diff options
Diffstat (limited to 'demos')
52 files changed, 0 insertions, 5221 deletions
diff --git a/demos/README b/demos/README deleted file mode 100644 index d2155ef9734..00000000000 --- a/demos/README +++ /dev/null @@ -1,9 +0,0 @@ -NOTE: Don't expect any of these programs to work with current -OpenSSL releases, or even with later SSLeay releases. - -Original README: -============================================================================= - -Some demo programs sent to me by various people - -eric diff --git a/demos/b64.c b/demos/b64.c deleted file mode 100644 index 8e248e7e728..00000000000 --- a/demos/b64.c +++ /dev/null @@ -1,270 +0,0 @@ -/* demos/b64.c */ -/* Copyright (C) 1995-1998 Eric Young ([email protected]) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young ([email protected]). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson ([email protected]). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young ([email protected])" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson ([email protected])" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#include "../apps/apps.h" -#include <openssl/buffer.h> -#include <openssl/err.h> -#include <openssl/evp.h> -#include <openssl/objects.h> -#include <openssl/x509.h> -#include <openssl/pem.h> - -#undef SIZE -#undef BSIZE -#undef PROG - -#define SIZE (512) -#define BSIZE (8*1024) -#define PROG enc_main - -int main(argc,argv) -int argc; -char **argv; - { - char *strbuf=NULL; - unsigned char *buff=NULL,*bufsize=NULL; - int bsize=BSIZE,verbose=0; - int ret=1,inl; - unsigned char key[24],iv[MD5_DIGEST_LENGTH]; - char *str=NULL; - char *hkey=NULL,*hiv=NULL; - int enc=1,printkey=0,i,base64=0; - int debug=0; - EVP_CIPHER *cipher=NULL,*c; - char *inf=NULL,*outf=NULL; - BIO *in=NULL,*out=NULL,*b64=NULL,*benc=NULL,*rbio=NULL,*wbio=NULL; -#define PROG_NAME_SIZE 16 - char pname[PROG_NAME_SIZE]; - - - apps_startup(); - - if (bio_err == NULL) - if ((bio_err=BIO_new(BIO_s_file())) != NULL) - BIO_set_fp(bio_err,stderr,BIO_NOCLOSE); - - base64=1; - - argc--; - argv++; - while (argc >= 1) - { - if (strcmp(*argv,"-e") == 0) - enc=1; - if (strcmp(*argv,"-in") == 0) - { - if (--argc < 1) goto bad; - inf= *(++argv); - } - else if (strcmp(*argv,"-out") == 0) - { - if (--argc < 1) goto bad; - outf= *(++argv); - } - else if (strcmp(*argv,"-d") == 0) - enc=0; - else if (strcmp(*argv,"-v") == 0) - verbose=1; - else if (strcmp(*argv,"-debug") == 0) - debug=1; - else if (strcmp(*argv,"-bufsize") == 0) - { - if (--argc < 1) goto bad; - bufsize=(unsigned char *)*(++argv); - } - else - { - BIO_printf(bio_err,"unknown option '%s'\n",*argv); -bad: - BIO_printf(bio_err,"options are\n"); - BIO_printf(bio_err,"%-14s input file\n","-in <file>"); - BIO_printf(bio_err,"%-14s output file\n","-out <file>"); - BIO_printf(bio_err,"%-14s encode\n","-e"); - BIO_printf(bio_err,"%-14s decode\n","-d"); - BIO_printf(bio_err,"%-14s buffer size\n","-bufsize <n>"); - - goto end; - } - argc--; - argv++; - } - - if (bufsize != NULL) - { - int i; - unsigned long n; - - for (n=0; *bufsize; bufsize++) - { - i= *bufsize; - if ((i <= '9') && (i >= '0')) - n=n*10+i-'0'; - else if (i == 'k') - { - n*=1024; - bufsize++; - break; - } - } - if (*bufsize != '\0') - { - BIO_printf(bio_err,"invalid 'bufsize' specified.\n"); - goto end; - } - - /* It must be large enough for a base64 encoded line */ - if (n < 80) n=80; - - bsize=(int)n; - if (verbose) BIO_printf(bio_err,"bufsize=%d\n",bsize); - } - - strbuf=OPENSSL_malloc(SIZE); - buff=(unsigned char *)OPENSSL_malloc(EVP_ENCODE_LENGTH(bsize)); - if ((buff == NULL) || (strbuf == NULL)) - { - BIO_printf(bio_err,"OPENSSL_malloc failure\n"); - goto end; - } - - in=BIO_new(BIO_s_file()); - out=BIO_new(BIO_s_file()); - if ((in == NULL) || (out == NULL)) - { - ERR_print_errors(bio_err); - goto end; - } - if (debug) - { - BIO_set_callback(in,BIO_debug_callback); - BIO_set_callback(out,BIO_debug_callback); - BIO_set_callback_arg(in,bio_err); - BIO_set_callback_arg(out,bio_err); - } - - if (inf == NULL) - BIO_set_fp(in,stdin,BIO_NOCLOSE); - else - { - if (BIO_read_filename(in,inf) <= 0) - { - perror(inf); - goto end; - } - } - - if (outf == NULL) - BIO_set_fp(out,stdout,BIO_NOCLOSE); - else - { - if (BIO_write_filename(out,outf) <= 0) - { - perror(outf); - goto end; - } - } - - rbio=in; - wbio=out; - - if (base64) - { - if ((b64=BIO_new(BIO_f_base64())) == NULL) - goto end; - if (debug) - { - BIO_set_callback(b64,BIO_debug_callback); - BIO_set_callback_arg(b64,bio_err); - } - if (enc) - wbio=BIO_push(b64,wbio); - else - rbio=BIO_push(b64,rbio); - } - - for (;;) - { - inl=BIO_read(rbio,(char *)buff,bsize); - if (inl <= 0) break; - if (BIO_write(wbio,(char *)buff,inl) != inl) - { - BIO_printf(bio_err,"error writing output file\n"); - goto end; - } - } - BIO_flush(wbio); - - ret=0; - if (verbose) - { - BIO_printf(bio_err,"bytes read :%8ld\n",BIO_number_read(in)); - BIO_printf(bio_err,"bytes written:%8ld\n",BIO_number_written(out)); - } -end: - if (strbuf != NULL) OPENSSL_free(strbuf); - if (buff != NULL) OPENSSL_free(buff); - if (in != NULL) BIO_free(in); - if (out != NULL) BIO_free(out); - if (benc != NULL) BIO_free(benc); - if (b64 != NULL) BIO_free(b64); - EXIT(ret); - } - diff --git a/demos/b64.pl b/demos/b64.pl deleted file mode 100644 index 8aa5fb464d3..00000000000 --- a/demos/b64.pl +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/local/bin/perl - -# -# Make PEM encoded data have lines of 64 bytes of data -# - -while (<>) - { - if (/^-----BEGIN/ .. /^-----END/) - { - if (/^-----BEGIN/) { $first=$_; next; } - if (/^-----END/) { $last=$_; next; } - $out.=$_; - } - } -$out =~ s/\s//g; -$out =~ s/(.{64})/$1\n/g; -print "$first$out\n$last\n"; - - diff --git a/demos/bio/Makefile b/demos/bio/Makefile deleted file mode 100644 index 43515405323..00000000000 --- a/demos/bio/Makefile +++ /dev/null @@ -1,16 +0,0 @@ -CC=cc -CFLAGS= -g -I../../include -LIBS= -L../.. ../../libssl.a ../../libcrypto.a -EXAMPLES=saccept sconnect - -all: $(EXAMPLES) - -saccept: saccept.o - $(CC) -o saccept saccept.o $(LIBS) - -sconnect: sconnect.o - $(CC) -o sconnect sconnect.o $(LIBS) - -clean: - rm -f $(EXAMPLES) *.o - diff --git a/demos/bio/README b/demos/bio/README deleted file mode 100644 index 0b24e5b80cc..00000000000 --- a/demos/bio/README +++ /dev/null @@ -1,3 +0,0 @@ -This directory contains some simple examples of the use of BIO's -to simplify socket programming. - diff --git a/demos/bio/saccept.c b/demos/bio/saccept.c deleted file mode 100644 index 933d6699ee3..00000000000 --- a/demos/bio/saccept.c +++ /dev/null @@ -1,107 +0,0 @@ -/* NOCW */ -/* demos/bio/saccept.c */ - -/* A minimal program to server an SSL connection. - * It uses blocking. - * saccept host:port - * host is the interface IP to use. If any interface, use *:port - * The default it *:4433 - * - * cc -I../../include saccept.c -L../.. -lssl -lcrypto - */ - -#include <stdio.h> -#include <signal.h> -#include <openssl/err.h> -#include <openssl/ssl.h> - -#define CERT_FILE "server.pem" - -BIO *in=NULL; - -void close_up() - { - if (in != NULL) - BIO_free(in); - } - -int main(argc,argv) -int argc; -char *argv[]; - { - char *port=NULL; - BIO *ssl_bio,*tmp; - SSL_CTX *ctx; - SSL *ssl; - char buf[512]; - int ret=1,i; - - if (argc <= 1) - port="*:4433"; - else - port=argv[1]; - - signal(SIGINT,close_up); - - SSL_load_error_strings(); - - /* Add ciphers and message digests */ - OpenSSL_add_ssl_algorithms(); - - ctx=SSL_CTX_new(SSLv23_server_method()); - if (!SSL_CTX_use_certificate_file(ctx,CERT_FILE,SSL_FILETYPE_PEM)) - goto err; - if (!SSL_CTX_use_PrivateKey_file(ctx,CERT_FILE,SSL_FILETYPE_PEM)) - goto err; - if (!SSL_CTX_check_private_key(ctx)) - goto err; - - /* Setup server side SSL bio */ - ssl=SSL_new(ctx); - ssl_bio=BIO_new_ssl(ctx,0); - - if ((in=BIO_new_accept(port)) == NULL) goto err; - - /* This means that when a new connection is acceptede on 'in', - * The ssl_bio will be 'dupilcated' and have the new socket - * BIO push into it. Basically it means the SSL BIO will be - * automatically setup */ - BIO_set_accept_bios(in,ssl_bio); - -again: - /* The first call will setup the accept socket, and the second - * will get a socket. In this loop, the first actual accept - * will occur in the BIO_read() function. */ - - if (BIO_do_accept(in) <= 0) goto err; - - for (;;) - { - i=BIO_read(in,buf,512); - if (i == 0) - { - /* If we have finished, remove the underlying - * BIO stack so the next time we call any function - * for this BIO, it will attempt to do an - * accept */ - printf("Done\n"); - tmp=BIO_pop(in); - BIO_free_all(tmp); - goto again; - } - if (i < 0) goto err; - fwrite(buf,1,i,stdout); - fflush(stdout); - } - - ret=0; -err: - if (ret) - { - ERR_print_errors_fp(stderr); - } - if (in != NULL) BIO_free(in); - exit(ret); - return(!ret); - } - diff --git a/demos/bio/sconnect.c b/demos/bio/sconnect.c deleted file mode 100644 index 87b380b258c..00000000000 --- a/demos/bio/sconnect.c +++ /dev/null @@ -1,116 +0,0 @@ -/* NOCW */ -/* demos/bio/sconnect.c */ - -/* A minimal program to do SSL to a passed host and port. - * It is actually using non-blocking IO but in a very simple manner - * sconnect host:port - it does a 'GET / HTTP/1.0' - * - * cc -I../../include sconnect.c -L../.. -lssl -lcrypto - */ -#include <stdio.h> -#include <stdlib.h> -#include <unistd.h> -#include <openssl/err.h> -#include <openssl/ssl.h> - -extern int errno; - -int main(argc,argv) -int argc; -char *argv[]; - { - char *host; - BIO *out; - char buf[1024*10],*p; - SSL_CTX *ssl_ctx=NULL; - SSL *ssl; - BIO *ssl_bio; - int i,len,off,ret=1; - - if (argc <= 1) - host="localhost:4433"; - else - host=argv[1]; - - /* Lets get nice error messages */ - SSL_load_error_strings(); - - /* Setup all the global SSL stuff */ - OpenSSL_add_ssl_algorithms(); - ssl_ctx=SSL_CTX_new(SSLv23_client_method()); - - /* Lets make a SSL structure */ - ssl=SSL_new(ssl_ctx); - SSL_set_connect_state(ssl); - - /* Use it inside an SSL BIO */ - ssl_bio=BIO_new(BIO_f_ssl()); - BIO_set_ssl(ssl_bio,ssl,BIO_CLOSE); - - /* Lets use a connect BIO under the SSL BIO */ - out=BIO_new(BIO_s_connect()); - BIO_set_conn_hostname(out,host); - BIO_set_nbio(out,1); - out=BIO_push(ssl_bio,out); - - p="GET / HTTP/1.0\r\n\r\n"; - len=strlen(p); - - off=0; - for (;;) - { - i=BIO_write(out,&(p[off]),len); - if (i <= 0) - { - if (BIO_should_retry(out)) - { - fprintf(stderr,"write DELAY\n"); - sleep(1); - continue; - } - else - { - goto err; - } - } - off+=i; - len-=i; - if (len <= 0) break; - } - - for (;;) - { - i=BIO_read(out,buf,sizeof(buf)); - if (i == 0) break; - if (i < 0) - { - if (BIO_should_retry(out)) - { - fprintf(stderr,"read DELAY\n"); - sleep(1); - continue; - } - goto err; - } - fwrite(buf,1,i,stdout); - } - - ret=1; - - if (0) - { -err: - if (ERR_peek_error() == 0) /* system call error */ - { - fprintf(stderr,"errno=%d ",errno); - perror("error"); - } - else - ERR_print_errors_fp(stderr); - } - BIO_free_all(out); - if (ssl_ctx != NULL) SSL_CTX_free(ssl_ctx); - exit(!ret); - return(ret); - } - diff --git a/demos/bio/server.pem b/demos/bio/server.pem deleted file mode 100644 index 5cf1387d65d..00000000000 --- a/demos/bio/server.pem +++ /dev/null @@ -1,30 +0,0 @@ -subject=/C=AU/SP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server -issuer= /C=AU/SP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA ------BEGIN X509 CERTIFICATE----- - -MIIBgjCCASwCAQQwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV -BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MTAwOTIz -MzIwNVoXDTk4MDcwNTIzMzIwNVowYDELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM -RDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRkLjELMAkGA1UECxMCQ1MxGzAZBgNV -BAMTElNTTGVheSBkZW1vIHNlcnZlcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC3 -LCXcScWua0PFLkHBLm2VejqpA1F4RQ8q0VjRiPafjx/Z/aWH3ipdMVvuJGa/wFXb -/nDFLDlfWp+oCPwhBtVPAgMBAAEwDQYJKoZIhvcNAQEEBQADQQArNFsihWIjBzb0 -DCsU0BvL2bvSwJrPEqFlkDq3F4M6EGutL9axEcANWgbbEdAvNJD1dmEmoWny27Pn -IMs6ZOZB ------END X509 CERTIFICATE----- ------BEGIN RSA PRIVATE KEY----- - -MIIBPAIBAAJBALcsJdxJxa5rQ8UuQcEubZV6OqkDUXhFDyrRWNGI9p+PH9n9pYfe -Kl0xW+4kZr/AVdv+cMUsOV9an6gI/CEG1U8CAwEAAQJAXJMBZ34ZXHd1vtgL/3hZ -hexKbVTx/djZO4imXO/dxPGRzG2ylYZpHmG32/T1kaHpZlCHoEPgHoSzmxYXfxjG -sQIhAPmZ/bQOjmRUHM/VM2X5zrjjM6z18R1P6l3ObFwt9FGdAiEAu943Yh9SqMRw -tL0xHGxKmM/YJueUw1gB6sLkETN71NsCIQCeT3RhoqXfrpXDoEcEU+gwzjI1bpxq -agiNTOLfqGoA5QIhAIQFYjgzONxex7FLrsKBm16N2SFl5pXsN9SpRqqL2n63AiEA -g9VNIQ3xwpw7og3IbONifeku+J9qGMGQJMKwSTwrFtI= ------END RSA PRIVATE KEY----- - ------BEGIN DH PARAMETERS----- -MEYCQQDaWDwW2YUiidDkr3VvTMqS3UvlM7gE+w/tlO+cikQD7VdGUNNpmdsp13Yn -a6LT1BLiGPTdHghM9tgAPnxHdOgzAgEC ------END DH PARAMETERS----- - diff --git a/demos/eay/Makefile b/demos/eay/Makefile deleted file mode 100644 index 2d22eaca569..00000000000 --- a/demos/eay/Makefile +++ /dev/null @@ -1,24 +0,0 @@ -CC=cc -CFLAGS= -g -I../../include -#LIBS= -L../.. -lcrypto -lssl -LIBS= -L../.. ../../libssl.a ../../libcrypto.a - -# the file conn.c requires a file "proxy.h" which I couldn't find... -#EXAMPLES=base64 conn loadrsa -EXAMPLES=base64 loadrsa - -all: $(EXAMPLES) - -base64: base64.o - $(CC) -o base64 base64.o $(LIBS) -# -# sorry... can't find "proxy.h" -#conn: conn.o -# $(CC) -o conn conn.o $(LIBS) - -loadrsa: loadrsa.o - $(CC) -o loadrsa loadrsa.o $(LIBS) - -clean: - rm -f $(EXAMPLES) *.o - diff --git a/demos/eay/base64.c b/demos/eay/base64.c deleted file mode 100644 index 4b8b0627d19..00000000000 --- a/demos/eay/base64.c +++ /dev/null @@ -1,49 +0,0 @@ -/* This is a simple example of using the base64 BIO to a memory BIO and then - * getting the data. - */ -#include <stdio.h> -#include <openssl/bio.h> -#include <openssl/evp.h> - -main() - { - int i; - BIO *mbio,*b64bio,*bio; - char buf[512]; - char *p; - - mbio=BIO_new(BIO_s_mem()); - b64bio=BIO_new(BIO_f_base64()); - - bio=BIO_push(b64bio,mbio); - /* We now have bio pointing at b64->mem, the base64 bio encodes on - * write and decodes on read */ - - for (;;) - { - i=fread(buf,1,512,stdin); - if (i <= 0) break; - BIO_write(bio,buf,i); - } - /* We need to 'flush' things to push out the encoding of the - * last few bytes. There is special encoding if it is not a - * multiple of 3 - */ - BIO_flush(bio); - - printf("We have %d bytes available\n",BIO_pending(mbio)); - - /* We will now get a pointer to the data and the number of elements. */ - /* hmm... this one was not defined by a macro in bio.h, it will be for - * 0.9.1. The other option is too just read from the memory bio. - */ - i=(int)BIO_ctrl(mbio,BIO_CTRL_INFO,0,(char *)&p); - - printf("%d\n",i); - fwrite("---\n",1,4,stdout); - fwrite(p,1,i,stdout); - fwrite("---\n",1,4,stdout); - - /* This call will walk the chain freeing all the BIOs */ - BIO_free_all(bio); - } diff --git a/demos/eay/conn.c b/demos/eay/conn.c deleted file mode 100644 index c4b8f5163e1..00000000000 --- a/demos/eay/conn.c +++ /dev/null @@ -1,105 +0,0 @@ -/* NOCW */ -/* demos/eay/conn.c */ - -/* A minimal program to connect to a port using the sock4a protocol. - * - * cc -I../../include conn.c -L../.. -lcrypto - */ -#include <stdio.h> -#include <stdlib.h> -#include <openssl/err.h> -#include <openssl/bio.h> -/* #include "proxy.h" */ - -extern int errno; - -int main(argc,argv) -int argc; -char *argv[]; - { - PROXY *pxy; - char *host; - char buf[1024*10],*p; - BIO *bio; - int i,len,off,ret=1; - - if (argc <= 1) - host="localhost:4433"; - else - host=argv[1]; - - /* Lets get nice error messages */ - ERR_load_crypto_strings(); - - /* First, configure proxy settings */ - pxy=PROXY_new(); - PROXY_add_server(pxy,PROXY_PROTOCOL_SOCKS,"gromit:1080"); - - bio=BIO_new(BIO_s_socks4a_connect()); - - BIO_set_conn_hostname(bio,host); - BIO_set_proxies(bio,pxy); - BIO_set_socks_userid(bio,"eay"); - BIO_set_nbio(bio,1); - - p="GET / HTTP/1.0\r\n\r\n"; - len=strlen(p); - - off=0; - for (;;) - { - i=BIO_write(bio,&(p[off]),len); - if (i <= 0) - { - if (BIO_should_retry(bio)) - { - fprintf(stderr,"write DELAY\n"); - sleep(1); - continue; - } - else - { - goto err; - } - } - off+=i; - len-=i; - if (len <= 0) break; - } - - for (;;) - { - i=BIO_read(bio,buf,sizeof(buf)); - if (i == 0) break; - if (i < 0) - { - if (BIO_should_retry(bio)) - { - fprintf(stderr,"read DELAY\n"); - sleep(1); - continue; - } - goto err; - } - fwrite(buf,1,i,stdout); - } - - ret=1; - - if (0) - { -err: - if (ERR_peek_error() == 0) /* system call error */ - { - fprintf(stderr,"errno=%d ",errno); - perror("error"); - } - else - ERR_print_errors_fp(stderr); - } - BIO_free_all(bio); - if (pxy != NULL) PROXY_free(pxy); - exit(!ret); - return(ret); - } - diff --git a/demos/eay/loadrsa.c b/demos/eay/loadrsa.c deleted file mode 100644 index 79f1885ca4a..00000000000 --- a/demos/eay/loadrsa.c +++ /dev/null @@ -1,53 +0,0 @@ -#include <stdio.h> -#include <openssl/rsa.h> - -/* This is a simple program to generate an RSA private key. It then - * saves both the public and private key into a char array, then - * re-reads them. It saves them as DER encoded binary data. - */ - -void callback(stage,count,arg) -int stage,count; -char *arg; - { - FILE *out; - - out=(FILE *)arg; - fprintf(out,"%d",stage); - if (stage == 3) - fprintf(out,"\n"); - fflush(out); - } - -main() - { - RSA *rsa,*pub_rsa,*priv_rsa; - int len; - unsigned char buf[1024],*p; - - rsa=RSA_generate_key(512,RSA_F4,callback,(char *)stdout); - - p=buf; - - /* Save the public key into buffer, we know it will be big enough - * but we should really check how much space we need by calling the - * i2d functions with a NULL second parameter */ - len=i2d_RSAPublicKey(rsa,&p); - len+=i2d_RSAPrivateKey(rsa,&p); - - printf("The public and private key are now both in a char array\n"); - printf("and are taking up %d bytes\n",len); - - RSA_free(rsa); - - p=buf; - pub_rsa=d2i_RSAPublicKey(NULL,&p,(long)len); - len-=(p-buf); - priv_rsa=d2i_RSAPrivateKey(NULL,&p,(long)len); - - if ((pub_rsa == NULL) || (priv_rsa == NULL)) - ERR_print_errors_fp(stderr); - - RSA_free(pub_rsa); - RSA_free(priv_rsa); - } diff --git a/demos/maurice/Makefile b/demos/maurice/Makefile deleted file mode 100644 index f9bf62276e8..00000000000 --- a/demos/maurice/Makefile +++ /dev/null @@ -1,59 +0,0 @@ -CC=cc -CFLAGS= -g -I../../include -Wall -LIBS= -L../.. -lcrypto -EXAMPLES=example1 example2 example3 example4 - -all: $(EXAMPLES) - -example1: example1.o loadkeys.o - $(CC) -o example1 example1.o loadkeys.o $(LIBS) - -example2: example2.o loadkeys.o - $(CC) -o example2 example2.o loadkeys.o $(LIBS) - -example3: example3.o - $(CC) -o example3 example3.o $(LIBS) - -example4: example4.o - $(CC) -o example4 example4.o $(LIBS) - -clean: - rm -f $(EXAMPLES) *.o - -test: all - @echo - @echo Example 1 Demonstrates the sealing and opening APIs - @echo Doing the encrypt side... - ./example1 <README >t.t - @echo Doing the decrypt side... - ./example1 -d <t.t >t.2 - diff t.2 README - rm -f t.t t.2 - @echo example1 is OK - - @echo - @echo Example2 Demonstrates rsa encryption and decryption - @echo and it should just print \"This