C++ do_handshake函数代码示例

static void client_handshake_read_cb(uv_stream_t* stream, ssize_t nread, uv_buf_t buf)
{
	server_ctx *ctx = (server_ctx *)stream->data;

	if (nread < 0) {
		if (buf.len) // If buf is set, we need to free it
			free(buf.base);
		uv_close((uv_handle_t*)stream, handshake_client_close_cb); // Then close the connection
		return;
	} else if (!nread) {
		free(buf.base);
		return;
	}

	memcpy(ctx->handshake_buffer + ctx->buffer_len, buf.base, nread);
	shadow_decrypt(ctx->handshake_buffer + ctx->buffer_len, &ctx->encoder, nread);

	ctx->buffer_len += nread;

	if (!ctx->handshake_buffer) {
		FATAL("Should not call this anymore");
	}
	free(buf.base);
	
	do_handshake(stream);
}

static void
check_rehandshake (socket_st * socket, int ret)
{
  if (socket->secure && ret == GNUTLS_E_REHANDSHAKE)
    {
      /* There is a race condition here. If application
       * data is sent after the rehandshake request,
       * the server thinks we ignored his request.
       * This is a bad design of this client.
       */
      printf ("*** Received rehandshake request\n");
      /* gnutls_alert_send( session, GNUTLS_AL_WARNING, GNUTLS_A_NO_RENEGOTIATION); */

      ret = do_handshake (socket);

      if (ret == 0)
	{
	  printf ("*** Rehandshake was performed.\n");
	}
      else
	{
	  printf ("*** Rehandshake Failed.\n");
	}
    }
}

test_code_t
test_version_rollback (gnutls_session session)
{
  int ret;
  if (tls1_ok == 0)
    return TEST_IGNORE;

  /* here we enable both SSL 3.0 and TLS 1.0
   * and we connect using a 3.1 client hello version,
   * and a 3.0 record version. Some implementations
   * are buggy (and vulnerable to man in the middle
   * attacks which allow a version downgrade) and this 
   * connection will fail.
   */
  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_ALL_PROTOCOLS (session);
  ADD_ALL_MACS (session);
  ADD_ALL_KX (session);
  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
  _gnutls_record_set_default_version (session, 3, 0);

  ret = do_handshake (session);
  if (ret != TEST_SUCCEED)
    return ret;

  if (tls1_ok != 0 && gnutls_protocol_get_version (session) == GNUTLS_SSL3)
    return TEST_FAILED;

  return TEST_SUCCEED;
}

/* 发送数据
 * * 返回: < 0 错误，0 成功，1 需要重读，2 需要重写
 */
int32 ssl_io::send()
{
    assert( "io send fd invalid",_fd > 0 );

    if ( !_handshake ) return do_handshake();

    size_t bytes = _send->data_size();
    assert( "io send without data",bytes > 0 );
    int32 len = SSL_write( X_SSL( _ssl_ctx ),_send->data_pointer(),bytes );
    if ( expect_true(len > 0) )
    {
        _send->subtract( len );
        return ((size_t)len) == bytes ? 0 : 2;
    }

    int32 ecode = SSL_get_error( X_SSL( _ssl_ctx ),len );
    if ( SSL_ERROR_WANT_WRITE == ecode ) return 2;

    // 非主动断开，打印错误日志
    if ( (SSL_ERROR_ZERO_RETURN == ecode)
        || (SSL_ERROR_SYSCALL == ecode && 0 == errno) )
    {
        return -1;
    }

    SSL_ERROR( "ssl io send" );
    return -1;
}

/* Prints the trusted server's CAs. This is only
 * if the server sends a certificate request packet.
 */
test_code_t
test_server_cas (gnutls_session session)
{
  int ret;

  if (verbose == 0)
    return TEST_IGNORE;

  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_ALL_PROTOCOLS (session);
  ADD_ALL_MACS (session);
  ADD_ALL_KX (session);

