• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

randombit / botan / 5079590438

25 May 2023 12:28PM UTC coverage: 92.228% (+0.5%) from 91.723%
5079590438

Pull #3502

github

Pull Request #3502: Apply clang-format to the codebase

75589 of 81959 relevant lines covered (92.23%)

12139530.51 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

68.87
/src/cli/tls_server.cpp
1
/*
2
* TLS echo server using BSD sockets
3
* (C) 2014 Jack Lloyd
4
*     2017 René Korthaus, Rohde & Schwarz Cybersecurity
5
*     2023 René Meusel, Rohde & Schwarz Cybersecurity
6
*
7
* Botan is released under the Simplified BSD License (see license.txt)
8
*/
9

10
#include "cli.h"
11
#include "sandbox.h"
12

13
#if defined(BOTAN_TARGET_OS_HAS_SOCKETS)
14
   #include <sys/socket.h>
15
#endif
16

17
#if defined(BOTAN_HAS_TLS) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM) && defined(BOTAN_TARGET_OS_HAS_SOCKETS)
18

19
   #if defined(SO_MARK) || defined(SO_USER_COOKIE) || defined(SO_RTABLE)
20
      #if defined(SO_MARK)
21
         #define BOTAN_SO_SOCKETID SO_MARK
22
      #elif defined(SO_USER_COOKIE)
23
         #define BOTAN_SO_SOCKETID SO_USER_COOKIE
24
      #else
25
         #define BOTAN_SO_SOCKETID SO_RTABLE
26
      #endif
27
   #endif
28

29
   #include <botan/hex.h>
30
   #include <botan/mem_ops.h>
31
   #include <botan/tls_callbacks.h>
32
   #include <botan/tls_policy.h>
33
   #include <botan/tls_server.h>
34
   #include <botan/tls_session_manager_memory.h>
35
   #include <botan/internal/os_utils.h>
36

37
   #include <fstream>
38
   #include <list>
39
   #include <memory>
40

41
   #include "socket_utils.h"
42
   #include "tls_helpers.h"
43

44
namespace Botan_CLI {
45

46
class TLS_Server;
47

48
namespace {
49

50
class Callbacks : public Botan::TLS::Callbacks {
1✔
51
   public:
52
      Callbacks(TLS_Server& server_command) : m_server_command(server_command) {}
1✔
53

54
      std::ostream& output();
55
      void send(std::span<const uint8_t> buffer);
56
      void push_pending_output(std::string line);
57

58
      void tls_session_established(const Botan::TLS::Session_Summary& session) override {
4✔
59
         output() << "Handshake complete, " << session.version().to_string() << " using "
4✔
60
                  << session.ciphersuite().to_string() << std::endl;
16✔
61

62
         if(const auto& session_id = session.session_id(); !session_id.empty()) {
4✔
63
            output() << "Session ID " << Botan::hex_encode(session_id.get()) << std::endl;
8✔
64
         }
65

66
         if(const auto& session_ticket = session.session_ticket()) {
4✔
67
            output() << "Session ticket " << Botan::hex_encode(session_ticket->get()) << std::endl;
×
68
         }
69
      }
4✔
70

71
      void tls_record_received(uint64_t /*seq_no*/, std::span<const uint8_t> input) override {
4✔
72
         for(size_t i = 0; i != input.size(); ++i) {
916✔
73
            const char c = static_cast<char>(input[i]);
912✔
74
            m_line_buf += c;
912✔
75
            if(c == '\n') {
912✔
76
               push_pending_output(std::exchange(m_line_buf, {}));
12✔
77
            }
78
         }
79
      }
4✔
80

81
      void tls_emit_data(std::span<const uint8_t> buf) override { send(buf); }
54✔
82

83
      void tls_alert(Botan::TLS::Alert alert) override { output() << "Alert: " << alert.type_string() << std::endl; }
4✔
84

