* When running on the same host as Citadel, if no key/cert are found,

  symlink to Citadel's if possible.
* One server binary now forks to start both http and https servers.

diff --git a/webcit/ChangeLog b/webcit/ChangeLog
index 684084e92c0165f83358bb0eaaee677d6e9cee15..5061f6e6d1b552a31ae5a94ccd4cdf2985b3f023 100644 (file)
--- a/webcit/ChangeLog
+++ b/webcit/ChangeLog
@@ -1,4 +1,9 @@
 $Log$
+Revision 506.11  2004/04/27 03:16:31  ajc
+* When running on the same host as Citadel, if no key/cert are found,
+  symlink to Citadel's if possible.
+* One server binary now forks to start both http and https servers.
+
 Revision 506.10  2004/04/21 03:43:39  ajc
 * Completed remaining SSL fixes.  Works in Moz, aIEeee, Konq; self-signed
   certs are also no longer invalid.
@@ -1794,3 +1799,4 @@ Sun Dec  6 19:50:55 EST 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
 
 1998-12-03 Nathan Bryant <bryant@cs.usm.maine.edu>
        * webserver.c: warning fix
+

diff --git a/webcit/README.txt b/webcit/README.txt
index 7ade2798309b47657d35094e8b6955ea6abef6b8..68bd06a33e89e3266af0e6909becf72a106e6b58 100644 (file)
--- a/webcit/README.txt
+++ b/webcit/README.txt
@@ -66,21 +66,28 @@ something like this:
  Several command-line options are also available.  Here's the usage for
 the "webserver" program:
   
- webserver [-p localport] [-t tracefile] [-c] [remotehost [remoteport]]
+ webserver [-p http_port] [-s https_port] [-t tracefile]
+           [-c] [remotehost [remoteport]]
  
    *or*
  
- webserver [-p localport] [-t tracefile] [-c] uds /your/citadel/directory
+ webserver [-p http_port] [-s https_port] [-t tracefile]
+           [-c] uds /your/citadel/directory
  
  Explained: 
   
-  -> localport: the TCP port on which you wish your WebCit server to run.
+  -> http_port: the TCP port on which you wish your WebCit server to run.
      this can be any port number at all; there is no standard.  Naturally,
      you'll want to create a link to this port on your system's regular web
      pages (presumably on an Apache server running on port 80).  Or, if you
      are installing WebCit on a dedicated server, then you might choose to
      use port 80 after all.
  
+  -> https_port: an optional TCP port on which you wish your WebCit server
+     to run an SSL-encrypted web service.  The standard port number for this
+     is 443, and if you're not already running a secure web server you might
+     choose to use that port.  Otherwise, select any free port number.
+ 
   -> tracefile: where you want WebCit to log to.  This can be a file, a
      virtual console, or /dev/null to suppress logging altogether.
  

diff --git a/webcit/crypto.c b/webcit/crypto.c
index d74c6b17dfcfc8821651572f1592e51d47dc3abe..36e7f8427a99b28e281d9aa483eca0e86f5666d8 100644 (file)
--- a/webcit/crypto.c
+++ b/webcit/crypto.c
@@ -48,6 +48,7 @@ void init_ssl(void)
        EVP_PKEY *req_pkey = NULL;
        X509_NAME *name = NULL;
        FILE *fp;
+       char buf[SIZ];
 
        if (!access("/var/run/egd-pool", F_OK))
                RAND_egd("/var/run/egd-pool");
@@ -127,7 +128,24 @@ void init_ssl(void)
        mkdir(CTDL_CRYPTO_DIR, 0700);
 
        /*
-        * Generate a key pair if we don't have one.
+        * Before attempting to generate keys/certificates, first try
+        * link to them from the Citadel server if it's on the same host.
+        * We ignore any error return because it either meant that there
+        * was nothing in Citadel to link from (in which case we just
+        * generate new files) or the target files already exist (which
+        * is not fatal either).
+        */
+       if (!strcasecmp(ctdlhost, "uds")) {
+               sprintf(buf, "%s/keys/citadel.key", ctdlport);
+               symlink(buf, CTDL_KEY_PATH);
+               sprintf(buf, "%s/keys/citadel.csr", ctdlport);
+               symlink(buf, CTDL_CSR_PATH);
+               sprintf(buf, "%s/keys/citadel.cer", ctdlport);
+               symlink(buf, CTDL_CER_PATH);
+       }
+
+       /*
+        * If we still don't have a private key, generate one.
         */
        if (access(CTDL_KEY_PATH, R_OK) != 0) {
                lprintf(5, "Generating RSA key pair.\n");

diff --git a/webcit/webserver.c b/webcit/webserver.c
index 07e10504fb792039a601e31c73d89e05d62df5ff..507d0ac8402be051dde60d056a8b00f56e6ed2d6 100644 (file)
--- a/webcit/webserver.c
+++ b/webcit/webserver.c
@@ -246,11 +246,12 @@ int main(int argc, char **argv)
        pthread_attr_t attr;    /* Thread attributes */
        int a, i;               /* General-purpose variables */
        int port = PORT_NUM;    /* Port to listen on */
+       int https_port = (-1);
        char tracefile[PATH_MAX];
 
        /* Parse command line */
 #ifdef HAVE_OPENSSL
-       while ((a = getopt(argc, argv, "hp:t:cs")) != EOF)
+       while ((a = getopt(argc, argv, "hp:t:cs:")) != EOF)
 #else
        while ((a = getopt(argc, argv, "hp:t:c")) != EOF)
 #endif
@@ -281,13 +282,13 @@ int main(int argc, char **argv)
                        }
                        break;
                case 's':
-                       is_https = 1;
+                       https_port = atoi(optarg);
                        break;
                default:
-                       fprintf(stderr, "usage: webserver [-p localport] "
+                       fprintf(stderr, "usage: webserver [-p http_port] "
                                "[-t tracefile] [-c] "
 #ifdef HAVE_OPENSSL
-                               "[-s] "
+                               "[-s https_port] "
 #endif
                                "[remotehost [remoteport]]\n");
                        return 1;
@@ -307,6 +308,16 @@ int main(int argc, char **argv)
        if (chdir(WEBCITDIR) != 0)
                perror("chdir");
 
+       /*
+        * If an HTTPS port was specified, fork an HTTPS server.
+        */
+       if (https_port > 0) {
+               if (fork() == 0) {
+                       is_https = 1;
+                       port = https_port;
+               }
+       }
+
         /*
          * Set up a place to put thread-specific data.
          * We only need a single pointer per thread - it points to the