gfwleak/tango-certstore
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.添加keyringid未注册情况下，读取本地默认证书mesalab-def-cert签发证书

Browse Source 
2.添加valid为不可用，读取keyringid为256不信任证书mesalab-insec签发证书
3.添加证书类型为实体证书，本地签发流程（证书可用优先级 > 证书类型）
4.添加全量增量匹配链表头迁移
This commit is contained in:
fengweihao
2018-09-10 10:01:27 +08:00
parent 2a844d3205
commit e971346db2
12 changed files with 293 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
src/cert_conf.c
View File

@@ -20,10 +20,11 @@
struct config_bucket_t certConfig = {
.thread_nu = 1,
.days = 30,
.e_port = 9995,
.r_ip = "0.0.0.0",
.r_port = 3366,
.expire_after = 30,
.info_path = "/home/test",
.pxy_path = "/home/test",
.def_path = "/home/test",
.addr_t = {9995, 3336, "0.0.0.0"},
};
struct config_bucket_t *cert_default_config()
@@ -42,23 +43,32 @@ static int load_system_config(char *config)
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Reading the number of running threads failed");
}
xret = MESA_load_profile_string_nodef(config, "CONFIG", "table_info", rte->info_path, 128);
xret = MESA_load_profile_uint_nodef(config, "CONFIG", "expire_after", &(rte->expire_after));
if (xret < 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Reading the table_info path failed");
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Reading the number of valid time failed");
}
if(!rt_file_exsit(rte->info_path)) {
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "The table_info(%s) does not exist", rte->info_path);
xret = MESA_load_profile_string_nodef(config, "CONFIG", "def-ca-path", rte->def_path, 128);
if (xret < 0 && !rt_dir_exsit(rte->def_path)){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Read the def path failed or the (%s) does not exist",
rte->def_path);
goto finish;
}
xret = MESA_load_profile_string_nodef(config, "CONFIG", "table_info", rte->info_path, 128);
if (xret < 0 && !rt_file_exsit(rte->info_path)){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Read the table info failed or the (%s) does not exist",
rte->info_path);
goto finish;
}
xret = MESA_load_profile_string_nodef(config, "CONFIG", "pxy_obj_keyring", rte->pxy_path, 128);
if (xret < 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Reading the pxy_obj_keyring path failed");
}
if(!rt_file_exsit(rte->pxy_path)) {
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "The pxy_obj_keyring(%s) does not exist", rte->pxy_path);
if (xret < 0 && !rt_file_exsit(rte->pxy_path)){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Read the pxy obj keyring failed or the (%s) does not exist",
rte->pxy_path);
goto finish;
}
finish:
return xret;
}
@@ -69,19 +79,19 @@ static int load_module_config(char *config)
struct config_bucket_t *rte = cert_default_config();
xret = MESA_load_profile_short_nodef(config, "LIBEVENT", "port", (short *)&(rte->e_port));
xret = MESA_load_profile_short_nodef(config, "LIBEVENT", "port", (short *)&(rte->addr_t.e_port));
if (xret < 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Libevent Port invalid\n");
goto finish;
}
xret = MESA_load_profile_string_nodef(config, "REDIS", "ip", rte->r_ip, 16);
xret = MESA_load_profile_string_nodef(config, "REDIS", "ip", rte->addr_t.r_ip, 16);
if (xret < 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Ip invalid\n");
goto finish;
}
xret = MESA_load_profile_short_nodef(config, "REDIS", "port", (short *)&(rte->r_port));
