From: Arran Cudbard-Bell Date: Sun, 5 Nov 2017 11:29:10 +0000 (+0000) Subject: Move tls support functions into their own library X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5daf5e090f77d9d8d69b0ea631144e81da18d4fa;p=thirdparty%2Ffreeradius-server.git Move tls support functions into their own library --- diff --git a/Make.inc.in b/Make.inc.in index 2a880218f4d..c877b96167f 100644 --- a/Make.inc.in +++ b/Make.inc.in @@ -133,10 +133,15 @@ MODULES = @MODULES@ # We don't use OpenSSL SHA1 by default because src/modules/rlm_eap/libeap/fips186prf.c # needs access to the SHA internals. # -ifeq "$(WITH_OPENSSL)" "yes" -CFLAGS += -DWITH_OPENSSL_MD4 -DWITH_OPENSSL_MD5 -CPPFLAGS := "$(OPENSSL_CPPFLAGS) $(CPPFLAGS)" +ifneq ($(OPENSSL_LIBS),) +CFLAGS += -DWITH_OPENSSL_MD4 -DWITH_OPENSSL_MD5 +CPPFLAGS := "$(OPENSSL_CPPFLAGS) $(CPPFLAGS)" +# +# Add optional dependency for libfreeradius-server if we're building with OpenSSL +# +LIBFREERADIUS_SERVER := libfreeradius-tls.a endif +LIBFREERADIUS_SERVER += libfreeradius-server.a OPENSSL_LIBS = @OPENSSL_LIBS@ diff --git a/src/include/libradius.h b/src/include/libradius.h index cdd8961f5c6..d5ec4ab825a 100644 --- a/src/include/libradius.h +++ b/src/include/libradius.h @@ -145,11 +145,6 @@ do { \ _p += _ret; \ } while (0) -extern uint32_t fr_max_attributes; /* per incoming packet */ -#define FR_MAX_PACKET_CODE (53) -extern char const *fr_packet_codes[FR_MAX_PACKET_CODE]; -#define is_radius_code(_x) ((_x > 0) && (_x < FR_MAX_PACKET_CODE)) - /* * Several handy miscellaneous functions. */ diff --git a/src/include/packet.h b/src/include/packet.h index 8627c7b6ed4..b076dd58623 100644 --- a/src/include/packet.h +++ b/src/include/packet.h @@ -101,7 +101,7 @@ bool fr_packet_list_socket_freeze(fr_packet_list_t *pl, int sockfd); bool fr_packet_list_socket_thaw(fr_packet_list_t *pl, int sockfd); int fr_packet_list_walk(fr_packet_list_t *pl, void *ctx, rb_walker_t callback); int fr_packet_list_fd_set(fr_packet_list_t *pl, fd_set *set); -RADIUS_PACKET *fr_packet_list_recv(fr_packet_list_t *pl, fd_set *set); +RADIUS_PACKET *fr_packet_list_recv(fr_packet_list_t *pl, fd_set *set, uint32_t max_attributes, bool require_ma); uint32_t fr_packet_list_num_incoming(fr_packet_list_t *pl); uint32_t fr_packet_list_num_outgoing(fr_packet_list_t *pl); diff --git a/src/include/tcp.h b/src/include/tcp.h index 7a09682103d..5f26c11597e 100644 --- a/src/include/tcp.h +++ b/src/include/tcp.h @@ -25,6 +25,6 @@ */ RCSIDH(tcp_h, "$Id$") -int fr_tcp_read_packet(RADIUS_PACKET *packet, bool require_ma); +int fr_tcp_read_packet(RADIUS_PACKET *packet, uint32_t max_attributes, bool require_ma); RADIUS_PACKET *fr_tcp_recv(int sockfd, int flags); #endif /* _FR_TCP_H */ diff --git a/src/lib/all.mk b/src/lib/all.mk index c339107b89a..75b12bd6a56 100644 --- a/src/lib/all.mk +++ b/src/lib/all.mk @@ -1 +1,5 @@ -SUBMAKEFILES := io/all.mk ldap/all.mk util/all.mk +SUBMAKEFILES := \ + io/all.mk \ + ldap/all.mk \ + tls/all.mk \ + util/all.mk diff --git a/src/lib/tls/all.mk b/src/lib/tls/all.mk new file mode 100644 index 00000000000..aa8427f2505 --- /dev/null +++ b/src/lib/tls/all.mk @@ -0,0 +1,22 @@ +TARGETNAME := libfreeradius-tls + +ifneq ($(OPENSSL_LIBS),) +TARGET := $(TARGETNAME).a +endif + +SOURCES := \ + cache.c \ + conf.c \ + ctx.c \ + global.c \ + log.c \ + ocsp.c \ + session.c \ + utils.c \ + validate.c + + +TGT_PREREQS := libfreeradius-util.la + +# This lets the linker determine which version of the SSLeay functions to use. +TGT_LDLIBS := $(LIBS) $(OPENSSL_LIBS) $(GPERFTOOLS_FLAGS) $(GPERFTOOLS_LIBS) diff --git a/src/main/tls/cache.c b/src/lib/tls/cache.c similarity index 100% rename from src/main/tls/cache.c rename to src/lib/tls/cache.c diff --git a/src/main/tls/conf.c b/src/lib/tls/conf.c similarity index 97% rename from src/main/tls/conf.c rename to src/lib/tls/conf.c index 945c85f9427..81a66dc1bd2 100644 --- a/src/main/tls/conf.c +++ b/src/lib/tls/conf.c @@ -322,12 +322,8 @@ fr_tls_conf_t *tls_conf_parse_server(CONF_SECTION *cs) if (conf_cert_admin_password(conf) < 0) goto error; #endif - if (!main_config.spawn_workers) { - conf->ctx_count = 1; - } else { - conf->ctx_count = fr_tls_max_threads * 2; /* Reduce contention */ - rad_assert(conf->ctx_count > 0); - } + conf->ctx_count = fr_tls_max_threads * 2; /* Reduce contention */ + if (!conf->ctx_count) conf->ctx_count = 1; /* * Initialize TLS @@ -440,12 +436,8 @@ fr_tls_conf_t *tls_conf_parse_client(CONF_SECTION *cs) /* * Initialize TLS */ - if (!main_config.spawn_workers) { - conf->ctx_count = 1; - } else { - conf->ctx_count = fr_tls_max_threads * 2; /* Even one context per thread will lead to contention */ - rad_assert(conf->ctx_count > 0); - } + conf->ctx_count = fr_tls_max_threads * 2; /* Even one context per thread will lead to contention */ + if (!conf->ctx_count) conf->ctx_count = 1; #ifdef __APPLE__ if (conf_cert_admin_password(conf) < 0) goto error; diff --git a/src/main/tls/ctx.c b/src/lib/tls/ctx.c similarity index 100% rename from src/main/tls/ctx.c rename to src/lib/tls/ctx.c diff --git a/src/main/tls/global.c b/src/lib/tls/global.c similarity index 100% rename from src/main/tls/global.c rename to src/lib/tls/global.c diff --git a/src/main/tls/log.c b/src/lib/tls/log.c similarity index 100% rename from src/main/tls/log.c rename to src/lib/tls/log.c diff --git a/src/main/tls/ocsp.c b/src/lib/tls/ocsp.c similarity index 100% rename from src/main/tls/ocsp.c rename to src/lib/tls/ocsp.c diff --git a/src/main/tls/session.c b/src/lib/tls/session.c similarity index 100% rename from src/main/tls/session.c rename to src/lib/tls/session.c diff --git a/src/main/tls/utils.c b/src/lib/tls/utils.c similarity index 100% rename from src/main/tls/utils.c rename to src/lib/tls/utils.c diff --git a/src/main/tls/validate.c b/src/lib/tls/validate.c similarity index 99% rename from src/main/tls/validate.c rename to src/lib/tls/validate.c index 46d66e51341..12ae7b7ac8c 100644 --- a/src/main/tls/validate.c +++ b/src/lib/tls/validate.c @@ -263,8 +263,7 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx) int fd; FILE *fp; - snprintf(filename, sizeof(filename), "%s/%s.client.XXXXXXXX", - conf->verify_tmp_dir, main_config.name); + snprintf(filename, sizeof(filename), "%s/client.XXXXXXXX", conf->verify_tmp_dir); #ifdef __COVERITY__ /* diff --git a/src/main/libfreeradius-server.mk b/src/main/libfreeradius-server.mk