1 /* $NetBSD: tlsstream.c,v 1.6 2026/04/08 00:16:16 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 #include <errno.h> 17 #include <libgen.h> 18 #include <unistd.h> 19 20 #include <openssl/err.h> 21 #include <openssl/ssl.h> 22 23 #include <isc/async.h> 24 #include <isc/atomic.h> 25 #include <isc/buffer.h> 26 #include <isc/condition.h> 27 #include <isc/log.h> 28 #include <isc/magic.h> 29 #include <isc/mem.h> 30 #include <isc/netmgr.h> 31 #include <isc/once.h> 32 #include <isc/quota.h> 33 #include <isc/random.h> 34 #include <isc/refcount.h> 35 #include <isc/region.h> 36 #include <isc/result.h> 37 #include <isc/sockaddr.h> 38 #include <isc/stdtime.h> 39 #include <isc/thread.h> 40 #include <isc/util.h> 41 #include <isc/uv.h> 42 43 #include "../openssl_shim.h" 44 #include "netmgr-int.h" 45 46 #define TLS_BUF_SIZE (UINT16_MAX) 47 48 #define TLS_MAX_SEND_BUF_SIZE (UINT16_MAX + UINT16_MAX / 2) 49 50 #define MAX_DNS_MESSAGE_SIZE (UINT16_MAX) 51 52 #ifdef ISC_NETMGR_TRACE 53 ISC_ATTR_UNUSED static const char * 54 tls_status2str(int tls_status) { 55 switch (tls_status) { 56 case SSL_ERROR_NONE: 57 return "SSL_ERROR_NONE"; 58 case SSL_ERROR_ZERO_RETURN: 59 return "SSL_ERROR_ZERO_RETURN"; 60 case SSL_ERROR_WANT_WRITE: 61 return "SSL_ERROR_WANT_WRITE"; 62 case SSL_ERROR_WANT_READ: 63 return "SSL_ERROR_WANT_READ"; 64 case SSL_ERROR_SSL: 65 return "SSL_ERROR_SSL"; 66 default: 67 UNREACHABLE(); 68 } 69 } 70 71 ISC_ATTR_UNUSED static const char * 72 state2str(int state) { 73 switch (state) { 74 case TLS_INIT: 75 return "TLS_INIT"; 76 case TLS_HANDSHAKE: 77 return "TLS_HANDSHAKE"; 78 case TLS_IO: 79 return "TLS_IO"; 80 case TLS_CLOSED: 81 return "TLS_CLOSED"; 82 default: 83 UNREACHABLE(); 84 } 85 } 86 #endif /* ISC_NETMGR_TRACE */ 87 88 static isc_result_t 89 tls_error_to_result(const int tls_err, const int tls_state, isc_tls_t *tls) { 90 switch (tls_err) { 91 case SSL_ERROR_ZERO_RETURN: 92 return ISC_R_EOF; 93 case SSL_ERROR_SSL: 94 if (tls != NULL && tls_state < TLS_IO && 95 SSL_get_verify_result(tls) != X509_V_OK) 96 { 97 return ISC_R_TLSBADPEERCERT; 98 } 99 return ISC_R_TLSERROR; 100 default: 101 return ISC_R_UNEXPECTED; 102 } 103 } 104 105 static void 106 tls_read_start(isc_nmsocket_t *restrict sock); 107 108 static void 109 tls_read_stop(isc_nmsocket_t *sock); 110 111 static void 112 tls_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result); 113 114 static void 115 tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data, 116 isc__nm_uvreq_t *send_data, bool finish); 117 118 static void 119 tls_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region, 120 void *cbarg); 121 122 static void 123 async_tls_do_bio(isc_nmsocket_t *sock); 124 125 static void 126 tls_init_listener_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *ctx); 127 128 static void 129 tls_cleanup_listener_tlsctx(isc_nmsocket_t *listener); 130 131 static isc_tlsctx_t * 132 tls_get_listener_tlsctx(isc_nmsocket_t *listener, const int tid); 133 134 static void 135 tls_keep_client_tls_session(isc_nmsocket_t *sock); 136 137 static void 138 tls_try_shutdown(isc_tls_t *tls, const bool quite); 139 140 static void 141 tls_try_to_enable_tcp_nodelay(isc_nmsocket_t *tlssock); 142 143 /* 144 * The socket is closing, outerhandle has been detached, listener is 145 * inactive, or the netmgr is closing: any operation on it should abort 146 * with ISC_R_CANCELED. 147 */ 148 static bool 149 inactive(isc_nmsocket_t *sock) { 150 return !isc__nmsocket_active(sock) || sock->closing || 151 sock->outerhandle == NULL || 152 !isc__nmsocket_active(sock->outerhandle->sock) || 153 sock->outerhandle->sock->closing || 154 isc__nm_closing(sock->worker); 155 } 156 157 static void 158 tls_call_connect_cb(isc_nmsocket_t *sock, isc_nmhandle_t *handle, 159 const isc_result_t result) { 160 INSIST(sock->connect_cb != NULL); 161 sock->connect_cb(handle, result, sock->connect_cbarg); 162 if (result != ISC_R_SUCCESS) { 163 isc__nmsocket_clearcb(handle->sock); 164 } 165 } 166 167 static void 168 tls_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) { 169 isc_nmsocket_tls_send_req_t *send_req = 170 (isc_nmsocket_tls_send_req_t *)cbarg; 171 isc_nmsocket_t *tlssock = NULL; 172 bool finish = send_req->finish; 173 isc_nm_cb_t send_cb = NULL; 174 void *send_cbarg = NULL; 175 isc_nmhandle_t *send_handle = NULL; 176 177 REQUIRE(VALID_NMHANDLE(handle)); 178 REQUIRE(VALID_NMSOCK(handle->sock)); 179 REQUIRE(VALID_NMSOCK(send_req->tlssock)); 180 181 tlssock = send_req->tlssock; 182 send_req->tlssock = NULL; 183 send_cb = send_req->cb; 184 send_req->cb = NULL; 185 send_cbarg = send_req->cbarg; 186 send_req->cbarg = NULL; 187 send_handle = send_req->handle; 188 send_req->handle = NULL; 189 190 if (finish) { 191 tls_try_shutdown(tlssock->tlsstream.tls, true); 192 } 193 194 /* Try to keep the object to be reused later - to avoid an allocation */ 195 if (tlssock->tlsstream.send_req == NULL) { 196 tlssock->tlsstream.send_req = send_req; 197 /* 198 * We need to ensure that the buffer is not going to grow too 199 * large uncontrollably. We try to keep its size to be no more 200 * than TLS_MAX_SEND_BUF_SIZE. The constant should be larger 201 * than 64 KB for this to work efficiently when combined with 202 * DNS transports. 203 */ 204 if (isc_buffer_length(&send_req->data) > TLS_MAX_SEND_BUF_SIZE) 205 { 206 /* free the underlying buffer */ 207 isc_buffer_clearmctx(&send_req->data); 208 isc_buffer_invalidate(&send_req->data); 209 isc_buffer_init(&send_req->data, send_req->smallbuf, 210 sizeof(send_req->smallbuf)); 211 isc_buffer_setmctx(&send_req->data, 212 handle->sock->worker->mctx); 213 } else { 214 isc_buffer_clear(&send_req->data); 215 } 216 } else { 217 isc_buffer_clearmctx(&send_req->data); 218 isc_buffer_invalidate(&send_req->data); 219 isc_mem_put(handle->sock->worker->mctx, send_req, 220 sizeof(*send_req)); 221 } 222 tlssock->tlsstream.nsending--; 223 224 if (send_cb != NULL) { 225 INSIST(VALID_NMHANDLE(tlssock->statichandle)); 226 send_cb(send_handle, eresult, send_cbarg); 227 isc_nmhandle_detach(&send_handle); 228 /* The last handle has been just detached: close the underlying 229 * socket. */ 230 if (tlssock->statichandle == NULL) { 231 finish = true; 232 } 233 } 234 235 if (finish) { 236 /* 237 * If wrapping up, call tls_failed_read() - it will care of 238 * socket de-initialisation and calling the read callback, if 239 * necessary. 