static void
_mongoc_stream_tls_secure_transport_destroy (mongoc_stream_t *stream)
{
mongoc_stream_tls_t *tls = (mongoc_stream_tls_t *) stream;
mongoc_stream_tls_secure_transport_t *secure_transport =
(mongoc_stream_tls_secure_transport_t *) tls->ctx;
ENTRY;
BSON_ASSERT (secure_transport);
SSLClose (secure_transport->ssl_ctx_ref);
CFRelease (secure_transport->ssl_ctx_ref);
secure_transport->ssl_ctx_ref = NULL;
/* SSLClose will do IO so destroy must come after */
mongoc_stream_destroy (tls->base_stream);
if (secure_transport->anchors) {
CFRelease (secure_transport->anchors);
}
if (secure_transport->my_cert) {
CFRelease (secure_transport->my_cert);
}
bson_free (secure_transport);
bson_free (stream);
mongoc_counter_streams_active_dec ();
mongoc_counter_streams_disposed_inc ();
EXIT;
}
/**
* Closes a client-side TLS credentials.
*/
static void st_ClientSessionClose (vlc_tls_creds_t *crd, vlc_tls_t *session) {
VLC_UNUSED(crd);
vlc_tls_sys_t *sys = session->sys;
msg_Dbg(session, "close TLS session");
if(sys->b_handshaked) {
OSStatus ret = SSLClose(sys->p_context);
if(ret != noErr) {
msg_Err(session, "error closing ssl context");
}
}
if (sys->p_context) {
#if TARGET_OS_IPHONE
CFRelease(sys->p_context);
#else
if(SSLDisposeContext(sys->p_context) != noErr) {
msg_Err(session, "error deleting context");
}
#endif
}
free (sys);
}
void TCPStream_CFNetwork::close()
{
if (state == Stream::State::Closed) {
return;
}
state = Stream::State::Closed;
if (secureLayerContext != nullptr) {
SSLClose(secureLayerContext);
}
if (inputStream != nullptr) {
CFReadStreamUnscheduleFromRunLoop(inputStream, CFRunLoopGetMain(), kCFRunLoopDefaultMode);
CFReadStreamClose(inputStream);
CFRelease(inputStream);
inputStream = nullptr;
}
if (outputStream != nullptr) {
CFWriteStreamClose(outputStream);
CFRelease(outputStream);
outputStream= nullptr;
}
if (secureLayerContext != nullptr) {
CFRelease(secureLayerContext);
secureLayerContext = nullptr;
}
handleClosedEvent();
}
void Curl_darwinssl_close(struct connectdata *conn, int sockindex)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
(void)SSLClose(connssl->ssl_ctx);
(void)SSLDisposeContext(connssl->ssl_ctx);
connssl->ssl_ctx = NULL;
connssl->ssl_sockfd = 0;
}
static int stransport_close(git_stream *stream)
{
stransport_stream *st = (stransport_stream *) stream;
OSStatus ret;
ret = SSLClose(st->ctx);
if (ret != noErr && ret != errSSLClosedGraceful)
return stransport_error(ret);
return git_stream_close(st->io);
}
static int tls_close(URLContext *h)
{
TLSContext *c = h->priv_data;
if (c->ssl_context) {
SSLClose(c->ssl_context);
CFRelease(c->ssl_context);
}
if (c->ca_array)
CFRelease(c->ca_array);
if (c->tls_shared.tcp)
ffurl_close(c->tls_shared.tcp);
return 0;
}
int /* O - 1 on success, 0 on error */
cupsdEndTLS(cupsd_client_t *con) /* I - Client connection */
{
while (SSLClose(con->http->tls) == errSSLWouldBlock)
usleep(1000);
CFRelease(con->http->tls);
con->http->tls = NULL;
if (con->http->tls_credentials)
CFRelease(con->http->tls_credentials);
return (1);
}
static void *securetransport_ssl_thread(void *arg)
{
OSStatus ortn;
int sock = (int)arg;
int socket = accept(sock, NULL, NULL);
CFArrayRef server_certs = server_chain();
ssl_test_handle * ssl = ssl_test_handle_create(socket, server_certs);
SSLContextRef ctx = ssl->st;
pthread_setname_np("server thread");
//uint64_t start = mach_absolute_time();
do {
ortn = SSLHandshake(ctx);
} while (ortn == errSSLWouldBlock);
require_noerr_action_quiet(ortn, out,
fprintf(stderr, "Fell out of SSLHandshake with error: %d\n", (int)ortn));
//uint64_t elapsed = mach_absolute_time() - start;
//fprintf(stderr, "setr elapsed: %lld\n", elapsed);
/*
SSLProtocol proto = kSSLProtocolUnknown;
require_noerr_quiet(SSLGetNegotiatedProtocolVersion(ctx, &proto), out); */
SSLCipherSuite cipherSuite;
require_noerr_quiet(ortn = SSLGetNegotiatedCipher(ctx, &cipherSuite), out);
//fprintf(stderr, "st negotiated %s\n", sslcipher_itoa(cipherSuite));
out:
CFRelease(server_certs);
SSLClose(ctx);
CFRelease(ctx);
if(ssl) {
close(ssl->comm);
free(ssl);
}
pthread_exit((void *)(intptr_t)ortn);
return NULL;
}
static void
ssl_cdsa_close(PurpleSslConnection *gsc)
{
PurpleSslCDSAData *cdsa_data = PURPLE_SSL_CDSA_DATA(gsc);
#ifdef CDSA_DEBUG
purple_debug_info("cdsa", "Closing PurpleSslConnection %p", cdsa_data);
#endif
if (cdsa_data == NULL)
return;
if (cdsa_data->handshake_handler)
purple_input_remove(cdsa_data->handshake_handler);
if (cdsa_data->ssl_ctx != NULL) {
OSStatus err;
SSLSessionState state;
err = SSLGetSessionState(cdsa_data->ssl_ctx, &state);
if(err != noErr)
purple_debug_error("cdsa", "SSLGetSessionState failed\n");
else if(state == kSSLConnected) {
err = SSLClose(cdsa_data->ssl_ctx);
if(err != noErr)
purple_debug_error("cdsa", "SSLClose failed\n");
}
#ifdef CDSA_DEBUG
purple_debug_info("cdsa", "SSLDisposeContext(%p)", cdsa_data->ssl_ctx);
#endif
err = SSLDisposeContext(cdsa_data->ssl_ctx);
if(err != noErr)
purple_debug_error("cdsa", "SSLDisposeContext failed\n");
cdsa_data->ssl_ctx = NULL;
}
connections = g_list_remove(connections, gsc);
g_free(cdsa_data);
gsc->private_data = NULL;
}
void Curl_darwinssl_close(struct connectdata *conn, int sockindex)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
if(connssl->ssl_ctx) {
(void)SSLClose(connssl->ssl_ctx);
#if defined(__MAC_10_8) || defined(__IPHONE_5_0)
if(SSLCreateContext != NULL)
CFRelease(connssl->ssl_ctx);
#if TARGET_OS_EMBEDDED == 0
else
(void)SSLDisposeContext(connssl->ssl_ctx);
#endif /* TARGET_OS_EMBEDDED == 0 */
#else
(void)SSLDisposeContext(connssl->ssl_ctx);
#endif /* defined(__MAC_10_8) || defined(__IPHONE_5_0) */