the clear text\" - ./example2 - - @echo - @echo Example3 Demonstrates the use of symmetric block ciphers - @echo in this case it uses EVP_des_ede3_cbc - @echo i.e. triple DES in Cipher Block Chaining mode - @echo Doing the encrypt side... - ./example3 ThisIsThePassword <README >t.t - @echo Doing the decrypt side... - ./example3 -d ThisIsThePassword <t.t >t.2 - diff t.2 README - rm -f t.t t.2 - @echo example3 is OK - - @echo - @echo Example4 Demonstrates base64 encoding and decoding - @echo Doing the encrypt side... - ./example4 <README >t.t - @echo Doing the decrypt side... - ./example4 -d <t.t >t.2 - diff t.2 README - rm -f t.t t.2 - @echo example4 is OK diff --git a/demos/maurice/README b/demos/maurice/README deleted file mode 100644 index 29778d55cbc..00000000000 --- a/demos/maurice/README +++ /dev/null @@ -1,34 +0,0 @@ -From Maurice Gittens <[email protected]> --- - Example programs, demonstrating some basic SSLeay crypto library - operations, to help you not to make the same mistakes I did. - - The following files are present. - - loadkeys.c Demonstrates the loading and of public and - private keys. - - loadkeys.h The interface for loadkeys.c - - example1.c Demonstrates the sealing and opening API's - - example2.c Demonstrates rsa encryption and decryption - - example3.c Demonstrates the use of symmetric block ciphers - - example4.c Demonstrates base64 and decoding - - Makefile A makefile you probably will have to adjust for - your environment - - README this file - - - The programs were written by Maurice Gittens <[email protected]> - with the necesary help from Eric Young <[email protected]> - - You may do as you please with these programs, but please don't - pretend that you wrote them. - - To be complete: If you use these programs you acknowlegde that - you are aware that there is NO warranty of any kind associated - with these programs. I don't even claim that the programs work, - they are provided AS-IS. - - January 1997 - - Maurice - - diff --git a/demos/maurice/cert.pem b/demos/maurice/cert.pem deleted file mode 100644 index e31a9ae05f9..00000000000 --- a/demos/maurice/cert.pem +++ /dev/null @@ -1,77 +0,0 @@ -issuer :/C=NL/SP=Brabant/L=Eindhoven/O=Gittens Information Systems B.V./OU=Certification Services/CN=ca.gits.nl/[email protected] -subject:/C=NL/SP=Brabant/O=Gittens Information Systems B.V./OU=Certification Services/CN=caleb.gits.nl/[email protected] -serial :01 - -Certificate: - Data: - Version: 0 (0x0) - Serial Number: 1 (0x1) - Signature Algorithm: md5withRSAEncryption - Issuer: C=NL, SP=Brabant, L=Eindhoven, O=Gittens Information Systems B.V., OU=Certification Services, CN=ca.gits.nl/[email protected] - Validity - Not Before: Jan 5 13:21:16 1997 GMT - Not After : Jul 24 13:21:16 1997 GMT - Subject: C=NL, SP=Brabant, O=Gittens Information Systems B.V., OU=Certification Services, CN=caleb.gits.nl/[email protected] - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - Modulus: - 00:dd:82:a0:fe:a9:8d:6a:02:7e:78:d6:33:75:9b: - 82:01:4b:12:80:ea:6b:9b:83:9e:e3:ae:dc:f3:d0: - 71:7c:4b:ea:03:57:b4:cc:ba:44:5b:b8:4b:49:d3: - f6:39:cc:3d:12:1f:da:58:26:27:bc:bc:ab:a4:6d: - 62:d1:91:5a:47:9f:80:40:c1:b9:fa:e3:1e:ef:52: - 78:46:26:43:65:1d:f2:6b:bf:ff:c0:81:66:14:cd: - 81:32:91:f1:f8:51:7d:0e:17:1f:27:fc:c7:51:fd: - 1c:73:41:e5:66:43:3c:67:a3:09:b9:5e:36:50:50: - b1:e8:42:bd:5c:c6:2b:ec:a9:2c:fe:6a:fe:40:26: - 64:9e:b9:bf:2d:1d:fb:d0:48:5b:82:2a:8e:ab:a4: - d5:7b:5f:26:84:8a:9a:69:5e:c1:71:e2:a9:59:4c: - 2a:76:f7:fd:f4:cf:3f:d3:ce:30:72:62:65:1c:e9: - e9:ee:d2:fc:44:00:1e:e0:80:57:e9:41:b3:f0:44: - e5:0f:77:3b:1a:1f:57:5e:94:1d:c3:a5:fa:af:41: - 8c:4c:30:6b:2b:00:84:52:0c:64:0c:a8:5b:17:16: - d1:1e:f8:ea:72:01:47:9a:b9:21:95:f9:71:ed:7c: - d2:93:54:0c:c5:9c:e8:e5:40:28:c5:a0:ca:b1:a9: - 20:f9 - Exponent: 65537 (0x10001) - Signature Algorithm: md5withRSAEncryption - 93:08:f9:e0:d4:c5:ca:95:de:4e:38:3b:28:87:e9:d3:b6:ce: - 4f:69:2e:c9:09:57:2f:fa:e2:50:9f:39:ec:f3:84:e8:3a:8f: - 9b:c3:06:62:90:49:93:6d:23:7a:2b:3d:7b:f9:46:32:18:d3: - 87:44:49:f7:29:2f:f3:58:97:70:c3:45:5b:90:52:1c:df:fb: - a8:a3:a1:29:53:a3:4c:ed:d2:51:d0:44:98:a4:14:6f:76:9d: - 0d:03:76:e5:d3:13:21:ce:a3:4d:2a:77:fe:ad:b3:47:6d:42: - b9:4a:0e:ff:61:f4:ec:62:b2:3b:00:9c:ac:16:a2:ec:19:c8: - c7:3d:d7:7d:97:cd:4d:1a:d2:00:07:4e:40:3d:b9:ba:1e:e2: - fe:81:28:57:b9:ad:2b:74:59:b0:9f:8b:a5:98:d3:75:06:67: - 4a:04:11:b2:ea:1a:8c:e0:d4:be:c8:0c:46:76:7f:5f:5a:7b: - 72:09:dd:b6:d3:6b:97:70:e8:7e:17:74:1c:f7:3a:5f:e3:fa: - c2:f7:95:bd:74:5e:44:4b:9b:bd:27:de:02:7f:87:1f:68:68: - 60:b9:f4:1d:2b:7b:ce:ef:b1:7f:3a:be:b9:66:60:54:6f:0c: - a0:dd:8c:03:a7:f1:9f:f8:0e:8d:bb:c6:ba:77:61:f7:8e:be: - 28:ba:d8:4f - ------BEGIN CERTIFICATE----- -MIIDzzCCArcCAQEwDQYJKoZIhvcNAQEEBQAwgbUxCzAJBgNVBAYTAk5MMRAwDgYD -VQQIEwdCcmFiYW50MRIwEAYDVQQHEwlFaW5kaG92ZW4xKTAnBgNVBAoTIEdpdHRl -bnMgSW5mb3JtYXRpb24gU3lzdGVtcyBCLlYuMR8wHQYDVQQLExZDZXJ0aWZpY2F0 -aW9uIFNlcnZpY2VzMRMwEQYDVQQDEwpjYS5naXRzLm5sMR8wHQYJKoZIhvcNAQkB -FhBtZ2l0dGVuc0BnaXRzLm5sMB4XDTk3MDEwNTEzMjExNloXDTk3MDcyNDEzMjEx -NlowgaQxCzAJBgNVBAYTAk5MMRAwDgYDVQQIEwdCcmFiYW50MSkwJwYDVQQKEyBH -aXR0ZW5zIEluZm9ybWF0aW9uIFN5c3RlbXMgQi5WLjEfMB0GA1UECxMWQ2VydGlm -aWNhdGlvbiBTZXJ2aWNlczEWMBQGA1UEAxMNY2FsZWIuZ2l0cy5ubDEfMB0GCSqG -SIb3DQEJARYQbWdpdHRlbnNAZ2l0cy5ubDCCASIwDQYJKoZIhvcNAQEBBQADggEP -ADCCAQoCggEBAN2CoP6pjWoCfnjWM3WbggFLEoDqa5uDnuOu3PPQcXxL6gNXtMy6 -RFu4S0nT9jnMPRIf2lgmJ7y8q6RtYtGRWkefgEDBufrjHu9SeEYmQ2Ud8mu//8CB -ZhTNgTKR8fhRfQ4XHyf8x1H9HHNB5WZDPGejCbleNlBQsehCvVzGK+ypLP5q/kAm -ZJ65vy0d+9BIW4Iqjquk1XtfJoSKmmlewXHiqVlMKnb3/fTPP9POMHJiZRzp6e7S -/EQAHuCAV+lBs/BE5Q93OxofV16UHcOl+q9BjEwwaysAhFIMZAyoWxcW0R746nIB -R5q5IZX5ce180pNUDMWc6OVAKMWgyrGpIPkCAwEAATANBgkqhkiG9w0BAQQFAAOC -AQEAkwj54NTFypXeTjg7KIfp07bOT2kuyQlXL/riUJ857POE6DqPm8MGYpBJk20j -eis9e/lGMhjTh0RJ9ykv81iXcMNFW5BSHN/7qKOhKVOjTO3SUdBEmKQUb3adDQN2 -5dMTIc6jTSp3/q2zR21CuUoO/2H07GKyOwCcrBai7BnIxz3XfZfNTRrSAAdOQD25 -uh7i/oEoV7mtK3RZsJ+LpZjTdQZnSgQRsuoajODUvsgMRnZ/X1p7cgndttNrl3Do -fhd0HPc6X+P6wveVvXReREubvSfeAn+HH2hoYLn0HSt7zu+xfzq+uWZgVG8MoN2M -A6fxn/gOjbvGundh946+KLrYTw== ------END CERTIFICATE----- - diff --git a/demos/maurice/example1.c b/demos/maurice/example1.c deleted file mode 100644 index 0e70523a336..00000000000 --- a/demos/maurice/example1.c +++ /dev/null @@ -1,200 +0,0 @@ -/* NOCW */ -/* - Please read the README file for condition of use, before - using this software. - - Maurice Gittens <[email protected]> January 1997 -*/ - -#include <unistd.h> -#include <stdio.h> -#include <netinet/in.h> -#include <fcntl.h> -#include <strings.h> -#include <stdlib.h> - -#include <openssl/rsa.h> -#include <openssl/evp.h> -#include <openssl/objects.h> -#include <openssl/x509.h> -#include <openssl/err.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> - -#include "loadkeys.h" - -#define PUBFILE "cert.pem" -#define PRIVFILE "privkey.pem" - -#define STDIN 0 -#define STDOUT 1 - -void main_encrypt(void); -void main_decrypt(void); - -static const char *usage = "Usage: example1 [-d]\n"; - -int main(int argc, char *argv[]) -{ - - ERR_load_crypto_strings(); - - if ((argc == 1)) - { - main_encrypt(); - } - else if ((argc == 2) && !strcmp(argv[1],"-d")) - { - main_decrypt(); - } - else - { - printf("%s",usage); - exit(1); - } - - return 0; -} - -void main_encrypt(void) -{ - unsigned int ebuflen; - EVP_CIPHER_CTX ectx; - unsigned char iv[EVP_MAX_IV_LENGTH]; - unsigned char *ekey[1]; - int readlen; - int ekeylen, net_ekeylen; - EVP_PKEY *pubKey[1]; - char buf[512]; - char ebuf[512]; - - memset(iv, '\0', sizeof(iv)); - - pubKey[0] = ReadPublicKey(PUBFILE); - - if(!pubKey) - { - fprintf(stderr,"Error: can't load public key"); - exit(1); - } - - ekey[0] = malloc(EVP_PKEY_size(pubKey[0])); - if (!ekey[0]) - { - EVP_PKEY_free(pubKey[0]); - perror("malloc"); - exit(1); - } - - EVP_SealInit(&ectx, - EVP_des_ede3_cbc(), - ekey, - &ekeylen, - iv, - pubKey, - 1); - - net_ekeylen = htonl(ekeylen); - write(STDOUT, (char*)&net_ekeylen, sizeof(net_ekeylen)); - write(STDOUT, ekey[0], ekeylen); - write(STDOUT, iv, sizeof(iv)); - - while(1) - { - readlen = read(STDIN, buf, sizeof(buf)); - - if (readlen <= 0) - { - if (readlen < 0) - perror("read"); - - break; - } - - EVP_SealUpdate(&ectx, ebuf, &ebuflen, buf, readlen); - - write(STDOUT, ebuf, ebuflen); - } - - EVP_SealFinal(&ectx, ebuf, &ebuflen); - - write(STDOUT, ebuf, ebuflen); - - EVP_PKEY_free(pubKey[0]); - free(ekey[0]); -} - -void main_decrypt(void) -{ - char buf[512]; - char ebuf[512]; - unsigned int buflen; - EVP_CIPHER_CTX ectx; - unsigned char iv[8]; - unsigned char *encryptKey; - unsigned int ekeylen; - EVP_PKEY *privateKey; - - memset(iv, '\0', sizeof(iv)); - - privateKey = ReadPrivateKey(PRIVFILE); - if (!privateKey) - { - fprintf(stderr, "Error: can't load private key"); - exit(1); - } - - read(STDIN, &ekeylen, sizeof(ekeylen)); - ekeylen = ntohl(ekeylen); - - if (ekeylen != EVP_PKEY_size(privateKey)) - { - EVP_PKEY_free(privateKey); - fprintf(stderr, "keylength mismatch"); - exit(1); - } - - encryptKey = malloc(sizeof(char) * ekeylen); - if (!encryptKey) - { - EVP_PKEY_free(privateKey); - perror("malloc"); - exit(1); - } - - read(STDIN, encryptKey, ekeylen); - read(STDIN, iv, sizeof(iv)); - - EVP_OpenInit(&ectx, - EVP_des_ede3_cbc(), - encryptKey, - ekeylen, - iv, - privateKey); - - while(1) - { - int readlen = read(STDIN, ebuf, sizeof(ebuf)); - - if (readlen <= 0) - { - if (readlen < 0) - perror("read"); - - break; - } - - EVP_OpenUpdate(&ectx, buf, &buflen, ebuf, readlen); - - write(STDOUT, buf, buflen); - } - - EVP_OpenFinal(&ectx, buf, &buflen); - - write(STDOUT, buf, buflen); - - EVP_PKEY_free(privateKey); - free(encryptKey); -} - - diff --git a/demos/maurice/example2.c b/demos/maurice/example2.c deleted file mode 100644 index 57bce10b5ed..00000000000 --- a/demos/maurice/example2.c +++ /dev/null @@ -1,75 +0,0 @@ -/* NOCW */ -/* - Please read the README file for condition of use, before - using this software. - - Maurice Gittens <[email protected]> January 1997 -*/ - -#include <stdlib.h> -#include <stdio.h> -#include <strings.h> - -#include <openssl/rsa.h> -#include <openssl/evp.h> -#include <openssl/objects.h> -#include <openssl/x509.h> -#include <openssl/err.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> - -#include "loadkeys.h" - -#define PUBFILE "cert.pem" -#define PRIVFILE "privkey.pem" -#define STDIN 0 -#define STDOUT 1 - -int main() -{ - char *ct = "This the clear text"; - char *buf; - char *buf2; - EVP_PKEY *pubKey; - EVP_PKEY *privKey; - int len; - - ERR_load_crypto_strings(); - - privKey = ReadPrivateKey(PRIVFILE); - if (!privKey) - { - ERR_print_errors_fp (stderr); - exit (1); - } - - pubKey = ReadPublicKey(PUBFILE); - if(!pubKey) - { - EVP_PKEY_free(privKey); - fprintf(stderr,"Error: can't load public key"); - exit(1); - } - - /* No error checking */ - buf = malloc(EVP_PKEY_size(pubKey)); - buf2 = malloc(EVP_PKEY_size(pubKey)); - - len = RSA_public_encrypt(strlen(ct)+1, ct, buf, pubKey->pkey.rsa,RSA_PKCS1_PADDING); - - if (len != EVP_PKEY_size(pubKey)) - { - fprintf(stderr,"Error: ciphertext should match length of key\n"); - exit(1); - } - - RSA_private_decrypt(len, buf, buf2, privKey->pkey.rsa,RSA_PKCS1_PADDING); - - printf("%s\n", buf2); - - EVP_PKEY_free(privKey); - EVP_PKEY_free(pubKey); - free(buf); - free(buf2); - return 0; -} diff --git a/demos/maurice/example3.c b/demos/maurice/example3.c deleted file mode 100644 index c8462a47c37..00000000000 --- a/demos/maurice/example3.c +++ /dev/null @@ -1,85 +0,0 @@ -/* NOCW */ -/* - Please read the README file for condition of use, before - using this software. - - Maurice Gittens <[email protected]> January 1997 - -*/ - -#include <stdio.h> -#include <unistd.h> -#include <fcntl.h> -#include <sys/stat.h> -#include <openssl/evp.h> - -#define STDIN 0 -#define STDOUT 1 -#define BUFLEN 512 -#define INIT_VECTOR "12345678" -#define ENCRYPT 1 -#define DECRYPT 0 -#define ALG EVP_des_ede3_cbc() - -static const char *usage = "Usage: example3 [-d] password\n"; - -void do_cipher(char *,int); - -int main(int argc, char *argv[]) -{ - if ((argc == 2)) - { - do_cipher(argv[1],ENCRYPT); - } - else if ((argc == 3) && !strcmp(argv[1],"-d")) - { - do_cipher(argv[2],DECRYPT); - } - else - { - fprintf(stderr,"%s", usage); - exit(1); - } - - return 0; -} - -void do_cipher(char *pw, int operation) -{ - char buf[BUFLEN]; - char ebuf[BUFLEN + 8]; - unsigned int ebuflen; /* rc; */ - unsigned char iv[EVP_MAX_IV_LENGTH], key[EVP_MAX_KEY_LENGTH]; - /* unsigned int ekeylen, net_ekeylen; */ - EVP_CIPHER_CTX ectx; - - memcpy(iv, INIT_VECTOR, sizeof(iv)); - - EVP_BytesToKey(ALG, EVP_md5(), "salu", pw, strlen(pw), 1, key, iv); - - EVP_CipherInit(&ectx, ALG, key, iv, operation); - - while(1) - { - int readlen = read(STDIN, buf, sizeof(buf)); - - if (readlen <= 0) - { - if (!readlen) - break; - else - { - perror("read"); - exit(1); - } - } - - EVP_CipherUpdate(&ectx, ebuf, &ebuflen, buf, readlen); - - write(STDOUT, ebuf, ebuflen); - } - - EVP_CipherFinal(&ectx, ebuf, &ebuflen); - - write(STDOUT, ebuf, ebuflen); -} diff --git a/demos/maurice/example4.c b/demos/maurice/example4.c deleted file mode 100644 index ce629848b74..00000000000 --- a/demos/maurice/example4.c +++ /dev/null @@ -1,123 +0,0 @@ -/* NOCW */ -/* - Please read the README file for condition of use, before - using this software. - - Maurice Gittens <[email protected]> January 1997 - -*/ - -#include <stdio.h> -#include <unistd.h> -#include <fcntl.h> -#include <sys/stat.h> -#include <openssl/evp.h> - -#define STDIN 0 -#define STDOUT 1 -#define BUFLEN 512 - -static const char *usage = "Usage: example4 [-d]\n"; - -void do_encode(void); -void do_decode(void); - -int main(int argc, char *argv[]) -{ - if ((argc == 1)) - { - do_encode(); - } - else if ((argc == 2) && !strcmp(argv[1],"-d")) - { - do_decode(); - } - else - { - fprintf(stderr,"%s", usage); - exit(1); - } - - return 0; -} - -void do_encode() -{ - char buf[BUFLEN]; - char ebuf[BUFLEN+24]; - unsigned int ebuflen; - EVP_ENCODE_CTX ectx; - - EVP_EncodeInit(&ectx); - - while(1) - { - int readlen = read(STDIN, buf, sizeof(buf)); - - if (readlen <= 0) - { - if (!readlen) - break; - else - { - perror("read"); - exit(1); - } - } - - EVP_EncodeUpdate(&ectx, ebuf, &ebuflen, buf, readlen); - - write(STDOUT, ebuf, ebuflen); - } - - EVP_EncodeFinal(&ectx, ebuf, &ebuflen); - - write(STDOUT, ebuf, ebuflen); -} - -void do_decode() -{ - char buf[BUFLEN]; - char ebuf[BUFLEN+24]; - unsigned int ebuflen; - EVP_ENCODE_CTX ectx; - - EVP_DecodeInit(&ectx); - - while(1) - { - int readlen = read(STDIN, buf, sizeof(buf)); - int rc; - - if (readlen <= 0) - { - if (!readlen) - break; - else - { - perror("read"); - exit(1); - } - } - - rc = EVP_DecodeUpdate(&ectx, ebuf, &ebuflen, buf, readlen); - if (rc <= 0) - { - if (!rc) - { - write(STDOUT, ebuf, ebuflen); - break; - } - - fprintf(stderr, "Error: decoding message\n"); - return; - } - - write(STDOUT, ebuf, ebuflen); - } - - EVP_DecodeFinal(&ectx, ebuf, &ebuflen); - - write(STDOUT, ebuf, ebuflen); -} - diff --git a/demos/maurice/loadkeys.c b/demos/maurice/loadkeys.c deleted file mode 100644 index 0f3464753af..00000000000 --- a/demos/maurice/loadkeys.c +++ /dev/null @@ -1,77 +0,0 @@ -/* NOCW */ -/* - Please read the README file for condition of use, before - using this software. - - Maurice Gittens <[email protected]> January 1997 - -*/ - -#include <unistd.h> -#include <stdio.h> -#include <netinet/in.h> -#include <fcntl.h> -#include <strings.h> -#include <stdlib.h> - -#include <openssl/rsa.h> -#include <openssl/evp.h> -#include <openssl/objects.h> -#include <openssl/x509.h> -#include <openssl/err.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> - -EVP_PKEY * ReadPublicKey(const char *certfile) -{ - FILE *fp = fopen (certfile, "r"); - X509 *x509; - EVP_PKEY *pkey; - - if (!fp) - return NULL; - - x509 = (X509 *)PEM_ASN1_read ((char *(*)())d2i_X509, - PEM_STRING_X509, - fp, NULL, NULL); - - if (x509 == NULL) - { - ERR_print_errors_fp (stderr); - return NULL; - } - - fclose (fp); - - pkey=X509_extract_key(x509); - - X509_free(x509); - - if (pkey == NULL) - ERR_print_errors_fp (stderr); - - return pkey; -} - -EVP_PKEY *ReadPrivateKey(const char *keyfile) -{ - FILE *fp = fopen(keyfile, "r"); - EVP_PKEY *pkey; - - if (!fp) - return NULL; - - pkey = (EVP_PKEY*)PEM_ASN1_read ((char *(*)())d2i_PrivateKey, - PEM_STRING_EVP_PKEY, - fp, - NULL, NULL); - - fclose (fp); - - if (pkey == NULL) - ERR_print_errors_fp (stderr); - - return pkey; -} - - diff --git a/demos/maurice/loadkeys.h b/demos/maurice/loadkeys.h deleted file mode 100644 index d8fde86eb7f..00000000000 --- a/demos/maurice/loadkeys.h +++ /dev/null @@ -1,19 +0,0 @@ -/* NOCW */ -/* - Please read the README file for condition of use, before - using this software. - - Maurice Gittens <[email protected]> January 1997 - -*/ - -#ifndef LOADKEYS_H_SEEN -#define LOADKEYS_H_SEEN - -#include <openssl/evp.h> - -EVP_PKEY * ReadPublicKey(const char *certfile); -EVP_PKEY *ReadPrivateKey(const char *keyfile); - -#endif - diff --git a/demos/maurice/privkey.pem b/demos/maurice/privkey.pem deleted file mode 100644 index fc3554e930a..00000000000 --- a/demos/maurice/privkey.pem +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEA3YKg/qmNagJ+eNYzdZuCAUsSgOprm4Oe467c89BxfEvqA1e0 -zLpEW7hLSdP2Ocw9Eh/aWCYnvLyrpG1i0ZFaR5+AQMG5+uMe71J4RiZDZR3ya7// -wIFmFM2BMpHx+FF9DhcfJ/zHUf0cc0HlZkM8Z6MJuV42UFCx6EK9XMYr7Kks/mr+ -QCZknrm/LR370EhbgiqOq6TVe18mhIqaaV7BceKpWUwqdvf99M8/084wcmJlHOnp -7tL8RAAe4IBX6UGz8ETlD3c7Gh9XXpQdw6X6r0GMTDBrKwCEUgxkDKhbFxbRHvjq -cgFHmrkhlflx7XzSk1QMxZzo5UAoxaDKsakg+QIDAQABAoIBAQC0hnh083PnuJ6g -Flob+B+stCUhYWtPc6ZzgphaMD+9ABV4oescipWZdooNYiyikBwZgFIvUvFBtTXh -rLBDgUVlZ81beUb7/EvC2aBh818rsotWW0Sw/ARY4d7wetcL/EWBzUA8E5vR6wlb -uZGelR9OiyYqp2h2bj1/v5yaVnuHxBeBj5clTHtPMXc+/70iUNBDMZ0ruZTdSwll -e0DH8pp/5USYewlrKtRIJT7elC8LFMqEz4OpNvfaR2OEY0FatYYmSvQPNwV8/Eor -XlNzRi9qD0uXbVexaAgQZ3/KZuAzUbOgwJZZXEAOGkZ/J1n08jljPXdU0o7bHhNl -7siHbuEBAoGBAP53IvvJkhnH8Akf6E6sXelZkPKHnwDwfywDAiIhXza9DB1DViRS -bZUB5gzcxmLGalex5+LcwZmsqFO5NXZ8SQeE9p0YT8yJsX4J1w9JzSvsWJBS2vyW -Kbt21oG6JAGrWSGMIfxKpuahtWLf4JpGjftti0qIVQ60GKEPc1/xE2PZAoGBAN7Y -nRPaUaqcIwbnH9kovOKwZ/PWREy1ecr3YXj65VYTnwSJHD0+CJa/DX8eB/G4AoNA -Y2LPbq0Xu3+7SaUsO45VkaZuJmNwheUQ4tmyd/YdnVZ0AHXx1tvpR7QeO0WjnlNK -mR+x00fetrff2Ypahs0wtU0Xf3F8ORgVB8jnxBIhAoGAcwf0PpI+g30Im3dbEsWE -poogpiJ81HXjZ0fs3PTtD9eh9FCOTlkcxHFZR5M980TyqbX4t2tH8WpFpaNh8a/5 -a3bF7PoiiLnuDKXyHC0mnKZ42rU53VkcgGwWSAqXYFHPNwUcD+rHTBbp4kqGQ/eF -E5XPk9/RY5YyVAyiAUr/kvECgYBvW1Ua75SxqbZDI8mhbZ79tGMt0NtubZz/1KCL -oOxrGAD1dkJ7Q/1svunSpMIZgvcWeV1wqfFHY72ZNZC2jiTwmkffH9nlBPyTm92Q -JYOWo/PUmMEGLyRL3gWrtxOtV/as7nEYCndmyZ8KwTxmy5fi/z0J2f0gS5AIPbIX -LeGnoQKBgQDapjz9K4HWR5AMxyga4eiLIrmADySP846uz3eZIvTJQZ+6TAamvnno -KbnU21cGq5HBBtxqQvGswLPGW9rZAgykHHJmYBUp0xv4+I4qHfXyD7QNmvq+Vxjj -V2tgIafEpaf2ZsfM7BZeZz8MzeGcDwyrHtIO1FQiYN5Qz9Hq68XmVA== ------END RSA PRIVATE KEY----- diff --git a/demos/pkcs12/README b/demos/pkcs12/README deleted file mode 100644 index c87434b04f6..00000000000 --- a/demos/pkcs12/README +++ /dev/null @@ -1,3 +0,0 @@ -PKCS#12 demo applications - -Written by Steve Henson. diff --git a/demos/pkcs12/pkread.c b/demos/pkcs12/pkread.c deleted file mode 100644 index 8e1b6863121..00000000000 --- a/demos/pkcs12/pkread.c +++ /dev/null @@ -1,61 +0,0 @@ -/* pkread.c */ - -#include <stdio.h> -#include <stdlib.h> -#include <openssl/pem.h> -#include <openssl/err.h> -#include <openssl/pkcs12.h> - -/* Simple PKCS#12 file reader */ - -int main(int argc, char **argv) -{ - FILE *fp; - EVP_PKEY *pkey; - X509 *cert; - STACK_OF(X509) *ca = NULL; - PKCS12 *p12; - int i; - if (argc != 4) { - fprintf(stderr, "Usage: pkread p12file password opfile\n"); - exit (1); - } - SSLeay_add_all_algorithms(); - ERR_load_crypto_strings(); - if (!