1 /*
2 * nghttp2 - HTTP/2 C Library
3 *
4 * Copyright (c) 2015 Tatsuhiro Tsujikawa
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining
7 * a copy of this software and associated documentation files (the
8 * "Software"), to deal in the Software without restriction, including
9 * without limitation the rights to use, copy, modify, merge, publish,
10 * distribute, sublicense, and/or sell copies of the Software, and to
11 * permit persons to whom the Software is furnished to do so, subject to
12 * the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be
15 * included in all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
18 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
19 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
20 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
21 * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
22 * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
23 * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
24 */
25 #include "shrpx_mruby_module_env.h"
26
27 #include <mruby/variable.h>
28 #include <mruby/string.h>
29 #include <mruby/hash.h>
30
31 #include "shrpx_downstream.h"
32 #include "shrpx_upstream.h"
33 #include "shrpx_client_handler.h"
34 #include "shrpx_mruby.h"
35 #include "shrpx_mruby_module.h"
36 #include "shrpx_log.h"
37 #include "shrpx_tls.h"
38
39 namespace shrpx {
40
41 namespace mruby {
42
43 namespace {
env_init(mrb_state * mrb,mrb_value self)44 mrb_value env_init(mrb_state *mrb, mrb_value self) { return self; }
45 } // namespace
46
47 namespace {
env_get_req(mrb_state * mrb,mrb_value self)48 mrb_value env_get_req(mrb_state *mrb, mrb_value self) {
49 return mrb_iv_get(mrb, self, mrb_intern_lit(mrb, "req"));
50 }
51 } // namespace
52
53 namespace {
env_get_resp(mrb_state * mrb,mrb_value self)54 mrb_value env_get_resp(mrb_state *mrb, mrb_value self) {
55 return mrb_iv_get(mrb, self, mrb_intern_lit(mrb, "resp"));
56 }
57 } // namespace
58
59 namespace {
env_get_ctx(mrb_state * mrb,mrb_value self)60 mrb_value env_get_ctx(mrb_state *mrb, mrb_value self) {
61 auto data = reinterpret_cast<MRubyAssocData *>(mrb->ud);
62 auto downstream = data->downstream;
63
64 auto dsym = intern_ptr(mrb, downstream);
65
66 auto ctx = mrb_iv_get(mrb, self, dsym);
67 if (mrb_nil_p(ctx)) {
68 ctx = mrb_hash_new(mrb);
69 mrb_iv_set(mrb, self, dsym, ctx);
70 }
71
72 return ctx;
73 }
74 } // namespace
75
76 namespace {
env_get_phase(mrb_state * mrb,mrb_value self)77 mrb_value env_get_phase(mrb_state *mrb, mrb_value self) {
78 auto data = static_cast<MRubyAssocData *>(mrb->ud);
79
80 return mrb_fixnum_value(data->phase);
81 }
82 } // namespace
83
84 namespace {
env_get_remote_addr(mrb_state * mrb,mrb_value self)85 mrb_value env_get_remote_addr(mrb_state *mrb, mrb_value self) {
86 auto data = static_cast<MRubyAssocData *>(mrb->ud);
87 auto downstream = data->downstream;
88 auto upstream = downstream->get_upstream();
89 auto handler = upstream->get_client_handler();
90
91 auto &ipaddr = handler->get_ipaddr();
92
93 return mrb_str_new(mrb, ipaddr.c_str(), ipaddr.size());
94 }
95 } // namespace
96
97 namespace {
env_get_server_port(mrb_state * mrb,mrb_value self)98 mrb_value env_get_server_port(mrb_state *mrb, mrb_value self) {
99 auto data = static_cast<MRubyAssocData *>(mrb->ud);
100 auto downstream = data->downstream;
