622 lines
15 KiB
C
622 lines
15 KiB
C
|
|
/*
|
|
* Copyright (C) NGINX, Inc.
|
|
* Copyright (C) Igor Sysoev
|
|
*/
|
|
|
|
#include <nxt_main.h>
|
|
#include <cyassl/ssl.h>
|
|
#include <cyassl/error-ssl.h>
|
|
|
|
|
|
typedef struct {
|
|
CYASSL *session;
|
|
|
|
int ssl_error;
|
|
uint8_t times; /* 2 bits */
|
|
|
|
nxt_buf_mem_t buffer;
|
|
} nxt_cyassl_conn_t;
|
|
|
|
|
|
static nxt_int_t nxt_cyassl_server_init(nxt_ssltls_conf_t *conf);
|
|
static void nxt_cyassl_conn_init(nxt_thread_t *thr, nxt_ssltls_conf_t *conf,
|
|
nxt_event_conn_t *c);
|
|
static void nxt_cyassl_session_cleanup(void *data);
|
|
static int nxt_cyassl_io_recv(CYASSL *ssl, char *buf, int size, void *data);
|
|
static int nxt_cyassl_io_send(CYASSL *ssl, char *buf, int size, void *data);
|
|
static void nxt_cyassl_conn_handshake(nxt_thread_t *thr, void *obj, void *data);
|
|
static void nxt_cyassl_conn_io_read(nxt_thread_t *thr, void *obj, void *data);
|
|
static void nxt_cyassl_conn_io_shutdown(nxt_thread_t *thr, void *obj,
|
|
void *data);
|
|
static ssize_t nxt_cyassl_conn_io_write_chunk(nxt_thread_t *thr,
|
|
nxt_event_conn_t *c, nxt_buf_t *b, size_t limit);
|
|
static ssize_t nxt_cyassl_conn_io_send(nxt_event_conn_t *c, void *buf,
|
|
size_t size);
|
|
static nxt_int_t nxt_cyassl_conn_test_error(nxt_thread_t *thr,
|
|
nxt_event_conn_t *c, int err, nxt_work_handler_t handler);
|
|
static void nxt_cdecl nxt_cyassl_conn_error(nxt_event_conn_t *c, nxt_err_t err,
|
|
const char *fmt, ...);
|
|
static nxt_uint_t nxt_cyassl_log_error_level(nxt_event_conn_t *c, nxt_err_t err,
|
|
int ssl_error);
|
|
static void nxt_cdecl nxt_cyassl_log_error(nxt_uint_t level, nxt_log_t *log,
|
|
int ret, const char *fmt, ...);
|
|
static u_char *nxt_cyassl_copy_error(int err, u_char *p, u_char *end);
|
|
|
|
|
|
const nxt_ssltls_lib_t nxt_cyassl_lib = {
|
|
nxt_cyassl_server_init,
|
|
NULL,
|
|
};
|
|
|
|
|
|
static nxt_event_conn_io_t nxt_cyassl_event_conn_io = {
|
|
NULL,
|
|
NULL,
|
|
|
|
nxt_cyassl_conn_io_read,
|
|
NULL,
|
|
NULL,
|
|
|
|
nxt_event_conn_io_write,
|
|
nxt_cyassl_conn_io_write_chunk,
|
|
NULL,
|
|
NULL,
|
|
nxt_cyassl_conn_io_send,
|
|
|
|
nxt_cyassl_conn_io_shutdown,
|
|
};
|
|
|
|
|
|
static nxt_int_t
|
|
nxt_cyassl_start(void)
|
|
{
|
|
int err;
|
|
nxt_thread_t *thr;
|
|
static nxt_bool_t started;
|
|
|
|
if (nxt_fast_path(started)) {
|
|
return NXT_OK;
|
|
}
|
|
|
|
started = 1;
|
|
|
|
thr = nxt_thread();
|
|
|
|
/* TODO: CyaSSL_Cleanup() */
|
|
|
|
err = CyaSSL_Init();
|
|
if (err != SSL_SUCCESS) {
|
|
nxt_cyassl_log_error(NXT_LOG_ALERT, thr->log, err,
