src/openssl/src/detail/engine.cpp

88.8% Lines (356/13/414) 100.0% List of functions (34/0/34)

[ ] prev/next file n p prev/next uncovered line

engine.cpp

f(x) Functions (34)

Function Calls Lines Blocks

Line	Hits	Source Code
1		//
2		// Copyright (c) 2026 Steve Gerbino
3		//
4		// Distributed under the Boost Software License, Version 1.0. (See accompanying
5		// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
6		//
7		// Official repository: https://github.com/cppalliance/corosio
8		//
9
10		#include "engine.hpp"
11
12		// openssl_category is declared alongside the public stream class
13		#include <boost/corosio/openssl_stream.hpp>
14		#include <boost/capy/error.hpp>
15
16		// Internal context implementation
17		#include "src/tls/detail/context_impl.hpp"
18
19		#include <openssl/ssl.h>
20		#include <openssl/err.h>
21		#include <openssl/bio.h>
22		#include <openssl/x509.h>
23		#include <openssl/pkcs12.h>
24
25		#include <cstring>
26		#include <vector>
27
28		namespace boost::corosio {
29
30		namespace {
31
32		inline SSL_METHOD const*
33	1637x	tls_method_compat() noexcept
34		{
35		#if OPENSSL_VERSION_NUMBER >= 0x10100000L
36	1637x	return TLS_method();
37		#else
38		return SSLv23_method();
39		#endif
40		}
41
42		inline bool
43	1665x	apply_hostname_verification(SSL* ssl, std::string const& hostname)
44		{
45		// SSL_clear retains a previously applied name; an empty hostname
46		// must clear SNI and the verify-param host or a reset stream
47		// would leak the old peer's name into the next handshake
48	1665x	char const* name = hostname.empty() ? nullptr : hostname.c_str();
49
50		// RFC 6066 excludes IP literals from SNI, and a literal must match
51		// the certificate's iPAddress entries rather than its DNS names.
52		// The unused field is cleared so a reset stream cannot carry the
53		// previous target's matching rule.
54	1665x	bool const is_ip = name && detail::is_ip_literal(hostname);
55	1665x	char const* dns_name = is_ip ? nullptr : name;
56
57	1665x	if (SSL_set_tlsext_host_name(ssl, dns_name) != 1)
58	✗	return false;
59
60	1665x	auto* param = SSL_get0_param(ssl);
61	1665x	if (!param)
62	✗	return name == nullptr;
63
64	1665x	if (X509_VERIFY_PARAM_set1_host(param, dns_name, 0) != 1)
65	✗	return false;
66	1665x	if (is_ip)
67	2x	return X509_VERIFY_PARAM_set1_ip_asc(param, name) == 1;
68	1663x	return X509_VERIFY_PARAM_set1_ip(param, nullptr, 0) == 1;
69		}
70
71		// Map a portable protocol version to the OpenSSL version constant.
72		inline int
73	3274x	openssl_proto_version(tls_version v) noexcept
74		{
75	3274x	return v == tls_version::tls_1_3 ? TLS1_3_VERSION : TLS1_2_VERSION;
76		}
77
78		// Encode a protocol list into ALPN wire format: each entry is a
79		// one-byte length followed by that many bytes. Entries longer than 255
80		// bytes are skipped (invalid per RFC 7301).
81		inline std::string
82	4x	build_alpn_wire(std::vector<std::string> const& protocols)
83		{
84	4x	std::string wire;
85	10x	for (auto const& p : protocols)
86		{
87	12x	if (p.empty() \|\|
88	−	p.size() > 255) // LCOV_EXCL_LINE set_alpn validates eagerly
89	−	continue; // LCOV_EXCL_LINE set_alpn validates eagerly
90	6x	wire.push_back(static_cast<char>(p.size()));
91	6x	wire.append(p);
92		}
93	4x	return wire;
94	✗	}
95
96		class openssl_category_impl final : public std::error_category
97		{
98	1x	char const* name() const noexcept override
99		{
100	1x	return "corosio.openssl";
101		}
102
103	2x	std::string message(int value) const override
104		{
105		char buf[256];
106	2x	::ERR_error_string_n(
107		static_cast<unsigned long>(value), buf, sizeof(buf));
108	4x	return buf;
109		}
110		};
111
112		// Convert a packed OpenSSL error (from ERR_get_error) into an error_code.
113		// Codes from the ERR_LIB_SYS library carry a genuine errno reason and are
114		// reported with the system category; everything else uses openssl_category.
115		inline std::error_code
116	27x	make_openssl_error(unsigned long err) noexcept
117		{
118	27x	if (ERR_GET_LIB(err) == ERR_LIB_SYS)
119	✗	return std::error_code(
120	✗	static_cast<int>(ERR_GET_REASON(err)), std::system_category());
121	27x	return std::error_code(static_cast<int>(err), openssl_category());
122		}
123
124		// Maps a terminal engine failure (any path that isn't WANT_READ/WANT_WRITE/
125		// ZERO_RETURN) to an error_code. SYSCALL and a bare SSL_ERROR_SSL both leave
126		// the queue empty when the transport simply vanished rather than reporting
127		// a protocol failure; make_openssl_error(0) is falsy, which would otherwise
128		// turn that vanished transport into a false success, so an empty queue maps
129		// to stream_truncated instead.
