mirror of
https://github.com/sheumann/hush.git
synced 2024-08-14 11:28:58 +00:00
I got sick of not being able to wget a https file... Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
481 lines
12 KiB
C
481 lines
12 KiB
C
/*
|
|
* Adapted from:
|
|
*
|
|
* client.c
|
|
*
|
|
* Copyright (C) 2006-2015 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL. (formerly known as CyaSSL)
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
|
*/
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <stdarg.h>
|
|
#include <string.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <stdio.h>
|
|
#include <time.h>
|
|
#include <poll.h>
|
|
#include <sys/socket.h>
|
|
|
|
#include <wolfssl/wolfcrypt/types.h>
|
|
#include <wolfssl/ssl.h>
|
|
|
|
#if 0
|
|
# define dbg(...) say(__VA_ARGS__)
|
|
#else
|
|
# define dbg(...) ((void)0)
|
|
#endif
|
|
|
|
static ssize_t safe_write(int fd, const void *buf, size_t count)
|
|
{
|
|
ssize_t n;
|
|
|
|
do {
|
|
n = write(fd, buf, count);
|
|
} while (n < 0 && errno == EINTR);
|
|
|
|
return n;
|
|
}
|
|
|
|
static ssize_t full_write(int fd, const void *buf, size_t len)
|
|
{
|
|
ssize_t cc;
|
|
ssize_t total;
|
|
|
|
total = 0;
|
|
|
|
while (len) {
|
|
cc = safe_write(fd, buf, len);
|
|
|
|
if (cc < 0) {
|
|
if (total) {
|
|
/* we already wrote some! */
|
|
/* user can do another write to know the error code */
|
|
return total;
|
|
}
|
|
return cc; /* write() returns -1 on failure. */
|
|
}
|
|
|
|
total += cc;
|
|
buf = ((const char *)buf) + cc;
|
|
len -= cc;
|
|
}
|
|
|
|
return total;
|
|
}
|
|
|
|
static void say(const char *s, ...)
|
|
{
|
|
char buf[256];
|
|
va_list p;
|
|
int sz;
|
|
|
|
va_start(p, s);
|
|
sz = vsnprintf(buf, sizeof(buf), s, p);
|
|
full_write(STDERR_FILENO, buf, sz >= 0 && sz < sizeof(buf) ? sz : strlen(buf));
|
|
va_end(p);
|
|
}
|
|
|
|
static void die(const char *s, ...)
|
|
{
|
|
char buf[256];
|
|
va_list p;
|
|
int sz;
|
|
|
|
va_start(p, s);
|
|
sz = vsnprintf(buf, sizeof(buf), s, p);
|
|
full_write(STDERR_FILENO, buf, sz >= 0 && sz < sizeof(buf) ? sz : strlen(buf));
|
|
exit(1);
|
|
va_end(p);
|
|
}
|
|
|
|
static void err_sys(const char *msg)
|
|
{
|
|
die("%s\n", msg);
|
|
}
|
|
|
|
/* ==== */
|
|
|
|
#if 0
|
|
static void showPeer(WOLFSSL* ssl)
|
|
{
|
|
WOLFSSL_CIPHER* cipher;
|
|
WOLFSSL_X509* peer = wolfSSL_get_peer_certificate(ssl);
|
|
if (peer)
|
|
ShowX509(peer, "peer's cert info:");
|
|
else
|
|
say("peer has no cert!\n");
|
|
say("SSL version is %s\n", wolfSSL_get_version(ssl));
|
|
|
|
cipher = wolfSSL_get_current_cipher(ssl);
|
|
say("SSL cipher suite is %s\n", wolfSSL_CIPHER_get_name(cipher));
|
|
|
|
{
|
|
