WIP

bin/dig/dighost.c

@@ -2776,7 +2776,7 @@ send_tcp_connect(dig_query_t *query) {
 
 	result = isc_socket_create(socketmgr,
 				   isc_sockaddr_pf(&query->sockaddr),
-				   isc_sockettype_tcp, &query->sock);
+				   isc_sockettype_tcp, 0, &query->sock);
 	check_result(result, "isc_socket_create");
 	sockcount++;
 	debug("sockcount=%d", sockcount);
@@ -2880,7 +2880,7 @@ send_udp(dig_query_t *query) {
 
 		result = isc_socket_create(socketmgr,
 					   isc_sockaddr_pf(&query->sockaddr),
-					   isc_sockettype_udp, &query->sock);
+					   isc_sockettype_udp, 0, &query->sock);
 		check_result(result, "isc_socket_create");
 		sockcount++;
 		debug("sockcount=%d", sockcount);

bin/named/controlconf.c

@@ -1215,7 +1215,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	if (result == ISC_R_SUCCESS)
 		result = isc_socket_create(named_g_socketmgr,
 					   isc_sockaddr_pf(&listener->address),
-					   type, &listener->sock);
+					   type, 0, &listener->sock);
 	if (result == ISC_R_SUCCESS)
 		isc_socket_setname(listener->sock, "control", NULL);
 

bin/named/main.c

@@ -79,6 +79,8 @@
 #ifdef OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
+#include <openssl/ssl.h>
+#include <openssl/engine.h>
 #endif
 #ifdef HAVE_LIBXML2
 #include <libxml/xmlversion.h>
@@ -1304,6 +1306,15 @@ main(int argc, char *argv[]) {
 	(void) ProfilerStart(NULL);
 #endif
 
+#ifdef OPENSSL
+	/* SSL library initialisation */
+	SSL_library_init();
+	OpenSSL_add_all_algorithms();
+	SSL_load_error_strings();
+	ERR_load_BIO_strings();
+	ERR_load_crypto_strings();
+#endif
+
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"

bin/named/statschannel.c

@@ -3256,7 +3256,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_task_setname(task, "statchannel", NULL);
 
 	result = isc_socket_create(named_g_socketmgr, isc_sockaddr_pf(addr),
-				   isc_sockettype_tcp, &sock);
+				   isc_sockettype_tcp, 0, &sock);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	isc_socket_setname(sock, "statchannel", NULL);

bin/rndc/rndc.c

@@ -522,7 +522,7 @@ rndc_startconnect(isc_sockaddr_t *addr, isc_task_t *task) {
 		type = isc_sockettype_tcp;
 	else
 		type = isc_sockettype_unix;
-	DO("create socket", isc_socket_create(socketmgr, pf, type, &sock));
+	DO("create socket", isc_socket_create(socketmgr, pf, type, 0, &sock));
 	switch (isc_sockaddr_pf(addr)) {
 	case AF_INET:
 		DO("bind socket", isc_socket_bind(sock, &local4, 0));

bin/tests/optional/gsstest.c

@@ -512,7 +512,7 @@ main(int argc, char *argv[]) {
 	dns_view_setkeyring(view, ring);
 
 	sock = NULL;
-	RUNCHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+	RUNCHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, 0,
 				   &sock));
 
 	setup();

bin/tests/system/tkey/keycreate.c

@@ -306,7 +306,7 @@ main(int argc, char *argv[]) {
 
 	sock = NULL;
 	RUNCHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
-				   &sock));
+				   0, &sock));
 
 	RUNCHECK(isc_app_onrun(mctx, task, sendquery, NULL));
 

bin/tests/system/tkey/keydelete.c

@@ -236,7 +236,7 @@ main(int argc, char **argv) {
 
 	sock = NULL;
 	RUNCHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
-				   &sock));
+				   0, &sock));
 
 	RUNCHECK(isc_app_onrun(mctx, task, sendquery, NULL));
 

configure

@@ -16385,15 +16385,15 @@ $as_echo "not found" >&6; }
 		if test "/usr" = "$use_openssl"
 		then
 			DST_OPENSSL_INC=""
-			DST_OPENSSL_LIBS="-lcrypto"
+			DST_OPENSSL_LIBS="-lcrypto -lssl"
 		else
 			DST_OPENSSL_INC="-I$use_openssl/include"
 			case $host in
 			*-solaris*)
-				DST_OPENSSL_LIBS="-L$use_openssl/lib -R$use_openssl/lib -lcrypto"
+				DST_OPENSSL_LIBS="-L$use_openssl/lib -R$use_openssl/lib -lcrypto -lssl"
 				;;
 			*-hp-hpux*)
-				DST_OPENSSL_LIBS="-L$use_openssl/lib -Wl,+b: -lcrypto"
+				DST_OPENSSL_LIBS="-L$use_openssl/lib -Wl,+b: -lcrypto -lssl"
 				;;
 			*-apple-darwin*)
 				#
@@ -16405,13 +16405,13 @@ $as_echo "not found" >&6; }
 				#
 				if test -f "$use_openssl/lib/libcrypto.dylib"
 				then
-					DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto"
+					DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto -lssl"
 				else
 					DST_OPENSSL_LIBS="$use_openssl/lib/libcrypto.a"
 				fi
 				;;
 			*)
-				DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto"
+				DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto -lssl"
 				;;
 			esac
 		fi

