1 /* $NetBSD: tlsstream.c,v 1.7 2026/09/17 18:01:17 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 #include <errno.h> 17 #include <libgen.h> 18 #include <unistd.h> 19 20 #include <openssl/err.h> 21 #include <openssl/ssl.h> 22 23 #include <isc/async.h> 24 #include <isc/atomic.h> 25 #include <isc/buffer.h> 26 #include <isc/condition.h> 27 #include <isc/log.h> 28 #include <isc/magic.h> 29 #include <isc/mem.h> 30 #include <isc/netmgr.h> 31 #include <isc/once.h> 32 #include <isc/quota.h> 33 #include <isc/random.h> 34 #include <isc/refcount.h> 35 #include <isc/region.h> 36 #include <isc/result.h> 37 #include <isc/sockaddr.h> 38 #include <isc/stdtime.h> 39 #include <isc/thread.h> 40 #include <isc/util.h> 41 #include <isc/uv.h> 42 43 #include "../openssl_shim.h" 44 #include "netmgr-int.h" 45 46 #define TLS_BUF_SIZE (UINT16_MAX) 47 48 #define TLS_MAX_SEND_BUF_SIZE (UINT16_MAX + UINT16_MAX / 2) 49 50 #define MAX_DNS_MESSAGE_SIZE (UINT16_MAX) 51 52 #ifdef ISC_NETMGR_TRACE 53 ISC_ATTR_UNUSED static const char * 54 tls_status2str(int tls_status) { 55 switch (tls_status) { 56 case SSL_ERROR_NONE: 57 return "SSL_ERROR_NONE"; 58 case SSL_ERROR_ZERO_RETURN: 59 return "SSL_ERROR_ZERO_RETURN"; 60 case SSL_ERROR_WANT_WRITE: 61 return "SSL_ERROR_WANT_WRITE"; 62 case SSL_ERROR_WANT_READ: 63 return "SSL_ERROR_WANT_READ"; 64 case SSL_ERROR_SSL: 65 return "SSL_ERROR_SSL"; 66 default: 67 UNREACHABLE(); 68 } 69 } 70 71 ISC_ATTR_UNUSED static const char * 72 state2str(int state) { 73 switch (state) { 74 case TLS_INIT: 75 return "TLS_INIT"; 76 case TLS_HANDSHAKE: 77 return "TLS_HANDSHAKE"; 78 case TLS_IO: 79 return "TLS_IO"; 80 case TLS_CLOSED: 81 return "TLS_CLOSED"; 82 default: 83 UNREACHABLE(); 84 } 85 } 86 #endif /* ISC_NETMGR_TRACE */ 87 88 static isc_result_t 89 tls_error_to_result(const int tls_err, const int tls_state, isc_tls_t *tls) { 90 switch (tls_err) { 91 case SSL_ERROR_ZERO_RETURN: 92 return ISC_R_EOF; 93 case SSL_ERROR_SSL: 94 if (tls != NULL && tls_state < TLS_IO && 95 SSL_get_verify_result(tls) != X509_V_OK) 96 { 97 return ISC_R_TLSBADPEERCERT; 98 } 99 return ISC_R_TLSERROR; 100 default: 101 return ISC_R_UNEXPECTED; 102 } 103 } 104 105 static void 106 tls_read_start(isc_nmsocket_t *restrict sock); 107 108 static void 109 tls_read_stop(isc_nmsocket_t *sock); 110 111 static void 112 tls_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result); 113 114 static void 115 tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data, 116 isc__nm_uvreq_t *send_data, bool finish); 117 118 static void 119 tls_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region, 120 void *cbarg); 121 122 static void 123 async_tls_do_bio(isc_nmsocket_t *sock); 124 125 static void 126 tls_init_listener_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *ctx); 127 128 static void 129 tls_cleanup_listener_tlsctx(isc_nmsocket_t *listener); 130 131 static isc_tlsctx_t * 132 tls_get_listener_tlsctx(isc_nmsocket_t *listener, const int tid); 133 134 static void 135 tls_keep_client_tls_session(isc_nmsocket_t *sock); 136 137 static void 138 tls_try_shutdown(isc_tls_t *tls, const bool quite); 139 140 static void 141 tls_try_to_enable_tcp_nodelay(isc_nmsocket_t *tlssock); 142 143 /* 144 * The socket is closing, outerhandle has been detached, listener is 145 * inactive, or the netmgr is closing: any operation on it should abort 146 * with ISC_R_CANCELED. 147 */ 148 static bool 149 inactive(isc_nmsocket_t *sock) { 150 return !isc__nmsocket_active(sock) || sock->closing || 151 sock->outerhandle == NULL || 152 !isc__nmsocket_active(sock->outerhandle->sock) || 153 sock->outerhandle->sock->closing || 154 isc__nm_closing(sock->worker); 155 } 156 157 static void 158 tls_call_connect_cb(isc_nmsocket_t *sock, isc_nmhandle_t *handle, 159 const isc_result_t result) { 160 INSIST(sock->connect_cb != NULL); 161 sock->connect_cb(handle, result, sock->connect_cbarg); 162 if (result != ISC_R_SUCCESS) { 163 isc__nmsocket_clearcb(handle->sock); 164 } 165 } 166 167 static void 168 tls_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) { 169 isc_nmsocket_tls_send_req_t *send_req = 170 (isc_nmsocket_tls_send_req_t *)cbarg; 171 isc_nmsocket_t *tlssock = NULL; 172 bool finish = send_req->finish; 173 isc_nm_cb_t send_cb = NULL; 174 void *send_cbarg = NULL; 175 isc_nmhandle_t *send_handle = NULL; 176 177 REQUIRE(VALID_NMHANDLE(handle)); 178 REQUIRE(VALID_NMSOCK(handle->sock)); 179 REQUIRE(VALID_NMSOCK(send_req->tlssock)); 180 181 tlssock = send_req->tlssock; 182 send_req->tlssock = NULL; 183 send_cb = send_req->cb; 184 send_req->cb = NULL; 185 send_cbarg = send_req->cbarg; 186 send_req->cbarg = NULL; 187 send_handle = send_req->handle; 188 send_req->handle = NULL; 189 190 if (finish) { 191 tls_try_shutdown(tlssock->tlsstream.tls, true); 192 } 193 194 /* Try to keep the object to be reused later - to avoid an allocation */ 195 if (tlssock->tlsstream.send_req == NULL) { 196 tlssock->tlsstream.send_req = send_req; 197 /* 198 * We need to ensure that the buffer is not going to grow too 199 * large uncontrollably. We try to keep its size to be no more 200 * than TLS_MAX_SEND_BUF_SIZE. The constant should be larger 201 * than 64 KB for this to work efficiently when combined with 202 * DNS transports. 203 */ 204 if (isc_buffer_length(&send_req->data) > TLS_MAX_SEND_BUF_SIZE) 205 { 206 /* free the underlying buffer */ 207 isc_buffer_clearmctx(&send_req->data); 208 isc_buffer_invalidate(&send_req->data); 209 isc_buffer_init(&send_req->data, send_req->smallbuf, 210 sizeof(send_req->smallbuf)); 211 isc_buffer_setmctx(&send_req->data, 212 handle->sock->worker->mctx); 213 } else { 214 isc_buffer_clear(&send_req->data); 215 } 216 } else { 217 isc_buffer_clearmctx(&send_req->data); 218 isc_buffer_invalidate(&send_req->data); 219 isc_mem_put(handle->sock->worker->mctx, send_req, 220 sizeof(*send_req)); 221 } 222 tlssock->tlsstream.nsending--; 223 224 if (send_cb != NULL) { 225 INSIST(VALID_NMHANDLE(tlssock->statichandle)); 226 send_cb(send_handle, eresult, send_cbarg); 227 isc_nmhandle_detach(&send_handle); 228 /* The last handle has been just detached: close the underlying 229 * socket. */ 230 if (tlssock->statichandle == NULL) { 231 finish = true; 232 } 233 } 234 235 if (finish) { 236 /* 237 * If wrapping up, call tls_failed_read() - it will care of 238 * socket de-initialisation and calling the read callback, if 239 * necessary. 