sslexample

sslserver.c (6648B)

---

 #include "common.h"
 
 struct ssl_remote_client {
 	struct connection conn;
 };
 
 int
 do_recv(struct io_uring *uring, struct connection *conn, int res);
 
 int
 do_tls_connect(struct io_uring *uring, struct connection *conn, int res)
 {
 	DBGLOG("[conn:%d] completed tls handshake\n", conn->socket);
 
 	return do_recv(uring, conn, res);
 }
 
 int
 do_recv(struct io_uring *uring, struct connection *conn, int res)
 {
 	DBGLOG("[conn:%d] received %d encrypted bytes\n", conn->socket, res);
 
 	conn->len = SSL_read(conn->ssl, conn->buf, conn->cap);
 
 	DBGLOG("[conn:%d] received %zu plaintext bytes\n", conn->socket, conn->len);
 
 	conn->cur = SSL_write(conn->ssl, conn->buf, conn->len);;
 
 	DBGLOG("[conn:%d] sending %zu plaintext bytes\n", conn->socket, conn->cur);
 
 	return conn_prep_send(conn, uring);
 }
 
 int
 do_send(struct io_uring *uring, struct connection *conn, int res)
 {
 	if (conn->cur < conn->len) { /* have not sent entire message */
 		conn->cur += SSL_write(conn->ssl, conn->buf + conn->cur, conn->len - conn->cur);
 		return conn_prep_send(conn, uring);
 	} else { /* sent entire message */
 		return conn_prep_recv(conn, uring);
 	}
 }
 
 struct ssl_server {
 	int socket;
 
 	struct io_uring io_uring;
 
 	SSL_CTX *ssl_ctx;
 };
 
 int
 handle_client(struct ssl_server *server, int fd)
 {
 	struct ssl_remote_client *client = malloc(sizeof *client);
 	assert(client);
 
 	SSL *ssl = SSL_new(server->ssl_ctx);
 	assert(ssl);
 
 	SSL_set_accept_state(ssl);
 
 	size_t cap = 4096;
 	void *buf = malloc(cap);
 	assert(buf);
 
 	conn_init(&client->conn, fd, ssl, buf, cap);
 
 	return conn_do_tls_handshake(&client->conn, &server->io_uring, 0);
 }
 
 void
 free_client(struct ssl_server *server, struct connection *conn)
 {
 	conn_free(conn);
 
 	struct ssl_remote_client *client =
 		TO_PARENT_PTR(conn, struct ssl_remote_client, conn);
 
 	free(client->conn.buf);
 	free(client);
 }
 
 int
 serve(struct ssl_server *server)
 {
 	struct sockaddr_storage client_addr;
 	socklen_t client_addrlen = sizeof client_addr;
 
 	struct ioreq accept_ioreq;
 	accept_ioreq.type = IOREQ_ACCEPT;
 	accept_ioreq.tag.accept.fd = server->socket;
 	accept_ioreq.tag.accept.addr = (struct sockaddr *) &client_addr;
 	accept_ioreq.tag.accept.addrlen = &client_addrlen;
 	accept_ioreq.tag.accept.flags = 0;
 
 	queue_ioreqs(&server->io_uring, &accept_ioreq, 1);
 
 	while (1) {
 		io_uring_submit_and_wait(&server->io_uring, 1);
 
 		struct io_uring_cqe *cqe;
 		unsigned head, seen_cqes = 0;
 		io_uring_for_each_cqe(&server->io_uring, head, cqe) {
 			struct ioreq *ioreq = io_uring_cqe_get_data(cqe);
 			assert(ioreq);
 
 			switch (ioreq->type) {
 			case IOREQ_ACCEPT: {
 				if (cqe->res < 0) {
 					queue_ioreqs(&server->io_uring,
 						     &accept_ioreq, 1);
 					goto next_cqe;
 				}
 
 				char host[NI_MAXHOST], serv[NI_MAXSERV];
 				getnameinfo(ioreq->tag.accept.addr,
 					    *ioreq->tag.accept.addrlen,
 					    host, sizeof host,
 					    serv, sizeof serv,
 					    NI_NUMERICSERV);
 
 				printf("Accepted client %d from %s:%s\n",
 						cqe->res, host, serv);
 
 				client_addrlen = sizeof client_addr;
 				queue_ioreqs(&server->io_uring, &accept_ioreq, 1);
 
 				handle_client(server, cqe->res);
 			} break;
 
 			case IOREQ_RECV: {
 				struct connection *conn =
 					TO_PARENT_PTR(ioreq, struct connection, ioreq);
 
 				if (cqe->res <= 0) {
 					conn_prep_close(conn, &server->io_uring);
 					goto next_cqe;
 				}
 
 				conn_finish_recv(conn, cqe->res);
 
 				if (!SSL_is_init_finished(conn->ssl)) {
 					conn_do_tls_handshake(conn, &server->io_uring, cqe->res);
 				} else {
 					do_recv(&server->io_uring, conn, cqe->res);
 				}
 			} break;
 
 			case IOREQ_SEND: {
 				struct connection *conn =
 					TO_PARENT_PTR(ioreq, struct connection, ioreq);
 
 				if (cqe->res <= 0) {
 					conn_prep_close(conn, &server->io_uring);
 					goto next_cqe;
 				}
 
 				conn_finish_send(conn, cqe->res);
 
 				if (!SSL_is_init_finished(conn->ssl)) {
 					conn_do_tls_handshake(conn, &server->io_uring, cqe->res);
 				} else {
 					do_send(&server->io_uring, conn, cqe->res);
 				}
 			} break;
 
 			case IOREQ_CLOSE: {
 				struct connection *conn =
 					TO_PARENT_PTR(ioreq, struct connection, ioreq);
 
 				printf("Closing client %d\n", conn->socket);
 
 				free_client(server, conn);
 			} break;
 
 			default:
 				break;
 			}
 
 next_cqe:
 			seen_cqes++;
 		}
 
 		io_uring_cq_advance(&server->io_uring, seen_cqes);
 	}
 
 	return EXIT_SUCCESS;
 }
 
 int
 main(int argc, char **argv)
 {
 	if (argc < 5) {
 		fprintf(stderr, "Usage: %s <host> <port> <cert> <key>\n", argv[0]);
 		exit(EXIT_FAILURE);
 	}
 
 	char *host = argv[1], *port = argv[2], *cert = argv[3], *key = argv[4];
 
 	struct ssl_server server;
 	memset(&server, 0, sizeof server);
 
 	// create server socket
 	// ===================================================================
 	//
 
 	struct addrinfo hints = {
 		.ai_family = AF_UNSPEC,
 		.ai_socktype = SOCK_STREAM,
 		.ai_protocol = IPPROTO_TCP,
 		.ai_flags = AI_NUMERICSERV,
 	}, *addrinfo, *ptr;
 
 	int res;
 	if ((res = getaddrinfo(host, port, &hints, &addrinfo))) {
 		fprintf(stderr, "Failed to get address info: %s\n",
 				gai_strerror(res));
 		exit(EXIT_FAILURE);
 	}
 
 	for (ptr = addrinfo; ptr; ptr = ptr->ai_next) {
 		server.socket = socket(ptr->ai_family,
 				       ptr->ai_socktype,
 				       ptr->ai_protocol);
 
 		if (server.socket < 0)
 			continue;
 
 		if (bind(server.socket, ptr->ai_addr, ptr->ai_addrlen) < 0) {
 			close(server.socket);
 			continue;
 		}
 
 		listen(server.socket, 32);
 
 		break;
 	}
 
 	if (ptr) {
 		char host[NI_MAXHOST], serv[NI_MAXSERV];
 		getnameinfo(ptr->ai_addr, ptr->ai_addrlen,
 			    host, sizeof host, serv, sizeof serv,
 			    NI_NUMERICSERV);
 		printf("Bound to %s:%s\n", host, serv);
 	}
 
 	freeaddrinfo(addrinfo);
 
 	if (!ptr) {
 		fprintf(stderr, "Failed to bind to %s:%s\n", host, port);
 		exit(EXIT_FAILURE);
 	}
 
 	setsockopt(server.socket, SOL_SOCKET, SO_REUSEADDR, &(int){1}, sizeof(int));
 
 	// create uring
 	// ===================================================================
 	//
 
 	unsigned entries = 32, flags = 0;
 	io_uring_queue_init(entries, &server.io_uring, flags);
 
 	// setup global ssl context
 	// ===================================================================
 	//
 
 	server.ssl_ctx = SSL_CTX_new(TLS_method());
 	assert(server.ssl_ctx);
 
 	SSL_CTX_set_min_proto_version(server.ssl_ctx, TLS1_2_VERSION);
 	SSL_CTX_use_certificate_file(server.ssl_ctx, cert, SSL_FILETYPE_PEM);
 	SSL_CTX_use_PrivateKey_file(server.ssl_ctx, key, SSL_FILETYPE_PEM);
 
 	if (SSL_CTX_check_private_key(server.ssl_ctx) != 1) {
 		fprintf(stderr, "Invalid certificate and private key pair given\n");
 		exit(EXIT_FAILURE);
 	}
 
 	// start server
 	// ===================================================================
 	//
 
 	exit(serve(&server));
 }