1 /*
2 * Copyright 2008 The WebRTC Project Authors. All rights reserved.
3 *
4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree.
9 */
10
11 #include "rtc_base/openssl_adapter.h"
12
13 #include <errno.h>
14 #include <openssl/bio.h>
15 #include <openssl/err.h>
16 #ifdef OPENSSL_IS_BORINGSSL
17 #include <openssl/pool.h>
18 #endif
19 #include <openssl/rand.h>
20 #include <openssl/x509.h>
21 #include <string.h>
22 #include <time.h>
23
24 #include <memory>
25
26 // Use CRYPTO_BUFFER APIs if available and we have no dependency on X509
27 // objects.
28 #if defined(OPENSSL_IS_BORINGSSL) && \
29 defined(WEBRTC_EXCLUDE_BUILT_IN_SSL_ROOT_CERTS)
30 #define WEBRTC_USE_CRYPTO_BUFFER_CALLBACK
31 #endif
32
33 #include "absl/memory/memory.h"
34 #include "rtc_base/checks.h"
35 #include "rtc_base/location.h"
36 #include "rtc_base/logging.h"
37 #include "rtc_base/numerics/safe_conversions.h"
38 #include "rtc_base/openssl.h"
39 #ifdef OPENSSL_IS_BORINGSSL
40 #include "rtc_base/boringssl_identity.h"
41 #else
42 #include "rtc_base/openssl_identity.h"
43 #endif
44 #include "rtc_base/openssl_utility.h"
45 #include "rtc_base/string_encode.h"
46 #include "rtc_base/thread.h"
47
48 //////////////////////////////////////////////////////////////////////
49 // SocketBIO
50 //////////////////////////////////////////////////////////////////////
51
52 static int socket_write(BIO* h, const char* buf, int num);
53 static int socket_read(BIO* h, char* buf, int size);
54 static int socket_puts(BIO* h, const char* str);
55 static long socket_ctrl(BIO* h, int cmd, long arg1, void* arg2); // NOLINT
56 static int socket_new(BIO* h);
57 static int socket_free(BIO* data);
58
BIO_socket_method()59 static BIO_METHOD* BIO_socket_method() {
60 static BIO_METHOD* methods = [] {
61 BIO_METHOD* methods = BIO_meth_new(BIO_TYPE_BIO, "socket");
62 BIO_meth_set_write(methods, socket_write);
63 BIO_meth_set_read(methods, socket_read);
64 BIO_meth_set_puts(methods, socket_puts);
65 BIO_meth_set_ctrl(methods, socket_ctrl);
66 BIO_meth_set_create(methods, socket_new);
67 BIO_meth_set_destroy(methods, socket_free);
68 return methods;
69 }();
70 return methods;
71 }
72
BIO_new_socket(rtc::AsyncSocket * socket)73 static BIO* BIO_new_socket(rtc::AsyncSocket* socket) {
74 BIO* ret = BIO_new(BIO_socket_method());
75 if (ret == nullptr) {
76 return nullptr;
77 }
78 BIO_set_data(ret, socket);
79 return ret;
80 }
81
socket_new(BIO * b)82 static int socket_new(BIO* b) {
83 BIO_set_shutdown(b, 0);
84 BIO_set_init(b, 1);
85 BIO_set_data(b, 0);
86 return 1;
87 }
88
socket_free(BIO * b)89 static int socket_free(BIO* b) {
90 if (b == nullptr)
91 return 0;
92 return 1;
93 }
94
socket_read(BIO * b,char * out,int outl)95 static int socket_read(BIO* b, char* out, int outl) {
96 if (!out)
97 return -1;
98 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(BIO_get_data(b));
99 BIO_clear_retry_flags(b);
100 int result = socket->Recv(out, outl, nullptr);
101 if (result > 0) {
102 return result;
103 } else if (socket->IsBlocking()) {
104 BIO_set_retry_read(b);
105 }
106 return -1;
107 }
108
socket_write(BIO * b,const char * in,int inl)109 static int socket_write(BIO* b, const char* in, int inl) {
110 if (!in)
111 return -1;
112 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(BIO_get_data(b));
113 BIO_clear_retry_flags(b);
114 int result = socket->Send(in, inl);
115 if (result > 0) {
116 return result;
117 } else if (socket->IsBlocking()) {
118 BIO_set_retry_write(b);
119 }
120 return -1;
121 }
122
socket_puts(BIO * b,const char * str)123 static int socket_puts(BIO* b, const char* str) {
124 return socket_write(b, str, rtc::checked_cast<int>(strlen(str)));
125 }
126
socket_ctrl(BIO * b,int cmd,long num,void * ptr)127 static long socket_ctrl(BIO* b, int cmd, long num, void* ptr) { // NOLINT
128 switch (cmd) {
129 case BIO_CTRL_RESET:
130 return 0;
131 case BIO_CTRL_EOF: {
132 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(ptr);
133 // 1 means socket closed.
134 return (socket->GetState() == rtc::AsyncSocket::CS_CLOSED) ? 1 : 0;
135 }
136 case BIO_CTRL_WPENDING:
137 case BIO_CTRL_PENDING:
138 return 0;
139 case BIO_CTRL_FLUSH:
140 return 1;
141 default:
142 return 0;
143 }
144 }
145
LogSslError()146 static void LogSslError() {
147 // Walk down the error stack to find the SSL error.