240 */ 241 tls_failed_read_cb(tlssock, ISC_R_EOF); 242 } else if (eresult == ISC_R_SUCCESS) { 243 tls_do_bio(tlssock, NULL, NULL, false); 244 } else if (eresult != ISC_R_SUCCESS && 245 tlssock->tlsstream.state <= TLS_HANDSHAKE && 246 !tlssock->tlsstream.server) 247 { 248 /* 249 * We are still waiting for the handshake to complete, but 250 * it isn't going to happen. Call the connect callback, 251 * passing the error code there. 252 * 253 * (Note: tls_failed_read_cb() calls the connect 254 * rather than the read callback in this case. 255 * XXX: clarify?) 256 */ 257 tls_failed_read_cb(tlssock, eresult); 258 } 259 260 isc__nmsocket_detach(&tlssock); 261 } 262 263 static void 264 tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) { 265 REQUIRE(VALID_NMSOCK(sock)); 266 REQUIRE(result != ISC_R_SUCCESS); 267 268 /* This is TLS counterpart of isc__nm_failed_connect_cb() */ 269 if (!sock->tlsstream.server && 270 (sock->tlsstream.state == TLS_INIT || 271 sock->tlsstream.state == TLS_HANDSHAKE) && 272 sock->connect_cb != NULL) 273 { 274 isc_nmhandle_t *handle = NULL; 275 INSIST(sock->statichandle == NULL); 276 handle = isc__nmhandle_get(sock, &sock->peer, &sock->iface); 277 tls_call_connect_cb(sock, handle, result); 278 isc__nmsocket_clearcb(sock); 279 isc_nmhandle_detach(&handle); 280 goto destroy; 281 } 282 283 isc__nmsocket_timer_stop(sock); 284 285 /* Nobody is reading from the socket yet */ 286 if (sock->statichandle == NULL) { 287 goto destroy; 288 } 289 290 /* This is TLS counterpart of isc__nmsocket_readtimeout_cb() */ 291 if (sock->client && result == ISC_R_TIMEDOUT) { 292 INSIST(sock->statichandle != NULL); 293 294 if (sock->recv_cb != NULL) { 295 isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL); 296 isc__nm_readcb(sock, req, ISC_R_TIMEDOUT, false); 297 } 298 299 if (isc__nmsocket_timer_running(sock)) { 300 /* Timer was restarted, bail-out */ 301 return; 302 } 303 304 isc__nmsocket_clearcb(sock); 305 306 goto destroy; 307 } 308 309 /* 310 * We don't need to check for .nsending, as the callbacks will be 311 * cleared at the time the tls_senddone() tries to call it for the 312 * second time. 313 */ 314 315 if (sock->recv_cb != NULL) { 316 isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL); 317 isc__nmsocket_clearcb(sock); 318 isc__nm_readcb(sock, req, result, false); 319 } 320 321 destroy: 322 isc__nmsocket_prep_destroy(sock); 323 } 324 325 void 326 isc__nm_tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result, 327 bool async ISC_ATTR_UNUSED) { 328 if (!inactive(sock) && sock->tlsstream.state == TLS_IO) { 329 tls_do_bio(sock, NULL, NULL, true); 330 return; 331 } 332 333 tls_failed_read_cb(sock, result); 334 } 335 336 static void 337 tls_do_bio_cb(void *arg) { 338 isc_nmsocket_t *sock = arg; 339 340 REQUIRE(VALID_NMSOCK(sock)); 341 342 tls_do_bio(sock, NULL, NULL, false); 343 344 isc__nmsocket_detach(&sock); 345 } 346 347 static void 348 async_tls_do_bio(isc_nmsocket_t *sock) { 349 isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL }); 350 isc_async_run(sock->worker->loop, tls_do_bio_cb, sock); 351 } 352 353 static int 354 tls_send_outgoing(isc_nmsocket_t *sock, bool finish, isc_nmhandle_t *tlshandle, 355 isc_nm_cb_t cb, void *cbarg) { 356 isc_nmsocket_tls_send_req_t *send_req = NULL; 357 int pending; 358 int rv; 359 size_t len = 0; 360 bool new_send_req = false; 361 isc_region_t used_region = { 0 }; 362 bool shutting_down = isc__nm_closing(sock->worker); 363 364 if (shutting_down || inactive(sock)) { 365 if (cb != NULL) { 366 isc_result_t result = shutting_down ? ISC_R_SHUTTINGDOWN 367 : ISC_R_CANCELED; 368 INSIST(VALID_NMHANDLE(tlshandle)); 369 cb(tlshandle, result, cbarg); 370 } 371 return 0; 372 } 373 374 if (finish) { 375 tls_try_shutdown(sock->tlsstream.tls, false); 376 tls_keep_client_tls_session(sock); 377 } 378 379 pending = BIO_pending(sock->tlsstream.bio_out); 380 if (pending <= 0) { 381 return pending; 382 } 383 384 /* Try to reuse previously allocated object */ 385 if (sock->tlsstream.send_req != NULL) { 386 send_req = sock->tlsstream.send_req; 387 send_req->finish = finish; 388 sock->tlsstream.send_req = NULL; 389 } else { 390 send_req = isc_mem_get(sock->worker->mctx, sizeof(*send_req)); 391 *send_req = (isc_nmsocket_tls_send_req_t){ .finish = finish }; 392 new_send_req = true; 393 } 394 395 if (new_send_req) { 396 isc_buffer_init(&send_req->data, &send_req->smallbuf, 397 sizeof(send_req->smallbuf)); 398 isc_buffer_setmctx(&send_req->data, sock->worker->mctx); 399 } 400 INSIST(isc_buffer_remaininglength(&send_req->data) == 0); 401 402 isc__nmsocket_attach(sock, &send_req->tlssock); 403 if (cb != NULL) { 404 send_req->cb = cb; 405 send_req->cbarg = cbarg; 406 isc_nmhandle_attach(tlshandle, &send_req->handle); 407 } 408 409 RUNTIME_CHECK(isc_buffer_reserve(&send_req->data, pending) == 410 ISC_R_SUCCESS); 411 isc_buffer_add(&send_req->data, pending); 412 rv = BIO_read_ex(sock->tlsstream.bio_out, 413 isc_buffer_base(&send_req->data), pending, &len); 414 /* There's something pending, read must succeed */ 415 RUNTIME_CHECK(rv == 1 && len == (size_t)pending); 416 417 INSIST(VALID_NMHANDLE(sock->outerhandle)); 418 419 sock->tlsstream.nsending++; 420 isc_buffer_remainingregion(&send_req->data, &used_region); 421 isc_nm_send(sock->outerhandle, &used_region, tls_senddone, send_req); 422 423 return pending; 424 } 425 426 static int 427 tls_process_outgoing(isc_nmsocket_t *sock, bool finish, 428 isc__nm_uvreq_t *send_data) { 429 int pending; 430 431 bool received_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) & 432 SSL_RECEIVED_SHUTDOWN) != 0); 433 bool sent_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) & 434 SSL_SENT_SHUTDOWN) != 0); 435 436 if (received_shutdown && !sent_shutdown) { 437 finish = true; 438 } 439 440 /* Data from TLS to network */ 441 if (send_data != NULL) { 442 pending = tls_send_outgoing(sock, finish, send_data->handle, 