|
|
"CyaSSL_Init() failed");
|
|
return NXT_ERROR;
|
|
}
|
|
|
|
nxt_thread_log_error(NXT_LOG_INFO, "CyaSSL version: %s",
|
|
LIBCYASSL_VERSION_STRING);
|
|
|
|
/* CyaSSL_SetLoggingCb */
|
|
/* CyaSSL_SetAllocators */
|
|
|
|
return NXT_OK;
|
|
}
|
|
|
|
|
|
static nxt_int_t
|
|
nxt_cyassl_server_init(nxt_ssltls_conf_t *conf)
|
|
{
|
|
int err;
|
|
char *certificate, *key;
|
|
CYASSL_CTX *ctx;
|
|
nxt_thread_t *thr;
|
|
|
|
thr = nxt_thread();
|
|
|
|
if (nxt_slow_path(nxt_cyassl_start() != NXT_OK)) {
|
|
return NXT_ERROR;
|
|
}
|
|
|
|
ctx = CyaSSL_CTX_new(CyaSSLv23_server_method());
|
|
if (ctx == NULL) {
|
|
nxt_cyassl_log_error(NXT_LOG_ALERT, thr->log, 0,
|
|
"CyaSSL_CTX_new() failed");
|
|
return NXT_ERROR;
|
|
}
|
|
|
|
conf->ctx = ctx;
|
|
conf->conn_init = nxt_cyassl_conn_init;
|
|
|
|
certificate = conf->certificate;
|
|
|
|
err = CyaSSL_CTX_use_certificate_file(ctx, certificate, SSL_FILETYPE_PEM);
|
|
if (err != SSL_SUCCESS) {
|
|
nxt_cyassl_log_error(NXT_LOG_ALERT, thr->log, err,
|
|
"CyaSSL_CTX_use_certificate_file(\"%s\") failed",
|
|
certificate);
|
|
goto fail;
|
|
}
|
|
|
|
key = conf->certificate_key;
|
|
|
|
err = CyaSSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM);
|
|
if (err != SSL_SUCCESS) {
|
|
nxt_cyassl_log_error(NXT_LOG_ALERT, thr->log, err,
|
|
"CyaSSL_CTX_use_PrivateKey_file(\"%s\") failed",
|
|
key);
|
|
goto fail;
|
|
}
|
|
|
|
if (conf->ciphers != NULL) {
|
|
err = CyaSSL_CTX_set_cipher_list(ctx, conf->ciphers);
|
|
if (err != SSL_SUCCESS) {
|
|
nxt_cyassl_log_error(NXT_LOG_ALERT, thr->log, err,
|
|
"CyaSSL_CTX_set_cipher_list(\"%s\") failed",
|
|
conf->ciphers);
|
|
goto fail;
|
|
}
|
|
}
|
|
|
|
/* TODO: ca_certificate */
|
|
|
|
CyaSSL_SetIORecv(ctx, nxt_cyassl_io_recv);
|
|
CyaSSL_SetIOSend(ctx, nxt_cyassl_io_send);
|
|
|
|
return NXT_OK;
|
|
|
|
fail:
|
|
|
|
CyaSSL_CTX_free(ctx);
|
|
|
|
return NXT_ERROR;
|
|
}
|
|
|
|
|
|
static void
|
|
nxt_cyassl_conn_init(nxt_thread_t *thr, nxt_ssltls_conf_t *conf,
|
|
nxt_event_conn_t *c)
|
|
{
|
|
CYASSL *s;
|
|
CYASSL_CTX *ctx;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
nxt_mem_pool_cleanup_t *mpcl;
|
|
|
|
nxt_log_debug(c->socket.log, "cyassl conn init");
|
|
|
|
ssltls = nxt_mp_zget(c->mem_pool, sizeof(nxt_cyassl_conn_t));
|
|
if (ssltls == NULL) {
|
|
goto fail;
|
|
}
|
|
|
|
c->u.ssltls = ssltls;
|
|
nxt_buf_mem_set_size(&ssltls->buffer, conf->buffer_size);
|
|
|
|
mpcl = nxt_mem_pool_cleanup(c->mem_pool, 0);
|
|
if (mpcl == NULL) {
|
|
goto fail;
|
|
}
|
|
|
|
ctx = conf->ctx;
|
|
|
|
s = CyaSSL_new(ctx);
|
|
if (s == NULL) {
