radsecproxy-1.6.5.

[libradsec.git] / dtls.c

diff --git a/dtls.c b/dtls.c
index e338154..8be677e 100644 (file)
--- a/dtls.c
+++ b/dtls.c
@@ -26,7 +26,6 @@
 #include <pthread.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
-#include "list.h"
 #include "hash.h"
 #include "radsecproxy.h"
 
@@ -47,7 +46,7 @@ void initextradtls();
 
 static const struct protodefs protodefs = {
     "dtls",
-    "mysecret", /* secretdefault */
+    "radsec", /* secretdefault */
     SOCK_DGRAM, /* socktype */
     "2083", /* portdefault */
     REQUEST_RETRY_COUNT, /* retrycountdefault */
@@ -95,12 +94,14 @@ struct sessioncacheentry {
 struct dtlsservernewparams {
     struct sessioncacheentry *sesscache;
     int sock;
-    struct sockaddr_storage addr;    
+    struct sockaddr_storage addr;
 };
 
 void dtlssetsrcres() {
     if (!srcres)
-       srcres = resolvepassiveaddrinfo(protoopts ? protoopts->sourcearg : NULL, NULL, protodefs.socktype);
+       srcres =
+            resolvepassiveaddrinfo(protoopts ? protoopts->sourcearg : NULL,
+                                   AF_UNSPEC, NULL, protodefs.socktype);
 }
 
 int udp2bio(int s, struct gqueue *q, int cnt) {
@@ -109,7 +110,7 @@ int udp2bio(int s, struct gqueue *q, int cnt) {
 
     if (cnt < 1)
        return 0;
-    
+
     buf = malloc(cnt);
     if (!buf) {
        unsigned char err;
@@ -162,7 +163,7 @@ BIO *getrbio(SSL *ssl, struct gqueue *q, int timeout) {
 int dtlsread(SSL *ssl, struct gqueue *q, unsigned char *buf, int num, int timeout) {
     int len, cnt;
     BIO *rbio;
-    
+
     for (len = 0; len < num; len += cnt) {
        cnt = SSL_read(ssl, buf + len, num - len);
        if (cnt <= 0)
@@ -171,7 +172,7 @@ int dtlsread(SSL *ssl, struct gqueue *q, unsigned char *buf, int num, int timeou
                rbio = getrbio(ssl, q, timeout);
                if (!rbio)
                    return 0;
-               BIO_free(ssl->rbio);            
+               BIO_free(ssl->rbio);
                ssl->rbio = rbio;
                cnt = 0;
                continue;
@@ -199,7 +200,7 @@ SSL *dtlsacccon(uint8_t acc, SSL_CTX *ctx, int s, struct sockaddr *addr, struct
     ssl = SSL_new(ctx);
     if (!ssl)
        return NULL;
-    
+
     mem0bio = BIO_new(BIO_s_mem());
     BIO_set_mem_eof_return(mem0bio, -1);
     wbio = BIO_new_dgram(s, BIO_NOCLOSE);
@@ -244,21 +245,21 @@ unsigned char *raddtlsget(SSL *ssl, struct gqueue *rbios, int timeout) {
            continue;
        }
        memcpy(rad, buf, 4);
-       
+
        cnt = dtlsread(ssl, rbios, rad + 4, len - 4, timeout);
         if (cnt < 1) {
             debug(DBG_DBG, cnt ? "raddtlsget: connection lost" : "raddtlsget: timeout");
             free(rad);
             return NULL;
         }
-        
+
         if (len >= 20)
             break;
-       
+
         free(rad);
         debug(DBG_WARN, "raddtlsget: packet smaller than minimum radius size");
     }
-    
+
     debug(DBG_DBG, "raddtlsget: got %d bytes", len);
     return rad;
 }
@@ -269,13 +270,13 @@ void *dtlsserverwr(void *arg) {
     struct client *client = (struct client *)arg;
     struct gqueue *replyq;
     struct request *reply;
-    
+
     debug(DBG_DBG, "dtlsserverwr: starting for %s", addr2string(client->addr));
     replyq = client->replyq;
     for (;;) {
        pthread_mutex_lock(&replyq->mutex);
        while (!list_first(replyq->entries)) {
-           if (client->ssl) {      
+           if (client->ssl) {
                debug(DBG_DBG, "dtlsserverwr: waiting for signal");
                pthread_cond_wait(&replyq->cond, &replyq->mutex);
                debug(DBG_DBG, "dtlsserverwr: got signal");
@@ -305,10 +306,10 @@ void dtlsserverrd(struct client *client) {
     struct request *rq;
     uint8_t *buf;
     pthread_t dtlsserverwrth;
-    
+
     debug(DBG_DBG, "dtlsserverrd: starting for %s", addr2string(client->addr));
 
-    if (pthread_create(&dtlsserverwrth, NULL, dtlsserverwr, (void *)client)) {
+    if (pthread_create(&dtlsserverwrth, &pthread_attr, dtlsserverwr, (void *)client)) {
        debug(DBG_ERR, "dtlsserverrd: pthread_create failed");
        return;
     }
@@ -332,7 +333,7 @@ void dtlsserverrd(struct client *client) {
            break;
        }
     }
-    
+
     /* stop writer by setting ssl to NULL and give signal in case waiting for data */
     client->ssl = NULL;
 
