ssl/test/handshake_util.cc - third_party/boringssl/boringssl - Git at Google

 /* Copyright (c) 2018, Google Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

 #include "handshake_util.h"

 #include <assert.h>
 #if defined(HANDSHAKER_SUPPORTED)
 #include <errno.h>
 #include <fcntl.h>
 #include <spawn.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 #endif

 #include <functional>
 #include <map>
 #include <vector>

 #include "async_bio.h"
 #include "packeted_bio.h"
 #include "test_config.h"
 #include "test_state.h"

 #include <openssl/bytestring.h>
 #include <openssl/ssl.h>

 using namespace bssl;

 bool RetryAsync(SSL *ssl, int ret) {
   const TestConfig *config = GetTestConfig(ssl);
   TestState *test_state = GetTestState(ssl);
   if (ret >= 0) {
     return false;
   }

   int ssl_err = SSL_get_error(ssl, ret);
   if (ssl_err == SSL_ERROR_WANT_RENEGOTIATE && config->renegotiate_explicit) {
     test_state->explicit_renegotiates++;
     return SSL_renegotiate(ssl);
   }

   if (test_state->quic_transport && ssl_err == SSL_ERROR_WANT_READ) {
     return test_state->quic_transport->ReadHandshake();
   }

   if (!config->async) {
     // Only asynchronous tests should trigger other retries.
     return false;
   }

   if (test_state->packeted_bio != nullptr &&
       PacketedBioAdvanceClock(test_state->packeted_bio)) {
     // The DTLS retransmit logic silently ignores write failures. So the test
     // may progress, allow writes through synchronously.
     AsyncBioEnforceWriteQuota(test_state->async_bio, false);
     int timeout_ret = DTLSv1_handle_timeout(ssl);
     AsyncBioEnforceWriteQuota(test_state->async_bio, true);

     if (timeout_ret < 0) {
       fprintf(stderr, "Error retransmitting.\n");
       return false;
     }
     return true;
   }

   // See if we needed to read or write more. If so, allow one byte through on
   // the appropriate end to maximally stress the state machine.
   switch (ssl_err) {
     case SSL_ERROR_WANT_READ:
       AsyncBioAllowRead(test_state->async_bio, 1);
       return true;
     case SSL_ERROR_WANT_WRITE:
       AsyncBioAllowWrite(test_state->async_bio, 1);
       return true;
     case SSL_ERROR_WANT_X509_LOOKUP:
       test_state->cert_ready = true;
       return true;
     case SSL_ERROR_PENDING_SESSION:
       test_state->session = std::move(test_state->pending_session);
       return true;
     case SSL_ERROR_PENDING_CERTIFICATE:
       test_state->early_callback_ready = true;
       return true;
     case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
       test_state->private_key_retries++;
       return true;
     case SSL_ERROR_WANT_CERTIFICATE_VERIFY:
       test_state->custom_verify_ready = true;
       return true;
     default:
       return false;
   }
 }

 int CheckIdempotentError(const char *name, SSL *ssl,
                          std::function<int()> func) {
   int ret = func();
   int ssl_err = SSL_get_error(ssl, ret);
   uint32_t err = ERR_peek_error();
   if (ssl_err == SSL_ERROR_SSL || ssl_err == SSL_ERROR_ZERO_RETURN) {
     int ret2 = func();
     int ssl_err2 = SSL_get_error(ssl, ret2);
     uint32_t err2 = ERR_peek_error();
     if (ret != ret2 || ssl_err != ssl_err2 || err != err2) {
       fprintf(stderr, "Repeating %s did not replay the error.\n", name);
       char buf[256];
       ERR_error_string_n(err, buf, sizeof(buf));
       fprintf(stderr, "Wanted: %d %d %s\n", ret, ssl_err, buf);
       ERR_error_string_n(err2, buf, sizeof(buf));
       fprintf(stderr, "Got:    %d %d %s\n", ret2, ssl_err2, buf);
       // runner treats exit code 90 as always failing. Otherwise, it may
       // accidentally consider the result an expected protocol failure.
       exit(90);
     }
   }
   return ret;
 }

 #if defined(HANDSHAKER_SUPPORTED)

 // MoveBIOs moves the |BIO|s of |src| to |dst|.  It is used for handoff.
 static void MoveBIOs(SSL *dest, SSL *src) {
   BIO *rbio = SSL_get_rbio(src);
   BIO_up_ref(rbio);
   SSL_set0_rbio(dest, rbio);

   BIO *wbio = SSL_get_wbio(src);
   BIO_up_ref(wbio);
   SSL_set0_wbio(dest, wbio);

   SSL_set0_rbio(src, nullptr);
   SSL_set0_wbio(src, nullptr);
 }

 static bool HandoffReady(SSL *ssl, int ret) {
   return ret < 0 && SSL_get_error(ssl, ret) == SSL_ERROR_HANDOFF;
 }

 static ssize_t read_eintr(int fd, void *out, size_t len) {
   ssize_t ret;
   do {
     ret = read(fd, out, len);
   } while (ret < 0 && errno == EINTR);
   return ret;
 }

 static ssize_t write_eintr(int fd, const void *in, size_t len) {
   ssize_t ret;
   do {
     ret = write(fd, in, len);
   } while (ret < 0 && errno == EINTR);
   return ret;
 }

 static ssize_t waitpid_eintr(pid_t pid, int *wstatus, int options) {
   pid_t ret;
   do {
     ret = waitpid(pid, wstatus, options);
   } while (ret < 0 && errno == EINTR);
   return ret;
 }

