[thirdparty/openssl.git] / ssl / bio_ssl.c

/*
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <openssl/crypto.h>
#include "internal/bio.h"
#include <openssl/err.h>
#include "ssl_local.h"

static int ssl_write(BIO *h, const char *buf, size_t size, size_t *written);
static int ssl_read(BIO *b, char *buf, size_t size, size_t *readbytes);
static int ssl_puts(BIO *h, const char *str);
static long ssl_ctrl(BIO *h, int cmd, long arg1, void *arg2);
static int ssl_new(BIO *h);
static int ssl_free(BIO *data);
static long ssl_callback_ctrl(BIO *h, int cmd, BIO_info_cb *fp);
typedef struct bio_ssl_st {
    SSL *ssl;                   /* The ssl handle :-) */
    /*
     * Re-negotiate every time the total number of bytes is this size
     * or when timeout expires.
     * There is no proper support for TLS-1.3 or QUIC yet.
     */
    int num_renegotiates;
    unsigned long renegotiate_count;
    size_t byte_count;
    unsigned long renegotiate_timeout;
    unsigned long last_time;
} BIO_SSL;

static const BIO_METHOD methods_sslp = {
    BIO_TYPE_SSL,
    "ssl",
    ssl_write,
    NULL,                       /* ssl_write_old, */
    ssl_read,
    NULL,                       /* ssl_read_old,  */
    ssl_puts,
    NULL,                       /* ssl_gets,      */
    ssl_ctrl,
    ssl_new,
    ssl_free,
    ssl_callback_ctrl,
};

const BIO_METHOD *BIO_f_ssl(void)
{
    return &methods_sslp;
}

static int ssl_new(BIO *bi)
{
    BIO_SSL *bs = OPENSSL_zalloc(sizeof(*bs));

    if (bs == NULL)
        return 0;
    BIO_set_init(bi, 0);
    BIO_set_data(bi, bs);
    /* Clear all flags */
    BIO_clear_flags(bi, ~0);

    return 1;
}

static int ssl_free(BIO *a)
{
    BIO_SSL *bs;

    if (a == NULL)
        return 0;
    bs = BIO_get_data(a);
    if (BIO_get_shutdown(a)) {
        if (bs->ssl != NULL)
            SSL_shutdown(bs->ssl);
        if (BIO_get_init(a))
            SSL_free(bs->ssl);
        BIO_clear_flags(a, ~0); /* Clear all flags */
        BIO_set_init(a, 0);
    }
    OPENSSL_free(bs);
    return 1;
}

static int ssl_read(BIO *b, char *buf, size_t size, size_t *readbytes)
{
    int ret = 1;
    BIO_SSL *sb;
    SSL *ssl;
    int retry_reason = 0;
    int r = 0;

    if (buf == NULL)
        return 0;
    sb = BIO_get_data(b);
    ssl = sb->ssl;

    BIO_clear_retry_flags(b);

    ret = ssl_read_internal(ssl, buf, size, readbytes);

    switch (SSL_get_error(ssl, ret)) {
    case SSL_ERROR_NONE:
        if (sb->renegotiate_count > 0) {
            sb->byte_count += *readbytes;
            if (sb->byte_count > sb->renegotiate_count) {
                sb->byte_count = 0;
                sb->num_renegotiates++;
                SSL_renegotiate(ssl);
                r = 1;
            }
        }
        if ((sb->renegotiate_timeout > 0) && (!r)) {
            unsigned long tm;

            tm = (unsigned long)time(NULL);
            if (tm > sb->last_time + sb->renegotiate_timeout) {
                sb->last_time = tm;
                sb->num_renegotiates++;
                SSL_renegotiate(ssl);
            }
        }

        break;
    case SSL_ERROR_WANT_READ:
        BIO_set_retry_read(b);
        break;
    case SSL_ERROR_WANT_WRITE:
        BIO_set_retry_write(b);
        break;
    case SSL_ERROR_WANT_X509_LOOKUP:
        BIO_set_retry_special(b);
        retry_reason = BIO_RR_SSL_X509_LOOKUP;
        break;
    case SSL_ERROR_WANT_ACCEPT:
        BIO_set_retry_special(b);
        retry_reason = BIO_RR_ACCEPT;
        break;
    case SSL_ERROR_WANT_CONNECT:
        BIO_set_retry_special(b);
        retry_reason = BIO_RR_CONNECT;
        break;
    case SSL_ERROR_SYSCALL:
    case SSL_ERROR_SSL:
    case SSL_ERROR_ZERO_RETURN:
    default:
        break;
    }

    BIO_set_retry_reason(b, retry_reason);

    return ret;
}

static int ssl_write(BIO *b, const char *buf, size_t size, size_t *written)
{
    int ret, r = 0;
    int retry_reason = 0;
    SSL *ssl;
    BIO_SSL *bs;

    if (buf == NULL)
        return 0;
    bs = BIO_get_data(b);
    ssl = bs->ssl;

