From cfc9271bb53c423a45be46252a544dab45c10b86 Mon Sep 17 00:00:00 2001 From: Levi Neely <141506390+lneely@users.noreply.github.com> Date: Tue, 2 Jul 2024 15:38:45 +0200 Subject: [PATCH] fixed handshake, now peer cert returning null --- cmd/pcloudcc/pclsync_lib.cpp | 2 -- lib/pclsync/pssl.c | 44 +++++++++++++++++++++++++----------- lib/pclsync/psynclib.c | 3 ++- 3 files changed, 33 insertions(+), 16 deletions(-) diff --git a/cmd/pcloudcc/pclsync_lib.cpp b/cmd/pcloudcc/pclsync_lib.cpp index 23f2589..54c15a1 100644 --- a/cmd/pcloudcc/pclsync_lib.cpp +++ b/cmd/pcloudcc/pclsync_lib.cpp @@ -337,8 +337,6 @@ int clib::pclsync_lib::init() { psync_set_string_setting("fsroot", get_mount().c_str()); } - // _tunnel = psync_ssl_tunnel_start("127.0.0.1", 9443, "62.210.116.50", 443); - isfsautostart = psync_get_bool_setting("autostartfs"); psync_start_sync(status_change, event_handler); diff --git a/lib/pclsync/pssl.c b/lib/pclsync/pssl.c index 0ff60c9..e059fd9 100644 --- a/lib/pclsync/pssl.c +++ b/lib/pclsync/pssl.c @@ -40,6 +40,7 @@ #include #include #include +#include #include "pcompat.h" #include "pcompiler.h" @@ -134,6 +135,7 @@ typedef struct { } ctr_drbg_context_locked; typedef struct { + mbedtls_net_context srv; mbedtls_ssl_context ssl; mbedtls_ssl_config cfg; psync_socket_t sock; @@ -212,22 +214,29 @@ int psync_ssl_init() { #endif if (pthread_mutex_init(&psync_mbed_rng.mutex, NULL)) return PRINT_RETURN(-1); + mbedtls_entropy_init(&psync_mbed_entropy); psync_get_random_seed(seed, seed, sizeof(seed), 0); mbedtls_entropy_update_manual(&psync_mbed_entropy, seed, sizeof(seed)); + mbedtls_ctr_drbg_init(&psync_mbed_rng.rnd); if ((result = mbedtls_ctr_drbg_seed(&psync_mbed_rng.rnd, mbedtls_entropy_func, &psync_mbed_entropy, NULL, 0))) { debug(D_ERROR, "mbedtls_ctr_drbg_seed failed with return code %d", result); return PRINT_RETURN(-1); } + mbedtls_x509_crt_init(&psync_mbed_trusted_certs_x509); - for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_certs); i++) - if (mbedtls_x509_crt_parse( - &psync_mbed_trusted_certs_x509, - (const unsigned char *)psync_ssl_trusted_certs[i], - strlen(psync_ssl_trusted_certs[i]))) - debug(D_ERROR, "failed to load certificate %lu", (unsigned long)i); + for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_certs); i++) { + result = mbedtls_x509_crt_parse(&psync_mbed_trusted_certs_x509, + (unsigned char *)psync_ssl_trusted_certs[i], + 1 + strlen(psync_ssl_trusted_certs[i])); + if (result) { + debug(D_ERROR, "failed to load certificate %lu, got result %d", + (unsigned long)i, result); + } + } + return 0; } @@ -258,9 +267,9 @@ static void psync_set_ssl_error(ssl_connection_t *conn, int err) { psync_ssl_errno = PSYNC_SSL_ERR_UNKNOWN; conn->isbroken = 1; if (err == MBEDTLS_ERR_NET_RECV_FAILED) - debug(D_NOTICE, "got POLARSSL_ERR_NET_RECV_FAILED"); + debug(D_NOTICE, "got