 // Proxy relays data between |socket|, which is connected to the client, and the
 // handshaker, which is connected to the numerically specified file descriptors,
 // until the handshaker returns control.
 static bool Proxy(BIO *socket, bool async, int control, int rfd, int wfd) {
   for (;;) {
     fd_set rfds;
     FD_ZERO(&rfds);
     FD_SET(wfd, &rfds);
     FD_SET(control, &rfds);
     int fd_max = wfd > control ? wfd : control;
     if (select(fd_max + 1, &rfds, nullptr, nullptr, nullptr) == -1) {
       perror("select");
       return false;
     }

     char buf[64];
     ssize_t bytes;
     if (FD_ISSET(wfd, &rfds) &&
         (bytes = read_eintr(wfd, buf, sizeof(buf))) > 0) {
       char *b = buf;
       while (bytes) {
         int written = BIO_write(socket, b, bytes);
         if (!written) {
           fprintf(stderr, "BIO_write wrote nothing\n");
           return false;
         }
         if (written < 0) {
           if (async) {
             AsyncBioAllowWrite(socket, 1);
             continue;
           }
           fprintf(stderr, "BIO_write failed\n");
           return false;
         }
         b += written;
         bytes -= written;
       }
       // Flush all pending data from the handshaker to the client before
       // considering control messages.
       continue;
     }

     if (!FD_ISSET(control, &rfds)) {
       continue;
     }

     char msg;
     if (read_eintr(control, &msg, 1) != 1) {
       perror("read");
       return false;
     }
     switch (msg) {
       case kControlMsgDone:
         return true;
       case kControlMsgError:
         return false;
       case kControlMsgWantRead:
         break;
       default:
         fprintf(stderr, "Unknown control message from handshaker: %c\n", msg);
         return false;
     }

     auto proxy_data = [&](uint8_t *out, size_t len) -> bool {
       if (async) {
         AsyncBioAllowRead(socket, len);
       }

       while (len > 0) {
         int bytes_read = BIO_read(socket, out, len);
         if (bytes_read < 1) {
           fprintf(stderr, "BIO_read failed\n");
           return false;
         }

         ssize_t bytes_written = write_eintr(rfd, out, bytes_read);
         if (bytes_written == -1) {
           perror("write");
           return false;
         }
         if (bytes_written != bytes_read) {
           fprintf(stderr, "short write (%zu of %d bytes)\n", bytes_written,
                   bytes_read);
           return false;
         }

         len -= bytes_read;
         out += bytes_read;
       }
       return true;
     };

     // Process one SSL record at a time.  That way, we don't send the handshaker
     // anything it doesn't want to process, e.g. early data.
     uint8_t header[SSL3_RT_HEADER_LENGTH];
     if (!proxy_data(header, sizeof(header))) {
       return false;
     }
     if (header[1] != 3) {
        fprintf(stderr, "bad header\n");
        return false;
     }
     size_t remaining = (header[3] << 8) + header[4];
     while (remaining > 0) {
       uint8_t readbuf[64];
       size_t len = remaining > sizeof(readbuf) ? sizeof(readbuf) : remaining;
       if (!proxy_data(readbuf, len)) {
         return false;
       }
       remaining -= len;
     }

     // The handshaker blocks on the control channel, so we have to signal
     // it that the data have been written.
     msg = kControlMsgWriteCompleted;
     if (write_eintr(control, &msg, 1) != 1) {
       perror("write");
       return false;
     }
   }
 }

 class ScopedFD {
  public:
   ScopedFD() : fd_(-1) {}
   explicit ScopedFD(int fd) : fd_(fd) {}
   ~ScopedFD() { Reset(); }

   ScopedFD(ScopedFD &&other) { *this = std::move(other); }
   ScopedFD &operator=(ScopedFD &&other) {
     Reset(other.fd_);
     other.fd_ = -1;
     return *this;
   }

   int fd() const { return fd_; }

   void Reset(int fd = -1) {
     if (fd_ >= 0) {
       close(fd_);
     }
     fd_ = fd;
   }

  private:
   int fd_;
 };

 class ScopedProcess {
  public:
   ScopedProcess() : pid_(-1) {}
   ~ScopedProcess() { Reset(); }

   ScopedProcess(ScopedProcess &&other) { *this = std::move(other); }
   ScopedProcess &operator=(ScopedProcess &&other) {
     Reset(other.pid_);
     other.pid_ = -1;
     return *this;
   }

   pid_t pid() const { return pid_; }

   void Reset(pid_t pid = -1) {
     if (pid_ >= 0) {
       kill(pid_, SIGTERM);
       int unused;
       Wait(&unused);
     }
     pid_ = pid;
   }

   bool Wait(int *out_status) {
     if (pid_ < 0) {
       return false;
     }
     if (waitpid_eintr(pid_, out_status, 0) != pid_) {
       return false;
     }
     pid_ = -1;
     return true;
   }

  private:
   pid_t pid_;
 };

 class FileActionsDestroyer {
  public:
   explicit FileActionsDestroyer(posix_spawn_file_actions_t *actions)
       : actions_(actions) {}
   ~FileActionsDestroyer() { posix_spawn_file_actions_destroy(actions_); }
   FileActionsDestroyer(const FileActionsDestroyer &) = delete;
   FileActionsDestroyer &operator=(const FileActionsDestroyer &) = delete;

  private:
   posix_spawn_file_actions_t *actions_;
 };

 // StartHandshaker starts the handshaker process and, on success, returns a
 // handle to the process in |*out|. It sets |*out_control| to a control pipe to
 // the process. |map_fds| maps from desired fd number in the child process to
 // the source fd in the calling process. |close_fds| is the list of additional
 // fds to close, which may overlap with |map_fds|. Other than stdin, stdout, and
 // stderr, the status of fds not listed in either set is undefined.
 static bool StartHandshaker(ScopedProcess *out, ScopedFD *out_control,
                             const TestConfig *config, bool is_resume,
                             std::map<int, int> map_fds,
                             std::vector<int> close_fds) {
   if (config->handshaker_path.empty()) {
     fprintf(stderr, "no -handshaker-path specified\n");
     return false;
   }
   struct stat dummy;
   if (stat(config->handshaker_path.c_str(), &dummy) == -1) {
     perror(config->handshaker_path.c_str());
     return false;
   }

   std::vector<const char *> args;
   args.push_back(config->handshaker_path.c_str());
   static const char kResumeFlag[] = "-handshaker-resume";
   if (is_resume) {
     args.push_back(kResumeFlag);
   }
   // config->argv omits argv[0].
   for (int j = 0; j < config->argc; ++j) {
     args.push_back(config->argv[j]);
   }
   args.push_back(nullptr);

