proxy2ch/BBS2chProxySecureSocket.cpp

#ifdef USE_MITM
#include <stdexcept>
#include <stdio.h>
#include <unistd.h>
#include <openssl/pem.h>
#include <openssl/x509v3.h>
#include <openssl/err.h>
#ifdef _WIN32
#include <winsock2.h>
#define CLOSESOCKET(x) closesocket(x)
#define SHUT_RDWR SD_BOTH
#else
#define CLOSESOCKET(x) ::close(x)
#endif
#include "BBS2chProxySecureSocket.h"

static X509 *ca_cert;
static EVP_PKEY *ca_privkey;
static EVP_PKEY *server_privkey;

static int add_ext(X509 *cert, int nid, const char *value)
{
	X509_EXTENSION *ex;
	X509V3_CTX ctx;
	X509V3_set_ctx_nodb(&ctx);
	X509V3_set_ctx(&ctx, cert, cert, NULL, NULL, 0);
	ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, value);
	if (!ex)
		return 0;

	X509_add_ext(cert,ex,-1);
	X509_EXTENSION_free(ex);
	return 1;
}

int BBS2chProxySecureSocket::initializeCerts(const char *certPath, const char *keyPath)
{
	static int initialized;
	if (initialized) return 0;

	FILE *fp = fopen(certPath, "rb");
	if (!fp) {
		fprintf(stderr, "Unable to open CA certificate from %s\n", certPath);
		return -1;
	}
	ca_cert = PEM_read_X509(fp, NULL, NULL, NULL);
	if (!ca_cert) {
		fprintf(stderr, "Error loading CA certificate: ");
		ERR_print_errors_fp(stderr);
		return -1;
	}
	fclose(fp);
	fp = fopen(keyPath, "rb");
	if (!fp) {
		fprintf(stderr, "Unable to open CA private key from %s\n", keyPath);
		return -1;
	}
	ca_privkey = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
	if (!ca_privkey) {
		fprintf(stderr, "Error loading CA private key: ");
		ERR_print_errors_fp(stderr);
		return -1;
	}
	fclose(fp);

	server_privkey = EVP_PKEY_new();
	BIGNUM *bn = BN_new();
	BN_set_word(bn, RSA_F4);
	RSA *rsa = RSA_new();
	RSA_generate_key_ex(rsa, 2048, bn, NULL);
	EVP_PKEY_assign_RSA(server_privkey, rsa);
	BN_free(bn);

	initialized = 1;
	return 0;
}

void BBS2chProxySecureSocket::generateAndPrintSelfSignedCertificate(void)
{
	EVP_PKEY *key = EVP_PKEY_new();
	BIGNUM *bn = BN_new();
	BN_set_word(bn, RSA_F4);
	RSA *rsa = RSA_new();
	RSA_generate_key_ex(rsa, 2048, bn, NULL);
	EVP_PKEY_assign_RSA(key, rsa);
	BN_free(bn);
	X509 *cert = X509_new();
	X509_set_version(cert, 2);
	ASN1_INTEGER *serial = ASN1_INTEGER_new();
	bn = BN_new();
	BN_rand(bn, 64, 0, 0);
	BN_to_ASN1_INTEGER(bn, serial);
	X509_set_serialNumber(cert, serial);
	ASN1_INTEGER_free(serial);
	BN_free(bn);
	X509_name_st *name = X509_get_subject_name(cert);
	X509_NAME_add_entry_by_txt(name, "C",  MBSTRING_ASC, (unsigned char *)"JP", -1, -1, 0);
	X509_NAME_add_entry_by_txt(name, "O",  MBSTRING_ASC, (unsigned char *)"proxy2ch certificate generator", -1, -1, 0);
	X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)"proxy2ch", -1, -1, 0);
	X509_set_subject_name(cert, name);
	X509_set_issuer_name(cert, name);
	X509_set_pubkey(cert, key);
	X509_gmtime_adj(X509_get_notBefore(cert), 0);
	X509_gmtime_adj(X509_get_notAfter(cert), 31536000*3);
	add_ext(cert, NID_basic_constraints, "critical,CA:TRUE");
	add_ext(cert, NID_key_usage, "critical,digitalSignature,keyCertSign,cRLSign");
	add_ext(cert, NID_ext_key_usage, "serverAuth,clientAuth");
	add_ext(cert, NID_subject_key_identifier, "hash");
	X509_sign(cert, key, EVP_sha256());

