aboutsummaryrefslogtreecommitdiff
path: root/src/microspdy/tls.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/microspdy/tls.c')
-rw-r--r--src/microspdy/tls.c52
1 files changed, 26 insertions, 26 deletions
diff --git a/src/microspdy/tls.c b/src/microspdy/tls.c
index 521f8f24..57fd357d 100644
--- a/src/microspdy/tls.c
+++ b/src/microspdy/tls.c
@@ -78,37 +78,37 @@ int
78SPDYF_tls_init(struct SPDY_Daemon *daemon) 78SPDYF_tls_init(struct SPDY_Daemon *daemon)
79{ 79{
80 //create ssl context. TLSv1 used 80 //create ssl context. TLSv1 used
81 if(NULL == (daemon->tls_context = SSL_CTX_new(TLSv1_server_method()))) 81 if(NULL == (daemon->io_context = SSL_CTX_new(TLSv1_server_method())))
82 { 82 {
83 SPDYF_DEBUG("Couldn't create ssl context"); 83 SPDYF_DEBUG("Couldn't create ssl context");
84 return SPDY_NO; 84 return SPDY_NO;
85 } 85 }
86 //set options for tls 86 //set options for tls
87 //TODO DH is not enabled for easier debugging 87 //TODO DH is not enabled for easier debugging
88 //SSL_CTX_set_options(daemon->tls_context, SSL_OP_SINGLE_DH_USE); 88 //SSL_CTX_set_options(daemon->io_context, SSL_OP_SINGLE_DH_USE);
89 89
90 //TODO here session tickets are disabled for easier debuging with 90 //TODO here session tickets are disabled for easier debuging with
91 //wireshark when using Chrome 91 //wireshark when using Chrome
92 //SSL_OP_NO_COMPRESSION disables TLS compression to avoid CRIME attack 92 //SSL_OP_NO_COMPRESSION disables TLS compression to avoid CRIME attack
93 SSL_CTX_set_options(daemon->tls_context, SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION); 93 SSL_CTX_set_options(daemon->io_context, SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION);
94 if(1 != SSL_CTX_use_certificate_file(daemon->tls_context, daemon->certfile , SSL_FILETYPE_PEM)) 94 if(1 != SSL_CTX_use_certificate_file(daemon->io_context, daemon->certfile , SSL_FILETYPE_PEM))
95 { 95 {
96 SPDYF_DEBUG("Couldn't load the cert file"); 96 SPDYF_DEBUG("Couldn't load the cert file");
97 SSL_CTX_free(daemon->tls_context); 97 SSL_CTX_free(daemon->io_context);
98 return SPDY_NO; 98 return SPDY_NO;
99 } 99 }
100 if(1 != SSL_CTX_use_PrivateKey_file(daemon->tls_context, daemon->keyfile, SSL_FILETYPE_PEM)) 100 if(1 != SSL_CTX_use_PrivateKey_file(daemon->io_context, daemon->keyfile, SSL_FILETYPE_PEM))
101 { 101 {
102 SPDYF_DEBUG("Couldn't load the name file"); 102 SPDYF_DEBUG("Couldn't load the name file");
103 SSL_CTX_free(daemon->tls_context); 103 SSL_CTX_free(daemon->io_context);
104 return SPDY_NO; 104 return SPDY_NO;
105 } 105 }
106 SSL_CTX_set_next_protos_advertised_cb(daemon->tls_context, &spdyf_next_protos_advertised_cb, NULL); 106 SSL_CTX_set_next_protos_advertised_cb(daemon->io_context, &spdyf_next_protos_advertised_cb, NULL);
107 //TODO only RC4-SHA is used to make it easy to debug with wireshark 107 //TODO only RC4-SHA is used to make it easy to debug with wireshark
108 if (1 != SSL_CTX_set_cipher_list(daemon->tls_context, "RC4-SHA")) 108 if (1 != SSL_CTX_set_cipher_list(daemon->io_context, "RC4-SHA"))
109 { 109 {
110 SPDYF_DEBUG("Couldn't set the desired cipher list"); 110 SPDYF_DEBUG("Couldn't set the desired cipher list");
111 SSL_CTX_free(daemon->tls_context); 111 SSL_CTX_free(daemon->io_context);
112 return SPDY_NO; 112 return SPDY_NO;
113 } 113 }
114 114
@@ -119,7 +119,7 @@ SPDYF_tls_init(struct SPDY_Daemon *daemon)
119void 119void
120SPDYF_tls_deinit(struct SPDY_Daemon *daemon) 120SPDYF_tls_deinit(struct SPDY_Daemon *daemon)
121{ 121{
122 SSL_CTX_free(daemon->tls_context); 122 SSL_CTX_free(daemon->io_context);
123} 123}
124 124
125 125
@@ -128,30 +128,30 @@ SPDYF_tls_new_session(struct SPDY_Session *session)
128{ 128{
129 int ret; 129 int ret;
130 130
131 if(NULL == (session->tls_context = SSL_new(session->daemon->tls_context))) 131 if(NULL == (session->io_context = SSL_new(session->daemon->io_context)))
132 { 132 {
133 SPDYF_DEBUG("Couldn't create ssl structure"); 133 SPDYF_DEBUG("Couldn't create ssl structure");
