fivedev/harbour-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
harbour-core/contrib/hbssl/ssl_sock.c
Przemysław Czerpak f5a3c980fc 2025-01-28 11:34 UTC+0100 Przemyslaw Czerpak (druzus/at/poczta.onet.pl) 
* contrib/hbssl/hbssl.hbx
  * contrib/hbssl/bio.c
    ! fixed BIO_set_conn_int_port() to work with OpenSSL >= 1.1
      (emulation with BIO_set_conn_port())
    ! fixed BIO_get_conn_ip() to work with OpenSSL >= 1.1
      (emulation with BIO_get_conn_address() and BIO_ADDR_hostname_string())
    + added BIO_get_conn_address(), it returns HB_SOCKET compatible array
      with address

  * contrib/hbssl/hbssl.hbx
  * contrib/hbssl/sslctx.c
    + added new function SSL_CTX_use_RSAPrivateKey()
    ! respect OPENSSL_NO_RSA macro in other SSL_CTX_use_RSA*() functions

  * contrib/hbssl/evp.c
    ! use EVP_CIPHER_key_length() and EVP_CIPHER_iv_length() in
      EVP_BytesToKey() to detect the exact key and iv length.

  * contrib/hbssl/hbssl.h
  * contrib/hbssl/evppkey.c
  * contrib/hbssl/rsa.c
    * removed hb_RSA_par_remove() function, use RSA_up_ref() instead

  * contrib/hbssl/hbssl.h
  * contrib/hbssl/x509.c
  * contrib/hbssl/pem.c
  * contrib/hbssl/ssl.c
    * removed 2-nd parameter ( HB_BOOL fRelease ) from hb_X509_ret(),
      use X509_up_ref() instead

  * contrib/hbssl/pem.c
    * respect OPENSSL_NO_DSA, OPENSSL_NO_DH and OPENSSL_NO_RSA macros

  * contrib/hbssl/ssl_sock.c
    * added casting to pacify SSL_set_fd() warning and updated link with
      description of the problem
2025-01-28 11:34:21 +01:00

642 lines
18 KiB
C
Raw Permalink Blame History

/*
* Harbour extended socket filter with SSL encryption
*
* Copyright 2015 Przemyslaw Czerpak <druzus / at / priv.onet.pl>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2, or (at your option)
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; see the file LICENSE.txt. If not, write to
* the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
* Boston, MA 02110-1301 USA (or visit https://www.gnu.org/licenses/).
*
* As a special exception, the Harbour Project gives permission for
* additional uses of the text contained in its release of Harbour.
*
* The exception is that, if you link the Harbour libraries with other
* files to produce an executable, this does not by itself cause the
* resulting executable to be covered by the GNU General Public License.
* Your use of that executable is in no way restricted on account of
* linking the Harbour library code into it.
*
* This exception does not however invalidate any other reasons why
* the executable file might be covered by the GNU General Public License.
*
* This exception applies only to the code released by the Harbour
* Project under the name Harbour. If you copy code from other
* Harbour Project or Free Software Foundation releases into a copy of
* Harbour, as the General Public License permits, the exception does
* not apply to the code that you add in this way. To avoid misleading
* anyone as to the status of such modified files, you must delete
* this exception notice from them.
*
* If you write modifications of your own for Harbour, it is your choice
* whether to permit this exception to apply to your modifications.
* If you do not wish that, delete this exception notice.
*
*/
/* this has to be declared before hbsocket.h is included */
#define _HB_SOCKEX_IMPLEMENTATION_
#include "hbssl.h"
#include "hbapiitm.h"
#include "hbvm.h"
#include "hbdate.h"
#include "hbinit.h"
typedef struct _HB_SSLSTREAM
{
SSL * ssl;
PHB_ITEM pSSL;
HB_BOOL blocking;
}
HB_SSLSTREAM;
const char * hb_ssl_socketErrorStr( int iError )
{
if( iError >= HB_SSL_SOCK_ERROR_BASE )
{
switch( iError - HB_SSL_SOCK_ERROR_BASE )
{
case SSL_ERROR_NONE:
return "SSL_ERROR_NONE";
case SSL_ERROR_ZERO_RETURN:
return "SSL_ERROR_ZERO_RETURN";
case SSL_ERROR_WANT_READ:
return "SSL_ERROR_WANT_READ";
case SSL_ERROR_WANT_WRITE:
return "SSL_ERROR_WANT_WRITE";
case SSL_ERROR_WANT_CONNECT:
return "SSL_ERROR_WANT_CONNECT";
case SSL_ERROR_WANT_ACCEPT:
return "SSL_ERROR_WANT_ACCEPT";
case SSL_ERROR_WANT_X509_LOOKUP:
return "SSL_ERROR_WANT_X509_LOOKUP";
case SSL_ERROR_SYSCALL:
return "SSL_ERROR_SYSCALL";
case SSL_ERROR_SSL:
return "SSL_ERROR_SSL";
}
}
return hb_socketErrorStr( iError );
}
long hb_ssl_socketRead( PHB_SSLSTREAM pStream, HB_SOCKET sd,
void * buffer, long len, HB_MAXINT timeout )
{
long lRead = -1;
int iToRead = -1;
HB_MAXUINT timer;
#if 0
sd = SSL_get_rfd( pStream->ssl );
#endif
#if LONG_MAX > INT_MAX
if( len > INT_MAX )
len = INT_MAX;
#endif
#if 0
while( ERR_get_error() != 0 ) { /* eat pending errors */ }
#endif
if( pStream->blocking ? timeout >= 0 : timeout < 0 )
{
if( hb_socketSetBlockingIO( sd, timeout < 0 ) >= 0 )
pStream->blocking = ! pStream->blocking;
}
timer = hb_timerInit( timeout );
if( len > 0 )
{
iToRead = SSL_pending( pStream->ssl );
if( iToRead <= 0 )
{
iToRead = timeout < 0 ? 1 : hb_socketSelectRead( sd, timeout );
if( iToRead > 0 )
iToRead = ( int ) len;
else if( iToRead == 0 )
hb_socketSetError( HB_SOCKET_ERR_TIMEOUT );
}
else if( iToRead > len )
iToRead = ( int ) len;
}
while( iToRead > 0 )
{
lRead = SSL_read( pStream->ssl, buffer, iToRead );
if( lRead > 0 )
hb_socketSetError( 0 );
else
{
int iError = SSL_get_error( pStream->ssl, ( int ) lRead );
switch( iError )
{
case SSL_ERROR_ZERO_RETURN:
hb_socketSetError( HB_SOCKET_ERR_PIPE );
lRead = 0;
break;
case SSL_ERROR_WANT_READ:
case SSL_ERROR_WANT_WRITE:
if( hb_vmRequestQuery() == 0 )
{
if( timeout > 0 )
{
if( ( timeout = hb_timerTest( timeout, &timer ) ) != 0 )
{
if( iError == SSL_ERROR_WANT_READ )
iError = hb_socketSelectRead( sd, timeout );
else
iError = hb_socketSelectWrite( sd, timeout );
if( iError > 0 )
continue;
else if( iError < 0 )
break;
}
}
hb_socketSetError( HB_SOCKET_ERR_TIMEOUT );
break;
}
/* fallthrough */
default:
hb_socketSetError( HB_SSL_SOCK_ERROR_BASE + iError );
}
}
break;
}
return lRead;
}
long hb_ssl_socketWrite( PHB_SSLSTREAM pStream, HB_SOCKET sd,
const void * buffer, long len, HB_MAXINT timeout,
long * plast )
{
long lWritten = 0, lWr = 0;
HB_MAXUINT timer;
#if 0
sd = SSL_get_wfd( pStream->ssl );
#endif
#if LONG_MAX > INT_MAX
if( len > INT_MAX )
len = INT_MAX;
#endif
#if 0
while( ERR_get_error() != 0 ) { /* eat pending errors */ }
#endif
if( pStream->blocking ? timeout >= 0 : timeout < 0 )
{
if( hb_socketSetBlockingIO( sd, timeout < 0 ) >= 0 )
pStream->blocking = ! pStream->blocking;
}
timer = hb_timerInit( timeout );
while( len > 0 )
{
lWr = SSL_write( pStream->ssl, buffer, ( int ) len );
if( plast )
*plast = lWr;
if( lWr > 0 )
{
lWritten += lWr;
len -= lWr;
buffer = ( const char * ) buffer + lWr;
hb_socketSetError( 0 );
}
else
{
int iError = SSL_get_error( pStream->ssl, ( int ) lWr );
switch( iError )
{
case SSL_ERROR_WANT_READ:
case SSL_ERROR_WANT_WRITE:
if( hb_vmRequestQuery() == 0 )
{
if( timeout > 0 )
{
if( ( timeout = hb_timerTest( timeout, &timer ) ) != 0 )
{
if( iError == SSL_ERROR_WANT_READ )
iError = hb_socketSelectRead( sd, timeout );
else
iError = hb_socketSelectWrite( sd, timeout );
if( iError > 0 )
continue;
}
else
iError = 0;
}
else
iError = 0;
if( lWritten == 0 && iError == 0 )
hb_socketSetError( HB_SOCKET_ERR_TIMEOUT );
break;
}
/* fallthrough */
default:
hb_socketSetError( HB_SSL_SOCK_ERROR_BASE + iError );
}
break;
}
}
return lWritten != 0 ? lWritten : lWr;
}
void hb_ssl_socketClose( PHB_SSLSTREAM pStream )
{
SSL_shutdown( pStream->ssl );
if( pStream->pSSL )
hb_itemRelease( pStream->pSSL );
else
SSL_free( pStream->ssl );
hb_xfree( pStream );
}
PHB_SSLSTREAM hb_ssl_socketNew( HB_SOCKET sd, SSL * ssl, HB_BOOL fServer,
HB_MAXINT timeout, PHB_ITEM pSSL,
int * piResult )
{
PHB_SSLSTREAM pStream;
HB_MAXUINT timer;
int iResult;
pStream = ( HB_SSLSTREAM * ) hb_xgrabz( sizeof( HB_SSLSTREAM ) );
pStream->ssl = ssl;
pStream->pSSL = pSSL ? hb_itemNew( pSSL ) : NULL;
pStream->blocking = timeout < 0;
if( hb_socketSetBlockingIO( sd, pStream->blocking ) < 0 )
pStream->blocking = ! pStream->blocking;
SSL_set_mode( ssl, HB_SSL_MODE_AUTO_RETRY );
iResult = SSL_set_fd( ssl, ( int ) sd ); /* Truncates `sd` on win64. https://docs.openssl.org/3.0/man3/SSL_set_fd/#notes */
timer = hb_timerInit( timeout );
while( iResult == 1 )
{
if( fServer )
iResult = SSL_accept( ssl );
else
iResult = SSL_connect( ssl );
if( iResult != 1 && hb_vmRequestQuery() == 0 )
{
int iError = SSL_get_error( ssl, iResult );
if( iError == SSL_ERROR_WANT_READ ||
iError == SSL_ERROR_WANT_WRITE )
{
if( timeout < 0 )
{
iResult = 1;
continue;
}
else if( timeout > 0 )
{
if( ( timeout = hb_timerTest( timeout, &timer ) ) != 0 )
{
if( iError == SSL_ERROR_WANT_READ )
iError = hb_socketSelectRead( sd, timeout );
else
iError = hb_socketSelectWrite( sd, timeout );
if( iError > 0 )
{
iResult = 1;
continue;
}
}
}
hb_socketSetError( HB_SOCKET_ERR_TIMEOUT );
}
}
break;
}
if( iResult != 1 )
{
hb_ssl_socketClose( pStream );
pStream = NULL;
}
else
pStream->blocking = hb_socketSetBlockingIO( sd, HB_FALSE ) < 0;
if( piResult )
*piResult = iResult;
return pStream;
}
/* socket filter */
static SSL * s_SSL_itemGet( PHB_ITEM pItem, PHB_ITEM * pSSL, HB_BOOL * pfFree )
{
SSL * ssl = NULL;
if( pItem )
{
PHB_ITEM pRelease = NULL;
if( HB_IS_EVALITEM( pItem ) )
pItem = pRelease = hb_itemDo( pItem, 0 );
ssl = hb_SSL_itemGet( pItem );
if( ssl == NULL )
{
SSL_CTX * ssl_ctx = hb_SSL_CTX_itemGet( pItem );
if( ssl_ctx )
{
ssl = SSL_new( ssl_ctx );
if( pRelease )
hb_itemRelease( pRelease );
pItem = pRelease = NULL;
}
}
if( ssl )
{
* pSSL = pItem;
* pfFree = pRelease != NULL;
}
else if( pRelease )
hb_itemRelease( pRelease );
}
return ssl;
}
#define HB_SSLSOCK_GET( p ) ( ( PHB_SSLSTREAM ) p->cargo )
#define HB_SSLSOCK_READAHEAD 0x40
static PHB_SOCKEX s_sockexNew( HB_SOCKET sd, PHB_ITEM pParams )
{
PHB_SOCKEX pSock;
HB_BOOL fServer = HB_FALSE, fFree = HB_FALSE;
HB_MAXINT timeout = -1;
PHB_ITEM pSSL = NULL;
SSL * ssl = NULL;
if( pParams && HB_IS_HASH( pParams ) )
{
PHB_ITEM pItem;
if( ssl == NULL )
ssl = s_SSL_itemGet( hb_hashGetCItemPtr( pParams, "ssl" ), &pSSL, &fFree );
if( ssl == NULL )
ssl = s_SSL_itemGet( hb_hashGetCItemPtr( pParams, "ctx" ), &pSSL, &fFree );
if( ssl == NULL )
ssl = s_SSL_itemGet( hb_hashGetCItemPtr( pParams, "key" ), &pSSL, &fFree );
if( ( pItem = hb_hashGetCItemPtr( pParams, "timeout" ) ) != NULL &&
HB_IS_NUMERIC( pItem ) )
timeout = hb_itemGetNInt( pItem );
if( ( pItem = hb_hashGetCItemPtr( pParams, "server" ) ) != NULL &&
HB_IS_LOGICAL( pItem ) )
fServer = hb_itemGetL( pItem );
else if( ( pItem = hb_hashGetCItemPtr( pParams, "client" ) ) != NULL &&
HB_IS_LOGICAL( pItem ) )
fServer = ! hb_itemGetL( pItem );
}
pSock = hb_sockexNewSSL( sd, ssl, fServer, timeout, pSSL );
if( pSock )
hb_socekxParamsInit( pSock, pParams );
if( fFree )
hb_itemRelease( pSSL );
return pSock;
}
/* this wrapper does not support multilevel filtering so
it destroys previous wrappers if any and create new one.
*/
static PHB_SOCKEX s_sockexNext( PHB_SOCKEX pSock, PHB_ITEM pParams )
{
PHB_SOCKEX pSockNew = NULL;
if( pSock && pSock->sd != HB_NO_SOCKET )
{
pSockNew = s_sockexNew( pSock->sd, pParams );
if( pSockNew )
hb_sockexClose( pSock, HB_FALSE );
}
return pSockNew;
}
static int s_sockexClose( PHB_SOCKEX pSock, HB_BOOL fClose )
{
int iResult;
if( pSock->cargo )
hb_ssl_socketClose( HB_SSLSOCK_GET( pSock ) );
iResult = hb_sockexRawClear( pSock, fClose );
hb_xfree( pSock );
return iResult;
}
static long s_sockexRead( PHB_SOCKEX pSock, void * data, long len, HB_MAXINT timeout )
{
long lRead = HB_MIN( pSock->inbuffer, len );
if( lRead > 0 )
{
memcpy( data, pSock->buffer + pSock->posbuffer, lRead );
pSock->inbuffer -= lRead;
if( pSock->inbuffer )
pSock->posbuffer += lRead;
else
pSock->posbuffer = 0;
return lRead;
}
else if( pSock->sd == HB_NO_SOCKET )
{
hb_socketSetError( HB_SOCKET_ERR_INVALIDHANDLE );
return -1;
}
return hb_ssl_socketRead( HB_SSLSOCK_GET( pSock ), pSock->sd, data, len, timeout );
}
static long s_sockexWrite( PHB_SOCKEX pSock, const void * data, long len, HB_MAXINT timeout )
{
if( pSock->sd == HB_NO_SOCKET )
{
hb_socketSetError( HB_SOCKET_ERR_INVALIDHANDLE );
return -1;
}
return hb_ssl_socketWrite( HB_SSLSOCK_GET( pSock ), pSock->sd, data, len, timeout, NULL );
}
static long s_sockexFlush( PHB_SOCKEX pSock, HB_MAXINT timeout, HB_BOOL fSync )
{
HB_SYMBOL_UNUSED( pSock );
HB_SYMBOL_UNUSED( timeout );
HB_SYMBOL_UNUSED( fSync );
return 0;
}
static int s_sockexCanRead( PHB_SOCKEX pSock, HB_BOOL fBuffer, HB_MAXINT timeout )
{
if( pSock->inbuffer )
return 1;
else if( pSock->sd == HB_NO_SOCKET )
{
