2012-06-29 05:18:28 +00:00
|
|
|
# -*- coding: binary -*-
|
2006-04-24 18:49:00 +00:00
|
|
|
require 'rex/socket'
|
|
|
|
require 'rex/socket/tcp_server'
|
|
|
|
require 'rex/io/stream_server'
|
2015-03-14 20:52:23 +00:00
|
|
|
require 'rex/parser/x509_certificate'
|
2006-04-24 18:49:00 +00:00
|
|
|
|
|
|
|
###
|
|
|
|
#
|
|
|
|
# This class provides methods for interacting with an SSL wrapped TCP server. It
|
|
|
|
# implements the StreamServer IO interface.
|
|
|
|
#
|
|
|
|
###
|
2008-11-12 22:47:21 +00:00
|
|
|
module Rex::Socket::SslTcpServer
|
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
@@loaded_openssl = false
|
|
|
|
|
|
|
|
begin
|
|
|
|
require 'openssl'
|
|
|
|
@@loaded_openssl = true
|
|
|
|
require 'openssl/nonblock'
|
|
|
|
rescue ::Exception
|
|
|
|
end
|
|
|
|
|
|
|
|
include Rex::Socket::TcpServer
|
|
|
|
|
|
|
|
##
|
|
|
|
#
|
|
|
|
# Factory
|
|
|
|
#
|
|
|
|
##
|
|
|
|
|
|
|
|
def self.create(hash = {})
|
|
|
|
hash['Proto'] = 'tcp'
|
|
|
|
hash['Server'] = true
|
|
|
|
hash['SSL'] = true
|
|
|
|
self.create_param(Rex::Socket::Parameters.from_hash(hash))
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Wrapper around the base class' creation method that automatically sets
|
|
|
|
# the parameter's protocol to TCP and sets the server flag to true.
|
|
|
|
#
|
|
|
|
def self.create_param(param)
|
|
|
|
param.proto = 'tcp'
|
|
|
|
param.server = true
|
|
|
|
param.ssl = true
|
|
|
|
Rex::Socket.create_param(param)
|
|
|
|
end
|
|
|
|
|
|
|
|
def initsock(params = nil)
|
2015-07-24 16:16:09 +00:00
|
|
|
raise RuntimeError, 'No OpenSSL support' unless @@loaded_openssl
|
|
|
|
|
|
|
|
if params && params.sslctx && params.sslctx.kind_of?(OpenSSL::SSL::SSLContext)
|
|
|
|
self.sslctx = params.sslctx
|
|
|
|
else
|
|
|
|
self.sslctx = makessl(params)
|
|
|
|
end
|
|
|
|
|
2013-08-30 21:28:33 +00:00
|
|
|
super
|
|
|
|
end
|
|
|
|
|
|
|
|
# (see TcpServer#accept)
|
|
|
|
def accept(opts = {})
|
|
|
|
sock = super()
|
|
|
|
return if not sock
|
|
|
|
|
|
|
|
begin
|
|
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock, self.sslctx)
|
|
|
|
|
|
|
|
if not allow_nonblock?(ssl)
|
|
|
|
ssl.accept
|
|
|
|
else
|
|
|
|
begin
|
|
|
|
ssl.accept_nonblock
|
2013-11-20 18:20:34 +00:00
|
|
|
|
|
|
|
# Ruby 1.8.7 and 1.9.0/1.9.1 uses a standard Errno
|
|
|
|
rescue ::Errno::EAGAIN, ::Errno::EWOULDBLOCK
|
|
|
|
IO::select(nil, nil, nil, 0.10)
|
|
|
|
retry
|
|
|
|
|
|
|
|
# Ruby 1.9.2+ uses IO::WaitReadable/IO::WaitWritable
|
|
|
|
rescue ::Exception => e
|
|
|
|
if ::IO.const_defined?('WaitReadable') and e.kind_of?(::IO::WaitReadable)
|
|
|
|
IO::select( [ ssl ], nil, nil, 0.10 )
|
|
|
|
retry
|
|
|
|
end
|
|
|
|
|
|
|
|
if ::IO.const_defined?('WaitWritable') and e.kind_of?(::IO::WaitWritable)
|
|
|
|
IO::select( nil, [ ssl ], nil, 0.10 )
|
|
|
|
retry
|
|
|
|
end
|
|
|
|
|
|
|
|
raise e
|
2013-08-30 21:28:33 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
sock.extend(Rex::Socket::SslTcp)
|
|
|
|
sock.sslsock = ssl
|
|
|
|
sock.sslctx = self.sslctx
|
|
|
|
|
|
|
|
return sock
|
|
|
|
|
|
|
|
rescue ::OpenSSL::SSL::SSLError
|
|
|
|
sock.close
|
|
|
|
nil
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2014-11-19 21:56:49 +00:00
|
|
|
#
|
|
|
|
# Parse a certificate in unified PEM format that contains a private key and
|
|
|
|
# one or more certificates. The first certificate is the primary, while any
|
|
|
|
# additional certificates are treated as intermediary certificates. This emulates
|
|
|
|
# the behavior of web servers like nginx.
|
|
|
|
#
|
|
|
|
# @param [String] ssl_cert
|
|
|
|
# @return [String, String, Array]
|
|
|
|
def self.ssl_parse_pem(ssl_cert)
|
2015-03-14 20:52:23 +00:00
|
|
|
Rex::Parser::X509Certificate.parse_pem(ssl_cert)
|
2014-11-19 21:56:49 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Shim for the ssl_parse_pem module method
|
|
|
|
#
|
|
|
|
def ssl_parse_pem(ssl_cert)
|
|
|
|
Rex::Socket::SslTcpServer.ssl_parse_pem(ssl_cert)
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Generate a realistic-looking but obstensibly fake SSL