130		inline std::error_code
131	25x	map_openssl_fatal() noexcept
132		{
133	25x	unsigned long ssl_err = ERR_get_error();
134	25x	if (ssl_err == 0)
135	✗	return make_error_code(capy::error::stream_truncated);
136	25x	return make_openssl_error(ssl_err);
137		}
138
139		} // namespace
140
141		std::error_category const&
142	34x	openssl_category() noexcept
143		{
144	34x	static openssl_category_impl instance;
145	34x	return instance;
146		}
147
148		//
149		// Native context caching
150		//
151
152		namespace detail {
153
154		static int sni_ctx_data_index = -1;
155
156		static int
157	2x	password_callback(char* buf, int size, int rwflag, void* userdata)
158		{
159	2x	auto* cd = static_cast<tls_context_data const*>(userdata);
160	4x	if (!cd \|\|
161	−	!cd->password_callback) // LCOV_EXCL_LINE installed only with a callback
162	−	return 0; // LCOV_EXCL_LINE installed only with a callback
163
164	2x	tls_password_purpose purpose = (rwflag == 0)
165	2x	? tls_password_purpose::for_reading
166		: tls_password_purpose::for_writing;
167
168		std::string password =
169	2x	cd->password_callback(static_cast<std::size_t>(size), purpose);
170
171	2x	int len = static_cast<int>(password.size());
172	2x	if (len > size)
173	1x	len = size;
174
175	2x	std::memcpy(buf, password.data(), static_cast<std::size_t>(len));
176	2x	return len;
177	2x	}
178
179		// Trampoline installed via SSL_CTX_set_verify. Recovers the portable
180		// context data from the SSL_CTX ex_data (populated for every context)
181		// and applies, in order: the revocation policy's soft-fail downgrade,
182		// then the user's verify callback. Installed whenever a verify callback
183		// or a non-disabled revocation policy is configured.
184		static int
185	10x	verify_callback_trampoline(int preverified, X509_STORE_CTX* store_ctx)
186		{
187	10x	SSL* ssl = static_cast<SSL*>(X509_STORE_CTX_get_ex_data(
188		store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
189	−	if (!ssl) // LCOV_EXCL_LINE ex-data set before verify runs
190	−	return preverified; // LCOV_EXCL_LINE ex-data set before verify runs
191
192		auto* cd = static_cast<tls_context_data const*>(
193	10x	SSL_CTX_get_ex_data(SSL_get_SSL_CTX(ssl), sni_ctx_data_index));
194	−	if (!cd) // LCOV_EXCL_LINE set at context build
195	−	return preverified; // LCOV_EXCL_LINE set at context build
196
197	10x	bool ok = preverified != 0;
198
199		// Soft-fail revocation: accept certificates whose revocation status
200		// could not be determined (missing/expired CRL), but never downgrade
201		// an actual revocation. hard_fail leaves every CRL error fatal.
202	10x	if (!ok && cd->revocation == tls_revocation_policy::soft_fail)
203		{
204	1x	int const err = X509_STORE_CTX_get_error(store_ctx);
205	1x	if (err == X509_V_ERR_UNABLE_TO_GET_CRL \|\|
206	✗	err == X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER \|\|
207	✗	err == X509_V_ERR_CRL_HAS_EXPIRED \|\|
208		err == X509_V_ERR_CRL_NOT_YET_VALID)
209	1x	ok = true;
210		}
211
212	10x	if (cd->verify_callback)
213		{
214		// Expose the current certificate's DER so the callback can inspect
215		// it portably. i2d_X509 allocates; free it after the callback.
216	6x	X509* cert = X509_STORE_CTX_get_current_cert(store_ctx);
217	6x	unsigned char* der = nullptr;
218	6x	int der_len = cert ? i2d_X509(cert, &der) : 0;
219
220		verify_context vc(
221		store_ctx, der,
222	6x	der_len > 0 ? static_cast<std::size_t>(der_len) : 0);
223	6x	ok = cd->verify_callback(ok, vc);
224
225	6x	if (der)
226	6x	OPENSSL_free(der);
227		}
228
229	10x	return ok ? 1 : 0;
230		}
231
232		// Server-side ALPN selection. Chooses the server's most-preferred
233		// protocol that the client also offered. On no overlap it sends a fatal
234		// no_application_protocol alert (RFC 7301 §3.2).
235		//
236		// `arg` points at the native context's build-time snapshot of the server
237		// preference list (a std::vector<std::string>), so client offer and server
238		// selection are both taken from the same immutable snapshot.
239		//
240		// The selected protocol pointer must stay valid until the callback runs
241		// again, so we point *out into the client list `in` (OpenSSL keeps it
242		// valid for the connection) rather than into a local buffer.
