xref: /freebsd/crypto/openssl/ssl/bio_ssl.c (revision d65cd7a57bf0600b722afc770838a5d0c1c3a8e1)
1 /*
2  * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the OpenSSL license (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <string.h>
13 #include <errno.h>
14 #include <openssl/crypto.h>
15 #include "internal/bio.h"
16 #include <openssl/err.h>
17 #include "ssl_local.h"
18 
19 static int ssl_write(BIO *h, const char *buf, size_t size, size_t *written);
20 static int ssl_read(BIO *b, char *buf, size_t size, size_t *readbytes);
21 static int ssl_puts(BIO *h, const char *str);
22 static long ssl_ctrl(BIO *h, int cmd, long arg1, void *arg2);
23 static int ssl_new(BIO *h);
24 static int ssl_free(BIO *data);
25 static long ssl_callback_ctrl(BIO *h, int cmd, BIO_info_cb *fp);
26 typedef struct bio_ssl_st {
27     SSL *ssl;                   /* The ssl handle :-) */
28     /* re-negotiate every time the total number of bytes is this size */
29     int num_renegotiates;
30     unsigned long renegotiate_count;
31     size_t byte_count;
32     unsigned long renegotiate_timeout;
33     unsigned long last_time;
34 } BIO_SSL;
35 
36 static const BIO_METHOD methods_sslp = {
37     BIO_TYPE_SSL,
38     "ssl",
39     ssl_write,
40     NULL,                       /* ssl_write_old, */
41     ssl_read,
42     NULL,                       /* ssl_read_old,  */
43     ssl_puts,
44     NULL,                       /* ssl_gets,      */
45     ssl_ctrl,
46     ssl_new,
47     ssl_free,
48     ssl_callback_ctrl,
49 };
50 
51 const BIO_METHOD *BIO_f_ssl(void)
52 {
53     return &methods_sslp;
54 }
55 
56 static int ssl_new(BIO *bi)
57 {
58     BIO_SSL *bs = OPENSSL_zalloc(sizeof(*bs));
59 
60     if (bs == NULL) {
61         BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
62         return 0;
63     }
64     BIO_set_init(bi, 0);
65     BIO_set_data(bi, bs);
66     /* Clear all flags */
67     BIO_clear_flags(bi, ~0);
68 
69     return 1;
70 }
71 
72 static int ssl_free(BIO *a)
73 {
74     BIO_SSL *bs;
75 
76     if (a == NULL)
77         return 0;
78     bs = BIO_get_data(a);
79     if (bs->ssl != NULL)
80         SSL_shutdown(bs->ssl);
81     if (BIO_get_shutdown(a)) {
82         if (BIO_get_init(a))
83             SSL_free(bs->ssl);
84         /* Clear all flags */
85         BIO_clear_flags(a, ~0);
86         BIO_set_init(a, 0);
87     }
88     OPENSSL_free(bs);
89     return 1;
90 }
91 
92 static int ssl_read(BIO *b, char *buf, size_t size, size_t *readbytes)
93 {
94     int ret = 1;
95     BIO_SSL *sb;
96     SSL *ssl;
97     int retry_reason = 0;
98     int r = 0;
99 
100     if (buf == NULL)
101         return 0;
102     sb = BIO_get_data(b);
103     ssl = sb->ssl;
104 
105     BIO_clear_retry_flags(b);
106 
107     ret = ssl_read_internal(ssl, buf, size, readbytes);
108 
109     switch (SSL_get_error(ssl, ret)) {
110     case SSL_ERROR_NONE:
111         if (sb->renegotiate_count > 0) {
112             sb->byte_count += *readbytes;
113             if (sb->byte_count > sb->renegotiate_count) {
114                 sb->byte_count = 0;
115                 sb->num_renegotiates++;
116                 SSL_renegotiate(ssl);
117                 r = 1;
118             }
119         }
120         if ((sb->renegotiate_timeout > 0) && (!r)) {
121             unsigned long tm;
122 
123             tm = (unsigned long)time(NULL);
124             if (tm > sb->last_time + sb->renegotiate_timeout) {
125                 sb->last_time = tm;
126                 sb->num_renegotiates++;
127                 SSL_renegotiate(ssl);
128             }
129         }
130 
131         break;
132     case SSL_ERROR_WANT_READ:
133         BIO_set_retry_read(b);
134         break;
135     case SSL_ERROR_WANT_WRITE:
136         BIO_set_retry_write(b);
137         break;
138     case SSL_ERROR_WANT_X509_LOOKUP:
139         BIO_set_retry_special(b);
140         retry_reason = BIO_RR_SSL_X509_LOOKUP;
141         break;
142     case SSL_ERROR_WANT_ACCEPT:
143         BIO_set_retry_special(b);
144         retry_reason = BIO_RR_ACCEPT;
145         break;
146     case SSL_ERROR_WANT_CONNECT:
147         BIO_set_retry_special(b);
148         retry_reason = BIO_RR_CONNECT;
149         break;
150     case SSL_ERROR_SYSCALL:
151     case SSL_ERROR_SSL:
152     case SSL_ERROR_ZERO_RETURN:
153     default:
154         break;
155     }
156 
157     BIO_set_retry_reason(b, retry_reason);
158 
159     return ret;
160 }
161 
162 static int ssl_write(BIO *b, const char *buf, size_t size, size_t *written)
163 {
164     int ret, r = 0;
165     int retry_reason = 0;
166     SSL *ssl;
167     BIO_SSL *bs;
168 
169     if (buf == NULL)
170         return 0;
171     bs = BIO_get_data(b);
172     ssl = bs->ssl;
173 
174     BIO_clear_retry_flags(b);
175 
176     ret = ssl_write_internal(ssl, buf, size, written);
177 
178     switch (SSL_get_error(ssl, ret)) {
179     case SSL_ERROR_NONE:
180         if (bs->renegotiate_count > 0) {
181             bs->byte_count += *written;
182             if (bs->byte_count > bs->renegotiate_count) {
183                 bs->byte_count = 0;
184                 bs->num_renegotiates++;
185                 SSL_renegotiate(ssl);
186                 r = 1;
187             }
188         }
189         if ((bs->renegotiate_timeout > 0) && (!r)) {
190             unsigned long tm;
191 
192             tm = (unsigned long)time(NULL);
193             if (tm > bs->last_time + bs->renegotiate_timeout) {
194                 bs->last_time = tm;
195                 bs->num_renegotiates++;
196                 SSL_renegotiate(ssl);
197             }
198         }
199         break;
200     case SSL_ERROR_WANT_WRITE:
201         BIO_set_retry_write(b);
202         break;
203     case SSL_ERROR_WANT_READ:
204         BIO_set_retry_read(b);
205         break;
206     case SSL_ERROR_WANT_X509_LOOKUP:
207         BIO_set_retry_special(b);
208         retry_reason = BIO_RR_SSL_X509_LOOKUP;
209         break;
210     case SSL_ERROR_WANT_CONNECT:
211         BIO_set_retry_special(b);
212         retry_reason = BIO_RR_CONNECT;
213     case SSL_ERROR_SYSCALL:
214     case SSL_ERROR_SSL:
215     default:
216         break;
217     }
218 
219     BIO_set_retry_reason(b, retry_reason);
220 
221     return ret;
222 }
223 
224 static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
225 {
226     SSL **sslp, *ssl;
227     BIO_SSL *bs, *dbs;
228     BIO *dbio, *bio;
229     long ret = 1;
230     BIO *next;
231 
232     bs = BIO_get_data(b);
233     next = BIO_next(b);
234     ssl = bs->ssl;
235     if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))
236         return 0;
237     switch (cmd) {
238     case BIO_CTRL_RESET:
239         SSL_shutdown(ssl);
240 
241         if (ssl->handshake_func == ssl->method->ssl_connect)
242             SSL_set_connect_state(ssl);
243         else if (ssl->handshake_func == ssl->method->ssl_accept)
244             SSL_set_accept_state(ssl);
245 
246         if (!SSL_clear(ssl)) {
247             ret = 0;
248             break;
249         }
250 
251         if (next != NULL)
252             ret = BIO_ctrl(next, cmd, num, ptr);
253         else if (ssl->rbio != NULL)
254             ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
255         else
256             ret = 1;
257         break;
258     case BIO_CTRL_INFO:
259         ret = 0;
260         break;
261     case BIO_C_SSL_MODE:
262         if (num)                /* client mode */
263             SSL_set_connect_state(ssl);
264         else
265             SSL_set_accept_state(ssl);
266         break;
267     case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
268         ret = bs->renegotiate_timeout;
269         if (num < 60)
270             num = 5;
271         bs->renegotiate_timeout = (unsigned long)num;
272         bs->last_time = (unsigned long)time(NULL);
273         break;
274     case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
275         ret = bs->renegotiate_count;
276         if ((long)num >= 512)
277             bs->renegotiate_count = (unsigned long)num;
278         break;
279     case BIO_C_GET_SSL_NUM_RENEGOTIATES:
280         ret = bs->num_renegotiates;
281         break;
282     case BIO_C_SET_SSL:
283         if (ssl != NULL) {
284             ssl_free(b);
285             if (!ssl_new(b))
286                 return 0;
287         }
288         BIO_set_shutdown(b, num);
289         ssl = (SSL *)ptr;
290         bs->ssl = ssl;
291         bio = SSL_get_rbio(ssl);
292         if (bio != NULL) {
293             if (next != NULL)
294                 BIO_push(bio, next);
295             BIO_set_next(b, bio);
296             BIO_up_ref(bio);
297         }
298         BIO_set_init(b, 1);
299         break;
300     case BIO_C_GET_SSL:
301         if (ptr != NULL) {
302             sslp = (SSL **)ptr;
303             *sslp = ssl;
304         } else
305             ret = 0;
306         break;
307     case BIO_CTRL_GET_CLOSE:
308         ret = BIO_get_shutdown(b);
309         break;
310     case BIO_CTRL_SET_CLOSE:
311         BIO_set_shutdown(b, (int)num);
312         break;
313     case BIO_CTRL_WPENDING:
314         ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
315         break;
316     case BIO_CTRL_PENDING:
317         ret = SSL_pending(ssl);
318         if (ret == 0)
319             ret = BIO_pending(ssl->rbio);
320         break;
321     case BIO_CTRL_FLUSH:
322         BIO_clear_retry_flags(b);
323         ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
324         BIO_copy_next_retry(b);
325         break;
326     case BIO_CTRL_PUSH:
327         if ((next != NULL) && (next != ssl->rbio)) {
328             /*
329              * We are going to pass ownership of next to the SSL object...but
330              * we don't own a reference to pass yet - so up ref
331              */
332             BIO_up_ref(next);
333             SSL_set_bio(ssl, next, next);
334         }
335         break;
336     case BIO_CTRL_POP:
337         /* Only detach if we are the BIO explicitly being popped */
338         if (b == ptr) {
339             /* This will clear the reference we obtained during push */
340             SSL_set_bio(ssl, NULL, NULL);
341         }
342         break;
343     case BIO_C_DO_STATE_MACHINE:
344         BIO_clear_retry_flags(b);
345 
346         BIO_set_retry_reason(b, 0);
347         ret = (int)SSL_do_handshake(ssl);
348 
349         switch (SSL_get_error(ssl, (int)ret)) {
350         case SSL_ERROR_WANT_READ:
351             BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
352             break;
353         case SSL_ERROR_WANT_WRITE:
354             BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
355             break;
356         case SSL_ERROR_WANT_CONNECT:
357             BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);
358             BIO_set_retry_reason(b, BIO_get_retry_reason(next));
359             break;
360         case SSL_ERROR_WANT_X509_LOOKUP:
361             BIO_set_retry_special(b);
362             BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);
363             break;
364         default:
365             break;
366         }
