Thu Apr 28 2011 17:16:22

Asterisk developer's documentation


tcptls.h File Reference

Generic support for tcp/tls servers in Asterisk. More...

#include "asterisk/utils.h"
Include dependency graph for tcptls.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  ast_tcptls_session_args
 arguments for the accepting thread More...
struct  ast_tcptls_session_instance
struct  ast_tls_config
struct  SSL
struct  SSL_CTX

Defines

#define AST_CERTFILE   "asterisk.pem"
#define HOOK_T   ssize_t
#define LEN_T   size_t

Enumerations

enum  ast_ssl_flags { AST_SSL_VERIFY_CLIENT = (1 << 0), AST_SSL_DONT_VERIFY_SERVER = (1 << 1), AST_SSL_IGNORE_COMMON_NAME = (1 << 2) }

Functions

int ast_ssl_setup (struct ast_tls_config *cfg)
struct
ast_tcptls_session_instance
ast_tcptls_client_create (struct ast_tcptls_session_args *desc)
struct
ast_tcptls_session_instance
ast_tcptls_client_start (struct ast_tcptls_session_instance *tcptls_session)
 attempts to connect and start tcptls session, on error the tcptls_session's ref count is decremented, fd and file are closed, and NULL is returned.
HOOK_T ast_tcptls_server_read (struct ast_tcptls_session_instance *ser, void *buf, size_t count)
 replacement read/write functions for SSL support. We use wrappers rather than SSL_read/SSL_write directly so we can put in some debugging.
void * ast_tcptls_server_root (void *)
void ast_tcptls_server_start (struct ast_tcptls_session_args *desc)
 This is a generic (re)start routine for a TCP server, which does the socket/bind/listen and starts a thread for handling accept().
void ast_tcptls_server_stop (struct ast_tcptls_session_args *desc)
 Shutdown a running server if there is one.
HOOK_T ast_tcptls_server_write (struct ast_tcptls_session_instance *ser, const void *buf, size_t count)

Detailed Description

Generic support for tcp/tls servers in Asterisk.

Note:
In order to have TLS/SSL support, we need the openssl libraries. Still we can decide whether or not to use them by commenting in or out the DO_SSL macro.

TLS/SSL support is basically implemented by reading from a config file (currently http.conf and sip.conf) the names of the certificate and cipher to use, and then run ssl_setup() to create an appropriate SSL_CTX (ssl_ctx) If we support multiple domains, presumably we need to read multiple certificates.

When we are requested to open a TLS socket, we run make_file_from_fd() on the socket, to do the necessary setup. At the moment the context's name is hardwired in the function, but we can certainly make it into an extra parameter to the function.

We declare most of ssl support variables unconditionally, because their number is small and this simplifies the code.

Note:
The ssl-support variables (ssl_ctx, do_ssl, certfile, cipher) and their setup should be moved to a more central place, e.g. asterisk.conf and the source files that processes it. Similarly, ssl_setup() should be run earlier in the startup process so modules have it available.

Definition in file tcptls.h.


Define Documentation

#define AST_CERTFILE   "asterisk.pem"

SSL support

Definition at line 67 of file tcptls.h.

Referenced by __ast_http_load(), __init_manager(), and reload_config().

#define HOOK_T   ssize_t

Definition at line 148 of file tcptls.h.

#define LEN_T   size_t

Definition at line 149 of file tcptls.h.


Enumeration Type Documentation

Enumerator:
AST_SSL_VERIFY_CLIENT 

Verify certificate when acting as server

AST_SSL_DONT_VERIFY_SERVER 

Don't verify certificate when connecting to a server

AST_SSL_IGNORE_COMMON_NAME 

Don't compare "Common Name" against IP or hostname

Definition at line 69 of file tcptls.h.

                   {
   /*! Verify certificate when acting as server */
   AST_SSL_VERIFY_CLIENT = (1 << 0),
   /*! Don't verify certificate when connecting to a server */
   AST_SSL_DONT_VERIFY_SERVER = (1 << 1),
   /*! Don't compare "Common Name" against IP or hostname */
   AST_SSL_IGNORE_COMMON_NAME = (1 << 2)
};

Function Documentation

int ast_ssl_setup ( struct ast_tls_config cfg)

Definition at line 335 of file tcptls.c.

