Shuffle cache_peer ssl*= options to libsecurity

diff --git a/src/CachePeer.h b/src/CachePeer.h
index 12033dc23fad92af9747f5457a6ea9766c053f9b..66232de6b7ef22b70ad3bd368f35ab8d6f0edb84 100644 (file)
--- a/src/CachePeer.h
+++ b/src/CachePeer.h
@@ -184,16 +184,6 @@ public:
     Security::PeerOptions secure;
 
 #if USE_OPENSSL
-    char *sslcert;
-    char *sslkey;
-    int sslversion;
-    char *ssloptions;
-    char *sslcipher;
-    char *sslcafile;
-    char *sslcapath;
-    char *sslcrlfile;
-    char *sslflags;
-    char *ssldomain;
     SSL_CTX *sslContext;
     SSL_SESSION *sslSession;
 #endif

diff --git a/src/Makefile.am b/src/Makefile.am
index ab124bd4c1b1d68bd341d6974d8eaff7c1610837..c83c20efb80f930379318f47b0da37e9bb9e87a7 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -643,6 +643,7 @@ squid_LDADD = \
        $(ESI_LIBS) \
        $(SNMP_LIBS) \
        parser/libsquid-parser.la \
+       security/libsecurity.la \
        $(top_builddir)/lib/libmisccontainers.la \
        $(top_builddir)/lib/libmiscencoding.la \
        $(top_builddir)/lib/libmiscutil.la \
@@ -1496,6 +1497,7 @@ tests_testCacheManager_SOURCES = \
        int.cc \
        internal.h \
        internal.cc \
+       tests/stub_libsecurity.cc \
        SquidList.h \
        SquidList.cc \
        MasterXaction.cc \
@@ -1920,6 +1922,7 @@ tests_testEvent_SOURCES = \
        int.cc \
        internal.h \
        internal.cc \
+       tests/stub_libsecurity.cc \
        SquidList.h \
        SquidList.cc \
        MasterXaction.cc \
@@ -2168,6 +2171,7 @@ tests_testEventLoop_SOURCES = \
        int.cc \
        internal.h \
        internal.cc \
+       tests/stub_libsecurity.cc \
        SquidList.h \
        SquidList.cc \
        MasterXaction.cc \
@@ -2412,6 +2416,7 @@ tests_test_http_range_SOURCES = \
        internal.cc \
        $(IPC_SOURCE) \
        ipcache.cc \
+       tests/stub_libsecurity.cc \
        SquidList.h \
        SquidList.cc \
        MasterXaction.cc \
@@ -2710,6 +2715,7 @@ tests_testHttpRequest_SOURCES = \
        int.cc \
        internal.h \
        internal.cc \
+       tests/stub_libsecurity.cc \
        SquidList.h \
        SquidList.cc \
        MasterXaction.cc \
@@ -3536,6 +3542,7 @@ tests_testURL_SOURCES = \
        int.cc \
        internal.h \
        internal.cc \
+       tests/stub_libsecurity.cc \
        SquidList.h \
        SquidList.cc \
        MasterXaction.cc \

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 1d47e53b9a166b7ac367ed20ab0064a3a438b3c1..74c60b5b4e28e8b338f6454e6e77948db6801a4f 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -886,7 +886,7 @@ configDoConfigure(void)
     for (CachePeer *p = Config.peers; p != NULL; p = p->next) {
         if (p->secure.ssl) {
             debugs(3, DBG_IMPORTANT, "Initializing cache_peer " << p->name << " SSL context");
-            p->sslContext = sslCreateClientContext(p->sslcert, p->sslkey, p->sslversion, p->sslcipher, p->ssloptions, p->sslflags, p->sslcafile, p->sslcapath, p->sslcrlfile);
+            p->sslContext = p->secure.createContext();
         }
     }
 
@@ -2236,7 +2236,6 @@ parse_peer(CachePeer ** head)
                 p->name = xstrdup(token + 5);
         } else if (!strncmp(token, "forceddomain=", 13)) {
             safe_free(p->domain);
-
             if (token[13])
                 p->domain = xstrdup(token + 13);
 
@@ -2247,44 +2246,32 @@ parse_peer(CachePeer ** head)
             p->secure.ssl = true;
 
         if (strncmp(token, "sslcert=", 8) == 0) {
-            safe_free(p->sslcert);
-            p->sslcert = xstrdup(token + 8);
+            p->secure.certFile = SBuf(token + 8);
         } else if (strncmp(token, "sslkey=", 7) == 0) {
-            safe_free(p->sslkey);
-            p->sslkey = xstrdup(token + 7);
+            p->secure.privateKeyFile = SBuf(token + 7);
+            if (p->secure.certFile.isEmpty()) {
+                debugs(0, DBG_PARSE_NOTE(1), "WARNING: cache_peer 'sslcert=' option needs to be set before 'sslkey=' is used.");
+                p->secure.certFile = p->secure.privateKeyFile;
+            }
         } else if (strncmp(token, "sslversion=", 11) == 0) {
-            p->sslversion = xatoi(token + 11);
+            p->secure.sslVersion = xatoi(token + 11);
         } else if (strncmp(token, "ssloptions=", 11) == 0) {
-            safe_free(p->ssloptions);
-            p->ssloptions = xstrdup(token + 11);
+            p->secure.sslOptions = SBuf(token + 11);
         } else if (strncmp(token, "sslcipher=", 10) == 0) {
-            safe_free(p->sslcipher);
-            p->sslcipher = xstrdup(token + 10);
+            p->secure.sslCipher = SBuf(token + 10);
         } else if (strncmp(token, "sslcafile=", 10) == 0) {
-            safe_free(p->sslcafile);
-            p->sslcafile = xstrdup(token + 10);
+            p->secure.caFile = SBuf(token + 10);
         } else if (strncmp(token, "sslcapath=", 10) == 0) {
-            safe_free(p->sslcafile);
-            p->sslcafile = xstrdup(token + 10);
+            p->secure.caDir = SBuf(token + 10);
         } else if (strncmp(token, "sslcrlfile=", 11) == 0) {
-            safe_free(p->sslcrlfile);
-            p->sslcrlfile = xstrdup(token + 11);
+            p->secure.crlFile = SBuf(token + 11);
         } else if (strncmp(token, "sslflags=", 9) == 0) {
-            safe_free(p->sslflags);
-            p->sslflags = xstrdup(token + 9);
+            p->secure.sslFlags = SBuf(token + 9);
         } else if (strncmp(token, "ssldomain=", 10) == 0) {
-            safe_free(p->ssldomain);
-            p->ssldomain = xstrdup(token + 10);
+            p->secure.sslDomain = SBuf(token + 10);
         }
 #endif
 
-        } else if (strncmp(token, "tls", 3) == 0) {
-#if !USE_GNUTLS && !USE_OPENSSL
-            debugs(0, DBG_CRITICAL, "WARNING: cache_peer option '" << token << "' requires --with-gnutls or --with-openssl");
-#else
-            p->secure.tls = true;
-#endif
-
         } else if (strcmp(token, "front-end-https") == 0) {
             p->front_end_https = 1;
         } else if (strcmp(token, "front-end-https=on") == 0) {

diff --git a/src/security/Context.h b/src/security/Context.h
new file mode 100644 (file)
index 0000000..8aef5a7
--- /dev/null
+++ b/src/security/Context.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#ifndef SQUID_SRC_SECURITY_CONTEXT_H
+#define SQUID_SRC_SECURITY_CONTEXT_H
+
+#if USE_OPENSSL
+#include "ssl/gadgets.h"
+#endif
+
+namespace Security {
+
+#if USE_OPENSSL
+// XXX: make this a SSL_CTX_Pointer
+typedef SSL_CTX* ContextPointer;
+
+#else
+// use void* so we can check against NULL
+typedef void* ContextPointer;
+#endif
+
+} // namespace Security
+
+#endif /* SQUID_SRC_SECURITY_CONTEXT_H */

diff --git a/src/security/Makefile.am b/src/security/Makefile.am
index 6ed2aa71732c3445b857a60ca795a893838d7604..6876db9c0051efb8cb592e0b67ee2ec3dd95549b 100644 (file)
--- a/src/security/Makefile.am
+++ b/src/security/Makefile.am
@@ -1,7 +1,16 @@
+## Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+##
+## Squid software is distributed under GPLv2+ license and includes
+## contributions from numerous individuals and organizations.
+## Please see the COPYING and CONTRIBUTORS files for details.
+##
+
 include $(top_srcdir)/src/Common.am
 include $(top_srcdir)/src/TestHeaders.am
 
 noinst_LTLIBRARIES = libsecurity.la
 
 libsecurity_la_SOURCES= \
+       Context.h \
+       PeerOptions.cc \
        PeerOptions.h