101 auto upstream = downstream->get_upstream();
102 auto handler = upstream->get_client_handler();
103 auto faddr = handler->get_upstream_addr();
104
105 return mrb_fixnum_value(faddr->port);
106 }
107 } // namespace
108
109 namespace {
env_get_server_addr(mrb_state * mrb,mrb_value self)110 mrb_value env_get_server_addr(mrb_state *mrb, mrb_value self) {
111 auto data = static_cast<MRubyAssocData *>(mrb->ud);
112 auto downstream = data->downstream;
113 auto upstream = downstream->get_upstream();
114 auto handler = upstream->get_client_handler();
115 auto faddr = handler->get_upstream_addr();
116
117 return mrb_str_new(mrb, faddr->host.c_str(), faddr->host.size());
118 }
119 } // namespace
120
121 namespace {
env_get_tls_used(mrb_state * mrb,mrb_value self)122 mrb_value env_get_tls_used(mrb_state *mrb, mrb_value self) {
123 auto data = static_cast<MRubyAssocData *>(mrb->ud);
124 auto downstream = data->downstream;
125 auto upstream = downstream->get_upstream();
126 auto handler = upstream->get_client_handler();
127
128 return handler->get_ssl() ? mrb_true_value() : mrb_false_value();
129 }
130 } // namespace
131
132 namespace {
env_get_tls_sni(mrb_state * mrb,mrb_value self)133 mrb_value env_get_tls_sni(mrb_state *mrb, mrb_value self) {
134 auto data = static_cast<MRubyAssocData *>(mrb->ud);
135 auto downstream = data->downstream;
136 auto upstream = downstream->get_upstream();
137 auto handler = upstream->get_client_handler();
138 auto sni = handler->get_tls_sni();
139
140 return mrb_str_new(mrb, sni.c_str(), sni.size());
141 }
142 } // namespace
143
144 namespace {
env_get_tls_client_fingerprint_md(mrb_state * mrb,const EVP_MD * md)145 mrb_value env_get_tls_client_fingerprint_md(mrb_state *mrb, const EVP_MD *md) {
146 auto data = static_cast<MRubyAssocData *>(mrb->ud);
147 auto downstream = data->downstream;
148 auto upstream = downstream->get_upstream();
149 auto handler = upstream->get_client_handler();
150 auto ssl = handler->get_ssl();
151
152 if (!ssl) {
153 return mrb_str_new_static(mrb, "", 0);
154 }
155
156 #if OPENSSL_3_0_0_API
157 auto x = SSL_get0_peer_certificate(ssl);
158 #else // !OPENSSL_3_0_0_API
159 auto x = SSL_get_peer_certificate(ssl);
160 #endif // !OPENSSL_3_0_0_API
161 if (!x) {
162 return mrb_str_new_static(mrb, "", 0);
163 }
164
165 // Currently the largest hash value is SHA-256, which is 32 bytes.
166 std::array<uint8_t, 32> buf;
167 auto slen = tls::get_x509_fingerprint(buf.data(), buf.size(), x, md);
168 #if !OPENSSL_3_0_0_API
169 X509_free(x);
170 #endif // !OPENSSL_3_0_0_API
171 if (slen == -1) {
172 mrb_raise(mrb, E_RUNTIME_ERROR, "could not compute client fingerprint");
173 }
174
175 // TODO Use template version of format_hex
176 auto &balloc = downstream->get_block_allocator();
177 auto f = util::format_hex(balloc,
178 StringRef{std::begin(buf), std::begin(buf) + slen});
179 return mrb_str_new(mrb, f.c_str(), f.size());
180 }
181 } // namespace
182
183 namespace {
env_get_tls_client_fingerprint_sha256(mrb_state * mrb,mrb_value self)184 mrb_value env_get_tls_client_fingerprint_sha256(mrb_state *mrb,
185 mrb_value self) {
186 return env_get_tls_client_fingerprint_md(mrb, EVP_sha256());
187 }
188 } // namespace
189
190 namespace {
env_get_tls_client_fingerprint_sha1(mrb_state * mrb,mrb_value self)191 mrb_value env_get_tls_client_fingerprint_sha1(mrb_state *mrb, mrb_value self) {