243		static int
244	2x	alpn_select_cb(
245		SSL* /* ssl */,
246		unsigned char const** out,
247		unsigned char* outlen,
248		unsigned char const* in,
249		unsigned int inlen,
250		void* arg)
251		{
252	2x	auto const* prefs = static_cast<std::vector<std::string> const*>(arg);
253	4x	if (!prefs \|\|
254	−	prefs->empty()) // LCOV_EXCL_LINE installed only with a non-empty list
255	−	return SSL_TLSEXT_ERR_NOACK; // LCOV_EXCL_LINE installed only with a non-empty list
256
257		// Server preference order wins: for each server protocol, look for a
258		// matching entry in the client's offered list.
259	3x	for (auto const& pref : *prefs)
260		{
261	3x	for (unsigned int i = 0; i + 1 <= inlen;)
262		{
263	2x	unsigned int len = in[i];
264	2x	if (i + 1 + len > inlen)
265	✗	break; // malformed
266	3x	if (len == pref.size() &&
267	1x	std::memcmp(in + i + 1, pref.data(), len) == 0)
268		{
269	1x	*out = in + i + 1;
270	1x	*outlen = static_cast<unsigned char>(len);
271	1x	return SSL_TLSEXT_ERR_OK;
272		}
273	1x	i += 1 + len;
274		}
275		}
276
277		// The server supports ALPN but shares no protocol with the client.
278		// RFC 7301 §3.2: fail the handshake with a fatal alert.
279	1x	return SSL_TLSEXT_ERR_ALERT_FATAL;
280		}
281
282		static int
283	12x	sni_callback(SSL* ssl, int* /* alert /, void /* arg */)
284		{
285	12x	char const* servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
286	12x	if (!servername)
287	4x	return SSL_TLSEXT_ERR_NOACK;
288
289	8x	SSL_CTX* ctx = SSL_get_SSL_CTX(ssl);
290		auto* cd = static_cast<tls_context_data const*>(
291	8x	SSL_CTX_get_ex_data(ctx, sni_ctx_data_index));
292
293	8x	if (cd && cd->servername_callback)
294		{
295	8x	if (!cd->servername_callback(servername))
296	1x	return SSL_TLSEXT_ERR_ALERT_FATAL;
297		}
298
299	7x	return SSL_TLSEXT_ERR_OK;
300		}
301
302		class openssl_native_context : public native_context_base
303		{
304		public:
305		SSL_CTX* ctx_;
306		tls_context_data const* cd_;
307		// Set when a requested configuration could not be applied: an inverted
308		// protocol window (min > max), a cipher list / suite the library
309		// rejected, a protocol-version bound that would not set, or a CRL that
310		// parsed as neither PEM nor DER. Silently proceeding would negotiate an
311		// unexpected version, ignore the requested ciphers, or weaken revocation
312		// (fail-open under soft_fail), so do_handshake refuses the handshake.
313		bool setup_failed_ = false;
314		// ALPN offer in wire format (length-prefixed), encoded once from the
315		// immutable protocol list. The client sets it per-SSL each handshake;
316		// caching it here avoids re-encoding and re-allocating per connection.
317		std::string alpn_wire_;
318		// Server preference snapshot, captured at build time so the select
319		// callback matches against the same immutable list the client offers
320		// from (see alpn_select_cb). Its address is handed to OpenSSL as the
321		// callback arg, so it must outlive the SSL_CTX (it does — same object).
322		std::vector<std::string> alpn_snapshot_;
323
324	1637x	explicit openssl_native_context(tls_context_data const& cd)
325	3274x	: ctx_(nullptr)
326	1637x	, cd_(&cd)
327		{
328	1637x	ctx_ = SSL_CTX_new(tls_method_compat());
329	1637x	if (!ctx_)
330	✗	return;
331
332	1637x	if (sni_ctx_data_index < 0)
333	3x	sni_ctx_data_index =
334	3x	SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
335
336	1637x	SSL_CTX_set_ex_data(
337		ctx_, sni_ctx_data_index, const_cast<tls_context_data*>(&cd));
338
339	1637x	if (cd.servername_callback)
340	8x	SSL_CTX_set_tlsext_servername_callback(ctx_, sni_callback);
341
342		// ALPN server-side selection. The callback only fires when this
343		// context is used as a server; the client offer (encoded once here)
344		// is set per-SSL from alpn_wire_. Snapshot the preference list so the
345		// callback and the client offer share one immutable source.
346	1637x	if (!cd.alpn_protocols.empty())
347		{
348	4x	alpn_snapshot_ = cd.alpn_protocols;
349	4x	SSL_CTX_set_alpn_select_cb(ctx_, alpn_select_cb, &alpn_snapshot_);
350	4x	alpn_wire_ = build_alpn_wire(cd.alpn_protocols);
351		}
352
353	1637x	SSL_CTX_set_mode(ctx_, SSL_MODE_ENABLE_PARTIAL_WRITE);
354	1637x	SSL_CTX_set_mode(ctx_, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
355		#if defined(SSL_MODE_RELEASE_BUFFERS)
356	1637x	SSL_CTX_set_mode(ctx_, SSL_MODE_RELEASE_BUFFERS);
357		#endif
358
359		// Enforce the configured protocol version window (role-agnostic).
