]> git.sesse.net Git - cubemap/blob - client.cpp
Add server-side TLS support, through kTLS.
[cubemap] / client.cpp
1 #include <stdio.h>
2 #include <arpa/inet.h>
3 #include <netinet/in.h>
4 #include <stdint.h>
5 #include <sys/socket.h>
6
7 #include "client.h"
8 #include "log.h"
9 #include "state.pb.h"
10 #include "stream.h"
11
12 #ifndef SO_MAX_PACING_RATE
13 #define SO_MAX_PACING_RATE 47
14 #endif
15
16 using namespace std;
17
18 Client::Client(int sock)
19         : sock(sock),
20           state(Client::READING_REQUEST),
21           stream(NULL),
22           header_or_short_response_bytes_sent(0),
23           stream_pos(0),
24           bytes_sent(0),
25           bytes_lost(0),
26           num_loss_events(0),
27           tls_context(NULL),
28           tls_data_to_send(NULL),
29           tls_data_left_to_send(0),
30           in_ktls_mode(false)
31 {
32         request.reserve(1024);
33
34         if (clock_gettime(CLOCK_MONOTONIC_COARSE, &connect_time) == -1) {
35                 log_perror("clock_gettime(CLOCK_MONOTONIC_COARSE)");
36                 return;
37         }
38
39         // Find the remote address, and convert it to ASCII.
40         sockaddr_in6 addr;
41         socklen_t addr_len = sizeof(addr);
42
43         if (getpeername(sock, reinterpret_cast<sockaddr *>(&addr), &addr_len) == -1) {
44                 log_perror("getpeername");
45                 remote_addr = "";
46                 return;
47         }
48
49         char buf[INET6_ADDRSTRLEN];
50         if (IN6_IS_ADDR_V4MAPPED(&addr.sin6_addr)) {
51                 // IPv4 address, really.
52                 if (inet_ntop(AF_INET, &addr.sin6_addr.s6_addr32[3], buf, sizeof(buf)) == NULL) {
53                         log_perror("inet_ntop");
54                         remote_addr = "";
55                 } else {
56                         remote_addr = buf;
57                 }
58         } else {
59                 if (inet_ntop(addr.sin6_family, &addr.sin6_addr, buf, sizeof(buf)) == NULL) {
60                         log_perror("inet_ntop");
61                         remote_addr = "";
62                 } else {
63                         remote_addr = buf;
64                 }
65         }
66 }
67         
68 Client::Client(const ClientProto &serialized, Stream *stream)
69         : sock(serialized.sock()),
70           remote_addr(serialized.remote_addr()),
71           referer(serialized.referer()),
72           user_agent(serialized.user_agent()),
73           state(State(serialized.state())),
74           request(serialized.request()),
75           url(serialized.url()),
76           stream(stream),
77           header_or_short_response(serialized.header_or_short_response()),
78           header_or_short_response_bytes_sent(serialized.header_or_short_response_bytes_sent()),
79           stream_pos(serialized.stream_pos()),
80           bytes_sent(serialized.bytes_sent()),
81           bytes_lost(serialized.bytes_lost()),
82           num_loss_events(serialized.num_loss_events())
83 {
84         if (stream != NULL) {
85                 if (setsockopt(sock, SOL_SOCKET, SO_MAX_PACING_RATE, &stream->pacing_rate, sizeof(stream->pacing_rate)) == -1) {
86                         if (stream->pacing_rate != ~0U) {
87                                 log_perror("setsockopt(SO_MAX_PACING_RATE)");
88                         }
89                 }
90         }
91         connect_time.tv_sec = serialized.connect_time_sec();
92         connect_time.tv_nsec = serialized.connect_time_nsec();
93
94         in_ktls_mode = false;
95         if (serialized.has_tls_context()) {
96                 tls_context = tls_import_context(
97                         reinterpret_cast<const unsigned char *>(serialized.tls_context().data()),
98                         serialized.tls_context().size());
99                 if (tls_context == NULL) {
100                         log(WARNING, "tls_import_context() failed, TLS client might not survive across restart");
101                 } else {
102                         tls_data_to_send = tls_get_write_buffer(tls_context, &tls_data_left_to_send);
103
104                         assert(serialized.tls_output_bytes_already_consumed() <= tls_data_left_to_send);
105                         if (serialized.tls_output_bytes_already_consumed() >= tls_data_left_to_send) {
106                                 tls_buffer_clear(tls_context);
107                                 tls_data_to_send = NULL;
108                         } else {
109                                 tls_data_to_send += serialized.tls_output_bytes_already_consumed();
110                                 tls_data_left_to_send -= serialized.tls_output_bytes_already_consumed();
111                         }
112                         in_ktls_mode = serialized.in_ktls_mode();
113                 }
114         } else {
115                 tls_context = NULL;
116         }
