Skip to content
Permalink
Browse files Browse the repository at this point in the history
openssl: associate/detach the transfer from connection
  • Loading branch information
Harry Sintonen authored and bagder committed May 24, 2021
1 parent 39ce47f commit 7f4a9a9
Show file tree
Hide file tree
Showing 13 changed files with 172 additions and 50 deletions.
5 changes: 4 additions & 1 deletion lib/multi.c
Expand Up @@ -878,8 +878,10 @@ bool Curl_multiplex_wanted(const struct Curl_multi *multi)
void Curl_detach_connnection(struct Curl_easy *data)
{
struct connectdata *conn = data->conn;
if(conn)
if(conn) {
Curl_llist_remove(&conn->easyq, &data->conn_queue, NULL);
Curl_ssl_detach_conn(data, conn);
}
data->conn = NULL;
}

Expand All @@ -898,6 +900,7 @@ void Curl_attach_connnection(struct Curl_easy *data,
&data->conn_queue);
if(conn->handler->attach)
conn->handler->attach(data, conn);
Curl_ssl_associate_conn(data, conn);
}

static int waitconnect_getsock(struct connectdata *conn,
Expand Down
4 changes: 3 additions & 1 deletion lib/vtls/gskit.c
Expand Up @@ -1304,7 +1304,9 @@ const struct Curl_ssl Curl_ssl_gskit = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
NULL /* sha256sum */
NULL, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif /* USE_GSKIT */
4 changes: 3 additions & 1 deletion lib/vtls/gtls.c
Expand Up @@ -1656,7 +1656,9 @@ const struct Curl_ssl Curl_ssl_gnutls = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
gtls_sha256sum /* sha256sum */
gtls_sha256sum, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif /* USE_GNUTLS */
4 changes: 3 additions & 1 deletion lib/vtls/mbedtls.c
Expand Up @@ -1093,7 +1093,9 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
mbedtls_sha256sum /* sha256sum */
mbedtls_sha256sum, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif /* USE_MBEDTLS */
4 changes: 3 additions & 1 deletion lib/vtls/mesalink.c
Expand Up @@ -666,7 +666,9 @@ const struct Curl_ssl Curl_ssl_mesalink = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
NULL /* sha256sum */
NULL, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif
4 changes: 3 additions & 1 deletion lib/vtls/nss.c
Expand Up @@ -2465,7 +2465,9 @@ const struct Curl_ssl Curl_ssl_nss = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
nss_false_start, /* false_start */
nss_sha256sum /* sha256sum */
nss_sha256sum, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif /* USE_NSS */
146 changes: 107 additions & 39 deletions lib/vtls/openssl.c
Expand Up @@ -240,6 +240,10 @@ struct ssl_backend_data {
#endif
};

static void ossl_associate_connection(struct Curl_easy *data,
struct connectdata *conn,
int sockindex);

/*
* Number of bytes to read from the random number seed file. This must be
* a finite value (because some entropy "files" like /dev/urandom have
Expand Down Expand Up @@ -2581,6 +2585,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
curl_socket_t sockfd = conn->sock[sockindex];
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
ctx_option_t ctx_options = 0;
void *ssl_sessionid = NULL;

#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
bool sni;
Expand Down Expand Up @@ -3225,46 +3230,23 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
}
#endif

/* Check if there's a cached ID we can/should use here! */
if(SSL_SET_OPTION(primary.sessionid)) {
void *ssl_sessionid = NULL;
int data_idx = ossl_get_ssl_data_index();
int connectdata_idx = ossl_get_ssl_conn_index();
int sockindex_idx = ossl_get_ssl_sockindex_index();
int proxy_idx = ossl_get_proxy_index();

if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
proxy_idx >= 0) {
/* Store the data needed for the "new session" callback.
* The sockindex is stored as a pointer to an array element. */
SSL_set_ex_data(backend->handle, data_idx, data);
SSL_set_ex_data(backend->handle, connectdata_idx, conn);
SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
#ifndef CURL_DISABLE_PROXY
SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
NULL);
#else
SSL_set_ex_data(backend->handle, proxy_idx, NULL);
#endif

}
ossl_associate_connection(data, conn, sockindex);

