openssl-support.diff

   1 After applying this patch, run these commands for a successful build:
   2
   3     ./prepare-source
   4     ./configure
   5     make
   6
   7 Casey Marshall writes:
   8
   9 I've been hacking together a way to use rsync with OpenSSL, and have
  10 attached my current patch against a recent CVS tree. The details of
  11 this implementation are:
  12
  13   1. The SSL code is added as a "layer" that is forked into its own
  14      process.
  15
  16   2. An SSL connection is established by the client issuing the
  17      command:
  18
  19        #starttls
  20
  21      And, if the daemon allows SSL, it replies with
  22
  23        @RSYNCD: starttls
  24
  25      At which point both sides begin negotiating the SSL connection.
  26      Servers that can't or don't want to use SSL just treat it as a
  27      normal unknown command.
  28
  29   3. The SSL code is meant to be unobtrusive, and when this patch is
  30      applied the program may still be built with no SSL code.
  31
  32   4. There are a number of details not implemented.
  33
  34 All warnings apply; I don't do C programming all that often, so I
  35 can't say if I've left any cleanup/compatibility errors in the code.
  36
  37
  38 --- old/Makefile.in
  39 +++ new/Makefile.in
  40 @@ -39,7 +39,7 @@ OBJS3=progress.o pipe.o
  41  DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o
  42  popt_OBJS=popt/findme.o  popt/popt.o  popt/poptconfig.o \
  43         popt/popthelp.o popt/poptparse.o
  44 -OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) $(ZLIBOBJ) @BUILD_POPT@
  45 +OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) $(ZLIBOBJ) @BUILD_POPT@ @SSL_OBJS@
  46
  47  TLS_OBJ = tls.o syscall.o lib/compat.o lib/snprintf.o lib/permstring.o
  48
  49 --- old/cleanup.c
  50 +++ new/cleanup.c
  51 @@ -26,6 +26,9 @@
  52  extern int am_server;
  53  extern int am_daemon;
  54  extern int io_error;
  55 +#ifdef HAVE_OPENSSL
  56 +extern int use_ssl;
  57 +#endif
  58  extern int keep_partial;
  59  extern int log_got_error;
  60  extern char *partial_dir;
  61 @@ -117,6 +120,14 @@ NORETURN void _exit_cleanup(int code, co
  62                                 code, file, line);
  63                 }
  64
  65 +#ifdef HAVE_OPENSSL
  66 +               /* FALLTHROUGH */
  67 +#include "case_N.h"
  68 +
  69 +               if (use_ssl)
  70 +                       end_tls();
  71 +#endif
  72 +
  73                 /* FALLTHROUGH */
  74  #include "case_N.h"
  75
  76 --- old/clientserver.c
  77 +++ new/clientserver.c
  78 @@ -29,6 +29,9 @@ extern int am_sender;
  79  extern int am_server;
  80  extern int am_daemon;
  81  extern int am_root;
  82 +#ifdef HAVE_OPENSSL
  83 +extern int use_ssl;
  84 +#endif
  85  extern int rsync_port;
  86  extern int kluge_around_eof;
  87  extern int daemon_over_rsh;
  88 @@ -105,8 +108,18 @@ int start_socket_client(char *host, char
  89         set_socket_options(fd, sockopts);
  90
  91         ret = start_inband_exchange(user, path, fd, fd, argc);
  92 +       if (ret)
  93 +               return ret;
  94 +
  95 +#ifdef HAVE_OPENSSL
  96 +       if (use_ssl) {
  97 +               int f_in = get_tls_rfd();
  98 +               int f_out = get_tls_wfd();
  99 +               return client_run(f_in, f_out, -1, argc, argv);
 100 +       }
 101 +#endif
 102
 103 -       return ret ? ret : client_run(fd, fd, -1, argc, argv);
 104 +       return client_run(fd, fd, -1, argc, argv);
 105  }
 106
 107  int start_inband_exchange(char *user, char *path, int f_in, int f_out,
 108 @@ -167,6 +180,33 @@ int start_inband_exchange(char *user, ch
 109         if (verbose > 1)
 110                 print_child_argv(sargs);
 111
 112 +#ifdef HAVE_OPENSSL
 113 +       if (use_ssl) {
 114 +               io_printf(f_out, "#starttls\n");
 115 +               while (1) {
 116 +                       if (!read_line(f_in, line, sizeof(line)-1)) {
 117 +                               rprintf(FERROR, "rsync: did not receive reply to #starttls\n");
 118 +                               return -1;
 119 +                       }
 120 +                       if (strncmp(line, "@ERROR", 6) == 0) {
 121 +                               rprintf(FERROR, "%s\n", line);
 122 +                               return -1;
 123 +                       }
 124 +                       if (strcmp(line, "@RSYNCD: starttls") == 0) {
 125 +                               break;
 126 +                       }
 127 +                       rprintf(FINFO, "%s\n", line);
 128 +               }
 129 +               if (start_tls(f_in, f_out)) {
 130 +                       rprintf(FERROR, "rsync: error during SSL handshake: %s\n",
 131 +                               get_ssl_error());
 132 +                       return -1;
 133 +               }
 134 +               f_in = get_tls_rfd();
 135 +               f_out = get_tls_wfd();
 136 +       }
 137 +#endif
 138 +
 139         p = strchr(path,'/');
 140         if (p) *p = 0;
 141         io_printf(f_out, "%s\n", path);
 142 @@ -195,6 +235,10 @@ int start_inband_exchange(char *user, ch
 143                          * server to terminate the listing of modules.
