diff options
Diffstat (limited to 'plugins/ice')
| -rw-r--r-- | plugins/ice/meson.build | 13 | ||||
| -rw-r--r-- | plugins/ice/src/dtls_srtp.vala | 146 | ||||
| -rw-r--r-- | plugins/ice/src/dtls_srtp_gnutls.vala | 245 | ||||
| -rw-r--r-- | plugins/ice/src/dtls_srtp_openssl.vala | 202 | ||||
| -rw-r--r-- | plugins/ice/src/module.vala | 4 | ||||
| -rw-r--r-- | plugins/ice/src/openssl_utils.c | 49 | ||||
| -rw-r--r-- | plugins/ice/src/openssl_utils.h | 8 | ||||
| -rw-r--r-- | plugins/ice/src/transport_parameters.vala | 2 | ||||
| -rw-r--r-- | plugins/ice/vapi/gnutls.vapi | 420 | ||||
| -rw-r--r-- | plugins/ice/vapi/openssl.vapi | 218 |
10 files changed, 5 insertions, 1302 deletions
diff --git a/plugins/ice/meson.build b/plugins/ice/meson.build index 99f8e6a1..19030259 100644 --- a/plugins/ice/meson.build +++ b/plugins/ice/meson.build @@ -8,7 +8,6 @@ dependencies = [ dep_xmpp_vala, ] sources = files( - 'src/dtls_srtp.vala', 'src/module.vala', 'src/plugin.vala', 'src/transport_parameters.vala', @@ -21,18 +20,6 @@ c_args = vala_c_args + [ vala_args = [ '--vapidir', meson.current_source_dir() / 'vapi', ] -if crypto_backend == 'gnu' - dependencies += [ dep_gnutls ] - sources += files( - 'src/dtls_srtp_gnutls.vala' - ) -elif crypto_backend == 'openssl' - dependencies += [ dep_openssl ] - sources += files( - 'src/dtls_srtp_openssl.vala', - 'src/openssl_utils.c', - ) -endif lib_ice = shared_library('ice', sources, name_prefix: '', c_args: c_args, vala_args: vala_args, include_directories: include_directories('src'), dependencies: dependencies, install: true, install_dir: get_option('libdir') / get_option('plugindir'), install_rpath: default_install_rpath) dep_ice = declare_dependency(link_with: lib_ice, include_directories: include_directories('.')) summary('Peer-to-peer communication (ice)', dep_ice.found(), bool_yn: true, section: 'Plugins') diff --git a/plugins/ice/src/dtls_srtp.vala b/plugins/ice/src/dtls_srtp.vala deleted file mode 100644 index 41918359..00000000 --- a/plugins/ice/src/dtls_srtp.vala +++ /dev/null @@ -1,146 +0,0 @@ -namespace Dino.Plugins.Ice.DtlsSrtp { - -public abstract class CredentialsCapsule : Object { - public uint8[] own_fingerprint; -} - -public abstract class AbstractHandler { - - public signal void send_data(uint8[] data); - - public bool ready { get { - return srtp_session.has_encrypt && srtp_session.has_decrypt; - }} - - public Mode mode { get; set; default = Mode.CLIENT; } - public uint8[] own_fingerprint { get; private set; } - public uint8[] peer_fingerprint { get; set; } - public string peer_fp_algo { get; set; } - - protected CredentialsCapsule credentials; - protected Cond buffer_cond = Cond(); - protected Mutex buffer_mutex = Mutex(); - protected Gee.LinkedList<Bytes> buffer_queue = new Gee.LinkedList<Bytes>(); - - protected bool running = false; - protected bool stop = false; - protected bool restart = false; - - protected Crypto.Srtp.Session srtp_session = new Crypto.Srtp.Session(); - - protected AbstractHandler.with_cert(CredentialsCapsule creds) { - this.credentials = creds; - this.own_fingerprint = creds.own_fingerprint; - } - - public uint8[]? process_incoming_data(uint component_id, uint8[] data) throws Crypto.Error { - if (data[0] >= 128) { - if (!srtp_session.has_decrypt) { - debug("Received data before SRTP session is ready, dropping."); - return null; - } - if (component_id == 1) { - if (data.length >= 2 && data[1] >= 192 && data[1] < 224) { - return srtp_session.decrypt_rtcp(data); - } - return srtp_session.decrypt_rtp(data); - } - if (component_id == 2) return srtp_session.decrypt_rtcp(data); - } - if (component_id == 1 && data.length >= 1 && (data[0] >= 20 && data[0] < 64)) { - on_data_rec(data); - return null; - } - debug("Dropping unknown data from component %u", component_id); - return null; - } - - public uint8[]? process_outgoing_data(uint component_id, uint8[] data) throws Crypto.Error { - if (srtp_session.has_encrypt) { - if (component_id == 1) { - if (data.length >= 2 && data[1] >= 192 && data[1] < 224) { - return srtp_session.encrypt_rtcp(data); - } - return srtp_session.encrypt_rtp(data); - } - if (component_id == 2) return srtp_session.encrypt_rtcp(data); - } - return null; - } - - public void on_data_rec(owned uint8[] data) { - buffer_mutex.lock(); - buffer_queue.add(new Bytes.take(data)); - buffer_cond.signal(); - buffer_mutex.unlock(); - } - - public void stop_dtls_connection() { - buffer_mutex.lock(); - stop = true; - buffer_cond.signal(); - buffer_mutex.unlock(); - } - - protected Bytes get_buffer_if_present () { - buffer_mutex.lock(); - if (buffer_queue.size == 0) { - buffer_mutex.unlock(); - return null; - } - Bytes res = buffer_queue.remove_at(0); - buffer_mutex.unlock(); - return res; - } - - public async Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection() { - MainContext context = MainContext.current_source().get_context(); - var thread = new Thread<Xmpp.Xep.Jingle.ContentEncryption>("dtls-connection", () => { - // Check we can start working on the thread - buffer_mutex.lock(); - if (stop) { - restart = true; - buffer_mutex.unlock(); - return null; - } - if (running || ready) { - buffer_mutex.unlock(); - return null; - } - running = true; - restart = false; - buffer_mutex.unlock(); - - // Actual work - var res = setup_dtls_connection_thread(); - - // Callback - Source source = new IdleSource(); - source.set_callback(setup_dtls_connection.callback); - source.attach(context); - return res; - }); - yield; - return thread.join(); - } - - protected