diff options
Diffstat (limited to 'src/microspdy/tls.c')
-rw-r--r-- | src/microspdy/tls.c | 52 |
1 files changed, 26 insertions, 26 deletions
diff --git a/src/microspdy/tls.c b/src/microspdy/tls.c index 521f8f24..57fd357d 100644 --- a/src/microspdy/tls.c +++ b/src/microspdy/tls.c | |||
@@ -78,37 +78,37 @@ int | |||
78 | SPDYF_tls_init(struct SPDY_Daemon *daemon) | 78 | SPDYF_tls_init(struct SPDY_Daemon *daemon) |
79 | { | 79 | { |
80 | //create ssl context. TLSv1 used | 80 | //create ssl context. TLSv1 used |
81 | if(NULL == (daemon->tls_context = SSL_CTX_new(TLSv1_server_method()))) | 81 | if(NULL == (daemon->io_context = SSL_CTX_new(TLSv1_server_method()))) |
82 | { | 82 | { |
83 | SPDYF_DEBUG("Couldn't create ssl context"); | 83 | SPDYF_DEBUG("Couldn't create ssl context"); |
84 | return SPDY_NO; | 84 | return SPDY_NO; |
85 | } | 85 | } |
86 | //set options for tls | 86 | //set options for tls |
87 | //TODO DH is not enabled for easier debugging | 87 | //TODO DH is not enabled for easier debugging |
88 | //SSL_CTX_set_options(daemon->tls_context, SSL_OP_SINGLE_DH_USE); | 88 | //SSL_CTX_set_options(daemon->io_context, SSL_OP_SINGLE_DH_USE); |
89 | 89 | ||
90 | //TODO here session tickets are disabled for easier debuging with | 90 | //TODO here session tickets are disabled for easier debuging with |
91 | //wireshark when using Chrome | 91 | //wireshark when using Chrome |
92 | //SSL_OP_NO_COMPRESSION disables TLS compression to avoid CRIME attack | 92 | //SSL_OP_NO_COMPRESSION disables TLS compression to avoid CRIME attack |
93 | SSL_CTX_set_options(daemon->tls_context, SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION); | 93 | SSL_CTX_set_options(daemon->io_context, SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION); |
94 | if(1 != SSL_CTX_use_certificate_file(daemon->tls_context, daemon->certfile , SSL_FILETYPE_PEM)) | 94 | if(1 != SSL_CTX_use_certificate_file(daemon->io_context, daemon->certfile , SSL_FILETYPE_PEM)) |
95 | { | 95 | { |
96 | SPDYF_DEBUG("Couldn't load the cert file"); | 96 | SPDYF_DEBUG("Couldn't load the cert file"); |
97 | SSL_CTX_free(daemon->tls_context); | 97 | SSL_CTX_free(daemon->io_context); |
98 | return SPDY_NO; | 98 | return SPDY_NO; |
99 | } | 99 | } |
100 | if(1 != SSL_CTX_use_PrivateKey_file(daemon->tls_context, daemon->keyfile, SSL_FILETYPE_PEM)) | 100 | if(1 != SSL_CTX_use_PrivateKey_file(daemon->io_context, daemon->keyfile, SSL_FILETYPE_PEM)) |
101 | { | 101 | { |
102 | SPDYF_DEBUG("Couldn't load the name file"); | 102 | SPDYF_DEBUG("Couldn't load the name file"); |
103 | SSL_CTX_free(daemon->tls_context); | 103 | SSL_CTX_free(daemon->io_context); |
104 | return SPDY_NO; | 104 | return SPDY_NO; |
105 | } | 105 | } |
106 | SSL_CTX_set_next_protos_advertised_cb(daemon->tls_context, &spdyf_next_protos_advertised_cb, NULL); | 106 | SSL_CTX_set_next_protos_advertised_cb(daemon->io_context, &spdyf_next_protos_advertised_cb, NULL); |
107 | //TODO only RC4-SHA is used to make it easy to debug with wireshark | 107 | //TODO only RC4-SHA is used to make it easy to debug with wireshark |
108 | if (1 != SSL_CTX_set_cipher_list(daemon->tls_context, "RC4-SHA")) | 108 | if (1 != SSL_CTX_set_cipher_list(daemon->io_context, "RC4-SHA")) |
109 | { | 109 | { |
110 | SPDYF_DEBUG("Couldn't set the desired cipher list"); | 110 | SPDYF_DEBUG("Couldn't set the desired cipher list"); |
111 | SSL_CTX_free(daemon->tls_context); | 111 | SSL_CTX_free(daemon->io_context); |
112 | return SPDY_NO; | 112 | return SPDY_NO; |
113 | } | 113 | } |
114 | 114 | ||
@@ -119,7 +119,7 @@ SPDYF_tls_init(struct SPDY_Daemon *daemon) | |||
119 | void | 119 | void |
120 | SPDYF_tls_deinit(struct SPDY_Daemon *daemon) | 120 | SPDYF_tls_deinit(struct SPDY_Daemon *daemon) |
121 | { | 121 | { |
122 | SSL_CTX_free(daemon->tls_context); | 122 | SSL_CTX_free(daemon->io_context); |
123 | } | 123 | } |
124 | 124 | ||
125 | 125 | ||
@@ -128,30 +128,30 @@ SPDYF_tls_new_session(struct SPDY_Session *session) | |||
128 | { | 128 | { |
129 | int ret; | 129 | int ret; |
130 | 130 | ||
131 | if(NULL == (session->tls_context = SSL_new(session->daemon->tls_context))) | 131 | if(NULL == (session->io_context = SSL_new(session->daemon->io_context))) |
132 | { | 132 | { |
133 | SPDYF_DEBUG("Couldn't create ssl structure"); | 133 | SPDYF_DEBUG("Couldn't create ssl structure"); |
134 | return SPDY_NO; | 134 | return SPDY_NO; |