360		// An inverted window (min > max) admits no protocol; fail closed
361		// rather than silently negotiate an unexpected version.
362	1637x	if (cd.min_version > cd.max_version)
363	2x	setup_failed_ = true;
364	1637x	if (!SSL_CTX_set_min_proto_version(
365		ctx_, openssl_proto_version(cd.min_version)))
366	✗	setup_failed_ = true;
367	1637x	if (!SSL_CTX_set_max_proto_version(
368		ctx_, openssl_proto_version(cd.max_version)))
369	✗	setup_failed_ = true;
370
371	1637x	int verify_mode_flag = SSL_VERIFY_NONE;
372	1637x	if (cd.verification_mode == tls_verify_mode::peer)
373	1157x	verify_mode_flag = SSL_VERIFY_PEER;
374	480x	else if (cd.verification_mode == tls_verify_mode::require_peer)
375	3x	verify_mode_flag =
376		SSL_VERIFY_PEER \| SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
377		// The trampoline runs the revocation soft-fail downgrade and the
378		// user callback, so install it if either is configured.
379	3269x	bool const need_trampoline = cd.verify_callback \|\|
380	3269x	cd.revocation != tls_revocation_policy::disabled;
381	1637x	SSL_CTX_set_verify(
382		ctx_, verify_mode_flag,
383		need_trampoline ? &verify_callback_trampoline : nullptr);
384
385		// PKCS#12 bundle: decode cert + key + chain directly into the
386		// context. This is an alternative credential source; the PEM/DER
387		// fields below are only consulted when no bundle is supplied.
388	1637x	if (!cd.pkcs12_data.empty())
389		{
390		// A bundle that fails to decode or parse (wrong passphrase,
391		// malformed) must not leave the context silently credential-less:
392		// a client using PKCS#12 for mTLS would then fail open against a
393		// verify_mode::peer server. Fail closed like every other setup
394		// error.
395	7x	BIO* bio = BIO_new_mem_buf(
396	7x	cd.pkcs12_data.data(), static_cast<int>(cd.pkcs12_data.size()));
397	7x	if (!bio)
398	✗	setup_failed_ = true;
399		else
400		{
401	7x	PKCS12* p12 = d2i_PKCS12_bio(bio, nullptr);
402	7x	if (!p12)
403	2x	setup_failed_ = true;
404		else
405		{
406	5x	EVP_PKEY* pkey = nullptr;
407	5x	X509* cert = nullptr;
408	5x	STACK_OF(X509)* chain = nullptr;
409	5x	if (PKCS12_parse(
410		p12, cd.pkcs12_password.c_str(), &pkey, &cert,
411		&chain))
412		{
413	3x	if (cert)
414	3x	SSL_CTX_use_certificate(ctx_, cert);
415	3x	if (pkey)
416	3x	SSL_CTX_use_PrivateKey(ctx_, pkey);
417	3x	if (chain)
418	2x	for (int i = 0; i < sk_X509_num(chain); ++i)
419		{
420		// add_extra_chain_cert takes ownership of the
421		// dup only on success; free it (and fail
422		// closed) otherwise so a partial chain isn't
423		// sent silently.
424	1x	X509* dup = X509_dup(sk_X509_value(chain, i));
425	2x	if (!dup \|\|
426	1x	!SSL_CTX_add_extra_chain_cert(ctx_, dup))
427		{
428	✗	X509_free(dup);
429	✗	setup_failed_ = true;
430		}
431		}
432		}
433		else
434	2x	setup_failed_ = true;
435	5x	EVP_PKEY_free(pkey);
436	5x	X509_free(cert);
437	5x	if (chain)
438	1x	sk_X509_pop_free(chain, X509_free);
439	5x	PKCS12_free(p12);
440		}
441	7x	ERR_clear_error();
442	7x	BIO_free(bio);
443		}
444		}
445
446	1637x	if (cd.pkcs12_data.empty() && !cd.entity_certificate.empty())
447		{
448		// An entity certificate that fails to parse must not pass
449		// silently: the handshake would run without the identity the
450		// caller configured and fail remotely instead of at setup.
