Initial version.

1 files changed, 742 insertions, 0 deletions

diff --git a/src/nxt_gnutls.c b/src/nxt_gnutls.c
new file mode 100644
index 00000000..15db7fc8
--- /dev/null
+++ b/src/nxt_gnutls.c
@@ -0,0 +1,742 @@
+
+/*
+ * Copyright (C) Igor Sysoev
+ * Copyright (C) NGINX, Inc.
+ */
+
+#include <nxt_main.h>
+#include <gnutls/gnutls.h>
+
+
+typedef struct {
+    gnutls_session_t                  session;
+
+    uint8_t                           times;        /* 2 bits */
+    uint8_t                           no_shutdown;  /* 1 bit */
+
+    nxt_buf_mem_t                     buffer;
+} nxt_gnutls_conn_t;
+
+
+typedef struct {
+    gnutls_priority_t                 ciphers;
+    gnutls_certificate_credentials_t  certificate;
+} nxt_gnutls_ctx_t;
+
+
+
+#if (NXT_HAVE_GNUTLS_SET_TIME)
+time_t nxt_gnutls_time(time_t *tp);
+#endif
+static nxt_int_t nxt_gnutls_server_init(nxt_ssltls_conf_t *conf);
+static nxt_int_t nxt_gnutls_set_ciphers(nxt_ssltls_conf_t *conf);
+
+static void nxt_gnutls_conn_init(nxt_thread_t *thr, nxt_ssltls_conf_t *conf,
+    nxt_event_conn_t *c);
+static void nxt_gnutls_session_cleanup(void *data);
+static ssize_t nxt_gnutls_pull(gnutls_transport_ptr_t data, void *buf,
+    size_t size);
+static ssize_t nxt_gnutls_push(gnutls_transport_ptr_t data, const void *buf,
+    size_t size);
+#if (NXT_HAVE_GNUTLS_VEC_PUSH)
+static ssize_t nxt_gnutls_vec_push(gnutls_transport_ptr_t data,
+    const giovec_t *iov, int iovcnt);
+#endif
+static void nxt_gnutls_conn_handshake(nxt_thread_t *thr, void *obj, void *data);
+static void nxt_gnutls_conn_io_read(nxt_thread_t *thr, void *obj, void *data);
+static ssize_t nxt_gnutls_conn_io_write_chunk(nxt_thread_t *thr,
+    nxt_event_conn_t *c, nxt_buf_t *b, size_t limit);
+static ssize_t nxt_gnutls_conn_io_send(nxt_event_conn_t *c, void *buf,
+    size_t size);
+static void nxt_gnutls_conn_io_shutdown(nxt_thread_t *thr, void *obj,
+    void *data);
+static nxt_int_t nxt_gnutls_conn_test_error(nxt_thread_t *thr,
+    nxt_event_conn_t *c, ssize_t err, nxt_work_handler_t handler);
+static void nxt_cdecl nxt_gnutls_conn_log_error(nxt_event_conn_t *c,
+    ssize_t err, const char *fmt, ...);
+static nxt_uint_t nxt_gnutls_log_error_level(nxt_event_conn_t *c, ssize_t err);
+static void nxt_cdecl nxt_gnutls_log_error(nxt_uint_t level, nxt_log_t *log,
+    int err, const char *fmt, ...);
+
+
+const nxt_ssltls_lib_t  nxt_gnutls_lib = {
+    nxt_gnutls_server_init,
+    NULL,
+};
+
+
+static nxt_event_conn_io_t  nxt_gnutls_event_conn_io = {
+    NULL,
+    NULL,
+
+    nxt_gnutls_conn_io_read,
+    NULL,
+    NULL,
+
+    nxt_event_conn_io_write,
+    nxt_gnutls_conn_io_write_chunk,
+    NULL,
+    NULL,
+    nxt_gnutls_conn_io_send,
+
+    nxt_gnutls_conn_io_shutdown,
+};
+
+
+static nxt_int_t
+nxt_gnutls_start(void)
+{
+    int                ret;
+    static nxt_bool_t  started;
+
+    if (nxt_fast_path(started)) {
+        return NXT_OK;
+    }
+
+    started = 1;
+
+    /* TODO: gnutls_global_deinit */
+
+    ret = gnutls_global_init();
+    if (ret != GNUTLS_E_SUCCESS) {
+        nxt_gnutls_log_error(NXT_LOG_CRIT, nxt_thread_log(), ret,
+                             "gnutls_global_init() failed");
+        return NXT_ERROR;
+    }
+
+    nxt_thread_log_error(NXT_LOG_INFO, "GnuTLS version: %s",
