Changeset 87 for trunk/sources/thelib/src/protocols/ssl/basesslprotocol.cpp

Timestamp:

08/21/10 19:30:35 (21 months ago)

Author:

shiretu

Message:

-- work on android apple streaming
-- work on new SSL support

Location:

trunk/sources/thelib/src/protocols/ssl

Files:

• . (added)
• basesslprotocol.cpp (moved) (moved from trunk/sources/thelib/src/protocols/sslprotocol.cpp) (9 diffs)

trunk/sources/thelib/src/protocols/ssl/basesslprotocol.cpp

@@ -18 +18 @@
  */
 
-#include "protocols/sslprotocol.h"
-
-#define MAX_SSL_READ_BUFFER 8192
-
-map<string, SSL_CTX *> SSLProtocol::_pGlobalContexts;
-bool SSLProtocol::_libraryInitialized = false;
-
-SSLProtocol::SSLProtocol()
-: BaseProtocol(PT_SSL) {
-        _pGlobalSSLContext1 = NULL;
+#include "protocols/ssl/basesslprotocol.h"
+
+#define MAX_SSL_READ_BUFFER 65536
+
+map<string, SSL_CTX *> BaseSSLProtocol::_pGlobalContexts;
+bool BaseSSLProtocol::_libraryInitialized = false;
+
+BaseSSLProtocol::BaseSSLProtocol(uint64_t type)
+: BaseProtocol(type) {
+        _pGlobalSSLContext = NULL;
         _pSSL = NULL;
+        _sslHandshakeCompleted = false;
         _pReadBuffer = new uint8_t[MAX_SSL_READ_BUFFER];
-        FINEST("SSL protocol created");
-}
-
-SSLProtocol::~SSLProtocol() {
+}
+
+BaseSSLProtocol::~BaseSSLProtocol() {
         if (_pSSL != NULL) {
                 SSL_free(_pSSL);
@@ -39 +39 @@
         }
         delete[] _pReadBuffer;
-        FINEST("SSL protocol deleted");
-}
-
-bool SSLProtocol::Initialize(Variant &parameters) {
-        //1. Comput the hash on key/cert pair and see
-        //if we have a global context with that hash
-        string hash = "";
-        if (parameters["hash"] != V_STRING) {
-                if (parameters[CONF_SSL_KEY] != V_STRING
-                                || parameters[CONF_SSL_CERT] != V_STRING) {
-                        FATAL("No key/cert provided");
-                        return false;
-                }
-                hash = md5((string) parameters[CONF_SSL_KEY]
-                                + (string) parameters[CONF_SSL_CERT], true);
-                parameters["hash"] = hash;
-        } else {
-                hash = (string) parameters["hash"];
-        }
-        string key = parameters[CONF_SSL_KEY];
-        string cert = parameters[CONF_SSL_CERT];
-        _pGlobalSSLContext1 = _pGlobalContexts[hash];
-
-        //2. Initialize the global context based on the specified
-        //key/cert pair if we don't have it
-        if (_pGlobalSSLContext1 == NULL) {
-                if (!_libraryInitialized) {
-                        //3. This is the first time we use the library. So we have to
-                        //initialize it first
-                        SSL_library_init();
-
-                        //init readable error messages
-                        SSL_load_error_strings();
-                        ERR_load_SSL_strings();
-                        ERR_load_CRYPTO_strings();
-                        ERR_load_crypto_strings();
-                        OpenSSL_add_all_algorithms();
-                        OpenSSL_add_all_ciphers();
-                        OpenSSL_add_all_digests();
-
-                        //initialize the random numbers generator
-                        InitRandGenerator();
-                        _libraryInitialized = false;
-                }
-
-                //4. prepare the global ssl context
-                _pGlobalSSLContext1 = SSL_CTX_new(SSLv23_method());
-                if (_pGlobalSSLContext1 == NULL) {
-                        FATAL("Unable to create global SSL context");
-                        return false;
-                }
-
-                //5. setup the certificate
-                if (SSL_CTX_use_certificate_file(_pGlobalSSLContext1, STR(cert),
-                                SSL_FILETYPE_PEM) <= 0) {
-                        FATAL("Unable to load certificate %s; Error(s) was: %s",
-                                        STR(cert),
-                                        STR(GetSSLErrors()));
-                        SSL_CTX_free(_pGlobalSSLContext1);
-                        _pGlobalSSLContext1 = NULL;
-                        return false;
-                }
-
-                //6. setup the private key
-                if (SSL_CTX_use_PrivateKey_file(_pGlobalSSLContext1, STR(key),
-                                SSL_FILETYPE_PEM) <= 0) {
-                        FATAL("Unable to load key %s; Error(s) was: %s",
-                                        STR(key),
-                                        STR(GetSSLErrors()));
-                        SSL_CTX_free(_pGlobalSSLContext1);
-                        _pGlobalSSLContext1 = NULL;
-                        return false;
-                }
-
-                //7. disable client certificate authentication
-                SSL_CTX_set_verify(_pGlobalSSLContext1, SSL_VERIFY_NONE, NULL);
-
-                //8. Store the global context for later usage
-                _pGlobalContexts[hash] = _pGlobalSSLContext1;
-        }
-
-        //9. create connection SSL context
-        _pSSL = SSL_new(_pGlobalSSLContext1);
+}
+
+bool BaseSSLProtocol::Initialize(Variant &parameters) {
+        //1. Initialize the SSL library
+        if (!_libraryInitialized) {
+                //3. This is the first time we use the library. So we have to
+                //initialize it first
+                SSL_library_init();
+
+                //init readable error messages
+                SSL_load_error_strings();
+                ERR_load_SSL_strings();
+                ERR_load_CRYPTO_strings();
+                ERR_load_crypto_strings();
+                OpenSSL_add_all_algorithms();
+                OpenSSL_add_all_ciphers();
+                OpenSSL_add_all_digests();
+
+                //initialize the random numbers generator
+                InitRandGenerator();
+                _libraryInitialized = false;
+        }
+
+        //2. Initialize the global context
+        if (!InitGlobalContext(parameters)) {
+                FATAL("Unable to initialize global context");
+                return false;
+        }
+
+        //3. create connection SSL context
+        _pSSL = SSL_new(_pGlobalSSLContext);
         if (_pSSL == NULL) {
                 FATAL("Unable to create SSL connection context");
@@ -127 +75 @@
         }
 