(fp = fopen(argv[1], "rb"))) { - fprintf(stderr, "Error opening file %s\n", argv[1]); - exit(1); - } - p12 = d2i_PKCS12_fp(fp, NULL); - fclose (fp); - if (!p12) { - fprintf(stderr, "Error reading PKCS#12 file\n"); - ERR_print_errors_fp(stderr); - exit (1); - } - if (!PKCS12_parse(p12, argv[2], &pkey, &cert, &ca)) { - fprintf(stderr, "Error parsing PKCS#12 file\n"); - ERR_print_errors_fp(stderr); - exit (1); - } - PKCS12_free(p12); - if (!(fp = fopen(argv[3], "w"))) { - fprintf(stderr, "Error opening file %s\n", argv[1]); - exit(1); - } - if (pkey) { - fprintf(fp, "***Private Key***\n"); - PEM_write_PrivateKey(fp, pkey, NULL, NULL, 0, NULL, NULL); - } - if (cert) { - fprintf(fp, "***User Certificate***\n"); - PEM_write_X509_AUX(fp, cert); - } - if (ca && sk_num(ca)) { - fprintf(fp, "***Other Certificates***\n"); - for (i = 0; i < sk_X509_num(ca); i++) - PEM_write_X509_AUX(fp, sk_X509_value(ca, i)); - } - fclose(fp); - return 0; -} diff --git a/demos/pkcs12/pkwrite.c b/demos/pkcs12/pkwrite.c deleted file mode 100644 index 15f839d1eba..00000000000 --- a/demos/pkcs12/pkwrite.c +++ /dev/null @@ -1,46 +0,0 @@ -/* pkwrite.c */ - -#include <stdio.h> -#include <stdlib.h> -#include <openssl/pem.h> -#include <openssl/err.h> -#include <openssl/pkcs12.h> - -/* Simple PKCS#12 file creator */ - -int main(int argc, char **argv) -{ - FILE *fp; - EVP_PKEY *pkey; - X509 *cert; - PKCS12 *p12; - if (argc != 5) { - fprintf(stderr, "Usage: pkwrite infile password name p12file\n"); - exit(1); - } - SSLeay_add_all_algorithms(); - ERR_load_crypto_strings(); - if (!(fp = fopen(argv[1], "r"))) { - fprintf(stderr, "Error opening file %s\n", argv[1]); - exit(1); - } - cert = PEM_read_X509(fp, NULL, NULL, NULL); - rewind(fp); - pkey = PEM_read_PrivateKey(fp, NULL, NULL, NULL); - fclose(fp); - p12 = PKCS12_create(argv[2], argv[3], pkey, cert, NULL, 0,0,0,0,0); - if(!p12) { - fprintf(stderr, "Error creating PKCS#12 structure\n"); - ERR_print_errors_fp(stderr); - exit(1); - } - if (!(fp = fopen(argv[4], "wb"))) { - fprintf(stderr, "Error opening file %s\n", argv[1]); - ERR_print_errors_fp(stderr); - exit(1); - } - i2d_PKCS12_fp(fp, p12); - PKCS12_free(p12); - fclose(fp); - return 0; -} diff --git a/demos/prime/Makefile b/demos/prime/Makefile deleted file mode 100644 index 0166cd46fe4..00000000000 --- a/demos/prime/Makefile +++ /dev/null @@ -1,20 +0,0 @@ -CC=cc -CFLAGS= -g -I../../include -Wall -LIBS= -L../.. -lcrypto -EXAMPLES=prime - -all: $(EXAMPLES) - -prime: prime.o - $(CC) -o prime prime.o $(LIBS) - -clean: - rm -f $(EXAMPLES) *.o - -test: all - @echo Test creating a 128-bit prime - ./prime 128 - @echo Test creating a 256-bit prime - ./prime 256 - @echo Test creating a 512-bit prime - ./prime 512 diff --git a/demos/prime/prime.c b/demos/prime/prime.c deleted file mode 100644 index 103e0efc0cd..00000000000 --- a/demos/prime/prime.c +++ /dev/null @@ -1,101 +0,0 @@ -/* demos/prime/prime.c */ -/* Copyright (C) 1995-1998 Eric Young ([email protected]) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young ([email protected]). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson ([email protected]). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young ([email protected])" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson ([email protected])" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ - -#include <stdio.h> -#include <stdlib.h> -#include <openssl/bn.h> - -void callback(type,num) -int type,num; - { - if (type == 0) - fprintf(stderr,"."); - else if (type == 1) - fprintf(stderr,"+"); - else if (type == 2) - fprintf(stderr,"*"); - fflush(stderr); - } - -int main(argc,argv) -int argc; -char *argv[]; - { - BIGNUM *rand; - int num=256; - - /* we should really call RAND_seed(char *bytes,int num); - * to fully initalise the random number generator */ - if (argc >= 2) - { - num=atoi(argv[1]); - if (num == 0) num=256; - } - - fprintf(stderr,"generate a strong prime\n"); - rand=BN_generate_prime(NULL,num,1,NULL,NULL,callback,NULL); - /* change the third parameter to 1 for a strong prime */ - fprintf(stderr,"\n"); - - BN_print_fp(stdout,rand); - fprintf(stdout,"\n"); - BN_free(rand); - exit(0); - return(0); - } - diff --git a/demos/privkey.pem b/demos/privkey.pem deleted file mode 100644 index ddae24075da..00000000000 --- a/demos/privkey.pem +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIBPAIBAAJBAN+FmbxmHVOp/RxtpMGz0DvQEBz1sDktHp19hIoMSu0YZift5MAu -4xAEJYvWVCshDiyOTWsUBXwZkrkt87FyctkCAwEAAQJAG/vxBGpQb6IPo1iC0RF/ -F430BnwoBPCGLbeCOXpSgx5X+19vuTSdEqMgeNB6+aNb+XY/7mvVfCjyD6WZ0oxs -JQIhAPO+uL9cP40lFs62pdL3QSWsh3VNDByvOtr9LpeaxBm/AiEA6sKVfXsDQ5hd -SHt9U61r2r8Lcxmzi9Kw6JNqjMmzqWcCIQCKoRy+aZ8Tjdas9yDVHh+FZ90bEBkl -b1xQFNOdEj8aTQIhAOJWrO6INYNsWTPS6+hLYZtLamyUsQj0H+B8kNQge/mtAiEA -nBfvUl243qbqN8gF7Az1u33uc9FsPVvQPiBzLxZ4ixw= ------END RSA PRIVATE KEY----- diff --git a/demos/selfsign.c b/demos/selfsign.c deleted file mode 100644 index 68904c611ea..00000000000 --- a/demos/selfsign.c +++ /dev/null @@ -1,180 +0,0 @@ -/* NOCW */ -/* cc -o ssdemo -I../include selfsign.c ../libcrypto.a */ - -#include <stdio.h> -#include <stdlib.h> - -#include <openssl/pem.h> -#include <openssl/conf.h> -#include <openssl/x509v3.h> - -int mkit(X509 **x509p, EVP_PKEY **pkeyp, int bits, int serial, int days); - -int main() - { - BIO *bio_err; - X509 *x509=NULL; - EVP_PKEY *pkey=NULL; - - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); - - bio_err=BIO_new_fp(stderr, BIO_NOCLOSE); - - mkit(&x509,&pkey,512,0,365); - - RSA_print_fp(stdout,pkey->pkey.rsa,0); - X509_print_fp(stdout,x509); - - PEM_write_PrivateKey(stdout,pkey,NULL,NULL,0,NULL, NULL); - PEM_write_X509(stdout,x509); - - X509_free(x509); - EVP_PKEY_free(pkey); - -#ifdef CUSTOM_EXT - /* Only needed if we add objects or custom extensions */ - X509V3_EXT_cleanup(); - OBJ_cleanup(); -#endif - - CRYPTO_mem_leaks(bio_err); - BIO_free(bio_err); - return(0); - } - -#ifdef WIN16 -# define MS_CALLBACK _far _loadds -# define MS_FAR _far -#else -# define MS_CALLBACK -# define MS_FAR -#endif - -static void MS_CALLBACK callback(p, n, arg) -int p; -int n; -void *arg; - { - char c='B'; - - if (p == 0) c='.'; - if (p == 1) c='+'; - if (p == 2) c='*'; - if (p == 3) c='\n'; - fputc(c,stderr); - } - -int mkit(x509p,pkeyp,bits,serial,days) -X509 **x509p; -EVP_PKEY **pkeyp; -int bits; -int serial; -int days; - { - X509 *x; - EVP_PKEY *pk; - RSA *rsa; - X509_NAME *name=NULL; - X509_NAME_ENTRY *ne=NULL; - X509_EXTENSION *ex=NULL; - - - if ((pkeyp == NULL) || (*pkeyp == NULL)) - { - if ((pk=EVP_PKEY_new()) == NULL) - { - abort(); - return(0); - } - } - else - pk= *pkeyp; - - if ((x509p == NULL) || (*x509p == NULL)) - { - if ((x=X509_new()) == NULL) - goto err; - } - else - x= *x509p; - - rsa=RSA_generate_key(bits,RSA_F4,callback,NULL); - if (!EVP_PKEY_assign_RSA(pk,rsa)) - { - abort(); - goto err; - } - rsa=NULL; - - X509_set_version(x,3); - ASN1_INTEGER_set(X509_get_serialNumber(x),serial); - X509_gmtime_adj(X509_get_notBefore(x),0); - X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days); - X509_set_pubkey(x,pk); - - name=X509_get_subject_name(x); - - /* This function creates and adds the entry, working out the - * correct string type and performing checks on its length. - * Normally we'd check the return value for errors... - */ - X509_NAME_add_entry_by_txt(name,"C", - MBSTRING_ASC, "UK", -1, -1, 0); - X509_NAME_add_entry_by_txt(name,"CN", - MBSTRING_ASC, "OpenSSL Group", -1, -1, 0); - - X509_set_issuer_name(x,name); - - /* Add extension using V3 code: we can set the config file as NULL - * because we wont reference any other sections. We can also set - * the context to NULL because none of these extensions below will need - * to access it. - */ - - ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_cert_type, "server"); - X509_add_ext(x,ex,-1); - X509_EXTENSION_free(ex); - - ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_comment, - "example comment extension"); - X509_add_ext(x,ex,-1); - X509_EXTENSION_free(ex); - - ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_ssl_server_name, - "www.openssl.org"); - - X509_add_ext(x,ex,-1); - X509_EXTENSION_free(ex); - -#if 0 - /* might want something like this too.... */ - ex = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints, - "critical,CA:TRUE"); - - - X509_add_ext(x,ex,-1); - X509_EXTENSION_free(ex); -#endif - -#ifdef CUSTOM_EXT - /* Maybe even add our own extension based on existing */ - { - int nid; - nid = OBJ_create("1.2.3.4", "MyAlias", "My Test Alias Extension"); - X509V3_EXT_add_alias(nid, NID_netscape_comment); - ex = X509V3_EXT_conf_nid(NULL, NULL, nid, - "example comment alias"); - X509_add_ext(x,ex,-1); - X509_EXTENSION_free(ex); - } -#endif - - if (!X509_sign(x,pk,EVP_md5())) - goto err; - - *x509p=x; - *pkeyp=pk; - return(1); -err: - return(0); - } diff --git a/demos/sign/Makefile b/demos/sign/Makefile deleted file mode 100644 index e6d391e4ada..00000000000 --- a/demos/sign/Makefile +++ /dev/null @@ -1,15 +0,0 @@ -CC=cc -CFLAGS= -g -I../../include -Wall -LIBS= -L../.. -lcrypto -EXAMPLES=sign - -all: $(EXAMPLES) - -sign: sign.o - $(CC) -o sign sign.o $(LIBS) - -clean: - rm -f $(EXAMPLES) *.o - -test: all - ./sign diff --git a/demos/sign/cert.pem b/demos/sign/cert.pem deleted file mode 100644 index 9d7ac238d86..00000000000 --- a/demos/sign/cert.pem +++ /dev/null @@ -1,14 +0,0 @@ ------BEGIN CERTIFICATE----- -MIICLDCCAdYCAQAwDQYJKoZIhvcNAQEEBQAwgaAxCzAJBgNVBAYTAlBUMRMwEQYD -VQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5ldXJv -bmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMTEmJy -dXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZpMB4X -DTk2MDkwNTAzNDI0M1oXDTk2MTAwNTAzNDI0M1owgaAxCzAJBgNVBAYTAlBUMRMw -EQYDVQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5l -dXJvbmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMT -EmJydXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZp -MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNw -L4lYKbpzzlmC5beaQXeQ2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAATAN -BgkqhkiG9w0BAQQFAANBAFqPEKFjk6T6CKTHvaQeEAsX0/8YHPHqH/9AnhSjrwuX -9EBc0n6bVGhN7XaXd6sJ7dym9sbsWxb+pJdurnkxjx4= ------END CERTIFICATE----- diff --git a/demos/sign/key.pem b/demos/sign/key.pem deleted file mode 100644 index 239ad66f990..00000000000 --- a/demos/sign/key.pem +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIBPAIBAAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNwL4lYKbpzzlmC5beaQXeQ -2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAAQJBALjkK+jc2+iihI98riEF -oudmkNziSRTYjnwjx8mCoAjPWviB3c742eO3FG4/soi1jD9A5alihEOXfUzloenr -8IECIQD3B5+0l+68BA/6d76iUNqAAV8djGTzvxnCxycnxPQydQIhAMXt4trUI3nc -a+U8YL2HPFA3gmhBsSICbq2OptOCnM7hAiEA6Xi3JIQECob8YwkRj29DU3/4WYD7 -WLPgsQpwo1GuSpECICGsnWH5oaeD9t9jbFoSfhJvv0IZmxdcLpRcpslpeWBBAiEA -6/5B8J0GHdJq89FHwEG/H2eVVUYu5y/aD6sgcm+0Avg= ------END RSA PRIVATE KEY----- diff --git a/demos/sign/sig.txt b/demos/sign/sig.txt deleted file mode 100644 index 5613c0ee77b..00000000000 --- a/demos/sign/sig.txt +++ /dev/null @@ -1,158 +0,0 @@ -From [email protected] Mon Sep 30 02:37:40 1996 -Received: from cygnus.mincom.oz.au by orb.mincom.oz.au with SMTP id AA11782 - (5.65c/IDA-1.4.4 for eay); Mon, 30 Sep 1996 11:46:21 +1000 -Received: (from daemon@localhost) by cygnus.mincom.oz.au (8.7.5/8.7.3) id LAA18980 for ssl-users-outgoing; Mon, 30 Sep 1996 11:44:56 +1000 (EST) -Received: from minbne.mincom.oz.au (minbne.mincom.oz.au [192.55.196.247]) by cygnus.mincom.oz.au (8.7.5/8.7.3) with SMTP id LAA18962 for <[email protected]>; Mon, 30 Sep 1996 11:44:51 +1000 (EST) -Received: by minbne.mincom.oz.au id AA22230 - (5.65c/IDA-1.4.4 for [email protected]); Mon, 30 Sep 1996 11:38:41 +1000 -Received: from brutus.neuronio.pt (brutus.neuronio.pt [193.126.253.2]) by bunyip.cc.uq.oz.au (8.7.6/8.7.3) with SMTP id LAA15824 for <[email protected]>; Mon, 30 Sep 1996 11:40:07 +1000 -Received: (from sampo@localhost) by brutus.neuronio.pt (8.6.11/8.6.11) id BAA08729; Mon, 30 Sep 1996 01:37:40 +0100 -Date: Mon, 30 Sep 1996 01:37:40 +0100 -Message-Id: <[email protected]> -From: Sampo Kellomaki <[email protected]> -To: [email protected] -Cc: [email protected] -Subject: Signing with envelope routines -Sender: [email protected] -Precedence: bulk -Status: RO -X-Status: D - - -I have been trying to figure out how to produce signatures with EVP_ -routines. I seem to be able to read in private key and sign some -data ok, but I can't figure out how I am supposed to read in -public key so that I could verify my signature. I use self signed -certificate. - -I figured I should use - EVP_PKEY* pkey = PEM_ASN1_read(d2i_PrivateKey, PEM_STRING_EVP_PKEY, - fp, NULL, NULL); -to read in private key and this seems to work Ok. - -However when I try analogous - EVP_PKEY* pkey = PEM_ASN1_read(d2i_PublicKey, PEM_STRING_X509, - fp, NULL, NULL); -the program fails with - -error:0D09508D:asn1 encoding routines:D2I_PUBLICKEY:unknown public key type:d2i_pu.c:93 -error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_lib.c:232 - -I figured that the second argument to PEM_ASN1_read should match the -name in my PEM encoded object, hence PEM_STRING_X509. -PEM_STRING_EVP_PKEY seems to be somehow magical -because it matches whatever private key there happens to be. I could -not find a similar constant to use with getting the certificate, however. - -Is my approach of using PEM_ASN1_read correct? What should I pass in -as name? Can I use normal (or even self signed) X509 certificate for -verifying the signature? - -When will SSLeay documentation be written ;-)? If I would contribute -comments to the code, would Eric take time to review them and include -them in distribution? - -I'm using SSLeay-0.6.4. My program is included below along with the -key and cert that I use. - ---Sampo - ------------------------------------ -/* sign-it.cpp - Simple test app using SSLeay envelopes to sign data - 29.9.1996, Sampo Kellomaki <[email protected]> */ - -#include <stdio.h> -#include "rsa.h" -#include "evp.h" -#include "objects.h" -#include "x509.h" -#include "err.h" -#include "pem.h" -#include "ssl.h" - -void main () -{ - int err; - int sig_len; - unsigned char sig_buf [4096]; - const char certfile[] = "plain-cert.pem"; - const char keyfile[] = "plain-key.pem"; - const char data[] = "I owe you..."; - EVP_MD_CTX md_ctx; - EVP_PKEY* pkey; - FILE* fp; - - SSL_load_error_strings(); - - /* Read private key */ - - fp = fopen (keyfile, "r"); if (fp == NULL) exit (1); - pkey = (EVP_PKEY*)PEM_ASN1_read ((char *(*)())d2i_PrivateKey, - PEM_STRING_EVP_PKEY, - fp, - NULL, NULL); - if (pkey == NULL) { ERR_print_errors_fp (stderr); exit (1); } - fclose (fp); - - /* Do the signature */ - - EVP_SignInit (&md_ctx, EVP_md5()); - EVP_SignUpdate (&md_ctx, data, strlen(data)); - sig_len = sizeof(sig_buf); - err = EVP_SignFinal (&md_ctx, - sig_buf, - &sig_len, - pkey); - if (err != 1) { ERR_print_errors_fp (stderr); exit (1); } - EVP_PKEY_free (pkey); - - /* Read public key */ - - fp = fopen (certfile, "r"); if (fp == NULL) exit (1); - pkey = (EVP_PKEY*)PEM_ASN1_read ((char *(*)())d2i_PublicKey, - PEM_STRING_X509, - fp, - NULL, NULL); - if (pkey == NULL) { ERR_print_errors_fp (stderr); exit (1); } - fclose (fp); - - /* Verify the signature */ - - EVP_VerifyInit (&md_ctx, EVP_md5()); - EVP_VerifyUpdate (&md_ctx, data, strlen((char*)data)); - err = EVP_VerifyFinal (&md_ctx, - sig_buf, - sig_len, - pkey); - if (err != 1) { ERR_print_errors_fp (stderr); exit (1); } - EVP_PKEY_free (pkey); - printf ("Signature Verified Ok.\n"); -} -/* EOF */ ---------------- plain-cert.pem ----------------- ------BEGIN CERTIFICATE----- -MIICLDCCAdYCAQAwDQYJKoZIhvcNAQEEBQAwgaAxCzAJBgNVBAYTAlBUMRMwEQYD -VQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5ldXJv -bmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMTEmJy -dXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZpMB4X -DTk2MDkwNTAzNDI0M1oXDTk2MTAwNTAzNDI0M1owgaAxCzAJBgNVBAYTAlBUMRMw -EQYDVQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5l -dXJvbmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMT -EmJydXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZp -MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNw -L4lYKbpzzlmC5beaQXeQ2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAATAN -BgkqhkiG9w0BAQQFAANBAFqPEKFjk6T6CKTHvaQeEAsX0/8YHPHqH/9AnhSjrwuX -9EBc0n6bVGhN7XaXd6sJ7dym9sbsWxb+pJdurnkxjx4= ------END CERTIFICATE----- ----------------- plain-key.pem ----------------- ------BEGIN RSA PRIVATE KEY----- -MIIBPAIBAAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNwL4lYKbpzzlmC5beaQXeQ -2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAAQJBALjkK+jc2+iihI98riEF -oudmkNziSRTYjnwjx8mCoAjPWviB3c742eO3FG4/soi1jD9A5alihEOXfUzloenr -8IECIQD3B5+0l+68BA/6d76iUNqAAV8djGTzvxnCxycnxPQydQIhAMXt4trUI3nc -a+U8YL2HPFA3gmhBsSICbq2OptOCnM7hAiEA6Xi3JIQECob8YwkRj29DU3/4WYD7 -WLPgsQpwo1GuSpECICGsnWH5oaeD9t9jbFoSfhJvv0IZmxdcLpRcpslpeWBBAiEA -6/5B8J0GHdJq89FHwEG/H2eVVUYu5y/aD6sgcm+0Avg= ------END RSA PRIVATE KEY----- ------------------------------------------------- - diff --git a/demos/sign/sign.c b/demos/sign/sign.c deleted file mode 100644 index 0fdf0de387d..00000000000 --- a/demos/sign/sign.c +++ /dev/null @@ -1,153 +0,0 @@ -/* demos/sign/sign.c */ -/* Copyright (C) 1995-1998 Eric Young ([email protected]) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young ([email protected]). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson ([email protected]). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young ([email protected])" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson ([email protected])" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ - -/* sign-it.cpp - Simple test app using SSLeay envelopes to sign data - 29.9.1996, Sampo Kellomaki <[email protected]> */ - -/* converted to C - eay :-) */ - -/* reformated a bit and converted to use the more common functions: this was - * initially written at the dawn of time :-) - Steve. - */ - -#include <stdio.h> -#include <openssl/rsa.h> -#include <openssl/evp.h> -#include <openssl/objects.h> -#include <openssl/x509.h> -#include <openssl/err.