References __ssl_setup().

Referenced by __ast_http_load(), __init_manager(), and reload_config().

{
   return __ssl_setup(cfg, 0);
}
struct ast_tcptls_session_instance* ast_tcptls_client_create ( struct ast_tcptls_session_args desc) [read]

Definition at line 377 of file tcptls.c.

References ast_tcptls_session_args::accept_fd, ao2_alloc, ao2_ref, ast_debug, ast_inet_ntoa(), ast_log(), ast_mutex_init(), ast_tcptls_session_instance::client, desc, errno, ast_tcptls_session_instance::fd, ast_tcptls_session_args::local_address, ast_tcptls_session_instance::lock, LOG_ERROR, LOG_WARNING, ast_tcptls_session_args::name, ast_tcptls_session_args::old_address, ast_tcptls_session_instance::parent, ast_tcptls_session_instance::remote_address, ast_tcptls_session_args::remote_address, session_instance_destructor(), and ast_tcptls_session_args::worker_fn.

Referenced by app_exec(), and sip_prepare_socket().

{
   int x = 1;
   struct ast_tcptls_session_instance *tcptls_session = NULL;

   /* Do nothing if nothing has changed */
   if (!memcmp(&desc->old_address, &desc->remote_address, sizeof(desc->old_address))) {
      ast_debug(1, "Nothing changed in %s\n", desc->name);
      return NULL;
   }

   desc->old_address = desc->remote_address;

   if (desc->accept_fd != -1)
      close(desc->accept_fd);

   desc->accept_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if (desc->accept_fd < 0) {
      ast_log(LOG_WARNING, "Unable to allocate socket for %s: %s\n",
         desc->name, strerror(errno));
      return NULL;
   }

   /* if a local address was specified, bind to it so the connection will
      originate from the desired address */
   if (desc->local_address.sin_family != 0) {
      setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
      if (bind(desc->accept_fd, (struct sockaddr *) &desc->local_address, sizeof(desc->local_address))) {
         ast_log(LOG_ERROR, "Unable to bind %s to %s:%d: %s\n",
         desc->name,
            ast_inet_ntoa(desc->local_address.sin_addr), ntohs(desc->local_address.sin_port),
            strerror(errno));
         goto error;
      }
   }

   if (!(tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor)))
      goto error;

   ast_mutex_init(&tcptls_session->lock);
   tcptls_session->client = 1;
   tcptls_session->fd = desc->accept_fd;
   tcptls_session->parent = desc;
   tcptls_session->parent->worker_fn = NULL;
   memcpy(&tcptls_session->remote_address, &desc->remote_address, sizeof(tcptls_session->remote_address));

   return tcptls_session;

error:
   close(desc->accept_fd);
   desc->accept_fd = -1;
   if (tcptls_session)
      ao2_ref(tcptls_session, -1);
   return NULL;
}
struct ast_tcptls_session_instance* ast_tcptls_client_start ( struct ast_tcptls_session_instance tcptls_session) [read]

attempts to connect and start tcptls session, on error the tcptls_session's ref count is decremented, fd and file are closed, and NULL is returned.

Definition at line 340 of file tcptls.c.

References __ssl_setup(), ast_tcptls_session_args::accept_fd, ao2_ref, ast_inet_ntoa(), ast_log(), desc, ast_tls_config::enabled, errno, handle_tcptls_connection(), LOG_ERROR, ast_tcptls_session_args::name, ast_tcptls_session_instance::parent, ast_tcptls_session_args::remote_address, and ast_tcptls_session_args::tls_cfg.

Referenced by _sip_tcp_helper_thread(), and app_exec().

