diff options
Diffstat (limited to '')
| -rw-r--r-- | src/lib/libtls/tls.c (renamed from src/lib/libressl/ressl.c) | 96 |
1 files changed, 48 insertions, 48 deletions
diff --git a/src/lib/libressl/ressl.c b/src/lib/libtls/tls.c index 06c7d54cc2..a7f612e40b 100644 --- a/src/lib/libressl/ressl.c +++ b/src/lib/libtls/tls.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ressl.c,v 1.18 2014/10/15 21:02:39 tedu Exp $ */ | 1 | /* $OpenBSD: tls.c,v 1.1 2014/10/31 13:46:17 jsing Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> | 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> |
| 4 | * | 4 | * |
| @@ -26,38 +26,38 @@ | |||
| 26 | #include <openssl/pem.h> | 26 | #include <openssl/pem.h> |
| 27 | #include <openssl/x509.h> | 27 | #include <openssl/x509.h> |
| 28 | 28 | ||
| 29 | #include <ressl.h> | 29 | #include <tls.h> |
| 30 | #include "ressl_internal.h" | 30 | #include "tls_internal.h" |
| 31 | 31 | ||
| 32 | static struct ressl_config *ressl_config_default; | 32 | static struct tls_config *tls_config_default; |
| 33 | 33 | ||
| 34 | int | 34 | int |
| 35 | ressl_init(void) | 35 | tls_init(void) |
| 36 | { | 36 | { |
| 37 | static int ressl_initialised = 0; | 37 | static int tls_initialised = 0; |
| 38 | 38 | ||
| 39 | if (ressl_initialised) | 39 | if (tls_initialised) |
| 40 | return (0); | 40 | return (0); |
| 41 | 41 | ||
| 42 | SSL_load_error_strings(); | 42 | SSL_load_error_strings(); |
| 43 | SSL_library_init(); | 43 | SSL_library_init(); |
| 44 | 44 | ||
| 45 | if ((ressl_config_default = ressl_config_new()) == NULL) | 45 | if ((tls_config_default = tls_config_new()) == NULL) |
| 46 | return (-1); | 46 | return (-1); |
| 47 | 47 | ||
| 48 | ressl_initialised = 1; | 48 | tls_initialised = 1; |
| 49 | 49 | ||
| 50 | return (0); | 50 | return (0); |
| 51 | } | 51 | } |
| 52 | 52 | ||
| 53 | const char * | 53 | const char * |
| 54 | ressl_error(struct ressl *ctx) | 54 | tls_error(struct tls *ctx) |
| 55 | { | 55 | { |
| 56 | return ctx->errmsg; | 56 | return ctx->errmsg; |
| 57 | } | 57 | } |
| 58 | 58 | ||
| 59 | int | 59 | int |
| 60 | ressl_set_error(struct ressl *ctx, char *fmt, ...) | 60 | tls_set_error(struct tls *ctx, char *fmt, ...) |
| 61 | { | 61 | { |
| 62 | va_list ap; | 62 | va_list ap; |
| 63 | int rv; | 63 | int rv; |
| @@ -73,37 +73,37 @@ ressl_set_error(struct ressl *ctx, char *fmt, ...) | |||
| 73 | return (rv); | 73 | return (rv); |
| 74 | } | 74 | } |
| 75 | 75 | ||
| 76 | struct ressl * | 76 | struct tls * |
| 77 | ressl_new(void) | 77 | tls_new(void) |
| 78 | { | 78 | { |
| 79 | struct ressl *ctx; | 79 | struct tls *ctx; |
| 80 | 80 | ||
| 81 | if ((ctx = calloc(1, sizeof(*ctx))) == NULL) | 81 | if ((ctx = calloc(1, sizeof(*ctx))) == NULL) |
| 82 | return (NULL); | 82 | return (NULL); |
| 83 | 83 | ||
| 84 | ctx->config = ressl_config_default; | 84 | ctx->config = tls_config_default; |
| 85 | 85 | ||
| 86 | ressl_reset(ctx); | 86 | tls_reset(ctx); |
| 87 | 87 | ||
| 88 | return (ctx); | 88 | return (ctx); |
| 89 | } | 89 | } |
| 90 | 90 | ||
| 91 | int | 91 | int |
| 92 | ressl_configure(struct ressl *ctx, struct ressl_config *config) | 92 | tls_configure(struct tls *ctx, struct tls_config *config) |
| 93 | { | 93 | { |
| 94 | if (config == NULL) | 94 | if (config == NULL) |
| 95 | config = ressl_config_default; | 95 | config = tls_config_default; |
| 96 | 96 | ||
| 97 | ctx->config = config; | 97 | ctx->config = config; |
| 98 | 98 | ||
