+++ /dev/null
-/*
- * Copyright (c) 2012-2014 Apple Inc. All Rights Reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- */
-
-
-#include <Security/SecureTransportPriv.h>
-#include <string.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <assert.h>
-
-#include <net/kext_net.h>
-
-#include "tlssocket.h"
-#include "tlsnke.h"
-
-#include <AssertMacros.h>
-#include <errno.h>
-
-/* TLSSocket functions */
-
-static
-int TLSSocket_Read(SSLRecordContextRef ref,
- SSLRecord *rec)
-{
- int socket = (int)ref;
- int rc;
- ssize_t sz;
- struct sockaddr_in client_addr;
- int avail;
- socklen_t avail_size;
- struct cmsghdr *cmsg;
- tls_record_hdr_t hdr;
- struct msghdr msg;
- struct iovec iov;
- int cbuf_len=CMSG_SPACE(sizeof(*hdr))+1024;
- uint8_t cbuf[cbuf_len];
-
-
- // printf("%s: Waiting for some data...\n", __FUNCTION__);
- /* PEEK only... */
- char b;
- rc = (int)recv(socket, &b, 1, MSG_PEEK);
-
- if(rc==-1)
- {
- if(errno==EAGAIN)
- return errSSLRecordWouldBlock;
- else {
- perror("recv");
- return errno;
- }
- }
-
- /* get the next packet size */
- avail_size = sizeof(avail);
- rc = getsockopt(socket, SOL_SOCKET, SO_NREAD, &avail, &avail_size);
-
- check_noerr(rc);
- check(avail_size==sizeof(avail));
-
- if(rc || (avail_size !=sizeof(avail)))
- return errSSLRecordInternal;
-
- // printf("%s: Available = %d\n", __FUNCTION__, avail);
-
- if(avail==0)
- return errSSLRecordWouldBlock;
-
-
- /* Allocate a buffer */
- rec->contents.data = malloc(avail);
- rec->contents.length = avail;
-
- /* read the message */
- iov.iov_base = rec->contents.data;
- iov.iov_len = rec->contents.length;
- msg.msg_name = &client_addr;
- msg.msg_namelen = sizeof(client_addr);
- msg.msg_iov = &iov;
- msg.msg_iovlen = 1;
- msg.msg_control = cbuf;
- msg.msg_controllen = cbuf_len;
-
- sz = recvmsg(socket, &msg, 0);
- check(sz==avail);
-
- // printf("%s: received = %ld, ctrl: l=%d f=%x\n", __FUNCTION__, sz, msg.msg_controllen, msg.msg_flags);
- rec->contents.length = sz;
-
- cmsg = CMSG_FIRSTHDR(&msg);
- check(cmsg);
- if(!cmsg)
- return 0;
-
- check(cmsg->cmsg_type == SCM_TLS_HEADER);
- check(cmsg->cmsg_level == SOL_SOCKET);
- check(cmsg->cmsg_len == CMSG_LEN(sizeof(*hdr)));
- hdr = (tls_record_hdr_t)CMSG_DATA(cmsg);
- check(hdr);
-
- /* print msg info */
- /*
- printf("%s: rc=%d, msg: %ld , cmsg = %d, %x, %x, hdr = %d, %x - from %s:%d\n", __FUNCTION__, rc,
- iov.iov_len,
- cmsg->cmsg_len, cmsg->cmsg_level, cmsg->cmsg_type,
- hdr->content_type, hdr->protocol_version,
- inet_ntoa(client_addr.sin_addr),ntohs(client_addr.sin_port));
- */
- rec->contentType = hdr->content_type;
- rec->protocolVersion = hdr->protocol_version;
-
- if(rec->contentType==SSL_RecordTypeChangeCipher) {
- printf("%s: Received ChangeCipherSpec message\n", __FUNCTION__);
- }
- return 0;
-}
-
-static
-int TLSSocket_Free(SSLRecordContextRef ref,
- SSLRecord rec)
-{
- free(rec.contents.data);
- return 0;
-}
-
-static
-int TLSSocket_Write(SSLRecordContextRef ref,
- SSLRecord rec)
-{
- int socket = (int)ref;
- ssize_t sz;
-
- struct msghdr msg;
- struct iovec iov;
- tls_record_hdr_t hdr;
- struct cmsghdr *cmsg;
- int cbuf_len=CMSG_SPACE(sizeof(*hdr));
- uint8_t cbuf[cbuf_len];
-
- if(rec.contentType==SSL_RecordTypeChangeCipher) {
- printf("%s: Sending ChangeCipherSpec message\n", __FUNCTION__);
- }
- // printf("%s: fd=%d, rec.len=%ld\n", __FUNCTION__, socket, rec.contents.length);
-
- /* write the message */
- iov.iov_base = rec.contents.data;
- iov.iov_len = rec.contents.length;
- msg.msg_name = NULL;
- msg.msg_namelen = 0;
- msg.msg_iov = &iov;
- msg.msg_iovlen = 1;
- msg.msg_control = cbuf;
- msg.msg_controllen = cbuf_len;
-
- cmsg = CMSG_FIRSTHDR(&msg);
- cmsg->cmsg_level = SOL_SOCKET;