{
   struct ast_tcptls_session_args *desc;
   int flags;

   if (!(desc = tcptls_session->parent)) {
      goto client_start_error;
   }

   if (connect(desc->accept_fd, (const struct sockaddr *) &desc->remote_address, sizeof(desc->remote_address))) {
      ast_log(LOG_ERROR, "Unable to connect %s to %s:%d: %s\n",
         desc->name,
         ast_inet_ntoa(desc->remote_address.sin_addr), ntohs(desc->remote_address.sin_port),
         strerror(errno));
      goto client_start_error;
   }

   flags = fcntl(desc->accept_fd, F_GETFL);
   fcntl(desc->accept_fd, F_SETFL, flags & ~O_NONBLOCK);

   if (desc->tls_cfg) {
      desc->tls_cfg->enabled = 1;
      __ssl_setup(desc->tls_cfg, 1);
   }

   return handle_tcptls_connection(tcptls_session);

client_start_error:
   close(desc->accept_fd);
   desc->accept_fd = -1;
   if (tcptls_session) {
      ao2_ref(tcptls_session, -1);
   }
   return NULL;

}
HOOK_T ast_tcptls_server_read ( struct ast_tcptls_session_instance ser,
void *  buf,
size_t  count 
)

replacement read/write functions for SSL support. We use wrappers rather than SSL_read/SSL_write directly so we can put in some debugging.

Definition at line 86 of file tcptls.c.

References ast_log(), errno, ast_tcptls_session_instance::fd, LOG_ERROR, and ast_tcptls_session_instance::ssl.

{
   if (tcptls_session->fd == -1) {
      ast_log(LOG_ERROR, "server_read called with an fd of -1\n");
      errno = EIO;
      return -1;
   }

#ifdef DO_SSL
   if (tcptls_session->ssl)
      return ssl_read(tcptls_session->ssl, buf, count);
#endif
   return read(tcptls_session->fd, buf, count);
}
void* ast_tcptls_server_root ( void *  )

Definition at line 234 of file tcptls.c.

References ast_tcptls_session_args::accept_fd, ao2_alloc, ao2_ref, ast_log(), ast_mutex_init(), ast_pthread_create_detached_background, ast_wait_for_input(), ast_tcptls_session_instance::client, desc, errno, ast_tcptls_session_instance::fd, handle_tcptls_connection(), ast_tcptls_session_instance::lock, LOG_WARNING, ast_tcptls_session_instance::parent, ast_tcptls_session_args::periodic_fn, ast_tcptls_session_args::poll_timeout, ast_tcptls_session_instance::remote_address, and session_instance_destructor().

{
   struct ast_tcptls_session_args *desc = data;
   int fd;
   struct sockaddr_in sin;
   socklen_t sinlen;
   struct ast_tcptls_session_instance *tcptls_session;
   pthread_t launched;
   
   for (;;) {
      int i, flags;

      if (desc->periodic_fn)
         desc->periodic_fn(desc);
      i = ast_wait_for_input(desc->accept_fd, desc->poll_timeout);
      if (i <= 0)
         continue;
      sinlen = sizeof(sin);
      fd = accept(desc->accept_fd, (struct sockaddr *) &sin, &sinlen);
      if (fd < 0) {
         if ((errno != EAGAIN) && (errno != EINTR))
            ast_log(LOG_WARNING, "Accept failed: %s\n", strerror(errno));
         continue;
      }
      tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor);
      if (!tcptls_session) {
         ast_log(LOG_WARNING, "No memory for new session: %s\n", strerror(errno));
         close(fd);
         continue;
      }

      ast_mutex_init(&tcptls_session->lock);

      flags = fcntl(fd, F_GETFL);
      fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
      tcptls_session->fd = fd;
      tcptls_session->parent = desc;
      memcpy(&tcptls_session->remote_address, &sin, sizeof(tcptls_session->remote_address));

      tcptls_session->client = 0;
         
      /* This thread is now the only place that controls the single ref to tcptls_session */
      if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) {
         ast_log(LOG_WARNING, "Unable to launch helper thread: %s\n", strerror(errno));
         close(tcptls_session->fd);
         ao2_ref(tcptls_session, -1);
      }
   }
   return NULL;
}
void ast_tcptls_server_start ( struct ast_tcptls_session_args desc)

This is a generic (re)start routine for a TCP server, which does the socket/bind/listen and starts a thread for handling accept().

Version:
1.6.1 changed desc parameter to be of ast_tcptls_session_args type

Definition at line 433 of file tcptls.c.

