TLS

Makefile.am

@@ -107,6 +107,13 @@ src_libbitcoin_network_la_SOURCES = \
     src/net/hosts.cpp \
     src/net/proxy.cpp \
     src/net/socket.cpp \
+    src/net/socket_connect.cpp \
+    src/net/socket_http.cpp \
+    src/net/socket_p2p.cpp \
+    src/net/socket_rpc.cpp \
+    src/net/socket_stop.cpp \
+    src/net/socket_wait.cpp \
+    src/net/socket_ws.cpp \
     src/protocols/protocol.cpp \
     src/protocols/protocol_address_in_209.cpp \
     src/protocols/protocol_address_out_209.cpp \
@@ -149,13 +156,15 @@ src_libbitcoin_network_la_SOURCES = \
     src/ssl/wolfssl/src/ssl_sk.c \
     src/ssl/wolfssl/src/x509.c \
     src/ssl/wolfssl/src/x509_str.c \
+    src/ssl/wolfssl/wolfcrypt/aes.c \
     src/ssl/wolfssl/wolfcrypt/asn.c \
     src/ssl/wolfssl/wolfcrypt/chacha.c \
     src/ssl/wolfssl/wolfcrypt/chacha20_poly1305.c \
     src/ssl/wolfssl/wolfcrypt/coding.c \
     src/ssl/wolfssl/wolfcrypt/cryptocb.c \
     src/ssl/wolfssl/wolfcrypt/curve25519.c \
     src/ssl/wolfssl/wolfcrypt/ecc.c \
+    src/ssl/wolfssl/wolfcrypt/ed25519.c \
     src/ssl/wolfssl/wolfcrypt/error.c \
     src/ssl/wolfssl/wolfcrypt/fe_operations.c \
     src/ssl/wolfssl/wolfcrypt/ge_operations.c \
@@ -167,6 +176,7 @@ src_libbitcoin_network_la_SOURCES = \
     src/ssl/wolfssl/wolfcrypt/poly1305.c \
     src/ssl/wolfssl/wolfcrypt/random.c \
     src/ssl/wolfssl/wolfcrypt/sha256.c \
+    src/ssl/wolfssl/wolfcrypt/sha512.c \
     src/ssl/wolfssl/wolfcrypt/signature.c \
     src/ssl/wolfssl/wolfcrypt/sp_int.c \
     src/ssl/wolfssl/wolfcrypt/wc_encrypt.c \
@@ -793,6 +803,7 @@ include_bitcoin_network_ssl_wolfssl_wolfcrypt_HEADERS = \
     include/bitcoin/network/ssl/wolfssl/wolfcrypt/error-crypt.h \
     include/bitcoin/network/ssl/wolfssl/wolfcrypt/fe_operations.h \
     include/bitcoin/network/ssl/wolfssl/wolfcrypt/fips_test.h \
+    include/bitcoin/network/ssl/wolfssl/wolfcrypt/ge_operations.h \
     include/bitcoin/network/ssl/wolfssl/wolfcrypt/hash.h \
     include/bitcoin/network/ssl/wolfssl/wolfcrypt/hmac.h \
     include/bitcoin/network/ssl/wolfssl/wolfcrypt/hpke.h \

builds/cmake/CMakeLists.txt

@@ -301,6 +301,13 @@ add_library( ${CANONICAL_LIB_NAME}
     "../../src/net/hosts.cpp"
     "../../src/net/proxy.cpp"
     "../../src/net/socket.cpp"
+    "../../src/net/socket_connect.cpp"
+    "../../src/net/socket_http.cpp"
+    "../../src/net/socket_p2p.cpp"
+    "../../src/net/socket_rpc.cpp"
+    "../../src/net/socket_stop.cpp"
+    "../../src/net/socket_wait.cpp"
+    "../../src/net/socket_ws.cpp"
     "../../src/protocols/protocol.cpp"
     "../../src/protocols/protocol_address_in_209.cpp"
     "../../src/protocols/protocol_address_out_209.cpp"
@@ -343,13 +350,15 @@ add_library( ${CANONICAL_LIB_NAME}
     "../../src/ssl/wolfssl/src/ssl_sk.c"
     "../../src/ssl/wolfssl/src/x509.c"
     "../../src/ssl/wolfssl/src/x509_str.c"
+    "../../src/ssl/wolfssl/wolfcrypt/aes.c"
     "../../src/ssl/wolfssl/wolfcrypt/asn.c"
     "../../src/ssl/wolfssl/wolfcrypt/chacha.c"
     "../../src/ssl/wolfssl/wolfcrypt/chacha20_poly1305.c"
     "../../src/ssl/wolfssl/wolfcrypt/coding.c"
     "../../src/ssl/wolfssl/wolfcrypt/cryptocb.c"
     "../../src/ssl/wolfssl/wolfcrypt/curve25519.c"
     "../../src/ssl/wolfssl/wolfcrypt/ecc.c"
+    "../../src/ssl/wolfssl/wolfcrypt/ed25519.c"
     "../../src/ssl/wolfssl/wolfcrypt/error.c"
     "../../src/ssl/wolfssl/wolfcrypt/fe_operations.c"
     "../../src/ssl/wolfssl/wolfcrypt/ge_operations.c"
@@ -361,6 +370,7 @@ add_library( ${CANONICAL_LIB_NAME}
     "../../src/ssl/wolfssl/wolfcrypt/poly1305.c"
     "../../src/ssl/wolfssl/wolfcrypt/random.c"
     "../../src/ssl/wolfssl/wolfcrypt/sha256.c"
+    "../../src/ssl/wolfssl/wolfcrypt/sha512.c"
     "../../src/ssl/wolfssl/wolfcrypt/signature.c"
     "../../src/ssl/wolfssl/wolfcrypt/sp_int.c"
     "../../src/ssl/wolfssl/wolfcrypt/wc_encrypt.c"

builds/msvc/vs2022/libbitcoin-network-test/libbitcoin-network-test.props

@@ -25,7 +25,7 @@
   <Target Name="WolfSSLTestSuppressions" BeforeTargets="ClCompile">
     <ItemGroup>
       <ClCompile Update="@(ClCompile)">
-        <AdditionalOptions Condition="$([System.String]::new('%(RelativeDir)').StartsWith('..\..\..\..\test\ssl\wolfssl\'))">/wd4005 /wd4189 /wd4245 /wd4267 /wd4701 /wd4702 /wd4703 %(AdditionalOptions)</AdditionalOptions>
+        <AdditionalOptions Condition="$([System.String]::new('%(RelativeDir)').StartsWith('..\..\..\..\test\ssl\wolfssl\'))">/wd4005 /wd4189 /wd4244 /wd4245 /wd4267 /wd4701 /wd4702 /wd4703 %(AdditionalOptions)</AdditionalOptions>
       </ClCompile>
     </ItemGroup>
   </Target>

builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.props

@@ -43,9 +43,6 @@
         <!-- These are only used as inlined headers, so never compile them directly. -->
         <ExcludedFromBuild Condition="$([System.String]::new('%(RelativeDir)').StartsWith('..\..\..\..\scr\ssl\wolfssl\src\'))">true</ExcludedFromBuild>
         <ExcludedFromBuild Condition="$([System.String]::new('%(RelativeDir)').StartsWith('..\..\..\..\include\bitcoin\network\ssl\wolfcrypt\src\'))">true</ExcludedFromBuild>
-
-        <!-- Exclude wolfssl sources when ssl is deselected (requires external linkage). -->
-        <ExcludedFromBuild Condition="$([System.String]::new('%(RelativeDir)').StartsWith('..\..\..\..\include\bitcoin\network\ssl\wolfcrypt\src\')) And '$(Option-ssl)' == 'false'">true</ExcludedFromBuild>
       </ClCompile>
     </ItemGroup>
   </Target>

builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj

@@ -201,6 +201,13 @@
     <ClCompile Include="..\..\..\..\src\net\hosts.cpp" />
     <ClCompile Include="..\..\..\..\src\net\proxy.cpp" />
     <ClCompile Include="..\..\..\..\src\net\socket.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_connect.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_http.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_p2p.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_rpc.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_stop.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_wait.cpp" />
+    <ClCompile Include="..\..\..\..\src\net\socket_ws.cpp" />
     <ClCompile Include="..\..\..\..\src\protocols\protocol.cpp" />
     <ClCompile Include="..\..\..\..\src\protocols\protocol_address_in_209.cpp" />
     <ClCompile Include="..\..\..\..\src\protocols\protocol_address_out_209.cpp" />
@@ -243,13 +250,15 @@
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\ssl.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\tls.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\tls13.c" />
+    <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\aes.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\asn.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\chacha.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\chacha20_poly1305.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\coding.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\cryptocb.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\curve25519.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\ecc.c" />
+    <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\ed25519.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\error.c">
       <ObjectFileName>$(IntDir)src_ssl_wolfssl_wolfcrypt_error.c.obj</ObjectFileName>
     </ClCompile>
@@ -265,6 +274,7 @@
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\poly1305.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\random.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\sha256.c" />
+    <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\sha512.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\signature.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\sp_int.c" />
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\wc_encrypt.c" />
@@ -511,6 +521,7 @@
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\error-crypt.h" />
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\fe_operations.h" />
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\fips_test.h" />
+    <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\ge_operations.h" />
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\hash.h" />
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\hmac.h" />
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\hpke.h" />

