Cleanup: Security::ContextPtr removal, pt2

Make the ContextPointer for client TLS contexts extend out of
libsecurity up the stack of callers to their main place of
med/long-term storage.

This means the code outside location where SSL contexts are created
mostly no longer needs to worry about (non-)locking details. Just
about using a smart Pointer properly.

Since class SquidConfig is one of those places this involves linking
pinger with openssl libraries. That is likely a bug to fix later.

diff --git a/src/CachePeer.cc b/src/CachePeer.cc
index 964948ad5b15e3df0d6e2db69f84b6ce0b299f74..0a4ccebfaa742c462dd18be9a88b4f6edd66c3dd 100644 (file)
--- a/src/CachePeer.cc
+++ b/src/CachePeer.cc
@@ -40,9 +40,6 @@ CachePeer::CachePeer() :
     connect_fail_limit(0),
     max_conn(0),
     domain(NULL),
-#if USE_OPENSSL
-    sslContext(NULL),
-#endif
     front_end_https(0),
     connection_auth(2 /* auto */)
 {
@@ -97,10 +94,5 @@ CachePeer::~CachePeer()
     PeerPoolMgr::Checkpoint(standby.mgr, "peer gone");
 
     xfree(domain);
-
-#if USE_OPENSSL
-    if (sslContext)
-        SSL_CTX_free(sslContext);
-#endif
 }
 

diff --git a/src/CachePeer.h b/src/CachePeer.h
index 67a6302ae399c53d83c0da696c3a2404ebda120b..8f951fe22dc39919618dd40407e0a0204a1ab2f5 100644 (file)
--- a/src/CachePeer.h
+++ b/src/CachePeer.h
@@ -183,7 +183,7 @@ public:
 
     /// security settings for peer connection
     Security::PeerOptions secure;
-    Security::ContextPtr sslContext;
+    Security::ContextPointer sslContext;
     Security::SessionStatePointer sslSession;
 
     int front_end_https;

diff --git a/src/SquidConfig.h b/src/SquidConfig.h
index 3ee1247898635fee35804dda90ac466d4aaefbe3..90eacd6bb1b77d1ace9f3b25e5c454f9e18bcc02 100644 (file)
--- a/src/SquidConfig.h
+++ b/src/SquidConfig.h
@@ -505,7 +505,7 @@ public:
     external_acl *externalAclHelperList;
 
     struct {
-        Security::ContextPtr sslContext;
+        Security::ContextPointer sslContext;
 #if USE_OPENSSL
         char *foreignIntermediateCertsPath;
         acl_access *cert_error;

diff --git a/src/adaptation/icap/ServiceRep.cc b/src/adaptation/icap/ServiceRep.cc
index 14996a7fa8226e92bd305353b4c7c8cfc97df78d..ef19473d1198f4ca8f828320f522f4e0e5c8d177 100644 (file)
--- a/src/adaptation/icap/ServiceRep.cc
+++ b/src/adaptation/icap/ServiceRep.cc
@@ -33,7 +33,6 @@ CBDATA_NAMESPACED_CLASS_INIT(Adaptation::Icap, ServiceRep);
 
 Adaptation::Icap::ServiceRep::ServiceRep(const ServiceConfigPointer &svcCfg):
     AsyncJob("Adaptation::Icap::ServiceRep"), Adaptation::Service(svcCfg),
-    sslContext(NULL),
     theOptions(NULL), theOptionsFetcher(0), theLastUpdate(0),
     theBusyConns(0),
     theAllWaiters(0),

diff --git a/src/adaptation/icap/ServiceRep.h b/src/adaptation/icap/ServiceRep.h
index 579bfbd574f84126b97d6f65493cf09c717a5bfc..e8a0838e287f419a8d7c7687ff44c3eced024820 100644 (file)
--- a/src/adaptation/icap/ServiceRep.h
+++ b/src/adaptation/icap/ServiceRep.h
@@ -110,7 +110,7 @@ public: // treat these as private, they are for callbacks only
     // receive either an ICAP OPTIONS response header or an abort message
     virtual void noteAdaptationAnswer(const Answer &answer);
 
-    Security::ContextPtr sslContext;
+    Security::ContextPointer sslContext;
     Security::SessionStatePointer sslSession;
 
 private:

diff --git a/src/adaptation/icap/Xaction.cc b/src/adaptation/icap/Xaction.cc
index 74b03938e371e66460d008655c8731168cf02089..7b8ed668c445a2b512c3aa5876b4b16382882b55 100644 (file)
--- a/src/adaptation/icap/Xaction.cc
+++ b/src/adaptation/icap/Xaction.cc
@@ -64,7 +64,9 @@ public:
     /* Security::PeerConnector API */
     virtual bool initialize(Security::SessionPointer &);
     virtual void noteNegotiationDone(ErrorState *error);
-    virtual Security::ContextPtr getSslContext() {return icapService->sslContext;}
+    virtual Security::ContextPtr getSslContext() {
+        return icapService->sslContext.get();
+    }
 
 private:
     Adaptation::Icap::ServiceRep::Pointer icapService;

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 3a6a76a95e7b2be7b3ecbb05271ecaae3acfd2bc..7c094473e4270bc1e000ba1439f636085cc4229c 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -880,7 +880,7 @@ configDoConfigure(void)
 #endif
         }
 #if USE_OPENSSL
-        Ssl::useSquidUntrusted(Config.ssl_client.sslContext);
+        Ssl::useSquidUntrusted(Config.ssl_client.sslContext.get());
 #endif
     }
 