WOLFSSL_X509_CHAIN* chain = wolfSSL_get_peer_chain(ssl);
|
|
int count = wolfSSL_get_chain_count(chain);
|
|
int i;
|
|
|
|
for (i = 0; i < count; i++) {
|
|
int length;
|
|
unsigned char buffer[3072];
|
|
WOLFSSL_X509* chainX509;
|
|
|
|
wolfSSL_get_chain_cert_pem(chain, i, buffer, sizeof(buffer), &length);
|
|
buffer[length] = 0;
|
|
say("cert %d has length %d data = \n%s\n", i, length, buffer);
|
|
|
|
chainX509 = wolfSSL_get_chain_X509(chain, i);
|
|
if (chainX509)
|
|
ShowX509(chainX509, "session cert info:");
|
|
else
|
|
say("get_chain_X509 failed\n");
|
|
wolfSSL_FreeX509(chainX509);
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
|
|
WOLFSSL *prepare(int sockfd)
|
|
{
|
|
WOLFSSL_METHOD* method;
|
|
WOLFSSL_CTX* ctx;
|
|
WOLFSSL* ssl;
|
|
|
|
wolfSSL_Init();
|
|
|
|
method = wolfTLSv1_1_client_method();
|
|
if (method == NULL)
|
|
err_sys("out of memory");
|
|
ctx = wolfSSL_CTX_new(method);
|
|
if (ctx == NULL)
|
|
err_sys("out of memory");
|
|
// if (cipherList)
|
|
// if (wolfSSL_CTX_set_cipher_list(ctx, cipherList) != SSL_SUCCESS)
|
|
// err_sys("client can't set cipher list 1");
|
|
|
|
// if (fewerPackets)
|
|
// wolfSSL_CTX_set_group_messages(ctx);
|
|
|
|
//#ifndef NO_DH
|
|
// wolfSSL_CTX_SetMinDhKey_Sz(ctx, (word16)minDhKeyBits);
|
|
//#endif
|
|
|
|
// if (usePsk) {
|
|
// wolfSSL_CTX_set_psk_client_callback(ctx, my_psk_client_cb);
|
|
// if (cipherList == NULL) {
|
|
// const char *defaultCipherList;
|
|
//#if defined(HAVE_AESGCM) && !defined(NO_DH)
|
|
// defaultCipherList = "DHE-PSK-AES128-GCM-SHA256";
|
|
//#elif defined(HAVE_NULL_CIPHER)
|
|
// defaultCipherList = "PSK-NULL-SHA256";
|
|
//#else
|
|
// defaultCipherList = "PSK-AES128-CBC-SHA256";
|
|
//#endif
|
|
// if (wolfSSL_CTX_set_cipher_list(ctx,defaultCipherList) != SSL_SUCCESS)
|
|
// err_sys("client can't set cipher list 2");
|
|
// }
|
|
// useClientCert = 0;
|
|
// }
|
|
|
|
// if (useAnon) {
|
|
// if (cipherList == NULL) {
|
|
// wolfSSL_CTX_allow_anon_cipher(ctx);
|
|
// if (wolfSSL_CTX_set_cipher_list(ctx,"ADH-AES128-SHA") != SSL_SUCCESS)
|
|
// err_sys("client can't set cipher list 4");
|
|
// }
|
|
// useClientCert = 0;
|
|
// }
|
|
|
|
//#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
|
|
// wolfSSL_CTX_set_default_passwd_cb(ctx, PasswordCallBack);
|
|
//#endif
|
|
|
|
// if (useOcsp) {
|
|
// if (ocspUrl != NULL) {
|
|
// wolfSSL_CTX_SetOCSP_OverrideURL(ctx, ocspUrl);
|
|
// wolfSSL_CTX_EnableOCSP(ctx, WOLFSSL_OCSP_NO_NONCE
|
|
// | WOLFSSL_OCSP_URL_OVERRIDE);
|
|
// }
|
|
// else
|
|
// wolfSSL_CTX_EnableOCSP(ctx, WOLFSSL_OCSP_NO_NONCE);
|
|
// }
|
|
//
|
|
//#ifdef USER_CA_CB
|
|
// wolfSSL_CTX_SetCACb(ctx, CaCb);
|
|
//#endif
|
