Merged revisions 205120 via svnmerge from

https://origsvn.digium.com/svn/asterisk/trunk

........
  r205120 | russell | 2009-07-08 10:17:19 -0500 (Wed, 08 Jul 2009) | 16 lines

  Move OpenSSL initialization to a single place, make library usage thread-safe.

  While doing some reading about OpenSSL, I noticed a couple of things that
  needed to be improved with our usage of OpenSSL.

  1) We had initialization of the library done in multiple modules.  This has now
     been moved to a core function that gets executed during Asterisk startup.
     We already link OpenSSL into the core for TCP/TLS functionality, so this
     was the most logical place to do it.

  2) OpenSSL is not thread-safe by default.  However, making it thread safe is
     very easy.  We just have to provide a couple of callbacks.  One callback
     returns a thread ID.  The other handles locking.  For more information,
     start with the "Is OpenSSL thread-safe?" question on the FAQ page of
     openssl.org.
........

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.1@205147 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/_private.h b/include/asterisk/_private.h
index ee46e6ce0cd1fdd15afa20bedefa06ef431416f0..0ac0bda504264f5f36ec9ea26375d578408a0394 100644 (file)
--- a/include/asterisk/_private.h
+++ b/include/asterisk/_private.h
@@ -38,6 +38,7 @@ int ast_http_init(void);              /*!< Provided by http.c */
 int ast_http_reload(void);             /*!< Provided by http.c */
 int ast_tps_init(void);                /*!< Provided by taskprocessor.c */
 int ast_timing_init(void);             /*!< Provided by timing.c */
+int ast_ssl_init(void);                 /*!< Porvided by ssl.c */
 
 /*!
  * \brief Reload asterisk modules.

diff --git a/main/Makefile b/main/Makefile
index 485d1b7031bc8ae9bd1eba84df2f5744898da991..bf0cf49bb23257ef9a44a61c6d3d742950b37ad5 100644 (file)
--- a/main/Makefile
+++ b/main/Makefile
@@ -28,7 +28,7 @@ OBJS= tcptls.o io.o sched.o logger.o frame.o loader.o config.o channel.o \
        cryptostub.o sha1.o http.o fixedjitterbuf.o abstract_jb.o \
        strcompat.o threadstorage.o dial.o event.o adsistub.o audiohook.o \
        astobj2.o hashtab.o global_datastores.o version.o \
-       features.o taskprocessor.o timing.o datastore.o poll.o
+       features.o taskprocessor.o timing.o datastore.o poll.o ssl.o
 
 # we need to link in the objects statically, not as a library, because
 # otherwise modules will not have them available if none of the static

diff --git a/main/asterisk.c b/main/asterisk.c
index 1ae468ceca43181f794b6e1516ccec81e8d3cfd0..057370766c762355708598fa752b324ee900b751 100644 (file)
--- a/main/asterisk.c
+++ b/main/asterisk.c
@@ -3414,6 +3414,11 @@ int main(int argc, char *argv[])
                exit(1);
        }
 
+       if (ast_ssl_init()) {
+               printf("%s", term_quit());
+               exit(1);
+       }
+
        if (load_modules(1)) {          /* Load modules, pre-load only */
                printf("%s", term_quit());
                exit(1);

