Convert the asio server from a weird example server to a generic proxy server.

4 files changed, 599 insertions, 334 deletions

diff --git a/doc/manual/tls.rst b/doc/manual/tls.rst
index b3ec1c0ea..1b7929f1b 100644
--- a/doc/manual/tls.rst
+++ b/doc/manual/tls.rst
@@ -269,9 +269,7 @@ TLS Clients
    resized as needed to process inputs). Otherwise some reasonable
    default is used.
 
-A simple TLS client example:
-
-.. literalinclude:: ../../src/cmd/tls_client.cpp
+A TLS client example using BSD sockets is in `src/cmd/tls_client.cpp`
 
 TLS Servers
 ----------------------------------------
@@ -309,10 +307,8 @@ not until they actually receive a hello without this parameter.
    renegotiation, but might change across different connections using
    that session.
 
-An example TLS server that can handle concurrent connections using
-asio follows:
-
-.. literalinclude:: ../../src/cmd/tls_server_asio.cpp
+An example TLS server implementation using asio is available in
+`src/cmd/tls_proxy.cpp`.
 
 .. _tls_sessions:
 
diff --git a/doc/relnotes/1_11_13.rst b/doc/relnotes/1_11_13.rst
index 8a9ed5872..d0ca04245 100644
--- a/doc/relnotes/1_11_13.rst
+++ b/doc/relnotes/1_11_13.rst
@@ -1,6 +1,9 @@
 Version 1.11.13, Not Yet Released
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
+* The command line tool now has `tls_proxy` which negotiates TLS with
+  clients and forwards the plaintext to a specified port.
+
 * Add MCEIES, a McEliece-based integrated encryption system using
   AES-256 in OCB mode for message encryption/authentication.
 
@@ -9,7 +12,7 @@ Version 1.11.13, Not Yet Released
 * Add SHA-512/256
 
 * The format of serialized TLS sessions has changed. Additiionally, PEM
-  formatted sessions now use the label of "TLS SESSION" instead of "SSL SESSION".
+  formatted sessions now use the label of "TLS SESSION" instead of "SSL SESSION"
 
 * Serialized TLS sessions are now encrypted using AES-256/GCM instead of a
   CBC+HMAC construction.
diff --git a/src/cmd/tls_proxy.cpp b/src/cmd/tls_proxy.cpp
new file mode 100644
index 000000000..867e2280e
--- /dev/null
+++ b/src/cmd/tls_proxy.cpp
@@ -0,0 +1,592 @@
+/*
+* TLS Server Proxy
+* (C) 2014,2015 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include "apps.h"
+
+#if defined(BOTAN_HAS_TLS)
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <thread>
+
+#define _GLIBCXX_HAVE_GTHR_DEFAULT
+#include <boost/asio.hpp>
+#include <boost/bind.hpp>
+#include <boost/shared_ptr.hpp>
+#include <boost/enable_shared_from_this.hpp>
+
+#include <botan/tls_server.h>
+#include <botan/x509cert.h>
+#include <botan/pkcs8.h>
+#include <botan/auto_rng.h>
+
+#if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
+  #include <botan/tls_session_manager_sqlite.h>
+#endif
+
+using boost::asio::ip::tcp;
+
+namespace Botan {
+
+namespace {
+
+void log_exception(const char* where, const std::exception& e)
+   {
+   std::cout << where << ' ' << e.what() << std::endl;
+   }
+
+void log_error(const char* where, const boost::system::error_code& error)
+   {
+   std::cout << where << ' ' << error.message() << std::endl;
+   }
+
+void log_binary_message(const char* where, const byte buf[], size_t buf_len)
+   {
+   //std::cout << where << ' ' << hex_encode(buf, buf_len) << std::endl;
+   }
+
+void log_text_message(const char* where,  const byte buf[], size_t buf_len)
+   {
+   //const char* c = reinterpret_cast<const char*>(buf);
+   //std::cout << where << ' ' << std::string(c, c + buf_len)  << std::endl;
+   }
+
+class tls_proxy_session : public boost::enable_shared_from_this<tls_proxy_session>
+   {
+   public:
+      enum { readbuf_size = 4 * 1024 };
+
+      typedef boost::shared_ptr<tls_proxy_session> pointer;
+
+      static pointer create(boost::asio::io_service& io,
+                            TLS::Session_Manager& session_manager,
+                            Credentials_Manager& credentials,
+                            TLS::Policy& policy,
+                            RandomNumberGenerator& rng,
+                            tcp::resolver::iterator endpoints)
+         {
+         return pointer(
+            new tls_proxy_session(
+               io,
+               session_manager,
+               credentials,
+               policy,
+               rng,
+               endpoints)
+            );
+         }
+
+      tcp::socket& client_socket() { return m_client_socket; }
+
+      void start()
+         {
+         m_c2p.resize(readbuf_size);
+
+         client_read(boost::system::error_code(), 0); // start read loop
+         }
+
+      void stop() { m_client_socket.close(); }
+
+   private:
+      tls_proxy_session(boost::asio::io_service& io,
+                        TLS::Session_Manager& session_manager,
+                        Credentials_Manager& credentials,
+                        TLS::Policy& policy,
+                        RandomNumberGenerator& rng,
+                        tcp::resolver::iterator endpoints) :
+         m_strand(io),
+         m_server_endpoints(endpoints),
+         m_client_socket(io),
+         m_server_socket(io),
+         m_tls(boost::bind(&tls_proxy_session::tls_proxy_write_to_client, this, _1, _2),
+               boost::bind(&tls_proxy_session::tls_client_write_to_proxy, this, _1, _2),
+               boost::bind(&tls_proxy_session::tls_alert_cb, this, _1, _2, _3),
+               boost::bind(&tls_proxy_session::tls_handshake_complete, this, _1),
+               session_manager,
+               credentials,
+               policy,
+               rng)
+         {
+         }
+
+      void client_read(const boost::system::error_code& error,
+                       size_t bytes_transferred)
+         {
+         if(error)
+            {
+            log_error("Read failed", error);
+            stop();
+            return;
+            }
+
+         try
+            {
+            if(!m_tls.is_active())
+               log_binary_message("From client", &m_c2p[0], bytes_transferred);
+            m_tls.received_data(&m_c2p[0], bytes_transferred);
+            }
+         catch(std::exception& e)
+            {
+            log_exception("TLS connection failed", e);
+            stop();
+            return;
+            }
+
+         m_client_socket.async_read_some(
+            boost::asio::buffer(&m_c2p[0], m_c2p.size()),
+            m_strand.wrap(boost::bind(&tls_proxy_session::client_read, shared_from_this(),
+                                      boost::asio::placeholders::error,
+                                      boost::asio::placeholders::bytes_transferred)));
+         }
+
+      void handle_client_write_completion(const boost::system::error_code& error)
+         {
+         if(error)
+            {
+            log_error("Client write", error);
+            stop();
+            return;
+            }
+
+         m_p2c.clear();
+         tls_proxy_write_to_client(nullptr, 0); // initiate another write if needed
+         }
+
+      void handle_server_write_completion(const boost::system::error_code& error)
+         {
+         if(error)
+            {
+            log_error("Server write", error);
+            stop();
+            return;
+            }
+
+         m_p2s.clear();
+         tls_proxy_write_to_server(nullptr, 0); // initiate another write if needed
+         }
+
+      void tls_client_write_to_proxy(const byte buf[], size_t buf_len)
+         {
+         tls_proxy_write_to_server(buf, buf_len);
+         }
+
+      void tls_proxy_write_to_client(const byte buf[], size_t buf_len)
+         {
+         if(buf_len > 0)
+            m_p2c_pending.insert(m_p2c_pending.end(), buf, buf + buf_len);
+
+         // no write now active and we still have output pending
+         if(m_p2c.empty() && !m_p2c_pending.empty())
+            {
+            std::swap(m_p2c_pending, m_p2c);
+
+            //log_binary_message("To Client", &m_p2c[0], m_p2c.size());
+
+            boost::asio::async_write(
+               m_client_socket,
+               boost::asio::buffer(&m_p2c[0], m_p2c.size()),
+               m_strand.wrap(boost::bind(
+                                &tls_proxy_session::handle_client_write_completion,
+                                shared_from_this(),
+                                boost::asio::placeholders::error)));
+            }
+         }
+
+      void tls_proxy_write_to_server(const byte buf[], size_t buf_len)
+         {
+         if(buf_len > 0)
+            m_p2s_pending.insert(m_p2s_pending.end(), buf, buf + buf_len);
+
+         // no write now active and we still have output pending
