a828725a26c0168f594b3b2b27c81a4eb7973f7b
[rsync-patches.git] / openssl-support.diff
1 After applying this patch, run these commands for a successful build:
2
3     autoconf
4     autoheader
5     ./configure
6     make proto
7     make
8
9 Casey Marshall writes:
10
11 I've been hacking together a way to use rsync with OpenSSL, and have
12 attached my current patch against a recent CVS tree. The details of
13 this implementation are:
14
15   1. The SSL code is added as a "layer" that is forked into its own
16      process.
17
18   2. An SSL connection is established by the client issuing the
19      command:
20
21        #starttls
22
23      And, if the server allows SSL, it replies with
24
25        @RSYNCD: starttls
26
27      At which point both sides begin negotiating the SSL connection.
28      Servers that can't or don't want to use SSL just treat it as a
29      normal unknown command.
30
31   3. The SSL code is meant to be unobtrusive, and when this patch is
32      applied the program may still be built with no SSL code.
33
34   4. There are a number of details not implemented.
35
36 All warnings apply; I don't do C programming all that often, so I
37 can't say if I've left any cleanup/compatibility errors in the code.
38
39
40 --- orig/Makefile.in    2004-05-15 00:53:53
41 +++ Makefile.in 2004-07-03 20:22:28
42 @@ -39,7 +39,7 @@ OBJS3=progress.o pipe.o
43  DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o
44  popt_OBJS=popt/findme.o  popt/popt.o  popt/poptconfig.o \
45         popt/popthelp.o popt/poptparse.o
46 -OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) $(ZLIBOBJ) @BUILD_POPT@
47 +OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) $(ZLIBOBJ) @BUILD_POPT@ @SSL_OBJS@
48  
49  TLS_OBJ = tls.o syscall.o lib/permstring.o
50  
51 --- orig/cleanup.c      2004-07-02 18:11:26
52 +++ cleanup.c   2004-07-03 20:22:28
53 @@ -24,6 +24,9 @@
54  extern int io_error;
55  extern int keep_partial;
56  extern int log_got_error;
57 +#ifdef HAVE_OPENSSL
58 +extern int use_ssl;
59 +#endif
60  
61  /**
62   * Close all open sockets and files, allowing a (somewhat) graceful
63 @@ -98,6 +101,11 @@ void _exit_cleanup(int code, const char 
64         signal(SIGUSR1, SIG_IGN);
65         signal(SIGUSR2, SIG_IGN);
66  
67 +#ifdef HAVE_OPENSSL
68 +       if (use_ssl)
69 +               end_tls();
70 +#endif
71 +
72         if (verbose > 3) {
73                 rprintf(FINFO,"_exit_cleanup(code=%d, file=%s, line=%d): entered\n",
74                         code, file, line);
75 --- orig/clientserver.c 2004-06-18 15:59:19
76 +++ clientserver.c      2004-07-03 20:22:28
77 @@ -46,6 +46,9 @@ extern int io_timeout;
78  extern int orig_umask;
79  extern int no_detach;
80  extern int default_af_hint;
81 +#ifdef HAVE_OPENSSL
82 +extern int use_ssl;
83 +#endif
84  extern char *bind_address;
85  extern struct exclude_list_struct server_exclude_list;
86  extern char *exclude_path_prefix;
87 @@ -93,8 +96,18 @@ int start_socket_client(char *host, char
88                 exit_cleanup(RERR_SOCKETIO);
89  
90         ret = start_inband_exchange(user, path, fd, fd, argc);
91 +       if (ret < 0)
92 +               return ret;
93 +
94 +#ifdef HAVE_OPENSSL
95 +       if (use_ssl) {
96 +               int f_in = get_tls_rfd();
97 +               int f_out = get_tls_wfd();
98 +               return client_run(f_in, f_out, -1, argc, argv);
99 +       }
100 +#endif
101  
102 -       return ret < 0? ret : client_run(fd, fd, -1, argc, argv);
103 +       return client_run(fd, fd, -1, argc, argv);
104  }
105  
106  int start_inband_exchange(char *user, char *path, int f_in, int f_out, int argc)
107 @@ -148,6 +161,33 @@ int start_inband_exchange(char *user, ch
108         if (protocol_version > remote_protocol)
109                 protocol_version = remote_protocol;
110  
111 +#ifdef HAVE_OPENSSL
112 +       if (use_ssl) {
113 +               io_printf(f_out, "#starttls\n");
114 +               while (1) {