240 */ 241 tls_failed_read_cb(tlssock, ISC_R_EOF); 242 } else if (eresult == ISC_R_SUCCESS) { 243 tls_do_bio(tlssock, NULL, NULL, false); 244 } else if (eresult != ISC_R_SUCCESS && 245 tlssock->tlsstream.state <= TLS_HANDSHAKE && 246 !tlssock->tlsstream.server) 247 { 248 /* 249 * We are still waiting for the handshake to complete, but 250 * it isn't going to happen. Call the connect callback, 251 * passing the error code there. 252 * 253 * (Note: tls_failed_read_cb() calls the connect 254 * rather than the read callback in this case. 255 * XXX: clarify?) 256 */ 257 tls_failed_read_cb(tlssock, eresult); 258 } 259 260 isc__nmsocket_detach(&tlssock); 261 } 262 263 static void 264 tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) { 265 REQUIRE(VALID_NMSOCK(sock)); 266 REQUIRE(result != ISC_R_SUCCESS); 267 268 /* This is TLS counterpart of isc__nm_failed_connect_cb() */ 269 if (!sock->tlsstream.server && 270 (sock->tlsstream.state == TLS_INIT || 271 sock->tlsstream.state == TLS_HANDSHAKE) && 272 sock->connect_cb != NULL) 273 { 274 isc_nmhandle_t *handle = NULL; 275 INSIST(sock->statichandle == NULL); 276 handle = isc__nmhandle_get(sock, &sock->peer, &sock->iface); 277 tls_call_connect_cb(sock, handle, result); 278 isc__nmsocket_clearcb(sock); 279 isc_nmhandle_detach(&handle); 280 goto destroy; 281 } 282 283 isc__nmsocket_timer_stop(sock); 284 285 /* Nobody is reading from the socket yet */ 286 if (sock->statichandle == NULL) { 287 goto destroy; 288 } 289 290 /* This is TLS counterpart of isc__nmsocket_readtimeout_cb() */ 291 if (sock->client && result == ISC_R_TIMEDOUT) { 292 INSIST(sock->statichandle != NULL); 293 294 if (sock->recv_cb != NULL) { 295 isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL); 296 isc__nm_readcb(sock, req, ISC_R_TIMEDOUT, false); 297 } 298 299 if (isc__nmsocket_timer_running(sock)) { 300 /* Timer was restarted, bail-out */ 301 return; 302 } 303 304 isc__nmsocket_clearcb(sock); 305 306 goto destroy; 307 } 308 309 /* 310 * We don't need to check for .nsending, as the callbacks will be 311 * cleared at the time the tls_senddone() tries to call it for the 312 * second time. 313 */ 314 315 if (sock->recv_cb != NULL) { 316 isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL); 317 isc__nmsocket_clearcb(sock); 318 isc__nm_readcb(sock, req, result, false); 319 } 320 321 destroy: 322 isc__nmsocket_prep_destroy(sock); 323 } 324 325 void 326 isc__nm_tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result, 327 bool async ISC_ATTR_UNUSED) { 328 if (!inactive(sock) && sock->tlsstream.state == TLS_IO) { 329 tls_do_bio(sock, NULL, NULL, true); 330 return; 331 } 332 333 tls_failed_read_cb(sock, result); 334 } 335 336 static void 337 tls_do_bio_cb(void *arg) { 338 isc_nmsocket_t *sock = arg; 339 340 REQUIRE(VALID_NMSOCK(sock)); 341 342 tls_do_bio(sock, NULL, NULL, false); 343 344 isc__nmsocket_detach(&sock); 345 } 346 347 static void 348 async_tls_do_bio(isc_nmsocket_t *sock) { 349 isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL }); 350 isc_async_run(sock->worker->loop, tls_do_bio_cb, sock); 351 } 352 353 static int 354 tls_send_outgoing(isc_nmsocket_t *sock, bool finish, isc_nmhandle_t *tlshandle, 355 isc_nm_cb_t cb, void *cbarg) { 356 isc_nmsocket_tls_send_req_t *send_req = NULL; 357 int pending; 358 int rv; 359 size_t len = 0; 360 bool new_send_req = false; 361 isc_region_t used_region = { 0 }; 362 bool shutting_down = isc__nm_closing(sock->worker); 363 364 if (shutting_down || inactive(sock)) { 365 if (cb != NULL) { 366 isc_result_t result = shutting_down ? ISC_R_SHUTTINGDOWN 367 : ISC_R_CANCELED; 368 INSIST(VALID_NMHANDLE(tlshandle)); 369 cb(tlshandle, result, cbarg); 370 } 371 return 0; 372 } 373 374 if (finish) { 375 tls_try_shutdown(sock->tlsstream.tls, false); 376 tls_keep_client_tls_session(sock); 377 } 378 379 pending = BIO_pending(sock->tlsstream.bio_out); 380 if (pending <= 0) { 381 return pending; 382 } 383 384 /* Try to reuse previously allocated object */ 385 if (sock->tlsstream.send_req != NULL) { 386 send_req = sock->tlsstream.send_req; 387 send_req->finish = finish; 388 sock->tlsstream.send_req = NULL; 389 } else { 390 send_req = isc_mem_get(sock->worker->mctx, sizeof(*send_req)); 391 *send_req = (isc_nmsocket_tls_send_req_t){ .finish = finish }; 392 new_send_req = true; 393 } 394 395 if (new_send_req) { 396 isc_buffer_init(&send_req->data, &send_req->smallbuf, 397 sizeof(send_req->smallbuf)); 398 isc_buffer_setmctx(&send_req->data, sock->worker->mctx); 399 } 400 INSIST(isc_buffer_remaininglength(&send_req->data) == 0); 401 402 isc__nmsocket_attach(sock, &send_req->tlssock); 403 if (cb != NULL) { 404 send_req->cb = cb; 405 send_req->cbarg = cbarg; 406 isc_nmhandle_attach(tlshandle, &send_req->handle); 407 } 408 409 RUNTIME_CHECK(isc_buffer_reserve(&send_req->data, pending) == 410 ISC_R_SUCCESS); 411 isc_buffer_add(&send_req->data, pending); 412 rv = BIO_read_ex(sock->tlsstream.bio_out, 413 isc_buffer_base(&send_req->data), pending, &len); 414 /* There's something pending, read must succeed */ 415 RUNTIME_CHECK(rv == 1 && len == (size_t)pending); 416 417 INSIST(VALID_NMHANDLE(sock->outerhandle)); 418 419 sock->tlsstream.nsending++; 420 isc_buffer_remainingregion(&send_req->data, &used_region); 421 isc_nm_send(sock->outerhandle, &used_region, tls_senddone, send_req); 422 423 return pending; 424 } 425 426 static int 427 tls_process_outgoing(isc_nmsocket_t *sock, bool finish, 428 isc__nm_uvreq_t *send_data) { 429 int pending; 430 431 bool received_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) & 432 SSL_RECEIVED_SHUTDOWN) != 0); 433 bool sent_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) & 434 SSL_SENT_SHUTDOWN) != 0); 435 436 if (received_shutdown && !sent_shutdown) { 437 finish = true; 438 } 439 440 /* Data