diff options
author | rizzo <rizzo@f38db490-d61c-443f-a65b-d21fe96a405b> | 2006-11-27 21:25:55 +0000 |
---|---|---|
committer | rizzo <rizzo@f38db490-d61c-443f-a65b-d21fe96a405b> | 2006-11-27 21:25:55 +0000 |
commit | 49754530324310de65059d13879d4c2116c04240 (patch) | |
tree | e7413ca531aae601eebee7ea1c6dd89e2c1bb5e1 /main/http.c | |
parent | ac91407f4751c5e63c26579fd09b1555efed0f98 (diff) |
document the support for running a server on TCP/TLS and
opening an SSL socket.
We are almost ready to make this code available to other modules.
git-svn-id: http://svn.digium.com/svn/asterisk/trunk@48073 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main/http.c')
-rw-r--r-- | main/http.c | 76 |
1 files changed, 63 insertions, 13 deletions
diff --git a/main/http.c b/main/http.c index 96cb8d153..1d48033e0 100644 --- a/main/http.c +++ b/main/http.c @@ -58,13 +58,28 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #define DEFAULT_PREFIX "/asterisk" /*! - * In order to have SSL support, we need the openssl libraries. + * In order to have TLS/SSL support, we need the openssl libraries. * Still we can decide whether or not to use them by commenting * in or out the DO_SSL macro. + * TLS/SSL support is basically implemented by reading from a config file + * (currently http.conf) the names of the certificate and cipher to use, + * and then run ssl_setup() to create an appropriate SSL_CTX (ssl_ctx) + * If we support multiple domains, presumably we need to read multiple + * certificates. + * When we are requested to open a TLS socket, we run make_file_from_fd() + * on the socket, to do the necessary setup. At the moment the context's name + * is hardwired in the function, but we can certainly make it into an extra + * parameter to the function. + * * We declare most of ssl support variables unconditionally, * because their number is small and this simplifies the code. - * XXX this eventually goes into a generic header file. + * + * NOTE: the ssl-support variables (ssl_ctx, do_ssl, certfile, cipher) + * and their setup should be moved to a more central place, e.g. asterisk.conf + * and the source files that processes it. Similarly, ssl_setup() should + * be run earlier in the startup process so modules have it available. */ + #if defined(HAVE_OPENSSL) && (defined(HAVE_FUNOPEN) || defined(HAVE_FOPENCOOKIE)) #define DO_SSL /* comment in/out if you want to support ssl */ #endif @@ -73,6 +88,8 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <openssl/ssl.h> #include <openssl/err.h> static SSL_CTX* ssl_ctx; +#else +typedef struct {} SSL; /* so we can define a pointer to it */ #endif /* DO_SSL */ /* SSL support */ @@ -82,15 +99,43 @@ static char *certfile; static char *cipher; /*! + * The following code implements a generic mechanism for starting + * services on a TCP or TLS socket. + * The service is configured in the struct server_args, and + * then started by calling server_start(desc) on the descriptor. + * server_start() first verifies if an instance of the service is active, + * and in case shuts it down. Then, if the service must be started, creates + * a socket and a thread in charge of doing the accept(). + * + * The body of the thread is desc->accept_fn(desc), which the user can define + * freely. We supply a sample implementation, server_root(), structured as an + * infinite loop. At the beginning of each iteration it runs periodic_fn() + * if defined (e.g. to perform some cleanup etc.) then issues a poll() + * or equivalent with a timeout of 'poll_timeout' milliseconds, and if the + * following accept() is successful it creates a thread in charge of + * running the session, whose body is desc->worker_fn(). The argument of + * worker_fn() is a struct server_instance, which contains the address + * of the other party, a pointer to desc, the file descriptors (fd) on which + * we can do a select/poll (but NOT IO/, and a FILE * on which we can do I/O. + * We have both because we want to support plain and SSL sockets, and + * going through a FILE * lets us provide the encryption/decryption + * on the stream without using an auxiliary thread. + * + * NOTE: in order to let other parts of asterisk use these services, + * we need to do the following: + * + move struct server_instance and struct server_args to + * a common header file, together with prototypes for + * server_start() and server_root(). + * + + */ + +/*! * describes a server instance */ struct server_instance { FILE *f; /* fopen/funopen result */ int fd; /* the socket returned by accept() */ - int is_ssl; /* is this an ssl session ? */ -#ifdef DO_SSL SSL *ssl; /* ssl state */ -#endif struct sockaddr_in requestor; struct server_args *parent; }; @@ -103,13 +148,15 @@ struct server_args { struct sockaddr_in oldsin; int is_ssl; /* is this an SSL accept ? */ int accept_fd; + int poll_timeout; pthread_t master; void *(*accept_fn)(void *); /* the function in charge of doing the accept */ + void (*periodic_fn)(void *); /* something we may want to run before after select on the accept socket */ void *(*worker_fn)(void *); /* the function in charge of doing the actual work */ const char *name; }; -static void *http_root(void *arg); +static void *server_root(void *arg); static void *httpd_helper_thread(void *arg); /*! @@ -120,7 +167,7 @@ static struct server_args http_desc = { .master = AST_PTHREADT_NULL, .is_ssl = 0, .name = "http server", - .accept_fn = http_root, + .accept_fn = server_root, .worker_fn = httpd_helper_thread, }; @@ -129,7 +176,7 @@ static struct server_args https_desc = { .master = AST_PTHREADT_NULL, .is_ssl = 1, .name = "https server", - .accept_fn = http_root, + .accept_fn = server_root, .worker_fn = httpd_helper_thread, }; @@ -496,7 +543,7 @@ static void *make_file_from_fd(void *data) /* * open a FILE * as appropriate. */ - if (!ser->is_ssl) + if (!ser->parent->is_ssl) ser->f = fdopen(ser->fd, "w+"); #ifdef DO_SSL else if ( (ser->ssl = SSL_new(ssl_ctx)) ) { @@ -656,7 +703,7 @@ done: return NULL; } -static void *http_root(void *data) +static void *server_root(void *data) { struct server_args *desc = data; int fd; @@ -667,9 +714,13 @@ static void *http_root(void *data) pthread_attr_t attr; for (;;) { - int flags; + int i, flags; - ast_wait_for_input(desc->accept_fd, -1); + if (desc->periodic_fn) + desc->periodic_fn(desc); + i = ast_wait_for_input(desc->accept_fd, desc->poll_timeout); + if (i <= 0) + continue; sinlen = sizeof(sin); fd = accept(desc->accept_fd, (struct sockaddr *)&sin, &sinlen); if (fd < 0) { @@ -686,7 +737,6 @@ static void *http_root(void *data) flags = fcntl(fd, F_GETFL); fcntl(fd, F_SETFL, flags & ~O_NONBLOCK); ser->fd = fd; - ser->is_ssl = desc->is_ssl; ser->parent = desc; memcpy(&ser->requestor, &sin, sizeof(ser->requestor)); |