}
void connectErr(const AsyncSocketException& ex) noexcept override {
- LOG(ERROR) << "TCP connect failed: " << ex.what();
+ VLOG(1) << "TCP connect failed: " << ex.what();
fail(ex);
delete this;
}
void handshakeErr(AsyncSSLSocket* /* socket */,
const AsyncSocketException& ex) noexcept override {
- LOG(ERROR) << "client handshakeErr: " << ex.what();
+ VLOG(1) << "client handshakeErr: " << ex.what();
fail(ex);
delete this;
}
}
};
-// XXX: implement an equivalent to corking for platforms with TCP_NOPUSH?
-#ifdef TCP_CORK // Linux-only
-/**
- * Utility class that corks a TCP socket upon construction or uncorks
- * the socket upon destruction
- */
-class CorkGuard : private boost::noncopyable {
- public:
- CorkGuard(int fd, bool multipleWrites, bool haveMore, bool* corked):
- fd_(fd), haveMore_(haveMore), corked_(corked) {
- if (*corked_) {
- // socket is already corked; nothing to do
- return;
- }
- if (multipleWrites || haveMore) {
- // We are performing multiple writes in this performWrite() call,
- // and/or there are more calls to performWrite() that will be invoked
- // later, so enable corking
- int flag = 1;
- setsockopt(fd_, IPPROTO_TCP, TCP_CORK, &flag, sizeof(flag));
- *corked_ = true;
- }
- }
-
- ~CorkGuard() {
- if (haveMore_) {
- // more data to come; don't uncork yet
- return;
- }
- if (!*corked_) {
- // socket isn't corked; nothing to do
- return;
- }
-
- int flag = 0;
- setsockopt(fd_, IPPROTO_TCP, TCP_CORK, &flag, sizeof(flag));
- *corked_ = false;
- }
-
- private:
- int fd_;
- bool haveMore_;
- bool* corked_;
-};
-#else
-class CorkGuard : private boost::noncopyable {
- public:
- CorkGuard(int, bool, bool, bool*) {}
-};
-#endif
-
void setup_SSL_CTX(SSL_CTX *ctx) {
#ifdef SSL_MODE_RELEASE_BUFFERS
SSL_CTX_set_mode(ctx,
EventBase* evb, bool deferSecurityNegotiation) :
AsyncSocket(evb),
ctx_(ctx),
- handshakeTimeout_(this, evb) {
+ handshakeTimeout_(this, evb),
+ connectionTimeout_(this, evb) {
init();
if (deferSecurityNegotiation) {
sslState_ = STATE_UNENCRYPTED;
AsyncSocket(evb, fd),
server_(server),
ctx_(ctx),
- handshakeTimeout_(this, evb) {
+ handshakeTimeout_(this, evb),
+ connectionTimeout_(this, evb) {
init();
if (server) {
SSL_CTX_set_info_callback(ctx_->getSSLCtx(),
}
size_t AsyncSSLSocket::getRawBytesWritten() const {
+ // The bio(s) in the write path are in a chain
+ // each bio flushes to the next and finally written into the socket
+ // to get the rawBytesWritten on the socket,
+ // get the write bytes of the last bio
BIO *b;
if (!ssl_ || !(b = SSL_get_wbio(ssl_))) {
return 0;
}
+ BIO* next = BIO_next(b);
+ while (next != NULL) {
+ b = next;
+ next = BIO_next(b);
+ }
return BIO_number_written(b);
}
// We are expecting a callback in restartSSLAccept. The cache lookup
// and rsa-call necessarily have pointers to this ssl socket, so delay
// the cleanup until he calls us back.
+ } else if (state_ == StateEnum::CONNECTING) {
+ assert(sslState_ == STATE_CONNECTING);
+ DestructorGuard dg(this);
+ AsyncSocketException ex(AsyncSocketException::TIMED_OUT,
+ "Fallback connect timed out during TFO");
+ failHandshake(__func__, ex);
} else {
assert(state_ == StateEnum::ESTABLISHED &&
(sslState_ == STATE_CONNECTING || sslState_ == STATE_ACCEPTING));
}
OpenSSLUtils::setBioAppData(wb, this);
- BIO_set_fd(wb, fd_, BIO_NOCLOSE);
+ OpenSSLUtils::setBioFd(wb, fd_, BIO_NOCLOSE);
SSL_set_bio(ssl_, wb, wb);
return true;
}
return invalidState(callback);
}
- handshakeStartTime_ = std::chrono::steady_clock::now();
- // Make end time at least >= start time.
- handshakeEndTime_ = handshakeStartTime_;
-
sslState_ = STATE_CONNECTING;
handshakeCallback_ = callback;
applyVerificationOptions(ssl_);
if (sslSession_ != nullptr) {
+ sessionResumptionAttempted_ = true;
SSL_set_session(ssl_, sslSession_);
SSL_SESSION_free(sslSession_);
sslSession_ = nullptr;
SSL_set_ex_data(ssl_, getSSLExDataIndex(), this);
- if (timeout > 0) {
- handshakeTimeout_.scheduleTimeout(timeout);
- }
+ handshakeConnectTimeout_ = timeout;
+ startSSLConnect();
+}
+// This could be called multiple times, during normal ssl connections
+// and after TFO fallback.
