From ec59112a822e16a539bc5dd1b8bed12afbcb82b8 Mon Sep 17 00:00:00 2001 From: Rich Salz Date: Mon, 7 Mar 2016 14:55:44 -0500 Subject: Remove really old demo's Reviewed-by: Richard Levitte --- demos/easy_tls/Makefile.in | 124 -- demos/easy_tls/README | 65 - demos/easy_tls/cacerts.pem | 18 - demos/easy_tls/cert.pem | 31 - demos/easy_tls/easy-tls.c | 1293 ---------------- demos/easy_tls/easy-tls.h | 59 - demos/easy_tls/test.c | 247 --- demos/easy_tls/test.h | 9 - demos/engines/cluster_labs/Makefile.in | 93 -- demos/engines/cluster_labs/cluster_labs.h | 33 - demos/engines/cluster_labs/hw_cluster_labs.c | 684 --------- demos/engines/cluster_labs/hw_cluster_labs.ec | 8 - demos/engines/cluster_labs/hw_cluster_labs_err.c | 151 -- demos/engines/cluster_labs/hw_cluster_labs_err.h | 100 -- demos/engines/ibmca/Makefile.in | 93 -- demos/engines/ibmca/hw_ibmca.c | 896 ----------- demos/engines/ibmca/hw_ibmca.ec | 8 - demos/engines/ibmca/hw_ibmca_err.c | 148 -- demos/engines/ibmca/hw_ibmca_err.h | 103 -- demos/engines/ibmca/ica_openssl_api.h | 183 --- demos/engines/rsaref/Makefile.in | 114 -- demos/engines/rsaref/README | 22 - demos/engines/rsaref/build.com | 105 -- demos/engines/rsaref/rsaref.c | 658 -------- demos/engines/rsaref/rsaref.ec | 8 - demos/engines/rsaref/rsaref_err.c | 157 -- demos/engines/rsaref/rsaref_err.h | 109 -- demos/engines/zencod/Makefile.in | 93 -- demos/engines/zencod/hw_zencod.c | 1785 ---------------------- demos/engines/zencod/hw_zencod.ec | 8 - demos/engines/zencod/hw_zencod.h | 158 -- demos/engines/zencod/hw_zencod_err.c | 146 -- demos/engines/zencod/hw_zencod_err.h | 100 -- demos/privkey.pem | 9 - demos/selfsign.c | 169 -- demos/sign/Makefile.in | 16 - demos/sign/cert.pem | 14 - demos/sign/key.pem | 9 - demos/sign/sig.txt | 158 -- demos/sign/sign.c | 159 -- demos/sign/sign.txt | 170 --- demos/spkigen.c | 171 --- demos/ssl/cli.cpp | 108 -- demos/ssl/inetdsrv.cpp | 98 -- demos/ssl/serv.cpp | 152 -- demos/ssltest-ecc/ECC-RSAcertgen.sh | 98 -- demos/ssltest-ecc/ECCcertgen.sh | 164 -- demos/ssltest-ecc/README | 15 - demos/ssltest-ecc/RSAcertgen.sh | 121 -- demos/ssltest-ecc/ssltest.sh | 188 --- demos/state_machine/Makefile.in | 10 - demos/state_machine/state_machine.c | 405 ----- demos/threads/README | 7 - demos/threads/mttest.c | 773 ---------- demos/threads/pthread.sh | 6 - demos/threads/th-lock.c | 194 --- demos/threads/win32.bat | 4 - demos/x509/README | 3 - demos/x509/mkcert.c | 169 -- demos/x509/mkreq.c | 168 -- 60 files changed, 11367 deletions(-) delete mode 100644 demos/easy_tls/Makefile.in delete mode 100644 demos/easy_tls/README delete mode 100644 demos/easy_tls/cacerts.pem delete mode 100644 demos/easy_tls/cert.pem delete mode 100644 demos/easy_tls/easy-tls.c delete mode 100644 demos/easy_tls/easy-tls.h delete mode 100644 demos/easy_tls/test.c delete mode 100644 demos/easy_tls/test.h delete mode 100644 demos/engines/cluster_labs/Makefile.in delete mode 100644 demos/engines/cluster_labs/cluster_labs.h delete mode 100644 demos/engines/cluster_labs/hw_cluster_labs.c delete mode 100644 demos/engines/cluster_labs/hw_cluster_labs.ec delete mode 100644 demos/engines/cluster_labs/hw_cluster_labs_err.c delete mode 100644 demos/engines/cluster_labs/hw_cluster_labs_err.h delete mode 100644 demos/engines/ibmca/Makefile.in delete mode 100644 demos/engines/ibmca/hw_ibmca.c delete mode 100644 demos/engines/ibmca/hw_ibmca.ec delete mode 100644 demos/engines/ibmca/hw_ibmca_err.c delete mode 100644 demos/engines/ibmca/hw_ibmca_err.h delete mode 100644 demos/engines/ibmca/ica_openssl_api.h delete mode 100644 demos/engines/rsaref/Makefile.in delete mode 100644 demos/engines/rsaref/README delete mode 100644 demos/engines/rsaref/build.com delete mode 100644 demos/engines/rsaref/rsaref.c delete mode 100644 demos/engines/rsaref/rsaref.ec delete mode 100644 demos/engines/rsaref/rsaref_err.c delete mode 100644 demos/engines/rsaref/rsaref_err.h delete mode 100644 demos/engines/zencod/Makefile.in delete mode 100644 demos/engines/zencod/hw_zencod.c delete mode 100644 demos/engines/zencod/hw_zencod.ec delete mode 100644 demos/engines/zencod/hw_zencod.h delete mode 100644 demos/engines/zencod/hw_zencod_err.c delete mode 100644 demos/engines/zencod/hw_zencod_err.h delete mode 100644 demos/privkey.pem delete mode 100644 demos/selfsign.c delete mode 100644 demos/sign/Makefile.in delete mode 100644 demos/sign/cert.pem delete mode 100644 demos/sign/key.pem delete mode 100644 demos/sign/sig.txt delete mode 100644 demos/sign/sign.c delete mode 100644 demos/sign/sign.txt delete mode 100644 demos/spkigen.c delete mode 100644 demos/ssl/cli.cpp delete mode 100644 demos/ssl/inetdsrv.cpp delete mode 100644 demos/ssl/serv.cpp delete mode 100755 demos/ssltest-ecc/ECC-RSAcertgen.sh delete mode 100755 demos/ssltest-ecc/ECCcertgen.sh delete mode 100644 demos/ssltest-ecc/README delete mode 100755 demos/ssltest-ecc/RSAcertgen.sh delete mode 100755 demos/ssltest-ecc/ssltest.sh delete mode 100644 demos/state_machine/Makefile.in delete mode 100644 demos/state_machine/state_machine.c delete mode 100644 demos/threads/README delete mode 100644 demos/threads/mttest.c delete mode 100644 demos/threads/pthread.sh delete mode 100644 demos/threads/th-lock.c delete mode 100644 demos/threads/win32.bat delete mode 100644 demos/x509/README delete mode 100644 demos/x509/mkcert.c delete mode 100644 demos/x509/mkreq.c (limited to 'demos') diff --git a/demos/easy_tls/Makefile.in b/demos/easy_tls/Makefile.in deleted file mode 100644 index 087caa8afc..0000000000 --- a/demos/easy_tls/Makefile.in +++ /dev/null @@ -1,124 +0,0 @@ -# Makefile for easy-tls example application (rudimentary client and server) -# $Id: Makefile,v 1.2 2001/09/18 09:15:40 bodo Exp $ - -SOLARIS_CFLAGS=-Wall -pedantic -g -O2 -SOLARIS_LIBS=-lxnet - -LINUX_CFLAGS=-Wall -pedantic -g -O2 -LINUX_LIBS= - - -auto-all: - case `uname -s` in \ - SunOS) echo Using SunOS configuration; \ - make SYSCFLAGS="$(SOLARIS_CFLAGS)" SYSLIBS="$(SOLARIS_LIBS)" all;; \ - Linux) echo Using Linux configuration; \ - make SYSCFLAGS="$(LINUX_CFLAGS)" SYSLIBS="$(LINUX_LIBS)" all;; \ - *) echo "unknown system"; exit 1;; \ - esac - -all: test TAGS - -# For adapting this Makefile to a different system, only the following -# definitions should need customizing: - -OPENSSLDIR=../.. -CC=gcc - -SYSCFLAGS=whatever -SYSLIBS=whatever - - -############################################################################# -# -# SSLeay/OpenSSL imports -# -# OPENSSLDIR (set above) can be either the directory where OpenSSL is -# installed or