Curl_ssl_sessionid_lock(data);
if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
&ssl_sessionid, NULL, sockindex)) {
/* we got a session id, use it! */
if(!SSL_set_session(backend->handle, ssl_sessionid)) {
Curl_ssl_sessionid_unlock(data);
failf(data, "SSL: SSL_set_session failed: %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)));
return CURLE_SSL_CONNECT_ERROR;
}
/* Informational message */
infof(data, "SSL re-using session ID\n");
Curl_ssl_sessionid_lock(data);
if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
&ssl_sessionid, NULL, sockindex)) {
/* we got a session id, use it! */
if(!SSL_set_session(backend->handle, ssl_sessionid)) {
Curl_ssl_sessionid_unlock(data);
failf(data, "SSL: SSL_set_session failed: %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)));
return CURLE_SSL_CONNECT_ERROR;
}
Curl_ssl_sessionid_unlock(data);
/* Informational message */
infof(data, "SSL re-using session ID\n");
}
Curl_ssl_sessionid_unlock(data);

#ifndef CURL_DISABLE_PROXY
if(conn->proxy_ssl[sockindex].use) {
Expand Down Expand Up @@ -4498,6 +4480,90 @@ static void *ossl_get_internals(struct ssl_connect_data *connssl,
(void *)backend->ctx : (void *)backend->handle;
}

static void ossl_associate_connection(struct Curl_easy *data,
struct connectdata *conn,
int sockindex)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;

/* If we don't have SSL context, do nothing. */
if(!backend->handle)
return;

if(SSL_SET_OPTION(primary.sessionid)) {
int data_idx = ossl_get_ssl_data_index();
int connectdata_idx = ossl_get_ssl_conn_index();
int sockindex_idx = ossl_get_ssl_sockindex_index();
int proxy_idx = ossl_get_proxy_index();

if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
proxy_idx >= 0) {
/* Store the data needed for the "new session" callback.
* The sockindex is stored as a pointer to an array element. */
SSL_set_ex_data(backend->handle, data_idx, data);
SSL_set_ex_data(backend->handle, connectdata_idx, conn);
SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
#ifndef CURL_DISABLE_PROXY
SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
NULL);
#else
SSL_set_ex_data(backend->handle, proxy_idx, NULL);
#endif
}
}
}

/*
* Starting with TLS 1.3, the ossl_new_session_cb callback gets called after
* the handshake. If the transfer that sets up the callback gets killed before
* this callback arrives, we must make sure to properly clear the data to
* avoid UAF problems. A future optimization could be to instead store another
* transfer that might still be using the same connection.
*/

static void ossl_disassociate_connection(struct Curl_easy *data,
int sockindex)
{
struct connectdata *conn = data->conn;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;

/* If we don't have SSL context, do nothing. */
if(!backend->handle)
return;

if(SSL_SET_OPTION(primary.sessionid)) {
bool isproxy = FALSE;
bool incache;
void *old_ssl_sessionid = NULL;
int data_idx = ossl_get_ssl_data_index();
int connectdata_idx = ossl_get_ssl_conn_index();
int sockindex_idx = ossl_get_ssl_sockindex_index();
int proxy_idx = ossl_get_proxy_index();

if(data_idx >= 0 && connectdata_idx >= 0 && sockindex_idx >= 0 &&
proxy_idx >= 0) {
/* Invalidate the session cache entry, if any */
isproxy = SSL_get_ex_data(backend->handle, proxy_idx) ? TRUE : FALSE;

/* Disable references to data in "new session" callback to avoid
* accessing a stale pointer. */
SSL_set_ex_data(backend->handle, data_idx, NULL);
SSL_set_ex_data(backend->handle, connectdata_idx, NULL);
SSL_set_ex_data(backend->handle, sockindex_idx, NULL);
SSL_set_ex_data(backend->handle, proxy_idx, NULL);
}

Curl_ssl_sessionid_lock(data);
incache = !(Curl_ssl_getsessionid(data, conn, isproxy,
&old_ssl_sessionid, NULL, sockindex));
if(incache)
Curl_ssl_delsessionid(data, old_ssl_sessionid);
Curl_ssl_sessionid_unlock(data);
}
}

const struct Curl_ssl Curl_ssl_openssl = {
{ CURLSSLBACKEND_OPENSSL, "openssl" }, /* info */

Expand Down Expand Up @@ -4533,10 +4599,12 @@ const struct Curl_ssl Curl_ssl_openssl = {
ossl_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
ossl_sha256sum /* sha256sum */
ossl_sha256sum, /* sha256sum */
#else
NULL /* sha256sum */
NULL, /* sha256sum */
#endif
ossl_associate_connection, /* associate_connection */
ossl_disassociate_connection /* disassociate_connection */
};

#endif /* USE_OPENSSL */
4 changes: 3 additions & 1 deletion lib/vtls/rustls.c
Expand Up @@ -604,7 +604,9 @@ const struct Curl_ssl Curl_ssl_rustls = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
NULL /* sha256sum */
NULL, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif /* USE_RUSTLS */
6 changes: 4 additions & 2 deletions lib/vtls/schannel.c
Expand Up @@ -329,7 +329,7 @@ get_alg_id_by_name(char *name)

static CURLcode
set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
int *algIds)
ALG_ID *algIds)
{
char *startCur = ciphers;
int algCount = 0;
Expand Down Expand Up @@ -2433,7 +2433,9 @@ const struct Curl_ssl Curl_ssl_schannel = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
schannel_sha256sum /* sha256sum */
schannel_sha256sum, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif /* USE_SCHANNEL */
2 changes: 2 additions & 0 deletions lib/vtls/sectransp.c
Expand Up @@ -3453,6 +3453,8 @@ const struct Curl_ssl Curl_ssl_sectransp = {
Curl_none_engines_list, /* engines_list */
sectransp_false_start, /* false_start */
sectransp_sha256sum /* sha256sum */

This comment has been minimized.

Copy link
@letsread

letsread Jul 8, 2021

miss the ,
......

This comment has been minimized.

Copy link
@bagder

bagder Jul 8, 2021

Member

See 9877034

NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#ifdef __clang__
Expand Down
23 changes: 22 additions & 1 deletion lib/vtls/vtls.c
Expand Up @@ -586,6 +586,25 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
return CURLE_OK;
}

void Curl_ssl_associate_conn(struct Curl_easy *data,
struct connectdata *conn)
{
if(Curl_ssl->associate_connection) {
Curl_ssl->associate_connection(data, conn, FIRSTSOCKET);
if(conn->sock[SECONDARYSOCKET] && conn->bits.sock_accepted)
Curl_ssl->associate_connection(data, conn, SECONDARYSOCKET);
}
}

void Curl_ssl_detach_conn(struct Curl_easy *data,
struct connectdata *conn)
{
if(Curl_ssl->disassociate_connection) {
Curl_ssl->disassociate_connection(data, FIRSTSOCKET);
if(conn->sock[SECONDARYSOCKET] && conn->bits.sock_accepted)
Curl_ssl->disassociate_connection(data, SECONDARYSOCKET);
}
}

void Curl_ssl_close_all(struct Curl_easy *data)
{
Expand Down Expand Up @@ -1214,7 +1233,9 @@ static const struct Curl_ssl Curl_ssl_multi = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
NULL /* sha256sum */
NULL, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

const struct Curl_ssl *Curl_ssl =
Expand Down
12 changes: 12 additions & 0 deletions lib/vtls/vtls.h
Expand Up @@ -84,6 +84,11 @@ struct Curl_ssl {
bool (*false_start)(void);
CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen,
unsigned char *sha256sum, size_t sha256sumlen);

void (*associate_connection)(struct Curl_easy *data,
struct connectdata *conn,
int sockindex);
void (*disassociate_connection)(struct Curl_easy *data, int sockindex);
};

#ifdef USE_SSL
Expand Down Expand Up @@ -283,6 +288,11 @@ bool Curl_ssl_cert_status_request(void);

bool Curl_ssl_false_start(void);

void Curl_ssl_associate_conn(struct Curl_easy *data,
struct connectdata *conn);
void Curl_ssl_detach_conn(struct Curl_easy *data,
struct connectdata *conn);

#define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */

#else /* if not USE_SSL */
Expand All @@ -309,6 +319,8 @@ bool Curl_ssl_false_start(void);
#define Curl_ssl_cert_status_request() FALSE
#define Curl_ssl_false_start() FALSE
#define Curl_ssl_tls13_ciphersuites() FALSE
#define Curl_ssl_associate_conn(a,b) Curl_nop_stmt
#define Curl_ssl_detach_conn(a,b) Curl_nop_stmt
#endif

#endif /* HEADER_CURL_VTLS_H */
4 changes: 3 additions & 1 deletion lib/vtls/wolfssl.c
Expand Up @@ -1125,7 +1125,9 @@ const struct Curl_ssl Curl_ssl_wolfssl = {
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Curl_none_false_start, /* false_start */
wolfssl_sha256sum /* sha256sum */
wolfssl_sha256sum, /* sha256sum */
NULL, /* associate_connection */
NULL /* disassociate_connection */
};

#endif

0 comments on commit 7f4a9a9

Please sign in to comment.