 144                          * We don't want to go on and transfer
 145                          * anything; just exit. */
 146 +#ifdef HAVE_OPENSSL
 147 +                       if (use_ssl)
 148 +                               end_tls();
 149 +#endif
 150                         exit(0);
 151                 }
 152
 153 @@ -202,6 +246,10 @@ int start_inband_exchange(char *user, ch
 154                         rprintf(FERROR, "%s\n", line);
 155                         /* This is always fatal; the server will now
 156                          * close the socket. */
 157 +#ifdef HAVE_OPENSSL
 158 +                       if (use_ssl)
 159 +                               end_tls();
 160 +#endif
 161                         return -1;
 162                 }
 163
 164 @@ -718,6 +766,7 @@ static void send_listing(int fd)
 165                 io_printf(fd,"@RSYNCD: EXIT\n");
 166  }
 167
 168 +
 169  /* this is called when a connection is established to a client
 170     and we want to start talking. The setup of the system is done from
 171     here */
 172 @@ -776,6 +825,9 @@ int start_daemon(int f_in, int f_out)
 173         if (protocol_version > remote_protocol)
 174                 protocol_version = remote_protocol;
 175
 176 +#ifdef HAVE_OPENSSL
 177 +retry:
 178 +#endif
 179         line[0] = 0;
 180         if (!read_line(f_in, line, sizeof line - 1))
 181                 return -1;
 182 @@ -787,6 +839,20 @@ int start_daemon(int f_in, int f_out)
 183                 return -1;
 184         }
 185
 186 +#ifdef HAVE_OPENSSL
 187 +       if (use_ssl && strcmp(line, "#starttls") == 0) {
 188 +               io_printf(f_out, "@RSYNCD: starttls\n");
 189 +               if (start_tls(f_in, f_out)) {
 190 +                       rprintf(FLOG, "SSL connection failed: %s\n",
 191 +                               get_ssl_error());
 192 +                       return -1;
 193 +               }
 194 +               f_in = get_tls_rfd();
 195 +               f_out = get_tls_wfd();
 196 +               goto retry;
 197 +       }
 198 +#endif
 199 +
 200         if (*line == '#') {
 201                 /* it's some sort of command that I don't understand */
 202                 io_printf(f_out, "@ERROR: Unknown command '%s'\n", line);
 203 --- old/configure.in
 204 +++ new/configure.in
 205 @@ -290,6 +290,21 @@ if test x"$enable_locale" != x"no"; then
 206         AC_DEFINE(CONFIG_LOCALE)
 207  fi
 208
 209 +AC_ARG_ENABLE(openssl,
 210 +              AC_HELP_STRING([--enable-openssl], [compile SSL support with OpenSSL.]))
 211 +
 212 +if test "x$enable_openssl" != xno
 213 +then
 214 +       have_ssl=yes
 215 +       AC_CHECK_LIB(ssl, SSL_library_init, , [have_ssl=no])
 216 +       if test "x$have_ssl" = xyes
 217 +       then
 218 +               AC_DEFINE(HAVE_OPENSSL, 1, [true if you want to use SSL.])
