SSLSocket.cpp

Go to the documentation of this file.

/*
 *  REFERENCES
 *
 *  OPENSSL
 *      http://www.rtfm.com/sslbook/
 *      http://www.openssl.org/
 *
 *  SCHANNEL
 *      Windows SDKs
 *      MSDN/Win32 and COM/Security/Authentication/
 *          Using Authentication/Using SSPI/
 *          Creating a Secure Connection Using Schannel
 *
 *      Windows SDKs 2003
 *      Samples/
 */
 
#include <dcl/Config.h>
 
#if __DCL_WINDOWS
    #include <winsock2.h>
#else
    #include <sys/socket.h>
#endif
 
#if __DCL_USE_OPENSSL
    #include <openssl/ssl.h>
    #include <openssl/err.h>
    #include <dcl/Thread.h>
#elif __DCL_USE_SCHANNEL
    #define SEC_FAILED(ss)      (ss < 0)
#endif
 
#include <dcl/Object.h>
#include <dcl/Charset.h>
#include <dcl/Numeric.h>
#include <dcl/SSLSocket.h>
 
__DCL_BEGIN_NAMESPACE
 
#if __DCL_DEBUG
    #undef __THIS_FILE__
    static const char_t __THIS_FILE__[] = __T("dcl/SSLSocket.cpp");
#endif
 
IMPLEMENT_CLASSINFO(SSLException, Exception)
 
SSLException::SSLException(Exception* _cause)
    : Exception(_cause)
{
}
 
#if __DCL_USE_OPENSSL
SSLException::SSLException()
    : Exception(NULL)
{
    unsigned long e = ERR_get_error();
    char buf[256];
    ERR_error_string_n(e, buf, sizeof(buf));
 
    LocaleDecoder decoder;
    __message = decoder.decode(buf);
}
 
#elif __DCL_USE_SCHANNEL
static HMODULE __hSecure32_dll__ = NULL;
 
static String __GetStatusMessage(SECURITY_STATUS _ss)
{
    if (__hSecure32_dll__ == NULL)
        __hSecure32_dll__ = LoadLibraryW(__T("secure32.dll"));
 
    StringBuilder sb;
    wchar_t* msg = NULL;
    DWORD dwLength = FormatMessageW(
            FORMAT_MESSAGE_ALLOCATE_BUFFER | 
            FORMAT_MESSAGE_FROM_SYSTEM | 
            FORMAT_MESSAGE_IGNORE_INSERTS,
            __hSecure32_dll__,
            _ss,
            MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
            (LPWSTR) &msg,
            0,
            NULL 
            );
    
    if (dwLength > 0) {
        for ( ; dwLength; dwLength--)
            if (!(msg[dwLength - 1] == L'\r' || msg[dwLength - 1] == L'\n'))
                break;
 
        sb.assign(msg, dwLength);
        LocalFree(msg);
 
        sb += L" (ERROR=";
        sb += UInteger::toString(_ss, 10);
        sb += L")";
    }
    else
        sb = L"::FormatMessage Fail!";
 
    return sb;
}
 
SSLException::SSLException(SECURITY_STATUS _ss)
{
    __message = __GetStatusMessage(_ss);
}
#endif
 
String SSLException::toString() const
{
    return __message;
}
 
IMPLEMENT_CLASSINFO(SSLSocket, Socket)
 
size_t SSLSocket::available() const
            __DCL_THROWS1(IOException*)
{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
    __DCL_TRACE2(__T("%d, %d\n"), (int) Socket::available(), SSL_pending(__ssl));
    return (size_t) SSL_pending(__ssl);
#else
    return Socket::available();
#endif
}
 
#if 0
size_t SSLSocket::read(void* _buf, size_t _n)
            __DCL_THROWS1(IOException*);
 
size_t SSLSocket::write(const void* _buf, size_t _n)
            __DCL_THROWS1(IOException*);
 
 
void SSLSocket::bind(const Addr& _my_addr,
        int _type, int _protocol,   bool _reuse
        ) __DCL_THROWS1(IOException*);
 
void SSLSocket::accept(SSLSocket& _r)
        __DCL_THROWS1(IOException*);
 
void SSLSocket::connect(const Addr& _serv_addr)
        __DCL_THROWS1(IOException*);
#endif
 
#if __DCL_USE_OPENSSL
static Thread::OnceType __opensslOnceControl = Thread::ONCE_INIT;
 
static void __opensslLibraryInit()
{
    SSL_library_init();
    SSL_load_error_strings();
}
#endif
 