xret = MESA_load_profile_short_nodef(config, "REDIS", "port", (short *)&(rte->addr_t.r_port));
if (xret < 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Redis Port invalid\n");
goto finish;

35
src/cert_conf.h
View File

@@ -18,13 +18,12 @@
#include "MESA_htable.h"
struct request_t{
#define DATALEN 64
int t_id;
int flag;
X509 *origin;
int kering_id;
char host[DATALEN];
#define DATALEN 128
int thread_id;
char *odata;
X509 *origin;
int keyring_id;
char rkey[DATALEN];
struct evhttp_request *evh_req;
};
@@ -43,25 +42,23 @@ struct pxy_obj_keyring{
struct key_ring_list
{
uint64_t sum_cnt;
MESA_htable_handle htable;
uint64_t sum_cnt;
MESA_htable_handle htable, oldhtable;
};
struct _initer_addr_t{
uint16_t e_port; /* libevent prot*/
uint16_t r_port; /* redis port*/
char r_ip[16]; /* redis ip */
};
struct config_bucket_t{
unsigned int thread_nu;
unsigned int days;
unsigned int expire_after;
char info_path[128];
char pxy_path[128];
uint16_t e_port; /* libevent prot*/
char r_ip[16]; /* redis ip */
uint16_t r_port; /* redis port*/
char def_path[128];
struct _initer_addr_t addr_t;
struct key_ring_list keyring;
};

302
src/cert_session.c
View File

@@ -47,9 +47,10 @@
#define WAIT_FOR_EFFECTIVE_US 1000*1000
#define SG_DATA_SIZE 4096
#define SG_INSEC_ID 256
#define DEFAULT_PRIVATEKEY_NAME "mesalab-ca-cert.key"
#define DEFAULT_CA_CERTIFICATE "mesalab-ca-cert.cer"
#define DEFAULT_PRIVATEKEY_NAME "mesalab-def-cert.key"
#define DEFAULT_CA_CERTIFICATE "mesalab-def-cert.cer"
static libevent_thread *threads;
@@ -88,33 +89,32 @@ MESA_internal_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_
return ret;
}
static int
key_ring_list_create(struct key_ring_list *keyring)
static MESA_htable_handle
key_ring_list_create()
{
int ret = 0;
int ret = 0;
MESA_htable_handle *htable = NULL;
keyring->htable = MESA_htable_born();
assert(keyring->htable != NULL);
keyring->sum_cnt = 0;
htable = MESA_htable_born();
assert(htable != NULL);
MESA_internal_htable_set_opt(keyring->htable, MHO_SCREEN_PRINT_CTRL, 0);
MESA_internal_htable_set_opt(keyring->htable, MHO_THREAD_SAFE, 1);
MESA_internal_htable_set_opt(htable, MHO_SCREEN_PRINT_CTRL, 0);
MESA_internal_htable_set_opt(htable, MHO_THREAD_SAFE, 1);
MESA_internal_htable_set_opt(keyring->htable, MHO_MUTEX_NUM, 16);
MESA_internal_htable_set_opt(keyring->htable, MHO_HASH_SLOT_SIZE, 1024);
MESA_internal_htable_set_opt(keyring->htable, MHO_HASH_MAX_ELEMENT_NUM, 2048);
MESA_internal_htable_set_opt(keyring->htable, MHO_EXPIRE_TIME, 0);
MESA_internal_htable_set_opt(htable, MHO_MUTEX_NUM, 16);
MESA_internal_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, 1024);
MESA_internal_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, 2048);
MESA_internal_htable_set_opt(htable, MHO_EXPIRE_TIME, 0);
MESA_internal_htable_set_opt(keyring->htable, MHO_ELIMIMINATE_TYPE,
HASH_ELIMINATE_ALGO_LRU);
ret = MESA_htable_mature(keyring->htable);
MESA_internal_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE,
HASH_ELIMINATE_ALGO_LRU);
ret = MESA_htable_mature(htable);
if(ret != 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "MESA_htable_mature error!\n");
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "MESA htable mature running error!\n");
goto finish;
}
finish:
return ret;
return htable;
}
void x509_get_private_key(EVP_PKEY *pkey, char *pubkey)
@@ -126,7 +126,6 @@ void x509_get_private_key(EVP_PKEY *pkey, char *pubkey)
