1 /* ssl/bio_ssl.c */ 2 /* Copyright (C) 1995-1998 Eric Young (eay (at) cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay (at) cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh (at) cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay (at) cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh (at) cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <stdio.h> 60 #include <stdlib.h> 61 #include <string.h> 62 #include <errno.h> 63 #include <openssl/crypto.h> 64 #include <openssl/bio.h> 65 #include <openssl/err.h> 66 #include <openssl/ssl.h> 67 68 static int ssl_write(BIO *h, const char *buf, int num); 69 static int ssl_read(BIO *h, char *buf, int size); 70 static int ssl_puts(BIO *h, const char *str); 71 static long ssl_ctrl(BIO *h, int cmd, long arg1, void *arg2); 72 static int ssl_new(BIO *h); 73 static int ssl_free(BIO *data); 74 static long ssl_callback_ctrl(BIO *h, int cmd, bio_info_cb *fp); 75 typedef struct bio_ssl_st 76 { 77 SSL *ssl; /* The ssl handle :-) */ 78 /* re-negotiate every time the total number of bytes is this size */ 79 int num_renegotiates; 80 unsigned long renegotiate_count; 81 unsigned long byte_count; 82 unsigned long renegotiate_timeout; 83 unsigned long last_time; 84 } BIO_SSL; 85 86 static BIO_METHOD methods_sslp= 87 { 88 BIO_TYPE_SSL,"ssl", 89 ssl_write, 90 ssl_read, 91 ssl_puts, 92 NULL, /* ssl_gets, */ 93 ssl_ctrl, 94 ssl_new, 95 ssl_free, 96 ssl_callback_ctrl, 97 }; 98 99 BIO_METHOD *BIO_f_ssl(void) 100 { 101 return(&methods_sslp); 102 } 103 104 static int ssl_new(BIO *bi) 105 { 106 BIO_SSL *bs; 107 108 bs=(BIO_SSL *)OPENSSL_malloc(sizeof(BIO_SSL)); 109 if (bs == NULL) 110 { 111 BIOerr(BIO_F_SSL_NEW,ERR_R_MALLOC_FAILURE); 112 return(0); 113 } 114 memset(bs,0,sizeof(BIO_SSL)); 115 bi->init=0; 116 bi->ptr=(char *)bs; 117 bi->flags=0; 118 return(1); 119 } 120 121 static int ssl_free(BIO *a) 122 { 123 BIO_SSL *bs; 124 125 if (a == NULL) return(0); 126 bs=(BIO_SSL *)a->ptr; 127 if (bs->ssl != NULL) SSL_shutdown(bs->ssl); 128 if (a->shutdown) 129 { 130 if (a->init && (bs->ssl != NULL)) 131 SSL_free(bs->ssl); 132 a->init=0; 133 a->flags=0; 134 } 135 if (a->ptr != NULL) 136 OPENSSL_free(a->ptr); 137 return(1); 138 } 139 140 static int ssl_read(BIO *b, char *out, int outl) 141 { 142 int ret=1; 143 BIO_SSL *sb; 144 SSL *ssl; 145 int retry_reason=0; 146 int r=0; 147 148 if (out == NULL) return(0); 149 sb=(BIO_SSL *)b->ptr; 150 ssl=sb->ssl; 151 152 BIO_clear_retry_flags(b); 153 154 #if 0 155 if (!SSL_is_init_finished(ssl)) 156 { 157 /* ret=SSL_do_handshake(ssl); */ 158 if (ret > 0) 159 { 160 161 outflags=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY); 162 ret= -1; 163 goto end; 164 } 165 } 166 #endif 167 /* if (ret > 0) */ 168 ret=SSL_read(ssl,out,outl); 169 170 switch (SSL_get_error(ssl,ret)) 171 { 172 case SSL_ERROR_NONE: 173 if (ret <= 0) break; 174 if (sb->renegotiate_count > 0) 175 { 176 sb->byte_count+=ret; 177 if (sb->byte_count > sb->renegotiate_count) 178 { 179 sb->byte_count=0; 180 sb->num_renegotiates++; 181 SSL_renegotiate(ssl); 182 r=1; 183 } 184 } 185 if ((sb->renegotiate_timeout > 0) && (!r)) 186 { 187 unsigned long tm; 188 189 tm=(unsigned long)time(NULL); 190 if (tm > sb->last_time+sb->renegotiate_timeout) 191 { 192 sb->last_time=tm; 193 