viossl.c 9.13 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
/* Copyright (C) 2000 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
   
   This library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Library General Public
   License as published by the Free Software Foundation; either
   version 2 of the License, or (at your option) any later version.
   
   This library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Library General Public License for more details.
   
   You should have received a copy of the GNU Library General Public
   License along with this library; if not, write to the Free
   Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
   MA 02111-1307, USA */

/*
  Note that we can't have assertion on file descriptors;  The reason for
  this is that during mysql shutdown, another thread can close a file
  we are working on.  In this case we should just return read errors from
  the file descriptior.
*/

25
#include <my_global.h>
26 27 28

#ifdef HAVE_OPENSSL

29
#include <mysql_com.h>
30 31 32

#include <errno.h>
#include <assert.h>
33
#include <violite.h>
34 35 36 37 38 39 40 41
#include <my_sys.h>
#include <my_net.h>
#include <m_string.h>

#ifndef __WIN__
#define HANDLE void *
#endif

42 43 44 45 46 47
static void
report_errors()
{
  unsigned long	l;
  const char*	file;
  const char*	data;
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
48
  int		line,flags, any_ssl_error = 0;
49 50 51 52 53
  DBUG_ENTER("report_errors");

  while ((l=ERR_get_error_line_data(&file,&line,&data,&flags)) != 0)
  {
    char buf[200];
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
54
    any_ssl_error = 1;
55 56 57
    DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf),
			 file,line,(flags&ERR_TXT_STRING)?data:"")) ;
  }
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
58 59 60
  if (!any_ssl_error) {
    DBUG_PRINT("info", ("No OpenSSL errors."));
  }
61
  DBUG_PRINT("info", ("BTW, errno=%d", scoket_errno));
62 63 64 65
  DBUG_VOID_RETURN;
}


66
void vio_ssl_delete(Vio * vio)
67 68 69 70 71 72 73 74 75 76 77
{
  /* It must be safe to delete null pointers. */
  /* This matches the semantics of C++'s delete operator. */
  if (vio)
  {
    if (vio->type != VIO_CLOSED)
      vio_close(vio);
    my_free((gptr) vio,MYF(0));
  }
}

78
int vio_ssl_errno(Vio *vio __attribute__((unused)))
79
{
80
  return socket_errno;	/* On Win32 this mapped to WSAGetLastError() */
81 82 83
}


84
int vio_ssl_read(Vio * vio, gptr buf, int size)
85 86 87
{
  int r;
  DBUG_ENTER("vio_ssl_read");
monty@hundin.mysql.fi's avatar
monty@hundin.mysql.fi committed
88 89
  DBUG_PRINT("enter", ("sd=%d, buf=%p, size=%d, ssl_=%p",
		       vio->sd, buf, size, vio->ssl_));
90

tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
91 92 93
#ifndef DBUG_OFF
  errno = 0;
#endif /* DBUG_OFF */
94 95
  r = SSL_read(vio->ssl_, buf, size);
#ifndef DBUG_OFF
96 97 98
  if ( r<= 0) {
    r=SSL_get_error(vio->ssl_, r);
    DBUG_PRINT("info",("SSL_get_error returned %d",r));
99
    report_errors();
100
  }
101 102 103 104 105 106
#endif /* DBUG_OFF */
  DBUG_PRINT("exit", ("%d", r));
  DBUG_RETURN(r);
}


107
int vio_ssl_write(Vio * vio, const gptr buf, int size)
108 109 110 111
{
  int r;
  DBUG_ENTER("vio_ssl_write");
  DBUG_PRINT("enter", ("sd=%d, buf=%p, size=%d", vio->sd, buf, size));
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
112 113 114 115

#ifndef DBUG_OFF
  errno = 0;
#endif /* DBUG_OFF */
116 117 118 119 120 121 122 123 124 125
  r = SSL_write(vio->ssl_, buf, size);
#ifndef DBUG_OFF
  if (r<0)
    report_errors();
#endif /* DBUG_OFF */
  DBUG_PRINT("exit", ("%d", r));
  DBUG_RETURN(r);
}


126
int vio_ssl_fastsend(Vio * vio __attribute__((unused)))
127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151
{
  int r=0;
  DBUG_ENTER("vio_ssl_fastsend");

#ifdef IPTOS_THROUGHPUT
  {
#ifndef __EMX__
    int tos = IPTOS_THROUGHPUT;
    if (!setsockopt(vio->sd, IPPROTO_IP, IP_TOS, (void *) &tos, sizeof(tos)))
#endif				/* !__EMX__ */
    {
      int nodelay = 1;
      if (setsockopt(vio->sd, IPPROTO_TCP, TCP_NODELAY, (void *) &nodelay,
		     sizeof(nodelay))) {
	DBUG_PRINT("warning",
		   ("Couldn't set socket option for fast send"));
	r= -1;
      }
    }
  }
#endif	/* IPTOS_THROUGHPUT */
  DBUG_PRINT("exit", ("%d", r));
  DBUG_RETURN(r);
}