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "unable to create BIO for output\n");
goto finish;
}
PEM_write_bio_PrivateKey(bp, pkey, NULL, NULL, 0, NULL, NULL);
len = BIO_read(bp, pubkey, SG_DATA_SIZE);
if(len <= 0) {
@@ -177,12 +176,11 @@ static void key_ring_free(void *data)
EVP_PKEY_free(pxy_obj->key);
}
void key_ring_list_destroy(struct key_ring_list *keyring)
void key_ring_list_destroy(MESA_htable_handle *htable)
{
keyring->sum_cnt = 0;
MESA_htable_destroy(keyring->htable, key_ring_free);
keyring->htable = NULL;
return;
MESA_htable_destroy(*htable, key_ring_free);
*htable = NULL;
return;
}
int
@@ -264,10 +262,11 @@ ssl_x509_v3ext_copy_by_nid(X509 *crt, X509 *origcrt, int nid)
return -1;
return 1;
}
int x509_get_cn_name(X509 *origcrt, char *cn_name)
#if 0
static int
x509_get_cn_name(X509 *origcrt, char *cn_name)
{
int len = 0;
int len = 0, xret = -1;
X509_NAME *subject = NULL;
subject = X509_get_subject_name(origcrt);
@@ -276,11 +275,12 @@ int x509_get_cn_name(X509 *origcrt, char *cn_name)
}
len = X509_NAME_get_text_by_NID(subject, NID_commonName, cn_name, 256);
if (len > 0){
printf("cn_name = %s\n", cn_name);
xret = 0;
}
finish:
return 0;
return xret;
}
#endif
X509 *
x509_modify_by_cert_bak(X509 *cacrt, EVP_PKEY *cakey, X509 *origcrt, char *pkey,
@@ -617,7 +617,7 @@ int redis_rsync_init(struct event_base *base, struct redisAsyncContext **cl_ctx)
int xret = -1;
struct config_bucket_t *redis = cert_default_config();
*cl_ctx = redisAsyncConnect(redis->r_ip, redis->r_port);
*cl_ctx = redisAsyncConnect(redis->addr_t.r_ip, redis->addr_t.r_port);
if((*cl_ctx)->err ) {
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Redis Connect error : %s", (*cl_ctx)->errstr);
goto finish;
@@ -784,45 +784,55 @@ err:
return NULL;
}
static uint64_t
x509_online_append(X509 *origin, int id, char *root, char *sign, char *pkey)
static int
x509_online_append(struct x509_object_ctx *def, X509 *origin, int id,
char *root, char *sign, char *pkey)
{
void *res = NULL;
uint64_t expire_after = 0;
void *odata = NULL;
int _expire = 0;
X509 *_root = NULL; EVP_PKEY *_key = NULL;
struct key_ring_list *keyring = &cert_default_config()->keyring;
res = MESA_htable_search(keyring->htable, (const uchar *)&id, sizeof(int));
if (!res){
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "The table where keyringid = %d was not found", 1);
goto finish;
}
struct pxy_obj_keyring *pxy_obj = (struct pxy_obj_keyring *)res;
if (pxy_obj->is_valid != 1){
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Table information is invalid");
goto finish;
}
if (STRCMP(pxy_obj->type, "root") == 0 ||
STRCMP(pxy_obj->type, "intermediate") == 0){
//X509* x509 = x509_modify_by_cert(pxy_obj->root, pxy_obj->key, host, pkey, pxy_obj->expire_after);
X509* x509 = x509_modify_by_cert_bak(pxy_obj->root, pxy_obj->key, origin, pkey,
pxy_obj->expire_after, NULL, NULL);
if (!x509){
goto finish;
odata = MESA_htable_search(keyring->htable, (const uchar *)&id, sizeof(int));
if ( !odata ){
_root = def->root;
_key = def->key;
_expire = cert_default_config()->expire_after;
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Sing certificates using local default certificates");
} else {
struct pxy_obj_keyring *pxy_obj = (struct pxy_obj_keyring *)odata;
if (pxy_obj->is_valid != 1){
id = SG_INSEC_ID;
odata = MESA_htable_search(keyring->htable, (const uchar *)&id, sizeof(int));
