ssl: Internaly use {active, N}

Make next_record an internal help function to next_event and avoid
duplicate calls to tls_socket:setopts for setting the active option.

1 files changed, 66 insertions, 63 deletions

diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 4dfb50967d..48f1206769 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -46,7 +46,7 @@
 -export([start_fsm/8, start_link/8, init/1, pids/1]).
 
 %% State transition handling	 
--export([next_record/1, next_event/3, next_event/4, 
+-export([next_event/3, next_event/4, 
          handle_common_event/4]).
 
 %% Handshake handling
@@ -61,7 +61,7 @@
          encode_alert/3, close/5, protocol_name/0]).
 
 %% Data handling
--export([encode_data/3, passive_receive/2, next_record_if_active/1, 
+-export([encode_data/3, passive_receive/2, 
          send/3, socket/5, setopts/3, getopts/3]).
 
 %% gen_statem state functions
@@ -161,30 +161,30 @@ next_record(#state{protocol_buffers =
 	    {Alert, State}
     end;
 next_record(#state{protocol_buffers = #protocol_buffers{tls_packets = [], tls_cipher_texts = []},
-		   socket = Socket,
+                   protocol_specific = #{active_n_toggle := true, active_n := N} = ProtocolSpec,
+ 		   socket = Socket,
                    close_tag = CloseTag,
 		   transport_cb = Transport} = State) ->
-    case tls_socket:setopts(Transport, Socket, [{active,once}]) of
-	ok ->
-	    {no_record, State};
-	_ ->
-            self() ! {CloseTag, Socket},
-	    {no_record, State}
-    end;
+     case tls_socket:setopts(Transport, Socket, [{active, N}]) of
+ 	ok ->
+             {no_record, State#state{protocol_specific = ProtocolSpec#{active_n_toggle => false}}}; 
+ 	_ ->
+             self() ! {CloseTag, Socket},
+             {no_record, State}
+     end;
 next_record(State) ->
     {no_record, State}.
 
 next_event(StateName, Record, State) ->
     next_event(StateName, Record, State, []).
-
-next_event(connection = StateName, no_record, State0, Actions) ->
-    case next_record_if_active(State0) of
-	{no_record, State} ->
-	    ssl_connection:hibernate_after(StateName, State, Actions);
-	{#ssl_tls{} = Record, State} ->
-	    {next_state, StateName, State, [{next_event, internal, {protocol_record, Record}} | Actions]};
-	{#alert{} = Alert, State} ->
-	    {next_state, StateName, State, [{next_event, internal, Alert} | Actions]}
+next_event(StateName, no_record, State0, Actions) ->
+    case next_record(State0) of
+ 	{no_record, State} ->
+            {next_state, StateName, State, Actions};
+ 	{#ssl_tls{} = Record, State} ->
+ 	    {next_state, StateName, State, [{next_event, internal, {protocol_record, Record}} | Actions]};
+ 	{#alert{} = Alert, State} ->
+ 	    {next_state, StateName, State, [{next_event, internal, Alert} | Actions]}
     end;
 next_event(StateName, Record, State, Actions) ->
     case Record of
@@ -207,22 +207,21 @@ handle_common_event(internal,  #ssl_tls{type = ?HANDSHAKE, fragment = Data},
 				      ssl_options = Options} = State0) ->
     try
 	{Packets, Buf} = tls_handshake:get_tls_handshake(Version,Data,Buf0, Options),
-	State1 =
+	State =
 	    State0#state{protocol_buffers =
 			     Buffers#protocol_buffers{tls_handshake_buffer = Buf}},
 	case Packets of
             [] -> 
                 assert_buffer_sanity(Buf, Options),
-                {Record, State} = next_record(State1),
-                next_event(StateName, Record, State);
+                next_event(StateName, no_record, State);
             _ ->                
                 Events = tls_handshake_events(Packets),
                 case StateName of
                     connection ->
-                        ssl_connection:hibernate_after(StateName, State1, Events);
+                        ssl_connection:hibernate_after(StateName, State, Events);
                     _ ->
                         {next_state, StateName, 
-                         State1#state{unprocessed_handshake_events = unprocessed_events(Events)}, Events}
+                         State#state{unprocessed_handshake_events = unprocessed_events(Events)}, Events}
                 end
         end
     catch throw:#alert{} = Alert ->
@@ -277,11 +276,10 @@ renegotiate(#state{role = server,
     {BinMsg, ConnectionStates} = 
 	tls_record:encode_handshake(Frag, Version, ConnectionStates0),
     send(Transport, Socket, BinMsg),
-    State1 = State0#state{connection_states = 
+    State = State0#state{connection_states = 
 			     ConnectionStates,
 			 tls_handshake_history = Hs0},
-    {Record, State} = next_record(State1),
-    next_event(hello, Record, State, Actions).
+    next_event(hello, no_record, State, Actions).
 	     
