2 ashd - A Sane HTTP Daemon
3 Copyright (C) 2008 Fredrik Tolf <fredrik@dolda2000.com>
5 This program is free software: you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation, either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include <sys/socket.h>
24 #include <netinet/in.h>
25 #include <arpa/inet.h>
41 #include <gnutls/gnutls.h>
42 #include <gnutls/x509.h>
46 gnutls_certificate_credentials_t creds;
50 struct namedcreds **b;
57 gnutls_certificate_credentials_t creds;
58 struct namedcreds **ncreds;
64 struct sockaddr_storage name;
65 gnutls_session_t sess;
69 static gnutls_dh_params_t dhparams;
71 static int tlsblock(int fd, gnutls_session_t sess, time_t to)
73 if(gnutls_record_get_direction(sess))
74 return(block(fd, EV_WRITE, to));
76 return(block(fd, EV_READ, to));
79 static ssize_t sslread(void *cookie, char *buf, size_t len)
81 struct sslconn *ssl = cookie;
85 while(ssl->in.d == 0) {
86 sizebuf(ssl->in, ssl->in.d + 1024);
87 ret = gnutls_record_recv(ssl->sess, ssl->in.b + ssl->in.d, ssl->in.s - ssl->in.d);
88 if((ret == GNUTLS_E_INTERRUPTED) || (ret == GNUTLS_E_AGAIN)) {
89 if(tlsblock(ssl->fd, ssl->sess, 60) == 0) {
102 xf = min(ssl->in.d, len);
103 memcpy(buf, ssl->in.b, xf);
104 memmove(ssl->in.b, ssl->in.b + xf, ssl->in.d -= xf);
108 static ssize_t sslwrite(void *cookie, const char *buf, size_t len)
110 struct sslconn *ssl = cookie;
116 ret = gnutls_record_send(ssl->sess, buf + off, len - off);
117 if((ret == GNUTLS_E_INTERRUPTED) || (ret == GNUTLS_E_AGAIN)) {
118 if(tlsblock(ssl->fd, ssl->sess, 60) == 0) {
138 static int sslclose(void *cookie)
143 static cookie_io_functions_t iofuns = {
149 static int initreq(struct conn *conn, struct hthead *req)
151 struct sslconn *ssl = conn->pdata;
152 struct sockaddr_storage sa;
156 headappheader(req, "X-Ash-Address", formathaddress((struct sockaddr *)&ssl->name, sizeof(sa)));
157 if(ssl->name.ss_family == AF_INET) {
158 headappheader(req, "X-Ash-Address", inet_ntop(AF_INET, &((struct sockaddr_in *)&ssl->name)->sin_addr, nmbuf, sizeof(nmbuf)));
159 headappheader(req, "X-Ash-Port", sprintf3("%i", ntohs(((struct sockaddr_in *)&ssl->name)->sin_port)));
160 } else if(ssl->name.ss_family == AF_INET6) {
161 headappheader(req, "X-Ash-Address", inet_ntop(AF_INET6, &((struct sockaddr_in6 *)&ssl->name)->sin6_addr, nmbuf, sizeof(nmbuf)));
162 headappheader(req, "X-Ash-Port", sprintf3("%i", ntohs(((struct sockaddr_in6 *)&ssl->name)->sin6_port)));
165 if(!getsockname(ssl->fd, (struct sockaddr *)&sa, &salen))
166 headappheader(req, "X-Ash-Server-Address", formathaddress((struct sockaddr *)&sa, sizeof(sa)));
167 headappheader(req, "X-Ash-Server-Port", sprintf3("%i", ssl->port->sport));
168 headappheader(req, "X-Ash-Protocol", "https");
172 static void servessl(struct muth *muth, va_list args)
175 vavar(struct sockaddr_storage, name);
176 vavar(struct sslport *, pd);
179 gnutls_session_t sess;
183 int setcreds(gnutls_session_t sess)
191 namlen = sizeof(nambuf);
192 if(gnutls_server_name_get(sess, nambuf, &namlen, &ntype, i) != 0)
194 if(ntype != GNUTLS_NAME_DNS)
196 for(o = 0; pd->ncreds[o] != NULL; o++) {
197 for(u = 0; pd->ncreds[o]->names[u] != NULL; u++) {
198 if(!strcmp(pd->ncreds[o]->names[u], nambuf)) {
199 gnutls_credentials_set(sess, GNUTLS_CRD_CERTIFICATE, pd->ncreds[o]->creds);
200 gnutls_certificate_server_set_request(sess, GNUTLS_CERT_REQUEST);
206 gnutls_credentials_set(sess, GNUTLS_CRD_CERTIFICATE, pd->creds);
207 gnutls_certificate_server_set_request(sess, GNUTLS_CERT_REQUEST);
211 fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK);
212 gnutls_init(&sess, GNUTLS_SERVER);
213 gnutls_set_default_priority(sess);
214 gnutls_handshake_set_post_client_hello_function(sess, setcreds);
215 gnutls_transport_set_ptr(sess, (gnutls_transport_ptr_t)(intptr_t)fd);
216 while((ret = gnutls_handshake(sess)) != 0) {
217 if((ret != GNUTLS_E_INTERRUPTED) && (ret != GNUTLS_E_AGAIN))
219 if(tlsblock(fd, sess, 60) <= 0)
222 memset(&conn, 0, sizeof(conn));
223 memset(&ssl, 0, sizeof(ssl));
225 conn.initreq = initreq;
231 in = fopencookie(&ssl, "r+", iofuns);
239 static void listenloop(struct muth *muth, va_list args)
241 vavar(struct sslport *, pd);
243 struct sockaddr_storage name;
247 namelen = sizeof(name);
248 block(pd->fd, EV_READ, 0);
249 ns = accept(pd->fd, (struct sockaddr *)&name, &namelen);
251 flog(LOG_ERR, "accept: %s", strerror(errno));
254 mustart(servessl, ns, name, pd);
262 static void init(void)
264 static int inited = 0;
270 if((ret = gnutls_global_init()) != 0) {
271 flog(LOG_ERR, "could not initialize GnuTLS: %s", gnutls_strerror(ret));
274 if(((ret = gnutls_dh_params_init(&dhparams)) != 0) ||
275 ((ret = gnutls_dh_params_generate2(dhparams, 2048)) != 0)) {
276 flog(LOG_ERR, "GnuTLS could not generate Diffie-Hellman parameters: %s", gnutls_strerror(ret));
281 static struct namedcreds *readncreds(char *file)
284 struct namedcreds *nc;
285 gnutls_x509_crt_t crt;
286 gnutls_x509_privkey_t key;
290 struct charbuf keybuf;
291 struct charvbuf names;
296 if((fd = open(file, O_RDONLY)) < 0) {
297 flog(LOG_ERR, "ssl: %s: %s", file, strerror(errno));
301 sizebuf(keybuf, keybuf.d + 1024);
302 ret = read(fd, keybuf.b + keybuf.d, keybuf.s - keybuf.d);
304 flog(LOG_ERR, "ssl: reading from %s: %s", file, strerror(errno));
306 } else if(ret == 0) {
312 d.data = (unsigned char *)keybuf.b;
314 gnutls_x509_crt_init(&crt);
315 if((ret = gnutls_x509_crt_import(crt, &d, GNUTLS_X509_FMT_PEM)) != 0) {
316 flog(LOG_ERR, "ssl: could not load certificate from %s: %s", file, gnutls_strerror(ret));
319 cnl = sizeof(cn) - 1;
320 if((ret = gnutls_x509_crt_get_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0, 0, cn, &cnl)) != 0) {
321 flog(LOG_ERR, "ssl: could not read common name from %s: %s", file, gnutls_strerror(ret));
325 bufadd(names, sstrdup(cn));
327 cnl = sizeof(cn) - 1;
328 if(gnutls_x509_crt_get_subject_alt_name2(crt, i, cn, &cnl, &type, NULL) < 0)
331 if(type == GNUTLS_SAN_DNSNAME)
332 bufadd(names, sstrdup(cn));
334 gnutls_x509_privkey_init(&key);
335 if((ret = gnutls_x509_privkey_import(key, &d, GNUTLS_X509_FMT_PEM)) != 0) {
336 flog(LOG_ERR, "ssl: could not load key from %s: %s", file, gnutls_strerror(ret));
343 gnutls_certificate_allocate_credentials(&nc->creds);
344 if((ret = gnutls_certificate_set_x509_key(nc->creds, &crt, 1, key)) != 0) {
345 flog(LOG_ERR, "ssl: could not use certificate from %s: %s", file, gnutls_strerror(ret));
348 gnutls_certificate_set_dh_params(nc->creds, dhparams);
352 void handlegnussl(int argc, char **argp, char **argv)
354 int i, ret, port, fd;
355 gnutls_certificate_credentials_t creds;
356 struct ncredbuf ncreds;
358 char *crtfile, *keyfile;
363 gnutls_certificate_allocate_credentials(&creds);
364 keyfile = crtfile = NULL;
365 for(i = 0; i < argc; i++) {
366 if(!strcmp(argp[i], "help")) {
367 printf("ssl handler parameters:\n");
368 printf("\tcert=CERT-FILE [mandatory]\n");
369 printf("\t\tThe name of the file to read the certificate from.\n");
370 printf("\tkey=KEY-FILE [same as CERT-FILE]\n");
371 printf("\t\tThe name of the file to read the private key from.\n");
372 printf("\ttrust=CA-FILE [no default]\n");
373 printf("\t\tThe name of a file to read trusted certificates from.\n");
374 printf("\t\tMay be given multiple times.\n");
375 printf("\tcrl=CRL-FILE [no default]\n");
376 printf("\t\tThe name of a file to read revocation lists from.\n");
377 printf("\t\tMay be given multiple times.\n");
378 printf("\tport=PORT [443]\n");
379 printf("\t\tThe TCP port to listen on.\n");
381 printf("\tAll X.509 data files must be PEM-encoded.\n");
382 printf("\tSee the manpage for information on specifying multiple\n\tcertificates to support SNI operation.\n");
384 } else if(!strcmp(argp[i], "cert")) {
386 } else if(!strcmp(argp[i], "key")) {
388 } else if(!strcmp(argp[i], "trust")) {
389 if((ret = gnutls_certificate_set_x509_trust_file(creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
390 flog(LOG_ERR, "ssl: could not load trust file `%s': %s", argv[i], gnutls_strerror(ret));
393 for(i = 0; i < ncreds.d; i++) {
394 if((ret = gnutls_certificate_set_x509_trust_file(ncreds.b[i]->creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
395 flog(LOG_ERR, "ssl: could not load trust file `%s': %s", argv[i], gnutls_strerror(ret));
399 } else if(!strcmp(argp[i], "crl")) {
400 if((ret = gnutls_certificate_set_x509_crl_file(creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
401 flog(LOG_ERR, "ssl: could not load CRL file `%s': %s", argv[i], gnutls_strerror(ret));
404 for(i = 0; i < ncreds.d; i++) {
405 if((ret = gnutls_certificate_set_x509_crl_file(ncreds.b[i]->creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
406 flog(LOG_ERR, "ssl: could not load CRL file `%s': %s", argv[i], gnutls_strerror(ret));
410 } else if(!strcmp(argp[i], "port")) {
411 port = atoi(argv[i]);
412 } else if(!strcmp(argp[i], "ncert")) {
413 bufadd(ncreds, readncreds(argv[i]));
415 flog(LOG_ERR, "unknown parameter `%s' to ssl handler", argp[i]);
419 if(crtfile == NULL) {
420 flog(LOG_ERR, "ssl: needs certificate file at the very least");
425 if((ret = gnutls_certificate_set_x509_key_file(creds, crtfile, keyfile, GNUTLS_X509_FMT_PEM)) != 0) {
426 flog(LOG_ERR, "ssl: could not load certificate or key: %s", gnutls_strerror(ret));
429 gnutls_certificate_set_dh_params(creds, dhparams);
430 if((fd = listensock6(port)) < 0) {
431 flog(LOG_ERR, "could not listen on IPv6 port (port %i): %s", port, strerror(errno));
434 bufadd(ncreds, NULL);
439 pd->ncreds = ncreds.b;
440 mustart(listenloop, pd);
441 if((fd = listensock6(port)) < 0) {
442 if(errno != EADDRINUSE) {
443 flog(LOG_ERR, "could not listen on IPv6 port (port %i): %s", port, strerror(errno));
451 mustart(listenloop, pd);