152
int vio_ssl_keepalive(Vio* vio, my_bool set_keep_alive)
153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170
{
  int r=0;
  uint opt = 0;
  DBUG_ENTER("vio_ssl_keepalive");
  DBUG_PRINT("enter", ("sd=%d, set_keep_alive=%d", vio->sd, (int)
		       set_keep_alive));
  if (vio->type != VIO_TYPE_NAMEDPIPE)
  {
    if (set_keep_alive)
      opt = 1;
    r = setsockopt(vio->sd, SOL_SOCKET, SO_KEEPALIVE, (char *) &opt,
		   sizeof(opt));
  }
  DBUG_RETURN(r);
}


my_bool
171
vio_ssl_should_retry(Vio * vio __attribute__((unused)))
172
{
173 174 175
  int en = socket_errno;
  return (en == SOCKET_EAGAIN || en == SOCKET_EINTR ||
	  en == SOCKET_EWOULDBLOCK);
176 177 178
}


179
int vio_ssl_close(Vio * vio)
180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195
{
  int r;
  DBUG_ENTER("vio_ssl_close");
  r=0;
  if (vio->ssl_)
  {
    r = SSL_shutdown(vio->ssl_);
    SSL_free(vio->ssl_);
    vio->ssl_= 0;
  }
  if (shutdown(vio->sd,2))
    r= -1;
  if (closesocket(vio->sd))
    r= -1;
  if (r)
  {
196
    DBUG_PRINT("error", ("close() failed, error: %d",socket_errno));
197
    report_errors();
198 199 200 201 202 203 204 205
    /* FIXME: error handling (not critical for MySQL) */
  }
  vio->type= VIO_CLOSED;
  vio->sd=   -1;
  DBUG_RETURN(r);
}


206
const char *vio_ssl_description(Vio * vio)
207 208 209 210
{
  return vio->desc;
}

211
enum enum_vio_type vio_ssl_type(Vio* vio)
212 213 214 215
{
  return vio->type;
}

216
my_socket vio_ssl_fd(Vio* vio)
217 218 219 220 221
{
  return vio->sd;
}


222
my_bool vio_ssl_peer_addr(Vio * vio, char *buf)
223 224 225 226 227 228 229 230 231 232 233 234 235
{
  DBUG_ENTER("vio_ssl_peer_addr");
  DBUG_PRINT("enter", ("sd=%d", vio->sd));
  if (vio->localhost)
  {
    strmov(buf,"127.0.0.1");
  }
  else
  {
    size_socket addrLen = sizeof(struct sockaddr);
    if (getpeername(vio->sd, (struct sockaddr *) (& (vio->remote)),
		    &addrLen) != 0)
    {
236
      DBUG_PRINT("exit", ("getpeername, error: %d", socket_errno));
237 238 239 240 241 242 243 244 245 246
      DBUG_RETURN(1);
    }
    /* FIXME */
/*    my_inet_ntoa(vio->remote.sin_addr,buf); */
  }
  DBUG_PRINT("exit", ("addr=%s", buf));
  DBUG_RETURN(0);
}


247
void vio_ssl_in_addr(Vio *vio, struct in_addr *in)
248 249 250 251 252 253 254 255 256 257 258 259
{
  DBUG_ENTER("vio_ssl_in_addr");
  if (vio->localhost)
    bzero((char*) in, sizeof(*in));	/* This should never be executed */
  else
    *in=vio->remote.sin_addr;
  DBUG_VOID_RETURN;
}


/* Return 0 if there is data to be read */

260
my_bool vio_ssl_poll_read(Vio *vio,uint timeout)
261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278
{
#ifndef HAVE_POLL
  return 0;
#else
  struct pollfd fds;
  int res;
  DBUG_ENTER("vio_ssl_poll");
  fds.fd=vio->sd;
  fds.events=POLLIN;
  fds.revents=0;
  if ((res=poll(&fds,1,(int) timeout*1000)) <= 0)
  {
    DBUG_RETURN(res < 0 ? 0 : 1);		/* Don't return 1 on errors */
  }
  DBUG_RETURN(fds.revents & POLLIN ? 0 : 1);
#endif
}

