From eff50346fd0eb0059c9efa251b5c58a88d728fe0 Mon Sep 17 00:00:00 2001 From: TapTap Date: Thu, 16 Jul 2026 15:30:03 +0200 Subject: [PATCH 1/8] TLS transport: OpenSSL-based encrypted TCP - New transport_tls.h/c: TLS server (server_create_tls, server_listen_tls) and client (client_connect_tls) using OpenSSL - protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data - transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs - config.h/c: use_tls, tls_cert, tls_key fields - client_cli.c: --tls, --cert, --key flags - server.c: --tls, --cert, --key, -p flags with TLS support - CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage - shell.nix: openssl added to buildInputs --- CMakeLists.txt | 8 +- shell.nix | 1 + src/client/client_cli.c | 15 ++++ src/client/client_send.c | 20 +++++ src/server/server.c | 33 +++++++- src/shared/config.c | 5 ++ src/shared/config.h | 3 + src/shared/protocol.c | 22 ++++- src/shared/protocol.h | 2 + src/shared/transport_tcp.c | 3 + src/shared/transport_tcp.h | 3 + src/shared/transport_tls.c | 162 +++++++++++++++++++++++++++++++++++++ src/shared/transport_tls.h | 14 ++++ 13 files changed, 282 insertions(+), 9 deletions(-) create mode 100644 src/shared/transport_tls.c create mode 100644 src/shared/transport_tls.h diff --git a/CMakeLists.txt b/CMakeLists.txt index 2100f70..7a3fda2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -19,6 +19,8 @@ if(NOT ZSTD_LIBRARY) message(FATAL_ERROR "zstd library not found. Ensure it is in your nix-shell!") endif() +find_package(OpenSSL REQUIRED) + file(GLOB SHARED_SRCS "src/shared/*.c") file(GLOB SERVER_SRCS "src/server/*.c") file(GLOB CLIENT_SRCS "src/client/*.c") @@ -26,13 +28,13 @@ file(GLOB TEST_SRCS "tests/*.c") add_executable(server ${SERVER_SRCS} ${SHARED_SRCS}) target_include_directories(server PRIVATE src/shared src/server src/client) -target_link_libraries(server PRIVATE Threads::Threads ${ZSTD_LIBRARY}) +target_link_libraries(server PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto) add_executable(client ${CLIENT_SRCS} ${SHARED_SRCS}) target_include_directories(client PRIVATE src/shared src/server src/client) -target_link_libraries(client PRIVATE Threads::Threads ${ZSTD_LIBRARY}) +target_link_libraries(client PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto) add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} src/client/scanner.c) target_include_directories(tests PRIVATE tests src/shared src/server src/client) -target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY}) +target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto) diff --git a/shell.nix b/shell.nix index db46dc5..b7f96c4 100644 --- a/shell.nix +++ b/shell.nix @@ -14,6 +14,7 @@ pkgs.mkShell { buildInputs = with pkgs; [ zstd + openssl ]; NIX_ENFORCE_PURITY = 0; diff --git a/src/client/client_cli.c b/src/client/client_cli.c index e96ae53..b7715f3 100644 --- a/src/client/client_cli.c +++ b/src/client/client_cli.c @@ -47,6 +47,10 @@ static void print_usage(void) { printf(" --server-host Server IP address (default: 127.0.0.1)\n"); printf(" --server-port Server port (default: 8080)\n"); printf(" --bwlimit Bandwidth limit in kilobytes per second\n"); + printf(" --tls Enable TLS encryption\n"); + printf(" --cert TLS certificate file (PEM)\n"); + printf(" --key TLS private key file (PEM)\n"); + printf(" --ca CA certificate for verification (PEM)\n"); printf(" --help Show this help\n"); } @@ -154,6 +158,17 @@ int main(int argc, char *argv[]) { unsigned long long val = strtoull(argv[++i], NULL, 10); if (val > 0) config->chunk_size = val; + } else if (strcmp(argv[i], "--tls") == 0) { + config->use_tls = true; + } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) { + free(config->tls_cert); + config->tls_cert = str_dup(argv[++i]); + } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) { + free(config->tls_key); + config->tls_key = str_dup(argv[++i]); + } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) { + free(config->tls_ca); + config->tls_ca = str_dup(argv[++i]); } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) { set_log_level(LOG_LEVEL_DEBUG); } else if (argv[i][0] == '-') { diff --git a/src/client/client_send.c b/src/client/client_send.c index 5b4b0bb..452dd18 100644 --- a/src/client/client_send.c +++ b/src/client/client_send.c @@ -11,6 +11,7 @@ #include "scanner.h" #include "transport_tcp.h" #include "transport_ssh.h" +#include "transport_tls.h" #include "utils.h" #include #include @@ -98,6 +99,16 @@ static int send_chunks_multithreaded(void *pipeline_context) { return 1; } client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port); + } else if (context->config->use_tls) { + tls_global_init(); + client = client_create(); + if (!client || !client_connect_tls(client, server_host, server_port, + context->config->tls_cert, + context->config->tls_key)) { + if (client) client_delete(client); + fprintf(stderr, "Error: could not connect to server via TLS\n"); + return thrd_error; + } } else { client = client_create(); if (!client || !client_connect(client, server_host, server_port)) { @@ -242,6 +253,15 @@ int send_files(Config *config) { } client = client_connect_ssh(config->ssh_destination, config->ssh_port); if (!client) return 1; + } else if (config->use_tls) { + tls_global_init(); + client = client_create(); + if (!client || !client_connect_tls(client, server_host, server_port, + config->tls_cert, config->tls_key)) { + if (client) client_delete(client); + fprintf(stderr, "Error: could not connect to server via TLS\n"); + return 1; + } } else { client = client_create(); if (!client || !client_connect(client, server_host, server_port)) { diff --git a/src/server/server.c b/src/server/server.c index a0cf8d2..34e6071 100644 --- a/src/server/server.c +++ b/src/server/server.c @@ -8,6 +8,7 @@ #include "protocol.h" #include "queue.h" #include "transport_tcp.h" +#include "transport_tls.h" #include "unistd.h" #include "utils.h" #include @@ -119,6 +120,11 @@ static void cleanup(int sig) { } int main(int argc, char *argv[]) { + bool use_tls = false; + char *tls_cert = NULL; + char *tls_key = NULL; + int port = 8080; + signal(SIGPIPE, SIG_IGN); for (int i = 1; i < argc; i++) { if (strcmp(argv[i], "--stdio") == 0) { @@ -127,15 +133,38 @@ int main(int argc, char *argv[]) { return 0; } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) { set_log_level(LOG_LEVEL_DEBUG); + } else if (strcmp(argv[i], "--tls") == 0) { + use_tls = true; + } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) { + tls_cert = argv[++i]; + } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) { + tls_key = argv[++i]; + } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) { + port = atoi(argv[++i]); } } signal(SIGINT, cleanup); signal(SIGTERM, cleanup); - g_server = server_create(8080); + g_server = server_create(port); if (g_server == NULL) { log_message(LOG_LEVEL_ERROR, "Failed to create server"); return 1; } - server_listen(g_server, handler); + if (use_tls) { + if (!tls_cert || !tls_key) { + fprintf(stderr, "Error: --tls requires --cert and --key\n"); + server_delete(&g_server); + return 1; + } + tls_global_init(); + if (!server_create_tls(g_server, tls_cert, tls_key)) { + log_message(LOG_LEVEL_ERROR, "Failed to set up TLS"); + server_delete(&g_server); + return 1; + } + server_listen_tls(g_server, handler); + } else { + server_listen(g_server, handler); + } return 0; } diff --git a/src/shared/config.c b/src/shared/config.c index 1838d4d..c25ae10 100644 --- a/src/shared/config.c +++ b/src/shared/config.c @@ -39,6 +39,9 @@ Config *config_create(char *version, char *send_directory, config->max_size = 0; config->min_size = 0; config->use_incremental = false; + config->use_tls = false; + config->tls_cert = NULL; + config->tls_key = NULL; return config; } @@ -74,6 +77,8 @@ void config_delete(Config *config) { for (int i = 0; i < config->include_count; i++) free(config->include_patterns[i]); free(config->include_patterns); + free(config->tls_cert); + free(config->tls_key); free(config); } diff --git a/src/shared/config.h b/src/shared/config.h index b581de7..bdf3169 100644 --- a/src/shared/config.h +++ b/src/shared/config.h @@ -33,6 +33,9 @@ typedef struct Config { unsigned long long max_size; unsigned long long min_size; bool use_incremental; + bool use_tls; + char *tls_cert; + char *tls_key; } Config; #define PROTOCOL_VERSION "1.1.0" diff --git a/src/shared/protocol.c b/src/shared/protocol.c index a95386e..73edfc2 100644 --- a/src/shared/protocol.c +++ b/src/shared/protocol.c @@ -1,6 +1,7 @@ #include "protocol.h" #include "log.h" #include +#include #include #include #include @@ -9,6 +10,7 @@ static __thread int io_read_fd = -1; static __thread int io_write_fd = -1; +static SSL *io_ssl = NULL; static unsigned long long io_bwlimit = 0; static long long bw_tokens = 0; @@ -54,6 +56,10 @@ static void bw_throttle(size_t bytes_written) { } } +void io_set_ssl(SSL *ssl) { + io_ssl = ssl; +} + static int io_fd(int dir_fd, int file_descriptor) { return (dir_fd != -1) ? dir_fd : file_descriptor; } @@ -66,8 +72,11 @@ bool send_n_data(int file_descriptor, void *data, size_t data_size) { size_t chunk = data_size - total_bytes_send; if (io_bwlimit > 0 && chunk > 65536) chunk = 65536; - ssize_t bytes_send = - write(fd, (char *)data + total_bytes_send, chunk); + ssize_t bytes_send; + if (io_ssl) + bytes_send = SSL_write(io_ssl, (char *)data + total_bytes_send, chunk); + else + bytes_send = write(fd, (char *)data + total_bytes_send, chunk); if (bytes_send <= 0) { log_message(LOG_LEVEL_ERROR, "Could not send data"); return false; @@ -84,8 +93,13 @@ bool receive_n_data(int file_descriptor, void *data, size_t data_size) { int fd = io_fd(io_read_fd, file_descriptor); size_t total_bytes_received = 0; while (total_bytes_received < data_size) { - ssize_t bytes_received = - read(fd, (char *)data + total_bytes_received, data_size - total_bytes_received); + ssize_t bytes_received; + if (io_ssl) + bytes_received = SSL_read(io_ssl, (char *)data + total_bytes_received, + data_size - total_bytes_received); + else + bytes_received = read(fd, (char *)data + total_bytes_received, + data_size - total_bytes_received); if (bytes_received <= 0) { if (bytes_received == 0) log_message(LOG_LEVEL_ERROR, "Connection closed while receiving data"); diff --git a/src/shared/protocol.h b/src/shared/protocol.h index 83b19c4..a9f6c20 100644 --- a/src/shared/protocol.h +++ b/src/shared/protocol.h @@ -10,6 +10,8 @@ enum NET_STATUS { STATUS_OK, STATUS_ERROR, STATUS_FINISHED, STATUS_NEXT, STATUS_ void io_set_fds(int read_fd, int write_fd); void io_set_bwlimit(unsigned long long bytes_per_sec); +typedef struct ssl_st SSL; +void io_set_ssl(SSL *ssl); bool send_n_data(int file_descriptor, void *data, size_t data_size); bool receive_n_data(int file_descriptor, void *data, size_t data_size); diff --git a/src/shared/transport_tcp.c b/src/shared/transport_tcp.c index 18bcaf4..8e1be80 100644 --- a/src/shared/transport_tcp.c +++ b/src/shared/transport_tcp.c @@ -36,6 +36,7 @@ Server *server_create(int port) { server->address.sin_addr.s_addr = INADDR_ANY; server->address.sin_port = htons(port); server->address_length = sizeof(server->address); + server->ssl_ctx = NULL; if (bind(server->file_descriptor, (struct sockaddr *)&server->address, server->address_length) < 0) { @@ -104,6 +105,8 @@ Client *client_create() { client->address.sin_family = AF_INET; client->address_length = sizeof(client->address); client->ssh_child_pid = -1; + client->ssl = NULL; + client->ssl_ctx = NULL; return client; } diff --git a/src/shared/transport_tcp.h b/src/shared/transport_tcp.h index 6479d2f..c9babfb 100644 --- a/src/shared/transport_tcp.h +++ b/src/shared/transport_tcp.h @@ -9,6 +9,7 @@ typedef struct Server { struct sockaddr_in address; unsigned int address_length; int file_descriptor; + void *ssl_ctx; } Server; typedef struct Client { @@ -16,6 +17,8 @@ typedef struct Client { unsigned int address_length; int file_descriptor; pid_t ssh_child_pid; + void *ssl; + void *ssl_ctx; } Client; Server *server_create(int port); diff --git a/src/shared/transport_tls.c b/src/shared/transport_tls.c new file mode 100644 index 0000000..8a1bfa8 --- /dev/null +++ b/src/shared/transport_tls.c @@ -0,0 +1,162 @@ +#include "transport_tls.h" +#include "log.h" +#include "protocol.h" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static SSL_CTX *g_ssl_ctx = NULL; + +bool tls_global_init(void) { + SSL_library_init(); + OpenSSL_add_all_algorithms(); + SSL_load_error_strings(); + return true; +} + +void tls_global_cleanup(void) { + if (g_ssl_ctx) { + SSL_CTX_free(g_ssl_ctx); + g_ssl_ctx = NULL; + } + EVP_cleanup(); +} + +static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert, const char *key) { + const SSL_METHOD *method = is_server ? TLS_server_method() : TLS_client_method(); + SSL_CTX *ctx = SSL_CTX_new(method); + if (!ctx) { + log_message(LOG_LEVEL_ERROR, "Unable to create SSL context"); + ERR_print_errors_fp(stderr); + return NULL; + } + + if (cert && key) { + if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) { + log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert); + ERR_print_errors_fp(stderr); + SSL_CTX_free(ctx); + return NULL; + } + if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) { + log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key); + ERR_print_errors_fp(stderr); + SSL_CTX_free(ctx); + return NULL; + } + if (!SSL_CTX_check_private_key(ctx)) { + log_message(LOG_LEVEL_ERROR, "Private key does not match certificate"); + SSL_CTX_free(ctx); + return NULL; + } + } + + return ctx; +} + +static SSL *wrap_fd_with_ssl(int fd, SSL_CTX *ctx, bool is_server) { + SSL *ssl = SSL_new(ctx); + if (!ssl) { + log_message(LOG_LEVEL_ERROR, "Failed to create SSL object"); + return NULL; + } + SSL_set_fd(ssl, fd); + int ret; + if (is_server) + ret = SSL_accept(ssl); + else + ret = SSL_connect(ssl); + + if (ret <= 0) { + log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect"); + ERR_print_errors_fp(stderr); + SSL_free(ssl); + return NULL; + } + return ssl; +} + +bool server_create_tls(Server *server, const char *cert_path, const char *key_path) { + SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path); + if (!ctx) return false; + server->ssl_ctx = ctx; + return true; +} + +bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)) { + log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d", + ntohs(server->address.sin_port)); + if (listen(server->file_descriptor, SOMAXCONN) < 0) { + perror("Could not listen on port!"); + return false; + } + + signal(SIGCHLD, SIG_IGN); + + while (1) { + struct sockaddr_in client_addr; + socklen_t client_len = sizeof(client_addr); + int file_descriptor = + accept(server->file_descriptor, (struct sockaddr *)&client_addr, + &client_len); + if (file_descriptor < 0) { + perror("Could not accept the connection"); + continue; + } + log_message(LOG_LEVEL_INFO, "Received TLS Connection"); + pid_t pid = fork(); + if (pid == 0) { + close(server->file_descriptor); + + SSL *ssl = wrap_fd_with_ssl(file_descriptor, (SSL_CTX *)server->ssl_ctx, true); + if (!ssl) { + close(file_descriptor); + _exit(1); + } + io_set_ssl(ssl); + handler(file_descriptor); + SSL_shutdown(ssl); + SSL_free(ssl); + io_set_ssl(NULL); + close(file_descriptor); + _exit(0); + } + close(file_descriptor); + } + return true; +} + +bool client_connect_tls(Client *client, char *host, int port, + const char *cert_path, const char *key_path) { + client->address.sin_port = htons(port); + if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) { + perror("Could not convert host address!"); + return false; + } + if (connect(client->file_descriptor, (struct sockaddr *)&client->address, + client->address_length) < 0) { + perror("Could not connect to Server!"); + return false; + } + + SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path); + if (!ctx) return false; + client->ssl_ctx = ctx; + + SSL *ssl = wrap_fd_with_ssl(client->file_descriptor, ctx, false); + if (!ssl) { + SSL_CTX_free(ctx); + client->ssl_ctx = NULL; + return false; + } + client->ssl = ssl; + io_set_ssl(ssl); + return true; +} diff --git a/src/shared/transport_tls.h b/src/shared/transport_tls.h new file mode 100644 index 0000000..e7180d2 --- /dev/null +++ b/src/shared/transport_tls.h @@ -0,0 +1,14 @@ +#ifndef TRANSPORT_TLS_H +#define TRANSPORT_TLS_H + +#include "transport_tcp.h" +#include + +bool tls_global_init(void); +void tls_global_cleanup(void); + +bool server_create_tls(Server *server, const char *cert_path, const char *key_path); +bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)); +bool client_connect_tls(Client *client, char *host, int port, const char *cert_path, const char *key_path); + +#endif -- 2.52.0 From 864eb1316d80df84b8e4ce33a73a45904231cea5 Mon Sep 17 00:00:00 2001 From: TapTap Date: Thu, 16 Jul 2026 16:56:33 +0200 Subject: [PATCH 2/8] Fix TLS code review issues: SSL cleanup, TLS 1.2 min, CA verify, deprecation guards, server --help, port validation, __thread io_ssl, shared accept loop --- src/client/client_cli.c | 11 +++- src/client/client_send.c | 10 ++-- src/server/server.c | 35 ++++++++++- src/shared/config.c | 6 ++ src/shared/config.h | 1 + src/shared/protocol.c | 2 +- src/shared/transport_tcp.c | 61 ++++++++++++++----- src/shared/transport_tcp.h | 2 + src/shared/transport_tls.c | 118 ++++++++++++++++++------------------- src/shared/transport_tls.h | 8 ++- 10 files changed, 167 insertions(+), 87 deletions(-) diff --git a/src/client/client_cli.c b/src/client/client_cli.c index b7715f3..1a046e9 100644 --- a/src/client/client_cli.c +++ b/src/client/client_cli.c @@ -2,6 +2,7 @@ #include "config.h" #include "log.h" #include "protocol.h" +#include "transport_tls.h" #include "utils.h" #include #include @@ -50,7 +51,7 @@ static void print_usage(void) { printf(" --tls Enable TLS encryption\n"); printf(" --cert TLS certificate file (PEM)\n"); printf(" --key TLS private key file (PEM)\n"); - printf(" --ca CA certificate for verification (PEM)\n"); + printf(" --ca TLS CA certificate file (PEM)\n"); printf(" --help Show this help\n"); } @@ -230,6 +231,14 @@ int main(int argc, char *argv[]) { config->use_metadata = true; } + if (config->use_tls) { + if (!config->tls_cert || !config->tls_key) { + fprintf(stderr, "Error: --tls requires --cert and --key\n"); + return 1; + } + tls_global_init(); + } + if (config->use_multithreading) return send_files_multithreaded(config); return send_files(config); diff --git a/src/client/client_send.c b/src/client/client_send.c index 452dd18..44c66c2 100644 --- a/src/client/client_send.c +++ b/src/client/client_send.c @@ -100,11 +100,11 @@ static int send_chunks_multithreaded(void *pipeline_context) { } client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port); } else if (context->config->use_tls) { - tls_global_init(); client = client_create(); if (!client || !client_connect_tls(client, server_host, server_port, - context->config->tls_cert, - context->config->tls_key)) { + context->config->tls_cert, + context->config->tls_key, + context->config->tls_ca)) { if (client) client_delete(client); fprintf(stderr, "Error: could not connect to server via TLS\n"); return