Merge pull request #5320

2e578b82 Enabling daemon-rpc SSL now requires non-system CA verification (Lee Clagett)
d58f3682 Require manual override for user chain certificates. (Lee Clagett)
97cd1fa9 Only check top-level certificate against fingerprint list. (Lee Clagett)
7c388fb3 Call `use_certificate_chain_file` instead of `use_certificate_file` (Lee Clagett)
eca0fea4 Perform RFC 2818 hostname verification in client SSL handshakes (Lee Clagett)
0416764c Require server verification when SSL is enabled. (Lee Clagett)
96d602ac Add `verify_fail_if_no_cert` option for proper client authentication (Lee Clagett)
21eb1b07 Pass SSL arguments via one class and use shared_ptr instead of reference (Lee Clagett)
1f5ed328 Change default SSL to "enabled" if user specifies fingerprint/certificate (Lee Clagett)
f18a069f Do not require client certificate unless server has some whitelisted. (Lee Clagett)
a3b02848 Change SSL certificate file list to OpenSSL builtin load_verify_location (Lee Clagett)

1 files changed, 27 insertions, 20 deletions

diff --git a/contrib/epee/src/connection_basic.cpp b/contrib/epee/src/connection_basic.cpp
index cafc08ead..19f2c7b02 100644
--- a/contrib/epee/src/connection_basic.cpp
+++ b/contrib/epee/src/connection_basic.cpp
@@ -65,6 +65,15 @@ namespace epee
 namespace net_utils
 {
 
+namespace
+{
+	boost::asio::ssl::context& get_context(connection_basic_shared_state* state)
+	{
+		CHECK_AND_ASSERT_THROW_MES(state != nullptr, "state shared_ptr cannot be null");
+		return state->ssl_context;
+	}
+}
+
   std::string to_string(t_connection_type type)
   {
 	  if (type == e_connection_type_NET)
@@ -119,56 +128,54 @@ connection_basic_pimpl::connection_basic_pimpl(const std::string &name) : m_thro
 int connection_basic_pimpl::m_default_tos;
 
 // methods:
-connection_basic::connection_basic(boost::asio::ip::tcp::socket&& sock, boost::shared_ptr<socket_stats> stats, ssl_support_t ssl_support, ssl_context_t &ssl_context)
+connection_basic::connection_basic(boost::asio::ip::tcp::socket&& sock, boost::shared_ptr<connection_basic_shared_state> state, ssl_support_t ssl_support)
 	:
-	m_stats(std::move(stats)),
+	m_state(std::move(state)),
 	mI( new connection_basic_pimpl("peer") ),
 	strand_(GET_IO_SERVICE(sock)),
-	socket_(GET_IO_SERVICE(sock), ssl_context.context),
+	socket_(GET_IO_SERVICE(sock), get_context(m_state.get())),
 	m_want_close_connection(false),
 	m_was_shutdown(false),
-	m_ssl_support(ssl_support),
-	m_ssl_context(ssl_context)
+	m_ssl_support(ssl_support)
 {
 	// add nullptr checks if removed
-	CHECK_AND_ASSERT_THROW_MES(bool(m_stats), "stats shared_ptr cannot be null");
+	assert(m_state != nullptr); // release runtime check in get_context
 
         socket_.next_layer() = std::move(sock);
 
-	++(m_stats->sock_count); // increase the global counter
-	mI->m_peer_number = m_stats->sock_number.fetch_add(1); // use, and increase the generated number
+	++(m_state->sock_count); // increase the global counter
+	mI->m_peer_number = m_state->sock_number.fetch_add(1); // use, and increase the generated number
 
 	std::string remote_addr_str = "?";
 	try { boost::system::error_code e; remote_addr_str = socket().remote_endpoint(e).address().to_string(); } catch(...){} ;
 
-	_note("Spawned connection #"<<mI->m_peer_number<<" to " << remote_addr_str << " currently we have sockets count:" << m_stats->sock_count);
+	_note("Spawned connection #"<<mI->m_peer_number<<" to " << remote_addr_str << " currently we have sockets count:" << m_state->sock_count);
 }
 
-connection_basic::connection_basic(boost::asio::io_service &io_service, boost::shared_ptr<socket_stats> stats, ssl_support_t ssl_support, ssl_context_t &ssl_context)
+connection_basic::connection_basic(boost::asio::io_service &io_service, boost::shared_ptr<connection_basic_shared_state> state, ssl_support_t ssl_support)
 	:
-	m_stats(std::move(stats)),
+	m_state(std::move(state)),
 	mI( new connection_basic_pimpl("peer") ),
 	strand_(io_service),
-	socket_(io_service, ssl_context.context),
-	m_want_close_connection(false), 
+	socket_(io_service, get_context(m_state.get())),
+	m_want_close_connection(false),
 	m_was_shutdown(false),
-	m_ssl_support(ssl_support),
-	m_ssl_context(ssl_context)
+	m_ssl_support(ssl_support)
 {
 	// add nullptr checks if removed
-	CHECK_AND_ASSERT_THROW_MES(bool(m_stats), "stats shared_ptr cannot be null");
+	assert(m_state != nullptr); // release runtime check in get_context
 
-	++(m_stats->sock_count); // increase the global counter
-	mI->m_peer_number = m_stats->sock_number.fetch_add(1); // use, and increase the generated number
+	++(m_state->sock_count); // increase the global counter
+	mI->m_peer_number = m_state->sock_number.fetch_add(1); // use, and increase the generated number
 
 	std::string remote_addr_str = "?";
 	try { boost::system::error_code e; remote_addr_str = socket().remote_endpoint(e).address().to_string(); } catch(...){} ;
 
-	_note("Spawned connection #"<<mI->m_peer_number<<" to " << remote_addr_str << " currently we have sockets count:" << m_stats->sock_count);
+	_note("Spawned connection #"<<mI->m_peer_number<<" to " << remote_addr_str << " currently we have sockets count:" << m_state->sock_count);
 }
 
 connection_basic::~connection_basic() noexcept(false) {
-	--(m_stats->sock_count);
+	--(m_state->sock_count);
 
 	std::string remote_addr_str = "?";
 	try { boost::system::error_code e; remote_addr_str = socket().remote_endpoint(e).address().to_string(); } catch(...){} ;