1
0
mirror of https://github.com/vlang/v.git synced 2023-08-10 21:13:21 +03:00
v/vlib/net/mbedtls/ssl_connection.v

410 lines
10 KiB
V
Raw Normal View History

module mbedtls
import io
import net
import time
const ctr_drbg = C.mbedtls_ctr_drbg_context{}
const entropy = C.mbedtls_entropy_context{}
fn init() {
$if trace_ssl ? {
eprintln(@METHOD)
}
2023-05-18 12:31:53 +03:00
unsafe { // Unsafe is needed for taking an address of const
C.mbedtls_ctr_drbg_init(&mbedtls.ctr_drbg)
C.mbedtls_entropy_init(&mbedtls.entropy)
ret := C.mbedtls_ctr_drbg_seed(&mbedtls.ctr_drbg, C.mbedtls_entropy_func, &mbedtls.entropy,
0, 0)
if ret != 0 {
C.mbedtls_ctr_drbg_free(&mbedtls.ctr_drbg)
panic('Failed to seed ssl context: ${ret}')
}
}
}
struct SSLCerts {
cacert C.mbedtls_x509_crt
client_cert C.mbedtls_x509_crt
client_key C.mbedtls_pk_context
}
// SSLConn is the current connection
pub struct SSLConn {
config SSLConnectConfig
mut:
server_fd C.mbedtls_net_context
ssl C.mbedtls_ssl_context
conf C.mbedtls_ssl_config
certs &SSLCerts = unsafe { nil }
handle int
duration time.Duration
opened bool
owns_socket bool
}
[params]
pub struct SSLConnectConfig {
verify string // the path to a rootca.pem file, containing trusted CA certificate(s)
cert string // the path to a cert.pem file, containing client certificate(s) for the request
cert_key string // the path to a key.pem file, containing private keys for the client certificate(s)
validate bool // set this to true, if you want to stop requests, when their certificates are found to be invalid
in_memory_verification bool // if true, verify, cert, and cert_key are read from memory, not from a file
}
// new_ssl_conn returns a new SSLConn with the given config.
pub fn new_ssl_conn(config SSLConnectConfig) !&SSLConn {
$if trace_ssl ? {
eprintln(@METHOD)
}
mut conn := &SSLConn{
config: config
}
conn.init() or { return err }
return conn
}
// Select operation
enum Select {
read
write
except
}
// shutdown terminates the ssl connection and does cleanup
pub fn (mut s SSLConn) shutdown() ! {
$if trace_ssl ? {
eprintln(@METHOD)
}
if !s.opened {
return error('ssl connection not open')
}
if unsafe { s.certs != nil } {
C.mbedtls_x509_crt_free(&s.certs.cacert)
C.mbedtls_x509_crt_free(&s.certs.client_cert)
C.mbedtls_pk_free(&s.certs.client_key)
}
C.mbedtls_ssl_free(&s.ssl)
C.mbedtls_ssl_config_free(&s.conf)
if s.owns_socket {
net.shutdown(s.handle)
net.close(s.handle)!
}
}
// connect to server using mbedtls
fn (mut s SSLConn) init() ! {
$if trace_ssl ? {
eprintln(@METHOD)
}
C.mbedtls_net_init(&s.server_fd)
C.mbedtls_ssl_init(&s.ssl)
C.mbedtls_ssl_config_init(&s.conf)
mut ret := 0
ret = C.mbedtls_ssl_config_defaults(&s.conf, C.MBEDTLS_SSL_IS_CLIENT, C.MBEDTLS_SSL_TRANSPORT_STREAM,
C.MBEDTLS_SSL_PRESET_DEFAULT)
if ret != 0 {
return error_with_code('Failed to set SSL configuration', ret)
}
2023-05-18 12:31:53 +03:00
unsafe {
C.mbedtls_ssl_conf_rng(&s.conf, C.mbedtls_ctr_drbg_random, &mbedtls.ctr_drbg)
}
if s.config.verify != '' || s.config.cert != '' || s.config.cert_key != '' {
s.certs = &SSLCerts{}
C.mbedtls_x509_crt_init(&s.certs.cacert)
C.mbedtls_x509_crt_init(&s.certs.client_cert)
C.mbedtls_pk_init(&s.certs.client_key)
}
if s.config.in_memory_verification {
if s.config.verify != '' {
ret = C.mbedtls_x509_crt_parse(&s.certs.cacert, s.config.verify.str, s.config.verify.len)
}
if s.config.cert != '' {
ret = C.mbedtls_x509_crt_parse(&s.certs.client_cert, s.config.cert.str, s.config.cert.len)
}
if s.config.cert_key != '' {
