[Libdexter-commits] SF.net SVN: libdexter: [369] libdexter/trunk
Brought to you by:
pkovacs
Menu
▾
▴
[Libdexter-commits] SF.net SVN: libdexter: [369] libdexter/trunk
|
From: <pk...@us...> - 2007-06-09 07:17:23
|
Revision: 369
http://svn.sourceforge.net/libdexter/?rev=369&view=rev
Author: pkovacs
Date: 2007-06-09 00:17:19 -0700 (Sat, 09 Jun 2007)
Log Message:
-----------
Committing intermediate work on TLS.
Modified Paths:
--------------
libdexter/trunk/ChangeLog
libdexter/trunk/dexter/dexter-channel.c
libdexter/trunk/dexter/dexter-network.c
libdexter/trunk/dexter/dexter-network.h
libdexter/trunk/dexter/dexter-server-internal.h
libdexter/trunk/dexter/dexter-server.c
libdexter/trunk/dexter/dexter-server.h
libdexter/trunk/dexter/dexter-servercomm.c
libdexter/trunk/dexter/dexter-servercomm.h
libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml
libdexter/trunk/programs/dexterd/dexterd.c
Modified: libdexter/trunk/ChangeLog
===================================================================
--- libdexter/trunk/ChangeLog 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/ChangeLog 2007-06-09 07:17:19 UTC (rev 369)
@@ -1,3 +1,6 @@
+2007-06-09 pkovacs
+ * Committing intermediate work on TLS.
+
2007-06-02 pkovacs
* Committing intermediate work on TLS.
Modified: libdexter/trunk/dexter/dexter-channel.c
===================================================================
--- libdexter/trunk/dexter/dexter-channel.c 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-channel.c 2007-06-09 07:17:19 UTC (rev 369)
@@ -101,7 +101,15 @@
static void dexter_channel_channel_event (DexterChannelObject *channel_object,
gint event);
static GError *dexter_channel_convert_network_error (GError **network_error);
+#ifdef HAVE_TLS
+static DexterChannelTLSParameters
+ *dexter_channel_tls_parameters_new0 (void);
+static void dexter_channel_tls_parameters_copy (DexterChannelTLSParameters *dest,
+ const DexterChannelTLSParameters *source);
+static void dexter_channel_tls_parameters_free (DexterChannelTLSParameters *tls_parameters);
+#endif
+
/* GDestroyNotify to destroy channel hash entries */
static void _destroy_object_hash_entry (ChannelObjectHashEntry *hash_entry);
@@ -140,6 +148,11 @@
int recvbufsize; /* receive buffer size */
GAsyncQueue *cmd_queue; /* channel commands are queued up here */
DexterHashTable *object_hash; /* channel object hash by (peer) id */
+
+#ifdef HAVE_TLS
+ DexterChannelTLSParameters
+ *tls_parameters; /* default TLS parameters from config file */
+#endif
};
struct _DexterChannelClass
@@ -228,6 +241,47 @@
channel->cmd_queue = g_async_queue_new ();
channel->object_hash = dexter_hash_table_new_full (g_int_hash, g_int_equal,
NULL, (GDestroyNotify) _destroy_object_hash_entry);
+#ifdef HAVE_TLS
+ channel->tls_parameters = dexter_channel_tls_parameters_new0 ();
+
+ /* fetch TLS parameters from config file */
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ChannelTLSCertFile",
+ &channel->tls_parameters->cert_file, NULL))
+ {
+ channel->tls_parameters->cert_file = g_strdup (DEFAULT_CHANNEL_TLS_CERT_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS cert file", G_STRFUNC, channel->tls_parameters->cert_file);
+#endif
+ }
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ChannelTLSKeyFile",
+ &channel->tls_parameters->key_file, NULL))
+ {
+ channel->tls_parameters->key_file = g_strdup (DEFAULT_CHANNEL_TLS_KEY_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS key file", G_STRFUNC, channel->tls_parameters->key_file);
+#endif
+ }
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ChannelTLSTrustFile",
+ &channel->tls_parameters->trust_file, NULL))
+ {
+ channel->tls_parameters->trust_file = g_strdup (DEFAULT_CHANNEL_TLS_TRUST_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS trust file", G_STRFUNC, channel->tls_parameters->trust_file);
+#endif
+ }
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ChannelTLSCrlFile",
+ &channel->tls_parameters->crl_file, NULL))
+ {
+ channel->tls_parameters->crl_file = g_strdup (DEFAULT_CHANNEL_TLS_CRL_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS crl file", G_STRFUNC, channel->tls_parameters->crl_file);
