HomePhorge
Diffusion Ant (master) Code

ant/vendor/packagefiles/tlsuv/src/boringssl/engine.c
201d063fe28amaster

Last Change
Raw File

engine.c
View Options

#include <assert.h>
#include <stdbool.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <uv.h>
#include "../alloc.h"
#include "../keychain.h"
#include "../um_debug.h"
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <openssl/x509.h>
#include "keys.h"
#if _WIN32
#include <windows.h>
#ifndef PATH_MAX
#define PATH_MAX MAX_PATH
#endif
#endif
#if __APPLE__
#include <Security/Security.h>
#endif
struct boringssl_ctx {
tls_context api;
SSL_CTX *ctx;
int (*cert_verify_f)(const struct tlsuv_certificate_s *cert, void *v_ctx);
void *verify_ctx;
unsigned char *alpn_protocols;
};
struct boringssl_engine {
struct tlsuv_engine_s api;
SSL *ssl;
char *alpn;
BIO *bio;
bool handshake_started;
io_ctx io;
io_read read_f;
io_write write_f;
unsigned long error;
};
static int is_self_signed(X509 *cert);
static bool host_is_ip_literal(const char *host);
static const char *name_str(const X509_NAME *n);
static void init_ssl_context(struct boringssl_ctx *c, const char *cabuf, size_t cabuf_len);
static int tls_set_own_cert(tls_context *ctx, tlsuv_private_key_t key, tlsuv_certificate_t cert);
static int set_ca_bundle(tls_context *tls, const char *ca, size_t ca_len);
tlsuv_engine_t new_boringssl_engine(tls_context *ctx, const char *host);
static int parse_pkcs7_certs(tlsuv_certificate_t *chain, const char *pkcs7, size_t pkcs7len);
static int load_cert(tlsuv_certificate_t *cert, const char *buf, size_t buflen);
static int generate_csr(tlsuv_private_key_t key, char **pem, size_t *pemlen, ...);
static int tls_set_partial_vfy(tls_context *ctx, int allow);
static void tls_set_cert_verify(tls_context *ctx, int (*verify_f)(const struct tlsuv_certificate_s *cert, void *v_ctx), void *v_ctx);
static void set_io(tlsuv_engine_t self, io_ctx io, io_read rdf, io_write wrtf);
static void set_io_fd(tlsuv_engine_t self, tlsuv_sock_t fd);
static void set_protocols(tlsuv_engine_t self, const char **protocols, int len);
static tls_handshake_state tls_hs_state(tlsuv_engine_t engine);
static tls_handshake_state tls_continue_hs(tlsuv_engine_t self);
static const char *tls_get_alpn(tlsuv_engine_t self);
static int tls_write(tlsuv_engine_t self, const char *data, size_t data_len);
static int tls_read(tlsuv_engine_t self, char *out, size_t *out_bytes, size_t maxout);
static int tls_close(tlsuv_engine_t self);
static int tls_reset(tlsuv_engine_t self);
static void tls_free(tlsuv_engine_t self);
static void tls_free_ctx(tls_context *ctx);
static const char *tls_lib_version();
static const char *tls_eng_error(tlsuv_engine_t self);
static void msg_cb(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg);
static void info_cb(const SSL *s, int where, int ret);
static BIO_METHOD *BIO_s_engine(void);
#if _WIN32
static X509_STORE *load_system_certs();
#endif
static tls_context boringssl_context_api = {
.version = tls_lib_version,
.strerror = (const char *(*)(long))tls_error,
.new_engine = new_boringssl_engine,
.free_ctx = tls_free_ctx,
.set_ca_bundle = set_ca_bundle,
.set_own_cert = tls_set_own_cert,
.allow_partial_chain = tls_set_partial_vfy,
.set_cert_verify = tls_set_cert_verify,
.parse_pkcs7_certs = parse_pkcs7_certs,
.load_cert = load_cert,
.generate_key = gen_key,