+         if(m_p2s.empty() && !m_p2s_pending.empty())
+            {
+            std::swap(m_p2s_pending, m_p2s);
+
+            log_text_message("To Server", &m_p2s[0], m_p2s.size());
+
+            boost::asio::async_write(
+               m_server_socket,
+               boost::asio::buffer(&m_p2s[0], m_p2s.size()),
+               m_strand.wrap(boost::bind(
+                                &tls_proxy_session::handle_server_write_completion,
+                                shared_from_this(),
+                                boost::asio::placeholders::error)));
+            }
+         }
+
+      void server_read(const boost::system::error_code& error,
+                       size_t bytes_transferred)
+         {
+         if(error)
+            {
+            log_error("Server read failed", error);
+            stop();
+            return;
+            }
+
+         try
+            {
+            if(bytes_transferred)
+               {
+               log_text_message("Server to client", &m_s2p[0], m_s2p.size());
+               log_binary_message("Server to client", &m_s2p[0], m_s2p.size());
+               m_tls.send(&m_s2p[0], bytes_transferred);
+               }
+            }
+         catch(std::exception& e)
+            {
+            log_exception("TLS connection failed", e);
+            stop();
+            return;
+            }
+
+         m_s2p.resize(readbuf_size);
+
+         m_server_socket.async_read_some(
+            boost::asio::buffer(&m_s2p[0], m_s2p.size()),
+            m_strand.wrap(boost::bind(&tls_proxy_session::server_read, shared_from_this(),
+                                      boost::asio::placeholders::error,
+                                      boost::asio::placeholders::bytes_transferred)));
+         }
+
+      bool tls_handshake_complete(const TLS::Session& session)
+         {
+         //std::cout << "Handshake from client complete\n";
+
+         m_hostname = session.server_info().hostname();
+
+         if(m_hostname != "")
+            std::cout << "Client requested hostname '" << m_hostname << "'\n";
+
+         async_connect(m_server_socket, m_server_endpoints,
+                       [this](boost::system::error_code ec, tcp::resolver::iterator endpoint)
+                       {
+                       if(ec)
+                          {
+                          log_error("Server connection", ec);
+                          return;
+                          }
+                       //std::cout << "Connected to " << endpoint->host_name() << ' '
+                       //<< endpoint->service_name() << "\n";
+                       tls_proxy_write_to_server(nullptr, 0);
+
+                       server_read(boost::system::error_code(), 0); // start read loop
+                       });
+         return true;
+         }
+
+      void tls_alert_cb(TLS::Alert alert, const byte[], size_t)
+         {
+         if(alert.type() == TLS::Alert::CLOSE_NOTIFY)
+            {
+            m_tls.close();
+            return;
+            }
+         else
+            std::cout << "Alert " << alert.type_string() << "\n";
+         }
+
+      boost::asio::io_service::strand m_strand;
+
+      tcp::resolver::iterator m_server_endpoints;
+
+      tcp::socket m_client_socket;
+      tcp::socket m_server_socket;
+
+      TLS::Server m_tls;
+      std::string m_hostname;
+
+      std::vector<byte> m_c2p;
+      std::vector<byte> m_p2c;
+      std::vector<byte> m_p2c_pending;
+
+      std::vector<byte> m_s2p;
+      std::vector<byte> m_p2s;
+      std::vector<byte> m_p2s_pending;
+   };
+
+class tls_proxy_server
+   {
+   public:
+      typedef tls_proxy_session session;
+
+      tls_proxy_server(boost::asio::io_service& io, unsigned short port,
+                       tcp::resolver::iterator endpoints,
+                       Credentials_Manager& creds,
+                       TLS::Policy& policy,
+                       TLS::Session_Manager& session_mgr,
+                       RandomNumberGenerator& rng) :
+         m_acceptor(io, tcp::endpoint(tcp::v4(), port)),
+         m_server_endpoints(endpoints),
+         m_creds(creds),
+         m_policy(policy),
+         m_session_manager(session_mgr),
+         m_rng(rng)
+         {
+         session::pointer new_session = make_session();
