TLS transport: OpenSSL-based encrypted TCP

- New transport_tls.h/c: TLS server (server_create_tls, server_listen_tls)
  and client (client_connect_tls) using OpenSSL
- protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data
- transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs
- config.h/c: use_tls, tls_cert, tls_key fields
- client_cli.c: --tls, --cert, --key flags
- server.c: --tls, --cert, --key, -p flags with TLS support
- CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage
- shell.nix: openssl added to buildInputs

src/shared/protocol.c

@@ -1,5 +1,6 @@
 #include "protocol.h"
 #include "log.h"
+#include <openssl/ssl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -7,12 +8,17 @@
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
+static SSL *io_ssl = NULL;
 
 void io_set_fds(int read_fd, int write_fd) {
   io_read_fd = read_fd;
   io_write_fd = write_fd;
 }
 
+void io_set_ssl(void *ssl) {
+  io_ssl = (SSL *)ssl;
+}
+
 static int io_fd(int dir_fd, int file_descriptor) {
   return (dir_fd != -1) ? dir_fd : file_descriptor;
 }
@@ -22,8 +28,13 @@ bool send_n_data(int file_descriptor, void *data, size_t data_size) {
   int fd = io_fd(io_write_fd, file_descriptor);
   ssize_t total_bytes_send = 0;
   while (total_bytes_send < data_size) {
-    ssize_t bytes_send =
-        write(fd, (char *)data + total_bytes_send, data_size - total_bytes_send);
+    ssize_t bytes_send;
+    if (io_ssl)
+      bytes_send = SSL_write(io_ssl, (char *)data + total_bytes_send,
+                             data_size - total_bytes_send);
+    else
+      bytes_send = write(fd, (char *)data + total_bytes_send,
+                          data_size - total_bytes_send);
     if (bytes_send <= 0) {
       log_message(LOG_LEVEL_ERROR, "Could not send data");
       return false;
@@ -39,8 +50,13 @@ bool receive_n_data(int file_descriptor, void *data, size_t data_size) {
   int fd = io_fd(io_read_fd, file_descriptor);
   size_t total_bytes_received = 0;
   while (total_bytes_received < data_size) {
-    ssize_t bytes_received =
-        read(fd, (char *)data + total_bytes_received, data_size - total_bytes_received);
+    ssize_t bytes_received;
+    if (io_ssl)
+      bytes_received = SSL_read(io_ssl, (char *)data + total_bytes_received,
+                                data_size - total_bytes_received);
+    else
+      bytes_received = read(fd, (char *)data + total_bytes_received,
+                             data_size - total_bytes_received);
     if (bytes_received <= 0) {
       if (bytes_received == 0)
         log_message(LOG_LEVEL_ERROR, "Connection closed while receiving data");