 219 +               SSL_OBJS=ssl.o
 220 +               AC_SUBST(SSL_OBJS)
 221 +       fi
 222 +fi
 223 +
 224  AC_MSG_CHECKING([whether to call shutdown on all sockets])
 225  case $host_os in
 226         *cygwin* ) AC_MSG_RESULT(yes)
 227 --- old/options.c
 228 +++ new/options.c
 229 @@ -172,6 +172,14 @@ int logfile_format_has_o_or_i = 0;
 230  int always_checksum = 0;
 231  int list_only = 0;
 232
 233 +#ifdef HAVE_OPENSSL
 234 +int use_ssl = 0;
 235 +char *ssl_cert_path = NULL;
 236 +char *ssl_key_path = NULL;
 237 +char *ssl_key_passwd = NULL;
 238 +char *ssl_ca_path = NULL;
 239 +#endif
 240 +
 241  #define MAX_BATCH_NAME_LEN 256 /* Must be less than MAXPATHLEN-13 */
 242  char *batch_name = NULL;
 243
 244 @@ -200,6 +208,7 @@ static void print_rsync_version(enum log
 245         char const *hardlinks = "no ";
 246         char const *links = "no ";
 247         char const *ipv6 = "no ";
 248 +       char const *ssl = "no ";
 249         STRUCT_STAT *dumstat;
 250
 251  #ifdef HAVE_SOCKETPAIR
 252 @@ -222,6 +231,10 @@ static void print_rsync_version(enum log
 253         ipv6 = "";
 254  #endif
 255
 256 +#ifdef HAVE_OPENSSL
 257 +       ssl = "";
 258 +#endif
 259 +
 260         rprintf(f, "%s  version %s  protocol version %d\n",
 261                 RSYNC_NAME, RSYNC_VERSION, PROTOCOL_VERSION);
 262         rprintf(f, "Copyright (C) 1996-2006 by Andrew Tridgell, Wayne Davison, and others.\n");
 263 @@ -234,9 +247,9 @@ static void print_rsync_version(enum log
 264         /* Note that this field may not have type ino_t.  It depends
 265          * on the complicated interaction between largefile feature
 266          * macros. */
 267 -       rprintf(f, "              %sinplace, %sIPv6, "
 268 +       rprintf(f, "              %sinplace, %sIPv6, %sSSL, "
 269                 "%d-bit system inums, %d-bit internal inums\n",
 270 -               have_inplace, ipv6,
 271 +               have_inplace, ipv6, ssl,
 272                 (int) (sizeof dumstat->st_ino * 8),
 273                 (int) (sizeof (int64) * 8));
 274  #ifdef MAINTAINER_MODE
 275 @@ -383,6 +396,13 @@ void usage(enum logcode F)
 276    rprintf(F," -4, --ipv4                  prefer IPv4\n");
 277    rprintf(F," -6, --ipv6                  prefer IPv6\n");
 278  #endif
 279 +#ifdef HAVE_OPENSSL
 280 +  rprintf(F,"     --ssl                   allow socket connections to use SSL\n");
 281 +  rprintf(F,"     --ssl-cert=FILE         path to daemon's SSL certificate\n");
 282 +  rprintf(F,"     --ssl-key=FILE          path to daemon's SSL private key\n");
 283 +  rprintf(F,"     --ssl-key-passwd=PASS   password for PEM-encoded private key\n");
 284 +  rprintf(F,"     --ssl-ca-certs=FILE     path to trusted CA certificates\n");
 285 +#endif
 286    rprintf(F,"     --version               print version number\n");
 287    rprintf(F,"(-h) --help                  show this help (-h works with no other options)\n");
 288
 289 @@ -396,7 +416,7 @@ enum {OPT_VERSION = 1000, OPT_DAEMON, OP
 290        OPT_FILTER, OPT_COMPARE_DEST, OPT_COPY_DEST, OPT_LINK_DEST, OPT_HELP,
 291        OPT_INCLUDE, OPT_INCLUDE_FROM, OPT_MODIFY_WINDOW, OPT_MIN_SIZE, OPT_CHMOD,
 292        OPT_READ_BATCH, OPT_WRITE_BATCH, OPT_ONLY_WRITE_BATCH, OPT_MAX_SIZE,
 293 -      OPT_NO_D,
 294 +      OPT_NO_D, OPT_USE_SSL,
 295        OPT_SERVER, OPT_REFUSED_BASE = 9000};
 296
 297  static struct poptOption long_options[] = {
 298 @@ -541,6 +561,13 @@ static struct poptOption long_options[]
 299    {"checksum-seed",    0,  POPT_ARG_INT,    &checksum_seed, 0, 0, 0 },
 300    {"server",           0,  POPT_ARG_NONE,   0, OPT_SERVER, 0, 0 },
 301    {"sender",           0,  POPT_ARG_NONE,   0, OPT_SENDER, 0, 0 },
 302 +#ifdef HAVE_OPENSSL
 303 +  {"ssl",              0,  POPT_ARG_NONE,   0, OPT_USE_SSL, 0, 0},
 304 +  {"ssl-cert",         0,  POPT_ARG_STRING, &ssl_cert_path, OPT_USE_SSL, 0, 0},
 305 +  {"ssl-key",          0,  POPT_ARG_STRING, &ssl_key_path, OPT_USE_SSL, 0, 0},
 306 +  {"ssl-key-passwd",   0,  POPT_ARG_STRING, &ssl_key_passwd, OPT_USE_SSL, 0, 0},
 307 +  {"ssl-ca-certs",     0,  POPT_ARG_STRING, &ssl_ca_path, OPT_USE_SSL, 0, 0},
 308 +#endif
