ipsilon.git - The Ipsilon project

diff options

author	Simo Sorce <simo@redhat.com>	2014-06-16 11:21:15 -0400
committer	Simo Sorce <simo@redhat.com>	2014-06-17 14:51:12 -0400
commit	a0e2bca194d6402ea621614ee95aac0b62fe21dc (patch)
tree	a6f56c41db70971798d28eea82deb63afbe9a7e1 /ipsilon/tools
parent	8a9b4fe36f1bd9b358b20333956af5602eb48a6c (diff)
download	ipsilon-a0e2bca194d6402ea621614ee95aac0b62fe21dc.tar.gz ipsilon-a0e2bca194d6402ea621614ee95aac0b62fe21dc.tar.xz ipsilon-a0e2bca194d6402ea621614ee95aac0b62fe21dc.zip

Add project url and maintainer data to setup file

Signed-off-by: Simo Sorce <simo@redhat.com>

Diffstat (limited to 'ipsilon/tools')

0 files changed, 0 insertions, 0 deletions

/* nsd_gtls.c * * An implementation of the nsd interface for GnuTLS. * * Copyright (C) 2007, 2008 Rainer Gerhards and Adiscon GmbH. * * This file is part of the rsyslog runtime library. * * The rsyslog runtime library is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * The rsyslog runtime library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with the rsyslog runtime library. If not, see <http://www.gnu.org/licenses/>. * * A copy of the GPL can be found in the file "COPYING" in this distribution. * A copy of the LGPL can be found in the file "COPYING.LESSER" in this distribution. */ #include "config.h" #include <stdlib.h> #include <assert.h> #include <string.h> #include <gnutls/gnutls.h> #include <gcrypt.h> #include <errno.h> #include "rsyslog.h" #include "syslogd-types.h" #include "module-template.h" #include "cfsysline.h" #include "obj.h" #include "errmsg.h" #include "nsd_ptcp.h" #include "nsdsel_gtls.h" #include "nsd_gtls.h" /* things to move to some better place/functionality - TODO */ #define DH_BITS 1024 #define CRLFILE "crl.pem" GCRY_THREAD_OPTION_PTHREAD_IMPL; MODULE_TYPE_LIB /* static data */ DEFobjStaticHelpers DEFobjCurrIf(errmsg) DEFobjCurrIf(glbl) DEFobjCurrIf(nsd_ptcp) static int bGlblSrvrInitDone = 0; /**< 0 - server global init not yet done, 1 - already done */ /* a macro to check GnuTLS calls against unexpected errors */ #define CHKgnutls(x) \ if((gnuRet = (x)) != 0) { \ uchar *pErr = gtlsStrerror(gnuRet); \ dbgprintf("unexpected GnuTLS error %d in %s:%d: %s\n", gnuRet, __FILE__, __LINE__, pErr); \ free(pErr); \ ABORT_FINALIZE(RS_RET_GNUTLS_ERR); \ } /* ------------------------------ GnuTLS specifics ------------------------------ */ static gnutls_certificate_credentials xcred; static gnutls_dh_params dh_params; /* a thread-safe variant of gnutls_strerror - TODO: implement it! * The caller must free the returned string. * rgerhards, 2008-04-30 */ uchar *gtlsStrerror(int error) { uchar *pErr; // TODO: guard by mutex! pErr = (uchar*) strdup(gnutls_strerror(error)); return pErr; } /* globally initialize GnuTLS */ static rsRetVal gtlsGlblInit(void) { int gnuRet; uchar *cafile; DEFiRet; /* gcry_control must be called first, so that the thread system is correctly set up */ gcry_control (GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread); CHKgnutls(gnutls_global_init()); /* X509 stuff */ CHKgnutls(gnutls_certificate_allocate_credentials(&xcred)); /* sets the trusted cas file */ cafile = glbl.GetDfltNetstrmDrvrCAF(); dbgprintf("GTLS CA file: '%s'\n", cafile); gnuRet = gnutls_certificate_set_x509_trust_file(xcred, (char*)cafile, GNUTLS_X509_FMT_PEM); if(gnuRet < 0) { /* TODO; a more generic error-tracking function (this one based on CHKgnutls()) */ uchar *pErr = gtlsStrerror(gnuRet); dbgprintf("unexpected GnuTLS error %d in %s:%d: %s\n", gnuRet, __FILE__, __LINE__, pErr); free(pErr); ABORT_FINALIZE(RS_RET_GNUTLS_ERR); } finalize_it: RETiRet; } static rsRetVal gtlsInitSession(nsd_gtls_t *pThis) { DEFiRet; int gnuRet; gnutls_session session; gnutls_init(&session, GNUTLS_SERVER); pThis->bHaveSess = 1; pThis->bIsInitiator = 0; /* avoid calling all the priority functions, since the defaults are adequate. */ CHKgnutls(gnutls_set_default_priority(session)); CHKgnutls(gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred)); /* request client certificate if