443 send_data->cb.send, 444 send_data->cbarg); 445 } else { 446 pending = tls_send_outgoing(sock, finish, NULL, NULL, NULL); 447 } 448 449 return pending; 450 } 451 452 static int 453 tls_try_handshake(isc_nmsocket_t *sock, isc_result_t *presult) { 454 REQUIRE(sock->tlsstream.state == TLS_HANDSHAKE); 455 456 if (SSL_is_init_finished(sock->tlsstream.tls) == 1) { 457 return 0; 458 } 459 460 int rv = SSL_do_handshake(sock->tlsstream.tls); 461 if (rv == 1) { 462 isc_nmhandle_t *tlshandle = NULL; 463 isc_result_t result = ISC_R_SUCCESS; 464 465 REQUIRE(sock->statichandle == NULL); 466 INSIST(SSL_is_init_finished(sock->tlsstream.tls) == 1); 467 468 isc__nmsocket_log_tls_session_reuse(sock, sock->tlsstream.tls); 469 tlshandle = isc__nmhandle_get(sock, &sock->peer, &sock->iface); 470 isc__nmsocket_timer_stop(sock); 471 tls_read_stop(sock); 472 473 if (isc__nm_closing(sock->worker)) { 474 result = ISC_R_SHUTTINGDOWN; 475 } 476 477 if (sock->tlsstream.server) { 478 /* 479 * The listening sockets are now closed from outer 480 * to inner order, which means that this function 481 * will never be called when the outer socket has 482 * stopped listening. 483 * 484 * Also see 'isc__nmsocket_stop()' - the function used 485 * to shut down the listening TLS socket - for more 486 * details. 487 */ 488 if (result == ISC_R_SUCCESS) { 489 result = sock->accept_cb(tlshandle, result, 490 sock->accept_cbarg); 491 } 492 } else { 493 tls_call_connect_cb(sock, tlshandle, result); 494 } 495 isc_nmhandle_detach(&tlshandle); 496 sock->tlsstream.state = TLS_IO; 497 498 if (presult != NULL) { 499 *presult = result; 500 } 501 } 502 503 return rv; 504 } 505 506 static bool 507 tls_try_to_close_unused_socket(isc_nmsocket_t *sock) { 508 if (sock->tlsstream.state > TLS_HANDSHAKE && 509 sock->statichandle == NULL && sock->tlsstream.nsending == 0) 510 { 511 /* 512 * It seems that no action on the socket has been 513 * scheduled on some point after the handshake, let's 514 * close the connection. 515 */ 516 isc__nmsocket_prep_destroy(sock); 517 return true; 518 } 519 520 return false; 521 } 522 523 static void 524 tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data, 525 isc__nm_uvreq_t *send_data, bool finish) { 526 isc_result_t result = ISC_R_SUCCESS; 527 int pending, tls_status = SSL_ERROR_NONE; 528 int rv = 0; 529 size_t len = 0; 530 int saved_errno = 0; 531 532 REQUIRE(VALID_NMSOCK(sock)); 533 REQUIRE(sock->tid == isc_tid()); 534 535 /* 536 * Clear the TLS error queue so that SSL_get_error() and SSL I/O 537 * routine calls will not get affected by prior error statuses. 538 * 539 * See here: 540 * https://www.openssl.org/docs/man3.0/man3/SSL_get_error.html 541 * 542 * In particular, it mentions the following: 543 * 544 * The current thread's error queue must be empty before the 545 * TLS/SSL I/O operation is attempted, or SSL_get_error() will not 546 * work reliably. 547 * 548 * As we use the result of SSL_get_error() to decide on I/O 549 * operations, we need to ensure that it works reliably by 550 * cleaning the error queue. 551 * 552 * The sum of details: https://stackoverflow.com/a/37980911 553 */ 554 ERR_clear_error(); 555 556 if (sock->tlsstream.state == TLS_INIT) { 557 INSIST(received_data == NULL && send_data == NULL); 558 if (sock->tlsstream.server) { 559 SSL_set_accept_state(sock->tlsstream.tls); 560 } else { 561 SSL_set_connect_state(sock->tlsstream.tls); 562 } 563 sock->tlsstream.state = TLS_HANDSHAKE; 564 rv = tls_try_handshake(sock, NULL); 565 INSIST(SSL_is_init_finished(sock->tlsstream.tls) == 0); 566 isc__nmsocket_timer_restart(sock); 567 } else if (sock->tlsstream.state == TLS_CLOSED) { 568 return; 569 } else { /* initialised and doing I/O */ 570 if (received_data != NULL) { 571 INSIST(send_data == NULL); 572 rv = BIO_write_ex(sock->tlsstream.bio_in, 573 received_data->base, 574 received_data->length, &len); 575 if (rv <= 0 || len != received_data->length) { 576 result = ISC_R_TLSERROR; 577 #if ISC_NETMGR_TRACE 578 saved_errno = errno; 579 #endif 580 goto error; 581 } 582 583 /* 584 * Only after doing the IO we can check whether SSL 585 * handshake is done. 586 */ 587 if (sock->tlsstream.state == TLS_HANDSHAKE) { 588 isc_result_t hs_result = ISC_R_UNSET; 589 rv = tls_try_handshake(sock, &hs_result); 590 if (sock->tlsstream.state == TLS_IO && 591 hs_result != ISC_R_SUCCESS) 592 { 593 /* 594 * The accept/connect callback has been 595 * called unsuccessfully. Let's try to 596 * shut down the TLS connection 597 * gracefully. 598 */ 599 INSIST(SSL_is_init_finished( 600 sock->tlsstream.tls) == 601 1); 602 finish = true; 603 } 604 } 605 } else if (send_data != NULL) { 606 INSIST(received_data == NULL); 607 INSIST(sock->tlsstream.state > TLS_HANDSHAKE); 608 bool received_shutdown = 609 ((SSL_get_shutdown(sock->tlsstream.tls) & 610 SSL_RECEIVED_SHUTDOWN) != 0); 611 bool sent_shutdown = 612 ((SSL_get_shutdown(sock->tlsstream.tls) & 613 SSL_SENT_SHUTDOWN) != 0); 614 bool write_failed = false; 615 if (*(uint16_t *)send_data->tcplen != 0) { 616 size_t sendlen = 0; 617 uint8_t sendbuf[MAX_DNS_MESSAGE_SIZE + 618 sizeof(uint16_t)]; 619 /* 620 * There is a DNS message length to write - do 621 * it. 622 */ 623 624 /* 625 * There's no SSL_writev(), so we need to use a 626 * local buffer to assemble the whole message 627 */ 628 INSIST(send_data->uvbuf.len <= 629 MAX_DNS_MESSAGE_SIZE); 630 631 sendlen = send_data->uvbuf.len + 632 sizeof(uint16_t); 633 memmove(sendbuf, send_data->tcplen, 634 sizeof(uint16_t)); 635 memmove(sendbuf + sizeof(uint16_t), 636 send_data->uvbuf.base, 637 send_data->uvbuf.len); 638 639 /* Write data */ 640 rv = SSL_write_ex(sock->tlsstream.tls, sendbuf, 641 sendlen, &len); 642 if (rv != 1 || len != sendlen) { 643 write_failed = true; 644 } 645 } else { 646 /* Write data only */ 647 rv = SSL_write_ex(sock->tlsstream.tls, 648 send_data->uvbuf.base, 649 send_data->uvbuf.len, &len); 650 if (rv != 1 || len != send_data->uvbuf.len) { 651 write_failed = true; 652 } 653 } 654 655 if (write_failed) { 656 result = received_shutdown || sent_shutdown 657 ? ISC_R_CANCELED 658 : ISC_R_TLSERROR; 659 