 309    /* All the following options switch us into daemon-mode option-parsing. */
 310    {"config",           0,  POPT_ARG_STRING, 0, OPT_DAEMON, 0, 0 },
 311    {"daemon",           0,  POPT_ARG_NONE,   0, OPT_DAEMON, 0, 0 },
 312 @@ -568,6 +595,13 @@ static void daemon_usage(enum logcode F)
 313    rprintf(F," -4, --ipv4                  prefer IPv4\n");
 314    rprintf(F," -6, --ipv6                  prefer IPv6\n");
 315  #endif
 316 +#ifdef HAVE_OPENSSL
 317 +  rprintf(F,"     --ssl                   allow socket connections to use SSL\n");
 318 +  rprintf(F,"     --ssl-cert=FILE         path to daemon's SSL certificate\n");
 319 +  rprintf(F,"     --ssl-key=FILE          path to daemon's SSL private key\n");
 320 +  rprintf(F,"     --ssl-key-passwd=PASS   password for PEM-encoded private key\n");
 321 +  rprintf(F,"     --ssl-ca-certs=FILE     path to trusted CA certificates\n");
 322 +#endif
 323    rprintf(F,"     --help                  show this help screen\n");
 324
 325    rprintf(F,"\n");
 326 @@ -594,6 +628,13 @@ static struct poptOption long_daemon_opt
 327    {"protocol",         0,  POPT_ARG_INT,    &protocol_version, 0, 0, 0 },
 328    {"server",           0,  POPT_ARG_NONE,   &am_server, 0, 0, 0 },
 329    {"temp-dir",        'T', POPT_ARG_STRING, &tmpdir, 0, 0, 0 },
 330 +#ifdef HAVE_OPENSSL
 331 +  {"ssl",              0,  POPT_ARG_NONE,   0, OPT_USE_SSL, 0, 0},
 332 +  {"ssl-cert",         0,  POPT_ARG_STRING, &ssl_cert_path, OPT_USE_SSL, 0, 0},
 333 +  {"ssl-key",          0,  POPT_ARG_STRING, &ssl_key_path, OPT_USE_SSL, 0, 0},
 334 +  {"ssl-key-passwd",   0,  POPT_ARG_STRING, &ssl_key_passwd, OPT_USE_SSL, 0, 0},
 335 +  {"ssl-ca-certs",     0,  POPT_ARG_STRING, &ssl_ca_path, OPT_USE_SSL, 0, 0},
 336 +#endif
 337    {"verbose",         'v', POPT_ARG_NONE,   0, 'v', 0, 0 },
 338    {"no-verbose",       0,  POPT_ARG_VAL,    &verbose, 0, 0, 0 },
 339    {"no-v",             0,  POPT_ARG_VAL,    &verbose, 0, 0, 0 },
 340 @@ -851,6 +892,12 @@ int parse_arguments(int *argc, const cha
 341                                         verbose++;
 342                                         break;
 343
 344 +#ifdef HAVE_OPENSSL
 345 +                               case OPT_USE_SSL:
 346 +                                       use_ssl = 1;
 347 +                                       break;
 348 +#endif
 349 +
 350                                 default:
 351                                         rprintf(FERROR,
 352                                             "rsync: %s: %s (in daemon mode)\n",
 353 @@ -874,6 +921,17 @@ int parse_arguments(int *argc, const cha
 354                                 exit_cleanup(RERR_SYNTAX);
 355                         }
 356
 357 +#ifdef HAVE_OPENSSL
 358 +                       if (use_ssl) {
 359 +                               if (init_tls()) {
 360 +                                       snprintf(err_buf, sizeof(err_buf),
 361 +                                                "Openssl error: %s\n",
 362 +                                                get_ssl_error());
 363 +                                       return 0;
 364 +                               }
 365 +                       }
 366 +#endif
 367 +
 368                         *argv = poptGetArgs(pc);
 369                         *argc = count_args(*argv);
 370                         am_starting_up = 0;
 371 @@ -1085,6 +1143,12 @@ int parse_arguments(int *argc, const cha
 372                         usage(FINFO);
 373                         exit_cleanup(0);
 374
 375 +#ifdef HAVE_OPENSSL
 376 +               case OPT_USE_SSL:
 377 +                       use_ssl = 1;
 378 +                       break;
 379 +#endif
 380 +
 381                 default:
 382                         /* A large opt value means that set_refuse_options()
 383                          * turned this option off. */
 384 @@ -1361,6 +1425,17 @@ int parse_arguments(int *argc, const cha
 385         if (delay_updates && !partial_dir)
 386                 partial_dir = tmp_partialdir;
 387
 388 +#ifdef HAVE_OPENSSL
 389 +       if (use_ssl) {
 390 +               if (init_tls()) {
 391 +                       snprintf(err_buf, sizeof(err_buf),