MBEDTLS_ERR_NET_RECV_FAILED"); else if (err == MBEDTLS_ERR_NET_SEND_FAILED) - debug(D_NOTICE, "got POLARSSL_ERR_NET_SEND_FAILED"); + debug(D_NOTICE, "got MBEDTLS_ERR_NET_SEND_FAILED"); else debug(D_NOTICE, "got error %d", err); } @@ -321,6 +330,8 @@ static int psync_ssl_check_peer_public_key(ssl_connection_t *conn) { unsigned char buff[1024], sigbin[32]; char sighex[66]; int i; + + // TODO: returning null, why? cert = mbedtls_ssl_get_peer_cert(&conn->ssl); if (!cert) { debug(D_WARNING, "ssl_get_peer_cert returned NULL"); @@ -354,24 +365,28 @@ int psync_ssl_connect(psync_socket_t sock, void **sslconn, ssl_connection_t *conn; mbedtls_ssl_session *sess; int ret; + conn = psync_ssl_alloc_conn(hostname); mbedtls_ssl_init(&conn->ssl); mbedtls_ssl_config_init(&conn->cfg); + mbedtls_net_init(&conn->srv); conn->sock = sock; + mbedtls_ssl_conf_endpoint(&conn->cfg, MBEDTLS_SSL_IS_CLIENT); mbedtls_ssl_conf_dbg(&conn->cfg, debug_cb, debug_ctx); mbedtls_ssl_conf_authmode(&conn->cfg, MBEDTLS_SSL_VERIFY_REQUIRED); mbedtls_ssl_conf_min_version(&conn->cfg, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3); - // TODO: hostname removed, does it need to go elsewhere? - // it seems so... mbedtls_ssl_conf_ca_chain(&conn->cfg, &psync_mbed_trusted_certs_x509, NULL); mbedtls_ssl_conf_ciphersuites(&conn->cfg, psync_mbed_ciphersuite); mbedtls_ssl_conf_rng(&conn->cfg, ctr_drbg_random_locked, &psync_mbed_rng); - mbedtls_ssl_set_bio(&conn->ssl, &conn->sock, psync_mbed_write, - psync_mbed_read, NULL); + + mbedtls_ssl_set_bio(&conn->ssl, &conn->srv, psync_mbed_write, psync_mbed_read, + NULL); mbedtls_ssl_set_hostname(&conn->ssl, hostname); + mbedtls_ssl_setup(&conn->ssl, &conn->cfg); // attach config to ssl + if ((sess = (mbedtls_ssl_session *)psync_cache_get(conn->cachekey))) { debug(D_NOTICE, "reusing cached session for %s", hostname); if (mbedtls_ssl_set_session(&conn->ssl, sess)) @@ -379,10 +394,13 @@ int psync_ssl_connect(psync_socket_t sock, void **sslconn, mbedtls_ssl_session_free(sess); psync_free(sess); } + ret = mbedtls_ssl_handshake(&conn->ssl); if (ret == 0) { - if (psync_ssl_check_peer_public_key(conn)) + int result; + if ((result = psync_ssl_check_peer_public_key(conn))) { goto err1; + } *sslconn = conn; psync_ssl_save_session(conn); return PSYNC_SSL_SUCCESS; diff --git a/lib/pclsync/psynclib.c b/lib/pclsync/psynclib.c index c60dbc7..a15a78e 100644 --- a/lib/pclsync/psynclib.c +++ b/lib/pclsync/psynclib.c @@ -210,7 +210,8 @@ static void psync_stop_crypto_on_sleep() { static void ssl_debug_cb(void *ctx, int level, const char *msg, int TODO1, const char *TODO2) { - debug(D_NOTICE, "%s", msg); + debug(D_NOTICE, "%s (%s, %d)", msg, TODO2, + TODO1); // trying to figure out what these are... } void psync_set_ssl_debug_callback(psync_ssl_debug_callback_t cb) {