3 files changed, 433 insertions, 0 deletions

diff --git a/networking/ssl_helper/README b/networking/ssl_helper/README
new file mode 100644
index 000000000..4d0508fbb
--- /dev/null
+++ b/networking/ssl_helper/README
@@ -0,0 +1,16 @@
+Build instructions:
+
+* Unpack matrixssl-3-4-2-open.tgz.
+* Build it: "make"
+* Drop this directory into matrixssl-3-4-2-open/ssl_helper
+* Run ssl_helper.sh to compile and link the helper
+
+Usage: "ssl_helper -d <FILE_DESCRIPTOR>" where FILE_DESCRIPTOR is open to the peer.
+
+In bash, you can do it this way:
+$ ssl_helper -d3 3<>/dev/tcp/HOST/PORT
+
+Stdin will be SSL-encrypted and sent to FILE_DESCRIPTOR.
+Data from FILE_DESCRIPTOR will be decrypted and sent to stdout.
+
+The plan is to adapt it for wget https helper, and for ssl support in nc.
diff --git a/networking/ssl_helper/ssl_helper.c b/networking/ssl_helper/ssl_helper.c
new file mode 100644
index 000000000..d840b1b88
--- /dev/null
+++ b/networking/ssl_helper/ssl_helper.c
@@ -0,0 +1,406 @@
+/*
+ * Copyright (c) 2013 INSIDE Secure Corporation
+ * Copyright (c) PeerSec Networks, 2002-2011
+ * All Rights Reserved
+ *
+ * The latest version of this code is available at http://www.matrixssl.org
+ *
+ * This software is open source; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in WITHOUT ANY WARRANTY; without even the
+ * implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * http://www.gnu.org/copyleft/gpl.html
+ */
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <time.h>
+#include <poll.h>
+#include <sys/socket.h>
+
+#include "matrixssl/matrixsslApi.h"
+
+//#warning "DO NOT USE THESE DEFAULT KEYS IN PRODUCTION ENVIRONMENTS."
+
+/*
+ * If supporting client authentication, pick ONE identity to auto select a
+ * certificate and private key that support desired algorithms.
+ */
+#define ID_RSA /* RSA Certificate and Key */
+
+#define USE_HEADER_KEYS
+
+/* If the algorithm type is supported, load a CA for it */
+#ifdef USE_HEADER_KEYS
+/* CAs */
+# include "sampleCerts/RSA/ALL_RSA_CAS.h"
+/* Identity Certs and Keys for use with Client Authentication */
+# ifdef ID_RSA
+#  define EXAMPLE_RSA_KEYS
+#  include "sampleCerts/RSA/2048_RSA.h"
+#  include "sampleCerts/RSA/2048_RSA_KEY.h"
+# endif
+#endif
+
+static ssize_t safe_write(int fd, const void *buf, size_t count)
+{
+        ssize_t n;
+
+        do {
+                n = write(fd, buf, count);
+        } while (n < 0 && errno == EINTR);
+
+        return n;
+}
+
+static ssize_t full_write(int fd, const void *buf, size_t len)
+{
+        ssize_t cc;
+        ssize_t total;
+
+        total = 0;
+
+        while (len) {
+                cc = safe_write(fd, buf, len);
+
+                if (cc < 0) {
+                        if (total) {
+                                /* we already wrote some! */
+                                /* user can do another write to know the error code */
+                                return total;
+                        }
+                        return cc;  /* write() returns -1 on failure. */
+                }
+
+                total += cc;
+                buf = ((const char *)buf) + cc;
+                len -= cc;
+        }
+
+        return total;
+}
+
+static void say(const char *s, ...)
+{
+        char buf[256];
+        va_list p;
+        int sz;
+
+        va_start(p, s);
+        sz = vsnprintf(buf, sizeof(buf), s, p);
+        full_write(STDERR_FILENO, buf, sz >= 0 && sz < sizeof(buf) ? sz : strlen(buf));
+        va_end(p);
+}
+
+static void die(const char *s, ...)