the directory where it was compiled. - -# We rely on having a new OpenSSL release where include files -# have names like (not just ). -OPENSSLINCLUDES=-I$(OPENSSLDIR)/include - -# libcrypto.a and libssl.a are directly in $(OPENSSLDIR) if this is -# the compile directory, or in $(OPENSSLDIR)/lib if we use an installed -# library. With the following definition, we can handle either case. -OPENSSLLIBS=-L$(OPENSSLDIR) -L$(OPENSSLDIR)/lib -lssl -lcrypto - - -############################################################################# -# -# Stuff for handling the source files -# - -SOURCES=easy-tls.c test.c -HEADERS=easy-tls.h test.h -DOCSandEXAMPLESetc=Makefile cert.pem cacerts.pem -EVERYTHING=$(SOURCES) $(HEADERS) $(DOCSandEXAMPLESetc) - -ls: ls-l -ls-l: - ls -l $(EVERYTHING) -# For RCS: -tag: - -rcs -n_`date +%y%m%d`: $(EVERYTHING) - rcs -nMYTAG $(EVERYTHING) - rcs -nMYTAG: $(EVERYTHING) -diff: - -rcsdiff -rMYTAG -u $(EVERYTHING) -today: - -rcsdiff -r_`date +%y%m%d` -u $(EVERYTHING) -ident: - for a in $(EVERYTHING); do ident $$a; done - -# Distribution .tar: -easy-tls.tar.gz: $(EVERYTHING) - tar cvf - $(EVERYTHING) | \ - gzip -9 > easy-tls.tar.gz - -# Working .tar: -tls.tgz: $(EVERYTHING) - tar cfv - `find . -type f -a ! -name '*.tgz' -a ! -name '*.tar.gz'` | \ - gzip -9 > tls.tgz - -# For emacs: -etags: TAGS -TAGS: $(SOURCES) $(HEADERS) - -etags $(SOURCES) $(HEADERS) - - -############################################################################# -# -# Compilation -# -# The following definitions are system dependent (and hence defined -# at the beginning of this Makefile, where they are more easily found): - -### CC=gcc -### SYSCFLAGS=-Wall -pedantic -g -O2 -### SYSLIBS=-lxnet - -EXTRACFLAGS=-DTLS_APP=\"test.h\" -# EXTRACFLAGS=-DTLS_APP=\"test.h\" -DDEBUG_TLS - -# -# The rest shouldn't need to be touched. -# -LDFLAGS=$(SYSLIBS) $(OPENSSLLIBS) -INCLUDES=$(OPENSSLINCLUDES) -CFLAGS=$(SYSCFLAGS) $(EXTRACFLAGS) $(INCLUDES) - -OBJS=easy-tls.o test.o - -clean: - @rm -f test - @rm -f TAGS - @rm -f *.o - @rm -f core - -test: $(OBJS) - $(CC) $(OBJS) $(LDFLAGS) -o test - -test.o: $(HEADERS) -easy-tls.o: $(HEADERS) -# DO NOT DELETE THIS LINE -- make depend depends on it. diff --git a/demos/easy_tls/README b/demos/easy_tls/README deleted file mode 100644 index ee89dfb942..0000000000 --- a/demos/easy_tls/README +++ /dev/null @@ -1,65 +0,0 @@ -easy_tls - generic SSL/TLS proxy -======== - -(... and example for non-blocking SSL/TLS I/O multiplexing.) - - - easy_tls.c, easy_tls.h: - - Small generic SSL/TLS proxy library: With a few function calls, - an application socket will be replaced by a pipe handled by a - separate SSL/TLS proxy process. This allows easily adding - SSL/TLS support to many programs not originally designed for it. - - [Actually easy_tls.c is not a proper library: Customization - requires defining preprocessor macros while compiling it. - This is quite confusing, so I'll probably change it.] - - These files may be used under the OpenSSL license. - - - - test.c, test.h, Makefile, cert.pem, cacerts.pem: - - Rudimentary example program using the easy_tls library, and - example key and certificates for it. Usage examples: - - $ ./test 8443 # create server listening at port 8443 - $ ./test 127.0.0.1 8443 # create client, connect to port 8443 - # at IP address 127.0.0.1 - - 'test' will not automatically do SSL/TLS, or even read or write - data -- it must be told to do so on input lines starting - with a command letter. 'W' means write a line, 'R' means - read a line, 'C' means close the connection, 'T' means - start an SSL/TLS proxy. E.g. (user input tagged with '*'): - - * R - <<< 220 mail.example.net - * WSTARTTLS - >>> STARTTLS - * R - <<< 220 Ready to start TLS - * T - test_process_init(fd = 3, client_p = 1, apparg = (nil)) - +++ `E:self signed certificate in certificate chain' - +++ `<... certificate info ...>' - * WHELO localhost - >>> HELO localhost - R - <<< 250 mail.example.net - - You can even do SSL/TLS over SSL/TLS over SSL/TLS ... by using - 'T' multiple times. I have no idea why you would want to though. - - -This code is rather old. When I find time I will update anything that -should be changed, and improve code comments. To compile the sample -program 'test' on platforms other then Linux or Solaris, you will have -to edit the Makefile. - -As noted above, easy_tls.c will be changed to become a library one -day, which means that future revisions will not be fully compatible to -the current version. - -Bodo Möller diff --git a/demos/easy_tls/cacerts.pem b/demos/easy_tls/cacerts.pem deleted file mode 100644 index acc70baf19..0000000000 --- a/demos/easy_tls/cacerts.pem +++ /dev/null @@ -1,18 +0,0 @@ -$Id: cacerts.pem,v 1.1 2001/09/17 19:06:57 bodo Exp $ - -issuer= /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test PCA (1024 bit) -subject=/C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (1024 bit) ------BEGIN CERTIFICATE----- -MIICJjCCAY8CAQAwDQYJKoZIhvcNAQEEBQAwXDELMAkGA1UEBhMCQVUxEzARBgNV -BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYD -VQQDExNUZXN0IFBDQSAoMTAyNCBiaXQpMB4XDTk3MDYwOTEzNTc0M1oXDTAxMDYw -OTEzNTc0M1owWzELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY -BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRswGQYDVQQDExJUZXN0IENBICgxMDI0 -IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKO7o8t116VP6cgybTsZ -DCZhr95nYlZuya3aCi1IKoztqwWnjbmDFIriOqGFPrZQ+moMETC9D59iRW/dFXSv -1F65ka/XY2hLh9exCCo7XuUcDs53Qp3bI3AmMqHjgzE8oO3ajyJAzJkTTOUecQU2 -mw/gI4tMM0LqWMQS7luTy4+xAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAM7achv3v -hLQJcv/65eGEpBXM40ZDVoFQFFJWaY5p883HTqLB1x4FdzsXHH0QKBTcKpWwqyu4 -YDm3fb8oDugw72bCzfyZK/zVZPR/hVlqI/fvU109Qoc+7oPvIXWky71HfcK6ZBCA -q30KIqGM/uoM60INq97qjDmCJapagcNBGQs= ------END CERTIFICATE----- diff --git a/demos/easy_tls/cert.pem b/demos/easy_tls/cert.pem deleted file mode 100644 index 364fe10d5b..0000000000 --- a/demos/easy_tls/cert.pem +++ /dev/null @@ -1,31 +0,0 @@ -$Id: cert.pem,v 1.1 2001/09/17 19:06:57 bodo Exp $ - -Example certificate and key. - ------BEGIN CERTIFICATE----- -MIIB1jCCAT8CAQEwDQYJKoZIhvcNAQEEBQAwRTELMAkGA1UEBhMCQVUxEzARBgNV -BAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0 -ZDAeFw05OTA1MDEwMTI2MzVaFw05OTA1MzEwMTI2MzVaMCIxCzAJBgNVBAYTAkRF -MRMwEQYDVQQDEwpUZXN0c2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB -gQD6I3oDKiexwwlkzjar69AIFnVUaG85LtCege2R+CtIDlkQYw68/8MbT3ou0pdF -AcL9IGiYY3Y0SHM9PqF00RO1MCtNpqTnF3ScLpbmggGjKilmWYn2ai7emdjMjXVL -tzWW2xGgIGATWQN32KgfJng4jXi1UjEiyLhkw0Zf1I/ggwIDAQABMA0GCSqGSIb3 -DQEBBAUAA4GBAMgM+sbAk8DfjSfa+Rf2gcGXmbrvZAzKzC+5RU3kaq/NyxIXAGco -9dZjozzWfN/xuGup5boFk+KrP+xdgsaqGHsyzlgEoqz4ekqLjQeVbnoj339hVFU9 -MhPi6JULPxjXKumjfX2LLNkikW5puz8Df3UiX0EiaJvd7EwP8J75tiUT ------END CERTIFICATE----- ------BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQD6I3oDKiexwwlkzjar69AIFnVUaG85LtCege2R+CtIDlkQYw68 -/8MbT3ou0pdFAcL9IGiYY3Y0SHM9PqF00RO1MCtNpqTnF3ScLpbmggGjKilmWYn2 -ai7emdjMjXVLtzWW2xGgIGATWQN32KgfJng4jXi1UjEiyLhkw0Zf1I/ggwIDAQAB -AoGANST8c1etf1MU19oIO5aqaE19OCXIG7oakNLCCtVTPMfvnE+vffBJH7BPIUuU -4BBzwRv1nQrkvk72TPjVjOAu81B1SStKQueun2flVuYxp9NyupNWCBley4QdohlP -I92ml2tzTSPmNIoA6jdGyNzFcGchapRRmejsC39F1RUbHQECQQD9KX81Wt8ZOrri -dWiEXja1L3X8Bkb9vvUjVMQDTJJPxBJjehC6eurgE6PP6SJD5p/f3RHPCcLr8tSM -D4P/OpKhAkEA/PFNlhIZUDKK6aTvG2mn7qQ5phbadOoyN1Js3ttWG5OMOZ6b/QlC -Wvp84h44506BIlv+Tg2YAI0AdBUrf7oEowJAM4joAVd/ROaEtqbJ4PBA2L9RmD06 -5FqkEk4mHLnQqvYx/BgUIbH18ClvVlqSBBqFfw/EmU3WZSuogt6Bs0ocIQJBAOxB -AoPiYcxbeQ5kZIVJOXaX49SzUdaUDNVJYrEBUzsspHQJJo/Avz606kJVkjbSR6Ft -JWmIHuqcyMikIV4KxFsCQQCU2evoVjVsqkkbHi7W28f73PGBsyu0KIwlK7nu4h08 -Daf7TAI+A6jW/WRUsJ6dFhUYi7/Jvkcdrlnbgm2fxziX ------END RSA PRIVATE KEY----- diff --git a/demos/easy_tls/easy-tls.c b/demos/easy_tls/easy-tls.c deleted file mode 100644 index deef1fd48d..0000000000 --- a/demos/easy_tls/easy-tls.c +++ /dev/null @@ -1,1293 +0,0 @@ -/* */ -/*- - * easy-tls.c -- generic TLS proxy. - * $Id: easy-tls.c,v 1.4 2002/03/05 09:07:16 bodo Exp $ - */ -/*- - (c) Copyright 1999 Bodo Moeller. All rights reserved. - - This is free software; you can redistributed and/or modify it - unter the terms of either - - the GNU General Public License as published by the - Free Software Foundation, version 1, or (at your option) - any later version, - or - - the following license: -*/ -/*- - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that each of the following - * conditions is met: - * - * 1. Redistributions qualify as "freeware" or "Open Source Software" under - * one of the following terms: - * - * (a) Redistributions are made at no charge beyond the reasonable cost of - * materials and delivery. - * - * (b) Redistributions are accompanied by a copy of the Source Code - * or by an irrevocable offer to provide a copy of the Source Code - * for up to three years at the cost of materials and delivery. - * Such redistributions must allow further use, modification, and - * redistribution of the Source Code under substantially the same - * terms as this license. - * - * 2. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 3. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 4. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by Bodo Moeller." - * (If available, substitute umlauted o for oe.) - * - * 5. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by Bodo Moeller." - * - * THIS SOFTWARE IS PROVIDED BY BODO MOELLER ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BODO MOELLER OR - * HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - */ -/*- - * Attribution for OpenSSL library: - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). - * This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/) - */ - -static char const rcsid[] = - "$Id: easy-tls.c,v 1.4 2002/03/05 09:07:16 bodo Exp $"; - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#ifndef NO_RSA -# include -#endif -#include -#include -#include - -#if OPENSSL_VERSION_NUMBER < 0x00904000L /* 0.9.4-dev */ -# error "This program needs OpenSSL 0.9.4 or later." -#endif - -#include "easy-tls.h" /* include after if both are - * needed */ - -#if TLS_INFO_SIZE > PIPE_BUF -# if PIPE_BUF < 512 -# error "PIPE_BUF < 512" /* non-POSIX */ -# endif -# error "TLS_INFO_SIZE > PIPE_BUF" -#endif - -/*****************************************************************************/ - -#ifdef TLS_APP -# include TLS_APP -#endif - -/*- - * Applications can define: - * TLS_APP_PROCESS_INIT -- void ...(int fd, int client_p, void *apparg) - * TLS_CUMULATE_ERRORS - * TLS_ERROR_BUFSIZ - * TLS_APP_ERRFLUSH -- void ...(int child_p, char *, size_t, void *apparg) - */ - -#ifndef TLS_APP_PROCESS_INIT -# define TLS_APP_PROCESS_INIT(fd, client_p, apparg) ((void) 0) -#endif - -#ifndef TLS_ERROR_BUFSIZ -# define TLS_ERROR_BUFSIZ (10*160) -#endif -#if TLS_ERROR_BUFSIZ < 2 /* {'\n',0} */ -# error "TLS_ERROR_BUFSIZE is too small." -#endif - -#ifndef TLS_APP_ERRFLUSH -# define TLS_APP_ERRFLUSH tls_app_errflush -static void -tls_app_errflush(int child_p, char *errbuf, size_t num, void *apparg) -{ - fputs(errbuf, stderr); -} -#endif - -/*****************************************************************************/ - -#ifdef DEBUG_TLS -# define DEBUG_MSG(x) fprintf(stderr," %s\n",x) -# define DEBUG_MSG2(x,y) fprintf(stderr, " %s: %d\n",x,y) -static int tls_loop_count = 0; -static int tls_select_count = 0; -#else -# define DEBUG_MSG(x) (void)0 -# define DEBUG_MSG2(x,y) (void)0 -#endif - -static void tls_rand_seed_uniquely(void); -static void tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, - int client_p); -static int tls_socket_nonblocking(int fd); - -static int tls_child_p = 0; -static void *tls_child_apparg; - -struct tls_start_proxy_args tls_start_proxy_defaultargs(void) -{ - struct tls_start_proxy_args ret; - - ret.fd = -1; - ret.client_p = -1; - ret.ctx = NULL; - ret.pid = NULL; - ret.infofd = NULL; - - return ret; -} - -/*- - * Slice in TLS proxy process at fd. - * Return value: - * 0 ok (*pid is set to child's PID if pid != NULL), - * < 0 look at errno - * > 0 other error - * (return value encodes place of error) - * - */ -int tls_start_proxy(struct tls_start_proxy_args a, void *apparg) -{ - int fds[2] = { -1, -1 }; - int infofds[2] = { -1, -1 }; - int r, getfd, getfl; - int ret; - - DEBUG_MSG2("tls_start_proxy fd", a.fd); - DEBUG_MSG2("tls_start_proxy client_p", a.client_p); - - if (a.fd == -1 || a.client_p == -1 || a.ctx == NULL) - return 1; - - if (a.pid != NULL) { - *a.pid = 0; - } - if (a.infofd != NULL) { - *a.infofd = -1; - } - - r = socketpair(AF_UNIX, SOCK_STREAM, 0, fds); - if (r == -1) - return -1; - if (a.fd >= FD_SETSIZE || fds[0] >= FD_SETSIZE) { - ret = 2; - goto err; - } - if (a.infofd != NULL) { - r = pipe(infofds); - if (r == -1) { - ret = -3; - goto err; - } - } - - r = fork(); - if (r == -1) { - ret = -4; - goto err; - } - if (r == 0) { - DEBUG_MSG("fork"); - tls_child_p = 1; - tls_child_apparg = apparg; - close(fds[1]); - if (infofds[0] != -1) - close(infofds[0]); - TLS_APP_PROCESS_INIT(a.fd, a.client_p, apparg); - DEBUG_MSG("TLS_APP_PROCESS_INIT"); - tls_proxy(fds[0], a.fd, infofds[1], a.ctx, a.client_p); - exit(0); - } - if (a.pid != NULL) - *a.pid = r; - if (infofds[1] != -1) { - close(infofds[1]); - infofds[1] = -1; - } - /* install fds[1] in place of fd: */ - close(fds[0]); - fds[0] = -1; - getfd = fcntl(a.fd, F_GETFD); - getfl = fcntl(a.fd, F_GETFL); - r = dup2(fds[1], a.fd); - close(fds[1]); - fds[1] = -1; - if (r == -1) { - ret = -5; - goto err; - } - if (getfd != 1) - fcntl(a.fd, F_SETFD, getfd); - if (getfl & O_NONBLOCK) - (void)tls_socket_nonblocking(a.fd); - if (a.infofd != NULL) - *a.infofd = infofds[0]; - return 0; - - err: - if (fds[0] != -1) - close(fds[0]); - if (fds[1] != -1) - close(fds[1]); - if (infofds[0] != -1) - close(infofds[0]); - if (infofds[1] != -1) - close(infofds[1]); - return ret; -} - -/*****************************************************************************/ - -static char errbuf[TLS_ERROR_BUFSIZ]; -static size_t errbuf_i = 0; - -static void tls_errflush(void *apparg) -{ - if (errbuf_i == 0) - return; - - assert(errbuf_i < sizeof errbuf); - assert(errbuf[errbuf_i] == 0); - if (errbuf_i == sizeof errbuf - 1) { - /* make sure we have a newline, even if string has been truncated */ - errbuf[errbuf_i - 1] = '\n'; - } - - /* - * TLS_APP_ERRFLUSH may modify the string as needed, e.g. substitute - * other characters for \n for convenience - */ - TLS_APP_ERRFLUSH(tls_child_p, errbuf, errbuf_i, apparg); - - errbuf_i = 0; -} - -static void tls_errprintf(int flush, void *apparg, const char *fmt, ...) -{ - va_list args; - int r; - - if (errbuf_i < sizeof errbuf - 1) { - size_t n; - - va_start(args, fmt); - n = (sizeof errbuf) - errbuf_i; - r = vsnprintf(errbuf + errbuf_i, n, fmt, args); - if (r >= n) - r = n - 1; - if (r >= 0) { - errbuf_i += r; - } else { - errbuf_i = sizeof errbuf - 1; - errbuf[errbuf_i] = '\0'; - } - assert(errbuf_i < sizeof errbuf); - assert(errbuf[errbuf_i] == 0); - } -#ifndef TLS_CUMULATE_ERRORS - tls_errflush(apparg); -#else - if (flush) - tls_errflush(apparg); -#endif -} - -/* - * app_prefix.. are for additional information provided by caller. If OpenSSL - * error queue is empty, print default_text ("???" if NULL). - */ -static char *tls_openssl_errors(const char *app_prefix_1, - const char *app_prefix_2, - const char *default_text, void *apparg) -{ - static char reasons[255]; - size_t reasons_i; - unsigned long err; - const char *file; - int line; - const char *data; - int flags; - char *errstring; - int printed_something = 0; - - reasons_i = 0; - - assert(app_prefix_1 != NULL); - assert(app_prefix_2 != NULL); - - if (default_text == NULL) - default_text = "?" "?" "?"; - - while ((err = ERR_get_error_line_data(&file, &line, &data, &flags)) != 0) { - if (reasons_i < sizeof reasons) { - size_t n; - int r; - - n = (sizeof reasons) - reasons_i; - r = snprintf(reasons + reasons_i, n, "%s%s", - (reasons_i > 0 ? ", " : ""), - ERR_reason_error_string(err)); - if (r >= n) - r = n - 1; - if (r >= 0) { - reasons_i += r; - } else { - reasons_i = sizeof reasons; - } - assert(reasons_i <= sizeof reasons); - } - - errstring = ERR_error_string(err, NULL); - assert(errstring != NULL); - tls_errprintf(0, apparg, "OpenSSL error%s%s: %s:%s:%d:%s\n", - app_prefix_1, app_prefix_2, errstring, file, line, - (flags & ERR_TXT_STRING) ? data : ""); - printed_something = 1; - } - - if (!printed_something) { - assert(reasons_i == 0); - snprintf(reasons, sizeof reasons, "%s", default_text); - tls_errprintf(0, apparg, "OpenSSL error%s%s: %s\n", app_prefix_1, - app_prefix_2, default_text); - } -#ifdef TLS_CUMULATE_ERRORS - tls_errflush(apparg); -#endif - assert(errbuf_i == 0); - - return reasons; -} - -/*****************************************************************************/ - -static int tls_init_done = 0; - -static int tls_init(void *apparg) -{ - if (tls_init_done) - return 0; - - SSL_load_error_strings(); - if (!SSL_library_init()) { - tls_errprintf(1, apparg, "SSL_library_init failed.\n"); - return -1; - } - tls_init_done = 1; - tls_rand_seed(); - return 0; -} - -/*****************************************************************************/ - -static void tls_rand_seed_uniquely(void) -{ - struct { - pid_t pid; - time_t time; - void *stack; - } data; - - data.pid = getpid(); - data.time = time(NULL); - data.stack = (void *)&data; - - RAND_seed((const void *)&data, sizeof data); -} - -void tls_rand_seed(void) -{ - struct { - struct utsname uname; - int uname_1; - int uname_2; - uid_t uid; - uid_t euid; - gid_t gid; - gid_t egid; - } data; - - data.uname_1 = uname(&data.uname); - data.uname_2 = errno; /* Let's hope that uname fails randomly :-) */ - - data.uid = getuid(); - data.euid = geteuid(); - data.gid = getgid(); - data.egid = getegid(); - - RAND_seed((const void *)&data, sizeof data); - tls_rand_seed_uniquely(); -} - -static int tls_rand_seeded_p = 0; - -#define my_MIN_SEED_BYTES 256 /* struct stat can be larger than 128 */ -int tls_rand_seed_from_file(const char *filename, size_t n, void *apparg) -{ - /* - * Seed OpenSSL's random number generator from file. Try to read n bytes - * if n > 0, whole file if n == 0. - */ - - int r; - - if (tls_init(apparg) == -1) - return -1; - tls_rand_seed(); - - r = RAND_load_file(filename, - (n > 0 && n < LONG_MAX) ? (long)n : LONG_MAX); - /* - * r is the number of bytes filled into the random number generator, - * which are taken from "stat(filename, ...)" in addition to the file - * contents. - */ - assert(1 < my_MIN_SEED_BYTES); - /* - * We need to detect at least those cases when the file does not exist at - * all. With current versions of OpenSSL, this should do it: - */ - if (n == 0) - n = my_MIN_SEED_BYTES; - if (r < n) { - tls_errprintf(1, apparg, - "rand_seed_from_file: could not read %d bytes from %s.