TLS transport: OpenSSL-based encrypted TCP

- New transport_tls.h/c: TLS server (server_create_tls, server_listen_tls)
  and client (client_connect_tls) using OpenSSL
- protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data
- transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs
- config.h/c: use_tls, tls_cert, tls_key fields
- client_cli.c: --tls, --cert, --key flags
- server.c: --tls, --cert, --key, -p flags with TLS support
- CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage
- shell.nix: openssl added to buildInputs

src/client/client_cli.c

@@ -47,6 +47,10 @@ static void print_usage(void) {
   printf("  --server-host <ip>  Server IP address (default: 127.0.0.1)\n");
   printf("  --server-port <n>   Server port (default: 8080)\n");
   printf("  --bwlimit <KB/s>    Bandwidth limit in kilobytes per second\n");
+  printf("  --tls               Enable TLS encryption\n");
+  printf("  --cert <path>       TLS certificate file (PEM)\n");
+  printf("  --key <path>        TLS private key file (PEM)\n");
+  printf("  --ca <path>         CA certificate for verification (PEM)\n");
   printf("  --help              Show this help\n");
 }
 
@@ -154,6 +158,17 @@ int main(int argc, char *argv[]) {
       unsigned long long val = strtoull(argv[++i], NULL, 10);
       if (val > 0)
         config->chunk_size = val;
+    } else if (strcmp(argv[i], "--tls") == 0) {
+      config->use_tls = true;
+    } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) {
+      free(config->tls_cert);
+      config->tls_cert = str_dup(argv[++i]);
+    } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
+      free(config->tls_key);
+      config->tls_key = str_dup(argv[++i]);
+    } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
+      free(config->tls_ca);
+      config->tls_ca = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
     } else if (argv[i][0] == '-') {

src/client/client_send.c

@@ -11,6 +11,7 @@
 #include "scanner.h"
 #include "transport_tcp.h"
 #include "transport_ssh.h"
+#include "transport_tls.h"
 #include "utils.h"
 #include <stdio.h>
 #include <stdlib.h>
@@ -98,6 +99,16 @@ static int send_chunks_multithreaded(void *pipeline_context) {
       return 1;
     }
     client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port);
+  } else if (context->config->use_tls) {
+    tls_global_init();
+    client = client_create();
+    if (!client || !client_connect_tls(client, server_host, server_port,
+                                       context->config->tls_cert,
+                                       context->config->tls_key)) {
+      if (client) client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return thrd_error;
+    }
   } else {
     client = client_create();
     if (!client || !client_connect(client, server_host, server_port)) {
@@ -242,6 +253,15 @@ int send_files(Config *config) {
     }
     client = client_connect_ssh(config->ssh_destination, config->ssh_port);
     if (!client) return 1;
+  } else if (config->use_tls) {
+    tls_global_init();
+    client = client_create();
+    if (!client || !client_connect_tls(client, server_host, server_port,
+                                       config->tls_cert, config->tls_key)) {
+      if (client) client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return 1;
+    }
   } else {
     client = client_create();
     if (!client || !client_connect(client, server_host, server_port)) {