logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0004-Allow-building-daemon-without-TLS-support.patch (13314B)

    

  1. From b69e788f3c4b8c3dbdb8d272630fe0616f43406f Mon Sep 17 00:00:00 2001
  2. From: Michael Forney <mforney@mforney.org>
  3. Date: Wed, 1 Dec 2021 13:57:48 -0800
  4. Subject: [PATCH] Allow building daemon without TLS support
  6. ---
  7.  configure                  | 11 ---------
  8.  configure.ac               | 11 ---------
  9.  daemon/cachedump.c         |  2 ++
  10.  daemon/remote.c            | 46 +++++++++++++++++++++++++++++++++-----
  11.  daemon/remote.h            |  2 --
  12.  daemon/unbound.c           |  9 +++++---
  13.  smallapp/unbound-control.c | 44 +++++++++++++++++++++++++++++++-----
  14.  7 files changed, 86 insertions(+), 39 deletions(-)
  16. diff --git a/configure b/configure
  17. index 8b012048..f2ea348e 100755
  18. --- a/configure
  19. +++ b/configure
  20. @@ -21739,17 +21739,6 @@ if test "${with_libunbound_only+set}" = set; then :
  21.  
  22.  fi
  23.  
  24. -if test $ALLTARGET = "alltargets"; then
  25. -	if test $USE_NSS = "yes"; then
  26. -		as_fn_error $? "--with-nss can only be used in combination with --with-libunbound-only." "$LINENO" 5
  27. -	fi
  28. -	if test $USE_NETTLE = "yes"; then
  29. -		as_fn_error $? "--with-nettle can only be used in combination with --with-libunbound-only." "$LINENO" 5
  30. -	fi
  31. -	if test $USE_BEARSSL = "yes"; then
  32. -		as_fn_error $? "--with-bearssl can only be used in combination with --with-libunbound-only." "$LINENO" 5
  33. -	fi
  34. -fi
  35.  
  36.  
  37.  
  38. diff --git a/configure.ac b/configure.ac
  39. index 750e9bfd..de6468c8 100644
  40. --- a/configure.ac
  41. +++ b/configure.ac
  42. @@ -1955,17 +1955,6 @@ AC_ARG_WITH(libunbound-only, AS_HELP_STRING([--with-libunbound-only],[do not bui
  43.  		INSTALLTARGET="install-lib"
  44.  	fi
  45.  ])
  46. -if test $ALLTARGET = "alltargets"; then
  47. -	if test $USE_NSS = "yes"; then 
  48. -		AC_MSG_ERROR([--with-nss can only be used in combination with --with-libunbound-only.])	
  49. -	fi
  50. -	if test $USE_NETTLE = "yes"; then
  51. -		AC_MSG_ERROR([--with-nettle can only be used in combination with --with-libunbound-only.])	
  52. -	fi
  53. -	if test $USE_BEARSSL = "yes"; then
  54. -		AC_MSG_ERROR([--with-bearssl can only be used in combination with --with-libunbound-only.])
  55. -	fi
  56. -fi
  57.  
  58.  AC_SUBST(ALLTARGET)
  59.  AC_SUBST(INSTALLTARGET)
  60. diff --git a/daemon/cachedump.c b/daemon/cachedump.c
  61. index b1ce53b5..b5636ca7 100644
  62. --- a/daemon/cachedump.c
  63. +++ b/daemon/cachedump.c
  64. @@ -40,7 +40,9 @@
  65.   * to text format.
  66.   */
  67.  #include "config.h"
  68. +#ifdef HAVE_SSL
  69.  #include <openssl/ssl.h>
  70. +#endif
  71.  #include "daemon/cachedump.h"
  72.  #include "daemon/remote.h"
  73.  #include "daemon/worker.h"
  74. diff --git a/daemon/remote.c b/daemon/remote.c
  75. index adf03838..94ab5603 100644
  76. --- a/daemon/remote.c
  77. +++ b/daemon/remote.c
  78. @@ -149,6 +149,7 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, long long d)
  79.  #endif
  80.  }
  81.  
  82. +#ifdef HAVE_SSL
  83.  static int
  84.  remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
  85.  {
  86. @@ -199,6 +200,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
  87.  	free(s_key);
  88.  	return 1;
  89.  }
  90. +#endif
  91.  
