libcouchbase 0.0.1

data/ext/libcouchbase/src/ssl/CMakeLists.txt

@@ -0,0 +1,23 @@
+IF(APPLE)
+    IF(NOT OpenSSL_DIR)
+        EXECUTE_PROCESS(COMMAND brew --prefix openssl
+                        OUTPUT_VARIABLE OPENSSL_ROOT_DIR
+                        OUTPUT_STRIP_TRAILING_WHITESPACE)
+        MESSAGE(STATUS "Found OpenSSL Prefix: ${OPENSSL_ROOT_DIR}")
+    ENDIF()
+ENDIF()
+
+FIND_PACKAGE(OpenSSL)
+IF(OPENSSL_FOUND AND (NOT LCB_NO_SSL))
+    INCLUDE_DIRECTORIES(${OPENSSL_INCLUDE_DIR})
+    ADD_DEFINITIONS(${OPENSSL_DEFINITIONS})
+    ADD_LIBRARY(lcbssl OBJECT ssl_e.c ssl_c.c ssl_common.c)
+    SET(lcb_ssl_libs ${OPENSSL_LIBRARIES} PARENT_SCOPE)
+    SET(lcb_ssl_objs $<TARGET_OBJECTS:lcbssl> PARENT_SCOPE)
+    LCB_UTIL(lcbssl)
+    MESSAGE(STATUS "SSL Found")
+ELSE()
+    SET(LCB_NO_SSL ON PARENT_SCOPE)
+    SET(lcb_ssl_libs "" PARENT_SCOPE)
+    MESSAGE(STATUS "SSL Not Found")
+ENDIF()

data/ext/libcouchbase/src/ssl/ssl_c.c

@@ -0,0 +1,415 @@
+/* -*- Mode: C; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2014 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#include "ssl_iot_common.h"
+#include "sllist.h"
+#include "sllist-inl.h"
+
+/* throw-away write buffer structure (for encoded data) */
+typedef struct {
+    void *parent;
+    char buf[1];
+} my_WBUF;
+
+/* throw-away write buffer structure (for application data) */
+typedef struct {
+    sllist_node slnode;
+    lcb_ioC_write2_callback cb;
+    void *uarg;
+    void *iovroot_;
+    lcb_IOV *iov;
+    lcb_size_t niov;
+} my_WCTX;
+
+typedef struct {
+    IOTSSL_COMMON_FIELDS
+    lcb_sockdata_t *sd; /**< Socket pointer */
+    lcbio_pTIMER as_read; /**< For callbacks when SSL_pending > 0 */
+    lcbio_pTIMER as_write; /**< For callbacks when SSL_writes succeeds */
+    lcb_IOV urd_iov; /**< User-defined buffer to read in applicataion data */
+    void *urd_arg; /**< User-defined argument for read callback */
+    my_WCTX *wctx_cached;
+    lcb_ioC_read2_callback urd_cb; /**< User defined read callback */
+    sllist_root writes; /**< List of pending user writes */
+
+    /**
+     * Whether a current read request is active. This read request refers to
+     * this module reading raw data from the actual underlying socket. The
+     * presence of a user-level (i.e. lcbio-invoked) read request is determined
+     * by the presence of a non-NULL urd_cb value
+     */
+    int rdactive;
+
+    int closed; /**< Pending delivery of close */
+    int entered;
+} lcbio_CSSL;
+
+#define CS_FROM_IOPS(iops) (lcbio_CSSL *)IOTSSL_FROM_IOPS(iops)
+#define SCHEDULE_WANT_SAFE(cs) if (!(cs)->entered) { schedule_wants(cs); }
+
+static void appdata_encode(lcbio_CSSL *);
+static void appdata_free_flushed(lcbio_CSSL *);
+static void appdata_read(lcbio_CSSL *);
+static void schedule_wants(lcbio_CSSL *cs);
+static int maybe_set_error(lcbio_CSSL *cs, int rv)
+{
+    return iotssl_maybe_error((lcbio_XSSL *)cs, rv);
+}
+
+/* This function goes through all the pending copies of data that was scheduled
+ * for write and where the current IOV position is at the end (or niov==0).