  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
  gnutls_certificate_client_set_retrieve_function (xcred, cert_callback);

  ret = do_handshake (session);
  gnutls_certificate_client_set_retrieve_function (xcred, NULL);

  if (ret == TEST_FAILED)
    return ret;
  return TEST_SUCCEED;
}

test_code_t
test_certificate (gnutls_session session)
{
  int ret;

  if (verbose == 0)
    return TEST_IGNORE;

  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_ALL_PROTOCOLS (session);
  ADD_ALL_MACS (session);
  ADD_ALL_KX (session);

  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);

  ret = do_handshake (session);
  if (ret == TEST_FAILED)
    return ret;

  printf ("\n");
  print_cert_info (session, hostname);

  return TEST_SUCCEED;
}

/*
* TLS Server Constructor
*/
TLS_Server::TLS_Server(std::tr1::function<size_t (byte[], size_t)> input_fn,
                       std::tr1::function<void (const byte[], size_t)> output_fn,
                       const TLS_Policy& policy,
                       RandomNumberGenerator& rng,
                       const X509_Certificate& cert,
                       const Private_Key& cert_key) :
   input_fn(input_fn),
   policy(policy),
   rng(rng),
   writer(output_fn)
   {
   state = 0;

   cert_chain.push_back(cert);
   private_key = PKCS8::copy_key(cert_key, rng);

   try {
      active = false;
      writer.set_version(TLS_V10);
      do_handshake();
      active = true;
   }
   catch(std::exception& e)
      {
      if(state)
         {
         delete state;
         state = 0;
         }

      writer.alert(FATAL, HANDSHAKE_FAILURE);
      throw Stream_IO_Error(std::string("TLS_Server: Handshake failed: ") +
                            e.what());
      }
   }

test_code_t
test_srp (gnutls_session session)
{
  int ret;

  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_ALL_PROTOCOLS (session);
  ADD_ALL_MACS (session);

  ADD_KX (session, GNUTLS_KX_SRP);
  srp_detected = 0;

  gnutls_srp_set_client_credentials_function (srp_cred,
					      _test_srp_username_callback);

  gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred);

  ret = do_handshake (session);

  gnutls_srp_set_client_credentials_function (srp_cred, NULL);

  if (srp_detected != 0)
    return TEST_SUCCEED;
  else
    return TEST_FAILED;
}

/* Advertize both TLS 1.0 and SSL 3.0. If the connection fails,
 * but the previous SSL 3.0 test succeeded then disable TLS 1.0.
 */
test_code_t
test_tls_disable (gnutls_session_t session)
{
  int ret;
  if (tls1_ok != 0)
    return TEST_IGNORE;

  sprintf (prio_str,
           INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
           ":" ALL_KX ":%s", protocol_str, rest);
  _gnutls_priority_set_direct (session, prio_str);

  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);

  ret = do_handshake (session);
  if (ret == TEST_FAILED)
    {
      /* disable TLS 1.0 */
      if (ssl3_ok != 0)
        {
          strcpy (protocol_str, "+VERS-SSL3.0");
        }
    }
  return ret;

}

test_code_t
test_tls1_1_fallback (gnutls_session session)
{
  int ret;
  if (tls1_1_ok)
    return TEST_IGNORE;

  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_PROTOCOL3 (session, GNUTLS_TLS1_1, GNUTLS_TLS1, GNUTLS_SSL3);
  ADD_ALL_MACS (session);
  ADD_ALL_KX (session);
  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);

  ret = do_handshake (session);
  if (ret != TEST_SUCCEED)
    return TEST_FAILED;

  if (gnutls_protocol_get_version (session) == GNUTLS_TLS1)
    return TEST_SUCCEED;
  else if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
    return TEST_UNSURE;

  return TEST_FAILED;

}

test_code_t
test_tls1_1_fallback (gnutls_session_t session)
{
  int ret;
  if (tls1_1_ok)
    return TEST_IGNORE;

  sprintf (prio_str,
           INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
           ":+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0:" ALL_MACS ":" ALL_KX
           ":%s", rest);
  _gnutls_priority_set_direct (session, prio_str);

