[ViewVC] Diff of: cvs/AnyEvent/lib/AnyEvent/Handle.pm

Comparing AnyEvent/lib/AnyEvent/Handle.pm (file contents):
Revision 1.130 by root, Mon Jun 29 21:00:32 2009 UTC vs.
Revision 1.134 by root, Fri Jul 3 00:09:04 2009 UTC

 =head1 METHODS
 =over 4
-=item B<new (%args)>
+=item $handle = B<new> AnyEvent::TLS fh => $filehandle, key => value...
-The constructor supports these arguments (all as key => value pairs).
+The constructor supports these arguments (all as C<< key => value >> pairs).
 =over 4
 =item fh => $filehandle [MANDATORY]
 waiting for data.
 If an EOF condition has been detected but no C<on_eof> callback has been
 set, then a fatal error will be raised with C<$!> set to <0>.
-=item on_error => $cb->($handle, $fatal)
+=item on_error => $cb->($handle, $fatal, $message)
 This is the error callback, which is called when, well, some error
 occured, such as not being able to resolve the hostname, failure to
 connect or a read error.
 fatal errors the handle object will be shut down and will not be usable
 (but you are free to look at the current C<< ->rbuf >>). Examples of fatal
 errors are an EOF condition with active (but unsatisifable) read watchers
 (C<EPIPE>) or I/O errors.
+AnyEvent::Handle tries to find an appropriate error code for you to check
+against, but in some cases (TLS errors), this does not work well. It is
+recommended to always output the C<$message> argument in human-readable
+error messages (it's usually the same as C<"$!">).
 Non-fatal errors can be retried by simply returning, but it is recommended
 to simply ignore this parameter and instead abondon the handle object
 when this callback is invoked. Examples of non-fatal errors are timeouts
 C<ETIMEDOUT>) or badly-formatted data (C<EBADMSG>).
 On callback entrance, the value of C<$!> contains the operating system
-error (or C<ENOSPC>, C<EPIPE>, C<ETIMEDOUT> or C<EBADMSG>).
+error code (or C<ENOSPC>, C<EPIPE>, C<ETIMEDOUT>, C<EBADMSG> or
+C<EPROTO>).
 While not mandatory, it is I<highly> recommended to set this callback, as
 you will not be notified of errors otherwise. The default simply calls
 C<croak>.
 This will not work for partial TLS data that could not be encoded
 yet. This data will be lost. Calling the C<stoptls> method in time might
 help.
+=item peername => $string
+A string used to identify the remote site - usually the DNS hostname
+(I<not> IDN!) used to create the connection, rarely the IP address.
+Apart from being useful in error messages, this string is also used in TLS
+common name verification (see C<verify_cn> in L<AnyEvent::TLS>).
 =item tls => "accept" | "connect" | Net::SSLeay::SSL object
 When this parameter is given, it enables TLS (SSL) mode, that means
 AnyEvent will start a TLS handshake as soon as the conenction has been
 established and will transparently encrypt/decrypt data afterwards.
+All TLS protocol errors will be signalled as C<EPROTO>, with an
+appropriate error message.
 TLS mode requires Net::SSLeay to be installed (it will be loaded
 automatically when you try to create a TLS handle): this module doesn't
 have a dependency on that module, so if your module requires it, you have
 to add the dependency yourself.
 mode.
 You can also provide your own TLS connection object, but you have
 to make sure that you call either C<Net::SSLeay::set_connect_state>
 or C<Net::SSLeay::set_accept_state> on it before you pass it to
-AnyEvent::Handle.
+AnyEvent::Handle. Also, this module will take ownership of this connection
+object.
+At some future point, AnyEvent::Handle might switch to another TLS
+implementation, then the option to use your own session object will go
+away.
 B<IMPORTANT:> since Net::SSLeay "objects" are really only integers,
 passing in the wrong integer will lead to certain crash. This most often
 happens when one uses a stylish C<< tls => 1 >> and is surprised about the
 segmentation fault.
 See the C<< ->starttls >> method for when need to start TLS negotiation later.
