src/event/ngx_event_openssl.c

   1
   2 /*
   3  * Copyright (C) Igor Sysoev
   4  */
   5
   6
   7 #include <ngx_config.h>
   8 #include <ngx_core.h>
   9 #include <ngx_event.h>
  10
  11 #include <openssl/engine.h>
  12
  13
  14 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
  15 static void ngx_ssl_write_handler(ngx_event_t *wev);
  16 static ssize_t ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size);
  17 static void ngx_ssl_read_handler(ngx_event_t *rev);
  18
  19
  20 ngx_int_t
  21 ngx_ssl_init(ngx_log_t *log)
  22 {
  23     ENGINE  *engine;
  24
  25     SSL_library_init();
  26     SSL_load_error_strings();
  27     ENGINE_load_builtin_engines();
  28
  29     return NGX_OK;
  30 }
  31
  32
  33 ngx_int_t
  34 ngx_ssl_create_session(ngx_ssl_ctx_t *ssl_ctx, ngx_connection_t *c,
  35     ngx_uint_t flags)
  36 {
  37     ngx_ssl_t  *ssl;
  38
  39     if (!(ssl = ngx_pcalloc(c->pool, sizeof(ngx_ssl_t)))) {
  40         return NGX_ERROR;
  41     }
  42
  43     if (!(ssl->buf = ngx_create_temp_buf(c->pool, NGX_SSL_BUFSIZE))) {
  44         return NGX_ERROR;
  45     }
  46
  47     if (flags & NGX_SSL_BUFFER) {
  48         ssl->buffer = 1;
  49     }
  50
  51     ssl->ssl = SSL_new(ssl_ctx);
  52
  53     if (ssl->ssl == NULL) {
  54         ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
  55         return NGX_ERROR;
  56     }
  57
  58     if (SSL_set_fd(ssl->ssl, c->fd) == 0) {
  59         ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
  60         return NGX_ERROR;
  61     }
  62
  63     SSL_set_accept_state(ssl->ssl);
  64
  65     c->ssl = ssl;
  66
  67     return NGX_OK;
  68 }
  69
  70
  71 ssize_t
  72 ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size)
  73 {
  74     int  n, bytes;
  75
  76     if (c->ssl->last == NGX_ERROR) {
  77         return NGX_ERROR;
  78     }
  79
  80     bytes = 0;
  81
  82     /*
  83      * SSL_read() may return data in parts, so try to read
  84      * until SSL_read() would return no data
  85      */
  86
  87     for ( ;; ) {
  88
  89         n = SSL_read(c->ssl->ssl, buf, size);
  90
  91         ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
  92
  93         if (n > 0) {
  94
  95             bytes += n;
  96
  97 #if (NGX_DEBUG)
  98
  99             if (!c->ssl->handshaked && SSL_is_init_finished(c->ssl->ssl)) {
 100                 char         buf[129], *s, *d;
 101                 SSL_CIPHER  *cipher;
 102
 103                 c->ssl->handshaked = 1;
 104
 105                 cipher = SSL_get_current_cipher(c->ssl->ssl);
 106
 107                 if (cipher) {
 108                     SSL_CIPHER_description(cipher, &buf[1], 128);
 109
 110                     for (s = &buf[1], d = buf; *s; s++) {
 111                         if (*s == ' ' && *d == ' ') {
 112                             continue;
 113                         }
 114
 115                         if (*s == '\n' || *s == '\r') {
 116                             continue;
 117                         }
 118
 119                         *++d = *s;
 120                     }
 121
 122                     if (*d != ' ') {
 123                         d++;
 124                     }
 125
 126                     *d = '\0';
 127
 128                     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
 129                                    "SSL cipher: \"%s\"", &buf[1]);
 130                 } else {
 131                     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
 132                                    "SSL no shared ciphers");