send_data->cb.send(send_data->handle, result, 660 send_data->cbarg); 661 send_data = NULL; 662 return; 663 } 664 } 665 666 /* Decrypt and pass data from network to client */ 667 if (sock->tlsstream.state >= TLS_IO && sock->recv_cb != NULL && 668 sock->statichandle != NULL && sock->reading && !finish) 669 { 670 bool was_new_data = false; 671 uint8_t recv_buf[TLS_BUF_SIZE]; 672 INSIST(sock->tlsstream.state > TLS_HANDSHAKE); 673 while ((rv = SSL_read_ex(sock->tlsstream.tls, recv_buf, 674 TLS_BUF_SIZE, &len)) == 1) 675 { 676 isc_region_t region; 677 region = (isc_region_t){ .base = &recv_buf[0], 678 .length = len }; 679 680 was_new_data = true; 681 INSIST(VALID_NMHANDLE(sock->statichandle)); 682 sock->recv_cb(sock->statichandle, ISC_R_SUCCESS, 683 ®ion, sock->recv_cbarg); 684 /* The handle could have been detached in 685 * sock->recv_cb, making the sock->statichandle 686 * nullified (it happens in netmgr.c). If it is 687 * the case, then it means that we are not 688 * interested in keeping the connection alive 689 * anymore. Let's shut down the SSL session, 690 * send what we have in the SSL buffers, 691 * and close the connection. 692 */ 693 if (sock->statichandle == NULL) { 694 finish = true; 695 break; 696 } else if (sock->recv_cb == NULL) { 697 /* 698 * The 'sock->recv_cb' might have been 699 * nullified during the call to 700 * 'sock->recv_cb'. That could happen, 701 * e.g. by an indirect call to 702 * 'isc_nmhandle_close()' from within 703 * the callback when wrapping up. 704 * 705 * In this case, let's close the TLS 706 * connection. 707 */ 708 finish = true; 709 break; 710 } else if (!sock->reading) { 711 /* 712 * Reading has been paused from withing 713 * the context of read callback - stop 714 * processing incoming data. 715 */ 716 break; 717 } 718 } 719 720 if (was_new_data && !sock->manual_read_timer) { 721 /* 722 * Some data has been decrypted, it is the right 723 * time to stop the read timer as it will be 724 * restarted on the next read attempt. 725 */ 726 isc__nmsocket_timer_stop(sock); 727 } 728 } 729 } 730 731 /* 732 * Setting 'finish' to 'true' means that we are about to close the 733 * TLS stream (we intend to send TLS shutdown message to the 734 * remote side). After that no new data can be received, so we 735 * should stop the timer regardless of the 736 * 'sock->manual_read_timer' value. 737 */ 738 if (finish) { 739 isc__nmsocket_timer_stop(sock); 740 } 741 742 errno = 0; 743 tls_status = SSL_get_error(sock->tlsstream.tls, rv); 744 saved_errno = errno; 745 746 /* See "BUGS" section at: 747 * https://www.openssl.org/docs/man1.1.1/man3/SSL_get_error.html 748 * 749 * It is mentioned there that when TLS status equals 750 * SSL_ERROR_SYSCALL AND errno == 0 it means that underlying 751 * transport layer returned EOF prematurely. However, we are 752 * managing the transport ourselves, so we should just resume 753 * reading from the TCP socket. 754 * 755 * It seems that this case has been handled properly on modern 756 * versions of OpenSSL. That being said, the situation goes in 757 * line with the manual: it is briefly mentioned there that 758 * SSL_ERROR_SYSCALL might be returned not only in a case of 759 * low-level errors (like system call failures). 760 */ 761 if (tls_status == SSL_ERROR_SYSCALL && saved_errno == 0 && 762 received_data == NULL && send_data == NULL && finish == false) 763 { 764 tls_status = SSL_ERROR_WANT_READ; 765 } 766 767 pending = tls_process_outgoing(sock, finish, send_data); 768 if (pending > 0 && tls_status != SSL_ERROR_SSL) { 769 return; 770 } 771 772 switch (tls_status) { 773 case SSL_ERROR_NONE: 774 case SSL_ERROR_ZERO_RETURN: 775 (void)tls_try_to_close_unused_socket(sock); 776 return; 777 case SSL_ERROR_WANT_WRITE: 778 if (sock->tlsstream.nsending == 0) { 779 /* 780 * Launch tls_do_bio asynchronously. If we're sending 781 * already the send callback will call it. 782 */ 783 async_tls_do_bio(sock); 784 } 785 return; 786 case SSL_ERROR_WANT_READ: 787 if (tls_try_to_close_unused_socket(sock) || 788 sock->outerhandle == NULL) 789 { 790 return; 791 } else if (sock->reading == false && 792 sock->tlsstream.state == TLS_HANDSHAKE) 793 { 794 /* 795 * We need to read data when doing handshake even if 796 * 'sock->reading == false'. It will be stopped when 797 * handshake is completed. 798 */ 799 tls_read_start(sock); 800 return; 801 } else if (sock->reading == false) { 802 return; 803 } 804 805 tls_read_start(sock); 806 return; 807 default: 808 result = tls_error_to_result(tls_status, sock->tlsstream.state, 809 sock->tlsstream.tls); 810 break; 811 } 812 813 error: 814 #if ISC_NETMGR_TRACE 815 isc__nmsocket_log(sock, ISC_LOG_NOTICE, 816 "SSL error in BIO: %d %s (errno: %d). Arguments: " 817 "received_data: %p, " 818 "send_data: %p, finish: %s", 819 tls_status, isc_result_totext(result), saved_errno, 820 received_data, send_data, finish ? "true" : "false"); 821 #endif 822 tls_failed_read_cb(sock, result); 823 } 824 825 static void 826 tls_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region, 827 void *cbarg) { 828 isc_nmsocket_t *tlssock = (isc_nmsocket_t *)cbarg; 829 830 REQUIRE(VALID_NMSOCK(tlssock)); 831 REQUIRE(VALID_NMHANDLE(handle)); 832 REQUIRE(tlssock->tid == isc_tid()); 833 834 if (result != ISC_R_SUCCESS) { 835 tls_failed_read_cb(tlssock, result); 836 return; 837 } else if (isc__nmsocket_closing(handle->sock)) { 838 tls_failed_read_cb(tlssock, ISC_R_CANCELED); 839 return; 840 } 841 842 REQUIRE(handle == tlssock->outerhandle); 843 tls_do_bio(tlssock, region, NULL, false); 844 } 845 846 static isc_result_t 847 initialize_tls(isc_nmsocket_t *sock, bool server) { 848 REQUIRE(sock->tid == isc_tid()); 849 850 sock->tlsstream.bio_in = BIO_new(BIO_s_mem()); 851 if (sock->tlsstream.bio_in == NULL) { 852 isc_tls_free(&sock->tlsstream.tls); 853 return ISC_R_TLSERROR; 854 } 855 sock->tlsstream.bio_out = BIO_new(BIO_s_mem()); 856 if (sock->tlsstream.bio_out == NULL) { 857 BIO_free_all(sock->tlsstream.bio_in); 858 sock->tlsstream.bio_in = NULL; 859 isc_tls_free(&sock->tlsstream.tls); 860 return ISC_R_TLSERROR; 861 } 862 863 if (BIO_set_mem_eof_return(sock->tlsstream.bio_in, EOF) != 1 || 864 