summaryrefslogtreecommitdiff
path: root/src/lib/libtls/tls.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/lib/libtls/tls.c (renamed from src/lib/libressl/ressl.c)96
1 files changed, 48 insertions, 48 deletions
diff --git a/src/lib/libressl/ressl.c b/src/lib/libtls/tls.c
index 06c7d54cc2..a7f612e40b 100644
--- a/src/lib/libressl/ressl.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ressl.c,v 1.18 2014/10/15 21:02:39 tedu Exp $ */ 1/* $OpenBSD: tls.c,v 1.1 2014/10/31 13:46:17 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -26,38 +26,38 @@
26#include <openssl/pem.h> 26#include <openssl/pem.h>
27#include <openssl/x509.h> 27#include <openssl/x509.h>
28 28
29#include <ressl.h> 29#include <tls.h>
30#include "ressl_internal.h" 30#include "tls_internal.h"
31 31
32static struct ressl_config *ressl_config_default; 32static struct tls_config *tls_config_default;
33 33
34int 34int
35ressl_init(void) 35tls_init(void)
36{ 36{
37 static int ressl_initialised = 0; 37 static int tls_initialised = 0;
38 38
39 if (ressl_initialised) 39 if (tls_initialised)
40 return (0); 40 return (0);
41 41
42 SSL_load_error_strings(); 42 SSL_load_error_strings();
43 SSL_library_init(); 43 SSL_library_init();
44 44
45 if ((ressl_config_default = ressl_config_new()) == NULL) 45 if ((tls_config_default = tls_config_new()) == NULL)
46 return (-1); 46 return (-1);
47 47
48 ressl_initialised = 1; 48 tls_initialised = 1;
49 49
50 return (0); 50 return (0);
51} 51}
52 52
53const char * 53const char *
54ressl_error(struct ressl *ctx) 54tls_error(struct tls *ctx)
55{ 55{
56 return ctx->errmsg; 56 return ctx->errmsg;
57} 57}
58 58
59int 59int
60ressl_set_error(struct ressl *ctx, char *fmt, ...) 60tls_set_error(struct tls *ctx, char *fmt, ...)
61{ 61{
62 va_list ap; 62 va_list ap;
63 int rv; 63 int rv;
@@ -73,37 +73,37 @@ ressl_set_error(struct ressl *ctx, char *fmt, ...)
73 return (rv); 73 return (rv);
74} 74}
75 75
76struct ressl * 76struct tls *
77ressl_new(void) 77tls_new(void)
78{ 78{
79 struct ressl *ctx; 79 struct tls *ctx;
80 80
81 if ((ctx = calloc(1, sizeof(*ctx))) == NULL) 81 if ((ctx = calloc(1, sizeof(*ctx))) == NULL)
82 return (NULL); 82 return (NULL);
83 83
84 ctx->config = ressl_config_default; 84 ctx->config = tls_config_default;
85 85
86 ressl_reset(ctx); 86 tls_reset(ctx);
87 87
88 return (ctx); 88 return (ctx);
89} 89}
90 90
91int 91int
92ressl_configure(struct ressl *ctx, struct ressl_config *config) 92tls_configure(struct tls *ctx, struct tls_config *config)
93{ 93{
94 if (config == NULL) 94 if (config == NULL)
95 config = ressl_config_default; 95 config = tls_config_default;
96 96
97 ctx->config = config; 97 ctx->config = config;
98 98
99 if ((ctx->flags & RESSL_SERVER) != 0) 99 if ((ctx->flags & TLS_SERVER) != 0)
100 return (ressl_configure_server(ctx)); 100 return (tls_configure_server(ctx));
101 101
102 return (0); 102 return (0);
103} 103}
104 104
105int 105int
106ressl_configure_keypair(struct ressl *ctx) 106tls_configure_keypair(struct tls *ctx)
107{ 107{
108 EVP_PKEY *pkey = NULL; 108 EVP_PKEY *pkey = NULL;
109 X509 *cert = NULL; 109 X509 *cert = NULL;
@@ -112,7 +112,7 @@ ressl_configure_keypair(struct ressl *ctx)
112 if (ctx->config->cert_mem != NULL) { 112 if (ctx->config->cert_mem != NULL) {
113 if (SSL_CTX_use_certificate_chain(ctx->ssl_ctx, 113 if (SSL_CTX_use_certificate_chain(ctx->ssl_ctx,
114 ctx->config->cert_mem, ctx->config->cert_len) != 1) { 114 ctx->config->cert_mem, ctx->config->cert_len) != 1) {
115 ressl_set_error(ctx, "failed to load certificate"); 115 tls_set_error(ctx, "failed to load certificate");
116 goto err; 116 goto err;
117 } 117 }
118 cert = NULL; 118 cert = NULL;
@@ -120,16 +120,16 @@ ressl_configure_keypair(struct ressl *ctx)
120 if (ctx->config->key_mem != NULL) { 120 if (ctx->config->key_mem != NULL) {
