tls_rpc.c

Go to the documentation of this file.

/*
 * $Id$
 *
 * TLS module - management interface
 *
 * Copyright (C) 2001-2003 FhG FOKUS
 * Copyright (C) 2005 iptelorg GmbH
 *
 * This file is part of sip-router, a free SIP server.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
#include "../../rpc.h"
#include "../../tcp_conn.h"
#include "../../tcp_info.h"
#include "../../timer.h"
#include "../../cfg/cfg.h"
#include "tls_init.h"
#include "tls_mod.h"
#include "tls_domain.h"
#include "tls_config.h"
#include "tls_util.h"
#include "tls_server.h"
#include "tls_ct_wrq.h"
#include "tls_rpc.h"
#include "tls_cfg.h"

static const char* tls_reload_doc[2] = {
        "Reload TLS configuration file",
        0
};

static void tls_reload(rpc_t* rpc, void* ctx)
{
        tls_domains_cfg_t* cfg;
        str tls_domains_cfg_file;

        tls_domains_cfg_file = cfg_get(tls, tls_cfg, config_file);
        if (!tls_domains_cfg_file.s) {
                rpc->fault(ctx, 500, "No TLS configuration file configured");
                return;
        }

             /* Try to delete old configurations first */
        collect_garbage();

        cfg = tls_load_config(&tls_domains_cfg_file);
        if (!cfg) {
                rpc->fault(ctx, 500, "Error while loading TLS configuration file"
                                                        " (consult server log)");
                return;
        }

        if (tls_fix_domains_cfg(cfg, &srv_defaults, &cli_defaults) < 0) {
                rpc->fault(ctx, 500, "Error while fixing TLS configuration"
                                                                " (consult server log)");
                goto error;
        }
        if (tls_check_sockets(cfg) < 0) {
                rpc->fault(ctx, 500, "No server listening socket found for one of"
                                                        " TLS domains (consult server log)");
                goto error;
        }

        DBG("TLS configuration successfuly loaded");
        cfg->next = (*tls_domains_cfg);
        *tls_domains_cfg = cfg;
        return;

 error:
        tls_free_cfg(cfg);
        
}


static const char* tls_list_doc[2] = {
        "List currently open TLS connections",
        0
};

extern gen_lock_t* tcpconn_lock;
extern struct tcp_connection** tcpconn_id_hash;

static void tls_list(rpc_t* rpc, void* c)
{
        char buf[128];
        char src_ip[IP_ADDR_MAX_STR_SIZE];
        char dst_ip[IP_ADDR_MAX_STR_SIZE];
        void* handle;
        char* tls_info;
        char* state;
        struct tls_extra_data* tls_d;
        struct tcp_connection* con;
        int i, len, timeout;

        TCPCONN_LOCK;
        for(i = 0; i < TCP_ID_HASH_SIZE; i++) {
                for (con = tcpconn_id_hash[i]; con; con = con->id_next) {
                        if (con->rcv.proto != PROTO_TLS) continue;
                        tls_d = con->extra_data;
                        rpc->add(c, "{", &handle);
                        /* tcp data */
                        if ((len = ip_addr2sbuf(&con->rcv.src_ip, src_ip, sizeof(src_ip)))
                                        == 0)
                                BUG("failed to convert source ip");
                        src_ip[len] = 0;
                        if ((len = ip_addr2sbuf(&con->rcv.dst_ip, dst_ip, sizeof(dst_ip)))
                                        == 0)
                                BUG("failed to convert destination ip");
                        dst_ip[len] = 0;
                        timeout = TICKS_TO_S(con->timeout - get_ticks_raw());
                        rpc->struct_add(handle, "ddsdsd",
                                        "id", con->id,
                                        "timeout", timeout,
                                        "src_ip", src_ip,
                                        "src_port", con->rcv.src_port,
                                        "dst_ip", dst_ip,
                                        "dst_port", con->rcv.dst_port);
                        if (tls_d) {
                                if(SSL_get_current_cipher(tls_d->ssl)) {
                                        tls_info = SSL_CIPHER_description(
                                                                        SSL_get_current_cipher(tls_d->ssl),
                                                                        buf, sizeof(buf));
                                        len = strlen(buf);
                                        if (len && buf[len - 1] == '\n') buf[len - 1] = '\0';
                                } else {
                                        tls_info = "unknown";
                                }
                                /* tls data */
                                state = "unknown/error";
                                lock_get(&con->write_lock);
                                        switch(tls_d->state) {
                                                case S_TLS_NONE:
                                                        state = "none/init";
                                                        break;
                                                case S_TLS_ACCEPTING:
                                                        state = "tls_accept";
                                                        break;
                                                case S_TLS_CONNECTING:
                                                        state = "tls_connect";
                                                        break;
                                                case S_TLS_ESTABLISHED:
                                                        state = "established";
                                                        break;
                                        }
                                        rpc->struct_add(handle, "sddds",
                                                        "cipher", tls_info,
                                                        "ct_wq_size", tls_d->ct_wq?
                                                                                        tls_d->ct_wq->queued:0,
                                                        "enc_rd_buf", tls_d->enc_rd_buf?
                                                                                        tls_d->enc_rd_buf->size:0,
                                                        "flags", tls_d->flags,
                                                        "state", state
                                                        );
                                lock_release(&con->write_lock);
                        } else {
                                rpc->struct_add(handle, "sddds",
                                                "cipher", "unknown",
                                                "ct_wq_size", 0,
                                                "enc_rd_buf", 0,
                                                "flags", 0,
                                                "state", "pre-init"
                                                );
                        }
                }
        }
        TCPCONN_UNLOCK;
}



