From fb955ef04f10dfedf061eb63824728b446d76bd4 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ale=C5=A1=20K=C5=99enek?= Date: Fri, 8 Dec 2006 12:40:18 +0000 Subject: [PATCH] - reload credentials on each new connection - terminate server slave on "certificate has expired" -- likely to be false --- org.glite.lb.server/src/bkserverd.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/org.glite.lb.server/src/bkserverd.c b/org.glite.lb.server/src/bkserverd.c index 1a34af5..215c679 100644 --- a/org.glite.lb.server/src/bkserverd.c +++ b/org.glite.lb.server/src/bkserverd.c @@ -699,17 +699,21 @@ int bk_handle_connection(int conn, struct timeval *timeout, void *data) +/* don't care :-( switch ( edg_wll_gss_watch_creds(server_cert, &cert_mtime) ) { case 0: break; case 1: +*/ if ( !edg_wll_gss_acquire_cred_gsi(server_cert, server_key, &newcred, NULL, &gss_code) ) { dprintf(("[%d] reloading credentials\n", getpid())); gss_release_cred(&min_stat, &mycred); mycred = newcred; - } else { dprintf(("[%d] reloading credentials failed\n", getpid())); } + } else { dprintf(("[%d] reloading credentials failed, using old ones\n", getpid())); } +/* break; case -1: dprintf(("[%d] edg_wll_gss_watch_creds failed\n", getpid())); break; } +*/ if ( edg_wll_InitContext(&ctx) ) { @@ -825,6 +829,12 @@ int bk_handle_connection(int conn, struct timeval *timeout, void *data) ctx->srvPort = ntohs(a.sin_port); } +/* XXX: ugly workaround, we may detect false expired certificated + * probably due to bug in Globus GSS/SSL. Treated as fatal, + * restarting the server solves the problem */ + +#define _EXPIRED_CERTIFICATE_MESSAGE "certificate has expired" + if ( (ret = edg_wll_gss_accept(mycred, conn, timeout, &ctx->connPool[ctx->connToUse].gss, &gss_code)) ) { if ( ret == EDG_WLL_GSS_ERROR_TIMEOUT ) @@ -832,6 +842,13 @@ int bk_handle_connection(int conn, struct timeval *timeout, void *data) dprintf(("[%d] Client authentication failed - timeout reached, closing.\n", getpid())); if (!debug) syslog(LOG_ERR, "Client authentication failed - timeout reached"); } + else if (ret == EDG_WLL_GSS_ERROR_GSS) { + edg_wll_SetErrorGss(ctx,"Client authentication",&gss_code); + if (strstr(ctx->errDesc,_EXPIRED_CERTIFICATE_MESSAGE)) { + edg_wll_FreeContext(ctx); + return -1; + } + } else { dprintf(("[%d] Client authentication failed, closing.\n", getpid())); -- 1.8.2.3