hb_socketSetError( HB_SOCKET_ERR_INVALIDHANDLE );
return -1;
}
else if( SSL_pending( HB_SSLSOCK_GET( pSock )->ssl ) )
{
long len;
if( pSock->buffer == NULL )
{
if( pSock->readahead <= 0 )
pSock->readahead = HB_SSLSOCK_READAHEAD;
pSock->buffer = ( HB_BYTE * ) hb_xgrab( pSock->readahead );
}
len = hb_ssl_socketRead( HB_SSLSOCK_GET( pSock ), pSock->sd,
pSock->buffer, pSock->readahead, 0 );
if( len > 0 )
{
pSock->inbuffer = len;
len = 1;
}
return ( int ) len;
}
return fBuffer ? 0 : hb_socketSelectRead( pSock->sd, timeout );
}
static int s_sockexCanWrite( PHB_SOCKEX pSock, HB_BOOL fBuffer, HB_MAXINT timeout )
{
if( pSock->sd == HB_NO_SOCKET )
{
hb_socketSetError( HB_SOCKET_ERR_INVALIDHANDLE );
return -1;
}
return fBuffer ? 0 : hb_socketSelectWrite( pSock->sd, timeout );
}
static char * s_sockexName( PHB_SOCKEX pSock )
{
return hb_strdup( pSock->pFilter->pszName );
}
static const char * s_sockexErrorStr( PHB_SOCKEX pSock, int iError )
{
HB_SYMBOL_UNUSED( pSock );
return hb_ssl_socketErrorStr( iError );
}
static const HB_SOCKET_FILTER s_sockFilter =
{
"SSL",
s_sockexNew,
s_sockexNext,
s_sockexClose,
s_sockexRead,
s_sockexWrite,
s_sockexFlush,
s_sockexCanRead,
s_sockexCanWrite,
s_sockexName,
s_sockexErrorStr
};
PHB_SOCKEX hb_sockexNewSSL( HB_SOCKET sd, SSL * ssl, HB_BOOL fServer,
HB_MAXINT timeout, PHB_ITEM pSSL )
{
PHB_SOCKEX pSock = NULL;
if( sd != HB_NO_SOCKET && ssl )
{
PHB_SSLSTREAM pStream = hb_ssl_socketNew( sd, ssl, fServer, timeout, pSSL, NULL );
if( pStream )
{
pSock = ( PHB_SOCKEX ) hb_xgrabz( sizeof( HB_SOCKEX ) );
pSock->sd = sd;
pSock->fRedirAll = HB_TRUE;
pSock->fShutDown = HB_TRUE;
pSock->pFilter = &s_sockFilter;
pSock->cargo = ( void * ) pStream;
}
}
return pSock;
}
static void s_sslSocketNew( HB_BOOL fServer )
{
HB_SOCKET sd = hb_socketParam( 1 );
if( sd != HB_NO_SOCKET )
{
PHB_SOCKEX pSock = NULL;
SSL * ssl = hb_SSL_par( 2 );
if( ssl )
pSock = hb_sockexNewSSL( sd, ssl, fServer, hb_parnintdef( 3, - 1 ), hb_param( 2, HB_IT_ANY ) );
else if( HB_ISHASH( 2 ) )
pSock = hb_sockexNew( sd, s_sockFilter.pszName, hb_param( 2, HB_IT_ANY ) );
else
hb_errRT_BASE( EG_ARG, 2010, NULL, HB_ERR_FUNCNAME, HB_ERR_ARGS_BASEPARAMS );
if( pSock )
{
PHB_ITEM pSockItm = hb_param( 1, HB_IT_POINTER );
if( HB_ISBYREF( 1 ) && hb_sockexItemReplace( pSockItm, pSock ) )
hb_itemReturn( pSockItm );
else
{
hb_socketItemClear( pSockItm );
hb_sockexItemPut( hb_param( -1, HB_IT_ANY ), pSock );
}
}
}
}
/* hb_socketNewSSL_connect( [@]<pSocket>, <pSSL> [, <nTimeout> ] ) */
HB_FUNC( HB_SOCKETNEWSSL_CONNECT )
{
s_sslSocketNew( HB_FALSE );
}
/* hb_socketNewSSL_accept( [@]<pSocket>, <pSSL> [, <nTimeout> ] ) */
HB_FUNC( HB_SOCKETNEWSSL_ACCEPT )
{
s_sslSocketNew( HB_TRUE );
}
HB_CALL_ON_STARTUP_BEGIN( _hb_sslsock_init_ )
hb_sockexRegister( &s_sockFilter );
HB_CALL_ON_STARTUP_END( _hb_sslsock_init_ )
#if defined( HB_PRAGMA_STARTUP )
#pragma startup _hb_sslsock_init_
#elif defined( HB_DATASEG_STARTUP )
#define HB_DATASEG_BODY HB_DATASEG_FUNC( _hb_sslsock_init_ )
#include "hbiniseg.h"
#endif
Reference in New Issue View Git Blame Copy Permalink