1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.eclipse.jetty.io.ssl;
20
21 import java.io.IOException;
22 import java.nio.ByteBuffer;
23 import java.nio.channels.ClosedChannelException;
24 import java.util.concurrent.Executor;
25
26 import javax.net.ssl.SSLEngine;
27 import javax.net.ssl.SSLEngineResult;
28 import javax.net.ssl.SSLEngineResult.HandshakeStatus;
29 import javax.net.ssl.SSLEngineResult.Status;
30 import javax.net.ssl.SSLException;
31
32 import org.eclipse.jetty.io.AbstractConnection;
33 import org.eclipse.jetty.io.AbstractEndPoint;
34 import org.eclipse.jetty.io.ByteBufferPool;
35 import org.eclipse.jetty.io.Connection;
36 import org.eclipse.jetty.io.EndPoint;
37 import org.eclipse.jetty.io.EofException;
38 import org.eclipse.jetty.io.RuntimeIOException;
39 import org.eclipse.jetty.io.SelectChannelEndPoint;
40 import org.eclipse.jetty.io.WriteFlusher;
41 import org.eclipse.jetty.util.BufferUtil;
42 import org.eclipse.jetty.util.Callback;
43 import org.eclipse.jetty.util.log.Log;
44 import org.eclipse.jetty.util.log.Logger;
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77 public class SslConnection extends AbstractConnection
78 {
79 private static final Logger LOG = Log.getLogger(SslConnection.class);
80 private static final ByteBuffer __FILL_CALLED_FLUSH= BufferUtil.allocate(0);
81 private static final ByteBuffer __FLUSH_CALLED_FILL= BufferUtil.allocate(0);
82 private final ByteBufferPool _bufferPool;
83 private final SSLEngine _sslEngine;
84 private final DecryptedEndPoint _decryptedEndPoint;
85 private ByteBuffer _decryptedInput;
86 private ByteBuffer _encryptedInput;
87 private ByteBuffer _encryptedOutput;
88 private final boolean _encryptedDirectBuffers = true;
89 private final boolean _decryptedDirectBuffers = false;
90 private boolean _renegotiationAllowed;
91 private final Runnable _runCompletWrite = new Runnable()
92 {
93 @Override
94 public void run()
95 {
96 _decryptedEndPoint.getWriteFlusher().completeWrite();
97 }
98 };
99 private final Runnable _runFillable = new Runnable()
100 {
101 @Override
102 public void run()
103 {
104 _decryptedEndPoint.getFillInterest().fillable();
105 }
106 };
107
108 public SslConnection(ByteBufferPool byteBufferPool, Executor executor, EndPoint endPoint, SSLEngine sslEngine)
109 {
110
111
112 super(endPoint, executor);
113 this._bufferPool = byteBufferPool;
114 this._sslEngine = sslEngine;
115 this._decryptedEndPoint = newDecryptedEndPoint();
116 }
117
118 protected DecryptedEndPoint newDecryptedEndPoint()
119 {
120 return new DecryptedEndPoint();
121 }
122
123 public SSLEngine getSSLEngine()
124 {
125 return _sslEngine;
126 }
127
128 public DecryptedEndPoint getDecryptedEndPoint()
129 {
130 return _decryptedEndPoint;
131 }
132
133 public boolean isRenegotiationAllowed()
134 {
135 return _renegotiationAllowed;
136 }
137
138 public void setRenegotiationAllowed(boolean renegotiationAllowed)
139 {
140 this._renegotiationAllowed = renegotiationAllowed;
141 }
142
143 @Override
144 public void onOpen()
145 {
146 try
147 {
148
149 _sslEngine.beginHandshake();
150 super.onOpen();
151 getDecryptedEndPoint().getConnection().onOpen();
152 }
153 catch (SSLException x)
154 {
155 getEndPoint().close();
156 throw new RuntimeIOException(x);
157 }
158 }
159
160 @Override