 send_handshake(Handshake, State) ->
     send_handshake_flight(queue_handshake(Handshake, State)).
@@ -411,23 +409,15 @@ protocol_name() ->
 encode_data(Data, Version, ConnectionStates0)->
     tls_record:encode_data(Data, Version, ConnectionStates0).
 
-passive_receive(State0 = #state{user_data_buffer = Buffer}, StateName) -> 
+passive_receive(#state{user_data_buffer = Buffer} = State0, StateName) -> 
     case Buffer of
 	<<>> ->
-	    {Record, State} = next_record(State0),
-	    next_event(StateName, Record, State);
+	    next_event(StateName, no_record, State0);
 	_ ->
 	    {Record, State} = ssl_connection:read_application_data(<<>>, State0),
-	    next_event(StateName, Record, State)
+            next_event(StateName, Record, State)
     end.
 
-next_record_if_active(State = 
-		      #state{socket_options = 
-			     #socket_options{active = false}}) -> 
-    {no_record ,State};
-next_record_if_active(State) ->
-    next_record(State).
-
 send(Transport, Socket, Data) ->
    tls_socket:send(Transport, Socket, Data).
 
@@ -469,15 +459,14 @@ init({call, From}, {start, Timeout},
     {BinMsg, ConnectionStates, Handshake} =
         encode_handshake(Hello,  HelloVersion, ConnectionStates0, Handshake0),
     send(Transport, Socket, BinMsg),
-    State1 = State0#state{connection_states = ConnectionStates,
-			  negotiated_version = Version, %% Requested version
-			  session =
-			      Session0#session{session_id = Hello#client_hello.session_id},
-			  tls_handshake_history = Handshake,
-			  start_or_recv_from = From,
+    State = State0#state{connection_states = ConnectionStates,
+                         negotiated_version = Version, %% Requested version
+                         session =
+                             Session0#session{session_id = Hello#client_hello.session_id},
+                         tls_handshake_history = Handshake,
+                         start_or_recv_from = From,
 			  timer = Timer},
-    {Record, State} = next_record(State1),
-    next_event(hello, Record, State);
+    next_event(hello, no_record, State);
 init(Type, Event, State) ->
     gen_handshake(?FUNCTION_NAME, Type, Event, State).
  