connssl->ssl_ctx = NULL;
}
connssl->ssl_sockfd = 0;
}
int main(int argc, char **argv)
{
/* user-spec'd variables */
const char *kcName = DEFAULT_KC;
unsigned xferSize = XFERSIZE_DEF;
int port = PORT_DEF;
const char *hostName = HOST_DEF;
SSLCipherSuite cipherSuite = TLS_RSA_WITH_AES_128_CBC_SHA;
SSLProtocol prot = kTLSProtocol1Only;
char password[200];
bool clientAuthEnable = false;
bool isServer = false;
unsigned bufSize = BUFSIZE;
bool diffieHellman = false;
int nonBlocking = 0;
if(argc < 2) {
usage(argv);
}
password[0] = 0;
switch(argv[1][0]) {
case 's':
isServer = true;
break;
case 'c':
isServer = false;
break;
default:
usage(argv);
}
extern int optind;
extern char *optarg;
int arg;
optind = 2;
while ((arg = getopt(argc, argv, "h:p:k:x:c:v:w:b:aB")) != -1) {
switch (arg) {
case 'h':
hostName = optarg;
break;
case 'p':
port = atoi(optarg);
break;
case 'k':
kcName = optarg;
break;
case 'x':
xferSize = atoi(optarg);
break;
case 'c':
if(!isServer) {
printf("***Specify cipherSuite on server side.\n");
exit(1);
}
switch(optarg[0]) {
case 'r':
cipherSuite = SSL_RSA_WITH_RC4_128_SHA;
break;
case 'd':
cipherSuite = SSL_RSA_WITH_DES_CBC_SHA;
break;
case 'D':
cipherSuite = SSL_RSA_WITH_3DES_EDE_CBC_SHA;
break;
case 'h':
cipherSuite = SSL_DH_anon_WITH_RC4_128_MD5;
diffieHellman = true;
break;
case 'H':
cipherSuite = SSL_DHE_DSS_WITH_DES_CBC_SHA;
diffieHellman = true;
break;
case 'A':
cipherSuite = TLS_RSA_WITH_AES_256_CBC_SHA;
break;
default:
usage(argv);
}
break;
case 'v':
if(!isServer) {
printf("***Specify protocol on server side.\n");
exit(1);
}
switch(optarg[0]) {
case 't':
prot = kTLSProtocol1Only;
break;
case '2':
prot = kSSLProtocol2;
break;
case '3':
prot = kSSLProtocol3Only;
break;
default:
usage(argv);
}
break;
case 'w':
strcpy(password, optarg);
break;
case 'b':
bufSize = atoi(optarg);
break;
case 'a':
clientAuthEnable = true;
break;
case 'B':
nonBlocking = 1;
break;
default:
usage(argv);
}
}
/* per-transfer buffer - make it random for server */
char *buf = (char *)malloc(bufSize);
if(isServer) {
Security::DevRandomGenerator rng;
rng.random(buf, bufSize);
}
/* gather Diffie-Hellman params from cwd */
unsigned char *dhParams = NULL;
unsigned dhParamsLen = 0;
if(diffieHellman && isServer) {
if(readFile(DH_PARAM_FILE, &dhParams, &dhParamsLen)) {
printf("***Error reading Diffie-Hellman Params. Prepare to "
"wait for a minute during SSL handshake.\n");
}
}
/*
* Open keychain; both sides use the same one.
*/
OSStatus ortn;
SecKeychainRef certKc = NULL;
CFAbsoluteTime kcOpenStart = CFAbsoluteTimeGetCurrent();
ortn = SecKeychainOpen(kcName, &certKc);
if(ortn) {
printf("Error opening keychain %s (%d); aborting.\n",
kcName, (int)ortn);
exit(1);
}
if(password[0]) {
ortn = SecKeychainUnlock(certKc, strlen(password), password, true);
if(ortn) {
printf("SecKeychainUnlock returned %d\n", (int)ortn);
/* oh well */
}
}
CFAbsoluteTime kcOpenEnd = CFAbsoluteTimeGetCurrent();
otSocket peerSock = 0;
otSocket listenSock = 0; // for server only
PeerSpec peerId;
if(isServer) {
printf("...listening for client connection on port %d\n", port);
ortn = ListenForClients(port, nonBlocking, &listenSock);
if(ortn) {
printf("...error establishing a listen socket. Aborting.\n");
exit(1);
}
ortn = AcceptClientConnection(listenSock, &peerSock, &peerId);
if(ortn) {
printf("...error listening for connection. Aborting.\n");
exit(1);
}
}
else {
printf("...connecting to host %s at port %d\n", hostName, port);
ortn = MakeServerConnection(hostName, port, nonBlocking, &peerSock,
&peerId);
if(ortn) {
printf("...error connecting to server %s. Aborting.\n",
hostName);
exit(1);
}
}
/* start timing SSL setup */
CFAbsoluteTime setupStart = CFAbsoluteTimeGetCurrent();
SSLContextRef ctx;
ortn = SSLNewContext(isServer, &ctx);
if(ortn) {
printSslErrStr("SSLNewContext", ortn);
exit(1);
}
ortn = SSLSetIOFuncs(ctx, SocketRead, SocketWrite);
if(ortn) {
printSslErrStr("SSLSetIOFuncs", ortn);
exit(1);
}
ortn = SSLSetConnection(ctx, (SSLConnectionRef)peerSock);
if(ortn) {
printSslErrStr("SSLSetConnection", ortn);
exit(1);
}
ortn = SSLSetPeerDomainName(ctx, hostName, strlen(hostName) + 1);
if(ortn) {
printSslErrStr("SSLSetPeerDomainName", ortn);
exit(1);
}
/*
* Server/client specific setup.
*
* Client uses the same keychain as server, but it uses it for
* sslAddTrustedRoots() instead of getSslCerts() and
* SSLSetCertificate().
*/
CFArrayRef myCerts = NULL;
if(clientAuthEnable || isServer) {
myCerts = sslKcRefToCertArray(certKc, CSSM_FALSE, CSSM_FALSE, NULL, NULL);
if(myCerts == NULL) {
exit(1);
}
ortn = addIdentityAsTrustedRoot(ctx, myCerts);
if(ortn) {
exit(1);
}
ortn = SSLSetCertificate(ctx, myCerts);
if(ortn) {
printSslErrStr("SSLSetCertificate", ortn);
exit(1);
}
}
if(isServer) {
SSLAuthenticate auth;
if(clientAuthEnable) {
auth = kAlwaysAuthenticate;
}
else {
auth = kNeverAuthenticate;
}
ortn = SSLSetClientSideAuthenticate(ctx, auth);
if(ortn) {
printSslErrStr("SSLSetClientSideAuthenticate", ortn);
exit(1);
}
ortn = SSLSetEnabledCiphers(ctx, &cipherSuite, 1);
if(ortn) {
printSslErrStr("SSLSetEnabledCiphers", ortn);
exit(1);
}
ortn = SSLSetProtocolVersion(ctx, prot);
if(ortn) {
printSslErrStr("SSLSetProtocolVersion", ortn);
exit(1);
}
if(dhParams != NULL) {
ortn = SSLSetDiffieHellmanParams(ctx, dhParams, dhParamsLen);
if(ortn) {
printSslErrStr("SSLSetDiffieHellmanParams", ortn);
exit(1);
}
}
}
else {
/* client setup */
if(!clientAuthEnable) {
/* We're not presenting a cert; trust the server certs */
bool foundOne;
ortn = sslAddTrustedRoots(ctx, certKc, &foundOne);
if(ortn) {
printSslErrStr("sslAddTrustedRoots", ortn);
exit(1);
}
}
}
/*
* Context setup complete. Start timing handshake.