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> - -int main () -{ - int err; - int sig_len; - unsigned char sig_buf [4096]; - static char certfile[] = "cert.pem"; - static char keyfile[] = "key.pem"; - static char data[] = "I owe you..."; - EVP_MD_CTX md_ctx; - EVP_PKEY * pkey; - FILE * fp; - X509 * x509; - - /* Just load the crypto library error strings, - * SSL_load_error_strings() loads the crypto AND the SSL ones */ - /* SSL_load_error_strings();*/ - ERR_load_crypto_strings(); - - /* Read private key */ - - fp = fopen (keyfile, "r"); - if (fp == NULL) exit (1); - pkey = PEM_read_PrivateKey(fp, NULL, NULL); - fclose (fp); - - if (pkey == NULL) { - ERR_print_errors_fp (stderr); - exit (1); - } - - /* Do the signature */ - - EVP_SignInit (&md_ctx, EVP_sha1()); - EVP_SignUpdate (&md_ctx, data, strlen(data)); - sig_len = sizeof(sig_buf); - err = EVP_SignFinal (&md_ctx, sig_buf, &sig_len, pkey); - - if (err != 1) { - ERR_print_errors_fp(stderr); - exit (1); - } - - EVP_PKEY_free (pkey); - - /* Read public key */ - - fp = fopen (certfile, "r"); - if (fp == NULL) exit (1); - x509 = PEM_read_X509(fp, NULL, NULL); - fclose (fp); - - if (x509 == NULL) { - ERR_print_errors_fp (stderr); - exit (1); - } - - /* Get public key - eay */ - pkey=X509_get_pubkey(x509); - if (pkey == NULL) { - ERR_print_errors_fp (stderr); - exit (1); - } - - /* Verify the signature */ - - EVP_VerifyInit (&md_ctx, EVP_sha1()); - EVP_VerifyUpdate (&md_ctx, data, strlen((char*)data)); - err = EVP_VerifyFinal (&md_ctx, sig_buf, sig_len, pkey); - EVP_PKEY_free (pkey); - - if (err != 1) { - ERR_print_errors_fp (stderr); - exit (1); - } - printf ("Signature Verified Ok.\n"); - return(0); -} diff --git a/demos/sign/sign.txt b/demos/sign/sign.txt deleted file mode 100644 index 2aa2b46cc36..00000000000 --- a/demos/sign/sign.txt +++ /dev/null @@ -1,170 +0,0 @@ -From [email protected] Mon Sep 30 22:43:15 1996 -Received: from cygnus.mincom.oz.au by orb.mincom.oz.au with SMTP id AA12802 - (5.65c/IDA-1.4.4 for eay); Mon, 30 Sep 1996 12:45:43 +1000 -Received: (from daemon@localhost) by cygnus.mincom.oz.au (8.7.5/8.7.3) id MAA25922 for ssl-users-outgoing; Mon, 30 Sep 1996 12:43:43 +1000 (EST) -Received: from orb.mincom.oz.au ([email protected] [192.55.197.1]) by cygnus.mincom.oz.au (8.7.5/8.7.3) with SMTP id MAA25900 for <[email protected]>; Mon, 30 Sep 1996 12:43:39 +1000 (EST) -Received: by orb.mincom.oz.au id AA12688 - (5.65c/IDA-1.4.4 for [email protected]); Mon, 30 Sep 1996 12:43:16 +1000 -Date: Mon, 30 Sep 1996 12:43:15 +1000 (EST) -From: Eric Young <[email protected]> -X-Sender: eay@orb -To: Sampo Kellomaki <[email protected]> -Subject: Re: Signing with envelope routines -In-Reply-To: <[email protected]> -Message-Id: <Pine.SOL.3.91.960930121504.11800Y-100000@orb> -Mime-Version: 1.0 -Content-Type: TEXT/PLAIN; charset=US-ASCII -Sender: [email protected] -Precedence: bulk -Status: O -X-Status: - - -On Mon, 30 Sep 1996, Sampo Kellomaki wrote: -> I have been trying to figure out how to produce signatures with EVP_ -> routines. I seem to be able to read in private key and sign some -> data ok, but I can't figure out how I am supposed to read in -> public key so that I could verify my signature. I use self signed -> certificate. - -hmm... a rather poorly documented are of the library at this point in time. - -> I figured I should use -> EVP_PKEY* pkey = PEM_ASN1_read(d2i_PrivateKey, PEM_STRING_EVP_PKEY, -> fp, NULL, NULL); -> to read in private key and this seems to work Ok. -> -> However when I try analogous -> EVP_PKEY* pkey = PEM_ASN1_read(d2i_PublicKey, PEM_STRING_X509, -> fp, NULL, NULL); - -What you should do is - X509 *x509=PEM_read_X509(fp,NULL,NULL); - /* which is the same as PEM_ASN1_read(d2i_X509,PEM_STRING_X509,fp, - * NULL,NULL); */ -Then - EVP_PKEY *pkey=X509_extract_key(x509); - -There is also a X509_REQ_extract_key(req); -which gets the public key from a certificate request. - -I re-worked quite a bit of this when I cleaned up the dependancy on -RSA as the private key. - -> I figured that the second argument to PEM_ASN1_read should match the -> name in my PEM encoded object, hence PEM_STRING_X509. -> PEM_STRING_EVP_PKEY seems to be somehow magical -> because it matches whatever private key there happens to be. I could -> not find a similar constant to use with getting the certificate, however. - -:-), PEM_STRING_EVP_PKEY is 'magical' :-). In theory I should be using a -standard such as PKCS#8 to store the private key so that the type is -encoded in the asn.1 encoding of the object. - -> Is my approach of using PEM_ASN1_read correct? What should I pass in -> as name? Can I use normal (or even self signed) X509 certificate for -> verifying the signature? - -The actual public key is kept in the certificate, so basically you have -to load the certificate and then 'unpack' the public key from the -certificate. - -> When will SSLeay documentation be written ;-)? If I would contribute -> comments to the code, would Eric take time to review them and include -> them in distribution? - -:-) After SSLv3 and PKCS#7 :-). I actually started doing a function list -but what I really need to do is do quite a few 'this is how you do xyz' -type documents. I suppose the current method is to post to ssl-users and -I'll respond :-). - -I'll add a 'demo' directory for the next release, I've appended a -modified version of your program that works, you were very close :-). - -eric - -/* sign-it.cpp - Simple test app using SSLeay envelopes to sign data - 29.9.1996, Sampo Kellomaki <[email protected]> */ - -/* converted to C - eay :-) */ - -#include <stdio.h> -#include "rsa.h" -#include "evp.h" -#include "objects.h" -#include "x509.h" -#include "err.h" -#include "pem.h" -#include "ssl.h" - -void main () -{ - int err; - int sig_len; - unsigned char sig_buf [4096]; - static char certfile[] = "plain-cert.pem"; - static char keyfile[] = "plain-key.pem"; - static char data[] = "I owe you..."; - EVP_MD_CTX md_ctx; - EVP_PKEY * pkey; - FILE * fp; - X509 * x509; - - /* Just load the crypto library error strings, - * SSL_load_error_strings() loads the crypto AND the SSL ones */ - /* SSL_load_error_strings();*/ - ERR_load_crypto_strings(); - - /* Read private key */ - - fp = fopen (keyfile, "r"); if (fp == NULL) exit (1); - pkey = (EVP_PKEY*)PEM_ASN1_read ((char *(*)())d2i_PrivateKey, - PEM_STRING_EVP_PKEY, - fp, - NULL, NULL); - if (pkey == NULL) { ERR_print_errors_fp (stderr); exit (1); } - fclose (fp); - - /* Do the signature */ - - EVP_SignInit (&md_ctx, EVP_md5()); - EVP_SignUpdate (&md_ctx, data, strlen(data)); - sig_len = sizeof(sig_buf); - err = EVP_SignFinal (&md_ctx, - sig_buf, - &sig_len, - pkey); - if (err != 1) { ERR_print_errors_fp (stderr); exit (1); } - EVP_PKEY_free (pkey); - - /* Read public key */ - - fp = fopen (certfile, "r"); if (fp == NULL) exit (1); - x509 = (X509 *)PEM_ASN1_read ((char *(*)())d2i_X509, - PEM_STRING_X509, - fp, NULL, NULL); - if (x509 == NULL) { ERR_print_errors_fp (stderr); exit (1); } - fclose (fp); - - /* Get public key - eay */ - pkey=X509_extract_key(x509); - if (pkey == NULL) { ERR_print_errors_fp (stderr); exit (1); } - - /* Verify the signature */ - - EVP_VerifyInit (&md_ctx, EVP_md5()); - EVP_VerifyUpdate (&md_ctx, data, strlen((char*)data)); - err = EVP_VerifyFinal (&md_ctx, - sig_buf, - sig_len, - pkey); - if (err != 1) { ERR_print_errors_fp (stderr); exit (1); } - EVP_PKEY_free (pkey); - printf ("Signature Verified Ok.\n"); -} - - - - - diff --git a/demos/spkigen.c b/demos/spkigen.c deleted file mode 100644 index d87881197c5..00000000000 --- a/demos/spkigen.c +++ /dev/null @@ -1,160 +0,0 @@ -/* NOCW */ -/* demos/spkigen.c - * 18-Mar-1997 - eay - A quick hack :-) - * version 1.1, it would probably help to save or load the - * private key :-) - */ -#include <stdio.h> -#include <stdlib.h> -#include <openssl/err.h> -#include <openssl/asn1.h> -#include <openssl/objects.h> -#include <openssl/evp.h> -#include <openssl/x509.h> -#include <openssl/pem.h> - -/* The following two don't exist in SSLeay but they are in here as - * examples */ -#define PEM_write_SPKI(fp,x) \ - PEM_ASN1_write((int (*)())i2d_NETSCAPE_SPKI,"SPKI",fp,\ - (char *)x,NULL,NULL,0,NULL) -int SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey); - -/* These are defined in the next version of SSLeay */ -int EVP_PKEY_assign(EVP_PKEY *pkey, int type,char *key); -#define RSA_F4 0x10001 -#define EVP_PKEY_assign_RSA(pkey,rsa) EVP_PKEY_assign((pkey),EVP_PKEY_RSA,\ - (char *)(rsa)) - -int main(argc,argv) -int argc; -char *argv[]; - { - RSA *rsa=NULL; - NETSCAPE_SPKI *spki=NULL; - EVP_PKEY *pkey=NULL; - char buf[128]; - int ok=0,i; - FILE *fp; - - pkey=EVP_PKEY_new(); - - if (argc < 2) - { - /* Generate an RSA key, the random state should have been seeded - * with lots of calls to RAND_seed(....) */ - fprintf(stderr,"generating RSA key, could take some time...\n"); - if ((rsa=RSA_generate_key(512,RSA_F4,NULL)) == NULL) goto err; - } - else - { - if ((fp=fopen(argv[1],"r")) == NULL) - { perror(argv[1]); goto err; } - if ((rsa=PEM_read_RSAPrivateKey(fp,NULL,NULL)) == NULL) - goto err; - fclose(fp); - } - - if (!EVP_PKEY_assign_RSA(pkey,rsa)) goto err; - rsa=NULL; - - /* lets make the spki and set the public key and challenge */ - if ((spki=NETSCAPE_SPKI_new()) == NULL) goto err; - - if (!SPKI_set_pubkey(spki,pkey)) goto err; - - fprintf(stderr,"please enter challenge string:"); - fflush(stderr); - fgets(buf,120,stdin); - i=strlen(buf); - if (i > 0) buf[--i]='\0'; - if (!ASN1_STRING_set((ASN1_STRING *)spki->spkac->challenge, - buf,i)) goto err; - - if (!NETSCAPE_SPKI_sign(spki,pkey,EVP_md5())) goto err; - PEM_write_SPKI(stdout,spki); - if (argc < 2) - PEM_write_RSAPrivateKey(stdout,pkey->pkey.rsa,NULL,NULL,0,NULL); - - ok=1; -err: - if (!ok) - { - fprintf(stderr,"something bad happened...."); - ERR_print_errors_fp(stderr); - } - NETSCAPE_SPKI_free(spki); - EVP_PKEY_free(pkey); - exit(!ok); - } - -/* This function is in the next version of SSLeay */ -int EVP_PKEY_assign(pkey,type,key) -EVP_PKEY *pkey; -int type; -char *key; - { - if (pkey == NULL) return(0); - if (pkey->pkey.ptr != NULL) - { - if (pkey->type == EVP_PKEY_RSA) - RSA_free(pkey->pkey.rsa); - /* else memory leak */ - } - pkey->type=type; - pkey->pkey.ptr=key; - return(1); - } - -/* While I have a - * X509_set_pubkey() and X509_REQ_set_pubkey(), SPKI_set_pubkey() does - * not currently exist so here is a version of it. - * The next SSLeay release will probably have - * X509_set_pubkey(), - * X509_REQ_set_pubkey() and - * NETSCAPE_SPKI_set_pubkey() - * as macros calling the same function */ -int SPKI_set_pubkey(x,pkey) -NETSCAPE_SPKI *x; -EVP_PKEY *pkey; - { - int ok=0; - X509_PUBKEY *pk; - X509_ALGOR *a; - ASN1_OBJECT *o; - unsigned char *s,*p; - int i; - - if (x == NULL) return(0); - - if ((pk=X509_PUBKEY_new()) == NULL) goto err; - a=pk->algor; - - /* set the algorithm id */ - if ((o=OBJ_nid2obj(pkey->type)) == NULL) goto err; - ASN1_OBJECT_free(a->algorithm); - a->algorithm=o; - - /* Set the parameter list */ - if ((a->parameter == NULL) || (a->parameter->type != V_ASN1_NULL)) - { - ASN1_TYPE_free(a->parameter); - a->parameter=ASN1_TYPE_new(); - a->parameter->type=V_ASN1_NULL; - } - i=i2d_PublicKey(pkey,NULL); - if ((s=(unsigned char *)malloc(i+1)) == NULL) goto err; - p=s; - i2d_PublicKey(pkey,&p); - if (!ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err; - free(s); - - X509_PUBKEY_free(x->spkac->pubkey); - x->spkac->pubkey=pk; - pk=NULL; - ok=1; -err: - if (pk != NULL) X509_PUBKEY_free(pk); - return(ok); - } - diff --git a/demos/ssl/cli.cpp b/demos/ssl/cli.cpp deleted file mode 100644 index 49cba5da0c8..00000000000 --- a/demos/ssl/cli.cpp +++ /dev/null @@ -1,110 +0,0 @@ -/* cli.cpp - Minimal ssleay client for Unix - 30.9.1996, Sampo Kellomaki <[email protected]> */ - -/* mangled to work with SSLeay-0.9.0b and OpenSSL 0.9.2b - Simplified to be even more minimal - 12/98 - 4/99 Wade Scholine <[email protected]> */ - -#include <stdio.h> -#include <memory.h> -#include <errno.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <netinet/in.h> -#include <arpa/inet.h> -#include <netdb.h> - -#include <openssl/crypto.h> -#include <openssl/x509.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> -#include <openssl/err.h> - - -#define CHK_NULL(x) if ((x)==NULL) exit (1) -#define CHK_ERR(err,s) if ((err)==-1) { perror(s); exit(1); } -#define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(stderr); exit(2); } - -void main () -{ - int err; - int sd; - struct sockaddr_in sa; - SSL_CTX* ctx; - SSL* ssl; - X509* server_cert; - char* str; - char buf [4096]; - SSL_METHOD *meth; - - SSLeay_add_ssl_algorithms(); - meth = SSLv2_client_method(); - SSL_load_error_strings(); - ctx = SSL_CTX_new (meth); CHK_NULL(ctx); - - CHK_SSL(err); - - /* ----------------------------------------------- */ - /* Create a socket and connect to server using normal socket calls. */ - - sd = socket (AF_INET, SOCK_STREAM, 0); CHK_ERR(sd, "socket"); - - memset (&sa, '\0', sizeof(sa)); - sa.sin_family = AF_INET; - sa.sin_addr.s_addr = inet_addr ("127.0.0.1"); /* Server IP */ - sa.sin_port = htons (1111); /* Server Port number */ - - err = connect(sd, (struct sockaddr*) &sa, - sizeof(sa)); CHK_ERR(err, "connect"); - - /* ----------------------------------------------- */ - /* Now we have TCP conncetion. Start SSL negotiation. */ - - ssl = SSL_new (ctx); CHK_NULL(ssl); - SSL_set_fd (ssl, sd); - err = SSL_connect (ssl); CHK_SSL(err); - - /* Following two steps are optional and not required for - data exchange to be successful. */ - - /* Get the cipher - opt */ - - printf ("SSL connection using %s\n", SSL_get_cipher (ssl)); - - /* Get server's certificate (note: beware of dynamic allocation) - opt */ - - server_cert = SSL_get_peer_certificate (ssl); CHK_NULL(server_cert); - printf ("Server certificate:\n"); - - str = X509_NAME_oneline (X509_get_subject_name (server_cert),0,0); - CHK_NULL(str); - printf ("\t subject: %s\n", str); - OPENSSL_free (str); - - str = X509_NAME_oneline (X509_get_issuer_name (server_cert),0,0); - CHK_NULL(str); - printf ("\t issuer: %s\n", str); - OPENSSL_free (str); - - /* We could do all sorts of certificate verification stuff here before - deallocating the certificate. */ - - X509_free (server_cert); - - /* --------------------------------------------------- */ - /* DATA EXCHANGE - Send a message and receive a reply. */ - - err = SSL_write (ssl, "Hello World!", strlen("Hello World!")); CHK_SSL(err); - - err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); - buf[err] = '\0'; - printf ("Got %d chars:'%s'\n", err, buf); - SSL_shutdown (ssl); /* send SSL/TLS close_notify */ - - /* Clean up. */ - - close (sd); - SSL_free (ssl); - SSL_CTX_free (ctx); -} -/* EOF - cli.cpp */ diff --git a/demos/ssl/inetdsrv.cpp b/demos/ssl/inetdsrv.cpp deleted file mode 100644 index efd70d2771b..00000000000 --- a/demos/ssl/inetdsrv.cpp +++ /dev/null @@ -1,98 +0,0 @@ -/* inetdserv.cpp - Minimal ssleay server for Unix inetd.conf - * 30.9.1996, Sampo Kellomaki <[email protected]> - * From /etc/inetd.conf: - * 1111 stream tcp nowait sampo /usr/users/sampo/demo/inetdserv inetdserv - */ - -#include <stdio.h> -#include <errno.h> - -#include "rsa.h" /* SSLeay stuff */ -#include <openssl/crypto.h> -#include <openssl/x509.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> -#include <openssl/err.h> - -#define HOME "/usr/users/sampo/demo/" -#define CERTF HOME "plain-cert.pem" -#define KEYF HOME "plain-key.pem" - -#define CHK_NULL(x) if ((x)==NULL) exit (1) -#define CHK_ERR(err,s) if ((err)==-1) \ - { fprintf(log, "%s %d\n", (s), errno); exit(1); } -#define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(log); exit(2); } - -void main () -{ - int err; - SSL_CTX* ctx; - SSL* ssl; - X509* client_cert; - char* str; - char buf [4096]; - FILE* log; - - log = fopen ("/dev/console", "a"); CHK_NULL(log); - fprintf (log, "inetdserv %ld\n", (long)getpid()); - - SSL_load_error_strings(); - ctx = SSL_CTX_new (); CHK_NULL(ctx); - - err = SSL_CTX_use_RSAPrivateKey_file (ctx, KEYF, SSL_FILETYPE_PEM); - CHK_SSL (err); - - err = SSL_CTX_use_certificate_file (ctx, CERTF, SSL_FILETYPE_PEM); - CHK_SSL (err); - - /* inetd has already opened the TCP connection, so we can get right - down to business. */ - - ssl = SSL_new (ctx); CHK_NULL(ssl); - SSL_set_fd (ssl, fileno(stdin)); - err = SSL_accept (ssl); CHK_SSL(err); - - /* Get the cipher - opt */ - - fprintf (log, "SSL connection using %s\n", SSL_get_cipher (ssl)); - - /* Get client's certificate (note: beware of dynamic allocation) - opt */ - - client_cert = SSL_get_peer_certificate (ssl); - if (client_cert != NULL) { - fprintf (log, "Client certificate:\n"); - - str = X509_NAME_oneline (X509_get_subject_name (client_cert)); - CHK_NULL(str); - fprintf (log, "\t subject: %s\n", str); - OPENSSL_free (str); - - str = X509_NAME_oneline (X509_get_issuer_name (client_cert)); - CHK_NULL(str); - fprintf (log, "\t issuer: %s\n", str); - OPENSSL_free (str); - - /* We could do all sorts of certificate verification stuff here before - deallocating the certificate. */ - - X509_free (client_cert); - } else - fprintf (log, "Client doe not have certificate.\n"); - - /* ------------------------------------------------- */ - /* DATA EXCHANGE: Receive message and send reply */ - - err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); - buf[err] = '\0'; - fprintf (log, "Got %d chars:'%s'\n", err, buf); - - err = SSL_write (ssl, "Loud and clear.", strlen("Loud and clear.")); - CHK_SSL(err); - - /* Clean up. */ - - fclose (log); - SSL_free (ssl); - SSL_CTX_free (ctx); -} -/* EOF - inetdserv.cpp */ diff --git a/demos/ssl/serv.cpp b/demos/ssl/serv.cpp deleted file mode 100644 index b142c758d2c..00000000000 --- a/demos/ssl/serv.cpp +++ /dev/null @@ -1,152 +0,0 @@ -/* serv.cpp - Minimal ssleay server for Unix - 30.9.1996, Sampo Kellomaki <[email protected]> */ - - -/* mangled to work with SSLeay-0.9.0b and OpenSSL 0.9.2b - Simplified to be even more minimal - 12/98 - 4/99 Wade Scholine <[email protected]> */ - -#include <stdio.h> -#include <unistd.h> -#include <stdlib.h> -#include <memory.h> -#include <errno.