index 5408f81c7c8..1958ebfb66a 100644 --- a/src/main/libfreeradius-server.mk +++ b/src/main/libfreeradius-server.mk @@ -1,4 +1,4 @@ -TARGET := libfreeradius-server.a +TARGET := libfreeradius-server.a SOURCES := cond_eval.c \ cond_tokenize.c \ @@ -25,8 +25,8 @@ SOURCES := cond_eval.c \ xlat_tokenize.c # This lets the linker determine which version of the SSLeay functions to use. -TGT_LDLIBS := $(LIBS) $(OPENSSL_LIBS) $(GPERFTOOLS_FLAGS) $(GPERFTOOLS_LIBS) -TGT_PREREQS := libfreeradius-util.la libfreeradius-radius.a +TGT_LDLIBS := $(LIBS) $(OPENSSL_LIBS) $(GPERFTOOLS_FLAGS) $(GPERFTOOLS_LIBS) +TGT_PREREQS := libfreeradius-tls.la libfreeradius-util.la ifneq ($(MAKECMDGOALS),scan) SRC_CFLAGS += -DBUILT_WITH_CPPFLAGS=\"$(CPPFLAGS)\" -DBUILT_WITH_CFLAGS=\"$(CFLAGS)\" -DBUILT_WITH_LDFLAGS=\"$(LDFLAGS)\" -DBUILT_WITH_LIBS=\"$(LIBS)\" diff --git a/src/main/radiusd.mk b/src/main/radiusd.mk index bdf2961ed03..27736c7d50d 100644 --- a/src/main/radiusd.mk +++ b/src/main/radiusd.mk @@ -17,16 +17,12 @@ SOURCES := \ virtual_servers.c \ process.c -ifneq ($(OPENSSL_LIBS),) -include ${top_srcdir}/src/main/tls.mk -endif - SRC_CFLAGS := TGT_INSTALLDIR := ${sbindir} TGT_LDLIBS := $(LIBS) $(LCRYPT) $(SYSTEMD_LIBS) TGT_LDFLAGS := $(LDFLAGS) $(SYSTEMD_LDFLAGS) -TGT_PREREQS := libfreeradius-server.a libfreeradius-util.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a # Libraries can't depend on libraries (oops), so make the binary # depend on the EAP code... diff --git a/src/main/radmin.mk b/src/main/radmin.mk index 60043a52d7d..bbc00bbde30 100644 --- a/src/main/radmin.mk +++ b/src/main/radmin.mk @@ -7,5 +7,5 @@ endif SOURCES := radmin.c conduit.c TGT_INSTALLDIR := ${sbindir} -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a libfreeradius-server.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a TGT_LDLIBS := $(LIBS) $(LIBREADLINE) diff --git a/src/main/radwho.mk b/src/main/radwho.mk index 8e052d26d1b..247e2837c50 100644 --- a/src/main/radwho.mk +++ b/src/main/radwho.mk @@ -1,5 +1,5 @@ TARGET := radwho SOURCES := radwho.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a libfreeradius-server.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/main/tls.mk b/src/main/tls.mk deleted file mode 100644 index 82fba6aecf7..00000000000 --- a/src/main/tls.mk +++ /dev/null @@ -1,9 +0,0 @@ -SOURCES += ${top_srcdir}/src/main/tls/cache.c \ - ${top_srcdir}/src/main/tls/conf.c \ - ${top_srcdir}/src/main/tls/ctx.c \ - ${top_srcdir}/src/main/tls/global.c \ - ${top_srcdir}/src/main/tls/log.c \ - ${top_srcdir}/src/main/tls/ocsp.c \ - ${top_srcdir}/src/main/tls/session.c \ - ${top_srcdir}/src/main/tls/utils.c \ - ${top_srcdir}/src/main/tls/validate.c diff --git a/src/main/unit_test_attribute.mk b/src/main/unit_test_attribute.mk index 21195ca61a8..a5980a6335e 100644 --- a/src/main/unit_test_attribute.mk +++ b/src/main/unit_test_attribute.mk @@ -1,5 +1,5 @@ TARGET := unit_test_attribute SOURCES := unit_test_attribute.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a libfreeradius-dhcpv4.a libfreeradius-tacacs.a libfreeradius-server.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-radius.a libfreeradius-dhcpv4.a libfreeradius-tacacs.