| 99 | if ((ctx->flags & RESSL_SERVER) != 0) | 99 | if ((ctx->flags & TLS_SERVER) != 0) |
| 100 | return (ressl_configure_server(ctx)); | 100 | return (tls_configure_server(ctx)); |
| 101 | 101 | ||
| 102 | return (0); | 102 | return (0); |
| 103 | } | 103 | } |
| 104 | 104 | ||
| 105 | int | 105 | int |
| 106 | ressl_configure_keypair(struct ressl *ctx) | 106 | tls_configure_keypair(struct tls *ctx) |
| 107 | { | 107 | { |
| 108 | EVP_PKEY *pkey = NULL; | 108 | EVP_PKEY *pkey = NULL; |
| 109 | X509 *cert = NULL; | 109 | X509 *cert = NULL; |
| @@ -112,7 +112,7 @@ ressl_configure_keypair(struct ressl *ctx) | |||
| 112 | if (ctx->config->cert_mem != NULL) { | 112 | if (ctx->config->cert_mem != NULL) { |
| 113 | if (SSL_CTX_use_certificate_chain(ctx->ssl_ctx, | 113 | if (SSL_CTX_use_certificate_chain(ctx->ssl_ctx, |
| 114 | ctx->config->cert_mem, ctx->config->cert_len) != 1) { | 114 | ctx->config->cert_mem, ctx->config->cert_len) != 1) { |
| 115 | ressl_set_error(ctx, "failed to load certificate"); | 115 | tls_set_error(ctx, "failed to load certificate"); |
| 116 | goto err; | 116 | goto err; |
| 117 | } | 117 | } |
| 118 | cert = NULL; | 118 | cert = NULL; |
| @@ -120,16 +120,16 @@ ressl_configure_keypair(struct ressl *ctx) | |||
| 120 | if (ctx->config->key_mem != NULL) { | 120 | if (ctx->config->key_mem != NULL) { |
| 121 | if ((bio = BIO_new_mem_buf(ctx->config->key_mem, | 121 | if ((bio = BIO_new_mem_buf(ctx->config->key_mem, |
| 122 | ctx->config->key_len)) == NULL) { | 122 | ctx->config->key_len)) == NULL) { |
| 123 | ressl_set_error(ctx, "failed to create buffer"); | 123 | tls_set_error(ctx, "failed to create buffer"); |
| 124 | goto err; | 124 | goto err; |
| 125 | } | 125 | } |
| 126 | if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, | 126 | if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, |
| 127 | NULL)) == NULL) { | 127 | NULL)) == NULL) { |
| 128 | ressl_set_error(ctx, "failed to read private key"); | 128 | tls_set_error(ctx, "failed to read private key"); |
| 129 | goto err; | 129 | goto err; |
| 130 | } | 130 | } |
| 131 | if (SSL_CTX_use_PrivateKey(ctx->ssl_ctx, pkey) != 1) { | 131 | if (SSL_CTX_use_PrivateKey(ctx->ssl_ctx, pkey) != 1) { |
| 132 | ressl_set_error(ctx, "failed to load private key"); | 132 | tls_set_error(ctx, "failed to load private key"); |
| 133 | goto err; | 133 | goto err; |
| 134 | } | 134 | } |
| 135 | BIO_free(bio); | 135 | BIO_free(bio); |
| @@ -141,20 +141,20 @@ ressl_configure_keypair(struct ressl *ctx) | |||
| 141 | if (ctx->config->cert_file != NULL) { | 141 | if (ctx->config->cert_file != NULL) { |
| 142 | if (SSL_CTX_use_certificate_chain_file(ctx->ssl_ctx, | 142 | if (SSL_CTX_use_certificate_chain_file(ctx->ssl_ctx, |
| 143 | ctx->config->cert_file) != 1) { | 143 | ctx->config->cert_file) != 1) { |
| 144 | ressl_set_error(ctx, "failed to load certificate file"); | 144 | tls_set_error(ctx, "failed to load certificate file"); |
| 145 | goto err; | 145 | goto err; |
| 146 | } | 146 | } |
| 147 | } | 147 | } |
| 148 | if (ctx->config->key_file != NULL) { | 148 | if (ctx->config->key_file != NULL) { |
| 149 | if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, | 149 | if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, |
| 150 | ctx->config->key_file, SSL_FILETYPE_PEM) != 1) { | 150 | ctx->config->key_file, SSL_FILETYPE_PEM) != 1) { |