if ( !odata){
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Read insecure certificate failed");
goto finish;
}
pxy_obj = (struct pxy_obj_keyring *)odata;
}else{
if (!STRCMP(pxy_obj->type, "end-entity")){
x509_get_msg_from_ca(pxy_obj->root, sign);
x509_get_private_key(pxy_obj->key, pkey);
goto finish;
}
}
expire_after = pxy_obj->expire_after;
x509_get_msg_from_ca(x509, sign);
x509_get_msg_from_ca(pxy_obj->root, root);
X509_free(x509);
}
if (STRCMP(pxy_obj->type, "end-entity")){
_root = pxy_obj->root;
_key = pxy_obj->key;
_expire = pxy_obj->expire_after;
}
X509* x509 = x509_modify_by_cert_bak(_root, _key, origin, pkey,
_expire, NULL, NULL);
if (!x509){
goto finish;
}
x509_get_msg_from_ca(x509, sign);
x509_get_msg_from_ca(_root, root);
X509_free(x509);
finish:
return expire_after;
return _expire;
}
static char readBytes(char *str)
@@ -844,30 +854,30 @@ rediSyncCommand(redisAsyncContext *cl_ctx, struct request_t *request,
int xret = -1;
redisReply *reply;
libevent_thread *thread = threads + request->t_id;
libevent_thread *thread = threads + request->thread_id;
struct evhttp_request *evh_req = request->evh_req;
reply = (redisReply *)redisCommand(thread->sync, "set %s %s ex %d nx", request->host, odata,
reply = (redisReply *)redisCommand(thread->sync, "set %s %s ex %d nx", request->rkey, odata,
sizeof_seconds(expire_after));
if (NULL == reply)
goto free;
switch (readBytes(reply->str)) {
case '+' :
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Writing data(key = %s) to redis successfully", request->host);
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Writing data(%s) to redis successfully\n", request->rkey);
FS_internal_operate(SGstats.handle, thread->column_ids, SGstats.line_ids[2], FS_OP_ADD, 1);
evhttp_socket_send(evh_req, request->odata);
goto free;
case '$' :
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Writing data(key = %s) to redis failed", request->host);
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Writing data(%s) to redis failed\n", request->rkey);
FS_internal_operate(SGstats.handle, thread->column_ids, SGstats.line_ids[1], FS_OP_ADD, 1);
redisAsyncCommand(cl_ctx, redis_reget_callback, request, "GET %s", request->host);
redisAsyncCommand(cl_ctx, redis_reget_callback, request, "GET %s", request->rkey);
freeReplyObject(reply);
goto finish;
default :
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Read redis data(key = %s) return code failed", request->host);
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Read redis data(%s) return code failed\n", request->rkey);
evhttp_send_error(request->evh_req, HTTP_NOTFOUND, 0);
goto free;
}
@@ -946,26 +956,26 @@ static int
redis_clnt_pdu_send(struct request_t *request, redisAsyncContext *c)
{
int xret = -1;
uint64_t expire_after;
int expire_after;
uint64_t startTime = 0, endTime = 0;
libevent_thread *thread = threads + request->t_id;
char sign[SG_DATA_SIZE] = {0}, pkey[SG_DATA_SIZE] = {0};
char root[SG_DATA_SIZE] = {0};
libevent_thread *info = threads + request->thread_id;
char sign[SG_DATA_SIZE] = {0}, pkey[SG_DATA_SIZE] = {0};
char root[SG_DATA_SIZE] = {0};
startTime = rt_time_ns();
expire_after = x509_online_append(request->origin, request->kering_id, root, sign, pkey);
expire_after = x509_online_append(&info->def, request->origin, request->keyring_id, root, sign, pkey);
