From be49802a35b13fc0de847f5db05bfc4e6072ed06 Mon Sep 17 00:00:00 2001 From: Adam Dickmeiss Date: Tue, 17 Jun 2008 16:08:02 +0200 Subject: [PATCH] Server functional for native use of GNU TLS. --- src/tcpip.c | 165 +++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 131 insertions(+), 34 deletions(-) diff --git a/src/tcpip.c b/src/tcpip.c index 310c6a1..5633264 100644 --- a/src/tcpip.c +++ b/src/tcpip.c @@ -9,6 +9,7 @@ #include #include +#include #include #include #include @@ -102,6 +103,13 @@ static void *tcpip_straddr(COMSTACK h, const char *str); #define YAZ_SOCKLEN_T int #endif +#if ENABLE_SSL == 2 +struct tcpip_cred_ptr { + gnutls_certificate_credentials_t xcred; + int ref; +}; + +#endif /* this state is used for both SSL and straight TCP/IP */ typedef struct tcpip_state { @@ -119,7 +127,7 @@ typedef struct tcpip_state #endif char buf[128]; /* returned by cs_addrstr */ #if ENABLE_SSL == 2 - gnutls_certificate_credentials_t xcred; + struct tcpip_cred_ptr *cred_ptr; gnutls_session_t session; char cert_fname[256]; #elif ENABLE_SSL == 1 @@ -202,8 +210,9 @@ COMSTACK tcpip_type(int s, int flags, int protocol, void *vp) p->user = 0; #if ENABLE_SSL == 2 - sp->xcred = 0; + sp->cred_ptr = 0; sp->session = 0; + strcpy(sp->cert_fname, "yaz.pem"); #elif ENABLE_SSL == 1 sp->ctx = sp->ctx_alloc = 0; sp->ssl = 0; @@ -252,6 +261,16 @@ COMSTACK yaz_tcpip_create(int s, int flags, int protocol, return p; } +#if ENABLE_SSL == 2 +static void tcpip_create_cred(COMSTACK cs) +{ + tcpip_state *sp = (tcpip_state *) cs->cprivate; + sp->cred_ptr = xmalloc(sizeof(*sp->cred_ptr)); + sp->cred_ptr->ref = 1; + gnutls_certificate_allocate_credentials(&sp->cred_ptr->xcred); +} + +#endif COMSTACK ssl_type(int s, int flags, int protocol, void *vp) { @@ -299,10 +318,10 @@ static int ssl_check_error(COMSTACK h, tcpip_state *sp, int res) } #else #if ENABLE_SSL == 2 - fprintf(stderr, "ssl_check_error error=%d fatal=%d msg=%s\n", - res, - gnutls_error_is_fatal(res), - gnutls_strerror(res)); + TRC(fprintf(stderr, "ssl_check_error error=%d fatal=%d msg=%s\n", + res, + gnutls_error_is_fatal(res), + gnutls_strerror(res))); if (res == GNUTLS_E_AGAIN || res == GNUTLS_E_INTERRUPTED) { int dir = gnutls_record_get_direction(sp->session); @@ -581,7 +600,6 @@ int tcpip_rcvconnect(COMSTACK h) { #if ENABLE_SSL tcpip_state *sp = (tcpip_state *)h->cprivate; - int res; #endif TRC(fprintf(stderr, "tcpip_rcvconnect\n")); @@ -593,23 +611,27 @@ int tcpip_rcvconnect(COMSTACK h) return -1; } #if ENABLE_SSL == 2 - gnutls_global_init(); - - gnutls_certificate_allocate_credentials(&sp->xcred); - gnutls_init(&sp->session, GNUTLS_CLIENT); - gnutls_priority_set_direct(sp->session, - "PERFORMANCE", NULL); - - gnutls_credentials_set (sp->session, GNUTLS_CRD_CERTIFICATE, sp->xcred); - - gnutls_transport_set_ptr(sp->session, (gnutls_transport_ptr_t) h->iofile); - - res = gnutls_handshake(sp->session); - if (res < 0) + if (h->type == ssl_type && !sp->session) { - if (ssl_check_error(h, sp, res)) - return 1; - return -1; + int res; + gnutls_global_init(); + + tcpip_create_cred(h); + + gnutls_init(&sp->session, GNUTLS_CLIENT); + gnutls_priority_set_direct(sp->session, "PERFORMANCE", NULL); + gnutls_credentials_set (sp->session, GNUTLS_CRD_CERTIFICATE, + sp->cred_ptr->xcred); + + gnutls_transport_set_ptr(sp->session, (gnutls_transport_ptr_t) h->iofile); + + res = gnutls_handshake(sp->session); + if (res < 0) + { + if (ssl_check_error(h, sp, res)) + return 1; + return -1; + } } #elif ENABLE_SSL == 1 if (h->type == ssl_type && !sp->ctx) @@ -694,7 +716,23 @@ static int tcpip_bind(COMSTACK h, void *address, int mode) #endif #if ENABLE_SSL == 2 - exit(9); + if (h->type == ssl_type && !sp->session) + { + int