    BIO_clear_retry_flags(b);

    ret = ssl_write_internal(ssl, buf, size, 0, written);

    switch (SSL_get_error(ssl, ret)) {
    case SSL_ERROR_NONE:
        if (bs->renegotiate_count > 0) {
            bs->byte_count += *written;
            if (bs->byte_count > bs->renegotiate_count) {
                bs->byte_count = 0;
                bs->num_renegotiates++;
                SSL_renegotiate(ssl);
                r = 1;
            }
        }
        if ((bs->renegotiate_timeout > 0) && (!r)) {
            unsigned long tm;

            tm = (unsigned long)time(NULL);
            if (tm > bs->last_time + bs->renegotiate_timeout) {
                bs->last_time = tm;
                bs->num_renegotiates++;
                SSL_renegotiate(ssl);
            }
        }
        break;
    case SSL_ERROR_WANT_WRITE:
        BIO_set_retry_write(b);
        break;
    case SSL_ERROR_WANT_READ:
        BIO_set_retry_read(b);
        break;
    case SSL_ERROR_WANT_X509_LOOKUP:
        BIO_set_retry_special(b);
        retry_reason = BIO_RR_SSL_X509_LOOKUP;
        break;
    case SSL_ERROR_WANT_CONNECT:
        BIO_set_retry_special(b);
        retry_reason = BIO_RR_CONNECT;
    case SSL_ERROR_SYSCALL:
    case SSL_ERROR_SSL:
    default:
        break;
    }

    BIO_set_retry_reason(b, retry_reason);

    return ret;
}

static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
{
    SSL **sslp, *ssl;
    BIO_SSL *bs, *dbs;
    BIO *dbio, *bio;
    long ret = 1;
    BIO *next;
    SSL_CONNECTION *sc = NULL;

    bs = BIO_get_data(b);
    next = BIO_next(b);
    ssl = bs->ssl;
    if (ssl == NULL && cmd != BIO_C_SET_SSL)
        return 0;
    switch (cmd) {
    case BIO_CTRL_RESET:
        /* TODO(QUIC FUTURE): Add support when SSL_clear() is supported */
        if ((sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl)) == NULL)
            return 0;

        SSL_shutdown(ssl);

        if (sc->handshake_func == ssl->method->ssl_connect)
            SSL_set_connect_state(ssl);
        else if (sc->handshake_func == ssl->method->ssl_accept)
            SSL_set_accept_state(ssl);

        if (!SSL_clear(ssl)) {
            ret = 0;
            break;
        }

        if (next != NULL)
            ret = BIO_ctrl(next, cmd, num, ptr);
        else if (sc->rbio != NULL)
            ret = BIO_ctrl(sc->rbio, cmd, num, ptr);
        else
            ret = 1;
        break;
    case BIO_CTRL_INFO:
        ret = 0;
        break;
    case BIO_C_SSL_MODE:
        if (num)                /* client mode */
            SSL_set_connect_state(ssl);
        else
            SSL_set_accept_state(ssl);
        break;
    case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
        ret = bs->renegotiate_timeout;
        if (num < 60)
            num = 5;
        bs->renegotiate_timeout = (unsigned long)num;
        bs->last_time = (unsigned long)time(NULL);
        break;
    case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
        ret = bs->renegotiate_count;
        if ((long)num >= 512)
            bs->renegotiate_count = (unsigned long)num;
        break;
    case BIO_C_GET_SSL_NUM_RENEGOTIATES:
        ret = bs->num_renegotiates;
        break;
    case BIO_C_SET_SSL:
        if (ssl != NULL) {
            ssl_free(b);
            if (!ssl_new(b))
                return 0;
            bs = BIO_get_data(b);
        }
        BIO_set_shutdown(b, num);
        ssl = (SSL *)ptr;
        bs->ssl = ssl;
        bio = SSL_get_rbio(ssl);
        if (bio != NULL) {
            if (next != NULL)
                BIO_push(bio, next);
            BIO_set_next(b, bio);
            BIO_up_ref(bio);
        }
        BIO_set_init(b, 1);
        break;
    case BIO_C_GET_SSL:
        if (ptr != NULL) {
            sslp = (SSL **)ptr;
            *sslp = ssl;
        } else
            ret = 0;
        break;
    case BIO_CTRL_GET_CLOSE:
        ret = BIO_get_shutdown(b);
        break;
    case BIO_CTRL_SET_CLOSE:
        BIO_set_shutdown(b, (int)num);
        break;
    case BIO_CTRL_WPENDING:
        ret = BIO_ctrl(SSL_get_wbio(ssl), cmd, num, ptr);
        break;
    case BIO_CTRL_PENDING:
        ret = SSL_pending(ssl);
        if (ret == 0)
            ret = BIO_pending(SSL_get_rbio(ssl));
        break;
    case BIO_CTRL_FLUSH:
        BIO_clear_retry_flags(b);
        ret = BIO_ctrl(SSL_get_wbio(ssl), cmd, num, ptr);
        BIO_copy_next_retry(b);
        break;
    case BIO_CTRL_PUSH:
        if ((next != NULL) && (next != SSL_get_rbio(ssl))) {
            /*
             * We are going to pass ownership of next to the SSL object...but
             * we don't own a reference to pass yet - so up ref
             */
            BIO_up_ref(next);
            SSL_set_bio(ssl, next, next);
        }
        break;
    case BIO_CTRL_POP:
        /* Only detach if we are the BIO explicitly being popped */
        if (b == ptr) {
            /* This will clear the reference we obtained during push */
            SSL_set_bio(ssl, NULL, NULL);
        }
        break;
    case BIO_C_DO_STATE_MACHINE:
        BIO_clear_retry_flags(b);