+
+         m_acceptor.async_accept(
+            new_session->client_socket(),
+            boost::bind(
+               &tls_proxy_server::handle_accept,
+               this,
+               new_session,
+               boost::asio::placeholders::error)
+            );
+         }
+
+   private:
+      session::pointer make_session()
+         {
+         return session::create(
+            m_acceptor.get_io_service(),
+            m_session_manager,
+            m_creds,
+            m_policy,
+            m_rng,
+            m_server_endpoints
+            );
+         }
+
+      void handle_accept(session::pointer new_session,
+                         const boost::system::error_code& error)
+         {
+         if (!error)
+            {
+            new_session->start();
+
+            new_session = make_session();
+
+            m_acceptor.async_accept(
+               new_session->client_socket(),
+               boost::bind(
+                  &tls_proxy_server::handle_accept,
+                  this,
+                  new_session,
+                  boost::asio::placeholders::error)
+               );
+            }
+         }
+
+      tcp::acceptor m_acceptor;
+      tcp::resolver::iterator m_server_endpoints;
+
+      Credentials_Manager& m_creds;
+      TLS::Policy& m_policy;
+      TLS::Session_Manager& m_session_manager;
+      RandomNumberGenerator& m_rng;
+   };
+
+size_t choose_thread_count()
+   {
+   size_t result = std::thread::hardware_concurrency();
+
+   if(result)
+      return result;
+
+   return 2;
+   }
+
+class Proxy_Credentials_Manager : public Credentials_Manager
+   {
+   public:
+      Proxy_Credentials_Manager(RandomNumberGenerator& rng,
+                                const std::string& server_crt,
+                                const std::string& server_key)
+         {
+         try
+            {
+            Certificate_Info cert;
+
+
+            try
+               {
+               cert.key.reset(PKCS8::load_key(server_key, rng));
+               }
+            catch(std::exception& e)
+               {
+               log_exception("Loading server key", e);
+               throw; // fatal
+               }
+
+            try
+               {
+               DataSource_Stream in(server_crt);
+               while(!in.end_of_data())
+                  cert.certs.push_back(X509_Certificate(in));
+               }
+            catch(std::exception& e)
+               {
+               log_exception("Loading certs", e);
+               }
+
+            // TODO: attempt to validate chain ourselves
+
+            m_creds.push_back(cert);
+            }
+         catch(std::exception& e)
+            {
+            log_exception("Loading server key", e);
+            throw; // fatal
+            }
+
+         try
+            {
+            // TODO: make path configurable
+            std::shared_ptr<Certificate_Store> cs(new Certificate_Store_In_Memory("/usr/share/ca-certificates"));
+            m_certstores.push_back(cs);
+            }
+         catch(std::exception& e)
+            {
+            log_exception("Loading CA certs", e);
+            //throw; // not fatal
+            }
+         }
+
+      std::vector<Botan::Certificate_Store*>
+      trusted_certificate_authorities(const std::string& type,
+                                      const std::string& /*hostname*/)
+         {
+         std::vector<Botan::Certificate_Store*> v;
+
+         // don't ask for client certs
+         if(type == "tls-server")
+            return v;
+
+         for(auto&& cs : m_certstores)
+            v.push_back(cs.get());
+
+         return v;
+         }
+
+      void verify_certificate_chain(
+         const std::string& type,
+         const std::string& purported_hostname,
+         const std::vector<X509_Certificate>& cert_chain)
+         {
+         try
+            {
+            Credentials_Manager::verify_certificate_chain(type,
+                                                          purported_hostname,
+                                                          cert_chain);
+            }
+         catch(std::exception& e)
+            {
+            std::cout << "Certificate validation failure: " << e.what() << "\n";
+            throw;
+            }