- cmsg->cmsg_type = SCM_TLS_HEADER;
- cmsg->cmsg_len = CMSG_LEN(sizeof(*hdr));
- hdr = (tls_record_hdr_t)CMSG_DATA(cmsg);
- hdr->content_type = rec.contentType;
- hdr->protocol_version = rec.protocolVersion;
-
- /* print msg info */
- sz = sendmsg(socket, &msg, 0);
-
- if(sz<0)
- perror("sendmsg");
-
- /*
- printf("%s: sz=%ld, msg: %ld , cmsg = %d, %d, %04x\n", __FUNCTION__, sz,
- iov.iov_len,
- cmsg->cmsg_len, cmsg->cmsg_level, cmsg->cmsg_type);
- */
-
- check(sz==rec.contents.length);
-
- if(sz<0)
- return (int)sz;
- else
- return 0;
-}
-
-
-static
-int TLSSocket_InitPendingCiphers(SSLRecordContextRef ref,
- uint16_t selectedCipher,
- bool server,
- SSLBuffer key)
-{
- int socket = (int)ref;
- int rc;
- char *buf;
-
- buf = malloc(key.length+3);
- buf[0] = selectedCipher >> 8;
- buf[1] = selectedCipher & 0xff;
- buf[2] = server;
- memcpy(buf+3, key.data, key.length);
-
- printf("%s: cipher=%04x, keylen=%ld\n", __FUNCTION__, selectedCipher, key.length);
-
- rc = setsockopt(socket, SOL_SOCKET, SO_TLS_INIT_CIPHER, buf, (socklen_t)(key.length+3));
-
- printf("%s: rc=%d\n", __FUNCTION__, rc);
-
- free(buf);
-
- return rc;
-}
-
-static
-int TLSSocket_AdvanceWriteCipher(SSLRecordContextRef ref)
-{
- int socket = (int)ref;
- int rc;
- rc = setsockopt(socket, SOL_SOCKET, SO_TLS_ADVANCE_WRITE_CIPHER, NULL, 0);
-
- printf("%s: rc=%d\n", __FUNCTION__, rc);
-
- return rc;
-}
-
-static
-int TLSSocket_RollbackWriteCipher(SSLRecordContextRef ref)
-{
- int socket = (int)ref;
- int rc;
- rc = setsockopt(socket, SOL_SOCKET, SO_TLS_ROLLBACK_WRITE_CIPHER, NULL, 0);
-
- printf("%s: rc=%d\n", __FUNCTION__, rc);
-
- return rc;
-}
-
-static
-int TLSSocket_AdvanceReadCipher(SSLRecordContextRef ref)
-{
- int socket = (int)ref;
- int rc;
- rc = setsockopt(socket, SOL_SOCKET, SO_TLS_ADVANCE_READ_CIPHER, NULL, 0);
-
- printf("%s: rc=%d\n", __FUNCTION__, rc);
-
- return rc;
-}
-
-static
-int TLSSocket_SetProtocolVersion(SSLRecordContextRef ref,
- SSLProtocolVersion protocolVersion)
-{
- int socket = (int)ref;
- int rc;
- rc = setsockopt(socket, SOL_SOCKET, SO_TLS_PROTOCOL_VERSION, &protocolVersion, sizeof(protocolVersion));
-
- printf("%s: rc=%d\n", __FUNCTION__, rc);
-
- return rc;
-}
-
-
-static
-int TLSSocket_ServiceWriteQueue(SSLRecordContextRef ref)
-{
- int socket = (int)ref;
- int rc;
- rc = setsockopt(socket, SOL_SOCKET, SO_TLS_SERVICE_WRITE_QUEUE, NULL, 0);
-
- return rc;
-}
-
-
-static
-int TLSSocket_SetOption(SSLRecordContextRef ref,
- SSLRecordOption option,
- bool value)
-{
- /* This is not implemented, and is not needed for DTLS */
- return EINVAL;
-}
-
-const struct SSLRecordFuncs TLSSocket_Funcs = {
- .read = TLSSocket_Read,
- .write = TLSSocket_Write,
- .initPendingCiphers = TLSSocket_InitPendingCiphers,
- .advanceWriteCipher = TLSSocket_AdvanceWriteCipher,
- .rollbackWriteCipher = TLSSocket_RollbackWriteCipher,
- .advanceReadCipher = TLSSocket_AdvanceReadCipher,
- .setProtocolVersion = TLSSocket_SetProtocolVersion,
- .free = TLSSocket_Free,
- .serviceWriteQueue = TLSSocket_ServiceWriteQueue,
- .setOption = TLSSocket_SetOption,
-};
-
-
-/* TLSSocket SPIs */
-
-int TLSSocket_Attach(int socket)
-{
-
- /* Attach the TLS socket filter and return handle */
- struct so_nke so_tlsnke;
- int rc;
- int handle;
- socklen_t len;
-
- memset(&so_tlsnke, 0, sizeof(so_tlsnke));
- so_tlsnke.nke_handle = TLS_HANDLE_IP4;
- rc=setsockopt(socket, SOL_SOCKET, SO_NKE, &so_tlsnke, sizeof(so_tlsnke));
- if(rc)
- return rc;
-
- len = sizeof(handle);
- rc = getsockopt(socket, SOL_SOCKET, SO_TLS_HANDLE, &handle, &len);
- if(rc)
- return rc;
-
- assert(len==sizeof(handle));
-
- return handle;
-}
-
projects / apple / security.git / blobdiff