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/main/unit_test_map.mk b/src/main/unit_test_map.mk index 6995b7c0add..17934c3f8f6 100644 --- a/src/main/unit_test_map.mk +++ b/src/main/unit_test_map.mk @@ -1,5 +1,5 @@ TARGET := unit_test_map SOURCES := unit_test_map.c ${top_srcdir}/src/main/unlang_compile.c ${top_srcdir}/src/main/unlang_interpret.c -TGT_PREREQS := libfreeradius-server.a libfreeradius-util.a libfreeradius-radius.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/main/unit_test_module.mk b/src/main/unit_test_module.mk index b3c710bb1a0..da6120882db 100644 --- a/src/main/unit_test_module.mk +++ b/src/main/unit_test_module.mk @@ -13,13 +13,9 @@ SOURCES := \ unlang_compile.c \ unlang_interpret.c -ifneq ($(OPENSSL_LIBS),) -include ${top_srcdir}/src/main/tls.mk -endif - TGT_INSTALLDIR := TGT_LDLIBS := $(LIBS) $(LCRYPT) -TGT_PREREQS := libfreeradius-server.a libfreeradius-util.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-radius.a libfreeradius-io.a libfreeradius-util.a # Libraries can't depend on libraries (oops), so make the binary # depend on the EAP code... diff --git a/src/modules/proto_detail/proto_detail.mk b/src/modules/proto_detail/proto_detail.mk index 7f74dba8252..249e04c0039 100644 --- a/src/modules/proto_detail/proto_detail.mk +++ b/src/modules/proto_detail/proto_detail.mk @@ -6,4 +6,4 @@ endif SOURCES := proto_detail.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := libfreeradius-util.a libfreeradius-io.a diff --git a/src/modules/proto_detail/proto_detail_file.mk b/src/modules/proto_detail/proto_detail_file.mk index 61cca14b98e..651c28ff4c8 100644 --- a/src/modules/proto_detail/proto_detail_file.mk +++ b/src/modules/proto_detail/proto_detail_file.mk @@ -6,4 +6,4 @@ endif SOURCES := proto_detail_file.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a +TGT_PREREQS := libfreeradius-util.a diff --git a/src/modules/proto_detail/proto_detail_process.mk b/src/modules/proto_detail/proto_detail_process.mk index e9d0982e010..1a1d89f2468 100644 --- a/src/modules/proto_detail/proto_detail_process.mk +++ b/src/modules/proto_detail/proto_detail_process.mk @@ -6,4 +6,4 @@ endif SOURCES := proto_detail_process.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a +TGT_PREREQS := libfreeradius-util.a diff --git a/src/modules/proto_detail/proto_detail_work.mk b/src/modules/proto_detail/proto_detail_work.mk index 3fac3abe746..d6c57fe5b6f 100644 --- a/src/modules/proto_detail/proto_detail_work.mk +++ b/src/modules/proto_detail/proto_detail_work.mk @@ -6,4 +6,4 @@ endif SOURCES := proto_detail_work.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a +TGT_PREREQS := libfreeradius-util.a diff --git a/src/modules/rlm_redis_ippool/rlm_redis_ippool_tool.mk b/src/modules/rlm_redis_ippool/rlm_redis_ippool_tool.mk index dd5ef993cb3..6a59d154679 100644 --- a/src/modules/rlm_redis_ippool/rlm_redis_ippool_tool.mk +++ b/src/modules/rlm_redis_ippool/rlm_redis_ippool_tool.mk @@ -12,7 +12,7 @@ endif SOURCES := $(TARGETNAME).c SRC_CFLAGS += -I$(top_builddir)/src/modules/rlm_redis -TGT_PREREQS := libfreeradius-util.a libfreeradius-radius.a libfreeradius-redis.a libfreeradius-server.