/*

 * Soft:        Perform a GET query to a remote HTTP/HTTPS server.

 *              Set a timer to compute global remote server response

 *              time.

 *

 * Part:        SSL engine. 'Semi' asyncrhonous stream handling.

 *

 * Authors:     Alexandre Cassen, <acassen@linux-vs.org>

 *

 *              This program is distributed in the hope that it will be useful,

 *              but WITHOUT ANY WARRANTY; without even the implied warranty of

 *              MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

 *              See the GNU General Public License for more details.

 *

 *              This program is free software; you can redistribute it and/or

 *              modify it under the terms of the GNU General Public License

 *              as published by the Free Software Foundation; either version

 *              2 of the License, or (at your option) any later version.

 *

 * Copyright (C) 2001-2017 Alexandre Cassen, <acassen@gmail.com>

 */

#include "config.h"

/* system includes */

#include <openssl/err.h>

#include <stdbool.h>

/* keepalived includes */

#include "utils.h"

/* genhash includes */

#include "include/ssl.h"

#include "include/main.h"

/* extern variables */

extern REQ *req;

/*

 * Initialize the SSL context, with or without specific

 * configuration files.

 */

void

init_ssl(void)

{

	/* Library initialization */

#ifdef HAVE_OPENSSL_INIT_CRYPTO

#ifndef HAVE_OPENSSL_INIT_NO_LOAD_CONFIG_BUG

	/* In OpenSSL v1.1.1 if the following is called, SSL_CTX_new() below fails.

	 * It works in v1.1.0h and v1.1.1b.

	 * It transpires that it works without setting NO_LOAD_CONFIG, but it is

	 * presumably more efficient not to load it. */

	if (!OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG, NULL))

		fprintf(stderr, "OPENSSL_init_crypto failed\n");

#endif

#else

	SSL_library_init();

	SSL_load_error_strings();

#endif

	/* Initialize SSL context */

#ifdef HAVE_TLS_METHOD

	req->meth = TLS_method();

#else

	req->meth = SSLv23_method();

#endif

	if (!(req->ctx = SSL_CTX_new(req->meth))) {

		fprintf(stderr, "SSL_CTX_new() failed\n");

		exit(1);

	}

#if HAVE_SSL_CTX_SET_VERIFY_DEPTH

	SSL_CTX_set_verify_depth(req->ctx, 1);

#endif

}

/* Display SSL error to readable string */

int

ssl_printerr(int err)

{

	switch (err) {

	case SSL_ERROR_ZERO_RETURN:

		fprintf(stderr, "  SSL error: (zero return)\n");

		break;

	case SSL_ERROR_WANT_READ:

		fprintf(stderr, "  SSL error: (read error)\n");

		break;

	case SSL_ERROR_WANT_WRITE:

		fprintf(stderr, "  SSL error: (write error)\n");

		break;

	case SSL_ERROR_WANT_CONNECT:

		fprintf(stderr, "  SSL error: (connect error)\n");

		break;

	case SSL_ERROR_WANT_X509_LOOKUP:

		fprintf(stderr, "  SSL error: (X509 lookup error)\n");

		break;

	case SSL_ERROR_SYSCALL:

		fprintf(stderr, "  SSL error: (syscall error)\n");

		break;

	case SSL_ERROR_SSL:

		fprintf(stderr, "  SSL error: (%s)\n", ERR_error_string(ERR_get_error(), NULL));

		break;

	}

	return 0;

}

bool

ssl_connect(thread_t * thread)

{

	SOCK *sock_obj = THREAD_ARG(thread);

	int ret;

	sock_obj->ssl = SSL_new(req->ctx);

	if (!sock_obj->ssl) {

		fprintf(stderr, "SSL_new() failed\n");

		return false;

	}

	sock_obj->bio = BIO_new_socket(sock_obj->fd, BIO_NOCLOSE);

	if (!sock_obj->bio) {

		fprintf(stderr, "BIO_new_socket failed\n");

		return false;

	}

	BIO_set_nbio(sock_obj->bio, 1);	/* Set the Non-Blocking flag */

#ifdef HAVE_SSL_SET0_RBIO

	BIO_up_ref(sock_obj->bio);

	SSL_set0_rbio(sock_obj->ssl, sock_obj->bio);

	SSL_set0_wbio(sock_obj->ssl, sock_obj->bio);

#else

	SSL_set_bio(sock_obj->ssl, sock_obj->bio, sock_obj->bio);

#endif

#ifdef _HAVE_SSL_SET_TLSEXT_HOST_NAME_

		if (req->vhost != NULL && req->sni) {

			SSL_set_tlsext_host_name(sock_obj->ssl, req->vhost);

		}

#endif

	ret = SSL_connect(sock_obj->ssl);

	DBG("  SSL_connect return code = %d on fd:%d\n", ret, thread->u.fd);

	ssl_printerr(SSL_get_error(sock_obj->ssl, ret));

	return (ret > 0);

}

int

ssl_send_request(SSL * ssl, char *str_request, int request_len)

{

	int err, r = 0;

	while (1) {

		err = 1;

		r = SSL_write(ssl, str_request, request_len);

		if (SSL_ERROR_NONE != SSL_get_error(ssl, r))

			break;

		err++;

		if (request_len != r)

			break;

		err++;

		break;

	}

	return (err == 3) ? 1 : 0;

}

/* Asynchronous SSL stream reader */

int

ssl_read_thread(thread_t * thread)

{

	SOCK *sock_obj = THREAD_ARG(thread);

	int r = 0;

	int error;

	/* Handle read timeout */

	if (thread->type == THREAD_READ_TIMEOUT) {

		exit_code = 1;

		return epilog(thread);

	}

	/*

	 * The design implemented here is a workaround for use

	 * with OpenSSL. This goto loop is a 'read until not

	 * end of stream'. But this break a little our global

	 * I/O multiplexer thread framework because it enter

	 * a synchronous read process for each GET reply.

	 * Sound a little nasty !.

	 *

	 * Why OpenSSL doesn t handle underlying fd. This

	 * break the I/O (select()) approach !...

	 * If you read this and know the answer, please reply

	 * I am probably missing something... :)

	 * My test show that sometime it return from select,

	 * and sometime not...

	 */

      read_stream:

	/* read the SSL stream */

	r = MAX_BUFFER_LENGTH - sock_obj->size;

	if (r <= 0) {

		/* defensive check, should not occur */

		fprintf(stderr, "SSL socket buffer overflow (not consumed)\n");

		r = MAX_BUFFER_LENGTH;

	}

	memset(sock_obj->buffer + sock_obj->size, 0, (size_t)r);

	r = SSL_read(sock_obj->ssl, sock_obj->buffer + sock_obj->size, r);

	error = SSL_get_error(sock_obj->ssl, r);

	DBG(" [l:%d,fd:%d]\n", r, sock_obj->fd);

	if (error) {

		/* All the SSL streal has been parsed */

		/* Handle response stream */

		if (error != SSL_ERROR_NONE)

			return finalize(thread);

	} else if (r > 0 && error == 0) {

		/* Handle the response stream */

		http_process_stream(sock_obj, r);

		/*

		 * Register next ssl stream reader.

		 * Register itself to not perturbe global I/O multiplexer.

		 */

		goto read_stream;

	}

	return 0;

}