builds/msvc/vs2022/libbitcoin-network/libbitcoin-network.vcxproj.filters

@@ -384,6 +384,27 @@
     <ClCompile Include="..\..\..\..\src\net\socket.cpp">
       <Filter>src\net</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_connect.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_http.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_p2p.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_rpc.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_stop.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_wait.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\net\socket_ws.cpp">
+      <Filter>src\net</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\protocols\protocol.cpp">
       <Filter>src\protocols</Filter>
     </ClCompile>
@@ -510,6 +531,9 @@
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\tls13.c">
       <Filter>src\ssl\wolfssl</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\aes.c">
+      <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\asn.c">
       <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
     </ClCompile>
@@ -531,6 +555,9 @@
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\ecc.c">
       <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\ed25519.c">
+      <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\error.c">
       <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
     </ClCompile>
@@ -564,6 +591,9 @@
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\sha256.c">
       <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\sha512.c">
+      <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\ssl\wolfssl\wolfcrypt\signature.c">
       <Filter>src\ssl\wolfssl\wolfcrypt</Filter>
     </ClCompile>
@@ -1298,6 +1328,9 @@
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\fips_test.h">
       <Filter>include\bitcoin\network\ssl\wolfssl\wolfcrypt</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\ge_operations.h">
+      <Filter>include\bitcoin\network\ssl\wolfssl\wolfcrypt</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\include\bitcoin\network\ssl\wolfssl\wolfcrypt\hash.h">
       <Filter>include\bitcoin\network\ssl\wolfssl\wolfcrypt</Filter>
     </ClInclude>

include/bitcoin/network.hpp

@@ -255,6 +255,7 @@
 #include <bitcoin/network/ssl/wolfssl/wolfcrypt/error-crypt.h>
 #include <bitcoin/network/ssl/wolfssl/wolfcrypt/fe_operations.h>
 #include <bitcoin/network/ssl/wolfssl/wolfcrypt/fips_test.h>
+#include <bitcoin/network/ssl/wolfssl/wolfcrypt/ge_operations.h>
 #include <bitcoin/network/ssl/wolfssl/wolfcrypt/hash.h>
 #include <bitcoin/network/ssl/wolfssl/wolfcrypt/hmac.h>
 #include <bitcoin/network/ssl/wolfssl/wolfcrypt/hpke.h>

include/bitcoin/network/asio.hpp

@@ -64,8 +64,20 @@ namespace asio
     /// asio::ssl::context
     namespace ssl
     {
+        static constexpr auto version =
+            boost::asio::ssl::context::tls_server;
+        static constexpr auto options =
+            boost::asio::ssl::context::no_sslv2 |
+            boost::asio::ssl::context::no_sslv3 |
+            boost::asio::ssl::context::no_tlsv1 |
+            boost::asio::ssl::context::no_tlsv1_1 |
+            ////boost::asio::ssl::context::single_dh_use |
+            boost::asio::ssl::context::default_workarounds;
+        static constexpr auto authenticate =
+            boost::asio::ssl::verify_peer |
+            boost::asio::ssl::verify_fail_if_no_peer_cert;
+
         typedef boost::asio::ssl::context context;
-        typedef std::shared_ptr<context> context_ptr;
         typedef boost::asio::ssl::stream<asio::socket> socket;
     }
 }

include/bitcoin/network/beast.hpp

@@ -27,6 +27,7 @@
 #include <boost/beast/core.hpp>
 #include <boost/beast/http.hpp>
 #include <boost/beast/websocket.hpp>
+#include <boost/beast/websocket/ssl.hpp>
 
 /// Convenience namespace for commonly used boost beast aliases.
 
