summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLaurent Bercot <ska-skaware@skarnet.org>2021-01-13 11:36:16 +0000
committerLaurent Bercot <ska-skaware@skarnet.org>2021-01-13 11:36:16 +0000
commitcc7dccb1858e73176814c3a8457ff6f94ff45662 (patch)
tree746a462d3a58b4dc19c240bcbf9f224e593e23e7 /src
parent23f7b20aeac1d337587d4f59779df94c82dc06b7 (diff)
downloads6-networking-cc7dccb1858e73176814c3a8457ff6f94ff45662.tar.xz
Implement handshake timeout for libtls backend
Diffstat (limited to 'src')
-rw-r--r--src/include/s6-networking/stls.h5
-rw-r--r--src/sbearssl/sbearssl_run.c11
-rw-r--r--src/stls/deps-lib/stls2
-rw-r--r--src/stls/stls-internal.h5
-rw-r--r--src/stls/stls_client_init_and_handshake.c4
-rw-r--r--src/stls/stls_handshake.c30
-rw-r--r--src/stls/stls_server_init_and_handshake.c4
-rw-r--r--src/tls/s6-tlsc-io.c3
-rw-r--r--src/tls/s6-tlsd-io.c3
9 files changed, 53 insertions, 14 deletions
diff --git a/src/include/s6-networking/stls.h b/src/include/s6-networking/stls.h
index 65bb950..071b96b 100644
--- a/src/include/s6-networking/stls.h
+++ b/src/include/s6-networking/stls.h
@@ -8,6 +8,7 @@
#include <tls.h>
#include <skalibs/gccattributes.h>
+#include <skalibs/tai.h>
#define STLS_BUFSIZE (16384 + 325 + 1)
@@ -20,7 +21,7 @@ extern void stls_run (struct tls *, int *, uint32_t, unsigned int) gccattr_noret
/* s6-tlsc-io and s6-tlsd-io */
-struct tls *stls_client_init_and_handshake (int const *, uint32_t, char const *) ;
-struct tls *stls_server_init_and_handshake (int const *, uint32_t) ;
+struct tls *stls_client_init_and_handshake (int const *, tain_t const *, uint32_t, char const *) ;
+struct tls *stls_server_init_and_handshake (int const *, tain_t const *, uint32_t) ;
#endif
diff --git a/src/sbearssl/sbearssl_run.c b/src/sbearssl/sbearssl_run.c
index e097698..fda9f3e 100644
--- a/src/sbearssl/sbearssl_run.c
+++ b/src/sbearssl/sbearssl_run.c
@@ -29,7 +29,7 @@ void sbearssl_run (br_ssl_engine_context *ctx, int *fds, tain_t const *tto, uint
for (;;)
{
- tain_t deadline = tain_infinite_relative ;
+ tain_t deadline = TAIN_INFINITE ;
unsigned int j = 0 ;
unsigned int state = br_ssl_engine_current_state(ctx) ;
int r ;
@@ -79,13 +79,16 @@ void sbearssl_run (br_ssl_engine_context *ctx, int *fds, tain_t const *tto, uint
if (xindex[0] == 4 && xindex[1] == 4 && xindex[3] == 4)
{
if (!j || handshake_done) break ;
- deadline = *tto ;
+ tain_add_g(&deadline, tto) ;
}
- tain_add_g(&deadline, &deadline) ;
r = iopause_g(x, j, &deadline) ;
if (r < 0) strerr_diefu1sys(111, "iopause") ;
- else if (!r) break ;
+ else if (!r)
+ {
+ if (verbosity) strerr_dief1x(98, "handshake timed out") ;
+ else _exit(98) ;
+ }
while (j--)
if (x[j].revents & IOPAUSE_EXCEPT)
diff --git a/src/stls/deps-lib/stls b/src/stls/deps-lib/stls
index 615ce3b..b7b94ec 100644
--- a/src/stls/deps-lib/stls
+++ b/src/stls/deps-lib/stls
@@ -1,7 +1,9 @@
stls_drop.o
+stls_handshake.o
stls_run.o
stls_client_init_and_handshake.o
stls_server_init_and_handshake.o
stls_send_environment.o
${CRYPTO_LIB}
-lskarnet
+${TIMER_LIB}
diff --git a/src/stls/stls-internal.h b/src/stls/stls-internal.h
index afe7a80..ef004ea 100644
--- a/src/stls/stls-internal.h
+++ b/src/stls/stls-internal.h
@@ -3,6 +3,11 @@
#ifndef STLS_INTERNAL_H
#define STLS_INTERNAL_H
+#include <tls.h>
+
+#include <skalibs/tai.h>
+
extern void stls_drop (void) ;
+extern void stls_handshake (struct tls *, tain_t const *) ;
#endif
diff --git a/src/stls/stls_client_init_and_handshake.c b/src/stls/stls_client_init_and_handshake.c
index fdea482..7e0bc13 100644
--- a/src/stls/stls_client_init_and_handshake.c
+++ b/src/stls/stls_client_init_and_handshake.c
@@ -12,7 +12,7 @@
#define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg))
#define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx))
-struct tls *stls_client_init_and_handshake (int const *fds, uint32_t preoptions, char const *servername)
+struct tls *stls_client_init_and_handshake (int const *fds, tain_t const *tto, uint32_t preoptions, char const *servername)
{
struct tls *ctx ;
struct tls_config *cfg ;
@@ -76,6 +76,6 @@ struct tls *stls_client_init_and_handshake (int const *fds, uint32_t preoptions,
if (tls_connect_fds(ctx, fds[0], fds[1], servername) < 0)
diectx(97, ctx, "tls_connect_fds") ;
tls_config_free(cfg) ;
- if (tls_handshake(ctx) < 0) diectx(97, ctx, "tls_handshake") ;
+ stls_handshake(ctx, tto) ;
return ctx ;
}
diff --git a/src/stls/stls_handshake.c b/src/stls/stls_handshake.c
new file mode 100644
index 0000000..989a167
--- /dev/null
+++ b/src/stls/stls_handshake.c
@@ -0,0 +1,30 @@
+/* ISC license. */
+
+#include <signal.h>
+#include <unistd.h>
+
+#include <tls.h>
+
+#include <skalibs/alarm.h>
+#include <skalibs/strerr2.h>
+
+#include "stls-internal.h"
+
+#define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx))
+
+static void alrm_handler (int sig)
+{
+ strerr_dief1x(98, "handshake timed out") ;
+}
+
+void stls_handshake (struct tls *ctx, tain_t const *tto)
+{
+ struct sigaction saold ;
+ struct sigaction sanew = { .sa_handler = &alrm_handler, .sa_flags = SA_RESTART, .sa_sigaction = 0 } ;
+ sigfillset(&sanew.sa_mask) ;
+ if (sigaction(SIGALRM, &sanew, &saold) < 0) strerr_diefu1sys(111, "sigaction") ;
+ if (!alarm_timeout(tto)) strerr_diefu1sys(111, "set an alarm") ;
+ if (tls_handshake(ctx) < 0) diectx(97, ctx, "tls_handshake") ;
+ alarm_disable() ;
+ sigaction(SIGALRM, &saold, 0) ;
+}
diff --git a/src/stls/stls_server_init_and_handshake.c b/src/stls/stls_server_init_and_handshake.c
index e6869be..4a5b2ff 100644
--- a/src/stls/stls_server_init_and_handshake.c
+++ b/src/stls/stls_server_init_and_handshake.c
@@ -12,7 +12,7 @@
#define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg))
#define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx))
-struct tls *stls_server_init_and_handshake (int const *fds, uint32_t preoptions)
+struct tls *stls_server_init_and_handshake (int const *fds, tain_t const *tto, uint32_t preoptions)
{
struct tls *ctx = 0 ;
struct tls *sctx ;
@@ -77,6 +77,6 @@ struct tls *stls_server_init_and_handshake (int const *fds, uint32_t preoptions)
if (tls_accept_fds(sctx, &ctx, fds[0], fds[1]) < 0)
diectx(97, sctx, "tls_accept_fds") ;
tls_free(sctx) ;
- if (tls_handshake(ctx) < 0) diectx(97, ctx, "tls_handshake") ;
+ stls_handshake(ctx, tto) ;
return ctx ;
}
diff --git a/src/tls/s6-tlsc-io.c b/src/tls/s6-tlsc-io.c
index 8629a8d..7c92d96 100644
--- a/src/tls/s6-tlsc-io.c
+++ b/src/tls/s6-tlsc-io.c
@@ -24,14 +24,13 @@ static inline void doit (int *, tain_t const *tto, uint32_t, uint32_t, unsigned
static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint32_t options, unsigned int verbosity, char const *servername, unsigned int notif)
{
- struct tls *ctx = stls_client_init_and_handshake(fds + 2, preoptions, servername) ;
+ struct tls *ctx = stls_client_init_and_handshake(fds + 2, tto, preoptions, servername) ;
if (notif)
{
if (!stls_send_environment(ctx, notif))
strerr_diefu1sys(111, "write post-handshake data") ;
fd_close(notif) ;
}
- (void)tto ;
stls_run(ctx, fds, options, verbosity) ;
}
diff --git a/src/tls/s6-tlsd-io.c b/src/tls/s6-tlsd-io.c
index b6621dd..01f0d74 100644
--- a/src/tls/s6-tlsd-io.c
+++ b/src/tls/s6-tlsd-io.c
@@ -24,14 +24,13 @@ static inline void doit (int *, tain_t const *tto, uint32_t, uint32_t, unsigned
static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint32_t options, unsigned int verbosity, unsigned int notif)
{
- struct tls *ctx = stls_server_init_and_handshake(fds + 2, preoptions) ;
+ struct tls *ctx = stls_server_init_and_handshake(fds + 2, tto, preoptions) ;
if (notif)
{
if (!stls_send_environment(ctx, notif))
strerr_diefu1sys(111, "write post-handshake data") ;
fd_close(notif) ;
}
- (void)tto ;
stls_run(ctx, fds, options, verbosity) ;
}