|
|
nxt_cyassl_log_error(NXT_LOG_ALERT, c->socket.log, 0,
|
|
"CyaSSL_new() failed");
|
|
goto fail;
|
|
}
|
|
|
|
ssltls->session = s;
|
|
mpcl->handler = nxt_cyassl_session_cleanup;
|
|
mpcl->data = ssltls;
|
|
|
|
CyaSSL_SetIOReadCtx(s, c);
|
|
CyaSSL_SetIOWriteCtx(s, c);
|
|
|
|
c->io = &nxt_cyassl_event_conn_io;
|
|
c->sendfile = NXT_CONN_SENDFILE_OFF;
|
|
|
|
nxt_cyassl_conn_handshake(thr, c, c->socket.data);
|
|
return;
|
|
|
|
fail:
|
|
|
|
nxt_event_conn_io_handle(thr, c->read_work_queue,
|
|
c->read_state->error_handler, c, c->socket.data);
|
|
}
|
|
|
|
|
|
static void
|
|
nxt_cyassl_session_cleanup(void *data)
|
|
{
|
|
nxt_cyassl_conn_t *ssltls;
|
|
|
|
ssltls = data;
|
|
|
|
nxt_thread_log_debug("cyassl session cleanup");
|
|
|
|
nxt_free(ssltls->buffer.start);
|
|
|
|
CyaSSL_free(ssltls->session);
|
|
}
|
|
|
|
|
|
static int
|
|
nxt_cyassl_io_recv(CYASSL *ssl, char *buf, int size, void *data)
|
|
{
|
|
ssize_t n;
|
|
nxt_thread_t *thr;
|
|
nxt_event_conn_t *c;
|
|
|
|
c = data;
|
|
thr = nxt_thread();
|
|
|
|
n = thr->engine->event->io->recv(c, (u_char *) buf, size, 0);
|
|
|
|
if (n > 0) {
|
|
return n;
|
|
}
|
|
|
|
if (n == 0) {
|
|
return CYASSL_CBIO_ERR_CONN_CLOSE;
|
|
}
|
|
|
|
if (n == NXT_AGAIN) {
|
|
return CYASSL_CBIO_ERR_WANT_READ;
|
|
}
|
|
|
|
return CYASSL_CBIO_ERR_GENERAL;
|
|
}
|
|
|
|
|
|
static int
|
|
nxt_cyassl_io_send(CYASSL *ssl, char *buf, int size, void *data)
|
|
{
|
|
ssize_t n;
|
|
nxt_thread_t *thr;
|
|
nxt_event_conn_t *c;
|
|
|
|
c = data;
|
|
thr = nxt_thread();
|
|
|
|
n = thr->engine->event->io->send(c, (u_char *) buf, size);
|
|
|
|
if (n > 0) {
|
|
return n;
|
|
}
|
|
|
|
if (n == NXT_AGAIN) {
|
|
return CYASSL_CBIO_ERR_WANT_WRITE;
|
|
}
|
|
|
|
return CYASSL_CBIO_ERR_GENERAL;
|
|
}
|
|
|
|
|
|
static void
|
|
nxt_cyassl_conn_handshake(nxt_thread_t *thr, void *obj, void *data)
|
|
{
|
|
int ret;
|
|
nxt_int_t n;
|
|
nxt_err_t err;
|
|
nxt_event_conn_t *c;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
|
|
c = obj;
|
|
ssltls = c->u.ssltls;
|
|
|
|
nxt_log_debug(thr->log, "cyassl conn handshake: %d", ssltls->times);
|
|
|
|
/* "ssltls->times == 1" is suitable to run CyaSSL_negotiate() in job. */
|
|
|
|
ret = CyaSSL_negotiate(ssltls->session);
|
|
|
|
err = (ret != 0) ? nxt_socket_errno : 0;
|
|
|
|
nxt_thread_time_debug_update(thr);
|
|
|
|
nxt_log_debug(thr->log, "CyaSSL_negotiate(%d): %d", c->socket.fd, ret);
|
|
|
|
if (ret == 0) {
|
|
nxt_cyassl_conn_io_read(thr, c, data);
|
|
return;
|
|
}
|
|
|
|
n = nxt_cyassl_conn_test_error(thr, c, ret, nxt_cyassl_conn_handshake);
