TLS transport: OpenSSL-based encrypted TCP

- New transport_tls.h/c: TLS server (server_create_tls, server_listen_tls)
  and client (client_connect_tls) using OpenSSL
- protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data
- transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs
- config.h/c: use_tls, tls_cert, tls_key fields
- client_cli.c: --tls, --cert, --key flags
- server.c: --tls, --cert, --key, -p flags with TLS support
- CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage
- shell.nix: openssl added to buildInputs

CMakeLists.txt

@@ -19,6 +19,8 @@ if(NOT ZSTD_LIBRARY)
 	message(FATAL_ERROR "zstd library not found. Ensure it is in your nix-shell!")
 endif()
 
+find_package(OpenSSL REQUIRED)
+
 file(GLOB SHARED_SRCS "src/shared/*.c")
 file(GLOB SERVER_SRCS "src/server/*.c")
 file(GLOB CLIENT_SRCS "src/client/*.c")
@@ -26,13 +28,13 @@ file(GLOB TEST_SRCS "tests/*.c")
 
 add_executable(server ${SERVER_SRCS} ${SHARED_SRCS})
 target_include_directories(server PRIVATE src/shared src/server src/client)
-target_link_libraries(server PRIVATE Threads::Threads ${ZSTD_LIBRARY})
+target_link_libraries(server PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto)
 
 add_executable(client ${CLIENT_SRCS} ${SHARED_SRCS})
 target_include_directories(client PRIVATE src/shared src/server src/client)
-target_link_libraries(client PRIVATE Threads::Threads ${ZSTD_LIBRARY})
+target_link_libraries(client PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto)
 
 add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} src/client/scanner.c)
 target_include_directories(tests PRIVATE tests src/shared src/server src/client)
-target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY})
+target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto)
 

shell.nix

@@ -13,6 +13,7 @@ pkgs.mkShell {
 
   buildInputs = with pkgs; [
     zstd
+    openssl
   ];
 
   NIX_ENFORCE_PURITY = 0;

src/client/client_cli.c

@@ -42,6 +42,9 @@ static void print_usage(void) {
   printf("  --save-to-disk      Write received files to disk\n");
   printf("  --server-host <ip>  Server IP address (default: 127.0.0.1)\n");
   printf("  --server-port <n>   Server port (default: 8080)\n");
+  printf("  --tls               Enable TLS encryption\n");
+  printf("  --cert <path>       TLS certificate file (PEM)\n");
+  printf("  --key <path>        TLS private key file (PEM)\n");
   printf("  --help              Show this help\n");
 }
 
@@ -133,6 +136,14 @@ int main(int argc, char *argv[]) {
       unsigned long long val = strtoull(argv[++i], NULL, 10);
       if (val > 0)
         config->chunk_size = val;
+    } else if (strcmp(argv[i], "--tls") == 0) {
+      config->use_tls = true;
+    } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) {
+      free(config->tls_cert);
+      config->tls_cert = str_dup(argv[++i]);
+    } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
+      free(config->tls_key);
+      config->tls_key = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
     } else if (argv[i][0] == '-') {

src/client/client_send.c

@@ -11,6 +11,7 @@
 #include "scanner.h"
 #include "transport_tcp.h"
 #include "transport_ssh.h"
+#include "transport_tls.h"
 #include "utils.h"
 #include <stdio.h>
 #include <stdlib.h>
@@ -57,6 +58,16 @@ static int send_chunks_multithreaded(void *pipeline_context) {
       return 1;
     }
     client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port);
+  } else if (context->config->use_tls) {
+    tls_global_init();
+    client = client_create();
+    if (!client || !client_connect_tls(client, server_host, server_port,
+                                       context->config->tls_cert,
+                                       context->config->tls_key)) {
+      if (client) client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return thrd_error;
+    }
   } else {
     client = client_create();
     if (!client || !client_connect(client, server_host, server_port)) {
@@ -201,6 +212,15 @@ int send_files(Config *config) {
     }
     client = client_connect_ssh(config->ssh_destination, config->ssh_port);
     if (!client) return 1;
+  } else if (config->use_tls) {
+    tls_global_init();
+    client = client_create();
+    if (!client || !client_connect_tls(client, server_host, server_port,
+                                       config->tls_cert, config->tls_key)) {
+      if (client) client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return 1;
+    }
   } else {
     client = client_create();
     if (!client || !client_connect(client, server_host, server_port)) {

src/server/server.c

@@ -10,6 +10,7 @@
 #include "protocol.h"
 #include "queue.h"
 #include "transport_tcp.h"
+#include "transport_tls.h"
 #include "unistd.h"
 #include "utils.h"
 #include <signal.h>
@@ -153,6 +154,11 @@ static void cleanup(int sig) {
 }
 
 int main(int argc, char *argv[]) {
+  bool use_tls = false;
+  char *tls_cert = NULL;
+  char *tls_key = NULL;
+  int port = 8080;
+
   signal(SIGPIPE, SIG_IGN);
   for (int i = 1; i < argc; i++) {
     if (strcmp(argv[i], "--stdio") == 0) {
@@ -161,15 +167,38 @@ int main(int argc, char *argv[]) {
       return 0;
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
+    } else if (strcmp(argv[i], "--tls") == 0) {
+      use_tls = true;
+    } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) {
+      tls_cert = argv[++i];
+    } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
+      tls_key = argv[++i];
+    } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
+      port = atoi(argv[++i]);
     }
   }
   signal(SIGINT, cleanup);
   signal(SIGTERM, cleanup);
-  g_server = server_create(8080);
+  g_server = server_create(port);
   if (g_server == NULL) {
     log_message(LOG_LEVEL_ERROR, "Failed to create server");
     return 1;
   }
-  server_listen(g_server, handler);
+  if (use_tls) {
+    if (!tls_cert || !tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      server_delete(&g_server);
+      return 1;
+    }
+    tls_global_init();
+    if (!server_create_tls(g_server, tls_cert, tls_key)) {
+      log_message(LOG_LEVEL_ERROR, "Failed to set up TLS");
+      server_delete(&g_server);
+      return 1;
+    }
+    server_listen_tls(g_server, handler);
+  } else {
+    server_listen(g_server, handler);
+  }
   return 0;
 }

src/shared/config.c

@@ -38,6 +38,9 @@ Config *config_create(char *version, char *send_directory,
   config->include_count = 0;
   config->max_size = 0;
   config->min_size = 0;
+  config->use_tls = false;
+  config->tls_cert = NULL;
+  config->tls_key = NULL;
   return config;
 }
 
@@ -73,6 +76,8 @@ void config_delete(Config *config) {
   for (int i = 0; i < config->include_count; i++)
     free(config->include_patterns[i]);
   free(config->include_patterns);
+  free(config->tls_cert);
+  free(config->tls_key);
   free(config);
 }
 

src/shared/config.h

@@ -32,6 +32,9 @@ typedef struct Config {
   int include_count;
   unsigned long long max_size;
   unsigned long long min_size;
+  bool use_tls;
+  char *tls_cert;
+  char *tls_key;
 } Config;
 
 #define PROTOCOL_VERSION "1.0.0"

src/shared/protocol.c

@@ -1,5 +1,6 @@
 #include "protocol.h"
 #include "log.h"
+#include <openssl/ssl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -7,12 +8,17 @@
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
+static SSL *io_ssl = NULL;
 
 void io_set_fds(int read_fd, int write_fd) {
   io_read_fd = read_fd;
   io_write_fd = write_fd;
 }
 
