SecureTCPSocket.cpp

/*
** libutil++
** $Id: SecureTCPSocket.cpp 1911 2017-09-02 17:37:35Z sella $
** Copyright (c) 2011-2016 Digital Genesis, LLC. All Rights Reserved.
** Released under the LGPL Version 2.1 License.
** http://www.digitalgenesis.com
*/

static const char rcsid[] __attribute__((used)) = "$Id: SecureTCPSocket.cpp 1911 2017-09-02 17:37:35Z sella $";

#include "SecureTCPSocket.h"
#include "../util/String.h"

#include <sys/types.h>
#include <sys/socket.h>
#include <fcntl.h>
#include <string.h>
#include <fstream>

using namespace sella::net;
using namespace sella::util;

extern bool libutilxx__openssl_init;

const std::set<SecureTCPSocket::Protocol> SecureTCPSocket::DefaultProtocols = { SSLv3, TLSv1_0, TLSv1_1, TLSv1_2 };
const std::string SecureTCPSocket::DefaultCiphers = "ALL:!aNULL:!eNULL";
const std::string SecureTCPSocket::PerformanceCiphers = "AES128-SHA:RC4-MD5:RC4-SHA:AES256-SHA:HIGH:!DSS:!aNULL:!eNULL";

SecureTCPSocket::SecureTCPSocket(int family) throw (SocketException) :
        TCPSocket(family, SOCK_STREAM, IPPROTO_TCP),
        ctx(NULL),
        ssl(NULL),
        server(true),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }
}

SecureTCPSocket::SecureTCPSocket(int family, const IPAddressPort &addressport) throw (SocketException) :
        TCPSocket(family, SOCK_STREAM, IPPROTO_TCP),
        ctx(NULL),
        ssl(NULL),
        server(false),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }

        connect(addressport);
        client_init();
}

SecureTCPSocket::SecureTCPSocket(int family, const IPAddress &address, const Port &port) throw (SocketException) :
        TCPSocket(family, SOCK_STREAM, IPPROTO_TCP),
        ctx(NULL),
        ssl(NULL),
        server(false),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }

        connect(address, port);
        client_init();
}

SecureTCPSocket::SecureTCPSocket(int family, const std::string &address, unsigned short port) throw (SocketException) :
        TCPSocket(family, SOCK_STREAM, IPPROTO_TCP),
        ctx(NULL),
        ssl(NULL),
        server(false),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }

        connect(address, port);
        client_init();
}

SecureTCPSocket::SecureTCPSocket(const IPAddressPort &addressport) throw (SocketException) :
        TCPSocket(addressport.getFamily(), SOCK_STREAM, IPPROTO_TCP),
        ctx(NULL),
        ssl(NULL),
        server(false),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }

        connect(addressport);
        client_init();
}

SecureTCPSocket::SecureTCPSocket(const IPAddress &address, const Port &port) throw (SocketException) :
        TCPSocket(address.getFamily(), SOCK_STREAM, IPPROTO_TCP),
        ctx(NULL),
        ssl(NULL),
        server(false),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }

        connect(address, port);
        client_init();
}

SecureTCPSocket::SecureTCPSocket(int s, bool unused) throw (SocketException) :
        TCPSocket(s, unused),
        ctx(NULL),
        ssl(NULL),
        server(true),
        protocols(DefaultProtocols),
        preferServerCiphers(false)
{
        try {
                init();
        } catch (SocketException &e) {
                usable = false;

                RETHROW(SocketException, e);
        }

        usable = true;
}

SecureTCPSocket::~SecureTCPSocket() {
        shutdown();

        try {
                close();
        } catch (...) { };

        /* Scrub buffer before release back to stack. */
        for (size_t i = 0; i < password.size(); i++) {
                password.at(i) = 0;
        }

        if (ctx) {
                SSL_CTX_free(ctx);

                ctx = NULL;
        }
}

void SecureTCPSocket::setCertificateFile(const std::string &certificateFile) throw () {
        this->certificateFile = certificateFile;
}

void SecureTCPSocket::setPrivateKeyFile(const std::string &privateKeyFile) throw () {
        this->privateKeyFile = privateKeyFile;
}

void SecureTCPSocket::setPasswordFile(const std::string &passwordFile) throw () {
        this->passwordFile = passwordFile;
}

void SecureTCPSocket::setPassword(const std::string &password) throw () {
        /* Scrub previous buffer before release back to stack. */
        for (size_t i = 0; i < this->password.size(); i++) {
                this->password.at(i) = 0;
        }

