ustream-ssl.c

   1 /*
   2  * ustream-ssl - library for SSL over ustream
   3  *
   4  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <errno.h>
  20
  21 #include <openssl/ssl.h>
  22 #include <openssl/err.h>
  23
  24 #include <libubox/ustream.h>
  25 #include "ustream-io.h"
  26 #include "ustream-ssl.h"
  27
  28 static void ssl_init(void)
  29 {
  30         static bool _init = false;
  31
  32         if (_init)
  33                 return;
  34
  35         SSL_load_error_strings();
  36         SSL_library_init();
  37
  38         _init = true;
  39 }
  40
  41 static void ustream_ssl_error_cb(struct uloop_timeout *t)
  42 {
  43         struct ustream_ssl *us = container_of(t, struct ustream_ssl, error_timer);
  44         static char buffer[128];
  45         int error = us->error;
  46
  47         if (us->notify_error)
  48                 us->notify_error(us, error, ERR_error_string(us->error, buffer));
  49 }
  50
  51 static void ustream_ssl_error(struct ustream_ssl *us, int error)
  52 {
  53         us->error = error;
  54         uloop_timeout_set(&us->error_timer, 0);
  55 }
  56
  57 static void ustream_ssl_check_conn(struct ustream_ssl *us)
  58 {
  59         int ret;
  60
  61         if (us->connected || us->error)
  62                 return;
  63
  64         if (us->server)
  65                 ret = SSL_accept(us->ssl);
  66         else
  67                 ret = SSL_connect(us->ssl);
  68
  69         if (ret == 1) {
  70                 us->connected = true;
  71                 if (us->notify_connected)
  72                         us->notify_connected(us);
  73                 return;
  74         }
  75
  76         ret = SSL_get_error(us->ssl, ret);
  77         if (ret == SSL_ERROR_WANT_READ || ret == SSL_ERROR_WANT_WRITE)
  78                 return;
  79
  80         ustream_ssl_error(us, ret);
  81 }
  82
  83 static bool __ustream_ssl_poll(struct ustream *s)
  84 {
  85         struct ustream_ssl *us = container_of(s->next, struct ustream_ssl, stream);
  86         char *buf;
  87         int len, ret;
  88         bool more = false;
  89
  90         ustream_ssl_check_conn(us);
  91         if (!us->connected || us->error)
  92                 return false;
  93
  94         do {
  95                 buf = ustream_reserve(&us->stream, 1, &len);
  96                 if (!len)
  97                         break;
  98
  99                 ret = SSL_read(us->ssl, buf, len);
 100                 if (ret < 0) {
 101                         ret = SSL_get_error(us->ssl, ret);
 102
 103                         if (ret == SSL_ERROR_WANT_READ)
 104                                 break;
 105
 106                         ustream_ssl_error(us, ret);
 107                         break;
 108                 }
 109                 if (ret == 0) {
 110                         us->stream.eof = true;
 111                         ustream_state_change(&us->stream);
 112                         break;
 113                 }
 114
 115                 ustream_fill_read(&us->stream, ret);
 116                 more = true;
 117         } while (1);
 118
 119         return more;
 120 }
 121
 122 static void ustream_ssl_notify_read(struct ustream *s, int bytes)
 123 {
 124         __ustream_ssl_poll(s);
 125 }
 126
 127 static void ustream_ssl_notify_write(struct ustream *s, int bytes)
 128 {
 129         struct ustream_ssl *us = container_of(s->next, struct ustream_ssl, stream);
 130
 131         ustream_ssl_check_conn(us);
 132         ustream_write_pending(s->next);
 133 }
 134
 135 static void ustream_ssl_notify_state(struct ustream *s)
 136 {
 137         s->next->write_error = true;
 138         ustream_state_change(s->next);
 139 }
 140
 141 static int ustream_ssl_write(struct ustream *s, const char *buf, int len, bool more)
 142 {
 143         struct ustream_ssl *us = container_of(s, struct ustream_ssl, stream);
 144         int ret;
 145
 146         if (!us->connected || us->error)
 147                 return 0;
 148
 149         if (us->conn->w.data_bytes)
 150                 return 0;
 151
 152         ret = SSL_write(us->ssl, buf, len);
 153         if (ret < 0) {
 154                 int err = SSL_get_error(us->ssl, ret);
 155                 if (err == SSL_ERROR_WANT_WRITE)
 156                         return 0;
 157         }
 158
 159         return ret;