451	473x	BIO* bio = BIO_new_mem_buf(
452	473x	cd.entity_certificate.data(),
453	473x	static_cast<int>(cd.entity_certificate.size()));
454	473x	if (bio)
455		{
456	473x	X509* cert = nullptr;
457	473x	if (cd.entity_cert_format == tls_file_format::pem)
458	471x	cert = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr);
459		else
460	2x	cert = d2i_X509_bio(bio, nullptr);
461	473x	if (cert)
462		{
463	471x	SSL_CTX_use_certificate(ctx_, cert);
464	471x	X509_free(cert);
465		}
466		else
467		{
468	2x	setup_failed_ = true;
469		}
470	473x	BIO_free(bio);
471		}
472		else
473		{
474	✗	setup_failed_ = true;
475		}
476		}
477
478	1637x	if (cd.pkcs12_data.empty() && !cd.certificate_chain.empty())
479		{
480	1x	BIO* bio = BIO_new_mem_buf(
481	1x	cd.certificate_chain.data(),
482	1x	static_cast<int>(cd.certificate_chain.size()));
483	1x	if (bio)
484		{
485		X509* entity =
486	1x	PEM_read_bio_X509(bio, nullptr, nullptr, nullptr);
487	1x	if (entity)
488		{
489	1x	SSL_CTX_use_certificate(ctx_, entity);
490	1x	X509_free(entity);
491		}
492
493		X509* cert;
494	2x	while ((cert = PEM_read_bio_X509(
495	2x	bio, nullptr, nullptr, nullptr)) != nullptr)
496		{
497	1x	SSL_CTX_add_extra_chain_cert(ctx_, cert);
498		}
499	1x	ERR_clear_error();
500	1x	BIO_free(bio);
501		}
502		}
503
504	1637x	if (cd.pkcs12_data.empty() && !cd.private_key.empty())
505		{
506	474x	BIO* bio = BIO_new_mem_buf(
507	474x	cd.private_key.data(), static_cast<int>(cd.private_key.size()));
508	474x	if (bio)
509		{
510	474x	EVP_PKEY* pkey = nullptr;
511	474x	if (cd.private_key_format == tls_file_format::pem)
512		{
513	473x	if (cd.password_callback)
514	2x	pkey = PEM_read_bio_PrivateKey(
515		bio, nullptr, password_callback,
516		const_cast<tls_context_data*>(&cd));
517		else
518	471x	pkey = PEM_read_bio_PrivateKey(
519		bio, nullptr, nullptr, nullptr);
520		}
521		else
522	1x	pkey = d2i_PrivateKey_bio(bio, nullptr);
523		// A key that fails to parse or decrypt (wrong or missing
524		// password) must fail setup, not surface later as an
525		// inexplicable handshake error.
526	474x	if (pkey)
527		{
528	471x	SSL_CTX_use_PrivateKey(ctx_, pkey);
529	471x	EVP_PKEY_free(pkey);
530		}
531		else
532		{
533	3x	setup_failed_ = true;
534		}
535	474x	BIO_free(bio);
536	474x	ERR_clear_error();
537		}
538		else
539		{
540	✗	setup_failed_ = true;
541		}
542		}
543
544	1637x	X509_STORE* store = SSL_CTX_get_cert_store(ctx_);
545	2809x	for (auto const& ca : cd.ca_certificates)
546		{
547		// A trust anchor that fails to parse or add must not pass
548		// silently: the store would verify against fewer anchors than
549		// requested and reject a legitimate peer as untrusted. Fail
550		// closed instead, tolerating only a duplicate the store already
551		// holds.
552	1172x	BIO* bio = BIO_new_mem_buf(ca.data(), static_cast<int>(ca.size()));
553	1172x	if (!bio)
554		{
555	✗	setup_failed_ = true;
556	✗	continue;
557		}
558	1172x	X509* cert = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr);
559	1172x	if (cert)
560		{
561	1170x	if (X509_STORE_add_cert(store, cert) != 1 &&
562	✗	ERR_GET_REASON(ERR_peek_last_error()) !=
563		X509_R_CERT_ALREADY_IN_HASH_TABLE)
564	✗	setup_failed_ = true;
565	1170x	X509_free(cert);
566		}
567		else
568	2x	setup_failed_ = true;
569	1172x	ERR_clear_error();
570	1172x	BIO_free(bio);
571		}
572
573		// Trust anchors from the system store and explicit directories.
574		// Failures leave the affected source unloaded rather than aborting
575		// context creation; the error queue is cleared so it does not leak
576		// into a later handshake.
577	1637x	if (cd.use_default_verify_paths)
578	1x	SSL_CTX_set_default_verify_paths(ctx_);
579	1638x	for (auto const& path : cd.verify_paths)
580	1x	SSL_CTX_load_verify_locations(ctx_, nullptr, path.c_str());
581	1637x	ERR_clear_error();
582
583		// Certificate revocation via CRLs. Load any supplied CRLs and, when
584		// a revocation policy is active, enable leaf CRL checking. soft_fail
585		// vs hard_fail is applied in the verify trampoline. CRL_CHECK (leaf
586		// only) is used so a missing CRL for a trusted root is not itself an
587		// error.
588	1637x	if (cd.revocation != tls_revocation_policy::disabled)
589		{
590	9x	for (auto const& crl_data : cd.crls)
591		{
592	4x	BIO* bio = BIO_new_mem_buf(
593	4x	crl_data.data(), static_cast<int>(crl_data.size()));
594	4x	if (!bio)
595		{
596	✗	setup_failed_ = true;
597	✗	continue;
598		}
599		// Accept PEM or DER (the documented contract). Try PEM first,
600		// then rewind and try DER.