abstract Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread(); -} - -private string format_fingerprint(uint8[] fingerprint) { - var sb = new StringBuilder(); - for (int i = 0; i < fingerprint.length; i++) { - sb.append("%02X".printf(fingerprint[i])); - if (i < fingerprint.length - 1) { - sb.append(":"); - } - } - return sb.str; -} - - -public enum Mode { - CLIENT, SERVER -} - -} diff --git a/plugins/ice/src/dtls_srtp_gnutls.vala b/plugins/ice/src/dtls_srtp_gnutls.vala deleted file mode 100644 index 91a7cfb2..00000000 --- a/plugins/ice/src/dtls_srtp_gnutls.vala +++ /dev/null @@ -1,245 +0,0 @@ -using GnuTLS; - -namespace Dino.Plugins.Ice.DtlsSrtp { - -public class CredentialsCapsuleGnuTLS : CredentialsCapsule { - public X509.Certificate[] own_cert; - public X509.PrivateKey private_key; -} - -private uint8[] get_fingerprint(X509.Certificate certificate, DigestAlgorithm digest_algo) { - uint8[] buf = new uint8[512]; - size_t buf_out_size = 512; - certificate.get_fingerprint(digest_algo, buf, ref buf_out_size); - - uint8[] ret = new uint8[buf_out_size]; - for (int i = 0; i < buf_out_size; i++) { - ret[i] = buf[i]; - } - return ret; -} - -internal CredentialsCapsule generate_credentials () throws GLib.Error { - int err = 0; - - X509.PrivateKey private_key = X509.PrivateKey.create (); - err = private_key.generate (PKAlgorithm.ECDSA, 256); - throw_if_error (err); - - var start_time = new DateTime.now_local().add_days(-1); - var end_time = start_time.add_days (2); - - X509.Certificate cert = X509.Certificate.create (); - cert.set_key (private_key); - cert.set_version (1); - cert.set_activation_time ((time_t) start_time.to_unix ()); - cert.set_expiration_time ((time_t) end_time.to_unix ()); - - uint32 serial = 1; - cert.set_serial (&serial, sizeof(uint32)); - - cert.sign (cert, private_key); - - uint8[] own_fingerprint = get_fingerprint (cert, DigestAlgorithm.SHA256); - X509.Certificate[] own_cert = new X509.Certificate[] { (owned)cert }; - - var creds = new CredentialsCapsuleGnuTLS(); - creds.own_fingerprint = own_fingerprint; - creds.own_cert = (owned) own_cert; - creds.private_key = (owned) private_key; - - return creds; -} - -public class Handler : AbstractHandler { - - public Handler.with_cert(CredentialsCapsule creds) { - base.with_cert(creds); - } - - protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread() { - InitFlags server_or_client = mode == Mode.SERVER ? InitFlags.SERVER : InitFlags.CLIENT; - debug("Setting up DTLS connection using GnuTLS. We're %s", mode.to_string()); - - CertificateCredentials cert_cred = CertificateCredentials.create(); - int err = cert_cred.set_x509_key(((CredentialsCapsuleGnuTLS)credentials).own_cert, ((CredentialsCapsuleGnuTLS)credentials).private_key); - throw_if_error(err); - - Session? session = Session.create(server_or_client | InitFlags.DATAGRAM); - session.enable_heartbeat(1); - session.set_srtp_profile_direct("SRTP_AES128_CM_HMAC_SHA1_80"); - session.set_credentials(GnuTLS.CredentialsType.CERTIFICATE, cert_cred); - session.server_set_request(CertificateRequest.REQUEST); - session.set_priority_from_string("NORMAL:!VERS-TLS-ALL:+VERS-DTLS-ALL:+CTYPE-CLI-X509"); - - session.set_transport_pointer(this); - session.set_pull_function(pull_function); - session.set_pull_timeout_function(pull_timeout_function); - session.set_push_function(push_function); - session.set_verify_function(verify_function); - - DateTime maximum_time = new DateTime.now_utc().add_seconds(20); - do { - err = session.handshake(); - - DateTime current_time = new DateTime.now_utc(); - if (maximum_time.compare(current_time) < 0) { - warning("DTLS handshake timeouted"); - err = ErrorCode.APPLICATION_ERROR_MIN + 1; - break; - } - if (stop) { - debug("DTLS handshake stopped"); - err = ErrorCode.APPLICATION_ERROR_MIN + 2; - break; - } - } while (err < 0 && !((ErrorCode)err).is_fatal()); - - buffer_mutex.lock(); - if (stop) { - stop = false; - running = false; - bool restart = restart; - buffer_mutex.unlock(); - if (restart) { - debug("Restarting DTLS handshake"); - return setup_dtls_connection_thread(); - } - return null; - } - buffer_mutex.unlock(); - if (err != ErrorCode.SUCCESS) { - warning("DTLS handshake failed: %s", ((ErrorCode)err).to_string()); - return null; - } - - uint8[] km = new uint8[150]; - Datum? client_key, client_salt, server_key, server_salt; - session.get_srtp_keys(km, km.length, out client_key, out client_salt, out server_key, out server_salt); - if (client_key == null || client_salt == null || server_key == null || server_salt == null) { - warning("SRTP client/server key/salt null"); - } - - debug("Finished DTLS connection. We're %s", mode.to_string()); - if (mode == Mode.SERVER) { - srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract()); - srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract()); - } else { - srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract()); - srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract()); - } - return new Xmpp.Xep.Jingle.ContentEncryption(Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint); - } - - private static ssize_t pull_function(void* transport_ptr, uint8[] buffer) { - Handler self = transport_ptr as Handler; - - self.buffer_mutex.lock(); - while (self.buffer_queue.size == 0) { - self.buffer_cond.wait(self.buffer_mutex); - if (self.stop) { - self.buffer_mutex.unlock(); - debug("DTLS handshake pull_function stopped"); - return -1; - } - } - Bytes data = self.buffer_queue.remove_at(0); - self.buffer_mutex.unlock(); - - uint8[] data_uint8 = Bytes.unref_to_data((owned) data); - Memory.copy(buffer, data_uint8, data_uint8.length); - - // The callback should return 0 on connection termination, a positive number indicating the number of bytes received, and -1 on error. - return (ssize_t)data_uint8.length; - } - - private static int pull_timeout_function(void* transport_ptr, uint ms) { - Handler self = transport_ptr as Handler; - - int64 end_time = get_monotonic_time() + ms * 1000; - - self.buffer_mutex.lock(); - while (self.buffer_queue.size == 0) { - self.buffer_cond.wait_until(self.buffer_mutex, end_time); - if (self.stop) { - self.buffer_mutex.unlock(); - debug("DTLS handshake pull_timeout_function stopped"); - return -1; - } - - if (get_monotonic_time() > end_time) { - self.buffer_mutex.unlock(); - return 0; - } - } - self.buffer_mutex.unlock(); - - // The callback should return 0 on timeout, a positive number if data can be received, and -1 on error. - return 1; - } - - private static ssize_t push_function(void* transport_ptr, uint8[] buffer) { - Handler self = transport_ptr as Handler; - self.send_data(buffer); - - // The callback should return a positive number indicating the bytes sent, and -1 on error. - return (ssize_t)buffer.length; - } - - private static int verify_function(Session session) { - Handler self = session.get_transport_pointer() as Handler; - try { - bool valid = self.verify_peer_cert(session); - if (!valid) { - warning("DTLS certificate invalid. Aborting handshake."); - return 1; - } - } catch (Error e) { - warning("Error during DTLS certificate validation: %s. Aborting handshake.", e.message); - return 1; - } - - // The callback function should return 0 for the handshake to continue or non-zero to terminate. - return 0; - } - - private bool verify_peer_cert(Session session) throws GLib.Error { - unowned Datum[] cert_datums = session.get_peer_certificates(); - if (cert_datums.length == 0) { - warning("No peer certs"); - return false; - } - if (cert_datums.length > 1) warning("More than one peer cert"); - - X509.Certificate peer_cert = X509.Certificate.create(); - peer_cert.import(ref cert_datums[0], CertificateFormat.DER); - - DigestAlgorithm algo; - switch (peer_fp_algo) { - case "sha-256": - algo = DigestAlgorithm.SHA256; - break; - default: - warning("Unkown peer fingerprint algorithm: %s", peer_fp_algo); - return false; - } - - uint8[] real_peer_fp = get_fingerprint(peer_cert, algo); - - if (real_peer_fp.length != this.peer_fingerprint.length) { - warning("Fingerprint lengths not equal %i vs %i", real_peer_fp.length, peer_fingerprint.length); - return false; - } - - for (int i = 0; i < real_peer_fp.length; i++) { - if (real_peer_fp[i] != this.peer_fingerprint[i]) { - warning("First cert in peer cert list doesn't equal advertised one: %s vs %s", format_fingerprint(real_peer_fp), format_fingerprint(peer_fingerprint)); - return false; - } - } - - return true; - } -} - -}
\ No newline at end of file diff --git a/plugins/ice/src/dtls_srtp_openssl.vala b/plugins/ice/src/dtls_srtp_openssl.vala deleted file mode 100644 index 86f080e5..00000000 --- a/plugins/ice/src/dtls_srtp_openssl.vala +++ /dev/null @@ -1,202 +0,0 @@ -using OpenSSL; - -namespace Dino.Plugins.Ice.DtlsSrtp { - -public class CredentialsCapsuleOpenSSL : CredentialsCapsule { - public X509.Certificate own_cert; - public EVP.Key private_key; -} - -internal CredentialsCapsule generate_credentials () throws GLib.Error { - EVP.Key key = new EVP.Key.generate_ecdsa ("prime256v1"); - - var start_time = new DateTime.now_local().add_days(-1); - var end_time = start_time.add_days (2); - - X509.Certificate cert = new X509.Certificate (); - cert.set_public_key (key); - cert.set_version (1); - cert.not_before.set ((time_t) start_time.to_unix ()); - cert.not_after.set ((time_t) end_time.to_unix ()); - cert.serial_number.set (1); - - cert.sign (key, EVP.sha256 ()); - - CredentialsCapsuleOpenSSL credentials = new CredentialsCapsuleOpenSSL (); - credentials.own_fingerprint = cert.digest (EVP.sha256 ()); - credentials.own_cert = (owned) cert; - credentials.private_key = (owned) key; - return credentials; -} - -public class Handler : AbstractHandler { - - public Handler.with_cert (CredentialsCapsule creds) { - base.with_cert (creds); - } - - protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread () { - debug("Setting up DTLS connection using OpenSSL. We're %s", mode.to_string()); - SSL.Context context = new SSL.Context (mode == Mode.SERVER ? SSL.Method.DTLS_SERVER : SSL.Method.DTLS_CLIENT); - context.set_tlsext_use_srtp ("SRTP_AES128_CM_SHA1_80"); - context.use_certificate (((CredentialsCapsuleOpenSSL) credentials).own_cert); - context.use_private_key (((CredentialsCapsuleOpenSSL) credentials).private_key); - SSL session = new SSL (context); - BIO<Handler> bio = new BIO<Handler>(get_handler_based_bio_method()); - bio.data = this; - session.rbio = bio; - session.wbio = bio; - - DateTime maximum_time = new DateTime.now_utc().add_seconds(20); - int err = 0; - if (mode == Mode.SERVER) { - session.set_accept_state (); - } else { - session.set_connect_state (); - } - do { - try { - SSL.Error ret = session.do_handshake(); - switch (ret) { - case SSL.Error.NONE: - err = 1; - break; - case SSL.Error.WANT_READ: - debug ("DTLS wants to read, but nothing in queue, wait for buffer"); - buffer_mutex.lock(); - if (buffer_queue.size == 0) { - buffer_cond.wait_until(buffer_mutex, get_monotonic_time() + maximum_time.difference(new DateTime.now_utc())); - } - buffer_mutex.unlock(); - err = -1; - break; - default: - warning ("DTLS