Initial version.

1 files changed, 621 insertions, 0 deletions

diff --git a/src/nxt_cyassl.c b/src/nxt_cyassl.c
new file mode 100644
index 00000000..404b89fe
--- /dev/null
+++ b/src/nxt_cyassl.c
@@ -0,0 +1,621 @@
+
+/*
+ * Copyright (C) NGINX, Inc.
+ * Copyright (C) Igor Sysoev
+ */
+
+#include <nxt_main.h>
+#include <cyassl/ssl.h>
+#include <cyassl/error-ssl.h>
+
+
+typedef struct {
+    CYASSL         *session;
+
+    int            ssl_error;
+    uint8_t        times;      /* 2 bits */
+
+    nxt_buf_mem_t  buffer;
+} nxt_cyassl_conn_t;
+
+
+static nxt_int_t nxt_cyassl_server_init(nxt_ssltls_conf_t *conf);
+static void nxt_cyassl_conn_init(nxt_thread_t *thr, nxt_ssltls_conf_t *conf,
+    nxt_event_conn_t *c);
+static void nxt_cyassl_session_cleanup(void *data);
+static int nxt_cyassl_io_recv(CYASSL *ssl, char *buf, int size, void *data);
+static int nxt_cyassl_io_send(CYASSL *ssl, char *buf, int size, void *data);
+static void nxt_cyassl_conn_handshake(nxt_thread_t *thr, void *obj, void *data);
+static void nxt_cyassl_conn_io_read(nxt_thread_t *thr, void *obj, void *data);
+static void nxt_cyassl_conn_io_shutdown(nxt_thread_t *thr, void *obj,
+    void *data);
+static ssize_t nxt_cyassl_conn_io_write_chunk(nxt_thread_t *thr,
+    nxt_event_conn_t *c, nxt_buf_t *b, size_t limit);
+static ssize_t nxt_cyassl_conn_io_send(nxt_event_conn_t *c, void *buf,
+    size_t size);
+static nxt_int_t nxt_cyassl_conn_test_error(nxt_thread_t *thr,
+    nxt_event_conn_t *c, int err, nxt_work_handler_t handler);
+static void nxt_cdecl nxt_cyassl_conn_error(nxt_event_conn_t *c, nxt_err_t err,
+    const char *fmt, ...);
+static nxt_uint_t nxt_cyassl_log_error_level(nxt_event_conn_t *c, nxt_err_t err,
+    int ssl_error);
+static void nxt_cdecl nxt_cyassl_log_error(nxt_uint_t level, nxt_log_t *log,
+    int ret, const char *fmt, ...);
+static u_char *nxt_cyassl_copy_error(int err, u_char *p, u_char *end);
+
+
+const nxt_ssltls_lib_t  nxt_cyassl_lib = {
+    nxt_cyassl_server_init,
+    NULL,
+};
+
+
+static nxt_event_conn_io_t  nxt_cyassl_event_conn_io = {
+    NULL,
+    NULL,
+
+    nxt_cyassl_conn_io_read,
+    NULL,
+    NULL,
+
+    nxt_event_conn_io_write,
+    nxt_cyassl_conn_io_write_chunk,
+    NULL,
+    NULL,
+    nxt_cyassl_conn_io_send,
+
+    nxt_cyassl_conn_io_shutdown,
+};
+
+
+static nxt_int_t
+nxt_cyassl_start(void)
+{
+    int                err;
+    nxt_thread_t       *thr;
+    static nxt_bool_t  started;
+
+    if (nxt_fast_path(started)) {
+        return NXT_OK;
+    }
+
+    started = 1;
+
+    thr = nxt_thread();
+
+    /* TODO: CyaSSL_Cleanup() */
+
+    err = CyaSSL_Init();
+    if (err != SSL_SUCCESS) {
+        nxt_cyassl_log_error(NXT_LOG_CRIT, thr->log, err,
+                             "CyaSSL_Init() failed");
+        return NXT_ERROR;
+    }
+
+    nxt_thread_log_error(NXT_LOG_INFO, "CyaSSL version: %s",
+                         LIBCYASSL_VERSION_STRING);
+
+    /* CyaSSL_SetLoggingCb */
+    /* CyaSSL_SetAllocators */
+
+    return NXT_OK;
+}
+
+
+static nxt_int_t
+nxt_cyassl_server_init(nxt_ssltls_conf_t *conf)
+{
+    int           err;
+    char          *certificate, *key;
+    CYASSL_CTX    *ctx;
+    nxt_thread_t  *thr;
+
+    thr = nxt_thread();
+
+    if (nxt_slow_path(nxt_cyassl_start() != NXT_OK)) {
+        return NXT_ERROR;
+    }
+
+    ctx = CyaSSL_CTX_new(CyaSSLv23_server_method());
+    if (ctx == NULL) {
+        nxt_cyassl_log_error(NXT_LOG_CRIT, thr->log, 0,
+                             "CyaSSL_CTX_new() failed");
+        return NXT_ERROR;
+    }
+
+    conf->ctx = ctx;
+    conf->conn_init = nxt_cyassl_conn_init;
+
+    certificate = conf->certificate;
+
+    err = CyaSSL_CTX_use_certificate_file(ctx, certificate, SSL_FILETYPE_PEM);
+    if (err != SSL_SUCCESS) {
+        nxt_cyassl_log_error(NXT_LOG_CRIT, thr->log, err,
+                             "CyaSSL_CTX_use_certificate_file(\"%s\") failed",
+                             certificate);
+        goto fail;
+    }
+
+    key = conf->certificate_key;
+
+    err = CyaSSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM);
+    if (err != SSL_SUCCESS) {
+        nxt_cyassl_log_error(NXT_LOG_CRIT, thr->log, err,
+                             "CyaSSL_CTX_use_PrivateKey_file(\"%s\") failed",
+                             key);
+        goto fail;
+    }
+
+    if (conf->ciphers != NULL) {
+        err = CyaSSL_CTX_set_cipher_list(ctx, conf->ciphers);
+        if (err != SSL_SUCCESS) {
+            nxt_cyassl_log_error(NXT_LOG_CRIT, thr->log, err,
+                                 "CyaSSL_CTX_set_cipher_list(\"%s\") failed",
+                                 conf->ciphers);
+            goto fail;
+        }
+    }
+
+    /* TODO: ca_certificate */
+
+    CyaSSL_SetIORecv(ctx, nxt_cyassl_io_recv);
+    CyaSSL_SetIOSend(ctx, nxt_cyassl_io_send);
+
+    return NXT_OK;
+
+fail:
+
+    CyaSSL_CTX_free(ctx);
+
+    return NXT_ERROR;
+}
+
+
+static void
+nxt_cyassl_conn_init(nxt_thread_t *thr, nxt_ssltls_conf_t *conf,
+    nxt_event_conn_t *c)
+{
+    CYASSL                  *s;
+    CYASSL_CTX              *ctx;
+    nxt_cyassl_conn_t       *ssltls;
+    nxt_mem_pool_cleanup_t  *mpcl;
+
+    nxt_log_debug(c->socket.log, "cyassl conn init");
+
+    ssltls = nxt_mem_zalloc(c->mem_pool, sizeof(nxt_cyassl_conn_t));
+    if (ssltls == NULL) {
+        goto fail;
+    }
+
+    c->u.ssltls = ssltls;
+    nxt_buf_mem_set_size(&ssltls->buffer, conf->buffer_size);
+
+    mpcl = nxt_mem_pool_cleanup(c->mem_pool, 0);
+    if (mpcl == NULL) {
+        goto fail;
+    }
+
+    ctx = conf->ctx;
+
+    s = CyaSSL_new(ctx);
+    if (s == NULL) {
+        nxt_cyassl_log_error(NXT_LOG_CRIT, c->socket.log, 0,
+                             "CyaSSL_new() failed");
+        goto fail;
+    }
+
+    ssltls->session = s;
+    mpcl->handler = nxt_cyassl_session_cleanup;
+    mpcl->data = ssltls;
+
+    CyaSSL_SetIOReadCtx(s, c);
+    CyaSSL_SetIOWriteCtx(s, c);
+
+    c->io = &nxt_cyassl_event_conn_io;
+    c->sendfile = NXT_CONN_SENDFILE_OFF;
+
+    nxt_cyassl_conn_handshake(thr, c, c->socket.data);
+    return;
+
+fail:
+
+    nxt_event_conn_io_handle(thr, c->read_work_queue,
+                             c->read_state->error_handler, c, c->socket.data);
+}
+
+
+static void
+nxt_cyassl_session_cleanup(void *data)
+{
+    nxt_cyassl_conn_t  *ssltls;
+
+    ssltls = data;
+
+    nxt_thread_log_debug("cyassl session cleanup");
+
+    nxt_free(ssltls->buffer.start);
+
+    CyaSSL_free(ssltls->session);
+}
+
+
+static int
+nxt_cyassl_io_recv(CYASSL *ssl, char *buf, int size, void *data)
+{
+    ssize_t           n;
+    nxt_thread_t      *thr;
+    nxt_event_conn_t  *c;
+
+    c = data;
+    thr = nxt_thread();
+
+    n = thr->engine->event->io->recv(c, (u_char *) buf, size, 0);
+
+    if (n > 0) {
+        return n;
+    }
+
+    if (n == 0) {
+        return CYASSL_CBIO_ERR_CONN_CLOSE;
+    }
+
+    if (n == NXT_AGAIN) {
+        return CYASSL_CBIO_ERR_WANT_READ;
+    }
+
+    return CYASSL_CBIO_ERR_GENERAL;
+}
+
+
+static int
+nxt_cyassl_io_send(CYASSL *ssl, char *buf, int size, void *data)
+{
+    ssize_t           n;
+    nxt_thread_t      *thr;
+    nxt_event_conn_t  *c;
+
+    c = data;
+    thr = nxt_thread();
+
+    n = thr->engine->event->io->send(c, (u_char *) buf, size);
+
+    if (n > 0) {
+        return n;
+    }
+
+    if (n == NXT_AGAIN) {
+        return CYASSL_CBIO_ERR_WANT_WRITE;
+    }
+
+    return CYASSL_CBIO_ERR_GENERAL;
+}
+
+
+static void
+nxt_cyassl_conn_handshake(nxt_thread_t *thr, void *obj, void *data)
+{
+    int                ret;
+    nxt_int_t          n;
+    nxt_err_t          err;
+    nxt_event_conn_t   *c;
+    nxt_cyassl_conn_t  *ssltls;
+
+    c = obj;
+    ssltls = c->u.ssltls;
+
+    nxt_log_debug(thr->log, "cyassl conn handshake: %d", ssltls->times);
+
+    /* "ssltls->times == 1" is suitable to run CyaSSL_negotiate() in job. */
+
+    ret = CyaSSL_negotiate(ssltls->session);
+
+    err = (ret != 0) ? nxt_socket_errno : 0;
+
+    nxt_thread_time_debug_update(thr);
+
+    nxt_log_debug(thr->log, "CyaSSL_negotiate(%d): %d", c->socket.fd, ret);
+
+    if (ret == 0) {
+        nxt_cyassl_conn_io_read(thr, c, data);
+        return;
+    }
+
+    n = nxt_cyassl_conn_test_error(thr, c, ret, nxt_cyassl_conn_handshake);
+
+    if (n == NXT_ERROR) {
+        nxt_cyassl_conn_error(c, err, "CyaSSL_negotiate(%d) failed",
+                              c->socket.fd);
+
+        nxt_event_conn_io_handle(thr, c->read_work_queue,
+                                 c->read_state->error_handler, c, data);
+
+    } else if (ssltls->ssl_error == SSL_ERROR_WANT_READ && ssltls->times < 2) {
+        ssltls->times++;
+    }
+}
+
+
+static void
+nxt_cyassl_conn_io_read(nxt_thread_t *thr, void *obj, void *data)
+{
+    int                 ret;
+    nxt_buf_t           *b;
+    nxt_err_t           err;
+    nxt_int_t           n;
+    nxt_event_conn_t    *c;
+    nxt_cyassl_conn_t   *ssltls;
+    nxt_work_handler_t  handler;
+
+    c = obj;
+
+    nxt_log_debug(thr->log, "cyassl conn read");
+
+    handler = c->read_state->ready_handler;
+    b = c->read;
+
+    /* b == NULL is used to test descriptor readiness. */
+
+    if (b != NULL) {
+        ssltls = c->u.ssltls;
+
+        ret = CyaSSL_read(ssltls->session, b->mem.free,
+                          b->mem.end - b->mem.free);
+
+        err = (ret <= 0) ? nxt_socket_errno : 0;
+
+        nxt_log_debug(thr->log, "CyaSSL_read(%d, %p, %uz): %d",