#if 0
int SSLSocket::pem_passwd_cb(char* _buf, int _size, int _rwflag, void* _userdata)
{
    SSLSocket* obj = (SSLSocket*) _userdata;
    return obj->onPermPasswordCallback(_buf, _size, _rwflag);
}
 
int SSLSocket::onPermPasswordCallback(char* _buf, int _size, int _rwflag)
{
    int n = (int) __defaultPassword.length() > (_size - 1) ? (_size - 1)
        : (int) __defaultPassword.length();
    strncpy(_buf, __defaultPassword.data(), n);
    _buf[n] = '\0';
    return n;
}
 
bool SSLSocket::__opensslContextInit(const char* _keyfile)
{
    Thread::once(__opensslOnceControl, __opensslLibraryInit);
    
    SSL_CTX* ctx = NULL;
 
    ctx = SSL_CTX_new(SSLv23_method());
 
 
    if (!(SSL_CTX_use_certificate_chain_file(ctx, "client.pem"))) {
        __DCL_TRACE0(__T("Can't read certificate file\n"));
        goto __failed;
    }
    SSL_CTX_set_default_passwd_cb(ctx, SSLSocket::pem_passwd_cb);
    SSL_CTX_set_default_passwd_cb_userdata(ctx, this);
 
    if (!(SSL_CTX_use_PrivateKey_file(ctx, "client.pem", SSL_FILETYPE_PEM))) {
        __DCL_TRACE0(__T("Can't read key file\n"));
        goto __failed;
    }
 
#define CA_LIST "root.pem"
 
    if( !(SSL_CTX_load_verify_locations(ctx, CA_LIST, 0))) {
        __DCL_TRACE0(__T("Can't read CA list\n"));
        goto __failed;
    }
 
#if (OPENSSL_VERSION_NUMBER < 0x00905100L)
    SSL_CTX_set_verify_depth(ctx,1);
#endif
 
    __ctx = ctx;
    return true;
 
__failed:
    if (ctx)
        SSL_CTX_free(ctx);
    return false;
}
 
#endif
 
void SSLSocket::construct()
        __DCL_THROWS1(SSLException*)
{
#if __DCL_USE_OPENSSL
    Thread::once(__opensslOnceControl, __opensslLibraryInit);
    __ctx = NULL;
    __ssl = NULL;
    SSL_CTX* ctx = SSL_CTX_new(SSLv23_method());
    if (ctx == NULL)
        throw new SSLException();
    __ctx = ctx;
 
#elif __DCL_USE_SCHANNEL
    SecInvalidateHandle(&__cred);
    SecInvalidateHandle(&__ctxt);
 
    CredHandle      cred;
    SCHANNEL_CRED   credData;
    TimeStamp       tsExpiry;
 
    ZeroMemory(&credData, sizeof(credData));
    credData.dwVersion = SCHANNEL_CRED_VERSION;
    // Specify the TLS V1.0 (client-side) security protocol.
    // credData.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT; 
 
    credData.dwFlags |= SCH_CRED_NO_DEFAULT_CREDS;
    credData.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
 
    SECURITY_STATUS ss = AcquireCredentialsHandleW(
        NULL,                   // __in     SEC_CHAR* pszPrincipal, default principal
        UNISP_NAME_W,           // __in     SEC_CHAR* pszPackage, for Schannel
        SECPKG_CRED_OUTBOUND,   // __in     ULONG fCredentialUse,
        NULL,                   // __in     PLUID pvLogonID, use the current LOGON id
        &credData,              // __in     PVOID pAuthData, protocol-specific data
        NULL,                   // __in     SEC_GET_KEY_FN pGetKeyFn, default
        NULL,                   // __in     PVOID pvGetKeyArgument, default
        &cred,                  // __out    PCredHandle phCredential,
        &tsExpiry               // __out    PTimeStamp ptsExpiry
        );
    if (ss != SEC_E_OK)
        throw new SSLException(ss);
 
    __cred = cred;
#endif
}
 
SSLSocket::SSLSocket()
        __DCL_THROWS1(SSLException*)
{
    construct();
}
 
SSLSocket::SSLSocket(const String& _addr, uint16_t _port)
            __DCL_THROWS2(IOException*, SSLException*)
{
    construct();
    Socket::open(_addr, _port);
}
 
SSLSocket::~SSLSocket()
{
#if __DCL_USE_OPENSSL
    if (__ssl)
#elif __DCL_USE_SCHANNEL
    if (SecIsValidHandle(&__ctxt))
#endif
    {
        try {
            close();
        }
        catch (Exception* cause) {
            __DCL_TRACE1(__T("Error! SSLSocket::~SSLSocket %ls\n"), cause->toString().data());
            cause->destroy();
        }
    }
 