from TLS to network */ 441 if (send_data != NULL) { 442 pending = tls_send_outgoing(sock, finish, send_data->handle, 443 send_data->cb.send, 444 send_data->cbarg); 445 } else { 446 pending = tls_send_outgoing(sock, finish, NULL, NULL, NULL); 447 } 448 449 return pending; 450 } 451 452 static int 453 tls_try_handshake(isc_nmsocket_t *sock, isc_result_t *presult) { 454 REQUIRE(sock->tlsstream.state == TLS_HANDSHAKE); 455 456 if (SSL_is_init_finished(sock->tlsstream.tls) == 1) { 457 return 0; 458 } 459 460 int rv = SSL_do_handshake(sock->tlsstream.tls); 461 if (rv == 1) { 462 isc_nmhandle_t *tlshandle = NULL; 463 isc_result_t result = ISC_R_SUCCESS; 464 465 REQUIRE(sock->statichandle == NULL); 466 INSIST(SSL_is_init_finished(sock->tlsstream.tls) == 1); 467 468 isc__nmsocket_log_tls_session_reuse(sock, sock->tlsstream.tls); 469 tlshandle = isc__nmhandle_get(sock, &sock->peer, &sock->iface); 470 isc__nmsocket_timer_stop(sock); 471 tls_read_stop(sock); 472 473 if (isc__nm_closing(sock->worker)) { 474 result = ISC_R_SHUTTINGDOWN; 475 } 476 477 if (sock->tlsstream.server) { 478 /* 479 * The listening sockets are now closed from outer 480 * to inner order, which means that this function 481 * will never be called when the outer socket has 482 * stopped listening. 483 * 484 * Also see 'isc__nmsocket_stop()' - the function used 485 * to shut down the listening TLS socket - for more 486 * details. 487 */ 488 if (result == ISC_R_SUCCESS) { 489 result = sock->accept_cb(tlshandle, result, 490 sock->accept_cbarg); 491 } 492 } else { 493 tls_call_connect_cb(sock, tlshandle, result); 494 } 495 isc_nmhandle_detach(&tlshandle); 496 sock->tlsstream.state = TLS_IO; 497 498 if (presult != NULL) { 499 *presult = result; 500 } 501 } 502 503 return rv; 504 } 505 506 static bool 507 tls_try_to_close_unused_socket(isc_nmsocket_t *sock) { 508 if (sock->tlsstream.state > TLS_HANDSHAKE && 509 sock->statichandle == NULL && sock->tlsstream.nsending == 0) 510 { 511 /* 512 * It seems that no action on the socket has been 513 * scheduled on some point after the handshake, let's 514 * close the connection. 515 */ 516 isc__nmsocket_prep_destroy(sock); 517 return true; 518 } 519 520 return false; 521 } 522 523 static void 524 tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data, 525 isc__nm_uvreq_t *send_data, bool finish) { 526 isc_result_t result = ISC_R_SUCCESS; 527 int pending, tls_status = SSL_ERROR_NONE; 528 int rv = 0; 529 size_t len = 0; 530 int saved_errno = 0; 531 532 REQUIRE(VALID_NMSOCK(sock)); 533 REQUIRE(sock->tid == isc_tid()); 534 535 /* 536 * Clear the TLS error queue so that SSL_get_error() and SSL I/O 537 * routine calls will not get affected by prior error statuses. 538 * 539 * See here: 540 * https://www.openssl.org/docs/man3.0/man3/SSL_get_error.html 541 * 542 * In particular, it mentions the following: 543 * 544 * The current thread's error queue must be empty before the 545 * TLS/SSL I/O operation is attempted, or SSL_get_error() will not 546 * work reliably. 547 * 548 * As we use the result of SSL_get_error() to decide on I/O 549 * operations, we need to ensure that it works reliably by 550 * cleaning the error queue. 551 * 552 * The sum of details: https://stackoverflow.com/a/37980911 553 */ 554 ERR_clear_error(); 555 556 if (sock->tlsstream.state == TLS_INIT) { 557 INSIST(received_data == NULL && send_data == NULL); 558 if (sock->tlsstream.server) { 559 SSL_set_accept_state(sock->tlsstream.tls); 560 } else { 561 SSL_set_connect_state(sock->tlsstream.tls); 562 } 563 sock->tlsstream.state = TLS_HANDSHAKE; 564 rv = tls_try_handshake(sock, NULL); 565 INSIST(SSL_is_init_finished(sock->tlsstream.tls) == 0); 566 isc__nmsocket_timer_restart(sock); 567 } else if (sock->tlsstream.state == TLS_CLOSED) { 568 return; 569 } else { /* initialised and doing I/O */ 570 if (received_data != NULL) { 571 INSIST(send_data == NULL); 572 rv = BIO_write_ex(sock->tlsstream.bio_in, 573 received_data->base, 574 received_data->length, &len); 575 if (rv <= 0 || len != received_data->length) { 576 result = ISC_R_TLSERROR; 577 #if ISC_NETMGR_TRACE 578 saved_errno = errno; 579 #endif 580 goto error; 581 } 582 583 /* 584 * Only after doing the IO we can check whether SSL 585 * handshake is done. 586 */ 587 if (sock->tlsstream.state == TLS_HANDSHAKE) { 588 isc_result_t hs_result = ISC_R_UNSET; 589 rv = tls_try_handshake(sock, &hs_result); 590 if (sock->tlsstream.state == TLS_IO && 591 hs_result != ISC_R_SUCCESS) 592 { 593 /* 594 * The accept/connect callback has been 595 * called unsuccessfully. Let's try to 596 * shut down the TLS connection 597 * gracefully. 598 */ 599 INSIST(SSL_is_init_finished( 600 sock->tlsstream.tls) == 601 1); 602 finish = true; 603 } 604 } 605 } else if (send_data != NULL) { 606 INSIST(received_data == NULL); 607 INSIST(sock->tlsstream.state > TLS_HANDSHAKE); 608 bool received_shutdown = 609 ((SSL_get_shutdown(sock->tlsstream.tls) & 610 SSL_RECEIVED_SHUTDOWN) != 0); 611 bool sent_shutdown = 612 ((SSL_get_shutdown(sock->tlsstream.tls) & 613 SSL_SENT_SHUTDOWN) != 0); 614 bool write_failed = false; 615 if (*(uint16_t *)send_data->tcplen != 0) { 616 size_t sendlen = 0; 617 uint8_t sendbuf[MAX_DNS_MESSAGE_SIZE + 618 sizeof(uint16_t)]; 619 /* 620 * There is a DNS message length to write - do 621 * it. 622 */ 623 624 /* 625 * There's no SSL_writev(), so we need to use a 626 * local buffer to assemble the whole message 627 */ 628 INSIST(send_data->uvbuf.len <= 629 MAX_DNS_MESSAGE_SIZE); 630 631 sendlen = send_data->uvbuf.len + 632 sizeof(uint16_t); 633 memmove(sendbuf, send_data->tcplen, 634 sizeof(uint16_t)); 635 memmove(sendbuf + sizeof(uint16_t), 636 send_data->uvbuf.base, 637 send_data->uvbuf.len); 638 639 /* Write data */ 640 rv = SSL_write_ex(sock->tlsstream.tls, sendbuf, 641 sendlen, &len); 642 if (rv != 1 || len != sendlen) { 643 write_failed = true; 644 } 645 } else { 646 /* Write data only */ 647 rv = SSL_write_ex(sock->tlsstream.tls, 648 send_data->uvbuf.base, 649 send_data->uvbuf.len, &len); 650 if (rv != 1 || len != send_data->uvbuf.len) { 651 write_failed = true; 652 } 653 } 654 655 if (write_failed) { 656 result = received_shutdown || sent_shutdown 657 ? ISC_R_CANCELED 658 : ISC_R_TLSERROR; 659 send_data->cb.send(send_data->handle, result, 660 send_data->cbarg); 661 send_data = NULL; 662 return; 663 } 664 } 665 666 /* Decrypt and pass data from network to client */ 667 if (sock->tlsstream.state >= TLS_IO && sock->recv_cb != NULL && 668 sock->statichandle != NULL && sock->reading && !finish) 669 { 670 bool was_new_data = false; 671 uint8_t recv_buf[TLS_BUF_SIZE]; 672 INSIST(sock->tlsstream.state > TLS_HANDSHAKE); 673 while ((rv = SSL_read_ex(sock->tlsstream.tls, recv_buf, 674 TLS_BUF_SIZE, &len)) == 1) 675 { 676 isc_region_t region; 677 region = (isc_region_t){ .base = &recv_buf[0], 678 .length = len }; 679 680 was_new_data = true; 681 INSIST(VALID_NMHANDLE(sock->statichandle)); 682 sock->recv_cb(sock->statichandle, ISC_R_SUCCESS, 683 ®ion, sock->recv_cbarg); 684 /* The handle could have been detached in 685 * sock->recv_cb, making the sock->statichandle 686 * nullified (it happens in netmgr.c). If it is 687 * the case, then it means that we are not 688 * interested in keeping the connection alive 689 * anymore. Let's shut down the SSL session, 690 * send what we have in the SSL buffers, 691 * and close the connection. 692 */ 693 if (sock->statichandle == NULL) { 694 finish = true; 695 break; 696 } else if (sock->recv_cb == NULL) { 697 /* 698 * The 'sock->recv_cb' might have been 699 * nullified during the call to 700 * 'sock->recv_cb'. That could happen, 701 * e.g. by an indirect call to 702 * 'isc_nmhandle_close()' from within 703 * the callback when wrapping up. 704 * 705 * In this case, let's close the TLS 706 * connection. 707 */ 708 finish = true; 709 break; 710 } else if (!sock->reading) { 711 /* 712 * Reading has been paused from withing 713 * the context of read callback - stop 714 * processing incoming data. 715 */ 716 break; 717 } 718 } 719 720 if (was_new_data && !sock->manual_read_timer) { 721 /* 722 * Some data has been decrypted, it is the right 723 * time to stop the read timer as it will be 724 * restarted on the next read attempt. 725 */ 726 isc__nmsocket_timer_stop(sock); 727 } 728 } 729 } 730 731 /* 732 * Setting 'finish' to 'true' means that we are about to close the 733 * TLS stream (we intend to send TLS shutdown message to the 734 * remote side). After that no new data can be received, so we 735 * should stop the timer regardless of the 736 * 'sock->manual_read_timer' value. 737 */ 738 if (finish) { 739 isc__nmsocket_timer_stop(sock); 740 } 741 742 errno = 0; 743 tls_status = SSL_get_error(sock->tlsstream.tls, rv); 744 saved_errno = errno; 745 746 /* See "BUGS" section at: 747 * https://www.openssl.org/docs/man1.1.1/man3/SSL_get_error.html 748 * 749 * It is mentioned there that when TLS status equals 750 * SSL_ERROR_SYSCALL AND errno == 0 it means that underlying 751 * transport layer returned EOF prematurely. However, we are 752 * managing the transport ourselves, so we should just resume 753 * reading from the TCP socket. 754 * 755 * It seems that this case has been handled properly on modern 756 * versions of OpenSSL. That being said, the situation goes in 757 * line with the manual: it is briefly mentioned there that 758 * SSL_ERROR_SYSCALL might be returned not only in a case of 759 * low-level errors (like system call failures). 760 */ 761 if (tls_status == SSL_ERROR_SYSCALL && saved_errno == 0 && 762 received_data == NULL && send_data == NULL && finish == false) 763 { 764 tls_status = SSL_ERROR_WANT_READ; 765 } 766 767 pending = tls_process_outgoing(sock, finish, send_data); 768 if (pending > 0 && tls_status != SSL_ERROR_SSL) { 769 return; 770 } 771 772 switch (tls_status) { 773 case SSL_ERROR_NONE: 774 case SSL_ERROR_ZERO_RETURN: 775 (void)tls_try_to_close_unused_socket(sock); 776 return; 777 case SSL_ERROR_WANT_WRITE: 778 if (sock->tlsstream.nsending == 0) { 779 /* 780 * Launch tls_do_bio asynchronously. If we're sending 781 * already the send callback will call it. 782 */ 783 async_tls_do_bio(sock); 784 } 785 return; 786 case SSL_ERROR_WANT_READ: 787 if (tls_try_to_close_unused_socket(sock) || 788 sock->outerhandle == NULL) 789 { 790 return; 791 } else if (sock->reading == false && 792 sock->tlsstream.state == TLS_HANDSHAKE) 793 { 794 /* 795 * We need to read data when doing handshake even if 796 * 'sock->reading == false'. It will be stopped when 797 * handshake is completed. 798 */ 799 tls_read_start(sock); 800 return; 801 } else if (sock->reading == false) { 802 return; 803 } 804 805 tls_read_start(sock); 806 return; 807 default: 808 result = tls_error_to_result(tls_status, sock->tlsstream.state, 809 sock->tlsstream.tls); 810 break; 811 } 812 813 error: 814 #if ISC_NETMGR_TRACE 815 isc__nmsocket_log(sock, ISC_LOG_NOTICE, 816 "SSL error in BIO: %d %s (errno: %d). Arguments: " 817 "received_data: %p, " 818 "send_data: %p, finish: %s", 819 tls_status, isc_result_totext(result), saved_errno, 820 received_data, send_data, finish ? "true" : "false"); 821 #endif 822 tls_failed_read_cb(sock, result); 823 } 824 825 static void 826 tls_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region, 827 void *cbarg) { 828 isc_nmsocket_t *tlssock = (isc_nmsocket_t *)cbarg; 829 830 REQUIRE(VALID_NMSOCK(tlssock)); 831 REQUIRE(VALID_NMHANDLE(handle)); 832 REQUIRE(tlssock->tid == isc_tid()); 833 834 if (result != ISC_R_SUCCESS) { 835 tls_failed_read_cb(tlssock, result); 836 return; 837 } else if (isc__nmsocket_closing(handle->sock)) { 838 tls_failed_read_cb(tlssock, ISC_R_CANCELED); 839 return; 840 } 841 842 REQUIRE(handle == tlssock->outerhandle); 843 tls_do_bio(tlssock, region, NULL, false); 844 } 845 846 static isc_result_t 847 initialize_tls(isc_nmsocket_t *sock, bool server) { 848 REQUIRE(sock->tid == isc_tid()); 849 850 sock->tlsstream.bio_in = BIO_new(BIO_s_mem()); 851 if (sock->tlsstream.bio_in == NULL) { 852 isc_tls_free(&sock->tlsstream.tls); 853 return ISC_R_TLSERROR; 854 } 855 sock->tlsstream.bio_out = BIO_new(BIO_s_mem()); 856 if (sock->tlsstream.bio_out == NULL) { 857 BIO_free_all(sock->tlsstream.bio_in); 