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <netinet/in.h> -#include <arpa/inet.h> -#include <netdb.h> - -#include <openssl/rsa.h> /* SSLeay stuff */ -#include <openssl/crypto.h> -#include <openssl/x509.h> -#include <openssl/pem.h> -#include <openssl/ssl.h> -#include <openssl/err.h> - - -/* define HOME to be dir for key and cert files... */ -#define HOME "./" -/* Make these what you want for cert & key files */ -#define CERTF HOME "foo-cert.pem" -#define KEYF HOME "foo-cert.pem" - - -#define CHK_NULL(x) if ((x)==NULL) exit (1) -#define CHK_ERR(err,s) if ((err)==-1) { perror(s); exit(1); } -#define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(stderr); exit(2); } - -void main () -{ - int err; - int listen_sd; - int sd; - struct sockaddr_in sa_serv; - struct sockaddr_in sa_cli; - size_t client_len; - SSL_CTX* ctx; - SSL* ssl; - X509* client_cert; - char* str; - char buf [4096]; - SSL_METHOD *meth; - - /* SSL preliminaries. We keep the certificate and key with the context. */ - - SSL_load_error_strings(); - SSLeay_add_ssl_algorithms(); - meth = SSLv23_server_method(); - ctx = SSL_CTX_new (meth); - if (!ctx) { - ERR_print_errors_fp(stderr); - exit(2); - } - - if (SSL_CTX_use_certificate_file(ctx, CERTF, SSL_FILETYPE_PEM) <= 0) { - ERR_print_errors_fp(stderr); - exit(3); - } - if (SSL_CTX_use_PrivateKey_file(ctx, KEYF, SSL_FILETYPE_PEM) <= 0) { - ERR_print_errors_fp(stderr); - exit(4); - } - - if (!SSL_CTX_check_private_key(ctx)) { - fprintf(stderr,"Private key does not match the certificate public key\n"); - exit(5); - } - - /* ----------------------------------------------- */ - /* Prepare TCP socket for receiving connections */ - - listen_sd = socket (AF_INET, SOCK_STREAM, 0); CHK_ERR(listen_sd, "socket"); - - memset (&sa_serv, '\0', sizeof(sa_serv)); - sa_serv.sin_family = AF_INET; - sa_serv.sin_addr.s_addr = INADDR_ANY; - sa_serv.sin_port = htons (1111); /* Server Port number */ - - err = bind(listen_sd, (struct sockaddr*) &sa_serv, - sizeof (sa_serv)); CHK_ERR(err, "bind"); - - /* Receive a TCP connection. */ - - err = listen (listen_sd, 5); CHK_ERR(err, "listen"); - - client_len = sizeof(sa_cli); - sd = accept (listen_sd, (struct sockaddr*) &sa_cli, &client_len); - CHK_ERR(sd, "accept"); - close (listen_sd); - - printf ("Connection from %lx, port %x\n", - sa_cli.sin_addr.s_addr, sa_cli.sin_port); - - /* ----------------------------------------------- */ - /* TCP connection is ready. Do server side SSL. */ - - ssl = SSL_new (ctx); CHK_NULL(ssl); - SSL_set_fd (ssl, sd); - err = SSL_accept (ssl); CHK_SSL(err); - - /* Get the cipher - opt */ - - printf ("SSL connection using %s\n", SSL_get_cipher (ssl)); - - /* Get client's certificate (note: beware of dynamic allocation) - opt */ - - client_cert = SSL_get_peer_certificate (ssl); - if (client_cert != NULL) { - printf ("Client certificate:\n"); - - str = X509_NAME_oneline (X509_get_subject_name (client_cert), 0, 0); - CHK_NULL(str); - printf ("\t subject: %s\n", str); - OPENSSL_free (str); - - str = X509_NAME_oneline (X509_get_issuer_name (client_cert), 0, 0); - CHK_NULL(str); - printf ("\t issuer: %s\n", str); - OPENSSL_free (str); - - /* We could do all sorts of certificate verification stuff here before - deallocating the certificate. */ - - X509_free (client_cert); - } else - printf ("Client does not have certificate.\n"); - - /* DATA EXCHANGE - Receive message and send reply. */ - - err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); - buf[err] = '\0'; - printf ("Got %d chars:'%s'\n", err, buf); - - err = SSL_write (ssl, "I hear you.", strlen("I hear you.")); CHK_SSL(err); - - /* Clean up. */ - - close (sd); - SSL_free (ssl); - SSL_CTX_free (ctx); -} -/* EOF - serv.cpp */ diff --git a/demos/state_machine/.cvsignore b/demos/state_machine/.cvsignore deleted file mode 100644 index 9aef0f5d4c0..00000000000 --- a/demos/state_machine/.cvsignore +++ /dev/null @@ -1 +0,0 @@ -state_machine diff --git a/demos/state_machine/Makefile b/demos/state_machine/Makefile deleted file mode 100644 index c7a114540de..00000000000 --- a/demos/state_machine/Makefile +++ /dev/null @@ -1,9 +0,0 @@ -CFLAGS=-I../../include -Wall -Werror -g - -all: state_machine - -state_machine: state_machine.o - $(CC) -o state_machine state_machine.o -L../.. -lssl -lcrypto - -test: state_machine - ./state_machine 10000 ../../apps/server.pem ../../apps/server.pem diff --git a/demos/state_machine/state_machine.c b/demos/state_machine/state_machine.c deleted file mode 100644 index 0140fbca704..00000000000 --- a/demos/state_machine/state_machine.c +++ /dev/null @@ -1,395 +0,0 @@ -/* ==================================================================== - * Copyright (c) 2000 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * [email protected]. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * ([email protected]). This product includes software written by Tim - * Hudson ([email protected]). - * - */ - -/* - * Nuron, a leader in hardware encryption technology, generously - * sponsored the development of this demo by Ben Laurie. - * - * See http://www.nuron.com/. - */ - -/* - * the aim of this demo is to provide a fully working state-machine - * style SSL implementation, i.e. one where the main loop acquires - * some data, then converts it from or to SSL by feeding it into the - * SSL state machine. It then does any I/O required by the state machine - * and loops. - * - * In order to keep things as simple as possible, this implementation - * listens on a TCP socket, which it expects to get an SSL connection - * on (for example, from s_client) and from then on writes decrypted - * data to stdout and encrypts anything arriving on stdin. Verbose - * commentary is written to stderr. - * - * This implementation acts as a server, but it can also be done for a client. */ - -#include <openssl/ssl.h> -#include <assert.h> -#include <unistd.h> -#include <string.h> -#include <openssl/err.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <netinet/in.h> - -/* die_unless is intended to work like assert, except that it happens - always, even if NDEBUG is defined. Use assert as a stopgap. */ - -#define die_unless(x) assert(x) - -typedef struct - { - SSL_CTX *pCtx; - BIO *pbioRead; - BIO *pbioWrite; - SSL *pSSL; - } SSLStateMachine; - -void SSLStateMachine_print_error(SSLStateMachine *pMachine,const char *szErr) - { - unsigned long l; - - fprintf(stderr,"%s\n",szErr); - while((l=ERR_get_error())) - { - char buf[1024]; - - ERR_error_string_n(l,buf,sizeof buf); - fprintf(stderr,"Error %lx: %s\n",l,buf); - } - } - -SSLStateMachine *SSLStateMachine_new(const char *szCertificateFile, - const char *szKeyFile) - { - SSLStateMachine *pMachine=malloc(sizeof *pMachine); - int n; - - die_unless(pMachine); - - pMachine->pCtx=SSL_CTX_new(SSLv23_server_method()); - die_unless(pMachine->pCtx); - - n=SSL_CTX_use_certificate_file(pMachine->pCtx,szCertificateFile, - SSL_FILETYPE_PEM); - die_unless(n > 0); - - n=SSL_CTX_use_PrivateKey_file(pMachine->pCtx,szKeyFile,SSL_FILETYPE_PEM); - die_unless(n > 0); - - pMachine->pSSL=SSL_new(pMachine->pCtx); - die_unless(pMachine->pSSL); - - pMachine->pbioRead=BIO_new(BIO_s_mem()); - - pMachine->pbioWrite=BIO_new(BIO_s_mem()); - - SSL_set_bio(pMachine->pSSL,pMachine->pbioRead,pMachine->pbioWrite); - - SSL_set_accept_state(pMachine->pSSL); - - return pMachine; - } - -void SSLStateMachine_read_inject(SSLStateMachine *pMachine, - const unsigned char *aucBuf,int nBuf) - { - int n=BIO_write(pMachine->pbioRead,aucBuf,nBuf); - /* If it turns out this assert fails, then buffer the data here - * and just feed it in in churn instead. Seems to me that it - * should be guaranteed to succeed, though. - */ - assert(n == nBuf); - fprintf(stderr,"%d bytes of encrypted data fed to state machine\n",n); - } - -int SSLStateMachine_read_extract(SSLStateMachine *pMachine, - unsigned char *aucBuf,int nBuf) - { - int n; - - if(!SSL_is_init_finished(pMachine->pSSL)) - { - fprintf(stderr,"Doing SSL_accept\n"); - n=SSL_accept(pMachine->pSSL); - if(n == 0) - fprintf(stderr,"SSL_accept returned zero\n"); - if(n < 0) - { - int err; - - if((err=SSL_get_error(pMachine->pSSL,n)) == SSL_ERROR_WANT_READ) - { - fprintf(stderr,"SSL_accept wants more data\n"); - return 0; - } - - SSLStateMachine_print_error(pMachine,"SSL_accept error"); - exit(7); - } - return 0; - } - - n=SSL_read(pMachine->pSSL,aucBuf,nBuf); - if(n < 0) - { - int err=SSL_get_error(pMachine->pSSL,n); - - if(err == SSL_ERROR_WANT_READ) - { - fprintf(stderr,"SSL_read wants more data\n"); - return 0; - } - } - - fprintf(stderr,"%d bytes of decrypted data read from state machine\n",n); - return n; - } - -int SSLStateMachine_write_can_extract(SSLStateMachine *pMachine) - { - int n=BIO_pending(pMachine->pbioWrite); - if(n) - fprintf(stderr,"There is encrypted data available to write\n"); - else - fprintf(stderr,"There is no encrypted data available to write\n"); - - return n; - } - -int SSLStateMachine_write_extract(SSLStateMachine *pMachine, - unsigned char *aucBuf,int nBuf) - { - int n; - - n=BIO_read(pMachine->pbioWrite,aucBuf,nBuf); - fprintf(stderr,"%d bytes of encrypted data read from state machine\n",n); - return n; - } - -void SSLStateMachine_write_inject(SSLStateMachine *pMachine, - const unsigned char *aucBuf,int nBuf) - { - int n=SSL_write(pMachine->pSSL,aucBuf,nBuf); - /* If it turns out this assert fails, then buffer the data here - * and just feed it in in churn instead. Seems to me that it - * should be guaranteed to succeed, though. - */ - assert(n == nBuf); - fprintf(stderr,"%d bytes of unencrypted data fed to state machine\n",n); - } - -int OpenSocket(int nPort) - { - int nSocket; - struct sockaddr_in saServer; - struct sockaddr_in saClient; - int one=1; - int nSize; - int nFD; - int nLen; - - nSocket=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); - if(nSocket < 0) - { - perror("socket"); - exit(1); - } - - if(setsockopt(nSocket,SOL_SOCKET,SO_REUSEADDR,(char *)&one,sizeof one) < 0) - { - perror("setsockopt"); - exit(2); - } - - memset(&saServer,0,sizeof saServer); - saServer.sin_family=AF_INET; - saServer.sin_port=htons(nPort); - nSize=sizeof saServer; - if(bind(nSocket,(struct sockaddr *)&saServer,nSize) < 0) - { - perror("bind"); - exit(3); - } - - if(listen(nSocket,512) < 0) - { - perror("listen"); - exit(4); - } - - nLen=sizeof saClient; - nFD=accept(nSocket,(struct sockaddr *)&saClient,&nLen); - if(nFD < 0) - { - perror("accept"); - exit(5); - } - - fprintf(stderr,"Incoming accepted on port %d\n",nPort); - - return nFD; - } - -int main(int argc,char **argv) - { - SSLStateMachine *pMachine; - int nPort; - int nFD; - const char *szCertificateFile; - const char *szKeyFile; - - if(argc != 4) - { - fprintf(stderr,"%s <port> <certificate file> <key file>\n",argv[0]); - exit(6); - } - - nPort=atoi(argv[1]); - szCertificateFile=argv[2]; - szKeyFile=argv[3]; - - SSL_library_init(); - OpenSSL_add_ssl_algorithms(); - SSL_load_error_strings(); - ERR_load_crypto_strings(); - - nFD=OpenSocket(nPort); - - pMachine=SSLStateMachine_new(szCertificateFile,szKeyFile); - - for( ; ; ) - { - fd_set rfds,wfds; - unsigned char buf[1024]; - int n; - - FD_ZERO(&rfds); - FD_ZERO(&wfds); - - /* Select socket for input */ - FD_SET(nFD,&rfds); - - /* Select socket for output */ - if(SSLStateMachine_write_can_extract(pMachine)) - FD_SET(nFD,&wfds); - - /* Select stdin for input */ - FD_SET(0,&rfds); - - /* Wait for something to do something */ - n=select(nFD+1,&rfds,&wfds,NULL,NULL); - assert(n > 0); - - /* Socket is ready for input */ - if(FD_ISSET(nFD,&rfds)) - { - n=read(nFD,buf,sizeof buf); - if(n == 0) - { - fprintf(stderr,"Got EOF on socket\n"); - exit(0); - } - assert(n > 0); - - SSLStateMachine_read_inject(pMachine,buf,n); - } - - /* FIXME: we should only extract if stdout is ready */ - n=SSLStateMachine_read_extract(pMachine,buf,n); - if(n < 0) - { - SSLStateMachine_print_error(pMachine,"read extract failed"); - break; - } - assert(n >= 0); - if(n > 0) - { - int w; - - w=write(1,buf,n); - /* FIXME: we should push back any unwritten data */ - assert(w == n); - } - - /* Socket is ready for output (and therefore we have output to send) */ - if(FD_ISSET(nFD,&wfds)) - { - int w; - - n=SSLStateMachine_write_extract(pMachine,buf,sizeof buf); - assert(n > 0); - - w=write(nFD,buf,n); - /* FIXME: we should push back any unwritten data */ - assert(w == n); - } - - /* Stdin is ready for input */ - if(FD_ISSET(0,&rfds)) - { - n=read(0,buf,sizeof buf); - if(n == 0) - { - fprintf(stderr,"Got EOF on stdin\n"); - exit(0); - } - assert(n > 0); - - SSLStateMachine_write_inject(pMachine,buf,n); - } - } - /* not reached */ - return 0; - } diff --git a/demos/tunala/A-client.pem b/demos/tunala/A-client.pem deleted file mode 100644 index 6b6c3411828..00000000000 --- a/demos/tunala/A-client.pem +++ /dev/null @@ -1,85 +0,0 @@ -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=NZ, L=Wellington, O=Really Irresponsible Authorisation Authority (RIAA), OU=Cert-stamping, CN=Jackov al-Trades/[email protected] - Validity - Not Before: Nov 1 21:09:30 2000 GMT - Not After : Nov 1 21:09:30 2001 GMT - Subject: C=NZ, L=Auckland, O=Silly City-Boys Corp., OU=Internal counselling, CN=tunala-client/[email protected] - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:a5:b2:8e:de:05:d1:fe:29:f7:46:a6:6b:a0:e5: - 41:2c:f7:55:a8:53:5a:e8:37:1a:68:29:5d:fd:7e: - a4:40:b5:ce:e0:44:54:9e:c6:f8:9a:40:bb:45:41: - 57:cc:dc:97:d9:66:3e:68:9d:29:93:15:f9:2b:75: - aa:49:7f:e6:cf:7f:95:44:8e:41:ed:05:97:1e:cb: - 3f:03:33:b0:21:2b:89:67:08:cc:7b:b2:ef:fa:26: - c7:ea:21:f2:77:5f:bd:e2:67:36:0a:e2:3d:ee:76: - 4f:d2:d3:e9:bb:22:c0:bb:0c:e4:a2:8c:aa:71:3b: - 75:6c:46:a7:d2:1b:57:ee:f3 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: - CA:FALSE - Netscape Comment: - OpenSSL Generated Certificate - X509v3 Subject Key Identifier: - 74:A8:8B:1F:5B:59:55:09:CB:98:5C:2F:41:87:CA:AC:D4:B5:04:FF - X509v3 Authority Key Identifier: - keyid:57:5A:5D:E0:71:0B:0C:E0:0F:51:87:DE:08:C8:25:E7:F7:87:46:C0 - DirName:/C=NZ/L=Wellington/O=Really Irresponsible Authorisation Authority (RIAA)/OU=Cert-stamping/CN=Jackov al-Trades/[email protected] - serial:00 - - Signature Algorithm: md5WithRSAEncryption - 5f:36:74:77:1d:c7:56:71:d3:32:30:12:8f:4d:8e:25:90:1c: - b3:2e:e0:c1:77:75:ea:2c:aa:ef:82:c8:e0:86:8c:df:dc:e1: - 86:68:81:91:1e:4e:56:b1:5d:93:6f:80:10:80:c3:d8:c4:3b: - 0f:20:dd:43:b5:f8:09:a4:bb:a9:04:11:e0:d4:f9:d9:83:19: - 2a:da:7c:bb:4c:c2:4f:57:43:0d:1a:1e:31:61:fb:24:62:92: - 74:12:9c:51:ef:12:3e:23:e4:45:66:2b:ac:00:60:bf:a0:ff: - 43:da:95:c3:cf:64:40:d2:97:8d:c1:dd:26:ce:5f:b9:a1:ea: - 92:32 ------BEGIN CERTIFICATE----- -MIIECDCCA3GgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBtDELMAkGA1UEBhMCTlox -EzARBgNVBAcTCldlbGxpbmd0b24xPDA6BgNVBAoTM1JlYWxseSBJcnJlc3BvbnNp -YmxlIEF1dGhvcmlzYXRpb24gQXV0aG9yaXR5IChSSUFBKTEWMBQGA1UECxMNQ2Vy -dC1zdGFtcGluZzEZMBcGA1UEAxMQSmFja292IGFsLVRyYWRlczEfMB0GCSqGSIb3 -DQEJARYQbm9uZUBmYWtlLmRvbWFpbjAeFw0wMDExMDEyMTA5MzBaFw0wMTExMDEy -MTA5MzBaMIGaMQswCQYDVQQGEwJOWjERMA8GA1UEBxMIQXVja2xhbmQxHjAcBgNV -BAoTFVNpbGx5IENpdHktQm95cyBDb3JwLjEdMBsGA1UECxMUSW50ZXJuYWwgY291 -bnNlbGxpbmcxFjAUBgNVBAMTDXR1bmFsYS1jbGllbnQxITAfBgkqhkiG9w0BCQEW -EmNsaWVudEBmYWtlLmRvbWFpbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA -pbKO3gXR/in3RqZroOVBLPdVqFNa6DcaaCld/X6kQLXO4ERUnsb4mkC7RUFXzNyX -2WY+aJ0pkxX5K3WqSX/mz3+VRI5B7QWXHss/AzOwISuJZwjMe7Lv+ibH6iHyd1+9 -4mc2CuI97nZP0tPpuyLAuwzkooyqcTt1bEan0htX7vMCAwEAAaOCAUAwggE8MAkG -A1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRp -ZmljYXRlMB0GA1UdDgQWBBR0qIsfW1lVCcuYXC9Bh8qs1LUE/zCB4QYDVR0jBIHZ -MIHWgBRXWl3gcQsM4A9Rh94IyCXn94dGwKGBuqSBtzCBtDELMAkGA1UEBhMCTlox -EzARBgNVBAcTCldlbGxpbmd0b24xPDA6BgNVBAoTM1JlYWxseSBJcnJlc3BvbnNp -YmxlIEF1dGhvcmlzYXRpb24gQXV0aG9yaXR5IChSSUFBKTEWMBQGA1UECxMNQ2Vy -dC1zdGFtcGluZzEZMBcGA1UEAxMQSmFja292IGFsLVRyYWRlczEfMB0GCSqGSIb3 -DQEJARYQbm9uZUBmYWtlLmRvbWFpboIBADANBgkqhkiG9w0BAQQFAAOBgQBfNnR3 -HcdWcdMyMBKPTY4lkByzLuDBd3XqLKrvgsjghozf3OGGaIGRHk5WsV2Tb4AQgMPY -xDsPIN1DtfgJpLupBBHg1PnZgxkq2ny7TMJPV0MNGh4xYfskYpJ0EpxR7xI+I+RF -ZiusAGC/oP9D2pXDz2RA0peNwd0mzl+5oeqSMg== ------END CERTIFICATE----- - ------BEGIN RSA PRIVATE KEY----- -MIICWwIBAAKBgQClso7eBdH+KfdGpmug5UEs91WoU1roNxpoKV39fqRAtc7gRFSe -xviaQLtFQVfM3JfZZj5onSmTFfkrdapJf+bPf5VEjkHtBZceyz8DM7AhK4lnCMx7 -su/6JsfqIfJ3X73iZzYK4j3udk/S0+m7IsC7DOSijKpxO3VsRqfSG1fu8wIDAQAB -AoGAUWBCHfQJz6NYl8//p8MvoR/PZ52YVddKFsHKMUbS8BzZ/vZQALKDQW5tCnQu -5KOpx9EY8VPOKThvaNKe0P4Joi+ozOm9UHABAQAL/dzk6NP4NG/GYoBdYDhRowbo -3mdxgbJ95INznK3WhGZNGnhd4umz0P67U2xyc5PklKqCGuECQQDcZQE0ZTi1hQ7Z -hStH5h0soyz9VQrx9wF5nfC64lKbh0f6k/pRJqanJ9EDE9od1tuxyWi0IGhOWGC0 -LPeB3S+LAkEAwHdptzi+c4hsGqoAEIuYvXah02LOYS2nCpcOssy3jwj8u6IWqiDf -KGt8J3S5u1afRIca9wgJiFME754FYdQrOQJACerNnBL1800Sdv1EDk8vfuO00Y1z -GaI4wcU2oOIwP2ld9suT1vT7SMhE4nORPAiACEb83CYdK3FUoKbpWEGgswJAe8aP -+yAIAz7x3vgDUKCmGvqHOe2qMf7tFTduYXicd+Vcu8KS9thrC5CMaMd9hsg/Zw/I -PKQzlTNm0j760R5kqQJAeO239gMrscKDFvsqSYr3UKf7uJxCetikhVZE1LH//WiM -Rl5jhu6fL9FgNWuyM0z8VTIgZAX6RwZdn1fb3mFYjw== ------END RSA PRIVATE KEY----- diff --git a/demos/tunala/A-server.pem b/demos/tunala/A-server.pem deleted file mode 100644 index a35661b963e..00000000000 --- a/demos/tunala/A-server.pem +++ /dev/null @@ -1,85 +0,0 @@ -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 2 (0x2) - Signature Algorithm: md5WithRSAEncryption - Issuer: C=NZ, L=Wellington, O=Really Irresponsible Authorisation Authority (RIAA), OU=Cert-stamping, CN=Jackov al-Trades/[email protected] - Validity - Not Before: Nov 1 21:14:03 2000 GMT - Not After : Nov 1 21:14:03 2001 GMT - Subject: C=NZ, L=Wellington, O=The Stuff of Culture and Taste, OU=SSL dev things, CN=tunala-server/[email protected] - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (1024 bit) - Modulus (1024 bit): - 00:a7:07:a0:70:5e:76:4e:98:46:70:0e:53:e3:09: - f4:18:7b:c2:7e:8a:d9:3c:12:52:24:9f:bf:76:e1: - 0e:ca:99:c0:ed:fb:0f:7c:d1:1a:6d:9c:1f:e0:19: - 3a:65:a4:00:26:19:5b:5f:0e:6d:a2:b0:49:0c:28: - 40:c5:43:94:55:57:50:d4:28:8a:35:3c:73:f3:bb: - 5a:14:1f:ac:85:ba:b1:20:26:98:9a:92:94:96:fb: - 90:1d:c4:18:04:f5:7e:f1:21:d7:34:5c:6e:14:b6: - 9b:48:ac:85:c0:50:d9:cf:79:67:a8:9e:3f:80:6c: - ff:68:95:4c:52:95:c9:23:41 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: - CA:FALSE - Netscape Comment: - OpenSSL Generated Certificate - X509v3 Subject Key Identifier: - 9F:91:73:D0:8D:11:13:25:8B:68:2A:40:57:8D:96:B7:62:0B:6E:0E - X509v3 Authority Key Identifier: - keyid:57:5A:5D:E0:71:0B:0C:E0:0F:51:87:DE:08:C8:25:E7:F7:87:46:C0 - DirName:/C=NZ/L=Wellington/O=Really Irresponsible Authorisation Authority (RIAA)/OU=Cert-stamping/CN=Jackov al-Trades/[email protected] - serial:00 - - Signature Algorithm: md5WithRSAEncryption - 27:c3:c3:d8:2e:b2:12:0c:b0:4c:bd:a4:d0:34:77:fe:13:6f: - 5e:8d:2c:50:c9:b5:a7:80:16:79:73:68:45:a1:5a:ed:74:d8: - 7c:92:f4:04:c0:6b:da:a5:ca:6d:03:2c:cc:f9:32:f9:fb:b9: - be:83:5a:4b:c5:54:1d:07:02:a4:78:c4:90:49:f6:bb:0f:32: - 57:86:ff:17:99:7a:a0:85:5f:ee:45:db:28:5f:91:66:d2:35: - 54:d7:c2:55:26:ff:ea:b7:3a:d0:3f:fd:6a:dd:26:35:3f:18: - 4e:c5:fa:36:d6:71:41:05:a0:4a:49:5d:b7:87:ee:6f:38:17: - 9a:4a ------BEGIN CERTIFICATE----- -MIIEDTCCA3agAwIBAgIBAjANBgkqhkiG9w0BAQQFADCBtDELMAkGA1UEBhMCTlox -EzARBgNVBAcTCldlbGxpbmd0b24xPDA6BgNVBAoTM1JlYWxseSBJcnJlc3BvbnNp -YmxlIEF1dGhvcmlzYXRpb24gQXV0aG9yaXR5IChSSUFBKTEWMBQGA1UECxMNQ2Vy -dC1zdGFtcGluZzEZMBcGA1UEAxMQSmFja292IGFsLVRyYWRlczEfMB0GCSqGSIb3 -DQEJARYQbm9uZUBmYWtlLmRvbWFpbjAeFw0wMDExMDEyMTE0MDNaFw0wMTExMDEy -MTE0MDNaMIGfMQswCQYDVQQGEwJOWjETMBEGA1UEBxMKV2VsbGluZ3RvbjEnMCUG -A1UEChMeVGhlIFN0dWZmIG9mIEN1bHR1cmUgYW5kIFRhc3RlMRcwFQYDVQQLEw5T -U0wgZGV2IHRoaW5nczEWMBQGA1UEAxMNdHVuYWxhLXNlcnZlcjEhMB8GCSqGSIb3 -DQEJARYSc2VydmVyQGZha2UuZG9tYWluMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB -iQKBgQCnB6BwXnZOmEZwDlPjCfQYe8J+itk8ElIkn7924Q7KmcDt+w980RptnB/g -GTplpAAmGVtfDm2isEkMKEDFQ5RVV1DUKIo1PHPzu1oUH6yFurEgJpiakpSW+5Ad -xBgE9X7xIdc0XG4UtptIrIXAUNnPeWeonj+AbP9olUxSlckjQQIDAQABo4IBQDCC -ATwwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQg -Q2VydGlmaWNhdGUwHQYDVR0OBBYEFJ+Rc9CNERMli2gqQFeNlrdiC24OMIHhBgNV -HSMEgdkwgdaAFFdaXeBxCwzgD1GH3gjIJef3h0bAoYG6pIG3MIG0MQswCQYDVQQG -EwJOWjETMBEGA1UEBxMKV2VsbGluZ3RvbjE8MDoGA1UEChMzUmVhbGx5IElycmVz -cG9uc2libGUgQXV0aG9yaXNhdGlvbiBBdXRob3JpdHkgKFJJQUEpMRYwFAYDVQQL -Ew1DZXJ0LXN0YW1waW5nMRkwFwYDVQQDExBKYWNrb3YgYWwtVHJhZGVzMR8wHQYJ -KoZIhvcNAQkBFhBub25lQGZha2UuZG9tYWluggEAMA0GCSqGSIb3DQEBBAUAA4GB -ACfDw9gushIMsEy9pNA0d/4Tb16NLFDJtaeAFnlzaEWhWu102HyS9ATAa9qlym0D -LMz5Mvn7ub6DWkvFVB0HAqR4xJBJ9rsPMleG/xeZeqCFX+5F2yhfkWbSNVTXwlUm -/+q3OtA//WrdJjU/GE7F+jbWcUEFoEpJXbeH7m84F5pK ------END CERTIFICATE----- - ------BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQCnB6BwXnZOmEZwDlPjCfQYe8J+itk8ElIkn7924Q7KmcDt+w98 -0RptnB/gGTplpAAmGVtfDm2isEkMKEDFQ5RVV1DUKIo1PHPzu1oUH6yFurEgJpia -kpSW+5AdxBgE9X7xIdc0XG4UtptIrIXAUNnPeWeonj+AbP9olUxSlckjQQIDAQAB -AoGAJPm/PqDqt8Nl9HB3iY8uhiz/hVvfczjrDkh+7iYsTBV1bDlj2FHB8/nX5Jgx -IUcI8WYzn/tlsdoskZBnpkOrlk0naOsgQk7Osh7Dn5sprRU0ieCgFhD/2DJNjJUE -ZfHrjXwr8LeG2CMa/FzkfkjDPC40gT8plbTOXmLECrjiEnECQQDaukSpJHX4JVtL -08j/mmKoBtBBVyzcSdxxHRXKBp+ivdszHC82oKH4yKwFdsfP6lX7iRsjKWIkdIiA -M9ZDF4TLAkEAw34aSYXWJttRr91HZ+aDXbxTnaaqdrwP1hUJM7dH/a1DQDoxV1vR -SWDX8YHSXgqPsxNtlW8bRtjh5cNWeZICowJAeS1A5MRCZxurHLNUY+dQSO6dadW2 -EMUKz8/hRm+s+ShdzE8NCSKtGXtzcgOAZ3vX7ubilfRTXwcAqKYPSlQ5SQJAFg2G -p56abt201FLw+C6PySYyhIlFl4lVe//5fsUBMQO3n2oxILqx3EY5dfwAIC2u0jOx -2/ahrBdRPFsRyTsIYwJBALAxKM5g7Qw0JgQ3gJnczY3/rpwlUhayYRYrNy1pJKp3 -hlVv+s5Oy1vXXppVfm830Eii7hsVp5PCFN+jRQhkFqw= ------END RSA PRIVATE KEY----- diff --git a/demos/tunala/CA.pem b/demos/tunala/CA.pem deleted file mode 100644 index 00d1e362903..00000000000 --- a/demos/tunala/CA.pem +++ /dev/null @@ -1,24 +0,0 @@ ------BEGIN CERTIFICATE----- -MIID9zCCA2CgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBtDELMAkGA1UEBhMCTlox -EzARBgNVBAcTCldlbGxpbmd0b24xPDA6BgNVBAoTM1JlYWxseSBJcnJlc3BvbnNp -YmxlIEF1dGhvcmlzYXRpb24gQXV0aG9yaXR5IChSSUFBKTEWMBQGA1UECxMNQ2Vy -dC1zdGFtcGluZzEZMBcGA1UEAxMQSmFja292IGFsLVRyYWRlczEfMB0GCSqGSIb3 -DQEJARYQbm9uZUBmYWtlLmRvbWFpbjAeFw0wMDExMDEyMTA3MDdaFw0wMTExMDEy -MTA3MDdaMIG0MQswCQYDVQQGEwJOWjETMBEGA1UEBxMKV2VsbGluZ3RvbjE8MDoG -A1UEChMzUmVhbGx5IElycmVzcG9uc2libGUgQXV0aG9yaXNhdGlvbiBBdXRob3Jp -dHkgKFJJQUEpMRYwFAYDVQQLEw1DZXJ0LXN0YW1waW5nMRkwFwYDVQQDExBKYWNr -b3YgYWwtVHJhZGVzMR8wHQYJKoZIhvcNAQkBFhBub25lQGZha2UuZG9tYWluMIGf -MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCj2aqRye4r8KZ0XKNC68elRVa5AHQY -Igd2K5OYkxACU+UkGzkPoYUz6Uq/kFjXa0lftCxMBvr3FoPb/MMVD+0LeFcJQza5 -dMfp3abLe7mttgU2fAQzC6OMetXvqVaBp/rlT0AE2DhzA4g+p51ivkG/pw2zDpra -nHaFsoRKg5puhQIDAQABo4IBFTCCAREwHQYDVR0OBBYEFFdaXeBxCwzgD1GH3gjI -Jef3h0bAMIHhBgNVHSMEgdkwgdaAFFdaXeBxCwzgD1GH3gjIJef3h0bAoYG6pIG3 -MIG0MQswCQYDVQQGEwJOWjETMBEGA1UEBxMKV2VsbGluZ3RvbjE8MDoGA1UEChMz -UmVhbGx5IElycmVzcG9uc2libGUgQXV0aG9yaXNhdGlvbiBBdXRob3JpdHkgKFJJ -QUEpMRYwFAYDVQQLEw1DZXJ0LXN0YW1waW5nMRkwFwYDVQQDExBKYWNrb3YgYWwt -VHJhZGVzMR8wHQYJKoZIhvcNAQkBFhBub25lQGZha2UuZG9tYWluggEAMAwGA1Ud -EwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEARuRhKpXa7K2HZEvoIWlLxF/ZrpfB -Zy2ixH25Uk8OnWm/NiS7eQAuR3aRWtEUsMENj1bC9I3hDk6zJVubp8TN0MPlvDvw -gOsMkGGSoumZRPh2aQadcmdBAHSMUMxNHGG0VdhXhodYZCF0H7z0gvKMPVTuIH5U -K2Iq6/aBOw9XbKM= ------END CERTIFICATE----- diff --git a/demos/tunala/Makefile b/demos/tunala/Makefile deleted file mode 100644 index fd5b651bc78..00000000000 --- a/demos/tunala/Makefile +++ /dev/null @@ -1,40 +0,0 @@ -# Edit these to suit -# -# Oh yeah, and please read the README too. - - -SSL_HOMEDIR=../.. -SSL_INCLUDEDIR=$(SSL_HOMEDIR)/include -SSL_LIBDIR=$(SSL_HOMEDIR) - -RM=rm -f -CC=gcc -DEBUG_FLAGS=-g -ggdb3 -Wall -Wshadow -INCLUDE_FLAGS=-I$(SSL_INCLUDEDIR) -CFLAGS=$(DEBUG_FLAGS) $(INCLUDE_FLAGS) -COMPILE=$(CC) $(CFLAGS) -c - -# Edit, particularly the "-ldl" if not building with "dlfcn" support -LINK_FLAGS=-L$(SSL_LIBDIR) -lssl -lcrypto -ldl - -SRCS=buffer.c ip.c sm.c tunala.c -OBJS=buffer.o ip.o sm.o tunala.o - -TARGETS=tunala - -default: $(TARGETS) - -clean: - $(RM) $(OBJS) $(TARGETS) *.bak core - -.c.o: - $(COMPILE) $< - -tunala: $(OBJS) - $(CC) -o tunala $(OBJS) $(LINK_FLAGS) - -# Extra dependencies, should really use makedepend -buffer.o: buffer.c tunala.h -ip.o: ip.c tunala.h -sm.o: sm.c tunala.h -tunala.o: tunala.c tunala.h diff --git a/demos/tunala/README b/demos/tunala/README deleted file mode 100644 index c59fd92bda3..00000000000 --- a/demos/tunala/README +++ /dev/null @@ -1,233 +0,0 @@ -This is intended to be an example of a state-machine driven SSL application. It -acts as an SSL tunneler (functioning as either the server or client half, -depending on command-line arguments). *PLEASE* read the comments in tunala.h -before you treat this stuff as anything more than a curiosity - YOU HAVE BEEN -WARNED!! There, that's the draconian bit out of the way ... - - -Why "tunala"?? --------------- - -I thought I asked you to read tunala.h?? :-) - - -Show me -------- - -If you want to simply see it running, skip to the end and see some example -command-line arguments to demonstrate with. - - -Where to look and what to do? ------------------------------ - -The code is split up roughly coinciding with the detaching of an "abstract" SSL -state machine (which is the purpose of all this) and its surrounding application -specifics. This is primarily to make it possible for me to know when I could cut -corners and when I needed to be rigorous (or at least maintain the pretense as -such :-). - -Network stuff: - -Basically, the network part of all this is what is supposed to be abstracted out -of the way. The intention is to illustrate one way to stick OpenSSL's mechanisms -inside a little memory-driven sandbox and operate it like a pure state-machine. -So, the network code is inside both ip.c (general utility functions and gory -IPv4 details) and tunala.c itself, which takes care of application specifics -like the main select() loop. The connectivity between the specifics of this -application (TCP/IP tunneling and the associated network code) and the -underlying abstract SSL state machine stuff is through the use of the "buffer_t" -type, declared in tunala.h and implemented in buffer.c. - -State machine: - -Which leaves us, generally speaking, with the abstract "state machine" code left -over and this is sitting inside sm.c, with declarations inside tunala.h. As can -be seen by the definition of the state_machine_t structure and the associated -functions to manipulate it, there are the 3 OpenSSL "handles" plus 4 buffer_t -structures dealing with IO on both the encrypted and unencrypted sides ("dirty" -and "clean" respectively). The "SSL" handle is what facilitates the reading and -writing of the unencrypted (tunneled) data. The two "BIO" handles act as the -read and write channels for encrypted tunnel traffic - in other applications -these are often socket BIOs so that the OpenSSL framework operates with the -network layer directly. In this example, those two BIOs are memory BIOs -(BIO_s_mem()) so that the sending and receiving of the tunnel traffic stays -within the state-machine, and we can handle where this gets send to (or read -from) ourselves. - - -Why? ----- - -If you take a look at the "state_machine_t" section of tunala.h and the code in -sm.c, you will notice that nothing related to the concept of 'transport' is -involved. The binding to TCP/IP networking occurs in tunala.c, specifically -within the "tunala_item_t" structure that associates a state_machine_t object -with 4 file-descriptors. The way to best see where the bridge between the -outside world (TCP/IP reads, writes, select()s, file-descriptors, etc) and the -state machine is, is to examine the "tunala_item_io()" function in tunala.c. -This is currently around lines 641-732 but of course could be subject to change. - - -And...? -------- - -Well, although that function is around 90 lines of code, it could easily have -been a lot less only I was trying to address an easily missed "gotcha" (item (2) -below). The main() code that drives the select/accept/IO loop initialises new -tunala_item_t structures when connections arrive, and works out which -file-descriptors go where depending on whether we're an SSL client or server -(client --> accepted connection is clean and proxied is dirty, server --> -accepted connection is dirty and proxied is clean). What that tunala_item_io() -function is attempting to do is 2 things; - - (1) Perform all reads and writes on the network directly into the - state_machine_t's buffers (based on a previous select() result), and only - then allow the abstact state_machine_t to "churn()" using those buffers. - This will cause the SSL machine to consume as much input data from the two - "IN" buffers as possible, and generate as much output data into the two - "OUT" buffers as possible. Back up in the main() function, the next main - loop loop will examine these output buffers and select() for writability - on the corresponding sockets if the buffers are non-empty. - - (2) Handle the complicated tunneling-specific issue of cascading "close"s. - This is the reason for most of the complexity in the logic - if one side - of the tunnel is closed, you can't simply close the other side and throw - away the whole thing - (a) there may still be outgoing data on the other - side of the tunnel that hasn't been sent yet, (b) the close (or things - happening during the close) may cause more data to be generated that needs - sending on the other side. Of course, this logic is complicated yet futher - by the fact that it's different depending on which side closes first :-) - state_machine_close_clean() will indicate to the state machine that the - unencrypted side of the tunnel has closed, so any existing outgoing data - needs to be flushed, and the SSL stream needs to be closed down using the - appropriate shutdown sequence. state_machine_close_dirty() is simpler - because it indicates that the SSL stream has been disconnected, so all - that remains before closing the other side is to flush out anything that - remains and wait for it to all be sent. - -Anyway, with those things in mind, the code should be a little easier to follow -in terms of "what is *this* bit supposed to achieve??!!". - - -How might this help? --------------------- - -Well, the reason I wrote this is that there seemed to be rather a flood of -questions of late on the openssl-dev and openssl-users lists about getting this -whole IO logic thing sorted out, particularly by those who were trying to either -use non-blocking IO, or wanted SSL in an environment where "something else" was -handling the network already and they needed to operate in memory only. This -code is loosely based on some other stuff I've been working on, although that -stuff is far more complete, far more dependant on a whole slew of other -network/framework code I don't want to incorporate here, and far harder to look -at for 5 minutes and follow where everything is going. I will be trying over -time to suck in a few things from that into this demo in the hopes it might be -more useful, and maybe to even make this demo usable as a utility of its own. -Possible things include: - - * controlling multiple processes/threads - this can be used to combat - latencies and get passed file-descriptor limits on some systems, and it uses - a "controller" process/thread that maintains IPC links with the - processes/threads doing the real work. - - * cert verification rules - having some say over which certs get in or out :-) - - * control over SSL protocols and cipher suites - - * A few other things you can already do in s_client and s_server :-) - - * Support (and control over) session resuming, particular when functioning as - an SSL client. - -If you have a particular environment where this model might work to let you "do -SSL" without having OpenSSL be aware of the transport, then you should find you -could use the state_machine_t structure (or your own variant thereof) and hook -it up to your transport stuff in much the way tunala.c matches it up with those -4 file-descriptors. The state_machine_churn(), state_machine_close_clean(), and -state_machine_close_dirty() functions are the main things to understand - after -that's done, you just have to ensure you're feeding and bleeding the 4 -state_machine buffers in a logical fashion. This state_machine loop handles not -only handshakes and normal streaming, but also renegotiates - there's no special -handling required beyond keeping an eye on those 4 buffers and keeping them in -sync with your outer "loop" logic. Ie. if one of the OUT buffers is not empty, -you need to find an opportunity to try and forward its data on. If one of the IN -buffers is not full, you should keep an eye out for data arriving that should be -placed there. - -This approach could hopefully also allow you to run the SSL protocol in very -different environments. As an example, you could support encrypted event-driven -IPC where threads/processes pass messages to each other inside an SSL layer; -each IPC-message's payload would be in fact the "dirty" content, and the "clean" -payload coming out of the tunnel at each end would be the real intended message. -Likewise, this could *easily* be made to work across unix domain sockets, or -even entirely different network/comms protocols. - -This is also a quick and easy way to do VPN if you (and the remote network's -gateway) support virtual network devices that are encapsulted in a single -network connection, perhaps PPP going through an SSL tunnel? - - -Suggestions ------------ - -Please let me know if you find this useful, or if there's anything wrong or -simply too confusing about it. Patches are also welcome, but please attach a -description of what it changes and why, and "diff -urN" format is preferred. -Mail to [email protected] should do the trick. - - -Example -------- - -Here is an example of how to use "tunala" ... - -First, it's assumed that OpenSSL has already built, and that you are building -inside the ./demos/tunala/ directory. If not - please correct the paths and -flags inside the Makefile. - -Secondly, this code so far has only ever been built and run on Linux - network -specifics are more than likely to create little glitches on other unixen, -particularly Solaris in my experience. If you're not on Linux, please read the -code wherever compilation flares up and try to make the necessary changes - -usually the man-page associated with the relevant function is enough (eg. all -that AF_INET/PF_INET stuff, subtely different parameters to various IPv4-related -functions like socket(), bind(), fcntl(), etc). - -Thirdly, if you are Win32, you probably need to do some *major* rewriting of -ip.c to stand a hope in hell. Good luck, and please mail me the diff if you do -this, otherwise I will take a look at another time. It can certainly be done, -but it's very non-POSIXy. - -Type make. - -Now, if you don't have an executable "tunala" compiled, go back to "First,...". -Rinse and repeat. - -Inside one console, try typing; - -(i) ./tunala -listen localhost:8080 -proxy localhost:8081 -cacert CA.pem \ - -cert A-client.pem - -In another console, type; - -(ii) ./tunala -listen localhost:8081 -proxy localhost:23 -cacert CA.pem \ - -cert A-server.pem -server 1 - -Now if you open another console and "telnet localhost 8080", you should be -tunneled through to the telnet service on your local machine. Feel free to -experiment :-) - -Notes: - - - the format for the "-listen" argument can skip the host part (eg. "-listen - 8080" is fine). If you do, the listening socket will listen on all interfaces - so you can connect from other machines for example. Using the "localhost" - form listens only on 127.0.0.1 so you can only connect locally (unless, of - course, you've set up weird stuff with your networking in which case probably - none of the above applies). - - - ./tunala -? gives you a list of other command-line options, but tunala.c is - also a good place to look :-) - - diff --git a/demos/tunala/buffer.c b/demos/tunala/buffer.c deleted file mode 100644 index e9a4e5b030c..00000000000 --- a/demos/tunala/buffer.c +++ /dev/null @@ -1,146 +0,0 @@ -#include "tunala.h" - -#ifndef NO_BUFFER - -void buffer_init(buffer_t *buf) -{ - buf->used = 0; -} - -void buffer_close(buffer_t *buf) -{ - /* Our data is static - nothing needs "release", just reset */ - buffer_init(buf); -} - -/* Code these simple ones in compact form */ -unsigned int buffer_used(buffer_t *buf) { - return buf->used; } -unsigned int buffer_unused(buffer_t *buf) { - return (MAX_DATA_SIZE - buf->used); } -int buffer_full(buffer_t *buf) { - return (buf->used == MAX_DATA_SIZE ? 1 : 0); } -int buffer_notfull(buffer_t *buf) { - return (buf->used < MAX_DATA_SIZE ? 1 : 0); } -int buffer_empty(buffer_t *buf) { - return (buf->used == 0 ? 1 : 0); } -int buffer_notempty(buffer_t *buf) { - return (buf->used > 0 ? 