You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

337 lines
8.0 KiB

var util = require('util');
var events = require('events');
var stream = require('stream');
var assert = process.assert;
var debugLevel = parseInt(process.env.NODE_DEBUG, 16);
function debug () {
if (debugLevel & 0x2) {
util.error.apply(this, arguments);
}
}
/* Lazy Loaded crypto object */
var SecureStream = null;
/**
* Provides a pair of streams to do encrypted communication.
*/
14 years ago
function SecurePair(credentials, isServer) {
if (!(this instanceof SecurePair)) {
14 years ago
return new SecurePair(credentials, isServer);
}
var self = this;
try {
SecureStream = process.binding('crypto').SecureStream;
}
catch (e) {
throw new Error('node.js not compiled with openssl crypto support.');
}
events.EventEmitter.call(this);
this._secureEstablished = false;
14 years ago
this._isServer = isServer ? true : false;
this._encWriteState = true;
this._clearWriteState = true;
this._done = false;
var crypto = require("crypto");
if (!credentials) {
this.credentials = crypto.createCredentials();
14 years ago
} else {
this.credentials = credentials;
}
14 years ago
if (!this._isServer) {
/* For clients, we will always have either a given ca list or be using default one */
this.credentials.shouldVerify = true;
}
this._secureEstablished = false;
14 years ago
this._encInPending = [];
this._clearInPending = [];
this._ssl = new SecureStream(this.credentials.context,
14 years ago
this._isServer ? true : false,
this.credentials.shouldVerify);
/* Acts as a r/w stream to the cleartext side of the stream. */
this.cleartext = new stream.Stream();
this.cleartext.readable = true;
/* Acts as a r/w stream to the encrypted side of the stream. */
this.encrypted = new stream.Stream();
this.encrypted.readable = true;
this.cleartext.write = function(data) {
debug('clearIn data');
14 years ago
self._clearInPending.push(data);
self._cycle();
14 years ago
return self._cleartextWriteState;
};
this.cleartext.pause = function() {
debug('paused cleartext');
14 years ago
self._cleartextWriteState = false;
};
this.cleartext.resume = function() {
debug('resumed cleartext');
14 years ago
self._cleartextWriteState = true;
};
this.cleartext.end = function(err) {
debug('cleartext end');
if (!self._done) {
self._ssl.shutdown();
self._cycle();
}
self._destroy(err);
};
this.encrypted.write = function(data) {
debug('encIn data');
14 years ago
self._encInPending.push(data);
self._cycle();
14 years ago
return self._encryptedWriteState;
};
this.encrypted.pause = function() {
debug('pause encrypted');
14 years ago
self._encryptedWriteState = false;
};
this.encrypted.resume = function() {
debug('resume encrypted');
14 years ago
self._encryptedWriteState = true;
};
this.encrypted.end = function(err) {
debug('encrypted end');
if (!self._done) {
self._ssl.shutdown();
self._cycle();
}
self._destroy(err);
};
this.cleartext.on('end', function(err) {
debug('clearIn end');
if (!self._done) {
self._ssl.shutdown();
self._cycle();
}
self._destroy(err);
});
this.cleartext.on('close', function() {
debug('source close');
self.emit('close');
self._destroy();
});
this.encrypted.on('end', function() {
if (!self._done) {
self._error(new Error('Encrypted stream ended before secure pair was done'));
}
});
this.encrypted.on('close', function() {
if (!self._done) {
self._error(new Error('Encrypted stream closed before secure pair was done'));
}
});
this.cleartext.on('drain', function() {
debug('source drain');
self._cycle();
self.encrypted.resume();
});
this.encrypted.on('drain', function() {
debug('target drain');
self._cycle();
self.cleartext.resume();
});
process.nextTick(function() {
self._ssl.start();
self._cycle();
});
}
util.inherits(SecurePair, events.EventEmitter);
14 years ago
exports.createSecurePair = function(credentials, isServer) {
var pair = new SecurePair(credentials, isServer);
return pair;
};
/**
* Attempt to cycle OpenSSLs buffers in various directions.
