src/lib/ecore_con/ecore_con_ssl.c

   1 #ifdef HAVE_CONFIG_H
   2 # include <config.h>
   3 #endif
   4
   5 #if USE_GNUTLS
   6 # include <gnutls/gnutls.h>
   7 # include <gnutls/x509.h>
   8 # include <gcrypt.h>
   9 #elif USE_OPENSSL
  10 # include <openssl/ssl.h>
  11 # include <openssl/err.h>
  12 # include <openssl/dh.h>
  13 #endif
  14
  15 #ifdef HAVE_WS2TCPIP_H
  16 # include <ws2tcpip.h>
  17 #endif
  18
  19 #include <sys/stat.h>
  20 #include "Ecore.h"
  21 #include "ecore_con_private.h"
  22
  23 EAPI int ECORE_CON_EVENT_CLIENT_UPGRADE = 0;
  24 EAPI int ECORE_CON_EVENT_SERVER_UPGRADE = 0;
  25
  26 static int _init_con_ssl_init_count = 0;
  27
  28 #ifdef USE_GNUTLS
  29 # ifdef EINA_HAVE_THREADS
  30 GCRY_THREAD_OPTION_PTHREAD_IMPL;
  31 # endif
  32
  33 static int _client_connected = 0;
  34
  35 # define SSL_SUFFIX(ssl_func) ssl_func ## _gnutls
  36 # define _ECORE_CON_SSL_AVAILABLE 1
  37
  38 #elif USE_OPENSSL
  39
  40 # define SSL_SUFFIX(ssl_func) ssl_func ## _openssl
  41 # define _ECORE_CON_SSL_AVAILABLE 2
  42
  43 #else
  44 # define SSL_SUFFIX(ssl_func) ssl_func ## _none
  45 # define _ECORE_CON_SSL_AVAILABLE 0
  46
  47 #endif
  48
  49 #if USE_GNUTLS
  50 static void
  51 _gnutls_print_errors(void *conn, int type, int ret)
  52 {
  53    char buf[1024];
  54
  55    if (!ret) return;
  56
  57    snprintf(buf, sizeof(buf), "GNUTLS error: %s - %s", gnutls_strerror_name(ret), gnutls_strerror(ret));
  58    if (type == ECORE_CON_EVENT_CLIENT_ERROR)
  59      ecore_con_event_client_error(conn, buf);
  60    else
  61      ecore_con_event_server_error(conn, buf);
  62 }
  63
  64 static void
  65 _gnutls_print_session(const gnutls_datum_t *cert_list, unsigned int cert_list_size)
  66 {
  67    char *c = NULL;
  68    gnutls_x509_crt_t crt;
  69    unsigned int x;
  70
  71    if (!eina_log_domain_level_check(_ecore_con_log_dom, EINA_LOG_LEVEL_DBG)) return;
  72    for (x = 0; x < cert_list_size; x++)
  73      {
  74         gnutls_x509_crt_init(&crt);
  75         gnutls_x509_crt_import(crt, &cert_list[x], GNUTLS_X509_FMT_DER);
  76         gnutls_x509_crt_print(crt, GNUTLS_CRT_PRINT_FULL, (gnutls_datum_t*)&c);
  77         INF("CERTIFICATE:\n%s", c);
  78         gnutls_free(c);
  79         gnutls_x509_crt_deinit(crt);
  80         crt = NULL;
  81      }
  82 }
  83
  84 #ifdef ISCOMFITOR
  85 static void
  86 _gnutls_log_func(int         level,
  87                  const char *str)
  88 {
  89    char buf[128];
  90    strncat(buf, str, strlen(str) - 1);
  91    DBG("|<%d>| %s", level, buf);
  92 }
  93 #endif
  94
  95 static const char *
  96 SSL_GNUTLS_PRINT_HANDSHAKE_STATUS(gnutls_handshake_description_t status)
  97 {
  98    switch (status)
  99      {
 100       case GNUTLS_HANDSHAKE_HELLO_REQUEST:
 101         return "Hello request";
 102
 103       case GNUTLS_HANDSHAKE_CLIENT_HELLO:
 104         return "Client hello";
 105
 106       case GNUTLS_HANDSHAKE_SERVER_HELLO:
 107         return "Server hello";
 108
 109       case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
 110         return "New session ticket";
 111
 112       case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
 113         return "Certificate packet";
 114
 115       case GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE:
 116         return "Server key exchange";
 117
 118       case GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST:
 119         return "Certificate request";
 120
 121       case GNUTLS_HANDSHAKE_SERVER_HELLO_DONE:
 122         return "Server hello done";
 123
 124       case GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY:
 125         return "Certificate verify";
 126
 127       case GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE:
 128         return "Client key exchange";
 129
 130       case GNUTLS_HANDSHAKE_FINISHED:
 131         return "Finished";
 132
 133       case GNUTLS_HANDSHAKE_SUPPLEMENTAL:
 134         return "Supplemental";
 135      }
 136    return NULL;
 137 }
 138
 139 #elif USE_OPENSSL
 140
 141 static void
 142 _openssl_print_verify_error(int error)
 143 {
 144    switch (error)
 145      {
 146 #define ERROR(X) \
 147   case (X): \
 148     ERR("%s", #X); \
 149     break
 150 #ifdef X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
 151       ERROR(X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT);
 152 #endif
 153 #ifdef X509_V_ERR_UNABLE_TO_GET_CRL
 154       ERROR(X509_V_ERR_UNABLE_TO_GET_CRL);
 155 #endif
 156 #ifdef X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE
 157       ERROR(X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE);
 158 #endif
 159 #ifdef X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE
 160       ERROR(X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE);
 161 #endif
 162 #ifdef X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY
 163       ERROR(X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY);
 164 #endif
 165 #ifdef X509_V_ERR_CERT_SIGNATURE_FAILURE
 166       ERROR(X509_V_ERR_CERT_SIGNATURE_FAILURE);
 167 #endif
 168 #ifdef X509_V_ERR_CRL_SIGNATURE_FAILURE
 169       ERROR(X509_V_ERR_CRL_SIGNATURE_FAILURE);
 170 #endif
 171 #ifdef X509_V_ERR_CERT_NOT_YET_VALID
 172       ERROR(X509_V_ERR_CERT_NOT_YET_VALID);
 173 #endif
 174 #ifdef X509_V_ERR_CERT_HAS_EXPIRED
 175       ERROR(X509_V_ERR_CERT_HAS_EXPIRED);
 176 #endif
 177 #ifdef X509_V_ERR_CRL_NOT_YET_VALID
 178       ERROR(X509_V_ERR_CRL_NOT_YET_VALID);
 179 #endif
 180 #ifdef X509_V_ERR_CRL_HAS_EXPIRED
 181       ERROR(X509_V_ERR_CRL_HAS_EXPIRED);
 182 #endif
 183 #ifdef X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
 184       ERROR(X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD);
 185 #endif
 186 #ifdef X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD
 187       ERROR(X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD);
 188 #endif
 189 #ifdef X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD
 190       ERROR(X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD);
 191 #endif
 192 #ifdef X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD
 193       ERROR(X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD);
 194 #endif
 195 #ifdef X509_V_ERR_OUT_OF_MEM
 196       ERROR(X509_V_ERR_OUT_OF_MEM);
 197 #endif
 198 #ifdef X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
 199       ERROR(X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT);
 200 #endif
 201 #ifdef X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN
 202       ERROR(X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN);
 203 #endif
 204 #ifdef X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
 205       ERROR(X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY);
 206 #endif
 207 #ifdef X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
 208       ERROR(X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE);
 209 #endif
 210 #ifdef X509_V_ERR_CERT_CHAIN_TOO_LONG
 211       ERROR(X509_V_ERR_CERT_CHAIN_TOO_LONG);
 212 #endif
 213 #ifdef X509_V_ERR_CERT_REVOKED
 214       ERROR(X509_V_ERR_CERT_REVOKED);
 215 #endif
 216 #ifdef X509_V_ERR_INVALID_CA
 217       ERROR(X509_V_ERR_INVALID_CA);
 218 #endif
 219 #ifdef X509_V_ERR_PATH_LENGTH_EXCEEDED
 220       ERROR(X509_V_ERR_PATH_LENGTH_EXCEEDED);
 221 #endif
 222 #ifdef X509_V_ERR_INVALID_PURPOSE
 223       ERROR(X509_V_ERR_INVALID_PURPOSE);
 224 #endif
 225 #ifdef X509_V_ERR_CERT_UNTRUSTED
 226       ERROR(X509_V_ERR_CERT_UNTRUSTED);
 227 #endif
 228 #ifdef X509_V_ERR_CERT_REJECTED
 229       ERROR(X509_V_ERR_CERT_REJECTED);
 230 #endif
 231       /* These are 'informational' when looking for issuer cert */
 232 #ifdef X509_V_ERR_SUBJECT_ISSUER_MISMATCH
 233       ERROR(X509_V_ERR_SUBJECT_ISSUER_MISMATCH);
 234 #endif
 235 #ifdef X509_V_ERR_AKID_SKID_MISMATCH
 236       ERROR(X509_V_ERR_AKID_SKID_MISMATCH);
 237 #endif
 238 #ifdef X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH
 239       ERROR(X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH);
 240 #endif
 241 #ifdef X509_V_ERR_KEYUSAGE_NO_CERTSIGN
 242       ERROR(X509_V_ERR_KEYUSAGE_NO_CERTSIGN);
 243 #endif
 244
 245 #ifdef X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER
 246       ERROR(X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER);
 247 #endif
 248 #ifdef X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION
 249       ERROR(X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION);
 250 #endif
 251 #ifdef X509_V_ERR_KEYUSAGE_NO_CRL_SIGN
 252       ERROR(X509_V_ERR_KEYUSAGE_NO_CRL_SIGN);
 253 #endif
 254 #ifdef X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION
 255       ERROR(X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
 256 #endif
 257 #ifdef X509_V_ERR_INVALID_NON_CA
 258       ERROR(X509_V_ERR_INVALID_NON_CA);
 259 #endif
 260 #ifdef X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED
 261       ERROR(X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED);
 262 #endif
 263 #ifdef X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE
 264       ERROR(X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE);
 265 #endif
 266 #ifdef X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED
 267       ERROR(X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED);
 268 #endif
 269
 270 #ifdef X509_V_ERR_INVALID_EXTENSION
 271       ERROR(X509_V_ERR_INVALID_EXTENSION);
 272 #endif
 273 #ifdef X509_V_ERR_INVALID_POLICY_EXTENSION
 274       ERROR(X509_V_ERR_INVALID_POLICY_EXTENSION);
 275 #endif
 276 #ifdef X509_V_ERR_NO_EXPLICIT_POLICY
 277       ERROR(X509_V_ERR_NO_EXPLICIT_POLICY);
 278 #endif
 279 #ifdef X509_V_ERR_DIFFERENT_CRL_SCOPE
 280       ERROR(X509_V_ERR_DIFFERENT_CRL_SCOPE);
 281 #endif
 282 #ifdef X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE
 283       ERROR(X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE);
 284 #endif
 285
 286 #ifdef X509_V_ERR_UNNESTED_RESOURCE