+#endif
+ }
+#endif /* HAVE_TLS */
}
@@ -257,7 +311,11 @@
g_async_queue_unref (channel->cmd_queue);
dexter_hash_table_destroy (channel->object_hash);
-
+
+#ifdef HAVE_TLS
+ dexter_channel_tls_parameters_free (channel->tls_parameters);
+#endif
+
/* chain up */
G_OBJECT_CLASS (dexter_channel_parent_class)->finalize (object);
}
@@ -634,6 +692,9 @@
case DEXTER_NETWORK_ERROR_ETIMEDOUT:
channel_error->code = DEXTER_CHANNEL_ERROR_TIMEOUT;
break;
+ case DEXTER_NETWORK_ERROR_TLS_NOT_ENABLED:
+ channel_error->code = DEXTER_CHANNEL_ERROR_TLS_NOT_ENABLED;
+ break;
case DEXTER_NETWORK_ERROR_FAILED:
default:
channel_error->code = DEXTER_CHANNEL_ERROR_FAILED;
@@ -645,7 +706,44 @@
}
+#ifdef HAVE_TLS
+static DexterChannelTLSParameters *
+dexter_channel_tls_parameters_new0 (void)
+{
+ return g_slice_new0 (DexterChannelTLSParameters);
+}
+
+
static void
+dexter_channel_tls_parameters_copy (DexterChannelTLSParameters *dest,
+ const DexterChannelTLSParameters *source)
+{
+ g_return_if_fail (dest != NULL);
+ g_return_if_fail (source != NULL);
+
+ dest->cert_file = g_strdup (source->cert_file);
+ dest->key_file = g_strdup (source->key_file);
+ dest->trust_file = g_strdup (source->trust_file);
+ dest->crl_file = g_strdup (source->crl_file);
+}
+
+
+static void
+dexter_channel_tls_parameters_free (DexterChannelTLSParameters *tls_parameters)
+{
+ if (G_UNLIKELY (!tls_parameters))
+ return;
+
+ g_free (tls_parameters->cert_file);
+ g_free (tls_parameters->key_file);
+ g_free (tls_parameters->trust_file);
+ g_free (tls_parameters->crl_file);
+ g_slice_free (DexterChannelTLSParameters, tls_parameters);
+}
+#endif
+
+
+static void
_destroy_object_hash_entry (ChannelObjectHashEntry *hash_entry)
{
g_object_unref (hash_entry->channel_object);
@@ -745,14 +843,13 @@
}
while (dexter_channel_is_runnable (channel) && (dexter_get_state () == DEXTER_STATE_UP));
+ g_object_unref (framer);
g_slice_free1 (channel->recvbufsize, recvbuf);
- g_object_unref (framer);
-
+ g_object_unref (channel);
+
#ifdef G_ENABLE_DEBUG
g_message ("channel done in thread 0x%08X", (unsigned)g_thread_self());
#endif
-
- g_object_unref (channel);
}
@@ -1147,7 +1244,7 @@
{
#ifdef HAVE_TLS
DexterChannelObject *channel_object;
- DexterChannelTLSParameters tls_parameters;
+ DexterChannelTLSParameters *tls_parameters;
GError *local_error = NULL;
#endif
@@ -1200,43 +1297,9 @@
return FALSE;
}
- /* fetch TLS parameters from config file */
- if (!dexter_config_get_string (__ICONFIG,
- "Main", "ChannelTLSCertFile",
- &tls_parameters.cert_file, NULL))
- {
- tls_parameters.cert_file = g_strdup (DEFAULT_CHANNEL_TLS_CERT_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS cert file", G_STRFUNC, tls_parameters.cert_file);
-#endif
- }
- if (!dexter_config_get_string (__ICONFIG,
- "Main", "ChannelTLSKeyFile",
- &tls_parameters.key_file, NULL))
- {
- tls_parameters.key_file = g_strdup (DEFAULT_CHANNEL_TLS_KEY_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS key file", G_STRFUNC, tls_parameters.key_file);
-#endif
- }
- if (!dexter_config_get_string (__ICONFIG,
- "Main", "ChannelTLSTrustFile",
- &tls_parameters.trust_file, NULL))
- {
- tls_parameters.trust_file = g_strdup (DEFAULT_CHANNEL_TLS_TRUST_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS trust file", G_STRFUNC, tls_parameters.trust_file);
-#endif
- }
- if (!dexter_config_get_string (__ICONFIG,
- "Main", "ChannelTLSCrlFile",
- &tls_parameters.crl_file, NULL))
- {
- tls_parameters.crl_file = g_strdup (DEFAULT_CHANNEL_TLS_CRL_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS crl file", G_STRFUNC, tls_parameters.crl_file);
-#endif
- }
+ /* get default TLS parameters */
+ tls_parameters = dexter_channel_tls_parameters_new0 ();
+ dexter_channel_tls_parameters_copy (tls_parameters, channel->tls_parameters);
/* if specified, issue callback to finalize TLS parameters */
if (starttls_callback)
@@ -1244,32 +1307,25 @@
(*starttls_callback) (channel,
dexter_network_session_peer_addr (channel->session),
dexter_network_session_peer_addrlen (channel->session),
- &tls_parameters);
+ tls_parameters);
}
/* start TLS handshake */
dexter_network_session_client_starttls (channel->session,