85
      std::string tls_server_choose_app_protocol(const std::vector<std::string>& /*client_protos*/) override {
×
86
         // we ignore whatever the client sends here
87
         return "echo/0.1";
×
88
      }
89

90
   private:
91
      TLS_Server& m_server_command;
92
      std::string m_line_buf;
93
};
94

95
}
96

97
class TLS_Server final : public Command {
98
   public:
99
   #if defined(BOTAN_SO_SOCKETID)
100
      TLS_Server() :
2✔
101
            Command(
102
               "tls_server cert key --port=443 --psk= --psk-identity=  --type=tcp --policy=default --dump-traces= --max-clients=0 --socket-id=0")
4✔
103
   #else
104
      TLS_Server() :
105
            Command(
106
               "tls_server cert key --port=443 --psk= --psk-identity=  --type=tcp --policy=default --dump-traces= --max-clients=0")
107
   #endif
108
      {
109
         init_sockets();
2✔
110
      }
2✔
111

112
      ~TLS_Server() override { stop_sockets(); }
4✔
113

114
      TLS_Server(const TLS_Server& other) = delete;
115
      TLS_Server(TLS_Server&& other) = delete;
116
      TLS_Server& operator=(const TLS_Server& other) = delete;
117
      TLS_Server& operator=(TLS_Server&& other) = delete;
118

119
      std::string group() const override { return "tls"; }
1✔
120

121
      std::string description() const override { return "Accept TLS/DTLS connections from TLS/DTLS clients"; }
1✔
122

123
      void go() override {
1✔
124
         const std::string server_crt = get_arg("cert");
1✔
125
         const std::string server_key = get_arg("key");
1✔
126
         const uint16_t port = get_arg_u16("port");
1✔
127
         const size_t max_clients = get_arg_sz("max-clients");
1✔
128
         const std::string transport = get_arg("type");
1✔
129
         const std::string dump_traces_to = get_arg("dump-traces");
1✔
130
         const auto psk = [this]() -> std::optional<Botan::SymmetricKey> {
2✔
131
            auto psk_hex = get_arg_maybe("psk");
1✔
132
            if(psk_hex)
1✔
133
               return Botan::SymmetricKey(Botan::hex_decode_locked(psk_hex.value()));
1✔
134
            else
135
               return {};
1✔
136
         }();
2✔
137
         const std::optional<std::string> psk_identity = get_arg_maybe("psk-identity");
1✔
138
   #if defined(BOTAN_SO_SOCKETID)
139
         m_socket_id = static_cast<uint32_t>(get_arg_sz("socket-id"));
1✔
140
   #endif
141

142
         if(transport != "tcp" && transport != "udp") {
1✔
143
            throw CLI_Usage_Error("Invalid transport type '" + transport + "' for TLS");
×
144
         }
145

146
         m_is_tcp = (transport == "tcp");
1✔
147

148
         auto policy = load_tls_policy(get_arg("policy"));
2✔
149
         auto session_manager =
1✔
150
            std::make_shared<Botan::TLS::Session_Manager_In_Memory>(rng_as_shared());  // TODO sqlite3
2✔
151
         auto creds = std::make_shared<Basic_Credentials_Manager>(server_crt, server_key, psk, psk_identity);
1✔
152
         auto callbacks = std::make_shared<Callbacks>(*this);
1✔
153

154
         output() << "Listening for new connections on " << transport << " port " << port << std::endl;
1✔
155

156
         if(!m_sandbox.init()) {
1✔
157
            error_output() << "Failed sandboxing\n";
×
158
            return;
×
159
         }
160

161
         socket_type server_fd = make_server_socket(port);
1✔
162
         size_t clients_served = 0;
163

164
         while(true) {
9✔
165
            if(max_clients > 0 && clients_served >= max_clients)
5✔
166
               break;
167

168
            if(m_is_tcp) {
4✔
169
               m_socket = ::accept(server_fd, nullptr, nullptr);
4✔
170
            } else {
171
               struct sockaddr_in from;
×
172
               socklen_t from_len = sizeof(sockaddr_in);
×
173