  92.  struct daemon_remote*
  93.  daemon_remote_create(struct config_file* cfg)
  94. @@ -211,19 +213,25 @@ daemon_remote_create(struct config_file* cfg)
  95.  	}
  96.  	rc->max_active = 10;
  97.  
  98. +#ifdef HAVE_SSL
  99. +	rc->ctx = NULL;
  100. +#endif
  101.  	if(!cfg->remote_control_enable) {
  102. -		rc->ctx = NULL;
  103.  		return rc;
  104.  	}
  105.  	if(options_remote_is_address(cfg) && cfg->control_use_cert) {
  106. +#ifdef HAVE_SSL
  107.  		if(!remote_setup_ctx(rc, cfg)) {
  108.  			daemon_remote_delete(rc);
  109.  			return NULL;
  110.  		}
  111.  		rc->use_cert = 1;
  112. +#else
  113. +		log_err("unbound built without TLS support");
  114. +		return NULL;
  115. +#endif
  116.  	} else {
  117.  		struct config_strlist* p;
  118. -		rc->ctx = NULL;
  119.  		rc->use_cert = 0;
  120.  		if(!options_remote_is_address(cfg))
  121.  		  for(p = cfg->control_ifs.first; p; p = p->next) {
  122. @@ -245,8 +253,10 @@ void daemon_remote_clear(struct daemon_remote* rc)
  123.  	p = rc->busy_list;
  124.  	while(p) {
  125.  		np = p->next;
  126. +#ifdef HAVE_SSL
  127.  		if(p->ssl)
  128.  			SSL_free(p->ssl);
  129. +#endif
  130.  		comm_point_delete(p->c);
  131.  		free(p);
  132.  		p = np;
  133. @@ -260,9 +270,11 @@ void daemon_remote_delete(struct daemon_remote* rc)
  134.  {
  135.  	if(!rc) return;
  136.  	daemon_remote_clear(rc);
  137. +#ifdef HAVE_SSL
  138.  	if(rc->ctx) {
  139.  		SSL_CTX_free(rc->ctx);
  140.  	}
  141. +#endif
  142.  	free(rc);
  143.  }
  144.  
  145. @@ -496,6 +508,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
  146.  	comm_point_start_listening(n->c, -1, REMOTE_CONTROL_TCP_TIMEOUT);
  147.  	memcpy(&n->c->repinfo.addr, &addr, addrlen);
  148.  	n->c->repinfo.addrlen = addrlen;
  149. +#ifdef HAVE_SSL
  150.  	if(rc->use_cert) {
  151.  		n->shake_state = rc_hs_read;
  152.  		n->ssl = SSL_new(rc->ctx);
  153. @@ -517,6 +530,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
  154.  	} else {
  155.  		n->ssl = NULL;
  156.  	}
  157. +#endif
  158.  
  159.  	n->rc = rc;
  160.  	n->next = rc->busy_list;
  161. @@ -548,10 +562,12 @@ clean_point(struct daemon_remote* rc, struct rc_state* s)
  162.  {
  163.  	state_list_remove_elem(&rc->busy_list, s->c);
  164.  	rc->active --;
  165. +#ifdef HAVE_SSL
  166.  	if(s->ssl) {
  167.  		SSL_shutdown(s->ssl);
  168.  		SSL_free(s->ssl);
  169.  	}
  170. +#endif
  171.  	comm_point_delete(s->c);
  172.  	free(s);
  173.  }
  174. @@ -562,6 +578,7 @@ ssl_print_text(RES* res, const char* text)
  175.  	int r;
  176.  	if(!res) 
  177.  		return 0;
  178. +#ifdef HAVE_SSL
  179.  	if(res->ssl) {
  180.  		ERR_clear_error();
  181.  		if((r=SSL_write(res->ssl, text, (int)strlen(text))) <= 0) {
  182. @@ -573,7 +590,9 @@ ssl_print_text(RES* res, const char* text)
  183.  			log_crypto_err("could not SSL_write");
  184.  			return 0;
  185.  		}
  186. -	} else {
  187. +	} else
  188. +#endif
  189. +	{
  190.  		size_t at = 0;
  191.  		while(at < strlen(text)) {
  192.  			ssize_t r = send(res->fd, text+at, strlen(text)-at, 0);
  193. @@ -618,6 +637,7 @@ ssl_read_line(RES* res, char* buf, size_t max)
  194.  	if(!res)
  195.  		return 0;
  196.  	while(len < max) {
  197. +#ifdef HAVE_SSL
  198.  		if(res->ssl) {
  199.  			ERR_clear_error();
  200.  			if((r=SSL_read(res->ssl, buf+len, 1)) <= 0) {
  201. @@ -628,7 +648,9 @@ ssl_read_line(RES* res, char* buf, size_t max)
  202.  				log_crypto_err("could not SSL_read");
  203.  				return 0;
  204.  			}
  205. -		} else {
  206. +		} else
  207. +#endif
  208. +		{
  209.  			while(1) {
  210.  				ssize_t rr = recv(res->fd, buf+len, 1, 0);
  211.  				if(rr <= 0) {
  212. @@ -3232,6 +3254,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res)
  213.  	fd_set_block(s->c->fd);
  214.  