        this->password = password;
}

void SecureTCPSocket::setCertificateChainFile(const std::string &certificateChainFile) throw () {
        this->certificateChainFile = certificateChainFile;
}

void SecureTCPSocket::setCACertificateFile(const std::string &caCertificateFile) throw () {
        this->caCertificateFile = caCertificateFile;
}

void SecureTCPSocket::setProtocols(const std::set<Protocol> &protocols) throw () {
        this->protocols = protocols;
}

void SecureTCPSocket::setProtocol(Protocol protocol, bool on) throw () {
        if (on) {
                this->protocols.insert(protocol);
        } else {
                this->protocols.erase(protocol);
        }
}

void SecureTCPSocket::setCiphers(const std::string &ciphers) throw () {
        this->ciphers = ciphers;
}

void SecureTCPSocket::setPreferServerCiphers(bool on) throw () {
        this->preferServerCiphers = on;
}

bool SecureTCPSocket::isSecure(void) const throw () {
        return true;
}

TCPSocket::shared SecureTCPSocket::accept(void) throw (SocketException) {
        int fd;

        if ((fd = ::accept(s, NULL, NULL)) < 0) {
                THROW2(SocketException, "accept()");
        }

        const SecureTCPSocket::shared socket(new SecureTCPSocket(fd, true));

        socket->certificateFile = this->certificateFile;
        socket->privateKeyFile = this->privateKeyFile;
        socket->passwordFile = this->passwordFile;
        socket->password = this->password;
        socket->certificateChainFile = this->certificateChainFile;
        socket->caCertificateFile = this->caCertificateFile;
        socket->protocols = this->protocols;
        socket->ciphers = this->ciphers;
        socket->preferServerCiphers = this->preferServerCiphers;

        socket->server_init();

        return socket;
}

ssize_t SecureTCPSocket::send(const void *data, size_t len, int flags) throw (SocketException) {
        if (!ssl) {
                THROW(SocketException, "Socket is closed");
        }

        errno = 0;
        ssize_t c = SSL_write(ssl, data, len);

        switch (SSL_get_error(ssl, c)) {
                case SSL_ERROR_NONE: /* No error */
                        break;

                case SSL_ERROR_ZERO_RETURN: /* Orderly socket shutdown */
                        shutdown();

                        break;

                case SSL_ERROR_WANT_READ:
                case SSL_ERROR_WANT_WRITE:
                case SSL_ERROR_WANT_CONNECT:
                case SSL_ERROR_WANT_ACCEPT:
                case SSL_ERROR_WANT_X509_LOOKUP:
                        return 0; /* Do not toggle read/except and return 0 to have caller retry. */

                case SSL_ERROR_SSL:
                        read = except = false;
                        shutdown();

                        THROW(SocketException, "SSL library error during receive: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());

                case SSL_ERROR_SYSCALL:
                default:
                        read = except = false;
                        shutdown();

                        THROW(SocketException, "Error receiving from connection: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

        read = except = false;

        return c;
}

ssize_t SecureTCPSocket::recv(void *data, size_t len, int flags) throw (SocketException) {
        if (!ssl) {
                THROW(SocketException, "Socket is closed");
        }

        errno = 0;
        ssize_t c = SSL_read(ssl, data, len);

        switch (SSL_get_error(ssl, c)) {
                case SSL_ERROR_NONE: /* No error */
                        break;

                case SSL_ERROR_ZERO_RETURN: /* Orderly socket shutdown */
                        shutdown();

                        break;

                case SSL_ERROR_WANT_READ:
                case SSL_ERROR_WANT_WRITE:
                case SSL_ERROR_WANT_CONNECT:
                case SSL_ERROR_WANT_ACCEPT:
                case SSL_ERROR_WANT_X509_LOOKUP:
                        return 0; /* Do not toggle read/except and return 0 to have caller retry. */

                case SSL_ERROR_SSL:
                        write = false;
                        shutdown();

                        THROW(SocketException, "SSL library error during receive: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());

                case SSL_ERROR_SYSCALL:
                default:
                        write = false;
                        shutdown();