BIO_set_mem_eof_return(sock->tlsstream.bio_out, EOF) != 1) 865 { 866 goto error; 867 } 868 869 SSL_set_bio(sock->tlsstream.tls, sock->tlsstream.bio_in, 870 sock->tlsstream.bio_out); 871 sock->tlsstream.server = server; 872 sock->tlsstream.nsending = 0; 873 sock->tlsstream.state = TLS_INIT; 874 if (sock->tlsstream.sni_hostname != NULL) { 875 INSIST(sock->client); 876 const int ret = SSL_set_tlsext_host_name( 877 sock->tlsstream.tls, sock->tlsstream.sni_hostname); 878 if (ret != 1) { 879 goto error; 880 } 881 } 882 return ISC_R_SUCCESS; 883 error: 884 isc_tls_free(&sock->tlsstream.tls); 885 sock->tlsstream.bio_out = sock->tlsstream.bio_in = NULL; 886 return ISC_R_TLSERROR; 887 } 888 889 static void 890 tls_try_to_enable_tcp_nodelay(isc_nmsocket_t *tlssock) { 891 /* 892 * Try to enable TCP_NODELAY for TLS connections by default to speed up 893 * the handshakes, just like other software (e.g. NGINX) does. 894 */ 895 isc_result_t result = isc_nmhandle_set_tcp_nodelay(tlssock->outerhandle, 896 true); 897 tlssock->tlsstream.tcp_nodelay_value = (result == ISC_R_SUCCESS); 898 } 899 900 static isc_result_t 901 tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) { 902 isc_nmsocket_t *tlslistensock = (isc_nmsocket_t *)cbarg; 903 isc_nmsocket_t *tlssock = NULL; 904 isc_tlsctx_t *tlsctx = NULL; 905 isc_sockaddr_t local; 906 907 /* If accept() was unsuccessful we can't do anything */ 908 if (result != ISC_R_SUCCESS) { 909 return result; 910 } 911 912 REQUIRE(VALID_NMHANDLE(handle)); 913 REQUIRE(VALID_NMSOCK(handle->sock)); 914 REQUIRE(VALID_NMSOCK(tlslistensock)); 915 REQUIRE(tlslistensock->type == isc_nm_tlslistener); 916 917 if (isc__nm_closing(handle->sock->worker)) { 918 return ISC_R_SHUTTINGDOWN; 919 } else if (isc__nmsocket_closing(handle->sock)) { 920 return ISC_R_CANCELED; 921 } 922 923 local = isc_nmhandle_localaddr(handle); 924 /* 925 * We need to create a 'wrapper' tlssocket for this connection. 926 */ 927 tlssock = isc_mempool_get(handle->sock->worker->nmsocket_pool); 928 isc__nmsocket_init(tlssock, handle->sock->worker, isc_nm_tlssocket, 929 &local, NULL); 930 isc__nmsocket_attach(tlslistensock, &tlssock->server); 931 932 /* We need to initialize SSL now to reference SSL_CTX properly */ 933 tlsctx = tls_get_listener_tlsctx(tlslistensock, isc_tid()); 934 RUNTIME_CHECK(tlsctx != NULL); 935 isc_tlsctx_attach(tlsctx, &tlssock->tlsstream.ctx); 936 tlssock->tlsstream.tls = isc_tls_create(tlssock->tlsstream.ctx); 937 if (tlssock->tlsstream.tls == NULL) { 938 tlssock->closed = true; 939 isc_tlsctx_free(&tlssock->tlsstream.ctx); 940 isc__nmsocket_detach(&tlssock->server); 941 isc__nmsocket_detach(&tlssock); 942 return ISC_R_TLSERROR; 943 } 944 945 tlssock->accept_cb = tlslistensock->accept_cb; 946 tlssock->accept_cbarg = tlslistensock->accept_cbarg; 947 isc__nmsocket_attach(handle->sock, &tlssock->listener); 948 isc_nmhandle_attach(handle, &tlssock->outerhandle); 949 tlssock->peer = isc_nmhandle_peeraddr(handle); 950 tlssock->read_timeout = 951 atomic_load_relaxed(&handle->sock->worker->netmgr->init); 952 953 /* 954 * Hold a reference to tlssock in the TCP socket: it will 955 * detached in isc__nm_tls_cleanup_data(). 956 */ 957 handle->sock->tlsstream.tlssocket = tlssock; 958 959 result = initialize_tls(tlssock, true); 960 if (result != ISC_R_SUCCESS) { 961 isc__nmsocket_log(tlssock, ISC_LOG_ERROR, 962 "TLS initialization failed: %s", 963 isc_result_totext(result)); 964 handle->sock->tlsstream.tlssocket = NULL; 965 isc_nmhandle_detach(&tlssock->outerhandle); 966 tlssock->closed = true; 967 isc_tlsctx_free(&tlssock->tlsstream.ctx); 968 isc__nmsocket_detach(&tlssock->listener); 969 isc__nmsocket_detach(&tlssock->server); 970 isc__nmsocket_detach(&tlssock); 971 return result; 972 } 973 974 tls_try_to_enable_tcp_nodelay(tlssock); 975 976 isc__nmhandle_set_manual_timer(tlssock->outerhandle, true); 977 tls_do_bio(tlssock, NULL, NULL, false); 978 return result; 979 } 980 981 isc_result_t 982 isc_nm_listentls(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface, 983 isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog, 984 isc_quota_t *quota, SSL_CTX *sslctx, bool proxy, 985 isc_nmsocket_t **sockp) { 986 isc_result_t result; 987 isc_nmsocket_t *tlssock = NULL; 988 isc_nmsocket_t *tsock = NULL; 989 isc__networker_t *worker = NULL; 990 991 REQUIRE(VALID_NM(mgr)); 992 REQUIRE(isc_tid() == 0); 993 994 worker = &mgr->workers[isc_tid()]; 995 996 if (isc__nm_closing(worker)) { 997 return ISC_R_SHUTTINGDOWN; 998 } 999 1000 if (workers == 0) { 1001 workers = mgr->nloops; 1002 } 1003 REQUIRE(workers <= mgr->nloops); 1004 1005 tlssock = isc_mempool_get(worker->nmsocket_pool); 1006 isc__nmsocket_init(tlssock, worker, isc_nm_tlslistener, iface, NULL); 1007 tlssock->accept_cb = accept_cb; 1008 tlssock->accept_cbarg = accept_cbarg; 1009 tls_init_listener_tlsctx(tlssock, sslctx); 1010 tlssock->tlsstream.tls = NULL; 1011 1012 /* 1013 * tlssock will be a TLS 'wrapper' around an unencrypted stream. 1014 * We set tlssock->outer to a socket listening for a TCP connection. 1015 */ 1016 if (proxy) { 1017 result = isc_nm_listenproxystream( 1018 mgr, workers, iface, tlslisten_acceptcb, tlssock, 1019 backlog, quota, NULL, &tlssock->outer); 1020 } else { 1021 result = isc_nm_listentcp(mgr, workers, iface, 1022 tlslisten_acceptcb, tlssock, backlog, 1023 quota, &tlssock->outer); 1024 } 1025 if (result != ISC_R_SUCCESS) { 1026 tlssock->closed = true; 1027 isc__nmsocket_detach(&tlssock); 1028 return result; 1029 } 1030 1031 /* copy the actual port we're listening on into sock->iface */ 1032 if (isc_sockaddr_getport(iface) == 0) { 1033 tlssock->iface = tlssock->outer->iface; 1034 } 1035 1036 /* wait for listen result */ 1037 isc__nmsocket_attach(tlssock->outer, &tsock); 1038 tlssock->result = result; 1039 tlssock->active = true; 1040 INSIST(tlssock->outer->tlsstream.tlslistener == NULL); 1041 isc__nmsocket_attach(tlssock, &tlssock->outer->tlsstream.tlslistener); 1042 isc__nmsocket_detach(&tsock); 1043 INSIST(result != ISC_R_UNSET); 1044 tlssock->nchildren = tlssock->outer->nchildren; 1045 1046 if (result == ISC_R_SUCCESS) { 1047 *sockp = tlssock; 1048 } 