*/
CFAbsoluteTime hshakeStart = CFAbsoluteTimeGetCurrent();
do {
ortn = SSLHandshake(ctx);
} while (ortn == errSSLWouldBlock);
if(ortn) {
printSslErrStr("SSLHandshake", ortn);
exit(1);
}
CFAbsoluteTime hshakeEnd = CFAbsoluteTimeGetCurrent();
/* snag these before data xfer possibly shuts down connection */
SSLProtocol negVersion;
SSLCipherSuite negCipher;
SSLClientCertificateState certState; // RETURNED
SSLGetNegotiatedCipher(ctx, &negCipher);
SSLGetNegotiatedProtocolVersion(ctx, &negVersion);
SSLGetClientCertificateState(ctx, &certState);
/* server sends xferSize bytes to client and shuts down */
size_t bytesMoved;
CFAbsoluteTime dataStart = CFAbsoluteTimeGetCurrent();
size_t totalMoved = 0;
if(isServer) {
size_t bytesToGo = xferSize;
bool done = false;
do {
size_t thisMove = bufSize;
if(thisMove > bytesToGo) {
thisMove = bytesToGo;
}
ortn = SSLWrite(ctx, buf, thisMove, &bytesMoved);
switch(ortn) {
case noErr:
case errSSLWouldBlock:
break;
default:
done = true;
break;
}
bytesToGo -= bytesMoved;
totalMoved += bytesMoved;
if(bytesToGo == 0) {
done = true;
}
} while(!done);
if(ortn != noErr) {
printSslErrStr("SSLWrite", ortn);
exit(1);
}
}
else {
/* client reads until error or errSSLClosedGraceful */
bool done = false;
do {
ortn = SSLRead(ctx, buf, bufSize, &bytesMoved);
switch(ortn) {
case errSSLClosedGraceful:
done = true;
break;
case noErr:
case errSSLWouldBlock:
break;
default:
done = true;
break;
}
totalMoved += bytesMoved;
} while(!done);
if(ortn != errSSLClosedGraceful) {
printSslErrStr("SSLRead", ortn);
exit(1);
}
}
/* shut down channel */
ortn = SSLClose(ctx);
if(ortn) {
printSslErrStr("SSLCLose", ortn);
exit(1);
}
CFAbsoluteTime dataEnd = CFAbsoluteTimeGetCurrent();
/* how'd we do? */
printf("SSL version : %s\n",
sslGetProtocolVersionString(negVersion));
printf("CipherSuite : %s\n",
sslGetCipherSuiteString(negCipher));
printf("Client Cert State : %s\n",
sslGetClientCertStateString(certState));
if(password[0]) {
printf("keychain open/unlock : ");
}
else {
printf("keychain open : ");
}
printf("%f s\n", kcOpenEnd - kcOpenStart);
printf("SSLContext setup : %f s\n", hshakeStart - setupStart);
printf("SSL Handshake : %f s\n", hshakeEnd - hshakeStart);
printf("Data Transfer : %u bytes in %f s\n", (unsigned)totalMoved,
dataEnd - dataStart);
printf(" : %.1f Kbytes/s\n",
totalMoved / (dataEnd - dataStart) / 1024.0);
return 0;
}
int dtls_client(const char *hostname, int bypass)
{
int fd;
int tlsfd;
struct sockaddr_in sa;
printf("Running dtls_client test with hostname=%s, bypass=%d\n", hostname, bypass);
if ((fd=socket(AF_INET, SOCK_DGRAM, 0))==-1) {
perror("socket");
exit(-1);
}
memset((char *) &sa, 0, sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_port = htons(PORT);
if (inet_aton(hostname, &sa.sin_addr)==0) {
fprintf(stderr, "inet_aton() failed\n");
exit(1);
}
if(connect(fd, (struct sockaddr *)&sa, sizeof(sa))==-1)
{
perror("connect");
return errno;
}
/* Change to non blocking io */
fcntl(fd, F_SETFL, O_NONBLOCK);
SSLRecordContextRef c=(intptr_t)fd;
OSStatus ortn;
SSLContextRef ctx = NULL;
SSLClientCertificateState certState;
SSLCipherSuite negCipher;
SSLProtocol negVersion;
/*
* Set up a SecureTransport session.
*/
ctx = SSLCreateContextWithRecordFuncs(kCFAllocatorDefault, kSSLClientSide, kSSLDatagramType, &TLSSocket_Funcs);
if(!ctx) {
printSslErrStr("SSLCreateContextWithRecordFuncs", -1);
return -1;
}
printf("Attaching filter\n");
ortn = TLSSocket_Attach(fd);
if(ortn) {
printSslErrStr("TLSSocket_Attach", ortn);
return ortn;
}
if(bypass) {
tlsfd = open("/dev/tlsnke", O_RDWR);
if(tlsfd<0) {
perror("opening tlsnke dev");
exit(-1);
}
}
ortn = SSLSetRecordContext(ctx, c);
if(ortn) {
printSslErrStr("SSLSetRecordContext", ortn);
return ortn;
}
ortn = SSLSetMaxDatagramRecordSize(ctx, 600);
if(ortn) {
printSslErrStr("SSLSetMaxDatagramRecordSize", ortn);
return ortn;
}
/* Lets not verify the cert, which is a random test cert */
ortn = SSLSetEnableCertVerify(ctx, false);
if(ortn) {
printSslErrStr("SSLSetEnableCertVerify", ortn);
return ortn;
}
ortn = SSLSetCertificate(ctx, server_chain());
if(ortn) {
printSslErrStr("SSLSetCertificate", ortn);
return ortn;
}
printf("Handshake...\n");
do {
ortn = SSLHandshake(ctx);
if(ortn == errSSLWouldBlock) {
/* keep UI responsive */
sslOutputDot();
}
} while (ortn == errSSLWouldBlock);
SSLGetClientCertificateState(ctx, &certState);
SSLGetNegotiatedCipher(ctx, &negCipher);
SSLGetNegotiatedProtocolVersion(ctx, &negVersion);
int count;
size_t len;
ssize_t sreadLen, swriteLen;
size_t readLen, writeLen;
char buffer[BUFLEN];
count = 0;
while(count<COUNT) {
int timeout = 10000;
snprintf(buffer, BUFLEN, "Message %d", count);
len = strlen(buffer);
if(bypass) {
/* Send data through the side channel, kind of like utun would */
swriteLen=write(tlsfd, buffer, len);
if(swriteLen<0) {
perror("write to tlsfd");
break;
}
writeLen=swriteLen;
} else {
ortn=SSLWrite(ctx, buffer, len, &writeLen);
if(ortn) {
printSslErrStr("SSLWrite", ortn);
break;
}
}
printf("Wrote %lu bytes\n", writeLen);
count++;
if(bypass) {
do {
sreadLen=read(tlsfd, buffer, BUFLEN);
} while((sreadLen==-1) && (errno==EAGAIN) && (timeout--));
if((sreadLen==-1) && (errno==EAGAIN)) {
printf("Read timeout...\n");
continue;
}
if(sreadLen<0) {
perror("read from tlsfd");
break;
}
readLen=sreadLen;
}
else {
do {
ortn=SSLRead(ctx, buffer, BUFLEN, &readLen);
} while((ortn==errSSLWouldBlock) && (timeout--));
if(ortn==errSSLWouldBlock) {
printf("SSLRead timeout...\n");
continue;
}
if(ortn) {
printSslErrStr("SSLRead", ortn);
break;
}
}
buffer[readLen]=0;
printf("Received %lu bytes: %s\n", readLen, buffer);
}
SSLClose(ctx);
SSLDisposeContext(ctx);
return ortn;
}
bool Connection::shutdown()
{
if( ! _connected )
return true;