+{
+        char buf[256];
+        va_list p;
+        int sz;
+
+        va_start(p, s);
+        sz = vsnprintf(buf, sizeof(buf), s, p);
+        full_write(STDERR_FILENO, buf, sz >= 0 && sz < sizeof(buf) ? sz : strlen(buf));
+        exit(1);
+        va_end(p);
+}
+
+#if 0
+# define dbg(...) say(__VA_ARGS__)
+#else
+# define dbg(...) ((void)0)
+#endif
+
+static struct pollfd pfd[2] = {
+        { -1, POLLIN|POLLERR|POLLHUP, 0 },
+        { -1, POLLIN|POLLERR|POLLHUP, 0 },
+};
+#define STDIN           pfd[0]
+#define NETWORK         pfd[1]
+#define STDIN_READY()   (pfd[0].revents & (POLLIN|POLLERR|POLLHUP))
+#define NETWORK_READY() (pfd[1].revents & (POLLIN|POLLERR|POLLHUP))
+
+static int wait_for_input(void)
+{
+        if (STDIN.fd == NETWORK.fd) /* means both are -1 */
+                exit(0);
+        dbg("polling\n");
+        STDIN.revents = NETWORK.revents = 0;
+        return poll(pfd, 2, -1);
+}
+
+static int32 certCb(ssl_t *ssl, psX509Cert_t *cert, int32 alert)
+{
+        /* Example to allow anonymous connections based on a define */
+        if (alert > 0) {
+                return SSL_ALLOW_ANON_CONNECTION; // = 254
+        }
+#if 0
+        /* Validate the 'not before' and 'not after' dates, etc */
+        return PS_FAILURE; /* if we don't like this cert */
+#endif
+        return PS_SUCCESS;
+}
+
+static void close_conn_and_exit(ssl_t *ssl, int fd)
+{
+        unsigned char *buf;
+        int len;
+
+        fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK);
+        /* Quick attempt to send a closure alert, don't worry about failure */
+        if (matrixSslEncodeClosureAlert(ssl) >= 0) {
+                len = matrixSslGetOutdata(ssl, &buf);
+                if (len > 0) {
+                        len = safe_write(fd, buf, len);
+                        //if (len > 0) {
+                        //      matrixSslSentData(ssl, len);
+                        //}
+                }
+        }
+        //matrixSslDeleteSession(ssl);
+        shutdown(fd, SHUT_WR);
+        exit(0);
+}
+
+static int encode_data(ssl_t *ssl, const void *data, int len)
+{
+        unsigned char *buf;
+        int available;
+
+        available = matrixSslGetWritebuf(ssl, &buf, len);
+        if (available < 0)
+                die("matrixSslGetWritebuf\n");
+        if (len > available)
+                die("len > available\n");
+        memcpy(buf, data, len);
+        if (matrixSslEncodeWritebuf(ssl, len) < 0)
+                die("matrixSslEncodeWritebuf\n");
+        return len;
+}
+
+static void flush_to_net(ssl_t *ssl, int fd)
+{
+        int rc;
+        int len;
+        unsigned char *buf;
+
+        while ((len = matrixSslGetOutdata(ssl, &buf)) > 0) {
+                dbg("writing net %d bytes\n", len);
+                if (full_write(fd, buf, len) != len)
+                        die("write to network\n");
+                rc = matrixSslSentData(ssl, len);
+                if (rc < 0)
+                        die("matrixSslSentData\n");
+        }
+}
+
+static void do_io_until_eof_and_exit(int fd, sslKeys_t *keys)
+{
+        int rc;
+        int len;
+        uint32_t len32u;
+        sslSessionId_t *sid;
+        ssl_t *ssl;
+        unsigned char *buf;
+
+        NETWORK.fd = fd;
+        /* Note! STDIN.fd is disabled (-1) until SSL handshake is over:
+         * we do not attempt to feed any user data to MatrixSSL
+         * before it is ready.