thrd_error; @@ -254,10 +254,10 @@ int send_files(Config *config) { client = client_connect_ssh(config->ssh_destination, config->ssh_port); if (!client) return 1; } else if (config->use_tls) { - tls_global_init(); client = client_create(); if (!client || !client_connect_tls(client, server_host, server_port, - config->tls_cert, config->tls_key)) { + config->tls_cert, config->tls_key, + config->tls_ca)) { if (client) client_delete(client); fprintf(stderr, "Error: could not connect to server via TLS\n"); return 1; diff --git a/src/server/server.c b/src/server/server.c index 34e6071..c023381 100644 --- a/src/server/server.c +++ b/src/server/server.c @@ -119,15 +119,34 @@ static void cleanup(int sig) { _exit(0); } +static void print_server_usage(void) { + printf("FastSync Server\n"); + printf("Usage: fastsync-server [options]\n"); + printf("\n"); + printf("Options:\n"); + printf(" --stdio Run in stdio mode (SSH transport)\n"); + printf(" -p TCP port (default: 8080, range: 1-65535)\n"); + printf(" --tls Enable TLS encryption\n"); + printf(" --cert TLS certificate file (PEM)\n"); + printf(" --key TLS private key file (PEM)\n"); + printf(" --ca TLS CA certificate file (PEM)\n"); + printf(" -v, --verbose Enable debug logging\n"); + printf(" --help Show this help\n"); +} + int main(int argc, char *argv[]) { bool use_tls = false; char *tls_cert = NULL; char *tls_key = NULL; + char *tls_ca = NULL; int port = 8080; signal(SIGPIPE, SIG_IGN); for (int i = 1; i < argc; i++) { - if (strcmp(argv[i], "--stdio") == 0) { + if (strcmp(argv[i], "--help") == 0) { + print_server_usage(); + return 0; + } else if (strcmp(argv[i], "--stdio") == 0) { io_set_fds(STDIN_FILENO, STDOUT_FILENO); handler(STDIN_FILENO); return 0; @@ -139,10 +158,22 @@ int main(int argc, char *argv[]) { tls_cert = argv[++i]; } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) { tls_key = argv[++i]; + } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) { + tls_ca = argv[++i]; } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) { port = atoi(argv[++i]); + } else if (argv[i][0] == '-') { + fprintf(stderr, "Unknown option: %s\n", argv[i]); + print_server_usage(); + return 1; } } + + if (port < 1 || port > 65535) { + fprintf(stderr, "Error: port must be between 1 and 65535\n"); + return 1; + } + signal(SIGINT, cleanup); signal(SIGTERM, cleanup); g_server = server_create(port); @@ -157,7 +188,7 @@ int main(int argc, char *argv[]) { return 1; } tls_global_init(); - if (!server_create_tls(g_server, tls_cert, tls_key)) { + if (!server_create_tls(g_server, tls_cert, tls_key, tls_ca)) { log_message(LOG_LEVEL_ERROR, "Failed to set up TLS"); server_delete(&g_server); return 1; diff --git a/src/shared/config.c b/src/shared/config.c index c25ae10..6b585d7 100644 --- a/src/shared/config.c +++ b/src/shared/config.c @@ -42,6 +42,7 @@ Config *config_create(char *version, char *send_directory, config->use_tls = false; config->tls_cert = NULL; config->tls_key = NULL; + config->tls_ca = NULL; return config; } @@ -79,6 +80,7 @@ void config_delete(Config *config) { free(config->include_patterns); free(config->tls_cert); free(config->tls_key); + free(config->tls_ca); free(config); } @@ -154,6 +156,10 @@ Config *config_receive(int file_descriptor) { config->include_count = 0; config->max_size = 0; config->min_size = 0; + config->use_tls = false; + config->tls_cert = NULL; + config->tls_key = NULL; + config->tls_ca = NULL; if (!send_status(file_descriptor, STATUS_OK)) goto error; return config; diff --git a/src/shared/config.h b/src/shared/config.h index bdf3169..050ef4c 100644 --- a/src/shared/config.h +++ b/src/shared/config.h @@ -36,6 +36,7 @@ typedef struct Config { bool use_tls; char *tls_cert; char *tls_key; + char *tls_ca; } Config; #define PROTOCOL_VERSION "1.1.0" diff --git a/src/shared/protocol.c b/src/shared/protocol.c index 73edfc2..5c06ec0 100644 --- a/src/shared/protocol.c +++ b/src/shared/protocol.c @@ -10,7 +10,7 @@ static __thread int io_read_fd = -1; static __thread int io_write_fd = -1; -static SSL *io_ssl = NULL; +static __thread SSL *io_ssl = NULL; static unsigned long long io_bwlimit = 0; static long long bw_tokens = 0; diff --git a/src/shared/transport_tcp.c b/src/shared/transport_tcp.c index 8e1be80..82e33ba 100644 --- a/src/shared/transport_tcp.c +++ b/src/shared/transport_tcp.c @@ -1,6 +1,7 @@ #include "transport_tcp.h" #include "log.h" #include +#include #include #include #include @@ -52,43 +53,63 @@ Server *server_create(int port) { void server_delete(Server **server) { if (server == NULL || *server == NULL) return; close((*server)->file_descriptor); + if ((*server)->ssl_ctx) { + SSL_CTX_free((*server)->ssl_ctx); + (*server)->ssl_ctx = NULL; + } free(*server); *server = NULL; } -bool server_listen(Server *server, void (*handler)(int