115 +                       if (!read_line(f_in, line, sizeof(line)-1)) {
116 +                               rprintf(FERROR, "rsync: did not receive reply to #starttls\n");
117 +                               return -1;
118 +                       }
119 +                       if (strncmp(line, "@ERROR", 6) == 0) {
120 +                               rprintf(FERROR, "rsync: ssl connection denied\n");
121 +                               return -1;
122 +                       }
123 +                       if (strcmp(line, "@RSYNCD: starttls") == 0) {
124 +                               break;
125 +                       }
126 +                       rprintf(FINFO, "%s\n", line);
127 +               }
128 +               if (start_tls(f_in, f_out)) {
129 +                       rprintf(FERROR, "rsync: error during SSL handshake: %s\n",
130 +                               get_ssl_error());
131 +                       return -1;
132 +               }
133 +               f_in = get_tls_rfd();
134 +               f_out = get_tls_wfd();
135 +       }
136 +#endif
137 +
138         p = strchr(path,'/');
139         if (p) *p = 0;
140         io_printf(f_out, "%s\n", path);
141 @@ -176,6 +216,10 @@ int start_inband_exchange(char *user, ch
142                          * server to terminate the listing of modules.
143                          * We don't want to go on and transfer
144                          * anything; just exit. */
145 +#ifdef HAVE_OPENSSL
146 +                       if (use_ssl)
147 +                               end_tls();
148 +#endif
149                         exit(0);
150                 }
151  
152 @@ -183,6 +227,10 @@ int start_inband_exchange(char *user, ch
153                         rprintf(FERROR, "%s\n", line);
154                         /* This is always fatal; the server will now
155                          * close the socket. */
156 +#ifdef HAVE_OPENSSL
157 +                       if (use_ssl)
158 +                               end_tls();
159 +#endif
160                         return RERR_STARTCLIENT;
161                 } else {
162                         rprintf(FINFO,"%s\n", line);
163 @@ -487,6 +535,7 @@ static void send_listing(int fd)
164                 io_printf(fd,"@RSYNCD: EXIT\n");
165  }
166  
167 +
168  /* this is called when a connection is established to a client
169     and we want to start talking. The setup of the system is done from
170     here */
171 @@ -544,6 +593,20 @@ int start_daemon(int f_in, int f_out)
172                         return -1;
173                 }
174  
175 +#if HAVE_OPENSSL
176 +               if (use_ssl && strcmp(line, "#starttls") == 0) {
177 +                       io_printf(f_out, "@RSYNCD: starttls\n");
178 +                       if (start_tls(f_in, f_out)) {
179 +                               rprintf(FLOG, "SSL connection failed: %s\n",
180 +                                       get_ssl_error());
181 +                               return -1;
182 +                       }
183 +                       f_in = get_tls_rfd();
184 +                       f_out = get_tls_wfd();
185 +                       continue;
186 +               }
187 +#endif
188 +
189                 if (*line == '#') {
190                         /* it's some sort of command that I don't understand */
191                         io_printf(f_out, "@ERROR: Unknown command '%s'\n", line);
192 --- orig/configure.in   2004-04-30 18:04:07
193 +++ configure.in        2004-07-03 20:22:28
194 @@ -271,6 +271,21 @@ yes
195         AC_SEARCH_LIBS(getaddrinfo, inet6)
196  fi
197  
198 +AC_ARG_ENABLE(openssl,
199 +              AC_HELP_STRING([--enable-openssl], [compile SSL support with OpenSSL.]))
200 +
201 +if test "x$enable_openssl" != xno
202 +then
203 +       have_ssl=yes
204 +       AC_CHECK_LIB(ssl, SSL_library_init, , [have_ssl=no])
205 +       if test "x$have_ssl" = xyes
206 +       then
207 +               AC_DEFINE(HAVE_OPENSSL, 1, [true if you want to use SSL.])