367         break;
368     case BIO_CTRL_DUP:
369         dbio = (BIO *)ptr;
370         dbs = BIO_get_data(dbio);
371         SSL_free(dbs->ssl);
372         dbs->ssl = SSL_dup(ssl);
373         dbs->num_renegotiates = bs->num_renegotiates;
374         dbs->renegotiate_count = bs->renegotiate_count;
375         dbs->byte_count = bs->byte_count;
376         dbs->renegotiate_timeout = bs->renegotiate_timeout;
377         dbs->last_time = bs->last_time;
378         ret = (dbs->ssl != NULL);
379         break;
380     case BIO_C_GET_FD:
381         ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
382         break;
383     case BIO_CTRL_SET_CALLBACK:
384         ret = 0; /* use callback ctrl */
385         break;
386     default:
387         ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
388         break;
389     }
390     return ret;
391 }
392 
393 static long ssl_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
394 {
395     SSL *ssl;
396     BIO_SSL *bs;
397     long ret = 1;
398 
399     bs = BIO_get_data(b);
400     ssl = bs->ssl;
401     switch (cmd) {
402     case BIO_CTRL_SET_CALLBACK:
403         ret = BIO_callback_ctrl(ssl->rbio, cmd, fp);
404         break;
405     default:
406         ret = 0;
407         break;
408     }
409     return ret;
410 }
411 
412 static int ssl_puts(BIO *bp, const char *str)
413 {
414     int n, ret;
415 
416     n = strlen(str);
417     ret = BIO_write(bp, str, n);
418     return ret;
419 }
420 
421 BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx)
422 {
423 #ifndef OPENSSL_NO_SOCK
424     BIO *ret = NULL, *buf = NULL, *ssl = NULL;
425 
426     if ((buf = BIO_new(BIO_f_buffer())) == NULL)
427         return NULL;
428     if ((ssl = BIO_new_ssl_connect(ctx)) == NULL)
429         goto err;
430     if ((ret = BIO_push(buf, ssl)) == NULL)
431         goto err;
432     return ret;
433  err:
434     BIO_free(buf);
435     BIO_free(ssl);
436 #endif
437     return NULL;
438 }
439 
440 BIO *BIO_new_ssl_connect(SSL_CTX *ctx)
441 {
442 #ifndef OPENSSL_NO_SOCK
443     BIO *ret = NULL, *con = NULL, *ssl = NULL;
444 
445     if ((con = BIO_new(BIO_s_connect())) == NULL)
446         return NULL;
447     if ((ssl = BIO_new_ssl(ctx, 1)) == NULL)
448         goto err;
449     if ((ret = BIO_push(ssl, con)) == NULL)
450         goto err;
451     return ret;
452  err:
453     BIO_free(con);
454 #endif
455     return NULL;
456 }
457 
458 BIO *BIO_new_ssl(SSL_CTX *ctx, int client)
459 {
460     BIO *ret;
461     SSL *ssl;
462 
463     if ((ret = BIO_new(BIO_f_ssl())) == NULL)
464         return NULL;
465     if ((ssl = SSL_new(ctx)) == NULL) {
466         BIO_free(ret);
467         return NULL;
468     }
469     if (client)
470         SSL_set_connect_state(ssl);
471     else
472         SSL_set_accept_state(ssl);
473 
474     BIO_set_ssl(ret, ssl, BIO_CLOSE);
475     return ret;
476 }
477 
478 int BIO_ssl_copy_session_id(BIO *t, BIO *f)
479 {
480     BIO_SSL *tdata, *fdata;
481     t = BIO_find_type(t, BIO_TYPE_SSL);
482     f = BIO_find_type(f, BIO_TYPE_SSL);
483     if ((t == NULL) || (f == NULL))
484         return 0;
485     tdata = BIO_get_data(t);
486     fdata = BIO_get_data(f);
487     if ((tdata->ssl == NULL) || (fdata->ssl == NULL))
488         return 0;
489     if (!SSL_copy_session_id(tdata->ssl, (fdata->ssl)))
490         return 0;
491     return 1;
492 }
493 
494 void BIO_ssl_shutdown(BIO *b)
495 {
496     BIO_SSL *bdata;
497 
498     for (; b != NULL; b = BIO_next(b)) {
499         if (BIO_method_type(b) != BIO_TYPE_SSL)
500             continue;
501         bdata = BIO_get_data(b);
502         if (bdata != NULL && bdata->ssl != NULL)
503             SSL_shutdown(bdata->ssl);
504     }
505 }
506