TapTap/FastSync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix TLS code review issues: SSL cleanup, TLS 1.2 min, CA verify, deprecation guards, server --help, port validation, __thread io_ssl, shared accept loop

Browse Source
This commit is contained in:
TapTap
2026-07-16 16:56:33 +02:00
parent c5d739d160
commit 64be95a57f
10 changed files with 167 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/client/client_cli.c
+10 -1
View File
@@ -2,6 +2,7 @@
#include "config.h"
#include "log.h"
#include "protocol.h"
#include "transport_tls.h"
#include "utils.h"
#include <errno.h>
#include <limits.h>
@@ -49,7 +50,7 @@ static void print_usage(void) {
printf(" --tls Enable TLS encryption\n");
printf(" --cert <path> TLS certificate file (PEM)\n");
printf(" --key <path> TLS private key file (PEM)\n");
printf(" --ca <path> CA certificate for verification (PEM)\n");
printf(" --ca <path> TLS CA certificate file (PEM)\n");
printf(" --help Show this help\n");
}
@@ -217,6 +218,14 @@ int main(int argc, char *argv[]) {
return 1;
}
if (config->use_tls) {
if (!config->tls_cert || !config->tls_key) {
fprintf(stderr, "Error: --tls requires --cert and --key\n");
return 1;
}
tls_global_init();
}
if (config->use_multithreading)
return send_files_multithreaded(config);
return send_files(config);
src/client/client_send.c
+4 -4
View File
@@ -59,11 +59,11 @@ static int send_chunks_multithreaded(void *pipeline_context) {
}
client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port);
} else if (context->config->use_tls) {
tls_global_init();
client = client_create();
if (!client || !client_connect_tls(client, server_host, server_port,
context->config->tls_cert,
context->config->tls_key)) {
context->config->tls_key,
context->config->tls_ca)) {
if (client) client_delete(client);
fprintf(stderr, "Error: could not connect to server via TLS\n");
return thrd_error;
@@ -213,10 +213,10 @@ int send_files(Config *config) {
client = client_connect_ssh(config->ssh_destination, config->ssh_port);
if (!client) return 1;
} else if (config->use_tls) {
tls_global_init();
client = client_create();
if (!client || !client_connect_tls(client, server_host, server_port,
config->tls_cert, config->tls_key)) {
config->tls_cert, config->tls_key,
config->tls_ca)) {
if (client) client_delete(client);
fprintf(stderr, "Error: could not connect to server via TLS\n");
return 1;
src/server/server.c
+33 -2
View File
@@ -153,15 +153,34 @@ static void cleanup(int sig) {
_exit(0);
}
static void print_server_usage(void) {
printf("FastSync Server\n");
printf("Usage: fastsync-server [options]\n");
printf("\n");
printf("Options:\n");
printf(" --stdio Run in stdio mode (SSH transport)\n");
printf(" -p <port> TCP port (default: 8080, range: 1-65535)\n");
printf(" --tls Enable TLS encryption\n");
printf(" --cert <path> TLS certificate file (PEM)\n");
printf(" --key <path> TLS private key file (PEM)\n");
printf(" --ca <path> TLS CA certificate file (PEM)\n");
printf(" -v, --verbose Enable debug logging\n");
printf(" --help Show this help\n");
}
int main(int argc, char *argv[]) {
bool use_tls = false;
char *tls_cert = NULL;
char *tls_key = NULL;
char *tls_ca = NULL;
int port = 8080;
signal(SIGPIPE, SIG_IGN);
for (int i = 1; i < argc; i++) {
if (strcmp(argv[i], "--stdio") == 0) {
if (strcmp(argv[i], "--help") == 0) {
print_server_usage();
return 0;
} else if (strcmp(argv[i], "--stdio") == 0) {
io_set_fds(STDIN_FILENO, STDOUT_FILENO);
handler(STDIN_FILENO);
return 0;
@@ -173,10 +192,22 @@ int main(int argc, char *argv[]) {
tls_cert = argv[++i];
} else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
tls_key = argv[++i];
} else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
