From af90968d483248a66603058ff2c8632f573ec8b5 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Milo=C5=A1=20Mula=C4=8D?= Date: Thu, 18 Jan 2007 12:50:23 +0000 Subject: [PATCH] merge with 3.0 branch (merge_30_31_src2 - merge_30_31_src3) --- org.glite.lb.server/src/bkserverd.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/org.glite.lb.server/src/bkserverd.c b/org.glite.lb.server/src/bkserverd.c index d04f934..c2d6a26 100644 --- a/org.glite.lb.server/src/bkserverd.c +++ b/org.glite.lb.server/src/bkserverd.c @@ -742,17 +742,21 @@ int bk_handle_connection(int conn, struct timeval *timeout, void *data) +/* don't care :-( switch ( edg_wll_gss_watch_creds(server_cert, &cert_mtime) ) { case 0: break; case 1: +*/ if ( !edg_wll_gss_acquire_cred_gsi(server_cert, server_key, &newcred, NULL, &gss_code) ) { dprintf(("[%d] reloading credentials\n", getpid())); gss_release_cred(&min_stat, &mycred); mycred = newcred; - } else { dprintf(("[%d] reloading credentials failed\n", getpid())); } + } else { dprintf(("[%d] reloading credentials failed, using old ones\n", getpid())); } +/* break; case -1: dprintf(("[%d] edg_wll_gss_watch_creds failed\n", getpid())); break; } +*/ if ( edg_wll_InitContext(&ctx) ) { @@ -869,6 +873,12 @@ int bk_handle_connection(int conn, struct timeval *timeout, void *data) ctx->srvPort = ntohs(a.sin_port); } +/* XXX: ugly workaround, we may detect false expired certificated + * probably due to bug in Globus GSS/SSL. Treated as fatal, + * restarting the server solves the problem */ + +#define _EXPIRED_CERTIFICATE_MESSAGE "certificate has expired" + if ( (ret = edg_wll_gss_accept(mycred, conn, timeout, &ctx->connPool[ctx->connToUse].gss, &gss_code)) ) { if ( ret == EDG_WLL_GSS_ERROR_TIMEOUT ) @@ -876,6 +886,15 @@ int bk_handle_connection(int conn, struct timeval *timeout, void *data) dprintf(("[%d] Client authentication failed - timeout reached, closing.\n", getpid())); if (!debug) syslog(LOG_ERR, "Client authentication failed - timeout reached"); } + else if (ret == EDG_WLL_GSS_ERROR_GSS) { + edg_wll_SetErrorGss(ctx,"Client authentication",&gss_code); + if (strstr(ctx->errDesc,_EXPIRED_CERTIFICATE_MESSAGE)) { + dprintf(("[%d] false expired certificate: %s\n",ctx->errDesc)); + if (!debug) syslog(LOG_ERR,"false expired certificate: %s",ctx->errDesc); + edg_wll_FreeContext(ctx); + return -1; + } + } else { dprintf(("[%d] Client authentication failed, closing.\n", getpid())); -- 1.8.2.3