	PEM_write_X509(stdout, cert);
	PEM_write_PrivateKey(stdout, key, NULL, NULL, 0, NULL, NULL);

	X509_free(cert);
	EVP_PKEY_free(key);
}

BBS2chProxySecureSocket::BBS2chProxySecureSocket(int sock, const char *host) :
socket(sock), ctx(NULL), ssl(NULL)
{
	bool hostIsDomain = false;
	for (int i=strlen(host)-1; i>=0; i--) {
		if (host[i] != '.' && !(host[i] >= '0' && host[i] <= '9')) {
			hostIsDomain = true;
			break;
		}
	}
	X509 *cert = X509_new();
	X509_set_version(cert, 2);
	ASN1_INTEGER *serial = ASN1_INTEGER_new();
	BIGNUM *bn = BN_new();
	BN_rand(bn, 64, 0, 0);
	BN_to_ASN1_INTEGER(bn, serial);
	X509_set_serialNumber(cert, serial);
	ASN1_INTEGER_free(serial);
	BN_free(bn);
	X509_name_st *name = X509_get_subject_name(cert);
	X509_NAME_add_entry_by_txt(name, "C",  MBSTRING_ASC, (unsigned char *)"JP", -1, -1, 0);
	X509_NAME_add_entry_by_txt(name, "O",  MBSTRING_ASC, (unsigned char *)"proxy2ch", -1, -1, 0);
	X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)host, -1, -1, 0);
	X509_set_subject_name(cert, name);
	X509_set_issuer_name(cert, X509_get_subject_name(ca_cert));
	X509_set_pubkey(cert, server_privkey);
	X509_gmtime_adj(X509_get_notBefore(cert), 0);
	X509_gmtime_adj(X509_get_notAfter(cert), 31536000);
	add_ext(cert, NID_basic_constraints, "critical,CA:FALSE");
	add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment");
	add_ext(cert, NID_ext_key_usage, "serverAuth,clientAuth");
	add_ext(cert, NID_subject_key_identifier, "hash");
	std::string sni(hostIsDomain ? "DNS:" : "IP:");
	sni += host;
	sni += ",DNS:*.5ch.net,DNS:*.2ch.net,DNS:*.bbspink.com";
	add_ext(cert, NID_subject_alt_name, sni.c_str());
	X509_sign(cert, ca_privkey, EVP_sha256());

	ctx = SSL_CTX_new(TLS_server_method());
	if (!ctx) {
		X509_free(cert);
		throw std::runtime_error("Unable to create SSL context");
	}
	if (SSL_CTX_use_certificate(ctx, cert) <= 0) {
		fprintf(stderr, "Unable to load server certificate\n");
	}
	if (SSL_CTX_use_PrivateKey(ctx, server_privkey) <= 0) {
		fprintf(stderr, "Unable to load server private key\n");
	}
	X509_free(cert);
	ssl = SSL_new(ctx);
	SSL_set_fd(ssl, socket);
	if (SSL_accept(ssl) <= 0) {
		char errbuf[256];
		ERR_error_string_n(ERR_get_error(), errbuf, 256);
		SSL_free(ssl);
		SSL_CTX_free(ctx);
		std::string str("Unable to establish SSL/TLS connection: ");
		str += errbuf;
		throw std::runtime_error(str);
	}
}

BBS2chProxySecureSocket::~BBS2chProxySecureSocket()
{
}

int BBS2chProxySecureSocket::read(char *buffer, int length)
{
	return SSL_read(ssl, buffer, length);
}

int BBS2chProxySecureSocket::readLine(char *buffer, int maxLength)
{
	char *ptr = buffer;
	while (ptr < buffer + maxLength - 1) {
		int read = SSL_read(ssl, ptr, 1);
		if (read != 1) {
			return 0;
		}
		if (*ptr++ == '\n') {
			break;
		}
	}
	*ptr = 0;
	return 1;
}

int BBS2chProxySecureSocket::write(const char *buffer, int length)
{
	return SSL_write(ssl, buffer, length);
}

int BBS2chProxySecureSocket::writeString(const std::string &str)
{
	return SSL_write(ssl, str.data(), str.length());
}

void BBS2chProxySecureSocket::close(void)
{
	if (ssl) {
		SSL_shutdown(ssl);
		SSL_free(ssl);
		ssl = NULL;
	}
	if (socket >= 0) {
		CLOSESOCKET(socket);
		socket = -1;
	}
	if (ctx) {
		SSL_CTX_free(ctx);
		ctx = NULL;
	}
}
#endif