tarweb 0.1.1

io-uring based static file web server, with SNI router
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112

#include "tls.h"

#include <linux/tls.h>
#include <openssl/ssl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <iostream>
#include <memory>

TLSConnection::TLSConnection(SSL_CTX* ctx, int fd)
{
    if (ssl_ = SSL_new(ctx); !ssl_) {
        throw std::runtime_error("KTLS: failed to create SSL object");
    }
    if (int err = SSL_set_fd(ssl_, fd); err != 1) {
        SSL_free(ssl_);
        throw std::runtime_error("KTLS: failed to set fd for SSL object");
    }
}

TLSConnection::~TLSConnection()
{
    if (ssl_) {
        SSL_free(ssl_);
    }
}

TLS::TLS(const std::string& cert, const std::string& priv)
{
    if (ctx_ = SSL_CTX_new(TLS_server_method()); !ctx_) {
        throw std::runtime_error("KTLS: failed create CTX");
    }

    // Enable KTLS.
    SSL_CTX_set_options(ctx_, SSL_OP_ENABLE_KTLS);

    // OpenSSL doesn't yet support TLS_RX on TLS 1.3.
    if (!SSL_CTX_set_min_proto_version(ctx_, TLS1_2_VERSION)) {
        throw std::runtime_error("KTLS: failed to set min version to 1.2");
    }
    if (!SSL_CTX_set_max_proto_version(ctx_, TLS1_2_VERSION)) {
        throw std::runtime_error("KTLS: failed to set max version to 1.2");
    }

    // Load my cert.
    if (SSL_CTX_use_certificate_chain_file(ctx_, cert.c_str()) != 1) {
        throw std::runtime_error("KTLS: failed load cert");
    }

    // Load my key.
    if (SSL_CTX_use_PrivateKey_file(ctx_, priv.c_str(), SSL_FILETYPE_PEM) !=
        1) {
        throw std::runtime_error("KTLS: failed load privkey");
    }
}

TLS::~TLS()
{
    if (ctx_) {
        SSL_CTX_free(ctx_);
    }
}

/*
 https://patchwork.kernel.org/project/linux-crypto/patch/20180320175434.GA23938@davejwatson-mba.local/
*/
int TLS::get_error(int fd)
{
    char buffer[128];
    char cmsgspace[CMSG_SPACE(sizeof(unsigned char))];
    struct msghdr msg {
    };
    msg.msg_control = cmsgspace;
    msg.msg_controllen = sizeof(cmsgspace);

    struct iovec msg_iov;
    msg_iov.iov_base = buffer;
    msg_iov.iov_len = sizeof(buffer);

    msg.msg_iov = &msg_iov;
    msg.msg_iovlen = 1;

    const auto ret = recvmsg(fd, &msg, 0);
    if (-1 == ret) {
        std::cerr << "recvmsg(): " << strerror(errno) << "\n";
        return errno;
    }
    for (struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg); cmsg != nullptr;
         cmsg = CMSG_NXTHDR(&msg, cmsg)) {
        if (cmsg->cmsg_level == SOL_TLS &&
            cmsg->cmsg_type == TLS_GET_RECORD_TYPE) {
            int record_type = *((unsigned char*)CMSG_DATA(cmsg));
            switch (record_type) {
            case 21: // TLS_RECORD_TYPE_ALERT
                return ENOTCONN;
            case 22: // Handshake.
            case 23: // Application data.
            default:
                std::cerr << "Unknown KTLS record type " << record_type << "\n";
            }
        } else {
            std::cerr << "TLS application data??? Should not be\n";
            // Buffer contains application data.
        }
    }
    return 0;
}

std::unique_ptr<TLSConnection> TLS::enable_ktls(int fd)
{
    return std::make_unique<TLSConnection>(ctx_, fd);
}