+ * For each of those routines this function will invoke its write callback
+ */
+static void
+appdata_free_flushed(lcbio_CSSL *cs)
+{
+    sllist_iterator iter;
+    SLLIST_ITERFOR(&cs->writes, &iter) {
+        my_WCTX *cur = SLLIST_ITEM(iter.cur, my_WCTX, slnode);
+        if (cur->niov && cs->error == 0) {
+            break;
+        }
+        /* invoke the callback */
+        cur->cb(cs->sd, cs->error?-1:0, cur->uarg);
+        sllist_iter_remove(&cs->writes, &iter);
+        free(cur->iovroot_);
+        if (cs->wctx_cached) {
+            free(cur);
+        } else {
+            cs->wctx_cached = cur;
+        }
+    }
+}
+
+/* This function will attempt to encode pending user data into SSL data. This
+ * will be output to the wbio. */
+static void
+appdata_encode(lcbio_CSSL *cs)
+{
+    sllist_node *cur;
+
+    /* each element here represents a used-defined write buffer */
+    SLLIST_FOREACH(&cs->writes, cur) {
+        my_WCTX *ctx = SLLIST_ITEM(cur, my_WCTX, slnode);
+
+        for (; ctx->niov && cs->error == 0; ctx->niov--, ctx->iov++) {
+            int rv;
+
+            assert(ctx->iov->iov_len);
+            rv = SSL_write(cs->ssl, ctx->iov->iov_base, ctx->iov->iov_len);
+            if (rv > 0) {
+                continue;
+            } else if (maybe_set_error(cs, rv) == 0) {
+                /* SSL_ERROR_WANT_READ. Should schedule a read here.
+                 * XXX: Note that this buffer will not be returned to the user
+                 * until the _next_ time the appdata_free_flushed function is
+                 * invoked; the call chain for appdata_free_flushed is like this:
+                 *
+                 * start_write2 => async_schedule(async_write) => appdata_free_flushed.
+                 * OR
+                 * start_write2 => write_callback => appdata_free_flushed
+                 */
+                SCHEDULE_WANT_SAFE(cs)
+                return;
+            } else {
+                IOTSSL_ERRNO(cs) = EINVAL;
+            }
+        }
+    }
+}
+
+static void
+async_write(void *arg)
+{
+    lcbio_CSSL *cs = arg;
+    appdata_encode(cs);
+    appdata_free_flushed(cs);
+}
+
+/* Called when SSL data has been written to the socket */
+static void
+write_callback(lcb_sockdata_t *sd, int status, void *arg)
+{
+    my_WBUF *wb = arg;
+    lcbio_CSSL *cs = wb->parent;
+
+    if (status) {
+        IOTSSL_ERRNO(cs) = IOT_ERRNO(cs->orig);
+        cs->error = 1;
+    }
+
+    free(wb);
+
+    appdata_free_flushed(cs);
+    lcbio_table_unref(&cs->base_);
+    (void) sd;
+}
+
+/* Read application data from SSL's rbio buffer. Invokes the user callback
+ * for the current read operation if there is data */
+static void
+appdata_read(lcbio_CSSL *cs)
+{
+    /* either an error or an actual read event */
+    int nr;
+    lcb_ioC_read2_callback cb = cs->urd_cb;
+    if (!cb) {
+        return;
+    }
+    assert(!cs->rdactive);
+    nr = SSL_read(cs->ssl, cs->urd_iov.iov_base, cs->urd_iov.iov_len);
+    if (nr > 0) {
+        /* nothing */
+    } else if (cs->closed || nr == 0) {
+        nr = 0;
+    } else if (maybe_set_error(cs, nr) == 0) {
+        return;
+    }
+
+    cs->urd_cb = NULL;
+    cb(cs->sd, nr, cs->urd_arg);
+}
+
+/* Invoked when SSL data has been read from the socket */
+static void
+read_callback(lcb_sockdata_t *sd, lcb_ssize_t nr, void *arg)
+{
+    lcbio_CSSL *cs = arg;
+    cs->rdactive = 0;
+    cs->entered++;
+
+    if (nr > 0) {
+        BUF_MEM *mb;
+
+        BIO_clear_retry_flags(cs->rbio);
+        BIO_get_mem_ptr(cs->rbio, &mb);
+        mb->length += nr;
+