@@ -612,36 +601,33 @@ connection(internal, #hello_request{},
 		  connection_states = ConnectionStates} = State0) ->
     Hello = tls_handshake:client_hello(Host, Port, ConnectionStates, SslOpts,
 				       Cache, CacheCb, Renegotiation, Cert),
-    {State1, Actions} = send_handshake(Hello, State0),
-    {Record, State} =
-	next_record(
-	  State1#state{session = Session0#session{session_id
-						  = Hello#client_hello.session_id}}),
-    next_event(hello, Record, State, Actions);
+    {State, Actions} = send_handshake(Hello, State0),
+    next_event(hello, no_record, State#state{session = Session0#session{session_id
+                                                                        = Hello#client_hello.session_id}}, Actions);
 connection(internal, #client_hello{} = Hello, 
 	   #state{role = server, allow_renegotiate = true, connection_states = CS,
                   %%protocol_cb = Connection,
                   protocol_specific = #{sender := Sender}
-                 } = State0) ->
+                 } = State) ->
     %% Mitigate Computational DoS attack
     %% http://www.educatedguesswork.org/2011/10/ssltls_and_computational_dos.html
     %% http://www.thc.org/thc-ssl-dos/ Rather than disabling client
     %% initiated renegotiation we will disallow many client initiated
     %% renegotiations immediately after each other.
     erlang:send_after(?WAIT_TO_ALLOW_RENEGOTIATION, self(), allow_renegotiate),
-    {Record, State} = next_record(State0#state{allow_renegotiate = false,
-					       renegotiation = {true, peer}}),
     {ok, Write} = tls_sender:renegotiate(Sender),
-    next_event(hello, Record, State#state{connection_states = CS#{current_write => Write}}, 
+    next_event(hello, no_record, State#state{connection_states = CS#{current_write => Write},
+                                             allow_renegotiate = false,
+                                             renegotiation = {true, peer}
+                                            }, 
                [{next_event, internal, Hello}]);
 connection(internal, #client_hello{}, 
 	   #state{role = server, allow_renegotiate = false,
                   protocol_cb = Connection} = State0) ->
     Alert = ?ALERT_REC(?WARNING, ?NO_RENEGOTIATION),
     send_alert_in_connection(Alert, State0),
-    State1 = Connection:reinit_handshake_data(State0),
-    {Record, State} = next_record(State1),
-    next_event(?FUNCTION_NAME, Record, State);
+    State = Connection:reinit_handshake_data(State0),
+    next_event(?FUNCTION_NAME, no_record, State);
 connection(Type, Event, State) ->
     ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
@@ -684,6 +670,13 @@ initial_state(Role, Sender, Host, Port, Socket, {SSLOptions, SocketOptions, Trac
 			 _  ->
 			     ssl_session_cache
 		     end,
+
+    InternalActiveN =  case application:get_env(ssl, internal_active_n) of
+                           {ok, N} when is_integer(N) andalso (not IsErlDist) ->
+                               N;
+                           _  ->
+                               ?INTERNAL_ACTIVE_N
+                       end,
     
     UserMonitor = erlang:monitor(process, User),
 
@@ -710,7 +703,10 @@ initial_state(Role, Sender, Host, Port, Socket, {SSLOptions, SocketOptions, Trac
 	   protocol_cb = ?MODULE,
 	   tracker = Tracker,
 	   flight_buffer = [],
-           protocol_specific = #{sender => Sender}
+           protocol_specific = #{sender => Sender,
+                                 active_n => InternalActiveN,
+                                 active_n_toggle => true
+                                }
 	  }.
 
 erl_dist_data(true) ->
@@ -771,7 +767,8 @@ tls_handshake_events(Packets) ->
 
 %% raw data from socket, upack records
 handle_info({Protocol, _, Data}, StateName,
-            #state{data_tag = Protocol} = State0) ->
+            #state{data_tag = Protocol
+                  } = State0) ->
     case next_tls_record(Data, StateName, State0) of
 	{Record, State} ->
 	    next_event(StateName, Record, State);
@@ -779,11 +776,16 @@ handle_info({Protocol, _, Data}, StateName,
 	    ssl_connection:handle_normal_shutdown(Alert, StateName, State0), 
 	    ssl_connection:stop({shutdown, own_alert}, State0)
     end;
+handle_info({tcp_passive, Socket},  StateName, #state{socket = Socket,
+                                                      protocol_specific = PS
+                                                     } = State) ->
+    next_event(StateName, no_record, State#state{protocol_specific = PS#{active_n_toggle => true}});
 handle_info({CloseTag, Socket}, StateName,
             #state{socket = Socket, close_tag = CloseTag,
                    socket_options = #socket_options{active = Active},
                    protocol_buffers = #protocol_buffers{tls_cipher_texts = CTs},
                    user_data_buffer = Buffer,
+                   protocol_specific = PS,
 		   negotiated_version = Version} = State) ->
 
     %% Note that as of TLS 1.1,
@@ -809,8 +811,9 @@ handle_info({CloseTag, Socket}, StateName,
         true ->
             %% Fixes non-delivery of final TLS record in {active, once}.
             %% Basically allows the application the opportunity to set {active, once} again
-            %% and then receive the final message.
-            next_event(StateName, no_record, State)
+            %% and then receive the final message. Set internal active_n to zero 
+            %% to ensure socket close message is sent if there is not enough data to deliver.
+            next_event(StateName, no_record, State#state{protocol_specific = PS#{active_n_toggle => true}})
     end;
 handle_info({'EXIT', Sender, Reason}, _,
             #state{protocol_specific = #{sender := Sender}} = State) ->