208 +               SSL_OBJS=ssl.o
209 +               AC_SUBST(SSL_OBJS)
210 +       fi
211 +fi
212 +
213  AC_MSG_CHECKING([whether to call shutdown on all sockets])
214  case $host_os in
215         *cygwin* ) AC_MSG_RESULT(yes)
216 --- orig/main.c 2004-06-30 07:24:30
217 +++ main.c      2004-07-03 20:22:28
218 @@ -52,6 +52,9 @@ extern int rsync_port;
219  extern int read_batch;
220  extern int write_batch;
221  extern int filesfrom_fd;
222 +#ifdef HAVE_OPENSSL
223 +extern int use_ssl;
224 +#endif
225  extern pid_t cleanup_child_pid;
226  extern char *files_from;
227  extern char *remote_filesfrom_file;
228 @@ -719,17 +722,32 @@ static int start_client(int argc, char *
229         pid_t pid;
230         int f_in,f_out;
231         int rc;
232 +       int url_prefix = strlen(URL_PREFIX);
233  
234         /* Don't clobber argv[] so that ps(1) can still show the right
235          * command line. */
236         if ((rc = copy_argv(argv)))
237                 return rc;
238  
239 +       if (strncasecmp(URL_PREFIX, argv[0], url_prefix) != 0) {
240 +#ifdef HAVE_OPENSSL
241 +               url_prefix = strlen(SSL_URL_PREFIX);
242 +               if (strncasecmp(SSL_URL_PREFIX, argv[0], url_prefix) != 0)
243 +                       url_prefix = 0;
244 +               else {
245 +                       if (!use_ssl)
246 +                               init_tls();
247 +                       use_ssl = 1;
248 +               }
249 +#else
250 +               url_prefix = 0;
251 +#endif
252 +       }
253         /* rsync:// always uses rsync server over direct socket connection */
254 -       if (strncasecmp(URL_PREFIX, argv[0], strlen(URL_PREFIX)) == 0) {
255 +       if (url_prefix) {
256                 char *host, *path;
257  
258 -               host = argv[0] + strlen(URL_PREFIX);
259 +               host = argv[0] + url_prefix;
260                 p = strchr(host,'/');
261                 if (p) {
262                         *p = 0;
263 @@ -777,12 +795,27 @@ static int start_client(int argc, char *
264                         argv++;
265                 } else { /* source is local */
266                         am_sender = 1;
267 +                       url_prefix = strlen(URL_PREFIX);
268 +                       if (strncasecmp(URL_PREFIX, argv[0], url_prefix) != 0) {
269 +#ifdef HAVE_OPENSSL
270 +                               url_prefix = strlen(SSL_URL_PREFIX);
271 +                               if (strncasecmp(SSL_URL_PREFIX, argv[0], url_prefix) != 0)
272 +                                       url_prefix = 0;
273 +                               else {
274 +                                       if (!use_ssl)
275 +                                               init_tls();
276 +                                       use_ssl = 1;
277 +                               }
278 +#else
279 +                               url_prefix = 0;
280 +#endif
281 +                       }
282  
283                         /* rsync:// destination uses rsync server over direct socket */
284 -                       if (strncasecmp(URL_PREFIX, argv[argc-1], strlen(URL_PREFIX)) == 0) {
285 +                       if (url_prefix) {
286                                 char *host, *path;
287  
288 -                               host = argv[argc-1] + strlen(URL_PREFIX);
289 +                               host = argv[argc-1] + url_prefix;
290                                 p = strchr(host,'/');
291                                 if (p) {
292                                         *p = 0;
293 --- orig/options.c      2004-06-20 19:30:00
294 +++ options.c   2004-07-03 20:22:28
295 @@ -133,6 +133,14 @@ int quiet = 0;
296  int always_checksum = 0;
297  int list_only = 0;
298  
299 +#ifdef HAVE_OPENSSL
300 +int use_ssl = 0;
301 +char *ssl_cert_path = NULL;
302 +char *ssl_key_path = NULL;
303 +char *ssl_key_passwd = NULL;
304 +char *ssl_ca_path = NULL;
305 +#endif
306 +
307  #define FIXED_CHECKSUM_SEED 32761
308  #define MAX_BATCH_PREFIX_LEN 256       /* Must be less than MAXPATHLEN-13 */
309  char *batch_prefix = NULL;
310 @@ -145,13 +153,13 @@ static int modify_window_set;
311   * address, or a hostname. **/
312  char *bind_address;
313  
314 -
315  static void print_rsync_version(enum logcode f)
316  {
317         char const *got_socketpair = "no ";
318         char const *hardlinks = "no ";
319         char const *links = "no ";
320         char const *ipv6 = "no ";
321 +       char const *ssl = "no ";
322         STRUCT_STAT *dumstat;
323  
324  #ifdef HAVE_SOCKETPAIR
325 @@ -170,6 +178,10 @@ static void print_rsync_version(enum log
326         ipv6 = "";
327  #endif
328  
329 +#ifdef HAVE_OPENSSL
330 +       ssl = "";
331 +#endif
332 +
333         rprintf(f, "%s  version %s  protocol version %d\n",
334                 RSYNC_NAME, RSYNC_VERSION, PROTOCOL_VERSION);
335         rprintf(f,
336 @@ -183,10 +195,10 @@ static void print_rsync_version(enum log
337         /* Note that this field may not have type ino_t.  It depends
338          * on the complicated interaction between largefile feature
339          * macros. */
340 -       rprintf(f, "              %sIPv6, %d-bit system inums, %d-bit internal inums\n",
341 +       rprintf(f, "              %sIPv6, %d-bit system inums, %d-bit internal inums, %sssl\n",
342                 ipv6,
343                 (int) (sizeof dumstat->st_ino * 8),
344 -               (int) (sizeof (uint64) * 8));
345 +               (int) (sizeof (uint64) * 8), ssl);
346  #ifdef MAINTAINER_MODE
347         rprintf(f, "              panic action: \"%s\"\n",
348                 get_panic_action());
349 @@ -299,6 +311,13 @@ void usage(enum logcode F)
350    rprintf(F," -4  --ipv4                  prefer IPv4\n");
351    rprintf(F," -6  --ipv6                  prefer IPv6\n");
352  #endif
353 +#ifdef HAVE_OPENSSL
354 +  rprintf(F,"     --ssl                   allow socket connections to use SSL\n");
355 +  rprintf(F,"     --ssl-cert=FILE         path to server's SSL certificate\n");
356 +  rprintf(F,"     --ssl-key=FILE          path to server's SSL private key\n");
357 +  rprintf(F,"     --ssl-key-passwd=PASS   password for PEM-encoded private key\n");
358 +  rprintf(F,"     --ssl-ca-certs=FILE     path to trusted CA certificates\n");
359 +#endif
360    rprintf(F," -h, --help                  show this help screen\n");
361  
362    rprintf(F,"\n");
363 @@ -310,7 +329,7 @@ void usage(enum logcode F)
364  enum {OPT_VERSION = 1000, OPT_SENDER, OPT_EXCLUDE, OPT_EXCLUDE_FROM,
365        OPT_DELETE_AFTER, OPT_DELETE_EXCLUDED, OPT_LINK_DEST,
366        OPT_INCLUDE, OPT_INCLUDE_FROM, OPT_MODIFY_WINDOW,
367 -      OPT_READ_BATCH, OPT_WRITE_BATCH, OPT_TIMEOUT,
368 +      OPT_READ_BATCH, OPT_WRITE_BATCH, OPT_TIMEOUT, OPT_USE_SSL,
369        OPT_REFUSED_BASE = 9000};
370  
371  static struct poptOption long_options[] = {
372 @@ -397,6 +416,13 @@ static struct poptOption long_options[] 
373    {"ipv4",            '4', POPT_ARG_VAL,    &default_af_hint, AF_INET, 0, 0 },
374    {"ipv6",            '6', POPT_ARG_VAL,    &default_af_hint, AF_INET6, 0, 0 },
375  #endif
376 +#ifdef HAVE_OPENSSL
377 +  {"ssl",              0,  POPT_ARG_NONE,   0,               OPT_USE_SSL, 0, 0},
378 +  {"ssl-cert",         0,  POPT_ARG_STRING, &ssl_cert_path,  OPT_USE_SSL, 0, 0},
379 +  {"ssl-key",          0,  POPT_ARG_STRING, &ssl_key_path,   OPT_USE_SSL, 0, 0},
380 +  {"ssl-key-passwd",   0,  POPT_ARG_STRING, &ssl_key_passwd, OPT_USE_SSL, 0, 0},
381 +  {"ssl-ca-certs",     0,  POPT_ARG_STRING, &ssl_ca_path,    OPT_USE_SSL, 0, 0},
382 +#endif
383    {0,0,0,0, 0, 0, 0}
384  };
385  
386 @@ -596,6 +622,12 @@ int parse_arguments(int *argc, const cha
387                         return 0;
388  #endif
389  
390 +               case OPT_USE_SSL:
391 +#ifdef HAVE_OPENSSL
392 +                       use_ssl = 1;
393 +#endif
394 +                       break;
395 +
396                 default:
397                         /* A large opt value means that set_refuse_options()
398                          * turned this option off (opt-BASE is its index). */
399 @@ -733,6 +765,17 @@ int parse_arguments(int *argc, const cha
400         if (do_progress && !verbose)
401                 verbose = 1;
402  
403 +#ifdef HAVE_OPENSSL
404 +       if (use_ssl) {
405 +               if (init_tls()) {
406 +                       snprintf(err_buf, sizeof(err_buf),
407 +                                "Openssl error: %s\n",
408 +                                get_ssl_error());
409 +                       return 0;
410 +               }
411 +       }
412 +#endif
413 +
414         if (bwlimit) {
415                 bwlimit_writemax = (size_t)bwlimit * 128;
416                 if (bwlimit_writemax < 512)
417 --- orig/rsync.h        2004-05-16 07:58:12
418 +++ rsync.h     2004-07-03 20:22:28
419 @@ -32,6 +32,7 @@
420  
421  #define DEFAULT_LOCK_FILE "/var/run/rsyncd.lock"
422  #define URL_PREFIX "rsync://"
423 +#define SSL_URL_PREFIX "rsyncs://"
424  
425  #define BACKUP_SUFFIX "~"
426  
427 @@ -326,6 +327,11 @@ enum msgcode {
428  #define uint64 unsigned off_t
429  #endif
430  
431 +#if HAVE_OPENSSL
432 +#include <openssl/ssl.h>
433 +#include <openssl/err.h>
434 +#endif
435 +
436  /* Starting from protocol version 26, we always use 64-bit
437   * ino_t and dev_t internally, even if this platform does not
438   * allow files to have 64-bit inums.  That's because the
439 --- orig/ssl.c  2004-07-02 21:44:19
440 +++ ssl.c       2004-07-02 21:44:19
441 @@ -0,0 +1,366 @@
442 +/* -*- c-file-style: "linux" -*-
443 + * ssl.c: operations for negotiating SSL rsync connections. 
444 + *
445 + * Copyright (C) 2003  Casey Marshall <rsdio@metastatic.org>
446 + *
447 + * This program is free software; you can redistribute it and/or modify
448 + * it under the terms of the GNU General Public License as published by
449 + * the Free Software Foundation; either version 2 of the License, or
450 + * (at your option) any later version.
451 + * 
452 + * This program is distributed in the hope that it will be useful,
453 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
454 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
455 + * GNU General Public License for more details.
456 + * 
457 + * You should have received a copy of the GNU General Public License
458 + * along with this program; if not, write to the Free Software
459 + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
460 + */
461 +
462 +#include "rsync.h"
463 +
464 +#ifdef HAVE_SYS_SELECT_H
465 +#include <sys/select.h>
466 +#else
467 +#include <sys/time.h>
468 +#include <sys/types.h>
469 +#include <unistd.h>
470 +#endif
471 +#include <string.h>
472 +
473 +#define BUF_SIZE 1024
474 +
475 +extern int verbose;
476 +extern int am_daemon;
477 +extern int am_server;
478 +
479 +extern char *ssl_cert_path;
480 +extern char *ssl_key_path;
481 +extern char *ssl_key_passwd;
482 +extern char *ssl_ca_path;
483 +
484 +static SSL_CTX *ssl_ctx;
485 +static SSL *ssl;
486 +static int tls_read[2] = { -1, -1 };
487 +static int tls_write[2] = { -1, -1 };
488 +static int ssl_running;
489 +static int ssl_pid = -1;
490 +
491 +/**
492 + * A non-interactive callback to be passed to SSL_CTX_set_default_password_cb,
493 + * which merely copies the value of ssl_key_passwd into buf. This is
494 + * used for when the private key password is supplied via an option.
495 + */
496 +static int default_password_cb(char *buf, int n, UNUSED(int f), UNUSED(void *u))
497 +{
498 +       if (ssl_key_passwd == NULL || n < strlen(ssl_key_passwd))
499 +               return 0;
500 +       strncpy(buf, ssl_key_passwd, n-1);
501 +       return strlen(ssl_key_passwd);
502 +}
503 +
504 +/**
505 + * If verbose, this method traces the status of the SSL handshake.
506 + */
507 +static void info_callback(SSL *ssl, int cb, int val)
508 +{
509 +       char buf[128];
510 +       char *cbs;
511 +
512 +       switch (cb) {
513 +       case SSL_CB_LOOP:
514 +               cbs = "SSL_CB_LOOP";
515 +               break;
516 +       case SSL_CB_EXIT:
517 +               cbs = "SSL_CB_EXIT";
518 +               break;
519 +       case SSL_CB_READ:
520 +               cbs = "SSL_CB_READ";
521 +               break;
522 +       case SSL_CB_WRITE:
523 +               cbs = "SSL_CB_WRITE";
524 +               break;
525 +       case SSL_CB_ALERT:
526 +               cbs = "SSL_CB_ALERT";
527 +               break;
528 +       case SSL_CB_READ_ALERT:
529 +               cbs = "SSL_CB_READ_ALERT";
530 +               break;
531 +       case SSL_CB_WRITE_ALERT:
532 +               cbs = "SSL_CB_WRITE_ALERT";
533 +               break;
534 +       case SSL_CB_ACCEPT_LOOP:
535 +               cbs = "SSL_CB_ACCEPT_LOOP";
536 +               break;
537 +       case SSL_CB_ACCEPT_EXIT:
538 +               cbs = "SSL_CB_ACCEPT_EXIT";
539 +               break;
540 +       case SSL_CB_CONNECT_LOOP:
541 +               cbs = "SSL_CB_CONNECT_LOOP";
542 +               break;
543 +       case SSL_CB_CONNECT_EXIT:
544 +               cbs = "SSL_CB_CONNECT_EXIT";
545 +               break;
546 +       case SSL_CB_HANDSHAKE_START:
547 +               cbs = "SSL_CB_HANDSHAKE_START";
548 +               break;
549 +       case SSL_CB_HANDSHAKE_DONE:
550 +               cbs = "SSL_CB_HANDSHAKE_DONE";
551 +               break;
552 +       default:
553 +               snprintf(buf, sizeof buf, "??? (%d)", cb);
554 +               cbs = buf;
555 +               break;
556 +       }
557 +       if (verbose > 2) {
558 +               rprintf(FLOG, "SSL: info_callback(%p,%s,%d)\n", ssl, cbs, val);
559 +               if (cb == SSL_CB_HANDSHAKE_DONE) {
560 +                       SSL_CIPHER_description(SSL_get_current_cipher(ssl),
561 +                                              buf, sizeof buf);
562 +                       rprintf(FLOG, "SSL: cipher: %s", buf);
563 +               }
564 +       }
565 +}
566 +
567 +/**
568 + * Initializes the SSL context for TLSv1 connections; returns zero on
569 + * success.
