1 /* $NetBSD: tls_proxy_context_scan.c,v 1.2 2020/03/18 19:05:21 christos Exp $ */ 2 3 /*++ 4 /* NAME 5 /* tls_proxy_context_scan 6 /* SUMMARY 7 /* read TLS session state from stream 8 /* SYNOPSIS 9 /* #include <tls_proxy.h> 10 /* 11 /* int tls_proxy_context_scan(scan_fn, stream, flags, ptr) 12 /* ATTR_SCAN_MASTER_FN scan_fn; 13 /* VSTREAM *stream; 14 /* int flags; 15 /* void *ptr; 16 /* 17 /* void tls_proxy_context_free(tls_context) 18 /* TLS_SESS_STATE *tls_context; 19 /* DESCRIPTION 20 /* tls_proxy_context_scan() reads the public members of a 21 /* TLS_ATTR_STATE structure from the named stream using the 22 /* specified attribute scan routine. tls_proxy_context_scan() 23 /* is meant to be passed as a call-back to attr_scan() as shown 24 /* below. 25 /* 26 /* tls_proxy_context_free() destroys a TLS context object that 27 /* was received with tls_proxy_context_scan(). 28 /* 29 /* TLS_ATTR_STATE *tls_context = 0; 30 /* ... 31 /* ... RECV_ATTR_FUNC(tls_proxy_context_scan, (void *) &tls_context), ... 32 /* ... 33 /* if (tls_context) 34 /* tls_proxy_context_free(tls_context); 35 /* DIAGNOSTICS 36 /* Fatal: out of memory. 37 /* LICENSE 38 /* .ad 39 /* .fi 40 /* The Secure Mailer license must be distributed with this software. 41 /* AUTHOR(S) 42 /* Wietse Venema 43 /* IBM T.J. Watson Research 44 /* P.O. Box 704 45 /* Yorktown Heights, NY 10598, USA 46 /* 47 /* Wietse Venema 48 /* Google, Inc. 49 /* 111 8th Avenue 50 /* New York, NY 10011, USA 51 /*--*/ 52 53 #ifdef USE_TLS 54 55 /* System library. */ 56 57 #include <sys_defs.h> 58 59 /* Utility library */ 60 61 #include <attr.h> 62 #include <msg.h> 63 64 /* TLS library. */ 65 66 #include <tls.h> 67 #include <tls_proxy.h> 68 69 /* tls_proxy_context_scan - receive TLS session state from stream */ 70 71 int tls_proxy_context_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp, 72 int flags, void *ptr) 73 { 74 TLS_SESS_STATE *tls_context 75 = (TLS_SESS_STATE *) mymalloc(sizeof(*tls_context));; 76 int ret; 77 VSTRING *peer_CN = vstring_alloc(25); 78 VSTRING *issuer_CN = vstring_alloc(25); 79 VSTRING *peer_cert_fprint = vstring_alloc(60); /* 60 for SHA-1 */ 80 VSTRING *peer_pkey_fprint = vstring_alloc(60); /* 60 for SHA-1 */ 81 VSTRING *protocol = vstring_alloc(25); 82 VSTRING *cipher_name = vstring_alloc(25); 83 VSTRING *kex_name = vstring_alloc(25); 84 VSTRING *kex_curve = vstring_alloc(25); 85 VSTRING *clnt_sig_name = vstring_alloc(25); 86 VSTRING *clnt_sig_curve = vstring_alloc(25); 87 VSTRING *clnt_sig_dgst = vstring_alloc(25); 88 VSTRING *srvr_sig_name = vstring_alloc(25); 89 VSTRING *srvr_sig_curve = vstring_alloc(25); 90 VSTRING *srvr_sig_dgst = vstring_alloc(25); 91 VSTRING *namaddr = vstring_alloc(100); 92 93 if (msg_verbose) 94 msg_info("begin tls_proxy_context_scan"); 95 96 /* 97 * Note: memset() is not a portable way to initialize non-integer types. 98 */ 99 memset(tls_context, 0, sizeof(*tls_context)); 100 ret = scan_fn(fp, flags | ATTR_FLAG_MORE, 101 RECV_ATTR_STR(TLS_ATTR_PEER_CN, peer_CN), 102 RECV_ATTR_STR(TLS_ATTR_ISSUER_CN, issuer_CN), 103 RECV_ATTR_STR(TLS_ATTR_PEER_CERT_FPT, peer_cert_fprint), 104 RECV_ATTR_STR(TLS_ATTR_PEER_PKEY_FPT, peer_pkey_fprint), 105 RECV_ATTR_INT(TLS_ATTR_PEER_STATUS, 106 &tls_context->peer_status), 107 RECV_ATTR_STR(TLS_ATTR_CIPHER_PROTOCOL, protocol), 108 RECV_ATTR_STR(TLS_ATTR_CIPHER_NAME, cipher_name), 109 RECV_ATTR_INT(TLS_ATTR_CIPHER_USEBITS, 110 &tls_context->cipher_usebits), 