Error: %s", @"$ret"); - err = 4; - break; - } - } catch (Error e) { - warning ("DTLS Error: %s", e.message); - err = e.code; - } - - DateTime current_time = new DateTime.now_utc(); - if (maximum_time.compare(current_time) < 0) { - debug ("DTLS handshake timeouted"); - err = 2; - break; - } - if (stop) { - debug ("DTLS handshake stopped"); - err = 3; - break; - } - } while (err < 0); - - buffer_mutex.lock(); - if (stop) { - stop = false; - running = false; - bool restart = restart; - buffer_mutex.unlock(); - if (restart) { - debug ("Restarting DTLS handshake"); - return setup_dtls_connection_thread(); - } - return null; - } - buffer_mutex.unlock(); - if (err != 1) { - debug ("DTLS handshake failed"); - return null; - } - - // TODO: Check peer certificate - - uint8[] km = new uint8[60]; - session.export_keying_material (km, "EXTRACTOR-dtls_srtp"); - uint8[] client_key = km[0:16]; - uint8[] server_key = km[16:32]; - uint8[] client_salt = km[32:46]; - uint8[] server_salt = km[46:60]; - - debug ("Finished DTLS connection. We're %s", mode.to_string()); - if (mode == Mode.SERVER) { - srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt); - srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt); - } else { - srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt); - srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt); - } - return new Xmpp.Xep.Jingle.ContentEncryption (Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint); - } - - private int read_impl (BIO<Handler> bio, uint8[] out_buf) { - Bytes data = get_buffer_if_present (); - if (data == null) { - if (!stop) { - debug ("No pending buffer in queue, but end not reached yet, set_retry_read"); - bio.set_retry_read (); - } - return -1; - } - if (data.length > out_buf.length) { - warning ("Buffer in queue does not fit in out_buf"); - return -1; - } - debug ("Read %d bytes from queue", data.length); - - uint8[] data_uint8 = Bytes.unref_to_data((owned) data); - Memory.copy (out_buf, data_uint8, data_uint8.length); - bio.clear_retry_flags (); - return data_uint8.length; - } - - private int write_impl (BIO<Handler> bio, uint8[] buf) { - debug ("Write %d bytes to network", buf.length); - send_data (buf); - return buf.length; - } - - private long ctrl_impl (BIO<Handler> bio, BIO.ControlCommand cmd, long num, void* ptr) { - switch (cmd) { - case BIO.ControlCommand.FLUSH: - // Datagrams are sent out immediately - return 1; - case BIO.ControlCommand.DGRAM_SET_NEXT_TIMEOUT: - // Datagrams are sent out immediately - return 1; - case BIO.ControlCommand.DGRAM_GET_MTU_OVERHEAD: - // Just some safe estimate - return 70; - case BIO.ControlCommand.DGRAM_QUERY_MTU: - // Just some safe estimate - return 1200; - case BIO.ControlCommand.WPENDING: - // Datagrams are sent out immediately - return 0; - case BIO.ControlCommand.POP: - case BIO.ControlCommand.PUSH: - // Ignored - return 0; - default: - warning (@"Unimplemented ctrl cmd:$cmd, num:$num"); - return 0; - } - } - - private static BIO.Method<Handler> _handler_based_bio_method_instance = null; - - private static unowned BIO.Method<Handler> get_handler_based_bio_method () { - if (_handler_based_bio_method_instance != null) return _handler_based_bio_method_instance; - _handler_based_bio_method_instance = new BIO.Method<Handler> (BIO.Type.SOURCE_SINK | BIO.Type.DGRAM, "Dino DTLS Handler BIO"); - _handler_based_bio_method_instance.read = (bio, out_buf) => bio.data.read_impl (bio, out_buf); - _handler_based_bio_method_instance.write = (bio, buf) => bio.data.write_impl (bio, buf); - _handler_based_bio_method_instance.ctrl = (bio, cmd, num, ptr) => bio.data.ctrl_impl (bio, cmd, num, ptr); - return _handler_based_bio_method_instance; - } -} - - - -}
\ No newline at end of file diff --git a/plugins/ice/src/module.vala b/plugins/ice/src/module.vala index ace62108..c3c92124 100644 --- a/plugins/ice/src/module.vala +++ b/plugins/ice/src/module.vala @@ -1,4 +1,6 @@ using Gee; + +using Dino.Crypto; using Xmpp; using Xmpp.Xep; @@ -43,7 +45,7 @@ public class Dino.Plugins.Ice.Module : JingleIceUdp.Module { string from_to_id = local_full_jid.to_string() + peer_full_jid.to_string(); try { if (!cerds.has_key(from_to_id)) cerds[from_to_id] = DtlsSrtp.generate_credentials(); - } catch (Error e) { + } catch (GLib.Error e) { warning("Error creating dtls credentials: %s", e.message); } return cerds[from_to_id]; diff --git a/plugins/ice/src/openssl_utils.c b/plugins/ice/src/openssl_utils.c deleted file mode 100644 index 7f4bf331..00000000 --- a/plugins/ice/src/openssl_utils.c +++ /dev/null @@ -1,49 +0,0 @@ -#include "openssl_utils.h" -#include <openssl/opensslv.h> -#include <openssl/ec.h> - -#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L -// This is for OpenSSL 3.0.0 and newer - -EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) { - // Generate EVP_PKEY directly - EVP_PKEY *pkey = EVP_EC_gen (curve); - return pkey; -} - -#else -// This is for OpenSSL before 3.0.0 and forks of earlier OpenSSL versions like LibreSSL - -EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) { - // Get NID from curve name - int nid = OBJ_sn2nid (curve); - if (nid == NID_undef) return NULL; - - // Create EC_KEY - EC_KEY *ec_key = EC_KEY_new_by_curve_name (nid); - if (!ec_key) return NULL; - - // Generate key - if (!EC_KEY_generate_key (ec_key)) { - EC_KEY_free (ec_key); - return NULL; - } - - // Create EVP_PKEY - EVP_PKEY *pkey = EVP_PKEY_new (); - if (!pkey) { - EC_KEY_free (ec_key); - return NULL; - } - - // Assign EC_KEY to EVP_PKEY - if (!EVP_PKEY_assign_EC_KEY (pkey, ec_key)) { - EC_KEY_free (ec_key); - return NULL; - } - - // EVP_PKEY_assign_EC_KEY takes ownership of ec_key, no need to free it explicitly - return pkey; -} - -#endif diff --git a/plugins/ice/src/openssl_utils.h b/plugins/ice/src/openssl_utils.h deleted file mode 100644 index bcc6f53a..00000000 --- a/plugins/ice/src/openssl_utils.h +++ /dev/null @@ -1,8 +0,0 @@ -#ifndef DINO_OPENSSL_UTILS_H -#define DINO_OPENSSL_UTILS_H - -#include <openssl/evp.h> - -EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve); - -#endif //DINO_OPENSSL_UTILS_H