192 return env_get_tls_client_fingerprint_md(mrb, EVP_sha1());
193 }
194 } // namespace
195
196 namespace {
env_get_tls_client_subject_name(mrb_state * mrb,mrb_value self)197 mrb_value env_get_tls_client_subject_name(mrb_state *mrb, mrb_value self) {
198 auto data = static_cast<MRubyAssocData *>(mrb->ud);
199 auto downstream = data->downstream;
200 auto upstream = downstream->get_upstream();
201 auto handler = upstream->get_client_handler();
202 auto ssl = handler->get_ssl();
203
204 if (!ssl) {
205 return mrb_str_new_static(mrb, "", 0);
206 }
207
208 #if OPENSSL_3_0_0_API
209 auto x = SSL_get0_peer_certificate(ssl);
210 #else // !OPENSSL_3_0_0_API
211 auto x = SSL_get_peer_certificate(ssl);
212 #endif // !OPENSSL_3_0_0_API
213 if (!x) {
214 return mrb_str_new_static(mrb, "", 0);
215 }
216
217 auto &balloc = downstream->get_block_allocator();
218 auto name = tls::get_x509_subject_name(balloc, x);
219 #if !OPENSSL_3_0_0_API
220 X509_free(x);
221 #endif // !OPENSSL_3_0_0_API
222 return mrb_str_new(mrb, name.c_str(), name.size());
223 }
224 } // namespace
225
226 namespace {
env_get_tls_client_issuer_name(mrb_state * mrb,mrb_value self)227 mrb_value env_get_tls_client_issuer_name(mrb_state *mrb, mrb_value self) {
228 auto data = static_cast<MRubyAssocData *>(mrb->ud);
229 auto downstream = data->downstream;
230 auto upstream = downstream->get_upstream();
231 auto handler = upstream->get_client_handler();
232 auto ssl = handler->get_ssl();
233
234 if (!ssl) {
235 return mrb_str_new_static(mrb, "", 0);
236 }
237
238 #if OPENSSL_3_0_0_API
239 auto x = SSL_get0_peer_certificate(ssl);
240 #else // !OPENSSL_3_0_0_API
241 auto x = SSL_get_peer_certificate(ssl);
242 #endif // !OPENSSL_3_0_0_API
243 if (!x) {
244 return mrb_str_new_static(mrb, "", 0);
245 }
246
247 auto &balloc = downstream->get_block_allocator();
248 auto name = tls::get_x509_issuer_name(balloc, x);
249 #if !OPENSSL_3_0_0_API
250 X509_free(x);
251 #endif // !OPENSSL_3_0_0_API
252 return mrb_str_new(mrb, name.c_str(), name.size());
253 }
254 } // namespace
255
256 namespace {
env_get_tls_client_serial(mrb_state * mrb,mrb_value self)257 mrb_value env_get_tls_client_serial(mrb_state *mrb, mrb_value self) {
258 auto data = static_cast<MRubyAssocData *>(mrb->ud);
259 auto downstream = data->downstream;
260 auto upstream = downstream->get_upstream();
261 auto handler = upstream->get_client_handler();
262 auto ssl = handler->get_ssl();
263
264 if (!ssl) {
265 return mrb_str_new_static(mrb, "", 0);
266 }
267
268 #if OPENSSL_3_0_0_API
269 auto x = SSL_get0_peer_certificate(ssl);
270 #else // !OPENSSL_3_0_0_API
271 auto x = SSL_get_peer_certificate(ssl);
272 #endif // !OPENSSL_3_0_0_API
273 if (!x) {
274 return mrb_str_new_static(mrb, "", 0);
275 }
276
277 auto &balloc = downstream->get_block_allocator();
278 auto sn = tls::get_x509_serial(balloc, x);
279 #if !OPENSSL_3_0_0_API
280 X509_free(x);
281 #endif // !OPENSSL_3_0_0_API
282 return mrb_str_new(mrb, sn.c_str(), sn.size());
283 }
284 } // namespace
285
286 namespace {
env_get_tls_client_not_before(mrb_state * mrb,mrb_value self)287 mrb_value env_get_tls_client_not_before(mrb_state *mrb, mrb_value self) {
288 auto data = static_cast<MRubyAssocData *>(mrb->ud);
289 auto downstream = data->downstream;
290 auto upstream = downstream->get_upstream();