 133                 }
 134             }
 135 #endif
 136
 137         }
 138
 139         c->ssl->last = ngx_ssl_handle_recv(c, n);
 140
 141         if (c->ssl->last != NGX_OK) {
 142
 143             if (bytes) {
 144                 return bytes;
 145
 146             } else {
 147                 return c->ssl->last;
 148             }
 149         }
 150
 151         size -= n;
 152
 153         if (size == 0) {
 154             return bytes;
 155         }
 156
 157         buf += n;
 158     }
 159 }
 160
 161
 162 static ngx_int_t
 163 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
 164 {
 165     int         sslerr;
 166     ngx_err_t   err;
 167     char       *handshake;
 168
 169     if (n > 0) {
 170
 171         if (c->ssl->saved_write_handler) {
 172
 173             c->write->event_handler = c->ssl->saved_write_handler;
 174             c->ssl->saved_write_handler = NULL;
 175             c->write->ready = 1;
 176
 177             if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
 178                 return NGX_ERROR;
 179             }
 180
 181             if (ngx_mutex_lock(ngx_posted_events_mutex) == NGX_ERROR) {
 182                 return NGX_ERROR;
 183             }
 184
 185             ngx_post_event(c->write);
 186
 187             ngx_mutex_unlock(ngx_posted_events_mutex);
 188         }
 189
 190         return NGX_OK;
 191     }
 192
 193     if (!SSL_is_init_finished(c->ssl->ssl)) {
 194         handshake = " in SSL handshake";
 195
 196     } else {
 197         handshake = "";
 198     }
 199
 200     sslerr = SSL_get_error(c->ssl->ssl, n);
 201
 202     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
 203
 204     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
 205
 206     if (sslerr == SSL_ERROR_WANT_READ) {
 207         c->read->ready = 0;
 208         return NGX_AGAIN;
 209     }
 210
 211     if (sslerr == SSL_ERROR_WANT_WRITE) {
 212         ngx_log_error(NGX_LOG_ALERT, c->log, err,
 213                       "SSL wants to write%s", handshake);
 214
 215         c->write->ready = 0;
 216
 217         if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
 218             return NGX_ERROR;
 219         }
 220
 221         /*
 222          * we do not set the timer because there is already the read event timer
 223          */
 224
 225         if (c->ssl->saved_write_handler == NULL) {
 226             c->ssl->saved_write_handler = c->write->event_handler;
 227             c->write->event_handler = ngx_ssl_write_handler;
 228         }
 229
 230         return NGX_AGAIN;
 231     }
 232
 233     c->ssl->no_rcv_shut = 1;
 234     c->ssl->no_send_shut = 1;
 235
 236     if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
 237         ngx_log_error(NGX_LOG_INFO, c->log, err,
 238                       "client closed connection%s", handshake);
 239
 240         return NGX_ERROR;
 241     }
 242
 243     ngx_ssl_error(NGX_LOG_ALERT, c->log, err,
 244                   "SSL_read() failed%s", handshake);
 245
 246     return NGX_ERROR;
 247 }
 248
 249
 250 static void
 251 ngx_ssl_write_handler(ngx_event_t *wev)
 252 {
 253     ngx_connection_t  *c;
 254
 255     c = wev->data;
 256     c->read->event_handler(c->read);
 257 }
 258
 259
 260 /*
 261  * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
 262  * before the SSL_write() call to decrease a SSL overhead.
 263  *
 264  * Besides for protocols such as HTTP it is possible to always buffer
 265  * the output to decrease a SSL overhead some more.
