fix: clean SSL shutdown, reset, allowing deamon operation

diff --git a/src/apps/client.cpp b/src/apps/client.cpp
index fabd221089e2d3e0a7ccad327e5c2a162ea0a66d..8ed2ca45eacbdd8fe9f1cd4a90f4d7d2c1047894 100644 (file)
--- a/src/apps/client.cpp
+++ b/src/apps/client.cpp
@@ -50,11 +50,11 @@ int main( int argc, const char* argv[] ) {
 
     std::string path;
 
-    if( DAEMON ) {
-        path = "/etc/cacert/cassiopeia/cassiopeia.conf";
-    } else {
-        path = "config.txt";
-    }
+#ifdef NDEBUG
+    path = "/etc/cacert/cassiopeia/cassiopeia.conf";
+#else
+    path = "config.txt";
+#endif
 
     if( parseConfig( path ) != 0 ) {
         return -1;
@@ -95,6 +95,12 @@ int main( int argc, const char* argv[] ) {
                 std::cout << cert->csr_content << " content " << std::endl;
 
                 std::shared_ptr<SignedCertificate> res = sign->sign( cert );
+
+                if( !res ) {
+                    std::cout << "Error no cert came back." << std::endl;
+                    continue;
+                }
+
                 std::cout << "did it!" << res->certificate << std::endl;
                 std::string fn = writeBackFile( atoi( job->target.c_str() ), res->certificate );
                 res->crt_name = fn;

diff --git a/src/apps/signer.cpp b/src/apps/signer.cpp
index 1e1a5894fc59e6da66384ab1c714c7a3196100dd..ec85009c90a1f3ab5f3b67b7724cb46656283ad9 100644 (file)
--- a/src/apps/signer.cpp
+++ b/src/apps/signer.cpp
@@ -30,12 +30,11 @@ int main( int argc, const char* argv[] ) {
 
     std::string path;
 
-    if( DAEMON ) {
-        path = "/etc/cacert/cassiopeia/cassiopeia.conf";
-    } else {
-        path = "config.txt";
-    }
-
+#ifdef NDEBUG
+    path = "/etc/cacert/cassiopeia/cassiopeia.conf";
+#else
+    path = "config.txt";
+#endif
 
     if( parseConfig( path ) != 0 ) {
         return -1;

diff --git a/src/recordHandler.cpp b/src/recordHandler.cpp
index f259fba020a15fc10bb1e657523d13172d1bae04..7412b0c844d66230b81acdfb16a446ed4cfb4dbf 100644 (file)
--- a/src/recordHandler.cpp
+++ b/src/recordHandler.cpp
@@ -29,7 +29,7 @@ public:
     std::shared_ptr<TBSCertificate> tbs;
     std::shared_ptr<SignedCertificate> result;
 
-    SSL* ssl;
+    std::shared_ptr<SSL> ssl;
 
     std::shared_ptr<OpensslBIOWrapper> io;
     DefaultRecordHandler* parent;
@@ -40,15 +40,15 @@ public:
         this->parent = parent;
         this->signer = signer;
 
-        ssl = SSL_new( ctx.get() );
+        ssl = std::shared_ptr<SSL>( SSL_new( ctx.get() ), SSL_free );
         std::shared_ptr<BIO> bio(
             BIO_new( BIO_f_ssl() ),
             [output]( BIO * p ) {
                 BIO_free( p );
             } );
-        SSL_set_accept_state( ssl );
-        SSL_set_bio( ssl, output.get(), output.get() );
-        BIO_set_ssl( bio.get(), ssl, BIO_NOCLOSE );
+        SSL_set_accept_state( ssl.get() );
+        SSL_set_bio( ssl.get(), output.get(), output.get() );
+        BIO_set_ssl( bio.get(), ssl.get(), BIO_NOCLOSE );
         io = std::shared_ptr<OpensslBIOWrapper>( new OpensslBIOWrapper( bio ) );
     }
 
@@ -146,6 +146,10 @@ public:
                 respondCommand( RecordHeader::SignerResult::CERTIFICATE, result->certificate );
             }
 
+            if( !SSL_shutdown( ssl.get() ) && !SSL_shutdown( ssl.get() ) ) {
+                std::cout << "SSL close failed" << std::endl;
+            }
+
             break;
 
         default:

diff --git a/src/remoteSigner.cpp b/src/remoteSigner.cpp
index 5d049034b5dc59e9511bb87596f9a2b1324a2f60..a17f515c566078f1be6b0425fc66f0eece7a57f6 100644 (file)
--- a/src/remoteSigner.cpp
+++ b/src/remoteSigner.cpp
@@ -18,6 +18,8 @@ void RemoteSigner::send( std::shared_ptr<OpensslBIOWrapper> bio, RecordHeader& h
 }
 
 std::shared_ptr<SignedCertificate> RemoteSigner::sign( std::shared_ptr<TBSCertificate> cert ) {
+    ( void )BIO_reset( target.get() );
+
     std::shared_ptr<SSL> ssl( SSL_new( ctx.get() ), SSL_free );
     std::shared_ptr<BIO> bio( BIO_new( BIO_f_ssl() ), BIO_free );
     SSL_set_connect_state( ssl.get() );
@@ -64,6 +66,11 @@ std::shared_ptr<SignedCertificate> RemoteSigner::sign( std::shared_ptr<TBSCertif
     for( int i = 0; i < 2; i++ ) {
         try {
             int length = conn->read( buffer.data(), buffer.size() );
+
+            if( length == -1 ) {
+                return std::shared_ptr<SignedCertificate>();
+            }
+
             RecordHeader head;
             std::string payload = parseCommand( head, std::string( buffer.data(), length ) );
 