\n", - n, filename); - return -1; - } else { - tls_rand_seeded_p = 1; - return 0; - } -} - -void tls_rand_seed_from_memory(const void *buf, size_t n) -{ - size_t i = 0; - - while (i < n) { - size_t rest = n - i; - int chunk = rest < INT_MAX ? (int)rest : INT_MAX; - RAND_seed((const char *)buf + i, chunk); - i += chunk; - } - tls_rand_seeded_p = 1; -} - -/*****************************************************************************/ - -struct tls_x509_name_string { - char str[100]; -}; - -static void -tls_get_x509_subject_name_oneline(X509 *cert, - struct tls_x509_name_string *namestring) -{ - X509_NAME *name; - - if (cert == NULL) { - namestring->str[0] = '\0'; - return; - } - - name = X509_get_subject_name(cert); /* does not increment any reference - * counter */ - - assert(sizeof namestring->str >= 4); /* "?" or "...", plus 0 */ - - if (name == NULL) { - namestring->str[0] = '?'; - namestring->str[1] = 0; - } else { - size_t len; - - X509_NAME_oneline(name, namestring->str, sizeof namestring->str); - len = strlen(namestring->str); - assert(namestring->str[len] == 0); - assert(len < sizeof namestring->str); - - if (len + 1 == sizeof namestring->str) { - /* - * (Probably something was cut off.) Does not really work -- - * X509_NAME_oneline truncates after name components, we cannot - * tell from the result whether anything is missing. - */ - - assert(namestring->str[len] == 0); - namestring->str[--len] = '.'; - namestring->str[--len] = '.'; - namestring->str[--len] = '.'; - } - } -} - -/*****************************************************************************/ - -/* to hinder OpenSSL from asking for passphrases */ -static int no_passphrase_callback(char *buf, int num, int w, void *arg) -{ - return -1; -} - -#if OPENSSL_VERSION_NUMBER >= 0x00907000L -static int verify_dont_fail_cb(X509_STORE_CTX *c, void *unused_arg) -#else -static int verify_dont_fail_cb(X509_STORE_CTX *c) -#endif -{ - int i; - - i = X509_verify_cert(c); /* sets c->error */ -#if OPENSSL_VERSION_NUMBER >= 0x00905000L /* don't allow unverified - * certificates -- they could - * survive session reuse, but - * OpenSSL < 0.9.5-dev does not - * preserve their verify_result */ - if (i == 0) - return 1; - else -#endif - return i; -} - -static DH *tls_dhe1024 = NULL; /* generating these takes a while, so do it - * just once */ - -void tls_set_dhe1024(int i, void *apparg) -{ - DSA *dsaparams; - DH *dhparams; - const char *seed[] = { ";-) :-( :-) :-( ", - ";-) :-( :-) :-( ", - "Random String no. 12", - ";-) :-( :-) :-( ", - "hackers have even mo", /* from jargon file */ - }; - unsigned char seedbuf[20]; - - tls_init(apparg); - if (i >= 0) { - i %= sizeof seed / sizeof seed[0]; - assert(strlen(seed[i]) == 20); - memcpy(seedbuf, seed[i], 20); - dsaparams = - DSA_generate_parameters(1024, seedbuf, 20, NULL, NULL, 0, NULL); - } else { - /* random parameters (may take a while) */ - dsaparams = - DSA_generate_parameters(1024, NULL, 0, NULL, NULL, 0, NULL); - } - - if (dsaparams == NULL) { - tls_openssl_errors("", "", NULL, apparg); - return; - } - dhparams = DSA_dup_DH(dsaparams); - DSA_free(dsaparams); - if (dhparams == NULL) { - tls_openssl_errors("", "", NULL, apparg); - return; - } - DH_free(tls_dhe1024); - tls_dhe1024 = dhparams; -} - -struct tls_create_ctx_args tls_create_ctx_defaultargs(void) -{ - struct tls_create_ctx_args ret; - - ret.client_p = 0; - ret.certificate_file = NULL; - ret.key_file = NULL; - ret.ca_file = NULL; - ret.verify_depth = -1; - ret.fail_unless_verified = 0; - - return ret; -} - -SSL_CTX *tls_create_ctx(struct tls_create_ctx_args a, void *apparg) -{ - int r; - static long context_num = 0; - SSL_CTX *ret; - const char *err_pref_1 = "", *err_pref_2 = ""; - - if (tls_init(apparg) == -1) - return NULL; - - ret = - SSL_CTX_new((a.client_p ? TLS_client_method : - TLS_server_method) ()); - - if (ret == NULL) - goto err; - - SSL_CTX_set_default_passwd_cb(ret, no_passphrase_callback); - SSL_CTX_set_mode(ret, SSL_MODE_ENABLE_PARTIAL_WRITE); - - if ((a.certificate_file != NULL) || (a.key_file != NULL)) { - if (a.key_file == NULL) { - tls_errprintf(1, apparg, "Need a key file.\n"); - goto err_return; - } - if (a.certificate_file == NULL) { - tls_errprintf(1, apparg, "Need a certificate chain file.\n"); - goto err_return; - } - - if (!SSL_CTX_use_PrivateKey_file(ret, a.key_file, SSL_FILETYPE_PEM)) - goto err; - if (!tls_rand_seeded_p) { - /* - * particularly paranoid people may not like this -- so provide - * your own random seeding before calling this - */ - if (tls_rand_seed_from_file(a.key_file, 0, apparg) == -1) - goto err_return; - } - if (!SSL_CTX_use_certificate_chain_file(ret, a.certificate_file)) - goto err; - if (!SSL_CTX_check_private_key(ret)) { - tls_errprintf(1, apparg, - "Private key \"%s\" does not match certificate \"%s\".\n", - a.key_file, a.certificate_file); - goto err_peek; - } - } - - if ((a.ca_file != NULL) || (a.verify_depth > 0)) { - context_num++; - r = SSL_CTX_set_session_id_context(ret, (const void *)&context_num, - (unsigned int)sizeof context_num); - if (!r) - goto err; - - SSL_CTX_set_verify(ret, - SSL_VERIFY_PEER | (a.fail_unless_verified ? - SSL_VERIFY_FAIL_IF_NO_PEER_CERT - : 0), 0); - if (!a.fail_unless_verified) - SSL_CTX_set_cert_verify_callback(ret, verify_dont_fail_cb, NULL); - - if (a.verify_depth > 0) - SSL_CTX_set_verify_depth(ret, a.verify_depth); - - if (a.ca_file != NULL) { - /* does not report failure if file does not exist ... */ - /* NULL argument means no CA-directory */ - r = SSL_CTX_load_verify_locations(ret, a.ca_file, NULL); - if (!r) { - err_pref_1 = " while processing certificate file "; - err_pref_2 = a.ca_file; - goto err; - } - - if (!a.client_p) { - /* - * SSL_load_client_CA_file is a misnomer, it just creates a - * list of CNs. - */ - SSL_CTX_set_client_CA_list(ret, - SSL_load_client_CA_file - (a.ca_file)); - /* - * SSL_CTX_set_client_CA_list does not have a return value; - * it does not really need one, but make sure (we really test - * if SSL_load_client_CA_file worked) - */ - if (SSL_CTX_get_client_CA_list(ret) == NULL) { - tls_errprintf(1, apparg, - "Could not set client CA list from \"%s\".\n", - a.ca_file); - goto err_peek; - } - } - } - } - - if (!a.client_p) { - if (tls_dhe1024 == NULL) { - int i; - - if (RAND_bytes((unsigned char *)&i, sizeof i) <= 0) - goto err_return; - /* - * make sure that i is non-negative -- pick one of the provided - * seeds - */ - if (i < 0) - i = -i; - if (i < 0) - i = 0; - tls_set_dhe1024(i, apparg); - if (tls_dhe1024 == NULL) - goto err_return; - } - - if (!SSL_CTX_set_tmp_dh(ret, tls_dhe1024)) - goto err; - - /* avoid small subgroup attacks: */ - SSL_CTX_set_options(ret, SSL_OP_SINGLE_DH_USE); - } - - return ret; - - err_peek: - if (!ERR_peek_error()) - goto err_return; - err: - tls_openssl_errors(err_pref_1, err_pref_2, NULL, apparg); - err_return: - SSL_CTX_free(ret); - return NULL; -} - -/*****************************************************************************/ - -static int tls_socket_nonblocking(int fd) -{ - int v, r; - - v = fcntl(fd, F_GETFL, 0); - if (v == -1) { - if (errno == EINVAL) - return 0; /* already shut down -- ignore */ - return -1; - } - r = fcntl(fd, F_SETFL, v | O_NONBLOCK); - if (r == -1) { - if (errno == EINVAL) - return 0; /* already shut down -- ignore */ - return -1; - } - return 0; -} - -static int max(int a, int b) -{ - return a > b ? a : b; -} - -/* timeout, -1 means no timeout */ -static void -tls_sockets_select(int read_select_1, int read_select_2, int write_select_1, - int write_select_2, int seconds) -{ - int maxfd, n; - fd_set reads, writes; - struct timeval timeout; - struct timeval *timeout_p; - - assert(read_select_1 >= -1 && read_select_2 >= -1 && write_select_1 >= -1 - && write_select_2 >= -1); - assert(read_select_1 < FD_SETSIZE && read_select_2 < FD_SETSIZE - 1 - && write_select_1 < FD_SETSIZE - 1 - && write_select_2 < FD_SETSIZE - 1); - - maxfd = - max(max(read_select_1, read_select_2), - max(write_select_1, write_select_2)); - assert(maxfd >= 0); - - FD_ZERO(&reads); - FD_ZERO(&writes); - - for (n = 0; n < 4; ++n) { - int i = n % 2; - int w = n >= 2; - /* loop over all (i, w) in {0,1}x{0,1} */ - int fd; - - if (i == 0 && w == 0) - fd = read_select_1; - else if (i == 1 && w == 0) - fd = read_select_2; - else if (i == 0 && w == 1) - fd = write_select_1; - else { - assert(i == 1 && w == 1); - fd = write_select_2; - } - - if (fd >= 0) { - if (w == 0) - FD_SET(fd, &reads); - else /* w == 1 */ - FD_SET(fd, &writes); - } - } - - if (seconds >= 0) { - timeout.tv_sec = seconds; - timeout.tv_usec = 0; - timeout_p = &timeout; - } else - timeout_p = NULL; - - DEBUG_MSG2("select no.", ++tls_select_count); - select(maxfd + 1, &reads, &writes, (fd_set *) NULL, timeout_p); - DEBUG_MSG("cont."); -} - -/*****************************************************************************/ - -#define TUNNELBUFSIZE (16*1024) -struct tunnelbuf { - char buf[TUNNELBUFSIZE]; - size_t len; - size_t offset; -}; - -static int tls_connect_attempt(SSL *, int *write_select, int *read_select, - int *closed, int *progress, - const char **err_pref); - -static int tls_accept_attempt(SSL *, int *write_select, int *read_select, - int *closed, int *progress, - const char **err_pref); - -static int tls_write_attempt(SSL *, struct tunnelbuf *, int *write_select, - int *read_select, int *closed, int *progress, - const char **err_pref); - -static int tls_read_attempt(SSL *, struct tunnelbuf *, int *write_select, - int *read_select, int *closed, int *progress, - const char **err_pref); - -static int write_attempt(int fd, struct tunnelbuf *, int *select, int *closed, - int *progress); - -static int read_attempt(int fd, struct tunnelbuf *, int *select, int *closed, - int *progress); - -static void write_info(SSL *ssl, int *info_fd) -{ - if (*info_fd != -1) { - long v; - int v_ok; - struct tls_x509_name_string peer; - char infobuf[TLS_INFO_SIZE]; - int r; - - DEBUG_MSG("write_info"); - v = SSL_get_verify_result(ssl); - v_ok = (v == X509_V_OK) ? 'A' : 'E'; /* Auth./Error */ - { - X509 *peercert; - - peercert = SSL_get_peer_certificate(ssl); - tls_get_x509_subject_name_oneline(peercert, &peer); - X509_free(peercert); - } - if (peer.str[0] == '\0') - v_ok = '0'; /* no cert at all */ - else if (strchr(peer.str, '\n')) { - /* should not happen, but make sure */ - *strchr(peer.str, '\n') = '\0'; - } - r = snprintf(infobuf, sizeof infobuf, "%c:%s\n%s\n", v_ok, - X509_verify_cert_error_string(v), peer.str); - DEBUG_MSG2("snprintf", r); - if (r == -1 || r >= sizeof infobuf) - r = sizeof infobuf - 1; - write(*info_fd, infobuf, r); - close(*info_fd); - *info_fd = -1; - } -} - -/* tls_proxy expects that all fds are closed after return */ -static void -tls_proxy(int clear_fd, int tls_fd, int info_fd, SSL_CTX *ctx, int client_p) -{ - struct tunnelbuf clear_to_tls, tls_to_clear; - SSL *ssl; - BIO *rbio, *wbio; - int closed, in_handshake; - const char *err_pref_1 = "", *err_pref_2 = ""; - const char *err_def = NULL; - - assert(clear_fd != -1); - assert(tls_fd != -1); - assert(clear_fd < FD_SETSIZE); - assert(tls_fd < FD_SETSIZE); - /* info_fd may be -1 */ - assert(ctx != NULL); - - tls_rand_seed_uniquely(); - - tls_socket_nonblocking(clear_fd); - DEBUG_MSG2("clear_fd", clear_fd); - tls_socket_nonblocking(tls_fd); - DEBUG_MSG2("tls_fd", tls_fd); - - ssl = SSL_new(ctx); - if (ssl == NULL) - goto err; - DEBUG_MSG("SSL_new"); - if (!SSL_set_fd(ssl, tls_fd)) - goto err; - rbio = SSL_get_rbio(ssl); - wbio = SSL_get_wbio(ssl); /* should be the same, but who cares */ - assert(rbio != NULL); - assert(wbio != NULL); - if (client_p) - SSL_set_connect_state(ssl); - else - SSL_set_accept_state(ssl); - - closed = 0; - in_handshake = 1; - tls_to_clear.len = 0; - tls_to_clear.offset = 0; - clear_to_tls.len = 0; - clear_to_tls.offset = 0; - - err_def = "I/O error"; - - /* - * loop finishes as soon as we detect that one side closed; when all - * (program and OS) buffers have enough space, the data from the last - * successful read in each direction is transferred before close - */ - do { - int clear_read_select = 0, clear_write_select = 0, - tls_read_select = 0, tls_write_select = 0, progress = 0; - int r; - uint64_t num_read = BIO_number_read(rbio), - num_written = BIO_number_written(wbio); - - DEBUG_MSG2("loop iteration", ++tls_loop_count); - - if (in_handshake) { - DEBUG_MSG("in_handshake"); - if (client_p) - r = tls_connect_attempt(ssl, &tls_write_select, - &tls_read_select, &closed, &progress, - &err_pref_1); - else - r = tls_accept_attempt(ssl, &tls_write_select, - &tls_read_select, &closed, &progress, - &err_pref_1); - if (r != 0) { - write_info(ssl, &info_fd); - goto err; - } - if (closed) - goto err_return; - if (!SSL_in_init(ssl)) { - in_handshake = 0; - write_info(ssl, &info_fd); - } - } - - if (clear_to_tls.len != 0 && !in_handshake) { - assert(!closed); - - r = tls_write_attempt(ssl, &clear_to_tls, &tls_write_select, - &tls_read_select, &closed, &progress, - &err_pref_1); - if (r != 0) - goto err; - if (closed) { - assert(progress); - tls_to_clear.offset = 0; - tls_to_clear.len = 0; - } - } - - if (tls_to_clear.len != 0) { - assert(!closed); - - r = write_attempt(clear_fd, &tls_to_clear, &clear_write_select, - &closed, &progress); - if (r != 0) - goto err_return; - if (closed) { - assert(progress); - clear_to_tls.offset = 0; - clear_to_tls.len = 0; - } - } - - if (!closed) { - if (clear_to_tls.offset + clear_to_tls.len < - sizeof clear_to_tls.buf) { - r = read_attempt(clear_fd, &clear_to_tls, &clear_read_select, - &closed, &progress); - if (r != 0) - goto err_return; - if (closed) { - r = SSL_shutdown(ssl); - DEBUG_MSG2("SSL_shutdown", r); - } - } - } - - if (!closed && !in_handshake) { - if (tls_to_clear.offset + tls_to_clear.len < - sizeof tls_to_clear.buf) { - r = tls_read_attempt(ssl, &tls_to_clear, &tls_write_select, - &tls_read_select, &closed, &progress, - &err_pref_1); - if (r != 0) - goto err; - if (closed) { - r = SSL_shutdown(ssl); - DEBUG_MSG2("SSL_shutdown", r); - } - } - } - - if (!progress) { - DEBUG_MSG("!progress?"); - if (num_read != BIO_number_read(rbio) - || num_written != BIO_number_written(wbio)) - progress = 1; - - if (!progress) { - DEBUG_MSG("!progress"); - assert(clear_read_select || tls_read_select - || clear_write_select || tls_write_select); - tls_sockets_select(clear_read_select ? clear_fd : -1, - tls_read_select ? tls_fd : -1, - clear_write_select ? clear_fd : -1, - tls_write_select ? tls_fd : -1, -1); - } - } - } while (!closed); - return; - - err: - tls_openssl_errors(err_pref_1, err_pref_2, err_def, tls_child_apparg); - err_return: - return; -} - -static int -tls_get_error(SSL *ssl, int r, int *write_select, int *read_select, - int *closed, int *progress) -{ - int err = SSL_get_error(ssl, r); - - if (err == SSL_ERROR_NONE) { - assert(r > 0); - *progress = 1; - return 0; - } - - assert(r <= 0); - - switch (err) { - case SSL_ERROR_ZERO_RETURN: - assert(r == 0); - *closed = 1; - *progress = 1; - return 0; - - case SSL_ERROR_WANT_WRITE: - *write_select = 1; - return 0; - - case SSL_ERROR_WANT_READ: - *read_select = 1; - return 0; - } - - return -1; -} - -static int -tls_connect_attempt(SSL *ssl, int *write_select, int *read_select, - int *closed, int *progress, const char **err_pref) -{ - int n, r; - - DEBUG_MSG("tls_connect_attempt"); - n = SSL_connect(ssl); - DEBUG_MSG2("SSL_connect", n); - r = tls_get_error(ssl, n, write_select, read_select, closed, progress); - if (r == -1) - *err_pref = " during SSL_connect"; - return r; -} - -static int -tls_accept_attempt(SSL *ssl, int *write_select, int *read_select, int *closed, - int *progress, const char **err_pref) -{ - int n, r; - - DEBUG_MSG("tls_accept_attempt"); - n = SSL_accept(ssl); - DEBUG_MSG2("SSL_accept", n); - r = tls_get_error(ssl, n, write_select, read_select, closed, progress); - if (r == -1) - *err_pref = " during SSL_accept"; - return r; -} - -static int -tls_write_attempt(SSL *ssl, struct tunnelbuf *buf, int *write_select, - int *read_select, int *closed, int *progress, - const char **err_pref) -{ - int n, r; - - DEBUG_MSG("tls_write_attempt"); - n = SSL_write(ssl, buf->buf + buf->offset, buf->len); - DEBUG_MSG2("SSL_write", n); - r = tls_get_error(ssl, n, write_select, read_select, closed, progress); - if (n > 0) { - buf->len -= n; - assert(buf->len >= 0); - if (buf->len == 0) - buf->offset = 0; - else - buf->offset += n; - } - if (r == -1) - *err_pref = " during SSL_write"; - return r; -} - -static int -tls_read_attempt(SSL *ssl, struct tunnelbuf *buf, int *write_select, - int *read_select, int *closed, int *progress, - const char **err_pref) -{ - int n, r; - size_t total; - - DEBUG_MSG("tls_read_attempt"); - total = buf->offset + buf->len; - assert(total < sizeof buf->buf); - n = SSL_read(ssl, buf->buf + total, (sizeof buf->buf) - total); - DEBUG_MSG2("SSL_read", n); - r = tls_get_error(ssl, n, write_select, read_select, closed, progress); - if (n > 0) { - buf->len += n; - assert(buf->offset + buf->len <= sizeof buf->buf); - } - if (r == -1) - *err_pref = " during SSL_read"; - return r; -} - -static int get_error(int r, int *select, int *closed, int *progress) -{ - if (r >= 0) { - *progress = 1; - if (r == 0) - *closed = 1; - return 0; - } else { - assert(r == -1); - if (errno == EAGAIN || errno == EWOULDBLOCK) { - *select = 1; - return 0; - } else if (errno == EPIPE) { - *progress = 1; - *closed = 1; - return 0; - } else - return -1; - } -} - -static int write_attempt(int fd, struct tunnelbuf *buf, int *select, - int *closed, int *progress) -{ - int n, r; - - DEBUG_MSG("write_attempt"); - n = write(fd, buf->buf + buf->offset, buf->len); - DEBUG_MSG2("write", n); - r = get_error(n, select, closed, progress); - if (n > 0) { - buf->len -= n; - assert(buf->len >= 0); - if (buf->len == 0) - buf->offset = 0; - else - buf->offset += n; - } - if (r == -1) - tls_errprintf(1, tls_child_apparg, "write error: %s\n", - strerror(errno)); - return r; -} - -static int -read_attempt(int fd, struct tunnelbuf *buf, int *select, int *closed, - int *progress) -{ - int n, r; - size_t total; - - DEBUG_MSG("read_attempt"); - total = buf->offset + buf->len; - assert(total < sizeof buf->buf); - n = read(fd, buf->buf + total, (sizeof buf->buf) - total); - DEBUG_MSG2("read", n); - r = get_error(n, select, closed, progress); - if (n > 0) { - buf->len += n; - assert(buf->offset + buf->len <= sizeof buf->buf); - } - if (r == -1) - tls_errprintf(1, tls_child_apparg, "read error: %s\n", - strerror(errno)); - return r; -} diff --git a/demos/easy_tls/easy-tls.h b/demos/easy_tls/easy-tls.h deleted file mode 100644 index 3ec8d63559..0000000000 --- a/demos/easy_tls/easy-tls.h +++ /dev/null @@ -1,59 +0,0 @@ -/* */ -/*- - * easy-tls.h -- generic TLS proxy. - * $Id: easy-tls.h,v 1.1 2001/09/17 19:06:59 bodo Exp $ - */ -/* - * (c) Copyright 1999 Bodo Moeller. All rights reserved. - */ - -#ifndef HEADER_TLS_H -# define HEADER_TLS_H - -# ifndef HEADER_SSL_H -typedef struct ssl_ctx_st SSL_CTX; -# endif - -# define TLS_INFO_SIZE 512 /* max. # of bytes written to infofd */ - -void tls_set_dhe1024(int i, void *apparg); -/* - * Generate DHE parameters: i >= 0 deterministic (i selects seed), i < 0 - * random (may take a while). tls_create_ctx calls this with random - * non-negative i if the application has never called it. - */ - -void tls_rand_seed(void); -int tls_rand_seed_from_file(const char *filename, size_t n, void *apparg); -void tls_rand_seed_from_memory(const void *buf, size_t n); - -struct tls_create_ctx_args { - int client_p; - const char *certificate_file; - const char *key_file; - const char *ca_file; - int verify_depth; - int fail_unless_verified; -}; -struct tls_create_ctx_args tls_create_ctx_defaultargs(void); -/* - * struct tls_create_ctx_args is similar to a conventional argument list, but - * it can provide default values and allows for future extension. - */ -SSL_CTX *tls_create_ctx(struct tls_create_ctx_args, void *apparg); - -struct tls_start_proxy_args { - int fd; - int client_p; - SSL_CTX *ctx; - pid_t *pid; - int *infofd; -}; -struct tls_start_proxy_args tls_start_proxy_defaultargs(void); -/* - * tls_start_proxy return value *MUST* be checked! 0 means ok, otherwise - * we've probably run out of some resources. - */ -int tls_start_proxy(struct tls_start_proxy_args, void *apparg); - -#endif diff --git a/demos/easy_tls/test.c b/demos/easy_tls/test.c deleted file mode 100644 index 713da09063..0000000000 --- a/demos/easy_tls/test.c +++ /dev/null @@ -1,247 +0,0 @@ -/* $Id: test.c,v 1.1 2001/09/17 19:06:59 bodo Exp $ */ - -#define L_PORT 9999 -#define C_PORT 443 - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "test.h" -#include "easy-tls.h" - -void test_process_init(int fd, int client_p, void *apparg) -{ - fprintf(stderr, - "test_process_init(fd = %d, client_p = %d, apparg = %p)\n", fd, - client_p, apparg); -} - -void test_errflush(int child_p, char *errbuf, size_t num, void *apparg) -{ - fputs(errbuf, stderr); -} - -int main(int argc, char *argv[]) -{ - int s, fd, r; - FILE *conn_in; - FILE *conn_out; - char buf[256]; - SSL_CTX *ctx; - int client_p = 0; - int port; - int tls = 0; - char infobuf[TLS_INFO_SIZE + 1]; - - if (argc > 1 && argv[1][0] == '-') { - fputs("Usage: test [port] -- server\n" - " test num.num.num.num [port] -- client\n", stderr); - exit(1); - } - - if (argc > 1) { - if (strchr(argv[1], '.')) { - client_p = 1; - } - } - - fputs(client_p ? "Client\n" : "Server\n", stderr); - - { - struct tls_create_ctx_args a = tls_create_ctx_defaultargs(); - a.client_p = client_p; - a.certificate_file = "cert.pem"; - a.key_file = "cert.pem"; - a.ca_file = "cacerts.pem"; - - ctx = tls_create_ctx(a, NULL); - if (ctx == NULL) - exit(1); - } - - s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); - if (s == -1) { - perror("socket"); - exit(1); - } - - if (client_p) { - struct sockaddr_in addr; - size_t addr_len = sizeof addr; - - addr.sin_family = AF_INET; - assert(argc > 1); - if (argc > 2) - sscanf(argv[2], "%d", &port); - else - port = C_PORT; - addr.sin_port = htons(port); - addr.sin_addr.s_addr = inet_addr(argv[1]); - - r = connect(s, &addr, addr_len); - if (r != 0) { - perror("connect"); - exit(1); - } - fd = s; - fprintf(stderr, "Connect (fd = %d).\n", fd); - } else { - /* server */ - { - int i = 1; - - r = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *)&i, sizeof i); - if (r == -1) { - perror("setsockopt"); - exit(1); - } - } - - { - struct sockaddr_in addr; - size_t addr_len = sizeof addr; - - if (argc > 1) - sscanf(argv[1], "%d", &port); - else - port = L_PORT; - addr.sin_family = AF_INET; - addr.sin_port = htons(port); - addr.sin_addr.s_addr = INADDR_ANY; - - r = bind(s, &addr, addr_len); - if (r != 0) { - perror("bind"); - exit(1); - } - } - - r = listen(s, 1); - if (r == -1) { - perror("listen"); - exit(1); - } - - fprintf(stderr, "Listening at port %i.\n", port); - - fd = accept(s, NULL, 0); - if (fd == -1) { - perror("accept"); - exit(1); - } - - fprintf(stderr, "Accept (fd = %d).\n", fd); - } - - conn_in = fdopen(fd, "r"); - if (conn_in == NULL) { - perror("fdopen"); - exit(1); - } - conn_out = fdopen(fd, "w"); - if (conn_out == NULL) { - perror("fdopen"); - exit(1); - } - - setvbuf(conn_in, NULL, _IOLBF, 256); - setvbuf(conn_out, NULL, _IOLBF, 256); - - while (fgets(buf, sizeof buf, stdin) != NULL) { - if (buf[0] == 'W') { - fprintf(conn_out, "%.*s\r\n", (int)(strlen(buf + 1) - 1), - buf + 1); - fprintf(stderr, ">>> %.*s\n", (int)(strlen(buf + 1) - 1), - buf + 1); - } else if (buf[0] == 'C') { - fprintf(stderr, "Closing.\n"); - fclose(conn_in); - fclose(conn_out); - exit(0); - } else if (buf[0] == 'R') { - int lines = 0; - - sscanf(buf + 1, "%d", &lines); - do { - if (fgets(buf, sizeof buf, conn_in) == NULL) { - if (ferror(conn_in)) { - fprintf(stderr, "ERROR\n"); - exit(1); - } - fprintf(stderr, "CLOSED\n"); - return 0; - } - fprintf(stderr, "<<< %s", buf); - } while (--lines > 0); - } else if (buf[0] == 'T') { - int infofd; - - tls++; - { - struct tls_start_proxy_args a = tls_start_proxy_defaultargs(); - a.fd = fd; - a.client_p = client_p; - a.ctx = ctx; - a.infofd = &infofd; - r = tls_start_proxy(a, NULL); - } - assert(r != 1); - if (r != 0) { - fprintf(stderr, "tls_start_proxy failed: %d\n", r); - switch (r) { - case -1: - fputs("socketpair", stderr); - break; - case 2: - fputs("FD_SETSIZE exceeded", stderr); - break; - case -3: - fputs("pipe", stderr); - break; - case -4: - fputs("fork", stderr); - break; - case -5: - fputs("dup2", stderr); - break; - default: - fputs("?", stderr); - } - if (r < 0) - perror(""); - else - fputc('\n', stderr); - exit(1); - } - - r = read(infofd, infobuf, sizeof infobuf - 1); - if (r > 0) { - const char *info = infobuf; - const char *eol; - - infobuf[r] = '\0'; - while ((eol = strchr(info, '\n')) != NULL) { - fprintf(stderr, "+++ `%.*s'\n", eol - info, info); - info = eol + 1; - } - close(infofd); - } - } else { - fprintf(stderr, "W... write line to network\n" - "R[n] read line (n lines) from network\n" - "C close\n" - "T start %sTLS proxy\n", tls ? "another " : ""); - } - } - return 0; -} diff --git a/demos/easy_tls/test.h b/demos/easy_tls/test.h deleted file mode 100644 index b30a60549d..0000000000 --- a/demos/easy_tls/test.h +++ /dev/null @@ -1,9 +0,0 @@ -/* $Id: test.h,v 1.1 2001/09/17 19:07:00 bodo Exp $ */ - -void test_process_init(int fd, int client_p, void *apparg); -#define TLS_APP_PROCESS_INIT test_process_init - -#undef TLS_CUMULATE_ERRORS - -void test_errflush(int child_p, char *errbuf, size_t num, void *apparg); -#define TLS_APP_ERRFLUSH test_errflush diff --git a/demos/engines/cluster_labs/Makefile.in b/demos/engines/cluster_labs/Makefile.in deleted file mode 100644 index af842756eb..0000000000 --- a/demos/engines/cluster_labs/Makefile.in +++ /dev/null @@ -1,93 +0,0 @@ -LIBNAME= libclabs -SRC= hw_cluster_labs.c -OBJ= hw_cluster_labs.o -HEADER= hw_cluster_labs.h - -CC= gcc -PIC= -fPIC -CFLAGS= -g -I../../../include $(PIC) -DENGINE_DYNAMIC_SUPPORT -DFLAT_INC -AR= ar r -RANLIB= ranlib - -LIB= $(LIBNAME).a -SHLIB= $(LIBNAME).so - -all: - @echo 'Please choose a system to build on:' - @echo '' - @echo 'tru64: Tru64 Unix, Digital Unix, Digital OSF/1' - @echo 'solaris: Solaris' - @echo 'irix: IRIX' - @echo 'hpux32: 32-bit HP/UX' - @echo 'hpux64: 64-bit HP/UX' - @echo 'aix: AIX' - @echo 'gnu: Generic GNU-based system (gcc and GNU ld)' - @echo '' - -generate: - perl ../../../util/mkerr.pl -conf hw_cluster_labs.ec \ - -nostatic -staticloader -write hw_cluster_labs.c - -gnu: $(SHLIB).gnu -tru64: $(SHLIB).tru64 -solaris: $(SHLIB).solaris -irix: $(SHLIB).irix -hpux32: $(SHLIB).hpux32 -hpux64: $(SHLIB).hpux64 -aix: $(SHLIB).aix - -$(LIB): $(OBJ) - $(AR) $(LIB) $(OBJ) - - $(RANLIB) $(LIB) - -LINK_SO= \ - ld -r -o $(LIBNAME).o $$ALLSYMSFLAGS $(LIB) && \ - (nm -Pg $(LIBNAME).o | grep ' [BDT] ' | cut -f1 -d' ' > $(LIBNAME).exp; \ - $$SHAREDCMD $$SHAREDFLAGS -o $(SHLIB) $(LIBNAME).o -L ../../.. -lcrypto -lc) - -$(SHLIB).gnu: $(LIB) - ALLSYMSFLAGS='--whole-archive' \ - SHAREDFLAGS='-shared -Wl