174
               void* peek_buf = nullptr;
×
175
               size_t peek_len = 0;
×
176

177
   #if defined(BOTAN_TARGET_OS_IS_MACOS)
178
               // macOS handles zero size buffers differently - it will return 0 even if there's no incoming data,
179
               // and after that connect() will fail as sockaddr_in from is not initialized
180
               int dummy;
181
               peek_buf = &dummy;
182
               peek_len = sizeof(dummy);
183
   #endif
184

185
               if(::recvfrom(server_fd,
×
186
                             static_cast<char*>(peek_buf),
187
                             static_cast<sendrecv_len_type>(peek_len),
188
                             MSG_PEEK,
189
                             reinterpret_cast<struct sockaddr*>(&from),
190
                             &from_len) != 0) {
191
                  throw CLI_Error("Could not peek next packet");
×
192
               }
193

194
               if(::connect(server_fd, reinterpret_cast<struct sockaddr*>(&from), from_len) != 0) {
×
195
                  throw CLI_Error("Could not connect UDP socket");
×
196
               }
197
               m_socket = server_fd;
×
198
            }
199

200
            clients_served++;
4✔
201

202
            Botan::TLS::Server server(callbacks, session_manager, creds, policy, rng_as_shared(), m_is_tcp == false);
24✔
203

204
            std::unique_ptr<std::ostream> dump_stream;
4✔
205

206
            if(!dump_traces_to.empty()) {
4✔
207
               uint64_t timestamp = Botan::OS::get_high_resolution_clock();
×
208
               const std::string dump_file = dump_traces_to + "/tls_" + std::to_string(timestamp) + ".bin";
×
209
               dump_stream = std::make_unique<std::ofstream>(dump_file.c_str());
×
210
            }
×
211

212
            try {
213
               while(!server.is_closed()) {
22✔
214
                  try {
18✔
215
                     uint8_t buf[4 * 1024] = {0};
18✔
216
                     ssize_t got = ::recv(m_socket, Botan::cast_uint8_ptr_to_char(buf), sizeof(buf), 0);
18✔
217

218
                     if(got == -1) {
18✔
219
                        error_output() << "Error in socket read - " << err_to_string(errno) << std::endl;
×
220
                        break;
×
221
                     }
222

223
                     if(got == 0) {
18✔
224
                        error_output() << "EOF on socket" << std::endl;
×
225
                        break;
226
                     }
227

228
                     if(dump_stream) {
18✔
229
                        dump_stream->write(reinterpret_cast<const char*>(buf), got);
×
230
                     }
231

232
                     server.received_data(buf, got);
18✔
233

234
                     while(server.is_active() && !m_pending_output.empty()) {
22✔
235
                        std::string output = m_pending_output.front();
4✔
236
                        m_pending_output.pop_front();
4✔
237
                        server.send(output);
4✔
238

239
                        if(output == "quit\n") {
4✔
240
                           server.close();
×
241
                        }
242
                     }
4✔
243
                  } catch(std::exception& e) {
×
244
                     error_output() << "Connection problem: " << e.what() << std::endl;
×
245
                     if(m_is_tcp) {
×
246
                        close_socket(m_socket);
×
247
                        m_socket = invalid_socket();
×
248
                     }
249
                  }
×
250
               }
251
            } catch(Botan::Exception& e) { error_output() << "Connection failed: " << e.what() << "\n"; }
×
252

253
            if(m_is_tcp) {
4✔
254
               close_socket(m_socket);
4✔
255
               m_socket = invalid_socket();
4✔
256
            }
257
         }
4✔
258

259
         close_socket(server_fd);
1✔
260
      }
6✔
261

262
   public:
263
      using Command::flag_set;
264
      using Command::output;
265

266
      void send(std::span<const uint8_t> buf) {
27✔
267
         if(m_is_tcp) {
27✔
268
            ssize_t sent = ::send(m_socket, buf.data(), static_cast<sendrecv_len_type>(buf.size()), MSG_NOSIGNAL);
27✔
269

270
            if(sent == -1) {
27✔
271
               error_output() << "Error writing to socket - " << err_to_string(errno) << std::endl;
×
272
            } else if(sent != static_cast<ssize_t>(buf.size())) {
27✔
273
               error_output() << "Packet of length " << buf.size() << " truncated to " << sent << std::endl;
×
274
            }
275
         } else {
276
            while(!buf.empty()) {
×
277
               ssize_t sent = ::send(m_socket, buf.data(), static_cast<sendrecv_len_type>(buf.size()), MSG_NOSIGNAL);
×
278

279
               if(sent == -1) {
×
280
                  if(errno == EINTR) {
×
281
                     sent = 0;
282
                  } else {
283
                     throw CLI_Error("Socket write failed");
×
284
                  }
285
               }
286

287
               buf = buf.subspan(sent);
×
288
            }
289
         }
290
      }
27✔
291

292
      void push_pending_output(std::string line) { m_pending_output.emplace_back(std::move(line)); }
4✔
293

294
   private:
295
      socket_type make_server_socket(uint16_t port) {
1✔
296
         const int type = m_is_tcp ? SOCK_STREAM : SOCK_DGRAM;
1✔
297

298
         socket_type fd = ::socket(PF_INET, type, 0);
1✔
299
         if(fd == invalid_socket()) {
1✔
300
            throw CLI_Error("Unable to acquire socket");
×
301
         }
302

303
         sockaddr_in socket_info;
1✔
304
         Botan::clear_mem(&socket_info, 1);
1✔
305
         socket_info.sin_family = AF_INET;
1✔
306
         socket_info.sin_port = htons(port);
1✔
307

308
         // FIXME: support limiting listeners
309
         socket_info.sin_addr.s_addr = INADDR_ANY;
1✔
310

311
         if(::bind(fd, reinterpret_cast<struct sockaddr*>(&socket_info), sizeof(struct sockaddr)) != 0) {
1✔
312
            close_socket(fd);
×
313
            throw CLI_Error("server bind failed");
×
314
         }
315

316
         if(m_is_tcp) {
1✔
317
            constexpr int backlog = std::min(100, SOMAXCONN);
1✔
318
            if(::listen(fd, backlog) != 0) {
1✔
319
               close_socket(fd);
×
320
               throw CLI_Error("listen failed");
×
321
            }
322
         }
323
         if(m_socket_id > 0) {
1✔
324
   #if defined(BOTAN_SO_SOCKETID)
325
            if(::setsockopt(fd,
×
326
                            SOL_SOCKET,
327
                            BOTAN_SO_SOCKETID,
328
                            reinterpret_cast<const void*>(&m_socket_id),
×
329
                            sizeof(m_socket_id)) != 0) {
330
               // Failed but not world-ending issue
331
               output() << "set socket identifier setting failed" << std::endl;
×
332
            }
333
   #endif
334
         }
335
         return fd;
1✔
336
      }
337

338
      socket_type m_socket = invalid_socket();
339
      bool m_is_tcp = false;
340
      uint32_t m_socket_id = 0;
341
      std::list<std::string> m_pending_output;
342
      Sandbox m_sandbox;
343
};
344

345
namespace {
346

347
std::ostream& Callbacks::output() { return m_server_command.output(); }
12✔
348

349
void Callbacks::send(std::span<const uint8_t> buffer) { m_server_command.send(buffer); }
27✔
350

351
void Callbacks::push_pending_output(std::string line) { m_server_command.push_pending_output(std::move(line)); }
12✔
352

353
}
354

355
BOTAN_REGISTER_COMMAND("tls_server", TLS_Server);
2✔
356

357
}
358

359
#endif
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc