remove polarssl support

polarssl (aka mbedTLS 1.3) has been EOL since end of 2016

Signed-off-by: Felix Fietkau <nbd@nbd.name>

4 files changed, 0 insertions, 399 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 49e79a1..c4a3c44 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -11,10 +11,6 @@ IF(MBEDTLS)
   ADD_DEFINITIONS(-DHAVE_MBEDTLS)
   SET(SSL_SRC ustream-mbedtls.c)
   SET(SSL_LIB mbedtls mbedcrypto mbedx509 m)
-ELSEIF(POLARSSL)
-  ADD_DEFINITIONS(-DHAVE_POLARSSL)
-  SET(SSL_SRC ustream-polarssl.c)
-  SET(SSL_LIB polarssl m)
 ELSEIF(CYASSL)
   CHECK_INCLUDE_FILES (cyassl/version.h HAVE_CYASSL_VERSION_H)
   SET(CMAKE_EXTRA_INCLUDE_FILES cyassl/ssl.h)
diff --git a/ustream-internal.h b/ustream-internal.h
index 4932a0d..a8c534f 100644
--- a/ustream-internal.h
+++ b/ustream-internal.h
@@ -23,8 +23,6 @@
 
 #if defined(HAVE_MBEDTLS)
 #include "ustream-mbedtls.h"
-#elif defined(HAVE_POLARSSL)
-#include "ustream-polarssl.h"
 #else
 #if defined(HAVE_CYASSL)
 #include <wolfssl/options.h>
diff --git a/ustream-polarssl.c b/ustream-polarssl.c
deleted file mode 100644
index 39bde21..0000000
--- a/ustream-polarssl.c
+++ /dev/null
@@ -1,340 +0,0 @@
-/*
- * ustream-ssl - library for SSL over ustream
- *
- * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <sys/types.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "ustream-ssl.h"
-#include "ustream-internal.h"
-
-static int urandom_fd = -1;
-
-static int s_ustream_read(void *ctx, unsigned char *buf, size_t len)
-{
-	struct ustream *s = ctx;
-	char *sbuf;
-	int slen;
-
-	if (s->eof)
-		return 0;
-
-	sbuf = ustream_get_read_buf(s, &slen);
-	if (slen > len)
-		slen = len;
-
-	if (!slen)
-		return POLARSSL_ERR_NET_WANT_READ;
-
-	memcpy(buf, sbuf, slen);
-	ustream_consume(s, slen);
-
-	return slen;
-}
-
-static int s_ustream_write(void *ctx, const unsigned char *buf, size_t len)
-{
-	struct ustream *s = ctx;
-	int ret;
-
-	ret = ustream_write(s, (const char *) buf, len, false);
-	if (ret < 0 || s->write_error)
-		return POLARSSL_ERR_NET_SEND_FAILED;
-
-	return ret;
-}
-
-__hidden void ustream_set_io(struct ustream_ssl_ctx *ctx, void *ssl, struct ustream *conn)
-{
-	ssl_set_bio(ssl, s_ustream_read, conn, s_ustream_write, conn);
-}
-
-static bool urandom_init(void)
-{
-	if (urandom_fd > -1)
-		return true;
-
-	urandom_fd = open("/dev/urandom", O_RDONLY);
-	if (urandom_fd < 0)
-		return false;
-
-	return true;
-}
-
-static int _urandom(void *ctx, unsigned char *out, size_t len)
-{
-	if (read(urandom_fd, out, len) < 0)
-		return POLARSSL_ERR_ENTROPY_SOURCE_FAILED;
-
-	return 0;
-}
-
-__hidden struct ustream_ssl_ctx *
-__ustream_ssl_context_new(bool server)
-{
-	struct ustream_ssl_ctx *ctx;
-
-	if (!urandom_init())
-		return NULL;
-
-	ctx = calloc(1, sizeof(*ctx));
-	if (!ctx)
-		return NULL;
-
-	ctx->server = server;
-	pk_init(&ctx->key);
-	x509_crt_init(&ctx->ca_cert);
-	x509_crt_init(&ctx->cert);
-
-	return ctx;
-}
-