+                         gnutls_check_version(NULL));
+
+#if (NXT_HAVE_GNUTLS_SET_TIME)
+    gnutls_global_set_time_function(nxt_gnutls_time);
+#endif
+
+    return NXT_OK;
+}
+
+
+#if (NXT_HAVE_GNUTLS_SET_TIME)
+
+/* GnuTLS 2.12.0 */
+
+time_t
+nxt_gnutls_time(time_t *tp)
+{
+    time_t        t;
+    nxt_thread_t  *thr;
+
+    thr = nxt_thread();
+    nxt_log_debug(thr->log, "gnutls time");
+
+    t = (time_t) nxt_thread_time(thr);
+
+    if (tp != NULL) {
+        *tp = t;
+    }
+
+    return t;
+}
+
+#endif
+
+
+static nxt_int_t
+nxt_gnutls_server_init(nxt_ssltls_conf_t *conf)
+{
+    int                ret;
+    char               *certificate, *key, *ca_certificate;
+    nxt_thread_t       *thr;
+    nxt_gnutls_ctx_t   *ctx;
+
+    if (nxt_slow_path(nxt_gnutls_start() != NXT_OK)) {
+        return NXT_ERROR;
+    }
+
+    /* TODO: mem_pool, cleanup: gnutls_certificate_free_credentials,
+             gnutls_priority_deinit */
+
+    ctx = nxt_zalloc(sizeof(nxt_gnutls_ctx_t));
+    if (ctx == NULL) {
+        return NXT_ERROR;
+    }
+
+    conf->ctx = ctx;
+    conf->conn_init = nxt_gnutls_conn_init;
+
+    thr = nxt_thread();
+
+    ret = gnutls_certificate_allocate_credentials(&ctx->certificate);
+    if (ret != GNUTLS_E_SUCCESS) {
+        nxt_gnutls_log_error(NXT_LOG_CRIT, thr->log, ret,
+                "gnutls_certificate_allocate_credentials() failed");
+        return NXT_ERROR;
+    }
+
+    certificate = conf->certificate;
+    key = conf->certificate_key;
+
+    ret = gnutls_certificate_set_x509_key_file(ctx->certificate, certificate,
+                                               key, GNUTLS_X509_FMT_PEM);
+    if (ret != GNUTLS_E_SUCCESS) {
+        nxt_gnutls_log_error(NXT_LOG_CRIT, thr->log, ret,
+                "gnutls_certificate_set_x509_key_file(\"%s\", \"%s\") failed",
+                certificate, key);
+        goto certificate_fail;
+    }
+
+    if (nxt_gnutls_set_ciphers(conf) != NXT_OK) {
+        goto ciphers_fail;
+    }
+
+    if (conf->ca_certificate != NULL) {
+        ca_certificate = conf->ca_certificate;
+
+        ret = gnutls_certificate_set_x509_trust_file(ctx->certificate,
+                                                     ca_certificate,
+                                                     GNUTLS_X509_FMT_PEM);
+        if (ret < 0) {
+            nxt_gnutls_log_error(NXT_LOG_CRIT, thr->log, ret,
+                "gnutls_certificate_set_x509_trust_file(\"%s\") failed",
+                ca_certificate);
+            goto ca_certificate_fail;
+        }
+    }
+
+    return NXT_OK;
+
+ca_certificate_fail:
+
+    gnutls_priority_deinit(ctx->ciphers);
+
+ciphers_fail:
+
+certificate_fail:
+
+    gnutls_certificate_free_credentials(ctx->certificate);
+
+    return NXT_ERROR;
+}
+
+
+static nxt_int_t
+nxt_gnutls_set_ciphers(nxt_ssltls_conf_t *conf)
+{
+    int                ret;
+    const char         *ciphers;
+    const char         *err;
+    nxt_gnutls_ctx_t   *ctx;
+
+    ciphers = (conf->ciphers != NULL) ? conf->ciphers : "NORMAL:!COMP-DEFLATE";
+    ctx = conf->ctx;
+
+    ret = gnutls_priority_init(&ctx->ciphers, ciphers, &err);
+
+    switch (ret) {
+
+    case GNUTLS_E_SUCCESS:
+        return NXT_OK;
+
+    case GNUTLS_E_INVALID_REQUEST:
+        nxt_gnutls_log_error(NXT_LOG_CRIT, nxt_thread_log(), ret,
+                             "gnutls_priority_init(\"%s\") failed at \"%s\"",
+                             ciphers, err);
+        return NXT_ERROR;
+
+    default:
+        nxt_gnutls_log_error(NXT_LOG_CRIT, nxt_thread_log(), ret,
+                             "gnutls_priority_init() failed");
+        return NXT_ERROR;
+    }
+}
+
+
+static void
+nxt_gnutls_conn_init(nxt_thread_t *thr, nxt_ssltls_conf_t *conf,
+    nxt_event_conn_t *c)
+{
+    int                     ret;
+    gnutls_session_t        sess;
+    nxt_gnutls_ctx_t        *ctx;
+    nxt_gnutls_conn_t       *ssltls;
+    nxt_mem_pool_cleanup_t  *mpcl;
+
+    nxt_log_debug(c->socket.log, "gnutls conn init");
+
+    ssltls = nxt_mem_zalloc(c->mem_pool, sizeof(nxt_gnutls_conn_t));
+    if (ssltls == NULL) {
+        goto fail;
+    }
+
+    c->u.ssltls = ssltls;
+    nxt_buf_mem_set_size(&ssltls->buffer, conf->buffer_size);
+
+    mpcl = nxt_mem_pool_cleanup(c->mem_pool, 0);
+    if (mpcl == NULL) {
+        goto fail;
+    }
+
+    ret = gnutls_init(&ssltls->session, GNUTLS_SERVER);
+    if (ret != GNUTLS_E_SUCCESS) {
+        nxt_gnutls_log_error(NXT_LOG_CRIT, c->socket.log, ret,
+                             "gnutls_init() failed");
+        goto fail;
+    }
+
+    sess = ssltls->session;
+    mpcl->handler = nxt_gnutls_session_cleanup;
+    mpcl->data = ssltls;
+
+    ctx = conf->ctx;
+
+    ret = gnutls_priority_set(sess, ctx->ciphers);
+    if (ret != GNUTLS_E_SUCCESS) {
+        nxt_gnutls_log_error(NXT_LOG_CRIT, c->socket.log, ret,
+                             "gnutls_priority_set() failed");
+        goto fail;
+    }
+
+    /*
+     * Disable TLS random padding of records in CBC ciphers,
+     * which may be up to 255 bytes.
+     */
+    gnutls_record_disable_padding(sess);
+
+    ret = gnutls_credentials_set(sess, GNUTLS_CRD_CERTIFICATE,
+                                 ctx->certificate);
+    if (ret != GNUTLS_E_SUCCESS) {
+        nxt_gnutls_log_error(NXT_LOG_CRIT, c->socket.log, ret,
+                             "gnutls_credentials_set() failed");
+        goto fail;
+    }
+
+    if (conf->ca_certificate != NULL) {
+        gnutls_certificate_server_set_request(sess, GNUTLS_CERT_REQUEST);
+    }
+
+    gnutls_transport_set_ptr(sess, (gnutls_transport_ptr_t) c);
+    gnutls_transport_set_pull_function(sess, nxt_gnutls_pull);
+    gnutls_transport_set_push_function(sess, nxt_gnutls_push);
+#if (NXT_HAVE_GNUTLS_VEC_PUSH)
+    gnutls_transport_set_vec_push_function(sess, nxt_gnutls_vec_push);
+#endif
+
+    c->io = &nxt_gnutls_event_conn_io;
+    c->sendfile = NXT_CONN_SENDFILE_OFF;
+
+    nxt_gnutls_conn_handshake(thr, c, c->socket.data);
+    return;
+
+fail:
+
+    nxt_event_conn_io_handle(thr, c->read_work_queue,
+                             c->read_state->error_handler, c, c->socket.data);
+}
+
+
+static void
+nxt_gnutls_session_cleanup(void *data)
+{
+    nxt_gnutls_conn_t  *ssltls;
+
+    ssltls = data;
+
+    nxt_thread_log_debug("gnutls session cleanup");
+
+    nxt_free(ssltls->buffer.start);
+
+    gnutls_deinit(ssltls->session);
+}
+
+
+static ssize_t
+nxt_gnutls_pull(gnutls_transport_ptr_t data, void *buf, size_t size)
+{
+    ssize_t           n;
+    nxt_thread_t      *thr;
