You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by zw...@apache.org on 2019/11/19 02:30:27 UTC
[trafficserver] branch 9.0.x updated (d490b5a -> 1f029cd)
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a change to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git.
from d490b5a Removes the ssn_close hook, it can never work (#6175)
new 386d33e Add base64 encoding/decoding to encryption/decryption, and general code cleanup.
new 1f029cd Fix ssl_session_reuse to compile on macOS and FreeBSD
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../experimental/ssl_session_reuse/Makefile.inc | 26 +--
.../ssl_session_reuse/example_config.config | 2 +-
.../ssl_session_reuse/src/ats_ssl_plugin.cc | 10 +-
.../experimental/ssl_session_reuse/src/common.cc | 182 +++++++++++++++++
.../experimental/ssl_session_reuse/src/common.h | 55 ++++++
.../experimental/ssl_session_reuse/src/config.cc | 10 +-
.../experimental/ssl_session_reuse/src/message.h | 1 +
.../ssl_session_reuse/src/openssl_utils.cc | 22 +--
.../experimental/ssl_session_reuse/src/publish.cc | 97 +++++----
.../experimental/ssl_session_reuse/src/publisher.h | 1 +
.../ssl_session_reuse/src/redis_endpoint.h | 1 +
.../ssl_session_reuse/src/session_process.cc | 218 ++++++++-------------
.../ssl_session_reuse/src/session_process.h | 9 +-
.../ssl_session_reuse/src/simple_pool.h | 3 +-
.../experimental/ssl_session_reuse/src/ssl_init.cc | 38 ++--
.../ssl_session_reuse/src/ssl_key_utils.cc | 141 +++++--------
.../experimental/ssl_session_reuse/src/ssl_utils.h | 39 +---
.../ssl_session_reuse/src/subscriber.cc | 53 ++---
.../ssl_session_reuse/src/subscriber.h | 1 +
19 files changed, 508 insertions(+), 401 deletions(-)
create mode 100644 plugins/experimental/ssl_session_reuse/src/common.cc
[trafficserver] 01/02: Add base64 encoding/decoding to
encryption/decryption, and general code cleanup.
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 386d33ea11ef95ee33654dcf651a8c20c36bf7d2
Author: Fei Deng <du...@gmail.com>
AuthorDate: Fri Sep 20 11:44:43 2019 -0500
Add base64 encoding/decoding to encryption/decryption, and general code cleanup.
(cherry picked from commit af2988b468f26d76fde118c6fb6d7b1e38b27ae4)
---
.../experimental/ssl_session_reuse/Makefile.inc | 26 +--
.../ssl_session_reuse/example_config.config | 2 +-
.../ssl_session_reuse/src/ats_ssl_plugin.cc | 10 +-
.../experimental/ssl_session_reuse/src/common.cc | 182 +++++++++++++++++
.../experimental/ssl_session_reuse/src/common.h | 55 ++++++
.../experimental/ssl_session_reuse/src/config.cc | 6 +-
.../experimental/ssl_session_reuse/src/message.h | 1 +
.../ssl_session_reuse/src/openssl_utils.cc | 22 +--
.../experimental/ssl_session_reuse/src/publish.cc | 89 ++++-----
.../experimental/ssl_session_reuse/src/publisher.h | 1 +
.../ssl_session_reuse/src/redis_endpoint.h | 1 +
.../ssl_session_reuse/src/session_process.cc | 218 ++++++++-------------
.../ssl_session_reuse/src/session_process.h | 9 +-
.../ssl_session_reuse/src/simple_pool.h | 3 +-
.../experimental/ssl_session_reuse/src/ssl_init.cc | 38 ++--
.../ssl_session_reuse/src/ssl_key_utils.cc | 141 +++++--------
.../experimental/ssl_session_reuse/src/ssl_utils.h | 39 +---
.../ssl_session_reuse/src/subscriber.cc | 53 ++---
.../ssl_session_reuse/src/subscriber.h | 1 +
19 files changed, 501 insertions(+), 396 deletions(-)
diff --git a/plugins/experimental/ssl_session_reuse/Makefile.inc b/plugins/experimental/ssl_session_reuse/Makefile.inc
index 5e5a956..8984463 100644
--- a/plugins/experimental/ssl_session_reuse/Makefile.inc
+++ b/plugins/experimental/ssl_session_reuse/Makefile.inc
@@ -18,17 +18,17 @@
pkglib_LTLIBRARIES += experimental/ssl_session_reuse/ssl_session_reuse.la
experimental_ssl_session_reuse_ssl_session_reuse_la_SOURCES = \
- experimental/ssl_session_reuse/src/openssl_utils.cc \
- experimental/ssl_session_reuse/src/session_process.cc \
- experimental/ssl_session_reuse/src/ssl_init.cc \
- experimental/ssl_session_reuse/src/config.cc \
- experimental/ssl_session_reuse/src/redis_endpoint.cc \
- experimental/ssl_session_reuse/src/simple_pool.cc \
- experimental/ssl_session_reuse/src/ssl_key_utils.cc \
- experimental/ssl_session_reuse/src/connection.cc \
- experimental/ssl_session_reuse/src/publish.cc \
- experimental/ssl_session_reuse/src/subscriber.cc \
- experimental/ssl_session_reuse/src/ats_ssl_plugin.cc
-
-experimental_ssl_session_reuse_ssl_session_reuse_la_LIBADD = @LIB_HIREDIS@
+ experimental/ssl_session_reuse/src/ats_ssl_plugin.cc \
+ experimental/ssl_session_reuse/src/common.cc \
+ experimental/ssl_session_reuse/src/config.cc \
+ experimental/ssl_session_reuse/src/connection.cc \
+ experimental/ssl_session_reuse/src/openssl_utils.cc \
+ experimental/ssl_session_reuse/src/publish.cc \
+ experimental/ssl_session_reuse/src/redis_endpoint.cc \
+ experimental/ssl_session_reuse/src/session_process.cc \
+ experimental/ssl_session_reuse/src/simple_pool.cc \
+ experimental/ssl_session_reuse/src/ssl_init.cc \
+ experimental/ssl_session_reuse/src/ssl_key_utils.cc \
+ experimental/ssl_session_reuse/src/subscriber.cc
+experimental_ssl_session_reuse_ssl_session_reuse_la_LIBADD = @LIB_HIREDIS@
diff --git a/plugins/experimental/ssl_session_reuse/example_config.config b/plugins/experimental/ssl_session_reuse/example_config.config
index e74ab02..55d96a5 100644
--- a/plugins/experimental/ssl_session_reuse/example_config.config
+++ b/plugins/experimental/ssl_session_reuse/example_config.config
@@ -21,7 +21,7 @@ redis.RedisEndpoints=host1.com:6379,host2.com:6379
# in milliseconds
redis.RedisConnectTimeout=20000
# in milliseconds
-resis.RedisRetryDelay=5000000
+redis.RedisRetryDelay=5000000
## end generic redis config parameters
## start pub config settings
diff --git a/plugins/experimental/ssl_session_reuse/src/ats_ssl_plugin.cc b/plugins/experimental/ssl_session_reuse/src/ats_ssl_plugin.cc
index 81be94a..64b03df 100644
--- a/plugins/experimental/ssl_session_reuse/src/ats_ssl_plugin.cc
+++ b/plugins/experimental/ssl_session_reuse/src/ats_ssl_plugin.cc
@@ -23,16 +23,15 @@
*/
#include <cstdio>
+#include <openssl/ssl.h>
#include <ts/ts.h>
#include <ts/apidefs.h>
-#include <openssl/ssl.h>
+#include "common.h"
#include "ssl_utils.h"
PluginThreads plugin_threads;
-int SSL_session_callback(TSCont contp, TSEvent event, void *edata);
-
static int
shutdown_handler(TSCont contp, TSEvent event, void *edata)
{
@@ -49,7 +48,7 @@ TSPluginInit(int argc, const char *argv[])
info.plugin_name = (char *)("ats_session_reuse");
info.vendor_name = (char *)("ats");
- info.support_email = (char *)("ats-devel@oath.com");
+ info.support_email = (char *)("ats-devel@verizonmedia.com");
TSLifecycleHookAdd(TS_LIFECYCLE_SHUTDOWN_HOOK, TSContCreate(shutdown_handler, nullptr));
@@ -63,10 +62,11 @@ TSPluginInit(int argc, const char *argv[])
}
#endif
if (argc < 2) {
- TSError("Must specify config file");
+ TSError("Must specify config file.");
} else if (!init_ssl_params(argv[1])) {
init_subscriber();
TSCont cont = TSContCreate(SSL_session_callback, nullptr);
+ TSDebug(PLUGIN, "TSPluginInit adding TS_SSL_SESSION_HOOK.");
TSHttpHookAdd(TS_SSL_SESSION_HOOK, cont);
} else {
TSError("init_ssl_params failed.");
diff --git a/plugins/experimental/ssl_session_reuse/src/common.cc b/plugins/experimental/ssl_session_reuse/src/common.cc
new file mode 100644
index 0000000..e552c5a
--- /dev/null
+++ b/plugins/experimental/ssl_session_reuse/src/common.cc
@@ -0,0 +1,182 @@
+/** @file
+
+ common.cc - Some common functions everyone needs
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ */
+
+#include <cstdio>
+#include <cstring>
+#include <openssl/ssl.h>
+#include <ts/ts.h>
+#include <ts/apidefs.h>
+
+#include "common.h"
+
+const unsigned char salt[] = {115, 97, 108, 117, 0, 85, 137, 229};
+
+std::string
+hex_str(std::string str)
+{
+ std::string hex_str = "";
+ for (char &c : str) {
+ std::stringstream stream;
+ stream << std::hex << std::setfill('0') << std::setw(2) << (0xFF & static_cast<unsigned int>(c));
+ hex_str += stream.str();
+ }
+ return hex_str;
+}
+
+int
+encrypt_encode64(const unsigned char *key, int key_length, const unsigned char *in_data, int in_data_len, char *out_data,
+ size_t out_data_size, size_t *out_data_len)
+{
+ if (!key || !in_data || !out_data || !out_data_len) {
+ return -1;
+ }
+
+ int cipher_block_size = 0;
+ unsigned char *encrypted = nullptr;
+ int encrypted_len = 0;
+ int encrypted_len_extra = 0;
+ int ret = -1;
+
+ // Initialize context
+ EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new();
+ unsigned char iv[EVP_MAX_IV_LENGTH];
+ unsigned char gen_key[EVP_MAX_KEY_LENGTH];
+
+ // generate key and iv
+ if (EVP_BytesToKey(EVP_aes_256_cbc(), EVP_md5(), salt, key, key_length, 1, gen_key, iv) <= 0) {
+ TSDebug(PLUGIN, "Error generating key.");
+ }
+
+ // Set context AES128 with the generated key and iv
+ if (1 != EVP_EncryptInit_ex(context, EVP_aes_256_cbc(), nullptr, gen_key, iv)) {
+ TSDebug(PLUGIN, "EVP_EncryptInit_ex failed.");
+ goto Cleanup;
+ }
+
+ // https://www.openssl.org/docs/manmaster/man3/EVP_EncryptUpdate.html
+ // EVP_EncryptUpdate() needs (inl + cipher_block_size - 1) bytes.