+                      c->socket.fd, b->mem.free, b->mem.end - b->mem.free, ret);
+
+        if (ret > 0) {
+            /* c->socket.read_ready is kept. */
+            b->mem.free += ret;
+            handler = c->read_state->ready_handler;
+
+        } else {
+            n = nxt_cyassl_conn_test_error(thr, c, ret,
+                                           nxt_cyassl_conn_io_read);
+
+            if (nxt_fast_path(n != NXT_ERROR)) {
+                return;
+            }
+
+            nxt_cyassl_conn_error(c, err, "CyaSSL_read(%d, %p, %uz) failed",
+                                  c->socket.fd, b->mem.free,
+                                  b->mem.end - b->mem.free);
+
+            handler = c->read_state->error_handler;
+        }
+    }
+
+    nxt_event_conn_io_handle(thr, c->read_work_queue, handler, c, data);
+}
+
+
+static ssize_t
+nxt_cyassl_conn_io_write_chunk(nxt_thread_t *thr, nxt_event_conn_t *c,
+    nxt_buf_t *b, size_t limit)
+{
+    nxt_cyassl_conn_t  *ssltls;
+
+    nxt_log_debug(thr->log, "cyassl conn write chunk");
+
+    ssltls = c->u.ssltls;
+
+    return nxt_sendbuf_copy_coalesce(c, &ssltls->buffer, b, limit);
+}
+
+
+static ssize_t
+nxt_cyassl_conn_io_send(nxt_event_conn_t *c, void *buf, size_t size)
+{
+    int                ret;
+    nxt_err_t          err;
+    nxt_int_t          n;
+    nxt_cyassl_conn_t  *ssltls;
+
+    nxt_log_debug(c->socket.log, "cyassl send");
+
+    ssltls = c->u.ssltls;
+
+    ret = CyaSSL_write(ssltls->session, buf, size);
+
+    if (ret <= 0) {
+        err = nxt_socket_errno;
+        c->socket.error = err;
+
+    } else {
+        err = 0;
+    }
+
+    nxt_log_debug(c->socket.log, "CyaSSL_write(%d, %p, %uz): %d",
+                  c->socket.fd, buf, size, ret);
+
+    if (ret > 0) {
+        return ret;
+    }
+
+    n = nxt_cyassl_conn_test_error(nxt_thread(), c, ret,
+                                   nxt_event_conn_io_write);
+
+    if (nxt_slow_path(n == NXT_ERROR)) {
+        nxt_cyassl_conn_error(c, err, "CyaSSL_write(%d, %p, %uz) failed",
+                              c->socket.fd, buf, size);
+    }
+
+    return n;
+}
+
+
+static void
+nxt_cyassl_conn_io_shutdown(nxt_thread_t *thr, void *obj, void *data)
+{
+    int                ret;
+    nxt_event_conn_t   *c;
+    nxt_cyassl_conn_t  *ssltls;
+
+    c = obj;
+
+    nxt_log_debug(thr->log, "cyassl conn shutdown");
+
+    ssltls = c->u.ssltls;
+
+    ret = CyaSSL_shutdown(ssltls->session);
+
+    nxt_log_debug(thr->log, "CyaSSL_shutdown(%d): %d", c->socket.fd, ret);
+
+    if (nxt_slow_path(ret != SSL_SUCCESS)) {
+        nxt_cyassl_conn_error(c, 0, "CyaSSL_shutdown(%d) failed", c->socket.fd);
+    }
+
+    nxt_event_conn_io_handle(thr, c->write_work_queue,
+                             c->write_state->close_handler, c, data);
+}
+
+
+static nxt_int_t
+nxt_cyassl_conn_test_error(nxt_thread_t *thr, nxt_event_conn_t *c, int ret,
+    nxt_work_handler_t handler)
+{
+    nxt_work_queue_t   *wq;
+    nxt_cyassl_conn_t  *ssltls;
+
+    ssltls = c->u.ssltls;
+    ssltls->ssl_error = CyaSSL_get_error(ssltls->session, ret);
+
+    nxt_log_debug(thr->log, "CyaSSL_get_error(): %d", ssltls->ssl_error);