161 public void onClose()
162 {
163 _decryptedEndPoint.getConnection().onClose();
164 super.onClose();
165 }
166
167 @Override
168 public void close()
169 {
170 getDecryptedEndPoint().getConnection().close();
171 }
172
173 @Override
174 public boolean onIdleExpired()
175 {
176 return getDecryptedEndPoint().getConnection().onIdleExpired();
177 }
178
179 @Override
180 public void onFillable()
181 {
182
183
184
185
186
187
188 if (LOG.isDebugEnabled())
189 LOG.debug("onFillable enter {}", _decryptedEndPoint);
190
191
192 if (_decryptedEndPoint.isInputShutdown())
193 _decryptedEndPoint.close();
194
195
196
197 _decryptedEndPoint.getFillInterest().fillable();
198
199
200 synchronized(_decryptedEndPoint)
201 {
202 if (_decryptedEndPoint._flushRequiresFillToProgress)
203 {
204 _decryptedEndPoint._flushRequiresFillToProgress = false;
205 _runCompletWrite.run();
206 }
207 }
208
209 if (LOG.isDebugEnabled())
210 LOG.debug("onFillable exit {}", _decryptedEndPoint);
211 }
212
213 @Override
214 public void onFillInterestedFailed(Throwable cause)
215 {
216
217
218
219
220
221 _decryptedEndPoint.getFillInterest().onFail(cause);
222
223 boolean failFlusher = false;
224 synchronized(_decryptedEndPoint)
225 {
226 if (_decryptedEndPoint._flushRequiresFillToProgress)
227 {
228 _decryptedEndPoint._flushRequiresFillToProgress = false;
229 failFlusher = true;
230 }
231 }
232 if (failFlusher)
233 _decryptedEndPoint.getWriteFlusher().onFail(cause);
234 }
235
236 @Override
237 public String toString()
238 {
239 ByteBuffer b = _encryptedInput;
240 int ei=b==null?-1:b.remaining();
241 b = _encryptedOutput;
242 int eo=b==null?-1:b.remaining();
243 b = _decryptedInput;
244 int di=b==null?-1:b.remaining();
245
246 return String.format("SslConnection@%x{%s,eio=%d/%d,di=%d} -> %s",
247 hashCode(),
248 _sslEngine.getHandshakeStatus(),
249 ei,eo,di,
250 _decryptedEndPoint.getConnection());
251 }
252
253 public class DecryptedEndPoint extends AbstractEndPoint
254 {
255 private boolean _fillRequiresFlushToProgress;
256 private boolean _flushRequiresFillToProgress;
257 private boolean _cannotAcceptMoreAppDataToFlush;
258 private boolean _handshaken;
259 private boolean _underFlown;
260
261 private final Callback _writeCallback = new Callback()
262 {
263 @Override
264 public void succeeded()
265 {
266
267
268
269 boolean fillable = false;
270 synchronized (DecryptedEndPoint.this)
271 {
272 if (LOG.isDebugEnabled())
273 LOG.debug("write.complete {}", SslConnection.this.getEndPoint());
274
275 releaseEncryptedOutputBuffer();
276
277 _cannotAcceptMoreAppDataToFlush = false;
278
279 if (_fillRequiresFlushToProgress)
280 {
281 _fillRequiresFlushToProgress = false;
282 fillable = true;
283 }
284 }
285 if (fillable)
286 getFillInterest().fillable();
287 _runCompletWrite.run();
288 }
289
290 @Override
291 public void failed(final Throwable x)
292 {
293
294
295
296 boolean fail_filler = false;
297 synchronized (DecryptedEndPoint.this)
298 {
299 if (LOG.isDebugEnabled())
300 LOG.debug("{} write.failed", SslConnection.this, x);
301 BufferUtil.clear(_encryptedOutput);
302 releaseEncryptedOutputBuffer();
303
304 _cannotAcceptMoreAppDataToFlush = false;
305
306 if (_fillRequiresFlushToProgress)
307 {
308 _fillRequiresFlushToProgress = false;
309 fail_filler = true;
310 }