configure.in

@@ -1592,15 +1592,15 @@ If you do not want OpenSSL, use --without-openssl])
 		if test "/usr" = "$use_openssl"
 		then
 			DST_OPENSSL_INC=""
-			DST_OPENSSL_LIBS="-lcrypto"
+			DST_OPENSSL_LIBS="-lcrypto -lssl"
 		else
 			DST_OPENSSL_INC="-I$use_openssl/include"
 			case $host in
 			*-solaris*)
-				DST_OPENSSL_LIBS="-L$use_openssl/lib -R$use_openssl/lib -lcrypto"
+				DST_OPENSSL_LIBS="-L$use_openssl/lib -R$use_openssl/lib -lcrypto -lssl"
 				;;
 			*-hp-hpux*)
-				DST_OPENSSL_LIBS="-L$use_openssl/lib -Wl,+b: -lcrypto"
+				DST_OPENSSL_LIBS="-L$use_openssl/lib -Wl,+b: -lcrypto -lssl"
 				;;
 			*-apple-darwin*)
 				#
@@ -1612,13 +1612,13 @@ If you do not want OpenSSL, use --without-openssl])
 				#
 				if test -f "$use_openssl/lib/libcrypto.dylib"
 				then
-					DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto"
+					DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto -lssl"
 				else
 					DST_OPENSSL_LIBS="$use_openssl/lib/libcrypto.a"
 				fi
 				;;
 			*)
-				DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto"
+				DST_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto -lssl"
 				;;
 			esac
 		fi

lib/dns/dispatch.c

@@ -1701,7 +1701,7 @@ open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 		return (ISC_R_SUCCESS);
 	} else {
 		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
-					   isc_sockettype_udp, &sock);
+					   isc_sockettype_udp, 0, &sock);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}

lib/dns/request.c

@@ -562,7 +562,7 @@ create_tcp_dispatch(isc_boolean_t newtcp, isc_boolean_t share,
 
 	result = isc_socket_create(requestmgr->socketmgr,
 				   isc_sockaddr_pf(destaddr),
-				   isc_sockettype_tcp, &sock);
+				   isc_sockettype_tcp, 0, &sock);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 #ifndef BROKEN_TCP_BIND_BEFORE_CONNECT

lib/dns/resolver.c

@@ -1964,7 +1964,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 
 		result = isc_socket_create(res->socketmgr, pf,
 					   isc_sockettype_tcp,
-					   &query->tcpsocket);
+					   0, &query->tcpsocket);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup_query;
 

lib/dns/tests/dispatch_test.c

@@ -277,7 +277,7 @@ ATF_TC_BODY(dispatch_getnext, tc) {
 	 * Create a local udp nameserver on the loopback.
 	 */
 	result = isc_socket_create(socketmgr, AF_INET, isc_sockettype_udp,
-				   &sock);
+				   0, &sock);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	ina.s_addr = htonl(INADDR_LOOPBACK);

lib/dns/xfrin.c

@@ -941,7 +941,7 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
 	isc_result_t result;
 	CHECK(isc_socket_create(xfr->socketmgr,
 				isc_sockaddr_pf(&xfr->sourceaddr),
-				isc_sockettype_tcp,
+				isc_sockettype_tcp, 0,
 				&xfr->socket));
 	isc_socket_setname(xfr->socket, "xfrin", NULL);
 #ifndef BROKEN_TCP_BIND_BEFORE_CONNECT

lib/isc/include/isc/result.h

@@ -85,9 +85,12 @@
 #define ISC_R_MULTIPLE			62	/*%< multiple */
 #define ISC_R_WOULDBLOCK		63	/*%< would block */
 #define ISC_R_COMPLETE			64	/*%< complete */
+#define ISC_R_TLSCONTEXTFAILURE         65      /*%< TLS context creation failure */
+#define ISC_R_TLSCERTIFICATEFAILURE     66      /*%< TLS certificate load failure */
+#define ISC_R_TLSSESSIONFAILURE         67      /*%< TLS session creation failure */
 
 /*% Not a result code: the number of results. */
-#define ISC_R_NRESULTS 			65
+#define ISC_R_NRESULTS 			68
 
 ISC_LANG_BEGINDECLS
 

lib/isc/include/isc/socket.h

@@ -128,6 +128,13 @@ ISC_LANG_BEGINDECLS
  */
 #define ISC_SOCKET_REUSEADDRESS		0x01U
 
+/*%
+ * Indicates whether TLS must be used on this socket for all
+ * communications. This option is to be passed only with
+ * `isc_sockettype_tcp` type sockets.
+ */
+#define ISC_SOCKET_TLS 0x00000001U
+
 /*%
  * Statistics counters.  Used as isc_statscounter_t values.
  */
@@ -327,6 +334,7 @@ typedef struct isc_socketmgrmethods {
 	void		(*destroy)(isc_socketmgr_t **managerp);
 	isc_result_t	(*socketcreate)(isc_socketmgr_t *manager, int pf,
 					isc_sockettype_t type,
+					unsigned int options,
 					isc_socket_t **socketp);
 	isc_result_t    (*fdwatchcreate)(isc_socketmgr_t *manager, int fd,
 					 int flags,
@@ -498,6 +506,7 @@ isc_result_t
 isc_socket_create(isc_socketmgr_t *manager,
 		  int pf,
 		  isc_sockettype_t type,
+		  unsigned int options,
 		  isc_socket_t **socketp);
 /*%<
  * Create a new 'type' socket managed by 'manager'.