 160 }
 161
 162 static void ustream_ssl_set_read_blocked(struct ustream *s)
 163 {
 164         struct ustream_ssl *us = container_of(s, struct ustream_ssl, stream);
 165
 166         ustream_set_read_blocked(us->conn, !!s->read_blocked);
 167 }
 168
 169 static void ustream_ssl_free(struct ustream *s)
 170 {
 171         struct ustream_ssl *us = container_of(s, struct ustream_ssl, stream);
 172
 173         if (us->conn) {
 174                 us->conn->next = NULL;
 175                 us->conn->notify_read = NULL;
 176                 us->conn->notify_write = NULL;
 177                 us->conn->notify_state = NULL;
 178         }
 179
 180         uloop_timeout_cancel(&us->error_timer);
 181         SSL_shutdown(us->ssl);
 182         SSL_free(us->ssl);
 183         us->ctx = NULL;
 184         us->ssl = NULL;
 185         us->conn = NULL;
 186         us->connected = false;
 187         us->error = false;
 188 }
 189
 190 static bool ustream_ssl_poll(struct ustream *s)
 191 {
 192         struct ustream_ssl *us = container_of(s, struct ustream_ssl, stream);
 193         bool fd_poll;
 194
 195         fd_poll = ustream_poll(us->conn);
 196         return __ustream_ssl_poll(s) || fd_poll;
 197 }
 198
 199 static void ustream_ssl_stream_init(struct ustream_ssl *us)
 200 {
 201         struct ustream *conn = us->conn;
 202         struct ustream *s = &us->stream;
 203
 204         conn->notify_read = ustream_ssl_notify_read;
 205         conn->notify_write = ustream_ssl_notify_write;
 206         conn->notify_state = ustream_ssl_notify_state;
 207
 208         s->free = ustream_ssl_free;
 209         s->write = ustream_ssl_write;
 210         s->poll = ustream_ssl_poll;
 211         s->set_read_blocked = ustream_ssl_set_read_blocked;
 212         ustream_init_defaults(s);
 213 }
 214
 215 static void *_ustream_ssl_context_new(bool server)
 216 {
 217         SSL_CTX *c;
 218         const void *m;
 219
 220         ssl_init();
 221
 222 #ifdef CYASSL_OPENSSL_H_
 223         if (server)
 224                 m = SSLv23_server_method();
 225         else
 226                 m = SSLv23_client_method();
 227 #else
 228         if (server)
 229                 m = TLSv1_server_method();
 230         else
 231                 m = TLSv1_client_method();
 232 #endif
 233
 234         c = SSL_CTX_new((void *) m);
 235         if (!c)
 236                 return NULL;
 237
 238         if (server)
 239                 SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
 240
 241         return c;
 242 }
 243
 244 static int _ustream_ssl_context_set_crt_file(void *ctx, const char *file)
 245 {
 246         int ret;
 247
 248         ret = SSL_CTX_use_certificate_file(ctx, file, SSL_FILETYPE_PEM);
 249         if (ret < 1)
 250                 ret = SSL_CTX_use_certificate_file(ctx, file, SSL_FILETYPE_ASN1);
 251
 252         if (ret < 1)
 253                 return -1;
 254
 255         return 0;
 256 }
 257
 258 static int _ustream_ssl_context_set_key_file(void *ctx, const char *file)
 259 {
 260         int ret;
 261
 262         ret = SSL_CTX_use_PrivateKey_file(ctx, file, SSL_FILETYPE_PEM);
 263         if (ret < 1)
 264                 ret = SSL_CTX_use_PrivateKey_file(ctx, file, SSL_FILETYPE_ASN1);
 265
 266         if (ret < 1)
 267                 return -1;
 268
 269         return 0;
 270 }
 271
 272 static void _ustream_ssl_context_free(void *ctx)
 273 {
 274         SSL_CTX_free(ctx);
 275 }
 276
 277 static int _ustream_ssl_init(struct ustream_ssl *us, struct ustream *conn, void *ctx, bool server)
 278 {
 279         us->error_timer.cb = ustream_ssl_error_cb;
 280         us->server = server;
 281         us->conn = conn;
 282         us->ctx = ctx;
 283
 284         us->ssl = SSL_new(us->ctx);
 285         if (!us->ssl)
 286                 return -ENOMEM;
 287
 288         conn->next = &us->stream;
 289         ustream_set_io(ctx, us->ssl, conn);
 290         ustream_ssl_stream_init(us);
 291
 292         return 0;
 293 }
 294
 295 const struct ustream_ssl_ops ustream_ssl_ops = {
 296         .context_new = _ustream_ssl_context_new,
 297         .context_set_crt_file = _ustream_ssl_context_set_crt_file,
 298         .context_set_key_file = _ustream_ssl_context_set_key_file,
 299         .context_free = _ustream_ssl_context_free,
 300         .init = _ustream_ssl_init,
 301 };