858 sock->tlsstream.bio_in = NULL; 859 isc_tls_free(&sock->tlsstream.tls); 860 return ISC_R_TLSERROR; 861 } 862 863 if (BIO_set_mem_eof_return(sock->tlsstream.bio_in, EOF) != 1 || 864 BIO_set_mem_eof_return(sock->tlsstream.bio_out, EOF) != 1) 865 { 866 goto error; 867 } 868 869 SSL_set_bio(sock->tlsstream.tls, sock->tlsstream.bio_in, 870 sock->tlsstream.bio_out); 871 sock->tlsstream.server = server; 872 sock->tlsstream.nsending = 0; 873 sock->tlsstream.state = TLS_INIT; 874 if (sock->tlsstream.sni_hostname != NULL) { 875 INSIST(sock->client); 876 const int ret = SSL_set_tlsext_host_name( 877 sock->tlsstream.tls, sock->tlsstream.sni_hostname); 878 if (ret != 1) { 879 goto error; 880 } 881 } 882 return ISC_R_SUCCESS; 883 error: 884 isc_tls_free(&sock->tlsstream.tls); 885 sock->tlsstream.bio_out = sock->tlsstream.bio_in = NULL; 886 return ISC_R_TLSERROR; 887 } 888 889 static void 890 tls_try_to_enable_tcp_nodelay(isc_nmsocket_t *tlssock) { 891 /* 892 * Try to enable TCP_NODELAY for TLS connections by default to speed up 893 * the handshakes, just like other software (e.g. NGINX) does. 894 */ 895 isc_result_t result = isc_nmhandle_set_tcp_nodelay(tlssock->outerhandle, 896 true); 897 tlssock->tlsstream.tcp_nodelay_value = (result == ISC_R_SUCCESS); 898 } 899 900 static isc_result_t 901 tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) { 902 isc_nmsocket_t *tlslistensock = (isc_nmsocket_t *)cbarg; 903 isc_nmsocket_t *tlssock = NULL; 904 isc_tlsctx_t *tlsctx = NULL; 905 isc_sockaddr_t local; 906 907 /* If accept() was unsuccessful we can't do anything */ 908 if (result != ISC_R_SUCCESS) { 909 return result; 910 } 911 912 REQUIRE(VALID_NMHANDLE(handle)); 913 REQUIRE(VALID_NMSOCK(handle->sock)); 914 REQUIRE(VALID_NMSOCK(tlslistensock)); 915 REQUIRE(tlslistensock->type == isc_nm_tlslistener); 916 917 if (isc__nm_closing(handle->sock->worker)) { 918 return ISC_R_SHUTTINGDOWN; 919 } else if (isc__nmsocket_closing(handle->sock)) { 920 return ISC_R_CANCELED; 921 } 922 923 local = isc_nmhandle_localaddr(handle); 924 /* 925 * We need to create a 'wrapper' tlssocket for this connection. 926 */ 927 tlssock = isc_mempool_get(handle->sock->worker->nmsocket_pool); 928 isc__nmsocket_init(tlssock, handle->sock->worker, isc_nm_tlssocket, 929 &local, NULL); 930 isc__nmsocket_attach(tlslistensock, &tlssock->server); 931 932 /* We need to initialize SSL now to reference SSL_CTX properly */ 933 tlsctx = tls_get_listener_tlsctx(tlslistensock, isc_tid()); 934 RUNTIME_CHECK(tlsctx != NULL); 935 isc_tlsctx_attach(tlsctx, &tlssock->tlsstream.ctx); 936 tlssock->tlsstream.tls = isc_tls_create(tlssock->tlsstream.ctx); 937 if (tlssock->tlsstream.tls == NULL) { 938 tlssock->closed = true; 939 isc_tlsctx_free(&tlssock->tlsstream.ctx); 940 isc__nmsocket_detach(&tlssock->server); 941 isc__nmsocket_detach(&tlssock); 942 return ISC_R_TLSERROR; 943 } 944 945 tlssock->accept_cb = tlslistensock->accept_cb; 946 tlssock->accept_cbarg = tlslistensock->accept_cbarg; 947 isc__nmsocket_attach(handle->sock, &tlssock->listener); 948 isc_nmhandle_attach(handle, &tlssock->outerhandle); 949 tlssock->peer = isc_nmhandle_peeraddr(handle); 950 tlssock->read_timeout = 951 atomic_load_relaxed(&handle->sock->worker->netmgr->init); 952 953 /* 954 * Hold a reference to tlssock in the TCP socket: it will 955 * detached in isc__nm_tls_cleanup_data(). 956 */ 957 handle->sock->tlsstream.tlssocket = tlssock; 958 959 result = initialize_tls(tlssock, true); 960 RUNTIME_CHECK(result == ISC_R_SUCCESS); 961 /* TODO: catch failure code, detach tlssock, and log the error */ 962 963 tls_try_to_enable_tcp_nodelay(tlssock); 964 965 isc__nmhandle_set_manual_timer(tlssock->outerhandle, true); 966 tls_do_bio(tlssock, NULL, NULL, false); 967 return result; 968 } 969 970 isc_result_t 971 isc_nm_listentls(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface, 972 isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog, 973 isc_quota_t *quota, SSL_CTX *sslctx, bool proxy, 974 isc_nmsocket_t **sockp) { 975 isc_result_t result; 976 isc_nmsocket_t *tlssock = NULL; 977 isc_nmsocket_t *tsock = NULL; 978 isc__networker_t *worker = NULL; 979 980 REQUIRE(VALID_NM(mgr)); 981 REQUIRE(isc_tid() == 0); 982 983 worker = &mgr->workers[isc_tid()]; 984 985 if (isc__nm_closing(worker)) { 986 return ISC_R_SHUTTINGDOWN; 987 } 988 989 if (workers == 0) { 990 workers = mgr->nloops; 991 } 992 REQUIRE(workers <= mgr->nloops); 993 994 tlssock = isc_mempool_get(worker->nmsocket_pool); 995 isc__nmsocket_init(tlssock, worker, isc_nm_tlslistener, iface, NULL); 996 tlssock->accept_cb = accept_cb; 997 tlssock->accept_cbarg = accept_cbarg; 998 tls_init_listener_tlsctx(tlssock, sslctx); 999 tlssock->tlsstream.tls = NULL; 1000 1001 /* 1002 * tlssock will be a TLS 'wrapper' around an unencrypted stream. 1003 * We set tlssock->outer to a socket listening for a TCP connection. 1004 */ 1005 if (proxy) { 1006 result = isc_nm_listenproxystream( 1007 mgr, workers, iface, tlslisten_acceptcb, tlssock, 1008 backlog, quota, NULL, &tlssock->outer); 1009 } else { 1010 result = isc_nm_listentcp(mgr, workers, iface, 1011 tlslisten_acceptcb, tlssock, backlog, 1012 quota, &tlssock->outer); 1013 } 1014 if (result != ISC_R_SUCCESS) { 1015 tlssock->closed = true; 1016 isc__nmsocket_detach(&tlssock); 1017 return result; 1018 } 1019 1020 /* copy the actual port we're listening on into sock->iface */ 1021 if (isc_sockaddr_getport(iface) == 0) { 1022 tlssock->iface = tlssock->outer->iface; 1023 } 1024 1025 /* wait for listen result */ 1026 isc__nmsocket_attach(tlssock->outer, &tsock); 1027 tlssock->result = result; 1028 tlssock->active = true; 1029 INSIST(tlssock->outer->tlsstream.tlslistener == NULL); 1030 isc__nmsocket_attach(tlssock, &tlssock->outer->tlsstream.tlslistener); 1031 isc__nmsocket_detach(&tsock); 1032 INSIST(result != ISC_R_UNSET); 1033 tlssock->nchildren = tlssock->outer->nchildren; 1034 1035 if (result == ISC_R_SUCCESS) { 1036 *sockp = tlssock; 1037 } 1038 1039 return result; 1040 } 1041 1042 static void 1043 tls_send_direct(void *arg) { 1044 isc__nm_uvreq_t *req = arg; 1045 