.load_key = load_key,
.generate_csr_to_pem = generate_csr,
};
static struct tlsuv_engine_s boringssl_engine_api = {
.set_io = set_io,
.set_io_fd = set_io_fd,
.set_protocols = set_protocols,
.handshake_state = tls_hs_state,
.handshake = tls_continue_hs,
.get_alpn = tls_get_alpn,
.close = tls_close,
.write = tls_write,
.read = tls_read,
.reset = tls_reset,
.free = tls_free,
.strerror = tls_eng_error,
};
int configure_boringssl() {
return 0;
}
static const char *tls_lib_version() {
return OpenSSL_version(OPENSSL_VERSION);
}
const char *tls_error(unsigned long code) {
static char err_buf[32];
if (code == 0) return "no error";
const char *lib_err = ERR_lib_error_string(code);
if (lib_err) return lib_err;
snprintf(err_buf, sizeof(err_buf), "error[%lX]", code);
return err_buf;
}
static const char *tls_eng_error(tlsuv_engine_t self) {
struct boringssl_engine *e = (struct boringssl_engine *)self;
const char *err = ERR_reason_error_string(e->error);
return err;
}
tls_context *new_boringssl_ctx(const char *ca, size_t ca_len) {
OPENSSL_init_ssl(OPENSSL_INIT_SSL_DEFAULT, NULL);
struct boringssl_ctx *c = tlsuv__calloc(1, sizeof(struct boringssl_ctx));
c->api = boringssl_context_api;
init_ssl_context(c, ca, ca_len);
return &c->api;
}
static X509_STORE *load_certs(const char *buf, size_t buf_len) {
X509_STORE *certs = X509_STORE_new();
X509 *c;
struct stat fstat;
if (stat(buf, &fstat) == 0) {
if (fstat.st_mode & S_IFREG) {
if (!X509_STORE_load_locations(certs, buf, NULL)) {
UM_LOG(ERR, "failed to load certs from [%s]", buf);
}
} else if (fstat.st_mode & S_IFDIR) {
X509_LOOKUP *lu = X509_STORE_add_lookup(certs, X509_LOOKUP_hash_dir());
if (lu == NULL || X509_LOOKUP_add_dir(lu, buf, X509_FILETYPE_PEM) != 1) {
UM_LOG(ERR, "failed to load cert directory from [%s]", buf);
}
} else {
UM_LOG(ERR, "cert bundle[%s] is not a regular file", buf);
}
} else {
BIO *crt_bio = BIO_new_mem_buf(buf, (int)buf_len);
while ((c = PEM_read_bio_X509(crt_bio, NULL, NULL, NULL)) != NULL) {
int root = is_self_signed(c);
UM_LOG(VERB, "%s root[%s]", name_str(X509_get_subject_name(c)), root ? "true" : "false");
X509_STORE_add_cert(certs, c);
X509_free(c);
}
BIO_free(crt_bio);
}
return certs;
}
static int load_cert(tlsuv_certificate_t *cert, const char *buf, size_t buflen) {
X509_STORE *store = load_certs(buf, buflen);
STACK_OF(X509_OBJECT) *certs = X509_STORE_get0_objects(store);
int count = sk_X509_OBJECT_num(certs);
if (count == 0) {
X509_STORE_free(store);
return -1;
}
struct cert_s *crt = tlsuv__calloc(1, sizeof(*crt));
cert_init(crt);
crt->cert = store;
*cert = (tlsuv_certificate_t)crt;
return 0;
}
static int is_self_signed(X509 *cert) {
X509_NAME *subj = X509_get_subject_name(cert);
X509_NAME *issuer = X509_get_issuer_name(cert);
if (X509_NAME_cmp(subj, issuer) != 0) {
return 0;
}
EVP_PKEY *pub = X509_get_pubkey(cert);
if (pub == NULL) {
return 0;
}
int ok = X509_verify(cert, pub);
EVP_PKEY_free(pub);
return ok == 1;
}
static const char *name_str(const X509_NAME *n) {
static char buf[1024];
BIO *b = BIO_new(BIO_s_mem());
X509_NAME_print(b, n, 0);
BIO_read(b, buf, sizeof(buf));
BIO_free(b);
return buf;
}
#if __APPLE__
static int apple_ca_verify(int pre_verify, X509_STORE_CTX *st) {
(void)pre_verify;
CFMutableArrayRef certs = CFArrayCreateMutable(kCFAllocatorDefault, 10, &kCFTypeArrayCallBacks);
STACK_OF(X509) *chain = X509_STORE_CTX_get1_chain(st);
for (int i = 0; i < sk_X509_num(chain); i++) {
X509 *x = sk_X509_value(chain, i);
uint8_t *der = NULL;
int der_len = i2d_X509(x, &der);
CFDataRef d = CFDataCreate(kCFAllocatorDefault, der, der_len);
OPENSSL_free(der);
SecCertificateRef c = SecCertificateCreateWithData(kCFAllocatorDefault, d);
CFArrayAppendValue(certs, c);
CFRelease(d);
CFRelease(c);
}
sk_X509_pop_free(chain, X509_free);
SecTrustRef trust;
SecPolicyRef policy = SecPolicyCreateBasicX509();
CFErrorRef err = NULL;
bool result = SecTrustCreateWithCertificates(certs, policy, &trust) == errSecSuccess &&
SecTrustEvaluateWithError(trust, &err);
CFRelease(trust);
CFRelease(policy);
CFRelease(certs);
return result;
}
#endif
static int set_ca_bundle(tls_context *tls, const char *ca, size_t ca_len) {
struct boringssl_ctx *c = (struct boringssl_ctx *)tls;
SSL_CTX *ctx = c->ctx;
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
if (ca != NULL) {
X509_STORE *store = load_certs(ca, ca_len);
SSL_CTX_set0_verify_cert_store(ctx, store);
} else {
#if _WIN32
X509_STORE *sys_ca = load_system_certs();
if (sys_ca != NULL) {
SSL_CTX_set0_verify_cert_store(ctx, sys_ca);
}
#elif __APPLE__
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, apple_ca_verify);
#elif defined(ANDROID) || defined(__ANDROID__)
X509_STORE *ca_store = SSL_CTX_get_cert_store(ctx);
X509_LOOKUP *lu = X509_STORE_add_lookup(ca_store, X509_LOOKUP_hash_dir());
if (lu != NULL) {
X509_LOOKUP_add_dir(lu, "/etc/security/cacerts", X509_FILETYPE_PEM);
}
#else
SSL_CTX_set_default_verify_paths(ctx);
#endif
}
return 0;
}
static void init_ssl_context(struct boringssl_ctx *c, const char *cabuf, size_t cabuf_len) {
const SSL_METHOD *method = TLS_client_method();
SSL_CTX *ctx = SSL_CTX_new(method);
if (ctx == NULL) {
ERR_print_errors_fp(stderr);
UM_LOG(ERR, "FATAL: failed to create SSL_CTX: %s", tls_error(ERR_get_error()));
abort();
}
SSL_CTX_set_app_data(ctx, c);
c->ctx = ctx;
set_ca_bundle((tls_context *)c, cabuf, cabuf_len);
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
char *tls_debug = getenv("TLS_DEBUG");
if (tls_debug) {
SSL_CTX_set_msg_callback(ctx, msg_cb);
SSL_CTX_set_info_callback(ctx, info_cb);
}
}
typedef struct string_int_pair_st {
const char *name;
int retval;
} STRINT_PAIR;
static const char *lookup(int val, const STRINT_PAIR *list, const char *def) {
for (; list->name; ++list) {
if (list->retval == val) return list->name;
}
return def;
}
static STRINT_PAIR handshakes[] = {
{", HelloRequest", SSL3_MT_HELLO_REQUEST},
{", ClientHello", SSL3_MT_CLIENT_HELLO},
{", ServerHello", SSL3_MT_SERVER_HELLO},
{", HelloVerifyRequest", DTLS1_MT_HELLO_VERIFY_REQUEST},
{", NewSessionTicket", SSL3_MT_NEWSESSION_TICKET},
{", EndOfEarlyData", SSL3_MT_END_OF_EARLY_DATA},
{", EncryptedExtensions", SSL3_MT_ENCRYPTED_EXTENSIONS},
{", Certificate", SSL3_MT_CERTIFICATE},
{", ServerKeyExchange", SSL3_MT_SERVER_KEY_EXCHANGE},
{", CertificateRequest", SSL3_MT_CERTIFICATE_REQUEST},
{", ServerHelloDone", SSL3_MT_SERVER_DONE},
{", CertificateVerify", SSL3_MT_CERTIFICATE_VERIFY},
{", ClientKeyExchange", SSL3_MT_CLIENT_KEY_EXCHANGE},
{", Finished", SSL3_MT_FINISHED},
{", CertificateStatus", SSL3_MT_CERTIFICATE_STATUS},
{", SupplementalData", SSL3_MT_SUPPLEMENTAL_DATA},
{", KeyUpdate", SSL3_MT_KEY_UPDATE},
#ifndef OPENSSL_NO_NEXTPROTONEG
{", NextProto", SSL3_MT_NEXT_PROTO},
#endif
{", MessageHash", SSL3_MT_MESSAGE_HASH},
{NULL}
};
static STRINT_PAIR alert_types[] = {
{" close_notify", 0},
{" end_of_early_data", 1},
{" unexpected_message", 10},
{" bad_record_mac", 20},
{" decryption_failed", 21},
{" record_overflow", 22},
{" decompression_failure", 30},
{" handshake_failure", 40},
{" bad_certificate", 42},
{" unsupported_certificate", 43},
{" certificate_revoked", 44},
{" certificate_expired", 45},
{" certificate_unknown", 46},
{" illegal_parameter", 47},
{" unknown_ca", 48},
{" access_denied", 49},
{" decode_error", 50},
{" decrypt_error", 51},
{" export_restriction", 60},
{" protocol_version", 70},
{" insufficient_security", 71},
{" internal_error", 80},
{" inappropriate_fallback", 86},
{" user_canceled", 90},
{" no_renegotiation", 100},
{" missing_extension", 109},
{" unsupported_extension", 110},
{" certificate_unobtainable", 111},
{" unrecognized_name", 112},
{" bad_certificate_status_response", 113},
{" bad_certificate_hash_value", 114},
{" unknown_psk_identity", 115},
{" certificate_required", 116},
{NULL}
};
static STRINT_PAIR ssl_versions[] = {
{"SSL 3.0", SSL3_VERSION},
{"TLS 1.0", TLS1_VERSION},
{"TLS 1.1", TLS1_1_VERSION},
{"TLS 1.2", TLS1_2_VERSION},
{"TLS 1.3", TLS1_3_VERSION},
{"DTLS 1.0", DTLS1_VERSION},
{NULL}
};
static void msg_cb(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg) {
(void)ssl;
(void)arg;
const char *str_write_p = write_p ? ">>>" : "<<<";
const char *str_content_type = "", *str_details1 = "", *str_details2 = "";
const char *str_version = lookup(version, ssl_versions, "???");
const unsigned char *bp = buf;
if (version == SSL3_VERSION || version == TLS1_VERSION || version == TLS1_1_VERSION ||
version == TLS1_2_VERSION || version == TLS1_3_VERSION ||
version == DTLS1_VERSION) {
switch (content_type) {
case 20: str_content_type = ", ChangeCipherSpec"; break;
case 21:
str_content_type = ", Alert";
str_details1 = ", ???";
if (len == 2) {
switch (bp[0]) {
case 1: str_details1 = ", warning"; break;
case 2: str_details1 = ", fatal"; break;
}
str_details2 = lookup((int)bp[1], alert_types, " ???");
}
break;
case 22:
str_content_type = ", Handshake";
str_details1 = "???";
if (len > 0) str_details1 = lookup((int)bp[0], handshakes, "???");
break;
case 23: str_content_type = ", ApplicationData"; break;
}
} else if (version == 0 && content_type == SSL3_RT_HEADER) {
str_version = "";
str_content_type = "TLS Header";
}
UM_LOG(TRACE, "%s %s%s [length %04lx]%s%s", str_write_p, str_version, str_content_type, (unsigned long)len, str_details1, str_details2);
}
void info_cb(const SSL *s, int where, int ret) {
const char *str;
int w = where & ~SSL_ST_MASK;
if (w & SSL_ST_CONNECT) str = "SSL_connect";
else if (w & SSL_ST_ACCEPT) str = "SSL_accept";
else str = "undefined";
if (where & SSL_CB_LOOP) {
UM_LOG(TRACE, "%s:%s", str, SSL_state_string_long(s));
} else if (where & SSL_CB_ALERT) {
str = (where & SSL_CB_READ) ? "read" : "write";
UM_LOG(VERB, "SSL3 alert %s:%s:%s", str, SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
} else if (where & SSL_CB_EXIT) {
if (ret == 0) UM_LOG(VERB, "%s:failed in %s", str, SSL_state_string_long(s));
else if (ret < 0) UM_LOG(VERB, "%s:error in %s", str, SSL_state_string_long(s));
}
}
tlsuv_engine_t new_boringssl_engine(tls_context *ctx, const char *host) {
struct boringssl_ctx *context = (struct boringssl_ctx *)ctx;