lib/isc/result.c

@@ -100,6 +100,9 @@ static const char *description[ISC_R_NRESULTS] = {
 	"multiple",				/*%< 62 */
 	"would block",				/*%< 63 */
 	"complete",				/*%< 64 */
+	"TLS context creation failure",		/*%< 65 */
+	"TLS certificate load failure",		/*%< 66 */
+	"TLS session creation failure",		/*%< 67 */
 };
 
 static const char *identifier[ISC_R_NRESULTS] = {
@@ -168,6 +171,9 @@ static const char *identifier[ISC_R_NRESULTS] = {
 	"ISC_R_MULTIPLE",
 	"ISC_R_WOULDBLOCK",
 	"ISC_R_COMPLETE",
+	"ISC_R_TLSCONTEXTFAILURE",
+	"ISC_R_TLSCERTIFICATEFAILURE",
+	"ISC_R_TLSSESSIONFAILURE",
 };
 
 #define ISC_RESULT_RESULTSET			2

lib/isc/socket_api.c

@@ -95,14 +95,18 @@ isc_socketmgr_destroy(isc_socketmgr_t **managerp) {
 
 isc_result_t
 isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-		  isc_socket_t **socketp)
+		  unsigned int options, isc_socket_t **socketp)
 {
 	REQUIRE(ISCAPI_SOCKETMGR_VALID(manager));
+	REQUIRE(((options & ISC_SOCKET_TLS) == 0U) ||
+		(type == isc_sockettype_tcp));
 
 	if (isc_bind9)
-		return (isc__socket_create(manager, pf, type, socketp));
+		return (isc__socket_create(manager, pf, type, options,
+					   socketp));
 
-	return (manager->methods->socketcreate(manager, pf, type, socketp));
+	return (manager->methods->socketcreate(manager, pf, type, options,
+					       socketp));
 }
 
 void

lib/isc/tests/socket_test.c

@@ -164,7 +164,8 @@ ATF_TC_BODY(udp_sendto, tc) {
 	isc_sockaddr_fromin(&addr1, &in, 0);
 	isc_sockaddr_fromin(&addr2, &in, 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+				   0, &s1);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 	result = isc_socket_bind(s1, &addr1, 0);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
@@ -173,7 +174,8 @@ ATF_TC_BODY(udp_sendto, tc) {
 			 isc_result_totext(result));
 	ATF_REQUIRE(isc_sockaddr_getport(&addr1) != 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+				   0, &s2);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 	result = isc_socket_bind(s2, &addr2, 0);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
@@ -239,7 +241,8 @@ ATF_TC_BODY(udp_dup, tc) {
 	isc_sockaddr_fromin(&addr1, &in, 0);
 	isc_sockaddr_fromin(&addr2, &in, 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+				   0, &s1);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 	result = isc_socket_bind(s1, &addr1, 0);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
@@ -248,7 +251,8 @@ ATF_TC_BODY(udp_dup, tc) {
 			 isc_result_totext(result));
 	ATF_REQUIRE(isc_sockaddr_getport(&addr1) != 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+				   0, &s2);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 	result = isc_socket_bind(s2, &addr2, 0);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
@@ -341,7 +345,8 @@ ATF_TC_BODY(udp_dscp_v4, tc) {
 	isc_sockaddr_fromin(&addr1, &in, 0);
 	isc_sockaddr_fromin(&addr2, &in, 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+				   0, &s1);
 	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS, "%s",
 			   isc_result_totext(result));
 	result = isc_socket_bind(s1, &addr1, ISC_SOCKET_REUSEADDRESS);
@@ -352,7 +357,8 @@ ATF_TC_BODY(udp_dscp_v4, tc) {
 			 isc_result_totext(result));
 	ATF_REQUIRE(isc_sockaddr_getport(&addr1) != 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
+				   0, &s2);
 	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS, "%s",
 			   isc_result_totext(result));
 	result = isc_socket_bind(s2, &addr2, ISC_SOCKET_REUSEADDRESS);
@@ -448,7 +454,7 @@ ATF_TC_BODY(udp_dscp_v6, tc) {
 	isc_sockaddr_fromin6(&addr2, &in6, 0);
 
 	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_udp,
-				   &s1);
+				   0, &s1);
 	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS, "%s",
 			 isc_result_totext(result));
 	result = isc_socket_bind(s1, &addr1, 0);
@@ -460,7 +466,7 @@ ATF_TC_BODY(udp_dscp_v6, tc) {
 	ATF_REQUIRE(isc_sockaddr_getport(&addr1) != 0);
 
 	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_udp,
-				   &s2);
+				   0, &s2);
 	ATF_CHECK_EQ_MSG(result, ISC_R_SUCCESS, "%s",
 			 isc_result_totext(result));
 	result = isc_socket_bind(s2, &addr2, 0);
@@ -550,7 +556,8 @@ ATF_TC_BODY(tcp_dscp_v4, tc) {
 	in.s_addr = inet_addr("127.0.0.1");
 	isc_sockaddr_fromin(&addr1, &in, 0);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_tcp, &s1);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_tcp,
+				   0, &s1);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_socket_bind(s1, &addr1, 0);
@@ -563,7 +570,8 @@ ATF_TC_BODY(tcp_dscp_v4, tc) {
 	result = isc_socket_listen(s1, 3);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_tcp, &s2);
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_tcp,
+				   0, &s2);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_task_create(taskmgr, 0, &task);
@@ -652,7 +660,7 @@ ATF_TC_BODY(tcp_dscp_v6, tc) {
 	isc_sockaddr_fromin6(&addr1, &in6, 0);
 