std::streambuf* sb = _ios->rdbuf();
if( ! sb)
return false;
if( ! _sentShutdown)
{
// write shutdown notify
log_debug("write shutdown notify");
_isWriting = true;
OSStatus error = SSLClose(_context);
_isWriting = false;
log_debug("SSLClose: " << error);
if(error == errSSLWouldBlock)
{
// need to read shutdown alert
log_debug("want to read shutdown alert");
_sentShutdown = true;
return false;
}
if(error != noErr)
throw SslError("shutdown failed");
log_debug("shutdown complete");
_connected = false;
_sentShutdown = false;
_receivedShutdown = false;
return true;
}
// read shutdown notify
log_debug("read shutdown notify");
_maxImport = sb->in_avail();
_wantRead = false;
_isReading = true;
OSStatus error = SSLClose(_context);
_isReading = false;
log_debug("SSLClose: " << error);
if(error == errSSLWouldBlock)
{
return false;
}
if(error != noErr)
throw SslError("shutdown failed");
log_debug("shutdown complete");
_connected = false;
_sentShutdown = false;
_receivedShutdown = false;
return true;
}
OSStatus
SSLProcessAlert(SSLRecord rec, SSLContext *ctx)
{ OSStatus err = errSecSuccess;
AlertLevel level;
AlertDescription desc;
uint8_t *charPtr;
size_t remaining;
if (rec.contents.length % 2 != 0)
{
err = SSLFatalSessionAlert(SSL_AlertIllegalParam, ctx);
if (!err) {
err = errSSLProtocol;
}
return err;
}
charPtr = rec.contents.data;
remaining = rec.contents.length;
bool fatal = false;
while (remaining > 0)
{ level = (AlertLevel)*charPtr++;
desc = (AlertDescription)*charPtr++;
sslHdskMsgDebug("alert msg received level %d desc %d",
(int)level, (int)desc);
remaining -= 2;
SSLLogAlertMsg(desc, false);
if (level == SSL_AlertLevelFatal) {
/* explicit fatal errror */
fatal = true;
sslErrorLog("***Fatal alert %d received\n", desc);
}
SSLDetectCertRejected(ctx, desc);
switch (desc) {
/* A number of these are fatal by implication */
case SSL_AlertUnexpectedMsg:
err = errSSLPeerUnexpectedMsg;
fatal = true;
break;
case SSL_AlertBadRecordMac:
err = errSSLPeerBadRecordMac;
fatal = true;
break;
case SSL_AlertDecryptionFail_RESERVED:
err = errSSLPeerDecryptionFail;
fatal = true;
break;
case SSL_AlertRecordOverflow:
err = errSSLPeerRecordOverflow;
fatal = true;
break;
case SSL_AlertDecompressFail:
err = errSSLPeerDecompressFail;
fatal = true;
break;
case SSL_AlertHandshakeFail:
err = errSSLPeerHandshakeFail;
fatal = true;
break;
case SSL_AlertIllegalParam:
err = errSSLIllegalParam;
fatal = true;
break;
case SSL_AlertBadCert:
err = errSSLPeerBadCert;
break;
case SSL_AlertUnsupportedCert:
err = errSSLPeerUnsupportedCert;
break;
case SSL_AlertCertRevoked:
err = errSSLPeerCertRevoked;
break;
case SSL_AlertCertExpired:
err = errSSLPeerCertExpired;
break;
case SSL_AlertCertUnknown:
err = errSSLPeerCertUnknown;
break;
case SSL_AlertUnknownCA:
err = errSSLPeerUnknownCA;
break;
case SSL_AlertAccessDenied:
err = errSSLPeerAccessDenied;
break;
case SSL_AlertDecodeError:
err = errSSLPeerDecodeError;
break;
case SSL_AlertDecryptError:
err = errSSLPeerDecryptError;
break;
case SSL_AlertExportRestriction_RESERVED:
err = errSSLPeerExportRestriction;
break;
case SSL_AlertProtocolVersion:
err = errSSLPeerProtocolVersion;
break;
case SSL_AlertInsufficientSecurity:
err = errSSLPeerInsufficientSecurity;
break;
case SSL_AlertInternalError:
err = errSSLPeerInternalError;
break;
case SSL_AlertUserCancelled:
err = errSSLPeerUserCancelled;
break;
case SSL_AlertNoRenegotiation:
err = errSSLPeerNoRenegotiation;
break;
/* unusual cases.... */
case SSL_AlertCloseNotify:
/* the clean "we're done" case */
SSLClose(ctx);
err = errSecSuccess;
break;
case SSL_AlertNoCert_RESERVED:
if((ctx->state == SSL_HdskStateClientCert) &&
(ctx->protocolSide == kSSLServerSide) &&
(ctx->clientAuth != kAlwaysAuthenticate)) {
/*
* Tolerate this unless we're configured to
* *require* a client cert. If a client cert is
* required, we'll catch the error at the next
* handshake msg we receive - which will probably
* be a client key exchange msg, which is illegal
* when we're in state SSL_HdskStateClientCert.
* If the client cert is optional, advance to
* state ClientKeyExchange by pretending we
* just got a client cert msg.
*/
if ((err = SSLAdvanceHandshake(SSL_HdskCert,
ctx)) != 0) {
return err;
}
}
break;
case SSL_AlertUnsupportedExtension:
err = errSSLFatalAlert;
fatal = true;
break;
default:
/* Unknown alert, ignore if not fatal */
if(level == SSL_AlertLevelFatal) {
err = errSSLFatalAlert;
}
else {
err = errSecSuccess;
}
break;
}
if(fatal) {
/* don't bother processing any more */
break;
}
}
if(fatal) {
SSLDeleteSessionData(ctx);
}
return err;
}
static OSStatus sslServe(
otSocket listenSock,
SSLProtocol tryVersion,
const char *hostName, // e.g., "www.amazon.com"
CFArrayRef serverCerts, // required
CFArrayRef encryptServerCerts, // optional
CSSM_BOOL allowExpired,
CSSM_BOOL allowAnyRoot,
char cipherRestrict, // '2', 'd'. etc...'\0' for no
// restriction
SSLAuthenticate authenticate,
CSSM_BOOL resumableEnable,
CSSM_BOOL silent, // no stdout
CSSM_BOOL pause,
SSLProtocol *negVersion, // RETURNED
SSLCipherSuite *negCipher, // RETURNED
CFArrayRef *peerCerts) // mallocd & RETURNED
{
otSocket acceptSock;
PeerSpec peerId;
OSStatus ortn;
SSLContextRef ctx = NULL;
UInt32 length;
uint8 rcvBuf[RCV_BUF_SIZE];
char *outMsg = SERVER_MESSAGE;
*negVersion = kSSLProtocolUnknown;
*negCipher = SSL_NULL_WITH_NULL_NULL;
*peerCerts = NULL;
#if IGNORE_SIGPIPE
signal(SIGPIPE, sigpipe);
#endif
/* first wait for a connection */
if(!silent) {
printf("Waiting for client connection...");
fflush(stdout);
}
ortn = AcceptClientConnection(listenSock, &acceptSock, &peerId);
if(ortn) {
printf("AcceptClientConnection returned %d; aborting\n", ortn);
return ortn;
}
/*
* Set up a SecureTransport session.
