// Copyright Joyent, Inc. and other Node contributors.

//

// Permission is hereby granted, free of charge, to any person obtaining a

// copy of this software and associated documentation files (the

// "Software"), to deal in the Software without restriction, including

// without limitation the rights to use, copy, modify, merge, publish,

// distribute, sublicense, and/or sell copies of the Software, and to permit

// persons to whom the Software is furnished to do so, subject to the

// following conditions:

//

// The above copyright notice and this permission notice shall be included

// in all copies or substantial portions of the Software.

//

// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN

// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,

// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE

// USE OR OTHER DEALINGS IN THE SOFTWARE.

#include "crypto/crypto_tls.h"

#include "crypto/crypto_context.h"

#include "crypto/crypto_common.h"

#include "crypto/crypto_util.h"

#include "crypto/crypto_bio.h"

#include "crypto/crypto_clienthello-inl.h"

#include "allocated_buffer-inl.h"

#include "async_wrap-inl.h"

#include "debug_utils-inl.h"

#include "memory_tracker-inl.h"

#include "node_buffer.h"

#include "node_errors.h"

#include "stream_base-inl.h"

#include "util-inl.h"

namespace node {

using v8::Array;

using v8::ArrayBufferView;

using v8::Context;

using v8::DontDelete;

using v8::EscapableHandleScope;

using v8::Exception;

using v8::False;

using v8::Function;

using v8::FunctionCallbackInfo;

using v8::FunctionTemplate;

using v8::HandleScope;

using v8::Integer;

using v8::Isolate;

using v8::Local;

using v8::MaybeLocal;

using v8::Null;

using v8::Object;

using v8::PropertyAttribute;

using v8::ReadOnly;

using v8::Signature;

using v8::String;

using v8::True;

using v8::Uint32;

using v8::Value;

namespace crypto {

namespace {

SSL_SESSION* GetSessionCallback(

SSL* s,

const unsigned char* key,

int len,

int* copy) {

TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));

*copy = 0;

return w->ReleaseSession();

}

void OnClientHello(

void* arg,

const ClientHelloParser::ClientHello& hello) {

TLSWrap* w = static_cast<TLSWrap*>(arg);

Environment* env = w->env();

HandleScope handle_scope(env->isolate());

Context::Scope context_scope(env->context());

Local<Object> hello_obj = Object::New(env->isolate());

Local<String> servername = (hello.servername() == nullptr)

? String::Empty(env->isolate())

: OneByteString(env->isolate(),

hello.servername(),

hello.servername_size());

Local<Object> buf =

Buffer::Copy(

env,

reinterpret_cast<const char*>(hello.session_id()),

hello.session_size()).FromMaybe(Local<Object>());

if ((buf.IsEmpty() ||

hello_obj->Set(env->context(), env->session_id_string(), buf)

.IsNothing()) ||

hello_obj->Set(env->context(), env->servername_string(), servername)

.IsNothing() ||

hello_obj->Set(

env->context(),

env->tls_ticket_string(),

hello.has_ticket()

? True(env->isolate())

: False(env->isolate())).IsNothing()) {

return;

}

Local<Value> argv[] = { hello_obj };

w->MakeCallback(env->onclienthello_string(), arraysize(argv), argv);

}

void KeylogCallback(const SSL* s, const char* line) {

TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));

Environment* env = w->env();

HandleScope handle_scope(env->isolate());

Context::Scope context_scope(env->context());

const size_t size = strlen(line);

Local<Value> line_bf = Buffer::Copy(env, line, 1 + size)

.FromMaybe(Local<Value>());

if (UNLIKELY(line_bf.IsEmpty()))

return;

char* data = Buffer::Data(line_bf);

data[size] = '\n';

w->MakeCallback(env->onkeylog_string(), 1, &line_bf);

}

int NewSessionCallback(SSL* s, SSL_SESSION* sess) {

TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));

Environment* env = w->env();

HandleScope handle_scope(env->isolate());

Context::Scope context_scope(env->context());

if (!w->has_session_callbacks())

return 0;

// Check if session is small enough to be stored

int size = i2d_SSL_SESSION(sess, nullptr);

if (UNLIKELY(size > SecureContext::kMaxSessionSize))

return 0;

// Serialize session

// TODO(@jasnell): An AllocatedBuffer or BackingStore would be better

// here to start eliminating unnecessary uses of Buffer where an ordinary

// Uint8Array would do just fine.