        BIO_set_retry_reason(b, 0);
        ret = (int)SSL_do_handshake(ssl);

        switch (SSL_get_error(ssl, (int)ret)) {
        case SSL_ERROR_WANT_READ:
            BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
            break;
        case SSL_ERROR_WANT_WRITE:
            BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
            break;
        case SSL_ERROR_WANT_CONNECT:
            BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);
            BIO_set_retry_reason(b, BIO_get_retry_reason(next));
            break;
        case SSL_ERROR_WANT_X509_LOOKUP:
            BIO_set_retry_special(b);
            BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);
            break;
        default:
            break;
        }
        break;
    case BIO_CTRL_DUP:
        dbio = (BIO *)ptr;
        dbs = BIO_get_data(dbio);
        SSL_free(dbs->ssl);
        dbs->ssl = SSL_dup(ssl);
        dbs->num_renegotiates = bs->num_renegotiates;
        dbs->renegotiate_count = bs->renegotiate_count;
        dbs->byte_count = bs->byte_count;
        dbs->renegotiate_timeout = bs->renegotiate_timeout;
        dbs->last_time = bs->last_time;
        ret = (dbs->ssl != NULL);
        break;
    case BIO_C_GET_FD:
        ret = BIO_ctrl(SSL_get_rbio(ssl), cmd, num, ptr);
        break;
    case BIO_CTRL_SET_CALLBACK:
        ret = 0; /* use callback ctrl */
        break;
    case BIO_CTRL_GET_RPOLL_DESCRIPTOR:
        if (!SSL_get_rpoll_descriptor(ssl, (BIO_POLL_DESCRIPTOR *)ptr))
            ret = 0;
        break;
    case BIO_CTRL_GET_WPOLL_DESCRIPTOR:
        if (!SSL_get_wpoll_descriptor(ssl, (BIO_POLL_DESCRIPTOR *)ptr))
            ret = 0;
        break;
    default:
        ret = BIO_ctrl(SSL_get_rbio(ssl), cmd, num, ptr);
        break;
    }
    return ret;
}

static long ssl_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
{
    SSL *ssl;
    BIO_SSL *bs;
    long ret = 1;

    bs = BIO_get_data(b);
    ssl = bs->ssl;
    switch (cmd) {
    case BIO_CTRL_SET_CALLBACK:
        ret = BIO_callback_ctrl(SSL_get_rbio(ssl), cmd, fp);
        break;
    default:
        ret = 0;
        break;
    }
    return ret;
}

static int ssl_puts(BIO *bp, const char *str)
{
    int n, ret;

    n = strlen(str);
    ret = BIO_write(bp, str, n);
    return ret;
}

BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx)
{
#ifndef OPENSSL_NO_SOCK
    BIO *ret = NULL, *buf = NULL, *ssl = NULL;

# ifndef OPENSSL_NO_QUIC
    if (ctx != NULL && IS_QUIC_CTX(ctx))
        /* Never use buffering for QUIC. */
        return BIO_new_ssl_connect(ctx);
# endif

    if ((buf = BIO_new(BIO_f_buffer())) == NULL)
        return NULL;
    if ((ssl = BIO_new_ssl_connect(ctx)) == NULL)
        goto err;
    if ((ret = BIO_push(buf, ssl)) == NULL)
        goto err;
    return ret;
 err:
    BIO_free(buf);
    BIO_free(ssl);
#endif
    return NULL;
}

BIO *BIO_new_ssl_connect(SSL_CTX *ctx)
{
#ifndef OPENSSL_NO_SOCK
    BIO *ret = NULL, *con = NULL, *ssl = NULL;

    if ((con = BIO_new(BIO_s_connect())) == NULL)
        return NULL;

# ifndef OPENSSL_NO_QUIC
    if (ctx != NULL && IS_QUIC_CTX(ctx))
        if (!BIO_set_sock_type(con, SOCK_DGRAM))
            goto err;
#endif

    if ((ssl = BIO_new_ssl(ctx, 1)) == NULL)
        goto err;
    if ((ret = BIO_push(ssl, con)) == NULL)
        goto err;
    return ret;
 err:
    BIO_free(ssl);
    BIO_free(con);
#endif
    return NULL;
}

BIO *BIO_new_ssl(SSL_CTX *ctx, int client)
{
    BIO *ret;
    SSL *ssl;

    if ((ret = BIO_new(BIO_f_ssl())) == NULL)
        return NULL;
    if ((ssl = SSL_new(ctx)) == NULL) {
        BIO_free(ret);
        return NULL;
    }
    if (client)
        SSL_set_connect_state(ssl);
    else
        SSL_set_accept_state(ssl);