- tls_parameters.cert_file,
- tls_parameters.key_file,
- tls_parameters.trust_file,
- tls_parameters.crl_file,
+ tls_parameters->cert_file,
+ tls_parameters->key_file,
+ tls_parameters->trust_file,
+ tls_parameters->crl_file,
&local_error);
if (local_error)
{
- g_free (tls_parameters.cert_file);
- g_free (tls_parameters.key_file);
- g_free (tls_parameters.trust_file);
- g_free (tls_parameters.crl_file);
+ dexter_channel_tls_parameters_free (tls_parameters);
g_propagate_error (error, local_error);
g_object_unref (channel);
return FALSE;
}
- g_free (tls_parameters.cert_file);
- g_free (tls_parameters.key_file);
- g_free (tls_parameters.trust_file);
- g_free (tls_parameters.crl_file);
-
+ dexter_channel_tls_parameters_free (tls_parameters);
g_object_unref (channel);
return TRUE;
Modified: libdexter/trunk/dexter/dexter-network.c
===================================================================
--- libdexter/trunk/dexter/dexter-network.c 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-network.c 2007-06-09 07:17:19 UTC (rev 369)
@@ -61,8 +61,8 @@
#ifdef HAVE_TLS
static gboolean _dexter_network_session_starttls (dexter_network_session_t *session,
gboolean role,
+ const gchar *cert_file,
const gchar *key_file,
- const gchar *cert_file,
const gchar *trust_file,
const gchar *crl_file,
guint flags,
@@ -326,13 +326,21 @@
static gboolean
_dexter_network_session_starttls (dexter_network_session_t *session,
gboolean role,
+ const gchar *cert_file,
const gchar *key_file,
- const gchar *cert_file,
const gchar *trust_file,
const gchar *crl_file,
guint flags,
GError **error)
{
+#ifdef G_ENABLE_DEBUG
+ g_message (G_STRFUNC);
+ g_message ("TLS cert file = %s", cert_file);
+ g_message ("TLS key file = %s", key_file);
+ g_message ("TLS trust file = %s", trust_file);
+ g_message ("TLS crl file = %s", crl_file);
+#endif
+
return TRUE;
}
#endif
@@ -627,8 +635,8 @@
gboolean
dexter_network_session_client_starttls (dexter_network_session_t *session,
+ const gchar *cert_file,
const gchar *key_file,
- const gchar *cert_file,
const gchar *trust_file,
const gchar *crl_file,
GError **error)
@@ -653,8 +661,8 @@
gboolean
dexter_network_session_server_starttls (dexter_network_session_t *session,
+ const gchar *cert_file,
const gchar *key_file,
- const gchar *cert_file,
const gchar *trust_file,
const gchar *crl_file,
guint client_cert_flag,
Modified: libdexter/trunk/dexter/dexter-network.h
===================================================================
--- libdexter/trunk/dexter/dexter-network.h 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-network.h 2007-06-09 07:17:19 UTC (rev 369)
@@ -74,16 +74,16 @@
gboolean dexter_network_session_client_starttls
(dexter_network_session_t *session,
+ const gchar *cert_file,
const gchar *key_file,
- const gchar *cert_file,
const gchar *trust_file,
const gchar *crl_file,
GError **error) G_GNUC_INTERNAL;
gboolean dexter_network_session_server_starttls
(dexter_network_session_t *session,
+ const gchar *cert_file,
const gchar *key_file,
- const gchar *cert_file,
const gchar *trust_file,
const gchar *crl_file,
guint client_cert_flag,
Modified: libdexter/trunk/dexter/dexter-server-internal.h
===================================================================
--- libdexter/trunk/dexter/dexter-server-internal.h 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-server-internal.h 2007-06-09 07:17:19 UTC (rev 369)
@@ -49,12 +49,17 @@
typedef struct _DexterServerClass DexterServerClass;
-GType dexter_server_get_type (void) G_GNUC_INTERNAL G_GNUC_CONST;
+GType dexter_server_get_type (void) G_GNUC_INTERNAL G_GNUC_CONST;
#ifdef HAVE_LIBWRAP
-gboolean dexter_server_hosts_access (int) G_GNUC_INTERNAL;
+gboolean dexter_server_hosts_access (int) G_GNUC_INTERNAL;
#endif
+#ifdef HAVE_TLS
+const DexterServerTLSSettings
+ *dexter_server_tls_settings (DexterServer *server) G_GNUC_INTERNAL;
+#endif
+
G_END_DECLS
#endif /* __DEXTER_SERVER_INTERNAL_H__ */
Modified: libdexter/trunk/dexter/dexter-server.c
===================================================================
--- libdexter/trunk/dexter/dexter-server.c 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-server.c 2007-06-09 07:17:19 UTC (rev 369)