|
//
|
|
//#ifdef VERIFY_CALLBACK
|
|
// wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, myVerify);
|
|
//#endif
|
|
//#if !defined(NO_FILESYSTEM) && !defined(NO_CERTS)
|
|
// if (useClientCert) {
|
|
// if (wolfSSL_CTX_use_certificate_chain_file(ctx, ourCert) != SSL_SUCCESS)
|
|
// err_sys("can't load client cert file, check file and run from"
|
|
// " wolfSSL home dir");
|
|
// if (wolfSSL_CTX_use_PrivateKey_file(ctx, ourKey, SSL_FILETYPE_PEM) != SSL_SUCCESS)
|
|
// err_sys("can't load client private key file, check file and run "
|
|
// "from wolfSSL home dir");
|
|
// }
|
|
//
|
|
// if (!usePsk && !useAnon) {
|
|
// if (wolfSSL_CTX_load_verify_locations(ctx, verifyCert,0) != SSL_SUCCESS)
|
|
// err_sys("can't load ca file, Please run from wolfSSL home dir");
|
|
//#ifdef HAVE_ECC
|
|
// /* load ecc verify too, echoserver uses it by default w/ ecc */
|
|
// if (wolfSSL_CTX_load_verify_locations(ctx, eccCert, 0) != SSL_SUCCESS)
|
|
// err_sys("can't load ecc ca file, Please run from wolfSSL home dir");
|
|
//#endif
|
|
// }
|
|
//#endif /* !NO_FILESYSTEM && !NO_CERTS */
|
|
|
|
//#if !defined(NO_CERTS)
|
|
// if (!usePsk && !useAnon && doPeerCheck == 0)
|
|
// wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
|
|
// if (!usePsk && !useAnon && overrideDateErrors == 1)
|
|
// wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, myDateCb);
|
|
//#endif
|
|
|
|
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
|
|
|
|
//#ifdef HAVE_SNI
|
|
// if (sniHostName)
|
|
// if (wolfSSL_CTX_UseSNI(ctx, 0, sniHostName, XSTRLEN(sniHostName)) != SSL_SUCCESS)
|
|
// err_sys("UseSNI failed");
|
|
//#endif
|
|
|
|
//#ifdef HAVE_MAX_FRAGMENT
|
|
// if (maxFragment)
|
|
// if (wolfSSL_CTX_UseMaxFragment(ctx, maxFragment) != SSL_SUCCESS)
|
|
// err_sys("UseMaxFragment failed");
|
|
//#endif
|
|
//#ifdef HAVE_TRUNCATED_HMAC
|
|
// if (truncatedHMAC)
|
|
// if (wolfSSL_CTX_UseTruncatedHMAC(ctx) != SSL_SUCCESS)
|
|
// err_sys("UseTruncatedHMAC failed");
|
|
//#endif
|
|
//#ifdef HAVE_SESSION_TICKET
|
|
// if (wolfSSL_CTX_UseSessionTicket(ctx) != SSL_SUCCESS)
|
|
// err_sys("UseSessionTicket failed");
|
|
//#endif
|
|
|
|
//#if defined(WOLFSSL_MDK_ARM)
|
|
// wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
|
|
//#endif
|
|
|
|
ssl = wolfSSL_new(ctx);
|
|
if (ssl == NULL)
|
|
err_sys("out of memory");
|
|
|
|
//#ifdef HAVE_SESSION_TICKET
|
|
// wolfSSL_set_SessionTicket_cb(ssl, sessionTicketCB, (void*)"initial session");
|
|
//#endif
|
|
|
|
// if (doDTLS) {
|
|
// SOCKADDR_IN_T addr;
|
|
// build_addr(&addr, host, port, 1);
|
|
// wolfSSL_dtls_set_peer(ssl, &addr, sizeof(addr));
|
|
// tcp_socket(&sockfd, 1);