                        THROW(SocketException, "Error receiving from connection: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

        write = false;

        return c;
}

const char* SecureTCPSocket::getSSLLibraryVersion(void) const throw () {
        return SSLeay_version(SSLEAY_VERSION);
}

const char* SecureTCPSocket::getActiveProtocol(void) const throw (SocketException) {
        const char *protocol;

        if (!ssl) {
                THROW(SocketException, "No active SSL session");
        }

        if ((protocol = SSL_get_version(ssl)) == NULL) {
                THROW(SocketException, "No active SSL session");
        }

        return protocol;
}

const char* SecureTCPSocket::getActiveCipher(void) const throw (SocketException) {
        const char *cipher;

        if (!ssl) {
                THROW(SocketException, "No active SSL session");
        }

        if ((cipher = SSL_get_cipher(ssl)) == NULL) {
                THROW(SocketException, "No active SSL session");
        }

        return cipher;
}

const SecureTCPSocket::shared SecureTCPSocket::shared_ptr(int family) throw (SocketException) {
        return std::make_shared<SecureTCPSocket>(family);
}

const SecureTCPSocket::shared SecureTCPSocket::shared_ptr(int family, const IPAddressPort &addressport) throw (SocketException) {
        return std::make_shared<SecureTCPSocket>(family, addressport);
}

const SecureTCPSocket::shared SecureTCPSocket::shared_ptr(int family, const IPAddress &address, const Port &port) throw (SocketException) {
        return std::make_shared<SecureTCPSocket>(family, address, port);
}

const SecureTCPSocket::shared SecureTCPSocket::shared_ptr(int family, const std::string &address, unsigned short port) throw (SocketException) {
        return std::make_shared<SecureTCPSocket>(family, address, port);
}

const SecureTCPSocket::shared SecureTCPSocket::shared_ptr(const IPAddressPort &addressport) throw (SocketException) {
        return std::make_shared<SecureTCPSocket>(addressport);
}

const SecureTCPSocket::shared SecureTCPSocket::shared_ptr(const IPAddress &address, const Port &port) throw (SocketException) {
        return std::make_shared<SecureTCPSocket>(address, port);
}

void SecureTCPSocket::init(void) throw (SocketException) {
        if (!libutilxx__openssl_init) { /* Nested to avoid lock overhead. */
                mutex.lock();

                if (!libutilxx__openssl_init) {
                        SSL_library_init(); /* Initialize OpenSSL library */
                        SSL_load_error_strings(); /* Load the error strings for SSL & CRYPTO APIs */

                        libutilxx__openssl_init = true;
                }

                mutex.unlock();
        }
}

void SecureTCPSocket::server_init(void) throw (SocketException) {
        int e;
        const SSL_METHOD *meth;

        if (ctx || ssl) {
                THROW(SocketException, "Already initialized");
        }

        if (privateKeyFile.empty() || certificateFile.empty()) {
                THROW(SocketException, "Must supply certificate and private-key for server side connection");
        }

#if OPENSSL_VERSION_NUMBER < 0x10100000L
        if ((meth = SSLv23_server_method()) == NULL) {
                THROW(SocketException, "Failed to create SSL/TLS method structure: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }
#else
        if ((meth = TLS_server_method()) == NULL) {
                THROW(SocketException, "Failed to create SSL/TLS method structure: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }
#endif

        if ((ctx = SSL_CTX_new(meth)) == NULL) {
                THROW(SocketException, "Failed to create OpenSSL context: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

#if OPENSSL_VERSION_NUMBER < 0x10100000L
        SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
#endif

        if (!protocols.empty()) {
                if (!protocols.count(SSLv3)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
                }

                if (!protocols.count(TLSv1_0)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1);
                }

                if (!protocols.count(TLSv1_1)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1);
                }

                if (!protocols.count(TLSv1_2)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2);
                }
        }

        if (!ciphers.empty()) {
                if (SSL_CTX_set_cipher_list(ctx, ciphers.c_str()) < 1) {
                        THROW(SocketException, "Failed to set SSL ciphers: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
                }
        }

        if (preferServerCiphers) {
                SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
        }

        if (!certificateFile.empty()) {
                if (SSL_CTX_use_certificate_file(ctx, certificateFile.c_str(), SSL_FILETYPE_PEM) <= 0) {
                        THROW(SocketException, "Failed to load PEM certificate file: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
                }
        }

        if (!passwordFile.empty()) {
                std::ifstream file(passwordFile);

                if (!file.is_open() || !file.good()) {
                        THROW(SocketException, "Failed to open file %s for reading", passwordFile.c_str());
                }