    BIO_set_ssl(ret, ssl, BIO_CLOSE);
    return ret;
}

int BIO_ssl_copy_session_id(BIO *t, BIO *f)
{
    BIO_SSL *tdata, *fdata;
    t = BIO_find_type(t, BIO_TYPE_SSL);
    f = BIO_find_type(f, BIO_TYPE_SSL);
    if ((t == NULL) || (f == NULL))
        return 0;
    tdata = BIO_get_data(t);
    fdata = BIO_get_data(f);
    if ((tdata->ssl == NULL) || (fdata->ssl == NULL))
        return 0;
    if (!SSL_copy_session_id(tdata->ssl, (fdata->ssl)))
        return 0;
    return 1;
}

void BIO_ssl_shutdown(BIO *b)
{
    BIO_SSL *bdata;

    for (; b != NULL; b = BIO_next(b)) {
        if (BIO_method_type(b) != BIO_TYPE_SSL)
            continue;
        bdata = BIO_get_data(b);
        if (bdata != NULL && bdata->ssl != NULL)
            SSL_shutdown(bdata->ssl);
    }
}
Commit	Line	Data
846e33c7	1	/*
b6461792	2	* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6	3	*
2c18d164	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
846e33c7 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
d02b48c6 RE	8	*/
	9
	10	#include <stdio.h>
58964a49	11	#include <stdlib.h>
d02b48c6 RE	12	#include <string.h>
d02b48c6 RE	13	#include <errno.h>
ec577822	14	#include <openssl/crypto.h>
a146ae55	15	#include "internal/bio.h"
ec577822	16	#include <openssl/err.h>
706457b7	17	#include "ssl_local.h"
d02b48c6	18
f42fd819 MC	19	static int ssl_write(BIO h, const char buf, size_t size, size_t *written);
f42fd819 MC	20	static int ssl_read(BIO b, char buf, size_t size, size_t *readbytes);
0e1c0612 UM	21	static int ssl_puts(BIO h, const char str);
0e1c0612 UM	22	static long ssl_ctrl(BIO h, int cmd, long arg1, void arg2);
d02b48c6 RE	23	static int ssl_new(BIO *h);
d02b48c6 RE	24	static int ssl_free(BIO *data);
fce78bd4	25	static long ssl_callback_ctrl(BIO h, int cmd, BIO_info_cb fp);
0f113f3e MC	26	typedef struct bio_ssl_st {
0f113f3e MC	27	SSL ssl; / The ssl handle :-) */
a2ca189e TM	28	/*
	29	* Re-negotiate every time the total number of bytes is this size
	30	* or when timeout expires.
	31	* There is no proper support for TLS-1.3 or QUIC yet.
	32	*/
0f113f3e MC	33	int num_renegotiates;
0f113f3e MC	34	unsigned long renegotiate_count;
8051ab2b	35	size_t byte_count;
0f113f3e MC	36	unsigned long renegotiate_timeout;
	37	unsigned long last_time;
	38	} BIO_SSL;
	39
04f6b0fd	40	static const BIO_METHOD methods_sslp = {
27ab9195 DB	41	BIO_TYPE_SSL,
27ab9195 DB	42	"ssl",
0f113f3e	43	ssl_write,
b4ff6622	44	NULL, /* ssl_write_old, */
0f113f3e	45	ssl_read,
b4ff6622	46	NULL, /* ssl_read_old, */
0f113f3e	47	ssl_puts,
b4ff6622	48	NULL, /* ssl_gets, */
0f113f3e MC	49	ssl_ctrl,
	50	ssl_new,
	51	ssl_free,
	52	ssl_callback_ctrl,
	53	};
a9188d4e	54
04f6b0fd	55	const BIO_METHOD *BIO_f_ssl(void)
0f113f3e	56	{
26a7d938	57	return &methods_sslp;
0f113f3e	58	}
d02b48c6	59
6b691a5c	60	static int ssl_new(BIO *bi)
0f113f3e	61	{
b51bce94	62	BIO_SSL bs = OPENSSL_zalloc(sizeof(bs));
0f113f3e	63
e077455e	64	if (bs == NULL)
26a7d938	65	return 0;
a146ae55 MC	66	BIO_set_init(bi, 0);
	67	BIO_set_data(bi, bs);
	68	/* Clear all flags */
	69	BIO_clear_flags(bi, ~0);
	70
	71	return 1;
0f113f3e	72	}
d02b48c6	73
6b691a5c	74	static int ssl_free(BIO *a)
0f113f3e MC	75	{
	76	BIO_SSL *bs;
	77
	78	if (a == NULL)
26a7d938	79	return 0;
a146ae55	80	bs = BIO_get_data(a);
a146ae55	81	if (BIO_get_shutdown(a)) {
dce910af DDO	82	if (bs->ssl != NULL)