311 }
312
313 final boolean filler_failed=fail_filler;
314
315 failedCallback(new Callback()
316 {
317 @Override
318 public void succeeded()
319 {
320 }
321
322 @Override
323 public void failed(Throwable x)
324 {
325 if (filler_failed)
326 getFillInterest().onFail(x);
327 getWriteFlusher().onFail(x);
328 }
329
330 },x);
331 }
332 };
333
334 public DecryptedEndPoint()
335 {
336
337 super(null, getEndPoint().getLocalAddress(), getEndPoint().getRemoteAddress());
338 super.setIdleTimeout(-1);
339 }
340
341 @Override
342 public long getIdleTimeout()
343 {
344 return getEndPoint().getIdleTimeout();
345 }
346
347 @Override
348 public void setIdleTimeout(long idleTimeout)
349 {
350 getEndPoint().setIdleTimeout(idleTimeout);
351 }
352
353 @Override
354 public boolean isOpen()
355 {
356 return getEndPoint().isOpen();
357 }
358
359 @Override
360 protected WriteFlusher getWriteFlusher()
361 {
362 return super.getWriteFlusher();
363 }
364
365 @Override
366 protected void onIncompleteFlush()
367 {
368
369
370
371
372 boolean try_again = false;
373 synchronized (DecryptedEndPoint.this)
374 {
375 if (LOG.isDebugEnabled())
376 LOG.debug("onIncompleteFlush {}", SslConnection.this);
377
378 if (BufferUtil.hasContent(_encryptedOutput))
379 {
380
381 _cannotAcceptMoreAppDataToFlush = true;
382 getEndPoint().write(_writeCallback, _encryptedOutput);
383 }
384
385 else if (_sslEngine.getHandshakeStatus() == HandshakeStatus.NEED_UNWRAP)
386 {
387
388 _flushRequiresFillToProgress = true;
389
390 ensureFillInterested();
391 }
392 else
393 {
394
395
396
397
398
399 try_again = true;
400 }
401 }
402
403
404 if (try_again)
405 {
406
407 if (isOutputShutdown())
408 {
409
410 getWriteFlusher().onClose();
411 }
412
413 else
414 {
415
416
417 getExecutor().execute(_runCompletWrite);
418 }
419 }
420 }
421
422 @Override
423 protected void needsFillInterest() throws IOException
424 {
425
426
427
428
429
430 synchronized (DecryptedEndPoint.this)
431 {
432
433 boolean fillable = (BufferUtil.hasContent(_decryptedInput))
434
435 || BufferUtil.hasContent(_encryptedInput) && !_underFlown;
436
437
438 if (!fillable)
439 {
440
441
442
443 if (_fillRequiresFlushToProgress)
444 {
445
446
447
448 if (BufferUtil.hasContent(_encryptedOutput))
449 {
450
451 _cannotAcceptMoreAppDataToFlush = true;
452 getEndPoint().write(_writeCallback, _encryptedOutput);
453 }
454 else
455 {
456
457
458 _fillRequiresFlushToProgress = false;
459 fillable=true;
460 }
461 }
462 }
463
464 if (fillable)
465 getExecutor().execute(_runFillable);
466 else
467 ensureFillInterested();
468 }
469 }
470
471 @Override
472 public void setConnection(Connection connection)
473 {
474 if (connection instanceof AbstractConnection)
475 {
476 AbstractConnection a = (AbstractConnection)connection;
477 if (a.getInputBufferSize()<_sslEngine.getSession().getApplicationBufferSize())
478 a.setInputBufferSize(_sslEngine.getSession().getApplicationBufferSize());
479 }
480 super.setConnection(connection);
481 }
482
483 public SslConnection getSslConnection()
484 {
485 return SslConnection.this;
486 }
487
488 @Override
489 public synchronized int fill(ByteBuffer buffer) throws IOException
490 {
491 try
492 {
493
494 if (BufferUtil.hasContent(_decryptedInput))
495 return BufferUtil.append(buffer,_decryptedInput);
496