@@ -85,6 +85,13 @@
static void dexter_server_set_runnable (DexterServer *server,
gboolean runnable);
static GError *dexter_server_convert_network_error (GError **network_error);
+#ifdef HAVE_TLS
+static DexterServerTLSSettings
+ *dexter_server_tls_settings_new0 (void);
+static void dexter_server_tls_settings_copy (DexterServerTLSSettings *dest,
+ const DexterServerTLSSettings *source);
+static void dexter_server_tls_settings_free (DexterServerTLSSettings *tls_settings);
+#endif
/* accept loop runs in a thread */
static void _server_thread_func (DexterServer *server);
@@ -122,6 +129,11 @@
gint max_clients; /* max number of simultaneous client connections */
int recvbufsize; /* receive buffer size for service sockets */
+
+#if HAVE_TLS
+ DexterServerTLSSettings
+ *tls_settings; /* TLS settings from dexter_server_start () */
+#endif
};
struct _DexterServerClass
@@ -136,6 +148,7 @@
struct _service_data
{
+ DexterServer *server; /* server */
int connfd; /* connection fd */
int recvbufsize; /* receive buffer size for service socket */
struct sockaddr_storage addr; /* socket address struct */
@@ -214,6 +227,10 @@
g_warning ("%s: ServerRecvBufferSize must be >= 128. Using default %d recv buffer size.",
G_STRFUNC, server->recvbufsize);
}
+
+#ifdef HAVE_TLS
+ server->tls_settings = dexter_server_tls_settings_new0 ();
+#endif
}
@@ -230,6 +247,10 @@
g_free (server->service);
g_free (server->socket_options);
+#ifdef HAVE_TLS
+ dexter_server_tls_settings_free (server->tls_settings);
+#endif
+
/* chain up */
G_OBJECT_CLASS(dexter_server_parent_class)->finalize (object);
}
@@ -261,6 +282,17 @@
#endif
+#ifdef HAVE_TLS
+const DexterServerTLSSettings *
+dexter_server_tls_settings (DexterServer *server)
+{
+ g_return_val_if_fail (DEXTER_IS_SERVER (server), NULL);
+
+ return server->tls_settings;
+}
+#endif
+
+
/**
* dexter_server_get_state:
* @server: a #DexterServer.
@@ -364,7 +396,38 @@
}
+#ifdef HAVE_TLS
+static DexterServerTLSSettings *
+dexter_server_tls_settings_new0 (void)
+{
+ return g_slice_new0 (DexterServerTLSSettings);
+}
+
+
static void
+dexter_server_tls_settings_copy (DexterServerTLSSettings *dest,
+ const DexterServerTLSSettings *source)
+{
+ g_return_if_fail (dest != NULL);
+ g_return_if_fail (source != NULL);
+
+ dest->support_flag = source->support_flag;
+ dest->starttls_callback = source->starttls_callback;
+}
+
+
+static void
+dexter_server_tls_settings_free (DexterServerTLSSettings *tls_settings)
+{
+ if (G_UNLIKELY (!tls_settings))
+ return;
+
+ g_slice_free (DexterServerTLSSettings, tls_settings);
+}
+#endif
+
+
+static void
_server_thread_func (DexterServer *server)
{
GError *local_error = NULL;
@@ -414,6 +477,8 @@
/* each service thread will be passed an allocated ServiceData structure */
service_data = g_slice_new0 (ServiceData);
+ /* service thread increments server ref count */
+ service_data->server = server;
service_data->recvbufsize = server->recvbufsize;
/* each thread sees the same atomic client counter */
service_data->client_counter = client_counter;
@@ -506,8 +571,8 @@
&local_error);
if (local_error)
{
- /* GLib's g_thread_pool_push only returns an error for non-exclusive pools when no
- * new thread could be created. GLib still enqueues the task, however. */
+ /* GLib's g_thread_pool_push only returns an error for non-exclusive pools when
+ * no new thread could be created. GLib still enqueues the task, however. */
g_warning ("%s: %s", G_STRFUNC, local_error->message);
g_clear_error (&local_error);
break;
@@ -515,6 +580,7 @@
/* new ServiceData needed for next connection */
service_data = g_slice_new0 (ServiceData);
+ service_data->server = server;
service_data->recvbufsize = server->recvbufsize;
service_data->client_counter = client_counter;
}
@@ -524,13 +590,7 @@
server_thread_done:
dexter_server_set_state (server, DEXTER_SERVER_STATE_STOPPED);
close (server->listenfd);
- if (service_data)
- g_slice_free (ServiceData, service_data);
-#ifdef G_ENABLE_DEBUG
- g_message ("server done in thread 0x%08X", (unsigned)g_thread_self());
-#endif
-
/* Decrement client count, since server is exiting and it counts as one.