 287       ERROR(X509_V_ERR_UNNESTED_RESOURCE);
 288 #endif
 289
 290 #ifdef X509_V_ERR_PERMITTED_VIOLATION
 291       ERROR(X509_V_ERR_PERMITTED_VIOLATION);
 292 #endif
 293 #ifdef X509_V_ERR_EXCLUDED_VIOLATION
 294       ERROR(X509_V_ERR_EXCLUDED_VIOLATION);
 295 #endif
 296 #ifdef X509_V_ERR_SUBTREE_MINMAX
 297       ERROR(X509_V_ERR_SUBTREE_MINMAX);
 298 #endif
 299 #ifdef X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE
 300       ERROR(X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE);
 301 #endif
 302 #ifdef X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX
 303       ERROR(X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX);
 304 #endif
 305 #ifdef X509_V_ERR_UNSUPPORTED_NAME_SYNTAX
 306       ERROR(X509_V_ERR_UNSUPPORTED_NAME_SYNTAX);
 307 #endif
 308 #ifdef X509_V_ERR_CRL_PATH_VALIDATION_ERROR
 309       ERROR(X509_V_ERR_CRL_PATH_VALIDATION_ERROR);
 310 #endif
 311
 312       /* The application is not happy */
 313 #ifdef X509_V_ERR_APPLICATION_VERIFICATION
 314       ERROR(X509_V_ERR_APPLICATION_VERIFICATION);
 315 #endif
 316      }
 317 #undef ERROR
 318 }
 319
 320 static void
 321 _openssl_print_errors(void *conn, int type)
 322 {
 323    char buf[1024];
 324    do
 325      {
 326         unsigned long err;
 327
 328         err = ERR_get_error();
 329         if (!err) break;
 330         snprintf(buf, sizeof(buf), "OpenSSL error: %s", ERR_reason_error_string(err));
 331         if (type == ECORE_CON_EVENT_CLIENT_ERROR)
 332           ecore_con_event_client_error(conn, buf);
 333         else
 334           ecore_con_event_server_error(conn, buf);
 335
 336      } while (1);
 337 }
 338
 339 static Eina_Bool
 340 _openssl_name_verify(const char *name, const char *svrname)
 341 {
 342    if (name[0] == '*')
 343      {
 344         /* we allow *.domain.TLD with a wildcard, but nothing else */
 345         const char *p, *s;
 346
 347         EINA_SAFETY_ON_TRUE_RETURN_VAL((name[1] != '.') || (!name[2]), EINA_FALSE);
 348         p = strchr(name + 1, '*');
 349         EINA_SAFETY_ON_TRUE_RETURN_VAL(!!p, EINA_FALSE);
 350         /* verify that we have a domain of at least *.X.TLD and not *.TLD */
 351         p = strchr(name + 2, '.');
 352         EINA_SAFETY_ON_TRUE_RETURN_VAL(!p, EINA_FALSE);
 353         s = strchr(svrname, '.');
 354         EINA_SAFETY_ON_TRUE_RETURN_VAL(!s, EINA_FALSE);
 355         /* same as above for the stored name */
 356         EINA_SAFETY_ON_TRUE_RETURN_VAL(!strchr(s + 1, '.'), EINA_FALSE);
 357         if (strcasecmp(s, name + 1))
 358           {
 359              ERR("%s != %s", s, name + 1);
 360              return EINA_FALSE;
 361           }
 362      }
 363    else
 364      if (strcasecmp(name, svrname))
 365        {
 366           ERR("%s != %s", name, svrname);
 367           return EINA_FALSE;
 368        }
 369    return EINA_TRUE;
 370 }
 371
 372 static void
 373 _openssl_print_session(SSL *ssl)
 374 {
 375    /* print session info into DBG */
 376    SSL_SESSION *s;
 377    STACK_OF(X509) *sk;
 378    BIO *b;
 379    char log[4096], *p;
 380    int x;
 381
 382    if (!eina_log_domain_level_check(_ecore_con_log_dom, EINA_LOG_LEVEL_DBG)) return;
 383
 384    memset(log, 0, sizeof(log));
 385    b = BIO_new(BIO_s_mem());
 386    sk = SSL_get_peer_cert_chain(ssl);
 387    if (sk)
 388      {
 389         DBG("CERTIFICATES:");
 390         for (x = 0; x < sk_X509_num(sk); x++)
 391           {
 392              p = X509_NAME_oneline(X509_get_subject_name(sk_X509_value(sk, x)), log, sizeof(log));
 393              DBG("%2d s:%s", x, p);
 394              p = X509_NAME_oneline(X509_get_issuer_name(sk_X509_value(sk, x)), log, sizeof(log));
 395              DBG("   i:%s", p);
 396              PEM_write_X509(stderr, sk_X509_value(sk, x));
 397           }
 398      }
 399    s = SSL_get_session(ssl);
 400    SSL_SESSION_print(b, s);
 401    fprintf(stderr, "\n");
 402    while (BIO_read(b, log, sizeof(log)) > 0)
 403      fprintf(stderr, "%s", log);
 404
 405    BIO_free(b);
 406 }
 407
 408 #endif
 409
 410 #define SSL_ERROR_CHECK_GOTO_ERROR(X)                                           \
 411   do                                                                            \
 412     {                                                                           \
 413        if ((X))                                                                 \
 414          {                                                                      \
 415             ERR("Error at %s:%s:%d!", __FILE__, __PRETTY_FUNCTION__, __LINE__); \
 416             goto error;                                                         \
 417          }                                                                      \
 418     }                                                                           \
 419   while (0)
 420
 421 static Ecore_Con_Ssl_Error
 422                            SSL_SUFFIX(_ecore_con_ssl_init) (void);
 423 static Ecore_Con_Ssl_Error
 424                            SSL_SUFFIX(_ecore_con_ssl_shutdown) (void);
 425
 426 static Eina_Bool           SSL_SUFFIX(_ecore_con_ssl_server_cafile_add) (Ecore_Con_Server * svr, const char *ca_file);
 427 static Eina_Bool           SSL_SUFFIX(_ecore_con_ssl_server_crl_add) (Ecore_Con_Server * svr, const char *crl_file);
 428 static Eina_Bool           SSL_SUFFIX(_ecore_con_ssl_server_cert_add) (Ecore_Con_Server * svr, const char *cert);
 429 static Eina_Bool           SSL_SUFFIX(_ecore_con_ssl_server_privkey_add) (Ecore_Con_Server * svr, const char *key_file);
 430
 431 static Ecore_Con_Ssl_Error SSL_SUFFIX(_ecore_con_ssl_server_prepare) (Ecore_Con_Server * svr, int ssl_type);
 432 static Ecore_Con_Ssl_Error SSL_SUFFIX(_ecore_con_ssl_server_init) (Ecore_Con_Server * svr);
 433 static Ecore_Con_Ssl_Error SSL_SUFFIX(_ecore_con_ssl_server_shutdown) (Ecore_Con_Server *svr);
 434 static int SSL_SUFFIX(_ecore_con_ssl_server_read) (Ecore_Con_Server *svr, unsigned char *buf, int size);
 435 static int SSL_SUFFIX(_ecore_con_ssl_server_write) (Ecore_Con_Server *svr, const unsigned char *buf, int size);
 436
 437 static Ecore_Con_Ssl_Error SSL_SUFFIX(_ecore_con_ssl_client_init) (Ecore_Con_Client * cl);
 438 static Ecore_Con_Ssl_Error SSL_SUFFIX(_ecore_con_ssl_client_shutdown) (Ecore_Con_Client *cl);
 439 static int SSL_SUFFIX(_ecore_con_ssl_client_read) (Ecore_Con_Client * cl,
 440                                         unsigned char *buf, int size);
 441 static int SSL_SUFFIX(_ecore_con_ssl_client_write) (Ecore_Con_Client * cl,
 442                                          const unsigned char *buf, int size);
 443
 444 /*
 445  * General SSL API
 446  */
 447
 448 Ecore_Con_Ssl_Error
 449 ecore_con_ssl_init(void)
 450 {
 451    if (!_init_con_ssl_init_count++)
 452      {
 453         SSL_SUFFIX(_ecore_con_ssl_init) ();
 454 #if _ECORE_CON_SSL_AVAILABLE != 0
 455         ECORE_CON_EVENT_CLIENT_UPGRADE = ecore_event_type_new();
 456         ECORE_CON_EVENT_SERVER_UPGRADE = ecore_event_type_new();
 457 #endif
 458      }
 459
 460    return _init_con_ssl_init_count;
 461 }
 462
 463 Ecore_Con_Ssl_Error
 464 ecore_con_ssl_shutdown(void)
 465 {
 466    if (!--_init_con_ssl_init_count)
 467      SSL_SUFFIX(_ecore_con_ssl_shutdown) ();
 468
 469    return _init_con_ssl_init_count;
 470 }
 471
 472 Ecore_Con_Ssl_Error
 473 ecore_con_ssl_server_prepare(Ecore_Con_Server *svr,
 474                              int               ssl_type)
 475 {
 476    if (!ssl_type)
 477      return ECORE_CON_SSL_ERROR_NONE;
 478    return SSL_SUFFIX(_ecore_con_ssl_server_prepare) (svr, ssl_type);
 479 }
 480
 481 Ecore_Con_Ssl_Error
 482 ecore_con_ssl_server_init(Ecore_Con_Server *svr)
 483 {
 484    if (!(svr->type & ECORE_CON_SSL))
 485      return ECORE_CON_SSL_ERROR_NONE;
 486    return SSL_SUFFIX(_ecore_con_ssl_server_init) (svr);
 487 }
 488
 489 Ecore_Con_Ssl_Error
 490 ecore_con_ssl_server_shutdown(Ecore_Con_Server *svr)
 491 {
 492    if (!(svr->type & ECORE_CON_SSL))
 493      return ECORE_CON_SSL_ERROR_NONE;
 494    return SSL_SUFFIX(_ecore_con_ssl_server_shutdown) (svr);
 495 }
 496
 497 int
 498 ecore_con_ssl_server_read(Ecore_Con_Server *svr,
 499                           unsigned char    *buf,
 500                           int               size)
 501 {
 502    return SSL_SUFFIX(_ecore_con_ssl_server_read) (svr, buf, size);
 503 }
 504
 505 int
 506 ecore_con_ssl_server_write(Ecore_Con_Server *svr,
 507                            const unsigned char *buf,
 508                            int               size)
 509 {
 510    return SSL_SUFFIX(_ecore_con_ssl_server_write) (svr, buf, size);
 511 }
 512
 513 Ecore_Con_Ssl_Error
 514 ecore_con_ssl_client_init(Ecore_Con_Client *cl)
 515 {
 516    if (!(cl->host_server->type & ECORE_CON_SSL))
 517      return ECORE_CON_SSL_ERROR_NONE;
 518    return SSL_SUFFIX(_ecore_con_ssl_client_init) (cl);
 519 }
 520
 521 Ecore_Con_Ssl_Error
 522 ecore_con_ssl_client_shutdown(Ecore_Con_Client *cl)
 523 {
 524    if (!(cl->host_server->type & ECORE_CON_SSL))
 525      return ECORE_CON_SSL_ERROR_NONE;
 526    return SSL_SUFFIX(_ecore_con_ssl_client_shutdown) (cl);
 527 }
 528
 529 int
 530 ecore_con_ssl_client_read(Ecore_Con_Client *cl,
 531                           unsigned char    *buf,
 532                           int               size)
 533 {
 534    return SSL_SUFFIX(_ecore_con_ssl_client_read) (cl, buf, size);
 535 }
 536
 537 int
 538 ecore_con_ssl_client_write(Ecore_Con_Client *cl,
 539                            const unsigned char *buf,
 540                            int               size)
 541 {
 542    return SSL_SUFFIX(_ecore_con_ssl_client_write) (cl, buf, size);
 543 }
 544
 545 /**
 546  * Returns if SSL support is available
 547  * @return 1 if SSL is available and provided by gnutls, 2 if provided by openssl,
 548  * 0 if it is not available.