135 | } | 135 | } |
136 | if(1 != (ret = SSL_set_fd(session->tls_context, session->socket_fd))) | 136 | if(1 != (ret = SSL_set_fd(session->io_context, session->socket_fd))) |
137 | { | 137 | { |
138 | SPDYF_DEBUG("SSL_set_fd %i",ret); | 138 | SPDYF_DEBUG("SSL_set_fd %i",ret); |
139 | SSL_free(session->tls_context); | 139 | SSL_free(session->io_context); |
140 | session->tls_context = NULL; | 140 | session->io_context = NULL; |
141 | return SPDY_NO; | 141 | return SPDY_NO; |
142 | } | 142 | } |
143 | 143 | ||
144 | //for non-blocking I/O SSL_accept may return -1 | 144 | //for non-blocking I/O SSL_accept may return -1 |
145 | //and this function won't work | 145 | //and this function won't work |
146 | if(1 != (ret = SSL_accept(session->tls_context))) | 146 | if(1 != (ret = SSL_accept(session->io_context))) |
147 | { | 147 | { |
148 | SPDYF_DEBUG("SSL_accept %i",ret); | 148 | SPDYF_DEBUG("SSL_accept %i",ret); |
149 | SSL_free(session->tls_context); | 149 | SSL_free(session->io_context); |
150 | session->tls_context = NULL; | 150 | session->io_context = NULL; |
151 | return SPDY_NO; | 151 | return SPDY_NO; |
152 | } | 152 | } |
153 | /* alternatively | 153 | /* alternatively |
154 | SSL_set_accept_state(session->tls_context); | 154 | SSL_set_accept_state(session->io_context); |
155 | * may be called and then the negotiation will be done on reading | 155 | * may be called and then the negotiation will be done on reading |
156 | */ | 156 | */ |
157 | 157 | ||
@@ -167,9 +167,9 @@ SPDYF_tls_close_session(struct SPDY_Session *session) | |||
167 | //the TLS session. The lib just sends it and will close the socket | 167 | //the TLS session. The lib just sends it and will close the socket |
168 | //after that because the browsers don't seem to care much about | 168 | //after that because the browsers don't seem to care much about |
169 | //"close notify" | 169 | //"close notify" |
170 | SSL_shutdown(session->tls_context); | 170 | SSL_shutdown(session->io_context); |
171 | 171 | ||
172 | SSL_free(session->tls_context); | 172 | SSL_free(session->io_context); |
173 | } | 173 | } |
174 | 174 | ||
175 | 175 | ||
@@ -179,13 +179,13 @@ SPDYF_tls_recv(struct SPDY_Session *session, | |||
179 | size_t size) | 179 | size_t size) |
180 | { | 180 | { |
181 | int ret; | 181 | int ret; |
182 | int n = SSL_read(session->tls_context, | 182 | int n = SSL_read(session->io_context, |
183 | buffer, | 183 | buffer, |
184 | size); | 184 | size); |
185 | //if(n > 0) SPDYF_DEBUG("recvd: %i",n); | 185 | //if(n > 0) SPDYF_DEBUG("recvd: %i",n); |
186 | if (n <= 0) | 186 | if (n <= 0) |
187 | { | 187 | { |
188 | ret = SSL_get_error(session->tls_context, n); | 188 | ret = SSL_get_error(session->io_context, n); |
189 | switch(ret) | 189 | switch(ret) |
190 | { | 190 | { |
191 | case SSL_ERROR_ZERO_RETURN: | 191 | case SSL_ERROR_ZERO_RETURN: |
@@ -215,13 +215,13 @@ SPDYF_tls_send(struct SPDY_Session *session, | |||
215 | { | 215 | { |
216 | int ret; | 216 | int ret; |
217 | 217 | ||
218 | int n = SSL_write(session->tls_context, | 218 | int n = SSL_write(session->io_context, |
219 | buffer, | 219 | buffer, |
220 | size); | 220 | size); |
221 | //if(n > 0) SPDYF_DEBUG("sent: %i",n); | 221 | //if(n > 0) SPDYF_DEBUG("sent: %i",n); |
222 | if (n <= 0) | 222 | if (n <= 0) |
223 | { | 223 | { |
224 | ret = SSL_get_error(session->tls_context, n); | 224 | ret = SSL_get_error(session->io_context, n); |
225 | switch(ret) | 225 | switch(ret) |
226 | { | 226 | { |
227 | case SSL_ERROR_ZERO_RETURN: | 227 | case SSL_ERROR_ZERO_RETURN: |
@@ -251,5 +251,5 @@ SPDYF_tls_is_pending(struct SPDY_Session *session) | |||
251 | * BUGS | 251 | * BUGS |
252 | SSL_pending() takes into account only bytes from the TLS/SSL record that is currently being processed (if any). If the SSL object's read_ahead flag is set, additional protocol bytes may have been read containing more TLS/SSL records; these are ignored by SSL_pending(). | 252 | SSL_pending() takes into account only bytes from the TLS/SSL record that is currently being processed (if any). If the SSL object's read_ahead flag is set, additional protocol bytes may have been read containing more TLS/SSL records; these are ignored by SSL_pending(). |
253 | */ | 253 | */ |
254 | return SSL_pending(session->tls_context) > 0 ? SPDY_YES : SPDY_NO; | 254 | return SSL_pending(session->io_context) > 0 ? SPDY_YES : SPDY_NO; |
255 | } | 255 | } |