ssl_connection.cpp

Go to the documentation of this file.

/*
**  ClanLib SDK
**  Copyright (c) 1997-2005 The ClanLib Team
**
**  This software is provided 'as-is', without any express or implied
**  warranty.  In no event will the authors be held liable for any damages
**  arising from the use of this software.
**
**  Permission is granted to anyone to use this software for any purpose,
**  including commercial applications, and to alter it and redistribute it
**  freely, subject to the following restrictions:
**
**  1. The origin of this software must not be misrepresented; you must not
**     claim that you wrote the original software. If you use this software
**     in a product, an acknowledgment in the product documentation would be
**     appreciated but is not required.
**  2. Altered source versions must be plainly marked as such, and must not be
**     misrepresented as being the original software.
**  3. This notice may not be removed or altered from any source distribution.
**
**  Note: Some of the libraries ClanLib link to may have additional
**  requirements or restrictions.
**
**  File Author(s):
**
**    Magnus Norddahl
*/

#include "precomp.h"
#include "ssl_connection.h"
#include "tcp_connection.h"
#include "exception.h"
#include "logger.h"
#include <prerr.h>

// CL_SSLConnection Construction:

CL_SSLConnection::CL_SSLConnection(CL_TCPConnection *connection, CL_PK11PasswordHandler *handler)
: ssl_fd(0), connection(connection), password_handler(handler)
{
        SECStatus result;
        PRFileDesc *model_fd = 0;
        PRFileDesc *socket_fd = create_prfd();
        PRFileDesc *ssl_fd = SSL_ImportFD(model_fd, socket_fd);
        if (ssl_fd == 0)
                throw CL_Exception(TEXT("Unable to import socket fd into a ssl fd"));
        // PRStatus status = PR_SetSocketOption(ssl_fd, option_data);
        // SECStatus result = SSL_OptionSet(ssl_fd, option, on);
        // if (result != SECSuccess)
        //      throw CL_Exception(TEXT("SSL_OptionSet failed!"));
                
        // Server:
        CERTCertificate *cert;
        SECKEYPrivateKey *key;
        SSLKEAType kea_type = kt_rsa;
        result = SSL_ConfigSecureServer(ssl_fd, cert, key, kea_type);
        if (result != SECSuccess)
                throw CL_Exception(TEXT("SSL_ConfigSecureServer failed!"));
        
        // Client:
//      int res = SSL_SetURL(ssl_fd, hostname);
//      if (res == -1)
//              throw CL_Exception(TEXT("SSL_SetURL failed!"));

        // Client and server:
        int res = SSL_SetPKCS11PinArg(ssl_fd, password_handler);
        if (res == -1)
                throw CL_Exception(TEXT("SSL_SetPKCS11PinArg failed!"));
                
        result = SSL_AuthCertificateHook(ssl_fd, &CL_SSLConnection::auth_certificate, this);
        if (result != SECSuccess)
                throw CL_Exception(TEXT("SSL_AuthCertificateHook failed!"));
                
        result = SSL_BadCertHook(ssl_fd, &CL_SSLConnection::bad_certificate, this);
        if (result != SECSuccess)
                throw CL_Exception(TEXT("SSL_BadCertHook failed!"));
        
        result = SSL_GetClientAuthDataHook(ssl_fd, &CL_SSLConnection::get_client_auth_data, this);
        if (result != SECSuccess)
                throw CL_Exception(TEXT("SSL_GetClientAuthDataHook failed!"));
                
        result = SSL_HandshakeCallback(ssl_fd, &CL_SSLConnection::handshake_completed, this);
        if (result != SECSuccess)
                throw CL_Exception(TEXT("SSL_HandshakeCallback failed!"));

//      result = SSL_CipherPrefSet(ssl_fd, cipher, enabled);
//      if (result != SECSuccess)
//              throw CL_Exception(TEXT("SSL_CipherPrefSet failed!"));


        int as_server = 1;
        result = SSL_ResetHandshake(ssl_fd, as_server);
        if (result != SECSuccess)
                throw CL_Exception(TEXT("SSL_ResetHandshake failed!"));
}
        
CL_SSLConnection::~CL_SSLConnection()
{
        PR_Close(ssl_fd);
}

// CL_SSLConnection Attributes:

// CL_SSLConnection Operations:

// CL_SSLConnection Implementation:

PRIOMethods CL_SSLConnection::methods =
{
        PR_DESC_SOCKET_TCP,
        &CL_SSLConnection::prfd_close,
        &CL_SSLConnection::prfd_read,
        &CL_SSLConnection::prfd_write,
        &CL_SSLConnection::prfd_available,
        &CL_SSLConnection::prfd_available64,
        &CL_SSLConnection::prfd_fsync,
        &CL_SSLConnection::prfd_seek,
        &CL_SSLConnection::prfd_seek64,
        &CL_SSLConnection::prfd_file_info,
        &CL_SSLConnection::prfd_file_info64,
        &CL_SSLConnection::prfd_writev,
        &CL_SSLConnection::prfd_connect,
        &CL_SSLConnection::prfd_accept,
        &CL_SSLConnection::prfd_bind,
        &CL_SSLConnection::prfd_listen,
        &CL_SSLConnection::prfd_shutdown,
        &CL_SSLConnection::prfd_recv,
        &CL_SSLConnection::prfd_send,
        &CL_SSLConnection::prfd_recvfrom,
        &CL_SSLConnection::prfd_sendto,
        &CL_SSLConnection::prfd_poll,
        &CL_SSLConnection::prfd_acceptread,
        &CL_SSLConnection::prfd_transmitfile,
        &CL_SSLConnection::prfd_getsockname,
        &CL_SSLConnection::prfd_getpeername,
        &CL_SSLConnection::prfd_reserved, // reserved_fn_6
        &CL_SSLConnection::prfd_reserved, // reserved_fn_5
        &CL_SSLConnection::prfd_getsockopt,
        &CL_SSLConnection::prfd_setsockopt,
        &CL_SSLConnection::prfd_sendfile,
        &CL_SSLConnection::prfd_connectcontinue,
        &CL_SSLConnection::prfd_reserved, // reserved_fn_3
        &CL_SSLConnection::prfd_reserved, // reserved_fn_2
        &CL_SSLConnection::prfd_reserved, // reserved_fn_1
        &CL_SSLConnection::prfd_reserved  // reserved_fn_0
};

PRFileDesc *CL_SSLConnection::create_prfd()
{
/*
        PRFileDesc *fd = (PRFileDesc *) PR_Malloc(sizeof(PRFileDesc));
        if (fd == 0)
                throw CL_Exception(TEXT("Unable to allocate memory for a PRFileDesc structure"));
        memset(fd, 0, sizeof(PRFileDesc));
        fd->methods = methods;
        fd->secret = (PRFilePrivate *) this;
        fd->dtor = &CL_SSLConnection::prfd_dtor;
        fd->identity = 0;
*/
        PRFileDesc *fd = PR_CreateIOLayerStub(0, &methods);
        if (fd == 0)
                throw CL_Exception(TEXT("Unable to allocate memory for a PRFileDesc structure"));
        fd->secret = (PRFilePrivate *) this;
        return fd;
}

SECStatus CL_SSLConnection::auth_certificate(void *arg, PRFileDesc *ssl_fd, PRBool check_sig, PRBool is_server)
{
        CL_SSLConnection *self = (CL_SSLConnection *) arg;
        return SSL_AuthCertificate(CERT_GetDefaultCertDB(), ssl_fd, check_sig, is_server);
}

SECStatus CL_SSLConnection::bad_certificate(void *arg, PRFileDesc *ssl_fd)
{
        CL_SSLConnection *self = (CL_SSLConnection *) arg;
        return SECSuccess;
}

SECStatus CL_SSLConnection::get_client_auth_data(
        void *arg,
        PRFileDesc *ssl_fd,
        CERTDistNames *ca_names,
        CERTCertificate **out_return_cert,
        SECKEYPrivateKey **out_return_key)
{
        CL_SSLConnection *self = (CL_SSLConnection *) arg;
        return NSS_GetClientAuthData(0, ssl_fd, ca_names, out_return_cert, out_return_key);
}

void CL_SSLConnection::handshake_completed(PRFileDesc *ssl_fd, void *arg)
{
        CL_SSLConnection *self = (CL_SSLConnection *) arg;
}

void CL_SSLConnection::prfd_dtor(PRFileDesc *fd)
{
}

PRStatus CL_SSLConnection::prfd_close(PRFileDesc *fd)
{
        cl_log_event("ssl", "prfd_close called");
        return PR_SUCCESS;
}

PRInt32 CL_SSLConnection::prfd_read(PRFileDesc *fd, void *buf, PRInt32 amount)
{
        cl_log_event("ssl", "prfd_read called (%1)", amount);
        return -1;
}

PRInt32 CL_SSLConnection::prfd_write(PRFileDesc *fd, const void *buf, PRInt32 amount)
{
        cl_log_event("ssl", "prfd_write called (%1)", amount);
        return -1;
}

PRInt32 CL_SSLConnection::prfd_available(PRFileDesc *fd)
{
        cl_log_event("ssl", "prfd_available called");
        return -1;
}

PRInt64 CL_SSLConnection::prfd_available64(PRFileDesc *fd)
{
        cl_log_event("ssl", "prfd_available64 called");
        return -1;
}

PRStatus CL_SSLConnection::prfd_fsync(PRFileDesc *fd)
{
        cl_log_event("ssl", "prfd_fsync called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRInt32 CL_SSLConnection::prfd_seek(PRFileDesc *fd, PRInt32 offset, PRSeekWhence whence)
{
        cl_log_event("ssl", "prfd_seek called");
        return -1;
}