+    } else if (nr == 0) {
+        cs->closed = 1;
+        cs->error = 1;
+
+    } else {
+        cs->error = 1;
+        IOTSSL_ERRNO(cs) = IOT_ERRNO(cs->orig);
+    }
+
+    appdata_encode(cs);
+    appdata_read(cs);
+
+    cs->entered--;
+    schedule_wants(cs);
+    lcbio_table_unref(&cs->base_);
+    (void) sd;
+}
+
+
+/* This function schedules any I/O on the actual socket. It writes encoded
+ * data and requests to read decoded data */
+static void
+schedule_wants(lcbio_CSSL *cs)
+{
+    size_t npend = BIO_ctrl_pending(cs->wbio);
+    char dummy;
+
+    int has_appdata = 0;
+
+    if (SSL_peek(cs->ssl, &dummy, 1) == 1) {
+        has_appdata = 1;
+    }
+
+    if (npend) {
+        /* Have pending data to write. The buffer is copied here because the
+         * BIO structure doesn't support "lockdown" semantics like netbuf/rdb
+         * do. We might transplant this with a different sort of BIO eventually..
+         */
+        my_WBUF *wb = malloc(sizeof(*wb) + npend);
+        lcb_IOV iov;
+        BIO_read(cs->wbio, wb->buf, npend);
+        iov.iov_base = wb->buf;
+        iov.iov_len = npend;
+        wb->parent = cs;
+
+        /* Increment the reference count. This is decremented when we get back
+         * the callback. The goal is that a pending internal SSL_write() should
+         * keep the object alive despite the user having called lcbio_table_unref()
+         * on us.
+         */
+        lcbio_table_ref(&cs->base_);
+        IOT_V1(cs->orig).write2(
+            IOT_ARG(cs->orig), cs->sd, &iov, 1, wb, write_callback);
+    }
+
+    /* Only schedule additional reads if we're not already in the process of a
+     * read */
+
+    if (cs->rdactive == 0) {
+        if (cs->error) {
+            /* This can happen if we got an SSL error in performing something
+             * within this callback.
+             *
+             * In this case, just signal "as-if" a read happened. appdata_read
+             * will do the right thing if there is no read callback, and will
+             * return an error if SSL_read() fails (which it should).
+             */
+            lcbio_async_signal(cs->as_read);
+
+        } else if (SSL_want_read(cs->ssl) || (cs->urd_cb && has_appdata == 0)) {
+            /* request more data from the socket */
+            BUF_MEM *mb;
+            lcb_IOV iov;
+
+            cs->rdactive = 1;
+            BIO_get_mem_ptr(cs->rbio, &mb);
+            iotssl_bm_reserve(mb);
+            iov.iov_base = mb->data + mb->length;
+            iov.iov_len = mb->max - mb->length;
+            lcbio_table_ref(&cs->base_);
+            IOT_V1(cs->orig).read2(
+                IOT_ARG(cs->orig), cs->sd, &iov, 1, cs, read_callback);
+        }
+
+    }
+}
+
+static int
+Cssl_read2(lcb_io_opt_t iops, lcb_sockdata_t *sd, lcb_IOV *iov, lcb_size_t niov,
+    void *uarg, lcb_ioC_read2_callback callback)
+{
+    lcbio_CSSL *cs = CS_FROM_IOPS(iops);
+    cs->urd_iov = *iov;
+    cs->urd_arg = uarg;
+    cs->urd_cb = callback;
+
+    IOTSSL_PENDING_PRECHECK(cs->ssl);
+    if (IOTSSL_IS_PENDING(cs->ssl)) {
+        /* have data to be read. Fast path here */
+        lcbio_async_signal(cs->as_read);
+    } else {
+        SCHEDULE_WANT_SAFE(cs);
+    }
+
+    (void) niov; (void) sd;
+    return 0;
+}
+
+static int
+Cssl_write2(lcb_io_opt_t io, lcb_sockdata_t *sd, lcb_IOV *iov, lcb_size_t niov,
+    void *uarg, lcb_ioC_write2_callback callback)
+{
+    lcbio_CSSL *cs = CS_FROM_IOPS(io);
+    my_WCTX *wc;
+
+    /* We keep one of these cached inside the cs structure so we don't have
+     * to make a new malloc for each write */
