Changeset 2971

Timestamp:

Oct 27, 2009 2:21:28 AM (14 years ago)

Author:

nanang

Message:

Ticket #957:

• Fixed SSL socket unit test issues (mostly on Linux platform): let OS manage the binding port (specify port to 0), use pj_sockaddr_get_len() instead of sizeof() for sockaddr size, DOS eol format for certificate and private key files.
• Temporary fix for SSL_CTX_use_certificate_chain_file() false error alarm (after previous OpenSSL handshake error), by clearing OpenSSL thread error queue in reset_ssl_sock_state()

Location:

pjproject/trunk/pjlib

Files:

• build/cacert.pem (modified) (1 prop)
• build/privkey.pem (modified) (1 prop)
• src/pj/ssl_sock_ossl.c (modified) (1 diff)
• src/pjlib-test/ssl_sock.c (modified) (8 diffs)

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -480 +480 @@
         ssock->sock = PJ_INVALID_SOCKET;
     }
+
+    /* Upon error, OpenSSL may leave any error description in the thread 
+     * error queue, which sometime may cause next call to SSL API returning
+     * false error alarm, e.g: in Linux, SSL_CTX_use_certificate_chain_file()
+     * returning false error after a handshake error (in different SSL_CTX!).
+     * For now, just clear thread error queue here.
+     */
+    ERR_clear_error();
 }
 

pjproject/trunk/pjlib/src/pjlib-test/ssl_sock.c

@@ -21 +21 @@
 #include <pjlib.h>
 
-#define ECHO_SERVER_NAME            "localhost"
-#define ECHO_SERVER_ADDR            "localhost"
-#define ECHO_SERVER_PORT            12345
-
-#define CERT_DIR                    "..\\build\\"
+
+#define CERT_DIR                    "../build/"
 #define CERT_CA_FILE                NULL
 #define CERT_FILE                   CERT_DIR "cacert.pem"
@@ -50 +47 @@
     if (status != PJ_SUCCESS) {
         app_perror("...FAILED to get available ciphers", status);
-        return -10;
+        return status;
     }
 
@@ -455 +452 @@
     struct test_state state_serv = { 0 };
     struct test_state state_cli = { 0 };
-    pj_sockaddr local_addr, rem_addr;
+    pj_sockaddr laddr, raddr;
     pj_str_t tmp_st;
     pj_ssl_cipher ciphers[1];
@@ -510 +507 @@
     }
 
-    pj_sockaddr_init(PJ_AF_INET, &local_addr, pj_strset2(&tmp_st, ECHO_SERVER_ADDR), ECHO_SERVER_PORT);
-    status = pj_ssl_sock_start_accept(ssock_serv, pool, &local_addr, sizeof(local_addr));
+    pj_sockaddr_init(PJ_AF_INET, &laddr, pj_strset2(&tmp_st, "127.0.0.1"), 0);
+    status = pj_ssl_sock_start_accept(ssock_serv, pool, &laddr, pj_sockaddr_get_len(&laddr));
     if (status != PJ_SUCCESS) {
         goto on_return;
@@ -542 +539 @@
     }
 
-    pj_sockaddr_init(PJ_AF_INET, &local_addr, pj_strset2(&tmp_st, "0.0.0.0"), 0);
-    pj_sockaddr_init(PJ_AF_INET, &rem_addr, pj_strset2(&tmp_st, ECHO_SERVER_ADDR), ECHO_SERVER_PORT);
-    status = pj_ssl_sock_start_connect(ssock_cli, pool, &local_addr, &rem_addr, sizeof(rem_addr));
+    {
+        pj_ssl_sock_info info;
+
+        pj_ssl_sock_get_info(ssock_serv, &info);
+        pj_sockaddr_cp(&raddr, &info.local_addr);
+    }
+
+    status = pj_ssl_sock_start_connect(ssock_cli, pool, &laddr, &raddr, pj_sockaddr_get_len(&raddr));
     if (status == PJ_SUCCESS) {
         ssl_on_connect_complete(ssock_cli, PJ_SUCCESS);
@@ -684 +686 @@
     param.cb.on_data_sent = &ssl_on_data_sent;
     param.ioqueue = ioqueue;
+    param.timer_heap = timer;
     param.timeout.sec = 0;
     param.timeout.msec = ms_timeout;
-    param.timer_heap = timer;
     pj_time_val_normalize(&param.timeout);
 
@@ -703 +705 @@
     }
 
-    pj_sockaddr_init(PJ_AF_INET, &listen_addr, pj_strset2(&tmp_st, ECHO_SERVER_ADDR), ECHO_SERVER_PORT);
-    status = pj_ssl_sock_start_accept(ssock_serv, pool, &listen_addr, sizeof(listen_addr));
-    if (status != PJ_SUCCESS) {
-        goto on_return;
+    pj_sockaddr_init(PJ_AF_INET, &listen_addr, pj_strset2(&tmp_st, "127.0.0.1"), 0);
+    status = pj_ssl_sock_start_accept(ssock_serv, pool, &listen_addr, pj_sockaddr_get_len(&listen_addr));
+    if (status != PJ_SUCCESS) {
+        goto on_return;
+    }
+
+    {
+        pj_ssl_sock_info info;
+
+        pj_ssl_sock_get_info(ssock_serv, &info);
+        pj_sockaddr_cp(&listen_addr, &info.local_addr);
     }
 
@@ -801 +810 @@
     PJ_LOG(3,("", "..echo test w/ incompatible ciphers"));
     ret = echo_test(PJ_SSL_SOCK_PROTO_DEFAULT, TLS_RSA_WITH_DES_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA);
-    if (ret == 0)
-        return -10;
+    if (ret != PJ_EEOF)
+        return ret;
 
     PJ_LOG(3,("", "..client non-SSL timeout in 5 secs"));