static const char* tls_info_doc[2] = {
        "Returns internal tls related info.",
        0 };

static void tls_info(rpc_t* rpc, void* c)
{
        struct tcp_gen_info ti;
        void* handle;

        tcp_get_info(&ti);
        rpc->add(c, "{", &handle);
        rpc->struct_add(handle, "ddd",
                        "max_connections", ti.tls_max_connections,
                        "opened_connections", ti.tls_connections_no,
                        "clear_text_write_queued_bytes", tls_ct_wq_total_bytes());
}



static const char* tls_options_doc[2] = {
        "Dumps all the tls config options.",
        0 };

static void tls_options(rpc_t* rpc, void* c)
{
        void* handle;
        rpc->add(c, "{", &handle);
        rpc->struct_add(handle, "dSdddSSSSdSSdddddddddddddd",
                "force_run",    cfg_get(tls, tls_cfg, force_run),
                "method",               &cfg_get(tls, tls_cfg, method),
                "verify_certificate", cfg_get(tls, tls_cfg, verify_cert),

                "verify_depth",         cfg_get(tls, tls_cfg, verify_depth),
                "require_certificate",  cfg_get(tls, tls_cfg, require_cert),
                "private_key",          &cfg_get(tls, tls_cfg, private_key),
                "ca_list",                      &cfg_get(tls, tls_cfg, ca_list),
                "certificate",          &cfg_get(tls, tls_cfg, certificate),
                "cipher_list",          &cfg_get(tls, tls_cfg, cipher_list),
                "session_cache",        cfg_get(tls, tls_cfg, session_cache),
                "session_id",           &cfg_get(tls, tls_cfg, session_id),
                "config",                       &cfg_get(tls, tls_cfg, config_file),
                "log",                          cfg_get(tls, tls_cfg, log),
                "debug",                        cfg_get(tls, tls_cfg, debug),
                "connection_timeout", TICKS_TO_S(cfg_get(tls, tls_cfg, con_lifetime)),
                "disable_compression",  cfg_get(tls, tls_cfg, disable_compression),
                "ssl_release_buffers",  cfg_get(tls, tls_cfg, ssl_release_buffers),
                "ssl_freelist_max",             cfg_get(tls, tls_cfg, ssl_freelist_max),
                "ssl_max_send_fragment", cfg_get(tls, tls_cfg, ssl_max_send_fragment),
                "ssl_read_ahead",               cfg_get(tls, tls_cfg, ssl_read_ahead),
                "send_close_notify",    cfg_get(tls, tls_cfg, send_close_notify),
                "low_mem_threshold1",   cfg_get(tls, tls_cfg, low_mem_threshold1),
                "low_mem_threshold2",   cfg_get(tls, tls_cfg, low_mem_threshold2),
                "ct_wq_max",                    cfg_get(tls, tls_cfg, ct_wq_max),
                "con_ct_wq_max",                cfg_get(tls, tls_cfg, con_ct_wq_max),
                "ct_wq_blk_size",               cfg_get(tls, tls_cfg, ct_wq_blk_size)
                );
}




rpc_export_t tls_rpc[] = {
        {"tls.reload", tls_reload, tls_reload_doc, 0},
        {"tls.list",   tls_list,   tls_list_doc,   RET_ARRAY},
        {"tls.info",   tls_info,   tls_info_doc, 0},
        {"tls.options",tls_options, tls_options_doc, 0},
        {0, 0, 0, 0}
};