tls_ca = argv[++i];
} else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
port = atoi(argv[++i]);
} else if (argv[i][0] == '-') {
fprintf(stderr, "Unknown option: %s\n", argv[i]);
print_server_usage();
return 1;
}
}
if (port < 1 || port > 65535) {
fprintf(stderr, "Error: port must be between 1 and 65535\n");
return 1;
}
signal(SIGINT, cleanup);
signal(SIGTERM, cleanup);
g_server = server_create(port);
@@ -191,7 +222,7 @@ int main(int argc, char *argv[]) {
return 1;
}
tls_global_init();
if (!server_create_tls(g_server, tls_cert, tls_key)) {
if (!server_create_tls(g_server, tls_cert, tls_key, tls_ca)) {
log_message(LOG_LEVEL_ERROR, "Failed to set up TLS");
server_delete(&g_server);
return 1;
src/shared/config.c
+6
View File
@@ -41,6 +41,7 @@ Config *config_create(char *version, char *send_directory,
config->use_tls = false;
config->tls_cert = NULL;
config->tls_key = NULL;
config->tls_ca = NULL;
return config;
}
@@ -78,6 +79,7 @@ void config_delete(Config *config) {
free(config->include_patterns);
free(config->tls_cert);
free(config->tls_key);
free(config->tls_ca);
free(config);
}
@@ -150,6 +152,10 @@ Config *config_receive(int file_descriptor) {
config->include_count = 0;
config->max_size = 0;
config->min_size = 0;
config->use_tls = false;
config->tls_cert = NULL;
config->tls_key = NULL;
config->tls_ca = NULL;
if (!send_status(file_descriptor, STATUS_OK)) goto error;
return config;
src/shared/config.h
+1
View File
@@ -35,6 +35,7 @@ typedef struct Config {
bool use_tls;
char *tls_cert;
char *tls_key;
char *tls_ca;
} Config;
#define PROTOCOL_VERSION "1.0.0"
src/shared/protocol.c
+1 -1
View File
@@ -10,7 +10,7 @@
static __thread int io_read_fd = -1;
static __thread int io_write_fd = -1;
static SSL *io_ssl = NULL;
static __thread SSL *io_ssl = NULL;
static unsigned long long io_bwlimit = 0;
static long long bw_tokens = 0;
src/shared/transport_tcp.c
+44 -15
View File
@@ -1,6 +1,7 @@
#include "transport_tcp.h"
#include "log.h"
#include <arpa/inet.h>
#include <openssl/ssl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
@@ -52,43 +53,63 @@ Server *server_create(int port) {
void server_delete(Server **server) {
if (server == NULL || *server == NULL) return;
close((*server)->file_descriptor);
if ((*server)->ssl_ctx) {
SSL_CTX_free((*server)->ssl_ctx);
(*server)->ssl_ctx = NULL;
}
free(*server);
*server = NULL;
}
bool server_listen(Server *server, void (*handler)(int file_descriptor)) {
log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d",
server->address.sin_port);
static void accept_loop(Server *server, void (*child_fn)(int, void *),
void *child_ctx, const char *log_fmt) {
if (listen(server->file_descriptor, SOMAXCONN) < 0) {
perror("Could not listen on port!");
return false;
return;
}
signal(SIGCHLD, SIG_IGN);
while (1) {
struct sockaddr_in client_addr;
socklen_t client_len = sizeof(client_addr);
int file_descriptor =
accept(server->file_descriptor, (struct sockaddr *)&client_addr,
int fd = accept(server->file_descriptor, (struct sockaddr *)&client_addr,
&client_len);
if (file_descriptor < 0) {
if (fd < 0) {
perror("Could not accept the connection");
continue;
}
log_message(LOG_LEVEL_INFO, "Received Connection");
log_message(LOG_LEVEL_INFO, "%s", log_fmt);
pid_t pid = fork();
if (pid == 0) {
close(server->file_descriptor);
handler(file_descriptor);
close(file_descriptor);
child_fn(fd, child_ctx);
close(fd);
_exit(0);
}
close(file_descriptor);
close(fd);
}
}
struct plain_ctx { void (*handler)(int); };
static void plain_child_fn(int fd, void *ctx) {
((struct plain_ctx *)ctx)->handler(fd);
}
bool server_listen(Server *server, void (*handler)(int file_descriptor)) {
log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d",
ntohs(server->address.sin_port));
struct plain_ctx ctx = {handler};
accept_loop(server, plain_child_fn, &ctx, "Received Connection");
return true;
}
void server_accept_loop(Server *server, void (*child_fn)(int, void *),
void *child_ctx, const char *log_fmt) {
log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d",
ntohs(server->address.sin_port));
accept_loop(server, child_fn, child_ctx, log_fmt);
}
Client *client_create() {
int file_descriptor = socket(AF_INET, SOCK_STREAM, 0);
if (file_descriptor < 0) {
@@ -127,6 +148,11 @@ bool client_connect(Client *client, char *host, int port) {
}
void client_disconnect(Client *client) {
if (client->ssl) {
SSL_shutdown(client->ssl);
SSL_free(client->ssl);
client->ssl = NULL;
}
close(client->file_descriptor);
if (client->ssh_child_pid > 0) {
int status;
@@ -136,7 +162,10 @@ void client_disconnect(Client *client) {
}
void client_delete(Client *client) {
if (client == NULL)
return;
if (client == NULL) return;
if (client->ssl_ctx) {
SSL_CTX_free(client->ssl_ctx);
client->ssl_ctx = NULL;
}
free(client);
}
src/shared/transport_tcp.h
+2
View File
@@ -23,6 +23,8 @@ typedef struct Client {
Server *server_create(int port);
bool server_listen(Server *server, void (*handler)(int file_descriptor));
void server_accept_loop(Server *server, void (*child_fn)(int, void *),
void *child_ctx, const char *log_fmt);
void server_delete(Server **server);
Client *client_create();
bool client_connect(Client *client, char *host, int port);
src/shared/transport_tls.c
+53 -53
View File
@@ -1,6 +1,7 @@
#include "transport_tls.h"
#include "log.h"
#include "protocol.h"
#include "transport_tcp.h"
#include <arpa/inet.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
@@ -12,52 +13,69 @@
#include <sys/wait.h>
#include <unistd.h>
static SSL_CTX *g_ssl_ctx = NULL;
bool tls_global_init(void) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
SSL_library_init();
OpenSSL_add_all_algorithms();
SSL_load_error_strings();
#endif
return true;
}
void tls_global_cleanup(void) {
if (g_ssl_ctx) {
SSL_CTX_free(g_ssl_ctx);
g_ssl_ctx = NULL;
static void log_ssl_errors(void) {
unsigned long err;
char buf[256];
while ((err = ERR_get_error()) != 0) {
ERR_error_string_n(err, buf, sizeof(buf));
log_message(LOG_LEVEL_ERROR, "SSL error: %s", buf);
}
EVP_cleanup();
}
static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert, const char *key) {
const SSL_METHOD *method = is_server ? TLS_server_method() : TLS_client_method();
static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert,
const char *key, const char *ca_path) {
const SSL_METHOD *method =
is_server ? TLS_server_method() : TLS_client_method();
SSL_CTX *ctx = SSL_CTX_new(method);
if (!ctx) {
log_message(LOG_LEVEL_ERROR, "Unable to create SSL context");
ERR_print_errors_fp(stderr);
log_ssl_errors();
return NULL;
}
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
if (cert && key) {
if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) {
log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert);
ERR_print_errors_fp(stderr);
log_ssl_errors();
SSL_CTX_free(ctx);
return NULL;
}
if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) {
log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key);
ERR_print_errors_fp(stderr);
log_ssl_errors();
SSL_CTX_free(ctx);
return NULL;
}
if (!SSL_CTX_check_private_key(ctx)) {
log_message(LOG_LEVEL_ERROR, "Private key does not match certificate");
log_message(LOG_LEVEL_ERROR,
"Private key does not match certificate");
SSL_CTX_free(ctx);
return NULL;
}
}
if (ca_path) {
if (!SSL_CTX_load_verify_locations(ctx, ca_path, NULL)) {