 266  */
 267
 268 ngx_chain_t *
 269 ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
 270 {
 271     int          n;
 272     ngx_uint_t   flush;
 273     ssize_t      send, size;
 274     ngx_buf_t   *buf;
 275
 276     buf = c->ssl->buf;
 277
 278     if (in && in->next == NULL && !c->buffered && !c->ssl->buffer) {
 279
 280         /*
 281          * we avoid a buffer copy if the incoming buf is a single,
 282          * our buffer is empty, and we do not need to buffer the output
 283          */
 284
 285         n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
 286
 287         if (n == NGX_ERROR) {
 288             return NGX_CHAIN_ERROR;
 289         }
 290
 291         if (n < 0) {
 292             n = 0;
 293         }
 294
 295         in->buf->pos += n;
 296
 297         return in;
 298     }
 299
 300
 301     /* the maximum limit size is the maximum uint32_t value - the page size */
 302
 303     if (limit == 0 || limit > NGX_MAX_UINT32_VALUE - ngx_pagesize) {
 304         limit = NGX_MAX_UINT32_VALUE - ngx_pagesize;
 305     }
 306
 307
 308     send = 0;
 309     flush = (in == NULL) ? 1 : 0;
 310
 311     for ( ;; ) {
 312
 313         while (in && buf->last < buf->end) {
 314             if (in->buf->last_buf) {
 315                 flush = 1;
 316             }
 317
 318             if (ngx_buf_special(in->buf)) {
 319                 in = in->next;
 320                 continue;
 321             }
 322
 323             size = in->buf->last - in->buf->pos;
 324
 325             if (size > buf->end - buf->last) {
 326                 size = buf->end - buf->last;
 327             }
 328
 329             /*
 330              * TODO: the taking in->buf->flush into account can be
 331              *       implemented using the limit on the higher level
 332              */
 333
 334             if (send + size > limit) {
 335                 size = limit - send;
 336                 flush = 1;
 337             }
 338
 339             ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
 340                            "SSL buf copy: %d", size);
 341
 342             ngx_memcpy(buf->last, in->buf->pos, size);
 343
 344             buf->last += size;
 345
 346             in->buf->pos += size;
 347             if (in->buf->pos == in->buf->last) {
 348                 in = in->next;
 349             }
 350         }
 351
 352         size = buf->last - buf->pos;
 353
 354         if (!flush && buf->last < buf->end && c->ssl->buffer) {
 355             break;
 356         }
 357
 358         n = ngx_ssl_write(c, buf->pos, size);
 359
 360         if (n == NGX_ERROR) {
 361             return NGX_CHAIN_ERROR;
 362         }
 363
 364         if (n < 0) {
 365             n = 0;
 366         }
 367
 368         buf->pos += n;
 369         send += n;
 370         c->sent += n;
 371
 372         if (n < size) {
 373             break;
 374         }
 375
 376         if (buf->pos == buf->last) {
 377             buf->pos = buf->start;
 378             buf->last = buf->start;
 379         }
 380
 381         if (in == NULL || send == limit) {
 382             break;
 383         }
 384     }
 385
 386     c->buffered = (buf->pos < buf->last) ? 1 : 0;
 387
 388     return in;
 389 }
 390
 391
 392 static ssize_t
 393 ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
 394 {
 395     int         n, sslerr;
 396     ngx_err_t   err;
 397     char       *handshake;
 398
 399     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %d", size);
 400
 401     n = SSL_write(c->ssl->ssl, data, size);
 402
 403     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
 404
 405     if (n > 0) {
 406         if (c->ssl->saved_read_handler) {
 407
 408             c->read->event_handler = c->ssl->saved_read_handler;
 409             c->ssl->saved_read_handler = NULL;
 410             c->read->ready = 1;
 411
 412             if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
 413                 return NGX_ERROR;
 414             }
 415
 416             if (ngx_mutex_lock(ngx_posted_events_mutex) == NGX_ERROR) {
 417                 return NGX_ERROR;
 418             }
 419
 420             ngx_post_event(c->read);
 421
 422             ngx_mutex_unlock(ngx_posted_events_mutex);
 423         }
 424
 425         return n;
 426     }
 427
 428     sslerr = SSL_get_error(c->ssl->ssl, n);