  215.  	/* try to read magic UBCT[version]_space_ string */
  216. +#ifdef HAVE_SSL
  217.  	if(res->ssl) {
  218.  		ERR_clear_error();
  219.  		if((r=SSL_read(res->ssl, magic, (int)sizeof(magic)-1)) <= 0) {
  220. @@ -3240,7 +3263,9 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res)
  221.  			log_crypto_err("could not SSL_read");
  222.  			return;
  223.  		}
  224. -	} else {
  225. +	} else
  226. +#endif
  227. +	{
  228.  		while(1) {
  229.  			ssize_t rr = recv(res->fd, magic, sizeof(magic)-1, 0);
  230.  			if(rr <= 0) {
  231. @@ -3278,6 +3303,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res)
  232.  	execute_cmd(rc, res, buf, rc->worker);
  233.  }
  234.  
  235. +#ifdef HAVE_SSL
  236.  /** handle SSL_do_handshake changes to the file descriptor to wait for later */
  237.  static int
  238.  remote_handshake_later(struct daemon_remote* rc, struct rc_state* s,
  239. @@ -3309,6 +3335,7 @@ remote_handshake_later(struct daemon_remote* rc, struct rc_state* s,
  240.  	}
  241.  	return 0;
  242.  }
  243. +#endif
  244.  
  245.  int remote_control_callback(struct comm_point* c, void* arg, int err, 
  246.  	struct comm_reply* ATTR_UNUSED(rep))
  247. @@ -3323,6 +3350,7 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
  248.  		clean_point(rc, s);
  249.  		return 0;
  250.  	}
  251. +#ifdef HAVE_SSL
  252.  	if(s->ssl) {
  253.  		/* (continue to) setup the SSL connection */
  254.  		ERR_clear_error();
  255. @@ -3333,11 +3361,14 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
  256.  		}
  257.  		s->shake_state = rc_none;
  258.  	}
  259. +#endif
  260.  
  261.  	/* once handshake has completed, check authentication */
  262.  	if (!rc->use_cert) {
  263.  		verbose(VERB_ALGO, "unauthenticated remote control connection");
  264. -	} else if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
  265. +	}
  266. +#ifdef HAVE_SSL
  267. +	else if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
  268.  #ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
  269.  		X509* x = SSL_get1_peer_certificate(s->ssl);
  270.  #else
  271. @@ -3357,9 +3388,12 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
  272.  		clean_point(rc, s);
  273.  		return 0;
  274.  	}
  275. +#endif
  276.  
  277.  	/* if OK start to actually handle the request */
  278. +#ifdef HAVE_SSL
  279.  	res.ssl = s->ssl;
  280. +#endif
  281.  	res.fd = c->fd;
  282.  	handle_req(rc, s, &res);
  283.  
  284. diff --git a/daemon/remote.h b/daemon/remote.h
  285. index 217ea21e..e2972779 100644
  286. --- a/daemon/remote.h
  287. +++ b/daemon/remote.h
  288. @@ -174,7 +174,6 @@ void daemon_remote_start_accept(struct daemon_remote* rc);
  289.   */
  290.  void daemon_remote_exec(struct worker* worker);
  291.  
  292. -#ifdef HAVE_SSL
  293.  /** 
  294.   * Print fixed line of text over ssl connection in blocking mode
  295.   * @param ssl: print to
  296. @@ -201,6 +200,5 @@ int ssl_printf(RES* ssl, const char* format, ...)
