Rework for TLS.
This commit is contained in:
Brad Arant committed
1 parent
519faa535b
commit
b7deabc5dc
2830 files changed
+4559
-80373
No files matched your search
@@ -1,7 +1,8 @@
|
||||
#include "TLS.h"
|
||||
#include "EPoll.h"
|
||||
#include "TCPSession.h"
|
||||
#include "Exception.h"
|
||||
#include "Log.h"
|
||||
#include <iostream>
|
||||
#include <openssl/rand.h>
|
||||
|
||||
namespace core {
|
||||
|
||||
@@ -17,8 +18,40 @@ namespace core {
|
||||
else
|
||||
pthread_mutex_unlock(&(lockarray[type]));
|
||||
}
|
||||
|
||||
static int generate_session_id(const SSL *ssl, unsigned char *id, unsigned int *id_len) {
|
||||
char *session_id_prefix = (char *)"BARANT";
|
||||
unsigned int count = 0;
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "Generating unique session id.";
|
||||
do {
|
||||
RAND_bytes(id, *id_len);
|
||||
memcpy(id, session_id_prefix, (strlen(session_id_prefix) < *id_len));
|
||||
} while(SSL_has_matching_session_id(ssl, id, *id_len) && (++count < 10));
|
||||
return 1;
|
||||
}
|
||||
|
||||
TLS::TLS() {
|
||||
void handshake_complete(const SSL *ssl, int where, int ret) {
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "==>" << SSL_state_string_long(ssl) << "<==" << ret;
|
||||
if(where & SSL_CB_HANDSHAKE_DONE) {
|
||||
X509 *ssl_client_cert = SSL_get_peer_certificate(ssl);
|
||||
if(!ssl_client_cert)
|
||||
throw std::string("Unable to get peer certificate.");
|
||||
X509_free(ssl_client_cert);
|
||||
if(SSL_get_verify_result(ssl) != X509_V_OK)
|
||||
throw std::string("Certificate verification failed.");
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "Certificate verified successfully.";
|
||||
}
|
||||
else
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "No client certificate.";
|
||||
}
|
||||
|
||||
TLS::TLS() {}
|
||||
|
||||
TLS::TLS(SSL_CTX *ctx) : ctx(ctx) {}
|
||||
|
||||
TLS::~TLS() {}
|
||||
|
||||
void TLS::createContext() {
|
||||
|
||||
SSL_library_init();
|
||||
SSL_load_error_strings();
|
||||
@@ -53,52 +86,22 @@ namespace core {
|
||||
SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(sip_cacert));
|
||||
coreutils::Log(coreutils::LOG_DEBUG_1) << "Server key authenticated.";
|
||||
}
|
||||
|
||||
TLS::~TLS() {}
|
||||
|
||||
static int generate_session_id(const SSL *ssl, unsigned char *id, unsigned int *id_len) {
|
||||
char *session_id_prefix = (char *)"BARANT";
|
||||
unsigned int count = 0;
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "Generating unique session id.";
|
||||
do {
|
||||
RAND_bytes(id, *id_len);
|
||||
memcpy(id, session_id_prefix, (strlen(session_id_prefix) < *id_len));
|
||||
} while(SSL_has_matching_session_id(ssl, id, *id_len) && (++count < 10));
|
||||
return 1;
|
||||
}
|
||||
|
||||
void handshake_complete(const SSL *ssl, int where, int ret) {
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "==>" << SSL_state_string_long(ssl) << "<==" << ret;
|
||||
if(where & SSL_CB_HANDSHAKE_DONE) {
|
||||
X509 *ssl_client_cert = SSL_get_peer_certificate(ssl);
|
||||
if(!ssl_client_cert)
|
||||
throw std::string("Unable to get peer certificate.");
|
||||
X509_free(ssl_client_cert);
|
||||
if(SSL_get_verify_result(ssl) != X509_V_OK)
|
||||
throw std::string("Certificate verification failed.");
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "Certificate verified successfully.";
|
||||
}
|
||||
else
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "No client certificate.";
|
||||
}
|
||||
|
||||
TLSSession::TLSSession(EPoll &ePoll, TCPServer &server) : TCPSession(ePoll, server) {}
|
||||
|
||||
void TLSSession::onRegister() {
|
||||
|
||||
void TLS::registerSocket(int fd) {
|
||||
initialized = true;
|
||||
int ret;
|
||||
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "TLS socket initializing on socket " << getDescriptor() << "...";
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "TLS socket initializing on socket " << fd << "...";
|
||||
|
||||
fcntl(getDescriptor(), F_SETFL, fcntl(getDescriptor(), F_GETFL, 0) | O_NONBLOCK);
|
||||
fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);
|
||||
|
||||
ssl = SSL_new(static_cast<TLSServer &>(server).ctx);
|
||||
ssl = SSL_new(ctx);
|
||||
// if(ssl <= 0)
|
||||
// throw std::string("Error creating new TLS socket.");
|
||||
|
||||
SSL_set_info_callback(ssl, handshake_complete);
|
||||
|
||||
if((ret = SSL_set_fd(ssl, getDescriptor())) == 0)
|
||||
if((ret = SSL_set_fd(ssl, fd)) == 0)
|
||||
throw std::string("Error setting TLS socket descriptor.");
|
||||
|
||||
// if(!SSL_set_generate_session_id(ssl, generate_session_id))
|
||||
@@ -106,7 +109,7 @@ namespace core {
|
||||
|
||||
}
|
||||
|
||||
void TLSSession::onRegistered() {
|
||||
void TLS::acceptSocket() {
|
||||
|
||||
switch (SSL_get_error(ssl, SSL_accept(ssl))) {
|
||||
case SSL_ERROR_SSL:
|
||||
@@ -120,7 +123,7 @@ namespace core {
|
||||
break;
|
||||
case SSL_ERROR_SYSCALL:
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "ERROR_SYSCALL on ssl_accept. errno=" << errno;
|
||||
shutdown();
|
||||
// shutdown();
|
||||
break;
|
||||
default:
|
||||
coreutils::Log(coreutils::LOG_DEBUG_3) << "Unknown ERROR on ssl_accept.";
|
||||
@@ -129,20 +132,14 @@ namespace core {
|
||||
|
||||
}
|
||||
|
||||
TLSSession::~TLSSession() {}
|
||||
|
||||
void TLSSession::protocol(coreutils::ZString &data) {}
|
||||
|
||||
void TLSSession::receiveData(coreutils::ZString &buffer) {
|
||||
void TLS::receiveData(coreutils::ZString &buffer) {
|
||||
|
||||
int len;
|
||||
// int error = -1;
|
||||
//
|
||||
std::cout << "receiveData TLS" << std::endl;
|
||||
|
||||
if((len = ::SSL_read(ssl, buffer.getData(), buffer.getLength())) >= 0) {
|
||||
std::cout << "receiveData TLS...len=" << len << ":" << buffer << std::endl;
|
||||
onDataReceived(buffer);
|
||||
// onDataReceived(buffer);
|
||||
}
|
||||
else {
|
||||
switch (SSL_get_error(ssl, len)) {
|
||||
@@ -165,10 +162,6 @@ namespace core {
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
void TLSSession::output(std::stringstream &out) {
|
||||
out << "|" << ipAddress.getClientAddressAndPort();
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user