+ // EVP_EncryptFinal_ex needs (inl + cipher_block_size) bytes.
+ cipher_block_size = EVP_CIPHER_CTX_block_size(context);
+ encrypted = new unsigned char[in_data_len + cipher_block_size * 2];
+ if (1 != EVP_EncryptUpdate(context, encrypted, &encrypted_len, in_data, in_data_len)) {
+ TSDebug(PLUGIN, "EVP_EncryptUpdate failed.");
+ goto Cleanup;
+ }
+
+ if (1 != EVP_EncryptFinal_ex(context, encrypted + encrypted_len, &encrypted_len_extra)) {
+ TSDebug(PLUGIN, "EVP_EncryptFinal_ex failed.");
+ goto Cleanup;
+ }
+
+ // We must encode it to base64 here, since the encryption doesn't guarantee that there are no
+ // null bytes in the output. Which will cause a problem when sending it through redis since
+ // the redis command needs to be formatted to a C string.
+ if (TSBase64Encode(reinterpret_cast<char *>(encrypted), encrypted_len + encrypted_len_extra, out_data, out_data_size,
+ out_data_len) != 0) {
+ TSDebug(PLUGIN, "Base 64 encoding failed.");
+ goto Cleanup;
+ }
+
+ TSDebug(PLUGIN, "Encrypted buffer of size %d to buffer of size %lu.", in_data_len, *out_data_len);
+ ret = 0;
+
+Cleanup:
+
+ if (encrypted) {
+ delete[] encrypted;
+ }
+
+ if (context) {
+ EVP_CIPHER_CTX_free(context);
+ }
+
+ return ret;
+}
+
+int
+decrypt_decode64(const unsigned char *key, int key_length, const char *in_data, int in_data_len, unsigned char *out_data,
+ size_t out_data_size, size_t *out_data_len)
+{
+ if (!key || !in_data || !out_data || !out_data_len) {
+ return -1;
+ }
+
+ size_t decoded_size = DECODED_LEN(in_data_len);
+ size_t decoded_len = 0;
+ unsigned char *decoded = new unsigned char[decoded_size];
+ int decrypted_len = 0;
+ int decrypted_len_extra = 0;
+ int ret = -1;
+
+ // Initialize context
+ EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new();
+ unsigned char iv[EVP_MAX_IV_LENGTH];
+ unsigned char gen_key[EVP_MAX_KEY_LENGTH];
+
+ // Decode base64
+ std::memset(decoded, 0, decoded_size);
+ if (TSBase64Decode(in_data, in_data_len, decoded, decoded_size, &decoded_len) != 0) {
+ TSDebug(PLUGIN, "Base 64 decoding failed.");
+ goto Cleanup;
+ }
+
+ // generate key and iv
+ if (EVP_BytesToKey(EVP_aes_256_cbc(), EVP_md5(), salt, key, key_length, 1, gen_key, iv) <= 0) {
+ TSDebug(PLUGIN, "Error generating key.");
+ }
+ // set context with the generated key and iv
+ if (1 != EVP_DecryptInit_ex(context, EVP_aes_256_cbc(), nullptr, gen_key, iv)) {
+ TSDebug(PLUGIN, "EVP_DecryptInit_ex failed.");
+ goto Cleanup;
+ }
+
+ // https://www.openssl.org/docs/manmaster/man3/EVP_DecryptUpdate.html
+ // EVP_DecryptUpdate() and EVP_DecryptFinal_ex() have the exact same requirements as their encrypt counterparts.
+ if (1 != EVP_DecryptUpdate(context, out_data, &decrypted_len, decoded, decoded_len)) {
+ TSDebug(PLUGIN, "EVP_DecryptUpdate failed.");
+ goto Cleanup;
+ }
+
+ if (1 != EVP_DecryptFinal_ex(context, out_data + decrypted_len, &decrypted_len_extra)) {
+ TSDebug(PLUGIN, "EVP_DecryptFinal_ex failed.");
+ goto Cleanup;
+ }
+
+ *out_data_len = decrypted_len + decrypted_len_extra;
+
+ TSDebug(PLUGIN, "Decrypted buffer of size %d to buffer of size %lu.", in_data_len, *out_data_len);
+ ret = 0;
+
+Cleanup:
+
+ if (decoded) {
+ delete[] decoded;
+ }
+
+ if (context) {
+ EVP_CIPHER_CTX_free(context);
+ }
+
+ return ret;
+}
diff --git a/plugins/experimental/ssl_session_reuse/src/common.h b/plugins/experimental/ssl_session_reuse/src/common.h
index 86b158e..bcec00b 100644
--- a/plugins/experimental/ssl_session_reuse/src/common.h
+++ b/plugins/experimental/ssl_session_reuse/src/common.h
@@ -23,6 +23,61 @@
*/
#pragma once
+#include <iostream>
+#include <sstream>
+#include <iomanip>
+#include <string>
+#include <cstring>
+#include <mutex>
+#include <deque>
+#include <cmath>
+
#define PLUGIN "ssl_session_reuse"
+// Base 64 encoding takes 4*(ceil(n/3)) bytes
+#define ENCODED_LEN(len) (((int)ceil(1.34 * (len) + 5)) + 1)
+#define DECODED_LEN(len) (((int)ceil(0.75 * (len))) + 1)
+// 3DES encryption will take at most 8 extra bytes. Plus we base 64 encode the result
+#define ENCRYPT_LEN(len) ((int)ceil(1.34 * ((len) + 8) + 5) + 1)
+#define DECRYPT_LEN(len) ((int)ceil(1.34 * ((len) + 8) + 5) + 1)
+
+class PluginThreads
+{
+public:
+ void
+ store(const pthread_t &th)
+ {
+ std::lock_guard<std::mutex> lock(threads_mutex);
+ threads_queue.push_back(th);
+ }
+
+ void
+ terminate()
+ {
+ std::lock_guard<std::mutex> lock(threads_mutex);
+ for (pthread_t th : threads_queue) {
+ ::pthread_cancel(th);
+ }
+ while (!threads_queue.empty()) {
+ pthread_t th = threads_queue.front();
+ ::pthread_join(th, nullptr);
+ threads_queue.pop_front();
+ }
+ }
+
+private:
+ std::deque<pthread_t> threads_queue;
+ std::mutex threads_mutex;
+};
+
+std::string hex_str(std::string str);
+
+int encrypt_encode64(const unsigned char *key, int key_length, const unsigned char *in_data, int in_data_len, char *out_data,
+ size_t out_data_size, size_t *out_data_len);
+
+int decrypt_decode64(const unsigned char *key, int key_length, const char *in_data, int in_data_len, unsigned char *out_data,
+ size_t out_data_size, size_t *out_data_len);
+
extern const unsigned char salt[];
+
+extern PluginThreads plugin_threads;
diff --git a/plugins/experimental/ssl_session_reuse/src/config.cc b/plugins/experimental/ssl_session_reuse/src/config.cc
index 7f39271..65f81a5 100644
--- a/plugins/experimental/ssl_session_reuse/src/config.cc
+++ b/plugins/experimental/ssl_session_reuse/src/config.cc
@@ -22,17 +22,17 @@
*/
-#include <ts/ts.h>
-#include <ts/apidefs.h>
#include <cstring>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
-#include "tscpp/util/TextView.h"
+#include <ts/ts.h>
+#include <ts/apidefs.h>
#include "Config.h"
#include "common.h"
+#include "tscpp/util/TextView.h"
Config::Config()
{
diff --git a/plugins/experimental/ssl_session_reuse/src/message.h b/plugins/experimental/ssl_session_reuse/src/message.h
index 41e94c0..9196085 100644
--- a/plugins/experimental/ssl_session_reuse/src/message.h
+++ b/plugins/experimental/ssl_session_reuse/src/message.h
@@ -25,6 +25,7 @@
#include <string>
#include <set>
+
#include "redis_endpoint.h"
typedef struct message {
diff --git a/plugins/experimental/ssl_session_reuse/src/openssl_utils.cc b/plugins/experimental/ssl_session_reuse/src/openssl_utils.cc
index 2909e72..0cff9ca 100644
--- a/plugins/experimental/ssl_session_reuse/src/openssl_utils.cc
+++ b/plugins/experimental/ssl_session_reuse/src/openssl_utils.cc
@@ -22,16 +22,15 @@
*/
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <unistd.h>
-#include <fcntl.h>
#include <cstring>
-#include <pthread.h>
#include <cerrno>
#include <cmath>
-#include <openssl/rand.h>
+#include <unistd.h>
+#include <fcntl.h>
#include <pthread.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <openssl/rand.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <ts/ts.h>
@@ -48,28 +47,28 @@ ssl_new_session(TSSslSessionID &sid)
std::string encoded_id;
int ret = encode_id(sid.bytes, sid.len, encoded_id);
if (ret < 0) {
- TSError("encoded id failed.");
+ TSError("Encoded id failed.");
return 0;
}
int session_ret_len = SSL_SESSION_MAX_DER;
char session_data[SSL_SESSION_MAX_DER];
if (!TSSslSessionGetBuffer(&sid, session_data, &session_ret_len)) {
- TSError("session data is too large. %d", session_ret_len);
+ TSError("Session data is too large: %d", session_ret_len);
return 0;
}
std::string encrypted_data;
ret = encrypt_session(session_data, session_ret_len, (unsigned char *)get_key_ptr(), get_key_length(), encrypted_data);
if (ret < 0) {
- TSError("encrypt_session failed.");
+ TSError("Encrypt_session failed.");
return 0;
}
std::string redis_channel = ssl_param.cluster_name + "." + encoded_id;
ssl_param.pub->publish(redis_channel, encrypted_data);
- TSDebug(PLUGIN, "create new session id: %s encoded: \"%s\" channel: %s", encoded_id.c_str(), encrypted_data.c_str(),
+ TSDebug(PLUGIN, "Create new session id: %s encoded: %s channel: %s", encoded_id.c_str(), encrypted_data.c_str(),
redis_channel.c_str());
return 0;
@@ -88,7 +87,7 @@ ssl_del_session(TSSslSessionID &sid)
int ret = encode_id(sid.bytes, sid.len, encoded_id);
if (!ret) {
- TSDebug(PLUGIN, "session is deleted. id: \"%s\"", encoded_id.c_str());
+ TSDebug(PLUGIN, "Session is deleted. id: %s", encoded_id.c_str());
}
return 0;
@@ -97,6 +96,7 @@ ssl_del_session(TSSslSessionID &sid)
int