134 return SPDY_NO; 134 return SPDY_NO;
135 } 135 }
136 if(1 != (ret = SSL_set_fd(session->tls_context, session->socket_fd))) 136 if(1 != (ret = SSL_set_fd(session->io_context, session->socket_fd)))
137 { 137 {
138 SPDYF_DEBUG("SSL_set_fd %i",ret); 138 SPDYF_DEBUG("SSL_set_fd %i",ret);
139 SSL_free(session->tls_context); 139 SSL_free(session->io_context);
140 session->tls_context = NULL; 140 session->io_context = NULL;
141 return SPDY_NO; 141 return SPDY_NO;
142 } 142 }
143 143
144 //for non-blocking I/O SSL_accept may return -1 144 //for non-blocking I/O SSL_accept may return -1
145 //and this function won't work 145 //and this function won't work
146 if(1 != (ret = SSL_accept(session->tls_context))) 146 if(1 != (ret = SSL_accept(session->io_context)))
147 { 147 {
148 SPDYF_DEBUG("SSL_accept %i",ret); 148 SPDYF_DEBUG("SSL_accept %i",ret);
149 SSL_free(session->tls_context); 149 SSL_free(session->io_context);
150 session->tls_context = NULL; 150 session->io_context = NULL;
151 return SPDY_NO; 151 return SPDY_NO;
152 } 152 }
153 /* alternatively 153 /* alternatively
154 SSL_set_accept_state(session->tls_context); 154 SSL_set_accept_state(session->io_context);
155 * may be called and then the negotiation will be done on reading 155 * may be called and then the negotiation will be done on reading
156 */ 156 */
157 157
@@ -167,9 +167,9 @@ SPDYF_tls_close_session(struct SPDY_Session *session)
167 //the TLS session. The lib just sends it and will close the socket 167 //the TLS session. The lib just sends it and will close the socket
168 //after that because the browsers don't seem to care much about 168 //after that because the browsers don't seem to care much about
169 //"close notify" 169 //"close notify"
170 SSL_shutdown(session->tls_context); 170 SSL_shutdown(session->io_context);
171 171
172 SSL_free(session->tls_context); 172 SSL_free(session->io_context);
173} 173}
174 174
175 175
@@ -179,13 +179,13 @@ SPDYF_tls_recv(struct SPDY_Session *session,
179 size_t size) 179 size_t size)
180{ 180{
181 int ret; 181 int ret;
182 int n = SSL_read(session->tls_context, 182 int n = SSL_read(session->io_context,
183 buffer, 183 buffer,
184 size); 184 size);
185 //if(n > 0) SPDYF_DEBUG("recvd: %i",n); 185 //if(n > 0) SPDYF_DEBUG("recvd: %i",n);
186 if (n <= 0) 186 if (n <= 0)
187 { 187 {
188 ret = SSL_get_error(session->tls_context, n); 188 ret = SSL_get_error(session->io_context, n);
189 switch(ret) 189 switch(ret)
190 { 190 {
191 case SSL_ERROR_ZERO_RETURN: 191 case SSL_ERROR_ZERO_RETURN:
@@ -215,13 +215,13 @@ SPDYF_tls_send(struct SPDY_Session *session,
215{ 215{
216 int ret; 216 int ret;
217 217
218 int n = SSL_write(session->tls_context, 218 int n = SSL_write(session->io_context,
219 buffer, 219 buffer,
220 size); 220 size);
221 //if(n > 0) SPDYF_DEBUG("sent: %i",n); 221 //if(n > 0) SPDYF_DEBUG("sent: %i",n);
222 if (n <= 0) 222 if (n <= 0)
223 { 223 {
224 ret = SSL_get_error(session->tls_context, n); 224 ret = SSL_get_error(session->io_context, n);
225 switch(ret) 225 switch(ret)
226 { 226 {
227 case SSL_ERROR_ZERO_RETURN: 227 case SSL_ERROR_ZERO_RETURN:
@@ -251,5 +251,5 @@ SPDYF_tls_is_pending(struct SPDY_Session *session)
251 * BUGS 251 * BUGS
252SSL_pending() takes into account only bytes from the TLS/SSL record that is currently being processed (if any). If the SSL object's read_ahead flag is set, additional protocol bytes may have been read containing more TLS/SSL records; these are ignored by SSL_pending(). 252SSL_pending() takes into account only bytes from the TLS/SSL record that is currently being processed (if any). If the SSL object's read_ahead flag is set, additional protocol bytes may have been read containing more TLS/SSL records; these are ignored by SSL_pending().
253 */ 253 */
254 return SSL_pending(session->tls_context) > 0 ? SPDY_YES : SPDY_NO; 254 return SSL_pending(session->io_context) > 0 ? SPDY_YES : SPDY_NO;
255} 255}