+         }
+
+      std::vector<X509_Certificate> cert_chain(
+         const std::vector<std::string>& algos,
+         const std::string& type,
+         const std::string& hostname)
+         {
+         for(auto&& i : m_creds)
+            {
+            if(std::find(algos.begin(), algos.end(), i.key->algo_name()) == algos.end())
+               continue;
+
+            if(hostname != "" && !i.certs[0].matches_dns_name(hostname))
+               continue;
+
+            return i.certs;
+            }
+
+         return std::vector<X509_Certificate>();
+         }
+
+      Private_Key* private_key_for(const X509_Certificate& cert,
+                                   const std::string& /*type*/,
+                                   const std::string& /*context*/)
+         {
+         for(auto&& i : m_creds)
+            {
+            if(cert == i.certs[0])
+               return i.key.get();
+            }
+
+         return nullptr;
+         }
+
+   private:
+      struct Certificate_Info
+         {
+         std::vector<X509_Certificate> certs;
+         std::shared_ptr<Private_Key> key;
+         };
+
+      std::vector<Certificate_Info> m_creds;
+      std::vector<std::shared_ptr<Certificate_Store>> m_certstores;
+   };
+
+int tls_proxy(int argc, char* argv[])
+   {
+   if(argc != 6)
+      {
+      std::cout << "Usage: " << argv[0] << " listen_port target_host target_port server_cert server_key\n";
+      return 1;
+      }
+
+   const size_t listen_port = to_u32bit(argv[1]);
+   const std::string target = argv[2];
+   const std::string target_port = argv[3];
+
+   const std::string server_crt = argv[4];
+   const std::string server_key = argv[5];
+
+   const size_t num_threads = choose_thread_count(); // make configurable
+
+   AutoSeeded_RNG rng;
+   Proxy_Credentials_Manager creds(rng, server_crt, server_key);
+
+   TLS::Policy policy; // TODO: Read policy from text file
+
+   try
+      {
+      boost::asio::io_service io;
+
+      tcp::resolver resolver(io);
+      auto server_endpoint_iterator = resolver.resolve({ target, target_port });
+
+#if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
+      // Todo: make configurable
+      const std::string sessions_passphrase = "correct horse battery staple";
+      const std::string sessions_db = "sessions.db";
+      TLS::Session_Manager_SQLite sessions(sessions_passphrase, rng, sessions_db);
+#else
+      TLS::Session_Manager_In_Memory sessions(rng);
+#endif
+
+      tls_proxy_server server(io, listen_port, server_endpoint_iterator, creds, policy, sessions, rng);
+
+      std::vector<std::shared_ptr<std::thread>> threads;
+
+      for(size_t i = 2; i <= num_threads; ++i)
+         threads.push_back(std::make_shared<std::thread>([&io]() { io.run(); }));
+
+      io.run();
+
+      for (size_t i = 0; i < threads.size(); ++i)
+         threads[i]->join();
+      }
+   catch (std::exception& e)
+      {
+      std::cerr << e.what() << std::endl;
+      }
+
+   return 0;
+   }
+
+}
+
+}
+
+REGISTER_APP(tls_proxy);
+
+#endif
diff --git a/src/cmd/tls_server_asio.cpp b/src/cmd/tls_server_asio.cpp
deleted file mode 100644
index 9d31107bb..000000000
--- a/src/cmd/tls_server_asio.cpp
+++ /dev/null
@@ -1,326 +0,0 @@
-/*
-* (C) 2014 Jack Lloyd
-*
-* Botan is released under the Simplified BSD License (see license.txt)
-*/
-
-#include "apps.h"
-
-#if defined(BOTAN_HAS_TLS)
-#include <iostream>
-#include <string>
-#include <vector>
-#include <thread>
-#define _GLIBCXX_HAVE_GTHR_DEFAULT
-#include <boost/asio.hpp>
-#include <boost/bind.hpp>
-//#include <boost/thread.hpp>
-#include <boost/shared_ptr.hpp>
-#include <boost/enable_shared_from_this.hpp>
-
-#include <botan/tls_server.h>
-#include <botan/x509cert.h>
-#include <botan/pkcs8.h>
-#include <botan/auto_rng.h>
-
-#include "credentials.h"
-
-using Botan::byte;
-using boost::asio::ip::tcp;
-
-namespace {
-
-class tls_server_session : public boost::enable_shared_from_this<tls_server_session>
-   {
-   public:
-      typedef boost::shared_ptr<tls_server_session> pointer;
-
-      static pointer create(boost::asio::io_service& io_service,
-                            Botan::TLS::Session_Manager& session_manager,
-                            Botan::Credentials_Manager& credentials,
-                            Botan::TLS::Policy& policy,