148 uint32_t error_code;
149 const char* file;
150 int line;
151 do {
152 error_code = ERR_get_error_line(&file, &line);
153 if (ERR_GET_LIB(error_code) == ERR_LIB_SSL) {
154 RTC_LOG(LS_ERROR) << "ERR_LIB_SSL: " << error_code << ", " << file << ":"
155 << line;
156 break;
157 }
158 } while (error_code != 0);
159 }
160
161 /////////////////////////////////////////////////////////////////////////////
162 // OpenSSLAdapter
163 /////////////////////////////////////////////////////////////////////////////
164
165 namespace rtc {
166
InitializeSSL()167 bool OpenSSLAdapter::InitializeSSL() {
168 if (!SSL_library_init())
169 return false;
170 #if !defined(ADDRESS_SANITIZER) || !defined(WEBRTC_MAC) || defined(WEBRTC_IOS)
171 // Loading the error strings crashes mac_asan. Omit this debugging aid there.
172 SSL_load_error_strings();
173 #endif
174 ERR_load_BIO_strings();
175 OpenSSL_add_all_algorithms();
176 RAND_poll();
177 return true;
178 }
179
CleanupSSL()180 bool OpenSSLAdapter::CleanupSSL() {
181 return true;
182 }
183
OpenSSLAdapter(AsyncSocket * socket,OpenSSLSessionCache * ssl_session_cache,SSLCertificateVerifier * ssl_cert_verifier)184 OpenSSLAdapter::OpenSSLAdapter(AsyncSocket* socket,
185 OpenSSLSessionCache* ssl_session_cache,
186 SSLCertificateVerifier* ssl_cert_verifier)
187 : SSLAdapter(socket),
188 ssl_session_cache_(ssl_session_cache),
189 ssl_cert_verifier_(ssl_cert_verifier),
190 state_(SSL_NONE),
191 role_(SSL_CLIENT),
192 ssl_read_needs_write_(false),
193 ssl_write_needs_read_(false),
194 ssl_(nullptr),
195 ssl_ctx_(nullptr),
196 ssl_mode_(SSL_MODE_TLS),
197 ignore_bad_cert_(false),
198 custom_cert_verifier_status_(false) {
199 // If a factory is used, take a reference on the factory's SSL_CTX.
200 // Otherwise, we'll create our own later.
201 // Either way, we'll release our reference via SSL_CTX_free() in Cleanup().
202 if (ssl_session_cache_ != nullptr) {
203 ssl_ctx_ = ssl_session_cache_->GetSSLContext();
204 RTC_DCHECK(ssl_ctx_);
205 // Note: if using OpenSSL, requires version 1.1.0 or later.
206 SSL_CTX_up_ref(ssl_ctx_);
207 }
208 }
209
~OpenSSLAdapter()210 OpenSSLAdapter::~OpenSSLAdapter() {
211 Cleanup();
212 }
213
SetIgnoreBadCert(bool ignore)214 void OpenSSLAdapter::SetIgnoreBadCert(bool ignore) {
215 ignore_bad_cert_ = ignore;
216 }
217
SetAlpnProtocols(const std::vector<std::string> & protos)218 void OpenSSLAdapter::SetAlpnProtocols(const std::vector<std::string>& protos) {
219 alpn_protocols_ = protos;
220 }
221
SetEllipticCurves(const std::vector<std::string> & curves)222 void OpenSSLAdapter::SetEllipticCurves(const std::vector<std::string>& curves) {
223 elliptic_curves_ = curves;
224 }
225
SetMode(SSLMode mode)226 void OpenSSLAdapter::SetMode(SSLMode mode) {
227 RTC_DCHECK(!ssl_ctx_);
228 RTC_DCHECK(state_ == SSL_NONE);
229 ssl_mode_ = mode;
230 }
231
SetCertVerifier(SSLCertificateVerifier * ssl_cert_verifier)232 void OpenSSLAdapter::SetCertVerifier(
233 SSLCertificateVerifier* ssl_cert_verifier) {
234 RTC_DCHECK(!ssl_ctx_);
235 ssl_cert_verifier_ = ssl_cert_verifier;
236 }
237
SetIdentity(std::unique_ptr<SSLIdentity> identity)238 void OpenSSLAdapter::SetIdentity(std::unique_ptr<SSLIdentity> identity) {
239 RTC_DCHECK(!identity_);
240 #ifdef OPENSSL_IS_BORINGSSL
241 identity_ =
242 absl::WrapUnique(static_cast<BoringSSLIdentity*>(identity.release()));
243 #else
244 identity_ =
245 absl::WrapUnique(static_cast<OpenSSLIdentity*>(identity.release()));
246 #endif
247 }
248
SetRole(SSLRole role)249 void OpenSSLAdapter::SetRole(SSLRole role) {
250 role_ = role;
251 }
252
Accept(SocketAddress * paddr)253 AsyncSocket* OpenSSLAdapter::Accept(SocketAddress* paddr) {
254 RTC_DCHECK(role_ == SSL_SERVER);
255 AsyncSocket* socket = SSLAdapter::Accept(paddr);
256 if (!socket) {
257 return nullptr;
258 }
259
260 SSLAdapter* adapter = SSLAdapter::Create(socket);
261 adapter->SetIdentity(identity_->Clone());
262 adapter->SetRole(rtc::SSL_SERVER);
263 adapter->SetIgnoreBadCert(ignore_bad_cert_);
264 adapter->StartSSL("");
265 return adapter;
266 }
267
StartSSL(const char * hostname)268 int OpenSSLAdapter::StartSSL(const char* hostname) {
269 if (state_ != SSL_NONE)
270 return -1;
271
272 ssl_host_name_ = hostname;
273
274 if (socket_->GetState() != Socket::CS_CONNECTED) {
275 state_ = SSL_WAIT;
276 return 0;
277 }
278
279 state_ = SSL_CONNECTING;
280 if (int err = BeginSSL()) {
281 Error("BeginSSL", err, false);
282 return err;
283 }
284
285 return 0;
286 }
287
BeginSSL()288 int OpenSSLAdapter::BeginSSL() {
289 RTC_LOG(LS_INFO) << "OpenSSLAdapter::BeginSSL: " << ssl_host_name_;
290 RTC_DCHECK(state_ == SSL_CONNECTING);
291
292 int err = 0;
293 BIO* bio = nullptr;
294
295 // First set up the context. We should either have a factory, with its own
296 // pre-existing context, or be running standalone, in which case we will
297 // need to create one, and specify |false| to disable session caching.