@@ -353,6 +354,7 @@ void *dtlsservernew(void *arg) {
     X509 *cert = NULL;
     SSL_CTX *ctx = NULL;
     uint8_t delay = 60;
+    struct tls *accepted_tls = NULL;
 
     debug(DBG_DBG, "dtlsservernew: starting");
     conf = find_clconf(handle, (struct sockaddr *)&params->addr, NULL);
@@ -366,10 +368,11 @@ void *dtlsservernew(void *arg) {
        cert = verifytlscert(ssl);
         if (!cert)
             goto exit;
+        accepted_tls = conf->tlsconf;
     }
 
     while (conf) {
-       if (verifyconfcert(cert, conf)) {
+       if (accepted_tls == conf->tlsconf && verifyconfcert(cert, conf)) {
            X509_free(cert);
            client = addclient(conf, 1);
            if (client) {
@@ -392,7 +395,7 @@ void *dtlsservernew(void *arg) {
     if (cert)
        X509_free(cert);
 
- exit:
+exit:
     if (ssl) {
        SSL_shutdown(ssl);
        SSL_free(ssl);
@@ -413,7 +416,7 @@ void cacheexpire(struct hash *cache, struct timeval *last) {
     struct timeval now;
     struct hash_entry *he;
     struct sessioncacheentry *e;
-    
+
     gettimeofday(&now, NULL);
     if (now.tv_sec - last->tv_sec < 19)
        return;
@@ -448,12 +451,12 @@ void *udpdtlsserverrd(void *arg) {
     pthread_t dtlsserverth;
     struct hash *sessioncache;
     struct sessioncacheentry *cacheentry;
-    
+
     sessioncache = hash_create();
     if (!sessioncache)
        debugx(1, DBG_ERR, "udpdtlsserverrd: malloc failed");
     gettimeofday(&lastexpiry, NULL);
-    
+
     for (;;) {
        FD_ZERO(&readfds);
         FD_SET(s, &readfds);
@@ -509,7 +512,7 @@ void *udpdtlsserverrd(void *arg) {
 
            if (udp2bio(s, params->sesscache->rbios, cnt)) {
                debug(DBG_DBG, "udpdtlsserverrd: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from));
-               if (!pthread_create(&dtlsserverth, NULL, dtlsservernew, (void *)params)) {
+               if (!pthread_create(&dtlsserverth, &pthread_attr, dtlsservernew, (void *)params)) {
                    pthread_detach(dtlsserverth);
                    cacheexpire(sessioncache, &lastexpiry);
                    continue;
@@ -532,7 +535,7 @@ int dtlsconnect(struct server *server, struct timeval *when, int timeout, char *
     X509 *cert;
     SSL_CTX *ctx = NULL;
     struct hostportres *hp;
-    
+
     debug(DBG_DBG, "dtlsconnect: called from %s", text);
     pthread_mutex_lock(&server->lock);
     if (when && memcmp(&server->lastconnecttry, when, sizeof(struct timeval))) {
@@ -579,11 +582,11 @@ int dtlsconnect(struct server *server, struct timeval *when, int timeout, char *
        if (!server->ssl)
            continue;
        debug(DBG_DBG, "dtlsconnect: DTLS: ok");
-       
+
        cert = verifytlscert(server->ssl);
        if (!cert)
            continue;
-       
+
        if (verifyconfcert(cert, server->conf))
            break;
        X509_free(cert);
@@ -622,7 +625,7 @@ void *udpdtlsclientrd(void *arg) {
     socklen_t fromlen = sizeof(from);
     struct clsrvconf *conf;
     fd_set readfds;
-    
+
     for (;;) {
        FD_ZERO(&readfds);
         FD_SET(s, &readfds);
@@ -633,7 +636,7 @@ void *udpdtlsclientrd(void *arg) {
            debug(DBG_WARN, "udpdtlsclientrd: recv failed");
            continue;
        }
-       
+
        conf = find_srvconf(handle, (struct sockaddr *)&from, NULL);
        if (!conf) {
            debug(DBG_WARN, "udpdtlsclientrd: got packet from wrong or unknown DTLS peer %s, ignoring", addr2string((struct sockaddr *)&from));
@@ -650,7 +653,7 @@ void *dtlsclientrd(void *arg) {
     unsigned char *buf;
     struct timeval lastconnecttry;
     int secs;
-    
+
     for (;;) {
        /* yes, lastconnecttry is really necessary */
        lastconnecttry = server->lastconnecttry;
@@ -696,12 +699,12 @@ void initextradtls() {
        freeaddrinfo(srcres);
        srcres = NULL;
     }
-    
+
     if (client4_sock >= 0)
-       if (pthread_create(&cl4th, NULL, udpdtlsclientrd, (void *)&client4_sock))
+       if (pthread_create(&cl4th, &pthread_attr, udpdtlsclientrd, (void *)&client4_sock))
            debugx(1, DBG_ERR, "pthread_create failed");
     if (client6_sock >= 0)
-       if (pthread_create(&cl6th, NULL, udpdtlsclientrd, (void *)&client6_sock))
+       if (pthread_create(&cl6th, &pthread_attr, udpdtlsclientrd, (void *)&client6_sock))
            debugx(1, DBG_ERR, "pthread_create failed");
 }
 #else
@@ -709,3 +712,7 @@ const struct protodefs *dtlsinit(uint8_t h) {
     return NULL;
 }
 #endif
+
+/* Local Variables: */
+/* c-file-style: "stroustrup" */
+/* End: */