@@ -3903,8 +3903,8 @@ void
 configFreeMemory(void)
 {
     free_all();
+    Config.ssl_client.sslContext.reset();
 #if USE_OPENSSL
-    SSL_CTX_free(Config.ssl_client.sslContext);
     Ssl::unloadSquidUntrusted();
 #endif
 }

diff --git a/src/icmp/Makefile.am b/src/icmp/Makefile.am
index 685ea87d839d8ce6b68e260b8f3796e9b88a1470..b6cc6d224256339f58f2811d64512069322ccb74 100644 (file)
--- a/src/icmp/Makefile.am
+++ b/src/icmp/Makefile.am
@@ -67,6 +67,7 @@ pinger_LDADD=\
        $(top_builddir)/src/ip/libip.la \
        $(top_builddir)/src/base/libbase.la \
        $(COMPAT_LIB) \
+       $(SSLLIB) \
        $(XTRA_LIBS)
 
 CLEANFILES += $(COPIED_SOURCE)

diff --git a/src/security/BlindPeerConnector.cc b/src/security/BlindPeerConnector.cc
index 578e0e18cd5ef516d3c179af7313113fd662e937..136f5a23eea682b7cf6cb26560091101c279a586 100644 (file)
--- a/src/security/BlindPeerConnector.cc
+++ b/src/security/BlindPeerConnector.cc
@@ -24,10 +24,9 @@ Security::BlindPeerConnector::getSslContext()
 {
     if (const CachePeer *peer = serverConnection()->getPeer()) {
         assert(peer->secure.encryptTransport);
-        Security::ContextPtr sslContext(peer->sslContext);
-        return sslContext;
+        return peer->sslContext.get();
     }
-    return ::Config.ssl_client.sslContext;
+    return ::Config.ssl_client.sslContext.get();
 }
 
 bool

diff --git a/src/security/PeerOptions.cc b/src/security/PeerOptions.cc
index c0a9a1814769ae973fb521b9c0d4ac85ca70cebb..53247611f8168c1319d06de4e08a2e8d42a692e4 100644 (file)
--- a/src/security/PeerOptions.cc
+++ b/src/security/PeerOptions.cc
@@ -249,12 +249,12 @@ Security::PeerOptions::createBlankContext() const
     return ctx;
 }
 
-Security::ContextPtr
+Security::ContextPointer
 Security::PeerOptions::createClientContext(bool setOptions)
 {
     updateTlsVersionLimits();
 
-    Security::ContextPointer t = createBlankContext();
+    Security::ContextPointer t(createBlankContext());
     if (t) {
 #if USE_OPENSSL
         // XXX: temporary performance regression. c_str() data copies and prevents this being a const method
@@ -265,7 +265,7 @@ Security::PeerOptions::createClientContext(bool setOptions)
         updateContextCrl(t.get());
     }
 
-    return t.release();
+    return t;
 }
 
 /// set of options we can parse and what they map to

diff --git a/src/security/PeerOptions.h b/src/security/PeerOptions.h
index 5543355a8989aafc851cf8f3295471e18c759bdb..bd9e2a7692e494a41f090cb8beccc1a87a22f842 100644 (file)
--- a/src/security/PeerOptions.h
+++ b/src/security/PeerOptions.h
@@ -36,7 +36,7 @@ public:
     virtual Security::ContextPointer createBlankContext() const;
 
     /// generate a security client-context from these configured options
-    Security::ContextPtr createClientContext(bool setOptions);
+    Security::ContextPointer createClientContext(bool setOptions);
 
     /// sync the context options with tls-min-version=N configuration
     void updateTlsVersionLimits();

diff --git a/src/ssl/PeekingPeerConnector.cc b/src/ssl/PeekingPeerConnector.cc
index e86616820649762943079c25307e3b926a2d78d0..2a8f985b22548ad637017ab4167b3417a93f30d6 100644 (file)
--- a/src/ssl/PeekingPeerConnector.cc
+++ b/src/ssl/PeekingPeerConnector.cc
@@ -129,8 +129,7 @@ Ssl::PeekingPeerConnector::checkForPeekAndSpliceGuess() const
 Security::ContextPtr
 Ssl::PeekingPeerConnector::getSslContext()
 {
-    // XXX: locate a per-server context in Security:: instead
-    return ::Config.ssl_client.sslContext;
+    return ::Config.ssl_client.sslContext.get();
 }
 
 bool

diff --git a/src/tests/stub_libsecurity.cc b/src/tests/stub_libsecurity.cc
index 4a84987832812ce498b4e846734ceca2ad938b4b..0ec8d2262e7b90ba1782aeec9c050624d37a3dd0 100644 (file)
--- a/src/tests/stub_libsecurity.cc
+++ b/src/tests/stub_libsecurity.cc
@@ -69,7 +69,7 @@ void PeerConnector::recordNegotiationDetails() STUB
 #include "security/PeerOptions.h"
 Security::PeerOptions Security::ProxyOutgoingConfig;
 void Security::PeerOptions::parse(char const*) STUB
-Security::ContextPtr Security::PeerOptions::createClientContext(bool) STUB_RETVAL(NULL)
+Security::ContextPointer Security::PeerOptions::createClientContext(bool) STUB_RETVAL(Security::ContextPointer())
 void Security::PeerOptions::updateTlsVersionLimits() STUB
 Security::ContextPointer Security::PeerOptions::createBlankContext() const STUB_RETVAL(Security::ContextPointer())
 void Security::PeerOptions::updateContextCa(Security::ContextPtr) STUB