@@ -82,6 +89,10 @@ std::shared_ptr<SignedCertificate> RemoteSigner::sign( std::shared_ptr<TBSCertif
         }
     }
 
+    if( !SSL_shutdown( ssl.get() ) && !SSL_shutdown( ssl.get() ) ) { // need to close the connection twice
+        std::cout << "SSL shutdown failed" << std::endl;
+    }
+
     return result;
 }
 

diff --git a/src/slipBio.cpp b/src/slipBio.cpp
index da1253a6b1aa04695f8a297f6f447a337ff63077..e1739ed65e0cf61002628518925b5d13379bed7d 100644 (file)
--- a/src/slipBio.cpp
+++ b/src/slipBio.cpp
@@ -6,6 +6,9 @@
 
 #define BUFFER_SIZE 8192
 
+#define SLIP_ESCAPE_CHAR ( (char) 0xDB)
+#define SLIP_PACKET ( (char) 0xC0)
+
 char hexDigit( char c ) {
     if( c < 0 ) {
         return 'x';
@@ -60,11 +63,14 @@ SlipBIO::SlipBIO( std::shared_ptr<OpensslBIO> target ) {
 SlipBIO::~SlipBIO() {}
 
 int SlipBIO::write( const char* buf, int num ) {
+#ifdef SLIP_IO_DEBUG
     std::cout << "Out: " << toHex( buf, num ) << std::endl;
+#endif
+
     int badOnes = 0;
 
     for( int i = 0; i < num; i++ ) {
-        if( ( buf[i] == ( char )0xc0 ) || ( buf[i] == ( char )0xDB ) ) {
+        if( ( buf[i] == SLIP_PACKET ) || ( buf[i] == SLIP_ESCAPE_CHAR ) ) {
             badOnes++;
         }
     }
@@ -79,21 +85,19 @@ int SlipBIO::write( const char* buf, int num ) {
     std::shared_ptr<char> t = std::shared_ptr<char>( targetPtr, free );
     int j = 0;
 
-    //targetPtr[j++] = (char)0xC0;
-
     for( int i = 0; i < num; i++ ) {
-        if( buf[i] == ( char )0xc0 ) {
-            targetPtr[j++] = ( char )0xDB;
+        if( buf[i] == SLIP_PACKET ) {
+            targetPtr[j++] = SLIP_ESCAPE_CHAR;
             targetPtr[j++] = ( char )0xDC;
-        } else if( buf[i] == ( char )0xDB ) {
-            targetPtr[j++] = ( char )0xDB;
+        } else if( buf[i] == SLIP_ESCAPE_CHAR ) {
+            targetPtr[j++] = SLIP_ESCAPE_CHAR;
             targetPtr[j++] = ( char )0xDD;
         } else {
             targetPtr[j++] = buf[i];
         }
     }
 
-    targetPtr[j++] = ( char )0xC0;
+    targetPtr[j++] = SLIP_PACKET;
     int sent = 0;
 
     while( sent < j ) {
@@ -153,6 +157,10 @@ int SlipBIO::read( char* buf, int size ) {
         packageLeft = false;
     }
 
+#ifdef SLIP_IO_DEBUG
+    std::cout << "in: " << toHex( buf, len ) << std::endl;
+#endif
+
     return len;
 }
 
@@ -160,7 +168,17 @@ long SlipBIO::ctrl( int cmod, long arg1, void* arg2 ) {
     ( void ) cmod;
     ( void ) arg1;
     ( void ) arg2;
-    std::cout << "SLIP crtl: " << cmod << std::endl;
+
+    if( cmod == BIO_CTRL_RESET ) {
+        char resetSequence[] = {SLIP_ESCAPE_CHAR, 0, SLIP_PACKET};
+        target->write( resetSequence, 3 );
+        decodePos = 0;
+        decodeTarget = 0;
+        rawPos = 0;
+        std::cout << "resetting SLIP" << std::endl;
+        return 0;
+    }
+
     return target->ctrl( cmod, arg1, arg2 );
 }
 
@@ -172,7 +190,7 @@ bool SlipBIO::unmask() {
     unsigned int j = decodeTarget;
 
     for( unsigned int i = decodePos; i < rawPos; i++ ) {
-        if( buffer[i] == ( char ) 0xDB ) {
+        if( buffer[i] == SLIP_ESCAPE_CHAR ) {
             i++;
 
             if( i >= rawPos ) {
@@ -182,16 +200,20 @@ bool SlipBIO::unmask() {
                 rawPos = decodePos + 1;
                 return 0;// no packet
             } else if( buffer[i] == ( char )0xdc ) {
-                buffer[j++] = ( char ) 0xc0;
+                buffer[j++] = SLIP_PACKET;
             } else if( buffer[i] == ( char )0xdd ) {
-                buffer[j++] = ( char ) 0xdb;
+                buffer[j++] = SLIP_ESCAPE_CHAR;
+            } else if( buffer[i] == SLIP_PACKET ) {
+                failed = true;
+                i--;
+                continue;
             } else {
                 decodeTarget = 0;
                 failed = true;
                 // failed package
                 // error
             }
-        } else if( buffer[i] == ( char ) 0xc0 ) {
+        } else if( buffer[i] == SLIP_PACKET ) {
             decodePos = i + 1;
             decodeTarget = j;