117 }
118
119 ClientProto Client::serialize() const
120 {
121         ClientProto serialized;
122         serialized.set_sock(sock);
123         serialized.set_remote_addr(remote_addr);
124         serialized.set_referer(referer);
125         serialized.set_user_agent(user_agent);
126         serialized.set_connect_time_sec(connect_time.tv_sec);
127         serialized.set_connect_time_nsec(connect_time.tv_nsec);
128         serialized.set_state(state);
129         serialized.set_request(request);
130         serialized.set_url(url);
131         serialized.set_header_or_short_response(header_or_short_response);
132         serialized.set_header_or_short_response_bytes_sent(serialized.header_or_short_response_bytes_sent());
133         serialized.set_stream_pos(stream_pos);
134         serialized.set_bytes_sent(bytes_sent);
135         serialized.set_bytes_lost(bytes_lost);
136         serialized.set_num_loss_events(num_loss_events);
137
138         if (tls_context != NULL) {
139                 bool small_version = false;
140                 int required_size = tls_export_context(tls_context, NULL, 0, small_version);
141                 if (required_size <= 0) {
142                         // Can happen if we're in the middle of the key exchange, unfortunately.
143                         // We'll get an error fairly fast, and this client hasn't started playing
144                         // anything yet, so just log the error and continue.
145                         //
146                         // In theory, we could still rescue it if we had sent _zero_ bytes,
147                         // by doing an entirely new TLS context, but it's an edge case
148                         // that's not really worth it.
149                         log(WARNING, "tls_export_context() failed (returned %d), TLS client might not survive across restart",
150                                 required_size);
151                 } else {
152                         string *serialized_context = serialized.mutable_tls_context();
153                         serialized_context->resize(required_size);
154
155                         int ret = tls_export_context(tls_context,
156                                 reinterpret_cast<unsigned char *>(&(*serialized_context)[0]),
157                                 serialized_context->size(),
158                                 small_version);
159                         assert(ret == required_size);
160
161                         // tls_export_context() has exported the contents of the write buffer, but it doesn't
162                         // know how much of that we've consumed, so we need to figure that out by ourselves.
163                         // In a sense, it's unlikely that this will ever be relevant, though, since TLSe can't
164                         // currently serialize in-progress key exchanges.
165                         unsigned base_tls_data_left_to_send;
166                         const unsigned char *base_tls_data_to_send = tls_get_write_buffer(tls_context, &base_tls_data_left_to_send);
167                         if (base_tls_data_to_send == NULL) {
168                                 assert(tls_data_to_send == NULL);
169                         } else {
170                                 assert(tls_data_to_send + tls_data_left_to_send == base_tls_data_to_send + base_tls_data_left_to_send);
171                         }
172                         serialized.set_tls_output_bytes_already_consumed(tls_data_to_send - base_tls_data_to_send);
173                         serialized.set_in_ktls_mode(in_ktls_mode);
174                 }
175         }
176
177         return serialized;
178 }
179
180 namespace {
181
182 string escape_string(const string &str) {
183         string ret;
184         for (size_t i = 0; i < str.size(); ++i) {
185                 char buf[16];
186                 if (isprint(str[i]) && str[i] >= 32 && str[i] != '"' && str[i] != '\\') {
187                         ret.push_back(str[i]);
188                 } else {
189                         snprintf(buf, sizeof(buf), "\\x%02x", (unsigned char)str[i]);
190                         ret += buf;
191                 }
192         }
193         return ret;
194 }
195
196 } // namespace
197         
198 ClientStats Client::get_stats() const
199 {
200         ClientStats stats;
201         if (url.empty()) {
202                 stats.url = "-";
203         } else {
204                 stats.url = url;
205         }
206         stats.sock = sock;
207         stats.remote_addr = remote_addr;
208         stats.referer = escape_string(referer);
209         stats.user_agent = escape_string(user_agent);
210         stats.connect_time = connect_time;
211         stats.bytes_sent = bytes_sent;
212         stats.bytes_lost = bytes_lost;
213         stats.num_loss_events = num_loss_events;
214         return stats;
215 }