PRInt64 CL_SSLConnection::prfd_seek64(PRFileDesc *fd, PRInt64 offset, PRSeekWhence whence)
{
        cl_log_event("ssl", "prfd_seek64 called");
        return -1;
}

PRStatus CL_SSLConnection::prfd_file_info(PRFileDesc *fd, PRFileInfo *info)
{
        cl_log_event("ssl", "prfd_file_info called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRStatus CL_SSLConnection::prfd_file_info64(PRFileDesc *fd, PRFileInfo64 *info64)
{
        cl_log_event("ssl", "prfd_file_info64 called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRInt32 CL_SSLConnection::prfd_writev(PRFileDesc *fd, const PRIOVec *iov, PRInt32 size, PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_writev called (%1)", size);
        return -1;
}

PRStatus CL_SSLConnection::prfd_connect(PRFileDesc *fd, const PRNetAddr *addr, PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_connect called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRFileDesc *CL_SSLConnection::prfd_accept(PRFileDesc *fd, PRNetAddr *addr, PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_accept called");
        return 0;
}

PRStatus CL_SSLConnection::prfd_bind(PRFileDesc *fd, const PRNetAddr *addr)
{
        cl_log_event("ssl", "prfd_bind called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRStatus CL_SSLConnection::prfd_listen(PRFileDesc *fd, PRIntn backlog)
{
        cl_log_event("ssl", "prfd_listen called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRStatus CL_SSLConnection::prfd_shutdown(PRFileDesc *fd, /*PRShutdownHow*/ PRIntn how)
{
        cl_log_event("ssl", "prfd_shutdown called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRInt32 CL_SSLConnection::prfd_recv(
        PRFileDesc *fd,
        void *buf,
        PRInt32 amount,
        PRIntn flags,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_recv called");
        return -1;
}

PRInt32 CL_SSLConnection::prfd_send(
        PRFileDesc *fd,
        const void *buf,
        PRInt32 amount,
        PRIntn flags,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_send called");
        return -1;
}

PRInt32 CL_SSLConnection::prfd_recvfrom(
        PRFileDesc *fd,
        void *buf,
        PRInt32 amount,
        PRIntn flags,
        PRNetAddr *addr,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_recvfrom called");
        return -1;
}
        
PRInt32 CL_SSLConnection::prfd_sendto(
        PRFileDesc *fd,
        const void *buf,
        PRInt32 amount,
        PRIntn flags,
        const PRNetAddr *addr,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_sendto called");
        return -1;
}

PRInt16 CL_SSLConnection::prfd_poll(PRFileDesc *fd, PRInt16 in_flags, PRInt16 *out_flags)
{
        cl_log_event("ssl", "prfd_poll called (%1)", in_flags);
        return -1;
}

PRInt32 CL_SSLConnection::prfd_acceptread(
        PRFileDesc *listen_sock,
        PRFileDesc **accepted_sock,
        PRNetAddr **peer_addr,
        void *buf,
        PRInt32 amount,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_acceptread called");
        return -1;
}
        
PRInt32 CL_SSLConnection::prfd_transmitfile(
        PRFileDesc *network_socket,
        PRFileDesc *source_file,
        const void *headers,
        PRInt32 hlen,
        PRTransmitFileFlags flags,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_transmitfile called");
        return -1;
}

PRStatus CL_SSLConnection::prfd_getsockname(PRFileDesc *fd, PRNetAddr *addr)
{
        cl_log_event("ssl", "prfd_getsockname called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}
        
PRStatus CL_SSLConnection::prfd_getpeername(PRFileDesc *fd, PRNetAddr *addr)
{
        cl_log_event("ssl", "prfd_getpeername called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRStatus CL_SSLConnection::prfd_getsockopt(PRFileDesc *fd, PRSocketOptionData *data)
{
        cl_log_event("ssl", "prfd_getsockopt called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRStatus CL_SSLConnection::prfd_setsockopt(PRFileDesc *fd, const PRSocketOptionData *data)
{
        cl_log_event("ssl", "prfd_setsockopt called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRInt32 CL_SSLConnection::prfd_sendfile(
        PRFileDesc *network_socket,
        PRSendFileData *send_data,
        PRTransmitFileFlags flags,
        PRIntervalTime timeout)
{
        cl_log_event("ssl", "prfd_sendfile called");
        return -1;
}

PRStatus CL_SSLConnection::prfd_connectcontinue(PRFileDesc *fd, PRInt16 out_flags)
{
        cl_log_event("ssl", "prfd_connectcontinue called");
        return (PRStatus) PR_INVALID_METHOD_ERROR;
}

PRIntn CL_SSLConnection::prfd_reserved(PRFileDesc *fd)
{
        cl_log_event("ssl", "prfd_reserved called");
        return -1;
}

---