aboutsummaryrefslogtreecommitdiffstats
path: root/src/libtls
diff options
context:
space:
mode:
Diffstat (limited to 'src/libtls')
-rw-r--r--src/libtls/tls.c14
-rw-r--r--src/libtls/tls.h14
-rw-r--r--src/libtls/tls_fragmentation.c8
-rw-r--r--src/libtls/tls_socket.c255
-rw-r--r--src/libtls/tls_socket.h23
5 files changed, 230 insertions, 84 deletions
diff --git a/src/libtls/tls.c b/src/libtls/tls.c
index dea08e3eb..85a05a00b 100644
--- a/src/libtls/tls.c
+++ b/src/libtls/tls.c
@@ -359,6 +359,18 @@ METHOD(tls_t, is_server, bool,
return this->is_server;
}
+METHOD(tls_t, get_server_id, identification_t*,
+ private_tls_t *this)
+{
+ return this->server;
+}
+
+METHOD(tls_t, get_peer_id, identification_t*,
+ private_tls_t *this)
+{
+ return this->peer;
+}
+
METHOD(tls_t, get_version, tls_version_t,
private_tls_t *this)
{
@@ -457,6 +469,8 @@ tls_t *tls_create(bool is_server, identification_t *server,
.process = _process,
.build = _build,
.is_server = _is_server,
+ .get_server_id = _get_server_id,
+ .get_peer_id = _get_peer_id,
.get_version = _get_version,
.set_version = _set_version,
.get_purpose = _get_purpose,
diff --git a/src/libtls/tls.h b/src/libtls/tls.h
index 6b4876f73..c8186b829 100644
--- a/src/libtls/tls.h
+++ b/src/libtls/tls.h
@@ -193,6 +193,20 @@ struct tls_t {
bool (*is_server)(tls_t *this);
/**
+ * Return the server identity
+ *
+ * @return Server identity
+ */
+ identification_t* (*get_server_id)(tls_t *this);
+
+ /**
+ * Return the peer identity
+ *
+ * @return Peer identity
+ */
+ identification_t* (*get_peer_id)(tls_t *this);
+
+ /**
* Get the negotiated TLS/SSL version.
*
* @return negotiated TLS version
diff --git a/src/libtls/tls_fragmentation.c b/src/libtls/tls_fragmentation.c
index c76376b43..6e4347e3c 100644
--- a/src/libtls/tls_fragmentation.c
+++ b/src/libtls/tls_fragmentation.c
@@ -223,7 +223,7 @@ static status_t process_application(private_tls_fragmentation_t *this,
continue;
case SUCCESS:
this->application_finished = TRUE;
- return SUCCESS;
+ /* FALL */
case FAILED:
default:
this->alert->add(this->alert, TLS_FATAL, TLS_CLOSE_NOTIFY);
@@ -368,7 +368,7 @@ static status_t build_application(private_tls_fragmentation_t *this)
break;
case SUCCESS:
this->application_finished = TRUE;
- break;
+ /* FALL */
case FAILED:
default:
this->alert->add(this->alert, TLS_FATAL, TLS_CLOSE_NOTIFY);
@@ -391,6 +391,10 @@ METHOD(tls_fragmentation_t, build, status_t,
this->state = ALERT_SENT;
return INVALID_STATE;
case ALERT_SENT:
+ if (this->application_finished)
+ {
+ return SUCCESS;
+ }
return FAILED;
case ALERT_NONE:
break;
diff --git a/src/libtls/tls_socket.c b/src/libtls/tls_socket.c
index 75b714e30..52e2cd629 100644
--- a/src/libtls/tls_socket.c
+++ b/src/libtls/tls_socket.c
@@ -42,14 +42,39 @@ struct private_tls_application_t {
tls_application_t application;
/**
- * Chunk of data to send
+ * Output buffer to write to
*/
chunk_t out;
/**
- * Chunk of data received
+ * Number of bytes written to out
+ */
+ size_t out_done;
+
+ /**
+ * Input buffer to read to
*/
chunk_t in;
+
+ /**
+ * Number of bytes read to in
+ */
+ size_t in_done;
+
+ /**
+ * Cached input data
+ */
+ chunk_t cache;
+
+ /**
+ * Bytes cosnumed in cache
+ */
+ size_t cache_done;
+
+ /**
+ * Close TLS connection?