+        //4. setup the I/O buffers
         SSL_set_bio(_pSSL, BIO_new(BIO_s_mem()), BIO_new(BIO_s_mem()));
-        SSL_set_accept_state(_pSSL);
-
-        return true;
-}
-
-bool SSLProtocol::AllowFarProtocol(uint64_t type) {
+
+        return DoHandshake();
+}
+
+bool BaseSSLProtocol::AllowFarProtocol(uint64_t type) {
         if (type == PT_TCP)
                 return true;
@@ -140 +88 @@
 }
 
-bool SSLProtocol::AllowNearProtocol(uint64_t type) {
+bool BaseSSLProtocol::AllowNearProtocol(uint64_t type) {
         return true;
 }
 
-bool SSLProtocol::EnqueueForOutbound() {
+bool BaseSSLProtocol::EnqueueForOutbound() {
+        //1. Is the SSL handshake completed?
+        if (!_sslHandshakeCompleted) {
+                return DoHandshake();
+        }
+
+        //2. Do we have some outstanding data?
         IOBuffer *pBuffer = _pNearProtocol->GetOutputBuffer();
         if (pBuffer == NULL)
                 return true;
+
+        //3. Encrypt the outstanding data
         if (SSL_write(_pSSL, GETIBPOINTER(*pBuffer), GETAVAILABLEBYTESCOUNT(*pBuffer))
                         != (int32_t) GETAVAILABLEBYTESCOUNT(*pBuffer)) {
@@ -154 +110 @@
         }
         pBuffer->IgnoreAll();
+
+        //4. Do the actual I/O
         return PerformIO();
 }
 
-IOBuffer * SSLProtocol::GetOutputBuffer() {
+IOBuffer * BaseSSLProtocol::GetOutputBuffer() {
         if (GETAVAILABLEBYTESCOUNT(_outputBuffer) > 0)
                 return &_outputBuffer;
@@ -163 +121 @@
 }
 
-IOBuffer * SSLProtocol::GetInputBuffer() {
+IOBuffer * BaseSSLProtocol::GetInputBuffer() {
         return &_inputBuffer;
 }
 
-bool SSLProtocol::SignalInputData(int32_t recvAmount) {
+bool BaseSSLProtocol::SignalInputData(int32_t recvAmount) {
         ASSERT("OPERATION NOT SUPPORTED");
         return false;
 }
 
-bool SSLProtocol::SignalInputData(IOBuffer &buffer) {
-        //2. get the SSL input buffer
+bool BaseSSLProtocol::SignalInputData(IOBuffer &buffer) {
+        //1. get the SSL input buffer
         BIO *pInBio = SSL_get_rbio(_pSSL);
 
-        //3. dump all the data from the network inside the ssl input
+        //2. dump all the data from the network inside the ssl input
         BIO_write(pInBio, GETIBPOINTER(buffer),
                         GETAVAILABLEBYTESCOUNT(buffer));
         buffer.IgnoreAll();
 