  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);

  ret = do_handshake (session);
  if (ret != TEST_SUCCEED)
    return TEST_FAILED;

  if (gnutls_protocol_get_version (session) == GNUTLS_TLS1)
    return TEST_SUCCEED;
  else if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
    return TEST_UNSURE;

  return TEST_FAILED;

}

/* Advertize both TLS 1.0 and SSL 3.0. If the connection fails,
 * but the previous SSL 3.0 test succeeded then disable TLS 1.0.
 */
test_code_t
test_tls_disable (gnutls_session session)
{
  int ret;
  if (tls1_ok != 0)
    return TEST_IGNORE;

  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_ALL_PROTOCOLS (session);
  ADD_ALL_MACS (session);
  ADD_ALL_KX (session);
  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);

  ret = do_handshake (session);
  if (ret == TEST_FAILED)
    {
      /* disable TLS 1.0 */
      if (ssl3_ok != 0)
	{
	  protocol_priority[0] = GNUTLS_SSL3;
	  protocol_priority[1] = 0;
	}
    }
  return ret;

}

test_code_t
test_rsa_pms (gnutls_session session)
{
  int ret;

  /* here we enable both SSL 3.0 and TLS 1.0
   * and try to connect and use rsa authentication.
   * If the server is old, buggy and only supports
   * SSL 3.0 then the handshake will fail.
   */
  ADD_ALL_CIPHERS (session);
  ADD_ALL_COMP (session);
  ADD_ALL_CERTTYPES (session);
  ADD_ALL_PROTOCOLS (session);
  ADD_ALL_MACS (session);
  ADD_KX (session, GNUTLS_KX_RSA);
  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);

  ret = do_handshake (session);
  if (ret == TEST_FAILED)
    return TEST_FAILED;

  if (gnutls_protocol_get_version (session) == GNUTLS_TLS1)
    return TEST_SUCCEED;
  return TEST_UNSURE;
}

void handlerThread(int csockIn)
{
   int sopt = 1, csock = csockIn;
   ws_ctx_t *ws_ctx;
   bool useHixie = TRUE;

   ws_ctx = do_handshake(csock, &useHixie);
   if (ws_ctx == NULL) {
      handler_msg("No connection after handshake\n");      
   }
   else
   {
      settings.handler(ws_ctx, useHixie);
      if (pipe_error) {
         handler_emsg("Closing due to SIGPIPE\n");
      }
   }

   if (ws_ctx) {
      ws_socket_free(ws_ctx);
   } else {
      shutdown(csock, SHUT_RDWR);
      close(csock);
   }
   handler_msg("handler exit\n");    
}

static void client_handshake_domain_resolved(uv_getaddrinfo_t *resolver, int status, struct addrinfo *res)
{
	server_ctx *ctx = (server_ctx *)resolver->data;
	if (status) {
		if (uv_last_error(ctx->client.loop).code == UV_ENOENT) {
			LOGI("Resolve error, NXDOMAIN");
		} else {
			SHOW_UV_ERROR(ctx->client.loop);
		}
		HANDLE_CLOSE((uv_handle_t*)(void *)&ctx->client, handshake_client_close_cb);
		uv_freeaddrinfo(res);
		free(resolver);
		return;
	}

	ctx->remote_ip = ((struct sockaddr_in*)(res->ai_addr))->sin_addr.s_addr;

	if (do_handshake((uv_stream_t *)(void *)&ctx->client)) {
		int n = uv_read_start((uv_stream_t *)(void *)&ctx->client, client_handshake_alloc_cb, client_handshake_read_cb);
		if (n) {
			HANDLE_CLOSE((uv_handle_t*)(void *)&ctx->client, handshake_client_close_cb);
			SHOW_UV_ERROR(ctx->client.loop);
		}
	}

	uv_freeaddrinfo(res);
	free(resolver);
}