\ No newline at end of file diff --git a/plugins/ice/src/transport_parameters.vala b/plugins/ice/src/transport_parameters.vala index 66dde8b1..122207c5 100644 --- a/plugins/ice/src/transport_parameters.vala +++ b/plugins/ice/src/transport_parameters.vala @@ -1,4 +1,6 @@ using Gee; + +using Dino.Crypto; using Xmpp; using Xmpp.Xep; diff --git a/plugins/ice/vapi/gnutls.vapi b/plugins/ice/vapi/gnutls.vapi deleted file mode 100644 index 86a8c401..00000000 --- a/plugins/ice/vapi/gnutls.vapi +++ /dev/null @@ -1,420 +0,0 @@ -[CCode (cprefix = "gnutls_", lower_case_cprefix = "gnutls_", cheader_filename = "gnutls/gnutls.h")] -namespace GnuTLS { - - public int global_init(); - - [CCode (cname = "gnutls_pull_func", has_target = false)] - public delegate ssize_t PullFunc(void* transport_ptr, [CCode (ctype = "void*", array_length_type="size_t")] uint8[] array); - - [CCode (cname = "gnutls_pull_timeout_func", has_target = false)] - public delegate int PullTimeoutFunc(void* transport_ptr, uint ms); - - [CCode (cname = "gnutls_push_func", has_target = false)] - public delegate ssize_t PushFunc(void* transport_ptr, [CCode (ctype = "void*", array_length_type="size_t")] uint8[] array); - - [CCode (cname = "gnutls_certificate_verify_function", has_target = false)] - public delegate int VerifyFunc(Session session); - - [Compact] - [CCode (cname = "struct gnutls_session_int", free_function = "gnutls_deinit")] - public class Session { - - public static Session? create(int con_end) throws GLib.Error { - Session result; - var ret = init(out result, con_end); - throw_if_error(ret); - return result; - } - - [CCode (cname = "gnutls_init")] - private static int init(out Session session, int con_end); - - [CCode (cname = "gnutls_transport_set_push_function")] - public void set_push_function(PushFunc func); - - [CCode (cname = "gnutls_transport_set_pull_function")] - public void set_pull_function(PullFunc func); - - [CCode (cname = "gnutls_transport_set_pull_timeout_function")] - public void set_pull_timeout_function(PullTimeoutFunc func); - - [CCode (cname = "gnutls_transport_set_ptr")] - public void set_transport_pointer(void* ptr); - - [CCode (cname = "gnutls_transport_get_ptr")] - public void* get_transport_pointer(); - - [CCode (cname = "gnutls_heartbeat_enable")] - public int enable_heartbeat(uint type); - - [CCode (cname = "gnutls_certificate_server_set_request")] - public void server_set_request(CertificateRequest req); - - [CCode (cname = "gnutls_credentials_set")] - public int set_credentials_(CredentialsType type, void* cred); - [CCode (cname = "gnutls_credentials_set_")] - public void set_credentials(CredentialsType type, void* cred) throws GLib.Error { - int err = set_credentials_(type, cred); - throw_if_error(err); - } - - [CCode (cname = "gnutls_priority_set_direct")] - public int set_priority_from_string_(string priority, out unowned string err_pos = null); - [CCode (cname = "gnutls_priority_set_direct_")] - public void set_priority_from_string(string priority, out unowned string err_pos = null) throws GLib.Error { - int err = set_priority_from_string_(priority, out err_pos); - throw_if_error(err); - } - - [CCode (cname = "gnutls_srtp_set_profile_direct")] - public int set_srtp_profile_direct_(string profiles, out unowned string err_pos = null); - [CCode (cname = "gnutls_srtp_set_profile_direct_")] - public void set_srtp_profile_direct(string profiles, out unowned string err_pos = null) throws GLib.Error { - int err = set_srtp_profile_direct_(profiles, out err_pos); - throw_if_error(err); - } - - [CCode (cname = "gnutls_transport_set_int")] - public void transport_set_int(int fd); - - [CCode (cname = "gnutls_handshake")] - public int handshake(); - - [CCode (cname = "gnutls_srtp_get_keys")] - public int get_srtp_keys_(void *key_material, uint32 key_material_size, out Datum client_key, out Datum client_salt, out Datum server_key, out Datum server_salt); - [CCode (cname = "gnutls_srtp_get_keys_")] - public void get_srtp_keys(void *key_material, uint32 key_material_size, out Datum client_key, out Datum client_salt, out Datum server_key, out Datum server_salt) throws GLib.Error { - get_srtp_keys_(key_material, key_material_size, out client_key, out client_salt, out server_key, out server_salt); - } - - [CCode (cname = "gnutls_certificate_get_peers", array_length_type = "unsigned int")] - public unowned Datum[]? get_peer_certificates(); - - [CCode (cname = "gnutls_session_set_verify_function")] - public void set_verify_function(VerifyFunc func); - } - - [Compact] - [CCode (cname = "struct gnutls_certificate_credentials_st", free_function = "gnutls_certificate_free_credentials", cprefix = "gnutls_certificate_")] - public class CertificateCredentials { - - [CCode (cname = "gnutls_certificate_allocate_credentials")] - private static int allocate(out CertificateCredentials credentials); - - public static CertificateCredentials create() throws GLib.Error { - CertificateCredentials result; - var ret = allocate (out