* Thread that decrements count to zero frees the counter. */
if (g_atomic_int_dec_and_test (&client_counter->count))
@@ -539,7 +599,14 @@
dexter_log (DEXTER_LOG_INFO, "server stopped on host %s, port %s",
server->host_numeric, server->serv_numeric);
+ if (service_data)
+ g_slice_free (ServiceData, service_data);
+
g_object_unref (server);
+
+#ifdef G_ENABLE_DEBUG
+ g_message ("server done in thread 0x%08X", (unsigned)g_thread_self());
+#endif
}
@@ -555,9 +622,12 @@
gboolean done = FALSE;
g_return_if_fail (sd != NULL);
+ g_return_if_fail (DEXTER_IS_SERVER (sd->server));
g_return_if_fail (sd->recvbufsize > 0);
g_return_if_fail (sd->client_counter != NULL);
+ g_object_ref (sd->server);
+
#ifdef G_ENABLE_DEBUG
g_message ("service running in thread 0x%08X", (unsigned)g_thread_self());
#endif
@@ -568,6 +638,7 @@
servercomm = g_object_new (DEXTER_TYPE_SERVERCOMM, NULL);
session = dexter_network_session_new ();
dexter_network_session_open (session, sd->connfd, &sd->addr, sd->addrlen);
+ servercomm->server = sd->server;
servercomm->session = session;
do
@@ -640,20 +711,21 @@
while ((!done) && (dexter_get_state () == DEXTER_STATE_UP));
dexter_network_session_close (session, NULL);
- g_slice_free1 (sd->recvbufsize, recvbuf);
- g_object_unref (framer);
- g_object_unref (servercomm);
dexter_network_session_free (session);
-#ifdef G_ENABLE_DEBUG
- g_message ("service done in thread 0x%08X", (unsigned)g_thread_self ());
-#endif
-
/* decrement client count. thread that decrements count to zero frees the counter. */
if (g_atomic_int_dec_and_test (&sd->client_counter->count))
g_slice_free (ClientCounter, sd->client_counter);
+ g_object_unref (framer);
+ g_object_unref (servercomm);
+ g_object_unref (sd->server);
+ g_slice_free1 (sd->recvbufsize, recvbuf);
g_slice_free (ServiceData, sd);
+
+#ifdef G_ENABLE_DEBUG
+ g_message ("service done in thread 0x%08X", (unsigned)g_thread_self ());
+#endif
}
@@ -776,9 +848,33 @@
g_return_val_if_fail (DEXTER_IS_SERVER (server), FALSE);
g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
+#ifdef HAVE_TLS
+ g_return_val_if_fail (tls_settings == NULL ||
+ tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_NONE ||
+ tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_AVAILABLE ||
+ tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_REQUIRED, FALSE);
+#else
+ g_return_val_if_fail (tls_settings == NULL, FALSE);
+#endif
g_object_ref (server);
+ if (tls_settings)
+#ifdef HAVE_TLS
+ {
+ dexter_server_tls_settings_copy (server->tls_settings, tls_settings);
+ }
+#else
+ {
+ g_set_error (error,
+ DEXTER_SERVER_ERROR,
+ DEXTER_SERVER_ERROR_TLS_NOT_ENABLED,
+ "%s: TLS not enabled", G_STRFUNC);
+ g_object_unref (server);
+ return FALSE;
+ }
+#endif /* HAVE_TLS */
+
/* check if server started */
if (dexter_server_get_state (server) == DEXTER_SERVER_STATE_STARTED)
{
Modified: libdexter/trunk/dexter/dexter-server.h
===================================================================
--- libdexter/trunk/dexter/dexter-server.h 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-server.h 2007-06-09 07:17:19 UTC (rev 369)
@@ -37,20 +37,22 @@
/**
* DexterServerError:
- * @DEXTER_SERVER_ERROR_STATE: operation not allowed in current server state.
* @DEXTER_SERVER_ERROR_EACCES: address is protected, and the user is not the superuser.
* @DEXTER_SERVER_ERROR_EADDRINUSE: local address in use.
* @DEXTER_SERVER_ERROR_EAGAIN: temporary name server failure.
+ * @DEXTER_SERVER_ERROR_STATE: operation not allowed in current server state.
+ * @DEXTER_SERVER_ERROR_TLS_NOT_ENABLED: TLS not enabled on this installation.
* @DEXTER_SERVER_ERROR_FAILED: other failure.
*
* Error codes for dexter_server operations.