 	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_tcp,
-				   &s1);
+				   0, &s1);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_socket_bind(s1, &addr1, 0);
@@ -666,7 +674,7 @@ ATF_TC_BODY(tcp_dscp_v6, tc) {
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_tcp,
-				   &s2);
+				   0, &s2);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_task_create(taskmgr, 0, &task);

lib/isc/unix/socket.c

@@ -80,6 +80,10 @@
 #endif
 #endif
 
+#ifdef OPENSSL
+#include <openssl/ssl.h>
+#endif
+
 #include <netinet/tcp.h>
 
 #include "errno2result.h"
@@ -335,6 +339,7 @@ struct isc__socket {
 	isc__socketmgr_t	*manager;
 	isc_mutex_t		lock;
 	isc_sockettype_t	type;
+	unsigned int		options;
 	const isc_statscounter_t	*statsindex;
 
 	/* Locked by socket lock. */
@@ -385,6 +390,16 @@ struct isc__socket {
 	int			fdwatchflags;
 	isc_task_t		*fdwatchtask;
 	unsigned int		dscp;
+#ifdef OPENSSL
+	SSL_CTX			*tls_ctx;
+	SSL                     *tls;
+	BIO                     *tls_rbio;
+	BIO                     *tls_wbio;
+	unsigned char           *tls_wbuf;
+	size_t                  tls_wbuf_length;
+	size_t                  tls_wbuf_allocation;
+	isc_socketevent_t       *tls_wdev;
+#endif
 };
 
 #define SOCKET_MANAGER_MAGIC	ISC_MAGIC('I', 'O', 'm', 'g')
@@ -471,14 +486,15 @@ static isc__socketmgr_t *socketmgr = NULL;
 
 static isc_result_t socket_create(isc_socketmgr_t *manager0, int pf,
 				  isc_sockettype_t type,
-				  isc_socket_t **socketp,
-				  isc_socket_t *dup_socket);
+				  unsigned int options,
+				  isc_socket_t *dup_socket,
+				  isc_socket_t **socketp);
 static void send_recvdone_event(isc__socket_t *, isc_socketevent_t **);
 static void send_senddone_event(isc__socket_t *, isc_socketevent_t **);
 static void send_connectdone_event(isc__socket_t *, isc_socket_connev_t **);
 static void free_socket(isc__socket_t **);
 static isc_result_t allocate_socket(isc__socketmgr_t *, isc_sockettype_t,
-				    isc__socket_t **);
+				    unsigned int, isc__socket_t **);
 static void destroy(isc__socket_t **);
 static void internal_accept(isc_task_t *, isc_event_t *);
 static void internal_connect(isc_task_t *, isc_event_t *);
@@ -508,7 +524,7 @@ isc_result_t
 isc__socket_close(isc_socket_t *sock0);
 isc_result_t
 isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-		   isc_socket_t **socketp);
+		   unsigned int options, isc_socket_t **socketp);
 void
 isc__socket_attach(isc_socket_t *sock, isc_socket_t **socketp);
 void
@@ -675,6 +691,7 @@ static isc_socketmgrmethods_t socketmgrmethods = {
 #define SELECT_POKE_CLOSE		(-5)
 
 #define SOCK_DEAD(s)			((s)->references == 0)
+#define SOCK_TLS(s)			(((s)->options & ISC_SOCKET_TLS) != 0U)
 
 /*%
  * Shortcut index arrays to get access to statistics counters.
@@ -2054,6 +2071,79 @@ doio_recv(isc__socket_t *sock, isc_socketevent_t *dev) {
 	return (DOIO_SUCCESS);
 }
 
+#ifdef OPENSSL
+
+static isc_result_t
+doio_tls_encryptbuffer(isc__socket_t *sock, void *data, size_t length) {
+	int n;
+
+	while (length > 0) {
+		n = SSL_write(sock->tls, data, length);
+	}
+}
+
+static int
+doio_tls_send(isc__socket_t *sock, isc_socketevent_t *dev) {
+	isc_buffer_t *buffer;
+	isc_region_t used;
+
+	/*
+	 * XXXMUKS: Carefully handle ISC_SOCKFLAG_NORETRY case. We
+	 * should not queue encrypted data in that case.
+	 */
+
+	/*
+	 * If TLS session is not yet ready, queue the new request.
+	 */
+	if (!SSL_is_init_finished(sock->tls)) {
+		dev->result = ISC_R_WOULDBLOCK;
+		return (DOIO_SOFT);
+	}
+
+	/*
+	 * If there is already encrypted data waiting to be sent, queue
+	 * the new request.
+	 */
+	if (sock->tls_wbuf_length > 0) {
+		dev->result = ISC_R_WOULDBLOCK;
+		return (DOIO_SOFT);
+	}
+
+	/*
+	 * Process the event's buffers entirely via OpenSSL and queue it
+	 * to be sent out.
+	 */
+
+	INSIST(dev->n == 0);
+
+	buffer = ISC_LIST_HEAD(dev->bufferlist);
+	if (buffer == NULL) {
+		doio_tls_encryptbuffer(sock, dev->region.base,
+				       dev->region.length);
+	} else {
+		while (buffer != NULL) {
+			isc_buffer_usedregion(buffer, &used);
+			doio_tls_encryptbuffer(sock, used.base, used.length);
+			buffer = ISC_LIST_NEXT(buffer, link);
+		}
+	}
+
+	/*
+	 * Attempt to send the encrypted data synchronously here. For
+	 * what doesn't succeed, we'll send it later.
+	 */
+
+	/*
+	 * Set ->tls_wdev if queuing it. In this case, return a
+	 * DOIO_STATUS that will not cause dev to be queued to the
+	 * waiting list (because we handle it in tls->wdev.
+	 */
+
+	return (0);
+}
+
+#endif /* OPENSSL */
+
 /*
  * Returns:
  *	DOIO_SUCCESS	The operation succeeded.  dev->result contains
@@ -2078,6 +2168,12 @@ doio_send(isc__socket_t *sock, isc_socketevent_t *dev) {
 	int send_errno;
 	char strbuf[ISC_STRERRORSIZE];
 
