xdm_netstream.c

Go to the documentation of this file.

/*----------------------------------------------------------------------------
 * Copyright (c) 2006, Novell, Inc.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without 
 * modification, are permitted provided that the following conditions are 
 * met:
 * 
 *     * Redistributions of source code must retain the above copyright 
 *       notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above copyright 
 *       notice, this list of conditions and the following disclaimer in the 
 *       documentation and/or other materials provided with the distribution.
 *     * Neither the name of the Novell nor the names of its contributors 
 *       may be used to endorse or promote products derived from this 
 *       software without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *--------------------------------------------------------------------------*/

#include <string.h>

#ifdef _WIN32
#  define WIN32_LEAN_AND_MEAN
#  include <windows.h>
#  include <winsock2.h>
#  include <ws2tcpip.h>
#  define XDMAPI __cdecl
#  define XDMEXP __declspec(dllexport)
#  define socket_t SOCKET
#  define strcasecmp _stricmp
#  ifdef ENABLE_SSL
#    define HAVE_LIBSSL 1
#  endif
#else
#  if HAVE_CONFIG_H
#    include <config.h>
#  endif
#  include <sys/types.h>
#  include <sys/socket.h>
#  include <netdb.h>
#  include <errno.h>
#  define XDMAPI
#  define XDMEXP
#  define socket_t int
#  define closesocket close
#  define INVALID_SOCKET -1
#  define WSAECONNRESET ECONNRESET
#  define WSAGetLastError() errno
#endif

#include <stddef.h>
#include <string.h>

#define CNF_SECURE      "xdasd.loggers.netstream.secure"
#define CNF_SERVER      "xdasd.loggers.netstream.server"
#define CNF_PORT        "xdasd.loggers.netstream.port"

#define XDM_DEF_SRVSTR  "localhost"
#define XDM_DEF_PORTSTR "1468"   /* syslog */

static void (*s_fplogmsg)(int level, const char * msg, ... ) = 0;

static char * (*s_fpgetcnfstr)(const char *, char *, size_t *) = 0;

static socket_t s_skt = INVALID_SOCKET;
static char s_srvstr[512];
static char s_portstr[32];

#if HAVE_LIBSSL
#  include <openssl/ssl.h>
#  ifdef _WIN32
#    include <openssl/rand.h>
#  endif
#  define CNF_TRUSTFILE "xdasd.loggers.netstream.trustfile"
#  define CNF_KEYFILE   "xdasd.loggers.netstream.keyfile"
#  define CNF_KEYPWD    "xdasd.loggers.netstream.keypwd"
#  define CNF_CIPHERS   "xdasd.loggers.netstream.ciphers"

static SSL_CTX * s_ctx = 0;
static SSL * s_ssl = 0;
static int s_srvauth_required = 0;

static int pem_passwd_cb(char * buf, int size, int rwflag, void * passwd)
{
   (void)rwflag;  /* not used */

   *buf = 0;
   if (passwd != 0)
      strncpy(buf, (char *)passwd, size);
   buf[size - 1] = 0;
   return strlen(buf);
}

static SSL_CTX * initialize_ctx(const char * trustfile, 
      const char * keyfile, const char * password, 
      const char * ciphers)
{
   SSL_CTX * ctx;

   /* Global system initialization */
   SSL_library_init();
   SSL_load_error_strings();
   
   /* Create our context */
   ctx = SSL_CTX_new(SSLv23_method());
   
   /* Client authentication configured? */
   if (keyfile && *keyfile)
   {
      /* Load our certificates. */
      if (!SSL_CTX_use_certificate_chain_file(ctx, keyfile))
      {
         s_fplogmsg(0, "netstream: Can't read certificates from %s.\n", keyfile);
         SSL_CTX_free(ctx);
         return 0;
      }

      /* Keyfile has password? */
      if (password && *password)
      {
         /* Set default password callback handler to provide keyfile password. */
         SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_cb);
         SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *)password);
      }
      
      /* Load our keys. */
      if (!SSL_CTX_use_PrivateKey_file(ctx, keyfile, SSL_FILETYPE_PEM))
      {
         s_fplogmsg(0, "netstream: Can't read keys from %s.\n", keyfile);
         SSL_CTX_free(ctx);
         return 0;
      }
   }

   /* Server authentication configured? */
   if (trustfile && *trustfile)
   {
      /* Load the server CAs we trust. */
      s_srvauth_required = 1;
      if (!SSL_CTX_load_verify_locations(ctx, trustfile, 0))
      {
         s_fplogmsg(0, "netstream: Can't read CA trust list from %s.\n", trustfile);
         SSL_CTX_free(ctx);
         return 0;
      }
   }