* First the standard calls.
*/
ortn = SSLNewContext(true, &ctx);
if(ortn) {
printSslErrStr("SSLNewContext", ortn);
goto cleanup;
}
ortn = SSLSetIOFuncs(ctx, SocketRead, SocketWrite);
if(ortn) {
printSslErrStr("SSLSetIOFuncs", ortn);
goto cleanup;
}
ortn = SSLSetProtocolVersion(ctx, tryVersion);
if(ortn) {
printSslErrStr("SSLSetProtocolVersion", ortn);
goto cleanup;
}
ortn = SSLSetConnection(ctx, acceptSock);
if(ortn) {
printSslErrStr("SSLSetConnection", ortn);
goto cleanup;
}
ortn = SSLSetPeerDomainName(ctx, hostName, strlen(hostName) + 1);
if(ortn) {
printSslErrStr("SSLSetPeerDomainName", ortn);
goto cleanup;
}
/* have to do these options befor setting server certs */
if(allowExpired) {
ortn = SSLSetAllowsExpiredCerts(ctx, true);
if(ortn) {
printSslErrStr("SSLSetAllowExpiredCerts", ortn);
goto cleanup;
}
}
if(allowAnyRoot) {
ortn = SSLSetAllowsAnyRoot(ctx, true);
if(ortn) {
printSslErrStr("SSLSetAllowAnyRoot", ortn);
goto cleanup;
}
}
ortn = SSLSetCertificate(ctx, serverCerts);
if(ortn) {
printSslErrStr("SSLSetCertificate", ortn);
goto cleanup;
}
if(encryptServerCerts) {
ortn = SSLSetEncryptionCertificate(ctx, encryptServerCerts);
if(ortn) {
printSslErrStr("SSLSetEncryptionCertificate", ortn);
goto cleanup;
}
}
/*
* SecureTransport options.
*/
if(resumableEnable) {
ortn = SSLSetPeerID(ctx, &peerId, sizeof(PeerSpec));
if(ortn) {
printSslErrStr("SSLSetPeerID", ortn);
goto cleanup;
}
}
if(cipherRestrict != '\0') {
ortn = setCipherRestrictions(ctx, cipherRestrict);
if(ortn) {
goto cleanup;
}
}
#if AUTHENTICATE_ENABLE
if(authenticate != kNeverAuthenticate) {
ortn = SSLSetClientSideAuthenticate(ctx, authenticate);
if(ortn) {
printSslErrStr("SSLSetClientSideAuthenticate", ortn);
goto cleanup;
}
}
#endif
if(pause) {
doPause("SSLContext initialized");
}
/* Perform SSL/TLS handshake */
do
{ ortn = SSLHandshake(ctx);
if((ortn == errSSLWouldBlock) && !silent) {
/* keep UI responsive */
outputDot();
}
} while (ortn == errSSLWouldBlock);
/* this works even if handshake failed due to cert chain invalid */
copyPeerCerts(ctx, peerCerts);
SSLGetNegotiatedCipher(ctx, negCipher);
SSLGetNegotiatedProtocolVersion(ctx, negVersion);
if(!silent) {
printf("\n");
}
if(ortn) {
goto cleanup;
}
if(pause) {
doPause("SSLContext handshake complete");
}
/* wait for one complete line or user says they've had enough */
while(ortn == noErr) {
length = sizeof(rcvBuf);
ortn = SSLRead(ctx, rcvBuf, length, &length);
if(length == 0) {
/* keep UI responsive */
outputDot();
}
else {
/* print what we have */
printf("client request: ");
dumpAscii(rcvBuf, length);
}
if(pause) {
/* allow user to bail */
char resp;
fpurge(stdin);
printf("\nMore client request (y/anything): ");
resp = getchar();
if(resp != 'y') {
break;
}
}
/* poor person's line completion scan */
for(unsigned i=0; i<length; i++) {
if((rcvBuf[i] == '\n') || (rcvBuf[i] == '\r')) {
/* a labelled break would be nice here.... */
goto serverResp;
}
}
if (ortn == errSSLWouldBlock) {
ortn = noErr;
}
}
serverResp:
if(pause) {
doPause("Client GET msg received");
}
/* send out canned response */
length = strlen(outMsg);
ortn = SSLWrite(ctx, outMsg, length, &length);
if(ortn) {
printSslErrStr("SSLWrite", ortn);
}
if(pause) {
doPause("Server response sent");
}
if (ortn == noErr) {
ortn = SSLClose(ctx);
}
cleanup:
if(acceptSock) {
endpointShutdown(acceptSock);
}
if(ctx) {
SSLDisposeContext(ctx);
}
/* FIXME - dispose of serverCerts */
return ortn;
}
static OSStatus sslServe(
otSocket listenSock,
unsigned short portNum,
SSLProtocol tryVersion, // only used if acceptedProts NULL
const char *acceptedProts,
CFArrayRef serverCerts, // required
char *password, // optional
CFArrayRef encryptServerCerts, // optional
bool allowExpired,
bool allowAnyRoot,
bool allowExpiredRoot,
bool disableCertVerify,
char *anchorFile,
bool replaceAnchors,
char cipherRestrict, // '2', 'd'. etc...'\0' for no
// restriction
SSLAuthenticate authenticate,
unsigned char *dhParams, // optional D-H parameters
unsigned dhParamsLen,
CFArrayRef acceptableDNList, // optional
bool resumableEnable,
uint32_t sessionCacheTimeout,// optional
bool disableAnonCiphers,
bool silent, // no stdout
bool pause,
SSLProtocol *negVersion, // RETURNED
SSLCipherSuite *negCipher, // RETURNED
SSLClientCertificateState *certState, // RETURNED
Boolean *sessionWasResumed, // RETURNED
unsigned char *sessionID, // mallocd by caller, RETURNED
size_t *sessionIDLength, // RETURNED
CFArrayRef *peerCerts, // mallocd & RETURNED
char **argv)
{
otSocket acceptSock;
PeerSpec peerId;
OSStatus ortn;
SSLContextRef ctx = NULL;
size_t length;
uint8_t rcvBuf[RCV_BUF_SIZE];
const char *outMsg = SERVER_MESSAGE;
*negVersion = kSSLProtocolUnknown;
*negCipher = SSL_NULL_WITH_NULL_NULL;
*peerCerts = NULL;
#if IGNORE_SIGPIPE
signal(SIGPIPE, sigpipe);
#endif
/* first wait for a connection */
if(!silent) {
printf("Waiting for client connection on port %u...", portNum);
fflush(stdout);
}
ortn = AcceptClientConnection(listenSock, &acceptSock, &peerId);
if(ortn) {
printf("AcceptClientConnection returned %d; aborting\n", (int)ortn);
return ortn;
}
/*
* Set up a SecureTransport session.