| 151 | ressl_set_error(ctx, "failed to load private key file"); | 151 | tls_set_error(ctx, "failed to load private key file"); |
| 152 | goto err; | 152 | goto err; |
| 153 | } | 153 | } |
| 154 | } | 154 | } |
| 155 | 155 | ||
| 156 | if (SSL_CTX_check_private_key(ctx->ssl_ctx) != 1) { | 156 | if (SSL_CTX_check_private_key(ctx->ssl_ctx) != 1) { |
| 157 | ressl_set_error(ctx, "private/public key mismatch"); | 157 | tls_set_error(ctx, "private/public key mismatch"); |
| 158 | goto err; | 158 | goto err; |
| 159 | } | 159 | } |
| 160 | 160 | ||
| @@ -169,7 +169,7 @@ err: | |||
| 169 | } | 169 | } |
| 170 | 170 | ||
| 171 | int | 171 | int |
| 172 | ressl_configure_ssl(struct ressl *ctx) | 172 | tls_configure_ssl(struct tls *ctx) |
| 173 | { | 173 | { |
| 174 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2); | 174 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2); |
| 175 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv3); | 175 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv3); |
| @@ -178,17 +178,17 @@ ressl_configure_ssl(struct ressl *ctx) | |||
| 178 | SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1); | 178 | SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1); |
| 179 | SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); | 179 | SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); |
| 180 | 180 | ||
| 181 | if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_0) == 0) | 181 | if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_0) == 0) |
| 182 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1); | 182 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1); |
| 183 | if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_1) == 0) | 183 | if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_1) == 0) |
| 184 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1); | 184 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1); |
| 185 | if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_2) == 0) | 185 | if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_2) == 0) |
| 186 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); | 186 | SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); |
| 187 | 187 | ||
| 188 | if (ctx->config->ciphers != NULL) { | 188 | if (ctx->config->ciphers != NULL) { |
| 189 | if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, | 189 | if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, |
| 190 | ctx->config->ciphers) != 1) { | 190 | ctx->config->ciphers) != 1) { |
| 191 | ressl_set_error(ctx, "failed to set ciphers"); | 191 | tls_set_error(ctx, "failed to set ciphers"); |
| 192 | goto err; | 192 | goto err; |
| 193 | } | 193 | } |
| 194 | } | 194 | } |
| @@ -200,16 +200,16 @@ err: | |||
| 200 | } | 200 | } |
| 201 | 201 | ||
| 202 | void | 202 | void |
| 203 | ressl_free(struct ressl *ctx) | 203 | tls_free(struct tls *ctx) |
| 204 | { | 204 | { |
| 205 | if (ctx == NULL) | 205 | if (ctx == NULL) |
| 206 | return; | 206 | return; |
| 207 | ressl_reset(ctx); | 207 | tls_reset(ctx); |
| 208 | free(ctx); | 208 | free(ctx); |
| 209 | } | 209 | } |
| 210 | 210 | ||
| 211 | void | 211 | void |
| 212 | ressl_reset(struct ressl *ctx) | 212 | tls_reset(struct tls *ctx) |
| 213 | { | 213 | { |
| 214 | SSL_CTX_free(ctx->ssl_ctx); | 214 | SSL_CTX_free(ctx->ssl_ctx); |
| 215 | SSL_free(ctx->ssl_conn); | 215 | SSL_free(ctx->ssl_conn); |
| @@ -225,7 +225,7 @@ ressl_reset(struct ressl *ctx) | |||
| 225 | } | 225 | } |
| 226 | 226 | ||