+void AsyncSSLSocket::startSSLConnect() {
+ handshakeStartTime_ = std::chrono::steady_clock::now();
+ // Make end time at least >= start time.
+ handshakeEndTime_ = handshakeStartTime_;
+ if (handshakeConnectTimeout_ > 0) {
+ handshakeTimeout_.scheduleTimeout(handshakeConnectTimeout_);
+ }
handleConnect();
}
sslState_ == STATE_CONNECTING);
assert(ssl_);
+ auto originalState = state_;
int ret = SSL_connect(ssl_);
if (ret <= 0) {
int sslError;
unsigned long errError;
int errnoCopy = errno;
if (willBlock(ret, &sslError, &errError)) {
+ // We fell back to connecting state due to TFO
+ if (state_ == StateEnum::CONNECTING) {
+ DCHECK_EQ(StateEnum::FAST_OPEN, originalState);
+ if (handshakeTimeout_.isScheduled()) {
+ handshakeTimeout_.cancelTimeout();
+ }
+ }
return;
} else {
sslState_ = STATE_ERROR;
AsyncSocket::handleInitialReadWrite();
}
+void AsyncSSLSocket::invokeConnectErr(const AsyncSocketException& ex) {
+ connectionTimeout_.cancelTimeout();
+ AsyncSocket::invokeConnectErr(ex);
+}
+
void AsyncSSLSocket::invokeConnectSuccess() {
+ connectionTimeout_.cancelTimeout();
if (sslState_ == SSLStateEnum::STATE_CONNECTING) {
// If we failed TFO, we'd fall back to trying to connect the socket,
- // when we succeed we should handle the writes that caused us to start
- // TFO.
- handleWrite();
+ // to setup things like timeouts.
+ startSSLConnect();
}
+ // still invoke the base class since it re-sets the connect time.
AsyncSocket::invokeConnectSuccess();
}
+void AsyncSSLSocket::scheduleConnectTimeout() {
+ if (sslState_ == SSLStateEnum::STATE_CONNECTING) {
+ // We fell back from TFO, and need to set the timeouts.
+ // We will not have a connect callback in this case, thus if the timer
+ // expires we would have no-one to notify.
+ // Thus we should reset even the connect timers to point to the handshake
+ // timeouts.
+ assert(connectCallback_ == nullptr);
+ // We use a different connect timeout here than the handshake timeout, so
+ // that we can disambiguate the 2 timers.
+ int timeout = connectTimeout_.count();
+ if (timeout > 0) {
+ if (!connectionTimeout_.scheduleTimeout(timeout)) {
+ throw AsyncSocketException(
+ AsyncSocketException::INTERNAL_ERROR,
+ withAddr("failed to schedule AsyncSSLSocket connect timeout"));
+ }
+ }
+ return;
+ }
+ AsyncSocket::scheduleConnectTimeout();
+}
+
void AsyncSSLSocket::setReadCB(ReadCallback *callback) {
#ifdef SSL_MODE_MOVE_BUFFER_OWNERSHIP
// turn on the buffer movable in openssl
WRITE_ERROR, folly::make_unique<SSLException>(SSLError::EARLY_WRITE));
}
- bool cork = isSet(flags, WriteFlags::CORK);
- CorkGuard guard(fd_, count > 1, cork, &corked_);
-
// Declare a buffer used to hold small write requests. It could point to a
// memory block either on stack or on heap. If it is on heap, we release it
// manually when scope exits
ssize_t bytes;
uint32_t buffersStolen = 0;
+ auto sslWriteBuf = buf;
if ((len < minWriteSize_) && ((i + 1) < count)) {
// Combine this buffer with part or all of the next buffers in
// order to avoid really small-grained calls to SSL_write().
}
}
assert(combinedBuf != nullptr);
+ sslWriteBuf = combinedBuf;
memcpy(combinedBuf, buf, len);
do {
buffersStolen++;
}
} while ((i + buffersStolen + 1) < count && (len < minWriteSize_));
- bytes = eorAwareSSLWrite(
- ssl_, combinedBuf, len,
- (isSet(flags, WriteFlags::EOR) && i + buffersStolen + 1 == count));
+ }
- } else {
- bytes = eorAwareSSLWrite(ssl_, buf, len,
- (isSet(flags, WriteFlags::EOR) && i + 1 == count));
+ // Advance any empty buffers immediately after.
+ if (bytesStolenFromNextBuffer == 0) {
+ while ((i + buffersStolen + 1) < count &&
+ vec[i + buffersStolen + 1].iov_len == 0) {
+ buffersStolen++;
+ }
}
+ corkCurrentWrite_ =
+ isSet(flags, WriteFlags::CORK) || (i + buffersStolen + 1 < count);
+ bytes = eorAwareSSLWrite(
+ ssl_,
+ sslWriteBuf,
+ len,
+ (isSet(flags, WriteFlags::EOR) && i + buffersStolen + 1 == count));
+
if (bytes <= 0) {
int error = SSL_get_error(ssl_, bytes);
if (error == SSL_ERROR_WANT_WRITE) {
flags = MSG_EOR;
}
- auto result =
- tsslSock->sendSocketMessage(BIO_get_fd(b, nullptr), &msg, flags);
+#ifdef MSG_NOSIGNAL
+ flags |= MSG_NOSIGNAL;
+#endif
+
+#ifdef MSG_MORE
+ if (tsslSock->corkCurrentWrite_) {
+ flags |= MSG_MORE;
+ }
+#endif
+
+ auto result = tsslSock->sendSocketMessage(
+ OpenSSLUtils::getBioFd(b, nullptr), &msg, flags);
BIO_clear_retry_flags(b);
if (!result.exception && result.writeReturn <= 0) {
if (OpenSSLUtils::getBioShouldRetryWrite(result.writeReturn)) {
extensionsLength -= 2;
uint16_t extensionDataLength = cursor.readBE<uint16_t>();
extensionsLength -= 2;
+ extensionsLength -= extensionDataLength;
if (extensionType == ssl::TLSExtension::SIGNATURE_ALGORITHMS) {
cursor.skip(2);
}
} else {
cursor.skip(extensionDataLength);
- extensionsLength -= extensionDataLength;
}
}
}
sock->resetClientHelloParsing(ssl);
}
+void AsyncSSLSocket::getSSLClientCiphers(
+ std::string& clientCiphers,
+ bool convertToString) const {
+ std::string ciphers;
+
+ if (parseClientHello_ == false
+ || clientHelloInfo_->clientHelloCipherSuites_.empty()) {
+ clientCiphers = "";
+ return;
+ }
+
+ bool first = true;
+ for (auto originalCipherCode : clientHelloInfo_->clientHelloCipherSuites_)
+ {
+ if (first) {
+ first = false;
+ } else {
+ ciphers += ":";
+ }
+
+ bool nameFound = convertToString;
+
+ if (convertToString) {
+ const auto& name = OpenSSLUtils::getCipherName(originalCipherCode);
+ if (name.empty()) {
+ nameFound = false;
+ } else {
+ ciphers += name;
+ }
+ }
+
+ if (!nameFound) {
+ folly::hexlify(
+ std::array<uint8_t, 2>{{
+ static_cast<uint8_t>((originalCipherCode >> 8) & 0xffL),
+ static_cast<uint8_t>(originalCipherCode & 0x00ffL) }},
+ ciphers,
+ /* append to ciphers = */ true);
+ }
+ }
+
+ clientCiphers = std::move(ciphers);
+}
+
+std::string AsyncSSLSocket::getSSLClientComprMethods() const {
+ if (!parseClientHello_) {
+ return "";
+ }
+ return folly::join(":", clientHelloInfo_->clientHelloCompressionMethods_);
+}
+
+std::string AsyncSSLSocket::getSSLClientExts() const {
+ if (!parseClientHello_) {
+ return "";
+ }
+ return folly::join(":", clientHelloInfo_->clientHelloExtensions_);
+}
+
+std::string AsyncSSLSocket::getSSLClientSigAlgs() const {
+ if (!parseClientHello_) {
+ return "";
+ }
+
+ std::string sigAlgs;
+ sigAlgs.reserve(clientHelloInfo_->clientHelloSigAlgs_.size() * 4);
+ for (size_t i = 0; i < clientHelloInfo_->clientHelloSigAlgs_.size(); i++) {
+ if (i) {
+ sigAlgs.push_back(':');
+ }
+ sigAlgs.append(folly::to<std::string>(
+ clientHelloInfo_->clientHelloSigAlgs_[i].first));
+ sigAlgs.push_back(',');
+ sigAlgs.append(folly::to<std::string>(
+ clientHelloInfo_->clientHelloSigAlgs_[i].second));
+ }
+
+ return sigAlgs;
+}
+
+std::string AsyncSSLSocket::getSSLAlertsReceived() const {
+ std::string ret;
+
+ for (const auto& alert : alertsReceived_) {
+ if (!ret.empty()) {
+ ret.append(",");
+ }
+ ret.append(folly::to<std::string>(alert.first, ": ", alert.second));
+ }
+
+ return ret;
+}
+
+void AsyncSSLSocket::getSSLSharedCiphers(std::string& sharedCiphers) const {
+ char ciphersBuffer[1024];
+ ciphersBuffer[0] = '\0';
+ SSL_get_shared_ciphers(ssl_, ciphersBuffer, sizeof(ciphersBuffer) - 1);
+ sharedCiphers = ciphersBuffer;
+}
+
+void AsyncSSLSocket::getSSLServerCiphers(std::string& serverCiphers) const {
+ serverCiphers = SSL_get_cipher_list(ssl_, 0);
+ int i = 1;
+ const char *cipher;
+ while ((cipher = SSL_get_cipher_list(ssl_, i)) != nullptr) {
+ serverCiphers.append(":");
+ serverCiphers.append(cipher);
+ i++;
+ }
+}
+
} // namespace
projects / folly.git / blobdiff