 549  * @ingroup Ecore_Con_Client_Group
 550  */
 551 EAPI int
 552 ecore_con_ssl_available_get(void)
 553 {
 554    return _ECORE_CON_SSL_AVAILABLE;
 555 }
 556
 557 /**
 558  * @addtogroup Ecore_Con_SSL_Group Ecore Connection SSL Functions
 559  *
 560  * Functions that operate on Ecore connection objects pertaining to SSL.
 561  *
 562  * @{
 563  */
 564
 565 /**
 566  * @brief Enable certificate verification on a server object
 567  *
 568  * Call this function on a server object before main loop has started
 569  * to enable verification of certificates against loaded certificates.
 570  * @param svr The server object
 571  */
 572 EAPI void
 573 ecore_con_ssl_server_verify(Ecore_Con_Server *svr)
 574 {
 575    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 576      {
 577         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, "ecore_con_ssl_server_verify");
 578         return;
 579      }
 580    svr->verify = EINA_TRUE;
 581 }
 582
 583 /**
 584  * @brief Enable hostname-based certificate verification on a server object
 585  *
 586  * Call this function on a server object before main loop has started
 587  * to enable verification of certificates using ONLY their hostnames.
 588  * @param svr The server object
 589  * @note This function has no effect when used on a listening server created by
 590  * ecore_con_server_add
 591  * @since 1.1
 592  */
 593 EAPI void
 594 ecore_con_ssl_server_verify_basic(Ecore_Con_Server *svr)
 595 {
 596    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 597      {
 598         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, __func__);
 599         return;
 600      }
 601    svr->verify_basic = EINA_TRUE;
 602 }
 603
 604 /**
 605  * @brief Set the hostname to verify against in certificate verification
 606  *
 607  * Sometimes the certificate hostname will not match the hostname that you are
 608  * connecting to, and will instead match a different name. An example of this is
 609  * that if you connect to talk.google.com to use Google Talk, you receive Google's
 610  * certificate for gmail.com. This certificate should be trusted, and so you must call
 611  * this function with "gmail.com" as @p name.
 612  * See RFC2818 for more details.
 613  * @param svr The server object
 614  * @param name The hostname to verify against
 615  * @since 1.2
 616  */
 617 EAPI void
 618 ecore_con_ssl_server_verify_name_set(Ecore_Con_Server *svr, const char *name)
 619 {
 620    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 621      {
 622         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, __func__);
 623         return;
 624      }
 625    eina_stringshare_replace(&svr->verify_name, name);
 626 }
 627
 628 /**
 629  * @brief Get the hostname to verify against in certificate verification
 630  *
 631  * This function returns the name which will be used to validate the SSL certificate
 632  * common name (CN) or alt name (subjectAltName). It will default to the @p name
 633  * param in ecore_con_server_connect(), but can be changed with ecore_con_ssl_server_verify_name_set().
 634  * @param svr The server object
 635  * @return The hostname which will be used
 636  * @since 1.2
 637  */
 638 EAPI const char *
 639 ecore_con_ssl_server_verify_name_get(Ecore_Con_Server *svr)
 640 {
 641    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 642      {
 643         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, __func__);
 644         return NULL;
 645      }
 646    return svr->verify_name ?: svr->name;
 647 }
 648
 649 /**
 650  * @brief Add an ssl certificate for use in ecore_con functions.
 651  *
 652  * Use this function to add a SSL PEM certificate.
 653  * Simply specify the cert here to use it in the server object for connecting or listening.
 654  * If there is an error loading the certificate, an error will automatically be logged.
 655  * @param svr The server object
 656  * @param cert The path to the certificate.
 657  * @return @c EINA_FALSE if the file cannot be loaded, otherwise @c EINA_TRUE.
 658  */
 659
 660 EAPI Eina_Bool
 661 ecore_con_ssl_server_cert_add(Ecore_Con_Server *svr,
 662                               const char       *cert)
 663 {
 664    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 665      {
 666         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, "ecore_con_ssl_server_cert_add");
 667         return EINA_FALSE;
 668      }
 669
 670    if (!svr->ssl_prepared)
 671      {
 672         svr->use_cert = EINA_TRUE;
 673         svr->type |= ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT;
 674         if (ecore_con_ssl_server_prepare(svr, svr->type & ECORE_CON_SSL))
 675           return EINA_FALSE;
 676      }
 677
 678    return SSL_SUFFIX(_ecore_con_ssl_server_cert_add) (svr, cert);
 679 }
 680
 681 /**
 682  * @brief Add an ssl CA file for use in ecore_con functions.
 683  *
 684  * Use this function to add a SSL PEM CA file.
 685  * Simply specify the file here to use it in the server object for connecting or listening.
 686  * If there is an error loading the CAs, an error will automatically be logged.
 687  * @param svr The server object
 688  * @param ca_file The path to the CA file.
 689  * @return @c EINA_FALSE if the file cannot be loaded, otherwise @c EINA_TRUE.
 690  * @note since 1.2, this function can load directores
 691  */
 692
 693 EAPI Eina_Bool
 694 ecore_con_ssl_server_cafile_add(Ecore_Con_Server *svr,
 695                                 const char       *ca_file)
 696 {
 697    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 698      {
 699         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, "ecore_con_ssl_server_cafile_add");
 700         return EINA_FALSE;
 701      }
 702
 703    if (!svr->ssl_prepared)
 704      {
 705         svr->use_cert = EINA_TRUE;
 706         svr->type |= ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT;
 707         if (ecore_con_ssl_server_prepare(svr, svr->type & ECORE_CON_SSL))
 708           return EINA_FALSE;
 709      }
 710
 711    return SSL_SUFFIX(_ecore_con_ssl_server_cafile_add) (svr, ca_file);
 712 }
 713
 714 /**
 715  * @brief Add an ssl private key for use in ecore_con functions.
 716  *
 717  * Use this function to add a SSL PEM private key
 718  * Simply specify the key file here to use it in the server object for connecting or listening.
 719  * If there is an error loading the key, an error will automatically be logged.
 720  * @param svr The server object
 721  * @param key_file The path to the key file.
 722  * @return @c EINA_FALSE if the file cannot be loaded, otherwise @c EINA_TRUE.
 723  */
 724
 725 EAPI Eina_Bool
 726 ecore_con_ssl_server_privkey_add(Ecore_Con_Server *svr,
 727                                  const char       *key_file)
 728 {
 729    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 730      {
 731         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, "ecore_con_ssl_server_privkey_add");
 732         return EINA_FALSE;
 733      }
 734
 735    if (!svr->ssl_prepared)
 736      {
 737         svr->use_cert = EINA_TRUE;
 738         svr->type |= ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT;
 739         if (ecore_con_ssl_server_prepare(svr, svr->type & ECORE_CON_SSL))
 740           return EINA_FALSE;
 741      }
 742
 743    return SSL_SUFFIX(_ecore_con_ssl_server_privkey_add) (svr, key_file);
 744 }
 745
 746 /**
 747  * @brief Add an ssl CRL for use in ecore_con functions.
 748  *
 749  * Use this function to add a SSL PEM CRL file
 750  * Simply specify the CRL file here to use it in the server object for connecting or listening.
 751  * If there is an error loading the CRL, an error will automatically be logged.
 752  * @param svr The server object
 753  * @param crl_file The path to the CRL file.
 754  * @return @c EINA_FALSE if the file cannot be loaded, otherwise @c EINA_TRUE.
 755  */
 756
 757 EAPI Eina_Bool
 758 ecore_con_ssl_server_crl_add(Ecore_Con_Server *svr,
 759                              const char       *crl_file)
 760 {
 761    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 762      {
 763         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, "ecore_con_ssl_server_crl_add");
 764         return EINA_FALSE;
 765      }
 766
 767    if (!svr->ssl_prepared)
 768      {
 769         svr->use_cert = EINA_TRUE;
 770         svr->type |= ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT;
 771         if (ecore_con_ssl_server_prepare(svr, svr->type & ECORE_CON_SSL))
 772           return EINA_FALSE;
 773      }
 774
 775    return SSL_SUFFIX(_ecore_con_ssl_server_crl_add) (svr, crl_file);
 776 }
 777
 778 /**
 779  * @brief Upgrade a connection to a specified level of encryption
 780  *
 781  * Use this function to begin an SSL handshake on a connection (STARTTLS or similar).
 782  * Once the upgrade has been completed, an ECORE_CON_EVENT_SERVER_UPGRADE event will be emitted.
 783  * The connection should be treated as disconnected until the next event.
 784  * @param svr The server object
 785  * @param ssl_type The SSL connection type (ONLY).
 786  * @return @c EINA_FALSE if the connection cannot be upgraded, otherwise @c EINA_TRUE.
 787  * @note This function is NEVER to be used on a server object created with ecore_con_server_add
 788  * @warning Setting a wrong value for @p compl_type WILL mess up your program.
 789  * @since 1.1
 790  */
 791
 792 EAPI Eina_Bool
 793 ecore_con_ssl_server_upgrade(Ecore_Con_Server *svr, Ecore_Con_Type ssl_type)
 794 {
 795    if (!ECORE_MAGIC_CHECK(svr, ECORE_MAGIC_CON_SERVER))
 796      {
 797         ECORE_MAGIC_FAIL(svr, ECORE_MAGIC_CON_SERVER, __func__);
 798         return EINA_FALSE;
 799      }
 800 #if _ECORE_CON_SSL_AVAILABLE == 0
 801    return EINA_FALSE;
 802 #endif
 803
 804    if (!svr->ssl_prepared)
 805      {
 806         if (ecore_con_ssl_server_prepare(svr, ssl_type))
 807           return EINA_FALSE;
 808      }
 809    if (!svr->use_cert)
 810      svr->type |= ssl_type;
 811    svr->upgrade = EINA_TRUE;
 812    svr->handshaking = EINA_TRUE;
 813    svr->ssl_state = ECORE_CON_SSL_STATE_INIT;
 814    return !SSL_SUFFIX(_ecore_con_ssl_server_init) (svr);
 815 }
 816
 817 /**
 818  * @brief Upgrade a connection to a specified level of encryption
 819  *
 820  * Use this function to begin an SSL handshake on a connection (STARTTLS or similar).
 821  * Once the upgrade has been completed, an ECORE_CON_EVENT_CLIENT_UPGRADE event will be emitted.
 822  * The connection should be treated as disconnected until the next event.
 823  * @param cl The client object
 824  * @param ssl_type The SSL connection type (ONLY).
 825  * @return @c EINA_FALSE if the connection cannot be upgraded, otherwise @c EINA_TRUE.
 826  * @warning Setting a wrong value for @p compl_type WILL mess up your program.
 827  * @since 1.1
 828  */
 829
 830 EAPI Eina_Bool
 831 ecore_con_ssl_client_upgrade(Ecore_Con_Client *cl, Ecore_Con_Type ssl_type)
 832 {
 833    if (!ECORE_MAGIC_CHECK(cl, ECORE_MAGIC_CON_CLIENT))
 834      {
 835         ECORE_MAGIC_FAIL(cl, ECORE_MAGIC_CON_CLIENT, __func__);
 836         return EINA_FALSE;
 837      }
 838 #if _ECORE_CON_SSL_AVAILABLE == 0
 839    return EINA_FALSE;
 840 #endif
 841
 842    if (!cl->host_server->ssl_prepared)
 843      {
 844         if (ecore_con_ssl_server_prepare(cl->host_server, ssl_type))
 845           return EINA_FALSE;
 846      }
 847    if (!cl->host_server->use_cert)
 848      cl->host_server->type |= ssl_type;
 849    cl->upgrade = EINA_TRUE;
 850    cl->host_server->upgrade = EINA_TRUE;
 851    cl->handshaking = EINA_TRUE;
 852    cl->ssl_state = ECORE_CON_SSL_STATE_INIT;
 853    return SSL_SUFFIX(_ecore_con_ssl_client_init) (cl);
 854 }
 855
 856 /**
 857  * @}
 858  */
 859
 860 #if USE_GNUTLS
 861
 862 /*
 863  * GnuTLS
 864  */
 865
 866 static Ecore_Con_Ssl_Error
 867 _ecore_con_ssl_init_gnutls(void)
 868 {
 869 #ifdef EINA_HAVE_THREADS
 870    if (gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread))
 871      WRN("YOU ARE USING PTHREADS, BUT I CANNOT INITIALIZE THREADSAFE GCRYPT OPERATIONS!");
 872 #endif
 873    if (gnutls_global_init())
 874      return ECORE_CON_SSL_ERROR_INIT_FAILED;
 875
 876 #ifdef ISCOMFITOR
 877    if (eina_log_domain_level_check(_ecore_con_log_dom, EINA_LOG_LEVEL_DBG))
 878      {
 879         gnutls_global_set_log_level(9);
 880         gnutls_global_set_log_function(_gnutls_log_func);
 881      }
 882 #endif
 883    return ECORE_CON_SSL_ERROR_NONE;
 884 }
 885
 886 static Ecore_Con_Ssl_Error
 887 _ecore_con_ssl_shutdown_gnutls(void)
 888 {
 889    gnutls_global_deinit();
 890
 891    return ECORE_CON_SSL_ERROR_NONE;
 892 }
 893
 894 static Ecore_Con_Ssl_Error
 895 _ecore_con_ssl_server_prepare_gnutls(Ecore_Con_Server *svr,
 896                                      int               ssl_type)
 897 {
 898    int ret;
 899
 900    if (ssl_type & ECORE_CON_USE_SSL2)
 901      return ECORE_CON_SSL_ERROR_SSL2_NOT_SUPPORTED;
 902
 903    switch (ssl_type)
 904      {
 905       case ECORE_CON_USE_SSL3:
 906       case ECORE_CON_USE_SSL3 | ECORE_CON_LOAD_CERT:
 907       case ECORE_CON_USE_TLS:
 908       case ECORE_CON_USE_TLS | ECORE_CON_LOAD_CERT:
 909       case ECORE_CON_USE_MIXED:
 910       case ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT:
 911         break;
 912
 913       default:
 914         return ECORE_CON_SSL_ERROR_NONE;
 915      }
 916
 917    SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_certificate_allocate_credentials(&svr->cert));
 918
 919    if (svr->use_cert)
 920      {
 921         if  (svr->created)
 922           {
 923              SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_dh_params_init(&svr->dh_params));
 924              INF("Generating DH params");
 925              SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_dh_params_generate2(svr->dh_params, 1024));
 926
 927              SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_anon_allocate_server_credentials(&svr->anoncred_s));
 928              /* TODO: implement PSK */
 929              //  SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_psk_allocate_server_credentials(&svr->pskcred_s));
 930
 931              gnutls_anon_set_server_dh_params(svr->anoncred_s, svr->dh_params);
 932              gnutls_certificate_set_dh_params(svr->cert, svr->dh_params);
 933              //gnutls_psk_set_server_dh_params(svr->pskcred_s, svr->dh_params);
 934              INF("DH params successfully generated and applied!");
 935           }
 936       else
 937         {
 938            //SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_psk_allocate_client_credentials(&svr->pskcred_c));
 939              SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_anon_allocate_client_credentials(&svr->anoncred_c));
 940         }
 941      }
 942
 943    svr->ssl_prepared = EINA_TRUE;
 944    return ECORE_CON_SSL_ERROR_NONE;
 945
 946 error:
 947    _gnutls_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR, ret);
 948    _ecore_con_ssl_server_shutdown_gnutls(svr);
 949    return ECORE_CON_SSL_ERROR_SERVER_INIT_FAILED;
 950 }
 951
 952
 953 static Ecore_Con_Ssl_Error
 954 _ecore_con_ssl_server_init_gnutls(Ecore_Con_Server *svr)
 955 {
 956    const gnutls_datum_t *cert_list;
 957    unsigned int iter, cert_list_size;
 958    gnutls_x509_crt_t cert = NULL;
 959    const char *priority = "NONE:%VERIFY_ALLOW_X509_V1_CA_CRT:+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+COMP-DEFLATE:+COMP-NULL:+CTYPE-X509:+SHA1:+SHA256:+SHA384:+SHA512:+AES-256-CBC:+AES-128-CBC:+3DES-CBC:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0";
 960    int ret = 0;
 961
 962    switch (svr->ssl_state)
 963      {
 964       case ECORE_CON_SSL_STATE_DONE:
 965         return ECORE_CON_SSL_ERROR_NONE;
 966
 967       case ECORE_CON_SSL_STATE_INIT:
 968         if (svr->type & ECORE_CON_USE_SSL2) /* not supported because of security issues */
 969           return ECORE_CON_SSL_ERROR_SSL2_NOT_SUPPORTED;
 970
 971         switch (svr->type & ECORE_CON_SSL)
 972           {
 973            case ECORE_CON_USE_SSL3:
 974            case ECORE_CON_USE_SSL3 | ECORE_CON_LOAD_CERT:
 975              priority = "NONE:%VERIFY_ALLOW_X509_V1_CA_CRT:+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+COMP-DEFLATE:+COMP-NULL:+CTYPE-X509:+SHA1:+SHA256:+SHA384:+SHA512:+AES-256-CBC:+AES-128-CBC:+3DES-CBC:!VERS-TLS1.0:!VERS-TLS1.1";
 976              break;
 977
 978            case ECORE_CON_USE_TLS:
 979            case ECORE_CON_USE_TLS | ECORE_CON_LOAD_CERT:
 980              priority = "NONE:%VERIFY_ALLOW_X509_V1_CA_CRT:+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+COMP-DEFLATE:+COMP-NULL:+CTYPE-X509:+SHA1:+SHA256:+SHA384:+SHA512:+AES-256-CBC:+AES-128-CBC:+3DES-CBC:!VERS-SSL3.0";
 981              break;
 982
 983            case ECORE_CON_USE_MIXED:
 984            case ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT:
 985              break;
 986
 987            default:
 988              return ECORE_CON_SSL_ERROR_NONE;
 989           }
 990
 991         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_init(&svr->session, GNUTLS_CLIENT));
 992         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_session_ticket_enable_client(svr->session));
 993         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_server_name_set(svr->session, GNUTLS_NAME_DNS, svr->name, strlen(svr->name)));
 994         INF("Applying priority string: %s", priority);
 995         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_priority_set_direct(svr->session, priority, NULL));
 996         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_credentials_set(svr->session, GNUTLS_CRD_CERTIFICATE, svr->cert));
 997         // SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_credentials_set(svr->session, GNUTLS_CRD_PSK, svr->pskcred_c));
 998         if (!svr->use_cert)
 999           SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_credentials_set(svr->session, GNUTLS_CRD_ANON, svr->anoncred_c));
1000
1001         gnutls_dh_set_prime_bits(svr->session, 512);
1002         gnutls_transport_set_ptr(svr->session, (gnutls_transport_ptr_t)((intptr_t)svr->fd));
1003         svr->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1004
1005       case ECORE_CON_SSL_STATE_HANDSHAKING:
1006         if (!svr->session)
1007           {
1008              DBG("Server was previously lost, going to error condition");
1009              goto error;
1010           }
1011         ret = gnutls_handshake(svr->session);
1012         DBG("calling gnutls_handshake(): returned with '%s'", gnutls_strerror_name(ret));
1013         SSL_ERROR_CHECK_GOTO_ERROR(gnutls_error_is_fatal(ret));
1014         if (!ret)
1015           {
1016              svr->handshaking = EINA_FALSE;
1017              svr->ssl_state = ECORE_CON_SSL_STATE_DONE;
1018           }
1019         else
1020           {
1021              if (gnutls_record_get_direction(svr->session))
1022                ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_WRITE);
1023              else
1024                ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_READ);
1025              return ECORE_CON_SSL_ERROR_NONE;
1026           }
1027
1028       default:
1029         break;
1030      }
1031
1032    if ((!svr->verify) && (!svr->verify_basic))
1033      /* not verifying certificates, so we're done! */
1034      return ECORE_CON_SSL_ERROR_NONE;
1035    if (svr->verify)
1036      {
1037         /* use CRL/CA lists to verify */
1038         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_certificate_verify_peers2(svr->session, &iter));
1039         if (iter & GNUTLS_CERT_INVALID)
1040           ERR("The certificate is not trusted.");
1041         else if (iter & GNUTLS_CERT_SIGNER_NOT_FOUND)
1042           ERR("The certificate hasn't got a known issuer.");
1043         else if (iter & GNUTLS_CERT_REVOKED)
1044           ERR("The certificate has been revoked.");
1045         else if (iter & GNUTLS_CERT_EXPIRED)
1046           ERR("The certificate has expired");
1047         else if (iter & GNUTLS_CERT_NOT_ACTIVATED)
1048           ERR("The certificate is not yet activated");
1049
1050         if (iter)
1051           goto error;
1052      }
1053    if (gnutls_certificate_type_get(svr->session) != GNUTLS_CRT_X509)
1054      {
1055         ERR("Warning: PGP certificates are not yet supported!");
1056         goto error;
1057      }
1058
1059    SSL_ERROR_CHECK_GOTO_ERROR(!(cert_list = gnutls_certificate_get_peers(svr->session, &cert_list_size)));
1060    SSL_ERROR_CHECK_GOTO_ERROR(!cert_list_size);
1061
1062    _gnutls_print_session(cert_list, cert_list_size);
1063
1064    SSL_ERROR_CHECK_GOTO_ERROR(gnutls_x509_crt_init(&cert));
1065    SSL_ERROR_CHECK_GOTO_ERROR(gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER));
1066
1067    SSL_ERROR_CHECK_GOTO_ERROR(!gnutls_x509_crt_check_hostname(cert, svr->verify_name ?: svr->name));
1068    gnutls_x509_crt_deinit(cert);
1069    DBG("SSL certificate verification succeeded!");
1070    return ECORE_CON_SSL_ERROR_NONE;
1071
1072 error:
1073    _gnutls_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR, ret);
1074    if ((ret == GNUTLS_E_WARNING_ALERT_RECEIVED) || (ret == GNUTLS_E_FATAL_ALERT_RECEIVED))
1075      ERR("Also received alert: %s", gnutls_alert_get_name(gnutls_alert_get(svr->session)));
1076    if (svr->session && (svr->ssl_state != ECORE_CON_SSL_STATE_DONE))
1077      {
1078         ERR("last out: %s", SSL_GNUTLS_PRINT_HANDSHAKE_STATUS(gnutls_handshake_get_last_out(svr->session)));
1079         ERR("last in: %s", SSL_GNUTLS_PRINT_HANDSHAKE_STATUS(gnutls_handshake_get_last_in(svr->session)));
1080      }
1081    if (cert)
1082      gnutls_x509_crt_deinit(cert);
1083    _ecore_con_ssl_server_shutdown_gnutls(svr);
1084    return ECORE_CON_SSL_ERROR_SERVER_INIT_FAILED;
1085 }
1086
1087 static Eina_Bool
1088 _ecore_con_ssl_server_cafile_add_gnutls(Ecore_Con_Server *svr,
1089                                         const char       *ca_file)
1090 {
1091    struct stat st;
1092    Eina_Iterator *it;
1093    const char *file;
1094    Eina_Bool error = EINA_FALSE;
1095
1096    if (stat(ca_file, &st)) return EINA_FALSE;
1097    if (S_ISDIR(st.st_mode))
1098      {
1099         it = eina_file_ls(ca_file);
1100         SSL_ERROR_CHECK_GOTO_ERROR(!it);
1101         EINA_ITERATOR_FOREACH(it, file)
1102           {
1103              if (!error)
1104                {
1105                   if (gnutls_certificate_set_x509_trust_file(svr->cert, file, GNUTLS_X509_FMT_PEM) < 1)
1106                     error++;
1107                }
1108              eina_stringshare_del(file);
1109           }
1110         eina_iterator_free(it);
1111      }
1112    else
1113      SSL_ERROR_CHECK_GOTO_ERROR(gnutls_certificate_set_x509_trust_file(svr->cert, ca_file,
1114                                                                        GNUTLS_X509_FMT_PEM) < 1);
1115
1116    return !error;
1117 error:
1118    ERR("Could not load CA file!");
1119    return EINA_FALSE;
1120 }
1121
1122 static Eina_Bool
1123 _ecore_con_ssl_server_crl_add_gnutls(Ecore_Con_Server *svr,
1124                                      const char       *crl_file)
1125 {
1126    SSL_ERROR_CHECK_GOTO_ERROR(gnutls_certificate_set_x509_crl_file(svr->cert, crl_file,
1127                                                                    GNUTLS_X509_FMT_PEM) < 1);
1128
1129    return EINA_TRUE;
1130 error:
1131    ERR("Could not load CRL file!");
1132    return EINA_FALSE;
1133 }
1134
1135 static Eina_Bool
1136 _ecore_con_ssl_server_privkey_add_gnutls(Ecore_Con_Server *svr,
1137                                          const char       *key_file)
1138 {
1139    SSL_ERROR_CHECK_GOTO_ERROR(gnutls_certificate_set_x509_key_file(svr->cert, svr->cert_file, key_file,
1140                                                                    GNUTLS_X509_FMT_PEM));
1141
1142    return EINA_TRUE;
1143 error:
1144    ERR("Could not load certificate/key file!");
1145    return EINA_FALSE;
1146 }
1147
1148 static Eina_Bool
1149 _ecore_con_ssl_server_cert_add_gnutls(Ecore_Con_Server *svr,
1150                                       const char       *cert_file)
1151 {
1152    if (!(svr->cert_file = strdup(cert_file)))
1153      return EINA_FALSE;
1154
1155    return EINA_TRUE;
1156 }
1157
1158 static Ecore_Con_Ssl_Error
1159 _ecore_con_ssl_server_shutdown_gnutls(Ecore_Con_Server *svr)
1160 {
1161    if (svr->session)
1162      {
1163         gnutls_bye(svr->session, GNUTLS_SHUT_RDWR);
1164         gnutls_deinit(svr->session);
1165      }
1166
1167    free(svr->cert_file);
1168    svr->cert_file = NULL;
1169    if (svr->cert)
1170      gnutls_certificate_free_credentials(svr->cert);
1171    svr->cert = NULL;
1172
1173    if ((svr->type & ECORE_CON_SSL) && svr->created)
1174      {
1175         if (svr->dh_params)
1176           {
1177              gnutls_dh_params_deinit(svr->dh_params);
1178              svr->dh_params = NULL;
1179           }
1180         if (svr->anoncred_s)
1181           gnutls_anon_free_server_credentials(svr->anoncred_s);
1182         //  if (svr->pskcred_s)
1183         //   gnutls_psk_free_server_credentials(svr->pskcred_s);
1184
1185         svr->anoncred_s = NULL;
1186         svr->pskcred_s = NULL;
1187      }
1188    else if (svr->type & ECORE_CON_SSL)
1189      {
1190         if (svr->anoncred_c)
1191           gnutls_anon_free_client_credentials(svr->anoncred_c);
1192         // if (svr->pskcred_c)
1193         // gnutls_psk_free_client_credentials(svr->pskcred_c);
1194
1195         svr->anoncred_c = NULL;
1196         svr->pskcred_c = NULL;
1197      }
1198
1199    svr->session = NULL;
1200
1201    return ECORE_CON_SSL_ERROR_NONE;
1202 }
1203
1204 static int
1205 _ecore_con_ssl_server_read_gnutls(Ecore_Con_Server *svr,
1206                                   unsigned char    *buf,
1207                                   int               size)
1208 {
1209    int num;
1210
1211    if (svr->ssl_state == ECORE_CON_SSL_STATE_HANDSHAKING)
1212      {
1213         DBG("Continuing gnutls handshake");
1214         if (!_ecore_con_ssl_server_init_gnutls(svr))
1215           return 0;
1216         return -1;
1217      }
1218
1219    num = gnutls_record_recv(svr->session, buf, size);
1220    if (num > 0)
1221      return num;
1222
1223    if (num == GNUTLS_E_REHANDSHAKE)
1224      {
1225         WRN("Rehandshake request ignored");
1226         return 0;
1227
1228         svr->handshaking = EINA_TRUE;
1229         svr->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1230         if (!_ecore_con_ssl_server_init_gnutls(svr))
1231           return 0;
1232      }
1233    else if ((!gnutls_error_is_fatal(num)) && (num != GNUTLS_E_SUCCESS))
1234      return 0;
1235
1236    return -1;
1237 }
1238
1239 static int
1240 _ecore_con_ssl_server_write_gnutls(Ecore_Con_Server *svr,
1241                                    const unsigned char *buf,
1242                                    int               size)
1243 {
1244    int num;
1245
1246    if (svr->ssl_state == ECORE_CON_SSL_STATE_HANDSHAKING)
1247      {
1248         DBG("Continuing gnutls handshake");
1249         if (!_ecore_con_ssl_server_init_gnutls(svr))
1250           return 0;
1251         return -1;
1252      }
1253
1254    num = gnutls_record_send(svr->session, buf, size);
1255    if (num > 0)
1256      return num;
1257
1258    if (num == GNUTLS_E_REHANDSHAKE)
1259      {
1260         WRN("Rehandshake request ignored");
1261         return 0;
1262 /* this is only partly functional I think? */
1263         svr->handshaking = EINA_TRUE;
1264         svr->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1265         if (!_ecore_con_ssl_server_init_gnutls(svr))
1266           return 0;
1267      }
1268    else if (!gnutls_error_is_fatal(num))
1269      return 0;
1270
1271    return -1;
1272 }
1273
1274 static Ecore_Con_Ssl_Error
1275 _ecore_con_ssl_client_init_gnutls(Ecore_Con_Client *cl)
1276 {
1277    const gnutls_datum_t *cert_list;
1278    unsigned int iter, cert_list_size;
1279    const char *priority = "NONE:%VERIFY_ALLOW_X509_V1_CA_CRT:+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+COMP-DEFLATE:+COMP-NULL:+CTYPE-X509:+SHA1:+SHA256:+SHA384:+SHA512:+AES-256-CBC:+AES-128-CBC:+3DES-CBC:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0";
1280    int ret = 0;
1281
1282    switch (cl->ssl_state)
1283      {
1284       case ECORE_CON_SSL_STATE_DONE:
1285         return ECORE_CON_SSL_ERROR_NONE;
1286
1287       case ECORE_CON_SSL_STATE_INIT:
1288         if (cl->host_server->type & ECORE_CON_USE_SSL2) /* not supported because of security issues */
1289           return ECORE_CON_SSL_ERROR_SSL2_NOT_SUPPORTED;
1290
1291         switch (cl->host_server->type & ECORE_CON_SSL)
1292           {
1293            case ECORE_CON_USE_SSL3:
1294            case ECORE_CON_USE_SSL3 | ECORE_CON_LOAD_CERT:
1295              priority = "NONE:%VERIFY_ALLOW_X509_V1_CA_CRT:+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+COMP-DEFLATE:+COMP-NULL:+CTYPE-X509:+SHA1:+SHA256:+SHA384:+SHA512:+AES-256-CBC:+AES-128-CBC:+3DES-CBC:!VERS-TLS1.0:!VERS-TLS1.1";
1296              break;
1297
1298            case ECORE_CON_USE_TLS:
1299            case ECORE_CON_USE_TLS | ECORE_CON_LOAD_CERT:
1300              priority = "NONE:%VERIFY_ALLOW_X509_V1_CA_CRT:+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+COMP-DEFLATE:+COMP-NULL:+CTYPE-X509:+SHA1:+SHA256:+SHA384:+SHA512:+AES-256-CBC:+AES-128-CBC:+3DES-CBC:!VERS-SSL3.0";
1301              break;
1302
1303            case ECORE_CON_USE_MIXED:
1304            case ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT:
1305              break;
1306
1307            default:
1308              return ECORE_CON_SSL_ERROR_NONE;
1309           }
1310
1311         _client_connected++;
1312
1313         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_init(&cl->session, GNUTLS_SERVER));
1314         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_session_ticket_key_generate(&cl->session_ticket));
1315         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_session_ticket_enable_server(cl->session, &cl->session_ticket));
1316         INF("Applying priority string: %s", priority);
1317         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_priority_set_direct(cl->session, priority, NULL));
1318         SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_credentials_set(cl->session, GNUTLS_CRD_CERTIFICATE, cl->host_server->cert));
1319         //  SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_credentials_set(cl->session, GNUTLS_CRD_PSK, cl->host_server->pskcred_s));
1320         if (!cl->host_server->use_cert)
1321           SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_credentials_set(cl->session, GNUTLS_CRD_ANON, cl->host_server->anoncred_s));
1322
1323         gnutls_certificate_server_set_request(cl->session, GNUTLS_CERT_REQUEST);
1324
1325         gnutls_dh_set_prime_bits(cl->session, 2048);
1326         gnutls_transport_set_ptr(cl->session, (gnutls_transport_ptr_t)((intptr_t)cl->fd));
1327         cl->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1328
1329       case ECORE_CON_SSL_STATE_HANDSHAKING:
1330         if (!cl->session)
1331           {
1332              DBG("Client was previously lost, going to error condition");
1333              goto error;
1334           }
1335         DBG("calling gnutls_handshake()");
1336         ret = gnutls_handshake(cl->session);
1337         SSL_ERROR_CHECK_GOTO_ERROR(gnutls_error_is_fatal(ret));
1338
1339         if (!ret)
1340           {
1341              cl->handshaking = EINA_FALSE;
1342              cl->ssl_state = ECORE_CON_SSL_STATE_DONE;
1343           }
1344         else
1345           {
1346              if (gnutls_record_get_direction(cl->session))
1347                ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_WRITE);
1348              else
1349                ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_READ);
1350              return ECORE_CON_SSL_ERROR_NONE;
1351           }
1352
1353       default:
1354         break;
1355      }
1356
1357    if (!cl->host_server->verify)
1358      /* not verifying certificates, so we're done! */
1359      return ECORE_CON_SSL_ERROR_NONE;
1360    /* use CRL/CA lists to verify */
1361    SSL_ERROR_CHECK_GOTO_ERROR(ret = gnutls_certificate_verify_peers2(cl->session, &iter));
1362    if (iter & GNUTLS_CERT_INVALID)
1363      ERR("The certificate is not trusted.");
1364    else if (iter & GNUTLS_CERT_SIGNER_NOT_FOUND)
1365      ERR("The certificate hasn't got a known issuer.");
1366    else if (iter & GNUTLS_CERT_REVOKED)
1367      ERR("The certificate has been revoked.");
1368    else if (iter & GNUTLS_CERT_EXPIRED)
1369      ERR("The certificate has expired");
1370    else if (iter & GNUTLS_CERT_NOT_ACTIVATED)
1371      ERR("The certificate is not yet activated");
1372
1373    if (iter)
1374      goto error;
1375    if (gnutls_certificate_type_get(cl->session) != GNUTLS_CRT_X509)
1376      {
1377         ERR("Warning: PGP certificates are not yet supported!");
1378         goto error;
1379      }
1380
1381    SSL_ERROR_CHECK_GOTO_ERROR(!(cert_list = gnutls_certificate_get_peers(cl->session, &cert_list_size)));
1382    SSL_ERROR_CHECK_GOTO_ERROR(!cert_list_size);
1383
1384    _gnutls_print_session(cert_list, cert_list_size);
1385 /*
1386    gnutls_x509_crt_t cert = NULL;
1387    SSL_ERROR_CHECK_GOTO_ERROR(gnutls_x509_crt_init(&cert));
1388    SSL_ERROR_CHECK_GOTO_ERROR(gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER));
1389
1390    SSL_ERROR_CHECK_GOTO_ERROR(!gnutls_x509_crt_check_hostname(cert, cl->host_server->name));
1391    gnutls_x509_crt_deinit(cert);
1392 */
1393    DBG("SSL certificate verification succeeded!");
1394    return ECORE_CON_SSL_ERROR_NONE;
1395
1396 error:
1397    _gnutls_print_errors(cl, ECORE_CON_EVENT_CLIENT_ERROR, ret);
1398    if ((ret == GNUTLS_E_WARNING_ALERT_RECEIVED) || (ret == GNUTLS_E_FATAL_ALERT_RECEIVED))
1399      ERR("Also received alert: %s", gnutls_alert_get_name(gnutls_alert_get(cl->session)));
1400    if (cl->session && (cl->ssl_state != ECORE_CON_SSL_STATE_DONE))
1401      {
1402         ERR("last out: %s", SSL_GNUTLS_PRINT_HANDSHAKE_STATUS(gnutls_handshake_get_last_out(cl->session)));
1403         ERR("last in: %s", SSL_GNUTLS_PRINT_HANDSHAKE_STATUS(gnutls_handshake_get_last_in(cl->session)));
1404      }
1405 /*
1406    if (cert)
1407      gnutls_x509_crt_deinit(cert);
1408 */
1409    _ecore_con_ssl_client_shutdown_gnutls(cl);
1410    return ECORE_CON_SSL_ERROR_SERVER_INIT_FAILED;
1411 }
1412
1413 static Ecore_Con_Ssl_Error
1414 _ecore_con_ssl_client_shutdown_gnutls(Ecore_Con_Client *cl)
1415 {
1416    if (cl->session)
1417      {
1418         gnutls_bye(cl->session, GNUTLS_SHUT_RDWR);
1419         gnutls_deinit(cl->session);
1420         gnutls_free(cl->session_ticket.data);
1421         cl->session_ticket.data = NULL;
1422      }
1423
1424    cl->session = NULL;
1425
1426    return ECORE_CON_SSL_ERROR_NONE;
1427 }
1428
1429 static int
1430 _ecore_con_ssl_client_read_gnutls(Ecore_Con_Client *cl,
1431                                   unsigned char    *buf,
1432                                   int               size)
1433 {
1434    int num;
1435
1436    if (cl->ssl_state == ECORE_CON_SSL_STATE_HANDSHAKING)
1437      {
1438         if (!_ecore_con_ssl_client_init_gnutls(cl))
1439           return 0;
1440         return -1;
1441      }
1442
1443    num = gnutls_record_recv(cl->session, buf, size);
1444    if (num > 0)
1445      return num;
1446
1447    if (num == GNUTLS_E_REHANDSHAKE)
1448      {
1449         WRN("Rehandshake request ignored");
1450         return 0;
1451         cl->handshaking = EINA_TRUE;
1452         cl->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1453         if (!_ecore_con_ssl_client_init_gnutls(cl))
1454           return 0;
1455         WRN("Rehandshake request ignored");
1456         return 0;
1457      }
1458    else if ((!gnutls_error_is_fatal(num)) && (num != GNUTLS_E_SUCCESS))
1459      return 0;
1460
1461    return -1;
1462 }
1463
1464 static int
1465 _ecore_con_ssl_client_write_gnutls(Ecore_Con_Client *cl,
1466                                    const unsigned char *buf,
1467                                    int               size)
1468 {
1469    int num;
1470
1471    if (cl->ssl_state == ECORE_CON_SSL_STATE_HANDSHAKING)
1472      {
1473         if (!_ecore_con_ssl_client_init_gnutls(cl))
1474           return 0;
1475         return -1;
1476      }
1477
1478    num = gnutls_record_send(cl->session, buf, size);
1479    if (num > 0)
1480      return num;
1481
1482    if (num == GNUTLS_E_REHANDSHAKE)
1483      {
1484         WRN("Rehandshake request ignored");
1485         return 0;
1486         cl->handshaking = EINA_TRUE;
1487         cl->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1488         if (!_ecore_con_ssl_client_init_gnutls(cl))
1489           return 0;
1490      }
1491    else if (!gnutls_error_is_fatal(num))
1492      return 0;
1493
1494    return -1;
1495 }
1496
1497 #elif USE_OPENSSL && !USE_GNUTLS
1498
1499 /*
1500  * OpenSSL
1501  */
1502
1503 static Ecore_Con_Ssl_Error
1504 _ecore_con_ssl_init_openssl(void)
1505 {
1506    SSL_library_init();
1507    SSL_load_error_strings();
1508    OpenSSL_add_all_algorithms();
1509
1510    return ECORE_CON_SSL_ERROR_NONE;
1511 }
1512
1513 static Ecore_Con_Ssl_Error
1514 _ecore_con_ssl_shutdown_openssl(void)
1515 {
1516    ERR_free_strings();
1517    EVP_cleanup();
1518    return ECORE_CON_SSL_ERROR_NONE;
1519 }
1520
1521 static Ecore_Con_Ssl_Error
1522 _ecore_con_ssl_server_prepare_openssl(Ecore_Con_Server *svr,
1523                                       int               ssl_type)
1524 {
1525    long options;
1526    int dh = 0;
1527
1528    if (ssl_type & ECORE_CON_USE_SSL2)
1529      return ECORE_CON_SSL_ERROR_SSL2_NOT_SUPPORTED;
1530
1531    switch (ssl_type)
1532      {
1533       case ECORE_CON_USE_SSL3:
1534       case ECORE_CON_USE_SSL3 | ECORE_CON_LOAD_CERT:
1535         if (!svr->created)
1536           SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl_ctx = SSL_CTX_new(SSLv3_client_method())));
1537         else
1538           SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl_ctx = SSL_CTX_new(SSLv3_server_method())));
1539         break;
1540
1541       case ECORE_CON_USE_TLS:
1542       case ECORE_CON_USE_TLS | ECORE_CON_LOAD_CERT:
1543         if (!svr->created)
1544           SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl_ctx = SSL_CTX_new(TLSv1_client_method())));
1545         else
1546           SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl_ctx = SSL_CTX_new(TLSv1_server_method())));
1547         break;
1548
1549       case ECORE_CON_USE_MIXED:
1550       case ECORE_CON_USE_MIXED | ECORE_CON_LOAD_CERT:
1551         if (!svr->created)
1552           SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl_ctx = SSL_CTX_new(SSLv23_client_method())));
1553         else
1554           SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl_ctx = SSL_CTX_new(SSLv23_server_method())));
1555         options = SSL_CTX_get_options(svr->ssl_ctx);
1556         SSL_CTX_set_options(svr->ssl_ctx, options | SSL_OP_NO_SSLv2 | SSL_OP_SINGLE_DH_USE);
1557         break;
1558
1559       default:
1560         svr->ssl_prepared = EINA_TRUE;
1561         return ECORE_CON_SSL_ERROR_NONE;
1562      }
1563
1564    if ((!svr->use_cert) && svr->created)
1565      {
1566         DH *dh_params;
1567         INF("Generating DH params");
1568         SSL_ERROR_CHECK_GOTO_ERROR(!(dh_params = DH_new()));
1569         SSL_ERROR_CHECK_GOTO_ERROR(!DH_generate_parameters_ex(dh_params, 1024, DH_GENERATOR_5, NULL));
1570         SSL_ERROR_CHECK_GOTO_ERROR(!DH_check(dh_params, &dh));
1571         SSL_ERROR_CHECK_GOTO_ERROR((dh & DH_CHECK_P_NOT_PRIME) || (dh & DH_CHECK_P_NOT_SAFE_PRIME));
1572         SSL_ERROR_CHECK_GOTO_ERROR(!DH_generate_key(dh_params));
1573         SSL_ERROR_CHECK_GOTO_ERROR(!SSL_CTX_set_tmp_dh(svr->ssl_ctx, dh_params));
1574         DH_free(dh_params);
1575         INF("DH params successfully generated and applied!");
1576         SSL_ERROR_CHECK_GOTO_ERROR(!SSL_CTX_set_cipher_list(svr->ssl_ctx, "aNULL:!eNULL:!LOW:!EXPORT:@STRENGTH"));
1577      }
1578    else if (!svr->use_cert)
1579      SSL_ERROR_CHECK_GOTO_ERROR(!SSL_CTX_set_cipher_list(svr->ssl_ctx, "aNULL:!eNULL:!LOW:!EXPORT:!ECDH:RSA:AES:!PSK:@STRENGTH"));
1580
1581    svr->ssl_prepared = EINA_TRUE;
1582    return ECORE_CON_SSL_ERROR_NONE;
1583
1584 error:
1585    if (dh)
1586      {
1587         if (dh & DH_CHECK_P_NOT_PRIME)
1588           ERR("openssl error: dh_params could not generate a prime!");
1589         else
1590           ERR("openssl error: dh_params could not generate a safe prime!");
1591      }
1592    else
1593      _openssl_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR);
1594    _ecore_con_ssl_server_shutdown_openssl(svr);
1595    return ECORE_CON_SSL_ERROR_SERVER_INIT_FAILED;
1596 }
1597
1598 static Ecore_Con_Ssl_Error
1599 _ecore_con_ssl_server_init_openssl(Ecore_Con_Server *svr)
1600 {
1601    int ret = -1;
1602
1603    switch (svr->ssl_state)
1604      {
1605       case ECORE_CON_SSL_STATE_DONE:
1606         return ECORE_CON_SSL_ERROR_NONE;
1607
1608       case ECORE_CON_SSL_STATE_INIT:
1609         SSL_ERROR_CHECK_GOTO_ERROR(!(svr->ssl = SSL_new(svr->ssl_ctx)));
1610
1611         SSL_ERROR_CHECK_GOTO_ERROR(!SSL_set_fd(svr->ssl, svr->fd));
1612         SSL_set_connect_state(svr->ssl);
1613         svr->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1614
1615       case ECORE_CON_SSL_STATE_HANDSHAKING:
1616         if (!svr->ssl)
1617           {
1618              DBG("Server was previously lost, going to error condition");
1619              goto error;
1620           }
1621         ret = SSL_do_handshake(svr->ssl);
1622         svr->ssl_err = SSL_get_error(svr->ssl, ret);
1623         SSL_ERROR_CHECK_GOTO_ERROR((svr->ssl_err == SSL_ERROR_SYSCALL) || (svr->ssl_err == SSL_ERROR_SSL));
1624
1625         if (ret == 1)
1626           {
1627              svr->handshaking = EINA_FALSE;
1628              svr->ssl_state = ECORE_CON_SSL_STATE_DONE;
1629           }
1630         else
1631           {
1632              if (svr->ssl_err == SSL_ERROR_WANT_READ)
1633                ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_READ);
1634              else if (svr->ssl_err == SSL_ERROR_WANT_WRITE)
1635                ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_WRITE);
1636              return ECORE_CON_SSL_ERROR_NONE;
1637           }
1638
1639       default:
1640         break;
1641      }
1642
1643    _openssl_print_session(svr->ssl);
1644    if ((!svr->verify) && (!svr->verify_basic))
1645      /* not verifying certificates, so we're done! */
1646      return ECORE_CON_SSL_ERROR_NONE;
1647
1648    {
1649       X509 *cert;
1650       SSL_set_verify(svr->ssl, SSL_VERIFY_PEER, NULL);
1651       /* use CRL/CA lists to verify */
1652       cert = SSL_get_peer_certificate(svr->ssl);
1653       if (cert)
1654         {
1655            char *c;
1656            int clen;
1657            int name = 0;
1658
1659            if (svr->verify)
1660              {
1661                int err;
1662
1663                err = SSL_get_verify_result(svr->ssl);
1664                _openssl_print_verify_error(err);
1665                SSL_ERROR_CHECK_GOTO_ERROR(err);
1666              }
1667            clen = X509_NAME_get_text_by_NID(X509_get_subject_name(cert), NID_subject_alt_name, NULL, 0);
1668            if (clen > 0)
1669              name = NID_subject_alt_name;
1670            else
1671              clen = X509_NAME_get_text_by_NID(X509_get_subject_name(cert), NID_commonName, NULL, 0);
1672            SSL_ERROR_CHECK_GOTO_ERROR(clen < 1);
1673            if (!name) name = NID_commonName;
1674            c = alloca(++clen);
1675            X509_NAME_get_text_by_NID(X509_get_subject_name(cert), name, c, clen);
1676            INF("CERT NAME: %s\n", c);
1677            SSL_ERROR_CHECK_GOTO_ERROR(!_openssl_name_verify(c, svr->verify_name ?: svr->name));
1678         }
1679    }
1680
1681    DBG("SSL certificate verification succeeded!");
1682
1683    return ECORE_CON_SSL_ERROR_NONE;
1684
1685 error:
1686    _openssl_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR);
1687    _ecore_con_ssl_server_shutdown_openssl(svr);
1688    return ECORE_CON_SSL_ERROR_SERVER_INIT_FAILED;
1689 }
1690
1691 static Eina_Bool
1692 _ecore_con_ssl_server_cafile_add_openssl(Ecore_Con_Server *svr,
1693                                          const char       *ca_file)
1694 {
1695    struct stat st;
1696
1697    if (stat(ca_file, &st)) return EINA_FALSE;
1698    if (S_ISDIR(st.st_mode))
1699      SSL_ERROR_CHECK_GOTO_ERROR(!SSL_CTX_load_verify_locations(svr->ssl_ctx, NULL, ca_file));
1700    else
1701      SSL_ERROR_CHECK_GOTO_ERROR(!SSL_CTX_load_verify_locations(svr->ssl_ctx, ca_file, NULL));
1702    return EINA_TRUE;
1703
1704 error:
1705    _openssl_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR);
1706    return EINA_FALSE;
1707 }
1708
1709 static Eina_Bool
1710 _ecore_con_ssl_server_crl_add_openssl(Ecore_Con_Server *svr,
1711                                       const char       *crl_file)
1712 {
1713    X509_STORE *st;
1714    X509_LOOKUP *lu;
1715    static Eina_Bool flag = EINA_FALSE;
1716
1717    SSL_ERROR_CHECK_GOTO_ERROR(!(st = SSL_CTX_get_cert_store(svr->ssl_ctx)));
1718    SSL_ERROR_CHECK_GOTO_ERROR(!(lu = X509_STORE_add_lookup(st, X509_LOOKUP_file())));
1719    SSL_ERROR_CHECK_GOTO_ERROR(X509_load_crl_file(lu, crl_file, X509_FILETYPE_PEM) < 1);
1720    if (!flag)
1721      {
1722         X509_STORE_set_flags(st, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
1723         flag = EINA_TRUE;
1724      }
1725
1726    return EINA_TRUE;
1727
1728 error:
1729    _openssl_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR);
1730    return EINA_FALSE;
1731 }
1732
1733 static Eina_Bool
1734 _ecore_con_ssl_server_privkey_add_openssl(Ecore_Con_Server *svr,
1735                                           const char       *key_file)
1736 {
1737    FILE *fp = NULL;
1738    EVP_PKEY *privkey = NULL;
1739
1740    if (!(fp = fopen(key_file, "r")))
1741      goto error;
1742
1743    SSL_ERROR_CHECK_GOTO_ERROR(!(privkey = PEM_read_PrivateKey(fp, NULL, NULL, NULL)));
1744
1745    fclose(fp);
1746    fp = NULL;
1747    SSL_ERROR_CHECK_GOTO_ERROR(SSL_CTX_use_PrivateKey(svr->ssl_ctx, privkey) < 1);
1748    SSL_ERROR_CHECK_GOTO_ERROR(SSL_CTX_check_private_key(svr->ssl_ctx) < 1);
1749
1750    return EINA_TRUE;
1751
1752 error:
1753    if (fp)
1754      fclose(fp);
1755    _openssl_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR);
1756    return EINA_FALSE;
1757 }
1758
1759 static Eina_Bool
1760 _ecore_con_ssl_server_cert_add_openssl(Ecore_Con_Server *svr,
1761                                        const char       *cert_file)
1762 {
1763    FILE *fp = NULL;
1764    X509 *cert = NULL;
1765
1766    if (!(fp = fopen(cert_file, "r")))
1767      goto error;
1768
1769    SSL_ERROR_CHECK_GOTO_ERROR(!(cert = PEM_read_X509(fp, NULL, NULL, NULL)));
1770
1771    fclose(fp);
1772    fp = NULL;
1773    SSL_ERROR_CHECK_GOTO_ERROR(SSL_CTX_use_certificate(svr->ssl_ctx, cert) < 1);
1774
1775    return EINA_TRUE;
1776
1777 error:
1778    if (fp)
1779      fclose(fp);
1780    _openssl_print_errors(svr, ECORE_CON_EVENT_SERVER_ERROR);
1781    return EINA_FALSE;
1782 }
1783
1784 static Ecore_Con_Ssl_Error
1785 _ecore_con_ssl_server_shutdown_openssl(Ecore_Con_Server *svr)
1786 {
1787    if (svr->ssl)
1788      {
1789         if (!SSL_shutdown(svr->ssl))
1790           SSL_shutdown(svr->ssl);
1791
1792         SSL_free(svr->ssl);
1793      }
1794
1795    if (svr->ssl_ctx)
1796      SSL_CTX_free(svr->ssl_ctx);
1797
1798    svr->ssl = NULL;
1799    svr->ssl_ctx = NULL;
1800    svr->ssl_err = SSL_ERROR_NONE;
1801
1802    return ECORE_CON_SSL_ERROR_NONE;
1803 }
1804
1805 static int
1806 _ecore_con_ssl_server_read_openssl(Ecore_Con_Server *svr,
1807                                    unsigned char    *buf,
1808                                    int               size)
1809 {
1810    int num;
1811
1812    if (!svr->ssl) return -1;
1813    num = SSL_read(svr->ssl, buf, size);