if (sign[0] == '\0' && pkey[0] == '\0'){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to issue certificate");
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to sign certificate\n");
evhttp_send_error(request->evh_req, HTTP_NOTFOUND, 0);
goto finish;
}
endTime = rt_time_ns();
thread->diffTime += (endTime - startTime);
info->diffTime += (endTime - startTime);
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "%lu - %lu = %lu\n", startTime, endTime, endTime - startTime);
FS_internal_operate(SGstats.handle, thread->column_ids, SGstats.line_ids[3], FS_OP_SET, thread->diffTime);
FS_internal_operate(SGstats.handle, thread->field_ids, 0, FS_OP_ADD, 1);
FS_internal_operate(SGstats.handle, info->column_ids, SGstats.line_ids[3], FS_OP_SET, info->diffTime);
FS_internal_operate(SGstats.handle, info->field_ids, 0, FS_OP_ADD, 1);
#if 0
char *chain[6] ={0};
@@ -978,7 +988,7 @@ redis_clnt_pdu_send(struct request_t *request, redisAsyncContext *c)
#endif
xret = rediSyncCommand(c, request, request->odata, expire_after);
if (xret < 0){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to set information to redis server");
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to set information to redis server\n");
goto finish;
}
xret = 0;
@@ -992,7 +1002,7 @@ redis_clnt_send(struct request_t *request, redisReply *reply)
int xret = -1;
char odata[SG_DATA_SIZE * 2] = {0};
libevent_thread *thread = threads + request->t_id;
libevent_thread *thread = threads + request->thread_id;
if (!reply && !reply->str){
evhttp_send_error(request->evh_req, HTTP_NOTFOUND, 0);
@@ -1021,13 +1031,13 @@ void redis_get_callback(redisAsyncContext *c, void *r, void *privdata)
switch(reply->type){
case REDIS_REPLY_STRING:
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Sends the certificate information to the requestor");
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Sends the certificate information to the requestor\n");
xret = redis_clnt_send(request, reply);
break;
case REDIS_REPLY_NIL:
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Generating certificate information");
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Generating certificate information\n");
xret = redis_clnt_pdu_send(request, c);
break;
@@ -1166,11 +1176,9 @@ finish:
}
static int
thread_decode_uri(const char *uri, char *host,
int *flag, X509 **origin, int *keyring_id)
thread_decode_uri(const char *uri, X509 **origin, int *keyring_id)
{
const char *fg = NULL, *cert = NULL;
const char *ht = NULL, *id = NULL;
const char *cert = NULL, *id = NULL;
char *decoded_uri = NULL, *ecode_uri = NULL;
struct evkeyvalq params;
@@ -1179,13 +1187,6 @@ thread_decode_uri(const char *uri, char *host,
goto finish;
}
evhttp_parse_query(uri, &params);
ht = evhttp_find_header(&params, "host");
if (ht != NULL)
memcpy(host, ht, strlen(ht));
fg = evhttp_find_header(&params, "flag");
if (fg)
*flag = atoi(fg);
id = evhttp_find_header(&params, "kering_id");
if (id)
*keyring_id = atoi(id);
@@ -1205,7 +1206,7 @@ static void
evhttp_socket_close_cb(struct evhttp_connection *evcon,
void __attribute__((__unused__))*arg)
{
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Evhttp connection is broken");
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Evhttp connection is broken\n");
if (NULL == evcon){
goto finish;
}
@@ -1213,6 +1214,21 @@ finish:
return;
}
static int