+#ifdef OPENSSL
+	if (SOCK_TLS(sock)) {
+		return (doio_tls_send(sock, dev));
+	}
+#endif /* OPENSSL */
+
 	build_msghdr_send(sock, dev, &msghdr, iov, &write_count);
 
  resend:
@@ -2267,6 +2363,9 @@ destroy(isc__socket_t **sockp) {
 	INSIST(ISC_LIST_EMPTY(sock->accept_list));
 	INSIST(ISC_LIST_EMPTY(sock->recv_list));
 	INSIST(ISC_LIST_EMPTY(sock->send_list));
+#ifdef OPENSSL
+	INSIST(sock->tls_wbuf_length == 0U);
+#endif
 	INSIST(sock->fd >= -1 && sock->fd < (int)manager->maxsocks);
 
 	if (sock->fd >= 0) {
@@ -2292,7 +2391,7 @@ destroy(isc__socket_t **sockp) {
 
 static isc_result_t
 allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
-		isc__socket_t **socketp)
+		unsigned int options, isc__socket_t **socketp)
 {
 	isc__socket_t *sock;
 	isc_result_t result;
@@ -2309,6 +2408,7 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
 
 	sock->manager = manager;
 	sock->type = type;
+	sock->options = options;
 	sock->fd = -1;
 	sock->dscp = 0;		/* TOS/TCLASS is zero until set. */
 	sock->dupped = 0;
@@ -2320,6 +2420,15 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
 	sock->recvcmsgbuf = NULL;
 	sock->sendcmsgbuf = NULL;
 
+#ifdef OPENSSL
+	sock->tls_ctx = NULL;
+	sock->tls = NULL;
+	sock->tls_rbio = NULL;
+	sock->tls_wbio = NULL;
+	sock->tls_wbuf = NULL;
+	sock->tls_wbuf_length = 0U;
+	sock->tls_wdev = NULL;
+#endif
 	/*
 	 * Set up cmsg buffers.
 	 */
@@ -2441,10 +2550,29 @@ free_socket(isc__socket_t **socketp) {
 	INSIST(!sock->pending_accept);
 	INSIST(ISC_LIST_EMPTY(sock->recv_list));
 	INSIST(ISC_LIST_EMPTY(sock->send_list));
+#ifdef OPENSSL
+	INSIST(sock->tls_wbuf_length == 0U);
+#endif
 	INSIST(ISC_LIST_EMPTY(sock->accept_list));
 	INSIST(ISC_LIST_EMPTY(sock->connect_list));
 	INSIST(!ISC_LINK_LINKED(sock, link));
 
+#ifdef OPENSSL
+	if (sock->tls_wbuf == NULL) {
+		isc_mem_free(sock->manager->mctx, sock->tls_wbuf);
+		sock->tls_wbuf = NULL;
+	}
+	if (sock->tls != NULL) {
+		/*
+		 * This also takes care of freeing any linked BIOs.
+		 */
+		SSL_free(sock->tls);
+	}
+	if (sock->tls_ctx != NULL) {
+		SSL_CTX_free(sock->tls_ctx);
+	}
+#endif
+
 	if (sock->recvcmsgbuf != NULL)
 		isc_mem_put(sock->manager->mctx, sock->recvcmsgbuf,
 			    sock->recvcmsgbuflen);
@@ -2979,7 +3107,8 @@ setup_done:
  */
 static isc_result_t
 socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
-	      isc_socket_t **socketp, isc_socket_t *dup_socket)
+	      unsigned int options, isc_socket_t *dup_socket,
+	      isc_socket_t **socketp)
 {
 	isc__socket_t *sock = NULL;
 	isc__socketmgr_t *manager = (isc__socketmgr_t *)manager0;
@@ -2989,8 +3118,15 @@ socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
 	REQUIRE(VALID_MANAGER(manager));
 	REQUIRE(socketp != NULL && *socketp == NULL);
 	REQUIRE(type != isc_sockettype_fdwatch);
+	REQUIRE(((options & ISC_SOCKET_TLS) == 0U) ||
+		(type == isc_sockettype_tcp));
 
-	result = allocate_socket(manager, type, &sock);
+#ifndef OPENSSL
+	if ((options & ISC_SOCKET_TLS) != 0U)
+		return (ISC_R_NOTIMPLEMENTED);
+#endif /* OPENSSL */
+
+	result = allocate_socket(manager, type, options, &sock);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -3017,10 +3153,59 @@ socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
 
 	sock->pf = pf;
 
+#ifdef OPENSSL
+	/*
+	 * Setup the TLS context. This context is shared by all TCP
+	 * connections that use this listening socket (i.e., it is not
+	 * for accepted connections).
+	 *
+	 * XXXMUKS: This is currently written for server code and
+	 * hardwired certificates. It'll need some tweaking for client
+	 * code and named certificate options (that'll come later).
+	 */
+	if (SOCK_TLS(sock)) {
+		int err;
+
+		sock->tls_ctx = SSL_CTX_new(TLS_method());
+		if (sock->tls_ctx == NULL) {
+			result = ISC_R_TLSCONTEXTFAILURE;
+			goto failure;
+		}
+
+		err = SSL_CTX_use_certificate_file(sock->tls_ctx,
+						   "server.crt",
+						   SSL_FILETYPE_PEM);
+		if (err != 1) {
+			result = ISC_R_TLSCERTIFICATEFAILURE;
+			goto failure;
+		}
+
+		err = SSL_CTX_use_PrivateKey_file(sock->tls_ctx,
+						  "server.key",
+						  SSL_FILETYPE_PEM);
+		if (err != 1) {
+			result = ISC_R_TLSCERTIFICATEFAILURE;
+			goto failure;
+		}
+
+		err = SSL_CTX_check_private_key(sock->tls_ctx);
+		if (err != 1) {
+			result = ISC_R_TLSCERTIFICATEFAILURE;
+			goto failure;
+		}
+
+		/*
+		 * XXXMUKS: Set TLS options as necessary based on named
+		 * config options here.
+		 */
+		SSL_CTX_set_options(sock->tls_ctx,
+				    SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);
+	}
+#endif /* OPENSSL */
+
 	result = opensocket(manager, sock, (isc__socket_t *)dup_socket);
 	if (result != ISC_R_SUCCESS) {
-		free_socket(&sock);
-		return (result);
+		goto failure;
 	}
 
 	sock->common.methods = (isc_socketmethods_t *)&socketmethods;
@@ -3057,6 +3242,11 @@ socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
 		   ISC_MSG_CREATED, dup_socket != NULL ? "dupped" : "created");
 
 	return (ISC_R_SUCCESS);
+
+failure:
+	if (sock != NULL)
+		free_socket(&sock);
+	return (result);
 }
 
 /*%
@@ -3067,9 +3257,9 @@ socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
  */
 isc_result_t
 isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
-		   isc_socket_t **socketp)
+		   unsigned int options, isc_socket_t **socketp)
 {
-	return (socket_create(manager0, pf, type, socketp, NULL));
+	return (socket_create(manager0, pf, type, options, NULL, socketp));
 }
 
 /*%
@@ -3084,8 +3274,8 @@ isc__socket_dup(isc_socket_t *sock0, isc_socket_t **socketp) {
 	REQUIRE(socketp != NULL && *socketp == NULL);
 
 	return (socket_create((isc_socketmgr_t *) sock->manager,
-			      sock->pf, sock->type, socketp,
-			      sock0));
+			      sock->pf, sock->type, sock->options,
+			      sock0, socketp));
 }
 
 isc_result_t
@@ -3157,7 +3347,7 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager0, int fd, int flags,
 	if (fd < 0 || (unsigned int)fd >= manager->maxsocks)
 		return (ISC_R_RANGE);
 
-	result = allocate_socket(manager, isc_sockettype_fdwatch, &sock);
+	result = allocate_socket(manager, isc_sockettype_fdwatch, 0, &sock);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -3893,6 +4083,140 @@ internal_send(isc_task_t *me, isc_event_t *ev) {
 		return;
 	}
 