   // A datagram socket guarantees that writes are all-or-nothing.
   int control[2];
   if (socketpair(AF_LOCAL, SOCK_DGRAM, 0, control) != 0) {
     perror("socketpair");
     return false;
   }
   ScopedFD scoped_control0(control[0]), scoped_control1(control[1]);
   close_fds.push_back(control[0]);
   map_fds[kFdControl] = control[1];

   posix_spawn_file_actions_t actions;
   if (posix_spawn_file_actions_init(&actions) != 0) {
     return false;
   }
   FileActionsDestroyer actions_destroyer(&actions);
   for (int fd : close_fds) {
     if (posix_spawn_file_actions_addclose(&actions, fd) != 0) {
       return false;
     }
   }
   if (!map_fds.empty()) {
     int max_fd = STDERR_FILENO;
     for (const auto &pair : map_fds) {
       max_fd = std::max(max_fd, pair.first);
       max_fd = std::max(max_fd, pair.second);
     }
     // |map_fds| may contain cycles, so make a copy of all the source fds.
     // |posix_spawn| can only use |dup2|, not |dup|, so we assume |max_fd| is
     // the last fd we care about inheriting. |temp_fds| maps from fd number in
     // the parent process to a temporary fd number in the child process.
     std::map<int, int> temp_fds;
     int next_fd = max_fd + 1;
     for (const auto &pair : map_fds) {
       if (temp_fds.count(pair.second)) {
         continue;
       }
       temp_fds[pair.second] = next_fd;
       if (posix_spawn_file_actions_adddup2(&actions, pair.second, next_fd) !=
           0 ||
           posix_spawn_file_actions_addclose(&actions, pair.second) != 0) {
         return false;
       }
       next_fd++;
     }
     for (const auto &pair : map_fds) {
       if (posix_spawn_file_actions_adddup2(&actions, temp_fds[pair.second],
                                            pair.first) != 0) {
         return false;
       }
     }
     // Clean up temporary fds.
     for (int fd = max_fd + 1; fd < next_fd; fd++) {
       if (posix_spawn_file_actions_addclose(&actions, fd) != 0) {
         return false;
       }
     }
   }

   fflush(stdout);
   fflush(stderr);

   // MSan doesn't know that |posix_spawn| initializes its output, so initialize
   // it to -1.
   pid_t pid = -1;
   if (posix_spawn(&pid, args[0], &actions, nullptr,
                   const_cast<char *const *>(args.data()), environ) != 0) {
     return false;
   }

   out->Reset(pid);
   *out_control = std::move(scoped_control0);
   return true;
 }

 // RunHandshaker forks and execs the handshaker binary, handing off |input|,
 // and, after proxying some amount of handshake traffic, handing back |out|.
 static bool RunHandshaker(BIO *bio, const TestConfig *config, bool is_resume,
                           Span<const uint8_t> input,
                           std::vector<uint8_t> *out) {
   int rfd[2], wfd[2];
   // We use pipes, rather than some other mechanism, for their buffers.  During
   // the handshake, this process acts as a dumb proxy until receiving the
   // handback signal, which arrives asynchronously.  The race condition means
   // that this process could incorrectly proxy post-handshake data from the
   // client to the handshaker.
   //
   // To avoid this, this process never proxies data to the handshaker that the
   // handshaker has not explicitly requested as a result of hitting
   // |SSL_ERROR_WANT_READ|.  Pipes allow the data to sit in a buffer while the
   // two processes synchronize over the |control| channel.
   if (pipe(rfd) != 0) {
     perror("pipe");
     return false;
   }
   ScopedFD rfd0_closer(rfd[0]), rfd1_closer(rfd[1]);

   if (pipe(wfd) != 0) {
     perror("pipe");
     return false;
   }
   ScopedFD wfd0_closer(wfd[0]), wfd1_closer(wfd[1]);

   ScopedProcess handshaker;
   ScopedFD control;
   if (!StartHandshaker(
           &handshaker, &control, config, is_resume,
           {{kFdProxyToHandshaker, rfd[0]}, {kFdHandshakerToProxy, wfd[1]}},
           {rfd[1], wfd[0]})) {
     return false;
   }

   rfd0_closer.Reset();
   wfd1_closer.Reset();

   if (write_eintr(control.fd(), input.data(), input.size()) == -1) {
     perror("write");
     return false;
   }
   bool ok = Proxy(bio, config->async, control.fd(), rfd[1], wfd[0]);
   int wstatus;
   if (!handshaker.Wait(&wstatus)) {
     perror("waitpid");
     return false;
   }
   if (ok && wstatus) {
     fprintf(stderr, "handshaker exited irregularly\n");
     return false;
   }
   if (!ok) {
     return false;  // This is a "good", i.e. expected, error.
   }

   constexpr size_t kBufSize = 1024 * 1024;
   std::vector<uint8_t> buf(kBufSize);
   ssize_t len = read_eintr(control.fd(), buf.data(), buf.size());
   if (len == -1) {
     perror("read");
     return false;
   }
   buf.resize(len);
   *out = std::move(buf);
   return true;
 }

 static bool RequestHandshakeHint(const TestConfig *config, bool is_resume,
                                  Span<const uint8_t> input, bool *out_has_hints,
                                  std::vector<uint8_t> *out_hints) {
   ScopedProcess handshaker;
   ScopedFD control;
   if (!StartHandshaker(&handshaker, &control, config, is_resume, {}, {})) {
     return false;
   }

   if (write_eintr(control.fd(), input.data(), input.size()) == -1) {
     perror("write");
     return false;
   }

   char msg;
   if (read_eintr(control.fd(), &msg, 1) != 1) {
     perror("read");
     return false;
   }

   switch (msg) {
     case kControlMsgDone: {
       constexpr size_t kBufSize = 1024 * 1024;
       out_hints->resize(kBufSize);
       ssize_t len =
           read_eintr(control.fd(), out_hints->data(), out_hints->size());
       if (len == -1) {
         perror("read");
         return false;
       }
       out_hints->resize(len);
       *out_has_hints = true;
       break;
     }
     case kControlMsgError:
       *out_has_hints = false;
       break;
     default:
       fprintf(stderr, "Unknown control message from handshaker: %c\n", msg);
       return false;
   }

   int wstatus;
   if (!handshaker.Wait(&wstatus)) {
     perror("waitpid");
     return false;
   }
   if (wstatus) {
     fprintf(stderr, "handshaker exited irregularly\n");
     return false;
   }

   return true;
 }

 // PrepareHandoff accepts the |ClientHello| from |ssl| and serializes state to
 // be passed to the handshaker.  The serialized state includes both the SSL
 // handoff, as well test-related state.
 static bool PrepareHandoff(SSL *ssl, SettingsWriter *writer,
                            std::vector<uint8_t> *out_handoff) {
   SSL_set_handoff_mode(ssl, 1);

   const TestConfig *config = GetTestConfig(ssl);
   int ret = -1;
   do {
     ret = CheckIdempotentError(
         "SSL_do_handshake", ssl,
         [&]() -> int { return SSL_do_handshake(ssl); });
   } while (!HandoffReady(ssl, ret) &&
            config->async &&
            RetryAsync(ssl, ret));
   if (!HandoffReady(ssl, ret)) {
     fprintf(stderr, "Handshake failed while waiting for handoff.\n");
     return false;
   }

   ScopedCBB cbb;
   SSL_CLIENT_HELLO hello;
   if (!CBB_init(cbb.get(), 512) ||
       !SSL_serialize_handoff(ssl, cbb.get(), &hello) ||
       !writer->WriteHandoff({CBB_data(cbb.get()), CBB_len(cbb.get())}) ||
       !SerializeContextState(SSL_get_SSL_CTX(ssl), cbb.get()) ||
       !GetTestState(ssl)->Serialize(cbb.get())) {
     fprintf(stderr, "Handoff serialisation failed.\n");
     return false;
   }
   out_handoff->assign(CBB_data(cbb.get()),
                       CBB_data(cbb.get()) + CBB_len(cbb.get()));
   return true;
 }

 // DoSplitHandshake delegates the SSL handshake to a separate process, called
 // the handshaker.  This process proxies I/O between the handshaker and the
 // client, using the |BIO| from |ssl|.  After a successful handshake, |ssl| is
 // replaced with a new |SSL| object, in a way that is intended to be invisible
 // to the caller.
 bool DoSplitHandshake(UniquePtr<SSL> *ssl, SettingsWriter *writer,
                       bool is_resume) {
   assert(SSL_get_rbio(ssl->get()) == SSL_get_wbio(ssl->get()));
   std::vector<uint8_t> handshaker_input;
   const TestConfig *config = GetTestConfig(ssl->get());
   // out is the response from the handshaker, which includes a serialized
   // handback message, but also serialized updates to the |TestState|.
   std::vector<uint8_t> out;
   if (!PrepareHandoff(ssl->get(), writer, &handshaker_input) ||
       !RunHandshaker(SSL_get_rbio(ssl->get()), config, is_resume,
                      handshaker_input, &out)) {
     fprintf(stderr, "Handoff failed.\n");
     return false;
   }

   SSL_CTX *ctx = SSL_get_SSL_CTX(ssl->get());
   UniquePtr<SSL> ssl_handback = config->NewSSL(ctx, nullptr, nullptr);
   if (!ssl_handback) {
     return false;
   }
   CBS output, handback;
   CBS_init(&output, out.data(), out.size());
   if (!CBS_get_u24_length_prefixed(&output, &handback) ||
       !DeserializeContextState(&output, ctx) ||
       !SetTestState(ssl_handback.get(), TestState::Deserialize(&output, ctx)) ||
       !GetTestState(ssl_handback.get()) || !writer->WriteHandback(handback) ||
       !SSL_apply_handback(ssl_handback.get(), handback)) {
     fprintf(stderr, "Handback failed.\n");
     return false;
   }
   MoveBIOs(ssl_handback.get(), ssl->get());
   GetTestState(ssl_handback.get())->async_bio =
       GetTestState(ssl->get())->async_bio;
   GetTestState(ssl->get())->async_bio = nullptr;

   *ssl = std::move(ssl_handback);
   return true;
 }

 bool GetHandshakeHint(SSL *ssl, SettingsWriter *writer, bool is_resume,
                       const SSL_CLIENT_HELLO *client_hello) {
   ScopedCBB input;
   CBB child;
   if (!CBB_init(input.get(), client_hello->client_hello_len + 256) ||
       !CBB_add_u24_length_prefixed(input.get(), &child) ||
       !CBB_add_bytes(&child, client_hello->client_hello,
                      client_hello->client_hello_len) ||
       !CBB_add_u24_length_prefixed(input.get(), &child) ||
       !SSL_serialize_capabilities(ssl, &child) ||  //
       !CBB_flush(input.get())) {
     return false;
   }

   bool has_hints;
   std::vector<uint8_t> hints;
   if (!RequestHandshakeHint(
           GetTestConfig(ssl), is_resume,
           MakeConstSpan(CBB_data(input.get()), CBB_len(input.get())),
           &has_hints, &hints)) {
     return false;
   }
   if (has_hints &&
       (!writer->WriteHints(hints) ||
        !SSL_set_handshake_hints(ssl, hints.data(), hints.size()))) {
     return false;
   }

   return true;
 }

 #endif  // defined(HANDSHAKER_SUPPORTED)
	/* Copyright (c) 2018, Google Inc.
	*
	* Permission to use, copy, modify, and/or distribute this software for any
	* purpose with or without fee is hereby granted, provided that the above
	* copyright notice and this permission notice appear in all copies.
	*
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
	* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
	* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
	* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

	#include "handshake_util.h"

	#include <assert.h>
	#if defined(HANDSHAKER_SUPPORTED)
	#include <errno.h>
	#include <fcntl.h>
	#include <spawn.h>
	#include <sys/socket.h>
	#include <sys/stat.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#include <unistd.h>
	#endif

	#include <functional>
	#include <map>
	#include <vector>

	#include "async_bio.h"
	#include "packeted_bio.h"
	#include "test_config.h"
	#include "test_state.h"

	#include <openssl/bytestring.h>
	#include <openssl/ssl.h>

	using namespace bssl;

	bool RetryAsync(SSL *ssl, int ret) {
	const TestConfig *config = GetTestConfig(ssl);
	TestState *test_state = GetTestState(ssl);
	if (ret >= 0) {
	return false;
	}

	int ssl_err = SSL_get_error(ssl, ret);
	if (ssl_err == SSL_ERROR_WANT_RENEGOTIATE && config->renegotiate_explicit) {
	test_state->explicit_renegotiates++;
	return SSL_renegotiate(ssl);
	}

	if (test_state->quic_transport && ssl_err == SSL_ERROR_WANT_READ) {
	return test_state->quic_transport->ReadHandshake();
	}

	if (!config->async) {
	// Only asynchronous tests should trigger other retries.
	return false;
	}

	if (test_state->packeted_bio != nullptr &&
	PacketedBioAdvanceClock(test_state->packeted_bio)) {
	// The DTLS retransmit logic silently ignores write failures. So the test
	// may progress, allow writes through synchronously.
	AsyncBioEnforceWriteQuota(test_state->async_bio, false);
	int timeout_ret = DTLSv1_handle_timeout(ssl);
	AsyncBioEnforceWriteQuota(test_state->async_bio, true);

	if (timeout_ret < 0) {
	fprintf(stderr, "Error retransmitting.\n");
	return false;
	}
	return true;
	}

	// See if we needed to read or write more. If so, allow one byte through on
	// the appropriate end to maximally stress the state machine.
	switch (ssl_err) {
	case SSL_ERROR_WANT_READ:
	AsyncBioAllowRead(test_state->async_bio, 1);
	return true;
	case SSL_ERROR_WANT_WRITE:
	AsyncBioAllowWrite(test_state->async_bio, 1);
	return true;
	case SSL_ERROR_WANT_X509_LOOKUP:
	test_state->cert_ready = true;
	return true;
	case SSL_ERROR_PENDING_SESSION:
	test_state->session = std::move(test_state->pending_session);
	return true;
	case SSL_ERROR_PENDING_CERTIFICATE:
	test_state->early_callback_ready = true;
	return true;
	case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
	test_state->private_key_retries++;
	return true;
	case SSL_ERROR_WANT_CERTIFICATE_VERIFY:
	test_state->custom_verify_ready = true;
	return true;
	default:
	return false;
	}
	}

	int CheckIdempotentError(const char name, SSL ssl,
	std::function<int()> func) {
	int ret = func();
	int ssl_err = SSL_get_error(ssl, ret);
	uint32_t err = ERR_peek_error();
	if (ssl_err == SSL_ERROR_SSL \|\| ssl_err == SSL_ERROR_ZERO_RETURN) {
	int ret2 = func();
	int ssl_err2 = SSL_get_error(ssl, ret2);
	uint32_t err2 = ERR_peek_error();
	if (ret != ret2 \|\| ssl_err != ssl_err2 \|\| err != err2) {
	fprintf(stderr, "Repeating %s did not replay the error.\n", name);
	char buf[256];
	ERR_error_string_n(err, buf, sizeof(buf));
	fprintf(stderr, "Wanted: %d %d %s\n", ret, ssl_err, buf);
	ERR_error_string_n(err2, buf, sizeof(buf));
	fprintf(stderr, "Got: %d %d %s\n", ret2, ssl_err2, buf);
	// runner treats exit code 90 as always failing. Otherwise, it may
	// accidentally consider the result an expected protocol failure.
	exit(90);
	}
	}
	return ret;
	}

	#if defined(HANDSHAKER_SUPPORTED)

	// MoveBIOs moves the \|BIO\|s of \|src\| to \|dst\|. It is used for handoff.
	static void MoveBIOs(SSL dest, SSL src) {
	BIO *rbio = SSL_get_rbio(src);
	BIO_up_ref(rbio);
	SSL_set0_rbio(dest, rbio);

	BIO *wbio = SSL_get_wbio(src);
	BIO_up_ref(wbio);
	SSL_set0_wbio(dest, wbio);

	SSL_set0_rbio(src, nullptr);
	SSL_set0_wbio(src, nullptr);
	}

	static bool HandoffReady(SSL *ssl, int ret) {
	return ret < 0 && SSL_get_error(ssl, ret) == SSL_ERROR_HANDOFF;
	}

	static ssize_t read_eintr(int fd, void *out, size_t len) {
	ssize_t ret;
	do {
	ret = read(fd, out, len);
	} while (ret < 0 && errno == EINTR);
	return ret;
	}

	static ssize_t write_eintr(int fd, const void *in, size_t len) {
	ssize_t ret;
	do {
	ret = write(fd, in, len);
	} while (ret < 0 && errno == EINTR);
	return ret;
	}

	static ssize_t waitpid_eintr(pid_t pid, int *wstatus, int options) {
	pid_t ret;
	do {
	ret = waitpid(pid, wstatus, options);
	} while (ret < 0 && errno == EINTR);
	return ret;
	}

	// Proxy relays data between \|socket\|, which is connected to the client, and the
	// handshaker, which is connected to the numerically specified file descriptors,
	// until the handshaker returns control.
	static bool Proxy(BIO *socket, bool async, int control, int rfd, int wfd) {
	for (;;) {
	fd_set rfds;
	FD_ZERO(&rfds);
	FD_SET(wfd, &rfds);
	FD_SET(control, &rfds);
	int fd_max = wfd > control ? wfd : control;
	if (select(fd_max + 1, &rfds, nullptr, nullptr, nullptr) == -1) {
	perror("select");
	return false;
	}

	char buf[64];
	ssize_t bytes;
	if (FD_ISSET(wfd, &rfds) &&
	(bytes = read_eintr(wfd, buf, sizeof(buf))) > 0) {
	char *b = buf;
	while (bytes) {
	int written = BIO_write(socket, b, bytes);
	if (!written) {
	fprintf(stderr, "BIO_write wrote nothing\n");
	return false;
	}
	if (written < 0) {
	if (async) {
	AsyncBioAllowWrite(socket, 1);
	continue;
	}
	fprintf(stderr, "BIO_write failed\n");
	return false;
	}
	b += written;
	bytes -= written;
	}
	// Flush all pending data from the handshaker to the client before
	// considering control messages.
	continue;
	}

	if (!FD_ISSET(control, &rfds)) {
	continue;
	}

	char msg;
	if (read_eintr(control, &msg, 1) != 1) {
	perror("read");
	return false;
	}
	switch (msg) {
	case kControlMsgDone:
	return true;
	case kControlMsgError:
	return false;
	case kControlMsgWantRead:
	break;
	default:
	fprintf(stderr, "Unknown control message from handshaker: %c\n", msg);
	return false;
	}

	auto proxy_data = [&](uint8_t *out, size_t len) -> bool {
	if (async) {
	AsyncBioAllowRead(socket, len);
	}

	while (len > 0) {
	int bytes_read = BIO_read(socket, out, len);
	if (bytes_read < 1) {
	fprintf(stderr, "BIO_read failed\n");
	return false;
	}

	ssize_t bytes_written = write_eintr(rfd, out, bytes_read);
	if (bytes_written == -1) {
	perror("write");
	return false;
	}
	if (bytes_written != bytes_read) {
	fprintf(stderr, "short write (%zu of %d bytes)\n", bytes_written,
	bytes_read);
	return false;
	}

	len -= bytes_read;
	out += bytes_read;
	}
	return true;
	};

	// Process one SSL record at a time. That way, we don't send the handshaker
	// anything it doesn't want to process, e.g. early data.
	uint8_t header[SSL3_RT_HEADER_LENGTH];
	if (!proxy_data(header, sizeof(header))) {
	return false;
	}
	if (header[1] != 3) {
	fprintf(stderr, "bad header\n");
	return false;
	}
	size_t remaining = (header[3] << 8) + header[4];
	while (remaining > 0) {
	uint8_t readbuf[64];
	size_t len = remaining > sizeof(readbuf) ? sizeof(readbuf) : remaining;
	if (!proxy_data(readbuf, len)) {
	return false;
	}
	remaining -= len;
	}

	// The handshaker blocks on the control channel, so we have to signal
	// it that the data have been written.
	msg = kControlMsgWriteCompleted;
	if (write_eintr(control, &msg, 1) != 1) {
	perror("write");
	return false;
	}
	}
	}

	class ScopedFD {
	public:
	ScopedFD() : fd_(-1) {}
	explicit ScopedFD(int fd) : fd_(fd) {}
	~ScopedFD() { Reset(); }

	ScopedFD(ScopedFD &&other) { *this = std::move(other); }
	ScopedFD &operator=(ScopedFD &&other) {
	Reset(other.fd_);
	other.fd_ = -1;
	return *this;
	}

	int fd() const { return fd_; }

	void Reset(int fd = -1) {
	if (fd_ >= 0) {
	close(fd_);
	}
	fd_ = fd;
	}

	private:
	int fd_;
	};

	class ScopedProcess {
	public:
	ScopedProcess() : pid_(-1) {}
	~ScopedProcess() { Reset(); }

	ScopedProcess(ScopedProcess &&other) { *this = std::move(other); }
	ScopedProcess &operator=(ScopedProcess &&other) {
	Reset(other.pid_);
	other.pid_ = -1;
	return *this;
	}

	pid_t pid() const { return pid_; }

	void Reset(pid_t pid = -1) {
	if (pid_ >= 0) {
	kill(pid_, SIGTERM);
	int unused;
	Wait(&unused);
	}
	pid_ = pid;
	}

	bool Wait(int *out_status) {
	if (pid_ < 0) {
	return false;
	}
	if (waitpid_eintr(pid_, out_status, 0) != pid_) {
	return false;
	}
	pid_ = -1;
	return true;
	}

	private:
	pid_t pid_;
	};

	class FileActionsDestroyer {
	public:
	explicit FileActionsDestroyer(posix_spawn_file_actions_t *actions)
	: actions_(actions) {}
	~FileActionsDestroyer() { posix_spawn_file_actions_destroy(actions_); }
	FileActionsDestroyer(const FileActionsDestroyer &) = delete;
	FileActionsDestroyer &operator=(const FileActionsDestroyer &) = delete;

	private:
	posix_spawn_file_actions_t *actions_;
	};

	// StartHandshaker starts the handshaker process and, on success, returns a
	// handle to the process in \|out\|. It sets \|out_control\| to a control pipe to
	// the process. \|map_fds\| maps from desired fd number in the child process to
	// the source fd in the calling process. \|close_fds\| is the list of additional
	// fds to close, which may overlap with \|map_fds\|. Other than stdin, stdout, and
	// stderr, the status of fds not listed in either set is undefined.
	static bool StartHandshaker(ScopedProcess out, ScopedFD out_control,
	const TestConfig *config, bool is_resume,
	std::map<int, int> map_fds,
	std::vector<int> close_fds) {
	if (config->handshaker_path.empty()) {
	fprintf(stderr, "no -handshaker-path specified\n");
	return false;
	}
	struct stat dummy;
	if (stat(config->handshaker_path.c_str(), &dummy) == -1) {
	perror(config->handshaker_path.c_str());
	return false;
	}

	std::vector<const char *> args;
	args.push_back(config->handshaker_path.c_str());
	static const char kResumeFlag[] = "-handshaker-resume";
	if (is_resume) {
	args.push_back(kResumeFlag);
	}
	// config->argv omits argv[0].
	for (int j = 0; j < config->argc; ++j) {
	args.push_back(config->argv[j]);
	}
	args.push_back(nullptr);