|
2014-11-22 00:25:04 +00:00
|
|
|
# certificate. This matches a typical "snakeoil" cert.
|
2014-11-19 21:56:49 +00:00
|
|
|
#
|
|
|
|
# @return [String, String, Array]
|
|
|
|
def self.ssl_generate_certificate
|
2014-11-22 00:25:04 +00:00
|
|
|
yr = 24*3600*365
|
|
|
|
vf = Time.at(Time.now.to_i - rand(yr * 3) - yr)
|
|
|
|
vt = Time.at(vf.to_i + (10 * yr))
|
|
|
|
cn = Rex::Text.rand_text_alpha_lower(rand(8)+2)
|
|
|
|
key = OpenSSL::PKey::RSA.new(2048){ }
|
2014-11-19 21:56:49 +00:00
|
|
|
cert = OpenSSL::X509::Certificate.new
|
2014-11-22 00:25:04 +00:00
|
|
|
cert.version = 2
|
|
|
|
cert.serial = (rand(0xFFFFFFFF) << 32) + rand(0xFFFFFFFF)
|
|
|
|
cert.subject = OpenSSL::X509::Name.new([["CN", cn]])
|
|
|
|
cert.issuer = OpenSSL::X509::Name.new([["CN", cn]])
|
|
|
|
cert.not_before = vf
|
|
|
|
cert.not_after = vt
|
2014-11-19 21:56:49 +00:00
|
|
|
cert.public_key = key.public_key
|
2014-11-22 00:25:04 +00:00
|
|
|
|
2014-11-19 21:56:49 +00:00
|
|
|
ef = OpenSSL::X509::ExtensionFactory.new(nil,cert)
|
|
|
|
cert.extensions = [
|
2014-11-22 00:25:04 +00:00
|
|
|
ef.create_extension("basicConstraints","CA:FALSE")
|
2014-11-19 21:56:49 +00:00
|
|
|
]
|
|
|
|
ef.issuer_certificate = cert
|
2014-11-22 00:25:04 +00:00
|
|
|
|
|
|
|
cert.sign(key, OpenSSL::Digest::SHA256.new)
|
2014-11-19 21:56:49 +00:00
|
|
|
|
|
|
|
[key, cert, nil]
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Shim for the ssl_generate_certificate module method
|
|
|
|
#
|
|
|
|
def ssl_generate_certificate
|
|
|
|
Rex::Socket::SslTcpServer.ssl_generate_certificate
|
|
|
|
end
|
2013-08-30 21:28:33 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Create a new ssl context. If +ssl_cert+ is not given, generates a new
|
|
|
|
# key and a leaf certificate with random values.
|
|
|
|
#
|
2013-11-20 04:34:31 +00:00
|
|
|
# @param [Rex::Socket::Parameters] params
|
2013-08-30 21:28:33 +00:00
|
|
|
# @return [::OpenSSL::SSL::SSLContext]
|
2013-11-20 04:34:31 +00:00
|
|
|
def makessl(params)
|
2014-11-19 21:56:49 +00:00
|
|
|
|
|
|
|
if params.ssl_cert
|
|
|
|
key, cert, chain = ssl_parse_pem(params.ssl_cert)
|
2013-08-30 21:28:33 +00:00
|
|
|
else
|
2014-11-19 21:56:49 +00:00
|
|
|
key, cert, chain = ssl_generate_certificate
|
2013-08-30 21:28:33 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
ctx = OpenSSL::SSL::SSLContext.new()
|
|
|
|
ctx.key = key
|
|
|
|
ctx.cert = cert
|
2014-11-19 21:56:49 +00:00
|
|
|
ctx.extra_chain_cert = chain
|
2013-11-20 05:42:58 +00:00
|
|
|
ctx.options = 0
|
2013-11-20 04:34:31 +00:00
|
|
|
|
2014-01-23 20:51:42 +00:00
|
|
|
# Older versions of OpenSSL do not export the OP_NO_COMPRESSION symbol
|
|
|
|
if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
|
|
|
|
# enable/disable the SSL/TLS-level compression
|
|
|
|
if params.ssl_compression
|
|
|
|
ctx.options &= ~OpenSSL::SSL::OP_NO_COMPRESSION
|
|
|
|
else
|
|
|
|
ctx.options |= OpenSSL::SSL::OP_NO_COMPRESSION
|
|
|
|
end
|
2013-11-20 04:34:31 +00:00
|
|
|
end
|
2013-08-30 21:28:33 +00:00
|
|
|
|
|
|
|
ctx.session_id_context = Rex::Text.rand_text(16)
|
|
|
|
|
|
|
|
return ctx
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# This flag determines whether to use the non-blocking openssl
|
|
|
|
# API calls when they are available. This is still buggy on
|
|
|
|
# Linux/Mac OS X, but is required on Windows
|
|
|
|
#
|
|
|
|
def allow_nonblock?(sock=self.sock)
|
|
|
|
avail = sock.respond_to?(:accept_nonblock)
|
|
|
|
if avail and Rex::Compat.is_windows
|
|
|
|
return true
|
|
|
|
end
|
|
|
|
false
|
|
|
|
end
|
|
|
|
|
|
|
|
attr_accessor :sslctx
|
2008-11-12 22:47:21 +00:00
|
|
|
end
|
2009-11-09 00:13:25 +00:00
|
|
|
|