diff --git a/main/ssl.c b/main/ssl.c
new file mode 100644 (file)
index 0000000..4f039c4
--- /dev/null
+++ b/main/ssl.c
@@ -0,0 +1,100 @@
+/*
+ * Asterisk -- An open source telephony toolkit.
+ *
+ * Copyright (C) 2009, Digium, Inc.
+ *
+ * Russell Bryant <russell@digium.com>
+ *
+ * See http://www.asterisk.org for more information about
+ * the Asterisk project. Please do not directly contact
+ * any of the maintainers of this project for assistance;
+ * the project provides a web site, mailing lists and IRC
+ * channels for your use.
+ *
+ * This program is free software, distributed under the terms of
+ * the GNU General Public License Version 2. See the LICENSE file
+ * at the top of the source tree.
+ */
+
+/*! 
+ * \file
+ * \brief Common OpenSSL support code
+ *
+ * \author Russell Bryant <russell@digium.com>
+ */
+
+#include "asterisk.h"
+
+ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
+
+#ifdef HAVE_OPENSSL
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#endif
+
+#include "asterisk/_private.h" /* ast_ssl_init() */
+
+#include "asterisk/utils.h"
+#include "asterisk/lock.h"
+
+#ifdef HAVE_OPENSSL
+
+static ast_mutex_t *ssl_locks;
+
+static int ssl_num_locks;
+
+static unsigned long ssl_threadid(void)
+{
+        return pthread_self();
+}
+
+static void ssl_lock(int mode, int n, const char *file, int line)
+{
+        if (n < 0 || n >= ssl_num_locks) {
+                ast_log(LOG_ERROR, "OpenSSL is full of LIES!!! - "
+                               "ssl_num_locks '%d' - n '%d'\n",
+                                ssl_num_locks, n);
+                return;
+        }
+
+        if (mode & CRYPTO_LOCK) {
+                ast_mutex_lock(&ssl_locks[n]);
+        } else {
+                ast_mutex_unlock(&ssl_locks[n]);
+        }
+}
+
+#endif /* HAVE_OPENSSL */
+
+/*!
+ * \internal
+ * \brief Common OpenSSL initialization for all of Asterisk.
+ */
+int ast_ssl_init(void)
+{
+#ifdef HAVE_OPENSSL
+        unsigned int i;
+
+        SSL_library_init();
+        SSL_load_error_strings();
+        ERR_load_crypto_strings();
+        ERR_load_BIO_strings();
+        OpenSSL_add_all_algorithms();
+
+        /* Make OpenSSL thread-safe. */
+
+        CRYPTO_set_id_callback(ssl_threadid);
+
+        ssl_num_locks = CRYPTO_num_locks();
+        if (!(ssl_locks = ast_calloc(ssl_num_locks, sizeof(ssl_locks[0])))) {
+                return -1;
+        }
+        for (i = 0; i < ssl_num_locks; i++) {
+                ast_mutex_init(&ssl_locks[i]);
+        }
+        CRYPTO_set_locking_callback(ssl_lock);
+
+#endif /* HAVE_OPENSSL */
+        return 0;
+}
+

diff --git a/res/res_crypto.c b/res/res_crypto.c
index e55abe891ce4da325bf7160a0f56d5121973e8ba..1a779968fa623dfd12f45adcd9444c4ba66cbdba 100644 (file)
--- a/res/res_crypto.c
+++ b/res/res_crypto.c
@@ -585,8 +585,6 @@ static struct ast_cli_entry cli_crypto[] = {
 /*! \brief initialise the res_crypto module */
 static int crypto_init(void)
 {
-       SSL_library_init();
-       ERR_load_crypto_strings();
        ast_cli_register_multiple(cli_crypto, sizeof(cli_crypto) / sizeof(struct ast_cli_entry));
 
        /* Install ourselves into stubs */

diff --git a/res/res_jabber.c b/res/res_jabber.c
index b8fd910282d7b6632c569c6e088cc0b5ec70ddef..7ff899240cbd6f50e7bb98209d0abcd3dbfa247a 100644 (file)
--- a/res/res_jabber.c
+++ b/res/res_jabber.c
@@ -541,10 +541,6 @@ static int aji_tls_handshake(struct aji_client *client)
        
        ast_debug(1, "Starting TLS handshake\n"); 
 
-       /* Load encryption, hashing algorithms and error strings */
-       SSL_library_init();
-       SSL_load_error_strings();
-
        /* Choose an SSL/TLS protocol version, create SSL_CTX */
        client->ssl_method = SSLv3_method();
        client->ssl_context = SSL_CTX_new(client->ssl_method);