SSL_session_callback(TSCont contp, TSEvent event, void *edata)
{
+ TSDebug(PLUGIN, "SSL_session_callback event: %d", event);
TSSslSessionID *sessionid = reinterpret_cast<TSSslSessionID *>(edata);
switch (event) {
diff --git a/plugins/experimental/ssl_session_reuse/src/publish.cc b/plugins/experimental/ssl_session_reuse/src/publish.cc
index 7942606..0877155 100644
--- a/plugins/experimental/ssl_session_reuse/src/publish.cc
+++ b/plugins/experimental/ssl_session_reuse/src/publish.cc
@@ -22,13 +22,14 @@
*/
-#include <sys/time.h>
-#include <unistd.h>
#include <iostream>
#include <exception>
#include <cstring>
#include <memory>
+#include <unistd.h>
+#include <sys/time.h>
#include <ts/ts.h>
+
#include "common.h"
#include "publisher.h"
#include "Config.h"
@@ -49,14 +50,12 @@ RedisPublisher::start_worker_thread(void *arg)
RedisPublisher::RedisPublisher(const std::string &conf)
: m_redisEndpointsStr(cDefaultRedisEndpoint),
-
m_numWorkers(cPubNumWorkerThreads),
m_redisConnectTimeout(cDefaultRedisConnectTimeout),
m_redisConnectTries(cDefaultRedisConnectTries),
m_redisPublishTries(cDefaultRedisPublishTries),
m_redisRetryDelay(cDefaultRedisRetryDelay),
m_maxQueuedMessages(cDefaultMaxQueuedMessages)
-
{
if (Config::getSingleton().loadConfig(conf)) {
Config::getSingleton().getValue("pubconfig", "PubNumWorkers", m_numWorkers);
@@ -73,7 +72,7 @@ RedisPublisher::RedisPublisher(const std::string &conf)
char redis_auth_key[MAX_REDIS_KEYSIZE];
if (!(get_redis_auth_key(redis_auth_key, MAX_REDIS_KEYSIZE))) {
err = true;
- TSError("RedisPublisher::RedisPublisher.Cannot get redis AUTH password.");
+ TSError("RedisPublisher::RedisPublisher: Cannot get redis AUTH password.");
redis_passwd.clear();
} else {
redis_passwd = redis_auth_key;
@@ -82,25 +81,24 @@ RedisPublisher::RedisPublisher(const std::string &conf)
addto_endpoint_vector(m_redisEndpoints, m_redisEndpointsStr);
- TSDebug(PLUGIN, "RedisPublisher::RedisPublisher.NumWorkers= %d RedisConnectTimeout=%d", m_numWorkers, m_redisConnectTimeout);
+ TSDebug(PLUGIN, "RedisPublisher::RedisPublisher: NumWorkers: %d RedisConnectTimeout: %d", m_numWorkers, m_redisConnectTimeout);
TSDebug(PLUGIN,
- "RedisPublisher::RedisPublisher.RedisPublishTries= %d RedisConnectTries=%d RedisRetryDelay=%d MaxQueuedMessages=%d",
+ "RedisPublisher::RedisPublisher: RedisPublishTries: %d RedisConnectTries: %d RedisRetryDelay: %d MaxQueuedMessages: %d",
m_redisPublishTries, m_redisConnectTries, m_redisRetryDelay, m_maxQueuedMessages);
- TSDebug(PLUGIN, "RedisPublisher::RedisPublisher.Redis Publish endpoints are as follows:");
+ TSDebug(PLUGIN, "RedisPublisher::RedisPublisher: Redis Publish endpoints are as follows:");
for (std::vector<RedisEndpoint>::iterator it = m_redisEndpoints.begin(); it != m_redisEndpoints.end(); ++it) {
- // LOGDEBUG(PUB, *it);
simple_pool *pool = simple_pool::create(it->m_hostname, it->m_port, m_poolRedisConnectTimeout);
pools.push_back(pool);
}
- TSDebug(PLUGIN, "RedisPublisher::RedisPublisher.PoolRedisConnectTimeout= %d", m_poolRedisConnectTimeout);
+ TSDebug(PLUGIN, "RedisPublisher::RedisPublisher: PoolRedisConnectTimeout: %d", m_poolRedisConnectTimeout);
::sem_init(&m_workerSem, 0, 0);
if (m_redisEndpoints.size() > m_numWorkers) {
err = true;
- TSError("RedisPublisher::RedisPublisher.Number of threads in the thread pool less than the number of redis endpoints");
+ TSError("RedisPublisher::RedisPublisher: Number of threads in the thread pool less than the number of redis endpoints.");
}
if (!err) {
@@ -120,7 +118,7 @@ RedisPublisher::is_good()
RedisPublisher::setup_connection(const RedisEndpoint &re)
{
::pthread_t my_id = ::pthread_self();
- TSDebug(PLUGIN, "RedisPublisher::setup_connection.called by threadId: %d", static_cast<int>(my_id));
+ TSDebug(PLUGIN, "RedisPublisher::setup_connection: Called by threadId: %lx", my_id);
RedisContextPtr my_context;
struct ::timeval timeout;
@@ -130,33 +128,32 @@ RedisPublisher::setup_connection(const RedisEndpoint &re)
for (int i = 0; i < static_cast<int>(m_redisConnectTries); ++i) {
my_context.reset(::redisConnectWithTimeout(re.m_hostname.c_str(), re.m_port, timeout));
if (!my_context) {
- TSError("RedisPublisher::setup_connection.connect to host: %s and port: %d fail count: %d threadId: %d",
- re.m_hostname.c_str(), re.m_port, i + 1, static_cast<int>(my_id));
+ TSError("RedisPublisher::setup_connection: Connect to host: %s port: %d fail count: %d threadId: %lx", re.m_hostname.c_str(),
+ re.m_port, i + 1, my_id);
} else if (my_context->err) {
- TSError("RedisPublisher::setup_connection.connect to host: %s port: %d fail count: %d and threadId: %d",
- re.m_hostname.c_str(), re.m_port, i + 1, static_cast<int>(my_id));
+ TSError("RedisPublisher::setup_connection: Connect to host: %s port: %d fail count: %d threadId: %lx", re.m_hostname.c_str(),
+ re.m_port, i + 1, my_id);
my_context.reset(nullptr);
} else {
- TSDebug(PLUGIN, "RedisPublisher::setup_connection.threadId: %d successfully connected to the redis instance",
- static_cast<int>(my_id));
+ TSDebug(PLUGIN, "RedisPublisher::setup_connection: threadId: %lx Successfully connected to the redis instance.", my_id);
redisReply *reply = static_cast<redisReply *>(redisCommand(my_context.get(), "AUTH %s", redis_passwd.c_str()));
if (reply == nullptr) {
- TSError("RedisPublisher::setup_connection. Cannot AUTH redis server, no reply.");
+ TSError("RedisPublisher::setup_connection: Cannot AUTH redis server, no reply.");
my_context.reset(nullptr);
} else if (reply->type == REDIS_REPLY_ERROR) {
- TSError("RedisPublisher::setup_connection. Cannot AUTH redis server, error reply.");
+ TSError("RedisPublisher::setup_connection: Cannot AUTH redis server, error reply.");
freeReplyObject(reply);
my_context.reset(nullptr);
} else {
- TSDebug(PLUGIN, "RedisPublisher::setup_connection. Successfully AUTH redis server.");
+ TSDebug(PLUGIN, "RedisPublisher::setup_connection: Successfully AUTH redis server.");
freeReplyObject(reply);
}
break;
}
- TSError("RedisPublisher::setup_connection.connect failed.will wait for: %d microseconds and try again.", m_redisRetryDelay);
+ TSError("RedisPublisher::setup_connection: Connect failed, will wait for: %d microseconds and try again.", m_redisRetryDelay);
::usleep(m_redisRetryDelay);
}
@@ -167,7 +164,7 @@ RedisPublisher::setup_connection(const RedisEndpoint &re)
RedisPublisher::send_publish(RedisContextPtr &ctx, const RedisEndpoint &re, const Message &msg)
{
::pthread_t my_id = ::pthread_self();
- TSDebug(PLUGIN, "RedisPublisher::send_publish.called by threadId: %d", static_cast<int>(my_id));
+ TSDebug(PLUGIN, "RedisPublisher::send_publish: Called by threadId: %lx", my_id);
::redisReply *current_reply(nullptr);
@@ -176,21 +173,20 @@ RedisPublisher::send_publish(RedisContextPtr &ctx, const RedisEndpoint &re, cons
ctx.reset(setup_connection(re));
if (!ctx) {
- TSError("RedisPublisher::send_publish.Unable to setup a connection to the redis server: %s:%d .ThreadId: %d Try: %d",
- re.m_hostname.c_str(), re.m_port, static_cast<int>(my_id), (i + 1));
+ TSError("RedisPublisher::send_publish: Unable to setup a connection to the redis server: %s:%d threadId: %lx try: %d",
+ re.m_hostname.c_str(), re.m_port, my_id, (i + 1));
continue;
}
}
current_reply = static_cast<redisReply *>(::redisCommand(ctx.get(), "PUBLISH %s %s", msg.channel.c_str(), msg.data.c_str()));
if (!current_reply) {
- TSError("RedisPublisher::send_publish.Unable to get a reply from the server for publish.ThreadId: %d Try: %d",
- static_cast<int>(my_id), (i + 1));
+ TSError("RedisPublisher::send_publish: Unable to get a reply from the server for publish. threadId: %lx try: %d", my_id,
+ (i + 1));
ctx.reset(nullptr); // Clean up previous attempt
} else if (REDIS_REPLY_ERROR == current_reply->type) {
- TSError("RedisPublisher::send_publish.Server responded with error for publish.ThreadId: %d Try: %d", static_cast<int>(my_id),
- i + 1);
+ TSError("RedisPublisher::send_publish: Server responded with error for publish. threadId: %lx try: %d", my_id, i + 1);
clear_reply(current_reply);
current_reply = nullptr;
ctx.reset(nullptr); // Clean up previous attempt
@@ -243,7 +239,8 @@ RedisPublisher::runWorker()
continue;
}
- Message ¤t_message(m_messageQueue.front());
+ // Can't do reference here, since we pop it off the queue, the reference will be invalid.