log_message(LOG_LEVEL_ERROR, "Failed to load CA: %s", ca_path);
log_ssl_errors();
SSL_CTX_free(ctx);
return NULL;
}
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
SSL_CTX_set_verify_depth(ctx, 4);
}
return ctx;
}
@@ -75,66 +93,48 @@ static SSL *wrap_fd_with_ssl(int fd, SSL_CTX *ctx, bool is_server) {
ret = SSL_connect(ssl);
if (ret <= 0) {
log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect");
ERR_print_errors_fp(stderr);
log_message(LOG_LEVEL_ERROR, "SSL %s failed",
is_server ? "accept" : "connect");
log_ssl_errors();
SSL_free(ssl);
return NULL;
}
return ssl;
}
bool server_create_tls(Server *server, const char *cert_path, const char *key_path) {
SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path);
bool server_create_tls(Server *server, const char *cert_path,
const char *key_path, const char *ca_path) {
SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path, ca_path);
if (!ctx) return false;
server->ssl_ctx = ctx;
return true;
}
bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)) {
log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d",
ntohs(server->address.sin_port));
if (listen(server->file_descriptor, SOMAXCONN) < 0) {
perror("Could not listen on port!");
return false;
}
struct tls_child_ctx {
void (*handler)(int);
SSL_CTX *ssl_ctx;
};
signal(SIGCHLD, SIG_IGN);
while (1) {
struct sockaddr_in client_addr;
socklen_t client_len = sizeof(client_addr);
int file_descriptor =
accept(server->file_descriptor, (struct sockaddr *)&client_addr,
&client_len);
if (file_descriptor < 0) {
perror("Could not accept the connection");
continue;
}
log_message(LOG_LEVEL_INFO, "Received TLS Connection");
pid_t pid = fork();
if (pid == 0) {
close(server->file_descriptor);
SSL *ssl = wrap_fd_with_ssl(file_descriptor, (SSL_CTX *)server->ssl_ctx, true);
if (!ssl) {
close(file_descriptor);
_exit(1);
}
static void tls_child_fn(int fd, void *arg) {
struct tls_child_ctx *ctx = (struct tls_child_ctx *)arg;
SSL *ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true);
if (!ssl) return;
io_set_ssl(ssl);
handler(file_descriptor);
ctx->handler(fd);
SSL_shutdown(ssl);
SSL_free(ssl);
io_set_ssl(NULL);
close(file_descriptor);
_exit(0);
}
close(file_descriptor);
}
bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)) {
struct tls_child_ctx ctx = {handler, (SSL_CTX *)server->ssl_ctx};
server_accept_loop(server, tls_child_fn, &ctx, "Received TLS Connection");
return true;
}
bool client_connect_tls(Client *client, char *host, int port,
const char *cert_path, const char *key_path) {
const char *cert_path, const char *key_path,
const char *ca_path) {
client->address.sin_port = htons(port);
if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
perror("Could not convert host address!");
@@ -146,7 +146,7 @@ bool client_connect_tls(Client *client, char *host, int port,
return false;
}
SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path);
SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path, ca_path);
if (!ctx) return false;
client->ssl_ctx = ctx;
src/shared/transport_tls.h
+5 -3
View File
@@ -5,10 +5,12 @@
#include <stdbool.h>
bool tls_global_init(void);
void tls_global_cleanup(void);
bool server_create_tls(Server *server, const char *cert_path, const char *key_path);
bool server_create_tls(Server *server, const char *cert_path,
const char *key_path, const char *ca_path);
bool server_listen_tls(Server *server, void (*handler)(int file_descriptor));
bool client_connect_tls(Client *client, char *host, int port, const char *cert_path, const char *key_path);
bool client_connect_tls(Client *client, char *host, int port,
const char *cert_path, const char *key_path,
const char *ca_path);
#endif