+    nxt_event_conn_t  *c;
+
+    c = data;
+    thr = nxt_thread();
+
+    n = thr->engine->event->io->recv(c, buf, size, 0);
+
+    if (n == NXT_AGAIN) {
+        nxt_set_errno(NXT_EAGAIN);
+        return -1;
+    }
+
+    return n;
+}
+
+
+static ssize_t
+nxt_gnutls_push(gnutls_transport_ptr_t data, const void *buf, size_t size)
+{
+    ssize_t           n;
+    nxt_thread_t      *thr;
+    nxt_event_conn_t  *c;
+
+    c = data;
+    thr = nxt_thread();
+
+    n = thr->engine->event->io->send(c, (u_char *) buf, size);
+
+    if (n == NXT_AGAIN) {
+        nxt_set_errno(NXT_EAGAIN);
+        return -1;
+    }
+
+    return n;
+}
+
+
+#if (NXT_HAVE_GNUTLS_VEC_PUSH)
+
+/* GnuTLS 2.12.0 */
+
+static ssize_t
+nxt_gnutls_vec_push(gnutls_transport_ptr_t data, const giovec_t *iov,
+    int iovcnt)
+{
+    ssize_t           n;
+    nxt_thread_t      *thr;
+    nxt_event_conn_t  *c;
+
+    c = data;
+    thr = nxt_thread();
+
+    /*
+     * This code assumes that giovec_t is the same as "struct iovec"
+     * and nxt_iobuf_t.  It is not true for Windows.
+     */
+    n = thr->engine->event->io->writev(c, (nxt_iobuf_t *) iov, iovcnt);
+
+    if (n == NXT_AGAIN) {
+        nxt_set_errno(NXT_EAGAIN);
+        return -1;
+    }
+
+    return n;
+}
+
+#endif
+
+
+static void
+nxt_gnutls_conn_handshake(nxt_thread_t *thr, void *obj, void *data)
+{
+    int                err;
+    nxt_int_t          ret;
+    nxt_event_conn_t   *c;
+    nxt_gnutls_conn_t  *ssltls;
+
+    c = obj;
+    ssltls = c->u.ssltls;
+
+    nxt_log_debug(thr->log, "gnutls conn handshake: %d", ssltls->times);
+
+    /* "ssltls->times == 1" is suitable to run gnutls_handshake() in job. */
+
+    err = gnutls_handshake(ssltls->session);
+
+    nxt_thread_time_debug_update(thr);
+
+    nxt_log_debug(thr->log, "gnutls_handshake(): %d", err);
+
+    if (err == GNUTLS_E_SUCCESS) {
+        nxt_gnutls_conn_io_read(thr, c, data);
+        return;
+    }
+
+    ret = nxt_gnutls_conn_test_error(thr, c, err, nxt_gnutls_conn_handshake);
+
+    if (ret == NXT_ERROR) {
+        nxt_gnutls_conn_log_error(c, err, "gnutls_handshake() failed");
+
+        nxt_event_conn_io_handle(thr, c->read_work_queue,
+                                 c->read_state->error_handler, c, data);
+
+    } else if (err == GNUTLS_E_AGAIN
+               && ssltls->times < 2
+               && gnutls_record_get_direction(ssltls->session) == 0)
+    {
+        ssltls->times++;
+    }
+}
+
+
+static void
+nxt_gnutls_conn_io_read(nxt_thread_t *thr, void *obj, void *data)
+{
+    ssize_t             n;
+    nxt_buf_t           *b;
+    nxt_int_t           ret;
+    nxt_event_conn_t    *c;
+    nxt_gnutls_conn_t   *ssltls;
+    nxt_work_handler_t  handler;
+
+    c = obj;
+
+    nxt_log_debug(thr->log, "gnutls conn read");
+
+    handler = c->read_state->ready_handler;
+    b = c->read;
+
+    /* b == NULL is used to test descriptor readiness. */
+
+    if (b != NULL) {
+        ssltls = c->u.ssltls;
+
+        n = gnutls_record_recv(ssltls->session, b->mem.free,
+                               b->mem.end - b->mem.free);
+
+        nxt_log_debug(thr->log, "gnutls_record_recv(%d, %p, %uz): %z",
+                      c->socket.fd, b->mem.free, b->mem.end - b->mem.free, n);
+
+        if (n > 0) {
+            /* c->socket.read_ready is kept. */
+            b->mem.free += n;
+            handler = c->read_state->ready_handler;
+
+        } else if (n == 0) {
+            handler = c->read_state->close_handler;
+
+        } else {
+            ret = nxt_gnutls_conn_test_error(thr, c, n,
+                                             nxt_gnutls_conn_io_read);
+
+            if (nxt_fast_path(ret != NXT_ERROR)) {
+                return;
+            }
+
+            nxt_gnutls_conn_log_error(c, n,
+                                      "gnutls_record_recv(%d, %p, %uz): failed",
+                                      c->socket.fd, b->mem.free,
+                                      b->mem.end - b->mem.free);
+
+            handler = c->read_state->error_handler;
+        }
+    }
+
+    nxt_event_conn_io_handle(thr, c->read_work_queue, handler, c, data);
+}
+
+
+static ssize_t
+nxt_gnutls_conn_io_write_chunk(nxt_thread_t *thr, nxt_event_conn_t *c,
+    nxt_buf_t *b, size_t limit)
+{
+    nxt_gnutls_conn_t  *ssltls;
+
+    nxt_log_debug(thr->log, "gnutls conn write chunk");
+
+    ssltls = c->u.ssltls;
+
+    return nxt_sendbuf_copy_coalesce(c, &ssltls->buffer, b, limit);
+}
+
+
+static ssize_t
+nxt_gnutls_conn_io_send(nxt_event_conn_t *c, void *buf, size_t size)
+{
+    ssize_t            n;
+    nxt_int_t          ret;
+    nxt_gnutls_conn_t  *ssltls;
+
+    ssltls = c->u.ssltls;
+
+    n = gnutls_record_send(ssltls->session, buf, size);
+
+    nxt_log_debug(c->socket.log, "gnutls_record_send(%d, %p, %uz): %z",
+                  c->socket.fd, buf, size, n);
+
+    if (n > 0) {
+        return n;
+    }
+
+    ret = nxt_gnutls_conn_test_error(nxt_thread(), c, n,
+                                     nxt_event_conn_io_write);
+
+    if (nxt_slow_path(ret == NXT_ERROR)) {
+        nxt_gnutls_conn_log_error(c, n,
+                                  "gnutls_record_send(%d, %p, %uz): failed",
+                                  c->socket.fd, buf, size);
+    }
+
+    return ret;
+}
+
+
+static void
+nxt_gnutls_conn_io_shutdown(nxt_thread_t *thr, void *obj, void *data)
+{
+    int                     err;
+    nxt_int_t               ret;
+    nxt_event_conn_t        *c;
+    nxt_gnutls_conn_t       *ssltls;
+    nxt_work_handler_t      handler;
+    gnutls_close_request_t  how;
+
+    c = obj;
+    ssltls = c->u.ssltls;
+
+    if (ssltls->session == NULL || ssltls->no_shutdown) {
+        handler = c->write_state->close_handler;
+        goto done;
+    }
+
+    nxt_log_debug(c->socket.log, "gnutls conn shutdown");
+
+    if (c->socket.timedout || c->socket.error != 0) {
+        how = GNUTLS_SHUT_WR;
+
+    } else if (c->socket.closed) {
+        how = GNUTLS_SHUT_RDWR;
+
+    } else {
+        how = GNUTLS_SHUT_RDWR;
+    }
+
+    err = gnutls_bye(ssltls->session, how);
+
+    nxt_log_debug(c->socket.log, "gnutls_bye(%d, %d): %d",
+                  c->socket.fd, how, err);
+
+    if (err == GNUTLS_E_SUCCESS) {
+        handler = c->write_state->close_handler;
+
+    } else {
+        ret = nxt_gnutls_conn_test_error(thr, c, err,
+                                         nxt_gnutls_conn_io_shutdown);
+
+        if (ret != NXT_ERROR) {  /* ret == NXT_AGAIN */
+            c->socket.error_handler = c->read_state->error_handler;