diff --git a/src/security/PeerOptions.cc b/src/security/PeerOptions.cc
new file mode 100644 (file)
index 0000000..8f989a2
--- /dev/null
+++ b/src/security/PeerOptions.cc
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#include "squid.h"
+#include "security/PeerOptions.h"
+
+#if USE_OPENSSL
+#include "ssl/support.h"
+#endif
+
+// XXX: make a GnuTLS variant
+Security::ContextPointer
+Security::PeerOptions::createContext()
+{
+    Security::ContextPointer t = NULL;
+
+    if (privateKeyFile.isEmpty())
+        privateKeyFile = certFile;
+
+#if USE_OPENSSL
+    t = sslCreateClientContext(certFile.c_str(), privateKeyFile.c_str(), sslVersion, sslCipher.c_str(),
+                           sslOptions.c_str(), sslFlags.c_str(), caFile.c_str(), caDir.c_str(), crlFile.c_str());
+#endif
+    return t;
+}

diff --git a/src/security/PeerOptions.h b/src/security/PeerOptions.h
index 25a67d85385844112c00ebf2e969aabe374b7fc9..fba2758a043ef8271e0720a6eb943a6785313b0d 100644 (file)
--- a/src/security/PeerOptions.h
+++ b/src/security/PeerOptions.h
@@ -1,7 +1,16 @@
+/*
+ * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
 #ifndef SQUID_SRC_SECURITY_PEEROPTIONS_H
 #define SQUID_SRC_SECURITY_PEEROPTIONS_H
 
 #include "SBuf.h"
+#include "security/Context.h"
 
 namespace Security
 {
@@ -9,10 +18,24 @@ namespace Security
 class PeerOptions
 {
 public:
-    PeerOptions() : tls(false), ssl(false) {}
+    PeerOptions() : ssl(false), sslVersion(0) {}
+
+    /// generate a security context from the configured options
+    Security::ContextPointer createContext();
 
-    bool tls;   ///< whether TLS is to be used on this connection
     bool ssl;   ///< whether SSL is to be used on this connection
+
+    SBuf certFile;       ///< path of file containing PEM format X509 certificate
+    SBuf privateKeyFile; ///< path of file containing private key in PEM format
+    SBuf sslOptions;     ///< library-specific options string
+    SBuf caFile;         ///< path of file containing trusted Certificate Authority
+    SBuf caDir;          ///< path of directory containign a set of trusted Certificate Authorities
+    SBuf crlFile;        ///< path of file containing Certificate Revoke List
+
+    int sslVersion;
+    SBuf sslCipher;
+    SBuf sslFlags;
+    SBuf sslDomain;
 };
 
 } // namespace Security

diff --git a/src/ssl/PeerConnector.cc b/src/ssl/PeerConnector.cc
index 7ddae4e21712230ad93f95ec7f3c15fc3e2a914c..0ae5b4b610e293c597b8aa24ad898690fa2e3a30 100644 (file)
--- a/src/ssl/PeerConnector.cc
+++ b/src/ssl/PeerConnector.cc
@@ -129,18 +129,20 @@ Ssl::PeerConnector::initializeSsl()
     }
 
     if (peer) {
-        if (peer->ssldomain)
-            SSL_set_ex_data(ssl, ssl_ex_index_server, peer->ssldomain);
-
+        if (!peer->secure.sslDomain.isEmpty()) {
+            // const loss is okay here, ssl_ex_index_server is only read and not assigned a destructor
+            SSL_set_ex_data(ssl, ssl_ex_index_server, const_cast<SBuf*>(&peer->secure.sslDomain));
+        }
 #if NOT_YET
 
         else if (peer->name)
             SSL_set_ex_data(ssl, ssl_ex_index_server, peer->name);
 
 #endif
-
+#if WHEN_PEER_HOST_IS_SBUF
         else
             SSL_set_ex_data(ssl, ssl_ex_index_server, peer->host);
+#endif
 
         if (peer->sslSession)
             SSL_set_session(ssl, peer->sslSession);

diff --git a/src/tests/stub_libsecurity.cc b/src/tests/stub_libsecurity.cc
new file mode 100644 (file)
index 0000000..a6b586f
--- /dev/null
+++ b/src/tests/stub_libsecurity.cc
@@ -0,0 +1,15 @@
+/*
+ * Copyright (C) 1996-2014 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#include "squid.h"
+
+#define STUB_API "security/libsecurity.la"
+#include "tests/STUB.h"
+
+#include "security/PeerOptions.h"
+Security::ContextPointer Security::PeerOptions::createContext() STUB_RETVAL(NULL)