#if __DCL_USE_OPENSSL
    if (__ctx) {
        SSL_CTX_free(__ctx);
    #if __DCL_DEBUG
        __ctx = NULL;
    #endif
    }
 
#elif __DCL_USE_SCHANNEL
    if (SecIsValidHandle(&__cred)) {
        SECURITY_STATUS ss = FreeCredentialsHandle(&__cred);
    #if __DCL_DEBUG
        if (ss != SEC_E_OK)
            __DCL_TRACE1(__T("Warning!! [%ls]\n"), __GetStatusMessage(ss).data());
        SecInvalidateHandle(&__cred);
    #endif
    }
 
#endif
}
 
void SSLSocket::close()
        __DCL_THROWS1(IOException*)
{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ssl != NULL);
    SSL_free(__ssl);
    __ssl = NULL;
 
#elif __DCL_USE_SCHANNEL
    __DCL_ASSERT_HANDLE(SecIsValidHandle(&__ctxt));
    SECURITY_STATUS ss = DeleteSecurityContext(&__ctxt);
    #if __DCL_DEBUG
    if (ss != SEC_E_OK)
        __DCL_TRACE1(__T("Warning!! [%ls]\n"), __GetStatusMessage(ss).data());
    #endif
    SecInvalidateHandle(&__ctxt);
 
#endif
    
    Socket::close();
}
 
#if 0
void SSLSocket::bind(const struct sockaddr* _my_addr, socklen_t _addrlen)
        __DCL_THROWS1(IOException*);
 
void SSLSocket::listen(unsigned _backlog)
        __DCL_THROWS1(IOException*);
 
void SSLSocket::accept(SSLSocket& r, struct sockaddr* _addr, socklen_t* _addrlen)
        __DCL_THROWS1(IOException*);
 
#endif
 
void SSLSocket::connect(const sockaddr* _serv_addr, socklen_t _addrlen)
        __DCL_THROWS1(IOException*)
{
    Socket::connect(_serv_addr, _addrlen);
 
    __DCL_TRACE0(__T("SSLSocket::connect()\n"));
 
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl == NULL);
    __ssl = SSL_new(__ctx);
    BIO* bio = BIO_new_socket(__handle, BIO_NOCLOSE);
 
    SSL_set_bio(__ssl, bio, bio);
 
    if (SSL_connect(__ssl) < 0)
        throw new IOException(toString(), new SSLException());
 
#elif __DCL_USE_SCHANNEL
    DWORD fContextReq = ISC_REQ_SEQUENCE_DETECT   |
            ISC_REQ_REPLAY_DETECT     |
            ISC_REQ_CONFIDENTIALITY   |
            ISC_RET_EXTENDED_ERROR    |
            ISC_REQ_ALLOCATE_MEMORY   |
            ISC_REQ_STREAM;
 
    SecBufferDesc   outBufferDesc;
    SecBuffer       outBuffers[1];
 
    outBuffers[0].BufferType = SECBUFFER_TOKEN;
    outBuffers[0].cbBuffer = 0;
    outBuffers[0].pvBuffer = NULL;
    outBufferDesc.ulVersion = SECBUFFER_VERSION;
    outBufferDesc.cBuffers = 1;
    outBufferDesc.pBuffers = outBuffers;
 
    CtxtHandle  ctxt;
    ULONG       ctxtAttr;
    TimeStamp   tsExpiry;
 
    SECURITY_STATUS ss = InitializeSecurityContextW(
        &__cred,                // __in         PCredHandle phCredential,
        NULL,                   // __in_out PCtxtHandle phContext,
        NULL,                   // __in         SEC_CHAR* pszTargetName,
        fContextReq,            // __in         ULONG fContextReq,
        0,                      // ULONG Reserved1,
        0,                      // __in         ULONG TargetDataRep,
        NULL,                   // __in_out PSecBufferDesc pInput,
        0,                      // ULONG Reserved2,
        &ctxt,                  // __in_out PCtxtHandle phNewContext,
        &outBufferDesc,         // __out        PSecBufferDesc pOutput,
        &ctxtAttr,              // __out        PULONG pfContextAttr,
        &tsExpiry               // __out        PTimeStamp ptsExpiry
        );
 
    if (FAILED(ss))
        throw new IOException(toString(), new SSLException(ss));
 