1046 REQUIRE(VALID_UVREQ(req)); 1047 1048 isc_nmsocket_t *sock = req->sock; 1049 1050 REQUIRE(VALID_NMSOCK(sock)); 1051 REQUIRE(sock->tid == isc_tid()); 1052 1053 if (isc__nm_closing(sock->worker)) { 1054 req->cb.send(req->handle, ISC_R_SHUTTINGDOWN, req->cbarg); 1055 goto done; 1056 } else if (inactive(sock)) { 1057 req->cb.send(req->handle, ISC_R_CANCELED, req->cbarg); 1058 goto done; 1059 } 1060 1061 tls_do_bio(sock, NULL, req, false); 1062 done: 1063 isc__nm_uvreq_put(&req); 1064 return; 1065 } 1066 1067 static void 1068 tls_send(isc_nmhandle_t *handle, const isc_region_t *region, isc_nm_cb_t cb, 1069 void *cbarg, const bool dnsmsg) { 1070 isc__nm_uvreq_t *uvreq = NULL; 1071 isc_nmsocket_t *sock = NULL; 1072 1073 REQUIRE(VALID_NMHANDLE(handle)); 1074 REQUIRE(VALID_NMSOCK(handle->sock)); 1075 1076 sock = handle->sock; 1077 1078 REQUIRE(sock->type == isc_nm_tlssocket); 1079 1080 uvreq = isc__nm_uvreq_get(sock); 1081 isc_nmhandle_attach(handle, &uvreq->handle); 1082 uvreq->cb.send = cb; 1083 uvreq->cbarg = cbarg; 1084 uvreq->uvbuf.base = (char *)region->base; 1085 uvreq->uvbuf.len = region->length; 1086 if (dnsmsg) { 1087 *(uint16_t *)uvreq->tcplen = htons(region->length); 1088 } 1089 1090 isc_job_run(sock->worker->loop, &uvreq->job, tls_send_direct, uvreq); 1091 } 1092 1093 void 1094 isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region, 1095 isc_nm_cb_t cb, void *cbarg) { 1096 tls_send(handle, region, cb, cbarg, false); 1097 } 1098 1099 void 1100 isc__nm_tls_senddns(isc_nmhandle_t *handle, const isc_region_t *region, 1101 isc_nm_cb_t cb, void *cbarg) { 1102 tls_send(handle, region, cb, cbarg, true); 1103 } 1104 1105 void 1106 isc__nm_tls_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) { 1107 isc_nmsocket_t *sock = NULL; 1108 1109 REQUIRE(VALID_NMHANDLE(handle)); 1110 1111 sock = handle->sock; 1112 REQUIRE(VALID_NMSOCK(sock)); 1113 REQUIRE(sock->statichandle == handle); 1114 REQUIRE(sock->tid == isc_tid()); 1115 1116 if (isc__nm_closing(sock->worker)) { 1117 cb(handle, ISC_R_SHUTTINGDOWN, NULL, cbarg); 1118 return; 1119 } else if (inactive(sock)) { 1120 cb(handle, ISC_R_CANCELED, NULL, cbarg); 1121 return; 1122 } 1123 1124 sock->recv_cb = cb; 1125 sock->recv_cbarg = cbarg; 1126 sock->reading = true; 1127 1128 async_tls_do_bio(sock); 1129 } 1130 1131 static void 1132 tls_read_start(isc_nmsocket_t *restrict sock) { 1133 if (sock->tlsstream.reading) { 1134 return; 1135 } 1136 sock->tlsstream.reading = true; 1137 1138 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1139 1140 isc_nm_read(sock->outerhandle, tls_readcb, sock); 1141 if (!sock->manual_read_timer) { 1142 isc__nmsocket_timer_start(sock); 1143 } 1144 } 1145 1146 static void 1147 tls_read_stop(isc_nmsocket_t *sock) { 1148 sock->tlsstream.reading = false; 1149 if (sock->outerhandle != NULL) { 1150 isc_nm_read_stop(sock->outerhandle); 1151 } 1152 } 1153 1154 void 1155 isc__nm_tls_read_stop(isc_nmhandle_t *handle) { 1156 REQUIRE(VALID_NMHANDLE(handle)); 1157 REQUIRE(VALID_NMSOCK(handle->sock)); 1158 1159 handle->sock->reading = false; 1160 1161 if (!handle->sock->manual_read_timer) { 1162 isc__nmsocket_timer_stop(handle->sock); 1163 } 1164 1165 tls_read_stop(handle->sock); 1166 } 1167 1168 void 1169 isc__nm_tls_close(isc_nmsocket_t *sock) { 1170 REQUIRE(VALID_NMSOCK(sock)); 1171 REQUIRE(sock->type == isc_nm_tlssocket); 1172 REQUIRE(!sock->closing); 1173 REQUIRE(sock->tid == isc_tid()); 1174 REQUIRE(!sock->closed); 1175 REQUIRE(!sock->closing); 1176 1177 sock->closing = true; 1178 1179 /* 1180 * At this point we're certain that there are no 1181 * external references, we can close everything. 1182 */ 1183 tls_read_stop(sock); 1184 if (sock->outerhandle != NULL) { 1185 isc__nmsocket_timer_stop(sock); 1186 isc_nm_read_stop(sock->outerhandle); 1187 isc_nmhandle_close(sock->outerhandle); 1188 isc_nmhandle_detach(&sock->outerhandle); 1189 } 1190 1191 if (sock->listener != NULL) { 1192 isc__nmsocket_detach(&sock->listener); 1193 } 1194 1195 if (sock->server != NULL) { 1196 isc__nmsocket_detach(&sock->server); 1197 } 1198 1199 /* Further cleanup performed in isc__nm_tls_cleanup_data() */ 1200 sock->closed = true; 1201 sock->active = false; 1202 sock->tlsstream.state = TLS_CLOSED; 1203 } 1204 1205 void 1206 isc__nm_tls_stoplistening(isc_nmsocket_t *sock) { 1207 REQUIRE(VALID_NMSOCK(sock)); 1208 REQUIRE(sock->type == isc_nm_tlslistener); 1209 REQUIRE(sock->tlsstream.tls == NULL); 1210 REQUIRE(sock->tlsstream.ctx == NULL); 1211 1212 isc__nmsocket_stop(sock); 1213 } 1214 1215 static void 1216 tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg); 1217 1218 void 1219 isc_nm_tlsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer, 1220 isc_nm_cb_t connect_cb, void *connect_cbarg, 1221 isc_tlsctx_t *ctx, const char *sni_hostname, 1222 isc_tlsctx_client_session_cache_t *client_sess_cache, 1223 unsigned int timeout, bool proxy, 1224 isc_nm_proxyheader_info_t *proxy_info) { 1225 isc_nmsocket_t *sock = NULL; 1226 isc__networker_t *worker = NULL; 1227 1228 REQUIRE(VALID_NM(mgr)); 1229 1230 worker = &mgr->workers[isc_tid()]; 1231 1232 if (isc__nm_closing(worker)) { 1233 connect_cb(NULL, ISC_R_SHUTTINGDOWN, connect_cbarg); 1234 return; 1235 } 1236 1237 sock = isc_mempool_get(worker->nmsocket_pool); 1238 isc__nmsocket_init(sock, worker, isc_nm_tlssocket, local, NULL); 1239 sock->connect_cb = connect_cb; 1240 sock->connect_cbarg = connect_cbarg; 1241 sock->connect_timeout = timeout; 1242 isc_tlsctx_attach(ctx, &sock->tlsstream.ctx); 1243 if (sni_hostname != NULL) { 1244 sock->tlsstream.sni_hostname = 1245 isc_mem_strdup(sock->worker->mctx, sni_hostname); 1246 } 1247 sock->client = true; 1248 if (client_sess_cache != NULL) { 1249 INSIST(isc_tlsctx_client_session_cache_getctx( 1250 client_sess_cache) == ctx); 1251 isc_tlsctx_client_session_cache_attach( 1252 client_sess_cache, &sock->tlsstream.client_sess_cache); 1253 } 1254 1255 if (proxy) { 1256 isc_nm_proxystreamconnect(mgr, local, peer, tcp_connected, sock, 1257 sock->connect_timeout, NULL, NULL, 1258 NULL, proxy_info); 1259 } else { 1260 isc_nm_tcpconnect(mgr, local, peer, tcp_connected, sock, 1261 sock->connect_timeout); 1262 } 1263 } 1264 1265 static void 1266 tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) { 1267 isc_nmsocket_t *tlssock = (isc_nmsocket_t *)cbarg; 1268 isc_nmhandle_t *tlshandle = NULL; 1269 isc__networker_t *worker = NULL; 1270 1271 REQUIRE(VALID_NMSOCK(tlssock)); 1272 1273 worker = tlssock->worker; 1274 1275 if (result != ISC_R_SUCCESS) { 1276 goto error; 1277 } 1278 1279 INSIST(VALID_NMHANDLE(handle)); 1280 1281 tlssock->iface = isc_nmhandle_localaddr(handle); 1282 tlssock->peer = isc_nmhandle_peeraddr(handle); 1283 if (isc__nm_closing(worker)) { 1284 result = ISC_R_SHUTTINGDOWN; 1285 goto error; 1286 } else if (isc__nmsocket_closing(handle->sock)) { 1287 result = ISC_R_CANCELED; 1288 goto error; 1289 } 1290 1291 /* 1292 * We need to initialize SSL now to reference SSL_CTX properly. 1293 */ 1294 tlssock->tlsstream.tls = isc_tls_create(tlssock->tlsstream.ctx); 1295 if (tlssock->tlsstream.tls == NULL) { 1296 result = ISC_R_TLSERROR; 1297 goto error; 1298 } 1299 1300 result = initialize_tls(tlssock, false); 1301 if (result != ISC_R_SUCCESS) { 1302 goto error; 1303 } 1304 tlssock->peer = isc_nmhandle_peeraddr(handle); 1305 isc_nmhandle_attach(handle, &tlssock->outerhandle); 1306 tlssock->active = true; 1307 1308 if (tlssock->tlsstream.client_sess_cache != NULL) { 1309 isc_tlsctx_client_session_cache_reuse_sockaddr( 1310 tlssock->tlsstream.client_sess_cache, &tlssock->peer, 1311 tlssock->tlsstream.tls); 1312 } 1313 1314 /* 1315 * Hold a reference to tlssock in the TCP socket: it will 1316 * detached in isc__nm_tls_cleanup_data(). 1317 */ 1318 handle->sock->tlsstream.tlssocket = tlssock; 1319 1320 tls_try_to_enable_tcp_nodelay(tlssock); 1321 1322 isc__nmhandle_set_manual_timer(tlssock->outerhandle, true); 1323 tls_do_bio(tlssock, NULL, NULL, false); 1324 return; 1325 error: 1326 tlshandle = isc__nmhandle_get(tlssock, NULL, NULL); 1327 tlssock->closed = true; 1328 tls_call_connect_cb(tlssock, tlshandle, result); 1329 isc_nmhandle_detach(&tlshandle); 1330 isc__nmsocket_detach(&tlssock); 1331 } 1332 1333 void 1334 isc__nm_tls_cleanup_data(isc_nmsocket_t *sock) { 1335 if ((sock->type == isc_nm_tcplistener || 1336 sock->type == isc_nm_proxystreamlistener) && 1337 sock->tlsstream.tlslistener != NULL) 1338 { 1339 isc__nmsocket_detach(&sock->tlsstream.tlslistener); 1340 } else if (sock->type == isc_nm_tlslistener) { 1341 tls_cleanup_listener_tlsctx(sock); 1342 } else if (sock->type == isc_nm_tlssocket) { 1343 if (sock->tlsstream.tls != NULL) { 1344 /* 1345 * Let's shut down the TLS session properly so that 1346 * the session will remain resumable, if required. 1347 */ 1348 tls_try_shutdown(sock->tlsstream.tls, true); 1349 tls_keep_client_tls_session(sock); 1350 isc_tls_free(&sock->tlsstream.tls); 1351 /* These are destroyed when we free SSL */ 1352 sock->tlsstream.bio_out = NULL; 1353 sock->tlsstream.bio_in = NULL; 1354 } 1355 if (sock->tlsstream.ctx != NULL) { 1356 isc_tlsctx_free(&sock->tlsstream.ctx); 1357 } 1358 if (sock->tlsstream.sni_hostname != NULL) { 1359 isc_mem_free(sock->worker->mctx, 1360 sock->tlsstream.sni_hostname); 1361 } 1362 if (sock->tlsstream.client_sess_cache != NULL) { 1363 INSIST(sock->client); 1364 isc_tlsctx_client_session_cache_detach( 1365 &sock->tlsstream.client_sess_cache); 1366 } 1367 1368 if (sock->tlsstream.send_req != NULL) { 1369 isc_buffer_clearmctx(&sock->tlsstream.send_req->data); 1370 isc_buffer_invalidate(&sock->tlsstream.send_req->data); 1371 isc_mem_put(sock->worker->mctx, 1372 sock->tlsstream.send_req, 1373 sizeof(*sock->tlsstream.send_req)); 1374 } 1375 } else if ((sock->type == isc_nm_tcpsocket || 1376 sock->type == isc_nm_proxystreamsocket) && 1377 sock->tlsstream.tlssocket != NULL) 1378 { 1379 /* 1380 * The TLS socket can't be destroyed until its underlying TCP 1381 * socket is, to avoid possible use-after-free errors. 1382 */ 1383 isc__nmsocket_detach(&sock->tlsstream.tlssocket); 1384 } 1385 } 1386 1387 void 1388 isc__nm_tls_cleartimeout(isc_nmhandle_t *handle) { 1389 isc_nmsocket_t *sock = NULL; 1390 1391 REQUIRE(VALID_NMHANDLE(handle)); 1392 REQUIRE(VALID_NMSOCK(handle->sock)); 1393 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1394 1395 sock = handle->sock; 1396 if (sock->outerhandle != NULL) { 1397 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1398 isc_nmhandle_cleartimeout(sock->outerhandle); 1399 } 1400 } 1401 1402 void 1403 isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout) { 1404 isc_nmsocket_t *sock = NULL; 1405 1406 REQUIRE(VALID_NMHANDLE(handle)); 1407 REQUIRE(VALID_NMSOCK(handle->sock)); 1408 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1409 1410 sock = handle->sock; 1411 if (sock->outerhandle != NULL) { 1412 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1413 isc_nmhandle_settimeout(sock->outerhandle, timeout); 1414 } 1415 } 1416 1417 void 1418 isc__nmhandle_tls_keepalive(isc_nmhandle_t *handle, bool value) { 1419 isc_nmsocket_t *sock = NULL; 1420 1421 REQUIRE(VALID_NMHANDLE(handle)); 1422 REQUIRE(VALID_NMSOCK(handle->sock)); 1423 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1424 1425 sock = handle->sock; 1426 if (sock->outerhandle != NULL) { 1427 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1428 1429 isc_nmhandle_keepalive(sock->outerhandle, value); 1430 } 1431 } 1432 1433 void 1434 isc__nmhandle_tls_setwritetimeout(isc_nmhandle_t *handle, 1435 uint64_t write_timeout) { 1436 isc_nmsocket_t *sock = NULL; 1437 1438 REQUIRE(VALID_NMHANDLE(handle)); 1439 REQUIRE(VALID_NMSOCK(handle->sock)); 1440 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1441 1442 sock = handle->sock; 1443 if (sock->outerhandle != NULL) { 1444 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1445 1446 isc_nmhandle_setwritetimeout(sock->outerhandle, write_timeout); 1447 } 1448 } 1449 1450 void 1451 isc__nmsocket_tls_reset(isc_nmsocket_t *sock) { 1452 REQUIRE(VALID_NMSOCK(sock)); 1453 REQUIRE(sock->type == isc_nm_tlssocket); 1454 1455 if (sock->outerhandle != NULL) { 1456 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1457 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1458 isc__nmsocket_reset(sock->outerhandle->sock); 1459 } 1460 } 1461 1462 bool 1463 isc__nmsocket_tls_timer_running(isc_nmsocket_t *sock) { 1464 REQUIRE(VALID_NMSOCK(sock)); 1465 REQUIRE(sock->type == isc_nm_tlssocket); 1466 1467 if (sock->outerhandle != NULL) { 1468 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1469 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1470 return isc__nmsocket_timer_running(sock->outerhandle->sock); 1471 } 1472 1473 return false; 1474 } 1475 1476 void 1477 isc__nmsocket_tls_timer_restart(isc_nmsocket_t *sock) { 1478 REQUIRE(VALID_NMSOCK(sock)); 1479 REQUIRE(sock->type == isc_nm_tlssocket); 1480 1481 if (sock->outerhandle != NULL) { 1482 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1483 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1484 isc__nmsocket_timer_restart(sock->outerhandle->sock); 1485 } 1486 } 1487 1488 void 1489 isc__nmsocket_tls_timer_stop(isc_nmsocket_t *sock) { 1490 REQUIRE(VALID_NMSOCK(sock)); 1491 REQUIRE(sock->type == isc_nm_tlssocket); 1492 1493 if (sock->outerhandle != NULL) { 1494 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1495 REQUIRE(VALID_NMSOCK(sock->outerhandle->sock)); 1496 isc__nmsocket_timer_stop(sock->outerhandle->sock); 1497 } 1498 } 1499 1500 const char * 1501 isc__nm_tls_verify_tls_peer_result_string(const isc_nmhandle_t *handle) { 1502 isc_nmsocket_t *sock = NULL; 1503 1504 REQUIRE(VALID_NMHANDLE(handle)); 1505 REQUIRE(VALID_NMSOCK(handle->sock)); 1506 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1507 1508 sock = handle->sock; 1509 if (sock->tlsstream.tls == NULL) { 1510 return NULL; 1511 } 1512 1513 return isc_tls_verify_peer_result_string(sock->tlsstream.tls); 1514 } 1515 1516 static void 1517 tls_init_listener_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *ctx) { 1518 size_t nworkers; 1519 1520 REQUIRE(VALID_NMSOCK(listener)); 1521 REQUIRE(ctx != NULL); 1522 1523 nworkers = 1524 (size_t)isc_loopmgr_nloops(listener->worker->netmgr->loopmgr); 1525 INSIST(nworkers > 0); 1526 1527 listener->tlsstream.listener_tls_ctx = isc_mem_cget( 1528 listener->worker->mctx, nworkers, sizeof(isc_tlsctx_t *)); 1529 listener->tlsstream.n_listener_tls_ctx = nworkers; 1530 for (size_t i = 0; i < nworkers; i++) { 1531 listener->tlsstream.listener_tls_ctx[i] = NULL; 1532 isc_tlsctx_attach(ctx, 1533 &listener->tlsstream.listener_tls_ctx[i]); 1534 } 1535 } 1536 1537 static void 1538 tls_cleanup_listener_tlsctx(isc_nmsocket_t *listener) { 1539 REQUIRE(VALID_NMSOCK(listener)); 1540 1541 if (listener->tlsstream.listener_tls_ctx == NULL) { 1542 return; 1543 } 1544 1545 for (size_t i = 0; i < listener->tlsstream.n_listener_tls_ctx; i++) { 1546 isc_tlsctx_free(&listener->tlsstream.listener_tls_ctx[i]); 1547 } 1548 isc_mem_cput( 1549 listener->worker->mctx, listener->tlsstream.listener_tls_ctx, 1550 listener->tlsstream.n_listener_tls_ctx, sizeof(isc_tlsctx_t *)); 1551 listener->tlsstream.n_listener_tls_ctx = 0; 1552 } 1553 1554 static isc_tlsctx_t * 1555 tls_get_listener_tlsctx(isc_nmsocket_t *listener, const int tid) { 1556 REQUIRE(VALID_NMSOCK(listener)); 1557 REQUIRE(tid >= 0); 1558 1559 if (listener->tlsstream.listener_tls_ctx == NULL) { 1560 return NULL; 1561 } 1562 1563 return listener->tlsstream.listener_tls_ctx[tid]; 1564 } 1565 1566 void 1567 isc__nm_async_tls_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx, 1568 const int tid) { 1569 REQUIRE(tid >= 0); 1570 1571 isc_tlsctx_free(&listener->tlsstream.listener_tls_ctx[tid]); 1572 isc_tlsctx_attach(tlsctx, &listener->tlsstream.listener_tls_ctx[tid]); 1573 } 1574 1575 static void 1576 tls_keep_client_tls_session(isc_nmsocket_t *sock) { 1577 /* 1578 * Ensure that the isc_tls_t is being accessed from 1579 * within the worker thread the socket is bound to. 1580 */ 1581 REQUIRE(sock->tid == isc_tid()); 1582 if (sock->tlsstream.client_sess_cache != NULL && 1583 sock->tlsstream.client_session_saved == false) 1584 { 1585 INSIST(sock->client); 1586 isc_tlsctx_client_session_cache_keep_sockaddr( 1587 sock->tlsstream.client_sess_cache, &sock->peer, 1588 sock->tlsstream.tls); 1589 sock->tlsstream.client_session_saved = true; 1590 } 1591 } 1592 1593 static void 1594 tls_try_shutdown(isc_tls_t *tls, const bool force) { 1595 if (force) { 1596 (void)SSL_set_shutdown(tls, SSL_SENT_SHUTDOWN); 1597 } else if ((SSL_get_shutdown(tls) & SSL_SENT_SHUTDOWN) == 0) { 1598 (void)SSL_shutdown(tls); 1599 } 1600 } 1601 1602 void 1603 isc__nmhandle_tls_set_manual_timer(isc_nmhandle_t *handle, const bool manual) { 1604 isc_nmsocket_t *sock; 1605 1606 REQUIRE(VALID_NMHANDLE(handle)); 1607 sock = handle->sock; 1608 REQUIRE(VALID_NMSOCK(sock)); 1609 REQUIRE(sock->type == isc_nm_tlssocket); 1610 REQUIRE(sock->tid == isc_tid()); 1611 1612 sock->manual_read_timer = manual; 1613 } 1614 1615 void 1616 isc__nmhandle_tls_get_selected_alpn(isc_nmhandle_t *handle, 1617 const unsigned char **alpn, 1618 unsigned int *alpnlen) { 1619 isc_nmsocket_t *sock; 1620 1621 REQUIRE(VALID_NMHANDLE(handle)); 1622 sock = handle->sock; 1623 REQUIRE(VALID_NMSOCK(sock)); 1624 REQUIRE(sock->type == isc_nm_tlssocket); 1625 REQUIRE(sock->tid == isc_tid()); 1626 1627 isc_tls_get_selected_alpn(sock->tlsstream.tls, alpn, alpnlen); 1628 } 1629 1630 isc_result_t 1631 isc__nmhandle_tls_set_tcp_nodelay(isc_nmhandle_t *handle, const bool value) { 1632 isc_nmsocket_t *sock = NULL; 1633 isc_result_t result = ISC_R_FAILURE; 1634 1635 REQUIRE(VALID_NMHANDLE(handle)); 1636 REQUIRE(VALID_NMSOCK(handle->sock)); 1637 REQUIRE(handle->sock->type == isc_nm_tlssocket); 1638 1639 sock = handle->sock; 1640 if (sock->outerhandle != NULL) { 1641 INSIST(VALID_NMHANDLE(sock->outerhandle)); 1642 1643 if (value == sock->tlsstream.tcp_nodelay_value) { 1644 result = ISC_R_SUCCESS; 1645 } else { 1646 result = isc_nmhandle_set_tcp_nodelay(sock->outerhandle, 1647 value); 1648 if (result == ISC_R_SUCCESS) { 1649 sock->tlsstream.tcp_nodelay_value = value; 1650 } 1651 } 1652 } 1653 1654 return result; 1655 } 1656
Indexes created Sat Jun 13 00:24:39 UTC 2026