Local<Object> session = Buffer::New(env, size).FromMaybe(Local<Object>());

if (UNLIKELY(session.IsEmpty()))

return 0;

unsigned char* session_data =

reinterpret_cast<unsigned char*>(Buffer::Data(session));

memset(session_data, 0, size);

i2d_SSL_SESSION(sess, &session_data);

unsigned int session_id_length;

const unsigned char* session_id_data =

SSL_SESSION_get_id(sess, &session_id_length);

// TODO(@jasnell): An AllocatedBuffer or BackingStore would be better

// here to start eliminating unnecessary uses of Buffer where an ordinary

// Uint8Array would do just fine

Local<Object> session_id = Buffer::Copy(

env,

reinterpret_cast<const char*>(session_id_data),

session_id_length).FromMaybe(Local<Object>());

if (UNLIKELY(session_id.IsEmpty()))

return 0;

Local<Value> argv[] = {

session_id,

session

};

// On servers, we pause the handshake until callback of 'newSession', which

// calls NewSessionDoneCb(). On clients, there is no callback to wait for.

if (w->is_server())

w->set_awaiting_new_session(true);

w->MakeCallback(env->onnewsession_string(), arraysize(argv), argv);

return 0;

}

int SSLCertCallback(SSL* s, void* arg) {

TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));

if (!w->is_server() || !w->is_waiting_cert_cb())

return 1;

if (w->is_cert_cb_running())

// Not an error. Suspend handshake with SSL_ERROR_WANT_X509_LOOKUP, and

// handshake will continue after certcb is done.

return -1;

Environment* env = w->env();

HandleScope handle_scope(env->isolate());

Context::Scope context_scope(env->context());

w->set_cert_cb_running();

Local<Object> info = Object::New(env->isolate());

const char* servername = GetServerName(s);

Local<String> servername_str = (servername == nullptr)

? String::Empty(env->isolate())

: OneByteString(env->isolate(), servername, strlen(servername));

Local<Value> ocsp = (SSL_get_tlsext_status_type(s) == TLSEXT_STATUSTYPE_ocsp)

? True(env->isolate())

: False(env->isolate());

if (info->Set(env->context(), env->servername_string(), servername_str)

.IsNothing() ||

info->Set(env->context(), env->ocsp_request_string(), ocsp).IsNothing()) {

return 1;

}

Local<Value> argv[] = { info };

w->MakeCallback(env->oncertcb_string(), arraysize(argv), argv);

return w->is_cert_cb_running() ? -1 : 1;

}

int SelectALPNCallback(

SSL* s,

const unsigned char** out,

unsigned char* outlen,

const unsigned char* in,

unsigned int inlen,

void* arg) {

TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));

Environment* env = w->env();

HandleScope handle_scope(env->isolate());

Context::Scope context_scope(env->context());

Local<Value> alpn_buffer =

w->object()->GetPrivate(

env->context(),

env->alpn_buffer_private_symbol()).FromMaybe(Local<Value>());

if (UNLIKELY(alpn_buffer.IsEmpty()) || !alpn_buffer->IsArrayBufferView())

return SSL_TLSEXT_ERR_NOACK;

ArrayBufferViewContents<unsigned char> alpn_protos(alpn_buffer);

int status = SSL_select_next_proto(

const_cast<unsigned char**>(out),

outlen,

alpn_protos.data(),

alpn_protos.length(),

in,

inlen);

// According to 3.2. Protocol Selection of RFC7301, fatal

// no_application_protocol alert shall be sent but OpenSSL 1.0.2 does not

// support it yet. See

// https://rt.openssl.org/Ticket/Display.html?id=3463&user=guest&pass=guest

return status == OPENSSL_NPN_NEGOTIATED

? SSL_TLSEXT_ERR_OK

: SSL_TLSEXT_ERR_NOACK;

}

int TLSExtStatusCallback(SSL* s, void* arg) {

TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));

Environment* env = w->env();

HandleScope handle_scope(env->isolate());

if (w->is_client()) {

// Incoming response

Local<Value> arg;

if (GetSSLOCSPResponse(env, s, Null(env->isolate())).ToLocal(&arg))

w->MakeCallback(env->onocspresponse_string(), 1, &arg);

// No async acceptance is possible, so always return 1 to accept the

// response. The listener for 'OCSPResponse' event has no control over

// return value, but it can .destroy() the connection if the response is not

// acceptable.

return 1;

}

// Outgoing response

Local<ArrayBufferView> obj =

w->ocsp_response().FromMaybe(Local<ArrayBufferView>());

if (UNLIKELY(obj.IsEmpty()))

return SSL_TLSEXT_ERR_NOACK;

size_t len = obj->ByteLength();

// OpenSSL takes control of the pointer after accepting it

unsigned char* data = MallocOpenSSL<unsigned char>(len);

obj->CopyContents(data, len);

if (!SSL_set_tlsext_status_ocsp_resp(s, data, len))

OPENSSL_free(data);

w->ClearOcspResponse();

return SSL_TLSEXT_ERR_OK;

}

void ConfigureSecureContext(SecureContext* sc) {

// OCSP stapling

SSL_CTX_set_tlsext_status_cb(sc->ctx_.get(), TLSExtStatusCallback);

SSL_CTX_set_tlsext_status_arg(sc->ctx_.get(), nullptr);

}

inline bool Set(

Environment* env,

Local<Object> target,

Local<String> name,

const char* value,

bool ignore_null = true) {

if (value == nullptr)

return ignore_null;

return !target->Set(

env->context(),

name,

OneByteString(env->isolate(), value))

.IsNothing();

}

} // namespace

TLSWrap::TLSWrap(Environment* env,

Local<Object> obj,

Kind kind,

StreamBase* stream,

SecureContext* sc)

: AsyncWrap(env, obj, AsyncWrap::PROVIDER_TLSWRAP),

StreamBase(env),

env_(env),

kind_(kind),

sc_(sc) {

MakeWeak();

CHECK(sc_);

ssl_ = sc_->CreateSSL();

CHECK(ssl_);

sc_->SetGetSessionCallback(GetSessionCallback);

sc_->SetNewSessionCallback(NewSessionCallback);

StreamBase::AttachToObject(GetObject());

stream->PushStreamListener(this);

env_->isolate()->AdjustAmountOfExternalAllocatedMemory(kExternalSize);

InitSSL();

Debug(this, "Created new TLSWrap");

}

TLSWrap::~TLSWrap() {

Destroy();

}

MaybeLocal<ArrayBufferView> TLSWrap::ocsp_response() const {

if (ocsp_response_.IsEmpty())

return MaybeLocal<ArrayBufferView>();

return PersistentToLocal::Default(env()->isolate(), ocsp_response_);

}

void TLSWrap::ClearOcspResponse() {

ocsp_response_.Reset();

}

SSL_SESSION* TLSWrap::ReleaseSession() {

return next_sess_.release();

}

void TLSWrap::InvokeQueued(int status, const char* error_str) {

Debug(this, "Invoking queued write callbacks (%d, %s)", status, error_str);

if (!write_callback_scheduled_)

return;

if (current_write_) {

BaseObjectPtr<AsyncWrap> current_write = std::move(current_write_);

current_write_.reset();

WriteWrap* w = WriteWrap::FromObject(current_write);

w->Done(status, error_str);

}

}

void TLSWrap::NewSessionDoneCb() {

Debug(this, "New session callback done");

Cycle();

}

void TLSWrap::InitSSL() {

// Initialize SSL – OpenSSL takes ownership of these.

enc_in_ = NodeBIO::New(env()).release();

enc_out_ = NodeBIO::New(env()).release();

SSL_set_bio(ssl_.get(), enc_in_, enc_out_);

// NOTE: This could be overridden in SetVerifyMode

SSL_set_verify(ssl_.get(), SSL_VERIFY_NONE, VerifyCallback);

#ifdef SSL_MODE_RELEASE_BUFFERS

SSL_set_mode(ssl_.get(), SSL_MODE_RELEASE_BUFFERS);

#endif // SSL_MODE_RELEASE_BUFFERS

// This is default in 1.1.1, but set it anyway, Cycle() doesn't currently

// re-call ClearIn() if SSL_read() returns SSL_ERROR_WANT_READ, so data can be

// left sitting in the incoming enc_in_ and never get processed.

// - https://wiki.openssl.org/index.php/TLS1.3#Non-application_data_records

SSL_set_mode(ssl_.get(), SSL_MODE_AUTO_RETRY);

#ifdef OPENSSL_IS_BORINGSSL

// OpenSSL allows renegotiation by default, but BoringSSL disables it.

// Configure BoringSSL to match OpenSSL's behavior.

SSL_set_renegotiate_mode(ssl_.get(), ssl_renegotiate_freely);

#endif

SSL_set_app_data(ssl_.get(), this);

// Using InfoCallback isn't how we are supposed to check handshake progress:

// https://github.com/openssl/openssl/issues/7199#issuecomment-420915993

//

// Note on when this gets called on various openssl versions:

// https://github.com/openssl/openssl/issues/7199#issuecomment-420670544

SSL_set_info_callback(ssl_.get(), SSLInfoCallback);

if (is_server())

sc_->SetSelectSNIContextCallback(SelectSNIContextCallback);

ConfigureSecureContext(sc_.get());

SSL_set_cert_cb(ssl_.get(), SSLCertCallback, this);

if (is_server()) {

SSL_set_accept_state(ssl_.get());

} else if (is_client()) {

// Enough space for server response (hello, cert)

NodeBIO::FromBIO(enc_in_)->set_initial(kInitialClientBufferLength);

SSL_set_connect_state(ssl_.get());

} else {

// Unexpected

ABORT();

}

}

void TLSWrap::Wrap(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

CHECK_EQ(args.Length(), 3);

CHECK(args[0]->IsObject());

CHECK(args[1]->IsObject());

CHECK(args[2]->IsBoolean());

Local<Object> sc = args[1].As<Object>();

Kind kind = args[2]->IsTrue() ? Kind::kServer : Kind::kClient;

StreamBase* stream = StreamBase::FromObject(args[0].As<Object>());

CHECK_NOT_NULL(stream);

Local<Object> obj;

if (!env->tls_wrap_constructor_function()

->NewInstance(env->context())

.ToLocal(&obj)) {

return;

}

TLSWrap* res = new TLSWrap(env, obj, kind, stream, Unwrap<SecureContext>(sc));

args.GetReturnValue().Set(res->object());

}

void TLSWrap::Receive(const FunctionCallbackInfo<Value>& args) {

TLSWrap* wrap;

ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());

ArrayBufferViewContents<char> buffer(args[0]);

const char* data = buffer.data();

size_t len = buffer.length();

Debug(wrap, "Receiving %zu bytes injected from JS", len);

// Copy given buffer entirely or partiall if handle becomes closed

while (len > 0 && wrap->IsAlive() && !wrap->IsClosing()) {

uv_buf_t buf = wrap->OnStreamAlloc(len);

size_t copy = buf.len > len ? len : buf.len;

memcpy(buf.base, data, copy);

buf.len = copy;

wrap->OnStreamRead(copy, buf);

data += copy;

len -= copy;

}

}

void TLSWrap::Start(const FunctionCallbackInfo<Value>& args) {

TLSWrap* wrap;

ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());

CHECK(!wrap->started_);

wrap->started_ = true;

// Send ClientHello handshake

CHECK(wrap->is_client());

// Seems odd to read when when we want to send, but SSL_read() triggers a

// handshake if a session isn't established, and handshake will cause

// encrypted data to become available for output.

wrap->ClearOut();

wrap->EncOut();

}

void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {

if (!(where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE)))

return;

// SSL_renegotiate_pending() should take `const SSL*`, but it does not.

SSL* ssl = const_cast<SSL*>(ssl_);

TLSWrap* c = static_cast<TLSWrap*>(SSL_get_app_data(ssl_));

Environment* env = c->env();

HandleScope handle_scope(env->isolate());

Context::Scope context_scope(env->context());

Local<Object> object = c->object();

if (where & SSL_CB_HANDSHAKE_START) {

Debug(c, "SSLInfoCallback(SSL_CB_HANDSHAKE_START);");

// Start is tracked to limit number and frequency of renegotiation attempts,

// since excessive renegotiation may be an attack.

Local<Value> callback;

if (object->Get(env->context(), env->onhandshakestart_string())

.ToLocal(&callback) && callback->IsFunction()) {

Local<Value> argv[] = { env->GetNow() };

c->MakeCallback(callback.As<Function>(), arraysize(argv), argv);

}

}

// SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE are called

// sending HelloRequest in OpenSSL-1.1.1.

// We need to check whether this is in a renegotiation state or not.

if (where & SSL_CB_HANDSHAKE_DONE && !SSL_renegotiate_pending(ssl)) {

Debug(c, "SSLInfoCallback(SSL_CB_HANDSHAKE_DONE);");

CHECK(!SSL_renegotiate_pending(ssl));

Local<Value> callback;

c->established_ = true;

if (object->Get(env->context(), env->onhandshakedone_string())

.ToLocal(&callback) && callback->IsFunction()) {

c->MakeCallback(callback.As<Function>(), 0, nullptr);

}

}

}

void TLSWrap::EncOut() {

Debug(this, "Trying to write encrypted output");

// Ignore cycling data if ClientHello wasn't yet parsed

if (!hello_parser_.IsEnded()) {

Debug(this, "Returning from EncOut(), hello_parser_ active");

return;

}

// Write in progress

if (write_size_ != 0) {

Debug(this, "Returning from EncOut(), write currently in progress");

return;

}

// Wait for `newSession` callback to be invoked

if (is_awaiting_new_session()) {

Debug(this, "Returning from EncOut(), awaiting new session");

return;

}

// Split-off queue

if (established_ && current_write_) {

Debug(this, "EncOut() write is scheduled");

write_callback_scheduled_ = true;

}

if (ssl_ == nullptr) {

Debug(this, "Returning from EncOut(), ssl_ == nullptr");

return;

}

// No encrypted output ready to write to the underlying stream.

if (BIO_pending(enc_out_) == 0) {

Debug(this, "No pending encrypted output");

if (pending_cleartext_input_.size() == 0) {

if (!in_dowrite_) {

Debug(this, "No pending cleartext input, not inside DoWrite()");

InvokeQueued(0);

} else {

Debug(this, "No pending cleartext input, inside DoWrite()");

// TODO(@sam-github, @addaleax) If in_dowrite_ is true, appdata was

// passed to SSL_write(). If we are here, the data was not encrypted to

// enc_out_ yet. Calling Done() "works", but since the write is not

// flushed, its too soon. Just returning and letting the next EncOut()

// call Done() passes the test suite, but without more careful analysis,

// its not clear if it is always correct. Not calling Done() could block

// data flow, so for now continue to call Done(), just do it in the next

// tick.

BaseObjectPtr<TLSWrap> strong_ref{this};

env()->SetImmediate([this, strong_ref](Environment* env) {

InvokeQueued(0);

});

}

}

return;

}

char* data[kSimultaneousBufferCount];

size_t size[arraysize(data)];

size_t count = arraysize(data);

write_size_ = NodeBIO::FromBIO(enc_out_)->PeekMultiple(data, size, &count);

CHECK(write_size_ != 0 && count != 0);

uv_buf_t buf[arraysize(data)];

uv_buf_t* bufs = buf;

for (size_t i = 0; i < count; i++)

buf[i] = uv_buf_init(data[i], size[i]);

Debug(this, "Writing %zu buffers to the underlying stream", count);

StreamWriteResult res = underlying_stream()->Write(bufs, count);

if (res.err != 0) {

InvokeQueued(res.err);

return;

}

if (!res.async) {

Debug(this, "Write finished synchronously");

HandleScope handle_scope(env()->isolate());

// Simulate asynchronous finishing, TLS cannot handle this at the moment.

BaseObjectPtr<TLSWrap> strong_ref{this};

env()->SetImmediate([this, strong_ref](Environment* env) {

OnStreamAfterWrite(nullptr, 0);

});

}

}

void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {

Debug(this, "OnStreamAfterWrite(status = %d)", status);

if (current_empty_write_) {

Debug(this, "Had empty write");

BaseObjectPtr<AsyncWrap> current_empty_write =

std::move(current_empty_write_);

current_empty_write_.reset();

WriteWrap* finishing = WriteWrap::FromObject(current_empty_write);

finishing->Done(status);

return;

}

if (ssl_ == nullptr) {

Debug(this, "ssl_ == nullptr, marking as cancelled");

status = UV_ECANCELED;

}

// Handle error

if (status) {

if (shutdown_) {

Debug(this, "Ignoring error after shutdown");

return;

}

// Notify about error

InvokeQueued(status);

return;

}

// Commit

NodeBIO::FromBIO(enc_out_)->Read(nullptr, write_size_);

// Ensure that the progress will be made and `InvokeQueued` will be called.

ClearIn();

// Try writing more data

write_size_ = 0;

EncOut();

}

MaybeLocal<Value> TLSWrap::GetSSLError(int status, int* err, std::string* msg) {

EscapableHandleScope scope(env()->isolate());

// ssl_ is already destroyed in reading EOF by close notify alert.

if (ssl_ == nullptr)

return MaybeLocal<Value>();

*err = SSL_get_error(ssl_.get(), status);

switch (*err) {

case SSL_ERROR_NONE:

case SSL_ERROR_WANT_READ:

case SSL_ERROR_WANT_WRITE:

case SSL_ERROR_WANT_X509_LOOKUP:

return MaybeLocal<Value>();

case SSL_ERROR_ZERO_RETURN:

return scope.Escape(env()->zero_return_string());

case SSL_ERROR_SSL:

case SSL_ERROR_SYSCALL:

{

unsigned long ssl_err = ERR_peek_error(); // NOLINT(runtime/int)

BIO* bio = BIO_new(BIO_s_mem());

ERR_print_errors(bio);

BUF_MEM* mem;

BIO_get_mem_ptr(bio, &mem);

Isolate* isolate = env()->isolate();

Local<Context> context = isolate->GetCurrentContext();

Local<String> message = OneByteString(isolate, mem->data, mem->length);

Local<Value> exception = Exception::Error(message);

Local<Object> obj =

exception->ToObject(context).FromMaybe(Local<Object>());

if (UNLIKELY(obj.IsEmpty()))

return MaybeLocal<Value>();

const char* ls = ERR_lib_error_string(ssl_err);

const char* fs = ERR_func_error_string(ssl_err);

const char* rs = ERR_reason_error_string(ssl_err);

if (!Set(env(), obj, env()->library_string(), ls) ||

!Set(env(), obj, env()->function_string(), fs)) {

return MaybeLocal<Value>();

}

if (rs != nullptr) {

if (!Set(env(), obj, env()->reason_string(), rs))

return MaybeLocal<Value>();

// SSL has no API to recover the error name from the number, so we

// transform reason strings like "this error" to "ERR_SSL_THIS_ERROR",

// which ends up being close to the original error macro name.

std::string code(rs);

for (auto& c : code)

c = (c == ' ') ? '_' : ToUpper(c);

if (!Set(env(), obj,

env()->code_string(),

("ERR_SSL_" + code).c_str())) {

return MaybeLocal<Value>();

}

}

if (msg != nullptr)

msg->assign(mem->data, mem->data + mem->length);

BIO_free_all(bio);

return scope.Escape(exception);

}

default:

UNREACHABLE();

}

UNREACHABLE();

}

void TLSWrap::ClearOut() {

Debug(this, "Trying to read cleartext output");

// Ignore cycling data if ClientHello wasn't yet parsed

if (!hello_parser_.IsEnded()) {

Debug(this, "Returning from ClearOut(), hello_parser_ active");

return;

}

// No reads after EOF

if (eof_) {

Debug(this, "Returning from ClearOut(), EOF reached");

return;

}

if (ssl_ == nullptr) {

Debug(this, "Returning from ClearOut(), ssl_ == nullptr");

return;

}

MarkPopErrorOnReturn mark_pop_error_on_return;

char out[kClearOutChunkSize];

int read;

for (;;) {

read = SSL_read(ssl_.get(), out, sizeof(out));

Debug(this, "Read %d bytes of cleartext output", read);

if (read <= 0)

break;

char* current = out;

while (read > 0) {

int avail = read;

uv_buf_t buf = EmitAlloc(avail);

if (static_cast<int>(buf.len) < avail)

avail = buf.len;

memcpy(buf.base, current, avail);

EmitRead(avail, buf);

// Caveat emptor: OnRead() calls into JS land which can result in

// the SSL context object being destroyed. We have to carefully

// check that ssl_ != nullptr afterwards.

if (ssl_ == nullptr) {

Debug(this, "Returning from read loop, ssl_ == nullptr");

return;

}

read -= avail;

current += avail;

}

}

int flags = SSL_get_shutdown(ssl_.get());

if (!eof_ && flags & SSL_RECEIVED_SHUTDOWN) {

eof_ = true;

EmitRead(UV_EOF);

}

// We need to check whether an error occurred or the connection was

// shutdown cleanly (SSL_ERROR_ZERO_RETURN) even when read == 0.

// See node#1642 and SSL_read(3SSL) for details.

if (read <= 0) {

HandleScope handle_scope(env()->isolate());

int err;

Local<Value> arg = GetSSLError(read, &err, nullptr)

.FromMaybe(Local<Value>());

// Ignore ZERO_RETURN after EOF, it is basically not a error

if (err == SSL_ERROR_ZERO_RETURN && eof_)

return;

if (LIKELY(!arg.IsEmpty())) {

Debug(this, "Got SSL error (%d), calling onerror", err);

// When TLS Alert are stored in wbio,

// it should be flushed to socket before destroyed.

if (BIO_pending(enc_out_) != 0)

EncOut();

MakeCallback(env()->onerror_string(), 1, &arg);

}

}

}

void TLSWrap::ClearIn() {

Debug(this, "Trying to write cleartext input");

// Ignore cycling data if ClientHello wasn't yet parsed

if (!hello_parser_.IsEnded()) {

Debug(this, "Returning from ClearIn(), hello_parser_ active");

return;

}

if (ssl_ == nullptr) {

Debug(this, "Returning from ClearIn(), ssl_ == nullptr");

return;

}

if (pending_cleartext_input_.size() == 0) {

Debug(this, "Returning from ClearIn(), no pending data");

return;

}

AllocatedBuffer data = std::move(pending_cleartext_input_);

MarkPopErrorOnReturn mark_pop_error_on_return;

NodeBIO::FromBIO(enc_out_)->set_allocate_tls_hint(data.size());

int written = SSL_write(ssl_.get(), data.data(), data.size());

Debug(this, "Writing %zu bytes, written = %d", data.size(), written);

CHECK(written == -1 || written == static_cast<int>(data.size()));

// All written

if (written != -1) {

Debug(this, "Successfully wrote all data to SSL");

return;

}

// Error or partial write

HandleScope handle_scope(env()->isolate());