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-redis.a libfreeradius-util.a TGT_LDLIBS += $(TALLOC_LIBS) MAN := rlm_redis_ippool_tool.8 diff --git a/src/tests/util/atomic_queue_test.mk b/src/tests/util/atomic_queue_test.mk index ccf638c3e7a..58f2d4ad4e4 100644 --- a/src/tests/util/atomic_queue_test.mk +++ b/src/tests/util/atomic_queue_test.mk @@ -2,6 +2,6 @@ TARGET := atomic_queue_test SOURCES := atomic_queue_test.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/channel_test.mk b/src/tests/util/channel_test.mk index 53985931fa2..898c982de8a 100644 --- a/src/tests/util/channel_test.mk +++ b/src/tests/util/channel_test.mk @@ -2,6 +2,6 @@ TARGET := channel_test SOURCES := channel_test.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/control_test.mk b/src/tests/util/control_test.mk index 4cd4e189365..8b07ca237fe 100644 --- a/src/tests/util/control_test.mk +++ b/src/tests/util/control_test.mk @@ -2,6 +2,6 @@ TARGET := control_test SOURCES := control_test.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/message_set_test.mk b/src/tests/util/message_set_test.mk index 571110ca01a..c07397cfe94 100644 --- a/src/tests/util/message_set_test.mk +++ b/src/tests/util/message_set_test.mk @@ -2,6 +2,6 @@ TARGET := message_set_test SOURCES := message_set_test.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/radius1_test.mk b/src/tests/util/radius1_test.mk index 281e6a3cf3f..b9771abfbe9 100644 --- a/src/tests/util/radius1_test.mk +++ b/src/tests/util/radius1_test.mk @@ -2,5 +2,5 @@ TARGET := radius1_test SOURCES := radius1_test.c -TGT_PREREQS := libfreeradius-io.a libfreeradius-util.a libfreeradius-radius.a libfreeradius-server.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/radius_schedule_test.mk b/src/tests/util/radius_schedule_test.mk index 4a3ef9d2291..bb5f65806c9 100644 --- a/src/tests/util/radius_schedule_test.mk +++ b/src/tests/util/radius_schedule_test.mk @@ -2,6 +2,6 @@ TARGET := radius_schedule_test SOURCES := radius_schedule_test.c -TGT_PREREQS := libfreeradius-io.a libfreeradius-util.a libfreeradius-radius.a libfreeradius-server.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/ring_buffer_test.mk b/src/tests/util/ring_buffer_test.mk index ff2414ed100..4d64355d430 100644 --- a/src/tests/util/ring_buffer_test.mk +++ b/src/tests/util/ring_buffer_test.mk @@ -2,6 +2,6 @@ TARGET := ring_buffer_test SOURCES := ring_buffer_test.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/schedule_test.mk b/src/tests/util/schedule_test.mk index 725ab4fcba9..773ed0118ad 100644 --- a/src/tests/util/schedule_test.mk +++ b/src/tests/util/schedule_test.mk @@ -2,6 +2,6 @@ TARGET := schedule_test SOURCES := schedule_test.c -TGT_PREREQS := libfreeradius-io.a libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS) diff --git a/src/tests/util/worker_test.mk b/src/tests/util/worker_test.mk index 1ec49673fc3..824197248f4 100644 --- a/src/tests/util/worker_test.mk +++ b/src/tests/util/worker_test.mk @@ -2,6 +2,6 @@ TARGET := worker_test SOURCES := worker_test.c -TGT_PREREQS := libfreeradius-util.a libfreeradius-server.a libfreeradius-radius.a libfreeradius-io.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-io.a libfreeradius-util.a TGT_LDLIBS := $(LIBS)