	// A datagram socket guarantees that writes are all-or-nothing.
	int control[2];
	if (socketpair(AF_LOCAL, SOCK_DGRAM, 0, control) != 0) {
	perror("socketpair");
	return false;
	}
	ScopedFD scoped_control0(control[0]), scoped_control1(control[1]);
	close_fds.push_back(control[0]);
	map_fds[kFdControl] = control[1];

	posix_spawn_file_actions_t actions;
	if (posix_spawn_file_actions_init(&actions) != 0) {
	return false;
	}
	FileActionsDestroyer actions_destroyer(&actions);
	for (int fd : close_fds) {
	if (posix_spawn_file_actions_addclose(&actions, fd) != 0) {
	return false;
	}
	}
	if (!map_fds.empty()) {
	int max_fd = STDERR_FILENO;
	for (const auto &pair : map_fds) {
	max_fd = std::max(max_fd, pair.first);
	max_fd = std::max(max_fd, pair.second);
	}
	// \|map_fds\| may contain cycles, so make a copy of all the source fds.
	// \|posix_spawn\| can only use \|dup2\|, not \|dup\|, so we assume \|max_fd\| is
	// the last fd we care about inheriting. \|temp_fds\| maps from fd number in
	// the parent process to a temporary fd number in the child process.
	std::map<int, int> temp_fds;
	int next_fd = max_fd + 1;
	for (const auto &pair : map_fds) {
	if (temp_fds.count(pair.second)) {
	continue;
	}
	temp_fds[pair.second] = next_fd;
	if (posix_spawn_file_actions_adddup2(&actions, pair.second, next_fd) !=
	0 \|\|
	posix_spawn_file_actions_addclose(&actions, pair.second) != 0) {
	return false;
	}
	next_fd++;
	}
	for (const auto &pair : map_fds) {
	if (posix_spawn_file_actions_adddup2(&actions, temp_fds[pair.second],
	pair.first) != 0) {
	return false;
	}
	}
	// Clean up temporary fds.
	for (int fd = max_fd + 1; fd < next_fd; fd++) {
	if (posix_spawn_file_actions_addclose(&actions, fd) != 0) {
	return false;
	}
	}
	}

	fflush(stdout);
	fflush(stderr);

	// MSan doesn't know that \|posix_spawn\| initializes its output, so initialize
	// it to -1.
	pid_t pid = -1;
	if (posix_spawn(&pid, args[0], &actions, nullptr,
	const_cast<char const >(args.data()), environ) != 0) {
	return false;
	}

	out->Reset(pid);
	*out_control = std::move(scoped_control0);
	return true;
	}

	// RunHandshaker forks and execs the handshaker binary, handing off \|input\|,
	// and, after proxying some amount of handshake traffic, handing back \|out\|.
	static bool RunHandshaker(BIO bio, const TestConfig config, bool is_resume,
	Span<const uint8_t> input,
	std::vector<uint8_t> *out) {
	int rfd[2], wfd[2];
	// We use pipes, rather than some other mechanism, for their buffers. During
	// the handshake, this process acts as a dumb proxy until receiving the
	// handback signal, which arrives asynchronously. The race condition means
	// that this process could incorrectly proxy post-handshake data from the
	// client to the handshaker.
	//
	// To avoid this, this process never proxies data to the handshaker that the
	// handshaker has not explicitly requested as a result of hitting
	// \|SSL_ERROR_WANT_READ\|. Pipes allow the data to sit in a buffer while the
	// two processes synchronize over the \|control\| channel.
	if (pipe(rfd) != 0) {
	perror("pipe");
	return false;
	}
	ScopedFD rfd0_closer(rfd[0]), rfd1_closer(rfd[1]);

	if (pipe(wfd) != 0) {
	perror("pipe");
	return false;
	}
	ScopedFD wfd0_closer(wfd[0]), wfd1_closer(wfd[1]);

	ScopedProcess handshaker;
	ScopedFD control;
	if (!StartHandshaker(
	&handshaker, &control, config, is_resume,
	{{kFdProxyToHandshaker, rfd[0]}, {kFdHandshakerToProxy, wfd[1]}},
	{rfd[1], wfd[0]})) {
	return false;
	}

	rfd0_closer.Reset();
	wfd1_closer.Reset();

	if (write_eintr(control.fd(), input.data(), input.size()) == -1) {
	perror("write");
	return false;
	}
	bool ok = Proxy(bio, config->async, control.fd(), rfd[1], wfd[0]);
	int wstatus;
	if (!handshaker.Wait(&wstatus)) {
	perror("waitpid");
	return false;
	}
	if (ok && wstatus) {
	fprintf(stderr, "handshaker exited irregularly\n");
	return false;
	}
	if (!ok) {
	return false; // This is a "good", i.e. expected, error.
	}

	constexpr size_t kBufSize = 1024 * 1024;
	std::vector<uint8_t> buf(kBufSize);
	ssize_t len = read_eintr(control.fd(), buf.data(), buf.size());
	if (len == -1) {
	perror("read");
	return false;
	}
	buf.resize(len);
	*out = std::move(buf);
	return true;
	}

	static bool RequestHandshakeHint(const TestConfig *config, bool is_resume,
	Span<const uint8_t> input, bool *out_has_hints,
	std::vector<uint8_t> *out_hints) {
	ScopedProcess handshaker;
	ScopedFD control;
	if (!StartHandshaker(&handshaker, &control, config, is_resume, {}, {})) {
	return false;
	}

	if (write_eintr(control.fd(), input.data(), input.size()) == -1) {
	perror("write");
	return false;
	}

	char msg;
	if (read_eintr(control.fd(), &msg, 1) != 1) {
	perror("read");
	return false;
	}

	switch (msg) {
	case kControlMsgDone: {
	constexpr size_t kBufSize = 1024 * 1024;
	out_hints->resize(kBufSize);
	ssize_t len =
	read_eintr(control.fd(), out_hints->data(), out_hints->size());
	if (len == -1) {
	perror("read");
	return false;
	}
	out_hints->resize(len);
	*out_has_hints = true;
	break;
	}
	case kControlMsgError:
	*out_has_hints = false;
	break;
	default:
	fprintf(stderr, "Unknown control message from handshaker: %c\n", msg);
	return false;
	}

	int wstatus;
	if (!handshaker.Wait(&wstatus)) {
	perror("waitpid");
	return false;
	}
	if (wstatus) {
	fprintf(stderr, "handshaker exited irregularly\n");
	return false;
	}

	return true;
	}

	// PrepareHandoff accepts the \|ClientHello\| from \|ssl\| and serializes state to
	// be passed to the handshaker. The serialized state includes both the SSL
	// handoff, as well test-related state.
	static bool PrepareHandoff(SSL ssl, SettingsWriter writer,
	std::vector<uint8_t> *out_handoff) {
	SSL_set_handoff_mode(ssl, 1);

	const TestConfig *config = GetTestConfig(ssl);
	int ret = -1;
	do {
	ret = CheckIdempotentError(
	"SSL_do_handshake", ssl,
	[&]() -> int { return SSL_do_handshake(ssl); });
	} while (!HandoffReady(ssl, ret) &&
	config->async &&
	RetryAsync(ssl, ret));
	if (!HandoffReady(ssl, ret)) {
	fprintf(stderr, "Handshake failed while waiting for handoff.\n");
	return false;
	}

	ScopedCBB cbb;
	SSL_CLIENT_HELLO hello;
	if (!CBB_init(cbb.get(), 512) \|\|
	!SSL_serialize_handoff(ssl, cbb.get(), &hello) \|\|
	!writer->WriteHandoff({CBB_data(cbb.get()), CBB_len(cbb.get())}) \|\|
	!SerializeContextState(SSL_get_SSL_CTX(ssl), cbb.get()) \|\|
	!GetTestState(ssl)->Serialize(cbb.get())) {
	fprintf(stderr, "Handoff serialisation failed.\n");
	return false;
	}
	out_handoff->assign(CBB_data(cbb.get()),
	CBB_data(cbb.get()) + CBB_len(cbb.get()));
	return true;
	}

	// DoSplitHandshake delegates the SSL handshake to a separate process, called
	// the handshaker. This process proxies I/O between the handshaker and the
	// client, using the \|BIO\| from \|ssl\|. After a successful handshake, \|ssl\| is
	// replaced with a new \|SSL\| object, in a way that is intended to be invisible
	// to the caller.
	bool DoSplitHandshake(UniquePtr<SSL> ssl, SettingsWriter writer,
	bool is_resume) {
	assert(SSL_get_rbio(ssl->get()) == SSL_get_wbio(ssl->get()));
	std::vector<uint8_t> handshaker_input;
	const TestConfig *config = GetTestConfig(ssl->get());
	// out is the response from the handshaker, which includes a serialized
	// handback message, but also serialized updates to the \|TestState\|.
	std::vector<uint8_t> out;
	if (!PrepareHandoff(ssl->get(), writer, &handshaker_input) \|\|
	!RunHandshaker(SSL_get_rbio(ssl->get()), config, is_resume,
	handshaker_input, &out)) {
	fprintf(stderr, "Handoff failed.\n");
	return false;
	}

	SSL_CTX *ctx = SSL_get_SSL_CTX(ssl->get());
	UniquePtr<SSL> ssl_handback = config->NewSSL(ctx, nullptr, nullptr);
	if (!ssl_handback) {
	return false;
	}
	CBS output, handback;
	CBS_init(&output, out.data(), out.size());
	if (!CBS_get_u24_length_prefixed(&output, &handback) \|\|
	!DeserializeContextState(&output, ctx) \|\|
	!SetTestState(ssl_handback.get(), TestState::Deserialize(&output, ctx)) \|\|
	!GetTestState(ssl_handback.get()) \|\| !writer->WriteHandback(handback) \|\|
	!SSL_apply_handback(ssl_handback.get(), handback)) {
	fprintf(stderr, "Handback failed.\n");
	return false;
	}
	MoveBIOs(ssl_handback.get(), ssl->get());
	GetTestState(ssl_handback.get())->async_bio =
	GetTestState(ssl->get())->async_bio;
	GetTestState(ssl->get())->async_bio = nullptr;

	*ssl = std::move(ssl_handback);
	return true;
	}

	bool GetHandshakeHint(SSL ssl, SettingsWriter writer, bool is_resume,
	const SSL_CLIENT_HELLO *client_hello) {
	ScopedCBB input;
	CBB child;
	if (!CBB_init(input.get(), client_hello->client_hello_len + 256) \|\|
	!CBB_add_u24_length_prefixed(input.get(), &child) \|\|
	!CBB_add_bytes(&child, client_hello->client_hello,
	client_hello->client_hello_len) \|\|
	!CBB_add_u24_length_prefixed(input.get(), &child) \|\|
	!SSL_serialize_capabilities(ssl, &child) \|\| //
	!CBB_flush(input.get())) {
	return false;
	}

	bool has_hints;
	std::vector<uint8_t> hints;
	if (!RequestHandshakeHint(
	GetTestConfig(ssl), is_resume,
	MakeConstSpan(CBB_data(input.get()), CBB_len(input.get())),
	&has_hints, &hints)) {
	return false;
	}
	if (has_hints &&
	(!writer->WriteHints(hints) \|\|
	!SSL_set_handshake_hints(ssl, hints.data(), hints.size()))) {
	return false;
	}

	return true;
	}

	#endif // defined(HANDSHAKER_SUPPORTED)