298 if (ssl_session_cache_ == nullptr) {
299 RTC_DCHECK(!ssl_ctx_);
300 ssl_ctx_ = CreateContext(ssl_mode_, false);
301 }
302
303 if (!ssl_ctx_) {
304 err = -1;
305 goto ssl_error;
306 }
307
308 if (identity_ && !identity_->ConfigureIdentity(ssl_ctx_)) {
309 SSL_CTX_free(ssl_ctx_);
310 err = -1;
311 goto ssl_error;
312 }
313
314 bio = BIO_new_socket(socket_);
315 if (!bio) {
316 err = -1;
317 goto ssl_error;
318 }
319
320 ssl_ = SSL_new(ssl_ctx_);
321 if (!ssl_) {
322 err = -1;
323 goto ssl_error;
324 }
325
326 SSL_set_app_data(ssl_, this);
327
328 // SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER allows different buffers to be passed
329 // into SSL_write when a record could only be partially transmitted (and thus
330 // requires another call to SSL_write to finish transmission). This allows us
331 // to copy the data into our own buffer when this occurs, since the original
332 // buffer can't safely be accessed after control exits Send.
333 // TODO(deadbeef): Do we want SSL_MODE_ENABLE_PARTIAL_WRITE? It doesn't
334 // appear Send handles partial writes properly, though maybe we never notice
335 // since we never send more than 16KB at once..
336 SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE |
337 SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
338
339 // Enable SNI, if a hostname is supplied.
340 if (!ssl_host_name_.empty()) {
341 SSL_set_tlsext_host_name(ssl_, ssl_host_name_.c_str());
342
343 // Enable session caching, if configured and a hostname is supplied.
344 if (ssl_session_cache_ != nullptr) {
345 SSL_SESSION* cached = ssl_session_cache_->LookupSession(ssl_host_name_);
346 if (cached) {
347 if (SSL_set_session(ssl_, cached) == 0) {
348 RTC_LOG(LS_WARNING) << "Failed to apply SSL session from cache";
349 err = -1;
350 goto ssl_error;
351 }
352
353 RTC_LOG(LS_INFO) << "Attempting to resume SSL session to "
354 << ssl_host_name_;
355 }
356 }
357 }
358
359 #ifdef OPENSSL_IS_BORINGSSL
360 // Set a couple common TLS extensions; even though we don't use them yet.
361 SSL_enable_ocsp_stapling(ssl_);
362 SSL_enable_signed_cert_timestamps(ssl_);
363 #endif
364
365 if (!alpn_protocols_.empty()) {
366 std::string tls_alpn_string = TransformAlpnProtocols(alpn_protocols_);
367 if (!tls_alpn_string.empty()) {
368 SSL_set_alpn_protos(
369 ssl_, reinterpret_cast<const unsigned char*>(tls_alpn_string.data()),
370 rtc::dchecked_cast<unsigned>(tls_alpn_string.size()));
371 }
372 }
373
374 if (!elliptic_curves_.empty()) {
375 SSL_set1_curves_list(ssl_, rtc::join(elliptic_curves_, ':').c_str());
376 }
377
378 // Now that the initial config is done, transfer ownership of |bio| to the
379 // SSL object. If ContinueSSL() fails, the bio will be freed in Cleanup().
380 SSL_set_bio(ssl_, bio, bio);
381 bio = nullptr;
382
383 // Do the connect.
384 err = ContinueSSL();
385 if (err != 0) {
386 goto ssl_error;
387 }
388
389 return err;
390
391 ssl_error:
392 Cleanup();
393 if (bio) {
394 BIO_free(bio);
395 }
396
397 return err;
398 }
399
ContinueSSL()400 int OpenSSLAdapter::ContinueSSL() {
401 RTC_DCHECK(state_ == SSL_CONNECTING);
402
403 // Clear the DTLS timer
404 Thread::Current()->Clear(this, MSG_TIMEOUT);
405
406 int code = (role_ == SSL_CLIENT) ? SSL_connect(ssl_) : SSL_accept(ssl_);
407 switch (SSL_get_error(ssl_, code)) {
408 case SSL_ERROR_NONE:
409 if (!SSLPostConnectionCheck(ssl_, ssl_host_name_)) {
410 RTC_LOG(LS_ERROR) << "TLS post connection check failed";
411 // make sure we close the socket
412 Cleanup();
413 // The connect failed so return -1 to shut down the socket
414 return -1;
415 }
416
417 state_ = SSL_CONNECTED;
418 AsyncSocketAdapter::OnConnectEvent(this);
419 // TODO(benwright): Refactor this code path.