                /* Scrub previous buffer before release back to stack. */
                for (size_t i = 0; i < this->password.size(); i++) {
                        this->password.at(i) = 0;
                }

                std::getline(file, this->password);
        }

        SSL_CTX_set_default_passwd_cb(ctx, SSL_password_callback);
        SSL_CTX_set_default_passwd_cb_userdata(ctx, &password);

        if (SSL_CTX_use_PrivateKey_file(ctx, privateKeyFile.c_str(), SSL_FILETYPE_PEM) <= 0) {
                THROW(SocketException, "Failed to load PEM private key file: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

        if (!SSL_CTX_check_private_key(ctx)) {
                THROW(SocketException, "Private key does not match the certificate public key");
        }

        if (!certificateChainFile.empty()) {
                if (SSL_CTX_use_certificate_chain_file(ctx, certificateChainFile.c_str()) <= 0) {
                        THROW(SocketException, "Failed to load PEM certificate chain file: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
                }
        }

        if (!caCertificateFile.empty()) {
                /* Load the RSA CA certificate into the SSL_CTX structure */
                if (!SSL_CTX_load_verify_locations(ctx, caCertificateFile.c_str(), NULL)) {
                        THROW(SocketException, "Failed to load CA certificate: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
                }

                /* Set to require peer (client) certificate verification */
                SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);

                /* Set the verification depth to 1 */
                SSL_CTX_set_verify_depth(ctx, 1);
        }

        if ((ssl = SSL_new(ctx)) == NULL) {
                THROW(SocketException, "Failed to create SSL connection: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

        SSL_set_fd(ssl, s);

        if ((e = SSL_accept(ssl)) != 1) {
                THROW(SocketException, "Failed SSL/TLS handshake with client: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }
}

void SecureTCPSocket::client_init(void) throw (SocketException) {
        int e;
        std::string server;
        const SSL_METHOD *meth;

        if (ctx || ssl) {
                THROW(SocketException, "Already initialized");
        }

#if OPENSSL_VERSION_NUMBER < 0x10100000L
        if ((meth = SSLv23_client_method()) == NULL) {
                THROW(SocketException, "Failed to create SSL/TLS method structure: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }
#else
        if ((meth = TLS_client_method()) == NULL) {
                THROW(SocketException, "Failed to create SSL/TLS method structure: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }
#endif

        if ((ctx = SSL_CTX_new(meth)) == NULL) {
                THROW(SocketException, "Failed to create OpenSSL context: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

#if OPENSSL_VERSION_NUMBER < 0x10100000L
        SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
#endif

        if (!protocols.empty()) {
                if (!protocols.count(SSLv3)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
                }

                if (!protocols.count(TLSv1_0)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1);
                }

                if (!protocols.count(TLSv1_1)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1);
                }

                if (!protocols.count(TLSv1_2)) {
                        SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2);
                }
        }

        if (!ciphers.empty()) {
                if (SSL_CTX_set_cipher_list(ctx, ciphers.c_str()) < 1) {
                        THROW(SocketException, "Failed to set SSL ciphers: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
                }
        }

        if ((ssl = SSL_new(ctx)) == NULL) {
                THROW(SocketException, "Failed to create SSL connection: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }

        SSL_set_fd(ssl, s);

        if ((e = SSL_connect(ssl)) != 1) {
                THROW(SocketException, "Failed SSL/TLS handshake with client: %s", String::join(getErrors(), ", ", '\0', "(no additional details)").c_str());
        }
}

void SecureTCPSocket::shutdown(void) throw () {
        usable = false;

        if (ssl && (SSL_get_shutdown(ssl) & SSL_SENT_SHUTDOWN) == 0) {
                if (SSL_shutdown(ssl) == 0) { /* Handle bidirectional shutdown. */
                        SSL_shutdown(ssl); /* Remote end read from socket, or it will miss the shutdown notify, timeout and this call will return an error. */
                }
        }
}

void SecureTCPSocket::close(void) throw (SocketException) {
        TCPSocket::close();

        if (ssl) {
                SSL_free(ssl);

                ssl = NULL;
        }
}

std::vector<std::string> SecureTCPSocket::getErrors(void) throw (SocketException) {
        int e;
        char buf[1024];
        std::vector<std::string> results;

        while ((e = ERR_get_error()) != 0) { /* Walks the error stack. */
                ERR_error_string_n(e, buf, sizeof(buf));

                results.push_back(buf);
        }

        return results;
}

int SecureTCPSocket::SSL_password_callback(char *buf, int num, int rwflag, void *userdata) {
        std::string *password = (std::string*) userdata;

        strncpy(buf, password->c_str(), num);

        return (int) password->size();
}

/*
** vim: noet ts=3 sw=3
*/