 429
 430     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
 431
 432     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
 433
 434     if (sslerr == SSL_ERROR_WANT_WRITE) {
 435         c->write->ready = 0;
 436         return NGX_AGAIN;
 437     }
 438
 439     if (sslerr == SSL_ERROR_WANT_READ) {
 440
 441         if (!SSL_is_init_finished(c->ssl->ssl)) {
 442             handshake = " in SSL handshake";
 443
 444         } else {
 445             handshake = "";
 446         }
 447
 448         ngx_log_error(NGX_LOG_ALERT, c->log, err,
 449                       "SSL wants to read%s", handshake);
 450
 451         c->read->ready = 0;
 452
 453         if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
 454             return NGX_ERROR;
 455         }
 456
 457         /*
 458          * we do not set the timer because there is already
 459          * the write event timer
 460          */
 461
 462         if (c->ssl->saved_read_handler == NULL) {
 463             c->ssl->saved_read_handler = c->read->event_handler;
 464             c->read->event_handler = ngx_ssl_read_handler;
 465         }
 466
 467         return NGX_AGAIN;
 468     }
 469
 470     c->ssl->no_rcv_shut = 1;
 471     c->ssl->no_send_shut = 1;
 472
 473     ngx_ssl_error(NGX_LOG_ALERT, c->log, err, "SSL_write() failed");
 474
 475     return NGX_ERROR;
 476 }
 477
 478
 479 static void
 480 ngx_ssl_read_handler(ngx_event_t *rev)
 481 {
 482     ngx_connection_t  *c;
 483
 484     c = rev->data;
 485     c->write->event_handler(c->write);
 486 }
 487
 488
 489 ngx_int_t
 490 ngx_ssl_shutdown(ngx_connection_t *c)
 491 {
 492     int         n, sslerr, mode;
 493     ngx_uint_t  again;
 494
 495     if (!c->ssl->shutdown_set) {
 496
 497         /* it seems that SSL_set_shutdown() could be called once only */
 498
 499         if (c->read->timedout) {
 500             mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
 501
 502         } else {
 503             mode = 0;
 504
 505             if (c->ssl->no_rcv_shut) {
 506                 mode = SSL_RECEIVED_SHUTDOWN;
 507             }
 508
 509             if (c->ssl->no_send_shut) {
 510                 mode |= SSL_SENT_SHUTDOWN;
 511             }
 512         }
 513
 514         if (mode) {
 515             SSL_set_shutdown(c->ssl->ssl, mode);
 516             c->ssl->shutdown_set = 1;
 517         }
 518     }
 519
 520     again = 0;
 521 #if (NGX_SUPPRESS_WARN)
 522     sslerr = 0;
 523 #endif
 524
 525     for ( ;; ) {
 526         n = SSL_shutdown(c->ssl->ssl);
 527
 528         ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
 529
 530         if (n == 1 || (n == 0 && c->read->timedout)) {
 531             SSL_free(c->ssl->ssl);
 532             c->ssl = NULL;
 533             return NGX_OK;
 534         }
 535
 536         if (n == 0) {
 537             again = 1;
 538             break;
 539         }
 540
 541         break;
 542     }
 543
 544     if (!again) {
 545         sslerr = SSL_get_error(c->ssl->ssl, n);
 546
 547         ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
 548                        "SSL_get_error: %d", sslerr);
 549     }
 550
 551     if (again || sslerr == SSL_ERROR_WANT_READ) {
 552
 553         ngx_add_timer(c->read, 30000);
 554
 555         if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
 556             return NGX_ERROR;
 557         }
 558
 559         return NGX_AGAIN;
 560     }
 561
 562     if (sslerr == SSL_ERROR_WANT_WRITE) {
 563
 564         if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
 565             return NGX_ERROR;
 566         }
 567
 568         return NGX_AGAIN;
 569     }
 570
 571     ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_shutdown() failed");
 572
 573     return NGX_ERROR;
 574 }
 575
 576
 577 void
 578 ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...)
 579 {
 580     u_char   errstr[NGX_MAX_CONF_ERRSTR], *p, *last;
 581     va_list  args;
 582
 583     last = errstr + NGX_MAX_CONF_ERRSTR;
 584
 585     va_start(args, fmt);
 586     p = ngx_vsnprintf(errstr, sizeof(errstr) - 1, fmt, args);
 587     va_end(args);
 588
 589     p = ngx_cpystrn(p, " (SSL: ", last - p);
 590
 591     ERR_error_string_n(ERR_get_error(), (char *) p, last - p);
 592
 593     ngx_log_error(level, log, err, "%s)", errstr);
 594 }