420 // Don't let ourselves go away during the callbacks
421 // PRefPtr<OpenSSLAdapter> lock(this);
422 // RTC_LOG(LS_INFO) << " -- onStreamReadable";
423 // AsyncSocketAdapter::OnReadEvent(this);
424 // RTC_LOG(LS_INFO) << " -- onStreamWriteable";
425 // AsyncSocketAdapter::OnWriteEvent(this);
426 break;
427
428 case SSL_ERROR_WANT_READ:
429 RTC_LOG(LS_VERBOSE) << " -- error want read";
430 struct timeval timeout;
431 if (DTLSv1_get_timeout(ssl_, &timeout)) {
432 int delay = timeout.tv_sec * 1000 + timeout.tv_usec / 1000;
433
434 Thread::Current()->PostDelayed(RTC_FROM_HERE, delay, this, MSG_TIMEOUT,
435 0);
436 }
437 break;
438
439 case SSL_ERROR_WANT_WRITE:
440 break;
441
442 case SSL_ERROR_ZERO_RETURN:
443 default:
444 RTC_LOG(LS_WARNING) << "ContinueSSL -- error " << code;
445 return (code != 0) ? code : -1;
446 }
447
448 return 0;
449 }
450
Error(const char * context,int err,bool signal)451 void OpenSSLAdapter::Error(const char* context, int err, bool signal) {
452 RTC_LOG(LS_WARNING) << "OpenSSLAdapter::Error(" << context << ", " << err
453 << ")";
454 state_ = SSL_ERROR;
455 SetError(err);
456 if (signal) {
457 AsyncSocketAdapter::OnCloseEvent(this, err);
458 }
459 }
460
Cleanup()461 void OpenSSLAdapter::Cleanup() {
462 RTC_LOG(LS_INFO) << "OpenSSLAdapter::Cleanup";
463
464 state_ = SSL_NONE;
465 ssl_read_needs_write_ = false;
466 ssl_write_needs_read_ = false;
467 custom_cert_verifier_status_ = false;
468 pending_data_.Clear();
469
470 if (ssl_) {
471 SSL_free(ssl_);
472 ssl_ = nullptr;
473 }
474
475 if (ssl_ctx_) {
476 SSL_CTX_free(ssl_ctx_);
477 ssl_ctx_ = nullptr;
478 }
479 identity_.reset();
480
481 // Clear the DTLS timer
482 Thread::Current()->Clear(this, MSG_TIMEOUT);
483 }
484
DoSslWrite(const void * pv,size_t cb,int * error)485 int OpenSSLAdapter::DoSslWrite(const void* pv, size_t cb, int* error) {
486 // If we have pending data (that was previously only partially written by
487 // SSL_write), we shouldn't be attempting to write anything else.
488 RTC_DCHECK(pending_data_.empty() || pv == pending_data_.data());
489 RTC_DCHECK(error != nullptr);
490
491 ssl_write_needs_read_ = false;
492 int ret = SSL_write(ssl_, pv, checked_cast<int>(cb));
493 *error = SSL_get_error(ssl_, ret);
494 switch (*error) {
495 case SSL_ERROR_NONE:
496 // Success!
497 return ret;
498 case SSL_ERROR_WANT_READ:
499 RTC_LOG(LS_INFO) << " -- error want read";
500 ssl_write_needs_read_ = true;
501 SetError(EWOULDBLOCK);
502 break;
503 case SSL_ERROR_WANT_WRITE:
504 RTC_LOG(LS_INFO) << " -- error want write";
505 SetError(EWOULDBLOCK);
506 break;
507 case SSL_ERROR_ZERO_RETURN:
508 SetError(EWOULDBLOCK);
509 // do we need to signal closure?
510 break;
511 case SSL_ERROR_SSL:
512 LogSslError();
513 Error("SSL_write", ret ? ret : -1, false);
514 break;
515 default:
516 Error("SSL_write", ret ? ret : -1, false);
517 break;
518 }
519
520 return SOCKET_ERROR;
521 }
522
523 ///////////////////////////////////////////////////////////////////////////////
524 // AsyncSocket Implementation
525 ///////////////////////////////////////////////////////////////////////////////
526
Send(const void * pv,size_t cb)527 int OpenSSLAdapter::Send(const void* pv, size_t cb) {
528 switch (state_) {
529 case SSL_NONE:
530 return AsyncSocketAdapter::Send(pv, cb);
531 case SSL_WAIT:
532 case SSL_CONNECTING:
533 SetError(ENOTCONN);
534 return SOCKET_ERROR;
535 case SSL_CONNECTED:
536 break;
537 case SSL_ERROR:
538 default:
539 return SOCKET_ERROR;
540 }
541
542 int ret;
543 int error;
544
545 if (!pending_data_.empty()) {
546 ret = DoSslWrite(pending_data_.data(), pending_data_.size(), &error);
547 if (ret != static_cast<int>(pending_data_.size())) {
548 // We couldn't finish sending the pending data, so we definitely can't
549 // send any more data. Return with an EWOULDBLOCK error.
550 SetError(EWOULDBLOCK);
551 return SOCKET_ERROR;
552 }
553 // We completed sending the data previously passed into SSL_write! Now
554 // we're allowed to send more data.
555 pending_data_.Clear();
556 }
557
558 // OpenSSL will return an error if we try to write zero bytes
559 if (cb == 0) {
560 return 0;
561 }
562
563 ret = DoSslWrite(pv, cb, &error);
564
565 // If SSL_write fails with SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE, this
566 // means the underlying socket is blocked on reading or (more typically)
567 // writing. When this happens, OpenSSL requires that the next call to
568 // SSL_write uses the same arguments (though, with
569 // SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER, the actual buffer pointer may be
570 // different).
571 //
572 // However, after Send exits, we will have lost access to data the user of
573 // this class is trying to send, and there's no guarantee that the user of
574 // this class will call Send with the same arguements when it fails. So, we
575 // buffer the data ourselves. When we know the underlying socket is writable
576 // again from OnWriteEvent (or if Send is called again before that happens),
577 // we'll retry sending this buffered data.
