[Spice-devel] [PATCH 12/18] Move ssl_parameters to RedsState struct

[Frediano Ziglio]

From: Jonathon Jongsma <jjongsma at redhat.com>

Removing more global variables
---
 server/reds-private.h | 11 +++++++++
 server/reds.c         | 65 ++++++++++++++++++++++-----------------------------
 2 files changed, 39 insertions(+), 37 deletions(-)

diff --git a/server/reds-private.h b/server/reds-private.h
index 5042773..2a6f438 100644
--- a/server/reds-private.h
+++ b/server/reds-private.h
@@ -137,6 +137,15 @@ typedef struct RedsClientMonitorsConfig {
 
 typedef struct ChannelSecurityOptions ChannelSecurityOptions;
 
+typedef struct RedSSLParameters {
+    char keyfile_password[256];
+    char certs_file[256];
+    char private_key_file[256];
+    char ca_certificate_file[256];
+    char dh_key_file[256];
+    char ciphersuite[256];
+} RedSSLParameters;
+
 struct RedsState {
     int listen_socket;
     int secure_listen_socket;
@@ -225,6 +234,8 @@ struct RedsState {
     gboolean agent_copypaste;
     gboolean agent_file_xfer;
     gboolean exit_on_disconnect;
+
+    RedSSLParameters ssl_parameters;
 };
 
 #endif
diff --git a/server/reds.c b/server/reds.c
index b25a1be..14857c2 100644
--- a/server/reds.c
+++ b/server/reds.c
@@ -159,15 +159,6 @@ typedef struct RedLinkInfo {
     int skip_auth;
 } RedLinkInfo;
 
-typedef struct RedSSLParameters {
-    char keyfile_password[256];
-    char certs_file[256];
-    char private_key_file[256];
-    char ca_certificate_file[256];
-    char dh_key_file[256];
-    char ciphersuite[256];
-} RedSSLParameters;
-
 struct ChannelSecurityOptions {
     uint32_t channel_id;
     uint32_t options;
@@ -187,8 +178,6 @@ static VDIReadBuf *vdi_port_read_buf_get(RedsState *reds);
 static VDIReadBuf *vdi_port_read_buf_ref(VDIReadBuf *buf);
 static void vdi_port_read_buf_unref(RedsState *reds, VDIReadBuf *buf);
 
-static RedSSLParameters ssl_parameters;
-
 static ChannelSecurityOptions *reds_find_channel_security(RedsState *reds, int id)
 {
     ChannelSecurityOptions *now = reds->channels_security;
@@ -2611,7 +2600,8 @@ static int load_dh_params(SSL_CTX *ctx, char *file)
 /*The password code is not thread safe*/
 static int ssl_password_cb(char *buf, int size, int flags, void *userdata)
 {
-    char *pass = ssl_parameters.keyfile_password;
+    RedsState *reds = userdata;
+    char *pass = reds->ssl_parameters.keyfile_password;
     if (size < strlen(pass) + 1) {
         return (0);
     }
@@ -2686,31 +2676,32 @@ static int reds_init_ssl(RedsState *reds)
     SSL_CTX_set_options(reds->ctx, ssl_options);
 
     /* Load our keys and certificates*/
-    return_code = SSL_CTX_use_certificate_chain_file(reds->ctx, ssl_parameters.certs_file);
+    return_code = SSL_CTX_use_certificate_chain_file(reds->ctx, reds->ssl_parameters.certs_file);
     if (return_code == 1) {
-        spice_info("Loaded certificates from %s", ssl_parameters.certs_file);
+        spice_info("Loaded certificates from %s", reds->ssl_parameters.certs_file);
     } else {
-        spice_warning("Could not load certificates from %s", ssl_parameters.certs_file);
+        spice_warning("Could not load certificates from %s", reds->ssl_parameters.certs_file);
         return -1;
     }
 
     SSL_CTX_set_default_passwd_cb(reds->ctx, ssl_password_cb);
+    SSL_CTX_set_default_passwd_cb_userdata(reds->ctx, reds);
 
-    return_code = SSL_CTX_use_PrivateKey_file(reds->ctx, ssl_parameters.private_key_file,
+    return_code = SSL_CTX_use_PrivateKey_file(reds->ctx, reds->ssl_parameters.private_key_file,
                                               SSL_FILETYPE_PEM);
     if (return_code == 1) {
-        spice_info("Using private key from %s", ssl_parameters.private_key_file);
+        spice_info("Using private key from %s", reds->ssl_parameters.private_key_file);
     } else {
         spice_warning("Could not use private key file");
         return -1;
     }
 
     /* Load the CAs we trust*/
-    return_code = SSL_CTX_load_verify_locations(reds->ctx, ssl_parameters.ca_certificate_file, 0);
+    return_code = SSL_CTX_load_verify_locations(reds->ctx, reds->ssl_parameters.ca_certificate_file, 0);
     if (return_code == 1) {
-        spice_info("Loaded CA certificates from %s", ssl_parameters.ca_certificate_file);
+        spice_info("Loaded CA certificates from %s", reds->ssl_parameters.ca_certificate_file);
     } else {
-        spice_warning("Could not use CA file %s", ssl_parameters.ca_certificate_file);
+        spice_warning("Could not use CA file %s", reds->ssl_parameters.ca_certificate_file);
         return -1;
     }
 
@@ -2718,15 +2709,15 @@ static int reds_init_ssl(RedsState *reds)
     SSL_CTX_set_verify_depth(reds->ctx, 1);
 #endif
 
-    if (strlen(ssl_parameters.dh_key_file) > 0) {
-        if (load_dh_params(reds->ctx, ssl_parameters.dh_key_file) < 0) {
+    if (strlen(reds->ssl_parameters.dh_key_file) > 0) {
+        if (load_dh_params(reds->ctx, reds->ssl_parameters.dh_key_file) < 0) {
             return -1;
         }
     }
 
     SSL_CTX_set_session_id_context(reds->ctx, (const unsigned char *)"SPICE", 5);
-    if (strlen(ssl_parameters.ciphersuite) > 0) {
-        if (!SSL_CTX_set_cipher_list(reds->ctx, ssl_parameters.ciphersuite)) {
+    if (strlen(reds->ssl_parameters.ciphersuite) > 0) {
+        if (!SSL_CTX_set_cipher_list(reds->ctx, reds->ssl_parameters.ciphersuite)) {
             return -1;
         }
     }
@@ -3633,27 +3624,27 @@ SPICE_GNUC_VISIBLE int spice_server_set_tls(SpiceServer *s, int port,
     if (port < 0 || port > 0xffff) {
         return -1;
     }
-    memset(&ssl_parameters, 0, sizeof(ssl_parameters));
+    memset(&s->ssl_parameters, 0, sizeof(s->ssl_parameters));
 
     s->spice_secure_port = port;
-    g_strlcpy(ssl_parameters.ca_certificate_file, ca_cert_file,
-              sizeof(ssl_parameters.ca_certificate_file));
-    g_strlcpy(ssl_parameters.certs_file, certs_file,
-              sizeof(ssl_parameters.certs_file));
-    g_strlcpy(ssl_parameters.private_key_file, private_key_file,
-              sizeof(ssl_parameters.private_key_file));
+    g_strlcpy(s->ssl_parameters.ca_certificate_file, ca_cert_file,
+              sizeof(s->ssl_parameters.ca_certificate_file));
+    g_strlcpy(s->ssl_parameters.certs_file, certs_file,
+              sizeof(s->ssl_parameters.certs_file));
+    g_strlcpy(s->ssl_parameters.private_key_file, private_key_file,
+              sizeof(s->ssl_parameters.private_key_file));
 
     if (key_passwd) {
-        g_strlcpy(ssl_parameters.keyfile_password, key_passwd,
-                  sizeof(ssl_parameters.keyfile_password));
+        g_strlcpy(s->ssl_parameters.keyfile_password, key_passwd,
+                  sizeof(s->ssl_parameters.keyfile_password));
     }
     if (ciphersuite) {
-        g_strlcpy(ssl_parameters.ciphersuite, ciphersuite,
-                  sizeof(ssl_parameters.ciphersuite));
+        g_strlcpy(s->ssl_parameters.ciphersuite, ciphersuite,
+                  sizeof(s->ssl_parameters.ciphersuite));
     }
     if (dh_key_file) {
-        g_strlcpy(ssl_parameters.dh_key_file, dh_key_file,
-                  sizeof(ssl_parameters.dh_key_file));
+        g_strlcpy(s->ssl_parameters.dh_key_file, dh_key_file,
+                  sizeof(s->ssl_parameters.dh_key_file));
     }
     return 0;
 }
-- 
2.4.3