Cleanup: add Security::ContextPointer as smart pointer to SSL_CTX*

Due to circular dependency issues between ssl/libsquidssl.la and
security/libsecurity.la the code within src/ssl/ is restricted to
only using Security::ContextPtr, it MUST NOT use ContextPointer

Code outside of src/ssl/ should always use Security::ContextPointer
when storing a reference to a context.

Unfortunately some uses of SSL_CTX_Pointer and AnyP::PortCfg remain
in src/ssl/support.cc for now.

diff --git a/configure.ac b/configure.ac
index 206f36861967e54a13673728a7b1f4a8ffcffd9b..612d26391a75455e51d14373698845843ce8fdf7 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1288,6 +1288,7 @@ AH_TEMPLATE(USE_OPENSSL,[OpenSSL support is available])
 if test "x$with_openssl" = "xyes"; then
   AC_CHECK_HEADERS( \
     openssl/bio.h \
+    openssl/crypto.h \
     openssl/err.h \
     openssl/md5.h \
     openssl/opensslv.h \

diff --git a/src/anyp/PortCfg.h b/src/anyp/PortCfg.h
index 38483b9cf105e22ddacefcd293c0f462dd84314a..dcdcc597e2425e4fbfe9263b890ab61e026c40d9 100644 (file)
--- a/src/anyp/PortCfg.h
+++ b/src/anyp/PortCfg.h
@@ -78,7 +78,7 @@ public:
     bool generateHostCertificates; ///< dynamically make host cert for sslBump
     size_t dynamicCertMemCacheSize; ///< max size of generated certificates memory cache
 
-    Ssl::SSL_CTX_Pointer staticSslContext; ///< for HTTPS accelerator or static sslBump
+    Security::ContextPointer staticSslContext; ///< for HTTPS accelerator or static sslBump
     Security::CertPointer signingCert; ///< x509 certificate for signing generated certificates
     Ssl::EVP_PKEY_Pointer signPkey; ///< private key for sighing generated certificates
     Ssl::X509_STACK_Pointer certsToChain; ///<  x509 certificates to send with the generated cert

diff --git a/src/security/Context.h b/src/security/Context.h
index 0aaa366b9cae5b269b6fb2efc8a74c0e3d32ff8a..ffb2188ba1437c1c0613ca819317d280566dae24 100644 (file)
--- a/src/security/Context.h
+++ b/src/security/Context.h
@@ -9,13 +9,14 @@
 #ifndef SQUID_SRC_SECURITY_CONTEXT_H
 #define SQUID_SRC_SECURITY_CONTEXT_H
 
+#include "security/LockingPointer.h"
+
 #if USE_OPENSSL
 #if HAVE_OPENSSL_SSL_H
 #include <openssl/ssl.h>
 #endif
-#endif
 
-#if USE_GNUTLS
+#elif USE_GNUTLS
 #if HAVE_GNUTLS_GNUTLS_H
 #include <gnutls/gnutls.h>
 #endif
@@ -23,15 +24,29 @@
 
 namespace Security {
 
+/* IMPORTANT:
+ * Due to circular dependency issues between ssl/libsquidssl.la and
+ * security/libsecurity.la the code within src/ssl/ is restricted to
+ * only using Security::ContextPtr, it MUST NOT use ContextPointer
+ *
+ * Code outside of src/ssl/ should always use Security::ContextPointer
+ * when storing a reference to a context.
+ */
 #if USE_OPENSSL
 typedef SSL_CTX* ContextPtr;
+CtoCpp1(SSL_CTX_free, SSL_CTX *);
+typedef LockingPointer<SSL_CTX, SSL_CTX_free_cpp, CRYPTO_LOCK_SSL_CTX> ContextPointer;
 
 #elif USE_GNUTLS
 typedef gnutls_certificate_credentials_t ContextPtr;
+CtoCpp1(gnutls_certificate_free_credentials, gnutls_certificate_credentials_t);
+typedef Security::LockingPointer<struct gnutls_certificate_credentials_st, gnutls_certificate_free_credentials_cpp, -1> ContextPointer;
 
 #else
 // use void* so we can check against nullptr
 typedef void* ContextPtr;
+typedef Security::LockingPointer<void, nullptr, -1> ContextPointer;
+
 #endif
 
 } // namespace Security

diff --git a/src/security/LockingPointer.h b/src/security/LockingPointer.h
index 49c1a297fde546e42909b7cfd68b5f4a67c82b26..74417f0d9cf0bb704c14ddae65028f6d97a449fb 100644 (file)
--- a/src/security/LockingPointer.h
+++ b/src/security/LockingPointer.h
@@ -11,6 +11,28 @@
 
 #include "base/TidyPointer.h"
 
+#if USE_OPENSSL
+#if HAVE_OPENSSL_CRYPTO_H
+#include <openssl/crypto.h>
+#endif
+
+// Macro to be used to define the C++ wrapper function of a sk_*_pop_free
+// openssl family functions. The C++ function suffixed with the _free_wrapper
+// extension
+#define sk_free_wrapper(sk_object, argument, freefunction) \
+        extern "C++" inline void sk_object ## _free_wrapper(argument a) { \
+            sk_object ## _pop_free(a, freefunction); \
+        }
+
+#endif
+
+// Macro to be used to define the C++ equivalent function of an extern "C"
+// function. The C++ function suffixed with the _cpp extension
+#define CtoCpp1(function, argument) \
+        extern "C++" inline void function ## _cpp(argument a) { \
+            function(a); \
+        }
+
 namespace Security
 {
 

diff --git a/src/security/forward.h b/src/security/forward.h
index 9286f836dc3b4c9668e18752263b4ae19be19e7d..63da96595899c07b644baa2f009b1e2ec6ff7e3e 100644 (file)
--- a/src/security/forward.h
+++ b/src/security/forward.h
@@ -10,7 +10,6 @@
 #define SQUID_SRC_SECURITY_FORWARD_H
 
 #include "security/Context.h"
-#include "security/LockingPointer.h"
 #include "security/Session.h"
 
 #if USE_GNUTLS
@@ -29,23 +28,6 @@
 #define SSL_FLAG_VERIFY_CRL         (1<<5)
 #define SSL_FLAG_VERIFY_CRL_ALL     (1<<6)
 
-// Macro to be used to define the C++ equivalent function of an extern "C"
-// function. The C++ function suffixed with the _cpp extension
-#define CtoCpp1(function, argument) \
-        extern "C++" inline void function ## _cpp(argument a) { \
-            function(a); \
-        }
-
-#if USE_OPENSSL
-// Macro to be used to define the C++ wrapper function of a sk_*_pop_free
-// openssl family functions. The C++ function suffixed with the _free_wrapper
-// extension
-#define sk_free_wrapper(sk_object, argument, freefunction) \
-        extern "C++" inline void sk_object ## _free_wrapper(argument a) { \
-            sk_object ## _pop_free(a, freefunction); \
-        }
-#endif
-
 /// Network/connection security abstraction layer
 namespace Security
 {