res; + gnutls_global_init(); + + tcpip_create_cred(h); + + res = gnutls_certificate_set_x509_key_file(sp->cred_ptr->xcred, + sp->cert_fname, + sp->cert_fname, + GNUTLS_X509_FMT_PEM); + if (res != GNUTLS_E_SUCCESS) + { + h->cerrno = CSERRORSSL; + return -1; + } + } #elif ENABLE_SSL == 1 if (h->type == ssl_type && !sp->ctx) { @@ -852,14 +890,14 @@ int tcpip_listen(COMSTACK h, char *raddr, int *addrlen, COMSTACK tcpip_accept(COMSTACK h) { COMSTACK cnew; - tcpip_state *state, *st = (tcpip_state *)h->cprivate; #ifdef WIN32 unsigned long tru = 1; #endif - TRC(fprintf(stderr, "tcpip_accept\n")); + TRC(fprintf(stderr, "tcpip_accept h=%p pid=%d\n", h, getpid())); if (h->state == CS_ST_INCON) { + tcpip_state *state, *st = (tcpip_state *)h->cprivate; if (!(cnew = (COMSTACK)xmalloc(sizeof(*cnew)))) { h->cerrno = CSYSERR; @@ -874,6 +912,7 @@ COMSTACK tcpip_accept(COMSTACK h) memcpy(cnew, h, sizeof(*h)); cnew->iofile = h->newfd; cnew->io_pending = 0; + if (!(state = (tcpip_state *) (cnew->cprivate = xmalloc(sizeof(tcpip_state))))) { @@ -917,7 +956,40 @@ COMSTACK tcpip_accept(COMSTACK h) h->state = CS_ST_IDLE; #if ENABLE_SSL == 2 - exit(9); + state->cred_ptr = st->cred_ptr; + state->session = 0; + if (st->cred_ptr) + { + int res; + + (state->cred_ptr->ref)++; + gnutls_init(&state->session, GNUTLS_SERVER); + if (!state->session) + { + xfree(cnew); + xfree(state); + return 0; + } + res = gnutls_priority_set_direct(state->session, + "PERFORMANCE", NULL); + if (res != GNUTLS_E_SUCCESS) + { + xfree(cnew); + xfree(state); + return 0; + } + res = gnutls_credentials_set(state->session, + GNUTLS_CRD_CERTIFICATE, + st->cred_ptr->xcred); + if (res != GNUTLS_E_SUCCESS) + { + xfree(cnew); + xfree(state); + return 0; + } + gnutls_transport_set_ptr(state->session, + (gnutls_transport_ptr_t) cnew->iofile); + } #elif ENABLE_SSL == 1 state->ctx = st->ctx; state->ctx_alloc = 0; @@ -934,9 +1006,24 @@ COMSTACK tcpip_accept(COMSTACK h) } if (h->state == CS_ST_ACCEPT) { - #if ENABLE_SSL == 2 - exit(9); + tcpip_state *state = (tcpip_state *)h->cprivate; + if (state->session) + { + int res = gnutls_handshake(state->session); + if (res < 0) + { + if (ssl_check_error(h, state, res)) + { + TRC(fprintf(stderr, "gnutls_handshake int in tcpip_accept\n")); + return h; + } + TRC(fprintf(stderr, "gnutls_handshake failed in tcpip_accept\n")); + cs_close(h); + return 0; + } + TRC(fprintf(stderr, "SSL_accept complete. gnutls\n")); + } #elif ENABLE_SSL == 1 tcpip_state *state = (tcpip_state *)h->cprivate; if (state->ctx) @@ -1313,7 +1400,7 @@ int tcpip_close(COMSTACK h) { tcpip_state *sp = (struct tcpip_state *)h->cprivate; - TRC(fprintf(stderr, "tcpip_close\n")); + TRC(fprintf(stderr, "tcpip_close h=%p pid=%d\n", h, getpid())); if (h->iofile != -1) { #if ENABLE_SSL == 2 @@ -1337,7 +1424,19 @@ int tcpip_close(COMSTACK h) if (sp->session) { gnutls_deinit(sp->session); - gnutls_certificate_free_credentials(sp->xcred); + } + if (sp->cred_ptr) + { + assert(sp->cred_ptr->ref > 0); + + if (--(sp->cred_ptr->ref) == 0) + { + TRC(fprintf(stderr, "Removed credentials %p pid=%d\n", + sp->cred_ptr->xcred, getpid())); + gnutls_certificate_free_credentials(sp->cred_ptr->xcred); + xfree(sp->cred_ptr); + } + sp->cred_ptr = 0; } #elif ENABLE_SSL == 1 if (sp->ssl) @@ -1546,11 +1645,10 @@ int cs_set_ssl_certificate_file(COMSTACK cs, const char *fname) int cs_get_peer_certificate_x509(COMSTACK cs, char **buf, int *len) { -#if ENABLE_SSL == 1 +#if HAVE_OPENSSL_SSL_H SSL *ssl = (SSL *) cs_get_ssl(cs); if (ssl) { -#if HAVE_OPENSSL_SSL_H X509 *server_cert = SSL_get_peer_certificate(ssl); if (server_cert) { @@ -1566,7 +1664,6 @@ int cs_get_peer_certificate_x509(COMSTACK cs, char **buf, int *len) } } #endif -#endif return 0; } #else -- 1.7.10.4