C++ SSL_get_rbio函数代码示例

void dtls1_stop_timer(SSL *s)
{
    /* Reset everything */
    memset(&s->d1->timeout, 0, sizeof(s->d1->timeout));
    memset(&s->d1->next_timeout, 0, sizeof(s->d1->next_timeout));
    s->d1->timeout_duration = 1;
    BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0,
             &(s->d1->next_timeout));
    /* Clear retransmission buffer */
    dtls1_clear_record_buffer(s);
}

int dtls1_listen(SSL *s, struct sockaddr *client)
	{
	int ret;

	SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);
	s->d1->listen = 1;

	ret = SSL_accept(s);
	if (ret <= 0) return ret;
	
	(void) BIO_dgram_get_peer(SSL_get_rbio(s), client);
	return 1;
	}

void dtls1_start_timer(SSL *s) {
  /* If timer is not set, initialize duration with 1 second */
  if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) {
    s->d1->timeout_duration = 1;
  }

  /* Set timeout to current time */
  get_current_time(s, &s->d1->next_timeout);

  /* Add duration to current time */
  s->d1->next_timeout.tv_sec += s->d1->timeout_duration;
  BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0,
           &s->d1->next_timeout);
}

PUBLIC void sslFree(Webs *wp)
{
    BIO     *bio;

    /* 
        Re-use sessions
     */
    if (wp->ssl != NULL) {
        SSL_set_shutdown(wp->ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
    }
    if ((bio = SSL_get_rbio(wp->ssl)) != 0) {
        BIO_free_all(bio);
    }
}

bool BaseSSLProtocol::SignalInputData(IOBuffer &buffer) {

	//1. get the SSL input buffer
	BIO *pInBio = SSL_get_rbio(_pSSL);

	//2. dump all the data from the network inside the ssl input
	BIO_write(pInBio, GETIBPOINTER(buffer),
			GETAVAILABLEBYTESCOUNT(buffer));
	buffer.IgnoreAll();

	//3. Do we have to do some handshake?
	if (!_sslHandshakeCompleted) {
		if (!DoHandshake()) {
			FATAL("Unable to do the SSL handshake");
			return false;
		}
		if (!_sslHandshakeCompleted) {
			return true;
		}
	}

	//4. Read the actual data an put it in the descrypted input buffer
	int32_t read = 0;
	while ((read = SSL_read(_pSSL, _pReadBuffer, MAX_SSL_READ_BUFFER)) > 0) {
		_inputBuffer.ReadFromBuffer(_pReadBuffer, (uint32_t) read);
	}
	if (read < 0) {
		int32_t error = SSL_get_error(_pSSL, read);
		if (error != SSL_ERROR_WANT_READ &&
				error != SSL_ERROR_WANT_WRITE) {
			FATAL("Unable to read data: %d", error);
			return false;
		}
	}

	//6. If we have pending data inside the decrypted buffer, bubble it up on the protocol stack
	if (GETAVAILABLEBYTESCOUNT(_inputBuffer) > 0) {
		if (_pNearProtocol != NULL) {
			if (!_pNearProtocol->SignalInputData(_inputBuffer)) {
				FATAL("Unable to signal near protocol for new data");
				return false;
			}
		}
	}

	//7. After the data was sent on the upper layers, we might have outstanding
	//data that needs to be sent.
	return PerformIO();
}

int
lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd)
{
#if !defined(USE_WOLFSSL)
	BIO *bio;
#endif

	errno = 0;
	wsi->tls.ssl = SSL_new(wsi->vhost->tls.ssl_ctx);
	if (wsi->tls.ssl == NULL) {
		lwsl_err("SSL_new failed: %d (errno %d)\n",
			 lws_ssl_get_error(wsi, 0), errno);

		lws_tls_err_describe();
		return 1;
	}

	SSL_set_ex_data(wsi->tls.ssl, openssl_websocket_private_data_index, wsi);
	SSL_set_fd(wsi->tls.ssl, (int)(long long)accept_fd);

#ifdef USE_WOLFSSL
#ifdef USE_OLD_CYASSL
	CyaSSL_set_using_nonblock(wsi->tls.ssl, 1);
#else
	wolfSSL_set_using_nonblock(wsi->tls.ssl, 1);
#endif
#else

	SSL_set_mode(wsi->tls.ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
				   SSL_MODE_RELEASE_BUFFERS);
	bio = SSL_get_rbio(wsi->tls.ssl);
	if (bio)
		BIO_set_nbio(bio, 1); /* nonblocking */
	else
		lwsl_notice("NULL rbio\n");
	bio = SSL_get_wbio(wsi->tls.ssl);
	if (bio)
		BIO_set_nbio(bio, 1); /* nonblocking */
	else
		lwsl_notice("NULL rbio\n");
#endif

#if defined (LWS_HAVE_SSL_SET_INFO_CALLBACK)
		if (wsi->vhost->tls.ssl_info_event_mask)
			SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);
#endif

	return 0;
}

void
ssl_write_ssl(FILE * fp, SSL * ssl)
{
  BIO *bio;
  SSL_CIPHER *cipher;
  bio = SSL_get_rbio(ssl);
  cipher = SSL_CIPHER_get_current_cipher(ssl);
  fwrite(bio, sizeof(BIO), 1, fp);
  fwrite(ssl->version, sizeof(ssl->version), 1, fp);
  fwrite(ssl->type, sizeof(ssl->type), 1, fp);
  fwrite(ssl->rwstate, sizeof(ssl->type), 1, fp);
  fwrite(ssl->rstate, sizeof(ssl->type), 1, fp);
  fwrite(ssl->state, sizeof(ssl->type), 1, fp);
  fwrite(cipher, sizeof(cipher), 1, fp);
}

int dtls1_listen(SSL *s, struct sockaddr *client)
	{
	int ret;

	/* Ensure there is no state left over from a previous invocation */
	SSL_clear(s);

	SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);
	s->d1->listen = 1;

	ret = SSL_accept(s);
	if (ret <= 0) return ret;
	
	(void) BIO_dgram_get_peer(SSL_get_rbio(s), client);
	return 1;
	}

CAMLprim value ocaml_ssl_get_rbio_eof(value socket) 
{
    CAMLparam1(socket);
    CAMLlocal1(ret);
    BIO *b;
    int eof;

    ssl_socket_t *ssl = ssl_socket_of_block(socket);
    b = SSL_get_rbio(ssl->handler);
    if (b == NULL) 
	failwith("Ssl.get_rbio_eof: No rbio found");
    eof = BIO_eof(b);
    ret = Val_bool(eof);

    CAMLreturn(ret);
}

static int
handshake (struct stream_data *data)
{
	int ret;
	int finished;

	SSL_library_init();
	SSL_load_error_strings();
	
	data->ssl_ctx = SSL_CTX_new(TLSv1_method());
	if(!data->ssl_ctx) return IKS_NOMEM;
	
	data->ssl = SSL_new(data->ssl_ctx);
	if(!data->ssl) return IKS_NOMEM;
	
	if( SSL_set_fd(data->ssl, (int)(intptr_t)data->sock) != 1 ) return IKS_NOMEM;
	
	/* Set both the read and write BIO's to non-blocking mode */
	BIO_set_nbio(SSL_get_rbio(data->ssl), 1);
	BIO_set_nbio(SSL_get_wbio(data->ssl), 1);

	finished = 0;
	
	do
	{
		ret = SSL_connect(data->ssl);
		
		if( ret != 1 ) 
		{
			if( wait_for_data(data, ret, 1) != IKS_OK ) 
			{
				finished = 1; 
				SSL_free(data->ssl);
			}
		}
	} while( ret != 1 && finished != 1 );
	
	if( ret == 1 )
	{
		data->flags &= (~SF_TRY_SECURE);
		data->flags |= SF_SECURE;
	
		iks_send_header (data->prs, data->server);
	}
	
	return ret == 1 ? IKS_OK : IKS_NET_TLSFAIL;
}

int ssl_decrypt(SSL *s, const char *in, int len, char **out)
{
    int i;
    
    // WARNING: we expect this to be a memory bio...
    BIO *rbio = SSL_get_rbio(s);
    if (!BIO_eof(rbio)) {
      fprintf(stderr, "ssl_decrypt: Someone left data in the rbio!");
      fflush(stderr);
      return -1;
    }

    if (BIO_write(rbio, in, len) != len) {
      fprintf(stderr, "ssl_decrypt: couldn't write to BIO!");
      fflush(stderr);
      return -1;
    }

    *out = malloc(len);
    if (!*out) {
        return -1;
    }

    i = 0;
    int ret = SSL_read(s, *out + i, len - i);
    i += ret;  // If <= 0, we return it; o.w. we should accumulate.
    //fprintf(stderr, "first SSL_read returned: %d\n", ret);
    //fflush(stderr);
    while (ret > 0 && !BIO_eof(rbio) && i < len) {
      ret = SSL_read(s, *out + i, len - i);
      fprintf(stderr, "SSL_read returned: %d\n", ret);
      fflush(stderr);
      if (ret > 0)
          i += ret;
    }

    if (!BIO_eof(rbio)) {
      fprintf(stderr, "We are leaving data in the rbio! ret: %d\n", ret);
      fprintf(stderr, "In particular, this data:\n");
      char *data;
      long data_len = BIO_get_mem_data(rbio, &data);
      //hexdump(data, data_len);
    }

    return i;
}

static SSL_SESSION *on_async_resumption_get(SSL *ssl, unsigned char *data, int len, int *copy)
{
    h2o_socket_t *sock = SSL_get_rbio(ssl)->ptr;