   /* Cipher suite configured? */
   if (ciphers && *ciphers)
   {
      /* Configure SSL context with requested ciphers. */
      if (!SSL_CTX_set_cipher_list(s_ctx, ciphers))
      {
         s_fplogmsg(0, "netstream: no requested cipher available.\n");
         SSL_CTX_free(ctx);
         return 0;
      }
   }

#if (OPENSSL_VERSION_NUMBER < 0x00905100L)
   SSL_CTX_set_verify_depth(ctx, 1);
#endif
   
#ifdef _WIN32
   /* add randomness to PRNG with RAND_add - 
   TODO: We need a better source of randomness than trustfile. */
   RAND_add(trustfile, strlen(trustfile), strlen(trustfile));
#endif

   return ctx;
}

static int ns_check_cert(SSL * ssl, const char * host)
{
   X509 * peer;
   char peer_CN[256];
   
   if (SSL_get_verify_result(ssl) != X509_V_OK)
      s_fplogmsg(0, "netstream: Can't verify server (%s) certificate.\n", host);
   
   /* Check the cert chain. The chain length is automatically checked 
      by OpenSSL when we set the verify depth in the ctx */
   
   /* Acquire the peer certificate */
   if ((peer = SSL_get_peer_certificate(ssl)) == 0)
   {
      s_fplogmsg(0, "netstream: Server (%s) presents no certificate.\n", host);
      return -1;
   }

   /* Check the common name */
   X509_NAME_get_text_by_NID(X509_get_subject_name(peer), 
         NID_commonName, peer_CN, 256);
   if (strcasecmp(peer_CN, host) != 0)
   {
      s_fplogmsg(0, "netstream: Common name (%s) doesn't "
            "match host name (%s).\n", peer_CN, host);
      return -1;
   }

   return 0;
}
#endif

static void ns_disconnect(void)
{
#if HAVE_LIBSSL
   if (s_ssl != 0)
      SSL_free(s_ssl), s_ssl = 0;
#endif

   if (s_skt != INVALID_SOCKET)
      closesocket(s_skt), s_skt = INVALID_SOCKET;
}

static int ns_connect(const char * host, const char * service)
{
   int err;
   struct addrinfo hints;
   struct addrinfo * alist = 0;

   ns_disconnect();  /* cleanup and reinit in case we're reconnecting */

   memset(&hints, 0, sizeof(hints));
   hints.ai_family = AF_INET;
   hints.ai_socktype = SOCK_STREAM;
   hints.ai_protocol = IPPROTO_TCP;

   /* convert address, open network connection, free addrinfo list */
   if ((err = getaddrinfo(host, service, &hints, &alist)) != 0)
      s_fplogmsg(0, "netstream: Unable to formulate server address, error %d.\n", err);
   else
   {
      s_skt = socket(alist->ai_family, alist->ai_socktype, alist->ai_protocol);
      if (s_skt == INVALID_SOCKET)
      {
         err = WSAGetLastError();
         s_fplogmsg(0, "netstream: socket error %d.\n", err);
      }
      else 
      {
         s_fplogmsg(0, "netstream: connecting to %s:%s.\n", host, service);
         err = connect(s_skt, (struct sockaddr *)alist->ai_addr, (int)alist->ai_addrlen);
         if (err != 0)
         {
            err = WSAGetLastError();
            s_fplogmsg(0, "netstream: connect failed, %d.\n", err);
         }
      }
      freeaddrinfo(alist);
   }

#if HAVE_LIBSSL
   if (err != 0 && s_ctx != 0)
   {
      if ((s_ssl = SSL_new(s_ctx)) == 0)
      {
         s_fplogmsg(0, "netstream: SSL_new failed.\n");
         ns_disconnect();
         err = -1;
      }
      else
      {
         BIO * sbio;
         if ((sbio = BIO_new_socket((int)s_skt, BIO_NOCLOSE)) == 0)
         {
            s_fplogmsg(0, "netstream: BIO_new_socket failed.\n");
            ns_disconnect();
            err = -1;
         }
         else
         {
            SSL_set_bio(s_ssl, sbio, sbio);
            if (SSL_connect(s_ssl) <= 0)
            {
               s_fplogmsg(0, "netstream: SSL_connect failed, %d.\n", err);
               ns_disconnect();
               err = -1;
            }
            else if (s_srvauth_required
                  && (err = ns_check_cert(s_ssl, host)) != 0)
               ns_disconnect();
         }
      }
   }
#endif

   return err;
}

static int ns_write(const char * msg, size_t msgsz)
{
   int err = 0;
   const char * send_api = "send";

