Refactored SSL initialisation functions

Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Signed-off-by: David Sommerseth <davids@redhat.com>

5 files changed, 97 insertions, 51 deletions

diff --git a/ssl.c b/ssl.c
index 0d618bd..6bef044 100644
--- a/ssl.c
+++ b/ssl.c
@@ -6,6 +6,7 @@
  *             packet compression.
  *
  *  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ *  Copyright (C) 2010 Fox Crypto B.V. <openvpn@fox-it.com>
  *
  *  Additions for eurephia plugin done by:
  *         David Sommerseth <dazo@users.sourceforge.net> Copyright (C) 2008-2009
@@ -26,6 +27,10 @@
  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+/**
+ * @file Control Channel SSL/Data channel negotiation Module
+ */
+
 /*
  * The routines in this file deal with dynamically negotiating
  * the data channel HMAC and cipher keys through a TLS session.
@@ -38,7 +43,6 @@
 
 #if defined(USE_CRYPTO) && defined(USE_SSL)
 
-#include "ssl.h"
 #include "error.h"
 #include "common.h"
 #include "integer.h"
@@ -54,6 +58,10 @@
 #include "base64.h"
 #include "route.h"
 
+#include "ssl.h"
+#include "ssl_verify.h"
+#include "ssl_backend.h"
+
 #ifdef WIN32
 #include "cryptoapi.h"
 #endif
@@ -204,55 +212,20 @@ tls_init_control_channel_frame_parameters(const struct frame *data_channel_frame
   frame_set_mtu_dynamic (frame, 0, SET_MTU_TUN);
 }
 
-/*
- * Allocate space in SSL objects
- * in which to store a struct tls_session
- * pointer back to parent.
- */
-
-static int mydata_index; /* GLOBAL */
-
-static void
-ssl_set_mydata_index ()
-{
-  mydata_index = SSL_get_ex_new_index (0, "struct session *", NULL, NULL, NULL);
-  ASSERT (mydata_index >= 0);
-}
-
 void
 init_ssl_lib ()
 {
-  SSL_library_init ();
-  SSL_load_error_strings ();
-  OpenSSL_add_all_algorithms ();
+  tls_init_lib ();
 
-  crypto_init_lib();
-
-  /*
-   * If you build the OpenSSL library and OpenVPN with
-   * CRYPTO_MDEBUG, you will get a listing of OpenSSL
-   * memory leaks on program termination.
-   */
-#ifdef CRYPTO_MDEBUG
-  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
-#endif
-
-  ssl_set_mydata_index ();
+  crypto_init_lib ();
 }
 
 void
 free_ssl_lib ()
 {
-#ifdef CRYPTO_MDEBUG
-  FILE* fp = fopen ("sdlog", "w");
-  ASSERT (fp);
-  CRYPTO_mem_leaks_fp (fp);
-  fclose (fp);
-#endif
-
   crypto_uninit_lib ();
-  EVP_cleanup ();
-  ERR_free_strings ();
+
+  tls_free_lib();
 }
 
 /*
@@ -5151,7 +5124,7 @@ tls_process (struct tls_multi *multi,
   }
 
 error:
-  ERR_clear_error ();
+  tls_clear_error();
   ks->state = S_ERROR;
   msg (D_TLS_ERRORS, "TLS Error: TLS handshake failed");
   INCR_ERROR;
@@ -5184,7 +5157,7 @@ tls_multi_process (struct tls_multi *multi,
 
   perf_push (PERF_TLS_MULTI_PROCESS);
 
-  ERR_clear_error ();
+  tls_clear_error ();
 
   /*
    * Process each session object having state of S_INITIAL or greater,
@@ -5791,7 +5764,7 @@ tls_pre_decrypt (struct tls_multi *multi,
  error:
   ++multi->n_soft_errors;
  error_lite:
-  ERR_clear_error ();
+  tls_clear_error();
   goto done;
 }
 
@@ -5902,7 +5875,7 @@ tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,
   return ret;
 
  error:
-  ERR_clear_error ();
+  tls_clear_error();
   gc_free (&gc);
   return ret;
 }
@@ -5997,7 +5970,7 @@ tls_send_payload (struct tls_multi *multi,
   struct key_state *ks;
   bool ret = false;
 
-  ERR_clear_error ();
+  tls_clear_error();
 
   ASSERT (multi);
 