111 RECV_ATTR_INT(TLS_ATTR_CIPHER_ALGBITS, 112 &tls_context->cipher_algbits), 113 RECV_ATTR_STR(TLS_ATTR_KEX_NAME, kex_name), 114 RECV_ATTR_STR(TLS_ATTR_KEX_CURVE, kex_curve), 115 RECV_ATTR_INT(TLS_ATTR_KEX_BITS, &tls_context->kex_bits), 116 RECV_ATTR_STR(TLS_ATTR_CLNT_SIG_NAME, clnt_sig_name), 117 RECV_ATTR_STR(TLS_ATTR_CLNT_SIG_CURVE, clnt_sig_curve), 118 RECV_ATTR_INT(TLS_ATTR_CLNT_SIG_BITS, &tls_context->clnt_sig_bits), 119 RECV_ATTR_STR(TLS_ATTR_CLNT_SIG_DGST, clnt_sig_dgst), 120 RECV_ATTR_STR(TLS_ATTR_SRVR_SIG_NAME, srvr_sig_name), 121 RECV_ATTR_STR(TLS_ATTR_SRVR_SIG_CURVE, srvr_sig_curve), 122 RECV_ATTR_INT(TLS_ATTR_SRVR_SIG_BITS, &tls_context->srvr_sig_bits), 123 RECV_ATTR_STR(TLS_ATTR_SRVR_SIG_DGST, srvr_sig_dgst), 124 RECV_ATTR_STR(TLS_ATTR_NAMADDR, namaddr), 125 ATTR_TYPE_END); 126 /* Always construct a well-formed structure. */ 127 tls_context->peer_CN = vstring_export(peer_CN); 128 tls_context->issuer_CN = vstring_export(issuer_CN); 129 tls_context->peer_cert_fprint = vstring_export(peer_cert_fprint); 130 tls_context->peer_pkey_fprint = vstring_export(peer_pkey_fprint); 131 tls_context->protocol = vstring_export(protocol); 132 tls_context->cipher_name = vstring_export(cipher_name); 133 tls_context->kex_name = vstring_export(kex_name); 134 tls_context->kex_curve = vstring_export(kex_curve); 135 tls_context->clnt_sig_name = vstring_export(clnt_sig_name); 136 tls_context->clnt_sig_curve = vstring_export(clnt_sig_curve); 137 tls_context->clnt_sig_dgst = vstring_export(clnt_sig_dgst); 138 tls_context->srvr_sig_name = vstring_export(srvr_sig_name); 139 tls_context->srvr_sig_curve = vstring_export(srvr_sig_curve); 140 tls_context->srvr_sig_dgst = vstring_export(srvr_sig_dgst); 141 tls_context->namaddr = vstring_export(namaddr); 142 ret = (ret == 21 ? 1 : -1); 143 if (ret != 1) { 144 tls_proxy_context_free(tls_context); 145 tls_context = 0; 146 } 147 *(TLS_SESS_STATE **) ptr = tls_context; 148 if (msg_verbose) 149 msg_info("tls_proxy_context_scan ret=%d", ret); 150 return (ret); 151 } 152 153 /* tls_proxy_context_free - destroy object from tls_proxy_context_receive() */ 154 155 void tls_proxy_context_free(TLS_SESS_STATE *tls_context) 156 { 157 if (tls_context->peer_CN) 158 myfree(tls_context->peer_CN); 159 if (tls_context->issuer_CN) 160 myfree(tls_context->issuer_CN); 161 if (tls_context->peer_cert_fprint) 162 myfree(tls_context->peer_cert_fprint); 163 if (tls_context->peer_pkey_fprint) 164 myfree(tls_context->peer_pkey_fprint); 165 if (tls_context->protocol) 166 myfree((void *) tls_context->protocol); 167 if (tls_context->cipher_name) 168 myfree((void *) tls_context->cipher_name); 169 if (tls_context->kex_name) 170 myfree((void *) tls_context->kex_name); 171 if (tls_context->kex_curve) 172 myfree((void *) tls_context->kex_curve); 173 if (tls_context->clnt_sig_name) 174 myfree((void *) tls_context->clnt_sig_name); 175 if (tls_context->clnt_sig_curve) 176 myfree((void *) tls_context->clnt_sig_curve); 177 if (tls_context->clnt_sig_dgst) 178 myfree((void *) tls_context->clnt_sig_dgst); 179 if (tls_context->srvr_sig_name) 180 myfree((void *) tls_context->srvr_sig_name); 181 if (tls_context->srvr_sig_curve) 182 myfree((void *) tls_context->srvr_sig_curve); 183 if (tls_context->srvr_sig_dgst) 184 myfree((void *) tls_context->srvr_sig_dgst); 185 if (tls_context->namaddr) 186 myfree((void *) tls_context->namaddr); 187 myfree((void *) tls_context); 188 } 189 190 #endif 191