578 if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {
579 // Shouldn't be able to get to this point if we already have pending data.
580 RTC_DCHECK(pending_data_.empty());
581 RTC_LOG(LS_WARNING)
582 << "SSL_write couldn't write to the underlying socket; buffering data.";
583 pending_data_.SetData(static_cast<const uint8_t*>(pv), cb);
584 // Since we're taking responsibility for sending this data, return its full
585 // size. The user of this class can consider it sent.
586 return rtc::dchecked_cast<int>(cb);
587 }
588 return ret;
589 }
590
SendTo(const void * pv,size_t cb,const SocketAddress & addr)591 int OpenSSLAdapter::SendTo(const void* pv,
592 size_t cb,
593 const SocketAddress& addr) {
594 if (socket_->GetState() == Socket::CS_CONNECTED &&
595 addr == socket_->GetRemoteAddress()) {
596 return Send(pv, cb);
597 }
598
599 SetError(ENOTCONN);
600 return SOCKET_ERROR;
601 }
602
Recv(void * pv,size_t cb,int64_t * timestamp)603 int OpenSSLAdapter::Recv(void* pv, size_t cb, int64_t* timestamp) {
604 switch (state_) {
605 case SSL_NONE:
606 return AsyncSocketAdapter::Recv(pv, cb, timestamp);
607 case SSL_WAIT:
608 case SSL_CONNECTING:
609 SetError(ENOTCONN);
610 return SOCKET_ERROR;
611 case SSL_CONNECTED:
612 break;
613 case SSL_ERROR:
614 default:
615 return SOCKET_ERROR;
616 }
617
618 // Don't trust OpenSSL with zero byte reads
619 if (cb == 0) {
620 return 0;
621 }
622
623 ssl_read_needs_write_ = false;
624 int code = SSL_read(ssl_, pv, checked_cast<int>(cb));
625 int error = SSL_get_error(ssl_, code);
626
627 switch (error) {
628 case SSL_ERROR_NONE:
629 return code;
630 case SSL_ERROR_WANT_READ:
631 SetError(EWOULDBLOCK);
632 break;
633 case SSL_ERROR_WANT_WRITE:
634 ssl_read_needs_write_ = true;
635 SetError(EWOULDBLOCK);
636 break;
637 case SSL_ERROR_ZERO_RETURN:
638 SetError(EWOULDBLOCK);
639 // do we need to signal closure?
640 break;
641 case SSL_ERROR_SSL:
642 LogSslError();
643 Error("SSL_read", (code ? code : -1), false);
644 break;
645 default:
646 Error("SSL_read", (code ? code : -1), false);
647 break;
648 }
649 return SOCKET_ERROR;
650 }
651
RecvFrom(void * pv,size_t cb,SocketAddress * paddr,int64_t * timestamp)652 int OpenSSLAdapter::RecvFrom(void* pv,
653 size_t cb,
654 SocketAddress* paddr,
655 int64_t* timestamp) {
656 if (socket_->GetState() == Socket::CS_CONNECTED) {
657 int ret = Recv(pv, cb, timestamp);
658 *paddr = GetRemoteAddress();
659 return ret;
660 }
661
662 SetError(ENOTCONN);
663 return SOCKET_ERROR;
664 }
665
Close()666 int OpenSSLAdapter::Close() {
667 Cleanup();
668 state_ = SSL_NONE;
669 return AsyncSocketAdapter::Close();
670 }
671
GetState() const672 Socket::ConnState OpenSSLAdapter::GetState() const {
673 ConnState state = socket_->GetState();
674 if ((state == CS_CONNECTED) &&
675 ((state_ == SSL_WAIT) || (state_ == SSL_CONNECTING))) {
676 state = CS_CONNECTING;
677 }
678 return state;
679 }
680
IsResumedSession()681 bool OpenSSLAdapter::IsResumedSession() {
682 return (ssl_ && SSL_session_reused(ssl_) == 1);
683 }
684
OnMessage(Message * msg)685 void OpenSSLAdapter::OnMessage(Message* msg) {
686 if (MSG_TIMEOUT == msg->message_id) {
687 RTC_LOG(LS_INFO) << "DTLS timeout expired";
688 DTLSv1_handle_timeout(ssl_);
689 ContinueSSL();
690 }
691 }
692
OnConnectEvent(AsyncSocket * socket)693 void OpenSSLAdapter::OnConnectEvent(AsyncSocket* socket) {
694 RTC_LOG(LS_INFO) << "OpenSSLAdapter::OnConnectEvent";
695 if (state_ != SSL_WAIT) {
696 RTC_DCHECK(state_ == SSL_NONE);
697 AsyncSocketAdapter::OnConnectEvent(socket);
698 return;
699 }
700
701 state_ = SSL_CONNECTING;
702 if (int err = BeginSSL()) {
703 AsyncSocketAdapter::OnCloseEvent(socket, err);
704 }
705 }
706
OnReadEvent(AsyncSocket * socket)707 void OpenSSLAdapter::OnReadEvent(AsyncSocket* socket) {
708 if (state_ == SSL_NONE) {
709 AsyncSocketAdapter::OnReadEvent(socket);
710 return;
711 }
712
713 if (state_ == SSL_CONNECTING) {
714 if (int err = ContinueSSL()) {
715 Error("ContinueSSL", err);
716 }
717 return;
718 }
719
720 if (state_ != SSL_CONNECTED) {
721 return;
722 }
723
724 // Don't let ourselves go away during the callbacks
725 // PRefPtr<OpenSSLAdapter> lock(this); // TODO(benwright): fix this
726 if (ssl_write_needs_read_) {
727 AsyncSocketAdapter::OnWriteEvent(socket);
728 }
729
730 AsyncSocketAdapter::OnReadEvent(socket);
731 }
732
OnWriteEvent(AsyncSocket * socket)733 void OpenSSLAdapter::OnWriteEvent(AsyncSocket* socket) {
734 if (state_ == SSL_NONE) {
735 AsyncSocketAdapter::OnWriteEvent(socket);
736 return;
737 }
738
739 if (state_ == SSL_CONNECTING) {
740 if (int err = ContinueSSL()) {
741 Error("ContinueSSL", err);
742 }
743 return;
744 }
745
746 if (state_ != SSL_CONNECTED) {
747 return;
748 }
749
750 // Don't let ourselves go away during the callbacks
751 // PRefPtr<OpenSSLAdapter> lock(this); // TODO(benwright): fix this
752
753 if (ssl_read_needs_write_) {
754 AsyncSocketAdapter::OnReadEvent(socket);
755 }
756
757 // If a previous SSL_write failed due to the underlying socket being blocked,
758 // this will attempt finishing the write operation.
759 if (!pending_data_.empty()) {
760 int error;
761 if (DoSslWrite(pending_data_.data(), pending_data_.size(), &error) ==
762 static_cast<int>(pending_data_.size())) {
763 pending_data_.Clear();
764 }
765 }
766
767 AsyncSocketAdapter::OnWriteEvent(socket);
768 }
769
OnCloseEvent(AsyncSocket * socket,int err)770 void OpenSSLAdapter::OnCloseEvent(AsyncSocket* socket, int err) {
771 RTC_LOG(LS_INFO) << "OpenSSLAdapter::OnCloseEvent(" << err << ")";
772 AsyncSocketAdapter::OnCloseEvent(socket, err);
773 }
774
SSLPostConnectionCheck(SSL * ssl,const std::string & host)775 bool OpenSSLAdapter::SSLPostConnectionCheck(SSL* ssl, const std::string& host) {
776 bool is_valid_cert_name =
777 openssl::VerifyPeerCertMatchesHost(ssl, host) &&
778 (SSL_get_verify_result(ssl) == X509_V_OK || custom_cert_verifier_status_);
779
780 if (!is_valid_cert_name && ignore_bad_cert_) {
781 RTC_DLOG(LS_WARNING) << "Other TLS post connection checks failed. "
782 "ignore_bad_cert_ set to true. Overriding name "
783 "verification failure!";
784 is_valid_cert_name = true;
785 }
786 return is_valid_cert_name;
787 }
788
789 #if !defined(NDEBUG)
790
791 // We only use this for tracing and so it is only needed in debug mode
792
SSLInfoCallback(const SSL * s,int where,int ret)793 void OpenSSLAdapter::SSLInfoCallback(const SSL* s, int where, int ret) {
794 const char* str = "undefined";
795 int w = where & ~SSL_ST_MASK;
796 if (w & SSL_ST_CONNECT) {
797 str = "SSL_connect";
798 } else if (w & SSL_ST_ACCEPT) {
799 str = "SSL_accept";
800 }
801 if (where & SSL_CB_LOOP) {
802 RTC_DLOG(LS_VERBOSE) << str << ":" << SSL_state_string_long(s);
803 } else if (where & SSL_CB_ALERT) {
804 str = (where & SSL_CB_READ) ? "read" : "write";
805 RTC_DLOG(LS_INFO) << "SSL3 alert " << str << ":"
806 << SSL_alert_type_string_long(ret) << ":"
807 << SSL_alert_desc_string_long(ret);
808 } else if (where & SSL_CB_EXIT) {
809 if (ret == 0) {
810 RTC_DLOG(LS_INFO) << str << ":failed in " << SSL_state_string_long(s);
811 } else if (ret < 0) {
812 RTC_DLOG(LS_INFO) << str << ":error in " << SSL_state_string_long(s);
813 }
814 }
815 }
816
817 #endif
818
819 #ifdef WEBRTC_USE_CRYPTO_BUFFER_CALLBACK
820 // static
SSLVerifyCallback(SSL * ssl,uint8_t * out_alert)821 enum ssl_verify_result_t OpenSSLAdapter::SSLVerifyCallback(SSL* ssl,
822 uint8_t* out_alert) {
823 // Get our stream pointer from the SSL context.
824 OpenSSLAdapter* stream =
825 reinterpret_cast<OpenSSLAdapter*>(SSL_get_app_data(ssl));
826
827 ssl_verify_result_t ret = stream->SSLVerifyInternal(ssl, out_alert);
828
829 // Should only be used for debugging and development.