+    if (cs->wctx_cached) {
+        wc = cs->wctx_cached;
+        cs->wctx_cached = NULL;
+        memset(wc, 0, sizeof *wc);
+    } else {
+        wc = calloc(1, sizeof(*wc));
+    }
+
+    /* assign the common parameters */
+    wc->uarg = uarg;
+    wc->cb = callback;
+
+    /* If the socket does not have a pending error and there are no other
+     * writes before this, then try to write the current buffer immediately. */
+    if (cs->error == 0 && SLLIST_IS_EMPTY(&cs->writes)) {
+        unsigned ii;
+        for (ii = 0; ii < niov; ++ii) {
+            int rv = SSL_write(cs->ssl, iov->iov_base, iov->iov_len);
+            if (rv > 0) {
+                iov++;
+                niov--;
+            } else {
+                maybe_set_error(cs, rv);
+                break;
+            }
+        }
+    }
+
+    /* We add this now in order for the SLLIST_IS_EMPTY to be false before, if
+     * no other items were pending */
+    sllist_append(&cs->writes, &wc->slnode);
+
+    /* If we have some IOVs remaining then it means we couldn't write all the
+     * data. If so, reschedule and place in the queue for later */
+    if (niov && cs->error == 0) {
+        wc->niov = niov;
+        wc->iov = malloc(sizeof (*iov) * wc->niov);
+        wc->iovroot_ = wc->iov;
+        memcpy(wc->iov, iov, sizeof (*iov) * niov);
+        /* This function will try to schedule the proper events. We need at least
+         * one SSL_write() in order to advance the state machine. In the future
+         * we could determine if we performed a previous SSL_write above */
+        appdata_encode(cs);
+    }
+
+    /* In most cases we will want to deliver the "flushed" notification */
+    lcbio_async_signal(cs->as_write);
+    (void) sd;
+    return 0;
+}
+
+static unsigned
+Cssl_close(lcb_io_opt_t io, lcb_sockdata_t *sd)
+{
+    lcbio_CSSL *cs = CS_FROM_IOPS(io);
+    IOT_V1(cs->orig).close(IOT_ARG(cs->orig), sd);
+    cs->error = 1;
+    if (!SLLIST_IS_EMPTY(&cs->writes)) {
+        /* It is possible that a prior call to SSL_write returned an SSL_want_read
+         * and the next subsequent call to the underlying read API returned an
+         * error. For this reason we signal to the as_write function (which
+         * then calls the appdata_free_flushed function) in case we have such
+         * leftover data.
+         */
+        lcbio_async_signal(cs->as_write);
+    }
+    return 0;
+}
+
+static void
+Cssl_dtor(void *arg)
+{
+    lcbio_CSSL *cs = arg;
+    assert(SLLIST_IS_EMPTY(&cs->writes));
+    lcbio_timer_destroy(cs->as_read);
+    lcbio_timer_destroy(cs->as_write);
+    iotssl_destroy_common((lcbio_XSSL *)cs);
+    free(cs->wctx_cached);
+    free(arg);
+}
+
+lcbio_pTABLE
+lcbio_Cssl_new(lcbio_pTABLE orig, lcb_sockdata_t *sd, SSL_CTX *sctx)
+{
+    lcbio_CSSL *ret = calloc(1, sizeof(*ret));
+    lcbio_pTABLE iot = &ret->base_;
+    ret->sd = sd;
+    ret->as_read = lcbio_timer_new(orig, ret, (void (*)(void*))appdata_read);
+    ret->as_write = lcbio_timer_new(orig, ret, async_write);
+    ret->base_.dtor = Cssl_dtor;
+
+    iot->u_io.completion.read2 = Cssl_read2;
+    iot->u_io.completion.write2 = Cssl_write2;
+    iot->u_io.completion.close = Cssl_close;
+    iotssl_init_common((lcbio_XSSL *)ret, orig, sctx);
+    return iot;
+}

data/ext/libcouchbase/src/ssl/ssl_common.c

@@ -0,0 +1,454 @@
+/* -*- Mode: C; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2014 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+/**
+ * This file contains the common bucket of routines necessary for interfacing
+ * with OpenSSL.