* First the standard calls.
*/
ortn = SSLNewContext(true, &ctx);
if(ortn) {
printSslErrStr("SSLNewContext", ortn);
goto cleanup;
}
ortn = SSLSetIOFuncs(ctx, SocketRead, SocketWrite);
if(ortn) {
printSslErrStr("SSLSetIOFuncs", ortn);
goto cleanup;
}
ortn = SSLSetConnection(ctx, (SSLConnectionRef)(intptr_t)acceptSock);
if(ortn) {
printSslErrStr("SSLSetConnection", ortn);
goto cleanup;
}
/* have to do these options befor setting server certs */
if(allowExpired) {
ortn = SSLSetAllowsExpiredCerts(ctx, true);
if(ortn) {
printSslErrStr("SSLSetAllowExpiredCerts", ortn);
goto cleanup;
}
}
if(allowAnyRoot) {
ortn = SSLSetAllowsAnyRoot(ctx, true);
if(ortn) {
printSslErrStr("SSLSetAllowAnyRoot", ortn);
goto cleanup;
}
}
if(anchorFile) {
ortn = sslAddTrustedRoot(ctx, anchorFile, replaceAnchors);
if(ortn) {
printf("***Error obtaining anchor file %s\n", anchorFile);
goto cleanup;
}
}
if(serverCerts != NULL) {
if(anchorFile == NULL) {
/* no specific anchors, so assume we want to trust this one */
ortn = addIdentityAsTrustedRoot(ctx, serverCerts);
if(ortn) {
goto cleanup;
}
}
ortn = SSLSetCertificate(ctx, serverCerts);
if(ortn) {
printSslErrStr("SSLSetCertificate", ortn);
goto cleanup;
}
}
if(encryptServerCerts) {
ortn = SSLSetEncryptionCertificate(ctx, encryptServerCerts);
if(ortn) {
printSslErrStr("SSLSetEncryptionCertificate", ortn);
goto cleanup;
}
}
if(allowExpiredRoot) {
ortn = SSLSetAllowsExpiredRoots(ctx, true);
if(ortn) {
printSslErrStr("SSLSetAllowsExpiredRoots", ortn);
goto cleanup;
}
}
if(disableCertVerify) {
ortn = SSLSetEnableCertVerify(ctx, false);
if(ortn) {
printSslErrStr("SSLSetEnableCertVerify", ortn);
goto cleanup;
}
}
/*
* SecureTransport options.
*/
if(acceptedProts) {
ortn = SSLSetProtocolVersionEnabled(ctx, kSSLProtocolAll, false);
if(ortn) {
printSslErrStr("SSLSetProtocolVersionEnabled(all off)", ortn);
goto cleanup;
}
for(const char *cp = acceptedProts; *cp; cp++) {
SSLProtocol prot = kSSLProtocolUnknown;
switch(*cp) {
case '2':
prot = kSSLProtocol2;
break;
case '3':
prot = kSSLProtocol3;
break;
case 't':
prot = kTLSProtocol1;
break;
default:
usage(argv);
}
ortn = SSLSetProtocolVersionEnabled(ctx, prot, true);
if(ortn) {
printSslErrStr("SSLSetProtocolVersionEnabled", ortn);
goto cleanup;
}
}
}
else {
ortn = SSLSetProtocolVersion(ctx, tryVersion);
if(ortn) {
printSslErrStr("SSLSetProtocolVersion", ortn);
goto cleanup;
}
}
if(resumableEnable) {
ortn = SSLSetPeerID(ctx, &peerId, sizeof(PeerSpec));
if(ortn) {
printSslErrStr("SSLSetPeerID", ortn);
goto cleanup;
}
}
if(cipherRestrict != '\0') {
ortn = sslSetCipherRestrictions(ctx, cipherRestrict);
if(ortn) {
goto cleanup;
}
}
if(authenticate != kNeverAuthenticate) {
ortn = SSLSetClientSideAuthenticate(ctx, authenticate);
if(ortn) {
printSslErrStr("SSLSetClientSideAuthenticate", ortn);
goto cleanup;
}
}
if(dhParams) {
ortn = SSLSetDiffieHellmanParams(ctx, dhParams, dhParamsLen);
if(ortn) {
printSslErrStr("SSLSetDiffieHellmanParams", ortn);
goto cleanup;
}
}
if(sessionCacheTimeout) {
ortn = SSLSetSessionCacheTimeout(ctx, sessionCacheTimeout);
if(ortn) {
printSslErrStr("SSLSetSessionCacheTimeout", ortn);
goto cleanup;
}
}
if(disableAnonCiphers) {
ortn = SSLSetAllowAnonymousCiphers(ctx, false);
if(ortn) {
printSslErrStr("SSLSetAllowAnonymousCiphers", ortn);
goto cleanup;
}
/* quickie test of the getter */
Boolean e;
ortn = SSLGetAllowAnonymousCiphers(ctx, &e);
if(ortn) {
printSslErrStr("SSLGetAllowAnonymousCiphers", ortn);
goto cleanup;
}
if(e) {
printf("***SSLGetAllowAnonymousCiphers() returned true; expected false\n");
ortn = errSecIO;
goto cleanup;
}
}
/* XXX/cs
if(acceptableDNList) {
ortn = SSLSetCertificateAuthorities(ctx, acceptableDNList, TRUE);
if(ortn) {
printSslErrStr("SSLSetCertificateAuthorities", ortn);
goto cleanup;
}
}
*/
/* end options */
if(pause) {
doPause("SSLContext initialized");
}
/* Perform SSL/TLS handshake */
do
{ ortn = SSLHandshake(ctx);
if((ortn == errSSLWouldBlock) && !silent) {
/* keep UI responsive */
sslOutputDot();
}
} while (ortn == errSSLWouldBlock);
/* this works even if handshake failed due to cert chain invalid */
copyPeerCerts(ctx, peerCerts);
SSLGetClientCertificateState(ctx, certState);
SSLGetNegotiatedCipher(ctx, negCipher);
SSLGetNegotiatedProtocolVersion(ctx, negVersion);
*sessionIDLength = MAX_SESSION_ID_LENGTH;
SSLGetResumableSessionInfo(ctx, sessionWasResumed, sessionID,
sessionIDLength);
if(!silent) {
printf("\n");
}
if(ortn) {
goto cleanup;
}
if(pause) {
doPause("SSLContext handshake complete");
}
/* wait for one complete line or user says they've had enough */
while(ortn == errSecSuccess) {
length = sizeof(rcvBuf);
ortn = SSLRead(ctx, rcvBuf, length, &length);
if(length == 0) {
/* keep UI responsive */
sslOutputDot();
}
else {
/* print what we have */
printf("client request: ");
dumpAscii(rcvBuf, length);
}
if(pause) {
/* allow user to bail */
char resp;
fpurge(stdin);
printf("\nMore client request (y/anything): ");
resp = getchar();
if(resp != 'y') {
break;
}
}
/* poor person's line completion scan */
for(unsigned i=0; i<length; i++) {
if((rcvBuf[i] == '\n') || (rcvBuf[i] == '\r')) {
/* a labelled break would be nice here.... */
goto serverResp;
}
}
if (ortn == errSSLWouldBlock) {
ortn = errSecSuccess;
}
}
serverResp:
if(pause) {
doPause("Client GET msg received");
}
/* send out canned response */
length = strlen(outMsg);
ortn = SSLWrite(ctx, outMsg, length, &length);
if(ortn) {
printSslErrStr("SSLWrite", ortn);
}
if(pause) {
doPause("Server response sent");
}
cleanup:
/*
