Changeset: 711be047f451 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB/rev/711be047f451
Modified Files:
common/stream/stream.h
common/stream/tls_stream.c
tools/merovingian/daemon/client.c
Branch: smapi
Log Message:
Server listens for SSL connections without crashing
diffs (159 lines):
diff --git a/common/stream/stream.h b/common/stream/stream.h
--- a/common/stream/stream.h
+++ b/common/stream/stream.h
@@ -164,7 +164,7 @@ stream_export void close_stream(stream *
stream_export stream *open_urlstream(const char *url); // mclient.c, future
copy from remote
-stream_export stream *open_tls_serv_stream(int fd, const char *name, bool
readonly);
+stream_export stream *open_tls_server_stream(int fd, const char *name, stream
*s);
stream_export stream *file_rstream(FILE *restrict fp, bool binary, const char
*restrict name); // unused
stream_export stream *file_wstream(FILE *restrict fp, bool binary, const char
*restrict name); // unused
diff --git a/common/stream/tls_stream.c b/common/stream/tls_stream.c
--- a/common/stream/tls_stream.c
+++ b/common/stream/tls_stream.c
@@ -46,25 +46,31 @@ tls_read(stream *restrict s, void *restr
static void
tls_close(stream *s) {
+ /* TODO properly shutdown */
ssl_wrapper *w = (ssl_wrapper *)s->stream_data.p;
SSL_shutdown(w->cSSL);
}
-stream *
-open_tls_serv_stream(int fd, const char *name, bool readonly)
+static stream *
+new_tls_server_stream(int fd, const char *name)
{
int ssl_err = 1;
stream *ret;
+ ERR_clear_error();
+
ssl_wrapper *w = (ssl_wrapper *)malloc(sizeof(ssl_wrapper));
if (w == NULL) {
/* TODO handle */
+ fprintf(stderr, "ssl wrapper allocation\n");
return NULL;
}
w->ctx = SSL_CTX_new(TLS_server_method());
if (w->ctx == NULL) {
/* TODO handle */
+ fprintf(stderr, "SSL_CTX_new\n");
+ ERR_print_errors_fp(stderr);
return NULL;
}
@@ -73,21 +79,26 @@ open_tls_serv_stream(int fd, const char
ssl_err = SSL_CTX_use_PrivateKey_file(w->ctx, server_keypair_fname,
SSL_FILETYPE_PEM);
if (ssl_err <= 0) {
/* TODO handle */
+ fprintf(stderr, "SSL_CTX_use_PrivateKey_file\n");
+ ERR_print_errors_fp(stderr);
return NULL;
}
/* TODO parametrize */
- const char *server_cert_chain_fname =
"/home/kutsurak/src/monetdb/mercurial-repos/public/smapi/smapi-dev-certificates/server_cert.pem";
+ const char *server_cert_chain_fname =
"/home/kutsurak/src/monetdb/mercurial-repos/public/smapi/smapi-dev-certificates/new/server_cert.pem";
ssl_err = SSL_CTX_use_certificate_chain_file(w->ctx,
server_cert_chain_fname);
if (ssl_err <= 0) {
/* TODO handle */
- ERR_print_errors_fp(stdout);
+ fprintf(stderr, "SSL_CTX_use_certificate_chain_file\n");
+ ERR_print_errors_fp(stderr);
return NULL;
}
ssl_err = SSL_CTX_check_private_key(w->ctx);
if (ssl_err <= 0) {
/* TODO handle */
+ fprintf(stderr, "SSL_CTX_check_private_key\n");
+ ERR_print_errors_fp(stderr);
return NULL;
}
@@ -99,20 +110,56 @@ open_tls_serv_stream(int fd, const char
ssl_err = SSL_accept(w->cSSL);
if (ssl_err <= 0) {
/* TODO handle */
+ fprintf(stderr, "SSL_accept\n");
+ ERR_print_errors_fp(stderr);
return NULL;
}
if ((ret = create_stream(name)) == NULL) {
+ fprintf(stderr, "Could not create read stream\n");
return NULL;
}
ret->stream_data.p = w;
- ret->readonly = readonly;
+ ret->readonly = true;
ret->read = tls_read;
ret->write = tls_write;
ret->close = tls_close;
+ ret->binary = true;
+
+ return ret;
+}
+
+stream *
+open_tls_server_stream(int fd, const char *name, stream *s) {
+ stream *ret;
+
+ /* This assumes that the read stream is created before the write
stream. This probably */
+ /* needs to change. */
+ if (s == NULL) {
+ ret = new_tls_server_stream(fd, name);
+ }
+ else {
+ if ((ret = create_stream(name)) == NULL) {
+ fprintf(stderr, "Could not create write stream\n");
+ return NULL;
+ }
+
+ if (s->inner != NULL) {
+ ret->stream_data.p = s->inner->stream_data.p;
+ }
+ else {
+ ret->stream_data.p = s->stream_data.p;
+ }
+
+ ret->readonly = false;
+ ret->read = tls_read;
+ ret->write = tls_write;
+ ret->close = tls_close;
+ ret->binary = true;
+ }
return ret;
}
diff --git a/tools/merovingian/daemon/client.c
b/tools/merovingian/daemon/client.c
--- a/tools/merovingian/daemon/client.c
+++ b/tools/merovingian/daemon/client.c
@@ -85,7 +85,7 @@ handleClient(void *data)
memcpy(chal, ((struct clientdata *) data)->challenge, sizeof(chal));
free(data);
#ifdef HAVE_OPENSSL
- fdin = open_tls_serv_stream(sock, "merovingian<-client (tls read)",
true);
+ fdin = open_tls_server_stream(sock, "merovingian<-client (tls read)",
NULL);
#else
fdin = socket_rstream(sock, "merovingian<-client (read)");
#endif // HAVE_OPENSSL
@@ -96,7 +96,9 @@ handleClient(void *data)
fdin = block_stream(fdin);
#ifdef HAVE_OPENSSL
- fout = open_tls_serv_stream(sock, "merovingian->client (tls write)",
false);
+ /* stream library really wants 2 different streams one read only and
one read write. On the other hand openssl has */
+ /* one object (BIO) that handles both directions. */
+ fout = open_tls_server_stream(sock, "merovingian->client (tls write)",
fdin);
#else
fout = socket_wstream(sock, "merovingian->client (write)");
#endif // HAVE_OPENSSL
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