any. */ gnutls_certificate_server_set_request( session, GNUTLS_CERT_REQUEST); gnutls_dh_set_prime_bits(session, DH_BITS); pThis->sess = session; finalize_it: RETiRet; } static rsRetVal generate_dh_params(void) { int gnuRet; DEFiRet; /* Generate Diffie Hellman parameters - for use with DHE * kx algorithms. These should be discarded and regenerated * once a day, once a week or once a month. Depending on the * security requirements. */ CHKgnutls(gnutls_dh_params_init( &dh_params)); CHKgnutls(gnutls_dh_params_generate2( dh_params, DH_BITS)); finalize_it: RETiRet; } /* set up all global things that are needed for server operations * rgerhards, 2008-04-30 */ static rsRetVal gtlsGlblInitLstn(void) { int gnuRet; uchar *keyFile; uchar *certFile; DEFiRet; if(bGlblSrvrInitDone == 0) { /* we do not use CRLs right now, and I doubt we'll ever do. This functionality is * considered legacy. -- rgerhards, 2008-05-05 */ /*CHKgnutls(gnutls_certificate_set_x509_crl_file(xcred, CRLFILE, GNUTLS_X509_FMT_PEM));*/ certFile = glbl.GetDfltNetstrmDrvrCertFile(); keyFile = glbl.GetDfltNetstrmDrvrKeyFile(); dbgprintf("GTLS certificate file: '%s'\n", certFile); dbgprintf("GTLS key file: '%s'\n", keyFile); CHKgnutls(gnutls_certificate_set_x509_key_file(xcred, (char*)certFile, (char*)keyFile, GNUTLS_X509_FMT_PEM)); CHKiRet(generate_dh_params()); gnutls_certificate_set_dh_params(xcred, dh_params); /* this is void */ bGlblSrvrInitDone = 1; /* we are all set now */ } finalize_it: RETiRet; } /* globally de-initialize GnuTLS */ static rsRetVal gtlsGlblExit(void) { DEFiRet; /* X509 stuff */ gnutls_certificate_free_credentials(xcred); gnutls_global_deinit(); /* we are done... */ RETiRet; } /* end a GnuTLS session * The function checks if we have a session and ends it only if so. So it can * always be called, even if there currently is no session. */ static rsRetVal gtlsEndSess(nsd_gtls_t *pThis) { int gnuRet; DEFiRet; if(pThis->bHaveSess) { if(pThis->bIsInitiator) { gnuRet = gnutls_bye(pThis->sess, GNUTLS_SHUT_RDWR); while(gnuRet == GNUTLS_E_INTERRUPTED || gnuRet == GNUTLS_E_AGAIN) { gnuRet = gnutls_bye(pThis->sess, GNUTLS_SHUT_RDWR); } } gnutls_deinit(pThis->sess); } RETiRet; } /* a small wrapper for gnutls_transport_set_ptr(). The main intension for * creating this wrapper is to get the annoying "cast to pointer from different * size" compiler warning just once. There seems to be no way around it, see: * http://lists.gnu.org/archive/html/help-gnutls/2008-05/msg00000.html * rgerhards, 2008.05-07 */ static inline void gtlsSetTransportPtr(nsd_gtls_t *pThis, int sock) { /* Note: the compiler warning for the next line is OK - see header comment! */ gnutls_transport_set_ptr(pThis->sess, (gnutls_transport_ptr_t) sock); } /* ---------------------------- end GnuTLS specifics ---------------------------- */ /* Standard-Constructor */ BEGINobjConstruct(nsd_gtls) /* be sure to specify the object type also in END macro! */ iRet = nsd_ptcp.Construct(&pThis->pTcp); ENDobjConstruct(nsd_gtls) /* destructor for the nsd_gtls object */ BEGINobjDestruct(nsd_gtls) /* be sure to specify the object type also in END and CODESTART macros! */ CODESTARTobjDestruct(nsd_gtls) if(pThis->iMode == 1) { gtlsEndSess(pThis); } if(pThis->pTcp != NULL) { nsd_ptcp.Destruct(&pThis->pTcp); } ENDobjDestruct(nsd_gtls) /* Set the driver mode. For us, this has the following meaning: * 0 - work in plain tcp mode, without tls (e.g. before a STARTTLS) * 1 - work in TLS mode * rgerhards, 2008-04-28 */ static rsRetVal SetMode(nsd_t *pNsd, int mode) { DEFiRet; nsd_gtls_t *pThis = (nsd_gtls_t*) pNsd; dbgprintf("SetMode tries to set mode %d\n", mode); ISOBJ_TYPE_assert((pThis), nsd_gtls); if(mode != 0 && mode != 1) ABORT_FINALIZE(RS_RET_INVAID_DRVR_MODE); pThis->iMode = mode; finalize_it: RETiRet; } /* Provide access to the underlying OS socket. This is primarily * useful for other drivers (like nsd_gtls) who utilize ourselfs * for some of their functionality. -- rgerhards, 2008-04-18 */ static rsRetVal SetSock(nsd_t *pNsd, int sock)


context:
space:
mode: