ssl_tool.c

Go to the documentation of this file.

 
#include "ssl_tool.h"
#include "dh_tool.h"
 
 
#ifdef ENABLE_SSL
 
 
//Buffer*  Base64_DHspki  = NULL;
//Buffer*  Base64_RSAspki = NULL;
 
//Buffer*  CRYPT_SharedKey        = NULL;
//const    EVP_CIPHER* CRYPT_Type = NULL;
//JBXL_DH* DHkey                  = NULL;
 
//int      KEYEX_Algorism = 0;
//int      CRYPT_Algorism = 0;
 
 
/*
typedef struct dh_st
{
    BIGNUM* p;
    BIGNUM* g;
    BIGNUM* pub_key;
    BIGNUM* priv_key; 
} DH;
 */
 
 
/*
###############################################################################################
for OpenSSL3
see https://stackoverflow.com/questions/71551116/openssl-3-diffie-hellman-key-exchange-c
see https://github.com/eugen15/diffie-hellman-cpp
###############################################################################################
*/
 
 
//
 
//Buffer   get_DHsharedkey   (Buffer pki,  JBXL_DH* dhkey);        // see dh_tools.c
 
int  gen_CRYPT_SharedKey(int keyex, Buffer spki, Buffer* shdkey, void* ptr)
{
    if (spki.buf==NULL || shdkey==NULL)  return FALSE;
 
    if (keyex==SSL_DH)  {
        JBXL_DH* dhkey = (JBXL_DH*)ptr;
        *shdkey = get_DHsharedkey(spki, dhkey);     // 共有鍵を得る
    }
    else if (keyex==SSL_RSA) {                      // 未実装
        *shdkey = dup_Buffer(spki); 
    }
    else return FALSE;
 
    return TRUE;
}
 
 
 
//
 
int   udp_send_crypt_Buffer_sockaddr_in(int sock, Buffer* data,  struct sockaddr_in* sv, Buffer* key, EVP_CIPHER* cipher)
{
    int  cc = 0;
    Buffer buf;
 
    if (data==NULL) return JBXL_ARGS_ERROR;
 
    if (key!=NULL && cipher!=NULL) {
        buf = encode_EVPAPI_Buffer(*data, *key, cipher);
        cc = udp_send_Buffer_sockaddr_in(sock, &buf, sv);
        free_Buffer(&buf);
    }
    else {
        cc = udp_send_Buffer_sockaddr_in(sock, data, sv);
    }
 
    return cc;
}
 
 
int  udp_recv_crypt_Buffer_sockaddr_in(int sock, Buffer* data, struct sockaddr_in* sv, Buffer* key, EVP_CIPHER* cipher)
{  
    Buffer  buf;
 
    buf = make_Buffer(RECVBUFSZ);
    int cc = udp_recv_Buffer_sockaddr_in(sock, &buf, sv);
    if (cc<=0) {
        free_Buffer(&buf);
        return cc;
    }
   
    if (key!=NULL && cipher!=NULL) {
        Buffer dec = decode_EVPAPI_Buffer(buf, *key, cipher);
        copy_Buffer(&dec, data);
        free_Buffer(&dec);
    }
    else {
        copy_Buffer(&buf, data);
    }
 
    cc = data->vldsz;
    free_Buffer(&buf);
    return cc;
}
 
 
 
//
 
int   udp_send_crypt_Buffer(int sock, Buffer* data,  struct addrinfo* sv, Buffer* key, EVP_CIPHER* cipher)
{
    int  cc = 0;
    Buffer buf;
 
    if (data==NULL) return JBXL_ARGS_ERROR;
 
    if (key!=NULL && cipher!=NULL) {
        buf = encode_EVPAPI_Buffer(*data, *key, cipher);
        cc = udp_send_Buffer(sock, &buf, sv);
        free_Buffer(&buf);
    }
    else {
        cc = udp_send_Buffer(sock, data, sv);
    }
 
    return cc;
}
 
 
int  udp_recv_crypt_Buffer(int sock, Buffer* data, struct addrinfo* sv, Buffer* key, EVP_CIPHER* cipher)
{  
    Buffer  buf;
 
    buf = make_Buffer(RECVBUFSZ);
    int cc = udp_recv_Buffer(sock, &buf, sv);
    if (cc<=0) {
        free_Buffer(&buf);
        return cc;
    }
   
    if (key!=NULL && cipher!=NULL) {
        Buffer dec = decode_EVPAPI_Buffer(buf, *key, cipher);
        copy_Buffer(&dec, data);
        free_Buffer(&dec);
    }
    else {
        copy_Buffer(&buf, data);
    }
 
    cc = data->vldsz;
    free_Buffer(&buf);
    return cc;
}
 
 
int  tcp_send_crypt_Buffer(int sock, Buffer* data, Buffer* key, EVP_CIPHER* cipher)
{
    int  cc = 0;
    Buffer buf;
 
    if (data==NULL) return JBXL_ARGS_ERROR;
 
    if (key!=NULL && cipher!=NULL) {
        buf = encode_EVPAPI_Buffer(*data, *key, cipher);
        cc = tcp_send_Buffer(sock, &buf);
        free_Buffer(&buf);
    }
    else {
        cc = tcp_send_Buffer(sock, data);
    }
 
    return cc;
}
 
 
int  tcp_recv_crypt_Buffer(int sock, Buffer* data, Buffer* key, EVP_CIPHER* cipher)
{  
    Buffer  buf;
 
    buf = make_Buffer(RECVBUFSZ);
    int cc = tcp_recv_Buffer(sock, &buf);
    if (cc<=0) {
        free_Buffer(&buf);
        return cc;
    }
   
    if (key!=NULL && cipher!=NULL) {
        Buffer dec = decode_EVPAPI_Buffer(buf, *key, cipher);
        copy_Buffer(&dec, data);
        free_Buffer(&dec);
    }
    else {
        copy_Buffer(&buf, data);
    }
 
    cc = data->vldsz;
    free_Buffer(&buf);
    return cc;
}
 
 
Buffer  get_plain_Buffer(Buffer data, Buffer* key, EVP_CIPHER* cipher)
{
    Buffer buf = init_Buffer();
    if (key==NULL || cipher==NULL) return buf;
 
    buf = decode_EVPAPI_Buffer(data, *key, cipher);
    return buf;
}
 
 
Buffer  get_crypt_Buffer(Buffer data, Buffer* key, EVP_CIPHER* cipher)
{
    Buffer buf = init_Buffer();
    if (key==NULL || cipher==NULL) return buf;
 
    buf = encode_EVPAPI_Buffer(data, *key, cipher);
    return buf;
}
 
 
int  tcp_send_crypt_mesg(int sock, char* mesg, Buffer* key, EVP_CIPHER* cipher)
{
    int  cc = 0;
    Buffer buf, enc;
 
    if (mesg==NULL) return JBXL_ARGS_ERROR;
    //DEBUG_MODE PRINT_ESC(" SEND -> [%s]\n", mesg);
 
    if (key!=NULL && cipher!=NULL) {
        buf = make_Buffer_bystr(mesg);
        enc = encode_EVPAPI_Buffer(buf, *key, cipher);
        free_Buffer(&buf);
        if (enc.vldsz>0) {
            buf = encode_base64_Buffer(enc);
            free_Buffer(&enc);
 
            //DEBUG_MODE PRINT_ESC("CSEND -> [%s]\n", (char*)buf.buf);
            cc = tcp_send_sBufferln(sock, &buf);
            free_Buffer(&buf);
        }
    }
    else {
        cc = tcp_send_mesg(sock, mesg);
    }
 
    return cc;
}
 
 
int  tcp_send_crypt_sBuffer(int sock, Buffer* mesg, Buffer* key, EVP_CIPHER* cipher)
{
    int  cc = 0;
    Buffer buf, enc;
 
    if (mesg==NULL) return JBXL_ARGS_ERROR;
    //DEBUG_MODE PRINT_ESC(" SEND -> [%s]\n", (char*)mesg->buf);
 
    if (key!=NULL && cipher!=NULL) {
        enc = encode_EVPAPI_Buffer(*mesg, *key, cipher);
        if (enc.vldsz>0) {
            buf = encode_base64_Buffer(enc);
            free_Buffer(&enc);
 
            //DEBUG_MODE PRINT_ESC("CSEND -> [%s]\n", (char*)buf.buf);
            cc = tcp_send_sBufferln(sock, &buf);
            free_Buffer(&buf);
        }
    }
    else {
        cc = tcp_send_sBuffer(sock, mesg);
    }
 
    return cc;
}
 
 
Buffer  get_plain_message(char* mesg, Buffer* key, EVP_CIPHER* cipher)
{
    Buffer  buf, dec;
 
    buf = make_Buffer_bystr(mesg);
    //DEBUG_MODE PRINT_ESC(" MESG -> [%s]\n", mesg);
    if (key==NULL || cipher==NULL) return buf;
 
    dec = decode_base64_Buffer(buf);
    if (dec.vldsz>0) {
        free_Buffer(&buf);
        buf = decode_EVPAPI_Buffer(dec, *key, cipher);
        free_Buffer(&dec);
        //DEBUG_MODE PRINT_ESC("DMESG -> [%s]\n", (char*)buf.buf);
    }
    return buf;
}
 
 
Buffer  get_plain_sBuffer(Buffer mesg, Buffer* key, EVP_CIPHER* cipher)
{
    Buffer buf, dec;
 
    buf = dup_Buffer(mesg);
    //DEBUG_MODE PRINT_ESC(" MESG -> [%s]\n", (char*)mesg.buf);
    if (key==NULL || cipher==NULL) return buf;
 
    dec = decode_base64_Buffer(buf);
    if (dec.vldsz>0) {
        free_Buffer(&buf);
        buf = decode_EVPAPI_Buffer(dec, *key, cipher);
        free_Buffer(&dec);
        //DEBUG_MODE PRINT_ESC("DMESG -> [%s]\n", (char*)buf.buf);
    }
    return buf;
}
 
 
Buffer  get_crypt_message(char* mesg, Buffer* key, EVP_CIPHER* cipher)
{
    Buffer  buf, enc;
 
    buf = make_Buffer_bystr(mesg);
    if (key==NULL || cipher==NULL) return buf;
 
    enc = encode_EVPAPI_Buffer(buf, *key, cipher);
    if (enc.vldsz>0) {
        free_Buffer(&buf);
        buf = encode_base64_Buffer(enc);
        free_Buffer(&enc);
    }
 
    return buf;
}
 
 
Buffer  get_crypt_sBuffer(Buffer mesg, Buffer* key, EVP_CIPHER* cipher)
{
    Buffer  buf, enc;
 
    buf = dup_Buffer(mesg);
    if (key==NULL || cipher==NULL) return buf;
 
    enc = encode_EVPAPI_Buffer(buf, *key, cipher);
    if (enc.vldsz>0) {
        free_Buffer(&buf);
        buf = encode_base64_Buffer(enc);
        free_Buffer(&enc);
    }
 
    return buf;
}
 
 
 
// Client's Side Check 
//
 
int  check_server_spki(Buffer ipaddr, Buffer spki, char* filename)
{
    Buffer  buf;
    FILE*    fp;
 
    buf = init_Buffer();
 
    fp = fopen(filename, "rb");
    if (fp!=NULL) {
        buf = read_spki_with_ipaddr(ipaddr, fp);
        fclose(fp);
        if (buf.buf!=NULL) {
            if (bincmp_Buffer(buf, spki)) {
                free_Buffer(&buf);
                return FALSE;
            }
        }
    }
 
    if (buf.buf==NULL) {
        fp = file_chmod_open(filename, (char*)"a", S_IRUSR | S_IWUSR);
        save_spki_with_ipaddr(ipaddr, spki, fp);
        fclose(fp);
    }
 
    return TRUE;
}
 
 
int  save_spki_with_ipaddr(Buffer ipa, Buffer pki, FILE* fp)
{    
    unsigned int  md;
 
    if (fp==NULL) return FALSE;
 
    md = JBXL_FIO_IPADDRESS | JBXL_FIO_STRING;
    if (!save_tagged_Buffer(ipa, fp, md, FALSE)) return FALSE;
 
    md = JBXL_FIO_SPKI | JBXL_FIO_ORIGINAL;
    if (!save_tagged_Buffer(pki, fp, md, FALSE)) return FALSE;
 
    return  TRUE;
}
 
 
Buffer  read_spki_with_ipaddr(Buffer ipa, FILE* fp)
{
    unsigned int  md;
    Buffer  ips, pki;
 
    pki = init_Buffer();
    if (ipa.buf==NULL) return pki;
 
    md  = JBXL_FIO_IPADDRESS | JBXL_FIO_STRING;
 
    ips = read_tagged_Buffer(fp, &md);
    while (!feof(fp) && strcmp_Buffer(ipa, ips)) {
        ips = read_tagged_Buffer(fp, &md);
    }
        
    if (!strcmp_Buffer(ipa, ips)) {
        md  = JBXL_FIO_SPKI | JBXL_FIO_ORIGINAL;    
        pki = read_tagged_Buffer(fp, &md);
    }
    free_Buffer(&ips);
 
    return pki;
}
 
 
 
// EVP API
//
 
EVP_CIPHER* init_EVPAPI_Buffer(int type)
{
    EVP_CIPHER* cipher = NULL;
 
    if (type==SSL_AES128CBC) {
        cipher = (EVP_CIPHER*)EVP_aes_128_cbc();
    }
    else if (type==SSL_3DES3CBC) {
        cipher = (EVP_CIPHER*)EVP_des_ede3_cbc();
    }
 
    return cipher;
}
 
 
Buffer  decode_EVPAPI_Buffer(Buffer buf, Buffer shdkey, EVP_CIPHER* cipher)
{
    int  sz, ss;
    Buffer dec;
    EVP_CIPHER_CTX* ctx;
    unsigned char*  iv;
 
    dec = init_Buffer();
    if (shdkey.buf==NULL || cipher==NULL) return dec;
 
    iv  = (unsigned char*)&(shdkey.buf[shdkey.vldsz - SSL_IV_SIZE]);
 
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    ctx = (EVP_CIPHER_CTX*)malloc(sizeof(EVP_CIPHER_CTX));  // v1.1.0
    memset(ctx, 0, sizeof(EVP_CIPHER_CTX));
    EVP_CIPHER_CTX_init(ctx);
#else
    ctx = EVP_CIPHER_CTX_new();                             // v1.1.1
    EVP_CIPHER_CTX_reset(ctx);
#endif
    
    EVP_DecryptInit_ex(ctx, cipher, NULL, shdkey.buf, iv);
 
    dec = make_Buffer(buf.vldsz + EVP_CIPHER_CTX_block_size(ctx) + 1);
    if (dec.buf==NULL) return dec;
 
    EVP_DecryptUpdate(ctx, dec.buf, &sz, buf.buf, buf.vldsz);
    EVP_DecryptFinal_ex(ctx, &(dec.buf[sz]), &ss);
    dec.vldsz = sz + ss;
    dec.buf[dec.vldsz] = '\0';
 
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    EVP_CIPHER_CTX_cleanup(ctx);
#endif
    free(ctx);
    return dec;
}
 
 
Buffer  encode_EVPAPI_Buffer(Buffer buf, Buffer shdkey, EVP_CIPHER* cipher)
{
    int  i, len, ss=0, sz;
    Buffer enc;
    EVP_CIPHER_CTX* ctx;
    unsigned char*  iv;
 
    enc = init_Buffer();
    //if (CRYPT_SharedKey==NULL || CRYPT_Type==NULL) return enc;
    if (shdkey.buf==NULL || cipher==NULL) return enc;
 
    iv  = (unsigned char*)&(shdkey.buf[shdkey.vldsz - SSL_IV_SIZE]);
 
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    ctx = (EVP_CIPHER_CTX*)malloc(sizeof(EVP_CIPHER_CTX));  // v1.1.0
    memset(ctx, 0, sizeof(EVP_CIPHER_CTX));
    EVP_CIPHER_CTX_init(ctx);
#else
    ctx = EVP_CIPHER_CTX_new();                             // v1.1.1
    EVP_CIPHER_CTX_reset(ctx);
#endif
 
    EVP_EncryptInit_ex(ctx, cipher, NULL, shdkey.buf, iv);
 
    len = buf.vldsz;
    enc = make_Buffer(len + EVP_CIPHER_CTX_block_size(ctx));
    if (enc.buf==NULL) return enc;
 
    for (i=0; i<len/SSL_ENC_BLCKSZ; i++) {
        EVP_EncryptUpdate(ctx, &(enc.buf[ss]), &sz, &(buf.buf[i*SSL_ENC_BLCKSZ]), SSL_ENC_BLCKSZ);
        ss += sz;
    }
    if (len%SSL_ENC_BLCKSZ!=0) {
        EVP_EncryptUpdate(ctx, &(enc.buf[ss]), &sz, &(buf.buf[i*SSL_ENC_BLCKSZ]), len%SSL_ENC_BLCKSZ);
        ss += sz;
    }
    EVP_EncryptFinal_ex(ctx, &(enc.buf[ss]), &sz);
    enc.vldsz = ss + sz;
 
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    EVP_CIPHER_CTX_cleanup(ctx);
#endif
    free(ctx);
    //EVP_CIPHER_CTX_free(ctx);
    return  enc;
}
 
 
void   free_EVP_CIPHER(EVP_CIPHER** p_cipher)
{
    if (p_cipher==NULL || *p_cipher==NULL) return;
 
    //free(*p_cipher);    // EVP_CIPHER* は解放する必要がない？
    *p_cipher = NULL;
 
    return;
}
 
 
 
// SSL/TLS
//         Reference: http://h71000.www7.hp.com/doc/83final/BA554_90007/ch04s03.html
//                    http://x68000.q-e-d.net/~68user/net/
//
 
void  ssl_init()
{
    SSL_library_init();
    SSL_load_error_strings();
}
 
 
 
SSL_CTX*  ssl_client_setup(char* ca)
{
    SSL_CTX* ssl_ctx;
 
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    ssl_ctx = SSL_CTX_new(SSLv23_client_method());
#else
    ssl_ctx = SSL_CTX_new(TLS_client_method());
#endif
    if (ssl_ctx==NULL) return NULL;
 
    // 認証局データを読み込む（PEMデータ）
    if (ca!=NULL) SSL_CTX_load_verify_locations(ssl_ctx, ca, NULL);
 
    return ssl_ctx;
}
 
 
SSL*  ssl_client_socket(int sock, SSL_CTX* ssl_ctx, int mode)
{
    if (ssl_ctx==NULL) return NULL;
    //
    SSL* ssl = SSL_new(ssl_ctx);
    if (ssl==NULL) {
        //SSL_CTX_free(ssl_ctx);
        return NULL;
    }
 
    int ret = SSL_set_fd(ssl, sock);
    if (ret!=1) {
        ssl_close(ssl);
        return NULL;
    }
 
    // サーバへ接続
    ret = SSL_connect(ssl);
    if (ret!=1) {
        ssl_close(ssl);
        return NULL;
    }
 
    // サーバ証明書のチェック
    if (mode==ON) {
        long lrt = SSL_get_verify_result(ssl);
        if (lrt!=X509_V_OK) {
            ssl_close(ssl);
            return NULL;
        }
    }
 
    return ssl;
}
 
 
SSL_CTX*  ssl_server_setup(char* crt_fn, char* key_fn, char* chn_fn)
{
    int  ret;
    SSL_CTX* ssl_ctx;
 
    //
#if OPENSSL_VERSION_NUMBER < 0x10101000L
    ssl_ctx = SSL_CTX_new(SSLv23_server_method());
#else
    ssl_ctx = SSL_CTX_new(TLS_server_method());
#endif
    if (ssl_ctx==NULL) return NULL;
 
    // サーバ証明書と秘密鍵の読み込み
    if (crt_fn!=NULL && key_fn!=NULL) {
        if (chn_fn!=NULL) {
            ret = SSL_CTX_use_certificate_file(ssl_ctx, crt_fn, SSL_FILETYPE_PEM);
        }
        else {
            ret = ssl_read_fullchain_cert_file(ssl_ctx, crt_fn);
        }
 
        if (ret==1) {
            ret = SSL_CTX_use_PrivateKey_file(ssl_ctx, key_fn, SSL_FILETYPE_PEM);
        }
        
        if (ret==1 && chn_fn!=NULL) {
            ret = ssl_add_chain_file(ssl_ctx, chn_fn);
        }
 
        if (ret!=1) {
            SSL_CTX_free(ssl_ctx);
            return NULL;
        }
 
        //SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);   // Client Certificate
        //SSL_CTX_set_verify_depth(ssl_ctx, 1);
    }
 
    return ssl_ctx;
}
 
 
int  ssl_add_chain_file(SSL_CTX* ssl_ctx, char* file)
{
    int ret = 0;
    if (file==NULL) return ret;
 
    BIO* bio = BIO_new(BIO_s_file());
    if (bio==NULL) return ret;
 
    BIO_read_filename(bio, file);
    X509* x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
    while(x509!=NULL) {
        ret = SSL_CTX_add_extra_chain_cert(ssl_ctx, x509);
        x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
    }
    BIO_free(bio);
 
    return ret;
}
 
 
int  ssl_read_fullchain_cert_file(SSL_CTX* ssl_ctx, char* file)
{
    int ret = 0;
    if (file==NULL) return ret;
 
    BIO*  bio  = NULL;
    X509* x509 = NULL;    
 
    bio = BIO_new(BIO_s_file());
    if (bio==NULL) return ret;
    BIO_read_filename(bio, file);
 
    // cert
    x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
    if (x509!=NULL) {
        ret = SSL_CTX_use_certificate(ssl_ctx, x509);
    }
    // chain
    if (ret==1) {
        x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
        while(x509!=NULL) {
            ret = SSL_CTX_add_extra_chain_cert(ssl_ctx, x509);
            x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
        }
    }
 
    BIO_free(bio);
 
    return ret;
}
 
 
#define  SSL_ACCEPT_COUNT_MAX  10
 
SSL*  ssl_server_socket(int sock, SSL_CTX* ssl_ctx)
{
    if (ssl_ctx==NULL) return NULL;
    int cnt_max = SSL_ACCEPT_COUNT_MAX;
 
    SSL* ssl = SSL_new(ssl_ctx);
    if (ssl==NULL) {
        //SSL_CTX_free(ssl_ctx);
        return NULL;
    }
 
    int ret = SSL_set_fd(ssl, sock);
    if (ret!=1) {
        ssl_close(ssl);
        return NULL;
    }
 
    int cnt = 0;
    SSL_set_accept_state(ssl);
    do {
        ret = SSL_accept(ssl);
        ret = SSL_get_error(ssl, ret);
        cnt++;
    } while (cnt<=cnt_max && (ret==SSL_ERROR_WANT_READ || ret==SSL_ERROR_WANT_WRITE || ret==SSL_ERROR_SYSCALL));
    
    if (ret==SSL_ERROR_SSL || cnt>cnt_max) {
        if (ret!=SSL_ERROR_SSL) ssl_close(ssl);
        return NULL;
    }
 
    return ssl;
}
 
 
void  ssl_close(SSL* ssl)
{
    if (ssl!=NULL) {
        //SSL_CTX* p = ssl->ctx;
        SSL_shutdown(ssl);
        SSL_free(ssl);
        //if (p!=NULL) SSL_CTX_free(p);
    }
}
 
 
tList*  ssl_get_cert_info(SSL* ssl)
{
    tList* lt;
    tList* lp;
    char* pp;
    char  buf[LBUF];
    X509* x509;
    BIO*  bio;
 
    pp = (char*)SSL_get_cipher(ssl);
    lt = lp = add_tList_node_str(NULL, "cipher", pp);
 
    pp = (char*)SSL_get_cipher_version(ssl);
    lp = add_tList_node_str(lp, "version", pp);
 
    x509 = SSL_get_peer_certificate(ssl); 
    if (x509==NULL) return lt;
 
    bio = BIO_new(BIO_s_mem());
    if (bio==NULL) {
        X509_free(x509);
        return lt;
    }
 
    X509_NAME_print_ex(bio, X509_get_subject_name(x509), 0, XN_FLAG_RFC2253);
    BIO_gets(bio, buf, LBUF);
    lp = add_tList_node_str(lp, "subject", buf);
 
    X509_NAME_print_ex(bio, X509_get_issuer_name(x509), 0, XN_FLAG_RFC2253);
    BIO_gets(bio, buf, LBUF);
    lp = add_tList_node_str(lp, "issuer", buf);
 
    ASN1_TIME_print(bio, X509_get_notBefore(x509));
    BIO_gets(bio, buf, LBUF);
    lp = add_tList_node_str(lp, "before", buf);
 
    ASN1_TIME_print(bio, X509_get_notAfter(x509));
    BIO_gets(bio, buf, LBUF);
    lp = add_tList_node_str(lp, "after", buf);
 
    BIO_free(bio);
    X509_free(x509);
 
    return lt;
}
 
 
 
// SSL communications
 
int  ssl_recv(SSL* ssl, char* rmsg, int size)
{
    int cc;
 
    if (ssl==NULL || rmsg==NULL) return JBXL_ARGS_ERROR;
 
    memset(rmsg, 0, size);
    cc = SSL_read(ssl, rmsg, size-1);
     
    if (cc<0) cc = JBXL_SSL_RECV_ERROR;
    return cc;
}
 
 
int  ssl_send(SSL* ssl, char* smsg, int size)
{
    int cc;
 
    if (ssl==NULL || smsg==NULL) return JBXL_ARGS_ERROR;
 
    if (size<=0) size = strlen(smsg);
    cc = SSL_write(ssl, smsg, size);
    
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_recv_wait(int sock, SSL* ssl, char* mesg, int sz, int tm)
{
    int  cc;
                 
    if (ssl==NULL || mesg==NULL) return JBXL_ARGS_ERROR;
 
    //memset(mesg, 0, sz);
    if (recv_wait(sock, tm)) {
        cc = ssl_recv(ssl, mesg, sz);
        //if (cc<=0) DEBUG_MODE PRINT_MESG("SSL_RECV_WAIT: Session Closed.\n");
    }
    else {
        //DEBUG_MODE PRINT_MESG("SSL_RECV_WAIT: Time Out. (%ds)\n", tm);
        return JBXL_NET_RECV_TIMEOUT;
    }
    
    return cc;
}
 
 
int  ssl_send_mesgln(SSL* ssl, char* mesg)
{  
    int   cc, sz;
    char* buf;
    
    if (ssl==NULL || mesg==NULL) return JBXL_ARGS_ERROR;
 
    sz = strlen(mesg) + 3;    // for CR+LF+0x00 
    buf = (char*)malloc(sz);
    if (buf==NULL) return JBXL_MALLOC_ERROR;
    
    strncpy(buf, mesg, sz);
    strncat(buf, "\r\n", 2);
    cc = ssl_send(ssl, buf, strlen(buf));
    
    free(buf);
    return cc;
}
 
 
int  ssl_recv_mstream(int sock, SSL* ssl, char* mesg, int sz, mstream* sb, int tm)
{
    int  cc;
    unsigned char* pp;
 
    if (ssl==NULL) return JBXL_ARGS_ERROR;
    if (mesg==NULL || sb==NULL) return JBXL_ARGS_ERROR;
    //memset(mesg, 0, sz);
 
    if (sb->buf==NULL) {
        *sb = make_mstream(RECVBUFSZ);
        if (sb->buf==NULL) return JBXL_MALLOC_ERROR;
    }
 
    while (sb->datano==0) {
        cc = ssl_recv_wait(sock, ssl, mesg, sz, tm);
        if (cc<=0) return cc;
        put_mstream(sb, (unsigned char*)mesg);
        //memset(mesg, 0, sz);
    }
 
    pp = get_mstream(sb);
    if (pp==NULL) return JBXL_NET_BUF_ERROR;
    if (strlen((const char*)pp)>=(unsigned int)sz) {
        memcpy(mesg, pp, sz-1);
        free(pp);
        return JBXL_NET_BUFSZ_ERROR;
    }
    memcpy(mesg, pp, strlen((const char*)pp));
 
    free(pp);
    return strlen(mesg);
}
 
 
 
// SSL with Buffer
 
int  ssl_recv_Buffer(SSL* ssl, Buffer* str)
{
    int cc;
 
    if (ssl==NULL || str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    memset(str->buf, 0, str->bufsz);
    str->vldsz = 0;
    str->state = JBXL_NORMAL;
 
    cc = SSL_read(ssl, str->buf, str->bufsz-1);
    if (cc>=0) str->vldsz = cc;
    else  cc = JBXL_SSL_RECV_ERROR;
    
    return cc;
}
 
 
int  ssl_send_Buffer(SSL* ssl, Buffer* str)
{
    int cc;
 
    if (ssl==NULL || str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    if (str->vldsz<0) str->vldsz = strlen((const char*)str->buf);
    cc = SSL_write(ssl, str->buf, str->vldsz);
 
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_recv_Buffer_wait(int sock, SSL* ssl, Buffer* str, int tm)
{
    int cc;
 
    if (ssl==NULL || str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    //memset(str->buf, 0, str->bufsz);
    str->vldsz = 0;
    cc = ssl_recv_wait(sock, ssl, (char*)str->buf, str->bufsz, tm);
    if (cc>=0) str->vldsz = cc;
 
    return cc;
}
 
 
int  ssl_send_sBuffer(SSL* ssl, Buffer* str)
{
    int cc;
 
    if (ssl==NULL || str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    cc = SSL_write(ssl, str->buf, strlen((const char*)str->buf));
 
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_send_sBufferln(SSL* ssl, Buffer* str)
{
    int    cc;
    Buffer buf;
 
    if (ssl==NULL || str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    buf = dup_Buffer(*str);
    cat_s2Buffer("\r\n", &buf);
    cc = SSL_write(ssl, buf.buf, strlen((const char*)buf.buf));
    free_Buffer(&buf);
 
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_recv_mstream_Buffer(int sock, SSL* ssl, Buffer* mesg, mstream* sb, int tm)
{
    int    cc;
    unsigned char* pp;
 
    if (ssl==NULL) return JBXL_ARGS_ERROR;
    if (mesg==NULL || mesg->buf==NULL || sb==NULL) return JBXL_ARGS_ERROR;
    *mesg = make_Buffer(LBUF);
 
    if (sb->buf==NULL) {
        *sb = make_mstream(RECVBUFSZ);
        if (sb->buf==NULL) return JBXL_MALLOC_ERROR;
    }
 
    while (sb->datano==0) {
        cc = ssl_recv_Buffer_wait(sock, ssl, mesg, tm);
        if (cc<=0) {
            free_Buffer(mesg);
            return cc;
        }
        put_mstream(sb, mesg->buf);
        clear_Buffer(mesg);
    }
 
    pp = get_mstream(sb);
    if (pp==NULL) return JBXL_NET_BUF_ERROR;
    copy_s2Buffer((char*)pp, mesg);
    free(pp);
 
    return mesg->vldsz;
}
 
 
int  ssl_recv_lines_Buffer(int sock, SSL* ssl, Buffer* mesg, int tm)
{
    int    cc;
    Buffer msg, buf;
 
    if (ssl==NULL || mesg==NULL || mesg->buf==NULL) return JBXL_ARGS_ERROR;
    buf = make_Buffer(LBUF);
 
    cc = ssl_recv_Buffer_wait(sock, ssl, &buf, tm);
    while (cc>0) {
        cat_Buffer(&buf, &msg);
        if (buf.buf[cc-1]==CHAR_LF) break;
        clear_Buffer(&buf);
        cc = ssl_recv_Buffer_wait(sock, ssl, &buf, tm);
    }
    free_Buffer(&buf);
        
    if (cc<=0) {
        free_Buffer(mesg);
        return cc;
    }
 
    return mesg->vldsz;
}
 
 
 
// SSL / TCP compati communications
 
int  ssl_tcp_recv(int sock, SSL* ssl, char* rmsg, int size)
{
    int cc;
 
    if (rmsg==NULL) return JBXL_ARGS_ERROR;
    memset(rmsg, 0, size);
    
    if (ssl!=NULL) cc = SSL_read(ssl, rmsg, size-1);
    else           cc = recv(sock, rmsg, size-1, 0);
     
    if (cc<0) cc = JBXL_SSL_RECV_ERROR;
    return cc;
}
 
 
int  ssl_tcp_send(int sock, SSL* ssl, char* smsg, int size)
{
    int cc;
 
    if (smsg==NULL) return JBXL_ARGS_ERROR;
 
    if (size<=0) size = strlen(smsg);
    if (ssl!=NULL) cc = SSL_write(ssl, smsg, size);
    else           cc = send(sock, smsg, size, 0);
    
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_tcp_recv_wait(int sock, SSL* ssl, char* mesg, int sz, int tm)
{
    int  cc;
 
    if (mesg==NULL) return JBXL_ARGS_ERROR;
 
    if (recv_wait(sock, tm)) {
        cc = ssl_tcp_recv(sock, ssl, mesg, sz);
        //if (cc<=0) DEBUG_MODE PRINT_MESG("SSL_TCP_RECV_WAIT: Session Closed. ret = %d. (%ds)\n", cc, tm);
    }
    else {
        //DEBUG_MODE PRINT_MESG("SSL_TCP_RECV_WAIT: Time Out. (%ds)\n", tm);
        return JBXL_NET_RECV_TIMEOUT;
    }
 
    return cc;
}
 
 
int  ssl_tcp_send_mesgln(int sock, SSL* ssl, char* mesg)
{  
    int   cc, sz;
    char* buf;
    
    if (mesg==NULL) return JBXL_ARGS_ERROR;
 
    sz = strlen(mesg) + 3;    // for CR+LF+0x00 
    buf = (char*)malloc(sz);
    if (buf==NULL) return JBXL_MALLOC_ERROR;
    
    strncpy(buf, mesg, sz);
    strncat(buf, "\r\n", 2);
    cc = ssl_tcp_send(sock, ssl, buf, strlen(buf));
    
    free(buf);
    return cc;
}
 
 
int  ssl_tcp_recv_mstream(int sock, SSL* ssl, char* mesg, int sz, mstream* sb, int tm)
{
    int  cc;
    unsigned char* pp;
 
    if (mesg==NULL || sb==NULL) return JBXL_ARGS_ERROR;
    //memset(mesg, 0, sz);
 
    if (sb->buf==NULL) {
        *sb = make_mstream(RECVBUFSZ);
        if (sb->buf==NULL) return JBXL_MALLOC_ERROR;
    }
 
    while (sb->datano==0) {
        cc = ssl_tcp_recv_wait(sock, ssl, mesg, sz, tm);
        if (cc<=0) return cc;
        put_mstream(sb, (unsigned char*)mesg);
        //memset(mesg, 0, sz);
    }
 
    pp = get_mstream(sb);
    if (pp==NULL) return JBXL_NET_BUF_ERROR;
    if (strlen((const char*)pp)>=(unsigned int)sz) {
        memcpy(mesg, pp, sz-1);
        free(pp);
        return JBXL_NET_BUFSZ_ERROR;
    }
    memcpy(mesg, pp, strlen((const char*)pp));
 
    free(pp);
    return strlen(mesg);
}
 
 
int  ssl_tcp_recv_Buffer(int sock, SSL* ssl, Buffer* str)
{
    int cc;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    memset(str->buf, 0, str->bufsz);
    str->vldsz = 0;
    str->state = JBXL_NORMAL;
 
    if (ssl!=NULL) cc = SSL_read(ssl, str->buf, str->bufsz-1);
    else           cc = recv(sock, str->buf, str->bufsz-1, 0);
 
    if (cc>=0) str->vldsz = cc;
    else  cc = JBXL_SSL_RECV_ERROR;
    return cc;
}
 
 
int  ssl_tcp_send_Buffer(int sock, SSL* ssl, Buffer* str)
{
    int cc;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    if (str->vldsz<0) str->vldsz = strlen((const char*)str->buf);
    if (ssl!=NULL) {
        cc = SSL_write(ssl, str->buf, str->vldsz);
    }
    else {
        cc = send(sock, str->buf, str->vldsz, 0);
    }
 
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_tcp_recv_Buffer_wait(int sock, SSL* ssl, Buffer* str, int tm)
{
    int cc;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    str->vldsz = 0;
    cc = ssl_tcp_recv_wait(sock, ssl, (char*)str->buf, str->bufsz, tm);
    if (cc>=0) str->vldsz = cc;
 
    //PRINT_MESG("ssl_tcp_recv_Buffer_wait : %s\n", (char*)str->buf);
    return cc;
}
 
 
int  ssl_tcp_recv_Buffer_tosize(int sock, SSL* ssl, Buffer* str, Buffer* mod, int size)
{
    int cc, sz;
    int modon = FALSE;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
    if (mod!=NULL && mod->buf!=NULL) modon = TRUE;
 
    if (modon) memset(mod->buf, 0, mod->vldsz);
    Buffer buf = make_Buffer(RECVBUFSZ);
 
    sz = str->vldsz;
    while (sz<size) {
        cc = ssl_tcp_recv_Buffer(sock, ssl, &buf);
        if (cc>0) {
            cat_Buffer(&buf, str);
            sz += cc;
        }
        else {
            if (cc<0) sz = cc;
            break;
        }
    }
    free_Buffer(&buf);
 
    if (sz>size && modon) {
        copy_b2Buffer((void*)(str->buf+size), mod, sz-size);
        str->vldsz = size;
    }
    return sz;
}
 
 
int  ssl_tcp_recv_Buffer_tosize_wait(int sock, SSL* ssl, Buffer* str, Buffer* mod, int size, int tm)
{
    int cc, sz;
    int modon = FALSE;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
    if (mod!=NULL && mod->buf!=NULL) modon = TRUE;
 
    if (modon) memset(mod->buf, 0, mod->vldsz);
    Buffer buf = make_Buffer(RECVBUFSZ);
 
    sz = str->vldsz;
    while (sz<size) {
        cc = ssl_tcp_recv_Buffer_wait(sock, ssl, &buf, tm);
        if (cc>0) {
            cat_Buffer(&buf, str);
            sz += cc;
        }
        else {
            if (cc<0) sz = cc;
            break;
        }
    }
    free_Buffer(&buf);
 
    if (sz>size && modon) {
        copy_b2Buffer((void*)(str->buf+size), mod, sz-size);
        str->vldsz = size;
    }
    return sz;
}
 
 
int  ssl_tcp_send_sBuffer(int sock, SSL* ssl, Buffer* str)
{
    int cc;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    if (ssl!=NULL) cc = SSL_write(ssl, str->buf, strlen((const char*)str->buf));
    else           cc = send(sock, str->buf, strlen((const char*)str->buf), 0);
 
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_tcp_send_sBufferln(int sock, SSL* ssl, Buffer* str)
{
    int    cc;
    Buffer buf;
 
    if (str==NULL || str->buf==NULL) return JBXL_ARGS_ERROR;
 
    buf = dup_Buffer(*str);
    cat_s2Buffer("\r\n", &buf);
 
    if (ssl!=NULL) cc = SSL_write(ssl, buf.buf, strlen((const char*)buf.buf));
    else           cc = send(sock, buf.buf, strlen((const char*)buf.buf), 0);
 
    free_Buffer(&buf);
 
    if (cc<0) cc = JBXL_SSL_SEND_ERROR;
    return cc;
}
 
 
int  ssl_tcp_recv_mstream_Buffer(int sock, SSL* ssl, Buffer* mesg, mstream* sb, int tm)
{
    int    cc;
    unsigned char* pp;
 
    if (mesg==NULL || mesg->buf==NULL || sb==NULL) return JBXL_ARGS_ERROR;
    *mesg = make_Buffer(LBUF);
 
    if (sb->buf==NULL) {
        *sb = make_mstream(RECVBUFSZ);
        if (sb->buf==NULL) return JBXL_MALLOC_ERROR;
    }
 
    while (sb->datano==0) {
        cc = ssl_tcp_recv_Buffer_wait(sock, ssl, mesg, tm);
        if (cc<=0) {
            free_Buffer(mesg);
            return cc;
        }
        put_mstream(sb, mesg->buf);
        clear_Buffer(mesg);
    }
 
    pp = get_mstream(sb);
    if (pp==NULL) return JBXL_NET_BUF_ERROR;
    copy_s2Buffer((char*)pp, mesg);
    free(pp);
 
    return mesg->vldsz;
}
 
 
int  ssl_tcp_recv_lines_Buffer(int sock, SSL* ssl, Buffer* mesg, int tm)
{
    int    cc;
    Buffer msg, buf;
 
    if (mesg==NULL || mesg->buf==NULL) return JBXL_ARGS_ERROR;
    buf = make_Buffer(LBUF);
 
    cc = ssl_tcp_recv_Buffer_wait(sock, ssl, &buf, tm);
    while (cc>0) {
        cat_Buffer(&buf, &msg);
        if (buf.buf[cc-1]==CHAR_LF) break;
        clear_Buffer(&buf);
        cc = ssl_tcp_recv_Buffer_wait(sock, ssl, &buf, tm);
    }
    free_Buffer(&buf);
        
    if (cc<=0) {
        free_Buffer(mesg);
        return cc;
    }
 
    return mesg->vldsz;
}
 
 
#endif