[PATCH] conn.s ssl fixes
Alexander Malysh <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Organization | Centrium GmbH |
| Message-ID | <[email protected]> |
Hi List, attched you can find conn.c fixes for ssl enabled connections. Patch does following: 1) enable non-blocking mode for read/write ssl BIO 2) enable partial writing and buffer moving in ssl context. this is needed if we use non-blocking mode otherwise openssl doesn't simulate write(2) behaviour. any comments are very welcome... -- Best regards / Mit besten Grüßen aus Düsseldorf Dipl.-Ing. Alexander Malysh ___________________________________________ Centrium GmbH Vogelsanger Weg 80 40470 Düsseldorf Fon: +49 (0211) 74 84 51 80 Fax: +49 (0211) 277 49 109 email: [email protected] web: www.centrium.de msn: [email protected] icq: 98063111 ___________________________________________ Please avoid sending me Word, Excel or PowerPoint attachments. See http://www.fsf.org/philosophy/no-word-attachments.html
conn.c-ssl-fixes.patch
(text/x-diff, 4.2 KB)
--- ../../../gateway/gwlib/conn.c 2003-10-27 11:40:41.000000000 +0100
+++ gwlib/conn.c 2003-11-07 19:26:20.000000000 +0100
@@ -405,6 +405,8 @@
if (socket_set_blocking(ret->fd, 0) < 0) {
goto error;
}
+ BIO_set_nbio(SSL_get_rbio(ret->ssl), 1);
+ BIO_set_nbio(SSL_get_wbio(ret->ssl), 1);
/* record current time */
timeout = time(NULL);
@@ -523,6 +525,10 @@
}
+/*
+ * XXX bad assuption here that conn_wrap_fd for SSL can only happens
+ * server side!!!! FIXME !!!!
+ */
Connection *conn_wrap_fd(int fd, int ssl)
{
Connection *conn;
@@ -570,8 +576,9 @@
return NULL;
}
/* SSL_set_verify(conn->ssl, 0, NULL); */
- BIO_set_nbio(SSL_get_rbio(conn->ssl), 0);
- BIO_set_nbio(SSL_get_wbio(conn->ssl), 0);
+ /* set read/write BIO layer to non-block */
+ BIO_set_nbio(SSL_get_rbio(conn->ssl), 1);
+ BIO_set_nbio(SSL_get_wbio(conn->ssl), 1);
/*
* now enter the SSL handshake phase
@@ -584,8 +591,11 @@
*/
while (((rc = SSL_accept(conn->ssl)) <= 0) &&
((SSL_get_error(conn->ssl, rc) == SSL_ERROR_WANT_READ) ||
- (SSL_get_error(conn->ssl, rc) == SSL_ERROR_WANT_WRITE)))
- {}
+ (SSL_get_error(conn->ssl, rc) == SSL_ERROR_WANT_WRITE))) {
+ /* busy waiting */
+ gwthread_sleep(0.02);
+ }
+
/*
* If SSL_accept() has failed then check which reason it may
@@ -599,8 +609,8 @@
* was transferred. That's not a real error and can occur
* sporadically with some clients.
*/
- warning(0, "SSL: handshake stopped: connection was closed");
- warning(0, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
+ error(0, "SSL: handshake stopped: connection was closed");
+ error(0, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
SSL_set_shutdown(conn->ssl, SSL_RECEIVED_SHUTDOWN);
SSL_smart_shutdown(conn->ssl);
@@ -617,8 +627,8 @@
char ca[2];
int rv;
- warning(0, "SSL: handshake failed: HTTP spoken on HTTPS port");
- warning(0, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
+ error(0, "SSL: handshake failed: HTTP spoken on HTTPS port");
+ error(0, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
/* first: skip the remaining bytes of the request line */
do {
@@ -648,8 +658,8 @@
/*
* ok, anything else is a fatal error
*/
- warning(0, "SSL: handshake failed with fatal error");
- warning(0, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
+ error(0, "SSL: handshake failed with fatal error");
+ error(0, "SSL: OpenSSL: %.256s", ERR_error_string(ERR_get_error(), NULL));
SSL_set_shutdown(conn->ssl, SSL_RECEIVED_SHUTDOWN);
SSL_smart_shutdown(conn->ssl);
@@ -1270,6 +1280,7 @@
/* the call-back function for the openssl crypto thread locking */
void openssl_locking_function(int mode, int n, const char *file, int line)
{
+ /* debug("", 0, "openssl_locking_function(%d, %d, %s, %d) called", mode, n, file, line); */
if (mode & CRYPTO_LOCK)
mutex_lock(ssl_static_locks[n-1]);
else
@@ -1310,6 +1321,8 @@
SSL_library_init();
SSL_load_error_strings();
global_ssl_context = SSL_CTX_new(SSLv23_method());
+ SSL_CTX_set_mode(global_ssl_context,
+ SSL_MODE_ENABLE_PARTIAL_WRITE|SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
}
void server_ssl_init(void)
@@ -1317,6 +1330,8 @@
SSLeay_add_ssl_algorithms();
SSL_load_error_strings();
global_server_ssl_context = SSL_CTX_new(SSLv23_server_method());
+ SSL_CTX_set_mode(global_server_ssl_context,
+ SSL_MODE_ENABLE_PARTIAL_WRITE|SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
if (!SSL_CTX_set_default_verify_paths(global_server_ssl_context)) {
panic(0, "can not set default path for server");
}