    __DCL_TRACE1(__T("%ls\n"), __GetStatusMessage(ss).data());
 
    if (outBuffers[0].cbBuffer != 0 && outBuffers[0].pvBuffer != NULL) {
        __DCL_TRACE3(__T("%d, %d, [%ls]\n"),
            outBuffers[0].BufferType,
            outBuffers[0].cbBuffer,
            String::tryString((const char*) outBuffers[0].pvBuffer,
                outBuffers[0].cbBuffer, 8).data()
            );
        int n = ::send((UINT_PTR) __handle,
            (const char*) outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0);
        if (n == SOCKET_ERROR || n == 0) {
            FreeContextBuffer(outBuffers[0].pvBuffer);
            DeleteSecurityContext(&ctxt);
            throw new IOException(toString(), WSAGetLastError());
        }
 
        __DCL_TRACE1(__T("[%d] bytes of Handshake data sent\n"), n);
        FreeContextBuffer(outBuffers[0].pvBuffer);
        outBuffers[0].pvBuffer = NULL;
    }
 
    // Handshake
 
    SecBufferDesc   inBufferDesc;
    SecBuffer       inBuffers[2];
 
    DWORD WSAError = 0;
#define READ_BUFFER_SIZE    0x10000
    char* readBuffer = (char*) malloc(READ_BUFFER_SIZE);
    bool fDoRead = true;
    unsigned int nRead = 0;
 
    while (ss == SEC_I_CONTINUE_NEEDED ||
            ss == SEC_E_INCOMPLETE_MESSAGE ||
            ss == SEC_I_INCOMPLETE_CREDENTIALS) {
        if (0 == nRead || ss == SEC_E_INCOMPLETE_MESSAGE) {
            if (fDoRead) {
                int n = ::recv(
                    (UINT_PTR) __handle,
                    readBuffer + nRead,
                    READ_BUFFER_SIZE - nRead,
                    0
                    );
                if (n == SOCKET_ERROR) {
                    WSAError = WSAGetLastError();
                    ss = SEC_E_INTERNAL_ERROR;
                    break;
                }
                else if (n == 0) {
                    WSAError = WSAECONNRESET;
                    ss = SEC_E_INTERNAL_ERROR;
                    break;
                }
                __DCL_TRACE2(__T("Handshake read [%d] [%ls]\n"), n,
                    String::tryString((const char*) readBuffer + nRead, n, 8).data());
 
                nRead += n;
            }
            else
                fDoRead = true;
        }
 
        inBuffers[0].BufferType = SECBUFFER_TOKEN;
        inBuffers[0].cbBuffer = nRead;
        inBuffers[0].pvBuffer = readBuffer;
 
        inBuffers[1].BufferType = SECBUFFER_EMPTY;
        inBuffers[1].cbBuffer = 0;
        inBuffers[1].pvBuffer = NULL;
 
        inBufferDesc.ulVersion = SECBUFFER_VERSION;
        inBufferDesc.cBuffers = 2;
        inBufferDesc.pBuffers = inBuffers;
 
        outBuffers[0].BufferType = SECBUFFER_TOKEN;
        outBuffers[0].cbBuffer = 0;
        outBuffers[0].pvBuffer = NULL;
 
        outBufferDesc.ulVersion = SECBUFFER_VERSION;
        outBufferDesc.cBuffers = 1;
        outBufferDesc.pBuffers = outBuffers;
 
        ss = InitializeSecurityContextW(
                &__cred,
                &ctxt,
                NULL,
                fContextReq,
                0,
                SECURITY_NATIVE_DREP,
                &inBufferDesc,
                0,
                NULL,
                &outBufferDesc,
                &ctxtAttr,
                &tsExpiry
                );
 
        if (ss == SEC_E_OK ||
                ss == SEC_I_CONTINUE_NEEDED ||
                FAILED(ss) && (ctxtAttr & ISC_RET_EXTENDED_ERROR)) {
            if (outBuffers[0].cbBuffer != 0 && outBuffers[0].pvBuffer != NULL) {
                int n = ::send(
                    (UINT_PTR) __handle,
                    (const char*) outBuffers[0].pvBuffer,
                    outBuffers[0].cbBuffer,
                    0
                    );
                if (n == SOCKET_ERROR || n == 0) {
                    WSAError = WSAGetLastError();
                    FreeContextBuffer(outBuffers[0].pvBuffer);
                    DeleteSecurityContext(&ctxt);
                    ss = SEC_E_INTERNAL_ERROR;
                    break;
                }
 
                __DCL_TRACE1(__T("[%d] bytes of Handshake data sent\n"), n);
                FreeContextBuffer(outBuffers[0].pvBuffer);
                outBuffers[0].pvBuffer = NULL;
            }
        }
 
        if (ss == SEC_E_INCOMPLETE_MESSAGE) {
            __DCL_TRACE0(__T("====================== SEC_E_INCOMPLETE_MESSAGE =====================\n"));
            continue;
        }
 
        __DCL_TRACE1(__T("Before OK[%u]\n"), ss);
        if (ss == SEC_E_OK) {
            __DCL_TRACE0(__T("Handshake was successful\n"));
 
            if (inBuffers[1].BufferType == SECBUFFER_EXTRA) {
                __DCL_TRACE1(__T("Extad data [%d] bytes\n"), inBuffers[1].cbBuffer);
            }
 
            break;
        }
 
        __DCL_TRACE2(__T("[%u][%ls]\n"), ss, __GetStatusMessage(ss).data());
 
        if(ss == SEC_I_INCOMPLETE_CREDENTIALS) {
            __DCL_TRACE0(__T("SEC_I_INCOMPLETE_CREDENTIALS\n"));
 
            // Get New client Credentials
 
            break;
 
            fDoRead = false;
            ss = SEC_I_CONTINUE_NEEDED;
            continue;
        }
    
        if (inBuffers[1].BufferType == SECBUFFER_EXTRA) {
            __DCL_TRACE1(__T("Extad data [%d] bytes\n"), inBuffers[1].cbBuffer);
            memcpy(readBuffer,
                readBuffer + (nRead - inBuffers[1].cbBuffer),
                inBuffers[1].cbBuffer
                );
            nRead = inBuffers[1].cbBuffer;
        }
        else
            nRead = 0;
    }
 
    free(readBuffer);
 
    if (FAILED(ss)) {
        DeleteSecurityContext(&ctxt);
    }
    else
        __ctxt = ctxt;
 
#endif
}
 
size_t SSLSocket::send(const void* _buf, size_t _n, int _flags)
        __DCL_THROWS1(IOException*)
{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    __DCL_TRACE2(__T("SSLSocket::send(%p, %zd)\n"), _buf, _n);
 
    int n = (int) _n;
    int r = SSL_write(__ssl, _buf, (int) _n);
 
    __DCL_TRACE1(__T("SSLSocket::SSL_write(%d)\n"),r);
 
    if (r > 0)
        return (size_t) r;
 
    switch(SSL_get_error(__ssl, r)) {      
        case SSL_ERROR_NONE:
            if(n != r)
                __DCL_TRACE0(__T("Incomplete write!\n"));
            break;
        default:
            throw new IOException(toString(), new SSLException());
    }
#endif
 
    return 0;
}
 
size_t SSLSocket::recv(void* _buf, size_t _n, int _flags)
        __DCL_THROWS1(IOException*)
{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    __DCL_TRACE2(__T("SSLSocket::recv(%p, %zd)\n"), _buf, _n);
 
    __DCL_TRACE2(__T("before avail[%zd], pending[%d]\n"),
        Socket::available(), SSL_pending(__ssl));
    int n = (int) _n;
    int r = SSL_read(__ssl, _buf, n);
    __DCL_TRACE1(__T("SSLSocket::SSL_read(%d)\n"), r);
    __DCL_TRACE2(__T("after avail[%zd], pending[%d]\n"),
        Socket::available(), SSL_pending(__ssl));
    if (r > 0)
        return (size_t) r;
    
    switch (SSL_get_error(__ssl, r)) {
        case SSL_ERROR_ZERO_RETURN:
            __DCL_TRACE0(__T("SSL error zero return\n"));
            // ssl close notify, and send close notify
            SSL_shutdown(__ssl);
            break;
        case SSL_ERROR_SYSCALL:
            __DCL_TRACE0(__T("SSL Error: Premature close\n"));
            break;
        default:
            throw new IOException(toString(), new SSLException());
    }
#endif
    // DWORD dw = SCHANNEL_SHUTDOWN;
 
    return 0;
}
 
bool SSLSocket::isPeerCertificateVerified() const
{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    return SSL_get_verify_result(__ssl) !=X509_V_OK;
#endif
    return false;
}
 
String SSLSocket::getPeerCertificateCommonName() const
{
    String s;
 
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    char peer_CN[512];
    
    X509* peer = SSL_get_peer_certificate(__ssl);
    if (peer) {
        int r = X509_NAME_get_text_by_NID(
            X509_get_subject_name(peer),
            NID_commonName,
            peer_CN,
            sizeof(peer_CN)
            );
 
        if (r > 0) {
            LocaleDecoder decoder;
            s = decoder.decode(peer_CN);
        }
    }
 
#endif
    return s;
}
 
__DCL_END_NAMESPACE