2 ashd - A Sane HTTP Daemon
3 Copyright (C) 2008 Fredrik Tolf <fredrik@dolda2000.com>
5 This program is free software: you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation, either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include <sys/socket.h>
25 #include <netinet/in.h>
26 #include <arpa/inet.h>
42 #include <gnutls/gnutls.h>
43 #include <gnutls/x509.h>
47 gnutls_certificate_credentials_t creds;
51 struct namedcreds **b;
58 gnutls_certificate_credentials_t creds;
59 gnutls_priority_t ciphers;
60 struct namedcreds **ncreds;
66 struct sockaddr_storage name;
67 gnutls_session_t sess;
72 struct savedsess *next, *prev;
73 gnutls_datum_t key, value;
76 static int numconn = 0, numsess = 0;
77 static struct btree *sessidx = NULL;
78 static struct savedsess *sesslistf = NULL, *sesslistl = NULL;
80 static int sesscmp(void *ap, void *bp)
82 struct savedsess *a = ap, *b = bp;
84 if(a->key.size != b->key.size)
85 return(a->key.size - b->key.size);
86 return(memcmp(a->key.data, b->key.data, a->key.size));
89 static gnutls_datum_t sessdbfetch(void *uudata, gnutls_datum_t key)
91 struct savedsess *sess, lkey;
94 memset(&ret, 0, sizeof(ret));
96 if((sess = btreeget(sessidx, &lkey, sesscmp)) == NULL)
98 ret.data = memcpy(gnutls_malloc(ret.size = sess->value.size), sess->value.data, sess->value.size);
102 static void freesess(struct savedsess *sess)
104 bbtreedel(&sessidx, sess, sesscmp);
106 sess->next->prev = sess->prev;
108 sess->prev->next = sess->next;
109 if(sess == sesslistf)
110 sesslistf = sess->next;
111 if(sess == sesslistl)
112 sesslistl = sess->prev;
113 free(sess->key.data);
114 free(sess->value.data);
119 static int sessdbdel(void *uudata, gnutls_datum_t key)
121 struct savedsess *sess, lkey;
124 if((sess = btreeget(sessidx, &lkey, sesscmp)) == NULL)
130 static void cleansess(void)
132 while(numsess > (max(numconn, 1) * 100))
136 static int sessdbstore(void *uudata, gnutls_datum_t key, gnutls_datum_t value)
139 struct savedsess *sess, lkey;
141 if((value.data == NULL) || (value.size == 0)) {
142 sessdbdel(NULL, key);
146 if((sess = btreeget(sessidx, &lkey, sesscmp)) == NULL) {
148 sess->key.data = memcpy(smalloc(sess->key.size = key.size), key.data, key.size);
149 sess->value.data = memcpy(smalloc(sess->value.size = value.size), value.data, value.size);
150 bbtreeput(&sessidx, sess, sesscmp);
152 sess->next = sesslistf;
154 sesslistf->prev = sess;
156 if(sesslistl == NULL)
160 free(sess->value.data);
161 sess->value.data = memcpy(smalloc(sess->value.size = value.size), value.data, value.size);
162 if(sess != sesslistf) {
164 sess->next->prev = sess->prev;
166 sess->prev->next = sess->next;
167 if(sess == sesslistl)
168 sesslistl = sess->prev;
170 sess->next = sesslistf;
172 sesslistf->prev = sess;
183 static int tlsblock(int fd, gnutls_session_t sess, time_t to)
185 if(gnutls_record_get_direction(sess))
186 return(block(fd, EV_WRITE, to));
188 return(block(fd, EV_READ, to));
191 static ssize_t sslread(void *cookie, char *buf, size_t len)
193 struct sslconn *ssl = cookie;
197 while(ssl->in.d == 0) {
198 sizebuf(ssl->in, ssl->in.d + 1024);
199 ret = gnutls_record_recv(ssl->sess, ssl->in.b + ssl->in.d, ssl->in.s - ssl->in.d);
200 if((ret == GNUTLS_E_INTERRUPTED) || (ret == GNUTLS_E_AGAIN)) {
201 if(tlsblock(ssl->fd, ssl->sess, 60) == 0) {
208 } else if(ret == 0) {
214 xf = min(ssl->in.d, len);
215 memcpy(buf, ssl->in.b, xf);
216 memmove(ssl->in.b, ssl->in.b + xf, ssl->in.d -= xf);
220 static ssize_t sslwrite(void *cookie, const char *buf, size_t len)
222 struct sslconn *ssl = cookie;
228 ret = gnutls_record_send(ssl->sess, buf + off, len - off);