+ */
+#include "ssl_iot_common.h"
+#include "settings.h"
+#include "logging.h"
+#include <openssl/err.h>
+
+#define LOGARGS(ssl, lvl) \
+    ((lcbio_SOCKET*)SSL_get_app_data(ssl))->settings, "SSL", lvl, __FILE__, __LINE__
+static char *global_event = "dummy event for ssl";
+
+/******************************************************************************
+ ******************************************************************************
+ ** Boilerplate lcbio_TABLE Wrappers                                         **
+ ******************************************************************************
+ ******************************************************************************/
+static void loop_run(lcb_io_opt_t io) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    IOT_START(xs->orig);
+}
+static void loop_stop(lcb_io_opt_t io) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    IOT_STOP(xs->orig);
+}
+static void *create_event(lcb_io_opt_t io) {
+    (void)io;
+    return global_event;
+}
+static void destroy_event(lcb_io_opt_t io, void *event) {
+    (void) io; (void) event;
+}
+static void *create_timer(lcb_io_opt_t io) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    return xs->orig->timer.create(IOT_ARG(xs->orig));
+}
+static int schedule_timer(lcb_io_opt_t io, void *timer, lcb_uint32_t us,
+    void *arg, lcb_ioE_callback callback) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    return xs->orig->timer.schedule(IOT_ARG(xs->orig), timer, us, arg, callback);
+}
+static void destroy_timer(lcb_io_opt_t io, void *timer) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    xs->orig->timer.destroy(IOT_ARG(xs->orig), timer);
+}
+static void cancel_timer(lcb_io_opt_t io, void *timer) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    xs->orig->timer.cancel(IOT_ARG(xs->orig), timer);
+}
+static int Eis_closed(lcb_io_opt_t io, lcb_socket_t sock, int flags) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    return xs->orig->u_io.v0.io.is_closed(IOT_ARG(xs->orig), sock, flags);
+}
+static int Cis_closed(lcb_io_opt_t io, lcb_sockdata_t *sd, int flags) {
+    lcbio_XSSL *xs = IOTSSL_FROM_IOPS(io);
+    return xs->orig->u_io.completion.is_closed(IOT_ARG(xs->orig), sd, flags);
+}
+
+/******************************************************************************
+ ******************************************************************************
+ ** Common Routines for lcbio_TABLE Emulation                                **
+ ******************************************************************************
+ ******************************************************************************/
+void
+iotssl_init_common(lcbio_XSSL *xs, lcbio_TABLE *orig, SSL_CTX *sctx)
+{
+    lcbio_TABLE *base = &xs->base_;
+    xs->iops_dummy_ = calloc(1, sizeof(*xs->iops_dummy_));
+    xs->iops_dummy_->v.v0.cookie = xs;
+    xs->orig = orig;
+    base->model = xs->orig->model;
+    base->p = xs->iops_dummy_;
+    base->refcount = 1;
+    base->loop.start = loop_run;
+    base->loop.stop = loop_stop;
+    base->timer.create = create_timer;
+    base->timer.destroy = destroy_timer;
+    base->timer.schedule = schedule_timer;
+    base->timer.cancel = cancel_timer;
+
+    if (orig->model == LCB_IOMODEL_EVENT) {
+        base->u_io.v0.ev.create = create_event;
+        base->u_io.v0.ev.destroy = destroy_event;
+        base->u_io.v0.io.is_closed = Eis_closed;
+    } else {
+        base->u_io.completion.is_closed = Cis_closed;
+    }
+
+    lcbio_table_ref(xs->orig);
+
+    xs->error = 0;
+    xs->ssl = SSL_new(sctx);
+
+    xs->rbio = BIO_new(BIO_s_mem());
+    xs->wbio = BIO_new(BIO_s_mem());
+
+    SSL_set_bio(xs->ssl, xs->rbio, xs->wbio);
+    SSL_set_read_ahead(xs->ssl, 0);
+