497
498 if (_encryptedInput == null)
499 _encryptedInput = _bufferPool.acquire(_sslEngine.getSession().getPacketBufferSize(), _encryptedDirectBuffers);
500 else
501 BufferUtil.compact(_encryptedInput);
502
503
504 ByteBuffer app_in;
505 if (BufferUtil.space(buffer) > _sslEngine.getSession().getApplicationBufferSize())
506 app_in = buffer;
507 else if (_decryptedInput == null)
508 app_in = _decryptedInput = _bufferPool.acquire(_sslEngine.getSession().getApplicationBufferSize(), _decryptedDirectBuffers);
509 else
510 app_in = _decryptedInput;
511
512
513 while (true)
514 {
515
516 int net_filled = getEndPoint().fill(_encryptedInput);
517
518 decryption: while (true)
519 {
520
521
522 int pos = BufferUtil.flipToFill(app_in);
523 SSLEngineResult unwrapResult;
524 try
525 {
526 unwrapResult = _sslEngine.unwrap(_encryptedInput, app_in);
527 }
528 finally
529 {
530 BufferUtil.flipToFlush(app_in, pos);
531 }
532 if (LOG.isDebugEnabled())
533 {
534 LOG.debug("{} net={} unwrap {}", SslConnection.this, net_filled, unwrapResult.toString().replace('\n',' '));
535 LOG.debug("{} filled {}",SslConnection.this,BufferUtil.toHexSummary(buffer));
536 }
537
538 HandshakeStatus handshakeStatus = _sslEngine.getHandshakeStatus();
539 HandshakeStatus unwrapHandshakeStatus = unwrapResult.getHandshakeStatus();
540 Status unwrapResultStatus = unwrapResult.getStatus();
541
542
543
544 _underFlown = unwrapResultStatus == Status.BUFFER_UNDERFLOW || unwrapResultStatus == Status.OK && unwrapResult.bytesConsumed()==0 && unwrapResult.bytesProduced()==0;
545
546 if (_underFlown)
547 {
548 if (net_filled < 0)
549 closeInbound();
550 if (net_filled <= 0)
551 return net_filled;
552 }
553
554 switch (unwrapResultStatus)
555 {
556 case CLOSED:
557 {
558 switch (handshakeStatus)
559 {
560 case NOT_HANDSHAKING:
561 {
562
563 return -1;
564 }
565 case NEED_TASK:
566 {
567 _sslEngine.getDelegatedTask().run();
568 continue;
569 }
570 case NEED_WRAP:
571 {
572
573
574
575 return -1;
576 }
577 case NEED_UNWRAP:
578 {
579
580
581 return -1;
582 }
583 default:
584 {
585 throw new IllegalStateException();
586 }
587 }
588 }
589 case BUFFER_UNDERFLOW:
590 case OK:
591 {
592 if (unwrapHandshakeStatus == HandshakeStatus.FINISHED && !_handshaken)
593 {
594 _handshaken = true;
595 if (LOG.isDebugEnabled())
596 LOG.debug("{} {} handshook {}/{}", SslConnection.this,
597 _sslEngine.getUseClientMode() ? "client" : "resumed server",
598 _sslEngine.getSession().getProtocol(),_sslEngine.getSession().getCipherSuite());
599 }
600
601
602 if (_handshaken && handshakeStatus != HandshakeStatus.NOT_HANDSHAKING && !isRenegotiationAllowed())
603 {
604 if (LOG.isDebugEnabled())
605 LOG.debug("{} renegotiation denied", SslConnection.this);
606 closeInbound();
607 return -1;
608 }
609
610
611
612
613 if (unwrapResult.bytesProduced() > 0)
614 {
615 if (app_in == buffer)
616 return unwrapResult.bytesProduced();
617 return BufferUtil.append(buffer,_decryptedInput);
618 }
619
620 switch (handshakeStatus)
621 {
622 case NOT_HANDSHAKING:
623 {
624 if (_underFlown)
625 break decryption;
626 continue;
627 }
628 case NEED_TASK:
629 {
630 _sslEngine.getDelegatedTask().run();
631 continue;
632 }
633 case NEED_WRAP:
634 {
635
636
637 if (buffer == __FLUSH_CALLED_FILL)
638 return 0;
639