+         */
+
+        matrixSslNewSessionId(&sid);
+        rc = matrixSslNewClientSession(&ssl, keys, sid, 0, certCb, NULL, NULL, 0);
+dbg("matrixSslNewClientSession:rc=%d\n", rc);
+        if (rc != MATRIXSSL_REQUEST_SEND)
+                die("matrixSslNewClientSession\n");
+
+        len = 0; /* only to suppress compiler warning */
+ again:
+        switch (rc) {
+        case MATRIXSSL_REQUEST_SEND:
+                dbg("MATRIXSSL_REQUEST_SEND\n");
+                flush_to_net(ssl, fd);
+                goto poll_input;
+
+        case 0:
+                dbg("rc==0\n");
+                flush_to_net(ssl, fd);
+                goto poll_input;
+
+        case MATRIXSSL_REQUEST_CLOSE:
+                /* what does this mean if we are here? */
+                dbg("MATRIXSSL_REQUEST_CLOSE\n");
+                close_conn_and_exit(ssl, fd);
+
+        case MATRIXSSL_HANDSHAKE_COMPLETE:
+                dbg("MATRIXSSL_HANDSHAKE_COMPLETE\n");
+                /* Init complete, can start reading local user's data: */
+                STDIN.fd = STDIN_FILENO;
+ poll_input:
+                wait_for_input();
+                if (STDIN_READY()) {
+                        char ibuf[4 * 1024];
+                        dbg("reading stdin\n");
+                        len = read(STDIN_FILENO, ibuf, sizeof(ibuf));
+                        if (len < 0)
+                                die("read error on stdin\n");
+                        if (len == 0)
+                                STDIN.fd = -1;
+                        else {
+                                len = encode_data(ssl, ibuf, len);
+                                if (len) {
+                                        rc = MATRIXSSL_REQUEST_SEND;
+dbg("rc=%d\n", rc);
+                                        goto again;
+                                }
+                        }
+                }
+ read_network:
+                if (NETWORK_READY()) {
+                        dbg("%s%s%s\n",
+                                (pfd[1].revents & POLLIN)  ? "POLLIN"  : "",
+                                (pfd[1].revents & POLLERR) ? "|POLLERR" : "",
+                                (pfd[1].revents & POLLHUP) ? "|POLLHUP" : ""
+                        );
+                        len = matrixSslGetReadbuf(ssl, &buf);
+                        if (len <= 0)
+                                die("matrixSslGetReadbuf\n");
+                        dbg("reading net up to %d\n", len);
+                        len = read(fd, buf, len);
+                        dbg("reading net:%d\n", len);
+                        if (len < 0)
+                                die("read error on network\n");
+                        if (len == 0) /*eof*/
+                                NETWORK.fd = -1;
+                        len32u = len;
+                        rc = matrixSslReceivedData(ssl, len, &buf, &len32u);
+dbg("matrixSslReceivedData:rc=%d\n", rc);
+                        len = len32u;
+                        if (rc < 0)
+                                die("matrixSslReceivedData\n");
+                }
+                goto again;
+
+        case MATRIXSSL_APP_DATA:
+                dbg("MATRIXSSL_APP_DATA: writing stdout\n");
+                do {
+                        if (full_write(STDOUT_FILENO, buf, len) != len)
+                                die("write to stdout\n");
+                        len32u = len;
+                        rc = matrixSslProcessedData(ssl, &buf, &len32u);
+//this was seen returning rc=0:
+dbg("matrixSslProcessedData:rc=%d\n", rc);
+                        len = len32u;
+                } while (rc == MATRIXSSL_APP_DATA);