* always do close, even on error - to flush outgoing write queue
*/
OSStatus cerr = SSLClose(ctx);
if(ortn == errSecSuccess) {
ortn = cerr;
}
if(acceptSock) {
endpointShutdown(acceptSock);
}
if(ctx) {
SSLDisposeContext(ctx);
}
/* FIXME - dispose of serverCerts */
return ortn;
}
static OSStatus securetransport(ssl_test_handle * ssl)
{
OSStatus ortn;
SSLContextRef ctx = ssl->st;
SecTrustRef trust = NULL;
bool got_server_auth = false, got_client_cert_req = false;
ortn = SSLHandshake(ctx);
//fprintf(stderr, "Fell out of SSLHandshake with error: %ld\n", (long)ortn);
size_t sent, received;
const char *r=request;
size_t l=sizeof(request);
do {
ortn = SSLWrite(ctx, r, l, &sent);
if(ortn == errSSLWouldBlock) {
r+=sent;
l-=sent;
}
if (ortn == errSSLServerAuthCompleted)
{
require_string(!got_server_auth, out, "second server auth");
require_string(!got_client_cert_req, out, "got client cert req before server auth");
got_server_auth = true;
require_string(!trust, out, "Got errSSLServerAuthCompleted twice?");
/* verify peer cert chain */
require_noerr(SSLCopyPeerTrust(ctx, &trust), out);
SecTrustResultType trust_result = 0;
/* this won't verify without setting up a trusted anchor */
require_noerr(SecTrustEvaluate(trust, &trust_result), out);
}
} while(ortn == errSSLWouldBlock || ortn == errSSLServerAuthCompleted);
//fprintf(stderr, "\nHTTP Request Sent\n");
require_noerr_action_quiet(ortn, out, printf("SSLWrite failed with err %ld\n", (long)ortn));
require_string(got_server_auth, out, "never got server auth");
do {
ortn = SSLRead(ctx, reply, sizeof(reply)-1, &received);
//fprintf(stderr, "r"); usleep(1000);
} while(ortn == errSSLWouldBlock);
//fprintf(stderr, "\n");
require_noerr_action_quiet(ortn, out, printf("SSLRead failed with err %ld\n", (long)ortn));
reply[received]=0;
//fprintf(stderr, "HTTP reply:\n");
//fprintf(stderr, "%s\n",reply);
out:
SSLClose(ctx);
SSLDisposeContext(ctx);
if (trust) CFRelease(trust);
return ortn;
}
/*
* params->lock is held for us by runSession() - we use it as a semapahore by
* unlocking it when we've created a port to listen on.
* This is generally run from a thread via sslRunSession() and
* sslServerThread() in sslAppUtils.cpp.
*/
OSStatus sslAppServe(
SslAppTestParams *params)
{
otSocket listenSock = 0;
otSocket acceptSock = 0;
PeerSpec peerId;
OSStatus ortn;
SSLContextRef ctx = NULL;
SecKeychainRef serverKc = nil;
CFArrayRef serverCerts = nil;
sslThrDebug("Server", "starting");
params->negVersion = kSSLProtocolUnknown;
params->negCipher = SSL_NULL_WITH_NULL_NULL;
params->ortn = noHardwareErr;
/* set up a socket on which to listen */
for(unsigned retry=0; retry<BIND_RETRIES; retry++) {
ortn = ListenForClients(params->port, params->nonBlocking,
&listenSock);
switch(ortn) {
case errSecSuccess:
break;
case errSecOpWr:
/* port already in use - try another */
params->port++;
if(params->verbose || THREADING_DEBUG) {
printf("...retrying ListenForClients at port %d\n",
params->port);
}
break;
default:
break;
}
if(ortn != errSecOpWr) {
break;
}
}
/* let main thread know a socket is ready */
if(pthread_mutex_lock(¶ms->pthreadMutex)) {
printf("***Error acquiring server lock; aborting.\n");
return -1;
}
params->serverReady = true;
if(pthread_cond_broadcast(¶ms->pthreadCond)) {
printf("***Error waking main thread; aborting.\n");
return -1;
}
if(pthread_mutex_unlock(¶ms->pthreadMutex)) {
printf("***Error acquiring server lock; aborting.\n");
return -1;
}
if(ortn) {
printf("ListenForClients returned %d; aborting\n", (int)ortn);
return ortn;
}
/* wait for a connection */
if(params->verbose) {
printf("Waiting for client connection...");
fflush(stdout);
}
ortn = AcceptClientConnection(listenSock, &acceptSock, &peerId);
if(ortn) {
printf("AcceptClientConnection returned %d; aborting\n", (int)ortn);
return ortn;
}
/*
* Set up a SecureTransport session.
*/
ortn = SSLNewContext(true, &ctx);
if(ortn) {
printSslErrStr("SSLNewContext", ortn);
goto cleanup;
}
ortn = SSLSetIOFuncs(ctx, SocketRead, SocketWrite);
if(ortn) {
printSslErrStr("SSLSetIOFuncs", ortn);
goto cleanup;
}
ortn = SSLSetConnection(ctx, (SSLConnectionRef)acceptSock);
if(ortn) {
printSslErrStr("SSLSetConnection", ortn);
goto cleanup;
}
if(params->anchorFile) {
ortn = sslAddTrustedRoot(ctx, params->anchorFile,
params->replaceAnchors);
if(ortn) {
goto cleanup;
}
}
if(params->myCertKcName != NULL) {
/* if not, better be trying anonymous diff-hellman... :-) */
serverCerts = getSslCerts(params->myCertKcName, false, false, NULL,
&serverKc);
if(serverCerts == nil) {
exit(1);
}
if(params->password) {
ortn = SecKeychainUnlock(serverKc, strlen(params->password),
(void *)params->password, true);
if(ortn) {
printf("SecKeychainUnlock returned %d\n", (int)ortn);
/* oh well */
}
}
if(params->idIsTrustedRoot) {
/* assume this is a root we want to implicitly trust */
ortn = addIdentityAsTrustedRoot(ctx, serverCerts);
if(ortn) {
goto cleanup;
}
}
ortn = SSLSetCertificate(ctx, serverCerts);
if(ortn) {
printSslErrStr("SSLSetCertificate", ortn);
goto cleanup;
}
}
if(params->disableCertVerify) {
ortn = SSLSetEnableCertVerify(ctx, false);
if(ortn) {
printSslErrStr("SSLSetEnableCertVerify", ortn);
goto cleanup;
}
}
ortn = sslSetProtocols(ctx, params->acceptedProts, params->tryVersion);
if(ortn) {
goto cleanup;
}
if(params->resumeEnable) {
ortn = SSLSetPeerID(ctx, &peerId, sizeof(PeerSpec));
if(ortn) {
printSslErrStr("SSLSetPeerID", ortn);
goto cleanup;
}
}
if(params->ciphers != NULL) {
ortn = sslSetEnabledCiphers(ctx, params->ciphers);
if(ortn) {
goto cleanup;
}
}
