Skip to content

Make places to bind/unbind SSL object with/from NetVC #7399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maskit merged 1 commit into from
Jan 7, 2021
Merged

Make places to bind/unbind SSL object with/from NetVC #7399

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions iocore/net/P_SSLNetVConnection.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -531,6 +531,11 @@ class SSLNetVConnection : public UnixNetVConnection, public ALPNSupport, public
std::unique_ptr<char[]> _ca_cert_dir;

EventIO async_ep{};

private:
void _make_ssl_connection(SSL_CTX *ctx);
void _bindSSLObject();
void _unbindSSLObject();
};

typedef int (SSLNetVConnection::*SSLNetVConnHandler)(int, void *);
Expand Down
50 changes: 27 additions & 23 deletions iocore/net/SSLNetVConnection.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,28 +153,24 @@ class ContWrapper : public Continuation
// Private
//

static SSL *
make_ssl_connection(SSL_CTX *ctx, SSLNetVConnection *netvc)
void
SSLNetVConnection::_make_ssl_connection(SSL_CTX *ctx)
{
SSL *ssl;

if (likely(ssl = SSL_new(ctx))) {
netvc->ssl = ssl;

if (likely(this->ssl = SSL_new(ctx))) {
// Only set up the bio stuff for the server side
if (netvc->get_context() == NET_VCONNECTION_OUT) {
if (this->get_context() == NET_VCONNECTION_OUT) {
BIO *bio = BIO_new(const_cast<BIO_METHOD *>(BIO_s_fastopen()));
BIO_set_fd(bio, netvc->get_socket(), BIO_NOCLOSE);
BIO_set_fd(bio, this->get_socket(), BIO_NOCLOSE);

if (netvc->options.f_tcp_fastopen) {
BIO_set_conn_address(bio, netvc->get_remote_addr());
if (this->options.f_tcp_fastopen) {
BIO_set_conn_address(bio, this->get_remote_addr());
}

SSL_set_bio(ssl, bio, bio);
} else {
netvc->initialize_handshake_buffers();
this->initialize_handshake_buffers();
BIO *rbio = BIO_new(BIO_s_mem());
BIO *wbio = BIO_new_fd(netvc->get_socket(), BIO_NOCLOSE);
BIO *wbio = BIO_new_fd(this->get_socket(), BIO_NOCLOSE);
BIO_set_mem_eof_return(wbio, -1);
SSL_set_bio(ssl, rbio, wbio);

Expand Down Expand Up @@ -210,12 +206,22 @@ make_ssl_connection(SSL_CTX *ctx, SSLNetVConnection *netvc)
}
#endif
}

SSLNetVCAttach(ssl, netvc);
TLSSessionResumptionSupport::bind(ssl, netvc);
this->_bindSSLObject();
}
}

return ssl;
void
SSLNetVConnection::_bindSSLObject()
{
SSLNetVCAttach(this->ssl, this);
TLSSessionResumptionSupport::bind(this->ssl, this);
}

void
SSLNetVConnection::_unbindSSLObject()
{
SSLNetVCDetach(this->ssl);
TLSSessionResumptionSupport::unbind(this->ssl);
}

static void
Expand Down Expand Up @@ -1041,7 +1047,7 @@ SSLNetVConnection::sslStartHandShake(int event, int &err)
// Attach the default SSL_CTX to this SSL session. The default context is never going to be able
// to negotiate a SSL session, but it's enough to trampoline us into the SNI callback where we
// can select the right server certificate.
this->ssl = make_ssl_connection(lookup->defaultContext(), this);
this->_make_ssl_connection(lookup->defaultContext());
}

if (this->ssl == nullptr) {
Expand Down Expand Up @@ -1118,7 +1124,7 @@ SSLNetVConnection::sslStartHandShake(int event, int &err)
return EVENT_ERROR;
}

this->ssl = make_ssl_connection(clientCTX, this);
this->_make_ssl_connection(clientCTX);
if (this->ssl == nullptr) {
SSLErrorVC(this, "failed to create SSL client session");
return EVENT_ERROR;
Expand Down Expand Up @@ -1820,8 +1826,7 @@ SSLNetVConnection::populate(Connection &con, Continuation *c, void *arg)
// Maybe bring over the stats?

sslHandshakeStatus = SSL_HANDSHAKE_DONE;
SSLNetVCAttach(this->ssl, this);
TLSSessionResumptionSupport::bind(this->ssl, this);
this->_bindSSLObject();
return EVENT_DONE;
}

Expand Down Expand Up @@ -1945,8 +1950,7 @@ SSLNetVConnection::_prepareForMigration()
{
SSL *save_ssl = this->ssl;

SSLNetVCDetach(this->ssl);
TLSSessionResumptionSupport::unbind(this->ssl);
this->_unbindSSLObject();
this->ssl = nullptr;

return save_ssl;
Expand Down