-                            Botan::RandomNumberGenerator& rng)
-         {
-         return pointer(
-            new tls_server_session(
-               io_service,
-               session_manager,
-               credentials,
-               policy,
-               rng)
-            );
-         }
-
-      tcp::socket& socket() { return m_socket; }
-
-      void start()
-         {
-         m_socket.async_read_some(
-            boost::asio::buffer(m_read_buf, sizeof(m_read_buf)),
-            m_strand.wrap(
-               boost::bind(&tls_server_session::handle_read, shared_from_this(),
-                           boost::asio::placeholders::error,
-                           boost::asio::placeholders::bytes_transferred)));
-         }
-
-      void stop() { m_socket.close(); }
-
-   private:
-      tls_server_session(boost::asio::io_service& io_service,
-                         Botan::TLS::Session_Manager& session_manager,
-                         Botan::Credentials_Manager& credentials,
-                         Botan::TLS::Policy& policy,
-                         Botan::RandomNumberGenerator& rng) :
-         m_strand(io_service),
-         m_socket(io_service),
-         m_tls(boost::bind(&tls_server_session::tls_output_wanted, this, _1, _2),
-               boost::bind(&tls_server_session::tls_data_recv, this, _1, _2),
-               boost::bind(&tls_server_session::tls_alert_cb, this, _1, _2, _3),
-               boost::bind(&tls_server_session::tls_handshake_complete, this, _1),
-               session_manager,
-               credentials,
-               policy,
-               rng)
-         {
-         }
-
-      void handle_read(const boost::system::error_code& error,
-                       size_t bytes_transferred)
-         {
-         if(!error)
-            {
-            try
-               {
-               m_tls.received_data(m_read_buf, bytes_transferred);
-               }
-            catch(std::exception& e)
-               {
-               std::cout << "Read failed " << e.what() << "\n";
-               stop();
-               return;
-               }
-
-            m_socket.async_read_some(
-               boost::asio::buffer(m_read_buf, sizeof(m_read_buf)),
-               m_strand.wrap(boost::bind(&tls_server_session::handle_read, shared_from_this(),
-                                         boost::asio::placeholders::error,
-                                         boost::asio::placeholders::bytes_transferred)));
-            }
-         else
-            {
-            stop();
-            }
-         }
-
-      void handle_write(const boost::system::error_code& error)
-         {
-         if(!error)
-            {
-            m_write_buf.clear();
-
-            // initiate another write if needed
-            tls_output_wanted(nullptr, 0);
-            }
-         else
-            {
-            stop();
-            }
-         }
-
-      void tls_output_wanted(const byte buf[], size_t buf_len)
-         {
-         if(buf_len > 0)
-            m_outbox.insert(m_outbox.end(), buf, buf + buf_len);
-
-         // no write pending and have output pending
-         if(m_write_buf.empty() && !m_outbox.empty())
-            {
-            std::swap(m_outbox, m_write_buf);
-
-            boost::asio::async_write(m_socket,
-                              boost::asio::buffer(&m_write_buf[0], m_write_buf.size()),
-                              m_strand.wrap(
-                                 boost::bind(&tls_server_session::handle_write,
-                                             shared_from_this(),
-                                             boost::asio::placeholders::error)));
-            }
-         }
-
-      void tls_alert_cb(Botan::TLS::Alert alert, const byte[], size_t)
-         {
-         if(alert.type() == Botan::TLS::Alert::CLOSE_NOTIFY)
-            {
-            m_tls.close();
-            return;
-            }
-         }
-
-      void tls_data_recv(const byte buf[], size_t buf_len)
-         {
-         m_client_data.insert(m_client_data.end(), buf, buf + buf_len);
-
-         if(ready_to_respond())
-            write_response();
-         }
-
-      bool ready_to_respond()
-         {
-         return true; // parse headers?