    switch (sock->ssl->handshake.server.async_resumption.state) {
    case ASYNC_RESUMPTION_STATE_RECORD:
        sock->ssl->handshake.server.async_resumption.state = ASYNC_RESUMPTION_STATE_REQUEST_SENT;
        resumption_get_async(sock, h2o_iovec_init(data, len));
        return NULL;
    case ASYNC_RESUMPTION_STATE_COMPLETE:
        *copy = 1;
        return sock->ssl->handshake.server.async_resumption.session_data;
    default:
        assert(!"FIXME");
        return NULL;
    }
}

int MS_CALLBACK generate_cookie_callback(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len)
	{
	unsigned char *buffer, result[EVP_MAX_MD_SIZE];
	unsigned int length, resultlength;
	struct sockaddr_in peer;
	
	/* Initialize a random secret */
	if (!cookie_initialized)
		{
		if (!RAND_bytes(cookie_secret, COOKIE_SECRET_LENGTH))
			{
			BIO_printf(bio_err,"error setting random cookie secret\n");
			return 0;
			}
		cookie_initialized = 1;
		}

	/* Read peer information */
	(void)BIO_dgram_get_peer(SSL_get_rbio(ssl), &peer);

	/* Create buffer with peer's address and port */
	length = sizeof(peer.sin_addr);
	length += sizeof(peer.sin_port);
	buffer = OPENSSL_malloc(length);

	if (buffer == NULL)
		{
		BIO_printf(bio_err,"out of memory\n");
		return 0;
		}
	
	memcpy(buffer, &peer.sin_addr, sizeof(peer.sin_addr));
	memcpy(buffer + sizeof(peer.sin_addr), &peer.sin_port, sizeof(peer.sin_port));

	/* Calculate HMAC of buffer using the secret */
	HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,
	     buffer, length, result, &resultlength);
	OPENSSL_free(buffer);

	memcpy(cookie, result, resultlength);
	*cookie_len = resultlength;

	return 1;
	}

static int conn_init_client_ssl(Connection *ret, Octstr *certkeyfile)
{
    ret->ssl = SSL_new(global_ssl_context);

    /*
     * The current thread's error queue must be empty before
     * the TLS/SSL I/O operation is attempted, or SSL_get_error()
     * will not work reliably.
     */
    ERR_clear_error();

    if (certkeyfile != NULL) {
        SSL_use_certificate_file(ret->ssl, octstr_get_cstr(certkeyfile),
                                 SSL_FILETYPE_PEM);
        SSL_use_PrivateKey_file(ret->ssl, octstr_get_cstr(certkeyfile),
                                SSL_FILETYPE_PEM);
        if (SSL_check_private_key(ret->ssl) != 1) {
            error(0, "conn_open_ssl: private key isn't consistent with the "
                     "certificate from file %s (or failed reading the file)",
                  octstr_get_cstr(certkeyfile));
            return -1;
        }
    }

    /* SSL_set_fd can fail, so check it */
    if (SSL_set_fd(ret->ssl, ret->fd) == 0) {
        /* SSL_set_fd failed, log error */
        error(errno, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
        return -1;
    }

    /*
     * make sure the socket is non-blocking while we do SSL_connect
     */
    if (socket_set_blocking(ret->fd, 0) < 0) {
        return -1;
    }
    BIO_set_nbio(SSL_get_rbio(ret->ssl), 1);
    BIO_set_nbio(SSL_get_wbio(ret->ssl), 1);

    SSL_set_connect_state(ret->ssl);
    
    return 0;
}

IoSecureSocket *IoSecureServer_tlsWrap(IoSecureServer *self, IoObject *locals, IoMessage *msg)
{
	SSL_CTX *ctx = OCTX(self);
	IoSocket *sock = IoMessage_locals_socketArgAt_(msg, locals, 0);
	IoNumber *port = IoObject_getSlot_(sock, IOSYMBOL("port"));
	SSL *ssl = SSL_new(ctx);
	SSL_set_fd(ssl, IoSocket_rawDescriptor(sock));
	set_nonblocking(SSL_get_rbio(ssl));
	set_nonblocking(SSL_get_wbio(ssl));
	SSL_set_accept_state(ssl);
	SSL_set_mode(ssl, SSL_MODE_ENABLE_PARTIAL_WRITE |
		SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
	IoIPAddress *ioaddr = IoIPAddress_new(IoObject_state(self));
	IPAddress *iaddr = IoIPAddress_rawIPAddress(ioaddr);
	IPAddress_setIp_(iaddr, "0.0.0.0");
	IPAddress_setPort_(iaddr, IoNumber_asLong(port));
	IoSecureSocket *ssock = IoSecureSocket_newWithSSL_IP_(IoObject_state(self), ssl, ioaddr);
	return ssock;
}