|
|
// } wlse {
|
|
// tcp_connect(&sockfd, host, port, 0);
|
|
// }
|
|
|
|
//#ifdef HAVE_POLY1305
|
|
// /* use old poly to connect with google server */
|
|
// if (!XSTRNCMP(domain, "www.google.com", 14)) {
|
|
// if (wolfSSL_use_old_poly(ssl, 1) != 0)
|
|
// err_sys("unable to set to old poly");
|
|
// }
|
|
//#endif
|
|
|
|
wolfSSL_set_fd(ssl, sockfd);
|
|
|
|
//#ifdef HAVE_CRL
|
|
// if (disableCRL == 0) {
|
|
// if (wolfSSL_EnableCRL(ssl, WOLFSSL_CRL_CHECKALL) != SSL_SUCCESS)
|
|
// err_sys("can't enable crl check");
|
|
// if (wolfSSL_LoadCRL(ssl, crlPemDir, SSL_FILETYPE_PEM, 0) != SSL_SUCCESS)
|
|
// err_sys("can't load crl, check crlfile and date validity");
|
|
// if (wolfSSL_SetCRL_Cb(ssl, CRL_CallBack) != SSL_SUCCESS)
|
|
// err_sys("can't set crl callback");
|
|
// }
|
|
//#endif
|
|
//#ifdef HAVE_SECURE_RENEGOTIATION
|
|
// if (scr) {
|
|
// if (wolfSSL_UseSecureRenegotiation(ssl) != SSL_SUCCESS)
|
|
// err_sys("can't enable secure renegotiation");
|
|
// }
|
|
//#endif
|
|
//#ifdef ATOMIC_USER
|
|
// if (atomicUser)
|
|
// SetupAtomicUser(ctx, ssl);
|
|
//#endif
|
|
//#ifdef HAVE_PK_CALLBACKS
|
|
// if (pkCallbacks)
|
|
// SetupPkCallbacks(ctx, ssl);
|
|
//#endif
|
|
// if (matchName && doPeerCheck)
|
|
// wolfSSL_check_domain_name(ssl, domain);
|
|
|
|
if (wolfSSL_connect(ssl) != SSL_SUCCESS) {
|
|
// /* see note at top of README */
|
|
// int err = wolfSSL_get_error(ssl, 0);
|
|
// char buffer[WOLFSSL_MAX_ERROR_SZ];
|
|
// say("err = %d, %s\n", err,
|
|
// wolfSSL_ERR_error_string(err, buffer));
|
|
err_sys("SSL_connect failed");
|
|
}
|
|
// showPeer(ssl);
|
|
|
|
//#ifdef HAVE_SECURE_RENEGOTIATION
|
|
// if (scr && forceScr) {
|
|
// if (wolfSSL_Rehandshake(ssl) != SSL_SUCCESS) {
|
|
// int err = wolfSSL_get_error(ssl, 0);
|
|
// char buffer[WOLFSSL_MAX_ERROR_SZ];
|
|
// say("err = %d, %s\n", err,
|
|
// wolfSSL_ERR_error_string(err, buffer));
|
|
// err_sys("wolfSSL_Rehandshake failed");
|
|
// }
|
|
// }
|
|
//#endif
|
|
|
|
return ssl;
|
|
}
|
|
|
|
static struct pollfd pfd[2] = {
|
|
{ -1, POLLIN|POLLERR|POLLHUP, 0 },
|
|
{ -1, POLLIN|POLLERR|POLLHUP, 0 },
|
|
};
|
|
#define STDIN pfd[0]
|
|
#define NETWORK pfd[1]
|
|
#define STDIN_READY() (pfd[0].revents & (POLLIN|POLLERR|POLLHUP))
|
|
#define NETWORK_READY() (pfd[1].revents & (POLLIN|POLLERR|POLLHUP))
|
|
|
|
static void wait_for_input(void)
|
|
{
|
|
if (STDIN.fd == NETWORK.fd) /* means both are -1 */
|
|
exit(0);
|
|
dbg("polling\n");
|
|
STDIN.revents = NETWORK.revents = 0;
|
|
while (poll(pfd, 2, -1) < 0 && errno == EINTR)
|
|
continue;
|
|
}
|
|
|
|
static void do_io_until_eof_and_exit(WOLFSSL *ssl, int fd)
|
|
{
|
|
int len;
|
|