-         }
-
-      void write_response()
-         {
-         std::string out;
-         out += "\r\n";
-         out += "HTTP/1.0 200 OK\r\n";
-         out += "Server: Botan ASIO test server\r\n";
-         if(m_hostname != "")
-            out += "Host: " + m_hostname + "\r\n";
-         out += "Content-Type: text/html\r\n";
-         out += "\r\n";
-         out += "<html><body>Greets. You said: ";
-         out += std::string(reinterpret_cast<const char*>(&m_client_data[0]),
-                            m_client_data.size());
-         out += "</body></html>\r\n\r\n";
-
-         m_tls.send(out);
-         m_tls.close();
-         }
-
-      bool tls_handshake_complete(const Botan::TLS::Session& session)
-         {
-         m_hostname = session.server_info().hostname();
-         return true;
-         }
-
-      boost::asio::io_service::strand m_strand; // serialization
-
-      tcp::socket m_socket;
-      Botan::TLS::Server m_tls;
-      std::string m_hostname;
-
-      unsigned char m_read_buf[1024];
-
-      // used to hold the data currently being written by the system
-      std::vector<byte> m_write_buf;
-
-      // used to hold data queued for writing
-      std::vector<byte> m_outbox;
-
-      std::vector<byte> m_client_data;
-   };
-
-class asio_tls_server
-   {
-   public:
-      typedef tls_server_session session;
-
-      asio_tls_server(boost::asio::io_service& io_service, unsigned short port) :
-         m_acceptor(io_service, tcp::endpoint(tcp::v4(), port)),
-         m_session_manager(m_rng),
-         m_creds(m_rng)
-         {
-         session::pointer new_session = make_session();
-
-         m_acceptor.async_accept(
-            new_session->socket(),
-            boost::bind(
-               &asio_tls_server::handle_accept,
-               this,
-               new_session,
-               boost::asio::placeholders::error)
-            );
-         }
-
-   private:
-      session::pointer make_session()
-         {
-         return session::create(
-            m_acceptor.get_io_service(),
-            m_session_manager,
-            m_creds,
-            m_policy,
-            m_rng
-            );
-         }
-
-      void handle_accept(session::pointer new_session,
-                         const boost::system::error_code& error)
-         {
-         if (!error)
-            {
-            new_session->start();
-
-            new_session = make_session();
-
-            m_acceptor.async_accept(
-               new_session->socket(),
-               boost::bind(
-                  &asio_tls_server::handle_accept,
-                  this,
-                  new_session,
-                  boost::asio::placeholders::error)
-               );
-            }
-         }
-
-      tcp::acceptor m_acceptor;
-
-      Botan::AutoSeeded_RNG m_rng;
-      Botan::TLS::Session_Manager_In_Memory m_session_manager;
-      Botan::TLS::Policy m_policy;
-      Credentials_Manager_Simple m_creds;
-   };
-
-size_t choose_thread_count()
-   {
-   size_t result = std::thread::hardware_concurrency();
-
-   if(result)
-      return result;
-
-   return 2;
-   }
-
-int tls_server_asio(int argc, char* argv[])
-   {
-   try
-      {
-      boost::asio::io_service io_service;
-
-      const unsigned short port = 4434;
-      asio_tls_server server(io_service, port);
-
-      size_t num_threads = choose_thread_count();
-      if(argc == 2)
-         std::istringstream(argv[1]) >> num_threads;
-
-      std::cout << "Using " << num_threads << " threads\n";
-
-      std::vector<boost::shared_ptr<std::thread> > threads;
-
-      for(size_t i = 0; i != num_threads; ++i)
-         {
-         boost::shared_ptr<std::thread> thread(
-            new std::thread(
-               boost::bind(&boost::asio::io_service::run, &io_service)));
-         threads.push_back(thread);
-         }
-
-      // Wait for all threads in the pool to exit.
-      for (size_t i = 0; i < threads.size(); ++i)
-         threads[i]->join();
-      }
-   catch (std::exception& e)
-      {
-      std::cerr << e.what() << std::endl;
-      }
-
-   return 0;
-   }
-
-}
-
-REGISTER_APP(tls_server_asio);
-
-#endif