830 if (ret != ssl_verify_ok && stream->ignore_bad_cert_) {
831 RTC_DLOG(LS_WARNING) << "Ignoring cert error while verifying cert chain";
832 return ssl_verify_ok;
833 }
834
835 return ret;
836 }
837
SSLVerifyInternal(SSL * ssl,uint8_t * out_alert)838 enum ssl_verify_result_t OpenSSLAdapter::SSLVerifyInternal(SSL* ssl,
839 uint8_t* out_alert) {
840 if (ssl_cert_verifier_ == nullptr) {
841 RTC_LOG(LS_WARNING) << "Built-in trusted root certificates disabled but no "
842 "SSL verify callback provided.";
843 return ssl_verify_invalid;
844 }
845
846 RTC_LOG(LS_INFO) << "Invoking SSL Verify Callback.";
847 const STACK_OF(CRYPTO_BUFFER)* chain = SSL_get0_peer_certificates(ssl);
848 if (sk_CRYPTO_BUFFER_num(chain) == 0) {
849 RTC_LOG(LS_ERROR) << "Peer certificate chain empty?";
850 return ssl_verify_invalid;
851 }
852
853 BoringSSLCertificate cert(bssl::UpRef(sk_CRYPTO_BUFFER_value(chain, 0)));
854 if (!ssl_cert_verifier_->Verify(cert)) {
855 RTC_LOG(LS_WARNING) << "Failed to verify certificate using custom callback";
856 return ssl_verify_invalid;
857 }
858
859 custom_cert_verifier_status_ = true;
860 RTC_LOG(LS_INFO) << "Validated certificate using custom callback";
861 return ssl_verify_ok;
862 }
863 #else // WEBRTC_USE_CRYPTO_BUFFER_CALLBACK
SSLVerifyCallback(int ok,X509_STORE_CTX * store)864 int OpenSSLAdapter::SSLVerifyCallback(int ok, X509_STORE_CTX* store) {
865 // Get our stream pointer from the store
866 SSL* ssl = reinterpret_cast<SSL*>(
867 X509_STORE_CTX_get_ex_data(store, SSL_get_ex_data_X509_STORE_CTX_idx()));
868
869 OpenSSLAdapter* stream =
870 reinterpret_cast<OpenSSLAdapter*>(SSL_get_app_data(ssl));
871 ok = stream->SSLVerifyInternal(ok, ssl, store);
872
873 // Should only be used for debugging and development.
874 if (!ok && stream->ignore_bad_cert_) {
875 RTC_DLOG(LS_WARNING) << "Ignoring cert error while verifying cert chain";
876 return 1;
877 }
878
879 return ok;
880 }
881
SSLVerifyInternal(int ok,SSL * ssl,X509_STORE_CTX * store)882 int OpenSSLAdapter::SSLVerifyInternal(int ok, SSL* ssl, X509_STORE_CTX* store) {
883 #if !defined(NDEBUG)
884 if (!ok) {
885 char data[256];
886 X509* cert = X509_STORE_CTX_get_current_cert(store);
887 int depth = X509_STORE_CTX_get_error_depth(store);
888 int err = X509_STORE_CTX_get_error(store);
889
890 RTC_DLOG(LS_INFO) << "Error with certificate at depth: " << depth;
891 X509_NAME_oneline(X509_get_issuer_name(cert), data, sizeof(data));
892 RTC_DLOG(LS_INFO) << " issuer = " << data;
893 X509_NAME_oneline(X509_get_subject_name(cert), data, sizeof(data));
894 RTC_DLOG(LS_INFO) << " subject = " << data;
895 RTC_DLOG(LS_INFO) << " err = " << err << ":"
896 << X509_verify_cert_error_string(err);
897 }
898 #endif
899 if (ssl_cert_verifier_ == nullptr) {
900 return ok;
901 }
902
903 RTC_LOG(LS_INFO) << "Invoking SSL Verify Callback.";
904 #ifdef OPENSSL_IS_BORINGSSL
905 // Convert X509 to CRYPTO_BUFFER.
906 uint8_t* data = nullptr;
907 int length = i2d_X509(X509_STORE_CTX_get_current_cert(store), &data);
908 if (length < 0) {
909 RTC_LOG(LS_ERROR) << "Failed to encode X509.";
910 return ok;
911 }
912 bssl::UniquePtr<uint8_t> owned_data(data);
913 bssl::UniquePtr<CRYPTO_BUFFER> crypto_buffer(
914 CRYPTO_BUFFER_new(data, length, openssl::GetBufferPool()));
915 if (!crypto_buffer) {
916 RTC_LOG(LS_ERROR) << "Failed to allocate CRYPTO_BUFFER.";
917 return ok;
918 }
919 const BoringSSLCertificate cert(std::move(crypto_buffer));
920 #else
921 const OpenSSLCertificate cert(X509_STORE_CTX_get_current_cert(store));
922 #endif
923 if (!ssl_cert_verifier_->Verify(cert)) {
924 RTC_LOG(LS_INFO) << "Failed to verify certificate using custom callback";
925 return ok;
926 }
927
928 custom_cert_verifier_status_ = true;
929 RTC_LOG(LS_INFO) << "Validated certificate using custom callback";
930 return 1;
931 }
932 #endif // !defined(WEBRTC_USE_CRYPTO_BUFFER_CALLBACK)
933
NewSSLSessionCallback(SSL * ssl,SSL_SESSION * session)934 int OpenSSLAdapter::NewSSLSessionCallback(SSL* ssl, SSL_SESSION* session) {
935 OpenSSLAdapter* stream =
936 reinterpret_cast<OpenSSLAdapter*>(SSL_get_app_data(ssl));
937 RTC_DCHECK(stream->ssl_session_cache_);
938 RTC_LOG(LS_INFO) << "Caching SSL session for " << stream->ssl_host_name_;
939 stream->ssl_session_cache_->AddSession(stream->ssl_host_name_, session);
940 return 1; // We've taken ownership of the session; OpenSSL shouldn't free it.
941 }
942
CreateContext(SSLMode mode,bool enable_cache)943 SSL_CTX* OpenSSLAdapter::CreateContext(SSLMode mode, bool enable_cache) {
944 #ifdef WEBRTC_USE_CRYPTO_BUFFER_CALLBACK
945 // If X509 objects aren't used, we can use these methods to avoid
946 // linking the sizable crypto/x509 code.
