From 5715c21a077ee1c2fe8957cb4adcea14fd2eda6b Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Fri, 20 Nov 2020 23:24:29 +0000 Subject: Refactor tls code to support ucspi-tls That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it. --- src/conn-tools/s6-tlsd-io.c | 126 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 src/conn-tools/s6-tlsd-io.c (limited to 'src/conn-tools/s6-tlsd-io.c') diff --git a/src/conn-tools/s6-tlsd-io.c b/src/conn-tools/s6-tlsd-io.c new file mode 100644 index 0000000..0b42b3b --- /dev/null +++ b/src/conn-tools/s6-tlsd-io.c @@ -0,0 +1,126 @@ +/* ISC license. */ + +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +#define HANDSHAKE_BANNER "SSL_PROTOCOL=TLSv1\0" + +static inline void doit (int *, tain_t const *tto, uint32_t, uint32_t, unsigned int, unsigned int) gccattr_noreturn ; + +#ifdef S6_NETWORKING_USE_TLS + +#include + +static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint32_t options, unsigned int verbosity, unsigned int notif) +{ + struct tls *ctx = stls_server_init_and_handshake(fds + 2, preoptions) ; + if (notif) + { + if (allwrite(notif, HANDSHAKE_BANNER, sizeof(HANDSHAKE_BANNER)) < sizeof(HANDSHAKE_BANNER)) + strerr_diefu1sys(111, "write post-handshake data") ; + fd_close(notif) ; + } + stls_run(ctx, fds, tto, options, verbosity) ; +} + +#else +#ifdef S6_NETWORKING_USE_BEARSSL + +#include + +#include + +static int handshake_cb_nop (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) +{ + (void)ctx ; + (void)cbarg ; + return 1 ; +} + +static int handshake_cb_sendvars (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) +{ + if (allwrite(cbarg->notif, HANDSHAKE_BANNER, sizeof(HANDSHAKE_BANNER)) < sizeof(HANDSHAKE_BANNER)) + return 0 ; + fd_close(cbarg->notif) ; + return 1 ; +} + +static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint32_t options, unsigned int verbosity, unsigned int notif) +{ + if (ndelay_on(fds[0]) < 0 || ndelay_on(fds[1]) < 0) + strerr_diefu1sys(111, "set local fds non-blocking") ; + if (!random_init()) strerr_diefu1sys(111, "initialize random device") ; + sbearssl_server_init_and_run(fds, tto, preoptions, options, verbosity, notif ? &handshake_cb_sendvars : &handshake_cb_nop, notif) ; +} + +#else + +#error No SSL backend configured. + +#endif +#endif + + +#define USAGE "s6-tlsd-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] fdr fdw" +#define dieusage() strerr_dieusage(100, USAGE) + +int main (int argc, char const *const *argv, char const *const *envp) +{ + tain_t tto ; + int fds[4] = { 0, 1, 0, 1 } ; + unsigned int verbosity = 1 ; + unsigned int notif = 0 ; + uint32_t preoptions = 0 ; + uint32_t options = 1 ; + + PROG = "s6-tlsd-io" ; + { + subgetopt_t l = SUBGETOPT_ZERO ; + unsigned int t = 0 ; + for (;;) + { + int opt = subgetopt_r(argc, argv, "d:SsYyv:K:", &l) ; + if (opt == -1) break ; + switch (opt) + { + case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; + case 'd' : if (!uint0_scan(l.arg, ¬if)) dieusage() ; break ; + case 'S' : options &= ~1 ; break ; + case 's' : options |= 1 ; break ; + case 'Y' : preoptions |= 1 ; preoptions &= ~2 ; break ; + case 'y' : preoptions |= 3 ; break ; + case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ; + default : dieusage() ; + } + } + argc -= l.ind ; argv += l.ind ; + if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ; + } + if (argc < 2) dieusage() ; + { + unsigned int u ; + if (!uint0_scan(argv[0], &u)) dieusage() ; + fds[0] = u ; + if (!uint0_scan(argv[1], &u)) dieusage() ; + fds[1] = u ; + } + + if (ndelay_on(0) < 0 || ndelay_on(1) < 0) + strerr_diefu1sys(111, "set stdin/stdout non-blocking") ; + if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ; + tain_now_set_stopwatch_g() ; + doit(fds, &tto, preoptions, options, verbosity, notif) ; +} -- cgit v1.3.1