 392 +                                "Openssl error: %s\n",
 393 +                                get_ssl_error());
 394 +                       return 0;
 395 +               }
 396 +       }
 397 +#endif
 398 +
 399         if (inplace) {
 400  #ifdef HAVE_FTRUNCATE
 401                 if (partial_dir) {
 402 @@ -1778,10 +1853,27 @@ char *check_for_hostspec(char *s, char *
 403         char *p;
 404         int not_host;
 405         int hostlen;
 406 +       int url_prefix_len = sizeof URL_PREFIX - 1;
 407
 408 -       if (port_ptr && strncasecmp(URL_PREFIX, s, strlen(URL_PREFIX)) == 0) {
 409 +       if (!port_ptr)
 410 +               url_prefix_len = 0;
 411 +       else if (strncasecmp(URL_PREFIX, s, url_prefix_len) != 0) {
 412 +#ifdef HAVE_OPENSSL
 413 +               url_prefix_len = sizeof SSL_URL_PREFIX - 1;
 414 +               if (strncasecmp(SSL_URL_PREFIX, s, url_prefix_len) != 0)
 415 +                       url_prefix_len = 0;
 416 +               else {
 417 +                       if (!use_ssl)
 418 +                               init_tls();
 419 +                       use_ssl = 1;
 420 +               }
 421 +#else
 422 +               url_prefix_len = 0;
 423 +#endif
 424 +       }
 425 +       if (url_prefix_len) {
 426                 char *path;
 427 -               s += strlen(URL_PREFIX);
 428 +               s += url_prefix_len;
 429                 if ((p = strchr(s, '/')) != NULL) {
 430                         hostlen = p - s;
 431                         path = p + 1;
 432 --- old/rsync.h
 433 +++ new/rsync.h
 434 @@ -32,6 +32,7 @@
 435
 436  #define DEFAULT_LOCK_FILE "/var/run/rsyncd.lock"
 437  #define URL_PREFIX "rsync://"
 438 +#define SSL_URL_PREFIX "rsyncs://"
 439
 440  #define BACKUP_SUFFIX "~"
 441
 442 @@ -419,6 +420,11 @@ enum msgcode {
 443  # define SIZEOF_INT64 SIZEOF_OFF_T
 444  #endif
 445
 446 +#ifdef HAVE_OPENSSL
 447 +#include <openssl/ssl.h>
 448 +#include <openssl/err.h>
 449 +#endif
 450 +
 451  /* Starting from protocol version 26, we always use 64-bit
 452   * ino_t and dev_t internally, even if this platform does not
 453   * allow files to have 64-bit inums.  That's because the
 454 --- old/ssl.c
 455 +++ new/ssl.c
 456 @@ -0,0 +1,370 @@
 457 +/* -*- c-file-style: "linux" -*-
 458 + * ssl.c: operations for negotiating SSL rsync connections.
 459 + *
 460 + * Copyright (C) 2003  Casey Marshall <rsdio@metastatic.org>
 461 + *
 462 + * This program is free software; you can redistribute it and/or modify
 463 + * it under the terms of the GNU General Public License as published by
 464 + * the Free Software Foundation; either version 2 of the License, or
 465 + * (at your option) any later version.
 466 + *
 467 + * This program is distributed in the hope that it will be useful,
 468 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 469 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 470 + * GNU General Public License for more details.
 471 + *
 472 + * You should have received a copy of the GNU General Public License
 473 + * along with this program; if not, write to the Free Software
 474 + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 475 + */
 476 +
 477 +#include "rsync.h"
 478 +
 479 +#ifdef HAVE_SYS_SELECT_H
 480 +#include <sys/select.h>
 481 +#else
 482 +#include <sys/time.h>
 483 +#include <sys/types.h>
 484 +#include <unistd.h>
 485 +#endif
 486 +#include <string.h>
 487 +
 488 +#define BUF_SIZE 1024
 489 +
 490 +extern int verbose;
 491 +extern int am_daemon;
 492 +extern int am_server;
 493 +
 494 +extern char *ssl_cert_path;
 495 +extern char *ssl_key_path;
 496 +extern char *ssl_key_passwd;
 497 +extern char *ssl_ca_path;
 498 +
 499 +static SSL_CTX *ssl_ctx;
 500 +static SSL *ssl;
 501 +static int tls_read[2] = { -1, -1 };
 502 +static int tls_write[2] = { -1, -1 };
 503 +static int ssl_running;
 504 +static int ssl_pid = -1;
 505 +
 506 +#ifdef HAVE_SIGACTION
 507 +static struct sigaction sigact;
 508 +#endif
 509 +
 510 +/**
 511 + * A non-interactive callback to be passed to SSL_CTX_set_default_password_cb,
 512 + * which merely copies the value of ssl_key_passwd into buf. This is
 513 + * used for when the private key password is supplied via an option.