1049 1050 return result; 1051 } 1052 1053 static void 1054 tls_send_direct(void *arg) { 1055 isc__nm_uvreq_t *req = arg; 1056 1057 REQUIRE(VALID_UVREQ(req)); 1058 1059 isc_nmsocket_t *sock = req->sock; 1060 1061 REQUIRE(VALID_NMSOCK(sock)); 1062 REQUIRE(sock->tid == isc_tid()); 1063 1064 if (isc__nm_closing(sock->worker)) { 1065 req->cb.send(req->handle, ISC_R_SHUTTINGDOWN, req->cbarg); 1066 goto done; 1067 } else if (inactive(sock)) { 1068 req->cb.send(req->handle, ISC_R_CANCELED, req->cbarg); 1069 goto done; 1070 } 1071 1072 tls_do_bio(sock, NULL, req, false); 1073 done: 1074 isc__nm_uvreq_put(&req); 1075 return; 1076 } 1077 1078 static void 1079 tls_send(isc_nmhandle_t *handle, const isc_region_t *region, isc_nm_cb_t cb, 1080 void *cbarg, const bool dnsmsg) { 1081 isc__nm_uvreq_t *uvreq = NULL; 1082 isc_nmsocket_t *sock = NULL; 1083 1084 REQUIRE(VALID_NMHANDLE(handle)); 1085 REQUIRE(VALID_NMSOCK(handle->sock)); 1086 1087 sock = handle->sock; 1088 1089 REQUIRE(sock->type == isc_nm_tlssocket); 1090 1091 uvreq = isc__nm_uvreq_get(sock); 1092 isc_nmhandle_attach(handle, &uvreq->handle); 1093 uvreq->cb.send = cb; 1094 uvreq->cbarg = cbarg; 1095 uvreq->uvbuf.base = (char *)region->base; 1096 uvreq->uvbuf.len = region->length; 1097 if (dnsmsg) { 1098 *(uint16_t *)uvreq->tcplen = htons(region->length); 1099 } 1100 1101 isc_job_run(sock->worker->loop, &uvreq->job, tls_send_direct, uvreq); 1102 } 1103 1104 void 1105 isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region, 1106 isc_nm_cb_t cb, void *cbarg) { 1107 tls_send(handle, region, cb, cbarg, false); 1108 } 1109 1110 void 1111 isc__nm_tls_senddns(isc_nmhandle_t *handle, const isc_region_t *region, 1112 isc_nm_cb_t cb, void *cbarg) { 1113 tls_send(handle, region, cb, cbarg, true); 1114 } 1115 1116 void 1117 isc__nm_tls_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) { 1118 isc_nmsocket_t *sock = NULL; 1119 1120 REQUIRE(VALID_NMHANDLE(handle)); 1121 1122 sock = handle->sock; 1123 REQUIRE(VALID_NMSOCK(sock)); 1124 REQUIRE(sock->statichandle == handle); 1125 REQUIRE(sock->tid == isc_tid()); 1126 1127 if (isc__nm_closing(sock->worker)) { 1128 cb(handle, ISC_R_SHUTTINGDOWN, NULL, cbarg); 1129 return; 1130 } else if (inactive(sock)) { 1131 cb(handle, ISC_R_CANCELED, NULL, cbarg); 1132 return; 1133 } 1134 1135 sock->recv_cb = cb; 1136 sock->recv_cbarg = cbarg; 1137 sock->reading = true; 1138 1139 async_tls_do_bio(sock); 1140 } 1141 1142 static void 1143 tls_read_start(isc_nmsocket_t *restrict sock) { 1144 if (sock->tlsstream.reading) { 1145 return; 1146 } 1147 sock->tlsstream.reading = true; 1148 1149 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1150 1151 isc_nm_read(sock->outerhandle, tls_readcb, sock); 1152 if (!sock->manual_read_timer) { 1153 isc__nmsocket_timer_start(sock); 1154 } 1155 } 1156 1157 static void 1158 tls_read_stop(isc_nmsocket_t *sock) { 1159 sock->tlsstream.reading = false; 1160 if (sock->outerhandle != NULL) { 1161 isc_nm_read_stop(sock->outerhandle); 1162 } 1163 } 1164 1165 void 1166 isc__nm_tls_read_stop(isc_nmhandle_t *handle) { 1167 REQUIRE(VALID_NMHANDLE(handle)); 1168 REQUIRE(VALID_NMSOCK(handle->sock)); 1169 1170 handle->sock->reading = false; 1171 1172 if (!handle->sock->manual_read_timer) { 1173 isc__nmsocket_timer_stop(handle->sock); 1174 } 1175 1176 tls_read_stop(handle->sock); 1177 } 1178 1179 void 1180 isc__nm_tls_close(isc_nmsocket_t *sock) { 1181 REQUIRE(VALID_NMSOCK(sock)); 1182 REQUIRE(sock->type == isc_nm_tlssocket); 1183 REQUIRE(!sock->closing); 1184 REQUIRE(sock->tid == isc_tid()); 1185 REQUIRE(!sock->closed); 1186 REQUIRE(!sock->closing); 1187 1188 sock->closing = true; 1189 1190 /* 1191 * At this point we're certain that there are no 1192 * external references, we can close everything. 1193 */ 1194 tls_read_stop(sock); 1195 if (sock->outerhandle != NULL) { 1196 isc__nmsocket_timer_stop(sock); 1197 isc_nm_read_stop(sock->outerhandle); 1198 isc_nmhandle_close(sock->outerhandle); 1199 isc_nmhandle_detach(&sock->outerhandle); 1200 } 1201 1202 if (sock->listener != NULL) { 1203 isc__nmsocket_detach(&sock->listener); 1204 } 1205 1206 if (sock->server != NULL) { 1207 isc__nmsocket_detach(&sock->server); 1208 } 1209 1210 /* Further cleanup performed in isc__nm_tls_cleanup_data() */ 1211 sock->closed = true; 1212 sock->active = false; 1213 sock->tlsstream.state = TLS_CLOSED; 1214 } 1215 1216 void 1217 isc__nm_tls_stoplistening(isc_nmsocket_t *sock) { 1218 REQUIRE(VALID_NMSOCK(sock)); 1219 REQUIRE(sock->type == isc_nm_tlslistener); 1220 REQUIRE(sock->tlsstream.tls == NULL); 1221 REQUIRE(sock->tlsstream.ctx == NULL); 1222 1223 isc__nmsocket_stop(sock); 1224 } 1225 1226 static void 1227 tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg); 1228 1229 void 1230 isc_nm_tlsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer, 1231 isc_nm_cb_t connect_cb, void *connect_cbarg, 1232 isc_tlsctx_t *ctx, const char *sni_hostname, 1233 isc_tlsctx_client_session_cache_t *client_sess_cache, 1234 unsigned int timeout, bool proxy, 1235 isc_nm_proxyheader_info_t *proxy_info) { 1236 isc_nmsocket_t *sock = NULL; 1237 isc__networker_t *worker = NULL; 1238 1239 REQUIRE(VALID_NM(mgr)); 1240 1241 worker = &mgr->workers[isc_tid()]; 1242 1243 if (isc__nm_closing(worker)) { 1244 connect_cb(NULL, ISC_R_SHUTTINGDOWN, connect_cbarg); 1245 return; 1246 } 1247 1248 sock = isc_mempool_get(worker->nmsocket_pool); 1249 isc__nmsocket_init(sock, worker, isc_nm_tlssocket, local, NULL); 1250 sock->connect_cb = connect_cb; 1251 sock->connect_cbarg = connect_cbarg; 1252 sock->connect_timeout = timeout; 1253 isc_tlsctx_attach(ctx, &sock->tlsstream.ctx); 1254 if (sni_hostname != NULL) { 1255 sock->tlsstream.sni_hostname = 1256 isc_mem_strdup(sock->worker->mctx, sni_hostname); 1257 } 1258 sock->client = true; 1259 if (client_sess_cache != NULL) { 1260 INSIST(isc_tlsctx_client_session_cache_getctx( 1261 client_sess_cache) == ctx); 1262 isc_tlsctx_client_session_cache_attach( 1263 client_sess_cache, &sock->tlsstream.client_sess_cache); 1264 } 1265 1266 if (proxy) { 1267 isc_nm_proxystreamconnect(mgr, local, peer, tcp_connected, sock, 1268 sock->connect_timeout, NULL, NULL, 