570 + */
571 +int init_tls(void)
572 +{
573 +       if (ssl_ctx)
574 +               return 0;
575 +       SSL_library_init();
576 +       SSL_load_error_strings();
577 +       ssl_ctx = SSL_CTX_new(TLSv1_method());
578 +       if (!ssl_ctx)
579 +               return 1;
580 +       SSL_CTX_set_info_callback(ssl_ctx, info_callback);
581 +
582 +       /* Sets the certificate sent to the other party. */
583 +       if (ssl_cert_path != NULL
584 +           && SSL_CTX_use_certificate_file(ssl_ctx, ssl_cert_path,
585 +                                           SSL_FILETYPE_PEM) != 1)
586 +               return 1;
587 +       /* Set up the simple non-interactive callback if the password
588 +        * was supplied on the command line. */
589 +       if (ssl_key_passwd != NULL)
590 +               SSL_CTX_set_default_passwd_cb(ssl_ctx, default_password_cb);
591 +       /* Sets the private key that matches the public certificate. */
592 +       if (ssl_key_path != NULL) {
593 +               if (SSL_CTX_use_PrivateKey_file(ssl_ctx, ssl_key_path,
594 +                                               SSL_FILETYPE_PEM) != 1)
595 +                       return 1;
596 +               if (SSL_CTX_check_private_key(ssl_ctx) != 1)
597 +                       return 1;
598 +       }
599 +       if (ssl_ca_path != NULL
600 +           && !SSL_CTX_load_verify_locations(ssl_ctx, ssl_ca_path, NULL))
601 +               return 1;
602 +
603 +       return 0;
604 +}
605 +
606 +/**
607 + * Returns the error string for the current SSL error, if any.
608 + */
609 +char *get_ssl_error(void)
610 +{
611 +       return ERR_error_string(ERR_get_error(), NULL);
612 +}
613 +
614 +/**
615 + * Returns the input file descriptor for the SSL connection.
616 + */
617 +int get_tls_rfd(void)
618 +{
619 +       return tls_read[0];
620 +}
621 +
622 +/**
623 + * Returns the output file descriptor for the SSL connection.
624 + */
625 +int get_tls_wfd(void)
626 +{
627 +       return tls_write[1];
628 +}
629 +
630 +/**
631 + * Signal handler that ends the SSL connection.
632 + */
633 +static RETSIGTYPE tls_sigusr1(int UNUSED(val))
634 +{
635 +       if (ssl) {
636 +               SSL_shutdown(ssl);
637 +               SSL_free(ssl);
638 +               ssl = NULL;
639 +       }
640 +       ssl_running = 0;
641 +}
642 +
643 +/**
644 + * Negotiates the TLS connection, creates a socket pair for communicating
645 + * with the rsync process, then forks into a new process that will handle
646 + * the communication.
647 + *
648 + * 0 is returned on success.
649 + */
650 +int start_tls(int f_in, int f_out)
651 +{
652 +       int tls_fd;
653 +       int n = 0, r;
654 +       unsigned char buf1[BUF_SIZE], buf2[BUF_SIZE];
655 +       int avail1 = 0, avail2 = 0, write1 = 0, write2 = 0;
656 +       fd_set rd, wd;
657 +
658 +       if (fd_pair(tls_read))
659 +               return 1;
660 +       if (fd_pair(tls_write))
661 +               return 1;
662 +
663 +       set_blocking(tls_read[0]);
664 +       set_blocking(tls_read[1]);
665 +       set_blocking(tls_write[0]);
666 +       set_blocking(tls_write[1]);
667 +       set_blocking(f_in);
668 +       set_blocking(f_out);
669 +
670 +       ssl_pid = do_fork();
671 +       if (ssl_pid < 0)
672 +               return -1;
673 +       if (ssl_pid != 0) {
674 +               close(tls_write[0]);
675 +               close(tls_read[1]);
676 +               return 0;
677 +       }
678 +
679 +       signal(SIGUSR1, tls_sigusr1);
680 +       ssl = SSL_new(ssl_ctx);
681 +       if (!ssl)
682 +               goto closed;
683 +       if (am_daemon || am_server)
684 +               SSL_set_accept_state(ssl);
685 +       else
686 +               SSL_set_connect_state(ssl);
687 +       SSL_set_rfd(ssl, f_in);
688 +       SSL_set_wfd(ssl, f_out);
689 +
690 +       tls_fd = SSL_get_fd(ssl);
691 +       n = tls_write[0];
692 +       n = MAX(tls_read[1], n);
693 +       n = MAX(tls_fd, n) + 1;
694 +
695 +       ssl_running = 1;
696 +       while (ssl_running) {
697 +               FD_ZERO(&rd);
698 +               FD_ZERO(&wd);
699 +               FD_SET(tls_write[0], &rd);
700 +               FD_SET(tls_read[1], &wd);
701 +               FD_SET(tls_fd, &rd);
702 +               FD_SET(tls_fd, &wd);
703 +
704 +               r = select(n, &rd, &wd, NULL, NULL);
705 +
706 +               if (r == -1 && errno == EINTR)
707 +                       continue;
708 +               if (FD_ISSET(tls_write[0], &rd)) {
709 +                       r = read(tls_write[0], buf1+avail1, BUF_SIZE-avail1);
710 +                       if (r >= 0)
711 +                               avail1 += r;
712 +                       else {
