bio_ssl.c

最後變更在這個檔案是 108206,由 vboxsync 提交於 4 週前
openssl-3.3.2: Exported all files to OSE and removed .scm-settings bugref:10757
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 13.7 KB

行
1	/*
2	* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <stdio.h>
11	#include <stdlib.h>
12	#include <string.h>
13	#include <errno.h>
14	#include <openssl/crypto.h>
15	#include "internal/bio.h"
16	#include <openssl/err.h>
17	#include "ssl_local.h"
18
19	static int ssl_write(BIO h, const char buf, size_t size, size_t *written);
20	static int ssl_read(BIO b, char buf, size_t size, size_t *readbytes);
21	static int ssl_puts(BIO h, const char str);
22	static long ssl_ctrl(BIO h, int cmd, long arg1, void arg2);
23	static int ssl_new(BIO *h);
24	static int ssl_free(BIO *data);
25	static long ssl_callback_ctrl(BIO h, int cmd, BIO_info_cb fp);
26	typedef struct bio_ssl_st {
27	SSL ssl; / The ssl handle :-) */
28	/*
29	* Re-negotiate every time the total number of bytes is this size
30	* or when timeout expires.
31	* There is no proper support for TLS-1.3 or QUIC yet.
32	*/
33	int num_renegotiates;
34	unsigned long renegotiate_count;
35	size_t byte_count;
36	unsigned long renegotiate_timeout;
37	unsigned long last_time;
38	} BIO_SSL;
39
40	static const BIO_METHOD methods_sslp = {
41	BIO_TYPE_SSL,
42	"ssl",
43	ssl_write,
44	NULL, /* ssl_write_old, */
45	ssl_read,
46	NULL, /* ssl_read_old, */
47	ssl_puts,
48	NULL, /* ssl_gets, */
49	ssl_ctrl,
50	ssl_new,
51	ssl_free,
52	ssl_callback_ctrl,
53	};
54
55	const BIO_METHOD *BIO_f_ssl(void)
56	{
57	return &methods_sslp;
58	}
59
60	static int ssl_new(BIO *bi)
61	{
62	BIO_SSL bs = OPENSSL_zalloc(sizeof(bs));
63
64	if (bs == NULL)
65	return 0;
66	BIO_set_init(bi, 0);
67	BIO_set_data(bi, bs);
68	/* Clear all flags */
69	BIO_clear_flags(bi, ~0);
70
71	return 1;
72	}
73
74	static int ssl_free(BIO *a)
75	{
76	BIO_SSL *bs;
77
78	if (a == NULL)
79	return 0;
80	bs = BIO_get_data(a);
81	if (BIO_get_shutdown(a)) {
82	if (bs->ssl != NULL && !SSL_in_init(bs->ssl))
83	SSL_shutdown(bs->ssl);
84	if (BIO_get_init(a))
85	SSL_free(bs->ssl);
86	BIO_clear_flags(a, ~0); /* Clear all flags */
87	BIO_set_init(a, 0);
88	}
89	OPENSSL_free(bs);
90	return 1;
91	}
92
93	static int ssl_read(BIO b, char buf, size_t size, size_t *readbytes)
94	{
95	int ret = 1;
96	BIO_SSL *sb;
97	SSL *ssl;
98	int retry_reason = 0;
99	int r = 0;
100
101	if (buf == NULL)
102	return 0;
103	sb = BIO_get_data(b);
104	ssl = sb->ssl;
105
106	BIO_clear_retry_flags(b);
107
108	ret = ssl_read_internal(ssl, buf, size, readbytes);
109
110	switch (SSL_get_error(ssl, ret)) {
111	case SSL_ERROR_NONE:
112	if (sb->renegotiate_count > 0) {
113	sb->byte_count += *readbytes;
114	if (sb->byte_count > sb->renegotiate_count) {
115	sb->byte_count = 0;
116	sb->num_renegotiates++;
117	SSL_renegotiate(ssl);
118	r = 1;
119	}
120	}
121	if ((sb->renegotiate_timeout > 0) && (!r)) {
122	unsigned long tm;
123
124	tm = (unsigned long)time(NULL);
125	if (tm > sb->last_time + sb->renegotiate_timeout) {
126	sb->last_time = tm;
127	sb->num_renegotiates++;
128	SSL_renegotiate(ssl);
129	}
130	}
131
132	break;
133	case SSL_ERROR_WANT_READ:
134	BIO_set_retry_read(b);
135	break;
136	case SSL_ERROR_WANT_WRITE:
137	BIO_set_retry_write(b);