**/
typedef enum
{
- DEXTER_SERVER_ERROR_STATE,
DEXTER_SERVER_ERROR_EACCES,
DEXTER_SERVER_ERROR_EADDRINUSE,
DEXTER_SERVER_ERROR_EAGAIN,
+ DEXTER_SERVER_ERROR_STATE,
+ DEXTER_SERVER_ERROR_TLS_NOT_ENABLED,
DEXTER_SERVER_ERROR_FAILED
} DexterServerError;
@@ -132,6 +134,7 @@
* DexterServerTLSStartCallback:
* @server: #DexterServer on which TLS is starting.
* @client_sa: socket address of client.
+ * @client_salen: length of client socket address.
* @tls_parameters: #DexterServerTLSParameters of default parameters from config file.
*
* Signature of callback function used to override default parameters as TLS starts.
@@ -145,6 +148,7 @@
**/
typedef void (*DexterServerTLSStartCallback) (DexterServer *server,
const struct sockaddr *client_sa,
+ socklen_t client_salen,
DexterServerTLSParameters *tls_parameters);
Modified: libdexter/trunk/dexter/dexter-servercomm.c
===================================================================
--- libdexter/trunk/dexter/dexter-servercomm.c 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-servercomm.c 2007-06-09 07:17:19 UTC (rev 369)
@@ -69,7 +69,18 @@
gint status,
GString *payload,
GError **error);
+#ifdef HAVE_TLS
+static DexterServerTLSParameters *
+ dexter_servercomm_tls_parameters_new0 (void);
+static void dexter_servercomm_tls_parameters_copy (DexterServerTLSParameters *dest,
+ const DexterServerTLSParameters *source);
+static void dexter_servercomm_tls_parameters_free (DexterServerTLSParameters *tls_parameters);
+static void dexter_servercomm_starttls (DexterServerComm *servercomm,
+ const DexterChannelMessage *msg,
+ GError **error);
+#endif
+
/* function to destroy [timed]sampler when removed from sampler hash */
static void _sampler_hash_destroy_notify (GObject *object);
@@ -125,6 +136,66 @@
}
servercomm->cur_dat_backlog = 0;
+
+#ifdef HAVE_TLS
+ servercomm->tls_parameters = dexter_servercomm_tls_parameters_new0 ();
+
+ /* fetch TLS parameters from config file */
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ServerTLSCertFile",
+ &servercomm->tls_parameters->cert_file, NULL))
+ {
+ servercomm->tls_parameters->cert_file = g_strdup (DEFAULT_SERVERCOMM_TLS_CERT_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS cert file", G_STRFUNC, servercomm->tls_parameters->cert_file);
+#endif
+ }
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ServerTLSKeyFile",
+ &servercomm->tls_parameters->key_file, NULL))
+ {
+ servercomm->tls_parameters->key_file = g_strdup (DEFAULT_SERVERCOMM_TLS_KEY_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS key file", G_STRFUNC, servercomm->tls_parameters->key_file);
+#endif
+ }
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ServerTLSTrustFile",
+ &servercomm->tls_parameters->trust_file, NULL))
+ {
+ servercomm->tls_parameters->trust_file = g_strdup (DEFAULT_SERVERCOMM_TLS_TRUST_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS trust file", G_STRFUNC, servercomm->tls_parameters->trust_file);
+#endif
+ }
+ if (!dexter_config_get_string (__ICONFIG,
+ "Main", "ServerTLSCrlFile",
+ &servercomm->tls_parameters->crl_file, NULL))
+ {
+ servercomm->tls_parameters->crl_file = g_strdup (DEFAULT_SERVERCOMM_TLS_CRL_FILE);
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %s for TLS crl file", G_STRFUNC, servercomm->tls_parameters->crl_file);
+#endif
+ }
+ {
+ gint tmp_client_cert_flag;
+
+ if (!dexter_config_get_integer (__ICONFIG,
+ "Main", "ServerTLSClientCertFlag",
+ &tmp_client_cert_flag, NULL))
+ {
+ servercomm->tls_parameters->client_cert_flag = DEFAULT_SERVERCOMM_TLS_CLIENT_CERT_FLAG;
+#ifdef G_ENABLE_DEBUG
+ g_message ("%s: using default %d for TLS client cert flag",
+ G_STRFUNC, servercomm->tls_parameters->client_cert_flag);
+#endif
+ }
+ else
+ {
+ servercomm->tls_parameters->client_cert_flag = (DexterServerTLSClientCertFlag) tmp_client_cert_flag;
+ }
+ }
+#endif /* HAVE_TLS */
}
@@ -153,6 +224,10 @@
/* release async queue */