 514 + */
 515 +static int default_password_cb(char *buf, int n, UNUSED(int f), UNUSED(void *u))
 516 +{
 517 +       if (ssl_key_passwd == NULL || n < (int)strlen(ssl_key_passwd))
 518 +               return 0;
 519 +       strncpy(buf, ssl_key_passwd, n-1);
 520 +       return strlen(ssl_key_passwd);
 521 +}
 522 +
 523 +/**
 524 + * If verbose, this method traces the status of the SSL handshake.
 525 + */
 526 +static void info_callback(const SSL *ssl, int cb, int val)
 527 +{
 528 +       char buf[128];
 529 +       char *cbs;
 530 +
 531 +       switch (cb) {
 532 +       case SSL_CB_LOOP:
 533 +               cbs = "SSL_CB_LOOP";
 534 +               break;
 535 +       case SSL_CB_EXIT:
 536 +               cbs = "SSL_CB_EXIT";
 537 +               break;
 538 +       case SSL_CB_READ:
 539 +               cbs = "SSL_CB_READ";
 540 +               break;
 541 +       case SSL_CB_WRITE:
 542 +               cbs = "SSL_CB_WRITE";
 543 +               break;
 544 +       case SSL_CB_ALERT:
 545 +               cbs = "SSL_CB_ALERT";
 546 +               break;
 547 +       case SSL_CB_READ_ALERT:
 548 +               cbs = "SSL_CB_READ_ALERT";
 549 +               break;
 550 +       case SSL_CB_WRITE_ALERT:
 551 +               cbs = "SSL_CB_WRITE_ALERT";
 552 +               break;
 553 +       case SSL_CB_ACCEPT_LOOP:
 554 +               cbs = "SSL_CB_ACCEPT_LOOP";
 555 +               break;
 556 +       case SSL_CB_ACCEPT_EXIT:
 557 +               cbs = "SSL_CB_ACCEPT_EXIT";
 558 +               break;
 559 +       case SSL_CB_CONNECT_LOOP:
 560 +               cbs = "SSL_CB_CONNECT_LOOP";
 561 +               break;
 562 +       case SSL_CB_CONNECT_EXIT:
 563 +               cbs = "SSL_CB_CONNECT_EXIT";
 564 +               break;
 565 +       case SSL_CB_HANDSHAKE_START:
 566 +               cbs = "SSL_CB_HANDSHAKE_START";
 567 +               break;
 568 +       case SSL_CB_HANDSHAKE_DONE:
 569 +               cbs = "SSL_CB_HANDSHAKE_DONE";
 570 +               break;
 571 +       default:
 572 +               snprintf(buf, sizeof buf, "??? (%d)", cb);
 573 +               cbs = buf;
 574 +               break;
 575 +       }
 576 +       if (verbose > 2) {
 577 +               rprintf(FLOG, "SSL: info_callback(%p,%s,%d)\n", ssl, cbs, val);
 578 +               if (cb == SSL_CB_HANDSHAKE_DONE) {
 579 +                       SSL_CIPHER_description(SSL_get_current_cipher((SSL*)ssl),
 580 +                                              buf, sizeof buf);
 581 +                       rprintf(FLOG, "SSL: cipher: %s", buf);
 582 +               }
 583 +       }
 584 +}
 585 +
 586 +/**
 587 + * Initializes the SSL context for TLSv1 connections; returns zero on
 588 + * success.
 589 + */
 590 +int init_tls(void)
 591 +{
 592 +       if (ssl_ctx)
 593 +               return 0;
 594 +       SSL_library_init();
 595 +       SSL_load_error_strings();
 596 +       ssl_ctx = SSL_CTX_new(TLSv1_method());
 597 +       if (!ssl_ctx)
 598 +               return 1;
 599 +       SSL_CTX_set_info_callback(ssl_ctx, info_callback);
 600 +
 601 +       /* Sets the certificate sent to the other party. */
 602 +       if (ssl_cert_path != NULL
 603 +           && SSL_CTX_use_certificate_file(ssl_ctx, ssl_cert_path,
 604 +                                           SSL_FILETYPE_PEM) != 1)
 605 +               return 1;
 606 +       /* Set up the simple non-interactive callback if the password
 607 +        * was supplied on the command line. */
 608 +       if (ssl_key_passwd != NULL)
 609 +               SSL_CTX_set_default_passwd_cb(ssl_ctx, default_password_cb);
 610 +       /* Sets the private key that matches the public certificate. */
 611 +       if (ssl_key_path != NULL) {
 612 +               if (SSL_CTX_use_PrivateKey_file(ssl_ctx, ssl_key_path,
 613 +                                               SSL_FILETYPE_PEM) != 1)
 614 +                       return 1;
 615 +               if (SSL_CTX_check_private_key(ssl_ctx) != 1)
 616 +                       return 1;
 617 +       }
 618 +       if (ssl_ca_path != NULL
 619 +           && !SSL_CTX_load_verify_locations(ssl_ctx, ssl_ca_path, NULL))
 620 +               return 1;
 621 +
 622 +       return 0;
 623 +}
 624 +
 625 +/**
 626 + * Returns the error string for the current SSL error, if any.
 627 + */
 628 +char *get_ssl_error(void)
 629 +{
 630 +       return ERR_error_string(ERR_get_error(), NULL);
 631 +}
 632 +
 633 +/**
 634 + * Returns the input file descriptor for the SSL connection.
 635 + */
 636 +int get_tls_rfd(void)
 637 +{
 638 +       return tls_read[0];
 639 +}
 640 +
 641 +/**
 642 + * Returns the output file descriptor for the SSL connection.
 643 + */
 644 +int get_tls_wfd(void)
 645 +{
 646 +       return tls_write[1];
 647 +}
 648 +
 649 +/**
 650 + * Signal handler that ends the SSL connection.
 651 + */
 652 +static RETSIGTYPE tls_sigusr1(int UNUSED(val))
 653 +{
 654 +       if (ssl) {
 655 +               SSL_shutdown(ssl);
 656 +               SSL_free(ssl);
 657 +               ssl = NULL;
 658 +       }
 659 +       ssl_running = 0;
 660 +}
 661 +
 662 +/**
 663 + * Negotiates the TLS connection, creates a socket pair for communicating
 664 + * with the rsync process, then forks into a new process that will handle
 665 + * the communication.
 666 + *
 667 + * 0 is returned on success.
 668 + */
 669 +int start_tls(int f_in, int f_out)
 670 +{
 671 +       int tls_fd;
 672 +       int n = 0, r;
 673 +       unsigned char buf1[BUF_SIZE], buf2[BUF_SIZE];
 674 +       int avail1 = 0, avail2 = 0, write1 = 0, write2 = 0;
 675 +       fd_set rd, wd;
 676 +
 677 +       if (fd_pair(tls_read))
 678 +               return 1;
 679 +       if (fd_pair(tls_write))
 680 +               return 1;
 681 +
 682 +       set_blocking(tls_read[0]);
 683 +       set_blocking(tls_read[1]);
 684 +       set_blocking(tls_write[0]);
 685 +       set_blocking(tls_write[1]);
 686 +       set_blocking(f_in);
 687 +       set_blocking(f_out);
 688 +
 689 +       ssl_pid = do_fork();
 690 +       if (ssl_pid < 0)
 691 +               return -1;
 692 +       if (ssl_pid != 0) {
 693 +               close(tls_write[0]);
 694 +               close(tls_read[1]);
 695 +               return 0;
 696 +       }
 697 +
 698 +       SIGACTION(SIGUSR1, tls_sigusr1);
 699 +       ssl = SSL_new(ssl_ctx);
 700 +       if (!ssl)
 701 +               goto closed;
 702 +       if (am_daemon || am_server)
 703 +               SSL_set_accept_state(ssl);
 704 +       else
 705 +               SSL_set_connect_state(ssl);
 706 +       SSL_set_rfd(ssl, f_in);
 707 +       SSL_set_wfd(ssl, f_out);
 708 +
 709 +       tls_fd = SSL_get_fd(ssl);
 710 +       n = tls_write[0];
 711 +       n = MAX(tls_read[1], n);
 712 +       n = MAX(tls_fd, n) + 1;
 713 +
 714 +       ssl_running = 1;
 715 +       while (ssl_running) {
 716 +               FD_ZERO(&rd);
 717 +               FD_ZERO(&wd);
 718 +               FD_SET(tls_write[0], &rd);
 719 +               FD_SET(tls_read[1], &wd);
 720 +               FD_SET(tls_fd, &rd);
 721 +               FD_SET(tls_fd, &wd);
 722 +
 723 +               r = select(n, &rd, &wd, NULL, NULL);
 724 +
 725 +               if (r == -1 && errno == EINTR)
 726 +                       continue;
 727 +               if (FD_ISSET(tls_write[0], &rd)) {
 728 +                       r = read(tls_write[0], buf1+avail1, BUF_SIZE-avail1);
 729 +                       if (r >= 0)
 730 +                               avail1 += r;
 731 +                       else {