1 : 0); } - -unsigned int buffer_adddata(buffer_t *buf, const unsigned char *ptr, - unsigned int size) -{ - unsigned int added = MAX_DATA_SIZE - buf->used; - if(added > size) - added = size; - if(added == 0) - return 0; - memcpy(buf->data + buf->used, ptr, added); - buf->used += added; - return added; -} - -unsigned int buffer_takedata(buffer_t *buf, unsigned char *ptr, - unsigned int size) -{ - unsigned int taken = buf->used; - if(taken > size) - taken = size; - if(taken == 0) - return 0; - if(ptr) - memcpy(ptr, buf->data, taken); - buf->used -= taken; - /* Do we have to scroll? */ - if(buf->used > 0) - memmove(buf->data, buf->data + taken, buf->used); - return taken; -} - -unsigned int buffer_tobuffer(buffer_t *to, buffer_t *from, int cap) -{ - unsigned int moved, tomove = from->used; - if((int)tomove > cap) - tomove = cap; - if(tomove == 0) - return 0; - moved = buffer_adddata(to, from->data, tomove); - if(moved == 0) - return 0; - buffer_takedata(from, NULL, moved); - return moved; -} - -#ifndef NO_IP - -int buffer_from_fd(buffer_t *buf, int fd) -{ - unsigned int toread = buffer_unused(buf); - if(toread == 0) - /* Shouldn't be called in this case! */ - abort(); - toread = read(fd, buf->data + buf->used, toread); - if(toread > 0) - buf->used += toread; - return toread; -} - -int buffer_to_fd(buffer_t *buf, int fd) -{ - unsigned int towrite = buffer_used(buf); - if(towrite == 0) - /* Shouldn't be called in this case! */ - abort(); - towrite = write(fd, buf->data, towrite); - if(towrite > 0) - buffer_takedata(buf, NULL, towrite); - return towrite; -} - -#endif /* !defined(NO_IP) */ - -#ifndef NO_OPENSSL - -void buffer_from_SSL(buffer_t *buf, SSL *ssl) -{ - int ret; - if(!ssl || buffer_full(buf)) - return; - ret = SSL_read(ssl, buf->data + buf->used, buffer_unused(buf)); - if(ret > 0) - buf->used += ret; -} - -void buffer_to_SSL(buffer_t *buf, SSL *ssl) -{ - int ret; - if(!ssl || buffer_empty(buf)) - return; - ret = SSL_write(ssl, buf->data, buf->used); - if(ret > 0) - buffer_takedata(buf, NULL, ret); -} - -void buffer_from_BIO(buffer_t *buf, BIO *bio) -{ - int ret; - if(!bio || buffer_full(buf)) - return; - ret = BIO_read(bio, buf->data + buf->used, buffer_unused(buf)); - if(ret > 0) - buf->used += ret; -} - -void buffer_to_BIO(buffer_t *buf, BIO *bio) -{ - int ret; - if(!bio || buffer_empty(buf)) - return; - ret = BIO_write(bio, buf->data, buf->used); - if(ret > 0) - buffer_takedata(buf, NULL, ret); -} - -#endif /* !defined(NO_OPENSSL) */ - -#endif /* !defined(NO_BUFFER) */ diff --git a/demos/tunala/ip.c b/demos/tunala/ip.c deleted file mode 100644 index 4874d620d50..00000000000 --- a/demos/tunala/ip.c +++ /dev/null @@ -1,147 +0,0 @@ -#include "tunala.h" - -#ifndef NO_IP - -#define IP_LISTENER_BACKLOG 511 /* So if it gets masked by 256 or some other - such value it'll still be respectable */ - -/* Any IP-related initialisations. For now, this means blocking SIGPIPE */ -int ip_initialise(void) -{ - struct sigaction sa; - - sa.sa_handler = SIG_IGN; - sa.sa_flags = 0; - sigemptyset(&sa.sa_mask); - if(sigaction(SIGPIPE, &sa, NULL) != 0) - return 0; - return 1; -} - -int ip_create_listener_split(const unsigned char *ip, unsigned short port) -{ - struct sockaddr_in in_addr; - int fd = -1; - int reuseVal = 1; - - /* Create the socket */ - if((fd = socket(PF_INET, SOCK_STREAM, 0)) == -1) - goto err; - /* Set the SO_REUSEADDR flag - servers act weird without it */ - if(setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (char *)(&reuseVal), - sizeof(reuseVal)) != 0) - goto err; - /* Prepare the listen address stuff */ - in_addr.sin_family = AF_INET; - memcpy(&in_addr.sin_addr.s_addr, ip, 4); - in_addr.sin_port = htons(port); - /* Bind to the required port/address/interface */ - if(bind(fd, &in_addr, sizeof(struct sockaddr_in)) != 0) - goto err; - /* Start "listening" */ - if(listen(fd, IP_LISTENER_BACKLOG) != 0) - goto err; - return fd; -err: - if(fd != -1) - close(fd); - return -1; -} - -int ip_create_connection_split(const unsigned char *ip, unsigned short port) -{ - struct sockaddr_in in_addr; - int flags, fd = -1; - - /* Create the socket */ - if((fd = socket(PF_INET, SOCK_STREAM, 0)) == -1) - goto err; - /* Make it non-blocking */ - if(((flags = fcntl(fd, F_GETFL, 0)) < 0) || - (fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0)) - goto err; - /* Prepare the connection address stuff */ - in_addr.sin_family = AF_INET; - memcpy(&in_addr.sin_addr.s_addr, ip, 4); - in_addr.sin_port = htons(port); - /* Start a connect (non-blocking, in all likelihood) */ - if((connect(fd, &in_addr, sizeof(struct sockaddr_in)) != 0) && - (errno != EINPROGRESS)) - goto err; - return fd; -err: - if(fd != -1) - close(fd); - return -1; -} - -static unsigned char all_local_ip[] = {0x00,0x00,0x00,0x00}; - -int ip_parse_address(const char *address, unsigned char **parsed_ip, - unsigned short *parsed_port, int accept_all_ip) -{ - char buf[256]; - struct hostent *lookup; - unsigned long port; - char *temp; - const char *ptr = strstr(address, ":"); - unsigned char *ip = all_local_ip; - - if(!ptr) { - /* We assume we're listening on all local interfaces and have - * only specified a port. */ - if(!accept_all_ip) - return 0; - ptr = address; - goto determine_port; - } - if((ptr - address) > 255) - return 0; - memset(buf, 0, 256); - memcpy(buf, address, ptr - address); - ptr++; - if((lookup = gethostbyname(buf)) == NULL) { - /* Spit a message to differentiate between lookup failures and - * bad strings. */ - fprintf(stderr, "hostname lookup for '%s' failed\n", buf); - return 0; - } - ip = lookup->h_addr_list[0]; -determine_port: - if(strlen(ptr) < 1) - return 0; - port = strtoul(ptr, &temp, 10); - if((temp == ptr) || (*temp != '\0') || (port > 65535)) - return 0; - *parsed_ip = ip; - *parsed_port = (unsigned short)port; - return 1; -} - -int ip_create_listener(const char *address) -{ - unsigned char *ip; - unsigned short port; - - if(!ip_parse_address(address, &ip, &port, 1)) - return -1; - return ip_create_listener_split(ip, port); -} - -int ip_create_connection(const char *address) -{ - unsigned char *ip; - unsigned short port; - - if(!ip_parse_address(address, &ip, &port, 0)) - return -1; - return ip_create_connection_split(ip, port); -} - -int ip_accept_connection(int listen_fd) -{ - return accept(listen_fd, NULL, NULL); -} - -#endif /* !defined(NO_IP) */ - diff --git a/demos/tunala/sm.c b/demos/tunala/sm.c deleted file mode 100644 index 05bd7b94594..00000000000 --- a/demos/tunala/sm.c +++ /dev/null @@ -1,149 +0,0 @@ -#include "tunala.h" - -#ifndef NO_TUNALA - -void state_machine_init(state_machine_t *machine) -{ - machine->ssl = NULL; - machine->bio_intossl = machine->bio_fromssl = NULL; - buffer_init(&machine->clean_in); - buffer_init(&machine->clean_out); - buffer_init(&machine->dirty_in); - buffer_init(&machine->dirty_out); -} - -void state_machine_close(state_machine_t *machine) -{ - if(machine->ssl) - SSL_free(machine->ssl); -/* SSL_free seems to decrement the reference counts already so doing this goes - * kaboom. */ -#if 0 - if(machine->bio_intossl) - BIO_free(machine->bio_intossl); - if(machine->bio_fromssl) - BIO_free(machine->bio_fromssl); -#endif - buffer_close(&machine->clean_in); - buffer_close(&machine->clean_out); - buffer_close(&machine->dirty_in); - buffer_close(&machine->dirty_out); - state_machine_init(machine); -} - -buffer_t *state_machine_get_buffer(state_machine_t *machine, sm_buffer_t type) -{ - switch(type) { - case SM_CLEAN_IN: - return &machine->clean_in; - case SM_CLEAN_OUT: - return &machine->clean_out; - case SM_DIRTY_IN: - return &machine->dirty_in; - case SM_DIRTY_OUT: - return &machine->dirty_out; - default: - break; - } - /* Should never get here */ - abort(); - return NULL; -} - -SSL *state_machine_get_SSL(state_machine_t *machine) -{ - return machine->ssl; -} - -void state_machine_set_SSL(state_machine_t *machine, SSL *ssl, int is_server) -{ - if(machine->ssl) - /* Shouldn't ever be set twice */ - abort(); - machine->ssl = ssl; - /* Create the BIOs to handle the dirty side of the SSL */ - if((machine->bio_intossl = BIO_new(BIO_s_mem())) == NULL) - abort(); - if((machine->bio_fromssl = BIO_new(BIO_s_mem())) == NULL) - abort(); - /* Hook up the BIOs on the dirty side of the SSL */ - SSL_set_bio(machine->ssl, machine->bio_intossl, machine->bio_fromssl); - if(is_server) - SSL_set_accept_state(machine->ssl); - else - SSL_set_connect_state(machine->ssl); - /* If we're the first one to generate traffic - do it now otherwise we - * go into the next select empty-handed and our peer will not send data - * but will similarly wait for us. */ - state_machine_churn(machine); -} - -/* Performs the data-IO loop and returns zero if the machine should close */ -int state_machine_churn(state_machine_t *machine) -{ - unsigned int loop; - /* Do this loop twice to cover any dependencies about which precise - * order of reads and writes is required. */ - for(loop = 0; loop < 2; loop++) { - buffer_to_SSL(&machine->clean_in, machine->ssl); - buffer_to_BIO(&machine->dirty_in, machine->bio_intossl); - buffer_from_SSL(&machine->clean_out, machine->ssl); - buffer_from_BIO(&machine->dirty_out, machine->bio_fromssl); - } - if(machine->ssl == NULL) { - if(buffer_empty(&machine->clean_out)) - /* Time to close this state-machine altogether */ - return 0; - else - /* Still buffered data on the clean side to go out */ - return 1; - } - if(SSL_get_shutdown(machine->ssl)) { - /* An SSL shutdown was underway */ - if(buffer_empty(&machine->dirty_out)) { - /* Great, we can seal off the dirty side completely */ - if(!state_machine_close_dirty(machine)) - return 0; - } - } - /* Either the SSL is alive and well, or the closing process still has - * outgoing data waiting to be sent */ - return 1; -} - -/* Called when the clean side of the SSL has lost its connection */ -int state_machine_close_clean(state_machine_t *machine) -{ - /* Well, first thing to do is null out the clean-side buffers - they're - * no use any more. */ - buffer_close(&machine->clean_in); - buffer_close(&machine->clean_out); - /* And start an SSL shutdown */ - SSL_shutdown(machine->ssl); - /* This is an "event", so flush the SSL of any generated traffic */ - state_machine_churn(machine); - if(buffer_empty(&machine->dirty_in) && - buffer_empty(&machine->dirty_out)) - return 0; - return 1; -} - -/* Called when the dirty side of the SSL has lost its connection. This is pretty - * terminal as all that can be left to do is send any buffered output on the - * clean side - after that, we're done. */ -int state_machine_close_dirty(state_machine_t *machine) -{ - buffer_close(&machine->dirty_in); - buffer_close(&machine->dirty_out); - buffer_close(&machine->clean_in); - if(machine->ssl) - SSL_free(machine->ssl); - machine->ssl = NULL; - machine->bio_intossl = machine->bio_fromssl = NULL; - if(buffer_empty(&machine->clean_out)) - return 0; - return 1; -} - -#endif /* !defined(NO_TUNALA) */ - diff --git a/demos/tunala/tunala.c b/demos/tunala/tunala.c deleted file mode 100644 index b54bb422dbb..00000000000 --- a/demos/tunala/tunala.c +++ /dev/null @@ -1,724 +0,0 @@ -#if defined(NO_BUFFER) || defined(NO_IP) || defined(NO_OPENSSL) -#error "Badness, NO_BUFFER, NO_IP or NO_OPENSSL is defined, turn them *off*" -#endif - -/* Include our bits'n'pieces */ -#include "tunala.h" - - -/********************************************/ -/* Our local types that specify our "world" */ -/********************************************/ - -/* These represent running "tunnels". Eg. if you wanted to do SSL in a - * "message-passing" scanario, the "int" file-descriptors might be replaced by - * thread or process IDs, and the "select" code might be replaced by message - * handling code. Whatever. */ -typedef struct _tunala_item_t { - /* The underlying SSL state machine. This is a data-only processing unit - * and we communicate with it by talking to its four "buffers". */ - state_machine_t sm; - /* The file-descriptors for the "dirty" (encrypted) side of the SSL - * setup. In actuality, this is typically a socket and both values are - * identical. */ - int dirty_read, dirty_send; - /* The file-descriptors for the "clean" (unencrypted) side of the SSL - * setup. These could be stdin/stdout, a socket (both values the same), - * or whatever you like. */ - int clean_read, clean_send; -} tunala_item_t; - -/* This structure is used as the data for running the main loop. Namely, in a - * network format such as this, it is stuff for select() - but as pointed out, - * when moving the real-world to somewhere else, this might be replaced by - * something entirely different. It's basically the stuff that controls when - * it's time to do some "work". */ -typedef struct _select_sets_t { - int max; /* As required as the first argument to select() */ - fd_set reads, sends, excepts; /* As passed to select() */ -} select_sets_t; -typedef struct _tunala_selector_t { - select_sets_t last_selected; /* Results of the last select() */ - select_sets_t next_select; /* What we'll next select on */ -} tunala_selector_t; - -/* This structure is *everything*. We do it to avoid the use of globals so that, - * for example, it would be easier to shift things around between async-IO, - * thread-based, or multi-fork()ed (or combinations thereof). */ -typedef struct _tunala_world_t { - /* The file-descriptor we "listen" on for new connections */ - int listen_fd; - /* The array of tunnels */ - tunala_item_t *tunnels; - /* the number of tunnels in use and allocated, respectively */ - unsigned int tunnels_used, tunnels_size; - /* Our outside "loop" context stuff */ - tunala_selector_t selector; - /* Our SSL_CTX, which is configured as the SSL client or server and has - * the various cert-settings and callbacks configured. */ - SSL_CTX *ssl_ctx; - /* Simple flag with complex logic :-) Indicates whether we're an SSL - * server or an SSL client. */ - int server_mode; -} tunala_world_t; - -/*****************************/ -/* Internal static functions */ -/*****************************/ - -static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id, - const char *CAfile, const char *cert, const char *key); -static void selector_init(tunala_selector_t *selector); -static void selector_add_listener(tunala_selector_t *selector, int fd); -static void selector_add_tunala(tunala_selector_t *selector, tunala_item_t *t); -static int selector_select(tunala_selector_t *selector); -/* This returns -1 for error, 0 for no new connections, or 1 for success, in - * which case *newfd is populated. */ -static int selector_get_listener(tunala_selector_t *selector, int fd, int *newfd); -static int tunala_world_new_item(tunala_world_t *world, int fd, - const unsigned char *ip, unsigned short port); -static void tunala_world_del_item(tunala_world_t *world, unsigned int idx); -static int tunala_item_io(tunala_selector_t *selector, tunala_item_t *item); - -/*********************************************/ -/* MAIN FUNCTION (and its utility functions) */ -/*********************************************/ - -static const char *def_proxyhost = "127.0.0.1:443"; -static const char *def_listenhost = "127.0.0.1:8080"; -static int def_max_tunnels = 50; -static const char *def_cacert = NULL; -static const char *def_cert = NULL; -static const char *def_key = NULL; -static const char *def_engine_id = NULL; -static int def_server_mode = 0; - -static const char *helpstring = - "\n'Tunala' (A tunneler with a New Zealand accent)\n" - "Usage: tunala [options], where options are from;\n" - " -listen [host:]<port> (default = 127.0.0.1:8080)\n" - " -proxy <host>:<port> (default = 127.0.0.1:443)\n" - " -maxtunnels <num> (default = 50)\n" - " -cacert <path|NULL> (default = NULL)\n" - " -cert <path|NULL> (default = NULL)\n" - " -key <path|NULL> (default = whatever '-cert' is)\n" - " -engine <id|NULL> (default = NULL)\n" - " -server <0|1> (default = 0, ie. an SSL client)\n" - " -<h|help|?> (displays this help screen)\n" - "NB: It is recommended to specify a cert+key when operating as an\n" - "SSL server. If you only specify '-cert', the same file must\n" - "contain a matching private key.\n"; - -static int usage(const char *errstr, int isunknownarg) -{ - if(isunknownarg) - fprintf(stderr, "Error: unknown argument '%s'\n", errstr); - else - fprintf(stderr, "Error: %s\n", errstr); - fprintf(stderr, "%s\n", helpstring); - return 1; -} - -static int err_str0(const char *str0) -{ - fprintf(stderr, str0); - fprintf(stderr, "\n"); - return 1; -} - -static int err_str1(const char *str0, const char *str1) -{ - fprintf(stderr, str0, str1); - fprintf(stderr, "\n"); - return 1; -} - -static int parse_max_tunnels(const char *s, unsigned int *maxtunnels) -{ - unsigned long l; - char *temp; - l = strtoul(s, &temp, 10); - if((temp == s) || (*temp != '\0') || (l < 1) || (l > 1024)) { - fprintf(stderr, "Error, '%s' is an invalid value for " - "maxtunnels\n", s); - return 0; - } - *maxtunnels = (unsigned int)l; - return 1; -} - -static int parse_server_mode(const char *s, int *servermode) -{ - unsigned long l; - char *temp; - l = strtoul(s, &temp, 10); - if((temp == s) || (*temp != '\0') || (l > 1)) { - fprintf(stderr, "Error, '%s' is an invalid value for the " - "server mode\n", s); - return 0; - } - *servermode = (int)l; - return 1; -} - -int main(int argc, char *argv[]) -{ - unsigned int loop; - int newfd; - tunala_world_t world; - tunala_item_t *t_item; - unsigned char *proxy_ip; - unsigned short proxy_port; - /* Overridables */ - const char *proxyhost = def_proxyhost; - const char *listenhost = def_listenhost; - unsigned int max_tunnels = def_max_tunnels; - const char *cacert = def_cacert; - const char *cert = def_cert; - const char *key = def_key; - const char *engine_id = def_engine_id; - int server_mode = def_server_mode; - -/* Parse command-line arguments */ -next_arg: - argc--; argv++; - if(argc > 0) { - if(strcmp(*argv, "-listen") == 0) { - if(argc < 2) - return usage("-listen requires an argument", 0); - argc--; argv++; - listenhost = *argv; - goto next_arg; - } else if(strcmp(*argv, "-proxy") == 0) { - if(argc < 2) - return usage("-proxy requires an argument", 0); - argc--; argv++; - proxyhost = *argv; - goto next_arg; - } else if(strcmp(*argv, "-maxtunnels") == 0) { - if(argc < 2) - return usage("-maxtunnels requires an argument", 0); - argc--; argv++; - if(!parse_max_tunnels(*argv, &max_tunnels)) - return 1; - goto next_arg; - } else if(strcmp(*argv, "-cacert") == 0) { - if(argc < 2) - return usage("-cacert requires an argument", 0); - argc--; argv++; - if(strcmp(*argv, "NULL") == 0) - cacert = NULL; - else - cacert = *argv; - goto next_arg; - } else if(strcmp(*argv, "-cert") == 0) { - if(argc < 2) - return usage("-cert requires an argument", 0); - argc--; argv++; - if(strcmp(*argv, "NULL") == 0) - cert = NULL; - else - cert = *argv; - goto next_arg; - } else if(strcmp(*argv, "-key") == 0) { - if(argc < 2) - return usage("-key requires an argument", 0); - argc--; argv++; - if(strcmp(*argv, "NULL") == 0) - key = NULL; - else - key = *argv; - goto next_arg; - } else if(strcmp(*argv, "-engine") == 0) { - if(argc < 2) - return usage("-engine requires an argument", 0); - argc--; argv++; - engine_id = *argv; - goto next_arg; - } else if(strcmp(*argv, "-server") == 0) { - if(argc < 2) - return usage("-server requires an argument", 0); - argc--; argv++; - if(!parse_server_mode(*argv, &server_mode)) - return 1; - goto next_arg; - } else if((strcmp(*argv, "-h") == 0) || - (strcmp(*argv, "-help") == 0) || - (strcmp(*argv, "-?") == 0)) { - fprintf(stderr, "%s\n", helpstring); - return 0; - } else - return usage(*argv, 1); - } - - /* Initialise network stuff */ - if(!ip_initialise()) - return err_str0("ip_initialise failed"); - err_str0("ip_initialise succeeded"); - /* Create the SSL_CTX */ - if((world.ssl_ctx = initialise_ssl_ctx(server_mode, engine_id, - cacert, cert, key)) == NULL) - return err_str1("initialise_ssl_ctx(engine_id=%s) failed", - (engine_id == NULL) ? "NULL" : engine_id); - err_str1("initialise_ssl_ctx(engine_id=%s) succeeded", - (engine_id == NULL) ? "NULL" : engine_id); - /* Create the listener */ - if((world.listen_fd = ip_create_listener(listenhost)) == -1) - return err_str1("ip_create_listener(%s) failed", listenhost); - err_str1("ip_create_listener(%s) succeeded", listenhost); - if(!ip_parse_address(proxyhost, &proxy_ip, &proxy_port, 0)) - return err_str1("ip_parse_address(%s) failed", proxyhost); - err_str1("ip_parse_address(%s) succeeded", proxyhost); - fprintf(stderr, "Info - proxying to %d.%d.%d.%d:%d\n", - (int)proxy_ip[0], (int)proxy_ip[1], - (int)proxy_ip[2], (int)proxy_ip[3], (int)proxy_port); - fprintf(stderr, "Info - set maxtunnels to %d\n", (int)max_tunnels); - fprintf(stderr, "Info - set to operate as an SSL %s\n", - (server_mode ? "server" : "client")); - /* Initialise the rest of the stuff */ - world.tunnels_used = world.tunnels_size = 0; - world.tunnels = NULL; - world.server_mode = server_mode; - selector_init(&world.selector); - -/* We're ready to loop */ -main_loop: - /* Should we listen for *new* tunnels? */ - if(world.tunnels_used < max_tunnels) - selector_add_listener(&world.selector, world.listen_fd); - /* We should add in our existing tunnels */ - for(loop = 0; loop < world.tunnels_used; loop++) - selector_add_tunala(&world.selector, world.tunnels + loop); - /* Now do the select */ - switch(selector_select(&world.selector)) { - case -1: - fprintf(stderr, "selector_select returned a badness error.