2023-05-18 12:31:53 +03:00
unsafe {
ret = C.mbedtls_pk_parse_key(&s.certs.client_key, s.config.cert_key.str,
s.config.cert_key.len, 0, 0, C.mbedtls_ctr_drbg_random, &mbedtls.ctr_drbg)
}
}
} else {
if s.config.verify != '' {
ret = C.mbedtls_x509_crt_parse_file(&s.certs.cacert, &char(s.config.verify.str))
}
if s.config.cert != '' {
ret = C.mbedtls_x509_crt_parse_file(&s.certs.client_cert, &char(s.config.cert.str))
}
if s.config.cert_key != '' {
2023-05-18 12:31:53 +03:00
unsafe {
ret = C.mbedtls_pk_parse_keyfile(&s.certs.client_key, &char(s.config.cert_key.str),
0, C.mbedtls_ctr_drbg_random, &mbedtls.ctr_drbg)
}
}
}
if ret < 0 {
return error_with_code('Failed to set certificates', ret)
}
if unsafe { s.certs != nil } {
C.mbedtls_ssl_conf_ca_chain(&s.conf, &s.certs.cacert, 0)
C.mbedtls_ssl_conf_own_cert(&s.conf, &s.certs.client_cert, &s.certs.client_key)
}
if s.config.validate {
C.mbedtls_ssl_conf_authmode(&s.conf, C.MBEDTLS_SSL_VERIFY_REQUIRED)
} else {
C.mbedtls_ssl_conf_authmode(&s.conf, C.MBEDTLS_SSL_VERIFY_OPTIONAL)
}
ret = C.mbedtls_ssl_setup(&s.ssl, &s.conf)
if ret != 0 {
return error_with_code('Failed to setup SSL connection', ret)
}
}
// connect sets up an ssl connection on an existing TCP connection
pub fn (mut s SSLConn) connect(mut tcp_conn net.TcpConn, hostname string) ! {
$if trace_ssl ? {
eprintln('${@METHOD} hostname: ${hostname}')
}
if s.opened {
return error('ssl connection already open')
}
s.handle = tcp_conn.sock.handle
s.duration = 30 * time.second
mut ret := C.mbedtls_ssl_set_hostname(&s.ssl, &char(hostname.str))
if ret != 0 {
return error_with_code('Failed to set hostname', ret)
}
s.server_fd.fd = s.handle
C.mbedtls_ssl_set_bio(&s.ssl, &s.server_fd, C.mbedtls_net_send, C.mbedtls_net_recv,
C.mbedtls_net_recv_timeout)
ret = C.mbedtls_ssl_handshake(&s.ssl)
if ret != 0 {
return error_with_code('SSL handshake failed', ret)
}
s.opened = true
}
// dial opens an ssl connection on hostname:port
pub fn (mut s SSLConn) dial(hostname string, port int) ! {
$if trace_ssl ? {
eprintln('${@METHOD} hostname: ${hostname} | port: ${port}')
}
s.owns_socket = true
if s.opened {
return error('ssl connection already open')
}
s.duration = 30 * time.second
mut ret := C.mbedtls_ssl_set_hostname(&s.ssl, &char(hostname.str))
if ret != 0 {
return error_with_code('Failed to set hostname', ret)
}
port_str := port.str()
ret = C.mbedtls_net_connect(&s.server_fd, &char(hostname.str), &char(port_str.str),
C.MBEDTLS_NET_PROTO_TCP)
if ret != 0 {
return error_with_code('Failed to connect to host', ret)
}
C.mbedtls_ssl_set_bio(&s.ssl, &s.server_fd, C.mbedtls_net_send, C.mbedtls_net_recv,
C.mbedtls_net_recv_timeout)
s.handle = s.server_fd.fd
ret = C.mbedtls_ssl_handshake(&s.ssl)
if ret != 0 {
return error_with_code('SSL handshake failed', ret)
}
s.opened = true
}
// socket_read_into_ptr reads `len` bytes into `buf`
pub fn (mut s SSLConn) socket_read_into_ptr(buf_ptr &u8, len int) !int {
mut res := 0
$if trace_ssl ? {
defer {
if len > 0 {
eprintln('${@METHOD} res: ${res}: buf_ptr: ${voidptr(buf_ptr):x}, len: ${len}, hex: ${unsafe { buf_ptr.vbytes(len).hex() }} data: `${unsafe { buf_ptr.vstring_with_len(len) }}`')
}
}
}
for {
res = C.mbedtls_ssl_read(&s.ssl, buf_ptr, len)
if res > 0 {
return res
} else if res == 0 {
$if trace_ssl ? {
eprintln('${@METHOD} ---> res: io.Eof')
}
2022-10-28 19:08:30 +03:00
return io.Eof{}
} else {
match res {
C.MBEDTLS_ERR_SSL_WANT_READ {
ready := @select(s.handle, .read, s.duration)!
if !ready {
$if trace_ssl ? {
eprintln('${@METHOD} ---> res: net.err_timed_out, C.MBEDTLS_ERR_SSL_WANT_READ')
}
return net.err_timed_out
}
}
C.MBEDTLS_ERR_SSL_WANT_WRITE {
ready := @select(s.handle, .write, s.duration)!
if !ready {
$if trace_ssl ? {
eprintln('${@METHOD} ---> res: net.err_timed_out, C.MBEDTLS_ERR_SSL_WANT_WRITE')
}
return net.err_timed_out
}
}
C.MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY {
break
}
else {
$if trace_ssl ? {
eprintln('${@METHOD} ---> res: could not read using SSL')
}
return error_with_code('Could not read using SSL', res)
}
}
}
}
return res
}
// read reads data from the ssl connection into `buffer`
pub fn (mut s SSLConn) read(mut buffer []u8) !int {
$if trace_ssl ? {
eprintln('${@METHOD} buffer.len: ${buffer.len}')
}
return s.socket_read_into_ptr(&u8(buffer.data), buffer.len)
}
// write_ptr writes `len` bytes from `bytes` to the ssl connection
pub fn (mut s SSLConn) write_ptr(bytes &u8, len int) !int {
mut total_sent := 0
$if trace_ssl ? {
defer {
eprintln('${@METHOD} total_sent: ${total_sent}, bytes: ${voidptr(bytes):x}, len: ${len}, hex: ${unsafe { bytes.vbytes(len).hex() }}, data:-=-=-=-\n${unsafe { bytes.vstring_with_len(len) }}\n-=-=-=-')
}
}
unsafe {
mut ptr_base := bytes
for total_sent < len {
ptr := ptr_base + total_sent
remaining := len - total_sent
mut sent := C.mbedtls_ssl_write(&s.ssl, ptr, remaining)
if sent <= 0 {
match sent {
C.MBEDTLS_ERR_SSL_WANT_READ {
for {
ready := @select(s.handle, .read, s.duration)!
if ready {
break
}
}
continue
}
C.MBEDTLS_ERR_SSL_WANT_WRITE {
for {
ready := @select(s.handle, .write, s.duration)!
if ready {
break
}
}
continue
}
else {
$if trace_ssl ? {
eprintln('${@METHOD} ---> res: could not write SSL, sent: ${sent}')
}
return error_with_code('Could not write using SSL', sent)
}
}
}
total_sent += sent
}
}
return total_sent
}
// write writes data from `bytes` to the ssl connection
pub fn (mut s SSLConn) write(bytes []u8) !int {
return s.write_ptr(&u8(bytes.data), bytes.len)
}
// write_string writes a string to the ssl connection
pub fn (mut s SSLConn) write_string(str string) !int {
$if trace_ssl ? {
eprintln('${@METHOD} str: ${str}')
}
return s.write_ptr(str.str, str.len)
}
/*
This is basically a copy of Emily socket implementation of select.
This have to be consolidated into common net lib features
when merging this to V
*/
// Select waits for an io operation (specified by parameter `test`) to be available
fn @select(handle int, test Select, timeout time.Duration) !bool {
$if trace_ssl ? {
eprintln('${@METHOD} handle: ${handle}, timeout: ${timeout}')
}
set := C.fd_set{}
C.FD_ZERO(&set)
C.FD_SET(handle, &set)
seconds := timeout.milliseconds() / 1000
microseconds := timeout - (seconds * time.second)
mut tt := C.timeval{
tv_sec: u64(seconds)
tv_usec: u64(microseconds)
}
mut timeval_timeout := &tt
// infinite timeout is signaled by passing null as the timeout to
// select
if timeout == net.infinite_timeout {
timeval_timeout = &C.timeval(unsafe { nil })
}
match test {
.read {
net.socket_error(C.@select(handle + 1, &set, C.NULL, C.NULL, timeval_timeout))!
}
.write {
net.socket_error(C.@select(handle + 1, C.NULL, &set, C.NULL, timeval_timeout))!
}
.except {
net.socket_error(C.@select(handle + 1, C.NULL, C.NULL, &set, timeval_timeout))!
}
}
res := C.FD_ISSET(handle, &set)
$if trace_ssl ? {
eprintln('${@METHOD} ---> res: ${res}')
}
return res
}