+ Message current_message(m_messageQueue.front());
if (!current_message.cleanup) {
m_messageQueue.pop_front();
}
@@ -252,7 +249,7 @@ RedisPublisher::runWorker()
::sem_wait(&m_workerSem);
if (current_message.cleanup) {
- TSDebug(PLUGIN, "RedisPublisher::runWorker.Thread id: %d received the cleanup message. exiting!", static_cast<int>(my_id));
+ TSDebug(PLUGIN, "RedisPublisher::runWorker: threadId: %lx received the cleanup message. Exiting!", my_id);
break;
}
current_reply = send_publish(my_context, my_endpoint, current_message);
@@ -284,8 +281,8 @@ RedisPublisher::runWorker()
int
RedisPublisher::publish(const std::string &channel, const std::string &data)
{
- TSDebug(PLUGIN, "RedisPublisher::publish.Publish request for channel: %s and message: \"%s\" received", channel.c_str(),
- data.c_str());
+ TSDebug(PLUGIN, "RedisPublisher::publish: Publish request for channel: %s and message: \"%s\" received.", channel.c_str(),
+ hex_str(data).c_str());
m_messageQueueMutex.lock();
@@ -302,7 +299,7 @@ RedisPublisher::publish(const std::string &channel, const std::string &data)
int
RedisPublisher::signal_cleanup()
{
- TSDebug(PLUGIN, "RedisPublisher::signal_cleanup.called");
+ TSDebug(PLUGIN, "RedisPublisher::signal_cleanup: Called.");
Message cleanup_message("", "", true);
m_messageQueueMutex.lock();
@@ -316,7 +313,7 @@ RedisPublisher::signal_cleanup()
RedisPublisher::~RedisPublisher()
{
- TSDebug(PLUGIN, "RedisPublisher::~RedisPublisher.called");
+ TSDebug(PLUGIN, "RedisPublisher::~RedisPublisher: Called.");
RedisPublisher::signal_cleanup();
::sem_destroy(&m_workerSem);
@@ -325,18 +322,18 @@ RedisPublisher::~RedisPublisher()
std::string
RedisPublisher::get_session(const std::string &channel)
{
- TSDebug(PLUGIN, "RedisPublisher::get_session. Called by threadId: %d", static_cast<int>(pthread_self()));
+ TSDebug(PLUGIN, "RedisPublisher::get_session: Called by threadId: %lx", ::pthread_self());
std::string ret;
uint32_t index = get_hash_index(channel);
redisReply *reply = nullptr;
- TSDebug(PLUGIN, "RedisPublisher::get_session. Start to try to get session.");
+ TSDebug(PLUGIN, "RedisPublisher::get_session: Start to try to get session.");
for (uint32_t i = 0; i < m_redisEndpoints.size(); i++) {
connection *conn = pools[index]->get();
if (conn) {
reply = static_cast<redisReply *>(redisCommand(conn->c_ptr(), "GET %s", channel.c_str()));
if (reply && reply->type == REDIS_REPLY_STRING) {
- TSDebug(PLUGIN, "RedisPublisher::get_session. Success to GET a value from redis server index: %d", index);
+ TSDebug(PLUGIN, "RedisPublisher::get_session: Success to GET a value from redis server index: %d", index);
pools[index]->put(conn);
ret = reply->str;
clear_reply(reply);
@@ -345,19 +342,19 @@ RedisPublisher::get_session(const std::string &channel)
pools[index]->put(conn);
clear_reply(reply);
}
- TSError("RedisPublisher::get_session. Fail to GET a value from this redis server index: %d", index);
+ TSError("RedisPublisher::get_session: Fail to GET a value from this redis server index: %d", index);
index = get_next_index(index);
- TSDebug(PLUGIN, "RedisPublisher::get_session. Will try the next redis server: %d", index);
+ TSDebug(PLUGIN, "RedisPublisher::get_session: Will try the next redis server: %d", index);
}
- TSError("RedisPublisher::get_session. Fail to GET a value from all redis servers!");
+ TSError("RedisPublisher::get_session: Fail to GET a value from all redis servers!");
return ret;
}
redisReply *
RedisPublisher::set_session(const Message &msg)
{
- TSDebug(PLUGIN, "RedisPublisher::set_session. Called by threadId: %d", static_cast<int>(pthread_self()));
+ TSDebug(PLUGIN, "RedisPublisher::set_session: Called by threadId: %lx", ::pthread_self());
uint32_t index = get_hash_index(msg.channel);
redisReply *reply = nullptr;
for (uint32_t i = 0; i < m_redisEndpoints.size(); i++) {
@@ -366,7 +363,7 @@ RedisPublisher::set_session(const Message &msg)
if (conn) {
reply = static_cast<redisReply *>(redisCommand(conn->c_ptr(), "SET %s %s", msg.channel.c_str(), msg.data.c_str()));
if (reply && reply->type == REDIS_REPLY_STATUS && strcasecmp(reply->str, "OK") == 0) {
- TSDebug(PLUGIN, "RedisPublisher::set_session. Success to SET a value to redis server: %s:%d",
+ TSDebug(PLUGIN, "RedisPublisher::set_session: Success to SET a value to redis server: %s:%d",
m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port);
pools[index]->put(conn);
return reply;
@@ -374,14 +371,14 @@ RedisPublisher::set_session(const Message &msg)
pools[index]->put(conn);
clear_reply(reply);
}
- TSError("RedisPublisher::set_session. Fail to SET a value to this redis server %s:%d",
+ TSError("RedisPublisher::set_session: Fail to SET a value to this redis server %s:%d",
m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port);
index = get_next_index(index);
- TSDebug(PLUGIN, "RedisPublisher::set_session. Will try the next redis server: %s:%d",
+ TSDebug(PLUGIN, "RedisPublisher::set_session: Will try the next redis server: %s:%d",
m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port);
}
- TSError("RedisPublisher::set_session. Fail to SET a value to all redis servers!");
+ TSError("RedisPublisher::set_session: Fail to SET a value to all redis servers!");
return nullptr;
}
diff --git a/plugins/experimental/ssl_session_reuse/src/publisher.h b/plugins/experimental/ssl_session_reuse/src/publisher.h
index 82fec01..a76880c 100644
--- a/plugins/experimental/ssl_session_reuse/src/publisher.h
+++ b/plugins/experimental/ssl_session_reuse/src/publisher.h
@@ -30,6 +30,7 @@
#include <memory>
#include <semaphore.h>
#include <hiredis/hiredis.h>
+
#include "message.h"
#include "globals.h"
#include "redis_endpoint.h"
diff --git a/plugins/experimental/ssl_session_reuse/src/redis_endpoint.h b/plugins/experimental/ssl_session_reuse/src/redis_endpoint.h
index 2762d9b..55ff737 100644
--- a/plugins/experimental/ssl_session_reuse/src/redis_endpoint.h
+++ b/plugins/experimental/ssl_session_reuse/src/redis_endpoint.h
@@ -25,6 +25,7 @@
#include <string>
#include <vector>
+
#include "globals.h"
typedef struct redis_endpoint {
diff --git a/plugins/experimental/ssl_session_reuse/src/session_process.cc b/plugins/experimental/ssl_session_reuse/src/session_process.cc
index be6e029..1d843f4 100644
--- a/plugins/experimental/ssl_session_reuse/src/session_process.cc
+++ b/plugins/experimental/ssl_session_reuse/src/session_process.cc
@@ -32,88 +32,45 @@
#include "session_process.h"
#include "ssl_utils.h"
-
#include "common.h"
-const unsigned char salt[] = {115, 97, 108, 117, 0, 85, 137, 229};
+const uint64_t protocol_version = 2;
int
encrypt_session(const char *session_data, int32_t session_data_len, const unsigned char *key, int key_length,
std::string &encrypted_data)
{
- size_t len_all = 0;
- size_t offset = 0;
- char *pBuf = nullptr;
-
- int encrypted_buffer_size = 0;
- int encrypted_msg_len = 0;
- unsigned char *encrypted_msg = nullptr;
- int ret = 0;
-
- offset = 0;
- len_all = sizeof(int64_t) + sizeof(int32_t) + session_data_len;
+ if (!key || !session_data) {
+ return -1;
+ }
- pBuf = new char[len_all];
+ int data_len = sizeof(int64_t) + sizeof(int32_t) + session_data_len;
+ unsigned char *data = new unsigned char[data_len];
+ int offset = 0;
+ size_t encrypted_size = ENCODED_LEN(data_len + EVP_MAX_BLOCK_LENGTH * 2);
+ size_t encrypted_len = 0;
+ char *encrypted = new char[encrypted_size];
+ int ret = 0;
- // Put in a fixed experation time of 7 hours, just to have communication consistency with the original
- // protocol
- int64_t expire_time = time(nullptr) + 2 * 3600;
- memcpy(pBuf + offset, &expire_time, sizeof(expire_time));
+ // Transition the expiration time into a protocol version field.
+ // Keeping it unnecessarily long at 64 bits to have consistency with previous version
+ // Version 1, had a fixed expiration time of 2*3600 seconds
+ std::memcpy(data + offset, &protocol_version, sizeof(int64_t));
offset += sizeof(int64_t);
-
- memcpy(pBuf + offset, &session_data_len, sizeof(int32_t));
+ std::memcpy(data + offset, &session_data_len, sizeof(int32_t));
offset += sizeof(session_data_len);
- memcpy(pBuf + offset, session_data, session_data_len);
-
- // Initialize context
- EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new();
- unsigned char iv[EVP_MAX_IV_LENGTH];
- unsigned char gen_key[EVP_MAX_KEY_LENGTH];
-
- // generate key and iv
- int generated_key_len = EVP_BytesToKey(EVP_aes_256_cbc(), EVP_md5(), (unsigned char *)salt, key, key_length, 1, gen_key, iv);
- if (generated_key_len <= 0) {
- TSDebug(PLUGIN, "Error generating key");
- }
-
- // Set context AES128 with the generated key and iv
- if (1 != EVP_EncryptInit_ex(context, EVP_aes_256_cbc(), nullptr, gen_key, iv)) {
- TSDebug(PLUGIN, "Encryption of session data failed");
- ret = -1;
- goto Cleanup;
- }
+ std::memcpy(data + offset, session_data, session_data_len);
- int elen;
- encrypted_buffer_size = ENCRYPT_LEN(len_all);
- encrypted_msg = new unsigned char[encrypted_buffer_size];
- if (1 != EVP_EncryptUpdate(context, encrypted_msg, &elen, reinterpret_cast<unsigned char *>(pBuf), len_all)) {
- TSDebug(PLUGIN, "Encryption of session data failed");
- ret = -1;
- goto Cleanup;
- }
- encrypted_msg_len = elen;
- if (1 != EVP_EncryptFinal_ex(context, encrypted_msg + elen, &elen)) {
- TSDebug(PLUGIN, "Encryption of session data failed");
- ret = -1;
- goto Cleanup;
+ std::memset(encrypted, 0, encrypted_size);
+ ret = encrypt_encode64(key, key_length, data, data_len, encrypted, encrypted_size, &encrypted_len);
+ if (ret == 0) {
+ encrypted_data.assign(encrypted, encrypted_len);
+ } else {
+ TSDebug(PLUGIN, "Session data encryption failed.");
}
- encrypted_msg_len += elen;
- TSDebug(PLUGIN, "Encrypted buffer of size %d to buffer of size %d\n", session_data_len, encrypted_msg_len);
-
- encrypted_data.assign(reinterpret_cast<char *>(encrypted_msg), encrypted_msg_len);
-
-Cleanup:
-
- if (pBuf) {
- delete[] pBuf;
- }
- if (encrypted_msg) {
- delete[] encrypted_msg;
- }
- if (context) {
- EVP_CIPHER_CTX_free(context);
- }
+ delete[] data;
+ delete[] encrypted;
return ret;
}
@@ -128,86 +85,54 @@ int
decrypt_session(const std::string &encrypted_data, const unsigned char *key, int key_length, char *session_data,
int32_t &session_data_len)
{
- unsigned char *ssl_sess_ptr = nullptr;
- int decrypted_buffer_size = 0;
- int decrypted_msg_len = 0;
- unsigned char *decrypted_msg = nullptr;
- int ret = 0;
-
- // Initialize context
- // Initialize context
- EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new();
- unsigned char iv[EVP_MAX_IV_LENGTH];
- unsigned char gen_key[EVP_MAX_KEY_LENGTH];
-
- // generate key and iv
- int generated_key_len = EVP_BytesToKey(EVP_aes_256_cbc(), EVP_md5(), (unsigned char *)salt, key, key_length, 1, gen_key, iv);
-
- if (generated_key_len <= 0) {
- TSDebug(PLUGIN, "Error generating key");
- }
- // set context with the generated key and iv
- if (1 != EVP_DecryptInit_ex(context, EVP_aes_256_cbc(), nullptr, gen_key, iv)) {
- TSDebug(PLUGIN, "Decryption of encrypted session data failed");
- goto Cleanup;
+ if (!key || !session_data) {
+ return -1;
}
- decrypted_buffer_size = DECRYPT_LEN(encrypted_data.length());
- decrypted_msg = reinterpret_cast<unsigned char *>(new char[decrypted_buffer_size + 1]);
- decrypted_msg_len = decrypted_buffer_size + 1;
- if (decrypted_msg == nullptr) {
- TSError("decrypted_msg allocate failure");
- }
- if (1 != EVP_DecryptUpdate(context, decrypted_msg, &decrypted_msg_len, (unsigned char *)encrypted_data.c_str(),
- encrypted_data.length())) {
- TSDebug(PLUGIN, "Decryption of encrypted session data failed");
- goto Cleanup;
- }
+ unsigned char *ssl_sess_ptr = nullptr;
+ size_t decrypted_size = DECODED_LEN(encrypted_data.length()) + EVP_MAX_BLOCK_LENGTH * 2;
+ size_t decrypted_len = 0;
+ unsigned char *decrypted = new unsigned char[decrypted_size];
+ int ret = -1;
+ size_t len_all = 0;
- // Retrieve ssl_session
- ssl_sess_ptr = decrypted_msg;
+ std::memset(decrypted, 0, decrypted_size);
+ decrypt_decode64(key, key_length, encrypted_data.c_str(), encrypted_data.length(), decrypted, decrypted_size, &decrypted_len);
- // Skip the expiration time. Just a place holder to interact with the old version
- ssl_sess_ptr += sizeof(int64_t);
+ // Retrieve ssl_session
+ ssl_sess_ptr = decrypted;
+
+ // The first 64 bits are now the protocol version. Make sure it matches what we expect
+ if (protocol_version == *(reinterpret_cast<uint64_t *>(ssl_sess_ptr))) {
+ // Move beyond the protocol version
+ ssl_sess_ptr += sizeof(int64_t);
+
+ // Length
+ ret = *(int32_t *)ssl_sess_ptr;
+ ssl_sess_ptr += sizeof(int32_t);
+
+ len_all = ret + sizeof(int64_t) + sizeof(int32_t);
+ if (decrypted_len < len_all) {
+ TSDebug(PLUGIN, "Session data length mismatch, got %lu, should be %lu.", decrypted_len, len_all);
+ ret = -1;
+ goto Cleanup;
+ }
- // Length
- ret = *reinterpret_cast<int32_t *>(ssl_sess_ptr);
- ssl_sess_ptr += sizeof(int32_t);
- TSDebug(PLUGIN, "Decrypted buffer of size %d from buffer of size %d\n", ret, session_data_len);
- // If there is less data than the maxiumum buffer size, reduce accordingly
- if (ret < session_data_len) {
- session_data_len = ret;
+ // If there is less data than the maxiumum buffer size, reduce accordingly
+ if (ret < session_data_len) {
+ session_data_len = ret;
+ }
+ std::memcpy(session_data, ssl_sess_ptr, session_data_len);
}
- memcpy(session_data, ssl_sess_ptr, session_data_len);
Cleanup:
- if (decrypted_msg) {
- delete[] decrypted_msg;
- }
-
- if (context) {
- EVP_CIPHER_CTX_free(context);
- }
+ delete[] decrypted;
return ret;
}
int
-decode_id(const std::string &encoded_id, char *decoded_data, int &decoded_data_len)
-{
- size_t decode_len = 0;
- memset(decoded_data, 0, decoded_data_len);
- if (TSBase64Decode(static_cast<const char *>(encoded_id.c_str()), encoded_id.length(),
- reinterpret_cast<unsigned char *>(decoded_data), decoded_data_len, &decode_len) != 0) {
- TSError("Base 64 decoding failed.");
- return -1;
- }
- decoded_data_len = decode_len;
- return 0;
-}
-
-int
encode_id(const char *id, int idlen, std::string &encoded_data)
{
char *encoded = new char[ENCODED_LEN(idlen)];
@@ -230,18 +155,35 @@ encode_id(const char *id, int idlen, std::string &encoded_data)
}
int
+decode_id(const std::string &encoded_id, char *decoded_data, int &decoded_data_len)
+{
+ size_t decode_len = 0;
+ memset(decoded_data, 0, decoded_data_len);
+ if (TSBase64Decode(static_cast<const char *>(encoded_id.c_str()), encoded_id.length(),
+ reinterpret_cast<unsigned char *>(decoded_data), decoded_data_len, &decode_len) != 0) {
+ TSError("Base 64 decoding failed.");
+ return -1;
+ }
+ decoded_data_len = decode_len;
+ return 0;
+}
+
+int
add_session(char *session_id, int session_id_len, const std::string &encrypted_session)
{
+ std::string session(session_id, session_id_len);
+ TSDebug(PLUGIN, "add_session session_id: %s", hex_str(session).c_str());
char session_data[SSL_SESSION_MAX_DER];
int32_t session_data_len = SSL_SESSION_MAX_DER;
- if (decrypt_session(encrypted_session, (unsigned char *)get_key_ptr(), get_key_length(), session_data, session_data_len) < 0) {
- TSError("Failed to decrypt session %.*s", session_id_len, session_id);
- return -1;
+ int ret = decrypt_session(encrypted_session, (unsigned char *)get_key_ptr(), get_key_length(), session_data, session_data_len);
+ if (ret < 0) {
+ TSError("Failed to decrypt session %.*s, error: %d", session_id_len, hex_str(session).c_str(), ret);
+ return ret;
}
const unsigned char *loc = reinterpret_cast<const unsigned char *>(session_data);
SSL_SESSION *sess = d2i_SSL_SESSION(nullptr, &loc, session_data_len);
if (nullptr == sess) {
- TSError("Failed to transform session buffer %.*s", session_id_len, session_id);
+ TSError("Failed to transform session buffer %.*s", session_id_len, hex_str(session).c_str());
}
TSSslSessionID sid;
memcpy(reinterpret_cast<char *>(sid.bytes), session_id, session_id_len);
diff --git a/plugins/experimental/ssl_session_reuse/src/session_process.h b/plugins/experimental/ssl_session_reuse/src/session_process.h
index a676db2..f987787 100644
--- a/plugins/experimental/ssl_session_reuse/src/session_process.h
+++ b/plugins/experimental/ssl_session_reuse/src/session_process.h
@@ -26,14 +26,7 @@
#include <string>
#include <cmath>
-#define SSL_SESSION_MAX_DER 1024 * 10
-
-// Base 64 encoding takes 4*(floor(n/3)) bytes
-#define ENCODED_LEN(len) ((int)ceil(1.34 * len + 5)) + 1
-#define DECODED_LEN(len) ((int)ceil(0.75 * len)) + 1
-// 3DES encryption will take at most 8 extra bytes. Plus we base 64 encode the result
-#define ENCRYPT_LEN(len) (int)ceil(1.34 * (len + 8) + 5) + 1
-#define DECRYPT_LEN(len) (int)ceil(1.34 * (len + 8) + 5) + 1
+#define SSL_SESSION_MAX_DER (1024 * 10)
int encrypt_session(const char *session_data, int32_t session_data_len, const unsigned char *key, int key_length,
std::string &encrypted_data);
diff --git a/plugins/experimental/ssl_session_reuse/src/simple_pool.h b/plugins/experimental/ssl_session_reuse/src/simple_pool.h
index 1931e8a..2977e35 100644
--- a/plugins/experimental/ssl_session_reuse/src/simple_pool.h
+++ b/plugins/experimental/ssl_session_reuse/src/simple_pool.h
@@ -23,10 +23,11 @@
*/
#pragma once
-#include "connection.h"
#include <set>
#include <mutex>
+#include "connection.h"
+
/**
* @brief Manages a pool of connections to a single Redis server
*/
diff --git a/plugins/experimental/ssl_session_reuse/src/ssl_init.cc b/plugins/experimental/ssl_session_reuse/src/ssl_init.cc
index fd0c456..afc88ff 100644
--- a/plugins/experimental/ssl_session_reuse/src/ssl_init.cc
+++ b/plugins/experimental/ssl_session_reuse/src/ssl_init.cc
@@ -24,13 +24,14 @@
#include <string>
#include <cstring>
-#include "ssl_utils.h"
-#include "Config.h"
-#include "common.h"
#include <fcntl.h>
#include <unistd.h>
#include <sys/stat.h>
+#include "ssl_utils.h"
+#include "Config.h"
+#include "common.h"
+
ssl_session_param ssl_param; // <- global containing all operational info
std::string conf_file;
@@ -60,26 +61,27 @@ init_ssl_params(const std::string &conf)
if (ssl_param.key_update_interval > STEK_MAX_LIFETIME) {
ssl_param.key_update_interval = STEK_MAX_LIFETIME;
- TSDebug(PLUGIN, "KeyUpdateInterval too high, resetting session ticket key rotation to %d seconds",
+ TSDebug(PLUGIN, "KeyUpdateInterval too high, resetting session ticket key rotation to %d seconds.",
ssl_param.key_update_interval);
}
- TSDebug(PLUGIN, "init_ssl_params: I %s been configured to initially be stek_master",
+ TSDebug(PLUGIN, "init_ssl_params: I %s been configured to initially be stek_master.",
((ssl_param.stek_master) ? "HAVE" : "HAVE NOT"));
- TSDebug(PLUGIN, "init_ssl_params: Rotation interval (ssl_param.key_update_interval)set to %d\n", ssl_param.key_update_interval);
+ TSDebug(PLUGIN, "init_ssl_params: Rotation interval (ssl_param.key_update_interval) set to %d", ssl_param.key_update_interval);
TSDebug(PLUGIN, "init_ssl_params: cluster_name set to %s", ssl_param.cluster_name.c_str());
- int ret = STEK_init_keys();
- if (ret < 0) {
- TSError("init keys failure. %s", conf.c_str());
- return -1;
- }
-
ssl_param.pub = new RedisPublisher(conf);
if ((!ssl_param.pub) || (!ssl_param.pub->is_good())) {
TSError("Construct RedisPublisher error.");
return -1;
}
+
+ int ret = STEK_init_keys();
+ if (ret < 0) {
+ TSError("STEK_init_keys failure: %s", conf.c_str());
+ return -1;
+ }
+
return 0;
}
@@ -93,12 +95,13 @@ ssl_session_param::~ssl_session_param()
}
/*
- Read the redis auth key from file ssl_param.redis_auth_key_file in retKeyBuff
-
+ Read the redis auth key from file ssl_param.redis_auth_key_file in retKeyBuff
+ Return length of key read.
*/
int
get_redis_auth_key(char *retKeyBuff, int buffSize)
{
+ int retval = 0;
// Get the Key
if (ssl_param.redis_auth_key_file.length()) {
int fd = open(ssl_param.redis_auth_key_file.c_str(), O_RDONLY);
@@ -112,12 +115,13 @@ get_redis_auth_key(char *retKeyBuff, int buffSize)
while (read_len > 1 && key_data[read_len - 1] == '\n') {
--read_len;
}
+ memset(retKeyBuff, 0, buffSize);
strncpy(retKeyBuff, key_data.c_str(), read_len);
+ retval = key_data.length();
}
} else {
- TSError("can not get redis auth key");
- return 0; /* error */
+ TSError("Can not get redis auth key.");
}
- return 1; /* ok */
+ return retval;
}
diff --git a/plugins/experimental/ssl_session_reuse/src/ssl_key_utils.cc b/plugins/experimental/ssl_session_reuse/src/ssl_key_utils.cc
index 7c53020..77ba417 100644
--- a/plugins/experimental/ssl_session_reuse/src/ssl_key_utils.cc
+++ b/plugins/experimental/ssl_session_reuse/src/ssl_key_utils.cc
@@ -22,15 +22,15 @@
*/
-#include <unistd.h>
#include <cstring>
#include <mutex>
+#include <cassert>
+#include <unistd.h>
#include <sys/time.h>
-#include <ts/ts.h>
#include <openssl/rand.h>
+#include <ts/ts.h>
#include "ssl_utils.h"
-#include <cassert>
#include "redis_auth.h"
#include "stek.h"
#include "common.h"
@@ -157,103 +157,59 @@ STEK_CreateNew(struct ssl_ticket_key_t *returnSTEK, int globalkey, int entropyEn
}
static int
-STEK_encrypt(struct ssl_ticket_key_t *stek, const char *key, int key_length, char *retEncrypted, int *retLength)
+STEK_encrypt(struct ssl_ticket_key_t *stek, const char *key, int key_length, char *ret_encrypted, int *ret_len)
{
- EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new();
- unsigned char iv[EVP_MAX_IV_LENGTH];
- unsigned char gen_key[EVP_MAX_KEY_LENGTH];
- int retval = 0;
-
- /* Encrypted stek will be placed in caller allocated retEncrypted buffer */
- /* NOTE: retLength must initially contain the size of the retEncrypted buffer */
+ /* Encrypted stek will be placed in caller allocated ret_encrypted buffer */
+ /* NOTE: ret_len must initially contain the size of the ret_encrypted buffer */
/* return 1 on success, 0 on failure */
-
- int stek_len = sizeof(struct ssl_ticket_key_t);
- int stek_enc_len = 0;
-
- // generate key and iv
- int generated_key_len = EVP_BytesToKey(EVP_aes_256_cbc(), EVP_md5(), (const unsigned char *)salt,
- reinterpret_cast<const unsigned char *>(key), key_length, 1, gen_key, iv);
- if (generated_key_len <= 0) {
- TSDebug(PLUGIN, "Key setup for encryption of session ticket failed");
- goto cleanup;
- }
-
- if (1 != EVP_EncryptInit_ex(context, EVP_aes_256_cbc(), nullptr, (const unsigned char *)gen_key, iv)) {
- TSDebug(PLUGIN, "Encryption init of session ticket failed");
- goto cleanup;
- }
-
- if (1 != EVP_EncryptUpdate(context, reinterpret_cast<unsigned char *>(retEncrypted), &stek_enc_len,
- reinterpret_cast<const unsigned char *>(stek), stek_len)) {
- TSDebug(PLUGIN, "Encryption of session ticket failed");
- goto cleanup;
- }
- *retLength = stek_enc_len;
- if (1 != EVP_EncryptFinal_ex(context, reinterpret_cast<unsigned char *>(retEncrypted) + stek_enc_len, &stek_enc_len)) {
- TSDebug(PLUGIN, "Final encryption of session ticket failed");
- goto cleanup;
+ int stek_len = sizeof(struct ssl_ticket_key_t);
+ size_t encrypted_size = *ret_len;
+ size_t encrypted_len = 0;
+
+ if (encrypt_encode64(reinterpret_cast<const unsigned char *>(key), key_length, reinterpret_cast<unsigned char *>(stek), stek_len,
+ ret_encrypted, encrypted_size, &encrypted_len) == 0) {
+ *ret_len = encrypted_len;
+ return 1; // success
+ } else {
+ TSDebug(PLUGIN, "STEK encryption failed.");
+ return 0;
}
- *retLength += stek_enc_len;
-
- retval = 1;
-cleanup:
- EVP_CIPHER_CTX_free(context);
- return retval; // success
}
static int
-STEK_decrypt(const std::string &encrypted_data, const char *key, int key_length, struct ssl_ticket_key_t *retSTEK)
+STEK_decrypt(const std::string &encrypted_data, const char *key, int key_length, struct ssl_ticket_key_t *ret_STEK)
{
- if (!retSTEK) {
+ if (!ret_STEK) {
return 0;
}
- EVP_CIPHER_CTX *context = EVP_CIPHER_CTX_new();
- unsigned char iv[EVP_MAX_IV_LENGTH];
- unsigned char gen_key[EVP_MAX_KEY_LENGTH];
- unsigned char decryptBuff[4 * sizeof(struct ssl_ticket_key_t)] = {
- 0,
- };
- int decryptLength = sizeof(decryptBuff);
- int retval = 0;
-
- TSDebug(PLUGIN, "STEK_decrypt(): requested to decrypt %d bytes", static_cast<int>(encrypted_data.length()));
+ TSDebug(PLUGIN, "STEK_decrypt: requested to decrypt %lu bytes", encrypted_data.length());
- // generate key and iv
- int generated_key_len = EVP_BytesToKey(EVP_aes_256_cbc(), EVP_md5(), (const unsigned char *)salt,
- reinterpret_cast<const unsigned char *>(key), key_length, 1, gen_key, iv);
- if (generated_key_len <= 0) {
- TSDebug(PLUGIN, "Key setup for decryption of session ticket failed");
- goto cleanup;
- }
+ int ret = 0;
+ size_t decrypted_size = DECODED_LEN(encrypted_data.length()) + EVP_MAX_BLOCK_LENGTH * 2;
+ size_t decrypted_len = 0;
+ unsigned char *decrypted = new unsigned char[decrypted_size];
- if (1 != EVP_DecryptInit_ex(context, EVP_aes_256_cbc(), nullptr, (const unsigned char *)gen_key, iv)) {
- TSDebug(PLUGIN, "Encryption of session data failed");
- goto cleanup;
- }
+ std::memset(decrypted, 0, decrypted_size);
+ decrypt_decode64(reinterpret_cast<const unsigned char *>(key), key_length, encrypted_data.c_str(), encrypted_data.length(),
+ decrypted, decrypted_size, &decrypted_len);
- if (1 !=
- EVP_DecryptUpdate(context, decryptBuff, &decryptLength, (unsigned char *)encrypted_data.c_str(), encrypted_data.length())) {
- TSDebug(PLUGIN, "Decryption of encrypted ticket key failed");
- goto cleanup;
+ if (sizeof(struct ssl_ticket_key_t) != decrypted_len) {
+ TSError("STEK data length mismatch, got %lu, should be %lu", decrypted_len, sizeof(struct ssl_ticket_key_t));
+ goto Cleanup;
}
- if (sizeof(struct ssl_ticket_key_t) != decryptLength) {
- TSError("STEK received is unexpected size length=%d not %d", decryptLength, static_cast<int>(sizeof(struct ssl_ticket_key_t)));
- goto cleanup;
- }
+ memcpy(ret_STEK, decrypted, sizeof(struct ssl_ticket_key_t));
+ memset(decrypted, 0, decrypted_size); // warm fuzzies
+ ret = 1;
- memcpy(retSTEK, decryptBuff, sizeof(struct ssl_ticket_key_t));
- memset(decryptBuff, 0, sizeof(decryptBuff)); // warm fuzzies
- retval = 1;
+Cleanup:
-cleanup:
- if (context) {
- EVP_CIPHER_CTX_free(context);
+ if (decrypted) {
+ delete[] decrypted;
}
- return retval; /* ok, length of data in retSTEK will be sizeof(struct ssl_ticket_key_t) */
+ return ret; /* ok, length of data in ret_STEK will be sizeof(struct ssl_ticket_key_t) */
}
int
@@ -272,7 +228,7 @@ STEK_Send_To_Network(struct ssl_ticket_key_t *stekToSend)
// encrypt the STEK before sending
encryptedDataLength = sizeof(encryptedData);
if (!STEK_encrypt(stekToSend, get_key_ptr(), get_key_length(), encryptedData, &encryptedDataLength)) {
- TSError("Can't encrypt STEK. Not sending");
+ TSError("STEK_encrypt failed, not sending.");
return 0; // failure
}
@@ -307,7 +263,7 @@ STEK_Update_Setter_Thread(void *arg)
}
stek_master_setter_running = 1;
- TSDebug(PLUGIN, "Will now act as the STEK rotator for pod");
+ TSDebug(PLUGIN, "Will now act as the STEK rotator for POD.");
while (true) {
// Create new STEK, set it for me, and then send it to the POD.
@@ -316,7 +272,7 @@ STEK_Update_Setter_Thread(void *arg)
// perhaps publishig isn't up yet.
startProblem++; // count how many times we have this problem.
sleepInterval = 60; // short sleep for error retry
- TSError("Could not create/send new STEK for key rotation...try again in %d seconds", sleepInterval);
+ TSError("Could not create/send new STEK for key rotation... Try again in %d seconds.", sleepInterval);
} else {
// Everything good. will sleep for normal rotation time period and then repeat
startProblem = 0;
@@ -343,7 +299,7 @@ STEK_Update_Setter_Thread(void *arg)
} // while(forever)
done_master_setter:
- TSDebug(PLUGIN, "Yielding STEK-Master rotation responsibility to another node in POD");
+ TSDebug(PLUGIN, "Yielding STEK-Master rotation responsibility to another node in POD.");
memset(&newKey, 0, sizeof(struct ssl_ticket_key_t));
stek_master_setter_running = 0;
return nullptr;
@@ -387,7 +343,7 @@ STEK_Update_Checker_Thread(void *arg)
* that something is up with our STEK master, and nominate a new STEK master.
*/
- TSDebug(PLUGIN, "Starting Update Checker Thread");
+ TSDebug(PLUGIN, "Starting STEK_Update_Checker_Thread.");
lastChangeTime = lastWarningTime = time(¤tTime); // init to current to supress a startup warning.
@@ -396,7 +352,7 @@ STEK_Update_Checker_Thread(void *arg)
// Launch a request for the master to resend you the ticket key
std::string redis_channel = ssl_param.cluster_name + "." + STEK_ID_RESEND;
ssl_param.pub->publish(redis_channel, ""); // send it
- TSDebug(PLUGIN, "Request for ticket");
+ TSDebug(PLUGIN, "Request for ticket.");
}
time(¤tTime);
time_t sleepUntil;
@@ -427,13 +383,13 @@ STEK_Update_Checker_Thread(void *arg)
/* Time to nominate a new stek master for pod key rotation... */
if (!stek_master_setter_running) {
- TSDebug(PLUGIN, "Will nominate a new STEK-master thread now for pod key rotation");
+ TSDebug(PLUGIN, "Will nominate a new STEK-master thread now for pod key rotation.");
TSThreadCreate(STEK_Update_Setter_Thread, nullptr);
}
}
-
} // while(forever)
+ return nullptr;
} // STEK_Update_Checker_Thread()
int
@@ -441,15 +397,16 @@ STEK_init_keys()
{
ssl_ticket_key_t initKey;
- if (!get_redis_auth_key(channel_key, MAX_REDIS_KEYSIZE)) {
- TSError("STEK_init_keys: could not get redis authentication key");
+ channel_key_length = get_redis_auth_key(channel_key, MAX_REDIS_KEYSIZE);
+ if (channel_key_length <= 0) {
+ TSError("STEK_init_keys: Could not get redis authentication key.");
return -1;
}
// Initialize starter Session Ticket Encryption Key
// Will sync up with master later
if (!STEK_CreateNew(&initKey, 0, 0 /*fast start*/)) {
- TSError("Cant init STEK");
+ TSError("Cant init STEK.");
return -1;
}
memcpy(&ssl_param.ticket_keys[0], &initKey, sizeof(struct ssl_ticket_key_t));
diff --git a/plugins/experimental/ssl_session_reuse/src/ssl_utils.h b/plugins/experimental/ssl_session_reuse/src/ssl_utils.h
index 262728c..adfc39c 100644
--- a/plugins/experimental/ssl_session_reuse/src/ssl_utils.h
+++ b/plugins/experimental/ssl_session_reuse/src/ssl_utils.h
@@ -23,15 +23,15 @@
*/
#pragma once
-#include <openssl/ssl.h>
#include <string>
+#include <iostream>
+#include <iomanip>
+#include <atomic>
+#include <openssl/ssl.h>
#include <ts/ts.h>
-#include <mutex>
-#include <deque>
#include "publisher.h"
#include "subscriber.h"
-
#include "stek.h"
struct ssl_session_param {
@@ -47,35 +47,6 @@ struct ssl_session_param {
~ssl_session_param();
};
-class PluginThreads
-{
-public:
- void
- store(const pthread_t &th)
- {
- std::lock_guard<std::mutex> lock(threads_mutex);
- threads_queue.push_back(th);
- }
-
- void
- terminate()
- {
- std::lock_guard<std::mutex> lock(threads_mutex);
- for (pthread_t th : threads_queue) {
- ::pthread_cancel(th);
- }
- while (!threads_queue.empty()) {
- pthread_t th = threads_queue.front();
- ::pthread_join(th, nullptr);
- threads_queue.pop_front();
- }
- }
-
-private:
- std::deque<pthread_t> threads_queue;
- std::mutex threads_mutex;
-};
-
int STEK_init_keys();
const char *get_key_ptr();
@@ -97,5 +68,3 @@ int init_subscriber();
int SSL_session_callback(TSCont contp, TSEvent event, void *edata);
extern ssl_session_param ssl_param; // almost everything one needs is stored in here
-
-extern PluginThreads plugin_threads;
diff --git a/plugins/experimental/ssl_session_reuse/src/subscriber.cc b/plugins/experimental/ssl_session_reuse/src/subscriber.cc
index 7dfc556..9d01f22 100644
--- a/plugins/experimental/ssl_session_reuse/src/subscriber.cc
+++ b/plugins/experimental/ssl_session_reuse/src/subscriber.cc
@@ -22,13 +22,13 @@
*/
+#include <cstring>
#include <unistd.h>
-#include <ts/ts.h>
#include <openssl/ssl.h>
#include <hiredis/hiredis.h>
-#include <cstring>
-#include "common.h"
+#include <ts/ts.h>
+#include "common.h"
#include "subscriber.h"
#include "Config.h"
#include "redis_auth.h"
@@ -67,7 +67,7 @@ RedisSubscriber::RedisSubscriber(const std::string &conf)
char redis_auth_key[MAX_REDIS_KEYSIZE];
if (!(get_redis_auth_key(redis_auth_key, MAX_REDIS_KEYSIZE))) {
err = true;
- TSError("RedisPublisher::RedisPublisher.Cannot get redis AUTH password.");
+ TSError("RedisPublisher::RedisPublisher: Cannot get redis AUTH password.");
redis_passwd.clear();
} else {
redis_passwd = redis_auth_key;
@@ -76,7 +76,7 @@ RedisSubscriber::RedisSubscriber(const std::string &conf)
m_channel_prefix = m_channel.substr(0, m_channel.find('*'));
- TSDebug(PLUGIN, "RedisSubscriber::RedisSubscriber.SubscriberChannel= %s SubscriberChannelPrefix= %s", m_channel.c_str(),
+ TSDebug(PLUGIN, "RedisSubscriber::RedisSubscriber: SubscriberChannel: %s SubscriberChannelPrefix: %s", m_channel.c_str(),
m_channel_prefix.c_str());
addto_endpoint_vector(m_redisEndpoints, redisEndpointsStr);
@@ -103,7 +103,7 @@ RedisSubscriber::get_endpoint_index()
::redisContext *
RedisSubscriber::setup_connection(int index)
{
- TSDebug(PLUGIN, "RedisSubscriber::setup_connection.called for host= %s and port= %d", m_redisEndpoints[index].m_hostname.c_str(),
+ TSDebug(PLUGIN, "RedisSubscriber::setup_connection: Called for host: %s port: %d", m_redisEndpoints[index].m_hostname.c_str(),
m_redisEndpoints[index].m_port);
::redisContext *my_context(nullptr);
@@ -115,31 +115,31 @@ RedisSubscriber::setup_connection(int index)
my_context =
::redisConnectWithTimeout(m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port, timeout_connect);
if (!my_context) {
- TSError("RedisSubscriber::setup_connection.connect to host: %s and port: %d failed",
- m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port);
+ TSError("RedisSubscriber::setup_connection: Connect to host: %s port: %d failed.", m_redisEndpoints[index].m_hostname.c_str(),
+ m_redisEndpoints[index].m_port);
} else if (my_context->err) {
- TSError("RedisSubscriber::setup_connection.connect to host: %s and port: %d failed.",
- m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port);
+ TSError("RedisSubscriber::setup_connection: Connect to host: %s port: %d failed.", m_redisEndpoints[index].m_hostname.c_str(),
+ m_redisEndpoints[index].m_port);
} else {
- TSDebug(PLUGIN, "RedisSubscriber::setup_connection: successfully connected to the redis host: %s on port: %d",
+ TSDebug(PLUGIN, "RedisSubscriber::setup_connection: Successfully connected to the redis host: %s port: %d",
m_redisEndpoints[index].m_hostname.c_str(), m_redisEndpoints[index].m_port);
redisReply *reply = static_cast<redisReply *>(redisCommand(my_context, "AUTH %s", redis_passwd.c_str()));
if (reply == nullptr) {
- TSError("RedisSubscriber::setup_connection Cannot AUTH redis server, no reply.");
+ TSError("RedisSubscriber::setup_connection: Cannot AUTH redis server, no reply.");
} else if (reply->type == REDIS_REPLY_ERROR) {
- TSError("RedisSubscriber::setup_connection Cannot AUTH redis server, error reply.");
+ TSError("RedisSubscriber::setup_connection: Cannot AUTH redis server, error reply.");
freeReplyObject(reply);
} else {
- TSDebug(PLUGIN, "RedisSubscriber::setup_connection. Successfully AUTH redis server.");
+ TSDebug(PLUGIN, "RedisSubscriber::setup_connection: Successfully AUTH redis server.");
freeReplyObject(reply);
}
break;
}
- TSError("RedisSubscriber::setup_connection.will wait for: %d microseconds and try again.", m_redisRetryDelay);
+ TSError("RedisSubscriber::setup_connection: Will wait for: %d microseconds and try again.", m_redisRetryDelay);
::usleep(m_redisRetryDelay);
}
@@ -150,7 +150,7 @@ RedisSubscriber::setup_connection(int index)
void
RedisSubscriber::run()
{
- TSDebug(PLUGIN, "RedisSubscriber::runMaster.called");
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Called.");
int my_endpoint_index = get_endpoint_index();
::redisContext *my_context(setup_connection(my_endpoint_index));
::redisReply *current_reply(nullptr);
@@ -161,16 +161,16 @@ RedisSubscriber::run()
my_context = setup_connection(my_endpoint_index);
}
- TSDebug(PLUGIN, "RedisSubscriber::runMaster.Issuing command: \"PSUBSCRIBE %s\"", m_channel.c_str());
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Issuing command: PSUBSCRIBE %s", m_channel.c_str());
current_reply = static_cast<redisReply *>(::redisCommand(my_context, "PSUBSCRIBE %s", m_channel.c_str()));
if (!current_reply || (REDIS_REPLY_ERROR == current_reply->type)) {
- TSError("RedisSubscriber::runMaster.subscribe to redis server on channel: %s failed.", m_channel.c_str());
+ TSError("RedisSubscriber::runMaster: Subscribe to redis server on channel: %s failed.", m_channel.c_str());
::usleep(1000 * 1000);
continue;
} else {
- TSDebug(PLUGIN, "RedisSubscriber::runMaster.Successfully subscribed to channel: \"%s\"", m_channel.c_str());
- TSDebug(PLUGIN, "RedisSubscriber::runMaster.Waiting for messages to appear on the channel!");
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Successfully subscribed to channel: %s", m_channel.c_str());
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Waiting for messages to appear on the channel!");
::freeReplyObject(current_reply);
}
@@ -179,7 +179,7 @@ RedisSubscriber::run()
// Process Message
std::string channel(current_reply->element[2]->str, current_reply->element[2]->len);
std::string data(current_reply->element[3]->str, current_reply->element[3]->len);
- TSDebug(PLUGIN, "Redis request channel=%s message=%s", channel.c_str(), data.c_str());
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Redis request channel: %s message: %s", channel.c_str(), hex_str(data).c_str());
std::string key = "";
// Strip the channel name to get the key
@@ -193,28 +193,29 @@ RedisSubscriber::run()
// Requesting last ticket to be resent
} else if (strncmp(key.c_str(), STEK_ID_RESEND, strlen(STEK_ID_RESEND)) == 0) {
if (isSTEKMaster()) {
- TSDebug(PLUGIN, "RedisSubscriber Resend ticket");
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Resend ticket.");
STEK_Send_To_Network(ssl_param.ticket_keys);
}
} else { // Otherwise this is a new session. Let ATS core know about it
char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH * 2];
int session_id_len = sizeof(session_id);
if (decode_id(key, session_id, session_id_len) == 0) { // Decrypt the data
- TSDebug(PLUGIN, "Add session encoded_id=%s decoded_id=%.*s %d", key.c_str(), session_id_len, session_id, session_id_len);
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Add session encoded_id: %s decoded_id: %.*s %d", key.c_str(), session_id_len,
+ hex_str(std::string(session_id, session_id_len)).c_str(), session_id_len);
add_session(session_id, session_id_len, data);
} else {
- TSDebug(PLUGIN, "failed to decode key=%s", key.c_str());
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Failed to decode key: %s", key.c_str());
}
}
::freeReplyObject(current_reply);
- TSDebug(PLUGIN, "RedisSubscriber::runMaster.Got message: %s on channel: %s", data.c_str(), channel.c_str());
+ TSDebug(PLUGIN, "RedisSubscriber::runMaster: Got message: %s channel: %s", hex_str(data).c_str(), channel.c_str());
}
}
}
RedisSubscriber::~RedisSubscriber()
{
- TSDebug(PLUGIN, "RedisSubscriber::~RedisSubscriber.called for endpoint");
+ TSDebug(PLUGIN, "RedisSubscriber::~RedisSubscriber: Called for endpoint.");
}
diff --git a/plugins/experimental/ssl_session_reuse/src/subscriber.h b/plugins/experimental/ssl_session_reuse/src/subscriber.h
index 19c1812..9e0ae85 100644
--- a/plugins/experimental/ssl_session_reuse/src/subscriber.h
+++ b/plugins/experimental/ssl_session_reuse/src/subscriber.h
@@ -25,6 +25,7 @@
#include <vector>
#include <string>
+
#include "message.h"
#include "globals.h"
#include "redis_endpoint.h"
[trafficserver] 02/02: Fix ssl_session_reuse to compile on macOS
and FreeBSD
Posted by zw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 1f029cd57e31e3ca95183957d75ef161efb9045c
Author: Bryan Call <bc...@apache.org>
AuthorDate: Mon Nov 18 16:50:02 2019 +0800
Fix ssl_session_reuse to compile on macOS and FreeBSD
(cherry picked from commit 7dd4a6f60743147d9d46c4f8d2ecc2e99034221e)
---
.../experimental/ssl_session_reuse/src/config.cc | 4 +--
.../experimental/ssl_session_reuse/src/publish.cc | 30 ++++++++++++----------
2 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/plugins/experimental/ssl_session_reuse/src/config.cc b/plugins/experimental/ssl_session_reuse/src/config.cc
index 65f81a5..6501048 100644
--- a/plugins/experimental/ssl_session_reuse/src/config.cc
+++ b/plugins/experimental/ssl_session_reuse/src/config.cc
@@ -101,9 +101,9 @@ Config::setLastConfigChange()
memset(&s, 0, sizeof(s));
stat(m_filename.c_str(), &s);
- m_lastmtime = s.st_mtim.tv_sec;
+ m_lastmtime = s.st_mtime;
- if (s.st_mtim.tv_sec > oldLastmtime) {
+ if (s.st_mtime > oldLastmtime) {
return true;
}
return false;
diff --git a/plugins/experimental/ssl_session_reuse/src/publish.cc b/plugins/experimental/ssl_session_reuse/src/publish.cc
index 0877155..98bab37 100644
--- a/plugins/experimental/ssl_session_reuse/src/publish.cc
+++ b/plugins/experimental/ssl_session_reuse/src/publish.cc
@@ -117,8 +117,8 @@ RedisPublisher::is_good()
::redisContext *
RedisPublisher::setup_connection(const RedisEndpoint &re)
{
- ::pthread_t my_id = ::pthread_self();
- TSDebug(PLUGIN, "RedisPublisher::setup_connection: Called by threadId: %lx", my_id);
+ auto my_id = (unsigned long long)::pthread_self();
+ TSDebug(PLUGIN, "RedisPublisher::setup_connection: Called by threadId: %llx", my_id);
RedisContextPtr my_context;
struct ::timeval timeout;
@@ -128,14 +128,14 @@ RedisPublisher::setup_connection(const RedisEndpoint &re)
for (int i = 0; i < static_cast<int>(m_redisConnectTries); ++i) {
my_context.reset(::redisConnectWithTimeout(re.m_hostname.c_str(), re.m_port, timeout));
if (!my_context) {
- TSError("RedisPublisher::setup_connection: Connect to host: %s port: %d fail count: %d threadId: %lx", re.m_hostname.c_str(),
+ TSError("RedisPublisher::setup_connection: Connect to host: %s port: %d fail count: %d threadId: %llx", re.m_hostname.c_str(),
re.m_port, i + 1, my_id);
} else if (my_context->err) {
- TSError("RedisPublisher::setup_connection: Connect to host: %s port: %d fail count: %d threadId: %lx", re.m_hostname.c_str(),
+ TSError("RedisPublisher::setup_connection: Connect to host: %s port: %d fail count: %d threadId: %llx", re.m_hostname.c_str(),
re.m_port, i + 1, my_id);
my_context.reset(nullptr);
} else {
- TSDebug(PLUGIN, "RedisPublisher::setup_connection: threadId: %lx Successfully connected to the redis instance.", my_id);
+ TSDebug(PLUGIN, "RedisPublisher::setup_connection: threadId: %llx Successfully connected to the redis instance.", my_id);
redisReply *reply = static_cast<redisReply *>(redisCommand(my_context.get(), "AUTH %s", redis_passwd.c_str()));
@@ -163,8 +163,8 @@ RedisPublisher::setup_connection(const RedisEndpoint &re)
::redisReply *
RedisPublisher::send_publish(RedisContextPtr &ctx, const RedisEndpoint &re, const Message &msg)
{
- ::pthread_t my_id = ::pthread_self();
- TSDebug(PLUGIN, "RedisPublisher::send_publish: Called by threadId: %lx", my_id);
+ auto my_id = (unsigned long long)::pthread_self();
+ TSDebug(PLUGIN, "RedisPublisher::send_publish: Called by threadId: %llx", my_id);
::redisReply *current_reply(nullptr);
@@ -173,7 +173,7 @@ RedisPublisher::send_publish(RedisContextPtr &ctx, const RedisEndpoint &re, cons
ctx.reset(setup_connection(re));
if (!ctx) {
- TSError("RedisPublisher::send_publish: Unable to setup a connection to the redis server: %s:%d threadId: %lx try: %d",
+ TSError("RedisPublisher::send_publish: Unable to setup a connection to the redis server: %s:%d threadId: %llx try: %d",
re.m_hostname.c_str(), re.m_port, my_id, (i + 1));
continue;
}
@@ -181,12 +181,12 @@ RedisPublisher::send_publish(RedisContextPtr &ctx, const RedisEndpoint &re, cons
current_reply = static_cast<redisReply *>(::redisCommand(ctx.get(), "PUBLISH %s %s", msg.channel.c_str(), msg.data.c_str()));
if (!current_reply) {
- TSError("RedisPublisher::send_publish: Unable to get a reply from the server for publish. threadId: %lx try: %d", my_id,
+ TSError("RedisPublisher::send_publish: Unable to get a reply from the server for publish. threadId: %llx try: %d", my_id,
(i + 1));
ctx.reset(nullptr); // Clean up previous attempt
} else if (REDIS_REPLY_ERROR == current_reply->type) {
- TSError("RedisPublisher::send_publish: Server responded with error for publish. threadId: %lx try: %d", my_id, i + 1);
+ TSError("RedisPublisher::send_publish: Server responded with error for publish. threadId: %llx try: %d", my_id, i + 1);
clear_reply(current_reply);
current_reply = nullptr;
ctx.reset(nullptr); // Clean up previous attempt
@@ -219,7 +219,7 @@ RedisPublisher::runWorker()
}
m_endpointIndexMutex.unlock();
- ::pthread_t my_id = ::pthread_self();
+ auto my_id = (unsigned long long)::pthread_self();
RedisContextPtr my_context;
::redisReply *current_reply(nullptr);
@@ -249,7 +249,7 @@ RedisPublisher::runWorker()
::sem_wait(&m_workerSem);
if (current_message.cleanup) {
- TSDebug(PLUGIN, "RedisPublisher::runWorker: threadId: %lx received the cleanup message. Exiting!", my_id);
+ TSDebug(PLUGIN, "RedisPublisher::runWorker: threadId: %llx received the cleanup message. Exiting!", my_id);
break;
}
current_reply = send_publish(my_context, my_endpoint, current_message);
@@ -322,7 +322,8 @@ RedisPublisher::~RedisPublisher()
std::string
RedisPublisher::get_session(const std::string &channel)
{
- TSDebug(PLUGIN, "RedisPublisher::get_session: Called by threadId: %lx", ::pthread_self());
+ auto my_id = (unsigned long long)::pthread_self();
+ TSDebug(PLUGIN, "RedisPublisher::get_session: Called by threadId: %llx", my_id);
std::string ret;
uint32_t index = get_hash_index(channel);
redisReply *reply = nullptr;
@@ -354,7 +355,8 @@ RedisPublisher::get_session(const std::string &channel)
redisReply *
RedisPublisher::set_session(const Message &msg)
{
- TSDebug(PLUGIN, "RedisPublisher::set_session: Called by threadId: %lx", ::pthread_self());
+ auto my_id = (unsigned long long)::pthread_self();
+ TSDebug(PLUGIN, "RedisPublisher::set_session: Called by threadId: %llx", my_id);
uint32_t index = get_hash_index(msg.channel);
redisReply *reply = nullptr;
for (uint32_t i = 0; i < m_redisEndpoints.size(); i++) {