trustbridge: ui/sslconnection

author	Andre Heinecke <andre.heinecke@intevation.de>
date	Wed, 13 Aug 2014 19:35:08 +0200
parents
children	eaed02defe6a

rev	line source
908 d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1 /* Copyright (C) 2014 by Bundesamt für Sicherheit in der Informationstechnik
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	2 * Software engineering by Intevation GmbH
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	3 *
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	4 * This file is Free Software under the GNU GPL (v>=2)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	5 * and comes with ABSOLUTELY NO WARRANTY!
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	6 * See LICENSE.txt for details.
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	7 */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	8 /* TODO: Wrap ssl_session in a class for reuse.
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	9 * see programs/ssl/ssl_client2.c for example of session reuse */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	10 #include "sslconnection_bare.h"
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	11 #include "sslhelp.h"
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	12
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	13 #include <QFile>
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	14 #include <QUuid>
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	15 #include <QApplication>
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	16
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	17 #define MAX_IO_TRIES 10
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	18 #define MAX_RESETS 10
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	19
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	20 #ifdef CONNECTION_DEBUG
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	21 static void my_debug(void ctx, int level, const char str)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	22 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	23 fprintf((FILE *) ctx, "%s", str);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	24 fflush((FILE *) ctx);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	25 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	26 #endif
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	27
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	28 SSLConnectionBare::SSLConnectionBare(const QString& url,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	29 const QByteArray& certificate):
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	30 SSLConnection (url, certificate)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	31 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	32 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	33
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	34 memset(&mSSL, 0, sizeof(ssl_context));
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	35 memset(&mSavedSession, 0, sizeof( ssl_session ) );
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	36
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	37 if (certificate.isEmpty()) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	38 QFile certResource(":certs/intevation.de");
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	39 certResource.open(QFile::ReadOnly);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	40 mPinnedCert = certResource.readAll();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	41 certResource.close();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	42 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	43
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	44 ret = init();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	45 if (ret == 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	46 mInitialized = true;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	47 } else {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	48 qDebug() << "Initialization error: " + getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	49 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	50 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	51
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	52 int SSLConnectionBare::init()
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	53 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	54 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	55 QUuid uuid = QUuid::createUuid();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	56 QString personalString = QApplication::applicationName() + uuid.toString();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	57 QByteArray personalBa = personalString.toLocal8Bit();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	58
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	59 x509_crt_init(&mX509PinnedCert);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	60 entropy_init(&mEntropy);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	61
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	62 ret = ssl_init(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	63 if (ret != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	64 /* The only documented error is malloc failed */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	65 mErrorState = ErrUnknown;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	66 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	67 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	68
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	69 /*
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	70 * Initialize random generator.
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	71 * Personalisation string, does not need to be random but
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	72 * should be unique according to documentation.
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	73 *
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	74 * the ctr_drbg structure does not need to be freed explicitly.
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	75 */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	76 ret = ctr_drbg_init(&mCtr_drbg, entropy_func, &mEntropy,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	77 (const unsigned char*) personalBa.constData(),
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	78 personalBa.size());
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	79 if (ret != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	80 ssl_free(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	81 mErrorState = ErrUnknown;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	82 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	83 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	84
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	85 ret = x509_crt_parse(&mX509PinnedCert,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	86 (const unsigned char*) mPinnedCert.constData(),
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	87 mPinnedCert.size());
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	88 if (ret != 0){
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	89 ssl_free(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	90 mErrorState = InvalidPinnedCertificate;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	91 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	92 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	93
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	94 ssl_set_endpoint(&mSSL, SSL_IS_CLIENT);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	95 ssl_set_authmode(&mSSL, SSL_VERIFY_OPTIONAL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	96 ssl_set_ca_chain(&mSSL, &mX509PinnedCert, NULL, NULL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	97 ssl_set_renegotiation(&mSSL, SSL_RENEGOTIATION_DISABLED);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	98 ssl_set_rng(&mSSL, ctr_drbg_random, &mCtr_drbg);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	99 #ifdef RELEASE_BUILD
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	100 ssl_set_min_version(&mSSL, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	101 #endif
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	102
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	103 #ifdef CONNECTION_DEBUG
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	104 ssl_set_dbg(&mSSL, my_debug, stdout);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	105 #endif
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	106