|
|
|
|
if (n == NXT_ERROR) {
|
|
nxt_cyassl_conn_error(c, err, "CyaSSL_negotiate(%d) failed",
|
|
c->socket.fd);
|
|
|
|
nxt_event_conn_io_handle(thr, c->read_work_queue,
|
|
c->read_state->error_handler, c, data);
|
|
|
|
} else if (ssltls->ssl_error == SSL_ERROR_WANT_READ && ssltls->times < 2) {
|
|
ssltls->times++;
|
|
}
|
|
}
|
|
|
|
|
|
static void
|
|
nxt_cyassl_conn_io_read(nxt_thread_t *thr, void *obj, void *data)
|
|
{
|
|
int ret;
|
|
nxt_buf_t *b;
|
|
nxt_err_t err;
|
|
nxt_int_t n;
|
|
nxt_event_conn_t *c;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
nxt_work_handler_t handler;
|
|
|
|
c = obj;
|
|
|
|
nxt_log_debug(thr->log, "cyassl conn read");
|
|
|
|
handler = c->read_state->ready_handler;
|
|
b = c->read;
|
|
|
|
/* b == NULL is used to test descriptor readiness. */
|
|
|
|
if (b != NULL) {
|
|
ssltls = c->u.ssltls;
|
|
|
|
ret = CyaSSL_read(ssltls->session, b->mem.free,
|
|
b->mem.end - b->mem.free);
|
|
|
|
err = (ret <= 0) ? nxt_socket_errno : 0;
|
|
|
|
nxt_log_debug(thr->log, "CyaSSL_read(%d, %p, %uz): %d",
|
|
c->socket.fd, b->mem.free, b->mem.end - b->mem.free, ret);
|
|
|
|
if (ret > 0) {
|
|
/* c->socket.read_ready is kept. */
|
|
b->mem.free += ret;
|
|
handler = c->read_state->ready_handler;
|
|
|
|
} else {
|
|
n = nxt_cyassl_conn_test_error(thr, c, ret,
|
|
nxt_cyassl_conn_io_read);
|
|
|
|
if (nxt_fast_path(n != NXT_ERROR)) {
|
|
return;
|
|
}
|
|
|
|
nxt_cyassl_conn_error(c, err, "CyaSSL_read(%d, %p, %uz) failed",
|
|
c->socket.fd, b->mem.free,
|
|
b->mem.end - b->mem.free);
|
|
|
|
handler = c->read_state->error_handler;
|
|
}
|
|
}
|
|
|
|
nxt_event_conn_io_handle(thr, c->read_work_queue, handler, c, data);
|
|
}
|
|
|
|
|
|
static ssize_t
|
|
nxt_cyassl_conn_io_write_chunk(nxt_thread_t *thr, nxt_event_conn_t *c,
|
|
nxt_buf_t *b, size_t limit)
|
|
{
|
|
nxt_cyassl_conn_t *ssltls;
|
|
|
|
nxt_log_debug(thr->log, "cyassl conn write chunk");
|
|
|
|
ssltls = c->u.ssltls;
|
|
|
|
return nxt_sendbuf_copy_coalesce(c, &ssltls->buffer, b, limit);
|
|
}
|
|
|
|
|
|
static ssize_t
|
|
nxt_cyassl_conn_io_send(nxt_event_conn_t *c, void *buf, size_t size)
|
|
{
|
|
int ret;
|
|
nxt_err_t err;
|
|
nxt_int_t n;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
|
|
nxt_log_debug(c->socket.log, "cyassl send");
|
|
|
|
ssltls = c->u.ssltls;
|
|
|
|
ret = CyaSSL_write(ssltls->session, buf, size);
|
|
|
|
if (ret <= 0) {
|
|
err = nxt_socket_errno;
|
|
c->socket.error = err;
|
|
|
|
} else {
|
|
err = 0;
|
|
}
|
|
|
|
nxt_log_debug(c->socket.log, "CyaSSL_write(%d, %p, %uz): %d",
|
|