+#ifdef OPENSSL
+	/*
+	 * TLS: First, send all of the SSL library's output for this
+	 * socket that's pending from the last send to the TCP stream.
+	 */
+	if (sock->tls_wbuf_length > 0U) {
+		ssize_t n;
+		int send_errno;
+		int attempts = 0;
+		int status;
+		char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+		char strbuf[ISC_STRERRORSIZE];
+
+		INSIST(sock->type == isc_sockettype_tcp);
+		INSIST(SOCK_TLS(sock));
+		INSIST(sock->tls_wbuf != NULL);
+
+	resend:
+		n = send(sock->fd, sock->tls_wbuf,
+			 sock->tls_wbuf_length, 0);
+		send_errno = errno;
+
+		/*
+		 * XXXMUKS: there may be no ->tls_wdev here (during TLS
+		 * handshake or negotiation).
+		 */
+
+		/*
+		 * Check for error or block condition.
+		 */
+		if (n < 0) {
+			if (send_errno == EINTR && ++attempts < NRETRIES)
+				goto resend;
+
+			if (SOFT_ERROR(send_errno)) {
+				if (errno == EWOULDBLOCK || errno == EAGAIN)
+					sock->tls_wdev->result = ISC_R_WOULDBLOCK;
+				status = DOIO_SOFT;
+				goto next;
+			}
+
+#define SOFT_OR_HARD(_system, _isc)					\
+			if (send_errno == _system) {			\
+				if (sock->connected) {			\
+					sock->tls_wdev->result = _isc;		\
+					inc_stats(sock->manager->stats, \
+						  sock->statsindex[STATID_SENDFAIL]); \
+					status = DOIO_HARD;		\
+					goto next;			\
+				}					\
+				status = DOIO_SOFT;			\
+				goto next;				\
+			}
+#define ALWAYS_HARD(_system, _isc)					\
+			if (send_errno == _system) {			\
+				sock->tls_wdev->result = _isc;			\
+				inc_stats(sock->manager->stats,		\
+					  sock->statsindex[STATID_SENDFAIL]); \
+				status = DOIO_HARD;			\
+				goto next;				\
+			}
+
+			SOFT_OR_HARD(ECONNREFUSED, ISC_R_CONNREFUSED);
+			ALWAYS_HARD(EACCES, ISC_R_NOPERM);
+			ALWAYS_HARD(EAFNOSUPPORT, ISC_R_ADDRNOTAVAIL);
+			ALWAYS_HARD(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL);
+			ALWAYS_HARD(EHOSTUNREACH, ISC_R_HOSTUNREACH);
+#ifdef EHOSTDOWN
+			ALWAYS_HARD(EHOSTDOWN, ISC_R_HOSTUNREACH);
+#endif
+			ALWAYS_HARD(ENETUNREACH, ISC_R_NETUNREACH);
+			ALWAYS_HARD(ENOBUFS, ISC_R_NORESOURCES);
+			ALWAYS_HARD(EPERM, ISC_R_HOSTUNREACH);
+			ALWAYS_HARD(EPIPE, ISC_R_NOTCONNECTED);
+			ALWAYS_HARD(ECONNRESET, ISC_R_CONNECTIONRESET);
+
+#undef SOFT_OR_HARD
+#undef ALWAYS_HARD
+
+			/*
+			 * The other error types depend on whether or not the
+			 * socket is UDP or TCP.  If it is UDP, some errors
+			 * that we expect to be fatal under TCP are merely
+			 * annoying, and are really soft errors.
+			 *
+			 * However, these soft errors are still returned as
+			 * a status.
+			 */
+			isc_sockaddr_format(&sock->tls_wdev->address, addrbuf, sizeof(addrbuf));
+			isc__strerror(send_errno, strbuf, sizeof(strbuf));
+			UNEXPECTED_ERROR(__FILE__, __LINE__, "internal_send: %s: %s",
+					 addrbuf, strbuf);
+			sock->tls_wdev->result = isc__errno2result(send_errno);
+			inc_stats(sock->manager->stats,
+				  sock->statsindex[STATID_SENDFAIL]);
+			status = DOIO_HARD;
+
+		next:
+			if (status == DOIO_HARD && sock->tls_wdev != NULL) {
+				send_senddone_event(sock, &sock->tls_wdev);
+			}
+		} else if (n == 0) {
+			inc_stats(sock->manager->stats,
+				  sock->statsindex[STATID_SENDFAIL]);
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "internal_send: send() %s 0",
+					 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+							ISC_MSG_RETURNED, "returned"));
+		} else {
+			memmove(sock->tls_wbuf, sock->tls_wbuf + n, sock->tls_wbuf_length - n);
+			sock->tls_wbuf_length -= n;
+		}
+
+		/*
+		 * If there's more SSL encrypted output to be written to
+		 * the TCP, it has to go out on the socket first before
+		 * we'll send any more unencrypted data to the SSL
+		 * library.
+		 */
+		if (sock->tls_wbuf_length != 0U) {
+			goto poke;
+		}
+
+		/*
+		 * XXXMUKS: We're done sending encrypted data. Post its
+		 * completion event (if there is one; during the TLS
+		 * handshake, there's none).
+		 */
+		if (sock->tls_wdev != NULL) {
+			sock->tls_wdev->result = ISC_R_SUCCESS;
+			send_senddone_event(sock, &sock->tls_wdev);
+		}
+	}
+#endif
 	/*
 	 * Try to do as much I/O as possible on this socket.  There are no
 	 * limits here, currently.
@@ -3913,9 +4237,14 @@ internal_send(isc_task_t *me, isc_event_t *ev) {
 	}
 
  poke:
-	if (!ISC_LIST_EMPTY(sock->send_list))
+	if (!ISC_LIST_EMPTY(sock->send_list)) {
 		select_poke(sock->manager, sock->fd, SELECT_POKE_WRITE);
-
+	}
+#ifdef OPENSSL
+	else if (sock->tls_wbuf_length > 0U) {
+		select_poke(sock->manager, sock->fd, SELECT_POKE_WRITE);
+	}
+#endif
 	UNLOCK(&sock->lock);
 }
 
@@ -5795,7 +6124,7 @@ isc__socket_accept(isc_socket_t *sock0,
 	isc_socket_newconnev_t *dev;
 	isc__socketmgr_t *manager;
 	isc_task_t *ntask = NULL;
-	isc__socket_t *nsock;
+	isc__socket_t *nsock = NULL;
 	isc_result_t result;
 	isc_boolean_t do_poke = ISC_FALSE;
 
@@ -5816,16 +6145,14 @@ isc__socket_accept(isc_socket_t *sock0,
 		isc_event_allocate(manager->mctx, task, ISC_SOCKEVENT_NEWCONN,
 				   action, arg, sizeof(*dev));
 	if (dev == NULL) {
-		UNLOCK(&sock->lock);
-		return (ISC_R_NOMEMORY);
+		result = ISC_R_NOMEMORY;
+		goto failure;
 	}
 	ISC_LINK_INIT(dev, ev_link);
 
-	result = allocate_socket(manager, sock->type, &nsock);
+	result = allocate_socket(manager, sock->type, 0, &nsock);
 	if (result != ISC_R_SUCCESS) {
-		isc_event_free(ISC_EVENT_PTR(&dev));
-		UNLOCK(&sock->lock);
-		return (result);
+		goto failure;
 	}
 
 	/*
@@ -5833,12 +6160,51 @@ isc__socket_accept(isc_socket_t *sock0,
 	 */
 	isc_task_attach(task, &ntask);
 	if (isc_task_exiting(ntask)) {
-		free_socket(&nsock);
-		isc_task_detach(&ntask);
-		isc_event_free(ISC_EVENT_PTR(&dev));
-		UNLOCK(&sock->lock);
-		return (ISC_R_SHUTTINGDOWN);
+		result = ISC_R_SHUTTINGDOWN;
+		goto failure;
 	}
+
+#ifdef OPENSSL
+	/*
+	 * Be careful here to separate TLS session specific stuff
+	 * (nsock) and TLS listening interface specific stuff (sock).
+	 */
+	if (SOCK_TLS(sock)) {
+		/*
+		 * For the accepted socket, this context must not be set
+		 * (it is only for the listening socket).
+		 */
+		INSIST(nsock->tls_ctx == NULL);
+
+		nsock->tls_rbio = BIO_new(BIO_s_mem());
+		if (nsock->tls_rbio == NULL) {
+			result = ISC_R_TLSSESSIONFAILURE;
+			goto failure;
+		}
+
+		nsock->tls_wbio = BIO_new(BIO_s_mem());
+		if (nsock->tls_wbio == NULL) {
+			BIO_free(nsock->tls_rbio);
+			nsock->tls_rbio = NULL;
+			result = ISC_R_TLSSESSIONFAILURE;
+			goto failure;
+		}
+
+		nsock->tls = SSL_new(sock->tls_ctx);
+		if (nsock->tls == NULL) {
+			BIO_free(nsock->tls_rbio);
+			nsock->tls_rbio = NULL;
+			BIO_free(nsock->tls_wbio);
+			nsock->tls_wbio = NULL;
+			result = ISC_R_TLSSESSIONFAILURE;
+			goto failure;
+		}
+
+		SSL_set_accept_state(nsock->tls);
+		SSL_set_bio(nsock->tls, nsock->tls_rbio, nsock->tls_wbio);
+	}
+#endif
+
 	nsock->references++;
 	nsock->statsindex = sock->statsindex;
 
@@ -5860,6 +6226,16 @@ isc__socket_accept(isc_socket_t *sock0,
 
 	UNLOCK(&sock->lock);
 	return (ISC_R_SUCCESS);
+
+failure:
+	if (nsock != NULL)
+		free_socket(&nsock);
+	if (ntask != NULL)
+		isc_task_detach(&ntask);
+	if (dev != NULL)
+		isc_event_free(ISC_EVENT_PTR(&dev));
+	UNLOCK(&sock->lock);
+	return (result);
 }
 
 isc_result_t
@@ -6243,24 +6619,37 @@ isc__socket_cancel(isc_socket_t *sock0, isc_task_t *task, unsigned int how) {
 		}
 	}
 
-	if (((how & ISC_SOCKCANCEL_SEND) == ISC_SOCKCANCEL_SEND)
-	    && !ISC_LIST_EMPTY(sock->send_list)) {
-		isc_socketevent_t      *dev;
-		isc_socketevent_t      *next;
-		isc_task_t	       *current_task;
+	if ((how & ISC_SOCKCANCEL_SEND) == ISC_SOCKCANCEL_SEND) {
+		if (!ISC_LIST_EMPTY(sock->send_list)) {
+			isc_socketevent_t      *dev;
+			isc_socketevent_t      *next;
+			isc_task_t	       *current_task;
 
-		dev = ISC_LIST_HEAD(sock->send_list);
+			dev = ISC_LIST_HEAD(sock->send_list);
 
-		while (dev != NULL) {
-			current_task = dev->ev_sender;
-			next = ISC_LIST_NEXT(dev, ev_link);
+			while (dev != NULL) {
+				current_task = dev->ev_sender;
+				next = ISC_LIST_NEXT(dev, ev_link);
 
-			if ((task == NULL) || (task == current_task)) {
-				dev->result = ISC_R_CANCELED;
-				send_senddone_event(sock, &dev);
+				if ((task == NULL) || (task == current_task)) {
+					dev->result = ISC_R_CANCELED;
+					send_senddone_event(sock, &dev);
+				}
+				dev = next;
 			}
-			dev = next;
 		}
+#ifdef OPENSSL
+		sock->tls_wbuf_length = 0U;
+		if (sock->tls_wdev != NULL) {
+			if ((task == NULL) ||
+			    (task == sock->tls_wdev->ev_sender))
+			{
+				sock->tls_wdev->result = ISC_R_CANCELED;
+				send_senddone_event(sock, &sock->tls_wdev);
+			}
+			sock->tls_wdev = NULL;
+		}
+#endif
 	}
 
 	if (((how & ISC_SOCKCANCEL_ACCEPT) == ISC_SOCKCANCEL_ACCEPT)

lib/ns/interfacemgr.c

@@ -241,7 +241,7 @@ ns_interfacemgr_create(isc_mem_t *mctx,
 #ifdef USE_ROUTE_SOCKET
 	mgr->route = NULL;
 	result = isc_socket_create(mgr->socketmgr, ROUTE_SOCKET_PROTOCOL,
-				   isc_sockettype_raw, &mgr->route);
+				   isc_sockettype_raw, 0, &mgr->route);
 	switch (result) {
 	case ISC_R_NOPERM:
 	case ISC_R_SUCCESS:
@@ -522,10 +522,14 @@ ns_interface_accepttcp(ns_interface_t *ifp) {
 
 	/*
 	 * Open a TCP socket.
+	 *
+	 * XXXMUKS: The following isc_socket_create() enforces TLS for
+	 * all TCP connections (which is clearly not for production). It
+	 * is to develop the TLS feature. It needs fixing.
 	 */
 	result = isc_socket_create(ifp->mgr->socketmgr,
 				   isc_sockaddr_pf(&ifp->addr),
-				   isc_sockettype_tcp,
+				   isc_sockettype_tcp, ISC_SOCKET_TLS,
 				   &ifp->tcpsocket);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,