601		X509_CRL* crl =
602	4x	PEM_read_bio_X509_CRL(bio, nullptr, nullptr, nullptr);
603	4x	if (!crl)
604		{
605	3x	BIO_reset(bio);
606	3x	crl = d2i_X509_CRL_bio(bio, nullptr);
607		}
608	4x	if (crl)
609		{
610	1x	X509_STORE_add_crl(store, crl);
611	1x	X509_CRL_free(crl);
612		}
613		else
614		{
615		// A supplied CRL that parses as neither PEM nor DER must
616		// not be silently dropped; record it so the handshake
617		// fails closed rather than weakening revocation.
618	3x	setup_failed_ = true;
619		}
620	4x	BIO_free(bio);
621		}
622	5x	X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK);
623	5x	ERR_clear_error();
624		}
625
626	1637x	SSL_CTX_set_verify_depth(ctx_, cd.verify_depth);
627
628		// Cipher configuration. TLS 1.2-and-below use the cipher list;
629		// TLS 1.3 uses the separate ciphersuites API. The security level
630		// is deliberately left at the library default: a weak cipher
631		// string should fail loudly rather than be silently permitted via
632		// a forced @SECLEVEL=0. Callers that genuinely need a lower level
633		// can express it in the cipher string (e.g. "...:@SECLEVEL=0").
634		// A cipher string the library rejects must not silently fall back to
635		// the default suites; fail closed instead.
636	1641x	if (!cd.ciphersuites.empty() &&
637	4x	!SSL_CTX_set_cipher_list(ctx_, cd.ciphersuites.c_str()))
638	2x	setup_failed_ = true;
639	1644x	if (!cd.ciphersuites_tls13.empty() &&
640	7x	!SSL_CTX_set_ciphersuites(ctx_, cd.ciphersuites_tls13.c_str()))
641	3x	setup_failed_ = true;
642	✗	}
643
644	3274x	~openssl_native_context() override
645	1637x	{
646	1637x	if (ctx_)
647	1637x	SSL_CTX_free(ctx_);
648	3274x	}
649		};
650
651		inline openssl_native_context*
652	1642x	get_openssl_native_context(tls_context_data const& cd)
653		{
654		static char key;
655	3279x	auto* p = cd.find(&key, [&] { return new openssl_native_context(cd); });
656	1642x	return static_cast<openssl_native_context*>(p);
657		}
658
659		//
660		// engine
661		//
662
663		namespace openssl {
664
665	2338x	engine::~engine()
666		{
667	2338x	if (ext_bio_)
668	1642x	BIO_free(ext_bio_);
669	2338x	if (ssl_)
670	1642x	SSL_free(ssl_);
671	2338x	}
672
673		std::error_code
674	1642x	engine::init(tls_context const& ctx)
675		{
676	1642x	auto& cd = get_tls_context_data(ctx);
677	1642x	nc_ = get_openssl_native_context(cd);
678	1642x	if (!nc_->ctx_)
679		{
680		// The cache retains a failed context build permanently (it
681		// never retries), so a later construction can reach here
682		// with an already-drained error queue; make_openssl_error(0)
683		// is falsy and would let the caller treat this as success and
684		// dereference a null ssl_ on first use. Report unconditionally
685		// rather than trust ERR_get_error() to be nonzero.
686	✗	return std::make_error_code(std::errc::not_enough_memory);
687		}
688
689	1642x	ssl_ = SSL_new(nc_->ctx_);
690	1642x	if (!ssl_)
691		{
692	✗	unsigned long err = ERR_get_error();
693	✗	return make_openssl_error(err);
694		}
695
696	1642x	BIO* int_bio = nullptr;
697	1642x	if (!BIO_new_bio_pair(&int_bio, 0, &ext_bio_, 0))
698		{
699	✗	unsigned long err = ERR_get_error();
700	✗	SSL_free(ssl_);
701	✗	ssl_ = nullptr;
702	✗	return make_openssl_error(err);
703		}
704
705	1642x	SSL_set_bio(ssl_, int_bio, int_bio);
706
707	1642x	return {};
708		}
709
710		void
711	65x	engine::reset()
712		{
713	−	if (!ssl_) // LCOV_EXCL_LINE reset() runs only on a used stream
714	−	return; // LCOV_EXCL_LINE reset() runs only on a used stream
715
716		// Preserves SSL* and BIO pair, releases session state
717	65x	if (SSL_clear(ssl_) != 1)
718	✗	clear_failed_ = true;
719
720		// SSL_clear() retains the negotiated session so a subsequent
721		// handshake on this SSL* can resume it. Resumed handshakes skip
722		// certificate/hostname re-verification, which would let a changed
723		// set_hostname() go unchecked after reset(); drop it to force a
724		// full handshake. A failure leaves the old session resumable,
725		// defeating that guarantee, so latch the same failure flag
726		// SSL_clear() uses above.
727	65x	if (SSL_set_session(ssl_, nullptr) != 1)
728	✗	clear_failed_ = true;
729
730		// Drain stale data from the external BIO. Mirrors the driver's
731		// flush guard: a read failure here would otherwise spin the loop
732		// forever since the pending count never advances.