#if HAVE_LIBSSL
   if (s_ctx != 0)
   {
      int r;
      send_api = "SSL_write";
      if ((r = SSL_write(s_ssl, msg, (int)msgsz)) > 0)
          r = SSL_write(s_ssl, "\r\n", 2);
      err = SSL_get_error(s_ssl, r);
   }
   else
#endif
   {
      if (send(s_skt, msg, (int)msgsz, 0) < 0
            || send(s_skt, "\r\n", 2, 0) < 0)
         err = WSAGetLastError();
   }
   if (err != 0)
      s_fplogmsg(0, "netstream: %s failed (%d) on record [ %.*s ].\n", 
            send_api, err, msgsz, msg);
   return err;
}

XDMEXP int XDMAPI xdm_append(const char ** msgflds)
{
   int err;

   /* has socket been permanently closed? */
   if (s_skt == INVALID_SOCKET)
      return -1;

   if ((err = ns_write(msgflds[0], msgflds[33] - msgflds[0] - 2)) != 0)
   {
      /* attempt a single reconnect and then try to write the record */
      s_fplogmsg(0, "netstream: attempting to reconnect...\n");
      if (ns_connect(s_srvstr, s_portstr) < 0)
      {
         s_fplogmsg(0, "netstream: reconnect failed, closing stream.\n");
         return -1;
      }
      err = ns_write(msgflds[0], msgflds[33] - msgflds[0] - 2);
   }
   return err;
}

XDMEXP void XDMAPI xdm_exit(void)
{
   ns_disconnect();

#if HAVE_LIBSSL
   if (s_ctx != 0)
      SSL_CTX_free(s_ctx), s_ctx = 0;
#endif

#ifdef _WIN32
   WSACleanup();
#endif
}

XDMEXP int XDMAPI xdm_init(void (*logmsg)(int level, const char * msg, ... ),
      char * (*getcnfstr)(const char *, char *, size_t *))
{
   int err;
   size_t srvstrsz = sizeof(s_srvstr);
   size_t portstrsz = sizeof(s_portstr);

   /* save function pointers */
   s_fplogmsg = logmsg;
   s_fpgetcnfstr = getcnfstr;

#ifdef _WIN32
   {
      WSADATA wsadata;
      if ((err = WSAStartup(MAKEWORD(2, 2), &wsadata)) != 0)
      {
         s_fplogmsg(0, "netstream: winsock init failed, %d.\n", err);
         return err;
      }
   }
#endif

#if HAVE_LIBSSL
   {
      int secure = 0;
      char secstr[32];
      size_t secstrsz = sizeof(secstr);

      /* configured to use security? */
      s_fpgetcnfstr(CNF_SECURE, secstr, &secstrsz);
      if (secstrsz != 0)
         secure = (toupper(*secstr) == 'Y' || toupper(*secstr) == 'T');

      if (secure)
      {
         char trustfile[512];
         char keyfile[512];
         char keypwd[512];
         char ciphers[512];
         size_t trustfilesz = sizeof(trustfile);
         size_t keyfilesz = sizeof(keyfile);
         size_t keypwdsz = sizeof(keypwd);
         size_t cipherssz = sizeof(ciphers);

         /* read all configuration parameters into buffers */
         *trustfile = *keyfile = *keypwd = *ciphers = 0;
         s_fpgetcnfstr(CNF_TRUSTFILE, trustfile, &trustfilesz);
         s_fpgetcnfstr(CNF_KEYFILE, keyfile, &keyfilesz);
         s_fpgetcnfstr(CNF_KEYPWD, keypwd, &keypwdsz);
         s_fpgetcnfstr(CNF_CIPHERS, ciphers, &cipherssz);

         /* build ssl context - s_ctx used later to determine if secure */
         if ((s_ctx = initialize_ctx(trustfile, keyfile, keypwd, ciphers)) == 0)
         {
            s_fplogmsg(0, "netstream: SSL context initialization failed.\n");
            xdm_exit();
            return -1;
         }
      }
   }
#endif

   /* read configuration criteria here */
   s_fpgetcnfstr(CNF_SERVER, s_srvstr, &srvstrsz);
   if (srvstrsz == 0)
      strcpy(s_srvstr, XDM_DEF_SRVSTR);

   s_fpgetcnfstr(CNF_PORT, s_portstr, &portstrsz);
   if (portstrsz == 0)
      strcpy(s_portstr, XDM_DEF_PORTSTR);

   /* connect to the specified server on the specified port */
   if ((err = ns_connect(s_srvstr, s_portstr)) < 0)
      xdm_exit();

   return err;
}