+
+    switch (ssltls->ssl_error) {
+
+    case SSL_ERROR_WANT_READ:
+        nxt_event_fd_block_write(thr->engine, &c->socket);
+
+        c->socket.read_ready = 0;
+        c->socket.read_handler = handler;
+
+        if (nxt_event_fd_is_disabled(c->socket.read)) {
+            nxt_event_fd_enable_read(thr->engine, &c->socket);
+        }
+
+        return NXT_AGAIN;
+
+    case SSL_ERROR_WANT_WRITE:
+        nxt_event_fd_block_read(thr->engine, &c->socket);
+
+        c->socket.write_ready = 0;
+        c->socket.write_handler = handler;
+
+        if (nxt_event_fd_is_disabled(c->socket.write)) {
+            nxt_event_fd_enable_write(thr->engine, &c->socket);
+        }
+
+        return NXT_AGAIN;
+
+    case SSL_ERROR_ZERO_RETURN:
+        /* A "close notify" alert */
+
+        if (c->read_state != NULL) {
+            wq = c->read_work_queue;
+            handler = c->read_state->close_handler;
+
+        } else {
+            wq = c->write_work_queue;
+            handler = c->write_state->close_handler;
+        }
+
+        nxt_event_conn_io_handle(thr, wq, handler, c, c->socket.data);
+
+        return 0;
+
+    default:
+        return NXT_ERROR;
+    }
+}
+
+
+static void nxt_cdecl
+nxt_cyassl_conn_error(nxt_event_conn_t *c, nxt_err_t err, const char *fmt, ...)
+{
+    u_char             *p, *end;
+    va_list            args;
+    nxt_uint_t         level;
+    nxt_cyassl_conn_t  *ssltls;
+    u_char             msg[NXT_MAX_ERROR_STR];
+
+    ssltls = c->u.ssltls;
+
+    level = nxt_cyassl_log_error_level(c, err, ssltls->ssl_error);
+
+    if (nxt_log_level_enough(c->socket.log, level)) {
+
+        end = msg + sizeof(msg);
+
+        va_start(args, fmt);
+        p = nxt_vsprintf(msg, end, fmt, args);
+        va_end(args);
+
+        if (err != 0) {
+            p = nxt_sprintf(p, end, " %E", err);
+        }
+
+        p = nxt_cyassl_copy_error(ssltls->ssl_error, p, end);
+
+        nxt_log_error(level, c->socket.log, "%*s", p - msg, msg);
+    }
+}
+
+
+static nxt_uint_t
+nxt_cyassl_log_error_level(nxt_event_conn_t *c, nxt_err_t err, int ssl_error)
+{
+    switch (ssl_error) {
+
+    case SOCKET_ERROR_E:            /* -208 */
+    case MATCH_SUITE_ERROR:         /* -261 */
+        break;
+
+    default:
+        return NXT_LOG_CRIT;
+    }
+
+    return NXT_LOG_INFO;
+}
+
+
+static void nxt_cdecl
+nxt_cyassl_log_error(nxt_uint_t level, nxt_log_t *log, int err,
+    const char *fmt, ...)
+{
+    u_char   *p, *end;
+    va_list  args;
+    u_char   msg[NXT_MAX_ERROR_STR];
+
+    if (nxt_log_level_enough(log, level)) {
+
+        end = msg + sizeof(msg);
+
+        va_start(args, fmt);
+        p = nxt_vsprintf(msg, end, fmt, args);
+        va_end(args);
+
+        p = nxt_cyassl_copy_error(err, p, end);
+
+        nxt_log_error(level, log, "%*s", p - msg, msg);
+    }
+}
+
+
+static u_char *
+nxt_cyassl_copy_error(int err, u_char *p, u_char *end)
+{
+    p = nxt_sprintf(p, end, " (SSL:%d ", err);
+
+    CyaSSL_ERR_error_string_n(err, (char *) p, end - p);
+
+    p += nxt_strlen(p);
+
+    if (p < end) {
+        *p++ = ')';
+    }
+
+    return p;
+}