+void io_set_ssl(void *ssl) {
+  io_ssl = (SSL *)ssl;
+}
+
 static int io_fd(int dir_fd, int file_descriptor) {
   return (dir_fd != -1) ? dir_fd : file_descriptor;
 }
@@ -22,8 +28,13 @@ bool send_n_data(int file_descriptor, void *data, size_t data_size) {
   int fd = io_fd(io_write_fd, file_descriptor);
   ssize_t total_bytes_send = 0;
   while (total_bytes_send < data_size) {
-    ssize_t bytes_send =
+    ssize_t bytes_send;
-        write(fd, (char *)data + total_bytes_send, data_size - total_bytes_send);
+    if (io_ssl)
+      bytes_send = SSL_write(io_ssl, (char *)data + total_bytes_send,
+                             data_size - total_bytes_send);
+    else
+      bytes_send = write(fd, (char *)data + total_bytes_send,
+                          data_size - total_bytes_send);
     if (bytes_send <= 0) {
       log_message(LOG_LEVEL_ERROR, "Could not send data");
       return false;
@@ -39,8 +50,13 @@ bool receive_n_data(int file_descriptor, void *data, size_t data_size) {
   int fd = io_fd(io_read_fd, file_descriptor);
   size_t total_bytes_received = 0;
   while (total_bytes_received < data_size) {
-    ssize_t bytes_received =
+    ssize_t bytes_received;
-        read(fd, (char *)data + total_bytes_received, data_size - total_bytes_received);
+    if (io_ssl)
+      bytes_received = SSL_read(io_ssl, (char *)data + total_bytes_received,
+                                data_size - total_bytes_received);
+    else
+      bytes_received = read(fd, (char *)data + total_bytes_received,
+                             data_size - total_bytes_received);
     if (bytes_received <= 0) {
       if (bytes_received == 0)
         log_message(LOG_LEVEL_ERROR, "Connection closed while receiving data");

src/shared/protocol.h

@@ -9,6 +9,7 @@ typedef int Status;
 enum NET_STATUS { STATUS_OK, STATUS_ERROR, STATUS_FINISHED, STATUS_NEXT, STATUS_CHUNK, STATUS_MANIFEST };
 
 void io_set_fds(int read_fd, int write_fd);
+void io_set_ssl(void *ssl);
 bool send_n_data(int file_descriptor, void *data, size_t data_size);
 bool receive_n_data(int file_descriptor, void *data, size_t data_size);
 

src/shared/transport_tcp.c

@@ -36,6 +36,7 @@ Server *server_create(int port) {
   server->address.sin_addr.s_addr = INADDR_ANY;
   server->address.sin_port = htons(port);
   server->address_length = sizeof(server->address);
+  server->ssl_ctx = NULL;
 
   if (bind(server->file_descriptor, (struct sockaddr *)&server->address,
            server->address_length) < 0) {
@@ -104,6 +105,8 @@ Client *client_create() {
   client->address.sin_family = AF_INET;
   client->address_length = sizeof(client->address);
   client->ssh_child_pid = -1;
+  client->ssl = NULL;
+  client->ssl_ctx = NULL;
   return client;
 }
 

src/shared/transport_tcp.h

@@ -9,6 +9,7 @@ typedef struct Server {
   struct sockaddr_in address;
   unsigned int address_length;
   int file_descriptor;
+  void *ssl_ctx;
 } Server;
 
 typedef struct Client {
@@ -16,6 +17,8 @@ typedef struct Client {
   unsigned int address_length;
   int file_descriptor;
   pid_t ssh_child_pid;
+  void *ssl;
+  void *ssl_ctx;
 } Client;
 
 Server *server_create(int port);