g_async_queue_unref (servercomm->dat_queue);
+#ifdef HAVE_TLS
+ dexter_servercomm_tls_parameters_free (servercomm->tls_parameters);
+#endif
+
/* chain up */
G_OBJECT_CLASS(dexter_servercomm_parent_class)->finalize (object);
}
@@ -190,7 +265,115 @@
}
+#ifdef HAVE_TLS
+static DexterServerTLSParameters *
+dexter_servercomm_tls_parameters_new0 (void)
+{
+ return g_slice_new0 (DexterServerTLSParameters);
+}
+
+
static void
+dexter_servercomm_tls_parameters_copy (DexterServerTLSParameters *dest,
+ const DexterServerTLSParameters *source)
+{
+ g_return_if_fail (dest != NULL);
+ g_return_if_fail (source != NULL);
+
+ dest->cert_file = g_strdup (source->cert_file);
+ dest->key_file = g_strdup (source->key_file);
+ dest->trust_file = g_strdup (source->trust_file);
+ dest->crl_file = g_strdup (source->crl_file);
+ dest->client_cert_flag = source->client_cert_flag;
+}
+
+
+static void
+dexter_servercomm_tls_parameters_free (DexterServerTLSParameters *tls_parameters)
+{
+ if (G_UNLIKELY (!tls_parameters))
+ return;
+
+ g_free (tls_parameters->cert_file);
+ g_free (tls_parameters->key_file);
+ g_free (tls_parameters->trust_file);
+ g_free (tls_parameters->crl_file);
+ g_slice_free (DexterServerTLSParameters, tls_parameters);
+}
+
+
+static void
+dexter_servercomm_starttls (DexterServerComm *servercomm,
+ const DexterChannelMessage *msg,
+ GError **error)
+{
+ DexterServerTLSParameters *tls_parameters;
+ const DexterServerTLSSettings *tls_settings;
+ GError *local_error = NULL;
+
+ g_return_if_fail (DEXTER_IS_SERVERCOMM (servercomm));
+ g_return_if_fail (msg != NULL);
+ g_return_if_fail (error == NULL || *error == NULL);
+
+ g_object_ref (servercomm);
+
+ tls_settings = dexter_server_tls_settings (servercomm->server);
+
+ /* check if server supports TLS */
+ if (tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_NONE)
+ {
+ dexter_servercomm_reply (servercomm, msg->cmd.command, msg->peer_id, ERROR_TLS_NOT_AVAILABLE, NULL, error);
+ g_object_unref (servercomm);
+ return;
+ }
+
+ /* check if TLS already running */
+ if (G_UNLIKELY (dexter_network_session_tls_running (servercomm->session)))
+ {
+ dexter_servercomm_reply (servercomm, msg->cmd.command, msg->peer_id, ERROR_TLS_ALREADY_STARTED, NULL,error);
+ g_object_unref (servercomm);
+ return;
+ }
+
+ /* get default TLS parameters */
+ tls_parameters = dexter_servercomm_tls_parameters_new0 ();
+ dexter_servercomm_tls_parameters_copy (tls_parameters, servercomm->tls_parameters);
+
+ /* if specified, issue callback to finalize TLS parameters */
+ if (tls_settings->starttls_callback)
+ {
+ (tls_settings->starttls_callback) (servercomm->server,
+ dexter_network_session_peer_addr (servercomm->session),
+ dexter_network_session_peer_addrlen (servercomm->session),
+ tls_parameters);
+ }
+
+ /* tell client to proceed with TLS handshake */
+ dexter_servercomm_reply (servercomm, msg->cmd.command, msg->peer_id, STATUS_OK, NULL, error);
+
+ /* start TLS handshake */
+ dexter_network_session_server_starttls (servercomm->session,
+ tls_parameters->cert_file,
+ tls_parameters->key_file,
+ tls_parameters->trust_file,
+ tls_parameters->crl_file,
+ tls_parameters->client_cert_flag,
+ &local_error);
+ if (local_error)
+ {
+ dexter_servercomm_tls_parameters_free (tls_parameters);
+ g_propagate_error (error, local_error);
+ g_object_unref (servercomm);
+ return;
+ }
+
+ dexter_servercomm_tls_parameters_free (tls_parameters);
+ g_object_unref (servercomm);
+}
+#endif
+
+
+static void
_sampler_hash_destroy_notify (GObject *object)
{
if (DEXTER_IS_SAMPLER (object))
@@ -339,7 +522,7 @@
{
REQUIRE_GREETING;
#ifdef HAVE_TLS
- dexter_servercomm_reply (servercomm, msg.cmd.command, msg.peer_id, STATUS_OK, NULL, error);
+ dexter_servercomm_starttls (servercomm, &msg, error);
#else
dexter_servercomm_reply (servercomm, msg.cmd.command, msg.peer_id, ERROR_TLS_NOT_AVAILABLE, NULL, error);
#endif
Modified: libdexter/trunk/dexter/dexter-servercomm.h
===================================================================
--- libdexter/trunk/dexter/dexter-servercomm.h 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/dexter/dexter-servercomm.h 2007-06-09 07:17:19 UTC (rev 369)
@@ -25,12 +25,21 @@
#include <glib-object.h>
#include <dexter-msgframer.h>
+#include <dexter-server-internal.h>
#include <dexterplugin-service.h>
G_BEGIN_DECLS
-#define DEFAULT_SERVERCOMM_MAX_DATA_BACKLOG 16
+#define DEFAULT_SERVERCOMM_MAX_DATA_BACKLOG 16
+#ifdef HAVE_TLS
+#define DEFAULT_SERVERCOMM_TLS_CERT_FILE "/etc/ssl/libdexter/server-cert.pem"
+#define DEFAULT_SERVERCOMM_TLS_KEY_FILE "/etc/ssl/libdexter/server-key.pem"
+#define DEFAULT_SERVERCOMM_TLS_TRUST_FILE "/etc/ssl/libdexter/server-trust.pem"
+#define DEFAULT_SERVERCOMM_TLS_CRL_FILE "/etc/ssl/libdexter/server-crl.pem"
+#define DEFAULT_SERVERCOMM_TLS_CLIENT_CERT_FLAG 1
+#endif
+
#define DEXTER_TYPE_SERVERCOMM (dexter_servercomm_get_type ())
#define DEXTER_SERVERCOMM(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), \
DEXTER_TYPE_SERVERCOMM, DexterServerComm))
@@ -50,14 +59,18 @@
struct _DexterServerComm
{
- GObject parent;
- dexter_network_session_t *session; /* network session */
- gboolean greeting_exchanged; /* true if protocol greeting exchanged */
- DexterPluginServiceGroup *sampler_service_group; /* sampler services we offer */
- GHashTable *sampler_hash; /* samplers created on behalf of client */
- GAsyncQueue *dat_queue; /* delivery queue of DAT messages for client */
- gint max_dat_backlog; /* max length of data delivery queue */
- volatile gint cur_dat_backlog; /* current data delivery backlog */
+ GObject parent;
+ DexterServer *server; /* server that owns us */
+ dexter_network_session_t *session; /* network session */
+ gboolean greeting_exchanged; /* true if protocol greeting exchanged */
+ DexterPluginServiceGroup *sampler_service_group; /* sampler services we offer */
+ GHashTable *sampler_hash; /* samplers created on behalf of client */
+ GAsyncQueue *dat_queue; /* delivery queue of DAT messages for client */
+ gint max_dat_backlog; /* max length of data delivery queue */
+ volatile gint cur_dat_backlog; /* current data delivery backlog */
+#ifdef HAVE_TLS
+ DexterServerTLSParameters *tls_parameters; /* default TLS parameters from config file */
+#endif
};
struct _DexterServerCommClass
Modified: libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml
===================================================================
--- libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml 2007-06-09 07:17:19 UTC (rev 369)
@@ -29,10 +29,11 @@
</para>
-@DEXTER_SERVER_ERROR_STATE:
@DEXTER_SERVER_ERROR_EACCES:
@DEXTER_SERVER_ERROR_EADDRINUSE:
@DEXTER_SERVER_ERROR_EAGAIN:
+@DEXTER_SERVER_ERROR_STATE:
+@DEXTER_SERVER_ERROR_TLS_NOT_ENABLED:
@DEXTER_SERVER_ERROR_FAILED:
<!-- ##### STRUCT DexterServer ##### -->
@@ -76,6 +77,7 @@
@server:
@client_sa:
+@client_salen:
@tls_parameters:
Modified: libdexter/trunk/programs/dexterd/dexterd.c
===================================================================
--- libdexter/trunk/programs/dexterd/dexterd.c 2007-06-04 18:13:59 UTC (rev 368)
+++ libdexter/trunk/programs/dexterd/dexterd.c 2007-06-09 07:17:19 UTC (rev 369)
@@ -72,7 +72,7 @@
{
GOptionContext *context;
DexterServer *server;
- DexterServerTLSSettings tls_settings;
+ DexterServerTLSSettings tls_settings;
GError *err = NULL;
/* Abort on any warning within this program's domain */
@@ -166,10 +166,10 @@
tls_settings.starttls_callback = NULL;
#ifdef HAVE_TLS
tls_settings.support_flag = DEXTER_SERVER_TLS_SUPPORT_AVAILABLE;
+ dexter_server_start (server, &tls_settings, &err);
#else
- tls_settings.support_flag = DEXTER_SERVER_TLS_SUPPORT_NONE;
+ dexter_server_start (server, NULL, &err);
#endif
- dexter_server_start (server, &tls_settings, &err);
if (err)
g_warning (err->message);
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