713 +                               rprintf(FERROR, "pipe read error: %s\n",
714 +                                       strerror(errno));
715 +                               break;
716 +                       }
717 +               }
718 +               if (FD_ISSET(tls_fd, &rd)) {
719 +                       r = SSL_read(ssl, buf2+avail2, BUF_SIZE-avail2);
720 +                       if (r > 0)
721 +                               avail2 += r;
722 +                       else {
723 +                               switch (SSL_get_error(ssl, r)) {
724 +                               case SSL_ERROR_ZERO_RETURN:
725 +                                       goto closed;
726 +                               case SSL_ERROR_WANT_READ:
727 +                               case SSL_ERROR_WANT_WRITE:
728 +                                       break;
729 +                               case SSL_ERROR_SYSCALL:
730 +                                       if (r == 0)
731 +                                               rprintf(FERROR, "SSL spurious EOF\n");
732 +                                       else
733 +                                               rprintf(FERROR, "SSL I/O error: %s\n",
734 +                                                       strerror(errno));
735 +                                       goto closed;
736 +                               case SSL_ERROR_SSL:
737 +                                       rprintf(FERROR, "SSL: %s\n",
738 +                                               ERR_error_string(ERR_get_error(), NULL));
739 +                                       goto closed;
740 +                               default:
741 +                                       rprintf(FERROR, "unexpected ssl error %d\n", r);
742 +                                       goto closed;
743 +                               }
744 +                       }
745 +               }
746 +               if (FD_ISSET(tls_read[1], &wd) && write2 < avail2) {
747 +                       r = write(tls_read[1], buf2+write2, avail2-write2);
748 +                       if (r >= 0)
749 +                               write2 += r;
750 +                       else {
751 +                               rprintf(FERROR, "pipe write error: %s\n",
752 +                                       strerror(errno));
753 +                               break;
754 +                       }
755 +               }
756 +               if (FD_ISSET(tls_fd, &wd) && write1 < avail1) {
757 +                       r = SSL_write(ssl, buf1+write1, avail1-write1);
758 +                       if (r > 0)
759 +                               write1 += r;
760 +                       else {
761 +                               switch (SSL_get_error(ssl, r)) {
762 +                               case SSL_ERROR_ZERO_RETURN:
763 +                                       goto closed;
764 +                               case SSL_ERROR_WANT_READ:
765 +                               case SSL_ERROR_WANT_WRITE:
766 +                                       break;
767 +                               case SSL_ERROR_SYSCALL:
768 +                                       if (r == 0)
769 +                                               rprintf(FERROR, "SSL: spurious EOF\n");
770 +                                       else
771 +                                               rprintf(FERROR, "SSL: I/O error: %s\n",
772 +                                                       strerror(errno));
773 +                                       goto closed;
774 +                               case SSL_ERROR_SSL:
775 +                                       rprintf(FERROR, "SSL: %s\n",
776 +                                               ERR_error_string(ERR_get_error(), NULL));
777 +                                       goto closed;
778 +                               default:
779 +                                       rprintf(FERROR, "unexpected ssl error %d\n", r);
780 +                                       goto closed;
781 +                               }
782 +                       }
783 +               }
784 +               if (avail1 == write1)
785 +                       avail1 = write1 = 0;
786 +               if (avail2 == write2)
787 +                       avail2 = write2 = 0;
788 +       }
789 +
790 +       /* XXX I'm pretty sure that there is a lot that I am not considering
791 +          here. Bugs? Yes, probably. */
792 +
793 +       /* We're finished. */
794 +    closed:
795 +       close(tls_read[1]);
796 +       close(tls_write[0]);
797 +       exit(0);
798 +}
799 +
800 +/**
801 + * Ends the TLS connection.
802 + */
803 +void end_tls(void)
804 +{
805 +       if (ssl_pid > 0)
806 +               kill(ssl_pid, SIGUSR1);
807 +}