@@ -89,17 +90,14 @@ namespace http
 /// ws::socket
 namespace ws
 {
-    template <class Socket>
-    using stream = boost::beast::websocket::stream<Socket>;
-    using socket = stream<boost::asio::ip::tcp::socket>;
-
-    using frame_type = boost::beast::websocket::frame_type;
+    using socket = boost::beast::websocket::stream<asio::tcp::socket>;
     using decorator = boost::beast::websocket::stream_base::decorator;
+    using frame_type = boost::beast::websocket::frame_type;
 
     /// ws::ssl::socket
     namespace ssl
     {
-        using socket = stream<asio::ssl::socket>;
+        using socket = boost::beast::websocket::stream<asio::ssl::socket>;
     }
 }
 

include/bitcoin/network/boost.hpp

@@ -21,7 +21,7 @@
 
 #include <bitcoin/network/preprocessor.hpp>
 
-// Pull in any base boost configuration before including boost.
+// Must pull in any base boost configuration before including boost.
 #include <bitcoin/system.hpp>
 
 #include <boost/bimap.hpp>
@@ -30,13 +30,11 @@
 #include <boost/circular_buffer.hpp>
 #include <boost/system/error_code.hpp>
 
-// TODO: exclude ssl sources when HAVE_SSL not defined (lib and test).
-// TODO: exclude ssl include paths when HAVE_SSL not defined (lib and test).
 #if defined(HAVE_SSL)
     #define BOOST_ASIO_USE_WOLFSSL
 #endif
 
-/// Without HAVE_SSL openssl headers must be externally defined for asio.
+/// SSL is always defined, must be externally linked if !HAVE_SSL.
 #include <boost/asio/ssl.hpp>
 
 #endif

include/bitcoin/network/channels/channel_rpc.hpp

@@ -36,6 +36,7 @@ class channel_rpc
 {
 public:
     typedef std::shared_ptr<channel_rpc> ptr;
+    using options_t = network::settings::tls_server;
     using dispatcher = rpc::dispatcher<Interface>;
 
     /// Subscribe to request from client (requires strand).

include/bitcoin/network/define.hpp

@@ -63,6 +63,7 @@ namespace network {
 // Each header includes only its required common headers.
 // protcols are not included in any headers except protocols.
 
+// /ssl           : <nothing>
 // /async         : define
 // /log           : define /async
 // /messages      : define memory /async

include/bitcoin/network/error.hpp

@@ -143,6 +143,14 @@ enum error_t : uint8_t
     socks_unassigned_failure,
     socks_response_invalid,
 
+    // tls
+    tls_set_options,
+    tls_use_certificate,
+    tls_use_private_key,
+    tls_set_password,
+    tls_set_default_verify,
+    tls_set_add_verify,
+
     ////// http 4xx client error
     bad_request,
     ////unauthorized,

include/bitcoin/network/net.hpp

@@ -217,12 +217,14 @@ class BCT_API net
     friend class session;
 
     /// I/O factories.
-    virtual acceptor::ptr create_acceptor() NOEXCEPT;
+    virtual acceptor::ptr create_acceptor(
+        const socket::context& context={}) NOEXCEPT;
     virtual connector::ptr create_seed_connector() NOEXCEPT;
     virtual connector::ptr create_manual_connector() NOEXCEPT;
     virtual connectors_ptr create_connectors(size_t count) NOEXCEPT;
     virtual connector::ptr create_connector(const settings::socks5& socks,
-        const steady_clock::duration& timeout, uint32_t maximum) NOEXCEPT;
+        const socket::parameters::duration& connect_timeout,
+        uint32_t maximum_request) NOEXCEPT;
 
     /// Sequences.
     virtual void do_start(const result_handler& handler) NOEXCEPT;

include/bitcoin/network/net/acceptor.hpp

@@ -40,6 +40,7 @@ class BCT_API acceptor
 {
 public:
     typedef std::shared_ptr<acceptor> ptr;
+    using parameters = socket::parameters;
 
     DELETE_COPY_MOVE(acceptor);
 
@@ -48,7 +49,7 @@ class BCT_API acceptor
 
     /// Construct an instance.
     acceptor(const logger& log, asio::strand& strand, asio::context& service,
-        size_t maximum_request, std::atomic_bool& suspended) NOEXCEPT;
+        std::atomic_bool& suspended, parameters&& parameters) NOEXCEPT;
 
     /// Asserts/logs stopped.
     virtual ~acceptor() NOEXCEPT;
@@ -85,10 +86,10 @@ class BCT_API acceptor
     bool stranded() const NOEXCEPT;
 
     // These are thread safe.
-    const size_t maximum_;
-    asio::context& service_;
     asio::strand& strand_;
+    asio::context& service_;
     std::atomic_bool& suspended_;
+    const parameters parameters_;
 
     // These are protected by strand.
     asio::acceptor acceptor_;