947 SSL_CTX* ctx = SSL_CTX_new(mode == SSL_MODE_DTLS ? DTLS_with_buffers_method()
948 : TLS_with_buffers_method());
949 #else
950 SSL_CTX* ctx =
951 SSL_CTX_new(mode == SSL_MODE_DTLS ? DTLS_method() : TLS_method());
952 #endif
953 if (ctx == nullptr) {
954 unsigned long error = ERR_get_error(); // NOLINT: type used by OpenSSL.
955 RTC_LOG(LS_WARNING) << "SSL_CTX creation failed: " << '"'
956 << ERR_reason_error_string(error)
957 << "\" "
958 "(error="
959 << error << ')';
960 return nullptr;
961 }
962
963 #ifndef WEBRTC_EXCLUDE_BUILT_IN_SSL_ROOT_CERTS
964 if (!openssl::LoadBuiltinSSLRootCertificates(ctx)) {
965 RTC_LOG(LS_ERROR) << "SSL_CTX creation failed: Failed to load any trusted "
966 "ssl root certificates.";
967 SSL_CTX_free(ctx);
968 return nullptr;
969 }
970 #endif // WEBRTC_EXCLUDE_BUILT_IN_SSL_ROOT_CERTS
971
972 #if !defined(NDEBUG)
973 SSL_CTX_set_info_callback(ctx, SSLInfoCallback);
974 #endif
975
976 #ifdef OPENSSL_IS_BORINGSSL
977 SSL_CTX_set0_buffer_pool(ctx, openssl::GetBufferPool());
978 #endif
979
980 #ifdef WEBRTC_USE_CRYPTO_BUFFER_CALLBACK
981 SSL_CTX_set_custom_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback);
982 #else
983 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback);
984 SSL_CTX_set_verify_depth(ctx, 4);
985 #endif
986 // Use defaults, but disable HMAC-SHA256 and HMAC-SHA384 ciphers
987 // (note that SHA256 and SHA384 only select legacy CBC ciphers).
988 // Additionally disable HMAC-SHA1 ciphers in ECDSA. These are the remaining
989 // CBC-mode ECDSA ciphers.
990 SSL_CTX_set_cipher_list(
991 ctx, "ALL:!SHA256:!SHA384:!aPSK:!ECDSA+SHA1:!ADH:!LOW:!EXP:!MD5");
992
993 if (mode == SSL_MODE_DTLS) {
994 SSL_CTX_set_read_ahead(ctx, 1);
995 }
996
997 if (enable_cache) {
998 SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT);
999 SSL_CTX_sess_set_new_cb(ctx, &OpenSSLAdapter::NewSSLSessionCallback);
1000 }
1001
1002 return ctx;
1003 }
1004
TransformAlpnProtocols(const std::vector<std::string> & alpn_protocols)1005 std::string TransformAlpnProtocols(
1006 const std::vector<std::string>& alpn_protocols) {
1007 // Transforms the alpn_protocols list to the format expected by
1008 // Open/BoringSSL. This requires joining the protocols into a single string
1009 // and prepending a character with the size of the protocol string before
1010 // each protocol.
1011 std::string transformed_alpn;
1012 for (const std::string& proto : alpn_protocols) {
1013 if (proto.size() == 0 || proto.size() > 0xFF) {
1014 RTC_LOG(LS_ERROR) << "OpenSSLAdapter::Error("
1015 "TransformAlpnProtocols received proto with size "
1016 << proto.size() << ")";
1017 return "";
1018 }
1019 transformed_alpn += static_cast<char>(proto.size());
1020 transformed_alpn += proto;
1021 RTC_LOG(LS_VERBOSE) << "TransformAlpnProtocols: Adding proto: " << proto;
1022 }
1023 return transformed_alpn;
1024 }
1025
1026 //////////////////////////////////////////////////////////////////////
1027 // OpenSSLAdapterFactory
1028 //////////////////////////////////////////////////////////////////////
1029
1030 OpenSSLAdapterFactory::OpenSSLAdapterFactory() = default;
1031
1032 OpenSSLAdapterFactory::~OpenSSLAdapterFactory() = default;
1033
SetMode(SSLMode mode)1034 void OpenSSLAdapterFactory::SetMode(SSLMode mode) {
1035 RTC_DCHECK(!ssl_session_cache_);
1036 ssl_mode_ = mode;
1037 }
1038
SetCertVerifier(SSLCertificateVerifier * ssl_cert_verifier)1039 void OpenSSLAdapterFactory::SetCertVerifier(
1040 SSLCertificateVerifier* ssl_cert_verifier) {
1041 RTC_DCHECK(!ssl_session_cache_);
1042 ssl_cert_verifier_ = ssl_cert_verifier;
1043 }
1044
CreateAdapter(AsyncSocket * socket)1045 OpenSSLAdapter* OpenSSLAdapterFactory::CreateAdapter(AsyncSocket* socket) {
1046 if (ssl_session_cache_ == nullptr) {
1047 SSL_CTX* ssl_ctx = OpenSSLAdapter::CreateContext(ssl_mode_, true);
1048 if (ssl_ctx == nullptr) {
1049 return nullptr;
1050 }
1051 // The OpenSSLSessionCache will upref the ssl_ctx.
1052 ssl_session_cache_ =
1053 std::make_unique<OpenSSLSessionCache>(ssl_mode_, ssl_ctx);
1054 SSL_CTX_free(ssl_ctx);
1055 }
1056 return new OpenSSLAdapter(socket, ssl_session_cache_.get(),
1057 ssl_cert_verifier_);
1058 }
1059
1060 } // namespace rtc
1061