  297.   * @return false on connection failure.
  298.   */
  299.  int ssl_read_line(RES* ssl, char* buf, size_t max);
  300. -#endif /* HAVE_SSL */
  301.  
  302.  #endif /* DAEMON_REMOTE_H */
  303. diff --git a/daemon/unbound.c b/daemon/unbound.c
  304. index 1a31bb3e..2baf4dba 100644
  305. --- a/daemon/unbound.c
  306. +++ b/daemon/unbound.c
  307. @@ -60,14 +60,16 @@
  308.  #include "util/ub_event.h"
  309.  #include <signal.h>
  310.  #include <fcntl.h>
  311. +#ifdef HAVE_SSL
  312.  #include <openssl/crypto.h>
  313. +#include <openssl/ssl.h>
  314. +#endif
  315.  #ifdef HAVE_PWD_H
  316.  #include <pwd.h>
  317.  #endif
  318.  #ifdef HAVE_GRP_H
  319.  #include <grp.h>
  320.  #endif
  321. -#include <openssl/ssl.h>
  322.  
  323.  #ifndef S_SPLINT_S
  324.  /* splint chokes on this system header file */
  325. @@ -488,10 +490,11 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  326.  	w_config_adjust_directory(cfg);
  327.  #endif
  328.  
  329. -	/* read ssl keys while superuser and outside chroot */
  330. -#ifdef HAVE_SSL
  331.  	if(!(daemon->rc = daemon_remote_create(cfg)))
  332.  		fatal_exit("could not set up remote-control");
  333. +
  334. +	/* read ssl keys while superuser and outside chroot */
  335. +#ifdef HAVE_SSL
  336.  	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
  337.  		if(!(daemon->listen_sslctx = listen_sslctx_create(
  338.  			cfg->ssl_service_key, cfg->ssl_service_pem, NULL)))
  339. diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
  340. index c7c38276..fea6a9f7 100644
  341. --- a/smallapp/unbound-control.c
  342. +++ b/smallapp/unbound-control.c
  343. @@ -45,6 +45,7 @@
  344.  #ifdef HAVE_GETOPT_H
  345.  #include <getopt.h>
  346.  #endif
  347. +#ifdef HAVE_SSL
  348.  #ifdef HAVE_OPENSSL_SSL_H
  349.  #include <openssl/ssl.h>
  350.  #endif
  351. @@ -54,6 +55,9 @@
  352.  #ifdef HAVE_OPENSSL_RAND_H
  353.  #include <openssl/rand.h>
  354.  #endif
  355. +#else
  356. +typedef void *SSL;
  357. +#endif
  358.  #include "util/log.h"
  359.  #include "util/config_file.h"
  360.  #include "util/locks.h"
  361. @@ -486,6 +490,7 @@ static void print_stats_shm(const char* cfgfile)
  362.  #endif /* HAVE_SHMGET */
  363.  }
  364.  
  365. +#ifdef HAVE_SSL
  366.  /** exit with ssl error */
  367.  static void ssl_err(const char* s)
  368.  {
  369. @@ -515,8 +520,6 @@ setup_ctx(struct config_file* cfg)
  370.  	char* s_cert=NULL, *c_key=NULL, *c_cert=NULL;
  371.  	SSL_CTX* ctx;
  372.  
  373. -	if(!(options_remote_is_address(cfg) && cfg->control_use_cert))
  374. -		return NULL;
  375.  	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
  376.  	c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);
  377.  	c_cert = fname_after_chroot(cfg->control_cert_file, cfg, 1);
  378. @@ -555,6 +558,7 @@ setup_ctx(struct config_file* cfg)
  379.  	free(c_cert);
  380.  	return ctx;
  381.  }
  382. +#endif
  383.  
  384.  /** check connect error */
  385.  static void
  386. @@ -723,6 +727,7 @@ contact_server(const char* svr, struct config_file* cfg, int statuscmd)
  387.  	return fd;
  388.  }
  389.  
  390. +#ifdef HAVE_SSL
  391.  /** setup SSL on the connection */
  392.  static SSL*
  393.  setup_ssl(SSL_CTX* ctx, int fd)
  394. @@ -759,11 +764,13 @@ setup_ssl(SSL_CTX* ctx, int fd)
  395.  