+            nxt_event_timer_add(thr->engine, &c->read_timer, 5000);
+            return;
+        }
+
+        nxt_gnutls_conn_log_error(c, err, "gnutls_bye(%d) failed",
+                                  c->socket.fd);
+
+        handler = c->write_state->error_handler;
+    }
+
+done:
+
+    nxt_event_conn_io_handle(thr, c->write_work_queue, handler, c, data);
+}
+
+
+static nxt_int_t
+nxt_gnutls_conn_test_error(nxt_thread_t *thr, nxt_event_conn_t *c, ssize_t err,
+    nxt_work_handler_t handler)
+{
+    int                ret;
+    nxt_gnutls_conn_t  *ssltls;
+
+    switch (err) {
+
+    case GNUTLS_E_REHANDSHAKE:
+    case GNUTLS_E_AGAIN:
+        ssltls = c->u.ssltls;
+        ret = gnutls_record_get_direction(ssltls->session);
+
+        nxt_log_debug(thr->log, "gnutls_record_get_direction(): %d", ret);
+
+        if (ret == 0) {
+            /* A read direction. */
+
+            nxt_event_fd_block_write(thr->engine, &c->socket);
+
+            c->socket.read_ready = 0;
+            c->socket.read_handler = handler;
+
+            if (nxt_event_fd_is_disabled(c->socket.read)) {
+                nxt_event_fd_enable_read(thr->engine, &c->socket);
+            }
+
+        } else {
+            /* A write direction. */
+
+            nxt_event_fd_block_read(thr->engine, &c->socket);
+
+            c->socket.write_ready = 0;
+            c->socket.write_handler = handler;
+
+            if (nxt_event_fd_is_disabled(c->socket.write)) {
+                nxt_event_fd_enable_write(thr->engine, &c->socket);
+            }
+        }
+
+        return NXT_AGAIN;
+
+    default:
+        c->socket.error = 1000;  /* Nonexistent errno code. */
+        return NXT_ERROR;
+    }
+}
+
+
+static void
+nxt_gnutls_conn_log_error(nxt_event_conn_t *c, ssize_t err,
+    const char *fmt, ...)
+{
+    va_list      args;
+    nxt_uint_t   level;
+    u_char       *p, msg[NXT_MAX_ERROR_STR];
+
+    level = nxt_gnutls_log_error_level(c, err);
+
+    if (nxt_log_level_enough(c->socket.log, level)) {
+
+        va_start(args, fmt);
+        p = nxt_vsprintf(msg, msg + sizeof(msg), fmt, args);
+        va_end(args);
+
+        nxt_log_error(level, c->socket.log, "%*s (%d: %s)",
+                      p - msg, msg, err, gnutls_strerror(err));
+    }
+}
+
+
+static nxt_uint_t
+nxt_gnutls_log_error_level(nxt_event_conn_t *c, ssize_t err)
+{
+    nxt_gnutls_conn_t  *ssltls;
+
+    switch (err) {
+
+    case GNUTLS_E_UNKNOWN_CIPHER_SUITE:                      /*  -21 */
+
+         /* Disable gnutls_bye(), because it returns GNUTLS_E_INTERNAL_ERROR. */
+        ssltls = c->u.ssltls;
+        ssltls->no_shutdown = 1;
+
+         /* Fall through. */
+
+    case GNUTLS_E_UNEXPECTED_PACKET_LENGTH:                  /*   -9 */
+        c->socket.error = 1000;  /* Nonexistent errno code. */
+        break;
+
+    default:
+        return NXT_LOG_CRIT;
+    }
+
+    return NXT_LOG_INFO;
+}
+
+
+static void
+nxt_gnutls_log_error(nxt_uint_t level, nxt_log_t *log, int err,
+    const char *fmt, ...)
+{
+    va_list  args;
+    u_char   *p, msg[NXT_MAX_ERROR_STR];
+
+    va_start(args, fmt);
+    p = nxt_vsprintf(msg, msg + sizeof(msg), fmt, args);
+    va_end(args);
+
+    nxt_log_error(level, log, "%*s (%d: %s)",
+                  p - msg, msg, err, gnutls_strerror(err));
+}