dce910af DDO	83	SSL_shutdown(bs->ssl);
a146ae55	84	if (BIO_get_init(a))
0f113f3e	85	SSL_free(bs->ssl);
dce910af	86	BIO_clear_flags(a, ~0); /* Clear all flags */
a146ae55	87	BIO_set_init(a, 0);
0f113f3e	88	}
a146ae55 MC	89	OPENSSL_free(bs);
a146ae55 MC	90	return 1;
0f113f3e MC	91	}
0f113f3e MC	92
f42fd819	93	static int ssl_read(BIO b, char buf, size_t size, size_t *readbytes)
0f113f3e MC	94	{
	95	int ret = 1;
	96	BIO_SSL *sb;
	97	SSL *ssl;
	98	int retry_reason = 0;
	99	int r = 0;
d02b48c6	100
f42fd819 MC	101	if (buf == NULL)
f42fd819 MC	102	return 0;
a146ae55	103	sb = BIO_get_data(b);
0f113f3e	104	ssl = sb->ssl;
d02b48c6	105
0f113f3e	106	BIO_clear_retry_flags(b);
d02b48c6	107
4ee7d3f9	108	ret = ssl_read_internal(ssl, buf, size, readbytes);
0f113f3e MC	109
	110	switch (SSL_get_error(ssl, ret)) {
	111	case SSL_ERROR_NONE:
0f113f3e	112	if (sb->renegotiate_count > 0) {
ac0edec1	113	sb->byte_count += *readbytes;
0f113f3e MC	114	if (sb->byte_count > sb->renegotiate_count) {
	115	sb->byte_count = 0;
	116	sb->num_renegotiates++;
	117	SSL_renegotiate(ssl);
	118	r = 1;
	119	}
	120	}
	121	if ((sb->renegotiate_timeout > 0) && (!r)) {
	122	unsigned long tm;
	123
	124	tm = (unsigned long)time(NULL);
	125	if (tm > sb->last_time + sb->renegotiate_timeout) {
	126	sb->last_time = tm;
	127	sb->num_renegotiates++;
	128	SSL_renegotiate(ssl);
	129	}
	130	}
	131
	132	break;
	133	case SSL_ERROR_WANT_READ:
	134	BIO_set_retry_read(b);
	135	break;
	136	case SSL_ERROR_WANT_WRITE:
	137	BIO_set_retry_write(b);
	138	break;
	139	case SSL_ERROR_WANT_X509_LOOKUP:
	140	BIO_set_retry_special(b);
	141	retry_reason = BIO_RR_SSL_X509_LOOKUP;
	142	break;
	143	case SSL_ERROR_WANT_ACCEPT:
	144	BIO_set_retry_special(b);
	145	retry_reason = BIO_RR_ACCEPT;
	146	break;
	147	case SSL_ERROR_WANT_CONNECT:
	148	BIO_set_retry_special(b);
	149	retry_reason = BIO_RR_CONNECT;
	150	break;
	151	case SSL_ERROR_SYSCALL:
	152	case SSL_ERROR_SSL:
	153	case SSL_ERROR_ZERO_RETURN:
	154	default:
	155	break;
	156	}
	157
a146ae55	158	BIO_set_retry_reason(b, retry_reason);
d07aee2c	159
3befffa3	160	return ret;
0f113f3e	161	}
d02b48c6	162
f42fd819	163	static int ssl_write(BIO b, const char buf, size_t size, size_t *written)
0f113f3e MC	164	{
	165	int ret, r = 0;
	166	int retry_reason = 0;
	167	SSL *ssl;
	168	BIO_SSL *bs;
	169
f42fd819 MC	170	if (buf == NULL)
f42fd819 MC	171	return 0;
a146ae55	172	bs = BIO_get_data(b);
0f113f3e MC	173	ssl = bs->ssl;
	174
	175	BIO_clear_retry_flags(b);
	176
113be15a	177	ret = ssl_write_internal(ssl, buf, size, 0, written);
0f113f3e MC	178
	179	switch (SSL_get_error(ssl, ret)) {
	180	case SSL_ERROR_NONE:
0f113f3e	181	if (bs->renegotiate_count > 0) {
8051ab2b	182	bs->byte_count += *written;
0f113f3e MC	183	if (bs->byte_count > bs->renegotiate_count) {
	184	bs->byte_count = 0;
	185	bs->num_renegotiates++;
	186	SSL_renegotiate(ssl);
	187	r = 1;
	188	}
	189	}
	190	if ((bs->renegotiate_timeout > 0) && (!r)) {
	191	unsigned long tm;
	192
	193	tm = (unsigned long)time(NULL);
	194	if (tm > bs->last_time + bs->renegotiate_timeout) {
	195	bs->last_time = tm;
	196	bs->num_renegotiates++;
	197	SSL_renegotiate(ssl);
	198	}
	199	}
	200	break;
	201	case SSL_ERROR_WANT_WRITE:
	202	BIO_set_retry_write(b);
	203	break;
	204	case SSL_ERROR_WANT_READ:
	205	BIO_set_retry_read(b);
	206	break;
	207	case SSL_ERROR_WANT_X509_LOOKUP:
	208	BIO_set_retry_special(b);
	209	retry_reason = BIO_RR_SSL_X509_LOOKUP;
	210	break;
	211	case SSL_ERROR_WANT_CONNECT:
	212	BIO_set_retry_special(b);
	213	retry_reason = BIO_RR_CONNECT;
	214	case SSL_ERROR_SYSCALL:
	215	case SSL_ERROR_SSL:
	216	default:
	217	break;
	218	}
	219
a146ae55	220	BIO_set_retry_reason(b, retry_reason);
3befffa3	221
a146ae55	222	return ret;
0f113f3e	223	}
d02b48c6	224
0e1c0612	225	static long ssl_ctrl(BIO b, int cmd, long num, void ptr)
0f113f3e MC	226	{
0f113f3e MC	227	SSL *sslp, ssl;
a146ae55	228	BIO_SSL bs, dbs;
0f113f3e MC	229	BIO dbio, bio;
0f113f3e MC	230	long ret = 1;
a146ae55	231	BIO *next;
38b051a1	232	SSL_CONNECTION *sc = NULL;
0f113f3e	233
a146ae55 MC	234	bs = BIO_get_data(b);
a146ae55 MC	235	next = BIO_next(b);
0f113f3e	236	ssl = bs->ssl;
a2ca189e	237	if (ssl == NULL && cmd != BIO_C_SET_SSL)
26a7d938	238	return 0;
0f113f3e MC	239	switch (cmd) {
0f113f3e MC	240	case BIO_CTRL_RESET:
a2ca189e TM	241	/* TODO(QUIC FUTURE): Add support when SSL_clear() is supported */
	242	if ((sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl)) == NULL)
	243	return 0;
	244
0f113f3e MC	245	SSL_shutdown(ssl);
0f113f3e MC	246
38b051a1	247	if (sc->handshake_func == ssl->method->ssl_connect)
0f113f3e	248	SSL_set_connect_state(ssl);
38b051a1	249	else if (sc->handshake_func == ssl->method->ssl_accept)
0f113f3e MC	250	SSL_set_accept_state(ssl);
0f113f3e MC	251
61986d32	252	if (!SSL_clear(ssl)) {
69f68237 MC	253	ret = 0;
	254	break;
	255	}
0f113f3e	256
a146ae55 MC	257	if (next != NULL)
a146ae55 MC	258	ret = BIO_ctrl(next, cmd, num, ptr);
38b051a1 TM	259	else if (sc->rbio != NULL)
38b051a1 TM	260	ret = BIO_ctrl(sc->rbio, cmd, num, ptr);
0f113f3e MC	261	else
	262	ret = 1;
	263	break;
	264	case BIO_CTRL_INFO:
	265	ret = 0;
	266	break;
	267	case BIO_C_SSL_MODE:
	268	if (num) /* client mode */
	269	SSL_set_connect_state(ssl);
	270	else
	271	SSL_set_accept_state(ssl);
	272	break;
	273	case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
	274	ret = bs->renegotiate_timeout;
	275	if (num < 60)
	276	num = 5;
	277	bs->renegotiate_timeout = (unsigned long)num;
	278	bs->last_time = (unsigned long)time(NULL);
	279	break;
	280	case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
	281	ret = bs->renegotiate_count;
	282	if ((long)num >= 512)
	283	bs->renegotiate_count = (unsigned long)num;
	284	break;
	285	case BIO_C_GET_SSL_NUM_RENEGOTIATES:
	286	ret = bs->num_renegotiates;
	287	break;
	288	case BIO_C_SET_SSL:
	289	if (ssl != NULL) {
	290	ssl_free(b);
	291	if (!ssl_new(b))
	292	return 0;
73d6b4ef	293	bs = BIO_get_data(b);
0f113f3e	294	}
a146ae55	295	BIO_set_shutdown(b, num);
0f113f3e	296	ssl = (SSL *)ptr;
a146ae55	297	bs->ssl = ssl;
0f113f3e MC	298	bio = SSL_get_rbio(ssl);
0f113f3e MC	299	if (bio != NULL) {
a146ae55 MC	300	if (next != NULL)
	301	BIO_push(bio, next);
	302	BIO_set_next(b, bio);
fb46be03	303	BIO_up_ref(bio);
0f113f3e	304	}
a146ae55	305	BIO_set_init(b, 1);
0f113f3e MC	306	break;
	307	case BIO_C_GET_SSL:
	308	if (ptr != NULL) {
	309	sslp = (SSL **)ptr;
	310	*sslp = ssl;
	311	} else
	312	ret = 0;
	313	break;
	314	case BIO_CTRL_GET_CLOSE:
a146ae55	315	ret = BIO_get_shutdown(b);
0f113f3e MC	316	break;
0f113f3e MC	317	case BIO_CTRL_SET_CLOSE:
a146ae55	318	BIO_set_shutdown(b, (int)num);
0f113f3e MC	319	break;