References ast_tcptls_session_args::accept_fd, ast_tcptls_session_args::accept_fn, ast_debug, ast_inet_ntoa(), ast_log(), ast_pthread_create_background, AST_PTHREADT_NULL, errno, ast_tcptls_session_args::local_address, LOG_ERROR, ast_tcptls_session_args::master, ast_tcptls_session_args::name, and ast_tcptls_session_args::old_address.

Referenced by __ast_http_load(), __init_manager(), and reload_config().

{
   int flags;
   int x = 1;
   
   /* Do nothing if nothing has changed */
   if (!memcmp(&desc->old_address, &desc->local_address, sizeof(desc->old_address))) {
      ast_debug(1, "Nothing changed in %s\n", desc->name);
      return;
   }
   
   desc->old_address = desc->local_address;
   
   /* Shutdown a running server if there is one */
   if (desc->master != AST_PTHREADT_NULL) {
      pthread_cancel(desc->master);
      pthread_kill(desc->master, SIGURG);
      pthread_join(desc->master, NULL);
   }
   
   if (desc->accept_fd != -1)
      close(desc->accept_fd);

   /* If there's no new server, stop here */
   if (desc->local_address.sin_family == 0) {
      ast_debug(2, "Server disabled:  %s\n", desc->name);
      return;
   }

   desc->accept_fd = socket(AF_INET, SOCK_STREAM, 0);
   if (desc->accept_fd < 0) {
      ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n", desc->name, strerror(errno));
      return;
   }
   
   setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
   if (bind(desc->accept_fd, (struct sockaddr *) &desc->local_address, sizeof(desc->local_address))) {
      ast_log(LOG_ERROR, "Unable to bind %s to %s:%d: %s\n",
         desc->name,
         ast_inet_ntoa(desc->local_address.sin_addr), ntohs(desc->local_address.sin_port),
         strerror(errno));
      goto error;
   }
   if (listen(desc->accept_fd, 10)) {
      ast_log(LOG_ERROR, "Unable to listen for %s!\n", desc->name);
      goto error;
   }
   flags = fcntl(desc->accept_fd, F_GETFL);
   fcntl(desc->accept_fd, F_SETFL, flags | O_NONBLOCK);
   if (ast_pthread_create_background(&desc->master, NULL, desc->accept_fn, desc)) {
      ast_log(LOG_ERROR, "Unable to launch thread for %s on %s:%d: %s\n",
         desc->name,
         ast_inet_ntoa(desc->local_address.sin_addr), ntohs(desc->local_address.sin_port),
         strerror(errno));
      goto error;
   }
   return;

error:
   close(desc->accept_fd);
   desc->accept_fd = -1;
}
void ast_tcptls_server_stop ( struct ast_tcptls_session_args desc)

Shutdown a running server if there is one.

Version:
1.6.1 changed desc parameter to be of ast_tcptls_session_args type

Definition at line 496 of file tcptls.c.

References ast_tcptls_session_args::accept_fd, ast_debug, AST_PTHREADT_NULL, ast_tcptls_session_args::master, and ast_tcptls_session_args::name.

Referenced by unload_module().

{
   if (desc->master != AST_PTHREADT_NULL) {
      pthread_cancel(desc->master);
      pthread_kill(desc->master, SIGURG);
      pthread_join(desc->master, NULL);
   }
   if (desc->accept_fd != -1)
      close(desc->accept_fd);
   desc->accept_fd = -1;
   ast_debug(2, "Stopped server :: %s\n", desc->name);
}
HOOK_T ast_tcptls_server_write ( struct ast_tcptls_session_instance ser,
const void *  buf,
size_t  count 
)

Definition at line 101 of file tcptls.c.

References ast_log(), errno, ast_tcptls_session_instance::fd, LOG_ERROR, and ast_tcptls_session_instance::ssl.

Referenced by _sip_tcp_helper_thread().

{
   if (tcptls_session->fd == -1) {
      ast_log(LOG_ERROR, "server_write called with an fd of -1\n");
      errno = EIO;
      return -1;
   }

#ifdef DO_SSL
   if (tcptls_session->ssl)
      return ssl_write(tcptls_session->ssl, buf, count);
#endif
   return write(tcptls_session->fd, buf, count);
}