905100L)
   SSL_CTX_set_verify_depth(ctx,1);
#endif

#if 1
   if ( ssl != 0 ) //in case context changed
   {
      SSL_free(ssl);
      ssl = 0;
   }
#endif
   
   if( (ssl = SSL_new(ctx)) == 0)
   {
      S3FC_DBG2_("s3_socket_tcp_ssl::setup_ssl()", "SSL_new failed");
      set_errnos(ERR_get_error());
      return false;
   }
   if( SSL_set_fd(ssl, sock) != 1 )
   {
      S3FC_DBG2_("s3_socket_tcp_ssl::setup_ssl()", "SSL_set_fd failed");
      set_errnos(ERR_get_error());
      return false;
   }
   return true;
}

void s3_socket_tcp_ssl::set_errnos(unsigned long new_ssl_error)
{
   ssl_error = new_ssl_error;
   s3_socket_tcp::set_errnos(); //default values
}

bool s3_socket_tcp_ssl::accept(s3_socket_tcp_ssl& newsock,
                sockaddr_in* clientname)
{
   S3FC_DBG_("s3_socket_tcp_ssl::accept()");

   set_errnos();
   //check sock for an incoming connection
   if( !s3_socket_tcp::accept(newsock, clientname) )
   {
      return false;
   }
   //mirror keyfile and password setup for accepted socket
   if ( !newsock.set_keyfile_password(keyfile, password) ||
   !newsock.set_verify_locations_file(CAfile) ||
   !newsock.set_verify_locations_path(CApath) ||
   !newsock.setup_ssl() )
   {
      return false;
   }
   SSL* ssl_accepted = newsock.ssl;
   assert( ssl_accepted != 0 );
   SSL_set_accept_state(ssl_accepted);
   int ret;
   //SSL handshake (server accepts client)
   if( (ret = SSL_accept(ssl_accepted)) != 1 )
   {
      S3FC_DBG2_("s3_socket_tcp_ssl::accept()",
       "SSL_accept failed, ret = " << ret);
      set_errnos(SSL_get_error(ssl, ret));
      return false;
   }
   return true; //server-side socket newsock is ready
}

bool s3_socket_tcp_ssl::connect(const std::string& IP_address, in_port_t port)
{
   S3FC_DBG_( "s3_socket_tcp_ssl::connect(IP_address=" << IP_address
         << ",port=" << port << ")" );

   set_errnos();
   if( !setup_ssl() )
   {
      return false;
   }
   SSL_set_connect_state(ssl);
   if( !s3_socket_tcp::connect(IP_address, port) )
   {
      return false;
   }
   //SSL handshake (client side)
   int ret;   
   if( (ret = SSL_connect(ssl)) != 1 )
   {
      set_errnos(SSL_get_error(ssl, ret));
      return false;
   }
   return true; //socket is ready for use
}

bool s3_socket_tcp_ssl::close(bool reinit)
{
   S3FC_DBG_("s3_socket_tcp_ssl::close(reinit=" << reinit << ")");

   set_errnos();
   int ret;
   //ssl == 0 => close before setup_ssl() was called
   if( ssl != 0 && (ret = SSL_shutdown(ssl)) != 1 )
   {
      set_errnos(SSL_get_error(ssl, ret));
      return false;
   }
   if( !s3_socket_tcp::close(reinit) )
   {
      return false;
   }
   return true;
}

std::string s3_socket_tcp_ssl::get_error() const
{
   S3FC_DBG2_( "s3_socket_tcp_ssl::get_error()",
          "ssl_error = " << ssl_error );
   
   if(ssl_error != ERR_LIB_NONE)
   {
      return ERR_error_string(ssl_error, 0);
   }
   return s3_socket_tcp::get_error();
}

bool s3_socket_tcp_ssl::read(void *data, int size, s3_semaphore *term)
{
   S3FC_DBG_("s3_socket_tcp_ssl::read()");

   set_errnos();
   char* buf = reinterpret_cast<char*>(data);
   int rem_size = size;
   do
   {
      // If a thread canceller is available, call it.
      s3_thread_base::test_cancel();

      // Test cancellation of the read via semaphore.
      if (term != 0 && term->try_wait())
      {
    s3_socket_tcp::set_errnos(-2);
    return false;
      }
      
      switch (select_rd(1) )
      {
      case -1 : return false; // errno already set
      case  0 : continue;     // Just a timeout so carry on
      case  1 : break;        // I smell data !!
      default: throw s3_generic_exception("s3_socket_tcp_ssl::read()",
                 "select_rd() returned an invalid value");
      }
   
      int ret;
      assert( ssl != 0 );
      if( (ret = SSL_read(ssl, buf, size)) <= 0 )
      {
    set_errnos(SSL_get_error(ssl, ret));
    return false;
      }
      rem_size -= ret; // Remaining data to acquire
      buf = buf + ret; // update pointer into buffer
   }
   while (rem_size > 0);

   return true;
}

bool s3_socket_tcp_ssl::write(void *data, int size, int max_packet,
               s3_semaphore *term)
{
   S3FC_DBG_("s3_socket_tcp_ssl::write()");

   set_errnos();
   char* buf = reinterpret_cast<char*>(data);   
   int rem_size = size;
   int packet_size = size;
   if ( max_packet > size )
   {
      packet_size = max_packet; //was packet_size = size
   }
   // Get all the data out the door
   do
   {
      s3_thread_base::test_cancel();
      
      // Test cancellation of the read via semaphore.
      if (term != 0 && term->try_wait())
      {
    s3_socket_tcp::set_errnos(-2);
    return false;
      }

      switch (select_wr(1) )
      {
      case -1 : return false; // errno already set
      case  0 : continue;     // Just a timeout so carry on
      case  1 : break;        // I smell data !!
      default: throw s3_generic_exception("s3_socket_tcp_ssl::write()",
                 "select_wr() returned an invalid value");
      }

      int ret;
      if( (ret = SSL_write(ssl, buf, size)) <= 0 )
      {
    set_errnos(SSL_get_error(ssl, ret));
    return false;
      }
      rem_size = rem_size - ret; // Remaining data to acquire
      buf = buf + ret; // update pointer into buffer
      if (rem_size < packet_size) packet_size = rem_size;
   }
   while (rem_size > 0);
   
   return true;
}

int s3_socket_tcp_ssl::password_cb(char *buf, int num, int rwflag,
               void *userdata)
{
   std::string* pass = reinterpret_cast<std::string*>(userdata);
   if ( num < static_cast<int>(pass->size()) )
   {
      return 0;
   }
   pass->copy(buf, num);
   return pass->size();
}

---

Send comments to: s3fc@stonethree.com