138	break;
139	case SSL_ERROR_WANT_X509_LOOKUP:
140	BIO_set_retry_special(b);
141	retry_reason = BIO_RR_SSL_X509_LOOKUP;
142	break;
143	case SSL_ERROR_WANT_ACCEPT:
144	BIO_set_retry_special(b);
145	retry_reason = BIO_RR_ACCEPT;
146	break;
147	case SSL_ERROR_WANT_CONNECT:
148	BIO_set_retry_special(b);
149	retry_reason = BIO_RR_CONNECT;
150	break;
151	case SSL_ERROR_SYSCALL:
152	case SSL_ERROR_SSL:
153	case SSL_ERROR_ZERO_RETURN:
154	default:
155	break;
156	}
157
158	BIO_set_retry_reason(b, retry_reason);
159
160	return ret;
161	}
162
163	static int ssl_write(BIO b, const char buf, size_t size, size_t *written)
164	{
165	int ret, r = 0;
166	int retry_reason = 0;
167	SSL *ssl;
168	BIO_SSL *bs;
169
170	if (buf == NULL)
171	return 0;
172	bs = BIO_get_data(b);
173	ssl = bs->ssl;
174
175	BIO_clear_retry_flags(b);
176
177	ret = ssl_write_internal(ssl, buf, size, 0, written);
178
179	switch (SSL_get_error(ssl, ret)) {
180	case SSL_ERROR_NONE:
181	if (bs->renegotiate_count > 0) {
182	bs->byte_count += *written;
183	if (bs->byte_count > bs->renegotiate_count) {
184	bs->byte_count = 0;
185	bs->num_renegotiates++;
186	SSL_renegotiate(ssl);
187	r = 1;
188	}
189	}
190	if ((bs->renegotiate_timeout > 0) && (!r)) {
191	unsigned long tm;
192
193	tm = (unsigned long)time(NULL);
194	if (tm > bs->last_time + bs->renegotiate_timeout) {
195	bs->last_time = tm;
196	bs->num_renegotiates++;
197	SSL_renegotiate(ssl);
198	}
199	}
200	break;
201	case SSL_ERROR_WANT_WRITE:
202	BIO_set_retry_write(b);
203	break;
204	case SSL_ERROR_WANT_READ:
205	BIO_set_retry_read(b);
206	break;
207	case SSL_ERROR_WANT_X509_LOOKUP:
208	BIO_set_retry_special(b);
209	retry_reason = BIO_RR_SSL_X509_LOOKUP;
210	break;
211	case SSL_ERROR_WANT_CONNECT:
212	BIO_set_retry_special(b);
213	retry_reason = BIO_RR_CONNECT;
214	case SSL_ERROR_SYSCALL:
215	case SSL_ERROR_SSL:
216	default:
217	break;
218	}
219
220	BIO_set_retry_reason(b, retry_reason);
221
222	return ret;
223	}
224
225	static long ssl_ctrl(BIO b, int cmd, long num, void ptr)
226	{
227	SSL *sslp, ssl;
228	BIO_SSL bs, dbs;
229	BIO dbio, bio;
230	long ret = 1;
231	BIO *next;
232	SSL_CONNECTION *sc = NULL;
233
234	bs = BIO_get_data(b);
235	next = BIO_next(b);
236	ssl = bs->ssl;
237	if (ssl == NULL && cmd != BIO_C_SET_SSL)
238	return 0;
239	switch (cmd) {
240	case BIO_CTRL_RESET:
241	/* TODO(QUIC FUTURE): Add support when SSL_clear() is supported */
242	if ((sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl)) == NULL)
243	return 0;
244
245	SSL_shutdown(ssl);
246
247	if (sc->handshake_func == ssl->method->ssl_connect)
248	SSL_set_connect_state(ssl);
249	else if (sc->handshake_func == ssl->method->ssl_accept)
250	SSL_set_accept_state(ssl);
251
252	if (!SSL_clear(ssl)) {
253	ret = 0;
254	break;
255	}
256
257	if (next != NULL)
258	ret = BIO_ctrl(next, cmd, num, ptr);
259	else if (sc->rbio != NULL)
260	ret = BIO_ctrl(sc->rbio, cmd, num, ptr);
261	else
262	ret = 1;
263	break;
264	case BIO_CTRL_INFO:
265	ret = 0;
266	break;
267	case BIO_C_SSL_MODE:
268	if (num) /* client mode */
269	SSL_set_connect_state(ssl);
270	else
271	SSL_set_accept_state(ssl);
272	break;
273	case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
274	ret = bs->renegotiate_timeout;
275	if (num < 60)