-__hidden int __ustream_ssl_add_ca_crt_file(struct ustream_ssl_ctx *ctx, const char *file)
-{
-	int ret;
-
-	ret = x509_crt_parse_file(&ctx->ca_cert, file);
-	if (ret)
-		return -1;
-
-	return 0;
-}
-
-__hidden int __ustream_ssl_set_crt_file(struct ustream_ssl_ctx *ctx, const char *file)
-{
-	int ret;
-
-	ret = x509_crt_parse_file(&ctx->cert, file);
-	if (ret)
-		return -1;
-
-	return 0;
-}
-
-__hidden int __ustream_ssl_set_key_file(struct ustream_ssl_ctx *ctx, const char *file)
-{
-	int ret;
-
-	ret = pk_parse_keyfile(&ctx->key, file, NULL);
-	if (ret)
-		return -1;
-
-	return 0;
-}
-
-__hidden void __ustream_ssl_context_free(struct ustream_ssl_ctx *ctx)
-{
-	pk_free(&ctx->key);
-	x509_crt_free(&ctx->ca_cert);
-	x509_crt_free(&ctx->cert);
-	free(ctx);
-}
-
-static void ustream_ssl_error(struct ustream_ssl *us, int ret)
-{
-	us->error = ret;
-	uloop_timeout_set(&us->error_timer, 0);
-}
-
-static bool ssl_do_wait(int ret)
-{
-	switch(ret) {
-	case POLARSSL_ERR_NET_WANT_READ:
-	case POLARSSL_ERR_NET_WANT_WRITE:
-		return true;
-	default:
-		return false;
-	}
-}
-
-static void ustream_ssl_verify_cert(struct ustream_ssl *us)
-{
-	void *ssl = us->ssl;
-	const char *msg = NULL;
-	bool cn_mismatch;
-	int r;
-
-	r = ssl_get_verify_result(ssl);
-	cn_mismatch = r & BADCERT_CN_MISMATCH;
-	r &= ~BADCERT_CN_MISMATCH;
-
-	if (r & BADCERT_EXPIRED)
-		msg = "certificate has expired";
-	else if (r & BADCERT_REVOKED)
-		msg = "certificate has been revoked";
-	else if (r & BADCERT_NOT_TRUSTED)
-		msg = "certificate is self-signed or not signed by a trusted CA";
-	else
-		msg = "unknown error";
-
-	if (r) {
-		if (us->notify_verify_error)
-			us->notify_verify_error(us, r, msg);
-		return;
-	}
-
-	if (!cn_mismatch)
-		us->valid_cn = true;
-}
-
-__hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
-{
-	void *ssl = us->ssl;
-	int r;
-
-	r = ssl_handshake(ssl);
-	if (r == 0) {
-		ustream_ssl_verify_cert(us);
-		return U_SSL_OK;
-	}
-
-	if (ssl_do_wait(r))
-		return U_SSL_PENDING;
-
-	ustream_ssl_error(us, r);
-	return U_SSL_ERROR;
-}
-
-__hidden int __ustream_ssl_write(struct ustream_ssl *us, const char *buf, int len)
-{
-	void *ssl = us->ssl;
-	int done = 0, ret = 0;
-
-	while (done != len) {
-		ret = ssl_write(ssl, (const unsigned char *) buf + done, len - done);
-
-		if (ret < 0) {
-			if (ssl_do_wait(ret))
-				return done;
-
-			ustream_ssl_error(us, ret);
-			return -1;
-		}
-
-		done += ret;
-	}
-
-	return done;
-}
-
-__hidden int __ustream_ssl_read(struct ustream_ssl *us, char *buf, int len)
-{
-	int ret = ssl_read(us->ssl, (unsigned char *) buf, len);
-
-	if (ret < 0) {
-		if (ssl_do_wait(ret))
-			return U_SSL_PENDING;
-
-		if (ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY)
-			return 0;
-
-		ustream_ssl_error(us, ret);
-		return U_SSL_ERROR;
-	}
-
-	return ret;
-}
-
-#define TLS_DEFAULT_CIPHERS			\
-    TLS_CIPHER(AES_256_CBC_SHA256)		\
-    TLS_CIPHER(AES_256_GCM_SHA384)		\