+    /* Indicate that we are a client */
+    SSL_set_connect_state(xs->ssl);
+}
+
+void
+iotssl_destroy_common(lcbio_XSSL *xs)
+{
+    free(xs->iops_dummy_);
+    SSL_free(xs->ssl);
+    lcbio_table_unref(xs->orig);
+}
+
+void
+iotssl_bm_reserve(BUF_MEM *bm)
+{
+    int oldlen;
+    oldlen = bm->length;
+    while (bm->max - bm->length < 4096) {
+        /* there's also a BUF_MEM_grow_clean() but that actually clears the
+         * used portion of the buffer */
+        BUF_MEM_grow(bm, bm->max + 4096);
+    }
+    bm->length = oldlen;
+}
+
+void
+iotssl_log_errors(lcbio_XSSL *xs)
+{
+    unsigned long curerr;
+    while ((curerr = ERR_get_error())) {
+        char errbuf[4096];
+        ERR_error_string_n(curerr, errbuf, sizeof errbuf);
+        lcb_log(LOGARGS(xs->ssl, LCB_LOG_ERROR), "%s", errbuf);
+
+        if (xs->errcode != LCB_SUCCESS) {
+            continue; /* Already set */
+        }
+
+        if (ERR_GET_LIB(curerr) == ERR_LIB_SSL) {
+            switch (ERR_GET_REASON(curerr)) {
+            case SSL_R_CERTIFICATE_VERIFY_FAILED:
+            case SSL_R_MISSING_VERIFY_MESSAGE:
+                xs->errcode = LCB_SSL_CANTVERIFY;
+                break;
+
+            case SSL_R_BAD_PROTOCOL_VERSION_NUMBER:
+            case SSL_R_UNKNOWN_PROTOCOL:
+            case SSL_R_WRONG_VERSION_NUMBER:
+            case SSL_R_UNKNOWN_SSL_VERSION:
+            case SSL_R_UNSUPPORTED_SSL_VERSION:
+                xs->errcode = LCB_PROTOCOL_ERROR;
+                break;
+            default:
+                xs->errcode = LCB_SSL_ERROR;
+            }
+        }
+    }
+}
+
+static void
+log_global_errors(lcb_settings *settings)
+{
+    unsigned long curerr;
+    while ((curerr = ERR_get_error())) {
+        char errbuf[4096];
+        ERR_error_string_n(curerr, errbuf, sizeof errbuf);
+        lcb_log(settings, "SSL", LCB_LOG_ERROR, __FILE__, __LINE__, "SSL Error: %ld, %s", curerr, errbuf);
+    }
+}
+
+int
+iotssl_maybe_error(lcbio_XSSL *xs, int rv)
+{
+    assert(rv < 1);
+    if (rv == -1) {
+        int err = SSL_get_error(xs->ssl, rv);
+        if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
+            /* this is ok. */
+            return 0;
+        }
+    }
+    iotssl_log_errors(xs);
+    return -1;
+}
+
+/******************************************************************************
+ ******************************************************************************
+ ** Higher Level SSL_CTX Wrappers                                            **
+ ******************************************************************************
+ ******************************************************************************/
+static void
+log_callback(const SSL *ssl, int where, int ret)
+{
+    const char *retstr = "";
+    int should_log = 0;
+    lcbio_SOCKET *sock = SSL_get_app_data(ssl);
+    /* Ignore low-level SSL stuff */
+
+    if (where & SSL_CB_ALERT) {
+        should_log = 1;
+    }
+    if (where == SSL_CB_HANDSHAKE_START || where == SSL_CB_HANDSHAKE_DONE) {
+        should_log = 1;
+    }
+    if ((where & SSL_CB_EXIT) && ret == 0) {
+        should_log = 1;
+    }
+
+    if (!should_log) {
+        return;
+    }
+
+    retstr = SSL_alert_type_string(ret);
+    lcb_log(LOGARGS(ssl, LCB_LOG_TRACE), "sock=%p: ST(0x%x). %s. R(0x%x)%s",
+        (void*)sock, where, SSL_state_string_long(ssl), ret, retstr);
+
+    if (where == SSL_CB_HANDSHAKE_DONE) {
+        lcb_log(LOGARGS(ssl, LCB_LOG_DEBUG), "sock=%p. Using SSL version %s. Cipher=%s", (void*)sock, SSL_get_version(ssl), SSL_get_cipher_name(ssl));
+    }
+}
+
+#if 0
+static void
+msg_callback(int write_p, int version, int ctype, const void *buf, size_t n,
+    SSL *ssl, void *arg)
+{
+    printf("Got message (%s). V=0x%x. T=%d. N=%lu\n",