@@ -6017,7 +5990,8 @@ tls_send_payload (struct tls_multi *multi,
       ret = true;
     }
 
-  ERR_clear_error ();
+
+  tls_clear_error();
 
   return ret;
 }
@@ -6030,7 +6004,7 @@ tls_rec_payload (struct tls_multi *multi,
   struct key_state *ks;
   bool ret = false;
 
-  ERR_clear_error ();
+  tls_clear_error();
 
   ASSERT (multi);
 
@@ -6044,7 +6018,7 @@ tls_rec_payload (struct tls_multi *multi,
       ks->plaintext_read_buf.len = 0;
     }
 
-  ERR_clear_error ();
+  tls_clear_error();
 
   return ret;
 }
diff --git a/ssl.h b/ssl.h
index 0f05728..fbdb2c6 100644
--- a/ssl.h
+++ b/ssl.h
@@ -6,6 +6,7 @@
  *             packet compression.
  *
  *  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ *  Copyright (C) 2010 Fox Crypto B.V. <openvpn@fox-it.com>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
@@ -22,12 +23,10 @@
  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-
 /**
- * @file header file
+ * @file Control Channel SSL/Data channel negotiation module
  */
 
-
 #ifndef OPENVPN_SSL_H
 #define OPENVPN_SSL_H
 
@@ -51,6 +50,9 @@
 #include "options.h"
 #include "plugin.h"
 
+#include "ssl_common.h"
+#include "ssl_verify.h"
+#include "ssl_backend.h"
 
 /* Used in the TLS PRF function */
 #define KEY_EXPANSION_ID "OpenVPN"
@@ -231,6 +233,15 @@ struct cert_hash {
 struct cert_hash_set {
   struct cert_hash *ch[MAX_CERT_DEPTH];
 };
+/*
+ * Prepare the SSL library for use
+ */
+void init_ssl_lib (void);
+
+/*
+ * Free any internal state that the SSL library might have
+ */
+void free_ssl_lib (void);
 
 /**
  * Container for one half of random material to be used in %key method 2
diff --git a/ssl_backend.h b/ssl_backend.h
index d7e8361..639d850 100644
--- a/ssl_backend.h
+++ b/ssl_backend.h
@@ -43,4 +43,25 @@
  * Functions implemented in ssl.c for use by the backend SSL library
  *
  */
+/*
+ *
+ * Functions used in ssl.c which must be implemented by the backend SSL library
+ *
+ */
+
+/**
+ * Perform any static initialisation necessary by the library.
+ * Called on OpenVPN initialisation
+ */
+void tls_init_lib();
+
+/**
+ * Free any global SSL library-specific data structures.
+ */
+void tls_free_lib();
+/**
+ * Clear the underlying SSL library's error state.
+ */
+void tls_clear_error();
+
 #endif /* SSL_BACKEND_H_ */
diff --git a/ssl_openssl.c b/ssl_openssl.c
index b38af87..eff0bc4 100644
--- a/ssl_openssl.c
+++ b/ssl_openssl.c
@@ -42,3 +42,35 @@
 #include <openssl/pkcs12.h>
 #include <openssl/x509.h>
 #include <openssl/crypto.h>
+
+/*
+ * Allocate space in SSL objects in which to store a struct tls_session
+ * pointer back to parent.
+ *
+ */
+
+int mydata_index; /* GLOBAL */
+
+void
+tls_init_lib()
+{
+  SSL_library_init();
+  SSL_load_error_strings();
+  OpenSSL_add_all_algorithms ();
+
+  mydata_index = SSL_get_ex_new_index(0, "struct session *", NULL, NULL, NULL);
+  ASSERT (mydata_index >= 0);
+}
+
+void
+tls_free_lib()
+{
+  EVP_cleanup();
+  ERR_free_strings();
+}
+
+void
+tls_clear_error()
+{
+  ERR_clear_error ();
+}
diff --git a/ssl_openssl.h b/ssl_openssl.h
index d412ef2..fb817ae 100644
--- a/ssl_openssl.h
+++ b/ssl_openssl.h
@@ -32,4 +32,12 @@
 
 #include <openssl/ssl.h>
 
+/**
+ * Allocate space in SSL objects in which to store a struct tls_session
+ * pointer back to parent.
+ */
+extern int mydata_index; /* GLOBAL */
+
+void openssl_set_mydata_index (void);
+
 #endif /* SSL_OPENSSL_H_ */