1269 NULL, proxy_info); 1270 } else { 1271 isc_nm_tcpconnect(mgr, local, peer, tcp_connected, sock, 1272 sock->connect_timeout); 1273 } 1274 } 1275 1276 static void 1277 tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) { 1278 isc_nmsocket_t *tlssock = (isc_nmsocket_t *)cbarg; 1279 isc_nmhandle_t *tlshandle = NULL; 1280 isc__networker_t *worker = NULL; 1281 1282 REQUIRE(VALID_NMSOCK(tlssock)); 1283 1284 worker = tlssock->worker; 1285 1286 if (result != ISC_R_SUCCESS) { 1287 goto error; 1288 } 1289 1290 INSIST(VALID_NMHANDLE(handle)); 1291 1292 tlssock->iface = isc_nmhandle_localaddr(handle); 1293 tlssock->peer = isc_nmhandle_peeraddr(handle); 1294 if (isc__nm_closing(worker)) { 1295 result = ISC_R_SHUTTINGDOWN; 1296 goto error; 1297 } else if (isc__nmsocket_closing(handle->sock)) { 1298 result = ISC_R_CANCELED; 1299 goto error; 1300 } 1301 1302 /* 1303 * We need to initialize SSL now to reference SSL_CTX properly. 1304 */ 1305 tlssock->tlsstream.tls = isc_tls_create(tlssock->tlsstream.ctx); 1306 if (tlssock->tlsstream.tls == NULL) { 1307 result = ISC_R_TLSERROR; 1308 goto error; 1309 } 1310 1311 result = initialize_tls(tlssock, false); 1312 if (result != ISC_R_SUCCESS) { 1313 goto error; 1314 } 1315 tlssock->peer = isc_nmhandle_peeraddr(handle); 1316 isc_nmhandle_attach(handle, &tlssock->outerhandle); 1317 tlssock->active = true; 1318 1319 if (tlssock->tlsstream.client_sess_cache != NULL) { 1320 isc_tlsctx_client_session_cache_reuse_sockaddr( 1321 tlssock->tlsstream.client_sess_cache, &tlssock->peer, 1322 tlssock->tlsstream.tls); 1323 } 1324 1325 /* 1326 * Hold a reference to tlssock in the TCP socket: it will 1327 * detached in isc__nm_tls_cleanup_data(). 1328 */ 1329 handle->sock->tlsstream.tlssocket = tlssock; 1330 1331 tls_try_to_enable_tcp_nodelay(tlssock); 1332 1333 isc__nmhandle_set_manual_timer(tlssock->outerhandle, true); 1334 tls_do_bio(tlssock, NULL, NULL, false); 1335 return; 1336 error: 1337 tlshandle = isc__nmhandle_get(tlssock, NULL, NULL); 1338 tlssock->closed = true; 1339 tls_call_connect_cb(tlssock, tlshandle, result); 1340 isc_nmhandle_detach(&tlshandle); 1341 isc__nmsocket_detach(&tlssock); 1342 } 1343 1344 void 1345 isc__nm_tls_cleanup_data(isc_nmsocket_t *sock) { 1346 if ((sock->type == isc_nm_tcplistener || 1347 sock->type == isc_nm_proxystreamlistener) && 1348 sock->tlsstream.tlslistener != NULL) 1349 { 1350 isc__nmsocket_detach(&sock->tlsstream.tlslistener); 1351 } else if (sock->type == isc_nm_tlslistener) { 1352 tls_cleanup_listener_tlsctx(sock); 1353 } else if (sock->type == isc_nm_tlssocket) { 1354 if (sock->tlsstream.tls != NULL) { 1355 /* 1356 * Let's shut down the TLS session properly so that 1357 * the session will remain resumable, if required. 1358 */ 1359 tls_try_shutdown(sock->tlsstream.tls, true); 1360 tls_keep_client_tls_session(sock); 1361 isc_tls_free(&sock->tlsstream.tls); 1362 /* These are destroyed when we free SSL */ 1363 sock->tlsstream.bio_out = NULL; 1364 sock->tlsstream.bio_in = NULL; 1365 } 1366 if (sock->tlsstream.ctx != NULL) { 1367 isc_tlsctx_free(&sock->tlsstream.ctx); 1368 } 1369 if (sock->tlsstream.sni_hostname != NULL) { 1370 isc_mem_free(sock->worker->mctx, 1371 sock->tlsstream.sni_hostname); 1372 } 1373 if (sock->tlsstream.client_sess_cache != NULL) { 1374 INSIST(sock->client); 1375 isc_tlsctx_client_session_cache_detach( 1376 &sock->tlsstream.client_sess_cache); 1377 } 1378 1379 if (sock->tlsstream.send_req != NULL) { 1380 isc_buffer_clearmctx(&sock->tlsstream.send_req->data); 1381 isc_buffer_invalidate(&sock->tlsstream.send_req->data); 1382 isc_mem_put(sock->worker->mctx, 1383 sock->tlsstream.send_req, 1384 sizeof(*sock->tlsstream.send_req)); 1385 } 1386 } else if ((sock->type == isc_nm_tcpsocket || 1387 sock->type == isc_nm_proxystreamsocket) && 1388 sock->tlsstream.tlssocket != NULL) 1389 { 1390 /* 1391 * The TLS socket can't be destroyed until its underlying TCP 1392 * socket is, to avoid possible use-after-free errors. 1393 */ 1394 isc__nmsocket_detach(&sock->tlsstream.tlssocket); 1395 } 1396 } 1397 1398 void 1399 isc__nm_tls_cleartimeout(isc_nmhandle_t *handle) { 1400 isc_nmsocket_t *sock = NULL; 1401 1402 REQUIRE(VALID_NMHANDLE(handle)); 1403 REQUIRE(VALID_NMSOCK(handle->sock)); 1404 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1405 1406 sock = handle->sock; 1407 if (sock->outerhandle != NULL) { 1408 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1409 isc_nmhandle_cleartimeout(sock->outerhandle); 1410 } 1411 } 1412 1413 void 1414 isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout) { 1415 isc_nmsocket_t *sock = NULL; 1416 1417 REQUIRE(VALID_NMHANDLE(handle)); 1418 REQUIRE(VALID_NMSOCK(handle->sock)); 1419 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1420 1421 sock = handle->sock; 1422 if (sock->outerhandle != NULL) { 1423 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1424 isc_nmhandle_settimeout(sock->outerhandle, timeout); 1425 } 1426 } 1427 1428 void 1429 isc__nmhandle_tls_keepalive(isc_nmhandle_t *handle, bool value) { 1430 isc_nmsocket_t *sock = NULL; 1431 1432 REQUIRE(VALID_NMHANDLE(handle)); 1433 REQUIRE(VALID_NMSOCK(handle->sock)); 1434 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1435 1436 sock = handle->sock; 1437 if (sock->outerhandle != NULL) { 1438 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1439 1440 isc_nmhandle_keepalive(sock->outerhandle, value); 1441 } 1442 } 1443 1444 void 1445 isc__nmhandle_tls_setwritetimeout(isc_nmhandle_t *handle, 1446 uint64_t write_timeout) { 1447 isc_nmsocket_t *sock = NULL; 1448 1449 REQUIRE(VALID_NMHANDLE(handle)); 1450 REQUIRE(VALID_NMSOCK(handle->sock)); 1451 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1452 1453 sock = handle->sock; 1454 if (sock->outerhandle != NULL) { 1455 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1456 1457 isc_nmhandle_setwritetimeout(sock->outerhandle, write_timeout); 1458 } 1459 } 1460 1461 void 1462 isc__nmsocket_tls_reset(isc_nmsocket_t *sock) { 1463 REQUIRE(VALID_NMSOCK(sock)); 1464 REQUIRE(sock->type == isc_nm_tlssocket); 1465 1466 if (sock->outerhandle != NULL) { 1467 