279
void sslaccept(struct st_VioSSLAcceptorFd* ptr, Vio* vio, long timeout)
280
{
281
  X509* client_cert;
282
  char *str;
283
  char buf[1024];
284
  DBUG_ENTER("sslaccept");
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
285 286 287 288 289
  DBUG_PRINT("enter", ("sd=%d ptr=%p", vio->sd,ptr));
  vio_reset(vio,VIO_TYPE_SSL,vio->sd,0,FALSE);
  vio->ssl_=0;
  vio->open_=FALSE; 
  if (!(vio->ssl_ = SSL_new(ptr->ssl_context_)))
290 291 292
  {
    DBUG_PRINT("error", ("SSL_new failure"));
    report_errors();
293
    DBUG_VOID_RETURN;
294
  }
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
295
  DBUG_PRINT("info", ("ssl_=%p",vio->ssl_));
296
  SSL_clear(vio->ssl_);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
297
  vio_blocking(vio, FALSE);
298
  SSL_SESSION_set_timeout(SSL_get_session(vio->ssl_), timeout);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
299 300
  SSL_set_fd(vio->ssl_,vio->sd);
  SSL_set_accept_state(vio->ssl_);
301
  SSL_do_handshake(vio->ssl_);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
302 303 304 305 306
  vio->open_ = TRUE;
#ifndef DBUF_OFF
  DBUG_PRINT("info",("SSL_get_cipher_name() = '%s'"
		     ,SSL_get_cipher_name(vio->ssl_)));
  client_cert = SSL_get_peer_certificate (vio->ssl_);
307 308 309 310 311 312 313 314 315 316 317 318 319
  if (client_cert != NULL) {
    DBUG_PRINT("info",("Client certificate:"));
    str = X509_NAME_oneline (X509_get_subject_name (client_cert), 0, 0);
    DBUG_PRINT("info",("\t subject: %s", str));
    free (str);

    str = X509_NAME_oneline (X509_get_issuer_name  (client_cert), 0, 0);
    DBUG_PRINT("info",("\t issuer: %s", str));
    free (str);

    X509_free (client_cert);
  } else
    DBUG_PRINT("info",("Client does not have certificate."));
320 321 322 323 324 325 326 327 328 329 330
  
  str=SSL_get_shared_ciphers(vio->ssl_, buf, sizeof(buf));
  if(str)
  {
    DBUG_PRINT("info",("SSL_get_shared_ciphers() returned '%s'",str));
  }
  else
  {
    DBUG_PRINT("info",("no shared ciphers!"));
  }

tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
331
#endif
332
  DBUG_VOID_RETURN;
333 334
}

335
void sslconnect(struct st_VioSSLConnectorFd* ptr, Vio* vio, long timeout)
336
{
337 338
  char *str;
  X509*    server_cert;
339
  DBUG_ENTER("sslconnect");
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
340 341
  DBUG_PRINT("enter", ("sd=%d ptr=%p ctx: %p", vio->sd,ptr,ptr->ssl_context_));
  vio_reset(vio,VIO_TYPE_SSL,vio->sd,0,FALSE);
342

tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
343 344 345
  vio->ssl_=0;
  vio->open_=FALSE; 
  if (!(vio->ssl_ = SSL_new(ptr->ssl_context_)))
346 347 348
  {
    DBUG_PRINT("error", ("SSL_new failure"));
    report_errors();
349
    DBUG_VOID_RETURN;
350
  }
351 352
  DBUG_PRINT("info",("ssl_=%p",vio->ssl_));
  SSL_clear(vio->ssl_);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
353
  vio_blocking(vio, FALSE);
354
  SSL_SESSION_set_timeout(SSL_get_session(vio->ssl_), timeout);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
355 356
  SSL_set_fd (vio->ssl_, vio->sd);
  SSL_set_connect_state(vio->ssl_);
357
  SSL_do_handshake(vio->ssl_);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
358 359 360 361 362
  vio->open_ = TRUE;
#ifndef DBUG_OFF
  DBUG_PRINT("info",("SSL_get_cipher_name() = '%s'"
		     ,SSL_get_cipher_name(vio->ssl_)));
  server_cert = SSL_get_peer_certificate (vio->ssl_);
363 364 365 366 367 368 369
  if (server_cert != NULL) {
    DBUG_PRINT("info",("Server certificate:"));
    str = X509_NAME_oneline (X509_get_subject_name (server_cert), 0, 0);
    DBUG_PRINT("info",("\t subject: %s", str));
    free (str);

    str = X509_NAME_oneline (X509_get_issuer_name  (server_cert), 0, 0);
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
370
    DBUG_PRINT("info",("\t issuer: %s", str));
371 372 373 374 375
    free (str);

    /* We could do all sorts of certificate verification stuff here before
     *        deallocating the certificate. */

tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
376
    X509_free (server_cert);
377 378
  } else
    DBUG_PRINT("info",("Server does not have certificate."));
tonu@x153.internalnet's avatar
tonu@x153.internalnet committed
379
#endif
380
  DBUG_VOID_RETURN;
381 382 383
}

#endif /* HAVE_OPENSSL */