229 if((ret == GNUTLS_E_INTERRUPTED) || (ret == GNUTLS_E_AGAIN)) {
230 if(tlsblock(ssl->fd, ssl->sess, 60) == 0) {
250 static int sslclose(void *cookie)
252 struct sslconn *ssl = cookie;
258 static cookie_io_functions_t iofuns = {
264 static int initreq(struct conn *conn, struct hthead *req)
266 struct sslconn *ssl = conn->pdata;
267 struct sockaddr_storage sa;
271 headappheader(req, "X-Ash-Address", formathaddress((struct sockaddr *)&ssl->name, sizeof(sa)));
272 if(ssl->name.ss_family == AF_INET) {
273 headappheader(req, "X-Ash-Address", inet_ntop(AF_INET, &((struct sockaddr_in *)&ssl->name)->sin_addr, nmbuf, sizeof(nmbuf)));
274 headappheader(req, "X-Ash-Port", sprintf3("%i", ntohs(((struct sockaddr_in *)&ssl->name)->sin_port)));
275 } else if(ssl->name.ss_family == AF_INET6) {
276 headappheader(req, "X-Ash-Address", inet_ntop(AF_INET6, &((struct sockaddr_in6 *)&ssl->name)->sin6_addr, nmbuf, sizeof(nmbuf)));
277 headappheader(req, "X-Ash-Port", sprintf3("%i", ntohs(((struct sockaddr_in6 *)&ssl->name)->sin6_port)));
280 if(!getsockname(ssl->fd, (struct sockaddr *)&sa, &salen))
281 headappheader(req, "X-Ash-Server-Address", formathaddress((struct sockaddr *)&sa, sizeof(sa)));
282 headappheader(req, "X-Ash-Server-Port", sprintf3("%i", ssl->port->sport));
283 headappheader(req, "X-Ash-Protocol", "https");
287 static void servessl(struct muth *muth, va_list args)
290 vavar(struct sockaddr_storage, name);
291 vavar(struct sslport *, pd);
294 gnutls_session_t sess;
298 int setcreds(gnutls_session_t sess)
306 namlen = sizeof(nambuf);
307 if(gnutls_server_name_get(sess, nambuf, &namlen, &ntype, i) != 0)
309 if(ntype != GNUTLS_NAME_DNS)
311 for(o = 0; pd->ncreds[o] != NULL; o++) {
312 for(u = 0; pd->ncreds[o]->names[u] != NULL; u++) {
313 if(!strcmp(pd->ncreds[o]->names[u], nambuf)) {
314 gnutls_credentials_set(sess, GNUTLS_CRD_CERTIFICATE, pd->ncreds[o]->creds);
315 gnutls_certificate_server_set_request(sess, GNUTLS_CERT_REQUEST);
321 gnutls_credentials_set(sess, GNUTLS_CRD_CERTIFICATE, pd->creds);
322 gnutls_certificate_server_set_request(sess, GNUTLS_CERT_REQUEST);
327 fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK);
328 gnutls_init(&sess, GNUTLS_SERVER);
329 gnutls_priority_set(sess, pd->ciphers);
330 gnutls_db_set_retrieve_function(sess, sessdbfetch);
331 gnutls_db_set_store_function(sess, sessdbstore);
332 gnutls_db_set_remove_function(sess, sessdbdel);
333 gnutls_db_set_ptr(sess, NULL);
334 gnutls_handshake_set_post_client_hello_function(sess, setcreds);
335 gnutls_transport_set_ptr(sess, (gnutls_transport_ptr_t)(intptr_t)fd);
336 while((ret = gnutls_handshake(sess)) != 0) {
337 if((ret != GNUTLS_E_INTERRUPTED) && (ret != GNUTLS_E_AGAIN))
339 if(tlsblock(fd, sess, 60) <= 0)
342 memset(&conn, 0, sizeof(conn));
343 memset(&ssl, 0, sizeof(ssl));
345 conn.initreq = initreq;
351 in = fopencookie(&ssl, "r+", iofuns);
360 static void listenloop(struct muth *muth, va_list args)
362 vavar(struct sslport *, pd);
364 struct sockaddr_storage name;
367 fcntl(pd->fd, F_SETFL, fcntl(pd->fd, F_GETFL) | O_NONBLOCK);
369 namelen = sizeof(name);
370 if(block(pd->fd, EV_READ, 0) == 0)
374 ns = accept(pd->fd, (struct sockaddr *)&name, &namelen);
378 flog(LOG_ERR, "accept: %s", strerror(errno));
381 mustart(servessl, ns, name, pd);
390 for(i = 0; i < listeners.d; i++) {
391 if(listeners.b[i] == muth)
392 bufdel(listeners, i);
396 static gnutls_dh_params_t dhparams(void)
398 static int inited = 0;
399 static gnutls_dh_params_t pars;
403 if(((ret = gnutls_dh_params_init(&pars)) != 0) ||
404 ((ret = gnutls_dh_params_generate2(pars, 2048)) != 0)) {