| 227 | int | 227 | int |
| 228 | ressl_read(struct ressl *ctx, void *buf, size_t buflen, size_t *outlen) | 228 | tls_read(struct tls *ctx, void *buf, size_t buflen, size_t *outlen) |
| 229 | { | 229 | { |
| 230 | int ret, ssl_err; | 230 | int ret, ssl_err; |
| 231 | 231 | ||
| @@ -238,17 +238,17 @@ ressl_read(struct ressl *ctx, void *buf, size_t buflen, size_t *outlen) | |||
| 238 | ssl_err = SSL_get_error(ctx->ssl_conn, ret); | 238 | ssl_err = SSL_get_error(ctx->ssl_conn, ret); |
| 239 | switch (ssl_err) { | 239 | switch (ssl_err) { |
| 240 | case SSL_ERROR_WANT_READ: | 240 | case SSL_ERROR_WANT_READ: |
| 241 | return (RESSL_READ_AGAIN); | 241 | return (TLS_READ_AGAIN); |
| 242 | case SSL_ERROR_WANT_WRITE: | 242 | case SSL_ERROR_WANT_WRITE: |
| 243 | return (RESSL_WRITE_AGAIN); | 243 | return (TLS_WRITE_AGAIN); |
| 244 | default: | 244 | default: |
| 245 | ressl_set_error(ctx, "read failed (%i)", ssl_err); | 245 | tls_set_error(ctx, "read failed (%i)", ssl_err); |
| 246 | return (-1); | 246 | return (-1); |
| 247 | } | 247 | } |
| 248 | } | 248 | } |
| 249 | 249 | ||
| 250 | int | 250 | int |
| 251 | ressl_write(struct ressl *ctx, const void *buf, size_t buflen, size_t *outlen) | 251 | tls_write(struct tls *ctx, const void *buf, size_t buflen, size_t *outlen) |
| 252 | { | 252 | { |
| 253 | int ret, ssl_err; | 253 | int ret, ssl_err; |
| 254 | 254 | ||
| @@ -261,33 +261,33 @@ ressl_write(struct ressl *ctx, const void *buf, size_t buflen, size_t *outlen) | |||
| 261 | ssl_err = SSL_get_error(ctx->ssl_conn, ret); | 261 | ssl_err = SSL_get_error(ctx->ssl_conn, ret); |
| 262 | switch (ssl_err) { | 262 | switch (ssl_err) { |
| 263 | case SSL_ERROR_WANT_READ: | 263 | case SSL_ERROR_WANT_READ: |
| 264 | return (RESSL_READ_AGAIN); | 264 | return (TLS_READ_AGAIN); |
| 265 | case SSL_ERROR_WANT_WRITE: | 265 | case SSL_ERROR_WANT_WRITE: |
| 266 | return (RESSL_WRITE_AGAIN); | 266 | return (TLS_WRITE_AGAIN); |
| 267 | default: | 267 | default: |
| 268 | ressl_set_error(ctx, "write failed (%i)", ssl_err); | 268 | tls_set_error(ctx, "write failed (%i)", ssl_err); |
| 269 | return (-1); | 269 | return (-1); |
| 270 | } | 270 | } |
| 271 | } | 271 | } |
| 272 | 272 | ||
| 273 | int | 273 | int |
| 274 | ressl_close(struct ressl *ctx) | 274 | tls_close(struct tls *ctx) |
| 275 | { | 275 | { |
| 276 | /* XXX - handle case where multiple calls are required. */ | 276 | /* XXX - handle case where multiple calls are required. */ |
| 277 | if (ctx->ssl_conn != NULL) { | 277 | if (ctx->ssl_conn != NULL) { |
| 278 | if (SSL_shutdown(ctx->ssl_conn) == -1) { | 278 | if (SSL_shutdown(ctx->ssl_conn) == -1) { |
| 279 | ressl_set_error(ctx, "SSL shutdown failed"); | 279 | tls_set_error(ctx, "SSL shutdown failed"); |
| 280 | goto err; | 280 | goto err; |
| 281 | } | 281 | } |
| 282 | } | 282 | } |
| 283 | 283 | ||
| 284 | if (ctx->socket != -1) { | 284 | if (ctx->socket != -1) { |
| 285 | if (shutdown(ctx->socket, SHUT_RDWR) != 0) { | 285 | if (shutdown(ctx->socket, SHUT_RDWR) != 0) { |
| 286 | ressl_set_error(ctx, "shutdown"); | 286 | tls_set_error(ctx, "shutdown"); |
| 287 | goto err; | 287 | goto err; |
| 288 | } | 288 | } |
| 289 | if (close(ctx->socket) != 0) { | 289 | if (close(ctx->socket) != 0) { |
| 290 | ressl_set_error(ctx, "close"); | 290 | tls_set_error(ctx, "close"); |
| 291 | goto err; | 291 | goto err; |
| 292 | } | 292 | } |
| 293 | ctx->socket = -1; | 293 | ctx->socket = -1; |