result); - throw_if_error(ret); - return result; - } - - public void get_x509_crt(uint index, [CCode (array_length_type = "unsigned int")] out unowned X509.Certificate[] x509_ca_list); - - public int set_x509_key(X509.Certificate[] cert_list, X509.PrivateKey key); - } - - [CCode (cheader_filename = "gnutls/x509.h", cprefix = "GNUTLS_")] - namespace X509 { - - [Compact] - [CCode (cname = "struct gnutls_x509_crt_int", cprefix = "gnutls_x509_crt_", free_function = "gnutls_x509_crt_deinit")] - public class Certificate { - - [CCode (cname = "gnutls_x509_crt_init")] - private static int init (out Certificate cert); - public static Certificate create() throws GLib.Error { - Certificate result; - var ret = init (out result); - throw_if_error(ret); - return result; - } - - [CCode (cname = "gnutls_x509_crt_import")] - public int import_(ref Datum data, CertificateFormat format); - [CCode (cname = "gnutls_x509_crt_import_")] - public void import(ref Datum data, CertificateFormat format) throws GLib.Error { - int err = import_(ref data, format); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_set_version")] - public int set_version_(uint version); - [CCode (cname = "gnutls_x509_crt_set_version_")] - public void set_version(uint version) throws GLib.Error { - int err = set_version_(version); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_set_key")] - public int set_key_(PrivateKey key); - [CCode (cname = "gnutls_x509_crt_set_key_")] - public void set_key(PrivateKey key) throws GLib.Error { - int err = set_key_(key); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_set_activation_time")] - public int set_activation_time_(time_t act_time); - [CCode (cname = "gnutls_x509_crt_set_activation_time_")] - public void set_activation_time(time_t act_time) throws GLib.Error { - int err = set_activation_time_(act_time); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_set_expiration_time")] - public int set_expiration_time_(time_t exp_time); - [CCode (cname = "gnutls_x509_crt_set_expiration_time_")] - public void set_expiration_time(time_t exp_time) throws GLib.Error { - int err = set_expiration_time_(exp_time); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_set_serial")] - public int set_serial_(void* serial, size_t serial_size); - [CCode (cname = "gnutls_x509_crt_set_serial_")] - public void set_serial(void* serial, size_t serial_size) throws GLib.Error { - int err = set_serial_(serial, serial_size); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_sign")] - public int sign_(Certificate issuer, PrivateKey issuer_key); - [CCode (cname = "gnutls_x509_crt_sign_")] - public void sign(Certificate issuer, PrivateKey issuer_key) throws GLib.Error { - int err = sign_(issuer, issuer_key); - throw_if_error(err); - } - - [CCode (cname = "gnutls_x509_crt_get_fingerprint")] - public int get_fingerprint_(DigestAlgorithm algo, void* buf, ref size_t buf_size); - [CCode (cname = "gnutls_x509_crt_get_fingerprint_")] - public void get_fingerprint(DigestAlgorithm algo, void* buf, ref size_t buf_size) throws GLib.Error { - int err = get_fingerprint_(algo, buf, ref buf_size); - throw_if_error(err); - } - } - - [Compact] - [CCode (cname = "struct gnutls_x509_privkey_int", cprefix = "gnutls_x509_privkey_", free_function = "gnutls_x509_privkey_deinit")] - public class PrivateKey { - private static int init (out PrivateKey key); - public static PrivateKey create () throws GLib.Error { - PrivateKey result; - var ret = init (out result); - throw_if_error(ret); - return result; - } - - public int generate(PKAlgorithm algo, uint bits, uint flags = 0); - } - - } - - [CCode (cname = "gnutls_certificate_request_t", cprefix = "GNUTLS_CERT_", has_type_id = false)] - public enum CertificateRequest { - IGNORE, - REQUEST, - REQUIRE - } - - [CCode (cname = "gnutls_pk_algorithm_t", cprefix = "GNUTLS_PK_", has_type_id = false)] - public enum PKAlgorithm { - UNKNOWN, - RSA, - DSA, - ECDSA; - } - - [CCode (cname = "gnutls_digest_algorithm_t", cprefix = "GNUTLS_DIG_", has_type_id = false)] - public enum DigestAlgorithm { - NULL, - MD5, - SHA1, - RMD160, - MD2, - SHA224, - SHA256, - SHA384, - SHA512; - } - - [Flags] - [CCode (cname = "gnutls_init_flags_t", cprefix = "GNUTLS_", has_type_id = false)] - public enum InitFlags { - SERVER, - CLIENT, - DATAGRAM - } - - [CCode (cname = "gnutls_credentials_type_t", cprefix = "GNUTLS_CRD_", has_type_id = false)] - public enum CredentialsType { - CERTIFICATE, - ANON, - SRP, - PSK, - IA - } - - [CCode (cname = "gnutls_x509_crt_fmt_t", cprefix = "GNUTLS_X509_FMT_", has_type_id = false)] - public enum CertificateFormat { - DER, - PEM - } - - [Flags] - [CCode (cname = "gnutls_certificate_status_t", cprefix = "GNUTLS_CERT_", has_type_id = false)] - public enum CertificateStatus { - INVALID, // will be set if the certificate was not verified. - REVOKED, // in X.509 this will be set only if CRLs are checked - SIGNER_NOT_FOUND, - SIGNER_NOT_CA, - INSECURE_ALGORITHM - } - - [SimpleType] - [CCode (cname = "gnutls_datum_t", has_type_id = false)] - public struct Datum { - public uint8* data; - public uint size; - - public uint8[] extract() { - uint8[] ret = new uint8[size]; - for (int i = 0; i < size; i++) { - ret[i] = data[i]; - } - return ret; - } - } - - // Gnutls error codes. The mapping to a TLS alert is also shown in comments. - [CCode (cname = "int", cprefix = "GNUTLS_E_", lower_case_cprefix = "gnutls_error_", has_type_id = false)] - public enum ErrorCode { - SUCCESS, - UNKNOWN_COMPRESSION_ALGORITHM, - UNKNOWN_CIPHER_TYPE, - LARGE_PACKET, - UNSUPPORTED_VERSION_PACKET, // GNUTLS_A_PROTOCOL_VERSION - UNEXPECTED_PACKET_LENGTH, // GNUTLS_A_RECORD_OVERFLOW - INVALID_SESSION, - FATAL_ALERT_RECEIVED, - UNEXPECTED_PACKET, // GNUTLS_A_UNEXPECTED_MESSAGE - WARNING_ALERT_RECEIVED, - ERROR_IN_FINISHED_PACKET, - UNEXPECTED_HANDSHAKE_PACKET, - UNKNOWN_CIPHER_SUITE, // GNUTLS_A_HANDSHAKE_FAILURE - UNWANTED_ALGORITHM, - MPI_SCAN_FAILED, - DECRYPTION_FAILED, // GNUTLS_A_DECRYPTION_FAILED, GNUTLS_A_BAD_RECORD_MAC - MEMORY_ERROR, - DECOMPRESSION_FAILED, // GNUTLS_A_DECOMPRESSION_FAILURE - COMPRESSION_FAILED, - AGAIN, - EXPIRED, - DB_ERROR, - SRP_PWD_ERROR, - INSUFFICIENT_CREDENTIALS, - HASH_FAILED, - BASE64_DECODING_ERROR, - MPI_PRINT_FAILED, - REHANDSHAKE, // GNUTLS_A_NO_RENEGOTIATION - GOT_APPLICATION_DATA, - RECORD_LIMIT_REACHED, - ENCRYPTION_FAILED, - PK_ENCRYPTION_FAILED, - PK_DECRYPTION_FAILED, - PK_SIGN_FAILED, - X509_UNSUPPORTED_CRITICAL_EXTENSION, - KEY_USAGE_VIOLATION, - NO_CERTIFICATE_FOUND, // GNUTLS_A_BAD_CERTIFICATE - INVALID_REQUEST, - SHORT_MEMORY_BUFFER, - INTERRUPTED, - PUSH_ERROR, - PULL_ERROR, - RECEIVED_ILLEGAL_PARAMETER, // GNUTLS_A_ILLEGAL_PARAMETER - REQUESTED_DATA_NOT_AVAILABLE, - PKCS1_WRONG_PAD, - RECEIVED_ILLEGAL_EXTENSION, - INTERNAL_ERROR, - DH_PRIME_UNACCEPTABLE, - FILE_ERROR, - TOO_MANY_EMPTY_PACKETS, - UNKNOWN_PK_ALGORITHM, - // returned if libextra functionality was requested but - // gnutls_global_init_extra() was not called. - - INIT_LIBEXTRA, - LIBRARY_VERSION_MISMATCH, - // returned if you need to generate temporary RSA - // parameters. These are needed for export cipher suites. - - NO_TEMPORARY_RSA_PARAMS, - LZO_INIT_FAILED, - NO_COMPRESSION_ALGORITHMS, - NO_CIPHER_SUITES, - OPENPGP_GETKEY_FAILED, - PK_SIG_VERIFY_FAILED, - ILLEGAL_SRP_USERNAME, - SRP_PWD_PARSING_ERROR, - NO_TEMPORARY_DH_PARAMS, - // For certificate and key stuff - - ASN1_ELEMENT_NOT_FOUND, - ASN1_IDENTIFIER_NOT_FOUND, - ASN1_DER_ERROR, - ASN1_VALUE_NOT_FOUND, - ASN1_GENERIC_ERROR, - ASN1_VALUE_NOT_VALID, - ASN1_TAG_ERROR, - ASN1_TAG_IMPLICIT, - ASN1_TYPE_ANY_ERROR, - ASN1_SYNTAX_ERROR, - ASN1_DER_OVERFLOW, - OPENPGP_UID_REVOKED, - CERTIFICATE_ERROR, - CERTIFICATE_KEY_MISMATCH, - UNSUPPORTED_CERTIFICATE_TYPE, // GNUTLS_A_UNSUPPORTED_CERTIFICATE - X509_UNKNOWN_SAN, - OPENPGP_FINGERPRINT_UNSUPPORTED, - X509_UNSUPPORTED_ATTRIBUTE, - UNKNOWN_HASH_ALGORITHM, - UNKNOWN_PKCS_CONTENT_TYPE, - UNKNOWN_PKCS_BAG_TYPE, - INVALID_PASSWORD, - MAC_VERIFY_FAILED, // for PKCS #12 MAC - CONSTRAINT_ERROR, - WARNING_IA_IPHF_RECEIVED, - WARNING_IA_FPHF_RECEIVED, - IA_VERIFY_FAILED, - UNKNOWN_ALGORITHM, - BASE64_ENCODING_ERROR, - INCOMPATIBLE_CRYPTO_LIBRARY, - INCOMPATIBLE_LIBTASN1_LIBRARY, - OPENPGP_KEYRING_ERROR, - X509_UNSUPPORTED_OID, - RANDOM_FAILED, - BASE64_UNEXPECTED_HEADER_ERROR, - OPENPGP_SUBKEY_ERROR, - CRYPTO_ALREADY_REGISTERED, - HANDSHAKE_TOO_LARGE, - UNIMPLEMENTED_FEATURE, - APPLICATION_ERROR_MAX, // -65000 - APPLICATION_ERROR_MIN; // -65500 - - [CCode (cname = "gnutls_error_is_fatal")] - public bool is_fatal(); - - [CCode (cname = "gnutls_perror")] - public void print(); - - [CCode (cname = "gnutls_strerror")] - public unowned string to_string(); - } - - public void throw_if_error(int err_int) throws GLib.Error { - ErrorCode error = (ErrorCode)err_int; - if (error != ErrorCode.SUCCESS) { - throw new GLib.Error(-1, error, "%s%s", error.to_string(), error.is_fatal() ? " fatal" : ""); - } - } -}
\ No newline at end of file diff --git a/plugins/ice/vapi/openssl.vapi b/plugins/ice/vapi/openssl.vapi deleted file mode 100644 index e0654869..00000000 --- a/plugins/ice/vapi/openssl.vapi +++ /dev/null @@ -1,218 +0,0 @@ -[CCode (cprefix = "")] -namespace OpenSSL { - [CCode (cprefix = "ASN1_", lower_case_cprefix = "ASN1_", cheader_filename = "openssl/asn1.h")] - namespace ASN1 { - [Compact] - [CCode (cname = "ASN1_INTEGER", lower_case_cprefix = "ASN1_INTEGER_", cprefix = "ASN1_INTEGER_", free_function = "ASN1_INTEGER_free")] - public class Integer { - public bool @set (long v); - } - - [Compact] - [CCode (cname = "ASN1_TIME", lower_case_cprefix = "ASN1_TIME_", cprefix = "ASN1_TIME_", copy_function = "ASN1_TIME_dup", free_function = "ASN1_STRING_free")] - public class Time { - public bool @set (time_t t); - } - } - [Compact] - [CCode (cname = "BIO", lower_case_cprefix = "BIO_", cprefix = "BIO_", ref_function = "BIO_up_ref", ref_function_void = true, unref_function = "BIO_free", cheader_filename = "openssl/bio.h", simple_generics = true)] - public class BIO<T> { - [Compact] - [CCode (cname = "BIO_METHOD", lower_case_cprefix = "BIO_meth_", cprefix = "BIO_meth_", unref_function = "BIO_meth_free", simple_generics = true)] - public class Method<T> { - public Method (Type type, string name); - [CCode (has_target = false)] - public delegate int WriteFunc<T> (BIO<T> bio, [CCode (type = "const char *", array_length_type = "int")] uint8[] buf); - [CCode (has_target = false)] - public delegate int ReadFunc<T> (BIO<T> bio, [CCode (type = "char *", array_length_type = "int")] uint8[] out_buf); - [CCode (has_target = false, simple_generics = true)] - public delegate long CtrlFunc<T> (BIO<T> bio, ControlCommand cmd, long num, void* ptr); - public WriteFunc<T> write { get; set; } - public ReadFunc<T> read { get; set; } - public CtrlFunc<T> ctrl { get; set; } - } - - [Flags] - [CCode (cname = "int")] - public enum Type { - SOURCE_SINK, - DGRAM, - } - - [CCode (cname = "int", cprefix = "BIO_CTRL_", has_type_id = false)] - public enum ControlCommand { - RESET, - EOF, - SET, - GET, - PUSH, - POP, - GET_CLOSE, - SET_CLOSE, - PENDING, - FLUSH, - DUP, - WPENDING, - - DGRAM_QUERY_MTU, - DGRAM_GET_MTU, - DGRAM_SET_MTU, - DGRAM_SET_PEER, - DGRAM_SET_NEXT_TIMEOUT, - DGRAM_GET_PEER, - DGRAM_GET_FALLBACK_MTU, - DGRAM_SET_DONT_FRAG, - DGRAM_GET_MTU_OVERHEAD, - } - - public BIO (Method<T> type); - public T data { get; set; } - - public void clear_retry_flags (); - public void set_retry_read (); - public bool should_read (); - } - - [CCode (cprefix = "ERR_", lower_case_cprefix = "ERR_", cheader_filename = "openssl/err.h")] - namespace ERR { - public ulong get_error (); - public unowned string lib_error_string (ulong error); - public unowned string reason_error_string (ulong error); - } - - [CCode (cprefix = "EVP_", lower_case_cprefix = "EVP_", cheader_filename = "openssl/evp.h")] - namespace EVP { - [Compact] - [CCode (cname = "EVP_PKEY", lower_case_cprefix = "EVP_PKEY_", cprefix = "EVP_PKEY_", ref_function = "EVP_PKEY_up_ref", ref_function_void = true, unref_function = "EVP_PKEY_free")] - public class Key { - public Key (); - [CCode (cheader_filename = "openssl_utils.h")] - public Key.generate_ecdsa (string curve); - } - [Compact] - [CCode (cname = "EVP_MD", lower_case_cprefix = "EVP_MD_", cprefix = "EVP_MD_", ref_function = "EVP_MD_up_ref", ref_function_void = true, unref_function = "EVP_MD_free")] - public class MessageDigest { - } - - public static unowned MessageDigest sha256 (); - } - - [Compact] - [CCode (cname = "SSL", lower_case_cprefix = "SSL_", cprefix = "SSL_", ref_function = "SSL_up_ref", ref_function_void = true, unref_function = "SSL_free", cheader_filename = "openssl/ssl.h")] - class SSL { - [Compact] - [CCode (cname = "SSL_CTX", lower_case_cprefix = "SSL_CTX_", cprefix = "SSL_CTX_", ref_function = "SSL_CTX_up_ref", ref_function_void = true, unref_function = "SSL_CTX_free")] - public class Context { - public Context (Method method); - public int set_tlsext_use_srtp (string profiles); - public int use_certificate (X509.Certificate certificate); - [CCode (cname = "SSL_CTX_use_PrivateKey")] - public int use_private_key (EVP.Key private_key); - } - - [CCode (cname = "const SSL_METHOD*")] - public enum Method { - [CCode (cname = "DTLS_client_method()")] - DTLS_CLIENT, - [CCode (cname = "DTLS_server_method()")] - DTLS_SERVER, - } - - [CCode (cname = "int", has_type_id = false)] - public enum Error { - NONE, - ZERO_RETURN, - WANT_READ, - WANT_WRITE, - WANT_CONNECT, - WANT_ACCEPT, - WANT_X509_LOOKUP, - WANT_ASYNC, - WANT_ASYNC_JOB, - WANT_CLIENT_HELLO_CB, - SYSCALL, - SSL - } - - public SSL (Context context); - public BIO rbio { get; [CCode (cname="SSL_set0_rbio")] owned set; } - public BIO wbio { get; [CCode (cname="SSL_set0_wbio")] owned set; } - - [CCode (cname = "SSL_do_handshake")] - private int do_handshake_ (); - [CCode (cname = "SSL_do_handshake_")] - public Error do_handshake () throws GLib.Error { - int ret = throw_if_error (do_handshake_ ()); - return get_error (ret); - } - [CCode (cname = "SSL_export_keying_material")] - private int export_keying_material_ (uint8[] out, string label, size_t llen, [CCode (type = "const unsigned char *")] string context, size_t contextlen, bool use_context); - [CCode (cname = "SSL_export_keying_material_")] - public void export_keying_material (uint8[] out, string label, string? context = null) throws GLib.Error { - throw_if_error (export_keying_material_ (@out, label, label.length, context, context == null ? 0 : context.length, context != null)); - } - public Error get_error (int ret); - public void set_accept_state (); - public void set_connect_state (); - public int want (); - } - - [CCode (cprefix = "X509_", lower_case_cprefix = "X509_", cheader_filename = "openssl/x509.h")] - namespace X509 { - [Compact] - [CCode (cname = "X509", lower_case_cprefix = "X509_", cprefix = "X509_", ref_function = "X509_up_ref", ref_function_void = true, unref_function = "X509_free")] - public class Certificate { - public Certificate (); - public ASN1.Time not_before { - [CCode (cname = "X509_get_notBefore")] - get; - [CCode (cname = "X509_set_notBefore")] - set; - } - public ASN1.Time not_after { - [CCode (cname = "X509_get_notAfter")] - get; - [CCode (cname = "X509_set_notAfter")] - set; - } - public ASN1.Integer serial_number { - [CCode (cname = "X509_get_serialNumber")] - get; - [CCode (cname = "X509_set_serialNumber")] - set; - } - [CCode (cname = "X509_digest")] - private int digest_ (EVP.MessageDigest type, uchar* md, ref uint len); - [CCode (cname = "X509_digest_")] - public uint8[] digest (EVP.MessageDigest type, size_t buf_len = 512) throws GLib.Error { - uint8[] buf = new uint8[buf_len]; - uint buf_out_size = (uint) buf_len; - throw_if_error (digest_ (type, (uchar*) buf, ref buf_out_size)); - - uint8[] ret = new uint8[buf_out_size]; - for (int i = 0; i < buf_out_size; i++) { - ret[i] = buf[i]; - } - return ret; - } - [CCode (cname = "X509_set_pubkey")] - public int set_public_key (EVP.Key public_key); - public int set_version (long version); - [CCode (cname = "X509_sign")] - private int sign_ (EVP.Key private_key, EVP.MessageDigest md); - [CCode (cname = "X509_sign_")] - public void sign (EVP.Key private_key, EVP.MessageDigest md) throws GLib.Error { - throw_if_error (sign_ (private_key, md)); - } - } - } - - public int throw_if_error(int res) throws GLib.Error { - if (res <= 0) { - ulong error = ERR.get_error (); - if (error == 0) return res; - throw new GLib.Error (-1, (int) error, "%s:%s", ERR.lib_error_string (error), ERR.reason_error_string (error)); - } - return res; - } -}
\ No newline at end of file |