\n"); - abort(); - case 0: - fprintf(stderr, "Warn, selector_select return 0 - signal??\n"); - goto main_loop; - default: - break; - } - /* Accept new connection if we should and can */ - if((world.tunnels_used < max_tunnels) && (selector_get_listener( - &world.selector, world.listen_fd, - &newfd) == 1)) { - /* We have a new connection */ - if(!tunala_world_new_item(&world, newfd, - proxy_ip, proxy_port)) { - fprintf(stderr, "tunala_world_new_item failed\n"); - abort(); - } - fprintf(stderr, "Info, new tunnel opened, now up to %d\n", - world.tunnels_used); - } - /* Give each tunnel its moment, note the while loop is because it makes - * the logic easier than with "for" to deal with an array that may shift - * because of deletes. */ - loop = 0; - t_item = world.tunnels; - while(loop < world.tunnels_used) { - if(!tunala_item_io(&world.selector, t_item)) { - /* We're closing whether for reasons of an error or a - * natural close. Don't increment loop or t_item because - * the next item is moving to us! */ - tunala_world_del_item(&world, loop); - fprintf(stderr, "Info, tunnel closed, down to %d\n", - world.tunnels_used); - } - else { - /* Move to the next item */ - loop++; - t_item++; - } - } - goto main_loop; - /* Should never get here */ - abort(); - return 1; -} - -/****************/ -/* OpenSSL bits */ -/****************/ - -static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id, - const char *CAfile, const char *cert, const char *key) -{ - SSL_CTX *ctx, *ret = NULL; - SSL_METHOD *meth; - ENGINE *e = NULL; - FILE *fp = NULL; - X509 *x509 = NULL; - EVP_PKEY *pkey = NULL; - - OpenSSL_add_ssl_algorithms(); - SSL_load_error_strings(); - - meth = (server_mode ? SSLv23_server_method() : SSLv23_client_method()); - if(meth == NULL) - goto err; - if(engine_id) { - if((e = ENGINE_by_id(engine_id)) == NULL) { - fprintf(stderr, "Error obtaining '%s' engine, openssl " - "errors follow\n", engine_id); - goto err; - } - if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { - fprintf(stderr, "Error assigning '%s' engine, openssl " - "errors follow\n", engine_id); - goto err; - } - ENGINE_free(e); - } - if((ctx = SSL_CTX_new(meth)) == NULL) - goto err; - /* cacert */ - if(CAfile) { - if(!X509_STORE_load_locations(SSL_CTX_get_cert_store(ctx), - CAfile, NULL)) { - fprintf(stderr, "Error loading CA cert(s) in '%s'\n", - CAfile); - goto err; - } - fprintf(stderr, "Info, operating with CA cert(s) in '%s'\n", - CAfile); - } else - fprintf(stderr, "Info, operating without a CA cert(-list)\n"); - if(!SSL_CTX_set_default_verify_paths(ctx)) { - fprintf(stderr, "Error setting default verify paths\n"); - goto err; - } - /* cert */ - if(cert) { - if((fp = fopen(cert, "r")) == NULL) { - fprintf(stderr, "Error opening cert file '%s'\n", cert); - goto err; - } - if(!PEM_read_X509(fp, &x509, NULL, NULL)) { - fprintf(stderr, "Error reading PEM cert from '%s'\n", - cert); - goto err; - } - if(!SSL_CTX_use_certificate(ctx, x509)) { - fprintf(stderr, "Error, cert in '%s' can not be used\n", - cert); - goto err; - } - fprintf(stderr, "Info, operating with cert in '%s'\n", cert); - fclose(fp); - fp = NULL; - /* If a cert was given without matching key, we assume the same - * file contains the required key. */ - if(!key) - key = cert; - } else - if(key) { - fprintf(stderr, "Error, can't specify a key without a " - "corresponding certificate\n"); - goto err; - } - /* key */ - if(key) { - if((fp = fopen(key, "r")) == NULL) { - fprintf(stderr, "Error opening key file '%s'\n", key); - goto err; - } - if(!PEM_read_PrivateKey(fp, &pkey, NULL, NULL)) { - fprintf(stderr, "Error reading PEM key from '%s'\n", - key); - goto err; - } - if(!SSL_CTX_use_PrivateKey(ctx, pkey)) { - fprintf(stderr, "Error, key in '%s' can not be used\n", - key); - goto err; - } - fprintf(stderr, "Info, operating with key in '%s'\n", key); - } else - fprintf(stderr, "Info, operating without a cert or key\n"); - - /* Success! */ - ret = ctx; -err: - if(!ret) { - ERR_print_errors_fp(stderr); - if(ctx) - SSL_CTX_free(ctx); - } - if(fp) - fclose(fp); - if(x509) - X509_free(x509); - if(pkey) - EVP_PKEY_free(pkey); - return ret; -} - -/*****************/ -/* Selector bits */ -/*****************/ - -static void selector_sets_init(select_sets_t *s) -{ - s->max = 0; - FD_ZERO(&s->reads); - FD_ZERO(&s->sends); - FD_ZERO(&s->excepts); -} -static void selector_init(tunala_selector_t *selector) -{ - selector_sets_init(&selector->last_selected); - selector_sets_init(&selector->next_select); -} - -#define SEL_EXCEPTS 0x00 -#define SEL_READS 0x01 -#define SEL_SENDS 0x02 -static void selector_add_raw_fd(tunala_selector_t *s, int fd, int flags) -{ - FD_SET(fd, &s->next_select.excepts); - if(flags & SEL_READS) - FD_SET(fd, &s->next_select.reads); - if(flags & SEL_SENDS) - FD_SET(fd, &s->next_select.sends); - /* Adjust "max" */ - if(s->next_select.max < (fd + 1)) - s->next_select.max = fd + 1; -} - -static void selector_add_listener(tunala_selector_t *selector, int fd) -{ - selector_add_raw_fd(selector, fd, SEL_READS); -} - -static void selector_add_tunala(tunala_selector_t *s, tunala_item_t *t) -{ - /* Set clean read if sm.clean_in is not full */ - if(t->clean_read != -1) { - selector_add_raw_fd(s, t->clean_read, - (buffer_full(state_machine_get_buffer(&t->sm, - SM_CLEAN_IN)) ? SEL_EXCEPTS : SEL_READS)); - } - /* Set clean send if sm.clean_out is not empty */ - if(t->clean_send != -1) { - selector_add_raw_fd(s, t->clean_send, - (buffer_empty(state_machine_get_buffer(&t->sm, - SM_CLEAN_OUT)) ? SEL_EXCEPTS : SEL_SENDS)); - } - /* Set dirty read if sm.dirty_in is not full */ - if(t->dirty_read != -1) { - selector_add_raw_fd(s, t->dirty_read, - (buffer_full(state_machine_get_buffer(&t->sm, - SM_DIRTY_IN)) ? SEL_EXCEPTS : SEL_READS)); - } - /* Set dirty send if sm.dirty_out is not empty */ - if(t->dirty_send != -1) { - selector_add_raw_fd(s, t->dirty_send, - (buffer_empty(state_machine_get_buffer(&t->sm, - SM_DIRTY_OUT)) ? SEL_EXCEPTS : SEL_SENDS)); - } -} - -static int selector_select(tunala_selector_t *selector) -{ - memcpy(&selector->last_selected, &selector->next_select, - sizeof(select_sets_t)); - selector_sets_init(&selector->next_select); - return select(selector->last_selected.max, - &selector->last_selected.reads, - &selector->last_selected.sends, - &selector->last_selected.excepts, NULL); -} - -/* This returns -1 for error, 0 for no new connections, or 1 for success, in - * which case *newfd is populated. */ -static int selector_get_listener(tunala_selector_t *selector, int fd, int *newfd) -{ - if(FD_ISSET(fd, &selector->last_selected.excepts)) - return -1; - if(!FD_ISSET(fd, &selector->last_selected.reads)) - return 0; - if((*newfd = ip_accept_connection(fd)) == -1) - return -1; - return 1; -} - -/************************/ -/* "Tunala" world stuff */ -/************************/ - -static int tunala_world_make_room(tunala_world_t *world) -{ - unsigned int newsize; - tunala_item_t *newarray; - - if(world->tunnels_used < world->tunnels_size) - return 1; - newsize = (world->tunnels_size == 0 ? 16 : - ((world->tunnels_size * 3) / 2)); - if((newarray = malloc(newsize * sizeof(tunala_item_t))) == NULL) - return 0; - memset(newarray, 0, newsize * sizeof(tunala_item_t)); - if(world->tunnels_used > 0) - memcpy(newarray, world->tunnels, - world->tunnels_used * sizeof(tunala_item_t)); - if(world->tunnels_size > 0) - free(world->tunnels); - /* migrate */ - world->tunnels = newarray; - world->tunnels_size = newsize; - return 1; -} - -static int tunala_world_new_item(tunala_world_t *world, int fd, - const unsigned char *ip, unsigned short port) -{ - tunala_item_t *item; - int newfd; - - if(!tunala_world_make_room(world)) - return 0; - item = world->tunnels + (world->tunnels_used++); - state_machine_init(&item->sm); - item->clean_read = item->clean_send = - item->dirty_read = item->dirty_send = -1; - if((newfd = ip_create_connection_split(ip, port)) == -1) - goto err; - /* Which way round? If we're a server, "fd" is the dirty side and the - * connection we open is the clean one. For a client, it's the other way - * around. */ - if(world->server_mode) { - item->dirty_read = item->dirty_send = fd; - item->clean_read = item->clean_send = newfd; - } else { - item->clean_read = item->clean_send = fd; - item->dirty_read = item->dirty_send = newfd; - } - state_machine_set_SSL(&item->sm, SSL_new(world->ssl_ctx), - world->server_mode); - return 1; -err: - state_machine_close(&item->sm); - return 0; - -} - -static void tunala_world_del_item(tunala_world_t *world, unsigned int idx) -{ - tunala_item_t *item = world->tunnels + idx; - if(item->clean_read != -1) - close(item->clean_read); - if(item->clean_send != item->clean_read) - close(item->clean_send); - item->clean_read = item->clean_send = -1; - if(item->dirty_read != -1) - close(item->dirty_read); - if(item->dirty_send != item->dirty_read) - close(item->dirty_send); - item->dirty_read = item->dirty_send = -1; - state_machine_close(&item->sm); - /* OK, now we fix the item array */ - if(idx + 1 < world->tunnels_used) - /* We need to scroll entries to the left */ - memmove(world->tunnels + idx, - world->tunnels + (idx + 1), - (world->tunnels_used - (idx + 1)) * - sizeof(tunala_item_t)); - world->tunnels_used--; -} - -static int tunala_item_io(tunala_selector_t *selector, tunala_item_t *item) -{ - int c_r, c_s, d_r, d_s; /* Four boolean flags */ - - /* Take ourselves out of the gene-pool if there was an except */ - if((item->clean_read != -1) && FD_ISSET(item->clean_read, - &selector->last_selected.excepts)) - return 0; - if((item->clean_send != -1) && FD_ISSET(item->clean_send, - &selector->last_selected.excepts)) - return 0; - if((item->dirty_read != -1) && FD_ISSET(item->dirty_read, - &selector->last_selected.excepts)) - return 0; - if((item->dirty_send != -1) && FD_ISSET(item->dirty_send, - &selector->last_selected.excepts)) - return 0; - /* Grab our 4 IO flags */ - c_r = c_s = d_r = d_s = 0; - if(item->clean_read != -1) - c_r = FD_ISSET(item->clean_read, &selector->last_selected.reads); - if(item->clean_send != -1) - c_s = FD_ISSET(item->clean_send, &selector->last_selected.sends); - if(item->dirty_read != -1) - d_r = FD_ISSET(item->dirty_read, &selector->last_selected.reads); - if(item->dirty_send != -1) - d_s = FD_ISSET(item->dirty_send, &selector->last_selected.sends); - /* If no IO has happened for us, skip needless data looping */ - if(!c_r && !c_s && !d_r && !d_s) - return 1; - if(c_r) - c_r = (buffer_from_fd(state_machine_get_buffer(&item->sm, - SM_CLEAN_IN), item->clean_read) <= 0); - if(c_s) - c_s = (buffer_to_fd(state_machine_get_buffer(&item->sm, - SM_CLEAN_OUT), item->clean_send) <= 0); - if(d_r) - d_r = (buffer_from_fd(state_machine_get_buffer(&item->sm, - SM_DIRTY_IN), item->dirty_read) <= 0); - if(d_s) - d_s = (buffer_to_fd(state_machine_get_buffer(&item->sm, - SM_DIRTY_OUT), item->dirty_send) <= 0); - /* If any of the flags is non-zero, that means they need closing */ - if(c_r) { - close(item->clean_read); - if(item->clean_send == item->clean_read) - item->clean_send = -1; - item->clean_read = -1; - } - if(c_s) { - close(item->clean_send); - if(item->clean_send == item->clean_read) - item->clean_read = -1; - item->clean_send = -1; - } - if(d_r) { - close(item->dirty_read); - if(item->dirty_send == item->dirty_read) - item->dirty_send = -1; - item->dirty_read = -1; - } - if(d_s) { - close(item->dirty_send); - if(item->dirty_send == item->dirty_read) - item->dirty_read = -1; - item->dirty_send = -1; - } - /* This function name is attributed to the term donated by David - * Schwartz on openssl-dev, message-ID: - * <[email protected]>. :-) */ - if(!state_machine_churn(&item->sm)) - /* If the SSL closes, it will also zero-out the _in buffers - * and will in future process just outgoing data. As and - * when the outgoing data has gone, it will return zero - * here to tell us to bail out. */ - return 0; - /* Otherwise, we return zero if both sides are dead. */ - if(((item->clean_read == -1) || (item->clean_send == -1)) && - ((item->dirty_read == -1) || (item->dirty_send == -1))) - return 0; - /* If only one side closed, notify the SSL of this so it can take - * appropriate action. */ - if((item->clean_read == -1) || (item->clean_send == -1)) { - if(!state_machine_close_clean(&item->sm)) - return 0; - } - if((item->dirty_read == -1) || (item->dirty_send == -1)) { - if(state_machine_close_dirty(&item->sm)) - return 0; - } - return 1; -} - diff --git a/demos/tunala/tunala.h b/demos/tunala/tunala.h deleted file mode 100644 index 7ad012b92e6..00000000000 --- a/demos/tunala/tunala.h +++ /dev/null @@ -1,146 +0,0 @@ -/* Tunala ("Tunneler with a New Zealand accent") - * - * Written by Geoff Thorpe, but endorsed/supported by noone. Please use this is - * if it's useful or informative to you, but it's only here as a scratchpad for - * ideas about how you might (or might not) program with OpenSSL. If you deploy - * this is in a mission-critical environment, and have not read, understood, - * audited, and modified this code to your satisfaction, and the result is that - * all hell breaks loose and you are looking for a new employer, then it proves - * nothing except perhaps that Darwinism is alive and well. Let's just say, *I* - * don't use this in a mission-critical environment, so it would be stupid for - * anyone to assume that it is solid and/or tested enough when even its author - * doesn't place that much trust in it. You have been warned. - * - * With thanks to Cryptographic Appliances, Inc. - */ - -#ifndef _TUNALA_H -#define _TUNALA_H - -#ifndef NO_SYSTEM_H -#include <string.h> -#include <unistd.h> -#include <fcntl.h> -#include <netdb.h> -#include <signal.h> -#include <sys/socket.h> -#include <netinet/in.h> -#endif /* !defined(NO_SYSTEM_H) */ - -#ifndef NO_OPENSSL -#include <openssl/err.h> -#include <openssl/engine.h> -#include <openssl/ssl.h> -#endif /* !defined(NO_OPENSSL) */ - -#ifndef NO_BUFFER -/* This is the generic "buffer" type that is used when feeding the - * state-machine. It's basically a FIFO with respect to the "adddata" & - * "takedata" type functions that operate on it. */ -#define MAX_DATA_SIZE 16384 -typedef struct _buffer_t { - unsigned char data[MAX_DATA_SIZE]; - unsigned int used; -} buffer_t; - -/* Initialise a buffer structure before use */ -void buffer_init(buffer_t *buf); -/* Cleanup a buffer structure - presently not needed, but if buffer_t is - * converted to using dynamic allocation, this would be required - so should be - * called to protect against an explosion of memory leaks later if the change is - * made. */ -void buffer_close(buffer_t *buf); - -/* Basic functions to manipulate buffers */ - -unsigned int buffer_used(buffer_t *buf); /* How much data in the buffer */ -unsigned int buffer_unused(buffer_t *buf); /* How much space in the buffer */ -int buffer_full(buffer_t *buf); /* Boolean, is it full? */ -int buffer_notfull(buffer_t *buf); /* Boolean, is it not full? */ -int buffer_empty(buffer_t *buf); /* Boolean, is it empty? */ -int buffer_notempty(buffer_t *buf); /* Boolean, is it not empty? */ - -/* Add data to the tail of the buffer, returns the amount that was actually - * added (so, you need to check if return value is less than size) */ -unsigned int buffer_adddata(buffer_t *buf, const unsigned char *ptr, - unsigned int size); - -/* Take data from the front of the buffer (and scroll the rest forward). If - * "ptr" is NULL, this just removes data off the front of the buffer. Return - * value is the amount actually removed (can be less than size if the buffer has - * too little data). */ -unsigned int buffer_takedata(buffer_t *buf, unsigned char *ptr, - unsigned int size); - -/* Flushes as much data as possible out of the "from" buffer into the "to" - * buffer. Return value is the amount moved. The amount moved can be restricted - * to a maximum by specifying "cap" - setting it to -1 means no limit. */ -unsigned int buffer_tobuffer(buffer_t *to, buffer_t *from, int cap); - -#ifndef NO_IP -/* Read or write between a file-descriptor and a buffer */ -int buffer_from_fd(buffer_t *buf, int fd); -int buffer_to_fd(buffer_t *buf, int fd); -#endif /* !defined(NO_IP) */ - -#ifndef NO_OPENSSL -/* Read or write between an SSL or BIO and a buffer */ -void buffer_from_SSL(buffer_t *buf, SSL *ssl); -void buffer_to_SSL(buffer_t *buf, SSL *ssl); -void buffer_from_BIO(buffer_t *buf, BIO *bio); -void buffer_to_BIO(buffer_t *buf, BIO *bio); -#endif /* !defined(NO_OPENSSL) */ -#endif /* !defined(NO_BUFFER) */ - -#ifndef NO_TUNALA -#ifdef NO_BUFFER -#error "TUNALA section of tunala.h requires BUFFER support" -#endif -typedef struct _state_machine_t { - SSL *ssl; - BIO *bio_intossl; - BIO *bio_fromssl; - buffer_t clean_in, clean_out; - buffer_t dirty_in, dirty_out; -} state_machine_t; -typedef enum { - SM_CLEAN_IN, SM_CLEAN_OUT, - SM_DIRTY_IN, SM_DIRTY_OUT -} sm_buffer_t; -void state_machine_init(state_machine_t *machine); -void state_machine_close(state_machine_t *machine); -buffer_t *state_machine_get_buffer(state_machine_t *machine, sm_buffer_t type); -SSL *state_machine_get_SSL(state_machine_t *machine); -void state_machine_set_SSL(state_machine_t *machine, SSL *ssl, int is_server); -/* Performs the data-IO loop and returns zero if the machine should close */ -int state_machine_churn(state_machine_t *machine); -/* Is used to handle closing conditions - namely when one side of the tunnel has - * closed but the other should finish flushing. */ -int state_machine_close_clean(state_machine_t *machine); -int state_machine_close_dirty(state_machine_t *machine); -#endif /* !defined(NO_TUNALA) */ - -#ifndef NO_IP -/* Initialise anything related to the networking. This includes blocking pesky - * SIGPIPE signals. */ -int ip_initialise(void); -/* ip is the 4-byte ip address (eg. 127.0.0.1 is {0x7F,0x00,0x00,0x01}), port is - * the port to listen on (host byte order), and the return value is the - * file-descriptor or -1 on error. */ -int ip_create_listener_split(const unsigned char *ip, unsigned short port); -/* Same semantics as above. */ -int ip_create_connection_split(const unsigned char *ip, unsigned short port); -/* Converts a string into the ip/port before calling the above */ -int ip_create_listener(const char *address); -int ip_create_connection(const char *address); -/* Just does a string conversion on its own. NB: If accept_all_ip is non-zero, - * then the address string could be just a port. Ie. it's suitable for a - * listening address but not a connecting address. */ -int ip_parse_address(const char *address, unsigned char **parsed_ip, - unsigned short *port, int accept_all_ip); -/* Accepts an incoming connection through the listener. Assumes selects and - * what-not have deemed it an appropriate thing to do. */ -int ip_accept_connection(int listen_fd); -#endif /* !defined(NO_IP) */ - -#endif /* !defined(_TUNALA_H) */ |