-        //4. Try to do the handshake
-        int32_t errorCode = SSL_ERROR_NONE;
-        if (!SSL_is_init_finished(_pSSL)) {
-                errorCode = SSL_accept(_pSSL);
-                if (errorCode < 0) {
-                        int32_t error = SSL_get_error(_pSSL, errorCode);
-                        if (error != SSL_ERROR_WANT_READ &&
-                                        error != SSL_ERROR_WANT_WRITE) {
-                                FATAL("Unable to accept SSL connection: %d; %s",
-                                                error, STR(GetSSLErrors()));
-                                return false;
-                        }
-                }
-        }
-
-        //5. if the init is made, read the actual data an put it in the
-        //descrypted input buffer
-        if (SSL_is_init_finished(_pSSL)) {
-                int32_t read = 0;
-                while ((read = SSL_read(_pSSL, _pReadBuffer, MAX_SSL_READ_BUFFER)) > 0) {
-                        _inputBuffer.ReadFromBuffer(_pReadBuffer, (uint32_t) read);
-                }
-                if (read < 0) {
-                        int32_t error = SSL_get_error(_pSSL, read);
-                        if (error != SSL_ERROR_WANT_READ &&
-                                        error != SSL_ERROR_WANT_WRITE) {
-                                FATAL("Unable to read data: %d", error);
-                                return false;
-                        }
-                }
-        }
-
-        //6. If we have pending data inside the decrypted buffer, bubble it up
-        //on the protocol stack
+        //3. Do we have to do some handshake?
+        if (!_sslHandshakeCompleted) {
+                if (!DoHandshake()) {
+                        FATAL("Unable to do the SSL handshake");
+                        return false;
+                }
+                if (!_sslHandshakeCompleted) {
+                        //WARN("SSL handshake not completed yet");
+                        return true;
+                }
+        }
+
+        //4. Read the actual data an put it in the descrypted input buffer
+        int32_t read = 0;
+        while ((read = SSL_read(_pSSL, _pReadBuffer, MAX_SSL_READ_BUFFER)) > 0) {
+                _inputBuffer.ReadFromBuffer(_pReadBuffer, (uint32_t) read);
+        }
+        if (read < 0) {
+                int32_t error = SSL_get_error(_pSSL, read);
+                if (error != SSL_ERROR_WANT_READ &&
+                                error != SSL_ERROR_WANT_WRITE) {
+                        FATAL("Unable to read data: %d", error);
+                        return false;
+                }
+        }
+
+        //6. If we have pending data inside the decrypted buffer, bubble it up on the protocol stack
+        //FINEST("_inputBuffer:\n%s", STR(_inputBuffer));
         if (GETAVAILABLEBYTESCOUNT(_inputBuffer) > 0) {
                 if (_pNearProtocol != NULL) {
@@ -225 +177 @@
 
         //7. After the data was sent on the upper layers, we might have outstanding
-        //data that needs to be sent. Also this outstanding data might come from
-        //the ssl handshake itself. So we do I/O
+        //data that needs to be sent.
         return PerformIO();
 }
 
-string SSLProtocol::DumpBIO(BIO *pBIO) {
+bool BaseSSLProtocol::PerformIO() {
+        //1. Put the data from SSL output buffer inside our protocol output buffer
+        if (!_outputBuffer.ReadFromBIO(SSL_get_wbio(_pSSL))) {
+                FATAL("Unable to transfer data from outBIO to outputBuffer");
+                return false;
+        }
+
+        //2. Enqueue the protocol for outbound if we have data that needs to be sent
+        if (GETAVAILABLEBYTESCOUNT(_outputBuffer) > 0) {
+                if (_pFarProtocol != NULL) {
+                        return _pFarProtocol->EnqueueForOutbound();
+                }
+        }
+
+        //3. Done
+        return true;
+}
+
+string BaseSSLProtocol::GetSSLErrors() {
+        string result = "";
+        uint32_t errorCode;
+        char *pTempBuffer = new char[4096];
+        while ((errorCode = ERR_get_error()) != 0) {
+                memset(pTempBuffer, 0, 4096);
+                ERR_error_string_n(errorCode, pTempBuffer, 4095);
+                result += "\n";
+                result += pTempBuffer;
+        }
+        delete[] pTempBuffer;
+        return result;
+}
+
+string BaseSSLProtocol::DumpBIO(BIO *pBIO) {
         string formatString;
         formatString = "method: %p\n";
@@ -263 +246 @@
 }
 
-string SSLProtocol::GetSSLErrors() {
-        string result = "";
-        uint32_t errorCode;
-        char *pTempBuffer = new char[4096];
-        while ((errorCode = ERR_get_error()) != 0) {
-                memset(pTempBuffer, 0, 4096);
-                ERR_error_string_n(errorCode, pTempBuffer, 4095);
-                result += "\n";
-                result += pTempBuffer;
-        }
-        delete[] pTempBuffer;
-        return result;
-}
-
-void SSLProtocol::InitRandGenerator() {
+void BaseSSLProtocol::InitRandGenerator() {
         srand((uint32_t) time(NULL));
 
@@ -294 +263 @@
 }
 
-bool SSLProtocol::PerformIO() {
-        //1. Put the data from SSL output buffer inside our
-        //protocol output buffer
-        if (!_outputBuffer.ReadFromBIO(SSL_get_wbio(_pSSL))) {
-                FATAL("Unable to transfer data from outBIO to outputBuffer");
-                return false;
-        }
-
-        //2. Enqueue the protocol for outbound if we have data that needs
-        //to be sent
-        if (GETAVAILABLEBYTESCOUNT(_outputBuffer) > 0) {
-                if (_pFarProtocol != NULL) {
-                        return _pFarProtocol->EnqueueForOutbound();
-                }
-        }
-
-        //3. Done
-        return true;
-}
-
-
+