  396.  	return ssl;
  397.  }
  398. +#endif
  399.  
  400.  /** read from ssl or fd, fatalexit on error, 0 EOF, 1 success */
  401.  static int
  402.  remote_read(SSL* ssl, int fd, char* buf, size_t len)
  403.  {
  404. +#ifdef HAVE_SSL
  405.  	if(ssl) {
  406.  		int r;
  407.  		ERR_clear_error();
  408. @@ -775,7 +782,9 @@ remote_read(SSL* ssl, int fd, char* buf, size_t len)
  409.  			ssl_err("could not SSL_read");
  410.  		}
  411.  		buf[r] = 0;
  412. -	} else {
  413. +	} else
  414. +#endif
  415. +	{
  416.  		ssize_t rr = recv(fd, buf, len-1, 0);
  417.  		if(rr <= 0) {
  418.  			if(rr == 0) {
  419. @@ -793,10 +802,13 @@ remote_read(SSL* ssl, int fd, char* buf, size_t len)
  420.  static void
  421.  remote_write(SSL* ssl, int fd, const char* buf, size_t len)
  422.  {
  423. +#ifdef HAVE_SSL
  424.  	if(ssl) {
  425.  		if(SSL_write(ssl, buf, (int)len) <= 0)
  426.  			ssl_err("could not SSL_write");
  427. -	} else {
  428. +	} else
  429. +#endif
  430. +	{
  431.  		if(send(fd, buf, len, 0) < (ssize_t)len) {
  432.  			fatal_exit("could not send: %s", sock_strerror(errno));
  433.  		}
  434. @@ -894,7 +906,9 @@ go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
  435.  {
  436.  	struct config_file* cfg;
  437.  	int fd, ret;
  438. +#ifdef HAVE_SSL
  439.  	SSL_CTX* ctx;
  440. +#endif
  441.  	SSL* ssl;
  442.  
  443.  	/* read config */
  444. @@ -907,18 +921,34 @@ go(const char* cfgfile, char* svr, int quiet, int argc, char* argv[])
  445.  #ifdef UB_ON_WINDOWS
  446.  	w_config_adjust_directory(cfg);
  447.  #endif
  448. -	ctx = setup_ctx(cfg);
  449. +	if(options_remote_is_address(cfg) && cfg->control_use_cert) {
  450. +#ifdef HAVE_SSL
  451. +		ctx = setup_ctx(cfg);
  452. +#else
  453. +		fatal_exit("unbound built without TLS support");
  454. +#endif
  455. +	} else {
  456. +#ifdef HAVE_SSL
  457. +		ctx = NULL;
  458. +#endif
  459. +	}
  460.  
  461.  	/* contact server */
  462.  	fd = contact_server(svr, cfg, argc>0&&strcmp(argv[0],"status")==0);
  463. +#ifdef HAVE_SSL
  464.  	ssl = setup_ssl(ctx, fd);
  465. +#else
  466. +	ssl = NULL;
  467. +#endif
  468.  
  469.  	/* send command */
  470.  	ret = go_cmd(ssl, fd, quiet, argc, argv);
  471.  
  472. +#ifdef HAVE_SSL
  473.  	if(ssl) SSL_free(ssl);
  474. -	sock_close(fd);
  475.  	if(ctx) SSL_CTX_free(ctx);
  476. +#endif
  477. +	sock_close(fd);
  478.  	config_delete(cfg);
  479.  	return ret;
  480.  }
  481. @@ -997,6 +1027,7 @@ int main(int argc, char* argv[])
  482.  		fatal_exit("WSAStartup failed: %s", wsa_strerror(r));
  483.  #endif
  484.  
  485. +#ifdef HAVE_SSL
  486.  #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
  487.  	ERR_load_crypto_strings();
  488.  #endif
  489. @@ -1031,6 +1062,7 @@ int main(int argc, char* argv[])
  490.  		RAND_seed(buf, 256);
  491.  		log_warn("no entropy, seeding openssl PRNG with time\n");
  492.  	}
  493. +#endif
  494.  
  495.  	ret = go(cfgfile, svr, quiet, argc, argv);
  496.  
  497. -- 
  498. 2.34.1