405 flog(LOG_ERR, "GnuTLS could not generate Diffie-Hellman parameters: %s", gnutls_strerror(ret));
413 static void init(void)
415 static int inited = 0;
421 if((ret = gnutls_global_init()) != 0) {
422 flog(LOG_ERR, "could not initialize GnuTLS: %s", gnutls_strerror(ret));
427 static struct namedcreds *readncreds(char *file)
430 struct namedcreds *nc;
431 gnutls_x509_crt_t crt;
432 gnutls_x509_privkey_t key;
436 struct charbuf keybuf;
437 struct charvbuf names;
442 if((fd = open(file, O_RDONLY)) < 0) {
443 flog(LOG_ERR, "ssl: %s: %s", file, strerror(errno));
447 sizebuf(keybuf, keybuf.d + 1024);
448 ret = read(fd, keybuf.b + keybuf.d, keybuf.s - keybuf.d);
450 flog(LOG_ERR, "ssl: reading from %s: %s", file, strerror(errno));
452 } else if(ret == 0) {
458 d.data = (unsigned char *)keybuf.b;
460 gnutls_x509_crt_init(&crt);
461 if((ret = gnutls_x509_crt_import(crt, &d, GNUTLS_X509_FMT_PEM)) != 0) {
462 flog(LOG_ERR, "ssl: could not load certificate from %s: %s", file, gnutls_strerror(ret));
465 cnl = sizeof(cn) - 1;
466 if((ret = gnutls_x509_crt_get_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0, 0, cn, &cnl)) != 0) {
467 flog(LOG_ERR, "ssl: could not read common name from %s: %s", file, gnutls_strerror(ret));
471 bufadd(names, sstrdup(cn));
473 cnl = sizeof(cn) - 1;
474 if(gnutls_x509_crt_get_subject_alt_name2(crt, i, cn, &cnl, &type, NULL) < 0)
477 if(type == GNUTLS_SAN_DNSNAME)
478 bufadd(names, sstrdup(cn));
480 gnutls_x509_privkey_init(&key);
481 if((ret = gnutls_x509_privkey_import(key, &d, GNUTLS_X509_FMT_PEM)) != 0) {
482 flog(LOG_ERR, "ssl: could not load key from %s: %s", file, gnutls_strerror(ret));
489 gnutls_certificate_allocate_credentials(&nc->creds);
490 if((ret = gnutls_certificate_set_x509_key(nc->creds, &crt, 1, key)) != 0) {
491 flog(LOG_ERR, "ssl: could not use certificate from %s: %s", file, gnutls_strerror(ret));
494 gnutls_certificate_set_dh_params(nc->creds, dhparams());
498 static void readncdir(struct ncredbuf *buf, char *dir)
504 if((d = opendir(dir)) == NULL) {
505 flog(LOG_ERR, "ssl: could not read certificate directory %s: %s", dir, strerror(errno));
508 while((e = readdir(d)) != NULL) {
509 if(e->d_name[0] == '.')
511 if((es = strlen(e->d_name)) <= 4)
513 if(strcmp(e->d_name + es - 4, ".crt"))
515 bufadd(*buf, readncreds(sprintf3("%s/%s", dir, e->d_name)));
520 void handlegnussl(int argc, char **argp, char **argv)
522 int i, ret, port, fd;
523 gnutls_certificate_credentials_t creds;
524 gnutls_priority_t ciphers;
525 struct ncredbuf ncreds;
527 char *crtfile, *keyfile, *perr;
532 gnutls_certificate_allocate_credentials(&creds);
533 keyfile = crtfile = NULL;
535 for(i = 0; i < argc; i++) {
536 if(!strcmp(argp[i], "help")) {
537 printf("ssl handler parameters:\n");
538 printf("\tcert=CERT-FILE [mandatory]\n");
539 printf("\t\tThe name of the file to read the certificate from.\n");
540 printf("\tkey=KEY-FILE [same as CERT-FILE]\n");
541 printf("\t\tThe name of the file to read the private key from.\n");
542 printf("\tprio=PRIORITIES [NORMAL]\n");
543 printf("\t\tCiphersuite priorities, as a GnuTLS priority string.\n");
544 printf("\ttrust=CA-FILE [no default]\n");
545 printf("\t\tThe name of a file to read trusted certificates from.\n");
546 printf("\t\tMay be given multiple times.\n");
547 printf("\tcrl=CRL-FILE [no default]\n");
548 printf("\t\tThe name of a file to read revocation lists from.\n");
549 printf("\t\tMay be given multiple times.\n");
550 printf("\tncert=CERT-FILE [no default]\n");
551 printf("\t\tThe name of a file to read a named certificate from,\n");
552 printf("\t\tfor use with SNI-enabled clients.\n");