121 if ((bio = BIO_new_mem_buf(ctx->config->key_mem, 121 if ((bio = BIO_new_mem_buf(ctx->config->key_mem,
122 ctx->config->key_len)) == NULL) { 122 ctx->config->key_len)) == NULL) {
123 ressl_set_error(ctx, "failed to create buffer"); 123 tls_set_error(ctx, "failed to create buffer");
124 goto err; 124 goto err;
125 } 125 }
126 if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, 126 if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL,
127 NULL)) == NULL) { 127 NULL)) == NULL) {
128 ressl_set_error(ctx, "failed to read private key"); 128 tls_set_error(ctx, "failed to read private key");
129 goto err; 129 goto err;
130 } 130 }
131 if (SSL_CTX_use_PrivateKey(ctx->ssl_ctx, pkey) != 1) { 131 if (SSL_CTX_use_PrivateKey(ctx->ssl_ctx, pkey) != 1) {
132 ressl_set_error(ctx, "failed to load private key"); 132 tls_set_error(ctx, "failed to load private key");
133 goto err; 133 goto err;
134 } 134 }
135 BIO_free(bio); 135 BIO_free(bio);
@@ -141,20 +141,20 @@ ressl_configure_keypair(struct ressl *ctx)
141 if (ctx->config->cert_file != NULL) { 141 if (ctx->config->cert_file != NULL) {
142 if (SSL_CTX_use_certificate_chain_file(ctx->ssl_ctx, 142 if (SSL_CTX_use_certificate_chain_file(ctx->ssl_ctx,
143 ctx->config->cert_file) != 1) { 143 ctx->config->cert_file) != 1) {
144 ressl_set_error(ctx, "failed to load certificate file"); 144 tls_set_error(ctx, "failed to load certificate file");
145 goto err; 145 goto err;
146 } 146 }
147 } 147 }
148 if (ctx->config->key_file != NULL) { 148 if (ctx->config->key_file != NULL) {
149 if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, 149 if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx,
150 ctx->config->key_file, SSL_FILETYPE_PEM) != 1) { 150 ctx->config->key_file, SSL_FILETYPE_PEM) != 1) {
151 ressl_set_error(ctx, "failed to load private key file"); 151 tls_set_error(ctx, "failed to load private key file");
152 goto err; 152 goto err;
153 } 153 }
154 } 154 }
155 155
156 if (SSL_CTX_check_private_key(ctx->ssl_ctx) != 1) { 156 if (SSL_CTX_check_private_key(ctx->ssl_ctx) != 1) {
157 ressl_set_error(ctx, "private/public key mismatch"); 157 tls_set_error(ctx, "private/public key mismatch");
158 goto err; 158 goto err;
159 } 159 }
160 160
@@ -169,7 +169,7 @@ err:
169} 169}
170 170
171int 171int
172ressl_configure_ssl(struct ressl *ctx) 172tls_configure_ssl(struct tls *ctx)
173{ 173{
174 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2); 174 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2);
175 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv3); 175 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv3);
@@ -178,17 +178,17 @@ ressl_configure_ssl(struct ressl *ctx)
178 SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1); 178 SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1);
179 SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); 179 SSL_CTX_clear_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2);
180 180
181 if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_0) == 0) 181 if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_0) == 0)
182 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1); 182 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1);
183 if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_1) == 0) 183 if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_1) == 0)
184 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1); 184 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_1);
185 if ((ctx->config->protocols & RESSL_PROTOCOL_TLSv1_2) == 0) 185 if ((ctx->config->protocols & TLS_PROTOCOL_TLSv1_2) == 0)
186 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2); 186 SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_TLSv1_2);
187 187