Context::Scope context_scope(env()->context());

int err;

std::string error_str;

MaybeLocal<Value> arg = GetSSLError(written, &err, &error_str);

if (!arg.IsEmpty()) {

Debug(this, "Got SSL error (%d)", err);

write_callback_scheduled_ = true;

// TODO(@sam-github) Should forward an error object with

// .code/.function/.etc, if possible.

return InvokeQueued(UV_EPROTO, error_str.c_str());

}

Debug(this, "Pushing data back");

// Push back the not-yet-written data. This can be skipped in the error

// case because no further writes would succeed anyway.

pending_cleartext_input_ = std::move(data);

}

std::string TLSWrap::diagnostic_name() const {

std::string name = "TLSWrap ";

name += is_server() ? "server (" : "client (";

name += std::to_string(static_cast<int64_t>(get_async_id())) + ")";

return name;

}

AsyncWrap* TLSWrap::GetAsyncWrap() {

return static_cast<AsyncWrap*>(this);

}

bool TLSWrap::IsIPCPipe() {

return underlying_stream()->IsIPCPipe();

}

int TLSWrap::GetFD() {

return underlying_stream()->GetFD();

}

bool TLSWrap::IsAlive() {

return ssl_ &&

underlying_stream() != nullptr &&

underlying_stream()->IsAlive();

}

bool TLSWrap::IsClosing() {

return underlying_stream()->IsClosing();

}

int TLSWrap::ReadStart() {

Debug(this, "ReadStart()");

if (underlying_stream() != nullptr)

return underlying_stream()->ReadStart();

return 0;

}

int TLSWrap::ReadStop() {

Debug(this, "ReadStop()");

return underlying_stream() != nullptr ? underlying_stream()->ReadStop() : 0;

}

const char* TLSWrap::Error() const {

return error_.empty() ? nullptr : error_.c_str();

}

void TLSWrap::ClearError() {

error_.clear();

}

// Called by StreamBase::Write() to request async write of clear text into SSL.

// TODO(@sam-github) Should there be a TLSWrap::DoTryWrite()?

int TLSWrap::DoWrite(WriteWrap* w,

uv_buf_t* bufs,

size_t count,

uv_stream_t* send_handle) {

CHECK_NULL(send_handle);

Debug(this, "DoWrite()");

if (ssl_ == nullptr) {

ClearError();

error_ = "Write after DestroySSL";

return UV_EPROTO;

}

size_t length = 0;

size_t i;

size_t nonempty_i = 0;

size_t nonempty_count = 0;

for (i = 0; i < count; i++) {

length += bufs[i].len;

if (bufs[i].len > 0) {

nonempty_i = i;

nonempty_count += 1;

}

}

// We want to trigger a Write() on the underlying stream to drive the stream

// system, but don't want to encrypt empty buffers into a TLS frame, so see

// if we can find something to Write().

// First, call ClearOut(). It does an SSL_read(), which might cause handshake

// or other internal messages to be encrypted. If it does, write them later

// with EncOut().

// If there is still no encrypted output, call Write(bufs) on the underlying

// stream. Since the bufs are empty, it won't actually write non-TLS data

// onto the socket, we just want the side-effects. After, make sure the

// WriteWrap was accepted by the stream, or that we call Done() on it.

if (length == 0) {

Debug(this, "Empty write");

ClearOut();

if (BIO_pending(enc_out_) == 0) {

Debug(this, "No pending encrypted output, writing to underlying stream");

CHECK(!current_empty_write_);

current_empty_write_.reset(w->GetAsyncWrap());

StreamWriteResult res =

underlying_stream()->Write(bufs, count, send_handle);

if (!res.async) {

BaseObjectPtr<TLSWrap> strong_ref{this};

env()->SetImmediate([this, strong_ref](Environment* env) {

OnStreamAfterWrite(WriteWrap::FromObject(current_empty_write_), 0);

});

}

return 0;

}

}

// Store the current write wrap

CHECK(!current_write_);

current_write_.reset(w->GetAsyncWrap());