-=item tls_ctx => $ssl_ctx
+=item tls_ctx => $anyevent_tls
-Use the given C<Net::SSLeay::CTX> object to create the new TLS connection
+Use the given C<AnyEvent::TLS> object to create the new TLS connection
 (unless a connection object was specified directly). If this parameter is
 missing, then AnyEvent::Handle will use C<AnyEvent::Handle::TLS_CTX>.
+Instead of an object, you can also specify a hash reference with C<< key
+=> value >> pairs. Those will be passed to L<AnyEvent::TLS> to create a
+new TLS context object.
 =item json => JSON or JSON::XS object
 This is the json coder object used by the C<json> read and write types.
 =cut
 sub new {
    my $class = shift;
    my $self = bless { @_ }, $class;
    $self->{fh} or Carp::croak "mandatory argument fh is missing";
    AnyEvent::Util::fh_nonblocking $self->{fh}, 1;
+   $self->{_activity} = AnyEvent->now;
+   $self->_timeout;
+   $self->no_delay (delete $self->{no_delay}) if exists $self->{no_delay};
    $self->starttls (delete $self->{tls}, delete $self->{tls_ctx})
       if $self->{tls};
-   $self->{_activity} = AnyEvent->now;
-   $self->_timeout;
    $self->on_drain (delete $self->{on_drain}) if exists $self->{on_drain};
-   $self->no_delay (delete $self->{no_delay}) if exists $self->{no_delay};
    $self->start_read
       if $self->{on_read};
-   $self
+   $self->{fh} && $self
 }
 sub _shutdown {
    my ($self) = @_;
-   delete @$self{qw(_tw _rw _ww fh rbuf wbuf on_read _queue)};
+   delete @$self{qw(_tw _rw _ww fh wbuf on_read _queue)};
+   $self->{_eof} = 1; # tell starttls et. al to stop trying
    &_freetls;
 }
 sub _error {
-   my ($self, $errno, $fatal) = @_;
+   my ($self, $errno, $fatal, $message) = @_;
    $self->_shutdown
       if $fatal;
    $! = $errno;
+   $message ||= "$!";
    if ($self->{on_error}) {
-      $self->{on_error}($self, $fatal);
+      $self->{on_error}($self, $fatal, $message);
    } elsif ($self->{fh}) {
-      Carp::croak "AnyEvent::Handle uncaught error: $!";
+      Carp::croak "AnyEvent::Handle uncaught error: $message";
    }
 }
 =item $fh = $handle->fh
    pack "w/a*", Storable::nfreeze ($ref)
 };
 =back
+=item $handle->push_shutdown
+Sometimes you know you want to close the socket after writing your data
+before it was actually written. One way to do that is to replace your
+C<on_drain> handler by a callback that shuts down the socket. This method
+is a shorthand for just that, and replaces the C<on_drain> callback with:
+   sub { shutdown $_[0]{fh}, 1 }    # for push_shutdown
+This simply shuts down the write side and signals an EOF condition to the
+the peer.
+You can rely on the normal read queue and C<on_eof> handling
+afterwards. This is the cleanest way to close a connection.
+=cut
+sub push_shutdown {
+   $_[0]->{on_drain} = sub { shutdown $_[0]{fh}, 1 };
+}
 =item AnyEvent::Handle::register_write_type type => $coderef->($handle, @args)
 This function (not method) lets you add your own types to C<push_write>.
 Whenever the given C<type> is used, C<push_write> will invoke the code
          }
       });
    }
 }
+our $ERROR_SYSCALL;
+our $ERROR_WANT_READ;
+our $ERROR_ZERO_RETURN;
+sub _tls_error {
+   my ($self, $err) = @_;
+      warn "$err,$!\n";#d#
+   return $self->_error ($!, 1)
+      if $err == Net::SSLeay::ERROR_SYSCALL ();
+   $self->_error (&Errno::EPROTO, 1,
+                  Net::SSLeay::ERR_error_string (Net::SSLeay::ERR_get_error ()));
+}
 # poll the write BIO and send the data if applicable
+# also decode read data if possible
+# this is basiclaly our TLS state machine
+# more efficient implementations are possible with openssl,
+# but not with the buggy and incomplete Net::SSLeay.
 sub _dotls {
    my ($self) = @_;
    my $tmp;
    if (length $self->{_tls_wbuf}) {
       while (($tmp = Net::SSLeay::write ($self->{tls}, $self->{_tls_wbuf})) > 0) {
          substr $self->{_tls_wbuf}, 0, $tmp, "";
       }
+      $tmp = Net::SSLeay::get_error ($self->{tls}, $tmp);
+      return $self->_tls_error ($tmp)
+         if $tmp != $ERROR_WANT_READ
+            && ($tmp != $ERROR_SYSCALL || $!)
+            && $tmp != $ERROR_ZERO_RETURN;
    }
    while (defined ($tmp = Net::SSLeay::read ($self->{tls}))) {
       unless (length $tmp) {
          # let's treat SSL-eof as we treat normal EOF
       $self->_drain_rbuf unless $self->{_in_drain};
       $self->{tls} or return; # tls session might have gone away in callback
    }
    $tmp = Net::SSLeay::get_error ($self->{tls}, -1);
-   if ($tmp != Net::SSLeay::ERROR_WANT_READ ()) {
-      if ($tmp == Net::SSLeay::ERROR_SYSCALL ()) {
-         return $self->_error ($!, 1);
+   return $self->_tls_error ($tmp)
-      } elsif ($tmp == Net::SSLeay::ERROR_SSL ()) {
+      if $tmp != $ERROR_WANT_READ
-         return $self->_error (&Errno::EIO, 1);
+         && ($tmp != $ERROR_SYSCALL || $!)
-      }
+         && $tmp != $ERROR_ZERO_RETURN;
-      # all other errors are fine for our purposes
-   }
    while (length ($tmp = Net::SSLeay::BIO_read ($self->{_wbio}))) {
       $self->{wbuf} .= $tmp;
       $self->_drain_wbuf;
    }
 C<starttls>.
 The first argument is the same as the C<tls> constructor argument (either
 C<"connect">, C<"accept"> or an existing Net::SSLeay object).
-The second argument is the optional C<Net::SSLeay::CTX> object that is
+The second argument is the optional C<AnyEvent::TLS> object that is used
-used when AnyEvent::Handle has to create its own TLS connection object.
+when AnyEvent::Handle has to create its own TLS connection object, or
+a hash reference with C<< key => value >> pairs that will be used to
+construct a new context.
-The TLS connection object will end up in C<< $handle->{tls} >> after this
+The TLS connection object will end up in C<< $handle->{tls} >>, the TLS
-call and can be used or changed to your liking. Note that the handshake
+context in C<< $handle->{tls_ctx} >> after this call and can be used or
-might have already started when this function returns.
+changed to your liking. Note that the handshake might have already started
+when this function returns.
 If it an error to start a TLS handshake more than once per
 AnyEvent::Handle object (this is due to bugs in OpenSSL).
 =cut
    require Net::SSLeay;
    Carp::croak "it is an error to call starttls more than once on an AnyEvent::Handle object"
       if $self->{tls};
+   $ERROR_SYSCALL     = Net::SSLeay::ERROR_SYSCALL     ();
+   $ERROR_WANT_READ   = Net::SSLeay::ERROR_WANT_READ   ();
+   $ERROR_ZERO_RETURN = Net::SSLeay::ERROR_ZERO_RETURN ();
+   $ctx ||= $self->{tls_ctx};
+   if ("HASH" eq ref $ctx) {
+      require AnyEvent::TLS;
+      local $Carp::CarpLevel = 1; # skip ourselves when creating a new context
+      $ctx = new AnyEvent::TLS %$ctx;
+   }
-   if ($ssl eq "accept") {
+   $self->{tls_ctx} = $ctx || TLS_CTX ();
-      $ssl = Net::SSLeay::new ($ctx || TLS_CTX ());
+   $self->{tls}     = $ssl = $self->{tls_ctx}->_get_session ($ssl, $self, $self->{peername});
-      Net::SSLeay::set_accept_state ($ssl);
-   } elsif ($ssl eq "connect") {
-      $ssl = Net::SSLeay::new ($ctx || TLS_CTX ());
-      Net::SSLeay::set_connect_state ($ssl);
-   }
-   $self->{tls} = $ssl;
    # basically, this is deep magic (because SSL_read should have the same issues)
    # but the openssl maintainers basically said: "trust us, it just works".
    # (unfortunately, we have to hardcode constants because the abysmally misdesigned
    # and mismaintained ssleay-module doesn't even offer them).
    #
    # note that we do not try to keep the length constant between writes as we are required to do.
    # we assume that most (but not all) of this insanity only applies to non-blocking cases,
    # and we drive openssl fully in blocking mode here. Or maybe we don't - openssl seems to
    # have identity issues in that area.
-   Net::SSLeay::CTX_set_mode ($self->{tls},
+#   Net::SSLeay::CTX_set_mode ($ssl,
-      (eval { local $SIG{__DIE__}; Net::SSLeay::MODE_ENABLE_PARTIAL_WRITE () } || 1)
+#      (eval { local $SIG{__DIE__}; Net::SSLeay::MODE_ENABLE_PARTIAL_WRITE () } || 1)
-      | (eval { local $SIG{__DIE__}; Net::SSLeay::MODE_ACCEPT_MOVING_WRITE_BUFFER () } || 2));
+#      | (eval { local $SIG{__DIE__}; Net::SSLeay::MODE_ACCEPT_MOVING_WRITE_BUFFER () } || 2));
+   Net::SSLeay::CTX_set_mode ($ssl, 1|2);
    $self->{_rbio} = Net::SSLeay::BIO_new (Net::SSLeay::BIO_s_mem ());
    $self->{_wbio} = Net::SSLeay::BIO_new (Net::SSLeay::BIO_s_mem ());
    Net::SSLeay::set_bio ($ssl, $self->{_rbio}, $self->{_wbio});
 sub _freetls {
    my ($self) = @_;
    return unless $self->{tls};
-   Net::SSLeay::free (delete $self->{tls});
+   $self->{tls_ctx}->_put_session (delete $self->{tls});
    delete @$self{qw(_rbio _wbio _tls_wbuf)};
 }
 sub DESTROY {
    %$self = ();
 }
 =item AnyEvent::Handle::TLS_CTX
-This function creates and returns the Net::SSLeay::CTX object used by
+This function creates and returns the AnyEvent::TLS object used by default
-default for TLS mode.
+for TLS mode.
-The context is created like this:
+The context is created by calling L<AnyEvent::TLS> without any arguments.
-   Net::SSLeay::load_error_strings;
-   Net::SSLeay::SSLeay_add_ssl_algorithms;
-   Net::SSLeay::randomize;
-   my $CTX = Net::SSLeay::CTX_new;
-   Net::SSLeay::CTX_set_options $CTX, Net::SSLeay::OP_ALL
 =cut
 our $TLS_CTX;
 sub TLS_CTX() {
-   $TLS_CTX || do {
+   $TLS_CTX ||= do {
-      require Net::SSLeay;
+      require AnyEvent::TLS;
-      Net::SSLeay::load_error_strings ();
+      new AnyEvent::TLS
-      Net::SSLeay::SSLeay_add_ssl_algorithms ();
-      Net::SSLeay::randomize ();
-      $TLS_CTX = Net::SSLeay::CTX_new ();
-      Net::SSLeay::CTX_set_options ($TLS_CTX, Net::SSLeay::OP_ALL ());
-      $TLS_CTX
    }
 }
 =back

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing AnyEvent/lib/AnyEvent/Handle.pm (file contents): Revision 1.130 by root, Mon Jun 29 21:00:32 2009 UTC vs. Revision 1.134 by root, Fri Jul 3 00:09:04 2009 UTC

Diff Legend

Comparing AnyEvent/lib/AnyEvent/Handle.pm (file contents):
Revision 1.130 by root, Mon Jun 29 21:00:32 2009 UTC vs.
Revision 1.134 by root, Fri Jul 3 00:09:04 2009 UTC