640 _fillRequiresFlushToProgress = true;
641 flush(__FILL_CALLED_FLUSH);
642 if (BufferUtil.isEmpty(_encryptedOutput))
643 {
644
645 _fillRequiresFlushToProgress = false;
646 continue;
647 }
648 else
649 {
650
651
652 return 0;
653 }
654 }
655 case NEED_UNWRAP:
656 {
657 if (_underFlown)
658 break decryption;
659 continue;
660 }
661 default:
662 {
663 throw new IllegalStateException();
664 }
665 }
666 }
667 default:
668 {
669 throw new IllegalStateException();
670 }
671 }
672 }
673 }
674 }
675 catch (IllegalStateException e)
676 {
677
678 LOG.debug(e);
679 getEndPoint().close();
680 throw new EofException(e);
681 }
682 catch (Exception e)
683 {
684 getEndPoint().close();
685 throw e;
686 }
687 finally
688 {
689
690 if (_flushRequiresFillToProgress)
691 {
692 _flushRequiresFillToProgress = false;
693 getExecutor().execute(_runCompletWrite);
694 }
695
696 if (_encryptedInput != null && !_encryptedInput.hasRemaining())
697 {
698 _bufferPool.release(_encryptedInput);
699 _encryptedInput = null;
700 }
701 if (_decryptedInput != null && !_decryptedInput.hasRemaining())
702 {
703 _bufferPool.release(_decryptedInput);
704 _decryptedInput = null;
705 }
706 }
707 }
708
709 private void closeInbound()
710 {
711 try
712 {
713 _sslEngine.closeInbound();
714 }
715 catch (SSLException x)
716 {
717 LOG.ignore(x);
718 }
719 }
720
721 @Override
722 public synchronized boolean flush(ByteBuffer... appOuts) throws IOException
723 {
724
725
726
727
728
729
730
731 if (LOG.isDebugEnabled())
732 {
733 for (ByteBuffer b : appOuts)
734 LOG.debug("{} flush {}", SslConnection.this, BufferUtil.toHexSummary(b));
735 }
736
737 try
738 {
739 if (_cannotAcceptMoreAppDataToFlush)
740 {
741 if (_sslEngine.isOutboundDone())
742 throw new EofException(new ClosedChannelException());
743 return false;
744 }
745
746
747 if (_encryptedOutput == null)
748 _encryptedOutput = _bufferPool.acquire(_sslEngine.getSession().getPacketBufferSize(), _encryptedDirectBuffers);
749
750 while (true)
751 {
752
753 BufferUtil.compact(_encryptedOutput);
754 int pos = BufferUtil.flipToFill(_encryptedOutput);
755 SSLEngineResult wrapResult;
756 try
757 {
758 wrapResult = _sslEngine.wrap(appOuts, _encryptedOutput);
759 }
760 finally
761 {
762 BufferUtil.flipToFlush(_encryptedOutput, pos);
763 }
764 if (LOG.isDebugEnabled())
765 LOG.debug("{} wrap {}", SslConnection.this, wrapResult.toString().replace('\n',' '));
766
767 Status wrapResultStatus = wrapResult.getStatus();
768
769 boolean allConsumed=true;
770 for (ByteBuffer b : appOuts)
771 if (BufferUtil.hasContent(b))
772 allConsumed=false;
773
774
775 switch (wrapResultStatus)
776 {
777 case CLOSED:
778
779 if (BufferUtil.hasContent(_encryptedOutput))
780 {
781 _cannotAcceptMoreAppDataToFlush = true;
782 getEndPoint().flush(_encryptedOutput);
783 getEndPoint().shutdownOutput();
784
785
786
787
788 if (BufferUtil.hasContent(_encryptedOutput))
789 return false;
790 }
791
792 else
793 {
794 getEndPoint().shutdownOutput();
795 }
796 return allConsumed;
797
798 case BUFFER_UNDERFLOW:
799 throw new IllegalStateException();
800
801 default:
802 if (LOG.isDebugEnabled())
803 LOG.debug("{} wrap {} {}", SslConnection.this, wrapResultStatus, BufferUtil.toHexSummary(_encryptedOutput));
804
805 if (wrapResult.getHandshakeStatus() == HandshakeStatus.FINISHED && !_handshaken)