char ibuf[4 * 1024];
|
|
|
|
NETWORK.fd = fd;
|
|
STDIN.fd = 0;
|
|
|
|
len = 0; /* only to suppress compiler warning */
|
|
for (;;) {
|
|
wait_for_input();
|
|
|
|
if (STDIN_READY()) {
|
|
dbg("reading stdin\n");
|
|
len = read(STDIN_FILENO, ibuf, sizeof(ibuf));
|
|
if (len < 0)
|
|
die("read error on stdin\n");
|
|
if (len == 0) {
|
|
dbg("read len = 0, stdin not polled anymore\n");
|
|
STDIN.fd = -1;
|
|
} else {
|
|
int n = wolfSSL_write(ssl, ibuf, len);
|
|
if (n != len)
|
|
die("SSL_write(%d) failed (returned %d)\n", len, n);
|
|
}
|
|
}
|
|
|
|
if (NETWORK_READY()) {
|
|
dbg("%s%s%s\n",
|
|
(pfd[1].revents & POLLIN) ? "POLLIN" : "",
|
|
(pfd[1].revents & POLLERR) ? "|POLLERR" : "",
|
|
(pfd[1].revents & POLLHUP) ? "|POLLHUP" : ""
|
|
);
|
|
/* We are using blocking socket here.
|
|
* (Nonblocking socket would complicate writing to it).
|
|
* Therefore, SSL_read _can block_ here.
|
|
* This is not what wget expects (it wants to see short reads).
|
|
* Therefore, we use smallish buffer here, to approximate that.
|
|
*/
|
|
len = wolfSSL_read(ssl, ibuf,
|
|
sizeof(ibuf) < 1024 ? sizeof(ibuf) : 1024
|
|
);
|
|
if (len < 0)
|
|
die("SSL_read error on network (%d)\n", len);
|
|
if (len > 0) {
|
|
int n;
|
|
n = full_write(STDOUT_FILENO, ibuf, len);
|
|
if (n != len)
|
|
die("write(%d) to stdout returned %d\n", len, n);
|
|
continue;
|
|
}
|
|
/* Blocking reads are easier wtr EOF detection (no EAGAIN error to check for) */
|
|
dbg("read len = 0, network not polled anymore\n");
|
|
NETWORK.fd = -1;
|
|
/* saw EOF on network, and we processed
|
|
* and wrote out all ssl data. Signal it:
|
|
*/
|
|
close(STDOUT_FILENO);
|
|
}
|
|
}
|
|
}
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
WOLFSSL *ssl;
|
|
int fd;
|
|
char *fd_str;
|
|
|
|
if (!argv[1])
|
|
die("Syntax error\n");
|
|
if (argv[1][0] != '-')
|
|
die("Syntax error\n");
|
|
if (argv[1][1] != 'd')
|
|
die("Syntax error\n");
|
|
fd_str = argv[1] + 2;
|
|
if (!fd_str[0])
|
|
fd_str = argv[2];
|
|
if (!fd_str || fd_str[0] < '0' || fd_str[0] > '9')
|
|
die("Syntax error\n");
|
|
|
|
fd = atoi(fd_str);
|
|
if (fd < 3)
|
|
die("Syntax error\n");
|
|
|
|
ssl = prepare(fd);
|
|
do_io_until_eof_and_exit(ssl, fd);
|
|
/* does not return */
|
|
|
|
// if (doDTLS == 0) { /* don't send alert after "break" command */
|
|
// ret = wolfSSL_shutdown(ssl);
|
|
// if (wc_shutdown && ret == SSL_SHUTDOWN_NOT_DONE)
|
|
// wolfSSL_shutdown(ssl); /* bidirectional shutdown */
|
|
// }
|
|
//#ifdef ATOMIC_USER
|
|
// if (atomicUser)
|
|
// FreeAtomicUser(ssl);
|
|
//#endif
|
|
// wolfSSL_free(ssl);
|
|
// CloseSocket(sockfd);
|
|
// wolfSSL_CTX_free(ctx);
|
|
|
|
return 0;
|
|
}
|