mirror of
https://github.com/3proxy/3proxy.git
synced 2026-10-28 22:05:48 +08:00
d0e88a7b88
ssl_ktls asks OpenSSL to hand TLS to the kernel (SSL_OP_ENABLE_KTLS) on the connections of the services which follow, both to clients and to servers; ssl_noktls, the default, keeps it in 3proxy. Where the library, the kernel and the cipher allow it, the kernel then encrypts and decrypts, and SSL_read/SSL_write go on working over it. What a service got is logged on its first TLS connection. Reading ahead is left off where the kernel took receiving, which reads a record at a time. A build whose library has no kernel TLS (wolfSSL, OpenSSL before 3.0 or without it) warns and ignores the command. splice() is not used for TLS services yet. Tested on AlmaLinux 10 (OpenSSL 3.5.8, tls module): both directions of both legs of a TLS chain in the kernel, the suite passing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
111 lines
2.7 KiB
C
111 lines
2.7 KiB
C
#ifndef __ssl_h__
|
|
#define __ssl_h__
|
|
|
|
//
|
|
// opaque connection structure
|
|
//
|
|
typedef void *SSL_CONN;
|
|
//
|
|
// opaque certificate structure
|
|
//
|
|
typedef void *SSL_CERT;
|
|
|
|
typedef struct _ssl_conn {
|
|
SSL_CTX *ctx;
|
|
SSL *ssl;
|
|
} ssl_conn;
|
|
|
|
struct alpn {
|
|
unsigned char *protos;
|
|
unsigned int protos_len;
|
|
};
|
|
|
|
struct ssl_config {
|
|
X509 *CA_cert;
|
|
X509 *server_cert;
|
|
X509 *client_cert;
|
|
EVP_PKEY *CA_key;
|
|
EVP_PKEY *server_key;
|
|
EVP_PKEY *client_key;
|
|
SSL_CTX *cli_ctx;
|
|
SSL_CTX *srv_ctx;
|
|
char *certcache;
|
|
char * client_ciphersuites;
|
|
char * server_ciphersuites;
|
|
char * client_cipher_list;
|
|
char * server_cipher_list;
|
|
char * client_ca_file;
|
|
char * client_ca_dir;
|
|
char * client_ca_store;
|
|
char * server_ca_file;
|
|
char * server_ca_dir;
|
|
char * server_ca_store;
|
|
char * client_sni;
|
|
struct alpn client_alpn_protos;
|
|
int mitm;
|
|
int serv;
|
|
int cli;
|
|
int client_min_proto_version;
|
|
int client_max_proto_version;
|
|
int server_min_proto_version;
|
|
int server_max_proto_version;
|
|
int client_verify;
|
|
int server_verify;
|
|
int client_mode;
|
|
int ktls; /* ssl_ktls: kernel TLS asked for (SSL_OP_ENABLE_KTLS) */
|
|
int ktls_reported; /* whether the kernel took it has been logged */
|
|
int timeout; /* seconds a handshake step may wait: the service's CONNECT_TO */
|
|
};
|
|
|
|
typedef struct ssl_config SSL_CONFIG;
|
|
|
|
|
|
//
|
|
// Create copy of certificate signed by "other" CA
|
|
//
|
|
SSL_CERT ssl_copy_cert(SSL_CERT cert, SSL_CONFIG *config);
|
|
|
|
//
|
|
// SSL/TLS handshakes
|
|
//
|
|
SSL_CTX * ssl_cli_ctx(SSL_CONFIG *config, X509 *server_cert, EVP_PKEY *server_key,char** errSSL);
|
|
SSL_CONN ssl_handshake_to_client(SOCKET s, SSL_CONFIG *config, X509 *server_cert, EVP_PKEY *server_key, char **errSSL);
|
|
SSL_CONN ssl_handshake_to_server(SOCKET s, char * hostname, SSL_CONFIG *config, SSL_CERT *server_cert, char **errSSL);
|
|
|
|
//
|
|
// SSL/TLS Read/Write
|
|
//
|
|
int ssl_read(SSL_CONN connection, void * buf, int bufsize);
|
|
int ssl_write(SSL_CONN connection, void * buf, int bufsize);
|
|
int ssl_pending(SSL_CONN connection);
|
|
|
|
/* TLS records are read ahead, a buffer at a time rather than two reads for
|
|
each record, where what is read ahead and not yet decrypted shows as
|
|
pending (SSL_has_pending(), OpenSSL 1.1.0 and later): poll() would wait
|
|
on it otherwise. */
|
|
#if !defined(WITH_WOLFSSL) && defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
|
|
#define SSL_READAHEAD 1
|
|
#else
|
|
#define SSL_READAHEAD 0
|
|
#endif
|
|
|
|
//
|
|
// Release of opaque structures
|
|
//
|
|
void ssl_conn_free(SSL_CONN connection);
|
|
void _ssl_cert_free(SSL_CERT cert);
|
|
|
|
//
|
|
// Global (de)initialization
|
|
//
|
|
void ssl_init(void);
|
|
char * getSSLErr(void);
|
|
|
|
//
|
|
// Built-in SSL installation (called from 3proxy.c)
|
|
//
|
|
void ssl_install(void);
|
|
|
|
extern struct sockfuncs sso;
|
|
#endif // __ssl_h__
|