henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2004 The WebRTC Project Authors. All rights reserved. |
| 3 | * |
| 4 | * Use of this source code is governed by a BSD-style license |
| 5 | * that can be found in the LICENSE file in the root of the source |
| 6 | * tree. An additional intellectual property rights grant can be found |
| 7 | * in the file PATENTS. All contributing project authors may |
| 8 | * be found in the AUTHORS file in the root of the source tree. |
| 9 | */ |
| 10 | |
Mirko Bonadei | 92ea95e | 2017-09-15 06:47:31 +0200 | [diff] [blame] | 11 | #ifndef RTC_BASE_OPENSSLADAPTER_H_ |
| 12 | #define RTC_BASE_OPENSSLADAPTER_H_ |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 13 | |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 14 | #include <openssl/ossl_typ.h> |
| 15 | |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 16 | #include <map> |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 17 | #include <memory> |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 18 | #include <string> |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 19 | #include <vector> |
| 20 | |
Mirko Bonadei | 92ea95e | 2017-09-15 06:47:31 +0200 | [diff] [blame] | 21 | #include "rtc_base/buffer.h" |
| 22 | #include "rtc_base/messagehandler.h" |
| 23 | #include "rtc_base/messagequeue.h" |
| 24 | #include "rtc_base/opensslidentity.h" |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 25 | #include "rtc_base/opensslsessioncache.h" |
Mirko Bonadei | 92ea95e | 2017-09-15 06:47:31 +0200 | [diff] [blame] | 26 | #include "rtc_base/ssladapter.h" |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 27 | |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 28 | namespace rtc { |
| 29 | |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 30 | class OpenSSLAdapter : public SSLAdapter, public MessageHandler { |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 31 | public: |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 32 | static bool InitializeSSL(VerificationCallback callback); |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 33 | static bool CleanupSSL(); |
| 34 | |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 35 | explicit OpenSSLAdapter(AsyncSocket* socket, |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 36 | OpenSSLSessionCache* ssl_session_cache = nullptr); |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 37 | ~OpenSSLAdapter() override; |
| 38 | |
Diogo Real | 1dca9d5 | 2017-08-29 12:18:32 -0700 | [diff] [blame] | 39 | void SetIgnoreBadCert(bool ignore) override; |
| 40 | void SetAlpnProtocols(const std::vector<std::string>& protos) override; |
Diogo Real | 7bd1f1b | 2017-09-08 12:50:41 -0700 | [diff] [blame] | 41 | void SetEllipticCurves(const std::vector<std::string>& curves) override; |
Diogo Real | 1dca9d5 | 2017-08-29 12:18:32 -0700 | [diff] [blame] | 42 | |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 43 | void SetMode(SSLMode mode) override; |
Steve Anton | 786de70 | 2017-08-17 15:15:46 -0700 | [diff] [blame] | 44 | void SetIdentity(SSLIdentity* identity) override; |
| 45 | void SetRole(SSLRole role) override; |
| 46 | AsyncSocket* Accept(SocketAddress* paddr) override; |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 47 | int StartSSL(const char* hostname, bool restartable) override; |
| 48 | int Send(const void* pv, size_t cb) override; |
| 49 | int SendTo(const void* pv, size_t cb, const SocketAddress& addr) override; |
| 50 | int Recv(void* pv, size_t cb, int64_t* timestamp) override; |
| 51 | int RecvFrom(void* pv, |
| 52 | size_t cb, |
| 53 | SocketAddress* paddr, |
| 54 | int64_t* timestamp) override; |
| 55 | int Close() override; |
| 56 | |
| 57 | // Note that the socket returns ST_CONNECTING while SSL is being negotiated. |
| 58 | ConnState GetState() const override; |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 59 | bool IsResumedSession() override; |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 60 | |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 61 | // Creates a new SSL_CTX object, configured for client-to-server usage |
| 62 | // with SSLMode |mode|, and if |enable_cache| is true, with support for |
| 63 | // storing successful sessions so that they can be later resumed. |
| 64 | // OpenSSLAdapterFactory will call this method to create its own internal |
| 65 | // SSL_CTX, and OpenSSLAdapter will also call this when used without a |
| 66 | // factory. |
| 67 | static SSL_CTX* CreateContext(SSLMode mode, bool enable_cache); |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 68 | |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 69 | protected: |
| 70 | void OnConnectEvent(AsyncSocket* socket) override; |
| 71 | void OnReadEvent(AsyncSocket* socket) override; |
| 72 | void OnWriteEvent(AsyncSocket* socket) override; |
| 73 | void OnCloseEvent(AsyncSocket* socket, int err) override; |
| 74 | |
| 75 | private: |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 76 | enum SSLState { |
| 77 | SSL_NONE, SSL_WAIT, SSL_CONNECTING, SSL_CONNECTED, SSL_ERROR |
| 78 | }; |
| 79 | |
| 80 | enum { MSG_TIMEOUT }; |
| 81 | |
| 82 | int BeginSSL(); |
| 83 | int ContinueSSL(); |
| 84 | void Error(const char* context, int err, bool signal = true); |
| 85 | void Cleanup(); |
| 86 | |
| 87 | // Return value and arguments have the same meanings as for Send; |error| is |
| 88 | // an output parameter filled with the result of SSL_get_error. |
| 89 | int DoSslWrite(const void* pv, size_t cb, int* error); |
| 90 | |
| 91 | void OnMessage(Message* msg) override; |
| 92 | |
Benjamin Wright | 9201d1a | 2018-04-05 12:12:26 -0700 | [diff] [blame] | 93 | bool SSLPostConnectionCheck(SSL* ssl, const std::string& host); |