1814    svr->ssl_err = SSL_get_error(svr->ssl, num);
1815
1816    if (svr->fd_handler)
1817      {
1818         if (svr->ssl && svr->ssl_err == SSL_ERROR_WANT_READ)
1819           ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_READ);
1820         else if (svr->ssl && svr->ssl_err == SSL_ERROR_WANT_WRITE)
1821           ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_WRITE);
1822      }
1823
1824    if ((svr->ssl_err == SSL_ERROR_ZERO_RETURN) ||
1825        (svr->ssl_err == SSL_ERROR_SYSCALL) ||
1826        (svr->ssl_err == SSL_ERROR_SSL))
1827      return -1;
1828
1829    if (num < 0)
1830      return 0;
1831
1832    return num;
1833 }
1834
1835 static int
1836 _ecore_con_ssl_server_write_openssl(Ecore_Con_Server *svr,
1837                                     const unsigned char *buf,
1838                                     int               size)
1839 {
1840    int num;
1841
1842    num = SSL_write(svr->ssl, buf, size);
1843    svr->ssl_err = SSL_get_error(svr->ssl, num);
1844
1845    if (svr->fd_handler)
1846      {
1847         if (svr->ssl && svr->ssl_err == SSL_ERROR_WANT_READ)
1848           ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_READ);
1849         else if (svr->ssl && svr->ssl_err == SSL_ERROR_WANT_WRITE)
1850           ecore_main_fd_handler_active_set(svr->fd_handler, ECORE_FD_WRITE);
1851      }
1852
1853    if ((svr->ssl_err == SSL_ERROR_ZERO_RETURN) ||
1854        (svr->ssl_err == SSL_ERROR_SYSCALL) ||
1855        (svr->ssl_err == SSL_ERROR_SSL))
1856      return -1;
1857
1858    if (num < 0)
1859      return 0;
1860
1861    return num;
1862 }
1863
1864 static Ecore_Con_Ssl_Error
1865 _ecore_con_ssl_client_init_openssl(Ecore_Con_Client *cl)
1866 {
1867    int ret = -1;
1868    switch (cl->ssl_state)
1869      {
1870       case ECORE_CON_SSL_STATE_DONE:
1871         return ECORE_CON_SSL_ERROR_NONE;
1872
1873       case ECORE_CON_SSL_STATE_INIT:
1874         SSL_ERROR_CHECK_GOTO_ERROR(!(cl->ssl = SSL_new(cl->host_server->ssl_ctx)));
1875
1876         SSL_ERROR_CHECK_GOTO_ERROR(!SSL_set_fd(cl->ssl, cl->fd));
1877         SSL_set_accept_state(cl->ssl);
1878         cl->ssl_state = ECORE_CON_SSL_STATE_HANDSHAKING;
1879
1880       case ECORE_CON_SSL_STATE_HANDSHAKING:
1881          if (!cl->ssl)
1882           {
1883              DBG("Client was previously lost, going to error condition");
1884              goto error;
1885           }
1886         ret = SSL_do_handshake(cl->ssl);
1887         cl->ssl_err = SSL_get_error(cl->ssl, ret);
1888         SSL_ERROR_CHECK_GOTO_ERROR((cl->ssl_err == SSL_ERROR_SYSCALL) || (cl->ssl_err == SSL_ERROR_SSL));
1889         if (ret == 1)
1890           {
1891              cl->handshaking = EINA_FALSE;
1892              cl->ssl_state = ECORE_CON_SSL_STATE_DONE;
1893           }
1894         else
1895           {
1896              if (cl->ssl_err == SSL_ERROR_WANT_READ)
1897                ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_READ);
1898              else if (cl->ssl_err == SSL_ERROR_WANT_WRITE)
1899                ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_WRITE);
1900              return ECORE_CON_SSL_ERROR_NONE;
1901           }
1902
1903       default:
1904         break;
1905      }
1906
1907    _openssl_print_session(cl->ssl);
1908    if (!cl->host_server->verify)
1909      /* not verifying certificates, so we're done! */
1910      return ECORE_CON_SSL_ERROR_NONE;
1911    SSL_set_verify(cl->ssl, SSL_VERIFY_PEER, NULL);
1912    /* use CRL/CA lists to verify */
1913    if (SSL_get_peer_certificate(cl->ssl))
1914      {
1915         int err;
1916
1917         err = SSL_get_verify_result(cl->ssl);
1918         _openssl_print_verify_error(err);
1919         SSL_ERROR_CHECK_GOTO_ERROR(err);
1920      }
1921
1922    return ECORE_CON_SSL_ERROR_NONE;
1923
1924 error:
1925    _openssl_print_errors(cl, ECORE_CON_EVENT_CLIENT_ERROR);
1926    _ecore_con_ssl_client_shutdown_openssl(cl);
1927    return ECORE_CON_SSL_ERROR_SERVER_INIT_FAILED;
1928 }
1929
1930 static Ecore_Con_Ssl_Error
1931 _ecore_con_ssl_client_shutdown_openssl(Ecore_Con_Client *cl)
1932 {
1933    if (cl->ssl)
1934      {
1935         if (!SSL_shutdown(cl->ssl))
1936           SSL_shutdown(cl->ssl);
1937
1938         SSL_free(cl->ssl);
1939      }
1940
1941    cl->ssl = NULL;
1942    cl->ssl_err = SSL_ERROR_NONE;
1943
1944    return ECORE_CON_SSL_ERROR_NONE;
1945 }
1946
1947 static int
1948 _ecore_con_ssl_client_read_openssl(Ecore_Con_Client *cl,
1949                                    unsigned char    *buf,
1950                                    int               size)
1951 {
1952    int num;
1953
1954    if (!cl->ssl) return -1;
1955    num = SSL_read(cl->ssl, buf, size);
1956    cl->ssl_err = SSL_get_error(cl->ssl, num);
1957
1958    if (cl->fd_handler)
1959      {
1960         if (cl->ssl && cl->ssl_err == SSL_ERROR_WANT_READ)
1961           ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_READ);
1962         else if (cl->ssl && cl->ssl_err == SSL_ERROR_WANT_WRITE)
1963           ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_WRITE);
1964      }
1965
1966    if ((cl->ssl_err == SSL_ERROR_ZERO_RETURN) ||
1967        (cl->ssl_err == SSL_ERROR_SYSCALL) ||
1968        (cl->ssl_err == SSL_ERROR_SSL))
1969      return -1;
1970
1971    if (num < 0)
1972      return 0;
1973
1974    return num;
1975 }
1976
1977 static int
1978 _ecore_con_ssl_client_write_openssl(Ecore_Con_Client *cl,
1979                                     const unsigned char *buf,
1980                                     int               size)
1981 {
1982    int num;
1983
1984    num = SSL_write(cl->ssl, buf, size);
1985    cl->ssl_err = SSL_get_error(cl->ssl, num);
1986
1987    if (cl->fd_handler)
1988      {
1989         if (cl->ssl && cl->ssl_err == SSL_ERROR_WANT_READ)
1990           ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_READ);
1991         else if (cl->ssl && cl->ssl_err == SSL_ERROR_WANT_WRITE)
1992           ecore_main_fd_handler_active_set(cl->fd_handler, ECORE_FD_WRITE);
1993      }
1994
1995    if ((cl->ssl_err == SSL_ERROR_ZERO_RETURN) ||
1996        (cl->ssl_err == SSL_ERROR_SYSCALL) ||
1997        (cl->ssl_err == SSL_ERROR_SSL))
1998      return -1;
1999
2000    if (num < 0)
2001      return 0;
2002
2003    return num;
2004 }
2005
2006 #else
2007
2008 /*
2009  * No Ssl
2010  */
2011
2012 static Ecore_Con_Ssl_Error
2013 _ecore_con_ssl_init_none(void)
2014 {
2015    return ECORE_CON_SSL_ERROR_NONE;
2016 }
2017
2018 static Ecore_Con_Ssl_Error
2019 _ecore_con_ssl_shutdown_none(void)
2020 {
2021    return ECORE_CON_SSL_ERROR_NONE;
2022 }
2023
2024 static Ecore_Con_Ssl_Error
2025 _ecore_con_ssl_server_prepare_none(Ecore_Con_Server *svr __UNUSED__,
2026                                    int ssl_type          __UNUSED__)
2027 {
2028    return ECORE_CON_SSL_ERROR_NONE;
2029 }
2030
2031 static Ecore_Con_Ssl_Error
2032 _ecore_con_ssl_server_init_none(Ecore_Con_Server *svr __UNUSED__)
2033 {
2034    return ECORE_CON_SSL_ERROR_NOT_SUPPORTED;
2035 }
2036
2037 static Eina_Bool
2038 _ecore_con_ssl_server_cafile_add_none(Ecore_Con_Server *svr __UNUSED__,
2039                                       const char *ca_file   __UNUSED__)
2040 {
2041    return EINA_FALSE;
2042 }
2043
2044 static Eina_Bool
2045 _ecore_con_ssl_server_cert_add_none(Ecore_Con_Server *svr __UNUSED__,
2046                                     const char *cert_file __UNUSED__)
2047 {
2048    return EINA_FALSE;
2049 }
2050
2051 static Eina_Bool
2052 _ecore_con_ssl_server_privkey_add_none(Ecore_Con_Server *svr __UNUSED__,
2053                                        const char *key_file  __UNUSED__)
2054 {
2055    return EINA_FALSE;
2056 }
2057
2058 static Eina_Bool
2059 _ecore_con_ssl_server_crl_add_none(Ecore_Con_Server *svr __UNUSED__,
2060                                    const char *crl_file  __UNUSED__)
2061 {
2062    return EINA_FALSE;
2063 }
2064
2065 static Ecore_Con_Ssl_Error
2066 _ecore_con_ssl_server_shutdown_none(Ecore_Con_Server *svr __UNUSED__)
2067 {
2068    return ECORE_CON_SSL_ERROR_NOT_SUPPORTED;
2069 }
2070
2071 static int
2072 _ecore_con_ssl_server_read_none(Ecore_Con_Server *svr __UNUSED__,
2073                                 unsigned char *buf    __UNUSED__,
2074                                 int size              __UNUSED__)
2075 {
2076    return -1;
2077 }
2078
2079 static int
2080 _ecore_con_ssl_server_write_none(Ecore_Con_Server *svr __UNUSED__,
2081                                  const unsigned char *buf __UNUSED__,
2082                                  int size              __UNUSED__)
2083 {
2084    return -1;
2085 }
2086
2087 static Ecore_Con_Ssl_Error
2088 _ecore_con_ssl_client_init_none(Ecore_Con_Client *cl __UNUSED__)
2089 {
2090    return ECORE_CON_SSL_ERROR_NOT_SUPPORTED;
2091 }
2092
2093 static Ecore_Con_Ssl_Error
2094 _ecore_con_ssl_client_shutdown_none(Ecore_Con_Client *cl __UNUSED__)
2095 {
2096    return ECORE_CON_SSL_ERROR_NOT_SUPPORTED;
2097 }
2098
2099 static int
2100 _ecore_con_ssl_client_read_none(Ecore_Con_Client *cl __UNUSED__,
2101                                 unsigned char *buf   __UNUSED__,
2102                                 int size             __UNUSED__)
2103 {
2104    return -1;
2105 }
2106
2107 static int
2108 _ecore_con_ssl_client_write_none(Ecore_Con_Client *cl __UNUSED__,
2109                                  const unsigned char *buf __UNUSED__,
2110                                  int size             __UNUSED__)
2111 {
2112    return -1;
2113 }
2114
2115 #endif