|
@ -18,10 +18,9 @@ var SecureStream = null; |
|
|
* Provides a pair of streams to do encrypted communication. |
|
|
* Provides a pair of streams to do encrypted communication. |
|
|
*/ |
|
|
*/ |
|
|
|
|
|
|
|
|
function SecurePair(credentials, is_server) |
|
|
function SecurePair(credentials, isServer) { |
|
|
{ |
|
|
|
|
|
if (!(this instanceof SecurePair)) { |
|
|
if (!(this instanceof SecurePair)) { |
|
|
return new SecurePair(credentials, is_server); |
|
|
return new SecurePair(credentials, isServer); |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
var self = this; |
|
|
var self = this; |
|
@ -36,9 +35,9 @@ function SecurePair(credentials, is_server) |
|
|
events.EventEmitter.call(this); |
|
|
events.EventEmitter.call(this); |
|
|
|
|
|
|
|
|
this._secureEstablished = false; |
|
|
this._secureEstablished = false; |
|
|
this._is_server = is_server ? true : false; |
|
|
this._isServer = isServer ? true : false; |
|
|
this._enc_write_state = true; |
|
|
this._encWriteState = true; |
|
|
this._clear_write_state = true; |
|
|
this._clearWriteState = true; |
|
|
this._done = false; |
|
|
this._done = false; |
|
|
|
|
|
|
|
|
var crypto = require("crypto"); |
|
|
var crypto = require("crypto"); |
|
@ -49,17 +48,17 @@ function SecurePair(credentials, is_server) |
|
|
this.credentials = credentials; |
|
|
this.credentials = credentials; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
if (!this._is_server) { |
|
|
if (!this._isServer) { |
|
|
/* For clients, we will always have either a given ca list or be using default one */ |
|
|
/* For clients, we will always have either a given ca list or be using default one */ |
|
|
this.credentials.shouldVerify = true; |
|
|
this.credentials.shouldVerify = true; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
this._secureEstablished = false; |
|
|
this._secureEstablished = false; |
|
|
this._encIn_pending = []; |
|
|
this._encInPending = []; |
|
|
this._clearIn_pending = []; |
|
|
this._clearInPending = []; |
|
|
|
|
|
|
|
|
this._ssl = new SecureStream(this.credentials.context, |
|
|
this._ssl = new SecureStream(this.credentials.context, |
|
|
this._is_server ? true : false, |
|
|
this._isServer ? true : false, |
|
|
this.credentials.shouldVerify); |
|
|
this.credentials.shouldVerify); |
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -72,19 +71,19 @@ function SecurePair(credentials, is_server) |
|
|
|
|
|
|
|
|
this.cleartext.write = function(data) { |
|
|
this.cleartext.write = function(data) { |
|
|
debug('clearIn data'); |
|
|
debug('clearIn data'); |
|
|
self._clearIn_pending.push(data); |
|
|
self._clearInPending.push(data); |
|
|
self._cycle(); |
|
|
self._cycle(); |
|
|
return self._cleartext_write_state; |
|
|
return self._cleartextWriteState; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
|
this.cleartext.pause = function() { |
|
|
this.cleartext.pause = function() { |
|
|
debug('paused cleartext'); |
|
|
debug('paused cleartext'); |
|
|
self._cleartext_write_state = false; |
|
|
self._cleartextWriteState = false; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
|
this.cleartext.resume = function() { |
|
|
this.cleartext.resume = function() { |
|
|
debug('resumed cleartext'); |
|
|
debug('resumed cleartext'); |
|
|
self._cleartext_write_state = true; |
|
|
self._cleartextWriteState = true; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
|
this.cleartext.end = function(err) { |
|
|
this.cleartext.end = function(err) { |
|
@ -98,19 +97,19 @@ function SecurePair(credentials, is_server) |
|
|
|
|
|
|
|
|
this.encrypted.write = function(data) { |
|
|
this.encrypted.write = function(data) { |
|
|
debug('encIn data'); |
|
|
debug('encIn data'); |
|
|
self._encIn_pending.push(data); |
|
|
self._encInPending.push(data); |
|
|
self._cycle(); |
|
|
self._cycle(); |
|
|
return self._encrypted_write_state; |
|
|
return self._encryptedWriteState; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
|
this.encrypted.pause = function() { |
|
|
this.encrypted.pause = function() { |
|
|
debug('pause encrypted'); |
|
|
debug('pause encrypted'); |
|
|
self._encrypted_write_state = false; |
|
|
self._encryptedWriteState = false; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
|
this.encrypted.resume = function() { |
|
|
this.encrypted.resume = function() { |
|
|
debug('resume encrypted'); |
|
|
debug('resume encrypted'); |
|
|
self._encrypted_write_state = true; |
|
|
self._encryptedWriteState = true; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
|
this.encrypted.end = function(err) { |
|
|
this.encrypted.end = function(err) { |
|
@ -169,9 +168,8 @@ function SecurePair(credentials, is_server) |
|
|
|
|
|
|
|
|
util.inherits(SecurePair, events.EventEmitter); |
|
|
util.inherits(SecurePair, events.EventEmitter); |
|
|
|
|
|
|
|
|
exports.createSecurePair = function(credentials, is_server) |
|
|