806 {
807 _handshaken = true;
808 if (LOG.isDebugEnabled())
809 LOG.debug("{} server handshook complete {}/{}", SslConnection.this, _sslEngine.getSession().getProtocol(),_sslEngine.getSession().getCipherSuite());
810 }
811
812 HandshakeStatus handshakeStatus = _sslEngine.getHandshakeStatus();
813
814
815 if (_handshaken && handshakeStatus != HandshakeStatus.NOT_HANDSHAKING && !isRenegotiationAllowed())
816 {
817 if (LOG.isDebugEnabled())
818 LOG.debug("{} renegotiation denied", SslConnection.this);
819 getEndPoint().shutdownOutput();
820 return allConsumed;
821 }
822
823
824 if (BufferUtil.hasContent(_encryptedOutput))
825 if (!getEndPoint().flush(_encryptedOutput))
826 getEndPoint().flush(_encryptedOutput);
827
828
829 switch (handshakeStatus)
830 {
831 case NOT_HANDSHAKING:
832
833
834
835 if (!allConsumed && wrapResult.getHandshakeStatus()==HandshakeStatus.FINISHED && BufferUtil.isEmpty(_encryptedOutput))
836 continue;
837
838
839 return allConsumed && BufferUtil.isEmpty(_encryptedOutput);
840
841 case NEED_TASK:
842
843 _sslEngine.getDelegatedTask().run();
844 continue;
845
846 case NEED_WRAP:
847
848 continue;
849
850 case NEED_UNWRAP:
851
852
853 if (appOuts[0]!=__FILL_CALLED_FLUSH && !getFillInterest().isInterested())
854 {
855
856 _flushRequiresFillToProgress = true;
857 fill(__FLUSH_CALLED_FILL);
858
859 if (handshakeStatus == HandshakeStatus.NEED_WRAP)
860 continue;
861 }
862 return allConsumed && BufferUtil.isEmpty(_encryptedOutput);
863
864 case FINISHED:
865 throw new IllegalStateException();
866 }
867 }
868 }
869 }
870 finally
871 {
872 releaseEncryptedOutputBuffer();
873 }
874 }
875
876 private void releaseEncryptedOutputBuffer()
877 {
878 if (!Thread.holdsLock(DecryptedEndPoint.this))
879 throw new IllegalStateException();
880 if (_encryptedOutput != null && !_encryptedOutput.hasRemaining())
881 {
882 _bufferPool.release(_encryptedOutput);
883 _encryptedOutput = null;
884 }
885 }
886
887 @Override
888 public void shutdownOutput()
889 {
890 boolean ishut = isInputShutdown();
891 boolean oshut = isOutputShutdown();
892 if (LOG.isDebugEnabled())
893 LOG.debug("{} shutdownOutput: oshut={}, ishut={}", SslConnection.this, oshut, ishut);
894 if (ishut)
895 {
896
897
898
899
900 getEndPoint().close();
901 }
902 else if (!oshut)
903 {
904 try
905 {
906 synchronized (this)
907 {
908 _sslEngine.closeOutbound();
909 flush(BufferUtil.EMPTY_BUFFER);
910 ensureFillInterested();
911 }
912 }
913 catch (Exception e)
914 {
915 LOG.ignore(e);
916 getEndPoint().close();
917 }
918 }
919 }
920
921 private void ensureFillInterested()
922 {
923 if (!SslConnection.this.isFillInterested())
924 SslConnection.this.fillInterested();
925 }
926
927 @Override
928 public boolean isOutputShutdown()
929 {
930 return _sslEngine.isOutboundDone() || getEndPoint().isOutputShutdown();
931 }
932
933 @Override
934 public void close()
935 {
936
937 shutdownOutput();
938 getEndPoint().close();
939 super.close();
940 }
941
942 @Override
943 public Object getTransport()
944 {
945 return getEndPoint();
946 }
947
948 @Override
949 public boolean isInputShutdown()
950 {
951 return _sslEngine.isInboundDone();
952 }
953
954 @Override
955 public String toString()
956 {
957 return super.toString()+"->"+getEndPoint().toString();
958 }
959 }
960 }