No one uses stunnel, ever, no matter how much you preach about security. I found out that only making SSL a setting in the client helped.
While I'm competition to mushclient (ok, ok, on different turf), I think it'd be better if I donated the SSL support (via GnuTLS).
The biggest part, SSL negotiation, is in
http://angband.pl/svn/kbtin/trunk/ssl.c
You can use just the first function, however, that would leave a gaping security hole (same as using stunnel the way you mention in the examples!!!). Mere SSL without certificate retention protects just against passively sniffing, someone who has access to a machine in between can h4x0r you with nothing but several lines of stunnel config...
The code from KBtin stores certificates in $HOMEDIR/.tintin/ssl/ -- for mushclient you'll probably want some other place, especially that $HOMEDIR is meaningless on Windows.
To actually use the negotiated connection, you'd use:
While I'm competition to mushclient (ok, ok, on different turf), I think it'd be better if I donated the SSL support (via GnuTLS).
The biggest part, SSL negotiation, is in
http://angband.pl/svn/kbtin/trunk/ssl.c
You can use just the first function, however, that would leave a gaping security hole (same as using stunnel the way you mention in the examples!!!). Mere SSL without certificate retention protects just against passively sniffing, someone who has access to a machine in between can h4x0r you with nothing but several lines of stunnel config...
The code from KBtin stores certificates in $HOMEDIR/.tintin/ssl/ -- for mushclient you'll probably want some other place, especially that $HOMEDIR is meaningless on Windows.
To actually use the negotiated connection, you'd use:
static int read_socket(struct session *ses, char *buffer, int len)
{
int ret;
if (ses->ssl)
{
do
{
ret=gnutls_record_recv(ses->ssl, buffer, len);
} while (ret==GNUTLS_E_INTERRUPTED || ret==GNUTLS_E_AGAIN);
return ret;
}
else
return read(ses->socket, buffer, len);
}
int write_socket(struct session *ses, char *buffer, int len)
{
int ret;
if (ses->ssl)
{
ret=gnutls_record_send(ses->ssl, buffer, len);
while (ret==GNUTLS_E_INTERRUPTED || ret==GNUTLS_E_AGAIN)
ret=gnutls_record_send(ses->ssl, 0, 0);
return ret;
}
else
return write(ses->socket, buffer, len);
}