file_descriptor)) { - log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d", - server->address.sin_port); +static void accept_loop(Server *server, void (*child_fn)(int, void *), + void *child_ctx, const char *log_fmt) { if (listen(server->file_descriptor, SOMAXCONN) < 0) { perror("Could not listen on port!"); - return false; + return; } - signal(SIGCHLD, SIG_IGN); - while (1) { struct sockaddr_in client_addr; socklen_t client_len = sizeof(client_addr); - int file_descriptor = - accept(server->file_descriptor, (struct sockaddr *)&client_addr, - &client_len); - if (file_descriptor < 0) { + int fd = accept(server->file_descriptor, (struct sockaddr *)&client_addr, + &client_len); + if (fd < 0) { perror("Could not accept the connection"); continue; } - log_message(LOG_LEVEL_INFO, "Received Connection"); + log_message(LOG_LEVEL_INFO, "%s", log_fmt); pid_t pid = fork(); if (pid == 0) { close(server->file_descriptor); - handler(file_descriptor); - close(file_descriptor); + child_fn(fd, child_ctx); + close(fd); _exit(0); } - close(file_descriptor); + close(fd); } +} + +struct plain_ctx { void (*handler)(int); }; + +static void plain_child_fn(int fd, void *ctx) { + ((struct plain_ctx *)ctx)->handler(fd); +} + +bool server_listen(Server *server, void (*handler)(int file_descriptor)) { + log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d", + ntohs(server->address.sin_port)); + struct plain_ctx ctx = {handler}; + accept_loop(server, plain_child_fn, &ctx, "Received Connection"); return true; } +void server_accept_loop(Server *server, void (*child_fn)(int, void *), + void *child_ctx, const char *log_fmt) { + log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d", + ntohs(server->address.sin_port)); + accept_loop(server, child_fn, child_ctx, log_fmt); +} + Client *client_create() { int file_descriptor = socket(AF_INET, SOCK_STREAM, 0); if (file_descriptor < 0) { @@ -127,6 +148,11 @@ bool client_connect(Client *client, char *host, int port) { } void client_disconnect(Client *client) { + if (client->ssl) { + SSL_shutdown(client->ssl); + SSL_free(client->ssl); + client->ssl = NULL; + } close(client->file_descriptor); if (client->ssh_child_pid > 0) { int status; @@ -136,7 +162,10 @@ void client_disconnect(Client *client) { } void client_delete(Client *client) { - if (client == NULL) - return; + if (client == NULL) return; + if (client->ssl_ctx) { + SSL_CTX_free(client->ssl_ctx); + client->ssl_ctx = NULL; + } free(client); } diff --git a/src/shared/transport_tcp.h b/src/shared/transport_tcp.h index c9babfb..b176c18 100644 --- a/src/shared/transport_tcp.h +++ b/src/shared/transport_tcp.h @@ -23,6 +23,8 @@ typedef struct Client { Server *server_create(int port); bool server_listen(Server *server, void (*handler)(int file_descriptor)); +void server_accept_loop(Server *server, void (*child_fn)(int, void *), + void *child_ctx, const char *log_fmt); void server_delete(Server **server); Client *client_create(); bool client_connect(Client *client, char *host, int port); diff --git a/src/shared/transport_tls.c b/src/shared/transport_tls.c index 8a1bfa8..2c9423f 100644 --- a/src/shared/transport_tls.c +++ b/src/shared/transport_tls.c @@ -1,6 +1,7 @@ #include "transport_tls.h" #include "log.h" #include "protocol.h" +#include "transport_tcp.h" #include #include #include @@ -12,52 +13,69 @@ #include #include -static SSL_CTX *g_ssl_ctx = NULL; - bool tls_global_init(void) { +#if OPENSSL_VERSION_NUMBER < 0x10100000L SSL_library_init(); OpenSSL_add_all_algorithms(); SSL_load_error_strings(); +#endif return true; } -void tls_global_cleanup(void) { - if (g_ssl_ctx) { - SSL_CTX_free(g_ssl_ctx); - g_ssl_ctx = NULL; +static void log_ssl_errors(void) { + unsigned long err; + char buf[256]; + while ((err = ERR_get_error()) != 0) { + ERR_error_string_n(err, buf, sizeof(buf)); + log_message(LOG_LEVEL_ERROR, "SSL error: %s", buf); } - EVP_cleanup(); } -static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert, const char *key) { - const SSL_METHOD *method = is_server ? TLS_server_method() : TLS_client_method(); +static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert, + const char *key, const char *ca_path) { + const SSL_METHOD *method = + is_server ? TLS_server_method() : TLS_client_method(); SSL_CTX *ctx = SSL_CTX_new(method); if (!ctx) { log_message(LOG_LEVEL_ERROR, "Unable to create SSL context"); - ERR_print_errors_fp(stderr); + log_ssl_errors(); return NULL; } + SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION); + if (cert && key) { if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) { log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert); - ERR_print_errors_fp(stderr); + log_ssl_errors(); SSL_CTX_free(ctx); return NULL; } if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) { log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key); - ERR_print_errors_fp(stderr); + log_ssl_errors(); SSL_CTX_free(ctx); return NULL; } if (!SSL_CTX_check_private_key(ctx)) { - log_message(LOG_LEVEL_ERROR, "Private key does not match certificate"); + log_message(LOG_LEVEL_ERROR, + "Private key does not match certificate"); SSL_CTX_free(ctx); return NULL; } } + if (ca_path) { + if (!SSL_CTX_load_verify_locations(ctx, ca_path, NULL)) { + log_message(LOG_LEVEL_ERROR, "Failed to load CA: %s", ca_path); + log_ssl_errors(); + SSL_CTX_free(ctx); + return NULL; + } + SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL); + SSL_CTX_set_verify_depth(ctx, 4); + } + return ctx; } @@ -75,78 +93,60 @@ static SSL *wrap_fd_with_ssl(int fd, SSL_CTX *ctx, bool is_server) { ret = SSL_connect(ssl); if (ret <= 0) { - log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect"); - ERR_print_errors_fp(stderr); + log_message(LOG_LEVEL_ERROR, "SSL %s failed", + is_server ? "accept" : "connect"); + log_ssl_errors(); SSL_free(ssl); return NULL; } return ssl; } -bool server_create_tls(Server *server, const char *cert_path, const char *key_path) { - SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path); +bool server_create_tls(Server *server, const char *cert_path, + const char *key_path, const char *ca_path) { + SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path, ca_path); if (!ctx) return false; server->ssl_ctx = ctx; return true; } +struct tls_child_ctx { + void (*handler)(int); + SSL_CTX *ssl_ctx; +}; + +static void tls_child_fn(int fd, void *arg) { + struct tls_child_ctx *ctx = (struct tls_child_ctx *)arg; + SSL *ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true); + if (!ssl) return; + io_set_ssl(ssl); + ctx->handler(fd); + SSL_shutdown(ssl); + SSL_free(ssl); + io_set_ssl(NULL); +} + bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)) { - log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d", - ntohs(server->address.sin_port)); - if (listen(server->file_descriptor, SOMAXCONN) < 0) { - perror("Could not listen on port!"); - return false; - } - - signal(SIGCHLD, SIG_IGN); - - while (1) { - struct sockaddr_in client_addr; - socklen_t client_len = sizeof(client_addr); - int file_descriptor = - accept(server->file_descriptor, (struct sockaddr *)&client_addr, - &client_len); - if (file_descriptor < 0) { - perror("Could not accept the connection"); - continue; - } - log_message(LOG_LEVEL_INFO, "Received TLS Connection"); - pid_t pid = fork(); - if (pid == 0) { - close(server->file_descriptor); - - SSL *ssl = wrap_fd_with_ssl(file_descriptor, (SSL_CTX *)server->ssl_ctx, true); - if (!ssl) { - close(file_descriptor); - _exit(1); - } - io_set_ssl(ssl); - handler(file_descriptor); - SSL_shutdown(ssl); - SSL_free(ssl); - io_set_ssl(NULL); - close(file_descriptor); - _exit(0); - } - close(file_descriptor); - } + struct tls_child_ctx ctx = {handler, (SSL_CTX *)server->ssl_ctx}; + server_accept_loop(server, tls_child_fn, &ctx, "Received TLS Connection"); return true; } bool client_connect_tls(Client *client, char *host, int port, - const char *cert_path, const char *key_path) { + const char *cert_path, const char *key_path, + const char *ca_path) { client->address.sin_port = htons(port); if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) { perror("Could not convert host address!"); return false; } if (connect(client->file_descriptor, (struct sockaddr *)&client->address, - client->address_length) < 0) { + client->address_length) < 0) { perror("Could not connect to Server!"); return false; } - SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path); + SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path, ca_path); if (!ctx) return false; client->ssl_ctx = ctx; diff --git a/src/shared/transport_tls.h b/src/shared/transport_tls.h index e7180d2..c04333f 100644 --- a/src/shared/transport_tls.h +++ b/src/shared/transport_tls.h @@ -5,10 +5,12 @@ #include bool tls_global_init(void); -void tls_global_cleanup(void); -bool server_create_tls(Server *server, const char *cert_path, const char *key_path); +bool server_create_tls(Server *server, const char *cert_path, + const char *key_path, const char *ca_path); bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)); -bool client_connect_tls(Client *client, char *host, int port, const char *cert_path, const char *key_path); +bool client_connect_tls(Client *client, char *host, int port, + const char *cert_path, const char *key_path, + const char *ca_path); #endif -- 2.52.0 From 20ede4391c4851c205874f024153ff613fbe8bda Mon Sep 17 00:00:00 2001 From: TapTap Date: Thu, 16 Jul 2026 17:08:15 +0200 Subject: [PATCH 3/8] Fix re-review: remove __thread from io_ssl (breaks -m), strtol port parsing, --ca warning --- src/server/server.c | 13 +++++++++---- src/shared/protocol.c | 2 +- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/server/server.c b/src/server/server.c index c023381..8c5af91 100644 --- a/src/server/server.c +++ b/src/server/server.c @@ -161,7 +161,13 @@ int main(int argc, char *argv[]) { } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) { tls_ca = argv[++i]; } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) { - port = atoi(argv[++i]); + char *end; + long p = strtol(argv[++i], &end, 10); + if (*end || p <= 0 || p > 65535) { + fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n", argv[i]); + return 1; + } + port = (int)p; } else if (argv[i][0] == '-') { fprintf(stderr, "Unknown option: %s\n", argv[i]); print_server_usage(); @@ -169,9 +175,8 @@ int main(int argc, char *argv[]) { } } - if (port < 1 || port > 65535) { - fprintf(stderr, "Error: port must be between 1 and 65535\n"); - return 1; + if (tls_ca && !use_tls) { + log_message(LOG_LEVEL_WARNING, "--ca has no effect without --tls"); } signal(SIGINT, cleanup); diff --git a/src/shared/protocol.c b/src/shared/protocol.c index 5c06ec0..73edfc2 100644 --- a/src/shared/protocol.c +++ b/src/shared/protocol.c @@ -10,7 +10,7 @@ static __thread int io_read_fd = -1; static __thread int io_write_fd = -1; -static __thread SSL *io_ssl = NULL; +static SSL *io_ssl = NULL; static unsigned long long io_bwlimit = 0; static long long bw_tokens = 0; -- 2.52.0 From 8b6550f8c618c0670932a82aa552302cb916228b Mon Sep 17 00:00:00 2001 From: TapTap Date: Fri, 17 Jul 2026 10:07:03 +0200 Subject: [PATCH 4/8] fix: io_set_ssl NULL in client_disconnect, SSL* type safety in protocol.h --- src/shared/protocol.h | 2 ++ src/shared/transport_tcp.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/shared/protocol.h b/src/shared/protocol.h index a9f6c20..27f8d8d 100644 --- a/src/shared/protocol.h +++ b/src/shared/protocol.h @@ -5,6 +5,8 @@ #include #include +typedef struct ssl_st SSL; + typedef int Status; enum NET_STATUS { STATUS_OK, STATUS_ERROR, STATUS_FINISHED, STATUS_NEXT, STATUS_CHUNK, STATUS_MANIFEST, STATUS_CHECK }; diff --git a/src/shared/transport_tcp.c b/src/shared/transport_tcp.c index 82e33ba..2050ea2 100644 --- a/src/shared/transport_tcp.c +++ b/src/shared/transport_tcp.c @@ -1,5 +1,6 @@ #include "transport_tcp.h" #include "log.h" +#include "protocol.h" #include #include #include @@ -152,6 +153,7 @@ void client_disconnect(Client *client) { SSL_shutdown(client->ssl); SSL_free(client->ssl); client->ssl = NULL; + io_set_ssl(NULL); } close(client->file_descriptor); if (client->ssh_child_pid > 0) { -- 2.52.0 From 907baf337946f1cf239a3247d4f3607c26f4bdde Mon Sep 17 00:00:00 2001 From: TapTap Date: Fri, 17 Jul 2026 10:47:46 +0200 Subject: [PATCH 5/8] fix: initialize ssl/ssl_ctx in client_connect_ssh to prevent use-after-free --- src/shared/transport_ssh.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/shared/transport_ssh.c b/src/shared/transport_ssh.c index 81ff680..63273ad 100644 --- a/src/shared/transport_ssh.c +++ b/src/shared/transport_ssh.c @@ -143,5 +143,7 @@ Client *client_connect_ssh(char *destination, int port) { client->address.sin_family = AF_UNIX; client->address_length = 0; client->ssh_child_pid = pid; + client->ssl = NULL; + client->ssl_ctx = NULL; return client; } -- 2.52.0 From 43cf0bd81e074d4afa60a5b767d4d0074d894a3f Mon Sep 17 00:00:00 2001 From: TapTap Date: Sat, 18 Jul 2026 17:43:46 +0200 Subject: [PATCH 6/8] ci: add libssl-dev to Docker image for TLS transport --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index fe7faa4..81bd44b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM ubuntu:24.04 RUN apt-get update && apt-get install -y --no-install-recommends \ - gcc g++ make libc6-dev cmake libzstd-dev git ca-certificates curl && \ + gcc g++ make libc6-dev cmake libzstd-dev libssl-dev git ca-certificates curl && \ curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \ apt-get install -y --no-install-recommends nodejs && \ rm -rf /var/lib/apt/lists/* -- 2.52.0 From 6de0998f6967cea2a3eb17dab9f369847e42d331 Mon Sep 17 00:00:00 2001 From: TapTap Date: Sat, 18 Jul 2026 17:50:55 +0200 Subject: [PATCH 7/8] ci: retrigger CI with updated Docker image -- 2.52.0 From fed77f6ce090d9b5acd08dadce8bfef6e2e61909 Mon Sep 17 00:00:00 2001 From: TapTap Date: Sat, 18 Jul 2026 17:53:08 +0200 Subject: [PATCH 8/8] ci: use v5 Docker image to force runner to pull updated image with libssl-dev --- .gitea/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index ca53903..92e579b 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -5,7 +5,7 @@ on: [push, pull_request] jobs: build-and-test: runs-on: ubuntu-latest - container: gitea.tap-tap.win/taptap/fastsync-ci:v4 + container: gitea.tap-tap.win/taptap/fastsync-ci:v5 steps: - name: Checkout uses: actions/checkout@v4 -- 2.52.0