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	107 return 0;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	108 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	109
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	110 SSLConnectionBare::~SSLConnectionBare() {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	111 disconnect();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	112 x509_crt_free(&mX509PinnedCert);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	113 entropy_free(&mEntropy);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	114 if (mInitialized) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	115 ssl_free(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	116 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	117 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	118
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	119 void SSLConnectionBare::disconnect() {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	120 if (mConnected) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	121 ssl_close_notify(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	122 if (mServerFD != -1) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	123 net_close(mServerFD);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	124 mServerFD = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	125 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	126 ssl_session_free(&mSavedSession);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	127 mConnected = false;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	128 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	129 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	130
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	131 int SSLConnectionBare::connect() {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	132 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	133
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	134 if (!mInitialized) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	135 mErrorState = ErrUnknown;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	136 return -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	137 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	138
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	139 ret = net_connect(&mServerFD, mUrl.host().toLatin1().constData(),
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	140 mUrl.port(443));
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	141
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	142 if (ret != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	143 qDebug() << "Connect failed: " << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	144 mErrorState = NoConnection;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	145 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	146 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	147
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	148 ssl_set_bio(&mSSL, net_recv, &mServerFD,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	149 net_send, &mServerFD);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	150
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	151 while ((ret = ssl_handshake(&mSSL)) != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	152 if (ret != POLARSSL_ERR_NET_WANT_READ &&
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	153 ret != POLARSSL_ERR_NET_WANT_WRITE) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	154 qDebug() << "SSL Handshake failed: " << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	155 mErrorState = SSLHandshakeFailed;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	156 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	157 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	158 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	159
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	160 ret = ssl_get_session(&mSSL, &mSavedSession);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	161 if (ret != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	162 qDebug() << "SSL get session failed: " << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	163
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	164 mErrorState = NoConnection;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	165 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	166 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	167 printf( " ok\n [ Ciphersuite is %s ]\n",
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	168 ssl_get_ciphersuite( &mSSL) );
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	169 ret = validateCertificate();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	170
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	171 if (ret == 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	172 mConnected = true;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	173 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	174 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	175 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	176
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	177 int SSLConnectionBare::validateCertificate()
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	178 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	179 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	180 const x509_crt *peerCert = NULL;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	181
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	182 /* we might want to set the verify function
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	183 * with ssl_set_verify before to archive the
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	184 * certificate pinning. */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	185
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	186 ret = ssl_get_verify_result(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	187
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	188 if (ret != 0 ) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	189 if((ret & BADCERT_EXPIRED) != 0)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	190 qDebug() << "server certificate has expired";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	191 if((ret & BADCERT_REVOKED) != 0)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	192 qDebug() << "server certificate has been revoked";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	193 if((ret & BADCERT_CN_MISMATCH) != 0)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	194 qDebug() << "CN mismatch";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	195 if((ret & BADCERT_NOT_TRUSTED) != 0)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	196 qDebug() << "self-signed or not signed by a trusted CA";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	197 ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	198 #ifdef RELEASE_BUILD
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	199 mErrorState = InvalidCertificate;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	200 return -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	201 #endif
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	202 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	203
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	204 peerCert = ssl_get_peer_cert(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	205
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	206 if (!peerCert) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	207 mErrorState = InvalidCertificate;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	208 qDebug() << "Failed to get peer cert";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	209 return -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	210 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	211
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	212 if (peerCert->raw.len == 0 \|\|
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	213 peerCert->raw.len != mX509PinnedCert.raw.len) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	214 mErrorState = InvalidCertificate;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	215 qDebug() << "Certificate length mismatch";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	216 return -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	217 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	218
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	219 /* You can never be sure what those c++ operators do..
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	220 if (mPinnedCert != QByteArray::fromRawData(
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	221 (const char*) peerCert->raw.p,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	222 peerCert->raw.len)) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	223 qDebug() << "Certificate content mismatch";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	224 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	225 */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	226
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	227 for (unsigned int i = 0; i < peerCert->raw.len; i++) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	228 if (peerCert->raw.p[i] != mX509PinnedCert.raw.p[i]) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	229 qDebug() << "Certificate content mismatch";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	230 mErrorState = InvalidCertificate;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	231 return -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	232 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	233 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	234 return 0;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	235 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	236
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	237 int SSLConnectionBare::write (const QByteArray& request)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	238 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	239 unsigned int tries = 0;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	240 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	241
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	242 const unsigned char buf = (const unsigned char ) request.constData();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	243 size_t len = (size_t) request.size();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	244
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	245 if (mNeedsReset) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	246 ret = reset();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	247 if (ret != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	248 qDebug() << "Reset failed: " << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	249 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	250 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	251 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	252
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	253 qDebug() << "Sending request: " << request;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	254 /* According to doc for ssl_write:
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	255 *
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	256 * When this function returns POLARSSL_ERR_NET_WANT_WRITE,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	257 * it must be called later with the same arguments,
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	258 * until it returns a positive value.
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	259 */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	260 do {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	261 ret = ssl_write(&mSSL, buf, len);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	262 if (ret >= 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	263 if ((unsigned int) ret == len) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	264 return 0;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	265 } else {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	266 qDebug() << "Write failed to write everything";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	267 return -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	268 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	269 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	270 if (ret != POLARSSL_ERR_NET_WANT_WRITE &&
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	271 ret != POLARSSL_ERR_NET_WANT_READ) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	272 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	273 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	274 tries++;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	275 net_usleep(100000); /* sleep 100ms to give the socket a chance
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	276 to clean up. */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	277 } while (tries < MAX_IO_TRIES);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	278
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	279 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	280 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	281
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	282
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	283 int SSLConnectionBare::reset()
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	284 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	285 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	286 ssl_close_notify(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	287
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	288 ret = ssl_session_reset(&mSSL);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	289 if (ret != 0)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	290 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	291 qDebug() << "SSL Connection reset failed: "
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	292 << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	293 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	294 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	295
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	296 ssl_set_session(&mSSL, &mSavedSession);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	297
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	298 ret = net_connect(&mServerFD, mUrl.host().toLatin1().constData(),
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	299 mUrl.port(443));
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	300
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	301 if (ret != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	302 mErrorState = NoConnection;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	303 qDebug() << "Connection failed." << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	304 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	305 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	306
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	307 while ((ret = ssl_handshake(&mSSL)) != 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	308 if (ret != POLARSSL_ERR_NET_WANT_READ &&
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	309 ret != POLARSSL_ERR_NET_WANT_WRITE) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	310 qDebug() << "SSL Handshake failed: "
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	311 << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	312 mErrorState = SSLHandshakeFailed;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	313 return ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	314 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	315 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	316
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	317 qDebug() << "Reset connection. ";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	318 /* Validation should not be necessary as we reused a saved
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	319 * session. But just to be sure. */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	320 return validateCertificate();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	321 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	322
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	323 QByteArray SSLConnectionBare::read(size_t len)
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	324 {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	325 unsigned char buf[len];
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	326 QByteArray retval("");
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	327 int ret = -1;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	328 unsigned int tries = 0;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	329
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	330 mNeedsReset = true;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	331 do {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	332 memset (buf, 0, sizeof(buf));
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	333 ret = ssl_read(&mSSL, buf, len);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	334 if (ret == 0 \|\|
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	335 ret == POLARSSL_ERR_SSL_CONN_EOF \|\|
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	336 ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	337 /* EOF */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	338 return retval;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	339 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	340 if (ret == POLARSSL_ERR_NET_WANT_WRITE \|\|
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	341 ret == POLARSSL_ERR_NET_WANT_READ) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	342 net_usleep(100000); /* sleep 100ms to give the socket a chance
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	343 to recover */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	344 tries++;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	345 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	346 if (ret <= 0) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	347 qDebug() << "Read failed: " << getPolarSSLErrorMsg(ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	348 return QByteArray();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	349 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	350 if (len < (len - (unsigned int) ret)) {
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	351 /* Should never happen if ssl_read behaves */
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	352 qDebug() << "integer overflow in polarSSLRead";
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	353 return QByteArray();
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	354 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	355 len -= (unsigned int) ret;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	356 retval.append((const char *)buf, ret);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	357 } while (len > 0 && tries < MAX_IO_TRIES);
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	358
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	359 return retval;
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	360 }
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	361
d1c951b3012d Curl based implementation of sslconnection Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	362

908

d1c951b3012d Curl based implementation of sslconnection