sb->num_renegotiates++; 194 SSL_renegotiate(ssl); 195 } 196 } 197 198 break; 199 case SSL_ERROR_WANT_READ: 200 BIO_set_retry_read(b); 201 break; 202 case SSL_ERROR_WANT_WRITE: 203 BIO_set_retry_write(b); 204 break; 205 case SSL_ERROR_WANT_X509_LOOKUP: 206 BIO_set_retry_special(b); 207 retry_reason=BIO_RR_SSL_X509_LOOKUP; 208 break; 209 case SSL_ERROR_WANT_CHANNEL_ID_LOOKUP: 210 BIO_set_retry_special(b); 211 retry_reason=BIO_RR_SSL_CHANNEL_ID_LOOKUP; 212 break; 213 case SSL_ERROR_WANT_ACCEPT: 214 BIO_set_retry_special(b); 215 retry_reason=BIO_RR_ACCEPT; 216 break; 217 case SSL_ERROR_WANT_CONNECT: 218 BIO_set_retry_special(b); 219 retry_reason=BIO_RR_CONNECT; 220 break; 221 case SSL_ERROR_SYSCALL: 222 case SSL_ERROR_SSL: 223 case SSL_ERROR_ZERO_RETURN: 224 default: 225 break; 226 } 227 228 b->retry_reason=retry_reason; 229 return(ret); 230 } 231 232 static int ssl_write(BIO *b, const char *out, int outl) 233 { 234 int ret,r=0; 235 int retry_reason=0; 236 SSL *ssl; 237 BIO_SSL *bs; 238 239 if (out == NULL) return(0); 240 bs=(BIO_SSL *)b->ptr; 241 ssl=bs->ssl; 242 243 BIO_clear_retry_flags(b); 244 245 /* ret=SSL_do_handshake(ssl); 246 if (ret > 0) */ 247 ret=SSL_write(ssl,out,outl); 248 249 switch (SSL_get_error(ssl,ret)) 250 { 251 case SSL_ERROR_NONE: 252 if (ret <= 0) break; 253 if (bs->renegotiate_count > 0) 254 { 255 bs->byte_count+=ret; 256 if (bs->byte_count > bs->renegotiate_count) 257 { 258 bs->byte_count=0; 259 bs->num_renegotiates++; 260 SSL_renegotiate(ssl); 261 r=1; 262 } 263 } 264 if ((bs->renegotiate_timeout > 0) && (!r)) 265 { 266 unsigned long tm; 267 268 tm=(unsigned long)time(NULL); 269 if (tm > bs->last_time+bs->renegotiate_timeout) 270 { 271 bs->last_time=tm; 272 bs->num_renegotiates++; 273 SSL_renegotiate(ssl); 274 } 275 } 276 break; 277 case SSL_ERROR_WANT_WRITE: 278 BIO_set_retry_write(b); 279 break; 280 case SSL_ERROR_WANT_READ: 281 BIO_set_retry_read(b); 282 break; 283 case SSL_ERROR_WANT_X509_LOOKUP: 284 BIO_set_retry_special(b); 285 retry_reason=BIO_RR_SSL_X509_LOOKUP; 286 break; 287 case SSL_ERROR_WANT_CHANNEL_ID_LOOKUP: 288 BIO_set_retry_special(b); 289 retry_reason=BIO_RR_SSL_CHANNEL_ID_LOOKUP; 290 break; 291 case SSL_ERROR_WANT_CONNECT: 292 BIO_set_retry_special(b); 293 retry_reason=BIO_RR_CONNECT; 294 case SSL_ERROR_SYSCALL: 295 case SSL_ERROR_SSL: 296 default: 297 break; 298 } 299 300 b->retry_reason=retry_reason; 301 return(ret); 302 } 303 304 static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr) 305 { 306 SSL **sslp,*ssl; 307 BIO_SSL *bs; 308 BIO *dbio,*bio; 309 long ret=1; 310 311 bs=(BIO_SSL *)b->ptr; 312 ssl=bs->ssl; 313 if ((ssl == NULL) && (cmd != BIO_C_SET_SSL)) 314 return(0); 315 switch (cmd) 316 { 317 case BIO_CTRL_RESET: 318 SSL_shutdown(ssl); 319 320 if (ssl->handshake_func == ssl->method->ssl_connect) 321 SSL_set_connect_state(ssl); 322 else if (ssl->handshake_func == ssl->method->ssl_accept) 323 SSL_set_accept_state(ssl); 324 325 SSL_clear(ssl); 326 327 if (b->next_bio != NULL) 328 ret=BIO_ctrl(b->next_bio,cmd,num,ptr); 329 else if (ssl->rbio != NULL) 330 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr); 331 else 332 ret=1; 333 break; 334 case BIO_CTRL_INFO: 335 ret=0; 336 break; 337 case BIO_C_SSL_MODE: 338 if (num) /* client mode */ 339 SSL_set_connect_state(ssl); 