| 94 | |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 95 | #if !defined(NDEBUG) |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 96 | // In debug builds, logs info about the state of the SSL connection. |
| 97 | static void SSLInfoCallback(const SSL* ssl, int where, int ret); |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 98 | #endif |
| 99 | static int SSLVerifyCallback(int ok, X509_STORE_CTX* store); |
| 100 | static VerificationCallback custom_verify_callback_; |
| 101 | friend class OpenSSLStreamAdapter; // for custom_verify_callback_; |
| 102 | |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 103 | // If the SSL_CTX was created with |enable_cache| set to true, this callback |
| 104 | // will be called when a SSL session has been successfully established, |
| 105 | // to allow its SSL_SESSION* to be cached for later resumption. |
| 106 | static int NewSSLSessionCallback(SSL* ssl, SSL_SESSION* session); |
| 107 | |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 108 | static bool ConfigureTrustedRootCertificates(SSL_CTX* ctx); |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 109 | |
| 110 | // Parent object that maintains shared state. |
| 111 | // Can be null if state sharing is not needed. |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 112 | OpenSSLSessionCache* ssl_session_cache_ = nullptr; |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 113 | |
| 114 | SSLState state_; |
Steve Anton | 786de70 | 2017-08-17 15:15:46 -0700 | [diff] [blame] | 115 | std::unique_ptr<OpenSSLIdentity> identity_; |
| 116 | SSLRole role_; |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 117 | bool ssl_read_needs_write_; |
| 118 | bool ssl_write_needs_read_; |
| 119 | // If true, socket will retain SSL configuration after Close. |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 120 | // TODO(juberti): Remove this unused flag. |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 121 | bool restartable_; |
| 122 | |
| 123 | // This buffer is used if SSL_write fails with SSL_ERROR_WANT_WRITE, which |
| 124 | // means we need to keep retrying with *the same exact data* until it |
| 125 | // succeeds. Afterwards it will be cleared. |
| 126 | Buffer pending_data_; |
| 127 | |
| 128 | SSL* ssl_; |
| 129 | SSL_CTX* ssl_ctx_; |
| 130 | std::string ssl_host_name_; |
| 131 | // Do DTLS or not |
| 132 | SSLMode ssl_mode_; |
Diogo Real | 1dca9d5 | 2017-08-29 12:18:32 -0700 | [diff] [blame] | 133 | // If true, the server certificate need not match the configured hostname. |
| 134 | bool ignore_bad_cert_; |
| 135 | // List of protocols to be used in the TLS ALPN extension. |
| 136 | std::vector<std::string> alpn_protocols_; |
Diogo Real | 7bd1f1b | 2017-09-08 12:50:41 -0700 | [diff] [blame] | 137 | // List of elliptic curves to be used in the TLS elliptic curves extension. |
| 138 | std::vector<std::string> elliptic_curves_; |
Henrik Kjellander | ec78f1c | 2017-06-29 07:52:50 +0200 | [diff] [blame] | 139 | |
| 140 | bool custom_verification_succeeded_; |
| 141 | }; |
| 142 | |
Diogo Real | 1dca9d5 | 2017-08-29 12:18:32 -0700 | [diff] [blame] | 143 | std::string TransformAlpnProtocols(const std::vector<std::string>& protos); |
| 144 | |
| 145 | ///////////////////////////////////////////////////////////////////////////// |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 146 | |
| 147 | // The OpenSSLAdapterFactory is responsbile for creating multiple new |
| 148 | // OpenSSLAdapters with a shared SSL_CTX and a shared SSL_SESSION cache. The |
| 149 | // SSL_SESSION cache allows existing SSL_SESSIONS to be reused instead of |
| 150 | // recreating them leading to a significant performance improvement. |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 151 | class OpenSSLAdapterFactory : public SSLAdapterFactory { |
| 152 | public: |
| 153 | OpenSSLAdapterFactory(); |
| 154 | ~OpenSSLAdapterFactory() override; |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 155 | // Set the SSL Mode to use with this factory. This should only be set before |
| 156 | // the first adapter is created with the factory. If it is called after it |
| 157 | // will DCHECK. |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 158 | void SetMode(SSLMode mode) override; |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 159 | // Constructs a new socket using the shared OpenSSLSessionCache. This means |
| 160 | // existing SSLSessions already in the cache will be reused instead of |
| 161 | // re-created for improved performance. |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 162 | OpenSSLAdapter* CreateAdapter(AsyncSocket* socket) override; |
Henrik Kjellander | c036276 | 2017-06-29 08:03:04 +0200 | [diff] [blame] | 163 | |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 164 | private: |
Benjamin Wright | 19aab2e | 2018-04-05 15:39:06 -0700 | [diff] [blame^] | 165 | // Holds the SSLMode (DTLS,TLS) that will be used to set the session cache. |
| 166 | SSLMode ssl_mode_ = SSL_MODE_TLS; |
| 167 | // Holds a cache of existing SSL Sessions. |
| 168 | std::unique_ptr<OpenSSLSessionCache> ssl_session_cache_; |
| 169 | // TODO(benwright): Remove this when context is moved to OpenSSLCommon. |
| 170 | // Hold a friend class to the OpenSSLAdapter to retrieve the context. |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 171 | friend class OpenSSLAdapter; |
Justin Uberti | 1d44550 | 2017-08-14 17:04:34 -0700 | [diff] [blame] | 172 | }; |
| 173 | |
| 174 | } // namespace rtc |
| 175 | |
Mirko Bonadei | 92ea95e | 2017-09-15 06:47:31 +0200 | [diff] [blame] | 176 | #endif // RTC_BASE_OPENSSLADAPTER_H_ |