553 printf("\t\tMay be given multiple times.\n");
554 printf("\tncertdir=DIR [no default]\n");
555 printf("\t\tRead all *.crt files in the given directory as if they\n");
556 printf("\t\twere given with `ncert' options.\n");
557 printf("\t\tMay be given multiple times.\n");
558 printf("\tport=PORT [443]\n");
559 printf("\t\tThe TCP port to listen on.\n");
561 printf("\tAll X.509 data files must be PEM-encoded.\n");
562 printf("\tIf any certificates were given with `ncert' options, they will be\n");
563 printf("\tused if a client explicitly names one of them with a\n");
564 printf("\tserver-name indication. If a client indicates no server name,\n");
565 printf("\tor if a server-name indication does not match any given\n");
566 printf("\tcertificate, the certificate given with the `cert' option will\n");
567 printf("\tbe used instead.\n");
569 } else if(!strcmp(argp[i], "cert")) {
571 } else if(!strcmp(argp[i], "key")) {
573 } else if(!strcmp(argp[i], "prio")) {
575 gnutls_priority_deinit(ciphers);
576 ret = gnutls_priority_init(&ciphers, argv[i], (const char **)&perr);
577 if(ret == GNUTLS_E_INVALID_REQUEST) {
578 flog(LOG_ERR, "ssl: invalid cipher priority string, at `%s'", perr);
580 } else if(ret != 0) {
581 flog(LOG_ERR, "ssl: could not initialize cipher priorities: %s", gnutls_strerror(ret));
584 } else if(!strcmp(argp[i], "trust")) {
585 if((ret = gnutls_certificate_set_x509_trust_file(creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
586 flog(LOG_ERR, "ssl: could not load trust file `%s': %s", argv[i], gnutls_strerror(ret));
589 for(i = 0; i < ncreds.d; i++) {
590 if((ret = gnutls_certificate_set_x509_trust_file(ncreds.b[i]->creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
591 flog(LOG_ERR, "ssl: could not load trust file `%s': %s", argv[i], gnutls_strerror(ret));
595 } else if(!strcmp(argp[i], "crl")) {
596 if((ret = gnutls_certificate_set_x509_crl_file(creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
597 flog(LOG_ERR, "ssl: could not load CRL file `%s': %s", argv[i], gnutls_strerror(ret));
600 for(i = 0; i < ncreds.d; i++) {
601 if((ret = gnutls_certificate_set_x509_crl_file(ncreds.b[i]->creds, argv[i], GNUTLS_X509_FMT_PEM)) != 0) {
602 flog(LOG_ERR, "ssl: could not load CRL file `%s': %s", argv[i], gnutls_strerror(ret));
606 } else if(!strcmp(argp[i], "port")) {
607 port = atoi(argv[i]);
608 } else if(!strcmp(argp[i], "ncert")) {
609 bufadd(ncreds, readncreds(argv[i]));
610 } else if(!strcmp(argp[i], "ncertdir")) {
611 readncdir(&ncreds, argv[i]);
613 flog(LOG_ERR, "unknown parameter `%s' to ssl handler", argp[i]);
617 if(crtfile == NULL) {
618 flog(LOG_ERR, "ssl: needs certificate file at the very least");
621 if((fd = listensock6(port)) < 0) {
622 flog(LOG_ERR, "could not listen on IPv6 port (port %i): %s", port, strerror(errno));
627 if((ret = gnutls_certificate_set_x509_key_file(creds, crtfile, keyfile, GNUTLS_X509_FMT_PEM)) != 0) {
628 flog(LOG_ERR, "ssl: could not load certificate or key: %s", gnutls_strerror(ret));
631 if((ciphers == NULL) && ((ret = gnutls_priority_init(&ciphers, "NORMAL", NULL)) != 0)) {
632 flog(LOG_ERR, "ssl: could not initialize cipher priorities: %s", gnutls_strerror(ret));
635 gnutls_certificate_set_dh_params(creds, dhparams());
636 bufadd(ncreds, NULL);
641 pd->ncreds = ncreds.b;
642 pd->ciphers = ciphers;
643 bufadd(listeners, mustart(listenloop, pd));
644 if((fd = listensock4(port)) < 0) {
645 if(errno != EADDRINUSE) {
646 flog(LOG_ERR, "could not listen on IPv4 port (port %i): %s", port, strerror(errno));
654 pd->ncreds = ncreds.b;
655 pd->ciphers = ciphers;
656 bufadd(listeners, mustart(listenloop, pd));