340 else 341 SSL_set_accept_state(ssl); 342 break; 343 case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT: 344 ret=bs->renegotiate_timeout; 345 if (num < 60) num=5; 346 bs->renegotiate_timeout=(unsigned long)num; 347 bs->last_time=(unsigned long)time(NULL); 348 break; 349 case BIO_C_SET_SSL_RENEGOTIATE_BYTES: 350 ret=bs->renegotiate_count; 351 if ((long)num >=512) 352 bs->renegotiate_count=(unsigned long)num; 353 break; 354 case BIO_C_GET_SSL_NUM_RENEGOTIATES: 355 ret=bs->num_renegotiates; 356 break; 357 case BIO_C_SET_SSL: 358 if (ssl != NULL) 359 { 360 ssl_free(b); 361 if (!ssl_new(b)) 362 return 0; 363 } 364 b->shutdown=(int)num; 365 ssl=(SSL *)ptr; 366 ((BIO_SSL *)b->ptr)->ssl=ssl; 367 bio=SSL_get_rbio(ssl); 368 if (bio != NULL) 369 { 370 if (b->next_bio != NULL) 371 BIO_push(bio,b->next_bio); 372 b->next_bio=bio; 373 CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO); 374 } 375 b->init=1; 376 break; 377 case BIO_C_GET_SSL: 378 if (ptr != NULL) 379 { 380 sslp=(SSL **)ptr; 381 *sslp=ssl; 382 } 383 else 384 ret=0; 385 break; 386 case BIO_CTRL_GET_CLOSE: 387 ret=b->shutdown; 388 break; 389 case BIO_CTRL_SET_CLOSE: 390 b->shutdown=(int)num; 391 break; 392 case BIO_CTRL_WPENDING: 393 ret=BIO_ctrl(ssl->wbio,cmd,num,ptr); 394 break; 395 case BIO_CTRL_PENDING: 396 ret=SSL_pending(ssl); 397 if (ret == 0) 398 ret=BIO_pending(ssl->rbio); 399 break; 400 case BIO_CTRL_FLUSH: 401 BIO_clear_retry_flags(b); 402 ret=BIO_ctrl(ssl->wbio,cmd,num,ptr); 403 BIO_copy_next_retry(b); 404 break; 405 case BIO_CTRL_PUSH: 406 if ((b->next_bio != NULL) && (b->next_bio != ssl->rbio)) 407 { 408 SSL_set_bio(ssl,b->next_bio,b->next_bio); 409 CRYPTO_add(&b->next_bio->references,1,CRYPTO_LOCK_BIO); 410 } 411 break; 412 case BIO_CTRL_POP: 413 /* Only detach if we are the BIO explicitly being popped */ 414 if (b == ptr) 415 { 416 /* Shouldn't happen in practice because the 417 * rbio and wbio are the same when pushed. 418 */ 419 if (ssl->rbio != ssl->wbio) 420 BIO_free_all(ssl->wbio); 421 if (b->next_bio != NULL) 422 CRYPTO_add(&b->next_bio->references,-1,CRYPTO_LOCK_BIO); 423 ssl->wbio=NULL; 424 ssl->rbio=NULL; 425 } 426 break; 427 case BIO_C_DO_STATE_MACHINE: 428 BIO_clear_retry_flags(b); 429 430 b->retry_reason=0; 431 ret=(int)SSL_do_handshake(ssl); 432 433 switch (SSL_get_error(ssl,(int)ret)) 434 { 435 case SSL_ERROR_WANT_READ: 436 BIO_set_flags(b, 437 BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY); 438 break; 439 case SSL_ERROR_WANT_WRITE: 440 BIO_set_flags(b, 441 BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY); 442 break; 443 case SSL_ERROR_WANT_CONNECT: 444 BIO_set_flags(b, 445 BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY); 446 b->retry_reason=b->next_bio->retry_reason; 447 break; 448 default: 449 break; 450 } 451 break; 452 case BIO_CTRL_DUP: 453 dbio=(BIO *)ptr; 454 if (((BIO_SSL *)dbio->ptr)->ssl != NULL) 455 SSL_free(((BIO_SSL *)dbio->ptr)->ssl); 456 ((BIO_SSL *)dbio->ptr)->ssl=SSL_dup(ssl); 457 ((BIO_SSL *)dbio->ptr)->renegotiate_count= 458 ((BIO_SSL *)b->ptr)->renegotiate_count; 459 ((BIO_SSL *)dbio->ptr)->byte_count= 460 ((BIO_SSL *)b->ptr)->byte_count; 461 ((BIO_SSL *)dbio->ptr)->renegotiate_timeout= 462 ((BIO_SSL *)b->ptr)->renegotiate_timeout; 463 ((BIO_SSL *)dbio->ptr)->last_time= 464 ((BIO_SSL *)b->ptr)->last_time; 465 ret=(((BIO_SSL *)dbio->ptr)->ssl != NULL); 466 break; 467 case BIO_C_GET_FD: 468 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr); 469 break; 470 case BIO_CTRL_SET_CALLBACK: 471 { 472 #if 0 /* FIXME: Should this be used? -- Richard Levitte */ 473 SSLerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 474 ret = -1; 475 #else 476 ret=0; 477 #endif 478 } 479 break; 480 case BIO_CTRL_GET_CALLBACK: 481 { 482 void (**fptr)(const SSL *xssl,int type,int val); 483 484 fptr=(void (**)(const SSL *xssl,int type,int val))ptr; 485 *fptr=SSL_get_info_callback(ssl); 486 } 487 break; 488 default: 489 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr); 490 break; 491 } 492 return(ret); 493 } 494 495 static long ssl_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp) 496 { 497 SSL *ssl; 498 BIO_SSL *bs; 499 long ret=1; 500 501 bs=(BIO_SSL *)b->ptr; 502 ssl=bs->ssl; 503 switch (cmd) 504 { 505 case BIO_CTRL_SET_CALLBACK: 506 { 507 /* FIXME: setting this via a completely different prototype 508 seems like a crap idea */ 509 SSL_set_info_callback(ssl,(void (*)(const SSL *,int,int))fp); 510 } 511 break; 512 default: 513 ret=BIO_callback_ctrl(ssl->rbio,cmd,fp); 514 break; 515 } 516 return(ret); 517 } 518 519 static int ssl_puts(BIO *bp, const char *str) 520 { 521 int n,ret; 522 523 n=strlen(str); 524 ret=BIO_write(bp,str,n); 525 return(ret); 526 } 527 528 BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx) 529 { 530 #ifndef OPENSSL_NO_SOCK 531 BIO *ret=NULL,*buf=NULL,*ssl=NULL; 532 533 if ((buf=BIO_new(BIO_f_buffer())) == NULL) 534 return(NULL); 535 if ((ssl=BIO_new_ssl_connect(ctx)) == NULL) 536 goto err; 537 if ((ret=BIO_push(buf,ssl)) == NULL) 538 goto err; 539 return(ret); 540 err: 541 if (buf != NULL) BIO_free(buf); 542 if (ssl != NULL) BIO_free(ssl); 543 #endif 544 return(NULL); 545 } 546 547 BIO *BIO_new_ssl_connect(SSL_CTX *ctx) 548 { 549 #ifndef OPENSSL_NO_SOCK 550 BIO *ret=NULL,*con=NULL,*ssl=NULL; 551 552 if ((con=BIO_new(BIO_s_connect())) == NULL) 553 return(NULL); 554 if ((ssl=BIO_new_ssl(ctx,1)) == NULL) 555 goto err; 556 if ((ret=BIO_push(ssl,con)) == NULL) 557 goto err; 558 return(ret); 559 err: 560 if (con != NULL) BIO_free(con); 561 #endif 562 return(NULL); 563 } 564 565 BIO *BIO_new_ssl(SSL_CTX *ctx, int client) 566 { 567 BIO *ret; 568 SSL *ssl; 569 570 if ((ret=BIO_new(BIO_f_ssl())) == NULL) 571 return(NULL); 572 if ((ssl=SSL_new(ctx)) == NULL) 573 { 574 BIO_free(ret); 575 return(NULL); 576 } 577 if (client) 578 SSL_set_connect_state(ssl); 579 else 580 SSL_set_accept_state(ssl); 581 582 BIO_set_ssl(ret,ssl,BIO_CLOSE); 583 return(ret); 584 } 585 586 int BIO_ssl_copy_session_id(BIO *t, BIO *f) 587 { 588 t=BIO_find_type(t,BIO_TYPE_SSL); 589 f=BIO_find_type(f,BIO_TYPE_SSL); 590 if ((t == NULL) || (f == NULL)) 591 return(0); 592 if ( (((BIO_SSL *)t->ptr)->ssl == NULL) || 593 (((BIO_SSL *)f->ptr)->ssl == NULL)) 594 return(0); 595 SSL_copy_session_id(((BIO_SSL *)t->ptr)->ssl,((BIO_SSL *)f->ptr)->ssl); 596 return(1); 597 } 598 599 void BIO_ssl_shutdown(BIO *b) 600 { 601 SSL *s; 602 603 while (b != NULL) 604 { 605 if (b->method->type == BIO_TYPE_SSL) 606 { 607 s=((BIO_SSL *)b->ptr)->ssl; 608 SSL_shutdown(s); 609 break; 610 } 611 b=b->next_bio; 612 } 613 } 614
