Fix TLS code review issues: SSL cleanup, TLS 1.2 min, CA verify, deprecation guards, server --help, port validation, __thread io_ssl, shared accept loop

src/client/client_cli.c

@@ -2,6 +2,7 @@
 #include "config.h"
 #include "log.h"
 #include "protocol.h"
+#include "transport_tls.h"
 #include "utils.h"
 #include <errno.h>
 #include <limits.h>
@@ -50,7 +51,7 @@ static void print_usage(void) {
   printf("  --tls               Enable TLS encryption\n");
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
-  printf("  --ca <path>         CA certificate for verification (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
   printf("  --help              Show this help\n");
 }
 
@@ -230,6 +231,14 @@ int main(int argc, char *argv[]) {
     config->use_metadata = true;
   }
 
+  if (config->use_tls) {
+    if (!config->tls_cert || !config->tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      return 1;
+    }
+    tls_global_init();
+  }
+
   if (config->use_multithreading)
     return send_files_multithreaded(config);
   return send_files(config);

src/client/client_send.c

@@ -100,11 +100,11 @@ static int send_chunks_multithreaded(void *pipeline_context) {
     }
     client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port);
   } else if (context->config->use_tls) {
-    tls_global_init();
     client = client_create();
     if (!client || !client_connect_tls(client, server_host, server_port,
-                                       context->config->tls_cert,
+                                        context->config->tls_cert,
-                                       context->config->tls_key)) {
+                                        context->config->tls_key,
+                                        context->config->tls_ca)) {
       if (client) client_delete(client);
       fprintf(stderr, "Error: could not connect to server via TLS\n");
       return thrd_error;
@@ -254,10 +254,10 @@ int send_files(Config *config) {
     client = client_connect_ssh(config->ssh_destination, config->ssh_port);
     if (!client) return 1;
   } else if (config->use_tls) {
-    tls_global_init();
     client = client_create();
     if (!client || !client_connect_tls(client, server_host, server_port,
-                                       config->tls_cert, config->tls_key)) {
+                                        config->tls_cert, config->tls_key,
+                                        config->tls_ca)) {
       if (client) client_delete(client);
       fprintf(stderr, "Error: could not connect to server via TLS\n");
       return 1;

src/server/server.c

@@ -119,15 +119,34 @@ static void cleanup(int sig) {
   _exit(0);
 }
 
+static void print_server_usage(void) {
+  printf("FastSync Server\n");
+  printf("Usage: fastsync-server [options]\n");
+  printf("\n");
+  printf("Options:\n");
+  printf("  --stdio             Run in stdio mode (SSH transport)\n");
+  printf("  -p <port>           TCP port (default: 8080, range: 1-65535)\n");
+  printf("  --tls               Enable TLS encryption\n");
+  printf("  --cert <path>       TLS certificate file (PEM)\n");
+  printf("  --key <path>        TLS private key file (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
+  printf("  -v, --verbose       Enable debug logging\n");
+  printf("  --help              Show this help\n");
+}
+
 int main(int argc, char *argv[]) {
   bool use_tls = false;
   char *tls_cert = NULL;
   char *tls_key = NULL;
+  char *tls_ca = NULL;
   int port = 8080;
 
   signal(SIGPIPE, SIG_IGN);
   for (int i = 1; i < argc; i++) {
-    if (strcmp(argv[i], "--stdio") == 0) {
+    if (strcmp(argv[i], "--help") == 0) {
+      print_server_usage();
+      return 0;
+    } else if (strcmp(argv[i], "--stdio") == 0) {
       io_set_fds(STDIN_FILENO, STDOUT_FILENO);
       handler(STDIN_FILENO);
       return 0;
@@ -139,10 +158,22 @@ int main(int argc, char *argv[]) {
       tls_cert = argv[++i];
     } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
       tls_key = argv[++i];
+    } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
+      tls_ca = argv[++i];
     } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
       port = atoi(argv[++i]);
+    } else if (argv[i][0] == '-') {
+      fprintf(stderr, "Unknown option: %s\n", argv[i]);
+      print_server_usage();
+      return 1;
     }
   }
+
+  if (port < 1 || port > 65535) {
+    fprintf(stderr, "Error: port must be between 1 and 65535\n");
+    return 1;
+  }
+
   signal(SIGINT, cleanup);
   signal(SIGTERM, cleanup);
   g_server = server_create(port);
@@ -157,7 +188,7 @@ int main(int argc, char *argv[]) {
       return 1;
     }
     tls_global_init();
-    if (!server_create_tls(g_server, tls_cert, tls_key)) {
+    if (!server_create_tls(g_server, tls_cert, tls_key, tls_ca)) {
       log_message(LOG_LEVEL_ERROR, "Failed to set up TLS");
       server_delete(&g_server);
       return 1;

src/shared/config.c

@@ -42,6 +42,7 @@ Config *config_create(char *version, char *send_directory,
   config->use_tls = false;
   config->tls_cert = NULL;
   config->tls_key = NULL;
+  config->tls_ca = NULL;
   return config;
 }
 
@@ -79,6 +80,7 @@ void config_delete(Config *config) {
   free(config->include_patterns);
   free(config->tls_cert);
   free(config->tls_key);
+  free(config->tls_ca);
   free(config);
 }
 
@@ -154,6 +156,10 @@ Config *config_receive(int file_descriptor) {
   config->include_count = 0;
   config->max_size = 0;
   config->min_size = 0;
+  config->use_tls = false;
+  config->tls_cert = NULL;
+  config->tls_key = NULL;
+  config->tls_ca = NULL;
   if (!send_status(file_descriptor, STATUS_OK)) goto error;
   return config;
 

src/shared/config.h

@@ -36,6 +36,7 @@ typedef struct Config {
   bool use_tls;
   char *tls_cert;
   char *tls_key;
+  char *tls_ca;
 } Config;
 
 #define PROTOCOL_VERSION "1.1.0"

src/shared/protocol.c

@@ -10,7 +10,7 @@
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
-static SSL *io_ssl = NULL;
+static __thread SSL *io_ssl = NULL;
 
 static unsigned long long io_bwlimit = 0;
 static long long bw_tokens = 0;

src/shared/transport_tcp.c

@@ -1,6 +1,7 @@
 #include "transport_tcp.h"
 #include "log.h"
 #include <arpa/inet.h>
+#include <openssl/ssl.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -52,43 +53,63 @@ Server *server_create(int port) {
 void server_delete(Server **server) {
   if (server == NULL || *server == NULL) return;
   close((*server)->file_descriptor);
+  if ((*server)->ssl_ctx) {
+    SSL_CTX_free((*server)->ssl_ctx);
+    (*server)->ssl_ctx = NULL;
+  }
   free(*server);
   *server = NULL;
 }
 
-bool server_listen(Server *server, void (*handler)(int file_descriptor)) {
+static void accept_loop(Server *server, void (*child_fn)(int, void *),
-  log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d",
+                        void *child_ctx, const char *log_fmt) {
-              server->address.sin_port);
   if (listen(server->file_descriptor, SOMAXCONN) < 0) {
     perror("Could not listen on port!");
-    return false;
+    return;
   }
-
   signal(SIGCHLD, SIG_IGN);
-
   while (1) {
     struct sockaddr_in client_addr;
     socklen_t client_len = sizeof(client_addr);
-    int file_descriptor =
+    int fd = accept(server->file_descriptor, (struct sockaddr *)&client_addr,
-        accept(server->file_descriptor, (struct sockaddr *)&client_addr,
+                    &client_len);
-               &client_len);
+    if (fd < 0) {
-    if (file_descriptor < 0) {
       perror("Could not accept the connection");
       continue;
     }
-    log_message(LOG_LEVEL_INFO, "Received Connection");
+    log_message(LOG_LEVEL_INFO, "%s", log_fmt);
     pid_t pid = fork();
     if (pid == 0) {
       close(server->file_descriptor);
-      handler(file_descriptor);
+      child_fn(fd, child_ctx);
-      close(file_descriptor);
+      close(fd);
       _exit(0);
     }
-    close(file_descriptor);
+    close(fd);
   }
+}
+
+struct plain_ctx { void (*handler)(int); };
+
+static void plain_child_fn(int fd, void *ctx) {
+  ((struct plain_ctx *)ctx)->handler(fd);
+}
+
+bool server_listen(Server *server, void (*handler)(int file_descriptor)) {
+  log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d",
+              ntohs(server->address.sin_port));
+  struct plain_ctx ctx = {handler};
+  accept_loop(server, plain_child_fn, &ctx, "Received Connection");
   return true;
 }
 
+void server_accept_loop(Server *server, void (*child_fn)(int, void *),
+                        void *child_ctx, const char *log_fmt) {
+  log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d",
+              ntohs(server->address.sin_port));
+  accept_loop(server, child_fn, child_ctx, log_fmt);
+}
+
 Client *client_create() {
   int file_descriptor = socket(AF_INET, SOCK_STREAM, 0);
   if (file_descriptor < 0) {
@@ -127,6 +148,11 @@ bool client_connect(Client *client, char *host, int port) {
 }
 
 void client_disconnect(Client *client) {
+  if (client->ssl) {
+    SSL_shutdown(client->ssl);
+    SSL_free(client->ssl);
+    client->ssl = NULL;
+  }
   close(client->file_descriptor);
   if (client->ssh_child_pid > 0) {
     int status;
@@ -136,7 +162,10 @@ void client_disconnect(Client *client) {
 }
 
 void client_delete(Client *client) {
-  if (client == NULL)
+  if (client == NULL) return;
-    return;
+  if (client->ssl_ctx) {
+    SSL_CTX_free(client->ssl_ctx);
+    client->ssl_ctx = NULL;
+  }
   free(client);
 }

src/shared/transport_tcp.h

@@ -23,6 +23,8 @@ typedef struct Client {
 
 Server *server_create(int port);
 bool server_listen(Server *server, void (*handler)(int file_descriptor));
+void server_accept_loop(Server *server, void (*child_fn)(int, void *),
+                        void *child_ctx, const char *log_fmt);
 void server_delete(Server **server);
 Client *client_create();
 bool client_connect(Client *client, char *host, int port);

src/shared/transport_tls.c

@@ -1,6 +1,7 @@
 #include "transport_tls.h"
 #include "log.h"
 #include "protocol.h"
+#include "transport_tcp.h"
 #include <arpa/inet.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
@@ -12,52 +13,69 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-static SSL_CTX *g_ssl_ctx = NULL;
-
 bool tls_global_init(void) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
   SSL_library_init();
   OpenSSL_add_all_algorithms();
   SSL_load_error_strings();
+#endif
   return true;
 }
 
-void tls_global_cleanup(void) {
+static void log_ssl_errors(void) {
-  if (g_ssl_ctx) {
+  unsigned long err;
-    SSL_CTX_free(g_ssl_ctx);
+  char buf[256];
-    g_ssl_ctx = NULL;
+  while ((err = ERR_get_error()) != 0) {
+    ERR_error_string_n(err, buf, sizeof(buf));
+    log_message(LOG_LEVEL_ERROR, "SSL error: %s", buf);
   }
-  EVP_cleanup();
 }
 
-static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert, const char *key) {
+static SSL_CTX *create_ssl_ctx(bool is_server, const char *cert,
-  const SSL_METHOD *method = is_server ? TLS_server_method() : TLS_client_method();
+                                const char *key, const char *ca_path) {
+  const SSL_METHOD *method =
+      is_server ? TLS_server_method() : TLS_client_method();
   SSL_CTX *ctx = SSL_CTX_new(method);
   if (!ctx) {
     log_message(LOG_LEVEL_ERROR, "Unable to create SSL context");
-    ERR_print_errors_fp(stderr);
+    log_ssl_errors();
     return NULL;
   }
 
+  SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
+
   if (cert && key) {
     if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) {
       log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert);
-      ERR_print_errors_fp(stderr);
+      log_ssl_errors();
       SSL_CTX_free(ctx);
       return NULL;
     }
     if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) {
       log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key);
-      ERR_print_errors_fp(stderr);
+      log_ssl_errors();
       SSL_CTX_free(ctx);
       return NULL;
     }
     if (!SSL_CTX_check_private_key(ctx)) {
-      log_message(LOG_LEVEL_ERROR, "Private key does not match certificate");
+      log_message(LOG_LEVEL_ERROR,
+                  "Private key does not match certificate");
       SSL_CTX_free(ctx);
       return NULL;
     }
   }
 
+  if (ca_path) {
+    if (!SSL_CTX_load_verify_locations(ctx, ca_path, NULL)) {
+      log_message(LOG_LEVEL_ERROR, "Failed to load CA: %s", ca_path);
+      log_ssl_errors();
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
+    SSL_CTX_set_verify_depth(ctx, 4);
+  }
+
   return ctx;
 }
 
@@ -75,78 +93,60 @@ static SSL *wrap_fd_with_ssl(int fd, SSL_CTX *ctx, bool is_server) {
     ret = SSL_connect(ssl);
 
   if (ret <= 0) {
-    log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect");
+    log_message(LOG_LEVEL_ERROR, "SSL %s failed",
-    ERR_print_errors_fp(stderr);
+                is_server ? "accept" : "connect");
+    log_ssl_errors();
     SSL_free(ssl);
     return NULL;
   }
   return ssl;
 }
 
-bool server_create_tls(Server *server, const char *cert_path, const char *key_path) {
+bool server_create_tls(Server *server, const char *cert_path,
-  SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path);
+                        const char *key_path, const char *ca_path) {
+  SSL_CTX *ctx = create_ssl_ctx(true, cert_path, key_path, ca_path);
   if (!ctx) return false;
   server->ssl_ctx = ctx;
   return true;
 }
 
+struct tls_child_ctx {
+  void (*handler)(int);
+  SSL_CTX *ssl_ctx;
+};
+
+static void tls_child_fn(int fd, void *arg) {
+  struct tls_child_ctx *ctx = (struct tls_child_ctx *)arg;
+  SSL *ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true);
+  if (!ssl) return;
+  io_set_ssl(ssl);
+  ctx->handler(fd);
+  SSL_shutdown(ssl);
+  SSL_free(ssl);
+  io_set_ssl(NULL);
+}
+
 bool server_listen_tls(Server *server, void (*handler)(int file_descriptor)) {
-  log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d",
+  struct tls_child_ctx ctx = {handler, (SSL_CTX *)server->ssl_ctx};
-              ntohs(server->address.sin_port));
+  server_accept_loop(server, tls_child_fn, &ctx, "Received TLS Connection");
-  if (listen(server->file_descriptor, SOMAXCONN) < 0) {
-    perror("Could not listen on port!");
-    return false;
-  }
-
-  signal(SIGCHLD, SIG_IGN);
-
-  while (1) {
-    struct sockaddr_in client_addr;
-    socklen_t client_len = sizeof(client_addr);
-    int file_descriptor =
-        accept(server->file_descriptor, (struct sockaddr *)&client_addr,
-               &client_len);
-    if (file_descriptor < 0) {
-      perror("Could not accept the connection");
-      continue;
-    }
-    log_message(LOG_LEVEL_INFO, "Received TLS Connection");
-    pid_t pid = fork();
-    if (pid == 0) {
-      close(server->file_descriptor);
-
-      SSL *ssl = wrap_fd_with_ssl(file_descriptor, (SSL_CTX *)server->ssl_ctx, true);
-      if (!ssl) {
-        close(file_descriptor);
-        _exit(1);
-      }
-      io_set_ssl(ssl);
-      handler(file_descriptor);
-      SSL_shutdown(ssl);
-      SSL_free(ssl);
-      io_set_ssl(NULL);
-      close(file_descriptor);
-      _exit(0);
-    }
-    close(file_descriptor);
-  }
   return true;
 }
 
 bool client_connect_tls(Client *client, char *host, int port,
-                        const char *cert_path, const char *key_path) {
+                         const char *cert_path, const char *key_path,
+                         const char *ca_path) {
   client->address.sin_port = htons(port);
   if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
     perror("Could not convert host address!");
     return false;
   }
   if (connect(client->file_descriptor, (struct sockaddr *)&client->address,
-              client->address_length) < 0) {
+               client->address_length) < 0) {
     perror("Could not connect to Server!");
     return false;
   }
 
-  SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path);
+  SSL_CTX *ctx = create_ssl_ctx(false, cert_path, key_path, ca_path);
   if (!ctx) return false;
   client->ssl_ctx = ctx;
 

src/shared/transport_tls.h

@@ -5,10 +5,12 @@
 #include <stdbool.h>
 
 bool tls_global_init(void);
-void tls_global_cleanup(void);
 
-bool server_create_tls(Server *server, const char *cert_path, const char *key_path);
+bool server_create_tls(Server *server, const char *cert_path,
+                        const char *key_path, const char *ca_path);
 bool server_listen_tls(Server *server, void (*handler)(int file_descriptor));
-bool client_connect_tls(Client *client, char *host, int port, const char *cert_path, const char *key_path);
+bool client_connect_tls(Client *client, char *host, int port,
+                         const char *cert_path, const char *key_path,
+                         const char *ca_path);
 
 #endif