x509_get_rkey(X509 *origin, int keyring_id, char *rkey)
{
unsigned int len = 0, i = 0;
char hex[EVP_MAX_MD_SIZE] = {0};
unsigned char fdig[EVP_MAX_MD_SIZE] = {0};
X509_digest(origin, EVP_sha1(), fdig, &len);
for (i = 0; i < len ; ++i){
sprintf(hex + i * sizeof(unsigned char) * 2, "%02x", fdig[i]);
}
snprintf(rkey, DATALEN, "%d:%s", keyring_id, hex);
return 0;
}
void
pthread_work_proc(struct evhttp_request *evh_req, void *arg)
{
@@ -1220,7 +1236,7 @@ pthread_work_proc(struct evhttp_request *evh_req, void *arg)
const char *cmdtype = NULL;
struct request_t *request = NULL;
struct evhttp_uri *decoded = NULL;
libevent_thread *t = (libevent_thread *)arg;
libevent_thread *info = (libevent_thread *)arg;
/* we want to know if this connection closes on us */
evhttp_connection_set_closecb(evhttp_request_get_connection(evh_req), evhttp_socket_close_cb, NULL);
@@ -1235,30 +1251,33 @@ pthread_work_proc(struct evhttp_request *evh_req, void *arg)
request = (struct request_t *) kmalloc (sizeof(struct request_t), MPF_CLR, -1);
if (request != NULL){
request->t_id = t->id;
request->thread_id = info->id;
request->evh_req = evh_req;
}
switch (evhttp_request_get_command(evh_req)) {
case EVHTTP_REQ_GET: cmdtype = "GET"; break;
default: cmdtype = "unknown"; break;
}
FS_internal_operate(SGstats.handle, t->column_ids, SGstats.line_ids[0], FS_OP_ADD, 1);
FS_internal_operate(SGstats.handle, info->column_ids, SGstats.line_ids[0], FS_OP_ADD, 1);
thread_decode_uri(uri, request->host, &request->flag, &request->origin, &request->kering_id);
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "[Thread %d]Received a %s request for %s, host:%s, flag:%d, valid:%p\nHeaders:",
request->t_id, cmdtype, uri, request->host,
request->flag, request->origin);
thread_decode_uri(uri, &request->origin, &request->keyring_id);
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "[Thread %d]Received a %s request for uri, kering_id:%d, origin:%p\n",
request->thread_id, cmdtype, request->keyring_id, request->origin);
if (request->host[0] == '\0' ||
request->origin == NULL ||
!request->evh_req){
if (request->origin == NULL || !request->evh_req){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to resolve the request url");
kfree(request);
evhttp_uri_free(decoded);
goto error;
}
xret = redisAsyncCommand(t->cl_ctx, redis_get_callback, request, "GET %s", request->host);
x509_get_rkey(request->origin, request->keyring_id, request->rkey);
if (request->rkey[0] == '\0'){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Get the redis key from the certificate failed\n");
goto error;
}
mesa_runtime_log(RLOG_LV_DEBUG, MODULE_NAME, "Redis key is %s\n", request->rkey);
xret = redisAsyncCommand(info->cl_ctx, redis_get_callback, request, "GET %s", request->rkey);
if (xret < 0)
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to get information from redis server");
@@ -1278,7 +1297,7 @@ int redis_sync_init(struct redisContext **c)
struct timeval timeout = { 1, 500000 }; // 1.5 seconds
*c = redisConnectWithTimeout(redis->r_ip, redis->r_port, timeout);
*c = redisConnectWithTimeout(redis->addr_t.r_ip, redis->addr_t.r_port, timeout);
if (*c == NULL || (*c)->err) {
if (*c) {
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Sync connection error: %s\n", (*c)->errstr);
@@ -1295,23 +1314,33 @@ finish:
}
static int
cert_task_private_init(struct event_base *base, libevent_thread *me)