-    TLS_CIPHER(AES_256_CBC_SHA)			\
-    TLS_CIPHER(CAMELLIA_256_CBC_SHA256)		\
-    TLS_CIPHER(CAMELLIA_256_CBC_SHA)		\
-    TLS_CIPHER(AES_128_CBC_SHA256)		\
-    TLS_CIPHER(AES_128_GCM_SHA256)		\
-    TLS_CIPHER(AES_128_CBC_SHA)			\
-    TLS_CIPHER(CAMELLIA_128_CBC_SHA256)		\
-    TLS_CIPHER(CAMELLIA_128_CBC_SHA)		\
-    TLS_CIPHER(3DES_EDE_CBC_SHA)
-
-static const int default_ciphersuites_nodhe[] =
-{
-#define TLS_CIPHER(v)				\
-	TLS_RSA_WITH_##v,
-	TLS_DEFAULT_CIPHERS
-#undef TLS_CIPHER
-	0
-};
-
-static const int default_ciphersuites[] =
-{
-#define TLS_CIPHER(v)				\
-	TLS_DHE_RSA_WITH_##v,			\
-	TLS_RSA_WITH_##v,
-	TLS_DEFAULT_CIPHERS
-#undef TLS_CIPHER
-	0
-};
-
-__hidden void *__ustream_ssl_session_new(struct ustream_ssl_ctx *ctx)
-{
-	ssl_context *ssl;
-	int auth;
-	int ep;
-
-	ssl = calloc(1, sizeof(ssl_context));
-	if (!ssl)
-		return NULL;
-
-	if (ssl_init(ssl)) {
-		free(ssl);
-		return NULL;
-	}
-
-	if (ctx->server) {
-		ep = SSL_IS_SERVER;
-		auth = SSL_VERIFY_NONE;
-	} else {
-		ep = SSL_IS_CLIENT;
-		auth = SSL_VERIFY_OPTIONAL;
-	}
-
-	ssl_set_endpoint(ssl, ep);
-	ssl_set_authmode(ssl, auth);
-	ssl_set_rng(ssl, _urandom, NULL);
-
-	if (ctx->server) {
-		ssl_set_ciphersuites(ssl, default_ciphersuites_nodhe);
-		if (ctx->cert.next)
-			ssl_set_ca_chain(ssl, ctx->cert.next, NULL, NULL);
-		ssl_set_own_cert(ssl, &ctx->cert, &ctx->key);
-	} else {
-		ssl_set_ciphersuites(ssl, default_ciphersuites);
-		ssl_set_ca_chain(ssl, &ctx->ca_cert, NULL, NULL);
-	}
-
-	ssl_session_reset(ssl);
-
-	return ssl;
-}
-
-__hidden void __ustream_ssl_session_free(void *ssl)
-{
-	ssl_free(ssl);
-	free(ssl);
-}
-
-__hidden void __ustream_ssl_update_peer_cn(struct ustream_ssl *us)
-{
-	struct ustream_ssl_ctx *ctx = us->ctx;
-
-	ssl_set_ca_chain(us->ssl, &ctx->ca_cert, NULL, us->peer_cn);
-}
diff --git a/ustream-polarssl.h b/ustream-polarssl.h
deleted file mode 100644
index 3c4a5ed..0000000
--- a/ustream-polarssl.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * ustream-ssl - library for SSL over ustream
- *
- * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef __USTREAM_POLARSSL_H
-#define __USTREAM_POLARSSL_H
-
-#include <polarssl/net.h>
-#include <polarssl/ssl.h>
-#include <polarssl/certs.h>
-#include <polarssl/x509.h>
-#include <polarssl/rsa.h>
-#include <polarssl/error.h>
-#include <polarssl/version.h>
-#include <polarssl/entropy.h>
-
-struct ustream_ssl_ctx {
-	pk_context key;
-	x509_crt ca_cert;
-	x509_crt cert;
-	bool server;
-};
-
-static inline char *__ustream_ssl_strerror(int error, char *buffer, int len)
-{
-	error_strerror(error, buffer, len);
-	return buffer;
-}
-
-static inline void __ustream_ssl_set_server_name(struct ustream_ssl *us)
-{
-	ssl_set_hostname(us->ssl, us->server_name);
-}
-
-void __ustream_ssl_update_peer_cn(struct ustream_ssl *us);
-void __ustream_ssl_session_free(void *ssl);
-void *__ustream_ssl_session_new(struct ustream_ssl_ctx *ctx);
-
-#endif