+                if (pfd[1].fd == -1) {
+                        /* Already saw EOF on network, and we processed
+                         * and wrote out all ssl data. Signal it:
+                         */
+                        close(STDOUT_FILENO);
+                }
+                goto again;
+
+        case MATRIXSSL_REQUEST_RECV:
+                dbg("MATRIXSSL_REQUEST_RECV\n");
+                wait_for_input();
+                goto read_network;
+
+        case MATRIXSSL_RECEIVED_ALERT:
+                dbg("MATRIXSSL_RECEIVED_ALERT\n");
+                /* The first byte of the buffer is the level */
+                /* The second byte is the description */
+                if (buf[0] == SSL_ALERT_LEVEL_FATAL)
+                        die("Fatal alert\n");
+                /* Closure alert is normal (and best) way to close */
+                if (buf[1] == SSL_ALERT_CLOSE_NOTIFY)
+                        close_conn_and_exit(ssl, fd);
+                die("Warning alert\n");
+                len32u = len;
+                rc = matrixSslProcessedData(ssl, &buf, &len32u);
+dbg("matrixSslProcessedData:rc=%d\n", rc);
+                len = len32u;
+                goto again;
+
+        default:
+                /* If rc < 0 it is an error */
+                die("bad rc:%d\n", rc);
+        }
+}
+
+static sslKeys_t* make_keys(void)
+{
+        int rc, CAstreamLen;
+        char *CAstream;
+        sslKeys_t *keys;
+
+        if (matrixSslNewKeys(&keys) < 0)
+                die("matrixSslNewKeys\n");
+
+#ifdef USE_HEADER_KEYS
+        /*
+         * In-memory based keys
+         * Build the CA list first for potential client auth usage
+         */
+        CAstream = NULL;
+        CAstreamLen = sizeof(RSACAS);
+        if (CAstreamLen > 0) {
+                CAstream = psMalloc(NULL, CAstreamLen);
+                memcpy(CAstream, RSACAS, sizeof(RSACAS));
+        }
+
+ #ifdef ID_RSA
+        rc = matrixSslLoadRsaKeysMem(keys, RSA2048, sizeof(RSA2048),
+                        RSA2048KEY, sizeof(RSA2048KEY), (unsigned char*)CAstream,
+                        CAstreamLen);
+        if (rc < 0)
+                die("matrixSslLoadRsaKeysMem\n");
+ #endif
+
+        if (CAstream)
+                psFree(CAstream);
+#endif /* USE_HEADER_KEYS */
+        return keys;
+}
+
+int main(int argc, char **argv)
+{
+        int fd;
+        char *fd_str;
+
+        if (!argv[1])
+                die("Syntax error\n");
+        if (argv[1][0] != '-')
+                die("Syntax error\n");
+        if (argv[1][1] != 'd')
+                die("Syntax error\n");
+        fd_str = argv[1] + 2;
+        if (!fd_str[0])
+                fd_str = argv[2];
+        if (!fd_str || fd_str[0] < '0' || fd_str[0] > '9')
+                die("Syntax error\n");
+
+        fd = atoi(fd_str);
+        if (fd < 3)
+                die("Syntax error\n");
+
+        if (matrixSslOpen() < 0)
+                die("matrixSslOpen\n");
+
+        do_io_until_eof_and_exit(fd, make_keys());
+        /* does not return */
+
+        return 0;
+}
diff --git a/networking/ssl_helper/ssl_helper.sh b/networking/ssl_helper/ssl_helper.sh
new file mode 100755
index 000000000..dc52de778
--- /dev/null
+++ b/networking/ssl_helper/ssl_helper.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# I use this to build static uclibc based binary using Aboriginal Linux toolchain:
+PREFIX=x86_64-
+STATIC=-static
+# Standard build:
+PREFIX=""
+STATIC=""
+
+${PREFIX}gcc -Os -DPOSIX -I.. -I../sampleCerts -Wall -c ssl_helper.c -o ssl_helper.o
+${PREFIX}gcc $STATIC ssl_helper.o ../libmatrixssl.a -lc ../libmatrixssl.a -o ssl_helper