task_private_init(struct event_base *base, libevent_thread *info)
{
int xret = -1;
char key_path[256] = {0}, cert_path[256] = {0};
/* Initialize the redis connection*/
xret = redis_rsync_init(base, &me->cl_ctx);
if (xret < 0 || !me->cl_ctx){
xret = redis_rsync_init(base, &info->cl_ctx);
if (xret < 0 || !info->cl_ctx){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Initialize the redis connection is failure\n");
goto finish;
}
xret = redis_sync_init(&me->sync);
if (xret < 0 || !me->sync){
xret = redis_sync_init(&info->sync);
if (xret < 0 || !info->sync){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Initialize the sync redis connection is failure\n");
goto finish;
}
/* Initialize the X509 CA*/
snprintf(key_path, sizeof(key_path), "%s/%s", cert_default_config()->def_path, DEFAULT_PRIVATEKEY_NAME);
snprintf(cert_path, sizeof(cert_path), "%s/%s", cert_default_config()->def_path, DEFAULT_CA_CERTIFICATE);
xret = x509_privatekey_init(key_path, cert_path, &info->def.key, &info->def.root);
if (xret < 0 || !(info->def.key) || !(info->def.root)){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to initialize the x509 certificate");
goto finish;
}
finish:
return xret;
}
@@ -1338,7 +1367,7 @@ static void *pthread_worker_libevent(void *arg)
}
/* Context initialization */
xret = cert_task_private_init(base, thread);
xret = task_private_init(base, thread);
if (xret < 0){
goto error;
}
@@ -1347,7 +1376,7 @@ static void *pthread_worker_libevent(void *arg)
bound = evhttp_accept_socket_with_handle(http, thread->accept_fd);
if (bound != NULL) {
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "Bound(%p) to port %d - Awaiting connections ... ", bound,
cert_default_config()->e_port);
cert_default_config()->addr_t.e_port);
}
event_base_dispatch(base);
@@ -1425,7 +1454,7 @@ libevent_socket_init()
/* Create a new evhttp object to handle requests. */
memset(&sin, 0, sizeof(struct sockaddr_in));
sin.sin_family = AF_INET;
sin.sin_port = htons(cert_default_config()->e_port);
sin.sin_port = htons(cert_default_config()->addr_t.e_port);
accept_fd = evhttp_listen_socket_byuser((struct sockaddr*)&sin, sizeof(struct sockaddr_in),
LEV_OPT_REUSEABLE_PORT|LEV_OPT_CLOSE_ON_FREE, -1);
if (accept_fd < 0) {
@@ -1496,6 +1525,7 @@ void sigproc(int __attribute__((__unused__))sig)
redisFree(thread->sync);
}
key_ring_list_destroy(rte->keyring.htable);
key_ring_list_destroy(rte->keyring.oldhtable);
}
kfree(threads);
@@ -1548,23 +1578,21 @@ static int mesa_fiel_stat_init()
void Maat_read_entry_start_cb(int update_type, void* u_para)
{
int xret = 0;
#define CM_UPDATE_TYPE_FULL 1
#define CM_UPDATE_TYPE_INC 2
struct key_ring_list *keyring = (struct key_ring_list *)u_para;
if (update_type != 1)
if (update_type != CM_UPDATE_TYPE_FULL)
goto finish;
/** The current behavior is full, and the original keyring chain is deleted */
if (keyring->htable){
key_ring_list_destroy(keyring);
}
if (keyring->oldhtable)
key_ring_list_destroy(keyring->oldhtable);
xret = key_ring_list_create(keyring);
if (xret == 0){
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "The initial keyring list was successful, addr is %p\n",
keyring->htable);
}
/*Keyring list initialization **/
keyring->oldhtable = key_ring_list_create();
keyring->sum_cnt = 0;
mesa_runtime_log(RLOG_LV_INFO, MODULE_NAME, "The initial key ring list was successful, addr is %p\n",
keyring->htable);
