From 5715c21a077ee1c2fe8957cb4adcea14fd2eda6b Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Fri, 20 Nov 2020 23:24:29 +0000 Subject: Refactor tls code to support ucspi-tls That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it. --- src/sbearssl/sbearssl_run.c | 107 ++++++++++++++------------------------------ 1 file changed, 34 insertions(+), 73 deletions(-) (limited to 'src/sbearssl/sbearssl_run.c') diff --git a/src/sbearssl/sbearssl_run.c b/src/sbearssl/sbearssl_run.c index 177a252..c8ff2fe 100644 --- a/src/sbearssl/sbearssl_run.c +++ b/src/sbearssl/sbearssl_run.c @@ -1,53 +1,30 @@ /* ISC license. */ -#include -#include +#include #include -#include + #include + #include #include -#include #include #include #include -#include -#include -static inline void handle_signals (pid_t pid, int *e) -{ - for (;;) switch (selfpipe_read()) - { - case -1 : strerr_diefu1sys(111, "read selfpipe") ; - case 0 : return ; - case SIGCHLD : - { - int wstat ; - if (wait_pid_nohang(pid, &wstat) == pid) - { - *e = wstat ; - return ; - } - } - } -} +#include +#include "sbearssl-internal.h" -int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto) +void sbearssl_run (br_ssl_engine_context *ctx, int *fds, tain_t const *tto, uint32_t options, unsigned int verbosity, sbearssl_handshake_cb_t_ref cb, sbearssl_handshake_cb_context_t *cbarg) { - iopause_fd x[5] = { { .fd = fds[4], .events = IOPAUSE_READ } } ; + iopause_fd x[4] ; unsigned int xindex[4] ; int markedforflush = 0 ; - int e = -1 ; - - if (ndelay_on(fds[2]) < 0 || ndelay_on(fds[3]) < 0) - strerr_diefu1sys(111, "set fds non-blocking") ; - if (sig_ignore(SIGPIPE) < 0) - strerr_diefu1sys(111, "ignore SIGPIPE") ; + int handshake_done = 0 ; for (;;) { tain_t deadline ; - unsigned int j = 1 ; + unsigned int j = 0 ; unsigned int state = br_ssl_engine_current_state(ctx) ; int r ; @@ -58,6 +35,17 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int break ; } + if (!handshake_done) + { + size_t dummy ; + if (br_ssl_engine_recvapp_buf(ctx, &dummy)) + { + if (!(*cb)(ctx, cbarg)) + strerr_diefu1sys(111, "post-handshake callback failed") ; + handshake_done = 1 ; + } + } + tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && state & (BR_SSL_SENDAPP | BR_SSL_RECVREC) ? tto : &tain_infinite_relative) ; if (fds[0] >= 0 && state & BR_SSL_SENDAPP) @@ -66,62 +54,42 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int x[j].events = IOPAUSE_READ ; xindex[0] = j++ ; } - else xindex[0] = 5 ; + else xindex[0] = 4 ; if (fds[1] >= 0 && state & BR_SSL_RECVAPP) { x[j].fd = fds[1] ; x[j].events = IOPAUSE_WRITE ; xindex[1] = j++ ; } - else xindex[1] = 5 ; + else xindex[1] = 4 ; if (fds[2] >= 0 && state & BR_SSL_RECVREC) { x[j].fd = fds[2] ; x[j].events = IOPAUSE_READ ; xindex[2] = j++ ; } - else xindex[2] = 5 ; + else xindex[2] = 4 ; if (fds[3] >= 0 && state & BR_SSL_SENDREC) { x[j].fd = fds[3] ; x[j].events = IOPAUSE_WRITE ; xindex[3] = j++ ; } - else xindex[3] = 5 ; + else xindex[3] = 4 ; - if (j == 1) break ; + if (xindex[0] == 4 && xindex[1] == 4 && xindex[3] == 4) break ; r = iopause_g(x, j, &deadline) ; if (r < 0) strerr_diefu1sys(111, "iopause") ; - else if (!r) - { - fd_close(fds[0]) ; fds[0] = -1 ; - if (options & 1) - { - shutdown(fds[3], SHUT_WR) ; - fd_close(fds[3]) ; fds[3] = -1 ; - } - else br_ssl_engine_close(ctx) ; - if (e >= 0) break ; - continue ; - } + else if (!r) break ; while (j--) if (x[j].revents & IOPAUSE_EXCEPT) x[j].revents |= IOPAUSE_READ | IOPAUSE_WRITE ; - /* Signal */ - - if (x[0].revents & IOPAUSE_READ) - { - handle_signals(pid, &e) ; - if (e >= 0 && xindex[0] == 5 && xindex[3] == 5) break ; - } - - /* Flush to local */ - if (state & BR_SSL_RECVAPP && x[xindex[1]].events & x[xindex[1]].revents & IOPAUSE_WRITE) + if (state & BR_SSL_RECVAPP && xindex[1] < 4 && x[xindex[1]].events & x[xindex[1]].revents & IOPAUSE_WRITE) { size_t len ; unsigned char const *s = br_ssl_engine_recvapp_buf(ctx, &len) ; @@ -145,7 +113,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int /* Flush to remote */ - if (state & BR_SSL_SENDREC && xindex[3] < 5 && x[xindex[3]].events & x[xindex[3]].revents & IOPAUSE_WRITE) + if (state & BR_SSL_SENDREC && xindex[3] < 4 && x[xindex[3]].events & x[xindex[3]].revents & IOPAUSE_WRITE) { size_t len ; unsigned char const *s = br_ssl_engine_sendrec_buf(ctx, &len) ; @@ -162,11 +130,10 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int { if (options & 1) { - shutdown(fds[3], SHUT_WR) ; + fd_shutdown(fds[3], 1) ; fd_close(fds[3]) ; fds[3] = -1 ; } else br_ssl_engine_close(ctx) ; - if (e >= 0) break ; } state = br_ssl_engine_current_state(ctx) ; } @@ -175,7 +142,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int /* Fill from local */ - if (state & BR_SSL_SENDAPP && xindex[0] < 5 && x[xindex[0]].events & IOPAUSE_READ && (markedforflush || x[xindex[0]].revents & IOPAUSE_READ)) + if (state & BR_SSL_SENDAPP && xindex[0] < 4 && x[xindex[0]].events & IOPAUSE_READ && (markedforflush || x[xindex[0]].revents & IOPAUSE_READ)) { size_t len ; unsigned char *s = br_ssl_engine_sendapp_buf(ctx, &len) ; @@ -191,11 +158,10 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int { if (options & 1) { - shutdown(fds[3], SHUT_WR) ; + fd_shutdown(fds[3], 1) ; fd_close(fds[3]) ; fds[3] = -1 ; } else br_ssl_engine_close(ctx) ; - if (e >= 0) break ; } } } @@ -215,7 +181,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int /* Fill from remote */ - if (state & BR_SSL_RECVREC && xindex[2] < 5 && x[xindex[2]].events & x[xindex[2]].revents & IOPAUSE_READ) + if (state & BR_SSL_RECVREC && xindex[2] < 4 && x[xindex[2]].events & x[xindex[2]].revents & IOPAUSE_READ) { size_t len ; unsigned char *s = br_ssl_engine_recvrec_buf(ctx, &len) ; @@ -224,7 +190,7 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int { if (!error_isagain(errno)) { - if (options & 1) shutdown(fds[2], SHUT_RD) ; + if (options & 1) fd_shutdown(fds[2], 0) ; fd_close(fds[2]) ; fds[2] = -1 ; if (fds[1] >= 0 && !br_ssl_engine_recvapp_buf(ctx, &len)) { @@ -235,10 +201,5 @@ int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int else br_ssl_engine_recvrec_ack(ctx, w) ; } } - - if (fds[1] >= 0) fd_close(fds[1]) ; - if (fds[0] >= 0) fd_close(fds[0]) ; - if (fds[3] >= 0) fd_close(fds[3]) ; - if (fds[2] >= 0) fd_close(fds[2]) ; - return e ; + _exit(0) ; } -- cgit v1.2.3