src/shared/transport_tls.c

@@ -0,0 +1,162 @@
+#include "transport_tls.h"
+#include "log.h"
+#include "protocol.h"
+#include <arpa/inet.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static SSL_CTX *g_ssl_ctx = NULL;
+
+bool tls_global_init(void) {
+  SSL_library_init();
+  OpenSSL_add_all_algorithms();
+  SSL_load_error_strings();
+  return true;
+}
+
+void tls_global_cleanup(void) {
+  if (g_ssl_ctx) {
+    SSL_CTX_free(g_ssl_ctx);
+    g_ssl_ctx = NULL;
+  }
+  EVP_cleanup();
+}
+
+static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert, const char *key) {
+  const SSL_METHOD *method = is_server ? TLS_server_method() : TLS_client_method();
+  SSL_CTX *ctx = SSL_CTX_new(method);
+  if (!ctx) {
+    log_message(LOG_LEVEL_ERROR, "Unable to create SSL context");
+    ERR_print_errors_fp(stderr);
+    return NULL;
+  }
+
+  if (cert && key) {
+    if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) {
+      log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert);
+      ERR_print_errors_fp(stderr);
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+    if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) {
+      log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key);
+      ERR_print_errors_fp(stderr);
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+    if (!SSL_CTX_check_private_key(ctx)) {
+      log_message(LOG_LEVEL_ERROR, "Private key does not match certificate");
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+  }
+
+  return ctx;
+}
+
+static SSL *wrap_fd_with_ssl(int fd, SSL_CTX *ctx, bool is_server) {
+  SSL *ssl = SSL_new(ctx);
+  if (!ssl) {
+    log_message(LOG_LEVEL_ERROR, "Failed to create SSL object");
+    return NULL;
+  }
+  SSL_set_fd(ssl, fd);
+  int ret;
+  if (is_server)
+    ret = SSL_accept(ssl);
+  else
+    ret = SSL_connect(ssl);
+
+  if (ret <= 0) {
+    log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect");
+    ERR_print_errors_fp(stderr);
+    SSL_free(ssl);
+    return NULL;
+  }
+  return ssl;
+}
+
+bool server_create_tls(Server *server, const char *cert_path, const char *key_path) {
+  SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path);
+  if (!ctx) return false;
+  server->ssl_ctx = ctx;
+  return true;
+}
+
+bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)) {
+  log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d",
+              ntohs(server->address.sin_port));
+  if (listen(server->file_descriptor, SOMAXCONN) < 0) {
+    perror("Could not listen on port!");
+    return false;
+  }
+
+  signal(SIGCHLD, SIG_IGN);
+
+  while (1) {
+    struct sockaddr_in client_addr;
+    socklen_t client_len = sizeof(client_addr);
+    int file_descriptor =
+        accept(server->file_descriptor, (struct sockaddr *)&client_addr,
+               &client_len);
+    if (file_descriptor < 0) {
+      perror("Could not accept the connection");
+      continue;
+    }
+    log_message(LOG_LEVEL_INFO, "Received TLS Connection");
+    pid_t pid = fork();
+    if (pid == 0) {
+      close(server->file_descriptor);
+
+      SSL *ssl = wrap_fd_with_ssl(file_descriptor, (SSL_CTX *)server->ssl_ctx, true);
+      if (!ssl) {
+        close(file_descriptor);
+        _exit(1);
+      }
+      io_set_ssl(ssl);
+      handler(file_descriptor);
+      SSL_shutdown(ssl);
+      SSL_free(ssl);
+      io_set_ssl(NULL);
+      close(file_descriptor);
+      _exit(0);
+    }
+    close(file_descriptor);
+  }
+  return true;
+}
+
+bool client_connect_tls(Client *client, char *host, int port,
+                        const char *cert_path, const char *key_path) {
+  client->address.sin_port = htons(port);
+  if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
+    perror("Could not convert host address!");
+    return false;
+  }
+  if (connect(client->file_descriptor, (struct sockaddr *)&client->address,
+              client->address_length) < 0) {
+    perror("Could not connect to Server!");
+    return false;
+  }
+
+  SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path);
+  if (!ctx) return false;
+  client->ssl_ctx = ctx;
+
+  SSL *ssl = wrap_fd_with_ssl(client->file_descriptor, ctx, false);
+  if (!ssl) {
+    SSL_CTX_free(ctx);
+    client->ssl_ctx = NULL;
+    return false;
+  }
+  client->ssl = ssl;
+  io_set_ssl(ssl);
+  return true;
+}

src/shared/transport_tls.h

@@ -0,0 +1,14 @@
+#ifndef TRANSPORT_TLS_H
+#define TRANSPORT_TLS_H
+
+#include "transport_tcp.h"
+#include <stdbool.h>
+
+bool tls_global_init(void);
+void tls_global_cleanup(void);
+
+bool server_create_tls(Server *server, const char *cert_path, const char *key_path);
+bool server_listen_tls(Server *server, void (*handler)(int file_descriptor));
+bool client_connect_tls(Client *client, char *host, int port, const char *cert_path, const char *key_path);
+
+#endif