finish:
return;
}
@@ -1588,6 +1616,7 @@ Maat_read_entry_cb(int __attribute__((__unused__))table_id, const char* table_li
sscanf(table_line, "%d\t%d\t%s\t%s\t%s\t%s\t%lu\t%s\t%s\t%d", &pxy_obj->id, &pxy_obj->service, pxy_obj->name,
pxy_obj->type, private_file, public_file, &pxy_obj->expire_after, pxy_obj->public_algo,
pxy_obj->ctl, &pxy_obj->is_valid);
xret = x509_privatekey_init(private_file, public_file, &pxy_obj->key, &pxy_obj->root);
if (xret < 0 || !pxy_obj->key || !pxy_obj->root){
mesa_runtime_log(RLOG_LV_FATAL, MODULE_NAME, "Failed to initialize the x509 certificate, the keyring id is %d",
@@ -1604,17 +1633,12 @@ finish:
void Maat_read_entry_finish_cb(void* u_para)
{
long long version=0;
Maat_feather_t feather = u_para;
int ret = 0, is_last_updating_table = 0;
ret = Maat_inter_read_state(feather,MAAT_STATE_VERSION, &version, sizeof(version));
assert(ret==0);
ret = Maat_inter_read_state(feather,MAAT_STATE_LAST_UPDATING_TABLE, &is_last_updating_table, sizeof(is_last_updating_table));
assert(ret==0);
//printf("Maat Version %lld at plugin finish callback, is_last_update=%d.\n",version,is_last_updating_table);
MESA_htable_handle tmphtable = NULL;
struct key_ring_list *keyring = (struct key_ring_list *)u_para;
tmphtable = keyring->htable;
keyring->htable = keyring->oldhtable;
keyring->oldhtable = tmphtable;
return;
}
@@ -1648,16 +1672,11 @@ int maat_feather_init()
feather = Maat_inter_feather(rte->thread_nu, rte->info_path, logging_sc_lid.run_log_handle);
Maat_inter_set_feather_opt(feather, MAAT_OPT_INSTANCE_NAME, "certstore", strlen("certstore") + 1);
Maat_inter_set_feather_opt(feather, MAAT_OPT_JSON_FILE_PATH, rte->pxy_path, strlen(rte->pxy_path)+1);
Maat_inter_set_feather_opt(feather, MAAT_OPT_SCANDIR_INTERVAL_MS,&scan_interval_ms, sizeof(scan_interval_ms));
Maat_inter_set_feather_opt(feather, MAAT_OPT_EFFECT_INVERVAL_MS,&effective_interval_ms, sizeof(effective_interval_ms));
Maat_inter_initiate_feather(feather);
/*Keyring list initialization **/
key_ring_list_create(&rte->keyring);
sample_plugin_table(feather, "PXY_OBJ_KEYRING",
Maat_read_entry_start_cb,
Maat_read_entry_cb,
@@ -1674,6 +1693,7 @@ int cert_session_init()
maat_feather_init();
libevent_socket_init();
return 0;
}

10
src/cert_session.h
View File

@@ -12,6 +12,12 @@
#include "MESA_list_queue.h"
#include "rt_sync.h"
struct x509_object_ctx
{
X509 *root;
EVP_PKEY *key;
};
typedef struct {
int id;
@@ -21,9 +27,7 @@ typedef struct {
rt_pthread_attr *attr;
EVP_PKEY *key;
X509 *root;
struct x509_object_ctx def;
struct redisAsyncContext *cl_ctx;

10
src/cert_store.c
View File

@@ -81,13 +81,13 @@ void cert_preview ()
printf("\r\nBasic Configuration of CertStore \n");
printf("%30s:%45d\n", "The Threads", rte->thread_nu);
printf("%30s:%45s\n", "Redis Ip", rte->r_ip);
printf("%30s:%45d\n", "Redis Port", rte->r_port);
printf("%30s:%45d\n", "Libevent Port", rte->e_port);
printf("%30s:%45s\n", "Redis Ip", rte->addr_t.r_ip);
printf("%30s:%45d\n", "Redis Port", rte->addr_t.r_port);
printf("%30s:%45d\n", "Libevent Port", rte->addr_t.e_port);
printf("%30s:%45s\n", "Def Cert Path", rte->def_path);
printf("%30s:%45s\n", "Log Directory", logging_sc_lid.run_log_path);
printf("%30s:%45s\n", "Table Info", rte->info_path);
printf("%30s:%45s\n", "Pxy Obj Keyring", rte->pxy_path);
printf("%30s:%45s\n", "Log Directory", logging_sc_lid.run_log_path);
printf("\r\n");
}