188 if (ctx->config->ciphers != NULL) { 188 if (ctx->config->ciphers != NULL) {
189 if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, 189 if (SSL_CTX_set_cipher_list(ctx->ssl_ctx,
190 ctx->config->ciphers) != 1) { 190 ctx->config->ciphers) != 1) {
191 ressl_set_error(ctx, "failed to set ciphers"); 191 tls_set_error(ctx, "failed to set ciphers");
192 goto err; 192 goto err;
193 } 193 }
194 } 194 }
@@ -200,16 +200,16 @@ err:
200} 200}
201 201
202void 202void
203ressl_free(struct ressl *ctx) 203tls_free(struct tls *ctx)
204{ 204{
205 if (ctx == NULL) 205 if (ctx == NULL)
206 return; 206 return;
207 ressl_reset(ctx); 207 tls_reset(ctx);
208 free(ctx); 208 free(ctx);
209} 209}
210 210
211void 211void
212ressl_reset(struct ressl *ctx) 212tls_reset(struct tls *ctx)
213{ 213{
214 SSL_CTX_free(ctx->ssl_ctx); 214 SSL_CTX_free(ctx->ssl_ctx);
215 SSL_free(ctx->ssl_conn); 215 SSL_free(ctx->ssl_conn);
@@ -225,7 +225,7 @@ ressl_reset(struct ressl *ctx)
225} 225}
226 226
227int 227int
228ressl_read(struct ressl *ctx, void *buf, size_t buflen, size_t *outlen) 228tls_read(struct tls *ctx, void *buf, size_t buflen, size_t *outlen)
229{ 229{
230 int ret, ssl_err; 230 int ret, ssl_err;
231 231
@@ -238,17 +238,17 @@ ressl_read(struct ressl *ctx, void *buf, size_t buflen, size_t *outlen)
238 ssl_err = SSL_get_error(ctx->ssl_conn, ret); 238 ssl_err = SSL_get_error(ctx->ssl_conn, ret);
239 switch (ssl_err) { 239 switch (ssl_err) {
240 case SSL_ERROR_WANT_READ: 240 case SSL_ERROR_WANT_READ:
241 return (RESSL_READ_AGAIN); 241 return (TLS_READ_AGAIN);
242 case SSL_ERROR_WANT_WRITE: 242 case SSL_ERROR_WANT_WRITE:
243 return (RESSL_WRITE_AGAIN); 243 return (TLS_WRITE_AGAIN);
244 default: 244 default:
245 ressl_set_error(ctx, "read failed (%i)", ssl_err); 245 tls_set_error(ctx, "read failed (%i)", ssl_err);
246 return (-1); 246 return (-1);
247 } 247 }
248} 248}
249 249
250int 250int
251ressl_write(struct ressl *ctx, const void *buf, size_t buflen, size_t *outlen) 251tls_write(struct tls *ctx, const void *buf, size_t buflen, size_t *outlen)
252{ 252{
253 int ret, ssl_err; 253 int ret, ssl_err;
254 254
@@ -261,33 +261,33 @@ ressl_write(struct ressl *ctx, const void *buf, size_t buflen, size_t *outlen)
261 ssl_err = SSL_get_error(ctx->ssl_conn, ret); 261 ssl_err = SSL_get_error(ctx->ssl_conn, ret);
262 switch (ssl_err) { 262 switch (ssl_err) {
263 case SSL_ERROR_WANT_READ: 263 case SSL_ERROR_WANT_READ:
264 return (RESSL_READ_AGAIN); 264 return (TLS_READ_AGAIN);
265 case SSL_ERROR_WANT_WRITE: 265 case SSL_ERROR_WANT_WRITE:
266 return (RESSL_WRITE_AGAIN); 266 return (TLS_WRITE_AGAIN);
267 default: 267 default:
268 ressl_set_error(ctx, "write failed (%i)", ssl_err); 268 tls_set_error(ctx, "write failed (%i)", ssl_err);
269 return (-1); 269 return (-1);
270 } 270 }
271} 271}
272 272
273int 273int
274ressl_close(struct ressl *ctx) 274tls_close(struct tls *ctx)
275{ 275{
276 /* XXX - handle case where multiple calls are required. */ 276 /* XXX - handle case where multiple calls are required. */
277 if (ctx->ssl_conn != NULL) { 277 if (ctx->ssl_conn != NULL) {
278 if (SSL_shutdown(ctx->ssl_conn) == -1) { 278 if (SSL_shutdown(ctx->ssl_conn) == -1) {
279 ressl_set_error(ctx, "SSL shutdown failed"); 279 tls_set_error(ctx, "SSL shutdown failed");
280 goto err; 280 goto err;
281 } 281 }
282 } 282 }
283 283
284 if (ctx->socket != -1) { 284 if (ctx->socket != -1) {
285 if (shutdown(ctx->socket, SHUT_RDWR) != 0) { 285 if (shutdown(ctx->socket, SHUT_RDWR) != 0) {
286 ressl_set_error(ctx, "shutdown"); 286 tls_set_error(ctx, "shutdown");
287 goto err; 287 goto err;
288 } 288 }
289 if (close(ctx->socket) != 0) { 289 if (close(ctx->socket) != 0) {
290 ressl_set_error(ctx, "close"); 290 tls_set_error(ctx, "close");
291 goto err; 291 goto err;
292 } 292 }
293 ctx->socket = -1; 293 ctx->socket = -1;