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1468 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1469 isc__nmsocket_reset(sock->outerhandle->sock); 1470 } 1471 } 1472 1473 bool 1474 isc__nmsocket_tls_timer_running(isc_nmsocket_t *sock) { 1475 REQUIRE(VALID_NMSOCK(sock)); 1476 REQUIRE(sock->type == isc_nm_tlssocket); 1477 1478 if (sock->outerhandle != NULL) { 1479 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1480 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1481 return isc__nmsocket_timer_running(sock->outerhandle->sock); 1482 } 1483 1484 return false; 1485 } 1486 1487 void 1488 isc__nmsocket_tls_timer_restart(isc_nmsocket_t *sock) { 1489 REQUIRE(VALID_NMSOCK(sock)); 1490 REQUIRE(sock->type == isc_nm_tlssocket); 1491 1492 if (sock->outerhandle != NULL) { 1493 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1494 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1495 isc__nmsocket_timer_restart(sock->outerhandle->sock); 1496 } 1497 } 1498 1499 void 1500 isc__nmsocket_tls_timer_stop(isc_nmsocket_t *sock) { 1501 REQUIRE(VALID_NMSOCK(sock)); 1502 REQUIRE(sock->type == isc_nm_tlssocket); 1503 1504 if (sock->outerhandle != NULL) { 1505 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1506 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1507 isc__nmsocket_timer_stop(sock->outerhandle->sock); 1508 } 1509 } 1510 1511 const char * 1512 isc__nm_tls_verify_tls_peer_result_string(const isc_nmhandle_t *handle) { 1513 isc_nmsocket_t *sock = NULL; 1514 1515 REQUIRE(VALID_NMHANDLE(handle)); 1516 REQUIRE(VALID_NMSOCK(handle->sock)); 1517 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1518 1519 sock = handle->sock; 1520 if (sock->tlsstream.tls == NULL) { 1521 return NULL; 1522 } 1523 1524 return isc_tls_verify_peer_result_string(sock->tlsstream.tls); 1525 } 1526 1527 static void 1528 tls_init_listener_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *ctx) { 1529 size_t nworkers; 1530 1531 REQUIRE(VALID_NMSOCK(listener)); 1532 REQUIRE(ctx != NULL); 1533 1534 nworkers = 1535 (size_t)isc_loopmgr_nloops(listener->worker->netmgr->loopmgr); 1536 INSIST(nworkers > 0); 1537 1538 listener->tlsstream.listener_tls_ctx = isc_mem_cget( 1539 listener->worker->mctx, nworkers, sizeof(isc_tlsctx_t *)); 1540 listener->tlsstream.n_listener_tls_ctx = nworkers; 1541 for (size_t i = 0; i < nworkers; i++) { 1542 listener->tlsstream.listener_tls_ctx[i] = NULL; 1543 isc_tlsctx_attach(ctx, 1544 &listener->tlsstream.listener_tls_ctx[i]); 1545 } 1546 } 1547 1548 static void 1549 tls_cleanup_listener_tlsctx(isc_nmsocket_t *listener) { 1550 REQUIRE(VALID_NMSOCK(listener)); 1551 1552 if (listener->tlsstream.listener_tls_ctx == NULL) { 1553 return; 1554 } 1555 1556 for (size_t i = 0; i < listener->tlsstream.n_listener_tls_ctx; i++) { 1557 isc_tlsctx_free(&listener->tlsstream.listener_tls_ctx[i]); 1558 } 1559 isc_mem_cput( 1560 listener->worker->mctx, listener->tlsstream.listener_tls_ctx, 1561 listener->tlsstream.n_listener_tls_ctx, sizeof(isc_tlsctx_t *)); 1562 listener->tlsstream.n_listener_tls_ctx = 0; 1563 } 1564 1565 static isc_tlsctx_t * 1566 tls_get_listener_tlsctx(isc_nmsocket_t *listener, const int tid) { 1567 REQUIRE(VALID_NMSOCK(listener)); 1568 REQUIRE(tid >= 0); 1569 1570 if (listener->tlsstream.listener_tls_ctx == NULL) { 1571 return NULL; 1572 } 1573 1574 return listener->tlsstream.listener_tls_ctx[tid]; 1575 } 1576 1577 void 1578 isc__nm_async_tls_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx, 1579 const int tid) { 1580 REQUIRE(tid >= 0); 1581 1582 isc_tlsctx_free(&listener->tlsstream.listener_tls_ctx[tid]); 1583 isc_tlsctx_attach(tlsctx, &listener->tlsstream.listener_tls_ctx[tid]); 1584 } 1585 1586 static void 1587 tls_keep_client_tls_session(isc_nmsocket_t *sock) { 1588 /* 1589 * Ensure that the isc_tls_t is being accessed from 1590 * within the worker thread the socket is bound to. 1591 */ 1592 REQUIRE(sock->tid == isc_tid()); 1593 if (sock->tlsstream.client_sess_cache != NULL && 1594 sock->tlsstream.client_session_saved == false) 1595 { 1596 INSIST(sock->client); 1597 isc_tlsctx_client_session_cache_keep_sockaddr( 1598 sock->tlsstream.client_sess_cache, &sock->peer, 1599 sock->tlsstream.tls); 1600 sock->tlsstream.client_session_saved = true; 1601 } 1602 } 1603 1604 static void 1605 tls_try_shutdown(isc_tls_t *tls, const bool force) { 1606 if (force) { 1607 (void)SSL_set_shutdown(tls, SSL_SENT_SHUTDOWN); 1608 } else if ((SSL_get_shutdown(tls) & SSL_SENT_SHUTDOWN) == 0) { 1609 (void)SSL_shutdown(tls); 1610 } 1611 } 1612 1613 void 1614 isc__nmhandle_tls_set_manual_timer(isc_nmhandle_t *handle, const bool manual) { 1615 isc_nmsocket_t *sock; 1616 1617 REQUIRE(VALID_NMHANDLE(handle)); 1618 sock = handle->sock; 1619 REQUIRE(VALID_NMSOCK(sock)); 1620 REQUIRE(sock->type == isc_nm_tlssocket); 1621 REQUIRE(sock->tid == isc_tid()); 1622 1623 sock->manual_read_timer = manual; 1624 } 1625 1626 void 1627 isc__nmhandle_tls_get_selected_alpn(isc_nmhandle_t *handle, 1628 const unsigned char **alpn, 1629 unsigned int *alpnlen) { 1630 isc_nmsocket_t *sock; 1631 1632 REQUIRE(VALID_NMHANDLE(handle)); 1633 sock = handle->sock; 1634 REQUIRE(VALID_NMSOCK(sock)); 1635 REQUIRE(sock->type == isc_nm_tlssocket); 1636 REQUIRE(sock->tid == isc_tid()); 1637 1638 isc_tls_get_selected_alpn(sock->tlsstream.tls, alpn, alpnlen); 1639 } 1640 1641 isc_result_t 1642 isc__nmhandle_tls_set_tcp_nodelay(isc_nmhandle_t *handle, const bool value) { 1643 isc_nmsocket_t *sock = NULL; 1644 isc_result_t result = ISC_R_FAILURE; 1645 1646 REQUIRE(VALID_NMHANDLE(handle)); 1647 REQUIRE(VALID_NMSOCK(handle->sock)); 1648 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1649 1650 sock = handle->sock; 1651 if (sock->outerhandle != NULL) { 1652 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1653 1654 if (value == sock->tlsstream.tcp_nodelay_value) { 1655 result = ISC_R_SUCCESS; 1656 } else { 1657 result = isc_nmhandle_set_tcp_nodelay(sock->outerhandle, 1658 value); 1659 if (result == ISC_R_SUCCESS) { 1660 sock->tlsstream.tcp_nodelay_value = value; 1661 } 1662 } 1663 } 1664 1665 return result; 1666 } 1667
Indexes created Sat Oct 03 00:25:10 UTC 2026