inet_listeners now support ssl=yes. For now only login processes support it.

--HG--
branch : HEAD

diff --git a/src/lib-master/master-service-private.h b/src/lib-master/master-service-private.h
index e64f7ad74658791342855255ba752900f41e25a4..e9e48121560d19f2a3e2e328dba485ab5b437cd4 100644 (file)
--- a/src/lib-master/master-service-private.h
+++ b/src/lib-master/master-service-private.h
@@ -7,6 +7,7 @@
 struct master_service_listener {
        struct master_service *service;
        int fd;
+       bool ssl;
        struct io *io;
 };
 
@@ -23,7 +24,7 @@ struct master_service {
        const char *config_path;
        int syslog_facility;
 
-       unsigned int socket_count;
+       unsigned int socket_count, ssl_socket_count;
         struct master_service_listener *listeners;
 
        struct io *io_status_write, *io_status_error;

diff --git a/src/lib-master/master-service.c b/src/lib-master/master-service.c
index 9670027768e9d0746716413118d903a74f7937e2..f4144c5c9ead01fb980532017a96809d16eec1cc 100644 (file)
--- a/src/lib-master/master-service.c
+++ b/src/lib-master/master-service.c
@@ -109,6 +109,9 @@ master_service_init(const char *name, enum master_service_flags flags,
        str = getenv("SOCKET_COUNT");
        if (str != NULL)
                service->socket_count = atoi(str);
+       str = getenv("SSL_SOCKET_COUNT");
+       if (str != NULL)
+               service->ssl_socket_count = atoi(str);
 
        /* set up some kind of logging until we know exactly how and where
           we want to log */
@@ -437,6 +440,7 @@ static void master_service_listen(struct master_service_listener *l)
                io_remove(&l->io);
                conn.fd = l->fd;
        }
+       conn.ssl = l->ssl;
 
        l->service->master_status.available_count--;
         master_status_update(l->service);
@@ -461,6 +465,9 @@ static void io_listeners_add(struct master_service *service)
                l->fd = MASTER_LISTEN_FD_FIRST + i;
                l->io = io_add(MASTER_LISTEN_FD_FIRST + i, IO_READ,
                               master_service_listen, l);
+
+               if (i >= service->socket_count - service->ssl_socket_count)
+                       l->ssl = TRUE;
        }
 }
 

diff --git a/src/lib-master/master-service.h b/src/lib-master/master-service.h
index 130283d8fa43083f58eb9147abbee74d63c0f979..69fc07e89d0623eea786bc9419d2de71a1aa53b8 100644 (file)
--- a/src/lib-master/master-service.h
+++ b/src/lib-master/master-service.h
@@ -18,6 +18,8 @@ struct master_service_connection {
 
        struct ip_addr remote_ip;
        unsigned int remote_port;
+
+       bool ssl;
 };
 
 typedef void

diff --git a/src/login-common/main.c b/src/login-common/main.c
index 2aabec1800d4494e672c1e0e626c496b31c8ab29..1ce6b8bc761143825f78b49a57e474ce1eaafa7f 100644 (file)
--- a/src/login-common/main.c
+++ b/src/login-common/main.c
@@ -39,8 +39,7 @@ static void client_connected(const struct master_service_connection *conn)
                local_port = 0;
        }
 
-       // FIXME: a global ssl_connections isn't enough!
-       if (!ssl_connections) {
+       if (!ssl_connections && !conn->ssl) {
                client = client_create(conn->fd, FALSE, &local_ip,
                                       &conn->remote_ip);
        } else {

diff --git a/src/master/master-settings.c b/src/master/master-settings.c
index 46a8bf272872973d78fcfcdb6b84f6202539bd1e..ac28b57cab79982f7a7effe32169dc5950f5c6d5 100644 (file)
--- a/src/master/master-settings.c
+++ b/src/master/master-settings.c
@@ -55,13 +55,15 @@ static struct setting_parser_info file_listener_setting_parser_info = {
 static struct setting_define inet_listener_setting_defines[] = {
        DEF(SET_STR, address),
        DEF(SET_UINT, port),
+       DEF(SET_BOOL, ssl),
 
        SETTING_DEFINE_LIST_END
 };
 
 static struct inet_listener_settings inet_listener_default_settings = {
        MEMBER(address) "*",
-       MEMBER(port) 0
+       MEMBER(port) 0,
+       MEMBER(ssl) FALSE
 };
 
 static struct setting_parser_info inet_listener_setting_parser_info = {

diff --git a/src/master/master-settings.h b/src/master/master-settings.h
index ead97d6d561816b84a9f58d3e6e64221b68fbb71..7d3ce973362ce716770cb9e18938d05bb840f441 100644 (file)
--- a/src/master/master-settings.h
+++ b/src/master/master-settings.h
@@ -12,6 +12,7 @@ ARRAY_DEFINE_TYPE(file_listener_settings, struct file_listener_settings *);
 struct inet_listener_settings {
        const char *address;
        unsigned int port;
+       bool ssl;
 };
 
 struct service_settings {

diff --git a/src/master/service-process.c b/src/master/service-process.c
index c33cc54b32f42552a147ba07c103e5367bf546af..c32985aed9c76e80758070367ab0d5c6f995158c 100644 (file)
--- a/src/master/service-process.c
+++ b/src/master/service-process.c
@@ -33,7 +33,7 @@ service_dup_fds(struct service *service, int auth_fd, int std_fd)
 {
        struct service_listener *const *listeners;
        ARRAY_TYPE(dup2) dups;
-       unsigned int i, count, n = 0, socket_listener_count;
+       unsigned int i, count, n = 0, socket_listener_count, ssl_socket_count;
 
        /* stdin/stdout is already redirected to /dev/null. Other master fds
           should have been opened with fd_close_on_exec() so we don't have to
@@ -53,13 +53,25 @@ service_dup_fds(struct service *service, int auth_fd, int std_fd)
                n += socket_listener_count;
        }
 
+       /* first add non-ssl listeners */
        for (i = 0; i < count; i++) {
-               if (listeners[i]->fd == -1)
-                       continue;
-
-               dup2_append(&dups, listeners[i]->fd,
-                           MASTER_LISTEN_FD_FIRST + n);
-               n++; socket_listener_count++;
+               if (listeners[i]->fd != -1 &&
+                   !listeners[i]->set.inetset.set->ssl) {
+                       dup2_append(&dups, listeners[i]->fd,
+                                   MASTER_LISTEN_FD_FIRST + n);
+                       n++; socket_listener_count++;
+               }
+       }
+       /* then ssl-listeners */
+       ssl_socket_count = 0;
+       for (i = 0; i < count; i++) {
+               if (listeners[i]->fd != -1 &&
+                   listeners[i]->set.inetset.set->ssl) {
+                       dup2_append(&dups, listeners[i]->fd,
+                                   MASTER_LISTEN_FD_FIRST + n);
+                       n++; socket_listener_count++;
+                       ssl_socket_count++;
+               }
        }
 
        dup2_append(&dups, null_fd, MASTER_RESERVED_FD);
@@ -106,6 +118,7 @@ service_dup_fds(struct service *service, int auth_fd, int std_fd)
                service_error(service, "dup2s failed");
 
        env_put(t_strdup_printf("SOCKET_COUNT=%d", socket_listener_count));
+       env_put(t_strdup_printf("SSL_SOCKET_COUNT=%d", ssl_socket_count));
 }
 
 static int validate_uid_gid(struct master_settings *set, uid_t uid, gid_t gid,