291 auto handler = upstream->get_client_handler();
292 auto ssl = handler->get_ssl();
293
294 if (!ssl) {
295 return mrb_fixnum_value(0);
296 }
297
298 #if OPENSSL_3_0_0_API
299 auto x = SSL_get0_peer_certificate(ssl);
300 #else // !OPENSSL_3_0_0_API
301 auto x = SSL_get_peer_certificate(ssl);
302 #endif // !OPENSSL_3_0_0_API
303 if (!x) {
304 return mrb_fixnum_value(0);
305 }
306
307 time_t t;
308 if (tls::get_x509_not_before(t, x) != 0) {
309 t = 0;
310 }
311
312 #if !OPENSSL_3_0_0_API
313 X509_free(x);
314 #endif // !OPENSSL_3_0_0_API
315
316 return mrb_fixnum_value(t);
317 }
318 } // namespace
319
320 namespace {
env_get_tls_client_not_after(mrb_state * mrb,mrb_value self)321 mrb_value env_get_tls_client_not_after(mrb_state *mrb, mrb_value self) {
322 auto data = static_cast<MRubyAssocData *>(mrb->ud);
323 auto downstream = data->downstream;
324 auto upstream = downstream->get_upstream();
325 auto handler = upstream->get_client_handler();
326 auto ssl = handler->get_ssl();
327
328 if (!ssl) {
329 return mrb_fixnum_value(0);
330 }
331
332 #if OPENSSL_3_0_0_API
333 auto x = SSL_get0_peer_certificate(ssl);
334 #else // !OPENSSL_3_0_0_API
335 auto x = SSL_get_peer_certificate(ssl);
336 #endif // !OPENSSL_3_0_0_API
337 if (!x) {
338 return mrb_fixnum_value(0);
339 }
340
341 time_t t;
342 if (tls::get_x509_not_after(t, x) != 0) {
343 t = 0;
344 }
345
346 #if !OPENSSL_3_0_0_API
347 X509_free(x);
348 #endif // !OPENSSL_3_0_0_API
349
350 return mrb_fixnum_value(t);
351 }
352 } // namespace
353
354 namespace {
env_get_tls_cipher(mrb_state * mrb,mrb_value self)355 mrb_value env_get_tls_cipher(mrb_state *mrb, mrb_value self) {
356 auto data = static_cast<MRubyAssocData *>(mrb->ud);
357 auto downstream = data->downstream;
358 auto upstream = downstream->get_upstream();
359 auto handler = upstream->get_client_handler();
360 auto ssl = handler->get_ssl();
361
362 if (!ssl) {
363 return mrb_str_new_static(mrb, "", 0);
364 }
365
366 return mrb_str_new_cstr(mrb, SSL_get_cipher_name(ssl));
367 }
368 } // namespace
369
370 namespace {
env_get_tls_protocol(mrb_state * mrb,mrb_value self)371 mrb_value env_get_tls_protocol(mrb_state *mrb, mrb_value self) {
372 auto data = static_cast<MRubyAssocData *>(mrb->ud);
373 auto downstream = data->downstream;
374 auto upstream = downstream->get_upstream();
375 auto handler = upstream->get_client_handler();
376 auto ssl = handler->get_ssl();
377
378 if (!ssl) {
379 return mrb_str_new_static(mrb, "", 0);
380 }
381
382 return mrb_str_new_cstr(mrb, nghttp2::tls::get_tls_protocol(ssl));
383 }
384 } // namespace
385
386 namespace {
env_get_tls_session_id(mrb_state * mrb,mrb_value self)387 mrb_value env_get_tls_session_id(mrb_state *mrb, mrb_value self) {
388 auto data = static_cast<MRubyAssocData *>(mrb->ud);
389 auto downstream = data->downstream;
390 auto upstream = downstream->get_upstream();
391 auto handler = upstream->get_client_handler();
392 auto ssl = handler->get_ssl();
393
394 if (!ssl) {
395 return mrb_str_new_static(mrb, "", 0);
396 }
397
398 auto session = SSL_get_session(ssl);
399 if (!session) {
400 return mrb_str_new_static(mrb, "", 0);
401 }
402
403 unsigned int session_id_length = 0;
404 auto session_id = SSL_SESSION_get_id(session, &session_id_length);
405
406 // TODO Use template version of util::format_hex.
407 auto &balloc = downstream->get_block_allocator();
408 auto id = util::format_hex(balloc, StringRef{session_id, session_id_length});
409 return mrb_str_new(mrb, id.c_str(), id.size());
410 }
411 } // namespace
412
413 namespace {
env_get_tls_session_reused(mrb_state * mrb,mrb_value self)414 mrb_value env_get_tls_session_reused(mrb_state *mrb, mrb_value self) {
415 auto data = static_cast<MRubyAssocData *>(mrb->ud);
416 auto downstream = data->downstream;
417 auto upstream = downstream->get_upstream();
418 auto handler = upstream->get_client_handler();
419 auto ssl = handler->get_ssl();
420
421 if (!ssl) {
422 return mrb_false_value();
423 }
424
425 return SSL_session_reused(ssl) ? mrb_true_value() : mrb_false_value();
426 }
427 } // namespace
428
429 namespace {
env_get_alpn(mrb_state * mrb,mrb_value self)430 mrb_value env_get_alpn(mrb_state *mrb, mrb_value self) {
431 auto data = static_cast<MRubyAssocData *>(mrb->ud);
432 auto downstream = data->downstream;
433 auto upstream = downstream->get_upstream();
434 auto handler = upstream->get_client_handler();
435 auto alpn = handler->get_alpn();
436 return mrb_str_new(mrb, alpn.c_str(), alpn.size());
437 }
438 } // namespace
439
440 namespace {
env_get_tls_handshake_finished(mrb_state * mrb,mrb_value self)441 mrb_value env_get_tls_handshake_finished(mrb_state *mrb, mrb_value self) {
442 auto data = static_cast<MRubyAssocData *>(mrb->ud);
443 auto downstream = data->downstream;
444 auto upstream = downstream->get_upstream();
445 auto handler = upstream->get_client_handler();
446 auto conn = handler->get_connection();
447 return SSL_is_init_finished(conn->tls.ssl) ? mrb_true_value()
448 : mrb_false_value();
449 }
450 } // namespace
451
init_env_class(mrb_state * mrb,RClass * module)452 void init_env_class(mrb_state *mrb, RClass *module) {
453 auto env_class =
454 mrb_define_class_under(mrb, module, "Env", mrb->object_class);
455
456 mrb_define_method(mrb, env_class, "initialize", env_init, MRB_ARGS_NONE());
457 mrb_define_method(mrb, env_class, "req", env_get_req, MRB_ARGS_NONE());
458 mrb_define_method(mrb, env_class, "resp", env_get_resp, MRB_ARGS_NONE());
459 mrb_define_method(mrb, env_class, "ctx", env_get_ctx, MRB_ARGS_NONE());
460 mrb_define_method(mrb, env_class, "phase", env_get_phase, MRB_ARGS_NONE());
461 mrb_define_method(mrb, env_class, "remote_addr", env_get_remote_addr,
462 MRB_ARGS_NONE());
463 mrb_define_method(mrb, env_class, "server_addr", env_get_server_addr,
464 MRB_ARGS_NONE());
465 mrb_define_method(mrb, env_class, "server_port", env_get_server_port,
466 MRB_ARGS_NONE());
467 mrb_define_method(mrb, env_class, "tls_used", env_get_tls_used,
468 MRB_ARGS_NONE());
469 mrb_define_method(mrb, env_class, "tls_sni", env_get_tls_sni,
470 MRB_ARGS_NONE());
471 mrb_define_method(mrb, env_class, "tls_client_fingerprint_sha256",
472 env_get_tls_client_fingerprint_sha256, MRB_ARGS_NONE());
473 mrb_define_method(mrb, env_class, "tls_client_fingerprint_sha1",
474 env_get_tls_client_fingerprint_sha1, MRB_ARGS_NONE());
475 mrb_define_method(mrb, env_class, "tls_client_issuer_name",
476 env_get_tls_client_issuer_name, MRB_ARGS_NONE());
477 mrb_define_method(mrb, env_class, "tls_client_subject_name",
478 env_get_tls_client_subject_name, MRB_ARGS_NONE());
479 mrb_define_method(mrb, env_class, "tls_client_serial",
480 env_get_tls_client_serial, MRB_ARGS_NONE());
481 mrb_define_method(mrb, env_class, "tls_client_not_before",
482 env_get_tls_client_not_before, MRB_ARGS_NONE());
483 mrb_define_method(mrb, env_class, "tls_client_not_after",
484 env_get_tls_client_not_after, MRB_ARGS_NONE());
485 mrb_define_method(mrb, env_class, "tls_cipher", env_get_tls_cipher,
486 MRB_ARGS_NONE());
487 mrb_define_method(mrb, env_class, "tls_protocol", env_get_tls_protocol,
488 MRB_ARGS_NONE());
489 mrb_define_method(mrb, env_class, "tls_session_id", env_get_tls_session_id,
490 MRB_ARGS_NONE());
491 mrb_define_method(mrb, env_class, "tls_session_reused",
492 env_get_tls_session_reused, MRB_ARGS_NONE());
493 mrb_define_method(mrb, env_class, "alpn", env_get_alpn, MRB_ARGS_NONE());
494 mrb_define_method(mrb, env_class, "tls_handshake_finished",
495 env_get_tls_handshake_finished, MRB_ARGS_NONE());
496 }
497
498 } // namespace mruby
499
500 } // namespace shrpx
501