if(params->authenticate != kNeverAuthenticate) {
ortn = SSLSetClientSideAuthenticate(ctx, params->authenticate);
if(ortn) {
printSslErrStr("SSLSetClientSideAuthenticate", ortn);
goto cleanup;
}
}
if(params->dhParams) {
#if JAGUAR_BUILD
printf("***Diffie-Hellman not supported in this config.\n");
#else
ortn = SSLSetDiffieHellmanParams(ctx, params->dhParams,
params->dhParamsLen);
if(ortn) {
printSslErrStr("SSLSetDiffieHellmanParams", ortn);
goto cleanup;
}
#endif
}
/* Perform SSL/TLS handshake */
do {
ortn = SSLHandshake(ctx);
if((ortn == errSSLWouldBlock) && !params->silent) {
/* keep UI responsive */
sslOutputDot();
}
} while (ortn == errSSLWouldBlock);
SSLGetClientCertificateState(ctx, ¶ms->certState);
SSLGetNegotiatedCipher(ctx, ¶ms->negCipher);
SSLGetNegotiatedProtocolVersion(ctx, ¶ms->negVersion);
if(params->verbose) {
printf("\n");
}
if(ortn) {
goto cleanup;
}
/* wait for one complete line */
char readBuf[READBUF_LEN];
size_t length;
while(ortn == errSecSuccess) {
length = READBUF_LEN;
ortn = SSLRead(ctx, readBuf, length, &length);
if (ortn == errSSLWouldBlock) {
/* keep trying */
ortn = errSecSuccess;
continue;
}
if(length == 0) {
/* keep trying */
continue;
}
/* poor person's line completion scan */
for(unsigned i=0; i<length; i++) {
if((readBuf[i] == '\n') || (readBuf[i] == '\r')) {
goto serverResp;
}
}
}
serverResp:
/* send out canned response */
ortn = SSLWrite(ctx, SERVER_MESSAGE, strlen(SERVER_MESSAGE), &length);
if(ortn) {
printSslErrStr("SSLWrite", ortn);
}
cleanup:
/*
* always do close, even on error - to flush outgoing write queue
*/
if(ctx) {
OSStatus cerr = SSLClose(ctx);
if(ortn == errSecSuccess) {
ortn = cerr;
}
}
if(acceptSock) {
while(!params->clientDone && !params->serverAbort) {
usleep(100);
}
endpointShutdown(acceptSock);
}
if(listenSock) {
endpointShutdown(listenSock);
}
if(ctx) {
SSLDisposeContext(ctx);
}
params->ortn = ortn;
sslThrDebug("Server", "done");
return ortn;
}
/* relies on SSLSetProtocolVersionEnabled */
OSStatus sslAppClient(
SslAppTestParams *params)
{
PeerSpec peerId;
otSocket sock = 0;
OSStatus ortn;
SSLContextRef ctx = NULL;
SecKeychainRef clientKc = nil;
CFArrayRef clientCerts = nil;
sslThrDebug("Client", "starting");
params->negVersion = kSSLProtocolUnknown;
params->negCipher = SSL_NULL_WITH_NULL_NULL;
params->ortn = noHardwareErr;
/* first make sure requested server is there */
ortn = MakeServerConnection(params->hostName, params->port,
params->nonBlocking, &sock, &peerId);
if(ortn) {
printf("MakeServerConnection returned %d; aborting\n", (int)ortn);
return ortn;
}
/*
* Set up a SecureTransport session.
*/
ortn = SSLNewContext(false, &ctx);
if(ortn) {
printSslErrStr("SSLNewContext", ortn);
goto cleanup;
}
ortn = SSLSetIOFuncs(ctx, SocketRead, SocketWrite);
if(ortn) {
printSslErrStr("SSLSetIOFuncs", ortn);
goto cleanup;
}
ortn = SSLSetConnection(ctx, (SSLConnectionRef)sock);
if(ortn) {
printSslErrStr("SSLSetConnection", ortn);
goto cleanup;
}
if(!params->skipHostNameCheck) {
ortn = SSLSetPeerDomainName(ctx, params->hostName,
strlen(params->hostName));
if(ortn) {
printSslErrStr("SSLSetPeerDomainName", ortn);
goto cleanup;
}
}
/* remainder of setup is optional */
if(params->anchorFile) {
ortn = sslAddTrustedRoot(ctx, params->anchorFile, params->replaceAnchors);
if(ortn) {
goto cleanup;
}
}
ortn = sslSetProtocols(ctx, params->acceptedProts, params->tryVersion);
if(ortn) {
goto cleanup;
}
if(params->resumeEnable) {
ortn = SSLSetPeerID(ctx, &peerId, sizeof(PeerSpec));
if(ortn) {
printSslErrStr("SSLSetPeerID", ortn);
goto cleanup;
}
}
if(params->disableCertVerify) {
ortn = SSLSetEnableCertVerify(ctx, false);
if(ortn) {
printSslErrStr("SSLSetEnableCertVerify", ortn);
goto cleanup;
}
}
if(params->ciphers != NULL) {
ortn = sslSetEnabledCiphers(ctx, params->ciphers);
if(ortn) {
goto cleanup;
}
}
if(params->myCertKcName) {
clientCerts = getSslCerts(params->myCertKcName, false, false, NULL, &clientKc);
if(clientCerts == nil) {
exit(1);
}
if(params->password) {
ortn = SecKeychainUnlock(clientKc, strlen(params->password),
(void *)params->password, true);
if(ortn) {
printf("SecKeychainUnlock returned %d\n", (int)ortn);
/* oh well */
}
}
if(params->idIsTrustedRoot) {
/* assume this is a root we want to implicitly trust */
ortn = addIdentityAsTrustedRoot(ctx, clientCerts);
if(ortn) {
goto cleanup;
}
}
ortn = SSLSetCertificate(ctx, clientCerts);
if(ortn) {
printSslErrStr("SSLSetCertificate", ortn);
goto cleanup;
}
}
do {
ortn = SSLHandshake(ctx);
if((ortn == errSSLWouldBlock) && !params->silent) {
/* keep UI responsive */
sslOutputDot();
}
} while (ortn == errSSLWouldBlock);
SSLGetClientCertificateState(ctx, ¶ms->certState);
SSLGetNegotiatedCipher(ctx, ¶ms->negCipher);
SSLGetNegotiatedProtocolVersion(ctx, ¶ms->negVersion);
if(ortn != errSecSuccess) {
goto cleanup;
}
/* send a GET msg */
size_t actLen;
ortn = SSLWrite(ctx, CLIENT_GETMSG, strlen(CLIENT_GETMSG), &actLen);
if(ortn) {
printSslErrStr("SSLWrite", ortn);
goto cleanup;
}
#if KEEP_CONNECTED
/*
* Consume any server data and wait for server to disconnect
*/
char readBuf[READBUF_LEN];
do {
ortn = SSLRead(ctx, readBuf, READBUF_LEN, &actLen);
} while (ortn == errSSLWouldBlock);
/* convert normal "shutdown" into zero err rtn */
if(ortn == errSSLClosedGraceful) {
ortn = errSecSuccess;
}
#endif /* KEEP_CONNECTED */
cleanup:
if(ctx) {
OSStatus cerr = SSLClose(ctx);
if(ortn == errSecSuccess) {
ortn = cerr;
}
}
if(sock) {
endpointShutdown(sock);
}
if(ctx) {
SSLDisposeContext(ctx);
}
params->ortn = ortn;
sslThrDebug("Client", "done");
return ortn;
}