733		char drain[1024];
734	65x	while (BIO_ctrl_pending(ext_bio_) > 0)
735		{
736	✗	if (BIO_read(ext_bio_, drain, sizeof(drain)) <= 0)
737	✗	break;
738		}
739		}
740
741		bool
742	3296x	engine::context_setup_failed() const noexcept
743		{
744		// Before the deferred init runs there is no native context to
745		// judge; prepare() re-checks once it exists.
746	3296x	return nc_ && nc_->setup_failed_;
747		}
748
749		std::error_code
750	3296x	engine::check_context() const noexcept
751		{
752	3296x	if (context_setup_failed())
753	20x	return std::make_error_code(std::errc::invalid_argument);
754	3276x	return {};
755		}
756
757		std::error_code
758	1676x	engine::check_session() const noexcept
759		{
760	1676x	if (clear_failed_)
761	✗	return std::make_error_code(std::errc::invalid_argument);
762	1676x	return {};
763		}
764
765		std::error_code
766	1676x	engine::prepare(
767		tls_context const& ctx, tls_role role, std::string const& hostname)
768		{
769		// Session creation is deferred from construction so a setup
770		// failure reports through the handshake completion.
771	1676x	if (!ssl_)
772		{
773	1611x	if (auto ec = init(ctx))
774	✗	return ec;
775		// The driver's check_context gate ran before this init could
776		// populate the native context; re-check so a rejected
777		// configuration still fails closed on the first handshake.
778	1611x	if (auto cec = check_context())
779	11x	return cec;
780		}
781
782		// The hostname applies to client handshakes only; a server
783		// handshake clears any name left by a prior client-role
784		// handshake so client certificates are never hostname-matched.
785	1665x	std::string const no_name;
786	1665x	if (!apply_hostname(role == tls_role::client ? hostname : no_name))
787		{
788		// Fail closed rather than handshake without the requested
789		// name check.
790	✗	return std::make_error_code(std::errc::invalid_argument);
791		}
792
793		// Client offers its ALPN protocol list; the server selects via
794		// the context callback. Role is only known here, so install the
795		// offer per-session; fail closed rather than negotiate nothing
796		// silently.
797	1665x	if (role == tls_role::client && !apply_alpn_offer())
798	✗	return std::make_error_code(std::errc::invalid_argument);
799
800	1665x	return {};
801	1665x	}
802
803		bool
804	1665x	engine::apply_hostname(std::string const& hostname)
805		{
806	1665x	return apply_hostname_verification(ssl_, hostname);
807		}
808
809		bool
810	1180x	engine::apply_alpn_offer()
811		{
812	1180x	if (nc_->alpn_wire_.empty())
813	1178x	return true;
814
815		// SSL_set_alpn_protos uses the inverted convention: 0 = success.
816		// A non-zero return (allocation failure) means the offer was not
817		// installed; the caller fails closed rather than negotiate nothing
818		// silently.
819	2x	return SSL_set_alpn_protos(
820		ssl_,
821	2x	reinterpret_cast<unsigned char const*>(nc_->alpn_wire_.data()),
822	4x	static_cast<unsigned int>(nc_->alpn_wire_.size())) == 0;
823		}
824
825		void
826	608x	engine::capture_alpn(std::string& out) const
827		{
828	608x	unsigned char const* data = nullptr;
829	608x	unsigned int len = 0;
830	608x	SSL_get0_alpn_selected(ssl_, &data, &len);
831	608x	if (data && len)
832	2x	out.assign(reinterpret_cast<char const*>(data), len);
833	608x	}
834
835		engine_result
836	72527x	engine::perform(engine_op op, void* data, std::size_t len)
837		{
838		// No session exists until the first handshake's deferred init;
839		// report I/O attempted before then instead of crashing on a null
840		// SSL handle.
841	72527x	if (!ssl_)
842		return {
843		engine_want::done,
844	3x	std::make_error_code(std::errc::invalid_argument), 0};
845
846	72524x	ERR_clear_error();
847
848	72524x	int ret = 0;
849	72524x	switch (op)
850		{
851	2663x	case engine_op::handshake_client:
852	2663x	ret = SSL_connect(ssl_);
853	2663x	break;
854	1491x	case engine_op::handshake_server:
855	1491x	ret = SSL_accept(ssl_);
856	1491x	break;
857	34653x	case engine_op::read:
858	34653x	ret = SSL_read(ssl_, data, static_cast<int>(len));
859	34653x	break;
860	33406x	case engine_op::write:
861	33406x	ret = SSL_write(ssl_, data, static_cast<int>(len));
862	33406x	break;
863	311x	case engine_op::shutdown:
864	311x	ret = SSL_shutdown(ssl_);
865	311x	break;
866		}
867
868	72524x	bool const transfer = op == engine_op::read \|\| op == engine_op::write;
869
870		// SSL_shutdown returning 0 means our close_notify was queued but
871		// the peer's has not arrived yet: flush it, then read for it.
872	72524x	if (op == engine_op::shutdown && ret == 0)
873		return {
874	92x	pending_output() > 0 ? engine_want::output_then_retry
875		: engine_want::input,
876		{},
877	92x	0};
878
879	72432x	if (transfer ? ret > 0 : ret == 1)
880		return {
881	67463x	pending_output() > 0 ? engine_want::output_then_done
882		: engine_want::done,
883		{},
884	67463x	transfer ? static_cast<std::size_t>(ret) : 0};
885
886	4969x	int const err = SSL_get_error(ssl_, ret);
887
888	4969x	if (err == SSL_ERROR_WANT_WRITE)
889	1x	return {engine_want::output_then_retry, {}, 0};
890
891	4968x	if (err == SSL_ERROR_WANT_READ)
892		return {
893	4886x	pending_output() > 0 ? engine_want::output_then_retry
894		: engine_want::input,
895		{},
896	4886x	0};
897
898	82x	if (transfer && err == SSL_ERROR_ZERO_RETURN)
899		{
900		// ZERO_RETURN means the peer's close_notify WAS received (an
901		// announced close), unlike the terminal branch's empty-queue
902		// fallback below, which means an unannounced one; report eof,
903		// not stream_truncated. A received close_notify queues no
904		// output, so a plain done skips the flush.
905	55x	return {engine_want::done, make_error_code(capy::error::eof), 0};
906		}
907
908	27x	std::error_code ec;
909	27x	if (op == engine_op::shutdown)
910		{
911	2x	unsigned long ssl_err = ERR_get_error();
912	2x	if (ssl_err == 0 && err == SSL_ERROR_SYSCALL)
913		{
914		// The socket closed without an OpenSSL-level error, but
915		// that can mean either the peer's close_notify already
916		// arrived (this operation's fill, or a concurrent reader,
917		// consumed it) or the peer vanished mid-shutdown without
918		// ever sending one; only RECEIVED_SHUTDOWN tells them
919		// apart, and the documented contract promises
920		// stream_truncated for the latter, matching the read path
921		// and the driver's `map_fill_error` policy.
922		// The driver's map_fill_error reports the truncation
923		// before a BIO-pair engine can see SYSCALL.
924	✗	ec =
925	−	received_shutdown() // LCOV_EXCL_LINE driver maps truncation first
926	✗	? std::error_code{}
927		// LCOV_EXCL_LINE driver maps truncation first
928	✗	: make_error_code(
929		capy::error::
930		stream_truncated); // LCOV_EXCL_LINE driver maps truncation first
931		}
932		else
933		{
934	2x	ec = make_openssl_error(ssl_err);
935		}
936		}
937		else
938		{
939		// SYSCALL and every other terminal code map the same way;
940		// map_openssl_fatal() covers both.
941	25x	ec = map_openssl_fatal();
942		}
943		return {
944	27x	pending_output() > 0 ? engine_want::output_then_done
945		: engine_want::done,
946	27x	ec, 0};
947		}
948
949		std::size_t
950	59x	engine::put_input(unsigned char const* data, std::size_t len)
951		{
952	59x	int put = BIO_write(ext_bio_, data, static_cast<int>(len));
953	59x	return put > 0 ? static_cast<std::size_t>(put) : 0;
954		}
955
956		std::pair<unsigned char*, std::size_t>
957	3316x	engine::input_area()
958		{
959		// A BIO pair hands out a pointer into its own buffer, so the
960		// transport reads ciphertext directly into the pair with no staging
961		// copy. The buffer is circular: this is only the contiguous run to
962		// the wrap, which the driver's read loop already tolerates.
963	3316x	char* p = nullptr;
964	3316x	int const cap = BIO_nwrite0(ext_bio_, &p);
965	3316x	if (cap <= 0 \|\| !p)
966	✗	return {nullptr, 0};
967	3316x	return {reinterpret_cast<unsigned char*>(p), static_cast<std::size_t>(cap)};
968		}
969
970		void
971	2341x	engine::input_committed(std::size_t n)
972		{
973	2341x	if (n == 0)
974	✗	return;
975		// The bytes were written straight into the region BIO_nwrite0
976		// returned; advance the pair's write cursor to make them readable.
977	2341x	char* p = nullptr;
978	2341x	BIO_nwrite(ext_bio_, &p, static_cast<int>(n));
979		}
980
981		std::size_t
982	182873x	engine::pending_output() const
983		{
984	182873x	return BIO_ctrl_pending(ext_bio_);
985		}
986
987		std::size_t
988	35744x	engine::get_output(unsigned char* data, std::size_t len)
989		{
990	35744x	int r = BIO_read(ext_bio_, data, static_cast<int>(len));
991	35744x	return r > 0 ? static_cast<std::size_t>(r) : 0;
992		}
993
994		bool
995	1037x	engine::received_shutdown() const
996		{
997	1037x	return (SSL_get_shutdown(ssl_) & SSL_RECEIVED_SHUTDOWN) != 0;
998		}
999
1000		} // namespace openssl
1001
1002		} // namespace detail
1003
1004		} // namespace boost::corosio
1005