+        write_p ? ">" : "<", version, ctype, n);
+    (void)ssl; (void)arg; (void)buf;
+}
+#endif
+
+struct lcbio_SSLCTX {
+    SSL_CTX *ctx;
+};
+
+lcbio_pSSLCTX
+lcbio_ssl_new(const char *cafile, int noverify, lcb_error_t *errp,
+    lcb_settings *settings)
+{
+    lcb_error_t err_s;
+    lcbio_pSSLCTX ret;
+
+    if (!errp) {
+        errp = &err_s;
+    }
+
+    ret = calloc(1, sizeof(*ret));
+    if (!ret) {
+        *errp = LCB_CLIENT_ENOMEM;
+        goto GT_ERR;
+    }
+    ret->ctx = SSL_CTX_new(SSLv23_client_method());
+    if (!ret->ctx) {
+        *errp = LCB_SSL_ERROR;
+        goto GT_ERR;
+
+    }
+    SSL_CTX_set_cipher_list(ret->ctx, "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:SEED-SHA:RC2-CBC-MD5:RC4-SHA:RC4-MD5:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5");
+//    SSL_CTX_set_cipher_list(ret->ctx, "!NULL");
+
+    if (cafile) {
+        if (!SSL_CTX_load_verify_locations(ret->ctx, cafile, NULL)) {
+            *errp = LCB_SSL_ERROR;
+            goto GT_ERR;
+        }
+    }
+
+    if (noverify) {
+        SSL_CTX_set_verify(ret->ctx, SSL_VERIFY_NONE, NULL);
+    } else {
+        SSL_CTX_set_verify(ret->ctx, SSL_VERIFY_PEER, NULL);
+    }
+
+    SSL_CTX_set_info_callback(ret->ctx, log_callback);
+    #if 0
+    SSL_CTX_set_msg_callback(ret->ctx, msg_callback);
+    #endif
+
+    /* this will allow us to do SSL_write and use a different buffer if the
+     * first one fails. This is helpful in the scenario where an initial
+     * SSL_write() returns an SSL_ERROR_WANT_READ in the ssl_e.c plugin. In
+     * such a scenario the correct behavior is to return EWOULDBLOCK. However
+     * we have no guarantee that the next time we get a write request we would
+     * be using the same buffer.
+     */
+    SSL_CTX_set_mode(ret->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+    SSL_CTX_set_options(ret->ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);
+    return ret;
+
+    GT_ERR:
+    log_global_errors(settings);
+    if (ret) {
+        if (ret->ctx) {
+            SSL_CTX_free(ret->ctx);
+        }
+        free(ret);
+    }
+    return NULL;
+}
+
+static void
+noop_dtor(lcbio_PROTOCTX *arg) {
+    free(arg);
+}
+
+lcb_error_t
+lcbio_ssl_apply(lcbio_SOCKET *sock, lcbio_pSSLCTX sctx)
+{
+    lcbio_pTABLE old_iot = sock->io, new_iot;
+    lcbio_PROTOCTX *sproto;
+
+    if (old_iot->model == LCB_IOMODEL_EVENT) {
+        new_iot = lcbio_Essl_new(old_iot, sock->u.fd, sctx->ctx);
+    } else {
+        new_iot = lcbio_Cssl_new(old_iot, sock->u.sd, sctx->ctx);
+    }
+
+    if (new_iot) {
+        sproto = calloc(1, sizeof(*sproto));
+        sproto->id = LCBIO_PROTOCTX_SSL;
+        sproto->dtor = noop_dtor;
+        lcbio_protoctx_add(sock, sproto);
+        lcbio_table_unref(old_iot);
+        sock->io = new_iot;
+        /* just for logging */
+        SSL_set_app_data(((lcbio_XSSL *)new_iot)->ssl, sock);
+        return LCB_SUCCESS;
+
+    } else {
+        return LCB_ERROR;
+    }
+}
+
+int
+lcbio_ssl_check(lcbio_SOCKET *sock)
+{
+    return lcbio_protoctx_get(sock, LCBIO_PROTOCTX_SSL) != NULL;
+}
+
+lcb_error_t
+lcbio_ssl_get_error(lcbio_SOCKET *sock)
+{
+    lcbio_XSSL *xs = (lcbio_XSSL *)sock->io;
+    return xs->errcode;
+}
+
+void
+lcbio_ssl_free(lcbio_pSSLCTX ctx)
+{
+    SSL_CTX_free(ctx->ctx);
+    free(ctx);
+}
+
+
+/**
+ * According to https://www.openssl.org/docs/crypto/threads.html we need
+ * to install two functions for locking support, a function that returns
+ * a thread ID, and a function which performs locking/unlocking. However later
+ * on in the link it says it will select a default implementation to return
+ * the thread ID, and thus we only need supply the locking function.
+ */
+#if defined(_POSIX_THREADS)
+#include <pthread.h>
+typedef pthread_mutex_t ossl_LOCKTYPE;
+static void ossl_lock_init(ossl_LOCKTYPE *l) { pthread_mutex_init(l, NULL); }
+static void ossl_lock_acquire(ossl_LOCKTYPE *l) { pthread_mutex_lock(l); }
+static void ossl_lock_release(ossl_LOCKTYPE *l) { pthread_mutex_unlock(l); }
+#elif defined(_WIN32)
+#include <windows.h>
+typedef CRITICAL_SECTION ossl_LOCKTYPE;
+static void ossl_lock_init(ossl_LOCKTYPE *l) { InitializeCriticalSection(l); }
+static void ossl_lock_acquire(ossl_LOCKTYPE *l) { EnterCriticalSection(l); }
+static void ossl_lock_release(ossl_LOCKTYPE *l) { LeaveCriticalSection(l); }
+#else
+typedef char ossl_LOCKTYPE;
+#define ossl_lock_init(l)
+#define ossl_lock_acquire(l)
+#define ossl_lock_release(l)
+#endif
+
+
+static ossl_LOCKTYPE *ossl_locks;
+static void
+ossl_lockfn(int mode, int lkid, const char *f, int line)
+{
+    ossl_LOCKTYPE *l = ossl_locks + lkid;
+
+    if (mode & CRYPTO_LOCK) {
+        ossl_lock_acquire(l);
+    } else {
+        ossl_lock_release(l);
+    }
+
+    (void)f;
+    (void)line;
+}
+
+static void
+ossl_init_locks(void)
+{
+    unsigned ii, nlocks;
+    if (CRYPTO_get_locking_callback() != NULL) {
+        /* Someone already set the callback before us. Don't destroy it! */
+        return;
+    }
+    nlocks = CRYPTO_num_locks();
+    ossl_locks = malloc(sizeof(*ossl_locks) * nlocks);
+    for (ii = 0; ii < nlocks; ii++) {
+        ossl_lock_init(ossl_locks + ii);
+    }
+    CRYPTO_set_locking_callback(ossl_lockfn);
+}
+
+static volatile int ossl_initialized = 0;
+void lcbio_ssl_global_init(void)
+{
+    if (ossl_initialized) {
+        return;
+    }
+    ossl_initialized = 1;
+    SSL_library_init();
+    SSL_load_error_strings();
+    ossl_init_locks();
+}
+
+lcb_error_t
+lcbio_sslify_if_needed(lcbio_SOCKET *sock, lcb_settings *settings)
+{
+    if (!(settings->sslopts & LCB_SSL_ENABLED)) {
+        return LCB_SUCCESS; /*not needed*/
+    }
+    if (lcbio_ssl_check(sock)) {
+        return LCB_SUCCESS; /*already ssl*/
+    }
+    return lcbio_ssl_apply(sock, settings->ssl_ctx);
+}