 732 +                               rprintf(FERROR, "pipe read error: %s\n",
 733 +                                       strerror(errno));
 734 +                               break;
 735 +                       }
 736 +               }
 737 +               if (FD_ISSET(tls_fd, &rd)) {
 738 +                       r = SSL_read(ssl, buf2+avail2, BUF_SIZE-avail2);
 739 +                       if (r > 0)
 740 +                               avail2 += r;
 741 +                       else {
 742 +                               switch (SSL_get_error(ssl, r)) {
 743 +                               case SSL_ERROR_ZERO_RETURN:
 744 +                                       goto closed;
 745 +                               case SSL_ERROR_WANT_READ:
 746 +                               case SSL_ERROR_WANT_WRITE:
 747 +                                       break;
 748 +                               case SSL_ERROR_SYSCALL:
 749 +                                       if (r == 0)
 750 +                                               rprintf(FERROR, "SSL spurious EOF\n");
 751 +                                       else
 752 +                                               rprintf(FERROR, "SSL I/O error: %s\n",
 753 +                                                       strerror(errno));
 754 +                                       goto closed;
 755 +                               case SSL_ERROR_SSL:
 756 +                                       rprintf(FERROR, "SSL: %s\n",
 757 +                                               ERR_error_string(ERR_get_error(), NULL));
 758 +                                       goto closed;
 759 +                               default:
 760 +                                       rprintf(FERROR, "unexpected ssl error %d\n", r);
 761 +                                       goto closed;
 762 +                               }
 763 +                       }
 764 +               }
 765 +               if (FD_ISSET(tls_read[1], &wd) && write2 < avail2) {
 766 +                       r = write(tls_read[1], buf2+write2, avail2-write2);
 767 +                       if (r >= 0)
 768 +                               write2 += r;
 769 +                       else {
 770 +                               rprintf(FERROR, "pipe write error: %s\n",
 771 +                                       strerror(errno));
 772 +                               break;
 773 +                       }
 774 +               }
 775 +               if (FD_ISSET(tls_fd, &wd) && write1 < avail1) {
 776 +                       r = SSL_write(ssl, buf1+write1, avail1-write1);
 777 +                       if (r > 0)
 778 +                               write1 += r;
 779 +                       else {
 780 +                               switch (SSL_get_error(ssl, r)) {
 781 +                               case SSL_ERROR_ZERO_RETURN:
 782 +                                       goto closed;
 783 +                               case SSL_ERROR_WANT_READ:
 784 +                               case SSL_ERROR_WANT_WRITE:
 785 +                                       break;
 786 +                               case SSL_ERROR_SYSCALL:
 787 +                                       if (r == 0)
 788 +                                               rprintf(FERROR, "SSL: spurious EOF\n");
 789 +                                       else
 790 +                                               rprintf(FERROR, "SSL: I/O error: %s\n",
 791 +                                                       strerror(errno));
 792 +                                       goto closed;
 793 +                               case SSL_ERROR_SSL:
 794 +                                       rprintf(FERROR, "SSL: %s\n",
 795 +                                               ERR_error_string(ERR_get_error(), NULL));
 796 +                                       goto closed;
 797 +                               default:
 798 +                                       rprintf(FERROR, "unexpected ssl error %d\n", r);
 799 +                                       goto closed;
 800 +                               }
 801 +                       }
 802 +               }
 803 +               if (avail1 == write1)
 804 +                       avail1 = write1 = 0;
 805 +               if (avail2 == write2)
 806 +                       avail2 = write2 = 0;
 807 +       }
 808 +
 809 +       /* XXX I'm pretty sure that there is a lot that I am not considering
 810 +          here. Bugs? Yes, probably. */
 811 +
 812 +       /* We're finished. */
 813 +    closed:
 814 +       close(tls_read[1]);
 815 +       close(tls_write[0]);
 816 +       exit(0);
 817 +}
 818 +
 819 +/**
 820 + * Ends the TLS connection.
 821 + */
 822 +void end_tls(void)
 823 +{
 824 +       if (ssl_pid > 0)
 825 +               kill(ssl_pid, SIGUSR1);
 826 +}