lib/tls.c
/*- Initialize a configuration for TLS or DTLS
 *
 * This function will initialize the handle for TLS or DTLS.
 *
 * @param rh a handle to parsed configuration
 * @param flags must be zero or SEC_FLAG_DTLS
 * @return 0 on success, -1 on failure.
 -*/
Initialize a configuration for TLS or DTLS
This function will initialize the handle for TLS or DTLS.

@param rh a handle to parsed configuration
@param flags must be zero or SEC_FLAG_DTLS
@return 0 on success, -1 on failure.
Initialize a configuration for TLS or DTLS This function will initialize the handle for TLS or DTLS . @param rh a handle to parsed configuration @param flags must be zero or SEC_FLAG_DTLS @return 0 on success - 1 on failure .
int rc_init_tls(rc_handle * rh, unsigned flags)
{
	int ret;
	tls_st *st = NULL;
	SSL_CTX *ssl_ctx = NULL;
	SSL *ssl = NULL;
	struct sockaddr_storage our_sockaddr;
	const char *ca_file = rc_conf_str(rh, "tls-ca-file");
	SERVER *authservers;
	char hostname[256];	
	unsigned port;		
	memset(&rh->so, 0, sizeof(rh->so));
	if (flags & SEC_FLAG_DTLS) {
		rh->so_type = RC_SOCKET_DTLS;
		rh->so.static_secret = DEFAULT_DTLS_SECRET;
	} else {
		rh->so_type = RC_SOCKET_TLS;
		rh->so.static_secret = DEFAULT_TLS_SECRET;
	}
	rc_own_bind_addr(rh, &our_sockaddr);
	ssl_ctx = init_ssl();
	st = calloc(1, sizeof(tls_st));
	if (st == NULL) {
		ret = -1;
		goto cleanup;
	}
	st->rh = rh;
	st->flags = flags;
	rh->so.ptr = st;
	if (ca_file) {
		if (set_trust_file(ca_file, ssl_ctx) < 0) {
			rc_log(LOG_ERR, "%s: error in ca verify location", __func__);
			ret = -1;
			goto cleanup;
		}
	} else { 
		SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_NONE, NULL);
	}
	st->ctx.ssl = SSL_new(ssl_ctx);
	authservers = rc_conf_srv(rh, "authserver");
	if (authservers == NULL) {
		rc_log(LOG_ERR,
		       "%s: cannot find authserver", __func__);
		ret = -1;
		goto cleanup;
	}
	if (authservers->max > 1) {
		ret = -1;
		rc_log(LOG_ERR,
		       "%s: too many auth servers for TLS/DTLS; only one is allowed",
		       __func__);
		goto cleanup;
	}
	strlcpy(hostname, authservers->name[0], sizeof(hostname));
	port = authservers->port[0];
	ret = init_session(rh, &st->ctx, hostname, port, &our_sockaddr, 0, flags);
	if (ret < 0) {
		ret = -1;
		goto cleanup;
	}
	rh->so.get_fd = tls_get_fd;
	rh->so.sendto = tls_sendto;
	rh->so.recvfrom = tls_recvfrom;
	rh->so.lock = tls_lock;
	rh->so.unlock = tls_unlock;
	return 0;
cleanup:
	if (st) {
		if (st->ctx.init != 0)
			deinit_session(&st->ctx);
	}
	free(st);
	return ret;
}
int rc_init_tls ( rc_handle * rh , unsigned flags ) { int ret ; tls_st * st = NULL ; SSL_CTX * ssl_ctx = NULL ; SSL * ssl = NULL ; struct sockaddr_storage our_sockaddr ; const char * ca_file = rc_conf_str ( rh , " " ) ; SERVER * authservers ; char hostname [ 256 ] ; unsigned port ; memset ( & rh -> so , 0 , sizeof ( rh -> so ) ) ; if ( flags & SEC_FLAG_DTLS ) { rh -> so_type = RC_SOCKET_DTLS ; rh -> so . static_secret = DEFAULT_DTLS_SECRET ; } else { rh -> so_type = RC_SOCKET_TLS ; rh -> so . static_secret = DEFAULT_TLS_SECRET ; } rc_own_bind_addr ( rh , & our_sockaddr ) ; ssl_ctx = init_ssl ( ) ; st = calloc ( 1 , sizeof ( tls_st ) ) ; if ( st == NULL ) { ret = -1 ; goto cleanup ; } st -> rh = rh ; st -> flags = flags ; rh -> so . ptr = st ; if ( ca_file ) { if ( set_trust_file ( ca_file , ssl_ctx ) < 0 ) { rc_log ( LOG_ERR , " " , __func__ ) ; ret = -1 ; goto cleanup ; } } else { SSL_CTX_set_verify ( ssl_ctx , SSL_VERIFY_NONE , NULL ) ; } st -> ctx . ssl = SSL_new ( ssl_ctx ) ; authservers = rc_conf_srv ( rh , " " ) ; if ( authservers == NULL ) { rc_log ( LOG_ERR , " " , __func__ ) ; ret = -1 ; goto cleanup ; } if ( authservers -> max > 1 ) { ret = -1 ; rc_log ( LOG_ERR , " " , __func__ ) ; goto cleanup ; } strlcpy ( hostname , authservers -> name [ 0 ] , sizeof ( hostname ) ) ; port = authservers -> port [ 0 ] ; ret = init_session ( rh , & st -> ctx , hostname , port , & our_sockaddr , 0 , flags ) ; if ( ret < 0 ) { ret = -1 ; goto cleanup ; } rh -> so . get_fd = tls_get_fd ; rh -> so . sendto = tls_sendto ; rh -> so . recvfrom = tls_recvfrom ; rh -> so . lock = tls_lock ; rh -> so . unlock = tls_unlock ; return 0 ; cleanup : if ( st ) { if ( st -> ctx . init != 0 ) deinit_session ( & st -> ctx ) ; } free ( st ) ; return ret ; }
Initialize a configuration for TLS or DTLS
 This function will initialize the handle for TLS or DTLS.
Initialize a configuration for TLS or DTLS This function will initialize the handle for TLS or DTLS .
/* server's hostname */ /* server's port */ /* Currently only verify server by using a provided ca file or skip server 
	 * verfication altogether.Also assume server does not require client 
	 * verification. If client verification is required, add support for 
	 * rc_conf_str(rh, "tls-cert-file") and rc_conf_str(rh, "tls-key-file")
	 */