struct boringssl_engine *engine = tlsuv__calloc(1, sizeof(struct boringssl_engine));
engine->api = boringssl_engine_api;
engine->ssl = SSL_new(context->ctx);
if (host && *host) {
if (host_is_ip_literal(host)) {
X509_VERIFY_PARAM_set1_ip_asc(SSL_get0_param(engine->ssl), host);
} else {
SSL_set_tlsext_host_name(engine->ssl, host);
SSL_set1_host(engine->ssl, host);
}
}
SSL_set_connect_state(engine->ssl);
SSL_set_app_data(engine->ssl, engine);
return &engine->api;
}
static bool host_is_ip_literal(const char *host) {
struct sockaddr_in addr4;
struct sockaddr_in6 addr6;
return host != NULL &&
(uv_inet_pton(AF_INET, host, &addr4.sin_addr) == 0 ||
uv_inet_pton(AF_INET6, host, &addr6.sin6_addr) == 0);
}
static void set_io(tlsuv_engine_t self, io_ctx io, io_read rdf, io_write wrtf) {
struct boringssl_engine *e = (struct boringssl_engine *)self;
assert(e->bio == NULL);
#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
SSL_set_options(e->ssl, SSL_OP_IGNORE_UNEXPECTED_EOF);
#endif
e->bio = BIO_new(BIO_s_engine());
BIO_set_data(e->bio, e);
BIO_set_init(e->bio, true);
SSL_set_bio(e->ssl, e->bio, e->bio);
e->io = io;
e->read_f = rdf;
e->write_f = wrtf;
}
static void set_io_fd(tlsuv_engine_t self, tlsuv_sock_t fd) {
struct boringssl_engine *e = (struct boringssl_engine *)self;
assert(e->bio == NULL);
e->bio = BIO_new_socket((int)fd, false);
SSL_set_bio(e->ssl, e->bio, e->bio);
}
static void set_protocols(tlsuv_engine_t self, const char **protocols, int len) {
struct boringssl_engine *e = (struct boringssl_engine *)self;
size_t protolen = 0;
for (int i = 0; i < len; i++) protolen += strlen(protocols[i]) + 1;
unsigned char *alpn_protocols = tlsuv__malloc(protolen + 1);
unsigned char *p = alpn_protocols;
for (int i = 0; i < len; i++) {
size_t plen = strlen(protocols[i]);
*p++ = (unsigned char)plen;
strncpy((char *)p, protocols[i], plen);
p += plen;
}
*p = 0;
SSL_set_alpn_protos(e->ssl, alpn_protocols, (unsigned int)strlen((char *)alpn_protocols));
tlsuv__free(alpn_protocols);
}
static int cert_verify_cb(X509_STORE_CTX *certs, void *ctx) {
struct boringssl_ctx *c = ctx;
X509_STORE *store = X509_STORE_new();
X509 *crt = X509_STORE_CTX_get0_cert(certs);
X509_STORE_add_cert(store, crt);
char n[1024];
X509_NAME_oneline(X509_get_subject_name(crt), n, 1024);
UM_LOG(VERB, "verifying %s", n);
int rc = 1;
struct cert_s cert;
cert_init(&cert);
cert.cert = store;
if (c->cert_verify_f && c->cert_verify_f((const struct tlsuv_certificate_s *)&cert, c->verify_ctx) != 0) {
UM_LOG(WARN, "verify failed for certificate[%s]", n);
rc = 0;
}
X509_STORE_free(store);
return rc;
}
int tls_set_partial_vfy(tls_context *ctx, int allow) {
struct boringssl_ctx *c = (struct boringssl_ctx *)ctx;
X509_VERIFY_PARAM *vfy = SSL_CTX_get0_param(c->ctx);
if (allow) X509_VERIFY_PARAM_set_flags(vfy, X509_V_FLAG_PARTIAL_CHAIN);
else X509_VERIFY_PARAM_clear_flags(vfy, X509_V_FLAG_PARTIAL_CHAIN);
return 0;
}
static void tls_set_cert_verify(tls_context *ctx, int (*verify_f)(const struct tlsuv_certificate_s *cert, void *v_ctx), void *v_ctx) {
struct boringssl_ctx *c = (struct boringssl_ctx *)ctx;
c->cert_verify_f = verify_f;
c->verify_ctx = v_ctx;
SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER, NULL);
SSL_CTX_set_cert_verify_callback(c->ctx, cert_verify_cb, c);
}
static void tls_free_ctx(tls_context *ctx) {
struct boringssl_ctx *c = (struct boringssl_ctx *)ctx;
if (c->alpn_protocols) {
tlsuv__free(c->alpn_protocols);
}
SSL_CTX_free(c->ctx);
tlsuv__free(c);
}
static int tls_reset(tlsuv_engine_t self) {
struct boringssl_engine *e = (struct boringssl_engine *)self;
ERR_clear_error();
e->bio = NULL;
if (!SSL_clear(e->ssl)) {
int err = SSL_get_error(e->ssl, 0);
UM_LOG(ERR, "error resetting TLS engine: %d(%s)", err, tls_error(err));
return -1;
}
return 0;
}
static void tls_free(tlsuv_engine_t self) {
struct boringssl_engine *e = (struct boringssl_engine *)self;
SSL_free(e->ssl);
if (e->alpn) {
tlsuv__free(e->alpn);
}
tlsuv__free(e);
}
#define SSL_OP_CHECK(op, desc) do { \
if ((op) != 1) { \
uint32_t err = ERR_get_error(); \
UM_LOG(ERR, "failed to " desc ": %d(%s)", err, tls_error(err)); \
return TLS_ERR; \
} \
} while (0)
static X509 *tls_set_cert_internal(SSL_CTX *ssl, X509_STORE *store) {
STACK_OF(X509_OBJECT) *certs = X509_STORE_get0_objects(store);
X509 *crt = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(certs, 0));
SSL_CTX_use_certificate(ssl, crt);
for (int i = 1; i < sk_X509_OBJECT_num(certs); i++) {
X509 *x509 = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(certs, i));
X509_up_ref(x509);
SSL_CTX_add_extra_chain_cert(ssl, x509);
}
return crt;
}
static int tls_set_own_cert(tls_context *ctx, tlsuv_private_key_t key, tlsuv_certificate_t cert) {
struct boringssl_ctx *c = (struct boringssl_ctx *)ctx;
SSL_CTX *ssl = c->ctx;
SSL_CTX_use_PrivateKey(ssl, NULL);
SSL_CTX_use_certificate(ssl, NULL);
SSL_CTX_clear_chain_certs(ssl);
if (key == NULL) {
return 0;
}
struct cert_s *crt = (struct cert_s *)cert;
X509_STORE *store = NULL;
if (crt == NULL) {
if (key->get_certificate) {
if (key->get_certificate(key, (tlsuv_certificate_t *)&crt) != 0) {
return -1;
}
store = crt->cert;
free(crt);
}
} else {
store = crt->cert;
X509_STORE_up_ref(crt->cert);
}
if (store == NULL) {
return -1;
}
struct priv_key_s *pk = (struct priv_key_s *)key;
X509 *certs = tls_set_cert_internal(ssl, store);
X509_STORE_free(store);
SSL_OP_CHECK(X509_check_private_key(certs, pk->pkey), "verify key/cert combo");
SSL_OP_CHECK(SSL_CTX_use_PrivateKey(ssl, pk->pkey), "set private key");
return 0;
}
static tls_handshake_state tls_hs_state(tlsuv_engine_t engine) {
struct boringssl_engine *eng = (struct boringssl_engine *)engine;
if (SSL_is_init_finished(eng->ssl)) return TLS_HS_COMPLETE;
return eng->handshake_started ? TLS_HS_CONTINUE : TLS_HS_BEFORE;
}
static int print_err_cb(const char *e, size_t len, void *v) {
(void)v;
UM_LOG(WARN, "%.*s", (int)len, e);
return 1;
}
static tls_handshake_state tls_continue_hs(tlsuv_engine_t self) {
struct boringssl_engine *eng = (struct boringssl_engine *)self;
ERR_clear_error();
eng->handshake_started = true;
int rc = SSL_do_handshake(eng->ssl);
if (rc != 1) {
eng->error = ERR_peek_error();
ERR_print_errors_cb(print_err_cb, NULL);
}
if (rc == 1) {
eng->error = 0;
return TLS_HS_COMPLETE;
}
int err = SSL_get_error(eng->ssl, rc);
if (rc == 0) {
UM_LOG(ERR, "boringssl: handshake was terminated: %s", tls_error(eng->error));
return TLS_HS_ERROR;
}
if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
return TLS_HS_CONTINUE;
}
UM_LOG(ERR, "boringssl: handshake was terminated: %s", tls_error(eng->error));
return TLS_HS_ERROR;
}
static const char *tls_get_alpn(tlsuv_engine_t self) {
struct boringssl_engine *eng = (struct boringssl_engine *)self;
const unsigned char *proto;
unsigned int protolen;
SSL_get0_alpn_selected(eng->ssl, &proto, &protolen);
eng->alpn = tlsuv__calloc(1, protolen + 1);
strncpy(eng->alpn, (const char *)proto, protolen);
return eng->alpn;
}
static int tls_write(tlsuv_engine_t self, const char *data, size_t data_len) {
struct boringssl_engine *eng = (struct boringssl_engine *)self;
ERR_clear_error();
if (data_len > INT_MAX) data_len = INT_MAX;
size_t wrote = 0;
while (data_len > wrote) {
int remaining = (int)(data_len - wrote);
int ret = SSL_write(eng->ssl, data + wrote, remaining);
if (ret <= 0) {
int err = SSL_get_error(eng->ssl, ret);
if (err == SSL_ERROR_WANT_WRITE) {
return wrote > 0 ? (int)wrote : TLS_AGAIN;
}
eng->error = ERR_peek_last_error();
UM_LOG(ERR, "boringssl: write[%d] error: %s", err, tls_error(eng->error));
return -1;
}
wrote += (size_t)ret;
}
return (int)wrote;
}
static int tls_read(tlsuv_engine_t self, char *out, size_t *out_bytes, size_t maxout) {
struct boringssl_engine *eng = (struct boringssl_engine *)self;
int err = SSL_ERROR_NONE;
uint8_t *writep = (uint8_t *)out;
size_t total_out = 0;
ERR_clear_error();
while (maxout - total_out > 0) {
int want = (int)(maxout - total_out);
int rc = SSL_read(eng->ssl, writep, want);
if (rc <= 0) {
err = SSL_get_error(eng->ssl, rc);
break;
}
total_out += (size_t)rc;
writep += rc;
}
if (total_out > 0) {
*out_bytes = total_out;
return SSL_pending(eng->ssl) ? TLS_MORE_AVAILABLE : TLS_OK;
}
*out_bytes = 0;
if (SSL_get_shutdown(eng->ssl)) return TLS_EOF;
unsigned long err_code = ERR_peek_last_error();
switch (err) {
case SSL_ERROR_NONE:
UM_LOG(WARN, "boringssl read: SSL_ERROR_NONE with 0 bytes read");
return TLS_OK;
case SSL_ERROR_ZERO_RETURN:
return TLS_EOF;
case SSL_ERROR_WANT_WRITE:
case SSL_ERROR_WANT_READ:
return TLS_AGAIN;
case SSL_ERROR_SYSCALL:
case SSL_ERROR_SSL:
eng->error = err_code;
UM_LOG(WARN, "boringssl read[%d]: %lX/%s", err, err_code, tls_error(err_code));
return TLS_ERR;
default:
UM_LOG(WARN, "boringssl read: unexpected err[%d] code[%lX]", err, err_code);
break;
}
return TLS_OK;
}
static int tls_close(tlsuv_engine_t self) {
struct boringssl_engine *eng = (struct boringssl_engine *)self;
ERR_clear_error();
int rc = SSL_shutdown(eng->ssl);
if (rc < 0) {
int err = SSL_get_error(eng->ssl, rc);
unsigned long err_code = ERR_peek_last_error();
UM_LOG(WARN, "boringssl shutdown[%d]: %lX/%s", err, err_code, tls_error(err_code));
}
return 0;
}
static int parse_pkcs7_certs(tlsuv_certificate_t *chain, const char *pkcs7buf, size_t pkcs7len) {
BIO *buf = BIO_new_mem_buf(pkcs7buf, (int)pkcs7len);
PKCS7 *pkcs7 = PEM_read_bio_PKCS7(buf, NULL, NULL, NULL);
if (pkcs7 == NULL) {
BIO_free(buf);
buf = BIO_new_mem_buf(pkcs7buf, (int)pkcs7len);
pkcs7 = d2i_PKCS7_bio(buf, NULL);
}
if (pkcs7 == NULL) {
BIO_free(buf);
return -1;
}
STACK_OF(X509) *certs;
if (PKCS7_type_is_signed(pkcs7)) certs = pkcs7->d.sign->cert;
else if (PKCS7_type_is_signedAndEnveloped(pkcs7)) certs = pkcs7->d.signed_and_enveloped->cert;
else {
BIO_free(buf);
PKCS7_free(pkcs7);
return -1;
}
X509_STORE *store = X509_STORE_new();
for (int i = 0; i < sk_X509_num(certs); i++) {
X509 *c = sk_X509_value(certs, i);
X509_STORE_add_cert(store, c);
}
struct cert_s *c = tlsuv__calloc(1, sizeof(*c));
cert_init(c);
c->cert = store;
*chain = (tlsuv_certificate_t)c;
PKCS7_free(pkcs7);
BIO_free(buf);
return 0;
}
static int generate_csr(tlsuv_private_key_t key, char **pem, size_t *pemlen, ...) {
struct priv_key_s *privkey = (struct priv_key_s *)key;
int ret = 0;
const char *op = NULL;
EVP_PKEY *pk = privkey->pkey;
X509_REQ *req = X509_REQ_new();
X509_NAME *subj = X509_REQ_get_subject_name(req);
BIO *b = BIO_new(BIO_s_mem());
va_list va;
va_start(va, pemlen);
while (true) {
char *id = va_arg(va, char *);
if (id == NULL) break;
const uint8_t *val = va_arg(va, uint8_t *);
if (val == NULL) break;
X509_NAME_add_entry_by_txt(subj, id, MBSTRING_ASC, val, -1, -1, 0);
}
va_end(va);
#define ssl_check(OP) do { \
op = #OP; \
if ((OP) == 0) { \
ret = ERR_get_error(); \
goto on_error; \
} \
} while (0)
ssl_check(X509_REQ_set_pubkey(req, pk));
ssl_check(X509_REQ_sign(req, pk, EVP_sha256()));
ssl_check(PEM_write_bio_X509_REQ(b, req));
on_error:
if (ret) {
UM_LOG(WARN, "%s => %s", op, tls_error(ret));
} else {
size_t len = BIO_ctrl_pending(b);
*pem = tlsuv__calloc(1, len + 1);
BIO_read(b, *pem, (int)len);
if (pemlen) *pemlen = len;
}
BIO_free(b);
X509_REQ_free(req);
return ret;
}
#if _WIN32
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
static X509_STORE *load_system_certs() {
X509_STORE *store = X509_STORE_new();
X509 *c;
HCERTSTORE hCertStore;
PCCERT_CONTEXT pCertContext = NULL;
if (!(hCertStore = CertOpenSystemStore(0, "ROOT"))) {
UM_LOG(ERR, "The first system store did not open.");
return store;
}
while ((pCertContext = CertEnumCertificatesInStore(hCertStore, pCertContext)) != NULL) {
c = d2i_X509(NULL, (const uint8_t **)&pCertContext->pbCertEncoded, (long)pCertContext->cbCertEncoded);
X509_STORE_add_cert(store, c);
}
CertFreeCertificateContext(pCertContext);
CertCloseStore(hCertStore, 0);
return store;
}
#endif
static int engine_bio_write(BIO *b, const char *data, int len) {
struct boringssl_engine *e = BIO_get_data(b);
assert(e);
assert(e->write_f);
ssize_t r = e->write_f(e->io, data, (size_t)len);
if (r > 0) {
return (int)r;
}
if (r == 0) {
BIO_set_retry_write(b);
}
return -1;
}
static int engine_bio_read(BIO *b, char *data, int len) {
struct boringssl_engine *e = BIO_get_data(b);
assert(e);
assert(e->read_f);
ssize_t r = e->read_f(e->io, data, (size_t)len);
if (r > 0) {
return (int)r;
}
if (r == 0) {
BIO_set_retry_read(b);
}
return -1;
}
static int engine_bio_puts(BIO *b, const char *str) {
return engine_bio_write(b, str, (int)strlen(str));
}
static long engine_bio_ctrl(BIO *b, int cmd, long num, void *ptr) {
(void)b;
(void)num;
(void)ptr;
switch (cmd) {
case BIO_CTRL_FLUSH:
case BIO_CTRL_DGRAM_QUERY_MTU:
return 1;
default:
return 0;
}
}
static int engine_bio_create(BIO *b) {
BIO_set_init(b, 0);
BIO_set_data(b, NULL);
return 1;
}
static int engine_bio_destroy(BIO *b) {
if (b == NULL) return 0;
BIO_set_data(b, NULL);
BIO_set_init(b, 0);
return 1;
}
static BIO_METHOD *BIO_s_engine(void) {
static BIO_METHOD *engine = NULL;
if (engine == NULL) {
engine = BIO_meth_new(BIO_TYPE_SOURCE_SINK, "tlsuv-engine");
BIO_meth_set_write(engine, engine_bio_write);
BIO_meth_set_read(engine, engine_bio_read);
BIO_meth_set_puts(engine, engine_bio_puts);
BIO_meth_set_ctrl(engine, engine_bio_ctrl);
BIO_meth_set_create(engine, engine_bio_create);
BIO_meth_set_destroy(engine, engine_bio_destroy);
}
return engine;
}

Owner Packages

  • No Owners