*
* An SSL Connection can be viewed as four separate piplines,
* interacting with one has no connection to the behavoir of
* any of the other 3 -- This might not sound reasonable,
14 years ago
* but consider things like mid-stream renegotiation of
* the ciphers.
*
* The four pipelines, using terminology of the client (server is just reversed):
* 1) Encrypted Output stream (Writing encrypted data to peer)
* 2) Encrypted Input stream (Reading encrypted data from peer)
* 3) Cleartext Output stream (Decrypted content from the peer)
* 4) Cleartext Input stream (Cleartext content to send to the peer)
*
* This function attempts to pull any available data out of the Cleartext
* input stream (#4), and the Encrypted input stream (#2). Then it pushes
* any data available from the cleartext output stream (#3), and finally
* from the Encrypted output stream (#1)
*
* It is called whenever we do something with OpenSSL -- post reciving content,
* trying to flush, trying to change ciphers, or shutting down the connection.
*
* Because it is also called everywhere, we also check if the connection
14 years ago
* has completed negotiation and emit 'secure' from here if it has.
*/
SecurePair.prototype._cycle = function() {
if (this._done) {
return;
}
var self = this;
var rv;
var tmp;
var bytesRead;
var bytesWritten;
var chunkBytes;
var chunk = null;
var pool = null;
14 years ago
while (this._encInPending.length > 0) {
tmp = this._encInPending.shift();
try {
debug('writng from encIn');
rv = this._ssl.encIn(tmp, 0, tmp.length);
} catch (e) {
return this._error(e);
}
if (rv === 0) {
14 years ago
this._encInPending.unshift(tmp);
break;
}
assert(rv === tmp.length);
}
14 years ago
while (this._clearInPending.length > 0) {
tmp = this._clearInPending.shift();
try {
debug('writng from clearIn');
rv = this._ssl.clearIn(tmp, 0, tmp.length);
} catch (e) {
return this._error(e);
}
if (rv === 0) {
14 years ago
this._clearInPending.unshift(tmp);
break;
}
assert(rv === tmp.length);
}
function mover(reader, writer, checker) {
var bytesRead;
var pool;
var chunkBytes;
do {
bytesRead = 0;
chunkBytes = 0;
pool = new Buffer(4096);
pool.used = 0;
do {
try {
chunkBytes = reader(pool,
pool.used + bytesRead,
pool.length - pool.used - bytesRead)
} catch (e) {
return self._error(e);
}
if (chunkBytes >= 0) {
bytesRead += chunkBytes;
}
} while ((chunkBytes > 0) && (pool.used + bytesRead < pool.length));
if (bytesRead > 0) {
chunk = pool.slice(0, bytesRead);
writer(chunk);
}
14 years ago
} while (checker(bytesRead));
}
mover(
function(pool, offset, length) {
debug('reading from clearOut');
return self._ssl.clearOut(pool, offset, length);
},
function(chunk) {
14 years ago
self.cleartext.emit('data', chunk);
},
function(bytesRead) {
14 years ago
return bytesRead > 0 && self._cleartextWriteState === true;
});
mover(
function(pool, offset, length) {
debug('reading from encOut');
return self._ssl.encOut(pool, offset, length);
},
function(chunk) {
self.encrypted.emit('data', chunk);
},
function(bytesRead) {
14 years ago
return bytesRead > 0 && self._encryptedWriteState === true;
});
if (!this._secureEstablished && this._ssl.isInitFinished()) {
this._secureEstablished = true;
debug('secure established');
this.emit('secure');
this._cycle();
}
};
SecurePair.prototype._destroy = function(err)
{
if (!this._done) {
this._done = true;
this._ssl.close();
delete this._ssl;
this.emit('end', err);
}
};
SecurePair.prototype._error = function (err)
{
this.emit('error', err);
};
SecurePair.prototype.getPeerCertificate = function (err)
{
return this._ssl.getPeerCertificate();
};
SecurePair.prototype.getCipher = function (err)
{
return this._ssl.getCurrentCipher();
};