c->socket.fd, buf, size, ret);
|
|
|
|
if (ret > 0) {
|
|
return ret;
|
|
}
|
|
|
|
n = nxt_cyassl_conn_test_error(nxt_thread(), c, ret,
|
|
nxt_event_conn_io_write);
|
|
|
|
if (nxt_slow_path(n == NXT_ERROR)) {
|
|
nxt_cyassl_conn_error(c, err, "CyaSSL_write(%d, %p, %uz) failed",
|
|
c->socket.fd, buf, size);
|
|
}
|
|
|
|
return n;
|
|
}
|
|
|
|
|
|
static void
|
|
nxt_cyassl_conn_io_shutdown(nxt_thread_t *thr, void *obj, void *data)
|
|
{
|
|
int ret;
|
|
nxt_event_conn_t *c;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
|
|
c = obj;
|
|
|
|
nxt_log_debug(thr->log, "cyassl conn shutdown");
|
|
|
|
ssltls = c->u.ssltls;
|
|
|
|
ret = CyaSSL_shutdown(ssltls->session);
|
|
|
|
nxt_log_debug(thr->log, "CyaSSL_shutdown(%d): %d", c->socket.fd, ret);
|
|
|
|
if (nxt_slow_path(ret != SSL_SUCCESS)) {
|
|
nxt_cyassl_conn_error(c, 0, "CyaSSL_shutdown(%d) failed", c->socket.fd);
|
|
}
|
|
|
|
nxt_event_conn_io_handle(thr, c->write_work_queue,
|
|
c->write_state->close_handler, c, data);
|
|
}
|
|
|
|
|
|
static nxt_int_t
|
|
nxt_cyassl_conn_test_error(nxt_thread_t *thr, nxt_event_conn_t *c, int ret,
|
|
nxt_work_handler_t handler)
|
|
{
|
|
nxt_work_queue_t *wq;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
|
|
ssltls = c->u.ssltls;
|
|
ssltls->ssl_error = CyaSSL_get_error(ssltls->session, ret);
|
|
|
|
nxt_log_debug(thr->log, "CyaSSL_get_error(): %d", ssltls->ssl_error);
|
|
|
|
switch (ssltls->ssl_error) {
|
|
|
|
case SSL_ERROR_WANT_READ:
|
|
nxt_event_fd_block_write(thr->engine, &c->socket);
|
|
|
|
c->socket.read_ready = 0;
|
|
c->socket.read_handler = handler;
|
|
|
|
if (nxt_event_fd_is_disabled(c->socket.read)) {
|
|
nxt_event_fd_enable_read(thr->engine, &c->socket);
|
|
}
|
|
|
|
return NXT_AGAIN;
|
|
|
|
case SSL_ERROR_WANT_WRITE:
|
|
nxt_event_fd_block_read(thr->engine, &c->socket);
|
|
|
|
c->socket.write_ready = 0;
|
|
c->socket.write_handler = handler;
|
|
|
|
if (nxt_event_fd_is_disabled(c->socket.write)) {
|
|
nxt_event_fd_enable_write(thr->engine, &c->socket);
|
|
}
|
|
|
|
return NXT_AGAIN;
|
|
|
|
case SSL_ERROR_ZERO_RETURN:
|
|
/* A "close notify" alert */
|
|
|
|
if (c->read_state != NULL) {
|
|
wq = c->read_work_queue;
|
|
handler = c->read_state->close_handler;
|
|
|
|
} else {
|
|
wq = c->write_work_queue;
|
|
handler = c->write_state->close_handler;
|
|
}
|
|
|
|
nxt_event_conn_io_handle(thr, wq, handler, c, c->socket.data);
|
|
|
|
return 0;
|
|
|
|
default:
|
|
return NXT_ERROR;
|
|
}
|
|
}
|
|
|
|
|
|
static void nxt_cdecl
|
|
nxt_cyassl_conn_error(nxt_event_conn_t *c, nxt_err_t err, const char *fmt, ...)