exports.createSecurePair = function(credentials, isServer) { |
|
|
{ |
|
|
var pair = new SecurePair(credentials, isServer); |
|
|
var pair = new SecurePair(credentials, is_server); |
|
|
|
|
|
return pair; |
|
|
return pair; |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
@ -181,7 +179,7 @@ exports.createSecurePair = function(credentials, is_server) |
|
|
* An SSL Connection can be viewed as four separate piplines, |
|
|
* An SSL Connection can be viewed as four separate piplines, |
|
|
* interacting with one has no connection to the behavoir of |
|
|
* interacting with one has no connection to the behavoir of |
|
|
* any of the other 3 -- This might not sound reasonable, |
|
|
* any of the other 3 -- This might not sound reasonable, |
|
|
* but consider things like mid-stream renegotiation of |
|
|
* but consider things like mid-stream renegotiation of |
|
|
* the ciphers. |
|
|
* the ciphers. |
|
|
* |
|
|
* |
|
|
* The four pipelines, using terminology of the client (server is just reversed): |
|
|
* The four pipelines, using terminology of the client (server is just reversed): |
|
@ -199,7 +197,7 @@ exports.createSecurePair = function(credentials, is_server) |
|
|
* trying to flush, trying to change ciphers, or shutting down the connection. |
|
|
* trying to flush, trying to change ciphers, or shutting down the connection. |
|
|
* |
|
|
* |
|
|
* Because it is also called everywhere, we also check if the connection |
|
|
* Because it is also called everywhere, we also check if the connection |
|
|
* has completed negotiation and emit 'secure' from here if it has. |
|
|
* has completed negotiation and emit 'secure' from here if it has. |
|
|
*/ |
|
|
*/ |
|
|
SecurePair.prototype._cycle = function() { |
|
|
SecurePair.prototype._cycle = function() { |
|
|
if (this._done) { |
|
|
if (this._done) { |
|
@ -215,8 +213,8 @@ SecurePair.prototype._cycle = function() { |
|
|
var chunk = null; |
|
|
var chunk = null; |
|
|
var pool = null; |
|
|
var pool = null; |
|
|
|
|
|
|
|
|
while (this._encIn_pending.length > 0) { |
|
|
while (this._encInPending.length > 0) { |
|
|
tmp = this._encIn_pending.shift(); |
|
|
tmp = this._encInPending.shift(); |
|
|
|
|
|
|
|
|
try { |
|
|
try { |
|
|
debug('writng from encIn'); |
|
|
debug('writng from encIn'); |
|
@ -226,15 +224,15 @@ SecurePair.prototype._cycle = function() { |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
if (rv === 0) { |
|
|
if (rv === 0) { |
|
|
this._encIn_pending.unshift(tmp); |
|
|
this._encInPending.unshift(tmp); |
|
|
break; |
|
|
break; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
assert(rv === tmp.length); |
|
|
assert(rv === tmp.length); |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
while (this._clearIn_pending.length > 0) { |
|
|
while (this._clearInPending.length > 0) { |
|
|
tmp = this._clearIn_pending.shift(); |
|
|
tmp = this._clearInPending.shift(); |
|
|
try { |
|
|
try { |
|
|
debug('writng from clearIn'); |
|
|
debug('writng from clearIn'); |
|
|
rv = this._ssl.clearIn(tmp, 0, tmp.length); |
|
|
rv = this._ssl.clearIn(tmp, 0, tmp.length); |
|
@ -243,7 +241,7 @@ SecurePair.prototype._cycle = function() { |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
if (rv === 0) { |
|
|
if (rv === 0) { |
|
|
this._clearIn_pending.unshift(tmp); |
|
|
this._clearInPending.unshift(tmp); |
|
|
break; |
|
|
break; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
@ -277,7 +275,7 @@ SecurePair.prototype._cycle = function() { |
|
|
chunk = pool.slice(0, bytesRead); |
|
|
chunk = pool.slice(0, bytesRead); |
|
|
writer(chunk); |
|
|
writer(chunk); |
|
|
} |
|
|
} |
|
|
} while (checker(bytesRead)); |
|
|
} while (checker(bytesRead)); |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
mover( |
|
|
mover( |
|
@ -286,10 +284,10 @@ SecurePair.prototype._cycle = function() { |
|
|
return self._ssl.clearOut(pool, offset, length); |
|
|
return self._ssl.clearOut(pool, offset, length); |
|
|
}, |
|
|
}, |
|
|
function(chunk) { |
|
|
function(chunk) { |
|
|
self.cleartext.emit('data', chunk); |
|
|
self.cleartext.emit('data', chunk); |
|
|
}, |
|
|
}, |
|
|
function(bytesRead) { |
|
|
function(bytesRead) { |
|
|
return bytesRead > 0 && self._cleartext_write_state === true; |
|
|
return bytesRead > 0 && self._cleartextWriteState === true; |
|
|
}); |
|
|
}); |
|
|
|
|
|
|
|
|
mover( |
|
|
mover( |
|
@ -301,7 +299,7 @@ SecurePair.prototype._cycle = function() { |
|
|
self.encrypted.emit('data', chunk); |
|
|
self.encrypted.emit('data', chunk); |
|
|
}, |
|
|
}, |
|
|
function(bytesRead) { |
|
|
function(bytesRead) { |
|
|
return bytesRead > 0 && self._encrypted_write_state === true; |
|
|
return bytesRead > 0 && self._encryptedWriteState === true; |
|
|
}); |
|
|
}); |
|
|
|
|
|
|
|
|
if (!this._secureEstablished && this._ssl.isInitFinished()) { |
|
|
if (!this._secureEstablished && this._ssl.isInitFinished()) { |
|
|