+ */
+ bool close;
};
/**
@@ -82,22 +107,44 @@ METHOD(tls_application_t, process, status_t,
private_tls_application_t *this, bio_reader_t *reader)
{
chunk_t data;
+ size_t len;
- if (!reader->read_data(reader, reader->remaining(reader), &data))
+ if (this->close)
{
- return FAILED;
+ return SUCCESS;
+ }
+ len = min(reader->remaining(reader), this->in.len - this->in_done);
+ if (len)
+ { /* copy to read buffer as much as fits in */
+ if (!reader->read_data(reader, len, &data))
+ {
+ return FAILED;
+ }
+ memcpy(this->in.ptr + this->in_done, data.ptr, data.len);
+ this->in_done += data.len;
+ }
+ else
+ { /* read buffer is full, cache for next read */
+ if (!reader->read_data(reader, reader->remaining(reader), &data))
+ {
+ return FAILED;
+ }
+ this->cache = chunk_cat("mc", this->cache, data);
}
- this->in = chunk_cat("mc", this->in, data);
return NEED_MORE;
}
METHOD(tls_application_t, build, status_t,
private_tls_application_t *this, bio_writer_t *writer)
{
- if (this->out.len)
+ if (this->close)
+ {
+ return SUCCESS;
+ }
+ if (this->out.len > this->out_done)
{
writer->write_data(writer, this->out);
- this->out = chunk_empty;
+ this->out_done = this->out.len;
return NEED_MORE;
}
return INVALID_STATE;
@@ -106,11 +153,11 @@ METHOD(tls_application_t, build, status_t,
/**
* TLS data exchange loop
*/
-static bool exchange(private_tls_socket_t *this, bool wr)
+static bool exchange(private_tls_socket_t *this, bool wr, bool block)
{
char buf[CRYPTO_BUF_SIZE], *pos;
ssize_t len, out;
- int round = 0;
+ int round = 0, flags;
for (round = 0; TRUE; round++)
{
@@ -137,6 +184,8 @@ static bool exchange(private_tls_socket_t *this, bool wr)
continue;
case INVALID_STATE:
break;
+ case SUCCESS:
+ return TRUE;
default:
return FALSE;
}
@@ -144,55 +193,97 @@ static bool exchange(private_tls_socket_t *this, bool wr)
}
if (wr)
{
- if (this->app.out.len == 0)
+ if (this->app.out_done == this->app.out.len)
{ /* all data written */
return TRUE;
}
}
else
{
- if (this->app.in.len)
- { /* some data received */
+ if (this->app.in_done == this->app.in.len)
+ { /* buffer fully received */
return TRUE;
}
- if (round > 0)
- { /* did some handshaking, return empty chunk to not block */
- return TRUE;
+ }
+
+ flags = 0;
+ if (this->app.out_done == this->app.out.len)
+ {
+ if (!block || this->app.in_done)
+ {
+ flags |= MSG_DONTWAIT;
}
}
- len = read(this->fd, buf, sizeof(buf));
- if (len <= 0)
+ len = recv(this->fd, buf, sizeof(buf), flags);
+ if (len < 0)
{
+ if (errno == EAGAIN || errno == EWOULDBLOCK)
+ {
+ if (this->app.in_done == 0)
+ {
+ /* reading, nothing got yet, and call would block */
+ errno = EWOULDBLOCK;
+ this->app.in_done = -1;
+ }
+ return TRUE;
+ }
return FALSE;
}
- if (this->tls->process(this->tls, buf, len) != NEED_MORE)
+ if (len == 0)
+ { /* EOF */
+ return TRUE;
+ }
+ switch (this->tls->process(this->tls, buf, len))
{
- return FALSE;
+ case NEED_MORE:
+ break;
+ case SUCCESS:
+ return TRUE;
+ default:
+ return FALSE;
}
}
}
-METHOD(tls_socket_t, read_, bool,
- private_tls_socket_t *this, chunk_t *buf)
+METHOD(tls_socket_t, read_, ssize_t,
+ private_tls_socket_t *this, void *buf, size_t len, bool block)
{
- if (exchange(this, FALSE))
+ if (this->app.cache.len)
+ {
+ size_t cache;
+
+ cache = min(len, this->app.cache.len - this->app.cache_done);
+ memcpy(buf, this->app.cache.ptr + this->app.cache_done, cache);
+
+ this->app.cache_done += cache;
+ if (this->app.cache_done == this->app.cache.len)
+ {
+ chunk_free(&this->app.cache);
+ this->app.cache_done = 0;
+ }
+ return cache;
+ }
+ this->app.in.ptr = buf;
+ this->app.in.len = len;
+ this->app.in_done = 0;
+ if (exchange(this, FALSE, block))
{
- *buf = this->app.in;
- this->app.in = chunk_empty;
- return TRUE;
+ return this->app.in_done;
}
- return FALSE;
+ return -1;
}
-METHOD(tls_socket_t, write_, bool,
- private_tls_socket_t *this, chunk_t buf)
+METHOD(tls_socket_t, write_, ssize_t,
+ private_tls_socket_t *this, void *buf, size_t len)
{
- this->app.out = buf;
- if (exchange(this, TRUE))
+ this->app.out.ptr = buf;
+ this->app.out.len = len;
+ this->app.out_done = 0;
+ if (exchange(this, TRUE, FALSE))
{
- return TRUE;
+ return this->app.out_done;
}
- return FALSE;
+ return -1;
}
METHOD(tls_socket_t, splice, bool,
@@ -200,68 +291,85 @@ METHOD(tls_socket_t, splice, bool,
{
char buf[PLAIN_BUF_SIZE], *pos;
fd_set set;
- chunk_t data;
- ssize_t len;
- bool old;
+ ssize_t in, out;
+ bool old, plain_eof = FALSE, crypto_eof = FALSE;
- while (TRUE)
+ while (!plain_eof && !crypto_eof)
{
FD_ZERO(&set);
FD_SET(rfd, &set);
FD_SET(this->fd, &set);
old = thread_cancelability(TRUE);
- len = select(max(rfd, this->fd) + 1, &set, NULL, NULL, NULL);
+ in = select(max(rfd, this->fd) + 1, &set, NULL, NULL, NULL);
thread_cancelability(old);
- if (len == -1)
+ if (in == -1)
{
DBG1(DBG_TLS, "TLS select error: %s", strerror(errno));
return FALSE;
}
- if (FD_ISSET(this->fd, &set))
+ while (!plain_eof && FD_ISSET(this->fd, &set))
{
- if (!read_(this, &data))
- {
- DBG2(DBG_TLS, "TLS read error/disconnect");
- return TRUE;
- }
- pos = data.ptr;
- while (data.len)
+ in = read_(this, buf, sizeof(buf), FALSE);
+ switch (in)
{
- len = write(wfd, pos, data.len);
- if (len == -1)
- {
- free(data.ptr);
- DBG1(DBG_TLS, "TLS plain write error: %s", strerror(errno));
- return FALSE;
- }
- data.len -= len;
- pos += len;
+ case 0:
+ plain_eof = TRUE;
+ break;
+ case -1:
+ if (errno != EWOULDBLOCK)
+ {
+ DBG1(DBG_TLS, "TLS read error: %s", strerror(errno));
+ return FALSE;
+ }
+ break;
+ default:
+ pos = buf;
+ while (in)
+ {
+ out = write(wfd, pos, in);
+ if (out == -1)
+ {
+ DBG1(DBG_TLS, "TLS plain write error: %s",
+ strerror(errno));
+ return FALSE;
+ }
+ in -= out;
+ pos += out;
+ }
+ continue;
}
- free(data.ptr);
+ break;
}
- if (FD_ISSET(rfd, &set))
+ if (!crypto_eof && FD_ISSET(rfd, &set))
{
- len = read(rfd, buf, sizeof(buf));
- if (len > 0)
+ in = read(rfd, buf, sizeof(buf));
+ switch (in)
{
- if (!write_(this, chunk_create(buf, len)))
- {
- DBG1(DBG_TLS, "TLS write error");
- return FALSE;
- }
- }
- else
- {
- if (len < 0)
- {
+ case 0:
+ crypto_eof = TRUE;
+ break;
+ case -1:
DBG1(DBG_TLS, "TLS plain read error: %s", strerror(errno));
return FALSE;
- }
- return TRUE;
+ default:
+ pos = buf;
+ while (in)
+ {
+ out = write_(this, pos, in);
+ if (out == -1)
+ {
+ DBG1(DBG_TLS, "TLS write error");
+ return FALSE;
+ }
+ in -= out;
+ pos += out;
+ }
+ break;
}
}
}
+ return TRUE;
}
METHOD(tls_socket_t, get_fd, int,
@@ -273,8 +381,11 @@ METHOD(tls_socket_t, get_fd, int,
METHOD(tls_socket_t, destroy, void,
private_tls_socket_t *this)
{
+ /* send a TLS close notify if not done yet */
+ this->app.close = TRUE;
+ write_(this, NULL, 0);
+ free(this->app.cache.ptr);
this->tls->destroy(this->tls);
- free(this->app.in.ptr);
free(this);
}
diff --git a/src/libtls/tls_socket.h b/src/libtls/tls_socket.h
index edd05fd29..4ddddc19e 100644
--- a/src/libtls/tls_socket.h
+++ b/src/libtls/tls_socket.h
@@ -35,24 +35,27 @@ typedef struct tls_socket_t tls_socket_t;
struct tls_socket_t {
/**
- * Read data from secured socket, return allocated chunk.
+ * Read data from secured socket.
*
* This call is blocking, you may use select() on the underlying socket to
- * wait for data. If the there was non-application data available, the
- * read function can return an empty chunk.
+ * wait for data. If "block" is FALSE and no application data is available,
+ * the function returns -1 and sets errno to EWOULDBLOCK.
*
- * @param data pointer to allocate received data
- * @return TRUE if data received successfully
+ * @param buf buffer to write received data to
+ * @param len size of buffer
+ * @param block TRUE to block this call, FALSE to fail if it would block
+ * @return number of bytes read, 0 on EOF, -1 on error
*/
- bool (*read)(tls_socket_t *this, chunk_t *data);
+ ssize_t (*read)(tls_socket_t *this, void *buf, size_t len, bool block);
/**
- * Write a chunk of data over the secured socket.
+ * Write data over the secured socket.
*
- * @param data data to send
- * @return TRUE if data sent successfully
+ * @param buf data to send
+ * @param len number of bytes to write from buf
+ * @return number of bytes written, -1 on error
*/
- bool (*write)(tls_socket_t *this, chunk_t data);
+ ssize_t (*write)(tls_socket_t *this, void *buf, size_t len);
/**
* Read/write plain data from file descriptor.
generated by cgit v1.2.3 (git 2.25.1) at 2025-09-14 16:17:54 +0000