276	num = 5;
277	bs->renegotiate_timeout = (unsigned long)num;
278	bs->last_time = (unsigned long)time(NULL);
279	break;
280	case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
281	ret = bs->renegotiate_count;
282	if ((long)num >= 512)
283	bs->renegotiate_count = (unsigned long)num;
284	break;
285	case BIO_C_GET_SSL_NUM_RENEGOTIATES:
286	ret = bs->num_renegotiates;
287	break;
288	case BIO_C_SET_SSL:
289	if (ssl != NULL) {
290	ssl_free(b);
291	if (!ssl_new(b))
292	return 0;
293	bs = BIO_get_data(b);
294	}
295	BIO_set_shutdown(b, num);
296	ssl = (SSL *)ptr;
297	bs->ssl = ssl;
298	bio = SSL_get_rbio(ssl);
299	if (bio != NULL) {
300	if (next != NULL)
301	BIO_push(bio, next);
302	BIO_set_next(b, bio);
303	BIO_up_ref(bio);
304	}
305	BIO_set_init(b, 1);
306	break;
307	case BIO_C_GET_SSL:
308	if (ptr != NULL) {
309	sslp = (SSL **)ptr;
310	*sslp = ssl;
311	} else
312	ret = 0;
313	break;
314	case BIO_CTRL_GET_CLOSE:
315	ret = BIO_get_shutdown(b);
316	break;
317	case BIO_CTRL_SET_CLOSE:
318	BIO_set_shutdown(b, (int)num);
319	break;
320	case BIO_CTRL_WPENDING:
321	ret = BIO_ctrl(SSL_get_wbio(ssl), cmd, num, ptr);
322	break;
323	case BIO_CTRL_PENDING:
324	ret = SSL_pending(ssl);
325	if (ret == 0)
326	ret = BIO_pending(SSL_get_rbio(ssl));
327	break;
328	case BIO_CTRL_FLUSH:
329	BIO_clear_retry_flags(b);
330	ret = BIO_ctrl(SSL_get_wbio(ssl), cmd, num, ptr);
331	BIO_copy_next_retry(b);
332	break;
333	case BIO_CTRL_PUSH:
334	if ((next != NULL) && (next != SSL_get_rbio(ssl))) {
335	/*
336	* We are going to pass ownership of next to the SSL object...but
337	* we don't own a reference to pass yet - so up ref
338	*/
339	BIO_up_ref(next);
340	SSL_set_bio(ssl, next, next);
341	}
342	break;
343	case BIO_CTRL_POP:
344	/* Only detach if we are the BIO explicitly being popped */
345	if (b == ptr) {
346	/* This will clear the reference we obtained during push */
347	SSL_set_bio(ssl, NULL, NULL);
348	}
349	break;
350	case BIO_C_DO_STATE_MACHINE:
351	BIO_clear_retry_flags(b);
352
353	BIO_set_retry_reason(b, 0);
354	ret = (int)SSL_do_handshake(ssl);
355
356	switch (SSL_get_error(ssl, (int)ret)) {
357	case SSL_ERROR_WANT_READ:
358	BIO_set_flags(b, BIO_FLAGS_READ \| BIO_FLAGS_SHOULD_RETRY);
359	break;
360	case SSL_ERROR_WANT_WRITE:
361	BIO_set_flags(b, BIO_FLAGS_WRITE \| BIO_FLAGS_SHOULD_RETRY);
362	break;
363	case SSL_ERROR_WANT_CONNECT:
364	BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL \| BIO_FLAGS_SHOULD_RETRY);
365	BIO_set_retry_reason(b, BIO_get_retry_reason(next));
366	break;
367	case SSL_ERROR_WANT_X509_LOOKUP:
368	BIO_set_retry_special(b);
369	BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);
370	break;
371	default:
372	break;
373	}
374	break;
375	case BIO_CTRL_DUP:
376	dbio = (BIO *)ptr;
377	dbs = BIO_get_data(dbio);
378	SSL_free(dbs->ssl);
379	dbs->ssl = SSL_dup(ssl);
380	dbs->num_renegotiates = bs->num_renegotiates;
381	dbs->renegotiate_count = bs->renegotiate_count;
382	dbs->byte_count = bs->byte_count;
383	dbs->renegotiate_timeout = bs->renegotiate_timeout;
384	dbs->last_time = bs->last_time;
385	ret = (dbs->ssl != NULL);
386	break;
387	case BIO_C_GET_FD:
388	ret = BIO_ctrl(SSL_get_rbio(ssl), cmd, num, ptr);
389	break;
390	case BIO_CTRL_SET_CALLBACK:
391	ret = 0; /* use callback ctrl */
392	break;
393	case BIO_CTRL_GET_RPOLL_DESCRIPTOR:
394	if (!SSL_get_rpoll_descriptor(ssl, (BIO_POLL_DESCRIPTOR *)ptr))
395	ret = 0;
396	break;
397	case BIO_CTRL_GET_WPOLL_DESCRIPTOR:
398	if (!SSL_get_wpoll_descriptor(ssl, (BIO_POLL_DESCRIPTOR *)ptr))
399	ret = 0;
400	break;
401	default:
402	ret = BIO_ctrl(SSL_get_rbio(ssl), cmd, num, ptr);
403	break;
404	}
405	return ret;
406	}
407
408	static long ssl_callback_ctrl(BIO b, int cmd, BIO_info_cb fp)
409	{
410	SSL *ssl;
411	BIO_SSL *bs;
412	long ret = 1;
413
414	bs = BIO_get_data(b);
415	ssl = bs->ssl;
416	switch (cmd) {
417	case BIO_CTRL_SET_CALLBACK:
418	ret = BIO_callback_ctrl(SSL_get_rbio(ssl), cmd, fp);
419	break;
420	default:
421	ret = 0;
422	break;
423	}
424	return ret;
425	}
426
427	static int ssl_puts(BIO bp, const char str)
428	{
429	int n, ret;
430
431	n = strlen(str);
432	ret = BIO_write(bp, str, n);
433	return ret;
434	}
435
436	BIO BIO_new_buffer_ssl_connect(SSL_CTX ctx)
437	{
438	#ifndef OPENSSL_NO_SOCK
439	BIO ret = NULL, buf = NULL, *ssl = NULL;
440
441	# ifndef OPENSSL_NO_QUIC
442	if (ctx != NULL && IS_QUIC_CTX(ctx))
443	/* Never use buffering for QUIC. */
444	return BIO_new_ssl_connect(ctx);
445	# endif
446
447	if ((buf = BIO_new(BIO_f_buffer())) == NULL)
448	return NULL;
449	if ((ssl = BIO_new_ssl_connect(ctx)) == NULL)
450	goto err;
451	if ((ret = BIO_push(buf, ssl)) == NULL)
452	goto err;
453	return ret;
454	err:
455	BIO_free(buf);
456	BIO_free(ssl);
457	#endif
458	return NULL;
459	}
460
461	BIO BIO_new_ssl_connect(SSL_CTX ctx)
462	{
463	#ifndef OPENSSL_NO_SOCK
464	BIO ret = NULL, con = NULL, *ssl = NULL;
465
466	if ((con = BIO_new(BIO_s_connect())) == NULL)
467	return NULL;
468
469	# ifndef OPENSSL_NO_QUIC
470	if (ctx != NULL && IS_QUIC_CTX(ctx))
471	if (!BIO_set_sock_type(con, SOCK_DGRAM))
472	goto err;
473	#endif
474
475	if ((ssl = BIO_new_ssl(ctx, 1)) == NULL)
476	goto err;
477	if ((ret = BIO_push(ssl, con)) == NULL)
478	goto err;
479	return ret;
480	err:
481	BIO_free(ssl);
482	BIO_free(con);
483	#endif
484	return NULL;
485	}
486
487	BIO BIO_new_ssl(SSL_CTX ctx, int client)
488	{
489	BIO *ret;
490	SSL *ssl;
491
492	if ((ret = BIO_new(BIO_f_ssl())) == NULL)
493	return NULL;
494	if ((ssl = SSL_new(ctx)) == NULL) {
495	BIO_free(ret);
496	return NULL;
497	}
498	if (client)
499	SSL_set_connect_state(ssl);
500	else
501	SSL_set_accept_state(ssl);
502
503	BIO_set_ssl(ret, ssl, BIO_CLOSE);
504	return ret;
505	}
506
507	int BIO_ssl_copy_session_id(BIO t, BIO f)
508	{
509	BIO_SSL tdata, fdata;
510	t = BIO_find_type(t, BIO_TYPE_SSL);
511	f = BIO_find_type(f, BIO_TYPE_SSL);
512	if ((t == NULL) \|\| (f == NULL))
513	return 0;
514	tdata = BIO_get_data(t);
515	fdata = BIO_get_data(f);
516	if ((tdata->ssl == NULL) \|\| (fdata->ssl == NULL))
517	return 0;
518	if (!SSL_copy_session_id(tdata->ssl, (fdata->ssl)))
519	return 0;
520	return 1;
521	}
522
523	void BIO_ssl_shutdown(BIO *b)
524	{
525	BIO_SSL *bdata;
526
527	for (; b != NULL; b = BIO_next(b)) {
528	if (BIO_method_type(b) != BIO_TYPE_SSL)
529	continue;
530	bdata = BIO_get_data(b);
531	if (bdata != NULL && bdata->ssl != NULL)
532	SSL_shutdown(bdata->ssl);
533	}
534	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.3.2/ssl/bio_ssl.c

以其他格式下載: