parent
a663088a77
commit
e7b7b1d82c
4 changed files with 572 additions and 17 deletions
@ -0,0 +1,493 @@ |
||||
/*
|
||||
* mod_openssl - ssl support |
||||
* |
||||
* Description: |
||||
* mod_openssl listens on separate sockets for ssl connections (https://...)
|
||||
* |
||||
* Setups: |
||||
* openssl - setup a ssl socket; takes a hash of following parameters: |
||||
* listen - (mandatory) the socket address (same as standard listen) |
||||
* pemfile - (mandatory) contains key and direct certificate for the key (PEM format) |
||||
* ca-file - contains certificate chain |
||||
* ciphers - contains comma separated list of allowed ciphers |
||||
* allow-ssl2 - boolean option to allow ssl2 (disabled by default) |
||||
* |
||||
* Example config: |
||||
* setup openssl [ "listen": "0.0.0.0:8443", "pemfile": "server.pem" ]; |
||||
* setup openssl [ "listen": "[::]:8443", "pemfile": "server.pem" ]; |
||||
* |
||||
* Author: |
||||
* Copyright (c) 2009 Stefan Bühler |
||||
*/ |
||||
|
||||
#include <lighttpd/base.h> |
||||
#include <lighttpd/plugin_core.h> |
||||
|
||||
#include <openssl/ssl.h> |
||||
#include <openssl/err.h> |
||||
#include <openssl/rand.h> |
||||
|
||||
LI_API gboolean mod_openssl_init(liModules *mods, liModule *mod); |
||||
LI_API gboolean mod_openssl_free(liModules *mods, liModule *mod); |
||||
|
||||
|
||||
typedef struct openssl_connection_ctx openssl_connection_ctx; |
||||
typedef struct openssl_context openssl_context; |
||||
|
||||
struct openssl_connection_ctx { |
||||
SSL *ssl; |
||||
GByteArray *reuse_read_buffer; |
||||
}; |
||||
|
||||
struct openssl_context { |
||||
SSL_CTX *ssl_ctx; |
||||
}; |
||||
|
||||
static gboolean openssl_con_new(liConnection *con) { |
||||
liServer *srv = con->srv; |
||||
openssl_context *ctx = con->srv_sock->data; |
||||
openssl_connection_ctx *conctx = g_slice_new0(openssl_connection_ctx); |
||||
|
||||
if (NULL == (conctx->ssl = SSL_new(ctx->ssl_ctx))) { |
||||
ERROR(srv, "SSL_new: %s", ERR_error_string(ERR_get_error(), NULL)); |
||||
goto fail; |
||||
} |
||||
|
||||
SSL_set_accept_state(conctx->ssl); |
||||
|
||||
if (1 != (SSL_set_fd(conctx->ssl, con->sock_watcher.fd))) { |
||||
ERROR(srv, "SSL_set_fd: %s", ERR_error_string(ERR_get_error(), NULL)); |
||||
goto fail; |
||||
} |
||||
|
||||
con->srv_sock_data = conctx; |
||||
|
||||
return TRUE; |
||||
|
||||
fail: |
||||
if (conctx->ssl) { |
||||
SSL_free(conctx->ssl); |
||||
} |
||||
|
||||
g_slice_free(openssl_connection_ctx, conctx); |
||||
|
||||
return FALSE; |
||||
} |
||||
|
||||
static void openssl_con_close(liConnection *con) { |
||||
openssl_connection_ctx *conctx = con->srv_sock_data; |
||||
|
||||
if (conctx->ssl) { |
||||
SSL_shutdown(conctx->ssl); /* TODO: wait for something??? */ |
||||
SSL_free(conctx->ssl); |
||||
conctx->ssl = FALSE; |
||||
} |
||||
} |
||||
|
||||
static liNetworkStatus openssl_con_write(liConnection *con, goffset write_max) { |
||||
const ssize_t blocksize = 16*1024; /* 16k */ |
||||
char *block_data; |
||||
off_t block_len; |
||||
ssize_t r; |
||||
liChunkIter ci; |
||||
liChunkQueue *cq = con->raw_out; |
||||
openssl_connection_ctx *conctx = con->srv_sock_data; |
||||
|
||||
do { |
||||
if (0 == cq->length) |
||||
return LI_NETWORK_STATUS_SUCCESS; |
||||
|
||||
ci = chunkqueue_iter(cq); |
||||
switch (li_chunkiter_read(con->mainvr, ci, 0, blocksize, &block_data, &block_len)) { |
||||
case LI_HANDLER_GO_ON: |
||||
break; |
||||
case LI_HANDLER_ERROR: |
||||
default: |
||||
return LI_NETWORK_STATUS_FATAL_ERROR; |
||||
} |
||||
|
||||
/**
|
||||
* SSL_write man-page |
||||
* |
||||
* WARNING |
||||
* When an SSL_write() operation has to be repeated because of |
||||
* SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE, it must be |
||||
* repeated with the same arguments. |
||||
* |
||||
*/ |
||||
|
||||
ERR_clear_error(); |
||||
if ((r = SSL_write(conctx->ssl, block_data, block_len)) <= 0) { |
||||
int ssl_r; |
||||
unsigned long err; |
||||
|
||||
switch ((ssl_r = SSL_get_error(conctx->ssl, r))) { |
||||
case SSL_ERROR_WANT_READ: |
||||
case SSL_ERROR_WANT_WRITE: |
||||
return LI_NETWORK_STATUS_WAIT_FOR_EVENT; |
||||
case SSL_ERROR_SYSCALL: |
||||
/* perhaps we have error waiting in our error-queue */ |
||||
if (0 != (err = ERR_get_error())) { |
||||
do { |
||||
VR_ERROR(con->mainvr, "SSL_write: %s", |
||||
ERR_error_string(err, NULL)); |
||||
} while (0 != (err = ERR_get_error())); |
||||
} else if (r == -1) { |
||||
/* no, but we have errno */ |
||||
switch(errno) { |
||||
case EPIPE: |
||||
case ECONNRESET: |
||||
return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
default: |
||||
VR_ERROR(con->mainvr, "SSL_write: %s", |
||||
g_strerror(errno)); |
||||
break; |
||||
} |
||||
} else { |
||||
/* neither error-queue nor errno ? */ |
||||
VR_ERROR(con->mainvr, "SSL_write: %s", |
||||
"Unexpected eof"); |
||||
return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
} |
||||
|
||||
return LI_NETWORK_STATUS_FATAL_ERROR; |
||||
case SSL_ERROR_ZERO_RETURN: |
||||
/* clean shutdown on the remote side */ |
||||
return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
default: |
||||
while (0 != (err = ERR_get_error())) { |
||||
VR_ERROR(con->mainvr, "SSL_write: %s", |
||||
ERR_error_string(err, NULL)); |
||||
} |
||||
|
||||
return LI_NETWORK_STATUS_FATAL_ERROR; |
||||
} |
||||
} |
||||
|
||||
li_chunkqueue_skip(cq, r); |
||||
write_max -= r; |
||||
} while (r == block_len && write_max > 0); |
||||
|
||||
return LI_NETWORK_STATUS_SUCCESS; |
||||
} |
||||
|
||||
static liNetworkStatus openssl_con_read(liConnection *con) { |
||||
liChunkQueue *cq = con->raw_in; |
||||
openssl_connection_ctx *conctx = con->srv_sock_data; |
||||
GByteArray *buf; |
||||
|
||||
const ssize_t blocksize = 16*1024; /* 16k */ |
||||
off_t max_read = 16 * blocksize; /* 256k */ |
||||
ssize_t r; |
||||
off_t len = 0; |
||||
|
||||
if (cq->limit && cq->limit->limit > 0) { |
||||
if (max_read > cq->limit->limit - cq->limit->current) { |
||||
max_read = cq->limit->limit - cq->limit->current; |
||||
if (max_read <= 0) { |
||||
max_read = 0; /* we still have to read something */ |
||||
VR_ERROR(con->mainvr, "%s", "li_network_read: fd should be disabled as chunkqueue is already full"); |
||||
} |
||||
} |
||||
} |
||||
|
||||
buf = conctx->reuse_read_buffer; |
||||
conctx->reuse_read_buffer = NULL; |
||||
|
||||
do { |
||||
ERR_clear_error(); |
||||
|
||||
if (!buf) { |
||||
buf = g_byte_array_new(); |
||||
g_byte_array_set_size(buf, blocksize); |
||||
} |
||||
|
||||
r = SSL_read(conctx->ssl, buf->data, buf->len); |
||||
if (r < 0) { |
||||
int oerrno = errno, err; |
||||
gboolean was_fatal; |
||||
|
||||
err = SSL_get_error(conctx->ssl, r); |
||||
|
||||
if (SSL_ERROR_WANT_READ == err || SSL_ERROR_WANT_WRITE == err) { |
||||
conctx->reuse_read_buffer = buf; |
||||
return LI_NETWORK_STATUS_WAIT_FOR_EVENT; |
||||
} |
||||
g_byte_array_free(buf, TRUE); |
||||
buf = NULL; |
||||
|
||||
switch (err) { |
||||
case SSL_ERROR_SYSCALL: |
||||
/**
|
||||
* man SSL_get_error() |
||||
* |
||||
* SSL_ERROR_SYSCALL |
||||
* Some I/O error occurred. The OpenSSL error queue may contain more |
||||
* information on the error. If the error queue is empty (i.e. |
||||
* ERR_get_error() returns 0), ret can be used to find out more about |
||||
* the error: If ret == 0, an EOF was observed that violates the |
||||
* protocol. If ret == -1, the underlying BIO reported an I/O error |
||||
* (for socket I/O on Unix systems, consult errno for details). |
||||
* |
||||
*/ |
||||
while (0 != (err = ERR_get_error())) { |
||||
VR_ERROR(con->mainvr, "SSL_read: %s", |
||||
ERR_error_string(err, NULL)); |
||||
} |
||||
|
||||
switch (oerrno) { |
||||
case EPIPE: |
||||
case ECONNRESET: |
||||
return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
} |
||||
|
||||
VR_ERROR(con->mainvr, "SSL_read: %s", g_strerror(oerrno)); |
||||
|
||||
break; |
||||
case SSL_ERROR_ZERO_RETURN: |
||||
/* clean shutdown on the remote side */ |
||||
return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
default: |
||||
was_fatal = FALSE; |
||||
|
||||
while((err = ERR_get_error())) { |
||||
switch (ERR_GET_REASON(err)) { |
||||
case SSL_R_SSL_HANDSHAKE_FAILURE: |
||||
case SSL_R_TLSV1_ALERT_UNKNOWN_CA: |
||||
case SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN: |
||||
case SSL_R_SSLV3_ALERT_BAD_CERTIFICATE: |
||||
/* TODO: if (!con->conf.log_ssl_noise) */ continue; |
||||
break; |
||||
default: |
||||
was_fatal = TRUE; |
||||
break; |
||||
} |
||||
/* get all errors from the error-queue */ |
||||
VR_ERROR(con->mainvr, "SSL_read: %s", |
||||
ERR_error_string(err, NULL)); |
||||
} |
||||
if (!was_fatal) return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
break; |
||||
} |
||||
|
||||
return LI_NETWORK_STATUS_FATAL_ERROR; |
||||
} else if (r == 0) { |
||||
g_byte_array_free(buf, TRUE); |
||||
return LI_NETWORK_STATUS_CONNECTION_CLOSE; |
||||
} |
||||
|
||||
g_byte_array_set_size(buf, r); |
||||
li_chunkqueue_append_bytearr(cq, buf); |
||||
buf = NULL; |
||||
len += r; |
||||
} while (r == blocksize && len < max_read); |
||||
|
||||
return LI_NETWORK_STATUS_SUCCESS; |
||||
} |
||||
|
||||
static void openssl_sock_release(liServerSocket *srv_sock) { |
||||
openssl_context *ctx = srv_sock->data; |
||||
|
||||
if (!ctx) return; |
||||
|
||||
SSL_CTX_free(ctx->ssl_ctx); |
||||
g_slice_free(openssl_context, ctx); |
||||
} |
||||
|
||||
static void openssl_setup_listen_cb(liServer *srv, int fd, gpointer data) { |
||||
openssl_context *ctx = data; |
||||
liServerSocket *srv_sock; |
||||
UNUSED(data); |
||||
|
||||
if (-1 == fd) { |
||||
SSL_CTX_free(ctx->ssl_ctx); |
||||
g_slice_free(openssl_context, ctx); |
||||
return; |
||||
} |
||||
|
||||
srv_sock = li_server_listen(srv, fd); |
||||
|
||||
srv_sock->data = ctx; |
||||
|
||||
srv_sock->write_cb = openssl_con_write; |
||||
srv_sock->read_cb = openssl_con_read; |
||||
srv_sock->new_cb = openssl_con_new; |
||||
srv_sock->close_cb = openssl_con_close; |
||||
srv_sock->release_cb = openssl_sock_release; |
||||
} |
||||
|
||||
static gboolean openssl_setup(liServer *srv, liPlugin* p, liValue *val) { |
||||
openssl_context *ctx; |
||||
GHashTableIter hti; |
||||
gpointer hkey, hvalue; |
||||
GString *htkey; |
||||
liValue *htval; |
||||
|
||||
/* options */ |
||||
const char *pemfile = NULL, *ca_file = NULL, *ciphers = NULL; |
||||
GString *ipstr = NULL; |
||||
gboolean allow_ssl2 = FALSE; |
||||
|
||||
UNUSED(p); |
||||
|
||||
if (val->type != LI_VALUE_HASH) { |
||||
ERROR(srv, "%s", "openssl expects a hash as parameter"); |
||||
return FALSE; |
||||
} |
||||
|
||||
g_hash_table_iter_init(&hti, val->data.hash); |
||||
while (g_hash_table_iter_next(&hti, &hkey, &hvalue)) { |
||||
htkey = hkey; htval = hvalue; |
||||
|
||||
if (g_str_equal(htkey->str, "listen")) { |
||||
if (htval->type != LI_VALUE_STRING) { |
||||
ERROR(srv, "%s", "openssl pemfile expects a string as parameter"); |
||||
return FALSE; |
||||
} |
||||
ipstr = htval->data.string; |
||||
} else if (g_str_equal(htkey->str, "pemfile")) { |
||||
if (htval->type != LI_VALUE_STRING) { |
||||
ERROR(srv, "%s", "openssl pemfile expects a string as parameter"); |
||||
return FALSE; |
||||
} |
||||
pemfile = htval->data.string->str; |
||||
} else if (g_str_equal(htkey->str, "ca-file")) { |
||||
if (htval->type != LI_VALUE_STRING) { |
||||
ERROR(srv, "%s", "openssl ca-file expects a string as parameter"); |
||||
return FALSE; |
||||
} |
||||
ca_file = htval->data.string->str; |
||||
} else if (g_str_equal(htkey->str, "ciphers")) { |
||||
if (htval->type != LI_VALUE_STRING) { |
||||
ERROR(srv, "%s", "openssl ciphers expects a string as parameter"); |
||||
return FALSE; |
||||
} |
||||
ciphers = htval->data.string->str; |
||||
} else if (g_str_equal(htkey->str, "allow-ssl2")) { |
||||
if (htval->type != LI_VALUE_BOOLEAN) { |
||||
ERROR(srv, "%s", "openssl allow-ssl2 expects a boolean as parameter"); |
||||
return FALSE; |
||||
} |
||||
allow_ssl2 = htval->data.boolean; |
||||
} |
||||
} |
||||
|
||||
if (!ipstr) { |
||||
ERROR(srv, "%s", "openssl needs a listen parameter"); |
||||
return FALSE; |
||||
} |
||||
|
||||
if (!pemfile) { |
||||
ERROR(srv, "%s", "openssl needs a pemfile"); |
||||
return FALSE; |
||||
} |
||||
|
||||
ctx = g_slice_new0(openssl_context); |
||||
|
||||
if (NULL == (ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method()))) { |
||||
ERROR(srv, "SSL_CTX_new: %s", ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
|
||||
if (!allow_ssl2) { |
||||
/* disable SSLv2 */ |
||||
if (SSL_OP_NO_SSLv2 != SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2)) { |
||||
ERROR(srv, "SSL_CTX_set_options(SSL_OP_NO_SSLv2): %s", ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
} |
||||
|
||||
if (ciphers) { |
||||
/* Disable support for low encryption ciphers */ |
||||
if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, ciphers) != 1) { |
||||
ERROR(srv, "SSL_CTX_set_cipher_list('%s'): %s", ciphers, ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
} |
||||
|
||||
if (ca_file) { |
||||
if (1 != SSL_CTX_load_verify_locations(ctx->ssl_ctx, ca_file, NULL)) { |
||||
ERROR(srv, "SSL_CTX_load_verify_locations('%s'): %s", ca_file, ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
} |
||||
|
||||
if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, pemfile, SSL_FILETYPE_PEM) < 0) { |
||||
ERROR(srv, "SSL_CTX_use_certificate_file('%s'): %s", pemfile, |
||||
ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
|
||||
if (SSL_CTX_use_PrivateKey_file (ctx->ssl_ctx, pemfile, SSL_FILETYPE_PEM) < 0) { |
||||
ERROR(srv, "SSL_CTX_use_PrivateKey_file('%s'): %s", pemfile, |
||||
ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
|
||||
if (SSL_CTX_check_private_key(ctx->ssl_ctx) != 1) { |
||||
ERROR(srv, "SSL: Private key '%s' does not match the certificate public key, reason: %s", pemfile, |
||||
ERR_error_string(ERR_get_error(), NULL)); |
||||
goto error_free_socket; |
||||
} |
||||
|
||||
SSL_CTX_set_default_read_ahead(ctx->ssl_ctx, 1); |
||||
SSL_CTX_set_mode(ctx->ssl_ctx, SSL_CTX_get_mode(ctx->ssl_ctx) | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); |
||||
|
||||
li_angel_listen(srv, ipstr, openssl_setup_listen_cb, ctx); |
||||
|
||||
return TRUE; |
||||
|
||||
error_free_socket: |
||||
if (ctx) { |
||||
if (ctx->ssl_ctx) SSL_CTX_free(ctx->ssl_ctx); |
||||
g_slice_free(openssl_context, ctx); |
||||
} |
||||
|
||||
return FALSE; |
||||
} |
||||
|
||||
static const liPluginOption options[] = { |
||||
{ NULL, 0, NULL, NULL, NULL } |
||||
}; |
||||
|
||||
static const liPluginAction actions[] = { |
||||
{ NULL, NULL } |
||||
}; |
||||
|
||||
static const liPluginSetup setups[] = { |
||||
{ "openssl", openssl_setup }, |
||||
|
||||
{ NULL, NULL } |
||||
}; |
||||
|
||||
|
||||
static void plugin_init(liServer *srv, liPlugin *p) { |
||||
UNUSED(srv); |
||||
|
||||
p->options = options; |
||||
p->actions = actions; |
||||
p->setups = setups; |
||||
} |
||||
|
||||
gboolean mod_openssl_init(liModules *mods, liModule *mod) { |
||||
MODULE_VERSION_CHECK(mods); |
||||
|
||||
SSL_load_error_strings(); |
||||
SSL_library_init(); |
||||
|
||||
if (0 == RAND_status()) { |
||||
ERROR(mods->main, "SSL: %s", "not enough entropy in the pool"); |
||||
return FALSE; |
||||
} |
||||
|
||||
mod->config = li_plugin_register(mods->main, "mod_openssl", plugin_init); |
||||
|
||||
return mod->config != NULL; |
||||
} |
||||
|
||||
gboolean mod_openssl_free(liModules *mods, liModule *mod) { |
||||
if (mod->config) |
||||
li_plugin_free(mods->main, mod->config); |
||||
|
||||
return TRUE; |
||||
} |
||||
Loading…
Reference in new issue