0f113f3e MC	320	case BIO_CTRL_WPENDING:
a2ca189e	321	ret = BIO_ctrl(SSL_get_wbio(ssl), cmd, num, ptr);
0f113f3e MC	322	break;
	323	case BIO_CTRL_PENDING:
	324	ret = SSL_pending(ssl);
	325	if (ret == 0)
a2ca189e	326	ret = BIO_pending(SSL_get_rbio(ssl));
0f113f3e MC	327	break;
	328	case BIO_CTRL_FLUSH:
	329	BIO_clear_retry_flags(b);
a2ca189e	330	ret = BIO_ctrl(SSL_get_wbio(ssl), cmd, num, ptr);
0f113f3e MC	331	BIO_copy_next_retry(b);
	332	break;
	333	case BIO_CTRL_PUSH:
a2ca189e	334	if ((next != NULL) && (next != SSL_get_rbio(ssl))) {
eddef305 MC	335	/*
	336	* We are going to pass ownership of next to the SSL object...but
	337	* we don't own a reference to pass yet - so up ref
	338	*/
	339	BIO_up_ref(next);
a146ae55	340	SSL_set_bio(ssl, next, next);
0f113f3e MC	341	}
	342	break;
	343	case BIO_CTRL_POP:
	344	/* Only detach if we are the BIO explicitly being popped */
	345	if (b == ptr) {
b46fe860 MC	346	/* This will clear the reference we obtained during push */
b46fe860 MC	347	SSL_set_bio(ssl, NULL, NULL);
0f113f3e MC	348	}
	349	break;
	350	case BIO_C_DO_STATE_MACHINE:
	351	BIO_clear_retry_flags(b);
	352
a146ae55	353	BIO_set_retry_reason(b, 0);
0f113f3e MC	354	ret = (int)SSL_do_handshake(ssl);
	355
	356	switch (SSL_get_error(ssl, (int)ret)) {
	357	case SSL_ERROR_WANT_READ:
	358	BIO_set_flags(b, BIO_FLAGS_READ \| BIO_FLAGS_SHOULD_RETRY);
	359	break;
	360	case SSL_ERROR_WANT_WRITE:
	361	BIO_set_flags(b, BIO_FLAGS_WRITE \| BIO_FLAGS_SHOULD_RETRY);
	362	break;
	363	case SSL_ERROR_WANT_CONNECT:
	364	BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL \| BIO_FLAGS_SHOULD_RETRY);
a146ae55	365	BIO_set_retry_reason(b, BIO_get_retry_reason(next));
0f113f3e	366	break;
f1c412c9 DSH	367	case SSL_ERROR_WANT_X509_LOOKUP:
f1c412c9 DSH	368	BIO_set_retry_special(b);
a146ae55	369	BIO_set_retry_reason(b, BIO_RR_SSL_X509_LOOKUP);
f1c412c9	370	break;
0f113f3e MC	371	default:
	372	break;
	373	}
	374	break;
	375	case BIO_CTRL_DUP:
	376	dbio = (BIO *)ptr;
a146ae55 MC	377	dbs = BIO_get_data(dbio);
	378	SSL_free(dbs->ssl);
	379	dbs->ssl = SSL_dup(ssl);
dbd5c34f MC	380	dbs->num_renegotiates = bs->num_renegotiates;
	381	dbs->renegotiate_count = bs->renegotiate_count;
	382	dbs->byte_count = bs->byte_count;
	383	dbs->renegotiate_timeout = bs->renegotiate_timeout;
	384	dbs->last_time = bs->last_time;
a146ae55	385	ret = (dbs->ssl != NULL);
0f113f3e MC	386	break;
0f113f3e MC	387	case BIO_C_GET_FD:
a2ca189e	388	ret = BIO_ctrl(SSL_get_rbio(ssl), cmd, num, ptr);
0f113f3e MC	389	break;
0f113f3e MC	390	case BIO_CTRL_SET_CALLBACK:
2722ff50	391	ret = 0; /* use callback ctrl */
0f113f3e	392	break;
68801bcb HL	393	case BIO_CTRL_GET_RPOLL_DESCRIPTOR:
	394	if (!SSL_get_rpoll_descriptor(ssl, (BIO_POLL_DESCRIPTOR *)ptr))
	395	ret = 0;
	396	break;
	397	case BIO_CTRL_GET_WPOLL_DESCRIPTOR:
	398	if (!SSL_get_wpoll_descriptor(ssl, (BIO_POLL_DESCRIPTOR *)ptr))
	399	ret = 0;
	400	break;
0f113f3e	401	default:
a2ca189e	402	ret = BIO_ctrl(SSL_get_rbio(ssl), cmd, num, ptr);
0f113f3e MC	403	break;
0f113f3e MC	404	}
26a7d938	405	return ret;
0f113f3e	406	}
d02b48c6	407
fce78bd4	408	static long ssl_callback_ctrl(BIO b, int cmd, BIO_info_cb fp)
0f113f3e MC	409	{
	410	SSL *ssl;
	411	BIO_SSL *bs;
	412	long ret = 1;
	413
a146ae55	414	bs = BIO_get_data(b);
0f113f3e MC	415	ssl = bs->ssl;
	416	switch (cmd) {
	417	case BIO_CTRL_SET_CALLBACK:
38b051a1	418	ret = BIO_callback_ctrl(SSL_get_rbio(ssl), cmd, fp);
0f113f3e MC	419	break;
0f113f3e MC	420	default:
fce78bd4	421	ret = 0;
0f113f3e MC	422	break;
0f113f3e MC	423	}
26a7d938	424	return ret;
0f113f3e	425	}
d3442bc7	426
0e1c0612	427	static int ssl_puts(BIO bp, const char str)
0f113f3e MC	428	{
0f113f3e MC	429	int n, ret;
d02b48c6	430
0f113f3e MC	431	n = strlen(str);
0f113f3e MC	432	ret = BIO_write(bp, str, n);
26a7d938	433	return ret;
0f113f3e	434	}
d02b48c6	435
6b691a5c	436	BIO BIO_new_buffer_ssl_connect(SSL_CTX ctx)
0f113f3e	437	{
85d686e7	438	#ifndef OPENSSL_NO_SOCK
0f113f3e MC	439	BIO ret = NULL, buf = NULL, *ssl = NULL;
0f113f3e MC	440
573f16c9 HL	441	# ifndef OPENSSL_NO_QUIC
	442	if (ctx != NULL && IS_QUIC_CTX(ctx))
	443	/* Never use buffering for QUIC. */
	444	return BIO_new_ssl_connect(ctx);
	445	# endif
	446
0f113f3e	447	if ((buf = BIO_new(BIO_f_buffer())) == NULL)
26a7d938	448	return NULL;
0f113f3e MC	449	if ((ssl = BIO_new_ssl_connect(ctx)) == NULL)
	450	goto err;
	451	if ((ret = BIO_push(buf, ssl)) == NULL)
	452	goto err;
26a7d938	453	return ret;
0f113f3e	454	err:
ca3a82c3 RS	455	BIO_free(buf);
ca3a82c3 RS	456	BIO_free(ssl);
85d686e7	457	#endif
26a7d938	458	return NULL;
0f113f3e	459	}
58964a49	460
6b691a5c	461	BIO BIO_new_ssl_connect(SSL_CTX ctx)
0f113f3e	462	{
4a1fbd13	463	#ifndef OPENSSL_NO_SOCK
0f113f3e MC	464	BIO ret = NULL, con = NULL, *ssl = NULL;
	465
	466	if ((con = BIO_new(BIO_s_connect())) == NULL)
26a7d938	467	return NULL;
573f16c9 HL	468
	469	# ifndef OPENSSL_NO_QUIC
	470	if (ctx != NULL && IS_QUIC_CTX(ctx))
	471	if (!BIO_set_sock_type(con, SOCK_DGRAM))
	472	goto err;
	473	#endif
	474
0f113f3e MC	475	if ((ssl = BIO_new_ssl(ctx, 1)) == NULL)
	476	goto err;
	477	if ((ret = BIO_push(ssl, con)) == NULL)
	478	goto err;
26a7d938	479	return ret;
0f113f3e	480	err:
7947a1eb	481	BIO_free(ssl);
ca3a82c3	482	BIO_free(con);
4a1fbd13	483	#endif
26a7d938	484	return NULL;
0f113f3e	485	}
58964a49	486
6b691a5c	487	BIO BIO_new_ssl(SSL_CTX ctx, int client)
0f113f3e MC	488	{
	489	BIO *ret;
	490	SSL *ssl;
	491
	492	if ((ret = BIO_new(BIO_f_ssl())) == NULL)
26a7d938	493	return NULL;
0f113f3e MC	494	if ((ssl = SSL_new(ctx)) == NULL) {
0f113f3e MC	495	BIO_free(ret);
26a7d938	496	return NULL;
0f113f3e MC	497	}
	498	if (client)
	499	SSL_set_connect_state(ssl);
	500	else
	501	SSL_set_accept_state(ssl);
	502
	503	BIO_set_ssl(ret, ssl, BIO_CLOSE);
26a7d938	504	return ret;
0f113f3e	505	}
d02b48c6	506
6b691a5c	507	int BIO_ssl_copy_session_id(BIO t, BIO f)
0f113f3e	508	{
a146ae55	509	BIO_SSL tdata, fdata;
0f113f3e MC	510	t = BIO_find_type(t, BIO_TYPE_SSL);
	511	f = BIO_find_type(f, BIO_TYPE_SSL);
	512	if ((t == NULL) \|\| (f == NULL))
a146ae55 MC	513	return 0;
	514	tdata = BIO_get_data(t);
	515	fdata = BIO_get_data(f);
	516	if ((tdata->ssl == NULL) \|\| (fdata->ssl == NULL))
26a7d938	517	return 0;
a146ae55	518	if (!SSL_copy_session_id(tdata->ssl, (fdata->ssl)))
17dd65e6	519	return 0;
208fb891	520	return 1;
0f113f3e	521	}
d02b48c6	522
6b691a5c	523	void BIO_ssl_shutdown(BIO *b)
0f113f3e	524	{
9015d34e RS	525	BIO_SSL *bdata;
	526
	527	for (; b != NULL; b = BIO_next(b)) {
	528	if (BIO_method_type(b) != BIO_TYPE_SSL)
	529	continue;
	530	bdata = BIO_get_data(b);
	531	if (bdata != NULL && bdata->ssl != NULL)
	532	SSL_shutdown(bdata->ssl);
	533	}
0f113f3e	534	}