|
|
{
|
|
u_char *p, *end;
|
|
va_list args;
|
|
nxt_uint_t level;
|
|
nxt_cyassl_conn_t *ssltls;
|
|
u_char msg[NXT_MAX_ERROR_STR];
|
|
|
|
ssltls = c->u.ssltls;
|
|
|
|
level = nxt_cyassl_log_error_level(c, err, ssltls->ssl_error);
|
|
|
|
if (nxt_log_level_enough(c->socket.log, level)) {
|
|
|
|
end = msg + sizeof(msg);
|
|
|
|
va_start(args, fmt);
|
|
p = nxt_vsprintf(msg, end, fmt, args);
|
|
va_end(args);
|
|
|
|
if (err != 0) {
|
|
p = nxt_sprintf(p, end, " %E", err);
|
|
}
|
|
|
|
p = nxt_cyassl_copy_error(ssltls->ssl_error, p, end);
|
|
|
|
nxt_log_error(level, c->socket.log, "%*s", p - msg, msg);
|
|
}
|
|
}
|
|
|
|
|
|
static nxt_uint_t
|
|
nxt_cyassl_log_error_level(nxt_event_conn_t *c, nxt_err_t err, int ssl_error)
|
|
{
|
|
switch (ssl_error) {
|
|
|
|
case SOCKET_ERROR_E: /* -208 */
|
|
case MATCH_SUITE_ERROR: /* -261 */
|
|
break;
|
|
|
|
default:
|
|
return NXT_LOG_ALERT;
|
|
}
|
|
|
|
return NXT_LOG_INFO;
|
|
}
|
|
|
|
|
|
static void nxt_cdecl
|
|
nxt_cyassl_log_error(nxt_uint_t level, nxt_log_t *log, int err,
|
|
const char *fmt, ...)
|
|
{
|
|
u_char *p, *end;
|
|
va_list args;
|
|
u_char msg[NXT_MAX_ERROR_STR];
|
|
|
|
if (nxt_log_level_enough(log, level)) {
|
|
|
|
end = msg + sizeof(msg);
|
|
|
|
va_start(args, fmt);
|
|
p = nxt_vsprintf(msg, end, fmt, args);
|
|
va_end(args);
|
|
|
|
p = nxt_cyassl_copy_error(err, p, end);
|
|
|
|
nxt_log_error(level, log, "%*s", p - msg, msg);
|
|
}
|
|
}
|
|
|
|
|
|
static u_char *
|
|
nxt_cyassl_copy_error(int err, u_char *p, u_char *end)
|
|
{
|
|
p = nxt_sprintf(p, end, " (SSL:%d ", err);
|
|
|
|
CyaSSL_ERR_error_string_n(err, (char *) p, end - p);
|
|
|
|
p += nxt_strlen(p);
|
|
|
|
if (p < end) {
|
|
*p++ = ')';
|
|
}
|
|
|
|
return p;
|
|
}
|